{"sample_id": "788cf9f8c8cbda53843e060540f3e91a060eb744_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void term_exit(void)\n+\n {\n \n tcsetattr(0, TCSANOW, &oldtty);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void term_exit(void)\n\n{\n\n tcsetattr(0, TCSANOW, &oldtty);\n\n}\n"}} {"sample_id": "59c6178a54c414fd19e064f0077d00b82a1eb812_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n init_get_bits(&s->gb, avctx->extradata, avctx->extradata_size*8);\n \n+ metadata_parse(s);\n+\n+ }\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int flac_decode_init(AVCodecContext *avctx)\n\n{\n\n FLACContext *s = avctx->priv_data;\n\n s->avctx = avctx;\n\n\n\n avctx->sample_fmt = SAMPLE_FMT_S16;\n\n\n\n if (avctx->extradata_size > 4) {\n\n /* initialize based on the demuxer-supplied streamdata header */\n\n if (avctx->extradata_size == FLAC_STREAMINFO_SIZE) {\n\n ff_flac_parse_streaminfo(avctx, (FLACStreaminfo *)s,\n\n avctx->extradata);\n\n allocate_buffers(s);\n\n } else {\n\n init_get_bits(&s->gb, avctx->extradata, avctx->extradata_size*8);\n\n metadata_parse(s);\n\n }\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "e864cabdc0a38bb598ddcf88b264896dc6f3e3b2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n union {\n+\n double d;\n \n uint64_t i;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-89", "target_file": "source.c", "files": {"source.c": "void do_fctiw (void)\n\n{\n\n union {\n\n double d;\n\n uint64_t i;\n\n } p;\n\n\n\n /* XXX: higher bits are not supposed to be significant.\n\n * to make tests easier, return the same as a real PowerPC 750 (aka G3)\n\n */\n\n p.i = float64_to_int32(FT0, &env->fp_status);\n\n p.i |= 0xFFF80000ULL << 32;\n\n FT0 = p.d;\n\n}\n"}} {"sample_id": "245f7b51c0ea04fb2224b1127430a096c91aee70_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n {\n \n int max_rows;\n+\n+\n+\n+ if (vs->clientds.pf.bytes_per_pixel == 4 && vs->clientds.pf.rmax == 0xFF &&\n+\n vs->clientds.pf.bmax == 0xFF && vs->clientds.pf.gmax == 0xFF) {\n \n vs->tight_pixel24 = true;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int vnc_tight_send_framebuffer_update(VncState *vs, int x, int y,\n\n int w, int h)\n\n{\n\n int max_rows;\n\n\n\n if (vs->clientds.pf.bytes_per_pixel == 4 && vs->clientds.pf.rmax == 0xFF &&\n\n vs->clientds.pf.bmax == 0xFF && vs->clientds.pf.gmax == 0xFF) {\n\n vs->tight_pixel24 = true;\n\n } else {\n\n vs->tight_pixel24 = false;\n\n }\n\n\n\n if (w * h < VNC_TIGHT_MIN_SPLIT_RECT_SIZE)\n\n return send_rect_simple(vs, x, y, w, h);\n\n\n\n /* Calculate maximum number of rows in one non-solid rectangle. */\n\n\n\n max_rows = tight_conf[vs->tight_compression].max_rect_size;\n\n max_rows /= MIN(tight_conf[vs->tight_compression].max_rect_width, w);\n\n\n\n return find_large_solid_color_rect(vs, x, y, w, h, max_rows);\n\n}\n"}} {"sample_id": "934982c4ace1a3d5d627b518782ed092a456c49e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -66,11 +66,11 @@\n \n \n \n+ /* return image */\n+\n+ *data_size = sizeof(AVFrame);\n+\n+ *(AVFrame*)data= s->picture;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int dvvideo_decode_frame(AVCodecContext *avctx, \n\n void *data, int *data_size,\n\n uint8_t *buf, int buf_size)\n\n{\n\n DVVideoContext *s = avctx->priv_data;\n\n \n\n /* special case for last picture */\n\n if(buf_size==0)\n\n return 0;\n\n \n\n s->sys = dv_frame_profile(buf);\n\n if (!s->sys || buf_size < s->sys->frame_size)\n\n return -1; /* NOTE: we only accept several full frames */\n\n\n\n if(s->picture.data[0])\n\n avctx->release_buffer(avctx, &s->picture);\n\n \n\n s->picture.reference = 0;\n\n avctx->pix_fmt = s->sys->pix_fmt;\n\n avctx->width = s->sys->width;\n\n avctx->height = s->sys->height;\n\n if(avctx->get_buffer(avctx, &s->picture) < 0) {\n\n av_log(avctx, AV_LOG_ERROR, \"get_buffer() failed\\n\");\n\n return -1;\n\n }\n\n s->picture.interlaced_frame = 1;\n\n s->picture.top_field_first = 0;\n\n\n\n s->buf = buf;\n\n avctx->execute(avctx, dv_decode_mt, (void**)&dv_anchor[0], NULL, \n\n\t s->sys->difseg_size * 27);\n\n \n\n emms_c();\n\n\n\n /* return image */\n\n *data_size = sizeof(AVFrame);\n\n *(AVFrame*)data= s->picture;\n\n \n\n return s->sys->frame_size;\n\n}\n"}} {"sample_id": "d9a3b33d2c9f996537b7f1d0246dee2d0120cefb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void acpi_gpe_init(ACPIREGS *ar, uint8_t len)\n \n+{\n+\n ar->gpe.len = len;\n \n ar->gpe.sts = g_malloc0(len / 2);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void acpi_gpe_init(ACPIREGS *ar, uint8_t len)\n\n{\n\n ar->gpe.len = len;\n\n ar->gpe.sts = g_malloc0(len / 2);\n\n ar->gpe.en = g_malloc0(len / 2);\n\n}\n"}} {"sample_id": "b3a2319792ad5c0f0f8c3d2f4d02b95fd7efbc69_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n SLAVIO_INTCTLState *s = opaque;\n+\n+\n+\n+ DPRINTF(\"Set cpu %d irq %d level %d\\n\", s->target_cpu, irq, level);\n+\n if (irq < 32) {\n \n \tuint32_t mask = 1 << irq;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void slavio_set_irq(void *opaque, int irq, int level)\n\n{\n\n SLAVIO_INTCTLState *s = opaque;\n\n\n\n DPRINTF(\"Set cpu %d irq %d level %d\\n\", s->target_cpu, irq, level);\n\n if (irq < 32) {\n\n\tuint32_t mask = 1 << irq;\n\n\tuint32_t pil = s->intbit_to_level[irq];\n\n\tif (pil > 0) {\n\n\t if (level) {\n\n\t\ts->intregm_pending |= mask;\n\n\t\ts->intreg_pending[s->target_cpu] |= 1 << pil;\n\n\t\tslavio_check_interrupts(s);\n\n\t }\n\n\t else {\n\n\t\ts->intregm_pending &= ~mask;\n\n\t\ts->intreg_pending[s->target_cpu] &= ~(1 << pil);\n\n\t }\n\n\t}\n\n }\n\n}\n"}} {"sample_id": "ad96090a01d848df67d70c5259ed8aa321fa8716_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n #if defined(cpudef_setup)\n \n+ cpudef_setup(); /* parse cpu definitions in target config file */\n+\n #endif\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void cpudef_init(void)\n\n{\n\n#if defined(cpudef_setup)\n\n cpudef_setup(); /* parse cpu definitions in target config file */\n\n#endif\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_130", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n #endif\n \n+\n+\n+ while (len) {\n+\n+ if (dma->translate(dma, addr, &paddr, &plen, dir) != 0) {\n \n return false;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool iommu_dma_memory_valid(DMAContext *dma, dma_addr_t addr, dma_addr_t len,\n\n DMADirection dir)\n\n{\n\n target_phys_addr_t paddr, plen;\n\n\n\n#ifdef DEBUG_IOMMU\n\n fprintf(stderr, \"dma_memory_check context=%p addr=0x\" DMA_ADDR_FMT\n\n \" len=0x\" DMA_ADDR_FMT \" dir=%d\\n\", dma, addr, len, dir);\n\n#endif\n\n\n\n while (len) {\n\n if (dma->translate(dma, addr, &paddr, &plen, dir) != 0) {\n\n return false;\n\n }\n\n\n\n /* The translation might be valid for larger regions. */\n\n if (plen > len) {\n\n plen = len;\n\n }\n\n\n\n len -= plen;\n\n addr += plen;\n\n }\n\n\n\n return true;\n\n}\n"}} {"sample_id": "72902672dc2ed6281cdb205259c1d52ecf01f6b2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n+uint64_t HELPER(neon_sub_saturate_u64)(uint64_t src1, uint64_t src2)\n+\n+{\n+\n+ uint64_t res;\n \n+\n \n+ if (src1 < src2) {\n \n env->QF = 1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "uint64_t HELPER(neon_sub_saturate_u64)(uint64_t src1, uint64_t src2)\n\n{\n\n uint64_t res;\n\n\n\n if (src1 < src2) {\n\n env->QF = 1;\n\n res = 0;\n\n } else {\n\n res = src1 - src2;\n\n }\n\n return res;\n\n}\n"}} {"sample_id": "958c717df97ea9ca47a2253b8371130fe5f22980_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,5 +7,5 @@\n \n \n return client->recv_coroutine || client->nb_requests < MAX_NBD_REQUESTS;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int nbd_can_read(void *opaque)\n\n{\n\n NBDClient *client = opaque;\n\n\n\n return client->recv_coroutine || client->nb_requests < MAX_NBD_REQUESTS;\n\n}\n"}} {"sample_id": "73d60fa5fae60c8e07e1f295d8c7fd5d04320160_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void get_sensor_type(IPMIBmcSim *ibs,\n \n uint8_t *cmd, unsigned int cmd_len,\n+\n uint8_t *rsp, unsigned int *rsp_len,\n \n unsigned int max_rsp_len)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void get_sensor_type(IPMIBmcSim *ibs,\n\n uint8_t *cmd, unsigned int cmd_len,\n\n uint8_t *rsp, unsigned int *rsp_len,\n\n unsigned int max_rsp_len)\n\n{\n\n IPMISensor *sens;\n\n\n\n\n\n IPMI_CHECK_CMD_LEN(3);\n\n if ((cmd[2] > MAX_SENSORS) ||\n\n !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) {\n\n rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT;\n\n return;\n\n }\n\n sens = ibs->sensors + cmd[2];\n\n IPMI_ADD_RSP_DATA(sens->sensor_type);\n\n IPMI_ADD_RSP_DATA(sens->evt_reading_type_code);\n\n}\n"}} {"sample_id": "3fa8f263abf90650b62d43cb532cdb8cc5bd7c13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n \n \n if (!swr_is_initialized(s)) {\n+\n if ((ret = swr_config_frame(s, out, in)) < 0)\n \n return ret;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int swr_convert_frame(SwrContext *s,\n\n AVFrame *out, const AVFrame *in)\n\n{\n\n int ret, setup = 0;\n\n\n\n if (!swr_is_initialized(s)) {\n\n if ((ret = swr_config_frame(s, out, in)) < 0)\n\n return ret;\n\n if ((ret = swr_init(s)) < 0)\n\n return ret;\n\n setup = 1;\n\n } else {\n\n // return as is or reconfigure for input changes?\n\n if ((ret = config_changed(s, out, in)))\n\n return ret;\n\n }\n\n\n\n if (out) {\n\n if (!out->linesize[0]) {\n\n out->nb_samples = swr_get_delay(s, s->out_sample_rate)\n\n + in->nb_samples*(int64_t)s->out_sample_rate / s->in_sample_rate\n\n + 3;\n\n if ((ret = av_frame_get_buffer(out, 0)) < 0) {\n\n if (setup)\n\n swr_close(s);\n\n return ret;\n\n }\n\n } else {\n\n if (!out->nb_samples)\n\n out->nb_samples = available_samples(out);\n\n }\n\n }\n\n\n\n return convert_frame(s, out, in);\n\n}\n"}} {"sample_id": "6e746f30558cb1331598575918c2a8808be2a75b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n uint32_t mask;\n \n+ int rv, i;\n+\n+ struct model_features_t ft[] = {\n+\n+ {&guest_def->features, &host_def.features,\n \n ~0, feature_name, 0x00000000},\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int check_features_against_host(x86_def_t *guest_def)\n\n{\n\n x86_def_t host_def;\n\n uint32_t mask;\n\n int rv, i;\n\n struct model_features_t ft[] = {\n\n {&guest_def->features, &host_def.features,\n\n ~0, feature_name, 0x00000000},\n\n {&guest_def->ext_features, &host_def.ext_features,\n\n ~CPUID_EXT_HYPERVISOR, ext_feature_name, 0x00000001},\n\n {&guest_def->ext2_features, &host_def.ext2_features,\n\n ~PPRO_FEATURES, ext2_feature_name, 0x80000000},\n\n {&guest_def->ext3_features, &host_def.ext3_features,\n\n ~CPUID_EXT3_SVM, ext3_feature_name, 0x80000001}};\n\n\n\n cpu_x86_fill_host(&host_def);\n\n for (rv = 0, i = 0; i < ARRAY_SIZE(ft); ++i)\n\n for (mask = 1; mask; mask <<= 1)\n\n if (ft[i].check_feat & mask && *ft[i].guest_feat & mask &&\n\n !(*ft[i].host_feat & mask)) {\n\n unavailable_host_feature(&ft[i], mask);\n\n rv = 1;\n\n }\n\n return rv;\n\n}\n"}} {"sample_id": "8d04fb55dec381bc5105cb47f29d918e579e8cbd_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void ppc_set_irq(PowerPCCPU *cpu, int n_IRQ, int level)\n \n {\n+\n CPUState *cs = CPU(cpu);\n \n CPUPPCState *env = &cpu->env;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void ppc_set_irq(PowerPCCPU *cpu, int n_IRQ, int level)\n\n{\n\n CPUState *cs = CPU(cpu);\n\n CPUPPCState *env = &cpu->env;\n\n unsigned int old_pending = env->pending_interrupts;\n\n\n\n if (level) {\n\n env->pending_interrupts |= 1 << n_IRQ;\n\n cpu_interrupt(cs, CPU_INTERRUPT_HARD);\n\n } else {\n\n env->pending_interrupts &= ~(1 << n_IRQ);\n\n if (env->pending_interrupts == 0) {\n\n cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);\n\n }\n\n }\n\n\n\n if (old_pending != env->pending_interrupts) {\n\n#ifdef CONFIG_KVM\n\n kvmppc_set_interrupt(cpu, n_IRQ, level);\n\n#endif\n\n }\n\n\n\n LOG_IRQ(\"%s: %p n_IRQ %d level %d => pending %08\" PRIx32\n\n \"req %08x\\n\", __func__, env, n_IRQ, level,\n\n env->pending_interrupts, CPU(cpu)->interrupt_request);\n\n}\n"}} {"sample_id": "958c717df97ea9ca47a2253b8371130fe5f22980", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n rc = nbd_send_reply(csock, reply);\n \n+ } else {\n+\n+ socket_set_cork(csock, 1);\n+\n+ rc = nbd_send_reply(csock, reply);\n \n if (rc >= 0) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ssize_t nbd_co_send_reply(NBDRequest *req, struct nbd_reply *reply,\n\n int len)\n\n{\n\n NBDClient *client = req->client;\n\n int csock = client->sock;\n\n ssize_t rc, ret;\n\n\n\n qemu_co_mutex_lock(&client->send_lock);\n\n qemu_set_fd_handler2(csock, nbd_can_read, nbd_read,\n\n nbd_restart_write, client);\n\n client->send_coroutine = qemu_coroutine_self();\n\n\n\n if (!len) {\n\n rc = nbd_send_reply(csock, reply);\n\n } else {\n\n socket_set_cork(csock, 1);\n\n rc = nbd_send_reply(csock, reply);\n\n if (rc >= 0) {\n\n ret = qemu_co_send(csock, req->data, len);\n\n if (ret != len) {\n\n rc = -EIO;\n\n }\n\n }\n\n socket_set_cork(csock, 0);\n\n }\n\n\n\n client->send_coroutine = NULL;\n\n qemu_set_fd_handler2(csock, nbd_can_read, nbd_read, NULL, client);\n\n qemu_co_mutex_unlock(&client->send_lock);\n\n return rc;\n\n}\n"}} {"sample_id": "6bdc21c050a2a7b92cbbd0b2a1f8934e9b5f896f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -40,11 +40,11 @@\n \n len = sg[i].iov_len;\n \n+ sg[i].iov_base = dma_memory_map(vdev->dma_as,\n+\n+ addr[i], &len, is_write ?\n+\n+ DMA_DIRECTION_FROM_DEVICE :\n \n DMA_DIRECTION_TO_DEVICE);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtqueue_map_iovec(VirtIODevice *vdev, struct iovec *sg,\n\n hwaddr *addr, unsigned int *num_sg,\n\n unsigned int max_size, int is_write)\n\n{\n\n unsigned int i;\n\n hwaddr len;\n\n\n\n /* Note: this function MUST validate input, some callers\n\n * are passing in num_sg values received over the network.\n\n */\n\n /* TODO: teach all callers that this can fail, and return failure instead\n\n * of asserting here.\n\n * When we do, we might be able to re-enable NDEBUG below.\n\n */\n\n#ifdef NDEBUG\n\n#error building with NDEBUG is not supported\n\n#endif\n\n assert(*num_sg <= max_size);\n\n\n\n for (i = 0; i < *num_sg; i++) {\n\n len = sg[i].iov_len;\n\n sg[i].iov_base = dma_memory_map(vdev->dma_as,\n\n addr[i], &len, is_write ?\n\n DMA_DIRECTION_FROM_DEVICE :\n\n DMA_DIRECTION_TO_DEVICE);\n\n if (!sg[i].iov_base) {\n\n error_report(\"virtio: error trying to map MMIO memory\");\n\n exit(1);\n\n }\n\n if (len != sg[i].iov_len) {\n\n error_report(\"virtio: unexpected memory split\");\n\n exit(1);\n\n }\n\n }\n\n}\n"}} {"sample_id": "c963530a5b3e3e0f7304841adfe84416d82f59f6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n }\n \n \n+\n+ snprintf(buf, sizeof(buf), \"%s.%d\", model, id);\n+\n+\n+\n return g_strdup(buf);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static char *assign_name(NetClientState *nc1, const char *model)\n\n{\n\n NetClientState *nc;\n\n char buf[256];\n\n int id = 0;\n\n\n\n QTAILQ_FOREACH(nc, &net_clients, next) {\n\n if (nc == nc1) {\n\n continue;\n\n }\n\n /* For compatibility only bump id for net clients on a vlan */\n\n if (strcmp(nc->model, model) == 0 &&\n\n net_hub_id_for_client(nc, NULL) == 0) {\n\n id++;\n\n }\n\n }\n\n\n\n snprintf(buf, sizeof(buf), \"%s.%d\", model, id);\n\n\n\n return g_strdup(buf);\n\n}\n"}} {"sample_id": "94e58e5770d2a2295a13240f51ddba583e6d5360", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n if (half_vert) {\n s->frame.data[0][(y+1)*s->frame.linesize[0] + x] = color;\n if (half_horiz)\n+ s->frame.data[0][(y+1)*s->frame.linesize[0] + x + 1] = color;\n+ }\n+ d++;\n+ }\n+ x += 1 + half_horiz;\n }\n }\n r += length;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void mm_decode_inter(MmContext * s, int half_horiz, int half_vert, const uint8_t *buf, int buf_size)\n{\n const int data_ptr = 2 + AV_RL16(&buf[0]);\n int d, r, y;\n d = data_ptr; r = 2; y = 0;\n while(r < data_ptr) {\n int i, j;\n int length = buf[r] & 0x7f;\n int x = buf[r+1] + ((buf[r] & 0x80) << 1);\n r += 2;\n if (length==0) {\n y += x;\n continue;\n }\n for(i=0; i> (7-j)) & 1;\n if (replace) {\n int color = buf[d];\n s->frame.data[0][y*s->frame.linesize[0] + x] = color;\n if (half_horiz)\n s->frame.data[0][y*s->frame.linesize[0] + x + 1] = color;\n if (half_vert) {\n s->frame.data[0][(y+1)*s->frame.linesize[0] + x] = color;\n if (half_horiz)\n s->frame.data[0][(y+1)*s->frame.linesize[0] + x + 1] = color;\n }\n d++;\n }\n x += 1 + half_horiz;\n }\n }\n r += length;\n y += 1 + half_vert;\n }\n}"}} {"sample_id": "6138ed777db101c26d19b96e6a27b8499ab9f4e7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int decode_residual_block(AVSContext *h, GetBitContext *gb,\n \n+ const dec_2dvlc_t *r, int esc_golomb_order,\n+\n int qp, uint8_t *dst, int stride) {\n \n int i, level_code, esc_code, level, run, mask;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int decode_residual_block(AVSContext *h, GetBitContext *gb,\n\n const dec_2dvlc_t *r, int esc_golomb_order,\n\n int qp, uint8_t *dst, int stride) {\n\n int i, level_code, esc_code, level, run, mask;\n\n DCTELEM level_buf[64];\n\n uint8_t run_buf[64];\n\n DCTELEM *block = h->block;\n\n\n\n for(i=0;i<65;i++) {\n\n level_code = get_ue_code(gb,r->golomb_order);\n\n if(level_code >= ESCAPE_CODE) {\n\n run = ((level_code - ESCAPE_CODE) >> 1) + 1;\n\n esc_code = get_ue_code(gb,esc_golomb_order);\n\n level = esc_code + (run > r->max_run ? 1 : r->level_add[run]);\n\n while(level > r->inc_limit)\n\n r++;\n\n mask = -(level_code & 1);\n\n level = (level^mask) - mask;\n\n } else {\n\n level = r->rltab[level_code][0];\n\n if(!level) //end of block signal\n\n break;\n\n run = r->rltab[level_code][1];\n\n r += r->rltab[level_code][2];\n\n }\n\n level_buf[i] = level;\n\n run_buf[i] = run;\n\n }\n\n if(dequant(h,level_buf, run_buf, block, ff_cavs_dequant_mul[qp],\n\n ff_cavs_dequant_shift[qp], i))\n\n return -1;\n\n h->s.dsp.cavs_idct8_add(dst,block,stride);\n\n return 0;\n\n}\n"}} {"sample_id": "a70dadc7f1a3e96a7179c6c3a6ccd1a0ea65760a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,21 +3,21 @@\n const siginfo_t *info)\n \n {\n+\n+ int sig = host_to_target_signal(info->si_signo);\n+\n+ tinfo->si_signo = sig;\n+\n+ tinfo->si_errno = 0;\n+\n+ tinfo->si_code = info->si_code;\n+\n+\n+\n+ if (sig == TARGET_SIGILL || sig == TARGET_SIGFPE || sig == TARGET_SIGSEGV\n+\n+ || sig == TARGET_SIGBUS || sig == TARGET_SIGTRAP) {\n+\n /* Should never come here, but who knows. The information for\n \n the target is irrelevant. */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void host_to_target_siginfo_noswap(target_siginfo_t *tinfo,\n\n const siginfo_t *info)\n\n{\n\n int sig = host_to_target_signal(info->si_signo);\n\n tinfo->si_signo = sig;\n\n tinfo->si_errno = 0;\n\n tinfo->si_code = info->si_code;\n\n\n\n if (sig == TARGET_SIGILL || sig == TARGET_SIGFPE || sig == TARGET_SIGSEGV\n\n || sig == TARGET_SIGBUS || sig == TARGET_SIGTRAP) {\n\n /* Should never come here, but who knows. The information for\n\n the target is irrelevant. */\n\n tinfo->_sifields._sigfault._addr = 0;\n\n } else if (sig == TARGET_SIGIO) {\n\n tinfo->_sifields._sigpoll._band = info->si_band;\n\n tinfo->_sifields._sigpoll._fd = info->si_fd;\n\n } else if (sig == TARGET_SIGCHLD) {\n\n tinfo->_sifields._sigchld._pid = info->si_pid;\n\n tinfo->_sifields._sigchld._uid = info->si_uid;\n\n tinfo->_sifields._sigchld._status\n\n = host_to_target_waitstatus(info->si_status);\n\n tinfo->_sifields._sigchld._utime = info->si_utime;\n\n tinfo->_sifields._sigchld._stime = info->si_stime;\n\n } else if (sig >= TARGET_SIGRTMIN) {\n\n tinfo->_sifields._rt._pid = info->si_pid;\n\n tinfo->_sifields._rt._uid = info->si_uid;\n\n /* XXX: potential problem if 64 bit */\n\n tinfo->_sifields._rt._sigval.sival_ptr\n\n = (abi_ulong)(unsigned long)info->si_value.sival_ptr;\n\n }\n\n}\n"}} {"sample_id": "af7e9e74c6a62a5bcd911726a9e88d28b61490e0_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,9 +12,9 @@\n \n /* Initialise controller registers */\n \n+ opp->frep = ((opp->nb_irqs - 1) << FREP_NIRQ_SHIFT) |\n \n+ ((opp->nb_cpus - 1) << FREP_NCPU_SHIFT) |\n \n (opp->vid << FREP_VID_SHIFT);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void openpic_reset(DeviceState *d)\n\n{\n\n OpenPICState *opp = FROM_SYSBUS(typeof (*opp), sysbus_from_qdev(d));\n\n int i;\n\n\n\n opp->glbc = GLBC_RESET;\n\n /* Initialise controller registers */\n\n opp->frep = ((opp->nb_irqs - 1) << FREP_NIRQ_SHIFT) |\n\n ((opp->nb_cpus - 1) << FREP_NCPU_SHIFT) |\n\n (opp->vid << FREP_VID_SHIFT);\n\n\n\n opp->pint = 0;\n\n opp->spve = -1 & opp->vector_mask;\n\n opp->tifr = opp->tifr_reset;\n\n /* Initialise IRQ sources */\n\n for (i = 0; i < opp->max_irq; i++) {\n\n opp->src[i].ipvp = opp->ipvp_reset;\n\n opp->src[i].ide = opp->ide_reset;\n\n }\n\n /* Initialise IRQ destinations */\n\n for (i = 0; i < MAX_CPU; i++) {\n\n opp->dst[i].pctp = 15;\n\n memset(&opp->dst[i].raised, 0, sizeof(IRQ_queue_t));\n\n opp->dst[i].raised.next = -1;\n\n memset(&opp->dst[i].servicing, 0, sizeof(IRQ_queue_t));\n\n opp->dst[i].servicing.next = -1;\n\n }\n\n /* Initialise timers */\n\n for (i = 0; i < MAX_TMR; i++) {\n\n opp->timers[i].ticc = 0;\n\n opp->timers[i].tibc = TIBC_CI;\n\n }\n\n /* Go out of RESET state */\n\n opp->glbc = 0;\n\n}\n"}} {"sample_id": "fbeadf50f2f965741def823036b086bbc2999b1f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n unsigned i = HBITMAP_LEVELS - 1;\n \n+\n \n unsigned long cur;\n+\n do {\n \n cur = hbi->cur[--i];", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "unsigned long hbitmap_iter_skip_words(HBitmapIter *hbi)\n\n{\n\n size_t pos = hbi->pos;\n\n const HBitmap *hb = hbi->hb;\n\n unsigned i = HBITMAP_LEVELS - 1;\n\n\n\n unsigned long cur;\n\n do {\n\n cur = hbi->cur[--i];\n\n pos >>= BITS_PER_LEVEL;\n\n } while (cur == 0);\n\n\n\n /* Check for end of iteration. We always use fewer than BITS_PER_LONG\n\n * bits in the level 0 bitmap; thus we can repurpose the most significant\n\n * bit as a sentinel. The sentinel is set in hbitmap_alloc and ensures\n\n * that the above loop ends even without an explicit check on i.\n\n */\n\n\n\n if (i == 0 && cur == (1UL << (BITS_PER_LONG - 1))) {\n\n return 0;\n\n }\n\n for (; i < HBITMAP_LEVELS - 1; i++) {\n\n /* Shift back pos to the left, matching the right shifts above.\n\n * The index of this word's least significant set bit provides\n\n * the low-order bits.\n\n */\n\n pos = (pos << BITS_PER_LEVEL) + ffsl(cur) - 1;\n\n hbi->cur[i] = cur & (cur - 1);\n\n\n\n /* Set up next level for iteration. */\n\n cur = hb->levels[i + 1][pos];\n\n }\n\n\n\n hbi->pos = pos;\n\n trace_hbitmap_iter_skip_words(hbi->hb, hbi, pos, cur);\n\n\n\n assert(cur);\n\n return cur;\n\n}\n"}} {"sample_id": "f61bece684d9685b07895508e6c1c733b5564ccf_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n return -1;\n \n+\n+\n+ c->dstFormatBpp = av_get_bits_per_pixel(desc_dst);\n+\n+ c->srcFormatBpp = av_get_bits_per_pixel(desc_src);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int sws_setColorspaceDetails(struct SwsContext *c, const int inv_table[4],\n\n int srcRange, const int table[4], int dstRange,\n\n int brightness, int contrast, int saturation)\n\n{\n\n const AVPixFmtDescriptor *desc_dst = av_pix_fmt_desc_get(c->dstFormat);\n\n const AVPixFmtDescriptor *desc_src = av_pix_fmt_desc_get(c->srcFormat);\n\n memcpy(c->srcColorspaceTable, inv_table, sizeof(int) * 4);\n\n memcpy(c->dstColorspaceTable, table, sizeof(int) * 4);\n\n\n\n c->brightness = brightness;\n\n c->contrast = contrast;\n\n c->saturation = saturation;\n\n c->srcRange = srcRange;\n\n c->dstRange = dstRange;\n\n if (isYUV(c->dstFormat) || isGray(c->dstFormat))\n\n return -1;\n\n\n\n c->dstFormatBpp = av_get_bits_per_pixel(desc_dst);\n\n c->srcFormatBpp = av_get_bits_per_pixel(desc_src);\n\n\n\n ff_yuv2rgb_c_init_tables(c, inv_table, srcRange, brightness,\n\n contrast, saturation);\n\n // FIXME factorize\n\n\n\n if (HAVE_ALTIVEC && av_get_cpu_flags() & AV_CPU_FLAG_ALTIVEC)\n\n ff_yuv2rgb_init_tables_altivec(c, inv_table, brightness,\n\n contrast, saturation);\n\n return 0;\n\n}\n"}} {"sample_id": "a89f364ae8740dfc31b321eed9ee454e996dc3c1_23", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n dev->lmp_name ?: \"(null)\");\n \n exit(-1);\n+\n+ }\n+\n+\n+\n *p = dev->next;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bt_device_done(struct bt_device_s *dev)\n\n{\n\n struct bt_device_s **p = &dev->net->slave;\n\n\n\n while (*p && *p != dev)\n\n p = &(*p)->next;\n\n if (*p != dev) {\n\n fprintf(stderr, \"%s: bad bt device \\\"%s\\\"\\n\", __FUNCTION__,\n\n dev->lmp_name ?: \"(null)\");\n\n exit(-1);\n\n }\n\n\n\n *p = dev->next;\n\n}\n"}} {"sample_id": "3e305e4a4752f70c0b5c3cf5b43ec957881714f7_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n ssize_t vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)\n \n+{\n+\n ssize_t ret;\n \n #ifdef CONFIG_VNC_TLS\n \n+ if (vs->tls.session) {\n \n ret = vnc_client_read_tls(&vs->tls.session, data, datalen);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "ssize_t vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)\n\n{\n\n ssize_t ret;\n\n#ifdef CONFIG_VNC_TLS\n\n if (vs->tls.session) {\n\n ret = vnc_client_read_tls(&vs->tls.session, data, datalen);\n\n } else {\n\n#endif /* CONFIG_VNC_TLS */\n\n ret = qemu_recv(vs->csock, data, datalen, 0);\n\n#ifdef CONFIG_VNC_TLS\n\n }\n\n#endif /* CONFIG_VNC_TLS */\n\n VNC_DEBUG(\"Read wire %p %zd -> %ld\\n\", data, datalen, ret);\n\n return vnc_client_io_error(vs, ret, socket_error());\n\n}\n"}} {"sample_id": "cf7c0ff521b0710079aa28f21937fb7dbb3f5224_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n NVDIMMDevice *nvd = list->data;\n \n int slot = object_property_get_int(OBJECT(nvd), PC_DIMM_SLOT_PROP,\n+\n+ NULL);\n+\n+\n+\n if (nvdimm_slot_to_handle(slot) == handle) {\n \n nvdimm = nvd;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static NVDIMMDevice *nvdimm_get_device_by_handle(uint32_t handle)\n\n{\n\n NVDIMMDevice *nvdimm = NULL;\n\n GSList *list, *device_list = nvdimm_get_plugged_device_list();\n\n\n\n for (list = device_list; list; list = list->next) {\n\n NVDIMMDevice *nvd = list->data;\n\n int slot = object_property_get_int(OBJECT(nvd), PC_DIMM_SLOT_PROP,\n\n NULL);\n\n\n\n if (nvdimm_slot_to_handle(slot) == handle) {\n\n nvdimm = nvd;\n\n break;\n\n }\n\n }\n\n\n\n g_slist_free(device_list);\n\n return nvdimm;\n\n}\n"}} {"sample_id": "2cac260768b9d4253737417ea7501cf2950e257f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n phdr.p_type = cpu_convert_to_target32(PT_LOAD, endian);\n \n+ phdr.p_offset = cpu_convert_to_target32(offset, endian);\n+\n+ phdr.p_paddr = cpu_convert_to_target32(memory_mapping->phys_addr, endian);\n+\n+ if (offset == -1) {\n \n /* When the memory is not stored into vmcore, offset will be -1 */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int write_elf32_load(DumpState *s, MemoryMapping *memory_mapping,\n\n int phdr_index, hwaddr offset)\n\n{\n\n Elf32_Phdr phdr;\n\n int ret;\n\n int endian = s->dump_info.d_endian;\n\n\n\n memset(&phdr, 0, sizeof(Elf32_Phdr));\n\n phdr.p_type = cpu_convert_to_target32(PT_LOAD, endian);\n\n phdr.p_offset = cpu_convert_to_target32(offset, endian);\n\n phdr.p_paddr = cpu_convert_to_target32(memory_mapping->phys_addr, endian);\n\n if (offset == -1) {\n\n /* When the memory is not stored into vmcore, offset will be -1 */\n\n phdr.p_filesz = 0;\n\n } else {\n\n phdr.p_filesz = cpu_convert_to_target32(memory_mapping->length, endian);\n\n }\n\n phdr.p_memsz = cpu_convert_to_target32(memory_mapping->length, endian);\n\n phdr.p_vaddr = cpu_convert_to_target32(memory_mapping->virt_addr, endian);\n\n\n\n ret = fd_write_vmcore(&phdr, sizeof(Elf32_Phdr), s);\n\n if (ret < 0) {\n\n dump_error(s, \"dump: failed to write program header table.\\n\");\n\n return -1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "016d2e1dfa21b64a524d3629fdd317d4c25bc3b8_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,10 +5,10 @@\n struct target_rt_sigframe *frame;\n \n abi_ulong frame_addr;\n+\n sigset_t blocked;\n \n+ target_ulong r0;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "long do_rt_sigreturn(CPUSH4State *regs)\n\n{\n\n struct target_rt_sigframe *frame;\n\n abi_ulong frame_addr;\n\n sigset_t blocked;\n\n target_ulong r0;\n\n\n\n#if defined(DEBUG_SIGNAL)\n\n fprintf(stderr, \"do_rt_sigreturn\\n\");\n\n#endif\n\n frame_addr = regs->gregs[15];\n\n if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))\n\n \tgoto badframe;\n\n\n\n target_to_host_sigset(&blocked, &frame->uc.tuc_sigmask);\n\n do_sigprocmask(SIG_SETMASK, &blocked, NULL);\n\n\n\n if (restore_sigcontext(regs, &frame->uc.tuc_mcontext, &r0))\n\n goto badframe;\n\n\n\n if (do_sigaltstack(frame_addr +\n\n\t\t offsetof(struct target_rt_sigframe, uc.tuc_stack),\n\n\t\t 0, get_sp_from_cpustate(regs)) == -EFAULT)\n\n goto badframe;\n\n\n\n unlock_user_struct(frame, frame_addr, 0);\n\n return r0;\n\n\n\nbadframe:\n\n unlock_user_struct(frame, frame_addr, 0);\n\n force_sig(TARGET_SIGSEGV);\n\n return 0;\n\n}\n"}} {"sample_id": "8297be80f7cf71e09617669a8bd8b2836dcfd4c3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -38,8 +38,8 @@\n \n env->insns_flags &= PPC_TCG_INSNS;\n \n+ env->insns_flags2 &= PPC_TCG_INSNS2;\n+\n+ return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ppc_fixup_cpu(PowerPCCPU *cpu)\n\n{\n\n CPUPPCState *env = &cpu->env;\n\n\n\n /* TCG doesn't (yet) emulate some groups of instructions that\n\n * are implemented on some otherwise supported CPUs (e.g. VSX\n\n * and decimal floating point instructions on POWER7). We\n\n * remove unsupported instruction groups from the cpu state's\n\n * instruction masks and hope the guest can cope. For at\n\n * least the pseries machine, the unavailability of these\n\n * instructions can be advertised to the guest via the device\n\n * tree. */\n\n if ((env->insns_flags & ~PPC_TCG_INSNS)\n\n || (env->insns_flags2 & ~PPC_TCG_INSNS2)) {\n\n fprintf(stderr, \"Warning: Disabling some instructions which are not \"\n\n \"emulated by TCG (0x%\" PRIx64 \", 0x%\" PRIx64 \")\\n\",\n\n env->insns_flags & ~PPC_TCG_INSNS,\n\n env->insns_flags2 & ~PPC_TCG_INSNS2);\n\n }\n\n env->insns_flags &= PPC_TCG_INSNS;\n\n env->insns_flags2 &= PPC_TCG_INSNS2;\n\n return 0;\n\n}\n"}} {"sample_id": "de13d2161473d02ae97ec0f8e4503147554892dd_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,9 +6,9 @@\n \n uint32_t io_int_word = (isc << 27) | IO_INT_WORD_AI;\n \n+\n+\n+ trace_css_adapter_interrupt(isc);\n \n s390_io_interrupt(cpu, 0, 0, 0, io_int_word);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void css_adapter_interrupt(uint8_t isc)\n\n{\n\n S390CPU *cpu = s390_cpu_addr2state(0);\n\n uint32_t io_int_word = (isc << 27) | IO_INT_WORD_AI;\n\n\n\n trace_css_adapter_interrupt(isc);\n\n s390_io_interrupt(cpu, 0, 0, 0, io_int_word);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_28", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,11 +34,11 @@\n \n if (s->regs[R_CR] & CR_STOP) {\n \n+ ptimer_stop(s->ptimer);\n+\n+ }\n+\n+ break;\n \n case R_PERIOD:\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void timer_write(void *opaque, target_phys_addr_t addr,\n\n uint64_t value, unsigned size)\n\n{\n\n LM32TimerState *s = opaque;\n\n\n\n trace_lm32_timer_memory_write(addr, value);\n\n\n\n addr >>= 2;\n\n switch (addr) {\n\n case R_SR:\n\n s->regs[R_SR] &= ~SR_TO;\n\n break;\n\n case R_CR:\n\n s->regs[R_CR] = value;\n\n if (s->regs[R_CR] & CR_START) {\n\n ptimer_run(s->ptimer, 1);\n\n }\n\n if (s->regs[R_CR] & CR_STOP) {\n\n ptimer_stop(s->ptimer);\n\n }\n\n break;\n\n case R_PERIOD:\n\n s->regs[R_PERIOD] = value;\n\n ptimer_set_count(s->ptimer, value);\n\n break;\n\n case R_SNAPSHOT:\n\n error_report(\"lm32_timer: write access to read only register 0x\"\n\n TARGET_FMT_plx, addr << 2);\n\n break;\n\n default:\n\n error_report(\"lm32_timer: write access to unknown register 0x\"\n\n TARGET_FMT_plx, addr << 2);\n\n break;\n\n }\n\n timer_update_irq(s);\n\n}\n"}} {"sample_id": "c96bd21227e594856f8fd0610fd213b002056383", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n MPADecodeContext s1, *s = &s1;\n \n+ s1.avctx = avctx;\n+\n+\n+\n+ if (ff_mpa_check_header(head) != 0)\n \n return -1;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int ff_mpa_decode_header(AVCodecContext *avctx, uint32_t head, int *sample_rate)\n\n{\n\n MPADecodeContext s1, *s = &s1;\n\n s1.avctx = avctx;\n\n\n\n if (ff_mpa_check_header(head) != 0)\n\n return -1;\n\n\n\n if (ff_mpegaudio_decode_header(s, head) != 0) {\n\n return -1;\n\n }\n\n\n\n switch(s->layer) {\n\n case 1:\n\n avctx->frame_size = 384;\n\n break;\n\n case 2:\n\n avctx->frame_size = 1152;\n\n break;\n\n default:\n\n case 3:\n\n if (s->lsf)\n\n avctx->frame_size = 576;\n\n else\n\n avctx->frame_size = 1152;\n\n break;\n\n }\n\n\n\n *sample_rate = s->sample_rate;\n\n avctx->channels = s->nb_channels;\n\n avctx->bit_rate = s->bit_rate;\n\n avctx->sub_id = s->layer;\n\n return s->frame_size;\n\n}\n"}} {"sample_id": "1ea879e5580f63414693655fcf0328559cdce138_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n | (!!conf.buffer_size_in_overridden << 1);\n \n \n+\n+ if (alsa_open (1, &req, &obt, &handle)) {\n+\n+ return -1;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int alsa_init_in (HWVoiceIn *hw, audsettings_t *as)\n\n{\n\n ALSAVoiceIn *alsa = (ALSAVoiceIn *) hw;\n\n struct alsa_params_req req;\n\n struct alsa_params_obt obt;\n\n snd_pcm_t *handle;\n\n audsettings_t obt_as;\n\n\n\n req.fmt = aud_to_alsafmt (as->fmt);\n\n req.freq = as->freq;\n\n req.nchannels = as->nchannels;\n\n req.period_size = conf.period_size_in;\n\n req.buffer_size = conf.buffer_size_in;\n\n req.size_in_usec = conf.size_in_usec_in;\n\n req.override_mask = !!conf.period_size_in_overridden\n\n | (!!conf.buffer_size_in_overridden << 1);\n\n\n\n if (alsa_open (1, &req, &obt, &handle)) {\n\n return -1;\n\n }\n\n\n\n obt_as.freq = obt.freq;\n\n obt_as.nchannels = obt.nchannels;\n\n obt_as.fmt = obt.fmt;\n\n obt_as.endianness = obt.endianness;\n\n\n\n audio_pcm_init_info (&hw->info, &obt_as);\n\n hw->samples = obt.samples;\n\n\n\n alsa->pcm_buf = audio_calloc (AUDIO_FUNC, hw->samples, 1 << hw->info.shift);\n\n if (!alsa->pcm_buf) {\n\n dolog (\"Could not allocate ADC buffer (%d samples, each %d bytes)\\n\",\n\n hw->samples, 1 << hw->info.shift);\n\n alsa_anal_close (&handle);\n\n return -1;\n\n }\n\n\n\n alsa->handle = handle;\n\n return 0;\n\n}\n"}} {"sample_id": "c363acef772647f66becdbf46dd54e70e67f3cc9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n __org_qemu_x_Union1 *ret = g_new0(__org_qemu_x_Union1, 1);\n \n \n+\n+ ret->kind = ORG_QEMU_X_UNION1_KIND___ORG_QEMU_X_BRANCH;\n+\n+ ret->__org_qemu_x_branch = strdup(\"blah1\");\n+\n \n \n return ret;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "__org_qemu_x_Union1 *qmp___org_qemu_x_command(__org_qemu_x_EnumList *a,\n\n __org_qemu_x_StructList *b,\n\n __org_qemu_x_Union2 *c,\n\n __org_qemu_x_Alt *d,\n\n Error **errp)\n\n{\n\n __org_qemu_x_Union1 *ret = g_new0(__org_qemu_x_Union1, 1);\n\n\n\n ret->kind = ORG_QEMU_X_UNION1_KIND___ORG_QEMU_X_BRANCH;\n\n ret->__org_qemu_x_branch = strdup(\"blah1\");\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "5e6439a12508f8f7f30aeef64eb96c2311b7f573", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n int j;\n \n+\n \n if (st->codec->codec_type == AVMEDIA_TYPE_AUDIO) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "AVRational ff_choose_timebase(AVFormatContext *s, AVStream *st, int min_precission)\n\n{\n\n AVRational q;\n\n int j;\n\n\n\n if (st->codec->codec_type == AVMEDIA_TYPE_AUDIO) {\n\n q = (AVRational){1, st->codec->sample_rate};\n\n } else {\n\n q = st->codec->time_base;\n\n }\n\n for (j=2; j<2000; j+= 1+(j>2))\n\n while (q.den / q.num < min_precission && q.num % j == 0)\n\n q.num /= j;\n\n while (q.den / q.num < min_precission && q.den < (1<<24))\n\n q.den <<= 1;\n\n\n\n return q;\n\n}\n"}} {"sample_id": "3c895fc098f7637f6d5ec3a9d6766e724a8b9e41_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n \n \n+ /* XXX: suppress this malloc */\n+\n+ buf1= (uint8_t*) av_malloc( size * sizeof(uint8_t) );\n+\n+ \n \n write_packet_header(s, stream, size, stream->enc->coded_frame->key_frame);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int rm_write_audio(AVFormatContext *s, const uint8_t *buf, int size)\n\n{\n\n uint8_t *buf1;\n\n RMContext *rm = s->priv_data;\n\n ByteIOContext *pb = &s->pb;\n\n StreamInfo *stream = rm->audio_stream;\n\n int i;\n\n\n\n /* XXX: suppress this malloc */\n\n buf1= (uint8_t*) av_malloc( size * sizeof(uint8_t) );\n\n \n\n write_packet_header(s, stream, size, stream->enc->coded_frame->key_frame);\n\n \n\n /* for AC3, the words seems to be reversed */\n\n for(i=0;inb_frames++;\n\n av_free(buf1);\n\n return 0;\n\n}\n"}} {"sample_id": "880a7578381d1c7ed4d41c7599ae3cc06567a824_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,10 +7,10 @@\n int i;\n \n \n+\n+ for (i = 0; i < size; i++) {\n+\n+ gdb_read_byte(s, buf[i]);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gdb_chr_receive(void *opaque, const uint8_t *buf, int size)\n\n{\n\n GDBState *s = opaque;\n\n int i;\n\n\n\n for (i = 0; i < size; i++) {\n\n gdb_read_byte(s, buf[i]);\n\n }\n\n}\n"}} {"sample_id": "b5cd9143e78da8ea9e17fa523aacbedd267aae54", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n DB_PRINT(\"realized spips\\n\");\n \n \n+\n+ s->spi = g_new(SSIBus *, s->num_busses);\n+\n+ for (i = 0; i < s->num_busses; ++i) {\n+\n char bus_name[16];\n \n snprintf(bus_name, 16, \"spi%d\", i);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void xilinx_spips_realize(DeviceState *dev, Error **errp)\n\n{\n\n XilinxSPIPS *s = XILINX_SPIPS(dev);\n\n SysBusDevice *sbd = SYS_BUS_DEVICE(dev);\n\n XilinxSPIPSClass *xsc = XILINX_SPIPS_GET_CLASS(s);\n\n int i;\n\n\n\n DB_PRINT(\"realized spips\\n\");\n\n\n\n s->spi = g_new(SSIBus *, s->num_busses);\n\n for (i = 0; i < s->num_busses; ++i) {\n\n char bus_name[16];\n\n snprintf(bus_name, 16, \"spi%d\", i);\n\n s->spi[i] = ssi_create_bus(dev, bus_name);\n\n }\n\n\n\n s->cs_lines = g_new0(qemu_irq, s->num_cs * s->num_busses);\n\n ssi_auto_connect_slaves(DEVICE(s), s->cs_lines, s->spi[0]);\n\n ssi_auto_connect_slaves(DEVICE(s), s->cs_lines, s->spi[1]);\n\n sysbus_init_irq(sbd, &s->irq);\n\n for (i = 0; i < s->num_cs * s->num_busses; ++i) {\n\n sysbus_init_irq(sbd, &s->cs_lines[i]);\n\n }\n\n\n\n memory_region_init_io(&s->iomem, &spips_ops, s, \"spi\", R_MAX*4);\n\n sysbus_init_mmio(sbd, &s->iomem);\n\n\n\n s->irqline = -1;\n\n\n\n fifo8_create(&s->rx_fifo, xsc->rx_fifo_size);\n\n fifo8_create(&s->tx_fifo, xsc->tx_fifo_size);\n\n}\n"}} {"sample_id": "87e8788680e16c51f6048af26f3f7830c35207a5_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n if (p->buf[0] == 0x01 && p->buf[1] == 0x00 &&\n \n p->buf[4] == 0x01 + p->buf[2] &&\n+\n+ p->buf[8] == p->buf[4] + p->buf[6] &&\n+\n+ p->buf[12] == p->buf[8] + p->buf[10])\n+\n return AVPROBE_SCORE_MAX;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int probe(AVProbeData *p)\n\n{\n\n if (p->buf_size < 13)\n\n return 0;\n\n\n\n if (p->buf[0] == 0x01 && p->buf[1] == 0x00 &&\n\n p->buf[4] == 0x01 + p->buf[2] &&\n\n p->buf[8] == p->buf[4] + p->buf[6] &&\n\n p->buf[12] == p->buf[8] + p->buf[10])\n\n return AVPROBE_SCORE_MAX;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "e4533c7a8cdcc79ccdf695f0aaa2e23a5b926ed0_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n return 1;\n \n+ }\n+\n+ tb = tb_find_pc(pc);\n+\n+ if (tb) {\n \n /* the PC is inside the translated code. It means that we have\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline int handle_cpu_signal(unsigned long pc, unsigned long address,\n\n int is_write, sigset_t *old_set)\n\n{\n\n TranslationBlock *tb;\n\n int ret;\n\n uint32_t found_pc;\n\n \n\n#if defined(DEBUG_SIGNAL)\n\n printf(\"qemu: SIGSEGV pc=0x%08lx address=%08lx wr=%d oldset=0x%08lx\\n\", \n\n pc, address, is_write, *(unsigned long *)old_set);\n\n#endif\n\n /* XXX: locking issue */\n\n if (is_write && page_unprotect(address)) {\n\n return 1;\n\n }\n\n tb = tb_find_pc(pc);\n\n if (tb) {\n\n /* the PC is inside the translated code. It means that we have\n\n a virtual CPU fault */\n\n ret = cpu_x86_search_pc(tb, &found_pc, pc);\n\n if (ret < 0)\n\n return 0;\n\n env->eip = found_pc - tb->cs_base;\n\n env->cr2 = address;\n\n /* we restore the process signal mask as the sigreturn should\n\n do it (XXX: use sigsetjmp) */\n\n sigprocmask(SIG_SETMASK, old_set, NULL);\n\n raise_exception_err(EXCP0E_PAGE, 4 | (is_write << 1));\n\n /* never comes here */\n\n return 1;\n\n } else {\n\n return 0;\n\n }\n\n}\n"}} {"sample_id": "9d4c0f4f0a71e74fd7e04d73620268484d693adf_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n * which are in an 'UNUSABLE' allocation state. (PAPR 2.7,\n \n * 13.5.3.5)\n+\n+ */\n+\n+ if (!drc->dev ||\n+\n drc->allocation_state == SPAPR_DR_ALLOCATION_STATE_UNUSABLE) {\n \n return RTAS_OUT_NO_SUCH_INDICATOR;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t drc_unisolate_logical(sPAPRDRConnector *drc)\n\n{\n\n /* cannot unisolate a non-existent resource, and, or resources\n\n * which are in an 'UNUSABLE' allocation state. (PAPR 2.7,\n\n * 13.5.3.5)\n\n */\n\n if (!drc->dev ||\n\n drc->allocation_state == SPAPR_DR_ALLOCATION_STATE_UNUSABLE) {\n\n return RTAS_OUT_NO_SUCH_INDICATOR;\n\n }\n\n\n\n drc->isolation_state = SPAPR_DR_ISOLATION_STATE_UNISOLATED;\n\n\n\n return RTAS_OUT_SUCCESS;\n\n}\n"}} {"sample_id": "a5e0dbf530d447f36099aed575b34e9258c5d75a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void push_output_configuration(AACContext *ac) {\n \n if (ac->oc[1].status == OC_LOCKED || ac->oc[0].status == OC_NONE) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void push_output_configuration(AACContext *ac) {\n\n if (ac->oc[1].status == OC_LOCKED || ac->oc[0].status == OC_NONE) {\n\n ac->oc[0] = ac->oc[1];\n\n }\n\n ac->oc[1].status = OC_NONE;\n\n}\n"}} {"sample_id": "c508277335e3b6b20cf18e6ea3a35c1fa835c64a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void vmxnet3_update_pm_state(VMXNET3State *s)\n \n+{\n+\n+ struct Vmxnet3_VariableLenConfDesc pm_descr;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void vmxnet3_update_pm_state(VMXNET3State *s)\n\n{\n\n struct Vmxnet3_VariableLenConfDesc pm_descr;\n\n\n\n pm_descr.confLen =\n\n VMXNET3_READ_DRV_SHARED32(s->drv_shmem, devRead.pmConfDesc.confLen);\n\n pm_descr.confVer =\n\n VMXNET3_READ_DRV_SHARED32(s->drv_shmem, devRead.pmConfDesc.confVer);\n\n pm_descr.confPA =\n\n VMXNET3_READ_DRV_SHARED64(s->drv_shmem, devRead.pmConfDesc.confPA);\n\n\n\n vmxnet3_dump_conf_descr(\"PM State\", &pm_descr);\n\n}\n"}} {"sample_id": "42fb414804419c3fc269c73ad049f218f8813ed0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n AVFormatContext *s)\n \n {\n+\n+ offset_t pos = url_ftell(pb);\n+\n+ int i;\n+\n \n \n put_be32(pb, 0); /* size */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mov_write_udta_tag(ByteIOContext *pb, MOVContext* mov,\n\n AVFormatContext *s)\n\n{\n\n offset_t pos = url_ftell(pb);\n\n int i;\n\n\n\n put_be32(pb, 0); /* size */\n\n put_tag(pb, \"udta\");\n\n\n\n /* iTunes meta data */\n\n mov_write_meta_tag(pb, mov, s);\n\n\n\n if(mov->mode == MODE_MOV){ // the title field breaks gtkpod with mp4 and my suspicion is that stuff isnt valid in mp4\n\n /* Requirements */\n\n for (i=0; itracks[i].entry <= 0) continue;\n\n if (mov->tracks[i].enc->codec_id == CODEC_ID_AAC ||\n\n mov->tracks[i].enc->codec_id == CODEC_ID_MPEG4) {\n\n mov_write_string_tag(pb, \"\\251req\", \"QuickTime 6.0 or greater\", 0);\n\n break;\n\n }\n\n }\n\n\n\n mov_write_string_tag(pb, \"\\251nam\", s->title , 0);\n\n mov_write_string_tag(pb, \"\\251aut\", s->author , 0);\n\n mov_write_string_tag(pb, \"\\251alb\", s->album , 0);\n\n mov_write_day_tag(pb, s->year, 0);\n\n if(mov->tracks[0].enc && !(mov->tracks[0].enc->flags & CODEC_FLAG_BITEXACT))\n\n mov_write_string_tag(pb, \"\\251enc\", LIBAVFORMAT_IDENT, 0);\n\n mov_write_string_tag(pb, \"\\251des\", s->comment , 0);\n\n mov_write_string_tag(pb, \"\\251gen\", s->genre , 0);\n\n }\n\n\n\n return updateSize(pb, pos);\n\n}\n"}} {"sample_id": "97437bd17a8c5d4135b2f3b1b299bd7bb72ce02c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void ff_aac_coder_init_mips(AACEncContext *c) {\n+\n #if HAVE_INLINE_ASM\n \n AACCoefficientsEncoder *e = c->coder;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void ff_aac_coder_init_mips(AACEncContext *c) {\n\n#if HAVE_INLINE_ASM\n\n AACCoefficientsEncoder *e = c->coder;\n\n int option = c->options.aac_coder;\n\n\n\n if (option == 2) {\n\n e->quantize_and_encode_band = quantize_and_encode_band_mips;\n\n e->encode_window_bands_info = codebook_trellis_rate;\n\n#if HAVE_MIPSFPU\n\n e->search_for_quantizers = search_for_quantizers_twoloop;\n\n#endif /* HAVE_MIPSFPU */\n\n }\n\n#if HAVE_MIPSFPU\n\n e->search_for_ms = search_for_ms_mips;\n\n#endif /* HAVE_MIPSFPU */\n\n#endif /* HAVE_INLINE_ASM */\n\n}\n"}} {"sample_id": "6d4b9e55fc625514a38d27cff4b9933f617fa7dc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -57,8 +57,8 @@\n \n \n \n+\n+\n+read_end:\n+\n+ return realsize;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static size_t curl_read_cb(void *ptr, size_t size, size_t nmemb, void *opaque)\n\n{\n\n CURLState *s = ((CURLState*)opaque);\n\n size_t realsize = size * nmemb;\n\n int i;\n\n\n\n DPRINTF(\"CURL: Just reading %zd bytes\\n\", realsize);\n\n\n\n if (!s || !s->orig_buf)\n\n goto read_end;\n\n\n\n\n\n\n\n\n memcpy(s->orig_buf + s->buf_off, ptr, realsize);\n\n s->buf_off += realsize;\n\n\n\n for(i=0; iacb[i];\n\n\n\n if (!acb)\n\n continue;\n\n\n\n if ((s->buf_off >= acb->end)) {\n\n qemu_iovec_from_buf(acb->qiov, 0, s->orig_buf + acb->start,\n\n acb->end - acb->start);\n\n acb->common.cb(acb->common.opaque, 0);\n\n qemu_aio_release(acb);\n\n s->acb[i] = NULL;\n\n\n\n\n\nread_end:\n\n return realsize;\n"}} {"sample_id": "ac1970fbe8ad5a70174f462109ac0f6c7bf1bc43_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void core_begin(MemoryListener *listener)\n \n {\n+\n+ destroy_all_mappings();\n+\n+ phys_sections_clear();\n \n phys_map.ptr = PHYS_MAP_NODE_NIL;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void core_begin(MemoryListener *listener)\n\n{\n\n destroy_all_mappings();\n\n phys_sections_clear();\n\n phys_map.ptr = PHYS_MAP_NODE_NIL;\n\n phys_section_unassigned = dummy_section(&io_mem_unassigned);\n\n phys_section_notdirty = dummy_section(&io_mem_notdirty);\n\n phys_section_rom = dummy_section(&io_mem_rom);\n\n phys_section_watch = dummy_section(&io_mem_watch);\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n bool qpci_msix_pending(QPCIDevice *dev, uint16_t entry)\n \n {\n+\n uint32_t pba_entry;\n+\n+ uint8_t bit_n = entry % 32;\n \n void *addr = dev->msix_pba + (entry / 32) * PCI_MSIX_ENTRY_SIZE / 4;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "bool qpci_msix_pending(QPCIDevice *dev, uint16_t entry)\n\n{\n\n uint32_t pba_entry;\n\n uint8_t bit_n = entry % 32;\n\n void *addr = dev->msix_pba + (entry / 32) * PCI_MSIX_ENTRY_SIZE / 4;\n\n\n\n g_assert(dev->msix_enabled);\n\n pba_entry = qpci_io_readl(dev, addr);\n\n qpci_io_writel(dev, addr, pba_entry & ~(1 << bit_n));\n\n return (pba_entry & (1 << bit_n)) != 0;\n\n}\n"}} {"sample_id": "64607d088132abdb25bf30d93e97d0c8df7b364c_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n ObjectProperty *prop = object_property_find(parent, part, NULL);\n \n if (prop == NULL) {\n+\n+ return NULL;\n+\n+ }\n+\n \n \n if (object_property_is_link(prop)) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "Object *object_resolve_path_component(Object *parent, const gchar *part)\n\n{\n\n ObjectProperty *prop = object_property_find(parent, part, NULL);\n\n if (prop == NULL) {\n\n return NULL;\n\n }\n\n\n\n if (object_property_is_link(prop)) {\n\n LinkProperty *lprop = prop->opaque;\n\n return *lprop->child;\n\n } else if (object_property_is_child(prop)) {\n\n return prop->opaque;\n\n } else {\n\n return NULL;\n\n }\n\n}\n"}} {"sample_id": "c5a49c63fa26e8825ad101dfe86339ae4c216539_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static inline bool use_goto_tb(DisasContext *s, int n, uint64_t dest)\n+\n {\n \n /* No direct tb linking with singlestep (either QEMU's or the ARM", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline bool use_goto_tb(DisasContext *s, int n, uint64_t dest)\n\n{\n\n /* No direct tb linking with singlestep (either QEMU's or the ARM\n\n * debug architecture kind) or deterministic io\n\n */\n\n if (s->base.singlestep_enabled || s->ss_active || (s->base.tb->cflags & CF_LAST_IO)) {\n\n return false;\n\n }\n\n\n\n#ifndef CONFIG_USER_ONLY\n\n /* Only link tbs from inside the same guest page */\n\n if ((s->base.tb->pc & TARGET_PAGE_MASK) != (dest & TARGET_PAGE_MASK)) {\n\n return false;\n\n }\n\n#endif\n\n\n\n return true;\n\n}\n"}} {"sample_id": "13705b69ebe9e375fdb52469760a0fbb5f593cc1_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,12 +5,12 @@\n DWTELEM *b0= cs->b0;\n \n DWTELEM *b1= cs->b1;\n+\n+ DWTELEM *b2= buffer + mirror(y+1, height-1)*stride;\n \n DWTELEM *b3= buffer + mirror(y+2, height-1)*stride;\n+\n+\n \n {START_TIMER\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void spatial_compose53i_dy(dwt_compose_t *cs, DWTELEM *buffer, int width, int height, int stride){\n\n int y= cs->y;\n\n DWTELEM *b0= cs->b0;\n\n DWTELEM *b1= cs->b1;\n\n DWTELEM *b2= buffer + mirror(y+1, height-1)*stride;\n\n DWTELEM *b3= buffer + mirror(y+2, height-1)*stride;\n\n\n\n{START_TIMER\n\n if(b1 <= b3) vertical_compose53iL0(b1, b2, b3, width);\n\n if(b0 <= b2) vertical_compose53iH0(b0, b1, b2, width);\n\nSTOP_TIMER(\"vertical_compose53i*\")}\n\n\n\n{START_TIMER\n\n if(y-1 >= 0) horizontal_compose53i(b0, width);\n\n if(b0 <= b2) horizontal_compose53i(b1, width);\n\nSTOP_TIMER(\"horizontal_compose53i\")}\n\n\n\n cs->b0 = b2;\n\n cs->b1 = b3;\n\n cs->y += 2;\n\n}\n"}} {"sample_id": "364031f17932814484657e5551ba12957d993d7e_24", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n {\n \n errno = ENOTSUP;\n+\n+ return -1;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int v9fs_synth_lremovexattr(FsContext *ctx,\n\n V9fsPath *path, const char *name)\n\n{\n\n errno = ENOTSUP;\n\n return -1;\n\n}\n"}} {"sample_id": "ff1685a3338072be9a94ab8a8f529c12e4265224", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n const char *arch = qtest_get_arch();\n \n QDict *response, *minfo;\n+\n QList *list;\n \n const QListEntry *p;\n@@ -20,7 +20,7 @@\n \n qtest_start(\"-machine none\");\n \n+ response = qmp(\"{ 'execute': 'query-machines' }\");\n \n g_assert(response);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void add_machine_test_cases(void)\n\n{\n\n const char *arch = qtest_get_arch();\n\n QDict *response, *minfo;\n\n QList *list;\n\n const QListEntry *p;\n\n QObject *qobj;\n\n QString *qstr;\n\n const char *mname, *path;\n\n\n\n qtest_start(\"-machine none\");\n\n response = qmp(\"{ 'execute': 'query-machines' }\");\n\n g_assert(response);\n\n list = qdict_get_qlist(response, \"return\");\n\n g_assert(list);\n\n\n\n for (p = qlist_first(list); p; p = qlist_next(p)) {\n\n minfo = qobject_to_qdict(qlist_entry_obj(p));\n\n g_assert(minfo);\n\n qobj = qdict_get(minfo, \"name\");\n\n g_assert(qobj);\n\n qstr = qobject_to_qstring(qobj);\n\n g_assert(qstr);\n\n mname = qstring_get_str(qstr);\n\n if (!is_blacklisted(arch, mname)) {\n\n path = g_strdup_printf(\"qom/%s\", mname);\n\n qtest_add_data_func(path, g_strdup(mname), test_machine);\n\n }\n\n }\n\n\n\n qtest_end();\n\n QDECREF(response);\n\n}\n"}} {"sample_id": "b57482d7a0fe669aeb6f0c3c3503d143b9db89dd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n {\n \n+ if (object_dynamic_cast(OBJECT(session->creds),\n \n TYPE_QCRYPTO_TLS_CREDS_ANON)) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "qcrypto_tls_session_check_credentials(QCryptoTLSSession *session,\n\n Error **errp)\n\n{\n\n if (object_dynamic_cast(OBJECT(session->creds),\n\n TYPE_QCRYPTO_TLS_CREDS_ANON)) {\n\n return 0;\n\n } else if (object_dynamic_cast(OBJECT(session->creds),\n\n TYPE_QCRYPTO_TLS_CREDS_X509)) {\n\n if (session->creds->verifyPeer) {\n\n return qcrypto_tls_session_check_certificate(session,\n\n errp);\n\n } else {\n\n return 0;\n\n }\n\n } else {\n\n error_setg(errp, \"Unexpected credential type %s\",\n\n object_get_typename(OBJECT(session->creds)));\n\n return -1;\n\n }\n\n}\n"}} {"sample_id": "c5a49c63fa26e8825ad101dfe86339ae4c216539_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static bool gen_rsr_ccount(DisasContext *dc, TCGv_i32 d, uint32_t sr)\n+\n {\n \n if (dc->tb->cflags & CF_USE_ICOUNT) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static bool gen_rsr_ccount(DisasContext *dc, TCGv_i32 d, uint32_t sr)\n\n{\n\n if (dc->tb->cflags & CF_USE_ICOUNT) {\n\n gen_io_start();\n\n }\n\n gen_helper_update_ccount(cpu_env);\n\n tcg_gen_mov_i32(d, cpu_SR[sr]);\n\n if (dc->tb->cflags & CF_USE_ICOUNT) {\n\n gen_io_end();\n\n return true;\n\n }\n\n return false;\n\n}\n"}} {"sample_id": "1d16a1cf99488f16492b1bb48e023f4da8377e07_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -58,11 +58,11 @@\n \n :\"+m\"(*(uint32_t*)(dst+0*stride)),\n \n+ \"+m\"(*(uint32_t*)(dst+1*stride)),\n+\n+ \"+m\"(*(uint32_t*)(dst+2*stride)),\n+\n+ \"+m\"(*(uint32_t*)(dst+3*stride))\n \n );\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ff_h264_idct_dc_add_mmx2(uint8_t *dst, int16_t *block, int stride)\n\n{\n\n int dc = (block[0] + 32) >> 6;\n\n __asm__ volatile(\n\n \"movd %0, %%mm0 \\n\\t\"\n\n \"pshufw $0, %%mm0, %%mm0 \\n\\t\"\n\n \"pxor %%mm1, %%mm1 \\n\\t\"\n\n \"psubw %%mm0, %%mm1 \\n\\t\"\n\n \"packuswb %%mm0, %%mm0 \\n\\t\"\n\n \"packuswb %%mm1, %%mm1 \\n\\t\"\n\n ::\"r\"(dc)\n\n );\n\n __asm__ volatile(\n\n \"movd %0, %%mm2 \\n\\t\"\n\n \"movd %1, %%mm3 \\n\\t\"\n\n \"movd %2, %%mm4 \\n\\t\"\n\n \"movd %3, %%mm5 \\n\\t\"\n\n \"paddusb %%mm0, %%mm2 \\n\\t\"\n\n \"paddusb %%mm0, %%mm3 \\n\\t\"\n\n \"paddusb %%mm0, %%mm4 \\n\\t\"\n\n \"paddusb %%mm0, %%mm5 \\n\\t\"\n\n \"psubusb %%mm1, %%mm2 \\n\\t\"\n\n \"psubusb %%mm1, %%mm3 \\n\\t\"\n\n \"psubusb %%mm1, %%mm4 \\n\\t\"\n\n \"psubusb %%mm1, %%mm5 \\n\\t\"\n\n \"movd %%mm2, %0 \\n\\t\"\n\n \"movd %%mm3, %1 \\n\\t\"\n\n \"movd %%mm4, %2 \\n\\t\"\n\n \"movd %%mm5, %3 \\n\\t\"\n\n :\"+m\"(*(uint32_t*)(dst+0*stride)),\n\n \"+m\"(*(uint32_t*)(dst+1*stride)),\n\n \"+m\"(*(uint32_t*)(dst+2*stride)),\n\n \"+m\"(*(uint32_t*)(dst+3*stride))\n\n );\n\n}\n"}} {"sample_id": "539de1246d355d3b8aa33fb7cde732352d8827c7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -51,11 +51,11 @@\n monitor_printf(mon, \"Start migration for %s with shared base \"\n \n \"image\\n\",\n+\n+ bs->device_name);\n+\n+ } else {\n+\n monitor_printf(mon, \"Start full migration for %s\\n\",\n \n bs->device_name);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void init_blk_migration_it(void *opaque, BlockDriverState *bs)\n\n{\n\n Monitor *mon = opaque;\n\n BlkMigDevState *bmds;\n\n int64_t sectors;\n\n\n\n if (!bdrv_is_read_only(bs)) {\n\n sectors = bdrv_getlength(bs) >> BDRV_SECTOR_BITS;\n\n if (sectors <= 0) {\n\n return;\n\n }\n\n\n\n bmds = g_malloc0(sizeof(BlkMigDevState));\n\n bmds->bs = bs;\n\n bmds->bulk_completed = 0;\n\n bmds->total_sectors = sectors;\n\n bmds->completed_sectors = 0;\n\n bmds->shared_base = block_mig_state.shared_base;\n\n alloc_aio_bitmap(bmds);\n\n drive_get_ref(drive_get_by_blockdev(bs));\n\n bdrv_set_in_use(bs, 1);\n\n\n\n block_mig_state.total_sector_sum += sectors;\n\n\n\n if (bmds->shared_base) {\n\n monitor_printf(mon, \"Start migration for %s with shared base \"\n\n \"image\\n\",\n\n bs->device_name);\n\n } else {\n\n monitor_printf(mon, \"Start full migration for %s\\n\",\n\n bs->device_name);\n\n }\n\n\n\n QSIMPLEQ_INSERT_TAIL(&block_mig_state.bmds_list, bmds, entry);\n\n }\n\n}\n"}} {"sample_id": "fd8f5e37557596e14a859d8edf3dc24523bd4400_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,10 +32,10 @@\n \n assert(pointer_size == 1 || pointer_size == 2 ||\n \n+ pointer_size == 4 || pointer_size == 8);\n+\n+\n+\n+ g_array_append_val(linker, entry);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bios_linker_loader_add_pointer(GArray *linker,\n\n const char *dest_file,\n\n const char *src_file,\n\n GArray *table, void *pointer,\n\n uint8_t pointer_size)\n\n{\n\n BiosLinkerLoaderEntry entry;\n\n\n\n memset(&entry, 0, sizeof entry);\n\n strncpy(entry.pointer.dest_file, dest_file,\n\n sizeof entry.pointer.dest_file - 1);\n\n strncpy(entry.pointer.src_file, src_file,\n\n sizeof entry.pointer.src_file - 1);\n\n entry.command = cpu_to_le32(BIOS_LINKER_LOADER_COMMAND_ADD_POINTER);\n\n entry.pointer.offset = cpu_to_le32((gchar *)pointer - table->data);\n\n entry.pointer.size = pointer_size;\n\n assert(pointer_size == 1 || pointer_size == 2 ||\n\n pointer_size == 4 || pointer_size == 8);\n\n\n\n g_array_append_val(linker, entry);\n\n}\n"}} {"sample_id": "9a8a5ae69d3a436e51a7eb2edafe254572f60823", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n assert(ts);\n \n if (idx < s->nb_globals) {\n+\n+ pstrcpy(buf, buf_size, ts->name);\n+\n+ } else {\n+\n if (ts->temp_local) \n \n snprintf(buf, buf_size, \"loc%d\", idx - s->nb_globals);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static char *tcg_get_arg_str_idx(TCGContext *s, char *buf, int buf_size,\n\n int idx)\n\n{\n\n TCGTemp *ts;\n\n\n\n assert(idx >= 0 && idx < s->nb_temps);\n\n ts = &s->temps[idx];\n\n assert(ts);\n\n if (idx < s->nb_globals) {\n\n pstrcpy(buf, buf_size, ts->name);\n\n } else {\n\n if (ts->temp_local) \n\n snprintf(buf, buf_size, \"loc%d\", idx - s->nb_globals);\n\n else\n\n snprintf(buf, buf_size, \"tmp%d\", idx - s->nb_globals);\n\n }\n\n return buf;\n\n}\n"}} {"sample_id": "9be385980d37e8f4fd33f605f5fb1c3d144170a8_15", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int load_refcount_block(BlockDriverState *bs,\n+\n+ int64_t refcount_block_offset,\n+\n+ void **refcount_block)\n+\n {\n \n BDRVQcow2State *s = bs->opaque;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int load_refcount_block(BlockDriverState *bs,\n\n int64_t refcount_block_offset,\n\n void **refcount_block)\n\n{\n\n BDRVQcow2State *s = bs->opaque;\n\n int ret;\n\n\n\n BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_LOAD);\n\n ret = qcow2_cache_get(bs, s->refcount_block_cache, refcount_block_offset,\n\n refcount_block);\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "2374e73edafff0586cbfb67c333c5a7588f81fd5_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void helper_ldl_raw(uint64_t t0, uint64_t t1)\n \n {\n+\n ldl_raw(t1, t0);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void helper_ldl_raw(uint64_t t0, uint64_t t1)\n\n{\n\n ldl_raw(t1, t0);\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_95", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n return wrid_desc[RDMA_WRID_RECV_CONTROL];\n \n }\n+\n+ return wrid_desc[wrid];\n+\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "const char *print_wrid(int wrid)\n\n{\n\n if (wrid >= RDMA_WRID_RECV_CONTROL) {\n\n return wrid_desc[RDMA_WRID_RECV_CONTROL];\n\n }\n\n return wrid_desc[wrid];\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ int64_t overlap_offset = req->offset & ~(align - 1);\n+\n+ unsigned int overlap_bytes = ROUND_UP(req->offset + req->bytes, align)\n+\n+ - overlap_offset;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void mark_request_serialising(BdrvTrackedRequest *req, uint64_t align)\n\n{\n\n int64_t overlap_offset = req->offset & ~(align - 1);\n\n unsigned int overlap_bytes = ROUND_UP(req->offset + req->bytes, align)\n\n - overlap_offset;\n\n\n\n if (!req->serialising) {\n\n req->bs->serialising_in_flight++;\n\n req->serialising = true;\n\n }\n\n\n\n req->overlap_offset = MIN(req->overlap_offset, overlap_offset);\n\n req->overlap_bytes = MAX(req->overlap_bytes, overlap_bytes);\n\n}\n"}} {"sample_id": "b5eab66e9fe6c93056e414b0b4a70a34948843e1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ AVFilterLink *out = NULL;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void avfilter_default_start_frame(AVFilterLink *link, AVFilterPicRef *picref)\n\n{\n\n AVFilterLink *out = NULL;\n\n\n\n if(link->dst->output_count)\n\n out = link->dst->outputs[0];\n\n\n\n if(out) {\n\n out->outpic = avfilter_get_video_buffer(out, AV_PERM_WRITE, link->w, link->h);\n\n out->outpic->pts = picref->pts;\n\n avfilter_start_frame(out, avfilter_ref_pic(out->outpic, ~0));\n\n }\n\n}\n"}} {"sample_id": "441692ddd8321d5e0f09b163e86410e578d87236", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n {\n \n int result = 0;\n+\n if (secn > 0) {\n \n const uint8_t *sp = (const uint8_t *)src;\n@@ -23,7 +23,7 @@\n result = 1;\n \n } else {\n+\n dpp = dp + ((sec & 31) << 4);\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline int onenand_prog_spare(OneNANDState *s, int sec, int secn,\n\n void *src)\n\n{\n\n int result = 0;\n\n if (secn > 0) {\n\n const uint8_t *sp = (const uint8_t *)src;\n\n uint8_t *dp = 0, *dpp = 0;\n\n if (s->blk_cur) {\n\n dp = g_malloc(512);\n\n if (!dp\n\n || blk_read(s->blk_cur, s->secs_cur + (sec >> 5), dp, 1) < 0) {\n\n result = 1;\n\n } else {\n\n dpp = dp + ((sec & 31) << 4);\n\n }\n\n } else {\n\n if (sec + secn > s->secs_cur) {\n\n result = 1;\n\n } else {\n\n dpp = s->current + (s->secs_cur << 9) + (sec << 4);\n\n }\n\n }\n\n if (!result) {\n\n uint32_t i;\n\n for (i = 0; i < (secn << 4); i++) {\n\n dpp[i] &= sp[i];\n\n }\n\n if (s->blk_cur) {\n\n result = blk_write(s->blk_cur, s->secs_cur + (sec >> 5),\n\n dp, 1) < 0;\n\n }\n\n }\n\n g_free(dp);\n\n }\n\n return result;\n\n}\n"}} {"sample_id": "a67cb012e6947fb238193afc0f18114f6e20818c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,8 +16,8 @@\n \n return NULL;\n \n+\n+\n c->phase_shift = phase_shift;\n \n c->phase_mask = phase_count - 1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "AVResampleContext *swr_resample_init(AVResampleContext *c, int out_rate, int in_rate, int filter_size, int phase_shift, int linear, double cutoff){\n\n double factor= FFMIN(out_rate * cutoff / in_rate, 1.0);\n\n int phase_count= 1<phase_shift != phase_shift || c->linear!=linear || c->factor != factor\n\n || c->filter_length != FFMAX((int)ceil(filter_size/factor), 1)) {\n\n c = av_mallocz(sizeof(AVResampleContext));\n\n if (!c)\n\n return NULL;\n\n\n\n c->phase_shift = phase_shift;\n\n c->phase_mask = phase_count - 1;\n\n c->linear = linear;\n\n c->factor = factor;\n\n c->filter_length = FFMAX((int)ceil(filter_size/factor), 1);\n\n c->filter_bank = av_mallocz(c->filter_length*(phase_count+1)*sizeof(FELEM));\n\n if (!c->filter_bank)\n\n goto error;\n\n if (build_filter(c->filter_bank, factor, c->filter_length, phase_count, 1<filter_bank[c->filter_length*phase_count+1], c->filter_bank, (c->filter_length-1)*sizeof(FELEM));\n\n c->filter_bank[c->filter_length*phase_count]= c->filter_bank[c->filter_length - 1];\n\n }\n\n\n\n c->compensation_distance= 0;\n\n c->src_incr= out_rate;\n\n c->ideal_dst_incr= c->dst_incr= in_rate * phase_count;\n\n c->index= -phase_count*((c->filter_length-1)/2);\n\n c->frac= 0;\n\n\n\n return c;\n\nerror:\n\n av_free(c->filter_bank);\n\n av_free(c);\n\n return NULL;\n\n}\n"}} {"sample_id": "7ad4c7200111d20eb97eed4f46b6026e3f0b0eef_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,9 +17,9 @@\n ptr = __coverity_alloc__(size);\n \n __coverity_mark_as_uninitialized_buffer__(ptr);\n+\n+ __coverity_mark_as_afm_allocated__(ptr, AFM_free);\n+\n+ return ptr;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void *g_malloc_n(size_t nmemb, size_t size)\n\n{\n\n size_t sz;\n\n void *ptr;\n\n\n\n __coverity_negative_sink__(nmemb);\n\n __coverity_negative_sink__(size);\n\n sz = nmemb * size;\n\n ptr = __coverity_alloc__(size);\n\n __coverity_mark_as_uninitialized_buffer__(ptr);\n\n __coverity_mark_as_afm_allocated__(ptr, AFM_free);\n\n return ptr;\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_60", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,10 +24,10 @@\n \n \tcris_alu(dc, CC_OP_MOVE,\n \n+\t\t cpu_R[dc->op2], cpu_R[dc->op1], t0, 4);\n+\n+\ttcg_temp_free(t0);\n+\n+\treturn 2;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static unsigned int dec_movs_r(DisasContext *dc)\n\n{\n\n\tTCGv t0;\n\n\tint size = memsize_z(dc);\n\n\tDIS(fprintf (logfile, \"movs.%c $r%u, $r%u\\n\",\n\n\t\t memsize_char(size),\n\n\t\t dc->op1, dc->op2));\n\n\n\n\tcris_cc_mask(dc, CC_MASK_NZ);\n\n\tt0 = tcg_temp_new(TCG_TYPE_TL);\n\n\t/* Size can only be qi or hi. */\n\n\tt_gen_sext(t0, cpu_R[dc->op1], size);\n\n\tcris_alu(dc, CC_OP_MOVE,\n\n\t\t cpu_R[dc->op2], cpu_R[dc->op1], t0, 4);\n\n\ttcg_temp_free(t0);\n\n\treturn 2;\n\n}\n"}} {"sample_id": "a9f8587e152c16e943c645ff295e015384ccd76d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n \n \n+ /* streaminfo metadata block */\n+\n+ put_bits(&pb, 16, s->avctx->frame_size);\n+\n+ put_bits(&pb, 16, s->avctx->frame_size);\n \n put_bits(&pb, 24, 0);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void write_streaminfo(FlacEncodeContext *s, uint8_t *header)\n\n{\n\n PutBitContext pb;\n\n\n\n memset(header, 0, FLAC_STREAMINFO_SIZE);\n\n init_put_bits(&pb, header, FLAC_STREAMINFO_SIZE);\n\n\n\n /* streaminfo metadata block */\n\n put_bits(&pb, 16, s->avctx->frame_size);\n\n put_bits(&pb, 16, s->avctx->frame_size);\n\n put_bits(&pb, 24, 0);\n\n put_bits(&pb, 24, s->max_framesize);\n\n put_bits(&pb, 20, s->samplerate);\n\n put_bits(&pb, 3, s->channels-1);\n\n put_bits(&pb, 5, 15); /* bits per sample - 1 */\n\n /* write 36-bit sample count in 2 put_bits() calls */\n\n put_bits(&pb, 24, (s->sample_count & 0xFFFFFF000LL) >> 12);\n\n put_bits(&pb, 12, s->sample_count & 0x000000FFFLL);\n\n flush_put_bits(&pb);\n\n /* MD5 signature = 0 */\n\n}\n"}} {"sample_id": "f789aa7baff33e74c549a249aba3ae7a364d7642", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void usage(const char *cmd)\n+\n {\n \n printf(", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void usage(const char *cmd)\n\n{\n\n printf(\n\n\"Usage: %s [-m -p ] []\\n\"\n\n\"QEMU Guest Agent %s\\n\"\n\n\"\\n\"\n\n\" -m, --method transport method: one of unix-listen, virtio-serial, or\\n\"\n\n\" isa-serial (virtio-serial is the default)\\n\"\n\n\" -p, --path device/socket path (the default for virtio-serial is:\\n\"\n\n\" %s)\\n\"\n\n\" -l, --logfile set logfile path, logs to stderr by default\\n\"\n\n\" -f, --pidfile specify pidfile (default is %s)\\n\"\n\n\" -v, --verbose log extra debugging information\\n\"\n\n\" -V, --version print version information and exit\\n\"\n\n\" -d, --daemonize become a daemon\\n\"\n\n#ifdef _WIN32\n\n\" -s, --service service commands: install, uninstall\\n\"\n\n#endif\n\n\" -b, --blacklist comma-separated list of RPCs to disable (no spaces, \\\"?\\\"\\n\"\n\n\" to list available RPCs)\\n\"\n\n\" -h, --help display this help and exit\\n\"\n\n\"\\n\"\n\n\"Report bugs to \\n\"\n\n , cmd, QGA_VERSION, QGA_VIRTIO_PATH_DEFAULT, QGA_PIDFILE_DEFAULT);\n\n}\n"}} {"sample_id": "3669915e93b3df63034857534245c3f2575d78ff", "diff": "--- a/source.c\n+++ b/source.c\n@@ -46,11 +46,11 @@\n if (pcm[of*2+1] == 0x80 && pcm[of*2] == 0x00)\n pcm[of*2+1] = 0;\n } else { /* 12bit quantization */\n+ lc = ((uint16_t)frame[d] << 4) |\n+ ((uint16_t)frame[d+2] >> 4);\n+ rc = ((uint16_t)frame[d+1] << 4) |\n+ ((uint16_t)frame[d+2] & 0x0f);\n+ lc = (lc == 0x800 ? 0 : dv_audio_12to16(lc));\n rc = (rc == 0x800 ? 0 : dv_audio_12to16(rc));\n of = sys->audio_shuffle[i%half_ch][j] + (d - 8) / 3 * sys->audio_stride;\n if (of*2 >= size)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4],\n const DVprofile *sys)\n{\n int size, chan, i, j, d, of, smpls, freq, quant, half_ch;\n uint16_t lc, rc;\n const uint8_t* as_pack;\n uint8_t *pcm, ipcm;\n as_pack = dv_extract_pack(frame, dv_audio_source);\n if (!as_pack) /* No audio ? */\n return 0;\n smpls = as_pack[1] & 0x3f; /* samples in this frame - min. samples */\n freq = (as_pack[4] >> 3) & 0x07; /* 0 - 48kHz, 1 - 44,1kHz, 2 - 32kHz */\n quant = as_pack[4] & 0x07; /* 0 - 16bit linear, 1 - 12bit nonlinear */\n if (quant > 1)\n return -1; /* unsupported quantization */\n if (freq >= FF_ARRAY_ELEMS(dv_audio_frequency))\n size = (sys->audio_min_samples[freq] + smpls) * 4; /* 2ch, 2bytes */\n half_ch = sys->difseg_size / 2;\n /* We work with 720p frames split in half, thus even frames have\n * channels 0,1 and odd 2,3. */\n ipcm = (sys->height == 720 && !(frame[1] & 0x0C)) ? 2 : 0;\n /* for each DIF channel */\n for (chan = 0; chan < sys->n_difchan; chan++) {\n av_assert0(ipcm<4);\n pcm = ppcm[ipcm++];\n if (!pcm)\n break;\n /* for each DIF segment */\n for (i = 0; i < sys->difseg_size; i++) {\n frame += 6 * 80; /* skip DIF segment header */\n if (quant == 1 && i == half_ch) {\n /* next stereo channel (12bit mode only) */\n av_assert0(ipcm<4);\n pcm = ppcm[ipcm++];\n if (!pcm)\n break;\n /* for each AV sequence */\n for (j = 0; j < 9; j++) {\n for (d = 8; d < 80; d += 2) {\n if (quant == 0) { /* 16bit quantization */\n of = sys->audio_shuffle[i][j] + (d - 8) / 2 * sys->audio_stride;\n if (of*2 >= size)\n continue;\n pcm[of*2] = frame[d+1]; // FIXME: maybe we have to admit\n pcm[of*2+1] = frame[d]; // that DV is a big-endian PCM\n if (pcm[of*2+1] == 0x80 && pcm[of*2] == 0x00)\n pcm[of*2+1] = 0;\n } else { /* 12bit quantization */\n lc = ((uint16_t)frame[d] << 4) |\n ((uint16_t)frame[d+2] >> 4);\n rc = ((uint16_t)frame[d+1] << 4) |\n ((uint16_t)frame[d+2] & 0x0f);\n lc = (lc == 0x800 ? 0 : dv_audio_12to16(lc));\n rc = (rc == 0x800 ? 0 : dv_audio_12to16(rc));\n of = sys->audio_shuffle[i%half_ch][j] + (d - 8) / 3 * sys->audio_stride;\n if (of*2 >= size)\n continue;\n pcm[of*2] = lc & 0xff; // FIXME: maybe we have to admit\n pcm[of*2+1] = lc >> 8; // that DV is a big-endian PCM\n of = sys->audio_shuffle[i%half_ch+half_ch][j] +\n (d - 8) / 3 * sys->audio_stride;\n pcm[of*2] = rc & 0xff; // FIXME: maybe we have to admit\n pcm[of*2+1] = rc >> 8; // that DV is a big-endian PCM\n ++d;\n frame += 16 * 80; /* 15 Video DIFs + 1 Audio DIF */\n return size;"}} {"sample_id": "636ced8e1dc8248a1353b416240b93d70ad03edb_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n int frame_number;\n \n+ double ti1, bitrate, avg_bitrate;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void do_video_stats(OutputStream *ost, int frame_size)\n\n{\n\n AVCodecContext *enc;\n\n int frame_number;\n\n double ti1, bitrate, avg_bitrate;\n\n\n\n /* this is executed just the first time do_video_stats is called */\n\n if (!vstats_file) {\n\n vstats_file = fopen(vstats_filename, \"w\");\n\n if (!vstats_file) {\n\n perror(\"fopen\");\n\n exit(1);\n\n }\n\n }\n\n\n\n enc = ost->st->codec;\n\n if (enc->codec_type == AVMEDIA_TYPE_VIDEO) {\n\n frame_number = ost->frame_number;\n\n fprintf(vstats_file, \"frame= %5d q= %2.1f \", frame_number, enc->coded_frame->quality / (float)FF_QP2LAMBDA);\n\n if (enc->flags&CODEC_FLAG_PSNR)\n\n fprintf(vstats_file, \"PSNR= %6.2f \", psnr(enc->coded_frame->error[0] / (enc->width * enc->height * 255.0 * 255.0)));\n\n\n\n fprintf(vstats_file,\"f_size= %6d \", frame_size);\n\n /* compute pts value */\n\n ti1 = ost->sync_opts * av_q2d(enc->time_base);\n\n if (ti1 < 0.01)\n\n ti1 = 0.01;\n\n\n\n bitrate = (frame_size * 8) / av_q2d(enc->time_base) / 1000.0;\n\n avg_bitrate = (double)(video_size * 8) / ti1 / 1000.0;\n\n fprintf(vstats_file, \"s_size= %8.0fkB time= %0.3f br= %7.1fkbits/s avg_br= %7.1fkbits/s \",\n\n (double)video_size / 1024, ti1, bitrate, avg_bitrate);\n\n fprintf(vstats_file, \"type= %c\\n\", av_get_picture_type_char(enc->coded_frame->pict_type));\n\n }\n\n}\n"}} {"sample_id": "0e1a46bbd2d6c39614b87f4e88ea305acce8a35f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n ARMCPU *cpu = opaque;\n \n CPUARMState *env = &cpu->env;\n+\n+\n+\n return arm_feature(env, ARM_FEATURE_PMSA) &&\n \n arm_feature(env, ARM_FEATURE_V7);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool pmsav7_needed(void *opaque)\n\n{\n\n ARMCPU *cpu = opaque;\n\n CPUARMState *env = &cpu->env;\n\n\n\n return arm_feature(env, ARM_FEATURE_PMSA) &&\n\n arm_feature(env, ARM_FEATURE_V7);\n\n}\n"}} {"sample_id": "d5103588aa39157c8eea3bb5fb6780bbd8be21b7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n qemu_co_queue_wait(&bs->throttled_reqs[is_write]);\n \n }\n+\n+\n+\n+ /* the IO will be executed, do the accounting */\n+\n throttle_account(&bs->throttle_state,\n \n is_write,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bdrv_io_limits_intercept(BlockDriverState *bs,\n\n int nb_sectors,\n\n bool is_write)\n\n{\n\n /* does this io must wait */\n\n bool must_wait = throttle_schedule_timer(&bs->throttle_state, is_write);\n\n\n\n /* if must wait or any request of this type throttled queue the IO */\n\n if (must_wait ||\n\n !qemu_co_queue_empty(&bs->throttled_reqs[is_write])) {\n\n qemu_co_queue_wait(&bs->throttled_reqs[is_write]);\n\n }\n\n\n\n /* the IO will be executed, do the accounting */\n\n throttle_account(&bs->throttle_state,\n\n is_write,\n\n nb_sectors * BDRV_SECTOR_SIZE);\n\n\n\n /* if the next request must wait -> do nothing */\n\n if (throttle_schedule_timer(&bs->throttle_state, is_write)) {\n\n return;\n\n }\n\n\n\n /* else queue next request for execution */\n\n qemu_co_queue_next(&bs->throttled_reqs[is_write]);\n\n}\n"}} {"sample_id": "631c56a8e46dea41585f3e7b3ef9c52b49faa385", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n int avformat_network_init(void)\n+\n+{\n+\n+#if CONFIG_NETWORK\n+\n int ret;\n \n ff_network_inited_globally = 1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int avformat_network_init(void)\n\n{\n\n#if CONFIG_NETWORK\n\n int ret;\n\n ff_network_inited_globally = 1;\n\n if ((ret = ff_network_init()) < 0)\n\n return ret;\n\n if ((ret = ff_tls_init()) < 0)\n\n return ret;\n\n#endif\n\n return 0;\n\n}\n"}} {"sample_id": "1d16a1cf99488f16492b1bb48e023f4da8377e07_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n if(nnzc[ scan8[i] ])\n \n+ ff_h264_idct_add_mmx (dest[(i&4)>>2] + block_offset[i], block + i*16, stride);\n+\n+ else if(block[i*16])\n+\n ff_h264_idct_dc_add_mmx2(dest[(i&4)>>2] + block_offset[i], block + i*16, stride);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ff_h264_idct_add8_mmx2(uint8_t **dest, const int *block_offset, DCTELEM *block, int stride, const uint8_t nnzc[6*8]){\n\n int i;\n\n for(i=16; i<16+8; i++){\n\n if(nnzc[ scan8[i] ])\n\n ff_h264_idct_add_mmx (dest[(i&4)>>2] + block_offset[i], block + i*16, stride);\n\n else if(block[i*16])\n\n ff_h264_idct_dc_add_mmx2(dest[(i&4)>>2] + block_offset[i], block + i*16, stride);\n\n }\n\n}\n"}} {"sample_id": "9a78eead0c74333a394c0f7bbfc4423ac746fcd5_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -44,11 +44,11 @@\n \n tmp.w[FP_ENDIAN_IDX], tmp.d, \\\n \n+ (double)tmp.fd, \\\n+\n+ (double)tmp.fs[FP_ENDIAN_IDX], \\\n+\n+ (double)tmp.fs[!FP_ENDIAN_IDX]); \\\n \n } \\\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void fpu_dump_state(CPUState *env, FILE *f,\n\n int (*fpu_fprintf)(FILE *f, const char *fmt, ...),\n\n int flags)\n\n{\n\n int i;\n\n int is_fpu64 = !!(env->hflags & MIPS_HFLAG_F64);\n\n\n\n#define printfpr(fp) \\\n\n do { \\\n\n if (is_fpu64) \\\n\n fpu_fprintf(f, \"w:%08x d:%016\" PRIx64 \\\n\n \" fd:%13g fs:%13g psu: %13g\\n\", \\\n\n (fp)->w[FP_ENDIAN_IDX], (fp)->d, \\\n\n (double)(fp)->fd, \\\n\n (double)(fp)->fs[FP_ENDIAN_IDX], \\\n\n (double)(fp)->fs[!FP_ENDIAN_IDX]); \\\n\n else { \\\n\n fpr_t tmp; \\\n\n tmp.w[FP_ENDIAN_IDX] = (fp)->w[FP_ENDIAN_IDX]; \\\n\n tmp.w[!FP_ENDIAN_IDX] = ((fp) + 1)->w[FP_ENDIAN_IDX]; \\\n\n fpu_fprintf(f, \"w:%08x d:%016\" PRIx64 \\\n\n \" fd:%13g fs:%13g psu:%13g\\n\", \\\n\n tmp.w[FP_ENDIAN_IDX], tmp.d, \\\n\n (double)tmp.fd, \\\n\n (double)tmp.fs[FP_ENDIAN_IDX], \\\n\n (double)tmp.fs[!FP_ENDIAN_IDX]); \\\n\n } \\\n\n } while(0)\n\n\n\n\n\n fpu_fprintf(f, \"CP1 FCR0 0x%08x FCR31 0x%08x SR.FR %d fp_status 0x%08x(0x%02x)\\n\",\n\n env->active_fpu.fcr0, env->active_fpu.fcr31, is_fpu64, env->active_fpu.fp_status,\n\n get_float_exception_flags(&env->active_fpu.fp_status));\n\n for (i = 0; i < 32; (is_fpu64) ? i++ : (i += 2)) {\n\n fpu_fprintf(f, \"%3s: \", fregnames[i]);\n\n printfpr(&env->active_fpu.fpr[i]);\n\n }\n\n\n\n#undef printfpr\n\n}\n"}} {"sample_id": "6d0ee85040e4d238e2483191fe6e74aebbecd5d5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n VirtIOBalloon *s = opaque;\n \n+\n+\n+ if (version_id != 1)\n+\n return -EINVAL;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int virtio_balloon_load(QEMUFile *f, void *opaque, int version_id)\n\n{\n\n VirtIOBalloon *s = opaque;\n\n\n\n if (version_id != 1)\n\n return -EINVAL;\n\n\n\n virtio_load(&s->vdev, f);\n\n\n\n s->num_pages = qemu_get_be32(f);\n\n s->actual = qemu_get_be32(f);\n\n qemu_get_buffer(f, (uint8_t *)&s->stats_vq_elem, sizeof(VirtQueueElement));\n\n qemu_get_buffer(f, (uint8_t *)&s->stats_vq_offset, sizeof(size_t));\n\n qemu_get_buffer(f, (uint8_t *)&s->stats_callback, sizeof(MonitorCompletion));\n\n qemu_get_buffer(f, (uint8_t *)&s->stats_opaque_callback_data, sizeof(void));\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "eabb7b91b36b202b4dac2df2d59d698e3aff197a_33", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n aimm >>= 12;\n \n+ assert(aimm <= 0xfff);\n+\n+ aimm |= 1 << 12; /* apply LSL 12 */\n+\n+ }\n \n tcg_out32(s, insn | ext << 31 | aimm << 10 | rn << 5 | rd);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void tcg_out_insn_3401(TCGContext *s, AArch64Insn insn, TCGType ext,\n\n TCGReg rd, TCGReg rn, uint64_t aimm)\n\n{\n\n if (aimm > 0xfff) {\n\n assert((aimm & 0xfff) == 0);\n\n aimm >>= 12;\n\n assert(aimm <= 0xfff);\n\n aimm |= 1 << 12; /* apply LSL 12 */\n\n }\n\n tcg_out32(s, insn | ext << 31 | aimm << 10 | rn << 5 | rd);\n\n}\n"}} {"sample_id": "0a39c9ac0bfd7345fe676b4e2707d9cec3cbb553", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n int cpu_flags = av_get_cpu_flags();\n \n+\n+\n+ if (INLINE_MMX(cpu_flags))\n+\n+ hpeldsp_init_mmx(c, flags);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "av_cold void ff_hpeldsp_init_x86(HpelDSPContext *c, int flags)\n\n{\n\n int cpu_flags = av_get_cpu_flags();\n\n\n\n if (INLINE_MMX(cpu_flags))\n\n hpeldsp_init_mmx(c, flags);\n\n\n\n if (EXTERNAL_AMD3DNOW(cpu_flags))\n\n hpeldsp_init_3dnow(c, flags);\n\n\n\n if (EXTERNAL_MMXEXT(cpu_flags))\n\n hpeldsp_init_mmxext(c, flags);\n\n\n\n if (EXTERNAL_SSE2_FAST(cpu_flags))\n\n hpeldsp_init_sse2_fast(c, flags);\n\n\n\n if (CONFIG_VP3_DECODER)\n\n ff_hpeldsp_vp3_init_x86(c, cpu_flags, flags);\n\n}\n"}} {"sample_id": "e23a1b33b53d25510320b26d9f154e19c6c99725_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n DeviceState *dev;\n \n SysBusDevice *s;\n+\n \n \n dev = qdev_create(NULL, \"SUNW,tcx\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void tcx_init(target_phys_addr_t addr, int vram_size, int width,\n\n int height, int depth)\n\n{\n\n DeviceState *dev;\n\n SysBusDevice *s;\n\n\n\n dev = qdev_create(NULL, \"SUNW,tcx\");\n\n qdev_prop_set_taddr(dev, \"addr\", addr);\n\n qdev_prop_set_uint32(dev, \"vram_size\", vram_size);\n\n qdev_prop_set_uint16(dev, \"width\", width);\n\n qdev_prop_set_uint16(dev, \"height\", height);\n\n qdev_prop_set_uint16(dev, \"depth\", depth);\n\n qdev_init(dev);\n\n s = sysbus_from_qdev(dev);\n\n /* 8-bit plane */\n\n sysbus_mmio_map(s, 0, addr + 0x00800000ULL);\n\n /* DAC */\n\n sysbus_mmio_map(s, 1, addr + 0x00200000ULL);\n\n /* TEC (dummy) */\n\n sysbus_mmio_map(s, 2, addr + 0x00700000ULL);\n\n /* THC 24 bit: NetBSD writes here even with 8-bit display: dummy */\n\n sysbus_mmio_map(s, 3, addr + 0x00301000ULL);\n\n if (depth == 24) {\n\n /* 24-bit plane */\n\n sysbus_mmio_map(s, 4, addr + 0x02000000ULL);\n\n /* Control plane */\n\n sysbus_mmio_map(s, 5, addr + 0x0a000000ULL);\n\n } else {\n\n /* THC 8 bit (dummy) */\n\n sysbus_mmio_map(s, 4, addr + 0x00300000ULL);\n\n }\n\n}\n"}} {"sample_id": "3f2ca480eb872b4946baf77f756236b637a5b15a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+uint32_t kvmppc_get_vmx(void)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint32_t kvmppc_get_vmx(void)\n\n{\n\n return kvmppc_read_int_cpu_dt(\"ibm,vmx\");\n\n}\n"}} {"sample_id": "e4256c3cbf7eefebc0bc6e1f472c47c6dd20b996", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n TCGv_i64 tcg_rd = cpu_reg(s, rd);\n \n TCGv_i64 tcg_tmp = tcg_temp_new_i64();\n+\n+ TCGv_i64 tcg_rn = read_cpu_reg(s, rn, sf);\n+\n+ TCGv_i64 mask = tcg_const_i64(sf ? 0x00ff00ff00ff00ffull : 0x00ff00ff);\n+\n \n \n tcg_gen_shri_i64(tcg_tmp, tcg_rn, 8);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void handle_rev16(DisasContext *s, unsigned int sf,\n\n unsigned int rn, unsigned int rd)\n\n{\n\n TCGv_i64 tcg_rd = cpu_reg(s, rd);\n\n TCGv_i64 tcg_tmp = tcg_temp_new_i64();\n\n TCGv_i64 tcg_rn = read_cpu_reg(s, rn, sf);\n\n TCGv_i64 mask = tcg_const_i64(sf ? 0x00ff00ff00ff00ffull : 0x00ff00ff);\n\n\n\n tcg_gen_shri_i64(tcg_tmp, tcg_rn, 8);\n\n tcg_gen_and_i64(tcg_rd, tcg_rn, mask);\n\n tcg_gen_and_i64(tcg_tmp, tcg_tmp, mask);\n\n tcg_gen_shli_i64(tcg_rd, tcg_rd, 8);\n\n tcg_gen_or_i64(tcg_rd, tcg_rd, tcg_tmp);\n\n\n\n\n tcg_temp_free_i64(tcg_tmp);\n\n}"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_72", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void scsi_aio_complete(void *opaque, int ret)\n+\n+{\n+\n+ SCSIDiskReq *r = (SCSIDiskReq *)opaque;\n \n SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void scsi_aio_complete(void *opaque, int ret)\n\n{\n\n SCSIDiskReq *r = (SCSIDiskReq *)opaque;\n\n SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);\n\n\n\n assert(r->req.aiocb != NULL);\n\n r->req.aiocb = NULL;\n\n block_acct_done(bdrv_get_stats(s->qdev.conf.bs), &r->acct);\n\n if (r->req.io_canceled) {\n\n scsi_req_cancel_complete(&r->req);\n\n goto done;\n\n }\n\n\n\n if (ret < 0) {\n\n if (scsi_handle_rw_error(r, -ret)) {\n\n goto done;\n\n }\n\n }\n\n\n\n scsi_req_complete(&r->req, GOOD);\n\n\n\ndone:\n\n scsi_req_unref(&r->req);\n\n}\n"}} {"sample_id": "d9123d09f711bf1b855de2b5a907d4c85f46d6c3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n gchar *command;\n const char *qemu_binary;\n qemu_binary = getenv(\"QTEST_QEMU_BINARY\");\n+ g_assert(qemu_binary != NULL);\n+ s = g_malloc(sizeof(*s));\n+ socket_path = g_strdup_printf(\"/tmp/qtest-%d.sock\", getpid());\n+ qmp_socket_path = g_strdup_printf(\"/tmp/qtest-%d.qmp\", getpid());\n+ sock = init_socket(socket_path);\n qmpsock = init_socket(qmp_socket_path);\n qtest_add_abrt_handler(kill_qemu_hook_func, s);\n s->qemu_pid = fork();", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "QTestState *qtest_init_without_qmp_handshake(const char *extra_args)\n{\n QTestState *s;\n int sock, qmpsock, i;\n gchar *socket_path;\n gchar *qmp_socket_path;\n gchar *command;\n const char *qemu_binary;\n qemu_binary = getenv(\"QTEST_QEMU_BINARY\");\n g_assert(qemu_binary != NULL);\n s = g_malloc(sizeof(*s));\n socket_path = g_strdup_printf(\"/tmp/qtest-%d.sock\", getpid());\n qmp_socket_path = g_strdup_printf(\"/tmp/qtest-%d.qmp\", getpid());\n sock = init_socket(socket_path);\n qmpsock = init_socket(qmp_socket_path);\n qtest_add_abrt_handler(kill_qemu_hook_func, s);\n s->qemu_pid = fork();\n if (s->qemu_pid == 0) {\n setenv(\"QEMU_AUDIO_DRV\", \"none\", true);\n command = g_strdup_printf(\"exec %s \"\n \"-qtest unix:%s,nowait \"\n \"-qtest-log %s \"\n \"-qmp unix:%s,nowait \"\n \"-machine accel=qtest \"\n \"-display none \"\n \"%s\", qemu_binary, socket_path,\n getenv(\"QTEST_LOG\") ? \"/dev/fd/2\" : \"/dev/null\",\n qmp_socket_path,\n extra_args ?: \"\");\n execlp(\"/bin/sh\", \"sh\", \"-c\", command, NULL);\n exit(1);\n }\n s->fd = socket_accept(sock);\n if (s->fd >= 0) {\n s->qmp_fd = socket_accept(qmpsock);\n }\n g_free(socket_path);\n g_free(qmp_socket_path);\n g_assert(s->fd >= 0 && s->qmp_fd >= 0);\n s->rx = g_string_new(\"\");\n for (i = 0; i < MAX_IRQ; i++) {\n s->irq_level[i] = false;\n }\n if (getenv(\"QTEST_STOP\")) {\n kill(s->qemu_pid, SIGSTOP);\n }\n /* ask endianness of the target */\n s->big_endian = qtest_query_target_endianness(s);\n return s;\n}"}} {"sample_id": "085ca7dcdbf9ab6c23e3a5397b1f6d4aa23f763d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n vbi_version(&maj, &min, &rev);\n \n+ if (!(maj > 0 || min > 2 || min == 2 && rev >= 26)) {\n \n av_log(avctx, AV_LOG_ERROR, \"decoder needs zvbi version >= 0.2.26.\\n\");\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int teletext_init_decoder(AVCodecContext *avctx)\n\n{\n\n TeletextContext *ctx = avctx->priv_data;\n\n unsigned int maj, min, rev;\n\n\n\n vbi_version(&maj, &min, &rev);\n\n if (!(maj > 0 || min > 2 || min == 2 && rev >= 26)) {\n\n av_log(avctx, AV_LOG_ERROR, \"decoder needs zvbi version >= 0.2.26.\\n\");\n\n return AVERROR_EXTERNAL;\n\n }\n\n\n\n if (ctx->format_id == 0) {\n\n avctx->width = 41 * BITMAP_CHAR_WIDTH;\n\n avctx->height = 25 * BITMAP_CHAR_HEIGHT;\n\n }\n\n\n\n ctx->dx = NULL;\n\n ctx->vbi = NULL;\n\n ctx->pts = AV_NOPTS_VALUE;\n\n\n\n#ifdef DEBUG\n\n {\n\n char *t;\n\n ctx->ex = vbi_export_new(\"text\", &t);\n\n }\n\n#endif\n\n av_log(avctx, AV_LOG_VERBOSE, \"page filter: %s\\n\", ctx->pgno);\n\n return (ctx->format_id == 1) ? ff_ass_subtitle_header_default(avctx) : 0;\n\n}\n"}} {"sample_id": "ecaf54a052c357e0bacb93c3f178fed34e4821ec", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n void hmp_info_memdev(Monitor *mon, const QDict *qdict)\n {\n Error *err = NULL;\n+ MemdevList *memdev_list = qmp_query_memdev(&err);\n+ MemdevList *m = memdev_list;\n+ StringOutputVisitor *ov;\n+ char *str;\n+ int i = 0;\n while (m) {\n ov = string_output_visitor_new(false);\n visit_type_uint16List(string_output_get_visitor(ov),", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void hmp_info_memdev(Monitor *mon, const QDict *qdict)\n{\n Error *err = NULL;\n MemdevList *memdev_list = qmp_query_memdev(&err);\n MemdevList *m = memdev_list;\n StringOutputVisitor *ov;\n char *str;\n int i = 0;\n while (m) {\n ov = string_output_visitor_new(false);\n visit_type_uint16List(string_output_get_visitor(ov),\n &m->value->host_nodes, NULL, NULL);\n monitor_printf(mon, \"memory backend: %d\\n\", i);\n monitor_printf(mon, \" size: %\" PRId64 \"\\n\", m->value->size);\n monitor_printf(mon, \" merge: %s\\n\",\n m->value->merge ? \"true\" : \"false\");\n monitor_printf(mon, \" dump: %s\\n\",\n m->value->dump ? \"true\" : \"false\");\n monitor_printf(mon, \" prealloc: %s\\n\",\n m->value->prealloc ? \"true\" : \"false\");\n monitor_printf(mon, \" policy: %s\\n\",\n HostMemPolicy_lookup[m->value->policy]);\n str = string_output_get_string(ov);\n monitor_printf(mon, \" host nodes: %s\\n\", str);\n g_free(str);\n string_output_visitor_cleanup(ov);\n m = m->next;\n i++;\n }\n monitor_printf(mon, \"\\n\");\n}"}} {"sample_id": "a517e88baa9bef2b5c54a11d62b2b2ab2a5c4ab7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n nbd = open(device, O_RDWR);\n \n if (nbd != -1)\n+\n+ close(nbd);\n+\n+ exit(0);\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void show_parts(const char *device)\n\n{\n\n if (fork() == 0) {\n\n int nbd;\n\n\n\n /* linux just needs an open() to trigger\n\n * the partition table update\n\n * but remember to load the module with max_part != 0 :\n\n * modprobe nbd max_part=63\n\n */\n\n nbd = open(device, O_RDWR);\n\n if (nbd != -1)\n\n close(nbd);\n\n exit(0);\n\n }\n\n}\n"}} {"sample_id": "8dc72eeaf647736c287b59a3856a11904bedd58b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n socklen_t *addr_len, const char *localaddr)\n \n {\n+\n int udp_fd = -1;\n \n struct addrinfo *res0 = NULL, *res = NULL;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int udp_socket_create(UDPContext *s, struct sockaddr_storage *addr,\n\n socklen_t *addr_len, const char *localaddr)\n\n{\n\n int udp_fd = -1;\n\n struct addrinfo *res0 = NULL, *res = NULL;\n\n int family = AF_UNSPEC;\n\n\n\n if (((struct sockaddr *) &s->dest_addr)->sa_family)\n\n family = ((struct sockaddr *) &s->dest_addr)->sa_family;\n\n res0 = udp_resolve_host(localaddr[0] ? localaddr : NULL, s->local_port,\n\n SOCK_DGRAM, family, AI_PASSIVE);\n\n if (res0 == 0)\n\n goto fail;\n\n for (res = res0; res; res=res->ai_next) {\n\n udp_fd = ff_socket(res->ai_family, SOCK_DGRAM, 0);\n\n if (udp_fd != -1) break;\n\n log_net_error(NULL, AV_LOG_ERROR, \"socket\");\n\n }\n\n\n\n if (udp_fd < 0)\n\n goto fail;\n\n\n\n memcpy(addr, res->ai_addr, res->ai_addrlen);\n\n *addr_len = res->ai_addrlen;\n\n\n\n freeaddrinfo(res0);\n\n\n\n return udp_fd;\n\n\n\n fail:\n\n if (udp_fd >= 0)\n\n closesocket(udp_fd);\n\n if(res0)\n\n freeaddrinfo(res0);\n\n return -1;\n\n}\n"}} {"sample_id": "92b540dac9fc3a572c7342edd0b073000f5a6abf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void check_guest_output(const testdef_t *test, int fd)\n \n+{\n \n bool output_ok = false;\n+\n int i, nbr, pos = 0;\n \n char ch;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void check_guest_output(const testdef_t *test, int fd)\n\n{\n\n bool output_ok = false;\n\n int i, nbr, pos = 0;\n\n char ch;\n\n\n\n /* Poll serial output... Wait at most 60 seconds */\n\n for (i = 0; i < 6000; ++i) {\n\n while ((nbr = read(fd, &ch, 1)) == 1) {\n\n if (ch == test->expect[pos]) {\n\n pos += 1;\n\n if (test->expect[pos] == '\\0') {\n\n /* We've reached the end of the expected string! */\n\n output_ok = true;\n\n goto done;\n\n }\n\n } else {\n\n pos = 0;\n\n }\n\n }\n\n g_assert(nbr >= 0);\n\n g_usleep(10000);\n\n }\n\n\n\ndone:\n\n g_assert(output_ok);\n\n}\n"}} {"sample_id": "f06b2031a31cdd3acf6f61a977e505b8c6b58f73", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void ga_channel_free(GAChannel *c)\n+\n+{\n+\n+ if (c->method == GA_CHANNEL_UNIX_LISTEN\n+\n && c->listen_channel) {\n \n ga_channel_listen_close(c);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ga_channel_free(GAChannel *c)\n\n{\n\n if (c->method == GA_CHANNEL_UNIX_LISTEN\n\n && c->listen_channel) {\n\n ga_channel_listen_close(c);\n\n }\n\n if (c->client_channel) {\n\n ga_channel_client_close(c);\n\n }\n\n g_free(c);\n\n}\n"}} {"sample_id": "e389be1673052b538534643165111725a79e5afd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static inline bool extended_addresses_enabled(CPUARMState *env)\n \n {\n+\n+ return arm_el_is_aa64(env, 1)\n \n || ((arm_feature(env, ARM_FEATURE_LPAE)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline bool extended_addresses_enabled(CPUARMState *env)\n\n{\n\n return arm_el_is_aa64(env, 1)\n\n || ((arm_feature(env, ARM_FEATURE_LPAE)\n\n && (env->cp15.c2_control & (1U << 31))));\n\n}\n"}} {"sample_id": "bea60dd7679364493a0d7f5b54316c767cf894ef_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,22 +1,22 @@\n static void vnc_dpy_switch(DisplayChangeListener *dcl,\n+\n DisplaySurface *surface)\n \n {\n \n+ VncDisplay *vd = container_of(dcl, VncDisplay, dcl);\n \n VncState *vs;\n \n \n+\n vnc_abort_display_jobs(vd);\n \n \n \n /* server surface */\n \n+ qemu_pixman_image_unref(vd->server);\n \n vd->ds = surface;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void vnc_dpy_switch(DisplayChangeListener *dcl,\n\n DisplaySurface *surface)\n\n{\n\n VncDisplay *vd = container_of(dcl, VncDisplay, dcl);\n\n VncState *vs;\n\n\n\n vnc_abort_display_jobs(vd);\n\n\n\n /* server surface */\n\n qemu_pixman_image_unref(vd->server);\n\n vd->ds = surface;\n\n vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT,\n\n surface_width(vd->ds),\n\n surface_height(vd->ds),\n\n NULL, 0);\n\n\n\n /* guest surface */\n\n#if 0 /* FIXME */\n\n if (ds_get_bytes_per_pixel(ds) != vd->guest.ds->pf.bytes_per_pixel)\n\n console_color_init(ds);\n\n#endif\n\n qemu_pixman_image_unref(vd->guest.fb);\n\n vd->guest.fb = pixman_image_ref(surface->image);\n\n vd->guest.format = surface->format;\n\n VNC_SET_VISIBLE_PIXELS_DIRTY(vd->guest.dirty,\n\n surface_width(vd->ds),\n\n surface_height(vd->ds));\n\n\n\n QTAILQ_FOREACH(vs, &vd->clients, next) {\n\n vnc_colordepth(vs);\n\n vnc_desktop_resize(vs);\n\n if (vs->vd->cursor) {\n\n vnc_cursor_define(vs);\n\n }\n\n VNC_SET_VISIBLE_PIXELS_DIRTY(vs->dirty,\n\n surface_width(vd->ds),\n\n surface_height(vd->ds));\n\n }\n\n}\n"}} {"sample_id": "ea37df2d528c15dc472e7272ac5278090f01f38e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(pix_fmt);\n+\n+ int max_step [4]; /* max pixel step for each plane */\n+\n+ int max_step_comp[4]; /* the component for each plane which has the max pixel step */\n+\n \n \n if ((unsigned)pix_fmt >= AV_PIX_FMT_NB || desc->flags & AV_PIX_FMT_FLAG_HWACCEL)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int av_image_get_linesize(enum AVPixelFormat pix_fmt, int width, int plane)\n\n{\n\n const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(pix_fmt);\n\n int max_step [4]; /* max pixel step for each plane */\n\n int max_step_comp[4]; /* the component for each plane which has the max pixel step */\n\n\n\n if ((unsigned)pix_fmt >= AV_PIX_FMT_NB || desc->flags & AV_PIX_FMT_FLAG_HWACCEL)\n\n return AVERROR(EINVAL);\n\n\n\n av_image_fill_max_pixsteps(max_step, max_step_comp, desc);\n\n return image_get_linesize(width, plane, max_step[plane], max_step_comp[plane], desc);\n\n}\n"}} {"sample_id": "c04643a2c24564aed96a5b0760de8bf02eb305c6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -38,11 +38,11 @@\n \n abort();\n \n+ }\n+\n+ }\n+\n+ }\n \n *has_video_ptr = has_video;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void check_audio_video_inputs(int *has_video_ptr, int *has_audio_ptr)\n\n{\n\n int has_video, has_audio, i, j;\n\n AVFormatContext *ic;\n\n\n\n has_video = 0;\n\n has_audio = 0;\n\n for(j=0;jnb_streams;i++) {\n\n AVCodecContext *enc = &ic->streams[i]->codec;\n\n switch(enc->codec_type) {\n\n case CODEC_TYPE_AUDIO:\n\n has_audio = 1;\n\n break;\n\n case CODEC_TYPE_VIDEO:\n\n has_video = 1;\n\n break;\n\n default:\n\n abort();\n\n }\n\n }\n\n }\n\n *has_video_ptr = has_video;\n\n *has_audio_ptr = has_audio;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_82", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,5 +7,5 @@\n qemu_get_sbe32s(f, v);\n \n return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int get_int32(QEMUFile *f, void *pv, size_t size)\n\n{\n\n int32_t *v = pv;\n\n qemu_get_sbe32s(f, v);\n\n return 0;\n\n}\n"}} {"sample_id": "56439e9d55626b65ecb887f1ac3714652555312e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int64_t coroutine_fn qcow_co_get_block_status(BlockDriverState *bs,\n \n+ int64_t sector_num, int nb_sectors, int *pnum, BlockDriverState **file)\n \n {\n+\n BDRVQcowState *s = bs->opaque;\n \n int index_in_cluster, n;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int64_t coroutine_fn qcow_co_get_block_status(BlockDriverState *bs,\n\n int64_t sector_num, int nb_sectors, int *pnum, BlockDriverState **file)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n int index_in_cluster, n;\n\n uint64_t cluster_offset;\n\n\n\n qemu_co_mutex_lock(&s->lock);\n\n cluster_offset = get_cluster_offset(bs, sector_num << 9, 0, 0, 0, 0);\n\n qemu_co_mutex_unlock(&s->lock);\n\n index_in_cluster = sector_num & (s->cluster_sectors - 1);\n\n n = s->cluster_sectors - index_in_cluster;\n\n if (n > nb_sectors)\n\n n = nb_sectors;\n\n *pnum = n;\n\n if (!cluster_offset) {\n\n return 0;\n\n }\n\n if ((cluster_offset & QCOW_OFLAG_COMPRESSED) || s->crypto) {\n\n return BDRV_BLOCK_DATA;\n\n }\n\n cluster_offset |= (index_in_cluster << BDRV_SECTOR_BITS);\n\n *file = bs->file->bs;\n\n return BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID | cluster_offset;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_63", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void remote_block_to_network(RDMARemoteBlock *rb)\n+\n+{\n+\n rb->remote_host_addr = htonll(rb->remote_host_addr);\n \n rb->offset = htonll(rb->offset);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void remote_block_to_network(RDMARemoteBlock *rb)\n\n{\n\n rb->remote_host_addr = htonll(rb->remote_host_addr);\n\n rb->offset = htonll(rb->offset);\n\n rb->length = htonll(rb->length);\n\n rb->remote_rkey = htonl(rb->remote_rkey);\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_64", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+PPC_OP(subfeo)\n+\n+{\n \n do_subfeo();\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "PPC_OP(subfeo)\n\n{\n\n do_subfeo();\n\n RETURN();\n\n}\n"}} {"sample_id": "4e17eae9f2ee49833698aae2753c5bb041510870", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void tcg_target_qemu_prologue(TCGContext *s)\n+\n {\n \n+ /* stmdb sp!, { r9 - r11, lr } */\n \n tcg_out32(s, (COND_AL << 28) | 0x092d4e00);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void tcg_target_qemu_prologue(TCGContext *s)\n\n{\n\n /* stmdb sp!, { r9 - r11, lr } */\n\n tcg_out32(s, (COND_AL << 28) | 0x092d4e00);\n\n\n\n tcg_out_bx(s, COND_AL, TCG_REG_R0);\n\n tb_ret_addr = s->code_ptr;\n\n\n\n /* ldmia sp!, { r9 - r11, pc } */\n\n tcg_out32(s, (COND_AL << 28) | 0x08bd8e00);\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_76", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n ctx->thread_pool = thread_pool_new(ctx);\n \n }\n+\n+ return ctx->thread_pool;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "ThreadPool *aio_get_thread_pool(AioContext *ctx)\n\n{\n\n if (!ctx->thread_pool) {\n\n ctx->thread_pool = thread_pool_new(ctx);\n\n }\n\n return ctx->thread_pool;\n\n}\n"}} {"sample_id": "3f50965b28d0c4ef10dde0bf2f7a9f78fa36b378_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n const int q1 = pix[1*xstride];\n \n+\n+\n+ if( FFABS( p0 - q0 ) < alpha &&\n+\n+ FFABS( p1 - p0 ) < beta &&\n \n FFABS( q1 - q0 ) < beta ) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void h264_loop_filter_chroma_intra_c(uint8_t *pix, int xstride, int ystride, int alpha, int beta)\n\n{\n\n int d;\n\n for( d = 0; d < 8; d++ ) {\n\n const int p0 = pix[-1*xstride];\n\n const int p1 = pix[-2*xstride];\n\n const int q0 = pix[0];\n\n const int q1 = pix[1*xstride];\n\n\n\n if( FFABS( p0 - q0 ) < alpha &&\n\n FFABS( p1 - p0 ) < beta &&\n\n FFABS( q1 - q0 ) < beta ) {\n\n\n\n pix[-xstride] = ( 2*p1 + p0 + q1 + 2 ) >> 2; /* p0' */\n\n pix[0] = ( 2*q1 + q0 + p1 + 2 ) >> 2; /* q0' */\n\n }\n\n pix += ystride;\n\n }\n\n}\n"}} {"sample_id": "7a2c4b82340d621bff462672b29c88d2020d68c1_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n ide_atapi_cmd_error(s, SENSE_NOT_READY, ASC_MEDIUM_NOT_PRESENT);\n \n return;\n+\n+ }\n+\n+\n+\n lba = ube32_to_cpu(buf + 2);\n \n if (lba >= total_sectors) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void cmd_seek(IDEState *s, uint8_t* buf)\n\n{\n\n unsigned int lba;\n\n uint64_t total_sectors = s->nb_sectors >> 2;\n\n\n\n if (total_sectors == 0) {\n\n ide_atapi_cmd_error(s, SENSE_NOT_READY, ASC_MEDIUM_NOT_PRESENT);\n\n return;\n\n }\n\n\n\n lba = ube32_to_cpu(buf + 2);\n\n if (lba >= total_sectors) {\n\n ide_atapi_cmd_error(s, SENSE_ILLEGAL_REQUEST, ASC_LOGICAL_BLOCK_OOR);\n\n return;\n\n }\n\n\n\n ide_atapi_cmd_ok(s);\n\n}\n"}} {"sample_id": "7b3621f47a990c5099c6385728347f69a8d0e55c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void pty_chr_close(struct CharDriverState *chr)\n \n {\n+\n PtyCharDriver *s = chr->opaque;\n \n int fd;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void pty_chr_close(struct CharDriverState *chr)\n\n{\n\n PtyCharDriver *s = chr->opaque;\n\n int fd;\n\n\n\n remove_fd_in_watch(chr);\n\n fd = g_io_channel_unix_get_fd(s->fd);\n\n g_io_channel_unref(s->fd);\n\n close(fd);\n\n if (s->timer_tag) {\n\n g_source_remove(s->timer_tag);\n\n s->timer_tag = 0;\n\n }\n\n g_free(s);\n\n qemu_chr_be_event(chr, CHR_EVENT_CLOSED);\n\n}\n"}} {"sample_id": "e14935df26c2c10b3445b1910f4ff76f3fb1a1b1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -46,11 +46,11 @@\n \n if (!*filename) {\n \n+ error_report(\"character device specification needed\");\n+\n+ return NULL;\n+\n+ }\n \n filename++;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static USBDevice *usb_serial_init(USBBus *bus, const char *filename)\n\n{\n\n USBDevice *dev;\n\n Chardev *cdrv;\n\n char label[32];\n\n static int index;\n\n\n\n while (*filename && *filename != ':') {\n\n const char *p;\n\n\n\n if (strstart(filename, \"vendorid=\", &p)) {\n\n error_report(\"vendorid is not supported anymore\");\n\n return NULL;\n\n } else if (strstart(filename, \"productid=\", &p)) {\n\n error_report(\"productid is not supported anymore\");\n\n return NULL;\n\n } else {\n\n error_report(\"unrecognized serial USB option %s\", filename);\n\n return NULL;\n\n }\n\n while(*filename == ',')\n\n filename++;\n\n }\n\n if (!*filename) {\n\n error_report(\"character device specification needed\");\n\n return NULL;\n\n }\n\n filename++;\n\n\n\n snprintf(label, sizeof(label), \"usbserial%d\", index++);\n\n cdrv = qemu_chr_new(label, filename);\n\n if (!cdrv)\n\n return NULL;\n\n\n\n dev = usb_create(bus, \"usb-serial\");\n\n qdev_prop_set_chr(&dev->qdev, \"chardev\", cdrv);\n\n\n\n return dev;\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_49", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n int bdrv_write_zeroes(BlockDriverState *bs, int64_t sector_num,\n \n int nb_sectors, BdrvRequestFlags flags)\n+\n+{\n \n return bdrv_rw_co(bs, sector_num, NULL, nb_sectors, true,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int bdrv_write_zeroes(BlockDriverState *bs, int64_t sector_num,\n\n int nb_sectors, BdrvRequestFlags flags)\n\n{\n\n return bdrv_rw_co(bs, sector_num, NULL, nb_sectors, true,\n\n BDRV_REQ_ZERO_WRITE | flags);\n\n}\n"}} {"sample_id": "85a040e5485413333da4fcf98bc8b28c92fa623f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n return -errno;\n \n }\n+\n+\n+\n+ ret = qemu_config_parse(f, config_groups, filename);\n+\n if (ret < 0) {\n \n error_setg(errp, \"Could not parse blkdebug config file\");", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int read_config(BDRVBlkdebugState *s, const char *filename, Error **errp)\n\n{\n\n FILE *f;\n\n int ret;\n\n struct add_rule_data d;\n\n\n\n f = fopen(filename, \"r\");\n\n if (f == NULL) {\n\n error_setg_errno(errp, errno, \"Could not read blkdebug config file\");\n\n return -errno;\n\n }\n\n\n\n ret = qemu_config_parse(f, config_groups, filename);\n\n if (ret < 0) {\n\n error_setg(errp, \"Could not parse blkdebug config file\");\n\n ret = -EINVAL;\n\n goto fail;\n\n }\n\n\n\n d.s = s;\n\n d.action = ACTION_INJECT_ERROR;\n\n qemu_opts_foreach(&inject_error_opts, add_rule, &d, 0);\n\n\n\n d.action = ACTION_SET_STATE;\n\n qemu_opts_foreach(&set_state_opts, add_rule, &d, 0);\n\n\n\n ret = 0;\n\nfail:\n\n qemu_opts_reset(&inject_error_opts);\n\n qemu_opts_reset(&set_state_opts);\n\n fclose(f);\n\n return ret;\n\n}\n"}} {"sample_id": "8458dab185ab52c3663c6f5a57c2bee7ca22af37", "diff": "--- a/source.c\n+++ b/source.c\n@@ -47,11 +47,11 @@\n *pd++ = ps[1];\n \n }\n+\n+ ps += 2;\n+\n+ }\n+\n i += l;\n \n } while (i < len);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int rle_unpack(unsigned char *src, unsigned char *dest, int len)\n\n{\n\n unsigned char *ps;\n\n unsigned char *pd;\n\n int i, l;\n\n\n\n ps = src;\n\n pd = dest;\n\n if (len & 1)\n\n *pd++ = *ps++;\n\n\n\n len >>= 1;\n\n i = 0;\n\n do {\n\n l = *ps++;\n\n if (l & 0x80) {\n\n l = (l & 0x7F) * 2;\n\n memcpy(pd, ps, l);\n\n ps += l;\n\n pd += l;\n\n } else {\n\n for (i = 0; i < l; i++) {\n\n *pd++ = ps[0];\n\n *pd++ = ps[1];\n\n }\n\n ps += 2;\n\n }\n\n i += l;\n\n } while (i < len);\n\n\n\n return (ps - src);\n\n}\n"}} {"sample_id": "9e559533bd825a3e371497875576137a8586c831", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n \n t2 = tsub(t2, ctx->t1);\n \n+ print_report(\"wrote\", &t2, ctx->offset, ctx->qiov.size,\n+\n+ ctx->qiov.size, 1, ctx->Cflag);\n+\n+out:\n \n qemu_io_free(ctx->buf);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void aio_write_done(void *opaque, int ret)\n\n{\n\n struct aio_ctx *ctx = opaque;\n\n struct timeval t2;\n\n\n\n gettimeofday(&t2, NULL);\n\n\n\n\n\n if (ret < 0) {\n\n printf(\"aio_write failed: %s\\n\", strerror(-ret));\n\n goto out;\n\n }\n\n\n\n if (ctx->qflag) {\n\n goto out;\n\n }\n\n\n\n /* Finally, report back -- -C gives a parsable format */\n\n t2 = tsub(t2, ctx->t1);\n\n print_report(\"wrote\", &t2, ctx->offset, ctx->qiov.size,\n\n ctx->qiov.size, 1, ctx->Cflag);\n\nout:\n\n qemu_io_free(ctx->buf);\n\n\n g_free(ctx);\n\n}"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_254", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n \n \n s->dpll = clk;\n+\n+ omap_dpll_reset(s);\n+\n+\n+\n memory_region_add_subregion(memory, base, &s->iomem);\n \n return s;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static struct dpll_ctl_s *omap_dpll_init(MemoryRegion *memory,\n\n target_phys_addr_t base, omap_clk clk)\n\n{\n\n struct dpll_ctl_s *s = g_malloc0(sizeof(*s));\n\n memory_region_init_io(&s->iomem, &omap_dpll_ops, s, \"omap-dpll\", 0x100);\n\n\n\n s->dpll = clk;\n\n omap_dpll_reset(s);\n\n\n\n memory_region_add_subregion(memory, base, &s->iomem);\n\n return s;\n\n}\n"}} {"sample_id": "0e180d9c8a7429c55d23d2e7855f1e490a063aaa", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n void pcie_aer_root_init(PCIDevice *dev)\n \n+{\n+\n+ uint16_t pos = dev->exp.aer_cap;\n+\n+\n \n pci_set_long(dev->wmask + pos + PCI_ERR_ROOT_COMMAND,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "void pcie_aer_root_init(PCIDevice *dev)\n\n{\n\n uint16_t pos = dev->exp.aer_cap;\n\n\n\n pci_set_long(dev->wmask + pos + PCI_ERR_ROOT_COMMAND,\n\n PCI_ERR_ROOT_CMD_EN_MASK);\n\n pci_set_long(dev->w1cmask + pos + PCI_ERR_ROOT_STATUS,\n\n PCI_ERR_ROOT_STATUS_REPORT_MASK);\n\n\n\n\n\n\n}"}} {"sample_id": "ec57db1630f9cdcd13c8c55acbc8daf5237aabf1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n int i;\n \n \n+\n+ virtio_net_set_multiqueue(n, !!(features & (1 << VIRTIO_NET_F_MQ)),\n+\n+ !!(features & (1 << VIRTIO_NET_F_CTRL_VQ)));\n+\n \n \n virtio_net_set_mrg_rx_bufs(n, !!(features & (1 << VIRTIO_NET_F_MRG_RXBUF)));", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_net_set_features(VirtIODevice *vdev, uint32_t features)\n\n{\n\n VirtIONet *n = VIRTIO_NET(vdev);\n\n int i;\n\n\n\n virtio_net_set_multiqueue(n, !!(features & (1 << VIRTIO_NET_F_MQ)),\n\n !!(features & (1 << VIRTIO_NET_F_CTRL_VQ)));\n\n\n\n virtio_net_set_mrg_rx_bufs(n, !!(features & (1 << VIRTIO_NET_F_MRG_RXBUF)));\n\n\n\n if (n->has_vnet_hdr) {\n\n tap_set_offload(qemu_get_subqueue(n->nic, 0)->peer,\n\n (features >> VIRTIO_NET_F_GUEST_CSUM) & 1,\n\n (features >> VIRTIO_NET_F_GUEST_TSO4) & 1,\n\n (features >> VIRTIO_NET_F_GUEST_TSO6) & 1,\n\n (features >> VIRTIO_NET_F_GUEST_ECN) & 1,\n\n (features >> VIRTIO_NET_F_GUEST_UFO) & 1);\n\n }\n\n\n\n for (i = 0; i < n->max_queues; i++) {\n\n NetClientState *nc = qemu_get_subqueue(n->nic, i);\n\n\n\n if (!nc->peer || nc->peer->info->type != NET_CLIENT_OPTIONS_KIND_TAP) {\n\n continue;\n\n }\n\n if (!tap_get_vhost_net(nc->peer)) {\n\n continue;\n\n }\n\n vhost_net_ack_features(tap_get_vhost_net(nc->peer), features);\n\n }\n\n}\n"}} {"sample_id": "46191a2da16f751e53d93646ae1388d421d12bee", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n {\n \n+ char *p = dst;\n \n char *end = dst+dstlen-1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int mov_read_mac_string(MOVContext *c, AVIOContext *pb, int len,\n\n char *dst, int dstlen)\n\n{\n\n char *p = dst;\n\n char *end = dst+dstlen-1;\n\n int i;\n\n\n\n for (i = 0; i < len; i++) {\n\n uint8_t t, c = avio_r8(pb);\n\n if (c < 0x80 && p < end)\n\n *p++ = c;\n\n else\n\n PUT_UTF8(mac_to_unicode[c-0x80], t, if (p < end) *p++ = t;);\n\n }\n\n *p = 0;\n\n return p - dst;\n\n}\n"}} {"sample_id": "72370dc1149d7c90d2c2218e0d0658bee23a5bf7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ FeatureWordInfo *f = &feature_word_info[w];\n \n int i;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void report_unavailable_features(FeatureWord w, uint32_t mask)\n\n{\n\n FeatureWordInfo *f = &feature_word_info[w];\n\n int i;\n\n\n\n for (i = 0; i < 32; ++i) {\n\n if (1 << i & mask) {\n\n const char *reg = get_register_name_32(f->cpuid_reg);\n\n assert(reg);\n\n fprintf(stderr, \"warning: %s doesn't support requested feature: \"\n\n \"CPUID.%02XH:%s%s%s [bit %d]\\n\",\n\n kvm_enabled() ? \"host\" : \"TCG\",\n\n f->cpuid_eax, reg,\n\n f->feat_names[i] ? \".\" : \"\",\n\n f->feat_names[i] ? f->feat_names[i] : \"\", i);\n\n }\n\n }\n\n}\n"}} {"sample_id": "621ff94d5074d88253a5818c6b9c4db718fbfc65_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n if (local_err) {\n \n goto out;\n+\n+ }\n+\n+ /* change bootindex to a new one */\n+\n d->conf.bootindex = boot_index;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ide_dev_set_bootindex(Object *obj, Visitor *v, const char *name,\n\n void *opaque, Error **errp)\n\n{\n\n IDEDevice *d = IDE_DEVICE(obj);\n\n int32_t boot_index;\n\n Error *local_err = NULL;\n\n\n\n visit_type_int32(v, name, &boot_index, &local_err);\n\n if (local_err) {\n\n goto out;\n\n }\n\n /* check whether bootindex is present in fw_boot_order list */\n\n check_boot_index(boot_index, &local_err);\n\n if (local_err) {\n\n goto out;\n\n }\n\n /* change bootindex to a new one */\n\n d->conf.bootindex = boot_index;\n\n\n\n if (d->unit != -1) {\n\n add_boot_device_path(d->conf.bootindex, &d->qdev,\n\n d->unit ? \"/disk@1\" : \"/disk@0\");\n\n }\n\nout:\n\n if (local_err) {\n\n error_propagate(errp, local_err);\n\n }\n\n}\n"}} {"sample_id": "b3db211f3c80bb996a704d665fe275619f728bd4_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n \n \n qmp_output_add(qov, name, dict);\n+\n+ qmp_output_push(qov, dict, obj);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qmp_output_start_struct(Visitor *v, const char *name, void **obj,\n\n size_t unused, Error **errp)\n\n{\n\n QmpOutputVisitor *qov = to_qov(v);\n\n QDict *dict = qdict_new();\n\n\n\n qmp_output_add(qov, name, dict);\n\n qmp_output_push(qov, dict, obj);\n\n}\n"}} {"sample_id": "3e305e4a4752f70c0b5c3cf5b43ec957881714f7_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,18 +1,18 @@\n+static int vnc_set_x509_credential(VncDisplay *vd,\n+\n+ const char *certdir,\n+\n+ const char *filename,\n+\n+ char **cred,\n+\n+ int ignoreMissing)\n+\n+{\n+\n+ struct stat sb;\n \n+\n \n g_free(*cred);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int vnc_set_x509_credential(VncDisplay *vd,\n\n const char *certdir,\n\n const char *filename,\n\n char **cred,\n\n int ignoreMissing)\n\n{\n\n struct stat sb;\n\n\n\n g_free(*cred);\n\n *cred = g_malloc(strlen(certdir) + strlen(filename) + 2);\n\n\n\n strcpy(*cred, certdir);\n\n strcat(*cred, \"/\");\n\n strcat(*cred, filename);\n\n\n\n VNC_DEBUG(\"Check %s\\n\", *cred);\n\n if (stat(*cred, &sb) < 0) {\n\n g_free(*cred);\n\n *cred = NULL;\n\n if (ignoreMissing && errno == ENOENT)\n\n return 0;\n\n return -1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "eabc977973103527bbb8fed69c91cfaa6691f8ab_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void aio_notify(AioContext *ctx)\n \n+{\n \n /* Write e.g. bh->scheduled before reading ctx->dispatching. */\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void aio_notify(AioContext *ctx)\n\n{\n\n /* Write e.g. bh->scheduled before reading ctx->dispatching. */\n\n smp_mb();\n\n if (!ctx->dispatching) {\n\n event_notifier_set(&ctx->notifier);\n\n }\n\n}\n"}} {"sample_id": "dd561441b1e849df7d8681c6f32af82d4088dafd_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ h264_loop_filter_luma_c(pix, 1, stride, alpha, beta, tc0);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void h264_h_loop_filter_luma_c(uint8_t *pix, int stride, int alpha, int beta, int8_t *tc0)\n\n{\n\n h264_loop_filter_luma_c(pix, 1, stride, alpha, beta, tc0);\n\n}\n"}} {"sample_id": "74b4c74d5efb0a489bdf0acc5b5d0197167e7649_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,6 +8,6 @@\n \n }\n \n+ return -ENOSYS;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int s390_cpu_restart(S390CPU *cpu)\n\n{\n\n if (kvm_enabled()) {\n\n return kvm_s390_cpu_restart(cpu);\n\n }\n\n return -ENOSYS;\n\n}\n"}} {"sample_id": "daa76aa416b1e18ab1fac650ff53d966d8f21f68_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static void test_parse_path_subprocess(void)\n+\n+{\n+\n /* All these should work without issue */\n \n qemu_set_log_filename(\"/tmp/qemu.log\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void test_parse_path_subprocess(void)\n\n{\n\n /* All these should work without issue */\n\n qemu_set_log_filename(\"/tmp/qemu.log\");\n\n qemu_set_log_filename(\"/tmp/qemu-%d.log\");\n\n qemu_set_log_filename(\"/tmp/qemu.log.%d\");\n\n}\n"}} {"sample_id": "297a3646c2947ee64a6d42ca264039732c6218e0_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n GenericList *visit_next_list(Visitor *v, GenericList **list, Error **errp)\n+\n+{\n \n+ if (!error_is_set(errp)) {\n \n return v->next_list(v, list, errp);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "GenericList *visit_next_list(Visitor *v, GenericList **list, Error **errp)\n\n{\n\n if (!error_is_set(errp)) {\n\n return v->next_list(v, list, errp);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_135", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static uint64_t watch_mem_read(void *opaque, target_phys_addr_t addr,\n+\n+ unsigned size)\n+\n+{\n+\n check_watchpoint(addr & ~TARGET_PAGE_MASK, ~(size - 1), BP_MEM_READ);\n \n switch (size) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t watch_mem_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n check_watchpoint(addr & ~TARGET_PAGE_MASK, ~(size - 1), BP_MEM_READ);\n\n switch (size) {\n\n case 1: return ldub_phys(addr);\n\n case 2: return lduw_phys(addr);\n\n case 4: return ldl_phys(addr);\n\n default: abort();\n\n }\n\n}\n"}} {"sample_id": "69d34a360dfe773e17e72c76d15931c9b9d190f6_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static off_t read_uint32(BlockDriverState *bs, int64_t offset)\n+\n+{\n+\n \tuint32_t buffer;\n \n \tif (bdrv_pread(bs->file, offset, &buffer, 4) < 4)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static off_t read_uint32(BlockDriverState *bs, int64_t offset)\n\n{\n\n\tuint32_t buffer;\n\n\tif (bdrv_pread(bs->file, offset, &buffer, 4) < 4)\n\n\t\treturn 0;\n\n\treturn be32_to_cpu(buffer);\n\n}\n"}} {"sample_id": "b49f7ead8d222bcb8df0388f3177002f3e33d046", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n }\n \n+ is_none_mode = mode == MIRROR_SYNC_MODE_NONE;\n+\n+ base = mode == MIRROR_SYNC_MODE_TOP ? backing_bs(bs) : NULL;\n+\n+ mirror_start_job(job_id, bs, target, replaces,\n \n speed, granularity, buf_size, backing_mode,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void mirror_start(const char *job_id, BlockDriverState *bs,\n\n BlockDriverState *target, const char *replaces,\n\n int64_t speed, uint32_t granularity, int64_t buf_size,\n\n MirrorSyncMode mode, BlockMirrorBackingMode backing_mode,\n\n BlockdevOnError on_source_error,\n\n BlockdevOnError on_target_error,\n\n bool unmap,\n\n BlockCompletionFunc *cb,\n\n void *opaque, Error **errp)\n\n{\n\n bool is_none_mode;\n\n BlockDriverState *base;\n\n\n\n if (mode == MIRROR_SYNC_MODE_INCREMENTAL) {\n\n error_setg(errp, \"Sync mode 'incremental' not supported\");\n\n return;\n\n }\n\n is_none_mode = mode == MIRROR_SYNC_MODE_NONE;\n\n base = mode == MIRROR_SYNC_MODE_TOP ? backing_bs(bs) : NULL;\n\n mirror_start_job(job_id, bs, target, replaces,\n\n speed, granularity, buf_size, backing_mode,\n\n on_source_error, on_target_error, unmap, cb, opaque, errp,\n\n &mirror_job_driver, is_none_mode, base);\n\n}\n"}} {"sample_id": "0b8b8753e4d94901627b3e86431230f2319215c4_28", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void coroutine_enter_cb(void *opaque, int ret)\n \n+{\n \n Coroutine *co = opaque;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void coroutine_enter_cb(void *opaque, int ret)\n\n{\n\n Coroutine *co = opaque;\n\n qemu_coroutine_enter(co, NULL);\n\n}\n"}} {"sample_id": "1ea3c03743ec6a7c33312896de3bbdbe7f60d0f5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,8 +3,8 @@\n {\n \n int64_t end;\n+\n+ int hh1, mm1, ss1, ms1;\n \n int hh2, mm2, ss2, ms2;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int read_ts(const char *s, int64_t *start, int *duration)\n\n{\n\n int64_t end;\n\n int hh1, mm1, ss1, ms1;\n\n int hh2, mm2, ss2, ms2;\n\n\n\n if (sscanf(s, \"%u:%u:%u.%u,%u:%u:%u.%u\",\n\n &hh1, &mm1, &ss1, &ms1, &hh2, &mm2, &ss2, &ms2) == 8) {\n\n end = (hh2*3600 + mm2*60 + ss2) * 100 + ms2;\n\n *start = (hh1*3600 + mm1*60 + ss1) * 100 + ms1;\n\n *duration = end - *start;\n\n return 0;\n\n }\n\n return -1;\n\n}\n"}} {"sample_id": "cb51ac2ffe3649eb8f5c65dccc2012f0ba2c6b12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void build_fadt(GArray *table_data, BIOSLinker *linker,\n \n VirtMachineState *vms, unsigned dsdt_tbl_offset)\n+\n+{\n+\n+ AcpiFadtDescriptorRev5_1 *fadt = acpi_data_push(table_data, sizeof(*fadt));\n+\n unsigned dsdt_entry_offset = (char *)&fadt->dsdt - table_data->data;\n \n uint16_t bootflags;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void build_fadt(GArray *table_data, BIOSLinker *linker,\n\n VirtMachineState *vms, unsigned dsdt_tbl_offset)\n\n{\n\n AcpiFadtDescriptorRev5_1 *fadt = acpi_data_push(table_data, sizeof(*fadt));\n\n unsigned dsdt_entry_offset = (char *)&fadt->dsdt - table_data->data;\n\n uint16_t bootflags;\n\n\n\n switch (vms->psci_conduit) {\n\n case QEMU_PSCI_CONDUIT_DISABLED:\n\n bootflags = 0;\n\n break;\n\n case QEMU_PSCI_CONDUIT_HVC:\n\n bootflags = ACPI_FADT_ARM_PSCI_COMPLIANT | ACPI_FADT_ARM_PSCI_USE_HVC;\n\n break;\n\n case QEMU_PSCI_CONDUIT_SMC:\n\n bootflags = ACPI_FADT_ARM_PSCI_COMPLIANT;\n\n break;\n\n default:\n\n g_assert_not_reached();\n\n }\n\n\n\n /* Hardware Reduced = 1 and use PSCI 0.2+ */\n\n fadt->flags = cpu_to_le32(1 << ACPI_FADT_F_HW_REDUCED_ACPI);\n\n fadt->arm_boot_flags = cpu_to_le16(bootflags);\n\n\n\n /* ACPI v5.1 (fadt->revision.fadt->minor_revision) */\n\n fadt->minor_revision = 0x1;\n\n\n\n /* DSDT address to be filled by Guest linker */\n\n bios_linker_loader_add_pointer(linker,\n\n ACPI_BUILD_TABLE_FILE, dsdt_entry_offset, sizeof(fadt->dsdt),\n\n ACPI_BUILD_TABLE_FILE, dsdt_tbl_offset);\n\n\n\n build_header(linker, table_data,\n\n (void *)fadt, \"FACP\", sizeof(*fadt), 5, NULL, NULL);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_175", "diff": "--- a/source.c\n+++ b/source.c\n@@ -50,11 +50,11 @@\n \n rom_size += rom_paddr & ~TARGET_PAGE_MASK;\n \n+ rom_paddr &= TARGET_PAGE_MASK;\n+\n+ rom_size = TARGET_PAGE_ALIGN(rom_size);\n+\n+\n \n memory_region_init_alias(&s->rom, \"kvmvapic-rom\", section.mr, rom_paddr,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vapic_map_rom_writable(VAPICROMState *s)\n\n{\n\n target_phys_addr_t rom_paddr = s->rom_state_paddr & ROM_BLOCK_MASK;\n\n MemoryRegionSection section;\n\n MemoryRegion *as;\n\n size_t rom_size;\n\n uint8_t *ram;\n\n\n\n as = sysbus_address_space(&s->busdev);\n\n\n\n if (s->rom_mapped_writable) {\n\n memory_region_del_subregion(as, &s->rom);\n\n memory_region_destroy(&s->rom);\n\n }\n\n\n\n /* grab RAM memory region (region @rom_paddr may still be pc.rom) */\n\n section = memory_region_find(as, 0, 1);\n\n\n\n /* read ROM size from RAM region */\n\n ram = memory_region_get_ram_ptr(section.mr);\n\n rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE;\n\n s->rom_size = rom_size;\n\n\n\n /* We need to round to avoid creating subpages\n\n * from which we cannot run code. */\n\n rom_size += rom_paddr & ~TARGET_PAGE_MASK;\n\n rom_paddr &= TARGET_PAGE_MASK;\n\n rom_size = TARGET_PAGE_ALIGN(rom_size);\n\n\n\n memory_region_init_alias(&s->rom, \"kvmvapic-rom\", section.mr, rom_paddr,\n\n rom_size);\n\n memory_region_add_subregion_overlap(as, rom_paddr, &s->rom, 1000);\n\n s->rom_mapped_writable = true;\n\n}\n"}} {"sample_id": "ee68697551cd81186c5b12eba10c158350cf1165", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+ s->aio_context = new_context;\n+\n+ s->completion_bh = aio_bh_new(new_context, qemu_laio_completion_bh, s);\n \n aio_set_event_notifier(new_context, &s->e, false,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void laio_attach_aio_context(LinuxAioState *s, AioContext *new_context)\n\n{\n\n s->aio_context = new_context;\n\n s->completion_bh = aio_bh_new(new_context, qemu_laio_completion_bh, s);\n\n aio_set_event_notifier(new_context, &s->e, false,\n\n qemu_laio_completion_cb, NULL);\n\n}\n"}} {"sample_id": "7157e2e23e89adcd436caeab31fdd6b47eded377", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void virtio_queue_notify(VirtIODevice *vdev, int n)\n+\n+{\n \n if (n < VIRTIO_PCI_QUEUE_MAX) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void virtio_queue_notify(VirtIODevice *vdev, int n)\n\n{\n\n if (n < VIRTIO_PCI_QUEUE_MAX) {\n\n virtio_queue_notify_vq(&vdev->vq[n]);\n\n }\n\n}\n"}} {"sample_id": "0e321191224c8cd137eef41da3257e096965c3d6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n start >> hb->granularity, last >> hb->granularity);\n \n \n+\n+ start >>= hb->granularity;\n+\n+ last >>= hb->granularity;\n+\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void hbitmap_reset(HBitmap *hb, uint64_t start, uint64_t count)\n\n{\n\n /* Compute range in the last layer. */\n\n uint64_t last = start + count - 1;\n\n\n\n trace_hbitmap_reset(hb, start, count,\n\n start >> hb->granularity, last >> hb->granularity);\n\n\n\n start >>= hb->granularity;\n\n last >>= hb->granularity;\n\n\n\n\n hb->count -= hb_count_between(hb, start, last);\n\n hb_reset_between(hb, HBITMAP_LEVELS - 1, start, last);\n\n}"}} {"sample_id": "062ba099e01ff1474be98c0a4f3da351efab5d9d_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n int kvm_arm_sync_mpstate_to_kvm(ARMCPU *cpu)\n \n {\n+\n if (cap_has_mp_state) {\n \n struct kvm_mp_state mp_state = {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int kvm_arm_sync_mpstate_to_kvm(ARMCPU *cpu)\n\n{\n\n if (cap_has_mp_state) {\n\n struct kvm_mp_state mp_state = {\n\n .mp_state =\n\n cpu->powered_off ? KVM_MP_STATE_STOPPED : KVM_MP_STATE_RUNNABLE\n\n };\n\n int ret = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MP_STATE, &mp_state);\n\n if (ret) {\n\n fprintf(stderr, \"%s: failed to set MP_STATE %d/%s\\n\",\n\n __func__, ret, strerror(-ret));\n\n return -1;\n\n }\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_30", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static uint32_t scsi_init_iovec(SCSIDiskReq *r, size_t size)\n \n+{\n+\n+ SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);\n+\n+\n \n if (!r->iov.iov_base) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t scsi_init_iovec(SCSIDiskReq *r, size_t size)\n\n{\n\n SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);\n\n\n\n if (!r->iov.iov_base) {\n\n r->buflen = size;\n\n r->iov.iov_base = qemu_blockalign(s->qdev.conf.bs, r->buflen);\n\n }\n\n r->iov.iov_len = MIN(r->sector_count * 512, r->buflen);\n\n qemu_iovec_init_external(&r->qiov, &r->iov, 1);\n\n return r->qiov.size / 512;\n\n}\n"}} {"sample_id": "221b804f3491638ecf2eec1302c669ad2d9ec799_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n static uint64_t getSSD(uint8_t *src1, uint8_t *src2, int stride1, int stride2, int w, int h){\n+\n+\tint x,y;\n+\n+\tuint64_t ssd=0;\n+\n+\n \n //printf(\"%d %d\\n\", w, h);\n+\n \n \n \tfor(y=0; yinputs[1]);\n \n struct FFBufQueue *queue =\n+\n (is_alpha ? &merge->queue_alpha : &merge->queue_main);\n \n ff_bufqueue_add(ctx, queue, buf);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *buf)\n\n{\n\n AVFilterContext *ctx = inlink->dst;\n\n AlphaMergeContext *merge = ctx->priv;\n\n\n\n int is_alpha = (inlink == ctx->inputs[1]);\n\n struct FFBufQueue *queue =\n\n (is_alpha ? &merge->queue_alpha : &merge->queue_main);\n\n ff_bufqueue_add(ctx, queue, buf);\n\n\n\n while (1) {\n\n AVFilterBufferRef *main_buf, *alpha_buf;\n\n\n\n if (!ff_bufqueue_peek(&merge->queue_main, 0) ||\n\n !ff_bufqueue_peek(&merge->queue_alpha, 0)) break;\n\n\n\n main_buf = ff_bufqueue_get(&merge->queue_main);\n\n alpha_buf = ff_bufqueue_get(&merge->queue_alpha);\n\n\n\n merge->frame_requested = 0;\n\n draw_frame(ctx, main_buf, alpha_buf);\n\n ff_filter_frame(ctx->outputs[0], avfilter_ref_buffer(main_buf, ~0));\n\n avfilter_unref_buffer(alpha_buf);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "c170aad8b057223b1139d72e5ce7acceafab4fa9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n int scsi_req_parse_cdb(SCSIDevice *dev, SCSICommand *cmd, uint8_t *buf)\n \n {\n+\n int rc;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int scsi_req_parse_cdb(SCSIDevice *dev, SCSICommand *cmd, uint8_t *buf)\n\n{\n\n int rc;\n\n\n\n cmd->lba = -1;\n\n cmd->len = scsi_cdb_length(buf);\n\n\n\n switch (dev->type) {\n\n case TYPE_TAPE:\n\n rc = scsi_req_stream_xfer(cmd, dev, buf);\n\n break;\n\n case TYPE_MEDIUM_CHANGER:\n\n rc = scsi_req_medium_changer_xfer(cmd, dev, buf);\n\n break;\n\n default:\n\n rc = scsi_req_xfer(cmd, dev, buf);\n\n break;\n\n }\n\n\n\n if (rc != 0)\n\n return rc;\n\n\n\n memcpy(cmd->buf, buf, cmd->len);\n\n scsi_cmd_xfer_mode(cmd);\n\n cmd->lba = scsi_cmd_lba(cmd);\n\n return 0;\n\n}\n"}} {"sample_id": "76d7c327eba042106b729e9d671b6f85f515b1af", "diff": "--- a/source.c\n+++ b/source.c\n@@ -69,11 +69,11 @@\n }\n \n }\n+\n+\n+\n+ s->bit_buf = bit_buf;\n+\n s->bit_left = 32 - bit_cnt;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void gif_put_bits_rev(PutBitContext *s, int n, unsigned int value)\n\n{\n\n unsigned int bit_buf;\n\n int bit_cnt;\n\n\n\n // printf(\"put_bits=%d %x\\n\", n, value);\n\n assert(n == 32 || value < (1U << n));\n\n\n\n bit_buf = s->bit_buf;\n\n bit_cnt = 32 - s->bit_left; /* XXX:lazyness... was = s->bit_cnt; */\n\n\n\n // printf(\"n=%d value=%x cnt=%d buf=%x\\n\", n, value, bit_cnt, bit_buf);\n\n /* XXX: optimize */\n\n if (n < (32-bit_cnt)) {\n\n bit_buf |= value << (bit_cnt);\n\n bit_cnt+=n;\n\n } else {\n\n bit_buf |= value << (bit_cnt);\n\n\n\n *s->buf_ptr = bit_buf & 0xff;\n\n s->buf_ptr[1] = (bit_buf >> 8) & 0xff;\n\n s->buf_ptr[2] = (bit_buf >> 16) & 0xff;\n\n s->buf_ptr[3] = (bit_buf >> 24) & 0xff;\n\n\n\n //printf(\"bitbuf = %08x\\n\", bit_buf);\n\n s->buf_ptr+=4;\n\n if (s->buf_ptr >= s->buf_end)\n\n puts(\"bit buffer overflow !!\"); // should never happen ! who got rid of the callback ???\n\n// flush_buffer_rev(s);\n\n bit_cnt=bit_cnt + n - 32;\n\n if (bit_cnt == 0) {\n\n bit_buf = 0;\n\n } else {\n\n bit_buf = value >> (n - bit_cnt);\n\n }\n\n }\n\n\n\n s->bit_buf = bit_buf;\n\n s->bit_left = 32 - bit_cnt;\n\n}\n"}} {"sample_id": "364031f17932814484657e5551ba12957d993d7e_27", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int v9fs_synth_truncate(FsContext *ctx, V9fsPath *path, off_t offset)\n \n+{\n+\n errno = ENOSYS;\n \n return -1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int v9fs_synth_truncate(FsContext *ctx, V9fsPath *path, off_t offset)\n\n{\n\n errno = ENOSYS;\n\n return -1;\n\n}\n"}} {"sample_id": "81f3053b77f7d3a4d9100c425cd8cec99ee7a3d4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n \n \n cpu = x86_env_get_cpu(env);\n+\n+ cs = CPU(cpu);\n+\n+ /* XXX: not complete but not completely erroneous */\n+\n if (cs->cpu_index != 0 || CPU_NEXT(cs) != NULL) {\n \n /* more than one CPU: do not sleep because another CPU may", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void helper_mwait(CPUX86State *env, int next_eip_addend)\n\n{\n\n CPUState *cs;\n\n X86CPU *cpu;\n\n\n\n if ((uint32_t)env->regs[R_ECX] != 0) {\n\n raise_exception(env, EXCP0D_GPF);\n\n }\n\n cpu_svm_check_intercept_param(env, SVM_EXIT_MWAIT, 0);\n\n env->eip += next_eip_addend;\n\n\n\n cpu = x86_env_get_cpu(env);\n\n cs = CPU(cpu);\n\n /* XXX: not complete but not completely erroneous */\n\n if (cs->cpu_index != 0 || CPU_NEXT(cs) != NULL) {\n\n /* more than one CPU: do not sleep because another CPU may\n\n wake this one */\n\n } else {\n\n do_hlt(cpu);\n\n }\n\n}\n"}} {"sample_id": "5797dcdc7ade30e8c4080d9282cd9e51b3566e14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n /* See the comments in nvdimm_dsm_root(). */\n \n+ if (!in->function) {\n+\n+ nvdimm_dsm_function0(0 /* No function supported other than\n+\n+ function 0 */, dsm_mem_addr);\n \n return;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void nvdimm_dsm_device(NvdimmDsmIn *in, hwaddr dsm_mem_addr)\n\n{\n\n /* See the comments in nvdimm_dsm_root(). */\n\n if (!in->function) {\n\n nvdimm_dsm_function0(0 /* No function supported other than\n\n function 0 */, dsm_mem_addr);\n\n return;\n\n }\n\n\n\n /* No function except function 0 is supported yet. */\n\n nvdimm_dsm_no_payload(1 /* Not Supported */, dsm_mem_addr);\n\n}\n"}} {"sample_id": "4407c1c56adb0d3ef2bcbf577592d72278d6e11f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n if (!running) {\n \n+ return;\n+\n+ }\n+\n+\n \n if (!s->bh) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_blk_dma_restart_cb(void *opaque, int running,\n\n RunState state)\n\n{\n\n VirtIOBlock *s = opaque;\n\n\n\n if (!running) {\n\n return;\n\n }\n\n\n\n if (!s->bh) {\n\n s->bh = qemu_bh_new(virtio_blk_dma_restart_bh, s);\n\n qemu_bh_schedule(s->bh);\n\n }\n\n}\n"}} {"sample_id": "fd34dbea58e097609ff09cf7dcc59f74930195d3_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int mxf_read_source_package(void *arg, AVIOContext *pb, int tag, int size, UID uid)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int mxf_read_source_package(void *arg, AVIOContext *pb, int tag, int size, UID uid)\n\n{\n\n MXFPackage *package = arg;\n\n switch(tag) {\n\n case 0x4403:\n\n package->tracks_count = avio_rb32(pb);\n\n if (package->tracks_count >= UINT_MAX / sizeof(UID))\n\n return -1;\n\n package->tracks_refs = av_malloc(package->tracks_count * sizeof(UID));\n\n if (!package->tracks_refs)\n\n return -1;\n\n avio_skip(pb, 4); /* useless size of objects, always 16 according to specs */\n\n avio_read(pb, (uint8_t *)package->tracks_refs, package->tracks_count * sizeof(UID));\n\n break;\n\n case 0x4401:\n\n /* UMID, only get last 16 bytes */\n\n avio_skip(pb, 16);\n\n avio_read(pb, package->package_uid, 16);\n\n break;\n\n case 0x4701:\n\n avio_read(pb, package->descriptor_ref, 16);\n\n break;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "ccea25f1c7cd3f0b12d878a5294620f5478729f8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n ssize_t len;\n \n \n+\n+ again1:\n+\n+ len = write(daemon_pipe, &status, 1);\n+\n if (len == -1 && (errno == EINTR)) {\n \n goto again1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void os_setup_post(void)\n\n{\n\n int fd = 0;\n\n\n\n if (daemonize) {\n\n uint8_t status = 0;\n\n ssize_t len;\n\n\n\n again1:\n\n len = write(daemon_pipe, &status, 1);\n\n if (len == -1 && (errno == EINTR)) {\n\n goto again1;\n\n }\n\n if (len != 1) {\n\n exit(1);\n\n }\n\n if (chdir(\"/\")) {\n\n perror(\"not able to chdir to /\");\n\n exit(1);\n\n }\n\n TFR(fd = qemu_open(\"/dev/null\", O_RDWR));\n\n if (fd == -1) {\n\n exit(1);\n\n }\n\n }\n\n\n\n change_root();\n\n change_process_uid();\n\n\n\n if (daemonize) {\n\n dup2(fd, 0);\n\n dup2(fd, 1);\n\n dup2(fd, 2);\n\n\n\n close(fd);\n\n }\n\n}\n"}} {"sample_id": "220b24c7c97dc033ceab1510549f66d0e7b52ef1_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static void libschroedinger_free_frame(void *data)\n+\n+{\n+\n FFSchroEncodedFrame *enc_frame = data;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void libschroedinger_free_frame(void *data)\n\n{\n\n FFSchroEncodedFrame *enc_frame = data;\n\n\n\n av_freep(&enc_frame->p_encbuf);\n\n av_free(enc_frame);\n\n}\n"}} {"sample_id": "b946a1533209f61a93e34898aebb5b43154b99c3_15", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void pcnet_common_init(PCNetState *d, NICInfo *nd)\n \n {\n \n+ d->poll_timer = qemu_new_timer(vm_clock, pcnet_poll_timer, d);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void pcnet_common_init(PCNetState *d, NICInfo *nd)\n\n{\n\n d->poll_timer = qemu_new_timer(vm_clock, pcnet_poll_timer, d);\n\n\n\n d->nd = nd;\n\n\n\n if (nd && nd->vlan) {\n\n d->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,\n\n pcnet_receive, pcnet_can_receive, d);\n\n\n\n qemu_format_nic_info_str(d->vc, d->nd->macaddr);\n\n } else {\n\n d->vc = NULL;\n\n }\n\n pcnet_h_reset(d);\n\n register_savevm(\"pcnet\", -1, 2, pcnet_save, pcnet_load, d);\n\n}\n"}} {"sample_id": "23887b79df2be53dc49166e1b677469abfb92147", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n \n \n+ if (xen_enabled()) {\n+\n+ *ram_addr = xen_ram_addr_from_mapcache(ptr);\n+\n+ return 0;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_ram_addr_from_host(void *ptr, ram_addr_t *ram_addr)\n\n{\n\n RAMBlock *block;\n\n uint8_t *host = ptr;\n\n\n\n if (xen_enabled()) {\n\n *ram_addr = xen_ram_addr_from_mapcache(ptr);\n\n return 0;\n\n }\n\n\n\n QTAILQ_FOREACH(block, &ram_list.blocks, next) {\n\n /* This case append when the block is not mapped. */\n\n if (block->host == NULL) {\n\n continue;\n\n }\n\n if (host - block->host < block->length) {\n\n *ram_addr = block->offset + (host - block->host);\n\n return 0;\n\n }\n\n }\n\n\n\n return -1;\n\n}\n"}} {"sample_id": "1ba08c94f5bb4d1c3c2d3651b5e01edb4ce172e2_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n for (i = 0; i < book->nentries; i++) {\n \n float * vec = book->dimentions + i * book->ndimentions, d = book->pow2[i];\n+\n int j;\n \n if (!book->lens[i])", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static float *put_vector(vorbis_enc_codebook *book, PutBitContext *pb,\n\n float *num)\n\n{\n\n int i, entry = -1;\n\n float distance = FLT_MAX;\n\n assert(book->dimentions);\n\n for (i = 0; i < book->nentries; i++) {\n\n float * vec = book->dimentions + i * book->ndimentions, d = book->pow2[i];\n\n int j;\n\n if (!book->lens[i])\n\n continue;\n\n for (j = 0; j < book->ndimentions; j++)\n\n d -= vec[j] * num[j];\n\n if (distance > d) {\n\n entry = i;\n\n distance = d;\n\n }\n\n }\n\n put_codeword(pb, book, entry);\n\n return &book->dimentions[entry * book->ndimentions];\n\n}\n"}} {"sample_id": "6ed3565f08abf3b1c2a1d2d7fac768b18753530c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ avctx->pix_fmt = PIX_FMT_YUV444P10;\n+\n avctx->bits_per_raw_sample = 10;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static av_cold int v410_decode_init(AVCodecContext *avctx)\n\n{\n\n avctx->pix_fmt = PIX_FMT_YUV444P10;\n\n avctx->bits_per_raw_sample = 10;\n\n\n\n if (avctx->width & 1) {\n\n av_log(avctx, AV_LOG_ERROR, \"v410 requires width to be even.\\n\");\n\n return AVERROR_INVALIDDATA;\n\n }\n\n\n\n avctx->coded_frame = avcodec_alloc_frame();\n\n\n\n if (!avctx->coded_frame) {\n\n av_log(avctx, AV_LOG_ERROR, \"Could not allocate frame.\\n\");\n\n return AVERROR(ENOMEM);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "0058584580b87feb47898e60e4b80c7f425882ad_23", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n \n \n+ for (i = 0; i < 256; i++) {\n+\n+ samples[i] += samples[i + 256];\n+\n samples[i + 256] = 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void downmix_dualmono_to_mono(float *samples)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < 256; i++) {\n\n samples[i] += samples[i + 256];\n\n samples[i + 256] = 0;\n\n }\n\n}\n"}} {"sample_id": "696b55017d90b3237ca9d656aa4904d6b5c46c7a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n error_setg(errp, \"can't create backend with size 0\");\n \n return;\n+\n }\n \n if (!fb->mem_path) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "file_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)\n\n{\n\n HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(backend);\n\n\n\n if (!backend->size) {\n\n error_setg(errp, \"can't create backend with size 0\");\n\n return;\n\n }\n\n if (!fb->mem_path) {\n\n error_setg(errp, \"mem-path property not set\");\n\n return;\n\n }\n\n#ifndef CONFIG_LINUX\n\n error_setg(errp, \"-mem-path not supported on this host\");\n\n#else\n\n if (!memory_region_size(&backend->mr)) {\n\n backend->force_prealloc = mem_prealloc;\n\n memory_region_init_ram_from_file(&backend->mr, OBJECT(backend),\n\n object_get_canonical_path(OBJECT(backend)),\n\n backend->size, fb->share,\n\n fb->mem_path, errp);\n\n }\n\n#endif\n\n}\n"}} {"sample_id": "55d53cb59380bebea79ae8f99d4e119b2b006629", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n if(filter && (!strcmp(target, \"all\") || !strcmp(target, filter->name) || !strcmp(target, filter->filter->name))){\n AVFilterCommand **queue = &filter->command_queue, *next;\n while (*queue && (*queue)->time <= ts)\n+ queue = &(*queue)->next;\n+ next = *queue;\n+ *queue = av_mallocz(sizeof(AVFilterCommand));\n+ (*queue)->command = av_strdup(command);\n+ (*queue)->arg = av_strdup(arg);\n (*queue)->time = ts;\n (*queue)->flags = flags;\n (*queue)->next = next;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int avfilter_graph_queue_command(AVFilterGraph *graph, const char *target, const char *command, const char *arg, int flags, double ts)\n{\n int i;\n if(!graph)\n return 0;\n for (i = 0; i < graph->nb_filters; i++) {\n AVFilterContext *filter = graph->filters[i];\n if(filter && (!strcmp(target, \"all\") || !strcmp(target, filter->name) || !strcmp(target, filter->filter->name))){\n AVFilterCommand **queue = &filter->command_queue, *next;\n while (*queue && (*queue)->time <= ts)\n queue = &(*queue)->next;\n next = *queue;\n *queue = av_mallocz(sizeof(AVFilterCommand));\n (*queue)->command = av_strdup(command);\n (*queue)->arg = av_strdup(arg);\n (*queue)->time = ts;\n (*queue)->flags = flags;\n (*queue)->next = next;\n if(flags & AVFILTER_CMD_FLAG_ONE)\n return 0;\n }\n }\n return 0;\n}"}} {"sample_id": "51000b994514e64a6c5039e179f20c9e24f87c45", "diff": "--- a/source.c\n+++ b/source.c\n@@ -46,11 +46,11 @@\n \n if (pkt->duration < 0 || pkt->duration > INT_MAX) {\n \n+ av_log(s, AV_LOG_ERROR, \"Application provided duration: %\"PRId64\" is invalid\\n\", pkt->duration);\n+\n+ return AVERROR(EINVAL);\n+\n+ }\n \n return 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int check_pkt(AVFormatContext *s, AVPacket *pkt)\n\n{\n\n MOVMuxContext *mov = s->priv_data;\n\n MOVTrack *trk = &mov->tracks[pkt->stream_index];\n\n\n\n if (trk->entry) {\n\n int64_t duration = pkt->dts - trk->cluster[trk->entry - 1].dts;\n\n if (duration < 0 || duration > INT_MAX) {\n\n av_log(s, AV_LOG_ERROR, \"Application provided duration: %\"PRId64\" / timestamp: %\"PRId64\" is out of range for mov/mp4 format\\n\",\n\n duration, pkt->dts\n\n );\n\n\n\n pkt->dts = trk->cluster[trk->entry - 1].dts + 1;\n\n pkt->pts = AV_NOPTS_VALUE;\n\n }\n\n } else if (pkt->dts <= INT_MIN || pkt->dts >= INT_MAX) {\n\n av_log(s, AV_LOG_ERROR, \"Application provided initial timestamp: %\"PRId64\" is out of range for mov/mp4 format\\n\",\n\n pkt->dts\n\n );\n\n\n\n pkt->dts = 0;\n\n pkt->pts = AV_NOPTS_VALUE;\n\n }\n\n if (pkt->duration < 0 || pkt->duration > INT_MAX) {\n\n av_log(s, AV_LOG_ERROR, \"Application provided duration: %\"PRId64\" is invalid\\n\", pkt->duration);\n\n return AVERROR(EINVAL);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "35ecde26018207fe723bec6efbd340db6e9c2d53_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n WorkerTestData data = { .n = 0, .ret = -EINPROGRESS };\n+\n data.aiocb = thread_pool_submit_aio(pool, worker_cb, &data,\n \n done_cb, &data);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void test_submit_aio(void)\n\n{\n\n WorkerTestData data = { .n = 0, .ret = -EINPROGRESS };\n\n data.aiocb = thread_pool_submit_aio(pool, worker_cb, &data,\n\n done_cb, &data);\n\n\n\n /* The callbacks are not called until after the first wait. */\n\n active = 1;\n\n g_assert_cmpint(data.ret, ==, -EINPROGRESS);\n\n qemu_aio_wait_all();\n\n g_assert_cmpint(active, ==, 0);\n\n g_assert_cmpint(data.n, ==, 1);\n\n g_assert_cmpint(data.ret, ==, 0);\n\n}\n"}} {"sample_id": "e7d81004e486b0e80a674d164d8aec0e83fa812f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static ssize_t handle_aiocb_ioctl(struct qemu_paiocb *aiocb)\n \n {\n+\n+ int ret;\n+\n+\n+\n ret = ioctl(aiocb->aio_fildes, aiocb->aio_ioctl_cmd, aiocb->aio_ioctl_buf);\n \n if (ret == -1)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static ssize_t handle_aiocb_ioctl(struct qemu_paiocb *aiocb)\n\n{\n\n int ret;\n\n\n\n ret = ioctl(aiocb->aio_fildes, aiocb->aio_ioctl_cmd, aiocb->aio_ioctl_buf);\n\n if (ret == -1)\n\n return -errno;\n\n\n\n /*\n\n * This looks weird, but the aio code only consideres a request\n\n * successful if it has written the number full number of bytes.\n\n *\n\n * Now we overload aio_nbytes as aio_ioctl_cmd for the ioctl command,\n\n * so in fact we return the ioctl command here to make posix_aio_read()\n\n * happy..\n\n */\n\n return aiocb->aio_nbytes;\n\n}\n"}} {"sample_id": "9a321e92343891e30f6fe8bfaad40454ae358bfb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,20 +2,20 @@\n \n sPAPREnvironment *spapr,\n \n+ uint32_t token,\n \n uint32_t nargs,\n+\n target_ulong args,\n \n uint32_t nret,\n+\n+ target_ulong rets)\n+\n+{\n \n uint32_t config_addr = rtas_ld(args, 0);\n+\n uint64_t buid = ((uint64_t)rtas_ld(args, 1) << 32) | rtas_ld(args, 2);\n \n unsigned int intr_src_num = -1, ioa_intr_num = rtas_ld(args, 3);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void rtas_ibm_query_interrupt_source_number(PowerPCCPU *cpu,\n\n sPAPREnvironment *spapr,\n\n uint32_t token,\n\n uint32_t nargs,\n\n target_ulong args,\n\n uint32_t nret,\n\n target_ulong rets)\n\n{\n\n uint32_t config_addr = rtas_ld(args, 0);\n\n uint64_t buid = ((uint64_t)rtas_ld(args, 1) << 32) | rtas_ld(args, 2);\n\n unsigned int intr_src_num = -1, ioa_intr_num = rtas_ld(args, 3);\n\n int ndev;\n\n sPAPRPHBState *phb = NULL;\n\n\n\n /* Fins sPAPRPHBState */\n\n phb = find_phb(spapr, buid);\n\n if (!phb) {\n\n rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);\n\n return;\n\n }\n\n\n\n /* Find device descriptor and start IRQ */\n\n ndev = spapr_msicfg_find(phb, config_addr, false);\n\n if (ndev < 0) {\n\n trace_spapr_pci_msi(\"MSI has not been enabled\", -1, config_addr);\n\n rtas_st(rets, 0, RTAS_OUT_HW_ERROR);\n\n return;\n\n }\n\n\n\n intr_src_num = phb->msi_table[ndev].irq + ioa_intr_num;\n\n trace_spapr_pci_rtas_ibm_query_interrupt_source_number(ioa_intr_num,\n\n intr_src_num);\n\n\n\n rtas_st(rets, 0, RTAS_OUT_SUCCESS);\n\n rtas_st(rets, 1, intr_src_num);\n\n rtas_st(rets, 2, 1);/* 0 == level; 1 == edge */\n\n}\n"}} {"sample_id": "ad674e53b5cce265fadafbde2c6a4f190345cd00_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n uint16_t sel_mask, sel_value;\n \n+ uint32_t status;\n+\n+ int cond;\n+\n+\n \n DBDMA_DPRINTF(\"conditional_interrupt\\n\");\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void conditional_interrupt(DBDMA_channel *ch)\n\n{\n\n dbdma_cmd *current = &ch->current;\n\n uint16_t intr;\n\n uint16_t sel_mask, sel_value;\n\n uint32_t status;\n\n int cond;\n\n\n\n DBDMA_DPRINTF(\"conditional_interrupt\\n\");\n\n\n\n intr = le16_to_cpu(current->command) & INTR_MASK;\n\n\n\n switch(intr) {\n\n case INTR_NEVER: /* don't interrupt */\n\n return;\n\n case INTR_ALWAYS: /* always interrupt */\n\n qemu_irq_raise(ch->irq);\n\n return;\n\n }\n\n\n\n status = be32_to_cpu(ch->regs[DBDMA_STATUS]) & DEVSTAT;\n\n\n\n sel_mask = (be32_to_cpu(ch->regs[DBDMA_INTR_SEL]) >> 16) & 0x0f;\n\n sel_value = be32_to_cpu(ch->regs[DBDMA_INTR_SEL]) & 0x0f;\n\n\n\n cond = (status & sel_mask) == (sel_value & sel_mask);\n\n\n\n switch(intr) {\n\n case INTR_IFSET: /* intr if condition bit is 1 */\n\n if (cond)\n\n qemu_irq_raise(ch->irq);\n\n return;\n\n case INTR_IFCLR: /* intr if condition bit is 0 */\n\n if (!cond)\n\n qemu_irq_raise(ch->irq);\n\n return;\n\n }\n\n}\n"}} {"sample_id": "fd56e0612b6454a282fa6a953fdb09281a98c589_22", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n PCIBus *bus = d->bus;\n \n \n+\n+ while (!pci_bus_is_root(bus)) {\n+\n+ d = bus->parent_dev;\n+\n assert(d != NULL);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "PCIBus *pci_device_root_bus(const PCIDevice *d)\n\n{\n\n PCIBus *bus = d->bus;\n\n\n\n while (!pci_bus_is_root(bus)) {\n\n d = bus->parent_dev;\n\n assert(d != NULL);\n\n\n\n bus = d->bus;\n\n }\n\n\n\n return bus;\n\n}\n"}} {"sample_id": "09cd058a2cf77bb7a3b10ff93c1f80ed88bca364", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int vtd_remap_irq_get(IntelIOMMUState *iommu, uint16_t index, VTDIrq *irq)\n+\n {\n \n VTD_IRTE irte = { 0 };", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int vtd_remap_irq_get(IntelIOMMUState *iommu, uint16_t index, VTDIrq *irq)\n\n{\n\n VTD_IRTE irte = { 0 };\n\n int ret = 0;\n\n\n\n ret = vtd_irte_get(iommu, index, &irte);\n\n if (ret) {\n\n return ret;\n\n }\n\n\n\n irq->trigger_mode = irte.trigger_mode;\n\n irq->vector = irte.vector;\n\n irq->delivery_mode = irte.delivery_mode;\n\n /* Not support EIM yet: please refer to vt-d 9.10 DST bits */\n\n#define VTD_IR_APIC_DEST_MASK (0xff00ULL)\n\n#define VTD_IR_APIC_DEST_SHIFT (8)\n\n irq->dest = (le32_to_cpu(irte.dest_id) & VTD_IR_APIC_DEST_MASK) >> \\\n\n VTD_IR_APIC_DEST_SHIFT;\n\n irq->dest_mode = irte.dest_mode;\n\n irq->redir_hint = irte.redir_hint;\n\n\n\n VTD_DPRINTF(IR, \"remapping interrupt index %d: trig:%u,vec:%u,\"\n\n \"deliver:%u,dest:%u,dest_mode:%u\", index,\n\n irq->trigger_mode, irq->vector, irq->delivery_mode,\n\n irq->dest, irq->dest_mode);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "4e06acbde4a75cf9aa6a3e46dd3a7c6ed1ecfb8f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,11 +34,11 @@\n s->output = DCA_STEREO;\n avctx->channel_layout = CH_LAYOUT_STEREO;\n }\n+ } else {\n+ av_log(avctx, AV_LOG_ERROR, \"Non standard configuration %d !\\n\",s->amode);\n+ }\n+ /* There is nothing that prevents a dts frame to change channel configuration\n+ but FFmpeg doesn't support that so only set the channels if it is previously\n unset. Ideally during the first probe for channels the crc should be checked\n and only set avctx->channels when the crc is ok. Right now the decoder could\n set the channels based on a broken first frame.*/", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int dca_decode_frame(AVCodecContext * avctx,\n void *data, int *data_size,\n AVPacket *avpkt)\n{\n const uint8_t *buf = avpkt->data;\n int buf_size = avpkt->size;\n int i;\n int16_t *samples = data;\n DCAContext *s = avctx->priv_data;\n int channels;\n s->dca_buffer_size = dca_convert_bitstream(buf, buf_size, s->dca_buffer, DCA_MAX_FRAME_SIZE);\n if (s->dca_buffer_size == -1) {\n av_log(avctx, AV_LOG_ERROR, \"Not a valid DCA frame\\n\");\n }\n init_get_bits(&s->gb, s->dca_buffer, s->dca_buffer_size * 8);\n if (dca_parse_frame_header(s) < 0) {\n //seems like the frame is corrupt, try with the next one\n *data_size=0;\n return buf_size;\n }\n //set AVCodec values with parsed data\n avctx->sample_rate = s->sample_rate;\n avctx->bit_rate = s->bit_rate;\n channels = s->prim_channels + !!s->lfe;\n if (s->amode<16) {\n avctx->channel_layout = dca_core_channel_layout[s->amode];\n if (s->lfe) {\n avctx->channel_layout |= CH_LOW_FREQUENCY;\n s->channel_order_tab = dca_channel_reorder_lfe[s->amode];\n } else\n s->channel_order_tab = dca_channel_reorder_nolfe[s->amode];\n if(avctx->request_channels == 2 && s->prim_channels > 2) {\n channels = 2;\n s->output = DCA_STEREO;\n avctx->channel_layout = CH_LAYOUT_STEREO;\n }\n } else {\n av_log(avctx, AV_LOG_ERROR, \"Non standard configuration %d !\\n\",s->amode);\n }\n /* There is nothing that prevents a dts frame to change channel configuration\n but FFmpeg doesn't support that so only set the channels if it is previously\n unset. Ideally during the first probe for channels the crc should be checked\n and only set avctx->channels when the crc is ok. Right now the decoder could\n set the channels based on a broken first frame.*/\n if (!avctx->channels)\n avctx->channels = channels;\n if(*data_size < (s->sample_blocks / 8) * 256 * sizeof(int16_t) * channels)\n *data_size = 256 / 8 * s->sample_blocks * sizeof(int16_t) * channels;\n for (i = 0; i < (s->sample_blocks / 8); i++) {\n dca_decode_block(s);\n s->dsp.float_to_int16_interleave(samples, s->samples_chanptr, 256, channels);\n samples += 256 * channels;\n }\n return buf_size;\n}"}} {"sample_id": "b2caa3b82edca29ccb5e7d6311ffcf841b9b7786", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n struct in6_address *dst_addr)\n \n {\n+\n struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "_eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,\n\n size_t rthdr_offset,\n\n struct ip6_ext_hdr *ext_hdr,\n\n struct in6_address *dst_addr)\n\n{\n\n struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;\n\n\n\n if ((rthdr->rtype == 2) &&\n\n (rthdr->len == sizeof(struct in6_address) / 8) &&\n\n (rthdr->segleft == 1)) {\n\n\n\n size_t input_size = iov_size(pkt, pkt_frags);\n\n size_t bytes_read;\n\n\n\n if (input_size < rthdr_offset + sizeof(*ext_hdr)) {\n\n return false;\n\n }\n\n\n\n bytes_read = iov_to_buf(pkt, pkt_frags,\n\n rthdr_offset + sizeof(*ext_hdr),\n\n dst_addr, sizeof(*dst_addr));\n\n\n\n return bytes_read == sizeof(dst_addr);\n\n }\n\n\n\n return false;\n\n}\n"}} {"sample_id": "49e617f9565b6528fe707bae7ea4b62b10c771a5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n int temporal_diff2 =(FFABS(next[mrefs] - c) + FFABS(next[prefs] - e) )>>1;\n \n int diff = FFMAX3(temporal_diff0>>1, temporal_diff1, temporal_diff2);\n+\n+ int spatial_pred = (c+e)>>1;\n+\n+ int spatial_score = FFABS(cur[mrefs-1] - cur[prefs-1]) + FFABS(c-e)\n+\n + FFABS(cur[mrefs+1] - cur[prefs+1]) - 1;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void filter_line_c(uint8_t *dst,\n\n uint8_t *prev, uint8_t *cur, uint8_t *next,\n\n int w, int prefs, int mrefs, int parity, int mode)\n\n{\n\n int x;\n\n uint8_t *prev2 = parity ? prev : cur ;\n\n uint8_t *next2 = parity ? cur : next;\n\n for (x = 0; x < w; x++) {\n\n int c = cur[mrefs];\n\n int d = (prev2[0] + next2[0])>>1;\n\n int e = cur[prefs];\n\n int temporal_diff0 = FFABS(prev2[0] - next2[0]);\n\n int temporal_diff1 =(FFABS(prev[mrefs] - c) + FFABS(prev[prefs] - e) )>>1;\n\n int temporal_diff2 =(FFABS(next[mrefs] - c) + FFABS(next[prefs] - e) )>>1;\n\n int diff = FFMAX3(temporal_diff0>>1, temporal_diff1, temporal_diff2);\n\n int spatial_pred = (c+e)>>1;\n\n int spatial_score = FFABS(cur[mrefs-1] - cur[prefs-1]) + FFABS(c-e)\n\n + FFABS(cur[mrefs+1] - cur[prefs+1]) - 1;\n\n\n\n#define CHECK(j)\\\n\n { int score = FFABS(cur[mrefs-1+j] - cur[prefs-1-j])\\\n\n + FFABS(cur[mrefs +j] - cur[prefs -j])\\\n\n + FFABS(cur[mrefs+1+j] - cur[prefs+1-j]);\\\n\n if (score < spatial_score) {\\\n\n spatial_score= score;\\\n\n spatial_pred= (cur[mrefs +j] + cur[prefs -j])>>1;\\\n\n\n\n CHECK(-1) CHECK(-2) }} }}\n"}} {"sample_id": "5e715b583dab85735660b15a8d217a69164675fe_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int parse_audio(DBEContext *s, int start, int end, int seg_id)\n+\n {\n \n int ch, ret, key = parse_key(s);\n@@ -10,10 +10,10 @@\n \n if (!s->ch_size[ch]) {\n \n+ s->channels[seg_id][ch].nb_groups = 0;\n \n+ continue;\n+\n }\n \n if ((ret = convert_input(s, s->ch_size[ch], key)) < 0)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int parse_audio(DBEContext *s, int start, int end, int seg_id)\n\n{\n\n int ch, ret, key = parse_key(s);\n\n\n\n for (ch = start; ch < end; ch++) {\n\n if (!s->ch_size[ch]) {\n\n s->channels[seg_id][ch].nb_groups = 0;\n\n continue;\n\n }\n\n if ((ret = convert_input(s, s->ch_size[ch], key)) < 0)\n\n return ret;\n\n if ((ret = parse_channel(s, ch, seg_id)) < 0) {\n\n if (s->avctx->err_recognition & AV_EF_EXPLODE)\n\n return ret;\n\n s->channels[seg_id][ch].nb_groups = 0;\n\n }\n\n skip_input(s, s->ch_size[ch]);\n\n }\n\n\n\n skip_input(s, 1);\n\n return 0;\n\n}\n"}} {"sample_id": "72f0d0bf51362011c4d841a89fb8f5cfb16e0bf3_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n static int mp_user_removexattr(FsContext *ctx,\n+\n+ const char *path, const char *name)\n \n {\n \n char *buffer;\n+\n+ int ret;\n+\n+\n \n if (strncmp(name, \"user.virtfs.\", 12) == 0) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int mp_user_removexattr(FsContext *ctx,\n\n const char *path, const char *name)\n\n{\n\n char *buffer;\n\n int ret;\n\n\n\n if (strncmp(name, \"user.virtfs.\", 12) == 0) {\n\n /*\n\n * Don't allow fetch of user.virtfs namesapce\n\n * in case of mapped security\n\n */\n\n errno = EACCES;\n\n return -1;\n\n }\n\n buffer = rpath(ctx, path);\n\n ret = lremovexattr(buffer, name);\n\n g_free(buffer);\n\n return ret;\n\n}\n"}} {"sample_id": "2d3e302ec2246d703ffa8d8f8769a3fa448d8145", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n \n } else {\n+\n+ pagesize = getpagesize();\n+\n+ }\n+\n \n \n return pagesize >= max_cpu_page_size;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "bool kvmppc_is_mem_backend_page_size_ok(const char *obj_path)\n\n{\n\n Object *mem_obj = object_resolve_path(obj_path, NULL);\n\n char *mempath = object_property_get_str(mem_obj, \"mem-path\", NULL);\n\n long pagesize;\n\n\n\n if (mempath) {\n\n pagesize = qemu_mempath_getpagesize(mempath);\n\n\n } else {\n\n pagesize = getpagesize();\n\n }\n\n\n\n return pagesize >= max_cpu_page_size;\n\n}"}} {"sample_id": "b0c7f5a9d82feb7f4c4cdf77f1537193670ab58b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -59,11 +59,11 @@\n (int64_t)s->pts_den * st->codec.frame_rate_base);\n \n break;\n+\n+ default:\n+\n+ break;\n+\n }\n \n return ret;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int av_write_frame(AVFormatContext *s, int stream_index, const uint8_t *buf, \n\n int size)\n\n{\n\n AVStream *st;\n\n int64_t pts_mask;\n\n int ret, frame_size;\n\n\n\n st = s->streams[stream_index];\n\n pts_mask = (1LL << s->pts_wrap_bits) - 1;\n\n ret = s->oformat->write_packet(s, stream_index, buf, size, \n\n st->pts.val & pts_mask);\n\n if (ret < 0)\n\n return ret;\n\n\n\n /* update pts */\n\n switch (st->codec.codec_type) {\n\n case CODEC_TYPE_AUDIO:\n\n frame_size = get_audio_frame_size(&st->codec, size);\n\n\n\n /* note, we skip the initial 0-size packets as they are most likely equal to the encoder delay,\n\n but it would be better if we had the real timestamps from the encoder */\n\n// av_log(s, AV_LOG_DEBUG, \"%d %lld %lld\\n\", size, st->pts.num, st->pts.val);\n\n if (frame_size >= 0 && (size || st->pts.num!=st->pts.den>>1 || st->pts.val)) {\n\n av_frac_add(&st->pts, \n\n (int64_t)s->pts_den * frame_size);\n\n }\n\n break;\n\n case CODEC_TYPE_VIDEO:\n\n av_frac_add(&st->pts, \n\n (int64_t)s->pts_den * st->codec.frame_rate_base);\n\n break;\n\n default:\n\n break;\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "006508032057824a371bec4e629b66f8cbb26c47", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n {\n \n+ DCTELEM prev_dc;\n+\n+ int code, i, sign;\n+\n+\n \n OPEN_READER(re, gb);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_always_inline void decode_dc_coeffs(GetBitContext *gb, DCTELEM *out,\n\n int blocks_per_slice)\n\n{\n\n DCTELEM prev_dc;\n\n int code, i, sign;\n\n\n\n OPEN_READER(re, gb);\n\n\n\n DECODE_CODEWORD(code, FIRST_DC_CB);\n\n prev_dc = TOSIGNED(code);\n\n out[0] = prev_dc;\n\n\n\n out += 64; // dc coeff for the next block\n\n\n\n code = 5;\n\n sign = 0;\n\n for (i = 1; i < blocks_per_slice; i++, out += 64) {\n\n DECODE_CODEWORD(code, dc_codebook[FFMIN(code, 6)]);\n\n if(code) sign ^= -(code & 1);\n\n else sign = 0;\n\n prev_dc += (((code + 1) >> 1) ^ sign) - sign;\n\n out[0] = prev_dc;\n\n }\n\n CLOSE_READER(re, gb);\n\n}\n"}} {"sample_id": "ded5957d75def70d2f1fc1c1eae079230004974b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n av_freep(&film->stereo_buffer);\n \n \n+\n+ return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int film_read_close(AVFormatContext *s)\n\n{\n\n FilmDemuxContext *film = s->priv_data;\n\n\n\n av_freep(&film->sample_table);\n\n av_freep(&film->stereo_buffer);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_30", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n return 1;\n \n }\n+\n+ return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "int qemu_file_rate_limit(QEMUFile *f)\n\n{\n\n if (qemu_file_get_error(f)) {\n\n return 1;\n\n }\n\n if (f->xfer_limit > 0 && f->bytes_xfer > f->xfer_limit) {\n\n return 1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "39a7a362e16bb27e98738d63f24d1ab5811e26a8_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n Coroutine *co;\n \n Coroutine *tmp;\n+\n+\n+\n+ QLIST_FOREACH_SAFE(co, &s->pool, pool_next, tmp) {\n+\n g_free(DO_UPCAST(CoroutineUContext, base, co)->stack);\n \n g_free(co);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_coroutine_thread_cleanup(void *opaque)\n\n{\n\n CoroutineThreadState *s = opaque;\n\n Coroutine *co;\n\n Coroutine *tmp;\n\n\n\n QLIST_FOREACH_SAFE(co, &s->pool, pool_next, tmp) {\n\n g_free(DO_UPCAST(CoroutineUContext, base, co)->stack);\n\n g_free(co);\n\n }\n\n g_free(s);\n\n}\n"}} {"sample_id": "e2ae6159de2482ee5e22532301eb7f2795828d07", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,10 +7,10 @@\n \n \n if (!vcon->chr) {\n+\n+ return;\n+\n+ }\n \n qemu_chr_fe_set_open(vcon->chr, guest_connected);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void set_guest_connected(VirtIOSerialPort *port, int guest_connected)\n\n{\n\n VirtConsole *vcon = VIRTIO_CONSOLE(port);\n\n\n\n if (!vcon->chr) {\n\n return;\n\n }\n\n qemu_chr_fe_set_open(vcon->chr, guest_connected);\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_15", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n memset(buf, 0, sizeof(buf));\n \n+ cmd[0] = INQUIRY;\n+\n+ cmd[4] = sizeof(buf);\n+\n+\n \n memset(&io_header, 0, sizeof(io_header));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int get_device_type(SCSIDiskState *s)\n\n{\n\n BlockDriverState *bdrv = s->qdev.conf.bs;\n\n uint8_t cmd[16];\n\n uint8_t buf[36];\n\n uint8_t sensebuf[8];\n\n sg_io_hdr_t io_header;\n\n int ret;\n\n\n\n memset(cmd, 0, sizeof(cmd));\n\n memset(buf, 0, sizeof(buf));\n\n cmd[0] = INQUIRY;\n\n cmd[4] = sizeof(buf);\n\n\n\n memset(&io_header, 0, sizeof(io_header));\n\n io_header.interface_id = 'S';\n\n io_header.dxfer_direction = SG_DXFER_FROM_DEV;\n\n io_header.dxfer_len = sizeof(buf);\n\n io_header.dxferp = buf;\n\n io_header.cmdp = cmd;\n\n io_header.cmd_len = sizeof(cmd);\n\n io_header.mx_sb_len = sizeof(sensebuf);\n\n io_header.sbp = sensebuf;\n\n io_header.timeout = 6000; /* XXX */\n\n\n\n ret = bdrv_ioctl(bdrv, SG_IO, &io_header);\n\n if (ret < 0 || io_header.driver_status || io_header.host_status) {\n\n return -1;\n\n }\n\n s->qdev.type = buf[0];\n\n if (buf[1] & 0x80) {\n\n s->features |= 1 << SCSI_DISK_F_REMOVABLE;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "a9c380db3b8c6af19546a68145c8d1438a09c92b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n \n s->response[i] = qemu_get_be32(f);\n \n+ s->arglen = qemu_get_be32(f);\n+\n+\n+\n+\n \n s->response_pos = qemu_get_be32(f);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int ssi_sd_load(QEMUFile *f, void *opaque, int version_id)\n\n{\n\n SSISlave *ss = SSI_SLAVE(opaque);\n\n ssi_sd_state *s = (ssi_sd_state *)opaque;\n\n int i;\n\n\n\n if (version_id != 1)\n\n\n\n\n s->mode = qemu_get_be32(f);\n\n s->cmd = qemu_get_be32(f);\n\n for (i = 0; i < 4; i++)\n\n s->cmdarg[i] = qemu_get_be32(f);\n\n for (i = 0; i < 5; i++)\n\n s->response[i] = qemu_get_be32(f);\n\n s->arglen = qemu_get_be32(f);\n\n\n\n\n\n s->response_pos = qemu_get_be32(f);\n\n s->stopping = qemu_get_be32(f);\n\n\n\n\n\n\n\n\n ss->cs = qemu_get_be32(f);\n\n\n\n return 0;\n"}} {"sample_id": "d66b969b0d9c8eefdcbff4b48535b0fe1501d139_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n return VTD_PAGE_SHIFT_4K + (level - 1) * VTD_SL_LEVEL_BITS;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline uint32_t vtd_slpt_level_shift(uint32_t level)\n\n{\n\n return VTD_PAGE_SHIFT_4K + (level - 1) * VTD_SL_LEVEL_BITS;\n\n}\n"}} {"sample_id": "21d5d12bb0ad4de7cc92a7a2d018e7ec0f9fd148_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n changes, so it should be avoided. */\n \n+ struct timeval tv;\n+\n+ gettimeofday(&tv, NULL);\n+\n+ return tv.tv_sec * 1000000000LL + (tv.tv_usec * 1000);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int64_t get_clock(void)\n\n{\n\n#if defined(__linux__) || (defined(__FreeBSD__) && __FreeBSD_version >= 500000) \\\n\n\t|| defined(__DragonFly__)\n\n if (use_rt_clock) {\n\n struct timespec ts;\n\n clock_gettime(CLOCK_MONOTONIC, &ts);\n\n return ts.tv_sec * 1000000000LL + ts.tv_nsec;\n\n } else\n\n#endif\n\n {\n\n /* XXX: using gettimeofday leads to problems if the date\n\n changes, so it should be avoided. */\n\n struct timeval tv;\n\n gettimeofday(&tv, NULL);\n\n return tv.tv_sec * 1000000000LL + (tv.tv_usec * 1000);\n\n }\n\n}\n"}} {"sample_id": "0062869ae25007c8506517dcfcbe6f439dc6958a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int smacker_probe(AVProbeData *p)\n+\n {\n \n if(p->buf[0] == 'S' && p->buf[1] == 'M' && p->buf[2] == 'K'", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int smacker_probe(AVProbeData *p)\n\n{\n\n if(p->buf[0] == 'S' && p->buf[1] == 'M' && p->buf[2] == 'K'\n\n && (p->buf[3] == '2' || p->buf[3] == '4'))\n\n return AVPROBE_SCORE_MAX;\n\n else\n\n return 0;\n\n}\n"}} {"sample_id": "7a0e58fa648736a75f2a6943afd2ab08ea15b8e0_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n continue;\n \n }\n+\n+ /* Write value and confirm it reads back as written\n+\n+ * (to catch read-only registers and partially read-only\n+\n * registers where the incoming migration value doesn't match)\n \n */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool write_list_to_cpustate(ARMCPU *cpu)\n\n{\n\n int i;\n\n bool ok = true;\n\n\n\n for (i = 0; i < cpu->cpreg_array_len; i++) {\n\n uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);\n\n uint64_t v = cpu->cpreg_values[i];\n\n const ARMCPRegInfo *ri;\n\n\n\n ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);\n\n if (!ri) {\n\n ok = false;\n\n continue;\n\n }\n\n if (ri->type & ARM_CP_NO_MIGRATE) {\n\n continue;\n\n }\n\n /* Write value and confirm it reads back as written\n\n * (to catch read-only registers and partially read-only\n\n * registers where the incoming migration value doesn't match)\n\n */\n\n write_raw_cp_reg(&cpu->env, ri, v);\n\n if (read_raw_cp_reg(&cpu->env, ri) != v) {\n\n ok = false;\n\n }\n\n }\n\n return ok;\n\n}\n"}} {"sample_id": "69d09245d19765fd461cc3d3a7d79686007c4474", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,8 +11,8 @@\n gint fd;\n \n gchar *out, *out_err;\n+\n+ gboolean ret;\n \n int i;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void load_asl(GArray *sdts, AcpiSdtTable *sdt)\n\n{\n\n AcpiSdtTable *temp;\n\n GError *error = NULL;\n\n GString *command_line = g_string_new(iasl);\n\n gint fd;\n\n gchar *out, *out_err;\n\n gboolean ret;\n\n int i;\n\n\n\n fd = g_file_open_tmp(\"asl-XXXXXX.dsl\", &sdt->asl_file, &error);\n\n g_assert_no_error(error);\n\n close(fd);\n\n\n\n /* build command line */\n\n g_string_append_printf(command_line, \" -p %s \", sdt->asl_file);\n\n for (i = 0; i < 2; ++i) { /* reference DSDT and SSDT */\n\n temp = &g_array_index(sdts, AcpiSdtTable, i);\n\n g_string_append_printf(command_line, \"-e %s \", temp->aml_file);\n\n }\n\n g_string_append_printf(command_line, \"-d %s\", sdt->aml_file);\n\n\n\n /* pass 'out' and 'out_err' in order to be redirected */\n\n g_spawn_command_line_sync(command_line->str, &out, &out_err, NULL, &error);\n\n g_assert_no_error(error);\n\n\n\n ret = g_file_get_contents(sdt->asl_file, (gchar **)&sdt->asl,\n\n &sdt->asl_len, &error);\n\n g_assert(ret);\n\n g_assert_no_error(error);\n\n g_assert(sdt->asl_len);\n\n\n\n g_free(out);\n\n g_free(out_err);\n\n g_string_free(command_line, true);\n\n}\n"}} {"sample_id": "cf29a570a7aa7abab66bf256fdf9540873590811", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n acb->count++;\n \n if (ret == 0) {\n+\n acb->success_count++;\n \n } else {\n+\n quorum_report_bad(acb, sacb->aiocb->bs->node_name, ret);\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void quorum_aio_cb(void *opaque, int ret)\n\n{\n\n QuorumChildRequest *sacb = opaque;\n\n QuorumAIOCB *acb = sacb->parent;\n\n BDRVQuorumState *s = acb->common.bs->opaque;\n\n\n\n sacb->ret = ret;\n\n acb->count++;\n\n if (ret == 0) {\n\n acb->success_count++;\n\n } else {\n\n quorum_report_bad(acb, sacb->aiocb->bs->node_name, ret);\n\n }\n\n assert(acb->count <= s->num_children);\n\n assert(acb->success_count <= s->num_children);\n\n if (acb->count < s->num_children) {\n\n return;\n\n }\n\n\n\n /* Do the vote on read */\n\n if (acb->is_read) {\n\n quorum_vote(acb);\n\n } else {\n\n quorum_has_too_much_io_failed(acb);\n\n }\n\n\n\n quorum_aio_finalize(acb);\n\n}\n"}} {"sample_id": "e75ccf2c033fb0503d6cb7ddd0fd1dfa0aa4fc16_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n \n \n+ vdev->nvectors = proxy->nvectors;\n+\n+ virtio_init_pci(proxy, vdev,\n+\n+ PCI_VENDOR_ID_REDHAT_QUMRANET,\n \n PCI_DEVICE_ID_VIRTIO_NET,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int virtio_net_init_pci(PCIDevice *pci_dev)\n\n{\n\n VirtIOPCIProxy *proxy = DO_UPCAST(VirtIOPCIProxy, pci_dev, pci_dev);\n\n VirtIODevice *vdev;\n\n\n\n vdev = virtio_net_init(&pci_dev->qdev, &proxy->nic, &proxy->net);\n\n\n\n vdev->nvectors = proxy->nvectors;\n\n virtio_init_pci(proxy, vdev,\n\n PCI_VENDOR_ID_REDHAT_QUMRANET,\n\n PCI_DEVICE_ID_VIRTIO_NET,\n\n PCI_CLASS_NETWORK_ETHERNET,\n\n 0x00);\n\n\n\n /* make the actual value visible */\n\n proxy->nvectors = vdev->nvectors;\n\n return 0;\n\n}\n"}} {"sample_id": "f929ab0569ff31ed5a59b0b0adb7ce09df3fca39_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n av_freep(&s->me.map);\n \n av_freep(&s->me.score_map);\n+\n+ av_freep(&s->blocks);\n+\n+ av_freep(&s->ac_val_base);\n+\n s->block = NULL;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void free_duplicate_context(MpegEncContext *s)\n\n{\n\n if (s == NULL)\n\n return;\n\n\n\n av_freep(&s->edge_emu_buffer);\n\n av_freep(&s->me.scratchpad);\n\n s->me.temp =\n\n s->rd_scratchpad =\n\n s->b_scratchpad =\n\n s->obmc_scratchpad = NULL;\n\n\n\n av_freep(&s->dct_error_sum);\n\n av_freep(&s->me.map);\n\n av_freep(&s->me.score_map);\n\n av_freep(&s->blocks);\n\n av_freep(&s->ac_val_base);\n\n s->block = NULL;\n\n}\n"}} {"sample_id": "3b098d56979d2f7fd707c5be85555d114353a28d_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n QmpSerializeData *d = datap;\n \n+ visit_free(qmp_output_get_visitor(d->qov));\n+\n+ visit_free(d->qiv);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qmp_cleanup(void *datap)\n\n{\n\n QmpSerializeData *d = datap;\n\n visit_free(qmp_output_get_visitor(d->qov));\n\n visit_free(d->qiv);\n\n\n\n g_free(d);\n\n}\n"}} {"sample_id": "67a0fd2a9bca204d2b39f910a97c7137636a0715_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -46,11 +46,11 @@\n \n while (!data.done) {\n \n+ aio_poll(aio_context, true);\n+\n+ }\n+\n+ }\n \n return data.ret;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int64_t bdrv_get_block_status_above(BlockDriverState *bs,\n\n BlockDriverState *base,\n\n int64_t sector_num,\n\n int nb_sectors, int *pnum)\n\n{\n\n Coroutine *co;\n\n BdrvCoGetBlockStatusData data = {\n\n .bs = bs,\n\n .base = base,\n\n .sector_num = sector_num,\n\n .nb_sectors = nb_sectors,\n\n .pnum = pnum,\n\n .done = false,\n\n };\n\n\n\n if (qemu_in_coroutine()) {\n\n /* Fast-path if already in coroutine context */\n\n bdrv_get_block_status_above_co_entry(&data);\n\n } else {\n\n AioContext *aio_context = bdrv_get_aio_context(bs);\n\n\n\n co = qemu_coroutine_create(bdrv_get_block_status_above_co_entry);\n\n qemu_coroutine_enter(co, &data);\n\n while (!data.done) {\n\n aio_poll(aio_context, true);\n\n }\n\n }\n\n return data.ret;\n\n}\n"}} {"sample_id": "4417ab7adf1613799054be5afedf810fc2524ee8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n \n \n for (blk = blk_all_next(NULL); blk; blk = blk_all_next(blk)) {\n+\n+ if (!blk->disable_perm) {\n+\n+ continue;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void blk_resume_after_migration(Error **errp)\n\n{\n\n BlockBackend *blk;\n\n Error *local_err = NULL;\n\n\n\n for (blk = blk_all_next(NULL); blk; blk = blk_all_next(blk)) {\n\n if (!blk->disable_perm) {\n\n continue;\n\n }\n\n\n\n blk->disable_perm = false;\n\n\n\n blk_set_perm(blk, blk->perm, blk->shared_perm, &local_err);\n\n if (local_err) {\n\n error_propagate(errp, local_err);\n\n blk->disable_perm = true;\n\n return;\n\n }\n\n }\n\n}\n"}} {"sample_id": "09aaa1602f9381c0e0fb539390b1793e51bdfc7b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void wdt_i6300esb_init(void)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void wdt_i6300esb_init(void)\n\n{\n\n watchdog_add_model(&model);\n\n}\n"}} {"sample_id": "65988b991659fea72365be53e17d10953c0f8f78", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void decode_gain_info(GetBitContext *gb, int *gaininfo)\n \n+{\n \n int i, n;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void decode_gain_info(GetBitContext *gb, int *gaininfo)\n\n{\n\n int i, n;\n\n\n\n while (get_bits1(gb)) {\n\n /* NOTHING */\n\n }\n\n\n\n n = get_bits_count(gb) - 1; // amount of elements*2 to update\n\n\n\n i = 0;\n\n while (n--) {\n\n int index = get_bits(gb, 3);\n\n int gain = get_bits1(gb) ? get_bits(gb, 4) - 7 : -1;\n\n\n\n while (i <= index)\n\n gaininfo[i++] = gain;\n\n }\n\n while (i <= 8)\n\n gaininfo[i++] = 0;\n\n}\n"}} {"sample_id": "d7a4155265416a1c8f3067b59e68bf5fda1d6215", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n * If link is down and auto-negotiation is supported and ongoing,\n \n+ * complete auto-negotiation immediately. This allows us to look\n+\n+ * at MII_SR_AUTONEG_COMPLETE to infer link status on load.\n+\n+ */\n \n if (nc->link_down &&\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void e1000_pre_save(void *opaque)\n\n{\n\n E1000State *s = opaque;\n\n NetClientState *nc = qemu_get_queue(s->nic);\n\n\n\n /* If the mitigation timer is active, emulate a timeout now. */\n\n if (s->mit_timer_on) {\n\n e1000_mit_timer(s);\n\n }\n\n\n\n /*\n\n * If link is down and auto-negotiation is supported and ongoing,\n\n * complete auto-negotiation immediately. This allows us to look\n\n * at MII_SR_AUTONEG_COMPLETE to infer link status on load.\n\n */\n\n if (nc->link_down &&\n\n s->compat_flags & E1000_FLAG_AUTONEG &&\n\n s->phy_reg[PHY_CTRL] & MII_CR_AUTO_NEG_EN &&\n\n s->phy_reg[PHY_CTRL] & MII_CR_RESTART_AUTO_NEG) {\n\n s->phy_reg[PHY_STATUS] |= MII_SR_AUTONEG_COMPLETE;\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_271", "diff": "--- a/source.c\n+++ b/source.c\n@@ -64,11 +64,11 @@\n \n break;\n \n+\n+\n+ default:\n+\n+ error_report(\"milkymist_pfpu: write access to unknown register 0x\"\n \n TARGET_FMT_plx, addr << 2);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pfpu_write(void *opaque, target_phys_addr_t addr, uint64_t value,\n\n unsigned size)\n\n{\n\n MilkymistPFPUState *s = opaque;\n\n\n\n trace_milkymist_pfpu_memory_write(addr, value);\n\n\n\n addr >>= 2;\n\n switch (addr) {\n\n case R_CTL:\n\n if (value & CTL_START_BUSY) {\n\n pfpu_start(s);\n\n }\n\n break;\n\n case R_MESHBASE:\n\n case R_HMESHLAST:\n\n case R_VMESHLAST:\n\n case R_CODEPAGE:\n\n case R_VERTICES:\n\n case R_COLLISIONS:\n\n case R_STRAYWRITES:\n\n case R_LASTDMA:\n\n case R_PC:\n\n case R_DREGBASE:\n\n case R_CODEBASE:\n\n s->regs[addr] = value;\n\n break;\n\n case GPR_BEGIN ... GPR_END:\n\n s->gp_regs[addr - GPR_BEGIN] = value;\n\n break;\n\n case MICROCODE_BEGIN ... MICROCODE_END:\n\n s->microcode[get_microcode_address(s, addr)] = value;\n\n break;\n\n\n\n default:\n\n error_report(\"milkymist_pfpu: write access to unknown register 0x\"\n\n TARGET_FMT_plx, addr << 2);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "34779e8c3991f7fcd74b2045478abcef67dbeb15_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n d.noreboot = true;\n \n test_init(&d);\n+\n g_assert_cmpint(qpci_io_readw(d.dev, d.tco_io_bar, TCO_RLD), ==,\n \n TCO_RLD_DEFAULT);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void test_tco_defaults(void)\n\n{\n\n TestData d;\n\n\n\n d.args = NULL;\n\n d.noreboot = true;\n\n test_init(&d);\n\n g_assert_cmpint(qpci_io_readw(d.dev, d.tco_io_bar, TCO_RLD), ==,\n\n TCO_RLD_DEFAULT);\n\n /* TCO_DAT_IN & TCO_DAT_OUT */\n\n g_assert_cmpint(qpci_io_readw(d.dev, d.tco_io_bar, TCO_DAT_IN), ==,\n\n (TCO_DAT_OUT_DEFAULT << 8) | TCO_DAT_IN_DEFAULT);\n\n /* TCO1_STS & TCO2_STS */\n\n g_assert_cmpint(qpci_io_readl(d.dev, d.tco_io_bar, TCO1_STS), ==,\n\n (TCO2_STS_DEFAULT << 16) | TCO1_STS_DEFAULT);\n\n /* TCO1_CNT & TCO2_CNT */\n\n g_assert_cmpint(qpci_io_readl(d.dev, d.tco_io_bar, TCO1_CNT), ==,\n\n (TCO2_CNT_DEFAULT << 16) | TCO1_CNT_DEFAULT);\n\n /* TCO_MESSAGE1 & TCO_MESSAGE2 */\n\n g_assert_cmpint(qpci_io_readw(d.dev, d.tco_io_bar, TCO_MESSAGE1), ==,\n\n (TCO_MESSAGE2_DEFAULT << 8) | TCO_MESSAGE1_DEFAULT);\n\n g_assert_cmpint(qpci_io_readb(d.dev, d.tco_io_bar, TCO_WDCNT), ==,\n\n TCO_WDCNT_DEFAULT);\n\n g_assert_cmpint(qpci_io_readb(d.dev, d.tco_io_bar, SW_IRQ_GEN), ==,\n\n SW_IRQ_GEN_DEFAULT);\n\n g_assert_cmpint(qpci_io_readw(d.dev, d.tco_io_bar, TCO_TMR), ==,\n\n TCO_TMR_DEFAULT);\n\n qtest_end();\n\n}\n"}} {"sample_id": "b3db211f3c80bb996a704d665fe275619f728bd4_19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,8 +14,8 @@\n \n \n \n+ visit_type_int(v, NULL, &res, &error_abort);\n+\n+ g_assert_cmpint(res, ==, value);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_visitor_in_int(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n int64_t res = 0, value = -42;\n\n Visitor *v;\n\n\n\n v = visitor_input_test_init(data, \"%\" PRId64, value);\n\n\n\n visit_type_int(v, NULL, &res, &error_abort);\n\n g_assert_cmpint(res, ==, value);\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n static void test_bmdma_no_busmaster(void)\n \n+{\n \n+ QPCIDevice *dev;\n \n void *bmdma_base, *ide_base;\n \n+ uint8_t status;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void test_bmdma_no_busmaster(void)\n\n{\n\n QPCIDevice *dev;\n\n void *bmdma_base, *ide_base;\n\n uint8_t status;\n\n\n\n dev = get_pci_device(&bmdma_base, &ide_base);\n\n\n\n /* No PRDT_EOT, each entry addr 0/size 64k, and in theory qemu shouldn't be\n\n * able to access it anyway because the Bus Master bit in the PCI command\n\n * register isn't set. This is complete nonsense, but it used to be pretty\n\n * good at confusing and occasionally crashing qemu. */\n\n PrdtEntry prdt[4096] = { };\n\n\n\n status = send_dma_request(CMD_READ_DMA | CMDF_NO_BM, 0, 512,\n\n prdt, ARRAY_SIZE(prdt), NULL);\n\n\n\n /* Not entirely clear what the expected result is, but this is what we get\n\n * in practice. At least we want to be aware of any changes. */\n\n g_assert_cmphex(status, ==, BM_STS_ACTIVE | BM_STS_INTR);\n\n assert_bit_clear(qpci_io_readb(dev, ide_base + reg_status), DF | ERR);\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_26", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n return timer_head && (timer_head->expire_time <= current_time);\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool timer_expired_ns(QEMUTimer *timer_head, int64_t current_time)\n\n{\n\n return timer_head && (timer_head->expire_time <= current_time);\n\n}\n"}} {"sample_id": "ec05ec26f940564b1e07bf88857035ec27e21dd8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n hwaddr size, unsigned client)\n \n {\n+\n+ assert(mr->terminates);\n+\n cpu_physical_memory_test_and_clear_dirty(mr->ram_addr + addr, size,\n \n client);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void memory_region_reset_dirty(MemoryRegion *mr, hwaddr addr,\n\n hwaddr size, unsigned client)\n\n{\n\n assert(mr->terminates);\n\n cpu_physical_memory_test_and_clear_dirty(mr->ram_addr + addr, size,\n\n client);\n\n}\n"}} {"sample_id": "f9a8b5530d438f836f9697639814f585aaec554d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void qdev_prop_set_globals_for_type(DeviceState *dev,\n+\n+ const char *typename)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void qdev_prop_set_globals_for_type(DeviceState *dev,\n\n const char *typename)\n\n{\n\n GlobalProperty *prop;\n\n\n\n QTAILQ_FOREACH(prop, &global_props, next) {\n\n Error *err = NULL;\n\n\n\n if (strcmp(typename, prop->driver) != 0) {\n\n continue;\n\n }\n\n prop->used = true;\n\n object_property_parse(OBJECT(dev), prop->value, prop->property, &err);\n\n if (err != NULL) {\n\n assert(prop->user_provided);\n\n error_reportf_err(err, \"Warning: global %s.%s=%s ignored: \",\n\n prop->driver, prop->property, prop->value);\n\n return;\n\n }\n\n }\n\n}\n"}} {"sample_id": "27e0c9a1bbd166a67c16291016fba298a8e47140", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n }\n \n+ bdrv_attach_dev_nofail(dinfo->bdrv, &bus->ifs[i]);\n+\n+ } else {\n+\n+ ide_reset(&bus->ifs[i]);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ide_init2_with_non_qdev_drives(IDEBus *bus, DriveInfo *hd0,\n\n DriveInfo *hd1, qemu_irq irq)\n\n{\n\n int i;\n\n DriveInfo *dinfo;\n\n\n\n for(i = 0; i < 2; i++) {\n\n dinfo = i == 0 ? hd0 : hd1;\n\n ide_init1(bus, i);\n\n if (dinfo) {\n\n if (ide_init_drive(&bus->ifs[i], dinfo->bdrv,\n\n dinfo->media_cd ? IDE_CD : IDE_HD, NULL,\n\n *dinfo->serial ? dinfo->serial : NULL) < 0) {\n\n error_report(\"Can't set up IDE drive %s\", dinfo->id);\n\n exit(1);\n\n }\n\n bdrv_attach_dev_nofail(dinfo->bdrv, &bus->ifs[i]);\n\n } else {\n\n ide_reset(&bus->ifs[i]);\n\n }\n\n }\n\n bus->irq = irq;\n\n bus->dma = &ide_dma_nop;\n\n}\n"}} {"sample_id": "9f61abc8111c7c43f49ca012e957a108b9cc7610_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n for (j = 0; j < sc->drefs_count; j++) {\n \n+ av_freep(&sc->drefs[j].path);\n+\n+ av_freep(&sc->drefs[j].dir);\n+\n+ }\n \n av_freep(&sc->drefs);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mov_read_close(AVFormatContext *s)\n\n{\n\n MOVContext *mov = s->priv_data;\n\n int i, j;\n\n\n\n for (i = 0; i < s->nb_streams; i++) {\n\n AVStream *st = s->streams[i];\n\n MOVStreamContext *sc = st->priv_data;\n\n\n\n av_freep(&sc->ctts_data);\n\n for (j = 0; j < sc->drefs_count; j++) {\n\n av_freep(&sc->drefs[j].path);\n\n av_freep(&sc->drefs[j].dir);\n\n }\n\n av_freep(&sc->drefs);\n\n if (sc->pb && sc->pb != s->pb)\n\n avio_close(sc->pb);\n\n\n\n av_freep(&sc->chunk_offsets);\n\n av_freep(&sc->stsc_data);\n\n av_freep(&sc->sample_sizes);\n\n av_freep(&sc->keyframes);\n\n av_freep(&sc->stts_data);\n\n av_freep(&sc->stps_data);\n\n av_freep(&sc->rap_group);\n\n av_freep(&sc->display_matrix);\n\n }\n\n\n\n if (mov->dv_demux) {\n\n avformat_free_context(mov->dv_fctx);\n\n mov->dv_fctx = NULL;\n\n }\n\n\n\n av_freep(&mov->trex_data);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "16f4e8fa737b58b7b0461b33581e43ac06991110", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,7 +16,7 @@\n \n } else if (strcmp(mode, \"halt\") == 0) {\n \n+ shutdown_flag |= EWX_SHUTDOWN;\n \n } else if (strcmp(mode, \"reboot\") == 0) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void qmp_guest_shutdown(bool has_mode, const char *mode, Error **err)\n\n{\n\n UINT shutdown_flag = EWX_FORCE;\n\n\n\n slog(\"guest-shutdown called, mode: %s\", mode);\n\n\n\n if (!has_mode || strcmp(mode, \"powerdown\") == 0) {\n\n shutdown_flag |= EWX_POWEROFF;\n\n } else if (strcmp(mode, \"halt\") == 0) {\n\n shutdown_flag |= EWX_SHUTDOWN;\n\n } else if (strcmp(mode, \"reboot\") == 0) {\n\n shutdown_flag |= EWX_REBOOT;\n\n } else {\n\n error_set(err, QERR_INVALID_PARAMETER_VALUE, \"mode\",\n\n \"halt|powerdown|reboot\");\n\n return;\n\n }\n\n\n\n /* Request a shutdown privilege, but try to shut down the system\n\n anyway. */\n\n acquire_privilege(SE_SHUTDOWN_NAME, err);\n\n if (error_is_set(err)) {\n\n return;\n\n }\n\n\n\n if (!ExitWindowsEx(shutdown_flag, SHTDN_REASON_FLAG_PLANNED)) {\n\n slog(\"guest-shutdown failed: %d\", GetLastError());\n\n error_set(err, QERR_UNDEFINED_ERROR);\n\n }\n\n}\n"}} {"sample_id": "10eacda787ac9990dc22d4437b289200c819712c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n switch (mode) {\n \n case ARM_CPU_MODE_USR:\n+\n+ return 0;\n+\n+ case ARM_CPU_MODE_SYS:\n+\n case ARM_CPU_MODE_SVC:\n \n case ARM_CPU_MODE_ABT:", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int bad_mode_switch(CPUARMState *env, int mode, CPSRWriteType write_type)\n\n{\n\n /* Return true if it is not valid for us to switch to\n\n * this CPU mode (ie all the UNPREDICTABLE cases in\n\n * the ARM ARM CPSRWriteByInstr pseudocode).\n\n\n\n\n /* Changes to or from Hyp via MSR and CPS are illegal. */\n\n\n ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_HYP ||\n\n mode == ARM_CPU_MODE_HYP)) {\n\n\n\n\n\n switch (mode) {\n\n case ARM_CPU_MODE_USR:\n\n return 0;\n\n case ARM_CPU_MODE_SYS:\n\n case ARM_CPU_MODE_SVC:\n\n case ARM_CPU_MODE_ABT:\n\n case ARM_CPU_MODE_UND:\n\n case ARM_CPU_MODE_IRQ:\n\n case ARM_CPU_MODE_FIQ:\n\n /* Note that we don't implement the IMPDEF NSACR.RFR which in v7\n\n * allows FIQ mode to be Secure-only. (In v8 this doesn't exist.)\n\n\n\n\n\n\n\n\n\n\n\n return 0;\n\n case ARM_CPU_MODE_HYP:\n\n return !arm_feature(env, ARM_FEATURE_EL2)\n\n || arm_current_el(env) < 2 || arm_is_secure(env);\n\n case ARM_CPU_MODE_MON:\n\n return arm_current_el(env) < 3;\n\n default:\n\n\n"}} {"sample_id": "54f254f973a1b2ed0f3571390f4de060adfe23e8_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n addr &= 0x1f;\n \n+#ifdef DEBUG\n+\n+ printf(\"uhci writel port=0x%04x val=0x%08x\\n\", addr, val);\n+\n+#endif\n \n switch(addr) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void uhci_ioport_writel(void *opaque, uint32_t addr, uint32_t val)\n\n{\n\n UHCIState *s = opaque;\n\n\n\n addr &= 0x1f;\n\n#ifdef DEBUG\n\n printf(\"uhci writel port=0x%04x val=0x%08x\\n\", addr, val);\n\n#endif\n\n switch(addr) {\n\n case 0x08:\n\n s->fl_base_addr = val & ~0xfff;\n\n break;\n\n }\n\n}\n"}} {"sample_id": "faabdbb792889bf011a593578d1de51e14616bb7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void qdev_property_add_static(DeviceState *dev, Property *prop,\n+\n+ Error **errp)\n+\n+{\n+\n Error *local_err = NULL;\n \n Object *obj = OBJECT(dev);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qdev_property_add_static(DeviceState *dev, Property *prop,\n\n Error **errp)\n\n{\n\n Error *local_err = NULL;\n\n Object *obj = OBJECT(dev);\n\n\n\n /*\n\n * TODO qdev_prop_ptr does not have getters or setters. It must\n\n * go now that it can be replaced with links. The test should be\n\n * removed along with it: all static properties are read/write.\n\n */\n\n if (!prop->info->get && !prop->info->set) {\n\n return;\n\n }\n\n\n\n object_property_add(obj, prop->name, prop->info->name,\n\n prop->info->get, prop->info->set,\n\n prop->info->release,\n\n prop, &local_err);\n\n\n\n if (local_err) {\n\n error_propagate(errp, local_err);\n\n return;\n\n }\n\n\n\n object_property_set_description(obj, prop->name,\n\n prop->info->description,\n\n &error_abort);\n\n\n\n if (prop->info->set_default_value) {\n\n prop->info->set_default_value(obj, prop);\n\n }\n\n}\n"}} {"sample_id": "cc84de9570ffe01a9c3c169bd62ab9586a9a080c_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n \n \n while (qemu_mutex_trylock(&qemu_global_mutex)) {\n+\n+ qemu_thread_signal(tcg_cpu_thread, SIGUSR1);\n+\n+ if (!qemu_mutex_timedlock(&qemu_global_mutex, msecs))\n+\n break;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_signal_lock(unsigned int msecs)\n\n{\n\n qemu_mutex_lock(&qemu_fair_mutex);\n\n\n\n while (qemu_mutex_trylock(&qemu_global_mutex)) {\n\n qemu_thread_signal(tcg_cpu_thread, SIGUSR1);\n\n if (!qemu_mutex_timedlock(&qemu_global_mutex, msecs))\n\n break;\n\n }\n\n qemu_mutex_unlock(&qemu_fair_mutex);\n\n}\n"}} {"sample_id": "ddca7f86ac022289840e0200fd4050b2b58e9176_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n \n \n+ pdu_unmarshal(pdu, offset, \"ds\", &s->msize, &version);\n+\n+ trace_v9fs_version(pdu->tag, pdu->id, s->msize, version.data);\n+\n+\n \n virtfs_reset(pdu);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void v9fs_version(void *opaque)\n\n{\n\n V9fsPDU *pdu = opaque;\n\n V9fsState *s = pdu->s;\n\n V9fsString version;\n\n size_t offset = 7;\n\n\n\n pdu_unmarshal(pdu, offset, \"ds\", &s->msize, &version);\n\n trace_v9fs_version(pdu->tag, pdu->id, s->msize, version.data);\n\n\n\n virtfs_reset(pdu);\n\n\n\n if (!strcmp(version.data, \"9P2000.u\")) {\n\n s->proto_version = V9FS_PROTO_2000U;\n\n } else if (!strcmp(version.data, \"9P2000.L\")) {\n\n s->proto_version = V9FS_PROTO_2000L;\n\n } else {\n\n v9fs_string_sprintf(&version, \"unknown\");\n\n }\n\n\n\n offset += pdu_marshal(pdu, offset, \"ds\", s->msize, &version);\n\n trace_v9fs_version_return(pdu->tag, pdu->id, s->msize, version.data);\n\n\n\n complete_pdu(s, pdu, offset);\n\n\n\n v9fs_string_free(&version);\n\n return;\n\n}\n"}} {"sample_id": "ad2d30f79d3b0812f02c741be2189796b788d6d7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static void scsi_remove_request(SCSIGenericReq *r)\n \n+{\n \n qemu_free(r->buf);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void scsi_remove_request(SCSIGenericReq *r)\n\n{\n\n qemu_free(r->buf);\n\n scsi_req_free(&r->req);\n\n}\n"}} {"sample_id": "e3cb6ba65d265f2cc1313ee26e879407ff24663c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n if (dev->state != DEV_STATE_CREATED) {\n \n+ error_set(errp, QERR_PERMISSION_DENIED);\n+\n+ return;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qdev_set_legacy_property(DeviceState *dev, Visitor *v, void *opaque,\n\n const char *name, Error **errp)\n\n{\n\n Property *prop = opaque;\n\n\n\n if (dev->state != DEV_STATE_CREATED) {\n\n error_set(errp, QERR_PERMISSION_DENIED);\n\n return;\n\n }\n\n\n\n if (prop->info->parse) {\n\n Error *local_err = NULL;\n\n char *ptr = NULL;\n\n\n\n visit_type_str(v, &ptr, name, &local_err);\n\n if (!local_err) {\n\n int ret;\n\n ret = prop->info->parse(dev, prop, ptr);\n\n if (ret != 0) {\n\n error_set(errp, QERR_INVALID_PARAMETER_VALUE,\n\n name, prop->info->name);\n\n }\n\n g_free(ptr);\n\n } else {\n\n error_propagate(errp, local_err);\n\n }\n\n } else {\n\n error_set(errp, QERR_PERMISSION_DENIED);\n\n }\n\n}\n"}} {"sample_id": "a12a5a1a0132527afe87c079e4aae4aad372bd94_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n {\n \n+ int64_t res = 0;\n+\n Error *err = NULL;\n \n Visitor *v;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_visitor_in_int_overflow(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n int64_t res = 0;\n\n Error *err = NULL;\n\n Visitor *v;\n\n\n\n /* this will overflow a Qint/int64, so should be deserialized into\n\n * a QFloat/double field instead, leading to an error if we pass it\n\n * to visit_type_int. confirm this.\n\n */\n\n v = visitor_input_test_init(data, \"%f\", DBL_MAX);\n\n\n\n visit_type_int(v, &res, NULL, &err);\n\n g_assert(err);\n\n error_free(err);\n\n}\n"}} {"sample_id": "47f9f15831faa549504ab9b035aaea44a02e5f95", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,9 +7,9 @@\n uint8_t *buf = NULL;\n \n uint8_t *buffer;\n+\n size_t offset;\n+\n ssize_t ret;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static ssize_t nc_sendv_compat(NetClientState *nc, const struct iovec *iov,\n\n int iovcnt, unsigned flags)\n\n{\n\n uint8_t *buf = NULL;\n\n uint8_t *buffer;\n\n size_t offset;\n\n ssize_t ret;\n\n\n\n if (iovcnt == 1) {\n\n buffer = iov[0].iov_base;\n\n offset = iov[0].iov_len;\n\n } else {\n\n buf = g_new(uint8_t, NET_BUFSIZE);\n\n buffer = buf;\n\n offset = iov_to_buf(iov, iovcnt, 0, buf, NET_BUFSIZE);\n\n }\n\n\n\n if (flags & QEMU_NET_PACKET_FLAG_RAW && nc->info->receive_raw) {\n\n ret = nc->info->receive_raw(nc, buffer, offset);\n\n } else {\n\n ret = nc->info->receive(nc, buffer, offset);\n\n }\n\n\n\n g_free(buf);\n\n return ret;\n\n}\n"}} {"sample_id": "5fb6c7a8b26eab1a22207d24b4784bd2b39ab54b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n strcpy(*cred, certdir);\n \n+ strcat(*cred, \"/\");\n+\n+ strcat(*cred, filename);\n+\n+\n \n VNC_DEBUG(\"Check %s\\n\", *cred);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int vnc_set_x509_credential(VncDisplay *vs,\n\n\t\t\t\t const char *certdir,\n\n\t\t\t\t const char *filename,\n\n\t\t\t\t char **cred,\n\n\t\t\t\t int ignoreMissing)\n\n{\n\n struct stat sb;\n\n\n\n if (*cred) {\n\n\tqemu_free(*cred);\n\n\t*cred = NULL;\n\n }\n\n\n\n *cred = qemu_malloc(strlen(certdir) + strlen(filename) + 2);\n\n\n\n strcpy(*cred, certdir);\n\n strcat(*cred, \"/\");\n\n strcat(*cred, filename);\n\n\n\n VNC_DEBUG(\"Check %s\\n\", *cred);\n\n if (stat(*cred, &sb) < 0) {\n\n\tqemu_free(*cred);\n\n\t*cred = NULL;\n\n\tif (ignoreMissing && errno == ENOENT)\n\n\t return 0;\n\n\treturn -1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "af165acefacd89196c003c24802fa3c494d54d3a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -43,11 +43,11 @@\n }\n \n }\n+\n+ if (is_clcp_track(track)) {\n+\n+ mov_write_tapt_tag(pb, track);\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mov_write_trak_tag(AVIOContext *pb, MOVMuxContext *mov,\n\n MOVTrack *track, AVStream *st)\n\n{\n\n int64_t pos = avio_tell(pb);\n\n avio_wb32(pb, 0); /* size */\n\n ffio_wfourcc(pb, \"trak\");\n\n mov_write_tkhd_tag(pb, track, st);\n\n if (supports_edts(mov))\n\n mov_write_edts_tag(pb, track); // PSP Movies and several other cases require edts box\n\n if (track->tref_tag)\n\n mov_write_tref_tag(pb, track);\n\n mov_write_mdia_tag(pb, track);\n\n if (track->mode == MODE_PSP)\n\n mov_write_uuid_tag_psp(pb, track); // PSP Movies require this uuid box\n\n if (track->tag == MKTAG('r','t','p',' '))\n\n mov_write_udta_sdp(pb, track);\n\n if (track->mode == MODE_MOV) {\n\n if (track->enc->codec_type == AVMEDIA_TYPE_VIDEO) {\n\n double sample_aspect_ratio = av_q2d(st->sample_aspect_ratio);\n\n if (st->sample_aspect_ratio.num && 1.0 != sample_aspect_ratio) {\n\n mov_write_tapt_tag(pb, track);\n\n }\n\n }\n\n if (is_clcp_track(track)) {\n\n mov_write_tapt_tag(pb, track);\n\n }\n\n }\n\n return update_size(pb, pos);\n\n}\n"}} {"sample_id": "6476615d385eb249105b25873ef30ba4b9c808dc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -51,11 +51,11 @@\n \n \n oldv = int128_make128(oldl, oldh);\n+\n+ fail = !int128_eq(oldv, cmpv);\n+\n+ if (fail) {\n+\n newv = oldv;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void HELPER(cdsg)(CPUS390XState *env, uint64_t addr,\n\n uint32_t r1, uint32_t r3)\n\n{\n\n uintptr_t ra = GETPC();\n\n Int128 cmpv = int128_make128(env->regs[r1 + 1], env->regs[r1]);\n\n Int128 newv = int128_make128(env->regs[r3 + 1], env->regs[r3]);\n\n Int128 oldv;\n\n bool fail;\n\n\n\n if (parallel_cpus) {\n\n#ifndef CONFIG_ATOMIC128\n\n cpu_loop_exit_atomic(ENV_GET_CPU(env), ra);\n\n#else\n\n int mem_idx = cpu_mmu_index(env, false);\n\n TCGMemOpIdx oi = make_memop_idx(MO_TEQ | MO_ALIGN_16, mem_idx);\n\n oldv = helper_atomic_cmpxchgo_be_mmu(env, addr, cmpv, newv, oi, ra);\n\n fail = !int128_eq(oldv, cmpv);\n\n#endif\n\n } else {\n\n uint64_t oldh, oldl;\n\n\n\n check_alignment(env, addr, 16, ra);\n\n\n\n oldh = cpu_ldq_data_ra(env, addr + 0, ra);\n\n oldl = cpu_ldq_data_ra(env, addr + 8, ra);\n\n\n\n oldv = int128_make128(oldl, oldh);\n\n fail = !int128_eq(oldv, cmpv);\n\n if (fail) {\n\n newv = oldv;\n\n }\n\n\n\n cpu_stq_data_ra(env, addr + 0, int128_gethi(newv), ra);\n\n cpu_stq_data_ra(env, addr + 8, int128_getlo(newv), ra);\n\n }\n\n\n\n env->cc_op = fail;\n\n env->regs[r1] = int128_gethi(oldv);\n\n env->regs[r1 + 1] = int128_getlo(oldv);\n\n}\n"}} {"sample_id": "53111180946a56d314a9c1d07d09b9ef91e847b9_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,18 +1,18 @@\n+static int arm_gic_common_init(SysBusDevice *dev)\n+\n {\n \n+ GICState *s = FROM_SYSBUS(GICState, dev);\n \n int num_irq = s->num_irq;\n \n+\n \n if (s->num_cpu > NCPU) {\n+\n hw_error(\"requested %u CPUs exceeds GIC maximum %d\\n\",\n \n+ s->num_cpu, NCPU);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int arm_gic_common_init(SysBusDevice *dev)\n\n{\n\n GICState *s = FROM_SYSBUS(GICState, dev);\n\n int num_irq = s->num_irq;\n\n\n\n if (s->num_cpu > NCPU) {\n\n hw_error(\"requested %u CPUs exceeds GIC maximum %d\\n\",\n\n s->num_cpu, NCPU);\n\n }\n\n s->num_irq += GIC_BASE_IRQ;\n\n if (s->num_irq > GIC_MAXIRQ) {\n\n hw_error(\"requested %u interrupt lines exceeds GIC maximum %d\\n\",\n\n num_irq, GIC_MAXIRQ);\n\n }\n\n /* ITLinesNumber is represented as (N / 32) - 1 (see\n\n * gic_dist_readb) so this is an implementation imposed\n\n * restriction, not an architectural one:\n\n */\n\n if (s->num_irq < 32 || (s->num_irq % 32)) {\n\n hw_error(\"%d interrupt lines unsupported: not divisible by 32\\n\",\n\n num_irq);\n\n }\n\n\n\n register_savevm(NULL, \"arm_gic\", -1, 3, gic_save, gic_load, s);\n\n return 0;\n\n}\n"}} {"sample_id": "a89f364ae8740dfc31b321eed9ee454e996dc3c1_21", "diff": "--- a/source.c\n+++ b/source.c\n@@ -39,11 +39,11 @@\n case 5:\n \n case 6:\n+\n+ printf(\"%s: Audio GPIO%i %s.\\n\",\n+\n+ __FUNCTION__, line - 4, level ? \"high\" : \"low\");\n+\n break;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void palmte_onoff_gpios(void *opaque, int line, int level)\n\n{\n\n switch (line) {\n\n case 0:\n\n printf(\"%s: current to MMC/SD card %sabled.\\n\",\n\n __FUNCTION__, level ? \"dis\" : \"en\");\n\n break;\n\n case 1:\n\n printf(\"%s: internal speaker amplifier %s.\\n\",\n\n __FUNCTION__, level ? \"down\" : \"on\");\n\n break;\n\n\n\n /* These LCD & Audio output signals have not been identified yet. */\n\n case 2:\n\n case 3:\n\n case 4:\n\n printf(\"%s: LCD GPIO%i %s.\\n\",\n\n __FUNCTION__, line - 1, level ? \"high\" : \"low\");\n\n break;\n\n case 5:\n\n case 6:\n\n printf(\"%s: Audio GPIO%i %s.\\n\",\n\n __FUNCTION__, line - 4, level ? \"high\" : \"low\");\n\n break;\n\n }\n\n}\n"}} {"sample_id": "4860625236475da20d0da954017e8c7fe412dea2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n yuv2rgb48_2_c_template(SwsContext *c, const int32_t *buf[2],\n \n+ const int32_t *ubuf[2], const int32_t *vbuf[2],\n+\n const int32_t *abuf[2], uint16_t *dest, int dstW,\n \n int yalpha, int uvalpha, int y,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "yuv2rgb48_2_c_template(SwsContext *c, const int32_t *buf[2],\n\n const int32_t *ubuf[2], const int32_t *vbuf[2],\n\n const int32_t *abuf[2], uint16_t *dest, int dstW,\n\n int yalpha, int uvalpha, int y,\n\n enum PixelFormat target)\n\n{\n\n const int32_t *buf0 = buf[0], *buf1 = buf[1],\n\n *ubuf0 = ubuf[0], *ubuf1 = ubuf[1],\n\n *vbuf0 = vbuf[0], *vbuf1 = vbuf[1];\n\n int yalpha1 = 4095 - yalpha;\n\n int uvalpha1 = 4095 - uvalpha;\n\n int i;\n\n\n\n for (i = 0; i < ((dstW + 1) >> 1); i++) {\n\n int Y1 = (buf0[i * 2] * yalpha1 + buf1[i * 2] * yalpha) >> 14;\n\n int Y2 = (buf0[i * 2 + 1] * yalpha1 + buf1[i * 2 + 1] * yalpha) >> 14;\n\n int U = (ubuf0[i] * uvalpha1 + ubuf1[i] * uvalpha + (-128 << 23)) >> 14;\n\n int V = (vbuf0[i] * uvalpha1 + vbuf1[i] * uvalpha + (-128 << 23)) >> 14;\n\n int R, G, B;\n\n\n\n Y1 -= c->yuv2rgb_y_offset;\n\n Y2 -= c->yuv2rgb_y_offset;\n\n Y1 *= c->yuv2rgb_y_coeff;\n\n Y2 *= c->yuv2rgb_y_coeff;\n\n Y1 += 1 << 13;\n\n Y2 += 1 << 13;\n\n\n\n R = V * c->yuv2rgb_v2r_coeff;\n\n G = V * c->yuv2rgb_v2g_coeff + U * c->yuv2rgb_u2g_coeff;\n\n B = U * c->yuv2rgb_u2b_coeff;\n\n\n\n output_pixel(&dest[0], av_clip_uintp2(R_B + Y1, 30) >> 14);\n\n output_pixel(&dest[1], av_clip_uintp2( G + Y1, 30) >> 14);\n\n output_pixel(&dest[2], av_clip_uintp2(B_R + Y1, 30) >> 14);\n\n output_pixel(&dest[3], av_clip_uintp2(R_B + Y2, 30) >> 14);\n\n output_pixel(&dest[4], av_clip_uintp2( G + Y2, 30) >> 14);\n\n output_pixel(&dest[5], av_clip_uintp2(B_R + Y2, 30) >> 14);\n\n dest += 6;\n\n }\n\n}\n"}} {"sample_id": "403e633126b7a781ecd48a29e3355770d46bbf1a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n void qemu_thread_create(QemuThread *thread,\n \n+ void *(*start_routine)(void *),\n \n void *arg, int mode)\n \n+{\n \n HANDLE hThread;\n+\n \n \n assert(mode == QEMU_THREAD_DETACHED);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void qemu_thread_create(QemuThread *thread,\n\n void *(*start_routine)(void *),\n\n void *arg, int mode)\n\n{\n\n HANDLE hThread;\n\n\n\n assert(mode == QEMU_THREAD_DETACHED);\n\n\n\n struct QemuThreadData *data;\n\n qemu_thread_init();\n\n data = g_malloc(sizeof *data);\n\n data->thread = thread;\n\n data->start_routine = start_routine;\n\n data->arg = arg;\n\n\n\n hThread = (HANDLE) _beginthreadex(NULL, 0, win32_start_routine,\n\n data, 0, NULL);\n\n if (!hThread) {\n\n error_exit(GetLastError(), __func__);\n\n }\n\n CloseHandle(hThread);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_109", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void stw_be_phys(target_phys_addr_t addr, uint32_t val)\n \n+{\n \n stw_phys_internal(addr, val, DEVICE_BIG_ENDIAN);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void stw_be_phys(target_phys_addr_t addr, uint32_t val)\n\n{\n\n stw_phys_internal(addr, val, DEVICE_BIG_ENDIAN);\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_31", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n void do_POWER_divs (void)\n+\n {\n \n if ((Ts0 == INT32_MIN && Ts1 == -1) || Ts1 == 0) {\n \n+ T0 = (long)((-1) * (T0 >> 31));\n \n env->spr[SPR_MQ] = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void do_POWER_divs (void)\n\n{\n\n if ((Ts0 == INT32_MIN && Ts1 == -1) || Ts1 == 0) {\n\n T0 = (long)((-1) * (T0 >> 31));\n\n env->spr[SPR_MQ] = 0;\n\n } else {\n\n env->spr[SPR_MQ] = T0 % T1;\n\n T0 = Ts0 / Ts1;\n\n }\n\n}\n"}} {"sample_id": "21b7cf9e07e5991c57b461181cfb5bbb6fe7a9d6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void __attribute__((__constructor__)) rcu_init(void)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void __attribute__((__constructor__)) rcu_init(void)\n\n{\n\n QemuThread thread;\n\n\n\n qemu_mutex_init(&rcu_gp_lock);\n\n qemu_event_init(&rcu_gp_event, true);\n\n\n\n qemu_event_init(&rcu_call_ready_event, false);\n\n qemu_thread_create(&thread, \"call_rcu\", call_rcu_thread,\n\n NULL, QEMU_THREAD_DETACHED);\n\n\n\n rcu_register_thread();\n\n}\n"}} {"sample_id": "31ce5e0c49821d92fb30cce2f3055ef33613b287_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void kvm_inject_x86_mce(CPUState *cenv, int bank, uint64_t status,\n \n uint64_t mcg_status, uint64_t addr, uint64_t misc,\n \n@@ -8,7 +8,7 @@\n \n #ifdef KVM_CAP_MCE\n \n+ struct kvm_x86_mce mce = {\n \n .bank = bank,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void kvm_inject_x86_mce(CPUState *cenv, int bank, uint64_t status,\n\n uint64_t mcg_status, uint64_t addr, uint64_t misc,\n\n int abort_on_error)\n\n{\n\n#ifdef KVM_CAP_MCE\n\n struct kvm_x86_mce mce = {\n\n .bank = bank,\n\n .status = status,\n\n .mcg_status = mcg_status,\n\n .addr = addr,\n\n .misc = misc,\n\n };\n\n struct kvm_x86_mce_data data = {\n\n .env = cenv,\n\n .mce = &mce,\n\n };\n\n\n\n if (!cenv->mcg_cap) {\n\n fprintf(stderr, \"MCE support is not enabled!\\n\");\n\n return;\n\n }\n\n\n\n run_on_cpu(cenv, kvm_do_inject_x86_mce, &data);\n\n#else\n\n if (abort_on_error)\n\n abort();\n\n#endif\n\n}\n"}} {"sample_id": "4a1418e07bdcfaa3177739e04707ecaec75d89e1_34", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,9 +13,9 @@\n if (env)\n \n env->last_io_time = cpu_get_time_fast();\n+\n+#endif\n+\n+ return val;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint32_t cpu_inl(CPUState *env, pio_addr_t addr)\n\n{\n\n uint32_t val;\n\n val = ioport_read(2, addr);\n\n LOG_IOPORT(\"inl : %04\"FMT_pioaddr\" %08\"PRIx32\"\\n\", addr, val);\n\n#ifdef CONFIG_KQEMU\n\n if (env)\n\n env->last_io_time = cpu_get_time_fast();\n\n#endif\n\n return val;\n\n}\n"}} {"sample_id": "6a2a5aae02b9a0b53807b9ad91f15cd4988781f9_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static inline uint32_t get_hwc_address(SM501State *state, int crt)\n+\n {\n \n uint32_t addr = crt ? state->dc_crt_hwc_addr : state->dc_panel_hwc_addr;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline uint32_t get_hwc_address(SM501State *state, int crt)\n\n{\n\n uint32_t addr = crt ? state->dc_crt_hwc_addr : state->dc_panel_hwc_addr;\n\n return (addr & 0x03FFFFF0)/* >> 4*/;\n\n}\n"}} {"sample_id": "11b7b07f8a15879134a54e73fade98d5e11e04f8_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n char *pr;\n \n+\n \n qdist_init(&dist);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void test_none(void)\n\n{\n\n struct qdist dist;\n\n char *pr;\n\n\n\n qdist_init(&dist);\n\n\n\n g_assert(isnan(qdist_avg(&dist)));\n\n g_assert(isnan(qdist_xmin(&dist)));\n\n g_assert(isnan(qdist_xmax(&dist)));\n\n\n\n pr = qdist_pr_plain(&dist, 0);\n\n g_assert(pr == NULL);\n\n\n\n pr = qdist_pr_plain(&dist, 2);\n\n g_assert(pr == NULL);\n\n\n\n qdist_destroy(&dist);\n\n}\n"}} {"sample_id": "39ae2474e337247e5930e8be783b689adc9f6215", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n+static uint32_t arm_v7m_load_vector(ARMCPU *cpu)\n+\n+\n+\n+{\n+\n+ CPUState *cs = CPU(cpu);\n+\n+ CPUARMState *env = &cpu->env;\n \n+ MemTxResult result;\n \n hwaddr vec = env->v7m.vecbase + env->v7m.exception * 4;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint32_t arm_v7m_load_vector(ARMCPU *cpu)\n\n\n\n{\n\n CPUState *cs = CPU(cpu);\n\n CPUARMState *env = &cpu->env;\n\n MemTxResult result;\n\n hwaddr vec = env->v7m.vecbase + env->v7m.exception * 4;\n\n uint32_t addr;\n\n\n\n addr = address_space_ldl(cs->as, vec,\n\n MEMTXATTRS_UNSPECIFIED, &result);\n\n if (result != MEMTX_OK) {\n\n /* Architecturally this should cause a HardFault setting HSFR.VECTTBL,\n\n * which would then be immediately followed by our failing to load\n\n * the entry vector for that HardFault, which is a Lockup case.\n\n * Since we don't model Lockup, we just report this guest error\n\n * via cpu_abort().\n\n */\n\n cpu_abort(cs, \"Failed to read from exception vector table \"\n\n \"entry %08x\\n\", (unsigned)vec);\n\n }\n\n return addr;\n\n}\n"}} {"sample_id": "00e2ceae6c55bef40f5128a3e606f5c44351e0f9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+ObjectClass *object_class_dynamic_cast(ObjectClass *class,\n+\n+ const char *typename)\n+\n+{\n \n TypeImpl *target_type = type_get_by_name(typename);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "ObjectClass *object_class_dynamic_cast(ObjectClass *class,\n\n const char *typename)\n\n{\n\n TypeImpl *target_type = type_get_by_name(typename);\n\n TypeImpl *type = class->type;\n\n ObjectClass *ret = NULL;\n\n\n\n if (type->num_interfaces && type_is_ancestor(target_type, type_interface)) {\n\n int found = 0;\n\n GSList *i;\n\n\n\n for (i = class->interfaces; i; i = i->next) {\n\n ObjectClass *target_class = i->data;\n\n\n\n if (type_is_ancestor(target_class->type, target_type)) {\n\n ret = target_class;\n\n found++;\n\n }\n\n }\n\n\n\n /* The match was ambiguous, don't allow a cast */\n\n if (found > 1) {\n\n ret = NULL;\n\n }\n\n } else if (type_is_ancestor(type, target_type)) {\n\n ret = class;\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "d6604b29ef544793479d7fb4e05ef6622bb3e534_43", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n avctx->coded_frame->pict_type = AV_PICTURE_TYPE_I;\n \n+ avctx->coded_frame->key_frame = 1;\n+\n+ avctx->bits_per_coded_sample = av_get_bits_per_pixel(desc);\n+\n+ if(!avctx->codec_tag)\n \n avctx->codec_tag = avcodec_pix_fmt_to_codec_tag(avctx->pix_fmt);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int raw_encode_init(AVCodecContext *avctx)\n\n{\n\n const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(avctx->pix_fmt);\n\n\n\n avctx->coded_frame = av_frame_alloc();\n\n if (!avctx->coded_frame)\n\n return AVERROR(ENOMEM);\n\n\n\n avctx->coded_frame->pict_type = AV_PICTURE_TYPE_I;\n\n avctx->coded_frame->key_frame = 1;\n\n avctx->bits_per_coded_sample = av_get_bits_per_pixel(desc);\n\n if(!avctx->codec_tag)\n\n avctx->codec_tag = avcodec_pix_fmt_to_codec_tag(avctx->pix_fmt);\n\n return 0;\n\n}\n"}} {"sample_id": "1f51470d044852592922f91000e741c381582cdc_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n+static int qemu_chr_open_file_out(QemuOpts *opts, CharDriverState **_chr)\n \n {\n+\n+ int fd_out;\n \n+\n+\n TFR(fd_out = qemu_open(qemu_opt_get(opts, \"path\"),\n \n O_WRONLY | O_TRUNC | O_CREAT | O_BINARY, 0666));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int qemu_chr_open_file_out(QemuOpts *opts, CharDriverState **_chr)\n\n{\n\n int fd_out;\n\n\n\n TFR(fd_out = qemu_open(qemu_opt_get(opts, \"path\"),\n\n O_WRONLY | O_TRUNC | O_CREAT | O_BINARY, 0666));\n\n if (fd_out < 0) {\n\n return -errno;\n\n }\n\n\n\n *_chr = qemu_chr_open_fd(-1, fd_out);\n\n return 0;\n\n}\n"}} {"sample_id": "e3f5ec2b5e92706e3b807059f79b1fb5d936e567_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,8 +30,8 @@\n \n \treturn 0;\n \n+ }\n+\n+ return 1;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int net_rx_ok(void *opaque)\n\n{\n\n struct XenNetDev *netdev = opaque;\n\n RING_IDX rc, rp;\n\n\n\n if (netdev->xendev.be_state != XenbusStateConnected)\n\n\treturn 0;\n\n\n\n rc = netdev->rx_ring.req_cons;\n\n rp = netdev->rx_ring.sring->req_prod;\n\n xen_rmb();\n\n\n\n if (rc == rp || RING_REQUEST_CONS_OVERFLOW(&netdev->rx_ring, rc)) {\n\n\txen_be_printf(&netdev->xendev, 2, \"%s: no rx buffers (%d/%d)\\n\",\n\n\t\t __FUNCTION__, rc, rp);\n\n\treturn 0;\n\n }\n\n return 1;\n\n}\n"}} {"sample_id": "3b199d29cd597a3518136d78860e172060b9e83d_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static av_cold int cinvideo_decode_init(AVCodecContext *avctx)\n \n {\n+\n+ CinVideoContext *cin = avctx->priv_data;\n+\n+ unsigned int i;\n+\n \n \n cin->avctx = avctx;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int cinvideo_decode_init(AVCodecContext *avctx)\n\n{\n\n CinVideoContext *cin = avctx->priv_data;\n\n unsigned int i;\n\n\n\n cin->avctx = avctx;\n\n avctx->pix_fmt = AV_PIX_FMT_PAL8;\n\n\n\n cin->frame.data[0] = NULL;\n\n\n\n cin->bitmap_size = avctx->width * avctx->height;\n\n for (i = 0; i < 3; ++i) {\n\n cin->bitmap_table[i] = av_mallocz(cin->bitmap_size);\n\n if (!cin->bitmap_table[i])\n\n av_log(avctx, AV_LOG_ERROR, \"Can't allocate bitmap buffers.\\n\");\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "7d8abfcb50a33aed369bbd267852cf04009c49e9_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n \tif (ret < 0) {\n \n \t\tprintf(\"aio_write failed: %s\\n\", strerror(-ret));\n+\n+\t\treturn;\n+\n+\t}\n+\n \n \n \tif (ctx->qflag) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "aio_write_done(void *opaque, int ret)\n\n{\n\n\tstruct aio_ctx *ctx = opaque;\n\n\tstruct timeval t2;\n\n\n\n\tgettimeofday(&t2, NULL);\n\n\n\n\n\n\tif (ret < 0) {\n\n\t\tprintf(\"aio_write failed: %s\\n\", strerror(-ret));\n\n\t\treturn;\n\n\t}\n\n\n\n\tif (ctx->qflag) {\n\n\t\treturn;\n\n\t}\n\n\n\n\t/* Finally, report back -- -C gives a parsable format */\n\n\tt2 = tsub(t2, ctx->t1);\n\n\tprint_report(\"wrote\", &t2, ctx->offset, ctx->qiov.size,\n\n\t\t ctx->qiov.size, 1, ctx->Cflag);\n\n\n\n\tqemu_io_free(ctx->buf);\n\n\tfree(ctx);\n\n}\n"}} {"sample_id": "b946a1533209f61a93e34898aebb5b43154b99c3_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n s = qemu_mallocz(sizeof(NE2000State));\n \n \n+\n register_ioport_write(base, 16, 1, ne2000_ioport_write, s);\n \n register_ioport_read(base, 16, 1, ne2000_ioport_read, s);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void isa_ne2000_init(int base, qemu_irq irq, NICInfo *nd)\n\n{\n\n NE2000State *s;\n\n\n\n qemu_check_nic_model(nd, \"ne2k_isa\");\n\n\n\n s = qemu_mallocz(sizeof(NE2000State));\n\n\n\n register_ioport_write(base, 16, 1, ne2000_ioport_write, s);\n\n register_ioport_read(base, 16, 1, ne2000_ioport_read, s);\n\n\n\n register_ioport_write(base + 0x10, 1, 1, ne2000_asic_ioport_write, s);\n\n register_ioport_read(base + 0x10, 1, 1, ne2000_asic_ioport_read, s);\n\n register_ioport_write(base + 0x10, 2, 2, ne2000_asic_ioport_write, s);\n\n register_ioport_read(base + 0x10, 2, 2, ne2000_asic_ioport_read, s);\n\n\n\n register_ioport_write(base + 0x1f, 1, 1, ne2000_reset_ioport_write, s);\n\n register_ioport_read(base + 0x1f, 1, 1, ne2000_reset_ioport_read, s);\n\n s->irq = irq;\n\n memcpy(s->macaddr, nd->macaddr, 6);\n\n\n\n ne2000_reset(s);\n\n\n\n s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,\n\n ne2000_receive, ne2000_can_receive, s);\n\n\n\n qemu_format_nic_info_str(s->vc, s->macaddr);\n\n\n\n register_savevm(\"ne2000\", -1, 2, ne2000_save, ne2000_load, s);\n\n}\n"}} {"sample_id": "f4658285f99473367dbbc34ce6970ec4637c2388_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n return -EACCES;\n if (bdrv_check_request(bs, sector_num, nb_sectors)) {\n return -EIO;\n+ /* throttling disk write I/O */\n+ if (bs->io_limits_enabled) {\n+ bdrv_io_limits_intercept(bs, true, nb_sectors);\n+ tracked_request_begin(&req, bs, sector_num, nb_sectors, true);\n+ ret = drv->bdrv_co_writev(bs, sector_num, nb_sectors, qiov);\n if (bs->dirty_bitmap) {\n set_dirty_bitmap(bs, sector_num, nb_sectors, 1);\n if (bs->wr_highest_sector < sector_num + nb_sectors - 1) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int coroutine_fn bdrv_co_do_writev(BlockDriverState *bs,\n int64_t sector_num, int nb_sectors, QEMUIOVector *qiov)\n{\n BlockDriver *drv = bs->drv;\n BdrvTrackedRequest req;\n int ret;\n if (!bs->drv) {\n return -ENOMEDIUM;\n if (bs->read_only) {\n return -EACCES;\n if (bdrv_check_request(bs, sector_num, nb_sectors)) {\n return -EIO;\n /* throttling disk write I/O */\n if (bs->io_limits_enabled) {\n bdrv_io_limits_intercept(bs, true, nb_sectors);\n tracked_request_begin(&req, bs, sector_num, nb_sectors, true);\n ret = drv->bdrv_co_writev(bs, sector_num, nb_sectors, qiov);\n if (bs->dirty_bitmap) {\n set_dirty_bitmap(bs, sector_num, nb_sectors, 1);\n if (bs->wr_highest_sector < sector_num + nb_sectors - 1) {\n bs->wr_highest_sector = sector_num + nb_sectors - 1;\n tracked_request_end(&req);\n return ret;"}} {"sample_id": "c11d3634b07b4aa71f75478aa1bcb63b0c22e030", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,12 +3,12 @@\n const char *in, int x1, int y1, int x2, int y2)\n \n {\n+\n+ if (x1 >= 0 && y1 >= 0) {\n \n /* XXX: here we rescale coordinate assuming they are in DVD resolution\n+\n+ * (720x480) since we don't have anything better */\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void srt_to_ass(AVCodecContext *avctx, AVBPrint *dst,\n\n const char *in, int x1, int y1, int x2, int y2)\n\n{\n\n if (x1 >= 0 && y1 >= 0) {\n\n /* XXX: here we rescale coordinate assuming they are in DVD resolution\n\n * (720x480) since we don't have anything better */\n\n\n\n if (x2 >= 0 && y2 >= 0 && (x2 != x1 || y2 != y1) && x2 >= x1 && y2 >= y1) {\n\n /* text rectangle defined, write the text at the center of the rectangle */\n\n const int cx = x1 + (x2 - x1)/2;\n\n const int cy = y1 + (y2 - y1)/2;\n\n const int scaled_x = cx * ASS_DEFAULT_PLAYRESX / 720;\n\n const int scaled_y = cy * ASS_DEFAULT_PLAYRESY / 480;\n\n av_bprintf(dst, \"{\\\\an5}{\\\\pos(%d,%d)}\", scaled_x, scaled_y);\n\n } else {\n\n /* only the top left corner, assume the text starts in that corner */\n\n const int scaled_x = x1 * ASS_DEFAULT_PLAYRESX / 720;\n\n const int scaled_y = y1 * ASS_DEFAULT_PLAYRESY / 480;\n\n av_bprintf(dst, \"{\\\\an1}{\\\\pos(%d,%d)}\", scaled_x, scaled_y);\n\n }\n\n }\n\n\n\n ff_htmlmarkup_to_ass(avctx, dst, in);\n\n}\n"}} {"sample_id": "13b6729361d45b9f308d731dd6b82dac01428dc3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,12 +9,12 @@\n unsigned short int work[50];\n \n short *ptr = work;\n+\n \n \n memcpy(work, statbuf,20);\n \n+ memcpy(work + 10, i2, len * 2);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void final(const short *i1, const short *i2,\n\n void *out, int *statbuf, int len)\n\n{\n\n int x, i;\n\n unsigned short int work[50];\n\n short *ptr = work;\n\n\n\n memcpy(work, statbuf,20);\n\n memcpy(work + 10, i2, len * 2);\n\n\n\n for (i=0; i>= 12;\n\n\n\n if (ptr[10] - sum < -32768 || ptr[10] - sum > 32767) {\n\n memset(out, 0, len * 2);\n\n memset(statbuf, 0, 20);\n\n return;\n\n }\n\n\n\n ptr[10] -= sum;\n\n ptr++;\n\n }\n\n\n\n memcpy(out, work+10, len * 2);\n\n memcpy(statbuf, work + 40, 20);\n\n}\n"}} {"sample_id": "42a268c241183877192c376d03bd9b6d527407c7_47", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void gen_loop(DisasContext *ctx, int r1, int32_t offset)\n \n {\n+\n+ int l1;\n+\n+ l1 = gen_new_label();\n+\n \n \n tcg_gen_subi_tl(cpu_gpr_a[r1], cpu_gpr_a[r1], 1);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gen_loop(DisasContext *ctx, int r1, int32_t offset)\n\n{\n\n int l1;\n\n l1 = gen_new_label();\n\n\n\n tcg_gen_subi_tl(cpu_gpr_a[r1], cpu_gpr_a[r1], 1);\n\n tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_gpr_a[r1], -1, l1);\n\n gen_goto_tb(ctx, 1, ctx->pc + offset);\n\n gen_set_label(l1);\n\n gen_goto_tb(ctx, 0, ctx->next_pc);\n\n}\n"}} {"sample_id": "0e8b68a2c4031e25082603ad88711be12210d41f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,10 +10,10 @@\n \n return (int64_t)ts.tv_sec * 1000000 + ts.tv_nsec / 1000;\n \n+#else\n+\n+ return av_gettime() + 42 * 60 * 60 * INT64_C(1000000);\n+\n #endif\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int64_t av_gettime_relative(void)\n\n{\n\n#if HAVE_CLOCK_GETTIME && defined(CLOCK_MONOTONIC)\n\n struct timespec ts;\n\n clock_gettime(CLOCK_MONOTONIC, &ts);\n\n return (int64_t)ts.tv_sec * 1000000 + ts.tv_nsec / 1000;\n\n#else\n\n return av_gettime() + 42 * 60 * 60 * INT64_C(1000000);\n\n#endif\n\n}\n"}} {"sample_id": "a89f364ae8740dfc31b321eed9ee454e996dc3c1_27", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n uint16_t cid = le16_to_cpu(frame->cid);\n \n uint16_t len = le16_to_cpu(frame->len);\n+\n+\n+\n+ if (unlikely(cid >= L2CAP_CID_MAX || !l2cap->cid[cid])) {\n+\n fprintf(stderr, \"%s: frame addressed to a non-existent L2CAP \"\n \n \"channel %04x received.\\n\", __FUNCTION__, cid);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void l2cap_frame_in(struct l2cap_instance_s *l2cap,\n\n const l2cap_hdr *frame)\n\n{\n\n uint16_t cid = le16_to_cpu(frame->cid);\n\n uint16_t len = le16_to_cpu(frame->len);\n\n\n\n if (unlikely(cid >= L2CAP_CID_MAX || !l2cap->cid[cid])) {\n\n fprintf(stderr, \"%s: frame addressed to a non-existent L2CAP \"\n\n \"channel %04x received.\\n\", __FUNCTION__, cid);\n\n return;\n\n }\n\n\n\n l2cap->cid[cid]->frame_in(l2cap->cid[cid], cid, frame, len);\n\n}\n"}} {"sample_id": "f65ed4c1529f29a7d62d6733eaa50bed24a4b2ed", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n e1000_mmio_map(PCIDevice *pci_dev, int region_num,\n+ uint32_t addr, uint32_t size, int type)\n {\n E1000State *d = (E1000State *)pci_dev;\n DBGOUT(MMIO, \"e1000_mmio_map addr=0x%08x 0x%08x\\n\", addr, size);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "e1000_mmio_map(PCIDevice *pci_dev, int region_num,\n uint32_t addr, uint32_t size, int type)\n{\n E1000State *d = (E1000State *)pci_dev;\n DBGOUT(MMIO, \"e1000_mmio_map addr=0x%08x 0x%08x\\n\", addr, size);\n cpu_register_physical_memory(addr, PNPMMIO_SIZE, d->mmio_index);\n}"}} {"sample_id": "505597e4476a6bc219d0ec1362b760d71cb4fdca", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n BusState *bus = opaque;\n \n DeviceState *qdev, *next;\n+\n PCIDevice *dev;\n \n int slot = ffs(val) - 1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void pciej_write(void *opaque, uint32_t addr, uint32_t val)\n\n{\n\n BusState *bus = opaque;\n\n DeviceState *qdev, *next;\n\n PCIDevice *dev;\n\n int slot = ffs(val) - 1;\n\n\n\n QLIST_FOREACH_SAFE(qdev, &bus->children, sibling, next) {\n\n dev = DO_UPCAST(PCIDevice, qdev, qdev);\n\n if (PCI_SLOT(dev->devfn) == slot) {\n\n qdev_free(qdev);\n\n }\n\n }\n\n\n\n\n\n PIIX4_DPRINTF(\"pciej write %x <== %d\\n\", addr, val);\n\n}\n"}} {"sample_id": "5e39d89d20b17cf6fb7f09d181d34f17b2ae2160", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ *resp = qmp(\"{ 'execute': 'query-cpus' }\");\n \n g_assert(*resp);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-89", "target_file": "source.c", "files": {"source.c": "static QList *get_cpus(QDict **resp)\n\n{\n\n *resp = qmp(\"{ 'execute': 'query-cpus' }\");\n\n g_assert(*resp);\n\n g_assert(qdict_haskey(*resp, \"return\"));\n\n return qdict_get_qlist(*resp, \"return\");\n\n}\n"}} {"sample_id": "d83c951cce14dd3c7600c386d3791c4993744622_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n break;\n \n case 1:\n+\n+ xfer = buf[3];\n+\n+ break;\n+\n case 2:\n \n xfer = buf[4];", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int ata_passthrough_12_xfer_size(SCSIDevice *dev, uint8_t *buf)\n\n{\n\n int length = buf[2] & 0x3;\n\n int xfer;\n\n int unit = ata_passthrough_xfer_unit(dev, buf);\n\n\n\n switch (length) {\n\n case 0:\n\n case 3: /* USB-specific. */\n\n\n xfer = 0;\n\n break;\n\n case 1:\n\n xfer = buf[3];\n\n break;\n\n case 2:\n\n xfer = buf[4];\n\n break;\n\n }\n\n\n\n return xfer * unit;\n\n}"}} {"sample_id": "445a02b1ec5ea94d28ea2503a3ae0272fcff0e12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,8 +11,8 @@\n memcmp(p, ff_asf_header, sizeof(ff_asf_guid))) {\n \n return -1;\n+\n+ }\n \n p += sizeof(ff_asf_guid) + 14;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int rtp_asf_fix_header(uint8_t *buf, int len)\n\n{\n\n uint8_t *p = buf, *end = buf + len;\n\n\n\n if (len < sizeof(ff_asf_guid) * 2 + 22 ||\n\n memcmp(p, ff_asf_header, sizeof(ff_asf_guid))) {\n\n return -1;\n\n }\n\n p += sizeof(ff_asf_guid) + 14;\n\n do {\n\n uint64_t chunksize = AV_RL64(p + sizeof(ff_asf_guid));\n\n if (memcmp(p, ff_asf_file_header, sizeof(ff_asf_guid))) {\n\n if (chunksize > end - p)\n\n return -1;\n\n p += chunksize;\n\n continue;\n\n }\n\n\n\n /* skip most of the file header, to min_pktsize */\n\n p += 6 * 8 + 3 * 4 + sizeof(ff_asf_guid) * 2;\n\n if (p + 8 <= end && AV_RL32(p) == AV_RL32(p + 4)) {\n\n /* and set that to zero */\n\n AV_WL32(p, 0);\n\n return 0;\n\n }\n\n break;\n\n } while (end - p >= sizeof(ff_asf_guid) + 8);\n\n\n\n return -1;\n\n}\n"}} {"sample_id": "1ea879e5580f63414693655fcf0328559cdce138_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void mixeng_clear (st_sample_t *buf, int len)\n \n+{\n \n memset (buf, 0, len * sizeof (st_sample_t));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void mixeng_clear (st_sample_t *buf, int len)\n\n{\n\n memset (buf, 0, len * sizeof (st_sample_t));\n\n}\n"}} {"sample_id": "07e2863d0271ac6c05206d8ce9e4f4c39b25d3ea", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n wp->vaddr = addr;\n \n wp->len = len;\n+\n+ wp->flags = flags;\n+\n+\n+\n /* keep all GDB-injected watchpoints in front */\n \n if (flags & BP_GDB) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int cpu_watchpoint_insert(CPUState *cpu, vaddr addr, vaddr len,\n\n int flags, CPUWatchpoint **watchpoint)\n\n{\n\n CPUWatchpoint *wp;\n\n\n\n /* forbid ranges which are empty or run off the end of the address space */\n\n if (len == 0 || (addr + len - 1) <= addr) {\n\n error_report(\"tried to set invalid watchpoint at %\"\n\n VADDR_PRIx \", len=%\" VADDR_PRIu, addr, len);\n\n return -EINVAL;\n\n }\n\n wp = g_malloc(sizeof(*wp));\n\n\n\n wp->vaddr = addr;\n\n wp->len = len;\n\n wp->flags = flags;\n\n\n\n /* keep all GDB-injected watchpoints in front */\n\n if (flags & BP_GDB) {\n\n QTAILQ_INSERT_HEAD(&cpu->watchpoints, wp, entry);\n\n } else {\n\n QTAILQ_INSERT_TAIL(&cpu->watchpoints, wp, entry);\n\n }\n\n\n\n tlb_flush_page(cpu, addr);\n\n\n\n if (watchpoint)\n\n *watchpoint = wp;\n\n return 0;\n\n}\n"}} {"sample_id": "1918057c8a3bc37c27e476d16736fe8bc76afd34", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void spatial_compose53i(IDWTELEM *buffer, int width, int height, int stride){\n \n dwt_compose_t cs;\n+\n+ spatial_compose53i_init(&cs, buffer, height, stride);\n \n while(cs.y <= height)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void spatial_compose53i(IDWTELEM *buffer, int width, int height, int stride){\n\n dwt_compose_t cs;\n\n spatial_compose53i_init(&cs, buffer, height, stride);\n\n while(cs.y <= height)\n\n spatial_compose53i_dy(&cs, buffer, width, height, stride);\n\n}\n"}} {"sample_id": "4cae9c97967a0e6311858285a30c44208210b277", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ lhs->selector = rhs->selector;\n \n lhs->base = rhs->base;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void get_seg(SegmentCache *lhs, const struct kvm_segment *rhs)\n\n{\n\n lhs->selector = rhs->selector;\n\n lhs->base = rhs->base;\n\n lhs->limit = rhs->limit;\n\n lhs->flags = (rhs->type << DESC_TYPE_SHIFT) |\n\n (rhs->present * DESC_P_MASK) |\n\n (rhs->dpl << DESC_DPL_SHIFT) |\n\n (rhs->db << DESC_B_SHIFT) |\n\n (rhs->s * DESC_S_MASK) |\n\n (rhs->l << DESC_L_SHIFT) |\n\n (rhs->g * DESC_G_MASK) |\n\n (rhs->avl * DESC_AVL_MASK);\n\n}\n"}} {"sample_id": "a28cccf6d62dc770757491510c248ed632a836ce", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+static void IMLT(float *pInput, float *pOutput, int odd_band)\n \n {\n \n int i;\n \n+\n \n if (odd_band) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void IMLT(float *pInput, float *pOutput, int odd_band)\n\n{\n\n int i;\n\n\n\n if (odd_band) {\n\n /**\n\n * Reverse the odd bands before IMDCT, this is an effect of the QMF transform\n\n * or it gives better compression to do it this way.\n\n * FIXME: It should be possible to handle this in ff_imdct_calc\n\n * for that to happen a modification of the prerotation step of\n\n * all SIMD code and C code is needed.\n\n * Or fix the functions before so they generate a pre reversed spectrum.\n\n */\n\n\n\n for (i=0; i<128; i++)\n\n FFSWAP(float, pInput[i], pInput[255-i]);\n\n }\n\n\n\n ff_imdct_calc(&mdct_ctx,pOutput,pInput);\n\n\n\n /* Perform windowing on the output. */\n\n dsp.vector_fmul(pOutput,mdct_window,512);\n\n\n\n}\n"}} {"sample_id": "3e305e4a4752f70c0b5c3cf5b43ec957881714f7_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n+static ssize_t vnc_tls_pull(gnutls_transport_ptr_t transport,\n+\n+ void *data,\n+\n+ size_t len) {\n+\n+ VncState *vs = (VncState *)transport;\n \n+ int ret;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static ssize_t vnc_tls_pull(gnutls_transport_ptr_t transport,\n\n void *data,\n\n size_t len) {\n\n VncState *vs = (VncState *)transport;\n\n int ret;\n\n\n\n retry:\n\n ret = qemu_recv(vs->csock, data, len, 0);\n\n if (ret < 0) {\n\n if (errno == EINTR)\n\n goto retry;\n\n return -1;\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "7bbc124e7e8fb544288ccd1f5185643a7d0554b8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n #ifndef CONFIG_USER_ONLY\n \n+ cpu_remove_sync(CPU(dev));\n+\n+ qemu_unregister_reset(x86_cpu_machine_reset_cb, dev);\n+\n+#endif\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void x86_cpu_unrealizefn(DeviceState *dev, Error **errp)\n\n{\n\n X86CPU *cpu = X86_CPU(dev);\n\n\n\n\n\n#ifndef CONFIG_USER_ONLY\n\n cpu_remove_sync(CPU(dev));\n\n qemu_unregister_reset(x86_cpu_machine_reset_cb, dev);\n\n#endif\n\n\n\n if (cpu->apic_state) {\n\n object_unparent(OBJECT(cpu->apic_state));\n\n cpu->apic_state = NULL;\n\n }\n\n\n\n xcc->parent_unrealize(dev, &local_err);\n\n if (local_err != NULL) {\n\n error_propagate(errp, local_err);\n\n return;\n\n }\n\n}"}} {"sample_id": "83d768b5640946b7da55ce8335509df297e2c7cd_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+void virtio_scsi_dataplane_notify(VirtIODevice *vdev, VirtIOSCSIReq *req)\n+\n+{\n \n if (virtio_should_notify(vdev, req->vq)) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void virtio_scsi_dataplane_notify(VirtIODevice *vdev, VirtIOSCSIReq *req)\n\n{\n\n if (virtio_should_notify(vdev, req->vq)) {\n\n event_notifier_set(virtio_queue_get_guest_notifier(req->vq));\n\n }\n\n}\n"}} {"sample_id": "caa881abe0e01f9931125a0977ec33c5343e4aa7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int pxa2xx_ssp_load(QEMUFile *f, void *opaque, int version_id)\n \n+{\n \n PXA2xxSSPState *s = (PXA2xxSSPState *) opaque;\n \n@@ -11,7 +11,7 @@\n s->enable = qemu_get_be32(f);\n \n \n+\n qemu_get_be32s(f, &s->sscr[0]);\n \n qemu_get_be32s(f, &s->sscr[1]);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int pxa2xx_ssp_load(QEMUFile *f, void *opaque, int version_id)\n\n{\n\n PXA2xxSSPState *s = (PXA2xxSSPState *) opaque;\n\n int i;\n\n\n\n s->enable = qemu_get_be32(f);\n\n\n\n qemu_get_be32s(f, &s->sscr[0]);\n\n qemu_get_be32s(f, &s->sscr[1]);\n\n qemu_get_be32s(f, &s->sspsp);\n\n qemu_get_be32s(f, &s->ssto);\n\n qemu_get_be32s(f, &s->ssitr);\n\n qemu_get_be32s(f, &s->sssr);\n\n qemu_get_8s(f, &s->sstsa);\n\n qemu_get_8s(f, &s->ssrsa);\n\n qemu_get_8s(f, &s->ssacd);\n\n\n\n s->rx_level = qemu_get_byte(f);\n\n s->rx_start = 0;\n\n for (i = 0; i < s->rx_level; i ++)\n\n s->rx_fifo[i] = qemu_get_byte(f);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "efec3dd631d94160288392721a5f9c39e50fb2bc_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);\n \n DeviceClass *dc = DEVICE_CLASS(klass);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void pci_grackle_class_init(ObjectClass *klass, void *data)\n\n{\n\n SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n\n\n k->init = pci_grackle_init_device;\n\n dc->no_user = 1;\n\n}\n"}} {"sample_id": "7e7e59409294af9caa63808e56c5cc824c98b4fc_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n case PIX_FMT_RGB565:\n \n case PIX_FMT_RGB555:\n+\n+ bits = 16;\n+\n+ break;\n+\n case PIX_FMT_PAL8:\n \n bits = 8;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int avg_bits_per_pixel(int pix_fmt)\n\n{\n\n int bits;\n\n const PixFmtInfo *pf;\n\n\n\n pf = &pix_fmt_info[pix_fmt];\n\n if (pf->is_packed) {\n\n switch(pix_fmt) {\n\n case PIX_FMT_RGB24:\n\n case PIX_FMT_BGR24:\n\n bits = 24;\n\n break;\n\n case PIX_FMT_RGBA32:\n\n bits = 32;\n\n break;\n\n case PIX_FMT_RGB565:\n\n case PIX_FMT_RGB555:\n\n bits = 16;\n\n break;\n\n case PIX_FMT_PAL8:\n\n bits = 8;\n\n break;\n\n default:\n\n bits = 32;\n\n break;\n\n }\n\n } else {\n\n bits = pf->depth;\n\n bits += (2 * pf->depth >> \n\n (pf->x_chroma_shift + pf->x_chroma_shift));\n\n }\n\n return bits;\n\n}\n"}} {"sample_id": "7f595609b49615b07c50b7182c4ef125c39cb5da", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n uc->product_desc = \"QEMU USB Mouse\";\n \n+ uc->usb_desc = &desc_mouse;\n+\n+ uc->handle_packet = usb_generic_handle_packet;\n+\n+ uc->handle_reset = usb_hid_handle_reset;\n \n uc->handle_control = usb_hid_handle_control;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void usb_mouse_class_initfn(ObjectClass *klass, void *data)\n\n{\n\n USBDeviceClass *uc = USB_DEVICE_CLASS(klass);\n\n\n\n uc->init = usb_mouse_initfn;\n\n uc->product_desc = \"QEMU USB Mouse\";\n\n uc->usb_desc = &desc_mouse;\n\n uc->handle_packet = usb_generic_handle_packet;\n\n uc->handle_reset = usb_hid_handle_reset;\n\n uc->handle_control = usb_hid_handle_control;\n\n uc->handle_data = usb_hid_handle_data;\n\n uc->handle_destroy = usb_hid_handle_destroy;\n\n}\n"}} {"sample_id": "326b1ed93e25f2b2d505ee88325fabb190d8c275", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ enum AVPixelFormat pix_fmts[] = {\n+\n+ AV_PIX_FMT_VAAPI, AV_PIX_FMT_NONE,\n+\n+ };\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int scale_vaapi_query_formats(AVFilterContext *avctx)\n\n{\n\n enum AVPixelFormat pix_fmts[] = {\n\n AV_PIX_FMT_VAAPI, AV_PIX_FMT_NONE,\n\n };\n\n\n\n ff_formats_ref(ff_make_format_list(pix_fmts),\n\n &avctx->inputs[0]->out_formats);\n\n ff_formats_ref(ff_make_format_list(pix_fmts),\n\n &avctx->outputs[0]->in_formats);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a818a4b69d47ca3826dee36878074395aeac2083_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n sc->init = scsi_hd_initfn;\n \n sc->destroy = scsi_destroy;\n+\n+ sc->alloc_req = scsi_new_request;\n+\n+ sc->unit_attention_reported = scsi_disk_unit_attention_reported;\n+\n dc->fw_name = \"disk\";\n \n dc->desc = \"virtual SCSI disk\";", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void scsi_hd_class_initfn(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);\n\n\n\n sc->init = scsi_hd_initfn;\n\n sc->destroy = scsi_destroy;\n\n sc->alloc_req = scsi_new_request;\n\n sc->unit_attention_reported = scsi_disk_unit_attention_reported;\n\n dc->fw_name = \"disk\";\n\n dc->desc = \"virtual SCSI disk\";\n\n dc->reset = scsi_disk_reset;\n\n dc->props = scsi_hd_properties;\n\n dc->vmsd = &vmstate_scsi_disk_state;\n\n}\n"}} {"sample_id": "4322e8ced5aaac7191958f09622d199fe61e2d87", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static hwaddr ppc_hash64_pteg_search(PowerPCCPU *cpu, hwaddr hash,\n \n bool secondary, target_ulong ptem,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static hwaddr ppc_hash64_pteg_search(PowerPCCPU *cpu, hwaddr hash,\n\n bool secondary, target_ulong ptem,\n\n ppc_hash_pte64_t *pte)\n\n{\n\n CPUPPCState *env = &cpu->env;\n\n int i;\n\n uint64_t token;\n\n target_ulong pte0, pte1;\n\n target_ulong pte_index;\n\n\n\n pte_index = (hash & env->htab_mask) * HPTES_PER_GROUP;\n\n token = ppc_hash64_start_access(cpu, pte_index);\n\n if (!token) {\n\n return -1;\n\n }\n\n for (i = 0; i < HPTES_PER_GROUP; i++) {\n\n pte0 = ppc_hash64_load_hpte0(cpu, token, i);\n\n pte1 = ppc_hash64_load_hpte1(cpu, token, i);\n\n\n\n if ((pte0 & HPTE64_V_VALID)\n\n && (secondary == !!(pte0 & HPTE64_V_SECONDARY))\n\n && HPTE64_V_COMPARE(pte0, ptem)) {\n\n pte->pte0 = pte0;\n\n pte->pte1 = pte1;\n\n ppc_hash64_stop_access(cpu, token);\n\n return (pte_index + i) * HASH_PTE_SIZE_64;\n\n }\n\n }\n\n ppc_hash64_stop_access(cpu, token);\n\n /*\n\n * We didn't find a valid entry.\n\n */\n\n return -1;\n\n}\n"}} {"sample_id": "8af00205445eb901f17ca5b632d976065187538e_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n void *value, size_t size, int flags)\n \n {\n+\n XattrOperations *xops = get_xattr_operations(ctx->xops, name);\n \n if (xops) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "int v9fs_set_xattr(FsContext *ctx, const char *path, const char *name,\n\n void *value, size_t size, int flags)\n\n{\n\n XattrOperations *xops = get_xattr_operations(ctx->xops, name);\n\n if (xops) {\n\n return xops->setxattr(ctx, path, name, value, size, flags);\n\n }\n\n errno = -EOPNOTSUPP;\n\n return -1;\n\n\n\n}\n"}} {"sample_id": "e9f4001a30c563a840614048629055769f6f7020", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n AVIOContext *pb = s->pb;\n+\n int ret;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int wav_parse_fmt_tag(AVFormatContext *s, int64_t size, AVStream **st)\n\n{\n\n AVIOContext *pb = s->pb;\n\n int ret;\n\n\n\n /* parse fmt header */\n\n *st = av_new_stream(s, 0);\n\n if (!*st)\n\n return AVERROR(ENOMEM);\n\n\n\n ff_get_wav_header(pb, (*st)->codec, size);\n\n if (ret < 0)\n\n return ret;\n\n (*st)->need_parsing = AVSTREAM_PARSE_FULL;\n\n\n\n av_set_pts_info(*st, 64, 1, (*st)->codec->sample_rate);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "0105ed551cb9610c62b6920a301125781e1161a0_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void ff_put_h264_qpel16_mc00_msa(uint8_t *dst, const uint8_t *src,\n \n+ ptrdiff_t stride)\n+\n {\n \n copy_width16_msa(src, stride, dst, stride, 16);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_put_h264_qpel16_mc00_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n copy_width16_msa(src, stride, dst, stride, 16);\n\n}\n"}} {"sample_id": "3c895fc098f7637f6d5ec3a9d6766e724a8b9e41_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n int64_t timestamp)\n \n {\n+\n+ int frame_delay;\n+\n+ int64_t pts, dts;\n+\n \n \n if (st->codec.codec_type == CODEC_TYPE_VIDEO && ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void compute_pts_dts(AVStream *st, int64_t *ppts, int64_t *pdts, \n\n int64_t timestamp)\n\n{\n\n int frame_delay;\n\n int64_t pts, dts;\n\n\n\n if (st->codec.codec_type == CODEC_TYPE_VIDEO && \n\n st->codec.max_b_frames != 0) {\n\n frame_delay = (st->codec.frame_rate_base * 90000LL) / \n\n st->codec.frame_rate;\n\n if (timestamp == 0) {\n\n /* specific case for first frame : DTS just before */\n\n pts = timestamp;\n\n dts = timestamp - frame_delay;\n\n } else {\n\n timestamp -= frame_delay;\n\n if (st->codec.coded_frame->pict_type == FF_B_TYPE) {\n\n /* B frames has identical pts/dts */\n\n pts = timestamp;\n\n dts = timestamp;\n\n } else {\n\n /* a reference frame has a pts equal to the dts of the\n\n _next_ one */\n\n dts = timestamp;\n\n pts = timestamp + (st->codec.max_b_frames + 1) * frame_delay;\n\n }\n\n }\n\n#if 1\n\n av_log(&st->codec, AV_LOG_DEBUG, \"pts=%0.3f dts=%0.3f pict_type=%c\\n\", \n\n pts / 90000.0, dts / 90000.0, \n\n av_get_pict_type_char(st->codec.coded_frame->pict_type));\n\n#endif\n\n } else {\n\n pts = timestamp;\n\n dts = timestamp;\n\n }\n\n\n\n *ppts = pts & ((1LL << 33) - 1);\n\n *pdts = dts & ((1LL << 33) - 1);\n\n}\n"}} {"sample_id": "5cb9b56acfc0b50acf7ccd2d044ab4991c47fdde_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static int print_uint16(DeviceState *dev, Property *prop, char *dest, size_t len)\n+\n+{\n \n uint16_t *ptr = qdev_get_prop_ptr(dev, prop);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int print_uint16(DeviceState *dev, Property *prop, char *dest, size_t len)\n\n{\n\n uint16_t *ptr = qdev_get_prop_ptr(dev, prop);\n\n return snprintf(dest, len, \"%\" PRIu16, *ptr);\n\n}\n"}} {"sample_id": "3b22c4707decb706b10ce023534f8b79413ff9fe_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -63,11 +63,11 @@\n env->regs[R_ESP] = (env->regs[R_ESP] & ~0xffff) | (esp & 0xffff);\n \n env->eip = offset;\n+\n+ env->segs[R_CS].selector = selector;\n+\n+ env->segs[R_CS].base = (uint8_t *)(selector << 4);\n+\n env->eflags &= ~(IF_MASK | TF_MASK | AC_MASK | RF_MASK);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void do_interrupt_real(int intno, int is_int, int error_code,\n\n unsigned int next_eip)\n\n{\n\n SegmentCache *dt;\n\n uint8_t *ptr, *ssp;\n\n int selector;\n\n uint32_t offset, esp;\n\n uint32_t old_cs, old_eip;\n\n\n\n /* real mode (simpler !) */\n\n dt = &env->idt;\n\n if (intno * 4 + 3 > dt->limit)\n\n raise_exception_err(EXCP0D_GPF, intno * 8 + 2);\n\n ptr = dt->base + intno * 4;\n\n offset = lduw(ptr);\n\n selector = lduw(ptr + 2);\n\n esp = env->regs[R_ESP];\n\n ssp = env->segs[R_SS].base;\n\n if (is_int)\n\n old_eip = next_eip;\n\n else\n\n old_eip = env->eip;\n\n old_cs = env->segs[R_CS].selector;\n\n esp -= 2;\n\n stw(ssp + (esp & 0xffff), compute_eflags());\n\n esp -= 2;\n\n stw(ssp + (esp & 0xffff), old_cs);\n\n esp -= 2;\n\n stw(ssp + (esp & 0xffff), old_eip);\n\n \n\n /* update processor state */\n\n env->regs[R_ESP] = (env->regs[R_ESP] & ~0xffff) | (esp & 0xffff);\n\n env->eip = offset;\n\n env->segs[R_CS].selector = selector;\n\n env->segs[R_CS].base = (uint8_t *)(selector << 4);\n\n env->eflags &= ~(IF_MASK | TF_MASK | AC_MASK | RF_MASK);\n\n}\n"}} {"sample_id": "6ba5cbc699e77cae66bb719354fa142114b64eab_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,9 +21,9 @@\n return AVERROR_IO;\n \n s->dest_addr.sin_family = AF_INET;\n+\n+ s->dest_addr.sin_port = htons(port);\n+\n+ return 0;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int udp_set_remote_url(URLContext *h, const char *uri)\n\n{\n\n UDPContext *s = h->priv_data;\n\n char hostname[256];\n\n int port;\n\n \n\n url_split(NULL, 0, hostname, sizeof(hostname), &port, NULL, 0, uri);\n\n\n\n /* set the destination address */\n\n if (resolve_host(&s->dest_addr.sin_addr, hostname) < 0)\n\n return AVERROR_IO;\n\n s->dest_addr.sin_family = AF_INET;\n\n s->dest_addr.sin_port = htons(port);\n\n return 0;\n\n}\n"}} {"sample_id": "6baebed7698a37a0ac5168faf26023426b0ac940_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,8 +18,8 @@\n \n \n \n+ vs->vd = vd;\n+\n vs->ds = vd->ds;\n \n vs->timer = qemu_new_timer(rt_clock, vnc_update_client, vs);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void vnc_connect(VncDisplay *vd, int csock)\n\n{\n\n VncState *vs = qemu_mallocz(sizeof(VncState));\n\n vs->csock = csock;\n\n\n\n VNC_DEBUG(\"New client on socket %d\\n\", csock);\n\n dcl->idle = 0;\n\n socket_set_nonblock(vs->csock);\n\n qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);\n\n\n\n vs->vd = vd;\n\n vs->ds = vd->ds;\n\n vs->timer = qemu_new_timer(rt_clock, vnc_update_client, vs);\n\n vs->last_x = -1;\n\n vs->last_y = -1;\n\n\n\n vs->as.freq = 44100;\n\n vs->as.nchannels = 2;\n\n vs->as.fmt = AUD_FMT_S16;\n\n vs->as.endianness = 0;\n\n\n\n vnc_resize(vs);\n\n vnc_write(vs, \"RFB 003.008\\n\", 12);\n\n vnc_flush(vs);\n\n vnc_read_when(vs, protocol_version, 12);\n\n memset(vs->old_data, 0, ds_get_linesize(vs->ds) * ds_get_height(vs->ds));\n\n memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));\n\n vnc_update_client(vs);\n\n reset_keys(vs);\n\n\n\n vs->next = vd->clients;\n\n vd->clients = vs;\n\n}\n"}} {"sample_id": "2e6a64cb8d7506ad27d3b6c8000bc8d773936932", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n rc = read(il->fd, &event, sizeof(event));\n \n+ if (rc != sizeof(event)) {\n+\n+ if (rc < 0 && errno != EAGAIN) {\n+\n+ fprintf(stderr, \"%s: read: %s\\n\", __func__, strerror(errno));\n \n qemu_set_fd_handler(il->fd, NULL, NULL, NULL);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void input_linux_event_keyboard(void *opaque)\n\n{\n\n InputLinux *il = opaque;\n\n struct input_event event;\n\n int rc;\n\n\n\n for (;;) {\n\n rc = read(il->fd, &event, sizeof(event));\n\n if (rc != sizeof(event)) {\n\n if (rc < 0 && errno != EAGAIN) {\n\n fprintf(stderr, \"%s: read: %s\\n\", __func__, strerror(errno));\n\n qemu_set_fd_handler(il->fd, NULL, NULL, NULL);\n\n close(il->fd);\n\n }\n\n break;\n\n }\n\n\n\n input_linux_handle_keyboard(il, &event);\n\n }\n\n}\n"}} {"sample_id": "96d7073fb058e6f05257cd9041ffbbd736f6ccec", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static inline void gen_op_mov_reg_v(int ot, int reg, TCGv t0)\n+\n+{\n+\n+ switch(ot) {\n+\n case OT_BYTE:\n \n if (reg < 4 X86_64_DEF( || reg >= 8 || x86_64_hregs)) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_op_mov_reg_v(int ot, int reg, TCGv t0)\n\n{\n\n switch(ot) {\n\n case OT_BYTE:\n\n if (reg < 4 X86_64_DEF( || reg >= 8 || x86_64_hregs)) {\n\n tcg_gen_deposit_tl(cpu_regs[reg], cpu_regs[reg], t0, 0, 8);\n\n } else {\n\n tcg_gen_deposit_tl(cpu_regs[reg - 4], cpu_regs[reg - 4], t0, 8, 8);\n\n }\n\n break;\n\n case OT_WORD:\n\n tcg_gen_deposit_tl(cpu_regs[reg], cpu_regs[reg], t0, 0, 16);\n\n break;\n\n default: /* XXX this shouldn't be reached; abort? */\n\n case OT_LONG:\n\n /* For x86_64, this sets the higher half of register to zero.\n\n For i386, this is equivalent to a mov. */\n\n tcg_gen_ext32u_tl(cpu_regs[reg], t0);\n\n break;\n\n#ifdef TARGET_X86_64\n\n case OT_QUAD:\n\n tcg_gen_mov_tl(cpu_regs[reg], t0);\n\n break;\n\n#endif\n\n }\n\n}\n"}} {"sample_id": "44f110f509d0ab4fc73b9f2363a97c6577d3850f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,22 +1,22 @@\n+static void expand_rle_row(unsigned char *optr, unsigned char *iptr, \n \n int chan_offset, int pixelstride)\n \n {\n \n unsigned char pixel, count;\n+\n \n \n #ifndef WORDS_BIGENDIAN\n \n /* rgba -> bgra for rgba32 on little endian cpus */\n+\n if (pixelstride == 4 && chan_offset != 3) {\n+\n chan_offset = 2 - chan_offset;\n \n+ }\n \n #endif\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void expand_rle_row(unsigned char *optr, unsigned char *iptr, \n\n int chan_offset, int pixelstride)\n\n{\n\n unsigned char pixel, count;\n\n \n\n#ifndef WORDS_BIGENDIAN\n\n /* rgba -> bgra for rgba32 on little endian cpus */\n\n if (pixelstride == 4 && chan_offset != 3) {\n\n chan_offset = 2 - chan_offset;\n\n }\n\n#endif\n\n \n\n optr += chan_offset;\n\n\n\n while (1) {\n\n pixel = *iptr++;\n\n\n\n if (!(count = (pixel & 0x7f))) {\n\n return;\n\n }\n\n if (pixel & 0x80) {\n\n while (count--) {\n\n *optr = *iptr;\n\n optr += pixelstride;\n\n iptr++;\n\n }\n\n } else {\n\n pixel = *iptr++;\n\n\n\n while (count--) {\n\n *optr = pixel;\n\n optr += pixelstride;\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "7839ff593be03a7de3c6760e0b50c565ea751d36_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void pc_compat_1_5(QEMUMachineInitArgs *args)\n \n+{\n \n pc_compat_1_6(args);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void pc_compat_1_5(QEMUMachineInitArgs *args)\n\n{\n\n pc_compat_1_6(args);\n\n has_pvpanic = true;\n\n}\n"}} {"sample_id": "56ad3e54dad6cdcee8668d170df161d89581846f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n static ssize_t mp_user_getxattr(FsContext *ctx, const char *path,\n+\n+ const char *name, void *value, size_t size)\n \n {\n \n char *buffer;\n+\n+ ssize_t ret;\n+\n+\n \n if (strncmp(name, \"user.virtfs.\", 12) == 0) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static ssize_t mp_user_getxattr(FsContext *ctx, const char *path,\n\n const char *name, void *value, size_t size)\n\n{\n\n char *buffer;\n\n ssize_t ret;\n\n\n\n if (strncmp(name, \"user.virtfs.\", 12) == 0) {\n\n /*\n\n * Don't allow fetch of user.virtfs namesapce\n\n * in case of mapped security\n\n */\n\n errno = ENOATTR;\n\n return -1;\n\n }\n\n buffer = rpath(ctx, path);\n\n ret = lgetxattr(buffer, name, value, size);\n\n g_free(buffer);\n\n return ret;\n\n}\n"}} {"sample_id": "f51074cdc6e750daa3b6df727d83449a7e42b391_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,23 +1,23 @@\n void hmp_drive_add(Monitor *mon, const QDict *qdict)\n+\n {\n \n DriveInfo *dinfo = NULL;\n+\n const char *opts = qdict_get_str(qdict, \"opts\");\n \n+\n \n dinfo = add_init_drive(opts);\n+\n if (!dinfo) {\n+\n+ goto err;\n+\n }\n \n if (dinfo->devaddr) {\n+\n monitor_printf(mon, \"Parameter addr not supported\\n\");\n \n goto err;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void hmp_drive_add(Monitor *mon, const QDict *qdict)\n\n{\n\n DriveInfo *dinfo = NULL;\n\n const char *opts = qdict_get_str(qdict, \"opts\");\n\n\n\n dinfo = add_init_drive(opts);\n\n if (!dinfo) {\n\n goto err;\n\n }\n\n if (dinfo->devaddr) {\n\n monitor_printf(mon, \"Parameter addr not supported\\n\");\n\n goto err;\n\n }\n\n\n\n switch (dinfo->type) {\n\n case IF_NONE:\n\n monitor_printf(mon, \"OK\\n\");\n\n break;\n\n default:\n\n if (pci_drive_hot_add(mon, qdict, dinfo)) {\n\n goto err;\n\n }\n\n }\n\n return;\n\n\n\nerr:\n\n if (dinfo) {\n\n blk_unref(blk_by_legacy_dinfo(dinfo));\n\n }\n\n}\n"}} {"sample_id": "29b5f3115d9f217758bebd1d00e541aa3e739d2a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n return ret;\n \n ret = ff_inlink_make_frame_writable(fs->parent->inputs[0], f0);\n+\n+ if (ret < 0) {\n+\n+ av_frame_free(f0);\n+\n av_frame_free(f1);\n \n return ret;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int ff_framesync_dualinput_get_writable(FFFrameSync *fs, AVFrame **f0, AVFrame **f1)\n\n{\n\n int ret;\n\n\n\n ret = ff_framesync_dualinput_get(fs, f0, f1);\n\n if (ret < 0)\n\n return ret;\n\n ret = ff_inlink_make_frame_writable(fs->parent->inputs[0], f0);\n\n if (ret < 0) {\n\n av_frame_free(f0);\n\n av_frame_free(f1);\n\n return ret;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "4e27e819bea0ea6c8108dc7e9fa48afd6ec13c46", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static void visit_type_int32(Visitor *v, int *value, const char *name, Error **errp)\n+\n+{\n \n int64_t val = *value;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void visit_type_int32(Visitor *v, int *value, const char *name, Error **errp)\n\n{\n\n int64_t val = *value;\n\n visit_type_int(v, &val, name, errp);\n\n}\n"}} {"sample_id": "0d7937974cd0504f30ad483c3368b21da426ddf9_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void vmsvga_bios_write(void *opaque, uint32_t address, uint32_t data)\n \n+{\n+\n printf(\"%s: what are we supposed to do with (%08x)?\\n\",\n \n __FUNCTION__, data);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vmsvga_bios_write(void *opaque, uint32_t address, uint32_t data)\n\n{\n\n printf(\"%s: what are we supposed to do with (%08x)?\\n\",\n\n __FUNCTION__, data);\n\n}\n"}} {"sample_id": "5f758366c0710d23e43f4d0f83816b98616a13d0_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static CharDriverState *qmp_chardev_open_udp(ChardevUdp *udp,\n \n Error **errp)\n+\n {\n \n int fd;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static CharDriverState *qmp_chardev_open_udp(ChardevUdp *udp,\n\n Error **errp)\n\n{\n\n int fd;\n\n\n\n fd = socket_dgram(udp->remote, udp->local, errp);\n\n if (error_is_set(errp)) {\n\n return NULL;\n\n }\n\n return qemu_chr_open_udp_fd(fd);\n\n}\n"}} {"sample_id": "fed92adbb3fc6cbf735e3df9a2f7d0a2917fcfbd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,22 +1,22 @@\n void vp78_decode_mv_mb_modes(AVCodecContext *avctx, VP8Frame *curframe,\n \n VP8Frame *prev_frame, int is_vp7)\n+\n+{\n \n VP8Context *s = avctx->priv_data;\n \n int mb_x, mb_y;\n+\n+\n \n s->mv_min.y = -MARGIN;\n+\n+ s->mv_max.y = ((s->mb_height - 1) << 6) + MARGIN;\n+\n for (mb_y = 0; mb_y < s->mb_height; mb_y++) {\n+\n+ VP8Macroblock *mb = s->macroblocks_base +\n \n ((s->mb_width + 1) * (mb_y + 1) + 1);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void vp78_decode_mv_mb_modes(AVCodecContext *avctx, VP8Frame *curframe,\n\n VP8Frame *prev_frame, int is_vp7)\n\n{\n\n VP8Context *s = avctx->priv_data;\n\n int mb_x, mb_y;\n\n\n\n s->mv_min.y = -MARGIN;\n\n s->mv_max.y = ((s->mb_height - 1) << 6) + MARGIN;\n\n for (mb_y = 0; mb_y < s->mb_height; mb_y++) {\n\n VP8Macroblock *mb = s->macroblocks_base +\n\n ((s->mb_width + 1) * (mb_y + 1) + 1);\n\n int mb_xy = mb_y * s->mb_width;\n\n\n\n AV_WN32A(s->intra4x4_pred_mode_left, DC_PRED * 0x01010101);\n\n\n\n s->mv_min.x = -MARGIN;\n\n s->mv_max.x = ((s->mb_width - 1) << 6) + MARGIN;\n\n for (mb_x = 0; mb_x < s->mb_width; mb_x++, mb_xy++, mb++) {\n\n if (mb_y == 0)\n\n AV_WN32A((mb - s->mb_width - 1)->intra4x4_pred_mode_top,\n\n DC_PRED * 0x01010101);\n\n decode_mb_mode(s, mb, mb_x, mb_y, curframe->seg_map->data + mb_xy,\n\n prev_frame && prev_frame->seg_map ?\n\n prev_frame->seg_map->data + mb_xy : NULL, 1, is_vp7);\n\n s->mv_min.x -= 64;\n\n s->mv_max.x -= 64;\n\n }\n\n s->mv_min.y -= 64;\n\n s->mv_max.y -= 64;\n\n }\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_33", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,8 +12,8 @@\n \n \n \n+ return bdrv_check_byte_request(bs, sector_num * BDRV_SECTOR_SIZE,\n+\n+ nb_sectors * BDRV_SECTOR_SIZE);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int bdrv_check_request(BlockDriverState *bs, int64_t sector_num,\n\n int nb_sectors)\n\n{\n\n if (nb_sectors < 0 || nb_sectors > BDRV_REQUEST_MAX_SECTORS) {\n\n return -EIO;\n\n }\n\n\n\n return bdrv_check_byte_request(bs, sector_num * BDRV_SECTOR_SIZE,\n\n nb_sectors * BDRV_SECTOR_SIZE);\n\n}\n"}} {"sample_id": "2119882c7eb7e2c612b24fc0c8d86f5887d6f1c3_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n goto out;\n \n }\n+\n+ bdrv_dirty_bitmap_make_anon(bitmap);\n+\n+ bdrv_release_dirty_bitmap(bs, bitmap);\n+\n \n \n out:", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qmp_block_dirty_bitmap_remove(const char *node, const char *name,\n\n Error **errp)\n\n{\n\n AioContext *aio_context;\n\n BlockDriverState *bs;\n\n BdrvDirtyBitmap *bitmap;\n\n\n\n bitmap = block_dirty_bitmap_lookup(node, name, &bs, &aio_context, errp);\n\n if (!bitmap || !bs) {\n\n return;\n\n }\n\n\n\n if (bdrv_dirty_bitmap_frozen(bitmap)) {\n\n error_setg(errp,\n\n \"Bitmap '%s' is currently frozen and cannot be removed\",\n\n name);\n\n goto out;\n\n }\n\n bdrv_dirty_bitmap_make_anon(bitmap);\n\n bdrv_release_dirty_bitmap(bs, bitmap);\n\n\n\n out:\n\n aio_context_release(aio_context);\n\n}\n"}} {"sample_id": "ee312992a323530ea2cda8680f3a34746c72db8f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n \n \n /* send event */\n+\n+ s = qemu_input_find_handler(1 << evt->type, src);\n+\n+ if (!s) {\n+\n return;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_input_event_send(QemuConsole *src, InputEvent *evt)\n\n{\n\n QemuInputHandlerState *s;\n\n\n\n if (!runstate_is_running() && !runstate_check(RUN_STATE_SUSPENDED)) {\n\n return;\n\n }\n\n\n\n qemu_input_event_trace(src, evt);\n\n\n\n /* pre processing */\n\n if (graphic_rotate && (evt->type == INPUT_EVENT_KIND_ABS)) {\n\n qemu_input_transform_abs_rotate(evt);\n\n }\n\n\n\n /* send event */\n\n s = qemu_input_find_handler(1 << evt->type, src);\n\n if (!s) {\n\n return;\n\n }\n\n s->handler->event(s->dev, src, evt);\n\n s->events++;\n\n}\n"}} {"sample_id": "4860625236475da20d0da954017e8c7fe412dea2_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n yuv2422_2_c_template(SwsContext *c, const int16_t *buf[2],\n \n+ const int16_t *ubuf[2], const int16_t *vbuf[2],\n+\n const int16_t *abuf[2], uint8_t *dest, int dstW,\n \n int yalpha, int uvalpha, int y,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "yuv2422_2_c_template(SwsContext *c, const int16_t *buf[2],\n\n const int16_t *ubuf[2], const int16_t *vbuf[2],\n\n const int16_t *abuf[2], uint8_t *dest, int dstW,\n\n int yalpha, int uvalpha, int y,\n\n enum PixelFormat target)\n\n{\n\n const int16_t *buf0 = buf[0], *buf1 = buf[1],\n\n *ubuf0 = ubuf[0], *ubuf1 = ubuf[1],\n\n *vbuf0 = vbuf[0], *vbuf1 = vbuf[1];\n\n int yalpha1 = 4095 - yalpha;\n\n int uvalpha1 = 4095 - uvalpha;\n\n int i;\n\n\n\n for (i = 0; i < ((dstW + 1) >> 1); i++) {\n\n int Y1 = (buf0[i * 2] * yalpha1 + buf1[i * 2] * yalpha) >> 19;\n\n int Y2 = (buf0[i * 2 + 1] * yalpha1 + buf1[i * 2 + 1] * yalpha) >> 19;\n\n int U = (ubuf0[i] * uvalpha1 + ubuf1[i] * uvalpha) >> 19;\n\n int V = (vbuf0[i] * uvalpha1 + vbuf1[i] * uvalpha) >> 19;\n\n\n\n Y1 = av_clip_uint8(Y1);\n\n Y2 = av_clip_uint8(Y2);\n\n U = av_clip_uint8(U);\n\n V = av_clip_uint8(V);\n\n\n\n output_pixels(i * 4, Y1, U, Y2, V);\n\n }\n\n}\n"}} {"sample_id": "fea7d77d3ea287d3b1878648f3049fc6bb4fd57b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n relation = float32_compare(t0, t1, &env->fp_status);\n \n if (unlikely(relation == float_relation_unordered)) {\n+\n+ update_fpscr(env, GETPC());\n+\n+ } else {\n+\n env->sr_t = (relation == float_relation_greater);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void helper_fcmp_gt_FT(CPUSH4State *env, float32 t0, float32 t1)\n\n{\n\n int relation;\n\n\n\n set_float_exception_flags(0, &env->fp_status);\n\n relation = float32_compare(t0, t1, &env->fp_status);\n\n if (unlikely(relation == float_relation_unordered)) {\n\n update_fpscr(env, GETPC());\n\n } else {\n\n env->sr_t = (relation == float_relation_greater);\n\n }\n\n}\n"}} {"sample_id": "fb23162885f7fd8cf7334bed22c25ac32c7d8b9d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n devfn = pci_dev->devfn;\n \n+ pci_dev = do_pci_register_device(pci_dev, bus, base->name, devfn,\n+\n+ info->config_read, info->config_write);\n+\n+ assert(pci_dev);\n \n rc = info->init(pci_dev);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pci_qdev_init(DeviceState *qdev, DeviceInfo *base)\n\n{\n\n PCIDevice *pci_dev = (PCIDevice *)qdev;\n\n PCIDeviceInfo *info = container_of(base, PCIDeviceInfo, qdev);\n\n PCIBus *bus;\n\n int devfn, rc;\n\n\n\n /* initialize cap_present for pci_is_express() and pci_config_size() */\n\n if (info->is_express) {\n\n pci_dev->cap_present |= QEMU_PCI_CAP_EXPRESS;\n\n }\n\n\n\n bus = FROM_QBUS(PCIBus, qdev_get_parent_bus(qdev));\n\n devfn = pci_dev->devfn;\n\n pci_dev = do_pci_register_device(pci_dev, bus, base->name, devfn,\n\n info->config_read, info->config_write);\n\n assert(pci_dev);\n\n rc = info->init(pci_dev);\n\n if (rc != 0)\n\n return rc;\n\n if (qdev->hotplugged)\n\n bus->hotplug(pci_dev, 1);\n\n return 0;\n\n}\n"}} {"sample_id": "2aae2b8e0abd58e76d616bcbe93c6966d06d0188", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static target_ulong get_psr(void)\n \n+{\n+\n+ helper_compute_psr();\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static target_ulong get_psr(void)\n\n{\n\n helper_compute_psr();\n\n\n\n#if !defined (TARGET_SPARC64)\n\n return env->version | (env->psr & PSR_ICC) |\n\n (env->psref? PSR_EF : 0) |\n\n (env->psrpil << 8) |\n\n (env->psrs? PSR_S : 0) |\n\n (env->psrps? PSR_PS : 0) |\n\n (env->psret? PSR_ET : 0) | env->cwp;\n\n#else\n\n return env->version | (env->psr & PSR_ICC) |\n\n (env->psref? PSR_EF : 0) |\n\n (env->psrpil << 8) |\n\n (env->psrs? PSR_S : 0) |\n\n (env->psrps? PSR_PS : 0) | env->cwp;\n\n#endif\n\n}\n"}} {"sample_id": "2ce68e4cf5be9b5176a3c3c372948d6340724d2d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n migrate_del_blocker(hdev->migration_blocker);\n \n+ error_free(hdev->migration_blocker);\n+\n+ }\n+\n+ g_free(hdev->mem);\n \n g_free(hdev->mem_sections);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void vhost_dev_cleanup(struct vhost_dev *hdev)\n\n{\n\n int i;\n\n for (i = 0; i < hdev->nvqs; ++i) {\n\n vhost_virtqueue_cleanup(hdev->vqs + i);\n\n }\n\n memory_listener_unregister(&hdev->memory_listener);\n\n if (hdev->migration_blocker) {\n\n migrate_del_blocker(hdev->migration_blocker);\n\n error_free(hdev->migration_blocker);\n\n }\n\n g_free(hdev->mem);\n\n g_free(hdev->mem_sections);\n\n hdev->vhost_ops->vhost_backend_cleanup(hdev);\n\n\n}"}} {"sample_id": "c3ab0004ae4dffc32494ae84dd15cfaa909a7884_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static inline void RENAME(nvXXtoUV)(uint8_t *dst1, uint8_t *dst2,\n \n const uint8_t *src, int width)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void RENAME(nvXXtoUV)(uint8_t *dst1, uint8_t *dst2,\n\n const uint8_t *src, int width)\n\n{\n\n#if COMPILE_TEMPLATE_MMX\n\n __asm__ volatile(\n\n \"movq \"MANGLE(bm01010101)\", %%mm4 \\n\\t\"\n\n \"mov %0, %%\"REG_a\" \\n\\t\"\n\n \"1: \\n\\t\"\n\n \"movq (%1, %%\"REG_a\",2), %%mm0 \\n\\t\"\n\n \"movq 8(%1, %%\"REG_a\",2), %%mm1 \\n\\t\"\n\n \"movq %%mm0, %%mm2 \\n\\t\"\n\n \"movq %%mm1, %%mm3 \\n\\t\"\n\n \"pand %%mm4, %%mm0 \\n\\t\"\n\n \"pand %%mm4, %%mm1 \\n\\t\"\n\n \"psrlw $8, %%mm2 \\n\\t\"\n\n \"psrlw $8, %%mm3 \\n\\t\"\n\n \"packuswb %%mm1, %%mm0 \\n\\t\"\n\n \"packuswb %%mm3, %%mm2 \\n\\t\"\n\n \"movq %%mm0, (%2, %%\"REG_a\") \\n\\t\"\n\n \"movq %%mm2, (%3, %%\"REG_a\") \\n\\t\"\n\n \"add $8, %%\"REG_a\" \\n\\t\"\n\n \" js 1b \\n\\t\"\n\n : : \"g\" ((x86_reg)-width), \"r\" (src+width*2), \"r\" (dst1+width), \"r\" (dst2+width)\n\n : \"%\"REG_a\n\n );\n\n#else\n\n int i;\n\n for (i = 0; i < width; i++) {\n\n dst1[i] = src[2*i+0];\n\n dst2[i] = src[2*i+1];\n\n }\n\n#endif\n\n}\n"}} {"sample_id": "7c47959d0cb05db43014141a156ada0b6d53a750_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n int64_t s, int64_t e)\n \n+{\n \n Range *r = g_malloc0(sizeof(*r));\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void string_output_append_range(StringOutputVisitor *sov,\n\n int64_t s, int64_t e)\n\n{\n\n Range *r = g_malloc0(sizeof(*r));\n\n r->begin = s;\n\n r->end = e + 1;\n\n sov->ranges = g_list_insert_sorted_merged(sov->ranges, r, range_compare);\n\n}\n"}} {"sample_id": "5430839144c6da0160e8e0cfb0c8db01de432e94", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n return AVERROR_INVALIDDATA;\n s->width = AV_RL16(&buf[4]);\n s->height = AV_RL16(&buf[6]);\n+ ret = ff_set_dimensions(s->avctx, s->width, s->height);\n+ if (ret < 0)\n+ return ret;\n+ fps = AV_RL16(&buf[10]);\n+ if (fps > 0)\n s->avctx->time_base = (AVRational){ 1, fps };\n pal_start = AV_RL16(&buf[12]);\n pal_count = AV_RL16(&buf[14]);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int cmv_process_header(CmvContext *s, const uint8_t *buf, const uint8_t *buf_end)\n{\n int pal_start, pal_count, i, ret, fps;\n if(buf_end - buf < 16) {\n av_log(s->avctx, AV_LOG_WARNING, \"truncated header\\n\");\n return AVERROR_INVALIDDATA;\n s->width = AV_RL16(&buf[4]);\n s->height = AV_RL16(&buf[6]);\n ret = ff_set_dimensions(s->avctx, s->width, s->height);\n if (ret < 0)\n return ret;\n fps = AV_RL16(&buf[10]);\n if (fps > 0)\n s->avctx->time_base = (AVRational){ 1, fps };\n pal_start = AV_RL16(&buf[12]);\n pal_count = AV_RL16(&buf[14]);\n buf += 16;\n for (i=pal_start; i= 3; i++) {\n s->palette[i] = AV_RB24(buf);\n buf += 3;\n return 0;"}} {"sample_id": "f6b5319d412cda360695e2005737f91ca8201af0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -53,11 +53,11 @@\n dc = DEVICE_CLASS(oc);\n \n if (dc->cannot_instantiate_with_device_add_yet ||\n+\n+ (qdev_hotplug && !dc->hotpluggable)) {\n+\n+ error_setg(errp, QERR_INVALID_PARAMETER_VALUE, \"driver\",\n+\n \"pluggable device type\");\n \n return NULL;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static DeviceClass *qdev_get_device_class(const char **driver, Error **errp)\n\n{\n\n ObjectClass *oc;\n\n DeviceClass *dc;\n\n\n\n oc = object_class_by_name(*driver);\n\n if (!oc) {\n\n const char *typename = find_typename_by_alias(*driver);\n\n\n\n if (typename) {\n\n *driver = typename;\n\n oc = object_class_by_name(*driver);\n\n }\n\n }\n\n\n\n if (!object_class_dynamic_cast(oc, TYPE_DEVICE)) {\n\n error_setg(errp, \"'%s' is not a valid device model name\", *driver);\n\n return NULL;\n\n }\n\n\n\n if (object_class_is_abstract(oc)) {\n\n error_setg(errp, QERR_INVALID_PARAMETER_VALUE, \"driver\",\n\n \"non-abstract device type\");\n\n return NULL;\n\n }\n\n\n\n dc = DEVICE_CLASS(oc);\n\n if (dc->cannot_instantiate_with_device_add_yet ||\n\n (qdev_hotplug && !dc->hotpluggable)) {\n\n error_setg(errp, QERR_INVALID_PARAMETER_VALUE, \"driver\",\n\n \"pluggable device type\");\n\n return NULL;\n\n }\n\n\n\n return dc;\n\n}\n"}} {"sample_id": "221b804f3491638ecf2eec1302c669ad2d9ec799", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,25 +1,25 @@\n+static inline void yuv2yuvXinC(int16_t *lumFilter, int16_t **lumSrc, int lumFilterSize,\n+\n+\t\t\t\t int16_t *chrFilter, int16_t **chrSrc, int chrFilterSize,\n \n+\t\t\t\t uint8_t *dest, uint8_t *uDest, uint8_t *vDest, int dstW, int chrDstW)\n+\n+{\n+\n+\t//FIXME Optimize (just quickly writen not opti..)\n \n+\tint i;\n \n+\tfor(i=0; i>19);\n\n\t}\n\n\n\n\tif(uDest != NULL)\n\n\t\tfor(i=0; i>19);\n\n\t\t\tvDest[i]= av_clip_uint8(v>>19);\n\n\t\t}\n\n}\n"}} {"sample_id": "85d9d044471f93c48c5c396f7e217b4ef12f69f8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n struct virtio_gpu_resp_capset *resp;\n \n+ uint32_t max_ver, max_size;\n \n VIRTIO_GPU_FILL_CMD(gc);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void virgl_cmd_get_capset(VirtIOGPU *g,\n\n struct virtio_gpu_ctrl_command *cmd)\n\n{\n\n struct virtio_gpu_get_capset gc;\n\n struct virtio_gpu_resp_capset *resp;\n\n uint32_t max_ver, max_size;\n\n VIRTIO_GPU_FILL_CMD(gc);\n\n\n\n virgl_renderer_get_cap_set(gc.capset_id, &max_ver,\n\n &max_size);\n\n if (!max_size) {\n\n cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;\n\n return;\n\n }\n\n\n\n resp = g_malloc(sizeof(*resp) + max_size);\n\n resp->hdr.type = VIRTIO_GPU_RESP_OK_CAPSET;\n\n virgl_renderer_fill_caps(gc.capset_id,\n\n gc.capset_version,\n\n (void *)resp->capset_data);\n\n virtio_gpu_ctrl_response(g, cmd, &resp->hdr, sizeof(*resp) + max_size);\n\n g_free(resp);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_298", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n /* Workaround to allow loading the binary-only wlandrv.ko crap\n \n+ * from the original Freecom firmware. */\n+\n+ case MP_WLAN_MAGIC1:\n+\n+ return ~3;\n \n case MP_WLAN_MAGIC2:\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t mv88w8618_wlan_read(void *opaque, target_phys_addr_t offset,\n\n unsigned size)\n\n{\n\n switch (offset) {\n\n /* Workaround to allow loading the binary-only wlandrv.ko crap\n\n * from the original Freecom firmware. */\n\n case MP_WLAN_MAGIC1:\n\n return ~3;\n\n case MP_WLAN_MAGIC2:\n\n return -1;\n\n\n\n default:\n\n return 0;\n\n }\n\n}\n"}} {"sample_id": "b8d834a00fa3ed4dad7d371e1a00938a126a54a0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static int x86_cpu_filter_features(X86CPU *cpu)\n \n {\n+\n+ CPUX86State *env = &cpu->env;\n+\n+ FeatureWord w;\n+\n int rv = 0;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int x86_cpu_filter_features(X86CPU *cpu)\n\n{\n\n CPUX86State *env = &cpu->env;\n\n FeatureWord w;\n\n int rv = 0;\n\n\n\n for (w = 0; w < FEATURE_WORDS; w++) {\n\n uint32_t host_feat =\n\n x86_cpu_get_supported_feature_word(w, false);\n\n uint32_t requested_features = env->features[w];\n\n env->features[w] &= host_feat;\n\n cpu->filtered_features[w] = requested_features & ~env->features[w];\n\n if (cpu->filtered_features[w]) {\n\n rv = 1;\n\n }\n\n }\n\n\n\n return rv;\n\n}\n"}} {"sample_id": "494a8ebe713055d3946183f4b395f85a18b43e9e_19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n *status = 0;\n \n reply->iov_len = 0;\n+\n+ retval = socket_read(proxy->sockfd, reply->iov_base, PROXY_HDR_SZ);\n+\n+ if (retval < 0) {\n+\n return retval;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int v9fs_receive_status(V9fsProxy *proxy,\n\n struct iovec *reply, int *status)\n\n{\n\n int retval;\n\n ProxyHeader header;\n\n\n\n *status = 0;\n\n reply->iov_len = 0;\n\n retval = socket_read(proxy->sockfd, reply->iov_base, PROXY_HDR_SZ);\n\n if (retval < 0) {\n\n return retval;\n\n }\n\n reply->iov_len = PROXY_HDR_SZ;\n\n proxy_unmarshal(reply, 0, \"dd\", &header.type, &header.size);\n\n if (header.size != sizeof(int)) {\n\n *status = -ENOBUFS;\n\n return 0;\n\n }\n\n retval = socket_read(proxy->sockfd,\n\n reply->iov_base + PROXY_HDR_SZ, header.size);\n\n if (retval < 0) {\n\n return retval;\n\n }\n\n reply->iov_len += header.size;\n\n proxy_unmarshal(reply, PROXY_HDR_SZ, \"d\", status);\n\n return 0;\n\n}\n"}} {"sample_id": "6687b79d636cd60ed9adb1177d0d946b58fa7717_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void print_net_client(Monitor *mon, VLANClientState *vc)\n+\n {\n \n monitor_printf(mon, \"%s: type=%s,%s\\n\", vc->name,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void print_net_client(Monitor *mon, VLANClientState *vc)\n\n{\n\n monitor_printf(mon, \"%s: type=%s,%s\\n\", vc->name,\n\n net_client_types[vc->info->type].type, vc->info_str);\n\n}\n"}} {"sample_id": "6a32f80f056b577d275268e4f6f3477ba721c94f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n case USB_SPEED_HIGH:\n \n+ port->portsc |= PORTSC_SPEED_HIGH;\n+\n+ break;\n+\n+ case USB_SPEED_SUPER:\n \n port->portsc |= PORTSC_SPEED_SUPER;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void xhci_port_update(XHCIPort *port, int is_detach)\n\n{\n\n port->portsc = PORTSC_PP;\n\n if (port->uport->dev && port->uport->dev->attached && !is_detach &&\n\n (1 << port->uport->dev->speed) & port->speedmask) {\n\n port->portsc |= PORTSC_CCS;\n\n switch (port->uport->dev->speed) {\n\n case USB_SPEED_LOW:\n\n port->portsc |= PORTSC_SPEED_LOW;\n\n break;\n\n case USB_SPEED_FULL:\n\n port->portsc |= PORTSC_SPEED_FULL;\n\n break;\n\n case USB_SPEED_HIGH:\n\n port->portsc |= PORTSC_SPEED_HIGH;\n\n break;\n\n case USB_SPEED_SUPER:\n\n port->portsc |= PORTSC_SPEED_SUPER;\n\n break;\n\n }\n\n }\n\n\n\n if (xhci_running(port->xhci)) {\n\n port->portsc |= PORTSC_CSC;\n\n XHCIEvent ev = { ER_PORT_STATUS_CHANGE, CC_SUCCESS,\n\n port->portnr << 24};\n\n xhci_event(port->xhci, &ev, 0);\n\n DPRINTF(\"xhci: port change event for port %d\\n\", port->portnr);\n\n }\n\n}\n"}} {"sample_id": "622b520fb4ca50b5028485f1d225317ece0a42b9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n \n \n loc_push_none(&loc);\n+\n+ for (unit = 0; unit < MAX_SCSI_DEVS; unit++) {\n+\n+ dinfo = drive_get(IF_SCSI, bus->busnr, unit);\n+\n if (dinfo == NULL) {\n \n continue;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int scsi_bus_legacy_handle_cmdline(SCSIBus *bus)\n\n{\n\n Location loc;\n\n DriveInfo *dinfo;\n\n int res = 0, unit;\n\n\n\n loc_push_none(&loc);\n\n for (unit = 0; unit < MAX_SCSI_DEVS; unit++) {\n\n dinfo = drive_get(IF_SCSI, bus->busnr, unit);\n\n if (dinfo == NULL) {\n\n continue;\n\n }\n\n qemu_opts_loc_restore(dinfo->opts);\n\n if (!scsi_bus_legacy_add_drive(bus, dinfo->bdrv, unit)) {\n\n res = -1;\n\n break;\n\n }\n\n }\n\n loc_pop(&loc);\n\n return res;\n\n}\n"}} {"sample_id": "c572f23a3e7180dbeab5e86583e43ea2afed6271_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n goto out_nofid;\n }\n err = v9fs_co_fstat(pdu, fidp->fs.fd, &stbuf);\n+ if (err < 0) {\n+ goto out;\n+ }\n+ status = P9_LOCK_SUCCESS;\n+out:\n put_fid(pdu, fidp);\n out_nofid:\n err = offset;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void v9fs_lock(void *opaque)\n{\n int8_t status;\n V9fsFlock *flock;\n size_t offset = 7;\n struct stat stbuf;\n V9fsFidState *fidp;\n int32_t fid, err = 0;\n V9fsPDU *pdu = opaque;\n V9fsState *s = pdu->s;\n flock = g_malloc(sizeof(*flock));\n pdu_unmarshal(pdu, offset, \"dbdqqds\", &fid, &flock->type,\n &flock->flags, &flock->start, &flock->length,\n &flock->proc_id, &flock->client_id);\n status = P9_LOCK_ERROR;\n /* We support only block flag now (that too ignored currently) */\n if (flock->flags & ~P9_LOCK_FLAGS_BLOCK) {\n err = -EINVAL;\n goto out_nofid;\n }\n fidp = get_fid(pdu, fid);\n if (fidp == NULL) {\n err = -ENOENT;\n goto out_nofid;\n }\n err = v9fs_co_fstat(pdu, fidp->fs.fd, &stbuf);\n if (err < 0) {\n goto out;\n }\n status = P9_LOCK_SUCCESS;\nout:\n put_fid(pdu, fidp);\nout_nofid:\n err = offset;\n err += pdu_marshal(pdu, offset, \"b\", status);\n trace_v9fs_lock_return(pdu->tag, pdu->id, status);\n complete_pdu(s, pdu, err);\n v9fs_string_free(&flock->client_id);\n g_free(flock);\n}"}} {"sample_id": "4f5eaf0b5956e492ee5023929669b1d09aaf6299_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n {\n \n+ ProresContext *ctx = avctx->priv_data;\n \n LOCAL_ALIGNED_16(int16_t, blocks, [8*4*64]);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int decode_slice_chroma(AVCodecContext *avctx, SliceContext *slice,\n\n uint16_t *dst, int dst_stride,\n\n const uint8_t *buf, unsigned buf_size,\n\n const int16_t *qmat, int log2_blocks_per_mb)\n\n{\n\n ProresContext *ctx = avctx->priv_data;\n\n LOCAL_ALIGNED_16(int16_t, blocks, [8*4*64]);\n\n int16_t *block;\n\n GetBitContext gb;\n\n int i, j, blocks_per_slice = slice->mb_count << log2_blocks_per_mb;\n\n int ret;\n\n\n\n for (i = 0; i < blocks_per_slice; i++)\n\n ctx->bdsp.clear_block(blocks+(i<<6));\n\n\n\n init_get_bits(&gb, buf, buf_size << 3);\n\n\n\n decode_dc_coeffs(&gb, blocks, blocks_per_slice);\n\n if ((ret = decode_ac_coeffs(avctx, &gb, blocks, blocks_per_slice)) < 0)\n\n return ret;\n\n\n\n block = blocks;\n\n for (i = 0; i < slice->mb_count; i++) {\n\n for (j = 0; j < log2_blocks_per_mb; j++) {\n\n ctx->prodsp.idct_put(dst, dst_stride, block+(0<<6), qmat);\n\n ctx->prodsp.idct_put(dst+4*dst_stride, dst_stride, block+(1<<6), qmat);\n\n block += 2*64;\n\n dst += 8;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "599d0c45615b7d099d256738a586d0f63bc707e6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n static int xen_host_pci_config_open(XenHostPCIDevice *d)\n \n+{\n+\n+ char path[PATH_MAX];\n+\n int rc;\n \n \n \n rc = xen_host_pci_sysfs_path(d, \"config\", path, sizeof (path));\n+\n if (rc) {\n \n return rc;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int xen_host_pci_config_open(XenHostPCIDevice *d)\n\n{\n\n char path[PATH_MAX];\n\n int rc;\n\n\n\n rc = xen_host_pci_sysfs_path(d, \"config\", path, sizeof (path));\n\n if (rc) {\n\n return rc;\n\n }\n\n d->config_fd = open(path, O_RDWR);\n\n if (d->config_fd < 0) {\n\n return -errno;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "155ec6edf82692bcf3a5f87d2bc697404f4e5aaf_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n put_symbol(&s->c, s->header_state, s->colorspace_type, 0);\n \n+ put_symbol(&s->c, s->header_state, s->b_width, 0);\n+\n+ put_symbol(&s->c, s->header_state, s->b_height, 0);\n+\n+ put_symbol(&s->c, s->header_state, s->chroma_h_shift, 0);\n \n put_symbol(&s->c, s->header_state, s->chroma_v_shift, 0);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void encode_header(SnowContext *s){\n\n int plane_index, level, orientation;\n\n\n\n put_cabac(&s->c, s->header_state, s->keyframe); // state clearing stuff?\n\n if(s->keyframe){\n\n put_symbol(&s->c, s->header_state, s->version, 0);\n\n put_symbol(&s->c, s->header_state, s->temporal_decomposition_type, 0);\n\n put_symbol(&s->c, s->header_state, s->temporal_decomposition_count, 0);\n\n put_symbol(&s->c, s->header_state, s->spatial_decomposition_count, 0);\n\n put_symbol(&s->c, s->header_state, s->colorspace_type, 0);\n\n put_symbol(&s->c, s->header_state, s->b_width, 0);\n\n put_symbol(&s->c, s->header_state, s->b_height, 0);\n\n put_symbol(&s->c, s->header_state, s->chroma_h_shift, 0);\n\n put_symbol(&s->c, s->header_state, s->chroma_v_shift, 0);\n\n put_cabac(&s->c, s->header_state, s->spatial_scalability);\n\n// put_cabac(&s->c, s->header_state, s->rate_scalability);\n\n\n\n for(plane_index=0; plane_index<2; plane_index++){\n\n for(level=0; levelspatial_decomposition_count; level++){\n\n for(orientation=level ? 1:0; orientation<4; orientation++){\n\n if(orientation==2) continue;\n\n put_symbol(&s->c, s->header_state, s->plane[plane_index].band[level][orientation].qlog, 1);\n\n }\n\n }\n\n }\n\n }\n\n put_symbol(&s->c, s->header_state, s->spatial_decomposition_type, 0);\n\n put_symbol(&s->c, s->header_state, s->qlog, 1); \n\n put_symbol(&s->c, s->header_state, s->mv_scale, 0); \n\n put_symbol(&s->c, s->header_state, s->qbias, 1);\n\n}\n"}} {"sample_id": "df824548d031dbfc5fa86ea9e0c652bd086b55c4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,10 +9,10 @@\n av_freep(&esc->samples);\n \n esc->samples_size = 0;\n+\n+ esc->samples_idx = 0;\n+\n+\n \n return 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int eightsvx_decode_close(AVCodecContext *avctx)\n\n{\n\n EightSvxContext *esc = avctx->priv_data;\n\n\n\n av_freep(&esc->samples);\n\n esc->samples_size = 0;\n\n esc->samples_idx = 0;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "b854bc196f5c4b4e3299c0b0ee63cf828ece9e77_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n target_phys_addr_t addr)\n \n+{\n+\n return addr >= OMAP_LOCALBUS_BASE && addr < OMAP_LOCALBUS_BASE + 0x1000000;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int omap_validate_local_addr(struct omap_mpu_state_s *s,\n\n target_phys_addr_t addr)\n\n{\n\n return addr >= OMAP_LOCALBUS_BASE && addr < OMAP_LOCALBUS_BASE + 0x1000000;\n\n}\n"}} {"sample_id": "a89d89d3e65800fa4a8e00de7af0ea8272bef779_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n static int del_existing_snapshots(Monitor *mon, const char *name)\n \n {\n+\n BlockDriverState *bs;\n \n QEMUSnapshotInfo sn1, *snapshot = &sn1;\n+\n+ int ret;\n+\n \n \n bs = NULL;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int del_existing_snapshots(Monitor *mon, const char *name)\n\n{\n\n BlockDriverState *bs;\n\n QEMUSnapshotInfo sn1, *snapshot = &sn1;\n\n int ret;\n\n\n\n bs = NULL;\n\n while ((bs = bdrv_next(bs))) {\n\n if (bdrv_can_snapshot(bs) &&\n\n bdrv_snapshot_find(bs, snapshot, name) >= 0)\n\n {\n\n ret = bdrv_snapshot_delete(bs, name);\n\n if (ret < 0) {\n\n monitor_printf(mon,\n\n \"Error while deleting snapshot on '%s'\\n\",\n\n bdrv_get_device_name(bs));\n\n return -1;\n\n }\n\n }\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a89f364ae8740dfc31b321eed9ee454e996dc3c1_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n bool msi = msi_enabled(&d->pci);\n \n int level;\n+\n+\n+\n+ intel_hda_update_int_sts(d);\n+\n if (d->int_sts & (1U << 31) && d->int_ctl & (1U << 31)) {\n \n level = 1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void intel_hda_update_irq(IntelHDAState *d)\n\n{\n\n bool msi = msi_enabled(&d->pci);\n\n int level;\n\n\n\n intel_hda_update_int_sts(d);\n\n if (d->int_sts & (1U << 31) && d->int_ctl & (1U << 31)) {\n\n level = 1;\n\n } else {\n\n level = 0;\n\n }\n\n dprint(d, 2, \"%s: level %d [%s]\\n\", __FUNCTION__,\n\n level, msi ? \"msi\" : \"intx\");\n\n if (msi) {\n\n if (level) {\n\n msi_notify(&d->pci, 0);\n\n }\n\n } else {\n\n pci_set_irq(&d->pci, level);\n\n }\n\n}\n"}} {"sample_id": "88ad920b8adbce8b00085c51a61e57b5fbc83b0c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ int64_t th;\n \n uint64_t tl;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void do_mulldo (void)\n\n{\n\n int64_t th;\n\n uint64_t tl;\n\n\n\n muls64(&tl, &th, T0, T1);\n\n if (likely(th == 0)) {\n\n xer_ov = 0;\n\n } else {\n\n xer_ov = 1;\n\n xer_so = 1;\n\n }\n\n T0 = (int64_t)tl;\n\n}\n"}} {"sample_id": "2278a69e7020d86a8c73a28474e7709d3e7d5081_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n buf_off += len;\n \n+ iov_off += len;\n+\n+ size -= len;\n+\n+ }\n \n iovec_off += iov[i].iov_len;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "size_t iov_from_buf(struct iovec *iov, unsigned int iov_cnt, size_t iov_off,\n\n const void *buf, size_t size)\n\n{\n\n size_t iovec_off, buf_off;\n\n unsigned int i;\n\n\n\n iovec_off = 0;\n\n buf_off = 0;\n\n for (i = 0; i < iov_cnt && size; i++) {\n\n if (iov_off < (iovec_off + iov[i].iov_len)) {\n\n size_t len = MIN((iovec_off + iov[i].iov_len) - iov_off, size);\n\n\n\n memcpy(iov[i].iov_base + (iov_off - iovec_off), buf + buf_off, len);\n\n\n\n buf_off += len;\n\n iov_off += len;\n\n size -= len;\n\n }\n\n iovec_off += iov[i].iov_len;\n\n }\n\n return buf_off;\n\n}\n"}} {"sample_id": "6706a2986c48e3f20f1274b24345e6555d8f0f48_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void store_slice_mmx(uint8_t *dst, const uint16_t *src,\n \n int dst_stride, int src_stride,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void store_slice_mmx(uint8_t *dst, const uint16_t *src,\n\n int dst_stride, int src_stride,\n\n int width, int height, int log2_scale,\n\n const uint8_t dither[8][8])\n\n{\n\n int y;\n\n\n\n for (y = 0; y < height; y++) {\n\n uint8_t *dst1 = dst;\n\n const int16_t *src1 = src;\n\n __asm__ volatile(\n\n \"movq (%3), %%mm3 \\n\"\n\n \"movq (%3), %%mm4 \\n\"\n\n \"movd %4, %%mm2 \\n\"\n\n \"pxor %%mm0, %%mm0 \\n\"\n\n \"punpcklbw %%mm0, %%mm3 \\n\"\n\n \"punpckhbw %%mm0, %%mm4 \\n\"\n\n \"psraw %%mm2, %%mm3 \\n\"\n\n \"psraw %%mm2, %%mm4 \\n\"\n\n \"movd %5, %%mm2 \\n\"\n\n \"1: \\n\"\n\n \"movq (%0), %%mm0 \\n\"\n\n \"movq 8(%0), %%mm1 \\n\"\n\n \"paddw %%mm3, %%mm0 \\n\"\n\n \"paddw %%mm4, %%mm1 \\n\"\n\n \"psraw %%mm2, %%mm0 \\n\"\n\n \"psraw %%mm2, %%mm1 \\n\"\n\n \"packuswb %%mm1, %%mm0 \\n\"\n\n \"movq %%mm0, (%1) \\n\"\n\n \"add $16, %0 \\n\"\n\n \"add $8, %1 \\n\"\n\n \"cmp %2, %1 \\n\"\n\n \" jb 1b \\n\"\n\n : \"+r\" (src1), \"+r\"(dst1)\n\n : \"r\"(dst + width), \"r\"(dither[y]), \"g\"(log2_scale), \"g\"(MAX_LEVEL - log2_scale)\n\n );\n\n src += src_stride;\n\n dst += dst_stride;\n\n }\n\n}\n"}} {"sample_id": "db5dc02bd7d31243d2c4f84294907d657ab3d070", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n if(enc->codec_id == CODEC_ID_VORBIS)\n \n+ return -1;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int get_audio_frame_size(AVCodecContext *enc, int size)\n\n{\n\n int frame_size;\n\n\n\n if(enc->codec_id == CODEC_ID_VORBIS)\n\n return -1;\n\n\n\n if (enc->frame_size <= 1) {\n\n int bits_per_sample = av_get_bits_per_sample(enc->codec_id);\n\n\n\n if (bits_per_sample) {\n\n if (enc->channels == 0)\n\n return -1;\n\n frame_size = (size << 3) / (bits_per_sample * enc->channels);\n\n } else {\n\n /* used for example by ADPCM codecs */\n\n if (enc->bit_rate == 0)\n\n return -1;\n\n frame_size = (size * 8 * enc->sample_rate) / enc->bit_rate;\n\n }\n\n } else {\n\n frame_size = enc->frame_size;\n\n }\n\n return frame_size;\n\n}\n"}} {"sample_id": "efec3dd631d94160288392721a5f9c39e50fb2bc_21", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass);\n \n+ DeviceClass *k = DEVICE_CLASS(klass);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void pl181_class_init(ObjectClass *klass, void *data)\n\n{\n\n SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass);\n\n DeviceClass *k = DEVICE_CLASS(klass);\n\n\n\n sdc->init = pl181_init;\n\n k->vmsd = &vmstate_pl181;\n\n k->reset = pl181_reset;\n\n k->no_user = 1;\n\n}\n"}} {"sample_id": "e37dac06dc4e85a2f46c24261c0dfdf2a30b50e3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n }\n \n+\n+\n+ ret = vfio_add_std_cap(vdev, pdev->config[PCI_CAPABILITY_LIST]);\n+\n+ if (ret) {\n \n return ret;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int vfio_add_capabilities(VFIOPCIDevice *vdev)\n\n{\n\n PCIDevice *pdev = &vdev->pdev;\n\n int ret;\n\n\n\n if (!(pdev->config[PCI_STATUS] & PCI_STATUS_CAP_LIST) ||\n\n !pdev->config[PCI_CAPABILITY_LIST]) {\n\n return 0; /* Nothing to add */\n\n }\n\n\n\n ret = vfio_add_std_cap(vdev, pdev->config[PCI_CAPABILITY_LIST]);\n\n if (ret) {\n\n return ret;\n\n }\n\n\n\n /* on PCI bus, it doesn't make sense to expose extended capabilities. */\n\n if (!pci_is_express(pdev) ||\n\n !pci_bus_is_express(pdev->bus) ||\n\n !pci_get_long(pdev->config + PCI_CONFIG_SPACE_SIZE)) {\n\n return 0;\n\n }\n\n\n\n return vfio_add_ext_cap(vdev);\n\n}\n"}} {"sample_id": "4f4321c11ff6e98583846bfd6f0e81954924b003_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,7 +12,7 @@\n \n \n \n+ DPRINTF(\"set config status %d config %d id %u\\n\", config_status->status,\n \n config_status->configuration, id);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void usbredir_configuration_status(void *priv, uint32_t id,\n\n struct usb_redir_configuration_status_header *config_status)\n\n{\n\n USBRedirDevice *dev = priv;\n\n AsyncURB *aurb;\n\n int len = 0;\n\n\n\n DPRINTF(\"set config status %d config %d id %u\\n\", config_status->status,\n\n config_status->configuration, id);\n\n\n\n aurb = async_find(dev, id);\n\n if (!aurb) {\n\n return;\n\n }\n\n if (aurb->packet) {\n\n if (aurb->get) {\n\n dev->dev.data_buf[0] = config_status->configuration;\n\n len = 1;\n\n }\n\n aurb->packet->len =\n\n usbredir_handle_status(dev, config_status->status, len);\n\n usb_generic_async_ctrl_complete(&dev->dev, aurb->packet);\n\n }\n\n async_free(dev, aurb);\n\n}\n"}} {"sample_id": "ae261c86aaed62e7acddafab8262a2bf286d40b7_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n memset(desc, 0, sizeof(desc));\n \n+ if (bdrv_pread(bs->file, s->desc_offset, desc, DESC_SIZE) != DESC_SIZE) {\n+\n+ return -EIO;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int vmdk_write_cid(BlockDriverState *bs, uint32_t cid)\n\n{\n\n char desc[DESC_SIZE], tmp_desc[DESC_SIZE];\n\n char *p_name, *tmp_str;\n\n BDRVVmdkState *s = bs->opaque;\n\n\n\n memset(desc, 0, sizeof(desc));\n\n if (bdrv_pread(bs->file, s->desc_offset, desc, DESC_SIZE) != DESC_SIZE) {\n\n return -EIO;\n\n }\n\n\n\n tmp_str = strstr(desc,\"parentCID\");\n\n pstrcpy(tmp_desc, sizeof(tmp_desc), tmp_str);\n\n if ((p_name = strstr(desc,\"CID\")) != NULL) {\n\n p_name += sizeof(\"CID\");\n\n snprintf(p_name, sizeof(desc) - (p_name - desc), \"%x\\n\", cid);\n\n pstrcat(desc, sizeof(desc), tmp_desc);\n\n }\n\n\n\n if (bdrv_pwrite_sync(bs->file, s->desc_offset, desc, DESC_SIZE) < 0) {\n\n return -EIO;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "06bb1de1c78a3653e197ff3434d550499b556e72", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n int size = (c->frame_bit_len - c->remaining_bits + 7)>>3;\n \n \n+\n if (av_new_packet(pkt, size+2) < 0)\n \n return AVERROR(EIO);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int vqf_read_packet(AVFormatContext *s, AVPacket *pkt)\n\n{\n\n VqfContext *c = s->priv_data;\n\n int ret;\n\n int size = (c->frame_bit_len - c->remaining_bits + 7)>>3;\n\n\n\n if (av_new_packet(pkt, size+2) < 0)\n\n return AVERROR(EIO);\n\n\n\n pkt->pos = avio_tell(s->pb);\n\n pkt->stream_index = 0;\n\n pkt->duration = 1;\n\n\n\n pkt->data[0] = 8 - c->remaining_bits; // Number of bits to skip\n\n pkt->data[1] = c->last_frame_bits;\n\n ret = avio_read(s->pb, pkt->data+2, size);\n\n\n\n if (ret<=0) {\n\n av_free_packet(pkt);\n\n return AVERROR(EIO);\n\n }\n\n\n\n c->last_frame_bits = pkt->data[size+1];\n\n c->remaining_bits = (size << 3) - c->frame_bit_len + c->remaining_bits;\n\n\n\n return size+2;\n\n}\n"}} {"sample_id": "f3c75d42adbba553eaf218a832d4fbea32c8f7b8_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n env->spr[SPR_SDR1] = value;\n \n+#if defined(TARGET_PPC64)\n \n if (env->mmu_model & POWERPC_MMU_64) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void ppc_store_sdr1(CPUPPCState *env, target_ulong value)\n\n{\n\n LOG_MMU(\"%s: \" TARGET_FMT_lx \"\\n\", __func__, value);\n\n if (env->spr[SPR_SDR1] != value) {\n\n env->spr[SPR_SDR1] = value;\n\n#if defined(TARGET_PPC64)\n\n if (env->mmu_model & POWERPC_MMU_64) {\n\n target_ulong htabsize = value & SDR_64_HTABSIZE;\n\n\n\n if (htabsize > 28) {\n\n fprintf(stderr, \"Invalid HTABSIZE 0x\" TARGET_FMT_lx\n\n \" stored in SDR1\\n\", htabsize);\n\n htabsize = 28;\n\n }\n\n env->htab_mask = (1ULL << (htabsize + 18)) - 1;\n\n env->htab_base = value & SDR_64_HTABORG;\n\n } else\n\n#endif /* defined(TARGET_PPC64) */\n\n {\n\n /* FIXME: Should check for valid HTABMASK values */\n\n env->htab_mask = ((value & SDR_32_HTABMASK) << 16) | 0xFFFF;\n\n env->htab_base = value & SDR_32_HTABORG;\n\n }\n\n tlb_flush(env, 1);\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_46", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static void bonito_pciconf_writel(void *opaque, target_phys_addr_t addr,\n+\n+ uint64_t val, unsigned size)\n+\n {\n \n PCIBonitoState *s = opaque;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bonito_pciconf_writel(void *opaque, target_phys_addr_t addr,\n\n uint64_t val, unsigned size)\n\n{\n\n PCIBonitoState *s = opaque;\n\n PCIDevice *d = PCI_DEVICE(s);\n\n\n\n DPRINTF(\"bonito_pciconf_writel \"TARGET_FMT_plx\" val %x\\n\", addr, val);\n\n d->config_write(d, addr, val, 4);\n\n}\n"}} {"sample_id": "393c13b940be8f2e5b126cd9f442c12e7ecb4cac", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ struct bt_l2cap_sdp_state_s *sdp = opaque;\n \n int i;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void bt_l2cap_sdp_close_ch(void *opaque)\n\n{\n\n struct bt_l2cap_sdp_state_s *sdp = opaque;\n\n int i;\n\n\n\n for (i = 0; i < sdp->services; i ++) {\n\n g_free(sdp->service_list[i].attribute_list->pair);\n\n g_free(sdp->service_list[i].attribute_list);\n\n g_free(sdp->service_list[i].uuid);\n\n }\n\n g_free(sdp->service_list);\n\n g_free(sdp);\n\n}\n"}} {"sample_id": "bae8196d9f97916de6323e70e3e374362ee16ec4_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ return job->deferred_to_main_loop ?\n+\n qemu_get_aio_context() :\n \n blk_get_aio_context(job->blk);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static AioContext *block_job_get_aio_context(BlockJob *job)\n\n{\n\n return job->deferred_to_main_loop ?\n\n qemu_get_aio_context() :\n\n blk_get_aio_context(job->blk);\n\n}\n"}} {"sample_id": "2b880bcdbeb87b9cb4e325dd6e872373458f82d9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void qvirtio_9p_pci_stop(QVirtIO9P *v9p)\n \n {\n+\n qvirtqueue_cleanup(v9p->dev->bus, v9p->vq, v9p->qs->alloc);\n \n qvirtio_pci_device_disable(container_of(v9p->dev, QVirtioPCIDevice, vdev));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void qvirtio_9p_pci_stop(QVirtIO9P *v9p)\n\n{\n\n qvirtqueue_cleanup(v9p->dev->bus, v9p->vq, v9p->qs->alloc);\n\n qvirtio_pci_device_disable(container_of(v9p->dev, QVirtioPCIDevice, vdev));\n\n g_free(v9p->dev);\n\n qvirtio_9p_stop(v9p);\n\n}\n"}} {"sample_id": "33577b47c64435fcc2a1bc01c7e82534256f1fc3_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,5 +5,5 @@\n int fd;\n \n return (qemu_chr_fe_get_msgfds(s, &fd, 1) == 1) ? fd : -1;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_chr_fe_get_msgfd(CharDriverState *s)\n\n{\n\n int fd;\n\n return (qemu_chr_fe_get_msgfds(s, &fd, 1) == 1) ? fd : -1;\n\n}\n"}} {"sample_id": "ddfa3751c092feaf1e080f66587024689dfe603c_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n static int get_bits(J2kDecoderContext *s, int n)\n \n+{\n \n int res = 0;\n+\n+ if (s->buf_end - s->buf < ((n - s->bit_index) >> 8))\n+\n return AVERROR(EINVAL);\n \n+ while (--n >= 0){\n \n res <<= 1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int get_bits(J2kDecoderContext *s, int n)\n\n{\n\n int res = 0;\n\n if (s->buf_end - s->buf < ((n - s->bit_index) >> 8))\n\n return AVERROR(EINVAL);\n\n while (--n >= 0){\n\n res <<= 1;\n\n if (s->bit_index == 0){\n\n s->bit_index = 7 + (*s->buf != 0xff);\n\n s->buf++;\n\n }\n\n s->bit_index--;\n\n res |= (*s->buf >> s->bit_index) & 1;\n\n }\n\n return res;\n\n}\n"}} {"sample_id": "554c97dd43e021b626c78ed5bd72bca33d5cb99c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -39,11 +39,11 @@\n virtio_net_receive, virtio_net_can_receive, n);\n \n \n+\n+ qemu_format_nic_info_str(n->vc, n->mac);\n+\n+\n+\n n->tx_timer = qemu_new_timer(vm_clock, virtio_net_tx_timer, n);\n \n n->tx_timer_active = 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "PCIDevice *virtio_net_init(PCIBus *bus, NICInfo *nd, int devfn)\n\n{\n\n VirtIONet *n;\n\n static int virtio_net_id;\n\n\n\n n = (VirtIONet *)virtio_init_pci(bus, \"virtio-net\", 6900, 0x1000,\n\n 0, VIRTIO_ID_NET,\n\n 0x02, 0x00, 0x00,\n\n 6, sizeof(VirtIONet));\n\n if (!n)\n\n return NULL;\n\n\n\n n->vdev.get_config = virtio_net_update_config;\n\n n->vdev.get_features = virtio_net_get_features;\n\n n->vdev.set_features = virtio_net_set_features;\n\n n->rx_vq = virtio_add_queue(&n->vdev, 256, virtio_net_handle_rx);\n\n n->tx_vq = virtio_add_queue(&n->vdev, 256, virtio_net_handle_tx);\n\n memcpy(n->mac, nd->macaddr, 6);\n\n n->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,\n\n virtio_net_receive, virtio_net_can_receive, n);\n\n\n\n qemu_format_nic_info_str(n->vc, n->mac);\n\n\n\n n->tx_timer = qemu_new_timer(vm_clock, virtio_net_tx_timer, n);\n\n n->tx_timer_active = 0;\n\n n->mergeable_rx_bufs = 0;\n\n\n\n register_savevm(\"virtio-net\", virtio_net_id++, 2,\n\n virtio_net_save, virtio_net_load, n);\n\n\n\n return (PCIDevice *)n;\n\n}\n"}} {"sample_id": "e8ede0a8bb5298a6979bcf7ed84ef64a64a4e3fe_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n return float64_chs(a);\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "float64 HELPER(ucf64_negd)(float64 a)\n\n{\n\n return float64_chs(a);\n\n}\n"}} {"sample_id": "8561c9244ddf1122dfe7ccac9b23f506062f1499", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n if (block->flags & RAM_PREALLOC) {\n \n+ ;\n \n } else if (xen_enabled()) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void reclaim_ramblock(RAMBlock *block)\n\n{\n\n if (block->flags & RAM_PREALLOC) {\n\n ;\n\n } else if (xen_enabled()) {\n\n xen_invalidate_map_cache_entry(block->host);\n\n#ifndef _WIN32\n\n } else if (block->fd >= 0) {\n\n munmap(block->host, block->max_length);\n\n close(block->fd);\n\n#endif\n\n } else {\n\n qemu_anon_ram_free(block->host, block->max_length);\n\n }\n\n g_free(block);\n\n}\n"}} {"sample_id": "494a8ebe713055d3946183f4b395f85a18b43e9e_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n stbuf->st_blocks = prstat->st_blocks;\n \n+ stbuf->st_atim.tv_sec = prstat->st_atim_sec;\n+\n+ stbuf->st_atim.tv_nsec = prstat->st_atim_nsec;\n+\n+ stbuf->st_mtime = prstat->st_mtim_sec;\n \n stbuf->st_mtim.tv_nsec = prstat->st_mtim_nsec;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void prstat_to_stat(struct stat *stbuf, ProxyStat *prstat)\n\n{\n\n memset(stbuf, 0, sizeof(*stbuf));\n\n stbuf->st_dev = prstat->st_dev;\n\n stbuf->st_ino = prstat->st_ino;\n\n stbuf->st_nlink = prstat->st_nlink;\n\n stbuf->st_mode = prstat->st_mode;\n\n stbuf->st_uid = prstat->st_uid;\n\n stbuf->st_gid = prstat->st_gid;\n\n stbuf->st_rdev = prstat->st_rdev;\n\n stbuf->st_size = prstat->st_size;\n\n stbuf->st_blksize = prstat->st_blksize;\n\n stbuf->st_blocks = prstat->st_blocks;\n\n stbuf->st_atim.tv_sec = prstat->st_atim_sec;\n\n stbuf->st_atim.tv_nsec = prstat->st_atim_nsec;\n\n stbuf->st_mtime = prstat->st_mtim_sec;\n\n stbuf->st_mtim.tv_nsec = prstat->st_mtim_nsec;\n\n stbuf->st_ctime = prstat->st_ctim_sec;\n\n stbuf->st_ctim.tv_nsec = prstat->st_ctim_nsec;\n\n}\n"}} {"sample_id": "0c9390d978cbf61e8f16c9f580fa96b305c43568_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n NBDExport *exp = client->exp;\n \n+\n \n if (exp) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static coroutine_fn void nbd_co_client_start(void *opaque)\n\n{\n\n NBDClientNewData *data = opaque;\n\n NBDClient *client = data->client;\n\n NBDExport *exp = client->exp;\n\n\n\n if (exp) {\n\n nbd_export_get(exp);\n\n QTAILQ_INSERT_TAIL(&exp->clients, client, next);\n\n }\n\n qemu_co_mutex_init(&client->send_lock);\n\n\n\n if (nbd_negotiate(data)) {\n\n client_close(client);\n\n goto out;\n\n }\n\n\n\n nbd_client_receive_next_request(client);\n\n\n\nout:\n\n g_free(data);\n\n}\n"}} {"sample_id": "473147bed01c0c6c82d85fd79d3e1c1d65542663_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+int ff_cmap_read_palette(AVCodecContext *avctx, uint32_t *pal)\n+\n+{\n+\n+ int count, i;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int ff_cmap_read_palette(AVCodecContext *avctx, uint32_t *pal)\n\n{\n\n int count, i;\n\n\n\n if (avctx->bits_per_coded_sample > 8) {\n\n av_log(avctx, AV_LOG_ERROR, \"bit_per_coded_sample > 8 not supported\\n\");\n\n return AVERROR_INVALIDDATA;\n\n }\n\n\n\n count = 1 << avctx->bits_per_coded_sample;\n\n if (avctx->extradata_size < count * 3) {\n\n av_log(avctx, AV_LOG_ERROR, \"palette data underflow\\n\");\n\n return AVERROR_INVALIDDATA;\n\n }\n\n for (i=0; i < count; i++) {\n\n pal[i] = 0xFF000000 | AV_RB24( avctx->extradata + i*3 );\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "59800ec8e52bcfa271fa61fb0aae19205ef1b7f1_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n if (unlikely((float64_is_infinity(farg1.d) && float64_is_zero(farg2.d)) ||\n \n+ (float64_is_zero(farg1.d) && float64_is_infinity(farg2.d)))) {\n+\n+ /* Multiplication of zero by infinity */\n+\n+ farg1.ll = fload_invalid_op_excp(env, POWERPC_EXCP_FP_VXIMZ);\n \n } else {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint64_t helper_fmul(CPUPPCState *env, uint64_t arg1, uint64_t arg2)\n\n{\n\n CPU_DoubleU farg1, farg2;\n\n\n\n farg1.ll = arg1;\n\n farg2.ll = arg2;\n\n\n\n if (unlikely((float64_is_infinity(farg1.d) && float64_is_zero(farg2.d)) ||\n\n (float64_is_zero(farg1.d) && float64_is_infinity(farg2.d)))) {\n\n /* Multiplication of zero by infinity */\n\n farg1.ll = fload_invalid_op_excp(env, POWERPC_EXCP_FP_VXIMZ);\n\n } else {\n\n if (unlikely(float64_is_signaling_nan(farg1.d) ||\n\n float64_is_signaling_nan(farg2.d))) {\n\n /* sNaN multiplication */\n\n fload_invalid_op_excp(env, POWERPC_EXCP_FP_VXSNAN);\n\n }\n\n farg1.d = float64_mul(farg1.d, farg2.d, &env->fp_status);\n\n }\n\n\n\n return farg1.ll;\n\n}\n"}} {"sample_id": "fdbbf2e0fc1bb91a5d735a49f39337eb172e68a7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n int i,j,xy,yz;\n \n+ int res; \n+\n+ for(i=1; i<7; i++){\n+\n+ for(j=0; j<8; j++){\n \n xy = j * stride + i;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void h261_h_loop_filter_c(uint8_t *dest,uint8_t *src, int stride){\n\n int i,j,xy,yz;\n\n int res; \n\n for(i=1; i<7; i++){\n\n for(j=0; j<8; j++){\n\n xy = j * stride + i;\n\n yz = j * 8 + i;\n\n res = (int)src[yz-1] + ((int)(src[yz]) *2) + (int)src[yz+1];\n\n res+=2;\n\n res>>=2;\n\n dest[xy] = (uint8_t)res;\n\n }\n\n }\n\n}\n"}} {"sample_id": "540c79fec9e8b6a6582ec4c65aa2c4c5366e4b89", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,21 +2,21 @@\n \n Error **errp)\n \n+{\n+\n+ s->get_error = socket_errno;\n+\n s->write = socket_write;\n \n+ s->close = tcp_close;\n+\n+\n+\n s->fd = inet_connect(host_port, false, NULL, errp);\n+\n \n \n+ if (!error_is_set(errp)) {\n \n migrate_fd_connect(s);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int tcp_start_outgoing_migration(MigrationState *s, const char *host_port,\n\n Error **errp)\n\n{\n\n s->get_error = socket_errno;\n\n s->write = socket_write;\n\n s->close = tcp_close;\n\n\n\n s->fd = inet_connect(host_port, false, NULL, errp);\n\n\n\n if (!error_is_set(errp)) {\n\n migrate_fd_connect(s);\n\n } else if (error_is_type(*errp, QERR_SOCKET_CONNECT_IN_PROGRESS)) {\n\n DPRINTF(\"connect in progress\\n\");\n\n qemu_set_fd_handler2(s->fd, NULL, NULL, tcp_wait_for_connect, s);\n\n } else if (error_is_type(*errp, QERR_SOCKET_CREATE_FAILED)) {\n\n DPRINTF(\"connect failed\\n\");\n\n return -1;\n\n } else if (error_is_type(*errp, QERR_SOCKET_CONNECT_FAILED)) {\n\n DPRINTF(\"connect failed\\n\");\n\n migrate_fd_error(s);\n\n return -1;\n\n } else {\n\n DPRINTF(\"unknown error\\n\");\n\n return -1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "c34d440a728fd3b5099d11dec122d440ef092c23", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n .addr = paddr,\n \n .misc = (MCM_ADDR_PHYS << 6) | 0xc,\n+\n+ };\n+\n+ int r;\n+\n \n \n r = kvm_set_mce(env, &mce);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void kvm_mce_inj_srar_dataload(CPUState *env, target_phys_addr_t paddr)\n\n{\n\n struct kvm_x86_mce mce = {\n\n .bank = 9,\n\n .status = MCI_STATUS_VAL | MCI_STATUS_UC | MCI_STATUS_EN\n\n | MCI_STATUS_MISCV | MCI_STATUS_ADDRV | MCI_STATUS_S\n\n | MCI_STATUS_AR | 0x134,\n\n .mcg_status = MCG_STATUS_MCIP | MCG_STATUS_EIPV,\n\n .addr = paddr,\n\n .misc = (MCM_ADDR_PHYS << 6) | 0xc,\n\n };\n\n int r;\n\n\n\n r = kvm_set_mce(env, &mce);\n\n if (r < 0) {\n\n fprintf(stderr, \"kvm_set_mce: %s\\n\", strerror(errno));\n\n abort();\n\n }\n\n kvm_mce_broadcast_rest(env);\n\n}\n"}} {"sample_id": "3a8c95f730732b9f1ffacdbfbf79a01b202a67af_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,8 +34,8 @@\n \n \n \n+ close_input_file(&fmt_ctx);\n+\n+ return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int probe_file(const char *filename)\n\n{\n\n AVFormatContext *fmt_ctx;\n\n int ret, i;\n\n\n\n if ((ret = open_input_file(&fmt_ctx, filename)))\n\n return ret;\n\n\n\n if (do_show_packets)\n\n show_packets(fmt_ctx);\n\n\n\n if (do_show_streams)\n\n for (i = 0; i < fmt_ctx->nb_streams; i++)\n\n show_stream(fmt_ctx, i);\n\n\n\n if (do_show_format)\n\n show_format(fmt_ctx);\n\n\n\n close_input_file(&fmt_ctx);\n\n return 0;\n\n}\n"}} {"sample_id": "aa92d6c4609e174fc6884e4b7b87367fac33cbe9_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n char *buf = NULL;\n \n+\n+\n+ nfs_co_init_task(client, &task);\n+\n+\n \n buf = g_try_malloc(nb_sectors * BDRV_SECTOR_SIZE);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int coroutine_fn nfs_co_writev(BlockDriverState *bs,\n\n int64_t sector_num, int nb_sectors,\n\n QEMUIOVector *iov)\n\n{\n\n NFSClient *client = bs->opaque;\n\n NFSRPC task;\n\n char *buf = NULL;\n\n\n\n nfs_co_init_task(client, &task);\n\n\n\n buf = g_try_malloc(nb_sectors * BDRV_SECTOR_SIZE);\n\n if (nb_sectors && buf == NULL) {\n\n return -ENOMEM;\n\n }\n\n\n\n qemu_iovec_to_buf(iov, 0, buf, nb_sectors * BDRV_SECTOR_SIZE);\n\n\n\n if (nfs_pwrite_async(client->context, client->fh,\n\n sector_num * BDRV_SECTOR_SIZE,\n\n nb_sectors * BDRV_SECTOR_SIZE,\n\n buf, nfs_co_generic_cb, &task) != 0) {\n\n g_free(buf);\n\n return -ENOMEM;\n\n }\n\n\n\n while (!task.complete) {\n\n nfs_set_events(client);\n\n qemu_coroutine_yield();\n\n }\n\n\n\n g_free(buf);\n\n\n\n if (task.ret != nb_sectors * BDRV_SECTOR_SIZE) {\n\n return task.ret < 0 ? task.ret : -EIO;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "fff39a7ad09da07ef490de05c92c91f22f8002f2_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n err = pdu_unmarshal(pdu, offset, \"dds\", &fid, &newdirfid, &name);\n if (err < 0) {\n fidp = get_fid(pdu, fid);\n+ if (fidp == NULL) {\n+ BUG_ON(fidp->fid_type != P9_FID_NONE);\n+ /* if fs driver is not path based, return EOPNOTSUPP */\n+ if (!(pdu->s->ctx.export_flags & V9FS_PATHNAME_FSCONTEXT)) {\n+ err = -EOPNOTSUPP;\n goto out;\n v9fs_path_write_lock(s);\n err = v9fs_complete_rename(pdu, fidp, newdirfid, &name);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void v9fs_rename(void *opaque)\n{\n int32_t fid;\n ssize_t err = 0;\n size_t offset = 7;\n V9fsString name;\n int32_t newdirfid;\n V9fsFidState *fidp;\n V9fsPDU *pdu = opaque;\n V9fsState *s = pdu->s;\n v9fs_string_init(&name);\n err = pdu_unmarshal(pdu, offset, \"dds\", &fid, &newdirfid, &name);\n if (err < 0) {\n fidp = get_fid(pdu, fid);\n if (fidp == NULL) {\n BUG_ON(fidp->fid_type != P9_FID_NONE);\n /* if fs driver is not path based, return EOPNOTSUPP */\n if (!(pdu->s->ctx.export_flags & V9FS_PATHNAME_FSCONTEXT)) {\n err = -EOPNOTSUPP;\n goto out;\n v9fs_path_write_lock(s);\n err = v9fs_complete_rename(pdu, fidp, newdirfid, &name);\n v9fs_path_unlock(s);\n if (!err) {\n err = offset;\nout:\n put_fid(pdu, fidp);\nout_nofid:\n pdu_complete(pdu, err);\n v9fs_string_free(&name);"}} {"sample_id": "344dc16fae0cb6a011aa5befffc8e7d520b11d5d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n void virtio_queue_aio_set_host_notifier_handler(VirtQueue *vq, AioContext *ctx,\n \n+ bool assign, bool set_handler)\n \n {\n \n if (assign && set_handler) {\n+\n aio_set_event_notifier(ctx, &vq->host_notifier, true,\n \n virtio_queue_host_notifier_read);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void virtio_queue_aio_set_host_notifier_handler(VirtQueue *vq, AioContext *ctx,\n\n bool assign, bool set_handler)\n\n{\n\n if (assign && set_handler) {\n\n aio_set_event_notifier(ctx, &vq->host_notifier, true,\n\n virtio_queue_host_notifier_read);\n\n } else {\n\n aio_set_event_notifier(ctx, &vq->host_notifier, true, NULL);\n\n }\n\n if (!assign) {\n\n /* Test and clear notifier before after disabling event,\n\n * in case poll callback didn't have time to run. */\n\n virtio_queue_host_notifier_read(&vq->host_notifier);\n\n }\n\n}\n"}} {"sample_id": "4d7c71c36467331f1e0c0f17af9f371d33308a9c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void ff_interleave_add_packet(AVFormatContext *s, AVPacket *pkt,\n \n int (*compare)(AVFormatContext *, AVPacket *, AVPacket *))\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void ff_interleave_add_packet(AVFormatContext *s, AVPacket *pkt,\n\n int (*compare)(AVFormatContext *, AVPacket *, AVPacket *))\n\n{\n\n AVPacketList **next_point, *this_pktl;\n\n\n\n this_pktl = av_mallocz(sizeof(AVPacketList));\n\n this_pktl->pkt= *pkt;\n\n pkt->destruct= NULL; // do not free original but only the copy\n\n av_dup_packet(&this_pktl->pkt); // duplicate the packet if it uses non-alloced memory\n\n\n\n if(s->streams[pkt->stream_index]->last_in_packet_buffer){\n\n next_point = &(s->streams[pkt->stream_index]->last_in_packet_buffer->next);\n\n }else\n\n next_point = &s->packet_buffer;\n\n\n\n if(*next_point){\n\n if(compare(s, &s->packet_buffer_end->pkt, pkt)){\n\n while(!compare(s, &(*next_point)->pkt, pkt)){\n\n next_point= &(*next_point)->next;\n\n }\n\n goto next_non_null;\n\n }else{\n\n next_point = &(s->packet_buffer_end->next);\n\n }\n\n }\n\n assert(!*next_point);\n\n\n\n s->packet_buffer_end= this_pktl;\n\nnext_non_null:\n\n\n\n this_pktl->next= *next_point;\n\n\n\n s->streams[pkt->stream_index]->last_in_packet_buffer=\n\n *next_point= this_pktl;\n\n}\n"}} {"sample_id": "a246d06fe0dc6c2ea65e95327624b4537ff9bd0d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,10 +22,10 @@\n \n coeffs++;\n \n+ }\n+\n+ dst += stride;\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void FUNC(transquant_bypass8x8)(uint8_t *_dst, int16_t *coeffs,\n\n ptrdiff_t stride)\n\n{\n\n int x, y;\n\n pixel *dst = (pixel *)_dst;\n\n\n\n stride /= sizeof(pixel);\n\n\n\n for (y = 0; y < 8; y++) {\n\n for (x = 0; x < 8; x++) {\n\n dst[x] += *coeffs;\n\n coeffs++;\n\n }\n\n dst += stride;\n\n }\n\n}\n"}} {"sample_id": "e92f0e1910f0655a0edd8d87c5a7262d36517a89_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n void *opaque,\n \n bool is_write)\n+\n {\n \n Coroutine *co;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static BlockAIOCB *bdrv_co_aio_prw_vector(BdrvChild *child,\n\n int64_t offset,\n\n QEMUIOVector *qiov,\n\n BdrvRequestFlags flags,\n\n BlockCompletionFunc *cb,\n\n void *opaque,\n\n bool is_write)\n\n{\n\n Coroutine *co;\n\n BlockAIOCBCoroutine *acb;\n\n\n\n /* Matched by bdrv_co_complete's bdrv_dec_in_flight. */\n\n bdrv_inc_in_flight(child->bs);\n\n\n\n acb = qemu_aio_get(&bdrv_em_co_aiocb_info, child->bs, cb, opaque);\n\n acb->child = child;\n\n acb->need_bh = true;\n\n acb->req.error = -EINPROGRESS;\n\n acb->req.offset = offset;\n\n acb->req.qiov = qiov;\n\n acb->req.flags = flags;\n\n acb->is_write = is_write;\n\n\n\n co = qemu_coroutine_create(bdrv_co_do_rw, acb);\n\n qemu_coroutine_enter(co);\n\n\n\n bdrv_co_maybe_schedule_bh(acb);\n\n return &acb->common;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_94", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+bool qemu_file_is_writable(QEMUFile *f)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "bool qemu_file_is_writable(QEMUFile *f)\n\n{\n\n return f->ops->writev_buffer || f->ops->put_buffer;\n\n}\n"}} {"sample_id": "299b520cd4092be3c53f8380b81315c33927d9d3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static inline int compare_masked(uint64_t x, uint64_t y, uint64_t mask)\n+\n {\n \n return (x & mask) == (y & mask);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline int compare_masked(uint64_t x, uint64_t y, uint64_t mask)\n\n{\n\n return (x & mask) == (y & mask);\n\n}\n"}} {"sample_id": "64ffbe04eaafebf4045a3ace52a360c14959d196", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+int index_from_key(const char *key)\n \n {\n+\n int i;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int index_from_key(const char *key)\n\n{\n\n int i;\n\n\n\n for (i = 0; QKeyCode_lookup[i] != NULL; i++) {\n\n if (!strcmp(key, QKeyCode_lookup[i])) {\n\n break;\n\n }\n\n }\n\n\n\n /* Return Q_KEY_CODE__MAX if the key is invalid */\n\n return i;\n\n}\n"}} {"sample_id": "e549933a270dd2cfc36f2cf9bb6b29acf3dc6d08_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n ptrdiff_t stride)\n \n+{\n+\n avc_luma_mid_4w_msa(src - (2 * stride) - 2, stride, dst, stride, 4);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_put_h264_qpel4_mc22_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n avc_luma_mid_4w_msa(src - (2 * stride) - 2, stride, dst, stride, 4);\n\n}\n"}} {"sample_id": "a89f364ae8740dfc31b321eed9ee454e996dc3c1_33", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n printf(\"%s: recv not supported!!!\\n\", __FUNCTION__);\n+\n+ return -1;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int tosa_dac_recv(I2CSlave *s)\n\n{\n\n printf(\"%s: recv not supported!!!\\n\", __FUNCTION__);\n\n return -1;\n\n}\n"}} {"sample_id": "cfdf2c40577ed99bb19cdc05d0537e2808d77a78", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n ram_addr_t actual;\n \n+\n+\n+ actual = qemu_balloon_status();\n+\n+ if (kvm_enabled() && !kvm_has_sync_mmu())\n \n qemu_error_new(QERR_KVM_MISSING_CAP, \"synchronous MMU\", \"balloon\");\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void do_info_balloon(Monitor *mon, QObject **ret_data)\n\n{\n\n ram_addr_t actual;\n\n\n\n actual = qemu_balloon_status();\n\n if (kvm_enabled() && !kvm_has_sync_mmu())\n\n qemu_error_new(QERR_KVM_MISSING_CAP, \"synchronous MMU\", \"balloon\");\n\n else if (actual == 0)\n\n qemu_error_new(QERR_DEVICE_NOT_ACTIVE, \"balloon\");\n\n else\n\n *ret_data = qobject_from_jsonf(\"{ 'balloon': %\" PRId64 \"}\",\n\n (int64_t) actual);\n\n}\n"}} {"sample_id": "a89f364ae8740dfc31b321eed9ee454e996dc3c1_17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n switch (event) {\n \n case I2C_START_SEND:\n+\n+ s->i2c_len = 0;\n+\n+ break;\n+\n case I2C_FINISH:\n \n #ifdef VERBOSE", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int wm8750_event(I2CSlave *i2c, enum i2c_event event)\n\n{\n\n WM8750State *s = WM8750(i2c);\n\n\n\n switch (event) {\n\n case I2C_START_SEND:\n\n s->i2c_len = 0;\n\n break;\n\n case I2C_FINISH:\n\n#ifdef VERBOSE\n\n if (s->i2c_len < 2)\n\n printf(\"%s: message too short (%i bytes)\\n\",\n\n __FUNCTION__, s->i2c_len);\n\n#endif\n\n break;\n\n default:\n\n break;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n \n \n+ trace_bdrv_aio_discard(bs, sector_num, nb_sectors, opaque);\n+\n+\n+\n+ acb = qemu_aio_get(&bdrv_em_co_aiocb_info, bs, cb, opaque);\n \n acb->need_bh = true;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "BlockAIOCB *bdrv_aio_discard(BlockDriverState *bs,\n\n int64_t sector_num, int nb_sectors,\n\n BlockCompletionFunc *cb, void *opaque)\n\n{\n\n Coroutine *co;\n\n BlockAIOCBCoroutine *acb;\n\n\n\n trace_bdrv_aio_discard(bs, sector_num, nb_sectors, opaque);\n\n\n\n acb = qemu_aio_get(&bdrv_em_co_aiocb_info, bs, cb, opaque);\n\n acb->need_bh = true;\n\n acb->req.error = -EINPROGRESS;\n\n acb->req.sector = sector_num;\n\n acb->req.nb_sectors = nb_sectors;\n\n co = qemu_coroutine_create(bdrv_aio_discard_co_entry);\n\n qemu_coroutine_enter(co, acb);\n\n\n\n bdrv_co_maybe_schedule_bh(acb);\n\n return &acb->common;\n\n}\n"}} {"sample_id": "f5946dbab388050da6d9343978a38c81cce0508d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n int qemu_register_machine(QEMUMachine *m)\n \n+{\n \n TypeInfo ti = {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int qemu_register_machine(QEMUMachine *m)\n\n{\n\n TypeInfo ti = {\n\n .name = g_strconcat(m->name, TYPE_MACHINE_SUFFIX, NULL),\n\n .parent = TYPE_MACHINE,\n\n .class_init = machine_class_init,\n\n .class_data = (void *)m,\n\n };\n\n\n\n type_register(&ti);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "dad5b9ea0895c227bc9d48b7f0a6fa51eaaa8661", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n case USB_SPEED_LOW:\n \n+ case USB_SPEED_FULL:\n+\n+ case USB_SPEED_HIGH:\n+\n+ set_field(&port->portsc, PLS_U0, PORTSC_PLS);\n \n trace_usb_xhci_port_link(port->portnr, PLS_U0);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void xhci_port_reset(XHCIPort *port)\n\n{\n\n trace_usb_xhci_port_reset(port->portnr);\n\n\n\n if (!xhci_port_have_device(port)) {\n\n return;\n\n }\n\n\n\n usb_device_reset(port->uport->dev);\n\n\n\n switch (port->uport->dev->speed) {\n\n case USB_SPEED_LOW:\n\n case USB_SPEED_FULL:\n\n case USB_SPEED_HIGH:\n\n set_field(&port->portsc, PLS_U0, PORTSC_PLS);\n\n trace_usb_xhci_port_link(port->portnr, PLS_U0);\n\n port->portsc |= PORTSC_PED;\n\n break;\n\n }\n\n\n\n port->portsc &= ~PORTSC_PR;\n\n xhci_port_notify(port, PORTSC_PRC);\n\n}\n"}} {"sample_id": "ac0c14d71b68ac18f03a876028e332534e1e6a3e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n proxy->class_code = PCI_CLASS_STORAGE_SCSI;\n \n \n+\n+ if (!proxy->block.bs) {\n+\n+ error_report(\"virtio-blk-pci: drive property not set\");\n+\n \n \n vdev = virtio_blk_init(&pci_dev->qdev, &proxy->block);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int virtio_blk_init_pci(PCIDevice *pci_dev)\n\n{\n\n VirtIOPCIProxy *proxy = DO_UPCAST(VirtIOPCIProxy, pci_dev, pci_dev);\n\n VirtIODevice *vdev;\n\n\n\n if (proxy->class_code != PCI_CLASS_STORAGE_SCSI &&\n\n proxy->class_code != PCI_CLASS_STORAGE_OTHER)\n\n proxy->class_code = PCI_CLASS_STORAGE_SCSI;\n\n\n\n if (!proxy->block.bs) {\n\n error_report(\"virtio-blk-pci: drive property not set\");\n\n\n\n vdev = virtio_blk_init(&pci_dev->qdev, &proxy->block);\n\n\n\n\n vdev->nvectors = proxy->nvectors;\n\n virtio_init_pci(proxy, vdev,\n\n PCI_VENDOR_ID_REDHAT_QUMRANET,\n\n PCI_DEVICE_ID_VIRTIO_BLOCK,\n\n proxy->class_code, 0x00);\n\n /* make the actual value visible */\n\n proxy->nvectors = vdev->nvectors;\n\n return 0;\n"}} {"sample_id": "f1c2dc7c866a939c39c14729290a21309a1c8a38_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n return -1;\n \n }\n+\n+\n+\n+ if (0 == i) {\n+\n first = irq;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int spapr_allocate_irq_block(int num, bool lsi)\n\n{\n\n int first = -1;\n\n int i;\n\n\n\n for (i = 0; i < num; ++i) {\n\n int irq;\n\n\n\n irq = spapr_allocate_irq(0, lsi);\n\n if (!irq) {\n\n return -1;\n\n }\n\n\n\n if (0 == i) {\n\n first = irq;\n\n }\n\n\n\n /* If the above doesn't create a consecutive block then that's\n\n * an internal bug */\n\n assert(irq == (first + i));\n\n }\n\n\n\n return first;\n\n}\n"}} {"sample_id": "cfde4bd93100c58c0bfaed76deefb144caac488f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n tlb_update_dirty(&env->tlb_table[2][i]);\n \n #endif\n+\n+#if (NB_MMU_MODES >= 4)\n+\n+ for(i = 0; i < CPU_TLB_SIZE; i++)\n+\n tlb_update_dirty(&env->tlb_table[3][i]);\n \n #endif", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void cpu_tlb_update_dirty(CPUState *env)\n\n{\n\n int i;\n\n for(i = 0; i < CPU_TLB_SIZE; i++)\n\n tlb_update_dirty(&env->tlb_table[0][i]);\n\n for(i = 0; i < CPU_TLB_SIZE; i++)\n\n tlb_update_dirty(&env->tlb_table[1][i]);\n\n#if (NB_MMU_MODES >= 3)\n\n for(i = 0; i < CPU_TLB_SIZE; i++)\n\n tlb_update_dirty(&env->tlb_table[2][i]);\n\n#endif\n\n#if (NB_MMU_MODES >= 4)\n\n for(i = 0; i < CPU_TLB_SIZE; i++)\n\n tlb_update_dirty(&env->tlb_table[3][i]);\n\n#endif\n\n#if (NB_MMU_MODES >= 5)\n\n for(i = 0; i < CPU_TLB_SIZE; i++)\n\n tlb_update_dirty(&env->tlb_table[4][i]);\n\n#endif\n\n}\n"}} {"sample_id": "7a7aae21ccab06606cee9aba846d2e30cb616763_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n qdev_prop_set(dev, name, &value, PROP_TYPE_PTR);\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qdev_prop_set_ptr(DeviceState *dev, const char *name, void *value)\n\n{\n\n qdev_prop_set(dev, name, &value, PROP_TYPE_PTR);\n\n}\n"}} {"sample_id": "1b3e71f8ee17ced609213d9b41758110f3c026e9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void HELPER(entry)(CPUXtensaState *env, uint32_t pc, uint32_t s, uint32_t imm)\n {\n int callinc = (env->sregs[PS] & PS_CALLINC) >> PS_CALLINC_SHIFT;\n+ if (s > 3 || ((env->sregs[PS] & (PS_WOE | PS_EXCM)) ^ PS_WOE) != 0) {\n+ qemu_log(\"Illegal entry instruction(pc = %08x), PS = %08x\\n\",\n+ pc, env->sregs[PS]);\n HELPER(exception_cause)(env, pc, ILLEGAL_INSTRUCTION_CAUSE);\n } else {\n env->regs[(callinc << 2) | (s & 3)] = env->regs[s] - (imm << 3);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void HELPER(entry)(CPUXtensaState *env, uint32_t pc, uint32_t s, uint32_t imm)\n{\n int callinc = (env->sregs[PS] & PS_CALLINC) >> PS_CALLINC_SHIFT;\n if (s > 3 || ((env->sregs[PS] & (PS_WOE | PS_EXCM)) ^ PS_WOE) != 0) {\n qemu_log(\"Illegal entry instruction(pc = %08x), PS = %08x\\n\",\n pc, env->sregs[PS]);\n HELPER(exception_cause)(env, pc, ILLEGAL_INSTRUCTION_CAUSE);\n } else {\n env->regs[(callinc << 2) | (s & 3)] = env->regs[s] - (imm << 3);\n rotate_window(env, callinc);\n env->sregs[WINDOW_START] |=\n windowstart_bit(env->sregs[WINDOW_BASE], env);"}} {"sample_id": "33e66b86d89040f0a9e99aa53deb74ce8936a649", "diff": "--- a/source.c\n+++ b/source.c\n@@ -53,11 +53,11 @@\n /* Allredy attached ? */\n \n if (hostdev_find(bus_num, addr))\n+\n+ return 0;\n+\n+\n+\n dprintf(\"husb: auto open: bus_num %d addr %d\\n\", bus_num, addr);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int usb_host_auto_scan(void *opaque, int bus_num, int addr,\n\n int class_id, int vendor_id, int product_id,\n\n const char *product_name, int speed)\n\n{\n\n struct USBAutoFilter *f;\n\n struct USBDevice *dev;\n\n\n\n /* Ignore hubs */\n\n if (class_id == 9)\n\n return 0;\n\n\n\n for (f = usb_auto_filter; f; f = f->next) {\n\n\tif (f->bus_num >= 0 && f->bus_num != bus_num)\n\n continue;\n\n\n\n\tif (f->addr >= 0 && f->addr != addr)\n\n continue;\n\n\n\n\tif (f->vendor_id >= 0 && f->vendor_id != vendor_id)\n\n continue;\n\n\n\n\tif (f->product_id >= 0 && f->product_id != product_id)\n\n continue;\n\n\n\n /* We got a match */\n\n\n\n /* Allredy attached ? */\n\n if (hostdev_find(bus_num, addr))\n\n return 0;\n\n\n\n dprintf(\"husb: auto open: bus_num %d addr %d\\n\", bus_num, addr);\n\n\n\n\tdev = usb_host_device_open_addr(bus_num, addr, product_name);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d20a580bc0eac9d489884f6d2ed28105880532b6_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n btn = INPUT_BUTTON_WHEEL_DOWN;\n \n+ } else {\n+\n+ return TRUE;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static gboolean gd_scroll_event(GtkWidget *widget, GdkEventScroll *scroll,\n\n void *opaque)\n\n{\n\n VirtualConsole *vc = opaque;\n\n InputButton btn;\n\n\n\n if (scroll->direction == GDK_SCROLL_UP) {\n\n btn = INPUT_BUTTON_WHEEL_UP;\n\n } else if (scroll->direction == GDK_SCROLL_DOWN) {\n\n btn = INPUT_BUTTON_WHEEL_DOWN;\n\n } else {\n\n return TRUE;\n\n }\n\n\n\n qemu_input_queue_btn(vc->gfx.dcl.con, btn, true);\n\n qemu_input_event_sync();\n\n qemu_input_queue_btn(vc->gfx.dcl.con, btn, false);\n\n qemu_input_event_sync();\n\n return TRUE;\n\n}\n"}} {"sample_id": "bbbc39ccacf66ef58261c155f9eed503947c3023_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n \n \n \n+ if (get_dwords(q->ehci, NLPTR_GET(qtdaddr),\n+\n+ (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2) < 0) {\n+\n+ return -1;\n \n \n ehci_trace_qtd(q, NLPTR_GET(qtdaddr), &qtd);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int ehci_fill_queue(EHCIPacket *p)\n\n{\n\n USBEndpoint *ep = p->packet.ep;\n\n EHCIQueue *q = p->queue;\n\n EHCIqtd qtd = p->qtd;\n\n uint32_t qtdaddr;\n\n\n\n for (;;) {\n\n if (NLPTR_TBIT(qtd.next) != 0) {\n\n\n\n qtdaddr = qtd.next;\n\n /*\n\n * Detect circular td lists, Windows creates these, counting on the\n\n * active bit going low after execution to make the queue stop.\n\n */\n\n QTAILQ_FOREACH(p, &q->packets, next) {\n\n if (p->qtdaddr == qtdaddr) {\n\n goto leave;\n\n\n\n if (get_dwords(q->ehci, NLPTR_GET(qtdaddr),\n\n (uint32_t *) &qtd, sizeof(EHCIqtd) >> 2) < 0) {\n\n return -1;\n\n\n ehci_trace_qtd(q, NLPTR_GET(qtdaddr), &qtd);\n\n if (!(qtd.token & QTD_TOKEN_ACTIVE)) {\n\n\n\n\n\n\n\n p = ehci_alloc_packet(q);\n\n p->qtdaddr = qtdaddr;\n\n p->qtd = qtd;\n\n if (ehci_execute(p, \"queue\") == -1) {\n\n return -1;\n\n\n assert(p->packet.status == USB_RET_ASYNC);\n\n p->async = EHCI_ASYNC_INFLIGHT;\n\n\nleave:\n\n usb_device_flush_ep_queue(ep->dev, ep);\n\n return 1;\n"}} {"sample_id": "5c6c0e513600ba57c3e73b7151d3c0664438f7b5_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ assert(req->status != -1);\n \n scsi_req_ref(req);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void scsi_req_complete(SCSIRequest *req)\n\n{\n\n assert(req->status != -1);\n\n scsi_req_ref(req);\n\n scsi_req_dequeue(req);\n\n req->bus->ops->complete(req->bus, SCSI_REASON_DONE,\n\n req->tag,\n\n req->status);\n\n scsi_req_unref(req);\n\n}\n"}} {"sample_id": "4c315c27661502a0813b129e41c0bf640c34a8d6_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void fsl_imx25_class_init(ObjectClass *oc, void *data)\n+{\n DeviceClass *dc = DEVICE_CLASS(oc);\n dc->realize = fsl_imx25_realize;\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void fsl_imx25_class_init(ObjectClass *oc, void *data)\n{\n DeviceClass *dc = DEVICE_CLASS(oc);\n dc->realize = fsl_imx25_realize;\n}"}} {"sample_id": "9307c4c1d93939db9b04117b654253af5113dc21_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n BlockDriverState *bs;\n \n+ const char **parg;\n+\n+ int force;\n+\n+\n \n parg = argv + 1;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void do_eject(int argc, const char **argv)\n\n{\n\n BlockDriverState *bs;\n\n const char **parg;\n\n int force;\n\n\n\n parg = argv + 1;\n\n if (!*parg) {\n\n fail:\n\n help_cmd(argv[0]);\n\n return;\n\n }\n\n force = 0;\n\n if (!strcmp(*parg, \"-f\")) {\n\n force = 1;\n\n parg++;\n\n }\n\n if (!*parg)\n\n goto fail;\n\n bs = bdrv_find(*parg);\n\n if (!bs) {\n\n term_printf(\"device not found\\n\");\n\n return;\n\n }\n\n eject_device(bs, force);\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n int bdrv_has_zero_init_1(BlockDriverState *bs)\n \n+{\n \n return 1;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int bdrv_has_zero_init_1(BlockDriverState *bs)\n\n{\n\n return 1;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_142", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void block_migration_cancel(void *opaque)\n \n {\n+\n blk_mig_cleanup();\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void block_migration_cancel(void *opaque)\n\n{\n\n blk_mig_cleanup();\n\n}\n"}} {"sample_id": "bf87908cd8da31e8f8fe75c06577170928ea70a8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static void rm_read_metadata(AVFormatContext *s, int wide)\n \n {\n \n+ char buf[1024];\n+\n int i;\n \n for (i=0; ipb) : avio_r8(s->pb);\n\n get_strl(s->pb, buf, sizeof(buf), len);\n\n av_dict_set(&s->metadata, ff_rm_metadata[i], buf, 0);\n\n }\n\n}\n"}} {"sample_id": "0eb28a42284ec32e6f283985d2d638474a05eba4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -55,9 +55,9 @@\n if (ptrans) {\n \n *ptrans = translation;\n+\n+ }\n+\n+ trace_hd_geometry_guess(blk, *pcyls, *pheads, *psecs, translation);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void hd_geometry_guess(BlockBackend *blk,\n\n uint32_t *pcyls, uint32_t *pheads, uint32_t *psecs,\n\n int *ptrans)\n\n{\n\n int cylinders, heads, secs, translation;\n\n\n\n if (guess_disk_lchs(blk, &cylinders, &heads, &secs) < 0) {\n\n /* no LCHS guess: use a standard physical disk geometry */\n\n guess_chs_for_size(blk, pcyls, pheads, psecs);\n\n translation = hd_bios_chs_auto_trans(*pcyls, *pheads, *psecs);\n\n } else if (heads > 16) {\n\n /* LCHS guess with heads > 16 means that a BIOS LBA\n\n translation was active, so a standard physical disk\n\n geometry is OK */\n\n guess_chs_for_size(blk, pcyls, pheads, psecs);\n\n translation = *pcyls * *pheads <= 131072\n\n ? BIOS_ATA_TRANSLATION_LARGE\n\n : BIOS_ATA_TRANSLATION_LBA;\n\n } else {\n\n /* LCHS guess with heads <= 16: use as physical geometry */\n\n *pcyls = cylinders;\n\n *pheads = heads;\n\n *psecs = secs;\n\n /* disable any translation to be in sync with\n\n the logical geometry */\n\n translation = BIOS_ATA_TRANSLATION_NONE;\n\n }\n\n if (ptrans) {\n\n *ptrans = translation;\n\n }\n\n trace_hd_geometry_guess(blk, *pcyls, *pheads, *psecs, translation);\n\n}\n"}} {"sample_id": "79b78a6bd47722ce23bc74287cd6322756698f09_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,7 +20,7 @@\n \n uint64_t addr;\n \n+\n \n if (size % SPAPR_MEMORY_BLOCK_SIZE) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void spapr_memory_plug(HotplugHandler *hotplug_dev, DeviceState *dev,\n\n uint32_t node, Error **errp)\n\n{\n\n Error *local_err = NULL;\n\n sPAPRMachineState *ms = SPAPR_MACHINE(hotplug_dev);\n\n PCDIMMDevice *dimm = PC_DIMM(dev);\n\n PCDIMMDeviceClass *ddc = PC_DIMM_GET_CLASS(dimm);\n\n MemoryRegion *mr = ddc->get_memory_region(dimm);\n\n uint64_t align = memory_region_get_alignment(mr);\n\n uint64_t size = memory_region_size(mr);\n\n uint64_t addr;\n\n\n\n if (size % SPAPR_MEMORY_BLOCK_SIZE) {\n\n error_setg(&local_err, \"Hotplugged memory size must be a multiple of \"\n\n \"%lld MB\", SPAPR_MEMORY_BLOCK_SIZE/M_BYTE);\n\n goto out;\n\n }\n\n\n\n pc_dimm_memory_plug(dev, &ms->hotplug_memory, mr, align, &local_err);\n\n if (local_err) {\n\n goto out;\n\n }\n\n\n\n addr = object_property_get_int(OBJECT(dimm), PC_DIMM_ADDR_PROP, &local_err);\n\n if (local_err) {\n\n pc_dimm_memory_unplug(dev, &ms->hotplug_memory, mr);\n\n goto out;\n\n }\n\n\n\n spapr_add_lmbs(dev, addr, size, node, &error_abort);\n\n\n\nout:\n\n error_propagate(errp, local_err);\n\n}\n"}} {"sample_id": "ebca2df783a5a742bb93784524336d8cbb9e662b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n TPMInfo *info = g_new0(TPMInfo, 1);\n \n+ TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);\n+\n TPMIfClass *tic = TPM_IF_GET_CLASS(s->tpmif);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-89", "target_file": "source.c", "files": {"source.c": "TPMInfo *tpm_backend_query_tpm(TPMBackend *s)\n\n{\n\n TPMInfo *info = g_new0(TPMInfo, 1);\n\n TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);\n\n TPMIfClass *tic = TPM_IF_GET_CLASS(s->tpmif);\n\n\n\n info->id = g_strdup(s->id);\n\n info->model = tic->model;\n\n if (k->get_tpm_options) {\n\n info->options = k->get_tpm_options(s);\n\n }\n\n\n\n return info;\n\n}\n"}} {"sample_id": "433d33c555deeed375996e338df1a9510df401c6_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,10 +5,10 @@\n TCGv_i32 tmp = tcg_const_i32(dest);\n \n if (((dc->pc ^ dest) & TARGET_PAGE_MASK) != 0) {\n+\n+ slot = -1;\n+\n+ }\n \n gen_callw_slot(dc, callinc, tmp, slot);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gen_callwi(DisasContext *dc, int callinc, uint32_t dest, int slot)\n\n{\n\n TCGv_i32 tmp = tcg_const_i32(dest);\n\n if (((dc->pc ^ dest) & TARGET_PAGE_MASK) != 0) {\n\n slot = -1;\n\n }\n\n gen_callw_slot(dc, callinc, tmp, slot);\n\n tcg_temp_free(tmp);\n\n}\n"}} {"sample_id": "3494d650273e619606c6cb2c38aa9b8b7bed98e2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static size_t curl_size_cb(void *ptr, size_t size, size_t nmemb, void *opaque)\n+\n {\n+\n+ CURLState *s = ((CURLState*)opaque);\n+\n size_t realsize = size * nmemb;\n \n size_t fsize;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static size_t curl_size_cb(void *ptr, size_t size, size_t nmemb, void *opaque)\n\n{\n\n CURLState *s = ((CURLState*)opaque);\n\n size_t realsize = size * nmemb;\n\n size_t fsize;\n\n\n\n if(sscanf(ptr, \"Content-Length: %zd\", &fsize) == 1) {\n\n s->s->len = fsize;\n\n }\n\n\n\n return realsize;\n\n}\n"}} {"sample_id": "7696414729b2d0f870c80ad1dd637d854bc78847", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void decode_opc_special3(CPUMIPSState *env, DisasContext *ctx)\n {\n+ int rs, rt, rd, sa;\n+ uint32_t op1, op2;\n+ rs = (ctx->opcode >> 21) & 0x1f;\n+ rt = (ctx->opcode >> 16) & 0x1f;\n+ rd = (ctx->opcode >> 11) & 0x1f;\n sa = (ctx->opcode >> 6) & 0x1f;\n op1 = MASK_SPECIAL3(ctx->opcode);\n case OPC_EXT:", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void decode_opc_special3(CPUMIPSState *env, DisasContext *ctx)\n{\n int rs, rt, rd, sa;\n uint32_t op1, op2;\n rs = (ctx->opcode >> 21) & 0x1f;\n rt = (ctx->opcode >> 16) & 0x1f;\n rd = (ctx->opcode >> 11) & 0x1f;\n sa = (ctx->opcode >> 6) & 0x1f;\n op1 = MASK_SPECIAL3(ctx->opcode);\n case OPC_EXT:\n case OPC_INS:\n check_insn(ctx, ISA_MIPS32R2);\n gen_bitops(ctx, op1, rt, rs, sa, rd);\n break;\n case OPC_BSHFL:\n op2 = MASK_BSHFL(ctx->opcode);\n switch (op2) {\n case OPC_ALIGN ... OPC_ALIGN_END:\n case OPC_BITSWAP:\n check_insn(ctx, ISA_MIPS32R6);\n decode_opc_special3_r6(env, ctx);\n break;\n default:\n check_insn(ctx, ISA_MIPS32R2);\n gen_bshfl(ctx, op2, rt, rd);\n break;\n break;\n#if defined(TARGET_MIPS64)\n case OPC_DEXTM ... OPC_DEXT:\n case OPC_DINSM ... OPC_DINS:\n check_insn(ctx, ISA_MIPS64R2);\n check_mips_64(ctx);\n gen_bitops(ctx, op1, rt, rs, sa, rd);\n break;\n case OPC_DBSHFL:\n op2 = MASK_DBSHFL(ctx->opcode);\n switch (op2) {\n case OPC_DALIGN ... OPC_DALIGN_END:\n case OPC_DBITSWAP:\n check_insn(ctx, ISA_MIPS32R6);\n decode_opc_special3_r6(env, ctx);\n break;\n default:\n check_insn(ctx, ISA_MIPS64R2);\n check_mips_64(ctx);\n op2 = MASK_DBSHFL(ctx->opcode);\n gen_bshfl(ctx, op2, rt, rd);\n break;\n break;\n#endif\n case OPC_RDHWR:\n gen_rdhwr(ctx, rt, rd, extract32(ctx->opcode, 6, 3));\n break;\n case OPC_FORK:\n check_insn(ctx, ASE_MT);\n {\n TCGv t0 = tcg_temp_new();\n TCGv t1 = tcg_temp_new();\n gen_load_gpr(t0, rt);\n gen_load_gpr(t1, rs);\n gen_helper_fork(t0, t1);\n tcg_temp_free(t0);\n tcg_temp_free(t1);\n break;\n case OPC_YIELD:\n check_insn(ctx, ASE_MT);\n {\n TCGv t0 = tcg_temp_new();\n gen_load_gpr(t0, rs);\n gen_helper_yield(t0, cpu_env, t0);\n gen_store_gpr(t0, rd);\n tcg_temp_free(t0);\n break;\n default:\n if (ctx->insn_flags & ISA_MIPS32R6) {\n decode_opc_special3_r6(env, ctx);\n } else {\n decode_opc_special3_legacy(env, ctx);"}} {"sample_id": "cfd47a71df51047833d182e9e97244e7816b57da", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,16 +1,16 @@\n static int check_protocol_support(bool *has_ipv4, bool *has_ipv6)\n+\n+{\n+\n+ struct sockaddr_in sin = {\n+\n+ .sin_family = AF_INET,\n+\n .sin_addr = { .s_addr = htonl(INADDR_LOOPBACK) },\n+\n };\n \n+ struct sockaddr_in6 sin6 = {\n \n .sin6_family = AF_INET6,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int check_protocol_support(bool *has_ipv4, bool *has_ipv6)\n\n{\n\n struct sockaddr_in sin = {\n\n .sin_family = AF_INET,\n\n .sin_addr = { .s_addr = htonl(INADDR_LOOPBACK) },\n\n };\n\n struct sockaddr_in6 sin6 = {\n\n .sin6_family = AF_INET6,\n\n .sin6_addr = IN6ADDR_LOOPBACK_INIT,\n\n };\n\n\n\n if (check_bind((struct sockaddr *)&sin, sizeof(sin), has_ipv4) < 0) {\n\n return -1;\n\n }\n\n if (check_bind((struct sockaddr *)&sin6, sizeof(sin6), has_ipv6) < 0) {\n\n return -1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a879125b47c3ae554c01824f996a64a45a86556e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void qpci_pc_config_writeb(QPCIBus *bus, int devfn, uint8_t offset, uint8_t value)\n+\n {\n \n outl(0xcf8, (1 << 31) | (devfn << 8) | offset);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void qpci_pc_config_writeb(QPCIBus *bus, int devfn, uint8_t offset, uint8_t value)\n\n{\n\n outl(0xcf8, (1 << 31) | (devfn << 8) | offset);\n\n outb(0xcfc, value);\n\n}\n"}} {"sample_id": "439e2a6e10ed7f5da819bf7dcaa54b8cfdbeab0d_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+Aml *aml_shiftright(Aml *arg1, Aml *count)\n+\n+{\n \n Aml *var = aml_opcode(0x7A /* ShiftRightOp */);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "Aml *aml_shiftright(Aml *arg1, Aml *count)\n\n{\n\n Aml *var = aml_opcode(0x7A /* ShiftRightOp */);\n\n aml_append(var, arg1);\n\n aml_append(var, count);\n\n build_append_byte(var->buf, 0x00); /* NullNameOp */\n\n return var;\n\n}\n"}} {"sample_id": "3f50965b28d0c4ef10dde0bf2f7a9f78fa36b378", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ int i, d;\n+\n+ for( i = 0; i < 4; i++ ) {\n+\n+ const int tc = tc0[i];\n \n if( tc <= 0 ) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void h264_loop_filter_chroma_c(uint8_t *pix, int xstride, int ystride, int alpha, int beta, int8_t *tc0)\n\n{\n\n int i, d;\n\n for( i = 0; i < 4; i++ ) {\n\n const int tc = tc0[i];\n\n if( tc <= 0 ) {\n\n pix += 2*ystride;\n\n continue;\n\n }\n\n for( d = 0; d < 2; d++ ) {\n\n const int p0 = pix[-1*xstride];\n\n const int p1 = pix[-2*xstride];\n\n const int q0 = pix[0];\n\n const int q1 = pix[1*xstride];\n\n\n\n if( FFABS( p0 - q0 ) < alpha &&\n\n FFABS( p1 - p0 ) < beta &&\n\n FFABS( q1 - q0 ) < beta ) {\n\n\n\n int delta = av_clip( (((q0 - p0 ) << 2) + (p1 - q1) + 4) >> 3, -tc, tc );\n\n\n\n pix[-xstride] = av_clip_uint8( p0 + delta ); /* p0' */\n\n pix[0] = av_clip_uint8( q0 - delta ); /* q0' */\n\n }\n\n pix += ystride;\n\n }\n\n }\n\n}\n"}} {"sample_id": "f5ed36635d8fa73feb66fe12b3b9c2ed90a1adbe", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n VRingUsedElem uelem;\n trace_virtqueue_fill(vq, elem, len, idx);\n virtqueue_unmap_sg(vq, elem, len);\n+ idx = (idx + vq->used_idx) % vq->vring.num;\n+ uelem.id = elem->index;\n uelem.len = len;\n vring_used_write(vq, &uelem, idx);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,\n unsigned int len, unsigned int idx)\n{\n VRingUsedElem uelem;\n trace_virtqueue_fill(vq, elem, len, idx);\n virtqueue_unmap_sg(vq, elem, len);\n idx = (idx + vq->used_idx) % vq->vring.num;\n uelem.id = elem->index;\n uelem.len = len;\n vring_used_write(vq, &uelem, idx);"}} {"sample_id": "5942a19040fed313b316ab7b6e3d2d8e7b1625bb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n BusClass *bc = BUS_GET_CLASS(bus);\n \n Error *local_err = NULL;\n+\n \n \n if (value && !bus->realized) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void bus_set_realized(Object *obj, bool value, Error **errp)\n\n{\n\n BusState *bus = BUS(obj);\n\n BusClass *bc = BUS_GET_CLASS(bus);\n\n Error *local_err = NULL;\n\n\n\n if (value && !bus->realized) {\n\n if (bc->realize) {\n\n bc->realize(bus, &local_err);\n\n }\n\n } else if (!value && bus->realized) {\n\n if (bc->unrealize) {\n\n bc->unrealize(bus, &local_err);\n\n }\n\n }\n\n\n\n if (local_err != NULL) {\n\n error_propagate(errp, local_err);\n\n return;\n\n }\n\n\n\n bus->realized = value;\n\n}\n"}} {"sample_id": "1f99939a6361e2e6d6788494dd7c682b051c6c34", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n int ff_j2k_dwt_init(DWTContext *s, uint16_t border[2][2], int decomp_levels, int type)\n \n+{\n \n int i, j, lev = decomp_levels, maxlen,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int ff_j2k_dwt_init(DWTContext *s, uint16_t border[2][2], int decomp_levels, int type)\n\n{\n\n int i, j, lev = decomp_levels, maxlen,\n\n b[2][2];\n\n\n\n if (decomp_levels >= FF_DWT_MAX_DECLVLS)\n\n return AVERROR_INVALIDDATA;\n\n s->ndeclevels = decomp_levels;\n\n s->type = type;\n\n\n\n for (i = 0; i < 2; i++)\n\n for(j = 0; j < 2; j++)\n\n b[i][j] = border[i][j];\n\n\n\n maxlen = FFMAX(b[0][1] - b[0][0],\n\n b[1][1] - b[1][0]);\n\n\n\n while(--lev >= 0){\n\n for (i = 0; i < 2; i++){\n\n s->linelen[lev][i] = b[i][1] - b[i][0];\n\n s->mod[lev][i] = b[i][0] & 1;\n\n for (j = 0; j < 2; j++)\n\n b[i][j] = (b[i][j] + 1) >> 1;\n\n }\n\n }\n\n if (type == FF_DWT97)\n\n s->linebuf = av_malloc((maxlen + 12) * sizeof(float));\n\n else if (type == FF_DWT53)\n\n s->linebuf = av_malloc((maxlen + 6) * sizeof(int));\n\n else\n\n return -1;\n\n\n\n if (!s->linebuf)\n\n return AVERROR(ENOMEM);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "af7e9e74c6a62a5bcd911726a9e88d28b61490e0_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n unsigned len)\n \n+{\n \n OpenPICState *opp = opaque;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void openpic_tmr_write(void *opaque, hwaddr addr, uint64_t val,\n\n unsigned len)\n\n{\n\n OpenPICState *opp = opaque;\n\n int idx;\n\n\n\n DPRINTF(\"%s: addr %08x <= %08x\\n\", __func__, addr, val);\n\n if (addr & 0xF)\n\n return;\n\n idx = (addr >> 6) & 0x3;\n\n addr = addr & 0x30;\n\n\n\n if (addr == 0x0) {\n\n /* TIFR (TFRR) */\n\n opp->tifr = val;\n\n return;\n\n }\n\n switch (addr & 0x30) {\n\n case 0x00: /* TICC (GTCCR) */\n\n break;\n\n case 0x10: /* TIBC (GTBCR) */\n\n if ((opp->timers[idx].ticc & TICC_TOG) != 0 &&\n\n (val & TIBC_CI) == 0 &&\n\n (opp->timers[idx].tibc & TIBC_CI) != 0) {\n\n opp->timers[idx].ticc &= ~TICC_TOG;\n\n }\n\n opp->timers[idx].tibc = val;\n\n break;\n\n case 0x20: /* TIVP (GTIVPR) */\n\n write_IRQreg_ipvp(opp, opp->irq_tim0 + idx, val);\n\n break;\n\n case 0x30: /* TIDE (GTIDR) */\n\n write_IRQreg_ide(opp, opp->irq_tim0 + idx, val);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "deb2db996cbb9470b39ae1e383791ef34c4eb3c2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n bool arm_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)\n+\n {\n \n return regime_using_lpae_format(env, mmu_idx);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool arm_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)\n\n{\n\n return regime_using_lpae_format(env, mmu_idx);\n\n}\n"}} {"sample_id": "15c2f669e3fb2bc97f7b42d1871f595c0ac24af8_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void qmp_input_pop(QmpInputVisitor *qiv, Error **errp)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void qmp_input_pop(QmpInputVisitor *qiv, Error **errp)\n\n{\n\n StackObject *tos = &qiv->stack[qiv->nb_stack - 1];\n\n assert(qiv->nb_stack > 0);\n\n\n\n if (qiv->strict) {\n\n GHashTable *const top_ht = tos->h;\n\n if (top_ht) {\n\n GHashTableIter iter;\n\n const char *key;\n\n\n\n g_hash_table_iter_init(&iter, top_ht);\n\n if (g_hash_table_iter_next(&iter, (void **)&key, NULL)) {\n\n error_setg(errp, QERR_QMP_EXTRA_MEMBER, key);\n\n }\n\n g_hash_table_unref(top_ht);\n\n }\n\n tos->h = NULL;\n\n }\n\n\n\n qiv->nb_stack--;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_91", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n address_space_rw(as, addr, buf, len, false);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void address_space_read(AddressSpace *as, target_phys_addr_t addr, uint8_t *buf, int len)\n\n{\n\n address_space_rw(as, addr, buf, len, false);\n\n}\n"}} {"sample_id": "55e1819c509b3d9c10a54678b9c585bbda13889e_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void qfloat_destroy_obj(QObject *obj)\n+\n {\n \n assert(obj != NULL);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qfloat_destroy_obj(QObject *obj)\n\n{\n\n assert(obj != NULL);\n\n g_free(qobject_to_qfloat(obj));\n\n}\n"}} {"sample_id": "187337f8b0ec0813dd3876d1efe37d415fb81c2e_18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,7 +18,7 @@\n \n s->irq_enabled = 0;\n \n+ s->oldclock = 0;\n \n s->clock = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static pxa2xx_timer_info *pxa2xx_timer_init(target_phys_addr_t base,\n\n qemu_irq *irqs)\n\n{\n\n int i;\n\n int iomemtype;\n\n pxa2xx_timer_info *s;\n\n\n\n s = (pxa2xx_timer_info *) qemu_mallocz(sizeof(pxa2xx_timer_info));\n\n s->base = base;\n\n s->irq_enabled = 0;\n\n s->oldclock = 0;\n\n s->clock = 0;\n\n s->lastload = qemu_get_clock(vm_clock);\n\n s->reset3 = 0;\n\n\n\n for (i = 0; i < 4; i ++) {\n\n s->timer[i].value = 0;\n\n s->timer[i].irq = irqs[i];\n\n s->timer[i].info = s;\n\n s->timer[i].num = i;\n\n s->timer[i].level = 0;\n\n s->timer[i].qtimer = qemu_new_timer(vm_clock,\n\n pxa2xx_timer_tick, &s->timer[i]);\n\n }\n\n\n\n iomemtype = cpu_register_io_memory(0, pxa2xx_timer_readfn,\n\n pxa2xx_timer_writefn, s);\n\n cpu_register_physical_memory(base, 0x00000fff, iomemtype);\n\n\n\n register_savevm(\"pxa2xx_timer\", 0, 0,\n\n pxa2xx_timer_save, pxa2xx_timer_load, s);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "b946a1533209f61a93e34898aebb5b43154b99c3_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,17 +1,17 @@\n void net_cleanup(void)\n+\n {\n+\n+#if !defined(_WIN32)\n+\n+ VLANState *vlan;\n+\n \n+\n+ /* close network clients */\n+\n for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {\n+\n VLANClientState *vc;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void net_cleanup(void)\n\n{\n\n#if !defined(_WIN32)\n\n VLANState *vlan;\n\n\n\n /* close network clients */\n\n for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {\n\n VLANClientState *vc;\n\n\n\n for(vc = vlan->first_client; vc != NULL; vc = vc->next) {\n\n if (vc->fd_read == tap_receive) {\n\n TAPState *s = vc->opaque;\n\n\n\n if (s->down_script[0])\n\n launch_script(s->down_script, s->down_script_arg, s->fd);\n\n }\n\n#if defined(CONFIG_VDE)\n\n if (vc->fd_read == vde_from_qemu) {\n\n VDEState *s = vc->opaque;\n\n vde_close(s->vde);\n\n }\n\n#endif\n\n }\n\n }\n\n#endif\n\n}\n"}} {"sample_id": "90fc00a623de44e137fe1601b91356e8cd8bdd54_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n const char *ptr = p->buf;\n \n+ const char *ptr_end = p->buf + p->buf_size;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int mpsub_probe(AVProbeData *p)\n\n{\n\n const char *ptr = p->buf;\n\n const char *ptr_end = p->buf + p->buf_size;\n\n\n\n while (ptr < ptr_end) {\n\n if (!memcmp(ptr, \"FORMAT=TIME\", 11))\n\n return AVPROBE_SCORE_EXTENSION;\n\n if (!memcmp(ptr, \"FORMAT=\", 7))\n\n return AVPROBE_SCORE_EXTENSION / 3;\n\n ptr += strcspn(ptr, \"\\n\") + 1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "58d479786b11a7e982419c1e0905b8490ef9a787", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static uint64_t bonito_cop_readl(void *opaque, hwaddr addr,\n unsigned size)\n {\n uint32_t val;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint64_t bonito_cop_readl(void *opaque, hwaddr addr,\n unsigned size)\n{\n uint32_t val;\n PCIBonitoState *s = opaque;\n val = ((uint32_t *)(&s->boncop))[addr/sizeof(uint32_t)];\n return val;"}} {"sample_id": "68aefbe81cb3b9dd002108782bb8d798e1c12806", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void stream_pause(VideoState *is)\n+\n+{\n \n+ is->paused = !is->paused;\n \n+ if (!is->paused) {\n+\n if(is->read_pause_return != AVERROR(ENOSYS)){\n \n is->video_current_pts = get_video_clock(is);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void stream_pause(VideoState *is)\n\n{\n\n is->paused = !is->paused;\n\n if (!is->paused) {\n\n if(is->read_pause_return != AVERROR(ENOSYS)){\n\n is->video_current_pts = get_video_clock(is);\n\n }\n\n\n\n is->frame_timer += (av_gettime() - is->video_current_pts_time) / 1000000.0;\n\n is->video_current_pts_time= av_gettime();\n\n }\n\n}\n"}} {"sample_id": "a3084e8055067b3fe8ed653a609021d2ab368564", "diff": "--- a/source.c\n+++ b/source.c\n@@ -46,11 +46,11 @@\n \n src |= a2 & ~TARGET_PAGE_MASK;\n \n+\n+\n+ /* XXX replace w/ memcpy */\n+\n+ for (i = 0; i < l; i++) {\n \n /* XXX be more clever */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t mvc_asc(CPUS390XState *env, int64_t l, uint64_t a1,\n\n uint64_t mode1, uint64_t a2, uint64_t mode2)\n\n{\n\n CPUState *cs = CPU(s390_env_get_cpu(env));\n\n target_ulong src, dest;\n\n int flags, cc = 0, i;\n\n\n\n if (!l) {\n\n return 0;\n\n } else if (l > 256) {\n\n /* max 256 */\n\n l = 256;\n\n cc = 3;\n\n }\n\n\n\n if (mmu_translate(env, a1, 1, mode1, &dest, &flags, true)) {\n\n cpu_loop_exit(CPU(s390_env_get_cpu(env)));\n\n }\n\n dest |= a1 & ~TARGET_PAGE_MASK;\n\n\n\n if (mmu_translate(env, a2, 0, mode2, &src, &flags, true)) {\n\n cpu_loop_exit(CPU(s390_env_get_cpu(env)));\n\n }\n\n src |= a2 & ~TARGET_PAGE_MASK;\n\n\n\n /* XXX replace w/ memcpy */\n\n for (i = 0; i < l; i++) {\n\n /* XXX be more clever */\n\n if ((((dest + i) & TARGET_PAGE_MASK) != (dest & TARGET_PAGE_MASK)) ||\n\n (((src + i) & TARGET_PAGE_MASK) != (src & TARGET_PAGE_MASK))) {\n\n mvc_asc(env, l - i, a1 + i, mode1, a2 + i, mode2);\n\n break;\n\n }\n\n stb_phys(cs->as, dest + i, ldub_phys(cs->as, src + i));\n\n }\n\n\n\n return cc;\n\n}\n"}} {"sample_id": "10ee2aaa417d8d8978cdb2bbed55ebb152df5f6b_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n qemu_put_be32s (f, &r->bdbar);\n \n qemu_put_8s (f, &r->civ);\n+\n+ qemu_put_8s (f, &r->lvi);\n+\n+ qemu_put_be16s (f, &r->sr);\n+\n qemu_put_be16s (f, &r->picb);\n \n qemu_put_8s (f, &r->piv);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ac97_save (QEMUFile *f, void *opaque)\n\n{\n\n size_t i;\n\n uint8_t active[LAST_INDEX];\n\n AC97LinkState *s = opaque;\n\n\n\n pci_device_save (s->pci_dev, f);\n\n\n\n qemu_put_be32s (f, &s->glob_cnt);\n\n qemu_put_be32s (f, &s->glob_sta);\n\n qemu_put_be32s (f, &s->cas);\n\n\n\n for (i = 0; i < ARRAY_SIZE (s->bm_regs); ++i) {\n\n AC97BusMasterRegs *r = &s->bm_regs[i];\n\n qemu_put_be32s (f, &r->bdbar);\n\n qemu_put_8s (f, &r->civ);\n\n qemu_put_8s (f, &r->lvi);\n\n qemu_put_be16s (f, &r->sr);\n\n qemu_put_be16s (f, &r->picb);\n\n qemu_put_8s (f, &r->piv);\n\n qemu_put_8s (f, &r->cr);\n\n qemu_put_be32s (f, &r->bd_valid);\n\n qemu_put_be32s (f, &r->bd.addr);\n\n qemu_put_be32s (f, &r->bd.ctl_len);\n\n }\n\n qemu_put_buffer (f, s->mixer_data, sizeof (s->mixer_data));\n\n\n\n active[PI_INDEX] = AUD_is_active_in (s->voice_pi) ? 1 : 0;\n\n active[PO_INDEX] = AUD_is_active_out (s->voice_po) ? 1 : 0;\n\n active[MC_INDEX] = AUD_is_active_in (s->voice_mc) ? 1 : 0;\n\n qemu_put_buffer (f, active, sizeof (active));\n\n}\n"}} {"sample_id": "03cef34aa66662e2ab3681d290e7c5a6634f4058_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n \n hwctx_dec = av_qsv_alloc_context();\n \n+ if (!hwctx_dec)\n+\n+ return AVERROR(ENOMEM);\n+\n+\n \n hwctx_dec->session = qsv->session;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qsv_init(AVCodecContext *s)\n\n{\n\n InputStream *ist = s->opaque;\n\n QSVContext *qsv = ist->hwaccel_ctx;\n\n AVQSVContext *hwctx_dec;\n\n int ret;\n\n\n\n if (!qsv) {\n\n av_log(NULL, AV_LOG_ERROR, \"QSV transcoding is not initialized. \"\n\n \"-hwaccel qsv should only be used for one-to-one QSV transcoding \"\n\n \"with no filters.\\n\");\n\n return AVERROR_BUG;\n\n }\n\n\n\n ret = init_opaque_surf(qsv);\n\n if (ret < 0)\n\n return ret;\n\n\n\n hwctx_dec = av_qsv_alloc_context();\n\n if (!hwctx_dec)\n\n return AVERROR(ENOMEM);\n\n\n\n hwctx_dec->session = qsv->session;\n\n hwctx_dec->iopattern = MFX_IOPATTERN_OUT_OPAQUE_MEMORY;\n\n hwctx_dec->ext_buffers = qsv->ext_buffers;\n\n hwctx_dec->nb_ext_buffers = FF_ARRAY_ELEMS(qsv->ext_buffers);\n\n\n\n av_freep(&s->hwaccel_context);\n\n s->hwaccel_context = hwctx_dec;\n\n\n\n ist->hwaccel_get_buffer = qsv_get_buffer;\n\n ist->hwaccel_uninit = qsv_uninit;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "0c6b9b9fe5edb7b4307e1705bac7f1087262a6fb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n {\n \n RTSPState *rt = s->priv_data;\n+\n int idx = 0;\n \n int ret = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static inline int read_line(AVFormatContext *s, char *rbuf, const int rbufsize,\n\n int *rbuflen)\n\n{\n\n RTSPState *rt = s->priv_data;\n\n int idx = 0;\n\n int ret = 0;\n\n *rbuflen = 0;\n\n\n\n do {\n\n ret = ffurl_read_complete(rt->rtsp_hd, rbuf + idx, 1);\n\n if (ret < 0)\n\n return ret;\n\n if (rbuf[idx] == '\\r') {\n\n /* Ignore */\n\n } else if (rbuf[idx] == '\\n') {\n\n rbuf[idx] = '\\0';\n\n *rbuflen = idx;\n\n return 0;\n\n } else\n\n idx++;\n\n } while (idx < rbufsize);\n\n av_log(s, AV_LOG_ERROR, \"Message too long\\n\");\n\n return AVERROR(EIO);\n\n}\n"}} {"sample_id": "6687b79d636cd60ed9adb1177d0d946b58fa7717_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+int net_init_vde(QemuOpts *opts, const char *name, VLANState *vlan)\n \n {\n \n@@ -7,7 +7,7 @@\n const char *group;\n \n int port, mode;\n+\n \n \n sock = qemu_opt_get(opts, \"sock\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int net_init_vde(QemuOpts *opts, const char *name, VLANState *vlan)\n\n{\n\n const char *sock;\n\n const char *group;\n\n int port, mode;\n\n\n\n sock = qemu_opt_get(opts, \"sock\");\n\n group = qemu_opt_get(opts, \"group\");\n\n\n\n port = qemu_opt_get_number(opts, \"port\", 0);\n\n mode = qemu_opt_get_number(opts, \"mode\", 0700);\n\n\n\n if (net_vde_init(vlan, \"vde\", name, sock, port, group, mode) == -1) {\n\n return -1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "ffa48cf5ab719e1e181e51b87bc0f5d397b791fa_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n #ifdef HAS_AUDIO\n \n+ return 1;\n+\n+#else\n \n return 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int audio_available(void)\n\n{\n\n#ifdef HAS_AUDIO\n\n return 1;\n\n#else\n\n return 0;\n\n#endif\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_332", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n \n \n+ memory_region_init_io(&s->iomem, &omap_lpg_ops, s, \"omap-lpg\", 0x800);\n+\n+ memory_region_add_subregion(system_memory, base, &s->iomem);\n+\n+\n \n omap_clk_adduser(clk, qemu_allocate_irqs(omap_lpg_clk_update, s, 1)[0]);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static struct omap_lpg_s *omap_lpg_init(MemoryRegion *system_memory,\n\n target_phys_addr_t base, omap_clk clk)\n\n{\n\n struct omap_lpg_s *s = (struct omap_lpg_s *)\n\n g_malloc0(sizeof(struct omap_lpg_s));\n\n\n\n s->tm = qemu_new_timer_ms(vm_clock, omap_lpg_tick, s);\n\n\n\n omap_lpg_reset(s);\n\n\n\n memory_region_init_io(&s->iomem, &omap_lpg_ops, s, \"omap-lpg\", 0x800);\n\n memory_region_add_subregion(system_memory, base, &s->iomem);\n\n\n\n omap_clk_adduser(clk, qemu_allocate_irqs(omap_lpg_clk_update, s, 1)[0]);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "367790cce8e14131426f5190dfd7d1bdbf656e4d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,19 +1,19 @@\n+DISAS_INSN(shift_im)\n+\n+{\n+\n TCGv reg;\n+\n+ int tmp;\n+\n+ TCGv shift;\n+\n+\n \n+ set_cc_op(s, CC_OP_FLAGS);\n+\n \n+\n reg = DREG(insn, 0);\n \n tmp = (insn >> 9) & 7;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "DISAS_INSN(shift_im)\n\n{\n\n TCGv reg;\n\n int tmp;\n\n TCGv shift;\n\n\n\n set_cc_op(s, CC_OP_FLAGS);\n\n\n\n reg = DREG(insn, 0);\n\n tmp = (insn >> 9) & 7;\n\n if (tmp == 0)\n\n tmp = 8;\n\n shift = tcg_const_i32(tmp);\n\n /* No need to flush flags becuse we know we will set C flag. */\n\n if (insn & 0x100) {\n\n gen_helper_shl_cc(reg, cpu_env, reg, shift);\n\n } else {\n\n if (insn & 8) {\n\n gen_helper_shr_cc(reg, cpu_env, reg, shift);\n\n } else {\n\n gen_helper_sar_cc(reg, cpu_env, reg, shift);\n\n }\n\n }\n\n}\n"}} {"sample_id": "e1f8c729fa890c67bb4532f22c22ace6fb0e1aaf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n for (i = 0; i < 4; i ++) {\n \n s->timer[i].value = 0;\n+\n+ s->timer[i].irq = irqs[i];\n+\n+ s->timer[i].info = s;\n+\n s->timer[i].num = i;\n \n s->timer[i].level = 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static pxa2xx_timer_info *pxa2xx_timer_init(target_phys_addr_t base,\n\n qemu_irq *irqs)\n\n{\n\n int i;\n\n int iomemtype;\n\n pxa2xx_timer_info *s;\n\n\n\n s = (pxa2xx_timer_info *) qemu_mallocz(sizeof(pxa2xx_timer_info));\n\n s->irq_enabled = 0;\n\n s->oldclock = 0;\n\n s->clock = 0;\n\n s->lastload = qemu_get_clock(vm_clock);\n\n s->reset3 = 0;\n\n\n\n for (i = 0; i < 4; i ++) {\n\n s->timer[i].value = 0;\n\n s->timer[i].irq = irqs[i];\n\n s->timer[i].info = s;\n\n s->timer[i].num = i;\n\n s->timer[i].level = 0;\n\n s->timer[i].qtimer = qemu_new_timer(vm_clock,\n\n pxa2xx_timer_tick, &s->timer[i]);\n\n }\n\n\n\n iomemtype = cpu_register_io_memory(pxa2xx_timer_readfn,\n\n pxa2xx_timer_writefn, s, DEVICE_NATIVE_ENDIAN);\n\n cpu_register_physical_memory(base, 0x00001000, iomemtype);\n\n\n\n register_savevm(NULL, \"pxa2xx_timer\", 0, 0,\n\n pxa2xx_timer_save, pxa2xx_timer_load, s);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "2b09f94cdbf5c54e2278d7f3aed2eceff3494790", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n wt2 = float32_to_int32(fst0, &env->active_fpu.fp_status);\n \n update_fcr31(env, GETPC());\n+\n+ if (get_float_exception_flags(&env->active_fpu.fp_status)\n+\n+ & (float_flag_invalid | float_flag_overflow)) {\n+\n wt2 = FP_TO_INT32_OVERFLOW;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint32_t helper_float_cvtw_s(CPUMIPSState *env, uint32_t fst0)\n\n{\n\n uint32_t wt2;\n\n\n\n wt2 = float32_to_int32(fst0, &env->active_fpu.fp_status);\n\n update_fcr31(env, GETPC());\n\n if (get_float_exception_flags(&env->active_fpu.fp_status)\n\n & (float_flag_invalid | float_flag_overflow)) {\n\n wt2 = FP_TO_INT32_OVERFLOW;\n\n }\n\n return wt2;\n\n}\n"}} {"sample_id": "b7680cb6078bd7294a3dd86473d3f2fdee991dd0_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n int old_mask;\n \n \n+\n+ old_mask = env->interrupt_request;\n+\n+ env->interrupt_request |= mask;\n+\n \n \n #ifndef CONFIG_USER_ONLY", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void cpu_interrupt(CPUState *env, int mask)\n\n{\n\n int old_mask;\n\n\n\n old_mask = env->interrupt_request;\n\n env->interrupt_request |= mask;\n\n\n\n#ifndef CONFIG_USER_ONLY\n\n /*\n\n * If called from iothread context, wake the target cpu in\n\n * case its halted.\n\n */\n\n if (!qemu_cpu_self(env)) {\n\n qemu_cpu_kick(env);\n\n return;\n\n }\n\n#endif\n\n\n\n if (use_icount) {\n\n env->icount_decr.u16.high = 0xffff;\n\n#ifndef CONFIG_USER_ONLY\n\n if (!can_do_io(env)\n\n && (mask & ~old_mask) != 0) {\n\n cpu_abort(env, \"Raised interrupt while not in I/O function\");\n\n }\n\n#endif\n\n } else {\n\n cpu_unlink_tb(env);\n\n }\n\n}\n"}} {"sample_id": "4295e15aa730a95003a3639d6dad2eb1e65a59e2_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n #if SPICE_INTERFACE_QXL_MINOR >= 1\n \n spice_qxl_add_memslot_async(&ssd->qxl, memslot, 0);\n+\n+#else\n+\n+ abort();\n+\n #endif\n \n } else {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_spice_add_memslot(SimpleSpiceDisplay *ssd, QXLDevMemSlot *memslot,\n\n qxl_async_io async)\n\n{\n\n if (async != QXL_SYNC) {\n\n#if SPICE_INTERFACE_QXL_MINOR >= 1\n\n spice_qxl_add_memslot_async(&ssd->qxl, memslot, 0);\n\n#else\n\n abort();\n\n#endif\n\n } else {\n\n ssd->worker->add_memslot(ssd->worker, memslot);\n\n }\n\n}\n"}} {"sample_id": "88266f5aa70fa71fd5cc20aa4dbeb7a7bd8d2e92", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void bdrv_io_limits_enable(BlockDriverState *bs)\n \n+{\n+\n qemu_co_queue_init(&bs->throttled_reqs);\n \n bs->block_timer = qemu_new_timer_ns(vm_clock, bdrv_block_timer, bs);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bdrv_io_limits_enable(BlockDriverState *bs)\n\n{\n\n qemu_co_queue_init(&bs->throttled_reqs);\n\n bs->block_timer = qemu_new_timer_ns(vm_clock, bdrv_block_timer, bs);\n\n bs->io_limits_enabled = true;\n\n}\n"}} {"sample_id": "3c99afc779c2c78718a565ad8c5e98de7c2c7484", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n PCIDevice *d = PCI_DEVICE(s);\n vmxnet_tx_pkt_init(&s->tx_pkt, s->max_tx_frags, s->peer_has_vhdr);\n vmxnet_rx_pkt_init(&s->rx_pkt, s->peer_has_vhdr);\n+ if (s->msix_used) {\n+ if (!vmxnet3_use_msix_vectors(s, VMXNET3_MAX_INTRS)) {\n+ VMW_WRPRN(\"Failed to re-use MSI-X vectors\");\n+ msix_uninit(d, &s->msix_bar, &s->msix_bar);\n s->msix_used = false;\n return -1;\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int vmxnet3_post_load(void *opaque, int version_id)\n{\n VMXNET3State *s = opaque;\n PCIDevice *d = PCI_DEVICE(s);\n vmxnet_tx_pkt_init(&s->tx_pkt, s->max_tx_frags, s->peer_has_vhdr);\n vmxnet_rx_pkt_init(&s->rx_pkt, s->peer_has_vhdr);\n if (s->msix_used) {\n if (!vmxnet3_use_msix_vectors(s, VMXNET3_MAX_INTRS)) {\n VMW_WRPRN(\"Failed to re-use MSI-X vectors\");\n msix_uninit(d, &s->msix_bar, &s->msix_bar);\n s->msix_used = false;\n return -1;\n }\n }\n return 0;\n}"}} {"sample_id": "37ad223c515da2fe9f1c679768cb5ccaa42e57e1_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n table_data, &tcpa->log_area_start_address,\n \n sizeof(tcpa->log_area_start_address));\n+\n+\n+\n+ build_header(linker, table_data,\n+\n (void *)tcpa, \"TCPA\", sizeof(*tcpa), 2, NULL);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "build_tpm_tcpa(GArray *table_data, GArray *linker, GArray *tcpalog)\n\n{\n\n Acpi20Tcpa *tcpa = acpi_data_push(table_data, sizeof *tcpa);\n\n uint64_t log_area_start_address = acpi_data_len(tcpalog);\n\n\n\n tcpa->platform_class = cpu_to_le16(TPM_TCPA_ACPI_CLASS_CLIENT);\n\n tcpa->log_area_minimum_length = cpu_to_le32(TPM_LOG_AREA_MINIMUM_SIZE);\n\n tcpa->log_area_start_address = cpu_to_le64(log_area_start_address);\n\n\n\n bios_linker_loader_alloc(linker, ACPI_BUILD_TPMLOG_FILE, 1,\n\n false /* high memory */);\n\n\n\n /* log area start address to be filled by Guest linker */\n\n bios_linker_loader_add_pointer(linker, ACPI_BUILD_TABLE_FILE,\n\n ACPI_BUILD_TPMLOG_FILE,\n\n table_data, &tcpa->log_area_start_address,\n\n sizeof(tcpa->log_area_start_address));\n\n\n\n build_header(linker, table_data,\n\n (void *)tcpa, \"TCPA\", sizeof(*tcpa), 2, NULL);\n\n\n\n acpi_data_push(tcpalog, TPM_LOG_AREA_MINIMUM_SIZE);\n\n}\n"}} {"sample_id": "9ef91a677110ec200d7b2904fc4bcae5a77329ad_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n return qemu_paio_submit(aiocb, QEMU_PAIO_IOCTL);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_paio_ioctl(struct qemu_paiocb *aiocb)\n\n{\n\n return qemu_paio_submit(aiocb, QEMU_PAIO_IOCTL);\n\n}\n"}} {"sample_id": "0b5538c300a56c3cfb33022840fe0b4968147e7a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,18 +1,18 @@\n static void trace(TraceEventID event, uint64_t x1, uint64_t x2, uint64_t x3,\n+\n uint64_t x4, uint64_t x5, uint64_t x6)\n \n {\n+\n+ TraceRecord *rec = &trace_buf[trace_idx];\n+\n+\n+\n+ if (!trace_list[event].state) {\n+\n+ return;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void trace(TraceEventID event, uint64_t x1, uint64_t x2, uint64_t x3,\n\n uint64_t x4, uint64_t x5, uint64_t x6)\n\n{\n\n TraceRecord *rec = &trace_buf[trace_idx];\n\n\n\n if (!trace_list[event].state) {\n\n return;\n\n }\n\n\n\n rec->event = event;\n\n rec->timestamp_ns = get_clock();\n\n rec->x1 = x1;\n\n rec->x2 = x2;\n\n rec->x3 = x3;\n\n rec->x4 = x4;\n\n rec->x5 = x5;\n\n rec->x6 = x6;\n\n\n\n if (++trace_idx == TRACE_BUF_LEN) {\n\n st_flush_trace_buffer();\n\n }\n\n}\n"}} {"sample_id": "e4fc8781db7c49b0c5ac5d24762e17c59dfe0871_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,9 +7,9 @@\n QEDRequest *request = read_l2_table_cb->request;\n \n BDRVQEDState *s = read_l2_table_cb->s;\n+\n CachedL2Table *l2_table = request->l2_table;\n+\n \n \n if (ret) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void qed_read_l2_table_cb(void *opaque, int ret)\n\n{\n\n QEDReadL2TableCB *read_l2_table_cb = opaque;\n\n QEDRequest *request = read_l2_table_cb->request;\n\n BDRVQEDState *s = read_l2_table_cb->s;\n\n CachedL2Table *l2_table = request->l2_table;\n\n\n\n if (ret) {\n\n /* can't trust loaded L2 table anymore */\n\n qed_unref_l2_cache_entry(l2_table);\n\n request->l2_table = NULL;\n\n } else {\n\n l2_table->offset = read_l2_table_cb->l2_offset;\n\n\n\n qed_commit_l2_cache_entry(&s->l2_cache, l2_table);\n\n\n\n /* This is guaranteed to succeed because we just committed the entry\n\n * to the cache.\n\n */\n\n request->l2_table = qed_find_l2_cache_entry(&s->l2_cache,\n\n l2_table->offset);\n\n assert(request->l2_table != NULL);\n\n }\n\n\n\n gencb_complete(&read_l2_table_cb->gencb, ret);\n\n}\n"}} {"sample_id": "b57ed9bf075e33cdd2f9eb545ff555301dd57221", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n uint64_t subch_id = args[0];\n \n+ uint64_t queue = args[1];\n+\n+ SubchDev *sch;\n+\n+ int cssid, ssid, schid, m;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int virtio_ccw_hcall_notify(const uint64_t *args)\n\n{\n\n uint64_t subch_id = args[0];\n\n uint64_t queue = args[1];\n\n SubchDev *sch;\n\n int cssid, ssid, schid, m;\n\n\n\n if (ioinst_disassemble_sch_ident(subch_id, &m, &cssid, &ssid, &schid)) {\n\n\n\n sch = css_find_subch(m, cssid, ssid, schid);\n\n if (!sch || !css_subch_visible(sch)) {\n\n\n\n\n\n\n virtio_queue_notify(virtio_ccw_get_vdev(sch), queue);\n\n return 0;\n\n\n"}} {"sample_id": "ed1c83508ec920bfef773e3aa3ac1764a65826ec", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,10 +26,10 @@\n \n return ret;\n \n+ }\n+\n+\n+\n+ return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int request_frame(AVFilterLink *outlink)\n\n{\n\n AVFilterContext *ctx = outlink->src;\n\n TrimContext *s = ctx->priv;\n\n int ret;\n\n\n\n s->got_output = 0;\n\n while (!s->got_output) {\n\n if (s->eof)\n\n return AVERROR_EOF;\n\n\n\n ret = ff_request_frame(ctx->inputs[0]);\n\n if (ret < 0)\n\n return ret;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_40", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n return 0;\n \n+ }\n+\n+\n+\n+ reg = addr >> s->it_shift;\n \n return read_register(s, reg);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t dp8393x_readw(void *opaque, target_phys_addr_t addr)\n\n{\n\n dp8393xState *s = opaque;\n\n int reg;\n\n\n\n if ((addr & ((1 << s->it_shift) - 1)) != 0) {\n\n return 0;\n\n }\n\n\n\n reg = addr >> s->it_shift;\n\n return read_register(s, reg);\n\n}\n"}} {"sample_id": "ec45bbe5f1921c6553fbf9c0c76b358b0403c22d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n envlist_to_environ(const envlist_t *envlist, size_t *count)\n \n {\n+\n+\tstruct envlist_entry *entry;\n \n \tchar **env, **penv;\n+\n \n \n \tpenv = env = malloc((envlist->el_count + 1) * sizeof (char *));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "envlist_to_environ(const envlist_t *envlist, size_t *count)\n\n{\n\n\tstruct envlist_entry *entry;\n\n\tchar **env, **penv;\n\n\n\n\tpenv = env = malloc((envlist->el_count + 1) * sizeof (char *));\n\n\tif (env == NULL)\n\n\t\treturn (NULL);\n\n\n\n\tfor (entry = envlist->el_entries.lh_first; entry != NULL;\n\n\t entry = entry->ev_link.le_next) {\n\n\t\t*(penv++) = strdup(entry->ev_var);\n\n\t}\n\n\t*penv = NULL; /* NULL terminate the list */\n\n\n\n\tif (count != NULL)\n\n\t\t*count = envlist->el_count;\n\n\n\n\treturn (env);\n\n}\n"}} {"sample_id": "8bb376cf6b4ab8645daedb8becaa7163656436a4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n int ascii_diff, digit_diff;\n+\n+\n+\n+ for (; !(ascii_diff = *a - *b) && *a; a++, b++);\n \n for (; av_isdigit(*a) && av_isdigit(*b); a++, b++);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int cmp_func_names(const char *a, const char *b)\n\n{\n\n int ascii_diff, digit_diff;\n\n\n\n for (; !(ascii_diff = *a - *b) && *a; a++, b++);\n\n for (; av_isdigit(*a) && av_isdigit(*b); a++, b++);\n\n\n\n return (digit_diff = av_isdigit(*a) - av_isdigit(*b)) ? digit_diff : ascii_diff;\n\n}\n"}} {"sample_id": "f225003d17364cd38fd28f268ae2b29abd8e5024", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,7 +14,7 @@\n \n uint32_t code = AV_RL32(block + 12);\n \n+\n \n extract_color(colors, color0, color1, 1, 0);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void dxt3_block_internal(uint8_t *dst, ptrdiff_t stride,\n\n const uint8_t *block)\n\n{\n\n int x, y;\n\n uint32_t colors[4];\n\n uint16_t color0 = AV_RL16(block + 8);\n\n uint16_t color1 = AV_RL16(block + 10);\n\n uint32_t code = AV_RL32(block + 12);\n\n\n\n extract_color(colors, color0, color1, 1, 0);\n\n\n\n for (y = 0; y < 4; y++) {\n\n const uint16_t alpha_code = AV_RL16(block + 2 * y);\n\n uint8_t alpha_values[4];\n\n\n\n alpha_values[0] = ((alpha_code >> 0) & 0x0F) * 17;\n\n alpha_values[1] = ((alpha_code >> 4) & 0x0F) * 17;\n\n alpha_values[2] = ((alpha_code >> 8) & 0x0F) * 17;\n\n alpha_values[3] = ((alpha_code >> 12) & 0x0F) * 17;\n\n\n\n for (x = 0; x < 4; x++) {\n\n uint8_t alpha = alpha_values[x];\n\n uint32_t pixel = colors[code & 3] | (alpha << 24);\n\n code >>= 2;\n\n\n\n AV_WL32(dst + x * 4, pixel);\n\n }\n\n dst += stride;\n\n }\n\n}\n"}} {"sample_id": "2da0d70d5eebe42f9fcd27ee554419ebe2a5da06_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,17 +1,17 @@\n static inline void RENAME(rgb32ToUV)(uint8_t *dstU, uint8_t *dstV, uint8_t *src1, uint8_t *src2, int width)\n+\n+{\n+\n \tint i;\n+\n+ assert(src1==src2);\n+\n+\tfor(i=0; i>8;\n\n\t\tconst int b= l>>16;\n\n\n\n\t\tdstU[i]= ((RU*r + GU*g + BU*b)>>(RGB2YUV_SHIFT+1)) + 128;\n\n\t\tdstV[i]= ((RV*r + GV*g + BV*b)>>(RGB2YUV_SHIFT+1)) + 128;\n\n\t}\n\n}\n"}} {"sample_id": "b55519a0f29fca0ef7ebc5d87ee4bfa7304dc219", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static target_ulong put_tce_emu(sPAPRTCETable *tcet, target_ulong ioba,\n \n target_ulong tce)\n+\n {\n \n sPAPRTCE *tcep;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static target_ulong put_tce_emu(sPAPRTCETable *tcet, target_ulong ioba,\n\n target_ulong tce)\n\n{\n\n sPAPRTCE *tcep;\n\n\n\n if (ioba >= tcet->window_size) {\n\n hcall_dprintf(\"spapr_vio_put_tce on out-of-boards IOBA 0x\"\n\n TARGET_FMT_lx \"\\n\", ioba);\n\n return H_PARAMETER;\n\n }\n\n\n\n tcep = tcet->table + (ioba >> SPAPR_TCE_PAGE_SHIFT);\n\n tcep->tce = tce;\n\n\n\n return H_SUCCESS;\n\n}\n"}} {"sample_id": "22b37f5d3200cfe4c15eded883663cf0612093c1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n f = &f1;\n \n if (url_fopen(f, filename, URL_RDONLY) < 0)\n+\n+ return -EIO;\n+\n+ } else {\n+\n f = &s1->pb;\n \n if (url_feof(f))", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int img_read_packet(AVFormatContext *s1, AVPacket *pkt)\n\n{\n\n VideoData *s = s1->priv_data;\n\n char filename[1024];\n\n int ret;\n\n ByteIOContext f1, *f;\n\n\n\n if (!s->is_pipe) {\n\n if (get_frame_filename(filename, sizeof(filename),\n\n s->path, s->img_number) < 0)\n\n return -EIO;\n\n f = &f1;\n\n if (url_fopen(f, filename, URL_RDONLY) < 0)\n\n return -EIO;\n\n } else {\n\n f = &s1->pb;\n\n if (url_feof(f))\n\n return -EIO;\n\n }\n\n\n\n av_new_packet(pkt, s->img_size);\n\n pkt->stream_index = 0;\n\n\n\n s->ptr = pkt->data;\n\n ret = av_read_image(f, filename, s->img_fmt, read_packet_alloc_cb, s);\n\n if (!s->is_pipe) {\n\n url_fclose(f);\n\n }\n\n\n\n if (ret < 0) {\n\n av_free_packet(pkt);\n\n return -EIO; /* signal EOF */\n\n } else {\n\n pkt->pts = av_rescale((int64_t)s->img_number * s1->streams[0]->codec.frame_rate_base, s1->pts_den, s1->streams[0]->codec.frame_rate) / s1->pts_num;\n\n s->img_number++;\n\n return 0;\n\n }\n\n}\n"}} {"sample_id": "31ca6d077c24b7aaa322d8930e3e5debbdb4a047_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+int bdrv_open_backing_file(BlockDriverState *bs)\n \n {\n \n@@ -6,7 +6,7 @@\n \n int back_flags, ret;\n \n+ BlockDriver *back_drv = NULL;\n \n \n \n@@ -15,7 +15,7 @@\n return 0;\n \n }\n+\n \n \n bs->open_flags &= ~BDRV_O_NO_BACKING;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int bdrv_open_backing_file(BlockDriverState *bs)\n\n{\n\n char backing_filename[PATH_MAX];\n\n int back_flags, ret;\n\n BlockDriver *back_drv = NULL;\n\n\n\n if (bs->backing_hd != NULL) {\n\n return 0;\n\n }\n\n\n\n bs->open_flags &= ~BDRV_O_NO_BACKING;\n\n if (bs->backing_file[0] == '\\0') {\n\n return 0;\n\n }\n\n\n\n bs->backing_hd = bdrv_new(\"\");\n\n bdrv_get_full_backing_filename(bs, backing_filename,\n\n sizeof(backing_filename));\n\n\n\n if (bs->backing_format[0] != '\\0') {\n\n back_drv = bdrv_find_format(bs->backing_format);\n\n }\n\n\n\n /* backing files always opened read-only */\n\n back_flags = bs->open_flags & ~(BDRV_O_RDWR | BDRV_O_SNAPSHOT);\n\n\n\n ret = bdrv_open(bs->backing_hd, backing_filename, NULL,\n\n back_flags, back_drv);\n\n if (ret < 0) {\n\n bdrv_delete(bs->backing_hd);\n\n bs->backing_hd = NULL;\n\n bs->open_flags |= BDRV_O_NO_BACKING;\n\n return ret;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "0ac7cc2af500b948510f2481c22e84a57b0a2447_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ QString *qstring = qstring_from_str(\"destroy test\");\n+\n QDECREF(qstring);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "START_TEST(qstring_destroy_test)\n\n{\n\n QString *qstring = qstring_from_str(\"destroy test\");\n\n QDECREF(qstring);\n\n}\n"}} {"sample_id": "0b8b8753e4d94901627b3e86431230f2319215c4_43", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ struct IscsiTask *iTask = opaque;\n \n iTask->complete = 1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void iscsi_retry_timer_expired(void *opaque)\n\n{\n\n struct IscsiTask *iTask = opaque;\n\n iTask->complete = 1;\n\n if (iTask->co) {\n\n qemu_coroutine_enter(iTask->co, NULL);\n\n }\n\n}\n"}} {"sample_id": "a8f2e5c8fffbaf7fbd4f0efc8efbeebade78008f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static void virtio_scsi_handle_cmd(VirtIODevice *vdev, VirtQueue *vq)\n+\n {\n \n+ /* use non-QOM casts in the data path */\n+\n VirtIOSCSI *s = (VirtIOSCSI *)vdev;\n \n VirtIOSCSIReq *req, *next;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void virtio_scsi_handle_cmd(VirtIODevice *vdev, VirtQueue *vq)\n\n{\n\n /* use non-QOM casts in the data path */\n\n VirtIOSCSI *s = (VirtIOSCSI *)vdev;\n\n VirtIOSCSIReq *req, *next;\n\n QTAILQ_HEAD(, VirtIOSCSIReq) reqs = QTAILQ_HEAD_INITIALIZER(reqs);\n\n\n\n if (s->ctx && !s->dataplane_started) {\n\n virtio_scsi_dataplane_start(s);\n\n return;\n\n }\n\n while ((req = virtio_scsi_pop_req(s, vq))) {\n\n if (virtio_scsi_handle_cmd_req_prepare(s, req)) {\n\n QTAILQ_INSERT_TAIL(&reqs, req, next);\n\n }\n\n }\n\n\n\n QTAILQ_FOREACH_SAFE(req, &reqs, next, next) {\n\n virtio_scsi_handle_cmd_req_submit(s, req);\n\n }\n\n}\n"}} {"sample_id": "788cf9f8c8cbda53843e060540f3e91a060eb744", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static bool key_is_missing(const BlockInfo *bdev)\n+\n {\n \n return (bdev->inserted && bdev->inserted->encryption_key_missing);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static bool key_is_missing(const BlockInfo *bdev)\n\n{\n\n return (bdev->inserted && bdev->inserted->encryption_key_missing);\n\n}\n"}} {"sample_id": "7372c2b926200db295412efbb53f93773b7f1754_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static inline void qemu_assert(int cond, const char *msg)\n+\n+{\n+\n if (!cond) {\n \n fprintf (stderr, \"badness: %s\\n\", msg);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static inline void qemu_assert(int cond, const char *msg)\n\n{\n\n if (!cond) {\n\n fprintf (stderr, \"badness: %s\\n\", msg);\n\n abort();\n\n }\n\n}\n"}} {"sample_id": "db486cc334aafd3dbdaf107388e37fc3d6d3e171_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static gint range_compare(gconstpointer a, gconstpointer b)\n+\n+{\n+\n+ Range *ra = (Range *)a, *rb = (Range *)b;\n+\n if (ra->begin == rb->begin && ra->end == rb->end) {\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static gint range_compare(gconstpointer a, gconstpointer b)\n\n{\n\n Range *ra = (Range *)a, *rb = (Range *)b;\n\n if (ra->begin == rb->begin && ra->end == rb->end) {\n\n return 0;\n\n } else if (range_get_last(ra->begin, ra->end) <\n\n range_get_last(rb->begin, rb->end)) {\n\n return -1;\n\n } else {\n\n return 1;\n\n }\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n void do_adde (void)\n+\n {\n+\n+ T2 = T0;\n \n+ T0 += T1 + xer_ca;\n \n if (likely(!(T0 < T2 || (xer_ca == 1 && T0 == T2)))) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void do_adde (void)\n\n{\n\n T2 = T0;\n\n T0 += T1 + xer_ca;\n\n if (likely(!(T0 < T2 || (xer_ca == 1 && T0 == T2)))) {\n\n xer_ca = 0;\n\n } else {\n\n xer_ca = 1;\n\n }\n\n}\n"}} {"sample_id": "5a571d324129ce367584ad9d92aae1d286f389a2_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n {\n \n AVStream *stream;\n+\n AVCodecContext *codec;\n \n const char *p = line;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int parse_h264_sdp_line(AVFormatContext *s, int st_index,\n\n PayloadContext *h264_data, const char *line)\n\n{\n\n AVStream *stream;\n\n AVCodecContext *codec;\n\n const char *p = line;\n\n\n\n if (st_index < 0)\n\n return 0;\n\n\n\n stream = s->streams[st_index];\n\n codec = stream->codec;\n\n assert(h264_data->cookie == MAGIC_COOKIE);\n\n\n\n if (av_strstart(p, \"framesize:\", &p)) {\n\n char buf1[50];\n\n char *dst = buf1;\n\n\n\n // remove the protocol identifier..\n\n while (*p && *p == ' ') p++; // strip spaces.\n\n while (*p && *p != ' ') p++; // eat protocol identifier\n\n while (*p && *p == ' ') p++; // strip trailing spaces.\n\n while (*p && *p != '-' && (dst - buf1) < sizeof(buf1) - 1) {\n\n *dst++ = *p++;\n\n }\n\n *dst = '\\0';\n\n\n\n // a='framesize:96 320-240'\n\n // set our parameters..\n\n codec->width = atoi(buf1);\n\n codec->height = atoi(p + 1); // skip the -\n\n codec->pix_fmt = PIX_FMT_YUV420P;\n\n } else if (av_strstart(p, \"fmtp:\", &p)) {\n\n return ff_parse_fmtp(stream, h264_data, p, sdp_parse_fmtp_config_h264);\n\n } else if (av_strstart(p, \"cliprect:\", &p)) {\n\n // could use this if we wanted.\n\n }\n\n\n\n return 0; // keep processing it the normal way...\n\n}\n"}} {"sample_id": "f53c398aa603cea135ee58fd15249aeff7b9c7ea_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void usb_cancel_packet(USBPacket * p)\n+\n+{\n+\n assert(p->owner != NULL);\n \n usb_device_cancel_packet(p->owner->dev, p);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void usb_cancel_packet(USBPacket * p)\n\n{\n\n assert(p->owner != NULL);\n\n usb_device_cancel_packet(p->owner->dev, p);\n\n p->owner = NULL;\n\n}\n"}} {"sample_id": "287c181ae4132d7cc75ea422051f2c90e90b6493", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n agc->parent_realize(dev, &local_err);\n \n if (local_err) {\n+\n+ error_propagate(errp, local_err);\n+\n+ return;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void arm_gic_realize(DeviceState *dev, Error **errp)\n\n{\n\n /* Device instance realize function for the GIC sysbus device */\n\n GICv3State *s = ARM_GICV3(dev);\n\n ARMGICv3Class *agc = ARM_GICV3_GET_CLASS(s);\n\n Error *local_err = NULL;\n\n\n\n agc->parent_realize(dev, &local_err);\n\n if (local_err) {\n\n error_propagate(errp, local_err);\n\n return;\n\n }\n\n\n\n gicv3_init_irqs_and_mmio(s, gicv3_set_irq, NULL);\n\n}\n"}} {"sample_id": "210461c0a83a5625560fa1d92229200dc7fb869b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n for(y=0;y<(height-2);y+=2) {\n \n deinterlace_line_inplace(buf,src_m1,src_0,src_p1,src_p2,width);\n+\n+ src_m1 = src_p1;\n+\n+ src_0 = src_p2;\n+\n src_p1 += 2*src_wrap;\n \n src_p2 += 2*src_wrap;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void deinterlace_bottom_field_inplace(uint8_t *src1, int src_wrap,\n\n int width, int height)\n\n{\n\n uint8_t *src_m1, *src_0, *src_p1, *src_p2;\n\n int y;\n\n uint8_t *buf;\n\n buf = av_malloc(width);\n\n\n\n src_m1 = src1;\n\n memcpy(buf,src_m1,width);\n\n src_0=&src_m1[src_wrap];\n\n src_p1=&src_0[src_wrap];\n\n src_p2=&src_p1[src_wrap];\n\n for(y=0;y<(height-2);y+=2) {\n\n deinterlace_line_inplace(buf,src_m1,src_0,src_p1,src_p2,width);\n\n src_m1 = src_p1;\n\n src_0 = src_p2;\n\n src_p1 += 2*src_wrap;\n\n src_p2 += 2*src_wrap;\n\n }\n\n /* do last line */\n\n deinterlace_line_inplace(buf,src_m1,src_0,src_0,src_0,width);\n\n av_free(buf);\n\n}\n"}} {"sample_id": "12f8def0e02232d7c6416ad9b66640f973c531d1_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void qemu_mutex_destroy(QemuMutex *mutex)\n+\n+{\n \n assert(mutex->owner == 0);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void qemu_mutex_destroy(QemuMutex *mutex)\n\n{\n\n assert(mutex->owner == 0);\n\n DeleteCriticalSection(&mutex->lock);\n\n}\n"}} {"sample_id": "e122636562218b3d442cd2cd18fbc188dd9ce709_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+void migration_set_incoming_channel(MigrationState *s,\n+\n+ QIOChannel *ioc)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void migration_set_incoming_channel(MigrationState *s,\n\n QIOChannel *ioc)\n\n{\n\n QEMUFile *f = qemu_fopen_channel_input(ioc);\n\n\n\n process_incoming_migration(f);\n\n}\n"}} {"sample_id": "95129d6fc9ead97155627a4ca0cfd37282883658_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n }\n \n if (enable) {\n+\n+ /* Expose avail event/used flags before caller checks the avail idx. */\n+\n+ smp_mb();\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void virtio_queue_set_notification(VirtQueue *vq, int enable)\n\n{\n\n vq->notification = enable;\n\n if (virtio_has_feature(vq->vdev, VIRTIO_RING_F_EVENT_IDX)) {\n\n vring_set_avail_event(vq, vring_avail_idx(vq));\n\n } else if (enable) {\n\n vring_used_flags_unset_bit(vq, VRING_USED_F_NO_NOTIFY);\n\n } else {\n\n vring_used_flags_set_bit(vq, VRING_USED_F_NO_NOTIFY);\n\n }\n\n if (enable) {\n\n /* Expose avail event/used flags before caller checks the avail idx. */\n\n smp_mb();\n\n }\n\n}\n"}} {"sample_id": "6fae8c5443d4fa40fe65f67138f4dbb731f23d72", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n UnsharpContext *unsharp = ctx->priv;\n \n+ int lmsize_x = 5, cmsize_x = 0;\n \n int lmsize_y = 5, cmsize_y = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static av_cold int init(AVFilterContext *ctx, const char *args, void *opaque)\n\n{\n\n UnsharpContext *unsharp = ctx->priv;\n\n int lmsize_x = 5, cmsize_x = 0;\n\n int lmsize_y = 5, cmsize_y = 0;\n\n double lamount = 1.0f, camount = 0.0f;\n\n\n\n if (args)\n\n sscanf(args, \"%d:%d:%lf:%d:%d:%lf\", &lmsize_x, &lmsize_y, &lamount,\n\n &cmsize_x, &cmsize_y, &camount);\n\n\n\n if (lmsize_x < 2 || lmsize_y < 2 || cmsize_x < 2 || cmsize_y < 2) {\n\n av_log(ctx, AV_LOG_ERROR,\n\n \"Invalid value <2 for lmsize_x:%d or lmsize_y:%d or cmsize_x:%d or cmsize_y:%d\\n\",\n\n lmsize_x, lmsize_y, cmsize_x, cmsize_y);\n\n return AVERROR(EINVAL);\n\n }\n\n\n\n set_filter_param(&unsharp->luma, lmsize_x, lmsize_y, lamount);\n\n set_filter_param(&unsharp->chroma, cmsize_x, cmsize_y, camount);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "6c87e3d5967a1d731b5f591a8f0ee6c319c14ca8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n \n \n sbd = SYS_BUS_DEVICE(dev);\n+\n+ sysbus_mmio_map(sbd, 0, ctl_addr);\n+\n+ sysbus_mmio_map(sbd, 1, data_addr);\n+\n \n \n return FW_CFG(dev);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "FWCfgState *fw_cfg_init_mem(hwaddr ctl_addr, hwaddr data_addr)\n\n{\n\n DeviceState *dev;\n\n SysBusDevice *sbd;\n\n\n\n dev = qdev_create(NULL, TYPE_FW_CFG_MEM);\n\n qdev_prop_set_uint32(dev, \"data_width\",\n\n fw_cfg_data_mem_ops.valid.max_access_size);\n\n\n\n fw_cfg_init1(dev);\n\n\n\n sbd = SYS_BUS_DEVICE(dev);\n\n sysbus_mmio_map(sbd, 0, ctl_addr);\n\n sysbus_mmio_map(sbd, 1, data_addr);\n\n\n\n return FW_CFG(dev);\n\n}\n"}} {"sample_id": "d68a6f3a6deb2f5eee198b6fa46877a20227d86e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n \n \n+ tmp = new_tmp();\n+\n+ tmp2 = new_tmp();\n+\n+\n \n tcg_gen_andi_i32(tmp, t0, 0xffff);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gen_neon_zip_u16(TCGv t0, TCGv t1)\n\n{\n\n TCGv tmp, tmp2;\n\n\n\n tmp = new_tmp();\n\n tmp2 = new_tmp();\n\n\n\n tcg_gen_andi_i32(tmp, t0, 0xffff);\n\n tcg_gen_shli_i32(tmp2, t1, 16);\n\n tcg_gen_or_i32(tmp, tmp, tmp2);\n\n tcg_gen_andi_i32(t1, t1, 0xffff0000);\n\n tcg_gen_shri_i32(tmp2, t0, 16);\n\n tcg_gen_or_i32(t1, t1, tmp2);\n\n tcg_gen_mov_i32(t0, tmp);\n\n\n\n dead_tmp(tmp2);\n\n dead_tmp(tmp);\n\n}\n"}} {"sample_id": "6892d145a0c80249bd61ee7dd31ec851c5076bcd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static int film_read_close(AVFormatContext *s)\n+\n+{\n+\n+ FilmDemuxContext *film = s->priv_data;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int film_read_close(AVFormatContext *s)\n\n{\n\n FilmDemuxContext *film = s->priv_data;\n\n\n\n av_free(film->sample_table);\n\n av_free(film->stereo_buffer);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "486637af8ef29ec215e0e0b7ecd3b5470f0e04e5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static inline void mix_3f_to_stereo(AC3DecodeContext *ctx)\n+\n+{\n+\n+ int i;\n+\n float (*output)[256] = ctx->audio_block.block_output;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void mix_3f_to_stereo(AC3DecodeContext *ctx)\n\n{\n\n int i;\n\n float (*output)[256] = ctx->audio_block.block_output;\n\n\n\n for (i = 0; i < 256; i++) {\n\n output[1][i] += output[2][i];\n\n output[2][i] += output[3][i];\n\n }\n\n memset(output[3], 0, sizeof(output[3]));\n\n}\n"}} {"sample_id": "e54165aa392322bbeeb823fc33a17336e465b7b5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n TTAContext *c = s->priv_data;\n \n+ AVStream *st = s->streams[stream_index];\n \n int index = av_index_search_timestamp(st, timestamp, flags);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int tta_read_seek(AVFormatContext *s, int stream_index, int64_t timestamp, int flags)\n\n{\n\n TTAContext *c = s->priv_data;\n\n AVStream *st = s->streams[stream_index];\n\n int index = av_index_search_timestamp(st, timestamp, flags);\n\n if (index < 0)\n\n return -1;\n\n\n\n c->currentframe = index;\n\n avio_seek(s->pb, st->index_entries[index].pos, SEEK_SET);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d4fce24f3a59eda081cdf2e38e7001591b95d173", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+int qtest_init(void)\n+\n+{\n+\n CharDriverState *chr;\n \n \n@@ -14,7 +14,7 @@\n \n chr = qemu_chr_new(\"qtest\", qtest_chrdev, NULL);\n \n+\n \n qemu_chr_add_handlers(chr, qtest_can_read, qtest_read, qtest_event, chr);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int qtest_init(void)\n\n{\n\n CharDriverState *chr;\n\n\n\n g_assert(qtest_chrdev != NULL);\n\n\n\n configure_icount(\"0\");\n\n chr = qemu_chr_new(\"qtest\", qtest_chrdev, NULL);\n\n\n\n qemu_chr_add_handlers(chr, qtest_can_read, qtest_read, qtest_event, chr);\n\n qemu_chr_fe_set_echo(chr, true);\n\n\n\n inbuf = g_string_new(\"\");\n\n\n\n if (qtest_log) {\n\n if (strcmp(qtest_log, \"none\") != 0) {\n\n qtest_log_fp = fopen(qtest_log, \"w+\");\n\n }\n\n } else {\n\n qtest_log_fp = stderr;\n\n }\n\n\n\n qtest_chr = chr;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "63f0f45f2e89b60ff8245fec81328ddfde42a303_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -42,8 +42,8 @@\n \n timer_del(&s->timer);\n \n+\n+\n+ g_free(s->url);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void curl_close(BlockDriverState *bs)\n\n{\n\n BDRVCURLState *s = bs->opaque;\n\n int i;\n\n\n\n DPRINTF(\"CURL: Close\\n\");\n\n for (i=0; istates[i].in_use)\n\n curl_clean_state(&s->states[i]);\n\n if (s->states[i].curl) {\n\n curl_easy_cleanup(s->states[i].curl);\n\n s->states[i].curl = NULL;\n\n }\n\n if (s->states[i].orig_buf) {\n\n g_free(s->states[i].orig_buf);\n\n s->states[i].orig_buf = NULL;\n\n }\n\n }\n\n if (s->multi)\n\n curl_multi_cleanup(s->multi);\n\n\n\n timer_del(&s->timer);\n\n\n\n g_free(s->url);\n\n}\n"}} {"sample_id": "ce5b1bbf624b977a55ff7f85bb3871682d03baff_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n CPUState *cs = CPU(obj);\n \n+ UniCore32CPU *cpu = UNICORE32_CPU(obj);\n \n CPUUniCore32State *env = &cpu->env;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void uc32_cpu_initfn(Object *obj)\n\n{\n\n CPUState *cs = CPU(obj);\n\n UniCore32CPU *cpu = UNICORE32_CPU(obj);\n\n CPUUniCore32State *env = &cpu->env;\n\n static bool inited;\n\n\n\n cs->env_ptr = env;\n\n cpu_exec_init(cs, &error_abort);\n\n\n\n#ifdef CONFIG_USER_ONLY\n\n env->uncached_asr = ASR_MODE_USER;\n\n env->regs[31] = 0;\n\n#else\n\n env->uncached_asr = ASR_MODE_PRIV;\n\n env->regs[31] = 0x03000000;\n\n#endif\n\n\n\n tlb_flush(cs, 1);\n\n\n\n if (tcg_enabled() && !inited) {\n\n inited = true;\n\n uc32_translate_init();\n\n }\n\n}\n"}} {"sample_id": "1ad9f0a464fe78d30ee60b3629f7a825cf2fab13_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n return;\n \n+ }\n+\n+\n+\n+ pte_index *= HASH_PTE_SIZE_64;\n \n if (env->external_htab) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ppc_hash64_store_hpte(PowerPCCPU *cpu,\n\n target_ulong pte_index,\n\n target_ulong pte0, target_ulong pte1)\n\n{\n\n CPUPPCState *env = &cpu->env;\n\n\n\n if (env->external_htab == MMU_HASH64_KVM_MANAGED_HPT) {\n\n kvmppc_hash64_write_pte(env, pte_index, pte0, pte1);\n\n return;\n\n }\n\n\n\n pte_index *= HASH_PTE_SIZE_64;\n\n if (env->external_htab) {\n\n stq_p(env->external_htab + pte_index, pte0);\n\n stq_p(env->external_htab + pte_index + HASH_PTE_SIZE_64 / 2, pte1);\n\n } else {\n\n stq_phys(CPU(cpu)->as, env->htab_base + pte_index, pte0);\n\n stq_phys(CPU(cpu)->as,\n\n env->htab_base + pte_index + HASH_PTE_SIZE_64 / 2, pte1);\n\n }\n\n}\n"}} {"sample_id": "ca9567e23454ca94e3911710da4e953ad049b40f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n QObject *data;\n \n+ Monitor *mon = opaque;\n+\n+\n+\n+ json_message_parser_init(&mon->mc->parser, handle_qmp_command);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void monitor_control_event(void *opaque, int event)\n\n{\n\n if (event == CHR_EVENT_OPENED) {\n\n QObject *data;\n\n Monitor *mon = opaque;\n\n\n\n json_message_parser_init(&mon->mc->parser, handle_qmp_command);\n\n\n\n data = qobject_from_jsonf(\"{ 'QMP': { 'capabilities': [] } }\");\n\n assert(data != NULL);\n\n\n\n monitor_json_emitter(mon, data);\n\n qobject_decref(data);\n\n }\n\n}\n"}} {"sample_id": "da8242e2d6f85d95239082efd0e5e2345e685a2c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n while (src_size--)\n+\n+ *dst++ = *src++ + 128;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void raw_decode(uint8_t *dst, const int8_t *src, int src_size)\n\n{\n\n while (src_size--)\n\n *dst++ = *src++ + 128;\n\n}\n"}} {"sample_id": "048c74c4379789d03c857cea038ec00d95b68eaf_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n if (version_id != 1)\n \n return -EINVAL;\n+\n+\n+\n+ qemu_get_buffer(f, s->cmos_data, 128);\n+\n qemu_get_8s(f, &s->cmos_index);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int rtc_load(QEMUFile *f, void *opaque, int version_id)\n\n{\n\n RTCState *s = opaque;\n\n\n\n if (version_id != 1)\n\n return -EINVAL;\n\n\n\n qemu_get_buffer(f, s->cmos_data, 128);\n\n qemu_get_8s(f, &s->cmos_index);\n\n\n\n s->current_tm.tm_sec=qemu_get_be32(f);\n\n s->current_tm.tm_min=qemu_get_be32(f);\n\n s->current_tm.tm_hour=qemu_get_be32(f);\n\n s->current_tm.tm_wday=qemu_get_be32(f);\n\n s->current_tm.tm_mday=qemu_get_be32(f);\n\n s->current_tm.tm_mon=qemu_get_be32(f);\n\n s->current_tm.tm_year=qemu_get_be32(f);\n\n\n\n qemu_get_timer(f, s->periodic_timer);\n\n s->next_periodic_time=qemu_get_be64(f);\n\n\n\n s->next_second_time=qemu_get_be64(f);\n\n qemu_get_timer(f, s->second_timer);\n\n qemu_get_timer(f, s->second_timer2);\n\n return 0;\n\n}\n"}} {"sample_id": "877f76ad33bb9b0b0d09565dd9ec1cf8e91096f1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,8 +21,8 @@\n dst2[i]=(src2[xx]*(xalpha^127)+src2[xx+1]*xalpha);\n \n xpos+=xInc;\n+\n+\n+\n+\n+", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void hcscale_fast_c(SwsContext *c, int16_t *dst1, int16_t *dst2,\n\n int dstWidth, const uint8_t *src1,\n\n const uint8_t *src2, int srcW, int xInc)\n\n{\n\n int i;\n\n unsigned int xpos=0;\n\n for (i=0;i>16;\n\n register unsigned int xalpha=(xpos&0xFFFF)>>9;\n\n dst1[i]=(src1[xx]*(xalpha^127)+src1[xx+1]*xalpha);\n\n dst2[i]=(src2[xx]*(xalpha^127)+src2[xx+1]*xalpha);\n\n xpos+=xInc;\n\n\n\n\n\n"}} {"sample_id": "2856332719d8ec182523f7793bb0517aaac68e73", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int vda_h264_uninit(AVCodecContext *avctx)\n \n+{\n+\n VDAContext *vda = avctx->internal->hwaccel_priv_data;\n \n av_freep(&vda->bitstream);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int vda_h264_uninit(AVCodecContext *avctx)\n\n{\n\n VDAContext *vda = avctx->internal->hwaccel_priv_data;\n\n av_freep(&vda->bitstream);\n\n if (vda->frame)\n\n CVPixelBufferRelease(vda->frame);\n\n return 0;\n\n}\n"}} {"sample_id": "c7269e3a2697c189c907832b8a36341cbb40936c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+static void release_buffer(AVCodecContext *avctx, AVFrame *pic)\n+\n+{\n+\n+ int i;\n+\n+\n \n CVPixelBufferRef cv_buffer = (CVPixelBufferRef)pic->data[3];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void release_buffer(AVCodecContext *avctx, AVFrame *pic)\n\n{\n\n int i;\n\n\n\n CVPixelBufferRef cv_buffer = (CVPixelBufferRef)pic->data[3];\n\n CVPixelBufferUnlockBaseAddress(cv_buffer, 0);\n\n CVPixelBufferRelease(cv_buffer);\n\n\n\n for (i = 0; i < 4; i++)\n\n pic->data[i] = NULL;\n\n}\n"}} {"sample_id": "1b71890729953825c57d52ace48a7671c295e899", "diff": "--- a/source.c\n+++ b/source.c\n@@ -53,11 +53,11 @@\n \n \n /* Copy RTAS over */\n+\n+ cpu_physical_memory_write(spapr->rtas_addr, spapr->rtas_blob,\n+\n+ spapr->rtas_size);\n+\n \n \n /* Set up the entry state */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ppc_spapr_reset(void)\n\n{\n\n sPAPRMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());\n\n PowerPCCPU *first_ppc_cpu;\n\n uint32_t rtas_limit;\n\n\n\n /* Check for unknown sysbus devices */\n\n foreach_dynamic_sysbus_device(find_unknown_sysbus_device, NULL);\n\n\n\n /* Reset the hash table & recalc the RMA */\n\n spapr_reset_htab(spapr);\n\n\n\n qemu_devices_reset();\n\n\n\n /*\n\n * We place the device tree and RTAS just below either the top of the RMA,\n\n * or just below 2GB, whichever is lowere, so that it can be\n\n * processed with 32-bit real mode code if necessary\n\n */\n\n rtas_limit = MIN(spapr->rma_size, RTAS_MAX_ADDR);\n\n spapr->rtas_addr = rtas_limit - RTAS_MAX_SIZE;\n\n spapr->fdt_addr = spapr->rtas_addr - FDT_MAX_SIZE;\n\n\n\n /* Load the fdt */\n\n spapr_finalize_fdt(spapr, spapr->fdt_addr, spapr->rtas_addr,\n\n spapr->rtas_size);\n\n\n\n /* Copy RTAS over */\n\n cpu_physical_memory_write(spapr->rtas_addr, spapr->rtas_blob,\n\n spapr->rtas_size);\n\n\n\n /* Set up the entry state */\n\n first_ppc_cpu = POWERPC_CPU(first_cpu);\n\n first_ppc_cpu->env.gpr[3] = spapr->fdt_addr;\n\n first_ppc_cpu->env.gpr[5] = 0;\n\n first_cpu->halted = 0;\n\n first_ppc_cpu->env.nip = spapr->entry_point;\n\n\n\n}\n"}} {"sample_id": "aabdc4618788a90c4a2b64a569f560d5b7378271", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,7 +12,7 @@\n \n int bit_pos, node_num, dat_pos;\n \n+\n \n prev = bit_pos = dat_pos = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void idcin_decode_vlcs(IdcinContext *s)\n\n{\n\n hnode_t *hnodes;\n\n long x, y;\n\n int prev;\n\n unsigned char v = 0;\n\n int bit_pos, node_num, dat_pos;\n\n\n\n prev = bit_pos = dat_pos = 0;\n\n for (y = 0; y < (s->frame.linesize[0] * s->avctx->height);\n\n y += s->frame.linesize[0]) {\n\n for (x = y; x < y + s->avctx->width; x++) {\n\n node_num = s->num_huff_nodes[prev];\n\n hnodes = s->huff_nodes[prev];\n\n\n\n while(node_num >= HUF_TOKENS) {\n\n if(!bit_pos) {\n\n if(dat_pos > s->size) {\n\n av_log(s->avctx, AV_LOG_ERROR, \"Huffman decode error.\\n\");\n\n return;\n\n }\n\n bit_pos = 8;\n\n v = s->buf[dat_pos++];\n\n }\n\n\n\n node_num = hnodes[node_num].children[v & 0x01];\n\n v = v >> 1;\n\n bit_pos--;\n\n }\n\n\n\n s->frame.data[0][x] = node_num;\n\n prev = node_num;\n\n }\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_280", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void pmac_ide_writel (void *opaque,\n \n+ target_phys_addr_t addr, uint32_t val)\n+\n+{\n+\n+ MACIOIDEState *d = opaque;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pmac_ide_writel (void *opaque,\n\n target_phys_addr_t addr, uint32_t val)\n\n{\n\n MACIOIDEState *d = opaque;\n\n\n\n addr = (addr & 0xFFF) >> 4;\n\n val = bswap32(val);\n\n if (addr == 0) {\n\n ide_data_writel(&d->bus, 0, val);\n\n }\n\n}\n"}} {"sample_id": "7102fa7073b2cefb33ab4012a11f15fbf297a74b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void pc_compat_1_6(MachineState *machine)\n \n+{\n+\n pc_compat_1_7(machine);\n \n rom_file_has_mr = false;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pc_compat_1_6(MachineState *machine)\n\n{\n\n pc_compat_1_7(machine);\n\n rom_file_has_mr = false;\n\n has_acpi_build = false;\n\n}\n"}} {"sample_id": "028b0da424ba85049557c61f9f0a8a6698352b41", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n if (s->vectors[irq].active) {\n \n nhand++;\n+\n+ if (nhand == 2) {\n+\n+ return 0;\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool nvic_rettobase(NVICState *s)\n\n{\n\n int irq, nhand = 0;\n\n\n\n for (irq = ARMV7M_EXCP_RESET; irq < s->num_irq; irq++) {\n\n if (s->vectors[irq].active) {\n\n nhand++;\n\n if (nhand == 2) {\n\n return 0;\n\n }\n\n }\n\n }\n\n\n\n return 1;\n\n}\n"}} {"sample_id": "8ed961d95708ee6cadac22fba7762724d533a5b4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n int64_t clock = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);\n \n+ int64_t warp_delta = clock - vm_clock_warp_start;\n+\n+ if (use_icount == 1) {\n+\n+ qemu_icount_bias += warp_delta;\n \n } else {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void icount_warp_rt(void *opaque)\n\n{\n\n if (vm_clock_warp_start == -1) {\n\n return;\n\n }\n\n\n\n if (runstate_is_running()) {\n\n int64_t clock = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);\n\n int64_t warp_delta = clock - vm_clock_warp_start;\n\n if (use_icount == 1) {\n\n qemu_icount_bias += warp_delta;\n\n } else {\n\n /*\n\n * In adaptive mode, do not let QEMU_CLOCK_VIRTUAL run too\n\n * far ahead of real time.\n\n */\n\n int64_t cur_time = cpu_get_clock();\n\n int64_t cur_icount = cpu_get_icount();\n\n int64_t delta = cur_time - cur_icount;\n\n qemu_icount_bias += MIN(warp_delta, delta);\n\n }\n\n if (qemu_clock_expired(QEMU_CLOCK_VIRTUAL)) {\n\n qemu_clock_notify(QEMU_CLOCK_VIRTUAL);\n\n }\n\n }\n\n vm_clock_warp_start = -1;\n\n}\n"}} {"sample_id": "92da23093c784b1d9f0db4db51d28ea80a59e759", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static inline int coeff_unpack_golomb(GetBitContext *gb, int qfactor, int qoffset)\n \n+{\n \n int coeff = dirac_get_se_golomb(gb);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline int coeff_unpack_golomb(GetBitContext *gb, int qfactor, int qoffset)\n\n{\n\n int coeff = dirac_get_se_golomb(gb);\n\n const int sign = FFSIGN(coeff);\n\n if (coeff)\n\n coeff = sign*((sign * coeff * qfactor + qoffset) >> 2);\n\n return coeff;\n\n}\n"}} {"sample_id": "f3e4ce4af336f2ea306fa0f40ec1a5149864ca8c_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n MirrorBlockJob *s = container_of(job, MirrorBlockJob, common);\n \n+\n \n if (speed < 0) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void mirror_set_speed(BlockJob *job, int64_t speed, Error **errp)\n\n{\n\n MirrorBlockJob *s = container_of(job, MirrorBlockJob, common);\n\n\n\n if (speed < 0) {\n\n error_setg(errp, QERR_INVALID_PARAMETER, \"speed\");\n\n return;\n\n }\n\n ratelimit_set_speed(&s->limit, speed / BDRV_SECTOR_SIZE, SLICE_TIME);\n\n}\n"}} {"sample_id": "81e3e75b6461c53724fe7c7918bc54468fcdaf9d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n }\n \n+ for (i = 0; i < ARRAY_SIZE(bus->devices); ++i) {\n+\n+ if (bus->devices[i]) {\n+\n+ pci_device_reset(bus->devices[i]);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void pci_bus_reset(PCIBus *bus)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < bus->nirq; i++) {\n\n bus->irq_count[i] = 0;\n\n }\n\n for (i = 0; i < ARRAY_SIZE(bus->devices); ++i) {\n\n if (bus->devices[i]) {\n\n pci_device_reset(bus->devices[i]);\n\n }\n\n }\n\n}\n"}} {"sample_id": "daf767b16aeb32e5b9a77066ba130fe723f875ca", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n if (!logfile) {\n \n+ perror(logfilename);\n \n _exit(1);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void cpu_set_log(int log_flags)\n\n{\n\n loglevel = log_flags;\n\n if (loglevel && !logfile) {\n\n logfile = fopen(logfilename, log_append ? \"a\" : \"w\");\n\n if (!logfile) {\n\n perror(logfilename);\n\n _exit(1);\n\n }\n\n#if !defined(CONFIG_SOFTMMU)\n\n /* must avoid mmap() usage of glibc by setting a buffer \"by hand\" */\n\n {\n\n static char logfile_buf[4096];\n\n setvbuf(logfile, logfile_buf, _IOLBF, sizeof(logfile_buf));\n\n }\n\n#elif !defined(_WIN32)\n\n /* Win32 doesn't support line-buffering and requires size >= 2 */\n\n setvbuf(logfile, NULL, _IOLBF, 0);\n\n#endif\n\n log_append = 1;\n\n }\n\n if (!loglevel && logfile) {\n\n fclose(logfile);\n\n logfile = NULL;\n\n }\n\n}\n"}} {"sample_id": "6886867e9880830d735d8ae6f6cc63ed9eb2be0c_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n switch (size) {\n \n+ case 1:\n+\n+ stb_p(qemu_get_ram_ptr(ram_addr), val);\n+\n+ break;\n \n case 2:\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void notdirty_mem_write(void *opaque, hwaddr ram_addr,\n\n uint64_t val, unsigned size)\n\n{\n\n if (!cpu_physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {\n\n tb_invalidate_phys_page_fast(ram_addr, size);\n\n }\n\n switch (size) {\n\n case 1:\n\n stb_p(qemu_get_ram_ptr(ram_addr), val);\n\n break;\n\n case 2:\n\n stw_p(qemu_get_ram_ptr(ram_addr), val);\n\n break;\n\n case 4:\n\n stl_p(qemu_get_ram_ptr(ram_addr), val);\n\n break;\n\n default:\n\n abort();\n\n }\n\n cpu_physical_memory_set_dirty_flag(ram_addr, DIRTY_MEMORY_MIGRATION);\n\n cpu_physical_memory_set_dirty_flag(ram_addr, DIRTY_MEMORY_VGA);\n\n /* we remove the notdirty callback only if the code has been\n\n flushed */\n\n if (!cpu_physical_memory_is_clean(ram_addr)) {\n\n CPUArchState *env = current_cpu->env_ptr;\n\n tlb_set_dirty(env, current_cpu->mem_io_vaddr);\n\n }\n\n}\n"}} {"sample_id": "5f706fdc164b20b48254eadf7bd413edace34499", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n size_t elf_note_size = 0;\n \n+ int note_head_size;\n \n const NoteFuncDesc *nf;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "ssize_t cpu_get_note_size(int class, int machine, int nr_cpus)\n\n{\n\n int name_size = 8; /* \"CORE\" or \"QEMU\" rounded */\n\n size_t elf_note_size = 0;\n\n int note_head_size;\n\n const NoteFuncDesc *nf;\n\n\n\n assert(class == ELFCLASS64);\n\n assert(machine == EM_S390);\n\n\n\n note_head_size = sizeof(Elf64_Nhdr);\n\n\n\n for (nf = note_func; nf->note_contents_func; nf++) {\n\n elf_note_size = elf_note_size + note_head_size + name_size +\n\n nf->contents_size;\n\n }\n\n\n\n return (elf_note_size) * nr_cpus;\n\n}\n"}} {"sample_id": "fced4d00e68e7559c73746d963265f7fd0b6abf9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ PCIDevice *d = PCI_DEVICE(dev);\n \n GenPCIERootPort *grp = GEN_PCIE_ROOT_PORT(d);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void gen_rp_realize(DeviceState *dev, Error **errp)\n\n{\n\n PCIDevice *d = PCI_DEVICE(dev);\n\n GenPCIERootPort *grp = GEN_PCIE_ROOT_PORT(d);\n\n PCIERootPortClass *rpc = PCIE_ROOT_PORT_GET_CLASS(d);\n\n\n\n rpc->parent_realize(dev, errp);\n\n\n\n int rc = pci_bridge_qemu_reserve_cap_init(d, 0, grp->bus_reserve,\n\n grp->io_reserve, grp->mem_reserve, grp->pref32_reserve,\n\n grp->pref64_reserve, errp);\n\n\n\n if (rc < 0) {\n\n rpc->parent_class.exit(d);\n\n return;\n\n }\n\n\n\n if (!grp->io_reserve) {\n\n pci_word_test_and_clear_mask(d->wmask + PCI_COMMAND,\n\n PCI_COMMAND_IO);\n\n d->wmask[PCI_IO_BASE] = 0;\n\n d->wmask[PCI_IO_LIMIT] = 0;\n\n }\n\n}\n"}} {"sample_id": "056f49ff2cf645dc484956b00b65a3aa18a1a9a3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n const char *buf;\n \n \n+\n if (mon->skip_flush) {\n \n return;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void monitor_flush(Monitor *mon)\n\n{\n\n int rc;\n\n size_t len;\n\n const char *buf;\n\n\n\n if (mon->skip_flush) {\n\n return;\n\n }\n\n\n\n buf = qstring_get_str(mon->outbuf);\n\n len = qstring_get_length(mon->outbuf);\n\n\n\n if (len && !mon->mux_out) {\n\n rc = qemu_chr_fe_write(mon->chr, (const uint8_t *) buf, len);\n\n if (rc == len) {\n\n /* all flushed */\n\n QDECREF(mon->outbuf);\n\n mon->outbuf = qstring_new();\n\n return;\n\n }\n\n if (rc > 0) {\n\n /* partinal write */\n\n QString *tmp = qstring_from_str(buf + rc);\n\n QDECREF(mon->outbuf);\n\n mon->outbuf = tmp;\n\n }\n\n if (mon->watch == 0) {\n\n mon->watch = qemu_chr_fe_add_watch(mon->chr, G_IO_OUT,\n\n monitor_unblocked, mon);\n\n }\n\n }\n\n}\n"}} {"sample_id": "d09a6fde1590ca3a45b608b6873a680f208dfeb5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n \n \n ram_control_before_iterate(f, RAM_CONTROL_FINISH);\n+\n \n \n /* try transferring iterative blocks of memory */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int ram_save_complete(QEMUFile *f, void *opaque)\n\n{\n\n rcu_read_lock();\n\n\n\n migration_bitmap_sync();\n\n\n\n ram_control_before_iterate(f, RAM_CONTROL_FINISH);\n\n\n\n /* try transferring iterative blocks of memory */\n\n\n\n /* flush all remaining blocks regardless of rate limiting */\n\n while (true) {\n\n int pages;\n\n\n\n pages = ram_find_and_save_block(f, true, &bytes_transferred);\n\n /* no more blocks to sent */\n\n if (pages == 0) {\n\n break;\n\n }\n\n }\n\n\n\n flush_compressed_data(f);\n\n ram_control_after_iterate(f, RAM_CONTROL_FINISH);\n\n migration_end();\n\n\n\n rcu_read_unlock();\n\n qemu_put_be64(f, RAM_SAVE_FLAG_EOS);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "c2551b47c9b9465962c4000268eda1307f55614a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static size_t refcount_array_byte_size(BDRVQcow2State *s, uint64_t entries)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static size_t refcount_array_byte_size(BDRVQcow2State *s, uint64_t entries)\n\n{\n\n /* This assertion holds because there is no way we can address more than\n\n * 2^(64 - 9) clusters at once (with cluster size 512 = 2^9, and because\n\n * offsets have to be representable in bytes); due to every cluster\n\n * corresponding to one refcount entry, we are well below that limit */\n\n assert(entries < (UINT64_C(1) << (64 - 9)));\n\n\n\n /* Thanks to the assertion this will not overflow, because\n\n * s->refcount_order < 7.\n\n * (note: x << s->refcount_order == x * s->refcount_bits) */\n\n return DIV_ROUND_UP(entries << s->refcount_order, 8);\n\n}\n"}} {"sample_id": "c3a3a7d356c4df2fe145037172ae52cba5f545a5_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int kvm_has_msr_hsave_pa(CPUState *env)\n+\n+{\n \n kvm_supported_msrs(env);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int kvm_has_msr_hsave_pa(CPUState *env)\n\n{\n\n kvm_supported_msrs(env);\n\n return has_msr_hsave_pa;\n\n}\n"}} {"sample_id": "d85f4222b4681da7ebf8a90b26e085a68fa2c55a_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -58,11 +58,11 @@\n \n }\n \n+ if (ret < 0) {\n+\n+ return -1;\n+\n+ }\n \n sector_num++;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int encrypt_sectors(BDRVQcowState *s, int64_t sector_num,\n\n uint8_t *buf, int nb_sectors, bool enc,\n\n Error **errp)\n\n{\n\n union {\n\n uint64_t ll[2];\n\n uint8_t b[16];\n\n } ivec;\n\n int i;\n\n int ret;\n\n\n\n for(i = 0; i < nb_sectors; i++) {\n\n ivec.ll[0] = cpu_to_le64(sector_num);\n\n ivec.ll[1] = 0;\n\n if (qcrypto_cipher_setiv(s->cipher,\n\n ivec.b, G_N_ELEMENTS(ivec.b),\n\n errp) < 0) {\n\n return -1;\n\n }\n\n if (enc) {\n\n ret = qcrypto_cipher_encrypt(s->cipher,\n\n buf, buf,\n\n 512,\n\n errp);\n\n } else {\n\n ret = qcrypto_cipher_decrypt(s->cipher,\n\n buf, buf,\n\n 512,\n\n errp);\n\n }\n\n if (ret < 0) {\n\n return -1;\n\n }\n\n sector_num++;\n\n buf += 512;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "8cd8c8331730fbaac5066bfd66e15b39a85ce537", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void get_lag(float *buf, const float *new, LongTermPrediction *ltp)\n+\n+{\n \n int i, j, lag, max_corr = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void get_lag(float *buf, const float *new, LongTermPrediction *ltp)\n\n{\n\n int i, j, lag, max_corr = 0;\n\n float max_ratio;\n\n for (i = 0; i < 2048; i++) {\n\n float corr, s0 = 0.0f, s1 = 0.0f;\n\n const int start = FFMAX(0, i - 1024);\n\n for (j = start; j < 2048; j++) {\n\n const int idx = j - i + 1024;\n\n s0 += new[j]*buf[idx];\n\n s1 += buf[idx]*buf[idx];\n\n }\n\n corr = s1 > 0.0f ? s0/sqrt(s1) : 0.0f;\n\n if (corr > max_corr) {\n\n max_corr = corr;\n\n lag = i;\n\n max_ratio = corr/(2048-start);\n\n }\n\n }\n\n ltp->lag = FFMAX(av_clip_uintp2(lag, 11), 0);\n\n ltp->coef_idx = quant_array_idx(max_ratio, ltp_coef, 8);\n\n ltp->coef = ltp_coef[ltp->coef_idx];\n\n}\n"}} {"sample_id": "ac369a77967d5dd984a5430505eaf24a380af1c0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static inline void acpi_build_tables_cleanup(AcpiBuildTables *tables, bool mfre)\n \n+{\n+\n void *linker_data = bios_linker_loader_cleanup(tables->linker);\n \n+ if (mfre) {\n \n g_free(linker_data);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void acpi_build_tables_cleanup(AcpiBuildTables *tables, bool mfre)\n\n{\n\n void *linker_data = bios_linker_loader_cleanup(tables->linker);\n\n if (mfre) {\n\n g_free(linker_data);\n\n }\n\n g_array_free(tables->rsdp, mfre);\n\n g_array_free(tables->table_data, mfre);\n\n g_array_free(tables->tcpalog, mfre);\n\n}\n"}} {"sample_id": "c23acbaed40101c677dfcfbbfe0d2c230a8e8f44_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void rv34_idct_dc_add_c(uint8_t *dst, ptrdiff_t stride, int dc)\n+\n {\n+\n const uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;\n \n int i, j;\n+\n \n \n cm += (13*13*dc + 0x200) >> 10;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void rv34_idct_dc_add_c(uint8_t *dst, ptrdiff_t stride, int dc)\n\n{\n\n const uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;\n\n int i, j;\n\n\n\n cm += (13*13*dc + 0x200) >> 10;\n\n\n\n for (i = 0; i < 4; i++)\n\n {\n\n for (j = 0; j < 4; j++)\n\n dst[j] = cm[ dst[j] ];\n\n\n\n dst += stride;\n\n }\n\n}\n"}} {"sample_id": "41a2b9596c9ed2a827e16e749632752dd2686647", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n if (s->is_cf)\n \n s->mult_sectors = 0;\n+\n+ else\n+\n+ s->mult_sectors = MAX_MULT_SECTORS;\n+\n s->cur_drive = s;\n \n s->select = 0xa0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ide_reset(IDEState *s)\n\n{\n\n if (s->is_cf)\n\n s->mult_sectors = 0;\n\n else\n\n s->mult_sectors = MAX_MULT_SECTORS;\n\n s->cur_drive = s;\n\n s->select = 0xa0;\n\n s->status = READY_STAT;\n\n ide_set_signature(s);\n\n /* init the transfer handler so that 0xffff is returned on data\n\n accesses */\n\n s->end_transfer_func = ide_dummy_transfer_stop;\n\n ide_dummy_transfer_stop(s);\n\n s->media_changed = 0;\n\n}\n"}} {"sample_id": "a1926a29fb4325afa46842883f197c74d4535c36", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n int mx = mv->x & 3;\n \n int my = mv->y & 3;\n+\n+ int extra_left = ff_hevc_qpel_extra_before[mx];\n+\n+ int extra_top = ff_hevc_qpel_extra_before[my];\n+\n \n \n x_off += mv->x >> 2;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void luma_mc(HEVCContext *s, int16_t *dst, ptrdiff_t dststride,\n\n AVFrame *ref, const Mv *mv, int x_off, int y_off,\n\n int block_w, int block_h)\n\n{\n\n HEVCLocalContext *lc = &s->HEVClc;\n\n uint8_t *src = ref->data[0];\n\n ptrdiff_t srcstride = ref->linesize[0];\n\n int pic_width = s->ps.sps->width;\n\n int pic_height = s->ps.sps->height;\n\n\n\n int mx = mv->x & 3;\n\n int my = mv->y & 3;\n\n int extra_left = ff_hevc_qpel_extra_before[mx];\n\n int extra_top = ff_hevc_qpel_extra_before[my];\n\n\n\n x_off += mv->x >> 2;\n\n y_off += mv->y >> 2;\n\n src += y_off * srcstride + (x_off << s->ps.sps->pixel_shift);\n\n\n\n if (x_off < extra_left || y_off < extra_top ||\n\n x_off >= pic_width - block_w - ff_hevc_qpel_extra_after[mx] ||\n\n y_off >= pic_height - block_h - ff_hevc_qpel_extra_after[my]) {\n\n const int edge_emu_stride = EDGE_EMU_BUFFER_STRIDE << s->ps.sps->pixel_shift;\n\n int offset = extra_top * srcstride + (extra_left << s->ps.sps->pixel_shift);\n\n int buf_offset = extra_top *\n\n edge_emu_stride + (extra_left << s->ps.sps->pixel_shift);\n\n\n\n s->vdsp.emulated_edge_mc(lc->edge_emu_buffer, src - offset,\n\n edge_emu_stride, srcstride,\n\n block_w + ff_hevc_qpel_extra[mx],\n\n block_h + ff_hevc_qpel_extra[my],\n\n x_off - extra_left, y_off - extra_top,\n\n pic_width, pic_height);\n\n src = lc->edge_emu_buffer + buf_offset;\n\n srcstride = edge_emu_stride;\n\n }\n\n s->hevcdsp.put_hevc_qpel[my][mx](dst, dststride, src, srcstride, block_w,\n\n block_h, lc->mc_buffer);\n\n}\n"}} {"sample_id": "6860710cc3864382a898c847d722f950b5e01a6e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -47,11 +47,11 @@\n \n struct sockaddr_ll *target_ll = (struct sockaddr_ll *)target_saddr;\n \n+ target_ll->sll_ifindex = tswap32(target_ll->sll_ifindex);\n+\n+ target_ll->sll_hatype = tswap16(target_ll->sll_hatype);\n+\n+ } else if (addr->sa_family == AF_INET6 &&\n \n len >= sizeof(struct target_sockaddr_in6)) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static inline abi_long host_to_target_sockaddr(abi_ulong target_addr,\n\n struct sockaddr *addr,\n\n socklen_t len)\n\n{\n\n struct target_sockaddr *target_saddr;\n\n\n\n if (len == 0) {\n\n return 0;\n\n }\n\n\n\n\n target_saddr = lock_user(VERIFY_WRITE, target_addr, len, 0);\n\n if (!target_saddr)\n\n return -TARGET_EFAULT;\n\n memcpy(target_saddr, addr, len);\n\n if (len >= offsetof(struct target_sockaddr, sa_family) +\n\n sizeof(target_saddr->sa_family)) {\n\n target_saddr->sa_family = tswap16(addr->sa_family);\n\n }\n\n if (addr->sa_family == AF_NETLINK && len >= sizeof(struct sockaddr_nl)) {\n\n struct sockaddr_nl *target_nl = (struct sockaddr_nl *)target_saddr;\n\n target_nl->nl_pid = tswap32(target_nl->nl_pid);\n\n target_nl->nl_groups = tswap32(target_nl->nl_groups);\n\n } else if (addr->sa_family == AF_PACKET) {\n\n struct sockaddr_ll *target_ll = (struct sockaddr_ll *)target_saddr;\n\n target_ll->sll_ifindex = tswap32(target_ll->sll_ifindex);\n\n target_ll->sll_hatype = tswap16(target_ll->sll_hatype);\n\n } else if (addr->sa_family == AF_INET6 &&\n\n len >= sizeof(struct target_sockaddr_in6)) {\n\n struct target_sockaddr_in6 *target_in6 =\n\n (struct target_sockaddr_in6 *)target_saddr;\n\n target_in6->sin6_scope_id = tswap16(target_in6->sin6_scope_id);\n\n }\n\n unlock_user(target_saddr, target_addr, len);\n\n\n\n return 0;\n\n}"}} {"sample_id": "a6a2282c25abe43e352010a7c3fbc92994c0bc1c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n RV34DecContext *r = avctx->priv_data;\n+\n+ int ret;\n+\n+\n+\n r->rv30 = 1;\n \n if ((ret = ff_rv34_decode_init(avctx)) < 0)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int rv30_decode_init(AVCodecContext *avctx)\n\n{\n\n RV34DecContext *r = avctx->priv_data;\n\n int ret;\n\n\n\n r->rv30 = 1;\n\n if ((ret = ff_rv34_decode_init(avctx)) < 0)\n\n return ret;\n\n if(avctx->extradata_size < 2){\n\n av_log(avctx, AV_LOG_ERROR, \"Extradata is too small.\\n\");\n\n return -1;\n\n }\n\n r->rpr = (avctx->extradata[1] & 7) >> 1;\n\n r->rpr = FFMIN(r->rpr + 1, 3);\n\n if(avctx->extradata_size - 8 < (r->rpr - 1) * 2){\n\n av_log(avctx, AV_LOG_ERROR, \"Insufficient extradata - need at least %d bytes, got %d\\n\",\n\n 6 + r->rpr * 2, avctx->extradata_size);\n\n return AVERROR(EINVAL);\n\n }\n\n r->parse_slice_header = rv30_parse_slice_header;\n\n r->decode_intra_types = rv30_decode_intra_types;\n\n r->decode_mb_info = rv30_decode_mb_info;\n\n r->loop_filter = rv30_loop_filter;\n\n r->luma_dc_quant_i = rv30_luma_dc_quant;\n\n r->luma_dc_quant_p = rv30_luma_dc_quant;\n\n return 0;\n\n}\n"}} {"sample_id": "68e75e4dec6b5f46a190118eecbba1e95c396e3d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n for (j = begin; j < end; j++) average += fabs(coeffs[j]);\n \n+ average /= end - begin;\n+\n+ average /= 32; // MAGIC!\n+\n+ for (j = 0; j < range - 1; j++) if (floor1_inverse_db_table[j * fc->multiplier] > average) break;\n \n posts[fc->list[i].sort] = j;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void floor_fit(venc_context_t * venc, floor_t * fc, float * coeffs, int * posts, int samples) {\n\n int range = 255 / fc->multiplier + 1;\n\n int i;\n\n for (i = 0; i < fc->values; i++) {\n\n int position = fc->list[fc->list[i].sort].x;\n\n int begin = fc->list[fc->list[FFMAX(i-1, 0)].sort].x;\n\n int end = fc->list[fc->list[FFMIN(i+1, fc->values - 1)].sort].x;\n\n int j;\n\n float average = 0;\n\n begin = (position + begin) / 2;\n\n end = (position + end ) / 2;\n\n\n\n assert(end <= samples);\n\n for (j = begin; j < end; j++) average += fabs(coeffs[j]);\n\n average /= end - begin;\n\n average /= 32; // MAGIC!\n\n for (j = 0; j < range - 1; j++) if (floor1_inverse_db_table[j * fc->multiplier] > average) break;\n\n posts[fc->list[i].sort] = j;\n\n }\n\n}\n"}} {"sample_id": "955aec3c7c7be39b659197e1ec379a09f2b7c41c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n case 1:\n \n+ avctx->codec_id = AV_CODEC_ID_MP1;\n+\n+ *frame_size = 384;\n+\n+ break;\n \n case 2:\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int avpriv_mpa_decode_header(AVCodecContext *avctx, uint32_t head, int *sample_rate, int *channels, int *frame_size, int *bit_rate)\n\n{\n\n MPADecodeHeader s1, *s = &s1;\n\n\n\n if (ff_mpa_check_header(head) != 0)\n\n return -1;\n\n\n\n if (avpriv_mpegaudio_decode_header(s, head) != 0) {\n\n return -1;\n\n }\n\n\n\n switch(s->layer) {\n\n case 1:\n\n avctx->codec_id = AV_CODEC_ID_MP1;\n\n *frame_size = 384;\n\n break;\n\n case 2:\n\n avctx->codec_id = AV_CODEC_ID_MP2;\n\n *frame_size = 1152;\n\n break;\n\n default:\n\n case 3:\n\n if (avctx->codec_id != AV_CODEC_ID_MP3ADU)\n\n avctx->codec_id = AV_CODEC_ID_MP3;\n\n if (s->lsf)\n\n *frame_size = 576;\n\n else\n\n *frame_size = 1152;\n\n break;\n\n }\n\n\n\n *sample_rate = s->sample_rate;\n\n *channels = s->nb_channels;\n\n *bit_rate = s->bit_rate;\n\n return s->frame_size;\n\n}\n"}} {"sample_id": "d1adad3cca407f493c3637e20ecd4f7124e69212_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n {\n \n //FIXME interpolate chroma\n+\n+ RENAME(yuvPlanartoyuy2)(ysrc, usrc, vsrc, dst, width, height, lumStride, chromStride, dstStride, 2);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void RENAME(yv12toyuy2)(const uint8_t *ysrc, const uint8_t *usrc, const uint8_t *vsrc, uint8_t *dst,\n\n long width, long height,\n\n long lumStride, long chromStride, long dstStride)\n\n{\n\n //FIXME interpolate chroma\n\n RENAME(yuvPlanartoyuy2)(ysrc, usrc, vsrc, dst, width, height, lumStride, chromStride, dstStride, 2);\n\n}\n"}} {"sample_id": "544a3731591f5d53e15f22de00ce5ac758d490b3_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n UserDefFlatUnion *tmp;\n \n+ UserDefUnionBase *base;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_visitor_in_union_flat(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n Visitor *v;\n\n UserDefFlatUnion *tmp;\n\n UserDefUnionBase *base;\n\n\n\n v = visitor_input_test_init(data,\n\n \"{ 'enum1': 'value1', \"\n\n \"'integer': 41, \"\n\n \"'string': 'str', \"\n\n \"'boolean': true }\");\n\n\n\n visit_type_UserDefFlatUnion(v, NULL, &tmp, &error_abort);\n\n g_assert_cmpint(tmp->enum1, ==, ENUM_ONE_VALUE1);\n\n g_assert_cmpstr(tmp->string, ==, \"str\");\n\n g_assert_cmpint(tmp->integer, ==, 41);\n\n g_assert_cmpint(tmp->u.value1->boolean, ==, true);\n\n\n\n base = qapi_UserDefFlatUnion_base(tmp);\n\n g_assert(&base->enum1 == &tmp->enum1);\n\n\n\n qapi_free_UserDefFlatUnion(tmp);\n\n}\n"}} {"sample_id": "cf1d078e4ea094e516faab49678fbea3a34b7848", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n \n \n \tif (!CONN_CANFRCV(so) || so->so_snd.sb_cc >= (so->so_snd.sb_datalen/2))\n+\n+\t\treturn 0;\n+\n+\n+\n \treturn sopreprbuf(so, iov, NULL);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "size_t slirp_socket_can_recv(Slirp *slirp, struct in_addr guest_addr,\n\n int guest_port)\n\n{\n\n\tstruct iovec iov[2];\n\n\tstruct socket *so;\n\n\n\n\tso = slirp_find_ctl_socket(slirp, guest_addr, guest_port);\n\n\n\n\tif (!so || so->so_state & SS_NOFDREF)\n\n\t\treturn 0;\n\n\n\n\tif (!CONN_CANFRCV(so) || so->so_snd.sb_cc >= (so->so_snd.sb_datalen/2))\n\n\t\treturn 0;\n\n\n\n\treturn sopreprbuf(so, iov, NULL);\n\n}\n"}} {"sample_id": "4e588a4d0e1683488282658c057d4b44976d77d8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n decr = muldiv64(tb_env->decr_next - qemu_get_clock(vm_clock),\n \n tb_env->tb_freq, ticks_per_sec);\n+\n+#if defined(DEBUG_TB)\n+\n+ printf(\"%s: 0x%08x\\n\", __func__, decr);\n+\n #endif\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint32_t cpu_ppc_load_decr (CPUState *env)\n\n{\n\n ppc_tb_t *tb_env = env->tb_env;\n\n uint32_t decr;\n\n\n\n decr = muldiv64(tb_env->decr_next - qemu_get_clock(vm_clock),\n\n tb_env->tb_freq, ticks_per_sec);\n\n#if defined(DEBUG_TB)\n\n printf(\"%s: 0x%08x\\n\", __func__, decr);\n\n#endif\n\n\n\n return decr;\n\n}\n"}} {"sample_id": "494a8ebe713055d3946183f4b395f85a18b43e9e_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static int proxy_lstat(FsContext *fs_ctx, V9fsPath *fs_path, struct stat *stbuf)\n+\n+{\n+\n+ int retval;\n \n retval = v9fs_request(fs_ctx->private, T_LSTAT, stbuf, \"s\", fs_path);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int proxy_lstat(FsContext *fs_ctx, V9fsPath *fs_path, struct stat *stbuf)\n\n{\n\n int retval;\n\n retval = v9fs_request(fs_ctx->private, T_LSTAT, stbuf, \"s\", fs_path);\n\n if (retval < 0) {\n\n errno = -retval;\n\n return -1;\n\n }\n\n return retval;\n\n}\n"}} {"sample_id": "02a2cbc872df99205eeafd399f01c210e0b797c4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,8 +16,8 @@\n \n \n \n+ VTD_DPRINTF(CSR, \"int remap table addr 0x%\"PRIx64 \" size %\"PRIu32,\n+\n+ s->intr_root, s->intr_size);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vtd_interrupt_remap_table_setup(IntelIOMMUState *s)\n\n{\n\n uint64_t value = 0;\n\n value = vtd_get_quad_raw(s, DMAR_IRTA_REG);\n\n s->intr_size = 1UL << ((value & VTD_IRTA_SIZE_MASK) + 1);\n\n s->intr_root = value & VTD_IRTA_ADDR_MASK;\n\n\n\n /* TODO: invalidate interrupt entry cache */\n\n\n\n VTD_DPRINTF(CSR, \"int remap table addr 0x%\"PRIx64 \" size %\"PRIu32,\n\n s->intr_root, s->intr_size);\n\n}\n"}} {"sample_id": "38e0735eb76a1479917ef3501a208d4f70998494", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n pstrcat(id, sizeof(id), \"/\");\n \n g_free(path);\n+\n+ }\n+\n+ }\n+\n pstrcat(id, sizeof(id), idstr);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void register_device_unmigratable(DeviceState *dev, const char *idstr,\n\n void *opaque)\n\n{\n\n SaveStateEntry *se;\n\n char id[256] = \"\";\n\n\n\n if (dev && dev->parent_bus && dev->parent_bus->info->get_dev_path) {\n\n char *path = dev->parent_bus->info->get_dev_path(dev);\n\n if (path) {\n\n pstrcpy(id, sizeof(id), path);\n\n pstrcat(id, sizeof(id), \"/\");\n\n g_free(path);\n\n }\n\n }\n\n pstrcat(id, sizeof(id), idstr);\n\n\n\n QTAILQ_FOREACH(se, &savevm_handlers, entry) {\n\n if (strcmp(se->idstr, id) == 0 && se->opaque == opaque) {\n\n se->no_migrate = 1;\n\n }\n\n }\n\n}\n"}} {"sample_id": "aac8b76983e340bc744d3542d676f72efa3b474f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n if( bS[0] < 4 ) {\n \n int8_t tc[4];\n+\n+ for(i=0; i<4; i++)\n+\n+ tc[i] = bS[i] ? (tc0_table+52)[index_a][bS[i] - 1] : -1;\n+\n h->s.dsp.h264_h_loop_filter_luma(pix, stride, alpha, beta, tc);\n \n } else {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void filter_mb_edgev( H264Context *h, uint8_t *pix, int stride, int16_t bS[4], int qp ) {\n\n int i, d;\n\n const int index_a = qp + h->slice_alpha_c0_offset;\n\n const int alpha = (alpha_table+52)[index_a];\n\n const int beta = (beta_table+52)[qp + h->slice_beta_offset];\n\n\n\n if( bS[0] < 4 ) {\n\n int8_t tc[4];\n\n for(i=0; i<4; i++)\n\n tc[i] = bS[i] ? (tc0_table+52)[index_a][bS[i] - 1] : -1;\n\n h->s.dsp.h264_h_loop_filter_luma(pix, stride, alpha, beta, tc);\n\n } else {\n\n h->s.dsp.h264_h_loop_filter_luma_intra(pix, stride, alpha, beta);\n\n }\n\n}\n"}} {"sample_id": "7328c2fc2184476235ebc9a9b9247a986bdea1cf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n AVFrame frame;\n \n int i = 0;\n+\n \n \n av_init_packet(&pkt);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void show_packets(WriterContext *w, AVFormatContext *fmt_ctx)\n\n{\n\n AVPacket pkt;\n\n AVFrame frame;\n\n int i = 0;\n\n\n\n av_init_packet(&pkt);\n\n\n\n while (!av_read_frame(fmt_ctx, &pkt)) {\n\n if (do_show_packets)\n\n show_packet(w, fmt_ctx, &pkt, i++);\n\n if (do_show_frames &&\n\n get_video_frame(fmt_ctx, &frame, &pkt)) {\n\n show_frame(w, &frame, fmt_ctx->streams[pkt.stream_index]);\n\n av_destruct_packet(&pkt);\n\n }\n\n }\n\n av_init_packet(&pkt);\n\n pkt.data = NULL;\n\n pkt.size = 0;\n\n //Flush remaining frames that are cached in the decoder\n\n for (i = 0; i < fmt_ctx->nb_streams; i++) {\n\n pkt.stream_index = i;\n\n while (get_video_frame(fmt_ctx, &frame, &pkt))\n\n show_frame(w, &frame, fmt_ctx->streams[pkt.stream_index]);\n\n }\n\n}\n"}} {"sample_id": "4e59b545868a5ee5f59b346337f0c44209929334", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque)\n+\n+{\n+\n QEMUBH *bh;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque)\n\n{\n\n QEMUBH *bh;\n\n\n\n bh = qemu_malloc(sizeof(*bh));\n\n bh->cb = cb;\n\n bh->opaque = opaque;\n\n\n\n return bh;\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_68", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n \tDIS(fprintf (logfile, \"addi.%c $r%u, $r%u, $acr\\n\",\n \n+\t\t memsize_char(memsize_zz(dc)), dc->op2, dc->op1));\n+\n+\tcris_cc_mask(dc, 0);\n+\n+\tt0 = tcg_temp_new(TCG_TYPE_TL);\n \n \ttcg_gen_shl_tl(t0, cpu_R[dc->op2], tcg_const_tl(dc->zzsize));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static unsigned int dec_addi_acr(DisasContext *dc)\n\n{\n\n\tTCGv t0;\n\n\tDIS(fprintf (logfile, \"addi.%c $r%u, $r%u, $acr\\n\",\n\n\t\t memsize_char(memsize_zz(dc)), dc->op2, dc->op1));\n\n\tcris_cc_mask(dc, 0);\n\n\tt0 = tcg_temp_new(TCG_TYPE_TL);\n\n\ttcg_gen_shl_tl(t0, cpu_R[dc->op2], tcg_const_tl(dc->zzsize));\n\n\ttcg_gen_add_tl(cpu_R[R_ACR], cpu_R[dc->op1], t0);\n\n\ttcg_temp_free(t0);\n\n\treturn 2;\n\n}\n"}} {"sample_id": "7e2515e87c41e2e658aaed466e11cbdf1ea8bcb1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void term_backward_char(void)\n+\n {\n \n if (term_cmd_buf_index > 0) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void term_backward_char(void)\n\n{\n\n if (term_cmd_buf_index > 0) {\n\n term_cmd_buf_index--;\n\n }\n\n}\n"}} {"sample_id": "6e0d8677cb443e7408c0b7a25a93c6596d7fa380_19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n gen_op_addq_EDI_T0();\n \n } else\n+\n+#endif\n+\n+ if (s->aflag) {\n+\n gen_op_addl_ESI_T0();\n \n gen_op_addl_EDI_T0();", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_cmps(DisasContext *s, int ot)\n\n{\n\n gen_string_movl_A0_ESI(s);\n\n gen_op_ld_T0_A0(ot + s->mem_index);\n\n gen_string_movl_A0_EDI(s);\n\n gen_op_ld_T1_A0(ot + s->mem_index);\n\n gen_op_cmpl_T0_T1_cc();\n\n gen_op_movl_T0_Dshift[ot]();\n\n#ifdef TARGET_X86_64\n\n if (s->aflag == 2) {\n\n gen_op_addq_ESI_T0();\n\n gen_op_addq_EDI_T0();\n\n } else\n\n#endif\n\n if (s->aflag) {\n\n gen_op_addl_ESI_T0();\n\n gen_op_addl_EDI_T0();\n\n } else {\n\n gen_op_addw_ESI_T0();\n\n gen_op_addw_EDI_T0();\n\n }\n\n}\n"}} {"sample_id": "dfd100f242370886bb6732f70f1f7cbd8eb9fedc_21", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n {\n \n+ SocketAddress *saddr = socket_address_crumple(saddr_flat);\n+\n+ QIOChannelSocket *sioc;\n+\n+ Error *local_err = NULL;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static QIOChannelSocket *nbd_establish_connection(SocketAddressFlat *saddr_flat,\n\n Error **errp)\n\n{\n\n SocketAddress *saddr = socket_address_crumple(saddr_flat);\n\n QIOChannelSocket *sioc;\n\n Error *local_err = NULL;\n\n\n\n sioc = qio_channel_socket_new();\n\n qio_channel_set_name(QIO_CHANNEL(sioc), \"nbd-client\");\n\n\n\n qio_channel_socket_connect_sync(sioc,\n\n saddr,\n\n &local_err);\n\n qapi_free_SocketAddress(saddr);\n\n if (local_err) {\n\n object_unref(OBJECT(sioc));\n\n error_propagate(errp, local_err);\n\n return NULL;\n\n }\n\n\n\n qio_channel_set_delay(QIO_CHANNEL(sioc), false);\n\n\n\n return sioc;\n\n}\n"}} {"sample_id": "345cfd04d093d9fdec81ea3531e73b1f5c1b6a6c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n if (!avctx)\n \n+ return;\n+\n+\n+\n+ avcodec_close(avctx);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void avcodec_free_context(AVCodecContext **pavctx)\n\n{\n\n AVCodecContext *avctx = *pavctx;\n\n\n\n if (!avctx)\n\n return;\n\n\n\n avcodec_close(avctx);\n\n\n\n av_freep(&avctx->extradata);\n\n av_freep(&avctx->subtitle_header);\n\n\n\n\n\n\n av_freep(pavctx);\n\n}"}} {"sample_id": "9abf567d95a4e840df868ca993219175fbef8c22_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,10 +26,10 @@\n \n setcc(env, 3);\n \n+ }\n+\n+\n+\n+ return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int kvm_sclp_service_call(CPUS390XState *env, struct kvm_run *run,\n\n uint16_t ipbh0)\n\n{\n\n uint32_t sccb;\n\n uint64_t code;\n\n int r = 0;\n\n\n\n cpu_synchronize_state(env);\n\n sccb = env->regs[ipbh0 & 0xf];\n\n code = env->regs[(ipbh0 & 0xf0) >> 4];\n\n\n\n r = sclp_service_call(env, sccb, code);\n\n if (r) {\n\n setcc(env, 3);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "90b2f3136778311fb5e097b8ee1f527518231c23", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n unsigned int nb_entries = avio_rb32(pb);\n \n+ for (i = 0; i < nb_entries; i++) {\n+\n+ char key[32];\n+\n+ char value[1024];\n \n avio_get_str(pb, INT_MAX, key, sizeof(key));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void read_info_chunk(AVFormatContext *s, int64_t size)\n\n{\n\n AVIOContext *pb = s->pb;\n\n unsigned int i;\n\n unsigned int nb_entries = avio_rb32(pb);\n\n for (i = 0; i < nb_entries; i++) {\n\n char key[32];\n\n char value[1024];\n\n avio_get_str(pb, INT_MAX, key, sizeof(key));\n\n avio_get_str(pb, INT_MAX, value, sizeof(value));\n\n av_dict_set(&s->metadata, key, value, 0);\n\n }\n\n}\n"}} {"sample_id": "697ab892786d47008807a49f57b2fd86adfcd098", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n target_ulong li, target;\n \n+\n+\n+ ctx->exception = POWERPC_EXCP_BRANCH;\n+\n+ /* sign extend LI */\n \n #if defined(TARGET_PPC64)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void gen_b(DisasContext *ctx)\n\n{\n\n target_ulong li, target;\n\n\n\n ctx->exception = POWERPC_EXCP_BRANCH;\n\n /* sign extend LI */\n\n#if defined(TARGET_PPC64)\n\n if (ctx->sf_mode)\n\n li = ((int64_t)LI(ctx->opcode) << 38) >> 38;\n\n else\n\n#endif\n\n li = ((int32_t)LI(ctx->opcode) << 6) >> 6;\n\n if (likely(AA(ctx->opcode) == 0))\n\n target = ctx->nip + li - 4;\n\n else\n\n target = li;\n\n if (LK(ctx->opcode))\n\n gen_setlr(ctx, ctx->nip);\n\n\n gen_goto_tb(ctx, 0, target);\n\n}"}} {"sample_id": "428098165de4c3edfe42c1b7f00627d287015863_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static uint16_t roundToInt16(int64_t f){\n+\n+\tint r= (f + (1<<15))>>16;\n+\n+\t if(r<-0x7FFF) return 0x8000;\n \n \telse if(r> 0x7FFF) return 0x7FFF;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static uint16_t roundToInt16(int64_t f){\n\n\tint r= (f + (1<<15))>>16;\n\n\t if(r<-0x7FFF) return 0x8000;\n\n\telse if(r> 0x7FFF) return 0x7FFF;\n\n\telse return r;\n\n}\n"}} {"sample_id": "eb5b0422b595d488f5c2f2a37a62cd46dfbb6aa7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n \n \n if (avctx->sample_rate != 8000 || avctx->channels != 1 ||\n+\n+ (avctx->bit_rate != 16000 && avctx->bit_rate != 24000 &&\n+\n+\t avctx->bit_rate != 32000 && avctx->bit_rate != 40000)) {\n+\n av_log(avctx, AV_LOG_ERROR, \"G726: unsupported audio format\\n\");\n \n \treturn -1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int g726_init(AVCodecContext * avctx)\n\n{\n\n AVG726Context* c = (AVG726Context*)avctx->priv_data;\n\n \n\n if (avctx->sample_rate != 8000 || avctx->channels != 1 ||\n\n (avctx->bit_rate != 16000 && avctx->bit_rate != 24000 &&\n\n\t avctx->bit_rate != 32000 && avctx->bit_rate != 40000)) {\n\n av_log(avctx, AV_LOG_ERROR, \"G726: unsupported audio format\\n\");\n\n\treturn -1;\n\n }\n\n g726_reset(&c->c, avctx->bit_rate);\n\n c->code_size = c->c.tbls->bits;\n\n c->bit_buffer = 0;\n\n c->bits_left = 0;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "baced9f5986a466c957456f5cf32a722d8b35512", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n int bit_rate_ext;\n \n int level, profile;\n+\n+\n+\n+ skip_bits(&s->gb, 1); /* profil and level esc*/\n+\n profile= get_bits(&s->gb, 3);\n \n level= get_bits(&s->gb, 4);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void mpeg_decode_sequence_extension(MpegEncContext *s)\n\n{\n\n int horiz_size_ext, vert_size_ext;\n\n int bit_rate_ext;\n\n int level, profile;\n\n\n\n skip_bits(&s->gb, 1); /* profil and level esc*/\n\n profile= get_bits(&s->gb, 3);\n\n level= get_bits(&s->gb, 4);\n\n s->progressive_sequence = get_bits1(&s->gb); /* progressive_sequence */\n\n s->chroma_format = get_bits(&s->gb, 2); /* chroma_format 1=420, 2=422, 3=444 */\n\n horiz_size_ext = get_bits(&s->gb, 2);\n\n vert_size_ext = get_bits(&s->gb, 2);\n\n s->width |= (horiz_size_ext << 12);\n\n s->height |= (vert_size_ext << 12);\n\n bit_rate_ext = get_bits(&s->gb, 12); /* XXX: handle it */\n\n s->bit_rate += (bit_rate_ext << 12) * 400;\n\n skip_bits1(&s->gb); /* marker */\n\n s->avctx->rc_buffer_size += get_bits(&s->gb, 8)*1024*16<<10;\n\n\n\n s->low_delay = get_bits1(&s->gb);\n\n if(s->flags & CODEC_FLAG_LOW_DELAY) s->low_delay=1;\n\n\n\n s->frame_rate_ext_n = get_bits(&s->gb, 2);\n\n s->frame_rate_ext_d = get_bits(&s->gb, 5);\n\n\n\n dprintf(\"sequence extension\\n\");\n\n s->codec_id= s->avctx->codec_id= CODEC_ID_MPEG2VIDEO;\n\n s->avctx->sub_id = 2; /* indicates mpeg2 found */\n\n\n\n if(s->avctx->debug & FF_DEBUG_PICT_INFO)\n\n av_log(s->avctx, AV_LOG_DEBUG, \"profile: %d, level: %d vbv buffer: %d, bitrate:%d\\n\", \n\n profile, level, s->avctx->rc_buffer_size, s->bit_rate);\n\n\n\n}\n"}} {"sample_id": "4a998740b22aa673ea475060c787da7c545588cf_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,8 +3,8 @@\n {\n \n if (!timer_head)\n+\n+ return 0;\n \n return (timer_head->expire_time <= current_time);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_timer_expired(QEMUTimer *timer_head, int64_t current_time)\n\n{\n\n if (!timer_head)\n\n return 0;\n\n return (timer_head->expire_time <= current_time);\n\n}\n"}} {"sample_id": "b544c1aba8681c2fe5d6715fbd37cf6caf1bc7bb_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,9 +12,9 @@\n \n \n \n+ mn = s->min_dirty_data_idx;\n \n+ mx = s->max_dirty_data_idx;\n \n if (mn <= mx) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void coroutine_fn sd_write_done(SheepdogAIOCB *acb)\n\n{\n\n BDRVSheepdogState *s = acb->common.bs->opaque;\n\n struct iovec iov;\n\n AIOReq *aio_req;\n\n uint32_t offset, data_len, mn, mx;\n\n\n\n mn = s->min_dirty_data_idx;\n\n mx = s->max_dirty_data_idx;\n\n if (mn <= mx) {\n\n /* we need to update the vdi object. */\n\n offset = sizeof(s->inode) - sizeof(s->inode.data_vdi_id) +\n\n mn * sizeof(s->inode.data_vdi_id[0]);\n\n data_len = (mx - mn + 1) * sizeof(s->inode.data_vdi_id[0]);\n\n\n\n s->min_dirty_data_idx = UINT32_MAX;\n\n s->max_dirty_data_idx = 0;\n\n\n\n iov.iov_base = &s->inode;\n\n iov.iov_len = sizeof(s->inode);\n\n aio_req = alloc_aio_req(s, acb, vid_to_vdi_oid(s->inode.vdi_id),\n\n data_len, offset, 0, 0, offset);\n\n QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);\n\n add_aio_request(s, aio_req, &iov, 1, false, AIOCB_WRITE_UDATA);\n\n\n\n acb->aio_done_func = sd_finish_aiocb;\n\n acb->aiocb_type = AIOCB_WRITE_UDATA;\n\n return;\n\n }\n\n\n\n sd_finish_aiocb(acb);\n\n}\n"}} {"sample_id": "3453f9a0dfa58578e6dadf0905ff4528b428ec73", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n }\n trace_usb_uas_command(uas->dev.addr, req->tag,\n usb_uas_get_lun(req->lun),\n+ req->lun >> 32, req->lun & 0xffffffff);\n+ QTAILQ_INSERT_TAIL(&uas->requests, req, next);\n+ if (uas_using_streams(uas) && uas->data3[req->tag] != NULL) {\n+ req->data = uas->data3[req->tag];\n+ req->data_async = true;\n uas->data3[req->tag] = NULL;\n }\n req->req = scsi_req_new(req->dev, req->tag,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void usb_uas_command(UASDevice *uas, uas_ui *ui)\n{\n UASRequest *req;\n uint32_t len;\n uint16_t tag = be16_to_cpu(ui->hdr.tag);\n if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) {\n goto invalid_tag;\n }\n req = usb_uas_find_request(uas, tag);\n if (req) {\n goto overlapped_tag;\n }\n req = usb_uas_alloc_request(uas, ui);\n if (req->dev == NULL) {\n goto bad_target;\n }\n trace_usb_uas_command(uas->dev.addr, req->tag,\n usb_uas_get_lun(req->lun),\n req->lun >> 32, req->lun & 0xffffffff);\n QTAILQ_INSERT_TAIL(&uas->requests, req, next);\n if (uas_using_streams(uas) && uas->data3[req->tag] != NULL) {\n req->data = uas->data3[req->tag];\n req->data_async = true;\n uas->data3[req->tag] = NULL;\n }\n req->req = scsi_req_new(req->dev, req->tag,\n usb_uas_get_lun(req->lun),\n ui->command.cdb, req);\n if (uas->requestlog) {\n scsi_req_print(req->req);\n }\n len = scsi_req_enqueue(req->req);\n if (len) {\n req->data_size = len;\n scsi_req_continue(req->req);\n }\noverlapped_tag:\n usb_uas_queue_fake_sense(uas, tag, sense_code_OVERLAPPED_COMMANDS);\nbad_target:\n usb_uas_queue_fake_sense(uas, tag, sense_code_LUN_NOT_SUPPORTED);\n g_free(req);\n}"}} {"sample_id": "28f9ab7029bd1a02f659995919f899f84ee7361b_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -47,11 +47,11 @@\n s->deblock_filtering = 1;\n \n \n+\n+ s->filter = NULL;\n+\n+\n+\n s->has_alpha = has_alpha;\n \n if (flip) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "av_cold void ff_vp56_init(AVCodecContext *avctx, int flip, int has_alpha)\n\n{\n\n VP56Context *s = avctx->priv_data;\n\n int i;\n\n\n\n s->avctx = avctx;\n\n avctx->pix_fmt = has_alpha ? PIX_FMT_YUVA420P : PIX_FMT_YUV420P;\n\n\n\n if (avctx->idct_algo == FF_IDCT_AUTO)\n\n avctx->idct_algo = FF_IDCT_VP3;\n\n ff_dsputil_init(&s->dsp, avctx);\n\n ff_vp56dsp_init(&s->vp56dsp, avctx->codec->id);\n\n ff_init_scantable(s->dsp.idct_permutation, &s->scantable,ff_zigzag_direct);\n\n\n\n for (i=0; i<4; i++)\n\n s->framep[i] = &s->frames[i];\n\n s->framep[VP56_FRAME_UNUSED] = s->framep[VP56_FRAME_GOLDEN];\n\n s->framep[VP56_FRAME_UNUSED2] = s->framep[VP56_FRAME_GOLDEN2];\n\n s->edge_emu_buffer_alloc = NULL;\n\n\n\n s->above_blocks = NULL;\n\n s->macroblocks = NULL;\n\n s->quantizer = -1;\n\n s->deblock_filtering = 1;\n\n\n\n s->filter = NULL;\n\n\n\n s->has_alpha = has_alpha;\n\n if (flip) {\n\n s->flip = -1;\n\n s->frbi = 2;\n\n s->srbi = 0;\n\n } else {\n\n s->flip = 1;\n\n s->frbi = 0;\n\n s->srbi = 2;\n\n }\n\n}\n"}} {"sample_id": "1687a089f103f9b7a1b4a1555068054cb46ee9e9_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n vcard_free(VCard *vcard)\n+\n+{\n+\n+ VCardApplet *current_applet = NULL;\n+\n VCardApplet *next_applet = NULL;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "vcard_free(VCard *vcard)\n\n{\n\n VCardApplet *current_applet = NULL;\n\n VCardApplet *next_applet = NULL;\n\n\n\n if (vcard == NULL) {\n\n return;\n\n }\n\n vcard->reference_count--;\n\n if (vcard->reference_count != 0) {\n\n return;\n\n }\n\n if (vcard->vcard_private_free) {\n\n (*vcard->vcard_private_free)(vcard->vcard_private);\n\n vcard->vcard_private_free = 0;\n\n vcard->vcard_private = 0;\n\n }\n\n for (current_applet = vcard->applet_list; current_applet;\n\n current_applet = next_applet) {\n\n next_applet = current_applet->next;\n\n vcard_delete_applet(current_applet);\n\n }\n\n vcard_buffer_response_delete(vcard->vcard_buffer_response);\n\n g_free(vcard);\n\n}\n"}} {"sample_id": "786a4ea82ec9c87e3a895cf41081029b285a5fe5_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n int bit;\n \n+\n+\n+ level = s->olevel & s->dir;\n+\n+\n \n for (diff = s->prev_level ^ level; diff; diff ^= 1 << bit) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void strongarm_ppc_handler_update(StrongARMPPCInfo *s)\n\n{\n\n uint32_t level, diff;\n\n int bit;\n\n\n\n level = s->olevel & s->dir;\n\n\n\n for (diff = s->prev_level ^ level; diff; diff ^= 1 << bit) {\n\n bit = ffs(diff) - 1;\n\n qemu_set_irq(s->handler[bit], (level >> bit) & 1);\n\n }\n\n\n\n s->prev_level = level;\n\n}\n"}} {"sample_id": "8786db7cb96f8ce5c75c6e1e074319c9dca8d356", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void memory_global_sync_dirty_bitmap(MemoryRegion *address_space)\n \n {\n+\n AddressSpace *as = memory_region_to_address_space(address_space);\n \n FlatRange *fr;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void memory_global_sync_dirty_bitmap(MemoryRegion *address_space)\n\n{\n\n AddressSpace *as = memory_region_to_address_space(address_space);\n\n FlatRange *fr;\n\n\n\n FOR_EACH_FLAT_RANGE(fr, &as->current_map) {\n\n MEMORY_LISTENER_UPDATE_REGION(fr, as, Forward, log_sync);\n\n }\n\n}\n"}} {"sample_id": "16f4e8fa737b58b7b0461b33581e43ac06991110_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ GuestSuspendMode *mode = opaque;\n \n DWORD ret = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static DWORD WINAPI do_suspend(LPVOID opaque)\n\n{\n\n GuestSuspendMode *mode = opaque;\n\n DWORD ret = 0;\n\n\n\n if (!SetSuspendState(*mode == GUEST_SUSPEND_MODE_DISK, TRUE, TRUE)) {\n\n slog(\"failed to suspend guest, %s\", GetLastError());\n\n ret = -1;\n\n }\n\n g_free(mode);\n\n return ret;\n\n}\n"}} {"sample_id": "3b098d56979d2f7fd707c5be85555d114353a28d_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -37,9 +37,9 @@\n monitor_printf(mon, \",%s=%s\", prop->name, str);\n \n g_free(str);\n+\n+ }\n+\n+ monitor_printf(mon, \"\\n\");\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void netfilter_print_info(Monitor *mon, NetFilterState *nf)\n\n{\n\n char *str;\n\n ObjectProperty *prop;\n\n ObjectPropertyIterator iter;\n\n StringOutputVisitor *ov;\n\n\n\n /* generate info str */\n\n object_property_iter_init(&iter, OBJECT(nf));\n\n while ((prop = object_property_iter_next(&iter))) {\n\n if (!strcmp(prop->name, \"type\")) {\n\n continue;\n\n }\n\n ov = string_output_visitor_new(false);\n\n object_property_get(OBJECT(nf), string_output_get_visitor(ov),\n\n prop->name, NULL);\n\n str = string_output_get_string(ov);\n\n visit_free(string_output_get_visitor(ov));\n\n monitor_printf(mon, \",%s=%s\", prop->name, str);\n\n g_free(str);\n\n }\n\n monitor_printf(mon, \"\\n\");\n\n}\n"}} {"sample_id": "0044a8f80df366643bcfaf74011e41a2658c88f8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n MpegTSWrite *ts = s->priv_data;\n \n+ MpegTSWriteStream *ts_st;\n+\n MpegTSService *service;\n \n AVStream *st;\n@@ -21,7 +21,7 @@\n st = s->streams[i];\n \n ts_st = st->priv_data;\n+\n if (ts_st->payload_index > 0) {\n \n mpegts_write_pes(s, st, ts_st->payload, ts_st->payload_index,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int mpegts_write_end(AVFormatContext *s)\n\n{\n\n MpegTSWrite *ts = s->priv_data;\n\n MpegTSWriteStream *ts_st;\n\n MpegTSService *service;\n\n AVStream *st;\n\n int i;\n\n\n\n /* flush current packets */\n\n for(i = 0; i < s->nb_streams; i++) {\n\n st = s->streams[i];\n\n ts_st = st->priv_data;\n\n if (ts_st->payload_index > 0) {\n\n mpegts_write_pes(s, st, ts_st->payload, ts_st->payload_index,\n\n ts_st->payload_pts);\n\n }\n\n }\n\n put_flush_packet(&s->pb);\n\n \n\n for(i = 0; i < ts->nb_services; i++) {\n\n service = ts->services[i];\n\n av_freep(&service->provider_name);\n\n av_freep(&service->name);\n\n av_free(service);\n\n }\n\n av_free(ts->services);\n\n\n\n for(i = 0; i < s->nb_streams; i++) {\n\n st = s->streams[i];\n\n av_free(st->priv_data);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "bbcc09518e0d1efc189a43ff0120c1a31f51c802", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n avio_wl16(pb, 4); /* wLongsPerEntry */\n \n avio_w8(pb, 0); /* bIndexSubType (0 == frame index) */\n+\n+ avio_w8(pb, 0); /* bIndexType (0 == AVI_INDEX_OF_INDEXES) */\n+\n+ avio_wl32(pb, 0); /* nEntriesInUse (will fill out later on) */\n+\n ffio_wfourcc(pb, avi_stream2fourcc(tag, stream_index, enc->codec_type));\n \n /* dwChunkId */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void write_odml_master(AVFormatContext *s, int stream_index)\n\n{\n\n AVIOContext *pb = s->pb;\n\n AVStream *st = s->streams[stream_index];\n\n AVCodecContext *enc = st->codec;\n\n AVIStream *avist = st->priv_data;\n\n unsigned char tag[5];\n\n int j;\n\n\n\n /* Starting to lay out AVI OpenDML master index.\n\n * We want to make it JUNK entry for now, since we'd\n\n * like to get away without making AVI an OpenDML one\n\n * for compatibility reasons. */\n\n avist->indexes.entry = avist->indexes.ents_allocated = 0;\n\n avist->indexes.indx_start = ff_start_tag(pb, \"JUNK\");\n\n avio_wl16(pb, 4); /* wLongsPerEntry */\n\n avio_w8(pb, 0); /* bIndexSubType (0 == frame index) */\n\n avio_w8(pb, 0); /* bIndexType (0 == AVI_INDEX_OF_INDEXES) */\n\n avio_wl32(pb, 0); /* nEntriesInUse (will fill out later on) */\n\n ffio_wfourcc(pb, avi_stream2fourcc(tag, stream_index, enc->codec_type));\n\n /* dwChunkId */\n\n avio_wl64(pb, 0); /* dwReserved[3] */\n\n avio_wl32(pb, 0); /* Must be 0. */\n\n for (j = 0; j < AVI_MASTER_INDEX_SIZE * 2; j++)\n\n avio_wl64(pb, 0);\n\n ff_end_tag(pb, avist->indexes.indx_start);\n\n}\n"}} {"sample_id": "1f001dc7bc9e435bf231a5b0edcad1c7c2bd6214_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ return -1;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int default_fdset_dup_fd_add(int64_t fdset_id, int dup_fd)\n\n{\n\n return -1;\n\n}\n"}} {"sample_id": "dd5ee2c2d3e3a17647ddd9bfa97935b8cb5dfa40", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n const void *unused)\n \n+{\n \n TestStruct *p = NULL;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_visitor_in_errors(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n TestStruct *p = NULL;\n\n Error *err = NULL;\n\n Visitor *v;\n\n\n\n v = visitor_input_test_init(data, \"{ 'integer': false, 'boolean': 'foo', 'string': -42 }\");\n\n\n\n visit_type_TestStruct(v, &p, NULL, &err);\n\n error_free_or_abort(&err);\n\n /* FIXME - a failed parse should not leave a partially-allocated p\n\n * for us to clean up; this could cause callers to leak memory. */\n\n g_assert(p->string == NULL);\n\n\n\n g_free(p->string);\n\n g_free(p);\n\n}\n"}} {"sample_id": "d65b9114f35c1afe2a7061f0a1ec957d33ba02b5_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n c->dir = opendir(h->filename);\n \n+ if (!c->dir)\n+\n+ return AVERROR(errno);\n+\n+\n \n return 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int file_open_dir(URLContext *h)\n\n{\n\n#if HAVE_DIRENT_H\n\n FileContext *c = h->priv_data;\n\n\n\n c->dir = opendir(h->filename);\n\n if (!c->dir)\n\n return AVERROR(errno);\n\n\n\n return 0;\n\n#else\n\n return AVERROR(ENOSYS);\n\n#endif /* HAVE_DIRENT_H */\n\n}\n"}} {"sample_id": "259342d34dbdfb304374f569feec26317edd97c9_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n \n /* Verify that we have an AHCI device present. */\n+\n+ s->dev = get_ahci_device(&s->fingerprint);\n+\n+\n+\n return s;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static AHCIQState *ahci_boot(void)\n\n{\n\n AHCIQState *s;\n\n const char *cli;\n\n\n\n s = g_malloc0(sizeof(AHCIQState));\n\n\n\n cli = \"-drive if=none,id=drive0,file=%s,cache=writeback,serial=%s\"\n\n \",format=raw\"\n\n \" -M q35 \"\n\n \"-device ide-hd,drive=drive0 \"\n\n \"-global ide-hd.ver=%s\";\n\n s->parent = qtest_pc_boot(cli, tmp_path, \"testdisk\", \"version\");\n\n\n\n\n /* Verify that we have an AHCI device present. */\n\n s->dev = get_ahci_device(&s->fingerprint);\n\n\n\n return s;\n\n}"}} {"sample_id": "bdd81addf4033ce26e6cd180b060f63095f3ded9_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n VFIOQuirk *quirk;\n \n VFIOrtl8168Quirk *rtl;\n+\n \n \n if (!vfio_pci_is(vdev, PCI_VENDOR_ID_REALTEK, 0x8168) || nr != 2) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void vfio_probe_rtl8168_bar2_quirk(VFIOPCIDevice *vdev, int nr)\n\n{\n\n VFIOQuirk *quirk;\n\n VFIOrtl8168Quirk *rtl;\n\n\n\n if (!vfio_pci_is(vdev, PCI_VENDOR_ID_REALTEK, 0x8168) || nr != 2) {\n\n return;\n\n }\n\n\n\n quirk = g_malloc0(sizeof(*quirk));\n\n quirk->mem = g_malloc0(sizeof(MemoryRegion) * 2);\n\n quirk->nr_mem = 2;\n\n quirk->data = rtl = g_malloc0(sizeof(*rtl));\n\n rtl->vdev = vdev;\n\n\n\n memory_region_init_io(&quirk->mem[0], OBJECT(vdev),\n\n &vfio_rtl_address_quirk, rtl,\n\n \"vfio-rtl8168-window-address-quirk\", 4);\n\n memory_region_add_subregion_overlap(&vdev->bars[nr].region.mem,\n\n 0x74, &quirk->mem[0], 1);\n\n\n\n memory_region_init_io(&quirk->mem[1], OBJECT(vdev),\n\n &vfio_rtl_data_quirk, rtl,\n\n \"vfio-rtl8168-window-data-quirk\", 4);\n\n memory_region_add_subregion_overlap(&vdev->bars[nr].region.mem,\n\n 0x70, &quirk->mem[1], 1);\n\n\n\n QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);\n\n\n\n trace_vfio_quirk_rtl8168_probe(vdev->vbasedev.name);\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n const char *name = reg2str(reg);\n+\n QTestState *qtest = global_qtest;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void out_reg(IVState *s, enum Reg reg, unsigned v)\n\n{\n\n const char *name = reg2str(reg);\n\n QTestState *qtest = global_qtest;\n\n\n\n global_qtest = s->qtest;\n\n g_test_message(\"%x -> *%s\\n\", v, name);\n\n qpci_io_writel(s->dev, s->reg_base + reg, v);\n\n global_qtest = qtest;\n\n}\n"}} {"sample_id": "b45c03f585ea9bb1af76c73e82195418c294919d_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n struct omap_lcd_panel_s *omap_lcdc_init(MemoryRegion *sysmem,\n+\n hwaddr base,\n \n qemu_irq irq,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "struct omap_lcd_panel_s *omap_lcdc_init(MemoryRegion *sysmem,\n\n hwaddr base,\n\n qemu_irq irq,\n\n struct omap_dma_lcd_channel_s *dma,\n\n omap_clk clk)\n\n{\n\n struct omap_lcd_panel_s *s = (struct omap_lcd_panel_s *)\n\n g_malloc0(sizeof(struct omap_lcd_panel_s));\n\n\n\n s->irq = irq;\n\n s->dma = dma;\n\n s->sysmem = sysmem;\n\n omap_lcdc_reset(s);\n\n\n\n memory_region_init_io(&s->iomem, NULL, &omap_lcdc_ops, s, \"omap.lcdc\", 0x100);\n\n memory_region_add_subregion(sysmem, base, &s->iomem);\n\n\n\n s->con = graphic_console_init(NULL, 0, &omap_ops, s);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "d41f3e750d2c06c613cb1b8db7724f0fbc0a2b14_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n srat_start = table_data->len;\n \n srat = acpi_data_push(table_data, sizeof(*srat));\n+\n+ srat->reserved1 = cpu_to_le32(1);\n+\n+\n+\n for (i = 0; i < cpu_list->len; ++i) {\n \n int node_id = cpu_list->cpus[i].props.has_node_id ?", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "build_srat(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)\n\n{\n\n AcpiSystemResourceAffinityTable *srat;\n\n AcpiSratProcessorGiccAffinity *core;\n\n AcpiSratMemoryAffinity *numamem;\n\n int i, srat_start;\n\n uint64_t mem_base;\n\n MachineClass *mc = MACHINE_GET_CLASS(vms);\n\n const CPUArchIdList *cpu_list = mc->possible_cpu_arch_ids(MACHINE(vms));\n\n\n\n srat_start = table_data->len;\n\n srat = acpi_data_push(table_data, sizeof(*srat));\n\n srat->reserved1 = cpu_to_le32(1);\n\n\n\n for (i = 0; i < cpu_list->len; ++i) {\n\n int node_id = cpu_list->cpus[i].props.has_node_id ?\n\n cpu_list->cpus[i].props.node_id : 0;\n\n core = acpi_data_push(table_data, sizeof(*core));\n\n core->type = ACPI_SRAT_PROCESSOR_GICC;\n\n core->length = sizeof(*core);\n\n core->proximity = cpu_to_le32(node_id);\n\n core->acpi_processor_uid = cpu_to_le32(i);\n\n core->flags = cpu_to_le32(1);\n\n }\n\n\n\n mem_base = vms->memmap[VIRT_MEM].base;\n\n for (i = 0; i < nb_numa_nodes; ++i) {\n\n numamem = acpi_data_push(table_data, sizeof(*numamem));\n\n build_srat_memory(numamem, mem_base, numa_info[i].node_mem, i,\n\n MEM_AFFINITY_ENABLED);\n\n mem_base += numa_info[i].node_mem;\n\n }\n\n\n\n build_header(linker, table_data, (void *)srat, \"SRAT\",\n\n table_data->len - srat_start, 3, NULL, NULL);\n\n}\n"}} {"sample_id": "991ef6e5b9a6a9d95e274ff6bff52db1c82b3808", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n int payload_size = 0;\n \n+ int byte = 0xFF;\n+\n+ av_log(logctx, AV_LOG_DEBUG, \"Decoding SEI\\n\");\n+\n+\n \n while (byte == 0xFF) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int decode_nal_sei_message(GetBitContext *gb, void *logctx, HEVCSEI *s,\n\n const HEVCParamSets *ps, int nal_unit_type)\n\n{\n\n int payload_type = 0;\n\n int payload_size = 0;\n\n int byte = 0xFF;\n\n av_log(logctx, AV_LOG_DEBUG, \"Decoding SEI\\n\");\n\n\n\n while (byte == 0xFF) {\n\n\n\n byte = get_bits(gb, 8);\n\n payload_type += byte;\n\n }\n\n byte = 0xFF;\n\n while (byte == 0xFF) {\n\n\n\n byte = get_bits(gb, 8);\n\n payload_size += byte;\n\n }\n\n if (nal_unit_type == HEVC_NAL_SEI_PREFIX) {\n\n return decode_nal_sei_prefix(gb, logctx, s, ps, payload_type, payload_size);\n\n } else { /* nal_unit_type == NAL_SEI_SUFFIX */\n\n return decode_nal_sei_suffix(gb, logctx, s, payload_type, payload_size);\n\n }\n\n}"}} {"sample_id": "f73f76fd202b310e8e1d0215b2e0cf038cd18c4a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n SwsContext *sws_alloc_context(void)\n \n+{\n+\n SwsContext *c = av_mallocz(sizeof(SwsContext));\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "SwsContext *sws_alloc_context(void)\n\n{\n\n SwsContext *c = av_mallocz(sizeof(SwsContext));\n\n\n\n c->av_class = &sws_context_class;\n\n av_opt_set_defaults(c);\n\n\n\n return c;\n\n}\n"}} {"sample_id": "9a75b0a037e3a8030992244353f17b62f6daf2ab", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n+static void ahci_pci_enable(AHCIQState *ahci)\n+\n+{\n+\n+ uint8_t reg;\n+\n+\n+\n+ start_ahci_device(ahci);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void ahci_pci_enable(AHCIQState *ahci)\n\n{\n\n uint8_t reg;\n\n\n\n start_ahci_device(ahci);\n\n\n\n switch (ahci->fingerprint) {\n\n case AHCI_INTEL_ICH9:\n\n /* ICH9 has a register at PCI 0x92 that\n\n * acts as a master port enabler mask. */\n\n reg = qpci_config_readb(ahci->dev, 0x92);\n\n reg |= 0x3F;\n\n qpci_config_writeb(ahci->dev, 0x92, reg);\n\n /* 0...0111111b -- bit significant, ports 0-5 enabled. */\n\n ASSERT_BIT_SET(qpci_config_readb(ahci->dev, 0x92), 0x3F);\n\n break;\n\n }\n\n\n\n}\n"}} {"sample_id": "071d4054770205ddb8a58a9e2735069d8fe52af1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n struct qdist_entry e;\n \n \n+\n e.x = x;\n \n entry = bsearch(&e, dist->entries, dist->n, sizeof(e), qdist_cmp);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void qdist_add(struct qdist *dist, double x, long count)\n\n{\n\n struct qdist_entry *entry = NULL;\n\n\n\n if (dist->n) {\n\n struct qdist_entry e;\n\n\n\n e.x = x;\n\n entry = bsearch(&e, dist->entries, dist->n, sizeof(e), qdist_cmp);\n\n }\n\n\n\n if (entry) {\n\n entry->count += count;\n\n return;\n\n }\n\n\n\n if (unlikely(dist->n == dist->size)) {\n\n dist->size *= 2;\n\n dist->entries = g_realloc(dist->entries,\n\n sizeof(*dist->entries) * (dist->size));\n\n }\n\n dist->n++;\n\n entry = &dist->entries[dist->n - 1];\n\n entry->x = x;\n\n entry->count = count;\n\n qsort(dist->entries, dist->n, sizeof(*entry), qdist_cmp);\n\n}\n"}} {"sample_id": "7d1b0095bff7157e856d1d0e6c4295641ced2752_31", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void gen_neon_trn_u8(TCGv t0, TCGv t1)\n \n+{\n+\n TCGv rd, tmp;\n \n \n@@ -11,8 +11,8 @@\n tmp = new_tmp();\n \n \n+\n+ tcg_gen_shli_i32(rd, t0, 8);\n \n tcg_gen_andi_i32(rd, rd, 0xff00ff00);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_neon_trn_u8(TCGv t0, TCGv t1)\n\n{\n\n TCGv rd, tmp;\n\n\n\n rd = new_tmp();\n\n tmp = new_tmp();\n\n\n\n tcg_gen_shli_i32(rd, t0, 8);\n\n tcg_gen_andi_i32(rd, rd, 0xff00ff00);\n\n tcg_gen_andi_i32(tmp, t1, 0x00ff00ff);\n\n tcg_gen_or_i32(rd, rd, tmp);\n\n\n\n tcg_gen_shri_i32(t1, t1, 8);\n\n tcg_gen_andi_i32(t1, t1, 0x00ff00ff);\n\n tcg_gen_andi_i32(tmp, t0, 0xff00ff00);\n\n tcg_gen_or_i32(t1, t1, tmp);\n\n tcg_gen_mov_i32(t0, rd);\n\n\n\n dead_tmp(tmp);\n\n dead_tmp(rd);\n\n}\n"}} {"sample_id": "36cccb8c575b74a691f685911fbb0301af19f924", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static void device_set_hotplugged(Object *obj, bool value, Error **err)\n+\n+{\n \n DeviceState *dev = DEVICE(obj);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void device_set_hotplugged(Object *obj, bool value, Error **err)\n\n{\n\n DeviceState *dev = DEVICE(obj);\n\n\n\n dev->hotplugged = value;\n\n}\n"}} {"sample_id": "24fee95321c1463360ba7042d026dae021854360", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,10 +2,10 @@\n \n {\n \n+ int old_flv_size;\n \n \n+\n // generate packet header and put data into buffer for FLV demuxer\n \n if (rt->flv_off < rt->flv_size) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int update_offset(RTMPContext *rt, int size)\n\n{\n\n int old_flv_size;\n\n\n\n // generate packet header and put data into buffer for FLV demuxer\n\n if (rt->flv_off < rt->flv_size) {\n\n // There is old unread data in the buffer, thus append at the end\n\n old_flv_size = rt->flv_size;\n\n rt->flv_size += size + 15;\n\n } else {\n\n // All data has been read, write the new data at the start of the buffer\n\n old_flv_size = 0;\n\n rt->flv_size = size + 15;\n\n rt->flv_off = 0;\n\n }\n\n\n\n return old_flv_size;\n\n}\n"}} {"sample_id": "e1c37d0e94048502f9874e6356ce7136d4b05bdb_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n DPRINTF(\"Unable to set nonblocking mode on file descriptor\\n\");\n \n goto err_after_open;\n+\n+ }\n+\n+\n+\n s->get_error = fd_errno;\n \n s->write = fd_write;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int fd_start_outgoing_migration(MigrationState *s, const char *fdname)\n\n{\n\n s->fd = monitor_get_fd(s->mon, fdname);\n\n if (s->fd == -1) {\n\n DPRINTF(\"fd_migration: invalid file descriptor identifier\\n\");\n\n goto err_after_get_fd;\n\n }\n\n\n\n if (fcntl(s->fd, F_SETFL, O_NONBLOCK) == -1) {\n\n DPRINTF(\"Unable to set nonblocking mode on file descriptor\\n\");\n\n goto err_after_open;\n\n }\n\n\n\n s->get_error = fd_errno;\n\n s->write = fd_write;\n\n s->close = fd_close;\n\n\n\n migrate_fd_connect(s);\n\n return 0;\n\n\n\nerr_after_open:\n\n close(s->fd);\n\nerr_after_get_fd:\n\n return -1;\n\n}\n"}} {"sample_id": "ebc996f3b13004e7272c462254522ba0102f09fe", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static int sys_utimensat(int dirfd, const char *pathname,\n \n const struct timespec times[2], int flags)\n+\n+{\n \n return (utimensat(dirfd, pathname, times, flags));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int sys_utimensat(int dirfd, const char *pathname,\n\n const struct timespec times[2], int flags)\n\n{\n\n return (utimensat(dirfd, pathname, times, flags));\n\n}\n"}} {"sample_id": "1546d487cf12da37d90a080813f8d57ac33036bf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n if(!val){\n \n+ do{\n+\n+\n+\n+ t = get_bits(gb, 8);\n \n val += t << 2;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int get_dimension(GetBitContext *gb, const int *dim)\n\n{\n\n int t = get_bits(gb, 3);\n\n int val = dim[t];\n\n if(val < 0)\n\n val = dim[get_bits1(gb) - val];\n\n if(!val){\n\n do{\n\n\n\n t = get_bits(gb, 8);\n\n val += t << 2;\n\n }while(t == 0xFF);\n\n }\n\n return val;\n\n}"}} {"sample_id": "441692ddd8321d5e0f09b163e86410e578d87236_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,7 +19,7 @@\n qemu_irq_raise(s->rdy);\n \n s->status = 0x0000;\n+\n s->intstatus = cold ? 0x8080 : 0x8010;\n \n s->unladdr[0] = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void onenand_reset(OneNANDState *s, int cold)\n\n{\n\n memset(&s->addr, 0, sizeof(s->addr));\n\n s->command = 0;\n\n s->count = 1;\n\n s->bufaddr = 0;\n\n s->config[0] = 0x40c0;\n\n s->config[1] = 0x0000;\n\n onenand_intr_update(s);\n\n qemu_irq_raise(s->rdy);\n\n s->status = 0x0000;\n\n s->intstatus = cold ? 0x8080 : 0x8010;\n\n s->unladdr[0] = 0;\n\n s->unladdr[1] = 0;\n\n s->wpstatus = 0x0002;\n\n s->cycle = 0;\n\n s->otpmode = 0;\n\n s->blk_cur = s->blk;\n\n s->current = s->image;\n\n s->secs_cur = s->secs;\n\n\n\n if (cold) {\n\n /* Lock the whole flash */\n\n memset(s->blockwp, ONEN_LOCK_LOCKED, s->blocks);\n\n\n\n if (s->blk_cur && blk_read(s->blk_cur, 0, s->boot[0], 8) < 0) {\n\n hw_error(\"%s: Loading the BootRAM failed.\\n\", __func__);\n\n }\n\n }\n\n}\n"}} {"sample_id": "062ba099e01ff1474be98c0a4f3da351efab5d9d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,14 +7,14 @@\n ARMCPU *target_cpu;\n \n \n+\n DPRINTF(\"cpu %\" PRId64 \"\\n\", cpuid);\n \n \n+\n+ /* change to the cpu we are powering up */\n+\n+ target_cpu_state = arm_get_cpu_by_id(cpuid);\n \n if (!target_cpu_state) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int arm_set_cpu_off(uint64_t cpuid)\n\n{\n\n CPUState *target_cpu_state;\n\n ARMCPU *target_cpu;\n\n\n\n DPRINTF(\"cpu %\" PRId64 \"\\n\", cpuid);\n\n\n\n /* change to the cpu we are powering up */\n\n target_cpu_state = arm_get_cpu_by_id(cpuid);\n\n if (!target_cpu_state) {\n\n return QEMU_ARM_POWERCTL_INVALID_PARAM;\n\n }\n\n target_cpu = ARM_CPU(target_cpu_state);\n\n if (target_cpu->powered_off) {\n\n qemu_log_mask(LOG_GUEST_ERROR,\n\n \"[ARM]%s: CPU %\" PRId64 \" is already off\\n\",\n\n __func__, cpuid);\n\n return QEMU_ARM_POWERCTL_IS_OFF;\n\n }\n\n\n\n target_cpu->powered_off = true;\n\n target_cpu_state->halted = 1;\n\n target_cpu_state->exception_index = EXCP_HLT;\n\n cpu_loop_exit(target_cpu_state);\n\n /* notreached */\n\n\n\n return QEMU_ARM_POWERCTL_RET_SUCCESS;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_345", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,6 +6,6 @@\n \n \n \n+ m48t59_write(NVRAM, addr, value & 0xff);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void nvram_writeb (void *opaque, target_phys_addr_t addr, uint32_t value)\n\n{\n\n M48t59State *NVRAM = opaque;\n\n\n\n m48t59_write(NVRAM, addr, value & 0xff);\n\n}\n"}} {"sample_id": "fd5293d216316752fd34dcb29051e748f076e5fb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n avfilter_unref_buffer(tinterlace->cur);\n \n+ tinterlace->cur = tinterlace->next;\n+\n+ tinterlace->next = picref;\n+\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int start_frame(AVFilterLink *inlink, AVFilterBufferRef *picref)\n\n{\n\n AVFilterContext *ctx = inlink->dst;\n\n TInterlaceContext *tinterlace = ctx->priv;\n\n\n\n avfilter_unref_buffer(tinterlace->cur);\n\n tinterlace->cur = tinterlace->next;\n\n tinterlace->next = picref;\n\n\n return 0;\n\n}"}} {"sample_id": "3e033da84782e12ed529e6a88dd53b6a72199e8e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n ff_rm_retrieve_cache (AVFormatContext *s, AVIOContext *pb,\n \n AVStream *st, RMStream *ast, AVPacket *pkt)\n+\n {\n \n RMDemuxContext *rm = s->priv_data;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "ff_rm_retrieve_cache (AVFormatContext *s, AVIOContext *pb,\n\n AVStream *st, RMStream *ast, AVPacket *pkt)\n\n{\n\n RMDemuxContext *rm = s->priv_data;\n\n\n\n assert (rm->audio_pkt_cnt > 0);\n\n\n\n if (st->codec->codec_id == CODEC_ID_AAC)\n\n av_get_packet(pb, pkt, ast->sub_packet_lengths[ast->sub_packet_cnt - rm->audio_pkt_cnt]);\n\n else {\n\n av_new_packet(pkt, st->codec->block_align);\n\n memcpy(pkt->data, ast->pkt.data + st->codec->block_align * //FIXME avoid this\n\n (ast->sub_packet_h * ast->audio_framesize / st->codec->block_align - rm->audio_pkt_cnt),\n\n st->codec->block_align);\n\n }\n\n rm->audio_pkt_cnt--;\n\n if ((pkt->pts = ast->audiotimestamp) != AV_NOPTS_VALUE) {\n\n ast->audiotimestamp = AV_NOPTS_VALUE;\n\n pkt->flags = AV_PKT_FLAG_KEY;\n\n } else\n\n pkt->flags = 0;\n\n pkt->stream_index = st->index;\n\n\n\n return rm->audio_pkt_cnt;\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_36", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static uint32_t qvirtio_pci_get_guest_features(QVirtioDevice *d)\n \n+{\n \n QVirtioPCIDevice *dev = (QVirtioPCIDevice *)d;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static uint32_t qvirtio_pci_get_guest_features(QVirtioDevice *d)\n\n{\n\n QVirtioPCIDevice *dev = (QVirtioPCIDevice *)d;\n\n return qpci_io_readl(dev->pdev, dev->addr + VIRTIO_PCI_GUEST_FEATURES);\n\n}\n"}} {"sample_id": "a12a5a1a0132527afe87c079e4aae4aad372bd94", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n {\n \n+ UserDefFlatUnion2 *tmp = NULL;\n+\n Error *err = NULL;\n \n Visitor *v;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_validate_fail_union_flat_no_discrim(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n UserDefFlatUnion2 *tmp = NULL;\n\n Error *err = NULL;\n\n Visitor *v;\n\n\n\n /* test situation where discriminator field ('enum1' here) is missing */\n\n v = validate_test_init(data, \"{ 'integer': 42, 'string': 'c', 'string1': 'd', 'string2': 'e' }\");\n\n\n\n visit_type_UserDefFlatUnion2(v, &tmp, NULL, &err);\n\n g_assert(err);\n\n error_free(err);\n\n qapi_free_UserDefFlatUnion2(tmp);\n\n}\n"}} {"sample_id": "d98e6c5d5d80c1dfe0c30f2e73d41a3aea0b920d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n return 0;\n if (buf_size <= 7)\n buf_size -= 7;\n+ /* Decode rle bitmap length, stored size includes width/height data */\n+ rle_bitmap_len = bytestream_get_be24(&buf) - 2*2;\n+ /* Get bitmap dimensions from data */\n+ width = bytestream_get_be16(&buf);\n+ height = bytestream_get_be16(&buf);\n /* Make sure the bitmap is not too large */\n if (avctx->width < width || avctx->height < height) {\n av_log(avctx, AV_LOG_ERROR, \"Bitmap dimensions larger than video.\\n\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int parse_object_segment(AVCodecContext *avctx,\n const uint8_t *buf, int buf_size)\n{\n PGSSubContext *ctx = avctx->priv_data;\n PGSSubObject *object;\n uint8_t sequence_desc;\n unsigned int rle_bitmap_len, width, height;\n int id;\n if (buf_size <= 4)\n buf_size -= 4;\n id = bytestream_get_be16(&buf);\n object = find_object(id, &ctx->objects);\n if (!object) {\n if (ctx->objects.count >= MAX_EPOCH_OBJECTS) {\n av_log(avctx, AV_LOG_ERROR, \"Too many objects in epoch\\n\");\n object = &ctx->objects.object[ctx->objects.count++];\n object->id = id;\n /* skip object version number */\n buf += 1;\n /* Read the Sequence Description to determine if start of RLE data or appended to previous RLE */\n sequence_desc = bytestream_get_byte(&buf);\n if (!(sequence_desc & 0x80)) {\n /* Additional RLE data */\n if (buf_size > object->rle_remaining_len)\n memcpy(object->rle + object->rle_data_len, buf, buf_size);\n object->rle_data_len += buf_size;\n object->rle_remaining_len -= buf_size;\n return 0;\n if (buf_size <= 7)\n buf_size -= 7;\n /* Decode rle bitmap length, stored size includes width/height data */\n rle_bitmap_len = bytestream_get_be24(&buf) - 2*2;\n /* Get bitmap dimensions from data */\n width = bytestream_get_be16(&buf);\n height = bytestream_get_be16(&buf);\n /* Make sure the bitmap is not too large */\n if (avctx->width < width || avctx->height < height) {\n av_log(avctx, AV_LOG_ERROR, \"Bitmap dimensions larger than video.\\n\");\n object->w = width;\n object->h = height;\n av_fast_malloc(&object->rle, &object->rle_buffer_size, rle_bitmap_len);\n if (!object->rle)\n return AVERROR(ENOMEM);\n memcpy(object->rle, buf, buf_size);\n object->rle_data_len = buf_size;\n object->rle_remaining_len = rle_bitmap_len - buf_size;\n return 0;"}} {"sample_id": "e92a78a4095d69d876bef189225608a35166dc4a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void ff_write_pass1_stats(MpegEncContext *s)\n+\n {\n \n snprintf(s->avctx->stats_out, 256,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void ff_write_pass1_stats(MpegEncContext *s)\n\n{\n\n snprintf(s->avctx->stats_out, 256,\n\n \"in:%d out:%d type:%d q:%d itex:%d ptex:%d mv:%d misc:%d \"\n\n \"fcode:%d bcode:%d mc-var:%d var:%d icount:%d skipcount:%d hbits:%d;\\n\",\n\n s->current_picture_ptr->f.display_picture_number,\n\n s->current_picture_ptr->f.coded_picture_number,\n\n s->pict_type,\n\n s->current_picture.f.quality,\n\n s->i_tex_bits,\n\n s->p_tex_bits,\n\n s->mv_bits,\n\n s->misc_bits,\n\n s->f_code,\n\n s->b_code,\n\n s->current_picture.mc_mb_var_sum,\n\n s->current_picture.mb_var_sum,\n\n s->i_count, s->skip_count,\n\n s->header_bits);\n\n}\n"}} {"sample_id": "a38469e1da7b4829a2fba4279d8420a33f96832e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n int read_ffserver_streams(AVFormatContext *s, const char *filename)\n \n+{\n+\n+ int i;\n+\n+ AVFormatContext *ic;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int read_ffserver_streams(AVFormatContext *s, const char *filename)\n\n{\n\n int i;\n\n AVFormatContext *ic;\n\n\n\n ic = av_open_input_file(filename, FFM_PACKET_SIZE);\n\n if (!ic)\n\n return -EIO;\n\n /* copy stream format */\n\n s->nb_streams = ic->nb_streams;\n\n for(i=0;inb_streams;i++) {\n\n AVStream *st;\n\n st = av_mallocz(sizeof(AVFormatContext));\n\n memcpy(st, ic->streams[i], sizeof(AVStream));\n\n s->streams[i] = st;\n\n }\n\n\n\n av_close_input_file(ic);\n\n return 0;\n\n}\n"}} {"sample_id": "2caf19e90f270abe1e80a3e85acaf0eb5c9d0aac_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,8 +12,8 @@\n \n PREDICT_8x8_LOAD_TOP;\n \n+ src[0] = t0;\n+\n src[1] = t1;\n \n src[2] = t2;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void FUNCC(pred8x8l_vertical)(uint8_t *_src, int has_topleft, int has_topright, int _stride)\n\n{\n\n int y;\n\n pixel *src = (pixel*)_src;\n\n int stride = _stride/sizeof(pixel);\n\n\n\n PREDICT_8x8_LOAD_TOP;\n\n src[0] = t0;\n\n src[1] = t1;\n\n src[2] = t2;\n\n src[3] = t3;\n\n src[4] = t4;\n\n src[5] = t5;\n\n src[6] = t6;\n\n src[7] = t7;\n\n for( y = 1; y < 8; y++ ) {\n\n ((pixel4*)(src+y*stride))[0] = ((pixel4*)src)[0];\n\n ((pixel4*)(src+y*stride))[1] = ((pixel4*)src)[1];\n\n }\n\n}\n"}} {"sample_id": "94fb0909645de18481cc726ee0ec9b5afa861394", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+static int ram_decompress_open(RamDecompressState *s, QEMUFile *f)\n+\n+{\n+\n+ int ret;\n+\n+ memset(s, 0, sizeof(*s));\n \n s->f = f;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int ram_decompress_open(RamDecompressState *s, QEMUFile *f)\n\n{\n\n int ret;\n\n memset(s, 0, sizeof(*s));\n\n s->f = f;\n\n ret = inflateInit(&s->zstream);\n\n if (ret != Z_OK)\n\n return -1;\n\n return 0;\n\n}\n"}} {"sample_id": "fd56e0612b6454a282fa6a953fdb09281a98c589_15", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,10 +24,10 @@\n \n * Synchronize between bios and QEMU by canceling\n \n+ * pxb's effect.\n+\n+ */\n+\n+ return pin - PCI_SLOT(pxb->devfn);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pxb_map_irq_fn(PCIDevice *pci_dev, int pin)\n\n{\n\n PCIDevice *pxb = pci_dev->bus->parent_dev;\n\n\n\n /*\n\n * The bios does not index the pxb slot number when\n\n * it computes the IRQ because it resides on bus 0\n\n * and not on the current bus.\n\n * However QEMU routes the irq through bus 0 and adds\n\n * the pxb slot to the IRQ computation of the PXB\n\n * device.\n\n *\n\n * Synchronize between bios and QEMU by canceling\n\n * pxb's effect.\n\n */\n\n return pin - PCI_SLOT(pxb->devfn);\n\n}\n"}} {"sample_id": "9a78eead0c74333a394c0f7bbfc4423ac746fcd5_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n cpu_fprintf(f, \"BROKEN: LO=0x\" TARGET_FMT_lx \"\\n\", env->active_tc.LO[0]);\n \n+ if (!SIGN_EXT_P(env->btarget))\n+\n+ cpu_fprintf(f, \"BROKEN: btarget=0x\" TARGET_FMT_lx \"\\n\", env->btarget);\n+\n+\n \n for (i = 0; i < 32; i++) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "cpu_mips_check_sign_extensions (CPUState *env, FILE *f,\n\n int (*cpu_fprintf)(FILE *f, const char *fmt, ...),\n\n int flags)\n\n{\n\n int i;\n\n\n\n if (!SIGN_EXT_P(env->active_tc.PC))\n\n cpu_fprintf(f, \"BROKEN: pc=0x\" TARGET_FMT_lx \"\\n\", env->active_tc.PC);\n\n if (!SIGN_EXT_P(env->active_tc.HI[0]))\n\n cpu_fprintf(f, \"BROKEN: HI=0x\" TARGET_FMT_lx \"\\n\", env->active_tc.HI[0]);\n\n if (!SIGN_EXT_P(env->active_tc.LO[0]))\n\n cpu_fprintf(f, \"BROKEN: LO=0x\" TARGET_FMT_lx \"\\n\", env->active_tc.LO[0]);\n\n if (!SIGN_EXT_P(env->btarget))\n\n cpu_fprintf(f, \"BROKEN: btarget=0x\" TARGET_FMT_lx \"\\n\", env->btarget);\n\n\n\n for (i = 0; i < 32; i++) {\n\n if (!SIGN_EXT_P(env->active_tc.gpr[i]))\n\n cpu_fprintf(f, \"BROKEN: %s=0x\" TARGET_FMT_lx \"\\n\", regnames[i], env->active_tc.gpr[i]);\n\n }\n\n\n\n if (!SIGN_EXT_P(env->CP0_EPC))\n\n cpu_fprintf(f, \"BROKEN: EPC=0x\" TARGET_FMT_lx \"\\n\", env->CP0_EPC);\n\n if (!SIGN_EXT_P(env->lladdr))\n\n cpu_fprintf(f, \"BROKEN: LLAddr=0x\" TARGET_FMT_lx \"\\n\", env->lladdr);\n\n}\n"}} {"sample_id": "9767ec6b865c35f68cb6642fefeacc009f17e638", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n printf(\"\\n\"\n \n \"Options:\\n\"\n+\n+ \"-e echo each input line on output\\n\"\n+\n+ \"-h print this help\\n\"\n+\n \"-i INFILE set INFILE as input file, stdin if omitted\\n\"\n \n \"-l LEVEL set the number of escaping levels, 1 if omitted\\n\"", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void usage(void)\n\n{\n\n printf(\"Escape an input string, adopting the av_get_token() escaping logic\\n\");\n\n printf(\"usage: ffescape [OPTIONS]\\n\");\n\n printf(\"\\n\"\n\n \"Options:\\n\"\n\n \"-e echo each input line on output\\n\"\n\n \"-h print this help\\n\"\n\n \"-i INFILE set INFILE as input file, stdin if omitted\\n\"\n\n \"-l LEVEL set the number of escaping levels, 1 if omitted\\n\"\n\n \"-m ESCAPE_MODE select escape mode between 'full', 'lazy', 'quote', default is 'lazy'\\n\"\n\n \"-o OUTFILE set OUTFILE as output file, stdout if omitted\\n\"\n\n \"-p PROMPT set output prompt, is '=> ' by default\\n\"\n\n \"-s SPECIAL_CHARS set the list of special characters\\n\");\n\n}\n"}} {"sample_id": "5bca5f87d1a32669e0357790e0d0ad8a5c9c998b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static av_noinline void emulated_edge_mc_mmxext(uint8_t *buf, const uint8_t *src,\n+\n+ ptrdiff_t buf_stride,\n+\n ptrdiff_t src_stride,\n \n int block_w, int block_h,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_noinline void emulated_edge_mc_mmxext(uint8_t *buf, const uint8_t *src,\n\n ptrdiff_t buf_stride,\n\n ptrdiff_t src_stride,\n\n int block_w, int block_h,\n\n int src_x, int src_y, int w, int h)\n\n{\n\n emulated_edge_mc(buf, src, buf_stride, src_stride, block_w, block_h,\n\n src_x, src_y, w, h, vfixtbl_mmx, &ff_emu_edge_vvar_mmx,\n\n hfixtbl_mmxext, &ff_emu_edge_hvar_mmxext);\n\n}\n"}} {"sample_id": "b20909195745c34a819aed14ae996b60ab0f591f_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n iscsi_abort_task_cb(struct iscsi_context *iscsi, int status, void *command_data,\n+\n+ void *private_data)\n+\n {\n \n IscsiAIOCB *acb = (IscsiAIOCB *)private_data;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "iscsi_abort_task_cb(struct iscsi_context *iscsi, int status, void *command_data,\n\n void *private_data)\n\n{\n\n IscsiAIOCB *acb = (IscsiAIOCB *)private_data;\n\n\n\n scsi_free_scsi_task(acb->task);\n\n acb->task = NULL;\n\n}\n"}} {"sample_id": "1635eecc413ed680013cf77e6994901cafe15590", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n BMDMAState *bm = opaque;\n \n+\n+\n if (!level) {\n \n /* pass through lower */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void bmdma_irq(void *opaque, int n, int level)\n\n{\n\n BMDMAState *bm = opaque;\n\n\n\n if (!level) {\n\n /* pass through lower */\n\n qemu_set_irq(bm->irq, level);\n\n return;\n\n }\n\n\n\n if (bm) {\n\n bm->status |= BM_STATUS_INT;\n\n }\n\n\n\n /* trigger the real irq */\n\n qemu_set_irq(bm->irq, level);\n\n}\n"}} {"sample_id": "edf779ffccc836661a7b654d320571a6c220caea", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static inline void memcpy_tofs(void * to, const void * from, unsigned long n)\n \n+{\n \n \tmemcpy(to, from, n);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void memcpy_tofs(void * to, const void * from, unsigned long n)\n\n{\n\n\tmemcpy(to, from, n);\n\n}\n"}} {"sample_id": "32c16620dda8ba16f6d6bcd20efefdec8975af77", "diff": "--- a/source.c\n+++ b/source.c\n@@ -37,11 +37,11 @@\n ret = ga_channel_client_add(c, client_fd);\n \n if (ret) {\n+\n+ g_warning(\"error setting up connection\");\n+\n+\n+ goto out;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static gboolean ga_channel_listen_accept(GIOChannel *channel,\n\n GIOCondition condition, gpointer data)\n\n{\n\n GAChannel *c = data;\n\n int ret, client_fd;\n\n bool accepted = false;\n\n struct sockaddr_un addr;\n\n socklen_t addrlen = sizeof(addr);\n\n\n\n g_assert(channel != NULL);\n\n\n\n client_fd = qemu_accept(g_io_channel_unix_get_fd(channel),\n\n (struct sockaddr *)&addr, &addrlen);\n\n if (client_fd == -1) {\n\n g_warning(\"error converting fd to gsocket: %s\", strerror(errno));\n\n goto out;\n\n }\n\n fcntl(client_fd, F_SETFL, O_NONBLOCK);\n\n ret = ga_channel_client_add(c, client_fd);\n\n if (ret) {\n\n g_warning(\"error setting up connection\");\n\n\n goto out;\n\n }\n\n accepted = true;\n\n\n\nout:\n\n /* only accept 1 connection at a time */\n\n return !accepted;\n\n}"}} {"sample_id": "231bb267644ee3a9ebfd9c7f42d5d41610194b45_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n uint64_t buf[RT_ENTRIES_PER_SECTOR];\n \n int rt_start_index;\n+\n int i, ret;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int write_reftable_entry(BlockDriverState *bs, int rt_index)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n uint64_t buf[RT_ENTRIES_PER_SECTOR];\n\n int rt_start_index;\n\n int i, ret;\n\n\n\n rt_start_index = rt_index & ~(RT_ENTRIES_PER_SECTOR - 1);\n\n for (i = 0; i < RT_ENTRIES_PER_SECTOR; i++) {\n\n buf[i] = cpu_to_be64(s->refcount_table[rt_start_index + i]);\n\n }\n\n\n\n ret = qcow2_pre_write_overlap_check(bs,\n\n QCOW2_OL_DEFAULT & ~QCOW2_OL_REFCOUNT_TABLE,\n\n s->refcount_table_offset + rt_start_index * sizeof(uint64_t),\n\n sizeof(buf));\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n\n\n BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_UPDATE);\n\n ret = bdrv_pwrite_sync(bs->file, s->refcount_table_offset +\n\n rt_start_index * sizeof(uint64_t), buf, sizeof(buf));\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "f5bebbbb28dc7a149a891f0f1e112fb50bb72664", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ int i;\n+\n+\n+\n+ if (!qemu_isalpha(id[0])) {\n \n return 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_opts_id_wellformed(const char *id)\n\n{\n\n int i;\n\n\n\n if (!qemu_isalpha(id[0])) {\n\n return 0;\n\n }\n\n for (i = 1; id[i]; i++) {\n\n if (!qemu_isalnum(id[i]) && !strchr(\"-._\", id[i])) {\n\n return 0;\n\n }\n\n }\n\n return 1;\n\n}\n"}} {"sample_id": "b931bfbf042983f311b3b09894d8030b2755a638_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n /* We don't provide a receive callback */\n \n+ s->nc.receive_disabled = 1;\n+\n+ s->chr = chr;\n+\n+\n \n qemu_chr_add_handlers(s->chr, NULL, NULL, net_vhost_user_event, s);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int net_vhost_user_init(NetClientState *peer, const char *device,\n\n const char *name, CharDriverState *chr)\n\n{\n\n NetClientState *nc;\n\n VhostUserState *s;\n\n\n\n nc = qemu_new_net_client(&net_vhost_user_info, peer, device, name);\n\n\n\n snprintf(nc->info_str, sizeof(nc->info_str), \"vhost-user to %s\",\n\n chr->label);\n\n\n\n s = DO_UPCAST(VhostUserState, nc, nc);\n\n\n\n /* We don't provide a receive callback */\n\n s->nc.receive_disabled = 1;\n\n s->chr = chr;\n\n\n\n qemu_chr_add_handlers(s->chr, NULL, NULL, net_vhost_user_event, s);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "63736fe48c30c5db313c3a25d1462ad31b2a1671", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n int ff_avfilter_graph_config_formats(AVFilterGraph *graph, AVClass *log_ctx)\n+\n+{\n+\n+ int ret;\n+\n \n \n /* find supported formats from sub-filters, and merge along links */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int ff_avfilter_graph_config_formats(AVFilterGraph *graph, AVClass *log_ctx)\n\n{\n\n int ret;\n\n\n\n /* find supported formats from sub-filters, and merge along links */\n\n if ((ret = query_formats(graph, log_ctx)) < 0)\n\n return ret;\n\n\n\n /* Once everything is merged, it's possible that we'll still have\n\n * multiple valid media format choices. We pick the first one. */\n\n pick_formats(graph);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "bc851a2946c64eefb96145b70e2190ff7d5a4827", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n int i;\n \n \n+\n if (!ost)\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int ogg_restore(AVFormatContext *s, int discard)\n\n{\n\n struct ogg *ogg = s->priv_data;\n\n AVIOContext *bc = s->pb;\n\n struct ogg_state *ost = ogg->state;\n\n int i;\n\n\n\n if (!ost)\n\n return 0;\n\n\n\n ogg->state = ost->next;\n\n\n\n if (!discard){\n\n for (i = 0; i < ogg->nstreams; i++)\n\n av_free (ogg->streams[i].buf);\n\n\n\n avio_seek (bc, ost->pos, SEEK_SET);\n\n ogg->curidx = ost->curidx;\n\n ogg->nstreams = ost->nstreams;\n\n memcpy(ogg->streams, ost->streams,\n\n ost->nstreams * sizeof(*ogg->streams));\n\n }\n\n\n\n av_free (ost);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "bd5c860fdbc33d19d2ff0f6d1f06de07c17560dd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void av_thread_message_queue_set_err_recv(AVThreadMessageQueue *mq,\n \n int err)\n+\n {\n \n #if HAVE_THREADS", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void av_thread_message_queue_set_err_recv(AVThreadMessageQueue *mq,\n\n int err)\n\n{\n\n#if HAVE_THREADS\n\n pthread_mutex_lock(&mq->lock);\n\n mq->err_recv = err;\n\n pthread_cond_broadcast(&mq->cond);\n\n pthread_mutex_unlock(&mq->lock);\n\n#endif /* HAVE_THREADS */\n\n}\n"}} {"sample_id": "fb96ac469a1d375b473868984f832e3a7cdfc24c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,7 +14,7 @@\n \n nut->last_syncpoint_pos = avio_tell(bc) - 8;\n \n+\n \n end = get_packetheader(nut, bc, 1, SYNCPOINT_STARTCODE);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int decode_syncpoint(NUTContext *nut, int64_t *ts, int64_t *back_ptr)\n\n{\n\n AVFormatContext *s = nut->avf;\n\n AVIOContext *bc = s->pb;\n\n int64_t end;\n\n uint64_t tmp;\n\n\n\n nut->last_syncpoint_pos = avio_tell(bc) - 8;\n\n\n\n end = get_packetheader(nut, bc, 1, SYNCPOINT_STARTCODE);\n\n end += avio_tell(bc);\n\n\n\n tmp = ffio_read_varlen(bc);\n\n *back_ptr = nut->last_syncpoint_pos - 16 * ffio_read_varlen(bc);\n\n if (*back_ptr < 0)\n\n return -1;\n\n\n\n ff_nut_reset_ts(nut, nut->time_base[tmp % nut->time_base_count],\n\n tmp / nut->time_base_count);\n\n\n\n if (skip_reserved(bc, end) || ffio_get_checksum(bc)) {\n\n av_log(s, AV_LOG_ERROR, \"sync point checksum mismatch\\n\");\n\n return -1;\n\n }\n\n\n\n *ts = tmp / s->nb_streams *\n\n av_q2d(nut->time_base[tmp % s->nb_streams]) * AV_TIME_BASE;\n\n ff_nut_add_sp(nut, nut->last_syncpoint_pos, *back_ptr, *ts);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a0efbf16604770b9d805bcf210ec29942321134f_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,5 +5,5 @@\n range->begin = range->end = 0;\n \n pci_for_each_device_under_bus(bus, pci_dev_get_w64, range);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void pci_bus_get_w64_range(PCIBus *bus, Range *range)\n\n{\n\n range->begin = range->end = 0;\n\n pci_for_each_device_under_bus(bus, pci_dev_get_w64, range);\n\n}\n"}} {"sample_id": "7e2515e87c41e2e658aaed466e11cbdf1ea8bcb1_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,5 +7,5 @@\n completions[nb_completions++] = qemu_strdup(str);\n \n }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void add_completion(const char *str)\n\n{\n\n if (nb_completions < NB_COMPLETIONS_MAX) {\n\n completions[nb_completions++] = qemu_strdup(str);\n\n }\n\n}\n"}} {"sample_id": "2d40a09b6e73230b160a505f01ed1acf169e1d9f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n+static int libquvi_probe(AVProbeData *p)\n+\n+{\n+\n+ int score;\n+\n+ quvi_t q;\n+\n+ QUVIcode rc;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int libquvi_probe(AVProbeData *p)\n\n{\n\n int score;\n\n quvi_t q;\n\n QUVIcode rc;\n\n\n\n rc = quvi_init(&q);\n\n if (rc != QUVI_OK)\n\n return AVERROR(ENOMEM);\n\n score = quvi_supported(q, (char *)p->filename) == QUVI_OK ? AVPROBE_SCORE_EXTENSION : 0;\n\n quvi_close(&q);\n\n return score;\n\n}\n"}} {"sample_id": "bd269ebc82fbaa5fe7ce5bc7c1770ac8acecd884", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n \n \n saddr = g_new0(SocketAddressLegacy, 1);\n+\n+ saddr->type = SOCKET_ADDRESS_LEGACY_KIND_UNIX;\n+\n+ saddr->u.q_unix.data = g_new0(UnixSocketAddress, 1);\n+\n saddr->u.q_unix.data->path = g_strdup(path);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static SocketAddressLegacy *unix_build_address(const char *path)\n\n{\n\n SocketAddressLegacy *saddr;\n\n\n\n saddr = g_new0(SocketAddressLegacy, 1);\n\n saddr->type = SOCKET_ADDRESS_LEGACY_KIND_UNIX;\n\n saddr->u.q_unix.data = g_new0(UnixSocketAddress, 1);\n\n saddr->u.q_unix.data->path = g_strdup(path);\n\n\n\n return saddr;\n\n}\n"}} {"sample_id": "6f2d8978728c48ca46f5c01835438508aace5c64_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static always_inline target_phys_addr_t get_pgaddr (target_phys_addr_t sdr1,\n+\n int sdr_sh,\n \n target_phys_addr_t hash,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static always_inline target_phys_addr_t get_pgaddr (target_phys_addr_t sdr1,\n\n int sdr_sh,\n\n target_phys_addr_t hash,\n\n target_phys_addr_t mask)\n\n{\n\n return (sdr1 & ((target_ulong)(-1ULL) << sdr_sh)) | (hash & mask);\n\n}\n"}} {"sample_id": "2c8cff2be4a044c66e4904efa156dafd0d332d25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n ASFContext *asf = s->priv_data;\n \n+\n+\n+ s->packet_size = PACKET_SIZE;\n+\n+ s->max_interleave_delta = 0;\n \n asf->nb_packets = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int asf_write_header(AVFormatContext *s)\n\n{\n\n ASFContext *asf = s->priv_data;\n\n\n\n s->packet_size = PACKET_SIZE;\n\n s->max_interleave_delta = 0;\n\n asf->nb_packets = 0;\n\n\n\n asf->index_ptr = av_malloc(sizeof(ASFIndex) * ASF_INDEX_BLOCK);\n\n asf->nb_index_memory_alloc = ASF_INDEX_BLOCK;\n\n asf->maximum_packet = 0;\n\n\n\n /* the data-chunk-size has to be 50 (DATA_HEADER_SIZE), which is\n\n * data_size - asf->data_offset at the moment this function is done.\n\n * It is needed to use asf as a streamable format. */\n\n if (asf_write_header1(s, 0, DATA_HEADER_SIZE) < 0) {\n\n //av_free(asf);\n\n\n return -1;\n\n }\n\n\n\n avio_flush(s->pb);\n\n\n\n asf->packet_nb_payloads = 0;\n\n asf->packet_timestamp_start = -1;\n\n asf->packet_timestamp_end = -1;\n\n ffio_init_context(&asf->pb, asf->packet_buf, s->packet_size, 1,\n\n NULL, NULL, NULL, NULL);\n\n\n\n if (s->avoid_negative_ts < 0)\n\n s->avoid_negative_ts = 1;\n\n\n\n return 0;\n\n}"}} {"sample_id": "4d1cb6e6f51b0d8405f701806a203a73e7431fe5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n dbs->acb = NULL;\n \n dbs->bs = bs;\n+\n+ dbs->sg = sg;\n+\n+ dbs->sector_num = sector_num;\n+\n dbs->sg_cur_index = 0;\n \n dbs->sg_cur_byte = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "BlockDriverAIOCB *dma_bdrv_io(\n\n BlockDriverState *bs, QEMUSGList *sg, uint64_t sector_num,\n\n DMAIOFunc *io_func, BlockDriverCompletionFunc *cb,\n\n void *opaque, DMADirection dir)\n\n{\n\n DMAAIOCB *dbs = qemu_aio_get(&dma_aiocb_info, bs, cb, opaque);\n\n\n\n trace_dma_bdrv_io(dbs, bs, sector_num, (dir == DMA_DIRECTION_TO_DEVICE));\n\n\n\n dbs->acb = NULL;\n\n dbs->bs = bs;\n\n dbs->sg = sg;\n\n dbs->sector_num = sector_num;\n\n dbs->sg_cur_index = 0;\n\n dbs->sg_cur_byte = 0;\n\n dbs->dir = dir;\n\n\n dbs->io_func = io_func;\n\n dbs->bh = NULL;\n\n qemu_iovec_init(&dbs->iov, sg->nsg);\n\n dma_bdrv_cb(dbs, 0);\n\n return &dbs->common;\n\n}"}} {"sample_id": "87513d654546a99f8ddb045ca4fa5d33778a617e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n int height = FFMIN(avctx->height, C64YRES);\n \n int width = FFMIN(avctx->width , C64XRES);\n+\n uint8_t *src = p->data[0];\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void to_meta_with_crop(AVCodecContext *avctx, AVFrame *p, int *dest)\n\n{\n\n int blockx, blocky, x, y;\n\n int luma = 0;\n\n int height = FFMIN(avctx->height, C64YRES);\n\n int width = FFMIN(avctx->width , C64XRES);\n\n uint8_t *src = p->data[0];\n\n\n\n for (blocky = 0; blocky < C64YRES; blocky += 8) {\n\n for (blockx = 0; blockx < C64XRES; blockx += 8) {\n\n for (y = blocky; y < blocky + 8 && y < C64YRES; y++) {\n\n for (x = blockx; x < blockx + 8 && x < C64XRES; x += 2) {\n\n if(x < width && y < height) {\n\n /* build average over 2 pixels */\n\n luma = (src[(x + 0 + y * p->linesize[0])] +\n\n src[(x + 1 + y * p->linesize[0])]) / 2;\n\n /* write blocks as linear data now so they are suitable for elbg */\n\n dest[0] = luma;\n\n }\n\n dest++;\n\n }\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "8786db7cb96f8ce5c75c6e1e074319c9dca8d356_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void memory_region_sync_dirty_bitmap(MemoryRegion *mr)\n \n+{\n \n FlatRange *fr;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void memory_region_sync_dirty_bitmap(MemoryRegion *mr)\n\n{\n\n FlatRange *fr;\n\n\n\n FOR_EACH_FLAT_RANGE(fr, &address_space_memory.current_map) {\n\n if (fr->mr == mr) {\n\n MEMORY_LISTENER_UPDATE_REGION(fr, &address_space_memory,\n\n Forward, log_sync);\n\n }\n\n }\n\n}\n"}} {"sample_id": "12848bfc5d719bad536c5448205a3226be1fda47", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,10 +9,10 @@\n \n \n /* Determine the security model */\n+\n+ if (fs_ctx->fs_sm == SM_MAPPED) {\n \n+ err = mkdir(rpath(fs_ctx, path), SM_LOCAL_DIR_MODE_BITS);\n \n if (err == -1) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int local_mkdir(FsContext *fs_ctx, const char *path, FsCred *credp)\n\n{\n\n int err = -1;\n\n int serrno = 0;\n\n\n\n /* Determine the security model */\n\n if (fs_ctx->fs_sm == SM_MAPPED) {\n\n err = mkdir(rpath(fs_ctx, path), SM_LOCAL_DIR_MODE_BITS);\n\n if (err == -1) {\n\n return err;\n\n }\n\n credp->fc_mode = credp->fc_mode|S_IFDIR;\n\n err = local_set_xattr(rpath(fs_ctx, path), credp);\n\n if (err == -1) {\n\n serrno = errno;\n\n goto err_end;\n\n }\n\n } else if (fs_ctx->fs_sm == SM_PASSTHROUGH) {\n\n err = mkdir(rpath(fs_ctx, path), credp->fc_mode);\n\n if (err == -1) {\n\n return err;\n\n }\n\n err = local_post_create_passthrough(fs_ctx, path, credp);\n\n if (err == -1) {\n\n serrno = errno;\n\n goto err_end;\n\n }\n\n }\n\n return err;\n\n\n\nerr_end:\n\n remove(rpath(fs_ctx, path));\n\n errno = serrno;\n\n return err;\n\n}\n"}} {"sample_id": "f42b3195d3f2692a4dfc0a8668bb4ac35301f2ed", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void fix_bitshift(ShortenContext *s, int32_t *buffer)\n \n {\n+\n int i;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void fix_bitshift(ShortenContext *s, int32_t *buffer)\n\n{\n\n int i;\n\n\n\n if (s->bitshift != 0)\n\n for (i = 0; i < s->blocksize; i++)\n\n buffer[s->nwrap + i] <<= s->bitshift;\n\n}\n"}} {"sample_id": "354711279fcc532cee310ed8098f51403dfef5d9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n return;\n \n }\n+\n if (data_dir_idx == ARRAY_SIZE(data_dir)) {\n \n return;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void qemu_add_data_dir(const char *path)\n\n{\n\n int i;\n\n\n\n if (path == NULL) {\n\n return;\n\n }\n\n if (data_dir_idx == ARRAY_SIZE(data_dir)) {\n\n return;\n\n }\n\n for (i = 0; i < data_dir_idx; i++) {\n\n if (strcmp(data_dir[i], path) == 0) {\n\n return; /* duplicate */\n\n }\n\n }\n\n data_dir[data_dir_idx++] = path;\n\n}\n"}} {"sample_id": "8092cb71322ca488deeb7c750ff8022ffcc2f9a6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n \n \n if (level) {\n+\n apic_local_deliver(s, APIC_LVT_LINT0);\n \n } else {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void apic_deliver_pic_intr(DeviceState *dev, int level)\n\n{\n\n APICCommonState *s = APIC_COMMON(dev);\n\n\n\n if (level) {\n\n apic_local_deliver(s, APIC_LVT_LINT0);\n\n } else {\n\n uint32_t lvt = s->lvt[APIC_LVT_LINT0];\n\n\n\n switch ((lvt >> 8) & 7) {\n\n case APIC_DM_FIXED:\n\n if (!(lvt & APIC_LVT_LEVEL_TRIGGER))\n\n break;\n\n apic_reset_bit(s->irr, lvt & 0xff);\n\n /* fall through */\n\n case APIC_DM_EXTINT:\n\n cpu_reset_interrupt(CPU(s->cpu), CPU_INTERRUPT_HARD);\n\n break;\n\n }\n\n }\n\n}\n"}} {"sample_id": "9321e93502810e4a3fcaf87bac156dba2fe3b477", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void gif_copy_img_rect(const uint32_t *src, uint32_t *dst,\n \n int linesize, int l, int t, int w, int h)\n+\n {\n \n const int y_start = t * linesize;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void gif_copy_img_rect(const uint32_t *src, uint32_t *dst,\n\n int linesize, int l, int t, int w, int h)\n\n{\n\n const int y_start = t * linesize;\n\n const uint32_t *src_px, *src_pr,\n\n *src_py = src + y_start,\n\n *dst_py = dst + y_start;\n\n const uint32_t *src_pb = src_py + (t + h) * linesize;\n\n uint32_t *dst_px;\n\n\n\n for (; src_py < src_pb; src_py += linesize, dst_py += linesize) {\n\n src_px = src_py + l;\n\n dst_px = (uint32_t *)dst_py + l;\n\n src_pr = src_px + w;\n\n\n\n for (; src_px < src_pr; src_px++, dst_px++)\n\n *dst_px = *src_px;\n\n }\n\n}\n"}} {"sample_id": "5c8d6f008c0555b54cf10550fa86199a2cfabbca_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -37,11 +37,11 @@\n channel_subsys.crws_lost = false;\n \n }\n+\n+\n+\n+ QTAILQ_INSERT_TAIL(&channel_subsys.pending_crws, crw_cont, sibling);\n+\n \n \n if (channel_subsys.do_crw_mchk) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void css_queue_crw(uint8_t rsc, uint8_t erc, int chain, uint16_t rsid)\n\n{\n\n CrwContainer *crw_cont;\n\n\n\n trace_css_crw(rsc, erc, rsid, chain ? \"(chained)\" : \"\");\n\n /* TODO: Maybe use a static crw pool? */\n\n crw_cont = g_try_malloc0(sizeof(CrwContainer));\n\n if (!crw_cont) {\n\n channel_subsys.crws_lost = true;\n\n return;\n\n }\n\n crw_cont->crw.flags = (rsc << 8) | erc;\n\n if (chain) {\n\n crw_cont->crw.flags |= CRW_FLAGS_MASK_C;\n\n }\n\n crw_cont->crw.rsid = rsid;\n\n if (channel_subsys.crws_lost) {\n\n crw_cont->crw.flags |= CRW_FLAGS_MASK_R;\n\n channel_subsys.crws_lost = false;\n\n }\n\n\n\n QTAILQ_INSERT_TAIL(&channel_subsys.pending_crws, crw_cont, sibling);\n\n\n\n if (channel_subsys.do_crw_mchk) {\n\n channel_subsys.do_crw_mchk = false;\n\n /* Inject crw pending machine check. */\n\n s390_crw_mchk();\n\n }\n\n}\n"}} {"sample_id": "88be7b4be4aa17c88247e162bdd7577ea79db94f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n int bdrv_all_goto_snapshot(const char *name, BlockDriverState **first_bad_bs)\n \n+{\n+\n+ int err = 0;\n \n BlockDriverState *bs;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int bdrv_all_goto_snapshot(const char *name, BlockDriverState **first_bad_bs)\n\n{\n\n int err = 0;\n\n BlockDriverState *bs;\n\n BdrvNextIterator *it = NULL;\n\n\n\n while (err == 0 && (it = bdrv_next(it, &bs))) {\n\n AioContext *ctx = bdrv_get_aio_context(bs);\n\n\n\n aio_context_acquire(ctx);\n\n if (bdrv_can_snapshot(bs)) {\n\n err = bdrv_snapshot_goto(bs, name);\n\n }\n\n aio_context_release(ctx);\n\n }\n\n\n\n *first_bad_bs = bs;\n\n return err;\n\n}\n"}} {"sample_id": "c2fa30757a2ba1bb5b053883773a9a61fbdd7082_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n le32_to_cpus(&set_label_data->offset);\n \n le32_to_cpus(&set_label_data->length);\n+\n+\n+\n+ nvdimm_debug(\"Write Label Data: offset %#x length %#x.\\n\",\n+\n set_label_data->offset, set_label_data->length);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void nvdimm_dsm_set_label_data(NVDIMMDevice *nvdimm, NvdimmDsmIn *in,\n\n hwaddr dsm_mem_addr)\n\n{\n\n NVDIMMClass *nvc = NVDIMM_GET_CLASS(nvdimm);\n\n NvdimmFuncSetLabelDataIn *set_label_data;\n\n uint32_t status;\n\n\n\n set_label_data = (NvdimmFuncSetLabelDataIn *)in->arg3;\n\n\n\n le32_to_cpus(&set_label_data->offset);\n\n le32_to_cpus(&set_label_data->length);\n\n\n\n nvdimm_debug(\"Write Label Data: offset %#x length %#x.\\n\",\n\n set_label_data->offset, set_label_data->length);\n\n\n\n status = nvdimm_rw_label_data_check(nvdimm, set_label_data->offset,\n\n set_label_data->length);\n\n if (status != 0 /* Success */) {\n\n nvdimm_dsm_no_payload(status, dsm_mem_addr);\n\n return;\n\n }\n\n\n\n assert(offsetof(NvdimmDsmIn, arg3) +\n\n sizeof(*set_label_data) + set_label_data->length <= 4096);\n\n\n\n nvc->write_label_data(nvdimm, set_label_data->in_buf,\n\n set_label_data->length, set_label_data->offset);\n\n nvdimm_dsm_no_payload(0 /* Success */, dsm_mem_addr);\n\n}\n"}} {"sample_id": "d3b12f5dec4b27ebab58fb5797cb67bacced773b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n \n \n+ if (w->num >= MAXIMUM_WAIT_OBJECTS)\n+\n+ return -1;\n+\n+ w->events[w->num] = handle;\n \n w->func[w->num] = func;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_add_wait_object(HANDLE handle, WaitObjectFunc *func, void *opaque)\n\n{\n\n WaitObjects *w = &wait_objects;\n\n\n\n if (w->num >= MAXIMUM_WAIT_OBJECTS)\n\n return -1;\n\n w->events[w->num] = handle;\n\n w->func[w->num] = func;\n\n w->opaque[w->num] = opaque;\n\n w->num++;\n\n return 0;\n\n}\n"}} {"sample_id": "fff4e48ed54cc39e5942921df91300646ad37707", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,8 +12,8 @@\n \n \n \n+ assert(opts->type == NET_CLIENT_OPTIONS_KIND_VHOST_USER);\n+\n vhost_user_opts = opts->u.vhost_user;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int net_init_vhost_user(const NetClientOptions *opts, const char *name,\n\n NetClientState *peer, Error **errp)\n\n{\n\n int queues;\n\n const NetdevVhostUserOptions *vhost_user_opts;\n\n CharDriverState *chr;\n\n\n\n assert(opts->type == NET_CLIENT_OPTIONS_KIND_VHOST_USER);\n\n vhost_user_opts = opts->u.vhost_user;\n\n\n\n chr = net_vhost_parse_chardev(vhost_user_opts, errp);\n\n if (!chr) {\n\n return -1;\n\n }\n\n\n\n /* verify net frontend */\n\n if (qemu_opts_foreach(qemu_find_opts(\"device\"), net_vhost_check_net,\n\n (char *)name, errp)) {\n\n return -1;\n\n }\n\n\n\n queues = vhost_user_opts->has_queues ? vhost_user_opts->queues : 1;\n\n if (queues < 1) {\n\n error_setg(errp,\n\n \"vhost-user number of queues must be bigger than zero\");\n\n return -1;\n\n }\n\n\n\n return net_vhost_user_init(peer, \"vhost_user\", name, chr, queues);\n\n}\n"}} {"sample_id": "80ca19f766aea8f4724aac1b3faa772d25163c8a_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n P[1] = *s->stream_ptr++;\n \n+ }\n+\n+ memset(s->pixel_ptr, P[0], 4);\n+\n+ memset(s->pixel_ptr + 4, P[1], 4);\n \n s->pixel_ptr += s->stride;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ipvideo_decode_block_opcode_0xD(IpvideoContext *s)\n\n{\n\n int y;\n\n unsigned char P[2];\n\n\n\n /* 4-color block encoding: each 4x4 block is a different color */\n\n CHECK_STREAM_PTR(4);\n\n\n\n for (y = 0; y < 8; y++) {\n\n if (!(y & 3)) {\n\n P[0] = *s->stream_ptr++;\n\n P[1] = *s->stream_ptr++;\n\n }\n\n memset(s->pixel_ptr, P[0], 4);\n\n memset(s->pixel_ptr + 4, P[1], 4);\n\n s->pixel_ptr += s->stride;\n\n }\n\n\n\n /* report success */\n\n return 0;\n\n}\n"}} {"sample_id": "d35ff5e6b3aa3a706b0aa3bcf11400fac945b67a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void process_incoming_migration_bh(void *opaque)\n+{\n+ Error *local_err = NULL;\n+ MigrationIncomingState *mis = opaque;\n+ /* Make sure all file formats flush their mutable metadata */\n+ bdrv_invalidate_cache_all(&local_err);\n migrate_set_state(&mis->state, MIGRATION_STATUS_ACTIVE,\n MIGRATION_STATUS_FAILED);\n error_report_err(local_err);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void process_incoming_migration_bh(void *opaque)\n{\n Error *local_err = NULL;\n MigrationIncomingState *mis = opaque;\n /* Make sure all file formats flush their mutable metadata */\n bdrv_invalidate_cache_all(&local_err);\n migrate_set_state(&mis->state, MIGRATION_STATUS_ACTIVE,\n MIGRATION_STATUS_FAILED);\n error_report_err(local_err);\n migrate_decompress_threads_join();\n exit(EXIT_FAILURE);\n /*\n * This must happen after all error conditions are dealt with and\n * we're sure the VM is going to be running on this host.\n */\n qemu_announce_self();\n /* If global state section was not received or we are in running\n state, we need to obey autostart. Any other state is set with\n runstate_set. */\n if (!global_state_received() ||\n global_state_get_runstate() == RUN_STATE_RUNNING) {\n if (autostart) {\n vm_start();\n } else {\n runstate_set(RUN_STATE_PAUSED);\n } else {\n runstate_set(global_state_get_runstate());\n migrate_decompress_threads_join();\n /*\n * This must happen after any state changes since as soon as an external\n * observer sees this event they might start to prod at the VM assuming\n * it's ready to use.\n */\n migrate_set_state(&mis->state, MIGRATION_STATUS_ACTIVE,\n MIGRATION_STATUS_COMPLETED);\n qemu_bh_delete(mis->bh);\n migration_incoming_state_destroy();"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n bs = bs->file;\n \n+ }\n+\n+\n+\n+ if (bs && bs->drv && bs->drv->bdrv_debug_is_suspended) {\n \n return bs->drv->bdrv_debug_is_suspended(bs, tag);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool bdrv_debug_is_suspended(BlockDriverState *bs, const char *tag)\n\n{\n\n while (bs && bs->drv && !bs->drv->bdrv_debug_is_suspended) {\n\n bs = bs->file;\n\n }\n\n\n\n if (bs && bs->drv && bs->drv->bdrv_debug_is_suspended) {\n\n return bs->drv->bdrv_debug_is_suspended(bs, tag);\n\n }\n\n\n\n return false;\n\n}\n"}} {"sample_id": "3604a76fea6ff37738d4a8f596be38407be74a83_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ int l1;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void dec_modu(DisasContext *dc)\n\n{\n\n int l1;\n\n\n\n LOG_DIS(\"modu r%d, r%d, %d\\n\", dc->r2, dc->r0, dc->r1);\n\n\n\n if (!(dc->env->features & LM32_FEATURE_DIVIDE)) {\n\n cpu_abort(dc->env, \"hardware divider is not available\\n\");\n\n }\n\n\n\n l1 = gen_new_label();\n\n tcg_gen_brcondi_tl(TCG_COND_NE, cpu_R[dc->r1], 0, l1);\n\n tcg_gen_movi_tl(cpu_pc, dc->pc);\n\n t_gen_raise_exception(dc, EXCP_DIVIDE_BY_ZERO);\n\n gen_set_label(l1);\n\n tcg_gen_remu_tl(cpu_R[dc->r2], cpu_R[dc->r0], cpu_R[dc->r1]);\n\n}\n"}} {"sample_id": "65207c59d99f2260c5f1d3b9c491146616a522aa_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n+static void user_async_cmd_handler(Monitor *mon, const mon_cmd_t *cmd,\n+\n+ const QDict *params)\n+\n+{\n+\n+ int ret;\n+\n+\n+\n MonitorCompletionData *cb_data = g_malloc(sizeof(*cb_data));\n \n cb_data->mon = mon;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void user_async_cmd_handler(Monitor *mon, const mon_cmd_t *cmd,\n\n const QDict *params)\n\n{\n\n int ret;\n\n\n\n MonitorCompletionData *cb_data = g_malloc(sizeof(*cb_data));\n\n cb_data->mon = mon;\n\n cb_data->user_print = cmd->user_print;\n\n monitor_suspend(mon);\n\n ret = cmd->mhandler.cmd_async(mon, params,\n\n user_monitor_complete, cb_data);\n\n if (ret < 0) {\n\n monitor_resume(mon);\n\n g_free(cb_data);\n\n }\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_136", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ value *= 1e9;\n+\n value = MAX(0, MIN(UINT64_MAX, value));\n \n max_downtime = (uint64_t)value;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void qmp_migrate_set_downtime(double value, Error **errp)\n\n{\n\n value *= 1e9;\n\n value = MAX(0, MIN(UINT64_MAX, value));\n\n max_downtime = (uint64_t)value;\n\n}\n"}} {"sample_id": "5e755519ac9d867f7da13f58a9d0c262db82e14c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -43,9 +43,9 @@\n if (loglevel & CPU_LOG_EXEC)\n \n CALL_FROM_TB2(do_mtc0_status_debug, old, val);\n+\n+ CALL_FROM_TB1(cpu_mips_update_irq, env);\n+\n+ RETURN();\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void op_mtc0_status (void)\n\n{\n\n uint32_t val, old;\n\n uint32_t mask = env->Status_rw_bitmask;\n\n\n\n /* No reverse endianness, no MDMX/DSP, no 64bit ops\n\n implemented. */\n\n val = T0 & mask;\n\n old = env->CP0_Status;\n\n if (!(val & (1 << CP0St_EXL)) &&\n\n !(val & (1 << CP0St_ERL)) &&\n\n !(env->hflags & MIPS_HFLAG_DM) &&\n\n (val & (1 << CP0St_UM)))\n\n env->hflags |= MIPS_HFLAG_UM;\n\n#ifdef TARGET_MIPS64\n\n if ((env->hflags & MIPS_HFLAG_UM) &&\n\n !(val & (1 << CP0St_PX)) &&\n\n !(val & (1 << CP0St_UX)))\n\n env->hflags &= ~MIPS_HFLAG_64;\n\n#endif\n\n env->CP0_Status = (env->CP0_Status & ~mask) | val;\n\n if (loglevel & CPU_LOG_EXEC)\n\n CALL_FROM_TB2(do_mtc0_status_debug, old, val);\n\n CALL_FROM_TB1(cpu_mips_update_irq, env);\n\n RETURN();\n\n}\n"}} {"sample_id": "e81a982aa5398269a2cc344091ffa4930bdd242f_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+void cpu_ppc_store_hdecr (CPUPPCState *env, uint32_t value)\n+\n {\n \n PowerPCCPU *cpu = ppc_env_get_cpu(env);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void cpu_ppc_store_hdecr (CPUPPCState *env, uint32_t value)\n\n{\n\n PowerPCCPU *cpu = ppc_env_get_cpu(env);\n\n\n\n _cpu_ppc_store_hdecr(cpu, cpu_ppc_load_hdecr(env), value, 0);\n\n}\n"}} {"sample_id": "b791c3b38c7969cb9f4acda8229e19fd865a1c08", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n } else if (desc->full && (dev->port->speedmask & USB_SPEED_MASK_FULL)) {\n \n+ dev->speed = USB_SPEED_FULL;\n+\n+ } else {\n+\n+ return;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void usb_desc_attach(USBDevice *dev)\n\n{\n\n const USBDesc *desc = usb_device_get_usb_desc(dev);\n\n\n\n assert(desc != NULL);\n\n if (desc->super && (dev->port->speedmask & USB_SPEED_MASK_SUPER)) {\n\n dev->speed = USB_SPEED_SUPER;\n\n } else if (desc->high && (dev->port->speedmask & USB_SPEED_MASK_HIGH)) {\n\n dev->speed = USB_SPEED_HIGH;\n\n } else if (desc->full && (dev->port->speedmask & USB_SPEED_MASK_FULL)) {\n\n dev->speed = USB_SPEED_FULL;\n\n } else {\n\n return;\n\n }\n\n usb_desc_setdefaults(dev);\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_44", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void do_op_602_mfrom (void)\n \n+{\n+\n if (likely(T0 < 602)) {\n \n #ifdef USE_MFROM_ROM_TABLE\n@@ -11,7 +11,7 @@\n T0 = mfrom_ROM_table[T0];\n \n #else\n+\n double d;\n \n /* Extremly decomposed:", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void do_op_602_mfrom (void)\n\n{\n\n if (likely(T0 < 602)) {\n\n#ifdef USE_MFROM_ROM_TABLE\n\n#include \"mfrom_table.c\"\n\n T0 = mfrom_ROM_table[T0];\n\n#else\n\n double d;\n\n /* Extremly decomposed:\n\n * -T0 / 256\n\n * T0 = 256 * log10(10 + 1.0) + 0.5\n\n */\n\n d = T0;\n\n d = float64_div(d, 256, &env->fp_status);\n\n d = float64_chs(d);\n\n d = exp10(d); // XXX: use float emulation function\n\n d = float64_add(d, 1.0, &env->fp_status);\n\n d = log10(d); // XXX: use float emulation function\n\n d = float64_mul(d, 256, &env->fp_status);\n\n d = float64_add(d, 0.5, &env->fp_status);\n\n T0 = float64_round_to_int(d, &env->fp_status);\n\n#endif\n\n } else {\n\n T0 = 0;\n\n }\n\n}\n"}} {"sample_id": "9fe73b0147d329bb03ea57c201dc99317cbf3c29", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,10 +5,10 @@\n ff_dlog(s, \"%s\", command);\n if (response)\n *response = NULL;\n+ if ((err = ffurl_write(s->conn_control, command, strlen(command))) < 0)\n+ return err;\n+ if (!err)\n+ return -1;\n /* return status */\n if (response_codes) {\n return ftp_status(s, response, response_codes);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int ftp_send_command(FTPContext *s, const char *command,\n const int response_codes[], char **response)\n{\n int err;\n ff_dlog(s, \"%s\", command);\n if (response)\n *response = NULL;\n if ((err = ffurl_write(s->conn_control, command, strlen(command))) < 0)\n return err;\n if (!err)\n return -1;\n /* return status */\n if (response_codes) {\n return ftp_status(s, response, response_codes);\n }\n return 0;\n}"}} {"sample_id": "378df4b23753a11be650af7664ca76bc75cb9f01", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void cpu_exit(CPUArchState *env)\n \n {\n+\n CPUState *cpu = ENV_GET_CPU(env);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void cpu_exit(CPUArchState *env)\n\n{\n\n CPUState *cpu = ENV_GET_CPU(env);\n\n\n\n cpu->exit_request = 1;\n\n cpu_unlink_tb(cpu);\n\n}\n"}} {"sample_id": "52c050236eaa4f0b5e1d160cd66dc18106445c4d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,9 +26,9 @@\n acb = bdrv_aio_readv(req->dev->bs, sector, &req->qiov,\n \n req->qiov.size / BDRV_SECTOR_SIZE,\n+\n+ virtio_blk_rw_complete, req);\n+\n+ if (!acb) {\n+\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void virtio_blk_handle_read(VirtIOBlockReq *req)\n\n{\n\n BlockDriverAIOCB *acb;\n\n uint64_t sector;\n\n\n\n sector = ldq_p(&req->out->sector);\n\n\n\n if (sector & req->dev->sector_mask) {\n\n\n\n\n\n\n\n\n\n\n acb = bdrv_aio_readv(req->dev->bs, sector, &req->qiov,\n\n req->qiov.size / BDRV_SECTOR_SIZE,\n\n virtio_blk_rw_complete, req);\n\n if (!acb) {\n\n\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_153", "diff": "--- a/source.c\n+++ b/source.c\n@@ -37,11 +37,11 @@\n \n \n st->bsize = st->cbl;\n+\n+ st->lpib = 0;\n+\n+ st->be = 0;\n+\n st->bp = 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void intel_hda_parse_bdl(IntelHDAState *d, IntelHDAStream *st)\n\n{\n\n target_phys_addr_t addr;\n\n uint8_t buf[16];\n\n uint32_t i;\n\n\n\n addr = intel_hda_addr(st->bdlp_lbase, st->bdlp_ubase);\n\n st->bentries = st->lvi +1;\n\n g_free(st->bpl);\n\n st->bpl = g_malloc(sizeof(bpl) * st->bentries);\n\n for (i = 0; i < st->bentries; i++, addr += 16) {\n\n pci_dma_read(&d->pci, addr, buf, 16);\n\n st->bpl[i].addr = le64_to_cpu(*(uint64_t *)buf);\n\n st->bpl[i].len = le32_to_cpu(*(uint32_t *)(buf + 8));\n\n st->bpl[i].flags = le32_to_cpu(*(uint32_t *)(buf + 12));\n\n dprint(d, 1, \"bdl/%d: 0x%\" PRIx64 \" +0x%x, 0x%x\\n\",\n\n i, st->bpl[i].addr, st->bpl[i].len, st->bpl[i].flags);\n\n }\n\n\n\n st->bsize = st->cbl;\n\n st->lpib = 0;\n\n st->be = 0;\n\n st->bp = 0;\n\n}\n"}} {"sample_id": "a12a5a1a0132527afe87c079e4aae4aad372bd94_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n {\n \n+ TestStruct *p = NULL;\n+\n Error *err = NULL;\n \n Visitor *v;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_validate_fail_struct(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n TestStruct *p = NULL;\n\n Error *err = NULL;\n\n Visitor *v;\n\n\n\n v = validate_test_init(data, \"{ 'integer': -42, 'boolean': true, 'string': 'foo', 'extra': 42 }\");\n\n\n\n visit_type_TestStruct(v, &p, NULL, &err);\n\n g_assert(err);\n\n error_free(err);\n\n if (p) {\n\n g_free(p->string);\n\n }\n\n g_free(p);\n\n}\n"}} {"sample_id": "fd56e0612b6454a282fa6a953fdb09281a98c589_27", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n int i;\n \n PIIX3State *piix3 = opaque;\n+\n+\n+\n+ for (i = 0; i < ARRAY_SIZE(piix3->pci_irq_levels_vmstate); i++) {\n+\n piix3->pci_irq_levels_vmstate[i] =\n \n pci_bus_get_irq_level(piix3->dev.bus, i);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int piix3_pre_save(void *opaque)\n\n{\n\n int i;\n\n PIIX3State *piix3 = opaque;\n\n\n\n for (i = 0; i < ARRAY_SIZE(piix3->pci_irq_levels_vmstate); i++) {\n\n piix3->pci_irq_levels_vmstate[i] =\n\n pci_bus_get_irq_level(piix3->dev.bus, i);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d4d34b0d3f5af5c8e09980da0de2eebe9a27dc71_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n if (dev->state != DEV_STATE_CREATED) {\n \n error_set(errp, QERR_PERMISSION_DENIED);\n+\n+ return;\n+\n+ }\n+\n \n \n visit_type_enum(v, ptr, prop->info->enum_table,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void set_enum(Object *obj, Visitor *v, void *opaque,\n\n const char *name, Error **errp)\n\n{\n\n DeviceState *dev = DEVICE(obj);\n\n Property *prop = opaque;\n\n int *ptr = qdev_get_prop_ptr(dev, prop);\n\n\n\n if (dev->state != DEV_STATE_CREATED) {\n\n error_set(errp, QERR_PERMISSION_DENIED);\n\n return;\n\n }\n\n\n\n visit_type_enum(v, ptr, prop->info->enum_table,\n\n prop->info->name, prop->name, errp);\n\n}\n"}} {"sample_id": "abc981bf292fb361f8a509c3611ddf2ba2c43360", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void test_io_channel_ipv4_fd(void)\n {\n+ QIOChannel *ioc;\n+ int fd = -1;\n fd = socket(AF_INET, SOCK_STREAM, 0);\n g_assert_cmpint(fd, >, -1);\n ioc = qio_channel_new_fd(fd, &error_abort);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_io_channel_ipv4_fd(void)\n{\n QIOChannel *ioc;\n int fd = -1;\n fd = socket(AF_INET, SOCK_STREAM, 0);\n g_assert_cmpint(fd, >, -1);\n ioc = qio_channel_new_fd(fd, &error_abort);\n g_assert_cmpstr(object_get_typename(OBJECT(ioc)),\n ==,\n TYPE_QIO_CHANNEL_SOCKET);\n object_unref(OBJECT(ioc));"}} {"sample_id": "81bad50ec40311797c38a7691844c7d2df9b3823_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n target_ulong helper_dvpe(CPUMIPSState *env)\n+\n {\n \n+ CPUMIPSState *other_cpu = first_cpu;\n+\n+ target_ulong prev = env->mvp->CP0_MVPControl;\n \n+\n+\n do {\n \n /* Turn off all VPEs except the one executing the dvpe. */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "target_ulong helper_dvpe(CPUMIPSState *env)\n\n{\n\n CPUMIPSState *other_cpu = first_cpu;\n\n target_ulong prev = env->mvp->CP0_MVPControl;\n\n\n\n do {\n\n /* Turn off all VPEs except the one executing the dvpe. */\n\n if (other_cpu != env) {\n\n other_cpu->mvp->CP0_MVPControl &= ~(1 << CP0MVPCo_EVP);\n\n mips_vpe_sleep(other_cpu);\n\n }\n\n other_cpu = other_cpu->next_cpu;\n\n } while (other_cpu);\n\n return prev;\n\n}\n"}} {"sample_id": "bc0f0674f037a01f2ce0870ad6270a356a7a8347_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,5 +5,5 @@\n return (s->compat_flags & E1000_FLAG_AUTONEG) &&\n \n (s->phy_reg[PHY_CTRL] & MII_CR_AUTO_NEG_EN);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "have_autoneg(E1000State *s)\n\n{\n\n return (s->compat_flags & E1000_FLAG_AUTONEG) &&\n\n (s->phy_reg[PHY_CTRL] & MII_CR_AUTO_NEG_EN);\n\n}\n"}} {"sample_id": "32bafa8fdd098d52fbf1102d5a5e48d29398c0aa_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n int keycode = qemu_input_key_value_to_number(value);\n \n int count = 0;\n+\n+\n+\n+ if (value->type == KEY_VALUE_KIND_QCODE &&\n+\n value->u.qcode == Q_KEY_CODE_PAUSE) {\n \n /* specific case */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_input_key_value_to_scancode(const KeyValue *value, bool down,\n\n int *codes)\n\n{\n\n int keycode = qemu_input_key_value_to_number(value);\n\n int count = 0;\n\n\n\n if (value->type == KEY_VALUE_KIND_QCODE &&\n\n value->u.qcode == Q_KEY_CODE_PAUSE) {\n\n /* specific case */\n\n int v = down ? 0 : 0x80;\n\n codes[count++] = 0xe1;\n\n codes[count++] = 0x1d | v;\n\n codes[count++] = 0x45 | v;\n\n return count;\n\n }\n\n if (keycode & SCANCODE_GREY) {\n\n codes[count++] = SCANCODE_EMUL0;\n\n keycode &= ~SCANCODE_GREY;\n\n }\n\n if (!down) {\n\n keycode |= SCANCODE_UP;\n\n }\n\n codes[count++] = keycode;\n\n\n\n return count;\n\n}\n"}} {"sample_id": "2296f194dfde4c0a54f249d3fdb8c8ca21dc611b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n DIR *dir;\n \n+\n \n if ((dir = opendir(path->pathname)) != NULL) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static struct pathelem *add_dir_maybe(struct pathelem *path)\n\n{\n\n DIR *dir;\n\n\n\n if ((dir = opendir(path->pathname)) != NULL) {\n\n struct dirent *dirent;\n\n\n\n while ((dirent = readdir(dir)) != NULL) {\n\n if (!streq(dirent->d_name,\".\") && !streq(dirent->d_name,\"..\")){\n\n path = add_entry(path, dirent->d_name);\n\n }\n\n }\n\n closedir(dir);\n\n }\n\n return path;\n\n}\n"}} {"sample_id": "8409dc884a201bf74b30a9d232b6bbdd00cb7e2b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void serial_exit_core(SerialState *s)\n {\n qemu_chr_fe_deinit(&s->chr);\n+ qemu_unregister_reset(serial_reset, s);\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void serial_exit_core(SerialState *s)\n{\n qemu_chr_fe_deinit(&s->chr);\n qemu_unregister_reset(serial_reset, s);\n}"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_79", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n s->packet_transfer_size = size;\n \n+ s->io_buffer_size = size; /* dma: send the reply data as one chunk */\n+\n+ s->elementary_transfer_size = 0;\n+\n+ s->io_buffer_index = 0;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ide_atapi_cmd_reply(IDEState *s, int size, int max_size)\n\n{\n\n if (size > max_size)\n\n size = max_size;\n\n s->lba = -1; /* no sector read */\n\n s->packet_transfer_size = size;\n\n s->io_buffer_size = size; /* dma: send the reply data as one chunk */\n\n s->elementary_transfer_size = 0;\n\n s->io_buffer_index = 0;\n\n\n\n if (s->atapi_dma) {\n\n block_acct_start(bdrv_get_stats(s->bs), &s->acct, size,\n\n BLOCK_ACCT_READ);\n\n s->status = READY_STAT | SEEK_STAT | DRQ_STAT;\n\n ide_start_dma(s, ide_atapi_cmd_read_dma_cb);\n\n } else {\n\n s->status = READY_STAT | SEEK_STAT;\n\n ide_atapi_cmd_reply_end(s);\n\n }\n\n}\n"}} {"sample_id": "b1a4b735f9b03840803413cb725216d15d5213a7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n yuv2plane1_16_c_template(const int32_t *src, uint16_t *dest, int dstW,\n \n+ int big_endian, int output_bits)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "yuv2plane1_16_c_template(const int32_t *src, uint16_t *dest, int dstW,\n\n int big_endian, int output_bits)\n\n{\n\n int i;\n\n int shift = 19 - output_bits;\n\n\n\n for (i = 0; i < dstW; i++) {\n\n int val = src[i] + (1 << (shift - 1));\n\n output_pixel(&dest[i], val, 0, uint);\n\n }\n\n}\n"}} {"sample_id": "c0323b9c9bcebe029df0b19a19a6f81deef94b3a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n if(!graph)\n \n+ return r;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "int avfilter_graph_send_command(AVFilterGraph *graph, const char *target, const char *cmd, const char *arg, char *res, int res_len, int flags)\n\n{\n\n int i, r = AVERROR(ENOSYS);\n\n\n\n if(!graph)\n\n return r;\n\n\n\n if((flags & AVFILTER_CMD_FLAG_ONE) && !(flags & AVFILTER_CMD_FLAG_FAST)) {\n\n r=avfilter_graph_send_command(graph, target, cmd, arg, res, res_len, flags | AVFILTER_CMD_FLAG_FAST);\n\n if(r != AVERROR(ENOSYS))\n\n return r;\n\n }\n\n\n\n if(res_len && res)\n\n res[0]= 0;\n\n\n\n for (i = 0; i < graph->filter_count; i++) {\n\n AVFilterContext *filter = graph->filters[i];\n\n if(!strcmp(target, \"all\") || !strcmp(target, filter->name) || !strcmp(target, filter->filter->name)){\n\n r = avfilter_process_command(filter, cmd, arg, res, res_len, flags);\n\n if(r != AVERROR(ENOSYS)) {\n\n if((flags & AVFILTER_CMD_FLAG_ONE) || r<0)\n\n return r;\n\n }\n\n }\n\n }\n\n\n\n return r;\n\n}\n"}} {"sample_id": "2436b61a6b386d712a1813b036921443bd1c5c39", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n DESC_S_MASK |\n \n DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);\n+\n+ cpu_x86_load_seg_cache(env, R_SS, (env->sysenter_cs + 8) & 0xfffc,\n+\n+ 0, 0xffffffff,\n+\n DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |\n \n DESC_S_MASK |", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void helper_sysenter(void)\n\n{\n\n if (env->sysenter_cs == 0) {\n\n raise_exception_err(EXCP0D_GPF, 0);\n\n }\n\n env->eflags &= ~(VM_MASK | IF_MASK | RF_MASK);\n\n cpu_x86_set_cpl(env, 0);\n\n cpu_x86_load_seg_cache(env, R_CS, env->sysenter_cs & 0xfffc,\n\n 0, 0xffffffff,\n\n DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |\n\n DESC_S_MASK |\n\n DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);\n\n cpu_x86_load_seg_cache(env, R_SS, (env->sysenter_cs + 8) & 0xfffc,\n\n 0, 0xffffffff,\n\n DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |\n\n DESC_S_MASK |\n\n DESC_W_MASK | DESC_A_MASK);\n\n ESP = env->sysenter_esp;\n\n EIP = env->sysenter_eip;\n\n}\n"}} {"sample_id": "b190f477e29c7cd03a8fee49c96d27f160e3f5b0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,10 +27,10 @@\n \n \n cc->dump_state = tricore_cpu_dump_state;\n+\n+ cc->set_pc = tricore_cpu_set_pc;\n+\n+ cc->synchronize_from_tb = tricore_cpu_synchronize_from_tb;\n+\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void tricore_cpu_class_init(ObjectClass *c, void *data)\n\n{\n\n TriCoreCPUClass *mcc = TRICORE_CPU_CLASS(c);\n\n CPUClass *cc = CPU_CLASS(c);\n\n DeviceClass *dc = DEVICE_CLASS(c);\n\n\n\n mcc->parent_realize = dc->realize;\n\n dc->realize = tricore_cpu_realizefn;\n\n\n\n mcc->parent_reset = cc->reset;\n\n cc->reset = tricore_cpu_reset;\n\n cc->class_by_name = tricore_cpu_class_by_name;\n\n cc->has_work = tricore_cpu_has_work;\n\n\n\n cc->dump_state = tricore_cpu_dump_state;\n\n cc->set_pc = tricore_cpu_set_pc;\n\n cc->synchronize_from_tb = tricore_cpu_synchronize_from_tb;\n\n\n}"}} {"sample_id": "e7342aa39b3193473ded24cbf2233930665796e9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n void (*access)(MemoryRegion *mr,\n \n+ hwaddr addr,\n+\n+ uint64_t *value,\n+\n+ unsigned size,\n \n unsigned shift,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void access_with_adjusted_size(hwaddr addr,\n\n uint64_t *value,\n\n unsigned size,\n\n unsigned access_size_min,\n\n unsigned access_size_max,\n\n void (*access)(MemoryRegion *mr,\n\n hwaddr addr,\n\n uint64_t *value,\n\n unsigned size,\n\n unsigned shift,\n\n uint64_t mask),\n\n MemoryRegion *mr)\n\n{\n\n uint64_t access_mask;\n\n unsigned access_size;\n\n unsigned i;\n\n\n\n if (!access_size_min) {\n\n access_size_min = 1;\n\n }\n\n if (!access_size_max) {\n\n access_size_max = 4;\n\n }\n\n\n\n /* FIXME: support unaligned access? */\n\n access_size = MAX(MIN(size, access_size_max), access_size_min);\n\n access_mask = -1ULL >> (64 - access_size * 8);\n\n for (i = 0; i < size; i += access_size) {\n\n#ifdef TARGET_WORDS_BIGENDIAN\n\n access(mr, addr + i, value, access_size,\n\n (size - access_size - i) * 8, access_mask);\n\n#else\n\n access(mr, addr + i, value, access_size, i * 8, access_mask);\n\n#endif\n\n }\n\n}\n"}} {"sample_id": "3a3b8502e6f0c8d30865c5f36d2c3ae4114000b5_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ spapr->epow_irq = spapr_allocate_msi(0);\n \n spapr->epow_notifier.notify = spapr_powerdown_req;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void spapr_events_init(sPAPREnvironment *spapr)\n\n{\n\n spapr->epow_irq = spapr_allocate_msi(0);\n\n spapr->epow_notifier.notify = spapr_powerdown_req;\n\n qemu_register_powerdown_notifier(&spapr->epow_notifier);\n\n spapr_rtas_register(\"check-exception\", check_exception);\n\n}\n"}} {"sample_id": "9b2fadda3e0196ffd485adde4fe9cdd6fae35300_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void gen_mfsri(DisasContext *ctx)\n+\n+{\n \n #if defined(CONFIG_USER_ONLY)\n+\n+ gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n \n #else\n \n@@ -14,7 +14,7 @@\n \n TCGv t0;\n \n+ if (unlikely(ctx->pr)) {\n \n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_mfsri(DisasContext *ctx)\n\n{\n\n#if defined(CONFIG_USER_ONLY)\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n#else\n\n int ra = rA(ctx->opcode);\n\n int rd = rD(ctx->opcode);\n\n TCGv t0;\n\n if (unlikely(ctx->pr)) {\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n return;\n\n }\n\n t0 = tcg_temp_new();\n\n gen_addr_reg_index(ctx, t0);\n\n tcg_gen_shri_tl(t0, t0, 28);\n\n tcg_gen_andi_tl(t0, t0, 0xF);\n\n gen_helper_load_sr(cpu_gpr[rd], cpu_env, t0);\n\n tcg_temp_free(t0);\n\n if (ra != 0 && ra != rd)\n\n tcg_gen_mov_tl(cpu_gpr[ra], cpu_gpr[rd]);\n\n#endif\n\n}\n"}} {"sample_id": "e1f7b4812eab992de46c98b3726745afb042a7f0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void virtio_rng_process(VirtIORNG *vrng)\n+\n+{\n+\n+ size_t size;\n+\n \n \n if (!is_guest_ready(vrng)) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_rng_process(VirtIORNG *vrng)\n\n{\n\n size_t size;\n\n\n\n if (!is_guest_ready(vrng)) {\n\n return;\n\n }\n\n\n\n size = get_request_size(vrng->vq);\n\n size = MIN(vrng->quota_remaining, size);\n\n if (size) {\n\n rng_backend_request_entropy(vrng->rng, size, chr_read, vrng);\n\n }\n\n}\n"}} {"sample_id": "a04c2c707de2ce850f79870e84ac9d7ec7aa9143_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n int avpriv_unlock_avformat(void)\n+\n+{\n \n+ if (lockmgr_cb) {\n \n if ((*lockmgr_cb)(&avformat_mutex, AV_LOCK_RELEASE))\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int avpriv_unlock_avformat(void)\n\n{\n\n if (lockmgr_cb) {\n\n if ((*lockmgr_cb)(&avformat_mutex, AV_LOCK_RELEASE))\n\n return -1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n g_malloc0(sizeof(struct omap_mmc_s));\n \n+\n+\n+ s->irq = irq;\n+\n+ s->dma = dma;\n \n s->clk = fclk;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "struct omap_mmc_s *omap2_mmc_init(struct omap_target_agent_s *ta,\n\n BlockDriverState *bd, qemu_irq irq, qemu_irq dma[],\n\n omap_clk fclk, omap_clk iclk)\n\n{\n\n struct omap_mmc_s *s = (struct omap_mmc_s *)\n\n g_malloc0(sizeof(struct omap_mmc_s));\n\n\n\n s->irq = irq;\n\n s->dma = dma;\n\n s->clk = fclk;\n\n s->lines = 4;\n\n s->rev = 2;\n\n\n\n omap_mmc_reset(s);\n\n\n\n memory_region_init_io(&s->iomem, NULL, &omap_mmc_ops, s, \"omap.mmc\",\n\n omap_l4_region_size(ta, 0));\n\n omap_l4_attach(ta, 0, &s->iomem);\n\n\n\n /* Instantiate the storage */\n\n s->card = sd_init(bd, false);\n\n if (s->card == NULL) {\n\n exit(1);\n\n }\n\n\n\n s->cdet = qemu_allocate_irq(omap_mmc_cover_cb, s, 0);\n\n sd_set_cb(s->card, NULL, s->cdet);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "dc162c8e4f088b08575460cca35b042d58c141aa", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ hbitmap_iter_init(hbi, bitmap->bitmap, 0);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bdrv_dirty_iter_init(BdrvDirtyBitmap *bitmap, HBitmapIter *hbi)\n\n{\n\n hbitmap_iter_init(hbi, bitmap->bitmap, 0);\n\n}\n"}} {"sample_id": "baf35cb90204d75404892aa4e52628ae7a00669b_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void qemu_aio_poll(void)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void qemu_aio_poll(void)\n\n{\n\n}\n"}} {"sample_id": "9ac228e02cf16202547e7025ef300369e0db7781", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,25 +1,25 @@\n+static int inc_refcounts(BlockDriverState *bs,\n \n uint16_t *refcount_table,\n \n+ int refcount_table_size,\n+\n int64_t offset, int64_t size)\n \n {\n \n BDRVQcowState *s = bs->opaque;\n+\n int64_t start, last, cluster_offset;\n+\n int k;\n \n int errors = 0;\n+\n \n \n if (size <= 0)\n+\n return 0;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int inc_refcounts(BlockDriverState *bs,\n\n uint16_t *refcount_table,\n\n int refcount_table_size,\n\n int64_t offset, int64_t size)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n int64_t start, last, cluster_offset;\n\n int k;\n\n int errors = 0;\n\n\n\n if (size <= 0)\n\n return 0;\n\n\n\n start = offset & ~(s->cluster_size - 1);\n\n last = (offset + size - 1) & ~(s->cluster_size - 1);\n\n for(cluster_offset = start; cluster_offset <= last;\n\n cluster_offset += s->cluster_size) {\n\n k = cluster_offset >> s->cluster_bits;\n\n if (k < 0 || k >= refcount_table_size) {\n\n fprintf(stderr, \"ERROR: invalid cluster offset=0x%\" PRIx64 \"\\n\",\n\n cluster_offset);\n\n errors++;\n\n } else {\n\n if (++refcount_table[k] == 0) {\n\n fprintf(stderr, \"ERROR: overflow cluster offset=0x%\" PRIx64\n\n \"\\n\", cluster_offset);\n\n errors++;\n\n }\n\n }\n\n }\n\n\n\n return errors;\n\n}\n"}} {"sample_id": "635db18f68ded6abec11cd4cf64ebc15c1c6b190", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ QObject *data;\n \n Monitor *mon = opaque;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void monitor_qmp_event(void *opaque, int event)\n\n{\n\n QObject *data;\n\n Monitor *mon = opaque;\n\n\n\n switch (event) {\n\n case CHR_EVENT_OPENED:\n\n mon->qmp.in_command_mode = false;\n\n data = get_qmp_greeting();\n\n monitor_json_emitter(mon, data);\n\n qobject_decref(data);\n\n mon_refcount++;\n\n break;\n\n case CHR_EVENT_CLOSED:\n\n json_message_parser_destroy(&mon->qmp.parser);\n\n json_message_parser_init(&mon->qmp.parser, handle_qmp_command);\n\n mon_refcount--;\n\n monitor_fdsets_cleanup();\n\n break;\n\n }\n\n}\n"}} {"sample_id": "44b6789299a8acca3f25331bc411055cafc7bb06_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n+static void blkverify_aio_cb(void *opaque, int ret)\n+\n+{\n+\n+ BlkverifyAIOCB *acb = opaque;\n+\n+\n \n+ switch (++acb->done) {\n+\n case 1:\n+\n acb->ret = ret;\n \n break;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void blkverify_aio_cb(void *opaque, int ret)\n\n{\n\n BlkverifyAIOCB *acb = opaque;\n\n\n\n switch (++acb->done) {\n\n case 1:\n\n acb->ret = ret;\n\n break;\n\n\n\n case 2:\n\n if (acb->ret != ret) {\n\n blkverify_err(acb, \"return value mismatch %d != %d\", acb->ret, ret);\n\n }\n\n\n\n if (acb->verify) {\n\n acb->verify(acb);\n\n }\n\n\n\n aio_bh_schedule_oneshot(bdrv_get_aio_context(acb->common.bs),\n\n blkverify_aio_bh, acb);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_60", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,9 +9,9 @@\n trace_bdrv_aio_writev(bs, sector_num, nb_sectors, opaque);\n \n \n+\n+ return bdrv_co_aio_rw_vector(bs, sector_num, qiov, nb_sectors, 0,\n+\n+ cb, opaque, true);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "BlockAIOCB *bdrv_aio_writev(BlockDriverState *bs, int64_t sector_num,\n\n QEMUIOVector *qiov, int nb_sectors,\n\n BlockCompletionFunc *cb, void *opaque)\n\n{\n\n trace_bdrv_aio_writev(bs, sector_num, nb_sectors, opaque);\n\n\n\n return bdrv_co_aio_rw_vector(bs, sector_num, qiov, nb_sectors, 0,\n\n cb, opaque, true);\n\n}\n"}} {"sample_id": "bf937a7965c1d1a6dce4f615d0ead2e2ab505004_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,9 +11,9 @@\n else\n \n fprintf(stderr, \"%s: stray LMP_accepted received, fixme\\n\",\n+\n+ __func__);\n+\n+ exit(-1);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bt_dummy_lmp_connection_complete(struct bt_link_s *link)\n\n{\n\n if (link->slave->reject_reason)\n\n fprintf(stderr, \"%s: stray LMP_not_accepted received, fixme\\n\",\n\n __func__);\n\n else\n\n fprintf(stderr, \"%s: stray LMP_accepted received, fixme\\n\",\n\n __func__);\n\n exit(-1);\n\n}\n"}} {"sample_id": "75af1f34cd5b07c3c7fcf86dfc99a42de48a600d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -46,11 +46,11 @@\n \n }\n \n+ if (ret & BDRV_BLOCK_ZERO) {\n+\n+ sector_num += n;\n+\n+ continue;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int bdrv_make_zero(BlockDriverState *bs, BdrvRequestFlags flags)\n\n{\n\n int64_t target_sectors, ret, nb_sectors, sector_num = 0;\n\n int n;\n\n\n\n target_sectors = bdrv_nb_sectors(bs);\n\n if (target_sectors < 0) {\n\n return target_sectors;\n\n }\n\n\n\n for (;;) {\n\n nb_sectors = target_sectors - sector_num;\n\n if (nb_sectors <= 0) {\n\n return 0;\n\n }\n\n if (nb_sectors > INT_MAX / BDRV_SECTOR_SIZE) {\n\n nb_sectors = INT_MAX / BDRV_SECTOR_SIZE;\n\n }\n\n ret = bdrv_get_block_status(bs, sector_num, nb_sectors, &n);\n\n if (ret < 0) {\n\n error_report(\"error getting block status at sector %\" PRId64 \": %s\",\n\n sector_num, strerror(-ret));\n\n return ret;\n\n }\n\n if (ret & BDRV_BLOCK_ZERO) {\n\n sector_num += n;\n\n continue;\n\n }\n\n ret = bdrv_write_zeroes(bs, sector_num, n, flags);\n\n if (ret < 0) {\n\n error_report(\"error writing zeroes at sector %\" PRId64 \": %s\",\n\n sector_num, strerror(-ret));\n\n return ret;\n\n }\n\n sector_num += n;\n\n }\n\n}\n"}} {"sample_id": "bc0f0674f037a01f2ce0870ad6270a356a7a8347_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,6 +6,6 @@\n \n \n \n+ return s->compat_flags & E1000_FLAG_MIT;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool e1000_mit_state_needed(void *opaque)\n\n{\n\n E1000State *s = opaque;\n\n\n\n return s->compat_flags & E1000_FLAG_MIT;\n\n}\n"}} {"sample_id": "96c9cff0ab986f3a0606e1a96c5b00e6a7c675c6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -38,11 +38,11 @@\n \n }\n \n+ return shift;\n+\n+ }\n+\n+\n \n /* We have a kernel that predates the htab reset calls. For PR\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int kvmppc_reset_htab(int shift_hint)\n\n{\n\n uint32_t shift = shift_hint;\n\n\n\n if (!kvm_enabled()) {\n\n /* Full emulation, tell caller to allocate htab itself */\n\n return 0;\n\n }\n\n if (kvm_check_extension(kvm_state, KVM_CAP_PPC_ALLOC_HTAB)) {\n\n int ret;\n\n ret = kvm_vm_ioctl(kvm_state, KVM_PPC_ALLOCATE_HTAB, &shift);\n\n if (ret == -ENOTTY) {\n\n /* At least some versions of PR KVM advertise the\n\n * capability, but don't implement the ioctl(). Oops.\n\n * Return 0 so that we allocate the htab in qemu, as is\n\n * correct for PR. */\n\n return 0;\n\n } else if (ret < 0) {\n\n return ret;\n\n }\n\n return shift;\n\n }\n\n\n\n /* We have a kernel that predates the htab reset calls. For PR\n\n * KVM, we need to allocate the htab ourselves, for an HV KVM of\n\n * this era, it has allocated a 16MB fixed size hash table\n\n * already. Kernels of this era have the GET_PVINFO capability\n\n * only on PR, so we use this hack to determine the right\n\n * answer */\n\n if (kvm_check_extension(kvm_state, KVM_CAP_PPC_GET_PVINFO)) {\n\n /* PR - tell caller to allocate htab */\n\n return 0;\n\n } else {\n\n /* HV - assume 16MB kernel allocated htab */\n\n return 24;\n\n }\n\n}\n"}} {"sample_id": "2f7e8dcf45f11df94f47acbe6825cc93514ea59b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n \n for (y = 0; y < h; y++) {\n \n+ if ((y ^ parity) & 1) {\n+\n+ uint8_t *prev = &yadif->prev->data[i][y*refs];\n+\n+ uint8_t *cur = &yadif->cur ->data[i][y*refs];\n \n uint8_t *next = &yadif->next->data[i][y*refs];\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void filter(AVFilterContext *ctx, AVFilterBufferRef *dstpic,\n\n int parity, int tff)\n\n{\n\n YADIFContext *yadif = ctx->priv;\n\n int y, i;\n\n\n\n for (i = 0; i < yadif->csp->nb_components; i++) {\n\n int w = dstpic->video->w;\n\n int h = dstpic->video->h;\n\n int refs = yadif->cur->linesize[i];\n\n int df = (yadif->csp->comp[i].depth_minus1 + 8) / 8;\n\n\n\n if (i == 1 || i == 2) {\n\n /* Why is this not part of the per-plane description thing? */\n\n w >>= yadif->csp->log2_chroma_w;\n\n h >>= yadif->csp->log2_chroma_h;\n\n }\n\n\n\n for (y = 0; y < h; y++) {\n\n if ((y ^ parity) & 1) {\n\n uint8_t *prev = &yadif->prev->data[i][y*refs];\n\n uint8_t *cur = &yadif->cur ->data[i][y*refs];\n\n uint8_t *next = &yadif->next->data[i][y*refs];\n\n uint8_t *dst = &dstpic->data[i][y*dstpic->linesize[i]];\n\n int mode = y==1 || y+2==h ? 2 : yadif->mode;\n\n yadif->filter_line(dst, prev, cur, next, w, y+1data[i][y*dstpic->linesize[i]],\n\n &yadif->cur->data[i][y*refs], w*df);\n\n }\n\n }\n\n }\n\n\n\n emms_c();\n\n}\n"}} {"sample_id": "fb7a2bf6956173eda6f9caceef8599fa4f83500d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,10 +2,10 @@\n \n {\n \n+ while (tags->id != 0) {\n+\n+ if (!tags->invalid_asf && tags->id == id)\n+\n return tags->tag;\n \n tags++;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static unsigned int codec_get_asf_tag(const CodecTag *tags, unsigned int id)\n\n{\n\n while (tags->id != 0) {\n\n if (!tags->invalid_asf && tags->id == id)\n\n return tags->tag;\n\n tags++;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "771c86c13d7133035e53f7aeb14407ae5dca6453", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+av_cold void ff_psy_preprocess_end(struct FFPsyPreprocessContext *ctx)\n+\n+{\n+\n int i;\n \n ff_iir_filter_free_coeffs(ctx->fcoeffs);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "av_cold void ff_psy_preprocess_end(struct FFPsyPreprocessContext *ctx)\n\n{\n\n int i;\n\n ff_iir_filter_free_coeffs(ctx->fcoeffs);\n\n if (ctx->fstate)\n\n for (i = 0; i < ctx->avctx->channels; i++)\n\n ff_iir_filter_free_state(ctx->fstate[i]);\n\n av_freep(&ctx->fstate);\n\n\n}"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_267", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static uint64_t tmu2_read(void *opaque, target_phys_addr_t addr,\n \n unsigned size)\n+\n+{\n+\n+ MilkymistTMU2State *s = opaque;\n+\n uint32_t r = 0;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t tmu2_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n MilkymistTMU2State *s = opaque;\n\n uint32_t r = 0;\n\n\n\n addr >>= 2;\n\n switch (addr) {\n\n case R_CTL:\n\n case R_HMESHLAST:\n\n case R_VMESHLAST:\n\n case R_BRIGHTNESS:\n\n case R_CHROMAKEY:\n\n case R_VERTICESADDR:\n\n case R_TEXFBUF:\n\n case R_TEXHRES:\n\n case R_TEXVRES:\n\n case R_TEXHMASK:\n\n case R_TEXVMASK:\n\n case R_DSTFBUF:\n\n case R_DSTHRES:\n\n case R_DSTVRES:\n\n case R_DSTHOFFSET:\n\n case R_DSTVOFFSET:\n\n case R_DSTSQUAREW:\n\n case R_DSTSQUAREH:\n\n case R_ALPHA:\n\n r = s->regs[addr];\n\n break;\n\n\n\n default:\n\n error_report(\"milkymist_tmu2: read access to unknown register 0x\"\n\n TARGET_FMT_plx, addr << 2);\n\n break;\n\n }\n\n\n\n trace_milkymist_tmu2_memory_read(addr << 2, r);\n\n\n\n return r;\n\n}\n"}} {"sample_id": "e12ed72e5c00dd3375b8bd107200e4d7e950276a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n /* First word */\n if (nr - bits_to_clear > 0) {\n old_bits = atomic_fetch_and(p, ~mask_to_clear);\n+ dirty |= old_bits & mask_to_clear;\n+ nr -= bits_to_clear;\n+ bits_to_clear = BITS_PER_LONG;\n+ mask_to_clear = ~0UL;\n+ p++;\n }\n /* Full words */\n if (bits_to_clear == BITS_PER_LONG) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "bool bitmap_test_and_clear_atomic(unsigned long *map, long start, long nr)\n{\n unsigned long *p = map + BIT_WORD(start);\n const long size = start + nr;\n int bits_to_clear = BITS_PER_LONG - (start % BITS_PER_LONG);\n unsigned long mask_to_clear = BITMAP_FIRST_WORD_MASK(start);\n unsigned long dirty = 0;\n unsigned long old_bits;\n /* First word */\n if (nr - bits_to_clear > 0) {\n old_bits = atomic_fetch_and(p, ~mask_to_clear);\n dirty |= old_bits & mask_to_clear;\n nr -= bits_to_clear;\n bits_to_clear = BITS_PER_LONG;\n mask_to_clear = ~0UL;\n p++;\n }\n /* Full words */\n if (bits_to_clear == BITS_PER_LONG) {\n while (nr >= BITS_PER_LONG) {\n if (*p) {\n old_bits = atomic_xchg(p, 0);\n dirty |= old_bits;\n }\n nr -= BITS_PER_LONG;\n p++;\n }\n }\n /* Last word */\n if (nr) {\n mask_to_clear &= BITMAP_LAST_WORD_MASK(size);\n old_bits = atomic_fetch_and(p, ~mask_to_clear);\n dirty |= old_bits & mask_to_clear;\n } else {\n if (!dirty) {\n smp_mb();\n }\n }\n return dirty != 0;\n}"}} {"sample_id": "ec53b45bcd1f74f7a4c31331fa6d50b402cd6d26_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n CPUBreakpoint *bp;\n \n \n+\n+ QTAILQ_FOREACH(bp, &cpu->breakpoints, entry) {\n+\n+ if (bp->pc == pc && bp->flags == flags) {\n+\n cpu_breakpoint_remove_by_ref(cpu, bp);\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int cpu_breakpoint_remove(CPUState *cpu, vaddr pc, int flags)\n\n{\n\n#if defined(TARGET_HAS_ICE)\n\n CPUBreakpoint *bp;\n\n\n\n QTAILQ_FOREACH(bp, &cpu->breakpoints, entry) {\n\n if (bp->pc == pc && bp->flags == flags) {\n\n cpu_breakpoint_remove_by_ref(cpu, bp);\n\n return 0;\n\n }\n\n }\n\n return -ENOENT;\n\n#else\n\n return -ENOSYS;\n\n#endif\n\n}\n"}} {"sample_id": "ed9164a3549f93204d6b096136cda2ce54e9f03a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n if (err) {\n \n+ fprintf(stderr, \"qemu:%s: %s\", __func__, strerror(err));\n+\n+ exit(1);\n+\n+ }\n \n #else /* _WIN32 */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_cpu_kick_thread(CPUState *cpu)\n\n{\n\n#ifndef _WIN32\n\n int err;\n\n\n\n err = pthread_kill(cpu->thread->thread, SIG_IPI);\n\n if (err) {\n\n fprintf(stderr, \"qemu:%s: %s\", __func__, strerror(err));\n\n exit(1);\n\n }\n\n#else /* _WIN32 */\n\n if (!qemu_cpu_is_self(cpu)) {\n\n SuspendThread(cpu->hThread);\n\n cpu_signal(0);\n\n ResumeThread(cpu->hThread);\n\n }\n\n#endif\n\n}\n"}} {"sample_id": "955aec3c7c7be39b659197e1ec379a09f2b7c41c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n avpriv_mpegaudio_decode_header(&mh, header))\n \n+ break;\n+\n+ out_pos[i] = off;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int check(AVIOContext *pb, int64_t pos, int64_t *out_pos)\n\n{\n\n MPADecodeHeader mh = { 0 };\n\n int i;\n\n uint32_t header;\n\n int64_t off = 0;\n\n\n\n\n\n for (i = 0; i < SEEK_PACKETS; i++) {\n\n off = avio_seek(pb, pos + mh.frame_size, SEEK_SET);\n\n if (off < 0)\n\n break;\n\n\n\n header = avio_rb32(pb);\n\n\n\n if (ff_mpa_check_header(header) < 0 ||\n\n avpriv_mpegaudio_decode_header(&mh, header))\n\n break;\n\n out_pos[i] = off;\n\n }\n\n\n\n return i;\n\n}\n"}} {"sample_id": "ebba2b3e2a551ce638d17332761431ba748f178f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static int tcp_wait_fd(int fd, int write)\n+\n+{\n+\n int ev = write ? POLLOUT : POLLIN;\n \n struct pollfd p = { .fd = fd, .events = ev, .revents = 0 };", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int tcp_wait_fd(int fd, int write)\n\n{\n\n int ev = write ? POLLOUT : POLLIN;\n\n struct pollfd p = { .fd = fd, .events = ev, .revents = 0 };\n\n int ret;\n\n\n\n ret = poll(&p, 1, 100);\n\n return ret < 0 ? ff_neterrno() : p.revents & ev ? 0 : AVERROR(EAGAIN);\n\n}\n"}} {"sample_id": "84b5d556dc29c06402783e98ee0eaa3369eb48e1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n char *prop = g_strdup_printf(\"%s[%d]\", SYSBUS_DEVICE_GPIO_IRQ, n);\n ObjectProperty *r;\n r = object_property_find(OBJECT(dev), prop, NULL);\n+ return (r != NULL);\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "bool sysbus_has_irq(SysBusDevice *dev, int n)\n{\n char *prop = g_strdup_printf(\"%s[%d]\", SYSBUS_DEVICE_GPIO_IRQ, n);\n ObjectProperty *r;\n r = object_property_find(OBJECT(dev), prop, NULL);\n return (r != NULL);\n}"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_185", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n if (size <= 2) {\n \n+ return ne2000_asic_ioport_read(s, addr);\n+\n+ } else {\n+\n+ return ne2000_asic_ioport_readl(s, addr);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t ne2000_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n NE2000State *s = opaque;\n\n\n\n if (addr < 0x10 && size == 1) {\n\n return ne2000_ioport_read(s, addr);\n\n } else if (addr == 0x10) {\n\n if (size <= 2) {\n\n return ne2000_asic_ioport_read(s, addr);\n\n } else {\n\n return ne2000_asic_ioport_readl(s, addr);\n\n }\n\n } else if (addr == 0x1f && size == 1) {\n\n return ne2000_reset_ioport_read(s, addr);\n\n }\n\n return ((uint64_t)1 << (size * 8)) - 1;\n\n}\n"}} {"sample_id": "25db9ebe15125deb32958c6df74996f745edf1f9_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n VirtIOPCIProxy *proxy = opaque;\n+\n+ VirtQueue *vq = virtio_get_queue(proxy->vdev, n);\n+\n+ EventNotifier *notifier = virtio_queue_get_host_notifier(vq);\n+\n int r;\n \n if (assign) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int virtio_pci_set_host_notifier(void *opaque, int n, bool assign)\n\n{\n\n VirtIOPCIProxy *proxy = opaque;\n\n VirtQueue *vq = virtio_get_queue(proxy->vdev, n);\n\n EventNotifier *notifier = virtio_queue_get_host_notifier(vq);\n\n int r;\n\n if (assign) {\n\n r = event_notifier_init(notifier, 1);\n\n if (r < 0) {\n\n return r;\n\n }\n\n r = kvm_set_ioeventfd_pio_word(event_notifier_get_fd(notifier),\n\n proxy->addr + VIRTIO_PCI_QUEUE_NOTIFY,\n\n n, assign);\n\n if (r < 0) {\n\n event_notifier_cleanup(notifier);\n\n }\n\n } else {\n\n r = kvm_set_ioeventfd_pio_word(event_notifier_get_fd(notifier),\n\n proxy->addr + VIRTIO_PCI_QUEUE_NOTIFY,\n\n n, assign);\n\n if (r < 0) {\n\n return r;\n\n }\n\n event_notifier_cleanup(notifier);\n\n }\n\n return r;\n\n}\n"}} {"sample_id": "e8bccad5ac6095b5af7946cd72d9aacb57f7c0a3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,7 +22,7 @@\n \n /* Short reads mean EOF, pad with zeros. */\n \n+ if (waiocb->is_read) {\n \n qemu_iovec_memset(waiocb->qiov, count, 0,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void win32_aio_process_completion(QEMUWin32AIOState *s,\n\n QEMUWin32AIOCB *waiocb, DWORD count)\n\n{\n\n int ret;\n\n s->count--;\n\n\n\n if (waiocb->ov.Internal != 0) {\n\n ret = -EIO;\n\n } else {\n\n ret = 0;\n\n if (count < waiocb->nbytes) {\n\n /* Short reads mean EOF, pad with zeros. */\n\n if (waiocb->is_read) {\n\n qemu_iovec_memset(waiocb->qiov, count, 0,\n\n waiocb->qiov->size - count);\n\n } else {\n\n ret = -EINVAL;\n\n }\n\n }\n\n }\n\n\n\n if (!waiocb->is_linear) {\n\n if (ret == 0 && waiocb->is_read) {\n\n QEMUIOVector *qiov = waiocb->qiov;\n\n char *p = waiocb->buf;\n\n int i;\n\n\n\n for (i = 0; i < qiov->niov; ++i) {\n\n memcpy(qiov->iov[i].iov_base, p, qiov->iov[i].iov_len);\n\n p += qiov->iov[i].iov_len;\n\n }\n\n qemu_vfree(waiocb->buf);\n\n }\n\n }\n\n\n\n\n\n waiocb->common.cb(waiocb->common.opaque, ret);\n\n qemu_aio_release(waiocb);\n\n}\n"}} {"sample_id": "fd7a7e11b94b12259c6f1e375da15298cbc37e83", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n BufferSinkContext *buf = ctx->priv;\n \n AVFilterFormats *formats = NULL;\n+\n unsigned i;\n \n int ret;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-89", "target_file": "source.c", "files": {"source.c": "static int vsink_query_formats(AVFilterContext *ctx)\n\n{\n\n BufferSinkContext *buf = ctx->priv;\n\n AVFilterFormats *formats = NULL;\n\n unsigned i;\n\n int ret;\n\n\n\n CHECK_LIST_SIZE(pixel_fmts)\n\n if (buf->pixel_fmts_size) {\n\n for (i = 0; i < NB_ITEMS(buf->pixel_fmts); i++)\n\n if ((ret = ff_add_format(&formats, buf->pixel_fmts[i])) < 0)\n\n return ret;\n\n ff_set_common_formats(ctx, formats);\n\n } else {\n\n ff_default_query_formats(ctx);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "ad6919dc0ab3b8ae26d772e883aa8e709785d249", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n ARMCPU *cpu = ARM_CPU(thread_cpu);\n \n+ uint32_t hwcaps = 0;\n+\n+\n+\n+ hwcaps |= ARM_HWCAP_ARM_SWP;\n \n hwcaps |= ARM_HWCAP_ARM_HALF;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t get_elf_hwcap(void)\n\n{\n\n ARMCPU *cpu = ARM_CPU(thread_cpu);\n\n uint32_t hwcaps = 0;\n\n\n\n hwcaps |= ARM_HWCAP_ARM_SWP;\n\n hwcaps |= ARM_HWCAP_ARM_HALF;\n\n hwcaps |= ARM_HWCAP_ARM_THUMB;\n\n hwcaps |= ARM_HWCAP_ARM_FAST_MULT;\n\n\n\n /* probe for the extra features */\n\n#define GET_FEATURE(feat, hwcap) \\\n\n do { if (arm_feature(&cpu->env, feat)) { hwcaps |= hwcap; } } while (0)\n\n /* EDSP is in v5TE and above, but all our v5 CPUs are v5TE */\n\n GET_FEATURE(ARM_FEATURE_V5, ARM_HWCAP_ARM_EDSP);\n\n GET_FEATURE(ARM_FEATURE_VFP, ARM_HWCAP_ARM_VFP);\n\n GET_FEATURE(ARM_FEATURE_IWMMXT, ARM_HWCAP_ARM_IWMMXT);\n\n GET_FEATURE(ARM_FEATURE_THUMB2EE, ARM_HWCAP_ARM_THUMBEE);\n\n GET_FEATURE(ARM_FEATURE_NEON, ARM_HWCAP_ARM_NEON);\n\n GET_FEATURE(ARM_FEATURE_VFP3, ARM_HWCAP_ARM_VFPv3);\n\n GET_FEATURE(ARM_FEATURE_V6K, ARM_HWCAP_ARM_TLS);\n\n GET_FEATURE(ARM_FEATURE_VFP4, ARM_HWCAP_ARM_VFPv4);\n\n GET_FEATURE(ARM_FEATURE_ARM_DIV, ARM_HWCAP_ARM_IDIVA);\n\n GET_FEATURE(ARM_FEATURE_THUMB_DIV, ARM_HWCAP_ARM_IDIVT);\n\n /* All QEMU's VFPv3 CPUs have 32 registers, see VFP_DREG in translate.c.\n\n * Note that the ARM_HWCAP_ARM_VFPv3D16 bit is always the inverse of\n\n * ARM_HWCAP_ARM_VFPD32 (and so always clear for QEMU); it is unrelated\n\n * to our VFP_FP16 feature bit.\n\n */\n\n GET_FEATURE(ARM_FEATURE_VFP3, ARM_HWCAP_ARM_VFPD32);\n\n GET_FEATURE(ARM_FEATURE_LPAE, ARM_HWCAP_ARM_LPAE);\n\n#undef GET_FEATURE\n\n\n\n return hwcaps;\n\n}\n"}} {"sample_id": "8c5ee45d13b7a0d14ff75b7db72d5400b7750571", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n case e_floor:\n \n+ case e_ceil:\n+\n+ case e_trunc:\n+\n+ case e_sqrt:\n \n case e_not:\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int verify_expr(AVExpr *e)\n\n{\n\n if (!e) return 0;\n\n switch (e->type) {\n\n case e_value:\n\n case e_const: return 1;\n\n case e_func0:\n\n case e_func1:\n\n case e_squish:\n\n case e_ld:\n\n case e_gauss:\n\n case e_isnan:\n\n case e_floor:\n\n case e_ceil:\n\n case e_trunc:\n\n case e_sqrt:\n\n case e_not:\n\n case e_random:\n\n return verify_expr(e->param[0]) && !e->param[2];\n\n case e_taylor:\n\n return verify_expr(e->param[0]) && verify_expr(e->param[1])\n\n && (!e->param[2] || verify_expr(e->param[2]));\n\n default: return verify_expr(e->param[0]) && verify_expr(e->param[1]) && !e->param[2];\n\n }\n\n}\n"}} {"sample_id": "c535436cbeeab89be64e9f3fd652bc736f2f3245", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n for (mat = 0; mat < s->num_primitive_matrices; mat++)\n \n if (s->lsb_bypass[mat])\n+\n m->bypassed_lsbs[pos + s->blockpos][mat] = get_bits1(gbp);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline int read_huff_channels(MLPDecodeContext *m, GetBitContext *gbp,\n\n unsigned int substr, unsigned int pos)\n\n{\n\n SubStream *s = &m->substream[substr];\n\n unsigned int mat, channel;\n\n\n\n for (mat = 0; mat < s->num_primitive_matrices; mat++)\n\n if (s->lsb_bypass[mat])\n\n m->bypassed_lsbs[pos + s->blockpos][mat] = get_bits1(gbp);\n\n\n\n for (channel = s->min_channel; channel <= s->max_channel; channel++) {\n\n ChannelParams *cp = &s->channel_params[channel];\n\n int codebook = cp->codebook;\n\n int quant_step_size = s->quant_step_size[channel];\n\n int lsb_bits = cp->huff_lsbs - quant_step_size;\n\n int result = 0;\n\n\n\n if (codebook > 0)\n\n result = get_vlc2(gbp, huff_vlc[codebook-1].table,\n\n VLC_BITS, (9 + VLC_BITS - 1) / VLC_BITS);\n\n\n\n if (result < 0)\n\n return AVERROR_INVALIDDATA;\n\n\n\n if (lsb_bits > 0)\n\n result = (result << lsb_bits) + get_bits(gbp, lsb_bits);\n\n\n\n result += cp->sign_huff_offset;\n\n result <<= quant_step_size;\n\n\n\n m->sample_buffer[pos + s->blockpos][channel] = result;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_35", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n+PPC_OP(subfic)\n+\n+{\n+\n T0 = PARAM(1) + ~T0 + 1;\n+\n if (T0 <= PARAM(1)) {\n+\n xer_ca = 1;\n \n } else {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "PPC_OP(subfic)\n\n{\n\n T0 = PARAM(1) + ~T0 + 1;\n\n if (T0 <= PARAM(1)) {\n\n xer_ca = 1;\n\n } else {\n\n xer_ca = 0;\n\n }\n\n RETURN();\n\n}\n"}} {"sample_id": "f141b353e60f1081185927a1e74a9ab46cae8bef", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,8 +10,8 @@\n if (best_dist > dist) {\n best_dist = dist;\n best_band = i;\n+ }\n+ }\n+ f->intensity_stereo = best_band;\n+ s->avg_is_band = (s->avg_is_band + f->intensity_stereo)/2.0f;\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void celt_search_for_intensity(OpusPsyContext *s, CeltFrame *f)\n{\n int i, best_band = CELT_MAX_BANDS - 1;\n float dist, best_dist = FLT_MAX;\n /* TODO: fix, make some heuristic up here using the lambda value */\n float end_band = 0;\n for (i = f->end_band; i >= end_band; i--) {\n f->intensity_stereo = i;\n bands_dist(s, f, &dist);\n if (best_dist > dist) {\n best_dist = dist;\n best_band = i;\n }\n }\n f->intensity_stereo = best_band;\n s->avg_is_band = (s->avg_is_band + f->intensity_stereo)/2.0f;\n}"}} {"sample_id": "d20423788e3a3d5f6a2aad8315779bf3f952ca36", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n \n \n+ fd = open_by_handle(data->mountfd, fs_path->data, O_NONBLOCK);\n+\n+ if (fd < 0) {\n+\n+ return fd;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int handle_utimensat(FsContext *ctx, V9fsPath *fs_path,\n\n const struct timespec *buf)\n\n{\n\n int fd, ret;\n\n struct handle_data *data = (struct handle_data *)ctx->private;\n\n\n\n fd = open_by_handle(data->mountfd, fs_path->data, O_NONBLOCK);\n\n if (fd < 0) {\n\n return fd;\n\n }\n\n ret = futimens(fd, buf);\n\n close(fd);\n\n return ret;\n\n}\n"}} {"sample_id": "e0c6cce44729d94e2a5507a4b6d031f23e8bd7b6_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,10 +36,10 @@\n \n dsp->idct_put = ff_prores_idct_put_10_avx;\n \n+ }\n+\n+#endif /* HAVE_AVX */\n+\n+#endif /* ARCH_X86_64 && HAVE_YASM */\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_proresdsp_x86_init(ProresDSPContext *dsp)\n\n{\n\n#if ARCH_X86_64 && HAVE_YASM\n\n int flags = av_get_cpu_flags();\n\n\n\n if (flags & AV_CPU_FLAG_SSE2) {\n\n dsp->idct_permutation_type = FF_TRANSPOSE_IDCT_PERM;\n\n dsp->idct_put = ff_prores_idct_put_10_sse2;\n\n }\n\n\n\n if (flags & AV_CPU_FLAG_SSE4) {\n\n dsp->idct_permutation_type = FF_TRANSPOSE_IDCT_PERM;\n\n dsp->idct_put = ff_prores_idct_put_10_sse4;\n\n }\n\n\n\n#if HAVE_AVX\n\n if (flags & AV_CPU_FLAG_AVX) {\n\n dsp->idct_permutation_type = FF_TRANSPOSE_IDCT_PERM;\n\n dsp->idct_put = ff_prores_idct_put_10_avx;\n\n }\n\n#endif /* HAVE_AVX */\n\n#endif /* ARCH_X86_64 && HAVE_YASM */\n\n}\n"}} {"sample_id": "ddca7f86ac022289840e0200fd4050b2b58e9176", "diff": "--- a/source.c\n+++ b/source.c\n@@ -41,11 +41,11 @@\n retval = offset;\n \n retval += v9fs_fill_statfs(s, pdu, &stbuf);\n+\n+out:\n+\n+ put_fid(pdu, fidp);\n+\n out_nofid:\n \n complete_pdu(s, pdu, retval);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void v9fs_statfs(void *opaque)\n\n{\n\n int32_t fid;\n\n ssize_t retval = 0;\n\n size_t offset = 7;\n\n V9fsFidState *fidp;\n\n struct statfs stbuf;\n\n V9fsPDU *pdu = opaque;\n\n V9fsState *s = pdu->s;\n\n\n\n pdu_unmarshal(pdu, offset, \"d\", &fid);\n\n fidp = get_fid(pdu, fid);\n\n if (fidp == NULL) {\n\n retval = -ENOENT;\n\n goto out_nofid;\n\n }\n\n retval = v9fs_co_statfs(pdu, &fidp->path, &stbuf);\n\n if (retval < 0) {\n\n goto out;\n\n }\n\n retval = offset;\n\n retval += v9fs_fill_statfs(s, pdu, &stbuf);\n\nout:\n\n put_fid(pdu, fidp);\n\nout_nofid:\n\n complete_pdu(s, pdu, retval);\n\n return;\n\n}\n"}} {"sample_id": "f8ed85ac992c48814d916d5df4d44f9a971c5de4_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,12 +4,12 @@\n \n uint64_t ram_size)\n \n+{\n \n if (mem_path) {\n \n #ifdef __linux__\n+\n Error *err = NULL;\n \n memory_region_init_ram_from_file(mr, owner, name, ram_size, false,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void allocate_system_memory_nonnuma(MemoryRegion *mr, Object *owner,\n\n const char *name,\n\n uint64_t ram_size)\n\n{\n\n if (mem_path) {\n\n#ifdef __linux__\n\n Error *err = NULL;\n\n memory_region_init_ram_from_file(mr, owner, name, ram_size, false,\n\n mem_path, &err);\n\n\n\n /* Legacy behavior: if allocation failed, fall back to\n\n * regular RAM allocation.\n\n */\n\n if (err) {\n\n error_report_err(err);\n\n memory_region_init_ram(mr, owner, name, ram_size, &error_abort);\n\n }\n\n#else\n\n fprintf(stderr, \"-mem-path not supported on this host\\n\");\n\n exit(1);\n\n#endif\n\n } else {\n\n memory_region_init_ram(mr, owner, name, ram_size, &error_abort);\n\n }\n\n vmstate_register_ram_global(mr);\n\n}\n"}} {"sample_id": "4fa4ce7107c6ec432f185307158c5df91ce54308_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static int local_opendir(FsContext *ctx,\n \n V9fsPath *fs_path, V9fsFidOpenState *fs)\n+\n+{\n+\n+ char buffer[PATH_MAX];\n+\n char *path = fs_path->data;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int local_opendir(FsContext *ctx,\n\n V9fsPath *fs_path, V9fsFidOpenState *fs)\n\n{\n\n char buffer[PATH_MAX];\n\n char *path = fs_path->data;\n\n\n\n fs->dir = opendir(rpath(ctx, path, buffer));\n\n if (!fs->dir) {\n\n return -1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "e644db613a8fe008c996ca642800f8ccd90e613f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static av_cold int xvid_encode_close(AVCodecContext *avctx) {\n \n struct xvid_context *x = avctx->priv_data;\n+\n \n \n xvid_encore(x->encoder_handle, XVID_ENC_DESTROY, NULL, NULL);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static av_cold int xvid_encode_close(AVCodecContext *avctx) {\n\n struct xvid_context *x = avctx->priv_data;\n\n\n\n xvid_encore(x->encoder_handle, XVID_ENC_DESTROY, NULL, NULL);\n\n\n\n if( avctx->extradata != NULL )\n\n av_free(avctx->extradata);\n\n if( x->twopassbuffer != NULL ) {\n\n av_free(x->twopassbuffer);\n\n av_free(x->old_twopassbuffer);\n\n }\n\n if( x->twopassfile != NULL )\n\n av_free(x->twopassfile);\n\n if( x->intra_matrix != NULL )\n\n av_free(x->intra_matrix);\n\n if( x->inter_matrix != NULL )\n\n av_free(x->inter_matrix);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_183", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+void stq_le_phys(target_phys_addr_t addr, uint64_t val)\n+\n {\n \n val = cpu_to_le64(val);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void stq_le_phys(target_phys_addr_t addr, uint64_t val)\n\n{\n\n val = cpu_to_le64(val);\n\n cpu_physical_memory_write(addr, &val, 8);\n\n}\n"}} {"sample_id": "273a2142176098fe2c27f263d86ad66b133b43cb_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void pci_mmio_map(PCIDevice * pci_dev, int region_num,\n \n+ uint32_t addr, uint32_t size, int type)\n+\n+{\n+\n+ PCIEEPRO100State *d = DO_UPCAST(PCIEEPRO100State, dev, pci_dev);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pci_mmio_map(PCIDevice * pci_dev, int region_num,\n\n uint32_t addr, uint32_t size, int type)\n\n{\n\n PCIEEPRO100State *d = DO_UPCAST(PCIEEPRO100State, dev, pci_dev);\n\n\n\n logout(\"region %d, addr=0x%08x, size=0x%08x, type=%d\\n\",\n\n region_num, addr, size, type);\n\n\n\n if (region_num == 0) {\n\n /* Map control / status registers. */\n\n cpu_register_physical_memory(addr, size, d->eepro100.mmio_index);\n\n d->eepro100.region[region_num] = addr;\n\n }\n\n}\n"}} {"sample_id": "19a2223feaabc6c574af57c8c5f1c21a60e8d194", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,8 +22,8 @@\n \n 0xffff, 0);\n \n+ env->halted = 0;\n+\n+ s->wait_for_sipi = 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void apic_sipi(CPUState *env)\n\n{\n\n APICState *s = env->apic_state;\n\n\n\n cpu_reset_interrupt(env, CPU_INTERRUPT_SIPI);\n\n\n\n if (!s->wait_for_sipi)\n\n return;\n\n\n\n env->eip = 0;\n\n cpu_x86_load_seg_cache(env, R_CS, s->sipi_vector << 8, s->sipi_vector << 12,\n\n 0xffff, 0);\n\n env->halted = 0;\n\n s->wait_for_sipi = 0;\n\n}\n"}} {"sample_id": "7d91ddd25e3a4e5008a2ac16127d51a34fd56bf1_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n NetQueue *qemu_new_net_queue(void *opaque)\n \n+{\n+\n+ NetQueue *queue;\n+\n+\n \n queue = g_malloc0(sizeof(NetQueue));\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "NetQueue *qemu_new_net_queue(void *opaque)\n\n{\n\n NetQueue *queue;\n\n\n\n queue = g_malloc0(sizeof(NetQueue));\n\n\n\n queue->opaque = opaque;\n\n\n\n\n\n QTAILQ_INIT(&queue->packets);\n\n\n\n queue->delivering = 0;\n\n\n\n return queue;\n\n}"}} {"sample_id": "d7b61ecc61f84d23f98f1ee270fb48b41834ca00", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n pci_config_set_vendor_id(d->config, PCI_VENDOR_ID_APPLE);\n+\n+ pci_config_set_device_id(d->config, PCI_DEVICE_ID_APPLE_UNI_N_I_PCI);\n+\n+ d->config[0x08] = 0x00; // revision\n+\n pci_config_set_class(d->config, PCI_CLASS_BRIDGE_HOST);\n \n d->config[0x0C] = 0x08; // cache_line_size", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int unin_internal_pci_host_init(PCIDevice *d)\n\n{\n\n pci_config_set_vendor_id(d->config, PCI_VENDOR_ID_APPLE);\n\n pci_config_set_device_id(d->config, PCI_DEVICE_ID_APPLE_UNI_N_I_PCI);\n\n d->config[0x08] = 0x00; // revision\n\n pci_config_set_class(d->config, PCI_CLASS_BRIDGE_HOST);\n\n d->config[0x0C] = 0x08; // cache_line_size\n\n d->config[0x0D] = 0x10; // latency_timer\n\n d->config[0x34] = 0x00; // capabilities_pointer\n\n return 0;\n\n}\n"}} {"sample_id": "45a50b1668822c23afc2a89f724654e176518bc4_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -42,11 +42,11 @@\n \n exit(1);\n \n+ }\n+\n+ /* Round up optiom rom size to the next 2k boundary */\n+\n+ size = (size + 2047) & ~2047;\n \n option_rom_setup_reset(start, size);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int load_option_rom(const char *oprom, target_phys_addr_t start,\n\n target_phys_addr_t end)\n\n{\n\n int size;\n\n char *filename;\n\n\n\n filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, oprom);\n\n if (filename) {\n\n size = get_image_size(filename);\n\n if (size > 0 && start + size > end) {\n\n fprintf(stderr, \"Not enough space to load option rom '%s'\\n\",\n\n oprom);\n\n exit(1);\n\n }\n\n size = load_image_targphys(filename, start, end - start);\n\n qemu_free(filename);\n\n } else {\n\n size = -1;\n\n }\n\n if (size < 0) {\n\n fprintf(stderr, \"Could not load option rom '%s'\\n\", oprom);\n\n exit(1);\n\n }\n\n /* Round up optiom rom size to the next 2k boundary */\n\n size = (size + 2047) & ~2047;\n\n option_rom_setup_reset(start, size);\n\n return size;\n\n}\n"}} {"sample_id": "2374e73edafff0586cbfb67c333c5a7588f81fd5_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void helper_stq_raw(uint64_t t0, uint64_t t1)\n \n {\n+\n stq_raw(t1, t0);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void helper_stq_raw(uint64_t t0, uint64_t t1)\n\n{\n\n stq_raw(t1, t0);\n\n}\n"}} {"sample_id": "ed1f8915daf6b84a940463dfe83c7b970f82383d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n va_list vl;\n+\n+ va_start(vl, fmt);\n+\n+ av_log(NULL, log_level, \"%s:%d: \", filename, line_num);\n \n av_vlog(NULL, log_level, fmt, vl);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void report_config_error(const char *filename, int line_num, int log_level, int *errors, const char *fmt, ...)\n\n{\n\n va_list vl;\n\n va_start(vl, fmt);\n\n av_log(NULL, log_level, \"%s:%d: \", filename, line_num);\n\n av_vlog(NULL, log_level, fmt, vl);\n\n va_end(vl);\n\n\n\n (*errors)++;\n\n}\n"}} {"sample_id": "de6c150444159a26fe2555089d384ddd2d6459aa", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n int64_t ff_lsb2full(StreamContext *stream, int64_t lsb){\n+\n int64_t mask = (1<msb_pts_shift)-1;\n \n int64_t delta= stream->last_pts - mask/2;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "int64_t ff_lsb2full(StreamContext *stream, int64_t lsb){\n\n int64_t mask = (1<msb_pts_shift)-1;\n\n int64_t delta= stream->last_pts - mask/2;\n\n return ((lsb - delta)&mask) + delta;\n\n}\n"}} {"sample_id": "ebba2b3e2a551ce638d17332761431ba748f178f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n if (ret < 0) {\n \n if (ff_neterrno() != AVERROR(EINTR) &&\n+\n+ ff_neterrno() != AVERROR(EAGAIN))\n+\n+ return ff_neterrno();\n+\n } else {\n \n break;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int udp_write(URLContext *h, const uint8_t *buf, int size)\n\n{\n\n UDPContext *s = h->priv_data;\n\n int ret;\n\n\n\n for(;;) {\n\n if (!s->is_connected) {\n\n ret = sendto (s->udp_fd, buf, size, 0,\n\n (struct sockaddr *) &s->dest_addr,\n\n s->dest_addr_len);\n\n } else\n\n ret = send(s->udp_fd, buf, size, 0);\n\n if (ret < 0) {\n\n if (ff_neterrno() != AVERROR(EINTR) &&\n\n ff_neterrno() != AVERROR(EAGAIN))\n\n return ff_neterrno();\n\n } else {\n\n break;\n\n }\n\n }\n\n return size;\n\n}\n"}} {"sample_id": "ac4b32df71bd932838043a4838b86d11e169707f_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+const uint8_t *get_submv_prob(uint32_t left, uint32_t top)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "const uint8_t *get_submv_prob(uint32_t left, uint32_t top)\n\n{\n\n if (left == top)\n\n return vp8_submv_prob[4 - !!left];\n\n if (!top)\n\n return vp8_submv_prob[2];\n\n return vp8_submv_prob[1 - !!left];\n\n}\n"}} {"sample_id": "9f61abc8111c7c43f49ca012e957a108b9cc7610_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int segment_end(AVFormatContext *oc, int write_trailer)\n \n+{\n+\n+ int ret = 0;\n+\n+\n \n av_write_frame(oc, NULL); /* Flush any buffered data (fragmented mp4) */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int segment_end(AVFormatContext *oc, int write_trailer)\n\n{\n\n int ret = 0;\n\n\n\n av_write_frame(oc, NULL); /* Flush any buffered data (fragmented mp4) */\n\n if (write_trailer)\n\n av_write_trailer(oc);\n\n avio_close(oc->pb);\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "6482b0ffd12ce83810c10b1a3884a75eba2ade1a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void s390x_cpu_timer(void *opaque)\n+\n+{\n+\n S390CPU *cpu = opaque;\n \n CPUS390XState *env = &cpu->env;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void s390x_cpu_timer(void *opaque)\n\n{\n\n S390CPU *cpu = opaque;\n\n CPUS390XState *env = &cpu->env;\n\n\n\n env->pending_int |= INTERRUPT_CPUTIMER;\n\n cpu_interrupt(CPU(cpu), CPU_INTERRUPT_HARD);\n\n}\n"}} {"sample_id": "06bf6d3bc04979bd39ecdc7311d0daf8aee7e10f_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,1 +1,1 @@\n+static void null_end_frame(AVFilterLink *inlink) { }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void null_end_frame(AVFilterLink *inlink) { }\n"}} {"sample_id": "f1e173049ecc9de03817385ba8962d14cba779db", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n {\n \n int i, j;\n+\n+ int w = cblk->coord[0][1] - cblk->coord[0][0];\n+\n+ for (j = 0; j < (cblk->coord[1][1] - cblk->coord[1][0]); ++j) {\n+\n int32_t *datap = &comp->i_data[(comp->coord[0][1] - comp->coord[0][0]) * (y + j) + x];\n \n int *src = t1->data[j];", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void dequantization_int_97(int x, int y, Jpeg2000Cblk *cblk,\n\n Jpeg2000Component *comp,\n\n Jpeg2000T1Context *t1, Jpeg2000Band *band)\n\n{\n\n int i, j;\n\n int w = cblk->coord[0][1] - cblk->coord[0][0];\n\n for (j = 0; j < (cblk->coord[1][1] - cblk->coord[1][0]); ++j) {\n\n int32_t *datap = &comp->i_data[(comp->coord[0][1] - comp->coord[0][0]) * (y + j) + x];\n\n int *src = t1->data[j];\n\n for (i = 0; i < w; ++i)\n\n datap[i] = (src[i] * (int64_t)band->i_stepsize + (1<<14)) >> 15;\n\n }\n\n}\n"}} {"sample_id": "45a50b1668822c23afc2a89f724654e176518bc4_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n \n \n got = fread_targphys(addr, max_sz, f);\n+\n+ if (ferror(f)) { fclose(f); return -1; }\n+\n+ fclose(f);\n+\n \n \n return got;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int load_image_targphys(const char *filename,\n\n\t\t\ttarget_phys_addr_t addr, int max_sz)\n\n{\n\n FILE *f;\n\n size_t got;\n\n\n\n f = fopen(filename, \"rb\");\n\n if (!f) return -1;\n\n\n\n got = fread_targphys(addr, max_sz, f);\n\n if (ferror(f)) { fclose(f); return -1; }\n\n fclose(f);\n\n\n\n return got;\n\n}\n"}} {"sample_id": "02c4f26b1517d9e403ec10d6f6ca3c0276d19e43_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void qemuio_add_command(const cmdinfo_t *ci)\n+\n {\n \n cmdtab = g_realloc(cmdtab, ++ncmds * sizeof(*cmdtab));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void qemuio_add_command(const cmdinfo_t *ci)\n\n{\n\n cmdtab = g_realloc(cmdtab, ++ncmds * sizeof(*cmdtab));\n\n cmdtab[ncmds - 1] = *ci;\n\n qsort(cmdtab, ncmds, sizeof(*cmdtab), compare_cmdname);\n\n}\n"}} {"sample_id": "b544c1aba8681c2fe5d6715fbd37cf6caf1bc7bb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,9 +8,9 @@\n \n AIOReq *aio_req;\n \n+\n \n+ if (s->cache_flags != SD_FLAG_CMD_CACHE) {\n \n return 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int coroutine_fn sd_co_flush_to_disk(BlockDriverState *bs)\n\n{\n\n BDRVSheepdogState *s = bs->opaque;\n\n SheepdogAIOCB *acb;\n\n AIOReq *aio_req;\n\n\n\n if (s->cache_flags != SD_FLAG_CMD_CACHE) {\n\n return 0;\n\n }\n\n\n\n acb = sd_aio_setup(bs, NULL, 0, 0);\n\n acb->aiocb_type = AIOCB_FLUSH_CACHE;\n\n acb->aio_done_func = sd_finish_aiocb;\n\n\n\n aio_req = alloc_aio_req(s, acb, vid_to_vdi_oid(s->inode.vdi_id),\n\n 0, 0, 0, 0, 0);\n\n QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);\n\n add_aio_request(s, aio_req, NULL, 0, false, acb->aiocb_type);\n\n\n\n qemu_coroutine_yield();\n\n return acb->ret;\n\n}\n"}} {"sample_id": "ae2f1d4624dc372aa86f85aeb47f820f48a4af38", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n static int common_init(AVCodecContext *avctx){\n \n+ HYuvContext *s = avctx->priv_data;\n \n int i;\n \n \n \n s->avctx= avctx;\n+\n+ s->flags= avctx->flags;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int common_init(AVCodecContext *avctx){\n\n HYuvContext *s = avctx->priv_data;\n\n int i;\n\n\n\n s->avctx= avctx;\n\n s->flags= avctx->flags;\n\n \n\n dsputil_init(&s->dsp, avctx);\n\n \n\n s->width= avctx->width;\n\n s->height= avctx->height;\n\n assert(s->width>0 && s->height>0);\n\n \n\n for(i=0; i<3; i++){\n\n s->temp[i]= av_malloc(avctx->width + 16);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "2572b37a4751cc967582d7d04f21d9bf97187ae5_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,8 +10,8 @@\n \n acb->req.error = bdrv_co_discard(bs, acb->req.sector, acb->req.nb_sectors);\n \n+ acb->bh = qemu_bh_new(bdrv_co_em_bh, acb);\n+\n+ qemu_bh_schedule(acb->bh);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void coroutine_fn bdrv_aio_discard_co_entry(void *opaque)\n\n{\n\n BlockDriverAIOCBCoroutine *acb = opaque;\n\n BlockDriverState *bs = acb->common.bs;\n\n\n\n acb->req.error = bdrv_co_discard(bs, acb->req.sector, acb->req.nb_sectors);\n\n acb->bh = qemu_bh_new(bdrv_co_em_bh, acb);\n\n qemu_bh_schedule(acb->bh);\n\n}\n"}} {"sample_id": "9824d01d5d789a57d27360c0f5e8ee44955eb1d7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ int64_t th;\n \n uint64_t tl;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "uint64_t helper_mulldo(CPUPPCState *env, uint64_t arg1, uint64_t arg2)\n\n{\n\n int64_t th;\n\n uint64_t tl;\n\n\n\n muls64(&tl, (uint64_t *)&th, arg1, arg2);\n\n /* If th != 0 && th != -1, then we had an overflow */\n\n if (likely((uint64_t)(th + 1) <= 1)) {\n\n env->ov = 0;\n\n } else {\n\n env->so = env->ov = 1;\n\n }\n\n return (int64_t)tl;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_126", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,10 +5,10 @@\n {\n \n MMIOState *s = opaque;\n+\n+ addr >>= s->shift;\n+\n+ if (addr & 7)\n \n return ide_ioport_read(&s->bus, addr);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t mmio_ide_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n MMIOState *s = opaque;\n\n addr >>= s->shift;\n\n if (addr & 7)\n\n return ide_ioport_read(&s->bus, addr);\n\n else\n\n return ide_data_readw(&s->bus, 0);\n\n}\n"}} {"sample_id": "4d7a81c06f5f17e019a2d3a18300500bd64f6f40", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void xhci_check_iso_kick(XHCIState *xhci, XHCITransfer *xfer,\n \n XHCIEPContext *epctx, uint64_t mfindex)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void xhci_check_iso_kick(XHCIState *xhci, XHCITransfer *xfer,\n\n XHCIEPContext *epctx, uint64_t mfindex)\n\n{\n\n if (xfer->mfindex_kick > mfindex) {\n\n timer_mod(epctx->kick_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +\n\n (xfer->mfindex_kick - mfindex) * 125000);\n\n xfer->running_retry = 1;\n\n } else {\n\n epctx->mfindex_last = xfer->mfindex_kick;\n\n timer_del(epctx->kick_timer);\n\n xfer->running_retry = 0;\n\n }\n\n}\n"}} {"sample_id": "e59c28b16660b8f86ef05c7f0db4db89e62ed55f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n c->sample1 = av_clip_int16(predictor);\n \n+ c->idelta = (ff_adpcm_AdaptationTable[(int)nibble] * c->idelta) >> 8;\n+\n+ if (c->idelta < 16) c->idelta = 16;\n+\n+\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline short adpcm_ms_expand_nibble(ADPCMChannelStatus *c, int nibble)\n\n{\n\n int predictor;\n\n\n\n predictor = (((c->sample1) * (c->coeff1)) + ((c->sample2) * (c->coeff2))) / 64;\n\n predictor += ((nibble & 0x08)?(nibble - 0x10):(nibble)) * c->idelta;\n\n\n\n c->sample2 = c->sample1;\n\n c->sample1 = av_clip_int16(predictor);\n\n c->idelta = (ff_adpcm_AdaptationTable[(int)nibble] * c->idelta) >> 8;\n\n if (c->idelta < 16) c->idelta = 16;\n\n\n\n\n\n\n\n return c->sample1;\n"}} {"sample_id": "0ecca7a49f8e254c12a3a1de048d738bfbb614c6_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void encode_gray_bitstream(HYuvContext *s, int count){\n \n int i;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void encode_gray_bitstream(HYuvContext *s, int count){\n\n int i;\n\n \n\n count/=2;\n\n if(s->flags&CODEC_FLAG_PASS1){\n\n for(i=0; istats[0][ s->temp[0][2*i ] ]++;\n\n s->stats[0][ s->temp[0][2*i+1] ]++;\n\n }\n\n }else if(s->context){\n\n for(i=0; istats[0][ s->temp[0][2*i ] ]++;\n\n put_bits(&s->pb, s->len[0][ s->temp[0][2*i ] ], s->bits[0][ s->temp[0][2*i ] ]);\n\n s->stats[0][ s->temp[0][2*i+1] ]++;\n\n put_bits(&s->pb, s->len[0][ s->temp[0][2*i+1] ], s->bits[0][ s->temp[0][2*i+1] ]);\n\n }\n\n }else{\n\n for(i=0; ipb, s->len[0][ s->temp[0][2*i ] ], s->bits[0][ s->temp[0][2*i ] ]);\n\n put_bits(&s->pb, s->len[0][ s->temp[0][2*i+1] ], s->bits[0][ s->temp[0][2*i+1] ]);\n\n }\n\n }\n\n}\n"}} {"sample_id": "3c11a27b440e27c3796592aa8fb7fed966386a21", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,7 +12,7 @@\n \n }\n \n+ }else{\n \n for(i=0; ipicture[i].data[0]==NULL && s->picture[i].type==0) return i;\n\n }\n\n }else{\n\n for(i=0; ipicture[i].data[0]==NULL && s->picture[i].type!=0) return i; //FIXME\n\n }\n\n for(i=0; ipicture[i].data[0]==NULL) return i;\n\n }\n\n }\n\n\n\n assert(0);\n\n return -1;\n\n}\n"}} {"sample_id": "7b5ff7d57355dc608f0fd86e3ab32a2fda65e752", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void vp7_decode_mb_row_no_filter(AVCodecContext *avctx, void *tdata,\n+\n int jobnr, int threadnr)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void vp7_decode_mb_row_no_filter(AVCodecContext *avctx, void *tdata,\n\n int jobnr, int threadnr)\n\n{\n\n decode_mb_row_no_filter(avctx, tdata, jobnr, threadnr, 1);\n\n}\n"}} {"sample_id": "0c1959b056f6ccaa2eee2c824352ba93c8e36d52", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n \n /* The command line flac encoder defaults to placing a seekpoint\n \n+ * every 10s. So one might add padding to allow that later\n+\n+ * but there seems to be no simple way to get the duration here.\n+\n+ * So let's try the flac default of 8192 bytes */\n \n flac_write_block_padding(s->pb, 8192, 1);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int flac_write_header(struct AVFormatContext *s)\n\n{\n\n int ret;\n\n AVCodecContext *codec = s->streams[0]->codec;\n\n FlacMuxerContext *c = s->priv_data;\n\n\n\n if (!c->write_header)\n\n return 0;\n\n\n\n ret = ff_flac_write_header(s->pb, codec, 0);\n\n if (ret)\n\n return ret;\n\n\n\n ret = flac_write_block_comment(s->pb, &s->metadata, 0,\n\n codec->flags & CODEC_FLAG_BITEXACT);\n\n if (ret)\n\n return ret;\n\n\n\n /* The command line flac encoder defaults to placing a seekpoint\n\n * every 10s. So one might add padding to allow that later\n\n * but there seems to be no simple way to get the duration here.\n\n * So let's try the flac default of 8192 bytes */\n\n flac_write_block_padding(s->pb, 8192, 1);\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "3dc6f8693694a649a9c83f1e2746565b47683923_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n trace_v9fs_flush(pdu->tag, pdu->id, tag);\n \n \n+\n+ if (pdu->tag == tag) {\n+\n+ error_report(\"Warning: the guest sent a self-referencing 9P flush request\");\n+\n } else {\n \n QLIST_FOREACH(cancel_pdu, &s->active_list, next) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void coroutine_fn v9fs_flush(void *opaque)\n\n{\n\n ssize_t err;\n\n int16_t tag;\n\n size_t offset = 7;\n\n V9fsPDU *cancel_pdu = NULL;\n\n V9fsPDU *pdu = opaque;\n\n V9fsState *s = pdu->s;\n\n\n\n err = pdu_unmarshal(pdu, offset, \"w\", &tag);\n\n if (err < 0) {\n\n pdu_complete(pdu, err);\n\n return;\n\n }\n\n trace_v9fs_flush(pdu->tag, pdu->id, tag);\n\n\n\n if (pdu->tag == tag) {\n\n error_report(\"Warning: the guest sent a self-referencing 9P flush request\");\n\n } else {\n\n QLIST_FOREACH(cancel_pdu, &s->active_list, next) {\n\n if (cancel_pdu->tag == tag) {\n\n break;\n\n }\n\n }\n\n }\n\n if (cancel_pdu) {\n\n cancel_pdu->cancelled = 1;\n\n /*\n\n * Wait for pdu to complete.\n\n */\n\n qemu_co_queue_wait(&cancel_pdu->complete, NULL);\n\n if (!qemu_co_queue_next(&cancel_pdu->complete)) {\n\n cancel_pdu->cancelled = 0;\n\n pdu_free(cancel_pdu);\n\n }\n\n }\n\n pdu_complete(pdu, 7);\n\n}\n"}} {"sample_id": "cc64b1a1940dc2e041c5b06b003d9acf64c22372", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static uint64_t kvmppc_read_int_cpu_dt(const char *propname)\n+\n {\n \n char buf[PATH_MAX];\n@@ -9,9 +9,9 @@\n uint32_t v32;\n \n uint64_t v64;\n+\n+ } u;\n+\n FILE *f;\n \n int len;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static uint64_t kvmppc_read_int_cpu_dt(const char *propname)\n\n{\n\n char buf[PATH_MAX];\n\n union {\n\n uint32_t v32;\n\n uint64_t v64;\n\n } u;\n\n FILE *f;\n\n int len;\n\n\n\n if (kvmppc_find_cpu_dt(buf, sizeof(buf))) {\n\n return -1;\n\n }\n\n\n\n strncat(buf, \"/\", sizeof(buf) - strlen(buf));\n\n strncat(buf, propname, sizeof(buf) - strlen(buf));\n\n\n\n f = fopen(buf, \"rb\");\n\n if (!f) {\n\n return -1;\n\n }\n\n\n\n len = fread(&u, 1, sizeof(u), f);\n\n fclose(f);\n\n switch (len) {\n\n case 4:\n\n /* property is a 32-bit quantity */\n\n return be32_to_cpu(u.v32);\n\n case 8:\n\n return be64_to_cpu(u.v64);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "c5c752af8cddad3e4e51acef40a46db998638144_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n if (value == 1 || value == 2) {\n \n qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);\n+\n+ } else if (value == 3) {\n+\n+ qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void hb_regs_write(void *opaque, hwaddr offset,\n\n uint64_t value, unsigned size)\n\n{\n\n uint32_t *regs = opaque;\n\n\n\n if (offset == 0xf00) {\n\n if (value == 1 || value == 2) {\n\n qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);\n\n } else if (value == 3) {\n\n qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);\n\n }\n\n }\n\n\n\n regs[offset/4] = value;\n\n}\n"}} {"sample_id": "9ea63c05d90ba85d819f9b2472ce6dfba7a403b4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n } else {\n \n return -EINVAL;\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int do_subchannel_work(SubchDev *sch)\n\n{\n\n if (sch->do_subchannel_work) {\n\n return sch->do_subchannel_work(sch);\n\n } else {\n\n return -EINVAL;\n\n }\n\n}\n"}} {"sample_id": "0919ac787641db11024912651f3bc5764d4f1286_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n \n \n s->new_agr[0] = ~0;\n+\n+ s->new_agr[1] = ~0;\n+\n+ s->sir_intr[0] = 0;\n+\n s->sir_intr[1] = 0;\n \n s->autoidle = 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void omap_inth_reset(struct omap_intr_handler_s *s)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < s->nbanks; ++i){\n\n s->bank[i].irqs = 0x00000000;\n\n s->bank[i].mask = 0xffffffff;\n\n s->bank[i].sens_edge = 0x00000000;\n\n s->bank[i].fiq = 0x00000000;\n\n s->bank[i].inputs = 0x00000000;\n\n s->bank[i].swi = 0x00000000;\n\n memset(s->bank[i].priority, 0, sizeof(s->bank[i].priority));\n\n\n\n if (s->level_only)\n\n s->bank[i].sens_edge = 0xffffffff;\n\n }\n\n\n\n s->new_agr[0] = ~0;\n\n s->new_agr[1] = ~0;\n\n s->sir_intr[0] = 0;\n\n s->sir_intr[1] = 0;\n\n s->autoidle = 0;\n\n s->mask = ~0;\n\n\n\n qemu_set_irq(s->parent_intr[0], 0);\n\n qemu_set_irq(s->parent_intr[1], 0);\n\n}\n"}} {"sample_id": "120b38b966b92a50dd36542190d35daba6730eb3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n+int ffio_rewind_with_probe_data(AVIOContext *s, unsigned char *buf, int buf_size)\n \n {\n \n+ int64_t buffer_start;\n \n+ int buffer_size;\n \n int overlap, new_size, alloc_size;\n \n+\n \n if (s->write_flag)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int ffio_rewind_with_probe_data(AVIOContext *s, unsigned char *buf, int buf_size)\n\n{\n\n int64_t buffer_start;\n\n int buffer_size;\n\n int overlap, new_size, alloc_size;\n\n\n\n if (s->write_flag)\n\n return AVERROR(EINVAL);\n\n\n\n buffer_size = s->buf_end - s->buffer;\n\n\n\n /* the buffers must touch or overlap */\n\n if ((buffer_start = s->pos - buffer_size) > buf_size)\n\n return AVERROR(EINVAL);\n\n\n\n overlap = buf_size - buffer_start;\n\n new_size = buf_size + buffer_size - overlap;\n\n\n\n alloc_size = FFMAX(s->buffer_size, new_size);\n\n if (alloc_size > buf_size)\n\n if (!(buf = av_realloc_f(buf, 1, alloc_size)))\n\n return AVERROR(ENOMEM);\n\n\n\n if (new_size > buf_size) {\n\n memcpy(buf + buf_size, s->buffer + overlap, buffer_size - overlap);\n\n buf_size = new_size;\n\n }\n\n\n\n av_free(s->buffer);\n\n s->buf_ptr = s->buffer = buf;\n\n s->buffer_size = alloc_size;\n\n s->pos = buf_size;\n\n s->buf_end = s->buf_ptr + buf_size;\n\n s->eof_reached = 0;\n\n s->must_flush = 0;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_42", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n ssi_sd_state *s = FROM_SSI_SLAVE(ssi_sd_state, d);\n \n DriveInfo *dinfo;\n+\n+\n+\n+ s->mode = SSI_SD_CMD;\n+\n dinfo = drive_get_next(IF_SD);\n \n s->sd = sd_init(dinfo ? blk_bs(blk_by_legacy_dinfo(dinfo)) : NULL, true);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ssi_sd_init(SSISlave *d)\n\n{\n\n DeviceState *dev = DEVICE(d);\n\n ssi_sd_state *s = FROM_SSI_SLAVE(ssi_sd_state, d);\n\n DriveInfo *dinfo;\n\n\n\n s->mode = SSI_SD_CMD;\n\n dinfo = drive_get_next(IF_SD);\n\n s->sd = sd_init(dinfo ? blk_bs(blk_by_legacy_dinfo(dinfo)) : NULL, true);\n\n if (s->sd == NULL) {\n\n return -1;\n\n }\n\n register_savevm(dev, \"ssi_sd\", -1, 1, ssi_sd_save, ssi_sd_load, s);\n\n return 0;\n\n}\n"}} {"sample_id": "6f3d2fb18bb6225c27e22a95846c42f2093dc3b7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n outlink->w, outlink->h);\n \n+ avfilter_copy_buffer_ref_props(outlink->out_buf, picref);\n+\n+ outlink->out_buf->video->w = outlink->w;\n+\n+ outlink->out_buf->video->h = outlink->h;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int start_frame(AVFilterLink *inlink, AVFilterBufferRef *picref)\n\n{\n\n AVFilterContext *ctx = inlink->dst;\n\n TileContext *tile = ctx->priv;\n\n AVFilterLink *outlink = ctx->outputs[0];\n\n\n\n if (tile->current)\n\n return 0;\n\n outlink->out_buf = ff_get_video_buffer(outlink, AV_PERM_WRITE,\n\n outlink->w, outlink->h);\n\n avfilter_copy_buffer_ref_props(outlink->out_buf, picref);\n\n outlink->out_buf->video->w = outlink->w;\n\n outlink->out_buf->video->h = outlink->h;\n\n\n\n /* fill surface once for margin/padding */\n\n if (tile->margin || tile->padding)\n\n ff_fill_rectangle(&tile->draw, &tile->blank,\n\n outlink->out_buf->data, outlink->out_buf->linesize,\n\n 0, 0, outlink->w, outlink->h);\n\n return 0;\n\n}\n"}} {"sample_id": "47d4be12c3997343e436c6cca89aefbbbeb70863_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int check_strtox_error(const char **next, char *endptr,\n \n int err)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int check_strtox_error(const char **next, char *endptr,\n\n int err)\n\n{\n\n if (!next && *endptr) {\n\n return -EINVAL;\n\n }\n\n if (next) {\n\n *next = endptr;\n\n }\n\n return -err;\n\n}\n"}} {"sample_id": "4d9ad7f793605abd9806fc932b3e04e028894565_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n uint64_t HELPER(neon_abdl_s64)(uint32_t a, uint32_t b)\n \n+{\n \n uint64_t result;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "uint64_t HELPER(neon_abdl_s64)(uint32_t a, uint32_t b)\n\n{\n\n uint64_t result;\n\n DO_ABD(result, a, b, int32_t);\n\n return result;\n\n}\n"}} {"sample_id": "aec4b054ea36c53c8b887da99f20010133b84378_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void unterminated_sq_string(void)\n+\n {\n \n QObject *obj = qobject_from_json(\"'abc\", NULL);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void unterminated_sq_string(void)\n\n{\n\n QObject *obj = qobject_from_json(\"'abc\", NULL);\n\n g_assert(obj == NULL);\n\n}\n"}} {"sample_id": "1ddcae82a2509668b94a13e84921bdcafddcdfff", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static int spapr_vga_init(PCIBus *pci_bus)\n+\n+{\n+\n+ switch (vga_interface_type) {\n \n case VGA_STD:\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int spapr_vga_init(PCIBus *pci_bus)\n\n{\n\n switch (vga_interface_type) {\n\n case VGA_STD:\n\n pci_std_vga_init(pci_bus);\n\n return 1;\n\n case VGA_NONE:\n\n return 0;\n\n default:\n\n fprintf(stderr, \"This vga model is not supported,\"\n\n \"currently it only supports -vga std\\n\");\n\n exit(0);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "feeee5aca765606818e00f5a19d19f141f4ae365_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n const char *name = qdict_get_str(qdict, \"name\");\n \n+\n \n bs = get_bs_snapshots();\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void do_delvm(Monitor *mon, const QDict *qdict)\n\n{\n\n DriveInfo *dinfo;\n\n BlockDriverState *bs, *bs1;\n\n int ret;\n\n const char *name = qdict_get_str(qdict, \"name\");\n\n\n\n bs = get_bs_snapshots();\n\n if (!bs) {\n\n monitor_printf(mon, \"No block device supports snapshots\\n\");\n\n return;\n\n }\n\n\n\n QTAILQ_FOREACH(dinfo, &drives, next) {\n\n bs1 = dinfo->bdrv;\n\n if (bdrv_has_snapshot(bs1)) {\n\n ret = bdrv_snapshot_delete(bs1, name);\n\n if (ret < 0) {\n\n if (ret == -ENOTSUP)\n\n monitor_printf(mon,\n\n \"Snapshots not supported on device '%s'\\n\",\n\n bdrv_get_device_name(bs1));\n\n else\n\n monitor_printf(mon, \"Error %d while deleting snapshot on \"\n\n \"'%s'\\n\", ret, bdrv_get_device_name(bs1));\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "d59ce6f34434bf47a9b26138c908650bf9a24be1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,18 +1,18 @@\n void rdma_start_outgoing_migration(void *opaque,\n \n+ const char *host_port, Error **errp)\n+\n {\n \n+ MigrationState *s = opaque;\n \n Error *local_err = NULL, **temp = &local_err;\n+\n RDMAContext *rdma = qemu_rdma_data_init(host_port, &local_err);\n \n int ret = 0;\n \n+\n \n if (rdma == NULL) {\n \n@@ -20,9 +20,9 @@\n \n goto err;\n \n+ }\n \n+\n \n ret = qemu_rdma_source_init(rdma, &local_err,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void rdma_start_outgoing_migration(void *opaque,\n\n const char *host_port, Error **errp)\n\n{\n\n MigrationState *s = opaque;\n\n Error *local_err = NULL, **temp = &local_err;\n\n RDMAContext *rdma = qemu_rdma_data_init(host_port, &local_err);\n\n int ret = 0;\n\n\n\n if (rdma == NULL) {\n\n ERROR(temp, \"Failed to initialize RDMA data structures! %d\", ret);\n\n goto err;\n\n }\n\n\n\n ret = qemu_rdma_source_init(rdma, &local_err,\n\n s->enabled_capabilities[MIGRATION_CAPABILITY_RDMA_PIN_ALL]);\n\n\n\n if (ret) {\n\n goto err;\n\n }\n\n\n\n trace_rdma_start_outgoing_migration_after_rdma_source_init();\n\n ret = qemu_rdma_connect(rdma, &local_err);\n\n\n\n if (ret) {\n\n goto err;\n\n }\n\n\n\n trace_rdma_start_outgoing_migration_after_rdma_connect();\n\n\n\n s->to_dst_file = qemu_fopen_rdma(rdma, \"wb\");\n\n migrate_fd_connect(s);\n\n return;\n\nerr:\n\n error_propagate(errp, local_err);\n\n g_free(rdma);\n\n migrate_fd_error(s);\n\n}\n"}} {"sample_id": "86e18cae209f8101ff9a6013a1ff6ae620c06944_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static inline int ohci_put_ed(OHCIState *ohci,\n+\n uint32_t addr, struct ohci_ed *ed)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline int ohci_put_ed(OHCIState *ohci,\n\n uint32_t addr, struct ohci_ed *ed)\n\n{\n\n return put_dwords(ohci, addr, (uint32_t *)ed, sizeof(*ed) >> 2);\n\n}\n"}} {"sample_id": "ca488ad480360dfafcb5766f7bfbb567a0638979_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,14 +15,14 @@\n bd.ra_block = ra_frame;\n \n bd.const_block = ctx->const_block;\n+\n bd.shift_lsbs = ctx->shift_lsbs;\n+\n bd.opt_order = ctx->opt_order;\n \n bd.store_prev_samples = ctx->store_prev_samples;\n \n+ bd.use_ltp = ctx->use_ltp;\n \n bd.ltp_lag = ctx->ltp_lag;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int decode_blocks_ind(ALSDecContext *ctx, unsigned int ra_frame,\n\n unsigned int c, const unsigned int *div_blocks,\n\n unsigned int *js_blocks)\n\n{\n\n unsigned int b;\n\n ALSBlockData bd = { 0 };\n\n\n\n bd.ra_block = ra_frame;\n\n bd.const_block = ctx->const_block;\n\n bd.shift_lsbs = ctx->shift_lsbs;\n\n bd.opt_order = ctx->opt_order;\n\n bd.store_prev_samples = ctx->store_prev_samples;\n\n bd.use_ltp = ctx->use_ltp;\n\n bd.ltp_lag = ctx->ltp_lag;\n\n bd.ltp_gain = ctx->ltp_gain[0];\n\n bd.quant_cof = ctx->quant_cof[0];\n\n bd.lpc_cof = ctx->lpc_cof[0];\n\n bd.prev_raw_samples = ctx->prev_raw_samples;\n\n bd.raw_samples = ctx->raw_samples[c];\n\n\n\n\n\n for (b = 0; b < ctx->num_blocks; b++) {\n\n bd.block_length = div_blocks[b];\n\n\n\n if (read_decode_block(ctx, &bd)) {\n\n // damaged block, write zero for the rest of the frame\n\n zero_remaining(b, ctx->num_blocks, div_blocks, bd.raw_samples);\n\n return -1;\n\n }\n\n bd.raw_samples += div_blocks[b];\n\n bd.ra_block = 0;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a457e7ee3daeb94b65a1a5a11258bd8b66673269", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n if (unlikely(ctx->mem_idx)) {\n+\n+ TCGv_i32 t0;\n+\n+ tcg_gen_qemu_ld32u(arg1, arg2, ctx->mem_idx);\n+\n t0 = tcg_temp_new_i32();\n \n tcg_gen_trunc_tl_i32(t0, arg1);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static always_inline void gen_qemu_ld32s(DisasContext *ctx, TCGv arg1, TCGv arg2)\n\n{\n\n if (unlikely(ctx->mem_idx)) {\n\n TCGv_i32 t0;\n\n tcg_gen_qemu_ld32u(arg1, arg2, ctx->mem_idx);\n\n t0 = tcg_temp_new_i32();\n\n tcg_gen_trunc_tl_i32(t0, arg1);\n\n tcg_gen_bswap_i32(t0, t0);\n\n tcg_gen_ext_i32_tl(arg1, t0);\n\n tcg_temp_free_i32(t0);\n\n } else\n\n tcg_gen_qemu_ld32s(arg1, arg2, ctx->mem_idx);\n\n}\n"}} {"sample_id": "e12ed72e5c00dd3375b8bd107200e4d7e950276a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n unsigned long *p = map + BIT_WORD(start);\n const long size = start + nr;\n int bits_to_set = BITS_PER_LONG - (start % BITS_PER_LONG);\n+ unsigned long mask_to_set = BITMAP_FIRST_WORD_MASK(start);\n+ /* First word */\n+ if (nr - bits_to_set > 0) {\n+ atomic_or(p, mask_to_set);\n+ nr -= bits_to_set;\n bits_to_set = BITS_PER_LONG;\n mask_to_set = ~0UL;\n p++;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void bitmap_set_atomic(unsigned long *map, long start, long nr)\n{\n unsigned long *p = map + BIT_WORD(start);\n const long size = start + nr;\n int bits_to_set = BITS_PER_LONG - (start % BITS_PER_LONG);\n unsigned long mask_to_set = BITMAP_FIRST_WORD_MASK(start);\n /* First word */\n if (nr - bits_to_set > 0) {\n atomic_or(p, mask_to_set);\n nr -= bits_to_set;\n bits_to_set = BITS_PER_LONG;\n mask_to_set = ~0UL;\n p++;\n }\n /* Full words */\n if (bits_to_set == BITS_PER_LONG) {\n while (nr >= BITS_PER_LONG) {\n *p = ~0UL;\n nr -= BITS_PER_LONG;\n p++;\n }\n }\n /* Last word */\n if (nr) {\n mask_to_set &= BITMAP_LAST_WORD_MASK(size);\n atomic_or(p, mask_to_set);\n } else {\n /* If we avoided the full barrier in atomic_or(), issue a\n * barrier to account for the assignments in the while loop.\n */\n smp_mb();\n }\n}"}} {"sample_id": "ce137829e7e58fcdc5ba63b5e256f972e80be438", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int remove_mapping(BDRVVVFATState* s, int mapping_index)\n \n {\n+\n mapping_t* mapping = array_get(&(s->mapping), mapping_index);\n \n mapping_t* first_mapping = array_get(&(s->mapping), 0);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int remove_mapping(BDRVVVFATState* s, int mapping_index)\n\n{\n\n mapping_t* mapping = array_get(&(s->mapping), mapping_index);\n\n mapping_t* first_mapping = array_get(&(s->mapping), 0);\n\n\n\n /* free mapping */\n\n if (mapping->first_mapping_index < 0)\n\n\tfree(mapping->path);\n\n\n\n /* remove from s->mapping */\n\n array_remove(&(s->mapping), mapping_index);\n\n\n\n /* adjust all references to mappings */\n\n adjust_mapping_indices(s, mapping_index, -1);\n\n\n\n if (s->current_mapping && first_mapping != (mapping_t*)s->mapping.pointer)\n\n\ts->current_mapping = array_get(&(s->mapping),\n\n\t\ts->current_mapping - first_mapping);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "039380a8e18f618cdacf72486449c04dc1b70eef", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n len = read(s->qmp_fd, &c, 1);\n if (len == -1 && errno == EINTR) {\n continue;\n+ switch (c) {\n+ case '{':\n+ nesting++;\n+ has_reply = true;\n+ break;\n case '}':\n nesting--;\n break;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void qtest_qmp(QTestState *s, const char *fmt, ...)\n{\n va_list ap;\n bool has_reply = false;\n int nesting = 0;\n /* Send QMP request */\n va_start(ap, fmt);\n socket_sendf(s->qmp_fd, fmt, ap);\n va_end(ap);\n /* Receive reply */\n while (!has_reply || nesting > 0) {\n ssize_t len;\n char c;\n len = read(s->qmp_fd, &c, 1);\n if (len == -1 && errno == EINTR) {\n continue;\n switch (c) {\n case '{':\n nesting++;\n has_reply = true;\n break;\n case '}':\n nesting--;\n break;"}} {"sample_id": "494a8ebe713055d3946183f4b395f85a18b43e9e_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n v9fs_string_free(&name);\n \n+ if (retval < 0) {\n+\n+ errno = -retval;\n+\n+ }\n \n return retval;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int proxy_remove(FsContext *ctx, const char *path)\n\n{\n\n int retval;\n\n V9fsString name;\n\n v9fs_string_init(&name);\n\n v9fs_string_sprintf(&name, \"%s\", path);\n\n retval = v9fs_request(ctx->private, T_REMOVE, NULL, \"s\", &name);\n\n v9fs_string_free(&name);\n\n if (retval < 0) {\n\n errno = -retval;\n\n }\n\n return retval;\n\n}\n"}} {"sample_id": "b6ee25e300420a3c98b78a1c2e983250ff065038", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n static inline struct rgbvec interp_trilinear(const LUT3DContext *lut3d,\n+\n+ const struct rgbvec *s)\n+\n+{\n+\n+ const struct rgbvec d = {s->r - PREV(s->r), s->g - PREV(s->g), s->b - PREV(s->b)};\n+\n+ const struct rgbvec c000 = lut3d->lut[PREV(s->r)][PREV(s->g)][PREV(s->b)];\n+\n const struct rgbvec c001 = lut3d->lut[PREV(s->r)][PREV(s->g)][NEXT(s->b)];\n \n const struct rgbvec c010 = lut3d->lut[PREV(s->r)][NEXT(s->g)][PREV(s->b)];", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline struct rgbvec interp_trilinear(const LUT3DContext *lut3d,\n\n const struct rgbvec *s)\n\n{\n\n const struct rgbvec d = {s->r - PREV(s->r), s->g - PREV(s->g), s->b - PREV(s->b)};\n\n const struct rgbvec c000 = lut3d->lut[PREV(s->r)][PREV(s->g)][PREV(s->b)];\n\n const struct rgbvec c001 = lut3d->lut[PREV(s->r)][PREV(s->g)][NEXT(s->b)];\n\n const struct rgbvec c010 = lut3d->lut[PREV(s->r)][NEXT(s->g)][PREV(s->b)];\n\n const struct rgbvec c011 = lut3d->lut[PREV(s->r)][NEXT(s->g)][NEXT(s->b)];\n\n const struct rgbvec c100 = lut3d->lut[NEXT(s->r)][PREV(s->g)][PREV(s->b)];\n\n const struct rgbvec c101 = lut3d->lut[NEXT(s->r)][PREV(s->g)][NEXT(s->b)];\n\n const struct rgbvec c110 = lut3d->lut[NEXT(s->r)][NEXT(s->g)][PREV(s->b)];\n\n const struct rgbvec c111 = lut3d->lut[NEXT(s->r)][NEXT(s->g)][NEXT(s->b)];\n\n const struct rgbvec c00 = lerp(&c000, &c100, d.r);\n\n const struct rgbvec c10 = lerp(&c010, &c110, d.r);\n\n const struct rgbvec c01 = lerp(&c001, &c101, d.r);\n\n const struct rgbvec c11 = lerp(&c011, &c111, d.r);\n\n const struct rgbvec c0 = lerp(&c00, &c10, d.g);\n\n const struct rgbvec c1 = lerp(&c01, &c11, d.g);\n\n const struct rgbvec c = lerp(&c0, &c1, d.b);\n\n return c;\n\n}\n"}} {"sample_id": "0abfc4b885566eb41c3a4e1de5e2e105bdc062d9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n { \"-32\", -32 },\n \n { \"-0\", 0, .skip = 1 },\n+\n+ { },\n+\n+ };\n+\n \n \n for (i = 0; test_cases[i].encoded; i++) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void simple_number(void)\n\n{\n\n int i;\n\n struct {\n\n const char *encoded;\n\n int64_t decoded;\n\n int skip;\n\n } test_cases[] = {\n\n { \"0\", 0 },\n\n { \"1234\", 1234 },\n\n { \"1\", 1 },\n\n { \"-32\", -32 },\n\n { \"-0\", 0, .skip = 1 },\n\n { },\n\n };\n\n\n\n for (i = 0; test_cases[i].encoded; i++) {\n\n QObject *obj;\n\n QInt *qint;\n\n\n\n obj = qobject_from_json(test_cases[i].encoded);\n\n g_assert(obj != NULL);\n\n g_assert(qobject_type(obj) == QTYPE_QINT);\n\n\n\n qint = qobject_to_qint(obj);\n\n g_assert(qint_get_int(qint) == test_cases[i].decoded);\n\n if (test_cases[i].skip == 0) {\n\n QString *str;\n\n\n\n str = qobject_to_json(obj);\n\n g_assert(strcmp(qstring_get_str(str), test_cases[i].encoded) == 0);\n\n QDECREF(str);\n\n }\n\n\n\n QDECREF(qint);\n\n }\n\n}\n"}} {"sample_id": "c89d416a2b0fb6a21224186b10af4c4a3feee31b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n struct NetRxPkt *pkt,\n \n+ const E1000E_RSSInfo *rss_info,\n \n uint16_t length)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "e1000e_write_lgcy_rx_descr(E1000ECore *core, uint8_t *desc,\n\n struct NetRxPkt *pkt,\n\n const E1000E_RSSInfo *rss_info,\n\n uint16_t length)\n\n{\n\n uint32_t status_flags, rss, mrq;\n\n uint16_t ip_id;\n\n\n\n struct e1000_rx_desc *d = (struct e1000_rx_desc *) desc;\n\n\n\n memset(d, 0, sizeof(*d));\n\n\n\n assert(!rss_info->enabled);\n\n\n\n d->length = cpu_to_le16(length);\n\n\n\n e1000e_build_rx_metadata(core, pkt, pkt != NULL,\n\n rss_info,\n\n &rss, &mrq,\n\n &status_flags, &ip_id,\n\n &d->special);\n\n d->errors = (uint8_t) (le32_to_cpu(status_flags) >> 24);\n\n d->status = (uint8_t) le32_to_cpu(status_flags);\n\n}\n"}} {"sample_id": "549e9bcabc2f5b37b0be8c24257e0b527bffb49a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n qemu_chr_fe_release(con->chr);\n \n+ }\n+\n+ xen_be_unbind_evtchn(&con->xendev);\n+\n+\n \n if (con->sring) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void con_disconnect(struct XenDevice *xendev)\n\n{\n\n struct XenConsole *con = container_of(xendev, struct XenConsole, xendev);\n\n\n\n if (!xendev->dev) {\n\n return;\n\n }\n\n if (con->chr) {\n\n qemu_chr_add_handlers(con->chr, NULL, NULL, NULL, NULL);\n\n qemu_chr_fe_release(con->chr);\n\n }\n\n xen_be_unbind_evtchn(&con->xendev);\n\n\n\n if (con->sring) {\n\n if (!xendev->gnttabdev) {\n\n munmap(con->sring, XC_PAGE_SIZE);\n\n } else {\n\n xc_gnttab_munmap(xendev->gnttabdev, con->sring, 1);\n\n }\n\n\tcon->sring = NULL;\n\n }\n\n}\n"}} {"sample_id": "0a90b6a43e76aec8031b6c8a46bba2bf6cd25fa7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -35,9 +35,9 @@\n pos += ts->raw_packet_size;\n \n }\n+\n+\n+\n+ return AV_NOPTS_VALUE;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int64_t mpegts_get_pcr(AVFormatContext *s, int stream_index,\n\n int64_t *ppos, int64_t pos_limit)\n\n{\n\n MpegTSContext *ts = s->priv_data;\n\n int64_t pos, timestamp;\n\n uint8_t buf[TS_PACKET_SIZE];\n\n int pcr_l, pcr_pid = ((PESContext*)s->streams[stream_index]->priv_data)->pcr_pid;\n\n pos = ((*ppos + ts->raw_packet_size - 1 - ts->pos47) / ts->raw_packet_size) * ts->raw_packet_size + ts->pos47;\n\n while(pos < pos_limit) {\n\n avio_seek(s->pb, pos, SEEK_SET);\n\n if (avio_read(s->pb, buf, TS_PACKET_SIZE) != TS_PACKET_SIZE)\n\n return AV_NOPTS_VALUE;\n\n if ((pcr_pid < 0 || (AV_RB16(buf + 1) & 0x1fff) == pcr_pid) &&\n\n parse_pcr(×tamp, &pcr_l, buf) == 0) {\n\n *ppos = pos;\n\n return timestamp;\n\n }\n\n pos += ts->raw_packet_size;\n\n }\n\n\n\n return AV_NOPTS_VALUE;\n\n}\n"}} {"sample_id": "3b39d734141a71296d08af3d4c32f872fafd782e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,9 +10,9 @@\n \n MemTxAttrs attrs = {};\n \n+ AddressSpace *as;\n \n+\n \n attrs.secure = is_secure;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,\n\n ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi)\n\n{\n\n ARMCPU *cpu = ARM_CPU(cs);\n\n CPUARMState *env = &cpu->env;\n\n MemTxAttrs attrs = {};\n\n AddressSpace *as;\n\n\n\n attrs.secure = is_secure;\n\n as = arm_addressspace(cs, attrs);\n\n addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi);\n\n if (fi->s1ptw) {\n\n return 0;\n\n }\n\n if (regime_translation_big_endian(env, mmu_idx)) {\n\n return address_space_ldq_be(as, addr, attrs, NULL);\n\n } else {\n\n return address_space_ldq_le(as, addr, attrs, NULL);\n\n }\n\n}\n"}} {"sample_id": "0b54f3c0878a3acaa9142e4f24942e762d97e350_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,23 +1,23 @@\n+static int gif_parse_next_image(GifState *s)\n+\n+{\n+\n+ ByteIOContext *f = s->f;\n+\n+ int ret, code;\n+\n+\n+\n+ for (;;) {\n+\n code = url_fgetc(f);\n+\n+#ifdef DEBUG\n+\n printf(\"gif: code=%02x '%c'\\n\", code, code);\n \n #endif\n+\n switch (code) {\n \n case ',':", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int gif_parse_next_image(GifState *s)\n\n{\n\n ByteIOContext *f = s->f;\n\n int ret, code;\n\n\n\n for (;;) {\n\n code = url_fgetc(f);\n\n#ifdef DEBUG\n\n printf(\"gif: code=%02x '%c'\\n\", code, code);\n\n#endif\n\n switch (code) {\n\n case ',':\n\n if (gif_read_image(s) < 0)\n\n return AVERROR(EIO);\n\n ret = 0;\n\n goto the_end;\n\n case ';':\n\n /* end of image */\n\n ret = AVERROR(EIO);\n\n goto the_end;\n\n case '!':\n\n if (gif_read_extension(s) < 0)\n\n return AVERROR(EIO);\n\n break;\n\n case EOF:\n\n default:\n\n /* error or errneous EOF */\n\n ret = AVERROR(EIO);\n\n goto the_end;\n\n }\n\n }\n\n the_end:\n\n return ret;\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_51", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n \n \n if (iocb->aiocb) {\n+\n+ bdrv_aio_cancel_async(iocb->aiocb);\n+\n+ iocb->aiocb = NULL;\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void trim_aio_cancel(BlockAIOCB *acb)\n\n{\n\n TrimAIOCB *iocb = container_of(acb, TrimAIOCB, common);\n\n\n\n /* Exit the loop so ide_issue_trim_cb will not continue */\n\n iocb->j = iocb->qiov->niov - 1;\n\n iocb->i = (iocb->qiov->iov[iocb->j].iov_len / 8) - 1;\n\n\n\n iocb->ret = -ECANCELED;\n\n\n\n if (iocb->aiocb) {\n\n bdrv_aio_cancel_async(iocb->aiocb);\n\n iocb->aiocb = NULL;\n\n }\n\n}\n"}} {"sample_id": "4d388c0cd05dd4de545e8ea333ab4de7d67ad12d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n+static int build_def_list(Picture *def, Picture **in, int len, int is_long, int sel)\n \n {\n+\n int i[2] = { 0 };\n \n+ int index = 0;\n \n \n \n+ while (i[0] < len || i[1] < len) {\n \n while (i[0] < len && !(in[i[0]] && (in[i[0]]->reference & sel)))\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int build_def_list(Picture *def, Picture **in, int len, int is_long, int sel)\n\n{\n\n int i[2] = { 0 };\n\n int index = 0;\n\n\n\n while (i[0] < len || i[1] < len) {\n\n while (i[0] < len && !(in[i[0]] && (in[i[0]]->reference & sel)))\n\n i[0]++;\n\n while (i[1] < len && !(in[i[1]] && (in[i[1]]->reference & (sel ^ 3))))\n\n i[1]++;\n\n if (i[0] < len) {\n\n in[i[0]]->pic_id = is_long ? i[0] : in[i[0]]->frame_num;\n\n split_field_copy(&def[index++], in[i[0]++], sel, 1);\n\n }\n\n if (i[1] < len) {\n\n in[i[1]]->pic_id = is_long ? i[1] : in[i[1]]->frame_num;\n\n split_field_copy(&def[index++], in[i[1]++], sel ^ 3, 0);\n\n }\n\n }\n\n\n\n return index;\n\n}\n"}} {"sample_id": "6652d0811c9463fbfb2d2d1cb2ec03f388145c5f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -38,11 +38,11 @@\n \n }\n \n+\n+\n+ return 0;\n+\n+\n \n undo:\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int virtio_pci_vector_unmask(PCIDevice *dev, unsigned vector,\n\n MSIMessage msg)\n\n{\n\n VirtIOPCIProxy *proxy = container_of(dev, VirtIOPCIProxy, pci_dev);\n\n VirtIODevice *vdev = virtio_bus_get_device(&proxy->bus);\n\n VirtQueue *vq = virtio_vector_first_queue(vdev, vector);\n\n int ret, index, unmasked = 0;\n\n\n\n while (vq) {\n\n index = virtio_get_queue_index(vq);\n\n if (!virtio_queue_get_num(vdev, index)) {\n\n break;\n\n }\n\n ret = virtio_pci_vq_vector_unmask(proxy, index, vector, msg);\n\n if (ret < 0) {\n\n goto undo;\n\n }\n\n vq = virtio_vector_next_queue(vq);\n\n ++unmasked;\n\n }\n\n\n\n return 0;\n\n\n\nundo:\n\n vq = virtio_vector_first_queue(vdev, vector);\n\n while (vq && --unmasked >= 0) {\n\n index = virtio_get_queue_index(vq);\n\n virtio_pci_vq_vector_mask(proxy, index, vector);\n\n vq = virtio_vector_next_queue(vq);\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_75", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n ssize_t i;\n \n+ off_t curr = 0;\n+\n+\n+\n+ if (pos > qsb->used) {\n \n return -1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static ssize_t qsb_get_iovec(const QEMUSizedBuffer *qsb,\n\n off_t pos, off_t *d_off)\n\n{\n\n ssize_t i;\n\n off_t curr = 0;\n\n\n\n if (pos > qsb->used) {\n\n return -1;\n\n }\n\n\n\n for (i = 0; i < qsb->n_iov; i++) {\n\n if (curr + qsb->iov[i].iov_len > pos) {\n\n *d_off = pos - curr;\n\n return i;\n\n }\n\n curr += qsb->iov[i].iov_len;\n\n }\n\n return -1;\n\n}\n"}} {"sample_id": "f53a829bb9ef14be800556cbc02d8b20fc1050a7_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n if (ret < 0) {\n \n logout(\"Failed to negotiate with the NBD server\\n\");\n+\n+ closesocket(sock);\n+\n+ return ret;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int nbd_client_session_init(NbdClientSession *client, BlockDriverState *bs,\n\n int sock, const char *export, Error **errp)\n\n{\n\n int ret;\n\n\n\n /* NBD handshake */\n\n logout(\"session init %s\\n\", export);\n\n qemu_set_block(sock);\n\n ret = nbd_receive_negotiate(sock, export,\n\n &client->nbdflags, &client->size,\n\n &client->blocksize, errp);\n\n if (ret < 0) {\n\n logout(\"Failed to negotiate with the NBD server\\n\");\n\n closesocket(sock);\n\n return ret;\n\n }\n\n\n\n qemu_co_mutex_init(&client->send_mutex);\n\n qemu_co_mutex_init(&client->free_sema);\n\n client->bs = bs;\n\n client->sock = sock;\n\n\n\n /* Now that we're connected, set the socket to be non-blocking and\n\n * kick the reply mechanism. */\n\n qemu_set_nonblock(sock);\n\n nbd_client_session_attach_aio_context(client, bdrv_get_aio_context(bs));\n\n\n\n logout(\"Established connection with NBD server\\n\");\n\n return 0;\n\n}\n"}} {"sample_id": "8bfc26ea302ec03585d7258a7cf8938f76512730", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ uint32_t tmp;\n+\n+ bool old_spsel = env->v7m.control & R_V7M_CONTROL_SPSEL_MASK;\n+\n+\n \n if (old_spsel != new_spsel) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void switch_v7m_sp(CPUARMState *env, bool new_spsel)\n\n{\n\n uint32_t tmp;\n\n bool old_spsel = env->v7m.control & R_V7M_CONTROL_SPSEL_MASK;\n\n\n\n if (old_spsel != new_spsel) {\n\n tmp = env->v7m.other_sp;\n\n env->v7m.other_sp = env->regs[13];\n\n env->regs[13] = tmp;\n\n\n\n env->v7m.control = deposit32(env->v7m.control,\n\n R_V7M_CONTROL_SPSEL_SHIFT,\n\n R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);\n\n }\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_83", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+IDEDevice *ide_create_drive(IDEBus *bus, int unit, DriveInfo *drive)\n+\n+{\n+\n+ DeviceState *dev;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "IDEDevice *ide_create_drive(IDEBus *bus, int unit, DriveInfo *drive)\n\n{\n\n DeviceState *dev;\n\n\n\n dev = qdev_create(&bus->qbus, drive->media_cd ? \"ide-cd\" : \"ide-hd\");\n\n qdev_prop_set_uint32(dev, \"unit\", unit);\n\n qdev_prop_set_drive_nofail(dev, \"drive\",\n\n blk_bs(blk_by_legacy_dinfo(drive)));\n\n qdev_init_nofail(dev);\n\n return DO_UPCAST(IDEDevice, qdev, dev);\n\n}\n"}} {"sample_id": "e612a1f7256bb3546cf3e9ae6cad3997c4153663", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n target_read_memory (bfd_vma memaddr,\n+\n+ bfd_byte *myaddr,\n+\n int length,\n \n struct disassemble_info *info)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "target_read_memory (bfd_vma memaddr,\n\n bfd_byte *myaddr,\n\n int length,\n\n struct disassemble_info *info)\n\n{\n\n int i;\n\n for(i = 0; i < length; i++) {\n\n myaddr[i] = ldub_code(memaddr + i);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "50c21814b9de5635cf01e2d1ea091a9a272a4d67", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,10 +9,10 @@\n dst->cbp_table = src->cbp_table;\n \n dst->mb2b_xy = src->mb2b_xy;\n+\n dst->mb2b8_xy = src->mb2b8_xy;\n \n+ dst->chroma_pred_mode_table = src->chroma_pred_mode_table;\n \n dst->mvd_table[0] = src->mvd_table[0];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void clone_tables(H264Context *dst, H264Context *src){\n\n dst->intra4x4_pred_mode = src->intra4x4_pred_mode;\n\n dst->non_zero_count = src->non_zero_count;\n\n dst->slice_table = src->slice_table;\n\n dst->cbp_table = src->cbp_table;\n\n dst->mb2b_xy = src->mb2b_xy;\n\n dst->mb2b8_xy = src->mb2b8_xy;\n\n dst->chroma_pred_mode_table = src->chroma_pred_mode_table;\n\n dst->mvd_table[0] = src->mvd_table[0];\n\n dst->mvd_table[1] = src->mvd_table[1];\n\n dst->direct_table = src->direct_table;\n\n\n\n if(!dst->dequant4_coeff[0])\n\n init_dequant_tables(dst);\n\n dst->s.obmc_scratchpad = NULL;\n\n ff_h264_pred_init(&dst->hpc, src->s.codec_id);\n\n dst->dequant_coeff_pps= -1;\n\n}\n"}} {"sample_id": "ca488ad480360dfafcb5766f7bfbb567a0638979_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ GetBitContext *gb = &ctx->gb;\n \n \n \n+ *bd->shift_lsbs = 0;\n \n // read block type flag and read the samples accordingly\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int read_block(ALSDecContext *ctx, ALSBlockData *bd)\n\n{\n\n GetBitContext *gb = &ctx->gb;\n\n\n\n *bd->shift_lsbs = 0;\n\n // read block type flag and read the samples accordingly\n\n if (get_bits1(gb)) {\n\n if (read_var_block_data(ctx, bd))\n\n return -1;\n\n } else {\n\n read_const_block_data(ctx, bd);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "db39fcf1f690b02d612e2bfc00980700887abe03_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n CharDriverState *chr;\n \n+\n+\n+ chr = g_malloc0(sizeof(CharDriverState));\n+\n chr->chr_write = null_chr_write;\n \n chr->explicit_be_open = true;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static CharDriverState *qemu_chr_open_null(void)\n\n{\n\n CharDriverState *chr;\n\n\n\n chr = g_malloc0(sizeof(CharDriverState));\n\n chr->chr_write = null_chr_write;\n\n chr->explicit_be_open = true;\n\n return chr;\n\n}\n"}} {"sample_id": "d1fdf257d52822695f5ace6c586e059aa17d4b79_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static ssize_t nbd_send_reply(QIOChannel *ioc, NBDReply *reply)\n \n+{\n+\n+ uint8_t buf[NBD_REPLY_SIZE];\n+\n+\n \n reply->error = system_errno_to_nbd_errno(reply->error);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ssize_t nbd_send_reply(QIOChannel *ioc, NBDReply *reply)\n\n{\n\n uint8_t buf[NBD_REPLY_SIZE];\n\n\n\n reply->error = system_errno_to_nbd_errno(reply->error);\n\n\n\n TRACE(\"Sending response to client: { .error = %\" PRId32\n\n \", handle = %\" PRIu64 \" }\",\n\n reply->error, reply->handle);\n\n\n\n /* Reply\n\n [ 0 .. 3] magic (NBD_REPLY_MAGIC)\n\n [ 4 .. 7] error (0 == no error)\n\n [ 7 .. 15] handle\n\n */\n\n stl_be_p(buf, NBD_REPLY_MAGIC);\n\n stl_be_p(buf + 4, reply->error);\n\n stq_be_p(buf + 8, reply->handle);\n\n\n\n return write_sync(ioc, buf, sizeof(buf), NULL);\n\n}\n"}} {"sample_id": "67e55caa6dcb91c80428cee6fe463f8dd8a755ab", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n OBJECT(cpu->apic_state), &error_abort);\n \n \n+\n+\n+ qdev_prop_set_uint8(cpu->apic_state, \"id\", cpu->apic_id);\n+\n+ /* TODO: convert to link<> */\n \n apic = APIC_COMMON(cpu->apic_state);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void x86_cpu_apic_create(X86CPU *cpu, Error **errp)\n\n{\n\n APICCommonState *apic;\n\n const char *apic_type = \"apic\";\n\n\n\n if (kvm_apic_in_kernel()) {\n\n apic_type = \"kvm-apic\";\n\n } else if (xen_enabled()) {\n\n apic_type = \"xen-apic\";\n\n }\n\n\n\n cpu->apic_state = DEVICE(object_new(apic_type));\n\n\n\n object_property_add_child(OBJECT(cpu), \"lapic\",\n\n OBJECT(cpu->apic_state), &error_abort);\n\n\n\n\n qdev_prop_set_uint8(cpu->apic_state, \"id\", cpu->apic_id);\n\n /* TODO: convert to link<> */\n\n apic = APIC_COMMON(cpu->apic_state);\n\n apic->cpu = cpu;\n\n apic->apicbase = APIC_DEFAULT_ADDRESS | MSR_IA32_APICBASE_ENABLE;\n\n}"}} {"sample_id": "72902672dc2ed6281cdb205259c1d52ecf01f6b2_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n+uint64_t HELPER(neon_add_saturate_u64)(uint64_t src1, uint64_t src2)\n+\n+{\n+\n+ uint64_t res;\n+\n \n+\n res = src1 + src2;\n \n if (res < src1) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "uint64_t HELPER(neon_add_saturate_u64)(uint64_t src1, uint64_t src2)\n\n{\n\n uint64_t res;\n\n\n\n res = src1 + src2;\n\n if (res < src1) {\n\n env->QF = 1;\n\n res = ~(uint64_t)0;\n\n }\n\n return res;\n\n}\n"}} {"sample_id": "dfd100f242370886bb6732f70f1f7cbd8eb9fedc_23", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n qdict_extract_subqdict(options, &server, \"server.\");\n \n+\n+\n+ crumpled_server = qdict_crumple(server, errp);\n+\n+ if (!crumpled_server) {\n \n goto done;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static SocketAddress *sd_server_config(QDict *options, Error **errp)\n\n{\n\n QDict *server = NULL;\n\n QObject *crumpled_server = NULL;\n\n Visitor *iv = NULL;\n\n SocketAddressFlat *saddr_flat = NULL;\n\n SocketAddress *saddr = NULL;\n\n Error *local_err = NULL;\n\n\n\n qdict_extract_subqdict(options, &server, \"server.\");\n\n\n\n crumpled_server = qdict_crumple(server, errp);\n\n if (!crumpled_server) {\n\n goto done;\n\n }\n\n\n\n /*\n\n * FIXME .numeric, .to, .ipv4 or .ipv6 don't work with -drive\n\n * server.type=inet. .to doesn't matter, it's ignored anyway.\n\n * That's because when @options come from -blockdev or\n\n * blockdev_add, members are typed according to the QAPI schema,\n\n * but when they come from -drive, they're all QString. The\n\n * visitor expects the former.\n\n */\n\n iv = qobject_input_visitor_new(crumpled_server);\n\n visit_type_SocketAddressFlat(iv, NULL, &saddr_flat, &local_err);\n\n if (local_err) {\n\n error_propagate(errp, local_err);\n\n goto done;\n\n }\n\n\n\n saddr = socket_address_crumple(saddr_flat);\n\n\n\ndone:\n\n qapi_free_SocketAddressFlat(saddr_flat);\n\n visit_free(iv);\n\n qobject_decref(crumpled_server);\n\n QDECREF(server);\n\n return saddr;\n\n}\n"}} {"sample_id": "fe3c546c5ff2a6210f9a4d8561cc64051ca8603e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,7 +23,7 @@\n \n \n if (sz > p->iov.size) {\n+\n sz = p->iov.size;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void usb_net_handle_dataout(USBNetState *s, USBPacket *p)\n\n{\n\n int sz = sizeof(s->out_buf) - s->out_ptr;\n\n struct rndis_packet_msg_type *msg =\n\n (struct rndis_packet_msg_type *) s->out_buf;\n\n uint32_t len;\n\n\n\n#ifdef TRAFFIC_DEBUG\n\n fprintf(stderr, \"usbnet: data out len %zu\\n\", p->iov.size);\n\n iov_hexdump(p->iov.iov, p->iov.niov, stderr, \"usbnet\", p->iov.size);\n\n#endif\n\n\n\n if (sz > p->iov.size) {\n\n sz = p->iov.size;\n\n }\n\n usb_packet_copy(p, &s->out_buf[s->out_ptr], sz);\n\n s->out_ptr += sz;\n\n\n\n if (!is_rndis(s)) {\n\n if (p->iov.size < 64) {\n\n qemu_send_packet(qemu_get_queue(s->nic), s->out_buf, s->out_ptr);\n\n s->out_ptr = 0;\n\n }\n\n return;\n\n }\n\n len = le32_to_cpu(msg->MessageLength);\n\n if (s->out_ptr < 8 || s->out_ptr < len) {\n\n return;\n\n }\n\n if (le32_to_cpu(msg->MessageType) == RNDIS_PACKET_MSG) {\n\n uint32_t offs = 8 + le32_to_cpu(msg->DataOffset);\n\n uint32_t size = le32_to_cpu(msg->DataLength);\n\n if (offs + size <= len)\n\n qemu_send_packet(qemu_get_queue(s->nic), s->out_buf + offs, size);\n\n }\n\n s->out_ptr -= len;\n\n memmove(s->out_buf, &s->out_buf[len], s->out_ptr);\n\n}\n"}} {"sample_id": "7e486f7577764a07aa35588e119903c80a5c30a2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,21 +3,21 @@\n {\n \n int num;\n+\n \n \n+ if (!s->config || !s->enable) {\n \n return 0;\n+\n }\n \n+\n \n /* Check range and alignment. */\n+\n if ((CMD(min) | CMD(max) | CMD(next_cmd) | CMD(stop)) & 3) {\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline int vmsvga_fifo_length(struct vmsvga_state_s *s)\n\n{\n\n int num;\n\n\n\n if (!s->config || !s->enable) {\n\n return 0;\n\n }\n\n\n\n /* Check range and alignment. */\n\n if ((CMD(min) | CMD(max) | CMD(next_cmd) | CMD(stop)) & 3) {\n\n return 0;\n\n }\n\n if (CMD(min) < (uint8_t *) s->cmd->fifo - (uint8_t *) s->fifo) {\n\n return 0;\n\n }\n\n if (CMD(max) > SVGA_FIFO_SIZE ||\n\n CMD(min) >= SVGA_FIFO_SIZE ||\n\n CMD(stop) >= SVGA_FIFO_SIZE ||\n\n CMD(next_cmd) >= SVGA_FIFO_SIZE) {\n\n return 0;\n\n }\n\n if (CMD(max) < CMD(min) + 10 * 1024) {\n\n return 0;\n\n }\n\n\n\n num = CMD(next_cmd) - CMD(stop);\n\n if (num < 0) {\n\n num += CMD(max) - CMD(min);\n\n }\n\n return num >> 2;\n\n}\n"}} {"sample_id": "3a661f1eabf7e8db66e28489884d9b54aacb94ea", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,5 +4,5 @@\n size_t len,\n Error **errp)\n {\n+ QCryptoCipherBuiltin *ctxt = cipher->opaque;\n+ return ctxt->decrypt(cipher, in, out, len, errp);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int qcrypto_cipher_decrypt(QCryptoCipher *cipher,\n const void *in,\n void *out,\n size_t len,\n Error **errp)\n{\n QCryptoCipherBuiltin *ctxt = cipher->opaque;\n return ctxt->decrypt(cipher, in, out, len, errp);"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n BdrvRequestFlags flags)\n \n {\n+\n+ if (nb_sectors < 0 || nb_sectors > BDRV_REQUEST_MAX_SECTORS) {\n+\n+ return -EINVAL;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int coroutine_fn bdrv_co_do_writev(BlockDriverState *bs,\n\n int64_t sector_num, int nb_sectors, QEMUIOVector *qiov,\n\n BdrvRequestFlags flags)\n\n{\n\n if (nb_sectors < 0 || nb_sectors > BDRV_REQUEST_MAX_SECTORS) {\n\n return -EINVAL;\n\n }\n\n\n\n return bdrv_co_do_pwritev(bs, sector_num << BDRV_SECTOR_BITS,\n\n nb_sectors << BDRV_SECTOR_BITS, qiov, flags);\n\n}\n"}} {"sample_id": "4accd107d0fd4a6fd7d2ad4f3365c67623834262", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n PCI_CLASS_NETWORK_ETHERNET) {\n \n qdev_unplug(&(d->qdev), NULL);\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void unplug_nic(PCIBus *b, PCIDevice *d)\n\n{\n\n if (pci_get_word(d->config + PCI_CLASS_DEVICE) ==\n\n PCI_CLASS_NETWORK_ETHERNET) {\n\n qdev_unplug(&(d->qdev), NULL);\n\n }\n\n}\n"}} {"sample_id": "f1e173049ecc9de03817385ba8962d14cba779db_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n int y0, x, y, mask = 1 << (bpno + NMSEDEC_FRACBITS);\n+\n+ for (y0 = 0; y0 < height; y0 += 4)\n+\n+ for (x = 0; x < width; x++)\n+\n for (y = y0; y < height && y < y0+4; y++)\n \n if ((t1->flags[y+1][x+1] & (JPEG2000_T1_SIG | JPEG2000_T1_VIS)) == JPEG2000_T1_SIG){", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void encode_refpass(Jpeg2000T1Context *t1, int width, int height, int *nmsedec, int bpno)\n\n{\n\n int y0, x, y, mask = 1 << (bpno + NMSEDEC_FRACBITS);\n\n for (y0 = 0; y0 < height; y0 += 4)\n\n for (x = 0; x < width; x++)\n\n for (y = y0; y < height && y < y0+4; y++)\n\n if ((t1->flags[y+1][x+1] & (JPEG2000_T1_SIG | JPEG2000_T1_VIS)) == JPEG2000_T1_SIG){\n\n int ctxno = ff_jpeg2000_getrefctxno(t1->flags[y+1][x+1]);\n\n *nmsedec += getnmsedec_ref(t1->data[y][x], bpno + NMSEDEC_FRACBITS);\n\n ff_mqc_encode(&t1->mqc, t1->mqc.cx_states + ctxno, t1->data[y][x] & mask ? 1:0);\n\n t1->flags[y+1][x+1] |= JPEG2000_T1_REF;\n\n }\n\n}\n"}} {"sample_id": "e6ffd997cbc06426e75d3fa291b991866c84a79b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,8 +10,8 @@\n \n } else if (level < 8)\n \n+ value = get_bits(gb, level + 1);\n+\n+ return value;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline int get_scale(GetBitContext *gb, int level, int value)\n\n{\n\n if (level < 5) {\n\n /* huffman encoded */\n\n value += get_bitalloc(gb, &dca_scalefactor, level);\n\n } else if (level < 8)\n\n value = get_bits(gb, level + 1);\n\n return value;\n\n}\n"}} {"sample_id": "a00676e48e49a3d794d6d2063ceca539e945a4a4_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,7 +23,7 @@\n if (get_bits1(gb)) {\n \n v = get_bits(gb, 4);\n+\n if (v) {\n \n sign = -get_bits1(gb);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int read_motion_values(AVCodecContext *avctx, GetBitContext *gb, Bundle *b)\n\n{\n\n int t, sign, v;\n\n const uint8_t *dec_end;\n\n\n\n CHECK_READ_VAL(gb, b, t);\n\n dec_end = b->cur_dec + t;\n\n if (dec_end > b->data_end) {\n\n av_log(avctx, AV_LOG_ERROR, \"Too many motion values\\n\");\n\n return -1;\n\n }\n\n if (get_bits1(gb)) {\n\n v = get_bits(gb, 4);\n\n if (v) {\n\n sign = -get_bits1(gb);\n\n v = (v ^ sign) - sign;\n\n }\n\n memset(b->cur_dec, v, t);\n\n b->cur_dec += t;\n\n } else {\n\n do {\n\n v = GET_HUFF(gb, b->tree);\n\n if (v) {\n\n sign = -get_bits1(gb);\n\n v = (v ^ sign) - sign;\n\n }\n\n *b->cur_dec++ = v;\n\n } while (b->cur_dec < dec_end);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "eca1bdf415c454093dfc7eb983cd49287c043967_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n env->CP0_EBase = 0x80000000;\n env->CP0_Status = (1 << CP0St_BEV) | (1 << CP0St_ERL);\n /* vectored interrupts not implemented, timer on int 7,\n+ no performance counters. */\n+ env->CP0_IntCtl = 0xe0000000;\n+ {\n+ int i;\n+ for (i = 0; i < 7; i++) {\n env->CP0_WatchLo[i] = 0;\n env->CP0_WatchHi[i] = 0x80000000;\n env->CP0_WatchLo[7] = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void cpu_reset (CPUMIPSState *env)\n{\n memset(env, 0, offsetof(CPUMIPSState, breakpoints));\n tlb_flush(env, 1);\n /* Minimal init */\n#if defined(CONFIG_USER_ONLY)\n env->hflags = MIPS_HFLAG_UM;\n#else\n if (env->hflags & MIPS_HFLAG_BMASK) {\n /* If the exception was raised from a delay slot,\n come back to the jump. */\n env->CP0_ErrorEPC = env->active_tc.PC - 4;\n } else {\n env->CP0_ErrorEPC = env->active_tc.PC;\n env->active_tc.PC = (int32_t)0xBFC00000;\n env->CP0_Wired = 0;\n /* SMP not implemented */\n env->CP0_EBase = 0x80000000;\n env->CP0_Status = (1 << CP0St_BEV) | (1 << CP0St_ERL);\n /* vectored interrupts not implemented, timer on int 7,\n no performance counters. */\n env->CP0_IntCtl = 0xe0000000;\n {\n int i;\n for (i = 0; i < 7; i++) {\n env->CP0_WatchLo[i] = 0;\n env->CP0_WatchHi[i] = 0x80000000;\n env->CP0_WatchLo[7] = 0;\n env->CP0_WatchHi[7] = 0;\n /* Count register increments in debug mode, EJTAG version 1 */\n env->CP0_Debug = (1 << CP0DB_CNT) | (0x1 << CP0DB_VER);\n env->hflags = MIPS_HFLAG_CP0;\n#endif\n env->exception_index = EXCP_NONE;\n cpu_mips_register(env, env->cpu_model);"}} {"sample_id": "b69b43e2c471c4febbffaf313875396256b6a51e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void check_decode_result(int *got_output, int ret)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void check_decode_result(int *got_output, int ret)\n\n{\n\n if (*got_output || ret<0)\n\n decode_error_stat[ret<0] ++;\n\n\n\n if (ret < 0 && exit_on_error)\n\n exit_program(1);\n\n}\n"}} {"sample_id": "6e0d8677cb443e7408c0b7a25a93c6596d7fa380_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n gen_op_addq_ESI_T0();\n \n } else\n+\n+#endif\n+\n+ if (s->aflag) {\n+\n gen_op_addl_ESI_T0();\n \n } else {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_lods(DisasContext *s, int ot)\n\n{\n\n gen_string_movl_A0_ESI(s);\n\n gen_op_ld_T0_A0(ot + s->mem_index);\n\n gen_op_mov_reg_T0(ot, R_EAX);\n\n gen_op_movl_T0_Dshift[ot]();\n\n#ifdef TARGET_X86_64\n\n if (s->aflag == 2) {\n\n gen_op_addq_ESI_T0();\n\n } else\n\n#endif\n\n if (s->aflag) {\n\n gen_op_addl_ESI_T0();\n\n } else {\n\n gen_op_addw_ESI_T0();\n\n }\n\n}\n"}} {"sample_id": "619d7ae952bb61ec27ec21fe4a383a8d4dd4cd70", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,7 +12,7 @@\n \n \n \n+ sz = sizeof(VirtIOSCSI) + proxyconf->num_queues * sizeof(VirtQueue *);\n \n s = (VirtIOSCSI *)virtio_common_init(\"virtio-scsi\", VIRTIO_ID_SCSI,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "VirtIODevice *virtio_scsi_init(DeviceState *dev, VirtIOSCSIConf *proxyconf)\n\n{\n\n VirtIOSCSI *s;\n\n static int virtio_scsi_id;\n\n size_t sz;\n\n int i;\n\n\n\n sz = sizeof(VirtIOSCSI) + proxyconf->num_queues * sizeof(VirtQueue *);\n\n s = (VirtIOSCSI *)virtio_common_init(\"virtio-scsi\", VIRTIO_ID_SCSI,\n\n sizeof(VirtIOSCSIConfig), sz);\n\n\n\n s->qdev = dev;\n\n s->conf = proxyconf;\n\n\n\n /* TODO set up vdev function pointers */\n\n s->vdev.get_config = virtio_scsi_get_config;\n\n s->vdev.set_config = virtio_scsi_set_config;\n\n s->vdev.get_features = virtio_scsi_get_features;\n\n s->vdev.reset = virtio_scsi_reset;\n\n\n\n s->ctrl_vq = virtio_add_queue(&s->vdev, VIRTIO_SCSI_VQ_SIZE,\n\n virtio_scsi_handle_ctrl);\n\n s->event_vq = virtio_add_queue(&s->vdev, VIRTIO_SCSI_VQ_SIZE,\n\n NULL);\n\n for (i = 0; i < s->conf->num_queues; i++) {\n\n s->cmd_vqs[i] = virtio_add_queue(&s->vdev, VIRTIO_SCSI_VQ_SIZE,\n\n virtio_scsi_handle_cmd);\n\n }\n\n\n\n scsi_bus_new(&s->bus, dev, &virtio_scsi_scsi_info);\n\n if (!dev->hotplugged) {\n\n scsi_bus_legacy_handle_cmdline(&s->bus);\n\n }\n\n\n\n register_savevm(dev, \"virtio-scsi\", virtio_scsi_id++, 1,\n\n virtio_scsi_save, virtio_scsi_load, s);\n\n\n\n return &s->vdev;\n\n}\n"}} {"sample_id": "da9b170c6f06184a5114dc66afb8385cd0ffff83", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n /* Why 16?\n \n because some cpus need alignment, for example SSE2 on P4, & most RISC cpus\n+\n+ it will just trigger an exception and the unaligned load will be done in the\n+\n+ exception handler or it will just segfault (SSE2 on P4)\n+\n Why not larger? because i didnt see a difference in benchmarks ...\n \n */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void *av_malloc(unsigned int size)\n\n{\n\n void *ptr;\n\n \n\n#if defined (HAVE_MEMALIGN)\n\n ptr = memalign(16,size);\n\n /* Why 64? \n\n Indeed, we should align it:\n\n on 4 for 386\n\n on 16 for 486\n\n\t on 32 for 586, PPro - k6-III\n\n\t on 64 for K7 (maybe for P3 too).\n\n Because L1 and L2 caches are aligned on those values.\n\n But I don't want to code such logic here!\n\n */\n\n /* Why 16?\n\n because some cpus need alignment, for example SSE2 on P4, & most RISC cpus\n\n it will just trigger an exception and the unaligned load will be done in the\n\n exception handler or it will just segfault (SSE2 on P4)\n\n Why not larger? because i didnt see a difference in benchmarks ...\n\n */\n\n /* benchmarks with p3\n\n memalign(64)+1\t\t3071,3051,3032\n\n memalign(64)+2\t\t3051,3032,3041\n\n memalign(64)+4\t\t2911,2896,2915\n\n memalign(64)+8\t\t2545,2554,2550\n\n memalign(64)+16\t\t2543,2572,2563\n\n memalign(64)+32\t\t2546,2545,2571\n\n memalign(64)+64\t\t2570,2533,2558\n\n \n\n btw, malloc seems to do 8 byte alignment by default here\n\n */\n\n#else\n\n ptr = malloc(size);\n\n#endif\n\n return ptr;\n\n}\n"}} {"sample_id": "8e46bbf362458fc3e4638a53249248a1ee40b912", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n MemoryRegion *mr = memory_region_find(parent, addr, 1).mr;\n+\n+ if (!mr) {\n+\n+ return false;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool memory_region_present(MemoryRegion *parent, hwaddr addr)\n\n{\n\n MemoryRegion *mr = memory_region_find(parent, addr, 1).mr;\n\n if (!mr) {\n\n return false;\n\n }\n\n memory_region_unref(mr);\n\n return true;\n\n}\n"}} {"sample_id": "111049a4ecefc9cf1ac75c773f4c5c165f27fe63_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void qmp_blockdev_backup(BlockdevBackup *arg, Error **errp)\n+\n {\n \n do_blockdev_backup(arg, NULL, errp);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void qmp_blockdev_backup(BlockdevBackup *arg, Error **errp)\n\n{\n\n do_blockdev_backup(arg, NULL, errp);\n\n}\n"}} {"sample_id": "104981d52b63dc3d68f39d4442881c667f44bbb9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n uint8_t ep)\n \n+{\n+\n+ AsyncURB *aurb = async_alloc(dev, p);\n+\n+ struct usb_redir_bulk_packet_header bulk_packet;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int usbredir_handle_bulk_data(USBRedirDevice *dev, USBPacket *p,\n\n uint8_t ep)\n\n{\n\n AsyncURB *aurb = async_alloc(dev, p);\n\n struct usb_redir_bulk_packet_header bulk_packet;\n\n\n\n DPRINTF(\"bulk-out ep %02X len %zd id %u\\n\", ep,\n\n p->iov.size, aurb->packet_id);\n\n\n\n bulk_packet.endpoint = ep;\n\n bulk_packet.length = p->iov.size;\n\n bulk_packet.stream_id = 0;\n\n aurb->bulk_packet = bulk_packet;\n\n\n\n if (ep & USB_DIR_IN) {\n\n usbredirparser_send_bulk_packet(dev->parser, aurb->packet_id,\n\n &bulk_packet, NULL, 0);\n\n } else {\n\n uint8_t buf[p->iov.size];\n\n usb_packet_copy(p, buf, p->iov.size);\n\n usbredir_log_data(dev, \"bulk data out:\", buf, p->iov.size);\n\n usbredirparser_send_bulk_packet(dev->parser, aurb->packet_id,\n\n &bulk_packet, buf, p->iov.size);\n\n }\n\n usbredirparser_do_write(dev->parser);\n\n return USB_RET_ASYNC;\n\n}\n"}} {"sample_id": "6e0d8677cb443e7408c0b7a25a93c6596d7fa380_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,10 +16,10 @@\n \n gen_op_addl_ESP_im(addend);\n \n+ } else {\n+\n+ gen_op_addw_ESP_im(addend);\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_stack_update(DisasContext *s, int addend)\n\n{\n\n#ifdef TARGET_X86_64\n\n if (CODE64(s)) {\n\n gen_op_addq_ESP_im(addend);\n\n } else\n\n#endif\n\n if (s->ss32) {\n\n gen_op_addl_ESP_im(addend);\n\n } else {\n\n gen_op_addw_ESP_im(addend);\n\n }\n\n}\n"}} {"sample_id": "4295e15aa730a95003a3639d6dad2eb1e65a59e2_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static QList *channel_list_get(void)\n \n+{\n \n return NULL;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static QList *channel_list_get(void)\n\n{\n\n return NULL;\n\n}\n"}} {"sample_id": "e0c6cce44729d94e2a5507a4b6d031f23e8bd7b6_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n av_cold void ff_vp3dsp_init_x86(VP3DSPContext *c, int flags)\n+\n+{\n+\n+#if HAVE_YASM\n+\n int cpuflags = av_get_cpu_flags();\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "av_cold void ff_vp3dsp_init_x86(VP3DSPContext *c, int flags)\n\n{\n\n#if HAVE_YASM\n\n int cpuflags = av_get_cpu_flags();\n\n\n\n#if ARCH_X86_32\n\n if (HAVE_MMX && cpuflags & AV_CPU_FLAG_MMX) {\n\n c->idct_put = ff_vp3_idct_put_mmx;\n\n c->idct_add = ff_vp3_idct_add_mmx;\n\n c->idct_perm = FF_PARTTRANS_IDCT_PERM;\n\n }\n\n#endif\n\n\n\n if (HAVE_MMXEXT && cpuflags & AV_CPU_FLAG_MMXEXT) {\n\n c->idct_dc_add = ff_vp3_idct_dc_add_mmx2;\n\n\n\n if (!(flags & CODEC_FLAG_BITEXACT)) {\n\n c->v_loop_filter = ff_vp3_v_loop_filter_mmx2;\n\n c->h_loop_filter = ff_vp3_h_loop_filter_mmx2;\n\n }\n\n }\n\n\n\n if (cpuflags & AV_CPU_FLAG_SSE2) {\n\n c->idct_put = ff_vp3_idct_put_sse2;\n\n c->idct_add = ff_vp3_idct_add_sse2;\n\n c->idct_perm = FF_TRANSPOSE_IDCT_PERM;\n\n }\n\n#endif\n\n}\n"}} {"sample_id": "b46b233baffc2076a1a17a264ba9553ae0d4878f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n {\n \n+ FilmstripDemuxContext *film = s->priv_data;\n \n AVStream *st = s->streams[0];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int read_packet(AVFormatContext *s,\n\n AVPacket *pkt)\n\n{\n\n FilmstripDemuxContext *film = s->priv_data;\n\n AVStream *st = s->streams[0];\n\n\n\n if (s->pb->eof_reached)\n\n return AVERROR(EIO);\n\n pkt->dts = avio_tell(s->pb) / (st->codec->width * (st->codec->height + film->leading) * 4);\n\n pkt->size = av_get_packet(s->pb, pkt, st->codec->width * st->codec->height * 4);\n\n avio_skip(s->pb, st->codec->width * film->leading * 4);\n\n if (pkt->size < 0)\n\n return pkt->size;\n\n pkt->flags |= AV_PKT_FLAG_KEY;\n\n return 0;\n\n}\n"}} {"sample_id": "297a3646c2947ee64a6d42ca264039732c6218e0_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void visit_start_list(Visitor *v, const char *name, Error **errp)\n+\n+{\n \n if (!error_is_set(errp)) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void visit_start_list(Visitor *v, const char *name, Error **errp)\n\n{\n\n if (!error_is_set(errp)) {\n\n v->start_list(v, name, errp);\n\n }\n\n}\n"}} {"sample_id": "7f549b8338ed3775fec4bf10421ff5744e5866dd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void parse_waveformatex(AVIOContext *pb, AVCodecParameters *par)\n \n+{\n \n ff_asf_guid subformat;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void parse_waveformatex(AVIOContext *pb, AVCodecParameters *par)\n\n{\n\n ff_asf_guid subformat;\n\n par->bits_per_coded_sample = avio_rl16(pb);\n\n par->channel_layout = avio_rl32(pb); /* dwChannelMask */\n\n\n\n ff_get_guid(pb, &subformat);\n\n if (!memcmp(subformat + 4,\n\n (const uint8_t[]){ FF_MEDIASUBTYPE_BASE_GUID }, 12)) {\n\n par->codec_tag = AV_RL32(subformat);\n\n par->codec_id = ff_wav_codec_get_id(par->codec_tag,\n\n par->bits_per_coded_sample);\n\n } else {\n\n par->codec_id = ff_codec_guid_get_id(ff_codec_wav_guids, subformat);\n\n if (!par->codec_id)\n\n av_log(pb, AV_LOG_WARNING,\n\n \"unknown subformat:\"FF_PRI_GUID\"\\n\",\n\n FF_ARG_GUID(subformat));\n\n }\n\n}\n"}} {"sample_id": "ac3107340fbb9422ea63ee5d6729775965e121fd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void qemu_chr_be_write(CharDriverState *s, uint8_t *buf, int len)\n+\n {\n \n s->chr_read(s->handler_opaque, buf, len);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void qemu_chr_be_write(CharDriverState *s, uint8_t *buf, int len)\n\n{\n\n s->chr_read(s->handler_opaque, buf, len);\n\n}\n"}} {"sample_id": "138902dfb60fbb87fb65a8c4800f8ac661394b72", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int read_dialogue(ASSContext *ass, AVBPrint *dst, const uint8_t *p,\n+\n int64_t *start, int *duration)\n \n {\n+\n int pos;\n \n int64_t end;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int read_dialogue(ASSContext *ass, AVBPrint *dst, const uint8_t *p,\n\n int64_t *start, int *duration)\n\n{\n\n int pos;\n\n int64_t end;\n\n int hh1, mm1, ss1, ms1;\n\n int hh2, mm2, ss2, ms2;\n\n\n\n if (sscanf(p, \"Dialogue: %*[^,],%d:%d:%d%*c%d,%d:%d:%d%*c%d,%n\",\n\n &hh1, &mm1, &ss1, &ms1,\n\n &hh2, &mm2, &ss2, &ms2, &pos) >= 8) {\n\n\n\n /* This is not part of the sscanf itself in order to handle an actual\n\n * number (which would be the Layer) or the form \"Marked=N\" (which is\n\n * the old SSA field, now replaced by Layer, and will be lead to Layer\n\n * being 0 here). */\n\n const int layer = atoi(p + 10);\n\n\n\n end = (hh2*3600LL + mm2*60LL + ss2) * 100LL + ms2;\n\n *start = (hh1*3600LL + mm1*60LL + ss1) * 100LL + ms1;\n\n *duration = end - *start;\n\n\n\n av_bprint_clear(dst);\n\n av_bprintf(dst, \"%u,%d,%s\", ass->readorder++, layer, p + pos);\n\n\n\n /* right strip the buffer */\n\n while (dst->len > 0 &&\n\n dst->str[dst->len - 1] == '\\r' ||\n\n dst->str[dst->len - 1] == '\\n')\n\n dst->str[--dst->len] = 0;\n\n return 0;\n\n }\n\n return -1;\n\n}\n"}} {"sample_id": "24df3371d97a7516605aef8abbc253a8c162b211", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int handle_utimensat(FsContext *ctx, V9fsPath *fs_path,\n \n+ const struct timespec *buf)\n \n {\n \n@@ -8,9 +8,9 @@\n \n #ifdef CONFIG_UTIMENSAT\n \n+ int fd;\n+\n+ struct handle_data *data = (struct handle_data *)ctx->private;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int handle_utimensat(FsContext *ctx, V9fsPath *fs_path,\n\n const struct timespec *buf)\n\n{\n\n int ret;\n\n#ifdef CONFIG_UTIMENSAT\n\n int fd;\n\n struct handle_data *data = (struct handle_data *)ctx->private;\n\n\n\n fd = open_by_handle(data->mountfd, fs_path->data, O_NONBLOCK);\n\n if (fd < 0) {\n\n return fd;\n\n }\n\n ret = futimens(fd, buf);\n\n close(fd);\n\n#else\n\n ret = -1;\n\n errno = ENOSYS;\n\n#endif\n\n return ret;\n\n}\n"}} {"sample_id": "100a54da5264436202daeedd68ed5e4a8be41459", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n dst += i;\n l->zeros_rem = lag_calc_zero_run(src[i]);\n src += i + 1;\n+ goto output_zeros;\n+ } else {\n+ memcpy(dst, src, i);\n+ src += i;\n+ dst += i;\n }\n }\n return src - src_start;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int lag_decode_zero_run_line(LagarithContext *l, uint8_t *dst,\n const uint8_t *src, const uint8_t *src_end,\n int width, int esc_count)\n{\n int i = 0;\n int count;\n uint8_t zero_run = 0;\n const uint8_t *src_start = src;\n uint8_t mask1 = -(esc_count < 2);\n uint8_t mask2 = -(esc_count < 3);\n uint8_t *end = dst + (width - 2);\noutput_zeros:\n if (l->zeros_rem) {\n count = FFMIN(l->zeros_rem, width - i);\n if (end - dst < count) {\n av_log(l->avctx, AV_LOG_ERROR, \"Too many zeros remaining.\\n\");\n return AVERROR_INVALIDDATA;\n }\n memset(dst, 0, count);\n l->zeros_rem -= count;\n dst += count;\n }\n while (dst < end) {\n i = 0;\n while (!zero_run && dst + i < end) {\n i++;\n if (i+2 >= src_end - src)\n return AVERROR_INVALIDDATA;\n zero_run =\n !(src[i] | (src[i + 1] & mask1) | (src[i + 2] & mask2));\n }\n if (zero_run) {\n zero_run = 0;\n i += esc_count;\n memcpy(dst, src, i);\n dst += i;\n l->zeros_rem = lag_calc_zero_run(src[i]);\n src += i + 1;\n goto output_zeros;\n } else {\n memcpy(dst, src, i);\n src += i;\n dst += i;\n }\n }\n return src - src_start;\n}"}} {"sample_id": "712b4243c761cb6ab6a4367a160fd2a42e2d4b76", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void gen_pusha(DisasContext *s)\n \n {\n+\n int i;\n \n gen_op_movl_A0_reg(R_ESP);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void gen_pusha(DisasContext *s)\n\n{\n\n int i;\n\n gen_op_movl_A0_reg(R_ESP);\n\n gen_op_addl_A0_im(-8 << s->dflag);\n\n if (!s->ss32)\n\n tcg_gen_ext16u_tl(cpu_A0, cpu_A0);\n\n tcg_gen_mov_tl(cpu_T[1], cpu_A0);\n\n if (s->addseg)\n\n gen_op_addl_A0_seg(s, R_SS);\n\n for(i = 0;i < 8; i++) {\n\n gen_op_mov_v_reg(MO_32, cpu_T[0], 7 - i);\n\n gen_op_st_v(s, s->dflag, cpu_T[0], cpu_A0);\n\n gen_op_addl_A0_im(1 << s->dflag);\n\n }\n\n gen_op_mov_reg_v(MO_16 + s->ss32, R_ESP, cpu_T[1]);\n\n}\n"}} {"sample_id": "86736f59d6a527d8bc807d09b93f971c0fe0bb07", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,8 +14,8 @@\n \n }\n \n+ for (; i < w; i++)\n+\n+ dst[i] = src1[i] + src2[i];\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void add_bytes_l2_c(uint8_t *dst, uint8_t *src1, uint8_t *src2, int w)\n\n{\n\n long i;\n\n for (i = 0; i <= w - sizeof(long); i += sizeof(long)) {\n\n long a = *(long *)(src1 + i);\n\n long b = *(long *)(src2 + i);\n\n *(long *)(dst + i) = ((a & pb_7f) + (b & pb_7f)) ^ ((a ^ b) & pb_80);\n\n }\n\n for (; i < w; i++)\n\n dst[i] = src1[i] + src2[i];\n\n}\n"}} {"sample_id": "104bf02eb50e080ac9d0de5905f80f9a09730154", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int acpi_checksum(const uint8_t *data, int len)\n \n {\n+\n+ int sum, i;\n+\n sum = 0;\n \n for(i = 0; i < len; i++)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int acpi_checksum(const uint8_t *data, int len)\n\n{\n\n int sum, i;\n\n sum = 0;\n\n for(i = 0; i < len; i++)\n\n sum += data[i];\n\n return (-sum) & 0xff;\n\n}\n"}} {"sample_id": "6e99c631f116221d169ea53953d91b8aa74d297a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+ qemu_set_fd_handler2(s->fd,\n+\n+ s->read_poll ? net_socket_can_send : NULL,\n \n s->read_poll ? s->send_fn : NULL,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void net_socket_update_fd_handler(NetSocketState *s)\n\n{\n\n qemu_set_fd_handler2(s->fd,\n\n s->read_poll ? net_socket_can_send : NULL,\n\n s->read_poll ? s->send_fn : NULL,\n\n s->write_poll ? net_socket_writable : NULL,\n\n s);\n\n}\n"}} {"sample_id": "b3db211f3c80bb996a704d665fe275619f728bd4_32", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n int i;\n \n+\n+\n+ for (i = 0; i < 32; i++) {\n+\n+ g_string_append_printf(gstr_list, \"'%d'\", i);\n \n if (i != 31) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_visitor_in_native_list_string(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n UserDefNativeListUnion *cvalue = NULL;\n\n strList *elem = NULL;\n\n Visitor *v;\n\n GString *gstr_list = g_string_new(\"\");\n\n GString *gstr_union = g_string_new(\"\");\n\n int i;\n\n\n\n for (i = 0; i < 32; i++) {\n\n g_string_append_printf(gstr_list, \"'%d'\", i);\n\n if (i != 31) {\n\n g_string_append(gstr_list, \", \");\n\n }\n\n }\n\n g_string_append_printf(gstr_union, \"{ 'type': 'string', 'data': [ %s ] }\",\n\n gstr_list->str);\n\n v = visitor_input_test_init_raw(data, gstr_union->str);\n\n\n\n visit_type_UserDefNativeListUnion(v, NULL, &cvalue, &error_abort);\n\n g_assert(cvalue != NULL);\n\n g_assert_cmpint(cvalue->type, ==, USER_DEF_NATIVE_LIST_UNION_KIND_STRING);\n\n\n\n for (i = 0, elem = cvalue->u.string.data; elem; elem = elem->next, i++) {\n\n gchar str[8];\n\n sprintf(str, \"%d\", i);\n\n g_assert_cmpstr(elem->value, ==, str);\n\n }\n\n\n\n g_string_free(gstr_union, true);\n\n g_string_free(gstr_list, true);\n\n qapi_free_UserDefNativeListUnion(cvalue);\n\n}\n"}} {"sample_id": "d6604b29ef544793479d7fb4e05ef6622bb3e534_21", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n if (x->twopassbuffer) {\n \n+ av_free(x->twopassbuffer);\n+\n+ av_free(x->old_twopassbuffer);\n+\n+ }\n \n av_free(x->twopassfile);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int xvid_encode_close(AVCodecContext *avctx)\n\n{\n\n struct xvid_context *x = avctx->priv_data;\n\n\n\n if (x->encoder_handle) {\n\n xvid_encore(x->encoder_handle, XVID_ENC_DESTROY, NULL, NULL);\n\n x->encoder_handle = NULL;\n\n }\n\n\n\n av_frame_free(&avctx->coded_frame);\n\n av_freep(&avctx->extradata);\n\n if (x->twopassbuffer) {\n\n av_free(x->twopassbuffer);\n\n av_free(x->old_twopassbuffer);\n\n }\n\n av_free(x->twopassfile);\n\n av_free(x->intra_matrix);\n\n av_free(x->inter_matrix);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "dbe29db8cb09fb39bd8dc5b25934e92279d0aa8d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,7 +15,7 @@\n int k = 0;\n \n while (k < ics->max_sfb) {\n+\n uint8_t sect_end = k;\n \n int sect_len_incr;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int decode_band_types(AACContext *ac, enum BandType band_type[120],\n\n int band_type_run_end[120], GetBitContext *gb,\n\n IndividualChannelStream *ics)\n\n{\n\n int g, idx = 0;\n\n const int bits = (ics->window_sequence[0] == EIGHT_SHORT_SEQUENCE) ? 3 : 5;\n\n for (g = 0; g < ics->num_window_groups; g++) {\n\n int k = 0;\n\n while (k < ics->max_sfb) {\n\n uint8_t sect_end = k;\n\n int sect_len_incr;\n\n int sect_band_type = get_bits(gb, 4);\n\n if (sect_band_type == 12) {\n\n av_log(ac->avctx, AV_LOG_ERROR, \"invalid band type\\n\");\n\n return -1;\n\n }\n\n do {\n\n sect_len_incr = get_bits(gb, bits);\n\n sect_end += sect_len_incr;\n\n if (get_bits_left(gb) < 0) {\n\n av_log(ac->avctx, AV_LOG_ERROR, overread_err);\n\n return -1;\n\n }\n\n if (sect_end > ics->max_sfb) {\n\n av_log(ac->avctx, AV_LOG_ERROR,\n\n \"Number of bands (%d) exceeds limit (%d).\\n\",\n\n sect_end, ics->max_sfb);\n\n return -1;\n\n }\n\n } while (sect_len_incr == (1 << bits) - 1);\n\n for (; k < sect_end; k++) {\n\n band_type [idx] = sect_band_type;\n\n band_type_run_end[idx++] = sect_end;\n\n }\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "0ca4f94195cce77b624edc6d9abcf14a3bf01f06", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static uint64_t bonito_readl(void *opaque, hwaddr addr,\n \n unsigned size)\n+\n {\n \n PCIBonitoState *s = opaque;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint64_t bonito_readl(void *opaque, hwaddr addr,\n\n unsigned size)\n\n{\n\n PCIBonitoState *s = opaque;\n\n uint32_t saddr;\n\n\n\n saddr = (addr - BONITO_REGBASE) >> 2;\n\n\n\n DPRINTF(\"bonito_readl \"TARGET_FMT_plx\"\\n\", addr);\n\n switch (saddr) {\n\n case BONITO_INTISR:\n\n return s->regs[saddr];\n\n default:\n\n return s->regs[saddr];\n\n }\n\n}\n"}} {"sample_id": "bd79255d2571a3c68820117caf94ea9afe1d527e_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,8 +14,8 @@\n \n gen_io_end();\n \n+ gen_stop_exception(ctx);\n+\n+ }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void spr_read_tbl (DisasContext *ctx, int gprn, int sprn)\n\n{\n\n if (use_icount) {\n\n gen_io_start();\n\n }\n\n gen_helper_load_tbl(cpu_gpr[gprn], cpu_env);\n\n if (use_icount) {\n\n gen_io_end();\n\n gen_stop_exception(ctx);\n\n }\n\n}\n"}} {"sample_id": "09b9418c6d085a0728372aa760ebd10128a020b1_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static target_long monitor_get_xer (const struct MonitorDef *md, int val)\n \n+{\n \n CPUState *env = mon_get_cpu();\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static target_long monitor_get_xer (const struct MonitorDef *md, int val)\n\n{\n\n CPUState *env = mon_get_cpu();\n\n if (!env)\n\n return 0;\n\n return env->xer;\n\n}\n"}} {"sample_id": "f332e830e38b3ff3953ef02ac04e409ae53769c5_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n Error **errp)\n \n {\n+\n+ StringInputVisitor *siv = to_siv(v);\n \n+ char *endp = (char *) siv->string;\n+\n double val;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void parse_type_number(Visitor *v, const char *name, double *obj,\n\n Error **errp)\n\n{\n\n StringInputVisitor *siv = to_siv(v);\n\n char *endp = (char *) siv->string;\n\n double val;\n\n\n\n errno = 0;\n\n if (siv->string) {\n\n val = strtod(siv->string, &endp);\n\n }\n\n if (!siv->string || errno || endp == siv->string || *endp) {\n\n error_setg(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : \"null\",\n\n \"number\");\n\n return;\n\n }\n\n\n\n *obj = val;\n\n}\n"}} {"sample_id": "f53a829bb9ef14be800556cbc02d8b20fc1050a7_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n if (!s->is_unix) {\n \n+ socket_set_cork(s->sock, 1);\n+\n+ }\n+\n+ rc = nbd_send_request(s->sock, request);\n \n if (rc >= 0) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int nbd_co_send_request(NbdClientSession *s,\n\n struct nbd_request *request,\n\n QEMUIOVector *qiov, int offset)\n\n{\n\n AioContext *aio_context;\n\n int rc, ret;\n\n\n\n qemu_co_mutex_lock(&s->send_mutex);\n\n s->send_coroutine = qemu_coroutine_self();\n\n aio_context = bdrv_get_aio_context(s->bs);\n\n aio_set_fd_handler(aio_context, s->sock,\n\n nbd_reply_ready, nbd_restart_write, s);\n\n if (qiov) {\n\n if (!s->is_unix) {\n\n socket_set_cork(s->sock, 1);\n\n }\n\n rc = nbd_send_request(s->sock, request);\n\n if (rc >= 0) {\n\n ret = qemu_co_sendv(s->sock, qiov->iov, qiov->niov,\n\n offset, request->len);\n\n if (ret != request->len) {\n\n rc = -EIO;\n\n }\n\n }\n\n if (!s->is_unix) {\n\n socket_set_cork(s->sock, 0);\n\n }\n\n } else {\n\n rc = nbd_send_request(s->sock, request);\n\n }\n\n aio_set_fd_handler(aio_context, s->sock, nbd_reply_ready, NULL, s);\n\n s->send_coroutine = NULL;\n\n qemu_co_mutex_unlock(&s->send_mutex);\n\n return rc;\n\n}\n"}} {"sample_id": "9e2dabed4a7bf21e3e0c0f4ddc895f8ed90fa839", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n void *opaque,\n \n int (*read_packet)(void *opaque, uint8_t *buf, int buf_size),\n+\n+ int (*write_packet)(void *opaque, uint8_t *buf, int buf_size),\n+\n+ int64_t (*seek)(void *opaque, int64_t offset, int whence))\n+\n {\n \n AVIOContext *s = av_mallocz(sizeof(AVIOContext));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "AVIOContext *avio_alloc_context(\n\n unsigned char *buffer,\n\n int buffer_size,\n\n int write_flag,\n\n void *opaque,\n\n int (*read_packet)(void *opaque, uint8_t *buf, int buf_size),\n\n int (*write_packet)(void *opaque, uint8_t *buf, int buf_size),\n\n int64_t (*seek)(void *opaque, int64_t offset, int whence))\n\n{\n\n AVIOContext *s = av_mallocz(sizeof(AVIOContext));\n\n\n\n ffio_init_context(s, buffer, buffer_size, write_flag, opaque,\n\n read_packet, write_packet, seek);\n\n return s;\n\n}"}} {"sample_id": "7385aed20db5d83979f683b9d0048674411e963c_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,9 +25,9 @@\n case 3:\n \n gen_helper_fcmpes_fcc3(cpu_env, r_rs1, r_rs2);\n+\n+ break;\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_op_fcmpes(int fccno, TCGv_i32 r_rs1, TCGv_i32 r_rs2)\n\n{\n\n switch (fccno) {\n\n case 0:\n\n gen_helper_fcmpes(cpu_env, r_rs1, r_rs2);\n\n break;\n\n case 1:\n\n gen_helper_fcmpes_fcc1(cpu_env, r_rs1, r_rs2);\n\n break;\n\n case 2:\n\n gen_helper_fcmpes_fcc2(cpu_env, r_rs1, r_rs2);\n\n break;\n\n case 3:\n\n gen_helper_fcmpes_fcc3(cpu_env, r_rs1, r_rs2);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "6687b79d636cd60ed9adb1177d0d946b58fa7717", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+int net_init_tap(QemuOpts *opts, const char *name, VLANState *vlan)\n \n {\n \n const char *ifname;\n+\n \n \n ifname = qemu_opt_get(opts, \"ifname\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int net_init_tap(QemuOpts *opts, const char *name, VLANState *vlan)\n\n{\n\n const char *ifname;\n\n\n\n ifname = qemu_opt_get(opts, \"ifname\");\n\n\n\n if (!ifname) {\n\n error_report(\"tap: no interface name\");\n\n return -1;\n\n }\n\n\n\n if (tap_win32_init(vlan, \"tap\", name, ifname) == -1) {\n\n return -1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "751ebd76e654bd1e65da08ecf694325282b4cfcc_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n bool block_job_is_paused(BlockJob *job)\n+\n {\n \n return job->paused;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool block_job_is_paused(BlockJob *job)\n\n{\n\n return job->paused;\n\n}\n"}} {"sample_id": "e3cffe6fad29e07d401eabb913a6d88501d5c143_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,1 +1,1 @@\n+static inline void gen_check_tlb_flush(DisasContext *ctx) { }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static inline void gen_check_tlb_flush(DisasContext *ctx) { }\n"}} {"sample_id": "380feaffb0fcc8e5f615ed8e86d2e93717a6f2c6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n case MODE_SELECT:\n \n+ case MODE_SELECT_10:\n+\n+ /* This also clears the sense buffer for REQUEST SENSE. */\n+\n+ scsi_req_complete(&r->req, GOOD);\n \n break;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void scsi_disk_emulate_write_data(SCSIRequest *req)\n\n{\n\n SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);\n\n\n\n if (r->iov.iov_len) {\n\n int buflen = r->iov.iov_len;\n\n DPRINTF(\"Write buf_len=%zd\\n\", buflen);\n\n r->iov.iov_len = 0;\n\n scsi_req_data(&r->req, buflen);\n\n return;\n\n }\n\n\n\n switch (req->cmd.buf[0]) {\n\n case MODE_SELECT:\n\n case MODE_SELECT_10:\n\n /* This also clears the sense buffer for REQUEST SENSE. */\n\n scsi_req_complete(&r->req, GOOD);\n\n break;\n\n\n\n default:\n\n abort();\n\n }\n\n}\n"}} {"sample_id": "ddd0e23d587e3e7ae81ee8a16a079221b0232782", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n \n \n+ for(i=0; inb_streams; i++){\n \n AVStream *st = ctx->streams[i];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int remove_decoded_packets(AVFormatContext *ctx, int64_t scr){\n\n// MpegMuxContext *s = ctx->priv_data;\n\n int i;\n\n\n\n for(i=0; inb_streams; i++){\n\n AVStream *st = ctx->streams[i];\n\n StreamInfo *stream = st->priv_data;\n\n PacketDesc *pkt_desc;\n\n\n\n while((pkt_desc= stream->predecode_packet)\n\n && scr > pkt_desc->dts){ //FIXME > vs >=\n\n if(stream->buffer_index < pkt_desc->size ||\n\n stream->predecode_packet == stream->premux_packet){\n\n av_log(ctx, AV_LOG_ERROR,\n\n \"buffer underflow i=%d bufi=%d size=%d\\n\",\n\n i, stream->buffer_index, pkt_desc->size);\n\n break;\n\n }\n\n stream->buffer_index -= pkt_desc->size;\n\n\n\n stream->predecode_packet= pkt_desc->next;\n\n av_freep(&pkt_desc);\n\n }\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "bc7c08a2c375acb7ae4d433054415588b176d34c_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void test_qemu_strtoull_underflow(void)\n+\n+{\n+\n+ const char *str = \"-99999999999999999999999999999999999999999999\";\n \n char f = 'X';\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_qemu_strtoull_underflow(void)\n\n{\n\n const char *str = \"-99999999999999999999999999999999999999999999\";\n\n char f = 'X';\n\n const char *endptr = &f;\n\n uint64_t res = 999;\n\n int err;\n\n\n\n err = qemu_strtoull(str, &endptr, 0, &res);\n\n\n\n g_assert_cmpint(err, ==, -ERANGE);\n\n g_assert_cmpint(res, ==, -1);\n\n g_assert(endptr == str + strlen(str));\n\n}\n"}} {"sample_id": "3dc6f8693694a649a9c83f1e2746565b47683923", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,9 +7,9 @@\n \n \n if (object_property_get_bool(qdev_get_machine(), \"iommu\", NULL)) {\n+\n+ error_report(\"warning: i440fx doesn't support emulated iommu\");\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void i440fx_realize(PCIDevice *dev, Error **errp)\n\n{\n\n dev->config[I440FX_SMRAM] = 0x02;\n\n\n\n if (object_property_get_bool(qdev_get_machine(), \"iommu\", NULL)) {\n\n error_report(\"warning: i440fx doesn't support emulated iommu\");\n\n }\n\n}\n"}} {"sample_id": "f9d7e9feec2a0fd7f7930d01876a70a9b8a4a3b9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n static int tee_write_trailer(AVFormatContext *avf)\n \n+{\n \n TeeContext *tee = avf->priv_data;\n \n+ AVFormatContext *avf2;\n+\n+ int ret_all = 0, ret;\n \n+ unsigned i;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int tee_write_trailer(AVFormatContext *avf)\n\n{\n\n TeeContext *tee = avf->priv_data;\n\n AVFormatContext *avf2;\n\n int ret_all = 0, ret;\n\n unsigned i;\n\n\n\n for (i = 0; i < tee->nb_slaves; i++) {\n\n avf2 = tee->slaves[i].avf;\n\n if ((ret = av_write_trailer(avf2)) < 0)\n\n if (!ret_all)\n\n ret_all = ret;\n\n if (!(avf2->oformat->flags & AVFMT_NOFILE))\n\n ff_format_io_close(avf2, &avf2->pb);\n\n }\n\n close_slaves(avf);\n\n return ret_all;\n\n}\n"}} {"sample_id": "2a1639291bf9f3c88c62d10459fedaa677536ff5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n s->irq = irq;\n \n s->slave.event = pxa2xx_i2c_event;\n+\n+ s->slave.recv = pxa2xx_i2c_rx;\n+\n+ s->slave.send = pxa2xx_i2c_tx;\n+\n s->bus = i2c_init_bus();\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "struct pxa2xx_i2c_s *pxa2xx_i2c_init(target_phys_addr_t base,\n\n qemu_irq irq, int ioregister)\n\n{\n\n int iomemtype;\n\n struct pxa2xx_i2c_s *s = (struct pxa2xx_i2c_s *)\n\n i2c_slave_init(i2c_init_bus(), 0, sizeof(struct pxa2xx_i2c_s));\n\n\n\n s->base = base;\n\n s->irq = irq;\n\n s->slave.event = pxa2xx_i2c_event;\n\n s->slave.recv = pxa2xx_i2c_rx;\n\n s->slave.send = pxa2xx_i2c_tx;\n\n s->bus = i2c_init_bus();\n\n\n\n if (ioregister) {\n\n iomemtype = cpu_register_io_memory(0, pxa2xx_i2c_readfn,\n\n pxa2xx_i2c_writefn, s);\n\n cpu_register_physical_memory(s->base & 0xfffff000, 0xfff, iomemtype);\n\n }\n\n\n\n register_savevm(\"pxa2xx_i2c\", base, 0,\n\n pxa2xx_i2c_save, pxa2xx_i2c_load, s);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "369cb092ecbbaff20bb0a2a1d60536c3bc04a8f0_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static void generate_silence(uint8_t* buf, enum AVSampleFormat sample_fmt, size_t size)\n+\n+{\n+\n int fill_char = 0x00;\n \n if (sample_fmt == AV_SAMPLE_FMT_U8)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void generate_silence(uint8_t* buf, enum AVSampleFormat sample_fmt, size_t size)\n\n{\n\n int fill_char = 0x00;\n\n if (sample_fmt == AV_SAMPLE_FMT_U8)\n\n fill_char = 0x80;\n\n memset(buf, fill_char, size);\n\n}\n"}} {"sample_id": "eabcea18f835178c1f8f088f88bf00e379f09438_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n \n \n switch (s390_cpu_get_state(cpu)) {\n+\n+ case CPU_STATE_STOPPED:\n+\n+ /* the restart irq has to be delivered prior to any other pending irq */\n+\n cpu_synchronize_state(cs);\n \n do_restart_interrupt(&cpu->env);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void sigp_restart(CPUState *cs, run_on_cpu_data arg)\n\n{\n\n S390CPU *cpu = S390_CPU(cs);\n\n SigpInfo *si = arg.host_ptr;\n\n struct kvm_s390_irq irq = {\n\n .type = KVM_S390_RESTART,\n\n };\n\n\n\n switch (s390_cpu_get_state(cpu)) {\n\n case CPU_STATE_STOPPED:\n\n /* the restart irq has to be delivered prior to any other pending irq */\n\n cpu_synchronize_state(cs);\n\n do_restart_interrupt(&cpu->env);\n\n s390_cpu_set_state(CPU_STATE_OPERATING, cpu);\n\n break;\n\n case CPU_STATE_OPERATING:\n\n kvm_s390_vcpu_interrupt(cpu, &irq);\n\n break;\n\n }\n\n si->cc = SIGP_CC_ORDER_CODE_ACCEPTED;\n\n}\n"}} {"sample_id": "8fd2a2f1a9048b9e37a898c2a5e9ef59d0c1a095", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n int i;\n \n \n+\n if (n->promisc)\n \n return 1;\n+\n \n \n if (!memcmp(&ptr[12], vlan, sizeof(vlan))) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int receive_filter(VirtIONet *n, const uint8_t *buf, int size)\n\n{\n\n static const uint8_t bcast[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};\n\n static const uint8_t vlan[] = {0x81, 0x00};\n\n uint8_t *ptr = (uint8_t *)buf;\n\n int i;\n\n\n\n if (n->promisc)\n\n return 1;\n\n\n\n if (!memcmp(&ptr[12], vlan, sizeof(vlan))) {\n\n int vid = be16_to_cpup((uint16_t *)(ptr + 14)) & 0xfff;\n\n if (!(n->vlans[vid >> 5] & (1U << (vid & 0x1f))))\n\n return 0;\n\n }\n\n\n\n if (ptr[0] & 1) { // multicast\n\n if (!memcmp(ptr, bcast, sizeof(bcast))) {\n\n return 1;\n\n } else if (n->allmulti) {\n\n return 1;\n\n }\n\n } else { // unicast\n\n if (!memcmp(ptr, n->mac, ETH_ALEN)) {\n\n return 1;\n\n }\n\n }\n\n\n\n for (i = 0; i < n->mac_table.in_use; i++) {\n\n if (!memcmp(ptr, &n->mac_table.macs[i * ETH_ALEN], ETH_ALEN))\n\n return 1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "4819446eae451a6e58d6ae41faefb5529af4e783", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int webvtt_event_to_ass(AVBPrint *buf, const char *p)\n+\n {\n \n int i, again, skip = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int webvtt_event_to_ass(AVBPrint *buf, const char *p)\n\n{\n\n int i, again, skip = 0;\n\n\n\n while (*p) {\n\n\n\n for (i = 0; i < FF_ARRAY_ELEMS(webvtt_tag_replace); i++) {\n\n const char *from = webvtt_tag_replace[i].from;\n\n const size_t len = strlen(from);\n\n if (!strncmp(p, from, len)) {\n\n av_bprintf(buf, \"%s\", webvtt_tag_replace[i].to);\n\n p += len;\n\n again = 1;\n\n break;\n\n }\n\n }\n\n if (!*p)\n\n break;\n\n\n\n if (again) {\n\n again = 0;\n\n skip = 0;\n\n continue;\n\n }\n\n if (*p == '<')\n\n skip = 1;\n\n else if (*p == '>')\n\n skip = 0;\n\n else if (p[0] == '\\n' && p[1])\n\n av_bprintf(buf, \"\\\\N\");\n\n else if (!skip && *p != '\\r')\n\n av_bprint_chars(buf, *p, 1);\n\n p++;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "7faa8075d898ae56d2c533c530569bb25ab86eaf_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static uint32_t pci_up_read(void *opaque, uint32_t addr)\n \n+{\n \n PIIX4PMState *s = opaque;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static uint32_t pci_up_read(void *opaque, uint32_t addr)\n\n{\n\n PIIX4PMState *s = opaque;\n\n uint32_t val = s->pci0_status.up;\n\n\n\n PIIX4_DPRINTF(\"pci_up_read %x\\n\", val);\n\n return val;\n\n}\n"}} {"sample_id": "1830f22a6777cedaccd67a08f675d30f7a85ebfd_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n QTAILQ_REMOVE(&v->stack, e, node);\n \n g_free(e);\n+\n+ }\n+\n+\n+\n qobject_decref(v->root);\n \n g_free(v);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qmp_output_visitor_cleanup(QmpOutputVisitor *v)\n\n{\n\n QStackEntry *e, *tmp;\n\n\n\n QTAILQ_FOREACH_SAFE(e, &v->stack, node, tmp) {\n\n QTAILQ_REMOVE(&v->stack, e, node);\n\n g_free(e);\n\n }\n\n\n\n qobject_decref(v->root);\n\n g_free(v);\n\n}\n"}} {"sample_id": "cc4a41727e29a52a181e3d1c1a398f1da40969c3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void RENAME(swri_noise_shaping)(SwrContext *s, AudioData *dsts, const AudioData *srcs, const AudioData *noises, int count){\n+\n int i, j, pos, ch;\n \n int taps = s->dither.ns_taps;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void RENAME(swri_noise_shaping)(SwrContext *s, AudioData *dsts, const AudioData *srcs, const AudioData *noises, int count){\n\n int i, j, pos, ch;\n\n int taps = s->dither.ns_taps;\n\n float S = s->dither.ns_scale;\n\n float S_1 = s->dither.ns_scale_1;\n\n\n\n av_assert2((taps&3) != 2);\n\n av_assert2((taps&3) != 3 || s->dither.ns_coeffs[taps] == 0);\n\n\n\n for (ch=0; chch_count; ch++) {\n\n const float *noise = ((const float *)noises->ch[ch]) + s->dither.noise_pos;\n\n const DELEM *src = (const DELEM*)srcs->ch[ch];\n\n DELEM *dst = (DELEM*)dsts->ch[ch];\n\n float *ns_errors = s->dither.ns_errors[ch];\n\n const float *ns_coeffs = s->dither.ns_coeffs;\n\n pos = s->dither.ns_pos;\n\n for (i=0; idither.ns_pos = pos;\n\n}\n"}} {"sample_id": "8be7e7e4c72c048b90e3482557954a24bba43ba7_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n int qemu_opts_set(QemuOptsList *list, const char *id,\n \n+ const char *name, const char *value)\n+\n {\n \n QemuOpts *opts;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int qemu_opts_set(QemuOptsList *list, const char *id,\n\n const char *name, const char *value)\n\n{\n\n QemuOpts *opts;\n\n\n\n opts = qemu_opts_create(list, id, 1);\n\n if (opts == NULL) {\n\n return -1;\n\n }\n\n return qemu_opt_set(opts, name, value);\n\n}\n"}} {"sample_id": "2ccf97ec0f1b7a62a3220064f305454f3932c55a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static inline void init_thread(struct target_pt_regs *_regs, struct image_info *infop)\n \n {\n+\n+ _regs->gpr[1] = infop->start_stack;\n \n #if defined(TARGET_PPC64) && !defined(TARGET_ABI32)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void init_thread(struct target_pt_regs *_regs, struct image_info *infop)\n\n{\n\n _regs->gpr[1] = infop->start_stack;\n\n#if defined(TARGET_PPC64) && !defined(TARGET_ABI32)\n\n if (get_ppc64_abi(infop) < 2) {\n\n _regs->gpr[2] = ldq_raw(infop->entry + 8) + infop->load_bias;\n\n infop->entry = ldq_raw(infop->entry) + infop->load_bias;\n\n } else {\n\n _regs->gpr[12] = infop->entry; /* r12 set to global entry address */\n\n }\n\n#endif\n\n _regs->nip = infop->entry;\n\n}\n"}} {"sample_id": "9ffb8270205a274a18ee4f8a735e2fccaf957246", "diff": "--- a/source.c\n+++ b/source.c\n@@ -38,11 +38,11 @@\n \n continue;\n \n+ }\n+\n+ if (len < 0) {\n+\n+ goto cleanup;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qio_channel_writev_all(QIOChannel *ioc,\n\n const struct iovec *iov,\n\n size_t niov,\n\n Error **errp)\n\n{\n\n int ret = -1;\n\n struct iovec *local_iov = g_new(struct iovec, niov);\n\n struct iovec *local_iov_head = local_iov;\n\n unsigned int nlocal_iov = niov;\n\n\n\n nlocal_iov = iov_copy(local_iov, nlocal_iov,\n\n iov, niov,\n\n 0, iov_size(iov, niov));\n\n\n\n while (nlocal_iov > 0) {\n\n ssize_t len;\n\n len = qio_channel_writev(ioc, local_iov, nlocal_iov, errp);\n\n if (len == QIO_CHANNEL_ERR_BLOCK) {\n\n qio_channel_wait(ioc, G_IO_OUT);\n\n continue;\n\n }\n\n if (len < 0) {\n\n goto cleanup;\n\n }\n\n\n\n iov_discard_front(&local_iov, &nlocal_iov, len);\n\n }\n\n\n\n ret = 0;\n\n cleanup:\n\n g_free(local_iov_head);\n\n return ret;\n\n}\n"}} {"sample_id": "d574e22659bd51cdf16723a204fef65a9e783f1d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n state->code_counterA_almost = 0;\n \n+ state->code_counterB = 0;\n+\n+ state->code_counterB_checkfails = 0;\n+\n+ state->code_counterC = 0;\n \n state->code_counterC_unmatched = 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void hdcd_reset(hdcd_state_t *state, unsigned rate)\n\n{\n\n int i;\n\n\n\n state->window = 0;\n\n state->readahead = 32;\n\n state->arg = 0;\n\n state->control = 0;\n\n\n\n state->running_gain = 0;\n\n\n\n state->sustain = 0;\n\n state->sustain_reset = rate * 10;\n\n\n\n state->code_counterA = 0;\n\n state->code_counterA_almost = 0;\n\n state->code_counterB = 0;\n\n state->code_counterB_checkfails = 0;\n\n state->code_counterC = 0;\n\n state->code_counterC_unmatched = 0;\n\n\n\n state->count_peak_extend = 0;\n\n state->count_transient_filter = 0;\n\n for(i = 0; i < 16; i++) state->gain_counts[i] = 0;\n\n state->max_gain = 0;\n\n\n\n state->count_sustain_expired = -1;\n\n}\n"}} {"sample_id": "3df4939988ace682f7ac0366ef8fd700d207e6b6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n \n \n+ if (init_get_bits8(&gb, buf, size) < 0)\n+\n+ return DCA_PARSE_ERROR_INVALIDDATA;\n+\n \n \n return ff_dca_parse_core_frame_header(h, &gb);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int avpriv_dca_parse_core_frame_header(DCACoreFrameHeader *h, const uint8_t *buf, int size)\n\n{\n\n GetBitContext gb;\n\n\n\n if (init_get_bits8(&gb, buf, size) < 0)\n\n return DCA_PARSE_ERROR_INVALIDDATA;\n\n\n\n return ff_dca_parse_core_frame_header(h, &gb);\n\n}\n"}} {"sample_id": "8cd1c0febe88b757e915e9af15559575c21ca728_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static av_cold int pcx_end(AVCodecContext *avctx) {\n \n PCXContext *s = avctx->priv_data;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static av_cold int pcx_end(AVCodecContext *avctx) {\n\n PCXContext *s = avctx->priv_data;\n\n\n\n if(s->picture.data[0])\n\n avctx->release_buffer(avctx, &s->picture);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "991f8f0c91d65cebf51fa931450e02b0d5209012_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void fill_prstatus(struct target_elf_prstatus *prstatus,\n+\n+ const TaskState *ts, int signr)\n+\n+{\n \n (void) memset(prstatus, 0, sizeof (*prstatus));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void fill_prstatus(struct target_elf_prstatus *prstatus,\n\n const TaskState *ts, int signr)\n\n{\n\n (void) memset(prstatus, 0, sizeof (*prstatus));\n\n prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;\n\n prstatus->pr_pid = ts->ts_tid;\n\n prstatus->pr_ppid = getppid();\n\n prstatus->pr_pgrp = getpgrp();\n\n prstatus->pr_sid = getsid(0);\n\n\n\n#ifdef BSWAP_NEEDED\n\n bswap_prstatus(prstatus);\n\n#endif\n\n}\n"}} {"sample_id": "62be4e3a5041e84304aa23637da623a205c53ecc_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,10 +5,10 @@\n RAMBlock *block;\n \n ram_addr_t last = 0;\n+\n+\n+\n+ QTAILQ_FOREACH(block, &ram_list.blocks, next)\n \n last = MAX(last, block->offset + block->length);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "ram_addr_t last_ram_offset(void)\n\n{\n\n RAMBlock *block;\n\n ram_addr_t last = 0;\n\n\n\n QTAILQ_FOREACH(block, &ram_list.blocks, next)\n\n last = MAX(last, block->offset + block->length);\n\n\n\n return last;\n\n}\n"}} {"sample_id": "21d5d12bb0ad4de7cc92a7a2d018e7ec0f9fd148", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n delta = active_timers[QEMU_CLOCK_VIRTUAL]->expire_time -\n \n qemu_get_clock(vm_clock);\n+\n+ } else {\n+\n+ /* To avoid problems with overflow limit this to 2^32. */\n+\n delta = INT32_MAX;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int64_t qemu_next_deadline(void)\n\n{\n\n int64_t delta;\n\n\n\n if (active_timers[QEMU_CLOCK_VIRTUAL]) {\n\n delta = active_timers[QEMU_CLOCK_VIRTUAL]->expire_time -\n\n qemu_get_clock(vm_clock);\n\n } else {\n\n /* To avoid problems with overflow limit this to 2^32. */\n\n delta = INT32_MAX;\n\n }\n\n\n\n if (delta < 0)\n\n delta = 0;\n\n\n\n return delta;\n\n}\n"}} {"sample_id": "7ebaf7955603cc50988e0eafd5e6074320fefc70", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ DeviceClass *dc = DEVICE_CLASS(oc);\n+\n dc->realize = spapr_cpu_core_realize;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void spapr_cpu_core_class_init(ObjectClass *oc, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(oc);\n\n dc->realize = spapr_cpu_core_realize;\n\n}\n"}} {"sample_id": "44701ab71ad854e6be567a6294f4665f36651076", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+void msix_load(PCIDevice *dev, QEMUFile *f)\n+\n+{\n+\n+ unsigned n = dev->msix_entries_nr;\n \n unsigned int vector;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void msix_load(PCIDevice *dev, QEMUFile *f)\n\n{\n\n unsigned n = dev->msix_entries_nr;\n\n unsigned int vector;\n\n\n\n if (!(dev->cap_present & QEMU_PCI_CAP_MSIX)) {\n\n return;\n\n }\n\n\n\n msix_free_irq_entries(dev);\n\n qemu_get_buffer(f, dev->msix_table_page, n * PCI_MSIX_ENTRY_SIZE);\n\n qemu_get_buffer(f, dev->msix_table_page + MSIX_PAGE_PENDING, (n + 7) / 8);\n\n msix_update_function_masked(dev);\n\n\n\n for (vector = 0; vector < n; vector++) {\n\n msix_handle_mask_update(dev, vector, true);\n\n }\n\n}\n"}} {"sample_id": "af52fe862fba686713044efdf9158195f84535ab", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,6 +8,6 @@\n \n qemu_chr_fe_ioctl(s->chr, CHR_IOCTL_SERIAL_SET_BREAK,\n \n+ &break_enabled);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void uart_send_breaks(UartState *s)\n\n{\n\n int break_enabled = 1;\n\n\n\n qemu_chr_fe_ioctl(s->chr, CHR_IOCTL_SERIAL_SET_BREAK,\n\n &break_enabled);\n\n}\n"}} {"sample_id": "c9c3c80af71dd2b7813d1ada9b14cb51df584221_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n {\n \n uint32_t val, size, addr;\n+\n uint64_t buid = ((uint64_t)rtas_ld(args, 1) << 32) | rtas_ld(args, 2);\n \n PCIDevice *dev = find_dev(spapr, buid, rtas_ld(args, 0));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void rtas_ibm_write_pci_config(sPAPREnvironment *spapr,\n\n uint32_t token, uint32_t nargs,\n\n target_ulong args,\n\n uint32_t nret, target_ulong rets)\n\n{\n\n uint32_t val, size, addr;\n\n uint64_t buid = ((uint64_t)rtas_ld(args, 1) << 32) | rtas_ld(args, 2);\n\n PCIDevice *dev = find_dev(spapr, buid, rtas_ld(args, 0));\n\n\n\n if (!dev) {\n\n rtas_st(rets, 0, -1);\n\n return;\n\n }\n\n val = rtas_ld(args, 4);\n\n size = rtas_ld(args, 3);\n\n addr = rtas_pci_cfgaddr(rtas_ld(args, 0));\n\n pci_default_write_config(dev, addr, val, size);\n\n rtas_st(rets, 0, 0);\n\n}\n"}} {"sample_id": "076b35b5a56bca57c4aa41044ed304fe9c45d6c5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n TypeInfo ti = {\n \n .name = name,\n+\n+ .parent = TYPE_MACHINE,\n+\n+ .class_init = machine_class_init,\n+\n .class_data = (void *)m,\n \n };", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_register_machine(QEMUMachine *m)\n\n{\n\n char *name = g_strconcat(m->name, TYPE_MACHINE_SUFFIX, NULL);\n\n TypeInfo ti = {\n\n .name = name,\n\n .parent = TYPE_MACHINE,\n\n .class_init = machine_class_init,\n\n .class_data = (void *)m,\n\n };\n\n\n\n type_register(&ti);\n\n g_free(name);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "6eb8f212d2686ed9b17077d554465df7ae06f805", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n CPUState *cs = arg;\n \n S390CPU *cpu = S390_CPU(cs);\n+\n+ struct kvm_s390_irq irq = {\n+\n+ .type = KVM_S390_RESTART,\n+\n };\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void sigp_cpu_restart(void *arg)\n\n{\n\n CPUState *cs = arg;\n\n S390CPU *cpu = S390_CPU(cs);\n\n struct kvm_s390_irq irq = {\n\n .type = KVM_S390_RESTART,\n\n };\n\n\n\n kvm_s390_vcpu_interrupt(cpu, &irq);\n\n s390_cpu_set_state(CPU_STATE_OPERATING, cpu);\n\n}\n"}} {"sample_id": "e549933a270dd2cfc36f2cf9bb6b29acf3dc6d08", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n ptrdiff_t stride)\n \n+{\n+\n avc_luma_mid_16w_msa(src - (2 * stride) - 2, stride, dst, stride, 16);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_put_h264_qpel16_mc22_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n avc_luma_mid_16w_msa(src - (2 * stride) - 2, stride, dst, stride, 16);\n\n}\n"}} {"sample_id": "56ad3e54dad6cdcee8668d170df161d89581846f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static ssize_t mp_pacl_getxattr(FsContext *ctx, const char *path,\n+\n+ const char *name, void *value, size_t size)\n+\n+{\n+\n+ char *buffer;\n \n ssize_t ret;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static ssize_t mp_pacl_getxattr(FsContext *ctx, const char *path,\n\n const char *name, void *value, size_t size)\n\n{\n\n char *buffer;\n\n ssize_t ret;\n\n\n\n buffer = rpath(ctx, path);\n\n ret = lgetxattr(buffer, MAP_ACL_ACCESS, value, size);\n\n g_free(buffer);\n\n return ret;\n\n}\n"}} {"sample_id": "b027a538c6790bcfc93ef7f4819fe3e581445959", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static int oss_poll_out (HWVoiceOut *hw)\n \n+{\n \n OSSVoiceOut *oss = (OSSVoiceOut *) hw;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int oss_poll_out (HWVoiceOut *hw)\n\n{\n\n OSSVoiceOut *oss = (OSSVoiceOut *) hw;\n\n\n\n return qemu_set_fd_handler (oss->fd, NULL, oss_helper_poll_out, NULL);\n\n}\n"}} {"sample_id": "65340c976c664b94427ac50f5d03b0e77883c108", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void free_buffers(VP8Context *s)\n+\n+{\n+\n+ int i;\n+\n if (s->thread_data)\n \n for (i = 0; i < MAX_THREADS; i++) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void free_buffers(VP8Context *s)\n\n{\n\n int i;\n\n if (s->thread_data)\n\n for (i = 0; i < MAX_THREADS; i++) {\n\n\n\n\n\n av_freep(&s->thread_data[i].filter_strength);\n\n av_freep(&s->thread_data[i].edge_emu_buffer);\n\n }\n\n av_freep(&s->thread_data);\n\n av_freep(&s->macroblocks_base);\n\n av_freep(&s->intra4x4_pred_mode_top);\n\n av_freep(&s->top_nnz);\n\n av_freep(&s->top_border);\n\n\n\n s->macroblocks = NULL;\n\n}"}} {"sample_id": "75f418064ecf5c2713151cbe6b3a716d2c047f1d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,7 +15,7 @@\n timestamp = FFMAX(timestamp, 0);\n \n \n+\n if (caf->frames_per_packet > 0 && caf->bytes_per_packet > 0) {\n \n /* calculate new byte position based on target frame position */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int read_seek(AVFormatContext *s, int stream_index,\n\n int64_t timestamp, int flags)\n\n{\n\n AVStream *st = s->streams[0];\n\n CaffContext *caf = s->priv_data;\n\n int64_t pos;\n\n\n\n timestamp = FFMAX(timestamp, 0);\n\n\n\n if (caf->frames_per_packet > 0 && caf->bytes_per_packet > 0) {\n\n /* calculate new byte position based on target frame position */\n\n pos = caf->bytes_per_packet * timestamp / caf->frames_per_packet;\n\n if (caf->data_size > 0)\n\n pos = FFMIN(pos, caf->data_size);\n\n caf->packet_cnt = pos / caf->bytes_per_packet;\n\n caf->frame_cnt = caf->frames_per_packet * caf->packet_cnt;\n\n } else if (st->nb_index_entries) {\n\n caf->packet_cnt = av_index_search_timestamp(st, timestamp, flags);\n\n caf->frame_cnt = st->index_entries[caf->packet_cnt].timestamp;\n\n pos = st->index_entries[caf->packet_cnt].pos;\n\n } else {\n\n return -1;\n\n }\n\n\n\n avio_seek(s->pb, pos + caf->data_start, SEEK_SET);\n\n return 0;\n\n}\n"}} {"sample_id": "c5a49c63fa26e8825ad101dfe86339ae4c216539_17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static inline void gen_outs(DisasContext *s, TCGMemOp ot)\n+\n {\n \n if (s->base.tb->cflags & CF_USE_ICOUNT) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void gen_outs(DisasContext *s, TCGMemOp ot)\n\n{\n\n if (s->base.tb->cflags & CF_USE_ICOUNT) {\n\n gen_io_start();\n\n }\n\n gen_string_movl_A0_ESI(s);\n\n gen_op_ld_v(s, ot, cpu_T0, cpu_A0);\n\n\n\n tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_regs[R_EDX]);\n\n tcg_gen_andi_i32(cpu_tmp2_i32, cpu_tmp2_i32, 0xffff);\n\n tcg_gen_trunc_tl_i32(cpu_tmp3_i32, cpu_T0);\n\n gen_helper_out_func(ot, cpu_tmp2_i32, cpu_tmp3_i32);\n\n gen_op_movl_T0_Dshift(ot);\n\n gen_op_add_reg_T0(s->aflag, R_ESI);\n\n gen_bpt_io(s, cpu_tmp2_i32, ot);\n\n if (s->base.tb->cflags & CF_USE_ICOUNT) {\n\n gen_io_end();\n\n }\n\n}\n"}} {"sample_id": "4fc9af53d88c0a2a810704a06cb39a7182982e4e_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n return -ENOMEDIUM;\n \n \n+\n+ if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {\n+\n+ memcpy(buf, bs->boot_sector_data, 512);\n+\n sector_num++;\n \n nb_sectors--;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int bdrv_read(BlockDriverState *bs, int64_t sector_num,\n\n uint8_t *buf, int nb_sectors)\n\n{\n\n BlockDriver *drv = bs->drv;\n\n\n\n if (!drv)\n\n return -ENOMEDIUM;\n\n\n\n if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {\n\n memcpy(buf, bs->boot_sector_data, 512);\n\n sector_num++;\n\n nb_sectors--;\n\n buf += 512;\n\n if (nb_sectors == 0)\n\n return 0;\n\n }\n\n if (drv->bdrv_pread) {\n\n int ret, len;\n\n len = nb_sectors * 512;\n\n ret = drv->bdrv_pread(bs, sector_num * 512, buf, len);\n\n if (ret < 0)\n\n return ret;\n\n else if (ret != len)\n\n return -EINVAL;\n\n else {\n\n\t bs->rd_bytes += (unsigned) len;\n\n\t bs->rd_ops ++;\n\n return 0;\n\n\t}\n\n } else {\n\n return drv->bdrv_read(bs, sector_num, buf, nb_sectors);\n\n }\n\n}\n"}} {"sample_id": "58af48f1c3cc98afc1f25d494f197148801cf210", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n int ret = 0;\n \n switch (frame->format) {\n+\n case AV_PIX_FMT_YUV420P:\n \n ret = SDL_UpdateYUVTexture(tex, NULL, frame->data[0], frame->linesize[0],", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int upload_texture(SDL_Texture *tex, AVFrame *frame, struct SwsContext **img_convert_ctx) {\n\n int ret = 0;\n\n switch (frame->format) {\n\n case AV_PIX_FMT_YUV420P:\n\n ret = SDL_UpdateYUVTexture(tex, NULL, frame->data[0], frame->linesize[0],\n\n frame->data[1], frame->linesize[1],\n\n frame->data[2], frame->linesize[2]);\n\n break;\n\n case AV_PIX_FMT_BGRA:\n\n ret = SDL_UpdateTexture(tex, NULL, frame->data[0], frame->linesize[0]);\n\n break;\n\n default:\n\n /* This should only happen if we are not using avfilter... */\n\n *img_convert_ctx = sws_getCachedContext(*img_convert_ctx,\n\n frame->width, frame->height, frame->format, frame->width, frame->height,\n\n AV_PIX_FMT_BGRA, sws_flags, NULL, NULL, NULL);\n\n if (*img_convert_ctx != NULL) {\n\n uint8_t *pixels;\n\n int pitch;\n\n if (!SDL_LockTexture(tex, NULL, (void **)&pixels, &pitch)) {\n\n sws_scale(*img_convert_ctx, (const uint8_t * const *)frame->data, frame->linesize,\n\n 0, frame->height, &pixels, &pitch);\n\n SDL_UnlockTexture(tex);\n\n }\n\n } else {\n\n av_log(NULL, AV_LOG_FATAL, \"Cannot initialize the conversion context\\n\");\n\n ret = -1;\n\n }\n\n break;\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "90fc00a623de44e137fe1601b91356e8cd8bdd54_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n char c;\n \n+ int64_t start, end;\n \n const unsigned char *ptr = p->buf;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int mpl2_probe(AVProbeData *p)\n\n{\n\n int i;\n\n char c;\n\n int64_t start, end;\n\n const unsigned char *ptr = p->buf;\n\n const unsigned char *ptr_end = ptr + p->buf_size;\n\n\n\n for (i = 0; i < 2; i++) {\n\n if (sscanf(ptr, \"[%\"SCNd64\"][%\"SCNd64\"]%c\", &start, &end, &c) != 3 &&\n\n sscanf(ptr, \"[%\"SCNd64\"][]%c\", &start, &c) != 2)\n\n return 0;\n\n ptr += strcspn(ptr, \"\\n\") + 1;\n\n if (ptr >= ptr_end)\n\n return 0;\n\n }\n\n return AVPROBE_SCORE_MAX;\n\n}\n"}} {"sample_id": "b164d66e35d349de414e2f0d7365a147aba8a620", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,9 +29,9 @@\n /* Pseudo-stereo - just copy left channel to right channel */\n \n if (ctx->channels == 2) {\n+\n+ memcpy(ctx->decoded[1], ctx->decoded[0], count * sizeof(*ctx->decoded[1]));\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ape_unpack_mono(APEContext *ctx, int count)\n\n{\n\n if (ctx->frameflags & APE_FRAMECODE_STEREO_SILENCE) {\n\n /* We are pure silence, so we're done. */\n\n av_log(ctx->avctx, AV_LOG_DEBUG, \"pure silence mono\\n\");\n\n return;\n\n }\n\n\n\n entropy_decode(ctx, count, 0);\n\n ape_apply_filters(ctx, ctx->decoded[0], NULL, count);\n\n\n\n /* Now apply the predictor decoding */\n\n predictor_decode_mono(ctx, count);\n\n\n\n /* Pseudo-stereo - just copy left channel to right channel */\n\n if (ctx->channels == 2) {\n\n memcpy(ctx->decoded[1], ctx->decoded[0], count * sizeof(*ctx->decoded[1]));\n\n }\n\n}\n"}} {"sample_id": "e2779de053b64f023de382fd87b3596613d47d1e_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n writable_mask = ~reg->ro_mask & valid_mask;\n \n cfg_entry->data = XEN_PT_MERGE_VALUE(*val, cfg_entry->data, writable_mask);\n+\n+\n+\n+ /* create value for writing to I/O device register */\n+\n if (*val & PCI_COMMAND_INTX_DISABLE) {\n \n throughable_mask |= PCI_COMMAND_INTX_DISABLE;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int xen_pt_cmd_reg_write(XenPCIPassthroughState *s, XenPTReg *cfg_entry,\n\n uint16_t *val, uint16_t dev_value,\n\n uint16_t valid_mask)\n\n{\n\n XenPTRegInfo *reg = cfg_entry->reg;\n\n uint16_t writable_mask = 0;\n\n uint16_t throughable_mask = get_throughable_mask(s, reg, valid_mask);\n\n\n\n /* modify emulate register */\n\n writable_mask = ~reg->ro_mask & valid_mask;\n\n cfg_entry->data = XEN_PT_MERGE_VALUE(*val, cfg_entry->data, writable_mask);\n\n\n\n /* create value for writing to I/O device register */\n\n if (*val & PCI_COMMAND_INTX_DISABLE) {\n\n throughable_mask |= PCI_COMMAND_INTX_DISABLE;\n\n } else {\n\n if (s->machine_irq) {\n\n throughable_mask |= PCI_COMMAND_INTX_DISABLE;\n\n }\n\n }\n\n\n\n *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "c83c66c3b58893a4dc056e272822beb88fe9ec7f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void *block_job_create(const BlockJobType *job_type, BlockDriverState *bs,\n+\n+ BlockDriverCompletionFunc *cb, void *opaque,\n+\n+ Error **errp)\n+\n {\n \n BlockJob *job;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void *block_job_create(const BlockJobType *job_type, BlockDriverState *bs,\n\n BlockDriverCompletionFunc *cb, void *opaque,\n\n Error **errp)\n\n{\n\n BlockJob *job;\n\n\n\n if (bs->job || bdrv_in_use(bs)) {\n\n error_set(errp, QERR_DEVICE_IN_USE, bdrv_get_device_name(bs));\n\n return NULL;\n\n }\n\n bdrv_set_in_use(bs, 1);\n\n\n\n job = g_malloc0(job_type->instance_size);\n\n job->job_type = job_type;\n\n job->bs = bs;\n\n job->cb = cb;\n\n job->opaque = opaque;\n\n bs->job = job;\n\n return job;\n\n}\n"}} {"sample_id": "7385aed20db5d83979f683b9d0048674411e963c_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n }\n \n if (status & float_flag_underflow) {\n+\n+ env->fsr |= FSR_UFC;\n+\n+ }\n+\n if (status & float_flag_divbyzero) {\n \n env->fsr |= FSR_DZC;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void check_ieee_exceptions(CPUSPARCState *env)\n\n{\n\n target_ulong status;\n\n\n\n status = get_float_exception_flags(&env->fp_status);\n\n if (status) {\n\n /* Copy IEEE 754 flags into FSR */\n\n if (status & float_flag_invalid) {\n\n env->fsr |= FSR_NVC;\n\n }\n\n if (status & float_flag_overflow) {\n\n env->fsr |= FSR_OFC;\n\n }\n\n if (status & float_flag_underflow) {\n\n env->fsr |= FSR_UFC;\n\n }\n\n if (status & float_flag_divbyzero) {\n\n env->fsr |= FSR_DZC;\n\n }\n\n if (status & float_flag_inexact) {\n\n env->fsr |= FSR_NXC;\n\n }\n\n\n\n if ((env->fsr & FSR_CEXC_MASK) & ((env->fsr & FSR_TEM_MASK) >> 23)) {\n\n /* Unmasked exception, generate a trap */\n\n env->fsr |= FSR_FTT_IEEE_EXCP;\n\n helper_raise_exception(env, TT_FP_EXCP);\n\n } else {\n\n /* Accumulate exceptions */\n\n env->fsr |= (env->fsr & FSR_CEXC_MASK) << 5;\n\n }\n\n }\n\n}\n"}} {"sample_id": "1e3f77b53a803a6c63fa64829f1be557b8226288_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n int width, int height,\n \n+ int lumStride, int chromStride, int srcStride)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void RENAME(uyvytoyuv420)(uint8_t *ydst, uint8_t *udst, uint8_t *vdst, const uint8_t *src,\n\n int width, int height,\n\n int lumStride, int chromStride, int srcStride)\n\n{\n\n int y;\n\n const int chromWidth = FF_CEIL_RSHIFT(width, 1);\n\n\n\n for (y=0; yvalue->base->integer, ==, 42 + i);\n \n+ }\n+\n+\n+\n+ qapi_free_UserDefOneList(head);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_visitor_in_list(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n UserDefOneList *item, *head = NULL;\n\n Error *err = NULL;\n\n Visitor *v;\n\n int i;\n\n\n\n v = visitor_input_test_init(data, \"[ { 'string': 'string0', 'integer': 42 }, { 'string': 'string1', 'integer': 43 }, { 'string': 'string2', 'integer': 44 } ]\");\n\n\n\n visit_type_UserDefOneList(v, &head, NULL, &err);\n\n g_assert(!err);\n\n g_assert(head != NULL);\n\n\n\n for (i = 0, item = head; item; item = item->next, i++) {\n\n char string[12];\n\n\n\n snprintf(string, sizeof(string), \"string%d\", i);\n\n g_assert_cmpstr(item->value->string, ==, string);\n\n g_assert_cmpint(item->value->base->integer, ==, 42 + i);\n\n }\n\n\n\n qapi_free_UserDefOneList(head);\n\n}\n"}} {"sample_id": "6f1ccca4ae3b93b6a2a820a7a0e72081ab35767c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n RowContext *row, int n)\n \n+{\n+\n return dnxhd_decode_dct_block(ctx, row, n, 6, 8, 4);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int dnxhd_decode_dct_block_10(const DNXHDContext *ctx,\n\n RowContext *row, int n)\n\n{\n\n return dnxhd_decode_dct_block(ctx, row, n, 6, 8, 4);\n\n}\n"}} {"sample_id": "0df9d0f4cbcb18006f9fde0502671f9ef293e2f2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n for (i = 0; i < c->nb_as; i++)\n av_dict_free(&c->as[i].metadata);\n av_freep(&c->as);\n+ c->nb_as = 0;\n+ }\n+ if (!c->streams)\n+ return;\n+ for (i = 0; i < s->nb_streams; i++) {\n OutputStream *os = &c->streams[i];\n if (os->ctx && os->ctx_inited)\n av_write_trailer(os->ctx);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void dash_free(AVFormatContext *s)\n{\n DASHContext *c = s->priv_data;\n int i, j;\n if (c->as) {\n for (i = 0; i < c->nb_as; i++)\n av_dict_free(&c->as[i].metadata);\n av_freep(&c->as);\n c->nb_as = 0;\n }\n if (!c->streams)\n return;\n for (i = 0; i < s->nb_streams; i++) {\n OutputStream *os = &c->streams[i];\n if (os->ctx && os->ctx_inited)\n av_write_trailer(os->ctx);\n if (os->ctx && os->ctx->pb)\n ffio_free_dyn_buf(&os->ctx->pb);\n ff_format_io_close(s, &os->out);\n if (os->ctx)\n avformat_free_context(os->ctx);\n for (j = 0; j < os->nb_segments; j++)\n av_free(os->segments[j]);\n av_free(os->segments);\n }\n av_freep(&c->streams);\n}"}} {"sample_id": "8eca6b1bc770982595db2f7207c65051572436cb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -39,11 +39,11 @@\n ret = vdev->vq[vdev->queue_sel].vring.num;\n \n break;\n+\n+ case VIRTIO_PCI_QUEUE_SEL:\n+\n+ ret = vdev->queue_sel;\n+\n break;\n \n case VIRTIO_PCI_STATUS:", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t virtio_ioport_read(void *opaque, uint32_t addr)\n\n{\n\n VirtIODevice *vdev = to_virtio_device(opaque);\n\n uint32_t ret = 0xFFFFFFFF;\n\n\n\n addr -= vdev->addr;\n\n\n\n switch (addr) {\n\n case VIRTIO_PCI_HOST_FEATURES:\n\n ret = vdev->get_features(vdev);\n\n ret |= (1 << VIRTIO_F_NOTIFY_ON_EMPTY);\n\n break;\n\n case VIRTIO_PCI_GUEST_FEATURES:\n\n ret = vdev->features;\n\n break;\n\n case VIRTIO_PCI_QUEUE_PFN:\n\n ret = vdev->vq[vdev->queue_sel].pfn;\n\n break;\n\n case VIRTIO_PCI_QUEUE_NUM:\n\n ret = vdev->vq[vdev->queue_sel].vring.num;\n\n break;\n\n case VIRTIO_PCI_QUEUE_SEL:\n\n ret = vdev->queue_sel;\n\n break;\n\n case VIRTIO_PCI_STATUS:\n\n ret = vdev->status;\n\n break;\n\n case VIRTIO_PCI_ISR:\n\n /* reading from the ISR also clears it. */\n\n ret = vdev->isr;\n\n vdev->isr = 0;\n\n virtio_update_irq(vdev);\n\n break;\n\n default:\n\n break;\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "6c18f1cda2e2b2471ebf75d30d552cb0cb61b6ad", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,9 +9,9 @@\n else {\n \n list_fmts(av_get_sample_fmt_string, AV_SAMPLE_FMT_NB);\n+\n+ ffmpeg_exit(0);\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void opt_audio_sample_fmt(const char *arg)\n\n{\n\n if (strcmp(arg, \"list\"))\n\n audio_sample_fmt = av_get_sample_fmt(arg);\n\n else {\n\n list_fmts(av_get_sample_fmt_string, AV_SAMPLE_FMT_NB);\n\n ffmpeg_exit(0);\n\n }\n\n}\n"}} {"sample_id": "b769d8fef6c06ddb39ef0337882a4f8872b9c2bc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n cpu_exec_init();\n \n+\n+\n+ env = qemu_mallocz(sizeof(CPUPPCState));\n+\n+ if (!env)\n \n return NULL;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "CPUPPCState *cpu_ppc_init(void)\n\n{\n\n CPUPPCState *env;\n\n\n\n cpu_exec_init();\n\n\n\n env = qemu_mallocz(sizeof(CPUPPCState));\n\n if (!env)\n\n return NULL;\n\n#if !defined(CONFIG_USER_ONLY) && defined (USE_OPEN_FIRMWARE)\n\n setup_machine(env, 0);\n\n#else\n\n// env->spr[PVR] = 0; /* Basic PPC */\n\n env->spr[PVR] = 0x00080100; /* G3 CPU */\n\n// env->spr[PVR] = 0x00083100; /* MPC755 (G3 embedded) */\n\n// env->spr[PVR] = 0x00070100; /* IBM 750FX */\n\n#endif\n\n tlb_flush(env, 1);\n\n#if defined (DO_SINGLE_STEP)\n\n /* Single step trace mode */\n\n msr_se = 1;\n\n#endif\n\n msr_fp = 1; /* Allow floating point exceptions */\n\n msr_me = 1; /* Allow machine check exceptions */\n\n#if defined(CONFIG_USER_ONLY)\n\n msr_pr = 1;\n\n cpu_ppc_register(env, 0x00080000);\n\n#else\n\n env->nip = 0xFFFFFFFC;\n\n#endif\n\n env->access_type = ACCESS_INT;\n\n cpu_single_env = env;\n\n return env;\n\n}\n"}} {"sample_id": "64607d088132abdb25bf30d93e97d0c8df7b364c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ return strstart(prop->type, \"link<\", NULL);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline bool object_property_is_link(ObjectProperty *prop)\n\n{\n\n return strstart(prop->type, \"link<\", NULL);\n\n}\n"}} {"sample_id": "03ce574442d2ee82f59a5232a24492ad80858d75", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n int net_init_vhost_user(const NetClientOptions *opts, const char *name,\n \n+ NetClientState *peer)\n+\n {\n \n return net_vhost_user_init(peer, \"vhost_user\", 0, 0, 0);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int net_init_vhost_user(const NetClientOptions *opts, const char *name,\n\n NetClientState *peer)\n\n{\n\n return net_vhost_user_init(peer, \"vhost_user\", 0, 0, 0);\n\n}\n"}} {"sample_id": "537b41f5013e1951fa15e8f18855b18d76124ce4_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,10 +5,10 @@\n {\n \n /* If the address-part contains a colon, it's an IPv6 IP so needs [] */\n+\n+ if (strstr(address, \":\")) {\n+\n+ snprintf(buf, len, \"[%s]:%u\", address, port);\n \n } else {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void combine_addr(char *buf, size_t len, const char* address,\n\n uint16_t port)\n\n{\n\n /* If the address-part contains a colon, it's an IPv6 IP so needs [] */\n\n if (strstr(address, \":\")) {\n\n snprintf(buf, len, \"[%s]:%u\", address, port);\n\n } else {\n\n snprintf(buf, len, \"%s:%u\", address, port);\n\n }\n\n}\n"}} {"sample_id": "0b8b8753e4d94901627b3e86431230f2319215c4_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,8 +7,8 @@\n {\n \n Coroutine *co;\n+\n+ BlockAIOCBCoroutine *acb;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "BlockAIOCB *bdrv_aio_discard(BlockDriverState *bs,\n\n int64_t sector_num, int nb_sectors,\n\n BlockCompletionFunc *cb, void *opaque)\n\n{\n\n Coroutine *co;\n\n BlockAIOCBCoroutine *acb;\n\n\n\n trace_bdrv_aio_discard(bs, sector_num, nb_sectors, opaque);\n\n\n\n acb = qemu_aio_get(&bdrv_em_co_aiocb_info, bs, cb, opaque);\n\n acb->need_bh = true;\n\n acb->req.error = -EINPROGRESS;\n\n acb->req.sector = sector_num;\n\n acb->req.nb_sectors = nb_sectors;\n\n co = qemu_coroutine_create(bdrv_aio_discard_co_entry);\n\n qemu_coroutine_enter(co, acb);\n\n\n\n bdrv_co_maybe_schedule_bh(acb);\n\n return &acb->common;\n\n}\n"}} {"sample_id": "237d78f8fc62e62f62246883ecf62e44ed35fb80_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n int64_t bdrv_get_block_status(BlockDriverState *bs,\n \n+ int64_t sector_num,\n+\n+ int nb_sectors, int *pnum,\n \n BlockDriverState **file)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int64_t bdrv_get_block_status(BlockDriverState *bs,\n\n int64_t sector_num,\n\n int nb_sectors, int *pnum,\n\n BlockDriverState **file)\n\n{\n\n return bdrv_get_block_status_above(bs, backing_bs(bs),\n\n sector_num, nb_sectors, pnum, file);\n\n}\n"}} {"sample_id": "b946a1533209f61a93e34898aebb5b43154b99c3_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n const char *model,\n \n+ const char *name,\n \n int fd)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static TAPState *net_tap_fd_init(VLANState *vlan,\n\n const char *model,\n\n const char *name,\n\n int fd)\n\n{\n\n TAPState *s;\n\n\n\n s = qemu_mallocz(sizeof(TAPState));\n\n s->fd = fd;\n\n s->vc = qemu_new_vlan_client(vlan, model, name, tap_receive, NULL, s);\n\n s->vc->fd_readv = tap_receive_iov;\n\n qemu_set_fd_handler(s->fd, tap_send, NULL, s);\n\n snprintf(s->vc->info_str, sizeof(s->vc->info_str), \"fd=%d\", fd);\n\n return s;\n\n}\n"}} {"sample_id": "6df5718bd3ec56225c44cf96440c723c1b611b87_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,26 +1,26 @@\n+static MegasasCmd *megasas_next_frame(MegasasState *s,\n+\n+ hwaddr frame)\n+\n+{\n+\n+ MegasasCmd *cmd = NULL;\n \n+ int num = 0, index;\n+\n+\n+\n+ cmd = megasas_lookup_frame(s, frame);\n+\n if (cmd) {\n+\n+ trace_megasas_qf_found(cmd->index, cmd->pa);\n \n+ return cmd;\n+\n }\n+\n+ index = s->reply_queue_head;\n \n num = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static MegasasCmd *megasas_next_frame(MegasasState *s,\n\n hwaddr frame)\n\n{\n\n MegasasCmd *cmd = NULL;\n\n int num = 0, index;\n\n\n\n cmd = megasas_lookup_frame(s, frame);\n\n if (cmd) {\n\n trace_megasas_qf_found(cmd->index, cmd->pa);\n\n return cmd;\n\n }\n\n index = s->reply_queue_head;\n\n num = 0;\n\n while (num < s->fw_cmds) {\n\n if (!s->frames[index].pa) {\n\n cmd = &s->frames[index];\n\n break;\n\n }\n\n index = megasas_next_index(s, index, s->fw_cmds);\n\n num++;\n\n }\n\n if (!cmd) {\n\n trace_megasas_qf_failed(frame);\n\n }\n\n trace_megasas_qf_new(index, cmd);\n\n return cmd;\n\n}\n"}} {"sample_id": "e248522d1b0d6dd8641f382cd5c4338d0ecd98e5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static int decode_styl(const uint8_t *tsmb, MovTextContext *m, AVPacket *avpkt)\n \n+{\n \n+ int i;\n \n m->style_entries = AV_RB16(tsmb);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int decode_styl(const uint8_t *tsmb, MovTextContext *m, AVPacket *avpkt)\n\n{\n\n int i;\n\n m->style_entries = AV_RB16(tsmb);\n\n tsmb += 2;\n\n // A single style record is of length 12 bytes.\n\n if (m->tracksize + m->size_var + 2 + m->style_entries * 12 > avpkt->size)\n\n return -1;\n\n\n\n m->box_flags |= STYL_BOX;\n\n for(i = 0; i < m->style_entries; i++) {\n\n m->s_temp = av_malloc(sizeof(*m->s_temp));\n\n if (!m->s_temp) {\n\n mov_text_cleanup(m);\n\n return AVERROR(ENOMEM);\n\n }\n\n m->s_temp->style_start = AV_RB16(tsmb);\n\n tsmb += 2;\n\n m->s_temp->style_end = AV_RB16(tsmb);\n\n tsmb += 2;\n\n m->s_temp->style_fontID = AV_RB16(tsmb);\n\n tsmb += 2;\n\n m->s_temp->style_flag = AV_RB8(tsmb);\n\n tsmb++;\n\n m->s_temp->fontsize = AV_RB8(tsmb);\n\n av_dynarray_add(&m->s, &m->count_s, m->s_temp);\n\n if(!m->s) {\n\n mov_text_cleanup(m);\n\n return AVERROR(ENOMEM);\n\n }\n\n tsmb++;\n\n // text-color-rgba\n\n tsmb += 4;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "5c55ff99fa88158871d5b9f619c485deae5f3d5b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n tcg_gen_ld_tl(t, cpu_env, offsetof(CPUState, spr[reg]));\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static always_inline void gen_load_spr(TCGv t, int reg)\n\n{\n\n tcg_gen_ld_tl(t, cpu_env, offsetof(CPUState, spr[reg]));\n\n}\n"}} {"sample_id": "8b3b720620a1137a1b794fc3ed64734236f94e06_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n BDRVQcowState *s = bs->opaque;\n \n size_t size = s->cluster_size;\n+\n \n \n if (s->refcount_block_cache_offset == 0) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int write_refcount_block(BlockDriverState *bs)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n size_t size = s->cluster_size;\n\n\n\n if (s->refcount_block_cache_offset == 0) {\n\n return 0;\n\n }\n\n\n\n BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_UPDATE);\n\n if (bdrv_pwrite(bs->file, s->refcount_block_cache_offset,\n\n s->refcount_block_cache, size) != size)\n\n {\n\n return -EIO;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "b8b8e82ea14016b2cb04b49ecea57f836e6ee7f8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n const DNXHDContext *ctx = avctx->priv_data;\n \n+ uint32_t offset = ctx->mb_scan_index[rownb];\n \n RowContext *row = ctx->rows + threadnb;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int dnxhd_decode_row(AVCodecContext *avctx, void *data,\n\n int rownb, int threadnb)\n\n{\n\n const DNXHDContext *ctx = avctx->priv_data;\n\n uint32_t offset = ctx->mb_scan_index[rownb];\n\n RowContext *row = ctx->rows + threadnb;\n\n int x;\n\n\n\n row->last_dc[0] =\n\n row->last_dc[1] =\n\n row->last_dc[2] = 1 << (ctx->bit_depth + 2); // for levels +2^(bitdepth-1)\n\n init_get_bits(&row->gb, ctx->buf + offset, (ctx->buf_size - offset) << 3);\n\n for (x = 0; x < ctx->mb_width; x++) {\n\n //START_TIMER;\n\n dnxhd_decode_macroblock(ctx, row, data, x, rownb);\n\n //STOP_TIMER(\"decode macroblock\");\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_30", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void bdrv_throttle_read_timer_cb(void *opaque)\n+\n {\n \n BlockDriverState *bs = opaque;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bdrv_throttle_read_timer_cb(void *opaque)\n\n{\n\n BlockDriverState *bs = opaque;\n\n qemu_co_enter_next(&bs->throttled_reqs[0]);\n\n}\n"}} {"sample_id": "0ac0703107c12bc78ea2853877a38a2a7384789a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n new_pkt.destruct= av_destruct_packet;\n \n+ }\n+\n+ *pkt= new_pkt;\n+\n+\n \n bsfc= bsfc->next;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void write_frame(AVFormatContext *s, AVPacket *pkt, AVCodecContext *avctx, AVBitStreamFilterContext *bsfc){\n\n while(bsfc){\n\n AVPacket new_pkt= *pkt;\n\n int a= av_bitstream_filter_filter(bsfc, avctx, NULL,\n\n &new_pkt.data, &new_pkt.size,\n\n pkt->data, pkt->size,\n\n pkt->flags & PKT_FLAG_KEY);\n\n if(a){\n\n av_free_packet(pkt);\n\n new_pkt.destruct= av_destruct_packet;\n\n }\n\n *pkt= new_pkt;\n\n\n\n bsfc= bsfc->next;\n\n }\n\n\n\n av_interleaved_write_frame(s, pkt);\n\n}\n"}} {"sample_id": "6e42e6c4b410dbef8b593c2d796a5dad95f89ee4_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,20 +1,20 @@\n void rgb16tobgr32(const uint8_t *src, uint8_t *dst, long src_size)\n+\n+{\n+\n+\tconst uint16_t *end;\n+\n+\tuint8_t *d = (uint8_t *)dst;\n+\n+\tconst uint16_t *s = (uint16_t *)src;\n+\n+\tend = s + src_size/2;\n+\n+\twhile(s < end)\n \n \t{\n \n+\t\tregister uint16_t bgr;\n \n \t\tbgr = *s++;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void rgb16tobgr32(const uint8_t *src, uint8_t *dst, long src_size)\n\n{\n\n\tconst uint16_t *end;\n\n\tuint8_t *d = (uint8_t *)dst;\n\n\tconst uint16_t *s = (uint16_t *)src;\n\n\tend = s + src_size/2;\n\n\twhile(s < end)\n\n\t{\n\n\t\tregister uint16_t bgr;\n\n\t\tbgr = *s++;\n\n\t\t#ifdef WORDS_BIGENDIAN\n\n\t\t\t*d++ = 0;\n\n\t\t\t*d++ = (bgr&0x1F)<<3;\n\n\t\t\t*d++ = (bgr&0x7E0)>>3;\n\n\t\t\t*d++ = (bgr&0xF800)>>8;\n\n\t\t#else\n\n\t\t\t*d++ = (bgr&0xF800)>>8;\n\n\t\t\t*d++ = (bgr&0x7E0)>>3;\n\n\t\t\t*d++ = (bgr&0x1F)<<3;\n\n\t\t\t*d++ = 0;\n\n\t\t#endif\n\n\t}\n\n}\n"}} {"sample_id": "1bfb4587a2e5b25ed15f742149e555efc8f305ae", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void ERROR(const char *str)\n+\n+{\n \n fprintf(stderr, \"%s\\n\", str);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void ERROR(const char *str)\n\n{\n\n fprintf(stderr, \"%s\\n\", str);\n\n exit(1);\n\n}\n"}} {"sample_id": "cb72cba83021fa42719e73a5249c12096a4d1cfc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n \n \n /* PIO data access allowed only when DRQ bit is set. The result of a read\n+\n * during PIO in is indeterminate, return 0 and don't move forward. */\n \n if (!(s->status & DRQ_STAT) || !ide_is_pio_out(s)) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "uint32_t ide_data_readw(void *opaque, uint32_t addr)\n\n{\n\n IDEBus *bus = opaque;\n\n IDEState *s = idebus_active_if(bus);\n\n uint8_t *p;\n\n int ret;\n\n\n\n /* PIO data access allowed only when DRQ bit is set. The result of a read\n\n * during PIO in is indeterminate, return 0 and don't move forward. */\n\n if (!(s->status & DRQ_STAT) || !ide_is_pio_out(s)) {\n\n return 0;\n\n }\n\n\n\n p = s->data_ptr;\n\n if (p + 2 > s->data_end) {\n\n return 0;\n\n }\n\n\n\n ret = cpu_to_le16(*(uint16_t *)p);\n\n p += 2;\n\n s->data_ptr = p;\n\n if (p >= s->data_end)\n\n s->end_transfer_func(s);\n\n return ret;\n\n}\n"}} {"sample_id": "8bd6b06d7b718b3e595aab279699ef3651ce2e48", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n if (index >= MAX_CONSOLES)\n \n+ return;\n \n if (active_console) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void console_select(unsigned int index)\n\n{\n\n TextConsole *s;\n\n\n\n if (index >= MAX_CONSOLES)\n\n return;\n\n if (active_console) {\n\n active_console->g_width = ds_get_width(active_console->ds);\n\n active_console->g_height = ds_get_height(active_console->ds);\n\n }\n\n s = consoles[index];\n\n if (s) {\n\n DisplayState *ds = s->ds;\n\n\n\n if (active_console->cursor_timer) {\n\n qemu_del_timer(active_console->cursor_timer);\n\n }\n\n active_console = s;\n\n if (ds_get_bits_per_pixel(s->ds)) {\n\n ds->surface = qemu_resize_displaysurface(ds, s->g_width, s->g_height);\n\n } else {\n\n s->ds->surface->width = s->width;\n\n s->ds->surface->height = s->height;\n\n }\n\n if (s->cursor_timer) {\n\n qemu_mod_timer(s->cursor_timer,\n\n qemu_get_clock_ms(rt_clock) + CONSOLE_CURSOR_PERIOD / 2);\n\n }\n\n dpy_resize(s->ds);\n\n vga_hw_invalidate();\n\n }\n\n}\n"}} {"sample_id": "c3671e1d5760d79c083e7565d951f4628c06cf41", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void ff_riff_write_info_tag(AVIOContext *pb, const char *tag, const char *str)\n+\n+{\n \n int len = strlen(str);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void ff_riff_write_info_tag(AVIOContext *pb, const char *tag, const char *str)\n\n{\n\n int len = strlen(str);\n\n if (len > 0) {\n\n len++;\n\n ffio_wfourcc(pb, tag);\n\n avio_wl32(pb, len);\n\n avio_put_str(pb, str);\n\n if (len & 1)\n\n avio_w8(pb, 0);\n\n }\n\n}\n"}} {"sample_id": "ccb8f674995ded871ac725833b5efefce0ad63de", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n int ret;\n \n+\n+\n+ ret = avformat_alloc_output_context2(&wc->avf, wc->oformat, NULL, NULL);\n+\n if (ret < 0)\n \n return ret;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int chunk_mux_init(AVFormatContext *s)\n\n{\n\n WebMChunkContext *wc = s->priv_data;\n\n AVFormatContext *oc;\n\n int ret;\n\n\n\n ret = avformat_alloc_output_context2(&wc->avf, wc->oformat, NULL, NULL);\n\n if (ret < 0)\n\n return ret;\n\n oc = wc->avf;\n\n\n\n oc->interrupt_callback = s->interrupt_callback;\n\n oc->max_delay = s->max_delay;\n\n av_dict_copy(&oc->metadata, s->metadata, 0);\n\n\n\n oc->priv_data = av_mallocz(oc->oformat->priv_data_size);\n\n if (!oc->priv_data) {\n\n avio_close(oc->pb);\n\n return AVERROR(ENOMEM);\n\n }\n\n *(const AVClass**)oc->priv_data = oc->oformat->priv_class;\n\n av_opt_set_defaults(oc->priv_data);\n\n av_opt_set_int(oc->priv_data, \"dash\", 1, 0);\n\n av_opt_set_int(oc->priv_data, \"cluster_time_limit\", wc->chunk_duration, 0);\n\n av_opt_set_int(oc->priv_data, \"live\", 1, 0);\n\n\n\n oc->streams = s->streams;\n\n oc->nb_streams = s->nb_streams;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "27bb0b2d6f80f058bdb6fcc8fcdfa69b0c8a6d71", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static uint32_t timer_int_route(struct HPETTimer *timer)\n+\n+{\n+\n uint32_t route;\n \n route = (timer->config & HPET_TN_INT_ROUTE_MASK) >> HPET_TN_INT_ROUTE_SHIFT;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint32_t timer_int_route(struct HPETTimer *timer)\n\n{\n\n uint32_t route;\n\n route = (timer->config & HPET_TN_INT_ROUTE_MASK) >> HPET_TN_INT_ROUTE_SHIFT;\n\n return route;\n\n}\n"}} {"sample_id": "d0d7708ba29cbcc343364a46bff981e0ff88366f_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -37,11 +37,11 @@\n }\n \n \n+\n+ d->prod = 0;\n+\n+ d->cons = 0;\n+\n d->cbuf = g_malloc0(d->size);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static CharDriverState *qemu_chr_open_ringbuf(const char *id,\n\n ChardevBackend *backend,\n\n ChardevReturn *ret,\n\n Error **errp)\n\n{\n\n ChardevRingbuf *opts = backend->u.ringbuf;\n\n CharDriverState *chr;\n\n RingBufCharDriver *d;\n\n\n\n chr = qemu_chr_alloc();\n\n d = g_malloc(sizeof(*d));\n\n\n\n d->size = opts->has_size ? opts->size : 65536;\n\n\n\n /* The size must be power of 2 */\n\n if (d->size & (d->size - 1)) {\n\n error_setg(errp, \"size of ringbuf chardev must be power of two\");\n\n goto fail;\n\n }\n\n\n\n d->prod = 0;\n\n d->cons = 0;\n\n d->cbuf = g_malloc0(d->size);\n\n\n\n chr->opaque = d;\n\n chr->chr_write = ringbuf_chr_write;\n\n chr->chr_close = ringbuf_chr_close;\n\n\n\n return chr;\n\n\n\nfail:\n\n g_free(d);\n\n g_free(chr);\n\n return NULL;\n\n}\n"}} {"sample_id": "802713c4e7b41bc2deed754d78649945c3442063", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,8 +6,8 @@\n \n MSS12Context *c = &ctx->c;\n \n+ int ret;\n+\n c->avctx = avctx;\n \n avctx->coded_frame = &ctx->pic;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static av_cold int mss2_decode_init(AVCodecContext *avctx)\n\n{\n\n MSS2Context * const ctx = avctx->priv_data;\n\n MSS12Context *c = &ctx->c;\n\n int ret;\n\n c->avctx = avctx;\n\n avctx->coded_frame = &ctx->pic;\n\n if (ret = ff_mss12_decode_init(c, 1, &ctx->sc[0], &ctx->sc[1]))\n\n return ret;\n\n c->pal_stride = c->mask_stride;\n\n c->pal_pic = av_malloc(c->pal_stride * avctx->height);\n\n c->last_pal_pic = av_malloc(c->pal_stride * avctx->height);\n\n if (!c->pal_pic || !c->last_pal_pic) {\n\n mss2_decode_end(avctx);\n\n return AVERROR(ENOMEM);\n\n }\n\n if (ret = wmv9_init(avctx)) {\n\n mss2_decode_end(avctx);\n\n return ret;\n\n }\n\n ff_mss2dsp_init(&ctx->dsp);\n\n\n\n avctx->pix_fmt = c->free_colours == 127 ? AV_PIX_FMT_RGB555\n\n : AV_PIX_FMT_RGB24;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "f090c9d4ad5812fb92843d6470a1111c15190c4c_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n if (!float64_is_nan(src0)\n \n+ && !float64_is_nan(src1)) {\n+\n+ res = 0;\n+\n+ if (float64_lt_quiet(src0, res, &env->fp_status))\n \n res = float64_chs(res);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "float64 helper_sub_cmpf64(CPUM68KState *env, float64 src0, float64 src1)\n\n{\n\n /* ??? This may incorrectly raise exceptions. */\n\n /* ??? Should flush denormals to zero. */\n\n float64 res;\n\n res = float64_sub(src0, src1, &env->fp_status);\n\n if (float64_is_nan(res)) {\n\n /* +/-inf compares equal against itself, but sub returns nan. */\n\n if (!float64_is_nan(src0)\n\n && !float64_is_nan(src1)) {\n\n res = 0;\n\n if (float64_lt_quiet(src0, res, &env->fp_status))\n\n res = float64_chs(res);\n\n }\n\n }\n\n return res;\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n if (bs && qdev_prop_set_drive(dev, \"drive\", bs)) {\n \n abort();\n+\n+ }\n+\n+ qdev_prop_set_uint32(dev, \"num-blocks\", nb_blocs);\n+\n qdev_prop_set_uint32(dev, \"sector-length\", sector_len);\n \n qdev_prop_set_uint8(dev, \"width\", width);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "type_init(pflash_cfi02_register_types)\n\n\n\npflash_t *pflash_cfi02_register(hwaddr base,\n\n DeviceState *qdev, const char *name,\n\n hwaddr size,\n\n BlockDriverState *bs, uint32_t sector_len,\n\n int nb_blocs, int nb_mappings, int width,\n\n uint16_t id0, uint16_t id1,\n\n uint16_t id2, uint16_t id3,\n\n uint16_t unlock_addr0, uint16_t unlock_addr1,\n\n int be)\n\n{\n\n DeviceState *dev = qdev_create(NULL, TYPE_CFI_PFLASH02);\n\n\n\n if (bs && qdev_prop_set_drive(dev, \"drive\", bs)) {\n\n abort();\n\n }\n\n qdev_prop_set_uint32(dev, \"num-blocks\", nb_blocs);\n\n qdev_prop_set_uint32(dev, \"sector-length\", sector_len);\n\n qdev_prop_set_uint8(dev, \"width\", width);\n\n qdev_prop_set_uint8(dev, \"mappings\", nb_mappings);\n\n qdev_prop_set_uint8(dev, \"big-endian\", !!be);\n\n qdev_prop_set_uint16(dev, \"id0\", id0);\n\n qdev_prop_set_uint16(dev, \"id1\", id1);\n\n qdev_prop_set_uint16(dev, \"id2\", id2);\n\n qdev_prop_set_uint16(dev, \"id3\", id3);\n\n qdev_prop_set_uint16(dev, \"unlock-addr0\", unlock_addr0);\n\n qdev_prop_set_uint16(dev, \"unlock-addr1\", unlock_addr1);\n\n qdev_prop_set_string(dev, \"name\", name);\n\n qdev_init_nofail(dev);\n\n\n\n sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);\n\n return CFI_PFLASH02(dev);\n\n}\n"}} {"sample_id": "6021615bbe393381f23b34a7cd0dcfd1a42687ba_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void hscroll(AVCodecContext *avctx)\n \n {\n+\n+ AnsiContext *s = avctx->priv_data;\n+\n+ int i;\n+\n \n \n if (s->y < avctx->height - s->font_height) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void hscroll(AVCodecContext *avctx)\n\n{\n\n AnsiContext *s = avctx->priv_data;\n\n int i;\n\n\n\n if (s->y < avctx->height - s->font_height) {\n\n s->y += s->font_height;\n\n return;\n\n }\n\n\n\n i = 0;\n\n for (; i < avctx->height - s->font_height; i++)\n\n memcpy(s->frame->data[0] + i * s->frame->linesize[0],\n\n s->frame->data[0] + (i + s->font_height) * s->frame->linesize[0],\n\n avctx->width);\n\n for (; i < avctx->height; i++)\n\n memset(s->frame->data[0] + i * s->frame->linesize[0],\n\n DEFAULT_BG_COLOR, avctx->width);\n\n}\n"}} {"sample_id": "ce5b1bbf624b977a55ff7f85bb3871682d03baff_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n CPUState *cs = CPU(obj);\n+\n AlphaCPU *cpu = ALPHA_CPU(obj);\n \n CPUAlphaState *env = &cpu->env;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void alpha_cpu_initfn(Object *obj)\n\n{\n\n CPUState *cs = CPU(obj);\n\n AlphaCPU *cpu = ALPHA_CPU(obj);\n\n CPUAlphaState *env = &cpu->env;\n\n\n\n cs->env_ptr = env;\n\n cpu_exec_init(cs, &error_abort);\n\n tlb_flush(cs, 1);\n\n\n\n alpha_translate_init();\n\n\n\n#if defined(CONFIG_USER_ONLY)\n\n env->ps = PS_USER_MODE;\n\n cpu_alpha_store_fpcr(env, (FPCR_INVD | FPCR_DZED | FPCR_OVFD\n\n | FPCR_UNFD | FPCR_INED | FPCR_DNOD\n\n | FPCR_DYN_NORMAL));\n\n#endif\n\n env->lock_addr = -1;\n\n env->fen = 1;\n\n}\n"}} {"sample_id": "66dc50f7057b9a0191f54e55764412202306858d_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,28 +1,28 @@\n void ioinst_handle_rsch(S390CPU *cpu, uint64_t reg1)\n \n {\n+\n+ int cssid, ssid, schid, m;\n \n SubchDev *sch;\n \n int ret = -ENODEV;\n \n int cc;\n+\n+\n \n+ if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {\n+\n+ program_interrupt(&cpu->env, PGM_OPERAND, 4);\n+\n return;\n+\n }\n+\n trace_ioinst_sch_id(\"rsch\", cssid, ssid, schid);\n \n+ sch = css_find_subch(m, cssid, ssid, schid);\n \n if (sch && css_subch_visible(sch)) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void ioinst_handle_rsch(S390CPU *cpu, uint64_t reg1)\n\n{\n\n int cssid, ssid, schid, m;\n\n SubchDev *sch;\n\n int ret = -ENODEV;\n\n int cc;\n\n\n\n if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {\n\n program_interrupt(&cpu->env, PGM_OPERAND, 4);\n\n return;\n\n }\n\n trace_ioinst_sch_id(\"rsch\", cssid, ssid, schid);\n\n sch = css_find_subch(m, cssid, ssid, schid);\n\n if (sch && css_subch_visible(sch)) {\n\n ret = css_do_rsch(sch);\n\n }\n\n switch (ret) {\n\n case -ENODEV:\n\n cc = 3;\n\n break;\n\n case -EINVAL:\n\n cc = 2;\n\n break;\n\n case 0:\n\n cc = 0;\n\n break;\n\n default:\n\n cc = 1;\n\n break;\n\n }\n\n setcc(cpu, cc);\n\n}\n"}} {"sample_id": "69179fe2fc0b91f68699012ba72d329e74ff629e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void test_reconnect(void)\n+\n+{\n+\n gchar *path = g_strdup_printf(\"/%s/vhost-user/reconnect/subprocess\",\n \n qtest_get_arch());", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void test_reconnect(void)\n\n{\n\n gchar *path = g_strdup_printf(\"/%s/vhost-user/reconnect/subprocess\",\n\n qtest_get_arch());\n\n g_test_trap_subprocess(path, 0, 0);\n\n g_test_trap_assert_passed();\n\n\n}"}} {"sample_id": "5e53486545726987ab4482321d4dcf7e23e7652f_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n inited = 1;\n \n \n+\n+ /* devices */\n+\n+ REGISTER_MUXDEMUX (AUDIO_BEOS, audio_beos);\n+\n REGISTER_DEMUXER (BKTR, bktr);\n \n REGISTER_DEMUXER (DV1394, dv1394);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void avdevice_register_all(void)\n\n{\n\n static int inited;\n\n\n\n if (inited)\n\n return;\n\n inited = 1;\n\n\n\n /* devices */\n\n REGISTER_MUXDEMUX (AUDIO_BEOS, audio_beos);\n\n REGISTER_DEMUXER (BKTR, bktr);\n\n REGISTER_DEMUXER (DV1394, dv1394);\n\n REGISTER_MUXDEMUX (OSS, oss);\n\n REGISTER_DEMUXER (V4L2, v4l2);\n\n REGISTER_DEMUXER (V4L, v4l);\n\n REGISTER_DEMUXER (X11_GRAB_DEVICE, x11_grab_device);\n\n\n\n /* external libraries */\n\n REGISTER_DEMUXER (LIBDC1394, libdc1394);\n\n}\n"}} {"sample_id": "8425d693eefbedbb41f91735614d41067695aa37", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static int flac_probe(AVProbeData *p)\n+\n+{\n+\n+ uint8_t *bufptr = p->buf;\n \n uint8_t *end = p->buf + p->buf_size;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int flac_probe(AVProbeData *p)\n\n{\n\n uint8_t *bufptr = p->buf;\n\n uint8_t *end = p->buf + p->buf_size;\n\n\n\n if(bufptr > end-4 || memcmp(bufptr, \"fLaC\", 4)) return 0;\n\n else return AVPROBE_SCORE_MAX/2;\n\n}\n"}} {"sample_id": "1e9737da4aafb54681203931dfe8f8eea21fcef7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -58,11 +58,11 @@\n \n return -1;\n \n+ }\n+\n+\n+\n+ t->timer = host_timer;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int dynticks_start_timer(struct qemu_alarm_timer *t)\n\n{\n\n struct sigevent ev;\n\n timer_t host_timer;\n\n struct sigaction act;\n\n\n\n sigfillset(&act.sa_mask);\n\n act.sa_flags = 0;\n\n act.sa_handler = host_alarm_handler;\n\n\n\n sigaction(SIGALRM, &act, NULL);\n\n\n\n /* \n\n * Initialize ev struct to 0 to avoid valgrind complaining\n\n * about uninitialized data in timer_create call\n\n */\n\n memset(&ev, 0, sizeof(ev));\n\n ev.sigev_value.sival_int = 0;\n\n ev.sigev_notify = SIGEV_SIGNAL;\n\n#ifdef SIGEV_THREAD_ID\n\n if (qemu_signalfd_available()) {\n\n ev.sigev_notify = SIGEV_THREAD_ID;\n\n ev._sigev_un._tid = qemu_get_thread_id();\n\n }\n\n#endif /* SIGEV_THREAD_ID */\n\n ev.sigev_signo = SIGALRM;\n\n\n\n if (timer_create(CLOCK_REALTIME, &ev, &host_timer)) {\n\n perror(\"timer_create\");\n\n return -1;\n\n }\n\n\n\n t->timer = host_timer;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "7cc84d241ba6ef8e27e4d057176a4ad385ad3d59_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,18 +1,18 @@\n+int decode_luma_intra_block(VC9Context *v, int mquant)\n+\n+{\n+\n+ GetBitContext *gb = &v->s.gb;\n \n+ int dcdiff;\n+\n+\n \n dcdiff = get_vlc2(gb, v->luma_dc_vlc->table,\n+\n+ DC_VLC_BITS, 2);\n \n+ if (dcdiff)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "int decode_luma_intra_block(VC9Context *v, int mquant)\n\n{\n\n GetBitContext *gb = &v->s.gb;\n\n int dcdiff;\n\n\n\n dcdiff = get_vlc2(gb, v->luma_dc_vlc->table,\n\n DC_VLC_BITS, 2);\n\n if (dcdiff)\n\n {\n\n if (dcdiff == 119 /* ESC index value */)\n\n {\n\n /* TODO: Optimize */\n\n if (mquant == 1) dcdiff = get_bits(gb, 10);\n\n else if (mquant == 2) dcdiff = get_bits(gb, 9);\n\n else dcdiff = get_bits(gb, 8);\n\n }\n\n else\n\n {\n\n if (mquant == 1)\n\n dcdiff = (dcdiff<<2) + get_bits(gb, 2) - 3;\n\n else if (mquant == 2)\n\n dcdiff = (dcdiff<<1) + get_bits(gb, 1) - 1;\n\n }\n\n if (get_bits(gb, 1))\n\n dcdiff = -dcdiff;\n\n }\n\n /* FIXME: 8.1.1.15, p(1)13, coeff scaling for Adv Profile */\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "4282c8277013dc5613b8f27845f6121b66b7cbff", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n QEMUPutKbdEntry *entry = QTAILQ_FIRST(&kbd_handlers);\n+\n \n \n if (!runstate_is_running() && !runstate_check(RUN_STATE_SUSPENDED)) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void kbd_put_keycode(int keycode)\n\n{\n\n QEMUPutKbdEntry *entry = QTAILQ_FIRST(&kbd_handlers);\n\n\n\n if (!runstate_is_running() && !runstate_check(RUN_STATE_SUSPENDED)) {\n\n return;\n\n }\n\n if (entry) {\n\n entry->put_kbd(entry->opaque, keycode);\n\n }\n\n}\n"}} {"sample_id": "c5b934303cf83fe3dda31e8d3e5778458c8a9eeb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n DeviceState *dev, Error **errp)\n {\n MachineState *ms = MACHINE(hotplug_dev);\n+ S390CPU *cpu = S390_CPU(dev);\n g_assert(!ms->possible_cpus->cpus[cpu->env.core_id].cpu);\n ms->possible_cpus->cpus[cpu->env.core_id].cpu = OBJECT(dev);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void s390_cpu_plug(HotplugHandler *hotplug_dev,\n DeviceState *dev, Error **errp)\n{\n MachineState *ms = MACHINE(hotplug_dev);\n S390CPU *cpu = S390_CPU(dev);\n g_assert(!ms->possible_cpus->cpus[cpu->env.core_id].cpu);\n ms->possible_cpus->cpus[cpu->env.core_id].cpu = OBJECT(dev);"}} {"sample_id": "f7c31d6381f2cbac03e82fc23133f6863606edd8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n int net_handle_fd_param(Monitor *mon, const char *param)\n+\n+{\n \n if (!qemu_isdigit(param[0])) {\n \n int fd;\n \n+\n \n+ fd = monitor_get_fd(mon, param);\n \n if (fd == -1) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int net_handle_fd_param(Monitor *mon, const char *param)\n\n{\n\n if (!qemu_isdigit(param[0])) {\n\n int fd;\n\n\n\n fd = monitor_get_fd(mon, param);\n\n if (fd == -1) {\n\n error_report(\"No file descriptor named %s found\", param);\n\n return -1;\n\n }\n\n\n\n return fd;\n\n } else {\n\n return strtol(param, NULL, 0);\n\n }\n\n}\n"}} {"sample_id": "6b5166f8a82888638bb9aba9dc49aa7fa25f292f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n xenstore = xs_daemon_open();\n \n+ if (!xenstore) {\n+\n xen_be_printf(NULL, 0, \"can't connect to xenstored\\n\");\n \n return -1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int xen_be_init(void)\n\n{\n\n xenstore = xs_daemon_open();\n\n if (!xenstore) {\n\n xen_be_printf(NULL, 0, \"can't connect to xenstored\\n\");\n\n return -1;\n\n }\n\n\n\n if (qemu_set_fd_handler(xs_fileno(xenstore), xenstore_update, NULL, NULL) < 0) {\n\n goto err;\n\n }\n\n\n\n if (xen_xc == XC_HANDLER_INITIAL_VALUE) {\n\n /* Check if xen_init() have been called */\n\n goto err;\n\n }\n\n return 0;\n\n\n\nerr:\n\n qemu_set_fd_handler(xs_fileno(xenstore), NULL, NULL, NULL);\n\n xs_daemon_close(xenstore);\n\n xenstore = NULL;\n\n\n\n return -1;\n\n}\n"}} {"sample_id": "ae2150680190e510dcbcdfdbfb3a54369c75367f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,7 +12,7 @@\n \n \n \n+ f = fopen(\"/proc/cpuinfo\", \"r\");\n \n if (!f) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int read_cpuinfo(const char *field, char *value, int len)\n\n{\n\n FILE *f;\n\n int ret = -1;\n\n int field_len = strlen(field);\n\n char line[512];\n\n\n\n f = fopen(\"/proc/cpuinfo\", \"r\");\n\n if (!f) {\n\n return -1;\n\n }\n\n\n\n do {\n\n if(!fgets(line, sizeof(line), f)) {\n\n break;\n\n }\n\n if (!strncmp(line, field, field_len)) {\n\n strncpy(value, line, len);\n\n ret = 0;\n\n break;\n\n }\n\n } while(*line);\n\n\n\n fclose(f);\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "62be4e3a5041e84304aa23637da623a205c53ecc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n new_block->host = host;\n \n if (host) {\n+\n+ new_block->flags |= RAM_PREALLOC;\n+\n+ }\n+\n addr = ram_block_add(new_block, &local_err);\n \n if (local_err) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "ram_addr_t qemu_ram_alloc_from_ptr(ram_addr_t size, void *host,\n\n MemoryRegion *mr, Error **errp)\n\n{\n\n RAMBlock *new_block;\n\n ram_addr_t addr;\n\n Error *local_err = NULL;\n\n\n\n size = TARGET_PAGE_ALIGN(size);\n\n new_block = g_malloc0(sizeof(*new_block));\n\n new_block->mr = mr;\n\n new_block->used_length = size;\n\n new_block->max_length = max_size;\n\n new_block->fd = -1;\n\n new_block->host = host;\n\n if (host) {\n\n new_block->flags |= RAM_PREALLOC;\n\n }\n\n addr = ram_block_add(new_block, &local_err);\n\n if (local_err) {\n\n g_free(new_block);\n\n error_propagate(errp, local_err);\n\n return -1;\n\n }\n\n return addr;\n\n}\n"}} {"sample_id": "fa365d7cd11185237471823a5a33d36765454e16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ AcpiPciHpState *s = opaque;\n \n uint32_t val = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint64_t pci_read(void *opaque, hwaddr addr, unsigned int size)\n\n{\n\n AcpiPciHpState *s = opaque;\n\n uint32_t val = 0;\n\n int bsel = s->hotplug_select;\n\n\n\n if (bsel < 0 || bsel > ACPI_PCIHP_MAX_HOTPLUG_BUS) {\n\n return 0;\n\n }\n\n\n\n switch (addr) {\n\n case PCI_UP_BASE:\n\n val = s->acpi_pcihp_pci_status[bsel].up;\n\n if (!s->legacy_piix) {\n\n s->acpi_pcihp_pci_status[bsel].up = 0;\n\n }\n\n ACPI_PCIHP_DPRINTF(\"pci_up_read %\" PRIu32 \"\\n\", val);\n\n break;\n\n case PCI_DOWN_BASE:\n\n val = s->acpi_pcihp_pci_status[bsel].down;\n\n ACPI_PCIHP_DPRINTF(\"pci_down_read %\" PRIu32 \"\\n\", val);\n\n break;\n\n case PCI_EJ_BASE:\n\n /* No feature defined yet */\n\n ACPI_PCIHP_DPRINTF(\"pci_features_read %\" PRIu32 \"\\n\", val);\n\n break;\n\n case PCI_RMV_BASE:\n\n val = s->acpi_pcihp_pci_status[bsel].hotplug_enable;\n\n ACPI_PCIHP_DPRINTF(\"pci_rmv_read %\" PRIu32 \"\\n\", val);\n\n break;\n\n case PCI_SEL_BASE:\n\n val = s->hotplug_select;\n\n ACPI_PCIHP_DPRINTF(\"pci_sel_read %\" PRIu32 \"\\n\", val);\n\n default:\n\n break;\n\n }\n\n\n\n return val;\n\n}\n"}} {"sample_id": "8692e6284f5169257a537c8fc25addf32fc67c87", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n \n \n int ret = avformat_open_input(&rdt->rmctx, \"\", &ff_rdt_demuxer, NULL);\n+\n+ if (ret < 0) {\n+\n+ av_free(rdt);\n+\n return NULL;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "rdt_new_context (void)\n\n{\n\n PayloadContext *rdt = av_mallocz(sizeof(PayloadContext));\n\n\n\n int ret = avformat_open_input(&rdt->rmctx, \"\", &ff_rdt_demuxer, NULL);\n\n if (ret < 0) {\n\n av_free(rdt);\n\n return NULL;\n\n }\n\n\n\n return rdt;\n\n}\n"}} {"sample_id": "f6774f905fb3cfdc319523ac640be30b14c1bc55_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,8 +3,8 @@\n {\n \n int hours, minutes, seconds;\n+\n+ int64_t time;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void mpeg4_encode_gop_header(MpegEncContext *s)\n\n{\n\n int hours, minutes, seconds;\n\n int64_t time;\n\n\n\n put_bits(&s->pb, 16, 0);\n\n put_bits(&s->pb, 16, GOP_STARTCODE);\n\n\n\n time = s->current_picture_ptr->f.pts;\n\n if (s->reordered_input_picture[1])\n\n time = FFMIN(time, s->reordered_input_picture[1]->f.pts);\n\n time = time * s->avctx->time_base.num;\n\n\n\n seconds = time / s->avctx->time_base.den;\n\n minutes = seconds / 60;\n\n seconds %= 60;\n\n hours = minutes / 60;\n\n minutes %= 60;\n\n hours %= 24;\n\n\n\n put_bits(&s->pb, 5, hours);\n\n put_bits(&s->pb, 6, minutes);\n\n put_bits(&s->pb, 1, 1);\n\n put_bits(&s->pb, 6, seconds);\n\n\n\n put_bits(&s->pb, 1, !!(s->flags & CODEC_FLAG_CLOSED_GOP));\n\n put_bits(&s->pb, 1, 0); // broken link == NO\n\n\n\n s->last_time_base = time / s->avctx->time_base.den;\n\n\n\n ff_mpeg4_stuffing(&s->pb);\n\n}\n"}} {"sample_id": "0dfabd39d523fc3f6f0f8c441f41c013cc429b52", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n sPAPRDRConnectorClass *drck;\n \n+\n+\n+ if (!drc) {\n+\n+ return RTAS_OUT_PARAM_ERROR;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t rtas_set_isolation_state(uint32_t idx, uint32_t state)\n\n{\n\n sPAPRDRConnector *drc = spapr_drc_by_index(idx);\n\n sPAPRDRConnectorClass *drck;\n\n\n\n if (!drc) {\n\n return RTAS_OUT_PARAM_ERROR;\n\n }\n\n\n\n drck = SPAPR_DR_CONNECTOR_GET_CLASS(drc);\n\n return drck->set_isolation_state(drc, state);\n\n}\n"}} {"sample_id": "d6604b29ef544793479d7fb4e05ef6622bb3e534_32", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n if (!avctx->coded_frame)\n \n return AVERROR(ENOMEM);\n+\n+\n+\n+ avctx->coded_frame->pict_type = AV_PICTURE_TYPE_I;\n+\n avctx->coded_frame->key_frame = 1;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int pam_encode_init(AVCodecContext *avctx)\n\n{\n\n avctx->coded_frame = av_frame_alloc();\n\n if (!avctx->coded_frame)\n\n return AVERROR(ENOMEM);\n\n\n\n avctx->coded_frame->pict_type = AV_PICTURE_TYPE_I;\n\n avctx->coded_frame->key_frame = 1;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "ca5c1457d614fec718aaec7bdf3663dec37e1e50", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n void *opaque, Error **errp)\n \n {\n+\n+ S390CPU *cpu = S390_CPU(obj);\n+\n int64_t value = cpu->id;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void s390x_cpu_get_id(Object *obj, Visitor *v, const char *name,\n\n void *opaque, Error **errp)\n\n{\n\n S390CPU *cpu = S390_CPU(obj);\n\n int64_t value = cpu->id;\n\n\n\n visit_type_int(v, name, &value, errp);\n\n}\n"}} {"sample_id": "3b199d29cd597a3518136d78860e172060b9e83d_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n avctx->pix_fmt = AV_PIX_FMT_BGR24;\n \n+ break;\n+\n+ default:\n+\n+ av_log(avctx, AV_LOG_ERROR, \"unsupported bits per sample\\n\");\n \n return AVERROR_INVALIDDATA;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int msrle_decode_init(AVCodecContext *avctx)\n\n{\n\n MsrleContext *s = avctx->priv_data;\n\n\n\n s->avctx = avctx;\n\n\n\n switch (avctx->bits_per_coded_sample) {\n\n case 4:\n\n case 8:\n\n avctx->pix_fmt = AV_PIX_FMT_PAL8;\n\n break;\n\n case 24:\n\n avctx->pix_fmt = AV_PIX_FMT_BGR24;\n\n break;\n\n default:\n\n av_log(avctx, AV_LOG_ERROR, \"unsupported bits per sample\\n\");\n\n return AVERROR_INVALIDDATA;\n\n }\n\n\n\n s->frame.data[0] = NULL;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "21f88d021d0d2b4ecee8f6cd6ca63a943a3ce71d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n /*\n \n+ * FIXME should set error when unvisited elements remain. Mostly\n+\n+ * harmless, as the generated visits always visit all elements.\n \n */\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "opts_check_list(Visitor *v, Error **errp)\n\n{\n\n /*\n\n * FIXME should set error when unvisited elements remain. Mostly\n\n * harmless, as the generated visits always visit all elements.\n\n */\n\n}\n"}} {"sample_id": "36b15c79aa1bef5fe7543f9f2629b6413720bbfb_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);\n \n+ VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);\n+\n+ VirtIOSCSIReq *req;\n+\n+ uint32_t n;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void *virtio_scsi_load_request(QEMUFile *f, SCSIRequest *sreq)\n\n{\n\n SCSIBus *bus = sreq->bus;\n\n VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);\n\n VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);\n\n VirtIOSCSIReq *req;\n\n uint32_t n;\n\n\n\n req = g_malloc(sizeof(*req));\n\n qemu_get_be32s(f, &n);\n\n assert(n < vs->conf.num_queues);\n\n qemu_get_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem));\n\n /* TODO: add a way for SCSIBusInfo's load_request to fail,\n\n * and fail migration instead of asserting here.\n\n * When we do, we might be able to re-enable NDEBUG below.\n\n */\n\n#ifdef NDEBUG\n\n#error building with NDEBUG is not supported\n\n#endif\n\n assert(req->elem.in_num <= ARRAY_SIZE(req->elem.in_sg));\n\n assert(req->elem.out_num <= ARRAY_SIZE(req->elem.out_sg));\n\n virtio_scsi_parse_req(s, vs->cmd_vqs[n], req);\n\n\n\n scsi_req_ref(sreq);\n\n req->sreq = sreq;\n\n if (req->sreq->cmd.mode != SCSI_XFER_NONE) {\n\n int req_mode =\n\n (req->elem.in_num > 1 ? SCSI_XFER_FROM_DEV : SCSI_XFER_TO_DEV);\n\n\n\n assert(req->sreq->cmd.mode == req_mode);\n\n }\n\n return req;\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n \t\t dc->op2, dc->op1, dc->postinc ? \"+]\" : \"]\"));\n \n \n+\n+\t/* prepare store. Address in T0, value in T1. */\n+\n+\tif (dc->op2 == PR_CCS)\n+\n \t\tcris_evaluate_flags(dc);\n \n \tt0 = tcg_temp_new(TCG_TYPE_TL);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static unsigned int dec_move_pm(DisasContext *dc)\n\n{\n\n\tTCGv t0;\n\n\tint memsize;\n\n\n\n\tmemsize = preg_sizes[dc->op2];\n\n\n\n\tDIS(fprintf (logfile, \"move.%c $p%u, [$r%u%s\\n\",\n\n\t\t memsize_char(memsize), \n\n\t\t dc->op2, dc->op1, dc->postinc ? \"+]\" : \"]\"));\n\n\n\n\t/* prepare store. Address in T0, value in T1. */\n\n\tif (dc->op2 == PR_CCS)\n\n\t\tcris_evaluate_flags(dc);\n\n\tt0 = tcg_temp_new(TCG_TYPE_TL);\n\n\tt_gen_mov_TN_preg(t0, dc->op2);\n\n\tcris_flush_cc_state(dc);\n\n\tgen_store(dc, cpu_R[dc->op1], t0, memsize);\n\n\ttcg_temp_free(t0);\n\n\n\n\tcris_cc_mask(dc, 0);\n\n\tif (dc->postinc)\n\n\t\ttcg_gen_addi_tl(cpu_R[dc->op1], cpu_R[dc->op1], memsize);\n\n\treturn 2;\n\n}\n"}} {"sample_id": "133e9b228df16d11de01529c217417e78d1d9370_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int pci_unregister_device(DeviceState *dev)\n \n {\n \n@@ -7,7 +7,7 @@\n PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(pci_dev);\n \n \n+\n pci_unregister_io_regions(pci_dev);\n \n pci_del_option_rom(pci_dev);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int pci_unregister_device(DeviceState *dev)\n\n{\n\n PCIDevice *pci_dev = PCI_DEVICE(dev);\n\n PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(pci_dev);\n\n\n\n pci_unregister_io_regions(pci_dev);\n\n pci_del_option_rom(pci_dev);\n\n\n\n if (pc->exit) {\n\n pc->exit(pci_dev);\n\n }\n\n\n\n do_pci_unregister_device(pci_dev);\n\n return 0;\n\n}\n"}} {"sample_id": "4ed899f2c5848b75b61d13ad42942ecc2a4386f9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n AVIStream *ast, *next_ast = next_st->priv_data;\n \n int64_t ts, next_ts, ts_min = INT64_MAX;\n+\n AVStream *st, *sub_st = NULL;\n \n int i;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static AVStream *get_subtitle_pkt(AVFormatContext *s, AVStream *next_st,\n\n AVPacket *pkt)\n\n{\n\n AVIStream *ast, *next_ast = next_st->priv_data;\n\n int64_t ts, next_ts, ts_min = INT64_MAX;\n\n AVStream *st, *sub_st = NULL;\n\n int i;\n\n\n\n next_ts = av_rescale_q(next_ast->frame_offset, next_st->time_base,\n\n AV_TIME_BASE_Q);\n\n\n\n for (i=0; inb_streams; i++) {\n\n st = s->streams[i];\n\n ast = st->priv_data;\n\n if (st->discard < AVDISCARD_ALL && ast->sub_pkt.data) {\n\n ts = av_rescale_q(ast->sub_pkt.dts, st->time_base, AV_TIME_BASE_Q);\n\n if (ts <= next_ts && ts < ts_min) {\n\n ts_min = ts;\n\n sub_st = st;\n\n }\n\n }\n\n }\n\n\n\n if (sub_st) {\n\n ast = sub_st->priv_data;\n\n *pkt = ast->sub_pkt;\n\n pkt->stream_index = sub_st->index;\n\n if (av_read_packet(ast->sub_ctx, &ast->sub_pkt) < 0)\n\n ast->sub_pkt.data = NULL;\n\n }\n\n return sub_st;\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_23", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+void sd_set_cb(SDState *sd, qemu_irq readonly, qemu_irq insert)\n+\n+{\n \n sd->readonly_cb = readonly;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void sd_set_cb(SDState *sd, qemu_irq readonly, qemu_irq insert)\n\n{\n\n sd->readonly_cb = readonly;\n\n sd->inserted_cb = insert;\n\n qemu_set_irq(readonly, sd->bdrv ? bdrv_is_read_only(sd->bdrv) : 0);\n\n qemu_set_irq(insert, sd->bdrv ? bdrv_is_inserted(sd->bdrv) : 0);\n\n}\n"}} {"sample_id": "2db59a76c421cdd1039d10e32a9798952d3ff5ba_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void gen_advance_ccount_cond(DisasContext *dc)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_advance_ccount_cond(DisasContext *dc)\n\n{\n\n if (dc->ccount_delta > 0) {\n\n TCGv_i32 tmp = tcg_const_i32(dc->ccount_delta);\n\n gen_helper_advance_ccount(cpu_env, tmp);\n\n tcg_temp_free(tmp);\n\n }\n\n}\n"}} {"sample_id": "58720ebd9e671f654d89d8e401d0b4dffb79122b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,19 +1,19 @@\n int ff_split_xiph_headers(uint8_t *extradata, int extradata_size,\n \n+ int first_header_size, uint8_t *header_start[3],\n \n int header_len[3])\n \n {\n \n int i, j;\n+\n \n \n+ if (AV_RB16(extradata) == first_header_size) {\n \n for (i=0; i<3; i++) {\n+\n header_len[i] = AV_RB16(extradata);\n \n extradata += 2;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int ff_split_xiph_headers(uint8_t *extradata, int extradata_size,\n\n int first_header_size, uint8_t *header_start[3],\n\n int header_len[3])\n\n{\n\n int i, j;\n\n\n\n if (AV_RB16(extradata) == first_header_size) {\n\n for (i=0; i<3; i++) {\n\n header_len[i] = AV_RB16(extradata);\n\n extradata += 2;\n\n header_start[i] = extradata;\n\n extradata += header_len[i];\n\n }\n\n } else if (extradata[0] == 2) {\n\n for (i=0,j=1; i<2; i++,j++) {\n\n header_len[i] = 0;\n\n for (; j= extradata_size)\n\n return -1;\n\n\n\n header_len[i] += extradata[j];\n\n }\n\n header_len[2] = extradata_size - header_len[0] - header_len[1] - j;\n\n extradata += j;\n\n header_start[0] = extradata;\n\n header_start[1] = header_start[0] + header_len[0];\n\n header_start[2] = header_start[1] + header_len[1];\n\n } else {\n\n return -1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "ad5afd07b628cd0610ea322ad60b5ad03aa250c8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,2 +1,2 @@\n+static void s390_cpu_model_initfn(Object *obj)\n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void s390_cpu_model_initfn(Object *obj)\n{"}} {"sample_id": "692d88b4085559f1254d0e04d64a849ce8ab5932", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,25 +1,25 @@\n static void mux_chr_update_read_handler(CharDriverState *chr,\n \n+ GMainContext *context)\n \n {\n \n MuxDriver *d = chr->opaque;\n+\n+ int idx;\n \n+\n+\n+ if (d->mux_cnt >= MAX_MUX) {\n+\n+ fprintf(stderr, \"Cannot add I/O handlers, MUX array is full\\n\");\n+\n return;\n \n }\n \n \n+\n if (chr->mux_idx == -1) {\n \n chr->mux_idx = d->mux_cnt++;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void mux_chr_update_read_handler(CharDriverState *chr,\n\n GMainContext *context)\n\n{\n\n MuxDriver *d = chr->opaque;\n\n int idx;\n\n\n\n if (d->mux_cnt >= MAX_MUX) {\n\n fprintf(stderr, \"Cannot add I/O handlers, MUX array is full\\n\");\n\n return;\n\n }\n\n\n\n if (chr->mux_idx == -1) {\n\n chr->mux_idx = d->mux_cnt++;\n\n }\n\n\n\n idx = chr->mux_idx;\n\n d->ext_opaque[idx] = chr->handler_opaque;\n\n d->chr_can_read[idx] = chr->chr_can_read;\n\n d->chr_read[idx] = chr->chr_read;\n\n d->chr_event[idx] = chr->chr_event;\n\n\n\n /* Fix up the real driver with mux routines */\n\n if (d->mux_cnt == 1) {\n\n qemu_chr_add_handlers_full(d->drv, mux_chr_can_read,\n\n mux_chr_read,\n\n mux_chr_event,\n\n chr, context);\n\n }\n\n if (d->focus != -1) {\n\n mux_chr_send_event(d, d->focus, CHR_EVENT_MUX_OUT);\n\n }\n\n d->focus = idx;\n\n mux_chr_send_event(d, d->focus, CHR_EVENT_MUX_IN);\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_49", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n && instance_id <= se->instance_id) {\n \n instance_id = se->instance_id + 1;\n+\n+ }\n+\n+ }\n+\n return instance_id;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int calculate_new_instance_id(const char *idstr)\n\n{\n\n SaveStateEntry *se;\n\n int instance_id = 0;\n\n\n\n TAILQ_FOREACH(se, &savevm_handlers, entry) {\n\n if (strcmp(idstr, se->idstr) == 0\n\n && instance_id <= se->instance_id) {\n\n instance_id = se->instance_id + 1;\n\n }\n\n }\n\n return instance_id;\n\n}\n"}} {"sample_id": "18d1d5886bb78e4d0e11a2a0193fda765e05805d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n static const int rv30_p_types[6] = { RV34_MB_SKIP, RV34_MB_P_16x16, RV34_MB_P_8x8, -1, RV34_MB_TYPE_INTRA, RV34_MB_TYPE_INTRA16x16 };\n \n+ static const int rv30_b_types[6] = { RV34_MB_SKIP, RV34_MB_B_DIRECT, RV34_MB_B_FORWARD, RV34_MB_B_BACKWARD, RV34_MB_TYPE_INTRA, RV34_MB_TYPE_INTRA16x16 };\n \n MpegEncContext *s = &r->s;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int rv30_decode_mb_info(RV34DecContext *r)\n\n{\n\n static const int rv30_p_types[6] = { RV34_MB_SKIP, RV34_MB_P_16x16, RV34_MB_P_8x8, -1, RV34_MB_TYPE_INTRA, RV34_MB_TYPE_INTRA16x16 };\n\n static const int rv30_b_types[6] = { RV34_MB_SKIP, RV34_MB_B_DIRECT, RV34_MB_B_FORWARD, RV34_MB_B_BACKWARD, RV34_MB_TYPE_INTRA, RV34_MB_TYPE_INTRA16x16 };\n\n MpegEncContext *s = &r->s;\n\n GetBitContext *gb = &s->gb;\n\n int code = svq3_get_ue_golomb(gb);\n\n\n\n if(code > 11){\n\n av_log(s->avctx, AV_LOG_ERROR, \"Incorrect MB type code\\n\");\n\n return -1;\n\n }\n\n if(code > 5){\n\n av_log(s->avctx, AV_LOG_ERROR, \"dquant needed\\n\");\n\n code -= 6;\n\n }\n\n if(s->pict_type != AV_PICTURE_TYPE_B)\n\n return rv30_p_types[code];\n\n else\n\n return rv30_b_types[code];\n\n}\n"}} {"sample_id": "ab2bfb85d49b2f8aa505816f93e75fd18ad0a361", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,7 +14,7 @@\n \n \n \n+ idx = FFMIN(idx, *count);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int ff_insert_pad(unsigned idx, unsigned *count, size_t padidx_off,\n\n AVFilterPad **pads, AVFilterLink ***links,\n\n AVFilterPad *newpad)\n\n{\n\n AVFilterLink **newlinks;\n\n AVFilterPad *newpads;\n\n unsigned i;\n\n\n\n idx = FFMIN(idx, *count);\n\n\n\n newpads = av_realloc_array(*pads, *count + 1, sizeof(AVFilterPad));\n\n newlinks = av_realloc_array(*links, *count + 1, sizeof(AVFilterLink*));\n\n if (newpads)\n\n *pads = newpads;\n\n if (newlinks)\n\n *links = newlinks;\n\n if (!newpads || !newlinks)\n\n return AVERROR(ENOMEM);\n\n\n\n memmove(*pads + idx + 1, *pads + idx, sizeof(AVFilterPad) * (*count - idx));\n\n memmove(*links + idx + 1, *links + idx, sizeof(AVFilterLink*) * (*count - idx));\n\n memcpy(*pads + idx, newpad, sizeof(AVFilterPad));\n\n (*links)[idx] = NULL;\n\n\n\n (*count)++;\n\n for (i = idx + 1; i < *count; i++)\n\n if (*links[i])\n\n (*(unsigned *)((uint8_t *) *links[i] + padidx_off))++;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "f34d5c750897abb3853910ce73f63d88d74dc827", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void usb_host_set_config(USBHostDevice *s, int config, USBPacket *p)\n \n+{\n+\n+ int rc;\n+\n+\n \n trace_usb_host_set_config(s->bus_num, s->addr, config);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void usb_host_set_config(USBHostDevice *s, int config, USBPacket *p)\n\n{\n\n int rc;\n\n\n\n trace_usb_host_set_config(s->bus_num, s->addr, config);\n\n\n\n usb_host_release_interfaces(s);\n\n usb_host_detach_kernel(s);\n\n rc = libusb_set_configuration(s->dh, config);\n\n if (rc != 0) {\n\n usb_host_libusb_error(\"libusb_set_configuration\", rc);\n\n p->status = USB_RET_STALL;\n\n if (rc == LIBUSB_ERROR_NO_DEVICE) {\n\n usb_host_nodev(s);\n\n }\n\n return;\n\n }\n\n p->status = usb_host_claim_interfaces(s, config);\n\n if (p->status != USB_RET_SUCCESS) {\n\n return;\n\n }\n\n usb_host_ep_update(s);\n\n}\n"}} {"sample_id": "b0b1d69079fcb9453f45aade9e9f6b71422147b0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n int kvm_update_guest_debug(CPUState *env, unsigned long reinject_trap)\n \n+{\n+\n struct kvm_set_guest_debug_data data;\n+\n \n \n data.dbg.control = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "int kvm_update_guest_debug(CPUState *env, unsigned long reinject_trap)\n\n{\n\n struct kvm_set_guest_debug_data data;\n\n\n\n data.dbg.control = 0;\n\n if (env->singlestep_enabled)\n\n data.dbg.control = KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_SINGLESTEP;\n\n\n\n kvm_arch_update_guest_debug(env, &data.dbg);\n\n data.dbg.control |= reinject_trap;\n\n data.env = env;\n\n\n\n on_vcpu(env, kvm_invoke_set_guest_debug, &data);\n\n return data.err;\n\n}\n"}} {"sample_id": "ccbcfedd17fd2d13521fcee66810d0df464ec1cc_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n int qemu_devtree_add_subnode(void *fdt, const char *name)\n+\n {\n \n int offset;\n@@ -8,11 +8,11 @@\n \n char *basename = strrchr(dupname, '/');\n \n+ int retval;\n+\n+\n \n+ if (!basename) {\n \n return -1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "int qemu_devtree_add_subnode(void *fdt, const char *name)\n\n{\n\n int offset;\n\n char *dupname = g_strdup(name);\n\n char *basename = strrchr(dupname, '/');\n\n int retval;\n\n\n\n if (!basename) {\n\n return -1;\n\n }\n\n\n\n basename[0] = '\\0';\n\n basename++;\n\n\n\n offset = fdt_path_offset(fdt, dupname);\n\n if (offset < 0) {\n\n return offset;\n\n }\n\n\n\n retval = fdt_add_subnode(fdt, offset, basename);\n\n g_free(dupname);\n\n return retval;\n\n}\n"}} {"sample_id": "00d2f3707a63881a0cec8d00cbd467f9b2d8af41", "diff": "--- a/source.c\n+++ b/source.c\n@@ -44,11 +44,11 @@\n error_setg_errno(errp, errno, \"failed to create child process\");\n return;\n }\n+ ga_wait_child(pid, &status, &local_err);\n+ if (local_err) {\n+ error_propagate(errp, local_err);\n+ return;\n+ }\n if (!WIFEXITED(status)) {\n error_setg(errp, \"child process has terminated abnormally\");\n return;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void qmp_guest_set_time(bool has_time, int64_t time_ns, Error **errp)\n{\n int ret;\n int status;\n pid_t pid;\n Error *local_err = NULL;\n struct timeval tv;\n /* If user has passed a time, validate and set it. */\n if (has_time) {\n /* year-2038 will overflow in case time_t is 32bit */\n if (time_ns / 1000000000 != (time_t)(time_ns / 1000000000)) {\n error_setg(errp, \"Time %\" PRId64 \" is too large\", time_ns);\n return;\n }\n tv.tv_sec = time_ns / 1000000000;\n tv.tv_usec = (time_ns % 1000000000) / 1000;\n g_date_set_time_t(&date, tv.tv_sec);\n if (date.year < 1970 || date.year >= 2070) {\n error_setg_errno(errp, errno, \"Invalid time\");\n return;\n }\n ret = settimeofday(&tv, NULL);\n if (ret < 0) {\n error_setg_errno(errp, errno, \"Failed to set time to guest\");\n return;\n }\n }\n /* Now, if user has passed a time to set and the system time is set, we\n * just need to synchronize the hardware clock. However, if no time was\n * passed, user is requesting the opposite: set the system time from the\n * hardware clock (RTC). */\n pid = fork();\n if (pid == 0) {\n setsid();\n reopen_fd_to_null(0);\n reopen_fd_to_null(1);\n reopen_fd_to_null(2);\n /* Use '/sbin/hwclock -w' to set RTC from the system time,\n * or '/sbin/hwclock -s' to set the system time from RTC. */\n execle(\"/sbin/hwclock\", \"hwclock\", has_time ? \"-w\" : \"-s\",\n NULL, environ);\n _exit(EXIT_FAILURE);\n } else if (pid < 0) {\n error_setg_errno(errp, errno, \"failed to create child process\");\n return;\n }\n ga_wait_child(pid, &status, &local_err);\n if (local_err) {\n error_propagate(errp, local_err);\n return;\n }\n if (!WIFEXITED(status)) {\n error_setg(errp, \"child process has terminated abnormally\");\n return;\n }\n if (WEXITSTATUS(status)) {\n error_setg(errp, \"hwclock failed to set hardware clock to system time\");\n return;\n }\n}"}} {"sample_id": "498f21405a286f718a0767c791b7d2db19f4e5bd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -65,9 +65,9 @@\n QLIST_REMOVE(acb, aiocb_siblings);\n \n qemu_co_queue_restart_all(&s->overwrapping_queue);\n+\n+\n+\n+ return acb->ret;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static coroutine_fn int sd_co_discard(BlockDriverState *bs, int64_t sector_num,\n\n int nb_sectors)\n\n{\n\n SheepdogAIOCB *acb;\n\n QEMUIOVector dummy;\n\n BDRVSheepdogState *s = bs->opaque;\n\n int ret;\n\n\n\n if (!s->discard_supported) {\n\n return 0;\n\n }\n\n\n\n acb = sd_aio_setup(bs, &dummy, sector_num, nb_sectors);\n\n acb->aiocb_type = AIOCB_DISCARD_OBJ;\n\n acb->aio_done_func = sd_finish_aiocb;\n\n\n\nretry:\n\n if (check_overwrapping_aiocb(s, acb)) {\n\n qemu_co_queue_wait(&s->overwrapping_queue);\n\n goto retry;\n\n }\n\n\n\n ret = sd_co_rw_vector(acb);\n\n if (ret <= 0) {\n\n QLIST_REMOVE(acb, aiocb_siblings);\n\n qemu_co_queue_restart_all(&s->overwrapping_queue);\n\n qemu_aio_unref(acb);\n\n return ret;\n\n }\n\n\n\n qemu_coroutine_yield();\n\n\n\n QLIST_REMOVE(acb, aiocb_siblings);\n\n qemu_co_queue_restart_all(&s->overwrapping_queue);\n\n\n\n return acb->ret;\n\n}\n"}} {"sample_id": "ddfa3751c092feaf1e080f66587024689dfe603c_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,19 +1,19 @@\n static int jp2_find_codestream(J2kDecoderContext *s)\n+\n {\n+\n+ uint32_t atom_size;\n+\n+ int found_codestream = 0, search_range = 10;\n \n+\n \n+ // skip jpeg2k signature atom\n+\n s->buf += 12;\n \n \n+\n while(!found_codestream && search_range && s->buf_end - s->buf >= 8) {\n \n atom_size = AV_RB32(s->buf);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int jp2_find_codestream(J2kDecoderContext *s)\n\n{\n\n uint32_t atom_size;\n\n int found_codestream = 0, search_range = 10;\n\n\n\n // skip jpeg2k signature atom\n\n s->buf += 12;\n\n\n\n while(!found_codestream && search_range && s->buf_end - s->buf >= 8) {\n\n atom_size = AV_RB32(s->buf);\n\n if(AV_RB32(s->buf + 4) == JP2_CODESTREAM) {\n\n found_codestream = 1;\n\n s->buf += 8;\n\n } else {\n\n if (s->buf_end - s->buf < atom_size)\n\n return 0;\n\n s->buf += atom_size;\n\n search_range--;\n\n }\n\n }\n\n\n\n if(found_codestream)\n\n return 1;\n\n return 0;\n\n}\n"}} {"sample_id": "364031f17932814484657e5551ba12957d993d7e_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static int v9fs_synth_renameat(FsContext *ctx, V9fsPath *olddir,\n+\n+ const char *old_name, V9fsPath *newdir,\n \n const char *new_name)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int v9fs_synth_renameat(FsContext *ctx, V9fsPath *olddir,\n\n const char *old_name, V9fsPath *newdir,\n\n const char *new_name)\n\n{\n\n errno = EPERM;\n\n return -1;\n\n}\n"}} {"sample_id": "c10350358da58600884292c08a8690289b81de29", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n src_pr = src_px + w;\n \n \n+\n+ for (; src_px < src_pr; src_px++, dst_px++)\n+\n+ *dst_px = *src_px;\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gif_copy_img_rect(const uint32_t *src, uint32_t *dst,\n\n int linesize, int l, int t, int w, int h)\n\n{\n\n const int y_start = t * linesize;\n\n const uint32_t *src_px, *src_pr,\n\n *src_py = src + y_start,\n\n *dst_py = dst + y_start;\n\n const uint32_t *src_pb = src_py + t * linesize;\n\n uint32_t *dst_px;\n\n\n\n for (; src_py < src_pb; src_py += linesize, dst_py += linesize) {\n\n src_px = src_py + l;\n\n dst_px = (uint32_t *)dst_py + l;\n\n src_pr = src_px + w;\n\n\n\n for (; src_px < src_pr; src_px++, dst_px++)\n\n *dst_px = *src_px;\n\n }\n\n}\n"}} {"sample_id": "e1833e1f96456fd8fc17463246fe0b2050e68efb_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,6 +8,6 @@\n \n gen_op_store_403_pb(sprn - SPR_403_PBL1);\n \n+ RET_STOP(ctx);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void spr_write_403_pbr (void *opaque, int sprn)\n\n{\n\n DisasContext *ctx = opaque;\n\n\n\n gen_op_store_403_pb(sprn - SPR_403_PBL1);\n\n RET_STOP(ctx);\n\n}\n"}} {"sample_id": "f755dea79dc81b0d6a8f6414e0672e165e28d8ba_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,8 +16,8 @@\n \n v->type_int64(v, &value, name, errp);\n \n+ *obj = value;\n+\n+ }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void visit_type_uint64(Visitor *v, uint64_t *obj, const char *name, Error **errp)\n\n{\n\n int64_t value;\n\n\n\n if (v->type_uint64) {\n\n v->type_uint64(v, obj, name, errp);\n\n } else {\n\n value = *obj;\n\n v->type_int64(v, &value, name, errp);\n\n *obj = value;\n\n }\n\n}\n"}} {"sample_id": "c546194f260fb3e391193cb8cc33505618077ecb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n bool iops_flag;\n \n+\n+\n+ assert(io_limits);\n+\n+\n \n bps_flag = (io_limits->bps[BLOCK_IO_LIMIT_TOTAL] != 0)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool do_check_io_limits(BlockIOLimit *io_limits)\n\n{\n\n bool bps_flag;\n\n bool iops_flag;\n\n\n\n assert(io_limits);\n\n\n\n bps_flag = (io_limits->bps[BLOCK_IO_LIMIT_TOTAL] != 0)\n\n && ((io_limits->bps[BLOCK_IO_LIMIT_READ] != 0)\n\n || (io_limits->bps[BLOCK_IO_LIMIT_WRITE] != 0));\n\n iops_flag = (io_limits->iops[BLOCK_IO_LIMIT_TOTAL] != 0)\n\n && ((io_limits->iops[BLOCK_IO_LIMIT_READ] != 0)\n\n || (io_limits->iops[BLOCK_IO_LIMIT_WRITE] != 0));\n\n if (bps_flag || iops_flag) {\n\n return false;\n\n }\n\n\n\n return true;\n\n}\n"}} {"sample_id": "6a63ff19b6a7fe3bc32c7fb4a62fca8f65786432_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -41,11 +41,11 @@\n int count =get_be32(pb);\n \n int duration =get_be32(pb);\n+\n+\n+\n+ sc->ctts_data[i].count = count;\n+\n sc->ctts_data[i].duration= duration;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mov_read_ctts(MOVContext *c, ByteIOContext *pb, MOVAtom atom)\n\n{\n\n AVStream *st = c->fc->streams[c->fc->nb_streams-1];\n\n MOVStreamContext *sc = st->priv_data;\n\n unsigned int i, entries;\n\n\n\n get_byte(pb); /* version */\n\n get_be24(pb); /* flags */\n\n entries = get_be32(pb);\n\n\n\n dprintf(c->fc, \"track[%i].ctts.entries = %i\\n\", c->fc->nb_streams-1, entries);\n\n\n\n if(entries >= UINT_MAX / sizeof(*sc->ctts_data))\n\n return -1;\n\n sc->ctts_data = av_malloc(entries * sizeof(*sc->ctts_data));\n\n if (!sc->ctts_data)\n\n return AVERROR(ENOMEM);\n\n sc->ctts_count = entries;\n\n\n\n for(i=0; ictts_data[i].count = count;\n\n sc->ctts_data[i].duration= duration;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "8f5d58ef2c92d7b82d9a6eeefd7c8854a183ba4a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void ivshmem_check_memdev_is_busy(Object *obj, const char *name,\n \n Object *val, Error **errp)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void ivshmem_check_memdev_is_busy(Object *obj, const char *name,\n\n Object *val, Error **errp)\n\n{\n\n if (host_memory_backend_is_mapped(MEMORY_BACKEND(val))) {\n\n char *path = object_get_canonical_path_component(val);\n\n error_setg(errp, \"can't use already busy memdev: %s\", path);\n\n g_free(path);\n\n } else {\n\n qdev_prop_allow_set_link_before_realize(obj, name, val, errp);\n\n }\n\n}\n"}} {"sample_id": "f19af812a32c1398d48c3550d11dbc6aafbb2bfc_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n static int adx_decode_header(AVCodecContext *avctx,const unsigned char *buf,size_t bufsize)\n+\n+{\n+\n+\tint offset;\n+\n+\tint channels,freq,size;\n+\n+\n+\n+\toffset = is_adx(buf,bufsize);\n+\n \tif (offset==0) return 0;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int adx_decode_header(AVCodecContext *avctx,const unsigned char *buf,size_t bufsize)\n\n{\n\n\tint offset;\n\n\tint channels,freq,size;\n\n\n\n\toffset = is_adx(buf,bufsize);\n\n\tif (offset==0) return 0;\n\n\n\n\tchannels = buf[7];\n\n\tfreq = read_long(buf+8);\n\n\tsize = read_long(buf+12);\n\n\n\n//\tprintf(\"freq=%d ch=%d\\n\",freq,channels);\n\n\n\n\tavctx->sample_rate = freq;\n\n\tavctx->channels = channels;\n\n\tavctx->bit_rate = freq*channels*18*8/32;\n\n//\tavctx->frame_size = 18*channels;\n\n\n\n\treturn offset;\n\n}\n"}} {"sample_id": "e5540b3fd30367ce3cc33b2f34a04b660dbc4b38", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n \n \n+ for (y=0; yheight_mb; y++)\n+\n+ {\n+\n+ for (x=0; xwidth_mb; x++)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int advanced_decode_i_mbs(VC9Context *v)\n\n{\n\n int i, x, y, cbpcy, mqdiff, absmq, mquant, ac_pred, condover,\n\n current_mb = 0, over_flags_mb = 0;\n\n\n\n for (y=0; yheight_mb; y++)\n\n {\n\n for (x=0; xwidth_mb; x++)\n\n {\n\n if (v->ac_pred_plane[i])\n\n ac_pred = get_bits(&v->gb, 1);\n\n if (condover == 3 && v->over_flags_plane)\n\n over_flags_mb = get_bits(&v->gb, 1);\n\n GET_MQUANT();\n\n }\n\n current_mb++;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "12de9a396acbc95e25c5d60ed097cc55777eaaed_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,9 +12,9 @@\n \n break;\n \n+ case POWERPC_MMU_SOFT_4xx:\n \n+ case POWERPC_MMU_SOFT_4xx_Z:\n \n ppc4xx_tlb_invalidate_all(env);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void ppc_tlb_invalidate_all (CPUPPCState *env)\n\n{\n\n switch (env->mmu_model) {\n\n case POWERPC_MMU_SOFT_6xx:\n\n case POWERPC_MMU_SOFT_74xx:\n\n ppc6xx_tlb_invalidate_all(env);\n\n break;\n\n case POWERPC_MMU_SOFT_4xx:\n\n case POWERPC_MMU_SOFT_4xx_Z:\n\n ppc4xx_tlb_invalidate_all(env);\n\n break;\n\n case POWERPC_MMU_REAL_4xx:\n\n cpu_abort(env, \"No TLB for PowerPC 4xx in real mode\\n\");\n\n break;\n\n case POWERPC_MMU_BOOKE:\n\n /* XXX: TODO */\n\n cpu_abort(env, \"MMU model not implemented\\n\");\n\n break;\n\n case POWERPC_MMU_BOOKE_FSL:\n\n /* XXX: TODO */\n\n cpu_abort(env, \"MMU model not implemented\\n\");\n\n break;\n\n case POWERPC_MMU_601:\n\n /* XXX: TODO */\n\n cpu_abort(env, \"MMU model not implemented\\n\");\n\n break;\n\n case POWERPC_MMU_32B:\n\n#if defined(TARGET_PPC64)\n\n case POWERPC_MMU_64B:\n\n case POWERPC_MMU_64BRIDGE:\n\n#endif /* defined(TARGET_PPC64) */\n\n tlb_flush(env, 1);\n\n break;\n\n default:\n\n /* XXX: TODO */\n\n cpu_abort(env, \"Unknown MMU model %d\\n\", env->mmu_model);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "ef1e1e0782e99c9dcf2b35e5310cdd8ca9211374", "diff": "--- a/source.c\n+++ b/source.c\n@@ -58,11 +58,11 @@\n \n \n \n+ etsec->rx_first_in_frame = 1;\n+\n+ etsec->rx_remaining_data = etsec->rx_buffer_len;\n+\n+ RING_DEBUG(\"%s: rx_buffer_len:%u rx_padding+crc:%u\\n\", __func__,\n \n etsec->rx_buffer_len, etsec->rx_padding);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void rx_init_frame(eTSEC *etsec, const uint8_t *buf, size_t size)\n\n{\n\n uint32_t fcb_size = 0;\n\n uint8_t prsdep = (etsec->regs[RCTRL].value >> RCTRL_PRSDEP_OFFSET)\n\n & RCTRL_PRSDEP_MASK;\n\n\n\n if (prsdep != 0) {\n\n /* Prepend FCB (FCB size + RCTRL[PAL]) */\n\n fcb_size = 8 + ((etsec->regs[RCTRL].value >> 16) & 0x1F);\n\n\n\n etsec->rx_fcb_size = fcb_size;\n\n\n\n /* TODO: fill_FCB(etsec); */\n\n memset(etsec->rx_fcb, 0x0, sizeof(etsec->rx_fcb));\n\n\n\n } else {\n\n etsec->rx_fcb_size = 0;\n\n }\n\n\n\n if (etsec->rx_buffer != NULL) {\n\n g_free(etsec->rx_buffer);\n\n }\n\n\n\n /* Do not copy the frame for now */\n\n etsec->rx_buffer = (uint8_t *)buf;\n\n etsec->rx_buffer_len = size;\n\n\n\n /* CRC padding (We don't have to compute the CRC) */\n\n etsec->rx_padding = 4;\n\n\n\n etsec->rx_first_in_frame = 1;\n\n etsec->rx_remaining_data = etsec->rx_buffer_len;\n\n RING_DEBUG(\"%s: rx_buffer_len:%u rx_padding+crc:%u\\n\", __func__,\n\n etsec->rx_buffer_len, etsec->rx_padding);\n\n}\n"}} {"sample_id": "7888ae8266d8f721cc443fe3aa627d350ca01204", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,9 +13,9 @@\n avctx->width = 0;\n \n avctx->height = 0;\n+\n+\n+\n+ return ff_cfhd_init_vlcs(s);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int cfhd_decode_init(AVCodecContext *avctx)\n\n{\n\n CFHDContext *s = avctx->priv_data;\n\n\n\n avctx->bits_per_raw_sample = 10;\n\n s->avctx = avctx;\n\n avctx->width = 0;\n\n avctx->height = 0;\n\n\n\n return ff_cfhd_init_vlcs(s);\n\n}\n"}} {"sample_id": "fe52840c8760122257be7b7e4893dd951480a71f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n Coroutine *co = arg;\n \n+ qemu_coroutine_enter(co, NULL);\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int coroutine_enter_func(void *arg)\n\n{\n\n Coroutine *co = arg;\n\n qemu_coroutine_enter(co, NULL);\n\n return 0;\n\n}\n"}} {"sample_id": "20c334a797bf46a4ee59a6e42be6d5e7c3cda585_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static inline int16_t mipsdsp_add_i16(int16_t a, int16_t b, CPUMIPSState *env)\n \n {\n+\n int16_t tempI;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static inline int16_t mipsdsp_add_i16(int16_t a, int16_t b, CPUMIPSState *env)\n\n{\n\n int16_t tempI;\n\n\n\n tempI = a + b;\n\n\n\n if (MIPSDSP_OVERFLOW(a, b, tempI, 0x8000)) {\n\n set_DSPControl_overflow_flag(1, 20, env);\n\n }\n\n\n\n return tempI;\n\n}\n"}} {"sample_id": "1bab33ab4ab4702f53012551cad333beb270f30d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n { 0xD4000, 0xD7FFF }, /* Option ROM */\n { 0xD8000, 0xDBFFF }, /* Option ROM */\n { 0xDC000, 0xDFFFF }, /* Option ROM */\n+ { 0xE0000, 0xE3FFF }, /* BIOS Extension */\n+ { 0xE4000, 0xE7FFF }, /* BIOS Extension */\n+ { 0xE8000, 0xEBFFF }, /* BIOS Extension */\n+ { 0xEC000, 0xEFFFF }, /* BIOS Extension */\n+ };\n bus = test_start_get_bus(s);\n dev = qpci_device_find(bus, QPCI_DEVFN(0, 0));\n g_assert(dev != NULL);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void test_i440fx_pam(gconstpointer opaque)\n{\n const TestData *s = opaque;\n QPCIBus *bus;\n QPCIDevice *dev;\n int i;\n static struct {\n uint32_t start;\n uint32_t end;\n } pam_area[] = {\n { 0, 0 }, /* Reserved */\n { 0xF0000, 0xFFFFF }, /* BIOS Area */\n { 0xC0000, 0xC3FFF }, /* Option ROM */\n { 0xC4000, 0xC7FFF }, /* Option ROM */\n { 0xC8000, 0xCBFFF }, /* Option ROM */\n { 0xCC000, 0xCFFFF }, /* Option ROM */\n { 0xD0000, 0xD3FFF }, /* Option ROM */\n { 0xD4000, 0xD7FFF }, /* Option ROM */\n { 0xD8000, 0xDBFFF }, /* Option ROM */\n { 0xDC000, 0xDFFFF }, /* Option ROM */\n { 0xE0000, 0xE3FFF }, /* BIOS Extension */\n { 0xE4000, 0xE7FFF }, /* BIOS Extension */\n { 0xE8000, 0xEBFFF }, /* BIOS Extension */\n { 0xEC000, 0xEFFFF }, /* BIOS Extension */\n };\n bus = test_start_get_bus(s);\n dev = qpci_device_find(bus, QPCI_DEVFN(0, 0));\n g_assert(dev != NULL);\n for (i = 0; i < ARRAY_SIZE(pam_area); i++) {\n if (pam_area[i].start == pam_area[i].end) {\n continue;\n }\n g_test_message(\"Checking area 0x%05x..0x%05x\",\n pam_area[i].start, pam_area[i].end);\n /* Switch to RE for the area */\n pam_set(dev, i, PAM_RE);\n /* Verify the RAM is all zeros */\n g_assert(verify_area(pam_area[i].start, pam_area[i].end, 0));\n /* Switch to WE for the area */\n pam_set(dev, i, PAM_RE | PAM_WE);\n /* Write out a non-zero mask to the full area */\n write_area(pam_area[i].start, pam_area[i].end, 0x42);\n#ifndef BROKEN\n /* QEMU only supports a limited form of PAM */\n /* Switch to !RE for the area */\n pam_set(dev, i, PAM_WE);\n /* Verify the area is not our mask */\n g_assert(!verify_area(pam_area[i].start, pam_area[i].end, 0x42));\n#endif\n /* Verify the area is our new mask */\n g_assert(verify_area(pam_area[i].start, pam_area[i].end, 0x42));\n /* Write out a new mask */\n write_area(pam_area[i].start, pam_area[i].end, 0x82);\n#ifndef BROKEN\n /* QEMU only supports a limited form of PAM */\n /* Verify the area is not our mask */\n g_assert(!verify_area(pam_area[i].start, pam_area[i].end, 0x82));\n /* Switch to RE for the area */\n pam_set(dev, i, PAM_RE | PAM_WE);\n#endif\n /* Verify the area is our new mask */\n g_assert(verify_area(pam_area[i].start, pam_area[i].end, 0x82));\n /* Reset area */\n pam_set(dev, i, 0);\n /* Verify the area is not our new mask */\n g_assert(!verify_area(pam_area[i].start, pam_area[i].end, 0x82));\n }\n qtest_end();\n}"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_77", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n switch (page) {\n \n case MODE_PAGE_CACHING:\n+\n+ bdrv_set_enable_write_cache(s->qdev.conf.bs, (p[0] & 4) != 0);\n+\n+ break;\n+\n \n \n default:", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void scsi_disk_apply_mode_select(SCSIDiskState *s, int page, uint8_t *p)\n\n{\n\n switch (page) {\n\n case MODE_PAGE_CACHING:\n\n bdrv_set_enable_write_cache(s->qdev.conf.bs, (p[0] & 4) != 0);\n\n break;\n\n\n\n default:\n\n break;\n\n }\n\n}\n"}} {"sample_id": "ee9f36a88eb3e2706ea659acb0ca80c414fa5d8a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n int stream_index,\n \n+ const uint8_t *buf, int size, int64_t pts)\n+\n+{\n \n CRCState *crc = s->priv_data;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int crc_write_packet(struct AVFormatContext *s, \n\n int stream_index,\n\n const uint8_t *buf, int size, int64_t pts)\n\n{\n\n CRCState *crc = s->priv_data;\n\n crc->crcval = adler32(crc->crcval, buf, size);\n\n return 0;\n\n}\n"}} {"sample_id": "12351a91da97b414eec8cdb09f1d9f41e535a401", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n set_bit(DEVICE_CATEGORY_SOUND, dc->categories);\n \n dc->desc = \"Intel 82801AA AC97 Audio\";\n+\n+ dc->vmsd = &vmstate_ac97;\n+\n+ dc->props = ac97_properties;\n+\n dc->reset = ac97_on_reset;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void ac97_class_init (ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS (klass);\n\n PCIDeviceClass *k = PCI_DEVICE_CLASS (klass);\n\n\n\n k->realize = ac97_realize;\n\n\n k->vendor_id = PCI_VENDOR_ID_INTEL;\n\n k->device_id = PCI_DEVICE_ID_INTEL_82801AA_5;\n\n k->revision = 0x01;\n\n k->class_id = PCI_CLASS_MULTIMEDIA_AUDIO;\n\n set_bit(DEVICE_CATEGORY_SOUND, dc->categories);\n\n dc->desc = \"Intel 82801AA AC97 Audio\";\n\n dc->vmsd = &vmstate_ac97;\n\n dc->props = ac97_properties;\n\n dc->reset = ac97_on_reset;\n\n}"}} {"sample_id": "33876dfad64bc481f59c5e9ccf60db78624c4b93_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void xenstore_update_be(char *watch, char *type, int dom,\n \n+ struct XenDevOps *ops)\n \n+{\n+\n+ struct XenDevice *xendev;\n \n char path[XEN_BUFSIZE], *dom0, *bepath;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void xenstore_update_be(char *watch, char *type, int dom,\n\n struct XenDevOps *ops)\n\n{\n\n struct XenDevice *xendev;\n\n char path[XEN_BUFSIZE], *dom0, *bepath;\n\n unsigned int len, dev;\n\n\n\n dom0 = xs_get_domain_path(xenstore, 0);\n\n len = snprintf(path, sizeof(path), \"%s/backend/%s/%d\", dom0, type, dom);\n\n free(dom0);\n\n if (strncmp(path, watch, len) != 0) {\n\n return;\n\n }\n\n if (sscanf(watch+len, \"/%u/%255s\", &dev, path) != 2) {\n\n strcpy(path, \"\");\n\n if (sscanf(watch+len, \"/%u\", &dev) != 1) {\n\n dev = -1;\n\n }\n\n }\n\n if (dev == -1) {\n\n return;\n\n }\n\n\n\n xendev = xen_be_get_xendev(type, dom, dev, ops);\n\n if (xendev != NULL) {\n\n bepath = xs_read(xenstore, 0, xendev->be, &len);\n\n if (bepath == NULL) {\n\n xen_be_del_xendev(dom, dev);\n\n } else {\n\n free(bepath);\n\n xen_be_backend_changed(xendev, path);\n\n xen_be_check_state(xendev);\n\n }\n\n }\n\n}\n"}} {"sample_id": "49a661910c1374858602a3002b67115893673c25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n return ri->raw_readfn(env, ri);\n \n+ } else if (ri->readfn) {\n+\n+ return ri->readfn(env, ri);\n+\n+ } else {\n \n return raw_read(env, ri);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t read_raw_cp_reg(CPUARMState *env, const ARMCPRegInfo *ri)\n\n{\n\n /* Raw read of a coprocessor register (as needed for migration, etc). */\n\n if (ri->type & ARM_CP_CONST) {\n\n return ri->resetvalue;\n\n } else if (ri->raw_readfn) {\n\n return ri->raw_readfn(env, ri);\n\n } else if (ri->readfn) {\n\n return ri->readfn(env, ri);\n\n } else {\n\n return raw_read(env, ri);\n\n }\n\n}\n"}} {"sample_id": "ad674e53b5cce265fadafbde2c6a4f190345cd00_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,9 +23,9 @@\n conditional_branch(ch);\n \n \n+\n+wait:\n+\n+ qemu_bh_schedule(dbdma_bh);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void nop(DBDMA_channel *ch)\n\n{\n\n dbdma_cmd *current = &ch->current;\n\n\n\n if (conditional_wait(ch))\n\n goto wait;\n\n\n\n current->xfer_status = cpu_to_le16(be32_to_cpu(ch->regs[DBDMA_STATUS]));\n\n dbdma_cmdptr_save(ch);\n\n\n\n conditional_interrupt(ch);\n\n conditional_branch(ch);\n\n\n\nwait:\n\n qemu_bh_schedule(dbdma_bh);\n\n}\n"}} {"sample_id": "5683de00e99e4be87419a97d521887f94acc937a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n for (i = 0; i < FF_ARRAY_ELEMS(error_entries); i++) {\n \n+ if (errnum == error_entries[i].num) {\n \n entry = &error_entries[i];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int av_strerror(int errnum, char *errbuf, size_t errbuf_size)\n\n{\n\n int ret = 0, i;\n\n struct error_entry *entry = NULL;\n\n\n\n for (i = 0; i < FF_ARRAY_ELEMS(error_entries); i++) {\n\n if (errnum == error_entries[i].num) {\n\n entry = &error_entries[i];\n\n break;\n\n }\n\n }\n\n if (entry) {\n\n av_strlcpy(errbuf, entry->str, errbuf_size);\n\n } else {\n\n#if HAVE_STRERROR_R\n\n ret = strerror_r(AVUNERROR(errnum), errbuf, errbuf_size);\n\n#else\n\n ret = -1;\n\n#endif\n\n if (ret < 0)\n\n snprintf(errbuf, errbuf_size, \"Error number %d occurred\", errnum);\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "ede9c94acf6cd1968de4188c0228b714ab871a86", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n return MEMTX_ERROR;\n \n+ }\n+\n+\n+\n+ VTD_DPRINTF(IR, \"delivering MSI 0x%\"PRIx64\":0x%\"PRIx32\n \n \" for device sid 0x%04x\",\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static MemTxResult vtd_mem_ir_write(void *opaque, hwaddr addr,\n\n uint64_t value, unsigned size,\n\n MemTxAttrs attrs)\n\n{\n\n int ret = 0;\n\n MSIMessage from = {}, to = {};\n\n\n\n from.address = (uint64_t) addr + VTD_INTERRUPT_ADDR_FIRST;\n\n from.data = (uint32_t) value;\n\n\n\n ret = vtd_interrupt_remap_msi(opaque, &from, &to);\n\n if (ret) {\n\n /* TODO: report error */\n\n VTD_DPRINTF(GENERAL, \"int remap fail for addr 0x%\"PRIx64\n\n \" data 0x%\"PRIx32, from.address, from.data);\n\n /* Drop this interrupt */\n\n return MEMTX_ERROR;\n\n }\n\n\n\n VTD_DPRINTF(IR, \"delivering MSI 0x%\"PRIx64\":0x%\"PRIx32\n\n \" for device sid 0x%04x\",\n\n to.address, to.data, sid);\n\n\n\n if (dma_memory_write(&address_space_memory, to.address,\n\n &to.data, size)) {\n\n VTD_DPRINTF(GENERAL, \"error: fail to write 0x%\"PRIx64\n\n \" value 0x%\"PRIx32, to.address, to.data);\n\n }\n\n\n\n return MEMTX_OK;\n\n}\n"}} {"sample_id": "e122636562218b3d442cd2cd18fbc188dd9ce709_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n const char *argv[] = { \"/bin/sh\", \"-c\", command, NULL };\n \n+\n \n trace_migration_exec_outgoing(command);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void exec_start_outgoing_migration(MigrationState *s, const char *command, Error **errp)\n\n{\n\n QIOChannel *ioc;\n\n const char *argv[] = { \"/bin/sh\", \"-c\", command, NULL };\n\n\n\n trace_migration_exec_outgoing(command);\n\n ioc = QIO_CHANNEL(qio_channel_command_new_spawn(argv,\n\n O_WRONLY,\n\n errp));\n\n if (!ioc) {\n\n return;\n\n }\n\n\n\n migration_set_outgoing_channel(s, ioc);\n\n object_unref(OBJECT(ioc));\n\n}\n"}} {"sample_id": "40ff6d7e8dceca227e7f8a3e8e0d58b2c66d19b4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int rtc_start_timer(struct qemu_alarm_timer *t)\n \n {\n+\n int rtc_fd;\n \n unsigned long current_rtc_freq = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int rtc_start_timer(struct qemu_alarm_timer *t)\n\n{\n\n int rtc_fd;\n\n unsigned long current_rtc_freq = 0;\n\n\n\n TFR(rtc_fd = open(\"/dev/rtc\", O_RDONLY));\n\n if (rtc_fd < 0)\n\n return -1;\n\n ioctl(rtc_fd, RTC_IRQP_READ, ¤t_rtc_freq);\n\n if (current_rtc_freq != RTC_FREQ &&\n\n ioctl(rtc_fd, RTC_IRQP_SET, RTC_FREQ) < 0) {\n\n fprintf(stderr, \"Could not configure '/dev/rtc' to have a 1024 Hz timer. This is not a fatal\\n\"\n\n \"error, but for better emulation accuracy either use a 2.6 host Linux kernel or\\n\"\n\n \"type 'echo 1024 > /proc/sys/dev/rtc/max-user-freq' as root.\\n\");\n\n goto fail;\n\n }\n\n if (ioctl(rtc_fd, RTC_PIE_ON, 0) < 0) {\n\n fail:\n\n close(rtc_fd);\n\n return -1;\n\n }\n\n\n\n enable_sigio_timer(rtc_fd);\n\n\n\n t->priv = (void *)(long)rtc_fd;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "70ae65f5d91462e1905a53236179fde21cda3a2f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -40,11 +40,11 @@\n \n register_ioport_write(addr + 4, 4, 2, bmdma_addr_writew, bm);\n \n+ register_ioport_read(addr + 4, 4, 2, bmdma_addr_readw, bm);\n+\n+ register_ioport_write(addr + 4, 4, 4, bmdma_addr_writel, bm);\n+\n+ register_ioport_read(addr + 4, 4, 4, bmdma_addr_readl, bm);\n \n addr += 8;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bmdma_map(PCIDevice *pci_dev, int region_num,\n\n pcibus_t addr, pcibus_t size, int type)\n\n{\n\n PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, pci_dev);\n\n int i;\n\n\n\n for(i = 0;i < 2; i++) {\n\n BMDMAState *bm = &d->bmdma[i];\n\n d->bus[i].bmdma = bm;\n\n bm->bus = d->bus+i;\n\n bm->pci_dev = d;\n\n qemu_add_vm_change_state_handler(ide_dma_restart_cb, bm);\n\n\n\n register_ioport_write(addr, 1, 1, bmdma_cmd_writeb, bm);\n\n\n\n register_ioport_write(addr + 1, 3, 1, bmdma_writeb, bm);\n\n register_ioport_read(addr, 4, 1, bmdma_readb, bm);\n\n\n\n register_ioport_write(addr + 4, 4, 1, bmdma_addr_writeb, bm);\n\n register_ioport_read(addr + 4, 4, 1, bmdma_addr_readb, bm);\n\n register_ioport_write(addr + 4, 4, 2, bmdma_addr_writew, bm);\n\n register_ioport_read(addr + 4, 4, 2, bmdma_addr_readw, bm);\n\n register_ioport_write(addr + 4, 4, 4, bmdma_addr_writel, bm);\n\n register_ioport_read(addr + 4, 4, 4, bmdma_addr_readl, bm);\n\n addr += 8;\n\n }\n\n}\n"}} {"sample_id": "c547e5640d5b0993cdfb252331065c1a1d813bd8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int blkdebug_debug_resume(BlockDriverState *bs, const char *tag)\n \n+{\n+\n BDRVBlkdebugState *s = bs->opaque;\n \n BlkdebugSuspendedReq *r;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int blkdebug_debug_resume(BlockDriverState *bs, const char *tag)\n\n{\n\n BDRVBlkdebugState *s = bs->opaque;\n\n BlkdebugSuspendedReq *r;\n\n\n\n QLIST_FOREACH(r, &s->suspended_reqs, next) {\n\n if (!strcmp(r->tag, tag)) {\n\n qemu_coroutine_enter(r->co, NULL);\n\n return 0;\n\n }\n\n }\n\n return -ENOENT;\n\n}\n"}} {"sample_id": "a03a642d5ceb5f2f7c6ebbf56ff365dfbcdb65eb_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,7 +14,7 @@\n \n c->h264_h_loop_filter_chroma = ff_h264_h_loop_filter_chroma_neon;\n \n+\n \n c->weight_h264_pixels_tab[0] = ff_weight_h264_pixels_16_neon;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static av_cold void h264dsp_init_neon(H264DSPContext *c, const int bit_depth,\n\n const int chroma_format_idc)\n\n{\n\n if (bit_depth == 8) {\n\n c->h264_v_loop_filter_luma = ff_h264_v_loop_filter_luma_neon;\n\n c->h264_h_loop_filter_luma = ff_h264_h_loop_filter_luma_neon;\n\n c->h264_v_loop_filter_chroma = ff_h264_v_loop_filter_chroma_neon;\n\n c->h264_h_loop_filter_chroma = ff_h264_h_loop_filter_chroma_neon;\n\n\n\n c->weight_h264_pixels_tab[0] = ff_weight_h264_pixels_16_neon;\n\n c->weight_h264_pixels_tab[1] = ff_weight_h264_pixels_8_neon;\n\n c->weight_h264_pixels_tab[2] = ff_weight_h264_pixels_4_neon;\n\n\n\n c->biweight_h264_pixels_tab[0] = ff_biweight_h264_pixels_16_neon;\n\n c->biweight_h264_pixels_tab[1] = ff_biweight_h264_pixels_8_neon;\n\n c->biweight_h264_pixels_tab[2] = ff_biweight_h264_pixels_4_neon;\n\n\n\n c->h264_idct_add = ff_h264_idct_add_neon;\n\n c->h264_idct_dc_add = ff_h264_idct_dc_add_neon;\n\n c->h264_idct_add16 = ff_h264_idct_add16_neon;\n\n c->h264_idct_add16intra = ff_h264_idct_add16intra_neon;\n\n if (chroma_format_idc == 1)\n\n c->h264_idct_add8 = ff_h264_idct_add8_neon;\n\n c->h264_idct8_add = ff_h264_idct8_add_neon;\n\n c->h264_idct8_dc_add = ff_h264_idct8_dc_add_neon;\n\n c->h264_idct8_add4 = ff_h264_idct8_add4_neon;\n\n }\n\n}\n"}} {"sample_id": "211a185cba78aa8410e85de91630aa3a8c083883", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+void ff_insert_pad(unsigned idx, unsigned *count, size_t padidx_off,\n \n AVFilterPad **pads, AVFilterLink ***links,\n+\n+ AVFilterPad *newpad)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void ff_insert_pad(unsigned idx, unsigned *count, size_t padidx_off,\n\n AVFilterPad **pads, AVFilterLink ***links,\n\n AVFilterPad *newpad)\n\n{\n\n unsigned i;\n\n\n\n idx = FFMIN(idx, *count);\n\n\n\n *pads = av_realloc(*pads, sizeof(AVFilterPad) * (*count + 1));\n\n *links = av_realloc(*links, sizeof(AVFilterLink*) * (*count + 1));\n\n memmove(*pads + idx + 1, *pads + idx, sizeof(AVFilterPad) * (*count - idx));\n\n memmove(*links + idx + 1, *links + idx, sizeof(AVFilterLink*) * (*count - idx));\n\n memcpy(*pads + idx, newpad, sizeof(AVFilterPad));\n\n (*links)[idx] = NULL;\n\n\n\n (*count)++;\n\n for (i = idx + 1; i < *count; i++)\n\n if (*links[i])\n\n (*(unsigned *)((uint8_t *) *links[i] + padidx_off))++;\n\n}\n"}} {"sample_id": "7372c2b926200db295412efbb53f93773b7f1754_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,8 +5,8 @@\n switch (opsize) {\n \n case OS_BYTE: return 1;\n+\n+ case OS_WORD: return 2;\n \n case OS_LONG: return 4;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static inline int opsize_bytes(int opsize)\n\n{\n\n switch (opsize) {\n\n case OS_BYTE: return 1;\n\n case OS_WORD: return 2;\n\n case OS_LONG: return 4;\n\n case OS_SINGLE: return 4;\n\n case OS_DOUBLE: return 8;\n\n default:\n\n qemu_assert(0, \"bad operand size\");\n\n return 0;\n\n }\n\n}\n"}} {"sample_id": "2ed0f76655a76cc49f8a1a1d59e545f5906e7924", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+av_cold void ff_h264_free_context(H264Context *h)\n+\n+{\n+\n+ int i;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "av_cold void ff_h264_free_context(H264Context *h)\n\n{\n\n int i;\n\n\n\n free_tables(h); //FIXME cleanup init stuff perhaps\n\n\n\n for(i = 0; i < MAX_SPS_COUNT; i++)\n\n av_freep(h->sps_buffers + i);\n\n\n\n for(i = 0; i < MAX_PPS_COUNT; i++)\n\n av_freep(h->pps_buffers + i);\n\n}\n"}} {"sample_id": "f68945d42bab700d95b87f62e0898606ce2421ed_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n SaveStateEntry *se;\n qemu_put_be32(f, QEMU_VM_FILE_MAGIC);\n qemu_put_be32(f, QEMU_VM_FILE_VERSION);\n+ cpu_synchronize_all_states();\n+ QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {\n+ if (se->is_ram) {\n+ continue;\n }\n if ((!se->ops || !se->ops->save_state) && !se->vmsd) {\n continue;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int qemu_save_device_state(QEMUFile *f)\n{\n SaveStateEntry *se;\n qemu_put_be32(f, QEMU_VM_FILE_MAGIC);\n qemu_put_be32(f, QEMU_VM_FILE_VERSION);\n cpu_synchronize_all_states();\n QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {\n if (se->is_ram) {\n continue;\n }\n if ((!se->ops || !se->ops->save_state) && !se->vmsd) {\n continue;\n }\n save_section_header(f, se, QEMU_VM_SECTION_FULL);\n vmstate_save(f, se, NULL);\n }\n qemu_put_byte(f, QEMU_VM_EOF);\n return qemu_file_get_error(f);\n}"}} {"sample_id": "391a1327bd076c25c2b2509ab7ae0081c443b94e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n for (x = 0; x < w; x++) {\n \n+ int c = cur[-refs];\n+\n+ int d = (prev2[0] + next2[0])>>1;\n+\n+ int e = cur[+refs];\n \n int temporal_diff0 = FFABS(prev2[0] - next2[0]);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void filter_line_c(uint8_t *dst,\n\n uint8_t *prev, uint8_t *cur, uint8_t *next,\n\n int w, int refs, int parity, int mode)\n\n{\n\n int x;\n\n uint8_t *prev2 = parity ? prev : cur ;\n\n uint8_t *next2 = parity ? cur : next;\n\n for (x = 0; x < w; x++) {\n\n int c = cur[-refs];\n\n int d = (prev2[0] + next2[0])>>1;\n\n int e = cur[+refs];\n\n int temporal_diff0 = FFABS(prev2[0] - next2[0]);\n\n int temporal_diff1 =(FFABS(prev[-refs] - c) + FFABS(prev[+refs] - e) )>>1;\n\n int temporal_diff2 =(FFABS(next[-refs] - c) + FFABS(next[+refs] - e) )>>1;\n\n int diff = FFMAX3(temporal_diff0>>1, temporal_diff1, temporal_diff2);\n\n int spatial_pred = (c+e)>>1;\n\n int spatial_score = FFABS(cur[-refs-1] - cur[+refs-1]) + FFABS(c-e)\n\n + FFABS(cur[-refs+1] - cur[+refs+1]) - 1;\n\n\n\n#define CHECK(j)\\\n\n { int score = FFABS(cur[-refs-1+j] - cur[+refs-1-j])\\\n\n + FFABS(cur[-refs +j] - cur[+refs -j])\\\n\n + FFABS(cur[-refs+1+j] - cur[+refs+1-j]);\\\n\n if (score < spatial_score) {\\\n\n spatial_score= score;\\\n\n spatial_pred= (cur[-refs +j] + cur[+refs -j])>>1;\\\n\n\n\n CHECK(-1) CHECK(-2) }} }}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_55", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n \n \n+ if ((addr & ((1 << s->it_shift) - 1)) != 0) {\n+\n+ return;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void dp8393x_writew(void *opaque, target_phys_addr_t addr, uint32_t val)\n\n{\n\n dp8393xState *s = opaque;\n\n int reg;\n\n\n\n if ((addr & ((1 << s->it_shift) - 1)) != 0) {\n\n return;\n\n }\n\n\n\n reg = addr >> s->it_shift;\n\n\n\n write_register(s, reg, (uint16_t)val);\n\n}\n"}} {"sample_id": "eefa3d8ef649f9055611361e2201cca49f8c3433", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n union {\n \n char buf[QIO_CHANNEL_WEBSOCK_HEADER_LEN_64_BIT];\n+\n QIOChannelWebsockHeader ws;\n \n } header;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void qio_channel_websock_encode(QIOChannelWebsock *ioc)\n\n{\n\n size_t header_size;\n\n union {\n\n char buf[QIO_CHANNEL_WEBSOCK_HEADER_LEN_64_BIT];\n\n QIOChannelWebsockHeader ws;\n\n } header;\n\n\n\n if (!ioc->rawoutput.offset) {\n\n return;\n\n }\n\n\n\n header.ws.b0 = (1 << QIO_CHANNEL_WEBSOCK_HEADER_SHIFT_FIN) |\n\n (QIO_CHANNEL_WEBSOCK_OPCODE_BINARY_FRAME &\n\n QIO_CHANNEL_WEBSOCK_HEADER_FIELD_OPCODE);\n\n if (ioc->rawoutput.offset <\n\n QIO_CHANNEL_WEBSOCK_PAYLOAD_LEN_THRESHOLD_7_BIT) {\n\n header.ws.b1 = (uint8_t)ioc->rawoutput.offset;\n\n header_size = QIO_CHANNEL_WEBSOCK_HEADER_LEN_7_BIT;\n\n } else if (ioc->rawoutput.offset <\n\n QIO_CHANNEL_WEBSOCK_PAYLOAD_LEN_THRESHOLD_16_BIT) {\n\n header.ws.b1 = QIO_CHANNEL_WEBSOCK_PAYLOAD_LEN_MAGIC_16_BIT;\n\n header.ws.u.s16.l16 = cpu_to_be16((uint16_t)ioc->rawoutput.offset);\n\n header_size = QIO_CHANNEL_WEBSOCK_HEADER_LEN_16_BIT;\n\n } else {\n\n header.ws.b1 = QIO_CHANNEL_WEBSOCK_PAYLOAD_LEN_MAGIC_64_BIT;\n\n header.ws.u.s64.l64 = cpu_to_be64(ioc->rawoutput.offset);\n\n header_size = QIO_CHANNEL_WEBSOCK_HEADER_LEN_64_BIT;\n\n }\n\n header_size -= QIO_CHANNEL_WEBSOCK_HEADER_LEN_MASK;\n\n\n\n buffer_reserve(&ioc->encoutput, header_size + ioc->rawoutput.offset);\n\n buffer_append(&ioc->encoutput, header.buf, header_size);\n\n buffer_append(&ioc->encoutput, ioc->rawoutput.buffer,\n\n ioc->rawoutput.offset);\n\n buffer_reset(&ioc->rawoutput);\n\n}\n"}} {"sample_id": "f53a829bb9ef14be800556cbc02d8b20fc1050a7_15", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n {\n \n+ int offset = 0;\n+\n+ int ret;\n+\n+ while (nb_sectors > NBD_MAX_SECTORS) {\n \n ret = nbd_co_writev_1(client, sector_num,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int nbd_client_session_co_writev(NbdClientSession *client, int64_t sector_num,\n\n int nb_sectors, QEMUIOVector *qiov)\n\n{\n\n int offset = 0;\n\n int ret;\n\n while (nb_sectors > NBD_MAX_SECTORS) {\n\n ret = nbd_co_writev_1(client, sector_num,\n\n NBD_MAX_SECTORS, qiov, offset);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n offset += NBD_MAX_SECTORS * 512;\n\n sector_num += NBD_MAX_SECTORS;\n\n nb_sectors -= NBD_MAX_SECTORS;\n\n }\n\n return nbd_co_writev_1(client, sector_num, nb_sectors, qiov, offset);\n\n}\n"}} {"sample_id": "80624c938d2d9d2b2cca56326876f213c31e1202", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void scsi_dma_complete(void *opaque, int ret)\n \n+{\n+\n+ SCSIDiskReq *r = (SCSIDiskReq *)opaque;\n+\n+ SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void scsi_dma_complete(void *opaque, int ret)\n\n{\n\n SCSIDiskReq *r = (SCSIDiskReq *)opaque;\n\n SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);\n\n\n\n bdrv_acct_done(s->qdev.conf.bs, &r->acct);\n\n\n\n if (ret) {\n\n if (scsi_handle_rw_error(r, -ret)) {\n\n goto done;\n\n }\n\n }\n\n\n\n r->sector += r->sector_count;\n\n r->sector_count = 0;\n\n scsi_req_complete(&r->req, GOOD);\n\n\n\ndone:\n\n if (!r->req.io_canceled) {\n\n scsi_req_unref(&r->req);\n\n }\n\n}\n"}} {"sample_id": "a2b7ed3274b2b575f6d2e8fd3bf0a6a1818b2c1e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n tag = mov_get_rawvideo_codec_tag(s, track);\n \n else if (track->enc->codec_type == AVMEDIA_TYPE_VIDEO) {\n+\n+ tag = ff_codec_get_tag(codec_movvideo_tags, track->enc->codec_id);\n+\n+ if (!tag) { // if no mac fcc found, try with Microsoft tags\n+\n tag = ff_codec_get_tag(ff_codec_bmp_tags, track->enc->codec_id);\n \n if (tag)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mov_get_codec_tag(AVFormatContext *s, MOVTrack *track)\n\n{\n\n int tag = track->enc->codec_tag;\n\n\n\n if (!tag || (track->enc->strict_std_compliance >= FF_COMPLIANCE_NORMAL &&\n\n (tag == MKTAG('d','v','c','p') ||\n\n track->enc->codec_id == CODEC_ID_RAWVIDEO ||\n\n track->enc->codec_id == CODEC_ID_H263 ||\n\n av_get_bits_per_sample(track->enc->codec_id)))) { // pcm audio\n\n if (track->enc->codec_id == CODEC_ID_DVVIDEO)\n\n tag = mov_get_dv_codec_tag(s, track);\n\n else if (track->enc->codec_id == CODEC_ID_RAWVIDEO)\n\n tag = mov_get_rawvideo_codec_tag(s, track);\n\n else if (track->enc->codec_type == AVMEDIA_TYPE_VIDEO) {\n\n tag = ff_codec_get_tag(codec_movvideo_tags, track->enc->codec_id);\n\n if (!tag) { // if no mac fcc found, try with Microsoft tags\n\n tag = ff_codec_get_tag(ff_codec_bmp_tags, track->enc->codec_id);\n\n if (tag)\n\n av_log(s, AV_LOG_INFO, \"Warning, using MS style video codec tag, \"\n\n \"the file may be unplayable!\\n\");\n\n }\n\n } else if (track->enc->codec_type == AVMEDIA_TYPE_AUDIO) {\n\n tag = ff_codec_get_tag(codec_movaudio_tags, track->enc->codec_id);\n\n if (!tag) { // if no mac fcc found, try with Microsoft tags\n\n int ms_tag = ff_codec_get_tag(ff_codec_wav_tags, track->enc->codec_id);\n\n if (ms_tag) {\n\n tag = MKTAG('m', 's', ((ms_tag >> 8) & 0xff), (ms_tag & 0xff));\n\n av_log(s, AV_LOG_INFO, \"Warning, using MS style audio codec tag, \"\n\n \"the file may be unplayable!\\n\");\n\n }\n\n }\n\n } else if (track->enc->codec_type == AVMEDIA_TYPE_SUBTITLE)\n\n tag = ff_codec_get_tag(ff_codec_movsubtitle_tags, track->enc->codec_id);\n\n }\n\n\n\n return tag;\n\n}\n"}} {"sample_id": "d0ebd78890fba2ab458ec34763dae8566ccb1b72", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static uint32_t parse_enumeration(char *str,\n EnumTable *table, uint32_t not_found_value)\n {\n+ uint32_t ret = not_found_value;\n+ while (table->name != NULL) {\n+ if (strcmp(table->name, str) == 0) {\n ret = table->value;\n break;\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static uint32_t parse_enumeration(char *str,\n EnumTable *table, uint32_t not_found_value)\n{\n uint32_t ret = not_found_value;\n while (table->name != NULL) {\n if (strcmp(table->name, str) == 0) {\n ret = table->value;\n break;\n }\n table++;\n }\n return ret;\n}"}} {"sample_id": "3a4dbe6aa934370a92372528c1255ee1504965ee", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,8 +11,8 @@\n \n vdev->msix = NULL;\n \n+ }\n+\n+ vfio_put_base_device(&vdev->vbasedev);\n+\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void vfio_put_device(VFIOPCIDevice *vdev)\n\n{\n\n g_free(vdev->vbasedev.name);\n\n if (vdev->msix) {\n\n\n g_free(vdev->msix);\n\n vdev->msix = NULL;\n\n }\n\n vfio_put_base_device(&vdev->vbasedev);\n\n}"}} {"sample_id": "e3c9d76acc984218264bbc6435b0c09f959ed9b8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void virtio_scsi_class_init(ObjectClass *klass, void *data)\n \n {\n+\n DeviceClass *dc = DEVICE_CLASS(klass);\n \n VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void virtio_scsi_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);\n\n dc->exit = virtio_scsi_device_exit;\n\n dc->props = virtio_scsi_properties;\n\n set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);\n\n vdc->init = virtio_scsi_device_init;\n\n vdc->set_config = virtio_scsi_set_config;\n\n vdc->get_features = virtio_scsi_get_features;\n\n vdc->reset = virtio_scsi_reset;\n\n}\n"}} {"sample_id": "c50f65118b429e6847d5c11b1a20a560d61c34b7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n bool gs_allowed(void)\n \n {\n+\n+ if (kvm_enabled()) {\n+\n+ MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());\n+\n if (object_class_dynamic_cast(OBJECT_CLASS(mc),\n \n TYPE_S390_CCW_MACHINE)) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool gs_allowed(void)\n\n{\n\n if (kvm_enabled()) {\n\n MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());\n\n if (object_class_dynamic_cast(OBJECT_CLASS(mc),\n\n TYPE_S390_CCW_MACHINE)) {\n\n S390CcwMachineClass *s390mc = S390_MACHINE_CLASS(mc);\n\n\n\n return s390mc->gs_allowed;\n\n }\n\n /* Make sure the \"none\" machine can have gs */\n\n return true;\n\n }\n\n return false;\n\n}\n"}} {"sample_id": "a150bad4062a29fc11b32117bc1ade38115cd95b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n AVFilterBufferRef *samplesref =\n \n avfilter_get_audio_buffer_ref_from_arrays((uint8_t **)frame->data, frame->linesize[0], perms,\n+\n+ frame->nb_samples, frame->format,\n+\n+ av_frame_get_channel_layout(frame));\n+\n if (!samplesref)\n \n return NULL;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "AVFilterBufferRef *avfilter_get_audio_buffer_ref_from_frame(const AVFrame *frame,\n\n int perms)\n\n{\n\n AVFilterBufferRef *samplesref =\n\n avfilter_get_audio_buffer_ref_from_arrays((uint8_t **)frame->data, frame->linesize[0], perms,\n\n frame->nb_samples, frame->format,\n\n av_frame_get_channel_layout(frame));\n\n if (!samplesref)\n\n return NULL;\n\n avfilter_copy_frame_props(samplesref, frame);\n\n return samplesref;\n\n}\n"}} {"sample_id": "a8eae58556c7dc693d757a9144045fbee7434c6c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n OHCIPCIState *ohci = DO_UPCAST(OHCIPCIState, pci_dev, dev);\n \n+ int num_ports = 3;\n+\n+\n+\n+ pci_config_set_vendor_id(ohci->pci_dev.config, PCI_VENDOR_ID_APPLE);\n \n pci_config_set_device_id(ohci->pci_dev.config,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int usb_ohci_initfn_pci(struct PCIDevice *dev)\n\n{\n\n OHCIPCIState *ohci = DO_UPCAST(OHCIPCIState, pci_dev, dev);\n\n int num_ports = 3;\n\n\n\n pci_config_set_vendor_id(ohci->pci_dev.config, PCI_VENDOR_ID_APPLE);\n\n pci_config_set_device_id(ohci->pci_dev.config,\n\n PCI_DEVICE_ID_APPLE_IPID_USB);\n\n ohci->pci_dev.config[PCI_CLASS_PROG] = 0x10; /* OHCI */\n\n pci_config_set_class(ohci->pci_dev.config, PCI_CLASS_SERIAL_USB);\n\n /* TODO: RST# value should be 0. */\n\n ohci->pci_dev.config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin 1 */\n\n\n\n usb_ohci_init(&ohci->state, &dev->qdev, num_ports, 0);\n\n ohci->state.irq = ohci->pci_dev.irq[0];\n\n\n\n /* TODO: avoid cast below by using dev */\n\n pci_register_bar_simple(&ohci->pci_dev, 0, 256, 0, ohci->state.mem);\n\n return 0;\n\n}\n"}} {"sample_id": "6735d433729f80fab80c0a1f70ae131398645613", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n USBPacket *usb_ep_find_packet_by_id(USBDevice *dev, int pid, int ep,\n \n uint64_t id)\n+\n {\n \n struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "USBPacket *usb_ep_find_packet_by_id(USBDevice *dev, int pid, int ep,\n\n uint64_t id)\n\n{\n\n struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);\n\n USBPacket *p;\n\n\n\n while ((p = QTAILQ_FIRST(&uep->queue)) != NULL) {\n\n if (p->id == id) {\n\n return p;\n\n }\n\n }\n\n\n\n return NULL;\n\n}\n"}} {"sample_id": "7df9381b7aa56c897e344f3bfe43bf5848bbd3e0_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -47,11 +47,11 @@\n phys_val = le32_to_cpu(phys_val);\n \n }\n+\n+\n+\n+ val = (emu_val & emu_bits) | (phys_val & ~emu_bits);\n+\n \n \n trace_vfio_pci_read_config(vdev->vbasedev.name, addr, len, val);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint32_t vfio_pci_read_config(PCIDevice *pdev, uint32_t addr, int len)\n\n{\n\n VFIOPCIDevice *vdev = DO_UPCAST(VFIOPCIDevice, pdev, pdev);\n\n uint32_t emu_bits = 0, emu_val = 0, phys_val = 0, val;\n\n\n\n memcpy(&emu_bits, vdev->emulated_config_bits + addr, len);\n\n emu_bits = le32_to_cpu(emu_bits);\n\n\n\n if (emu_bits) {\n\n emu_val = pci_default_read_config(pdev, addr, len);\n\n }\n\n\n\n if (~emu_bits & (0xffffffffU >> (32 - len * 8))) {\n\n ssize_t ret;\n\n\n\n ret = pread(vdev->vbasedev.fd, &phys_val, len,\n\n vdev->config_offset + addr);\n\n if (ret != len) {\n\n error_report(\"%s(%04x:%02x:%02x.%x, 0x%x, 0x%x) failed: %m\",\n\n __func__, vdev->host.domain, vdev->host.bus,\n\n vdev->host.slot, vdev->host.function, addr, len);\n\n return -errno;\n\n }\n\n phys_val = le32_to_cpu(phys_val);\n\n }\n\n\n\n val = (emu_val & emu_bits) | (phys_val & ~emu_bits);\n\n\n\n trace_vfio_pci_read_config(vdev->vbasedev.name, addr, len, val);\n\n\n\n return val;\n\n}\n"}} {"sample_id": "9b2fadda3e0196ffd485adde4fe9cdd6fae35300_26", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n static void gen_tlbiva(DisasContext *ctx)\n+\n+{\n+\n+#if defined(CONFIG_USER_ONLY)\n \n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n \n #else\n \n TCGv t0;\n+\n if (unlikely(ctx->pr)) {\n \n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_tlbiva(DisasContext *ctx)\n\n{\n\n#if defined(CONFIG_USER_ONLY)\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n#else\n\n TCGv t0;\n\n if (unlikely(ctx->pr)) {\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n return;\n\n }\n\n t0 = tcg_temp_new();\n\n gen_addr_reg_index(ctx, t0);\n\n gen_helper_tlbiva(cpu_env, cpu_gpr[rB(ctx->opcode)]);\n\n tcg_temp_free(t0);\n\n#endif\n\n}\n"}} {"sample_id": "b12d92efd6c0d48665383a9baecc13e7ebbd8a22_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n uint32_t *pal = ctx->pal + 256 - ctx->free_colours;\n \n \n+\n if (!ctx->free_colours)\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int decode_pal(MSS12Context *ctx, ArithCoder *acoder)\n\n{\n\n int i, ncol, r, g, b;\n\n uint32_t *pal = ctx->pal + 256 - ctx->free_colours;\n\n\n\n if (!ctx->free_colours)\n\n return 0;\n\n\n\n ncol = arith_get_number(acoder, ctx->free_colours + 1);\n\n for (i = 0; i < ncol; i++) {\n\n r = arith_get_bits(acoder, 8);\n\n g = arith_get_bits(acoder, 8);\n\n b = arith_get_bits(acoder, 8);\n\n *pal++ = (0xFF << 24) | (r << 16) | (g << 8) | b;\n\n }\n\n\n\n return !!ncol;\n\n}\n"}} {"sample_id": "04618b98e361951f550b3970865803a875f4a8f0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n ctx += 2;\n \n+ }\n+\n+\n+\n+ while( get_cabac( &h->cabac, &h->cabac_state[54+ctx] ) ) {\n \n ref++;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int decode_cabac_mb_ref( H264Context *h, int list, int n ) {\n\n int refa = h->ref_cache[list][scan8[n] - 1];\n\n int refb = h->ref_cache[list][scan8[n] - 8];\n\n int ref = 0;\n\n int ctx = 0;\n\n\n\n if( h->slice_type_nos == FF_B_TYPE) {\n\n if( refa > 0 && !h->direct_cache[scan8[n] - 1] )\n\n ctx++;\n\n if( refb > 0 && !h->direct_cache[scan8[n] - 8] )\n\n ctx += 2;\n\n } else {\n\n if( refa > 0 )\n\n ctx++;\n\n if( refb > 0 )\n\n ctx += 2;\n\n }\n\n\n\n while( get_cabac( &h->cabac, &h->cabac_state[54+ctx] ) ) {\n\n ref++;\n\n if( ctx < 4 )\n\n ctx = 4;\n\n else\n\n ctx = 5;\n\n if(ref >= 32 /*h->ref_list[list]*/){\n\n av_log(h->s.avctx, AV_LOG_ERROR, \"overflow in decode_cabac_mb_ref\\n\");\n\n return 0; //FIXME we should return -1 and check the return everywhere\n\n }\n\n }\n\n return ref;\n\n}\n"}} {"sample_id": "323e6fead07c75f418e4b60704a4f437bb3483b2_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n {\n \n AC3EncodeContext *s = avctx->priv_data;\n+\n const SampleType *samples = data;\n \n int ret;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int ac3_encode_frame(AVCodecContext *avctx, unsigned char *frame,\n\n int buf_size, void *data)\n\n{\n\n AC3EncodeContext *s = avctx->priv_data;\n\n const SampleType *samples = data;\n\n int ret;\n\n\n\n if (s->bit_alloc.sr_code == 1)\n\n adjust_frame_size(s);\n\n\n\n deinterleave_input_samples(s, samples);\n\n\n\n apply_mdct(s);\n\n\n\n compute_rematrixing_strategy(s);\n\n\n\n scale_coefficients(s);\n\n\n\n apply_rematrixing(s);\n\n\n\n process_exponents(s);\n\n\n\n ret = compute_bit_allocation(s);\n\n if (ret) {\n\n av_log(avctx, AV_LOG_ERROR, \"Bit allocation failed. Try increasing the bitrate.\\n\");\n\n return ret;\n\n }\n\n\n\n quantize_mantissas(s);\n\n\n\n output_frame(s, frame);\n\n\n\n return s->frame_size;\n\n}\n"}} {"sample_id": "30aa5c0d303c334c646e9db1ebadda0c0db8b13f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+static void nvram_writeb (void *opaque, target_phys_addr_t addr, uint32_t value)\n+\n+{\n+\n+ ds1225y_t *NVRAM = opaque;\n+\n+ int64_t pos;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void nvram_writeb (void *opaque, target_phys_addr_t addr, uint32_t value)\r\n\n{\r\n\n ds1225y_t *NVRAM = opaque;\r\n\n int64_t pos;\r\n\n\r\n\n pos = addr - NVRAM->mem_base;\r\n\n if (ds1225y_set_to_mode(NVRAM, writemode, \"wb\"))\r\n\n {\r\n\n qemu_fseek(NVRAM->file, pos, SEEK_SET);\r\n\n qemu_put_byte(NVRAM->file, (int)value);\r\n\n }\r\n\n}\r\n"}} {"sample_id": "51b19ebe4320f3dcd93cea71235c1219318ddfd2_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n ssize_t virtio_pdu_vunmarshal(V9fsPDU *pdu, size_t offset,\n \n const char *fmt, va_list ap)\n+\n+{\n+\n+ V9fsState *s = pdu->s;\n \n V9fsVirtioState *v = container_of(s, V9fsVirtioState, state);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "ssize_t virtio_pdu_vunmarshal(V9fsPDU *pdu, size_t offset,\n\n const char *fmt, va_list ap)\n\n{\n\n V9fsState *s = pdu->s;\n\n V9fsVirtioState *v = container_of(s, V9fsVirtioState, state);\n\n VirtQueueElement *elem = &v->elems[pdu->idx];\n\n\n\n return v9fs_iov_vunmarshal(elem->out_sg, elem->out_num, offset, 1, fmt, ap);\n\n}\n"}} {"sample_id": "a426e122173f36f05ea2cb72dcff77b7408546ce", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n int i;\n+\n+\n+\n+ for (i = 0; i < ARRAY_SIZE(s->slots); i++) {\n+\n /* KVM private memory slots */\n \n if (i >= 8 && i < 12)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static KVMSlot *kvm_alloc_slot(KVMState *s)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < ARRAY_SIZE(s->slots); i++) {\n\n /* KVM private memory slots */\n\n if (i >= 8 && i < 12)\n\n continue;\n\n if (s->slots[i].memory_size == 0)\n\n return &s->slots[i];\n\n }\n\n\n\n fprintf(stderr, \"%s: no free slot available\\n\", __func__);\n\n abort();\n\n}\n"}} {"sample_id": "7860a380ac2a9fd09a6e8f31fd9db5318fc91285", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n struct sockaddr_in addr;\n \n+ socklen_t addr_len = sizeof(addr);\n+\n+\n+\n+ int fd = accept(server_fd, (struct sockaddr *)&addr, &addr_len);\n \n nbd_started = true;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void nbd_accept(void *opaque)\n\n{\n\n int server_fd = (uintptr_t) opaque;\n\n struct sockaddr_in addr;\n\n socklen_t addr_len = sizeof(addr);\n\n\n\n int fd = accept(server_fd, (struct sockaddr *)&addr, &addr_len);\n\n nbd_started = true;\n\n if (fd >= 0 && nbd_client_new(exp, fd, nbd_client_closed)) {\n\n nb_fds++;\n\n }\n\n}\n"}} {"sample_id": "dfd100f242370886bb6732f70f1f7cbd8eb9fedc_19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n VncServerInfo2 *info;\n \n Error *err = NULL;\n+\n+ SocketAddress *addr;\n+\n+\n+\n addr = qio_channel_socket_get_local_address(ioc, &err);\n \n if (!addr) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static VncServerInfo2List *qmp_query_server_entry(QIOChannelSocket *ioc,\n\n bool websocket,\n\n int auth,\n\n int subauth,\n\n VncServerInfo2List *prev)\n\n{\n\n VncServerInfo2List *list;\n\n VncServerInfo2 *info;\n\n Error *err = NULL;\n\n SocketAddress *addr;\n\n\n\n addr = qio_channel_socket_get_local_address(ioc, &err);\n\n if (!addr) {\n\n error_free(err);\n\n return prev;\n\n }\n\n\n\n info = g_new0(VncServerInfo2, 1);\n\n vnc_init_basic_info(addr, qapi_VncServerInfo2_base(info), &err);\n\n qapi_free_SocketAddress(addr);\n\n if (err) {\n\n qapi_free_VncServerInfo2(info);\n\n error_free(err);\n\n return prev;\n\n }\n\n info->websocket = websocket;\n\n\n\n qmp_query_auth(auth, subauth, &info->auth,\n\n &info->vencrypt, &info->has_vencrypt);\n\n\n\n list = g_new0(VncServerInfo2List, 1);\n\n list->value = info;\n\n list->next = prev;\n\n return list;\n\n}\n"}} {"sample_id": "a903f40c314c57734ffd651786c953541cfc43a8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,7 +21,7 @@\n }\n \n slog(\"guest-file-open called, filepath: %s, mode: %s\", path, mode);\n+\n fh = safe_open_or_create(path, mode, &local_err);\n \n if (local_err != NULL) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int64_t qmp_guest_file_open(const char *path, bool has_mode, const char *mode,\n\n Error **errp)\n\n{\n\n FILE *fh;\n\n Error *local_err = NULL;\n\n int fd;\n\n int64_t ret = -1, handle;\n\n\n\n if (!has_mode) {\n\n mode = \"r\";\n\n }\n\n slog(\"guest-file-open called, filepath: %s, mode: %s\", path, mode);\n\n fh = safe_open_or_create(path, mode, &local_err);\n\n if (local_err != NULL) {\n\n error_propagate(errp, local_err);\n\n return -1;\n\n }\n\n\n\n /* set fd non-blocking to avoid common use cases (like reading from a\n\n * named pipe) from hanging the agent\n\n */\n\n fd = fileno(fh);\n\n ret = fcntl(fd, F_GETFL);\n\n ret = fcntl(fd, F_SETFL, ret | O_NONBLOCK);\n\n if (ret == -1) {\n\n error_setg_errno(errp, errno, \"failed to make file '%s' non-blocking\",\n\n path);\n\n fclose(fh);\n\n return -1;\n\n }\n\n\n\n handle = guest_file_handle_add(fh, errp);\n\n if (error_is_set(errp)) {\n\n fclose(fh);\n\n return -1;\n\n }\n\n\n\n slog(\"guest-file-open, handle: %\" PRId64, handle);\n\n return handle;\n\n}\n"}} {"sample_id": "58b1cba0c9173741cf769117a735b429356d83c0_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static unsigned int read_sbr_data(AACContext *ac, SpectralBandReplication *sbr,\n \n GetBitContext *gb, int id_aac)\n+\n {\n+\n unsigned int cnt = get_bits_count(gb);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static unsigned int read_sbr_data(AACContext *ac, SpectralBandReplication *sbr,\n\n GetBitContext *gb, int id_aac)\n\n{\n\n unsigned int cnt = get_bits_count(gb);\n\n\n\n if (id_aac == TYPE_SCE || id_aac == TYPE_CCE) {\n\n read_sbr_single_channel_element(ac, sbr, gb);\n\n } else if (id_aac == TYPE_CPE) {\n\n read_sbr_channel_pair_element(ac, sbr, gb);\n\n } else {\n\n av_log(ac->avccontext, AV_LOG_ERROR,\n\n \"Invalid bitstream - cannot apply SBR to element type %d\\n\", id_aac);\n\n sbr->start = 0;\n\n return get_bits_count(gb) - cnt;\n\n }\n\n if (get_bits1(gb)) { // bs_extended_data\n\n int num_bits_left = get_bits(gb, 4); // bs_extension_size\n\n if (num_bits_left == 15)\n\n num_bits_left += get_bits(gb, 8); // bs_esc_count\n\n\n\n num_bits_left <<= 3;\n\n while (num_bits_left > 7) {\n\n num_bits_left -= 2;\n\n read_sbr_extension(ac, sbr, gb, get_bits(gb, 2), &num_bits_left); // bs_extension_id\n\n }\n\n }\n\n\n\n return get_bits_count(gb) - cnt;\n\n}\n"}} {"sample_id": "0187688f3270433269fc7d4909ad36dc5c5db7aa_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -45,11 +45,11 @@\n \n if (dc->rd) {\n \n+ gen_load(dc, cpu_R[dc->rd], *addr, size);\n+\n+ } else {\n+\n+ gen_load(dc, env_imm, *addr, size);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void dec_load(DisasContext *dc)\n\n{\n\n TCGv t, *addr;\n\n unsigned int size;\n\n\n\n size = 1 << (dc->opcode & 3);\n\n\n\n\n\n\n\n\n\n LOG_DIS(\"l %x %d\\n\", dc->opcode, size);\n\n t_sync_flags(dc);\n\n addr = compute_ldst_addr(dc, &t);\n\n\n\n /* If we get a fault on a dslot, the jmpstate better be in sync. */\n\n sync_jmpstate(dc);\n\n\n\n /* Verify alignment if needed. */\n\n if ((dc->env->pvr.regs[2] & PVR2_UNALIGNED_EXC_MASK) && size > 1) {\n\n gen_helper_memalign(*addr, tcg_const_tl(dc->rd),\n\n tcg_const_tl(0), tcg_const_tl(size - 1));\n\n\n\n\n if (dc->rd) {\n\n gen_load(dc, cpu_R[dc->rd], *addr, size);\n\n } else {\n\n gen_load(dc, env_imm, *addr, size);\n\n\n\n\n if (addr == &t)\n\n tcg_temp_free(t);\n"}} {"sample_id": "fff23ee9a5de74ab111b3cea9eec56782e7d7c50", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n async->uhci = s;\n \n+ async->valid = 0;\n+\n+ async->td = 0;\n+\n+ async->token = 0;\n \n async->done = 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static UHCIAsync *uhci_async_alloc(UHCIState *s)\n\n{\n\n UHCIAsync *async = g_malloc(sizeof(UHCIAsync));\n\n\n\n memset(&async->packet, 0, sizeof(async->packet));\n\n async->uhci = s;\n\n async->valid = 0;\n\n async->td = 0;\n\n async->token = 0;\n\n async->done = 0;\n\n async->isoc = 0;\n\n usb_packet_init(&async->packet);\n\n qemu_sglist_init(&async->sgl, 1);\n\n\n\n return async;\n\n}\n"}} {"sample_id": "f5b6ffcf2a94337df31e801dd11b34896bd4fe2b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -65,11 +65,11 @@\n res_out = req->data_len;\n \n } else {\n+\n+ res_in = req->data_len;\n+\n+ }\n+\n }\n \n vscsi_send_rsp(s, req, status, res_in, res_out);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vscsi_command_complete(SCSIRequest *sreq, uint32_t status)\n\n{\n\n VSCSIState *s = DO_UPCAST(VSCSIState, vdev.qdev, sreq->bus->qbus.parent);\n\n vscsi_req *req = sreq->hba_private;\n\n int32_t res_in = 0, res_out = 0;\n\n\n\n dprintf(\"VSCSI: SCSI cmd complete, r=0x%x tag=0x%x status=0x%x, req=%p\\n\",\n\n reason, sreq->tag, status, req);\n\n if (req == NULL) {\n\n fprintf(stderr, \"VSCSI: Can't find request for tag 0x%x\\n\", sreq->tag);\n\n return;\n\n }\n\n\n\n if (status == CHECK_CONDITION) {\n\n req->senselen = scsi_req_get_sense(req->sreq, req->sense,\n\n sizeof(req->sense));\n\n status = 0;\n\n dprintf(\"VSCSI: Sense data, %d bytes:\\n\", len);\n\n dprintf(\" %02x %02x %02x %02x %02x %02x %02x %02x\\n\",\n\n req->sense[0], req->sense[1], req->sense[2], req->sense[3],\n\n req->sense[4], req->sense[5], req->sense[6], req->sense[7]);\n\n dprintf(\" %02x %02x %02x %02x %02x %02x %02x %02x\\n\",\n\n req->sense[8], req->sense[9], req->sense[10], req->sense[11],\n\n req->sense[12], req->sense[13], req->sense[14], req->sense[15]);\n\n }\n\n\n\n dprintf(\"VSCSI: Command complete err=%d\\n\", status);\n\n if (status == 0) {\n\n /* We handle overflows, not underflows for normal commands,\n\n * but hopefully nobody cares\n\n */\n\n if (req->writing) {\n\n res_out = req->data_len;\n\n } else {\n\n res_in = req->data_len;\n\n }\n\n }\n\n vscsi_send_rsp(s, req, status, res_in, res_out);\n\n vscsi_put_req(req);\n\n}\n"}} {"sample_id": "ac47e014bbaf5163871a8beb7522015e0bc27615", "diff": "--- a/source.c\n+++ b/source.c\n@@ -49,11 +49,11 @@\n put_bits(&pb, 2, 0); /* number_of_raw_data_blocks_in_frame */\n \n \n+\n+ flush_put_bits(&pb);\n+\n+\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int ff_adts_write_frame_header(ADTSContext *ctx,\n\n uint8_t *buf, int size, int pce_size)\n\n{\n\n PutBitContext pb;\n\n\n\n init_put_bits(&pb, buf, ADTS_HEADER_SIZE);\n\n\n\n /* adts_fixed_header */\n\n put_bits(&pb, 12, 0xfff); /* syncword */\n\n put_bits(&pb, 1, 0); /* ID */\n\n put_bits(&pb, 2, 0); /* layer */\n\n put_bits(&pb, 1, 1); /* protection_absent */\n\n put_bits(&pb, 2, ctx->objecttype); /* profile_objecttype */\n\n put_bits(&pb, 4, ctx->sample_rate_index);\n\n put_bits(&pb, 1, 0); /* private_bit */\n\n put_bits(&pb, 3, ctx->channel_conf); /* channel_configuration */\n\n put_bits(&pb, 1, 0); /* original_copy */\n\n put_bits(&pb, 1, 0); /* home */\n\n\n\n /* adts_variable_header */\n\n put_bits(&pb, 1, 0); /* copyright_identification_bit */\n\n put_bits(&pb, 1, 0); /* copyright_identification_start */\n\n put_bits(&pb, 13, ADTS_HEADER_SIZE + size + pce_size); /* aac_frame_length */\n\n put_bits(&pb, 11, 0x7ff); /* adts_buffer_fullness */\n\n put_bits(&pb, 2, 0); /* number_of_raw_data_blocks_in_frame */\n\n\n\n flush_put_bits(&pb);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "2278a69e7020d86a8c73a28474e7709d3e7d5081", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n for (i = 0; i < iov_cnt && size; i++) {\n \n+ if (iov_off < (iovec_off + iov[i].iov_len)) {\n+\n+ size_t len = MIN((iovec_off + iov[i].iov_len) - iov_off , size);\n+\n+\n \n memset(iov[i].iov_base + (iov_off - iovec_off), fillc, len);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "size_t iov_memset(const struct iovec *iov, const unsigned int iov_cnt,\n\n size_t iov_off, int fillc, size_t size)\n\n{\n\n size_t iovec_off, buf_off;\n\n unsigned int i;\n\n\n\n iovec_off = 0;\n\n buf_off = 0;\n\n for (i = 0; i < iov_cnt && size; i++) {\n\n if (iov_off < (iovec_off + iov[i].iov_len)) {\n\n size_t len = MIN((iovec_off + iov[i].iov_len) - iov_off , size);\n\n\n\n memset(iov[i].iov_base + (iov_off - iovec_off), fillc, len);\n\n\n\n buf_off += len;\n\n iov_off += len;\n\n size -= len;\n\n }\n\n iovec_off += iov[i].iov_len;\n\n }\n\n return buf_off;\n\n}\n"}} {"sample_id": "1c29331248d82e5a9caaf7974756a9d8bd5cd1e5_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n return mknod(rpath(ctx, path), mode, dev);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int local_mknod(FsContext *ctx, const char *path, mode_t mode, dev_t dev)\n\n{\n\n return mknod(rpath(ctx, path), mode, dev);\n\n}\n"}} {"sample_id": "ad674e53b5cce265fadafbde2c6a4f190345cd00_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void DBDMA_run (DBDMA_channel *ch)\n \n {\n+\n+ int channel;\n+\n+\n \n for (channel = 0; channel < DBDMA_CHANNELS; channel++, ch++) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void DBDMA_run (DBDMA_channel *ch)\n\n{\n\n int channel;\n\n\n\n for (channel = 0; channel < DBDMA_CHANNELS; channel++, ch++) {\n\n uint32_t status = be32_to_cpu(ch->regs[DBDMA_STATUS]);\n\n if (!ch->processing && (status & RUN) && (status & ACTIVE))\n\n channel_run(ch);\n\n }\n\n}\n"}} {"sample_id": "82f19afefe4f28db0e2eefbc2d06eee0def74a53", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n get_string(s, \"title\", buf + 3, 30);\n \n get_string(s, \"artist\", buf + 33, 30);\n+\n+ get_string(s, \"album\", buf + 63, 30);\n+\n+ get_string(s, \"date\", buf + 93, 4);\n+\n get_string(s, \"comment\", buf + 97, 30);\n \n if (buf[125] == 0 && buf[126] != 0)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int parse_tag(AVFormatContext *s, const uint8_t *buf)\n\n{\n\n int genre;\n\n\n\n if (!(buf[0] == 'T' &&\n\n buf[1] == 'A' &&\n\n buf[2] == 'G'))\n\n return -1;\n\n get_string(s, \"title\", buf + 3, 30);\n\n get_string(s, \"artist\", buf + 33, 30);\n\n get_string(s, \"album\", buf + 63, 30);\n\n get_string(s, \"date\", buf + 93, 4);\n\n get_string(s, \"comment\", buf + 97, 30);\n\n if (buf[125] == 0 && buf[126] != 0)\n\n av_metadata_set2(&s->metadata, \"track\", av_d2str(buf[126]), AV_METADATA_DONT_STRDUP_VAL);\n\n genre = buf[127];\n\n if (genre <= ID3v1_GENRE_MAX)\n\n av_metadata_set2(&s->metadata, \"genre\", ff_id3v1_genre_str[genre], 0);\n\n return 0;\n\n}\n"}} {"sample_id": "ec53b45bcd1f74f7a4c31331fa6d50b402cd6d26_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n void cpu_single_step(CPUState *cpu, int enabled)\n \n+{\n+\n+#if defined(TARGET_HAS_ICE)\n+\n+ if (cpu->singlestep_enabled != enabled) {\n \n cpu->singlestep_enabled = enabled;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void cpu_single_step(CPUState *cpu, int enabled)\n\n{\n\n#if defined(TARGET_HAS_ICE)\n\n if (cpu->singlestep_enabled != enabled) {\n\n cpu->singlestep_enabled = enabled;\n\n if (kvm_enabled()) {\n\n kvm_update_guest_debug(cpu, 0);\n\n } else {\n\n /* must flush all the translated code to avoid inconsistencies */\n\n /* XXX: only flush what is necessary */\n\n CPUArchState *env = cpu->env_ptr;\n\n tb_flush(env);\n\n }\n\n }\n\n#endif\n\n}\n"}} {"sample_id": "403ee835e7913eb9536b22c2b22edfdd700166a9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n int url_open_dyn_packet_buf(AVIOContext **s, int max_packet_size)\n \n+{\n+\n if (max_packet_size <= 0)\n \n return -1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int url_open_dyn_packet_buf(AVIOContext **s, int max_packet_size)\n\n{\n\n if (max_packet_size <= 0)\n\n return -1;\n\n return url_open_dyn_buf_internal(s, max_packet_size);\n\n}\n"}} {"sample_id": "0372e73f917e72c40b09270f771046fc142be4a7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+av_cold void ff_intrax8_common_init(IntraX8Context *w, MpegEncContext *const s)\n+\n+{\n+\n+ w->s = s;\n \n x8_vlc_init();\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "av_cold void ff_intrax8_common_init(IntraX8Context *w, MpegEncContext *const s)\n\n{\n\n w->s = s;\n\n x8_vlc_init();\n\n assert(s->mb_width > 0);\n\n\n\n // two rows, 2 blocks per cannon mb\n\n w->prediction_table = av_mallocz(s->mb_width * 2 * 2);\n\n\n\n ff_init_scantable(s->idsp.idct_permutation, &w->scantable[0],\n\n ff_wmv1_scantable[0]);\n\n ff_init_scantable(s->idsp.idct_permutation, &w->scantable[1],\n\n ff_wmv1_scantable[2]);\n\n ff_init_scantable(s->idsp.idct_permutation, &w->scantable[2],\n\n ff_wmv1_scantable[3]);\n\n\n\n ff_intrax8dsp_init(&w->dsp);\n\n}\n"}} {"sample_id": "3a03bfa5a219fe06779706315f2555622b51193c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n int qemu_socket(int domain, int type, int protocol)\n \n {\n+\n int ret;\n \n \n+\n #ifdef SOCK_CLOEXEC\n \n ret = socket(domain, type | SOCK_CLOEXEC, protocol);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "int qemu_socket(int domain, int type, int protocol)\n\n{\n\n int ret;\n\n\n\n#ifdef SOCK_CLOEXEC\n\n ret = socket(domain, type | SOCK_CLOEXEC, protocol);\n\n#else\n\n ret = socket(domain, type, protocol);\n\n if (ret >= 0) {\n\n qemu_set_cloexec(ret);\n\n }\n\n#endif\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "b5da07d4340a8e8e40dcd1900977a76ff31fbb84_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void ff_put_h264_qpel16_mc10_msa(uint8_t *dst, const uint8_t *src,\n+\n+ ptrdiff_t stride)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_put_h264_qpel16_mc10_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n avc_luma_hz_qrt_16w_msa(src - 2, stride, dst, stride, 16, 0);\n\n}\n"}} {"sample_id": "f755dea79dc81b0d6a8f6414e0672e165e28d8ba_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n value = *obj;\n \n+ v->type_int64(v, &value, name, errp);\n+\n+ if (value < 0 || value > UINT32_MAX) {\n+\n+ /* FIXME questionable reuse of errp if callback changed\n \n value on error */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void visit_type_uint32(Visitor *v, uint32_t *obj, const char *name, Error **errp)\n\n{\n\n int64_t value;\n\n\n\n if (v->type_uint32) {\n\n v->type_uint32(v, obj, name, errp);\n\n } else {\n\n value = *obj;\n\n v->type_int64(v, &value, name, errp);\n\n if (value < 0 || value > UINT32_MAX) {\n\n /* FIXME questionable reuse of errp if callback changed\n\n value on error */\n\n error_setg(errp, QERR_INVALID_PARAMETER_VALUE,\n\n name ? name : \"null\", \"uint32_t\");\n\n return;\n\n }\n\n *obj = value;\n\n }\n\n}\n"}} {"sample_id": "45b9fd348061ab793cf4521bb3621f07a5bd7bf6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n port->dev = dev;\n \n port->ops->attach(port);\n+\n+ usb_send_msg(dev, USB_MSG_ATTACH);\n+\n+ } else {\n+\n /* detach */\n \n dev = port->dev;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void usb_attach(USBPort *port, USBDevice *dev)\n\n{\n\n if (dev != NULL) {\n\n /* attach */\n\n if (port->dev) {\n\n usb_attach(port, NULL);\n\n }\n\n dev->port = port;\n\n port->dev = dev;\n\n port->ops->attach(port);\n\n usb_send_msg(dev, USB_MSG_ATTACH);\n\n } else {\n\n /* detach */\n\n dev = port->dev;\n\n port->ops->detach(port);\n\n if (dev) {\n\n usb_send_msg(dev, USB_MSG_DETACH);\n\n dev->port = NULL;\n\n port->dev = NULL;\n\n }\n\n }\n\n}\n"}} {"sample_id": "068abdc8a57023eeafe1025b964a50f8a39929b4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void ppc_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...))\n+\n+{\n \n+ int i;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void ppc_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...))\n\n{\n\n int i;\n\n\n\n for (i = 0; ; i++) {\n\n (*cpu_fprintf)(f, \"PowerPC %-16s PVR %08x\\n\",\n\n ppc_defs[i].name, ppc_defs[i].pvr);\n\n if (strcmp(ppc_defs[i].name, \"default\") == 0)\n\n break;\n\n }\n\n}\n"}} {"sample_id": "dfd100f242370886bb6732f70f1f7cbd8eb9fedc_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,10 +18,10 @@\n \n }\n \n+\n+\n+ vnc_init_basic_info(addr, info, errp);\n+\n+ qapi_free_SocketAddress(addr);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vnc_init_basic_info_from_remote_addr(QIOChannelSocket *ioc,\n\n VncBasicInfo *info,\n\n Error **errp)\n\n{\n\n SocketAddress *addr = NULL;\n\n\n\n addr = qio_channel_socket_get_remote_address(ioc, errp);\n\n if (!addr) {\n\n return;\n\n }\n\n\n\n vnc_init_basic_info(addr, info, errp);\n\n qapi_free_SocketAddress(addr);\n\n}\n"}} {"sample_id": "80a5d05108cb218e8cd2e25c6621a3bfef0a832e_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n VAAPIEncodeH265Options *opt = ctx->codec_options;\n \n \n+\n+ priv->fixed_qp_p = opt->qp;\n+\n+ if (avctx->i_quant_factor > 0.0)\n+\n priv->fixed_qp_idr = (int)((priv->fixed_qp_p * avctx->i_quant_factor +\n \n avctx->i_quant_offset) + 0.5);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int vaapi_encode_h265_init_fixed_qp(AVCodecContext *avctx)\n\n{\n\n VAAPIEncodeContext *ctx = avctx->priv_data;\n\n VAAPIEncodeH265Context *priv = ctx->priv_data;\n\n VAAPIEncodeH265Options *opt = ctx->codec_options;\n\n\n\n priv->fixed_qp_p = opt->qp;\n\n if (avctx->i_quant_factor > 0.0)\n\n priv->fixed_qp_idr = (int)((priv->fixed_qp_p * avctx->i_quant_factor +\n\n avctx->i_quant_offset) + 0.5);\n\n else\n\n priv->fixed_qp_idr = priv->fixed_qp_p;\n\n if (avctx->b_quant_factor > 0.0)\n\n priv->fixed_qp_b = (int)((priv->fixed_qp_p * avctx->b_quant_factor +\n\n avctx->b_quant_offset) + 0.5);\n\n else\n\n priv->fixed_qp_b = priv->fixed_qp_p;\n\n\n\n av_log(avctx, AV_LOG_DEBUG, \"Using fixed QP = \"\n\n \"%d / %d / %d for IDR- / P- / B-frames.\\n\",\n\n priv->fixed_qp_idr, priv->fixed_qp_p, priv->fixed_qp_b);\n\n return 0;\n\n}\n"}} {"sample_id": "073c2593c9f0aa4445a6fc1b9b24e6e52a8cc2c1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+static int alloc_table(VLC *vlc, int size)\n \n {\n \n int index;\n \n+ index = vlc->table_size;\n \n vlc->table_size += size;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int alloc_table(VLC *vlc, int size)\n\n{\n\n int index;\n\n index = vlc->table_size;\n\n vlc->table_size += size;\n\n if (vlc->table_size > vlc->table_allocated) {\n\n vlc->table_allocated += (1 << vlc->bits);\n\n vlc->table = av_realloc(vlc->table,\n\n sizeof(VLC_TYPE) * 2 * vlc->table_allocated);\n\n if (!vlc->table)\n\n return -1;\n\n }\n\n return index;\n\n}\n"}} {"sample_id": "245f7b51c0ea04fb2224b1127430a096c91aee70_25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static void vnc_tight_start(VncState *vs)\n+\n+{\n \n buffer_reset(&vs->tight);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vnc_tight_start(VncState *vs)\n\n{\n\n buffer_reset(&vs->tight);\n\n\n\n // make the output buffer be the zlib buffer, so we can compress it later\n\n vs->tight_tmp = vs->output;\n\n vs->output = vs->tight;\n\n}\n"}} {"sample_id": "d6604b29ef544793479d7fb4e05ef6622bb3e534_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n default:\n \n break;\n+\n+ }\n+\n+\n+\n avctx->bits_per_coded_sample = av_get_bits_per_sample(avctx->codec->id);\n \n avctx->block_align = avctx->channels * avctx->bits_per_coded_sample / 8;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int pcm_encode_init(AVCodecContext *avctx)\n\n{\n\n avctx->frame_size = 0;\n\n switch (avctx->codec->id) {\n\n case AV_CODEC_ID_PCM_ALAW:\n\n pcm_alaw_tableinit();\n\n break;\n\n case AV_CODEC_ID_PCM_MULAW:\n\n pcm_ulaw_tableinit();\n\n break;\n\n default:\n\n break;\n\n }\n\n\n\n avctx->bits_per_coded_sample = av_get_bits_per_sample(avctx->codec->id);\n\n avctx->block_align = avctx->channels * avctx->bits_per_coded_sample / 8;\n\n avctx->bit_rate = avctx->block_align * avctx->sample_rate * 8;\n\n avctx->coded_frame = av_frame_alloc();\n\n if (!avctx->coded_frame)\n\n return AVERROR(ENOMEM);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "f53c398aa603cea135ee58fd15249aeff7b9c7ea_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev)\n \n {\n+\n EHCIQueue *q, *tmp;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void ehci_queues_rip_device(EHCIState *ehci, USBDevice *dev)\n\n{\n\n EHCIQueue *q, *tmp;\n\n\n\n QTAILQ_FOREACH_SAFE(q, &ehci->queues, next, tmp) {\n\n if (q->packet.owner == NULL ||\n\n q->packet.owner->dev != dev) {\n\n continue;\n\n }\n\n ehci_free_queue(q);\n\n }\n\n}\n"}} {"sample_id": "ad1be89948f88e89708b04ccd782456ccec3a6f0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ qemu_spice_init();\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void spice_register_types(void)\n\n{\n\n qemu_spice_init();\n\n}\n"}} {"sample_id": "e0cb42ae4bc4438ba4ec0760df2d830b8759b255", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int xen_init(MachineState *ms)\n \n+{\n \n xen_xc = xen_xc_interface_open(0, 0, 0);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int xen_init(MachineState *ms)\n\n{\n\n xen_xc = xen_xc_interface_open(0, 0, 0);\n\n if (xen_xc == XC_HANDLER_INITIAL_VALUE) {\n\n xen_be_printf(NULL, 0, \"can't open xen interface\\n\");\n\n\n\n\n\n\n\n\n\n qemu_add_vm_change_state_handler(xen_change_state_handler, NULL);\n\n\n\n global_state_set_optional();\n\n savevm_skip_configuration();\n\n savevm_skip_section_footers();\n\n\n\n return 0;\n"}} {"sample_id": "4f5eaf0b5956e492ee5023929669b1d09aaf6299", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n {\n \n+ ProresContext *ctx = avctx->priv_data;\n \n LOCAL_ALIGNED_16(int16_t, blocks, [8*4*64]);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int decode_slice_luma(AVCodecContext *avctx, SliceContext *slice,\n\n uint16_t *dst, int dst_stride,\n\n const uint8_t *buf, unsigned buf_size,\n\n const int16_t *qmat)\n\n{\n\n ProresContext *ctx = avctx->priv_data;\n\n LOCAL_ALIGNED_16(int16_t, blocks, [8*4*64]);\n\n int16_t *block;\n\n GetBitContext gb;\n\n int i, blocks_per_slice = slice->mb_count<<2;\n\n int ret;\n\n\n\n for (i = 0; i < blocks_per_slice; i++)\n\n ctx->bdsp.clear_block(blocks+(i<<6));\n\n\n\n init_get_bits(&gb, buf, buf_size << 3);\n\n\n\n decode_dc_coeffs(&gb, blocks, blocks_per_slice);\n\n if ((ret = decode_ac_coeffs(avctx, &gb, blocks, blocks_per_slice)) < 0)\n\n return ret;\n\n\n\n block = blocks;\n\n for (i = 0; i < slice->mb_count; i++) {\n\n ctx->prodsp.idct_put(dst, dst_stride, block+(0<<6), qmat);\n\n ctx->prodsp.idct_put(dst +8, dst_stride, block+(1<<6), qmat);\n\n ctx->prodsp.idct_put(dst+4*dst_stride , dst_stride, block+(2<<6), qmat);\n\n ctx->prodsp.idct_put(dst+4*dst_stride+8, dst_stride, block+(3<<6), qmat);\n\n block += 4*64;\n\n dst += 16;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "df1561e22df42643d769aacdcc7d6d239f243366", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void op_flush_icache_all(void) {\n \n CALL_FROM_TB1(tb_flush, env);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void op_flush_icache_all(void) {\n\n CALL_FROM_TB1(tb_flush, env);\n\n RETURN();\n\n}\n"}} {"sample_id": "8653c0158c23ec592f0041ab48b83d6cc6d152fe_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n pthread_mutex_lock(&lock);\n \n+ ret = aiocb->ret;\n+\n+ pthread_mutex_unlock(&lock);\n+\n \n \n return ret;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "ssize_t qemu_paio_return(struct qemu_paiocb *aiocb)\n\n{\n\n ssize_t ret;\n\n\n\n pthread_mutex_lock(&lock);\n\n ret = aiocb->ret;\n\n pthread_mutex_unlock(&lock);\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "fd0a10cd20a1c5ae829be32f3364dae88f435c4e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,8 +3,8 @@\n {\n \n ohci->sof_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);\n+\n+ timer_mod(ohci->eof_timer, ohci->sof_time + usb_frame_time);\n \n ohci_set_interrupt(ohci, OHCI_INTR_SF);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ohci_sof(OHCIState *ohci)\n\n{\n\n ohci->sof_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);\n\n timer_mod(ohci->eof_timer, ohci->sof_time + usb_frame_time);\n\n ohci_set_interrupt(ohci, OHCI_INTR_SF);\n\n}\n"}} {"sample_id": "635ac8e1be91e941908f85642e4bbb609e48193f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,9 +31,9 @@\n \n \n \n+\n+\n+\n+\n+\n return 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int handle_ping(URLContext *s, RTMPPacket *pkt)\n\n{\n\n RTMPContext *rt = s->priv_data;\n\n int t, ret;\n\n\n\n if (pkt->data_size < 2) {\n\n av_log(s, AV_LOG_ERROR, \"Too short ping packet (%d)\\n\",\n\n pkt->data_size);\n\n return AVERROR_INVALIDDATA;\n\n\n\n\n t = AV_RB16(pkt->data);\n\n if (t == 6) {\n\n if ((ret = gen_pong(s, rt, pkt)) < 0)\n\n\n\n\n\n\n\n\n\n\n\n\n return 0;\n"}} {"sample_id": "4751fd5328dfcd4fe2f9055728a72a0e3ae56512", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int fchmodat_nofollow(int dirfd, const char *name, mode_t mode)\n \n+{\n \n int fd, ret;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int fchmodat_nofollow(int dirfd, const char *name, mode_t mode)\n\n{\n\n int fd, ret;\n\n\n\n /* FIXME: this should be handled with fchmodat(AT_SYMLINK_NOFOLLOW).\n\n * Unfortunately, the linux kernel doesn't implement it yet. As an\n\n * alternative, let's open the file and use fchmod() instead. This\n\n * may fail depending on the permissions of the file, but it is the\n\n * best we can do to avoid TOCTTOU. We first try to open read-only\n\n * in case name points to a directory. If that fails, we try write-only\n\n * in case name doesn't point to a directory.\n\n */\n\n fd = openat_file(dirfd, name, O_RDONLY, 0);\n\n if (fd == -1) {\n\n /* In case the file is writable-only and isn't a directory. */\n\n if (errno == EACCES) {\n\n fd = openat_file(dirfd, name, O_WRONLY, 0);\n\n }\n\n if (fd == -1 && errno == EISDIR) {\n\n errno = EACCES;\n\n }\n\n }\n\n if (fd == -1) {\n\n return -1;\n\n }\n\n ret = fchmod(fd, mode);\n\n close_preserve_errno(fd);\n\n return ret;\n\n}\n"}} {"sample_id": "c661cb6672af5ebcb900ec8766b24761bd2ab011_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int match_group_separator(const OptionGroupDef *groups, const char *opt)\n \n+{\n+\n+ const OptionGroupDef *p = groups;\n+\n+\n \n while (p->name) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int match_group_separator(const OptionGroupDef *groups, const char *opt)\n\n{\n\n const OptionGroupDef *p = groups;\n\n\n\n while (p->name) {\n\n if (p->sep && !strcmp(p->sep, opt))\n\n return p - groups;\n\n p++;\n\n }\n\n\n\n return -1;\n\n}\n"}} {"sample_id": "486637af8ef29ec215e0e0b7ecd3b5470f0e04e5_18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,8 +16,8 @@\n \n }\n \n+ memset(output[3], 0, sizeof(output[3]));\n+\n+ memset(output[4], 0, sizeof(output[4]));\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void mix_2f_2r_to_dolby(AC3DecodeContext *ctx)\n\n{\n\n int i;\n\n float (*output)[256] = ctx->audio_block.block_output;\n\n\n\n for (i = 0; i < 256; i++) {\n\n output[1][i] -= output[3][i];\n\n output[2][i] += output[4][i];\n\n }\n\n memset(output[3], 0, sizeof(output[3]));\n\n memset(output[4], 0, sizeof(output[4]));\n\n}\n"}} {"sample_id": "a307d59434ba78b97544b42b8cfd24a1b62e39a6_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n /*\n+\n+ * Here we use the number returned by pci_spapr_map_irq to find a\n+\n+ * corresponding qemu_irq.\n \n */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pci_spapr_set_irq(void *opaque, int irq_num, int level)\n\n{\n\n /*\n\n * Here we use the number returned by pci_spapr_map_irq to find a\n\n * corresponding qemu_irq.\n\n */\n\n sPAPRPHBState *phb = opaque;\n\n\n\n qemu_set_irq(phb->lsi_table[irq_num].qirq, level);\n\n}\n"}} {"sample_id": "02b07434bed8360715198b4cbfdfebd17f7cac32_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n PXBDev *pxb = PXB_DEV(pci_dev);\n \n+\n+\n pxb_dev_list = g_list_remove(pxb_dev_list, pxb);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pxb_dev_exitfn(PCIDevice *pci_dev)\n\n{\n\n PXBDev *pxb = PXB_DEV(pci_dev);\n\n\n\n pxb_dev_list = g_list_remove(pxb_dev_list, pxb);\n\n}\n"}} {"sample_id": "599d0c45615b7d099d256738a586d0f63bc707e6_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static bool xen_host_pci_dev_is_virtfn(XenHostPCIDevice *d)\n \n {\n+\n+ char path[PATH_MAX];\n \n struct stat buf;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static bool xen_host_pci_dev_is_virtfn(XenHostPCIDevice *d)\n\n{\n\n char path[PATH_MAX];\n\n struct stat buf;\n\n\n\n if (xen_host_pci_sysfs_path(d, \"physfn\", path, sizeof (path))) {\n\n return false;\n\n }\n\n return !stat(path, &buf);\n\n}\n"}} {"sample_id": "12f8def0e02232d7c6416ad9b66640f973c531d1_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void qemu_mutex_unlock(QemuMutex *mutex)\n+\n+{\n+\n assert(mutex->owner == GetCurrentThreadId());\n \n mutex->owner = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void qemu_mutex_unlock(QemuMutex *mutex)\n\n{\n\n assert(mutex->owner == GetCurrentThreadId());\n\n mutex->owner = 0;\n\n LeaveCriticalSection(&mutex->lock);\n\n}\n"}} {"sample_id": "e53c9065ca08a9153ecc73a6a8940bcc6d667e58_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static int test_vector_fmac_scalar(AVFloatDSPContext *fdsp, AVFloatDSPContext *cdsp,\n \n const float *v1, const float *src0, float scale)\n+\n+{\n+\n+ LOCAL_ALIGNED(32, float, cdst, [LEN]);\n+\n LOCAL_ALIGNED(32, float, odst, [LEN]);\n \n int ret;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int test_vector_fmac_scalar(AVFloatDSPContext *fdsp, AVFloatDSPContext *cdsp,\n\n const float *v1, const float *src0, float scale)\n\n{\n\n LOCAL_ALIGNED(32, float, cdst, [LEN]);\n\n LOCAL_ALIGNED(32, float, odst, [LEN]);\n\n int ret;\n\n\n\n memcpy(cdst, v1, LEN * sizeof(*v1));\n\n memcpy(odst, v1, LEN * sizeof(*v1));\n\n\n\n cdsp->vector_fmac_scalar(cdst, src0, scale, LEN);\n\n fdsp->vector_fmac_scalar(odst, src0, scale, LEN);\n\n\n\n if (ret = compare_floats(cdst, odst, LEN, ARBITRARY_FMAC_SCALAR_CONST))\n\n av_log(NULL, AV_LOG_ERROR, \"vector_fmac_scalar failed\\n\");\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "fde9bf4470d4a3b6ee1da0dee2370ab028b6314a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ object_unparent(obj);\n \n g_assert(obj->ref == 1);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void object_delete(Object *obj)\n\n{\n\n object_unparent(obj);\n\n g_assert(obj->ref == 1);\n\n object_unref(obj);\n\n g_free(obj);\n\n}\n"}} {"sample_id": "f78cd0c243b9149c7f604ecf1006d78e344aa6ca_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n pixel *dest = (pixel *)dest_;\n+\n int i;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void FUNC(ff_simple_idct_put)(uint8_t *dest_, int line_size, DCTELEM *block)\n\n{\n\n pixel *dest = (pixel *)dest_;\n\n int i;\n\n\n\n line_size /= sizeof(pixel);\n\n\n\n for (i = 0; i < 8; i++)\n\n FUNC(idctRowCondDC)(block + i*8);\n\n\n\n for (i = 0; i < 8; i++)\n\n FUNC(idctSparseColPut)(dest + i, line_size, block + i);\n\n}\n"}} {"sample_id": "1eb3fc0a0b61b5d22adee2a9add3162a6c03a47e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n size_t pagesize_bits =\n \n+ qemu_ram_pagesize(pss->block) >> TARGET_PAGE_BITS;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int ram_save_host_page(RAMState *rs, PageSearchStatus *pss,\n\n bool last_stage)\n\n{\n\n int tmppages, pages = 0;\n\n size_t pagesize_bits =\n\n qemu_ram_pagesize(pss->block) >> TARGET_PAGE_BITS;\n\n\n\n do {\n\n tmppages = ram_save_target_page(rs, pss, last_stage);\n\n if (tmppages < 0) {\n\n return tmppages;\n\n }\n\n\n\n pages += tmppages;\n\n pss->page++;\n\n } while (pss->page & (pagesize_bits - 1));\n\n\n\n /* The offset we leave with is the last one we looked at */\n\n pss->page--;\n\n return pages;\n\n}\n"}} {"sample_id": "84a12e6648444f517055138a7d7f25a22d7e1029", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,5 +5,5 @@\n bdrv_register(&bdrv_raw);\n \n bdrv_register(&bdrv_host_device);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bdrv_raw_init(void)\n\n{\n\n bdrv_register(&bdrv_raw);\n\n bdrv_register(&bdrv_host_device);\n\n}\n"}} {"sample_id": "daa76aa416b1e18ab1fac650ff53d966d8f21f68_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void test_parse_invalid_path_subprocess(void)\n+\n {\n \n qemu_set_log_filename(\"/tmp/qemu-%d%d.log\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void test_parse_invalid_path_subprocess(void)\n\n{\n\n qemu_set_log_filename(\"/tmp/qemu-%d%d.log\");\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_50", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n result->rkey = ntohl(result->rkey);\n+\n+ result->host_addr = ntohll(result->host_addr);\n \n };", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void network_to_result(RDMARegisterResult *result)\n\n{\n\n result->rkey = ntohl(result->rkey);\n\n result->host_addr = ntohll(result->host_addr);\n\n};\n"}} {"sample_id": "d608a27d9e28d24ab56acc4ea6bfb13b2802035c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -50,11 +50,11 @@\n \n \n \n+ ret = try_seek(avf, stream, min_ts, ts, max_ts, flags);\n+\n+ if (ret < 0 && !(flags & AVSEEK_FLAG_BACKWARD) &&\n+\n+ left < cat->nb_files - 1 &&\n \n cat->files[left + 1].start_time < max_ts) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int real_seek(AVFormatContext *avf, int stream,\n\n int64_t min_ts, int64_t ts, int64_t max_ts, int flags)\n\n{\n\n ConcatContext *cat = avf->priv_data;\n\n int ret, left, right;\n\n\n\n if (stream >= 0) {\n\n if (stream >= avf->nb_streams)\n\n return AVERROR(EINVAL);\n\n rescale_interval(avf->streams[stream]->time_base, AV_TIME_BASE_Q,\n\n &min_ts, &ts, &max_ts);\n\n }\n\n\n\n left = 0;\n\n right = cat->nb_files;\n\n while (right - left > 1) {\n\n int mid = (left + right) / 2;\n\n if (ts < cat->files[mid].start_time)\n\n right = mid;\n\n else\n\n left = mid;\n\n }\n\n\n\n if ((ret = open_file(avf, left)) < 0)\n\n return ret;\n\n\n\n ret = try_seek(avf, stream, min_ts, ts, max_ts, flags);\n\n if (ret < 0 && !(flags & AVSEEK_FLAG_BACKWARD) &&\n\n left < cat->nb_files - 1 &&\n\n cat->files[left + 1].start_time < max_ts) {\n\n if ((ret = open_file(avf, left + 1)) < 0)\n\n return ret;\n\n ret = try_seek(avf, stream, min_ts, ts, max_ts, flags);\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "f2eb665a11a34ac9f6459f8a18c3d9d8be9ca359", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n static uint64_t itc_tag_read(void *opaque, hwaddr addr, unsigned size)\n \n {\n+\n+ MIPSITUState *tag = (MIPSITUState *)opaque;\n+\n+ uint64_t index = addr >> 3;\n+\n uint64_t ret = 0;\n \n+\n \n switch (index) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint64_t itc_tag_read(void *opaque, hwaddr addr, unsigned size)\n\n{\n\n MIPSITUState *tag = (MIPSITUState *)opaque;\n\n uint64_t index = addr >> 3;\n\n uint64_t ret = 0;\n\n\n\n switch (index) {\n\n case 0 ... ITC_ADDRESSMAP_NUM:\n\n ret = tag->ITCAddressMap[index];\n\n break;\n\n default:\n\n qemu_log_mask(LOG_GUEST_ERROR, \"Read 0x%\" PRIx64 \"\\n\", addr);\n\n break;\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "a9db86b223030bd40bdd81b160788196bc95fe6f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n+static BlockDriverAIOCB *quorum_aio_readv(BlockDriverState *bs,\n+\n+ int64_t sector_num,\n+\n+ QEMUIOVector *qiov,\n \n+ int nb_sectors,\n+\n+ BlockDriverCompletionFunc *cb,\n \n void *opaque)\n+\n {\n \n BDRVQuorumState *s = bs->opaque;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static BlockDriverAIOCB *quorum_aio_readv(BlockDriverState *bs,\n\n int64_t sector_num,\n\n QEMUIOVector *qiov,\n\n int nb_sectors,\n\n BlockDriverCompletionFunc *cb,\n\n void *opaque)\n\n{\n\n BDRVQuorumState *s = bs->opaque;\n\n QuorumAIOCB *acb = quorum_aio_get(s, bs, qiov, sector_num,\n\n nb_sectors, cb, opaque);\n\n int i;\n\n\n\n acb->is_read = true;\n\n\n\n for (i = 0; i < s->num_children; i++) {\n\n acb->qcrs[i].buf = qemu_blockalign(s->bs[i], qiov->size);\n\n qemu_iovec_init(&acb->qcrs[i].qiov, qiov->niov);\n\n qemu_iovec_clone(&acb->qcrs[i].qiov, qiov, acb->qcrs[i].buf);\n\n }\n\n\n\n for (i = 0; i < s->num_children; i++) {\n\n bdrv_aio_readv(s->bs[i], sector_num, &acb->qcrs[i].qiov, nb_sectors,\n\n quorum_aio_cb, &acb->qcrs[i]);\n\n }\n\n\n\n return &acb->common;\n\n}\n"}} {"sample_id": "139921aaa77c435104308ad53b631a00c3b65ae8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int64_t coroutine_fn vvfat_co_get_block_status(BlockDriverState *bs,\n+\n+\tint64_t sector_num, int nb_sectors, int *n, BlockDriverState **file)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int64_t coroutine_fn vvfat_co_get_block_status(BlockDriverState *bs,\n\n\tint64_t sector_num, int nb_sectors, int *n, BlockDriverState **file)\n\n{\n\n BDRVVVFATState* s = bs->opaque;\n\n *n = s->sector_count - sector_num;\n\n if (*n > nb_sectors) {\n\n *n = nb_sectors;\n\n } else if (*n < 0) {\n\n return 0;\n\n }\n\n return BDRV_BLOCK_DATA;\n\n}\n"}} {"sample_id": "28f9ab7029bd1a02f659995919f899f84ee7361b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n IDCT_START\n \n+\n+\n+ // pixels are signed; so add 128*16 in addition to the normal 8\n+\n+ vec_s16 v2048 = vec_sl(vec_splat_s16(1), vec_splat_u16(11));\n \n eight = vec_add(eight, v2048);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_vp3_idct_put_altivec(uint8_t *dst, int stride, DCTELEM block[64])\n\n{\n\n vec_u8 t;\n\n IDCT_START\n\n\n\n // pixels are signed; so add 128*16 in addition to the normal 8\n\n vec_s16 v2048 = vec_sl(vec_splat_s16(1), vec_splat_u16(11));\n\n eight = vec_add(eight, v2048);\n\n\n\n IDCT_1D(NOP, NOP)\n\n TRANSPOSE8(b0, b1, b2, b3, b4, b5, b6, b7);\n\n IDCT_1D(ADD8, SHIFT4)\n\n\n\n#define PUT(a)\\\n\n t = vec_packsu(a, a);\\\n\n vec_ste((vec_u32)t, 0, (unsigned int *)dst);\\\n\n vec_ste((vec_u32)t, 4, (unsigned int *)dst);\n\n\n\n PUT(b0) dst += stride;\n\n PUT(b1) dst += stride;\n\n PUT(b2) dst += stride;\n\n PUT(b3) dst += stride;\n\n PUT(b4) dst += stride;\n\n PUT(b5) dst += stride;\n\n PUT(b6) dst += stride;\n\n PUT(b7)\n\n}\n"}} {"sample_id": "99fd437dee468609de8218f0eb3b16621fb6a9c9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n int i;\n+\n+ PCIBus *bus = find_i440fx();\n+\n+\n+\n if (!bus) {\n \n /* Only PIIX supports ACPI hotplug */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void acpi_get_hotplug_info(AcpiMiscInfo *misc)\n\n{\n\n int i;\n\n PCIBus *bus = find_i440fx();\n\n\n\n if (!bus) {\n\n /* Only PIIX supports ACPI hotplug */\n\n memset(misc->slot_hotplug_enable, 0, sizeof misc->slot_hotplug_enable);\n\n return;\n\n }\n\n\n\n memset(misc->slot_hotplug_enable, 0xff,\n\n DIV_ROUND_UP(PCI_SLOT_MAX, BITS_PER_BYTE));\n\n\n\n for (i = 0; i < ARRAY_SIZE(bus->devices); ++i) {\n\n PCIDeviceClass *pc;\n\n PCIDevice *pdev = bus->devices[i];\n\n\n\n if (!pdev) {\n\n continue;\n\n }\n\n\n\n pc = PCI_DEVICE_GET_CLASS(pdev);\n\n\n\n if (pc->no_hotplug) {\n\n int slot = PCI_SLOT(i);\n\n\n\n clear_bit(slot, misc->slot_hotplug_enable);\n\n }\n\n }\n\n}\n"}} {"sample_id": "80a5d05108cb218e8cd2e25c6621a3bfef0a832e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n return ff_vaapi_encode_init(avctx, &vaapi_encode_type_mjpeg);\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int vaapi_encode_mjpeg_init(AVCodecContext *avctx)\n\n{\n\n return ff_vaapi_encode_init(avctx, &vaapi_encode_type_mjpeg);\n\n}\n"}} {"sample_id": "c619ff6daf93a8f3c03decf2d3345d2474c3db91", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,10 +12,10 @@\n \n }\n \n+ if (bits_left > 0) {\n+\n+ put_bits(pb, bits_left, get_bits(gb, bits_left));\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void bit_copy(PutBitContext *pb, GetBitContext *gb)\n\n{\n\n int bits_left = get_bits_left(gb);\n\n while (bits_left >= 16) {\n\n put_bits(pb, 16, get_bits(gb, 16));\n\n bits_left -= 16;\n\n }\n\n if (bits_left > 0) {\n\n put_bits(pb, bits_left, get_bits(gb, bits_left));\n\n }\n\n}\n"}} {"sample_id": "581fe784c3adf85dc167a47a4a60fd1245a98217", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n const char *port\n \n ) {\n+\n struct addrinfo hints;\n \n struct addrinfo *server;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "connect_to_qemu(\n\n const char *host,\n\n const char *port\n\n) {\n\n struct addrinfo hints;\n\n struct addrinfo *server;\n\n int ret, sock;\n\n\n\n sock = qemu_socket(AF_INET, SOCK_STREAM, 0);\n\n if (sock < 0) {\n\n /* Error */\n\n fprintf(stderr, \"Error opening socket!\\n\");\n\n return -1;\n\n }\n\n\n\n memset(&hints, 0, sizeof(struct addrinfo));\n\n hints.ai_family = AF_UNSPEC;\n\n hints.ai_socktype = SOCK_STREAM;\n\n hints.ai_flags = 0;\n\n hints.ai_protocol = 0; /* Any protocol */\n\n\n\n ret = getaddrinfo(host, port, &hints, &server);\n\n\n\n if (ret != 0) {\n\n /* Error */\n\n fprintf(stderr, \"getaddrinfo failed\\n\");\n\n return -1;\n\n }\n\n\n\n if (connect(sock, server->ai_addr, server->ai_addrlen) < 0) {\n\n /* Error */\n\n fprintf(stderr, \"Could not connect\\n\");\n\n return -1;\n\n }\n\n if (verbose) {\n\n printf(\"Connected (sizeof Header=%zd)!\\n\", sizeof(VSCMsgHeader));\n\n }\n\n return sock;\n\n}\n"}} {"sample_id": "efb9ee024845982a210bfe48a73298846adfe9da", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n \n \n+ if (action == BLOCK_ERR_IGNORE) {\n+\n+ bdrv_mon_event(s->bs, BDRV_ACTION_IGNORE, is_read);\n+\n+ return 0;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int scsi_handle_rw_error(SCSIDiskReq *r, int error, int type)\n\n{\n\n int is_read = (type == SCSI_REQ_STATUS_RETRY_READ);\n\n SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);\n\n BlockErrorAction action = bdrv_get_on_error(s->bs, is_read);\n\n\n\n if (action == BLOCK_ERR_IGNORE) {\n\n bdrv_mon_event(s->bs, BDRV_ACTION_IGNORE, is_read);\n\n return 0;\n\n }\n\n\n\n if ((error == ENOSPC && action == BLOCK_ERR_STOP_ENOSPC)\n\n || action == BLOCK_ERR_STOP_ANY) {\n\n\n\n type &= SCSI_REQ_STATUS_RETRY_TYPE_MASK;\n\n r->status |= SCSI_REQ_STATUS_RETRY | type;\n\n\n\n bdrv_mon_event(s->bs, BDRV_ACTION_STOP, is_read);\n\n vm_stop(VMSTOP_DISKFULL);\n\n } else {\n\n if (type == SCSI_REQ_STATUS_RETRY_READ) {\n\n scsi_req_data(&r->req, 0);\n\n }\n\n if (error == ENOMEM) {\n\n scsi_command_complete(r, CHECK_CONDITION,\n\n SENSE_CODE(TARGET_FAILURE));\n\n } else {\n\n scsi_command_complete(r, CHECK_CONDITION,\n\n SENSE_CODE(IO_ERROR));\n\n }\n\n bdrv_mon_event(s->bs, BDRV_ACTION_REPORT, is_read);\n\n }\n\n\n\n return 1;\n\n}\n"}} {"sample_id": "37ad223c515da2fe9f1c679768cb5ccaa42e57e1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -40,8 +40,8 @@\n \n \n \n+ build_header(linker, table_data,\n+\n+ (void *)fadt, \"FACP\", sizeof(*fadt), 1, NULL);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "build_fadt(GArray *table_data, GArray *linker, AcpiPmInfo *pm,\n\n unsigned facs, unsigned dsdt)\n\n{\n\n AcpiFadtDescriptorRev1 *fadt = acpi_data_push(table_data, sizeof(*fadt));\n\n\n\n fadt->firmware_ctrl = cpu_to_le32(facs);\n\n /* FACS address to be filled by Guest linker */\n\n bios_linker_loader_add_pointer(linker, ACPI_BUILD_TABLE_FILE,\n\n ACPI_BUILD_TABLE_FILE,\n\n table_data, &fadt->firmware_ctrl,\n\n sizeof fadt->firmware_ctrl);\n\n\n\n fadt->dsdt = cpu_to_le32(dsdt);\n\n /* DSDT address to be filled by Guest linker */\n\n bios_linker_loader_add_pointer(linker, ACPI_BUILD_TABLE_FILE,\n\n ACPI_BUILD_TABLE_FILE,\n\n table_data, &fadt->dsdt,\n\n sizeof fadt->dsdt);\n\n\n\n fadt_setup(fadt, pm);\n\n\n\n build_header(linker, table_data,\n\n (void *)fadt, \"FACP\", sizeof(*fadt), 1, NULL);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_259", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+uint32_t ldl_phys(target_phys_addr_t addr)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint32_t ldl_phys(target_phys_addr_t addr)\n\n{\n\n return ldl_phys_internal(addr, DEVICE_NATIVE_ENDIAN);\n\n}\n"}} {"sample_id": "8be7e7e4c72c048b90e3482557954a24bba43ba7_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n int socktype, int port_offset, Error **errp)\n \n+{\n \n QemuOpts *opts;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int inet_listen(const char *str, char *ostr, int olen,\n\n int socktype, int port_offset, Error **errp)\n\n{\n\n QemuOpts *opts;\n\n char *optstr;\n\n int sock = -1;\n\n\n\n opts = qemu_opts_create(&dummy_opts, NULL, 0);\n\n if (inet_parse(opts, str) == 0) {\n\n sock = inet_listen_opts(opts, port_offset, errp);\n\n if (sock != -1 && ostr) {\n\n optstr = strchr(str, ',');\n\n if (qemu_opt_get_bool(opts, \"ipv6\", 0)) {\n\n snprintf(ostr, olen, \"[%s]:%s%s\",\n\n qemu_opt_get(opts, \"host\"),\n\n qemu_opt_get(opts, \"port\"),\n\n optstr ? optstr : \"\");\n\n } else {\n\n snprintf(ostr, olen, \"%s:%s%s\",\n\n qemu_opt_get(opts, \"host\"),\n\n qemu_opt_get(opts, \"port\"),\n\n optstr ? optstr : \"\");\n\n }\n\n }\n\n } else {\n\n error_set(errp, QERR_SOCKET_CREATE_FAILED);\n\n }\n\n qemu_opts_del(opts);\n\n return sock;\n\n}\n"}} {"sample_id": "bc7c08a2c375acb7ae4d433054415588b176d34c_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,10 +36,10 @@\n \n \n \n+ g_assert_cmpint(err, ==, 0);\n+\n+ g_assert_cmpint(res, ==, 0x123);\n+\n+ g_assert(endptr == str + strlen(str));\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_qemu_strtoull_hex(void)\n\n{\n\n const char *str = \"0123\";\n\n char f = 'X';\n\n const char *endptr = &f;\n\n uint64_t res = 999;\n\n int err;\n\n\n\n err = qemu_strtoull(str, &endptr, 16, &res);\n\n\n\n g_assert_cmpint(err, ==, 0);\n\n g_assert_cmpint(res, ==, 0x123);\n\n g_assert(endptr == str + strlen(str));\n\n\n\n str = \"0x123\";\n\n endptr = &f;\n\n res = 999;\n\n err = qemu_strtoull(str, &endptr, 0, &res);\n\n\n\n g_assert_cmpint(err, ==, 0);\n\n g_assert_cmpint(res, ==, 0x123);\n\n g_assert(endptr == str + strlen(str));\n\n}\n"}} {"sample_id": "ad96090a01d848df67d70c5259ed8aa321fa8716_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n fprintf(stderr, \"Wrong smbios provided\\n\");\n \n exit(1);\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void do_smbios_option(const char *optarg)\n\n{\n\n if (smbios_entry_add(optarg) < 0) {\n\n fprintf(stderr, \"Wrong smbios provided\\n\");\n\n exit(1);\n\n }\n\n}\n"}} {"sample_id": "4c3b22459d3589cf84d1ccadc6b09e586497820d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,7 +18,7 @@\n \n #endif\n \n+\n \n pci_conf = pci_dev->config;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int pci_pcnet_init(PCIDevice *pci_dev)\n\n{\n\n PCIPCNetState *d = PCI_PCNET(pci_dev);\n\n PCNetState *s = &d->state;\n\n uint8_t *pci_conf;\n\n\n\n#if 0\n\n printf(\"sizeof(RMD)=%d, sizeof(TMD)=%d\\n\",\n\n sizeof(struct pcnet_RMD), sizeof(struct pcnet_TMD));\n\n#endif\n\n\n\n pci_conf = pci_dev->config;\n\n\n\n pci_set_word(pci_conf + PCI_STATUS,\n\n PCI_STATUS_FAST_BACK | PCI_STATUS_DEVSEL_MEDIUM);\n\n\n\n pci_set_word(pci_conf + PCI_SUBSYSTEM_VENDOR_ID, 0x0);\n\n pci_set_word(pci_conf + PCI_SUBSYSTEM_ID, 0x0);\n\n\n\n pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin A */\n\n pci_conf[PCI_MIN_GNT] = 0x06;\n\n pci_conf[PCI_MAX_LAT] = 0xff;\n\n\n\n /* Handler for memory-mapped I/O */\n\n memory_region_init_io(&d->state.mmio, OBJECT(d), &pcnet_mmio_ops, s,\n\n \"pcnet-mmio\", PCNET_PNPMMIO_SIZE);\n\n\n\n memory_region_init_io(&d->io_bar, OBJECT(d), &pcnet_io_ops, s, \"pcnet-io\",\n\n PCNET_IOPORT_SIZE);\n\n pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &d->io_bar);\n\n\n\n pci_register_bar(pci_dev, 1, 0, &s->mmio);\n\n\n\n s->irq = pci_allocate_irq(pci_dev);\n\n s->phys_mem_read = pci_physical_memory_read;\n\n s->phys_mem_write = pci_physical_memory_write;\n\n s->dma_opaque = pci_dev;\n\n\n\n return pcnet_common_init(DEVICE(pci_dev), s, &net_pci_pcnet_info);\n\n}\n"}} {"sample_id": "f1ffb01ee9fd3a15c395c3cf6ff362ac5cd668d0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static double get_audio_clock(VideoState *is)\n \n+{\n+\n+ double pts;\n+\n+ int hw_buf_size, bytes_per_sec;\n \n pts = is->audio_clock;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static double get_audio_clock(VideoState *is)\n\n{\n\n double pts;\n\n int hw_buf_size, bytes_per_sec;\n\n pts = is->audio_clock;\n\n hw_buf_size = audio_write_get_buf_size(is);\n\n bytes_per_sec = 0;\n\n if (is->audio_st) {\n\n bytes_per_sec = is->audio_st->codec->sample_rate *\n\n 2 * is->audio_st->codec->channels;\n\n }\n\n if (bytes_per_sec)\n\n pts -= (double)hw_buf_size / bytes_per_sec;\n\n return pts;\n\n}\n"}} {"sample_id": "dd4b7badb416a5c2688da7310a7fe80fe4e4f209", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int64_t find_best_filter(const DCAADPCMEncContext *s, const int32_t *in, int len)\n \n {\n+\n const premultiplied_coeffs *precalc_data = s->private_data;\n \n int i, j, k = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int64_t find_best_filter(const DCAADPCMEncContext *s, const int32_t *in, int len)\n\n{\n\n const premultiplied_coeffs *precalc_data = s->private_data;\n\n int i, j, k = 0;\n\n int vq;\n\n int64_t err;\n\n int64_t min_err = 1ll << 62;\n\n int64_t corr[15];\n\n\n\n for (i = 0; i <= DCA_ADPCM_COEFFS; i++)\n\n for (j = i; j <= DCA_ADPCM_COEFFS; j++)\n\n corr[k++] = calc_corr(in+4, len, i, j);\n\n\n\n for (i = 0; i < DCA_ADPCM_VQCODEBOOK_SZ; i++) {\n\n err = apply_filter(ff_dca_adpcm_vb[i], corr, *precalc_data);\n\n if (err < min_err) {\n\n min_err = err;\n\n vq = i;\n\n }\n\n precalc_data++;\n\n }\n\n\n\n return vq;\n\n}\n"}} {"sample_id": "ebee92b4fef9defa19a8c348ec8b2716732ad4df", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n proto_drv = bdrv_find_protocol(filename, true);\n \n if (!proto_drv) {\n+\n+ error_report(\"Unknown protocol '%s'\", filename);\n+\n+\n+ return 1;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int print_block_option_help(const char *filename, const char *fmt)\n\n{\n\n BlockDriver *drv, *proto_drv;\n\n QEMUOptionParameter *create_options = NULL;\n\n\n\n /* Find driver and parse its options */\n\n drv = bdrv_find_format(fmt);\n\n if (!drv) {\n\n error_report(\"Unknown file format '%s'\", fmt);\n\n return 1;\n\n }\n\n\n\n create_options = append_option_parameters(create_options,\n\n drv->create_options);\n\n\n\n if (filename) {\n\n proto_drv = bdrv_find_protocol(filename, true);\n\n if (!proto_drv) {\n\n error_report(\"Unknown protocol '%s'\", filename);\n\n\n return 1;\n\n }\n\n create_options = append_option_parameters(create_options,\n\n proto_drv->create_options);\n\n }\n\n\n\n print_option_help(create_options);\n\n\n return 0;\n\n}"}} {"sample_id": "1ea879e5580f63414693655fcf0328559cdce138_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -59,11 +59,11 @@\n alsa->pcm_buf = audio_calloc (AUDIO_FUNC, obt.samples, 1 << hw->info.shift);\n \n if (!alsa->pcm_buf) {\n+\n+ dolog (\"Could not allocate DAC buffer (%d samples, each %d bytes)\\n\",\n+\n+ hw->samples, 1 << hw->info.shift);\n+\n alsa_anal_close (&handle);\n \n return -1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int alsa_init_out (HWVoiceOut *hw, audsettings_t *as)\n\n{\n\n ALSAVoiceOut *alsa = (ALSAVoiceOut *) hw;\n\n struct alsa_params_req req;\n\n struct alsa_params_obt obt;\n\n snd_pcm_t *handle;\n\n audsettings_t obt_as;\n\n\n\n req.fmt = aud_to_alsafmt (as->fmt);\n\n req.freq = as->freq;\n\n req.nchannels = as->nchannels;\n\n req.period_size = conf.period_size_out;\n\n req.buffer_size = conf.buffer_size_out;\n\n req.size_in_usec = conf.size_in_usec_out;\n\n req.override_mask = !!conf.period_size_out_overridden\n\n | (!!conf.buffer_size_out_overridden << 1);\n\n\n\n if (alsa_open (0, &req, &obt, &handle)) {\n\n return -1;\n\n }\n\n\n\n obt_as.freq = obt.freq;\n\n obt_as.nchannels = obt.nchannels;\n\n obt_as.fmt = obt.fmt;\n\n obt_as.endianness = obt.endianness;\n\n\n\n audio_pcm_init_info (&hw->info, &obt_as);\n\n hw->samples = obt.samples;\n\n\n\n alsa->pcm_buf = audio_calloc (AUDIO_FUNC, obt.samples, 1 << hw->info.shift);\n\n if (!alsa->pcm_buf) {\n\n dolog (\"Could not allocate DAC buffer (%d samples, each %d bytes)\\n\",\n\n hw->samples, 1 << hw->info.shift);\n\n alsa_anal_close (&handle);\n\n return -1;\n\n }\n\n\n\n alsa->handle = handle;\n\n return 0;\n\n}\n"}} {"sample_id": "8da91fffeaffba5f014dfdcc88b672590e83b7fc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n pid1 = chk_error(clone(thread1_func, stack1 + STACK_SIZE,\n \n CLONE_VM | CLONE_FS | CLONE_FILES | SIGCHLD, \"hello1\"));\n+\n+\n+\n+ stack2 = malloc(STACK_SIZE);\n+\n pid2 = chk_error(clone(thread2_func, stack2 + STACK_SIZE,\n \n CLONE_VM | CLONE_FS | CLONE_FILES | SIGCHLD, \"hello2\"));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void test_clone(void)\n\n{\n\n uint8_t *stack1, *stack2;\n\n int pid1, pid2, status1, status2;\n\n\n\n stack1 = malloc(STACK_SIZE);\n\n pid1 = chk_error(clone(thread1_func, stack1 + STACK_SIZE,\n\n CLONE_VM | CLONE_FS | CLONE_FILES | SIGCHLD, \"hello1\"));\n\n\n\n stack2 = malloc(STACK_SIZE);\n\n pid2 = chk_error(clone(thread2_func, stack2 + STACK_SIZE,\n\n CLONE_VM | CLONE_FS | CLONE_FILES | SIGCHLD, \"hello2\"));\n\n\n\n while (waitpid(pid1, &status1, 0) != pid1);\n\n\n while (waitpid(pid2, &status2, 0) != pid2);\n\n\n if (thread1_res != 5 ||\n\n thread2_res != 6)\n\n error(\"clone\");\n\n}"}} {"sample_id": "44b6789299a8acca3f25331bc411055cafc7bb06_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static BlockAIOCB *blkverify_aio_flush(BlockDriverState *bs,\n+\n+ BlockCompletionFunc *cb,\n \n void *opaque)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static BlockAIOCB *blkverify_aio_flush(BlockDriverState *bs,\n\n BlockCompletionFunc *cb,\n\n void *opaque)\n\n{\n\n BDRVBlkverifyState *s = bs->opaque;\n\n\n\n /* Only flush test file, the raw file is not important */\n\n return bdrv_aio_flush(s->test_file->bs, cb, opaque);\n\n}\n"}} {"sample_id": "01dbbd0a9af53237cf7aac210370892208bfb957", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n int i;\n \n \n+\n if (s->motion_val)\n \n free(s->motion_val);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void MPV_common_end(MpegEncContext *s)\n\n{\n\n int i;\n\n\n\n if (s->motion_val)\n\n free(s->motion_val);\n\n if (s->h263_pred) {\n\n free(s->dc_val[0]);\n\n free(s->ac_val[0]);\n\n free(s->coded_block);\n\n free(s->mbintra_table);\n\n }\n\n if (s->mbskip_table)\n\n free(s->mbskip_table);\n\n for(i=0;i<3;i++) {\n\n free(s->last_picture_base[i]);\n\n free(s->next_picture_base[i]);\n\n if (s->has_b_frames)\n\n free(s->aux_picture_base[i]);\n\n }\n\n s->context_initialized = 0;\n\n}\n"}} {"sample_id": "8f5d58ef2c92d7b82d9a6eeefd7c8854a183ba4a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void qdev_prop_allow_set_link_before_realize(Object *obj, const char *name,\n \n Object *val, Error **errp)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void qdev_prop_allow_set_link_before_realize(Object *obj, const char *name,\n\n Object *val, Error **errp)\n\n{\n\n DeviceState *dev = DEVICE(obj);\n\n\n\n if (dev->realized) {\n\n error_setg(errp, \"Attempt to set link property '%s' on device '%s' \"\n\n \"(type '%s') after it was realized\",\n\n name, dev->id, object_get_typename(obj));\n\n }\n\n}\n"}} {"sample_id": "3eedd29bd7df6f21a79e1a67a6d905049996d2ec", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n uint32_t * palette = (uint32_t *)frame->data[1];\n+\n+ int a;\n+\n+ for(a = 0; a < 256; a++){\n \n palette[a] = AV_RB24(&palette_buffer[a * 3]) * 4;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void set_palette(AVFrame * frame, const uint8_t * palette_buffer)\n\n{\n\n uint32_t * palette = (uint32_t *)frame->data[1];\n\n int a;\n\n for(a = 0; a < 256; a++){\n\n palette[a] = AV_RB24(&palette_buffer[a * 3]) * 4;\n\n }\n\n frame->palette_has_changed = 1;\n\n}\n"}} {"sample_id": "74f24cb6306d065045d0e2215a7d10533fa59c57", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n start_list(Visitor *v, const char *name, Error **errp)\n \n+{\n \n StringInputVisitor *siv = to_siv(v);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "start_list(Visitor *v, const char *name, Error **errp)\n\n{\n\n StringInputVisitor *siv = to_siv(v);\n\n\n\n parse_str(siv, errp);\n\n\n\n siv->cur_range = g_list_first(siv->ranges);\n\n if (siv->cur_range) {\n\n Range *r = siv->cur_range->data;\n\n if (r) {\n\n siv->cur = r->begin;\n\n }\n\n }\n\n}\n"}} {"sample_id": "c39059bea3adebcd888571d1181db215eee54495", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n get_scale_factor(h, poc, poc1, i + 16);\n \n }\n+\n+\n+\n+ for (i = 0; i < h->ref_count[0]; i++)\n+\n h->dist_scale_factor[i] = get_scale_factor(h, poc, poc1, i);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_h264_direct_dist_scale_factor(H264Context *const h)\n\n{\n\n const int poc = h->cur_pic_ptr->field_poc[h->picture_structure == PICT_BOTTOM_FIELD];\n\n const int poc1 = h->ref_list[1][0].poc;\n\n int i, field;\n\n\n\n if (FRAME_MBAFF(h))\n\n for (field = 0; field < 2; field++) {\n\n const int poc = h->cur_pic_ptr->field_poc[field];\n\n const int poc1 = h->ref_list[1][0].field_poc[field];\n\n for (i = 0; i < 2 * h->ref_count[0]; i++)\n\n h->dist_scale_factor_field[field][i ^ field] =\n\n get_scale_factor(h, poc, poc1, i + 16);\n\n }\n\n\n\n for (i = 0; i < h->ref_count[0]; i++)\n\n h->dist_scale_factor[i] = get_scale_factor(h, poc, poc1, i);\n\n}\n"}} {"sample_id": "5f8b6491f20732e0a31e64bbf75b62def579e044", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void coroutine_fn wait_for_overlapping_requests(BlockDriverState *bs,\n+ int64_t sector_num, int nb_sectors)\n+{\n+ BdrvTrackedRequest *req;\n+ int64_t cluster_sector_num;\n int cluster_nb_sectors;\n bool retry;\n /* If we touch the same cluster it counts as an overlap. This guarantees", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void coroutine_fn wait_for_overlapping_requests(BlockDriverState *bs,\n int64_t sector_num, int nb_sectors)\n{\n BdrvTrackedRequest *req;\n int64_t cluster_sector_num;\n int cluster_nb_sectors;\n bool retry;\n /* If we touch the same cluster it counts as an overlap. This guarantees\n * that allocating writes will be serialized and not race with each other\n * for the same cluster. For example, in copy-on-read it ensures that the\n * CoR read and write operations are atomic and guest writes cannot\n * interleave between them.\n round_to_clusters(bs, sector_num, nb_sectors,\n &cluster_sector_num, &cluster_nb_sectors);\n do {\n retry = false;\n QLIST_FOREACH(req, &bs->tracked_requests, list) {\n if (tracked_request_overlaps(req, cluster_sector_num,\n cluster_nb_sectors)) {\n qemu_co_queue_wait(&req->wait_queue);\n retry = true;\n break;\n }\n }\n } while (retry);\n}"}} {"sample_id": "77e8b9ca64e85d3d309f322410964b7852ec091e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n if (local_err != NULL) {\n \n+ qerror_report_err(local_err);\n+\n+ error_free(local_err);\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int tcp_socket_outgoing_opts(QemuOpts *opts)\n\n{\n\n Error *local_err = NULL;\n\n int fd = inet_connect_opts(opts, &local_err, NULL, NULL);\n\n if (local_err != NULL) {\n\n qerror_report_err(local_err);\n\n error_free(local_err);\n\n }\n\n\n\n return fd;\n\n}\n"}} {"sample_id": "f3cdcbaee16d32b52d5015a8b1e8ddf5a27f7089", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n ram_size = qfw_cfg_get_u64(fw_cfg, FW_CFG_RAM_SIZE);\n /* Start at 1MB */\n s->start = 1 << 20;\n+ /* Respect PCI hole */\n+ s->end = MIN(ram_size, 0xE0000000);\n+ return &s->alloc;\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "QGuestAllocator *pc_alloc_init(void)\n{\n PCAlloc *s = g_malloc0(sizeof(*s));\n uint64_t ram_size;\n QFWCFG *fw_cfg = pc_fw_cfg_init();\n s->alloc.alloc = pc_alloc;\n s->alloc.free = pc_free;\n ram_size = qfw_cfg_get_u64(fw_cfg, FW_CFG_RAM_SIZE);\n /* Start at 1MB */\n s->start = 1 << 20;\n /* Respect PCI hole */\n s->end = MIN(ram_size, 0xE0000000);\n return &s->alloc;\n}"}} {"sample_id": "b25b387fa5928e516cb2c9e7fde68e958bd7e50a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -60,8 +60,8 @@\n \n return -1;\n \n+ }\n+\n+ return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int qcow2_set_key(BlockDriverState *bs, const char *key)\n\n{\n\n BDRVQcow2State *s = bs->opaque;\n\n uint8_t keybuf[16];\n\n int len, i;\n\n Error *err = NULL;\n\n\n\n memset(keybuf, 0, 16);\n\n len = strlen(key);\n\n if (len > 16)\n\n len = 16;\n\n /* XXX: we could compress the chars to 7 bits to increase\n\n entropy */\n\n for(i = 0;i < len;i++) {\n\n keybuf[i] = key[i];\n\n }\n\n assert(bs->encrypted);\n\n\n\n qcrypto_cipher_free(s->cipher);\n\n s->cipher = qcrypto_cipher_new(\n\n QCRYPTO_CIPHER_ALG_AES_128,\n\n QCRYPTO_CIPHER_MODE_CBC,\n\n keybuf, G_N_ELEMENTS(keybuf),\n\n &err);\n\n\n\n if (!s->cipher) {\n\n /* XXX would be nice if errors in this method could\n\n * be properly propagate to the caller. Would need\n\n * the bdrv_set_key() API signature to be fixed. */\n\n error_free(err);\n\n return -1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "f41e37b84f3d57c29d4a2a21f9337159135b981d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -66,11 +66,11 @@\n \n \n \n+ l = future[l->need_s ? 3 : !res_bits ? 2 : res_bits & 1];\n+\n+ }\n+\n+\n \n return c_idx;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int ff_dirac_golomb_read_16bit(DiracGolombLUT *lut_ctx, const uint8_t *buf,\n\n int bytes, uint8_t *_dst, int coeffs)\n\n{\n\n int i, b, c_idx = 0;\n\n int16_t *dst = (int16_t *)_dst;\n\n DiracGolombLUT *future[4], *l = &lut_ctx[2*LUT_SIZE + buf[0]];\n\n INIT_RESIDUE(res);\n\n\n\n for (b = 1; b <= bytes; b++) {\n\n future[0] = &lut_ctx[buf[b]];\n\n future[1] = future[0] + 1*LUT_SIZE;\n\n future[2] = future[0] + 2*LUT_SIZE;\n\n future[3] = future[0] + 3*LUT_SIZE;\n\n\n\n if ((c_idx + 1) > coeffs)\n\n return c_idx;\n\n\n\n if (res_bits && l->sign) {\n\n int32_t coeff = 1;\n\n APPEND_RESIDUE(res, l->preamble);\n\n for (i = 0; i < (res_bits >> 1) - 1; i++) {\n\n coeff <<= 1;\n\n coeff |= (res >> (RSIZE_BITS - 2*i - 2)) & 1;\n\n }\n\n dst[c_idx++] = l->sign * (coeff - 1);\n\n SET_RESIDUE(res, 0, 0);\n\n }\n\n\n\n for (i = 0; i < LUT_BITS; i++)\n\n dst[c_idx + i] = l->ready[i];\n\n c_idx += l->ready_num;\n\n\n\n APPEND_RESIDUE(res, l->leftover);\n\n\n\n l = future[l->need_s ? 3 : !res_bits ? 2 : res_bits & 1];\n\n }\n\n\n\n return c_idx;\n\n}\n"}} {"sample_id": "3abde1a3b49cf299f2aae4eaae6b6cb5270bdc22", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n+static const uint8_t *pcx_rle_decode(const uint8_t *src, uint8_t *dst,\n \n unsigned int bytes_per_scanline,\n \n+ int compressed)\n \n {\n+\n unsigned int i = 0;\n \n unsigned char run, value;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static const uint8_t *pcx_rle_decode(const uint8_t *src, uint8_t *dst,\n\n unsigned int bytes_per_scanline,\n\n int compressed)\n\n{\n\n unsigned int i = 0;\n\n unsigned char run, value;\n\n\n\n if (compressed) {\n\n while (i < bytes_per_scanline) {\n\n run = 1;\n\n value = *src++;\n\n if (value >= 0xc0) {\n\n run = value & 0x3f;\n\n value = *src++;\n\n }\n\n while (i < bytes_per_scanline && run--)\n\n dst[i++] = value;\n\n }\n\n } else {\n\n memcpy(dst, src, bytes_per_scanline);\n\n src += bytes_per_scanline;\n\n }\n\n\n\n return src;\n\n}\n"}} {"sample_id": "9b2fadda3e0196ffd485adde4fe9cdd6fae35300_29", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void gen_iccci(DisasContext *ctx)\n+\n+{\n+\n #if defined(CONFIG_USER_ONLY)\n \n+ gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n \n #else\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_iccci(DisasContext *ctx)\n\n{\n\n#if defined(CONFIG_USER_ONLY)\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n#else\n\n if (unlikely(ctx->pr)) {\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n return;\n\n }\n\n /* interpreted as no-op */\n\n#endif\n\n}\n"}} {"sample_id": "faaec4676cb4c7a2303d50df66c6290bc96a7657", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void matroska_execute_seekhead(MatroskaDemuxContext *matroska)\n \n+{\n \n EbmlList *seekhead_list = &matroska->seekhead;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void matroska_execute_seekhead(MatroskaDemuxContext *matroska)\n\n{\n\n EbmlList *seekhead_list = &matroska->seekhead;\n\n MatroskaSeekhead *seekhead = seekhead_list->elem;\n\n int64_t before_pos = avio_tell(matroska->ctx->pb);\n\n int i;\n\n\n\n // we should not do any seeking in the streaming case\n\n if (!matroska->ctx->pb->seekable ||\n\n (matroska->ctx->flags & AVFMT_FLAG_IGNIDX))\n\n return;\n\n\n\n for (i = 0; i < seekhead_list->nb_elem; i++) {\n\n if (seekhead[i].pos <= before_pos)\n\n continue;\n\n\n\n // defer cues parsing until we actually need cue data.\n\n if (seekhead[i].id == MATROSKA_ID_CUES) {\n\n matroska->cues_parsing_deferred = 1;\n\n continue;\n\n }\n\n\n\n if (matroska_parse_seekhead_entry(matroska, i) < 0)\n\n break;\n\n }\n\n}\n"}} {"sample_id": "d9f62dde1303286b24ac8ce88be27e2b9b9c5f46_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n g_assert_cmpint(tmp->value, ==, value[i++]);\n \n tmp = tmp->next;\n+\n+ }\n+\n+ g_assert(!tmp);\n+\n \n \n qapi_free_int16List(res);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_visitor_in_intList(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n int64_t value[] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 20};\n\n int16List *res = NULL, *tmp;\n\n Error *err = NULL;\n\n Visitor *v;\n\n int i = 0;\n\n\n\n v = visitor_input_test_init(data, \"1,2,0,2-4,20,5-9,1-8\");\n\n\n\n visit_type_int16List(v, NULL, &res, &error_abort);\n\n tmp = res;\n\n while (i < sizeof(value) / sizeof(value[0])) {\n\n g_assert(tmp);\n\n g_assert_cmpint(tmp->value, ==, value[i++]);\n\n tmp = tmp->next;\n\n }\n\n g_assert(!tmp);\n\n\n\n qapi_free_int16List(res);\n\n\n\n visitor_input_teardown(data, unused);\n\n\n\n v = visitor_input_test_init(data, \"not an int list\");\n\n\n\n /* FIXME: res should be NULL on failure, regardless of starting value */\n\n res = NULL;\n\n visit_type_int16List(v, NULL, &res, &err);\n\n error_free_or_abort(&err);\n\n g_assert(!res);\n\n}\n"}} {"sample_id": "f22d85e9e67262db34504f4079745f9843da6a92_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n ga_disable_logging(ga_state);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void disable_logging(void)\n\n{\n\n ga_disable_logging(ga_state);\n\n}\n"}} {"sample_id": "b45c03f585ea9bb1af76c73e82195418c294919d_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static struct omap_sysctl_s *omap_sysctl_init(struct omap_target_agent_s *ta,\n+\n omap_clk iclk, struct omap_mpu_state_s *mpu)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static struct omap_sysctl_s *omap_sysctl_init(struct omap_target_agent_s *ta,\n\n omap_clk iclk, struct omap_mpu_state_s *mpu)\n\n{\n\n struct omap_sysctl_s *s = (struct omap_sysctl_s *)\n\n g_malloc0(sizeof(struct omap_sysctl_s));\n\n\n\n s->mpu = mpu;\n\n omap_sysctl_reset(s);\n\n\n\n memory_region_init_io(&s->iomem, NULL, &omap_sysctl_ops, s, \"omap.sysctl\",\n\n omap_l4_region_size(ta, 0));\n\n omap_l4_attach(ta, 0, &s->iomem);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "56c4bfb3f07f3107894c00281276aea4f5e8834d_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+void qemu_get_guest_simple_memory_mapping(MemoryMappingList *list)\n+\n+{\n+\n RAMBlock *block;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void qemu_get_guest_simple_memory_mapping(MemoryMappingList *list)\n\n{\n\n RAMBlock *block;\n\n\n\n QTAILQ_FOREACH(block, &ram_list.blocks, next) {\n\n create_new_memory_mapping(list, block->offset, 0, block->length);\n\n }\n\n}\n"}} {"sample_id": "02942db7982541716131ca486ca0d59eae107553", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n \"infiniband_verbs class device path %s, \"\n \n+ \"infiniband class device path %s, \"\n+\n+ \"transport: (%d) %s\\n\",\n+\n+ who,\n \n verbs->device->name,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_rdma_dump_id(const char *who, struct ibv_context *verbs)\n\n{\n\n struct ibv_port_attr port;\n\n\n\n if (ibv_query_port(verbs, 1, &port)) {\n\n error_report(\"Failed to query port information\");\n\n return;\n\n }\n\n\n\n printf(\"%s RDMA Device opened: kernel name %s \"\n\n \"uverbs device name %s, \"\n\n \"infiniband_verbs class device path %s, \"\n\n \"infiniband class device path %s, \"\n\n \"transport: (%d) %s\\n\",\n\n who,\n\n verbs->device->name,\n\n verbs->device->dev_name,\n\n verbs->device->dev_path,\n\n verbs->device->ibdev_path,\n\n port.link_layer,\n\n (port.link_layer == IBV_LINK_LAYER_INFINIBAND) ? \"Infiniband\" :\n\n ((port.link_layer == IBV_LINK_LAYER_ETHERNET) \n\n ? \"Ethernet\" : \"Unknown\"));\n\n}\n"}} {"sample_id": "5d7e3d71673d64a16b58430a0027afadb6b3a54e_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static const unsigned char *seq_decode_op3(SeqVideoContext *seq, const unsigned char *src, unsigned char *dst)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static const unsigned char *seq_decode_op3(SeqVideoContext *seq, const unsigned char *src, unsigned char *dst)\n\n{\n\n int pos, offset;\n\n\n\n do {\n\n pos = *src++;\n\n offset = ((pos >> 3) & 7) * seq->frame.linesize[0] + (pos & 7);\n\n dst[offset] = *src++;\n\n } while (!(pos & 0x80));\n\n\n\n return src;\n\n}\n"}} {"sample_id": "4c19eb721a5929f2277d33a98bb59963c58c2e3b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n memory_region_transaction_begin();\n \n+ as->root = root;\n+\n+ as->current_map = g_new(FlatView, 1);\n+\n+ flatview_init(as->current_map);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void address_space_init(AddressSpace *as, MemoryRegion *root)\n\n{\n\n memory_region_transaction_begin();\n\n as->root = root;\n\n as->current_map = g_new(FlatView, 1);\n\n flatview_init(as->current_map);\n\n\n\n QTAILQ_INSERT_TAIL(&address_spaces, as, address_spaces_link);\n\n as->name = NULL;\n\n memory_region_transaction_commit();\n\n address_space_init_dispatch(as);\n\n}"}} {"sample_id": "32be264cea542b4dc721b10092bf1dfe511a28ee", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n int start, i, j, w;\n \n+\n \n if (sce->ics.clip_avoidance_factor < 1.0f) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void avoid_clipping(AACEncContext *s, SingleChannelElement *sce)\n\n{\n\n int start, i, j, w;\n\n\n\n if (sce->ics.clip_avoidance_factor < 1.0f) {\n\n for (w = 0; w < sce->ics.num_windows; w++) {\n\n start = 0;\n\n for (i = 0; i < sce->ics.max_sfb; i++) {\n\n float *swb_coeffs = sce->coeffs + start + w*128;\n\n for (j = 0; j < sce->ics.swb_sizes[i]; j++)\n\n swb_coeffs[j] *= sce->ics.clip_avoidance_factor;\n\n start += sce->ics.swb_sizes[i];\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "1108b2f8a939fb5778d384149e2f1b99062a72da", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,12 +10,12 @@\n \n \n \n+ if (pread(vdev->vbasedev.fd, &ctrl, sizeof(ctrl),\n \n vdev->config_offset + pos + PCI_CAP_FLAGS) != sizeof(ctrl)) {\n \n return -errno;\n+\n }\n \n ctrl = le16_to_cpu(ctrl);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int vfio_msi_setup(VFIOPCIDevice *vdev, int pos)\n\n{\n\n uint16_t ctrl;\n\n bool msi_64bit, msi_maskbit;\n\n int ret, entries;\n\n\n\n if (pread(vdev->vbasedev.fd, &ctrl, sizeof(ctrl),\n\n vdev->config_offset + pos + PCI_CAP_FLAGS) != sizeof(ctrl)) {\n\n return -errno;\n\n }\n\n ctrl = le16_to_cpu(ctrl);\n\n\n\n msi_64bit = !!(ctrl & PCI_MSI_FLAGS_64BIT);\n\n msi_maskbit = !!(ctrl & PCI_MSI_FLAGS_MASKBIT);\n\n entries = 1 << ((ctrl & PCI_MSI_FLAGS_QMASK) >> 1);\n\n\n\n trace_vfio_msi_setup(vdev->vbasedev.name, pos);\n\n\n\n ret = msi_init(&vdev->pdev, pos, entries, msi_64bit, msi_maskbit);\n\n if (ret < 0) {\n\n if (ret == -ENOTSUP) {\n\n return 0;\n\n }\n\n error_report(\"vfio: msi_init failed\");\n\n return ret;\n\n }\n\n vdev->msi_cap_size = 0xa + (msi_maskbit ? 0xa : 0) + (msi_64bit ? 0x4 : 0);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "3a661f1eabf7e8db66e28489884d9b54aacb94ea_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n const void *in,\n \n void *out,\n+\n size_t len,\n \n Error **errp)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int qcrypto_cipher_decrypt(QCryptoCipher *cipher,\n\n const void *in,\n\n void *out,\n\n size_t len,\n\n Error **errp)\n\n{\n\n QCryptoCipherNettle *ctx = cipher->opaque;\n\n\n\n switch (cipher->mode) {\n\n case QCRYPTO_CIPHER_MODE_ECB:\n\n ctx->alg_decrypt(ctx->ctx_decrypt ? ctx->ctx_decrypt : ctx->ctx_encrypt,\n\n len, out, in);\n\n break;\n\n\n\n case QCRYPTO_CIPHER_MODE_CBC:\n\n cbc_decrypt(ctx->ctx_decrypt ? ctx->ctx_decrypt : ctx->ctx_encrypt,\n\n ctx->alg_decrypt, ctx->niv, ctx->iv,\n\n len, out, in);\n\n break;\n\n default:\n\n error_setg(errp, \"Unsupported cipher algorithm %d\",\n\n cipher->alg);\n\n return -1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "3e305e4a4752f70c0b5c3cf5b43ec957881714f7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,31 +1,31 @@\n static int vncws_start_tls_handshake(VncState *vs)\n+\n+{\n+\n+ int ret = gnutls_handshake(vs->tls.session);\n+\n+\n \n+ if (ret < 0) {\n \n+ if (!gnutls_error_is_fatal(ret)) {\n \n+ VNC_DEBUG(\"Handshake interrupted (blocking)\\n\");\n+\n+ if (!gnutls_record_get_direction(vs->tls.session)) {\n \n+ qemu_set_fd_handler(vs->csock, vncws_tls_handshake_io,\n+\n+ NULL, vs);\n+\n+ } else {\n \n+ qemu_set_fd_handler(vs->csock, NULL, vncws_tls_handshake_io,\n \n vs);\n+\n+ }\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int vncws_start_tls_handshake(VncState *vs)\n\n{\n\n int ret = gnutls_handshake(vs->tls.session);\n\n\n\n if (ret < 0) {\n\n if (!gnutls_error_is_fatal(ret)) {\n\n VNC_DEBUG(\"Handshake interrupted (blocking)\\n\");\n\n if (!gnutls_record_get_direction(vs->tls.session)) {\n\n qemu_set_fd_handler(vs->csock, vncws_tls_handshake_io,\n\n NULL, vs);\n\n } else {\n\n qemu_set_fd_handler(vs->csock, NULL, vncws_tls_handshake_io,\n\n vs);\n\n }\n\n return 0;\n\n }\n\n VNC_DEBUG(\"Handshake failed %s\\n\", gnutls_strerror(ret));\n\n vnc_client_error(vs);\n\n return -1;\n\n }\n\n\n\n if (vs->vd->tls.x509verify) {\n\n if (vnc_tls_validate_certificate(vs) < 0) {\n\n VNC_DEBUG(\"Client verification failed\\n\");\n\n vnc_client_error(vs);\n\n return -1;\n\n } else {\n\n VNC_DEBUG(\"Client verification passed\\n\");\n\n }\n\n }\n\n\n\n VNC_DEBUG(\"Handshake done, switching to TLS data mode\\n\");\n\n qemu_set_fd_handler(vs->csock, vncws_handshake_read, NULL, vs);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "bec1631100323fac0900aea71043d5c4e22fc2fa_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n TCGArg arg1, TCGArg arg2, int const_arg2,\n \n+ int label_index, TCGType type)\n+\n+{\n \n tcg_out_cmp(s, cond, arg1, arg2, const_arg2, 7, type);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void tcg_out_brcond(TCGContext *s, TCGCond cond,\n\n TCGArg arg1, TCGArg arg2, int const_arg2,\n\n int label_index, TCGType type)\n\n{\n\n tcg_out_cmp(s, cond, arg1, arg2, const_arg2, 7, type);\n\n tcg_out_bc(s, tcg_to_bc[cond], label_index);\n\n}\n"}} {"sample_id": "b61cb61ab8f9abca98cc8c4d67cbefdb30f1e82a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,10 +27,10 @@\n } else {\n if ((err = mxf_write_partition(s, 0, 0, header_closed_partition_key, 1)) < 0)\n end:\n+ ff_audio_interleave_close(s);\n+ av_freep(&mxf->index_entries);\n+ av_freep(&mxf->body_partition_offset);\n+ av_freep(&mxf->timecode_track->priv_data);\n+ av_freep(&mxf->timecode_track);\n mxf_free(s);\n return err < 0 ? err : 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int mxf_write_footer(AVFormatContext *s)\n{\n MXFContext *mxf = s->priv_data;\n AVIOContext *pb = s->pb;\n int err = 0;\n mxf->duration = mxf->last_indexed_edit_unit + mxf->edit_units_count;\n mxf_write_klv_fill(s);\n mxf->footer_partition_offset = avio_tell(pb);\n if (mxf->edit_unit_byte_count && s->oformat != &ff_mxf_opatom_muxer) { // no need to repeat index\n if ((err = mxf_write_partition(s, 0, 0, footer_partition_key, 0)) < 0)\n } else {\n if ((err = mxf_write_partition(s, 0, 2, footer_partition_key, 0)) < 0)\n mxf_write_klv_fill(s);\n mxf_write_index_table_segment(s);\n mxf_write_klv_fill(s);\n mxf_write_random_index_pack(s);\n if (s->pb->seekable) {\n if (s->oformat == &ff_mxf_opatom_muxer){\n /* rewrite body partition to update lengths */\n avio_seek(pb, mxf->body_partition_offset[0], SEEK_SET);\n if ((err = mxf_write_opatom_body_partition(s)) < 0)\n avio_seek(pb, 0, SEEK_SET);\n if (mxf->edit_unit_byte_count && s->oformat != &ff_mxf_opatom_muxer) {\n if ((err = mxf_write_partition(s, 1, 2, header_closed_partition_key, 1)) < 0)\n mxf_write_klv_fill(s);\n mxf_write_index_table_segment(s);\n } else {\n if ((err = mxf_write_partition(s, 0, 0, header_closed_partition_key, 1)) < 0)\nend:\n ff_audio_interleave_close(s);\n av_freep(&mxf->index_entries);\n av_freep(&mxf->body_partition_offset);\n av_freep(&mxf->timecode_track->priv_data);\n av_freep(&mxf->timecode_track);\n mxf_free(s);\n return err < 0 ? err : 0;"}} {"sample_id": "e8ede0a8bb5298a6979bcf7ed84ef64a64a4e3fe_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n union {\n+\n+ uint32_t i;\n+\n+ float32 s;\n \n } v;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline uint32_t ucf64_stoi(float32 s)\n\n{\n\n union {\n\n uint32_t i;\n\n float32 s;\n\n } v;\n\n\n\n v.s = s;\n\n return v.i;\n\n}\n"}} {"sample_id": "f1e173049ecc9de03817385ba8962d14cba779db_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n t1->flags[y][x + 1] |= JPEG2000_T1_SIG_W | JPEG2000_T1_SGN_W;\n \n+ t1->flags[y][x - 1] |= JPEG2000_T1_SIG_E | JPEG2000_T1_SGN_E;\n+\n+ t1->flags[y + 1][x] |= JPEG2000_T1_SIG_N | JPEG2000_T1_SGN_N;\n+\n+ t1->flags[y - 1][x] |= JPEG2000_T1_SIG_S | JPEG2000_T1_SGN_S;\n \n } else {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_jpeg2000_set_significance(Jpeg2000T1Context *t1, int x, int y,\n\n int negative)\n\n{\n\n x++;\n\n y++;\n\n t1->flags[y][x] |= JPEG2000_T1_SIG;\n\n if (negative) {\n\n t1->flags[y][x + 1] |= JPEG2000_T1_SIG_W | JPEG2000_T1_SGN_W;\n\n t1->flags[y][x - 1] |= JPEG2000_T1_SIG_E | JPEG2000_T1_SGN_E;\n\n t1->flags[y + 1][x] |= JPEG2000_T1_SIG_N | JPEG2000_T1_SGN_N;\n\n t1->flags[y - 1][x] |= JPEG2000_T1_SIG_S | JPEG2000_T1_SGN_S;\n\n } else {\n\n t1->flags[y][x + 1] |= JPEG2000_T1_SIG_W;\n\n t1->flags[y][x - 1] |= JPEG2000_T1_SIG_E;\n\n t1->flags[y + 1][x] |= JPEG2000_T1_SIG_N;\n\n t1->flags[y - 1][x] |= JPEG2000_T1_SIG_S;\n\n }\n\n t1->flags[y + 1][x + 1] |= JPEG2000_T1_SIG_NW;\n\n t1->flags[y + 1][x - 1] |= JPEG2000_T1_SIG_NE;\n\n t1->flags[y - 1][x + 1] |= JPEG2000_T1_SIG_SW;\n\n t1->flags[y - 1][x - 1] |= JPEG2000_T1_SIG_SE;\n\n}\n"}} {"sample_id": "de9e9d9f17a36ff76c1a02a5348835e5e0a081b0_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,10 +5,10 @@\n gen_mov_reg_N(cpu_tmp0, src);\n \n gen_mov_reg_V(dst, src);\n+\n+ tcg_gen_xor_tl(dst, dst, cpu_tmp0);\n+\n+ gen_mov_reg_Z(cpu_tmp0, src);\n \n tcg_gen_or_tl(dst, dst, cpu_tmp0);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_op_eval_bg(TCGv dst, TCGv_i32 src)\n\n{\n\n gen_mov_reg_N(cpu_tmp0, src);\n\n gen_mov_reg_V(dst, src);\n\n tcg_gen_xor_tl(dst, dst, cpu_tmp0);\n\n gen_mov_reg_Z(cpu_tmp0, src);\n\n tcg_gen_or_tl(dst, dst, cpu_tmp0);\n\n tcg_gen_xori_tl(dst, dst, 0x1);\n\n}\n"}} {"sample_id": "35b0f237205dc6a5c9aa3eae14f19ef4d37dafcd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n }\n \n absolute_enabled = 1;\n+\n+ }\n+\n+ } else if (absolute_enabled) {\n+\n \tsdl_show_cursor();\n \n \tabsolute_enabled = 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void sdl_mouse_mode_change(Notifier *notify, void *data)\n\n{\n\n if (kbd_mouse_is_absolute()) {\n\n if (!absolute_enabled) {\n\n sdl_hide_cursor();\n\n if (gui_grab) {\n\n sdl_grab_end();\n\n }\n\n absolute_enabled = 1;\n\n }\n\n } else if (absolute_enabled) {\n\n\tsdl_show_cursor();\n\n\tabsolute_enabled = 0;\n\n }\n\n}\n"}} {"sample_id": "e6bc38fd49c94726b45d5d5cc2b756ad8ec49ee0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+void ff_wmv2_idct_c(short * block){\n+\n+ int i;\n+\n \n+\n+ for(i=0;i<64;i+=8){\n \n wmv2_idct_row(block+i);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void ff_wmv2_idct_c(short * block){\n\n int i;\n\n\n\n for(i=0;i<64;i+=8){\n\n wmv2_idct_row(block+i);\n\n }\n\n for(i=0;i<8;i++){\n\n wmv2_idct_col(block+i);\n\n }\n\n}\n"}} {"sample_id": "6cecf093735f2e5af7d0e29d957350320044e354", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n DeviceClass *dc = DEVICE_CLASS(klass);\n \n+ VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);\n+\n+\n+\n+ dc->props = virtio_9p_properties;\n \n set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void virtio_9p_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);\n\n\n\n dc->props = virtio_9p_properties;\n\n set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);\n\n vdc->realize = virtio_9p_device_realize;\n\n\n vdc->get_features = virtio_9p_get_features;\n\n vdc->get_config = virtio_9p_get_config;\n\n}"}} {"sample_id": "1b7f01d966f97b7820f3cdd471461cf0799a93cc_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n if (lock->writer) {\n lock->writer = false;\n qemu_co_queue_restart_all(&lock->queue);\n+ } else {\n+ lock->reader--;\n+ assert(lock->reader >= 0);\n /* Wakeup only one waiting writer */\n if (!lock->reader) {\n qemu_co_queue_next(&lock->queue);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void qemu_co_rwlock_unlock(CoRwlock *lock)\n{\n assert(qemu_in_coroutine());\n if (lock->writer) {\n lock->writer = false;\n qemu_co_queue_restart_all(&lock->queue);\n } else {\n lock->reader--;\n assert(lock->reader >= 0);\n /* Wakeup only one waiting writer */\n if (!lock->reader) {\n qemu_co_queue_next(&lock->queue);\n }\n }\n}"}} {"sample_id": "5484dad7f6122a4d4dbc28e867a8c71d22ba2297", "diff": "--- a/source.c\n+++ b/source.c\n@@ -53,11 +53,11 @@\n s->decoded[channel][sample] = get_sbits(&s->gb, tmp);\n \n \n+ else\n+\n+ {\n+\n+// av_log(s->avctx, AV_LOG_DEBUG, \"rice coded partition k=%d\\n\", tmp);\n \n for (; i < samples; i++, sample++){\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int decode_residuals(FLACContext *s, int channel, int pred_order)\n\n{\n\n int i, tmp, partition, method_type, rice_order;\n\n int sample = 0, samples;\n\n\n\n method_type = get_bits(&s->gb, 2);\n\n if (method_type != 0){\n\n av_log(s->avctx, AV_LOG_DEBUG, \"illegal residual coding method %d\\n\", method_type);\n\n\n\n\n\n rice_order = get_bits(&s->gb, 4);\n\n\n\n samples= s->blocksize >> rice_order;\n\n\n\n\n\n\n\n sample=\n\n i= pred_order;\n\n for (partition = 0; partition < (1 << rice_order); partition++)\n\n {\n\n tmp = get_bits(&s->gb, 4);\n\n if (tmp == 15)\n\n {\n\n av_log(s->avctx, AV_LOG_DEBUG, \"fixed len partition\\n\");\n\n tmp = get_bits(&s->gb, 5);\n\n for (; i < samples; i++, sample++)\n\n s->decoded[channel][sample] = get_sbits(&s->gb, tmp);\n\n\n else\n\n {\n\n// av_log(s->avctx, AV_LOG_DEBUG, \"rice coded partition k=%d\\n\", tmp);\n\n for (; i < samples; i++, sample++){\n\n s->decoded[channel][sample] = get_sr_golomb_flac(&s->gb, tmp, INT_MAX, 0);\n\n\n\n i= 0;\n\n\n\n\n// av_log(s->avctx, AV_LOG_DEBUG, \"partitions: %d, samples: %d\\n\", 1 << rice_order, sample);\n\n\n\n return 0;\n"}} {"sample_id": "bc0f0674f037a01f2ce0870ad6270a356a7a8347_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static bool e1000_full_mac_needed(void *opaque)\n \n {\n+\n+ E1000State *s = opaque;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool e1000_full_mac_needed(void *opaque)\n\n{\n\n E1000State *s = opaque;\n\n\n\n return s->compat_flags & E1000_FLAG_MAC;\n\n}\n"}} {"sample_id": "91479dd0b5bd3b087b92ddd7bc3f2c54982cfe17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n fail_unless(opaque == NULL);\n \n \n+\n+ qi = qobject_to_qint(obj);\n+\n+ fail_unless(qi != NULL);\n+\n fail_unless((qint_get_int(qi) >= 0) && (qint_get_int(qi) <= iter_max));\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void iter_func(QObject *obj, void *opaque)\n\n{\n\n QInt *qi;\n\n\n\n fail_unless(opaque == NULL);\n\n\n\n qi = qobject_to_qint(obj);\n\n fail_unless(qi != NULL);\n\n fail_unless((qint_get_int(qi) >= 0) && (qint_get_int(qi) <= iter_max));\n\n\n\n iter_called++;\n\n}\n"}} {"sample_id": "d8f94e1bb275ab6a14a15220fd6afd0d04324aeb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n+void ide_drive_get(DriveInfo **hd, int max_bus)\n \n+{\n+\n int i;\n \n+\n+\n if (drive_get_max_bus(IF_IDE) >= max_bus) {\n \n fprintf(stderr, \"qemu: too many IDE bus: %d\\n\", max_bus);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void ide_drive_get(DriveInfo **hd, int max_bus)\n\n{\n\n int i;\n\n\n\n if (drive_get_max_bus(IF_IDE) >= max_bus) {\n\n fprintf(stderr, \"qemu: too many IDE bus: %d\\n\", max_bus);\n\n exit(1);\n\n }\n\n\n\n for(i = 0; i < max_bus * MAX_IDE_DEVS; i++) {\n\n hd[i] = drive_get(IF_IDE, i / MAX_IDE_DEVS, i % MAX_IDE_DEVS);\n\n }\n\n}\n"}} {"sample_id": "f6b4fc8b23b1154577c72937b70e565716bb0a60_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static int check_opts(QemuOptsList *opts_list, QDict *args)\n+\n {\n \n assert(!opts_list->desc->name);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int check_opts(QemuOptsList *opts_list, QDict *args)\n\n{\n\n assert(!opts_list->desc->name);\n\n return 0;\n\n}\n"}} {"sample_id": "a8f2e5c8fffbaf7fbd4f0efc8efbeebade78008f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void virtio_scsi_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq)\n+\n {\n+\n+ VirtIOSCSI *s = (VirtIOSCSI *)vdev;\n \n VirtIOSCSIReq *req;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void virtio_scsi_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq)\n\n{\n\n VirtIOSCSI *s = (VirtIOSCSI *)vdev;\n\n VirtIOSCSIReq *req;\n\n\n\n if (s->ctx && !s->dataplane_started) {\n\n virtio_scsi_dataplane_start(s);\n\n return;\n\n }\n\n while ((req = virtio_scsi_pop_req(s, vq))) {\n\n virtio_scsi_handle_ctrl_req(s, req);\n\n }\n\n}\n"}} {"sample_id": "949868633f0454715af1781c0f377413b6ab000e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,14 +9,14 @@\n hwaddr pte_offset;\n \n ppc_hash_pte64_t pte;\n+\n unsigned apshift;\n+\n \n \n if (msr_dr == 0) {\n+\n+ /* In real mode the top 4 effective address bits are ignored */\n \n return addr & 0x0FFFFFFFFFFFFFFFULL;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "hwaddr ppc_hash64_get_phys_page_debug(PowerPCCPU *cpu, target_ulong addr)\n\n{\n\n CPUPPCState *env = &cpu->env;\n\n ppc_slb_t *slb;\n\n hwaddr pte_offset;\n\n ppc_hash_pte64_t pte;\n\n unsigned apshift;\n\n\n\n if (msr_dr == 0) {\n\n /* In real mode the top 4 effective address bits are ignored */\n\n return addr & 0x0FFFFFFFFFFFFFFFULL;\n\n }\n\n\n\n slb = slb_lookup(cpu, addr);\n\n if (!slb) {\n\n return -1;\n\n }\n\n\n\n pte_offset = ppc_hash64_htab_lookup(cpu, slb, addr, &pte);\n\n if (pte_offset == -1) {\n\n return -1;\n\n }\n\n\n\n apshift = hpte_page_shift(slb->sps, pte.pte0, pte.pte1);\n\n if (!apshift) {\n\n return -1;\n\n }\n\n\n\n return deposit64(pte.pte1 & HPTE64_R_RPN, 0, apshift, addr)\n\n & TARGET_PAGE_MASK;\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_37", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n \n \n tcg_gen_ext_i32_i64(tmp1, a);\n+\n+ dead_tmp(a);\n+\n+ tcg_gen_ext_i32_i64(tmp2, b);\n+\n dead_tmp(b);\n \n tcg_gen_mul_i64(tmp1, tmp1, tmp2);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static TCGv gen_muls_i64_i32(TCGv a, TCGv b)\n\n{\n\n TCGv tmp1 = tcg_temp_new(TCG_TYPE_I64);\n\n TCGv tmp2 = tcg_temp_new(TCG_TYPE_I64);\n\n\n\n tcg_gen_ext_i32_i64(tmp1, a);\n\n dead_tmp(a);\n\n tcg_gen_ext_i32_i64(tmp2, b);\n\n dead_tmp(b);\n\n tcg_gen_mul_i64(tmp1, tmp1, tmp2);\n\n return tmp1;\n\n}\n"}} {"sample_id": "ac531cb6e542b1e61d668604adf9dc5306a948c0_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n ent = QLIST_FIRST(&qdict->table[12345 % QDICT_BUCKET_MAX]);\n \n qi = qobject_to_qint(ent->value);\n+\n+ fail_unless(qint_get_int(qi) == num);\n+\n+\n+\n // destroy doesn't exit yet\n \n QDECREF(qi);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "START_TEST(qdict_put_obj_test)\n\n{\n\n QInt *qi;\n\n QDict *qdict;\n\n QDictEntry *ent;\n\n const int num = 42;\n\n\n\n qdict = qdict_new();\n\n\n\n // key \"\" will have tdb hash 12345\n\n qdict_put_obj(qdict, \"\", QOBJECT(qint_from_int(num)));\n\n\n\n fail_unless(qdict_size(qdict) == 1);\n\n ent = QLIST_FIRST(&qdict->table[12345 % QDICT_BUCKET_MAX]);\n\n qi = qobject_to_qint(ent->value);\n\n fail_unless(qint_get_int(qi) == num);\n\n\n\n // destroy doesn't exit yet\n\n QDECREF(qi);\n\n g_free(ent->key);\n\n g_free(ent);\n\n g_free(qdict);\n\n}\n"}} {"sample_id": "2caf19e90f270abe1e80a3e85acaf0eb5c9d0aac_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n pixel *src = (pixel*)_src;\n \n+ int stride = _stride/sizeof(pixel);\n \n const int dc= ( src[-1+0*stride] + src[-1+1*stride] + src[-1+2*stride] + src[-1+3*stride] + 2) >>2;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void FUNCC(pred4x4_left_dc)(uint8_t *_src, const uint8_t *topright, int _stride){\n\n pixel *src = (pixel*)_src;\n\n int stride = _stride/sizeof(pixel);\n\n const int dc= ( src[-1+0*stride] + src[-1+1*stride] + src[-1+2*stride] + src[-1+3*stride] + 2) >>2;\n\n\n\n ((pixel4*)(src+0*stride))[0]=\n\n ((pixel4*)(src+1*stride))[0]=\n\n ((pixel4*)(src+2*stride))[0]=\n\n ((pixel4*)(src+3*stride))[0]= PIXEL_SPLAT_X4(dc);\n\n}\n"}} {"sample_id": "57d1f6d7ce23e79a8ebe4a57bd2363b269b4664b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n return fs.f_bsize;\n \n }\n+\n+ }\n+\n+\n+\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "size_t qemu_fd_getpagesize(int fd)\n\n{\n\n#ifdef CONFIG_LINUX\n\n struct statfs fs;\n\n int ret;\n\n\n\n if (fd != -1) {\n\n do {\n\n ret = fstatfs(fd, &fs);\n\n } while (ret != 0 && errno == EINTR);\n\n\n\n if (ret == 0 && fs.f_type == HUGETLBFS_MAGIC) {\n\n return fs.f_bsize;\n\n }\n\n }\n\n\n\n\n\n\n\n\n return getpagesize();\n\n}"}} {"sample_id": "2cbe6bac0337939f023bd1c37a9c455e6d535f3a_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,7 +12,7 @@\n \n if ((s->flags & FRAMERATE_FLAG_SCD)) {\n \n+ if (s->score >= 0.0)\n \n interpolate_scene_score = s->score;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int blend_frames(AVFilterContext *ctx, int interpolate)\n\n{\n\n FrameRateContext *s = ctx->priv;\n\n AVFilterLink *outlink = ctx->outputs[0];\n\n double interpolate_scene_score = 0;\n\n\n\n if ((s->flags & FRAMERATE_FLAG_SCD)) {\n\n if (s->score >= 0.0)\n\n interpolate_scene_score = s->score;\n\n else\n\n interpolate_scene_score = s->score = get_scene_score(ctx, s->f0, s->f1);\n\n ff_dlog(ctx, \"blend_frames() interpolate scene score:%f\\n\", interpolate_scene_score);\n\n }\n\n // decide if the shot-change detection allows us to blend two frames\n\n if (interpolate_scene_score < s->scene_score) {\n\n ThreadData td;\n\n td.copy_src1 = s->f0;\n\n td.copy_src2 = s->f1;\n\n td.src2_factor = interpolate;\n\n td.src1_factor = s->max - td.src2_factor;\n\n\n\n // get work-space for output frame\n\n s->work = ff_get_video_buffer(outlink, outlink->w, outlink->h);\n\n if (!s->work)\n\n return AVERROR(ENOMEM);\n\n\n\n av_frame_copy_props(s->work, s->f0);\n\n\n\n ff_dlog(ctx, \"blend_frames() INTERPOLATE to create work frame\\n\");\n\n ctx->internal->execute(ctx, filter_slice, &td, NULL, FFMIN(outlink->h, ff_filter_get_nb_threads(ctx)));\n\n return 1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "dfd100f242370886bb6732f70f1f7cbd8eb9fedc_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n }\n \n if (nsaddr != 1) {\n+\n+ error_setg(errp, \"Expected a single address in reverse mode\");\n+\n+ return -1;\n+\n }\n \n /* TODO SOCKET_ADDRESS_KIND_FD when fd has AF_UNIX */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int vnc_display_connect(VncDisplay *vd,\n\n SocketAddress **saddr,\n\n size_t nsaddr,\n\n SocketAddress **wsaddr,\n\n size_t nwsaddr,\n\n Error **errp)\n\n{\n\n /* connect to viewer */\n\n QIOChannelSocket *sioc = NULL;\n\n if (nwsaddr != 0) {\n\n error_setg(errp, \"Cannot use websockets in reverse mode\");\n\n return -1;\n\n }\n\n if (nsaddr != 1) {\n\n error_setg(errp, \"Expected a single address in reverse mode\");\n\n return -1;\n\n }\n\n /* TODO SOCKET_ADDRESS_KIND_FD when fd has AF_UNIX */\n\n vd->is_unix = saddr[0]->type == SOCKET_ADDRESS_KIND_UNIX;\n\n sioc = qio_channel_socket_new();\n\n qio_channel_set_name(QIO_CHANNEL(sioc), \"vnc-reverse\");\n\n if (qio_channel_socket_connect_sync(sioc, saddr[0], errp) < 0) {\n\n return -1;\n\n }\n\n vnc_connect(vd, sioc, false, false);\n\n object_unref(OBJECT(sioc));\n\n return 0;\n\n}\n"}} {"sample_id": "3228ac730c11eca49d5680d5550128e397061c85_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+av_cold int ff_vc2enc_init_transforms(VC2TransformContext *s, int p_width, int p_height)\n \n {\n \n s->vc2_subband_dwt[VC2_TRANSFORM_9_7] = vc2_subband_dwt_97;\n+\n s->vc2_subband_dwt[VC2_TRANSFORM_5_3] = vc2_subband_dwt_53;\n \n s->vc2_subband_dwt[VC2_TRANSFORM_HAAR] = vc2_subband_dwt_haar;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "av_cold int ff_vc2enc_init_transforms(VC2TransformContext *s, int p_width, int p_height)\n\n{\n\n s->vc2_subband_dwt[VC2_TRANSFORM_9_7] = vc2_subband_dwt_97;\n\n s->vc2_subband_dwt[VC2_TRANSFORM_5_3] = vc2_subband_dwt_53;\n\n s->vc2_subband_dwt[VC2_TRANSFORM_HAAR] = vc2_subband_dwt_haar;\n\n s->vc2_subband_dwt[VC2_TRANSFORM_HAAR_S] = vc2_subband_dwt_haar_shift;\n\n\n\n s->buffer = av_malloc(2*p_width*p_height*sizeof(dwtcoef));\n\n if (!s->buffer)\n\n return 1;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "79ca616f291124d166ca173e512c4ace1c2fe8b2_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n int dom, bus;\n \n+ unsigned slot;\n+\n+ Error *local_err = NULL;\n+\n+\n \n if (pci_read_devaddr(mon, pci_addr, &dom, &bus, &slot)) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pci_device_hot_remove(Monitor *mon, const char *pci_addr)\n\n{\n\n PCIDevice *d;\n\n int dom, bus;\n\n unsigned slot;\n\n Error *local_err = NULL;\n\n\n\n if (pci_read_devaddr(mon, pci_addr, &dom, &bus, &slot)) {\n\n return -1;\n\n }\n\n\n\n d = pci_find_device(pci_find_root_bus(dom), bus, PCI_DEVFN(slot, 0));\n\n if (!d) {\n\n monitor_printf(mon, \"slot %d empty\\n\", slot);\n\n return -1;\n\n }\n\n\n\n qdev_unplug(&d->qdev, &local_err);\n\n if (error_is_set(&local_err)) {\n\n monitor_printf(mon, \"%s\\n\", error_get_pretty(local_err));\n\n error_free(local_err);\n\n return -1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "5f758366c0710d23e43f4d0f83816b98616a13d0_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n static CharDriverState *qmp_chardev_open_file(ChardevFile *file, Error **errp)\n+\n {\n \n+ int flags, in = -1, out = -1;\n \n \n \n flags = O_WRONLY | O_TRUNC | O_CREAT | O_BINARY;\n \n+ out = qmp_chardev_open_file_source(file->out, flags, errp);\n \n if (error_is_set(errp)) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static CharDriverState *qmp_chardev_open_file(ChardevFile *file, Error **errp)\n\n{\n\n int flags, in = -1, out = -1;\n\n\n\n flags = O_WRONLY | O_TRUNC | O_CREAT | O_BINARY;\n\n out = qmp_chardev_open_file_source(file->out, flags, errp);\n\n if (error_is_set(errp)) {\n\n return NULL;\n\n }\n\n\n\n if (file->has_in) {\n\n flags = O_RDONLY;\n\n in = qmp_chardev_open_file_source(file->in, flags, errp);\n\n if (error_is_set(errp)) {\n\n qemu_close(out);\n\n return NULL;\n\n }\n\n }\n\n\n\n return qemu_chr_open_fd(in, out);\n\n}\n"}} {"sample_id": "42d73f7f6bea0ee0f64a3ad4882860ce5b923a11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static int parse_vtrk(AVFormatContext *s,\n \n+ FourxmDemuxContext *fourxm, uint8_t *buf, int size)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int parse_vtrk(AVFormatContext *s,\n\n FourxmDemuxContext *fourxm, uint8_t *buf, int size)\n\n{\n\n AVStream *st;\n\n /* check that there is enough data */\n\n if (size != vtrk_SIZE) {\n\n return AVERROR_INVALIDDATA;\n\n }\n\n\n\n /* allocate a new AVStream */\n\n st = avformat_new_stream(s, NULL);\n\n if (!st)\n\n return AVERROR(ENOMEM);\n\n\n\n avpriv_set_pts_info(st, 60, 1, fourxm->fps);\n\n\n\n fourxm->video_stream_index = st->index;\n\n\n\n st->codec->codec_type = AVMEDIA_TYPE_VIDEO;\n\n st->codec->codec_id = AV_CODEC_ID_4XM;\n\n st->codec->extradata_size = 4;\n\n st->codec->extradata = av_malloc(4);\n\n AV_WL32(st->codec->extradata, AV_RL32(buf + 16));\n\n st->codec->width = AV_RL32(buf + 36);\n\n st->codec->height = AV_RL32(buf + 40);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a890643958f03aaa344290700093b280cb606c28_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n const void *userp, uint32_t hash)\n \n {\n+\n struct qht_bucket *b = head;\n \n int i;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void *qht_do_lookup(struct qht_bucket *head, qht_lookup_func_t func,\n\n const void *userp, uint32_t hash)\n\n{\n\n struct qht_bucket *b = head;\n\n int i;\n\n\n\n do {\n\n for (i = 0; i < QHT_BUCKET_ENTRIES; i++) {\n\n if (b->hashes[i] == hash) {\n\n /* The pointer is dereferenced before seqlock_read_retry,\n\n * so (unlike qht_insert__locked) we need to use\n\n * atomic_rcu_read here.\n\n */\n\n void *p = atomic_rcu_read(&b->pointers[i]);\n\n\n\n if (likely(p) && likely(func(p, userp))) {\n\n return p;\n\n }\n\n }\n\n }\n\n b = atomic_rcu_read(&b->next);\n\n } while (b);\n\n\n\n return NULL;\n\n}\n"}} {"sample_id": "0f3f1f302fd2021a5ce6cb170321d0a0d35bdec5_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void virtio_set_status(struct subchannel_id schid,\n \n+ unsigned long dev_addr)\n+\n {\n \n unsigned char status = dev_addr;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_set_status(struct subchannel_id schid,\n\n unsigned long dev_addr)\n\n{\n\n unsigned char status = dev_addr;\n\n run_ccw(schid, CCW_CMD_WRITE_STATUS, &status, sizeof(status));\n\n}\n"}} {"sample_id": "6bd665b7c5798803366b877903fa3bce7f129d05_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n TAK_BPS_MIN;\n \n+ s->channels = get_bits(gb, TAK_FORMAT_CHANNEL_BITS) +\n+\n+ TAK_CHANNELS_MIN;\n+\n+\n \n if (get_bits1(gb)) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void avpriv_tak_parse_streaminfo(GetBitContext *gb, TAKStreamInfo *s)\n\n{\n\n uint64_t channel_mask = 0;\n\n int frame_type, i;\n\n\n\n s->codec = get_bits(gb, TAK_ENCODER_CODEC_BITS);\n\n skip_bits(gb, TAK_ENCODER_PROFILE_BITS);\n\n\n\n frame_type = get_bits(gb, TAK_SIZE_FRAME_DURATION_BITS);\n\n s->samples = get_bits64(gb, TAK_SIZE_SAMPLES_NUM_BITS);\n\n\n\n s->data_type = get_bits(gb, TAK_FORMAT_DATA_TYPE_BITS);\n\n s->sample_rate = get_bits(gb, TAK_FORMAT_SAMPLE_RATE_BITS) +\n\n TAK_SAMPLE_RATE_MIN;\n\n s->bps = get_bits(gb, TAK_FORMAT_BPS_BITS) +\n\n TAK_BPS_MIN;\n\n s->channels = get_bits(gb, TAK_FORMAT_CHANNEL_BITS) +\n\n TAK_CHANNELS_MIN;\n\n\n\n if (get_bits1(gb)) {\n\n skip_bits(gb, TAK_FORMAT_VALID_BITS);\n\n if (get_bits1(gb)) {\n\n for (i = 0; i < s->channels; i++) {\n\n int value = get_bits(gb, TAK_FORMAT_CH_LAYOUT_BITS);\n\n\n\n if (value < FF_ARRAY_ELEMS(tak_channel_layouts))\n\n channel_mask |= tak_channel_layouts[value];\n\n }\n\n }\n\n }\n\n\n\n s->ch_layout = channel_mask;\n\n s->frame_samples = tak_get_nb_samples(s->sample_rate, frame_type);\n\n}\n"}} {"sample_id": "b6dcbe086c77ec683f5ff0b693593cda1d61f3a1_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n sdram_set_bcr(&sdram->bcr[i],\n \n+ sdram_bcr(sdram->ram_bases[i], sdram->ram_sizes[i]),\n+\n+ 1);\n+\n+ } else {\n \n sdram_set_bcr(&sdram->bcr[i], 0x00000000, 0);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void sdram_map_bcr (ppc4xx_sdram_t *sdram)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < sdram->nbanks; i++) {\n\n if (sdram->ram_sizes[i] != 0) {\n\n sdram_set_bcr(&sdram->bcr[i],\n\n sdram_bcr(sdram->ram_bases[i], sdram->ram_sizes[i]),\n\n 1);\n\n } else {\n\n sdram_set_bcr(&sdram->bcr[i], 0x00000000, 0);\n\n }\n\n }\n\n}\n"}} {"sample_id": "2958620f67dcfd11476e62b4ca704dae0b978ea3_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+uint64_t helper_subqv (uint64_t op1, uint64_t op2)\n+\n+{\n+\n+ uint64_t res;\n \n+ res = op1 - op2;\n \n if (unlikely((op1 ^ op2) & (res ^ op1) & (1ULL << 63))) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "uint64_t helper_subqv (uint64_t op1, uint64_t op2)\n\n{\n\n uint64_t res;\n\n res = op1 - op2;\n\n if (unlikely((op1 ^ op2) & (res ^ op1) & (1ULL << 63))) {\n\n arith_excp(env, GETPC(), EXC_M_IOV, 0);\n\n }\n\n return res;\n\n}\n"}} {"sample_id": "c0532a76b407af4b276dc5a62d8178db59857ea6_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,13 +7,13 @@\n int r, e;\n \n siginfo_t siginfo;\n+\n+ sigset_t waitset;\n+\n+\n+\n+ ts.tv_sec = timeout / 1000;\n+\n ts.tv_nsec = (timeout % 1000) * 1000000;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void qemu_kvm_eat_signal(CPUState *env, int timeout)\n\n{\n\n struct timespec ts;\n\n int r, e;\n\n siginfo_t siginfo;\n\n sigset_t waitset;\n\n\n\n ts.tv_sec = timeout / 1000;\n\n ts.tv_nsec = (timeout % 1000) * 1000000;\n\n\n\n sigemptyset(&waitset);\n\n sigaddset(&waitset, SIG_IPI);\n\n\n\n qemu_mutex_unlock(&qemu_global_mutex);\n\n r = sigtimedwait(&waitset, &siginfo, &ts);\n\n e = errno;\n\n qemu_mutex_lock(&qemu_global_mutex);\n\n\n\n if (r == -1 && !(e == EAGAIN || e == EINTR)) {\n\n fprintf(stderr, \"sigtimedwait: %s\\n\", strerror(e));\n\n exit(1);\n\n }\n\n}\n"}} {"sample_id": "92e483f8ed70d88d4f64337f65bae212502735d4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int cmp_intervals(const void *a, const void *b)\n \n {\n+\n+ const Interval *i1 = a;\n+\n+ const Interval *i2 = b;\n \n int64_t ts_diff = i1->start_ts - i2->start_ts;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int cmp_intervals(const void *a, const void *b)\n\n{\n\n const Interval *i1 = a;\n\n const Interval *i2 = b;\n\n int64_t ts_diff = i1->start_ts - i2->start_ts;\n\n int ret;\n\n\n\n ret = ts_diff > 0 ? 1 : ts_diff < 0 ? -1 : 0;\n\n return ret == 0 ? i1->index - i2->index : ret;\n\n}\n"}} {"sample_id": "aba232cfa9b193604ed98f3fa505378d006b1b3b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,8 +13,8 @@\n r3d->video_offsets_count = (atom->size - 8) / 4;\n \n r3d->video_offsets = av_malloc(atom->size);\n+\n+ if (!r3d->video_offsets)\n \n return AVERROR(ENOMEM);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int r3d_read_rdvo(AVFormatContext *s, Atom *atom)\n\n{\n\n R3DContext *r3d = s->priv_data;\n\n AVStream *st = s->streams[0];\n\n int i;\n\n\n\n r3d->video_offsets_count = (atom->size - 8) / 4;\n\n r3d->video_offsets = av_malloc(atom->size);\n\n if (!r3d->video_offsets)\n\n return AVERROR(ENOMEM);\n\n\n\n for (i = 0; i < r3d->video_offsets_count; i++) {\n\n r3d->video_offsets[i] = avio_rb32(s->pb);\n\n if (!r3d->video_offsets[i]) {\n\n r3d->video_offsets_count = i;\n\n break;\n\n }\n\n av_dlog(s, \"video offset %d: %#x\\n\", i, r3d->video_offsets[i]);\n\n }\n\n\n\n if (st->r_frame_rate.num)\n\n st->duration = av_rescale_q(r3d->video_offsets_count,\n\n (AVRational){st->r_frame_rate.den,\n\n st->r_frame_rate.num},\n\n st->time_base);\n\n av_dlog(s, \"duration %\"PRId64\"\\n\", st->duration);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "b6d36def6d9e9fd187327182d0abafc9b7085d8f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n BDRVQcow2State *s = bs->opaque;\n+\n+ unsigned int nb_clusters;\n+\n+ int ret;\n+\n \n \n /* The zero flag is only supported by version 3 and newer */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qcow2_zero_clusters(BlockDriverState *bs, uint64_t offset, int nb_sectors)\n\n{\n\n BDRVQcow2State *s = bs->opaque;\n\n unsigned int nb_clusters;\n\n int ret;\n\n\n\n /* The zero flag is only supported by version 3 and newer */\n\n if (s->qcow_version < 3) {\n\n return -ENOTSUP;\n\n }\n\n\n\n /* Each L2 table is handled by its own loop iteration */\n\n nb_clusters = size_to_clusters(s, nb_sectors << BDRV_SECTOR_BITS);\n\n\n\n s->cache_discards = true;\n\n\n\n while (nb_clusters > 0) {\n\n ret = zero_single_l2(bs, offset, nb_clusters);\n\n if (ret < 0) {\n\n goto fail;\n\n }\n\n\n\n nb_clusters -= ret;\n\n offset += (ret * s->cluster_size);\n\n }\n\n\n\n ret = 0;\n\nfail:\n\n s->cache_discards = false;\n\n qcow2_process_discards(bs, ret);\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "ff1d2ac949dc94d8a0e71fd46939fb69c2ef075b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ mcf_fec_bd bd;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void mcf_fec_enable_rx(mcf_fec_state *s)\n\n{\n\n mcf_fec_bd bd;\n\n\n\n mcf_fec_read_bd(&bd, s->rx_descriptor);\n\n s->rx_enabled = ((bd.flags & FEC_BD_E) != 0);\n\n if (!s->rx_enabled)\n\n DPRINTF(\"RX buffer full\\n\");\n\n}\n"}} {"sample_id": "973e7170dddefb491a48df5cba33b2ae151013a0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void virtqueue_map_desc(unsigned int *p_num_sg, hwaddr *addr, struct iovec *iov,\n unsigned int max_num_sg, bool is_write,\n hwaddr pa, size_t sz)\n+{\n+ unsigned num_sg = *p_num_sg;\n+ assert(num_sg <= max_num_sg);\n+ if (!sz) {\n error_report(\"virtio: zero sized buffers are not allowed\");\n while (sz) {\n hwaddr len = sz;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void virtqueue_map_desc(unsigned int *p_num_sg, hwaddr *addr, struct iovec *iov,\n unsigned int max_num_sg, bool is_write,\n hwaddr pa, size_t sz)\n{\n unsigned num_sg = *p_num_sg;\n assert(num_sg <= max_num_sg);\n if (!sz) {\n error_report(\"virtio: zero sized buffers are not allowed\");\n while (sz) {\n hwaddr len = sz;\n if (num_sg == max_num_sg) {\n error_report(\"virtio: too many write descriptors in indirect table\");\n iov[num_sg].iov_base = cpu_physical_memory_map(pa, &len, is_write);\n iov[num_sg].iov_len = len;\n addr[num_sg] = pa;\n sz -= len;\n pa += len;\n num_sg++;\n *p_num_sg = num_sg;"}} {"sample_id": "a763d278274cfbda4e78e21b338b9b525fe22eab", "diff": "--- a/source.c\n+++ b/source.c\n@@ -48,8 +48,8 @@\n err = AVERROR(ENOMEM);\n \n \n+\n+\n+ return err;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int set_hwframe_ctx(AVCodecContext *ctx, AVBufferRef *hw_device_ctx)\n\n{\n\n AVBufferRef *hw_frames_ref;\n\n AVHWFramesContext *frames_ctx = NULL;\n\n int err = 0;\n\n\n\n if (!(hw_frames_ref = av_hwframe_ctx_alloc(hw_device_ctx))) {\n\n fprintf(stderr, \"Failed to create VAAPI frame context.\\n\");\n\n return -1;\n\n }\n\n frames_ctx = (AVHWFramesContext *)(hw_frames_ref->data);\n\n frames_ctx->format = AV_PIX_FMT_VAAPI;\n\n frames_ctx->sw_format = AV_PIX_FMT_NV12;\n\n frames_ctx->width = width;\n\n frames_ctx->height = height;\n\n frames_ctx->initial_pool_size = 20;\n\n if ((err = av_hwframe_ctx_init(hw_frames_ref)) < 0) {\n\n fprintf(stderr, \"Failed to initialize VAAPI frame context.\"\n\n \"Error code: %s\\n\",av_err2str(err));\n\n\n return err;\n\n }\n\n ctx->hw_frames_ctx = av_buffer_ref(hw_frames_ref);\n\n if (!ctx->hw_frames_ctx)\n\n err = AVERROR(ENOMEM);\n\n\n\n\n return err;\n\n}"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_41", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void xen_config_cleanup_dir(char *dir)\n+\n+{\n+\n struct xs_dirs *d;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void xen_config_cleanup_dir(char *dir)\n\n{\n\n struct xs_dirs *d;\n\n\n\n d = qemu_malloc(sizeof(*d));\n\n d->xs_dir = dir;\n\n TAILQ_INSERT_TAIL(&xs_cleanup, d, list);\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n * parameters as the flash devices on the Versatile Express board.\n \n */\n+\n+ DriveInfo *dinfo = drive_get_next(IF_PFLASH);\n+\n+ DeviceState *dev = qdev_create(NULL, \"cfi.pflash01\");\n+\n const uint64_t sectorlength = 256 * 1024;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void create_one_flash(const char *name, hwaddr flashbase,\n\n hwaddr flashsize)\n\n{\n\n /* Create and map a single flash device. We use the same\n\n * parameters as the flash devices on the Versatile Express board.\n\n */\n\n DriveInfo *dinfo = drive_get_next(IF_PFLASH);\n\n DeviceState *dev = qdev_create(NULL, \"cfi.pflash01\");\n\n const uint64_t sectorlength = 256 * 1024;\n\n\n\n if (dinfo && qdev_prop_set_drive(dev, \"drive\",\n\n blk_bs(blk_by_legacy_dinfo(dinfo)))) {\n\n abort();\n\n }\n\n\n\n qdev_prop_set_uint32(dev, \"num-blocks\", flashsize / sectorlength);\n\n qdev_prop_set_uint64(dev, \"sector-length\", sectorlength);\n\n qdev_prop_set_uint8(dev, \"width\", 4);\n\n qdev_prop_set_uint8(dev, \"device-width\", 2);\n\n qdev_prop_set_uint8(dev, \"big-endian\", 0);\n\n qdev_prop_set_uint16(dev, \"id0\", 0x89);\n\n qdev_prop_set_uint16(dev, \"id1\", 0x18);\n\n qdev_prop_set_uint16(dev, \"id2\", 0x00);\n\n qdev_prop_set_uint16(dev, \"id3\", 0x00);\n\n qdev_prop_set_string(dev, \"name\", name);\n\n qdev_init_nofail(dev);\n\n\n\n sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, flashbase);\n\n}\n"}} {"sample_id": "9a75b0a037e3a8030992244353f17b62f6daf2ab_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static uint64_t ahci_alloc(AHCIQState *ahci, size_t bytes)\n+\n {\n \n return qmalloc(ahci->parent, bytes);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static uint64_t ahci_alloc(AHCIQState *ahci, size_t bytes)\n\n{\n\n return qmalloc(ahci->parent, bytes);\n\n}\n"}} {"sample_id": "341f01290c2353669ed2263f56e1a9f4c67cc597", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n uint8_t bits[256];\n \n+ uint8_t syms[256];\n \n uint32_t code;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int huff_build(VLC *vlc, uint8_t *len)\n\n{\n\n HuffEntry he[256];\n\n uint32_t codes[256];\n\n uint8_t bits[256];\n\n uint8_t syms[256];\n\n uint32_t code;\n\n int i;\n\n\n\n for (i = 0; i < 256; i++) {\n\n he[i].sym = 255 - i;\n\n he[i].len = len[i];\n\n if (len[i] == 0)\n\n return AVERROR_INVALIDDATA;\n\n }\n\n AV_QSORT(he, 256, HuffEntry, huff_cmp_len);\n\n\n\n code = 1;\n\n for (i = 255; i >= 0; i--) {\n\n codes[i] = code >> (32 - he[i].len);\n\n bits[i] = he[i].len;\n\n syms[i] = he[i].sym;\n\n code += 0x80000000u >> (he[i].len - 1);\n\n }\n\n\n\n ff_free_vlc(vlc);\n\n return ff_init_vlc_sparse(vlc, FFMIN(he[255].len, 12), 256,\n\n bits, sizeof(*bits), sizeof(*bits),\n\n codes, sizeof(*codes), sizeof(*codes),\n\n syms, sizeof(*syms), sizeof(*syms), 0);\n\n}\n"}} {"sample_id": "9e92f6d46233171898fc7d0487a04e5b78e44234", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n if (!ga_is_frozen(s)) {\n+\n return;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "void ga_unset_frozen(GAState *s)\n\n{\n\n if (!ga_is_frozen(s)) {\n\n return;\n\n }\n\n\n\n /* if we delayed creation/opening of pid/log files due to being\n\n * in a frozen state at start up, do it now\n\n */\n\n if (s->deferred_options.log_filepath) {\n\n s->log_file = fopen(s->deferred_options.log_filepath, \"a\");\n\n if (!s->log_file) {\n\n s->log_file = stderr;\n\n }\n\n s->deferred_options.log_filepath = NULL;\n\n }\n\n ga_enable_logging(s);\n\n g_warning(\"logging re-enabled due to filesystem unfreeze\");\n\n if (s->deferred_options.pid_filepath) {\n\n if (!ga_open_pidfile(s->deferred_options.pid_filepath)) {\n\n g_warning(\"failed to create/open pid file\");\n\n }\n\n s->deferred_options.pid_filepath = NULL;\n\n }\n\n\n\n /* enable all disabled, non-blacklisted commands */\n\n ga_enable_non_blacklisted(s->blacklist);\n\n s->frozen = false;\n\n if (!ga_delete_file(s->state_filepath_isfrozen)) {\n\n g_warning(\"unable to delete %s, fsfreeze may not function properly\",\n\n s->state_filepath_isfrozen);\n\n }\n\n}\n"}} {"sample_id": "10ee2aaa417d8d8978cdb2bbed55ebb152df5f6b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,6 +8,6 @@\n \n dolog (\"U nam writel %#x <- %#x\\n\", addr, val);\n \n+ s->cas = 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void nam_writel (void *opaque, uint32_t addr, uint32_t val)\n\n{\n\n PCIAC97LinkState *d = opaque;\n\n AC97LinkState *s = &d->ac97;\n\n dolog (\"U nam writel %#x <- %#x\\n\", addr, val);\n\n s->cas = 0;\n\n}\n"}} {"sample_id": "6c01bf6c7ba7539460fcaeb99fbe1776ba137aa8_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n farg.ll = float_zero_divide_excp(fone.d, farg.d);\n \n } else if (likely(isnormal(farg.d))) {\n+\n+ farg.d = float64_div(fone.d, farg.d, &env->fp_status);\n+\n+ } else {\n+\n if (farg.ll == 0x8000000000000000ULL) {\n \n farg.ll = 0xFFF0000000000000ULL;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint64_t helper_fre (uint64_t arg)\n\n{\n\n CPU_DoubleU fone, farg;\n\n fone.ll = 0x3FF0000000000000ULL; /* 1.0 */\n\n farg.ll = arg;\n\n\n\n if (unlikely(float64_is_signaling_nan(farg.d))) {\n\n /* sNaN reciprocal */\n\n farg.ll = fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN);\n\n } else if (unlikely(float64_is_zero(farg.d))) {\n\n /* Zero reciprocal */\n\n farg.ll = float_zero_divide_excp(fone.d, farg.d);\n\n } else if (likely(isnormal(farg.d))) {\n\n farg.d = float64_div(fone.d, farg.d, &env->fp_status);\n\n } else {\n\n if (farg.ll == 0x8000000000000000ULL) {\n\n farg.ll = 0xFFF0000000000000ULL;\n\n } else if (farg.ll == 0x0000000000000000ULL) {\n\n farg.ll = 0x7FF0000000000000ULL;\n\n } else if (float64_is_nan(farg.d)) {\n\n farg.ll = 0x7FF8000000000000ULL;\n\n } else if (float64_is_neg(farg.d)) {\n\n farg.ll = 0x8000000000000000ULL;\n\n } else {\n\n farg.ll = 0x0000000000000000ULL;\n\n }\n\n }\n\n return farg.d;\n\n}\n"}} {"sample_id": "184bd0484533b725194fa517ddc271ffd74da7c9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static uint32_t virtio_net_bad_features(VirtIODevice *vdev)\n \n {\n+\n+ uint32_t features = 0;\n+\n+\n \n /* Linux kernel 2.6.25. It understood MAC (as everyone must),\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint32_t virtio_net_bad_features(VirtIODevice *vdev)\n\n{\n\n uint32_t features = 0;\n\n\n\n /* Linux kernel 2.6.25. It understood MAC (as everyone must),\n\n * but also these: */\n\n features |= (1 << VIRTIO_NET_F_MAC);\n\n features |= (1 << VIRTIO_NET_F_GUEST_CSUM);\n\n features |= (1 << VIRTIO_NET_F_GUEST_TSO4);\n\n features |= (1 << VIRTIO_NET_F_GUEST_TSO6);\n\n features |= (1 << VIRTIO_NET_F_GUEST_ECN);\n\n\n\n return features & virtio_net_get_features(vdev);\n\n}\n"}} {"sample_id": "67a0fd2a9bca204d2b39f910a97c7137636a0715_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n int64_t sector_num,\n \n int nb_sectors, int *pnum)\n+\n+{\n+\n *pnum = nb_sectors;\n \n return BDRV_BLOCK_RAW | BDRV_BLOCK_OFFSET_VALID | BDRV_BLOCK_DATA |", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int64_t coroutine_fn raw_co_get_block_status(BlockDriverState *bs,\n\n int64_t sector_num,\n\n int nb_sectors, int *pnum)\n\n{\n\n *pnum = nb_sectors;\n\n return BDRV_BLOCK_RAW | BDRV_BLOCK_OFFSET_VALID | BDRV_BLOCK_DATA |\n\n (sector_num << BDRV_SECTOR_BITS);\n\n}\n"}} {"sample_id": "81174dae3f9189519cd60c7b79e91c291b021bbe", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static int tty_serial_ioctl(CharDriverState *chr, int cmd, void *arg)\n+\n+\n+ FDCharDriver *s = chr->opaque;\n+\n \n \n switch(cmd) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int tty_serial_ioctl(CharDriverState *chr, int cmd, void *arg)\n\n\n FDCharDriver *s = chr->opaque;\n\n\n\n switch(cmd) {\n\n case CHR_IOCTL_SERIAL_SET_PARAMS:\n\n\n QEMUSerialSetParams *ssp = arg;\n\n tty_serial_init(s->fd_in, ssp->speed, ssp->parity,\n\n ssp->data_bits, ssp->stop_bits);\n\n\n\n case CHR_IOCTL_SERIAL_SET_BREAK:\n\n\n int enable = *(int *)arg;\n\n if (enable)\n\n tcsendbreak(s->fd_in, 1);\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n default:\n\n return -ENOTSUP;\n\n\n return 0;\n"}} {"sample_id": "4871b51b9241b10f4fd8e04bbb21577886795e25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ QemuUUID expected, measured;\n \n gchar *cmd;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void vmgenid_set_guid_test(void)\n\n{\n\n QemuUUID expected, measured;\n\n gchar *cmd;\n\n\n\n g_assert(qemu_uuid_parse(VGID_GUID, &expected) == 0);\n\n\n\n cmd = g_strdup_printf(\"-machine accel=tcg -device vmgenid,id=testvgid,\"\n\n \"guid=%s\", VGID_GUID);\n\n qtest_start(cmd);\n\n\n\n /* Read the GUID from accessing guest memory */\n\n read_guid_from_memory(&measured);\n\n g_assert(memcmp(measured.data, expected.data, sizeof(measured.data)) == 0);\n\n\n\n qtest_quit(global_qtest);\n\n g_free(cmd);\n\n}\n"}} {"sample_id": "82a41186941c419afde977f477f19c545b40c1c5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,7 +12,7 @@\n \n \n \n+ visit_type_int64(v, name, &value, &local_err);\n \n if (local_err) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void iothread_set_poll_max_ns(Object *obj, Visitor *v,\n\n const char *name, void *opaque, Error **errp)\n\n{\n\n IOThread *iothread = IOTHREAD(obj);\n\n Error *local_err = NULL;\n\n int64_t value;\n\n\n\n visit_type_int64(v, name, &value, &local_err);\n\n if (local_err) {\n\n goto out;\n\n }\n\n\n\n if (value < 0) {\n\n error_setg(&local_err, \"poll_max_ns value must be in range \"\n\n \"[0, %\"PRId64\"]\", INT64_MAX);\n\n goto out;\n\n }\n\n\n\n iothread->poll_max_ns = value;\n\n\n\n if (iothread->ctx) {\n\n aio_context_set_poll_params(iothread->ctx, value, &local_err);\n\n }\n\n\n\nout:\n\n error_propagate(errp, local_err);\n\n}\n"}} {"sample_id": "d23727e0420b9f77f0d4cb28b43819b402f702e5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n int scale = AV_RB16(in);\n \n int i;\n+\n int s0, s1, s2, d;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int adx_decode(ADXContext *c, int16_t *out, int offset,\n\n const uint8_t *in, int ch)\n\n{\n\n ADXChannelState *prev = &c->prev[ch];\n\n GetBitContext gb;\n\n int scale = AV_RB16(in);\n\n int i;\n\n int s0, s1, s2, d;\n\n\n\n /* check if this is an EOF packet */\n\n if (scale & 0x8000)\n\n return -1;\n\n\n\n init_get_bits(&gb, in + 2, (BLOCK_SIZE - 2) * 8);\n\n out += offset;\n\n s1 = prev->s1;\n\n s2 = prev->s2;\n\n for (i = 0; i < BLOCK_SAMPLES; i++) {\n\n d = get_sbits(&gb, 4);\n\n s0 = ((d << COEFF_BITS) * scale + c->coeff[0] * s1 + c->coeff[1] * s2) >> COEFF_BITS;\n\n s2 = s1;\n\n s1 = av_clip_int16(s0);\n\n *out++ = s1;\n\n }\n\n prev->s1 = s1;\n\n prev->s2 = s2;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "8be7e7e4c72c048b90e3482557954a24bba43ba7_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,12 +16,12 @@\n \n assert(!permit_abbrev || list->implied_opt_name);\n \n+ firstname = permit_abbrev ? list->implied_opt_name : NULL;\n \n \n+\n if (strncmp(params, \"id=\", 3) == 0) {\n+\n get_opt_value(value, sizeof(value), params+3);\n \n id = value;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static QemuOpts *opts_parse(QemuOptsList *list, const char *params,\n\n int permit_abbrev, bool defaults)\n\n{\n\n const char *firstname;\n\n char value[1024], *id = NULL;\n\n const char *p;\n\n QemuOpts *opts;\n\n\n\n assert(!permit_abbrev || list->implied_opt_name);\n\n firstname = permit_abbrev ? list->implied_opt_name : NULL;\n\n\n\n if (strncmp(params, \"id=\", 3) == 0) {\n\n get_opt_value(value, sizeof(value), params+3);\n\n id = value;\n\n } else if ((p = strstr(params, \",id=\")) != NULL) {\n\n get_opt_value(value, sizeof(value), p+4);\n\n id = value;\n\n }\n\n if (defaults) {\n\n if (!id && !QTAILQ_EMPTY(&list->head)) {\n\n opts = qemu_opts_find(list, NULL);\n\n } else {\n\n opts = qemu_opts_create(list, id, 0);\n\n }\n\n } else {\n\n opts = qemu_opts_create(list, id, 1);\n\n }\n\n if (opts == NULL)\n\n return NULL;\n\n\n\n if (opts_do_parse(opts, params, firstname, defaults) != 0) {\n\n qemu_opts_del(opts);\n\n return NULL;\n\n }\n\n\n\n return opts;\n\n}\n"}} {"sample_id": "428098165de4c3edfe42c1b7f00627d287015863_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,27 +1,27 @@\n void yuv2rgb_altivec_init_tables (SwsContext *c, const int inv_table[4],int brightness,int contrast, int saturation)\n+\n+{\n+\n+ union {\n \n \tsigned short tmp[8] __attribute__ ((aligned(16)));\n \n \tvector signed short vec;\n \n \t} buf;\n+\n+\n+\n+ buf.tmp[0] = ( (0xffffLL) * contrast>>8 )>>9;\t\t\t//cy\n+\n+ buf.tmp[1] = -256*brightness;\t\t\t\t\t//oy\n+\n buf.tmp[2] = (inv_table[0]>>3) *(contrast>>16)*(saturation>>16);\t//crv\n+\n+ buf.tmp[3] = (inv_table[1]>>3) *(contrast>>16)*(saturation>>16);\t//cbu\n+\n+ buf.tmp[4] = -((inv_table[2]>>1)*(contrast>>16)*(saturation>>16));\t//cgu\n+\n buf.tmp[5] = -((inv_table[3]>>1)*(contrast>>16)*(saturation>>16));\t//cgv\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-89", "target_file": "source.c", "files": {"source.c": "void yuv2rgb_altivec_init_tables (SwsContext *c, const int inv_table[4],int brightness,int contrast, int saturation)\n\n{\n\n union {\n\n \tsigned short tmp[8] __attribute__ ((aligned(16)));\n\n\tvector signed short vec;\n\n\t} buf;\n\n\n\n buf.tmp[0] = ( (0xffffLL) * contrast>>8 )>>9;\t\t\t//cy\n\n buf.tmp[1] = -256*brightness;\t\t\t\t\t//oy\n\n buf.tmp[2] = (inv_table[0]>>3) *(contrast>>16)*(saturation>>16);\t//crv\n\n buf.tmp[3] = (inv_table[1]>>3) *(contrast>>16)*(saturation>>16);\t//cbu\n\n buf.tmp[4] = -((inv_table[2]>>1)*(contrast>>16)*(saturation>>16));\t//cgu\n\n buf.tmp[5] = -((inv_table[3]>>1)*(contrast>>16)*(saturation>>16));\t//cgv\n\n\n\n\n\n c->CSHIFT = (vector unsigned short)vec_splat_u16(2);\n\n c->CY = vec_splat ((vector signed short)buf.vec, 0);\n\n c->OY = vec_splat ((vector signed short)buf.vec, 1);\n\n c->CRV = vec_splat ((vector signed short)buf.vec, 2);\n\n c->CBU = vec_splat ((vector signed short)buf.vec, 3);\n\n c->CGU = vec_splat ((vector signed short)buf.vec, 4);\n\n c->CGV = vec_splat ((vector signed short)buf.vec, 5);\n\n#if 0\n\n{\n\nint i;\n\nchar *v[6]={\"cy\",\"oy\",\"crv\",\"cbu\",\"cgu\",\"cgv\"};\n\nfor (i=0; i<6;i++)\n\n printf(\"%s %d \", v[i],buf.tmp[i] );\n\n printf(\"\\n\");\n\n}\n\n#endif\n\n return;\n\n}\n"}} {"sample_id": "d87aa138039a4be6d705793fd3e397c69c52405a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n int network_header_length = ppkt->ip->ip_hl * 4;\n \n+\n \n trace_colo_compare_main(\"compare icmp\");\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int colo_packet_compare_icmp(Packet *spkt, Packet *ppkt)\n\n{\n\n int network_header_length = ppkt->ip->ip_hl * 4;\n\n\n\n trace_colo_compare_main(\"compare icmp\");\n\n\n\n /*\n\n * Because of ppkt and spkt are both in the same connection,\n\n * The ppkt's src ip, dst ip, src port, dst port, ip_proto all are\n\n * same with spkt. In addition, IP header's Identification is a random\n\n * field, we can handle it in IP fragmentation function later.\n\n * COLO just concern the response net packet payload from primary guest\n\n * and secondary guest are same or not, So we ignored all IP header include\n\n * other field like TOS,TTL,IP Checksum. we only need to compare\n\n * the ip payload here.\n\n */\n\n if (colo_packet_compare_common(ppkt, spkt,\n\n network_header_length + ETH_HLEN)) {\n\n trace_colo_compare_icmp_miscompare(\"primary pkt size\",\n\n ppkt->size);\n\n trace_colo_compare_icmp_miscompare(\"Secondary pkt size\",\n\n spkt->size);\n\n if (trace_event_get_state(TRACE_COLO_COMPARE_MISCOMPARE)) {\n\n qemu_hexdump((char *)ppkt->data, stderr, \"colo-compare pri pkt\",\n\n ppkt->size);\n\n qemu_hexdump((char *)spkt->data, stderr, \"colo-compare sec pkt\",\n\n spkt->size);\n\n }\n\n return -1;\n\n } else {\n\n return 0;\n\n }\n\n}\n"}} {"sample_id": "f8b6cc0070aab8b75bd082582c829be1353f395f_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,8 +8,8 @@\n \n if (*ptr) {\n \n+ blockdev_auto_del((*ptr)->bdrv);\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void free_drive(DeviceState *dev, Property *prop)\n\n{\n\n DriveInfo **ptr = qdev_get_prop_ptr(dev, prop);\n\n\n\n if (*ptr) {\n\n blockdev_auto_del((*ptr)->bdrv);\n\n }\n\n}\n"}} {"sample_id": "364031f17932814484657e5551ba12957d993d7e_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void v9fs_synth_rewinddir(FsContext *ctx, V9fsFidOpenState *fs)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void v9fs_synth_rewinddir(FsContext *ctx, V9fsFidOpenState *fs)\n\n{\n\n v9fs_synth_seekdir(ctx, fs, 0);\n\n}\n"}} {"sample_id": "e3faad811e429002d549562db4e0fc30c08dc6a4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n for (i = 0; i < order; i++) {\n \n+ idx[i] = ceilf(asin(coef[i])*((coef[i] >= 0) ? iqfac_p : iqfac_m));\n+\n+ u_coef = (idx[i])&(~(~0<= 0) ? iqfac_p : iqfac_m));\n\n u_coef = (idx[i])&(~(~0<size);\n+\n+ bus->info = info;\n+\n bus->parent = parent;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "BusState *qbus_create(BusInfo *info, DeviceState *parent, const char *name)\n\n{\n\n BusState *bus;\n\n char *buf;\n\n int i,len;\n\n\n\n bus = qemu_mallocz(info->size);\n\n bus->info = info;\n\n bus->parent = parent;\n\n\n\n if (name) {\n\n /* use supplied name */\n\n bus->name = qemu_strdup(name);\n\n } else if (parent && parent->id) {\n\n /* parent device has id -> use it for bus name */\n\n len = strlen(parent->id) + 16;\n\n buf = qemu_malloc(len);\n\n snprintf(buf, len, \"%s.%d\", parent->id, parent->num_child_bus);\n\n bus->name = buf;\n\n } else {\n\n /* no id -> use lowercase bus type for bus name */\n\n len = strlen(info->name) + 16;\n\n buf = qemu_malloc(len);\n\n len = snprintf(buf, len, \"%s.%d\", info->name,\n\n parent ? parent->num_child_bus : 0);\n\n for (i = 0; i < len; i++)\n\n buf[i] = qemu_tolower(buf[i]);\n\n bus->name = buf;\n\n }\n\n\n\n LIST_INIT(&bus->children);\n\n if (parent) {\n\n LIST_INSERT_HEAD(&parent->child_bus, bus, sibling);\n\n parent->num_child_bus++;\n\n }\n\n return bus;\n\n}\n"}} {"sample_id": "32bafa8fdd098d52fbf1102d5a5e48d29398c0aa_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n for (info = info_list; info; info = info->next) {\n \n+ MemoryDeviceInfo *value = info->value;\n+\n+\n+\n+ if (value) {\n \n switch (value->type) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void numa_stat_memory_devices(uint64_t node_mem[])\n\n{\n\n MemoryDeviceInfoList *info_list = NULL;\n\n MemoryDeviceInfoList **prev = &info_list;\n\n MemoryDeviceInfoList *info;\n\n\n\n qmp_pc_dimm_device_list(qdev_get_machine(), &prev);\n\n for (info = info_list; info; info = info->next) {\n\n MemoryDeviceInfo *value = info->value;\n\n\n\n if (value) {\n\n switch (value->type) {\n\n case MEMORY_DEVICE_INFO_KIND_DIMM:\n\n node_mem[value->u.dimm->node] += value->u.dimm->size;\n\n break;\n\n default:\n\n break;\n\n }\n\n }\n\n }\n\n qapi_free_MemoryDeviceInfoList(info_list);\n\n}\n"}} {"sample_id": "5e53486545726987ab4482321d4dcf7e23e7652f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,10 +9,10 @@\n if (inited != 0)\n \n return;\n+\n+ inited = 1;\n+\n+\n \n dsputil_static_init();\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void avcodec_init(void)\n\n{\n\n static int inited = 0;\n\n\n\n if (inited != 0)\n\n return;\n\n inited = 1;\n\n\n\n dsputil_static_init();\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_67", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n {\n \n TCGv tmp = tcg_temp_new(TCG_TYPE_I32);\n+\n+ tcg_gen_qemu_ld32u(tmp, t1, flags);\n+\n tcg_gen_helper_1_1(helper_memory_to_f, t0, tmp);\n \n tcg_temp_free(tmp);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static always_inline void gen_qemu_ldf (TCGv t0, TCGv t1, int flags)\n\n{\n\n TCGv tmp = tcg_temp_new(TCG_TYPE_I32);\n\n tcg_gen_qemu_ld32u(tmp, t1, flags);\n\n tcg_gen_helper_1_1(helper_memory_to_f, t0, tmp);\n\n tcg_temp_free(tmp);\n\n}\n"}} {"sample_id": "7faa8075d898ae56d2c533c530569bb25ab86eaf_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void enable_device(PIIX4PMState *s, int slot)\n \n+{\n \n s->ar.gpe.sts[0] |= PIIX4_PCI_HOTPLUG_STATUS;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void enable_device(PIIX4PMState *s, int slot)\n\n{\n\n s->ar.gpe.sts[0] |= PIIX4_PCI_HOTPLUG_STATUS;\n\n s->pci0_status.up |= (1 << slot);\n\n}\n"}} {"sample_id": "a3fa1d78cbae2259491b17689812edcb643a3b30", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n return;\n \n+\n+\n+ DPRINTF(\"cancelling migration\\n\");\n+\n+\n \n s->state = MIG_STATE_CANCELLED;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void migrate_fd_cancel(MigrationState *s)\n\n{\n\n if (s->state != MIG_STATE_ACTIVE)\n\n return;\n\n\n\n DPRINTF(\"cancelling migration\\n\");\n\n\n\n s->state = MIG_STATE_CANCELLED;\n\n notifier_list_notify(&migration_state_notifiers, s);\n\n\n\n migrate_fd_cleanup(s);\n\n}\n"}} {"sample_id": "db39fcf1f690b02d612e2bfc00980700887abe03_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n }\n \n+\n+\n+ d->prod = 0;\n+\n+ d->cons = 0;\n \n d->cbuf = g_malloc0(d->size);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static CharDriverState *qemu_chr_open_ringbuf(ChardevRingbuf *opts,\n\n Error **errp)\n\n{\n\n CharDriverState *chr;\n\n RingBufCharDriver *d;\n\n\n\n chr = g_malloc0(sizeof(CharDriverState));\n\n d = g_malloc(sizeof(*d));\n\n\n\n d->size = opts->has_size ? opts->size : 65536;\n\n\n\n /* The size must be power of 2 */\n\n if (d->size & (d->size - 1)) {\n\n error_setg(errp, \"size of ringbuf chardev must be power of two\");\n\n goto fail;\n\n }\n\n\n\n d->prod = 0;\n\n d->cons = 0;\n\n d->cbuf = g_malloc0(d->size);\n\n\n\n chr->opaque = d;\n\n chr->chr_write = ringbuf_chr_write;\n\n chr->chr_close = ringbuf_chr_close;\n\n\n\n return chr;\n\n\n\nfail:\n\n g_free(d);\n\n g_free(chr);\n\n return NULL;\n\n}\n"}} {"sample_id": "b308c82cbda44e138ef990af64d44a5613c16092_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static void pci_bridge_region_init(PCIBridge *br)\n \n {\n+\n+ PCIBus *parent = br->dev.bus;\n+\n uint16_t cmd = pci_get_word(br->dev.config + PCI_COMMAND);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void pci_bridge_region_init(PCIBridge *br)\n\n{\n\n PCIBus *parent = br->dev.bus;\n\n uint16_t cmd = pci_get_word(br->dev.config + PCI_COMMAND);\n\n\n\n pci_bridge_init_alias(br, &br->alias_pref_mem,\n\n PCI_BASE_ADDRESS_MEM_PREFETCH,\n\n \"pci_bridge_pref_mem\",\n\n &br->address_space_mem,\n\n parent->address_space_mem,\n\n cmd & PCI_COMMAND_MEMORY);\n\n pci_bridge_init_alias(br, &br->alias_mem,\n\n PCI_BASE_ADDRESS_SPACE_MEMORY,\n\n \"pci_bridge_mem\",\n\n &br->address_space_mem,\n\n parent->address_space_mem,\n\n cmd & PCI_COMMAND_MEMORY);\n\n pci_bridge_init_alias(br, &br->alias_io,\n\n PCI_BASE_ADDRESS_SPACE_IO,\n\n \"pci_bridge_io\",\n\n &br->address_space_io,\n\n parent->address_space_io,\n\n cmd & PCI_COMMAND_IO);\n\n /* TODO: optinal VGA and VGA palette snooping support. */\n\n}\n"}} {"sample_id": "7f526efd17973ec6d2204f7a47b6923e2be31363_15", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static inline void RENAME(yvu9toyv12)(const uint8_t *ysrc, const uint8_t *usrc, const uint8_t *vsrc,\n \n \tuint8_t *ydst, uint8_t *udst, uint8_t *vdst,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static inline void RENAME(yvu9toyv12)(const uint8_t *ysrc, const uint8_t *usrc, const uint8_t *vsrc,\n\n\tuint8_t *ydst, uint8_t *udst, uint8_t *vdst,\n\n\tunsigned int width, unsigned int height, int lumStride, int chromStride)\n\n{\n\n\t/* Y Plane */\n\n\tmemcpy(ydst, ysrc, width*height);\n\n\n\n\t/* XXX: implement upscaling for U,V */\n\n}\n"}} {"sample_id": "70df51112ccc8d281cdb96141f20b3fd8a5b11f8_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void cqueue_free(cqueue *q)\n+\n {\n \n av_free(q->elements);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void cqueue_free(cqueue *q)\n\n{\n\n av_free(q->elements);\n\n av_free(q);\n\n}\n"}} {"sample_id": "2d0b4bc4cf92dd961dbafbff3f1f4a9e08a9565b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n if(s->mb_y >= s->mb_height)\n \n return 1;\n+\n+ if(!s->mb_num_left)\n+\n+ return 1;\n+\n if(r->s.mb_skip_run > 1)\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int check_slice_end(RV34DecContext *r, MpegEncContext *s)\n\n{\n\n int bits;\n\n if(s->mb_y >= s->mb_height)\n\n return 1;\n\n if(!s->mb_num_left)\n\n return 1;\n\n if(r->s.mb_skip_run > 1)\n\n return 0;\n\n bits = get_bits_left(&s->gb);\n\n if(bits < 0 || (bits < 8 && !show_bits(&s->gb, bits)))\n\n return 1;\n\n return 0;\n\n}\n"}} {"sample_id": "70a0c19e83aa4c71c879d51e426e89e4b3d4e014", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static bool kvmppc_is_pr(KVMState *ks)\n+\n+{\n \n /* Assume KVM-PR if the GET_PVINFO capability is available */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool kvmppc_is_pr(KVMState *ks)\n\n{\n\n /* Assume KVM-PR if the GET_PVINFO capability is available */\n\n return kvm_check_extension(ks, KVM_CAP_PPC_GET_PVINFO) != 0;\n\n}\n"}} {"sample_id": "315b0f974252120cfacb0346954a2d817dff279a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n b_frames = atoi(arg);\n \n if (b_frames > FF_MAX_B_FRAMES) {\n+\n+ fprintf(stderr, \"\\nCannot have more than %d B frames, increase FF_MAX_B_FRAMES.\\n\", FF_MAX_B_FRAMES);\n+\n+ exit(1);\n+\n } else if (b_frames < 1) {\n \n fprintf(stderr, \"\\nNumber of B frames must be higher than 0\\n\");", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void opt_b_frames(const char *arg)\n\n{\n\n b_frames = atoi(arg);\n\n if (b_frames > FF_MAX_B_FRAMES) {\n\n fprintf(stderr, \"\\nCannot have more than %d B frames, increase FF_MAX_B_FRAMES.\\n\", FF_MAX_B_FRAMES);\n\n exit(1);\n\n } else if (b_frames < 1) {\n\n fprintf(stderr, \"\\nNumber of B frames must be higher than 0\\n\");\n\n exit(1);\n\n }\n\n}\n"}} {"sample_id": "5d7fd045cafeac1831c1999cb9e1251b7906c6b2_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+uint32_t HELPER(lpxbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)\n+\n+{\n+\n+ CPU_QuadU v1;\n \n CPU_QuadU v2;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint32_t HELPER(lpxbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)\n\n{\n\n CPU_QuadU v1;\n\n CPU_QuadU v2;\n\n\n\n v2.ll.upper = env->fregs[f2].ll;\n\n v2.ll.lower = env->fregs[f2 + 2].ll;\n\n v1.q = float128_abs(v2.q);\n\n env->fregs[f1].ll = v1.ll.upper;\n\n env->fregs[f1 + 2].ll = v1.ll.lower;\n\n return set_cc_nz_f128(v1.q);\n\n}\n"}} {"sample_id": "2d3735d3bf61d5c8e154a197a11535cc65044334", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n qerror_report(QERR_DEVICE_NOT_FOUND, device);\n \n return;\n+\n+ }\n+\n+ bdrv_commit(bs);\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void do_commit(Monitor *mon, const QDict *qdict)\n\n{\n\n const char *device = qdict_get_str(qdict, \"device\");\n\n BlockDriverState *bs;\n\n\n\n if (!strcmp(device, \"all\")) {\n\n bdrv_commit_all();\n\n } else {\n\n bs = bdrv_find(device);\n\n if (!bs) {\n\n qerror_report(QERR_DEVICE_NOT_FOUND, device);\n\n return;\n\n }\n\n bdrv_commit(bs);\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_128", "diff": "--- a/source.c\n+++ b/source.c\n@@ -69,11 +69,11 @@\n }\n \n DPRINTF(\"read: %08x = %08x\\n\", s->ioregsel, val);\n+\n+ break;\n+\n+ }\n+\n return val;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "ioapic_mem_read(void *opaque, target_phys_addr_t addr, unsigned int size)\n\n{\n\n IOAPICCommonState *s = opaque;\n\n int index;\n\n uint32_t val = 0;\n\n\n\n switch (addr & 0xff) {\n\n case IOAPIC_IOREGSEL:\n\n val = s->ioregsel;\n\n break;\n\n case IOAPIC_IOWIN:\n\n if (size != 4) {\n\n break;\n\n }\n\n switch (s->ioregsel) {\n\n case IOAPIC_REG_ID:\n\n val = s->id << IOAPIC_ID_SHIFT;\n\n break;\n\n case IOAPIC_REG_VER:\n\n val = IOAPIC_VERSION |\n\n ((IOAPIC_NUM_PINS - 1) << IOAPIC_VER_ENTRIES_SHIFT);\n\n break;\n\n case IOAPIC_REG_ARB:\n\n val = 0;\n\n break;\n\n default:\n\n index = (s->ioregsel - IOAPIC_REG_REDTBL_BASE) >> 1;\n\n if (index >= 0 && index < IOAPIC_NUM_PINS) {\n\n if (s->ioregsel & 1) {\n\n val = s->ioredtbl[index] >> 32;\n\n } else {\n\n val = s->ioredtbl[index] & 0xffffffff;\n\n }\n\n }\n\n }\n\n DPRINTF(\"read: %08x = %08x\\n\", s->ioregsel, val);\n\n break;\n\n }\n\n return val;\n\n}\n"}} {"sample_id": "d4261662b67b48e52f747ee1e3c31cf873c5c982", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n target_ulong opcode, target_ulong *args)\n \n {\n+\n+ target_ulong liobn = args[0];\n+\n target_ulong ioba = args[1];\n \n target_ulong tce = args[2];", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static target_ulong h_put_tce(PowerPCCPU *cpu, sPAPREnvironment *spapr,\n\n target_ulong opcode, target_ulong *args)\n\n{\n\n target_ulong liobn = args[0];\n\n target_ulong ioba = args[1];\n\n target_ulong tce = args[2];\n\n sPAPRTCETable *tcet = spapr_tce_find_by_liobn(liobn);\n\n\n\n if (liobn & 0xFFFFFFFF00000000ULL) {\n\n hcall_dprintf(\"spapr_vio_put_tce on out-of-boundsw LIOBN \"\n\n TARGET_FMT_lx \"\\n\", liobn);\n\n return H_PARAMETER;\n\n }\n\n\n\n ioba &= ~(SPAPR_TCE_PAGE_SIZE - 1);\n\n\n\n if (tcet) {\n\n return put_tce_emu(tcet, ioba, tce);\n\n }\n\n#ifdef DEBUG_TCE\n\n fprintf(stderr, \"%s on liobn=\" TARGET_FMT_lx /*%s*/\n\n \" ioba 0x\" TARGET_FMT_lx \" TCE 0x\" TARGET_FMT_lx \"\\n\",\n\n __func__, liobn, /*dev->qdev.id, */ioba, tce);\n\n#endif\n\n\n\n return H_PARAMETER;\n\n}\n"}} {"sample_id": "42a268c241183877192c376d03bd9b6d527407c7_44", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n int over = gen_new_label();\n \n tcg_out_jxx(s, tcg_cond_to_jcc[tcg_invert_cond(cond)], over, 1);\n+\n+ tcg_out_mov(s, TCG_TYPE_I32, dest, v1);\n+\n+ tcg_out_label(s, over, s->code_ptr);\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void tcg_out_movcond32(TCGContext *s, TCGCond cond, TCGArg dest,\n\n TCGArg c1, TCGArg c2, int const_c2,\n\n TCGArg v1)\n\n{\n\n tcg_out_cmp(s, c1, c2, const_c2, 0);\n\n if (have_cmov) {\n\n tcg_out_modrm(s, OPC_CMOVCC | tcg_cond_to_jcc[cond], dest, v1);\n\n } else {\n\n int over = gen_new_label();\n\n tcg_out_jxx(s, tcg_cond_to_jcc[tcg_invert_cond(cond)], over, 1);\n\n tcg_out_mov(s, TCG_TYPE_I32, dest, v1);\n\n tcg_out_label(s, over, s->code_ptr);\n\n }\n\n}\n"}} {"sample_id": "d58f574bf39796ed2396dfd1e308352fbb03f944", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void migrate_finish_set_state(MigrationState *s, int new_state)\n+\n {\n \n if (atomic_cmpxchg(&s->state, MIG_STATE_ACTIVE, new_state) == new_state) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void migrate_finish_set_state(MigrationState *s, int new_state)\n\n{\n\n if (atomic_cmpxchg(&s->state, MIG_STATE_ACTIVE, new_state) == new_state) {\n\n trace_migrate_set_state(new_state);\n\n }\n\n}\n"}} {"sample_id": "c661cb6672af5ebcb900ec8766b24761bd2ab011", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n while (g->name)\n \n g++;\n+\n+ octx->nb_groups = g - groups;\n+\n+ octx->groups = av_mallocz(sizeof(*octx->groups) * octx->nb_groups);\n+\n if (!octx->groups)\n \n exit(1);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void init_parse_context(OptionParseContext *octx,\n\n const OptionGroupDef *groups)\n\n{\n\n static const OptionGroupDef global_group = { \"global\" };\n\n const OptionGroupDef *g = groups;\n\n int i;\n\n\n\n memset(octx, 0, sizeof(*octx));\n\n\n\n while (g->name)\n\n g++;\n\n octx->nb_groups = g - groups;\n\n octx->groups = av_mallocz(sizeof(*octx->groups) * octx->nb_groups);\n\n if (!octx->groups)\n\n exit(1);\n\n\n\n for (i = 0; i < octx->nb_groups; i++)\n\n octx->groups[i].group_def = &groups[i];\n\n\n\n octx->global_opts.group_def = &global_group;\n\n octx->global_opts.arg = \"\";\n\n\n\n init_opts();\n\n}\n"}} {"sample_id": "1c59eb39cf75e660b1ac4ea95ef789c84021a1c4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void cpu_exec_exit(CPUState *cpu)\n+\n+{\n+\n+ if (cpu->cpu_index == -1) {\n \n /* cpu_index was never allocated by this @cpu or was already freed. */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void cpu_exec_exit(CPUState *cpu)\n\n{\n\n if (cpu->cpu_index == -1) {\n\n /* cpu_index was never allocated by this @cpu or was already freed. */\n\n return;\n\n }\n\n\n\n bitmap_clear(cpu_index_map, cpu->cpu_index, 1);\n\n cpu->cpu_index = -1;\n\n}\n"}} {"sample_id": "45b00c44ceffeac8143fb8857a12677234114f2b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n \n \n+ while ((c = getopt(argc, argv,\n \n \"h\" /* help */\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "ivshmem_client_parse_args(IvshmemClientArgs *args, int argc, char *argv[])\n\n{\n\n int c;\n\n\n\n while ((c = getopt(argc, argv,\n\n \"h\" /* help */\n\n \"v\" /* verbose */\n\n \"S:\" /* unix_sock_path */\n\n )) != -1) {\n\n\n\n switch (c) {\n\n case 'h': /* help */\n\n ivshmem_client_usage(argv[0], 0);\n\n break;\n\n\n\n case 'v': /* verbose */\n\n args->verbose = 1;\n\n break;\n\n\n\n case 'S': /* unix_sock_path */\n\n args->unix_sock_path = strdup(optarg);\n\n break;\n\n\n\n default:\n\n ivshmem_client_usage(argv[0], 1);\n\n break;\n\n }\n\n }\n\n}\n"}} {"sample_id": "c489780203f9b22aca5539ec7589b7140bdc951f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n QObject *qobj = qmp_input_get_object(qiv, name, true);\n if (qobject_type(qobj) != QTYPE_QNULL) {\n error_setg(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : \"null\",\n+ \"null\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void qmp_input_type_null(Visitor *v, const char *name, Error **errp)\n{\n QmpInputVisitor *qiv = to_qiv(v);\n QObject *qobj = qmp_input_get_object(qiv, name, true);\n if (qobject_type(qobj) != QTYPE_QNULL) {\n error_setg(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : \"null\",\n \"null\");"}} {"sample_id": "6546d0dba6c211c1a3eac1252a4f50a0c151a08a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static bool object_create_initial(const char *type)\n {\n+ if (g_str_equal(type, \"rng-egd\")) {\n+ /*\n * return false for concrete netfilters since\n * they depend on netdevs already existing\n if (g_str_equal(type, \"filter-buffer\") ||", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static bool object_create_initial(const char *type)\n{\n if (g_str_equal(type, \"rng-egd\")) {\n /*\n * return false for concrete netfilters since\n * they depend on netdevs already existing\n if (g_str_equal(type, \"filter-buffer\") ||\n g_str_equal(type, \"filter-dump\") ||\n g_str_equal(type, \"filter-mirror\") ||\n g_str_equal(type, \"filter-redirector\")) {\n return true;"}} {"sample_id": "d07cc1f12d8e15c167857852c39190d770763824_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n kroute.flags = 0;\n \n+ kroute.u.msi.address_lo = (uint32_t)msg.address;\n+\n+ kroute.u.msi.address_hi = msg.address >> 32;\n+\n+ kroute.u.msi.data = msg.data;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int kvm_irqchip_update_msi_route(KVMState *s, int virq, MSIMessage msg)\n\n{\n\n struct kvm_irq_routing_entry kroute;\n\n\n\n if (!kvm_irqchip_in_kernel()) {\n\n return -ENOSYS;\n\n }\n\n\n\n kroute.gsi = virq;\n\n kroute.type = KVM_IRQ_ROUTING_MSI;\n\n kroute.flags = 0;\n\n kroute.u.msi.address_lo = (uint32_t)msg.address;\n\n kroute.u.msi.address_hi = msg.address >> 32;\n\n kroute.u.msi.data = msg.data;\n\n\n\n return kvm_update_routing_entry(s, &kroute);\n\n}\n"}} {"sample_id": "a37fd7f9578d2dfbe20a109aae91e5f0a4b58874", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int bgr24ToYv12Wrapper(SwsContext *c, const uint8_t *src[],\n+\n int srcStride[], int srcSliceY, int srcSliceH,\n \n uint8_t *dst[], int dstStride[])", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int bgr24ToYv12Wrapper(SwsContext *c, const uint8_t *src[],\n\n int srcStride[], int srcSliceY, int srcSliceH,\n\n uint8_t *dst[], int dstStride[])\n\n{\n\n rgb24toyv12(\n\n src[0],\n\n dst[0] + srcSliceY * dstStride[0],\n\n dst[1] + (srcSliceY >> 1) * dstStride[1],\n\n dst[2] + (srcSliceY >> 1) * dstStride[2],\n\n c->srcW, srcSliceH,\n\n dstStride[0], dstStride[1], srcStride[0]);\n\n if (dst[3])\n\n fillPlane(dst[3], dstStride[3], c->srcW, srcSliceH, srcSliceY, 255);\n\n return srcSliceH;\n\n}\n"}} {"sample_id": "5add35bec1e249bb5345a47008c8f298d4760be4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -43,11 +43,11 @@\n if (pm->smi_en & ICH9_PMIO_SMI_EN_TCO_EN) {\n \n ich9_generate_smi();\n+\n+ } else {\n+\n+ ich9_generate_nmi();\n+\n }\n \n tr->tco.rld = tr->tco.tmr;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void tco_timer_expired(void *opaque)\n\n{\n\n TCOIORegs *tr = opaque;\n\n ICH9LPCPMRegs *pm = container_of(tr, ICH9LPCPMRegs, tco_regs);\n\n ICH9LPCState *lpc = container_of(pm, ICH9LPCState, pm);\n\n uint32_t gcs = pci_get_long(lpc->chip_config + ICH9_CC_GCS);\n\n\n\n tr->tco.rld = 0;\n\n tr->tco.sts1 |= TCO_TIMEOUT;\n\n if (++tr->timeouts_no == 2) {\n\n tr->tco.sts2 |= TCO_SECOND_TO_STS;\n\n tr->tco.sts2 |= TCO_BOOT_STS;\n\n tr->timeouts_no = 0;\n\n\n\n if (!(gcs & ICH9_CC_GCS_NO_REBOOT)) {\n\n watchdog_perform_action();\n\n tco_timer_stop(tr);\n\n return;\n\n }\n\n }\n\n\n\n if (pm->smi_en & ICH9_PMIO_SMI_EN_TCO_EN) {\n\n ich9_generate_smi();\n\n } else {\n\n ich9_generate_nmi();\n\n }\n\n tr->tco.rld = tr->tco.tmr;\n\n tco_timer_reload(tr);\n\n}\n"}} {"sample_id": "a9c0183059d6a4e4d940cd86ac0f9402b0655d24", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n uint32_t ret = 0;\n \n \n+\n+ wpnum = addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);\n+\n+\n+\n for (i = 0; i < 32; i ++, wpnum ++, addr += WPGROUP_SIZE)\n \n if (addr < sd->size && sd->wp_groups[wpnum])", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t sd_wpbits(SDState *sd, uint64_t addr)\n\n{\n\n uint32_t i, wpnum;\n\n uint32_t ret = 0;\n\n\n\n wpnum = addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT);\n\n\n\n for (i = 0; i < 32; i ++, wpnum ++, addr += WPGROUP_SIZE)\n\n if (addr < sd->size && sd->wp_groups[wpnum])\n\n ret |= (1 << i);\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "0ecca7a49f8e254c12a3a1de048d738bfbb614c6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n len = s->buf_end - s->buf_ptr;\n if (len == 0) {\n fill_buffer(s);\n+ len = s->buf_end - s->buf_ptr;\n+ }\n+ if (len > size)\n len = size;\n memcpy(buf, s->buf_ptr, len);\n s->buf_ptr += len;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int get_partial_buffer(ByteIOContext *s, unsigned char *buf, int size)\n{\n int len;\n len = s->buf_end - s->buf_ptr;\n if (len == 0) {\n fill_buffer(s);\n len = s->buf_end - s->buf_ptr;\n }\n if (len > size)\n len = size;\n memcpy(buf, s->buf_ptr, len);\n s->buf_ptr += len;\n return len;\n}"}} {"sample_id": "470de55aa17cb933a21f7e4c4015202eaba7277f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n skip_bits_long(gb,24+align);\n \n h->stc = get_bits(gb,8);\n+\n+ decode_slice_header(h,gb);\n+\n+ return 1;\n+\n }\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline int check_for_slice(AVSContext *h) {\n\n GetBitContext *gb = &h->s.gb;\n\n int align;\n\n\n\n if(h->mbx)\n\n return 0;\n\n align = (-get_bits_count(gb)) & 7;\n\n /* check for stuffing byte */\n\n if(!align && (show_bits(gb,8) == 0x80))\n\n get_bits(gb,8);\n\n if((show_bits_long(gb,24+align) & 0xFFFFFF) == 0x000001) {\n\n skip_bits_long(gb,24+align);\n\n h->stc = get_bits(gb,8);\n\n decode_slice_header(h,gb);\n\n return 1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "af7e9e74c6a62a5bcd911726a9e88d28b61490e0_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void openpic_load_IRQ_queue(QEMUFile* f, IRQ_queue_t *q)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void openpic_load_IRQ_queue(QEMUFile* f, IRQ_queue_t *q)\n\n{\n\n unsigned int i;\n\n\n\n for (i = 0; i < BF_WIDTH(MAX_IRQ); i++)\n\n qemu_get_be32s(f, &q->queue[i]);\n\n\n\n qemu_get_sbe32s(f, &q->next);\n\n qemu_get_sbe32s(f, &q->priority);\n\n}\n"}} {"sample_id": "ac1970fbe8ad5a70174f462109ac0f6c7bf1bc43_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,6 +4,6 @@\n \n destroy_l2_mapping(&phys_map, P_L2_LEVELS - 1);\n \n+ phys_map_nodes_reset();\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void destroy_all_mappings(void)\n\n{\n\n destroy_l2_mapping(&phys_map, P_L2_LEVELS - 1);\n\n phys_map_nodes_reset();\n\n}\n"}} {"sample_id": "cc276c85d15272df6e44fb3252657a43cbd49555_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n if (!strcmp(channel_layout_map[i].name, name))\n \n+ return channel_layout_map[i].layout;\n+\n+ i++;\n+\n+ } while (channel_layout_map[i].name);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int64_t av_get_channel_layout(const char *name)\n\n{\n\n int i = 0;\n\n do {\n\n if (!strcmp(channel_layout_map[i].name, name))\n\n return channel_layout_map[i].layout;\n\n i++;\n\n } while (channel_layout_map[i].name);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "da35797359cec148f3fe59894c62727b0422d75a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static inline void comp_block(MadContext *t, int mb_x, int mb_y,\n \n int j, int mv_x, int mv_y, int add)\n+\n {\n \n+ MpegEncContext *s = &t->s;\n \n if (j < 4) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static inline void comp_block(MadContext *t, int mb_x, int mb_y,\n\n int j, int mv_x, int mv_y, int add)\n\n{\n\n MpegEncContext *s = &t->s;\n\n if (j < 4) {\n\n comp(t->frame.data[0] + (mb_y*16 + ((j&2)<<2))*t->frame.linesize[0] + mb_x*16 + ((j&1)<<3),\n\n t->frame.linesize[0],\n\n t->last_frame.data[0] + (mb_y*16 + ((j&2)<<2) + mv_y)*t->last_frame.linesize[0] + mb_x*16 + ((j&1)<<3) + mv_x,\n\n t->last_frame.linesize[0], add);\n\n } else if (!(s->avctx->flags & CODEC_FLAG_GRAY)) {\n\n int index = j - 3;\n\n comp(t->frame.data[index] + (mb_y*8)*t->frame.linesize[index] + mb_x * 8,\n\n t->frame.linesize[index],\n\n t->last_frame.data[index] + (mb_y * 8 + (mv_y/2))*t->last_frame.linesize[index] + mb_x * 8 + (mv_x/2),\n\n t->last_frame.linesize[index], add);\n\n }\n\n}\n"}} {"sample_id": "e1833e1f96456fd8fc17463246fe0b2050e68efb_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void ppc_hw_interrupt (CPUState *env)\n \n {\n+\n env->exception_index = -1;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ppc_hw_interrupt (CPUState *env)\n\n{\n\n env->exception_index = -1;\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void qvirtio_pci_set_status(QVirtioDevice *d, uint8_t status)\n \n+{\n \n QVirtioPCIDevice *dev = (QVirtioPCIDevice *)d;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void qvirtio_pci_set_status(QVirtioDevice *d, uint8_t status)\n\n{\n\n QVirtioPCIDevice *dev = (QVirtioPCIDevice *)d;\n\n qpci_io_writeb(dev->pdev, dev->addr + VIRTIO_PCI_STATUS, status);\n\n}\n"}} {"sample_id": "47d4be12c3997343e436c6cca89aefbbbeb70863_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n const char *str = \"\";\n \n char f = 'X';\n+\n+ const char *endptr = &f;\n+\n unsigned long res = 999;\n \n int err;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_qemu_strtoul_empty(void)\n\n{\n\n const char *str = \"\";\n\n char f = 'X';\n\n const char *endptr = &f;\n\n unsigned long res = 999;\n\n int err;\n\n\n\n err = qemu_strtoul(str, &endptr, 0, &res);\n\n\n\n g_assert_cmpint(err, ==, 0);\n\n g_assert_cmpint(res, ==, 0);\n\n g_assert(endptr == str);\n\n}\n"}} {"sample_id": "8a354bd935a800dd2d98ac8f30707e2912c80ae6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n if (replay_mode != REPLAY_MODE_PLAY) {\n \n /* put the event into the file */\n+\n+ replay_put_event(EVENT_ASYNC);\n+\n+ replay_put_byte(checkpoint);\n+\n replay_put_byte(event->event_kind);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void replay_save_event(Event *event, int checkpoint)\n\n{\n\n if (replay_mode != REPLAY_MODE_PLAY) {\n\n /* put the event into the file */\n\n replay_put_event(EVENT_ASYNC);\n\n replay_put_byte(checkpoint);\n\n replay_put_byte(event->event_kind);\n\n\n\n /* save event-specific data */\n\n switch (event->event_kind) {\n\n default:\n\n error_report(\"Unknown ID %d of replay event\", read_event_kind);\n\n exit(1);\n\n break;\n\n }\n\n }\n\n}\n"}} {"sample_id": "2db59a76c421cdd1039d10e32a9798952d3ff5ba_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,25 +1,25 @@\n void HELPER(window_check)(CPUXtensaState *env, uint32_t pc, uint32_t w)\n \n+{\n+\n+ uint32_t windowbase = windowbase_bound(env->sregs[WINDOW_BASE], env);\n \n uint32_t windowstart = env->sregs[WINDOW_START];\n+\n+ uint32_t m, n;\n \n \n+\n+ if ((env->sregs[PS] & (PS_WOE | PS_EXCM)) ^ PS_WOE) {\n \n return;\n+\n }\n \n \n+\n for (n = 1; ; ++n) {\n+\n if (n > w) {\n \n return;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void HELPER(window_check)(CPUXtensaState *env, uint32_t pc, uint32_t w)\n\n{\n\n uint32_t windowbase = windowbase_bound(env->sregs[WINDOW_BASE], env);\n\n uint32_t windowstart = env->sregs[WINDOW_START];\n\n uint32_t m, n;\n\n\n\n if ((env->sregs[PS] & (PS_WOE | PS_EXCM)) ^ PS_WOE) {\n\n return;\n\n }\n\n\n\n for (n = 1; ; ++n) {\n\n if (n > w) {\n\n return;\n\n }\n\n if (windowstart & windowstart_bit(windowbase + n, env)) {\n\n break;\n\n }\n\n }\n\n\n\n m = windowbase_bound(windowbase + n, env);\n\n rotate_window(env, n);\n\n env->sregs[PS] = (env->sregs[PS] & ~PS_OWB) |\n\n (windowbase << PS_OWB_SHIFT) | PS_EXCM;\n\n env->sregs[EPC1] = env->pc = pc;\n\n\n\n if (windowstart & windowstart_bit(m + 1, env)) {\n\n HELPER(exception)(env, EXC_WINDOW_OVERFLOW4);\n\n } else if (windowstart & windowstart_bit(m + 2, env)) {\n\n HELPER(exception)(env, EXC_WINDOW_OVERFLOW8);\n\n } else {\n\n HELPER(exception)(env, EXC_WINDOW_OVERFLOW12);\n\n }\n\n}\n"}} {"sample_id": "57285302af51a8bae334c03e1f8243e935373953", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int spapr_vty_init(VIOsPAPRDevice *sdev)\n {\n VIOsPAPRVTYDevice *dev = (VIOsPAPRVTYDevice *)sdev;\n qemu_chr_add_handlers(dev->chardev, vty_can_receive,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int spapr_vty_init(VIOsPAPRDevice *sdev)\n{\n VIOsPAPRVTYDevice *dev = (VIOsPAPRVTYDevice *)sdev;\n qemu_chr_add_handlers(dev->chardev, vty_can_receive,\n vty_receive, NULL, dev);\n return 0;"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_116", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static inline uint64_t ram_chunk_index(const uint8_t *start,\n+\n+ const uint8_t *host)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline uint64_t ram_chunk_index(const uint8_t *start,\n\n const uint8_t *host)\n\n{\n\n return ((uintptr_t) host - (uintptr_t) start) >> RDMA_REG_CHUNK_SHIFT;\n\n}\n"}} {"sample_id": "4295e15aa730a95003a3639d6dad2eb1e65a59e2_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n {\n \n+ if (async != QXL_SYNC) {\n+\n+#if SPICE_INTERFACE_QXL_MINOR >= 1\n+\n+ spice_qxl_create_primary_surface_async(&ssd->qxl, id, surface, 0);\n \n #else\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_spice_create_primary_surface(SimpleSpiceDisplay *ssd, uint32_t id,\n\n QXLDevSurfaceCreate *surface,\n\n qxl_async_io async)\n\n{\n\n if (async != QXL_SYNC) {\n\n#if SPICE_INTERFACE_QXL_MINOR >= 1\n\n spice_qxl_create_primary_surface_async(&ssd->qxl, id, surface, 0);\n\n#else\n\n abort();\n\n#endif\n\n } else {\n\n ssd->worker->create_primary_surface(ssd->worker, id, surface);\n\n }\n\n}\n"}} {"sample_id": "680e60b6ba5a26332d684a60a6d9f39c0a999941", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n e1000e_set_pbaclr(E1000ECore *core, int index, uint32_t val)\n \n {\n+\n int i;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "e1000e_set_pbaclr(E1000ECore *core, int index, uint32_t val)\n\n{\n\n int i;\n\n\n\n core->mac[PBACLR] = val & E1000_PBACLR_VALID_MASK;\n\n\n\n if (msix_enabled(core->owner)) {\n\n return;\n\n }\n\n\n\n for (i = 0; i < E1000E_MSIX_VEC_NUM; i++) {\n\n if (core->mac[PBACLR] & BIT(i)) {\n\n msix_clr_pending(core->owner, i);\n\n }\n\n }\n\n}\n"}} {"sample_id": "b798068d51ecf173702c91617793989ab843c8fb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void dec_scall(DisasContext *dc)\n \n {\n+\n+ TCGv t0;\n+\n+ int l1;\n+\n \n \n if (dc->imm5 == 7) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void dec_scall(DisasContext *dc)\n\n{\n\n TCGv t0;\n\n int l1;\n\n\n\n if (dc->imm5 == 7) {\n\n LOG_DIS(\"scall\\n\");\n\n } else if (dc->imm5 == 2) {\n\n LOG_DIS(\"break\\n\");\n\n } else {\n\n cpu_abort(dc->env, \"invalid opcode\\n\");\n\n }\n\n\n\n t0 = tcg_temp_new();\n\n l1 = gen_new_label();\n\n\n\n if (dc->imm5 == 7) {\n\n tcg_gen_movi_tl(cpu_pc, dc->pc);\n\n t_gen_raise_exception(dc, EXCP_SYSTEMCALL);\n\n } else {\n\n tcg_gen_movi_tl(cpu_pc, dc->pc);\n\n t_gen_raise_exception(dc, EXCP_BREAKPOINT);\n\n }\n\n}\n"}} {"sample_id": "ef4dc3e55b677b27f6e8f471946c711bcf92da82", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int write_number(void *obj, const AVOption *o, void *dst, double num, int den, int64_t intnum)\n \n+{\n \n if (o->max*den < num*intnum || o->min*den > num*intnum) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int write_number(void *obj, const AVOption *o, void *dst, double num, int den, int64_t intnum)\n\n{\n\n if (o->max*den < num*intnum || o->min*den > num*intnum) {\n\n av_log(obj, AV_LOG_ERROR, \"Value %f for parameter '%s' out of range\\n\",\n\n num*intnum/den, o->name);\n\n return AVERROR(ERANGE);\n\n }\n\n\n\n switch (o->type) {\n\n case AV_OPT_TYPE_FLAGS:\n\n case AV_OPT_TYPE_INT: *(int *)dst= llrint(num/den)*intnum; break;\n\n case AV_OPT_TYPE_INT64: *(int64_t *)dst= llrint(num/den)*intnum; break;\n\n case AV_OPT_TYPE_FLOAT: *(float *)dst= num*intnum/den; break;\n\n case AV_OPT_TYPE_DOUBLE:*(double *)dst= num*intnum/den; break;\n\n case AV_OPT_TYPE_RATIONAL:\n\n if ((int)num == num) *(AVRational*)dst= (AVRational){num*intnum, den};\n\n else *(AVRational*)dst= av_d2q(num*intnum/den, 1<<24);\n\n break;\n\n default:\n\n return AVERROR(EINVAL);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "f6774f905fb3cfdc319523ac640be30b14c1bc55_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void ff_mpeg_unref_picture(MpegEncContext *s, Picture *pic)\n \n+{\n \n+ int off = offsetof(Picture, mb_mean) + sizeof(pic->mb_mean);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void ff_mpeg_unref_picture(MpegEncContext *s, Picture *pic)\n\n{\n\n int off = offsetof(Picture, mb_mean) + sizeof(pic->mb_mean);\n\n\n\n pic->tf.f = &pic->f;\n\n /* WM Image / Screen codecs allocate internal buffers with different\n\n * dimensions / colorspaces; ignore user-defined callbacks for these. */\n\n if (s->codec_id != AV_CODEC_ID_WMV3IMAGE &&\n\n s->codec_id != AV_CODEC_ID_VC1IMAGE &&\n\n s->codec_id != AV_CODEC_ID_MSS2)\n\n ff_thread_release_buffer(s->avctx, &pic->tf);\n\n else\n\n av_frame_unref(&pic->f);\n\n\n\n av_buffer_unref(&pic->hwaccel_priv_buf);\n\n\n\n if (pic->needs_realloc)\n\n ff_free_picture_tables(pic);\n\n\n\n memset((uint8_t*)pic + off, 0, sizeof(*pic) - off);\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_43", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void OPPROTO op_srl_T0_T1 (void)\n+\n+{\n \n T0 = T0 >> T1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void OPPROTO op_srl_T0_T1 (void)\n\n{\n\n T0 = T0 >> T1;\n\n RETURN();\n\n}\n"}} {"sample_id": "d510c5cf343eabd4d3a301f5730af724747b7055", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n const char *firstname;\n \n char value[1024], *id = NULL;\n+\n const char *p;\n \n QemuOpts *opts;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "QemuOpts *qemu_opts_parse(QemuOptsList *list, const char *params,\n\n int permit_abbrev)\n\n{\n\n const char *firstname;\n\n char value[1024], *id = NULL;\n\n const char *p;\n\n QemuOpts *opts;\n\n\n\n assert(!permit_abbrev || list->implied_opt_name);\n\n firstname = permit_abbrev ? list->implied_opt_name : NULL;\n\n\n\n if (strncmp(params, \"id=\", 3) == 0) {\n\n get_opt_value(value, sizeof(value), params+3);\n\n id = qemu_strdup(value);\n\n } else if ((p = strstr(params, \",id=\")) != NULL) {\n\n get_opt_value(value, sizeof(value), p+4);\n\n id = qemu_strdup(value);\n\n }\n\n opts = qemu_opts_create(list, id, 1);\n\n if (opts == NULL)\n\n return NULL;\n\n\n\n if (qemu_opts_do_parse(opts, params, firstname) != 0) {\n\n qemu_opts_del(opts);\n\n return NULL;\n\n }\n\n\n\n return opts;\n\n}\n"}} {"sample_id": "0abe740f1de899737242bcba1fb4a9857f7a3087", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,17 +1,17 @@\n static void inc_refcounts(BlockDriverState *bs,\n \n+ BdrvCheckResult *res,\n+\n uint16_t *refcount_table,\n \n int refcount_table_size,\n \n int64_t offset, int64_t size)\n \n+{\n+\n+ BDRVQcowState *s = bs->opaque;\n+\n int64_t start, last, cluster_offset;\n \n int k;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void inc_refcounts(BlockDriverState *bs,\n\n BdrvCheckResult *res,\n\n uint16_t *refcount_table,\n\n int refcount_table_size,\n\n int64_t offset, int64_t size)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n int64_t start, last, cluster_offset;\n\n int k;\n\n\n\n if (size <= 0)\n\n return;\n\n\n\n start = start_of_cluster(s, offset);\n\n last = start_of_cluster(s, offset + size - 1);\n\n for(cluster_offset = start; cluster_offset <= last;\n\n cluster_offset += s->cluster_size) {\n\n k = cluster_offset >> s->cluster_bits;\n\n if (k < 0) {\n\n fprintf(stderr, \"ERROR: invalid cluster offset=0x%\" PRIx64 \"\\n\",\n\n cluster_offset);\n\n res->corruptions++;\n\n } else if (k >= refcount_table_size) {\n\n fprintf(stderr, \"Warning: cluster offset=0x%\" PRIx64 \" is after \"\n\n \"the end of the image file, can't properly check refcounts.\\n\",\n\n cluster_offset);\n\n res->check_errors++;\n\n } else {\n\n if (++refcount_table[k] == 0) {\n\n fprintf(stderr, \"ERROR: overflow cluster offset=0x%\" PRIx64\n\n \"\\n\", cluster_offset);\n\n res->corruptions++;\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "5c6c0e513600ba57c3e73b7151d3c0664438f7b5_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n+static int scsi_write_data(SCSIDevice *d, uint32_t tag)\n+\n+{\n \n+ SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);\n+\n+ SCSIGenericReq *r;\n+\n+ int ret;\n+\n \n \n DPRINTF(\"scsi_write_data 0x%x\\n\", tag);\n@@ -17,7 +17,7 @@\n if (!r) {\n \n BADF(\"Bad write tag 0x%x\\n\", tag);\n+\n /* ??? This is the wrong error. */\n \n scsi_command_complete(r, -EINVAL);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static int scsi_write_data(SCSIDevice *d, uint32_t tag)\n\n{\n\n SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);\n\n SCSIGenericReq *r;\n\n int ret;\n\n\n\n DPRINTF(\"scsi_write_data 0x%x\\n\", tag);\n\n r = scsi_find_request(s, tag);\n\n if (!r) {\n\n BADF(\"Bad write tag 0x%x\\n\", tag);\n\n /* ??? This is the wrong error. */\n\n scsi_command_complete(r, -EINVAL);\n\n return 0;\n\n }\n\n\n\n if (r->len == 0) {\n\n r->len = r->buflen;\n\n scsi_req_data(&r->req, r->len);\n\n return 0;\n\n }\n\n\n\n ret = execute_command(s->bs, r, SG_DXFER_TO_DEV, scsi_write_complete);\n\n if (ret == -1) {\n\n scsi_command_complete(r, -EINVAL);\n\n return 1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "5c843af22604edecda10d4bb89d4eede9e1bd3d0_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,7 +12,7 @@\n \n const char *arg3 = qdict_get_try_str(qdict, \"arg3\");\n \n+\n \n if (arg2) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void hmp_hostfwd_add(Monitor *mon, const QDict *qdict)\n\n{\n\n const char *redir_str;\n\n SlirpState *s;\n\n const char *arg1 = qdict_get_str(qdict, \"arg1\");\n\n const char *arg2 = qdict_get_try_str(qdict, \"arg2\");\n\n const char *arg3 = qdict_get_try_str(qdict, \"arg3\");\n\n\n\n if (arg2) {\n\n s = slirp_lookup(mon, arg1, arg2);\n\n redir_str = arg3;\n\n } else {\n\n s = slirp_lookup(mon, NULL, NULL);\n\n redir_str = arg1;\n\n }\n\n if (s) {\n\n slirp_hostfwd(s, redir_str, 0);\n\n }\n\n\n\n}\n"}} {"sample_id": "a9d52a75634ac9aa7d101bf7f63e10bf6655a865", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n \n str);\n \n+ } else {\n+\n+ error_setg(errp, \"Drive '%s' is already in use by another device\",\n+\n+ str);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void parse_drive(DeviceState *dev, const char *str, void **ptr,\n\n const char *propname, Error **errp)\n\n{\n\n BlockBackend *blk;\n\n\n\n blk = blk_by_name(str);\n\n if (!blk) {\n\n error_setg(errp, \"Property '%s.%s' can't find value '%s'\",\n\n object_get_typename(OBJECT(dev)), propname, str);\n\n return;\n\n }\n\n if (blk_attach_dev(blk, dev) < 0) {\n\n DriveInfo *dinfo = blk_legacy_dinfo(blk);\n\n\n\n if (dinfo->type != IF_NONE) {\n\n error_setg(errp, \"Drive '%s' is already in use because \"\n\n \"it has been automatically connected to another \"\n\n \"device (did you need 'if=none' in the drive options?)\",\n\n str);\n\n } else {\n\n error_setg(errp, \"Drive '%s' is already in use by another device\",\n\n str);\n\n }\n\n return;\n\n }\n\n *ptr = blk;\n\n}\n"}} {"sample_id": "7e84c2498f0ff3999937d18d1e9abaa030400000_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static inline void load_seg_vm(int seg, int selector)\n \n+{\n+\n selector &= 0xffff;\n \n cpu_x86_load_seg_cache(env, seg, selector, ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void load_seg_vm(int seg, int selector)\n\n{\n\n selector &= 0xffff;\n\n cpu_x86_load_seg_cache(env, seg, selector, \n\n (uint8_t *)(selector << 4), 0xffff, 0);\n\n}\n"}} {"sample_id": "eabb7b91b36b202b4dac2df2d59d698e3aff197a_29", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n /* Let the compiler perform the right-shift as part of the arithmetic. */\n \n ptrdiff_t disp = target - (pc + 1);\n+\n+ assert(disp == (int16_t)disp);\n+\n return disp & 0xffff;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline uint32_t reloc_pc16_val(tcg_insn_unit *pc, tcg_insn_unit *target)\n\n{\n\n /* Let the compiler perform the right-shift as part of the arithmetic. */\n\n ptrdiff_t disp = target - (pc + 1);\n\n assert(disp == (int16_t)disp);\n\n return disp & 0xffff;\n\n}\n"}} {"sample_id": "f5be7958e313f3f62505ea7f90007800e8e1dcb5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void qdm2_calculate_fft (QDM2Context *q, int channel, int sub_packet)\n \n {\n+\n+ const float gain = (q->channels == 1 && q->nb_channels == 2) ? 0.5f : 1.0f;\n+\n+ int i;\n+\n q->fft.complex[channel][0].re *= 2.0f;\n \n q->fft.complex[channel][0].im = 0.0f;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qdm2_calculate_fft (QDM2Context *q, int channel, int sub_packet)\n\n{\n\n const float gain = (q->channels == 1 && q->nb_channels == 2) ? 0.5f : 1.0f;\n\n int i;\n\n q->fft.complex[channel][0].re *= 2.0f;\n\n q->fft.complex[channel][0].im = 0.0f;\n\n q->rdft_ctx.rdft_calc(&q->rdft_ctx, (FFTSample *)q->fft.complex[channel]);\n\n /* add samples to output buffer */\n\n for (i = 0; i < ((q->fft_frame_size + 15) & ~15); i++)\n\n q->output_buffer[q->channels * i + channel] += ((float *) q->fft.complex[channel])[i] * gain;\n\n}\n"}} {"sample_id": "9ef91a677110ec200d7b2904fc4bcae5a77329ad_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n \n \n /* close fd so that we can reopen it as needed */\n+\n+ close(s->fd);\n+\n+ s->fd = -1;\n+\n s->fd_media_changed = 1;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int floppy_open(BlockDriverState *bs, const char *filename, int flags)\n\n{\n\n BDRVRawState *s = bs->opaque;\n\n int ret;\n\n\n\n posix_aio_init();\n\n\n\n s->type = FTYPE_FD;\n\n\n\n /* open will not fail even if no floppy is inserted, so add O_NONBLOCK */\n\n ret = raw_open_common(bs, filename, flags, O_NONBLOCK);\n\n if (ret)\n\n return ret;\n\n\n\n /* close fd so that we can reopen it as needed */\n\n close(s->fd);\n\n s->fd = -1;\n\n s->fd_media_changed = 1;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "7f0278435df1fa845b3bd9556942f89296d4246b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n const char *qdict_get_str(const QDict *qdict, const char *key)\n+\n+{\n \n QObject *obj = qdict_get_obj(qdict, key, QTYPE_QSTRING);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "const char *qdict_get_str(const QDict *qdict, const char *key)\n\n{\n\n QObject *obj = qdict_get_obj(qdict, key, QTYPE_QSTRING);\n\n return qstring_get_str(qobject_to_qstring(obj));\n\n}\n"}} {"sample_id": "ce5b1bbf624b977a55ff7f85bb3871682d03baff_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n CPUState *cs = CPU(obj);\n \n+ MicroBlazeCPU *cpu = MICROBLAZE_CPU(obj);\n \n CPUMBState *env = &cpu->env;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void mb_cpu_initfn(Object *obj)\n\n{\n\n CPUState *cs = CPU(obj);\n\n MicroBlazeCPU *cpu = MICROBLAZE_CPU(obj);\n\n CPUMBState *env = &cpu->env;\n\n static bool tcg_initialized;\n\n\n\n cs->env_ptr = env;\n\n cpu_exec_init(cs, &error_abort);\n\n\n\n set_float_rounding_mode(float_round_nearest_even, &env->fp_status);\n\n\n\n#ifndef CONFIG_USER_ONLY\n\n /* Inbound IRQ and FIR lines */\n\n qdev_init_gpio_in(DEVICE(cpu), microblaze_cpu_set_irq, 2);\n\n#endif\n\n\n\n if (tcg_enabled() && !tcg_initialized) {\n\n tcg_initialized = true;\n\n mb_tcg_init();\n\n }\n\n}\n"}} {"sample_id": "b47d8efa9f430c332bf96ce6eede169eb48422ad_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n trace_vfio_put_group(group->fd);\n \n close(group->fd);\n+\n+ g_free(group);\n+\n+\n+\n if (QLIST_EMPTY(&group_list)) {\n \n qemu_unregister_reset(vfio_pci_reset_handler, NULL);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vfio_put_group(VFIOGroup *group)\n\n{\n\n if (!QLIST_EMPTY(&group->device_list)) {\n\n return;\n\n }\n\n\n\n vfio_kvm_device_del_group(group);\n\n vfio_disconnect_container(group);\n\n QLIST_REMOVE(group, next);\n\n trace_vfio_put_group(group->fd);\n\n close(group->fd);\n\n g_free(group);\n\n\n\n if (QLIST_EMPTY(&group_list)) {\n\n qemu_unregister_reset(vfio_pci_reset_handler, NULL);\n\n }\n\n}\n"}} {"sample_id": "5e003f17ec518cd96f5d2ac23ce9e14144426235_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n int bdrv_all_create_snapshot(QEMUSnapshotInfo *sn,\n \n+ BlockDriverState *vm_state_bs,\n \n uint64_t vm_state_size,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "int bdrv_all_create_snapshot(QEMUSnapshotInfo *sn,\n\n BlockDriverState *vm_state_bs,\n\n uint64_t vm_state_size,\n\n BlockDriverState **first_bad_bs)\n\n{\n\n int err = 0;\n\n BlockDriverState *bs;\n\n BdrvNextIterator it;\n\n\n\n for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {\n\n AioContext *ctx = bdrv_get_aio_context(bs);\n\n\n\n aio_context_acquire(ctx);\n\n if (bs == vm_state_bs) {\n\n sn->vm_state_size = vm_state_size;\n\n err = bdrv_snapshot_create(bs, sn);\n\n } else if (bdrv_can_snapshot(bs)) {\n\n sn->vm_state_size = 0;\n\n err = bdrv_snapshot_create(bs, sn);\n\n }\n\n aio_context_release(ctx);\n\n if (err < 0) {\n\n\n goto fail;\n\n }\n\n }\n\n\n\nfail:\n\n *first_bad_bs = bs;\n\n return err;\n\n}"}} {"sample_id": "ccbcfedd17fd2d13521fcee66810d0df464ec1cc_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n int qemu_devtree_setprop_cell(void *fdt, const char *node_path,\n+\n+ const char *property, uint32_t val)\n+\n+{\n \n int offset;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "int qemu_devtree_setprop_cell(void *fdt, const char *node_path,\n\n const char *property, uint32_t val)\n\n{\n\n int offset;\n\n\n\n offset = fdt_path_offset(fdt, node_path);\n\n if (offset < 0)\n\n return offset;\n\n\n\n return fdt_setprop_cell(fdt, offset, property, val);\n\n}\n"}} {"sample_id": "41836c4e306e572ecf80d5a714aaec532c7ece60", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n x265pic.stride[i] = pic->linesize[i];\n }\n x265pic.pts = pic->pts;\n+ }\n+ ret = x265_encoder_encode(ctx->encoder, &nal, &nnal,\n+ pic ? &x265pic : NULL, &x265pic_out);\n+ if (ret < 0)\n+ return AVERROR_UNKNOWN;\n if (!nnal)\n return 0;\n for (i = 0; i < nnal; i++)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int libx265_encode_frame(AVCodecContext *avctx, AVPacket *pkt,\n const AVFrame *pic, int *got_packet)\n{\n libx265Context *ctx = avctx->priv_data;\n x265_picture x265pic;\n x265_picture x265pic_out = { { 0 } };\n x265_nal *nal;\n uint8_t *dst;\n int payload = 0;\n int nnal;\n int ret;\n int i;\n if (pic) {\n for (i = 0; i < 3; i++) {\n x265pic.planes[i] = pic->data[i];\n x265pic.stride[i] = pic->linesize[i];\n }\n x265pic.pts = pic->pts;\n }\n ret = x265_encoder_encode(ctx->encoder, &nal, &nnal,\n pic ? &x265pic : NULL, &x265pic_out);\n if (ret < 0)\n return AVERROR_UNKNOWN;\n if (!nnal)\n return 0;\n for (i = 0; i < nnal; i++)\n payload += nal[i].sizeBytes;\n payload += ctx->header_size;\n ret = ff_alloc_packet(pkt, payload);\n if (ret < 0) {\n av_log(avctx, AV_LOG_ERROR, \"Error getting output packet.\\n\");\n return ret;\n }\n dst = pkt->data;\n if (ctx->header) {\n memcpy(dst, ctx->header, ctx->header_size);\n dst += ctx->header_size;\n av_freep(&ctx->header);\n ctx->header_size = 0;\n }\n for (i = 0; i < nnal; i++) {\n memcpy(dst, nal[i].payload, nal[i].sizeBytes);\n dst += nal[i].sizeBytes;\n if (is_keyframe(nal[i].type))\n pkt->flags |= AV_PKT_FLAG_KEY;\n }\n pkt->pts = x265pic_out.pts;\n pkt->dts = x265pic_out.dts;\n *got_packet = 1;\n return 0;\n}"}} {"sample_id": "defdb20e1a8ac3a7200aaf190d7fb20a5ac8bcea", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,8 +14,8 @@\n \n if (qdev_init(&dev->qdev) < 0)\n \n+ return NULL;\n+\n+ return &DO_UPCAST(ISAParallelState, dev, dev)->state;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "ParallelState *parallel_init(int index, CharDriverState *chr)\n\n{\n\n ISADevice *dev;\n\n\n\n dev = isa_create(\"isa-parallel\");\n\n qdev_prop_set_uint32(&dev->qdev, \"index\", index);\n\n qdev_prop_set_chr(&dev->qdev, \"chardev\", chr);\n\n if (qdev_init(&dev->qdev) < 0)\n\n return NULL;\n\n return &DO_UPCAST(ISAParallelState, dev, dev)->state;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_118", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n {\n \n+ arm_mptimer_state *s = (arm_mptimer_state *)opaque;\n+\n+ int id = get_current_cpu(s);\n \n return timerblock_read(&s->timerblock[id * 2 + 1], addr, size);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t arm_thiswdog_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n arm_mptimer_state *s = (arm_mptimer_state *)opaque;\n\n int id = get_current_cpu(s);\n\n return timerblock_read(&s->timerblock[id * 2 + 1], addr, size);\n\n}\n"}} {"sample_id": "854e67fea6a6f181163a5467fc9ba04de8d181bb_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void hmp_info_cpustats(Monitor *mon, const QDict *qdict)\n+\n {\n \n cpu_dump_statistics(mon_get_cpu(), (FILE *)mon, &monitor_fprintf, 0);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void hmp_info_cpustats(Monitor *mon, const QDict *qdict)\n\n{\n\n cpu_dump_statistics(mon_get_cpu(), (FILE *)mon, &monitor_fprintf, 0);\n\n}\n"}} {"sample_id": "185698715dfb18c82ad2a5dbc169908602d43e81_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n } else {\n \n+ set_float_rounding_mode(rounding_mode, &env->fp_status);\n+\n+ farg.ll = float64_round_to_int(farg.d, &env->fp_status);\n+\n+ /* Restore rounding mode from FPSCR */\n \n fpscr_set_rounding_mode();\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline uint64_t do_fri(uint64_t arg, int rounding_mode)\n\n{\n\n CPU_DoubleU farg;\n\n farg.ll = arg;\n\n\n\n if (unlikely(float64_is_signaling_nan(farg.d))) {\n\n /* sNaN round */\n\n farg.ll = fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN | POWERPC_EXCP_FP_VXCVI);\n\n } else if (unlikely(float64_is_nan(farg.d) || float64_is_infinity(farg.d))) {\n\n /* qNan / infinity round */\n\n farg.ll = fload_invalid_op_excp(POWERPC_EXCP_FP_VXCVI);\n\n } else {\n\n set_float_rounding_mode(rounding_mode, &env->fp_status);\n\n farg.ll = float64_round_to_int(farg.d, &env->fp_status);\n\n /* Restore rounding mode from FPSCR */\n\n fpscr_set_rounding_mode();\n\n }\n\n return farg.ll;\n\n}\n"}} {"sample_id": "856d72454f03aea26fd61c728762ef9cd1d71512", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void listener_add_address_space(MemoryListener *listener,\n+\n+ AddressSpace *as)\n+\n+{\n+\n FlatView *view;\n \n FlatRange *fr;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void listener_add_address_space(MemoryListener *listener,\n\n AddressSpace *as)\n\n{\n\n FlatView *view;\n\n FlatRange *fr;\n\n\n\n if (listener->address_space_filter\n\n && listener->address_space_filter != as) {\n\n return;\n\n }\n\n\n\n if (global_dirty_log) {\n\n if (listener->log_global_start) {\n\n listener->log_global_start(listener);\n\n }\n\n }\n\n\n\n view = as->current_map;\n\n FOR_EACH_FLAT_RANGE(fr, view) {\n\n MemoryRegionSection section = {\n\n .mr = fr->mr,\n\n .address_space = as,\n\n .offset_within_region = fr->offset_in_region,\n\n .size = fr->addr.size,\n\n .offset_within_address_space = int128_get64(fr->addr.start),\n\n .readonly = fr->readonly,\n\n };\n\n if (listener->region_add) {\n\n listener->region_add(listener, §ion);\n\n }\n\n }\n\n}\n"}} {"sample_id": "65e7545ea3c65a6468fb59418a6dbe66ef71d6d1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n qemu_chr_add_handlers(s->chn[i].chr, serial_can_receive,\n \n+ serial_receive1, serial_event, &s->chn[i]);\n+\n+ }\n+\n+ }\n \n s->chn[0].otherchn = &s->chn[1];\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int escc_init1(SysBusDevice *dev)\n\n{\n\n ESCCState *s = ESCC(dev);\n\n unsigned int i;\n\n\n\n s->chn[0].disabled = s->disabled;\n\n s->chn[1].disabled = s->disabled;\n\n for (i = 0; i < 2; i++) {\n\n sysbus_init_irq(dev, &s->chn[i].irq);\n\n s->chn[i].chn = 1 - i;\n\n s->chn[i].clock = s->frequency / 2;\n\n if (s->chn[i].chr) {\n\n qemu_chr_add_handlers(s->chn[i].chr, serial_can_receive,\n\n serial_receive1, serial_event, &s->chn[i]);\n\n }\n\n }\n\n s->chn[0].otherchn = &s->chn[1];\n\n s->chn[1].otherchn = &s->chn[0];\n\n\n\n memory_region_init_io(&s->mmio, OBJECT(s), &escc_mem_ops, s, \"escc\",\n\n ESCC_SIZE << s->it_shift);\n\n sysbus_init_mmio(dev, &s->mmio);\n\n\n\n if (s->chn[0].type == mouse) {\n\n qemu_add_mouse_event_handler(sunmouse_event, &s->chn[0], 0,\n\n \"QEMU Sun Mouse\");\n\n }\n\n if (s->chn[1].type == kbd) {\n\n qemu_add_kbd_event_handler(sunkbd_event, &s->chn[1]);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d5a8ee60a0fbc20a2c2d02f3bda1bb1bd365f1ee_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+BlockDeviceInfoList *bdrv_named_nodes_list(void)\n \n {\n \n BlockDeviceInfoList *list, *entry;\n \n+ BlockDriverState *bs;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "BlockDeviceInfoList *bdrv_named_nodes_list(void)\n\n{\n\n BlockDeviceInfoList *list, *entry;\n\n BlockDriverState *bs;\n\n\n\n list = NULL;\n\n QTAILQ_FOREACH(bs, &graph_bdrv_states, node_list) {\n\n entry = g_malloc0(sizeof(*entry));\n\n entry->value = bdrv_block_device_info(bs);\n\n entry->next = list;\n\n list = entry;\n\n }\n\n\n\n return list;\n\n}\n"}} {"sample_id": "77cb0f5aafc8e6d0c6d3c339f381c9b7921648e0_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void adb_register_types(void)\n \n {\n+\n+ type_register_static(&adb_bus_type_info);\n \n type_register_static(&adb_device_type_info);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void adb_register_types(void)\n\n{\n\n type_register_static(&adb_bus_type_info);\n\n type_register_static(&adb_device_type_info);\n\n type_register_static(&adb_kbd_type_info);\n\n type_register_static(&adb_mouse_type_info);\n\n}\n"}} {"sample_id": "297a3646c2947ee64a6d42ca264039732c6218e0_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void visit_end_list(Visitor *v, Error **errp)\n+\n {\n \n assert(!error_is_set(errp));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void visit_end_list(Visitor *v, Error **errp)\n\n{\n\n assert(!error_is_set(errp));\n\n v->end_list(v, errp);\n\n}\n"}} {"sample_id": "158ef8cbb7e0fe8bb430310924b8bebe5f186e6e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,10 +5,10 @@\n \n if (n == 1) {\n \n+ pthread_cond_signal(&ev->cond);\n+\n+ } else {\n+\n pthread_cond_broadcast(&ev->cond);\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void futex_wake(QemuEvent *ev, int n)\n\n{\n\n\n if (n == 1) {\n\n pthread_cond_signal(&ev->cond);\n\n } else {\n\n pthread_cond_broadcast(&ev->cond);\n\n }\n\n\n}"}} {"sample_id": "42a268c241183877192c376d03bd9b6d527407c7_48", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void disas_test_b_imm(DisasContext *s, uint32_t insn)\n \n+{\n+\n+ unsigned int bit_pos, op, rt;\n+\n+ uint64_t addr;\n \n int label_match;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void disas_test_b_imm(DisasContext *s, uint32_t insn)\n\n{\n\n unsigned int bit_pos, op, rt;\n\n uint64_t addr;\n\n int label_match;\n\n TCGv_i64 tcg_cmp;\n\n\n\n bit_pos = (extract32(insn, 31, 1) << 5) | extract32(insn, 19, 5);\n\n op = extract32(insn, 24, 1); /* 0: TBZ; 1: TBNZ */\n\n addr = s->pc + sextract32(insn, 5, 14) * 4 - 4;\n\n rt = extract32(insn, 0, 5);\n\n\n\n tcg_cmp = tcg_temp_new_i64();\n\n tcg_gen_andi_i64(tcg_cmp, cpu_reg(s, rt), (1ULL << bit_pos));\n\n label_match = gen_new_label();\n\n tcg_gen_brcondi_i64(op ? TCG_COND_NE : TCG_COND_EQ,\n\n tcg_cmp, 0, label_match);\n\n tcg_temp_free_i64(tcg_cmp);\n\n gen_goto_tb(s, 0, s->pc);\n\n gen_set_label(label_match);\n\n gen_goto_tb(s, 1, addr);\n\n}\n"}} {"sample_id": "0a73336d96397c80881219d080518fac6f1ecacb_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,16 +1,16 @@\n+static CharDriverState *net_vhost_parse_chardev(\n \n+ const NetdevVhostUserOptions *opts, Error **errp)\n \n {\n \n CharDriverState *chr = qemu_chr_find(opts->chardev);\n+\n+ VhostUserChardevProps props;\n \n \n+\n+ if (chr == NULL) {\n \n error_setg(errp, \"chardev \\\"%s\\\" not found\", opts->chardev);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static CharDriverState *net_vhost_parse_chardev(\n\n const NetdevVhostUserOptions *opts, Error **errp)\n\n{\n\n CharDriverState *chr = qemu_chr_find(opts->chardev);\n\n VhostUserChardevProps props;\n\n\n\n if (chr == NULL) {\n\n error_setg(errp, \"chardev \\\"%s\\\" not found\", opts->chardev);\n\n return NULL;\n\n }\n\n\n\n /* inspect chardev opts */\n\n memset(&props, 0, sizeof(props));\n\n if (qemu_opt_foreach(chr->opts, net_vhost_chardev_opts, &props, errp)) {\n\n return NULL;\n\n }\n\n\n\n if (!props.is_socket || !props.is_unix) {\n\n error_setg(errp, \"chardev \\\"%s\\\" is not a unix socket\",\n\n opts->chardev);\n\n return NULL;\n\n }\n\n\n\n qemu_chr_fe_claim_no_fail(chr);\n\n\n\n return chr;\n\n}\n"}} {"sample_id": "157e94e8a2f7d3e14060d833bd1519a83099eaa9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,21 +7,21 @@\n Error *err = NULL;\n \n \n+\n {\n \n Visitor *v = opts_visitor_new(opts);\n \n+ visit_type_NumaOptions(v, NULL, &object, &err);\n \n visit_free(v);\n \n }\n \n+\n+\n if (err) {\n+\n goto error;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int parse_numa(void *opaque, QemuOpts *opts, Error **errp)\n\n{\n\n NumaOptions *object = NULL;\n\n Error *err = NULL;\n\n\n\n {\n\n Visitor *v = opts_visitor_new(opts);\n\n visit_type_NumaOptions(v, NULL, &object, &err);\n\n visit_free(v);\n\n }\n\n\n\n if (err) {\n\n goto error;\n\n }\n\n\n\n switch (object->type) {\n\n case NUMA_OPTIONS_KIND_NODE:\n\n numa_node_parse(object->u.node.data, opts, &err);\n\n if (err) {\n\n goto error;\n\n }\n\n nb_numa_nodes++;\n\n break;\n\n default:\n\n abort();\n\n }\n\n\n\n return 0;\n\n\n\nerror:\n\n error_report_err(err);\n\n qapi_free_NumaOptions(object);\n\n\n\n return -1;\n\n}\n"}} {"sample_id": "9bd7854e1e5d6f4cfe4558090bbd9493c12bf846_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,10 +2,10 @@\n \n {\n \n+ char buf[4096];\n+\n+ va_list ap;\n+\n va_start(ap, fmt);\n \n vsnprintf(buf, sizeof(buf), fmt, ap);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_chr_printf(CharDriverState *s, const char *fmt, ...)\n\n{\n\n char buf[4096];\n\n va_list ap;\n\n va_start(ap, fmt);\n\n vsnprintf(buf, sizeof(buf), fmt, ap);\n\n qemu_chr_write(s, (uint8_t *)buf, strlen(buf));\n\n va_end(ap);\n\n}\n"}} {"sample_id": "c6d2283068026035a6468aae9dcde953bd7521ac_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n int bdrv_get_dirty(BlockDriverState *bs, int64_t sector)\n \n+{\n+\n int64_t chunk = sector / (int64_t)BDRV_SECTORS_PER_DIRTY_CHUNK;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int bdrv_get_dirty(BlockDriverState *bs, int64_t sector)\n\n{\n\n int64_t chunk = sector / (int64_t)BDRV_SECTORS_PER_DIRTY_CHUNK;\n\n\n\n if (bs->dirty_bitmap != NULL &&\n\n (sector << BDRV_SECTOR_BITS) <= bdrv_getlength(bs)) {\n\n return bs->dirty_bitmap[chunk];\n\n } else {\n\n return 0;\n\n }\n\n}\n"}} {"sample_id": "b952b5589a36114e06201c0d2e82c293dbad2b1f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int coroutine_fn mirror_iteration(MirrorBlockJob *s)\n \n {\n \n@@ -15,9 +15,9 @@\n struct iovec iov;\n \n \n+\n end = s->common.len >> BDRV_SECTOR_BITS;\n+\n s->sector_num = bdrv_get_next_dirty(source, s->sector_num);\n \n nb_sectors = MIN(BDRV_SECTORS_PER_DIRTY_CHUNK, end - s->sector_num);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int coroutine_fn mirror_iteration(MirrorBlockJob *s)\n\n{\n\n BlockDriverState *source = s->common.bs;\n\n BlockDriverState *target = s->target;\n\n QEMUIOVector qiov;\n\n int ret, nb_sectors;\n\n int64_t end;\n\n struct iovec iov;\n\n\n\n end = s->common.len >> BDRV_SECTOR_BITS;\n\n s->sector_num = bdrv_get_next_dirty(source, s->sector_num);\n\n nb_sectors = MIN(BDRV_SECTORS_PER_DIRTY_CHUNK, end - s->sector_num);\n\n bdrv_reset_dirty(source, s->sector_num, nb_sectors);\n\n\n\n /* Copy the dirty cluster. */\n\n iov.iov_base = s->buf;\n\n iov.iov_len = nb_sectors * 512;\n\n qemu_iovec_init_external(&qiov, &iov, 1);\n\n\n\n trace_mirror_one_iteration(s, s->sector_num, nb_sectors);\n\n ret = bdrv_co_readv(source, s->sector_num, nb_sectors, &qiov);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n return bdrv_co_writev(target, s->sector_num, nb_sectors, &qiov);\n\n}\n"}} {"sample_id": "ff047453f56713aa627e63aade1a9046ccd3bdfd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n abort();\n \n }\n+\n+\n+\n+ cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len;\n+\n memcpy(cpu->cpreg_vmstate_indexes, cpu->cpreg_indexes,\n \n cpu->cpreg_array_len * sizeof(uint64_t));", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void cpu_pre_save(void *opaque)\n\n{\n\n ARMCPU *cpu = opaque;\n\n\n\n if (!write_cpustate_to_list(cpu)) {\n\n /* This should never fail. */\n\n abort();\n\n }\n\n\n\n cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len;\n\n memcpy(cpu->cpreg_vmstate_indexes, cpu->cpreg_indexes,\n\n cpu->cpreg_array_len * sizeof(uint64_t));\n\n memcpy(cpu->cpreg_vmstate_values, cpu->cpreg_values,\n\n cpu->cpreg_array_len * sizeof(uint64_t));\n\n}\n"}} {"sample_id": "97e89ee914411384dcda771d38bf89f13726d71e_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void gen_window_check2(DisasContext *dc, unsigned r1, unsigned r2)\n+\n {\n \n gen_window_check1(dc, r1 > r2 ? r1 : r2);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void gen_window_check2(DisasContext *dc, unsigned r1, unsigned r2)\n\n{\n\n gen_window_check1(dc, r1 > r2 ? r1 : r2);\n\n}\n"}} {"sample_id": "97f90cbfe810bb153fc44bde732d9639610783bb_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n addr, mask, wr);\n \n if (!(env->sregs[SR_MSR] & MSR_EE)) {\n+\n+ return;\n+\n+ }\n+\n \n \n env->sregs[SR_ESR] = ESR_EC_UNALIGNED_DATA | (wr << 10) \\", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void helper_memalign(uint32_t addr, uint32_t dr, uint32_t wr, uint32_t mask)\n\n{\n\n if (addr & mask) {\n\n qemu_log(\"unaligned access addr=%x mask=%x, wr=%d\\n\",\n\n addr, mask, wr);\n\n if (!(env->sregs[SR_MSR] & MSR_EE)) {\n\n return;\n\n }\n\n\n\n env->sregs[SR_ESR] = ESR_EC_UNALIGNED_DATA | (wr << 10) \\\n\n | (dr & 31) << 5;\n\n if (mask == 3) {\n\n env->sregs[SR_ESR] |= 1 << 11;\n\n }\n\n helper_raise_exception(EXCP_HW_EXCP);\n\n }\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_123", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n \n \n s->stdio_file = stdio_file;\n+\n+\n+\n+ if (mode[0] == 'r') {\n+\n s->file = qemu_fopen_ops(s, &stdio_pipe_read_ops);\n \n } else {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "QEMUFile *qemu_popen_cmd(const char *command, const char *mode)\n\n{\n\n FILE *stdio_file;\n\n QEMUFileStdio *s;\n\n\n\n if (mode == NULL || (mode[0] != 'r' && mode[0] != 'w') || mode[1] != 0) {\n\n fprintf(stderr, \"qemu_popen: Argument validity check failed\\n\");\n\n return NULL;\n\n }\n\n\n\n stdio_file = popen(command, mode);\n\n if (stdio_file == NULL) {\n\n return NULL;\n\n }\n\n\n\n s = g_malloc0(sizeof(QEMUFileStdio));\n\n\n\n s->stdio_file = stdio_file;\n\n\n\n if (mode[0] == 'r') {\n\n s->file = qemu_fopen_ops(s, &stdio_pipe_read_ops);\n\n } else {\n\n s->file = qemu_fopen_ops(s, &stdio_pipe_write_ops);\n\n }\n\n return s->file;\n\n}\n"}} {"sample_id": "29ba091136a5e04574f7bfc1b17536c923958f6f_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n const char *postproc_configuration(void)\n \n {\n+\n return FFMPEG_CONFIGURATION;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "const char *postproc_configuration(void)\n\n{\n\n return FFMPEG_CONFIGURATION;\n\n}\n"}} {"sample_id": "0b8b8753e4d94901627b3e86431230f2319215c4_15", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,7 +16,7 @@\n \n cb->status = BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID | offset;\n \n+ *cb->file = cb->bs->file->bs;\n \n break;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void qed_is_allocated_cb(void *opaque, int ret, uint64_t offset, size_t len)\n\n{\n\n QEDIsAllocatedCB *cb = opaque;\n\n BDRVQEDState *s = cb->bs->opaque;\n\n *cb->pnum = len / BDRV_SECTOR_SIZE;\n\n switch (ret) {\n\n case QED_CLUSTER_FOUND:\n\n offset |= qed_offset_into_cluster(s, cb->pos);\n\n cb->status = BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID | offset;\n\n *cb->file = cb->bs->file->bs;\n\n break;\n\n case QED_CLUSTER_ZERO:\n\n cb->status = BDRV_BLOCK_ZERO;\n\n break;\n\n case QED_CLUSTER_L2:\n\n case QED_CLUSTER_L1:\n\n cb->status = 0;\n\n break;\n\n default:\n\n assert(ret < 0);\n\n cb->status = ret;\n\n break;\n\n }\n\n\n\n if (cb->co) {\n\n qemu_coroutine_enter(cb->co, NULL);\n\n }\n\n}\n"}} {"sample_id": "40ff6d7e8dceca227e7f8a3e8e0d58b2c66d19b4_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int qemu_event_init(void)\n \n {\n+\n int err;\n \n int fds[2];", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int qemu_event_init(void)\n\n{\n\n int err;\n\n int fds[2];\n\n\n\n err = pipe(fds);\n\n if (err == -1)\n\n return -errno;\n\n\n\n err = fcntl_setfl(fds[0], O_NONBLOCK);\n\n if (err < 0)\n\n goto fail;\n\n\n\n err = fcntl_setfl(fds[1], O_NONBLOCK);\n\n if (err < 0)\n\n goto fail;\n\n\n\n qemu_set_fd_handler2(fds[0], NULL, qemu_event_read, NULL,\n\n (void *)(unsigned long)fds[0]);\n\n\n\n io_thread_fd = fds[1];\n\n return 0;\n\n\n\nfail:\n\n close(fds[0]);\n\n close(fds[1]);\n\n return err;\n\n}\n"}} {"sample_id": "acfb23ad3dd8d0ab385a10e483776ba7dcf927ad_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,9 +21,9 @@\n \n \n g_assert(!aio_poll(ctx, false));\n+\n+ g_assert_cmpint(data.n, ==, 1);\n+\n+ qemu_bh_delete(data.bh);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_bh_flush(void)\n\n{\n\n BHTestData data = { .n = 0 };\n\n data.bh = aio_bh_new(ctx, bh_test_cb, &data);\n\n\n\n qemu_bh_schedule(data.bh);\n\n g_assert_cmpint(data.n, ==, 0);\n\n\n\n wait_for_aio();\n\n g_assert_cmpint(data.n, ==, 1);\n\n\n\n g_assert(!aio_poll(ctx, false));\n\n g_assert_cmpint(data.n, ==, 1);\n\n qemu_bh_delete(data.bh);\n\n}\n"}} {"sample_id": "e2f0c49ffae8d3a00272c3cbc68850cc5aafbffa", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,8 +21,8 @@\n DPRINTF(\"Read TOC (track %d format %d msf %d)\\n\", start_track, format, msf >> 1);\n \n nb_sectors /= s->qdev.blocksize / 512;\n+\n+ switch (format) {\n \n case 0:\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int scsi_disk_emulate_read_toc(SCSIRequest *req, uint8_t *outbuf)\n\n{\n\n SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);\n\n int start_track, format, msf, toclen;\n\n uint64_t nb_sectors;\n\n\n\n msf = req->cmd.buf[1] & 2;\n\n format = req->cmd.buf[2] & 0xf;\n\n start_track = req->cmd.buf[6];\n\n bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);\n\n DPRINTF(\"Read TOC (track %d format %d msf %d)\\n\", start_track, format, msf >> 1);\n\n nb_sectors /= s->qdev.blocksize / 512;\n\n switch (format) {\n\n case 0:\n\n toclen = cdrom_read_toc(nb_sectors, outbuf, msf, start_track);\n\n break;\n\n case 1:\n\n /* multi session : only a single session defined */\n\n toclen = 12;\n\n memset(outbuf, 0, 12);\n\n outbuf[1] = 0x0a;\n\n outbuf[2] = 0x01;\n\n outbuf[3] = 0x01;\n\n break;\n\n case 2:\n\n toclen = cdrom_read_toc_raw(nb_sectors, outbuf, msf, start_track);\n\n break;\n\n default:\n\n return -1;\n\n }\n\n if (toclen > req->cmd.xfer) {\n\n toclen = req->cmd.xfer;\n\n }\n\n return toclen;\n\n}\n"}} {"sample_id": "c508277335e3b6b20cf18e6ea3a35c1fa835c64a_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void vmxnet3_set_events(VMXNET3State *s, uint32_t val)\n \n {\n+\n+ uint32_t events;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void vmxnet3_set_events(VMXNET3State *s, uint32_t val)\n\n{\n\n uint32_t events;\n\n\n\n VMW_CBPRN(\"Setting events: 0x%x\", val);\n\n events = VMXNET3_READ_DRV_SHARED32(s->drv_shmem, ecr) | val;\n\n VMXNET3_WRITE_DRV_SHARED32(s->drv_shmem, ecr, events);\n\n}\n"}} {"sample_id": "d17008bc2914d62fd0af6a8f313604ae9f9a102c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static uint32_t hpet_time_after64(uint64_t a, uint64_t b)\n+\n {\n \n return ((int64_t)(b) - (int64_t)(a) < 0);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint32_t hpet_time_after64(uint64_t a, uint64_t b)\n\n{\n\n return ((int64_t)(b) - (int64_t)(a) < 0);\n\n}\n"}} {"sample_id": "a99dfb45f26bface6830ee5465e57bcdbc53c6c8_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n {\n \n+ int i;\n \n uint64_t mask = stop_flags | L2E_OFFSET_MASK | QCOW_OFLAG_COMPRESSED;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int count_contiguous_clusters(int nb_clusters, int cluster_size,\n\n uint64_t *l2_table, uint64_t stop_flags)\n\n{\n\n int i;\n\n uint64_t mask = stop_flags | L2E_OFFSET_MASK | QCOW_OFLAG_COMPRESSED;\n\n uint64_t first_entry = be64_to_cpu(l2_table[0]);\n\n uint64_t offset = first_entry & mask;\n\n\n\n if (!offset)\n\n return 0;\n\n\n\n assert(qcow2_get_cluster_type(first_entry) != QCOW2_CLUSTER_COMPRESSED);\n\n\n\n for (i = 0; i < nb_clusters; i++) {\n\n uint64_t l2_entry = be64_to_cpu(l2_table[i]) & mask;\n\n if (offset + (uint64_t) i * cluster_size != l2_entry) {\n\n break;\n\n }\n\n }\n\n\n\n\treturn i;\n\n}\n"}} {"sample_id": "fc9f38c3c0f42b7e98957b646976ee5b63f23806", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n sPAPRMachineClass *smc = SPAPR_MACHINE_CLASS(mc);\n \n \n+\n+ mc->alias = \"pseries\";\n+\n mc->is_default = 1;\n \n smc->dr_lmb_enabled = true;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void spapr_machine_2_5_class_options(MachineClass *mc)\n\n{\n\n sPAPRMachineClass *smc = SPAPR_MACHINE_CLASS(mc);\n\n\n\n mc->alias = \"pseries\";\n\n mc->is_default = 1;\n\n smc->dr_lmb_enabled = true;\n\n}\n"}} {"sample_id": "e911765cbb9e9ddf5d952c88bb52180a62c6cea0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n unsigned iov_copy(struct iovec *dst_iov, unsigned int dst_iov_cnt,\n \n const struct iovec *iov, unsigned int iov_cnt,\n+\n size_t offset, size_t bytes)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "unsigned iov_copy(struct iovec *dst_iov, unsigned int dst_iov_cnt,\n\n const struct iovec *iov, unsigned int iov_cnt,\n\n size_t offset, size_t bytes)\n\n{\n\n size_t len;\n\n unsigned int i, j;\n\n for (i = 0, j = 0; i < iov_cnt && j < dst_iov_cnt && bytes; i++) {\n\n if (offset >= iov[i].iov_len) {\n\n offset -= iov[i].iov_len;\n\n continue;\n\n }\n\n len = MIN(bytes, iov[i].iov_len - offset);\n\n\n\n dst_iov[j].iov_base = iov[i].iov_base + offset;\n\n dst_iov[j].iov_len = len;\n\n j++;\n\n bytes -= len;\n\n offset = 0;\n\n }\n\n assert(offset == 0);\n\n return j;\n\n}\n"}} {"sample_id": "6d0ceb80ffe18ad4b28aab7356f440636c0be7be_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n int ret = 0;\n \n+\n+\n+ if (runstate_is_running()) {\n+\n+ cpu_disable_ticks();\n \n pause_all_vcpus();\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int do_vm_stop(RunState state)\n\n{\n\n int ret = 0;\n\n\n\n if (runstate_is_running()) {\n\n cpu_disable_ticks();\n\n pause_all_vcpus();\n\n runstate_set(state);\n\n vm_state_notify(0, state);\n\n qapi_event_send_stop(&error_abort);\n\n }\n\n\n\n bdrv_drain_all();\n\n\n ret = blk_flush_all();\n\n\n\n return ret;\n\n}"}} {"sample_id": "da8242e2d6f85d95239082efd0e5e2345e685a2c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n \n \n switch (avctx->codec->id) {\n+\n+ case AV_CODEC_ID_8SVX_FIB: esc->table = fibonacci; break;\n+\n+ case AV_CODEC_ID_8SVX_EXP: esc->table = exponential; break;\n+\n case AV_CODEC_ID_PCM_S8_PLANAR:\n \n case AV_CODEC_ID_8SVX_RAW: esc->table = NULL; break;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int eightsvx_decode_init(AVCodecContext *avctx)\n\n{\n\n EightSvxContext *esc = avctx->priv_data;\n\n\n\n if (avctx->channels < 1 || avctx->channels > 2) {\n\n av_log(avctx, AV_LOG_ERROR, \"8SVX does not support more than 2 channels\\n\");\n\n return AVERROR_INVALIDDATA;\n\n }\n\n\n\n switch (avctx->codec->id) {\n\n case AV_CODEC_ID_8SVX_FIB: esc->table = fibonacci; break;\n\n case AV_CODEC_ID_8SVX_EXP: esc->table = exponential; break;\n\n case AV_CODEC_ID_PCM_S8_PLANAR:\n\n case AV_CODEC_ID_8SVX_RAW: esc->table = NULL; break;\n\n default:\n\n av_log(avctx, AV_LOG_ERROR, \"Invalid codec id %d.\\n\", avctx->codec->id);\n\n return AVERROR_INVALIDDATA;\n\n }\n\n avctx->sample_fmt = AV_SAMPLE_FMT_U8P;\n\n\n\n avcodec_get_frame_defaults(&esc->frame);\n\n avctx->coded_frame = &esc->frame;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "229843aa359ae0c9519977d7fa952688db63f559_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int ftp_close(URLContext *h)\n \n+{\n+\n+ FTPContext *s = h->priv_data;\n+\n+\n \n av_dlog(h, \"ftp protocol close\\n\");\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ftp_close(URLContext *h)\n\n{\n\n FTPContext *s = h->priv_data;\n\n\n\n av_dlog(h, \"ftp protocol close\\n\");\n\n\n\n ftp_close_both_connections(s);\n\n av_freep(&s->user);\n\n av_freep(&s->password);\n\n av_freep(&s->hostname);\n\n av_freep(&s->path);\n\n av_freep(&s->features);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "788cf9f8c8cbda53843e060540f3e91a060eb744_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n+static void bdrv_password_cb(void *opaque, const char *password,\n+\n+ void *readline_opaque)\n+\n+{\n+\n+ Monitor *mon = opaque;\n+\n+ BlockDriverState *bs = readline_opaque;\n \n+ int ret = 0;\n+\n Error *local_err = NULL;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void bdrv_password_cb(void *opaque, const char *password,\n\n void *readline_opaque)\n\n{\n\n Monitor *mon = opaque;\n\n BlockDriverState *bs = readline_opaque;\n\n int ret = 0;\n\n Error *local_err = NULL;\n\n\n\n bdrv_add_key(bs, password, &local_err);\n\n if (local_err) {\n\n error_report_err(local_err);\n\n ret = -EPERM;\n\n }\n\n if (mon->password_completion_cb)\n\n mon->password_completion_cb(mon->password_opaque, ret);\n\n\n\n monitor_read_command(mon, 1);\n\n}\n"}} {"sample_id": "eb2f9b024d68884a3b25e63e4dbf90b67f8da236", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static inline void vmsvga_check_size(struct vmsvga_state_s *s)\n \n+{\n+\n DisplaySurface *surface = qemu_console_surface(s->vga.con);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static inline void vmsvga_check_size(struct vmsvga_state_s *s)\n\n{\n\n DisplaySurface *surface = qemu_console_surface(s->vga.con);\n\n\n\n if (s->new_width != surface_width(surface) ||\n\n s->new_height != surface_height(surface)) {\n\n qemu_console_resize(s->vga.con, s->new_width, s->new_height);\n\n s->invalidated = 1;\n\n }\n\n}\n"}} {"sample_id": "a9fc37f6bc3f2ab90585cb16493da9f6dcfbfbcf_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n /* FIXME: qobject_to_qint mishandles values over INT64_MAX */\n \n QObjectInputVisitor *qiv = to_qiv(v);\n+\n QObject *qobj = qobject_input_get_object(qiv, name, true, errp);\n \n QInt *qint;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void qobject_input_type_uint64(Visitor *v, const char *name,\n\n uint64_t *obj, Error **errp)\n\n{\n\n /* FIXME: qobject_to_qint mishandles values over INT64_MAX */\n\n QObjectInputVisitor *qiv = to_qiv(v);\n\n QObject *qobj = qobject_input_get_object(qiv, name, true, errp);\n\n QInt *qint;\n\n\n\n if (!qobj) {\n\n return;\n\n }\n\n qint = qobject_to_qint(qobj);\n\n if (!qint) {\n\n error_setg(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : \"null\",\n\n \"integer\");\n\n return;\n\n }\n\n\n\n *obj = qint_get_int(qint);\n\n}\n"}} {"sample_id": "1745eaaa7c53c6090d53090d239d0234a7ecfd2d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n return 0;\n \n+ if (shutdown_requested)\n+\n+ return 0;\n+\n+ if (debug_requested)\n \n return 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int vm_can_run(void)\n\n{\n\n if (powerdown_requested)\n\n return 0;\n\n if (reset_requested)\n\n return 0;\n\n if (shutdown_requested)\n\n return 0;\n\n if (debug_requested)\n\n return 0;\n\n return 1;\n\n}\n"}} {"sample_id": "09b9418c6d085a0728372aa760ebd10128a020b1_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static target_long monitor_get_pc (const struct MonitorDef *md, int val)\n \n+{\n \n CPUState *env = mon_get_cpu();\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static target_long monitor_get_pc (const struct MonitorDef *md, int val)\n\n{\n\n CPUState *env = mon_get_cpu();\n\n if (!env)\n\n return 0;\n\n return env->eip + env->segs[R_CS].base;\n\n}\n"}} {"sample_id": "77af8a2b95b79699de650965d5228772743efe84", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n build_fadt(GArray *table_data, BIOSLinker *linker, AcpiPmInfo *pm,\n \n+ unsigned facs_tbl_offset, unsigned dsdt_tbl_offset,\n+\n+ const char *oem_id, const char *oem_table_id)\n+\n+{\n \n AcpiFadtDescriptorRev1 *fadt = acpi_data_push(table_data, sizeof(*fadt));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "build_fadt(GArray *table_data, BIOSLinker *linker, AcpiPmInfo *pm,\n\n unsigned facs_tbl_offset, unsigned dsdt_tbl_offset,\n\n const char *oem_id, const char *oem_table_id)\n\n{\n\n AcpiFadtDescriptorRev1 *fadt = acpi_data_push(table_data, sizeof(*fadt));\n\n unsigned fw_ctrl_offset = (char *)&fadt->firmware_ctrl - table_data->data;\n\n unsigned dsdt_entry_offset = (char *)&fadt->dsdt - table_data->data;\n\n\n\n /* FACS address to be filled by Guest linker */\n\n bios_linker_loader_add_pointer(linker,\n\n ACPI_BUILD_TABLE_FILE, fw_ctrl_offset, sizeof(fadt->firmware_ctrl),\n\n ACPI_BUILD_TABLE_FILE, facs_tbl_offset);\n\n\n\n /* DSDT address to be filled by Guest linker */\n\n fadt_setup(fadt, pm);\n\n bios_linker_loader_add_pointer(linker,\n\n ACPI_BUILD_TABLE_FILE, dsdt_entry_offset, sizeof(fadt->dsdt),\n\n ACPI_BUILD_TABLE_FILE, dsdt_tbl_offset);\n\n\n\n build_header(linker, table_data,\n\n (void *)fadt, \"FACP\", sizeof(*fadt), 1, oem_id, oem_table_id);\n\n}\n"}} {"sample_id": "18ce63a60e1bffc35b4df5d8a4f9a1ff1a96cb9a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n libAVFilter_QueryVendorInfo(libAVFilter *this, wchar_t **info)\n \n {\n+\n+ dshowdebug(\"libAVFilter_QueryVendorInfo(%p)\\n\", this);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-89", "target_file": "source.c", "files": {"source.c": "libAVFilter_QueryVendorInfo(libAVFilter *this, wchar_t **info)\n\n{\n\n dshowdebug(\"libAVFilter_QueryVendorInfo(%p)\\n\", this);\n\n\n\n if (!info)\n\n return E_POINTER;\n\n *info = wcsdup(L\"libAV\");\n\n\n\n return S_OK;\n\n}\n"}} {"sample_id": "bd269ebc82fbaa5fe7ce5bc7c1770ac8acecd884_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n QIOChannelSocket *sioc = qio_channel_socket_new();\n \n char *name;\n+\n+ UdpChardev *s = UDP_CHARDEV(chr);\n+\n+\n+\n if (qio_channel_socket_dgram_sync(sioc,\n \n udp->local, udp->remote,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qmp_chardev_open_udp(Chardev *chr,\n\n ChardevBackend *backend,\n\n bool *be_opened,\n\n Error **errp)\n\n{\n\n ChardevUdp *udp = backend->u.udp.data;\n\n QIOChannelSocket *sioc = qio_channel_socket_new();\n\n char *name;\n\n UdpChardev *s = UDP_CHARDEV(chr);\n\n\n\n if (qio_channel_socket_dgram_sync(sioc,\n\n udp->local, udp->remote,\n\n errp) < 0) {\n\n object_unref(OBJECT(sioc));\n\n return;\n\n }\n\n\n\n name = g_strdup_printf(\"chardev-udp-%s\", chr->label);\n\n qio_channel_set_name(QIO_CHANNEL(sioc), name);\n\n g_free(name);\n\n\n\n s->ioc = QIO_CHANNEL(sioc);\n\n /* be isn't opened until we get a connection */\n\n *be_opened = false;\n\n}\n"}} {"sample_id": "5e54769c921a3d8cd8858444f5a3fa62cc44260e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void execute_async(DWORD WINAPI (*func)(LPVOID), LPVOID opaque,\n \n+ Error **errp)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void execute_async(DWORD WINAPI (*func)(LPVOID), LPVOID opaque,\n\n Error **errp)\n\n{\n\n Error *local_err = NULL;\n\n\n\n if (error_is_set(errp)) {\n\n return;\n\n }\n\n HANDLE thread = CreateThread(NULL, 0, func, opaque, 0, NULL);\n\n if (!thread) {\n\n error_set(&local_err, QERR_QGA_COMMAND_FAILED,\n\n \"failed to dispatch asynchronous command\");\n\n error_propagate(errp, local_err);\n\n }\n\n}\n"}} {"sample_id": "4d6a0680fa425230748a2d91d81be9afe050eeb3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,7 +24,7 @@\n \n } else {\n \n+ write_cb = ctx->spr_cb[sprn].oea_write;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void gen_mtspr(DisasContext *ctx)\n\n{\n\n void (*write_cb)(DisasContext *ctx, int sprn, int gprn);\n\n uint32_t sprn = SPR(ctx->opcode);\n\n\n\n#if defined(CONFIG_USER_ONLY)\n\n write_cb = ctx->spr_cb[sprn].uea_write;\n\n#else\n\n if (ctx->pr) {\n\n write_cb = ctx->spr_cb[sprn].uea_write;\n\n } else if (ctx->hv) {\n\n write_cb = ctx->spr_cb[sprn].hea_write;\n\n } else {\n\n write_cb = ctx->spr_cb[sprn].oea_write;\n\n }\n\n#endif\n\n if (likely(write_cb != NULL)) {\n\n if (likely(write_cb != SPR_NOACCESS)) {\n\n (*write_cb)(ctx, sprn, rS(ctx->opcode));\n\n } else {\n\n /* Privilege exception */\n\n fprintf(stderr, \"Trying to write privileged spr %d (0x%03x) at \"\n\n TARGET_FMT_lx \"\\n\", sprn, sprn, ctx->nip - 4);\n\n if (qemu_log_separate()) {\n\n qemu_log(\"Trying to write privileged spr %d (0x%03x) at \"\n\n TARGET_FMT_lx \"\\n\", sprn, sprn, ctx->nip - 4);\n\n }\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_REG);\n\n }\n\n } else {\n\n /* Not defined */\n\n if (qemu_log_separate()) {\n\n qemu_log(\"Trying to write invalid spr %d (0x%03x) at \"\n\n TARGET_FMT_lx \"\\n\", sprn, sprn, ctx->nip - 4);\n\n }\n\n fprintf(stderr, \"Trying to write invalid spr %d (0x%03x) at \"\n\n TARGET_FMT_lx \"\\n\", sprn, sprn, ctx->nip - 4);\n\n gen_inval_exception(ctx, POWERPC_EXCP_INVAL_SPR);\n\n }\n\n}\n"}} {"sample_id": "f19af812a32c1398d48c3550d11dbc6aafbb2bfc_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n int is_adx(const unsigned char *buf,size_t bufsize)\n+\n+{\n+\n+\tint\toffset;\n+\n \n \n \tif (buf[0]!=0x80) return 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int is_adx(const unsigned char *buf,size_t bufsize)\n\n{\n\n\tint\toffset;\n\n\n\n\tif (buf[0]!=0x80) return 0;\n\n\toffset = (read_long(buf)^0x80000000)+4;\n\n\tif (bufsizebase = base;\n+\n+ memory_region_init_io(&mmio->iomem, &subpage_ops, mmio,\n \n \"subpage\", TARGET_PAGE_SIZE);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static subpage_t *subpage_init(target_phys_addr_t base)\n\n{\n\n subpage_t *mmio;\n\n\n\n mmio = g_malloc0(sizeof(subpage_t));\n\n\n\n mmio->base = base;\n\n memory_region_init_io(&mmio->iomem, &subpage_ops, mmio,\n\n \"subpage\", TARGET_PAGE_SIZE);\n\n mmio->iomem.subpage = true;\n\n#if defined(DEBUG_SUBPAGE)\n\n printf(\"%s: %p base \" TARGET_FMT_plx \" len %08x %d\\n\", __func__,\n\n mmio, base, TARGET_PAGE_SIZE, subpage_memory);\n\n#endif\n\n subpage_register(mmio, 0, TARGET_PAGE_SIZE-1, phys_section_unassigned);\n\n\n\n return mmio;\n\n}\n"}} {"sample_id": "d9654a58576dae982458bdb1eb565c9876c24c22", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n read_help(void)\n+\n {\n \n \tprintf(", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "read_help(void)\n\n{\n\n\tprintf(\n\n\"\\n\"\n\n\" reads a range of bytes from the given offset\\n\"\n\n\"\\n\"\n\n\" Example:\\n\"\n\n\" 'read -v 512 1k' - dumps 1 kilobyte read from 512 bytes into the file\\n\"\n\n\"\\n\"\n\n\" Reads a segment of the currently open file, optionally dumping it to the\\n\"\n\n\" standard output stream (with -v option) for subsequent inspection.\\n\"\n\n\" -p, -- use bdrv_pread to read the file\\n\"\n\n\" -P, -- use a pattern to verify read data\\n\"\n\n\" -C, -- report statistics in a machine parsable format\\n\"\n\n\" -v, -- dump buffer to standard output\\n\"\n\n\" -q, -- quite mode, do not show I/O statistics\\n\"\n\n\"\\n\");\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_172", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void bitband_writeb(void *opaque, target_phys_addr_t offset,\n \n uint32_t value)\n+\n+{\n+\n+ uint32_t addr;\n+\n uint8_t mask;\n \n uint8_t v;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bitband_writeb(void *opaque, target_phys_addr_t offset,\n\n uint32_t value)\n\n{\n\n uint32_t addr;\n\n uint8_t mask;\n\n uint8_t v;\n\n addr = bitband_addr(opaque, offset);\n\n mask = (1 << ((offset >> 2) & 7));\n\n cpu_physical_memory_read(addr, &v, 1);\n\n if (value & 1)\n\n v |= mask;\n\n else\n\n v &= ~mask;\n\n cpu_physical_memory_write(addr, &v, 1);\n\n}\n"}} {"sample_id": "fc3b32958a80bca13309e2695de07b43dd788421", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n field->type = type;\n \n field->offset = cpu_to_le16(offset);\n+\n+ memcpy(field->data, data, len);\n+\n+\n+\n smbios_entries_len += sizeof(*field) + len;\n \n (*(uint16_t *)smbios_entries) =", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void smbios_add_field(int type, int offset, const void *data, size_t len)\n\n{\n\n struct smbios_field *field;\n\n\n\n smbios_check_collision(type, SMBIOS_FIELD_ENTRY);\n\n\n\n if (!smbios_entries) {\n\n smbios_entries_len = sizeof(uint16_t);\n\n smbios_entries = g_malloc0(smbios_entries_len);\n\n }\n\n smbios_entries = g_realloc(smbios_entries, smbios_entries_len +\n\n sizeof(*field) + len);\n\n field = (struct smbios_field *)(smbios_entries + smbios_entries_len);\n\n field->header.type = SMBIOS_FIELD_ENTRY;\n\n field->header.length = cpu_to_le16(sizeof(*field) + len);\n\n\n\n field->type = type;\n\n field->offset = cpu_to_le16(offset);\n\n memcpy(field->data, data, len);\n\n\n\n smbios_entries_len += sizeof(*field) + len;\n\n (*(uint16_t *)smbios_entries) =\n\n cpu_to_le16(le16_to_cpu(*(uint16_t *)smbios_entries) + 1);\n\n}\n"}} {"sample_id": "4a1418e07bdcfaa3177739e04707ecaec75d89e1_30", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n \n \n+ env = cpu_single_env;\n+\n+ if (!env)\n+\n return;\n \n env->eflags = (env->eflags & ~(IF_MASK | IOPL_MASK)) | ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qpi_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)\n\n{\n\n CPUState *env;\n\n\n\n env = cpu_single_env;\n\n if (!env)\n\n return;\n\n env->eflags = (env->eflags & ~(IF_MASK | IOPL_MASK)) | \n\n (val & (IF_MASK | IOPL_MASK));\n\n}\n"}} {"sample_id": "14324f585d76abd8a609c119d627503e6a0961be", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void test_io_channel_command_fifo(bool async)\n \n {\n+\n+#define TEST_FIFO \"tests/test-io-channel-command.fifo\"\n \n QIOChannel *src, *dst;\n \n@@ -21,8 +21,8 @@\n const char *dstargv[] = {\n \n \"/bin/socat\", dstfifo, \"-\", NULL,\n+\n+ };\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void test_io_channel_command_fifo(bool async)\n\n{\n\n#define TEST_FIFO \"tests/test-io-channel-command.fifo\"\n\n QIOChannel *src, *dst;\n\n QIOChannelTest *test;\n\n char *srcfifo = g_strdup_printf(\"PIPE:%s,wronly\", TEST_FIFO);\n\n char *dstfifo = g_strdup_printf(\"PIPE:%s,rdonly\", TEST_FIFO);\n\n const char *srcargv[] = {\n\n \"/bin/socat\", \"-\", srcfifo, NULL,\n\n };\n\n const char *dstargv[] = {\n\n \"/bin/socat\", dstfifo, \"-\", NULL,\n\n };\n\n\n\n unlink(TEST_FIFO);\n\n if (access(\"/bin/socat\", X_OK) < 0) {\n\n return; /* Pretend success if socat is not present */\n\n }\n\n if (mkfifo(TEST_FIFO, 0600) < 0) {\n\n abort();\n\n }\n\n src = QIO_CHANNEL(qio_channel_command_new_spawn(srcargv,\n\n O_WRONLY,\n\n &error_abort));\n\n dst = QIO_CHANNEL(qio_channel_command_new_spawn(dstargv,\n\n O_RDONLY,\n\n &error_abort));\n\n\n\n test = qio_channel_test_new();\n\n qio_channel_test_run_threads(test, async, src, dst);\n\n qio_channel_test_validate(test);\n\n\n\n object_unref(OBJECT(src));\n\n object_unref(OBJECT(dst));\n\n\n\n g_free(srcfifo);\n\n g_free(dstfifo);\n\n unlink(TEST_FIFO);\n\n}\n"}} {"sample_id": "e1d4fb2de594ab0cbe78846bc79617b9bd50c867", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n entry = g_new0(MSIRouteEntry, 1);\n entry->dev = dev;\n entry->vector = vector;\n+ entry->virq = route->gsi;\n+ QLIST_INSERT_HEAD(&msi_route_list, entry, list);\n+ trace_kvm_x86_add_msi_route(route->gsi);\n+ return 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int kvm_arch_add_msi_route_post(struct kvm_irq_routing_entry *route,\n int vector, PCIDevice *dev)\n{\n static bool notify_list_inited = false;\n MSIRouteEntry *entry;\n if (!dev) {\n /* These are (possibly) IOAPIC routes only used for split\n * kernel irqchip mode, while what we are housekeeping are\n * PCI devices only. */\n return 0;\n entry = g_new0(MSIRouteEntry, 1);\n entry->dev = dev;\n entry->vector = vector;\n entry->virq = route->gsi;\n QLIST_INSERT_HEAD(&msi_route_list, entry, list);\n trace_kvm_x86_add_msi_route(route->gsi);\n return 0;"}} {"sample_id": "3ff91d7e85176f8b4b131163d7fd801757a2c949", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void tcg_gen_ld8s_i64(TCGv_i64 ret, TCGv_ptr arg2, tcg_target_long offset)\n \n+{\n \n tcg_gen_ld8s_i32(TCGV_LOW(ret), arg2, offset);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void tcg_gen_ld8s_i64(TCGv_i64 ret, TCGv_ptr arg2, tcg_target_long offset)\n\n{\n\n tcg_gen_ld8s_i32(TCGV_LOW(ret), arg2, offset);\n\n tcg_gen_sari_i32(TCGV_HIGH(ret), TCGV_HIGH(ret), 31);\n\n}\n"}} {"sample_id": "b1ade3d1821a29174963b28cd0caa5f7ed394998_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n \n \n for (n = 0; n < buffer_length; n++) {\n+\n+ out[n] = in[n];\n+\n+ for (i = 1; i < filter_length; i++)\n+\n out[n] += filter_coeffs[i-1] * in[n-i];\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_celp_lp_zero_synthesis_filterf(float *out,\n\n const float* filter_coeffs,\n\n const float* in,\n\n int buffer_length,\n\n int filter_length)\n\n{\n\n int i,n;\n\n\n\n // Avoids a +1 in the inner loop.\n\n filter_length++;\n\n\n\n for (n = 0; n < buffer_length; n++) {\n\n out[n] = in[n];\n\n for (i = 1; i < filter_length; i++)\n\n out[n] += filter_coeffs[i-1] * in[n-i];\n\n }\n\n}\n"}} {"sample_id": "d6f2ea22a05b429ba83248b80a625b6fe1d927f3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n return NULL;\n \n+ }\n+\n+ lp->u.node = p = g_malloc0(sizeof(PhysPageEntry) * L2_SIZE);\n+\n+ if (i == 0) {\n \n for (j = 0; j < L2_SIZE; j++) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint16_t *phys_page_find_alloc(target_phys_addr_t index, int alloc)\n\n{\n\n PhysPageEntry *lp, *p;\n\n int i, j;\n\n\n\n lp = &phys_map;\n\n\n\n /* Level 1..N. */\n\n for (i = P_L2_LEVELS - 1; i >= 0; i--) {\n\n if (lp->u.node == NULL) {\n\n if (!alloc) {\n\n return NULL;\n\n }\n\n lp->u.node = p = g_malloc0(sizeof(PhysPageEntry) * L2_SIZE);\n\n if (i == 0) {\n\n for (j = 0; j < L2_SIZE; j++) {\n\n p[j].u.leaf = phys_section_unassigned;\n\n }\n\n }\n\n }\n\n lp = &lp->u.node[(index >> (i * L2_BITS)) & (L2_SIZE - 1)];\n\n }\n\n\n\n return &lp->u.leaf;\n\n}\n"}} {"sample_id": "d0eb91ad0451cdb6c062b2d4760bfa7f8bb4db6b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n tv.tv_sec = 0;\n \n tv.tv_usec = 100 * 1000;\n+\n+ ret = select(fd_max + 1, NULL, &wfds, NULL, &tv);\n+\n+ if (ret > 0 && FD_ISSET(s->fd, &wfds)) {\n+\n len = send(s->fd, buf, size, 0);\n \n if (len < 0) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int tcp_write(URLContext *h, const uint8_t *buf, int size)\n\n{\n\n TCPContext *s = h->priv_data;\n\n int ret, size1, fd_max, len;\n\n fd_set wfds;\n\n struct timeval tv;\n\n\n\n size1 = size;\n\n while (size > 0) {\n\n if (url_interrupt_cb())\n\n return AVERROR(EINTR);\n\n fd_max = s->fd;\n\n FD_ZERO(&wfds);\n\n FD_SET(s->fd, &wfds);\n\n tv.tv_sec = 0;\n\n tv.tv_usec = 100 * 1000;\n\n ret = select(fd_max + 1, NULL, &wfds, NULL, &tv);\n\n if (ret > 0 && FD_ISSET(s->fd, &wfds)) {\n\n len = send(s->fd, buf, size, 0);\n\n if (len < 0) {\n\n if (ff_neterrno() != FF_NETERROR(EINTR) &&\n\n ff_neterrno() != FF_NETERROR(EAGAIN))\n\n return ff_neterrno();\n\n continue;\n\n }\n\n size -= len;\n\n buf += len;\n\n } else if (ret < 0) {\n\n if (ff_neterrno() == FF_NETERROR(EINTR))\n\n continue;\n\n return -1;\n\n }\n\n }\n\n return size1 - size;\n\n}\n"}} {"sample_id": "b3db211f3c80bb996a704d665fe275619f728bd4_61", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n QString *qstr;\n \n+\n+\n+ *obj = NULL;\n+\n+ if (!qobj) {\n \n return;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qmp_input_type_str(Visitor *v, const char *name, char **obj,\n\n Error **errp)\n\n{\n\n QmpInputVisitor *qiv = to_qiv(v);\n\n QObject *qobj = qmp_input_get_object(qiv, name, true, errp);\n\n QString *qstr;\n\n\n\n *obj = NULL;\n\n if (!qobj) {\n\n return;\n\n }\n\n qstr = qobject_to_qstring(qobj);\n\n if (!qstr) {\n\n error_setg(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : \"null\",\n\n \"string\");\n\n return;\n\n }\n\n\n\n *obj = g_strdup(qstring_get_str(qstr));\n\n}\n"}} {"sample_id": "4f4321c11ff6e98583846bfd6f0e81954924b003", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static inline int usb_bt_fifo_dequeue(struct usb_hci_in_fifo_s *fifo,\n+\n USBPacket *p)\n+\n+{\n+\n int len;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static inline int usb_bt_fifo_dequeue(struct usb_hci_in_fifo_s *fifo,\n\n USBPacket *p)\n\n{\n\n int len;\n\n\n\n if (likely(!fifo->len))\n\n return USB_RET_STALL;\n\n\n\n len = MIN(p->len, fifo->fifo[fifo->start].len);\n\n memcpy(p->data, fifo->fifo[fifo->start].data, len);\n\n if (len == p->len) {\n\n fifo->fifo[fifo->start].len -= len;\n\n fifo->fifo[fifo->start].data += len;\n\n } else {\n\n fifo->start ++;\n\n fifo->start &= CFIFO_LEN_MASK;\n\n fifo->len --;\n\n }\n\n\n\n fifo->dstart += len;\n\n fifo->dlen -= len;\n\n if (fifo->dstart >= fifo->dsize) {\n\n fifo->dstart = 0;\n\n fifo->dsize = DFIFO_LEN_MASK + 1;\n\n }\n\n\n\n return len;\n\n}\n"}} {"sample_id": "515b69f8f8e9a24cfaee95d8c1f63f265d8582fe_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void check_pred8x8l(H264PredContext *h, uint8_t *buf0, uint8_t *buf1,\n+\n+ int codec, int chroma_format, int bit_depth)\n+\n+{\n \n if (chroma_format == 1 && codec_ids[codec] == AV_CODEC_ID_H264) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void check_pred8x8l(H264PredContext *h, uint8_t *buf0, uint8_t *buf1,\n\n int codec, int chroma_format, int bit_depth)\n\n{\n\n if (chroma_format == 1 && codec_ids[codec] == AV_CODEC_ID_H264) {\n\n int pred_mode;\n\n for (pred_mode = 0; pred_mode < 12; pred_mode++) {\n\n if (check_pred_func(h->pred8x8l[pred_mode], \"8x8l\", pred4x4_modes[codec][pred_mode])) {\n\n int neighbors;\n\n for (neighbors = 0; neighbors <= 0xc000; neighbors += 0x4000) {\n\n int has_topleft = neighbors & 0x8000;\n\n int has_topright = neighbors & 0x4000;\n\n\n\n if ((pred_mode == DIAG_DOWN_RIGHT_PRED || pred_mode == VERT_RIGHT_PRED) && !has_topleft)\n\n continue; /* Those aren't allowed according to the spec */\n\n\n\n randomize_buffers();\n\n call_ref(src0, has_topleft, has_topright, (ptrdiff_t)24*SIZEOF_PIXEL);\n\n call_new(src1, has_topleft, has_topright, (ptrdiff_t)24*SIZEOF_PIXEL);\n\n if (memcmp(buf0, buf1, BUF_SIZE))\n\n fail();\n\n bench_new(src1, has_topleft, has_topright, (ptrdiff_t)24*SIZEOF_PIXEL);\n\n }\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "662234a9a22f1cd0f0ac83b8bb1ffadedca90c0a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void ff_put_h264_qpel4_mc02_msa(uint8_t *dst, const uint8_t *src,\n+\n+ ptrdiff_t stride)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_put_h264_qpel4_mc02_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n avc_luma_vt_4w_msa(src - (stride * 2), stride, dst, stride, 4);\n\n}\n"}} {"sample_id": "69c1fe7c9c9bc85eebfc02c6a19caf7e88cd74ff", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n uint64_t start, end;\n \n+\n+\n+ if (sscanf(p, \"%*[^,],%d:%d:%d%*c%d,%d:%d:%d%*c%d\",\n+\n+ &sh, &sm, &ss, &sc, &eh, &em, &es, &ec) != 8)\n \n return 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ass_get_duration(const uint8_t *p)\n\n{\n\n int sh, sm, ss, sc, eh, em, es, ec;\n\n uint64_t start, end;\n\n\n\n if (sscanf(p, \"%*[^,],%d:%d:%d%*c%d,%d:%d:%d%*c%d\",\n\n &sh, &sm, &ss, &sc, &eh, &em, &es, &ec) != 8)\n\n return 0;\n\n start = 3600000 * sh + 60000 * sm + 1000 * ss + 10 * sc;\n\n end = 3600000 * eh + 60000 * em + 1000 * es + 10 * ec;\n\n return end - start;\n\n}\n"}} {"sample_id": "b0cd14fb1dab4b044f7fe6b53ac635409849de77_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static int show_hwaccels(void *optctx, const char *opt, const char *arg)\n \n {\n+\n+ int i;\n+\n+\n+\n printf(\"Hardware acceleration methods:\\n\");\n \n for (i = 0; hwaccels[i].name; i++) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int show_hwaccels(void *optctx, const char *opt, const char *arg)\n\n{\n\n int i;\n\n\n\n printf(\"Hardware acceleration methods:\\n\");\n\n for (i = 0; hwaccels[i].name; i++) {\n\n printf(\"%s\\n\", hwaccels[i].name);\n\n }\n\n printf(\"\\n\");\n\n return 0;\n\n}\n"}} {"sample_id": "449041d4db1f82f281fe097e832f07cd9ee1e864", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static int parse_uint32(DeviceState *dev, Property *prop, const char *str)\n \n+{\n+\n+ uint32_t *ptr = qdev_get_prop_ptr(dev, prop);\n \n const char *fmt;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int parse_uint32(DeviceState *dev, Property *prop, const char *str)\n\n{\n\n uint32_t *ptr = qdev_get_prop_ptr(dev, prop);\n\n const char *fmt;\n\n\n\n /* accept both hex and decimal */\n\n fmt = strncasecmp(str, \"0x\",2) == 0 ? \"%\" PRIx32 : \"%\" PRIu32;\n\n if (sscanf(str, fmt, ptr) != 1)\n\n return -EINVAL;\n\n return 0;\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n assert(!qemu_lockcnt_count(&ctx->list_lock));\n \n+ while (ctx->first_bh) {\n+\n+ QEMUBH *next = ctx->first_bh->next;\n+\n+\n \n /* qemu_bh_delete() must have been called on BHs in this AioContext */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "aio_ctx_finalize(GSource *source)\n\n{\n\n AioContext *ctx = (AioContext *) source;\n\n\n\n thread_pool_free(ctx->thread_pool);\n\n\n\n#ifdef CONFIG_LINUX_AIO\n\n if (ctx->linux_aio) {\n\n laio_detach_aio_context(ctx->linux_aio, ctx);\n\n laio_cleanup(ctx->linux_aio);\n\n ctx->linux_aio = NULL;\n\n }\n\n#endif\n\n\n\n qemu_lockcnt_lock(&ctx->list_lock);\n\n assert(!qemu_lockcnt_count(&ctx->list_lock));\n\n while (ctx->first_bh) {\n\n QEMUBH *next = ctx->first_bh->next;\n\n\n\n /* qemu_bh_delete() must have been called on BHs in this AioContext */\n\n assert(ctx->first_bh->deleted);\n\n\n\n g_free(ctx->first_bh);\n\n ctx->first_bh = next;\n\n }\n\n qemu_lockcnt_unlock(&ctx->list_lock);\n\n\n\n aio_set_event_notifier(ctx, &ctx->notifier, false, NULL, NULL);\n\n event_notifier_cleanup(&ctx->notifier);\n\n qemu_rec_mutex_destroy(&ctx->lock);\n\n qemu_lockcnt_destroy(&ctx->list_lock);\n\n timerlistgroup_deinit(&ctx->tlg);\n\n}\n"}} {"sample_id": "77d4db015c99ce7083fd5b33f0c650176fe8bc98", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n return;\n \n+ fprintf(f, \"P6\\n%d %d\\n%d\\n\", w, h, 255);\n+\n+ for (y = 0; y < h; y++) {\n+\n+ for (x = 0; x < w; x++) {\n \n fputc(0, f);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vga_screen_dump_blank(VGAState *s, const char *filename)\n\n{\n\n FILE *f;\n\n unsigned int y, x, w, h;\n\n\n\n w = s->last_scr_width * sizeof(uint32_t);\n\n h = s->last_scr_height;\n\n\n\n f = fopen(filename, \"wb\");\n\n if (!f)\n\n return;\n\n fprintf(f, \"P6\\n%d %d\\n%d\\n\", w, h, 255);\n\n for (y = 0; y < h; y++) {\n\n for (x = 0; x < w; x++) {\n\n fputc(0, f);\n\n }\n\n }\n\n fclose(f);\n\n}\n"}} {"sample_id": "c3ab0004ae4dffc32494ae84dd15cfaa909a7884_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static inline void RENAME(nv12ToUV)(uint8_t *dstU, uint8_t *dstV,\n \n const uint8_t *src1, const uint8_t *src2,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void RENAME(nv12ToUV)(uint8_t *dstU, uint8_t *dstV,\n\n const uint8_t *src1, const uint8_t *src2,\n\n int width, uint32_t *unused)\n\n{\n\n RENAME(nvXXtoUV)(dstU, dstV, src1, width);\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n const char *tag)\n \n {\n+\n+ while (bs && bs->drv && !bs->drv->bdrv_debug_breakpoint) {\n+\n+ bs = bs->file;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int bdrv_debug_breakpoint(BlockDriverState *bs, const char *event,\n\n const char *tag)\n\n{\n\n while (bs && bs->drv && !bs->drv->bdrv_debug_breakpoint) {\n\n bs = bs->file;\n\n }\n\n\n\n if (bs && bs->drv && bs->drv->bdrv_debug_breakpoint) {\n\n return bs->drv->bdrv_debug_breakpoint(bs, event, tag);\n\n }\n\n\n\n return -ENOTSUP;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_91", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ BlkMigDevState *bmds;\n+\n+ uint64_t sum = 0;\n+\n+\n \n blk_mig_lock();\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "uint64_t blk_mig_bytes_transferred(void)\n\n{\n\n BlkMigDevState *bmds;\n\n uint64_t sum = 0;\n\n\n\n blk_mig_lock();\n\n QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {\n\n sum += bmds->completed_sectors;\n\n }\n\n blk_mig_unlock();\n\n return sum << BDRV_SECTOR_BITS;\n\n}\n"}} {"sample_id": "8417cebfda193c7f9ca70be5e308eaa92cf84b94_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static FlatView generate_memory_topology(MemoryRegion *mr)\n \n {\n+\n FlatView view;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static FlatView generate_memory_topology(MemoryRegion *mr)\n\n{\n\n FlatView view;\n\n\n\n flatview_init(&view);\n\n\n\n render_memory_region(&view, mr, 0, addrrange_make(0, UINT64_MAX));\n\n flatview_simplify(&view);\n\n\n\n return view;\n\n}\n"}} {"sample_id": "364031f17932814484657e5551ba12957d993d7e_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n const char *name, void *value,\n \n size_t size, int flags)\n+\n+{\n+\n errno = ENOTSUP;\n \n return -1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int v9fs_synth_lsetxattr(FsContext *ctx, V9fsPath *path,\n\n const char *name, void *value,\n\n size_t size, int flags)\n\n{\n\n errno = ENOTSUP;\n\n return -1;\n\n}\n"}} {"sample_id": "6350b0904615cc0531cc3059ea34db5c009c88aa_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n Error *local_err = NULL;\n \n int64_t value;\n+\n \n \n if (dev->state != DEV_STATE_CREATED) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void set_int16(Object *obj, Visitor *v, void *opaque,\n\n const char *name, Error **errp)\n\n{\n\n DeviceState *dev = DEVICE(obj);\n\n Property *prop = opaque;\n\n int16_t *ptr = qdev_get_prop_ptr(dev, prop);\n\n Error *local_err = NULL;\n\n int64_t value;\n\n\n\n if (dev->state != DEV_STATE_CREATED) {\n\n error_set(errp, QERR_PERMISSION_DENIED);\n\n return;\n\n }\n\n\n\n visit_type_int(v, &value, name, &local_err);\n\n if (local_err) {\n\n error_propagate(errp, local_err);\n\n return;\n\n }\n\n if (value > prop->info->min && value <= prop->info->max) {\n\n *ptr = value;\n\n } else {\n\n error_set(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE,\n\n dev->id?:\"\", name, value, prop->info->min,\n\n prop->info->max);\n\n }\n\n}\n"}} {"sample_id": "4de484698bdda6c5e093dfbe4368cdb364fdf87f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n /* We can't rely on STS_BSY until the command has started processing.\n+\n+ * Therefore, we also use the Command Issue bit as indication of\n+\n+ * a command in-flight. */\n+\n while (BITSET(ahci_px_rreg(ahci, cmd->port, AHCI_PX_TFD),\n \n AHCI_PX_TFD_STS_BSY) ||", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ahci_command_wait(AHCIQState *ahci, AHCICommand *cmd)\n\n{\n\n /* We can't rely on STS_BSY until the command has started processing.\n\n * Therefore, we also use the Command Issue bit as indication of\n\n * a command in-flight. */\n\n while (BITSET(ahci_px_rreg(ahci, cmd->port, AHCI_PX_TFD),\n\n AHCI_PX_TFD_STS_BSY) ||\n\n BITSET(ahci_px_rreg(ahci, cmd->port, AHCI_PX_CI), (1 << cmd->slot))) {\n\n usleep(50);\n\n }\n\n}\n"}} {"sample_id": "b2b012afdd9c03ba8a1619f45301d34f358d367b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n+static void imx_eth_enable_rx(IMXFECState *s)\n \n {\n \n IMXFECBufDesc bd;\n \n bool rx_ring_full;\n+\n \n \n imx_fec_read_bd(&bd, s->rx_descriptor);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void imx_eth_enable_rx(IMXFECState *s)\n\n{\n\n IMXFECBufDesc bd;\n\n bool rx_ring_full;\n\n\n\n imx_fec_read_bd(&bd, s->rx_descriptor);\n\n\n\n rx_ring_full = !(bd.flags & ENET_BD_E);\n\n\n\n if (rx_ring_full) {\n\n FEC_PRINTF(\"RX buffer full\\n\");\n\n } else if (!s->regs[ENET_RDAR]) {\n\n qemu_flush_queued_packets(qemu_get_queue(s->nic));\n\n }\n\n\n\n s->regs[ENET_RDAR] = rx_ring_full ? 0 : ENET_RDAR_RDAR;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n BlkMigDevState *bmds;\n \n+ uint64_t sum = 0;\n+\n+\n+\n QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {\n \n sum += bmds->total_sectors;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "uint64_t blk_mig_bytes_total(void)\n\n{\n\n BlkMigDevState *bmds;\n\n uint64_t sum = 0;\n\n\n\n QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {\n\n sum += bmds->total_sectors;\n\n }\n\n return sum << BDRV_SECTOR_BITS;\n\n}\n"}} {"sample_id": "0f51726adcdb620214405a88b2601d9edd059db4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n dom = xs_get_domain_path(xenstore, con->xendev.dom);\n \n snprintf(con->console, sizeof(con->console), \"%s/console\", dom);\n+\n+ free(dom);\n+\n+\n+\n type = xenstore_read_str(con->console, \"type\");\n \n if (!type || strcmp(type, \"ioemu\") != 0) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int con_init(struct XenDevice *xendev)\n\n{\n\n struct XenConsole *con = container_of(xendev, struct XenConsole, xendev);\n\n char *type, *dom;\n\n int ret = 0;\n\n\n\n /* setup */\n\n dom = xs_get_domain_path(xenstore, con->xendev.dom);\n\n snprintf(con->console, sizeof(con->console), \"%s/console\", dom);\n\n free(dom);\n\n\n\n type = xenstore_read_str(con->console, \"type\");\n\n if (!type || strcmp(type, \"ioemu\") != 0) {\n\n\txen_be_printf(xendev, 1, \"not for me (type=%s)\\n\", type);\n\n ret = -1;\n\n goto out;\n\n }\n\n\n\n if (!serial_hds[con->xendev.dev])\n\n\txen_be_printf(xendev, 1, \"WARNING: serial line %d not configured\\n\",\n\n con->xendev.dev);\n\n else\n\n con->chr = serial_hds[con->xendev.dev];\n\n\n\nout:\n\n qemu_free(type);\n\n return ret;\n\n}\n"}} {"sample_id": "3115550abe96de674dac42f02a0b464e137bfc20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void fill_yuv_image(AVFrame *pict, int frame_index,\n+\n+ int width, int height)\n+\n {\n \n int x, y, i, ret;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void fill_yuv_image(AVFrame *pict, int frame_index,\n\n int width, int height)\n\n{\n\n int x, y, i, ret;\n\n\n\n /* when we pass a frame to the encoder, it may keep a reference to it\n\n * internally;\n\n * make sure we do not overwrite it here\n\n */\n\n ret = av_frame_make_writable(pict);\n\n if (ret < 0)\n\n exit(1);\n\n\n\n i = frame_index;\n\n\n\n /* Y */\n\n for (y = 0; y < height; y++)\n\n for (x = 0; x < width; x++)\n\n pict->data[0][y * pict->linesize[0] + x] = x + y + i * 3;\n\n\n\n /* Cb and Cr */\n\n for (y = 0; y < height / 2; y++) {\n\n for (x = 0; x < width / 2; x++) {\n\n pict->data[1][y * pict->linesize[1] + x] = 128 + y + i * 2;\n\n pict->data[2][y * pict->linesize[2] + x] = 64 + x + i * 5;\n\n }\n\n }\n\n}\n"}} {"sample_id": "044f4c8b0ee90290b6cbbc616c4be3c8aeffcaab", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,8 +36,8 @@\n \n ics->irqs[i].priority = 0xff;\n \n+ ics->irqs[i].saved_priority = 0xff;\n+\n+ }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void xics_reset(void *opaque)\n\n{\n\n struct icp_state *icp = (struct icp_state *)opaque;\n\n struct ics_state *ics = icp->ics;\n\n int i;\n\n\n\n for (i = 0; i < icp->nr_servers; i++) {\n\n icp->ss[i].xirr = 0;\n\n icp->ss[i].pending_priority = 0;\n\n icp->ss[i].mfrr = 0xff;\n\n /* Make all outputs are deasserted */\n\n qemu_set_irq(icp->ss[i].output, 0);\n\n }\n\n\n\n for (i = 0; i < ics->nr_irqs; i++) {\n\n /* Reset everything *except* the type */\n\n ics->irqs[i].server = 0;\n\n ics->irqs[i].status = 0;\n\n ics->irqs[i].priority = 0xff;\n\n ics->irqs[i].saved_priority = 0xff;\n\n }\n\n}\n"}} {"sample_id": "9f14b0add1dcdbfa2ee61051d068211fb0a1fcc9_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n \n \n+ for (i = s->parent.requests; i; i = i->next) {\n+\n+ rng_egd_free_request(i->data);\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void rng_egd_free_requests(RngEgd *s)\n\n{\n\n GSList *i;\n\n\n\n for (i = s->parent.requests; i; i = i->next) {\n\n rng_egd_free_request(i->data);\n\n }\n\n\n\n g_slist_free(s->parent.requests);\n\n s->parent.requests = NULL;\n\n}\n"}} {"sample_id": "967b75230b9720ea2b3ae49f38f8287026125f9f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,8 +9,8 @@\n powernv_create_core_node(chip, pnv_core, fdt);\n }\n if (chip->ram_size) {\n+ powernv_populate_memory_node(fdt, chip->chip_id, chip->ram_start,\n+ chip->ram_size);\n+ }\n+ g_free(typename);\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void powernv_populate_chip(PnvChip *chip, void *fdt)\n{\n PnvChipClass *pcc = PNV_CHIP_GET_CLASS(chip);\n char *typename = pnv_core_typename(pcc->cpu_model);\n size_t typesize = object_type_get_instance_size(typename);\n int i;\n for (i = 0; i < chip->nr_cores; i++) {\n PnvCore *pnv_core = PNV_CORE(chip->cores + i * typesize);\n powernv_create_core_node(chip, pnv_core, fdt);\n }\n if (chip->ram_size) {\n powernv_populate_memory_node(fdt, chip->chip_id, chip->ram_start,\n chip->ram_size);\n }\n g_free(typename);\n}"}} {"sample_id": "6c77805fc84a63b74e5025b4d7eeea24c8138cf3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+unsigned int av_codec_get_tag(const AVCodecTag *tags[4], enum CodecID id)\n+\n+{\n+\n int i;\n \n for(i=0; i<4 && tags[i]; i++){", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "unsigned int av_codec_get_tag(const AVCodecTag *tags[4], enum CodecID id)\n\n{\n\n int i;\n\n for(i=0; i<4 && tags[i]; i++){\n\n int tag= codec_get_tag(tags[i], id);\n\n if(tag) return tag;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "7f526efd17973ec6d2204f7a47b6923e2be31363_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void rgb15tobgr24(const uint8_t *src, uint8_t *dst, unsigned int src_size)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void rgb15tobgr24(const uint8_t *src, uint8_t *dst, unsigned int src_size)\n\n{\n\n\tconst uint16_t *end;\n\n\tuint8_t *d = (uint8_t *)dst;\n\n\tconst uint16_t *s = (uint16_t *)src;\n\n\tend = s + src_size/2;\n\n\twhile(s < end)\n\n\t{\n\n\t\tregister uint16_t bgr;\n\n\t\tbgr = *s++;\n\n\t\t*d++ = (bgr&0x7C00)>>7;\n\n\t\t*d++ = (bgr&0x3E0)>>2;\n\n\t\t*d++ = (bgr&0x1F)<<3;\n\n\t}\n\n}\n"}} {"sample_id": "61b9251a3aaa65e65c4aab3a6800e884bb3b82f9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,9 +6,9 @@\n \n gnutls_certificate_free_credentials(creds->data);\n \n+ creds->data = NULL;\n+\n+\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds)\n\n{\n\n if (creds->data) {\n\n gnutls_certificate_free_credentials(creds->data);\n\n creds->data = NULL;\n\n\n\n\n\n"}} {"sample_id": "f9c6a7f1395c6d88a3bb1a0cb48811994709966e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,8 +6,8 @@\n \n if (irq >= 16)\n \n+ irq += 16;\n+\n+ gic_complete_irq(&s->gic, 0, irq);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void armv7m_nvic_complete_irq(void *opaque, int irq)\n\n{\n\n nvic_state *s = (nvic_state *)opaque;\n\n if (irq >= 16)\n\n irq += 16;\n\n gic_complete_irq(&s->gic, 0, irq);\n\n}\n"}} {"sample_id": "94e58e5770d2a2295a13240f51ddba583e6d5360_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n run_length *=2;\n if (color) {\n memset(s->frame.data[0] + y*s->frame.linesize[0] + x, color, run_length);\n+ if (half_vert)\n+ memset(s->frame.data[0] + (y+1)*s->frame.linesize[0] + x, color, run_length);\n+ }\n+ x+= run_length;\n+ if (x >= s->avctx->width) {\n x=0;\n y += 1 + half_vert;\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void mm_decode_intra(MmContext * s, int half_horiz, int half_vert, const uint8_t *buf, int buf_size)\n{\n int i, x, y;\n i=0; x=0; y=0;\n while(iframe.data[0] + y*s->frame.linesize[0] + x, color, run_length);\n if (half_vert)\n memset(s->frame.data[0] + (y+1)*s->frame.linesize[0] + x, color, run_length);\n }\n x+= run_length;\n if (x >= s->avctx->width) {\n x=0;\n y += 1 + half_vert;\n }\n }\n}"}} {"sample_id": "b888abe1be9f0b3c75273c28e9a7b58fe47d5ec4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -50,11 +50,11 @@\n \n for (u=0; u<=c; u++)\n \n+ bp1[u] = ((bp2[u] - ((refl[c+1] * bp2[c-u]) >> 12)) * (0x1000000 / b)) >> 12;\n+\n+\n+\n+ refl[c] = bp1[c];\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int eval_refl(int *refl, const int16_t *coefs, RA144Context *ractx)\n\n{\n\n int b, c, i;\n\n unsigned int u;\n\n int buffer1[10];\n\n int buffer2[10];\n\n int *bp1 = buffer1;\n\n int *bp2 = buffer2;\n\n\n\n for (i=0; i < 10; i++)\n\n buffer2[i] = coefs[i];\n\n\n\n refl[9] = bp2[9];\n\n\n\n if ((unsigned) bp2[9] + 0x1000 > 0x1fff) {\n\n av_log(ractx, AV_LOG_ERROR, \"Overflow. Broken sample?\\n\");\n\n return 1;\n\n }\n\n\n\n for (c=8; c >= 0; c--) {\n\n b = 0x1000-((bp2[c+1] * bp2[c+1]) >> 12);\n\n\n\n if (!b)\n\n b = -2;\n\n\n\n for (u=0; u<=c; u++)\n\n bp1[u] = ((bp2[u] - ((refl[c+1] * bp2[c-u]) >> 12)) * (0x1000000 / b)) >> 12;\n\n\n\n refl[c] = bp1[c];\n\n\n\n if ((unsigned) bp1[c] + 0x1000 > 0x1fff)\n\n return 1;\n\n\n\n FFSWAP(int *, bp1, bp2);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "92a0f338786b629c5661f5b552e32c6154c3389d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,9 +19,9 @@\n #ifdef DEBUG_SEEK\n \n av_log(s, AV_LOG_DEBUG, \"seek to %\"PRIx64\" -> %\"PRIx64\"\\n\", pos1, pos);\n+\n+#endif\n+\n+ url_fseek(pb, pos, SEEK_SET);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ffm_seek1(AVFormatContext *s, int64_t pos1)\n\n{\n\n FFMContext *ffm = s->priv_data;\n\n ByteIOContext *pb = s->pb;\n\n int64_t pos;\n\n\n\n pos = pos1 + ffm->write_index;\n\n if (pos >= ffm->file_size)\n\n pos -= (ffm->file_size - FFM_PACKET_SIZE);\n\n#ifdef DEBUG_SEEK\n\n av_log(s, AV_LOG_DEBUG, \"seek to %\"PRIx64\" -> %\"PRIx64\"\\n\", pos1, pos);\n\n#endif\n\n url_fseek(pb, pos, SEEK_SET);\n\n}\n"}} {"sample_id": "cfb08fbafcd946341bdf14103293887763802697", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,7 +15,7 @@\n drive->fdctrl = fdctrl;\n \n \n+\n if (drive->bs) {\n \n if (bdrv_get_on_error(drive->bs, 0) != BLOCK_ERR_STOP_ENOSPC) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int fdctrl_connect_drives(FDCtrl *fdctrl)\n\n{\n\n unsigned int i;\n\n FDrive *drive;\n\n\n\n for (i = 0; i < MAX_FD; i++) {\n\n drive = &fdctrl->drives[i];\n\n drive->fdctrl = fdctrl;\n\n\n\n if (drive->bs) {\n\n if (bdrv_get_on_error(drive->bs, 0) != BLOCK_ERR_STOP_ENOSPC) {\n\n error_report(\"fdc doesn't support drive option werror\");\n\n return -1;\n\n }\n\n if (bdrv_get_on_error(drive->bs, 1) != BLOCK_ERR_REPORT) {\n\n error_report(\"fdc doesn't support drive option rerror\");\n\n return -1;\n\n }\n\n }\n\n\n\n fd_init(drive);\n\n fd_revalidate(drive);\n\n if (drive->bs) {\n\n bdrv_set_dev_ops(drive->bs, &fdctrl_block_ops, drive);\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "1b324700e3a1cb7894bfbd76f5591cf643dc0371", "diff": "--- a/source.c\n+++ b/source.c\n@@ -62,11 +62,11 @@\n \n if (check_func(s.threshold, \"threshold8\")) {\n \n+ call_ref(in, threshold, min, max, out_ref, line_size, line_size, line_size, line_size, line_size, w, 1);\n+\n+ call_new(in, threshold, min, max, out_new, line_size, line_size, line_size, line_size, line_size, w, 1);\n+\n+ if (memcmp(out_ref, out_new, w))\n \n fail();\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void check_threshold_8(void){\n\n LOCAL_ALIGNED_32(uint8_t, in , [WIDTH_PADDED]);\n\n LOCAL_ALIGNED_32(uint8_t, threshold, [WIDTH_PADDED]);\n\n LOCAL_ALIGNED_32(uint8_t, min , [WIDTH_PADDED]);\n\n LOCAL_ALIGNED_32(uint8_t, max , [WIDTH_PADDED]);\n\n LOCAL_ALIGNED_32(uint8_t, out_ref , [WIDTH_PADDED]);\n\n LOCAL_ALIGNED_32(uint8_t, out_new , [WIDTH_PADDED]);\n\n ptrdiff_t line_size = WIDTH_PADDED;\n\n int w = WIDTH;\n\n\n\n ThresholdContext s;\n\n s.depth = 8;\n\n ff_threshold_init(&s);\n\n\n\n declare_func(void, const uint8_t *in, const uint8_t *threshold,\n\n const uint8_t *min, const uint8_t *max, uint8_t *out,\n\n ptrdiff_t ilinesize, ptrdiff_t tlinesize,\n\n ptrdiff_t flinesize, ptrdiff_t slinesize,\n\n ptrdiff_t olinesize, int w, int h);\n\n\n\n memset(in, 0, WIDTH_PADDED);\n\n memset(threshold, 0, WIDTH_PADDED);\n\n memset(min, 0, WIDTH_PADDED);\n\n memset(max, 0, WIDTH_PADDED);\n\n memset(out_ref, 0, WIDTH_PADDED);\n\n memset(out_new, 0, WIDTH_PADDED);\n\n randomize_buffers(in, WIDTH);\n\n randomize_buffers(threshold, WIDTH);\n\n randomize_buffers(min, WIDTH);\n\n randomize_buffers(max, WIDTH);\n\n\n\n if (check_func(s.threshold, \"threshold8\")) {\n\n call_ref(in, threshold, min, max, out_ref, line_size, line_size, line_size, line_size, line_size, w, 1);\n\n call_new(in, threshold, min, max, out_new, line_size, line_size, line_size, line_size, line_size, w, 1);\n\n if (memcmp(out_ref, out_new, w))\n\n fail();\n\n bench_new(in, threshold, min, max, out_new, line_size, line_size, line_size, line_size, line_size, w, 1);\n\n }\n\n}\n"}} {"sample_id": "6a63ff19b6a7fe3bc32c7fb4a62fca8f65786432_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n const int num = get_be32(pb);\n \n const int den = get_be32(pb);\n+\n+ AVStream * const st = c->fc->streams[c->fc->nb_streams-1];\n+\n+ if (den != 0) {\n+\n if ((st->sample_aspect_ratio.den != 1 || st->sample_aspect_ratio.num) && // default\n \n (den != st->sample_aspect_ratio.den || num != st->sample_aspect_ratio.num))", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mov_read_pasp(MOVContext *c, ByteIOContext *pb, MOVAtom atom)\n\n{\n\n const int num = get_be32(pb);\n\n const int den = get_be32(pb);\n\n AVStream * const st = c->fc->streams[c->fc->nb_streams-1];\n\n if (den != 0) {\n\n if ((st->sample_aspect_ratio.den != 1 || st->sample_aspect_ratio.num) && // default\n\n (den != st->sample_aspect_ratio.den || num != st->sample_aspect_ratio.num))\n\n av_log(c->fc, AV_LOG_WARNING,\n\n \"sample aspect ratio already set to %d:%d, overriding by 'pasp' atom\\n\",\n\n st->sample_aspect_ratio.num, st->sample_aspect_ratio.den);\n\n st->sample_aspect_ratio.num = num;\n\n st->sample_aspect_ratio.den = den;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "c8721d35994fd3731e592f81ba2f9c08e7dc8c31", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,7 +20,7 @@\n \n /*\n \n+ * We set up the default / latest behaviour here. The class_init\n \n * functions for the specific versioned machine types can override\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-89", "target_file": "source.c", "files": {"source.c": "static void spapr_machine_class_init(ObjectClass *oc, void *data)\n\n{\n\n MachineClass *mc = MACHINE_CLASS(oc);\n\n sPAPRMachineClass *smc = SPAPR_MACHINE_CLASS(oc);\n\n FWPathProviderClass *fwc = FW_PATH_PROVIDER_CLASS(oc);\n\n NMIClass *nc = NMI_CLASS(oc);\n\n HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);\n\n\n\n mc->desc = \"pSeries Logical Partition (PAPR compliant)\";\n\n\n\n /*\n\n * We set up the default / latest behaviour here. The class_init\n\n * functions for the specific versioned machine types can override\n\n * these details for backwards compatibility\n\n */\n\n mc->init = ppc_spapr_init;\n\n mc->reset = ppc_spapr_reset;\n\n mc->block_default_type = IF_SCSI;\n\n mc->max_cpus = MAX_CPUMASK_BITS;\n\n mc->no_parallel = 1;\n\n mc->default_boot_order = \"\";\n\n mc->default_ram_size = 512 * M_BYTE;\n\n mc->kvm_type = spapr_kvm_type;\n\n mc->has_dynamic_sysbus = true;\n\n mc->pci_allow_0_address = true;\n\n mc->get_hotplug_handler = spapr_get_hotpug_handler;\n\n hc->pre_plug = spapr_machine_device_pre_plug;\n\n hc->plug = spapr_machine_device_plug;\n\n hc->unplug = spapr_machine_device_unplug;\n\n mc->cpu_index_to_socket_id = spapr_cpu_index_to_socket_id;\n\n mc->query_hotpluggable_cpus = spapr_query_hotpluggable_cpus;\n\n\n\n smc->dr_lmb_enabled = true;\n\n smc->dr_cpu_enabled = true;\n\n fwc->get_dev_path = spapr_get_fw_dev_path;\n\n nc->nmi_monitor_handler = spapr_nmi;\n\n}\n"}} {"sample_id": "d538e8f50d89a66ae14a2cf351d2e0e5365d463b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void write_dt(void *ptr, unsigned long addr, unsigned long limit,\n \n+ int flags)\n+\n+{\n+\n+ unsigned int e1, e2;\n \n uint32_t *p;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void write_dt(void *ptr, unsigned long addr, unsigned long limit,\n\n int flags)\n\n{\n\n unsigned int e1, e2;\n\n uint32_t *p;\n\n e1 = (addr << 16) | (limit & 0xffff);\n\n e2 = ((addr >> 16) & 0xff) | (addr & 0xff000000) | (limit & 0x000f0000);\n\n e2 |= flags;\n\n p = ptr;\n\n p[0] = tswapl(e1);\n\n p[1] = tswapl(e2);\n\n}\n"}} {"sample_id": "e53c9065ca08a9153ecc73a6a8940bcc6d667e58_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n av_log(NULL, AV_LOG_ERROR, \"%d: %- .12f - %- .12f = % .12g\\n\",\n \n i, a[i], b[i], a[i] - b[i]);\n+\n+ return -1;\n+\n+ }\n+\n }\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int compare_floats(const float *a, const float *b, int len,\n\n float max_diff)\n\n{\n\n int i;\n\n for (i = 0; i < len; i++) {\n\n if (fabsf(a[i] - b[i]) > max_diff) {\n\n av_log(NULL, AV_LOG_ERROR, \"%d: %- .12f - %- .12f = % .12g\\n\",\n\n i, a[i], b[i], a[i] - b[i]);\n\n return -1;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "57d77b3963ce1023eaf5ada8cba58b9379405cc8_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -41,11 +41,11 @@\n if (ret < 0)\n \n goto end;\n+\n+ }\n+\n+ /*initialize program, kernel_name, kernel_count*/\n+\n opt_build_entry = av_dict_get(options, \"build_options\", NULL, 0);\n \n if (opt_build_entry)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int av_opencl_init(AVDictionary *options, AVOpenCLExternalEnv *ext_opencl_env)\n\n{\n\n int ret = 0;\n\n AVDictionaryEntry *opt_build_entry;\n\n AVDictionaryEntry *opt_platform_entry;\n\n AVDictionaryEntry *opt_device_entry;\n\n LOCK_OPENCL\n\n if (!gpu_env.init_count) {\n\n opt_platform_entry = av_dict_get(options, \"platform_idx\", NULL, 0);\n\n opt_device_entry = av_dict_get(options, \"device_idx\", NULL, 0);\n\n /*initialize devices, context, command_queue*/\n\n gpu_env.usr_spec_dev_info.platform_idx = -1;\n\n gpu_env.usr_spec_dev_info.dev_idx = -1;\n\n if (opt_platform_entry) {\n\n gpu_env.usr_spec_dev_info.platform_idx = strtol(opt_platform_entry->value, NULL, 10);\n\n }\n\n if (opt_device_entry) {\n\n gpu_env.usr_spec_dev_info.dev_idx = strtol(opt_device_entry->value, NULL, 10);\n\n }\n\n ret = init_opencl_env(&gpu_env, ext_opencl_env);\n\n if (ret < 0)\n\n goto end;\n\n }\n\n /*initialize program, kernel_name, kernel_count*/\n\n opt_build_entry = av_dict_get(options, \"build_options\", NULL, 0);\n\n if (opt_build_entry)\n\n ret = compile_kernel_file(&gpu_env, opt_build_entry->value);\n\n else\n\n ret = compile_kernel_file(&gpu_env, NULL);\n\n if (ret < 0)\n\n goto end;\n\n av_assert1(gpu_env.kernel_code_count > 0);\n\n gpu_env.init_count++;\n\n\n\nend:\n\n UNLOCK_OPENCL\n\n return ret;\n\n}\n"}} {"sample_id": "47d4be12c3997343e436c6cca89aefbbbeb70863_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n int err = 0;\n \n if (!nptr) {\n+\n if (endptr) {\n \n *endptr = nptr;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int qemu_strtoul(const char *nptr, const char **endptr, int base,\n\n unsigned long *result)\n\n{\n\n char *p;\n\n int err = 0;\n\n if (!nptr) {\n\n if (endptr) {\n\n *endptr = nptr;\n\n }\n\n err = -EINVAL;\n\n } else {\n\n errno = 0;\n\n *result = strtoul(nptr, &p, base);\n\n err = check_strtox_error(endptr, p, errno);\n\n }\n\n return err;\n\n}\n"}} {"sample_id": "bb5fc20f7c1c65e95030da3629dd0d7a0cce38cd_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n return 0;\n \n \n+\n+ term_printf(\"%s (%s) is encrypted.\\n\", bdrv_get_device_name(bs),\n+\n+ bdrv_get_encrypted_filename(bs));\n+\n for(i = 0; i < 3; i++) {\n \n monitor_readline(\"Password: \", 1, password, sizeof(password));", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int monitor_read_bdrv_key(BlockDriverState *bs)\n\n{\n\n char password[256];\n\n int i;\n\n\n\n if (!bdrv_is_encrypted(bs))\n\n return 0;\n\n\n\n term_printf(\"%s (%s) is encrypted.\\n\", bdrv_get_device_name(bs),\n\n bdrv_get_encrypted_filename(bs));\n\n for(i = 0; i < 3; i++) {\n\n monitor_readline(\"Password: \", 1, password, sizeof(password));\n\n if (bdrv_set_key(bs, password) == 0)\n\n return 0;\n\n term_printf(\"invalid password\\n\");\n\n }\n\n return -EPERM;\n\n}\n"}} {"sample_id": "805017b7791200f1b72deef17dc98fd272b941eb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -54,11 +54,11 @@\n \n &testdata, test_validate_fail_union_flat);\n \n+ validate_test_add(\"/visitor/input-strict/fail/union-flat-no-discriminator\",\n+\n+ &testdata, test_validate_fail_union_flat_no_discrim);\n+\n+ validate_test_add(\"/visitor/input-strict/fail/union-anon\",\n \n &testdata, test_validate_fail_union_anon);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int main(int argc, char **argv)\n\n{\n\n TestInputVisitorData testdata;\n\n\n\n g_test_init(&argc, &argv, NULL);\n\n\n\n validate_test_add(\"/visitor/input-strict/pass/struct\",\n\n &testdata, test_validate_struct);\n\n validate_test_add(\"/visitor/input-strict/pass/struct-nested\",\n\n &testdata, test_validate_struct_nested);\n\n validate_test_add(\"/visitor/input-strict/pass/list\",\n\n &testdata, test_validate_list);\n\n validate_test_add(\"/visitor/input-strict/pass/union\",\n\n &testdata, test_validate_union);\n\n validate_test_add(\"/visitor/input-strict/pass/union-flat\",\n\n &testdata, test_validate_union_flat);\n\n validate_test_add(\"/visitor/input-strict/pass/union-anon\",\n\n &testdata, test_validate_union_anon);\n\n validate_test_add(\"/visitor/input-strict/fail/struct\",\n\n &testdata, test_validate_fail_struct);\n\n validate_test_add(\"/visitor/input-strict/fail/struct-nested\",\n\n &testdata, test_validate_fail_struct_nested);\n\n validate_test_add(\"/visitor/input-strict/fail/list\",\n\n &testdata, test_validate_fail_list);\n\n validate_test_add(\"/visitor/input-strict/fail/union\",\n\n &testdata, test_validate_fail_union);\n\n validate_test_add(\"/visitor/input-strict/fail/union-flat\",\n\n &testdata, test_validate_fail_union_flat);\n\n validate_test_add(\"/visitor/input-strict/fail/union-flat-no-discriminator\",\n\n &testdata, test_validate_fail_union_flat_no_discrim);\n\n validate_test_add(\"/visitor/input-strict/fail/union-anon\",\n\n &testdata, test_validate_fail_union_anon);\n\n\n\n g_test_run();\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "acd82796211041c5af43c8c523b85d250c2ccebe_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n GICv3State *s = opaque;\n GICv3CPUState *cs;\n+ MemTxResult r;\n+ int cpuidx;\n+ /* This region covers all the redistributor pages; there are\n+ * (for GICv3) two 64K pages per CPU. At the moment they are\n+ * all contiguous (ie in this one region), though we might later\n * want to allow splitting of redistributor pages into several\n * blocks so we can support more CPUs.\n */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "MemTxResult gicv3_redist_read(void *opaque, hwaddr offset, uint64_t *data,\n unsigned size, MemTxAttrs attrs)\n{\n GICv3State *s = opaque;\n GICv3CPUState *cs;\n MemTxResult r;\n int cpuidx;\n /* This region covers all the redistributor pages; there are\n * (for GICv3) two 64K pages per CPU. At the moment they are\n * all contiguous (ie in this one region), though we might later\n * want to allow splitting of redistributor pages into several\n * blocks so we can support more CPUs.\n */\n cpuidx = offset / 0x20000;\n offset %= 0x20000;\n assert(cpuidx < s->num_cpu);\n cs = &s->cpu[cpuidx];\n switch (size) {\n case 1:\n r = gicr_readb(cs, offset, data, attrs);\n break;\n case 4:\n r = gicr_readl(cs, offset, data, attrs);\n break;\n case 8:\n r = gicr_readll(cs, offset, data, attrs);\n break;\n default:\n r = MEMTX_ERROR;\n break;\n }\n if (r == MEMTX_ERROR) {\n qemu_log_mask(LOG_GUEST_ERROR,\n \"%s: invalid guest read at offset \" TARGET_FMT_plx\n \"size %u\\n\", __func__, offset, size);\n trace_gicv3_redist_badread(gicv3_redist_affid(cs), offset,\n size, attrs.secure);\n } else {\n trace_gicv3_redist_read(gicv3_redist_affid(cs), offset, *data,\n size, attrs.secure);\n }\n return r;\n}"}} {"sample_id": "59c6178a54c414fd19e064f0077d00b82a1eb812", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n ByteIOContext *pb = s->pb;\n \n uint8_t *streaminfo = s->streams[0]->codec->extradata;\n+\n+ int len = s->streams[0]->codec->extradata_size;\n+\n+ int64_t file_size;\n+\n \n \n if (streaminfo && len > 0 && !url_is_streamed(s->pb)) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int flac_write_trailer(struct AVFormatContext *s)\n\n{\n\n ByteIOContext *pb = s->pb;\n\n uint8_t *streaminfo = s->streams[0]->codec->extradata;\n\n int len = s->streams[0]->codec->extradata_size;\n\n int64_t file_size;\n\n\n\n if (streaminfo && len > 0 && !url_is_streamed(s->pb)) {\n\n file_size = url_ftell(pb);\n\n url_fseek(pb, 8, SEEK_SET);\n\n put_buffer(pb, streaminfo, len);\n\n url_fseek(pb, file_size, SEEK_SET);\n\n put_flush_packet(pb);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_54", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void pmac_ide_flush(DBDMA_io *io)\n \n+{\n+\n+ MACIOIDEState *m = io->opaque;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pmac_ide_flush(DBDMA_io *io)\n\n{\n\n MACIOIDEState *m = io->opaque;\n\n\n\n if (m->aiocb) {\n\n bdrv_drain_all();\n\n }\n\n}\n"}} {"sample_id": "94e7340b5db8bce7866e44e700ffa8fd26585c7e_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+int nbd_receive_reply(int csock, struct nbd_reply *reply)\n \n {\n+\n uint8_t buf[NBD_REPLY_SIZE];\n \n uint32_t magic;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int nbd_receive_reply(int csock, struct nbd_reply *reply)\n\n{\n\n uint8_t buf[NBD_REPLY_SIZE];\n\n uint32_t magic;\n\n\n\n memset(buf, 0xAA, sizeof(buf));\n\n\n\n if (read_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {\n\n LOG(\"read failed\");\n\n errno = EINVAL;\n\n return -1;\n\n }\n\n\n\n /* Reply\n\n [ 0 .. 3] magic (NBD_REPLY_MAGIC)\n\n [ 4 .. 7] error (0 == no error)\n\n [ 7 .. 15] handle\n\n */\n\n\n\n magic = be32_to_cpup((uint32_t*)buf);\n\n reply->error = be32_to_cpup((uint32_t*)(buf + 4));\n\n reply->handle = be64_to_cpup((uint64_t*)(buf + 8));\n\n\n\n TRACE(\"Got reply: \"\n\n \"{ magic = 0x%x, .error = %d, handle = %\" PRIu64\" }\",\n\n magic, reply->error, reply->handle);\n\n\n\n if (magic != NBD_REPLY_MAGIC) {\n\n LOG(\"invalid magic (got 0x%x)\", magic);\n\n errno = EINVAL;\n\n return -1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "39bb30f6640fe1faf4bbc779a79786028febc95d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static int mxf_read_local_tags(MXFContext *mxf, KLVPacket *klv, int (*read_child)(), int ctx_size, enum MXFMetadataSetType type)\n+\n {\n \n ByteIOContext *pb = mxf->fc->pb;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int mxf_read_local_tags(MXFContext *mxf, KLVPacket *klv, int (*read_child)(), int ctx_size, enum MXFMetadataSetType type)\n\n{\n\n ByteIOContext *pb = mxf->fc->pb;\n\n MXFMetadataSet *ctx = ctx_size ? av_mallocz(ctx_size) : mxf;\n\n uint64_t klv_end = url_ftell(pb) + klv->length;\n\n\n\n if (!ctx)\n\n return -1;\n\n while (url_ftell(pb) + 4 < klv_end) {\n\n int tag = get_be16(pb);\n\n int size = get_be16(pb); /* KLV specified by 0x53 */\n\n uint64_t next = url_ftell(pb) + size;\n\n UID uid = {0};\n\n\n\n dprintf(mxf->fc, \"local tag %#04x size %d\\n\", tag, size);\n\n if (!size) { /* ignore empty tag, needed for some files with empty UMID tag */\n\n av_log(mxf->fc, AV_LOG_ERROR, \"local tag %#04x with 0 size\\n\", tag);\n\n continue;\n\n }\n\n if (tag > 0x7FFF) { /* dynamic tag */\n\n int i;\n\n for (i = 0; i < mxf->local_tags_count; i++) {\n\n int local_tag = AV_RB16(mxf->local_tags+i*18);\n\n if (local_tag == tag) {\n\n memcpy(uid, mxf->local_tags+i*18+2, 16);\n\n dprintf(mxf->fc, \"local tag %#04x\\n\", local_tag);\n\n PRINT_KEY(mxf->fc, \"uid\", uid);\n\n }\n\n }\n\n }\n\n if (ctx_size && tag == 0x3C0A)\n\n get_buffer(pb, ctx->uid, 16);\n\n else if (read_child(ctx, pb, tag, size, uid) < 0)\n\n return -1;\n\n\n\n url_fseek(pb, next, SEEK_SET);\n\n }\n\n if (ctx_size) ctx->type = type;\n\n return ctx_size ? mxf_add_metadata_set(mxf, ctx) : 0;\n\n}\n"}} {"sample_id": "13705b69ebe9e375fdb52469760a0fbb5f593cc1_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,16 +16,16 @@\n \n int mirror5 = mirror(y + 4, height - 1);\n \n+ DWTELEM *b0= cs->b0;\n+\n+ DWTELEM *b1= cs->b1;\n+\n DWTELEM *b2= cs->b2;\n \n DWTELEM *b3= cs->b3;\n \n+ DWTELEM *b4= slice_buffer_get_line(sb, mirror4 * stride_line);\n+\n DWTELEM *b5= slice_buffer_get_line(sb, mirror5 * stride_line);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void spatial_compose97i_dy_buffered(dwt_compose_t *cs, slice_buffer * sb, int width, int height, int stride_line){\n\n int y = cs->y;\n\n\n\n int mirror0 = mirror(y - 1, height - 1);\n\n int mirror1 = mirror(y + 0, height - 1);\n\n int mirror2 = mirror(y + 1, height - 1);\n\n int mirror3 = mirror(y + 2, height - 1);\n\n int mirror4 = mirror(y + 3, height - 1);\n\n int mirror5 = mirror(y + 4, height - 1);\n\n DWTELEM *b0= cs->b0;\n\n DWTELEM *b1= cs->b1;\n\n DWTELEM *b2= cs->b2;\n\n DWTELEM *b3= cs->b3;\n\n DWTELEM *b4= slice_buffer_get_line(sb, mirror4 * stride_line);\n\n DWTELEM *b5= slice_buffer_get_line(sb, mirror5 * stride_line);\n\n\n\n{START_TIMER\n\n if(y>0 && y+4400){\n\nSTOP_TIMER(\"vertical_compose97i\")}}\n\n\n\n{START_TIMER\n\n if(y-1>= 0) horizontal_compose97i(b0, width);\n\n if(mirror0 <= mirror2) horizontal_compose97i(b1, width);\n\nif(width>400 && mirror0 <= mirror2){\n\nSTOP_TIMER(\"horizontal_compose97i\")}}\n\n\n\n cs->b0=b2;\n\n cs->b1=b3;\n\n cs->b2=b4;\n\n cs->b3=b5;\n\n cs->y += 2;\n\n}\n"}} {"sample_id": "5fb6c7a8b26eab1a22207d24b4784bd2b39ab54b_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n if (vs->tls_session) {\n \n+\tret = gnutls_write(vs->tls_session, vs->output.buffer, vs->output.offset);\n+\n+\tif (ret < 0) {\n+\n+\t if (ret == GNUTLS_E_AGAIN)\n \n \t\terrno = EAGAIN;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vnc_client_write(void *opaque)\n\n{\n\n long ret;\n\n VncState *vs = opaque;\n\n\n\n#ifdef CONFIG_VNC_TLS\n\n if (vs->tls_session) {\n\n\tret = gnutls_write(vs->tls_session, vs->output.buffer, vs->output.offset);\n\n\tif (ret < 0) {\n\n\t if (ret == GNUTLS_E_AGAIN)\n\n\t\terrno = EAGAIN;\n\n\t else\n\n\t\terrno = EIO;\n\n\t ret = -1;\n\n\t}\n\n } else\n\n#endif /* CONFIG_VNC_TLS */\n\n\tret = send(vs->csock, vs->output.buffer, vs->output.offset, 0);\n\n ret = vnc_client_io_error(vs, ret, socket_error());\n\n if (!ret)\n\n\treturn;\n\n\n\n memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));\n\n vs->output.offset -= ret;\n\n\n\n if (vs->output.offset == 0) {\n\n\tqemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);\n\n }\n\n}\n"}} {"sample_id": "a718978ed58abc1ad92567a9c17525136be02a71_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static int32_t ahci_dma_prepare_buf(IDEDMA *dma, int is_write)\n \n {\n+\n AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);\n \n IDEState *s = &ad->port.ifs[0];", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int32_t ahci_dma_prepare_buf(IDEDMA *dma, int is_write)\n\n{\n\n AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);\n\n IDEState *s = &ad->port.ifs[0];\n\n\n\n if (ahci_populate_sglist(ad, &s->sg, s->io_buffer_offset) == -1) {\n\n DPRINTF(ad->port_no, \"ahci_dma_prepare_buf failed.\\n\");\n\n return -1;\n\n }\n\n s->io_buffer_size = s->sg.size;\n\n\n\n DPRINTF(ad->port_no, \"len=%#x\\n\", s->io_buffer_size);\n\n return s->io_buffer_size;\n\n}\n"}} {"sample_id": "12f8def0e02232d7c6416ad9b66640f973c531d1_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n void qemu_cond_destroy(QemuCond *cond)\n+\n+{\n+\n+ BOOL result;\n \n+ result = CloseHandle(cond->continue_event);\n+\n if (!result) {\n \n error_exit(GetLastError(), __func__);\n+\n }\n \n cond->continue_event = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void qemu_cond_destroy(QemuCond *cond)\n\n{\n\n BOOL result;\n\n result = CloseHandle(cond->continue_event);\n\n if (!result) {\n\n error_exit(GetLastError(), __func__);\n\n }\n\n cond->continue_event = 0;\n\n result = CloseHandle(cond->sema);\n\n if (!result) {\n\n error_exit(GetLastError(), __func__);\n\n }\n\n cond->sema = 0;\n\n}\n"}} {"sample_id": "364031f17932814484657e5551ba12957d993d7e_30", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,6 +4,6 @@\n \n errno = EPERM;\n \n+ return -1;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int v9fs_synth_chmod(FsContext *fs_ctx, V9fsPath *path, FsCred *credp)\n\n{\n\n errno = EPERM;\n\n return -1;\n\n}\n"}} {"sample_id": "1e6ee86d9254e8fd2158cc9a31d3be96b0809411", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static inline void scale_mv(AVSContext *h, int *d_x, int *d_y,\n+\n cavs_vector *src, int distp)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void scale_mv(AVSContext *h, int *d_x, int *d_y,\n\n cavs_vector *src, int distp)\n\n{\n\n int den = h->scale_den[FFMAX(src->ref, 0)];\n\n\n\n *d_x = (src->x * distp * den + 256 + FF_SIGNBIT(src->x)) >> 9;\n\n *d_y = (src->y * distp * den + 256 + FF_SIGNBIT(src->y)) >> 9;\n\n}\n"}} {"sample_id": "80168bff43760bde98388480dc7c93f94693421c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n {\n \n+ int ret;\n \n \n \n@@ -16,7 +16,7 @@\n \n .filename = g_strdup(filename),\n \n+ .options = options,\n \n .ret = NOT_DONE,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "int bdrv_create(BlockDriver *drv, const char* filename,\n\n QEMUOptionParameter *options)\n\n{\n\n int ret;\n\n\n\n Coroutine *co;\n\n CreateCo cco = {\n\n .drv = drv,\n\n .filename = g_strdup(filename),\n\n .options = options,\n\n .ret = NOT_DONE,\n\n };\n\n\n\n if (!drv->bdrv_create) {\n\n return -ENOTSUP;\n\n }\n\n\n\n if (qemu_in_coroutine()) {\n\n /* Fast-path if already in coroutine context */\n\n bdrv_create_co_entry(&cco);\n\n } else {\n\n co = qemu_coroutine_create(bdrv_create_co_entry);\n\n qemu_coroutine_enter(co, &cco);\n\n while (cco.ret == NOT_DONE) {\n\n qemu_aio_wait();\n\n }\n\n }\n\n\n\n ret = cco.ret;\n\n g_free(cco.filename);\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_64", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n \n \n+ if (len <= 0) {\n+\n+ return 0;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int buf_get_buffer(void *opaque, uint8_t *buf, int64_t pos, int size)\n\n{\n\n QEMUBuffer *s = opaque;\n\n ssize_t len = qsb_get_length(s->qsb) - pos;\n\n\n\n if (len <= 0) {\n\n return 0;\n\n }\n\n\n\n if (len > size) {\n\n len = size;\n\n }\n\n return qsb_get_buffer(s->qsb, pos, len, buf);\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_113", "diff": "--- a/source.c\n+++ b/source.c\n@@ -46,8 +46,8 @@\n \n \n \n+ rdma->migration_started_on_destination = 1;\n+\n+ process_incoming_migration(f);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void rdma_accept_incoming_migration(void *opaque)\n\n{\n\n RDMAContext *rdma = opaque;\n\n int ret;\n\n QEMUFile *f;\n\n Error *local_err = NULL, **errp = &local_err;\n\n\n\n DPRINTF(\"Accepting rdma connection...\\n\");\n\n ret = qemu_rdma_accept(rdma);\n\n\n\n if (ret) {\n\n ERROR(errp, \"RDMA Migration initialization failed!\");\n\n return;\n\n }\n\n\n\n DPRINTF(\"Accepted migration\\n\");\n\n\n\n f = qemu_fopen_rdma(rdma, \"rb\");\n\n if (f == NULL) {\n\n ERROR(errp, \"could not qemu_fopen_rdma!\");\n\n qemu_rdma_cleanup(rdma);\n\n return;\n\n }\n\n\n\n rdma->migration_started_on_destination = 1;\n\n process_incoming_migration(f);\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_40", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void dump_syscall(CPUState *env)\n+\n {\n \n fprintf(logfile, \"syscall r0=0x%08x r3=0x%08x r4=0x%08x \"", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void dump_syscall(CPUState *env)\n\n{\n\n fprintf(logfile, \"syscall r0=0x%08x r3=0x%08x r4=0x%08x \"\n\n \"r5=0x%08x r6=0x%08x nip=0x%08x\\n\",\n\n env->gpr[0], env->gpr[3], env->gpr[4],\n\n env->gpr[5], env->gpr[6], env->nip);\n\n}\n"}} {"sample_id": "60f10e0ad37418cc697765d85b0bc22db70f726a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void pred4x4_horizontal_vp8_c(uint8_t *src, const uint8_t *topright, int stride){\n+\n const int lt= src[-1-1*stride];\n \n LOAD_LEFT_EDGE", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void pred4x4_horizontal_vp8_c(uint8_t *src, const uint8_t *topright, int stride){\n\n const int lt= src[-1-1*stride];\n\n LOAD_LEFT_EDGE\n\n\n\n AV_WN32A(src+0*stride, ((lt + 2*l0 + l1 + 2) >> 2)*0x01010101);\n\n AV_WN32A(src+1*stride, ((l0 + 2*l1 + l2 + 2) >> 2)*0x01010101);\n\n AV_WN32A(src+2*stride, ((l1 + 2*l2 + l3 + 2) >> 2)*0x01010101);\n\n AV_WN32A(src+3*stride, ((l2 + 2*l3 + l3 + 2) >> 2)*0x01010101);\n\n}\n"}} {"sample_id": "bd3be4dbbf0491d6db8bf326706747b4629ace4b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n virtio_init(vdev, \"virtio-9p\", VIRTIO_ID_9P, v->config_size);\n \n+ v->vq = virtio_add_queue(vdev, MAX_REQ, handle_9p_output);\n+\n+ v9fs_register_transport(s, &virtio_9p_transport);\n+\n+\n \n out:\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_9p_device_realize(DeviceState *dev, Error **errp)\n\n{\n\n VirtIODevice *vdev = VIRTIO_DEVICE(dev);\n\n V9fsVirtioState *v = VIRTIO_9P(dev);\n\n V9fsState *s = &v->state;\n\n\n\n if (v9fs_device_realize_common(s, errp)) {\n\n goto out;\n\n }\n\n\n\n v->config_size = sizeof(struct virtio_9p_config) + strlen(s->fsconf.tag);\n\n virtio_init(vdev, \"virtio-9p\", VIRTIO_ID_9P, v->config_size);\n\n v->vq = virtio_add_queue(vdev, MAX_REQ, handle_9p_output);\n\n v9fs_register_transport(s, &virtio_9p_transport);\n\n\n\nout:\n\n return;\n\n}\n"}} {"sample_id": "6796a1dd8c14843b77925cb83a3ef88706ae1dd0_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void ff_put_h264_qpel16_mc01_msa(uint8_t *dst, const uint8_t *src,\n \n ptrdiff_t stride)\n+\n+{\n \n avc_luma_vt_qrt_16w_msa(src - (stride * 2), stride, dst, stride, 16, 0);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_put_h264_qpel16_mc01_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n avc_luma_vt_qrt_16w_msa(src - (stride * 2), stride, dst, stride, 16, 0);\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n PPC_OP(setlr)\n+\n+{\n \n regs->lr = PARAM1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "PPC_OP(setlr)\n\n{\n\n regs->lr = PARAM1;\n\n RETURN();\n\n}\n"}} {"sample_id": "cd6a9bb6e977864b1b7ec21b983fa0678b4b82e9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+static hwaddr ppc_hash64_pte_raddr(ppc_slb_t *slb, ppc_hash_pte64_t pte,\n+\n+ target_ulong eaddr)\n+\n+{\n+\n+ hwaddr mask;\n \n int target_page_bits;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static hwaddr ppc_hash64_pte_raddr(ppc_slb_t *slb, ppc_hash_pte64_t pte,\n\n target_ulong eaddr)\n\n{\n\n hwaddr mask;\n\n int target_page_bits;\n\n hwaddr rpn = pte.pte1 & HPTE64_R_RPN;\n\n /*\n\n * We support 4K, 64K and 16M now\n\n */\n\n target_page_bits = ppc_hash64_page_shift(slb);\n\n mask = (1ULL << target_page_bits) - 1;\n\n return (rpn & ~mask) | (eaddr & mask);\n\n}\n"}} {"sample_id": "c9e884f3d98df85bf7f2cf30d71877b22929fdcb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n d = get_bits(&ctx->gb, 9);\n \n+ mb = get_bits(&ctx->gb, 5);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int tm2_read_deltas(TM2Context *ctx, int stream_id)\n\n{\n\n int d, mb;\n\n int i, v;\n\n\n\n d = get_bits(&ctx->gb, 9);\n\n mb = get_bits(&ctx->gb, 5);\n\n\n\n av_assert2(mb < 32);\n\n if ((d < 1) || (d > TM2_DELTAS) || (mb < 1)) {\n\n av_log(ctx->avctx, AV_LOG_ERROR, \"Incorrect delta table: %i deltas x %i bits\\n\", d, mb);\n\n return AVERROR_INVALIDDATA;\n\n }\n\n\n\n for (i = 0; i < d; i++) {\n\n v = get_bits_long(&ctx->gb, mb);\n\n if (v & (1 << (mb - 1)))\n\n ctx->deltas[stream_id][i] = v - (1 << mb);\n\n else\n\n ctx->deltas[stream_id][i] = v;\n\n }\n\n for (; i < TM2_DELTAS; i++)\n\n ctx->deltas[stream_id][i] = 0;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "425532d71d5d295cc9c649500e4969ac621ce51d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,6 +4,6 @@\n \n return (val << ((sizeof(tcg_target_long) * 8 - bits))\n \n+ >> (sizeof(tcg_target_long) * 8 - bits)) == val;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline int check_fit_tl(tcg_target_long val, unsigned int bits)\n\n{\n\n return (val << ((sizeof(tcg_target_long) * 8 - bits))\n\n >> (sizeof(tcg_target_long) * 8 - bits)) == val;\n\n}\n"}} {"sample_id": "3902d49e13c2428bd6381cfdf183103ca4477c1f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static int virtio_rng_load(QEMUFile *f, void *opaque, int version_id)\n \n {\n+\n+ VirtIORNG *vrng = opaque;\n+\n+ VirtIODevice *vdev = VIRTIO_DEVICE(vrng);\n+\n \n \n if (version_id != 1) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int virtio_rng_load(QEMUFile *f, void *opaque, int version_id)\n\n{\n\n VirtIORNG *vrng = opaque;\n\n VirtIODevice *vdev = VIRTIO_DEVICE(vrng);\n\n\n\n if (version_id != 1) {\n\n return -EINVAL;\n\n }\n\n virtio_load(vdev, f, version_id);\n\n\n\n /* We may have an element ready but couldn't process it due to a quota\n\n * limit. Make sure to try again after live migration when the quota may\n\n * have been reset.\n\n */\n\n virtio_rng_process(vrng);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "e0dadc1e9ef1f35208e5d2af9c7740c18a0b769f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,6 +8,6 @@\n \n set_bit(DEVICE_CATEGORY_MISC, k->categories);\n \n+ k->bus_type = TYPE_AUX_BUS;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void aux_slave_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *k = DEVICE_CLASS(klass);\n\n\n\n set_bit(DEVICE_CATEGORY_MISC, k->categories);\n\n k->bus_type = TYPE_AUX_BUS;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_43", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,9 +13,9 @@\n \n \n dev = sysbus_create_simple(\"imx_timerp\", addr, irq);\n+\n+ pp = container_of(dev, IMXTimerPState, busdev.qdev);\n+\n+ pp->ccm = ccm;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void imx_timerp_create(const target_phys_addr_t addr,\n\n qemu_irq irq,\n\n DeviceState *ccm)\n\n{\n\n IMXTimerPState *pp;\n\n DeviceState *dev;\n\n\n\n dev = sysbus_create_simple(\"imx_timerp\", addr, irq);\n\n pp = container_of(dev, IMXTimerPState, busdev.qdev);\n\n pp->ccm = ccm;\n\n}\n"}} {"sample_id": "8c222bb405f7031b2326c601f5072ca2980b1079", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int ac3_probe(AVProbeData *p)\n+\n {\n \n int max_frames, first_frames, frames;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int ac3_probe(AVProbeData *p)\n\n{\n\n int max_frames, first_frames, frames;\n\n uint8_t *buf, *buf2, *end;\n\n AC3HeaderInfo hdr;\n\n\n\n if(p->buf_size < 7)\n\n return 0;\n\n\n\n max_frames = 0;\n\n buf = p->buf;\n\n end = buf + FFMIN(4096, p->buf_size - 7);\n\n\n\n for(; buf < end; buf++) {\n\n buf2 = buf;\n\n\n\n for(frames = 0; buf2 < end; frames++) {\n\n if(ff_ac3_parse_header(buf2, &hdr) < 0)\n\n break;\n\n buf2 += hdr.frame_size;\n\n }\n\n max_frames = FFMAX(max_frames, frames);\n\n if(buf == p->buf)\n\n first_frames = frames;\n\n }\n\n if (first_frames>=3) return AVPROBE_SCORE_MAX * 3 / 4;\n\n else if(max_frames>=3) return AVPROBE_SCORE_MAX / 2;\n\n else if(max_frames>=1) return 1;\n\n else return 0;\n\n}\n"}} {"sample_id": "563890c7c7e977842e2a35afe7a24d06d2103242_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void test_media_insert(void)\n \n {\n+\n uint8_t dir;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-89", "target_file": "source.c", "files": {"source.c": "static void test_media_insert(void)\n\n{\n\n uint8_t dir;\n\n\n\n /* Insert media in drive. DSKCHK should not be reset until a step pulse\n\n * is sent. */\n\n qmp_discard_response(\"{'execute':'change', 'arguments':{\"\n\n \" 'device':'floppy0', 'target': '%s' }}\",\n\n test_image);\n\n qmp_discard_response(\"\"); /* ignore event\n\n (FIXME open -> open transition?!) */\n\n qmp_discard_response(\"\"); /* ignore event */\n\n\n\n dir = inb(FLOPPY_BASE + reg_dir);\n\n assert_bit_set(dir, DSKCHG);\n\n dir = inb(FLOPPY_BASE + reg_dir);\n\n assert_bit_set(dir, DSKCHG);\n\n\n\n send_seek(0);\n\n dir = inb(FLOPPY_BASE + reg_dir);\n\n assert_bit_set(dir, DSKCHG);\n\n dir = inb(FLOPPY_BASE + reg_dir);\n\n assert_bit_set(dir, DSKCHG);\n\n\n\n /* Step to next track should clear DSKCHG bit. */\n\n send_seek(1);\n\n dir = inb(FLOPPY_BASE + reg_dir);\n\n assert_bit_clear(dir, DSKCHG);\n\n dir = inb(FLOPPY_BASE + reg_dir);\n\n assert_bit_clear(dir, DSKCHG);\n\n}\n"}} {"sample_id": "386aee6864c5cfc438785d2421b2f056450da014_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n AVABufferSinkParams *params;\n \n+\n+\n+ if (!opaque) {\n+\n+ av_log(ctx, AV_LOG_ERROR,\n \n \"No opaque field provided, an AVABufferSinkParams struct is required\\n\");\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int asink_init(AVFilterContext *ctx, const char *args, void *opaque)\n\n{\n\n BufferSinkContext *buf = ctx->priv;\n\n AVABufferSinkParams *params;\n\n\n\n if (!opaque) {\n\n av_log(ctx, AV_LOG_ERROR,\n\n \"No opaque field provided, an AVABufferSinkParams struct is required\\n\");\n\n return AVERROR(EINVAL);\n\n } else\n\n params = (AVABufferSinkParams *)opaque;\n\n\n\n buf->sample_fmts = params->sample_fmts;\n\n buf->channel_layouts = params->channel_layouts;\n\n buf->packing_fmts = params->packing_fmts;\n\n\n\n return common_init(ctx);\n\n}\n"}} {"sample_id": "1f001dc7bc9e435bf231a5b0edcad1c7c2bd6214_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int default_fdset_dup_fd_find(int dup_fd)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int default_fdset_dup_fd_find(int dup_fd)\n\n{\n\n return -1;\n\n}\n"}} {"sample_id": "35c2c8dc8c0899882a8e0d349d93bd657772f1e7_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n qemu_version = version;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_set_version(const char *version)\n\n{\n\n qemu_version = version;\n\n}\n"}} {"sample_id": "3e831b40e015ba34dfb55ff11f767001839425ff_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ PVSCSICmdDescSetupRings *rc =\n \n (PVSCSICmdDescSetupRings *) s->curr_cmd_data;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "pvscsi_on_cmd_setup_rings(PVSCSIState *s)\n\n{\n\n PVSCSICmdDescSetupRings *rc =\n\n (PVSCSICmdDescSetupRings *) s->curr_cmd_data;\n\n\n\n trace_pvscsi_on_cmd_arrived(\"PVSCSI_CMD_SETUP_RINGS\");\n\n\n\n pvscsi_dbg_dump_tx_rings_config(rc);\n\n pvscsi_ring_init_data(&s->rings, rc);\n\n s->rings_info_valid = TRUE;\n\n return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;\n\n}\n"}} {"sample_id": "4fa4ce7107c6ec432f185307158c5df91ce54308_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n \n \n fs->fd = open(rpath(ctx, path, buffer), flags | O_NOFOLLOW);\n+\n+ return fs->fd;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int local_open(FsContext *ctx, V9fsPath *fs_path,\n\n int flags, V9fsFidOpenState *fs)\n\n{\n\n char buffer[PATH_MAX];\n\n char *path = fs_path->data;\n\n\n\n fs->fd = open(rpath(ctx, path, buffer), flags | O_NOFOLLOW);\n\n return fs->fd;\n\n}\n"}} {"sample_id": "2c62f08ddbf3fa80dc7202eb9a2ea60ae44e2cc5_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n \n \n omap_update_display(opaque);\n+\n+ if (omap_lcd && surface_data(surface))\n+\n+ omap_ppm_save(filename, surface_data(surface),\n+\n omap_lcd->width, omap_lcd->height,\n \n surface_stride(surface), errp);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void omap_screen_dump(void *opaque, const char *filename, bool cswitch,\n\n Error **errp)\n\n{\n\n struct omap_lcd_panel_s *omap_lcd = opaque;\n\n DisplaySurface *surface = qemu_console_surface(omap_lcd->con);\n\n\n\n omap_update_display(opaque);\n\n if (omap_lcd && surface_data(surface))\n\n omap_ppm_save(filename, surface_data(surface),\n\n omap_lcd->width, omap_lcd->height,\n\n surface_stride(surface), errp);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_144", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n if (value == 1 || value == 2) {\n \n qemu_system_reset_request();\n+\n+ } else if (value == 3) {\n+\n+ qemu_system_shutdown_request();\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void hb_regs_write(void *opaque, target_phys_addr_t offset,\n\n uint64_t value, unsigned size)\n\n{\n\n uint32_t *regs = opaque;\n\n\n\n if (offset == 0xf00) {\n\n if (value == 1 || value == 2) {\n\n qemu_system_reset_request();\n\n } else if (value == 3) {\n\n qemu_system_shutdown_request();\n\n }\n\n }\n\n\n\n regs[offset/4] = value;\n\n}\n"}} {"sample_id": "6133b39f3c36623425a6ede9e89d93175fde15cd_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void co_sleep_cb(void *opaque)\n \n+{\n+\n+ CoSleepCB *sleep_cb = opaque;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void co_sleep_cb(void *opaque)\n\n{\n\n CoSleepCB *sleep_cb = opaque;\n\n\n\n\n\n aio_co_wake(sleep_cb->co);\n\n}"}} {"sample_id": "902b27d0b8d5bfa840eaf389d7cbcc28b57e3fbe", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n {\n \n BlockDriver *drv = bs->drv;\n+\n+\n+\n+ if (!drv)\n+\n return -ENOMEDIUM;\n \n if (!drv->bdrv_pread)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int bdrv_pread(BlockDriverState *bs, int64_t offset,\n\n void *buf1, int count1)\n\n{\n\n BlockDriver *drv = bs->drv;\n\n\n\n if (!drv)\n\n return -ENOMEDIUM;\n\n if (!drv->bdrv_pread)\n\n return bdrv_pread_em(bs, offset, buf1, count1);\n\n\n\n return drv->bdrv_pread(bs, offset, buf1, count1);\n\n}"}} {"sample_id": "f16a6f667c993a158643b52815ec42961508b0a9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n OCVContext *ocv = ctx->priv;\n \n DilateContext *dilate = ocv->priv;\n+\n char default_kernel_str[] = \"3x3+0x0/rect\";\n+\n char *kernel_str;\n+\n const char *buf = args;\n \n int ret;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static av_cold int dilate_init(AVFilterContext *ctx, const char *args)\n\n{\n\n OCVContext *ocv = ctx->priv;\n\n DilateContext *dilate = ocv->priv;\n\n char default_kernel_str[] = \"3x3+0x0/rect\";\n\n char *kernel_str;\n\n const char *buf = args;\n\n int ret;\n\n\n\n dilate->nb_iterations = 1;\n\n\n\n if (args)\n\n kernel_str = av_get_token(&buf, \"|\");\n\n if ((ret = parse_iplconvkernel(&dilate->kernel,\n\n *kernel_str ? kernel_str : default_kernel_str,\n\n ctx)) < 0)\n\n return ret;\n\n av_free(kernel_str);\n\n\n\n sscanf(buf, \"|%d\", &dilate->nb_iterations);\n\n av_log(ctx, AV_LOG_VERBOSE, \"iterations_nb:%d\\n\", dilate->nb_iterations);\n\n if (dilate->nb_iterations <= 0) {\n\n av_log(ctx, AV_LOG_ERROR, \"Invalid non-positive value '%d' for nb_iterations\\n\",\n\n dilate->nb_iterations);\n\n return AVERROR(EINVAL);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "3d3efba020da1de57a715e2087cf761ed0ad0904_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,14 +2,14 @@\n \n {\n \n+ CPUState *cpu = ENV_GET_CPU(cpu_env);\n+\n+ int sig;\n+\n TaskState *ts = cpu->opaque;\n \n \n+\n if (!ts->signal_pending)\n \n return;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void process_pending_signals(CPUArchState *cpu_env)\n\n{\n\n CPUState *cpu = ENV_GET_CPU(cpu_env);\n\n int sig;\n\n TaskState *ts = cpu->opaque;\n\n\n\n if (!ts->signal_pending)\n\n return;\n\n\n\n /* FIXME: This is not threadsafe. */\n\n for(sig = 1; sig <= TARGET_NSIG; sig++) {\n\n if (ts->sigtab[sig - 1].pending) {\n\n handle_pending_signal(cpu_env, sig);\n\n return;\n\n }\n\n }\n\n /* if no signal is pending, just return */\n\n ts->signal_pending = 0;\n\n return;\n\n}\n"}} {"sample_id": "1a6245a5b0b4e8d822c739b403fc67c8a7bc8d12_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int nbd_handle_list(NBDClient *client, uint32_t length)\n \n+{\n+\n+ int csock;\n+\n+ NBDExport *exp;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int nbd_handle_list(NBDClient *client, uint32_t length)\n\n{\n\n int csock;\n\n NBDExport *exp;\n\n\n\n csock = client->sock;\n\n if (length) {\n\n if (drop_sync(csock, length) != length) {\n\n return -EIO;\n\n }\n\n return nbd_send_rep(csock, NBD_REP_ERR_INVALID, NBD_OPT_LIST);\n\n }\n\n\n\n /* For each export, send a NBD_REP_SERVER reply. */\n\n QTAILQ_FOREACH(exp, &exports, next) {\n\n if (nbd_send_rep_list(csock, exp)) {\n\n return -EINVAL;\n\n }\n\n }\n\n /* Finish with a NBD_REP_ACK. */\n\n return nbd_send_rep(csock, NBD_REP_ACK, NBD_OPT_LIST);\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_48", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,6 +8,6 @@\n \n \n \n+ return false;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool aio_prepare(AioContext *ctx)\n\n{\n\n /* Poll mode cannot be used with glib's event loop, disable it. */\n\n poll_set_started(ctx, false);\n\n\n\n return false;\n\n}\n"}} {"sample_id": "33d7f822f8ed2d1870babc1d04d4d48cf8b6f240", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n {\n \n+ int i;\n \n float speech_energy = 0.0, postfilter_energy = 0.0, gain_scale_factor;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void adaptive_gain_control(float *out, const float *in,\n\n const float *speech_synth,\n\n int size, float alpha, float *gain_mem)\n\n{\n\n int i;\n\n float speech_energy = 0.0, postfilter_energy = 0.0, gain_scale_factor;\n\n float mem = *gain_mem;\n\n\n\n for (i = 0; i < size; i++) {\n\n speech_energy += fabsf(speech_synth[i]);\n\n postfilter_energy += fabsf(in[i]);\n\n }\n\n gain_scale_factor = (1.0 - alpha) * speech_energy / postfilter_energy;\n\n\n\n for (i = 0; i < size; i++) {\n\n mem = alpha * mem + gain_scale_factor;\n\n out[i] = in[i] * mem;\n\n }\n\n\n\n *gain_mem = mem;\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n \n \n iocb = qemu_aio_get(&trim_aiocb_info, bs, cb, opaque);\n+\n+ iocb->bh = qemu_bh_new(ide_trim_bh_cb, iocb);\n+\n+ iocb->ret = 0;\n+\n iocb->qiov = qiov;\n \n iocb->i = -1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "BlockAIOCB *ide_issue_trim(BlockDriverState *bs,\n\n int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,\n\n BlockCompletionFunc *cb, void *opaque)\n\n{\n\n TrimAIOCB *iocb;\n\n\n\n iocb = qemu_aio_get(&trim_aiocb_info, bs, cb, opaque);\n\n iocb->bh = qemu_bh_new(ide_trim_bh_cb, iocb);\n\n iocb->ret = 0;\n\n iocb->qiov = qiov;\n\n iocb->i = -1;\n\n iocb->j = 0;\n\n ide_issue_trim_cb(iocb, 0);\n\n return &iocb->common;\n\n}\n"}} {"sample_id": "8617343faae6ba7e916137c6c9e3ef22c00565d8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int vhost_verify_ring_mappings(struct vhost_dev *dev,\n \n+ uint64_t start_addr,\n \n uint64_t size)\n \n@@ -11,15 +11,15 @@\n for (i = 0; i < dev->nvqs; ++i) {\n \n struct vhost_virtqueue *vq = dev->vqs + i;\n+\n hwaddr l;\n \n void *p;\n+\n \n \n if (!ranges_overlap(start_addr, size, vq->ring_phys, vq->ring_size)) {\n+\n continue;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int vhost_verify_ring_mappings(struct vhost_dev *dev,\n\n uint64_t start_addr,\n\n uint64_t size)\n\n{\n\n int i;\n\n for (i = 0; i < dev->nvqs; ++i) {\n\n struct vhost_virtqueue *vq = dev->vqs + i;\n\n hwaddr l;\n\n void *p;\n\n\n\n if (!ranges_overlap(start_addr, size, vq->ring_phys, vq->ring_size)) {\n\n continue;\n\n }\n\n l = vq->ring_size;\n\n p = cpu_physical_memory_map(vq->ring_phys, &l, 1);\n\n if (!p || l != vq->ring_size) {\n\n fprintf(stderr, \"Unable to map ring buffer for ring %d\\n\", i);\n\n return -ENOMEM;\n\n }\n\n if (p != vq->ring) {\n\n fprintf(stderr, \"Ring buffer relocated for ring %d\\n\", i);\n\n return -EBUSY;\n\n }\n\n cpu_physical_memory_unmap(p, l, 0, 0);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "3fc827d591679f3e262b9d1f8b34528eabfca8c0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -56,11 +56,11 @@\n \n target_el = 3;\n \n+ break;\n+\n+ case CP_ACCESS_TRAP_UNCATEGORIZED:\n+\n+ target_el = exception_target_el(env);\n \n syndrome = syn_uncategorized();\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome)\n\n{\n\n const ARMCPRegInfo *ri = rip;\n\n int target_el;\n\n\n\n if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14\n\n && extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) {\n\n raise_exception(env, EXCP_UDEF, syndrome, exception_target_el(env));\n\n }\n\n\n\n if (!ri->accessfn) {\n\n return;\n\n }\n\n\n\n switch (ri->accessfn(env, ri)) {\n\n case CP_ACCESS_OK:\n\n return;\n\n case CP_ACCESS_TRAP:\n\n target_el = exception_target_el(env);\n\n break;\n\n case CP_ACCESS_TRAP_EL2:\n\n /* Requesting a trap to EL2 when we're in EL3 or S-EL0/1 is\n\n * a bug in the access function.\n\n */\n\n assert(!arm_is_secure(env) && !arm_current_el(env) == 3);\n\n target_el = 2;\n\n break;\n\n case CP_ACCESS_TRAP_EL3:\n\n target_el = 3;\n\n break;\n\n case CP_ACCESS_TRAP_UNCATEGORIZED:\n\n target_el = exception_target_el(env);\n\n syndrome = syn_uncategorized();\n\n break;\n\n default:\n\n g_assert_not_reached();\n\n }\n\n\n\n raise_exception(env, EXCP_UDEF, syndrome, target_el);\n\n}\n"}} {"sample_id": "68d553587c0aa271c3eb2902921b503740d775b6_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static inline int put_dwords(uint32_t addr, uint32_t *buf, int num)\n \n {\n+\n+ int i;\n+\n+\n+\n for(i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {\n \n uint32_t tmp = cpu_to_le32(*buf);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline int put_dwords(uint32_t addr, uint32_t *buf, int num)\n\n{\n\n int i;\n\n\n\n for(i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {\n\n uint32_t tmp = cpu_to_le32(*buf);\n\n cpu_physical_memory_rw(addr,(uint8_t *)&tmp, sizeof(tmp), 1);\n\n }\n\n\n\n return 1;\n\n}\n"}} {"sample_id": "15fa08f8451babc88d733bd411d4c94976f9d0f8_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void arm_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)\n \n+{\n \n DisasContext *dc = container_of(dcbase, DisasContext, base);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void arm_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)\n\n{\n\n DisasContext *dc = container_of(dcbase, DisasContext, base);\n\n\n\n dc->insn_start_idx = tcg_op_buf_count();\n\n tcg_gen_insn_start(dc->pc,\n\n (dc->condexec_cond << 4) | (dc->condexec_mask >> 1),\n\n 0);\n\n}\n"}} {"sample_id": "6b896ab261942f441a16836e3fa3c83f3f4488b9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n \n \n+ if (s->identify_set) {\n+\n+ blk_set_enable_write_cache(s->blk, !!(s->identify_data[85] & (1 << 5)));\n+\n }\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ide_drive_post_load(void *opaque, int version_id)\n\n{\n\n IDEState *s = opaque;\n\n\n\n if (s->identify_set) {\n\n blk_set_enable_write_cache(s->blk, !!(s->identify_data[85] & (1 << 5)));\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "b3db211f3c80bb996a704d665fe275619f728bd4_41", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n \n \n v = validate_test_init_raw(data, schema_json);\n+\n+\n+\n+ visit_type_SchemaInfoList(v, NULL, &schema, &error_abort);\n+\n g_assert(schema);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void do_test_validate_qmp_introspect(TestInputVisitorData *data,\n\n const char *schema_json)\n\n{\n\n SchemaInfoList *schema = NULL;\n\n Visitor *v;\n\n\n\n v = validate_test_init_raw(data, schema_json);\n\n\n\n visit_type_SchemaInfoList(v, NULL, &schema, &error_abort);\n\n g_assert(schema);\n\n\n\n qapi_free_SchemaInfoList(schema);\n\n}\n"}} {"sample_id": "8a805c222caa0e20bf11d2267f726d0bb5917d94_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n /* qemu_aio_flush will execute the rest of the coroutine. */\n \n \n+\n+ qemu_aio_flush();\n+\n+\n+\n /* Back here after the coroutine has finished. */\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_submit_co(void)\n\n{\n\n WorkerTestData data;\n\n Coroutine *co = qemu_coroutine_create(co_test_cb);\n\n\n\n qemu_coroutine_enter(co, &data);\n\n\n\n /* Back here once the worker has started. */\n\n\n\n g_assert_cmpint(active, ==, 1);\n\n g_assert_cmpint(data.ret, ==, -EINPROGRESS);\n\n\n\n /* qemu_aio_flush will execute the rest of the coroutine. */\n\n\n\n qemu_aio_flush();\n\n\n\n /* Back here after the coroutine has finished. */\n\n\n\n g_assert_cmpint(active, ==, 0);\n\n g_assert_cmpint(data.ret, ==, 0);\n\n}\n"}} {"sample_id": "f9aebe2ef52ff0dcb733999f57e00a7b430303c6_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -40,11 +40,11 @@\n \n } else {\n \n+ pci_set_long(dev->config + pci_bar(dev, r), region->type);\n+\n+ }\n+\n+ }\n \n pci_update_mappings(dev);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pci_device_reset(PCIDevice *dev)\n\n{\n\n int r;\n\n\n\n dev->irq_state = 0;\n\n pci_update_irq_status(dev);\n\n /* Clear all writeable bits */\n\n pci_word_test_and_clear_mask(dev->config + PCI_COMMAND,\n\n pci_get_word(dev->wmask + PCI_COMMAND));\n\n dev->config[PCI_CACHE_LINE_SIZE] = 0x0;\n\n dev->config[PCI_INTERRUPT_LINE] = 0x0;\n\n for (r = 0; r < PCI_NUM_REGIONS; ++r) {\n\n PCIIORegion *region = &dev->io_regions[r];\n\n if (!region->size) {\n\n continue;\n\n }\n\n\n\n if (!(region->type & PCI_BASE_ADDRESS_SPACE_IO) &&\n\n region->type & PCI_BASE_ADDRESS_MEM_TYPE_64) {\n\n pci_set_quad(dev->config + pci_bar(dev, r), region->type);\n\n } else {\n\n pci_set_long(dev->config + pci_bar(dev, r), region->type);\n\n }\n\n }\n\n pci_update_mappings(dev);\n\n}\n"}} {"sample_id": "d00e6923b1e2c1bec7840b0a0706764493648527", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n g_assert(!throttle_enabled(&cfg));\n \n+\n \n for (i = 0; i < BUCKETS_COUNT; i++) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_enabled(void)\n\n{\n\n int i;\n\n\n\n throttle_config_init(&cfg);\n\n g_assert(!throttle_enabled(&cfg));\n\n\n\n for (i = 0; i < BUCKETS_COUNT; i++) {\n\n throttle_config_init(&cfg);\n\n set_cfg_value(false, i, 150);\n\n g_assert(throttle_enabled(&cfg));\n\n }\n\n\n\n for (i = 0; i < BUCKETS_COUNT; i++) {\n\n throttle_config_init(&cfg);\n\n set_cfg_value(false, i, -150);\n\n g_assert(!throttle_enabled(&cfg));\n\n }\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_89", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n \n \n+ initial_reset_issued = 1;\n+\n+\n+\n TAILQ_FOREACH(chr, &chardevs, next) {\n \n qemu_chr_reset(chr);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_chr_initial_reset(void)\n\n{\n\n CharDriverState *chr;\n\n\n\n initial_reset_issued = 1;\n\n\n\n TAILQ_FOREACH(chr, &chardevs, next) {\n\n qemu_chr_reset(chr);\n\n }\n\n}\n"}} {"sample_id": "66dd21d50be14a355e296b769d9d99090c0207f7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,10 +9,10 @@\n if (!avcodec_is_open(avctx) || !av_codec_is_decoder(avctx->codec))\n \n return AVERROR(EINVAL);\n+\n+\n \n+ if (avctx->internal->draining)\n \n return AVERROR_EOF;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int attribute_align_arg avcodec_send_packet(AVCodecContext *avctx, const AVPacket *avpkt)\n\n{\n\n int ret;\n\n\n\n if (!avcodec_is_open(avctx) || !av_codec_is_decoder(avctx->codec))\n\n return AVERROR(EINVAL);\n\n\n\n if (avctx->internal->draining)\n\n return AVERROR_EOF;\n\n\n\n if (!avpkt || !avpkt->size) {\n\n avctx->internal->draining = 1;\n\n avpkt = NULL;\n\n\n\n if (!(avctx->codec->capabilities & AV_CODEC_CAP_DELAY))\n\n return 0;\n\n }\n\n\n\n if (avctx->codec->send_packet) {\n\n if (avpkt) {\n\n ret = apply_param_change(avctx, (AVPacket *)avpkt);\n\n if (ret < 0)\n\n return ret;\n\n }\n\n return avctx->codec->send_packet(avctx, avpkt);\n\n }\n\n\n\n // Emulation via old API. Assume avpkt is likely not refcounted, while\n\n // decoder output is always refcounted, and avoid copying.\n\n\n\n if (avctx->internal->buffer_pkt->size || avctx->internal->buffer_frame->buf[0])\n\n return AVERROR(EAGAIN);\n\n\n\n // The goal is decoding the first frame of the packet without using memcpy,\n\n // because the common case is having only 1 frame per packet (especially\n\n // with video, but audio too). In other cases, it can't be avoided, unless\n\n // the user is feeding refcounted packets.\n\n return do_decode(avctx, (AVPacket *)avpkt);\n\n}\n"}} {"sample_id": "d565fef1b83b6c5f8afb32229260b79f67c68109", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n int av_vdpau_bind_context(AVCodecContext *avctx, VdpDevice device,\n \n+ VdpGetProcAddress *get_proc, unsigned flags)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int av_vdpau_bind_context(AVCodecContext *avctx, VdpDevice device,\n\n VdpGetProcAddress *get_proc, unsigned flags)\n\n{\n\n VDPAUHWContext *hwctx;\n\n\n\n if (flags != 0)\n\n return AVERROR(EINVAL);\n\n\n\n if (av_reallocp(&avctx->hwaccel_context, sizeof(*hwctx)))\n\n return AVERROR(ENOMEM);\n\n\n\n hwctx = avctx->hwaccel_context;\n\n\n\n memset(hwctx, 0, sizeof(*hwctx));\n\n hwctx->context.decoder = VDP_INVALID_HANDLE;\n\n hwctx->device = device;\n\n hwctx->get_proc_address = get_proc;\n\n hwctx->reset = 1;\n\n return 0;\n\n}\n"}} {"sample_id": "f56fe04de3cc4cdc6b618dfe7a3506fc2ea79795", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n void ff_mqc_init_contexts(MqcState *mqc)\n \n {\n+\n+ int i;\n+\n+ memset(mqc->cx_states, 0, sizeof(mqc->cx_states));\n+\n mqc->cx_states[MQC_CX_UNI] = 2 * 46;\n \n mqc->cx_states[MQC_CX_RL] = 2 * 3;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_mqc_init_contexts(MqcState *mqc)\n\n{\n\n int i;\n\n memset(mqc->cx_states, 0, sizeof(mqc->cx_states));\n\n mqc->cx_states[MQC_CX_UNI] = 2 * 46;\n\n mqc->cx_states[MQC_CX_RL] = 2 * 3;\n\n mqc->cx_states[0] = 2 * 4;\n\n\n\n for (i = 0; i < 47; i++) {\n\n ff_mqc_qe[2 * i] =\n\n ff_mqc_qe[2 * i + 1] = cx_states[i].qe;\n\n\n\n ff_mqc_nlps[2 * i] = 2 * cx_states[i].nlps + cx_states[i].sw;\n\n ff_mqc_nlps[2 * i + 1] = 2 * cx_states[i].nlps + 1 - cx_states[i].sw;\n\n ff_mqc_nmps[2 * i] = 2 * cx_states[i].nmps;\n\n ff_mqc_nmps[2 * i + 1] = 2 * cx_states[i].nmps + 1;\n\n }\n\n}\n"}} {"sample_id": "b39e3f34c9de7ead6a11a74aa2de78baf41d81a7_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,10 +32,10 @@\n \n }\n \n+\n+\n+ timer_del(icount_warp_timer);\n+\n+ icount_warp_rt();\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_account_warp_timer(void)\n\n{\n\n if (!use_icount || !icount_sleep) {\n\n return;\n\n }\n\n\n\n /* Nothing to do if the VM is stopped: QEMU_CLOCK_VIRTUAL timers\n\n * do not fire, so computing the deadline does not make sense.\n\n */\n\n if (!runstate_is_running()) {\n\n return;\n\n }\n\n\n\n /* warp clock deterministically in record/replay mode */\n\n if (!replay_checkpoint(CHECKPOINT_CLOCK_WARP_ACCOUNT)) {\n\n return;\n\n }\n\n\n\n timer_del(icount_warp_timer);\n\n icount_warp_rt();\n\n}\n"}} {"sample_id": "ad674e53b5cce265fadafbde2c6a4f190345cd00_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n \n \n wait = le16_to_cpu(current->command) & WAIT_MASK;\n+\n+\n+\n+ switch(wait) {\n+\n case WAIT_NEVER: /* don't wait */\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int conditional_wait(DBDMA_channel *ch)\n\n{\n\n dbdma_cmd *current = &ch->current;\n\n uint16_t wait;\n\n uint16_t sel_mask, sel_value;\n\n uint32_t status;\n\n int cond;\n\n\n\n DBDMA_DPRINTF(\"conditional_wait\\n\");\n\n\n\n wait = le16_to_cpu(current->command) & WAIT_MASK;\n\n\n\n switch(wait) {\n\n case WAIT_NEVER: /* don't wait */\n\n return 0;\n\n case WAIT_ALWAYS: /* always wait */\n\n return 1;\n\n }\n\n\n\n status = be32_to_cpu(ch->regs[DBDMA_STATUS]) & DEVSTAT;\n\n\n\n sel_mask = (be32_to_cpu(ch->regs[DBDMA_WAIT_SEL]) >> 16) & 0x0f;\n\n sel_value = be32_to_cpu(ch->regs[DBDMA_WAIT_SEL]) & 0x0f;\n\n\n\n cond = (status & sel_mask) == (sel_value & sel_mask);\n\n\n\n switch(wait) {\n\n case WAIT_IFSET: /* wait if condition bit is 1 */\n\n if (cond)\n\n return 1;\n\n return 0;\n\n case WAIT_IFCLR: /* wait if condition bit is 0 */\n\n if (!cond)\n\n return 1;\n\n return 0;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "f1d8763a02b5fce9a7d9789e049d74a45b15e1e8_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+void ff_update_duplicate_context(MpegEncContext *dst, MpegEncContext *src)\n \n+{\n \n MpegEncContext bak;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void ff_update_duplicate_context(MpegEncContext *dst, MpegEncContext *src)\n\n{\n\n MpegEncContext bak;\n\n int i;\n\n // FIXME copy only needed parts\n\n // START_TIMER\n\n backup_duplicate_context(&bak, dst);\n\n memcpy(dst, src, sizeof(MpegEncContext));\n\n backup_duplicate_context(dst, &bak);\n\n for (i = 0; i < 12; i++) {\n\n dst->pblocks[i] = &dst->block[i];\n\n }\n\n // STOP_TIMER(\"update_duplicate_context\")\n\n // about 10k cycles / 0.01 sec for 1000frames on 1ghz with 2 threads\n\n}\n"}} {"sample_id": "ef76dc59fa5203d146a2acf85a0ad5a5971a4824_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,8 +6,8 @@\n \n \n \n+ QObject *obj = qobject_from_json(empty);\n+\n+ fail_unless(obj == NULL);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "START_TEST(empty_input)\n\n{\n\n const char *empty = \"\";\n\n\n\n QObject *obj = qobject_from_json(empty);\n\n fail_unless(obj == NULL);\n\n}\n"}} {"sample_id": "e058fa2dd599ccc780d334558be9c1d155222b80", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n }\n \n if (s->match.addr > 127) {\n+\n+ error_setg(errp, \"hostaddr out of range\");\n+\n+ return;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void usb_host_realize(USBDevice *udev, Error **errp)\n\n{\n\n USBHostDevice *s = USB_HOST_DEVICE(udev);\n\n\n\n if (s->match.vendor_id > 0xffff) {\n\n error_setg(errp, \"vendorid out of range\");\n\n return;\n\n }\n\n if (s->match.product_id > 0xffff) {\n\n error_setg(errp, \"productid out of range\");\n\n return;\n\n }\n\n if (s->match.addr > 127) {\n\n error_setg(errp, \"hostaddr out of range\");\n\n return;\n\n }\n\n\n\n loglevel = s->loglevel;\n\n udev->flags |= (1 << USB_DEV_FLAG_IS_HOST);\n\n udev->auto_attach = 0;\n\n QTAILQ_INIT(&s->requests);\n\n QTAILQ_INIT(&s->isorings);\n\n\n\n s->exit.notify = usb_host_exit_notifier;\n\n qemu_add_exit_notifier(&s->exit);\n\n\n\n QTAILQ_INSERT_TAIL(&hostdevs, s, next);\n\n usb_host_auto_check(NULL);\n\n}\n"}} {"sample_id": "d0d7708ba29cbcc343364a46bff981e0ff88366f_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n }\n \n+ g_free(chr->filename);\n+\n+ g_free(chr->label);\n+\n qemu_opts_del(chr->opts);\n \n g_free(chr);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_chr_free(CharDriverState *chr)\n\n{\n\n if (chr->chr_close) {\n\n chr->chr_close(chr);\n\n }\n\n g_free(chr->filename);\n\n g_free(chr->label);\n\n qemu_opts_del(chr->opts);\n\n g_free(chr);\n\n}\n"}} {"sample_id": "b946a1533209f61a93e34898aebb5b43154b99c3_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n void smc91c111_init(NICInfo *nd, uint32_t base, qemu_irq irq)\n \n+{\n \n smc91c111_state *s;\n+\n+ int iomemtype;\n \n \n \n+ qemu_check_nic_model(nd, \"smc91c111\");\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void smc91c111_init(NICInfo *nd, uint32_t base, qemu_irq irq)\n\n{\n\n smc91c111_state *s;\n\n int iomemtype;\n\n\n\n qemu_check_nic_model(nd, \"smc91c111\");\n\n\n\n s = (smc91c111_state *)qemu_mallocz(sizeof(smc91c111_state));\n\n iomemtype = cpu_register_io_memory(0, smc91c111_readfn,\n\n smc91c111_writefn, s);\n\n cpu_register_physical_memory(base, 16, iomemtype);\n\n s->irq = irq;\n\n memcpy(s->macaddr, nd->macaddr, 6);\n\n\n\n smc91c111_reset(s);\n\n\n\n s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,\n\n smc91c111_receive, smc91c111_can_receive, s);\n\n qemu_format_nic_info_str(s->vc, s->macaddr);\n\n /* ??? Save/restore. */\n\n}\n"}} {"sample_id": "f61eddcb2bb5cbbdd1d911b7e937db9affc29028_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -66,8 +66,8 @@\n \n qemu_chr_fe_claim_no_fail(chr);\n \n+ monitor_init(chr, flags);\n+\n+ return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mon_init_func(void *opaque, QemuOpts *opts, Error **errp)\n\n{\n\n CharDriverState *chr;\n\n const char *chardev;\n\n const char *mode;\n\n int flags;\n\n\n\n mode = qemu_opt_get(opts, \"mode\");\n\n if (mode == NULL) {\n\n mode = \"readline\";\n\n }\n\n if (strcmp(mode, \"readline\") == 0) {\n\n flags = MONITOR_USE_READLINE;\n\n } else if (strcmp(mode, \"control\") == 0) {\n\n flags = MONITOR_USE_CONTROL;\n\n } else {\n\n fprintf(stderr, \"unknown monitor mode \\\"%s\\\"\\n\", mode);\n\n exit(1);\n\n }\n\n\n\n if (qemu_opt_get_bool(opts, \"pretty\", 0))\n\n flags |= MONITOR_USE_PRETTY;\n\n\n\n if (qemu_opt_get_bool(opts, \"default\", 0))\n\n flags |= MONITOR_IS_DEFAULT;\n\n\n\n chardev = qemu_opt_get(opts, \"chardev\");\n\n chr = qemu_chr_find(chardev);\n\n if (chr == NULL) {\n\n fprintf(stderr, \"chardev \\\"%s\\\" not found\\n\", chardev);\n\n exit(1);\n\n }\n\n\n\n qemu_chr_fe_claim_no_fail(chr);\n\n monitor_init(chr, flags);\n\n return 0;\n\n}\n"}} {"sample_id": "7bd427d801e1e3293a634d3c83beadaa90ffb911_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n {\n \n uint64_t interval = GUI_REFRESH_INTERVAL;\n+\n+\n+\n qemu_flush_coalesced_mmio_buffer();\n \n qemu_mod_timer(nographic_timer, interval + qemu_get_clock(rt_clock));", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void nographic_update(void *opaque)\n\n{\n\n uint64_t interval = GUI_REFRESH_INTERVAL;\n\n\n\n qemu_flush_coalesced_mmio_buffer();\n\n qemu_mod_timer(nographic_timer, interval + qemu_get_clock(rt_clock));\n\n}\n"}} {"sample_id": "7f4ec4364bc4a73036660c1c6a3c4801db524e9e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n uint8_t *ff_stream_new_side_data(AVStream *st, enum AVPacketSideDataType type,\n+\n+ int size)\n+\n+{\n+\n AVPacketSideData *sd, *tmp;\n \n int i;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint8_t *ff_stream_new_side_data(AVStream *st, enum AVPacketSideDataType type,\n\n int size)\n\n{\n\n AVPacketSideData *sd, *tmp;\n\n int i;\n\n uint8_t *data = av_malloc(size);\n\n\n\n if (!data)\n\n return NULL;\n\n\n\n for (i = 0; i < st->nb_side_data; i++) {\n\n sd = &st->side_data[i];\n\n\n\n if (sd->type == type) {\n\n av_freep(&sd->data);\n\n sd->data = data;\n\n sd->size = size;\n\n return sd->data;\n\n }\n\n }\n\n\n\n tmp = av_realloc_array(st->side_data, st->nb_side_data + 1, sizeof(*tmp));\n\n if (!tmp) {\n\n av_freep(&data);\n\n return NULL;\n\n }\n\n\n\n st->side_data = tmp;\n\n st->nb_side_data++;\n\n\n\n sd = &st->side_data[st->nb_side_data - 1];\n\n sd->type = type;\n\n sd->data = data;\n\n sd->size = size;\n\n return data;\n\n}\n"}} {"sample_id": "36bed541ca886da735bef1e8d76d09f8849ed5dd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n int size;\n+\n \n \n if (kernel_filename == NULL && qtest_enabled()) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void puv3_load_kernel(const char *kernel_filename)\n\n{\n\n int size;\n\n\n\n if (kernel_filename == NULL && qtest_enabled()) {\n\n return;\n\n }\n\n assert(kernel_filename != NULL);\n\n\n\n /* only zImage format supported */\n\n size = load_image_targphys(kernel_filename, KERNEL_LOAD_ADDR,\n\n KERNEL_MAX_SIZE);\n\n if (size < 0) {\n\n error_report(\"Load kernel error: '%s'\", kernel_filename);\n\n exit(1);\n\n }\n\n\n\n /* cheat curses that we have a graphic console, only under ocd console */\n\n graphic_console_init(NULL, 0, &no_ops, NULL);\n\n}\n"}} {"sample_id": "d65f97a82c4ed48374a764c769d4ba1ea9724e97", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n s->block_size = be32_to_cpu(s->block_size);\n ret = bdrv_pread(bs->file, 128 + 4, &s->n_blocks, 4);\n if (ret < 0) {\n+ return ret;\n+ s->n_blocks = be32_to_cpu(s->n_blocks);\n+ /* read offsets */\n+ offsets_size = s->n_blocks * sizeof(uint64_t);\n+ s->offsets = g_malloc(offsets_size);\n ret = bdrv_pread(bs->file, 128 + 4 + 4, s->offsets, offsets_size);\n if (ret < 0) {\n goto fail;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int cloop_open(BlockDriverState *bs, QDict *options, int flags,\n Error **errp)\n{\n BDRVCloopState *s = bs->opaque;\n uint32_t offsets_size, max_compressed_block_size = 1, i;\n int ret;\n bs->read_only = 1;\n /* read header */\n ret = bdrv_pread(bs->file, 128, &s->block_size, 4);\n if (ret < 0) {\n return ret;\n s->block_size = be32_to_cpu(s->block_size);\n ret = bdrv_pread(bs->file, 128 + 4, &s->n_blocks, 4);\n if (ret < 0) {\n return ret;\n s->n_blocks = be32_to_cpu(s->n_blocks);\n /* read offsets */\n offsets_size = s->n_blocks * sizeof(uint64_t);\n s->offsets = g_malloc(offsets_size);\n ret = bdrv_pread(bs->file, 128 + 4 + 4, s->offsets, offsets_size);\n if (ret < 0) {\n goto fail;\n for(i=0;in_blocks;i++) {\n s->offsets[i] = be64_to_cpu(s->offsets[i]);\n if (i > 0) {\n uint32_t size = s->offsets[i] - s->offsets[i - 1];\n if (size > max_compressed_block_size) {\n max_compressed_block_size = size;\n /* initialize zlib engine */\n s->compressed_block = g_malloc(max_compressed_block_size + 1);\n s->uncompressed_block = g_malloc(s->block_size);\n if (inflateInit(&s->zstream) != Z_OK) {\n ret = -EINVAL;\n goto fail;\n s->current_block = s->n_blocks;\n s->sectors_per_block = s->block_size/512;\n bs->total_sectors = s->n_blocks * s->sectors_per_block;\n qemu_co_mutex_init(&s->lock);\n return 0;\nfail:\n g_free(s->offsets);\n g_free(s->compressed_block);\n g_free(s->uncompressed_block);\n return ret;"}} {"sample_id": "b23046abe78f48498a423b802d6d86ba0172d57f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,10 +5,10 @@\n AcpiBuildPciBusHotplugState *parent = parent_state;\n \n AcpiBuildPciBusHotplugState *child = g_malloc(sizeof *child);\n+\n+\n+\n+ build_pci_bus_state_init(child, parent, parent->pcihp_bridge_en);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void *build_pci_bus_begin(PCIBus *bus, void *parent_state)\n\n{\n\n AcpiBuildPciBusHotplugState *parent = parent_state;\n\n AcpiBuildPciBusHotplugState *child = g_malloc(sizeof *child);\n\n\n\n build_pci_bus_state_init(child, parent, parent->pcihp_bridge_en);\n\n\n\n return child;\n\n}\n"}} {"sample_id": "384acbf46b70edf0d2c1648aa1a92a90bcf7057d_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ return async_context->id;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int get_async_context_id(void)\n\n{\n\n return async_context->id;\n\n}\n"}} {"sample_id": "d31dbec3742e488156621b9ca21069f8c05aabf0_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -41,11 +41,11 @@\n }\n \n ff_convert_matrix(&ctx->m.dsp, ctx->qmatrix_c, ctx->qmatrix_c16, weight_matrix,\n+\n+ ctx->m.intra_quant_bias, 1, ctx->m.avctx->qmax, 1);\n+\n+ for (qscale = 1; qscale <= ctx->m.avctx->qmax; qscale++) {\n+\n for (i = 0; i < 64; i++) {\n \n ctx->qmatrix_l [qscale] [i] <<= 2; ctx->qmatrix_c [qscale] [i] <<= 2;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int dnxhd_init_qmat(DNXHDEncContext *ctx, int lbias, int cbias)\n\n{\n\n // init first elem to 1 to avoid div by 0 in convert_matrix\n\n uint16_t weight_matrix[64] = {1,}; // convert_matrix needs uint16_t*\n\n int qscale, i;\n\n\n\n CHECKED_ALLOCZ(ctx->qmatrix_l, (ctx->m.avctx->qmax+1) * 64 * sizeof(int));\n\n CHECKED_ALLOCZ(ctx->qmatrix_c, (ctx->m.avctx->qmax+1) * 64 * sizeof(int));\n\n CHECKED_ALLOCZ(ctx->qmatrix_l16, (ctx->m.avctx->qmax+1) * 64 * 2 * sizeof(uint16_t));\n\n CHECKED_ALLOCZ(ctx->qmatrix_c16, (ctx->m.avctx->qmax+1) * 64 * 2 * sizeof(uint16_t));\n\n\n\n for (i = 1; i < 64; i++) {\n\n int j = ctx->m.dsp.idct_permutation[ff_zigzag_direct[i]];\n\n weight_matrix[j] = ctx->cid_table->luma_weight[i];\n\n }\n\n ff_convert_matrix(&ctx->m.dsp, ctx->qmatrix_l, ctx->qmatrix_l16, weight_matrix,\n\n ctx->m.intra_quant_bias, 1, ctx->m.avctx->qmax, 1);\n\n for (i = 1; i < 64; i++) {\n\n int j = ctx->m.dsp.idct_permutation[ff_zigzag_direct[i]];\n\n weight_matrix[j] = ctx->cid_table->chroma_weight[i];\n\n }\n\n ff_convert_matrix(&ctx->m.dsp, ctx->qmatrix_c, ctx->qmatrix_c16, weight_matrix,\n\n ctx->m.intra_quant_bias, 1, ctx->m.avctx->qmax, 1);\n\n for (qscale = 1; qscale <= ctx->m.avctx->qmax; qscale++) {\n\n for (i = 0; i < 64; i++) {\n\n ctx->qmatrix_l [qscale] [i] <<= 2; ctx->qmatrix_c [qscale] [i] <<= 2;\n\n ctx->qmatrix_l16[qscale][0][i] <<= 2; ctx->qmatrix_l16[qscale][1][i] <<= 2;\n\n ctx->qmatrix_c16[qscale][0][i] <<= 2; ctx->qmatrix_c16[qscale][1][i] <<= 2;\n\n }\n\n }\n\n return 0;\n\n fail:\n\n return -1;\n\n}\n"}} {"sample_id": "b1d61eb7aaaef84391130b6f5e83942cc829a8c8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static int mov_read_packet(AVFormatContext *s, AVPacket *pkt)\n+{\n+ MOVContext *mov = s->priv_data;\n+ MOVStreamContext *sc;\n+ AVIndexEntry *sample;\n AVStream *st = NULL;\n int ret;\n mov->fc = s;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int mov_read_packet(AVFormatContext *s, AVPacket *pkt)\n{\n MOVContext *mov = s->priv_data;\n MOVStreamContext *sc;\n AVIndexEntry *sample;\n AVStream *st = NULL;\n int ret;\n mov->fc = s;\n retry:\n sample = mov_find_next_sample(s, &st);\n if (!sample) {\n mov->found_mdat = 0;\n if (!mov->next_root_atom)\n return AVERROR_EOF;\n avio_seek(s->pb, mov->next_root_atom, SEEK_SET);\n mov->next_root_atom = 0;\n if (mov_read_default(mov, s->pb, (MOVAtom){ AV_RL32(\"root\"), INT64_MAX }) < 0 ||\n url_feof(s->pb))\n return AVERROR_EOF;\n av_dlog(s, \"read fragments, offset 0x%\"PRIx64\"\\n\", avio_tell(s->pb));\n goto retry;\n sc = st->priv_data;\n /* must be done just before reading, to avoid infinite loop on sample */\n sc->current_sample++;\n if (st->discard != AVDISCARD_ALL) {\n if (avio_seek(sc->pb, sample->pos, SEEK_SET) != sample->pos) {\n av_log(mov->fc, AV_LOG_ERROR, \"stream %d, offset 0x%\"PRIx64\": partial file\\n\",\n sc->ffindex, sample->pos);\n return AVERROR_INVALIDDATA;\n ret = av_get_packet(sc->pb, pkt, sample->size);\n if (ret < 0)\n return ret;\n if (sc->has_palette) {\n uint8_t *pal;\n pal = av_packet_new_side_data(pkt, AV_PKT_DATA_PALETTE, AVPALETTE_SIZE);\n if (!pal) {\n av_log(mov->fc, AV_LOG_ERROR, \"Cannot append palette to packet\\n\");\n } else {\n memcpy(pal, sc->palette, AVPALETTE_SIZE);\n sc->has_palette = 0;\n#if CONFIG_DV_DEMUXER\n if (mov->dv_demux && sc->dv_audio_container) {\n avpriv_dv_produce_packet(mov->dv_demux, pkt, pkt->data, pkt->size, pkt->pos);\n av_free(pkt->data);\n pkt->size = 0;\n ret = avpriv_dv_get_packet(mov->dv_demux, pkt);\n if (ret < 0)\n return ret;\n#endif\n pkt->stream_index = sc->ffindex;\n pkt->dts = sample->timestamp;\n if (sc->ctts_data && sc->ctts_index < sc->ctts_count) {\n pkt->pts = pkt->dts + sc->dts_shift + sc->ctts_data[sc->ctts_index].duration;\n /* update ctts context */\n sc->ctts_sample++;\n if (sc->ctts_index < sc->ctts_count &&\n sc->ctts_data[sc->ctts_index].count == sc->ctts_sample) {\n sc->ctts_index++;\n sc->ctts_sample = 0;\n if (sc->wrong_dts)\n pkt->dts = AV_NOPTS_VALUE;\n } else {\n int64_t next_dts = (sc->current_sample < st->nb_index_entries) ?\n st->index_entries[sc->current_sample].timestamp : st->duration;\n pkt->duration = next_dts - pkt->dts;\n pkt->pts = pkt->dts;\n if (st->discard == AVDISCARD_ALL)\n goto retry;\n pkt->flags |= sample->flags & AVINDEX_KEYFRAME ? AV_PKT_FLAG_KEY : 0;\n pkt->pos = sample->pos;\n av_dlog(s, \"stream %d, pts %\"PRId64\", dts %\"PRId64\", pos 0x%\"PRIx64\", duration %d\\n\",\n pkt->stream_index, pkt->pts, pkt->dts, pkt->pos, pkt->duration);\n return 0;"}} {"sample_id": "dae7ff04160901a30a35af05f2f149b289c4f0b1_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,8 +5,8 @@\n int ch, i, cbits;\n \n s->lpc_order = get_bits(&s->gb, 5) + 1;\n+\n+ s->lpc_scaling = get_bits(&s->gb, 4);\n \n s->lpc_intbits = get_bits(&s->gb, 3) + 1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "decode_lpc(WmallDecodeCtx *s)\n\n{\n\n int ch, i, cbits;\n\n s->lpc_order = get_bits(&s->gb, 5) + 1;\n\n s->lpc_scaling = get_bits(&s->gb, 4);\n\n s->lpc_intbits = get_bits(&s->gb, 3) + 1;\n\n cbits = s->lpc_scaling + s->lpc_intbits;\n\n for(ch = 0; ch < s->num_channels; ch++) {\n\n\tfor(i = 0; i < s->lpc_order; i++) {\n\n\t s->lpc_coefs[ch][i] = get_sbits(&s->gb, cbits);\n\n\t}\n\n }\n\n}\n"}} {"sample_id": "04097f7c5957273c578f72b9bd603ba6b1d69e33_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n int i, r;\n+\n \n \n for (i = 0; i < hdev->nvqs; ++i) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev)\n\n{\n\n int i, r;\n\n\n\n for (i = 0; i < hdev->nvqs; ++i) {\n\n vhost_virtqueue_cleanup(hdev,\n\n vdev,\n\n hdev->vqs + i,\n\n i);\n\n }\n\n vhost_client_sync_dirty_bitmap(&hdev->client, 0,\n\n (target_phys_addr_t)~0x0ull);\n\n r = vdev->binding->set_guest_notifiers(vdev->binding_opaque, false);\n\n if (r < 0) {\n\n fprintf(stderr, \"vhost guest notifier cleanup failed: %d\\n\", r);\n\n fflush(stderr);\n\n }\n\n assert (r >= 0);\n\n\n\n hdev->started = false;\n\n g_free(hdev->log);\n\n hdev->log = NULL;\n\n hdev->log_size = 0;\n\n}\n"}} {"sample_id": "bb551faa4ac8a798df9757c0ae26893041344bc3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n s->count_load_time = cpu_get_ticks();\n \n s->count_last_edge_check_time = s->count_load_time;\n+\n+ s->count = val;\n+\n+ if (s == &pit_channels[0] && val <= pit_min_timer_count) {\n+\n fprintf(stderr, \n \n \"\\nWARNING: qemu: on your system, accurate timer emulation is impossible if its frequency is more than %d Hz. If using a 2.5.xx Linux kernel, you must patch asm/param.h to change HZ from 1000 to 100.\\n\\n\", ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void pit_load_count(PITChannelState *s, int val)\n\n{\n\n if (val == 0)\n\n val = 0x10000;\n\n s->count_load_time = cpu_get_ticks();\n\n s->count_last_edge_check_time = s->count_load_time;\n\n s->count = val;\n\n if (s == &pit_channels[0] && val <= pit_min_timer_count) {\n\n fprintf(stderr, \n\n \"\\nWARNING: qemu: on your system, accurate timer emulation is impossible if its frequency is more than %d Hz. If using a 2.5.xx Linux kernel, you must patch asm/param.h to change HZ from 1000 to 100.\\n\\n\", \n\n PIT_FREQ / pit_min_timer_count);\n\n }\n\n}\n"}} {"sample_id": "9ed5726c043958359b0f1fa44ab3e4f25f9d9a47", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+target_ulong helper_evpe(target_ulong arg1)\n+\n+{\n \n // TODO\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "target_ulong helper_evpe(target_ulong arg1)\n\n{\n\n // TODO\n\n arg1 = 0;\n\n // rt = arg1\n\n\n\n return arg1;\n\n}\n"}} {"sample_id": "863714ba6cdc09d1a84069815dc67c8da66b0a29", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n void *fdt = vbi->fdt;\n \n+ ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(0));\n+\n+\n+\n+ /* No PSCI for TCG yet */\n \n if (kvm_enabled()) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void fdt_add_psci_node(const VirtBoardInfo *vbi)\n\n{\n\n void *fdt = vbi->fdt;\n\n ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(0));\n\n\n\n /* No PSCI for TCG yet */\n\n if (kvm_enabled()) {\n\n qemu_fdt_add_subnode(fdt, \"/psci\");\n\n if (armcpu->psci_version == 2) {\n\n const char comp[] = \"arm,psci-0.2\\0arm,psci\";\n\n qemu_fdt_setprop(fdt, \"/psci\", \"compatible\", comp, sizeof(comp));\n\n } else {\n\n qemu_fdt_setprop_string(fdt, \"/psci\", \"compatible\", \"arm,psci\");\n\n }\n\n\n\n qemu_fdt_setprop_string(fdt, \"/psci\", \"method\", \"hvc\");\n\n qemu_fdt_setprop_cell(fdt, \"/psci\", \"cpu_suspend\",\n\n QEMU_PSCI_0_1_FN_CPU_SUSPEND);\n\n qemu_fdt_setprop_cell(fdt, \"/psci\", \"cpu_off\", QEMU_PSCI_0_1_FN_CPU_OFF);\n\n qemu_fdt_setprop_cell(fdt, \"/psci\", \"cpu_on\", QEMU_PSCI_0_1_FN_CPU_ON);\n\n qemu_fdt_setprop_cell(fdt, \"/psci\", \"migrate\", QEMU_PSCI_0_1_FN_MIGRATE);\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_31", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,9 +11,9 @@\n if (addr & 7)\n \n ide_ioport_write(&s->bus, addr, val);\n+\n+ else\n+\n+ ide_data_writew(&s->bus, 0, val);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void mmio_ide_write(void *opaque, target_phys_addr_t addr,\n\n uint64_t val, unsigned size)\n\n{\n\n MMIOState *s = opaque;\n\n addr >>= s->shift;\n\n if (addr & 7)\n\n ide_ioport_write(&s->bus, addr, val);\n\n else\n\n ide_data_writew(&s->bus, 0, val);\n\n}\n"}} {"sample_id": "c5633d998a27502ad8cc10c2d46f91b02555ae7a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n XenPTReg *reg_entry;\n \n uint32_t data = 0;\n+\n int rc = 0;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int xen_pt_config_reg_init(XenPCIPassthroughState *s,\n\n XenPTRegGroup *reg_grp, XenPTRegInfo *reg)\n\n{\n\n XenPTReg *reg_entry;\n\n uint32_t data = 0;\n\n int rc = 0;\n\n\n\n reg_entry = g_new0(XenPTReg, 1);\n\n reg_entry->reg = reg;\n\n\n\n if (reg->init) {\n\n /* initialize emulate register */\n\n rc = reg->init(s, reg_entry->reg,\n\n reg_grp->base_offset + reg->offset, &data);\n\n if (rc < 0) {\n\n free(reg_entry);\n\n return rc;\n\n }\n\n if (data == XEN_PT_INVALID_REG) {\n\n /* free unused BAR register entry */\n\n free(reg_entry);\n\n return 0;\n\n }\n\n /* set register value */\n\n reg_entry->data = data;\n\n }\n\n /* list add register entry */\n\n QLIST_INSERT_HEAD(®_grp->reg_tbl_list, reg_entry, entries);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "b131c74a0e485b084ddaffc8214c8a19af492be7_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ return kvm_irqchip_remove_irqfd(s, event_notifier_get_fd(n), virq);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int kvm_irqchip_remove_irq_notifier(KVMState *s, EventNotifier *n, int virq)\n\n{\n\n return kvm_irqchip_remove_irqfd(s, event_notifier_get_fd(n), virq);\n\n}\n"}} {"sample_id": "661e32fb3cb71c7e019daee375be4bb487b9917c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static void virtio_scsi_bad_req(void)\n+\n+{\n \n error_report(\"wrong size for virtio-scsi headers\");\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void virtio_scsi_bad_req(void)\n\n{\n\n error_report(\"wrong size for virtio-scsi headers\");\n\n exit(1);\n\n}\n"}} {"sample_id": "2d6421a90047a83f6722832405fe09571040ea5b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n QList *qobject_to_qlist(const QObject *obj)\n+\n {\n \n if (qobject_type(obj) != QTYPE_QLIST) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "QList *qobject_to_qlist(const QObject *obj)\n\n{\n\n if (qobject_type(obj) != QTYPE_QLIST) {\n\n return NULL;\n\n }\n\n\n\n return container_of(obj, QList, base);\n\n}\n"}} {"sample_id": "08b277ac46da8b02e50cec455eca7cb2d12ffcf0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n {\n \n+ uint64_t *v = pv;\n+\n+ *v = qemu_get_be32(f);\n \n return 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int get_uint64_as_uint32(QEMUFile *f, void *pv, size_t size,\n\n VMStateField *field)\n\n{\n\n uint64_t *v = pv;\n\n *v = qemu_get_be32(f);\n\n return 0;\n\n}\n"}} {"sample_id": "ec53b45bcd1f74f7a4c31331fa6d50b402cd6d26", "diff": "--- a/source.c\n+++ b/source.c\n@@ -42,11 +42,11 @@\n \n QTAILQ_FOREACH(bp, &cpu->breakpoints, entry) {\n \n+ cpu_breakpoint_insert(new_cpu, bp->pc, bp->flags, NULL);\n+\n+ }\n+\n+ QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {\n \n cpu_watchpoint_insert(new_cpu, wp->vaddr, wp->len, wp->flags, NULL);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "CPUArchState *cpu_copy(CPUArchState *env)\n\n{\n\n CPUState *cpu = ENV_GET_CPU(env);\n\n CPUArchState *new_env = cpu_init(cpu_model);\n\n CPUState *new_cpu = ENV_GET_CPU(new_env);\n\n#if defined(TARGET_HAS_ICE)\n\n CPUBreakpoint *bp;\n\n CPUWatchpoint *wp;\n\n#endif\n\n\n\n /* Reset non arch specific state */\n\n cpu_reset(new_cpu);\n\n\n\n memcpy(new_env, env, sizeof(CPUArchState));\n\n\n\n /* Clone all break/watchpoints.\n\n Note: Once we support ptrace with hw-debug register access, make sure\n\n BP_CPU break/watchpoints are handled correctly on clone. */\n\n QTAILQ_INIT(&cpu->breakpoints);\n\n QTAILQ_INIT(&cpu->watchpoints);\n\n#if defined(TARGET_HAS_ICE)\n\n QTAILQ_FOREACH(bp, &cpu->breakpoints, entry) {\n\n cpu_breakpoint_insert(new_cpu, bp->pc, bp->flags, NULL);\n\n }\n\n QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {\n\n cpu_watchpoint_insert(new_cpu, wp->vaddr, wp->len, wp->flags, NULL);\n\n }\n\n#endif\n\n\n\n return new_env;\n\n}\n"}} {"sample_id": "e55ed689a264c78f332745598ea8c58a3422ee13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n int srcW, srcH, dstW, dstH;\n \n+ int flags;\n+\n+\n+\n+ for (srcFormat = 0; srcFormat < PIX_FMT_NB; srcFormat++) {\n \n for (dstFormat = 0; dstFormat < PIX_FMT_NB; dstFormat++) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void selfTest(uint8_t *src[4], int stride[4], int w, int h){\n\n enum PixelFormat srcFormat, dstFormat;\n\n int srcW, srcH, dstW, dstH;\n\n int flags;\n\n\n\n for (srcFormat = 0; srcFormat < PIX_FMT_NB; srcFormat++) {\n\n for (dstFormat = 0; dstFormat < PIX_FMT_NB; dstFormat++) {\n\n printf(\"%s -> %s\\n\",\n\n sws_format_name(srcFormat),\n\n sws_format_name(dstFormat));\n\n fflush(stdout);\n\n\n\n srcW= w;\n\n srcH= h;\n\n for (dstW=w - w/3; dstW<= 4*w/3; dstW+= w/3){\n\n for (dstH=h - h/3; dstH<= 4*h/3; dstH+= h/3){\n\n for (flags=1; flags<33; flags*=2) {\n\n int res;\n\n\n\n res = doTest(src, stride, w, h, srcFormat, dstFormat,\n\n srcW, srcH, dstW, dstH, flags);\n\n if (res < 0) {\n\n dstW = 4 * w / 3;\n\n dstH = 4 * h / 3;\n\n flags = 33;\n\n }\n\n }\n\n }\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "24a370ef2351dc596a7e47508b952ddfba79ef94", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int get_int32_le(QEMUFile *f, void *pv, size_t size)\n \n+{\n+\n+ int32_t *old = pv;\n+\n+ int32_t new;\n \n qemu_get_sbe32s(f, &new);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int get_int32_le(QEMUFile *f, void *pv, size_t size)\n\n{\n\n int32_t *old = pv;\n\n int32_t new;\n\n qemu_get_sbe32s(f, &new);\n\n\n\n if (*old <= new) {\n\n return 0;\n\n }\n\n return -EINVAL;\n\n}\n"}} {"sample_id": "9b2fadda3e0196ffd485adde4fe9cdd6fae35300_21", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void gen_mtsrin(DisasContext *ctx)\n+\n+{\n+\n+#if defined(CONFIG_USER_ONLY)\n \n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_REG);\n \n@@ -10,7 +10,7 @@\n \n TCGv t0;\n \n+ if (unlikely(ctx->pr)) {\n \n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_REG);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_mtsrin(DisasContext *ctx)\n\n{\n\n#if defined(CONFIG_USER_ONLY)\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_REG);\n\n#else\n\n TCGv t0;\n\n if (unlikely(ctx->pr)) {\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_REG);\n\n return;\n\n }\n\n t0 = tcg_temp_new();\n\n tcg_gen_shri_tl(t0, cpu_gpr[rB(ctx->opcode)], 28);\n\n tcg_gen_andi_tl(t0, t0, 0xF);\n\n gen_helper_store_sr(cpu_env, t0, cpu_gpr[rD(ctx->opcode)]);\n\n tcg_temp_free(t0);\n\n#endif\n\n}\n"}} {"sample_id": "4cad3867b6df2c0826ae508a9fe15dd0b9d8936a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+int fw_cfg_add_i32(FWCfgState *s, uint16_t key, uint32_t value)\n \n {\n \n+ uint32_t *copy;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int fw_cfg_add_i32(FWCfgState *s, uint16_t key, uint32_t value)\n\n{\n\n uint32_t *copy;\n\n\n\n copy = g_malloc(sizeof(value));\n\n *copy = cpu_to_le32(value);\n\n return fw_cfg_add_bytes(s, key, (uint8_t *)copy, sizeof(value));\n\n}\n"}} {"sample_id": "3eadc68ebd174f5bad51fe6e0bbcf6d6651c784c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void os_set_proc_name(const char *s)\n \n {\n+\n+#if defined(PR_SET_NAME)\n \n char name[16];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void os_set_proc_name(const char *s)\n\n{\n\n#if defined(PR_SET_NAME)\n\n char name[16];\n\n if (!s)\n\n return;\n\n name[sizeof(name) - 1] = 0;\n\n strncpy(name, s, sizeof(name));\n\n /* Could rewrite argv[0] too, but that's a bit more complicated.\n\n This simple way is enough for `top'. */\n\n if (prctl(PR_SET_NAME, name)) {\n\n perror(\"unable to change process name\");\n\n exit(1);\n\n }\n\n#else\n\n fprintf(stderr, \"Change of process name not supported by your OS\\n\");\n\n exit(1);\n\n#endif\n\n}\n"}} {"sample_id": "6687b79d636cd60ed9adb1177d0d946b58fa7717_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+int net_init_bridge(QemuOpts *opts, const char *name, VLANState *vlan)\n \n {\n \n@@ -9,7 +9,7 @@\n \n \n if (!qemu_opt_get(opts, \"br\")) {\n+\n qemu_opt_set(opts, \"br\", DEFAULT_BRIDGE_INTERFACE);\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int net_init_bridge(QemuOpts *opts, const char *name, VLANState *vlan)\n\n{\n\n TAPState *s;\n\n int fd, vnet_hdr;\n\n\n\n if (!qemu_opt_get(opts, \"br\")) {\n\n qemu_opt_set(opts, \"br\", DEFAULT_BRIDGE_INTERFACE);\n\n }\n\n if (!qemu_opt_get(opts, \"helper\")) {\n\n qemu_opt_set(opts, \"helper\", DEFAULT_BRIDGE_HELPER);\n\n }\n\n\n\n fd = net_bridge_run_helper(qemu_opt_get(opts, \"helper\"),\n\n qemu_opt_get(opts, \"br\"));\n\n if (fd == -1) {\n\n return -1;\n\n }\n\n\n\n fcntl(fd, F_SETFL, O_NONBLOCK);\n\n\n\n vnet_hdr = tap_probe_vnet_hdr(fd);\n\n\n\n s = net_tap_fd_init(vlan, \"bridge\", name, fd, vnet_hdr);\n\n if (!s) {\n\n close(fd);\n\n return -1;\n\n }\n\n\n\n snprintf(s->nc.info_str, sizeof(s->nc.info_str), \"helper=%s,br=%s\",\n\n qemu_opt_get(opts, \"helper\"), qemu_opt_get(opts, \"br\"));\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "37ad223c515da2fe9f1c679768cb5ccaa42e57e1_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n spcr->base_address.address = cpu_to_le64(uart_memmap->base);\n \n+\n+\n+ spcr->interrupt_types = (1 << 3); /* Bit[3] ARMH GIC interrupt */\n+\n+ spcr->gsi = cpu_to_le32(irq); /* Global System Interrupt */\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "build_spcr(GArray *table_data, GArray *linker, VirtGuestInfo *guest_info)\n\n{\n\n AcpiSerialPortConsoleRedirection *spcr;\n\n const MemMapEntry *uart_memmap = &guest_info->memmap[VIRT_UART];\n\n int irq = guest_info->irqmap[VIRT_UART] + ARM_SPI_BASE;\n\n\n\n spcr = acpi_data_push(table_data, sizeof(*spcr));\n\n\n\n spcr->interface_type = 0x3; /* ARM PL011 UART */\n\n\n\n spcr->base_address.space_id = AML_SYSTEM_MEMORY;\n\n spcr->base_address.bit_width = 8;\n\n spcr->base_address.bit_offset = 0;\n\n spcr->base_address.access_width = 1;\n\n spcr->base_address.address = cpu_to_le64(uart_memmap->base);\n\n\n\n spcr->interrupt_types = (1 << 3); /* Bit[3] ARMH GIC interrupt */\n\n spcr->gsi = cpu_to_le32(irq); /* Global System Interrupt */\n\n\n\n spcr->baud = 3; /* Baud Rate: 3 = 9600 */\n\n spcr->parity = 0; /* No Parity */\n\n spcr->stopbits = 1; /* 1 Stop bit */\n\n spcr->flowctrl = (1 << 1); /* Bit[1] = RTS/CTS hardware flow control */\n\n spcr->term_type = 0; /* Terminal Type: 0 = VT100 */\n\n\n\n spcr->pci_device_id = 0xffff; /* PCI Device ID: not a PCI device */\n\n spcr->pci_vendor_id = 0xffff; /* PCI Vendor ID: not a PCI device */\n\n\n\n build_header(linker, table_data, (void *)spcr, \"SPCR\", sizeof(*spcr), 2,\n\n NULL);\n\n}\n"}} {"sample_id": "f1d3b99154138741161fc52f5a8c373bf71613c6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,7 +19,7 @@\n \n \n dev = qvirtio_mmio_init_device(MMIO_DEV_BASE_ADDR, MMIO_PAGE_SIZE);\n+\n g_assert(dev != NULL);\n \n g_assert_cmphex(dev->vdev.device_type, ==, VIRTIO_ID_BLOCK);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void mmio_basic(void)\n\n{\n\n QVirtioMMIODevice *dev;\n\n QVirtQueue *vq;\n\n QGuestAllocator *alloc;\n\n int n_size = TEST_IMAGE_SIZE / 2;\n\n uint64_t capacity;\n\n\n\n arm_test_start();\n\n\n\n dev = qvirtio_mmio_init_device(MMIO_DEV_BASE_ADDR, MMIO_PAGE_SIZE);\n\n g_assert(dev != NULL);\n\n g_assert_cmphex(dev->vdev.device_type, ==, VIRTIO_ID_BLOCK);\n\n\n\n qvirtio_reset(&qvirtio_mmio, &dev->vdev);\n\n qvirtio_set_acknowledge(&qvirtio_mmio, &dev->vdev);\n\n qvirtio_set_driver(&qvirtio_mmio, &dev->vdev);\n\n\n\n alloc = generic_alloc_init(MMIO_RAM_ADDR, MMIO_RAM_SIZE, MMIO_PAGE_SIZE);\n\n vq = qvirtqueue_setup(&qvirtio_mmio, &dev->vdev, alloc, 0);\n\n\n\n test_basic(&qvirtio_mmio, &dev->vdev, alloc, vq,\n\n QVIRTIO_MMIO_DEVICE_SPECIFIC);\n\n\n\n qmp(\"{ 'execute': 'block_resize', 'arguments': { 'device': 'drive0', \"\n\n \" 'size': %d } }\", n_size);\n\n\n\n qvirtio_wait_queue_isr(&qvirtio_mmio, &dev->vdev, vq,\n\n QVIRTIO_BLK_TIMEOUT_US);\n\n\n\n capacity = qvirtio_config_readq(&qvirtio_mmio, &dev->vdev,\n\n QVIRTIO_MMIO_DEVICE_SPECIFIC);\n\n g_assert_cmpint(capacity, ==, n_size / 512);\n\n\n\n /* End test */\n\n guest_free(alloc, vq->desc);\n\n generic_alloc_uninit(alloc);\n\n g_free(dev);\n\n test_end();\n\n}\n"}} {"sample_id": "e976c6a1e40ad74d616a186d3b48b0ad8f5eb970", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n static int qcow_write(BlockDriverState *bs, int64_t sector_num,\n \n const uint8_t *buf, int nb_sectors)\n+\n {\n \n BDRVQcowState *s = bs->opaque;\n \n int ret, index_in_cluster, n;\n+\n uint64_t cluster_offset;\n \n int n_end;\n@@ -15,7 +15,7 @@\n \n \n while (nb_sectors > 0) {\n+\n index_in_cluster = sector_num & (s->cluster_sectors - 1);\n \n n_end = index_in_cluster + nb_sectors;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int qcow_write(BlockDriverState *bs, int64_t sector_num,\n\n const uint8_t *buf, int nb_sectors)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n int ret, index_in_cluster, n;\n\n uint64_t cluster_offset;\n\n int n_end;\n\n\n\n while (nb_sectors > 0) {\n\n index_in_cluster = sector_num & (s->cluster_sectors - 1);\n\n n_end = index_in_cluster + nb_sectors;\n\n if (s->crypt_method &&\n\n n_end > QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors)\n\n n_end = QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors;\n\n cluster_offset = alloc_cluster_offset(bs, sector_num << 9,\n\n index_in_cluster,\n\n n_end, &n);\n\n if (!cluster_offset)\n\n return -1;\n\n if (s->crypt_method) {\n\n encrypt_sectors(s, sector_num, s->cluster_data, buf, n, 1,\n\n &s->aes_encrypt_key);\n\n ret = bdrv_pwrite(s->hd, cluster_offset + index_in_cluster * 512,\n\n s->cluster_data, n * 512);\n\n } else {\n\n ret = bdrv_pwrite(s->hd, cluster_offset + index_in_cluster * 512, buf, n * 512);\n\n }\n\n if (ret != n * 512)\n\n return -1;\n\n nb_sectors -= n;\n\n sector_num += n;\n\n buf += n * 512;\n\n }\n\n s->cluster_cache_offset = -1; /* disable compressed cache */\n\n return 0;\n\n}\n"}} {"sample_id": "bec1631100323fac0900aea71043d5c4e22fc2fa_15", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n tcg_out_reloc(s, s->code_ptr + 1, R_390_PC16DBL, labelno, -2);\n \n }\n+\n+\n+\n+ tcg_out16(s, (opc & 0xff00) | (r1 << 4) | cc);\n+\n tcg_out16(s, off);\n \n tcg_out16(s, (i2 << 8) | (opc & 0xff));", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void tgen_compare_imm_branch(TCGContext *s, S390Opcode opc, int cc,\n\n TCGReg r1, int i2, int labelno)\n\n{\n\n TCGLabel* l = &s->labels[labelno];\n\n tcg_target_long off;\n\n\n\n if (l->has_value) {\n\n off = l->u.value_ptr - s->code_ptr;\n\n } else {\n\n /* We need to keep the offset unchanged for retranslation. */\n\n off = s->code_ptr[1];\n\n tcg_out_reloc(s, s->code_ptr + 1, R_390_PC16DBL, labelno, -2);\n\n }\n\n\n\n tcg_out16(s, (opc & 0xff00) | (r1 << 4) | cc);\n\n tcg_out16(s, off);\n\n tcg_out16(s, (i2 << 8) | (opc & 0xff));\n\n}\n"}} {"sample_id": "f8ed85ac992c48814d916d5df4d44f9a971c5de4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void cg3_initfn(Object *obj)\n \n {\n+\n SysBusDevice *sbd = SYS_BUS_DEVICE(obj);\n \n CG3State *s = CG3(obj);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void cg3_initfn(Object *obj)\n\n{\n\n SysBusDevice *sbd = SYS_BUS_DEVICE(obj);\n\n CG3State *s = CG3(obj);\n\n\n\n memory_region_init_ram(&s->rom, NULL, \"cg3.prom\", FCODE_MAX_ROM_SIZE,\n\n &error_abort);\n\n memory_region_set_readonly(&s->rom, true);\n\n sysbus_init_mmio(sbd, &s->rom);\n\n\n\n memory_region_init_io(&s->reg, NULL, &cg3_reg_ops, s, \"cg3.reg\",\n\n CG3_REG_SIZE);\n\n sysbus_init_mmio(sbd, &s->reg);\n\n}\n"}} {"sample_id": "7d1b0095bff7157e856d1d0e6c4295641ced2752_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n TCGv tmp;\n+\n tcg_gen_add_i32(dest, t0, t1);\n \n tmp = load_cpu_field(CF);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_add_carry(TCGv dest, TCGv t0, TCGv t1)\n\n{\n\n TCGv tmp;\n\n tcg_gen_add_i32(dest, t0, t1);\n\n tmp = load_cpu_field(CF);\n\n tcg_gen_add_i32(dest, dest, tmp);\n\n dead_tmp(tmp);\n\n}\n"}} {"sample_id": "37f573543c4fd7f44339e04d8d15b95118493ddd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n {\n \n const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(pix_fmt);\n+\n+ int i;\n+\n+\n+\n for (i = 0; i < 4; i++) {\n \n int plane = desc->comp[i].plane;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int check_image_pointers(uint8_t *data[4], enum AVPixelFormat pix_fmt,\n\n const int linesizes[4])\n\n{\n\n const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(pix_fmt);\n\n int i;\n\n\n\n for (i = 0; i < 4; i++) {\n\n int plane = desc->comp[i].plane;\n\n if (!data[plane] || !linesizes[plane])\n\n return 0;\n\n }\n\n\n\n return 1;\n\n}\n"}} {"sample_id": "3176217c60ca7828712985092d9102d331ea4f3d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n width = h->avctx->width;\n \n+ height = h->avctx->height;\n+\n+ }\n+\n+\n \n if (width <= 0 || height <= 0) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int init_dimensions(H264Context *h)\n\n{\n\n int width = h->width - (h->sps.crop_right + h->sps.crop_left);\n\n int height = h->height - (h->sps.crop_top + h->sps.crop_bottom);\n\n\n\n /* handle container cropping */\n\n if (FFALIGN(h->avctx->width, 16) == FFALIGN(width, 16) &&\n\n FFALIGN(h->avctx->height, 16) == FFALIGN(height, 16)) {\n\n width = h->avctx->width;\n\n height = h->avctx->height;\n\n }\n\n\n\n if (width <= 0 || height <= 0) {\n\n av_log(h->avctx, AV_LOG_ERROR, \"Invalid cropped dimensions: %dx%d.\\n\",\n\n width, height);\n\n if (h->avctx->err_recognition & AV_EF_EXPLODE)\n\n return AVERROR_INVALIDDATA;\n\n\n\n av_log(h->avctx, AV_LOG_WARNING, \"Ignoring cropping information.\\n\");\n\n h->sps.crop_bottom =\n\n h->sps.crop_top =\n\n h->sps.crop_right =\n\n h->sps.crop_left =\n\n h->sps.crop = 0;\n\n\n\n width = h->width;\n\n height = h->height;\n\n }\n\n\n\n h->avctx->coded_width = h->width;\n\n h->avctx->coded_height = h->height;\n\n h->avctx->width = width;\n\n h->avctx->height = height;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "81cf8d8adc64203567e03326c13ea4abec9fe5df_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void helper_check_iow(CPUX86State *env, uint32_t t0)\n \n {\n+\n check_io(env, t0, 2);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void helper_check_iow(CPUX86State *env, uint32_t t0)\n\n{\n\n check_io(env, t0, 2);\n\n}\n"}} {"sample_id": "0fada67420e29f389119ca6f44285203400e0730", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ return section->address_space == get_system_memory()\n+\n && memory_region_is_ram(section->mr);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool vhost_section(MemoryRegionSection *section)\n\n{\n\n return section->address_space == get_system_memory()\n\n && memory_region_is_ram(section->mr);\n\n}\n"}} {"sample_id": "a89f364ae8740dfc31b321eed9ee454e996dc3c1_19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -48,11 +48,11 @@\n \n printf(\"%s: Tx FIFO overrun\\n\", __FUNCTION__);\n \n+ return;\n+\n+ }\n+\n+\n \n omap_badwidth_write16(opaque, addr, value);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void omap_mcbsp_writew(void *opaque, hwaddr addr,\n\n uint32_t value)\n\n{\n\n struct omap_mcbsp_s *s = (struct omap_mcbsp_s *) opaque;\n\n int offset = addr & OMAP_MPUI_REG_MASK;\n\n\n\n if (offset == 0x04) {\t\t\t\t/* DXR */\n\n if (((s->xcr[0] >> 5) & 7) < 3)\t\t\t/* XWDLEN1 */\n\n return;\n\n if (s->tx_req > 3) {\n\n s->tx_req -= 4;\n\n if (s->codec && s->codec->cts) {\n\n s->codec->out.fifo[s->codec->out.len ++] =\n\n (value >> 24) & 0xff;\n\n s->codec->out.fifo[s->codec->out.len ++] =\n\n (value >> 16) & 0xff;\n\n s->codec->out.fifo[s->codec->out.len ++] =\n\n (value >> 8) & 0xff;\n\n s->codec->out.fifo[s->codec->out.len ++] =\n\n (value >> 0) & 0xff;\n\n }\n\n if (s->tx_req < 4)\n\n omap_mcbsp_tx_done(s);\n\n } else\n\n printf(\"%s: Tx FIFO overrun\\n\", __FUNCTION__);\n\n return;\n\n }\n\n\n\n omap_badwidth_write16(opaque, addr, value);\n\n}\n"}} {"sample_id": "bd269ebc82fbaa5fe7ce5bc7c1770ac8acecd884_17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -54,8 +54,8 @@\n \n abort();\n \n+ }\n+\n+ return fd;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int socket_connect(SocketAddressLegacy *addr, NonBlockingConnectHandler *callback,\n\n void *opaque, Error **errp)\n\n{\n\n int fd;\n\n\n\n switch (addr->type) {\n\n case SOCKET_ADDRESS_LEGACY_KIND_INET:\n\n fd = inet_connect_saddr(addr->u.inet.data, callback, opaque, errp);\n\n break;\n\n\n\n case SOCKET_ADDRESS_LEGACY_KIND_UNIX:\n\n fd = unix_connect_saddr(addr->u.q_unix.data, callback, opaque, errp);\n\n break;\n\n\n\n case SOCKET_ADDRESS_LEGACY_KIND_FD:\n\n fd = monitor_get_fd(cur_mon, addr->u.fd.data->str, errp);\n\n if (fd >= 0 && callback) {\n\n qemu_set_nonblock(fd);\n\n callback(fd, NULL, opaque);\n\n }\n\n break;\n\n\n\n case SOCKET_ADDRESS_LEGACY_KIND_VSOCK:\n\n fd = vsock_connect_saddr(addr->u.vsock.data, callback, opaque, errp);\n\n break;\n\n\n\n default:\n\n abort();\n\n }\n\n return fd;\n\n}\n"}} {"sample_id": "7f84c1272b601be88daeb828ec1890890c7aae25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+bool qemu_signalfd_available(void)\n+\n+{\n+\n #ifdef CONFIG_SIGNALFD\n \n errno = 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool qemu_signalfd_available(void)\n\n{\n\n#ifdef CONFIG_SIGNALFD\n\n errno = 0;\n\n syscall(SYS_signalfd, -1, NULL, _NSIG / 8);\n\n return errno != ENOSYS;\n\n#else\n\n return false;\n\n#endif\n\n}\n"}} {"sample_id": "01ecb7172b684f1c4b3e748f95c5a9a494ca36ec", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void quantize_and_encode_band_mips(struct AACEncContext *s, PutBitContext *pb,\n+\n const float *in, float *out, int size, int scale_idx,\n \n int cb, const float lambda, int rtz)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void quantize_and_encode_band_mips(struct AACEncContext *s, PutBitContext *pb,\n\n const float *in, float *out, int size, int scale_idx,\n\n int cb, const float lambda, int rtz)\n\n{\n\n quantize_and_encode_band_cost(s, pb, in, out, NULL, size, scale_idx, cb, lambda,\n\n INFINITY, NULL, (rtz) ? ROUND_TO_ZERO : ROUND_STANDARD);\n\n}\n"}} {"sample_id": "d6b6abc51dda79a97f2c7bd6652c1940c068f1ec", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n void *data, size_t len)\n \n {\n+\n int i, index;\n \n void *ptr = NULL;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void *fw_cfg_modify_file(FWCfgState *s, const char *filename,\n\n void *data, size_t len)\n\n{\n\n int i, index;\n\n void *ptr = NULL;\n\n\n\n assert(s->files);\n\n\n\n index = be32_to_cpu(s->files->count);\n\n assert(index < fw_cfg_file_slots(s));\n\n\n\n for (i = 0; i < index; i++) {\n\n if (strcmp(filename, s->files->f[i].name) == 0) {\n\n ptr = fw_cfg_modify_bytes_read(s, FW_CFG_FILE_FIRST + i,\n\n data, len);\n\n s->files->f[i].size = cpu_to_be32(len);\n\n return ptr;\n\n }\n\n }\n\n /* add new one */\n\n fw_cfg_add_file_callback(s, filename, NULL, NULL, NULL, data, len, true);\n\n return NULL;\n\n}\n"}} {"sample_id": "3e305e4a4752f70c0b5c3cf5b43ec957881714f7_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n+static ssize_t vnc_client_write_tls(gnutls_session_t *session,\n+\n+ const uint8_t *data,\n+\n+ size_t datalen)\n \n+{\n \n+ ssize_t ret = gnutls_write(*session, data, datalen);\n \n+ if (ret < 0) {\n \n if (ret == GNUTLS_E_AGAIN) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static ssize_t vnc_client_write_tls(gnutls_session_t *session,\n\n const uint8_t *data,\n\n size_t datalen)\n\n{\n\n ssize_t ret = gnutls_write(*session, data, datalen);\n\n if (ret < 0) {\n\n if (ret == GNUTLS_E_AGAIN) {\n\n errno = EAGAIN;\n\n } else {\n\n errno = EIO;\n\n }\n\n ret = -1;\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "ecca3b397d06a957b18913ff9afc63860001cfdf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n int n;\n \n+\n \n s->pio_aiocb = NULL;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void ide_sector_read_cb(void *opaque, int ret)\n\n{\n\n IDEState *s = opaque;\n\n int n;\n\n\n\n s->pio_aiocb = NULL;\n\n s->status &= ~BUSY_STAT;\n\n\n\n if (ret == -ECANCELED) {\n\n return;\n\n }\n\n block_acct_done(blk_get_stats(s->blk), &s->acct);\n\n if (ret != 0) {\n\n if (ide_handle_rw_error(s, -ret, IDE_RETRY_PIO |\n\n IDE_RETRY_READ)) {\n\n return;\n\n }\n\n }\n\n\n\n n = s->nsector;\n\n if (n > s->req_nb_sectors) {\n\n n = s->req_nb_sectors;\n\n }\n\n\n\n ide_set_sector(s, ide_get_sector(s) + n);\n\n s->nsector -= n;\n\n /* Allow the guest to read the io_buffer */\n\n ide_transfer_start(s, s->io_buffer, n * BDRV_SECTOR_SIZE, ide_sector_read);\n\n ide_set_irq(s->bus);\n\n}\n"}} {"sample_id": "b3db211f3c80bb996a704d665fe275619f728bd4_58", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n Visitor *v;\n \n Error *err = NULL;\n+\n+\n+\n+ v = validate_test_init(data, \"3.14\");\n+\n \n \n visit_type_UserDefAlternate(v, NULL, &tmp, &err);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_validate_fail_alternate(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n UserDefAlternate *tmp;\n\n Visitor *v;\n\n Error *err = NULL;\n\n\n\n v = validate_test_init(data, \"3.14\");\n\n\n\n visit_type_UserDefAlternate(v, NULL, &tmp, &err);\n\n error_free_or_abort(&err);\n\n g_assert(!tmp);\n\n}\n"}} {"sample_id": "1753f3dc177a82f8b3c5ea8d2a32737db9411dd4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,7 +17,7 @@\n \n \n uint8_t lba_index = NVME_ID_NS_FLBAS_INDEX(ns->id_ns.flbas);\n+\n uint8_t data_shift = ns->id_ns.lbaf[lba_index].ds;\n \n uint64_t data_size = (uint64_t)nlb << data_shift;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint16_t nvme_rw(NvmeCtrl *n, NvmeNamespace *ns, NvmeCmd *cmd,\n\n NvmeRequest *req)\n\n{\n\n NvmeRwCmd *rw = (NvmeRwCmd *)cmd;\n\n uint32_t nlb = le32_to_cpu(rw->nlb) + 1;\n\n uint64_t slba = le64_to_cpu(rw->slba);\n\n uint64_t prp1 = le64_to_cpu(rw->prp1);\n\n uint64_t prp2 = le64_to_cpu(rw->prp2);\n\n\n\n uint8_t lba_index = NVME_ID_NS_FLBAS_INDEX(ns->id_ns.flbas);\n\n uint8_t data_shift = ns->id_ns.lbaf[lba_index].ds;\n\n uint64_t data_size = (uint64_t)nlb << data_shift;\n\n uint64_t aio_slba = slba << (data_shift - BDRV_SECTOR_BITS);\n\n int is_write = rw->opcode == NVME_CMD_WRITE ? 1 : 0;\n\n\n\n if ((slba + nlb) > ns->id_ns.nsze) {\n\n return NVME_LBA_RANGE | NVME_DNR;\n\n }\n\n if (nvme_map_prp(&req->qsg, prp1, prp2, data_size, n)) {\n\n return NVME_INVALID_FIELD | NVME_DNR;\n\n }\n\n assert((nlb << data_shift) == req->qsg.size);\n\n\n\n req->has_sg = true;\n\n dma_acct_start(n->conf.blk, &req->acct, &req->qsg,\n\n is_write ? BLOCK_ACCT_WRITE : BLOCK_ACCT_READ);\n\n req->aiocb = is_write ?\n\n dma_blk_write(n->conf.blk, &req->qsg, aio_slba, nvme_rw_cb, req) :\n\n dma_blk_read(n->conf.blk, &req->qsg, aio_slba, nvme_rw_cb, req);\n\n\n\n return NVME_NO_COMPLETE;\n\n}\n"}} {"sample_id": "4f298a4b2957b7833bc607c951ca27c458d98d88_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void clr_msg_flags(IPMIBmcSim *ibs,\n \n uint8_t *cmd, unsigned int cmd_len,\n+\n uint8_t *rsp, unsigned int *rsp_len,\n \n unsigned int max_rsp_len)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void clr_msg_flags(IPMIBmcSim *ibs,\n\n uint8_t *cmd, unsigned int cmd_len,\n\n uint8_t *rsp, unsigned int *rsp_len,\n\n unsigned int max_rsp_len)\n\n{\n\n IPMIInterface *s = ibs->parent.intf;\n\n IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);\n\n\n\n IPMI_CHECK_CMD_LEN(3);\n\n ibs->msg_flags &= ~cmd[2];\n\n k->set_atn(s, attn_set(ibs), attn_irq_enabled(ibs));\n\n}\n"}} {"sample_id": "9c5ce8db2e5c2769ed2fd3d91928dd1853b5ce7c_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n type1.version);\n \n smbios_maybe_add_str(1, offsetof(struct smbios_type_1, serial_number_str),\n+\n+ type1.serial);\n+\n+ smbios_maybe_add_str(1, offsetof(struct smbios_type_1, sku_number_str),\n+\n type1.sku);\n \n smbios_maybe_add_str(1, offsetof(struct smbios_type_1, family_str),", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void smbios_build_type_1_fields(void)\n\n{\n\n smbios_maybe_add_str(1, offsetof(struct smbios_type_1, manufacturer_str),\n\n type1.manufacturer);\n\n smbios_maybe_add_str(1, offsetof(struct smbios_type_1, product_name_str),\n\n type1.product);\n\n smbios_maybe_add_str(1, offsetof(struct smbios_type_1, version_str),\n\n type1.version);\n\n smbios_maybe_add_str(1, offsetof(struct smbios_type_1, serial_number_str),\n\n type1.serial);\n\n smbios_maybe_add_str(1, offsetof(struct smbios_type_1, sku_number_str),\n\n type1.sku);\n\n smbios_maybe_add_str(1, offsetof(struct smbios_type_1, family_str),\n\n type1.family);\n\n if (qemu_uuid_set) {\n\n /* We don't encode the UUID in the \"wire format\" here because this\n\n * function is for legacy mode and needs to keep the guest ABI, and\n\n * because we don't know what's the SMBIOS version advertised by the\n\n * BIOS.\n\n */\n\n smbios_add_field(1, offsetof(struct smbios_type_1, uuid),\n\n qemu_uuid, 16);\n\n }\n\n}\n"}} {"sample_id": "6950cca97fed890ec56259a2f868f37b65513d92", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n linesizes[0] = (width * (desc->comp[0].step_minus1+1) + 7) >> 3;\n \n return 0;\n+\n+ }\n+\n+\n+\n av_image_fill_max_pixsteps(max_step, max_step_comp, desc);\n \n for (i = 0; i < 4; i++) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int av_image_fill_linesizes(int linesizes[4], enum PixelFormat pix_fmt, int width)\n\n{\n\n int i;\n\n const AVPixFmtDescriptor *desc = &av_pix_fmt_descriptors[pix_fmt];\n\n int max_step [4]; /* max pixel step for each plane */\n\n int max_step_comp[4]; /* the component for each plane which has the max pixel step */\n\n\n\n memset(linesizes, 0, 4*sizeof(linesizes[0]));\n\n\n\n if (desc->flags & PIX_FMT_HWACCEL)\n\n return AVERROR(EINVAL);\n\n\n\n if (desc->flags & PIX_FMT_BITSTREAM) {\n\n linesizes[0] = (width * (desc->comp[0].step_minus1+1) + 7) >> 3;\n\n return 0;\n\n }\n\n\n\n av_image_fill_max_pixsteps(max_step, max_step_comp, desc);\n\n for (i = 0; i < 4; i++) {\n\n int s = (max_step_comp[i] == 1 || max_step_comp[i] == 2) ? desc->log2_chroma_w : 0;\n\n linesizes[i] = max_step[i] * (((width + (1 << s) - 1)) >> s);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "44696296d5c2ffccef9d43d37d4f525bba7d9f5c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n \t\t\t TCGv d, TCGv op_a, TCGv op_b, int size)\n \n {\n+\n \tTCGv tmp;\n \n \tint writeback;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void cris_alu(DisasContext *dc, int op,\n\n\t\t\t TCGv d, TCGv op_a, TCGv op_b, int size)\n\n{\n\n\tTCGv tmp;\n\n\tint writeback;\n\n\n\n\twriteback = 1;\n\n\n\n\tif (op == CC_OP_BOUND || op == CC_OP_BTST)\n\n\t\ttmp = tcg_temp_local_new(TCG_TYPE_TL);\n\n\telse\n\n\t\ttmp = tcg_temp_new(TCG_TYPE_TL);\n\n\n\n\tif (op == CC_OP_CMP) {\n\n\t\twriteback = 0;\n\n\t} else if (size == 4) {\n\n\t\ttmp = d;\n\n\t\twriteback = 0;\n\n\t}\n\n\n\n\tcris_pre_alu_update_cc(dc, op, op_a, op_b, size);\n\n\tcris_alu_op_exec(dc, op, tmp, op_a, op_b, size);\n\n\tcris_update_result(dc, tmp);\n\n\n\n\t/* Writeback. */\n\n\tif (writeback) {\n\n\t\tif (size == 1)\n\n\t\t\ttcg_gen_andi_tl(d, d, ~0xff);\n\n\t\telse\n\n\t\t\ttcg_gen_andi_tl(d, d, ~0xffff);\n\n\t\ttcg_gen_or_tl(d, d, tmp);\n\n\t}\n\n\tif (tmp != d)\n\n\t\ttcg_temp_free(tmp);\n\n}\n"}} {"sample_id": "ff100c9dd97d2f1f456ff38b192edf84f9744738", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,11 +34,11 @@\n \n av_free(buf);\n \n+\n+\n+ // initialization range\n+\n+ // 5 is the offset of Cluster ID.\n \n av_dict_set_int(&s->streams[0]->metadata, INITIALIZATION_RANGE, avio_tell(s->pb) - 5, 0);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int webm_dash_manifest_read_header(AVFormatContext *s)\n\n{\n\n char *buf;\n\n int ret = matroska_read_header(s);\n\n MatroskaTrack *tracks;\n\n MatroskaDemuxContext *matroska = s->priv_data;\n\n if (ret) {\n\n av_log(s, AV_LOG_ERROR, \"Failed to read file headers\\n\");\n\n return -1;\n\n\n\n\n\n\n\n\n\n if (!matroska->is_live) {\n\n buf = av_asprintf(\"%g\", matroska->duration);\n\n if (!buf) return AVERROR(ENOMEM);\n\n av_dict_set(&s->streams[0]->metadata, DURATION, buf, 0);\n\n av_free(buf);\n\n\n\n // initialization range\n\n // 5 is the offset of Cluster ID.\n\n av_dict_set_int(&s->streams[0]->metadata, INITIALIZATION_RANGE, avio_tell(s->pb) - 5, 0);\n\n\n\n\n // basename of the file\n\n buf = strrchr(s->filename, '/');\n\n av_dict_set(&s->streams[0]->metadata, FILENAME, buf ? ++buf : s->filename, 0);\n\n\n\n // track number\n\n tracks = matroska->tracks.elem;\n\n av_dict_set_int(&s->streams[0]->metadata, TRACK_NUMBER, tracks[0].num, 0);\n\n\n\n // parse the cues and populate Cue related fields\n\n return matroska->is_live ? 0 : webm_dash_manifest_cues(s);\n"}} {"sample_id": "5331773cc33ba26b9e26ace643d926219e46a17b_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void ff_id3v2_read(AVFormatContext *s, const char *magic,\n+\n+ ID3v2ExtraMeta **extra_meta)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_id3v2_read(AVFormatContext *s, const char *magic,\n\n ID3v2ExtraMeta **extra_meta)\n\n{\n\n id3v2_read_internal(s->pb, &s->metadata, s, magic, extra_meta);\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_78", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n {\n \n trace_bdrv_co_writev(bs, sector_num, nb_sectors);\n+\n+\n+\n return bdrv_co_do_writev(bs, sector_num, nb_sectors, qiov, 0);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int coroutine_fn bdrv_co_writev(BlockDriverState *bs, int64_t sector_num,\n\n int nb_sectors, QEMUIOVector *qiov)\n\n{\n\n trace_bdrv_co_writev(bs, sector_num, nb_sectors);\n\n\n\n return bdrv_co_do_writev(bs, sector_num, nb_sectors, qiov, 0);\n\n}\n"}} {"sample_id": "773eb74babe07bc5c97c32aa564efc40e2d4b00c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,7 +20,7 @@\n \n dshowdebug(\"libAVMemInputPin_Receive(%p)\\n\", this);\n \n+\n \n if (!sample)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "libAVMemInputPin_Receive(libAVMemInputPin *this, IMediaSample *sample)\n\n{\n\n libAVPin *pin = (libAVPin *) ((uint8_t *) this - imemoffset);\n\n enum dshowDeviceType devtype = pin->filter->type;\n\n void *priv_data;\n\n uint8_t *buf;\n\n int buf_size;\n\n int index;\n\n int64_t curtime;\n\n\n\n dshowdebug(\"libAVMemInputPin_Receive(%p)\\n\", this);\n\n\n\n if (!sample)\n\n return E_POINTER;\n\n\n\n if (devtype == VideoDevice) {\n\n /* PTS from video devices is unreliable. */\n\n IReferenceClock *clock = pin->filter->clock;\n\n IReferenceClock_GetTime(clock, &curtime);\n\n } else {\n\n int64_t dummy;\n\n IMediaSample_GetTime(sample, &curtime, &dummy);\n\n curtime += pin->filter->start_time;\n\n }\n\n\n\n buf_size = IMediaSample_GetActualDataLength(sample);\n\n IMediaSample_GetPointer(sample, &buf);\n\n priv_data = pin->filter->priv_data;\n\n index = pin->filter->stream_index;\n\n\n\n pin->filter->callback(priv_data, index, buf, buf_size, curtime);\n\n\n\n return S_OK;\n\n}\n"}} {"sample_id": "234ac1a9025bcfcc532449f72a97b3d4754d466c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n assert(!bdrv_requests_pending(new));\n \n \n+\n+ bdrv_ref(old);\n+\n+\n+\n change_parent_backing_link(old, new);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bdrv_replace_in_backing_chain(BlockDriverState *old, BlockDriverState *new)\n\n{\n\n assert(!bdrv_requests_pending(old));\n\n assert(!bdrv_requests_pending(new));\n\n\n\n bdrv_ref(old);\n\n\n\n change_parent_backing_link(old, new);\n\n\n\n bdrv_unref(old);\n\n}\n"}} {"sample_id": "280beebd399b2d2c9bf58438c2aa2a22a0a53282", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n /* alloc top line of predictors */\n \n+ h->top_qp = av_malloc( h->mb_width);\n+\n+ h->top_mv[0] = av_malloc((h->mb_width*2+1)*sizeof(cavs_vector));\n+\n+ h->top_mv[1] = av_malloc((h->mb_width*2+1)*sizeof(cavs_vector));\n \n h->top_pred_Y = av_malloc( h->mb_width*2*sizeof(*h->top_pred_Y));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_cavs_init_top_lines(AVSContext *h) {\n\n /* alloc top line of predictors */\n\n h->top_qp = av_malloc( h->mb_width);\n\n h->top_mv[0] = av_malloc((h->mb_width*2+1)*sizeof(cavs_vector));\n\n h->top_mv[1] = av_malloc((h->mb_width*2+1)*sizeof(cavs_vector));\n\n h->top_pred_Y = av_malloc( h->mb_width*2*sizeof(*h->top_pred_Y));\n\n h->top_border_y = av_malloc((h->mb_width+1)*16);\n\n h->top_border_u = av_malloc( h->mb_width * 10);\n\n h->top_border_v = av_malloc( h->mb_width * 10);\n\n\n\n /* alloc space for co-located MVs and types */\n\n h->col_mv = av_malloc( h->mb_width*h->mb_height*4*sizeof(cavs_vector));\n\n h->col_type_base = av_malloc(h->mb_width*h->mb_height);\n\n h->block = av_mallocz(64*sizeof(DCTELEM));\n\n}\n"}} {"sample_id": "e3329474a366de066b25e86f35f5abf9c5a4b7b2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static av_always_inline void avcodec_thread_park_workers(ThreadContext *c, int thread_count)\n+\n {\n \n pthread_cond_wait(&c->last_job_cond, &c->current_job_lock);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static av_always_inline void avcodec_thread_park_workers(ThreadContext *c, int thread_count)\n\n{\n\n pthread_cond_wait(&c->last_job_cond, &c->current_job_lock);\n\n pthread_mutex_unlock(&c->current_job_lock);\n\n}\n"}} {"sample_id": "ef1e1e0782e99c9dcf2b35e5310cdd8ca9211374_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n if (ssd->ptr_move) {\n \n g_free(ssd->ptr_move);\n+\n+ }\n+\n+ ssd->ptr_move = qemu_spice_create_cursor_update(ssd, NULL, on);\n+\n qemu_mutex_unlock(&ssd->lock);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void display_mouse_set(DisplayChangeListener *dcl,\n\n int x, int y, int on)\n\n{\n\n SimpleSpiceDisplay *ssd = container_of(dcl, SimpleSpiceDisplay, dcl);\n\n\n\n qemu_mutex_lock(&ssd->lock);\n\n ssd->ptr_x = x;\n\n ssd->ptr_y = y;\n\n if (ssd->ptr_move) {\n\n g_free(ssd->ptr_move);\n\n }\n\n ssd->ptr_move = qemu_spice_create_cursor_update(ssd, NULL, on);\n\n qemu_mutex_unlock(&ssd->lock);\n\n}\n"}} {"sample_id": "7084851534c834f00652f90a9da5e4032bd22130", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int protocol_version(VncState *vs, char *version, size_t len)\n+\n+{\n+\n+ char local[13];\n+\n int maj, min;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int protocol_version(VncState *vs, char *version, size_t len)\n\n{\n\n char local[13];\n\n int maj, min;\n\n\n\n memcpy(local, version, 12);\n\n local[12] = 0;\n\n\n\n if (sscanf(local, \"RFB %03d.%03d\\n\", &maj, &min) != 2) {\n\n\tvnc_client_error(vs);\n\n\treturn 0;\n\n }\n\n\n\n vnc_write_u32(vs, 1); /* None */\n\n vnc_flush(vs);\n\n\n\n vnc_read_when(vs, protocol_client_init, 1);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "7453c96b78c2b09aa72924f933bb9616e5474194", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static int inc_refcounts(BlockDriverState *bs,\n \n+ BdrvCheckResult *res,\n \n uint16_t **refcount_table,\n \n@@ -17,7 +17,7 @@\n int ret;\n \n \n+\n if (size <= 0) {\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int inc_refcounts(BlockDriverState *bs,\n\n BdrvCheckResult *res,\n\n uint16_t **refcount_table,\n\n int64_t *refcount_table_size,\n\n int64_t offset, int64_t size)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n uint64_t start, last, cluster_offset, k;\n\n int ret;\n\n\n\n if (size <= 0) {\n\n return 0;\n\n }\n\n\n\n start = start_of_cluster(s, offset);\n\n last = start_of_cluster(s, offset + size - 1);\n\n for(cluster_offset = start; cluster_offset <= last;\n\n cluster_offset += s->cluster_size) {\n\n k = cluster_offset >> s->cluster_bits;\n\n if (k >= *refcount_table_size) {\n\n ret = realloc_refcount_array(s, refcount_table,\n\n refcount_table_size, k + 1);\n\n if (ret < 0) {\n\n res->check_errors++;\n\n return ret;\n\n }\n\n }\n\n\n\n if (++(*refcount_table)[k] == 0) {\n\n fprintf(stderr, \"ERROR: overflow cluster offset=0x%\" PRIx64\n\n \"\\n\", cluster_offset);\n\n res->corruptions++;\n\n }\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "e23a1b33b53d25510320b26d9f154e19c6c99725_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n target_phys_addr_t addrg,\n \n qemu_irq **parent_irq)\n+\n {\n \n DeviceState *dev;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static DeviceState *slavio_intctl_init(target_phys_addr_t addr,\n\n target_phys_addr_t addrg,\n\n qemu_irq **parent_irq)\n\n{\n\n DeviceState *dev;\n\n SysBusDevice *s;\n\n unsigned int i, j;\n\n\n\n dev = qdev_create(NULL, \"slavio_intctl\");\n\n qdev_init(dev);\n\n\n\n s = sysbus_from_qdev(dev);\n\n\n\n for (i = 0; i < MAX_CPUS; i++) {\n\n for (j = 0; j < MAX_PILS; j++) {\n\n sysbus_connect_irq(s, i * MAX_PILS + j, parent_irq[i][j]);\n\n }\n\n }\n\n sysbus_mmio_map(s, 0, addrg);\n\n for (i = 0; i < MAX_CPUS; i++) {\n\n sysbus_mmio_map(s, i + 1, addr + i * TARGET_PAGE_SIZE);\n\n }\n\n\n\n return dev;\n\n}\n"}} {"sample_id": "7385aed20db5d83979f683b9d0048674411e963c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static inline void gen_op_fcmpd(int fccno, TCGv_i64 r_rs1, TCGv_i64 r_rs2)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_op_fcmpd(int fccno, TCGv_i64 r_rs1, TCGv_i64 r_rs2)\n\n{\n\n gen_helper_fcmpd(cpu_env, r_rs1, r_rs2);\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -45,11 +45,11 @@\n qemu_put_be32(f, se->instance_id);\n \n qemu_put_be32(f, se->version_id);\n+\n+\n+\n+ se->save_live_state(f, QEMU_VM_SECTION_START, se->opaque);\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_savevm_state_begin(QEMUFile *f)\n\n{\n\n SaveStateEntry *se;\n\n\n\n qemu_put_be32(f, QEMU_VM_FILE_MAGIC);\n\n qemu_put_be32(f, QEMU_VM_FILE_VERSION);\n\n\n\n TAILQ_FOREACH(se, &savevm_handlers, entry) {\n\n int len;\n\n\n\n if (se->save_live_state == NULL)\n\n continue;\n\n\n\n /* Section type */\n\n qemu_put_byte(f, QEMU_VM_SECTION_START);\n\n qemu_put_be32(f, se->section_id);\n\n\n\n /* ID string */\n\n len = strlen(se->idstr);\n\n qemu_put_byte(f, len);\n\n qemu_put_buffer(f, (uint8_t *)se->idstr, len);\n\n\n\n qemu_put_be32(f, se->instance_id);\n\n qemu_put_be32(f, se->version_id);\n\n\n\n se->save_live_state(f, QEMU_VM_SECTION_START, se->opaque);\n\n }\n\n\n\n if (qemu_file_has_error(f))\n\n return -EIO;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d4862a87e31a51de9eb260f25c9e99a75efe3235", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n s->count_latched = RW_STATE_MSB;\n break;\n } else {\n+ switch(s->read_state) {\n+ default:\n+ case RW_STATE_LSB:\n+ count = pit_get_count(s);\n+ ret = count & 0xff;\n break;\n case RW_STATE_MSB:\n count = pit_get_count(s);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint64_t pit_ioport_read(void *opaque, hwaddr addr,\n unsigned size)\n{\n PITCommonState *pit = opaque;\n int ret, count;\n PITChannelState *s;\n addr &= 3;\n s = &pit->channels[addr];\n if (s->status_latched) {\n s->status_latched = 0;\n ret = s->status;\n } else if (s->count_latched) {\n switch(s->count_latched) {\n default:\n case RW_STATE_LSB:\n ret = s->latched_count & 0xff;\n s->count_latched = 0;\n break;\n case RW_STATE_MSB:\n ret = s->latched_count >> 8;\n s->count_latched = 0;\n break;\n case RW_STATE_WORD0:\n ret = s->latched_count & 0xff;\n s->count_latched = RW_STATE_MSB;\n break;\n } else {\n switch(s->read_state) {\n default:\n case RW_STATE_LSB:\n count = pit_get_count(s);\n ret = count & 0xff;\n break;\n case RW_STATE_MSB:\n count = pit_get_count(s);\n ret = (count >> 8) & 0xff;\n break;\n case RW_STATE_WORD0:\n count = pit_get_count(s);\n ret = count & 0xff;\n s->read_state = RW_STATE_WORD1;\n break;\n case RW_STATE_WORD1:\n count = pit_get_count(s);\n ret = (count >> 8) & 0xff;\n s->read_state = RW_STATE_WORD0;\n break;\n return ret;"}} {"sample_id": "1ea879e5580f63414693655fcf0328559cdce138_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n hw->clip (dst, src1, src_len1);\n \n }\n+\n+\n+\n+ if (src_len2) {\n+\n dst = advance (dst, src_len1 << hw->info.shift);\n \n hw->clip (dst, src2, src_len2);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void dsound_write_sample (HWVoiceOut *hw, uint8_t *dst, int dst_len)\n\n{\n\n int src_len1 = dst_len;\n\n int src_len2 = 0;\n\n int pos = hw->rpos + dst_len;\n\n st_sample_t *src1 = hw->mix_buf + hw->rpos;\n\n st_sample_t *src2 = NULL;\n\n\n\n if (pos > hw->samples) {\n\n src_len1 = hw->samples - hw->rpos;\n\n src2 = hw->mix_buf;\n\n src_len2 = dst_len - src_len1;\n\n pos = src_len2;\n\n }\n\n\n\n if (src_len1) {\n\n hw->clip (dst, src1, src_len1);\n\n }\n\n\n\n if (src_len2) {\n\n dst = advance (dst, src_len1 << hw->info.shift);\n\n hw->clip (dst, src2, src_len2);\n\n }\n\n\n\n hw->rpos = pos % hw->samples;\n\n}\n"}} {"sample_id": "8542f9c4f17125d483c40c0c5723842f1c982f81", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,19 +1,19 @@\n+static uint32_t parse_peak(const uint8_t *peak)\n+\n+{\n+\n+ int64_t val = 0;\n+\n+ int64_t scale = 1;\n+\n+\n+\n+ if (!peak)\n+\n+ return 0;\n+\n \n+\n peak += strspn(peak, \" \\t\");\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static uint32_t parse_peak(const uint8_t *peak)\n\n{\n\n int64_t val = 0;\n\n int64_t scale = 1;\n\n\n\n if (!peak)\n\n return 0;\n\n\n\n peak += strspn(peak, \" \\t\");\n\n\n\n if (peak[0] == '1' && peak[1] == '.')\n\n return UINT32_MAX;\n\n else if (!(peak[0] == '0' && peak[1] == '.'))\n\n return 0;\n\n\n\n peak += 2;\n\n\n\n while (av_isdigit(*peak)) {\n\n int digit = *peak - '0';\n\n\n\n if (scale > INT64_MAX / 10)\n\n break;\n\n\n\n val = 10 * val + digit;\n\n scale *= 10;\n\n\n\n peak++;\n\n }\n\n\n\n return av_rescale(val, UINT32_MAX, scale);\n\n}\n"}} {"sample_id": "77b0359bf414ad666d1714dc9888f1017c08e283", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n item = QTAILQ_FIRST(queue);\n \n g_assert(item->type == QEMU_INPUT_QUEUE_DELAY);\n+\n+ QTAILQ_REMOVE(queue, item, node);\n+\n+\n+ g_free(item);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void qemu_input_queue_process(void *opaque)\n\n{\n\n struct QemuInputEventQueueHead *queue = opaque;\n\n QemuInputEventQueue *item;\n\n\n\n g_assert(!QTAILQ_EMPTY(queue));\n\n item = QTAILQ_FIRST(queue);\n\n g_assert(item->type == QEMU_INPUT_QUEUE_DELAY);\n\n QTAILQ_REMOVE(queue, item, node);\n\n\n g_free(item);\n\n\n\n while (!QTAILQ_EMPTY(queue)) {\n\n item = QTAILQ_FIRST(queue);\n\n switch (item->type) {\n\n case QEMU_INPUT_QUEUE_DELAY:\n\n timer_mod(item->timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL)\n\n + item->delay_ms);\n\n return;\n\n case QEMU_INPUT_QUEUE_EVENT:\n\n qemu_input_event_send(item->src, item->evt);\n\n qapi_free_InputEvent(item->evt);\n\n break;\n\n case QEMU_INPUT_QUEUE_SYNC:\n\n qemu_input_event_sync();\n\n break;\n\n }\n\n QTAILQ_REMOVE(queue, item, node);\n\n\n g_free(item);\n\n }\n\n}"}} {"sample_id": "91f4a44ff4fa55e0a48f71c432a1dc3158d662b9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static int packed_16bpc_bswap(SwsContext *c, const uint8_t *src[],\n+\n+ int srcStride[], int srcSliceY, int srcSliceH,\n+\n+ uint8_t *dst[], int dstStride[])\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int packed_16bpc_bswap(SwsContext *c, const uint8_t *src[],\n\n int srcStride[], int srcSliceY, int srcSliceH,\n\n uint8_t *dst[], int dstStride[])\n\n{\n\n int i, j, p;\n\n\n\n for (p = 0; p < 4; p++) {\n\n int srcstr = srcStride[p] >> 1;\n\n int dststr = dstStride[p] >> 1;\n\n uint16_t *dstPtr = (uint16_t *) dst[p];\n\n const uint16_t *srcPtr = (const uint16_t *) src[p];\n\n int min_stride = FFMIN(srcstr, dststr);\n\n if(!dstPtr || !srcPtr)\n\n continue;\n\n for (i = 0; i < (srcSliceH >> c->chrDstVSubSample); i++) {\n\n for (j = 0; j < min_stride; j++) {\n\n dstPtr[j] = av_bswap16(srcPtr[j]);\n\n }\n\n srcPtr += srcstr;\n\n dstPtr += dststr;\n\n }\n\n }\n\n\n\n return srcSliceH;\n\n}\n"}} {"sample_id": "a12a5a1a0132527afe87c079e4aae4aad372bd94_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n {\n \n+ UserDefOneList *head = NULL;\n+\n Error *err = NULL;\n \n Visitor *v;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_validate_fail_list(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n UserDefOneList *head = NULL;\n\n Error *err = NULL;\n\n Visitor *v;\n\n\n\n v = validate_test_init(data, \"[ { 'string': 'string0', 'integer': 42 }, { 'string': 'string1', 'integer': 43 }, { 'string': 'string2', 'integer': 44, 'extra': 'ggg' } ]\");\n\n\n\n visit_type_UserDefOneList(v, &head, NULL, &err);\n\n g_assert(err);\n\n error_free(err);\n\n qapi_free_UserDefOneList(head);\n\n}\n"}} {"sample_id": "b027a538c6790bcfc93ef7f4819fe3e581445959_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n \n \n switch (cmd) {\n+\n case VOICE_ENABLE:\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int oss_ctl_in (HWVoiceIn *hw, int cmd, ...)\n\n{\n\n OSSVoiceIn *oss = (OSSVoiceIn *) hw;\n\n\n\n switch (cmd) {\n\n case VOICE_ENABLE:\n\n {\n\n va_list ap;\n\n int poll_mode;\n\n\n\n va_start (ap, cmd);\n\n poll_mode = va_arg (ap, int);\n\n va_end (ap);\n\n\n\n if (poll_mode && oss_poll_in (hw)) {\n\n poll_mode = 0;\n\n }\n\n hw->poll_mode = poll_mode;\n\n }\n\n break;\n\n\n\n case VOICE_DISABLE:\n\n if (hw->poll_mode) {\n\n hw->poll_mode = 0;\n\n qemu_set_fd_handler (oss->fd, NULL, NULL, NULL);\n\n }\n\n break;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "c5acdc9ab4e6aa9b05e6242114479333b15d496b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,9 +19,9 @@\n g_free(bitmap);\n \n return;\n+\n+ }\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bdrv_release_dirty_bitmap(BlockDriverState *bs, BdrvDirtyBitmap *bitmap)\n\n{\n\n BdrvDirtyBitmap *bm, *next;\n\n QLIST_FOREACH_SAFE(bm, &bs->dirty_bitmaps, list, next) {\n\n if (bm == bitmap) {\n\n assert(!bdrv_dirty_bitmap_frozen(bm));\n\n QLIST_REMOVE(bitmap, list);\n\n hbitmap_free(bitmap->bitmap);\n\n g_free(bitmap->name);\n\n g_free(bitmap);\n\n return;\n\n }\n\n }\n\n}\n"}} {"sample_id": "dc87758775e2ce8be84e4fe598e12416e83d2845", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n uint8_t *buffer;\n \n int max_buffer_size = s->max_packet_size ?\n+\n+ s->max_packet_size : IO_BUFFER_SIZE;\n+\n+ int filled = s->buf_end - s->buffer;\n+\n ptrdiff_t checksum_ptr_offset = s->checksum_ptr ? s->checksum_ptr - s->buffer : -1;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int ffio_ensure_seekback(AVIOContext *s, int64_t buf_size)\n\n{\n\n uint8_t *buffer;\n\n int max_buffer_size = s->max_packet_size ?\n\n s->max_packet_size : IO_BUFFER_SIZE;\n\n int filled = s->buf_end - s->buffer;\n\n ptrdiff_t checksum_ptr_offset = s->checksum_ptr ? s->checksum_ptr - s->buffer : -1;\n\n\n\n buf_size += s->buf_ptr - s->buffer + max_buffer_size;\n\n\n\n if (buf_size < filled || s->seekable || !s->read_packet)\n\n return 0;\n\n av_assert0(!s->write_flag);\n\n\n\n buffer = av_malloc(buf_size);\n\n if (!buffer)\n\n return AVERROR(ENOMEM);\n\n\n\n memcpy(buffer, s->buffer, filled);\n\n av_free(s->buffer);\n\n s->buf_ptr = buffer + (s->buf_ptr - s->buffer);\n\n s->buf_end = buffer + (s->buf_end - s->buffer);\n\n s->buffer = buffer;\n\n s->buffer_size = buf_size;\n\n\n\n return 0;\n\n}"}} {"sample_id": "299b520cd4092be3c53f8380b81315c33927d9d3_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static inline int ultrasparc_tag_match(SparcTLBEntry *tlb,\n \n uint64_t address, uint64_t context,\n \n@@ -10,7 +10,7 @@\n \n uint64_t mask;\n \n+\n \n switch ((tlb->tte >> 61) & 3) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline int ultrasparc_tag_match(SparcTLBEntry *tlb,\n\n uint64_t address, uint64_t context,\n\n target_phys_addr_t *physical,\n\n int is_nucleus)\n\n{\n\n uint64_t mask;\n\n\n\n switch ((tlb->tte >> 61) & 3) {\n\n default:\n\n case 0x0: // 8k\n\n mask = 0xffffffffffffe000ULL;\n\n break;\n\n case 0x1: // 64k\n\n mask = 0xffffffffffff0000ULL;\n\n break;\n\n case 0x2: // 512k\n\n mask = 0xfffffffffff80000ULL;\n\n break;\n\n case 0x3: // 4M\n\n mask = 0xffffffffffc00000ULL;\n\n break;\n\n }\n\n\n\n // valid, context match, virtual address match?\n\n if (TTE_IS_VALID(tlb->tte) &&\n\n ((is_nucleus && compare_masked(0, tlb->tag, 0x1fff))\n\n || TTE_IS_GLOBAL(tlb->tte) || compare_masked(context, tlb->tag, 0x1fff))\n\n && compare_masked(address, tlb->tag, mask))\n\n {\n\n // decode physical address\n\n *physical = ((tlb->tte & mask) | (address & ~mask)) & 0x1ffffffe000ULL;\n\n return 1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "efec3dd631d94160288392721a5f9c39e50fb2bc_36", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n \n \n+ k->no_hotplug = 1;\n \n k->init = pci_piix_ide_initfn;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void piix3_ide_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);\n\n\n\n k->no_hotplug = 1;\n\n k->init = pci_piix_ide_initfn;\n\n k->exit = pci_piix_ide_exitfn;\n\n k->vendor_id = PCI_VENDOR_ID_INTEL;\n\n k->device_id = PCI_DEVICE_ID_INTEL_82371SB_1;\n\n k->class_id = PCI_CLASS_STORAGE_IDE;\n\n set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);\n\n dc->no_user = 1;\n\n}\n"}} {"sample_id": "2469ed32c81ebf2347e6883091c566724b286167", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,7 +15,7 @@\n uint64_t bits[MAX_PARTITION_ORDER+1];\n \n int opt_porder;\n+\n RiceContext tmp_rc;\n \n int kmax = (1 << rc->coding_mode) - 2;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint64_t calc_rice_params(RiceContext *rc,\n\n uint32_t udata[FLAC_MAX_BLOCKSIZE],\n\n uint64_t sums[32][MAX_PARTITIONS],\n\n int pmin, int pmax,\n\n const int32_t *data, int n, int pred_order, int exact)\n\n{\n\n int i;\n\n uint64_t bits[MAX_PARTITION_ORDER+1];\n\n int opt_porder;\n\n RiceContext tmp_rc;\n\n int kmax = (1 << rc->coding_mode) - 2;\n\n\n\n av_assert1(pmin >= 0 && pmin <= MAX_PARTITION_ORDER);\n\n av_assert1(pmax >= 0 && pmax <= MAX_PARTITION_ORDER);\n\n av_assert1(pmin <= pmax);\n\n\n\n tmp_rc.coding_mode = rc->coding_mode;\n\n\n\n for (i = 0; i < n; i++)\n\n udata[i] = (2 * data[i]) ^ (data[i] >> 31);\n\n\n\n calc_sum_top(pmax, exact ? kmax : 0, udata, n, pred_order, sums);\n\n\n\n opt_porder = pmin;\n\n bits[pmin] = UINT32_MAX;\n\n for (i = pmax; ; ) {\n\n bits[i] = calc_optimal_rice_params(&tmp_rc, i, sums, n, pred_order, kmax, exact);\n\n if (bits[i] < bits[opt_porder]) {\n\n opt_porder = i;\n\n *rc = tmp_rc;\n\n }\n\n if (i == pmin)\n\n break;\n\n calc_sum_next(--i, sums, exact ? kmax : 0);\n\n }\n\n\n\n return bits[opt_porder];\n\n}\n"}} {"sample_id": "bf18bee547d19fde314e7b6b81f21f68b46c8a92", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,6 +10,6 @@\n \n }\n \n+ do_open_tray(device, force, errp);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qmp_blockdev_open_tray(const char *device, bool has_force, bool force,\n\n Error **errp)\n\n{\n\n if (!has_force) {\n\n force = false;\n\n }\n\n do_open_tray(device, force, errp);\n\n}\n"}} {"sample_id": "daa76aa416b1e18ab1fac650ff53d966d8f21f68_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void test_parse_invalid_path(void)\n+\n+{\n+\n+ g_test_trap_subprocess (\"/logging/parse_invalid_path/subprocess\", 0, 0);\n \n g_test_trap_assert_passed();\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void test_parse_invalid_path(void)\n\n{\n\n g_test_trap_subprocess (\"/logging/parse_invalid_path/subprocess\", 0, 0);\n\n g_test_trap_assert_passed();\n\n g_test_trap_assert_stdout(\"\");\n\n g_test_trap_assert_stderr(\"Bad logfile format: /tmp/qemu-%d%d.log\\n\");\n\n}\n"}} {"sample_id": "5c95de150f3b18f2e76fed670d6ea579feab1206", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n if (vo_len > 0) {\n \n /* We need to store the header, so extract it */\n+\n+ if (!avctx->extradata) {\n+\n+ avctx->extradata = av_malloc(vo_len);\n+\n \n \n memcpy(avctx->extradata, pkt->data, vo_len);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int xvid_strip_vol_header(AVCodecContext *avctx, AVPacket *pkt,\n\n unsigned int header_len,\n\n unsigned int frame_len)\n\n{\n\n int vo_len = 0, i;\n\n\n\n for (i = 0; i < header_len - 3; i++) {\n\n if (pkt->data[i] == 0x00 &&\n\n pkt->data[i + 1] == 0x00 &&\n\n pkt->data[i + 2] == 0x01 &&\n\n pkt->data[i + 3] == 0xB6) {\n\n vo_len = i;\n\n break;\n\n }\n\n }\n\n\n\n if (vo_len > 0) {\n\n /* We need to store the header, so extract it */\n\n if (!avctx->extradata) {\n\n avctx->extradata = av_malloc(vo_len);\n\n\n\n memcpy(avctx->extradata, pkt->data, vo_len);\n\n avctx->extradata_size = vo_len;\n\n }\n\n /* Less dangerous now, memmove properly copies the two\n\n * chunks of overlapping data */\n\n memmove(pkt->data, &pkt->data[vo_len], frame_len - vo_len);\n\n pkt->size = frame_len - vo_len;\n\n }\n\n return 0;\n\n}"}} {"sample_id": "15861962a7a9e64fbe75f5cc0dc7d1c032db8dd5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,6 +9,6 @@\n \n \n av_free(pc->buffer);\n+\n+\n+}", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void close(AVCodecParserContext *s)\n\n{\n\n H264Context *h = s->priv_data;\n\n ParseContext *pc = &h->s.parse_context;\n\n\n\n av_free(pc->buffer);\n\n\n}"}} {"sample_id": "62d60e8cc4c4c8aebdfd97f10087456d2690c0a0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -52,11 +52,11 @@\n \n if (flags >= IO_MEM_UNASSIGNED)\n \n+ return;\n+\n+\n+\n+ mem = kvm_alloc_slot(s);\n \n mem->memory_size = size;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void kvm_set_phys_mem(target_phys_addr_t start_addr,\n\n ram_addr_t size,\n\n ram_addr_t phys_offset)\n\n{\n\n KVMState *s = kvm_state;\n\n ram_addr_t flags = phys_offset & ~TARGET_PAGE_MASK;\n\n KVMSlot *mem;\n\n\n\n /* KVM does not support read-only slots */\n\n phys_offset &= ~IO_MEM_ROM;\n\n\n\n mem = kvm_lookup_slot(s, start_addr);\n\n if (mem) {\n\n if (flags == IO_MEM_UNASSIGNED) {\n\n mem->memory_size = 0;\n\n mem->guest_phys_addr = start_addr;\n\n mem->userspace_addr = 0;\n\n mem->flags = 0;\n\n\n\n kvm_vm_ioctl(s, KVM_SET_USER_MEMORY_REGION, mem);\n\n } else if (start_addr >= mem->guest_phys_addr &&\n\n (start_addr + size) <= (mem->guest_phys_addr + mem->memory_size))\n\n return;\n\n }\n\n\n\n /* KVM does not need to know about this memory */\n\n if (flags >= IO_MEM_UNASSIGNED)\n\n return;\n\n\n\n mem = kvm_alloc_slot(s);\n\n mem->memory_size = size;\n\n mem->guest_phys_addr = start_addr;\n\n mem->userspace_addr = (unsigned long)(phys_ram_base + phys_offset);\n\n mem->flags = 0;\n\n\n\n kvm_vm_ioctl(s, KVM_SET_USER_MEMORY_REGION, mem);\n\n /* FIXME deal with errors */\n\n}\n"}} {"sample_id": "e2779de053b64f023de382fd87b3596613d47d1e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n XenPTRegInfo *reg = cfg_entry->reg;\n \n+ uint16_t writable_mask = 0;\n+\n+ uint16_t throughable_mask = get_throughable_mask(s, reg, valid_mask);\n+\n+\n \n /* modify emulate register */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int xen_pt_word_reg_write(XenPCIPassthroughState *s, XenPTReg *cfg_entry,\n\n uint16_t *val, uint16_t dev_value,\n\n uint16_t valid_mask)\n\n{\n\n XenPTRegInfo *reg = cfg_entry->reg;\n\n uint16_t writable_mask = 0;\n\n uint16_t throughable_mask = get_throughable_mask(s, reg, valid_mask);\n\n\n\n /* modify emulate register */\n\n writable_mask = reg->emu_mask & ~reg->ro_mask & valid_mask;\n\n cfg_entry->data = XEN_PT_MERGE_VALUE(*val, cfg_entry->data, writable_mask);\n\n\n\n /* create value for writing to I/O device register */\n\n *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "778111592bf5f38630858ee6dfcfd097cd6c6da9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -55,9 +55,9 @@\n pkt->flags |= AV_PKT_FLAG_KEY;\n \n *got_packet = 1;\n+\n+\n+\n+ return 0;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int dvvideo_encode_frame(AVCodecContext *c, AVPacket *pkt,\n\n const AVFrame *frame, int *got_packet)\n\n{\n\n DVVideoContext *s = c->priv_data;\n\n int ret;\n\n\n\n s->sys = avpriv_dv_codec_profile(c);\n\n if (!s->sys || ff_dv_init_dynamic_tables(s->sys))\n\n return -1;\n\n if ((ret = ff_alloc_packet(pkt, s->sys->frame_size)) < 0) {\n\n av_log(c, AV_LOG_ERROR, \"Error getting output packet.\\n\");\n\n return ret;\n\n }\n\n\n\n c->pix_fmt = s->sys->pix_fmt;\n\n s->frame = frame;\n\n c->coded_frame->key_frame = 1;\n\n c->coded_frame->pict_type = AV_PICTURE_TYPE_I;\n\n\n\n s->buf = pkt->data;\n\n c->execute(c, dv_encode_video_segment, s->sys->work_chunks, NULL,\n\n dv_work_pool_size(s->sys), sizeof(DVwork_chunk));\n\n\n\n emms_c();\n\n\n\n dv_format_frame(s, pkt->data);\n\n\n\n pkt->flags |= AV_PKT_FLAG_KEY;\n\n *got_packet = 1;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "97f3ad35517e0d02c0149637d1bb10713c52b057", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n QEMUFileStdio *s;\n+\n \n \n if (qemu_file_mode_is_not_valid(mode)) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "QEMUFile *qemu_fopen(const char *filename, const char *mode)\n\n{\n\n QEMUFileStdio *s;\n\n\n\n if (qemu_file_mode_is_not_valid(mode)) {\n\n return NULL;\n\n }\n\n\n\n s = g_malloc0(sizeof(QEMUFileStdio));\n\n\n\n s->stdio_file = fopen(filename, mode);\n\n if (!s->stdio_file) {\n\n goto fail;\n\n }\n\n\n\n if (mode[0] == 'w') {\n\n s->file = qemu_fopen_ops(s, &stdio_file_write_ops);\n\n } else {\n\n s->file = qemu_fopen_ops(s, &stdio_file_read_ops);\n\n }\n\n return s->file;\n\nfail:\n\n g_free(s);\n\n return NULL;\n\n}\n"}} {"sample_id": "c3e10c7b4377c1cbc0a4fbc12312c2cf41c0cda7_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static always_inline void gen_op_subfco_64 (void)\n+\n {\n \n+ gen_op_move_T2_T0();\n \n gen_op_subf();\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static always_inline void gen_op_subfco_64 (void)\n\n{\n\n gen_op_move_T2_T0();\n\n gen_op_subf();\n\n gen_op_check_subfc_64();\n\n gen_op_check_subfo_64();\n\n}\n"}} {"sample_id": "91cda45b69e45a089f9989979a65db3f710c9925_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n if (!(*pte1p & HPTE32_R_R)) {\n \n+ /* Update accessed flag */\n+\n+ *pte1p |= HPTE32_R_R;\n+\n+ store = 1;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ppc_hash32_pte_update_flags(struct mmu_ctx_hash32 *ctx, target_ulong *pte1p,\n\n int ret, int rw)\n\n{\n\n int store = 0;\n\n\n\n /* Update page flags */\n\n if (!(*pte1p & HPTE32_R_R)) {\n\n /* Update accessed flag */\n\n *pte1p |= HPTE32_R_R;\n\n store = 1;\n\n }\n\n if (!(*pte1p & HPTE32_R_C)) {\n\n if (rw == 1 && ret == 0) {\n\n /* Update changed flag */\n\n *pte1p |= HPTE32_R_C;\n\n store = 1;\n\n } else {\n\n /* Force page fault for first write access */\n\n ctx->prot &= ~PAGE_WRITE;\n\n }\n\n }\n\n\n\n return store;\n\n}\n"}} {"sample_id": "5104a1f65088285ddf870aa641b9061064e8757d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n \n dy = y - s->last_y;\n \n+ }\n+\n+\n+\n+ s->last_x = x;\n \n s->last_y = y;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static gboolean gd_motion_event(GtkWidget *widget, GdkEventMotion *motion,\n\n void *opaque)\n\n{\n\n GtkDisplayState *s = opaque;\n\n int dx, dy;\n\n int x, y;\n\n\n\n x = motion->x / s->scale_x;\n\n y = motion->y / s->scale_y;\n\n\n\n if (kbd_mouse_is_absolute()) {\n\n dx = x * 0x7FFF / (ds_get_width(s->ds) - 1);\n\n dy = y * 0x7FFF / (ds_get_height(s->ds) - 1);\n\n } else if (s->last_x == -1 || s->last_y == -1) {\n\n dx = 0;\n\n dy = 0;\n\n } else {\n\n dx = x - s->last_x;\n\n dy = y - s->last_y;\n\n }\n\n\n\n s->last_x = x;\n\n s->last_y = y;\n\n\n\n if (kbd_mouse_is_absolute()) {\n\n kbd_mouse_event(dx, dy, 0, s->button_mask);\n\n }\n\n\n\n return TRUE;\n\n}\n"}} {"sample_id": "9c6b899f7a46893ab3b671e341a2234e9c0c060e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,10 +10,10 @@\n \n } else {\n \n+ v9fs_path_sprintf(target, \"%s\", name);\n+\n+ }\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int local_name_to_path(FsContext *ctx, V9fsPath *dir_path,\n\n const char *name, V9fsPath *target)\n\n{\n\n if (dir_path) {\n\n v9fs_path_sprintf(target, \"%s/%s\", dir_path->data, name);\n\n } else {\n\n v9fs_path_sprintf(target, \"%s\", name);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "b3db211f3c80bb996a704d665fe275619f728bd4_44", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,5 +5,5 @@\n {\n \n test_native_list(data, unused, USER_DEF_NATIVE_LIST_UNION_KIND_S32);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_visitor_out_native_list_int32(TestOutputVisitorData *data,\n\n const void *unused)\n\n{\n\n test_native_list(data, unused, USER_DEF_NATIVE_LIST_UNION_KIND_S32);\n\n}\n"}} {"sample_id": "0b8b8753e4d94901627b3e86431230f2319215c4_25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static gboolean qio_channel_yield_enter(QIOChannel *ioc,\n \n+ GIOCondition condition,\n \n gpointer opaque)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static gboolean qio_channel_yield_enter(QIOChannel *ioc,\n\n GIOCondition condition,\n\n gpointer opaque)\n\n{\n\n QIOChannelYieldData *data = opaque;\n\n qemu_coroutine_enter(data->co, NULL);\n\n return FALSE;\n\n}\n"}} {"sample_id": "1a3598aae768465a8efc8475b6df5a8261bc62fc_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static int get_cod(Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c,\n \n uint8_t *properties)\n+\n {\n+\n+ Jpeg2000CodingStyle tmp;\n+\n int compno;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int get_cod(Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c,\n\n uint8_t *properties)\n\n{\n\n Jpeg2000CodingStyle tmp;\n\n int compno;\n\n\n\n if (s->buf_end - s->buf < 5)\n\n return AVERROR_INVALIDDATA;\n\n\n\n tmp.log2_prec_width =\n\n tmp.log2_prec_height = 15;\n\n\n\n tmp.csty = bytestream_get_byte(&s->buf);\n\n\n\n // get progression order\n\n tmp.prog_order = bytestream_get_byte(&s->buf);\n\n\n\n tmp.nlayers = bytestream_get_be16(&s->buf);\n\n tmp.mct = bytestream_get_byte(&s->buf); // multiple component transformation\n\n\n\n get_cox(s, &tmp);\n\n for (compno = 0; compno < s->ncomponents; compno++)\n\n if (!(properties[compno] & HAD_COC))\n\n memcpy(c + compno, &tmp, sizeof(tmp));\n\n return 0;\n\n}\n"}} {"sample_id": "ee88dcb2b0fefb42b0761ddb105c71daf604d791", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n ff_set_sar(avctx, av_div_q(\n (AVRational){ format->display_aspect_ratio.x, format->display_aspect_ratio.y },\n (AVRational){ avctx->width, avctx->height }));\n+ if (!format->progressive_sequence)\n+ avctx->flags |= AV_CODEC_FLAG_INTERLACED_DCT;\n+ else\n+ avctx->flags &= ~AV_CODEC_FLAG_INTERLACED_DCT;\n+ if (format->video_signal_description.video_full_range_flag)\n avctx->color_range = AVCOL_RANGE_JPEG;\n else\n avctx->color_range = AVCOL_RANGE_MPEG;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int CUDAAPI cuvid_handle_video_sequence(void *opaque, CUVIDEOFORMAT* format)\n{\n AVCodecContext *avctx = opaque;\n CuvidContext *ctx = avctx->priv_data;\n AVHWFramesContext *hwframe_ctx = (AVHWFramesContext*)ctx->hwframe->data;\n CUVIDDECODECREATEINFO cuinfo;\n av_log(avctx, AV_LOG_TRACE, \"pfnSequenceCallback\\n\");\n ctx->internal_error = 0;\n avctx->width = format->display_area.right;\n avctx->height = format->display_area.bottom;\n ff_set_sar(avctx, av_div_q(\n (AVRational){ format->display_aspect_ratio.x, format->display_aspect_ratio.y },\n (AVRational){ avctx->width, avctx->height }));\n if (!format->progressive_sequence)\n avctx->flags |= AV_CODEC_FLAG_INTERLACED_DCT;\n else\n avctx->flags &= ~AV_CODEC_FLAG_INTERLACED_DCT;\n if (format->video_signal_description.video_full_range_flag)\n avctx->color_range = AVCOL_RANGE_JPEG;\n else\n avctx->color_range = AVCOL_RANGE_MPEG;\n avctx->color_primaries = format->video_signal_description.color_primaries;\n avctx->color_trc = format->video_signal_description.transfer_characteristics;\n avctx->colorspace = format->video_signal_description.matrix_coefficients;\n if (format->bitrate)\n avctx->bit_rate = format->bitrate;\n if (format->frame_rate.numerator && format->frame_rate.denominator) {\n avctx->framerate.num = format->frame_rate.numerator;\n avctx->framerate.den = format->frame_rate.denominator;\n if (ctx->cudecoder\n && avctx->coded_width == format->coded_width\n && avctx->coded_height == format->coded_height\n && ctx->chroma_format == format->chroma_format\n && ctx->codec_type == format->codec)\n return 1;\n if (ctx->cudecoder) {\n av_log(avctx, AV_LOG_ERROR, \"re-initializing decoder is not supported\\n\");\n if (hwframe_ctx->pool && !ctx->ever_flushed) {\n av_log(avctx, AV_LOG_ERROR, \"AVHWFramesContext is already initialized\\n\");\n avctx->coded_width = format->coded_width;\n avctx->coded_height = format->coded_height;\n ctx->chroma_format = format->chroma_format;\n memset(&cuinfo, 0, sizeof(cuinfo));\n cuinfo.CodecType = ctx->codec_type = format->codec;\n cuinfo.ChromaFormat = format->chroma_format;\n cuinfo.OutputFormat = cudaVideoSurfaceFormat_NV12;\n cuinfo.ulWidth = avctx->coded_width;\n cuinfo.ulHeight = avctx->coded_height;\n cuinfo.ulTargetWidth = cuinfo.ulWidth;\n cuinfo.ulTargetHeight = cuinfo.ulHeight;\n cuinfo.target_rect.left = 0;\n cuinfo.target_rect.top = 0;\n cuinfo.target_rect.right = cuinfo.ulWidth;\n cuinfo.target_rect.bottom = cuinfo.ulHeight;\n cuinfo.ulNumDecodeSurfaces = MAX_FRAME_COUNT;\n cuinfo.ulNumOutputSurfaces = 1;\n cuinfo.ulCreationFlags = cudaVideoCreate_PreferCUVID;\n cuinfo.DeinterlaceMode = cudaVideoDeinterlaceMode_Weave;\n ctx->internal_error = CHECK_CU(cuvidCreateDecoder(&ctx->cudecoder, &cuinfo));\n if (ctx->internal_error < 0)\n if (!hwframe_ctx->pool) {\n hwframe_ctx->format = AV_PIX_FMT_CUDA;\n hwframe_ctx->sw_format = AV_PIX_FMT_NV12;\n hwframe_ctx->width = FFALIGN(avctx->coded_width, 32);\n hwframe_ctx->height = FFALIGN(avctx->coded_height, 32);\n if ((ctx->internal_error = av_hwframe_ctx_init(ctx->hwframe)) < 0) {\n av_log(avctx, AV_LOG_ERROR, \"av_hwframe_ctx_init failed\\n\");\n return 1;"}} {"sample_id": "1f001dc7bc9e435bf231a5b0edcad1c7c2bd6214_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n return -1;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int default_fdset_dup_fd_remove(int dup_fd)\n\n{\n\n return -1;\n\n}\n"}} {"sample_id": "b4049b74b97f30fe944c63b5f158ec9e87bd2593", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+void qemu_unregister_clock_reset_notifier(QEMUClock *clock,\n+\n Notifier *notifier)\n \n {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_unregister_clock_reset_notifier(QEMUClock *clock,\n\n Notifier *notifier)\n\n{\n\n qemu_clock_unregister_reset_notifier(clock->type, notifier);\n\n}\n"}} {"sample_id": "0db6e54a8a2c6e16780356422da671b71f862341", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {\n \n if (bmds->dirty_bitmap) {\n+\n+ bdrv_release_dirty_bitmap(bmds->bs, bmds->dirty_bitmap);\n+\n+ }\n+\n }\n \n return ret;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int set_dirty_tracking(void)\n\n{\n\n BlkMigDevState *bmds;\n\n int ret;\n\n\n\n QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {\n\n bmds->dirty_bitmap = bdrv_create_dirty_bitmap(bmds->bs, BLOCK_SIZE,\n\n NULL);\n\n if (!bmds->dirty_bitmap) {\n\n ret = -errno;\n\n goto fail;\n\n }\n\n }\n\n return 0;\n\n\n\nfail:\n\n QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {\n\n if (bmds->dirty_bitmap) {\n\n bdrv_release_dirty_bitmap(bmds->bs, bmds->dirty_bitmap);\n\n }\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "0719e71e5297f68b6b4500aa74e1b49d59806342", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static bool sd_get_inserted(SDState *sd)\n \n {\n+\n return blk_is_inserted(sd->blk);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool sd_get_inserted(SDState *sd)\n\n{\n\n return blk_is_inserted(sd->blk);\n\n}\n"}} {"sample_id": "39ea3d4eaf1ff300ee55946108394729bc053dfa_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ env->banked_r13[bank_number(mode)] = val;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void HELPER(set_r13_banked)(CPUState *env, uint32_t mode, uint32_t val)\n\n{\n\n env->banked_r13[bank_number(mode)] = val;\n\n}\n"}} {"sample_id": "473f0f75a16b4d37bdaa943f75e4ae249212c1ba", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int thread_execute(AVFilterContext *ctx, avfilter_action_func *func,\n \n+ void *arg, int *ret, int nb_jobs)\n \n {\n \n@@ -8,12 +8,12 @@\n \n int dummy_ret;\n \n+\n+\n+ if (nb_jobs <= 0)\n \n+ return 0;\n+\n \n \n pthread_mutex_lock(&c->current_job_lock);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int thread_execute(AVFilterContext *ctx, avfilter_action_func *func,\n\n void *arg, int *ret, int nb_jobs)\n\n{\n\n ThreadContext *c = ctx->graph->internal->thread;\n\n int dummy_ret;\n\n\n\n if (nb_jobs <= 0)\n\n return 0;\n\n\n\n pthread_mutex_lock(&c->current_job_lock);\n\n\n\n c->current_job = c->nb_threads;\n\n c->nb_jobs = nb_jobs;\n\n c->ctx = ctx;\n\n c->arg = arg;\n\n c->func = func;\n\n if (ret) {\n\n c->rets = ret;\n\n c->nb_rets = nb_jobs;\n\n } else {\n\n c->rets = &dummy_ret;\n\n c->nb_rets = 1;\n\n }\n\n c->current_execute++;\n\n\n\n pthread_cond_broadcast(&c->current_job_cond);\n\n\n\n slice_thread_park_workers(c);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "61c68000eda643dfce96dc46b488d39fd5c4e309", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n uint16_t (*buffer)[4];\n int left[4], top[4], topleft[4];\n const int linesize = s->linesize[0];\n+ const int mask = (1 << s->bits) - 1;\n+ int resync_mb_y = 0;\n+ int resync_mb_x = 0;\n+ s->restart_count = s->restart_interval;\n+ av_fast_malloc(&s->ljpeg_buffer, &s->ljpeg_buffer_size,\n (unsigned)s->mb_width * 4 * sizeof(s->ljpeg_buffer[0][0]));\n buffer = s->ljpeg_buffer;\n for (i = 0; i < 4; i++)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int nb_components, int predictor, int point_transform)\n{\n int i, mb_x, mb_y;\n uint16_t (*buffer)[4];\n int left[4], top[4], topleft[4];\n const int linesize = s->linesize[0];\n const int mask = (1 << s->bits) - 1;\n int resync_mb_y = 0;\n int resync_mb_x = 0;\n s->restart_count = s->restart_interval;\n av_fast_malloc(&s->ljpeg_buffer, &s->ljpeg_buffer_size,\n (unsigned)s->mb_width * 4 * sizeof(s->ljpeg_buffer[0][0]));\n buffer = s->ljpeg_buffer;\n for (i = 0; i < 4; i++)\n buffer[0][i] = 1 << (s->bits - 1);\n for (mb_y = 0; mb_y < s->mb_height; mb_y++) {\n uint8_t *ptr = s->picture.data[0] + (linesize * mb_y);\n if (s->interlaced && s->bottom_field)\n ptr += linesize >> 1;\n for (i = 0; i < 4; i++)\n top[i] = left[i] = topleft[i] = buffer[0][i];\n for (mb_x = 0; mb_x < s->mb_width; mb_x++) {\n int modified_predictor = predictor;\n if (s->restart_interval && !s->restart_count){\n s->restart_count = s->restart_interval;\n resync_mb_x = mb_x;\n resync_mb_y = mb_y;\n for(i=0; i<4; i++)\n top[i] = left[i]= topleft[i]= 1 << (s->bits - 1);\n }\n if (mb_y == resync_mb_y || mb_y == resync_mb_y+1 && mb_x < resync_mb_x || !mb_x)\n modified_predictor = 1;\n for (i=0;idc_index[i]);\n if(dc == 0xFFFF)\n return -1;\n left[i] = buffer[mb_x][i] =\n mask & (pred + (dc << point_transform));\n }\n if (s->restart_interval && !--s->restart_count) {\n align_get_bits(&s->gb);\n skip_bits(&s->gb, 16); /* skip RSTn */\n }\n }\n if (s->nb_components == 4) {\n for(i=0; icomp_index[i];\n for(mb_x = 0; mb_x < s->mb_width; mb_x++) {\n ptr[4*mb_x+3-c] = buffer[mb_x][i];\n }\n }\n } else if (s->rct) {\n for (mb_x = 0; mb_x < s->mb_width; mb_x++) {\n ptr[3*mb_x + 1] = buffer[mb_x][0] - ((buffer[mb_x][1] + buffer[mb_x][2] - 0x200) >> 2);\n ptr[3*mb_x + 0] = buffer[mb_x][1] + ptr[3*mb_x + 1];\n ptr[3*mb_x + 2] = buffer[mb_x][2] + ptr[3*mb_x + 1];\n }\n } else if (s->pegasus_rct) {\n for (mb_x = 0; mb_x < s->mb_width; mb_x++) {\n ptr[3*mb_x + 1] = buffer[mb_x][0] - ((buffer[mb_x][1] + buffer[mb_x][2]) >> 2);\n ptr[3*mb_x + 0] = buffer[mb_x][1] + ptr[3*mb_x + 1];\n ptr[3*mb_x + 2] = buffer[mb_x][2] + ptr[3*mb_x + 1];\n }\n } else {\n for(i=0; icomp_index[i];\n for(mb_x = 0; mb_x < s->mb_width; mb_x++) {\n ptr[3*mb_x+2-c] = buffer[mb_x][i];\n }\n }\n }\n }\n return 0;\n}"}} {"sample_id": "1303d62d8416fa315a0cc7bbbe35cfdab787ea92_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n url_fseek(pb, -TS_PACKET_SIZE, SEEK_CUR);\n \n if (mpegts_resync(pb) < 0)\n+\n+ return AVERROR_INVALIDDATA;\n+\n+ else\n+\n continue;\n \n } else {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int read_packet(ByteIOContext *pb, uint8_t *buf, int raw_packet_size)\n\n{\n\n int skip, len;\n\n\n\n for(;;) {\n\n len = get_buffer(pb, buf, TS_PACKET_SIZE);\n\n if (len != TS_PACKET_SIZE)\n\n return AVERROR(EIO);\n\n /* check paquet sync byte */\n\n if (buf[0] != 0x47) {\n\n /* find a new packet start */\n\n url_fseek(pb, -TS_PACKET_SIZE, SEEK_CUR);\n\n if (mpegts_resync(pb) < 0)\n\n return AVERROR_INVALIDDATA;\n\n else\n\n continue;\n\n } else {\n\n skip = raw_packet_size - TS_PACKET_SIZE;\n\n if (skip > 0)\n\n url_fskip(pb, skip);\n\n break;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "c6742b14fe7352059cd4954a356a8105757af31b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+bool memory_region_present(MemoryRegion *container, hwaddr addr)\n+\n+{\n+\n MemoryRegion *mr = memory_region_find(container, addr, 1).mr;\n+\n+ if (!mr || (mr == container)) {\n \n return false;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "bool memory_region_present(MemoryRegion *container, hwaddr addr)\n\n{\n\n MemoryRegion *mr = memory_region_find(container, addr, 1).mr;\n\n if (!mr || (mr == container)) {\n\n return false;\n\n }\n\n memory_region_unref(mr);\n\n return true;\n\n}\n"}} {"sample_id": "c19148bd8f5c2800265372d3554035efde1c5517", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n env->asi = 0x82; // Primary no-fault\n \n+#endif\n+\n+#else\n+\n+ env->psret = 0;\n \n env->psrs = 1;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void cpu_reset(CPUSPARCState *env)\n\n{\n\n tlb_flush(env, 1);\n\n env->cwp = 0;\n\n env->wim = 1;\n\n env->regwptr = env->regbase + (env->cwp * 16);\n\n#if defined(CONFIG_USER_ONLY)\n\n env->user_mode_only = 1;\n\n#ifdef TARGET_SPARC64\n\n env->cleanwin = env->nwindows - 2;\n\n env->cansave = env->nwindows - 2;\n\n env->pstate = PS_RMO | PS_PEF | PS_IE;\n\n env->asi = 0x82; // Primary no-fault\n\n#endif\n\n#else\n\n env->psret = 0;\n\n env->psrs = 1;\n\n env->psrps = 1;\n\n#ifdef TARGET_SPARC64\n\n env->pstate = PS_PRIV;\n\n env->hpstate = HS_PRIV;\n\n env->pc = 0x1fff0000020ULL; // XXX should be different for system_reset\n\n env->tsptr = &env->ts[env->tl];\n\n#else\n\n env->pc = 0;\n\n env->mmuregs[0] &= ~(MMU_E | MMU_NF);\n\n env->mmuregs[0] |= env->mmu_bm;\n\n#endif\n\n env->npc = env->pc + 4;\n\n#endif\n\n}\n"}} {"sample_id": "662234a9a22f1cd0f0ac83b8bb1ffadedca90c0a_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+void ff_put_h264_qpel16_mc21_msa(uint8_t *dst, const uint8_t *src,\n+\n ptrdiff_t stride)\n \n {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_put_h264_qpel16_mc21_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n avc_luma_midv_qrt_16w_msa(src - (2 * stride) - 2,\n\n stride, dst, stride, 16, 0);\n\n}\n"}} {"sample_id": "983bff3530782d51c46c8d7c0e17e2a9dfe5fb77", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void usb_mtp_handle_reset(USBDevice *dev)\n \n {\n+\n MTPState *s = USB_MTP(dev);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void usb_mtp_handle_reset(USBDevice *dev)\n\n{\n\n MTPState *s = USB_MTP(dev);\n\n\n\n trace_usb_mtp_reset(s->dev.addr);\n\n\n\n#ifdef __linux__\n\n usb_mtp_inotify_cleanup(s);\n\n#endif\n\n usb_mtp_object_free(s, QTAILQ_FIRST(&s->objects));\n\n s->session = 0;\n\n usb_mtp_data_free(s->data_in);\n\n s->data_in = NULL;\n\n usb_mtp_data_free(s->data_out);\n\n s->data_out = NULL;\n\n g_free(s->result);\n\n s->result = NULL;\n\n}\n"}} {"sample_id": "6f321e93abb27b4e7ceb228b4204aa304e95daad", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void qed_aio_write_alloc(QEDAIOCB *acb, size_t len)\n \n+{\n \n BDRVQEDState *s = acb_to_s(acb);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void qed_aio_write_alloc(QEDAIOCB *acb, size_t len)\n\n{\n\n BDRVQEDState *s = acb_to_s(acb);\n\n\n\n /* Freeze this request if another allocating write is in progress */\n\n if (acb != QSIMPLEQ_FIRST(&s->allocating_write_reqs)) {\n\n QSIMPLEQ_INSERT_TAIL(&s->allocating_write_reqs, acb, next);\n\n }\n\n if (acb != QSIMPLEQ_FIRST(&s->allocating_write_reqs)) {\n\n return; /* wait for existing request to finish */\n\n }\n\n\n\n acb->cur_nclusters = qed_bytes_to_clusters(s,\n\n qed_offset_into_cluster(s, acb->cur_pos) + len);\n\n acb->cur_cluster = qed_alloc_clusters(s, acb->cur_nclusters);\n\n qemu_iovec_copy(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);\n\n\n\n if (qed_should_set_need_check(s)) {\n\n s->header.features |= QED_F_NEED_CHECK;\n\n qed_write_header(s, qed_aio_write_prefill, acb);\n\n } else {\n\n qed_aio_write_prefill(acb, 0);\n\n }\n\n}\n"}} {"sample_id": "aa8f057e74ae08014736a690ff41f76c756f75f1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n Object *val, Error **errp)\n \n {\n+\n+ if (cryptodev_backend_is_used(CRYPTODEV_BACKEND(val))) {\n+\n+ char *path = object_get_canonical_path_component(val);\n+\n error_setg(errp,\n \n \"can't use already used cryptodev backend: %s\", path);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "virtio_crypto_check_cryptodev_is_used(const Object *obj, const char *name,\n\n Object *val, Error **errp)\n\n{\n\n if (cryptodev_backend_is_used(CRYPTODEV_BACKEND(val))) {\n\n char *path = object_get_canonical_path_component(val);\n\n error_setg(errp,\n\n \"can't use already used cryptodev backend: %s\", path);\n\n g_free(path);\n\n } else {\n\n qdev_prop_allow_set_link_before_realize(obj, name, val, errp);\n\n }\n\n}\n"}} {"sample_id": "12d69ac03b45156356b240424623719f15d8143e_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n EventNotifierTestData data = { .n = 0, .active = 10, .auto_set = true };\n \n event_notifier_init(&data.e, false);\n+\n+ aio_set_event_notifier(ctx, &data.e, event_ready_cb);\n+\n+ g_assert(!aio_poll(ctx, false));\n+\n g_assert_cmpint(data.n, ==, 0);\n \n g_assert_cmpint(data.active, ==, 10);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_flush_event_notifier(void)\n\n{\n\n EventNotifierTestData data = { .n = 0, .active = 10, .auto_set = true };\n\n event_notifier_init(&data.e, false);\n\n aio_set_event_notifier(ctx, &data.e, event_ready_cb);\n\n g_assert(!aio_poll(ctx, false));\n\n g_assert_cmpint(data.n, ==, 0);\n\n g_assert_cmpint(data.active, ==, 10);\n\n\n\n event_notifier_set(&data.e);\n\n g_assert(aio_poll(ctx, false));\n\n g_assert_cmpint(data.n, ==, 1);\n\n g_assert_cmpint(data.active, ==, 9);\n\n g_assert(aio_poll(ctx, false));\n\n\n\n wait_until_inactive(&data);\n\n g_assert_cmpint(data.n, ==, 10);\n\n g_assert_cmpint(data.active, ==, 0);\n\n g_assert(!aio_poll(ctx, false));\n\n\n\n aio_set_event_notifier(ctx, &data.e, NULL);\n\n g_assert(!aio_poll(ctx, false));\n\n event_notifier_cleanup(&data.e);\n\n}\n"}} {"sample_id": "71b12d31971751f46c546d693c1e216f38ba2053", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n int kvm_arch_process_async_events(CPUState *env)\n \n+{\n \n return 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int kvm_arch_process_async_events(CPUState *env)\n\n{\n\n return 0;\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n AioContext *qemu_get_aio_context(void)\n \n {\n+\n return qemu_aio_context;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "AioContext *qemu_get_aio_context(void)\n\n{\n\n return qemu_aio_context;\n\n}\n"}} {"sample_id": "5fb6c7a8b26eab1a22207d24b4784bd2b39ab54b_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n {\n \n+ if (vnc_set_x509_credential(vs, certdir, X509_CA_CERT_FILE, &vs->x509cacert, 0) < 0)\n+\n+\tgoto cleanup;\n+\n+ if (vnc_set_x509_credential(vs, certdir, X509_CA_CRL_FILE, &vs->x509cacrl, 1) < 0)\n \n \tgoto cleanup;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int vnc_set_x509_credential_dir(VncDisplay *vs,\n\n\t\t\t\t const char *certdir)\n\n{\n\n if (vnc_set_x509_credential(vs, certdir, X509_CA_CERT_FILE, &vs->x509cacert, 0) < 0)\n\n\tgoto cleanup;\n\n if (vnc_set_x509_credential(vs, certdir, X509_CA_CRL_FILE, &vs->x509cacrl, 1) < 0)\n\n\tgoto cleanup;\n\n if (vnc_set_x509_credential(vs, certdir, X509_SERVER_CERT_FILE, &vs->x509cert, 0) < 0)\n\n\tgoto cleanup;\n\n if (vnc_set_x509_credential(vs, certdir, X509_SERVER_KEY_FILE, &vs->x509key, 0) < 0)\n\n\tgoto cleanup;\n\n\n\n return 0;\n\n\n\n cleanup:\n\n qemu_free(vs->x509cacert);\n\n qemu_free(vs->x509cacrl);\n\n qemu_free(vs->x509cert);\n\n qemu_free(vs->x509key);\n\n vs->x509cacert = vs->x509cacrl = vs->x509cert = vs->x509key = NULL;\n\n return -1;\n\n}\n"}} {"sample_id": "5bb95e41868b461f37159efb48908828ebd7ab36_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n \"Number of SMBIOS Type 4 tables must match cpu count.\\n\");\n \n exit(1);\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void smbios_validate_table(void)\n\n{\n\n if (smbios_type4_count && smbios_type4_count != smp_cpus) {\n\n fprintf(stderr,\n\n \"Number of SMBIOS Type 4 tables must match cpu count.\\n\");\n\n exit(1);\n\n }\n\n}\n"}} {"sample_id": "75511c293add07db1cca58dcd8b08c33fc2f1075", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n char buf[256];\n int flags = (is_output ? ic->oformat->flags : ic->iformat->flags);\n+ AVStream *st = ic->streams[i];\n+ int g = av_gcd(st->time_base.num, st->time_base.den);\n+ AVDictionaryEntry *lang = av_dict_get(st->metadata, \"language\", NULL, 0);\n+ avcodec_string(buf, sizeof(buf), st->codec, is_output);\n+ av_log(NULL, AV_LOG_INFO, \" Stream #%d:%d\", index, i);\n /* the pid is an important information, so we display it */\n /* XXX: add a generic system */\n if (flags & AVFMT_SHOW_IDS)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void dump_stream_format(AVFormatContext *ic, int i,\n int index, int is_output)\n{\n char buf[256];\n int flags = (is_output ? ic->oformat->flags : ic->iformat->flags);\n AVStream *st = ic->streams[i];\n int g = av_gcd(st->time_base.num, st->time_base.den);\n AVDictionaryEntry *lang = av_dict_get(st->metadata, \"language\", NULL, 0);\n avcodec_string(buf, sizeof(buf), st->codec, is_output);\n av_log(NULL, AV_LOG_INFO, \" Stream #%d:%d\", index, i);\n /* the pid is an important information, so we display it */\n /* XXX: add a generic system */\n if (flags & AVFMT_SHOW_IDS)\n av_log(NULL, AV_LOG_INFO, \"[0x%x]\", st->id);\n if (lang)\n av_log(NULL, AV_LOG_INFO, \"(%s)\", lang->value);\n av_log(NULL, AV_LOG_DEBUG, \", %d, %d/%d\", st->codec_info_nb_frames,\n st->time_base.num / g, st->time_base.den / g);\n av_log(NULL, AV_LOG_INFO, \": %s\", buf);\n if (st->sample_aspect_ratio.num && // default\n av_cmp_q(st->sample_aspect_ratio, st->codec->sample_aspect_ratio)) {\n AVRational display_aspect_ratio;\n av_reduce(&display_aspect_ratio.num, &display_aspect_ratio.den,\n st->codec->width * st->sample_aspect_ratio.num,\n st->codec->height * st->sample_aspect_ratio.den,\n 1024 * 1024);\n av_log(NULL, AV_LOG_INFO, \", SAR %d:%d DAR %d:%d\",\n st->sample_aspect_ratio.num, st->sample_aspect_ratio.den,\n display_aspect_ratio.num, display_aspect_ratio.den);\n }\n if (st->codec->codec_type == AVMEDIA_TYPE_VIDEO) {\n if (st->avg_frame_rate.den && st->avg_frame_rate.num)\n print_fps(av_q2d(st->avg_frame_rate), \"fps\");\n#if FF_API_R_FRAME_RATE\n if (st->r_frame_rate.den && st->r_frame_rate.num)\n print_fps(av_q2d(st->r_frame_rate), \"tbr\");\n#endif\n if (st->time_base.den && st->time_base.num)\n print_fps(1 / av_q2d(st->time_base), \"tbn\");\n if (st->codec->time_base.den && st->codec->time_base.num)\n print_fps(1 / av_q2d(st->codec->time_base), \"tbc\");\n }\n if (st->disposition & AV_DISPOSITION_DEFAULT)\n av_log(NULL, AV_LOG_INFO, \" (default)\");\n if (st->disposition & AV_DISPOSITION_DUB)\n av_log(NULL, AV_LOG_INFO, \" (dub)\");\n if (st->disposition & AV_DISPOSITION_ORIGINAL)\n av_log(NULL, AV_LOG_INFO, \" (original)\");\n if (st->disposition & AV_DISPOSITION_COMMENT)\n av_log(NULL, AV_LOG_INFO, \" (comment)\");\n if (st->disposition & AV_DISPOSITION_LYRICS)\n av_log(NULL, AV_LOG_INFO, \" (lyrics)\");\n if (st->disposition & AV_DISPOSITION_KARAOKE)\n av_log(NULL, AV_LOG_INFO, \" (karaoke)\");\n if (st->disposition & AV_DISPOSITION_FORCED)\n av_log(NULL, AV_LOG_INFO, \" (forced)\");\n if (st->disposition & AV_DISPOSITION_HEARING_IMPAIRED)\n av_log(NULL, AV_LOG_INFO, \" (hearing impaired)\");\n if (st->disposition & AV_DISPOSITION_VISUAL_IMPAIRED)\n av_log(NULL, AV_LOG_INFO, \" (visual impaired)\");\n if (st->disposition & AV_DISPOSITION_CLEAN_EFFECTS)\n av_log(NULL, AV_LOG_INFO, \" (clean effects)\");\n av_log(NULL, AV_LOG_INFO, \"\\n\");\n dump_metadata(NULL, st->metadata, \" \");\n dump_sidedata(NULL, st, \" \");\n}"}} {"sample_id": "2b584959ed300ddff4acba0d7554becad5f274fd_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n *pcyls = bs->cyls;\n \n *pheads = bs->heads;\n+\n+ *psecs = bs->secs;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bdrv_get_geometry_hint(BlockDriverState *bs,\n\n int *pcyls, int *pheads, int *psecs)\n\n{\n\n *pcyls = bs->cyls;\n\n *pheads = bs->heads;\n\n *psecs = bs->secs;\n\n}\n"}} {"sample_id": "c572f23a3e7180dbeab5e86583e43ea2afed6271", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n V9fsString target;\n \n+ int32_t fid;\n+\n+ int err = 0;\n+\n+ V9fsFidState *fidp;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void v9fs_readlink(void *opaque)\n\n{\n\n V9fsPDU *pdu = opaque;\n\n size_t offset = 7;\n\n V9fsString target;\n\n int32_t fid;\n\n int err = 0;\n\n V9fsFidState *fidp;\n\n\n\n pdu_unmarshal(pdu, offset, \"d\", &fid);\n\n\n fidp = get_fid(pdu, fid);\n\n if (fidp == NULL) {\n\n err = -ENOENT;\n\n goto out_nofid;\n\n }\n\n\n\n v9fs_string_init(&target);\n\n err = v9fs_co_readlink(pdu, &fidp->path, &target);\n\n if (err < 0) {\n\n goto out;\n\n }\n\n offset += pdu_marshal(pdu, offset, \"s\", &target);\n\n err = offset;\n\n v9fs_string_free(&target);\n\nout:\n\n put_fid(pdu, fidp);\n\nout_nofid:\n\n trace_v9fs_readlink_return(pdu->tag, pdu->id, target.data);\n\n complete_pdu(pdu->s, pdu, err);\n\n}"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_330", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n switch (saddr) {\n \n case BONITO_INTISR:\n+\n+ return s->regs[saddr];\n+\n+ default:\n+\n return s->regs[saddr];\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t bonito_readl(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n PCIBonitoState *s = opaque;\n\n uint32_t saddr;\n\n\n\n saddr = (addr - BONITO_REGBASE) >> 2;\n\n\n\n DPRINTF(\"bonito_readl \"TARGET_FMT_plx\"\\n\", addr);\n\n switch (saddr) {\n\n case BONITO_INTISR:\n\n return s->regs[saddr];\n\n default:\n\n return s->regs[saddr];\n\n }\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_31", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void put_uint32(QEMUFile *f, void *pv, size_t size)\n \n+{\n+\n uint32_t *v = pv;\n \n qemu_put_be32s(f, v);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void put_uint32(QEMUFile *f, void *pv, size_t size)\n\n{\n\n uint32_t *v = pv;\n\n qemu_put_be32s(f, v);\n\n}\n"}} {"sample_id": "3bc36a401e0f33e63a4d2c58b646ddf78efb567c_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n Error *local_err = NULL;\n \n USBDevice *dev;\n+\n QemuOpts *opts;\n \n int idx;\n@@ -17,7 +17,7 @@\n if (!opts) {\n \n return NULL;\n+\n }\n \n qemu_opt_set(opts, \"type\", \"nic\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static USBDevice *usb_net_init(USBBus *bus, const char *cmdline)\n\n{\n\n Error *local_err = NULL;\n\n USBDevice *dev;\n\n QemuOpts *opts;\n\n int idx;\n\n\n\n opts = qemu_opts_parse(qemu_find_opts(\"net\"), cmdline, 0);\n\n if (!opts) {\n\n return NULL;\n\n }\n\n qemu_opt_set(opts, \"type\", \"nic\");\n\n qemu_opt_set(opts, \"model\", \"usb\");\n\n\n\n idx = net_client_init(opts, 0, &local_err);\n\n if (local_err) {\n\n error_report(\"%s\", error_get_pretty(local_err));\n\n error_free(local_err);\n\n return NULL;\n\n }\n\n\n\n dev = usb_create(bus, \"usb-net\");\n\n qdev_set_nic_properties(&dev->qdev, &nd_table[idx]);\n\n qdev_init_nofail(&dev->qdev);\n\n return dev;\n\n}\n"}} {"sample_id": "709628aa71f24520553eb10b0cf6d56784e6c3ec", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n AVFilterContext *ctx = inlink->dst;\n \n ConcatContext *cat = ctx->priv;\n+\n unsigned in_no = FF_INLINK_IDX(inlink);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void process_frame(AVFilterLink *inlink, AVFilterBufferRef *buf)\n\n{\n\n AVFilterContext *ctx = inlink->dst;\n\n ConcatContext *cat = ctx->priv;\n\n unsigned in_no = FF_INLINK_IDX(inlink);\n\n\n\n if (in_no < cat->cur_idx) {\n\n av_log(ctx, AV_LOG_ERROR, \"Frame after EOF on input %s\\n\",\n\n ctx->input_pads[in_no].name);\n\n avfilter_unref_buffer(buf);\n\n } if (in_no >= cat->cur_idx + ctx->nb_outputs) {\n\n ff_bufqueue_add(ctx, &cat->in[in_no].queue, buf);\n\n } else {\n\n push_frame(ctx, in_no, buf);\n\n }\n\n}\n"}} {"sample_id": "866c44d4b0f90d448cffbe9d4422a2dec7df698b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n break;\n for (i = 0; i < s->terms; i++) {\n t = s->decorr[i].value;\n+ if (t > 8) {\n+ if (t & 1)\n+ A = 2 * s->decorr[i].samplesA[0] - s->decorr[i].samplesA[1];\n+ else\n+ A = (3 * s->decorr[i].samplesA[0] - s->decorr[i].samplesA[1]) >> 1;\n s->decorr[i].samplesA[1] = s->decorr[i].samplesA[0];\n j = 0;\n } else {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline int wv_unpack_mono(WavpackFrameContext *s, GetBitContext *gb,\n void *dst, const int type)\n{\n int i, j, count = 0;\n int last, t;\n int A, S, T;\n int pos = s->pos;\n uint32_t crc = s->sc.crc;\n uint32_t crc_extra_bits = s->extra_sc.crc;\n int16_t *dst16 = dst;\n int32_t *dst32 = dst;\n float *dstfl = dst;\n s->one = s->zero = s->zeroes = 0;\n do {\n T = wv_get_value(s, gb, 0, &last);\n S = 0;\n if (last)\n break;\n for (i = 0; i < s->terms; i++) {\n t = s->decorr[i].value;\n if (t > 8) {\n if (t & 1)\n A = 2 * s->decorr[i].samplesA[0] - s->decorr[i].samplesA[1];\n else\n A = (3 * s->decorr[i].samplesA[0] - s->decorr[i].samplesA[1]) >> 1;\n s->decorr[i].samplesA[1] = s->decorr[i].samplesA[0];\n j = 0;\n } else {\n A = s->decorr[i].samplesA[pos];\n j = (pos + t) & 7;\n if (type != AV_SAMPLE_FMT_S16P)\n S = T + ((s->decorr[i].weightA * (int64_t)A + 512) >> 10);\n else\n S = T + ((s->decorr[i].weightA * A + 512) >> 10);\n if (A && T)\n s->decorr[i].weightA -= ((((T ^ A) >> 30) & 2) - 1) * s->decorr[i].delta;\n s->decorr[i].samplesA[j] = T = S;\n pos = (pos + 1) & 7;\n crc = crc * 3 + S;\n if (type == AV_SAMPLE_FMT_FLTP) {\n *dstfl++ = wv_get_value_float(s, &crc_extra_bits, S);\n } else if (type == AV_SAMPLE_FMT_S32P) {\n *dst32++ = wv_get_value_integer(s, &crc_extra_bits, S);\n } else {\n *dst16++ = wv_get_value_integer(s, &crc_extra_bits, S);\n count++;\n } while (!last && count < s->samples);\n wv_reset_saved_context(s);\n if (s->avctx->err_recognition & AV_EF_CRCCHECK) {\n int ret = wv_check_crc(s, crc, crc_extra_bits);\n if (ret < 0 && s->avctx->err_recognition & AV_EF_EXPLODE)\n return ret;\n return 0;"}} {"sample_id": "9d9474726274d0e1c420f055849a0e3058cad0e4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n int unix_connect_opts(QemuOpts *opts)\n \n+{\n+\n+ struct sockaddr_un un;\n+\n+ const char *path = qemu_opt_get(opts, \"path\");\n \n int sock;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "int unix_connect_opts(QemuOpts *opts)\n\n{\n\n struct sockaddr_un un;\n\n const char *path = qemu_opt_get(opts, \"path\");\n\n int sock;\n\n\n\n if (NULL == path) {\n\n fprintf(stderr, \"unix connect: no path specified\\n\");\n\n return -1;\n\n }\n\n\n\n sock = qemu_socket(PF_UNIX, SOCK_STREAM, 0);\n\n if (sock < 0) {\n\n perror(\"socket(unix)\");\n\n return -1;\n\n }\n\n\n\n memset(&un, 0, sizeof(un));\n\n un.sun_family = AF_UNIX;\n\n snprintf(un.sun_path, sizeof(un.sun_path), \"%s\", path);\n\n if (connect(sock, (struct sockaddr*) &un, sizeof(un)) < 0) {\n\n fprintf(stderr, \"connect(unix:%s): %s\\n\", path, strerror(errno));\n\n\n\treturn -1;\n\n }\n\n\n\n if (sockets_debug)\n\n fprintf(stderr, \"connect(unix:%s): OK\\n\", path);\n\n return sock;\n\n}"}} {"sample_id": "14b6160099f0caf5dc9d62e637b007bc5d719a96_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n QBool *qobject_to_qbool(const QObject *obj)\n+\n {\n \n if (qobject_type(obj) != QTYPE_QBOOL)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "QBool *qobject_to_qbool(const QObject *obj)\n\n{\n\n if (qobject_type(obj) != QTYPE_QBOOL)\n\n return NULL;\n\n\n\n return container_of(obj, QBool, base);\n\n}\n"}} {"sample_id": "1d16a1cf99488f16492b1bb48e023f4da8377e07_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n for(i=0; i<16; i++){\n \n+ if(nnzc[ scan8[i] ])\n+\n+ ff_h264_idct_add_mmx(dst + block_offset[i], block + i*16, stride);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ff_h264_idct_add16_mmx(uint8_t *dst, const int *block_offset, DCTELEM *block, int stride, const uint8_t nnzc[6*8]){\n\n int i;\n\n for(i=0; i<16; i++){\n\n if(nnzc[ scan8[i] ])\n\n ff_h264_idct_add_mmx(dst + block_offset[i], block + i*16, stride);\n\n }\n\n}\n"}} {"sample_id": "a9fc37f6bc3f2ab90585cb16493da9f6dcfbfbcf_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n \n \n assert(tos && !tos->entry);\n+\n if (qiv->strict) {\n \n GHashTable *const top_ht = tos->h;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void qobject_input_check_struct(Visitor *v, Error **errp)\n\n{\n\n QObjectInputVisitor *qiv = to_qiv(v);\n\n StackObject *tos = QSLIST_FIRST(&qiv->stack);\n\n\n\n assert(tos && !tos->entry);\n\n if (qiv->strict) {\n\n GHashTable *const top_ht = tos->h;\n\n if (top_ht) {\n\n GHashTableIter iter;\n\n const char *key;\n\n\n\n g_hash_table_iter_init(&iter, top_ht);\n\n if (g_hash_table_iter_next(&iter, (void **)&key, NULL)) {\n\n error_setg(errp, \"Parameter '%s' is unexpected\", key);\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "81cf8d8adc64203567e03326c13ea4abec9fe5df_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n ((env->tr.flags >> DESC_TYPE_SHIFT) & 0xf) != 9 ||\n \n+ env->tr.limit < 103) {\n+\n+ goto fail;\n+\n+ }\n \n io_offset = cpu_lduw_kernel(env, env->tr.base + 0x66);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void check_io(CPUX86State *env, int addr, int size)\n\n{\n\n int io_offset, val, mask;\n\n\n\n /* TSS must be a valid 32 bit one */\n\n if (!(env->tr.flags & DESC_P_MASK) ||\n\n ((env->tr.flags >> DESC_TYPE_SHIFT) & 0xf) != 9 ||\n\n env->tr.limit < 103) {\n\n goto fail;\n\n }\n\n io_offset = cpu_lduw_kernel(env, env->tr.base + 0x66);\n\n io_offset += (addr >> 3);\n\n /* Note: the check needs two bytes */\n\n if ((io_offset + 1) > env->tr.limit) {\n\n goto fail;\n\n }\n\n val = cpu_lduw_kernel(env, env->tr.base + io_offset);\n\n val >>= (addr & 7);\n\n mask = (1 << size) - 1;\n\n /* all bits must be zero to allow the I/O */\n\n if ((val & mask) != 0) {\n\n fail:\n\n raise_exception_err(env, EXCP0D_GPF, 0);\n\n }\n\n}\n"}} {"sample_id": "c2f07f81a2d52d9d5243ead61d93e875487acf70", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void breakpoint_invalidate(CPUState *env, target_ulong pc)\n+\n+{\n+\n target_ulong phys_addr;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void breakpoint_invalidate(CPUState *env, target_ulong pc)\n\n{\n\n target_ulong phys_addr;\n\n\n\n phys_addr = cpu_get_phys_page_debug(env, pc);\n\n tb_invalidate_phys_page_range(phys_addr, phys_addr + 1, 0);\n\n}\n"}} {"sample_id": "abed886ec60cf239a03515cf0b30fb11fa964c44", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void device_finalize(Object *obj)\n \n {\n+\n NamedGPIOList *ngl, *next;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void device_finalize(Object *obj)\n\n{\n\n NamedGPIOList *ngl, *next;\n\n\n\n DeviceState *dev = DEVICE(obj);\n\n qemu_opts_del(dev->opts);\n\n\n\n QLIST_FOREACH_SAFE(ngl, &dev->gpios, node, next) {\n\n QLIST_REMOVE(ngl, node);\n\n qemu_free_irqs(ngl->in, ngl->num_in);\n\n g_free(ngl->name);\n\n g_free(ngl);\n\n /* ngl->out irqs are owned by the other end and should not be freed\n\n * here\n\n */\n\n }\n\n}\n"}} {"sample_id": "faadf50e2962dd54175647a80bd6fc4319c91973_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n target_phys_addr_t cpu_get_phys_page_debug (CPUState *env, target_ulong addr)\n \n+{\n \n mmu_ctx_t ctx;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "target_phys_addr_t cpu_get_phys_page_debug (CPUState *env, target_ulong addr)\n\n{\n\n mmu_ctx_t ctx;\n\n\n\n if (unlikely(get_physical_address(env, &ctx, addr, 0, ACCESS_INT, 1) != 0))\n\n return -1;\n\n\n\n return ctx.raddr & TARGET_PAGE_MASK;\n\n}\n"}} {"sample_id": "22b985d59c007c4422aefe3ef3fca0aa0daafa9f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n src = frame_src;\n \n+ frame_ant = *frame_ant_ptr;\n+\n+ }\n+\n+\n \n if (spatial[0])\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void denoise_depth(HQDN3DContext *s,\n\n uint8_t *src, uint8_t *dst,\n\n uint16_t *line_ant, uint16_t **frame_ant_ptr,\n\n int w, int h, int sstride, int dstride,\n\n int16_t *spatial, int16_t *temporal, int depth)\n\n{\n\n // FIXME: For 16bit depth, frame_ant could be a pointer to the previous\n\n // filtered frame rather than a separate buffer.\n\n long x, y;\n\n uint16_t *frame_ant = *frame_ant_ptr;\n\n if (!frame_ant) {\n\n uint8_t *frame_src = src;\n\n *frame_ant_ptr = frame_ant = av_malloc(w*h*sizeof(uint16_t));\n\n for (y = 0; y < h; y++, src += sstride, frame_ant += w)\n\n for (x = 0; x < w; x++)\n\n frame_ant[x] = LOAD(x);\n\n src = frame_src;\n\n frame_ant = *frame_ant_ptr;\n\n }\n\n\n\n if (spatial[0])\n\n denoise_spatial(s, src, dst, line_ant, frame_ant,\n\n w, h, sstride, dstride, spatial, temporal, depth);\n\n else\n\n denoise_temporal(src, dst, frame_ant,\n\n w, h, sstride, dstride, temporal, depth);\n\n emms_c();\n\n}\n"}} {"sample_id": "6484e422479c93f28e3f8a68258b0eacd3b31e6d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n if (ioh->fd == fd) {\n \n+ ioh->deleted = 1;\n+\n+ break;\n+\n+ }\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_set_fd_handler2(int fd,\n\n IOCanReadHandler *fd_read_poll,\n\n IOHandler *fd_read,\n\n IOHandler *fd_write,\n\n void *opaque)\n\n{\n\n IOHandlerRecord *ioh;\n\n\n\n assert(fd >= 0);\n\n\n\n if (!fd_read && !fd_write) {\n\n QLIST_FOREACH(ioh, &io_handlers, next) {\n\n if (ioh->fd == fd) {\n\n ioh->deleted = 1;\n\n break;\n\n }\n\n }\n\n } else {\n\n QLIST_FOREACH(ioh, &io_handlers, next) {\n\n if (ioh->fd == fd)\n\n goto found;\n\n }\n\n ioh = g_malloc0(sizeof(IOHandlerRecord));\n\n QLIST_INSERT_HEAD(&io_handlers, ioh, next);\n\n found:\n\n ioh->fd = fd;\n\n ioh->fd_read_poll = fd_read_poll;\n\n ioh->fd_read = fd_read;\n\n ioh->fd_write = fd_write;\n\n ioh->opaque = opaque;\n\n ioh->pollfds_idx = -1;\n\n ioh->deleted = 0;\n\n qemu_notify_event();\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "5f8632d3c3d7bc5ef24166ba7cf90fcfb2adbf7d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,10 +19,10 @@\n \n }\n \n+ x86_cpu_compat_disable_kvm_features(FEAT_KVM, KVM_FEATURE_PV_EOI);\n+\n+ enable_compat_apic_id_mode();\n+\n+ pc_init1(machine, 0, 1);\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void pc_init_isa(MachineState *machine)\n\n{\n\n has_pci_info = false;\n\n has_acpi_build = false;\n\n smbios_defaults = false;\n\n\n\n\n\n\n if (!machine->cpu_model) {\n\n machine->cpu_model = \"486\";\n\n }\n\n x86_cpu_compat_disable_kvm_features(FEAT_KVM, KVM_FEATURE_PV_EOI);\n\n enable_compat_apic_id_mode();\n\n pc_init1(machine, 0, 1);\n\n}"}} {"sample_id": "ec6a855b3a6b87f3415cc4ecfc685bd2eefc6a80", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n {\n VDPAUHWContext *hwctx = avctx->hwaccel_context;\n VDPAUContext *vdctx = avctx->internal->hwaccel_priv_data;\n+ VdpDecoderCreate *create;\n+ void *func;\n+ VdpStatus status;\n+ /* See vdpau/vdpau.h for alignment constraints. */\n+ uint32_t width = (avctx->coded_width + 1) & ~1;\n uint32_t height = (avctx->coded_height + 3) & ~3;\n if (hwctx->context.decoder != VDP_INVALID_HANDLE) {\n vdctx->decoder = hwctx->context.decoder;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "MAKE_ACCESSORS(AVVDPAUContext, vdpau_hwaccel, AVVDPAU_Render2, render2)\nint ff_vdpau_common_init(AVCodecContext *avctx, VdpDecoderProfile profile,\n int level)\n{\n VDPAUHWContext *hwctx = avctx->hwaccel_context;\n VDPAUContext *vdctx = avctx->internal->hwaccel_priv_data;\n VdpDecoderCreate *create;\n void *func;\n VdpStatus status;\n /* See vdpau/vdpau.h for alignment constraints. */\n uint32_t width = (avctx->coded_width + 1) & ~1;\n uint32_t height = (avctx->coded_height + 3) & ~3;\n if (hwctx->context.decoder != VDP_INVALID_HANDLE) {\n vdctx->decoder = hwctx->context.decoder;\n vdctx->render = hwctx->context.render;\n return 0; /* Decoder created by user */\n vdctx->device = hwctx->device;\n vdctx->get_proc_address = hwctx->get_proc_address;\n status = vdctx->get_proc_address(vdctx->device, VDP_FUNC_ID_DECODER_CREATE,\n &func);\n if (status != VDP_STATUS_OK)\n return vdpau_error(status);\n else\n create = func;\n status = vdctx->get_proc_address(vdctx->device, VDP_FUNC_ID_DECODER_RENDER,\n &func);\n if (status != VDP_STATUS_OK)\n return vdpau_error(status);\n else\n vdctx->render = func;\n status = create(vdctx->device, profile, width, height, avctx->refs,\n &vdctx->decoder);\n return vdpau_error(status);"}} {"sample_id": "073c2593c9f0aa4445a6fc1b9b24e6e52a8cc2c1_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static void init_2d_vlc_rl(RLTable *rl)\n \n+{\n+\n int i;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void init_2d_vlc_rl(RLTable *rl)\n\n{\n\n int i;\n\n \n\n init_vlc(&rl->vlc, TEX_VLC_BITS, rl->n + 2, \n\n &rl->table_vlc[0][1], 4, 2,\n\n &rl->table_vlc[0][0], 4, 2);\n\n\n\n \n\n rl->rl_vlc[0]= av_malloc(rl->vlc.table_size*sizeof(RL_VLC_ELEM));\n\n for(i=0; ivlc.table_size; i++){\n\n int code= rl->vlc.table[i][0];\n\n int len = rl->vlc.table[i][1];\n\n int level, run;\n\n \n\n if(len==0){ // illegal code\n\n run= 65;\n\n level= MAX_LEVEL;\n\n }else if(len<0){ //more bits needed\n\n run= 0;\n\n level= code;\n\n }else{\n\n if(code==rl->n){ //esc\n\n run= 65;\n\n level= 0;\n\n }else if(code==rl->n+1){ //eob\n\n run= 0;\n\n level= 127;\n\n }else{\n\n run= rl->table_run [code] + 1;\n\n level= rl->table_level[code];\n\n }\n\n }\n\n rl->rl_vlc[0][i].len= len;\n\n rl->rl_vlc[0][i].level= level;\n\n rl->rl_vlc[0][i].run= run;\n\n }\n\n}\n"}} {"sample_id": "7a961a46ba28e49f88ff0e81b96395c96b424634", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,10 +7,10 @@\n \n p = &first_avcodec;\n \n+ while (*p != NULL) p = &(*p)->next;\n+\n+ *p = codec;\n+\n codec->next = NULL;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void register_avcodec(AVCodec *codec)\n\n{\n\n AVCodec **p;\n\n\n p = &first_avcodec;\n\n while (*p != NULL) p = &(*p)->next;\n\n *p = codec;\n\n codec->next = NULL;\n\n}"}} {"sample_id": "f19442c069929727b19c948619488370d279e177", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n int i, idx = 0, sum = 0;\n \n for (i = N - 1; i >= 0; i--) {\n+\n const uint32_t i_s = CELT_PVQ_U(N - i, sum + FFABS(y[i]) + 1);\n \n idx += CELT_PVQ_U(N - i, sum) + (y[i] < 0)*i_s;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static inline uint32_t celt_icwrsi(uint32_t N, uint32_t K, const int *y)\n\n{\n\n int i, idx = 0, sum = 0;\n\n for (i = N - 1; i >= 0; i--) {\n\n const uint32_t i_s = CELT_PVQ_U(N - i, sum + FFABS(y[i]) + 1);\n\n idx += CELT_PVQ_U(N - i, sum) + (y[i] < 0)*i_s;\n\n sum += FFABS(y[i]);\n\n }\n\n av_assert0(sum == K);\n\n return idx;\n\n}\n"}} {"sample_id": "15c2f669e3fb2bc97f7b42d1871f595c0ac24af8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static void qmp_input_end_struct(Visitor *v, Error **errp)\n+\n+{\n \n QmpInputVisitor *qiv = to_qiv(v);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void qmp_input_end_struct(Visitor *v, Error **errp)\n\n{\n\n QmpInputVisitor *qiv = to_qiv(v);\n\n\n\n qmp_input_pop(qiv, errp);\n\n}\n"}} {"sample_id": "2c933c51687db958d8045d25ed87848342e869f6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,7 +20,7 @@\n \n }\n \n+\n \n for (i = 0; i < 4; i++) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void svq3_add_idct_c(uint8_t *dst, int16_t *block,\n\n int stride, int qp, int dc)\n\n{\n\n const int qmul = svq3_dequant_coeff[qp];\n\n int i;\n\n\n\n if (dc) {\n\n dc = 13 * 13 * (dc == 1 ? 1538U* block[0]\n\n : qmul * (block[0] >> 3) / 2);\n\n block[0] = 0;\n\n }\n\n\n\n for (i = 0; i < 4; i++) {\n\n const int z0 = 13 * (block[0 + 4 * i] + block[2 + 4 * i]);\n\n const int z1 = 13 * (block[0 + 4 * i] - block[2 + 4 * i]);\n\n const int z2 = 7 * block[1 + 4 * i] - 17 * block[3 + 4 * i];\n\n const int z3 = 17 * block[1 + 4 * i] + 7 * block[3 + 4 * i];\n\n\n\n block[0 + 4 * i] = z0 + z3;\n\n block[1 + 4 * i] = z1 + z2;\n\n block[2 + 4 * i] = z1 - z2;\n\n block[3 + 4 * i] = z0 - z3;\n\n }\n\n\n\n for (i = 0; i < 4; i++) {\n\n const unsigned z0 = 13 * (block[i + 4 * 0] + block[i + 4 * 2]);\n\n const unsigned z1 = 13 * (block[i + 4 * 0] - block[i + 4 * 2]);\n\n const unsigned z2 = 7 * block[i + 4 * 1] - 17 * block[i + 4 * 3];\n\n const unsigned z3 = 17 * block[i + 4 * 1] + 7 * block[i + 4 * 3];\n\n const int rr = (dc + 0x80000);\n\n\n\n dst[i + stride * 0] = av_clip_uint8(dst[i + stride * 0] + ((int)((z0 + z3) * qmul + rr) >> 20));\n\n dst[i + stride * 1] = av_clip_uint8(dst[i + stride * 1] + ((int)((z1 + z2) * qmul + rr) >> 20));\n\n dst[i + stride * 2] = av_clip_uint8(dst[i + stride * 2] + ((int)((z1 - z2) * qmul + rr) >> 20));\n\n dst[i + stride * 3] = av_clip_uint8(dst[i + stride * 3] + ((int)((z0 - z3) * qmul + rr) >> 20));\n\n }\n\n\n\n memset(block, 0, 16 * sizeof(int16_t));\n\n}\n"}} {"sample_id": "c60bf3391bf4cb79b7adc6650094e21671ddaabd_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n \n \n+ rs->hist_entry = -1;\n+\n+ rs->mon = mon;\n+\n+ rs->completion_finder = completion_finder;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "ReadLineState *readline_init(Monitor *mon,\n\n ReadLineCompletionFunc *completion_finder)\n\n{\n\n ReadLineState *rs = g_malloc0(sizeof(*rs));\n\n\n\n rs->hist_entry = -1;\n\n rs->mon = mon;\n\n rs->completion_finder = completion_finder;\n\n\n\n return rs;\n\n}\n"}} {"sample_id": "36be0929f53260cb9b1e2720c7c22f6b5fb5910f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void cd_read_sector_cb(void *opaque, int ret)\n \n+{\n \n IDEState *s = opaque;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void cd_read_sector_cb(void *opaque, int ret)\n\n{\n\n IDEState *s = opaque;\n\n\n\n block_acct_done(blk_get_stats(s->blk), &s->acct);\n\n\n\n#ifdef DEBUG_IDE_ATAPI\n\n printf(\"cd_read_sector_cb: lba=%d ret=%d\\n\", s->lba, ret);\n\n#endif\n\n\n\n if (ret < 0) {\n\n ide_atapi_io_error(s, ret);\n\n return;\n\n }\n\n\n\n if (s->cd_sector_size == 2352) {\n\n cd_data_to_raw(s->io_buffer, s->lba);\n\n }\n\n\n\n s->lba++;\n\n s->io_buffer_index = 0;\n\n s->status &= ~BUSY_STAT;\n\n\n\n ide_atapi_cmd_reply_end(s);\n\n}\n"}} {"sample_id": "83e6813a93e38976391b8c382c3375e3e188df3e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void aarch64_cpu_register(const ARMCPUInfo *info)\n+\n+{\n+\n+ TypeInfo type_info = {\n \n .parent = TYPE_AARCH64_CPU,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void aarch64_cpu_register(const ARMCPUInfo *info)\n\n{\n\n TypeInfo type_info = {\n\n .parent = TYPE_AARCH64_CPU,\n\n .instance_size = sizeof(ARMCPU),\n\n .instance_init = info->initfn,\n\n .class_size = sizeof(ARMCPUClass),\n\n .class_init = info->class_init,\n\n };\n\n\n\n /* TODO: drop when we support more CPUs - all entries will have name set */\n\n if (!info->name) {\n\n return;\n\n }\n\n\n\n type_info.name = g_strdup_printf(\"%s-\" TYPE_ARM_CPU, info->name);\n\n type_register(&type_info);\n\n g_free((void *)type_info.name);\n\n}\n"}} {"sample_id": "4a41a2d68a684241aca96dba066e0699941b730d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n+static void nbd_teardown_connection(NbdClientSession *client)\n \n {\n+\n+ struct nbd_request request = {\n+\n+ .type = NBD_CMD_DISC,\n+\n+ .from = 0,\n \n .len = 0\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void nbd_teardown_connection(NbdClientSession *client)\n\n{\n\n struct nbd_request request = {\n\n .type = NBD_CMD_DISC,\n\n .from = 0,\n\n .len = 0\n\n };\n\n\n\n nbd_send_request(client->sock, &request);\n\n\n\n /* finish any pending coroutines */\n\n shutdown(client->sock, 2);\n\n nbd_recv_coroutines_enter_all(client);\n\n\n\n qemu_aio_set_fd_handler(client->sock, NULL, NULL, NULL);\n\n closesocket(client->sock);\n\n client->sock = -1;\n\n}\n"}} {"sample_id": "8607f5c3072caeebbe0217df28651fffd3a79fd9_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -43,11 +43,11 @@\n virtio_blk_init_request(s, virtio_get_queue(vdev, vq_idx), req);\n \n req->next = s->rq;\n+\n+ s->rq = req;\n+\n+ }\n+\n \n \n return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int virtio_blk_load_device(VirtIODevice *vdev, QEMUFile *f,\n\n int version_id)\n\n{\n\n VirtIOBlock *s = VIRTIO_BLK(vdev);\n\n\n\n while (qemu_get_sbyte(f)) {\n\n unsigned nvqs = s->conf.num_queues;\n\n unsigned vq_idx = 0;\n\n VirtIOBlockReq *req;\n\n\n\n if (nvqs > 1) {\n\n vq_idx = qemu_get_be32(f);\n\n\n\n if (vq_idx >= nvqs) {\n\n error_report(\"Invalid virtqueue index in request list: %#x\",\n\n vq_idx);\n\n return -EINVAL;\n\n }\n\n }\n\n\n\n req = qemu_get_virtqueue_element(f, sizeof(VirtIOBlockReq));\n\n virtio_blk_init_request(s, virtio_get_queue(vdev, vq_idx), req);\n\n req->next = s->rq;\n\n s->rq = req;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "3b199d29cd597a3518136d78860e172060b9e83d_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static av_cold int truemotion1_decode_init(AVCodecContext *avctx)\n+\n+{\n+\n+ TrueMotion1Context *s = avctx->priv_data;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int truemotion1_decode_init(AVCodecContext *avctx)\n\n{\n\n TrueMotion1Context *s = avctx->priv_data;\n\n\n\n s->avctx = avctx;\n\n\n\n // FIXME: it may change ?\n\n// if (avctx->bits_per_sample == 24)\n\n// avctx->pix_fmt = AV_PIX_FMT_RGB24;\n\n// else\n\n// avctx->pix_fmt = AV_PIX_FMT_RGB555;\n\n\n\n s->frame.data[0] = NULL;\n\n\n\n /* there is a vertical predictor for each pixel in a line; each vertical\n\n * predictor is 0 to start with */\n\n av_fast_malloc(&s->vert_pred, &s->vert_pred_size, s->avctx->width * sizeof(unsigned int));\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_61", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,6 +4,6 @@\n \n {\n \n+ cpu_outb(addr & IOPORTS_MASK, val);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void isa_mmio_writeb (void *opaque, target_phys_addr_t addr,\n\n uint32_t val)\n\n{\n\n cpu_outb(addr & IOPORTS_MASK, val);\n\n}\n"}} {"sample_id": "0fbf50b6ec126600dca115adb1563c657cc27695", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static uint64_t master_abort_mem_read(void *opaque, hwaddr addr, unsigned size)\n+\n {\n \n return -1ULL;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static uint64_t master_abort_mem_read(void *opaque, hwaddr addr, unsigned size)\n\n{\n\n return -1ULL;\n\n}\n"}} {"sample_id": "704cc5e75df3a1dc68581d3857a06d502d8662b6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n return;\n \n+\n+\n+ if ((*wctx)->writer->uninit)\n+\n+ (*wctx)->writer->uninit(*wctx);\n \n for (i = 0; i < SECTION_MAX_NB_LEVELS; i++)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void writer_close(WriterContext **wctx)\n\n{\n\n int i;\n\n\n\n if (!*wctx)\n\n return;\n\n\n\n if ((*wctx)->writer->uninit)\n\n (*wctx)->writer->uninit(*wctx);\n\n for (i = 0; i < SECTION_MAX_NB_LEVELS; i++)\n\n av_bprint_finalize(&(*wctx)->section_pbuf[i], NULL);\n\n if ((*wctx)->writer->priv_class)\n\n av_opt_free((*wctx)->priv);\n\n av_freep(&((*wctx)->priv));\n\n\n av_freep(wctx);\n\n}"}} {"sample_id": "77a10d04d033484a913a5ee76eed31a9acc57bae_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void vfio_exitfn(PCIDevice *pdev)\n \n+{\n \n VFIOPCIDevice *vdev = DO_UPCAST(VFIOPCIDevice, pdev, pdev);\n \n@@ -9,10 +9,10 @@\n \n \n vfio_unregister_err_notifier(vdev);\n+\n+ pci_device_set_intx_routing_notifier(&vdev->pdev, NULL);\n+\n+ vfio_disable_interrupts(vdev);\n \n if (vdev->intx.mmap_timer) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void vfio_exitfn(PCIDevice *pdev)\n\n{\n\n VFIOPCIDevice *vdev = DO_UPCAST(VFIOPCIDevice, pdev, pdev);\n\n VFIOGroup *group = vdev->vbasedev.group;\n\n\n\n vfio_unregister_err_notifier(vdev);\n\n pci_device_set_intx_routing_notifier(&vdev->pdev, NULL);\n\n vfio_disable_interrupts(vdev);\n\n if (vdev->intx.mmap_timer) {\n\n timer_free(vdev->intx.mmap_timer);\n\n }\n\n vfio_teardown_msi(vdev);\n\n vfio_unmap_bars(vdev);\n\n g_free(vdev->emulated_config_bits);\n\n g_free(vdev->rom);\n\n vfio_put_device(vdev);\n\n vfio_put_group(group);\n\n}\n"}} {"sample_id": "77cb0f5aafc8e6d0c6d3c339f381c9b7921648e0_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,19 +1,19 @@\n+static void adb_keyboard_event(DeviceState *dev, QemuConsole *src,\n+\n+ InputEvent *evt)\n+\n+{\n \n KBDState *s = (KBDState *)dev;\n+\n int qcode, keycode;\n+\n \n \n qcode = qemu_input_key_value_to_qcode(evt->u.key.data->key);\n \n if (qcode >= ARRAY_SIZE(qcode_to_adb_keycode)) {\n+\n return;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void adb_keyboard_event(DeviceState *dev, QemuConsole *src,\n\n InputEvent *evt)\n\n{\n\n KBDState *s = (KBDState *)dev;\n\n int qcode, keycode;\n\n\n\n qcode = qemu_input_key_value_to_qcode(evt->u.key.data->key);\n\n if (qcode >= ARRAY_SIZE(qcode_to_adb_keycode)) {\n\n return;\n\n }\n\n /* FIXME: take handler into account when translating qcode */\n\n keycode = qcode_to_adb_keycode[qcode];\n\n if (keycode == NO_KEY) { /* We don't want to send this to the guest */\n\n ADB_DPRINTF(\"Ignoring NO_KEY\\n\");\n\n return;\n\n }\n\n if (evt->u.key.data->down == false) { /* if key release event */\n\n keycode = keycode | 0x80; /* create keyboard break code */\n\n }\n\n\n\n adb_kbd_put_keycode(s, keycode);\n\n}\n"}} {"sample_id": "6e42e6c4b410dbef8b593c2d796a5dad95f89ee4_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n void rgb15tobgr16(const uint8_t *src, uint8_t *dst, long src_size)\n+\n+{\n+\n \tlong i;\n+\n+\tlong num_pixels = src_size >> 1;\n+\n+\n+\n+\tfor(i=0; i> 1;\n\n\n\n\tfor(i=0; i>5;\n\n\t b = (rgb&0x7C00)>>10;\n\n\t dst[2*i] = (b&0x1F) | ((g&0x3F)<<5) | ((r&0x1F)<<11);\n\n\t}\n\n}\n"}} {"sample_id": "a340046614644a8958883954b96e92a87a5e78f7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n {\n \n+ DeviceState *dev = DEVICE(obj);\n \n Property *prop = opaque;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void set_pci_devfn(Object *obj, Visitor *v, void *opaque,\n\n const char *name, Error **errp)\n\n{\n\n DeviceState *dev = DEVICE(obj);\n\n Property *prop = opaque;\n\n uint32_t *ptr = qdev_get_prop_ptr(dev, prop);\n\n unsigned int slot, fn, n;\n\n Error *local_err = NULL;\n\n char *str = (char *)\"\";\n\n\n\n if (dev->state != DEV_STATE_CREATED) {\n\n error_set(errp, QERR_PERMISSION_DENIED);\n\n return;\n\n }\n\n\n\n visit_type_str(v, &str, name, &local_err);\n\n if (local_err) {\n\n error_free(local_err);\n\n return set_int32(obj, v, opaque, name, errp);\n\n }\n\n\n\n if (sscanf(str, \"%x.%x%n\", &slot, &fn, &n) != 2) {\n\n fn = 0;\n\n if (sscanf(str, \"%x%n\", &slot, &n) != 1) {\n\n goto invalid;\n\n }\n\n }\n\n if (str[n] != '\\0' || fn > 7 || slot > 31) {\n\n goto invalid;\n\n }\n\n *ptr = slot << 3 | fn;\n\n return;\n\n\n\ninvalid:\n\n error_set_from_qdev_prop_error(errp, EINVAL, dev, prop, str);\n\n}\n"}} {"sample_id": "30be1ea33e5525266ad871bed60b1893a53caeaf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int ebml_read_binary(AVIOContext *pb, int length, EbmlBin *bin)\n \n+{\n \n av_free(bin->data);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int ebml_read_binary(AVIOContext *pb, int length, EbmlBin *bin)\n\n{\n\n av_free(bin->data);\n\n if (!(bin->data = av_malloc(length)))\n\n return AVERROR(ENOMEM);\n\n\n\n bin->size = length;\n\n bin->pos = avio_tell(pb);\n\n if (avio_read(pb, bin->data, length) != length) {\n\n av_freep(&bin->data);\n\n return AVERROR(EIO);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "ac3b01a9c0607961f4540fe62040833870f5deb1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n *src[1]++ = i1;\n *src[2]++ = i2;\n break;\n+ case FF_DWT53:\n+ for (i = 0; i < csize; i++) {\n+ i1 = *src[0] - (*src[2] + *src[1] >> 2);\n+ i0 = i1 + *src[2];\n+ i2 = i1 + *src[1];\n *src[0]++ = i0;\n *src[1]++ = i1;\n *src[2]++ = i2;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void mct_decode(Jpeg2000DecoderContext *s, Jpeg2000Tile *tile)\n{\n int i, csize = 1;\n int32_t *src[3], i0, i1, i2;\n float *srcf[3], i0f, i1f, i2f;\n for (i = 0; i < 3; i++)\n if (tile->codsty[0].transform == FF_DWT97)\n srcf[i] = tile->comp[i].f_data;\n else\n src [i] = tile->comp[i].i_data;\n for (i = 0; i < 2; i++)\n csize *= tile->comp[0].coord[i][1] - tile->comp[0].coord[i][0];\n switch (tile->codsty[0].transform) {\n case FF_DWT97:\n for (i = 0; i < csize; i++) {\n i0f = *srcf[0] + (f_ict_params[0] * *srcf[2]);\n i1f = *srcf[0] - (f_ict_params[1] * *srcf[1])\n - (f_ict_params[2] * *srcf[2]);\n i2f = *srcf[0] + (f_ict_params[3] * *srcf[1]);\n *srcf[0]++ = i0f;\n *srcf[1]++ = i1f;\n *srcf[2]++ = i2f;\n break;\n case FF_DWT97_INT:\n for (i = 0; i < csize; i++) {\n i0 = *src[0] + (((i_ict_params[0] * *src[2]) + (1 << 15)) >> 16);\n i1 = *src[0] - (((i_ict_params[1] * *src[1]) + (1 << 15)) >> 16)\n - (((i_ict_params[2] * *src[2]) + (1 << 15)) >> 16);\n i2 = *src[0] + (((i_ict_params[3] * *src[1]) + (1 << 15)) >> 16);\n *src[0]++ = i0;\n *src[1]++ = i1;\n *src[2]++ = i2;\n break;\n case FF_DWT53:\n for (i = 0; i < csize; i++) {\n i1 = *src[0] - (*src[2] + *src[1] >> 2);\n i0 = i1 + *src[2];\n i2 = i1 + *src[1];\n *src[0]++ = i0;\n *src[1]++ = i1;\n *src[2]++ = i2;\n break;"}} {"sample_id": "6a5b69a959483c7404576a7dc54221ced41e6515", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,9 +9,9 @@\n int overflow = 0;\n \n uint64_t x0;\n+\n+ uint32_t x1;\n+\n \n \n x0 = (a & 0xffffffff) | ((int64_t) (env->y) << 32);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static target_ulong helper_udiv_common(CPUSPARCState *env, target_ulong a,\n\n target_ulong b, int cc)\n\n{\n\n SPARCCPU *cpu = sparc_env_get_cpu(env);\n\n int overflow = 0;\n\n uint64_t x0;\n\n uint32_t x1;\n\n\n\n x0 = (a & 0xffffffff) | ((int64_t) (env->y) << 32);\n\n x1 = (b & 0xffffffff);\n\n\n\n if (x1 == 0) {\n\n cpu_restore_state(CPU(cpu), GETPC());\n\n helper_raise_exception(env, TT_DIV_ZERO);\n\n }\n\n\n\n x0 = x0 / x1;\n\n if (x0 > 0xffffffff) {\n\n x0 = 0xffffffff;\n\n overflow = 1;\n\n }\n\n\n\n if (cc) {\n\n env->cc_dst = x0;\n\n env->cc_src2 = overflow;\n\n env->cc_op = CC_OP_DIV;\n\n }\n\n return x0;\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static uint32_t qvirtio_pci_get_features(QVirtioDevice *d)\n \n+{\n \n QVirtioPCIDevice *dev = (QVirtioPCIDevice *)d;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static uint32_t qvirtio_pci_get_features(QVirtioDevice *d)\n\n{\n\n QVirtioPCIDevice *dev = (QVirtioPCIDevice *)d;\n\n return qpci_io_readl(dev->pdev, dev->addr + VIRTIO_PCI_HOST_FEATURES);\n\n}\n"}} {"sample_id": "439e2a6e10ed7f5da819bf7dcaa54b8cfdbeab0d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n Aml *var = aml_opcode(0x79 /* ShiftLeftOp */);\n \n aml_append(var, arg1);\n+\n+ aml_append(var, count);\n+\n build_append_byte(var->buf, 0x00); /* NullNameOp */\n \n return var;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "Aml *aml_shiftleft(Aml *arg1, Aml *count)\n\n{\n\n Aml *var = aml_opcode(0x79 /* ShiftLeftOp */);\n\n aml_append(var, arg1);\n\n aml_append(var, count);\n\n build_append_byte(var->buf, 0x00); /* NullNameOp */\n\n return var;\n\n}\n"}} {"sample_id": "b436982f04fb33bb29fcdea190bd1fdc97dc65ef_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n BlockErrorAction action;\n \n \n+\n+ bdrv_set_dirty_bitmap(s->dirty_bitmap, op->sector_num, op->nb_sectors);\n+\n+ action = mirror_error_action(s, false, -ret);\n+\n if (action == BLOCK_ERROR_ACTION_REPORT && s->ret >= 0) {\n \n s->ret = ret;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void mirror_write_complete(void *opaque, int ret)\n\n{\n\n MirrorOp *op = opaque;\n\n MirrorBlockJob *s = op->s;\n\n\n\n aio_context_acquire(blk_get_aio_context(s->common.blk));\n\n if (ret < 0) {\n\n BlockErrorAction action;\n\n\n\n bdrv_set_dirty_bitmap(s->dirty_bitmap, op->sector_num, op->nb_sectors);\n\n action = mirror_error_action(s, false, -ret);\n\n if (action == BLOCK_ERROR_ACTION_REPORT && s->ret >= 0) {\n\n s->ret = ret;\n\n }\n\n }\n\n mirror_iteration_done(op, ret);\n\n aio_context_release(blk_get_aio_context(s->common.blk));\n\n}\n"}} {"sample_id": "d1adad3cca407f493c3637e20ecd4f7124e69212_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n vdst+= chromStride;\n \n+ }\n+\n+#if COMPILE_TEMPLATE_MMX\n+\n+ __asm__(\n \n EMMS\" \\n\\t\"\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void RENAME(uyvytoyuv422)(uint8_t *ydst, uint8_t *udst, uint8_t *vdst, const uint8_t *src,\n\n long width, long height,\n\n long lumStride, long chromStride, long srcStride)\n\n{\n\n long y;\n\n const long chromWidth= -((-width)>>1);\n\n\n\n for (y=0; ypriv_data;\n\n int err = ff_pcm_read_seek(s, stream_index, timestamp, flags);\n\n\n\n if (!oc->encrypted)\n\n return err;\n\n\n\n /* readjust IV for CBC */\n\n if (err || avio_tell(s->pb) < oc->content_start)\n\n goto wipe;\n\n if ((err = avio_seek(s->pb, -8, SEEK_CUR)) < 0)\n\n goto wipe;\n\n if ((err = avio_read(s->pb, oc->iv, 8)) < 8) {\n\n if (err >= 0)\n\n err = AVERROR_EOF;\n\n goto wipe;\n\n }\n\n\n\n return 0;\n\nwipe:\n\n memset(oc->iv, 0, 8);\n\n return err;\n\n}\n"}} {"sample_id": "6a63ff19b6a7fe3bc32c7fb4a62fca8f65786432_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n return AVERROR(ENOMEM);\n \n sc->chunk_count = entries;\n+\n+\n+\n+ if (atom.type == MKTAG('s','t','c','o'))\n+\n for(i=0; ichunk_offsets[i] = get_be32(pb);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mov_read_stco(MOVContext *c, ByteIOContext *pb, MOVAtom atom)\n\n{\n\n AVStream *st = c->fc->streams[c->fc->nb_streams-1];\n\n MOVStreamContext *sc = st->priv_data;\n\n unsigned int i, entries;\n\n\n\n get_byte(pb); /* version */\n\n get_be24(pb); /* flags */\n\n\n\n entries = get_be32(pb);\n\n\n\n if(entries >= UINT_MAX/sizeof(int64_t))\n\n return -1;\n\n\n\n sc->chunk_offsets = av_malloc(entries * sizeof(int64_t));\n\n if (!sc->chunk_offsets)\n\n return AVERROR(ENOMEM);\n\n sc->chunk_count = entries;\n\n\n\n if (atom.type == MKTAG('s','t','c','o'))\n\n for(i=0; ichunk_offsets[i] = get_be32(pb);\n\n else if (atom.type == MKTAG('c','o','6','4'))\n\n for(i=0; ichunk_offsets[i] = get_be64(pb);\n\n else\n\n return -1;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,8 +14,8 @@\n \n TAILQ_FOREACH(e, l, node) {\n \n+ e->init();\n+\n+ }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void module_call_init(module_init_type type)\n\n{\n\n ModuleTypeList *l;\n\n ModuleEntry *e;\n\n\n\n l = find_type(type);\n\n\n\n TAILQ_FOREACH(e, l, node) {\n\n e->init();\n\n }\n\n}\n"}} {"sample_id": "e3fc4481b6dd60acdb9f3e370ee9a1d1bd4ddd73", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int vqf_probe(AVProbeData *probe_packet)\n {\n+ if (AV_RL32(probe_packet->buf) != MKTAG('T','W','I','N'))\n+ return 0;\n if (!memcmp(probe_packet->buf + 4, \"97012000\", 8))\n return AVPROBE_SCORE_MAX;\n if (!memcmp(probe_packet->buf + 4, \"00052200\", 8))", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int vqf_probe(AVProbeData *probe_packet)\n{\n if (AV_RL32(probe_packet->buf) != MKTAG('T','W','I','N'))\n return 0;\n if (!memcmp(probe_packet->buf + 4, \"97012000\", 8))\n return AVPROBE_SCORE_MAX;\n if (!memcmp(probe_packet->buf + 4, \"00052200\", 8))\n return AVPROBE_SCORE_MAX;\n return AVPROBE_SCORE_EXTENSION;\n}"}} {"sample_id": "0380aef323154205a7d838fb9953423621290d41_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void test_properties(const char *path)\n \n {\n \n@@ -11,9 +11,9 @@\n QListEntry *entry;\n \n \n+\n g_test_message(\"Obtaining properties of %s\", path);\n+\n response = qmp(\"{ 'execute': 'qom-list',\"\n \n \" 'arguments': { 'path': '%s' } }\", path);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void test_properties(const char *path)\n\n{\n\n char *child_path;\n\n QDict *response, *tuple;\n\n QList *list;\n\n QListEntry *entry;\n\n\n\n g_test_message(\"Obtaining properties of %s\", path);\n\n response = qmp(\"{ 'execute': 'qom-list',\"\n\n \" 'arguments': { 'path': '%s' } }\", path);\n\n g_assert(response);\n\n\n\n g_assert(qdict_haskey(response, \"return\"));\n\n list = qobject_to_qlist(qdict_get(response, \"return\"));\n\n QLIST_FOREACH_ENTRY(list, entry) {\n\n tuple = qobject_to_qdict(qlist_entry_obj(entry));\n\n if (strstart(qdict_get_str(tuple, \"type\"), \"child<\", NULL)) {\n\n child_path = g_strdup_printf(\"%s/%s\",\n\n path, qdict_get_str(tuple, \"name\"));\n\n test_properties(child_path);\n\n g_free(child_path);\n\n } else {\n\n const char *prop = qdict_get_str(tuple, \"name\");\n\n g_test_message(\"Testing property %s.%s\", path, prop);\n\n response = qmp(\"{ 'execute': 'qom-get',\"\n\n \" 'arguments': { 'path': '%s',\"\n\n \" 'property': '%s' } }\",\n\n path, prop);\n\n /* qom-get may fail but should not, e.g., segfault. */\n\n g_assert(response);\n\n }\n\n }\n\n}\n"}} {"sample_id": "4f298a4b2957b7833bc607c951ca27c458d98d88_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void add_sel_entry(IPMIBmcSim *ibs,\n+\n uint8_t *cmd, unsigned int cmd_len,\n \n uint8_t *rsp, unsigned int *rsp_len,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void add_sel_entry(IPMIBmcSim *ibs,\n\n uint8_t *cmd, unsigned int cmd_len,\n\n uint8_t *rsp, unsigned int *rsp_len,\n\n unsigned int max_rsp_len)\n\n{\n\n IPMI_CHECK_CMD_LEN(18);\n\n if (sel_add_event(ibs, cmd + 2)) {\n\n rsp[2] = IPMI_CC_OUT_OF_SPACE;\n\n return;\n\n }\n\n /* sel_add_event fills in the record number. */\n\n IPMI_ADD_RSP_DATA(cmd[2]);\n\n IPMI_ADD_RSP_DATA(cmd[3]);\n\n}\n"}} {"sample_id": "19e95b88459e879d3e67a66350d937c32ed762ca", "diff": "--- a/source.c\n+++ b/source.c\n@@ -70,10 +70,10 @@\n \n prevframe_index += line_inc;\n \n+ prevframe_x = 0;\n+\n+ }\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static inline void xan_wc3_copy_pixel_run(XanContext *s,\n\n int x, int y, int pixel_count, int motion_x, int motion_y)\n\n{\n\n int stride;\n\n int line_inc;\n\n int curframe_index, prevframe_index;\n\n int curframe_x, prevframe_x;\n\n int width = s->avctx->width;\n\n unsigned char *palette_plane, *prev_palette_plane;\n\n\n\n palette_plane = s->current_frame.data[0];\n\n prev_palette_plane = s->last_frame.data[0];\n\n\n\n stride = s->current_frame.linesize[0];\n\n line_inc = stride - width;\n\n curframe_index = y * stride + x;\n\n curframe_x = x;\n\n prevframe_index = (y + motion_y) * stride + x + motion_x;\n\n prevframe_x = x + motion_x;\n\n while(pixel_count && (curframe_index < s->frame_size)) {\n\n int count = FFMIN3(pixel_count, width - curframe_x, width - prevframe_x);\n\n\n\n memcpy(palette_plane + curframe_index, prev_palette_plane + prevframe_index, count);\n\n pixel_count -= count;\n\n curframe_index += count;\n\n prevframe_index += count;\n\n curframe_x += count;\n\n prevframe_x += count;\n\n\n\n if (curframe_x >= width) {\n\n curframe_index += line_inc;\n\n curframe_x = 0;\n\n }\n\n\n\n if (prevframe_x >= width) {\n\n prevframe_index += line_inc;\n\n prevframe_x = 0;\n\n }\n\n }\n\n}"}} {"sample_id": "5e715b583dab85735660b15a8d217a69164675fe_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int parse_meter(DBEContext *s)\n+\n+{\n \n if (s->meter_size)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int parse_meter(DBEContext *s)\n\n{\n\n if (s->meter_size)\n\n skip_input(s, s->key_present + s->meter_size + 1);\n\n return 0;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_29", "diff": "--- a/source.c\n+++ b/source.c\n@@ -45,11 +45,11 @@\n s->nic = qemu_new_nic(&net_dp83932_info, &s->conf, nd->model, nd->name, s);\n \n \n+\n+ qemu_format_nic_info_str(&s->nic->nc, s->conf.macaddr.a);\n+\n+ qemu_register_reset(nic_reset, s);\n+\n nic_reset(s);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void dp83932_init(NICInfo *nd, target_phys_addr_t base, int it_shift,\n\n MemoryRegion *address_space,\n\n qemu_irq irq, void* mem_opaque,\n\n void (*memory_rw)(void *opaque, target_phys_addr_t addr, uint8_t *buf, int len, int is_write))\n\n{\n\n dp8393xState *s;\n\n\n\n qemu_check_nic_model(nd, \"dp83932\");\n\n\n\n s = g_malloc0(sizeof(dp8393xState));\n\n\n\n s->address_space = address_space;\n\n s->mem_opaque = mem_opaque;\n\n s->memory_rw = memory_rw;\n\n s->it_shift = it_shift;\n\n s->irq = irq;\n\n s->watchdog = qemu_new_timer_ns(vm_clock, dp8393x_watchdog, s);\n\n s->regs[SONIC_SR] = 0x0004; /* only revision recognized by Linux */\n\n\n\n s->conf.macaddr = nd->macaddr;\n\n s->conf.peer = nd->netdev;\n\n\n\n s->nic = qemu_new_nic(&net_dp83932_info, &s->conf, nd->model, nd->name, s);\n\n\n\n qemu_format_nic_info_str(&s->nic->nc, s->conf.macaddr.a);\n\n qemu_register_reset(nic_reset, s);\n\n nic_reset(s);\n\n\n\n memory_region_init_io(&s->mmio, &dp8393x_ops, s,\n\n \"dp8393x\", 0x40 << it_shift);\n\n memory_region_add_subregion(address_space, base, &s->mmio);\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_22", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+uint16_t qpci_io_readw(QPCIDevice *dev, void *data)\n+\n+{\n+\n uintptr_t addr = (uintptr_t)data;\n \n+\n \n if (addr < QPCI_PIO_LIMIT) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "uint16_t qpci_io_readw(QPCIDevice *dev, void *data)\n\n{\n\n uintptr_t addr = (uintptr_t)data;\n\n\n\n if (addr < QPCI_PIO_LIMIT) {\n\n return dev->bus->pio_readw(dev->bus, addr);\n\n } else {\n\n uint16_t val;\n\n dev->bus->memread(dev->bus, addr, &val, sizeof(val));\n\n return le16_to_cpu(val);\n\n }\n\n}\n"}} {"sample_id": "30ca440eec9fe1d7eec5a48addac656438778278", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static QOSState *pci_test_start(int socket)\n \n {\n+\n+ const char *cmd = \"-netdev socket,fd=%d,id=hs0 -device \"\n+\n \"virtio-net-pci,netdev=hs0\";\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static QOSState *pci_test_start(int socket)\n\n{\n\n const char *cmd = \"-netdev socket,fd=%d,id=hs0 -device \"\n\n \"virtio-net-pci,netdev=hs0\";\n\n\n\n return qtest_pc_boot(cmd, socket);\n\n}\n"}} {"sample_id": "876d516311c1538a7d29f2abec48b7cda0645eea", "diff": "--- a/source.c\n+++ b/source.c\n@@ -47,11 +47,11 @@\n \n \n \n+ /* vram (surfaces, 64bit, bar 4+5) */\n+\n+ if (qxl->vram_size_mb != -1) {\n+\n+ qxl->vram_size = qxl->vram_size_mb * 1024 * 1024;\n \n \n if (qxl->vram_size < qxl->vram32_size) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void qxl_init_ramsize(PCIQXLDevice *qxl)\n\n{\n\n /* vga mode framebuffer / primary surface (bar 0, first part) */\n\n if (qxl->vgamem_size_mb < 8) {\n\n qxl->vgamem_size_mb = 8;\n\n\n\n\n\n\n\n\n qxl->vgamem_size = qxl->vgamem_size_mb * 1024 * 1024;\n\n\n\n /* vga ram (bar 0, total) */\n\n if (qxl->ram_size_mb != -1) {\n\n qxl->vga.vram_size = qxl->ram_size_mb * 1024 * 1024;\n\n\n if (qxl->vga.vram_size < qxl->vgamem_size * 2) {\n\n qxl->vga.vram_size = qxl->vgamem_size * 2;\n\n\n\n\n /* vram32 (surfaces, 32bit, bar 1) */\n\n if (qxl->vram32_size_mb != -1) {\n\n qxl->vram32_size = qxl->vram32_size_mb * 1024 * 1024;\n\n\n if (qxl->vram32_size < 4096) {\n\n qxl->vram32_size = 4096;\n\n\n\n\n /* vram (surfaces, 64bit, bar 4+5) */\n\n if (qxl->vram_size_mb != -1) {\n\n qxl->vram_size = qxl->vram_size_mb * 1024 * 1024;\n\n\n if (qxl->vram_size < qxl->vram32_size) {\n\n qxl->vram_size = qxl->vram32_size;\n\n\n\n\n if (qxl->revision == 1) {\n\n qxl->vram32_size = 4096;\n\n qxl->vram_size = 4096;\n\n\n qxl->vgamem_size = msb_mask(qxl->vgamem_size * 2 - 1);\n\n qxl->vga.vram_size = msb_mask(qxl->vga.vram_size * 2 - 1);\n\n qxl->vram32_size = msb_mask(qxl->vram32_size * 2 - 1);\n\n qxl->vram_size = msb_mask(qxl->vram_size * 2 - 1);\n"}} {"sample_id": "318347234d7069b62d38391dd27e269a3107d668", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n sPAPRDRConnectorClass *drck = SPAPR_DR_CONNECTOR_GET_CLASS(drc);\n \n \n+\n+ drck->detach(drc, DEVICE(pdev), spapr_phb_remove_pci_device_cb, phb, errp);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void spapr_phb_remove_pci_device(sPAPRDRConnector *drc,\n\n sPAPRPHBState *phb,\n\n PCIDevice *pdev,\n\n Error **errp)\n\n{\n\n sPAPRDRConnectorClass *drck = SPAPR_DR_CONNECTOR_GET_CLASS(drc);\n\n\n\n drck->detach(drc, DEVICE(pdev), spapr_phb_remove_pci_device_cb, phb, errp);\n\n}\n"}} {"sample_id": "f61bece684d9685b07895508e6c1c733b5564ccf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n #if HAVE_ALTIVEC\n \n if (!(av_get_cpu_flags() & AV_CPU_FLAG_ALTIVEC))\n+\n+ return;\n+\n+\n+\n fdsp->vector_fmul = ff_vector_fmul_altivec;\n \n fdsp->vector_fmul_add = ff_vector_fmul_add_altivec;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "av_cold void ff_float_dsp_init_ppc(AVFloatDSPContext *fdsp, int bit_exact)\n\n{\n\n#if HAVE_ALTIVEC\n\n if (!(av_get_cpu_flags() & AV_CPU_FLAG_ALTIVEC))\n\n return;\n\n\n\n fdsp->vector_fmul = ff_vector_fmul_altivec;\n\n fdsp->vector_fmul_add = ff_vector_fmul_add_altivec;\n\n fdsp->vector_fmul_reverse = ff_vector_fmul_reverse_altivec;\n\n\n\n if (!bit_exact) {\n\n fdsp->vector_fmul_window = ff_vector_fmul_window_altivec;\n\n }\n\n#endif\n\n}\n"}} {"sample_id": "7f526efd17973ec6d2204f7a47b6923e2be31363_19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+void rgb16tobgr16(const uint8_t *src, uint8_t *dst, unsigned int src_size)\n+\n+{\n \n \tunsigned i;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void rgb16tobgr16(const uint8_t *src, uint8_t *dst, unsigned int src_size)\n\n{\n\n\tunsigned i;\n\n\tunsigned num_pixels = src_size >> 1;\n\n\t\n\n\tfor(i=0; i>5;\n\n\t b = (rgb&0xF800)>>11;\n\n\t dst[2*i] = (b&0x1F) | ((g&0x3F)<<5) | ((r&0x1F)<<11);\n\n\t}\n\n}\n"}} {"sample_id": "f6774f905fb3cfdc319523ac640be30b14c1bc55_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n int ff_mpeg_ref_picture(MpegEncContext *s, Picture *dst, Picture *src)\n \n+{\n+\n+ int ret;\n+\n \n \n av_assert0(!dst->f.buf[0]);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int ff_mpeg_ref_picture(MpegEncContext *s, Picture *dst, Picture *src)\n\n{\n\n int ret;\n\n\n\n av_assert0(!dst->f.buf[0]);\n\n av_assert0(src->f.buf[0]);\n\n\n\n src->tf.f = &src->f;\n\n dst->tf.f = &dst->f;\n\n ret = ff_thread_ref_frame(&dst->tf, &src->tf);\n\n if (ret < 0)\n\n goto fail;\n\n\n\n ret = update_picture_tables(dst, src);\n\n if (ret < 0)\n\n goto fail;\n\n\n\n if (src->hwaccel_picture_private) {\n\n dst->hwaccel_priv_buf = av_buffer_ref(src->hwaccel_priv_buf);\n\n if (!dst->hwaccel_priv_buf)\n\n goto fail;\n\n dst->hwaccel_picture_private = dst->hwaccel_priv_buf->data;\n\n }\n\n\n\n dst->field_picture = src->field_picture;\n\n dst->mb_var_sum = src->mb_var_sum;\n\n dst->mc_mb_var_sum = src->mc_mb_var_sum;\n\n dst->b_frame_score = src->b_frame_score;\n\n dst->needs_realloc = src->needs_realloc;\n\n dst->reference = src->reference;\n\n dst->shared = src->shared;\n\n\n\n return 0;\n\nfail:\n\n ff_mpeg_unref_picture(s, dst);\n\n return ret;\n\n}\n"}} {"sample_id": "4a1418e07bdcfaa3177739e04707ecaec75d89e1_35", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n kqemu_comm_base = 0xff000000 | 1;\n \n+ qpi_io_memory = cpu_register_io_memory(\n+\n+ qpi_mem_read, \n+\n qpi_mem_write, NULL);\n \n cpu_register_physical_memory(kqemu_comm_base & ~0xfff, ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qpi_init(void)\n\n{\n\n kqemu_comm_base = 0xff000000 | 1;\n\n qpi_io_memory = cpu_register_io_memory(\n\n qpi_mem_read, \n\n qpi_mem_write, NULL);\n\n cpu_register_physical_memory(kqemu_comm_base & ~0xfff, \n\n 0x1000, qpi_io_memory);\n\n}\n"}} {"sample_id": "b952b5589a36114e06201c0d2e82c293dbad2b1f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,7 +16,7 @@\n \n Error *errp = NULL;\n \n+\n \n if (!filename) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void hmp_drive_mirror(Monitor *mon, const QDict *qdict)\n\n{\n\n const char *device = qdict_get_str(qdict, \"device\");\n\n const char *filename = qdict_get_str(qdict, \"target\");\n\n const char *format = qdict_get_try_str(qdict, \"format\");\n\n int reuse = qdict_get_try_bool(qdict, \"reuse\", 0);\n\n int full = qdict_get_try_bool(qdict, \"full\", 0);\n\n enum NewImageMode mode;\n\n Error *errp = NULL;\n\n\n\n if (!filename) {\n\n error_set(&errp, QERR_MISSING_PARAMETER, \"target\");\n\n hmp_handle_error(mon, &errp);\n\n return;\n\n }\n\n\n\n if (reuse) {\n\n mode = NEW_IMAGE_MODE_EXISTING;\n\n } else {\n\n mode = NEW_IMAGE_MODE_ABSOLUTE_PATHS;\n\n }\n\n\n\n qmp_drive_mirror(device, filename, !!format, format,\n\n full ? MIRROR_SYNC_MODE_FULL : MIRROR_SYNC_MODE_TOP,\n\n true, mode, false, 0, &errp);\n\n hmp_handle_error(mon, &errp);\n\n}\n"}} {"sample_id": "42a268c241183877192c376d03bd9b6d527407c7_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n gen_load_fpr32(t0, fs);\n \n+ gen_store_fpr32(t0, fd);\n+\n+ gen_set_label(l1);\n+\n+\n \n tcg_gen_andi_i32(t0, fpu_fcr31, 1 << get_fp_bit(cc+1));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_movcf_ps(DisasContext *ctx, int fs, int fd,\n\n int cc, int tf)\n\n{\n\n int cond;\n\n TCGv_i32 t0 = tcg_temp_new_i32();\n\n int l1 = gen_new_label();\n\n int l2 = gen_new_label();\n\n\n\n if (tf)\n\n cond = TCG_COND_EQ;\n\n else\n\n cond = TCG_COND_NE;\n\n\n\n tcg_gen_andi_i32(t0, fpu_fcr31, 1 << get_fp_bit(cc));\n\n tcg_gen_brcondi_i32(cond, t0, 0, l1);\n\n gen_load_fpr32(t0, fs);\n\n gen_store_fpr32(t0, fd);\n\n gen_set_label(l1);\n\n\n\n tcg_gen_andi_i32(t0, fpu_fcr31, 1 << get_fp_bit(cc+1));\n\n tcg_gen_brcondi_i32(cond, t0, 0, l2);\n\n gen_load_fpr32h(ctx, t0, fs);\n\n gen_store_fpr32h(ctx, t0, fd);\n\n tcg_temp_free_i32(t0);\n\n gen_set_label(l2);\n\n}\n"}} {"sample_id": "cd6a9bb6e977864b1b7ec21b983fa0678b4b82e9_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n+static uint64_t ppc_hash64_page_shift(ppc_slb_t *slb)\n+\n+{\n+\n+ uint64_t epnshift;\n+\n \n+\n /* Page size according to the SLB, which we use to generate the\n+\n * EPN for hash table lookup.. When we implement more recent MMU\n \n * extensions this might be different from the actual page size", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static uint64_t ppc_hash64_page_shift(ppc_slb_t *slb)\n\n{\n\n uint64_t epnshift;\n\n\n\n /* Page size according to the SLB, which we use to generate the\n\n * EPN for hash table lookup.. When we implement more recent MMU\n\n * extensions this might be different from the actual page size\n\n * encoded in the PTE */\n\n if ((slb->vsid & SLB_VSID_LLP_MASK) == SLB_VSID_4K) {\n\n epnshift = TARGET_PAGE_BITS;\n\n } else if ((slb->vsid & SLB_VSID_LLP_MASK) == SLB_VSID_64K) {\n\n epnshift = TARGET_PAGE_BITS_64K;\n\n } else {\n\n epnshift = TARGET_PAGE_BITS_16M;\n\n }\n\n return epnshift;\n\n}\n"}} {"sample_id": "cdfd9717edac118968e63e6f83c3e45a7e337833", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n if(c->format == AV_SAMPLE_FMT_S16P && (mm_flags&AV_CPU_FLAG_MMX2 )){\n ret= swri_resample_int16_mmx2 (c, (int16_t*)dst->ch[i], (const int16_t*)src->ch[i], consumed, src_size, dst_size, i+1==dst->ch_count);\n need_emms= 1;\n+ } else\n+#endif\n+ if(c->format == AV_SAMPLE_FMT_S16P) ret= swri_resample_int16(c, (int16_t*)dst->ch[i], (const int16_t*)src->ch[i], consumed, src_size, dst_size, i+1==dst->ch_count);\n+ else if(c->format == AV_SAMPLE_FMT_S32P) ret= swri_resample_int32(c, (int32_t*)dst->ch[i], (const int32_t*)src->ch[i], consumed, src_size, dst_size, i+1==dst->ch_count);\n+#if HAVE_AVX_INLINE\n else if(c->format == AV_SAMPLE_FMT_FLTP && (mm_flags&AV_CPU_FLAG_AVX))\n ret= swri_resample_float_avx (c, (float*)dst->ch[i], (const float*)src->ch[i], consumed, src_size, dst_size, i+1==dst->ch_count);\n #endif", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int multiple_resample(ResampleContext *c, AudioData *dst, int dst_size, AudioData *src, int src_size, int *consumed){\n int i, ret= -1;\n int av_unused mm_flags = av_get_cpu_flags();\n int need_emms= 0;\n if (c->compensation_distance)\n dst_size = FFMIN(dst_size, c->compensation_distance);\n for(i=0; ich_count; i++){\n#if HAVE_MMXEXT_INLINE\n#if HAVE_SSE2_INLINE\n if(c->format == AV_SAMPLE_FMT_S16P && (mm_flags&AV_CPU_FLAG_SSE2)) ret= swri_resample_int16_sse2 (c, (int16_t*)dst->ch[i], (const int16_t*)src->ch[i], consumed, src_size, dst_size, i+1==dst->ch_count);\n else\n#endif\n if(c->format == AV_SAMPLE_FMT_S16P && (mm_flags&AV_CPU_FLAG_MMX2 )){\n ret= swri_resample_int16_mmx2 (c, (int16_t*)dst->ch[i], (const int16_t*)src->ch[i], consumed, src_size, dst_size, i+1==dst->ch_count);\n need_emms= 1;\n } else\n#endif\n if(c->format == AV_SAMPLE_FMT_S16P) ret= swri_resample_int16(c, (int16_t*)dst->ch[i], (const int16_t*)src->ch[i], consumed, src_size, dst_size, i+1==dst->ch_count);\n else if(c->format == AV_SAMPLE_FMT_S32P) ret= swri_resample_int32(c, (int32_t*)dst->ch[i], (const int32_t*)src->ch[i], consumed, src_size, dst_size, i+1==dst->ch_count);\n#if HAVE_AVX_INLINE\n else if(c->format == AV_SAMPLE_FMT_FLTP && (mm_flags&AV_CPU_FLAG_AVX))\n ret= swri_resample_float_avx (c, (float*)dst->ch[i], (const float*)src->ch[i], consumed, src_size, dst_size, i+1==dst->ch_count);\n#endif\n#if HAVE_SSE_INLINE\n else if(c->format == AV_SAMPLE_FMT_FLTP && (mm_flags&AV_CPU_FLAG_SSE))\n ret= swri_resample_float_sse (c, (float*)dst->ch[i], (const float*)src->ch[i], consumed, src_size, dst_size, i+1==dst->ch_count);\n#endif\n else if(c->format == AV_SAMPLE_FMT_FLTP) ret= swri_resample_float(c, (float *)dst->ch[i], (const float *)src->ch[i], consumed, src_size, dst_size, i+1==dst->ch_count);\n#if HAVE_SSE2_INLINE\n else if(c->format == AV_SAMPLE_FMT_DBLP && (mm_flags&AV_CPU_FLAG_SSE2))\n ret= swri_resample_double_sse2(c,(double *)dst->ch[i], (const double *)src->ch[i], consumed, src_size, dst_size, i+1==dst->ch_count);\n#endif\n else if(c->format == AV_SAMPLE_FMT_DBLP) ret= swri_resample_double(c,(double *)dst->ch[i], (const double *)src->ch[i], consumed, src_size, dst_size, i+1==dst->ch_count);\n if(need_emms)\n emms_c();\n return ret;"}} {"sample_id": "71407786054cad26de7ef66718b2a57a4bcb49b5_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n bool virtio_scsi_handle_event_vq(VirtIOSCSI *s, VirtQueue *vq)\n+\n {\n \n+ virtio_scsi_acquire(s);\n \n if (s->events_dropped) {\n+\n virtio_scsi_push_event(s, NULL, VIRTIO_SCSI_T_NO_EVENT, 0);\n \n virtio_scsi_release(s);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "bool virtio_scsi_handle_event_vq(VirtIOSCSI *s, VirtQueue *vq)\n\n{\n\n virtio_scsi_acquire(s);\n\n if (s->events_dropped) {\n\n virtio_scsi_push_event(s, NULL, VIRTIO_SCSI_T_NO_EVENT, 0);\n\n virtio_scsi_release(s);\n\n return true;\n\n }\n\n virtio_scsi_release(s);\n\n return false;\n\n}\n"}} {"sample_id": "6acbe4c6f18e7de00481ff30574262b58526de45_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n \n \n k->init = virtio_serial_init_pci;\n+\n+ k->exit = virtio_serial_exit_pci;\n+\n+ k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;\n+\n k->device_id = PCI_DEVICE_ID_VIRTIO_CONSOLE;\n \n k->revision = VIRTIO_PCI_ABI_VERSION;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_serial_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);\n\n\n\n k->init = virtio_serial_init_pci;\n\n k->exit = virtio_serial_exit_pci;\n\n k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;\n\n k->device_id = PCI_DEVICE_ID_VIRTIO_CONSOLE;\n\n k->revision = VIRTIO_PCI_ABI_VERSION;\n\n k->class_id = PCI_CLASS_COMMUNICATION_OTHER;\n\n dc->alias = \"virtio-serial\";\n\n dc->reset = virtio_pci_reset;\n\n dc->props = virtio_serial_properties;\n\n}\n"}} {"sample_id": "59c9f437c59a4bf0594ed300d28fb24c645963a5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ bool progress = false;\n \n AioHandler *node;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static bool run_poll_handlers_once(AioContext *ctx)\n\n{\n\n bool progress = false;\n\n AioHandler *node;\n\n\n\n QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) {\n\n if (!node->deleted && node->io_poll &&\n\n node->io_poll(node->opaque)) {\n\n progress = true;\n\n }\n\n\n\n /* Caller handles freeing deleted nodes. Don't do it here. */\n\n }\n\n\n\n return progress;\n\n}\n"}} {"sample_id": "a15fcc3cf69ee3d408f60d6cc316488d2b0249b4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n void visit_start_alternate(Visitor *v, const char *name,\n \n GenericAlternate **obj, size_t size,\n+\n bool promote_int, Error **errp)\n \n {\n+\n Error *err = NULL;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void visit_start_alternate(Visitor *v, const char *name,\n\n GenericAlternate **obj, size_t size,\n\n bool promote_int, Error **errp)\n\n{\n\n Error *err = NULL;\n\n\n\n assert(obj && size >= sizeof(GenericAlternate));\n\n assert(v->type != VISITOR_OUTPUT || *obj);\n\n if (v->start_alternate) {\n\n v->start_alternate(v, name, obj, size, promote_int, &err);\n\n }\n\n if (v->type == VISITOR_INPUT) {\n\n assert(v->start_alternate && !err != !*obj);\n\n }\n\n error_propagate(errp, err);\n\n}\n"}} {"sample_id": "4cad3867b6df2c0826ae508a9fe15dd0b9d8936a_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+int fw_cfg_add_bytes(FWCfgState *s, uint16_t key, uint8_t *data, uint32_t len)\n \n {\n+\n int arch = !!(key & FW_CFG_ARCH_LOCAL);\n \n+\n \n key &= FW_CFG_ENTRY_MASK;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int fw_cfg_add_bytes(FWCfgState *s, uint16_t key, uint8_t *data, uint32_t len)\n\n{\n\n int arch = !!(key & FW_CFG_ARCH_LOCAL);\n\n\n\n key &= FW_CFG_ENTRY_MASK;\n\n\n\n if (key >= FW_CFG_MAX_ENTRY)\n\n return 0;\n\n\n\n s->entries[arch][key].data = data;\n\n s->entries[arch][key].len = len;\n\n\n\n return 1;\n\n}\n"}} {"sample_id": "ad0ebb91cd8b5fdc4a583b03645677771f420a46_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,10 +2,10 @@\n \n target_ulong alignment)\n \n+{\n \n if ((VLAN_BD_ADDR(bd) % alignment)\n+\n || (VLAN_BD_LEN(bd) % alignment)) {\n \n return -1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int check_bd(VIOsPAPRVLANDevice *dev, vlan_bd_t bd,\n\n target_ulong alignment)\n\n{\n\n if ((VLAN_BD_ADDR(bd) % alignment)\n\n || (VLAN_BD_LEN(bd) % alignment)) {\n\n return -1;\n\n }\n\n\n\n if (spapr_vio_check_tces(&dev->sdev, VLAN_BD_ADDR(bd),\n\n VLAN_BD_LEN(bd), SPAPR_TCE_RW) != 0) {\n\n return -1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "1db6947dafa7f33a309130ccbf461748adac6da0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,9 +11,9 @@\n \t}\n \n \n+\n+\tbs = bdrv_new(\"hda\");\n+\n \tif (!bs)\n \n \t\treturn 1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int openfile(char *name, int flags, int growable)\n\n{\n\n\tif (bs) {\n\n\t\tfprintf(stderr, \"file open already, try 'help close'\\n\");\n\n\t\treturn 1;\n\n\t}\n\n\n\n\tbs = bdrv_new(\"hda\");\n\n\tif (!bs)\n\n\t\treturn 1;\n\n\n\n\tif (bdrv_open(bs, name, flags) == -1) {\n\n\t\tfprintf(stderr, \"%s: can't open device %s\\n\", progname, name);\n\n\t\tbs = NULL;\n\n\t\treturn 1;\n\n\t}\n\n\n\n\n\n\tif (growable) {\n\n\t\tif (!bs->drv || !bs->drv->protocol_name) {\n\n\t\t\tfprintf(stderr,\n\n\t\t\t\t\"%s: only protocols can be opened growable\\n\",\n\n\t\t\t\tprogname);\n\n\t\t\treturn 1;\n\n\t\t}\n\n\t\tbs->growable = 1;\n\n\t}\n\n\n\n\treturn 0;\n\n}\n"}} {"sample_id": "563890c7c7e977842e2a35afe7a24d06d2103242_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n+static void socket_sendf(int fd, const char *fmt, va_list ap)\n+\n+{\n+\n+ gchar *str;\n \n size_t size, offset;\n \n+\n \n str = g_strdup_vprintf(fmt, ap);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void socket_sendf(int fd, const char *fmt, va_list ap)\n\n{\n\n gchar *str;\n\n size_t size, offset;\n\n\n\n str = g_strdup_vprintf(fmt, ap);\n\n size = strlen(str);\n\n\n\n offset = 0;\n\n while (offset < size) {\n\n ssize_t len;\n\n\n\n len = write(fd, str + offset, size - offset);\n\n if (len == -1 && errno == EINTR) {\n\n continue;\n\n }\n\n\n\n g_assert_no_errno(len);\n\n g_assert_cmpint(len, >, 0);\n\n\n\n offset += len;\n\n }\n\n}\n"}} {"sample_id": "8194f35a0c71a3bf169459bf715bea53b7bbc904", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n void helper_done(void)\n+\n+{\n+\n+ env->pc = env->tsptr->tpc;\n+\n+ env->npc = env->tsptr->tnpc + 4;\n \n+ PUT_CCR(env, env->tsptr->tstate >> 32);\n \n env->asi = (env->tsptr->tstate >> 24) & 0xff;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void helper_done(void)\n\n{\n\n env->pc = env->tsptr->tpc;\n\n env->npc = env->tsptr->tnpc + 4;\n\n PUT_CCR(env, env->tsptr->tstate >> 32);\n\n env->asi = (env->tsptr->tstate >> 24) & 0xff;\n\n change_pstate((env->tsptr->tstate >> 8) & 0xf3f);\n\n PUT_CWP64(env, env->tsptr->tstate & 0xff);\n\n env->tl--;\n\n env->tsptr = &env->ts[env->tl & MAXTL_MASK];\n\n}\n"}} {"sample_id": "a4435f9235eefac8a25f1cda471486e2c37b21b5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n {\n \n int i, j;\n+\n struct Track *track = tracks->tracks[main];\n \n for (i = 0; i < track->chunks; i++) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void print_track_chunks(FILE *out, struct Tracks *tracks, int main,\n\n const char *type)\n\n{\n\n int i, j;\n\n struct Track *track = tracks->tracks[main];\n\n for (i = 0; i < track->chunks; i++) {\n\n for (j = main + 1; j < tracks->nb_tracks; j++) {\n\n if (tracks->tracks[j]->is_audio == track->is_audio &&\n\n track->offsets[i].duration != tracks->tracks[j]->offsets[i].duration)\n\n fprintf(stderr, \"Mismatched duration of %s chunk %d in %s and %s\\n\",\n\n type, i, track->name, tracks->tracks[j]->name);\n\n }\n\n fprintf(out, \"\\t\\t\\n\",\n\n i, track->offsets[i].duration);\n\n }\n\n}\n"}} {"sample_id": "976620ac4018db142d82cd42bb7774f40290ce7e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n uint16List **list, Error **errp)\n \n {\n+\n StringOutputVisitor *ov;\n \n StringInputVisitor *iv;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void object_property_get_uint16List(Object *obj, const char *name,\n\n uint16List **list, Error **errp)\n\n{\n\n StringOutputVisitor *ov;\n\n StringInputVisitor *iv;\n\n\n\n ov = string_output_visitor_new(false);\n\n object_property_get(obj, string_output_get_visitor(ov),\n\n name, errp);\n\n iv = string_input_visitor_new(string_output_get_string(ov));\n\n visit_type_uint16List(string_input_get_visitor(iv),\n\n list, NULL, errp);\n\n string_output_visitor_cleanup(ov);\n\n string_input_visitor_cleanup(iv);\n\n}\n"}} {"sample_id": "b93f995081cc32e56071fef179161d2907d0491e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -57,11 +57,11 @@\n if (ret < 0) {\n goto fail;\n g_free(s->l1_table);\n+ old_l1_table_offset = s->l1_table_offset;\n+ s->l1_table_offset = new_l1_table_offset;\n+ s->l1_table = new_l1_table;\n+ old_l1_size = s->l1_size;\n+ s->l1_size = new_l1_size;\n qcow2_free_clusters(bs, old_l1_table_offset, old_l1_size * sizeof(uint64_t),\n QCOW2_DISCARD_OTHER);\n return 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,\n bool exact_size)\n{\n BDRVQcowState *s = bs->opaque;\n int new_l1_size2, ret, i;\n uint64_t *new_l1_table;\n int64_t old_l1_table_offset, old_l1_size;\n int64_t new_l1_table_offset, new_l1_size;\n uint8_t data[12];\n if (min_size <= s->l1_size)\n return 0;\n if (exact_size) {\n new_l1_size = min_size;\n } else {\n /* Bump size up to reduce the number of times we have to grow */\n new_l1_size = s->l1_size;\n if (new_l1_size == 0) {\n new_l1_size = 1;\n while (min_size > new_l1_size) {\n new_l1_size = (new_l1_size * 3 + 1) / 2;\n if (new_l1_size > INT_MAX / sizeof(uint64_t)) {\n#ifdef DEBUG_ALLOC2\n fprintf(stderr, \"grow l1_table from %d to %\" PRId64 \"\\n\",\n s->l1_size, new_l1_size);\n#endif\n new_l1_size2 = sizeof(uint64_t) * new_l1_size;\n new_l1_table = g_malloc0(align_offset(new_l1_size2, 512));\n memcpy(new_l1_table, s->l1_table, s->l1_size * sizeof(uint64_t));\n /* write new table (align to cluster) */\n BLKDBG_EVENT(bs->file, BLKDBG_L1_GROW_ALLOC_TABLE);\n new_l1_table_offset = qcow2_alloc_clusters(bs, new_l1_size2);\n if (new_l1_table_offset < 0) {\n g_free(new_l1_table);\n return new_l1_table_offset;\n ret = qcow2_cache_flush(bs, s->refcount_block_cache);\n if (ret < 0) {\n goto fail;\n /* the L1 position has not yet been updated, so these clusters must\n * indeed be completely free */\n ret = qcow2_pre_write_overlap_check(bs, 0, new_l1_table_offset,\n new_l1_size2);\n if (ret < 0) {\n goto fail;\n BLKDBG_EVENT(bs->file, BLKDBG_L1_GROW_WRITE_TABLE);\n for(i = 0; i < s->l1_size; i++)\n new_l1_table[i] = cpu_to_be64(new_l1_table[i]);\n ret = bdrv_pwrite_sync(bs->file, new_l1_table_offset, new_l1_table, new_l1_size2);\n if (ret < 0)\n goto fail;\n for(i = 0; i < s->l1_size; i++)\n new_l1_table[i] = be64_to_cpu(new_l1_table[i]);\n /* set new table */\n BLKDBG_EVENT(bs->file, BLKDBG_L1_GROW_ACTIVATE_TABLE);\n cpu_to_be32w((uint32_t*)data, new_l1_size);\n stq_be_p(data + 4, new_l1_table_offset);\n ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, l1_size), data,sizeof(data));\n if (ret < 0) {\n goto fail;\n g_free(s->l1_table);\n old_l1_table_offset = s->l1_table_offset;\n s->l1_table_offset = new_l1_table_offset;\n s->l1_table = new_l1_table;\n old_l1_size = s->l1_size;\n s->l1_size = new_l1_size;\n qcow2_free_clusters(bs, old_l1_table_offset, old_l1_size * sizeof(uint64_t),\n QCOW2_DISCARD_OTHER);\n return 0;\n fail:\n g_free(new_l1_table);\n qcow2_free_clusters(bs, new_l1_table_offset, new_l1_size2,\n QCOW2_DISCARD_OTHER);\n return ret;"}} {"sample_id": "5b8009f4c80d8fd96523c8c163441ad4011ad472", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static inline void range_dec_normalize(APEContext *ctx)\n \n {\n+\n+ while (ctx->rc.range <= BOTTOM_VALUE) {\n \n ctx->rc.buffer <<= 8;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void range_dec_normalize(APEContext *ctx)\n\n{\n\n while (ctx->rc.range <= BOTTOM_VALUE) {\n\n ctx->rc.buffer <<= 8;\n\n if(ctx->ptr < ctx->data_end)\n\n ctx->rc.buffer += *ctx->ptr;\n\n ctx->ptr++;\n\n ctx->rc.low = (ctx->rc.low << 8) | ((ctx->rc.buffer >> 1) & 0xFF);\n\n ctx->rc.range <<= 8;\n\n }\n\n}\n"}} {"sample_id": "a083a89d7277f3268a251ce635d9aae5559242bd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n+void qemu_del_vlan_client(VLANClientState *vc)\n \n {\n \n+ if (vc->vlan) {\n+\n QTAILQ_REMOVE(&vc->vlan->clients, vc, next);\n \n+ } else {\n+\n if (vc->send_queue) {\n \n qemu_del_net_queue(vc->send_queue);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void qemu_del_vlan_client(VLANClientState *vc)\n\n{\n\n if (vc->vlan) {\n\n QTAILQ_REMOVE(&vc->vlan->clients, vc, next);\n\n } else {\n\n if (vc->send_queue) {\n\n qemu_del_net_queue(vc->send_queue);\n\n }\n\n QTAILQ_REMOVE(&non_vlan_clients, vc, next);\n\n if (vc->peer) {\n\n vc->peer->peer = NULL;\n\n }\n\n }\n\n\n\n if (vc->info->cleanup) {\n\n vc->info->cleanup(vc);\n\n }\n\n\n\n qemu_free(vc->name);\n\n qemu_free(vc->model);\n\n qemu_free(vc);\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_26", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ VirtIOBlockReq *req = opaque;\n+\n+\n+\n+ trace_virtio_blk_rw_complete(req, ret);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_blk_rw_complete(void *opaque, int ret)\n\n{\n\n VirtIOBlockReq *req = opaque;\n\n\n\n trace_virtio_blk_rw_complete(req, ret);\n\n\n\n if (ret) {\n\n int p = virtio_ldl_p(VIRTIO_DEVICE(req->dev), &req->out.type);\n\n bool is_read = !(p & VIRTIO_BLK_T_OUT);\n\n if (virtio_blk_handle_rw_error(req, -ret, is_read))\n\n return;\n\n }\n\n\n\n virtio_blk_req_complete(req, VIRTIO_BLK_S_OK);\n\n block_acct_done(bdrv_get_stats(req->dev->bs), &req->acct);\n\n virtio_blk_free_request(req);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_173", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void omap_badwidth_write16(void *opaque, target_phys_addr_t addr,\n+\n+ uint32_t value)\n+\n {\n \n uint16_t val16 = value;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void omap_badwidth_write16(void *opaque, target_phys_addr_t addr,\n\n uint32_t value)\n\n{\n\n uint16_t val16 = value;\n\n\n\n OMAP_16B_REG(addr);\n\n cpu_physical_memory_write(addr, (void *) &val16, 2);\n\n}\n"}} {"sample_id": "220b24c7c97dc033ceab1510549f66d0e7b52ef1_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+av_cold void ff_schro_queue_init(FFSchroQueue *queue)\n+\n+{\n \n queue->p_head = queue->p_tail = NULL;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "av_cold void ff_schro_queue_init(FFSchroQueue *queue)\n\n{\n\n queue->p_head = queue->p_tail = NULL;\n\n queue->size = 0;\n\n}\n"}} {"sample_id": "06bf6d3bc04979bd39ecdc7311d0daf8aee7e10f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,1 +1,1 @@\n+static void null_draw_slice(AVFilterLink *inlink, int y, int h, int slice_dir) { }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void null_draw_slice(AVFilterLink *inlink, int y, int h, int slice_dir) { }\n"}} {"sample_id": "94e7340b5db8bce7866e44e700ffa8fd26585c7e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static int nbd_co_send_reply(NBDRequest *req, struct nbd_reply *reply,\n \n int len)\n+\n {\n \n NBDClient *client = req->client;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int nbd_co_send_reply(NBDRequest *req, struct nbd_reply *reply,\n\n int len)\n\n{\n\n NBDClient *client = req->client;\n\n int csock = client->sock;\n\n int rc, ret;\n\n\n\n qemu_co_mutex_lock(&client->send_lock);\n\n qemu_set_fd_handler2(csock, nbd_can_read, nbd_read,\n\n nbd_restart_write, client);\n\n client->send_coroutine = qemu_coroutine_self();\n\n\n\n if (!len) {\n\n rc = nbd_send_reply(csock, reply);\n\n if (rc == -1) {\n\n rc = -errno;\n\n }\n\n } else {\n\n socket_set_cork(csock, 1);\n\n rc = nbd_send_reply(csock, reply);\n\n if (rc != -1) {\n\n ret = qemu_co_send(csock, req->data, len);\n\n if (ret != len) {\n\n errno = EIO;\n\n rc = -1;\n\n }\n\n }\n\n if (rc == -1) {\n\n rc = -errno;\n\n }\n\n socket_set_cork(csock, 0);\n\n }\n\n\n\n client->send_coroutine = NULL;\n\n qemu_set_fd_handler2(csock, nbd_can_read, nbd_read, NULL, client);\n\n qemu_co_mutex_unlock(&client->send_lock);\n\n return rc;\n\n}\n"}} {"sample_id": "5a2ad7ede33b5d63c1f1b1313a218da62e1c0d48", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n int frame_size = 1 << (venc->log2_blocksize[1] - 1);\n \n int subframes = frame_size / sf_size;\n+\n+\n+\n+ for (int sf = 0; sf < subframes; sf++) {\n+\n cur = ff_bufqueue_get(&venc->bufqueue);\n \n *samples += cur->nb_samples;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void move_audio(vorbis_enc_context *venc, float *audio, int *samples, int sf_size)\n\n{\n\n AVFrame *cur = NULL;\n\n int frame_size = 1 << (venc->log2_blocksize[1] - 1);\n\n int subframes = frame_size / sf_size;\n\n\n\n for (int sf = 0; sf < subframes; sf++) {\n\n cur = ff_bufqueue_get(&venc->bufqueue);\n\n *samples += cur->nb_samples;\n\n\n\n for (int ch = 0; ch < venc->channels; ch++) {\n\n const float *input = (float *) cur->extended_data[ch];\n\n const size_t len = cur->nb_samples * sizeof(float);\n\n memcpy(audio + ch*frame_size + sf*sf_size, input, len);\n\n }\n\n av_frame_free(&cur);\n\n }\n\n}\n"}} {"sample_id": "20a579de8484096d18e65751ebe63fee31551f04", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n uint64_t hbitmap_serialization_granularity(const HBitmap *hb)\n+\n {\n \n /* Must hold true so that the shift below is defined", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "uint64_t hbitmap_serialization_granularity(const HBitmap *hb)\n\n{\n\n /* Must hold true so that the shift below is defined\n\n * (ld(64) == 6, i.e. 1 << 6 == 64) */\n\n assert(hb->granularity < 64 - 6);\n\n\n\n /* Require at least 64 bit granularity to be safe on both 64 bit and 32 bit\n\n * hosts. */\n\n return UINT64_C(64) << hb->granularity;\n\n}\n"}} {"sample_id": "55fa898969d10e2d47bba0613175bf57a86c5a41", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,8 +5,8 @@\n int compno, ret;\n if ((ret = get_qcx(s, n, &tmp)) < 0)\n return ret;\n+ for (compno = 0; compno < s->ncomponents; compno++)\n+ if (!(properties[compno] & HAD_QCC))\n+ memcpy(q + compno, &tmp, sizeof(tmp));\n return 0;\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int get_qcd(Jpeg2000DecoderContext *s, int n, Jpeg2000QuantStyle *q,\n uint8_t *properties)\n{\n Jpeg2000QuantStyle tmp;\n int compno, ret;\n if ((ret = get_qcx(s, n, &tmp)) < 0)\n return ret;\n for (compno = 0; compno < s->ncomponents; compno++)\n if (!(properties[compno] & HAD_QCC))\n memcpy(q + compno, &tmp, sizeof(tmp));\n return 0;\n}"}} {"sample_id": "7372c2b926200db295412efbb53f93773b7f1754_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,12 +3,12 @@\n {\n \n int index = IS_USER(s);\n+\n s->is_mem = 1;\n \n switch(opsize) {\n \n+ case OS_BYTE:\n \n tcg_gen_qemu_st8(val, addr, index);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static inline void gen_store(DisasContext *s, int opsize, TCGv addr, TCGv val)\n\n{\n\n int index = IS_USER(s);\n\n s->is_mem = 1;\n\n switch(opsize) {\n\n case OS_BYTE:\n\n tcg_gen_qemu_st8(val, addr, index);\n\n break;\n\n case OS_WORD:\n\n tcg_gen_qemu_st16(val, addr, index);\n\n break;\n\n case OS_LONG:\n\n case OS_SINGLE:\n\n tcg_gen_qemu_st32(val, addr, index);\n\n break;\n\n default:\n\n qemu_assert(0, \"bad store size\");\n\n }\n\n gen_throws_exception = gen_last_qop;\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_69", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n VirtIOBlock *s = VIRTIO_BLK(dev);\n \n \n+\n+ remove_migration_state_change_notifier(&s->migration_state_notifier);\n+\n+ virtio_blk_data_plane_destroy(s->dataplane);\n+\n s->dataplane = NULL;\n \n qemu_del_vm_change_state_handler(s->change);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_blk_device_unrealize(DeviceState *dev, Error **errp)\n\n{\n\n VirtIODevice *vdev = VIRTIO_DEVICE(dev);\n\n VirtIOBlock *s = VIRTIO_BLK(dev);\n\n\n\n remove_migration_state_change_notifier(&s->migration_state_notifier);\n\n virtio_blk_data_plane_destroy(s->dataplane);\n\n s->dataplane = NULL;\n\n qemu_del_vm_change_state_handler(s->change);\n\n unregister_savevm(dev, \"virtio-blk\", s);\n\n blockdev_mark_auto_del(s->bs);\n\n virtio_cleanup(vdev);\n\n}\n"}} {"sample_id": "f38b5b7fc4e27724afc72b91efa2bc82f84bb25e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n dev_st = get_boot_device(0);\n if (dev_st) {\n VirtioCcwDevice *virtio_ccw_dev = (VirtioCcwDevice *)\n+ object_dynamic_cast(OBJECT(qdev_get_parent_bus(dev_st)->parent),\n+ TYPE_VIRTIO_CCW_DEVICE);\n+ SCSIDevice *sd = (SCSIDevice *) object_dynamic_cast(OBJECT(dev_st),\n+ TYPE_SCSI_DEVICE);\n+ if (virtio_ccw_dev) {\n CcwDevice *ccw_dev = CCW_DEVICE(virtio_ccw_dev);\n ipl->iplb.len = cpu_to_be32(S390_IPLB_MIN_CCW_LEN);\n ipl->iplb.blk0_len =", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static bool s390_gen_initial_iplb(S390IPLState *ipl)\n{\n DeviceState *dev_st;\n dev_st = get_boot_device(0);\n if (dev_st) {\n VirtioCcwDevice *virtio_ccw_dev = (VirtioCcwDevice *)\n object_dynamic_cast(OBJECT(qdev_get_parent_bus(dev_st)->parent),\n TYPE_VIRTIO_CCW_DEVICE);\n SCSIDevice *sd = (SCSIDevice *) object_dynamic_cast(OBJECT(dev_st),\n TYPE_SCSI_DEVICE);\n if (virtio_ccw_dev) {\n CcwDevice *ccw_dev = CCW_DEVICE(virtio_ccw_dev);\n ipl->iplb.len = cpu_to_be32(S390_IPLB_MIN_CCW_LEN);\n ipl->iplb.blk0_len =\n cpu_to_be32(S390_IPLB_MIN_CCW_LEN - S390_IPLB_HEADER_LEN);\n ipl->iplb.pbt = S390_IPL_TYPE_CCW;\n ipl->iplb.ccw.devno = cpu_to_be16(ccw_dev->sch->devno);\n ipl->iplb.ccw.ssid = ccw_dev->sch->ssid & 3;\n return true;\n } else if (sd) {\n SCSIBus *bus = scsi_bus_from_device(sd);\n VirtIOSCSI *vdev = container_of(bus, VirtIOSCSI, bus);\n VirtIOSCSICcw *scsi_ccw = container_of(vdev, VirtIOSCSICcw, vdev);\n CcwDevice *ccw_dev = CCW_DEVICE(scsi_ccw);\n ipl->iplb.len = cpu_to_be32(S390_IPLB_MIN_QEMU_SCSI_LEN);\n ipl->iplb.blk0_len =\n cpu_to_be32(S390_IPLB_MIN_QEMU_SCSI_LEN - S390_IPLB_HEADER_LEN);\n ipl->iplb.pbt = S390_IPL_TYPE_QEMU_SCSI;\n ipl->iplb.scsi.lun = cpu_to_be32(sd->lun);\n ipl->iplb.scsi.target = cpu_to_be16(sd->id);\n ipl->iplb.scsi.channel = cpu_to_be16(sd->channel);\n ipl->iplb.scsi.devno = cpu_to_be16(ccw_dev->sch->devno);\n ipl->iplb.scsi.ssid = ccw_dev->sch->ssid & 3;\n return true;\n return false;"}} {"sample_id": "bd88c780e6a17188f7fd676f3a056e5db21500e0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n CPUState *cpu;\n \n TaskState *ts;\n+\n \n \n rcu_register_thread();", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void *clone_func(void *arg)\n\n{\n\n new_thread_info *info = arg;\n\n CPUArchState *env;\n\n CPUState *cpu;\n\n TaskState *ts;\n\n\n\n rcu_register_thread();\n\n env = info->env;\n\n cpu = ENV_GET_CPU(env);\n\n thread_cpu = cpu;\n\n ts = (TaskState *)cpu->opaque;\n\n info->tid = gettid();\n\n cpu->host_tid = info->tid;\n\n task_settid(ts);\n\n if (info->child_tidptr)\n\n put_user_u32(info->tid, info->child_tidptr);\n\n if (info->parent_tidptr)\n\n put_user_u32(info->tid, info->parent_tidptr);\n\n /* Enable signals. */\n\n sigprocmask(SIG_SETMASK, &info->sigmask, NULL);\n\n /* Signal to the parent that we're ready. */\n\n pthread_mutex_lock(&info->mutex);\n\n pthread_cond_broadcast(&info->cond);\n\n pthread_mutex_unlock(&info->mutex);\n\n /* Wait until the parent has finshed initializing the tls state. */\n\n pthread_mutex_lock(&clone_lock);\n\n pthread_mutex_unlock(&clone_lock);\n\n cpu_loop(env);\n\n /* never exits */\n\n return NULL;\n\n}\n"}} {"sample_id": "fb6faea888c1e54059aed7f87be93de623b346ee", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void test_smram_lock(void)\n {\n+ QPCIBus *pcibus;\n+ QPCIDevice *pcidev;\n+ QDict *response;\n+ pcibus = qpci_init_pc(NULL);\n+ g_assert(pcibus != NULL);\n pcidev = qpci_device_find(pcibus, 0);\n g_assert(pcidev != NULL);\n /* check open is settable */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void test_smram_lock(void)\n{\n QPCIBus *pcibus;\n QPCIDevice *pcidev;\n QDict *response;\n pcibus = qpci_init_pc(NULL);\n g_assert(pcibus != NULL);\n pcidev = qpci_device_find(pcibus, 0);\n g_assert(pcidev != NULL);\n /* check open is settable */\n smram_set_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN, false);\n g_assert(smram_test_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN) == false);\n smram_set_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN, true);\n g_assert(smram_test_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN) == true);\n /* lock, check open is cleared & not settable */\n smram_set_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_LCK, true);\n g_assert(smram_test_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN) == false);\n smram_set_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN, true);\n g_assert(smram_test_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN) == false);\n /* reset */\n response = qmp(\"{'execute': 'system_reset', 'arguments': {} }\");\n g_assert(response);\n g_assert(!qdict_haskey(response, \"error\"));\n QDECREF(response);\n /* check open is settable again */\n smram_set_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN, false);\n g_assert(smram_test_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN) == false);\n smram_set_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN, true);\n g_assert(smram_test_bit(pcidev, MCH_HOST_BRIDGE_SMRAM_D_OPEN) == true);\n}"}} {"sample_id": "a516e72d60803cac3b81b3330db55983b080d8da", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n const char *path(const char *name)\n+\n {\n \n /* Only do absolute paths: quick and dirty, but should mostly be OK.", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "const char *path(const char *name)\n\n{\n\n /* Only do absolute paths: quick and dirty, but should mostly be OK.\n\n Could do relative by tracking cwd. */\n\n if (!base || name[0] != '/')\n\n\treturn name;\n\n\n\n return follow_path(base, name) ?: name;\n\n}\n"}} {"sample_id": "b3db211f3c80bb996a704d665fe275619f728bd4_40", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ visit_complete(data->ov, &data->obj);\n+\n g_assert(data->obj);\n \n return data->obj;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static QObject *visitor_get(TestOutputVisitorData *data)\n\n{\n\n visit_complete(data->ov, &data->obj);\n\n g_assert(data->obj);\n\n return data->obj;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_119", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n int64_t qmp_query_migrate_cache_size(Error **errp)\n+\n {\n \n return migrate_xbzrle_cache_size();", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-89", "target_file": "source.c", "files": {"source.c": "int64_t qmp_query_migrate_cache_size(Error **errp)\n\n{\n\n return migrate_xbzrle_cache_size();\n\n}\n"}} {"sample_id": "1e9b65bb1bad51735cab6c861c29b592dccabf0e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+void error_setg_file_open(Error **errp, int os_errno, const char *filename)\n+\n {\n \n error_setg_errno(errp, os_errno, \"Could not open '%s'\", filename);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void error_setg_file_open(Error **errp, int os_errno, const char *filename)\n\n{\n\n error_setg_errno(errp, os_errno, \"Could not open '%s'\", filename);\n\n}\n"}} {"sample_id": "4a1418e07bdcfaa3177739e04707ecaec75d89e1_28", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n if (r1->count < r2->count)\n \n+ return 1;\n+\n+ else if (r1->count == r2->count)\n+\n+ return 0;\n \n else\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pc_rec_cmp(const void *p1, const void *p2)\n\n{\n\n PCRecord *r1 = *(PCRecord **)p1;\n\n PCRecord *r2 = *(PCRecord **)p2;\n\n if (r1->count < r2->count)\n\n return 1;\n\n else if (r1->count == r2->count)\n\n return 0;\n\n else\n\n return -1;\n\n}\n"}} {"sample_id": "c1f2448998062f25df395cd239169400a4c41ed6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n pfd.revents = 0;\n \n+ g_poll(&pfd, 1, 0);\n+\n+ if (pfd.revents & G_IO_HUP) {\n+\n+ pty_chr_state(chr, 0);\n \n } else {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pty_chr_update_read_handler_locked(CharDriverState *chr)\n\n{\n\n PtyCharDriver *s = chr->opaque;\n\n GPollFD pfd;\n\n\n\n pfd.fd = g_io_channel_unix_get_fd(s->fd);\n\n pfd.events = G_IO_OUT;\n\n pfd.revents = 0;\n\n g_poll(&pfd, 1, 0);\n\n if (pfd.revents & G_IO_HUP) {\n\n pty_chr_state(chr, 0);\n\n } else {\n\n pty_chr_state(chr, 1);\n\n }\n\n}\n"}} {"sample_id": "210b580b106fa798149e28aa13c66b325a43204e_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n return;\n \n }\n+\n+\n+\n+ rtas_st(rets, 0, 0); /* Success */\n+\n rtas_st(rets, 1, ics->irqs[nr - ics->offset].server);\n \n rtas_st(rets, 2, ics->irqs[nr - ics->offset].priority);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void rtas_get_xive(sPAPREnvironment *spapr, uint32_t token,\n\n uint32_t nargs, target_ulong args,\n\n uint32_t nret, target_ulong rets)\n\n{\n\n struct ics_state *ics = spapr->icp->ics;\n\n uint32_t nr;\n\n\n\n if ((nargs != 1) || (nret != 3)) {\n\n rtas_st(rets, 0, -3);\n\n return;\n\n }\n\n\n\n nr = rtas_ld(args, 0);\n\n\n\n if (!ics_valid_irq(ics, nr)) {\n\n rtas_st(rets, 0, -3);\n\n return;\n\n }\n\n\n\n rtas_st(rets, 0, 0); /* Success */\n\n rtas_st(rets, 1, ics->irqs[nr - ics->offset].server);\n\n rtas_st(rets, 2, ics->irqs[nr - ics->offset].priority);\n\n}\n"}} {"sample_id": "758e8e38eb582e3dc87fd55a1d234c25108a7b7f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n return s->ops->lstat(&s->ctx, path->data, stbuf);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int v9fs_do_lstat(V9fsState *s, V9fsString *path, struct stat *stbuf)\n\n{\n\n return s->ops->lstat(&s->ctx, path->data, stbuf);\n\n}\n"}} {"sample_id": "2e2aa31674444b61e79536a90d63a90572e695c8_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n if (state) {\n \n+ trace_mptsas_irq_msi(s);\n+\n+ msi_notify(pci, 0);\n+\n+ }\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void mptsas_update_interrupt(MPTSASState *s)\n\n{\n\n PCIDevice *pci = (PCIDevice *) s;\n\n uint32_t state = s->intr_status & ~(s->intr_mask | MPI_HIS_IOP_DOORBELL_STATUS);\n\n\n\n if (s->msi_in_use && msi_enabled(pci)) {\n\n if (state) {\n\n trace_mptsas_irq_msi(s);\n\n msi_notify(pci, 0);\n\n }\n\n }\n\n\n\n trace_mptsas_irq_intx(s, !!state);\n\n pci_set_irq(pci, !!state);\n\n}\n"}} {"sample_id": "d32fcad366e5f45d33dab2ee4de0e5729439680b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n offset = iov_to_buf(iov, iovcnt, 0, buffer, sizeof(buffer));\n \n \n+\n+ return nc->info->receive(nc, buffer, offset);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ssize_t nc_sendv_compat(NetClientState *nc, const struct iovec *iov,\n\n int iovcnt)\n\n{\n\n uint8_t buffer[4096];\n\n size_t offset;\n\n\n\n offset = iov_to_buf(iov, iovcnt, 0, buffer, sizeof(buffer));\n\n\n\n return nc->info->receive(nc, buffer, offset);\n\n}\n"}} {"sample_id": "89ae337acbe4dba5b2481007aec1277252d2b86c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n .region_add = mem_add,\n \n .region_nop = mem_add,\n+\n+ .priority = 0,\n+\n+ };\n+\n d->as = as;\n \n as->dispatch = d;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void address_space_init_dispatch(AddressSpace *as)\n\n{\n\n AddressSpaceDispatch *d = g_new(AddressSpaceDispatch, 1);\n\n\n\n d->phys_map = (PhysPageEntry) { .ptr = PHYS_MAP_NODE_NIL, .is_leaf = 0 };\n\n d->listener = (MemoryListener) {\n\n .begin = mem_begin,\n\n .region_add = mem_add,\n\n .region_nop = mem_add,\n\n .priority = 0,\n\n };\n\n d->as = as;\n\n as->dispatch = d;\n\n memory_listener_register(&d->listener, as);\n\n}\n"}} {"sample_id": "301a24de52f5baa09beff0958327af2c2a7005dc_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n dnxhd_load_picture(ctx, data);\n encode_coding_unit:\n for (i = 0; i < 3; i++) {\n+ ctx->src[i] = ctx->frame.data[i];\n+ if (ctx->interlaced && ctx->cur_field)\n+ ctx->src[i] += ctx->frame.linesize[i];\n+ }\n+ dnxhd_write_header(avctx, buf);\n if (avctx->mb_decision == FF_MB_DECISION_RD)\n ret = dnxhd_encode_rdo(avctx, ctx);\n else", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int dnxhd_encode_picture(AVCodecContext *avctx, unsigned char *buf, int buf_size, void *data)\n{\n DNXHDEncContext *ctx = avctx->priv_data;\n int first_field = 1;\n int offset, i, ret;\n if (buf_size < ctx->cid_table->frame_size) {\n av_log(avctx, AV_LOG_ERROR, \"output buffer is too small to compress picture\\n\");\n return -1;\n }\n dnxhd_load_picture(ctx, data);\n encode_coding_unit:\n for (i = 0; i < 3; i++) {\n ctx->src[i] = ctx->frame.data[i];\n if (ctx->interlaced && ctx->cur_field)\n ctx->src[i] += ctx->frame.linesize[i];\n }\n dnxhd_write_header(avctx, buf);\n if (avctx->mb_decision == FF_MB_DECISION_RD)\n ret = dnxhd_encode_rdo(avctx, ctx);\n else\n ret = dnxhd_encode_fast(avctx, ctx);\n if (ret < 0) {\n av_log(avctx, AV_LOG_ERROR, \"picture could not fit ratecontrol constraints\\n\");\n return -1;\n }\n dnxhd_setup_threads_slices(ctx, buf);\n offset = 0;\n for (i = 0; i < ctx->m.mb_height; i++) {\n AV_WB32(ctx->msip + i * 4, offset);\n offset += ctx->slice_size[i];\n assert(!(ctx->slice_size[i] & 3));\n }\n avctx->execute(avctx, dnxhd_encode_thread, (void**)&ctx->thread[0], NULL, avctx->thread_count, sizeof(void*));\n AV_WB32(buf + ctx->cid_table->coding_unit_size - 4, 0x600DC0DE); // EOF\n if (ctx->interlaced && first_field) {\n first_field = 0;\n ctx->cur_field ^= 1;\n buf += ctx->cid_table->coding_unit_size;\n buf_size -= ctx->cid_table->coding_unit_size;\n goto encode_coding_unit;\n }\n ctx->frame.quality = ctx->qscale*FF_QP2LAMBDA;\n return ctx->cid_table->frame_size;\n}"}} {"sample_id": "efc8c709c93875dffa4c4181fa9b56fa6d20d4c7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int draw_glyphs(DrawTextContext *dtext, AVFilterBufferRef *picref,\n+\n int width, int height, const uint8_t rgbcolor[4], const uint8_t yuvcolor[4], int x, int y)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int draw_glyphs(DrawTextContext *dtext, AVFilterBufferRef *picref,\n\n int width, int height, const uint8_t rgbcolor[4], const uint8_t yuvcolor[4], int x, int y)\n\n{\n\n char *text = dtext->text;\n\n uint32_t code = 0;\n\n int i;\n\n uint8_t *p;\n\n Glyph *glyph = NULL;\n\n\n\n for (i = 0, p = text; *p; i++) {\n\n Glyph dummy = { 0 };\n\n GET_UTF8(code, *p++, continue;);\n\n\n\n /* skip new line chars, just go to new line */\n\n if (code == '\\n' || code == '\\r' || code == '\\t')\n\n continue;\n\n\n\n dummy.code = code;\n\n glyph = av_tree_find(dtext->glyphs, &dummy, (void *)glyph_cmp, NULL);\n\n\n\n if (glyph->bitmap.pixel_mode != FT_PIXEL_MODE_MONO &&\n\n glyph->bitmap.pixel_mode != FT_PIXEL_MODE_GRAY)\n\n return AVERROR(EINVAL);\n\n\n\n if (dtext->is_packed_rgb) {\n\n draw_glyph_rgb(picref, &glyph->bitmap,\n\n dtext->positions[i].x+x, dtext->positions[i].y+y, width, height,\n\n dtext->pixel_step[0], rgbcolor, dtext->rgba_map);\n\n } else {\n\n draw_glyph_yuv(picref, &glyph->bitmap,\n\n dtext->positions[i].x+x, dtext->positions[i].y+y, width, height,\n\n yuvcolor, dtext->hsub, dtext->vsub);\n\n }\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_39", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n }\n \n+ }\n+\n+ }\n+\n+\n \n mrb->num_writes = 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void virtio_submit_multiwrite(BlockDriverState *bs, MultiReqBuffer *mrb)\n\n{\n\n int i, ret;\n\n\n\n if (!mrb->num_writes) {\n\n return;\n\n }\n\n\n\n ret = bdrv_aio_multiwrite(bs, mrb->blkreq, mrb->num_writes);\n\n if (ret != 0) {\n\n for (i = 0; i < mrb->num_writes; i++) {\n\n if (mrb->blkreq[i].error) {\n\n virtio_blk_rw_complete(mrb->blkreq[i].opaque, -EIO);\n\n }\n\n }\n\n }\n\n\n\n mrb->num_writes = 0;\n\n}\n"}} {"sample_id": "747a0554ea8ad09404c1f5b80239ebd8d71b291e_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static int swf_write_audio(AVFormatContext *s, const uint8_t *buf, int size)\n+\n+{\n+\n+ ByteIOContext *pb = &s->pb;\n+\n \n \n put_swf_tag(s, TAG_STREAMBLOCK | TAG_LONG);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int swf_write_audio(AVFormatContext *s, const uint8_t *buf, int size)\n\n{\n\n ByteIOContext *pb = &s->pb;\n\n\n\n put_swf_tag(s, TAG_STREAMBLOCK | TAG_LONG);\n\n\n\n put_buffer(pb, buf, size);\n\n \n\n put_swf_end_tag(s);\n\n put_flush_packet(&s->pb);\n\n return 0;\n\n}\n"}} {"sample_id": "550830f9351291c585c963204ad9127998b1c1ce_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,10 +2,10 @@\n \n uint8_t *buf, int nb_sectors)\n \n+{\n+\n+ int ret;\n+\n BDRVCowState *s = bs->opaque;\n \n qemu_co_mutex_lock(&s->lock);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static coroutine_fn int cow_co_read(BlockDriverState *bs, int64_t sector_num,\n\n uint8_t *buf, int nb_sectors)\n\n{\n\n int ret;\n\n BDRVCowState *s = bs->opaque;\n\n qemu_co_mutex_lock(&s->lock);\n\n ret = cow_read(bs, sector_num, buf, nb_sectors);\n\n qemu_co_mutex_unlock(&s->lock);\n\n return ret;\n\n}\n"}} {"sample_id": "f5e646a00ac21e500dae4bcceded790a0fbc5246", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n if (!filesize)\n \n goto done;\n+\n+\n+\n+ st = avformat_new_stream(s, NULL);\n+\n if (!st)\n \n goto done;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void get_attachment(AVFormatContext *s, AVIOContext *pb, int length)\n\n{\n\n char mime[1024];\n\n char description[1024];\n\n unsigned int filesize;\n\n AVStream *st;\n\n int64_t pos = avio_tell(pb);\n\n\n\n avio_get_str16le(pb, INT_MAX, mime, sizeof(mime));\n\n if (strcmp(mime, \"image/jpeg\"))\n\n goto done;\n\n\n\n avio_r8(pb);\n\n avio_get_str16le(pb, INT_MAX, description, sizeof(description));\n\n filesize = avio_rl32(pb);\n\n if (!filesize)\n\n goto done;\n\n\n\n st = avformat_new_stream(s, NULL);\n\n if (!st)\n\n goto done;\n\n av_dict_set(&st->metadata, \"title\", description, 0);\n\n st->codec->codec_id = AV_CODEC_ID_MJPEG;\n\n st->codec->codec_type = AVMEDIA_TYPE_ATTACHMENT;\n\n st->codec->extradata = av_mallocz(filesize);\n\n\n if (!st->codec->extradata)\n\n goto done;\n\n st->codec->extradata_size = filesize;\n\n avio_read(pb, st->codec->extradata, filesize);\n\ndone:\n\n avio_seek(pb, pos + length, SEEK_SET);\n\n}"}} {"sample_id": "55274a30522d0f542c1659386f01096b78669455", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,10 +10,10 @@\n \n return 0;\n \n+ if (!vm_running)\n+\n+ return 0;\n+\n return 1;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int cpu_can_run(CPUState *env)\n\n{\n\n if (env->stop)\n\n return 0;\n\n if (env->stopped)\n\n return 0;\n\n if (!vm_running)\n\n return 0;\n\n return 1;\n\n}\n"}} {"sample_id": "9d70c4b7b8a580959cc4f739e7c9a04964d00d46", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void breakpoint_invalidate(CPUArchState *env, target_ulong pc)\n+\n {\n \n tb_invalidate_phys_addr(cpu_get_phys_page_debug(env, pc));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void breakpoint_invalidate(CPUArchState *env, target_ulong pc)\n\n{\n\n tb_invalidate_phys_addr(cpu_get_phys_page_debug(env, pc));\n\n}\n"}} {"sample_id": "ba21f0cca8165c5b284274edd12dc955cf4fb248", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static bool is_iso_bc_entry_compatible(IsoBcSection *s)\n \n {\n+\n return true;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool is_iso_bc_entry_compatible(IsoBcSection *s)\n\n{\n\n return true;\n\n}\n"}} {"sample_id": "a0efbf16604770b9d805bcf210ec29942321134f_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -37,11 +37,11 @@\n g_free(data);\n \n \n+\n+ /* Merge any subsequent list elements that now also overlap */\n+\n+ while (l->next && range_compare(l->data, l->next->data) == 0) {\n+\n GList *new_l;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "GList *range_list_insert(GList *list, Range *data)\n\n{\n\n GList *l;\n\n\n\n /* Range lists require no empty ranges */\n\n assert(data->begin < data->end || (data->begin && !data->end));\n\n\n\n /* Skip all list elements strictly less than data */\n\n for (l = list; l && range_compare(l->data, data) < 0; l = l->next) {\n\n }\n\n\n\n if (!l || range_compare(l->data, data) > 0) {\n\n /* Rest of the list (if any) is strictly greater than @data */\n\n return g_list_insert_before(list, l, data);\n\n }\n\n\n\n /* Current list element overlaps @data, merge the two */\n\n range_extend(l->data, data);\n\n g_free(data);\n\n\n\n /* Merge any subsequent list elements that now also overlap */\n\n while (l->next && range_compare(l->data, l->next->data) == 0) {\n\n GList *new_l;\n\n\n\n range_extend(l->data, l->next->data);\n\n g_free(l->next->data);\n\n new_l = g_list_delete_link(list, l->next);\n\n assert(new_l == list);\n\n }\n\n\n\n return list;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_244", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void bonito_ldma_writel(void *opaque, target_phys_addr_t addr,\n+\n+ uint64_t val, unsigned size)\n+\n {\n \n PCIBonitoState *s = opaque;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bonito_ldma_writel(void *opaque, target_phys_addr_t addr,\n\n uint64_t val, unsigned size)\n\n{\n\n PCIBonitoState *s = opaque;\n\n\n\n ((uint32_t *)(&s->bonldma))[addr/sizeof(uint32_t)] = val & 0xffffffff;\n\n}\n"}} {"sample_id": "9be385980d37e8f4fd33f605f5fb1c3d144170a8_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,10 +12,10 @@\n \n /* Device tree style name device@reg */\n \n+ name = g_strdup_printf(\"%s@%x\", pc->dt_name, dev->reg);\n+\n+\n+\n+ return name;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static char *spapr_vio_get_dev_name(DeviceState *qdev)\n\n{\n\n VIOsPAPRDevice *dev = VIO_SPAPR_DEVICE(qdev);\n\n VIOsPAPRDeviceClass *pc = VIO_SPAPR_DEVICE_GET_CLASS(dev);\n\n char *name;\n\n\n\n /* Device tree style name device@reg */\n\n name = g_strdup_printf(\"%s@%x\", pc->dt_name, dev->reg);\n\n\n\n return name;\n\n}\n"}} {"sample_id": "0ffea3565700c9b3093ead285f729bb319a2163e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n \n \n+ for (i = 0; i < st->nb_side_data; i++) {\n \n sd = &st->side_data[i];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int av_stream_add_side_data(AVStream *st, enum AVPacketSideDataType type,\n\n uint8_t *data, size_t size)\n\n{\n\n AVPacketSideData *sd, *tmp;\n\n int i;\n\n\n\n for (i = 0; i < st->nb_side_data; i++) {\n\n sd = &st->side_data[i];\n\n\n\n if (sd->type == type) {\n\n av_freep(&sd->data);\n\n sd->data = data;\n\n sd->size = size;\n\n return 0;\n\n }\n\n }\n\n\n\n tmp = av_realloc_array(st->side_data, st->nb_side_data + 1, sizeof(*tmp));\n\n if (!tmp) {\n\n return AVERROR(ENOMEM);\n\n }\n\n\n\n st->side_data = tmp;\n\n st->nb_side_data++;\n\n\n\n sd = &st->side_data[st->nb_side_data - 1];\n\n sd->type = type;\n\n sd->data = data;\n\n sd->size = size;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "bd269ebc82fbaa5fe7ce5bc7c1770ac8acecd884_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -47,11 +47,11 @@\n &vd->lwebsock_tag,\n \n &vd->nlwebsock,\n+\n+ errp) < 0) {\n+\n+ return -1;\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int vnc_display_listen(VncDisplay *vd,\n\n SocketAddressLegacy **saddr,\n\n size_t nsaddr,\n\n SocketAddressLegacy **wsaddr,\n\n size_t nwsaddr,\n\n Error **errp)\n\n{\n\n size_t i;\n\n\n\n for (i = 0; i < nsaddr; i++) {\n\n if (vnc_display_listen_addr(vd, saddr[i],\n\n \"vnc-listen\",\n\n &vd->lsock,\n\n &vd->lsock_tag,\n\n &vd->nlsock,\n\n errp) < 0) {\n\n return -1;\n\n }\n\n }\n\n for (i = 0; i < nwsaddr; i++) {\n\n if (vnc_display_listen_addr(vd, wsaddr[i],\n\n \"vnc-ws-listen\",\n\n &vd->lwebsock,\n\n &vd->lwebsock_tag,\n\n &vd->nlwebsock,\n\n errp) < 0) {\n\n return -1;\n\n }\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "0491a2a07a44f6e5e6f34081835e402c07025fd2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,8 +8,8 @@\n \n printf(\"TAG:\");\n \n+ writer_print_string(wctx, tag->key, tag->value);\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void default_show_tags(WriterContext *wctx, AVDictionary *dict)\n\n{\n\n AVDictionaryEntry *tag = NULL;\n\n while ((tag = av_dict_get(dict, \"\", tag, AV_DICT_IGNORE_SUFFIX))) {\n\n printf(\"TAG:\");\n\n writer_print_string(wctx, tag->key, tag->value);\n\n }\n\n}\n"}} {"sample_id": "34e1c27bc3094ffe484d9855e07ad104bddf579f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,12 +4,12 @@\n \n int64_t v;\n \n+ uint32 res;\n \n \n \n v = float32_to_int64_round_to_zero(a STATUS_VAR);\n+\n if (v < 0) {\n \n res = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "uint32 float32_to_uint32_round_to_zero( float32 a STATUS_PARAM )\n\n{\n\n int64_t v;\n\n uint32 res;\n\n\n\n v = float32_to_int64_round_to_zero(a STATUS_VAR);\n\n if (v < 0) {\n\n res = 0;\n\n float_raise( float_flag_invalid STATUS_VAR);\n\n } else if (v > 0xffffffff) {\n\n res = 0xffffffff;\n\n float_raise( float_flag_invalid STATUS_VAR);\n\n } else {\n\n res = v;\n\n }\n\n return res;\n\n}\n"}} {"sample_id": "aba232cfa9b193604ed98f3fa505378d006b1b3b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,7 +15,7 @@\n \n \n st = avformat_new_stream(s, NULL);\n+\n if (!st) {\n \n ret = AVERROR(ENOMEM);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int ff_raw_video_read_header(AVFormatContext *s)\n\n{\n\n AVStream *st;\n\n FFRawVideoDemuxerContext *s1 = s->priv_data;\n\n AVRational framerate;\n\n int ret = 0;\n\n\n\n\n\n st = avformat_new_stream(s, NULL);\n\n if (!st) {\n\n ret = AVERROR(ENOMEM);\n\n goto fail;\n\n }\n\n\n\n st->codec->codec_type = AVMEDIA_TYPE_VIDEO;\n\n st->codec->codec_id = s->iformat->raw_codec_id;\n\n st->need_parsing = AVSTREAM_PARSE_FULL;\n\n\n\n if ((ret = av_parse_video_rate(&framerate, s1->framerate)) < 0) {\n\n av_log(s, AV_LOG_ERROR, \"Could not parse framerate: %s.\\n\", s1->framerate);\n\n goto fail;\n\n }\n\n\n\n st->r_frame_rate = st->avg_frame_rate = framerate;\n\n avpriv_set_pts_info(st, 64, framerate.den, framerate.num);\n\n\n\nfail:\n\n return ret;\n\n}\n"}} {"sample_id": "5858dd1801883309bdd208d72ddb81c4e9fee30c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n return 0;\n \n \n+\n+ (*s->cirrus_rop) (s, dst, src,\n+\n+ s->cirrus_blt_dstpitch, 0,\n+\n s->cirrus_blt_width, s->cirrus_blt_height);\n \n cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int cirrus_bitblt_common_patterncopy(CirrusVGAState * s,\n\n\t\t\t\t\t const uint8_t * src)\n\n{\n\n uint8_t *dst;\n\n\n\n dst = s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask);\n\n\n\n if (blit_is_unsafe(s, false))\n\n return 0;\n\n\n\n (*s->cirrus_rop) (s, dst, src,\n\n s->cirrus_blt_dstpitch, 0,\n\n s->cirrus_blt_width, s->cirrus_blt_height);\n\n cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,\n\n s->cirrus_blt_dstpitch, s->cirrus_blt_width,\n\n s->cirrus_blt_height);\n\n return 1;\n\n}\n"}} {"sample_id": "12f8def0e02232d7c6416ad9b66640f973c531d1_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n int qemu_mutex_trylock(QemuMutex *mutex)\n \n+{\n+\n+ int owned;\n+\n \n \n owned = TryEnterCriticalSection(&mutex->lock);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int qemu_mutex_trylock(QemuMutex *mutex)\n\n{\n\n int owned;\n\n\n\n owned = TryEnterCriticalSection(&mutex->lock);\n\n if (owned) {\n\n assert(mutex->owner == 0);\n\n mutex->owner = GetCurrentThreadId();\n\n }\n\n return !owned;\n\n}\n"}} {"sample_id": "62ef3760d4e400849fc663474227bb4668244455", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n \n \n+ ov = g_new0(sPAPROptionVector, 1);\n+\n+ ov->bitmap = bitmap_new(OV_MAXBITS);\n+\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "sPAPROptionVector *spapr_ovec_new(void)\n\n{\n\n sPAPROptionVector *ov;\n\n\n\n ov = g_new0(sPAPROptionVector, 1);\n\n ov->bitmap = bitmap_new(OV_MAXBITS);\n\n\n\n\n return ov;\n\n}"}} {"sample_id": "b7b5233ad7fdd9985bb6d05b7919f3a20723ff2c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+void g_free(void *ptr)\n+\n+{\n+\n /* FIXME: We should unmark the reserved pages here. However this gets\n \n complicated when one target page spans multiple host pages, so we", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void g_free(void *ptr)\n\n{\n\n /* FIXME: We should unmark the reserved pages here. However this gets\n\n complicated when one target page spans multiple host pages, so we\n\n don't bother. */\n\n size_t *p;\n\n p = (size_t *)((char *)ptr - 16);\n\n munmap(p, *p);\n\n}\n"}} {"sample_id": "d3b12f5dec4b27ebab58fb5797cb67bacced773b_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,8 +14,8 @@\n \n do {\n \n+ len = read(fd, buffer, sizeof(buffer));\n+\n+ } while ((len == -1 && errno == EINTR) || len == sizeof(buffer));\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_event_read(void *opaque)\n\n{\n\n int fd = (intptr_t)opaque;\n\n ssize_t len;\n\n char buffer[512];\n\n\n\n /* Drain the notify pipe. For eventfd, only 8 bytes will be read. */\n\n do {\n\n len = read(fd, buffer, sizeof(buffer));\n\n } while ((len == -1 && errno == EINTR) || len == sizeof(buffer));\n\n}\n"}} {"sample_id": "8d0786ec6d066f892f29da6593e99e73a7dfd014", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n int64_t fmt, fact;\n \n \n+\n+ ffio_wfourcc(pb, \"RIFF\");\n+\n+ avio_wl32(pb, 0); /* file length */\n+\n ffio_wfourcc(pb, \"WAVE\");\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int wav_write_header(AVFormatContext *s)\n\n{\n\n WAVContext *wav = s->priv_data;\n\n AVIOContext *pb = s->pb;\n\n int64_t fmt, fact;\n\n\n\n ffio_wfourcc(pb, \"RIFF\");\n\n avio_wl32(pb, 0); /* file length */\n\n ffio_wfourcc(pb, \"WAVE\");\n\n\n\n /* format header */\n\n fmt = ff_start_tag(pb, \"fmt \");\n\n if (ff_put_wav_header(pb, s->streams[0]->codec) < 0) {\n\n av_log(s, AV_LOG_ERROR, \"%s codec not supported in WAVE format\\n\",\n\n s->streams[0]->codec->codec ? s->streams[0]->codec->codec->name : \"NONE\");\n\n av_free(wav);\n\n return -1;\n\n }\n\n ff_end_tag(pb, fmt);\n\n\n\n if (s->streams[0]->codec->codec_tag != 0x01 /* hence for all other than PCM */\n\n && s->pb->seekable) {\n\n fact = ff_start_tag(pb, \"fact\");\n\n avio_wl32(pb, 0);\n\n ff_end_tag(pb, fact);\n\n }\n\n\n\n av_set_pts_info(s->streams[0], 64, 1, s->streams[0]->codec->sample_rate);\n\n wav->maxpts = wav->last_duration = 0;\n\n wav->minpts = INT64_MAX;\n\n\n\n /* data header */\n\n wav->data = ff_start_tag(pb, \"data\");\n\n\n\n avio_flush(pb);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "baf35cb90204d75404892aa4e52628ae7a00669b_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void qemu_aio_wait_end(void)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void qemu_aio_wait_end(void)\n\n{\n\n}\n"}} {"sample_id": "5ee5993001cf32addb86a92e2ae8cb090fbc1462", "diff": "--- a/source.c\n+++ b/source.c\n@@ -39,11 +39,11 @@\n \n \n #if !defined(CONFIG_USER_ONLY)\n+\n+ if (cpu_interrupts_enabled(env)) {\n+\n+\n+ cpu_check_irqs(env);\n \n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void helper_retry(CPUSPARCState *env)\n\n{\n\n trap_state *tsptr = cpu_tsptr(env);\n\n\n\n env->pc = tsptr->tpc;\n\n env->npc = tsptr->tnpc;\n\n cpu_put_ccr(env, tsptr->tstate >> 32);\n\n env->asi = (tsptr->tstate >> 24) & 0xff;\n\n cpu_change_pstate(env, (tsptr->tstate >> 8) & 0xf3f);\n\n cpu_put_cwp64(env, tsptr->tstate & 0xff);\n\n if (cpu_has_hypervisor(env)) {\n\n uint32_t new_gl = (tsptr->tstate >> 40) & 7;\n\n env->hpstate = env->htstate[env->tl];\n\n cpu_gl_switch_gregs(env, new_gl);\n\n env->gl = new_gl;\n\n }\n\n env->tl--;\n\n\n\n trace_win_helper_retry(env->tl);\n\n\n\n#if !defined(CONFIG_USER_ONLY)\n\n if (cpu_interrupts_enabled(env)) {\n\n\n cpu_check_irqs(env);\n\n\n }\n\n#endif\n\n}"}} {"sample_id": "f090c9d4ad5812fb92843d6470a1111c15190c4c_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n \n \n+ if ( ( ( extractFloat64Exp( a ) == 0x7FF ) && extractFloat64Frac( a ) )\n+\n+ || ( ( extractFloat64Exp( b ) == 0x7FF ) && extractFloat64Frac( b ) )\n+\n+ ) {\n \n if ( float64_is_signaling_nan( a ) || float64_is_signaling_nan( b ) ) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int float64_le_quiet( float64 a, float64 b STATUS_PARAM )\n\n{\n\n flag aSign, bSign;\n\n\n\n if ( ( ( extractFloat64Exp( a ) == 0x7FF ) && extractFloat64Frac( a ) )\n\n || ( ( extractFloat64Exp( b ) == 0x7FF ) && extractFloat64Frac( b ) )\n\n ) {\n\n if ( float64_is_signaling_nan( a ) || float64_is_signaling_nan( b ) ) {\n\n float_raise( float_flag_invalid STATUS_VAR);\n\n }\n\n return 0;\n\n }\n\n aSign = extractFloat64Sign( a );\n\n bSign = extractFloat64Sign( b );\n\n if ( aSign != bSign ) return aSign || ( (bits64) ( ( a | b )<<1 ) == 0 );\n\n return ( a == b ) || ( aSign ^ ( a < b ) );\n\n\n\n}\n"}} {"sample_id": "94171e119cb6f7bab2578896643b0daff1d9b184", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int monitor_read_password(Monitor *mon, ReadLineFunc *readline_func,\n \n+ void *opaque)\n+\n+{\n+\n+ if (mon->rs) {\n \n readline_start(mon->rs, \"Password: \", 1, readline_func, opaque);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int monitor_read_password(Monitor *mon, ReadLineFunc *readline_func,\n\n void *opaque)\n\n{\n\n if (mon->rs) {\n\n readline_start(mon->rs, \"Password: \", 1, readline_func, opaque);\n\n /* prompt is printed on return from the command handler */\n\n return 0;\n\n } else {\n\n monitor_printf(mon, \"terminal does not support password prompting\\n\");\n\n return -ENOTTY;\n\n }\n\n}\n"}} {"sample_id": "8b19ae07616bbd18969b94cbf5d74308a8f2bbdf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n int av_crc_init(AVCRC *ctx, int le, int bits, uint32_t poly, int ctx_size){\n+\n int i, j;\n \n uint32_t c;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int av_crc_init(AVCRC *ctx, int le, int bits, uint32_t poly, int ctx_size){\n\n int i, j;\n\n uint32_t c;\n\n\n\n if (bits < 8 || bits > 32 || poly >= (1LL<>1)^(poly & (-(c&1)));\n\n ctx[i] = c;\n\n } else {\n\n for (c = i << 24, j = 0; j < 8; j++)\n\n c = (c<<1) ^ ((poly<<(32-bits)) & (((int32_t)c)>>31) );\n\n ctx[i] = av_bswap32(c);\n\n }\n\n }\n\n ctx[256]=1;\n\n#if !CONFIG_SMALL\n\n if(ctx_size >= sizeof(AVCRC)*1024)\n\n for (i = 0; i < 256; i++)\n\n for(j=0; j<3; j++)\n\n ctx[256*(j+1) + i]= (ctx[256*j + i]>>8) ^ ctx[ ctx[256*j + i]&0xFF ];\n\n#endif\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "9604f70fdf8e21ec0dbf6eac5e59a0eb8beadd64", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void pc_q35_init_1_5(QEMUMachineInitArgs *args)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void pc_q35_init_1_5(QEMUMachineInitArgs *args)\n\n{\n\n has_pci_info = false;\n\n pc_q35_init(args);\n\n}\n"}} {"sample_id": "621ff94d5074d88253a5818c6b9c4db718fbfc65_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void virtio_ccw_balloon_realize(VirtioCcwDevice *ccw_dev, Error **errp)\n \n {\n+\n+ VirtIOBalloonCcw *dev = VIRTIO_BALLOON_CCW(ccw_dev);\n+\n+ DeviceState *vdev = DEVICE(&dev->vdev);\n+\n Error *err = NULL;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_ccw_balloon_realize(VirtioCcwDevice *ccw_dev, Error **errp)\n\n{\n\n VirtIOBalloonCcw *dev = VIRTIO_BALLOON_CCW(ccw_dev);\n\n DeviceState *vdev = DEVICE(&dev->vdev);\n\n Error *err = NULL;\n\n\n\n qdev_set_parent_bus(vdev, BUS(&ccw_dev->bus));\n\n object_property_set_bool(OBJECT(vdev), true, \"realized\", &err);\n\n if (err) {\n\n error_propagate(errp, err);\n\n }\n\n}\n"}} {"sample_id": "2da0d70d5eebe42f9fcd27ee554419ebe2a5da06_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,18 +1,18 @@\n static inline void RENAME(bgr15ToUV)(uint8_t *dstU, uint8_t *dstV, uint8_t *src1, uint8_t *src2, int width)\n+\n+{\n+\n \tint i;\n+\n+ assert(src1==src2);\n+\n+\tfor(i=0; i>5)&0x03E0F81F);\n\n\n\n\t\tint dh2= (dh>>11) + (dh<<21);\n\n\t\tint d= dh2 + dl;\n\n\n\n\t\tint b= d&0x7F;\n\n\t\tint r= (d>>10)&0x7F;\n\n\t\tint g= d>>21;\n\n\t\tdstU[i]= ((RU*r + GU*g + BU*b)>>(RGB2YUV_SHIFT+1-3)) + 128;\n\n\t\tdstV[i]= ((RV*r + GV*g + BV*b)>>(RGB2YUV_SHIFT+1-3)) + 128;\n\n\t}\n\n}\n"}} {"sample_id": "0e8d2b5575938b8876a3c4bb66ee13c5d306fb6d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n exit(0);\n+\n+ return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int do_quit(Monitor *mon, const QDict *qdict, QObject **ret_data)\n\n{\n\n exit(0);\n\n return 0;\n\n}\n"}} {"sample_id": "bec1e9546e03b9e7f5152cf3e8c95cf8acff5e12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,23 +1,23 @@\n static ssize_t local_readlink(FsContext *fs_ctx, V9fsPath *fs_path,\n \n+ char *buf, size_t bufsz)\n+\n {\n \n+ ssize_t tsize = -1;\n+\n+ char *buffer;\n \n char *path = fs_path->data;\n \n \n \n if ((fs_ctx->export_flags & V9FS_SM_MAPPED) ||\n+\n (fs_ctx->export_flags & V9FS_SM_MAPPED_FILE)) {\n \n int fd;\n+\n buffer = rpath(fs_ctx, path);\n \n fd = open(buffer, O_RDONLY | O_NOFOLLOW);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static ssize_t local_readlink(FsContext *fs_ctx, V9fsPath *fs_path,\n\n char *buf, size_t bufsz)\n\n{\n\n ssize_t tsize = -1;\n\n char *buffer;\n\n char *path = fs_path->data;\n\n\n\n if ((fs_ctx->export_flags & V9FS_SM_MAPPED) ||\n\n (fs_ctx->export_flags & V9FS_SM_MAPPED_FILE)) {\n\n int fd;\n\n buffer = rpath(fs_ctx, path);\n\n fd = open(buffer, O_RDONLY | O_NOFOLLOW);\n\n g_free(buffer);\n\n if (fd == -1) {\n\n return -1;\n\n }\n\n do {\n\n tsize = read(fd, (void *)buf, bufsz);\n\n } while (tsize == -1 && errno == EINTR);\n\n close(fd);\n\n } else if ((fs_ctx->export_flags & V9FS_SM_PASSTHROUGH) ||\n\n (fs_ctx->export_flags & V9FS_SM_NONE)) {\n\n buffer = rpath(fs_ctx, path);\n\n tsize = readlink(buffer, buf, bufsz);\n\n g_free(buffer);\n\n }\n\n return tsize;\n\n}\n"}} {"sample_id": "02cb7f3a256517cbf3136caff2863fbafc57b540_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n v9fs_co_run_in_worker(\n \n {\n+\n+ err = s->ops->mknod(&s->ctx, path->data, &cred);\n+\n+ if (err < 0) {\n+\n err = -errno;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int v9fs_co_mknod(V9fsState *s, V9fsString *path, uid_t uid,\n\n gid_t gid, dev_t dev, mode_t mode)\n\n{\n\n int err;\n\n FsCred cred;\n\n\n\n cred_init(&cred);\n\n cred.fc_uid = uid;\n\n cred.fc_gid = gid;\n\n cred.fc_mode = mode;\n\n cred.fc_rdev = dev;\n\n v9fs_co_run_in_worker(\n\n {\n\n err = s->ops->mknod(&s->ctx, path->data, &cred);\n\n if (err < 0) {\n\n err = -errno;\n\n }\n\n });\n\n return err;\n\n}\n"}} {"sample_id": "5d7fd045cafeac1831c1999cb9e1251b7906c6b2_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n \n \n+ v1 = float32_abs(v2);\n+\n+ env->fregs[f1].d = v1;\n+\n return set_cc_nz_f32(v1);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint32_t HELPER(lpebr)(CPUS390XState *env, uint32_t f1, uint32_t f2)\n\n{\n\n float32 v1;\n\n float32 v2 = env->fregs[f2].d;\n\n\n\n v1 = float32_abs(v2);\n\n env->fregs[f1].d = v1;\n\n return set_cc_nz_f32(v1);\n\n}\n"}} {"sample_id": "0824afda0cd20045ffe87d58e142774514b61026", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n \n \n /* Check cancellation *before* setting busy = false, too! */\n+\n+ if (block_job_is_cancelled(job)) {\n+\n+ return;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void block_job_sleep_ns(BlockJob *job, QEMUClockType type, int64_t ns)\n\n{\n\n assert(job->busy);\n\n\n\n /* Check cancellation *before* setting busy = false, too! */\n\n if (block_job_is_cancelled(job)) {\n\n return;\n\n }\n\n\n\n job->busy = false;\n\n if (block_job_is_paused(job)) {\n\n qemu_coroutine_yield();\n\n } else {\n\n co_aio_sleep_ns(blk_get_aio_context(job->blk), type, ns);\n\n }\n\n job->busy = true;\n\n}\n"}} {"sample_id": "915bbac6815eddd911fb5cb8a23517b3cac3a84b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ static int done = 0;\n+\n+\n+\n+ if (!done) {\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void mpeg1_init_vlc(MpegEncContext *s)\n\n{\n\n static int done = 0;\n\n\n\n if (!done) {\n\n\n\n\n init_vlc(&dc_lum_vlc, 9, 12, \n\n vlc_dc_lum_bits, 1, 1,\n\n vlc_dc_lum_code, 2, 2);\n\n init_vlc(&dc_chroma_vlc, 9, 12, \n\n vlc_dc_chroma_bits, 1, 1,\n\n vlc_dc_chroma_code, 2, 2);\n\n init_vlc(&mv_vlc, 9, 17, \n\n &mbMotionVectorTable[0][1], 2, 1,\n\n &mbMotionVectorTable[0][0], 2, 1);\n\n init_vlc(&mbincr_vlc, 9, 35, \n\n &mbAddrIncrTable[0][1], 2, 1,\n\n &mbAddrIncrTable[0][0], 2, 1);\n\n init_vlc(&mb_pat_vlc, 9, 63, \n\n &mbPatTable[0][1], 2, 1,\n\n &mbPatTable[0][0], 2, 1);\n\n \n\n init_vlc(&mb_ptype_vlc, 6, 32, \n\n &table_mb_ptype[0][1], 2, 1,\n\n &table_mb_ptype[0][0], 2, 1);\n\n init_vlc(&mb_btype_vlc, 6, 32, \n\n &table_mb_btype[0][1], 2, 1,\n\n &table_mb_btype[0][0], 2, 1);\n\n init_rl(&rl_mpeg1);\n\n init_rl(&rl_mpeg2);\n\n /* cannot use generic init because we must add the EOB code */\n\n init_vlc(&rl_mpeg1.vlc, 9, rl_mpeg1.n + 2, \n\n &rl_mpeg1.table_vlc[0][1], 4, 2,\n\n &rl_mpeg1.table_vlc[0][0], 4, 2);\n\n init_vlc(&rl_mpeg2.vlc, 9, rl_mpeg2.n + 2, \n\n &rl_mpeg2.table_vlc[0][1], 4, 2,\n\n &rl_mpeg2.table_vlc[0][0], 4, 2);\n\n }\n\n}"}} {"sample_id": "0c33682d5f29b0a4ae53bdec4c8e52e4fae37b34", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void exception_action(CPUState *cpu)\n+\n+{\n+\n+#if defined(TARGET_I386)\n+\n X86CPU *x86_cpu = X86_CPU(cpu);\n \n CPUX86State *env1 = &x86_cpu->env;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void exception_action(CPUState *cpu)\n\n{\n\n#if defined(TARGET_I386)\n\n X86CPU *x86_cpu = X86_CPU(cpu);\n\n CPUX86State *env1 = &x86_cpu->env;\n\n\n\n raise_exception_err(env1, cpu->exception_index, env1->error_code);\n\n#else\n\n cpu_loop_exit(cpu);\n\n#endif\n\n}\n"}} {"sample_id": "d1adad3cca407f493c3637e20ecd4f7124e69212_18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n {\n \n int i;\n+\n+ for (i = 0; i < width; i++) {\n+\n dst[i ] = (dst[i ]*1799 + 4081085)>>11; //1469\n \n dst[i+VOFW] = (dst[i+VOFW]*1799 + 4081085)>>11; //1469", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void RENAME(chrRangeFromJpeg)(int16_t *dst, int width)\n\n{\n\n int i;\n\n for (i = 0; i < width; i++) {\n\n dst[i ] = (dst[i ]*1799 + 4081085)>>11; //1469\n\n dst[i+VOFW] = (dst[i+VOFW]*1799 + 4081085)>>11; //1469\n\n }\n\n}\n"}} {"sample_id": "be9ce6e10a8d53b8bc346c9337d75a5a30631a2a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void mov_parse_stsd_subtitle(MOVContext *c, AVIOContext *pb,\n \n AVStream *st, MOVStreamContext *sc,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void mov_parse_stsd_subtitle(MOVContext *c, AVIOContext *pb,\n\n AVStream *st, MOVStreamContext *sc,\n\n int size)\n\n{\n\n // ttxt stsd contains display flags, justification, background\n\n // color, fonts, and default styles, so fake an atom to read it\n\n MOVAtom fake_atom = { .size = size };\n\n // mp4s contains a regular esds atom\n\n if (st->codec->codec_tag != AV_RL32(\"mp4s\"))\n\n mov_read_glbl(c, pb, fake_atom);\n\n st->codec->width = sc->width;\n\n st->codec->height = sc->height;\n\n}\n"}} {"sample_id": "2caf19e90f270abe1e80a3e85acaf0eb5c9d0aac", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,8 +12,8 @@\n \n \n \n+ dc0=dc1=0;\n+\n for(i=0;i<4; i++){\n \n dc0+= src[i-stride];", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void FUNCC(pred8x8_top_dc)(uint8_t *_src, int stride){\n\n int i;\n\n int dc0, dc1;\n\n pixel4 dc0splat, dc1splat;\n\n pixel *src = (pixel*)_src;\n\n stride /= sizeof(pixel);\n\n\n\n dc0=dc1=0;\n\n for(i=0;i<4; i++){\n\n dc0+= src[i-stride];\n\n dc1+= src[4+i-stride];\n\n }\n\n dc0splat = PIXEL_SPLAT_X4((dc0 + 2)>>2);\n\n dc1splat = PIXEL_SPLAT_X4((dc1 + 2)>>2);\n\n\n\n for(i=0; i<4; i++){\n\n ((pixel4*)(src+i*stride))[0]= dc0splat;\n\n ((pixel4*)(src+i*stride))[1]= dc1splat;\n\n }\n\n for(i=4; i<8; i++){\n\n ((pixel4*)(src+i*stride))[0]= dc0splat;\n\n ((pixel4*)(src+i*stride))[1]= dc1splat;\n\n }\n\n}\n"}} {"sample_id": "5c6c0e513600ba57c3e73b7151d3c0664438f7b5_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n+static void scsi_read_data(SCSIDevice *d, uint32_t tag)\n+\n+{\n+\n+ SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);\n+\n+ SCSIDiskReq *r;\n \n \n+\n r = scsi_find_request(s, tag);\n \n if (!r) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void scsi_read_data(SCSIDevice *d, uint32_t tag)\n\n{\n\n SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);\n\n SCSIDiskReq *r;\n\n\n\n r = scsi_find_request(s, tag);\n\n if (!r) {\n\n BADF(\"Bad read tag 0x%x\\n\", tag);\n\n /* ??? This is the wrong error. */\n\n scsi_command_complete(r, CHECK_CONDITION, HARDWARE_ERROR);\n\n return;\n\n }\n\n\n\n scsi_read_request(r);\n\n}\n"}} {"sample_id": "7e2515e87c41e2e658aaed466e11cbdf1ea8bcb1_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void term_show_prompt2(void)\n \n+{\n+\n+ term_printf(\"(qemu) \");\n \n fflush(stdout);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void term_show_prompt2(void)\n\n{\n\n term_printf(\"(qemu) \");\n\n fflush(stdout);\n\n term_last_cmd_buf_index = 0;\n\n term_last_cmd_buf_size = 0;\n\n term_esc_state = IS_NORM;\n\n}\n"}} {"sample_id": "a89d89d3e65800fa4a8e00de7af0ea8272bef779", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n+static int find_snapshot_by_id_or_name(BlockDriverState *bs, const char *name)\n+\n+{\n+\n+ BDRVQcowState *s = bs->opaque;\n+\n+ int i, ret;\n \n+\n \n ret = find_snapshot_by_id(bs, name);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int find_snapshot_by_id_or_name(BlockDriverState *bs, const char *name)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n int i, ret;\n\n\n\n ret = find_snapshot_by_id(bs, name);\n\n if (ret >= 0)\n\n return ret;\n\n for(i = 0; i < s->nb_snapshots; i++) {\n\n if (!strcmp(s->snapshots[i].name, name))\n\n return i;\n\n }\n\n return -1;\n\n}\n"}} {"sample_id": "4edebb0e8e14a5b934114b5ff74cb86437bb2532_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,8 +14,8 @@\n \n sun4m_common_init(ram_size, boot_device, ds, kernel_filename,\n \n+ kernel_cmdline, initrd_filename, cpu_model,\n+\n+ 0);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ss5_init(int ram_size, int vga_ram_size, int boot_device,\n\n DisplayState *ds, const char **fd_filename, int snapshot,\n\n const char *kernel_filename, const char *kernel_cmdline,\n\n const char *initrd_filename, const char *cpu_model)\n\n{\n\n if (cpu_model == NULL)\n\n cpu_model = \"Fujitsu MB86904\";\n\n sun4m_common_init(ram_size, boot_device, ds, kernel_filename,\n\n kernel_cmdline, initrd_filename, cpu_model,\n\n 0);\n\n}\n"}} {"sample_id": "fa2a34cd40d124161c748bb0f430dc63c94dd0da", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void avfilter_uninit(void)\n+\n+{\n \n memset(registered_avfilters, 0, sizeof(registered_avfilters));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void avfilter_uninit(void)\n\n{\n\n memset(registered_avfilters, 0, sizeof(registered_avfilters));\n\n next_registered_avfilter_idx = 0;\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_79", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n mutex_lock(&lock);\n \n+ if (idle_threads == 0 && cur_threads < max_threads)\n+\n+ spawn_thread();\n+\n+ TAILQ_INSERT_TAIL(&request_list, aiocb, node);\n \n mutex_unlock(&lock);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_paio_submit(struct qemu_paiocb *aiocb)\n\n{\n\n aiocb->ret = -EINPROGRESS;\n\n aiocb->active = 0;\n\n mutex_lock(&lock);\n\n if (idle_threads == 0 && cur_threads < max_threads)\n\n spawn_thread();\n\n TAILQ_INSERT_TAIL(&request_list, aiocb, node);\n\n mutex_unlock(&lock);\n\n cond_signal(&cond);\n\n}\n"}} {"sample_id": "ce5b1bbf624b977a55ff7f85bb3871682d03baff_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n CPUState *cs = CPU(obj);\n+\n SPARCCPU *cpu = SPARC_CPU(obj);\n \n CPUSPARCState *env = &cpu->env;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void sparc_cpu_initfn(Object *obj)\n\n{\n\n CPUState *cs = CPU(obj);\n\n SPARCCPU *cpu = SPARC_CPU(obj);\n\n CPUSPARCState *env = &cpu->env;\n\n\n\n cs->env_ptr = env;\n\n cpu_exec_init(cs, &error_abort);\n\n\n\n if (tcg_enabled()) {\n\n gen_intermediate_code_init(env);\n\n }\n\n}\n"}} {"sample_id": "7372c2b926200db295412efbb53f93773b7f1754_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n if (IS_USER(s)) {\n+\n gen_exception(s, s->pc - 2, EXCP_PRIVILEGE);\n \n return;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "DISAS_INSN(wdebug)\n\n{\n\n if (IS_USER(s)) {\n\n gen_exception(s, s->pc - 2, EXCP_PRIVILEGE);\n\n return;\n\n }\n\n /* TODO: Implement wdebug. */\n\n qemu_assert(0, \"WDEBUG not implemented\");\n\n}\n"}} {"sample_id": "5331773cc33ba26b9e26ace643d926219e46a17b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+void ff_id3v2_read_dict(AVIOContext *pb, AVDictionary **metadata,\n+\n const char *magic, ID3v2ExtraMeta **extra_meta)\n \n {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_id3v2_read_dict(AVIOContext *pb, AVDictionary **metadata,\n\n const char *magic, ID3v2ExtraMeta **extra_meta)\n\n{\n\n id3v2_read_internal(pb, metadata, NULL, magic, extra_meta);\n\n}\n"}} {"sample_id": "384acbf46b70edf0d2c1648aa1a92a90bcf7057d_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n return NULL;\n \n acb->aio_type = QEMU_AIO_IOCTL;\n+\n+ acb->aio_fildes = fd;\n+\n+ acb->ev_signo = SIGUSR2;\n+\n acb->async_context_id = get_async_context_id();\n \n acb->aio_offset = 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "BlockDriverAIOCB *paio_ioctl(BlockDriverState *bs, int fd,\n\n unsigned long int req, void *buf,\n\n BlockDriverCompletionFunc *cb, void *opaque)\n\n{\n\n struct qemu_paiocb *acb;\n\n\n\n acb = qemu_aio_get(&raw_aio_pool, bs, cb, opaque);\n\n if (!acb)\n\n return NULL;\n\n acb->aio_type = QEMU_AIO_IOCTL;\n\n acb->aio_fildes = fd;\n\n acb->ev_signo = SIGUSR2;\n\n acb->async_context_id = get_async_context_id();\n\n acb->aio_offset = 0;\n\n acb->aio_ioctl_buf = buf;\n\n acb->aio_ioctl_cmd = req;\n\n\n\n acb->next = posix_aio_state->first_aio;\n\n posix_aio_state->first_aio = acb;\n\n\n\n qemu_paio_submit(acb);\n\n return &acb->common;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_286", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,9 +17,9 @@\n if (did > 0)\n \n rom_add_blob_fixed(\"read\", buf, did, dst_addr);\n+\n+ g_free(buf);\n+\n+ return did;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "ssize_t read_targphys(const char *name,\n\n int fd, target_phys_addr_t dst_addr, size_t nbytes)\n\n{\n\n uint8_t *buf;\n\n ssize_t did;\n\n\n\n buf = g_malloc(nbytes);\n\n did = read(fd, buf, nbytes);\n\n if (did > 0)\n\n rom_add_blob_fixed(\"read\", buf, did, dst_addr);\n\n g_free(buf);\n\n return did;\n\n}\n"}} {"sample_id": "210b580b106fa798149e28aa13c66b325a43204e_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n }\n \n \n+\n+ qemu_get_timedate(&tm, spapr->rtc_offset);\n+\n+\n+\n rtas_st(rets, 0, 0); /* Success */\n \n rtas_st(rets, 1, tm.tm_year + 1900);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void rtas_get_time_of_day(sPAPREnvironment *spapr,\n\n uint32_t token, uint32_t nargs,\n\n target_ulong args,\n\n uint32_t nret, target_ulong rets)\n\n{\n\n struct tm tm;\n\n\n\n if (nret != 8) {\n\n rtas_st(rets, 0, -3);\n\n return;\n\n }\n\n\n\n qemu_get_timedate(&tm, spapr->rtc_offset);\n\n\n\n rtas_st(rets, 0, 0); /* Success */\n\n rtas_st(rets, 1, tm.tm_year + 1900);\n\n rtas_st(rets, 2, tm.tm_mon + 1);\n\n rtas_st(rets, 3, tm.tm_mday);\n\n rtas_st(rets, 4, tm.tm_hour);\n\n rtas_st(rets, 5, tm.tm_min);\n\n rtas_st(rets, 6, tm.tm_sec);\n\n rtas_st(rets, 7, 0); /* we don't do nanoseconds */\n\n}\n"}} {"sample_id": "3d5822d9cf07d08bce82903e4715658f46b01b5c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,7 +15,7 @@\n \n \n if (!comp->reslevel)\n+\n continue;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void ff_jpeg2000_cleanup(Jpeg2000Component *comp, Jpeg2000CodingStyle *codsty)\n\n{\n\n int reslevelno, bandno, precno;\n\n for (reslevelno = 0;\n\n comp->reslevel && reslevelno < codsty->nreslevels;\n\n reslevelno++) {\n\n Jpeg2000ResLevel *reslevel;\n\n\n\n if (!comp->reslevel)\n\n continue;\n\n\n\n reslevel = comp->reslevel + reslevelno;\n\n for (bandno = 0; bandno < reslevel->nbands; bandno++) {\n\n Jpeg2000Band *band;\n\n\n\n if (!reslevel->band)\n\n continue;\n\n\n\n band = reslevel->band + bandno;\n\n for (precno = 0; precno < reslevel->num_precincts_x * reslevel->num_precincts_y; precno++) {\n\n if (band->prec) {\n\n Jpeg2000Prec *prec = band->prec + precno;\n\n av_freep(&prec->zerobits);\n\n av_freep(&prec->cblkincl);\n\n av_freep(&prec->cblk);\n\n }\n\n }\n\n\n\n av_freep(&band->prec);\n\n }\n\n av_freep(&reslevel->band);\n\n }\n\n\n\n ff_dwt_destroy(&comp->dwt);\n\n av_freep(&comp->reslevel);\n\n av_freep(&comp->i_data);\n\n av_freep(&comp->f_data);\n\n}\n"}} {"sample_id": "a89f364ae8740dfc31b321eed9ee454e996dc3c1_25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -50,11 +50,11 @@\n \n case ICSR0:\n \n+ return s->status[0];\n+\n+ case ICSR1:\n+\n+ return s->status[1] | (1 << 3);\t\t\t/* TNF */\n \n case ICFOR:\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t pxa2xx_fir_read(void *opaque, hwaddr addr,\n\n unsigned size)\n\n{\n\n PXA2xxFIrState *s = (PXA2xxFIrState *) opaque;\n\n uint8_t ret;\n\n\n\n switch (addr) {\n\n case ICCR0:\n\n return s->control[0];\n\n case ICCR1:\n\n return s->control[1];\n\n case ICCR2:\n\n return s->control[2];\n\n case ICDR:\n\n s->status[0] &= ~0x01;\n\n s->status[1] &= ~0x72;\n\n if (s->rx_len) {\n\n s->rx_len --;\n\n ret = s->rx_fifo[s->rx_start ++];\n\n s->rx_start &= 63;\n\n pxa2xx_fir_update(s);\n\n return ret;\n\n }\n\n printf(\"%s: Rx FIFO underrun.\\n\", __FUNCTION__);\n\n break;\n\n case ICSR0:\n\n return s->status[0];\n\n case ICSR1:\n\n return s->status[1] | (1 << 3);\t\t\t/* TNF */\n\n case ICFOR:\n\n return s->rx_len;\n\n default:\n\n printf(\"%s: Bad register \" REG_FMT \"\\n\", __FUNCTION__, addr);\n\n break;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "636ced8e1dc8248a1353b416240b93d70ad03edb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ AVDictionaryEntry *t;\n \n if ((t = av_dict_get(m, \"\", NULL, AV_DICT_IGNORE_SUFFIX))) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void assert_avoptions(AVDictionary *m)\n\n{\n\n AVDictionaryEntry *t;\n\n if ((t = av_dict_get(m, \"\", NULL, AV_DICT_IGNORE_SUFFIX))) {\n\n av_log(NULL, AV_LOG_FATAL, \"Option %s not found.\\n\", t->key);\n\n exit(1);\n\n }\n\n}\n"}} {"sample_id": "3a1a7e32ace7af47de74e8ae779cb4e04c89aa97_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static int tta_decode_init(AVCodecContext * avctx)\n {\n TTAContext *s = avctx->priv_data;\n+ int i;\n+ s->avctx = avctx;\n+ // 30bytes includes a seektable with one frame\n+ if (avctx->extradata_size < 30)\n+ init_get_bits(&s->gb, avctx->extradata, avctx->extradata_size);\n if (show_bits_long(&s->gb, 32) == bswap_32(ff_get_fourcc(\"TTA1\")))\n {\n /* signature */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int tta_decode_init(AVCodecContext * avctx)\n{\n TTAContext *s = avctx->priv_data;\n int i;\n s->avctx = avctx;\n // 30bytes includes a seektable with one frame\n if (avctx->extradata_size < 30)\n init_get_bits(&s->gb, avctx->extradata, avctx->extradata_size);\n if (show_bits_long(&s->gb, 32) == bswap_32(ff_get_fourcc(\"TTA1\")))\n {\n /* signature */\n skip_bits(&s->gb, 32);\n// if (get_bits_long(&s->gb, 32) != bswap_32(ff_get_fourcc(\"TTA1\"))) {\n// av_log(s->avctx, AV_LOG_ERROR, \"Missing magic\\n\");\n// return -1;\n// }\n s->flags = get_le16(&s->gb);\n if (s->flags != 1 && s->flags != 3)\n {\n av_log(s->avctx, AV_LOG_ERROR, \"Invalid flags\\n\");\n s->is_float = (s->flags == FORMAT_FLOAT);\n avctx->channels = s->channels = get_le16(&s->gb);\n avctx->bits_per_sample = get_le16(&s->gb);\n s->bps = (avctx->bits_per_sample + 7) / 8;\n avctx->sample_rate = get_le32(&s->gb);\n if(avctx->sample_rate > 1000000){ //prevent FRAME_TIME * avctx->sample_rate from overflowing and sanity check\n av_log(avctx, AV_LOG_ERROR, \"sample_rate too large\\n\");\n s->data_length = get_le32(&s->gb);\n skip_bits(&s->gb, 32); // CRC32 of header\n if (s->is_float)\n {\n avctx->sample_fmt = SAMPLE_FMT_FLT;\n av_log(s->avctx, AV_LOG_ERROR, \"Unsupported sample format. Please contact the developers.\\n\");\n else switch(s->bps) {\n// case 1: avctx->sample_fmt = SAMPLE_FMT_U8; break;\n case 2: avctx->sample_fmt = SAMPLE_FMT_S16; break;\n// case 3: avctx->sample_fmt = SAMPLE_FMT_S24; break;\n case 4: avctx->sample_fmt = SAMPLE_FMT_S32; break;\n default:\n av_log(s->avctx, AV_LOG_ERROR, \"Invalid/unsupported sample format. Please contact the developers.\\n\");\n // FIXME: horribly broken, but directly from reference source\n#define FRAME_TIME 1.04489795918367346939\n s->frame_length = (int)(FRAME_TIME * avctx->sample_rate);\n s->last_frame_length = s->data_length % s->frame_length;\n s->total_frames = s->data_length / s->frame_length +\n (s->last_frame_length ? 1 : 0);\n av_log(s->avctx, AV_LOG_DEBUG, \"flags: %x chans: %d bps: %d rate: %d block: %d\\n\",\n s->flags, avctx->channels, avctx->bits_per_sample, avctx->sample_rate,\n avctx->block_align);\n av_log(s->avctx, AV_LOG_DEBUG, \"data_length: %d frame_length: %d last: %d total: %d\\n\",\n s->data_length, s->frame_length, s->last_frame_length, s->total_frames);\n // FIXME: seek table\n for (i = 0; i < s->total_frames; i++)\n skip_bits(&s->gb, 32);\n skip_bits(&s->gb, 32); // CRC32 of seektable\n s->decode_buffer = av_mallocz(sizeof(int32_t)*s->frame_length*s->channels);\n } else {\n av_log(avctx, AV_LOG_ERROR, \"Wrong extradata present\\n\");\n return 0;"}} {"sample_id": "f02ca5cbeaf86038834c1953247a1579d7921927_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static inline void tcg_out_ldst(TCGContext *s, int ret, int addr, int offset, int op)\n+\n+{\n \n if (offset == (offset & 0xfff))\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void tcg_out_ldst(TCGContext *s, int ret, int addr, int offset, int op)\n\n{\n\n if (offset == (offset & 0xfff))\n\n tcg_out32(s, op | INSN_RD(ret) | INSN_RS1(addr) |\n\n INSN_IMM13(offset));\n\n else\n\n fprintf(stderr, \"unimplemented %s with offset %d\\n\", __func__, offset);\n\n}\n"}} {"sample_id": "2217a2249dd78c3719f865569b661b8adcda4962", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,9 +6,9 @@\n \n const uint8_t *src = pic->data[0];\n \n+ int x, y;\n \n+\n \n for (y = 0; y < avctx->height; y++) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void encode_rgb48_10bit(AVCodecContext *avctx, const AVPicture *pic, uint8_t *dst)\n\n{\n\n DPXContext *s = avctx->priv_data;\n\n const uint8_t *src = pic->data[0];\n\n int x, y;\n\n\n\n for (y = 0; y < avctx->height; y++) {\n\n for (x = 0; x < avctx->width; x++) {\n\n int value;\n\n if (s->big_endian) {\n\n value = ((AV_RB16(src + 6*x + 4) & 0xFFC0) >> 4)\n\n | ((AV_RB16(src + 6*x + 2) & 0xFFC0) << 6)\n\n | ((AV_RB16(src + 6*x + 0) & 0xFFC0) << 16);\n\n } else {\n\n value = ((AV_RL16(src + 6*x + 4) & 0xFFC0) >> 4)\n\n | ((AV_RL16(src + 6*x + 2) & 0xFFC0) << 6)\n\n | ((AV_RL16(src + 6*x + 0) & 0xFFC0) << 16);\n\n }\n\n write32(dst, value);\n\n dst += 4;\n\n }\n\n src += pic->linesize[0];\n\n }\n\n}\n"}} {"sample_id": "72f0d0bf51362011c4d841a89fb8f5cfb16e0bf3_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+int pt_removexattr(FsContext *ctx, const char *path, const char *name)\n+\n+{\n+\n+ char *buffer;\n+\n+ int ret;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "int pt_removexattr(FsContext *ctx, const char *path, const char *name)\n\n{\n\n char *buffer;\n\n int ret;\n\n\n\n buffer = rpath(ctx, path);\n\n ret = lremovexattr(path, name);\n\n g_free(buffer);\n\n return ret;\n\n}\n"}} {"sample_id": "5651743c908d8c3b1ff0192ce9543a502ec7a206", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n \n \n+ cpu->cpu_index = UNASSIGNED_CPU_INDEX;\n \n cpu->gdb_num_regs = cpu->gdb_num_g_regs = cc->gdb_num_core_regs;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void cpu_common_initfn(Object *obj)\n\n{\n\n CPUState *cpu = CPU(obj);\n\n CPUClass *cc = CPU_GET_CLASS(obj);\n\n\n\n cpu->cpu_index = UNASSIGNED_CPU_INDEX;\n\n cpu->gdb_num_regs = cpu->gdb_num_g_regs = cc->gdb_num_core_regs;\n\n /* *-user doesn't have configurable SMP topology */\n\n /* the default value is changed by qemu_init_vcpu() for softmmu */\n\n cpu->nr_cores = 1;\n\n cpu->nr_threads = 1;\n\n\n\n qemu_mutex_init(&cpu->work_mutex);\n\n QTAILQ_INIT(&cpu->breakpoints);\n\n QTAILQ_INIT(&cpu->watchpoints);\n\n\n\n cpu->trace_dstate = bitmap_new(trace_get_vcpu_event_count());\n\n\n\n cpu_exec_initfn(cpu);\n\n}\n"}} {"sample_id": "dc5999787181f6d090217f45570067e55333835b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n MonitorQAPIEventState *evstate = opaque;\n \n+ MonitorQAPIEventConf *evconf = &monitor_qapi_event_conf[evstate->event];\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void monitor_qapi_event_handler(void *opaque)\n\n{\n\n MonitorQAPIEventState *evstate = opaque;\n\n MonitorQAPIEventConf *evconf = &monitor_qapi_event_conf[evstate->event];\n\n\n\n trace_monitor_protocol_event_handler(evstate->event, evstate->qdict);\n\n qemu_mutex_lock(&monitor_lock);\n\n\n\n if (evstate->qdict) {\n\n int64_t now = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);\n\n\n\n monitor_qapi_event_emit(evstate->event, evstate->qdict);\n\n QDECREF(evstate->qdict);\n\n evstate->qdict = NULL;\n\n timer_mod_ns(evstate->timer, now + evconf->rate);\n\n } else {\n\n g_hash_table_remove(monitor_qapi_event_state, evstate);\n\n QDECREF(evstate->data);\n\n timer_free(evstate->timer);\n\n g_free(evstate);\n\n }\n\n\n\n qemu_mutex_unlock(&monitor_lock);\n\n}\n"}} {"sample_id": "e0498daab50d42f3948fc5607683c971fe9416fd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void gen_lq(DisasContext *ctx)\n+\n+{\n \n+#if defined(CONFIG_USER_ONLY)\n \n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n \n@@ -12,18 +12,18 @@\n \n TCGv EA;\n \n+\n+\n /* Restore CPU state */\n \n if (unlikely(ctx->mem_idx == 0)) {\n \n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n+\n+ return;\n+\n }\n+\n ra = rA(ctx->opcode);\n \n rd = rD(ctx->opcode);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_lq(DisasContext *ctx)\n\n{\n\n#if defined(CONFIG_USER_ONLY)\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n#else\n\n int ra, rd;\n\n TCGv EA;\n\n\n\n /* Restore CPU state */\n\n if (unlikely(ctx->mem_idx == 0)) {\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n return;\n\n }\n\n ra = rA(ctx->opcode);\n\n rd = rD(ctx->opcode);\n\n if (unlikely((rd & 1) || rd == ra)) {\n\n gen_inval_exception(ctx, POWERPC_EXCP_INVAL_INVAL);\n\n return;\n\n }\n\n if (unlikely(ctx->le_mode)) {\n\n /* Little-endian mode is not handled */\n\n gen_exception_err(ctx, POWERPC_EXCP_ALIGN, POWERPC_EXCP_ALIGN_LE);\n\n return;\n\n }\n\n gen_set_access_type(ctx, ACCESS_INT);\n\n EA = tcg_temp_new();\n\n gen_addr_imm_index(ctx, EA, 0x0F);\n\n gen_qemu_ld64(ctx, cpu_gpr[rd], EA);\n\n gen_addr_add(ctx, EA, EA, 8);\n\n gen_qemu_ld64(ctx, cpu_gpr[rd+1], EA);\n\n tcg_temp_free(EA);\n\n#endif\n\n}\n"}} {"sample_id": "e53c9065ca08a9153ecc73a6a8940bcc6d667e58_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,10 +20,10 @@\n \n if (ret = compare_floats(cdst, odst, LEN, FLT_EPSILON))\n \n+ av_log(NULL, AV_LOG_ERROR, \"vector_fmul_scalar failed\\n\");\n+\n+\n+\n+ return ret;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int test_vector_fmul_scalar(AVFloatDSPContext *fdsp, AVFloatDSPContext *cdsp,\n\n const float *v1, float scale)\n\n{\n\n LOCAL_ALIGNED(32, float, cdst, [LEN]);\n\n LOCAL_ALIGNED(32, float, odst, [LEN]);\n\n int ret;\n\n\n\n cdsp->vector_fmul_scalar(cdst, v1, scale, LEN);\n\n fdsp->vector_fmul_scalar(odst, v1, scale, LEN);\n\n\n\n if (ret = compare_floats(cdst, odst, LEN, FLT_EPSILON))\n\n av_log(NULL, AV_LOG_ERROR, \"vector_fmul_scalar failed\\n\");\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "7d1b0095bff7157e856d1d0e6c4295641ced2752_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+ TCGv_i64 tmp1 = tcg_temp_new_i64();\n \n+ TCGv_i64 tmp2 = tcg_temp_new_i64();\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static TCGv_i64 gen_mulu_i64_i32(TCGv a, TCGv b)\n\n{\n\n TCGv_i64 tmp1 = tcg_temp_new_i64();\n\n TCGv_i64 tmp2 = tcg_temp_new_i64();\n\n\n\n tcg_gen_extu_i32_i64(tmp1, a);\n\n dead_tmp(a);\n\n tcg_gen_extu_i32_i64(tmp2, b);\n\n dead_tmp(b);\n\n tcg_gen_mul_i64(tmp1, tmp1, tmp2);\n\n tcg_temp_free_i64(tmp2);\n\n return tmp1;\n\n}\n"}} {"sample_id": "8927cfbba232e28304734f7afd463c1b84134031", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void qxl_reset_state(PCIQXLDevice *d)\n \n {\n+\n+ QXLRam *ram = d->ram;\n \n QXLRom *rom = d->rom;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void qxl_reset_state(PCIQXLDevice *d)\n\n{\n\n QXLRam *ram = d->ram;\n\n QXLRom *rom = d->rom;\n\n\n\n assert(SPICE_RING_IS_EMPTY(&ram->cmd_ring));\n\n assert(SPICE_RING_IS_EMPTY(&ram->cursor_ring));\n\n d->shadow_rom.update_id = cpu_to_le32(0);\n\n *rom = d->shadow_rom;\n\n qxl_rom_set_dirty(d);\n\n init_qxl_ram(d);\n\n d->num_free_res = 0;\n\n d->last_release = NULL;\n\n memset(&d->ssd.dirty, 0, sizeof(d->ssd.dirty));\n\n}\n"}} {"sample_id": "e4f4fb1eca795e36f363b4647724221e774523c1_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n dc->realize = hpet_realize;\n \n dc->reset = hpet_reset;\n+\n+ dc->vmsd = &vmstate_hpet;\n+\n+ dc->props = hpet_device_properties;\n+\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void hpet_device_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n\n\n dc->realize = hpet_realize;\n\n dc->reset = hpet_reset;\n\n dc->vmsd = &vmstate_hpet;\n\n dc->props = hpet_device_properties;\n\n\n\n\n\n\n}"}} {"sample_id": "5f5a1318653c08e435cfa52f60b6a712815b659d_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void virtio_config_writeb(VirtIODevice *vdev, uint32_t addr, uint32_t data)\n \n {\n+\n VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);\n \n uint8_t val = data;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void virtio_config_writeb(VirtIODevice *vdev, uint32_t addr, uint32_t data)\n\n{\n\n VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);\n\n uint8_t val = data;\n\n\n\n if (addr > (vdev->config_len - sizeof(val)))\n\n return;\n\n\n\n stb_p(vdev->config + addr, val);\n\n\n\n if (k->set_config) {\n\n k->set_config(vdev, vdev->config);\n\n }\n\n}\n"}} {"sample_id": "a4a1c70dc759e5b81627e96564f344ab43ea86eb_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n \n \n+ visit_start_list(v, NULL, NULL, 0, &error_abort);\n+\n+ visit_type_int(v, NULL, &i64, &error_abort);\n+\n+ g_assert_cmpint(i64, ==, 1);\n \n visit_type_int(v, NULL, &i64, &error_abort);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_visitor_in_fail_list(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n int64_t i64 = -1;\n\n Visitor *v;\n\n\n\n /* Unvisited list tail */\n\n\n\n v = visitor_input_test_init(data, \"[ 1, 2, 3 ]\");\n\n\n\n visit_start_list(v, NULL, NULL, 0, &error_abort);\n\n visit_type_int(v, NULL, &i64, &error_abort);\n\n g_assert_cmpint(i64, ==, 1);\n\n visit_type_int(v, NULL, &i64, &error_abort);\n\n g_assert_cmpint(i64, ==, 2);\n\n visit_end_list(v, NULL);\n\n /* BUG: unvisited tail not reported; actually not reportable by design */\n\n}\n"}} {"sample_id": "f44d50a94c120135faeba6b4a1e5551b4397810f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n {\n \n int i;\n+\n int32_t *dst = (int32_t *) _dst;\n \n const uint16_t *src = (const uint16_t *) _src;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void hScale16_c(SwsContext *c, int16_t *_dst, int dstW, const uint8_t *_src,\n\n const int16_t *filter,\n\n const int16_t *filterPos, int filterSize)\n\n{\n\n int i;\n\n int32_t *dst = (int32_t *) _dst;\n\n const uint16_t *src = (const uint16_t *) _src;\n\n int bits = av_pix_fmt_descriptors[c->srcFormat].comp[0].depth_minus1;\n\n int sh = (bits <= 7) ? 11 : (bits - 4);\n\n\n\n for (i = 0; i < dstW; i++) {\n\n int j;\n\n int srcPos = filterPos[i];\n\n unsigned int val = 0;\n\n\n\n for (j = 0; j < filterSize; j++) {\n\n val += src[srcPos + j] * filter[filterSize * i + j];\n\n }\n\n // filter=14 bit, input=16 bit, output=30 bit, >> 11 makes 19 bit\n\n dst[i] = FFMIN(val >> sh, (1 << 19) - 1);\n\n }\n\n}\n"}} {"sample_id": "71a2c9b26567e2294b54eedafeb23aee08563de7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void term_init(void)\n \n {\n+\n #if HAVE_TERMIOS_H\n \n if(!run_as_daemon){", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void term_init(void)\n\n{\n\n#if HAVE_TERMIOS_H\n\n if(!run_as_daemon){\n\n struct termios tty;\n\n\n\n tcgetattr (0, &tty);\n\n oldtty = tty;\n\n atexit(term_exit);\n\n\n\n tty.c_iflag &= ~(IGNBRK|BRKINT|PARMRK|ISTRIP\n\n |INLCR|IGNCR|ICRNL|IXON);\n\n tty.c_oflag |= OPOST;\n\n tty.c_lflag &= ~(ECHO|ECHONL|ICANON|IEXTEN);\n\n tty.c_cflag &= ~(CSIZE|PARENB);\n\n tty.c_cflag |= CS8;\n\n tty.c_cc[VMIN] = 1;\n\n tty.c_cc[VTIME] = 0;\n\n\n\n tcsetattr (0, TCSANOW, &tty);\n\n signal(SIGQUIT, sigterm_handler); /* Quit (POSIX). */\n\n }\n\n#endif\n\n avformat_network_deinit();\n\n\n\n signal(SIGINT , sigterm_handler); /* Interrupt (ANSI). */\n\n signal(SIGTERM, sigterm_handler); /* Termination (ANSI). */\n\n#ifdef SIGXCPU\n\n signal(SIGXCPU, sigterm_handler);\n\n#endif\n\n}\n"}} {"sample_id": "bdcc3a28b7f6ed6b90ad8b8af7b5d17e0d3f1f06", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n if (graphic_rotate && (evt->kind == INPUT_EVENT_KIND_ABS)) {\n \n qemu_input_transform_abs_rotate(evt);\n+\n+\n+\n+\n+ /* send event */\n \n s = qemu_input_find_handler(1 << evt->kind);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void qemu_input_event_send(QemuConsole *src, InputEvent *evt)\n\n{\n\n QemuInputHandlerState *s;\n\n\n\n if (!runstate_is_running() && !runstate_check(RUN_STATE_SUSPENDED)) {\n\n\n\n\n\n qemu_input_event_trace(src, evt);\n\n\n\n /* pre processing */\n\n if (graphic_rotate && (evt->kind == INPUT_EVENT_KIND_ABS)) {\n\n qemu_input_transform_abs_rotate(evt);\n\n\n\n\n /* send event */\n\n s = qemu_input_find_handler(1 << evt->kind);\n\n\n\n\n s->handler->event(s->dev, src, evt);\n\n s->events++;\n"}} {"sample_id": "15455536df5ef652759ccf465d5e6f73acb493df", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static inline void os_host_main_loop_wait(int *timeout)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void os_host_main_loop_wait(int *timeout)\n\n{\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_303", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,6 +8,6 @@\n \n int id = get_current_cpu(s);\n \n+ return timerblock_read(&s->timerblock[id * 2], addr, size);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t arm_thistimer_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n arm_mptimer_state *s = (arm_mptimer_state *)opaque;\n\n int id = get_current_cpu(s);\n\n return timerblock_read(&s->timerblock[id * 2], addr, size);\n\n}\n"}} {"sample_id": "2d0d2837dcf786da415cf4165d37f4ddd684ff57_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void default_drive(int enable, int snapshot, int use_scsi,\n \n+ BlockInterfaceType type, int index,\n+\n+ const char *optstr)\n+\n+{\n \n QemuOpts *opts;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void default_drive(int enable, int snapshot, int use_scsi,\n\n BlockInterfaceType type, int index,\n\n const char *optstr)\n\n{\n\n QemuOpts *opts;\n\n\n\n if (type == IF_DEFAULT) {\n\n type = use_scsi ? IF_SCSI : IF_IDE;\n\n }\n\n\n\n if (!enable || drive_get_by_index(type, index)) {\n\n return;\n\n }\n\n\n\n opts = drive_add(type, index, NULL, optstr);\n\n if (snapshot) {\n\n drive_enable_snapshot(opts, NULL);\n\n }\n\n if (!drive_init(opts, use_scsi)) {\n\n exit(1);\n\n }\n\n}\n"}} {"sample_id": "f9dc175d84802e9a00161bc8d4356b90d6c52125", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n int64_t cpu_id;\n \n+\n+\n+ cpu_id = k->get_arch_id(cpu);\n+\n+ if ((cpu_id / 8) >= ACPI_GPE_PROC_LEN) {\n \n error_setg(errp, \"acpi: invalid cpu id: %\" PRIi64, cpu_id);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void acpi_set_cpu_present_bit(AcpiCpuHotplug *g, CPUState *cpu,\n\n Error **errp)\n\n{\n\n CPUClass *k = CPU_GET_CLASS(cpu);\n\n int64_t cpu_id;\n\n\n\n cpu_id = k->get_arch_id(cpu);\n\n if ((cpu_id / 8) >= ACPI_GPE_PROC_LEN) {\n\n error_setg(errp, \"acpi: invalid cpu id: %\" PRIi64, cpu_id);\n\n return;\n\n }\n\n\n\n g->sts[cpu_id / 8] |= (1 << (cpu_id % 8));\n\n}\n"}} {"sample_id": "673b0d7ccc34e9617d99ed4c29caa964f19a4c5a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n uint8_t offset, uint8_t size)\n \n+{\n+\n int ret;\n \n+ Error *local_err = NULL;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int pci_add_capability(PCIDevice *pdev, uint8_t cap_id,\n\n uint8_t offset, uint8_t size)\n\n{\n\n int ret;\n\n Error *local_err = NULL;\n\n\n\n ret = pci_add_capability2(pdev, cap_id, offset, size, &local_err);\n\n if (local_err) {\n\n assert(ret < 0);\n\n error_report_err(local_err);\n\n } else {\n\n /* success implies a positive offset in config space */\n\n assert(ret > 0);\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "22d716c28e95e4640e2cd80553eb3f662db3fd50", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n static ExitStatus gen_bcond(DisasContext *ctx, TCGCond cond, int ra,\n+\n int32_t disp, int mask)\n+\n+{\n \n+ TCGv cmp_tmp;\n \n+\n \n if (mask) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static ExitStatus gen_bcond(DisasContext *ctx, TCGCond cond, int ra,\n\n int32_t disp, int mask)\n\n{\n\n TCGv cmp_tmp;\n\n\n\n if (mask) {\n\n cmp_tmp = tcg_temp_new();\n\n tcg_gen_andi_i64(cmp_tmp, load_gpr(ctx, ra), 1);\n\n } else {\n\n cmp_tmp = load_gpr(ctx, ra);\n\n }\n\n\n\n return gen_bcond_internal(ctx, cond, cmp_tmp, disp);\n\n}\n"}} {"sample_id": "4d68e86bb10159099da0798f74e7512955f15eec", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,10 +14,10 @@\n \n qemu_coroutine_delete(co);\n \n+ }\n+\n+\n+\n+ qemu_mutex_destroy(&pool_lock);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void __attribute__((destructor)) coroutine_pool_cleanup(void)\n\n{\n\n Coroutine *co;\n\n Coroutine *tmp;\n\n\n\n QSLIST_FOREACH_SAFE(co, &pool, pool_next, tmp) {\n\n QSLIST_REMOVE_HEAD(&pool, pool_next);\n\n qemu_coroutine_delete(co);\n\n }\n\n\n\n qemu_mutex_destroy(&pool_lock);\n\n}\n"}} {"sample_id": "4f5e19e6c570459cd524b29b24374f03860f5149", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,8 +26,8 @@\n \n sysbus_init_mmio(dev, 0x1000, pci_mem_config);\n \n+ sysbus_init_mmio(dev, 0x1000, pci_mem_data);\n+\n+ return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pci_dec_21154_init_device(SysBusDevice *dev)\n\n{\n\n UNINState *s;\n\n int pci_mem_config, pci_mem_data;\n\n\n\n /* Uninorth bridge */\n\n s = FROM_SYSBUS(UNINState, dev);\n\n\n\n // XXX: s = &pci_bridge[2];\n\n pci_mem_config = cpu_register_io_memory(pci_unin_config_read,\n\n pci_unin_config_write, s);\n\n pci_mem_data = cpu_register_io_memory(pci_unin_main_read,\n\n pci_unin_main_write, &s->host_state);\n\n sysbus_init_mmio(dev, 0x1000, pci_mem_config);\n\n sysbus_init_mmio(dev, 0x1000, pci_mem_data);\n\n return 0;\n\n}\n"}} {"sample_id": "ad674e53b5cce265fadafbde2c6a4f190345cd00_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -41,11 +41,11 @@\n val >>= 24;\n \n \n+\n+ cpu_physical_memory_write(addr, (uint8_t*)&val, len);\n+\n+\n+\n if (conditional_wait(ch))\n \n goto wait;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void store_word(DBDMA_channel *ch, int key, uint32_t addr,\n\n uint16_t len)\n\n{\n\n dbdma_cmd *current = &ch->current;\n\n uint32_t val;\n\n\n\n DBDMA_DPRINTF(\"store_word\\n\");\n\n\n\n /* only implements KEY_SYSTEM */\n\n\n\n if (key != KEY_SYSTEM) {\n\n printf(\"DBDMA: STORE_WORD, unimplemented key %x\\n\", key);\n\n kill_channel(ch);\n\n return;\n\n }\n\n\n\n val = current->cmd_dep;\n\n if (len == 2)\n\n val >>= 16;\n\n else if (len == 1)\n\n val >>= 24;\n\n\n\n cpu_physical_memory_write(addr, (uint8_t*)&val, len);\n\n\n\n if (conditional_wait(ch))\n\n goto wait;\n\n\n\n current->xfer_status = cpu_to_le16(be32_to_cpu(ch->regs[DBDMA_STATUS]));\n\n dbdma_cmdptr_save(ch);\n\n ch->regs[DBDMA_STATUS] &= cpu_to_be32(~FLUSH);\n\n\n\n conditional_interrupt(ch);\n\n next(ch);\n\n\n\nwait:\n\n qemu_bh_schedule(dbdma_bh);\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ return bs->open_flags;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int bdrv_get_flags(BlockDriverState *bs)\n\n{\n\n return bs->open_flags;\n\n}\n"}} {"sample_id": "f8593c2f492a514b67533a877b716a25d3770418", "diff": "--- a/source.c\n+++ b/source.c\n@@ -61,11 +61,11 @@\n if ((ret = ff_get_buffer(avctx, picture, 0)) < 0)\n return ret;\n planes[0] = img->planes[VPX_PLANE_Y];\n+ planes[1] = img->planes[VPX_PLANE_U];\n+ planes[2] = img->planes[VPX_PLANE_V];\n+ planes[3] =\n+ ctx->has_alpha_channel ? img_alpha->planes[VPX_PLANE_Y] : NULL;\n+ linesizes[0] = img->stride[VPX_PLANE_Y];\n linesizes[1] = img->stride[VPX_PLANE_U];\n linesizes[2] = img->stride[VPX_PLANE_V];\n linesizes[3] =", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int vpx_decode(AVCodecContext *avctx,\n void *data, int *got_frame, AVPacket *avpkt)\n{\n VPxContext *ctx = avctx->priv_data;\n AVFrame *picture = data;\n const void *iter = NULL;\n const void *iter_alpha = NULL;\n struct vpx_image *img, *img_alpha;\n int ret;\n uint8_t *side_data = NULL;\n int side_data_size = 0;\n ret = decode_frame(avctx, &ctx->decoder, avpkt->data, avpkt->size);\n if (ret)\n return ret;\n side_data = av_packet_get_side_data(avpkt,\n AV_PKT_DATA_MATROSKA_BLOCKADDITIONAL,\n &side_data_size);\n if (side_data_size > 1) {\n const uint64_t additional_id = AV_RB64(side_data);\n side_data += 8;\n side_data_size -= 8;\n if (additional_id == 1) { // 1 stands for alpha channel data.\n if (!ctx->has_alpha_channel) {\n ctx->has_alpha_channel = 1;\n ret = vpx_init(avctx,\n#if CONFIG_LIBVPX_VP8_DECODER && CONFIG_LIBVPX_VP9_DECODER\n (avctx->codec_id == AV_CODEC_ID_VP8) ?\n &vpx_codec_vp8_dx_algo : &vpx_codec_vp9_dx_algo,\n#elif CONFIG_LIBVPX_VP8_DECODER\n &vpx_codec_vp8_dx_algo,\n#else\n &vpx_codec_vp9_dx_algo,\n#endif\n 1);\n if (ret)\n return ret;\n ret = decode_frame(avctx, &ctx->decoder_alpha, side_data,\n side_data_size);\n if (ret)\n return ret;\n if ((img = vpx_codec_get_frame(&ctx->decoder, &iter)) &&\n (!ctx->has_alpha_channel ||\n (img_alpha = vpx_codec_get_frame(&ctx->decoder_alpha, &iter_alpha)))) {\n uint8_t *planes[4];\n int linesizes[4];\n if ((ret = set_pix_fmt(avctx, img, ctx->has_alpha_channel)) < 0) {\n#ifdef VPX_IMG_FMT_HIGHBITDEPTH\n av_log(avctx, AV_LOG_ERROR, \"Unsupported output colorspace (%d) / bit_depth (%d)\\n\",\n img->fmt, img->bit_depth);\n#else\n av_log(avctx, AV_LOG_ERROR, \"Unsupported output colorspace (%d) / bit_depth (%d)\\n\",\n img->fmt, 8);\n#endif\n return ret;\n if ((int) img->d_w != avctx->width || (int) img->d_h != avctx->height) {\n av_log(avctx, AV_LOG_INFO, \"dimension change! %dx%d -> %dx%d\\n\",\n avctx->width, avctx->height, img->d_w, img->d_h);\n ret = ff_set_dimensions(avctx, img->d_w, img->d_h);\n if (ret < 0)\n return ret;\n if ((ret = ff_get_buffer(avctx, picture, 0)) < 0)\n return ret;\n planes[0] = img->planes[VPX_PLANE_Y];\n planes[1] = img->planes[VPX_PLANE_U];\n planes[2] = img->planes[VPX_PLANE_V];\n planes[3] =\n ctx->has_alpha_channel ? img_alpha->planes[VPX_PLANE_Y] : NULL;\n linesizes[0] = img->stride[VPX_PLANE_Y];\n linesizes[1] = img->stride[VPX_PLANE_U];\n linesizes[2] = img->stride[VPX_PLANE_V];\n linesizes[3] =\n ctx->has_alpha_channel ? img_alpha->stride[VPX_PLANE_Y] : 0;\n av_image_copy(picture->data, picture->linesize, (const uint8_t**)planes,\n linesizes, avctx->pix_fmt, img->d_w, img->d_h);\n *got_frame = 1;\n return avpkt->size;"}} {"sample_id": "15d61692da651fc79b3fc40050b986c5a73055c0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ SaveState *state = opaque;\n \n const char *current_name = MACHINE_GET_CLASS(current_machine)->name;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int configuration_post_load(void *opaque, int version_id)\n\n{\n\n SaveState *state = opaque;\n\n const char *current_name = MACHINE_GET_CLASS(current_machine)->name;\n\n\n\n if (strncmp(state->name, current_name, state->len) != 0) {\n\n error_report(\"Machine type received is '%s' and local is '%s'\",\n\n state->name, current_name);\n\n return -EINVAL;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "aa92d6c4609e174fc6884e4b7b87367fac33cbe9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n \n \n while (!task.complete) {\n+\n+ nfs_set_events(client);\n+\n+ aio_poll(client->aio_context, true);\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int64_t nfs_get_allocated_file_size(BlockDriverState *bs)\n\n{\n\n NFSClient *client = bs->opaque;\n\n NFSRPC task = {0};\n\n struct stat st;\n\n\n\n if (bdrv_is_read_only(bs) &&\n\n !(bs->open_flags & BDRV_O_NOCACHE)) {\n\n return client->st_blocks * 512;\n\n }\n\n\n\n task.st = &st;\n\n if (nfs_fstat_async(client->context, client->fh, nfs_co_generic_cb,\n\n &task) != 0) {\n\n return -ENOMEM;\n\n }\n\n\n\n while (!task.complete) {\n\n nfs_set_events(client);\n\n aio_poll(client->aio_context, true);\n\n }\n\n\n\n return (task.ret < 0 ? task.ret : st.st_blocks * 512);\n\n}\n"}} {"sample_id": "a89f364ae8740dfc31b321eed9ee454e996dc3c1_32", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n uint64_t value, unsigned size)\n \n+{\n+\n+ PXA2xxPICState *s = (PXA2xxPICState *) opaque;\n+\n+\n \n switch (offset) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pxa2xx_pic_mem_write(void *opaque, hwaddr offset,\n\n uint64_t value, unsigned size)\n\n{\n\n PXA2xxPICState *s = (PXA2xxPICState *) opaque;\n\n\n\n switch (offset) {\n\n case ICMR:\t/* Mask register */\n\n s->int_enabled[0] = value;\n\n break;\n\n case ICMR2:\t/* Mask register 2 */\n\n s->int_enabled[1] = value;\n\n break;\n\n case ICLR:\t/* Level register */\n\n s->is_fiq[0] = value;\n\n break;\n\n case ICLR2:\t/* Level register 2 */\n\n s->is_fiq[1] = value;\n\n break;\n\n case ICCR:\t/* Idle mask */\n\n s->int_idle = (value & 1) ? 0 : ~0;\n\n break;\n\n case IPR0 ... IPR31:\n\n s->priority[0 + ((offset - IPR0 ) >> 2)] = value & 0x8000003f;\n\n break;\n\n case IPR32 ... IPR39:\n\n s->priority[32 + ((offset - IPR32) >> 2)] = value & 0x8000003f;\n\n break;\n\n default:\n\n printf(\"%s: Bad register offset \" REG_FMT \"\\n\", __FUNCTION__, offset);\n\n return;\n\n }\n\n pxa2xx_pic_update(opaque);\n\n}\n"}} {"sample_id": "ac4b32df71bd932838043a4838b86d11e169707f_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n+static av_always_inline void filter_common(uint8_t *p, ptrdiff_t stride,\n+\n int is4tap)\n \n {\n \n LOAD_PIXELS\n+\n int a, f1, f2;\n \n const uint8_t *cm = ff_crop_tab + MAX_NEG_CROP;\n+\n \n \n a = 3 * (q0 - p0);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static av_always_inline void filter_common(uint8_t *p, ptrdiff_t stride,\n\n int is4tap)\n\n{\n\n LOAD_PIXELS\n\n int a, f1, f2;\n\n const uint8_t *cm = ff_crop_tab + MAX_NEG_CROP;\n\n\n\n a = 3 * (q0 - p0);\n\n\n\n if (is4tap)\n\n a += clip_int8(p1 - q1);\n\n\n\n a = clip_int8(a);\n\n\n\n // We deviate from the spec here with c(a+3) >> 3\n\n // since that's what libvpx does.\n\n f1 = FFMIN(a + 4, 127) >> 3;\n\n f2 = FFMIN(a + 3, 127) >> 3;\n\n\n\n // Despite what the spec says, we do need to clamp here to\n\n // be bitexact with libvpx.\n\n p[-1 * stride] = cm[p0 + f2];\n\n p[ 0 * stride] = cm[q0 - f1];\n\n\n\n // only used for _inner on blocks without high edge variance\n\n if (!is4tap) {\n\n a = (f1 + 1) >> 1;\n\n p[-2 * stride] = cm[p1 + a];\n\n p[ 1 * stride] = cm[q1 - a];\n\n }\n\n}\n"}} {"sample_id": "ef1e1e0782e99c9dcf2b35e5310cdd8ca9211374_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -41,11 +41,11 @@\n sd_set_cardstatus(sd);\n \n sd_set_sdstatus(sd);\n+\n+\n+\n+ if (sd->wp_groups)\n+\n g_free(sd->wp_groups);\n \n sd->wp_switch = sd->blk ? blk_is_read_only(sd->blk) : false;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void sd_reset(SDState *sd)\n\n{\n\n uint64_t size;\n\n uint64_t sect;\n\n\n\n if (sd->blk) {\n\n blk_get_geometry(sd->blk, §);\n\n } else {\n\n sect = 0;\n\n }\n\n size = sect << 9;\n\n\n\n sect = sd_addr_to_wpnum(size) + 1;\n\n\n\n sd->state = sd_idle_state;\n\n sd->rca = 0x0000;\n\n sd_set_ocr(sd);\n\n sd_set_scr(sd);\n\n sd_set_cid(sd);\n\n sd_set_csd(sd, size);\n\n sd_set_cardstatus(sd);\n\n sd_set_sdstatus(sd);\n\n\n\n if (sd->wp_groups)\n\n g_free(sd->wp_groups);\n\n sd->wp_switch = sd->blk ? blk_is_read_only(sd->blk) : false;\n\n sd->wpgrps_size = sect;\n\n sd->wp_groups = bitmap_new(sd->wpgrps_size);\n\n memset(sd->function_group, 0, sizeof(sd->function_group));\n\n sd->erase_start = 0;\n\n sd->erase_end = 0;\n\n sd->size = size;\n\n sd->blk_len = 0x200;\n\n sd->pwd_len = 0;\n\n sd->expecting_acmd = false;\n\n}\n"}} {"sample_id": "2ff30257974e19ebe2a97baad32ac29c06da5fb9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void qmp_migrate_set_downtime(double value, Error **errp)\n \n {\n+\n+ value *= 1e9;\n \n value = MAX(0, MIN(UINT64_MAX, value));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qmp_migrate_set_downtime(double value, Error **errp)\n\n{\n\n value *= 1e9;\n\n value = MAX(0, MIN(UINT64_MAX, value));\n\n max_downtime = (uint64_t)value;\n\n}\n"}} {"sample_id": "dfd100f242370886bb6732f70f1f7cbd8eb9fedc_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n \n \n+ if (!ioc) {\n+\n+ error_setg(errp, \"No listener socket available\");\n+\n+ return;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vnc_init_basic_info_from_server_addr(QIOChannelSocket *ioc,\n\n VncBasicInfo *info,\n\n Error **errp)\n\n{\n\n SocketAddress *addr = NULL;\n\n\n\n if (!ioc) {\n\n error_setg(errp, \"No listener socket available\");\n\n return;\n\n }\n\n\n\n addr = qio_channel_socket_get_local_address(ioc, errp);\n\n if (!addr) {\n\n return;\n\n }\n\n\n\n vnc_init_basic_info(addr, info, errp);\n\n qapi_free_SocketAddress(addr);\n\n}\n"}} {"sample_id": "c169998802505c244b8bcad562633f29de7d74a4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n for (i=0; itimer[i];\n+\n+ timer->qemu_timer = qemu_new_timer(vm_clock, hpet_timer, timer);\n+\n+ }\n \n hpet_reset(s);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void hpet_init(qemu_irq *irq) {\n\n int i, iomemtype;\n\n HPETState *s;\n\n\n\n dprintf (\"hpet_init\\n\");\n\n\n\n s = qemu_mallocz(sizeof(HPETState));\n\n hpet_statep = s;\n\n s->irqs = irq;\n\n for (i=0; itimer[i];\n\n timer->qemu_timer = qemu_new_timer(vm_clock, hpet_timer, timer);\n\n }\n\n hpet_reset(s);\n\n vmstate_register(-1, &vmstate_hpet, s);\n\n qemu_register_reset(hpet_reset, s);\n\n /* HPET Area */\n\n iomemtype = cpu_register_io_memory(hpet_ram_read,\n\n hpet_ram_write, s);\n\n cpu_register_physical_memory(HPET_BASE, 0x400, iomemtype);\n\n}\n"}} {"sample_id": "560f19f162529d691619ac69ed032321c7f5f1fb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,7 +12,7 @@\n \n \n \n+ if (!ret) {\n \n return -1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int64_t object_property_get_int(Object *obj, const char *name,\n\n Error **errp)\n\n{\n\n QObject *ret = object_property_get_qobject(obj, name, errp);\n\n QInt *qint;\n\n int64_t retval;\n\n\n\n if (!ret) {\n\n return -1;\n\n }\n\n qint = qobject_to_qint(ret);\n\n if (!qint) {\n\n error_setg(errp, QERR_INVALID_PARAMETER_TYPE, name, \"int\");\n\n retval = -1;\n\n } else {\n\n retval = qint_get_int(qint);\n\n }\n\n\n\n QDECREF(qint);\n\n return retval;\n\n}\n"}} {"sample_id": "aedbe19297907143f17b733a7ff0e0534377bed1_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void qemu_system_reset(bool report)\n \n {\n \n@@ -7,7 +7,7 @@\n \n \n mc = current_machine ? MACHINE_GET_CLASS(current_machine) : NULL;\n+\n \n \n cpu_synchronize_all_states();", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void qemu_system_reset(bool report)\n\n{\n\n MachineClass *mc;\n\n\n\n mc = current_machine ? MACHINE_GET_CLASS(current_machine) : NULL;\n\n\n\n cpu_synchronize_all_states();\n\n\n\n if (mc && mc->reset) {\n\n mc->reset();\n\n } else {\n\n qemu_devices_reset();\n\n }\n\n if (report) {\n\n qapi_event_send_reset(&error_abort);\n\n }\n\n cpu_synchronize_all_post_reset();\n\n}\n"}} {"sample_id": "494a8ebe713055d3946183f4b395f85a18b43e9e_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n {\n \n ssize_t ret;\n+\n+#ifdef CONFIG_PREADV\n+\n+ ret = preadv(fs->fd, iov, iovcnt, offset);\n+\n #else\n \n ret = lseek(fs->fd, offset, SEEK_SET);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ssize_t proxy_preadv(FsContext *ctx, V9fsFidOpenState *fs,\n\n const struct iovec *iov,\n\n int iovcnt, off_t offset)\n\n{\n\n ssize_t ret;\n\n#ifdef CONFIG_PREADV\n\n ret = preadv(fs->fd, iov, iovcnt, offset);\n\n#else\n\n ret = lseek(fs->fd, offset, SEEK_SET);\n\n if (ret >= 0) {\n\n ret = readv(fs->fd, iov, iovcnt);\n\n }\n\n#endif\n\n return ret;\n\n}\n"}} {"sample_id": "223d996aaf9f1668c28519d3d7eb756e6cdf3fcf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n else{\n \n+ int i, e, a;\n \n e= 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static inline int get_symbol(RangeCoder *c, uint8_t *state, int is_signed){\n\n if(get_rac(c, state+0))\n\n return 0;\n\n else{\n\n int i, e, a;\n\n e= 0;\n\n while(get_rac(c, state+1 + e)){ //1..10\n\n e++;\n\n }\n\n assert(e<=9);\n\n\n\n a= 1;\n\n for(i=e-1; i>=0; i--){\n\n a += a + get_rac(c, state+22 + i); //22..31\n\n }\n\n\n\n if(is_signed && get_rac(c, state+11 + e)) //11..21\n\n return -a;\n\n else\n\n return a;\n\n }\n\n}\n"}} {"sample_id": "47f0beadba9003391d8bfef59b15aa21a5b2d293", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void cin_decode_rle(const unsigned char *src, int src_size, unsigned char *dst, int dst_size)\n \n {\n \n+ int len, code;\n \n unsigned char *dst_end = dst + dst_size;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void cin_decode_rle(const unsigned char *src, int src_size, unsigned char *dst, int dst_size)\n\n{\n\n int len, code;\n\n unsigned char *dst_end = dst + dst_size;\n\n const unsigned char *src_end = src + src_size;\n\n\n\n while (src < src_end && dst < dst_end) {\n\n code = *src++;\n\n if (code & 0x80) {\n\n len = code - 0x7F;\n\n memset(dst, *src++, FFMIN(len, dst_end - dst));\n\n } else {\n\n len = code + 1;\n\n memcpy(dst, src, FFMIN(len, dst_end - dst));\n\n src += len;\n\n }\n\n dst += len;\n\n }\n\n}\n"}} {"sample_id": "4f298a4b2957b7833bc607c951ca27c458d98d88_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void chassis_control(IPMIBmcSim *ibs,\n \n uint8_t *cmd, unsigned int cmd_len,\n+\n uint8_t *rsp, unsigned int *rsp_len,\n \n unsigned int max_rsp_len)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void chassis_control(IPMIBmcSim *ibs,\n\n uint8_t *cmd, unsigned int cmd_len,\n\n uint8_t *rsp, unsigned int *rsp_len,\n\n unsigned int max_rsp_len)\n\n{\n\n IPMIInterface *s = ibs->parent.intf;\n\n IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s);\n\n\n\n IPMI_CHECK_CMD_LEN(3);\n\n switch (cmd[2] & 0xf) {\n\n case 0: /* power down */\n\n rsp[2] = k->do_hw_op(s, IPMI_POWEROFF_CHASSIS, 0);\n\n break;\n\n case 1: /* power up */\n\n rsp[2] = k->do_hw_op(s, IPMI_POWERON_CHASSIS, 0);\n\n break;\n\n case 2: /* power cycle */\n\n rsp[2] = k->do_hw_op(s, IPMI_POWERCYCLE_CHASSIS, 0);\n\n break;\n\n case 3: /* hard reset */\n\n rsp[2] = k->do_hw_op(s, IPMI_RESET_CHASSIS, 0);\n\n break;\n\n case 4: /* pulse diagnostic interrupt */\n\n rsp[2] = k->do_hw_op(s, IPMI_PULSE_DIAG_IRQ, 0);\n\n break;\n\n case 5: /* soft shutdown via ACPI by overtemp emulation */\n\n rsp[2] = k->do_hw_op(s,\n\n IPMI_SHUTDOWN_VIA_ACPI_OVERTEMP, 0);\n\n break;\n\n default:\n\n rsp[2] = IPMI_CC_INVALID_DATA_FIELD;\n\n return;\n\n }\n\n}\n"}} {"sample_id": "13f59ae8157e8ec238fa8aefe5309909a1eeb7e2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,10 +28,10 @@\n \n va_end(ap);\n \n+ err->msg = qerror_format(fmt, err->obj);\n+\n+\n+\n+ *errp = err;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void error_set(Error **errp, const char *fmt, ...)\n\n{\n\n Error *err;\n\n va_list ap;\n\n\n\n if (errp == NULL) {\n\n return;\n\n }\n\n assert(*errp == NULL);\n\n\n\n err = g_malloc0(sizeof(*err));\n\n\n\n va_start(ap, fmt);\n\n err->obj = qobject_to_qdict(qobject_from_jsonv(fmt, &ap));\n\n va_end(ap);\n\n err->msg = qerror_format(fmt, err->obj);\n\n\n\n *errp = err;\n\n}\n"}} {"sample_id": "7d553f27fce284805d7f94603932045ee3bbb979", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n if (dev->attached) {\n \n+ usb_device_detach(dev);\n+\n+ }\n+\n+ usb_device_handle_destroy(dev);\n \n if (dev->port) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int usb_qdev_exit(DeviceState *qdev)\n\n{\n\n USBDevice *dev = USB_DEVICE(qdev);\n\n\n\n if (dev->attached) {\n\n usb_device_detach(dev);\n\n }\n\n usb_device_handle_destroy(dev);\n\n if (dev->port) {\n\n usb_release_port(dev);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "db486cc334aafd3dbdaf107388e37fc3d6d3e171", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static bool ranges_can_merge(Range *range1, Range *range2)\n+\n {\n \n return !(range1->end < range2->begin || range2->end < range1->begin);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static bool ranges_can_merge(Range *range1, Range *range2)\n\n{\n\n return !(range1->end < range2->begin || range2->end < range1->begin);\n\n}\n"}} {"sample_id": "d509c743b78da198af385fea362b632292cd00ad", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n c->dv_demux = dv_init_demux(s);\n \n if (!c->dv_demux)\n+\n return -1;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int dv_read_header(AVFormatContext *s,\n\n AVFormatParameters *ap)\n\n{\n\n unsigned state;\n\n RawDVContext *c = s->priv_data;\n\n\n\n c->dv_demux = dv_init_demux(s);\n\n if (!c->dv_demux)\n\n return -1;\n\n\n\n state = get_be32(s->pb);\n\n while ((state & 0xffffff7f) != 0x1f07003f) {\n\n if (url_feof(s->pb)) {\n\n av_log(s, AV_LOG_ERROR, \"Cannot find DV header.\\n\");\n\n return -1;\n\n }\n\n state = (state << 8) | get_byte(s->pb);\n\n }\n\n AV_WB32(c->buf, state);\n\n\n\n if (get_buffer(s->pb, c->buf + 4, DV_PROFILE_BYTES - 4) <= 0 ||\n\n url_fseek(s->pb, -DV_PROFILE_BYTES, SEEK_CUR) < 0)\n\n return AVERROR(EIO);\n\n\n\n c->dv_demux->sys = dv_frame_profile(c->buf);\n\n if (!c->dv_demux->sys) {\n\n av_log(s, AV_LOG_ERROR, \"Can't determine profile of DV input stream.\\n\");\n\n return -1;\n\n }\n\n\n\n s->bit_rate = av_rescale_q(c->dv_demux->sys->frame_size, (AVRational){8,1},\n\n c->dv_demux->sys->time_base);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "4871b51b9241b10f4fd8e04bbb21577886795e25_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void vmgenid_set_guid_auto_test(void)\n+\n {\n+\n const char *cmd;\n \n QemuUUID measured;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void vmgenid_set_guid_auto_test(void)\n\n{\n\n const char *cmd;\n\n QemuUUID measured;\n\n\n\n cmd = \"-machine accel=tcg -device vmgenid,id=testvgid,\" \"guid=auto\";\n\n qtest_start(cmd);\n\n\n\n read_guid_from_memory(&measured);\n\n\n\n /* Just check that the GUID is non-null */\n\n g_assert(!qemu_uuid_is_null(&measured));\n\n\n\n qtest_quit(global_qtest);\n\n}\n"}} {"sample_id": "f9f9ae1b77e4fb1bffa6b23be7bd20e514b8ba7b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n if (bit_depth == 8) {\n \n+ c->h264_v_loop_filter_luma = ff_h264_v_loop_filter_luma_neon;\n+\n+ c->h264_h_loop_filter_luma = ff_h264_h_loop_filter_luma_neon;\n+\n+ if(chroma_format_idc == 1){\n \n c->h264_v_loop_filter_chroma = ff_h264_v_loop_filter_chroma_neon;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold void h264dsp_init_neon(H264DSPContext *c, const int bit_depth,\n\n const int chroma_format_idc)\n\n{\n\n#if HAVE_NEON\n\n if (bit_depth == 8) {\n\n c->h264_v_loop_filter_luma = ff_h264_v_loop_filter_luma_neon;\n\n c->h264_h_loop_filter_luma = ff_h264_h_loop_filter_luma_neon;\n\n if(chroma_format_idc == 1){\n\n c->h264_v_loop_filter_chroma = ff_h264_v_loop_filter_chroma_neon;\n\n c->h264_h_loop_filter_chroma = ff_h264_h_loop_filter_chroma_neon;\n\n }\n\n\n\n c->weight_h264_pixels_tab[0] = ff_weight_h264_pixels_16_neon;\n\n c->weight_h264_pixels_tab[1] = ff_weight_h264_pixels_8_neon;\n\n c->weight_h264_pixels_tab[2] = ff_weight_h264_pixels_4_neon;\n\n\n\n c->biweight_h264_pixels_tab[0] = ff_biweight_h264_pixels_16_neon;\n\n c->biweight_h264_pixels_tab[1] = ff_biweight_h264_pixels_8_neon;\n\n c->biweight_h264_pixels_tab[2] = ff_biweight_h264_pixels_4_neon;\n\n\n\n c->h264_idct_add = ff_h264_idct_add_neon;\n\n c->h264_idct_dc_add = ff_h264_idct_dc_add_neon;\n\n c->h264_idct_add16 = ff_h264_idct_add16_neon;\n\n c->h264_idct_add16intra = ff_h264_idct_add16intra_neon;\n\n if (chroma_format_idc <= 1)\n\n c->h264_idct_add8 = ff_h264_idct_add8_neon;\n\n c->h264_idct8_add = ff_h264_idct8_add_neon;\n\n c->h264_idct8_dc_add = ff_h264_idct8_dc_add_neon;\n\n c->h264_idct8_add4 = ff_h264_idct8_add4_neon;\n\n }\n\n#endif // HAVE_NEON\n\n}\n"}} {"sample_id": "323e6fead07c75f418e4b60704a4f437bb3483b2_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n int blk, ch;\n \n \n+\n for (ch = 0; ch < s->channels; ch++) {\n \n for (blk = 0; blk < AC3_MAX_BLOCKS; blk++) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void apply_mdct(AC3EncodeContext *s)\n\n{\n\n int blk, ch;\n\n\n\n for (ch = 0; ch < s->channels; ch++) {\n\n for (blk = 0; blk < AC3_MAX_BLOCKS; blk++) {\n\n AC3Block *block = &s->blocks[blk];\n\n const SampleType *input_samples = &s->planar_samples[ch][blk * AC3_BLOCK_SIZE];\n\n\n\n apply_window(&s->dsp, s->windowed_samples, input_samples, s->mdct.window, AC3_WINDOW_SIZE);\n\n\n\n block->exp_shift[ch] = normalize_samples(s);\n\n\n\n mdct512(&s->mdct, block->mdct_coef[ch], s->windowed_samples);\n\n }\n\n }\n\n}\n"}} {"sample_id": "d21e8776f6578be155714ae95c7d6c1bb03e8e34", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n qemu_mutex_init(&iothread->init_done_lock);\n \n+ qemu_cond_init(&iothread->init_done_cond);\n+\n+\n+\n+ /* This assumes we are called from a thread with useful CPU affinity for us\n \n * to inherit.\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void iothread_complete(UserCreatable *obj, Error **errp)\n\n{\n\n Error *local_error = NULL;\n\n IOThread *iothread = IOTHREAD(obj);\n\n\n\n iothread->stopping = false;\n\n iothread->thread_id = -1;\n\n iothread->ctx = aio_context_new(&local_error);\n\n if (!iothread->ctx) {\n\n error_propagate(errp, local_error);\n\n return;\n\n }\n\n\n\n qemu_mutex_init(&iothread->init_done_lock);\n\n qemu_cond_init(&iothread->init_done_cond);\n\n\n\n /* This assumes we are called from a thread with useful CPU affinity for us\n\n * to inherit.\n\n */\n\n qemu_thread_create(&iothread->thread, \"iothread\", iothread_run,\n\n iothread, QEMU_THREAD_JOINABLE);\n\n\n\n /* Wait for initialization to complete */\n\n qemu_mutex_lock(&iothread->init_done_lock);\n\n while (iothread->thread_id == -1) {\n\n qemu_cond_wait(&iothread->init_done_cond,\n\n &iothread->init_done_lock);\n\n }\n\n qemu_mutex_unlock(&iothread->init_done_lock);\n\n}\n"}} {"sample_id": "0886267e3cc4ce12bcd48b712d8affa8c953bc38", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,9 +15,9 @@\n p = strchr(arg, ':');\n \n if (p) {\n+\n+ x = strtol(arg, &end, 10);\n+\n if (end == p)\n \n y = strtol(end+1, &end, 10);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void opt_frame_aspect_ratio(const char *arg)\n\n{\n\n int x = 0, y = 0;\n\n double ar = 0;\n\n const char *p;\n\n char *end;\n\n\n\n p = strchr(arg, ':');\n\n if (p) {\n\n x = strtol(arg, &end, 10);\n\n if (end == p)\n\n y = strtol(end+1, &end, 10);\n\n if (x > 0 && y > 0)\n\n ar = (double)x / (double)y;\n\n } else\n\n ar = strtod(arg, NULL);\n\n\n\n if (!ar) {\n\n fprintf(stderr, \"Incorrect aspect ratio specification.\\n\");\n\n ffmpeg_exit(1);\n\n }\n\n frame_aspect_ratio = ar;\n\n\n\n x = vfilters ? strlen(vfilters) : 0;\n\n vfilters = av_realloc(vfilters, x+100);\n\n snprintf(vfilters+x, x+100, \"%csetdar=%f\\n\", x?',':' ', ar);\n\n}\n"}} {"sample_id": "45db7ba681ede57113a67499840e69ee586bcdf2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,10 +34,10 @@\n \n cpu_abort(cs, \"Failed to read from exception vector table \"\n \n+ \"entry %08x\\n\", (unsigned)vec);\n+\n+ }\n+\n+ return addr;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t arm_v7m_load_vector(ARMCPU *cpu)\n\n{\n\n CPUState *cs = CPU(cpu);\n\n CPUARMState *env = &cpu->env;\n\n MemTxResult result;\n\n hwaddr vec = env->v7m.vecbase + env->v7m.exception * 4;\n\n uint32_t addr;\n\n\n\n addr = address_space_ldl(cs->as, vec,\n\n MEMTXATTRS_UNSPECIFIED, &result);\n\n if (result != MEMTX_OK) {\n\n /* Architecturally this should cause a HardFault setting HSFR.VECTTBL,\n\n * which would then be immediately followed by our failing to load\n\n * the entry vector for that HardFault, which is a Lockup case.\n\n * Since we don't model Lockup, we just report this guest error\n\n * via cpu_abort().\n\n */\n\n cpu_abort(cs, \"Failed to read from exception vector table \"\n\n \"entry %08x\\n\", (unsigned)vec);\n\n }\n\n return addr;\n\n}\n"}} {"sample_id": "bd10f6e1492492b0dfddc7dd8773e782ccea6daf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static av_cold int g726_init(AVCodecContext * avctx)\n \n+{\n \n G726Context* c = avctx->priv_data;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static av_cold int g726_init(AVCodecContext * avctx)\n\n{\n\n G726Context* c = avctx->priv_data;\n\n unsigned int index= (avctx->bit_rate + avctx->sample_rate/2) / avctx->sample_rate - 2;\n\n\n\n if (avctx->bit_rate % avctx->sample_rate && avctx->codec->encode) {\n\n av_log(avctx, AV_LOG_ERROR, \"Bitrate - Samplerate combination is invalid\\n\");\n\n return -1;\n\n }\n\n if(avctx->channels != 1){\n\n av_log(avctx, AV_LOG_ERROR, \"Only mono is supported\\n\");\n\n return -1;\n\n }\n\n if(index>3){\n\n av_log(avctx, AV_LOG_ERROR, \"Unsupported number of bits %d\\n\", index+2);\n\n return -1;\n\n }\n\n g726_reset(c, index);\n\n c->code_size = index+2;\n\n\n\n avctx->coded_frame = avcodec_alloc_frame();\n\n if (!avctx->coded_frame)\n\n return AVERROR(ENOMEM);\n\n avctx->coded_frame->key_frame = 1;\n\n\n\n if (avctx->codec->decode)\n\n avctx->sample_fmt = SAMPLE_FMT_S16;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_41", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void do_POWER_dozo (void)\n+\n {\n \n+ if (Ts1 > Ts0) {\n \n T2 = T0;\n \n@@ -10,7 +10,7 @@\n \n if (((~T2) ^ T1 ^ (-1)) & ((~T2) ^ T0) & (1 << 31)) {\n \n+ xer_so = 1;\n \n xer_ov = 1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void do_POWER_dozo (void)\n\n{\n\n if (Ts1 > Ts0) {\n\n T2 = T0;\n\n T0 = T1 - T0;\n\n if (((~T2) ^ T1 ^ (-1)) & ((~T2) ^ T0) & (1 << 31)) {\n\n xer_so = 1;\n\n xer_ov = 1;\n\n } else {\n\n xer_ov = 0;\n\n }\n\n } else {\n\n T0 = 0;\n\n xer_ov = 0;\n\n }\n\n}\n"}} {"sample_id": "b9ce1454e14ec918acb90d899ce7724f69682f45_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,8 +16,8 @@\n \n return 0;\n \n+ }\n+\n+ return f->buf[f->buf_index];\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int qemu_peek_byte(QEMUFile *f)\n\n{\n\n if (f->is_write)\n\n abort();\n\n\n\n if (f->buf_index >= f->buf_size) {\n\n qemu_fill_buffer(f);\n\n if (f->buf_index >= f->buf_size)\n\n return 0;\n\n }\n\n return f->buf[f->buf_index];\n\n}\n"}} {"sample_id": "1108b2f8a939fb5778d384149e2f1b99062a72da_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n pvscsi_init_msi(PVSCSIState *s)\n+\n+{\n+\n int res;\n \n+ PCIDevice *d = PCI_DEVICE(s);\n \n+\n \n res = msi_init(d, PVSCSI_MSI_OFFSET(s), PVSCSI_MSIX_NUM_VECTORS,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "pvscsi_init_msi(PVSCSIState *s)\n\n{\n\n int res;\n\n PCIDevice *d = PCI_DEVICE(s);\n\n\n\n res = msi_init(d, PVSCSI_MSI_OFFSET(s), PVSCSI_MSIX_NUM_VECTORS,\n\n PVSCSI_USE_64BIT, PVSCSI_PER_VECTOR_MASK);\n\n if (res < 0) {\n\n trace_pvscsi_init_msi_fail(res);\n\n s->msi_used = false;\n\n } else {\n\n s->msi_used = true;\n\n }\n\n}\n"}} {"sample_id": "b3dd1b8c295636e64ceb14cdc4db6420d7319e38_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+int monitor_fdset_dup_fd_remove(int dupfd)\n+\n {\n \n return -1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int monitor_fdset_dup_fd_remove(int dupfd)\n\n{\n\n return -1;\n\n}\n"}} {"sample_id": "6c7d3ead79af2de091ff74cb2e29770882cbae99", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,6 +4,6 @@\n \n if(!delay) delay=1; //SDL seems to be buggy when the delay is 0\n \n+ SDL_AddTimer(delay, sdl_refresh_timer_cb, is);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void schedule_refresh(VideoState *is, int delay)\n\n{\n\n if(!delay) delay=1; //SDL seems to be buggy when the delay is 0\n\n SDL_AddTimer(delay, sdl_refresh_timer_cb, is);\n\n}\n"}} {"sample_id": "875efafac8afe22971c87fc7dfee83d27364ab50", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n s->avctx = avctx;\n \n \n+\n+ avctx->pix_fmt = PIX_FMT_PAL8;\n+\n+ avctx->has_b_frames = 0;\n+\n s->frame.data[0] = s->prev_frame.data[0] = NULL;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int msrle_decode_init(AVCodecContext *avctx)\n\n{\n\n MsrleContext *s = (MsrleContext *)avctx->priv_data;\n\n int i, j;\n\n unsigned char *palette;\n\n\n\n s->avctx = avctx;\n\n\n\n avctx->pix_fmt = PIX_FMT_PAL8;\n\n avctx->has_b_frames = 0;\n\n s->frame.data[0] = s->prev_frame.data[0] = NULL;\n\n\n\n /* convert palette */\n\n palette = (unsigned char *)s->avctx->extradata;\n\n memset (s->palette, 0, 256 * 4);\n\n for (i = 0, j = 0; i < s->avctx->extradata_size / 4; i++, j += 4)\n\n s->palette[i] = \n\n (palette[j + 2] << 16) |\n\n (palette[j + 1] << 8) |\n\n (palette[j + 0] << 0);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "2c00b373024054e0779ef67fc54b763d624db3e8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n int ret = 0;\n \n+\n \n if (!dict || !data || !size)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int av_packet_unpack_dictionary(const uint8_t *data, int size, AVDictionary **dict)\n\n{\n\n const uint8_t *end = data + size;\n\n int ret = 0;\n\n\n\n if (!dict || !data || !size)\n\n return ret;\n\n if (size && end[-1])\n\n return AVERROR_INVALIDDATA;\n\n while (data < end) {\n\n const uint8_t *key = data;\n\n const uint8_t *val = data + strlen(key) + 1;\n\n\n\n if (val >= end)\n\n return AVERROR_INVALIDDATA;\n\n\n\n ret = av_dict_set(dict, key, val, 0);\n\n if (ret < 0)\n\n break;\n\n data = val + strlen(val) + 1;\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "245f7b51c0ea04fb2224b1127430a096c91aee70_17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,10 +10,10 @@\n \n else if (ds_get_bytes_per_pixel(vs->ds) == 4)\n \n+ jpeg_prepare_row32(vs, dst, x, y, count);\n+\n+ else\n+\n jpeg_prepare_row16(vs, dst, x, y, count);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void jpeg_prepare_row(VncState *vs, uint8_t *dst, int x, int y,\n\n int count)\n\n{\n\n if (vs->tight_pixel24)\n\n jpeg_prepare_row24(vs, dst, x, y, count);\n\n else if (ds_get_bytes_per_pixel(vs->ds) == 4)\n\n jpeg_prepare_row32(vs, dst, x, y, count);\n\n else\n\n jpeg_prepare_row16(vs, dst, x, y, count);\n\n}\n"}} {"sample_id": "927411fa42c5fcf16ed0fcc0447d5ee8c83b22ca", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n \n }\n \n+ s->esr = 0;\n+\n+ memset(s->icr, 0, sizeof(s->icr));\n+\n+ s->divide_conf = 0;\n \n s->count_shift = 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void apic_init_reset(DeviceState *dev)\n\n{\n\n APICCommonState *s = APIC_COMMON(dev);\n\n APICCommonClass *info = APIC_COMMON_GET_CLASS(s);\n\n int i;\n\n\n\n if (!s) {\n\n return;\n\n }\n\n s->tpr = 0;\n\n s->spurious_vec = 0xff;\n\n s->log_dest = 0;\n\n s->dest_mode = 0xf;\n\n memset(s->isr, 0, sizeof(s->isr));\n\n memset(s->tmr, 0, sizeof(s->tmr));\n\n memset(s->irr, 0, sizeof(s->irr));\n\n for (i = 0; i < APIC_LVT_NB; i++) {\n\n s->lvt[i] = APIC_LVT_MASKED;\n\n }\n\n s->esr = 0;\n\n memset(s->icr, 0, sizeof(s->icr));\n\n s->divide_conf = 0;\n\n s->count_shift = 0;\n\n s->initial_count = 0;\n\n s->initial_count_load_time = 0;\n\n s->next_time = 0;\n\n s->wait_for_sipi = !cpu_is_bsp(s->cpu);\n\n\n\n if (s->timer) {\n\n timer_del(s->timer);\n\n }\n\n s->timer_expiry = -1;\n\n\n\n if (info->reset) {\n\n info->reset(s);\n\n }\n\n}\n"}} {"sample_id": "30fb2ca603e8b8d0f02630ef18bc0d0637a88ffa_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+void qemu_add_balloon_handler(QEMUBalloonEvent *func, void *opaque)\n+\n {\n \n balloon_event_fn = func;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void qemu_add_balloon_handler(QEMUBalloonEvent *func, void *opaque)\n\n{\n\n balloon_event_fn = func;\n\n balloon_opaque = opaque;\n\n}\n"}} {"sample_id": "798325ed3856bc1e2f2b640b7e0db60044fdddf9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n \n \n+ set_bit(apic_id, cpu->found_cpus);\n+\n+ }\n+\n+\n \n object_child_foreach(o, acpi_add_cpu_info, opaque);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int acpi_add_cpu_info(Object *o, void *opaque)\n\n{\n\n AcpiCpuInfo *cpu = opaque;\n\n uint64_t apic_id;\n\n\n\n if (object_dynamic_cast(o, TYPE_CPU)) {\n\n apic_id = object_property_get_int(o, \"apic-id\", NULL);\n\n assert(apic_id <= MAX_CPUMASK_BITS);\n\n\n\n set_bit(apic_id, cpu->found_cpus);\n\n }\n\n\n\n object_child_foreach(o, acpi_add_cpu_info, opaque);\n\n return 0;\n\n}\n"}} {"sample_id": "9042c0e20de166542b603621fd30dc8be95dfd4d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n return -1;\n \n+ }\n+\n+ if (read(fd, e_ident, sizeof(e_ident)) != sizeof(e_ident))\n+\n+ goto fail;\n \n if (e_ident[0] != ELFMAG0 ||\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int load_elf(const char *filename, int64_t virt_to_phys_addend,\n\n uint64_t *pentry)\n\n{\n\n int fd, data_order, must_swab, ret;\n\n uint8_t e_ident[EI_NIDENT];\n\n\n\n fd = open(filename, O_RDONLY | O_BINARY);\n\n if (fd < 0) {\n\n perror(filename);\n\n return -1;\n\n }\n\n if (read(fd, e_ident, sizeof(e_ident)) != sizeof(e_ident))\n\n goto fail;\n\n if (e_ident[0] != ELFMAG0 ||\n\n e_ident[1] != ELFMAG1 ||\n\n e_ident[2] != ELFMAG2 ||\n\n e_ident[3] != ELFMAG3)\n\n goto fail;\n\n#ifdef WORDS_BIGENDIAN\n\n data_order = ELFDATA2MSB;\n\n#else\n\n data_order = ELFDATA2LSB;\n\n#endif\n\n must_swab = data_order != e_ident[EI_DATA];\n\n \n\n lseek(fd, 0, SEEK_SET);\n\n if (e_ident[EI_CLASS] == ELFCLASS64) {\n\n ret = load_elf64(fd, virt_to_phys_addend, must_swab, pentry);\n\n } else {\n\n ret = load_elf32(fd, virt_to_phys_addend, must_swab, pentry);\n\n }\n\n\n\n close(fd);\n\n return ret;\n\n\n\n fail:\n\n close(fd);\n\n return -1;\n\n}\n"}} {"sample_id": "b946a1533209f61a93e34898aebb5b43154b99c3_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,16 +1,16 @@\n void lance_init(NICInfo *nd, target_phys_addr_t leaddr, void *dma_opaque,\n \n+ qemu_irq irq, qemu_irq *reset)\n \n {\n+\n PCNetState *d;\n+\n+ int lance_io_memory;\n \n \n \n+ qemu_check_nic_model(nd, \"lance\");\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void lance_init(NICInfo *nd, target_phys_addr_t leaddr, void *dma_opaque,\n\n qemu_irq irq, qemu_irq *reset)\n\n{\n\n PCNetState *d;\n\n int lance_io_memory;\n\n\n\n qemu_check_nic_model(nd, \"lance\");\n\n\n\n d = qemu_mallocz(sizeof(PCNetState));\n\n\n\n lance_io_memory =\n\n cpu_register_io_memory(0, lance_mem_read, lance_mem_write, d);\n\n\n\n d->dma_opaque = dma_opaque;\n\n\n\n *reset = *qemu_allocate_irqs(parent_lance_reset, d, 1);\n\n\n\n cpu_register_physical_memory(leaddr, 4, lance_io_memory);\n\n\n\n d->irq = irq;\n\n d->phys_mem_read = ledma_memory_read;\n\n d->phys_mem_write = ledma_memory_write;\n\n\n\n pcnet_common_init(d, nd);\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_86", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n bs = bdrv_find(str);\n \n if (bs == NULL) {\n+\n+ return -ENOENT;\n+\n+ }\n+\n if (bdrv_attach_dev(bs, dev) < 0) {\n \n return -EEXIST;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int parse_drive(DeviceState *dev, const char *str, void **ptr)\n\n{\n\n BlockDriverState *bs;\n\n\n\n bs = bdrv_find(str);\n\n if (bs == NULL) {\n\n return -ENOENT;\n\n }\n\n if (bdrv_attach_dev(bs, dev) < 0) {\n\n return -EEXIST;\n\n }\n\n *ptr = bs;\n\n return 0;\n\n}\n"}} {"sample_id": "2254b559cbcfc0418135f09add37c0a5866b1981_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void hScale16To19_c(SwsContext *c, int16_t *_dst, int dstW, const uint8_t *_src,\n \n const int16_t *filter,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void hScale16To19_c(SwsContext *c, int16_t *_dst, int dstW, const uint8_t *_src,\n\n const int16_t *filter,\n\n const int16_t *filterPos, int filterSize)\n\n{\n\n int i;\n\n int32_t *dst = (int32_t *) _dst;\n\n const uint16_t *src = (const uint16_t *) _src;\n\n int bits = av_pix_fmt_descriptors[c->srcFormat].comp[0].depth_minus1;\n\n int sh = bits - 4;\n\n\n\n for (i = 0; i < dstW; i++) {\n\n int j;\n\n int srcPos = filterPos[i];\n\n int val = 0;\n\n\n\n for (j = 0; j < filterSize; j++) {\n\n val += src[srcPos + j] * filter[filterSize * i + j];\n\n }\n\n // filter=14 bit, input=16 bit, output=30 bit, >> 11 makes 19 bit\n\n dst[i] = FFMIN(val >> sh, (1 << 19) - 1);\n\n }\n\n}\n"}} {"sample_id": "cfd937b081adfa122e3f814b928c9ea0ada7f4f0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n // XXX dsputil-ize\n \n+ dest[group*128+k] += cce->coup.gain[index][idx] * src[group*128+k];\n+\n+ }\n+\n+ }\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void apply_dependent_coupling(AACContext * ac, SingleChannelElement * target, ChannelElement * cce, int index) {\n\n IndividualChannelStream * ics = &cce->ch[0].ics;\n\n const uint16_t * offsets = ics->swb_offset;\n\n float * dest = target->coeffs;\n\n const float * src = cce->ch[0].coeffs;\n\n int g, i, group, k, idx = 0;\n\n if(ac->m4ac.object_type == AOT_AAC_LTP) {\n\n av_log(ac->avccontext, AV_LOG_ERROR,\n\n \"Dependent coupling is not supported together with LTP\\n\");\n\n return;\n\n }\n\n for (g = 0; g < ics->num_window_groups; g++) {\n\n for (i = 0; i < ics->max_sfb; i++, idx++) {\n\n if (cce->ch[0].band_type[idx] != ZERO_BT) {\n\n for (group = 0; group < ics->group_len[g]; group++) {\n\n for (k = offsets[i]; k < offsets[i+1]; k++) {\n\n // XXX dsputil-ize\n\n dest[group*128+k] += cce->coup.gain[index][idx] * src[group*128+k];\n\n }\n\n }\n\n }\n\n }\n\n dest += ics->group_len[g]*128;\n\n src += ics->group_len[g]*128;\n\n }\n\n}\n"}} {"sample_id": "3f162d119ef52fda714ebb498fcb4f4b7c354d38", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n ppcmas_tlb_t *tlb;\n \n target_phys_addr_t raddr;\n+\n+ int i, j, ret;\n+\n+\n+\n ret = -1;\n \n raddr = (target_phys_addr_t)-1ULL;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int mmubooke206_get_physical_address(CPUState *env, mmu_ctx_t *ctx,\n\n target_ulong address, int rw,\n\n int access_type)\n\n{\n\n ppcmas_tlb_t *tlb;\n\n target_phys_addr_t raddr;\n\n int i, j, ret;\n\n\n\n ret = -1;\n\n raddr = (target_phys_addr_t)-1ULL;\n\n\n\n for (i = 0; i < BOOKE206_MAX_TLBN; i++) {\n\n int ways = booke206_tlb_ways(env, i);\n\n\n\n for (j = 0; j < ways; j++) {\n\n tlb = booke206_get_tlbm(env, i, address, j);\n\n\n\n\n ret = mmubooke206_check_tlb(env, tlb, &raddr, &ctx->prot, address,\n\n rw, access_type);\n\n if (ret != -1) {\n\n goto found_tlb;\n\n\n\n\n\n\nfound_tlb:\n\n\n\n if (ret >= 0) {\n\n ctx->raddr = raddr;\n\n LOG_SWTLB(\"%s: access granted \" TARGET_FMT_lx \" => \" TARGET_FMT_plx\n\n \" %d %d\\n\", __func__, address, ctx->raddr, ctx->prot,\n\n ret);\n\n } else {\n\n LOG_SWTLB(\"%s: access refused \" TARGET_FMT_lx \" => \" TARGET_FMT_plx\n\n \" %d %d\\n\", __func__, address, raddr, ctx->prot, ret);\n\n\n\n\n return ret;\n"}} {"sample_id": "8aba7968dd604aae91ee42cbce0be3dad7dceb30_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -57,9 +57,9 @@\n }\n }\n }\n+ *got_frame = 1;\n+ return buf_size;\n+packet_small:\n+ av_log(avctx, AV_LOG_ERROR, \"Input packet too small.\\n\");\n+ return AVERROR_INVALIDDATA;\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int vcr1_decode_frame(AVCodecContext *avctx, void *data,\n int *got_frame, AVPacket *avpkt)\n{\n const uint8_t *buf = avpkt->data;\n int buf_size = avpkt->size;\n VCR1Context *const a = avctx->priv_data;\n AVFrame *const p = data;\n const uint8_t *bytestream = buf;\n int i, x, y, ret;\n if ((ret = ff_get_buffer(avctx, p, 0)) < 0) {\n av_log(avctx, AV_LOG_ERROR, \"get_buffer() failed\\n\");\n return ret;\n }\n p->pict_type = AV_PICTURE_TYPE_I;\n p->key_frame = 1;\n if (buf_size < 32)\n for (i = 0; i < 16; i++) {\n a->delta[i] = *bytestream++;\n bytestream++;\n buf_size--;\n }\n for (y = 0; y < avctx->height; y++) {\n int offset;\n uint8_t *luma = &p->data[0][y * p->linesize[0]];\n if ((y & 3) == 0) {\n uint8_t *cb = &p->data[1][(y >> 2) * p->linesize[1]];\n uint8_t *cr = &p->data[2][(y >> 2) * p->linesize[2]];\n for (i = 0; i < 4; i++)\n a->offset[i] = *bytestream++;\n offset = a->offset[0] - a->delta[bytestream[2] & 0xF];\n for (x = 0; x < avctx->width; x += 4) {\n luma[0] = offset += a->delta[bytestream[2] & 0xF];\n luma[1] = offset += a->delta[bytestream[2] >> 4];\n luma[2] = offset += a->delta[bytestream[0] & 0xF];\n luma[3] = offset += a->delta[bytestream[0] >> 4];\n luma += 4;\n *cb++ = bytestream[3];\n *cr++ = bytestream[1];\n bytestream += 4;\n buf_size -= 4;\n }\n } else {\n if (buf_size < avctx->width / 2)\n offset = a->offset[y & 3] - a->delta[bytestream[2] & 0xF];\n for (x = 0; x < avctx->width; x += 8) {\n luma[0] = offset += a->delta[bytestream[2] & 0xF];\n luma[1] = offset += a->delta[bytestream[2] >> 4];\n luma[2] = offset += a->delta[bytestream[3] & 0xF];\n luma[3] = offset += a->delta[bytestream[3] >> 4];\n luma[4] = offset += a->delta[bytestream[0] & 0xF];\n luma[5] = offset += a->delta[bytestream[0] >> 4];\n luma[6] = offset += a->delta[bytestream[1] & 0xF];\n luma[7] = offset += a->delta[bytestream[1] >> 4];\n luma += 8;\n bytestream += 4;\n buf_size -= 4;\n }\n }\n }\n *got_frame = 1;\n return buf_size;\npacket_small:\n av_log(avctx, AV_LOG_ERROR, \"Input packet too small.\\n\");\n return AVERROR_INVALIDDATA;\n}"}} {"sample_id": "b9c600d20716b3d942cb07188ff998fb236a8365_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n int i;\n \n \n+\n for (i = 0; i < s->num_children; i++) {\n \n acb->qcrs[i].buf = qemu_blockalign(s->children[i]->bs, acb->qiov->size);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static BlockAIOCB *read_quorum_children(QuorumAIOCB *acb)\n\n{\n\n BDRVQuorumState *s = acb->common.bs->opaque;\n\n int i;\n\n\n\n for (i = 0; i < s->num_children; i++) {\n\n acb->qcrs[i].buf = qemu_blockalign(s->children[i]->bs, acb->qiov->size);\n\n qemu_iovec_init(&acb->qcrs[i].qiov, acb->qiov->niov);\n\n qemu_iovec_clone(&acb->qcrs[i].qiov, acb->qiov, acb->qcrs[i].buf);\n\n }\n\n\n\n for (i = 0; i < s->num_children; i++) {\n\n bdrv_aio_readv(s->children[i]->bs, acb->sector_num, &acb->qcrs[i].qiov,\n\n acb->nb_sectors, quorum_aio_cb, &acb->qcrs[i]);\n\n }\n\n\n\n return &acb->common;\n\n}\n"}} {"sample_id": "e313d5cec564a9b708bad1bb44c291530a5a4935", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void add_query_tests(QmpSchema *schema)\n \n {\n+\n SchemaInfoList *tail;\n \n SchemaInfo *si, *arg_type, *ret_type;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void add_query_tests(QmpSchema *schema)\n\n{\n\n SchemaInfoList *tail;\n\n SchemaInfo *si, *arg_type, *ret_type;\n\n const char *test_name;\n\n\n\n /* Test the query-like commands */\n\n for (tail = schema->list; tail; tail = tail->next) {\n\n si = tail->value;\n\n if (si->meta_type != SCHEMA_META_TYPE_COMMAND) {\n\n continue;\n\n }\n\n\n\n if (query_is_blacklisted(si->name)) {\n\n continue;\n\n }\n\n\n\n arg_type = qmp_schema_lookup(schema, si->u.command.arg_type);\n\n if (object_type_has_mandatory_members(arg_type)) {\n\n continue;\n\n }\n\n\n\n ret_type = qmp_schema_lookup(schema, si->u.command.ret_type);\n\n if (ret_type->meta_type == SCHEMA_META_TYPE_OBJECT\n\n && !ret_type->u.object.members) {\n\n continue;\n\n }\n\n\n\n test_name = g_strdup_printf(\"qmp/%s\", si->name);\n\n qtest_add_data_func(test_name, si->name, test_query);\n\n }\n\n}\n"}} {"sample_id": "0b8b8753e4d94901627b3e86431230f2319215c4_32", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int coroutine_enter_func(void *arg)\n \n+{\n \n Coroutine *co = arg;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int coroutine_enter_func(void *arg)\n\n{\n\n Coroutine *co = arg;\n\n qemu_coroutine_enter(co, NULL);\n\n return 0;\n\n}\n"}} {"sample_id": "2c79288d4e0bcb8d3a8a908813fc9cc586dd7fdd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n int ff_wma_end(AVCodecContext *avctx)\n \n+{\n+\n+ WMACodecContext *s = avctx->priv_data;\n+\n+ int i;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "int ff_wma_end(AVCodecContext *avctx)\n\n{\n\n WMACodecContext *s = avctx->priv_data;\n\n int i;\n\n\n\n for(i = 0; i < s->nb_block_sizes; i++)\n\n ff_mdct_end(&s->mdct_ctx[i]);\n\n for(i = 0; i < s->nb_block_sizes; i++)\n\n av_free(s->windows[i]);\n\n\n\n if (s->use_exp_vlc) {\n\n free_vlc(&s->exp_vlc);\n\n }\n\n if (s->use_noise_coding) {\n\n free_vlc(&s->hgain_vlc);\n\n }\n\n for(i = 0;i < 2; i++) {\n\n free_vlc(&s->coef_vlc[i]);\n\n av_free(s->run_table[i]);\n\n av_free(s->level_table[i]);\n\n\n }\n\n\n\n return 0;\n\n}"}} {"sample_id": "83548fe894cdb455cc127f754d09905b6d23c173_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,9 +25,9 @@\n bink->video_pts = 0;\n \n memset(bink->audio_pts, 0, sizeof(bink->audio_pts));\n+\n+ bink->current_track = -1;\n+\n+ return 0;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int read_seek(AVFormatContext *s, int stream_index, int64_t timestamp, int flags)\n\n{\n\n BinkDemuxContext *bink = s->priv_data;\n\n AVStream *vst = s->streams[0];\n\n\n\n if (!s->pb->seekable)\n\n return -1;\n\n\n\n /* seek to the first frame */\n\n if (avio_seek(s->pb, vst->index_entries[0].pos, SEEK_SET) < 0)\n\n return -1;\n\n\n\n bink->video_pts = 0;\n\n memset(bink->audio_pts, 0, sizeof(bink->audio_pts));\n\n bink->current_track = -1;\n\n return 0;\n\n}\n"}} {"sample_id": "45faf7fcd335b91e41b0e3ba4e397a9640d8c694", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n return AVPROBE_SCORE_MAX-20;\n \n }\n+\n+ /* so we'll have more luck on extension... */\n+\n+ if (av_match_ext(p->filename, \"nsv\"))\n+\n return AVPROBE_SCORE_MAX/2;\n \n /* FIXME: add mime-type check */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int nsv_probe(AVProbeData *p)\n\n{\n\n int i;\n\n av_dlog(NULL, \"nsv_probe(), buf_size %d\\n\", p->buf_size);\n\n /* check file header */\n\n /* streamed files might not have any header */\n\n if (p->buf[0] == 'N' && p->buf[1] == 'S' &&\n\n p->buf[2] == 'V' && (p->buf[3] == 'f' || p->buf[3] == 's'))\n\n return AVPROBE_SCORE_MAX;\n\n /* XXX: do streamed files always start at chunk boundary ?? */\n\n /* or do we need to search NSVs in the byte stream ? */\n\n /* seems the servers don't bother starting clean chunks... */\n\n /* sometimes even the first header is at 9KB or something :^) */\n\n for (i = 1; i < p->buf_size - 3; i++) {\n\n if (p->buf[i+0] == 'N' && p->buf[i+1] == 'S' &&\n\n p->buf[i+2] == 'V' && p->buf[i+3] == 's')\n\n return AVPROBE_SCORE_MAX-20;\n\n }\n\n /* so we'll have more luck on extension... */\n\n if (av_match_ext(p->filename, \"nsv\"))\n\n return AVPROBE_SCORE_MAX/2;\n\n /* FIXME: add mime-type check */\n\n return 0;\n\n}\n"}} {"sample_id": "637f7a6a01e09bc39f7b3a24257a9cd6ea396ca0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n {\n \n struct vhost_dev *dev = container_of(listener, struct vhost_dev,\n+\n memory_listener);\n \n int i;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void vhost_region_del(MemoryListener *listener,\n\n MemoryRegionSection *section)\n\n{\n\n struct vhost_dev *dev = container_of(listener, struct vhost_dev,\n\n memory_listener);\n\n int i;\n\n\n\n vhost_set_memory(listener, section, false);\n\n for (i = 0; i < dev->n_mem_sections; ++i) {\n\n if (dev->mem_sections[i].offset_within_address_space\n\n == section->offset_within_address_space) {\n\n --dev->n_mem_sections;\n\n memmove(&dev->mem_sections[i], &dev->mem_sections[i+1],\n\n dev->n_mem_sections - i);\n\n break;\n\n }\n\n }\n\n}\n"}} {"sample_id": "72dbc610be3272ba36603f78a39cc2d2d8fe0cc3_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void ff_avg_h264_qpel4_mc32_msa(uint8_t *dst, const uint8_t *src,\n \n+ ptrdiff_t stride)\n+\n {\n \n avc_luma_midh_qrt_and_aver_dst_4w_msa(src - (2 * stride) - 2,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_avg_h264_qpel4_mc32_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n avc_luma_midh_qrt_and_aver_dst_4w_msa(src - (2 * stride) - 2,\n\n stride, dst, stride, 4, 1);\n\n}\n"}} {"sample_id": "47d3df2387ed6927732584ffa4159c26d9f4dee8_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static inline ioreq_t *xen_vcpu_ioreq(shared_iopage_t *shared_page, int vcpu)\n+\n {\n \n return &shared_page->vcpu_iodata[vcpu].vp_ioreq;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline ioreq_t *xen_vcpu_ioreq(shared_iopage_t *shared_page, int vcpu)\n\n{\n\n return &shared_page->vcpu_iodata[vcpu].vp_ioreq;\n\n}\n"}} {"sample_id": "c4237dfa635900e4d1cdc6038d5efe3507f45f0c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void bdrv_reset_dirty(BlockDriverState *bs, int64_t cur_sector, int nr_sectors)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void bdrv_reset_dirty(BlockDriverState *bs, int64_t cur_sector, int nr_sectors)\n\n{\n\n BdrvDirtyBitmap *bitmap;\n\n QLIST_FOREACH(bitmap, &bs->dirty_bitmaps, list) {\n\n hbitmap_reset(bitmap->bitmap, cur_sector, nr_sectors);\n\n }\n\n}\n"}} {"sample_id": "5e5557d97026d1d3325e0e7b0ba593366da2f3dc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n BDRVQcowState *s = bs->opaque;\n+\n uint32_t l1_length = s->l1_size * sizeof(uint64_t);\n \n int ret;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int qcow_make_empty(BlockDriverState *bs)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n uint32_t l1_length = s->l1_size * sizeof(uint64_t);\n\n int ret;\n\n\n\n memset(s->l1_table, 0, l1_length);\n\n if (bdrv_pwrite(bs->file, s->l1_table_offset, s->l1_table, l1_length) < 0)\n\n\treturn -1;\n\n ret = bdrv_truncate(bs->file, s->l1_table_offset + l1_length);\n\n if (ret < 0)\n\n return ret;\n\n\n\n memset(s->l2_cache, 0, s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));\n\n memset(s->l2_cache_offsets, 0, L2_CACHE_SIZE * sizeof(uint64_t));\n\n memset(s->l2_cache_counts, 0, L2_CACHE_SIZE * sizeof(uint32_t));\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "0852648301ad968bc7d79d000400e2b973bbb59a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,17 +3,17 @@\n {\n \n double ret = 0;\n+\n SelectContext *select = ctx->priv;\n \n AVFilterBufferRef *prev_picref = select->prev_picref;\n \n \n+\n+ if (prev_picref &&\n \n picref->video->h == prev_picref->video->h &&\n+\n picref->video->w == prev_picref->video->w &&\n \n picref->linesize[0] == prev_picref->linesize[0]) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-89", "target_file": "source.c", "files": {"source.c": "static double get_scene_score(AVFilterContext *ctx, AVFilterBufferRef *picref)\n\n{\n\n double ret = 0;\n\n SelectContext *select = ctx->priv;\n\n AVFilterBufferRef *prev_picref = select->prev_picref;\n\n\n\n if (prev_picref &&\n\n picref->video->h == prev_picref->video->h &&\n\n picref->video->w == prev_picref->video->w &&\n\n picref->linesize[0] == prev_picref->linesize[0]) {\n\n int x, y;\n\n int64_t sad = 0;\n\n double mafd, diff;\n\n uint8_t *p1 = picref->data[0];\n\n uint8_t *p2 = prev_picref->data[0];\n\n const int linesize = picref->linesize[0];\n\n\n\n for (y = 0; y < picref->video->h; y += 8)\n\n for (x = 0; x < linesize; x += 8)\n\n sad += select->c.sad[1](select,\n\n p1 + y * linesize + x,\n\n p2 + y * linesize + x,\n\n linesize, 8);\n\n emms_c();\n\n mafd = sad / (picref->video->h * picref->video->w * 3);\n\n diff = fabs(mafd - select->prev_mafd);\n\n ret = av_clipf(FFMIN(mafd, diff) / 100., 0, 1);\n\n select->prev_mafd = mafd;\n\n avfilter_unref_buffer(prev_picref);\n\n }\n\n select->prev_picref = avfilter_ref_buffer(picref, ~0);\n\n return ret;\n\n}\n"}} {"sample_id": "95c077c91900c1420cd4f0be996ffeea6fb6cec8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n [GDB_WATCHPOINT_ACCESS] = 0x3\n \n+ };\n \n const uint8_t len_code[] = {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void kvm_arch_update_guest_debug(CPUState *env, struct kvm_guest_debug *dbg)\n\n{\n\n const uint8_t type_code[] = {\n\n [GDB_BREAKPOINT_HW] = 0x0,\n\n [GDB_WATCHPOINT_WRITE] = 0x1,\n\n [GDB_WATCHPOINT_ACCESS] = 0x3\n\n };\n\n const uint8_t len_code[] = {\n\n [1] = 0x0, [2] = 0x1, [4] = 0x3, [8] = 0x2\n\n };\n\n int n;\n\n\n\n if (kvm_sw_breakpoints_active(env))\n\n dbg->control |= KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP;\n\n\n\n if (nb_hw_breakpoint > 0) {\n\n dbg->control |= KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_HW_BP;\n\n dbg->arch.debugreg[7] = 0x0600;\n\n for (n = 0; n < nb_hw_breakpoint; n++) {\n\n dbg->arch.debugreg[n] = hw_breakpoint[n].addr;\n\n dbg->arch.debugreg[7] |= (2 << (n * 2)) |\n\n (type_code[hw_breakpoint[n].type] << (16 + n*4)) |\n\n (len_code[hw_breakpoint[n].len] << (18 + n*4));\n\n }\n\n }\n\n /* Legal xcr0 for loading */\n\n env->xcr0 = 1;\n\n}\n"}} {"sample_id": "ddfa3751c092feaf1e080f66587024689dfe603c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int get_coc(J2kDecoderContext *s, J2kCodingStyle *c, uint8_t *properties)\n \n+{\n+\n int compno;\n+\n \n \n if (s->buf_end - s->buf < 2)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int get_coc(J2kDecoderContext *s, J2kCodingStyle *c, uint8_t *properties)\n\n{\n\n int compno;\n\n\n\n if (s->buf_end - s->buf < 2)\n\n return AVERROR(EINVAL);\n\n\n\n compno = bytestream_get_byte(&s->buf);\n\n\n\n c += compno;\n\n c->csty = bytestream_get_byte(&s->buf);\n\n get_cox(s, c);\n\n\n\n properties[compno] |= HAD_COC;\n\n return 0;\n\n}\n"}} {"sample_id": "e5dc1a6c6c4359cd783810f63eb68e9e09350708", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n ReadLineState *readline_init(ReadLinePrintfFunc *printf_func,\n+\n ReadLineFlushFunc *flush_func,\n \n void *opaque,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "ReadLineState *readline_init(ReadLinePrintfFunc *printf_func,\n\n ReadLineFlushFunc *flush_func,\n\n void *opaque,\n\n ReadLineCompletionFunc *completion_finder)\n\n{\n\n ReadLineState *rs = g_malloc0(sizeof(*rs));\n\n\n\n rs->hist_entry = -1;\n\n rs->opaque = opaque;\n\n rs->printf_func = printf_func;\n\n rs->flush_func = flush_func;\n\n rs->completion_finder = completion_finder;\n\n\n\n return rs;\n\n}\n"}} {"sample_id": "24ae353dfbe61019a86093a9c5cd15476aabef49", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+ XanContext *s = avctx->priv_data;\n+\n+\n \n s->avctx = avctx;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static av_cold int xan_decode_init(AVCodecContext *avctx)\n\n{\n\n XanContext *s = avctx->priv_data;\n\n\n\n s->avctx = avctx;\n\n s->frame_size = 0;\n\n\n\n if ((avctx->codec->id == CODEC_ID_XAN_WC3) &&\n\n (s->avctx->palctrl == NULL)) {\n\n av_log(avctx, AV_LOG_ERROR, \"palette expected\\n\");\n\n return AVERROR(EINVAL);\n\n }\n\n\n\n avctx->pix_fmt = PIX_FMT_PAL8;\n\n\n\n s->buffer1_size = avctx->width * avctx->height;\n\n s->buffer1 = av_malloc(s->buffer1_size);\n\n if (!s->buffer1)\n\n return AVERROR(ENOMEM);\n\n s->buffer2_size = avctx->width * avctx->height;\n\n s->buffer2 = av_malloc(s->buffer2_size + 130);\n\n if (!s->buffer2) {\n\n av_freep(&s->buffer1);\n\n return AVERROR(ENOMEM);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "bb572aefbdac290363bfa5ca0e810ccce0a14ed6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static int64_t alloc_clusters_noref(BlockDriverState *bs, int64_t size)\n \n+{\n \n BDRVQcowState *s = bs->opaque;\n+\n int i, nb_clusters, refcount;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int64_t alloc_clusters_noref(BlockDriverState *bs, int64_t size)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n int i, nb_clusters, refcount;\n\n\n\n nb_clusters = size_to_clusters(s, size);\n\nretry:\n\n for(i = 0; i < nb_clusters; i++) {\n\n int64_t next_cluster_index = s->free_cluster_index++;\n\n refcount = get_refcount(bs, next_cluster_index);\n\n\n\n if (refcount < 0) {\n\n return refcount;\n\n } else if (refcount != 0) {\n\n goto retry;\n\n }\n\n }\n\n#ifdef DEBUG_ALLOC2\n\n fprintf(stderr, \"alloc_clusters: size=%\" PRId64 \" -> %\" PRId64 \"\\n\",\n\n size,\n\n (s->free_cluster_index - nb_clusters) << s->cluster_bits);\n\n#endif\n\n return (s->free_cluster_index - nb_clusters) << s->cluster_bits;\n\n}\n"}} {"sample_id": "8417f904bad50021b432dfea12613345d9fb1f68_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,8 +28,8 @@\n \n }\n \n+ }\n+\n+ return false;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool s390_cpu_exec_interrupt(CPUState *cs, int interrupt_request)\n\n{\n\n if (interrupt_request & CPU_INTERRUPT_HARD) {\n\n S390CPU *cpu = S390_CPU(cs);\n\n CPUS390XState *env = &cpu->env;\n\n\n\n if (env->ex_value) {\n\n /* Execution of the target insn is indivisible from\n\n the parent EXECUTE insn. */\n\n return false;\n\n }\n\n if (env->psw.mask & PSW_MASK_EXT) {\n\n s390_cpu_do_interrupt(cs);\n\n return true;\n\n }\n\n }\n\n return false;\n\n}\n"}} {"sample_id": "a83000f5e3fac30a7f213af1ba6a8f827622854d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n QLIST_INIT(&spapr_tce_tables);\n \n \n+\n+ /* hcall-tce */\n+\n spapr_register_hypercall(H_PUT_TCE, h_put_tce);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void spapr_iommu_init(void)\n\n{\n\n QLIST_INIT(&spapr_tce_tables);\n\n\n\n /* hcall-tce */\n\n spapr_register_hypercall(H_PUT_TCE, h_put_tce);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_48", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void slow_bar_writew(void *opaque, target_phys_addr_t addr, uint32_t val)\n \n+{\n+\n+ AssignedDevRegion *d = opaque;\n \n uint16_t *out = (uint16_t *)(d->u.r_virtbase + addr);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void slow_bar_writew(void *opaque, target_phys_addr_t addr, uint32_t val)\n\n{\n\n AssignedDevRegion *d = opaque;\n\n uint16_t *out = (uint16_t *)(d->u.r_virtbase + addr);\n\n\n\n DEBUG(\"slow_bar_writew addr=0x\" TARGET_FMT_plx \" val=0x%04x\\n\", addr, val);\n\n *out = val;\n\n}\n"}} {"sample_id": "6c2d1c32d084320081b0cd047f8cacd6e722d03a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n k->exit = info->unplug ? usb_uhci_exit : NULL;\n \n k->vendor_id = info->vendor_id;\n+\n+ k->device_id = info->device_id;\n+\n+ k->revision = info->revision;\n+\n k->class_id = PCI_CLASS_SERIAL_USB;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void uhci_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);\n\n UHCIPCIDeviceClass *u = container_of(k, UHCIPCIDeviceClass, parent_class);\n\n UHCIInfo *info = data;\n\n\n\n k->init = info->initfn ? info->initfn : usb_uhci_common_initfn;\n\n k->exit = info->unplug ? usb_uhci_exit : NULL;\n\n k->vendor_id = info->vendor_id;\n\n k->device_id = info->device_id;\n\n k->revision = info->revision;\n\n k->class_id = PCI_CLASS_SERIAL_USB;\n\n\n dc->vmsd = &vmstate_uhci;\n\n dc->props = uhci_properties;\n\n u->info = *info;\n\n}"}} {"sample_id": "1c275925bfbbc2de84a8f0e09d1dd70bbefb6da3_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -41,11 +41,11 @@\n get_sp_from_cpustate(env)) == -EFAULT) {\n \n goto badframe;\n+\n+ }\n+\n+ unlock_user_struct(frame, frame_addr, 0);\n+\n return env->regs[2];\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "long do_rt_sigreturn(CPUS390XState *env)\n\n{\n\n rt_sigframe *frame;\n\n abi_ulong frame_addr = env->regs[15];\n\n qemu_log(\"%s: frame_addr 0x%llx\\n\", __FUNCTION__,\n\n (unsigned long long)frame_addr);\n\n sigset_t set;\n\n\n\n if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1)) {\n\n goto badframe;\n\n }\n\n target_to_host_sigset(&set, &frame->uc.tuc_sigmask);\n\n\n\n sigprocmask(SIG_SETMASK, &set, NULL); /* ~_BLOCKABLE? */\n\n\n\n if (restore_sigregs(env, &frame->uc.tuc_mcontext)) {\n\n goto badframe;\n\n }\n\n\n\n if (do_sigaltstack(frame_addr + offsetof(rt_sigframe, uc.tuc_stack), 0,\n\n get_sp_from_cpustate(env)) == -EFAULT) {\n\n goto badframe;\n\n }\n\n unlock_user_struct(frame, frame_addr, 0);\n\n return env->regs[2];\n\n\n\nbadframe:\n\n unlock_user_struct(frame, frame_addr, 0);\n\n force_sig(TARGET_SIGSEGV);\n\n return 0;\n\n}\n"}} {"sample_id": "82be8e7394b31fd2d740651365b8ebdd0c847529", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n {\n \n struct kvm_get_htab_fd s = {\n+\n .flags = write ? KVM_GET_HTAB_WRITE : 0,\n+\n .start_index = 0,\n \n };", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int kvmppc_get_htab_fd(bool write)\n\n{\n\n struct kvm_get_htab_fd s = {\n\n .flags = write ? KVM_GET_HTAB_WRITE : 0,\n\n .start_index = 0,\n\n };\n\n\n\n if (!cap_htab_fd) {\n\n fprintf(stderr, \"KVM version doesn't support saving the hash table\\n\");\n\n return -1;\n\n }\n\n\n\n return kvm_vm_ioctl(kvm_state, KVM_PPC_GET_HTAB_FD, &s);\n\n}\n"}} {"sample_id": "ef76dc59fa5203d146a2acf85a0ad5a5971a4824_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -40,11 +40,11 @@\n \n fail_unless(qobject_type(obj) == QTYPE_QINT);\n \n+\n+\n+ qint = qobject_to_qint(obj);\n+\n+ fail_unless(qint_get_int(qint) == value64);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "START_TEST(vararg_number)\n\n{\n\n QObject *obj;\n\n QInt *qint;\n\n QFloat *qfloat;\n\n int value = 0x2342;\n\n int64_t value64 = 0x2342342343LL;\n\n double valuef = 2.323423423;\n\n\n\n obj = qobject_from_jsonf(\"%d\", value);\n\n fail_unless(obj != NULL);\n\n fail_unless(qobject_type(obj) == QTYPE_QINT);\n\n\n\n qint = qobject_to_qint(obj);\n\n fail_unless(qint_get_int(qint) == value);\n\n\n\n QDECREF(qint);\n\n\n\n obj = qobject_from_jsonf(\"%\" PRId64, value64);\n\n fail_unless(obj != NULL);\n\n fail_unless(qobject_type(obj) == QTYPE_QINT);\n\n\n\n qint = qobject_to_qint(obj);\n\n fail_unless(qint_get_int(qint) == value64);\n\n\n\n QDECREF(qint);\n\n\n\n obj = qobject_from_jsonf(\"%f\", valuef);\n\n fail_unless(obj != NULL);\n\n fail_unless(qobject_type(obj) == QTYPE_QFLOAT);\n\n\n\n qfloat = qobject_to_qfloat(obj);\n\n fail_unless(qfloat_get_double(qfloat) == valuef);\n\n\n\n QDECREF(qfloat);\n\n}\n"}} {"sample_id": "ad7ee4ad6c3a5388acf94dd532d291ea6d3a5972", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n {\n \n int ret;\n+\n+\n+\n+ if (colors == 0) {\n+\n if (tight_detect_smooth_image(vs, w, h)) {\n \n int quality = tight_conf[vs->tight.quality].jpeg_quality;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int send_sub_rect_jpeg(VncState *vs, int x, int y, int w, int h,\n\n int bg, int fg, int colors,\n\n VncPalette *palette)\n\n{\n\n int ret;\n\n\n\n if (colors == 0) {\n\n if (tight_detect_smooth_image(vs, w, h)) {\n\n int quality = tight_conf[vs->tight.quality].jpeg_quality;\n\n\n\n ret = send_jpeg_rect(vs, x, y, w, h, quality);\n\n\n ret = send_full_color_rect(vs, x, y, w, h);\n\n }\n\n } else if (colors == 1) {\n\n ret = send_solid_rect(vs);\n\n } else if (colors == 2) {\n\n ret = send_mono_rect(vs, x, y, w, h, bg, fg);\n\n } else if (colors <= 256) {\n\n if (colors > 96 &&\n\n tight_detect_smooth_image(vs, w, h)) {\n\n int quality = tight_conf[vs->tight.quality].jpeg_quality;\n\n\n\n ret = send_jpeg_rect(vs, x, y, w, h, quality);\n\n\n ret = send_palette_rect(vs, x, y, w, h, palette);\n\n }\n\n\n\n }\n\n return ret;\n\n}"}} {"sample_id": "0b8b8753e4d94901627b3e86431230f2319215c4_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void co_read_response(void *opaque)\n \n {\n+\n BDRVSheepdogState *s = opaque;\n+\n \n \n if (!s->co_recv) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void co_read_response(void *opaque)\n\n{\n\n BDRVSheepdogState *s = opaque;\n\n\n\n if (!s->co_recv) {\n\n s->co_recv = qemu_coroutine_create(aio_read_response);\n\n }\n\n\n\n qemu_coroutine_enter(s->co_recv, opaque);\n\n}\n"}} {"sample_id": "7a0e58fa648736a75f2a6943afd2ab08ea15b8e0_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n }\n \n+ if (ri->type & ARM_CP_NO_MIGRATE) {\n+\n+ continue;\n+\n+ }\n \n cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool write_cpustate_to_list(ARMCPU *cpu)\n\n{\n\n /* Write the coprocessor state from cpu->env to the (index,value) list. */\n\n int i;\n\n bool ok = true;\n\n\n\n for (i = 0; i < cpu->cpreg_array_len; i++) {\n\n uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);\n\n const ARMCPRegInfo *ri;\n\n\n\n ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);\n\n if (!ri) {\n\n ok = false;\n\n continue;\n\n }\n\n if (ri->type & ARM_CP_NO_MIGRATE) {\n\n continue;\n\n }\n\n cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri);\n\n }\n\n return ok;\n\n}\n"}} {"sample_id": "ccff9da62a833238db7a22eb39be0814f522c2c5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n if(val > 16)\n \n+ val -=32;\n+\n+ if(val < -16)\n+\n+ val+=32;\n \n sign = val < 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void h261_encode_motion(H261Context * h, int val){\n\n MpegEncContext * const s = &h->s;\n\n int sign, code;\n\n if(val==0){\n\n code = 0;\n\n put_bits(&s->pb,h261_mv_tab[code][1],h261_mv_tab[code][0]);\n\n } \n\n else{\n\n if(val > 16)\n\n val -=32;\n\n if(val < -16)\n\n val+=32;\n\n sign = val < 0;\n\n code = sign ? -val : val; \n\n put_bits(&s->pb,h261_mv_tab[code][1],h261_mv_tab[code][0]);\n\n put_bits(&s->pb,1,sign);\n\n }\n\n}\n"}} {"sample_id": "f7c11b535040df31cc8bc3b1f0c33f546073ee62_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;\n \n+ /* we remove the notdirty callback only if the code has been\n+\n+ flushed */\n+\n+ if (dirty_flags == 0xff)\n \n tlb_set_dirty(cpu_single_env, cpu_single_env->mem_io_vaddr);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void notdirty_mem_writel(void *opaque, target_phys_addr_t ram_addr,\n\n uint32_t val)\n\n{\n\n int dirty_flags;\n\n dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];\n\n if (!(dirty_flags & CODE_DIRTY_FLAG)) {\n\n#if !defined(CONFIG_USER_ONLY)\n\n tb_invalidate_phys_page_fast(ram_addr, 4);\n\n dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];\n\n#endif\n\n }\n\n stl_p(qemu_get_ram_ptr(ram_addr), val);\n\n dirty_flags |= (0xff & ~CODE_DIRTY_FLAG);\n\n phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;\n\n /* we remove the notdirty callback only if the code has been\n\n flushed */\n\n if (dirty_flags == 0xff)\n\n tlb_set_dirty(cpu_single_env, cpu_single_env->mem_io_vaddr);\n\n}\n"}} {"sample_id": "bd269ebc82fbaa5fe7ce5bc7c1770ac8acecd884_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n info->service = g_strdup(addr->u.inet.data->port);\n \n if (addr->u.inet.data->ipv6) {\n+\n+ info->family = NETWORK_ADDRESS_FAMILY_IPV6;\n+\n+ } else {\n+\n info->family = NETWORK_ADDRESS_FAMILY_IPV4;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vnc_init_basic_info(SocketAddressLegacy *addr,\n\n VncBasicInfo *info,\n\n Error **errp)\n\n{\n\n switch (addr->type) {\n\n case SOCKET_ADDRESS_LEGACY_KIND_INET:\n\n info->host = g_strdup(addr->u.inet.data->host);\n\n info->service = g_strdup(addr->u.inet.data->port);\n\n if (addr->u.inet.data->ipv6) {\n\n info->family = NETWORK_ADDRESS_FAMILY_IPV6;\n\n } else {\n\n info->family = NETWORK_ADDRESS_FAMILY_IPV4;\n\n }\n\n break;\n\n\n\n case SOCKET_ADDRESS_LEGACY_KIND_UNIX:\n\n info->host = g_strdup(\"\");\n\n info->service = g_strdup(addr->u.q_unix.data->path);\n\n info->family = NETWORK_ADDRESS_FAMILY_UNIX;\n\n break;\n\n\n\n case SOCKET_ADDRESS_LEGACY_KIND_VSOCK:\n\n case SOCKET_ADDRESS_LEGACY_KIND_FD:\n\n error_setg(errp, \"Unsupported socket address type %s\",\n\n SocketAddressLegacyKind_lookup[addr->type]);\n\n break;\n\n default:\n\n abort();\n\n }\n\n\n\n return;\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n \n \n+ ets = qemu_mallocz(sizeof (*ets));\n+\n+ ets->num_notes = 1; /* only prstatus is dumped */\n+\n+ fill_prstatus(&ets->prstatus, ts, 0);\n \n elf_core_copy_regs(&ets->prstatus.pr_reg, env);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void fill_thread_info(struct elf_note_info *info, const CPUState *env)\n\n{\n\n TaskState *ts = (TaskState *)env->opaque;\n\n struct elf_thread_status *ets;\n\n\n\n ets = qemu_mallocz(sizeof (*ets));\n\n ets->num_notes = 1; /* only prstatus is dumped */\n\n fill_prstatus(&ets->prstatus, ts, 0);\n\n elf_core_copy_regs(&ets->prstatus.pr_reg, env);\n\n fill_note(&ets->notes[0], \"CORE\", NT_PRSTATUS, sizeof (ets->prstatus),\n\n &ets->prstatus);\n\n\n\n TAILQ_INSERT_TAIL(&info->thread_list, ets, ets_link);\n\n\n\n info->notes_size += note_size(&ets->notes[0]);\n\n}\n"}} {"sample_id": "f738140807f504c9af7850042067777832f05e88", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int decode_pic_timing(HEVCSEIContext *s, GetBitContext *gb, const HEVCParamSets *ps,\n \n void *logctx)\n \n@@ -16,7 +16,7 @@\n \n sps = (HEVCSPS*)ps->sps_list[s->active_seq_parameter_set_id]->data;\n \n+\n \n if (sps->vui.frame_field_info_present_flag) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int decode_pic_timing(HEVCSEIContext *s, GetBitContext *gb, const HEVCParamSets *ps,\n\n void *logctx)\n\n{\n\n HEVCSEIPictureTiming *h = &s->picture_timing;\n\n HEVCSPS *sps;\n\n\n\n if (!ps->sps_list[s->active_seq_parameter_set_id])\n\n return(AVERROR(ENOMEM));\n\n sps = (HEVCSPS*)ps->sps_list[s->active_seq_parameter_set_id]->data;\n\n\n\n if (sps->vui.frame_field_info_present_flag) {\n\n int pic_struct = get_bits(gb, 4);\n\n h->picture_struct = AV_PICTURE_STRUCTURE_UNKNOWN;\n\n if (pic_struct == 2) {\n\n av_log(logctx, AV_LOG_DEBUG, \"BOTTOM Field\\n\");\n\n h->picture_struct = AV_PICTURE_STRUCTURE_BOTTOM_FIELD;\n\n } else if (pic_struct == 1) {\n\n av_log(logctx, AV_LOG_DEBUG, \"TOP Field\\n\");\n\n h->picture_struct = AV_PICTURE_STRUCTURE_TOP_FIELD;\n\n }\n\n get_bits(gb, 2); // source_scan_type\n\n get_bits(gb, 1); // duplicate_flag\n\n }\n\n return 1;\n\n}\n"}} {"sample_id": "548f66db33b91bf305c4e5228bb29585701ab58d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n if (a) {\n \n gen_branch_a(dc, target, dc->npc, r_cond);\n+\n+ dc->is_br = 1;\n+\n+ } else {\n+\n dc->pc = dc->npc;\n \n dc->jump_pc[0] = target;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void do_branch_reg(DisasContext *dc, int32_t offset, uint32_t insn,\n\n TCGv r_cond, TCGv r_reg)\n\n{\n\n unsigned int cond = GET_FIELD_SP(insn, 25, 27), a = (insn & (1 << 29));\n\n target_ulong target = dc->pc + offset;\n\n\n\n flush_cond(dc, r_cond);\n\n gen_cond_reg(r_cond, cond, r_reg);\n\n if (a) {\n\n gen_branch_a(dc, target, dc->npc, r_cond);\n\n dc->is_br = 1;\n\n } else {\n\n dc->pc = dc->npc;\n\n dc->jump_pc[0] = target;\n\n dc->jump_pc[1] = dc->npc + 4;\n\n dc->npc = JUMP_PC;\n\n }\n\n}\n"}} {"sample_id": "03ae4133ab8675d4c67e6fdc8032de7c53a89514", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n }\n \n+\n+\n+ if (!ppc_cpu_is_valid(pcc)) {\n+\n+ return -1;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static gint ppc_cpu_compare_class_pvr_mask(gconstpointer a, gconstpointer b)\n\n{\n\n ObjectClass *oc = (ObjectClass *)a;\n\n uint32_t pvr = *(uint32_t *)b;\n\n PowerPCCPUClass *pcc = (PowerPCCPUClass *)a;\n\n gint ret;\n\n\n\n /* -cpu host does a PVR lookup during construction */\n\n if (unlikely(strcmp(object_class_get_name(oc),\n\n TYPE_HOST_POWERPC_CPU) == 0)) {\n\n return -1;\n\n }\n\n\n\n if (!ppc_cpu_is_valid(pcc)) {\n\n return -1;\n\n }\n\n\n\n ret = (((pcc->pvr & pcc->pvr_mask) == (pvr & pcc->pvr_mask)) ? 0 : -1);\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "3b6c5ad2f67cc8eeeec89fb9d497ec79c1f3948a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n int bin, band, ch, band_end;\n+\n+\n+\n+ bin = s->start_freq[CPL_CH];\n+\n for (band = 0; band < s->num_cpl_bands; band++) {\n \n band_end = bin + s->cpl_band_sizes[band];", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void calc_transform_coeffs_cpl(AC3DecodeContext *s)\n\n{\n\n int bin, band, ch, band_end;\n\n\n\n bin = s->start_freq[CPL_CH];\n\n for (band = 0; band < s->num_cpl_bands; band++) {\n\n band_end = bin + s->cpl_band_sizes[band];\n\n for (; bin < band_end; bin++) {\n\n for (ch = 1; ch <= s->fbw_channels; ch++) {\n\n if (s->channel_in_cpl[ch]) {\n\n s->fixed_coeffs[ch][bin] = ((int64_t)s->fixed_coeffs[CPL_CH][bin] *\n\n (int64_t)s->cpl_coords[ch][band]) >> 23;\n\n if (ch == 2 && s->phase_flags[band])\n\n s->fixed_coeffs[ch][bin] = -s->fixed_coeffs[ch][bin];\n\n }\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "457772e68f83ea02a33b58a70bd25ec5c028c077", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n if ((err = getnameinfo((struct sockaddr *)sa, salen,\n \n+ host, sizeof(host),\n+\n+ serv, sizeof(serv),\n+\n+ NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {\n \n VNC_DEBUG(\"Cannot resolve address %d: %s\\n\",\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static char *addr_to_string(const char *format,\n\n struct sockaddr_storage *sa,\n\n socklen_t salen) {\n\n char *addr;\n\n char host[NI_MAXHOST];\n\n char serv[NI_MAXSERV];\n\n int err;\n\n\n\n if ((err = getnameinfo((struct sockaddr *)sa, salen,\n\n host, sizeof(host),\n\n serv, sizeof(serv),\n\n NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {\n\n VNC_DEBUG(\"Cannot resolve address %d: %s\\n\",\n\n err, gai_strerror(err));\n\n return NULL;\n\n }\n\n\n\n if (asprintf(&addr, format, host, serv) < 0)\n\n return NULL;\n\n\n\n return addr;\n\n}\n"}} {"sample_id": "229843aa359ae0c9519977d7fa952688db63f559", "diff": "--- a/source.c\n+++ b/source.c\n@@ -42,11 +42,11 @@\n \n }\n \n+\n+\n+ sumscore = sumscore * CHECK_COUNT / check_count;\n+\n+ maxscore = maxscore * CHECK_COUNT / CHECK_BLOCK;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mpegts_probe(AVProbeData *p)\n\n{\n\n const int size = p->buf_size;\n\n int maxscore = 0;\n\n int sumscore = 0;\n\n int i;\n\n int check_count = size / TS_FEC_PACKET_SIZE;\n\n#define CHECK_COUNT 10\n\n#define CHECK_BLOCK 100\n\n\n\n if (check_count < CHECK_COUNT)\n\n return 0;\n\n\n\n for (i = 0; ibuf + TS_PACKET_SIZE *i, TS_PACKET_SIZE *left, TS_PACKET_SIZE , NULL, 1);\n\n int dvhs_score = analyze(p->buf + TS_DVHS_PACKET_SIZE*i, TS_DVHS_PACKET_SIZE*left, TS_DVHS_PACKET_SIZE, NULL, 1);\n\n int fec_score = analyze(p->buf + TS_FEC_PACKET_SIZE *i, TS_FEC_PACKET_SIZE *left, TS_FEC_PACKET_SIZE , NULL, 1);\n\n score = FFMAX3(score, dvhs_score, fec_score);\n\n sumscore += score;\n\n maxscore = FFMAX(maxscore, score);\n\n }\n\n\n\n sumscore = sumscore * CHECK_COUNT / check_count;\n\n maxscore = maxscore * CHECK_COUNT / CHECK_BLOCK;\n\n\n\n av_dlog(0, \"TS score: %d %d\\n\", sumscore, maxscore);\n\n\n\n if (sumscore > 6) return AVPROBE_SCORE_MAX + sumscore - CHECK_COUNT;\n\n else if (maxscore > 6) return AVPROBE_SCORE_MAX/2 + sumscore - CHECK_COUNT;\n\n else\n\n return 0;\n\n}\n"}} {"sample_id": "e8e880a72e63d0587f03aa670be3de683b881ca8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -39,11 +39,11 @@\n \n m->m_len = pkt_len + 2;\n \n+ memcpy(m->m_data + 2, pkt, pkt_len);\n+\n+\n+\n+ m->m_data += 2 + ETH_HLEN;\n \n m->m_len -= 2 + ETH_HLEN;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void slirp_input(const uint8_t *pkt, int pkt_len)\n\n{\n\n struct mbuf *m;\n\n int proto;\n\n\n\n if (pkt_len < ETH_HLEN)\n\n return;\n\n\n\n proto = ntohs(*(uint16_t *)(pkt + 12));\n\n switch(proto) {\n\n case ETH_P_ARP:\n\n arp_input(pkt, pkt_len);\n\n break;\n\n case ETH_P_IP:\n\n m = m_get();\n\n if (!m)\n\n return;\n\n /* Note: we add to align the IP header */\n\n\n\n\n m->m_len = pkt_len + 2;\n\n memcpy(m->m_data + 2, pkt, pkt_len);\n\n\n\n m->m_data += 2 + ETH_HLEN;\n\n m->m_len -= 2 + ETH_HLEN;\n\n\n\n ip_input(m);\n\n break;\n\n default:\n\n break;\n\n"}} {"sample_id": "f897bf751fbd95e4015b95d202c706548586813a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static VirtIOBlockReq *virtio_blk_alloc_request(VirtIOBlock *s)\n \n {\n \n VirtIOBlockReq *req = g_slice_new(VirtIOBlockReq);\n+\n req->dev = s;\n \n req->qiov.size = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static VirtIOBlockReq *virtio_blk_alloc_request(VirtIOBlock *s)\n\n{\n\n VirtIOBlockReq *req = g_slice_new(VirtIOBlockReq);\n\n req->dev = s;\n\n req->qiov.size = 0;\n\n req->next = NULL;\n\n req->elem = g_slice_new(VirtQueueElement);\n\n return req;\n\n}\n"}} {"sample_id": "4d9ad7f793605abd9806fc932b3e04e028894565", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n uint64_t HELPER(neon_abdl_s16)(uint32_t a, uint32_t b)\n \n {\n+\n+ uint64_t tmp;\n \n+ uint64_t result;\n \n+ DO_ABD(result, a, b, int8_t);\n \n DO_ABD(tmp, a >> 8, b >> 8, int8_t);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "uint64_t HELPER(neon_abdl_s16)(uint32_t a, uint32_t b)\n\n{\n\n uint64_t tmp;\n\n uint64_t result;\n\n DO_ABD(result, a, b, int8_t);\n\n DO_ABD(tmp, a >> 8, b >> 8, int8_t);\n\n result |= tmp << 16;\n\n DO_ABD(tmp, a >> 16, b >> 16, int8_t);\n\n result |= tmp << 32;\n\n DO_ABD(tmp, a >> 24, b >> 24, int8_t);\n\n result |= tmp << 48;\n\n return result;\n\n}\n"}} {"sample_id": "acd82796211041c5af43c8c523b85d250c2ccebe", "diff": "--- a/source.c\n+++ b/source.c\n@@ -35,9 +35,9 @@\n \"size %u\\n\", __func__, offset, size);\n trace_gicv3_redist_badwrite(gicv3_redist_affid(cs), offset, data,\n size, attrs.secure);\n+ } else {\n+ trace_gicv3_redist_write(gicv3_redist_affid(cs), offset, data,\n+ size, attrs.secure);\n+ }\n+ return r;\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,\n unsigned size, MemTxAttrs attrs)\n{\n GICv3State *s = opaque;\n GICv3CPUState *cs;\n MemTxResult r;\n int cpuidx;\n /* This region covers all the redistributor pages; there are\n * (for GICv3) two 64K pages per CPU. At the moment they are\n * all contiguous (ie in this one region), though we might later\n * want to allow splitting of redistributor pages into several\n * blocks so we can support more CPUs.\n */\n cpuidx = offset / 0x20000;\n offset %= 0x20000;\n assert(cpuidx < s->num_cpu);\n cs = &s->cpu[cpuidx];\n switch (size) {\n case 1:\n r = gicr_writeb(cs, offset, data, attrs);\n break;\n case 4:\n r = gicr_writel(cs, offset, data, attrs);\n break;\n case 8:\n r = gicr_writell(cs, offset, data, attrs);\n break;\n default:\n r = MEMTX_ERROR;\n break;\n }\n if (r == MEMTX_ERROR) {\n qemu_log_mask(LOG_GUEST_ERROR,\n \"%s: invalid guest write at offset \" TARGET_FMT_plx\n \"size %u\\n\", __func__, offset, size);\n trace_gicv3_redist_badwrite(gicv3_redist_affid(cs), offset, data,\n size, attrs.secure);\n } else {\n trace_gicv3_redist_write(gicv3_redist_affid(cs), offset, data,\n size, attrs.secure);\n }\n return r;\n}"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_75", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n .bs = bs,\n \n .offset = offset,\n+\n+ .bytes = bytes,\n+\n+ .is_write = is_write,\n+\n .co = qemu_coroutine_self(),\n \n .serialising = false,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void tracked_request_begin(BdrvTrackedRequest *req,\n\n BlockDriverState *bs,\n\n int64_t offset,\n\n unsigned int bytes, bool is_write)\n\n{\n\n *req = (BdrvTrackedRequest){\n\n .bs = bs,\n\n .offset = offset,\n\n .bytes = bytes,\n\n .is_write = is_write,\n\n .co = qemu_coroutine_self(),\n\n .serialising = false,\n\n .overlap_offset = offset,\n\n .overlap_bytes = bytes,\n\n };\n\n\n\n qemu_co_queue_init(&req->wait_queue);\n\n\n\n QLIST_INSERT_HEAD(&bs->tracked_requests, req, list);\n\n}\n"}} {"sample_id": "c3ab0004ae4dffc32494ae84dd15cfaa909a7884_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static inline void RENAME(BEToUV)(uint8_t *dstU, uint8_t *dstV, const uint8_t *src1, const uint8_t *src2, int width, uint32_t *unused)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void RENAME(BEToUV)(uint8_t *dstU, uint8_t *dstV, const uint8_t *src1, const uint8_t *src2, int width, uint32_t *unused)\n\n{\n\n#if COMPILE_TEMPLATE_MMX\n\n __asm__ volatile(\n\n \"movq \"MANGLE(bm01010101)\", %%mm4 \\n\\t\"\n\n \"mov %0, %%\"REG_a\" \\n\\t\"\n\n \"1: \\n\\t\"\n\n \"movq (%1, %%\"REG_a\",2), %%mm0 \\n\\t\"\n\n \"movq 8(%1, %%\"REG_a\",2), %%mm1 \\n\\t\"\n\n \"movq (%2, %%\"REG_a\",2), %%mm2 \\n\\t\"\n\n \"movq 8(%2, %%\"REG_a\",2), %%mm3 \\n\\t\"\n\n \"pand %%mm4, %%mm0 \\n\\t\"\n\n \"pand %%mm4, %%mm1 \\n\\t\"\n\n \"pand %%mm4, %%mm2 \\n\\t\"\n\n \"pand %%mm4, %%mm3 \\n\\t\"\n\n \"packuswb %%mm1, %%mm0 \\n\\t\"\n\n \"packuswb %%mm3, %%mm2 \\n\\t\"\n\n \"movq %%mm0, (%3, %%\"REG_a\") \\n\\t\"\n\n \"movq %%mm2, (%4, %%\"REG_a\") \\n\\t\"\n\n \"add $8, %%\"REG_a\" \\n\\t\"\n\n \" js 1b \\n\\t\"\n\n : : \"g\" ((x86_reg)-width), \"r\" (src1+width*2), \"r\" (src2+width*2), \"r\" (dstU+width), \"r\" (dstV+width)\n\n : \"%\"REG_a\n\n );\n\n#else\n\n int i;\n\n for (i=0; i= 0 && pitch_delay_frac < precision);\n\n\n\n for(n=0; n> 15);\n\n }\n\n}\n"}} {"sample_id": "8607f5c3072caeebbe0217df28651fffd3a79fd9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,9 +11,9 @@\n virtio_tswap64s(vdev, &desc->addr);\n \n virtio_tswap32s(vdev, &desc->len);\n+\n+ virtio_tswap16s(vdev, &desc->flags);\n+\n+ virtio_tswap16s(vdev, &desc->next);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vring_desc_read(VirtIODevice *vdev, VRingDesc *desc,\n\n hwaddr desc_pa, int i)\n\n{\n\n address_space_read(&address_space_memory, desc_pa + i * sizeof(VRingDesc),\n\n MEMTXATTRS_UNSPECIFIED, (void *)desc, sizeof(VRingDesc));\n\n virtio_tswap64s(vdev, &desc->addr);\n\n virtio_tswap32s(vdev, &desc->len);\n\n virtio_tswap16s(vdev, &desc->flags);\n\n virtio_tswap16s(vdev, &desc->next);\n\n}\n"}} {"sample_id": "0e9b9edae7bebfd31fdbead4ccbbce03876a7edd_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,8 +3,8 @@\n {\n \n AcpiFacsDescriptorRev1 *facs = acpi_data_push(table_data, sizeof *facs);\n+\n+ memcpy(&facs->signature, \"FACS\", 4);\n \n facs->length = cpu_to_le32(sizeof(*facs));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "build_facs(GArray *table_data, GArray *linker)\n\n{\n\n AcpiFacsDescriptorRev1 *facs = acpi_data_push(table_data, sizeof *facs);\n\n memcpy(&facs->signature, \"FACS\", 4);\n\n facs->length = cpu_to_le32(sizeof(*facs));\n\n}\n"}} {"sample_id": "d6604b29ef544793479d7fb4e05ef6622bb3e534_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,6 +4,6 @@\n \n av_frame_free(&avctx->coded_frame);\n \n+ return 0;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int bmp_encode_close(AVCodecContext *avctx)\n\n{\n\n av_frame_free(&avctx->coded_frame);\n\n return 0;\n\n}\n"}} {"sample_id": "5fb6c7a8b26eab1a22207d24b4784bd2b39ab54b_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n size_t len) {\n \n+ struct VncState *vs = (struct VncState *)transport;\n+\n+ int ret;\n+\n+\n \n retry:\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ssize_t vnc_tls_push(gnutls_transport_ptr_t transport,\n\n const void *data,\n\n size_t len) {\n\n struct VncState *vs = (struct VncState *)transport;\n\n int ret;\n\n\n\n retry:\n\n ret = send(vs->csock, data, len, 0);\n\n if (ret < 0) {\n\n\tif (errno == EINTR)\n\n\t goto retry;\n\n\treturn -1;\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "207f328afc2137d422f59293ba37b8be5d3e1617_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n }\n \n+\n+\n+ if (!vs->lossy_rect[sty][stx]) {\n+\n+ continue;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)\n\n{\n\n VncState *vs;\n\n int sty = y / VNC_STAT_RECT;\n\n int stx = x / VNC_STAT_RECT;\n\n int has_dirty = 0;\n\n\n\n y = y / VNC_STAT_RECT * VNC_STAT_RECT;\n\n x = x / VNC_STAT_RECT * VNC_STAT_RECT;\n\n\n\n QTAILQ_FOREACH(vs, &vd->clients, next) {\n\n int j;\n\n\n\n /* kernel send buffers are full -> refresh later */\n\n if (vs->output.offset) {\n\n continue;\n\n }\n\n\n\n if (!vs->lossy_rect[sty][stx]) {\n\n continue;\n\n }\n\n vs->lossy_rect[sty][stx] = 0;\n\n for (j = 0; j < VNC_STAT_RECT; ++j) {\n\n vnc_set_bits(vs->dirty[y + j], x / 16, VNC_STAT_RECT / 16);\n\n }\n\n has_dirty++;\n\n }\n\n return has_dirty;\n\n}\n"}} {"sample_id": "0b8b8753e4d94901627b3e86431230f2319215c4_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void test_lifecycle(void)\n \n {\n+\n+ Coroutine *coroutine;\n \n bool done = false;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_lifecycle(void)\n\n{\n\n Coroutine *coroutine;\n\n bool done = false;\n\n\n\n /* Create, enter, and return from coroutine */\n\n coroutine = qemu_coroutine_create(set_and_exit);\n\n qemu_coroutine_enter(coroutine, &done);\n\n g_assert(done); /* expect done to be true (first time) */\n\n\n\n /* Repeat to check that no state affects this test */\n\n done = false;\n\n coroutine = qemu_coroutine_create(set_and_exit);\n\n qemu_coroutine_enter(coroutine, &done);\n\n g_assert(done); /* expect done to be true (second time) */\n\n}\n"}} {"sample_id": "b0706b716769494f321a0d2bfd9fa9893992f995_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry, uintptr_t start,\n+\n+ uintptr_t length)\n+\n {\n \n uintptr_t addr;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry, uintptr_t start,\n\n uintptr_t length)\n\n{\n\n uintptr_t addr;\n\n\n\n if (tlb_is_dirty_ram(tlb_entry)) {\n\n addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend;\n\n if ((addr - start) < length) {\n\n tlb_entry->addr_write |= TLB_NOTDIRTY;\n\n }\n\n }\n\n}\n"}} {"sample_id": "b64bd51efa9bbf30df1b2f91477d2805678d0b93_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,6 +6,6 @@\n \n assert(bdrv_dirty_bitmap_enabled(bitmap));\n \n+ hbitmap_set(bitmap->bitmap, cur_sector, nr_sectors);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bdrv_set_dirty_bitmap(BdrvDirtyBitmap *bitmap,\n\n int64_t cur_sector, int64_t nr_sectors)\n\n{\n\n assert(bdrv_dirty_bitmap_enabled(bitmap));\n\n hbitmap_set(bitmap->bitmap, cur_sector, nr_sectors);\n\n}\n"}} {"sample_id": "1dc42050185d63c1de5d16146fbaee92640af187_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -35,11 +35,11 @@\n ret = ff_draw_slice(link, 0, color->h, 1);\n \n if (ret < 0)\n+\n+ goto fail;\n+\n+\n+\n ret = ff_end_frame(link);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int color_request_frame(AVFilterLink *link)\n\n{\n\n ColorContext *color = link->src->priv;\n\n AVFilterBufferRef *picref = ff_get_video_buffer(link, AV_PERM_WRITE, color->w, color->h);\n\n int ret;\n\n\n\n picref->video->pixel_aspect = (AVRational) {1, 1};\n\n picref->pts = color->pts++;\n\n picref->pos = -1;\n\n\n\n ret = ff_start_frame(link, avfilter_ref_buffer(picref, ~0));\n\n if (ret < 0)\n\n goto fail;\n\n\n\n ff_draw_rectangle(picref->data, picref->linesize,\n\n color->line, color->line_step, color->hsub, color->vsub,\n\n 0, 0, color->w, color->h);\n\n ret = ff_draw_slice(link, 0, color->h, 1);\n\n if (ret < 0)\n\n goto fail;\n\n\n\n ret = ff_end_frame(link);\n\n\n\nfail:\n\n avfilter_unref_buffer(picref);\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "d07bde88a52bf293c3f8846cfd162e0a57e1557c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+int cpu_gen_code(CPUState *env, TranslationBlock *tb,\n \n int max_code_size, int *gen_code_size_ptr)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int cpu_gen_code(CPUState *env, TranslationBlock *tb,\n\n int max_code_size, int *gen_code_size_ptr)\n\n{\n\n uint8_t *gen_code_buf;\n\n int gen_code_size;\n\n\n\n if (gen_intermediate_code(env, tb) < 0)\n\n return -1;\n\n \n\n /* generate machine code */\n\n tb->tb_next_offset[0] = 0xffff;\n\n tb->tb_next_offset[1] = 0xffff;\n\n gen_code_buf = tb->tc_ptr;\n\n#ifdef USE_DIRECT_JUMP\n\n /* the following two entries are optional (only used for string ops) */\n\n tb->tb_jmp_offset[2] = 0xffff;\n\n tb->tb_jmp_offset[3] = 0xffff;\n\n#endif\n\n dyngen_labels(gen_labels, nb_gen_labels, gen_code_buf, gen_opc_buf);\n\n \n\n gen_code_size = dyngen_code(gen_code_buf, tb->tb_next_offset,\n\n#ifdef USE_DIRECT_JUMP\n\n tb->tb_jmp_offset,\n\n#else\n\n NULL,\n\n#endif\n\n gen_opc_buf, gen_opparam_buf, gen_labels);\n\n *gen_code_size_ptr = gen_code_size;\n\n#ifdef DEBUG_DISAS\n\n if (loglevel & CPU_LOG_TB_OUT_ASM) {\n\n fprintf(logfile, \"OUT: [size=%d]\\n\", *gen_code_size_ptr);\n\n disas(logfile, tb->tc_ptr, *gen_code_size_ptr);\n\n fprintf(logfile, \"\\n\");\n\n fflush(logfile);\n\n }\n\n#endif\n\n return 0;\n\n}\n"}} {"sample_id": "7385aed20db5d83979f683b9d0048674411e963c_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n default:\n \n+ case FSR_RD_ZERO:\n+\n+ rnd_mode = float_round_to_zero;\n+\n+ break;\n \n case FSR_RD_POS:\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void set_fsr(CPUSPARCState *env)\n\n{\n\n int rnd_mode;\n\n\n\n switch (env->fsr & FSR_RD_MASK) {\n\n case FSR_RD_NEAREST:\n\n rnd_mode = float_round_nearest_even;\n\n break;\n\n default:\n\n case FSR_RD_ZERO:\n\n rnd_mode = float_round_to_zero;\n\n break;\n\n case FSR_RD_POS:\n\n rnd_mode = float_round_up;\n\n break;\n\n case FSR_RD_NEG:\n\n rnd_mode = float_round_down;\n\n break;\n\n }\n\n set_float_rounding_mode(rnd_mode, &env->fp_status);\n\n}\n"}} {"sample_id": "b3ceef24f4fee8d5ed96b8c4a5d3e80c0a651f0b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,11 +34,11 @@\n \n case 1:\n \n+\ts->rregs[0] &= ~1;\n+\n+ clr_rxint(s);\n+\n+\tif (s->type == kbd || s->type == mouse)\n \n \t ret = get_queue(s);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t slavio_serial_mem_readb(void *opaque, target_phys_addr_t addr)\n\n{\n\n SerialState *ser = opaque;\n\n ChannelState *s;\n\n uint32_t saddr;\n\n uint32_t ret;\n\n int channel;\n\n\n\n saddr = (addr & 3) >> 1;\n\n channel = (addr & SERIAL_MAXADDR) >> 2;\n\n s = &ser->chn[channel];\n\n switch (saddr) {\n\n case 0:\n\n\tSER_DPRINTF(\"Read channel %c, reg[%d] = %2.2x\\n\", CHN_C(s), s->reg, s->rregs[s->reg]);\n\n\tret = s->rregs[s->reg];\n\n\ts->reg = 0;\n\n\treturn ret;\n\n case 1:\n\n\ts->rregs[0] &= ~1;\n\n clr_rxint(s);\n\n\tif (s->type == kbd || s->type == mouse)\n\n\t ret = get_queue(s);\n\n\telse\n\n\t ret = s->rx;\n\n\tSER_DPRINTF(\"Read channel %c, ch %d\\n\", CHN_C(s), ret);\n\n\treturn ret;\n\n default:\n\n\tbreak;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "c976437c7dba9c7444fb41df45468968aaa326ad", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n XenPTMSI *msi = s->msi;\n \n \n+\n if (!msi) {\n \n return;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void xen_pt_msi_disable(XenPCIPassthroughState *s)\n\n{\n\n XenPTMSI *msi = s->msi;\n\n\n\n if (!msi) {\n\n return;\n\n }\n\n\n\n xen_pt_msi_set_enable(s, false);\n\n\n\n msi_msix_disable(s, msi_addr64(msi), msi->data, msi->pirq, false,\n\n msi->initialized);\n\n\n\n /* clear msi info */\n\n msi->flags = 0;\n\n msi->mapped = false;\n\n msi->pirq = XEN_PT_UNASSIGNED_PIRQ;\n\n}\n"}} {"sample_id": "bb593904c18e22ea0671dfa1b02e24982f2bf0ea_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n 0x00000000);\n \n+ spr_register(env, SPR_DAR, \"DAR\",\n+\n+ SPR_NOACCESS, SPR_NOACCESS,\n+\n+ &spr_read_generic, &spr_write_generic,\n \n 0x00000000);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gen_spr_ne_601 (CPUPPCState *env)\n\n{\n\n /* Exception processing */\n\n spr_register(env, SPR_DSISR, \"DSISR\",\n\n SPR_NOACCESS, SPR_NOACCESS,\n\n &spr_read_generic, &spr_write_generic,\n\n 0x00000000);\n\n spr_register(env, SPR_DAR, \"DAR\",\n\n SPR_NOACCESS, SPR_NOACCESS,\n\n &spr_read_generic, &spr_write_generic,\n\n 0x00000000);\n\n /* Timer */\n\n spr_register(env, SPR_DECR, \"DECR\",\n\n SPR_NOACCESS, SPR_NOACCESS,\n\n &spr_read_decr, &spr_write_decr,\n\n 0x00000000);\n\n /* Memory management */\n\n spr_register(env, SPR_SDR1, \"SDR1\",\n\n SPR_NOACCESS, SPR_NOACCESS,\n\n &spr_read_sdr1, &spr_write_sdr1,\n\n 0x00000000);\n\n}\n"}} {"sample_id": "7ccc0ed6a0cedbe80443779a805ec90335cd832f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n \n \n+ if (len == 2)\n+\n+ return avio_rl16(bc);\n+\n+ else if (len == 4)\n \n return avio_rl32(bc);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t get_fourcc(AVIOContext *bc)\n\n{\n\n unsigned int len = ffio_read_varlen(bc);\n\n\n\n if (len == 2)\n\n return avio_rl16(bc);\n\n else if (len == 4)\n\n return avio_rl32(bc);\n\n else\n\n return -1;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void fd_accept_incoming_migration(void *opaque)\n+\n+{\n+\n QEMUFile *f = opaque;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void fd_accept_incoming_migration(void *opaque)\n\n{\n\n QEMUFile *f = opaque;\n\n\n\n qemu_set_fd_handler2(qemu_get_fd(f), NULL, NULL, NULL, NULL);\n\n process_incoming_migration(f);\n\n}\n"}} {"sample_id": "65afd211c71fc91750d8a18f9604c1e57a5202fb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -54,11 +54,11 @@\n \n retry = true;\n \n+ break;\n+\n+ }\n+\n+ }\n \n } while (retry);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void coroutine_fn wait_for_overlapping_requests(BlockDriverState *bs,\n\n int64_t offset, unsigned int bytes)\n\n{\n\n BdrvTrackedRequest *req;\n\n int64_t cluster_offset;\n\n unsigned int cluster_bytes;\n\n bool retry;\n\n\n\n /* If we touch the same cluster it counts as an overlap. This guarantees\n\n * that allocating writes will be serialized and not race with each other\n\n * for the same cluster. For example, in copy-on-read it ensures that the\n\n * CoR read and write operations are atomic and guest writes cannot\n\n * interleave between them.\n\n */\n\n round_bytes_to_clusters(bs, offset, bytes, &cluster_offset, &cluster_bytes);\n\n\n\n do {\n\n retry = false;\n\n QLIST_FOREACH(req, &bs->tracked_requests, list) {\n\n if (tracked_request_overlaps(req, cluster_offset, cluster_bytes)) {\n\n /* Hitting this means there was a reentrant request, for\n\n * example, a block driver issuing nested requests. This must\n\n * never happen since it means deadlock.\n\n */\n\n assert(qemu_coroutine_self() != req->co);\n\n\n\n qemu_co_queue_wait(&req->wait_queue);\n\n retry = true;\n\n break;\n\n }\n\n }\n\n } while (retry);\n\n}\n"}} {"sample_id": "111049a4ecefc9cf1ac75c773f4c5c165f27fe63_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void drive_backup_abort(BlkActionState *common)\n \n+{\n+\n+ DriveBackupState *state = DO_UPCAST(DriveBackupState, common, common);\n \n BlockDriverState *bs = state->bs;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void drive_backup_abort(BlkActionState *common)\n\n{\n\n DriveBackupState *state = DO_UPCAST(DriveBackupState, common, common);\n\n BlockDriverState *bs = state->bs;\n\n\n\n /* Only cancel if it's the job we started */\n\n if (bs && bs->job && bs->job == state->job) {\n\n block_job_cancel_sync(bs->job);\n\n }\n\n}\n"}} {"sample_id": "0b8b8753e4d94901627b3e86431230f2319215c4_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n unsigned int i, maxcycles;\n+\n double duration;\n \n+\n \n maxcycles = 100000000;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void perf_yield(void)\n\n{\n\n unsigned int i, maxcycles;\n\n double duration;\n\n\n\n maxcycles = 100000000;\n\n i = maxcycles;\n\n Coroutine *coroutine = qemu_coroutine_create(yield_loop);\n\n\n\n g_test_timer_start();\n\n while (i > 0) {\n\n qemu_coroutine_enter(coroutine, &i);\n\n }\n\n duration = g_test_timer_elapsed();\n\n\n\n g_test_message(\"Yield %u iterations: %f s\\n\",\n\n maxcycles, duration);\n\n}\n"}} {"sample_id": "57d1f6d7ce23e79a8ebe4a57bd2363b269b4664b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -35,11 +35,11 @@\n /* It's hugepage, return the huge page size */\n \n return fs.f_bsize;\n+\n+ }\n+\n+\n+\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "size_t qemu_mempath_getpagesize(const char *mem_path)\n\n{\n\n#ifdef CONFIG_LINUX\n\n struct statfs fs;\n\n int ret;\n\n\n\n do {\n\n ret = statfs(mem_path, &fs);\n\n } while (ret != 0 && errno == EINTR);\n\n\n\n if (ret != 0) {\n\n fprintf(stderr, \"Couldn't statfs() memory path: %s\\n\",\n\n strerror(errno));\n\n exit(1);\n\n }\n\n\n\n if (fs.f_type == HUGETLBFS_MAGIC) {\n\n /* It's hugepage, return the huge page size */\n\n return fs.f_bsize;\n\n }\n\n\n\n\n\n\n\n\n return getpagesize();\n\n}"}} {"sample_id": "c595139f1fdb5ce5ee128c317ed9e4e836282436", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n int32_t *dst = (int32_t *)_dst;\n DiracGolombLUT *future[4], *l = &lut_ctx[2*LUT_SIZE + buf[0]];\n INIT_RESIDUE(res);\n+ for (b = 1; b <= bytes; b++) {\n+ future[0] = &lut_ctx[buf[b]];\n+ future[1] = future[0] + 1*LUT_SIZE;\n+ future[2] = future[0] + 2*LUT_SIZE;\n+ future[3] = future[0] + 3*LUT_SIZE;\n if ((c_idx + 1) > coeffs)\n return c_idx;\n /* res_bits is a hint for better branch prediction */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int ff_dirac_golomb_read_32bit(DiracGolombLUT *lut_ctx, const uint8_t *buf,\n int bytes, uint8_t *_dst, int coeffs)\n{\n int i, b, c_idx = 0;\n int32_t *dst = (int32_t *)_dst;\n DiracGolombLUT *future[4], *l = &lut_ctx[2*LUT_SIZE + buf[0]];\n INIT_RESIDUE(res);\n for (b = 1; b <= bytes; b++) {\n future[0] = &lut_ctx[buf[b]];\n future[1] = future[0] + 1*LUT_SIZE;\n future[2] = future[0] + 2*LUT_SIZE;\n future[3] = future[0] + 3*LUT_SIZE;\n if ((c_idx + 1) > coeffs)\n return c_idx;\n /* res_bits is a hint for better branch prediction */\n if (res_bits && l->sign) {\n int32_t coeff = 1;\n APPEND_RESIDUE(res, l->preamble);\n for (i = 0; i < (res_bits >> 1) - 1; i++) {\n coeff <<= 1;\n coeff |= (res >> (RSIZE_BITS - 2*i - 2)) & 1;\n }\n dst[c_idx++] = l->sign * (coeff - 1);\n }\n memcpy(&dst[c_idx], l->ready, LUT_BITS*sizeof(int32_t));\n c_idx += l->ready_num;\n APPEND_RESIDUE(res, l->leftover);\n l = future[l->need_s ? 3 : !res_bits ? 2 : res_bits & 1];\n }\n return c_idx;\n}"}} {"sample_id": "dc8764f06155a7b3e635e02281b747a9e292127e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static gboolean register_signal_handlers(void)\n+\n {\n \n struct sigaction sigact, sigact_chld;\n \n+ int ret;\n+\n \n \n memset(&sigact, 0, sizeof(struct sigaction));\n@@ -13,10 +13,10 @@\n sigact.sa_handler = quit_handler;\n \n \n+\n+ ret = sigaction(SIGINT, &sigact, NULL);\n+\n+ if (ret == -1) {\n \n g_error(\"error configuring signal handler: %s\", strerror(errno));\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static gboolean register_signal_handlers(void)\n\n{\n\n struct sigaction sigact, sigact_chld;\n\n int ret;\n\n\n\n memset(&sigact, 0, sizeof(struct sigaction));\n\n sigact.sa_handler = quit_handler;\n\n\n\n ret = sigaction(SIGINT, &sigact, NULL);\n\n if (ret == -1) {\n\n g_error(\"error configuring signal handler: %s\", strerror(errno));\n\n return false;\n\n }\n\n ret = sigaction(SIGTERM, &sigact, NULL);\n\n if (ret == -1) {\n\n g_error(\"error configuring signal handler: %s\", strerror(errno));\n\n return false;\n\n }\n\n\n\n memset(&sigact_chld, 0, sizeof(struct sigaction));\n\n sigact_chld.sa_handler = child_handler;\n\n sigact_chld.sa_flags = SA_NOCLDSTOP;\n\n ret = sigaction(SIGCHLD, &sigact_chld, NULL);\n\n if (ret == -1) {\n\n g_error(\"error configuring signal handler: %s\", strerror(errno));\n\n }\n\n\n\n return true;\n\n}\n"}} {"sample_id": "f7613bee32ebd13ff4a8d721a59cf27b1fe5d94b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n }\n \n v9fs_wstat_post_chown(s, vs, err);\n+\n+ return;\n+\n+\n+\n out:\n \n v9fs_stat_free(&vs->v9stat);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void v9fs_wstat_post_utime(V9fsState *s, V9fsWstatState *vs, int err)\n\n{\n\n if (err < 0) {\n\n goto out;\n\n }\n\n\n\n if (vs->v9stat.n_gid != -1) {\n\n if (v9fs_do_chown(s, &vs->fidp->path, vs->v9stat.n_uid,\n\n vs->v9stat.n_gid)) {\n\n err = -errno;\n\n }\n\n }\n\n v9fs_wstat_post_chown(s, vs, err);\n\n return;\n\n\n\nout:\n\n v9fs_stat_free(&vs->v9stat);\n\n complete_pdu(s, vs->pdu, err);\n\n qemu_free(vs);\n\n}\n"}} {"sample_id": "621ff94d5074d88253a5818c6b9c4db718fbfc65_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n \n \n if (OpenProcessToken(GetCurrentProcess(),\n+\n+ TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY, &token))\n+\n+ {\n+\n if (!LookupPrivilegeValue(NULL, name, &priv.Privileges[0].Luid)) {\n \n error_setg(&local_err, QERR_QGA_COMMAND_FAILED,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void acquire_privilege(const char *name, Error **errp)\n\n{\n\n HANDLE token = NULL;\n\n TOKEN_PRIVILEGES priv;\n\n Error *local_err = NULL;\n\n\n\n if (OpenProcessToken(GetCurrentProcess(),\n\n TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY, &token))\n\n {\n\n if (!LookupPrivilegeValue(NULL, name, &priv.Privileges[0].Luid)) {\n\n error_setg(&local_err, QERR_QGA_COMMAND_FAILED,\n\n \"no luid for requested privilege\");\n\n goto out;\n\n }\n\n\n\n priv.PrivilegeCount = 1;\n\n priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;\n\n\n\n if (!AdjustTokenPrivileges(token, FALSE, &priv, 0, NULL, 0)) {\n\n error_setg(&local_err, QERR_QGA_COMMAND_FAILED,\n\n \"unable to acquire requested privilege\");\n\n goto out;\n\n }\n\n\n\n } else {\n\n error_setg(&local_err, QERR_QGA_COMMAND_FAILED,\n\n \"failed to open privilege token\");\n\n }\n\n\n\nout:\n\n if (token) {\n\n CloseHandle(token);\n\n }\n\n if (local_err) {\n\n error_propagate(errp, local_err);\n\n }\n\n}\n"}} {"sample_id": "3f66f764ee25f10d3e1144ebc057a949421b7728", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n Error *err = NULL;\n \n \n+\n+ v = validate_test_init(data, \"{ 'type': 'integer', 'data' : [ 1, 2 ] }\");\n+\n+\n+\n visit_type_UserDefNativeListUnion(v, &tmp, NULL, &err);\n \n g_assert(!err);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_validate_union_native_list(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n UserDefNativeListUnion *tmp = NULL;\n\n Visitor *v;\n\n Error *err = NULL;\n\n\n\n v = validate_test_init(data, \"{ 'type': 'integer', 'data' : [ 1, 2 ] }\");\n\n\n\n visit_type_UserDefNativeListUnion(v, &tmp, NULL, &err);\n\n g_assert(!err);\n\n qapi_free_UserDefNativeListUnion(tmp);\n\n}\n"}} {"sample_id": "aac8b76983e340bc744d3542d676f72efa3b474f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,8 +24,8 @@\n \n } else {\n \n+ h->s.dsp.h264_v_loop_filter_luma_intra(pix, stride, alpha, beta);\n+\n+ }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void filter_mb_edgeh( H264Context *h, uint8_t *pix, int stride, int16_t bS[4], int qp ) {\n\n int i, d;\n\n const int index_a = qp + h->slice_alpha_c0_offset;\n\n const int alpha = (alpha_table+52)[index_a];\n\n const int beta = (beta_table+52)[qp + h->slice_beta_offset];\n\n const int pix_next = stride;\n\n\n\n if( bS[0] < 4 ) {\n\n int8_t tc[4];\n\n for(i=0; i<4; i++)\n\n tc[i] = bS[i] ? (tc0_table+52)[index_a][bS[i] - 1] : -1;\n\n h->s.dsp.h264_v_loop_filter_luma(pix, stride, alpha, beta, tc);\n\n } else {\n\n h->s.dsp.h264_v_loop_filter_luma_intra(pix, stride, alpha, beta);\n\n }\n\n}\n"}} {"sample_id": "a9a72aeefbd3ef8bcbbeeccaf174ee10db2978ac", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n+int tpm_register_driver(const TPMDriverOps *tdo)\n+\n+{\n+\n+ int i;\n+\n \n \n+ for (i = 0; i < TPM_MAX_DRIVERS; i++) {\n+\n if (!be_drivers[i]) {\n \n be_drivers[i] = tdo;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int tpm_register_driver(const TPMDriverOps *tdo)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < TPM_MAX_DRIVERS; i++) {\n\n if (!be_drivers[i]) {\n\n be_drivers[i] = tdo;\n\n return 0;\n\n }\n\n }\n\n error_report(\"Could not register TPM driver\");\n\n return 1;\n\n}\n"}} {"sample_id": "68d553587c0aa271c3eb2902921b503740d775b6_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n ehci_set_state(q->ehci, async, EST_EXECUTE);\n \n+ again = 1;\n+\n+ } else {\n+\n+ ehci_set_state(q->ehci, async, EST_HORIZONTALQH);\n \n again = 1;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ehci_state_fetchqtd(EHCIQueue *q, int async)\n\n{\n\n int again = 0;\n\n\n\n get_dwords(NLPTR_GET(q->qtdaddr),(uint32_t *) &q->qtd, sizeof(EHCIqtd) >> 2);\n\n ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), &q->qtd);\n\n\n\n if (q->qtd.token & QTD_TOKEN_ACTIVE) {\n\n ehci_set_state(q->ehci, async, EST_EXECUTE);\n\n again = 1;\n\n } else {\n\n ehci_set_state(q->ehci, async, EST_HORIZONTALQH);\n\n again = 1;\n\n }\n\n\n\n return again;\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_80", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n return vlan;\n \n+ }\n+\n+ if (!allocate) {\n+\n+ return NULL;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "VLANState *qemu_find_vlan(int id, int allocate)\n\n{\n\n VLANState **pvlan, *vlan;\n\n for(vlan = first_vlan; vlan != NULL; vlan = vlan->next) {\n\n if (vlan->id == id)\n\n return vlan;\n\n }\n\n if (!allocate) {\n\n return NULL;\n\n }\n\n vlan = qemu_mallocz(sizeof(VLANState));\n\n vlan->id = id;\n\n TAILQ_INIT(&vlan->send_queue);\n\n vlan->next = NULL;\n\n pvlan = &first_vlan;\n\n while (*pvlan != NULL)\n\n pvlan = &(*pvlan)->next;\n\n *pvlan = vlan;\n\n return vlan;\n\n}\n"}} {"sample_id": "1181d93231e9b807965724587d363c1cfd5a1d0d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n uint8_t *dst,\n \n+ int32_t dst_stride)\n+\n+{\n+\n avc_luma_mid_and_aver_dst_8w_msa(src, src_stride, dst, dst_stride, 16);\n \n avc_luma_mid_and_aver_dst_8w_msa(src + 8, src_stride, dst + 8, dst_stride,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void avc_luma_mid_and_aver_dst_16x16_msa(const uint8_t *src,\n\n int32_t src_stride,\n\n uint8_t *dst,\n\n int32_t dst_stride)\n\n{\n\n avc_luma_mid_and_aver_dst_8w_msa(src, src_stride, dst, dst_stride, 16);\n\n avc_luma_mid_and_aver_dst_8w_msa(src + 8, src_stride, dst + 8, dst_stride,\n\n 16);\n\n}\n"}} {"sample_id": "b3a6a2e0417c78ec5491347eb85a7d125a5fefdc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ flag aSign;\n \n int32 aExp, shiftCount;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "int32 float128_to_int32_round_to_zero( float128 a STATUS_PARAM )\n\n{\n\n flag aSign;\n\n int32 aExp, shiftCount;\n\n uint64_t aSig0, aSig1, savedASig;\n\n int32 z;\n\n\n\n aSig1 = extractFloat128Frac1( a );\n\n aSig0 = extractFloat128Frac0( a );\n\n aExp = extractFloat128Exp( a );\n\n aSign = extractFloat128Sign( a );\n\n aSig0 |= ( aSig1 != 0 );\n\n if ( 0x401E < aExp ) {\n\n if ( ( aExp == 0x7FFF ) && aSig0 ) aSign = 0;\n\n goto invalid;\n\n }\n\n else if ( aExp < 0x3FFF ) {\n\n if ( aExp || aSig0 ) STATUS(float_exception_flags) |= float_flag_inexact;\n\n return 0;\n\n }\n\n aSig0 |= LIT64( 0x0001000000000000 );\n\n shiftCount = 0x402F - aExp;\n\n savedASig = aSig0;\n\n aSig0 >>= shiftCount;\n\n z = aSig0;\n\n if ( aSign ) z = - z;\n\n if ( ( z < 0 ) ^ aSign ) {\n\n invalid:\n\n float_raise( float_flag_invalid STATUS_VAR);\n\n return aSign ? (int32_t) 0x80000000 : 0x7FFFFFFF;\n\n }\n\n if ( ( aSig0<streams[stream_index];\n\n FFMStream *fst = st->priv_data;\n\n INT64 pts;\n\n UINT8 header[FRAME_HEADER_SIZE];\n\n int duration;\n\n\n\n if (st->codec.codec_type == CODEC_TYPE_AUDIO) {\n\n duration = ((float)st->codec.frame_size / st->codec.sample_rate * 1000000.0);\n\n } else {\n\n duration = (1000000.0 * FRAME_RATE_BASE / (float)st->codec.frame_rate);\n\n }\n\n\n\n pts = fst->pts;\n\n /* packet size & key_frame */\n\n header[0] = stream_index;\n\n header[1] = 0;\n\n if (st->codec.coded_picture->key_frame)\n\n header[1] |= FLAG_KEY_FRAME;\n\n header[2] = (size >> 16) & 0xff;\n\n header[3] = (size >> 8) & 0xff;\n\n header[4] = size & 0xff;\n\n header[5] = (duration >> 16) & 0xff;\n\n header[6] = (duration >> 8) & 0xff;\n\n header[7] = duration & 0xff;\n\n ffm_write_data(s, header, FRAME_HEADER_SIZE, pts, 1);\n\n ffm_write_data(s, buf, size, pts, 0);\n\n\n\n fst->pts += duration;\n\n return 0;\n\n}\n"}} {"sample_id": "48bf7ea81aa848027bad24f7e7791b503dff727d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void blk_io_limits_disable(BlockBackend *blk)\n+\n+{\n+\n+ assert(blk->public.throttle_group_member.throttle_state);\n \n bdrv_drained_begin(blk_bs(blk));\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void blk_io_limits_disable(BlockBackend *blk)\n\n{\n\n assert(blk->public.throttle_group_member.throttle_state);\n\n bdrv_drained_begin(blk_bs(blk));\n\n throttle_group_unregister_tgm(&blk->public.throttle_group_member);\n\n bdrv_drained_end(blk_bs(blk));\n\n}\n"}} {"sample_id": "269fc8e04906ffd965aa19425ca90980b23c6508_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ AVCodecContext *codec = s->streams[0]->codec;\n+\n+\n+\n+ if (s->nb_streams > 1) {\n \n av_log(s, AV_LOG_ERROR, \"only one stream is supported\\n\");\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int write_header(AVFormatContext *s)\n\n{\n\n AVCodecContext *codec = s->streams[0]->codec;\n\n\n\n if (s->nb_streams > 1) {\n\n av_log(s, AV_LOG_ERROR, \"only one stream is supported\\n\");\n\n return AVERROR(EINVAL);\n\n }\n\n if (codec->codec_id != AV_CODEC_ID_WAVPACK) {\n\n av_log(s, AV_LOG_ERROR, \"unsupported codec\\n\");\n\n return AVERROR(EINVAL);\n\n }\n\n if (codec->extradata_size > 0) {\n\n avpriv_report_missing_feature(s, \"remuxing from matroska container\");\n\n return AVERROR_PATCHWELCOME;\n\n }\n\n avpriv_set_pts_info(s->streams[0], 64, 1, codec->sample_rate);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "339064d5063924e5176842abbf6c8089f3479c5b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void *qemu_blockalign(BlockDriverState *bs, size_t size)\n+\n {\n \n return qemu_memalign((bs && bs->buffer_alignment) ? bs->buffer_alignment : 512, size);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void *qemu_blockalign(BlockDriverState *bs, size_t size)\n\n{\n\n return qemu_memalign((bs && bs->buffer_alignment) ? bs->buffer_alignment : 512, size);\n\n}\n"}} {"sample_id": "7cc84d241ba6ef8e27e4d057176a4ad385ad3d59", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static void decode_rowskip(uint8_t* plane, int width, int height, int stride, VC9Context *v){\n \n+ int x, y;\n \n GetBitContext *gb = &v->s.gb;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void decode_rowskip(uint8_t* plane, int width, int height, int stride, VC9Context *v){\n\n int x, y;\n\n GetBitContext *gb = &v->s.gb;\n\n\n\n for (y=0; ychannels; ch++) {\n \n for (blk = 0; blk < AC3_MAX_BLOCKS; blk++) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void apply_mdct(AC3EncodeContext *s)\n\n{\n\n int blk, ch;\n\n\n\n for (ch = 0; ch < s->channels; ch++) {\n\n for (blk = 0; blk < AC3_MAX_BLOCKS; blk++) {\n\n AC3Block *block = &s->blocks[blk];\n\n const SampleType *input_samples = &s->planar_samples[ch][blk * AC3_BLOCK_SIZE];\n\n\n\n apply_window(&s->dsp, s->windowed_samples, input_samples, s->mdct.window, AC3_WINDOW_SIZE);\n\n\n\n block->coeff_shift[ch] = normalize_samples(s);\n\n\n\n mdct512(&s->mdct, block->mdct_coef[ch], s->windowed_samples);\n\n }\n\n }\n\n}\n"}} {"sample_id": "32a2003af9cb0cb11b3992fd3248cb89752c53e9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n (sas_ss_flags(oldsp))) {\n \n+ oldsp = (target_sigaltstack_used.ss_sp\n+\n+ + target_sigaltstack_used.ss_size);\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static target_ulong get_sigframe(struct target_sigaction *ka,\n\n CPUPPCState *env,\n\n int frame_size)\n\n{\n\n target_ulong oldsp, newsp;\n\n\n\n oldsp = env->gpr[1];\n\n\n\n if ((ka->sa_flags & TARGET_SA_ONSTACK) &&\n\n (sas_ss_flags(oldsp))) {\n\n oldsp = (target_sigaltstack_used.ss_sp\n\n + target_sigaltstack_used.ss_size);\n\n }\n\n\n\n newsp = (oldsp - frame_size) & ~0xFUL;\n\n\n\n return newsp;\n\n}\n"}} {"sample_id": "bec1631100323fac0900aea71043d5c4e22fc2fa_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n TCGLabel *l = &s->labels[label_index];\n \n+ uint64_t imm;\n+\n+\n+\n+ /* We pay attention here to not modify the branch target by reading\n \n the existing value and using it again. This ensure that caches and\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void tcg_out_brcond(TCGContext *s, TCGCond cond, TCGReg arg1,\n\n TCGReg arg2, int label_index, int cmp4)\n\n{\n\n TCGLabel *l = &s->labels[label_index];\n\n uint64_t imm;\n\n\n\n /* We pay attention here to not modify the branch target by reading\n\n the existing value and using it again. This ensure that caches and\n\n memory are kept coherent during retranslation. */\n\n if (l->has_value) {\n\n imm = l->u.value_ptr - s->code_ptr;\n\n } else {\n\n imm = get_reloc_pcrel21b_slot2(s->code_ptr);\n\n tcg_out_reloc(s, s->code_ptr, R_IA64_PCREL21B, label_index, 0);\n\n }\n\n\n\n tcg_out_bundle(s, miB,\n\n INSN_NOP_M,\n\n tcg_opc_cmp_a(TCG_REG_P0, cond, arg1, arg2, cmp4),\n\n tcg_opc_b1(TCG_REG_P6, OPC_BR_DPTK_FEW_B1, imm));\n\n}\n"}} {"sample_id": "f3c75d42adbba553eaf218a832d4fbea32c8f7b8_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n \n \n+ cpu_reset(cs);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void spapr_cpu_reset(void *opaque)\n\n{\n\n PowerPCCPU *cpu = opaque;\n\n CPUState *cs = CPU(cpu);\n\n CPUPPCState *env = &cpu->env;\n\n\n\n cpu_reset(cs);\n\n\n\n /* All CPUs start halted. CPU0 is unhalted from the machine level\n\n * reset code and the rest are explicitly started up by the guest\n\n * using an RTAS call */\n\n cs->halted = 1;\n\n\n\n env->spr[SPR_HIOR] = 0;\n\n\n\n env->external_htab = (uint8_t *)spapr->htab;\n\n if (kvm_enabled() && !env->external_htab) {\n\n /*\n\n * HV KVM, set external_htab to 1 so our ppc_hash64_load_hpte*\n\n * functions do the right thing.\n\n */\n\n env->external_htab = (void *)1;\n\n }\n\n env->htab_base = -1;\n\n env->htab_mask = HTAB_SIZE(spapr) - 1;\n\n env->spr[SPR_SDR1] = (target_ulong)(uintptr_t)spapr->htab |\n\n (spapr->htab_shift - 18);\n\n}\n"}} {"sample_id": "7385aed20db5d83979f683b9d0048674411e963c_27", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n break;\n \n case 3:\n+\n+ gen_helper_fcmpq_fcc3(cpu_env);\n+\n+ break;\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_op_fcmpq(int fccno)\n\n{\n\n switch (fccno) {\n\n case 0:\n\n gen_helper_fcmpq(cpu_env);\n\n break;\n\n case 1:\n\n gen_helper_fcmpq_fcc1(cpu_env);\n\n break;\n\n case 2:\n\n gen_helper_fcmpq_fcc2(cpu_env);\n\n break;\n\n case 3:\n\n gen_helper_fcmpq_fcc3(cpu_env);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "966439a67830239a6c520c5df6c55627b8153c8b_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n T1 = T0;\n \n+ T0 = ~T0 + xer_ca - 1;\n \n if (likely(!((uint64_t)~T1 & ((uint64_t)~T1 ^ (uint64_t)T0) &\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void do_subfmeo_64 (void)\n\n{\n\n T1 = T0;\n\n T0 = ~T0 + xer_ca - 1;\n\n if (likely(!((uint64_t)~T1 & ((uint64_t)~T1 ^ (uint64_t)T0) &\n\n (1ULL << 63)))) {\n\n xer_ov = 0;\n\n } else {\n\n xer_so = 1;\n\n xer_ov = 1;\n\n }\n\n if (likely((uint64_t)T1 != UINT64_MAX))\n\n xer_ca = 1;\n\n}\n"}} {"sample_id": "891fb2cd4592b6fe76106a69e0ca40efbf82726a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n dev->auto_attach = 1;\n \n+ QLIST_INIT(&dev->strings);\n+\n+ rc = dev->info->init(dev);\n+\n+ if (rc == 0 && dev->auto_attach)\n \n rc = usb_device_attach(dev);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int usb_qdev_init(DeviceState *qdev, DeviceInfo *base)\n\n{\n\n USBDevice *dev = DO_UPCAST(USBDevice, qdev, qdev);\n\n USBDeviceInfo *info = DO_UPCAST(USBDeviceInfo, qdev, base);\n\n int rc;\n\n\n\n pstrcpy(dev->product_desc, sizeof(dev->product_desc), info->product_desc);\n\n dev->info = info;\n\n dev->auto_attach = 1;\n\n QLIST_INIT(&dev->strings);\n\n rc = dev->info->init(dev);\n\n if (rc == 0 && dev->auto_attach)\n\n rc = usb_device_attach(dev);\n\n return rc;\n\n}\n"}} {"sample_id": "1d06cb7ab93f879ac25c9f5ef1d1ac8d97a42dfc_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int cmd_valid_while_locked(SDState *sd, SDRequest *req)\n+\n {\n \n /* Valid commands in locked state:", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static int cmd_valid_while_locked(SDState *sd, SDRequest *req)\n\n{\n\n /* Valid commands in locked state:\n\n * basic class (0)\n\n * lock card class (7)\n\n * CMD16\n\n * implicitly, the ACMD prefix CMD55\n\n * ACMD41 and ACMD42\n\n * Anything else provokes an \"illegal command\" response.\n\n */\n\n if (sd->card_status & APP_CMD) {\n\n return req->cmd == 41 || req->cmd == 42;\n\n }\n\n if (req->cmd == 16 || req->cmd == 55) {\n\n return 1;\n\n }\n\n return sd_cmd_class[req->cmd] == 0 || sd_cmd_class[req->cmd] == 7;\n\n}\n"}} {"sample_id": "a89f364ae8740dfc31b321eed9ee454e996dc3c1_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n s->bd_addr.b[3] = data[offset + 0];\n \n s->bd_addr.b[4] = data[offset + 3];\n+\n+ s->bd_addr.b[5] = data[offset + 2];\n+\n+\n+\n s->hci->bdaddr_set(s->hci, s->bd_addr.b);\n \n fprintf(stderr, \"%s: bd_address loaded from firmware: \"", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void csrhci_in_packet_vendor(struct csrhci_s *s, int ocf,\n\n uint8_t *data, int len)\n\n{\n\n int offset;\n\n uint8_t *rpkt;\n\n\n\n switch (ocf) {\n\n case OCF_CSR_SEND_FIRMWARE:\n\n /* Check if this is the bd_address packet */\n\n if (len >= 18 + 8 && data[12] == 0x01 && data[13] == 0x00) {\n\n offset = 18;\n\n s->bd_addr.b[0] = data[offset + 7];\t/* Beyond cmd packet end(!?) */\n\n s->bd_addr.b[1] = data[offset + 6];\n\n s->bd_addr.b[2] = data[offset + 4];\n\n s->bd_addr.b[3] = data[offset + 0];\n\n s->bd_addr.b[4] = data[offset + 3];\n\n s->bd_addr.b[5] = data[offset + 2];\n\n\n\n s->hci->bdaddr_set(s->hci, s->bd_addr.b);\n\n fprintf(stderr, \"%s: bd_address loaded from firmware: \"\n\n \"%02x:%02x:%02x:%02x:%02x:%02x\\n\", __FUNCTION__,\n\n s->bd_addr.b[0], s->bd_addr.b[1], s->bd_addr.b[2],\n\n s->bd_addr.b[3], s->bd_addr.b[4], s->bd_addr.b[5]);\n\n }\n\n\n\n rpkt = csrhci_out_packet_event(s, EVT_VENDOR, 11);\n\n /* Status bytes: no error */\n\n rpkt[9] = 0x00;\n\n rpkt[10] = 0x00;\n\n break;\n\n\n\n default:\n\n fprintf(stderr, \"%s: got a bad CMD packet\\n\", __FUNCTION__);\n\n return;\n\n }\n\n\n\n csrhci_fifo_wake(s);\n\n}\n"}} {"sample_id": "202204717a7e73971cccebd38c5d8ac4b0bfcef8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void nbd_refresh_limits(BlockDriverState *bs, Error **errp)\n+\n+{\n \n bs->bl.max_discard = UINT32_MAX >> BDRV_SECTOR_BITS;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void nbd_refresh_limits(BlockDriverState *bs, Error **errp)\n\n{\n\n bs->bl.max_discard = UINT32_MAX >> BDRV_SECTOR_BITS;\n\n bs->bl.max_transfer_length = UINT32_MAX >> BDRV_SECTOR_BITS;\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_44", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n case 2: gen_helper_neon_narrow_sat_u32(dest, cpu_env, src); break;\n \n default: abort();\n+\n+ }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_neon_narrow_satu(int size, TCGv dest, TCGv src)\n\n{\n\n switch (size) {\n\n case 0: gen_helper_neon_narrow_sat_u8(dest, cpu_env, src); break;\n\n case 1: gen_helper_neon_narrow_sat_u16(dest, cpu_env, src); break;\n\n case 2: gen_helper_neon_narrow_sat_u32(dest, cpu_env, src); break;\n\n default: abort();\n\n }\n\n}\n"}} {"sample_id": "3e8522e23f6ab3c2b89ebb962ec4c2227d88aca6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -44,11 +44,11 @@\n \n \n \n+ pc_dimm_memory_unplug(dev, &pcms->hotplug_memory, mr);\n+\n+ object_unparent(OBJECT(dev));\n+\n+\n \n out:\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pc_dimm_unplug(HotplugHandler *hotplug_dev,\n\n DeviceState *dev, Error **errp)\n\n{\n\n PCMachineState *pcms = PC_MACHINE(hotplug_dev);\n\n PCDIMMDevice *dimm = PC_DIMM(dev);\n\n PCDIMMDeviceClass *ddc = PC_DIMM_GET_CLASS(dimm);\n\n MemoryRegion *mr = ddc->get_memory_region(dimm);\n\n HotplugHandlerClass *hhc;\n\n Error *local_err = NULL;\n\n\n\n if (object_dynamic_cast(OBJECT(dev), TYPE_NVDIMM)) {\n\n error_setg(&local_err,\n\n \"nvdimm device hot unplug is not supported yet.\");\n\n goto out;\n\n }\n\n\n\n hhc = HOTPLUG_HANDLER_GET_CLASS(pcms->acpi_dev);\n\n hhc->unplug(HOTPLUG_HANDLER(pcms->acpi_dev), dev, &local_err);\n\n\n\n if (local_err) {\n\n goto out;\n\n }\n\n\n\n pc_dimm_memory_unplug(dev, &pcms->hotplug_memory, mr);\n\n object_unparent(OBJECT(dev));\n\n\n\n out:\n\n error_propagate(errp, local_err);\n\n}\n"}} {"sample_id": "a91394f4de63ae5c2e21c548045b79393ca7fea1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n \n \n s->avctx = avctx;\n+\n s->frame_number = -1;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static av_cold int dirac_decode_init(AVCodecContext *avctx)\n\n{\n\n DiracContext *s = avctx->priv_data;\n\n int i;\n\n\n\n s->avctx = avctx;\n\n s->frame_number = -1;\n\n\n\n if (avctx->flags&CODEC_FLAG_EMU_EDGE) {\n\n av_log(avctx, AV_LOG_ERROR, \"Edge emulation not supported!\\n\");\n\n return AVERROR_PATCHWELCOME;\n\n }\n\n\n\n ff_dsputil_init(&s->dsp, avctx);\n\n ff_diracdsp_init(&s->diracdsp);\n\n\n\n for (i = 0; i < MAX_FRAMES; i++)\n\n s->all_frames[i].avframe = av_frame_alloc();\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "4ced5d7780fea2ea49444d6686d26f26b3a2160f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n int xBase, int yBase, int log2_cb_size)\n \n+{\n \n int qp_y = get_qPy_pred(s, xC, yC, xBase, yBase, log2_cb_size);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void ff_hevc_set_qPy(HEVCContext *s, int xC, int yC,\n\n int xBase, int yBase, int log2_cb_size)\n\n{\n\n int qp_y = get_qPy_pred(s, xC, yC, xBase, yBase, log2_cb_size);\n\n\n\n if (s->HEVClc->tu.cu_qp_delta != 0) {\n\n int off = s->sps->qp_bd_offset;\n\n s->HEVClc->qp_y = ((qp_y + s->HEVClc->tu.cu_qp_delta + 52 + 2 * off) %\n\n (52 + off)) - off;\n\n } else\n\n s->HEVClc->qp_y = qp_y;\n\n}\n"}} {"sample_id": "d451008e0fdf7fb817c791397e7999d5f3687e58", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n if (pci_get_word(pdev->config + PCI_VENDOR_ID) != PCI_VENDOR_ID_REALTEK ||\n \n+ pci_get_word(pdev->config + PCI_DEVICE_ID) != 0x8168 || nr != 2) {\n \n return;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void vfio_probe_rtl8168_bar2_window_quirk(VFIOPCIDevice *vdev, int nr)\n\n{\n\n PCIDevice *pdev = &vdev->pdev;\n\n VFIOQuirk *quirk;\n\n\n\n if (pci_get_word(pdev->config + PCI_VENDOR_ID) != PCI_VENDOR_ID_REALTEK ||\n\n pci_get_word(pdev->config + PCI_DEVICE_ID) != 0x8168 || nr != 2) {\n\n return;\n\n }\n\n\n\n quirk = g_malloc0(sizeof(*quirk));\n\n quirk->vdev = vdev;\n\n quirk->data.bar = nr;\n\n\n\n memory_region_init_io(&quirk->mem, OBJECT(vdev), &vfio_rtl8168_window_quirk,\n\n quirk, \"vfio-rtl8168-window-quirk\", 8);\n\n memory_region_add_subregion_overlap(&vdev->bars[nr].region.mem,\n\n 0x70, &quirk->mem, 1);\n\n\n\n QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);\n\n\n\n trace_vfio_probe_rtl8168_bar2_window_quirk(vdev->vbasedev.name);\n\n}\n"}} {"sample_id": "1509c018bd5b054a2354e20021ccbac9c934d213", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n {\n \n const int size = p->buf_size;\n+\n+ int score, fec_score, dvhs_score;\n+\n int check_count = size / TS_FEC_PACKET_SIZE;\n \n #define CHECK_COUNT 10", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int mpegts_probe(AVProbeData *p)\n\n{\n\n const int size = p->buf_size;\n\n int score, fec_score, dvhs_score;\n\n int check_count = size / TS_FEC_PACKET_SIZE;\n\n#define CHECK_COUNT 10\n\n\n\n if (check_count < CHECK_COUNT)\n\n return AVERROR_INVALIDDATA;\n\n\n\n score = analyze(p->buf, TS_PACKET_SIZE * check_count,\n\n TS_PACKET_SIZE, NULL) * CHECK_COUNT / check_count;\n\n dvhs_score = analyze(p->buf, TS_DVHS_PACKET_SIZE * check_count,\n\n TS_DVHS_PACKET_SIZE, NULL) * CHECK_COUNT / check_count;\n\n fec_score = analyze(p->buf, TS_FEC_PACKET_SIZE * check_count,\n\n TS_FEC_PACKET_SIZE, NULL) * CHECK_COUNT / check_count;\n\n av_dlog(NULL, \"score: %d, dvhs_score: %d, fec_score: %d \\n\",\n\n score, dvhs_score, fec_score);\n\n\n\n /* we need a clear definition for the returned score otherwise\n\n * things will become messy sooner or later */\n\n if (score > fec_score && score > dvhs_score && score > 6)\n\n return AVPROBE_SCORE_MAX + score - CHECK_COUNT;\n\n else if (dvhs_score > score && dvhs_score > fec_score && dvhs_score > 6)\n\n return AVPROBE_SCORE_MAX + dvhs_score - CHECK_COUNT;\n\n else if (fec_score > 6)\n\n return AVPROBE_SCORE_MAX + fec_score - CHECK_COUNT;\n\n else\n\n return AVERROR_INVALIDDATA;\n\n}\n"}} {"sample_id": "6c643e070584ba7af251d3907e277d2170537b1f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n int ff_avc_parse_nal_units(AVIOContext *pb, const uint8_t *buf_in, int size)\n \n {\n+\n+ const uint8_t *p = buf_in;\n+\n+ const uint8_t *end = p + size;\n+\n const uint8_t *nal_start, *nal_end;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int ff_avc_parse_nal_units(AVIOContext *pb, const uint8_t *buf_in, int size)\n\n{\n\n const uint8_t *p = buf_in;\n\n const uint8_t *end = p + size;\n\n const uint8_t *nal_start, *nal_end;\n\n\n\n size = 0;\n\n nal_start = ff_avc_find_startcode(p, end);\n\n while (nal_start < end) {\n\n while(!*(nal_start++));\n\n nal_end = ff_avc_find_startcode(nal_start, end);\n\n avio_wb32(pb, nal_end - nal_start);\n\n avio_write(pb, nal_start, nal_end - nal_start);\n\n size += 4 + nal_end - nal_start;\n\n nal_start = nal_end;\n\n }\n\n return size;\n\n}\n"}} {"sample_id": "87638494cac0e58178a445b2c6436264b3af31e9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n nb_streams = 0;\n if (c->stream) \n nb_streams = c->stream->nb_streams;\n+ for(i=0;irtp_ctx[i];\n+ if (ctx) {\n+ av_free(ctx);\n+ h = c->rtp_handles[i];\n if (h) {\n url_close(h);\n if (c->stream)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void close_connection(HTTPContext *c)\n{\n HTTPContext **cp, *c1;\n int i, nb_streams;\n AVFormatContext *ctx;\n URLContext *h;\n AVStream *st;\n /* remove connection from list */\n cp = &first_http_ctx;\n while ((*cp) != NULL) {\n c1 = *cp;\n if (c1 == c) {\n *cp = c->next;\n } else {\n cp = &c1->next;\n /* remove connection associated resources */\n if (c->fd >= 0)\n close(c->fd);\n if (c->fmt_in) {\n /* close each frame parser */\n for(i=0;ifmt_in->nb_streams;i++) {\n st = c->fmt_in->streams[i];\n if (st->codec.codec) {\n avcodec_close(&st->codec);\n av_close_input_file(c->fmt_in);\n /* free RTP output streams if any */\n nb_streams = 0;\n if (c->stream) \n nb_streams = c->stream->nb_streams;\n for(i=0;irtp_ctx[i];\n if (ctx) {\n av_free(ctx);\n h = c->rtp_handles[i];\n if (h) {\n url_close(h);\n if (c->stream)\n current_bandwidth -= c->stream->bandwidth;\n av_freep(&c->pb_buffer);\n av_free(c->buffer);\n av_free(c);\n nb_connections--;"}} {"sample_id": "cea3a63ba3d89d8403eef008f7a7c54d645cff70", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n buf = av_mallocz(sizeof(*buf));\n \n if (!buf) {\n+\n+ av_buffer_unref(&ret);\n+\n+ return NULL;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static AVBufferRef *pool_alloc_buffer(AVBufferPool *pool)\n\n{\n\n BufferPoolEntry *buf;\n\n AVBufferRef *ret;\n\n\n\n ret = pool->alloc(pool->size);\n\n if (!ret)\n\n return NULL;\n\n\n\n buf = av_mallocz(sizeof(*buf));\n\n if (!buf) {\n\n av_buffer_unref(&ret);\n\n return NULL;\n\n }\n\n\n\n buf->data = ret->buffer->data;\n\n buf->opaque = ret->buffer->opaque;\n\n buf->free = ret->buffer->free;\n\n buf->pool = pool;\n\n\n\n ret->buffer->opaque = buf;\n\n ret->buffer->free = pool_release_buffer;\n\n\n\n avpriv_atomic_int_add_and_fetch(&pool->refcount, 1);\n\n\n\n\n return ret;\n\n}"}} {"sample_id": "a890643958f03aaa344290700093b280cb606c28", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n int i;\n \n \n+\n seqlock_write_begin(&head->sequence);\n \n do {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void qht_bucket_reset__locked(struct qht_bucket *head)\n\n{\n\n struct qht_bucket *b = head;\n\n int i;\n\n\n\n seqlock_write_begin(&head->sequence);\n\n do {\n\n for (i = 0; i < QHT_BUCKET_ENTRIES; i++) {\n\n if (b->pointers[i] == NULL) {\n\n goto done;\n\n }\n\n b->hashes[i] = 0;\n\n atomic_set(&b->pointers[i], NULL);\n\n }\n\n b = b->next;\n\n } while (b);\n\n done:\n\n seqlock_write_end(&head->sequence);\n\n}\n"}} {"sample_id": "948b54763b6c851b2a0bec6702cd9c419065fdb6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n uint64_t l = x * (mantissa & 0xffffffff);\n+\n uint64_t h = x * (mantissa >> 32);\n \n h += l >> 32;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint32_t softfloat_mul(uint32_t x, uint64_t mantissa)\n\n{\n\n uint64_t l = x * (mantissa & 0xffffffff);\n\n uint64_t h = x * (mantissa >> 32);\n\n h += l >> 32;\n\n l &= 0xffffffff;\n\n l += 1 << av_log2(h >> 21);\n\n h += l >> 32;\n\n return h >> 20;\n\n}\n"}} {"sample_id": "4cd0bdae9a62d1f0366e60603222762af31e5289_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,22 +1,22 @@\n+static int read_rle_sgi(unsigned char* out_buf, const uint8_t *in_buf,\n \n const uint8_t *in_end, SgiState* s)\n+\n {\n \n+ uint8_t *dest_row;\n \n unsigned int len = s->height * s->depth * 4;\n+\n const uint8_t *start_table = in_buf;\n \n unsigned int y, z;\n \n+ unsigned int start_offset;\n+\n+\n \n+ /* size of RLE offset and length tables */\n \n if(len * 2 > in_end - in_buf) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int read_rle_sgi(unsigned char* out_buf, const uint8_t *in_buf,\n\n const uint8_t *in_end, SgiState* s)\n\n{\n\n uint8_t *dest_row;\n\n unsigned int len = s->height * s->depth * 4;\n\n const uint8_t *start_table = in_buf;\n\n unsigned int y, z;\n\n unsigned int start_offset;\n\n\n\n /* size of RLE offset and length tables */\n\n if(len * 2 > in_end - in_buf) {\n\n return AVERROR_INVALIDDATA;\n\n }\n\n\n\n in_buf -= SGI_HEADER_SIZE;\n\n for (z = 0; z < s->depth; z++) {\n\n dest_row = out_buf;\n\n for (y = 0; y < s->height; y++) {\n\n dest_row -= s->linesize;\n\n start_offset = bytestream_get_be32(&start_table);\n\n if(start_offset > in_end - in_buf) {\n\n return AVERROR_INVALIDDATA;\n\n }\n\n if (expand_rle_row(in_buf + start_offset, in_end, dest_row + z,\n\n dest_row + FFABS(s->linesize), s->depth) != s->width)\n\n return AVERROR_INVALIDDATA;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "21174c34b6b9ace9ad82e0deb13be752d28a5907", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int get_unused_buffer(QEMUFile *f, void *pv, size_t size)\n+\n+{\n \n qemu_fseek(f, size, SEEK_CUR);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int get_unused_buffer(QEMUFile *f, void *pv, size_t size)\n\n{\n\n qemu_fseek(f, size, SEEK_CUR);\n\n return 0;\n\n}\n"}} {"sample_id": "f4bd9fe326ad1315a74206939ae56df93b940a09", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n int ff_generate_sliding_window_mmcos(H264Context *h, int first_slice)\n \n+{\n \n MMCO mmco_temp[MAX_MMCO_COUNT], *mmco = first_slice ? h->mmco : mmco_temp;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int ff_generate_sliding_window_mmcos(H264Context *h, int first_slice)\n\n{\n\n MMCO mmco_temp[MAX_MMCO_COUNT], *mmco = first_slice ? h->mmco : mmco_temp;\n\n int mmco_index = 0, i;\n\n\n\n assert(h->long_ref_count + h->short_ref_count <= h->sps.ref_frame_count);\n\n\n\n if (h->short_ref_count &&\n\n h->long_ref_count + h->short_ref_count == h->sps.ref_frame_count &&\n\n !(FIELD_PICTURE(h) && !h->first_field && h->cur_pic_ptr->reference)) {\n\n mmco[0].opcode = MMCO_SHORT2UNUSED;\n\n mmco[0].short_pic_num = h->short_ref[h->short_ref_count - 1]->frame_num;\n\n mmco_index = 1;\n\n if (FIELD_PICTURE(h)) {\n\n mmco[0].short_pic_num *= 2;\n\n mmco[1].opcode = MMCO_SHORT2UNUSED;\n\n mmco[1].short_pic_num = mmco[0].short_pic_num + 1;\n\n mmco_index = 2;\n\n }\n\n }\n\n\n\n if (first_slice) {\n\n h->mmco_index = mmco_index;\n\n } else if (!first_slice && mmco_index >= 0 &&\n\n (mmco_index != h->mmco_index ||\n\n (i = check_opcodes(h->mmco, mmco_temp, mmco_index)))) {\n\n av_log(h->avctx, AV_LOG_ERROR,\n\n \"Inconsistent MMCO state between slices [%d, %d, %d]\\n\",\n\n mmco_index, h->mmco_index, i);\n\n return AVERROR_INVALIDDATA;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "5bb95e41868b461f37159efb48908828ebd7ab36_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,11 +34,11 @@\n \n if (qemu_uuid_parse(buf, qemu_uuid) != 0) {\n \n+ fprintf(stderr, \"Invalid SMBIOS UUID string\\n\");\n+\n+ exit(1);\n+\n+ }\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void smbios_build_type_1_fields(const char *t)\n\n{\n\n char buf[1024];\n\n\n\n if (get_param_value(buf, sizeof(buf), \"manufacturer\", t))\n\n smbios_add_field(1, offsetof(struct smbios_type_1, manufacturer_str),\n\n strlen(buf) + 1, buf);\n\n if (get_param_value(buf, sizeof(buf), \"product\", t))\n\n smbios_add_field(1, offsetof(struct smbios_type_1, product_name_str),\n\n strlen(buf) + 1, buf);\n\n if (get_param_value(buf, sizeof(buf), \"version\", t))\n\n smbios_add_field(1, offsetof(struct smbios_type_1, version_str),\n\n strlen(buf) + 1, buf);\n\n if (get_param_value(buf, sizeof(buf), \"serial\", t))\n\n smbios_add_field(1, offsetof(struct smbios_type_1, serial_number_str),\n\n strlen(buf) + 1, buf);\n\n if (get_param_value(buf, sizeof(buf), \"uuid\", t)) {\n\n if (qemu_uuid_parse(buf, qemu_uuid) != 0) {\n\n fprintf(stderr, \"Invalid SMBIOS UUID string\\n\");\n\n exit(1);\n\n }\n\n }\n\n if (get_param_value(buf, sizeof(buf), \"sku\", t))\n\n smbios_add_field(1, offsetof(struct smbios_type_1, sku_number_str),\n\n strlen(buf) + 1, buf);\n\n if (get_param_value(buf, sizeof(buf), \"family\", t))\n\n smbios_add_field(1, offsetof(struct smbios_type_1, family_str),\n\n strlen(buf) + 1, buf);\n\n}\n"}} {"sample_id": "2e1198672759eda6e122ff38fcf6df06f27e0fe2_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,8 +8,8 @@\n \n \n \n+ memory_region_init_io(&s->mmio, OBJECT(s), &stellaris_enet_ops, s,\n+\n \"stellaris_enet\", 0x1000);\n \n sysbus_init_mmio(sbd, &s->mmio);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int stellaris_enet_init(SysBusDevice *sbd)\n\n{\n\n DeviceState *dev = DEVICE(sbd);\n\n stellaris_enet_state *s = STELLARIS_ENET(dev);\n\n\n\n memory_region_init_io(&s->mmio, OBJECT(s), &stellaris_enet_ops, s,\n\n \"stellaris_enet\", 0x1000);\n\n sysbus_init_mmio(sbd, &s->mmio);\n\n sysbus_init_irq(sbd, &s->irq);\n\n qemu_macaddr_default_if_unset(&s->conf.macaddr);\n\n\n\n s->nic = qemu_new_nic(&net_stellaris_enet_info, &s->conf,\n\n object_get_typename(OBJECT(dev)), dev->id, s);\n\n qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);\n\n\n\n stellaris_enet_reset(s);\n\n register_savevm(dev, \"stellaris_enet\", -1, 1,\n\n stellaris_enet_save, stellaris_enet_load, s);\n\n return 0;\n\n}\n"}} {"sample_id": "6ea428789371fa0601e9ebb5b7f2216d4e73e831", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n int a;\n \n \n+\n for (a = 0; a < 72; a++) {\n \n int i, tmp;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void dss_sp_shift_sq_sub(const int32_t *filter_buf,\n\n int32_t *error_buf, int32_t *dst)\n\n{\n\n int a;\n\n\n\n for (a = 0; a < 72; a++) {\n\n int i, tmp;\n\n\n\n tmp = dst[a] * filter_buf[0];\n\n\n\n for (i = 14; i > 0; i--)\n\n tmp -= error_buf[i] * (unsigned)filter_buf[i];\n\n\n\n for (i = 14; i > 0; i--)\n\n error_buf[i] = error_buf[i - 1];\n\n\n\n tmp = (tmp + 4096) >> 13;\n\n\n\n error_buf[1] = tmp;\n\n\n\n dst[a] = av_clip_int16(tmp);\n\n }\n\n}\n"}} {"sample_id": "9ed5726c043958359b0f1fa44ab3e4f25f9d9a47_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+target_ulong helper_emt(target_ulong arg1)\n+\n+{\n \n // TODO\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "target_ulong helper_emt(target_ulong arg1)\n\n{\n\n // TODO\n\n arg1 = 0;\n\n // rt = arg1\n\n\n\n return arg1;\n\n}\n"}} {"sample_id": "067acf28d1d726059f994356f25e054ce2926acf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n bdrv_replace_in_backing_chain(state->new_bs, state->old_bs);\n \n }\n+\n+ }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void external_snapshot_abort(BlkActionState *common)\n\n{\n\n ExternalSnapshotState *state =\n\n DO_UPCAST(ExternalSnapshotState, common, common);\n\n if (state->new_bs) {\n\n if (state->new_bs->backing) {\n\n bdrv_replace_in_backing_chain(state->new_bs, state->old_bs);\n\n }\n\n }\n\n}\n"}} {"sample_id": "6d0ee85040e4d238e2483191fe6e74aebbecd5d5_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n VirtIOBalloon *s = opaque;\n+\n+\n+\n+ virtio_save(&s->vdev, f);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void virtio_balloon_save(QEMUFile *f, void *opaque)\n\n{\n\n VirtIOBalloon *s = opaque;\n\n\n\n virtio_save(&s->vdev, f);\n\n\n\n qemu_put_be32(f, s->num_pages);\n\n qemu_put_be32(f, s->actual);\n\n qemu_put_buffer(f, (uint8_t *)&s->stats_vq_elem, sizeof(VirtQueueElement));\n\n qemu_put_buffer(f, (uint8_t *)&s->stats_vq_offset, sizeof(size_t));\n\n qemu_put_buffer(f, (uint8_t *)&s->stats_callback, sizeof(MonitorCompletion));\n\n qemu_put_buffer(f, (uint8_t *)&s->stats_opaque_callback_data, sizeof(void));\n\n}\n"}} {"sample_id": "b106ad9185f35fc4ad669555ad0e79e276083bd7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ int64_t offset;\n+\n+ int ret;\n \n+\n \n BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int64_t qcow2_alloc_clusters(BlockDriverState *bs, int64_t size)\n\n{\n\n int64_t offset;\n\n int ret;\n\n\n\n BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC);\n\n offset = alloc_clusters_noref(bs, size);\n\n if (offset < 0) {\n\n return offset;\n\n }\n\n\n\n ret = update_refcount(bs, offset, size, 1, QCOW2_DISCARD_NEVER);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n\n\n return offset;\n\n}\n"}} {"sample_id": "486637af8ef29ec215e0e0b7ecd3b5470f0e04e5_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static inline void mix_dualmono_to_stereo(AC3DecodeContext *ctx)\n+\n+{\n+\n+ int i;\n \n float tmp;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void mix_dualmono_to_stereo(AC3DecodeContext *ctx)\n\n{\n\n int i;\n\n float tmp;\n\n float (*output)[256] = ctx->audio_block.block_output;\n\n\n\n for (i = 0; i < 256; i++) {\n\n tmp = output[1][i] + output[2][i];\n\n output[1][i] = output[2][i] = tmp;\n\n }\n\n}\n"}} {"sample_id": "edcc51fb8e15b704955d742559215697598927bb_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int add_shorts_metadata(int count, const char *name,\n \n const char *sep, TiffContext *s)\n \n@@ -11,7 +11,7 @@\n int16_t *sp;\n \n \n+\n if (count >= INT_MAX / sizeof(int16_t) || count <= 0)\n \n return AVERROR_INVALIDDATA;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int add_shorts_metadata(int count, const char *name,\n\n const char *sep, TiffContext *s)\n\n{\n\n char *ap;\n\n int i;\n\n int16_t *sp;\n\n\n\n if (count >= INT_MAX / sizeof(int16_t) || count <= 0)\n\n return AVERROR_INVALIDDATA;\n\n if (bytestream2_get_bytes_left(&s->gb) < count * sizeof(int16_t))\n\n return AVERROR_INVALIDDATA;\n\n\n\n sp = av_malloc(count * sizeof(int16_t));\n\n if (!sp)\n\n return AVERROR(ENOMEM);\n\n\n\n for (i = 0; i < count; i++)\n\n sp[i] = tget_short(&s->gb, s->le);\n\n ap = shorts2str(sp, count, sep);\n\n av_freep(&sp);\n\n if (!ap)\n\n return AVERROR(ENOMEM);\n\n av_dict_set(avpriv_frame_get_metadatap(&s->picture), name, ap, AV_DICT_DONT_STRDUP_VAL);\n\n return 0;\n\n}\n"}} {"sample_id": "d3f8e138c23ba082f87c96634d06b978473c1e9b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static const char *local_mapped_attr_path(FsContext *ctx,\n \n+ const char *path, char *buffer)\n \n {\n \n char *dir_name;\n+\n char *tmp_path = strdup(path);\n \n char *base_name = basename(tmp_path);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static const char *local_mapped_attr_path(FsContext *ctx,\n\n const char *path, char *buffer)\n\n{\n\n char *dir_name;\n\n char *tmp_path = strdup(path);\n\n char *base_name = basename(tmp_path);\n\n\n\n /* NULL terminate the directory */\n\n dir_name = tmp_path;\n\n *(base_name - 1) = '\\0';\n\n\n\n snprintf(buffer, PATH_MAX, \"%s/%s/%s/%s\",\n\n ctx->fs_root, dir_name, VIRTFS_META_DIR, base_name);\n\n free(tmp_path);\n\n return buffer;\n\n}\n"}} {"sample_id": "8be7e7e4c72c048b90e3482557954a24bba43ba7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n if (strcmp(arg, \"none\") == 0) {\n \n+ return 0;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int balloon_parse(const char *arg)\n\n{\n\n QemuOpts *opts;\n\n\n\n if (strcmp(arg, \"none\") == 0) {\n\n return 0;\n\n }\n\n\n\n if (!strncmp(arg, \"virtio\", 6)) {\n\n if (arg[6] == ',') {\n\n /* have params -> parse them */\n\n opts = qemu_opts_parse(qemu_find_opts(\"device\"), arg+7, 0);\n\n if (!opts)\n\n return -1;\n\n } else {\n\n /* create empty opts */\n\n opts = qemu_opts_create(qemu_find_opts(\"device\"), NULL, 0);\n\n }\n\n qemu_opt_set(opts, \"driver\", \"virtio-balloon\");\n\n return 0;\n\n }\n\n\n\n return -1;\n\n}\n"}} {"sample_id": "74c01823badbf4637c18ac4cad5967b4f9669514", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n PCIBridge *s = DO_UPCAST(PCIBridge, dev, dev);\n+\n+\n+\n+ pci_config_set_vendor_id(s->dev.config, s->vid);\n+\n pci_config_set_device_id(s->dev.config, s->did);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pci_bridge_initfn(PCIDevice *dev)\n\n{\n\n PCIBridge *s = DO_UPCAST(PCIBridge, dev, dev);\n\n\n\n pci_config_set_vendor_id(s->dev.config, s->vid);\n\n pci_config_set_device_id(s->dev.config, s->did);\n\n\n\n s->dev.config[0x04] = 0x06; // command = bus master, pci mem\n\n s->dev.config[0x05] = 0x00;\n\n s->dev.config[0x06] = 0xa0; // status = fast back-to-back, 66MHz, no error\n\n s->dev.config[0x07] = 0x00; // status = fast devsel\n\n s->dev.config[0x08] = 0x00; // revision\n\n s->dev.config[0x09] = 0x00; // programming i/f\n\n pci_config_set_class(s->dev.config, PCI_CLASS_BRIDGE_PCI);\n\n s->dev.config[0x0D] = 0x10; // latency_timer\n\n s->dev.config[PCI_HEADER_TYPE] =\n\n PCI_HEADER_TYPE_MULTI_FUNCTION | PCI_HEADER_TYPE_BRIDGE; // header_type\n\n s->dev.config[0x1E] = 0xa0; // secondary status\n\n return 0;\n\n}\n"}} {"sample_id": "a5b39cd3f647eaaaef5b648beda5cb2f387418c0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n VFIOPlatformDevice *vdev =\n \n container_of(vbasedev, VFIOPlatformDevice, vbasedev);\n+\n \n \n qemu_mutex_lock(&vdev->intp_mutex);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void vfio_platform_eoi(VFIODevice *vbasedev)\n\n{\n\n VFIOINTp *intp;\n\n VFIOPlatformDevice *vdev =\n\n container_of(vbasedev, VFIOPlatformDevice, vbasedev);\n\n\n\n qemu_mutex_lock(&vdev->intp_mutex);\n\n QLIST_FOREACH(intp, &vdev->intp_list, next) {\n\n if (intp->state == VFIO_IRQ_ACTIVE) {\n\n trace_vfio_platform_eoi(intp->pin,\n\n event_notifier_get_fd(intp->interrupt));\n\n intp->state = VFIO_IRQ_INACTIVE;\n\n\n\n /* deassert the virtual IRQ */\n\n qemu_set_irq(intp->qemuirq, 0);\n\n\n\n if (intp->flags & VFIO_IRQ_INFO_AUTOMASKED) {\n\n /* unmasks the physical level-sensitive IRQ */\n\n vfio_unmask_single_irqindex(vbasedev, intp->pin);\n\n }\n\n\n\n /* a single IRQ can be active at a time */\n\n break;\n\n }\n\n }\n\n /* in case there are pending IRQs, handle the first one */\n\n if (!QSIMPLEQ_EMPTY(&vdev->pending_intp_queue)) {\n\n intp = QSIMPLEQ_FIRST(&vdev->pending_intp_queue);\n\n vfio_intp_inject_pending_lockheld(intp);\n\n QSIMPLEQ_REMOVE_HEAD(&vdev->pending_intp_queue, pqnext);\n\n }\n\n qemu_mutex_unlock(&vdev->intp_mutex);\n\n}\n"}} {"sample_id": "a1f0cce2ac0243572ff72aa561da67fe3766a395", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,7 +15,7 @@\n bdrv_mon_event(s->bs, BDRV_ACTION_IGNORE, is_read);\n \n return 0;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static int scsi_handle_rw_error(SCSIDiskReq *r, int error, int type)\n\n{\n\n int is_read = (type == SCSI_REQ_STATUS_RETRY_READ);\n\n SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);\n\n BlockErrorAction action = bdrv_get_on_error(s->bs, is_read);\n\n\n\n if (action == BLOCK_ERR_IGNORE) {\n\n bdrv_mon_event(s->bs, BDRV_ACTION_IGNORE, is_read);\n\n return 0;\n\n }\n\n\n\n if ((error == ENOSPC && action == BLOCK_ERR_STOP_ENOSPC)\n\n || action == BLOCK_ERR_STOP_ANY) {\n\n\n\n type &= SCSI_REQ_STATUS_RETRY_TYPE_MASK;\n\n r->status |= SCSI_REQ_STATUS_RETRY | type;\n\n\n\n bdrv_mon_event(s->bs, BDRV_ACTION_STOP, is_read);\n\n vm_stop(VMSTOP_DISKFULL);\n\n } else {\n\n if (type == SCSI_REQ_STATUS_RETRY_READ) {\n\n scsi_req_data(&r->req, 0);\n\n }\n\n scsi_command_complete(r, CHECK_CONDITION,\n\n HARDWARE_ERROR);\n\n bdrv_mon_event(s->bs, BDRV_ACTION_REPORT, is_read);\n\n }\n\n\n\n return 1;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_65", "diff": "--- a/source.c\n+++ b/source.c\n@@ -54,11 +54,11 @@\n \n break;\n \n+ default:\n+\n+ val = 0xff;\n+\n+ break;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t bmdma_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n BMDMAState *bm = opaque;\n\n PCIIDEState *pci_dev = bm->pci_dev;\n\n uint32_t val;\n\n\n\n if (size != 1) {\n\n return ((uint64_t)1 << (size * 8)) - 1;\n\n }\n\n\n\n switch(addr & 3) {\n\n case 0:\n\n val = bm->cmd;\n\n break;\n\n case 1:\n\n val = pci_dev->dev.config[MRDMODE];\n\n break;\n\n case 2:\n\n val = bm->status;\n\n break;\n\n case 3:\n\n if (bm == &pci_dev->bmdma[0]) {\n\n val = pci_dev->dev.config[UDIDETCR0];\n\n } else {\n\n val = pci_dev->dev.config[UDIDETCR1];\n\n }\n\n break;\n\n default:\n\n val = 0xff;\n\n break;\n\n }\n\n#ifdef DEBUG_IDE\n\n printf(\"bmdma: readb 0x%02x : 0x%02x\\n\", addr, val);\n\n#endif\n\n return val;\n\n}\n"}} {"sample_id": "9604f70fdf8e21ec0dbf6eac5e59a0eb8beadd64_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void pc_init_pci_1_5(QEMUMachineInitArgs *args)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void pc_init_pci_1_5(QEMUMachineInitArgs *args)\n\n{\n\n has_pci_info = false;\n\n pc_init_pci(args);\n\n}\n"}} {"sample_id": "ef546f1275f6563e8934dd5e338d29d9f9909ca6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n Error **errp)\n \n+{\n+\n+ VirtIODevice *vdev = VIRTIO_DEVICE(hotplug_dev);\n+\n+ VirtIOSCSI *s = VIRTIO_SCSI(vdev);\n \n SCSIDevice *sd = SCSI_DEVICE(dev);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,\n\n Error **errp)\n\n{\n\n VirtIODevice *vdev = VIRTIO_DEVICE(hotplug_dev);\n\n VirtIOSCSI *s = VIRTIO_SCSI(vdev);\n\n SCSIDevice *sd = SCSI_DEVICE(dev);\n\n\n\n if (s->ctx && !s->dataplane_disabled) {\n\n if (blk_op_is_blocked(sd->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {\n\n return;\n\n }\n\n blk_op_block_all(sd->conf.blk, s->blocker);\n\n }\n\n\n\n if ((vdev->guest_features >> VIRTIO_SCSI_F_HOTPLUG) & 1) {\n\n virtio_scsi_push_event(s, sd,\n\n VIRTIO_SCSI_T_TRANSPORT_RESET,\n\n VIRTIO_SCSI_EVT_RESET_RESCAN);\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_92", "diff": "--- a/source.c\n+++ b/source.c\n@@ -37,11 +37,11 @@\n case R_IER:\n \n case R_LCR:\n+\n+ case R_MCR:\n+\n+ case R_DIV:\n+\n error_report(\"lm32_uart: read access to write only register 0x\"\n \n TARGET_FMT_plx, addr << 2);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t uart_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n LM32UartState *s = opaque;\n\n uint32_t r = 0;\n\n\n\n addr >>= 2;\n\n switch (addr) {\n\n case R_RXTX:\n\n r = s->regs[R_RXTX];\n\n s->regs[R_LSR] &= ~LSR_DR;\n\n uart_update_irq(s);\n\n break;\n\n case R_IIR:\n\n case R_LSR:\n\n case R_MSR:\n\n r = s->regs[addr];\n\n break;\n\n case R_IER:\n\n case R_LCR:\n\n case R_MCR:\n\n case R_DIV:\n\n error_report(\"lm32_uart: read access to write only register 0x\"\n\n TARGET_FMT_plx, addr << 2);\n\n break;\n\n default:\n\n error_report(\"lm32_uart: read access to unknown register 0x\"\n\n TARGET_FMT_plx, addr << 2);\n\n break;\n\n }\n\n\n\n trace_lm32_uart_memory_read(addr << 2, r);\n\n return r;\n\n}\n"}} {"sample_id": "8db165b36ef893ac69af0452f20eeb78e7b26b5a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n {\n \n int nfds = -1;\n+\n int i;\n \n \n+\n for (i = 0; i < pollfds->len; i++) {\n \n GPollFD *pfd = &g_array_index(pollfds, GPollFD, i);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int pollfds_fill(GArray *pollfds, fd_set *rfds, fd_set *wfds,\n\n fd_set *xfds)\n\n{\n\n int nfds = -1;\n\n int i;\n\n\n\n for (i = 0; i < pollfds->len; i++) {\n\n GPollFD *pfd = &g_array_index(pollfds, GPollFD, i);\n\n int fd = pfd->fd;\n\n int events = pfd->events;\n\n if (events & (G_IO_IN | G_IO_HUP | G_IO_ERR)) {\n\n FD_SET(fd, rfds);\n\n nfds = MAX(nfds, fd);\n\n }\n\n if (events & (G_IO_OUT | G_IO_ERR)) {\n\n FD_SET(fd, wfds);\n\n nfds = MAX(nfds, fd);\n\n }\n\n if (events & G_IO_PRI) {\n\n FD_SET(fd, xfds);\n\n nfds = MAX(nfds, fd);\n\n }\n\n }\n\n return nfds;\n\n}\n"}} {"sample_id": "01a720125f5e2f0a23d2682b39dead2fcc820066", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ memory_content *current = env->movcal_backup;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void helper_discard_movcal_backup(CPUSH4State *env)\n\n{\n\n memory_content *current = env->movcal_backup;\n\n\n\n while(current)\n\n {\n\n\tmemory_content *next = current->next;\n\n\tfree (current);\n\n\tenv->movcal_backup = current = next;\n\n\tif (current == NULL)\n\n\t env->movcal_backup_tail = &(env->movcal_backup);\n\n } \n\n}\n"}} {"sample_id": "364031f17932814484657e5551ba12957d993d7e_23", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n V9fsSynthOpenState *synth_open = fs->private;\n \n+ V9fsSynthNode *node = synth_open->node;\n+\n+\n+\n node->open_count--;\n \n g_free(synth_open);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int v9fs_synth_close(FsContext *ctx, V9fsFidOpenState *fs)\n\n{\n\n V9fsSynthOpenState *synth_open = fs->private;\n\n V9fsSynthNode *node = synth_open->node;\n\n\n\n node->open_count--;\n\n g_free(synth_open);\n\n fs->private = NULL;\n\n return 0;\n\n}\n"}} {"sample_id": "e4f4fb1eca795e36f363b4647724221e774523c1_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,9 +14,9 @@\n \n dc->bus_type = TYPE_XENSYSBUS;\n \n+\n+\n+\n+\n+\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void xen_sysdev_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);\n\n\n\n k->init = xen_sysdev_init;\n\n dc->props = xen_sysdev_properties;\n\n dc->bus_type = TYPE_XENSYSBUS;\n\n\n\n\n\n\n}"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_89", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n acb->bh = aio_bh_new(bdrv_get_aio_context(bs), bdrv_co_em_bh, acb);\n \n qemu_bh_schedule(acb->bh);\n+\n+ }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bdrv_co_maybe_schedule_bh(BlockAIOCBCoroutine *acb)\n\n{\n\n acb->need_bh = false;\n\n if (acb->req.error != -EINPROGRESS) {\n\n BlockDriverState *bs = acb->common.bs;\n\n\n\n acb->bh = aio_bh_new(bdrv_get_aio_context(bs), bdrv_co_em_bh, acb);\n\n qemu_bh_schedule(acb->bh);\n\n }\n\n}\n"}} {"sample_id": "8af00205445eb901f17ca5b632d976065187538e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n const char *path, const char *name)\n \n {\n+\n XattrOperations *xops = get_xattr_operations(ctx->xops, name);\n \n if (xops) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "int v9fs_remove_xattr(FsContext *ctx,\n\n const char *path, const char *name)\n\n{\n\n XattrOperations *xops = get_xattr_operations(ctx->xops, name);\n\n if (xops) {\n\n return xops->removexattr(ctx, path, name);\n\n }\n\n errno = -EOPNOTSUPP;\n\n return -1;\n\n\n\n}\n"}} {"sample_id": "a00676e48e49a3d794d6d2063ceca539e945a4a4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,7 +23,7 @@\n }\n \n if (get_bits1(gb)) {\n+\n v = get_bits(gb, 4);\n \n memset(b->cur_dec, v, t);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int read_block_types(AVCodecContext *avctx, GetBitContext *gb, Bundle *b)\n\n{\n\n int t, v;\n\n int last = 0;\n\n const uint8_t *dec_end;\n\n\n\n CHECK_READ_VAL(gb, b, t);\n\n dec_end = b->cur_dec + t;\n\n if (dec_end > b->data_end) {\n\n av_log(avctx, AV_LOG_ERROR, \"Too many block type values\\n\");\n\n return -1;\n\n }\n\n if (get_bits1(gb)) {\n\n v = get_bits(gb, 4);\n\n memset(b->cur_dec, v, t);\n\n b->cur_dec += t;\n\n } else {\n\n do {\n\n v = GET_HUFF(gb, b->tree);\n\n if (v < 12) {\n\n last = v;\n\n *b->cur_dec++ = v;\n\n } else {\n\n int run = bink_rlelens[v - 12];\n\n\n\n memset(b->cur_dec, last, run);\n\n b->cur_dec += run;\n\n }\n\n } while (b->cur_dec < dec_end);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "2c6942fa7b332a95286071b92d233853e1000948_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n if (!bdrv_is_removable(bs)) {\n \n+ qerror_report(QERR_DEVICE_NOT_REMOVABLE, bdrv_get_device_name(bs));\n+\n+ return -1;\n+\n+ }\n \n if (!force && bdrv_dev_is_medium_locked(bs)) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int eject_device(Monitor *mon, BlockDriverState *bs, int force)\n\n{\n\n if (!bdrv_is_removable(bs)) {\n\n qerror_report(QERR_DEVICE_NOT_REMOVABLE, bdrv_get_device_name(bs));\n\n return -1;\n\n }\n\n if (!force && bdrv_dev_is_medium_locked(bs)) {\n\n qerror_report(QERR_DEVICE_LOCKED, bdrv_get_device_name(bs));\n\n return -1;\n\n }\n\n bdrv_close(bs);\n\n return 0;\n\n}\n"}} {"sample_id": "d812b3d68ddf0efe91a088ecc8b177865b0bab8d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,10 +16,10 @@\n \n qemu_set_irq(*s->a20_out, (val >> 1) & 1);\n \n+ if ((val & 1) && !(oldval & 1)) {\n+\n+ qemu_system_reset_request();\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void port92_write(void *opaque, hwaddr addr, uint64_t val,\n\n unsigned size)\n\n{\n\n Port92State *s = opaque;\n\n int oldval = s->outport;\n\n\n\n DPRINTF(\"port92: write 0x%02\" PRIx64 \"\\n\", val);\n\n s->outport = val;\n\n qemu_set_irq(*s->a20_out, (val >> 1) & 1);\n\n if ((val & 1) && !(oldval & 1)) {\n\n qemu_system_reset_request();\n\n }\n\n}\n"}} {"sample_id": "2d896b454a0e19ec4c1ddbb0e0b65b7e54fcedf3_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void boston_flash_write(void *opaque, hwaddr addr,\n \n uint64_t val, unsigned size)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void boston_flash_write(void *opaque, hwaddr addr,\n\n uint64_t val, unsigned size)\n\n{\n\n}\n"}} {"sample_id": "539de1246d355d3b8aa33fb7cde732352d8827c7_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n \n \n+ set_dirty_tracking(0);\n+\n+\n+\n+ while ((bmds = QSIMPLEQ_FIRST(&block_mig_state.bmds_list)) != NULL) {\n \n QSIMPLEQ_REMOVE_HEAD(&block_mig_state.bmds_list, entry);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void blk_mig_cleanup(Monitor *mon)\n\n{\n\n BlkMigDevState *bmds;\n\n BlkMigBlock *blk;\n\n\n\n set_dirty_tracking(0);\n\n\n\n while ((bmds = QSIMPLEQ_FIRST(&block_mig_state.bmds_list)) != NULL) {\n\n QSIMPLEQ_REMOVE_HEAD(&block_mig_state.bmds_list, entry);\n\n bdrv_set_in_use(bmds->bs, 0);\n\n drive_put_ref(drive_get_by_blockdev(bmds->bs));\n\n g_free(bmds->aio_bitmap);\n\n g_free(bmds);\n\n }\n\n\n\n while ((blk = QSIMPLEQ_FIRST(&block_mig_state.blk_list)) != NULL) {\n\n QSIMPLEQ_REMOVE_HEAD(&block_mig_state.blk_list, entry);\n\n g_free(blk->buf);\n\n g_free(blk);\n\n }\n\n\n\n monitor_printf(mon, \"\\n\");\n\n}\n"}} {"sample_id": "6b8f0187a4d7c263e356302f8d308655372a4b5b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n qemu_notify_event();\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_timer_notify_cb(void *opaque, QEMUClockType type)\n\n{\n\n qemu_notify_event();\n\n}\n"}} {"sample_id": "2f96cc1fc41f2d3a349d55f9d2078694a6a87dc1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n int ff_rtsp_send_cmd_with_content(AVFormatContext *s,\n \n const char *method, const char *url,\n+\n const char *header,\n \n RTSPMessageHeader *reply,\n+\n unsigned char **content_ptr,\n \n const unsigned char *send_content,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int ff_rtsp_send_cmd_with_content(AVFormatContext *s,\n\n const char *method, const char *url,\n\n const char *header,\n\n RTSPMessageHeader *reply,\n\n unsigned char **content_ptr,\n\n const unsigned char *send_content,\n\n int send_content_length)\n\n{\n\n RTSPState *rt = s->priv_data;\n\n HTTPAuthType cur_auth_type;\n\n int ret;\n\n\n\nretry:\n\n cur_auth_type = rt->auth_state.auth_type;\n\n if ((ret = ff_rtsp_send_cmd_with_content_async(s, method, url, header,\n\n send_content,\n\n send_content_length)))\n\n return ret;\n\n\n\n if ((ret = ff_rtsp_read_reply(s, reply, content_ptr, 0, method) ) < 0)\n\n return ret;\n\n\n\n if (reply->status_code == 401 && cur_auth_type == HTTP_AUTH_NONE &&\n\n rt->auth_state.auth_type != HTTP_AUTH_NONE)\n\n goto retry;\n\n\n\n if (reply->status_code > 400){\n\n av_log(s, AV_LOG_ERROR, \"method %s failed: %d%s\\n\",\n\n method,\n\n reply->status_code,\n\n reply->reason);\n\n av_log(s, AV_LOG_DEBUG, \"%s\\n\", rt->last_reply);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "c208e8c2d88eea2bbafc2850d8856525637e495d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static BlockDriverAIOCB *hdev_aio_ioctl(BlockDriverState *bs,\n \n unsigned long int req, void *buf,\n+\n+ BlockDriverCompletionFunc *cb, void *opaque)\n+\n+{\n \n BDRVRawState *s = bs->opaque;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static BlockDriverAIOCB *hdev_aio_ioctl(BlockDriverState *bs,\n\n unsigned long int req, void *buf,\n\n BlockDriverCompletionFunc *cb, void *opaque)\n\n{\n\n BDRVRawState *s = bs->opaque;\n\n\n\n if (fd_open(bs) < 0)\n\n return NULL;\n\n return paio_ioctl(bs, s->fd, req, buf, cb, opaque);\n\n}\n"}} {"sample_id": "5b185639c5740998de403415c749ac98e13418fd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,28 +1,28 @@\n void HELPER(cksm)(uint32_t r1, uint32_t r2)\n \n {\n+\n uint64_t src = get_address_31fix(r2);\n \n+ uint64_t src_len = env->regs[(r2 + 1) & 15];\n \n uint64_t cksm = 0;\n \n \n \n+ while (src_len >= 4) {\n \n cksm += ldl(src);\n+\n cksm = cksm_overflow(cksm);\n \n+\n+\n /* move to next word */\n \n src_len -= 4;\n \n+ src += 4;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void HELPER(cksm)(uint32_t r1, uint32_t r2)\n\n{\n\n uint64_t src = get_address_31fix(r2);\n\n uint64_t src_len = env->regs[(r2 + 1) & 15];\n\n uint64_t cksm = 0;\n\n\n\n while (src_len >= 4) {\n\n cksm += ldl(src);\n\n cksm = cksm_overflow(cksm);\n\n\n\n /* move to next word */\n\n src_len -= 4;\n\n src += 4;\n\n }\n\n\n\n switch (src_len) {\n\n case 0:\n\n break;\n\n case 1:\n\n cksm += ldub(src);\n\n cksm = cksm_overflow(cksm);\n\n break;\n\n case 2:\n\n cksm += lduw(src);\n\n cksm = cksm_overflow(cksm);\n\n break;\n\n case 3:\n\n /* XXX check if this really is correct */\n\n cksm += lduw(src) << 8;\n\n cksm += ldub(src + 2);\n\n cksm = cksm_overflow(cksm);\n\n break;\n\n }\n\n\n\n /* indicate we've processed everything */\n\n env->regs[(r2 + 1) & 15] = 0;\n\n\n\n /* store result */\n\n env->regs[r1] = (env->regs[r1] & 0xffffffff00000000ULL) | (uint32_t)cksm;\n\n}\n"}} {"sample_id": "f3c7d0389fe8a2792fd4c1cf151b885de03c8f62_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n CBus *cbus_init(qemu_irq dat)\n \n {\n+\n+ CBusPriv *s = (CBusPriv *) g_malloc0(sizeof(*s));\n+\n \n \n s->dat_out = dat;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "CBus *cbus_init(qemu_irq dat)\n\n{\n\n CBusPriv *s = (CBusPriv *) g_malloc0(sizeof(*s));\n\n\n\n s->dat_out = dat;\n\n s->cbus.clk = qemu_allocate_irqs(cbus_clk, s, 1)[0];\n\n s->cbus.dat = qemu_allocate_irqs(cbus_dat, s, 1)[0];\n\n s->cbus.sel = qemu_allocate_irqs(cbus_sel, s, 1)[0];\n\n\n\n s->sel = 1;\n\n s->clk = 0;\n\n s->dat = 0;\n\n\n\n return &s->cbus;\n\n}\n"}} {"sample_id": "46abb8124006887d071921c5e657eeec3c50a9e2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n int qemu_add_balloon_handler(QEMUBalloonEvent *event_func,\n \n+ QEMUBalloonStatus *stat_func, void *opaque)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int qemu_add_balloon_handler(QEMUBalloonEvent *event_func,\n\n QEMUBalloonStatus *stat_func, void *opaque)\n\n{\n\n if (balloon_event_fn || balloon_stat_fn || balloon_opaque) {\n\n /* We're already registered one balloon handler. How many can\n\n * a guest really have?\n\n */\n\n error_report(\"Another balloon device already registered\");\n\n return -1;\n\n }\n\n balloon_event_fn = event_func;\n\n balloon_stat_fn = stat_func;\n\n balloon_opaque = opaque;\n\n return 0;\n\n}\n"}} {"sample_id": "802f045a5f61b781df55e4492d896b4d20503ba7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void replay_shutdown_request(void)\n \n+{\n+\n+ if (replay_mode == REPLAY_MODE_RECORD) {\n \n replay_mutex_lock();\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void replay_shutdown_request(void)\n\n{\n\n if (replay_mode == REPLAY_MODE_RECORD) {\n\n replay_mutex_lock();\n\n replay_put_event(EVENT_SHUTDOWN);\n\n replay_mutex_unlock();\n\n }\n\n}\n"}} {"sample_id": "bcd7bf7eeb09a395cc01698842d1b8be9af483fc_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n int32_t stride,\n \n+ int32_t height,\n+\n+ int32_t log2_denom,\n+\n+ int32_t src_weight,\n \n int32_t offset_in)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void avc_wgt_4width_msa(uint8_t *data,\n\n int32_t stride,\n\n int32_t height,\n\n int32_t log2_denom,\n\n int32_t src_weight,\n\n int32_t offset_in)\n\n{\n\n if (2 == height) {\n\n avc_wgt_4x2_msa(data, stride, log2_denom, src_weight, offset_in);\n\n } else {\n\n avc_wgt_4x4multiple_msa(data, stride, height, log2_denom,\n\n src_weight, offset_in);\n\n }\n\n}\n"}} {"sample_id": "732b530c1bd064bdcc29975c0b78fc6de8c47e7f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n *\n \n * _ADR object that is used to supply OSPM with unique address\n+\n+ * of the NVDIMM device. This is done by returning the NFIT Device\n+\n+ * handle that is used to identify the associated entries in ACPI\n+\n * table NFIT or _FIT.\n \n */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void nvdimm_build_nvdimm_devices(GSList *device_list, Aml *root_dev)\n\n{\n\n for (; device_list; device_list = device_list->next) {\n\n DeviceState *dev = device_list->data;\n\n int slot = object_property_get_int(OBJECT(dev), PC_DIMM_SLOT_PROP,\n\n NULL);\n\n uint32_t handle = nvdimm_slot_to_handle(slot);\n\n Aml *nvdimm_dev;\n\n\n\n nvdimm_dev = aml_device(\"NV%02X\", slot);\n\n\n\n /*\n\n * ACPI 6.0: 9.20 NVDIMM Devices:\n\n *\n\n * _ADR object that is used to supply OSPM with unique address\n\n * of the NVDIMM device. This is done by returning the NFIT Device\n\n * handle that is used to identify the associated entries in ACPI\n\n * table NFIT or _FIT.\n\n */\n\n aml_append(nvdimm_dev, aml_name_decl(\"_ADR\", aml_int(handle)));\n\n\n\n nvdimm_build_device_dsm(nvdimm_dev);\n\n aml_append(root_dev, nvdimm_dev);\n\n }\n\n}\n"}} {"sample_id": "daa1ea049a9445b7bed03963cb789497065dd1eb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n \n \n+ STORE_4_WORDS((%1), (%1,%3), (%1,%3,2), (%1,%4), %%mm4)\n+\n+ STORE_4_WORDS((%2), (%2,%3), (%2,%3,2), (%2,%4), %%mm5)\n+\n+\n \n : \"=&r\"(tmp)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_vp3_h_loop_filter_mmx(uint8_t *src, int stride, int *bounding_values)\n\n{\n\n x86_reg tmp;\n\n\n\n __asm__ volatile(\n\n \"movd -2(%1), %%mm6 \\n\\t\"\n\n \"movd -2(%1,%3), %%mm0 \\n\\t\"\n\n \"movd -2(%1,%3,2), %%mm1 \\n\\t\"\n\n \"movd -2(%1,%4), %%mm4 \\n\\t\"\n\n\n\n TRANSPOSE8x4(%%mm6, %%mm0, %%mm1, %%mm4, -2(%2), -2(%2,%3), -2(%2,%3,2), -2(%2,%4), %%mm2)\n\n VP3_LOOP_FILTER(%5)\n\n SBUTTERFLY(%%mm4, %%mm3, %%mm5, bw, q)\n\n\n\n STORE_4_WORDS((%1), (%1,%3), (%1,%3,2), (%1,%4), %%mm4)\n\n STORE_4_WORDS((%2), (%2,%3), (%2,%3,2), (%2,%4), %%mm5)\n\n\n\n : \"=&r\"(tmp)\n\n : \"r\"(src), \"r\"(src+4*stride), \"r\"((x86_reg)stride), \"r\"((x86_reg)3*stride),\n\n \"m\"(*(uint64_t*)(bounding_values+129))\n\n : \"memory\"\n\n );\n\n}\n"}} {"sample_id": "ade0d0c0d3a0444c626ec5f46ef75af7395236f6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n note.prstatus.pr_reg.regs[16] = cpu_to_dump32(s, cpsr_read(env));\n \n+\n+\n+ ret = f(¬e, ARM_PRSTATUS_NOTE_SIZE, s);\n+\n+ if (ret < 0) {\n \n return -1;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int arm_cpu_write_elf32_note(WriteCoreDumpFunction f, CPUState *cs,\n\n int cpuid, void *opaque)\n\n{\n\n struct arm_note note;\n\n CPUARMState *env = &ARM_CPU(cs)->env;\n\n DumpState *s = opaque;\n\n int ret, i;\n\n\n\n arm_note_init(¬e, s, \"CORE\", 5, NT_PRSTATUS, sizeof(note.prstatus));\n\n\n\n note.prstatus.pr_pid = cpu_to_dump32(s, cpuid);\n\n\n\n for (i = 0; i < 16; ++i) {\n\n note.prstatus.pr_reg.regs[i] = cpu_to_dump32(s, env->regs[i]);\n\n }\n\n note.prstatus.pr_reg.regs[16] = cpu_to_dump32(s, cpsr_read(env));\n\n\n\n ret = f(¬e, ARM_PRSTATUS_NOTE_SIZE, s);\n\n if (ret < 0) {\n\n return -1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "0cd09c3a6cc2230ba38c462fc410b4acce59eb6f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void virtio_mmio_device_plugged(DeviceState *opaque)\n \n {\n+\n+ VirtIOMMIOProxy *proxy = VIRTIO_MMIO(opaque);\n+\n \n \n proxy->host_features |= (0x1 << VIRTIO_F_NOTIFY_ON_EMPTY);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_mmio_device_plugged(DeviceState *opaque)\n\n{\n\n VirtIOMMIOProxy *proxy = VIRTIO_MMIO(opaque);\n\n\n\n proxy->host_features |= (0x1 << VIRTIO_F_NOTIFY_ON_EMPTY);\n\n proxy->host_features = virtio_bus_get_vdev_features(&proxy->bus,\n\n proxy->host_features);\n\n}\n"}} {"sample_id": "8be7e7e4c72c048b90e3482557954a24bba43ba7_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n { \n \n QemuOpts *opts;\n+\n \n \n if (!qemu_chr_new(\"debugcon\", devname, NULL)) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int debugcon_parse(const char *devname)\n\n{ \n\n QemuOpts *opts;\n\n\n\n if (!qemu_chr_new(\"debugcon\", devname, NULL)) {\n\n exit(1);\n\n }\n\n opts = qemu_opts_create(qemu_find_opts(\"device\"), \"debugcon\", 1);\n\n if (!opts) {\n\n fprintf(stderr, \"qemu: already have a debugcon device\\n\");\n\n exit(1);\n\n }\n\n qemu_opt_set(opts, \"driver\", \"isa-debugcon\");\n\n qemu_opt_set(opts, \"chardev\", \"debugcon\");\n\n return 0;\n\n}\n"}} {"sample_id": "b2bedb214469af55179d907a60cd67fed6b0779e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -51,11 +51,11 @@\n \t\t\tif (optlen != TCPOLEN_MAXSEG)\n \n \t\t\t\tcontinue;\n+\n+\t\t\tif (!(ti->ti_flags & TH_SYN))\n+\n+\t\t\t\tcontinue;\n+\n \t\t\tmemcpy((char *) &mss, (char *) cp + 2, sizeof(mss));\n \n \t\t\tNTOHS(mss);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "tcp_dooptions(struct tcpcb *tp, u_char *cp, int cnt, struct tcpiphdr *ti)\n\n{\n\n\tuint16_t mss;\n\n\tint opt, optlen;\n\n\n\n\tDEBUG_CALL(\"tcp_dooptions\");\n\n\tDEBUG_ARGS((dfd,\" tp = %lx cnt=%i \\n\", (long )tp, cnt));\n\n\n\n\tfor (; cnt > 0; cnt -= optlen, cp += optlen) {\n\n\t\topt = cp[0];\n\n\t\tif (opt == TCPOPT_EOL)\n\n\t\t\tbreak;\n\n\t\tif (opt == TCPOPT_NOP)\n\n\t\t\toptlen = 1;\n\n\t\telse {\n\n\t\t\toptlen = cp[1];\n\n\t\t\tif (optlen <= 0)\n\n\t\t\t\tbreak;\n\n\t\t}\n\n\t\tswitch (opt) {\n\n\n\n\t\tdefault:\n\n\t\t\tcontinue;\n\n\n\n\t\tcase TCPOPT_MAXSEG:\n\n\t\t\tif (optlen != TCPOLEN_MAXSEG)\n\n\t\t\t\tcontinue;\n\n\t\t\tif (!(ti->ti_flags & TH_SYN))\n\n\t\t\t\tcontinue;\n\n\t\t\tmemcpy((char *) &mss, (char *) cp + 2, sizeof(mss));\n\n\t\t\tNTOHS(mss);\n\n\t\t\t(void) tcp_mss(tp, mss);\t/* sets t_maxseg */\n\n\t\t\tbreak;\n\n\t\t}\n\n\t}\n\n}\n"}} {"sample_id": "9b2fadda3e0196ffd485adde4fe9cdd6fae35300_18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void gen_dcbi(DisasContext *ctx)\n+\n+{\n+\n+#if defined(CONFIG_USER_ONLY)\n \n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n \n@@ -13,7 +13,7 @@\n if (unlikely(ctx->pr)) {\n \n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n+\n return;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_dcbi(DisasContext *ctx)\n\n{\n\n#if defined(CONFIG_USER_ONLY)\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n#else\n\n TCGv EA, val;\n\n if (unlikely(ctx->pr)) {\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n return;\n\n }\n\n EA = tcg_temp_new();\n\n gen_set_access_type(ctx, ACCESS_CACHE);\n\n gen_addr_reg_index(ctx, EA);\n\n val = tcg_temp_new();\n\n /* XXX: specification says this should be treated as a store by the MMU */\n\n gen_qemu_ld8u(ctx, val, EA);\n\n gen_qemu_st8(ctx, val, EA);\n\n tcg_temp_free(val);\n\n tcg_temp_free(EA);\n\n#endif\n\n}\n"}} {"sample_id": "faadf50e2962dd54175647a80bd6fc4319c91973", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void init_excp_620 (CPUPPCState *env)\n+\n {\n \n #if !defined(CONFIG_USER_ONLY)\n@@ -15,7 +15,7 @@\n env->excp_vectors[POWERPC_EXCP_EXTERNAL] = 0x00000500;\n \n env->excp_vectors[POWERPC_EXCP_ALIGN] = 0x00000600;\n+\n env->excp_vectors[POWERPC_EXCP_PROGRAM] = 0x00000700;\n \n env->excp_vectors[POWERPC_EXCP_FPU] = 0x00000800;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void init_excp_620 (CPUPPCState *env)\n\n{\n\n#if !defined(CONFIG_USER_ONLY)\n\n env->excp_vectors[POWERPC_EXCP_RESET] = 0x00000100;\n\n env->excp_vectors[POWERPC_EXCP_MCHECK] = 0x00000200;\n\n env->excp_vectors[POWERPC_EXCP_DSI] = 0x00000300;\n\n env->excp_vectors[POWERPC_EXCP_ISI] = 0x00000400;\n\n env->excp_vectors[POWERPC_EXCP_EXTERNAL] = 0x00000500;\n\n env->excp_vectors[POWERPC_EXCP_ALIGN] = 0x00000600;\n\n env->excp_vectors[POWERPC_EXCP_PROGRAM] = 0x00000700;\n\n env->excp_vectors[POWERPC_EXCP_FPU] = 0x00000800;\n\n env->excp_vectors[POWERPC_EXCP_DECR] = 0x00000900;\n\n env->excp_vectors[POWERPC_EXCP_SYSCALL] = 0x00000C00;\n\n env->excp_vectors[POWERPC_EXCP_TRACE] = 0x00000D00;\n\n env->excp_vectors[POWERPC_EXCP_FPA] = 0x00000E00;\n\n env->excp_vectors[POWERPC_EXCP_PERFM] = 0x00000F00;\n\n env->excp_vectors[POWERPC_EXCP_IABR] = 0x00001300;\n\n env->excp_vectors[POWERPC_EXCP_SMI] = 0x00001400;\n\n /* Hardware reset vector */\n\n env->hreset_vector = 0x0000000000000100ULL; /* ? */\n\n#endif\n\n}\n"}} {"sample_id": "aa638b4600e1fa7a1b64323b8228c459af644a47", "diff": "--- a/source.c\n+++ b/source.c\n@@ -43,10 +43,10 @@\n goto fail;\n av_set_pts_info(st, 64, framerate.den, framerate.num);\n st->codec->width = width;\n+ st->codec->height = height;\n+ st->codec->pix_fmt = pix_fmt;\n+fail:\n+ return ret;\n+ default:\n return -1;\n return 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int ff_raw_read_header(AVFormatContext *s, AVFormatParameters *ap)\n{\n AVStream *st;\n enum CodecID id;\n st = avformat_new_stream(s, NULL);\n if (!st)\n return AVERROR(ENOMEM);\n id = s->iformat->value;\n if (id == CODEC_ID_RAWVIDEO) {\n st->codec->codec_type = AVMEDIA_TYPE_VIDEO;\n } else {\n st->codec->codec_type = AVMEDIA_TYPE_AUDIO;\n st->codec->codec_id = id;\n switch(st->codec->codec_type) {\n case AVMEDIA_TYPE_AUDIO: {\n RawAudioDemuxerContext *s1 = s->priv_data;\n st->codec->channels = 1;\n if (id == CODEC_ID_ADPCM_G722)\n st->codec->sample_rate = 16000;\n if (s1 && s1->sample_rate)\n st->codec->sample_rate = s1->sample_rate;\n if (s1 && s1->channels)\n st->codec->channels = s1->channels;\n st->codec->bits_per_coded_sample = av_get_bits_per_sample(st->codec->codec_id);\n assert(st->codec->bits_per_coded_sample > 0);\n st->codec->block_align = st->codec->bits_per_coded_sample*st->codec->channels/8;\n av_set_pts_info(st, 64, 1, st->codec->sample_rate);\n break;\n case AVMEDIA_TYPE_VIDEO: {\n FFRawVideoDemuxerContext *s1 = s->priv_data;\n int width = 0, height = 0, ret = 0;\n enum PixelFormat pix_fmt;\n AVRational framerate;\n if (s1->video_size && (ret = av_parse_video_size(&width, &height, s1->video_size)) < 0) {\n av_log(s, AV_LOG_ERROR, \"Couldn't parse video size.\\n\");\n goto fail;\n if ((pix_fmt = av_get_pix_fmt(s1->pixel_format)) == PIX_FMT_NONE) {\n av_log(s, AV_LOG_ERROR, \"No such pixel format: %s.\\n\", s1->pixel_format);\n ret = AVERROR(EINVAL);\n goto fail;\n if ((ret = av_parse_video_rate(&framerate, s1->framerate)) < 0) {\n av_log(s, AV_LOG_ERROR, \"Could not parse framerate: %s.\\n\", s1->framerate);\n goto fail;\n av_set_pts_info(st, 64, framerate.den, framerate.num);\n st->codec->width = width;\n st->codec->height = height;\n st->codec->pix_fmt = pix_fmt;\nfail:\n return ret;\n default:\n return -1;\n return 0;"}} {"sample_id": "a03ef88f77af045a2eb9629b5ce774a3fb973c5e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static int coroutine_fn raw_co_pwrite_zeroes(BlockDriverState *bs,\n \n int64_t offset, int count,\n+\n+ BdrvRequestFlags flags)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int coroutine_fn raw_co_pwrite_zeroes(BlockDriverState *bs,\n\n int64_t offset, int count,\n\n BdrvRequestFlags flags)\n\n{\n\n return bdrv_co_pwrite_zeroes(bs->file->bs, offset, count, flags);\n\n}\n"}} {"sample_id": "f897bf751fbd95e4015b95d202c706548586813a_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n VirtIOBlock *s = VIRTIO_BLK(vdev);\n+\n VirtIOBlockReq *req = s->rq;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void virtio_blk_save_device(VirtIODevice *vdev, QEMUFile *f)\n\n{\n\n VirtIOBlock *s = VIRTIO_BLK(vdev);\n\n VirtIOBlockReq *req = s->rq;\n\n\n\n while (req) {\n\n qemu_put_sbyte(f, 1);\n\n qemu_put_buffer(f, (unsigned char *)req->elem,\n\n sizeof(VirtQueueElement));\n\n req = req->next;\n\n }\n\n qemu_put_sbyte(f, 0);\n\n}\n"}} {"sample_id": "32bafa8fdd098d52fbf1102d5a5e48d29398c0aa_32", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n break;\n \n \n+\n+ case SOCKET_ADDRESS_KIND_UNIX:\n+\n+ fd = unix_connect_saddr(addr->u.q_unix, errp, callback, opaque);\n+\n break;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int socket_connect(SocketAddress *addr, Error **errp,\n\n NonBlockingConnectHandler *callback, void *opaque)\n\n{\n\n int fd;\n\n\n\n switch (addr->type) {\n\n case SOCKET_ADDRESS_KIND_INET:\n\n fd = inet_connect_saddr(addr->u.inet, errp, callback, opaque);\n\n break;\n\n\n\n case SOCKET_ADDRESS_KIND_UNIX:\n\n fd = unix_connect_saddr(addr->u.q_unix, errp, callback, opaque);\n\n break;\n\n\n\n case SOCKET_ADDRESS_KIND_FD:\n\n fd = monitor_get_fd(cur_mon, addr->u.fd->str, errp);\n\n if (fd >= 0 && callback) {\n\n qemu_set_nonblock(fd);\n\n callback(fd, NULL, opaque);\n\n }\n\n break;\n\n\n\n default:\n\n abort();\n\n }\n\n return fd;\n\n}\n"}} {"sample_id": "398489018183d613306ab022653552247d93919f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n PcGuestInfo *pc_guest_info_init(ram_addr_t below_4g_mem_size,\n \n ram_addr_t above_4g_mem_size)\n+\n+{\n+\n+ PcGuestInfoState *guest_info_state = g_malloc0(sizeof *guest_info_state);\n \n+ PcGuestInfo *guest_info = &guest_info_state->info;\n+\n+\n \n guest_info->pci_info.w32.end = IO_APIC_DEFAULT_ADDRESS;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "PcGuestInfo *pc_guest_info_init(ram_addr_t below_4g_mem_size,\n\n ram_addr_t above_4g_mem_size)\n\n{\n\n PcGuestInfoState *guest_info_state = g_malloc0(sizeof *guest_info_state);\n\n PcGuestInfo *guest_info = &guest_info_state->info;\n\n\n\n guest_info->pci_info.w32.end = IO_APIC_DEFAULT_ADDRESS;\n\n if (sizeof(hwaddr) == 4) {\n\n guest_info->pci_info.w64.begin = 0;\n\n guest_info->pci_info.w64.end = 0;\n\n } else {\n\n /*\n\n * BIOS does not set MTRR entries for the 64 bit window, so no need to\n\n * align address to power of two. Align address at 1G, this makes sure\n\n * it can be exactly covered with a PAT entry even when using huge\n\n * pages.\n\n */\n\n guest_info->pci_info.w64.begin =\n\n ROUND_UP((0x1ULL << 32) + above_4g_mem_size, 0x1ULL << 30);\n\n guest_info->pci_info.w64.end = guest_info->pci_info.w64.begin +\n\n (0x1ULL << 62);\n\n assert(guest_info->pci_info.w64.begin <= guest_info->pci_info.w64.end);\n\n }\n\n\n\n guest_info_state->machine_done.notify = pc_guest_info_machine_done;\n\n qemu_add_machine_init_done_notifier(&guest_info_state->machine_done);\n\n return guest_info;\n\n}\n"}} {"sample_id": "12848bfc5d719bad536c5448205a3226be1fda47_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n if ((credp->fc_uid == -1 && credp->fc_gid == -1) ||\n+\n (fs_ctx->fs_sm == SM_PASSTHROUGH)) {\n \n return lchown(rpath(fs_ctx, path), credp->fc_uid, credp->fc_gid);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int local_chown(FsContext *fs_ctx, const char *path, FsCred *credp)\n\n{\n\n if ((credp->fc_uid == -1 && credp->fc_gid == -1) ||\n\n (fs_ctx->fs_sm == SM_PASSTHROUGH)) {\n\n return lchown(rpath(fs_ctx, path), credp->fc_uid, credp->fc_gid);\n\n } else if (fs_ctx->fs_sm == SM_MAPPED) {\n\n return local_set_xattr(rpath(fs_ctx, path), credp);\n\n } else if (fs_ctx->fs_sm == SM_PASSTHROUGH) {\n\n return lchown(rpath(fs_ctx, path), credp->fc_uid, credp->fc_gid);\n\n }\n\n return -1;\n\n}\n"}} {"sample_id": "c7085da7266120a8594f8fddcbf3b6839a8eda58", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void virtio_blk_update_config(VirtIODevice *vdev, uint8_t *config)\n \n+{\n+\n+ VirtIOBlock *s = to_virtio_blk(vdev);\n+\n+ struct virtio_blk_config blkcfg;\n \n uint64_t capacity;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void virtio_blk_update_config(VirtIODevice *vdev, uint8_t *config)\n\n{\n\n VirtIOBlock *s = to_virtio_blk(vdev);\n\n struct virtio_blk_config blkcfg;\n\n uint64_t capacity;\n\n int cylinders, heads, secs;\n\n\n\n bdrv_get_geometry(s->bs, &capacity);\n\n bdrv_get_geometry_hint(s->bs, &cylinders, &heads, &secs);\n\n stq_raw(&blkcfg.capacity, capacity);\n\n stl_raw(&blkcfg.seg_max, 128 - 2);\n\n stw_raw(&blkcfg.cylinders, cylinders);\n\n blkcfg.heads = heads;\n\n blkcfg.sectors = secs;\n\n\n memcpy(config, &blkcfg, sizeof(blkcfg));\n\n}"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_119", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n uint16_t retval;\n+\n+ MACIOIDEState *d = opaque;\n+\n+\n+\n addr = (addr & 0xFFF) >> 4;\n \n if (addr == 0) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t pmac_ide_readw (void *opaque,target_phys_addr_t addr)\n\n{\n\n uint16_t retval;\n\n MACIOIDEState *d = opaque;\n\n\n\n addr = (addr & 0xFFF) >> 4;\n\n if (addr == 0) {\n\n retval = ide_data_readw(&d->bus, 0);\n\n } else {\n\n retval = 0xFFFF;\n\n }\n\n retval = bswap16(retval);\n\n return retval;\n\n}\n"}} {"sample_id": "1a6245a5b0b4e8d822c739b403fc67c8a7bc8d12_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n if (write_sync(csock, &magic, sizeof(magic)) != sizeof(magic)) {\n \n+ LOG(\"write failed (rep magic)\");\n+\n+ return -EINVAL;\n+\n+ }\n \n opt = cpu_to_be32(opt);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int nbd_send_rep(int csock, uint32_t type, uint32_t opt)\n\n{\n\n uint64_t magic;\n\n uint32_t len;\n\n\n\n magic = cpu_to_be64(NBD_REP_MAGIC);\n\n if (write_sync(csock, &magic, sizeof(magic)) != sizeof(magic)) {\n\n LOG(\"write failed (rep magic)\");\n\n return -EINVAL;\n\n }\n\n opt = cpu_to_be32(opt);\n\n if (write_sync(csock, &opt, sizeof(opt)) != sizeof(opt)) {\n\n LOG(\"write failed (rep opt)\");\n\n return -EINVAL;\n\n }\n\n type = cpu_to_be32(type);\n\n if (write_sync(csock, &type, sizeof(type)) != sizeof(type)) {\n\n LOG(\"write failed (rep type)\");\n\n return -EINVAL;\n\n }\n\n len = cpu_to_be32(0);\n\n if (write_sync(csock, &len, sizeof(len)) != sizeof(len)) {\n\n LOG(\"write failed (rep data length)\");\n\n return -EINVAL;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "88be7b4be4aa17c88247e162bdd7577ea79db94f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n int bdrv_all_find_snapshot(const char *name, BlockDriverState **first_bad_bs)\n \n {\n+\n+ QEMUSnapshotInfo sn;\n+\n int err = 0;\n \n BlockDriverState *bs;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int bdrv_all_find_snapshot(const char *name, BlockDriverState **first_bad_bs)\n\n{\n\n QEMUSnapshotInfo sn;\n\n int err = 0;\n\n BlockDriverState *bs;\n\n BdrvNextIterator *it = NULL;\n\n\n\n while (err == 0 && (it = bdrv_next(it, &bs))) {\n\n AioContext *ctx = bdrv_get_aio_context(bs);\n\n\n\n aio_context_acquire(ctx);\n\n if (bdrv_can_snapshot(bs)) {\n\n err = bdrv_snapshot_find(bs, &sn, name);\n\n }\n\n aio_context_release(ctx);\n\n }\n\n\n\n *first_bad_bs = bs;\n\n return err;\n\n}\n"}} {"sample_id": "a808c0865b720e22ca2929ec3d362d4610fbad51", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void mmio_interface_realize(DeviceState *dev, Error **errp)\n+\n+{\n+\n+ MMIOInterface *s = MMIO_INTERFACE(dev);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void mmio_interface_realize(DeviceState *dev, Error **errp)\n\n{\n\n MMIOInterface *s = MMIO_INTERFACE(dev);\n\n\n\n DPRINTF(\"realize from 0x%\" PRIX64 \" to 0x%\" PRIX64 \" map host pointer\"\n\n \" %p\\n\", s->start, s->end, s->host_ptr);\n\n\n\n if (!s->host_ptr) {\n\n error_setg(errp, \"host_ptr property must be set\");\n\n\n }\n\n\n\n if (!s->subregion) {\n\n error_setg(errp, \"subregion property must be set\");\n\n\n }\n\n\n\n memory_region_init_ram_ptr(&s->ram_mem, OBJECT(s), \"ram\",\n\n s->end - s->start + 1, s->host_ptr);\n\n memory_region_set_readonly(&s->ram_mem, s->ro);\n\n memory_region_add_subregion(s->subregion, s->start, &s->ram_mem);\n\n}"}} {"sample_id": "38152d9368beb080b4acd6cd9e5ccc89b3f733bf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n int i;\n+\n \n \n if (bits < 0)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void dss_sp_scale_vector(int32_t *vec, int bits, int size)\n\n{\n\n int i;\n\n\n\n if (bits < 0)\n\n for (i = 0; i < size; i++)\n\n vec[i] = vec[i] >> -bits;\n\n else\n\n for (i = 0; i < size; i++)\n\n vec[i] = vec[i] << bits;\n\n}\n"}} {"sample_id": "eacc324914c2dc7aecec3b4ea920252b685b5c8e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,6 +4,6 @@\n \n /* XXX: TODO */\n \n+ tlb_flush(env, 1);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ppc_slb_invalidate_all (CPUPPCState *env)\n\n{\n\n /* XXX: TODO */\n\n tlb_flush(env, 1);\n\n}\n"}} {"sample_id": "69e7336b8e16ee65226fc20381baf537f4b125e6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n if (!av_strncasecmp(name, names, len))\n \n+ return 1;\n+\n+ names = p + 1;\n+\n+ }\n \n return !av_strcasecmp(name, names);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int match_format(const char *name, const char *names)\n\n{\n\n const char *p;\n\n int len, namelen;\n\n\n\n if (!name || !names)\n\n return 0;\n\n\n\n namelen = strlen(name);\n\n while ((p = strchr(names, ','))) {\n\n len = FFMAX(p - names, namelen);\n\n if (!av_strncasecmp(name, names, len))\n\n return 1;\n\n names = p + 1;\n\n }\n\n return !av_strcasecmp(name, names);\n\n}\n"}} {"sample_id": "d195325b05199038b5907fa791729425b9720d21", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void error_propagate(Error **dst_err, Error *local_err)\n+\n {\n \n if (dst_err) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void error_propagate(Error **dst_err, Error *local_err)\n\n{\n\n if (dst_err) {\n\n *dst_err = local_err;\n\n } else if (local_err) {\n\n error_free(local_err);\n\n }\n\n}\n"}} {"sample_id": "df3c286c53ac51e7267f2761c7a0c62e11b6e815_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n if (ret < 0) {\n \n error_report(\"Failed flush request: %s\\n\", strerror(-ret));\n+\n+ exit(EXIT_FAILURE);\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bench_undrained_flush_cb(void *opaque, int ret)\n\n{\n\n if (ret < 0) {\n\n error_report(\"Failed flush request: %s\\n\", strerror(-ret));\n\n exit(EXIT_FAILURE);\n\n }\n\n}\n"}} {"sample_id": "ee9f36a88eb3e2706ea659acb0ca80c414fa5d8a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n \tput_packetheader(nut, bc, 64);\n \n+\tput_v(bc, s->streams[i]->id);\n+\n+\tput_v(bc, ...);\n+\n+\tput_be32(bc, 0); /* FIXME: checksum */\n \n update_packetheader(nut, bc, 0);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int nut_write_trailer(AVFormatContext *s)\n\n{\n\n NUTContext *nut = s->priv_data;\n\n ByteIOContext *bc = &s->pb;\n\n\n\n update_packetheader(nut, bc, 0);\n\n\n\n#if 0\n\n int i;\n\n\n\n /* WRITE INDEX */\n\n\n\n for (i = 0; s->nb_streams; i++)\n\n {\n\n\tput_be64(bc, INDEX_STARTCODE);\n\n\tput_packetheader(nut, bc, 64);\n\n\tput_v(bc, s->streams[i]->id);\n\n\tput_v(bc, ...);\n\n\tput_be32(bc, 0); /* FIXME: checksum */\n\n update_packetheader(nut, bc, 0);\n\n }\n\n#endif\n\n\n\n put_flush_packet(bc);\n\n \n\n av_freep(&nut->stream);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "4a1418e07bdcfaa3177739e04707ecaec75d89e1_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,9 +7,9 @@\n /* cancelling the I/O request causes KQEMU to finish executing the\n \n current block and successfully returning. */\n+\n+ CancelIo(kqemu_fd);\n+\n #endif\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void kqemu_cpu_interrupt(CPUState *env)\n\n{\n\n#if defined(_WIN32)\n\n /* cancelling the I/O request causes KQEMU to finish executing the\n\n current block and successfully returning. */\n\n CancelIo(kqemu_fd);\n\n#endif\n\n}\n"}} {"sample_id": "5fb6c7a8b26eab1a22207d24b4784bd2b39ab54b_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n vnc_write(vs, (char *)&value, 1);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vnc_write_u8(VncState *vs, uint8_t value)\n\n{\n\n vnc_write(vs, (char *)&value, 1);\n\n}\n"}} {"sample_id": "d07bde88a52bf293c3f8846cfd162e0a57e1557c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,7 +14,7 @@\n \n int code_gen_size;\n \n+\n \n phys_pc = get_phys_addr_code(env, pc);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void tb_gen_code(CPUState *env,\n\n target_ulong pc, target_ulong cs_base, int flags,\n\n int cflags)\n\n{\n\n TranslationBlock *tb;\n\n uint8_t *tc_ptr;\n\n target_ulong phys_pc, phys_page2, virt_page2;\n\n int code_gen_size;\n\n\n\n phys_pc = get_phys_addr_code(env, pc);\n\n tb = tb_alloc(pc);\n\n if (!tb) {\n\n /* flush must be done */\n\n tb_flush(env);\n\n /* cannot fail at this point */\n\n tb = tb_alloc(pc);\n\n }\n\n tc_ptr = code_gen_ptr;\n\n tb->tc_ptr = tc_ptr;\n\n tb->cs_base = cs_base;\n\n tb->flags = flags;\n\n tb->cflags = cflags;\n\n cpu_gen_code(env, tb, CODE_GEN_MAX_SIZE, &code_gen_size);\n\n code_gen_ptr = (void *)(((unsigned long)code_gen_ptr + code_gen_size + CODE_GEN_ALIGN - 1) & ~(CODE_GEN_ALIGN - 1));\n\n\n\n /* check next page if needed */\n\n virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK;\n\n phys_page2 = -1;\n\n if ((pc & TARGET_PAGE_MASK) != virt_page2) {\n\n phys_page2 = get_phys_addr_code(env, virt_page2);\n\n }\n\n tb_link_phys(tb, phys_pc, phys_page2);\n\n}\n"}} {"sample_id": "b2a7c017336b19afc045e8a7385999c1896d4b45", "diff": "--- a/source.c\n+++ b/source.c\n@@ -51,11 +51,11 @@\n if(bands[i].msf){\n \n int t1, t2;\n+\n+ for(j = 0; j < SAMPLES_PER_BAND; j++){\n+\n+ t1 = c->sb_samples[0][j][i];\n+\n t2 = c->sb_samples[1][j][i];\n \n c->sb_samples[0][j][i] = t1 + t2;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_mpc_dequantize_and_synth(MPCContext * c, int maxband, void *data, int channels)\n\n{\n\n int i, j, ch;\n\n Band *bands = c->bands;\n\n int off;\n\n float mul;\n\n\n\n /* dequantize */\n\n memset(c->sb_samples, 0, sizeof(c->sb_samples));\n\n off = 0;\n\n for(i = 0; i <= maxband; i++, off += SAMPLES_PER_BAND){\n\n for(ch = 0; ch < 2; ch++){\n\n if(bands[i].res[ch]){\n\n j = 0;\n\n mul = mpc_CC[bands[i].res[ch]] * mpc_SCF[bands[i].scf_idx[ch][0] & 0xFF];\n\n for(; j < 12; j++)\n\n c->sb_samples[ch][j][i] = mul * c->Q[ch][j + off];\n\n mul = mpc_CC[bands[i].res[ch]] * mpc_SCF[bands[i].scf_idx[ch][1] & 0xFF];\n\n for(; j < 24; j++)\n\n c->sb_samples[ch][j][i] = mul * c->Q[ch][j + off];\n\n mul = mpc_CC[bands[i].res[ch]] * mpc_SCF[bands[i].scf_idx[ch][2] & 0xFF];\n\n for(; j < 36; j++)\n\n c->sb_samples[ch][j][i] = mul * c->Q[ch][j + off];\n\n }\n\n }\n\n if(bands[i].msf){\n\n int t1, t2;\n\n for(j = 0; j < SAMPLES_PER_BAND; j++){\n\n t1 = c->sb_samples[0][j][i];\n\n t2 = c->sb_samples[1][j][i];\n\n c->sb_samples[0][j][i] = t1 + t2;\n\n c->sb_samples[1][j][i] = t1 - t2;\n\n }\n\n }\n\n }\n\n\n\n mpc_synth(c, data, channels);\n\n}\n"}} {"sample_id": "4b51437dccd62fc5491280db44e3c21b44aeeb3f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n const uint8_t * ptr = src + byte*2;\n \n+ int ptr_len = src_len - 1 - byte*2;\n \n uint8_t val = ival;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int xan_huffman_decode(uint8_t *dest, int dest_len,\n\n const uint8_t *src, int src_len)\n\n{\n\n uint8_t byte = *src++;\n\n uint8_t ival = byte + 0x16;\n\n const uint8_t * ptr = src + byte*2;\n\n int ptr_len = src_len - 1 - byte*2;\n\n uint8_t val = ival;\n\n uint8_t *dest_end = dest + dest_len;\n\n uint8_t *dest_start = dest;\n\n int ret;\n\n GetBitContext gb;\n\n\n\n if ((ret = init_get_bits8(&gb, ptr, ptr_len)) < 0)\n\n return ret;\n\n\n\n while (val != 0x16) {\n\n unsigned idx = val - 0x17 + get_bits1(&gb) * byte;\n\n if (idx >= 2 * byte)\n\n return AVERROR_INVALIDDATA;\n\n val = src[idx];\n\n\n\n if (val < 0x16) {\n\n if (dest >= dest_end)\n\n return dest_len;\n\n *dest++ = val;\n\n val = ival;\n\n }\n\n }\n\n\n\n return dest - dest_start;\n\n}\n"}} {"sample_id": "7c560456707bfe53eb1728fcde759be7d9418b62_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,10 +2,10 @@\n \n BlockDriverState **fds)\n \n+{\n+\n+ fdctrl_t *fdctrl;\n+\n \n \n fdctrl = fdctrl_init(irq, 0, 1, io_base, fds);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "fdctrl_t *sun4m_fdctrl_init (qemu_irq irq, target_phys_addr_t io_base,\n\n BlockDriverState **fds)\n\n{\n\n fdctrl_t *fdctrl;\n\n\n\n fdctrl = fdctrl_init(irq, 0, 1, io_base, fds);\n\n fdctrl->sun4m = 1;\n\n\n\n return fdctrl;\n\n}\n"}} {"sample_id": "e8ede0a8bb5298a6979bcf7ed84ef64a64a4e3fe_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n return float32_add(a, b, &env->ucf64.fp_status);\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "float32 HELPER(ucf64_adds)(float32 a, float32 b, CPUUniCore32State *env)\n\n{\n\n return float32_add(a, b, &env->ucf64.fp_status);\n\n}\n"}} {"sample_id": "e53c9065ca08a9153ecc73a6a8940bcc6d667e58_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n int ret;\n \n \n+\n+ cdsp->vector_fmul(cdst, v1, v2, LEN);\n+\n+ fdsp->vector_fmul(odst, v1, v2, LEN);\n+\n \n \n if (ret = compare_floats(cdst, odst, LEN, FLT_EPSILON))", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int test_vector_fmul(AVFloatDSPContext *fdsp, AVFloatDSPContext *cdsp,\n\n const float *v1, const float *v2)\n\n{\n\n LOCAL_ALIGNED(32, float, cdst, [LEN]);\n\n LOCAL_ALIGNED(32, float, odst, [LEN]);\n\n int ret;\n\n\n\n cdsp->vector_fmul(cdst, v1, v2, LEN);\n\n fdsp->vector_fmul(odst, v1, v2, LEN);\n\n\n\n if (ret = compare_floats(cdst, odst, LEN, FLT_EPSILON))\n\n av_log(NULL, AV_LOG_ERROR, \"vector_fmul failed\\n\");\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "67a0fd2a9bca204d2b39f910a97c7137636a0715_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n {\n \n BDRVQcowState *s = bs->opaque;\n+\n+ int index_in_cluster, n;\n+\n+ uint64_t cluster_offset;\n+\n \n \n qemu_co_mutex_lock(&s->lock);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int64_t coroutine_fn qcow_co_get_block_status(BlockDriverState *bs,\n\n int64_t sector_num, int nb_sectors, int *pnum)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n int index_in_cluster, n;\n\n uint64_t cluster_offset;\n\n\n\n qemu_co_mutex_lock(&s->lock);\n\n cluster_offset = get_cluster_offset(bs, sector_num << 9, 0, 0, 0, 0);\n\n qemu_co_mutex_unlock(&s->lock);\n\n index_in_cluster = sector_num & (s->cluster_sectors - 1);\n\n n = s->cluster_sectors - index_in_cluster;\n\n if (n > nb_sectors)\n\n n = nb_sectors;\n\n *pnum = n;\n\n if (!cluster_offset) {\n\n return 0;\n\n }\n\n if ((cluster_offset & QCOW_OFLAG_COMPRESSED) || s->cipher) {\n\n return BDRV_BLOCK_DATA;\n\n }\n\n cluster_offset |= (index_in_cluster << BDRV_SECTOR_BITS);\n\n return BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID | cluster_offset;\n\n}\n"}} {"sample_id": "0cd09c3a6cc2230ba38c462fc410b4acce59eb6f_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ VirtIOSerial *vser;\n+\n+\n+\n+ vser = VIRTIO_SERIAL(vdev);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t get_features(VirtIODevice *vdev, uint32_t features)\n\n{\n\n VirtIOSerial *vser;\n\n\n\n vser = VIRTIO_SERIAL(vdev);\n\n\n\n if (vser->bus.max_nr_ports > 1) {\n\n features |= (1 << VIRTIO_CONSOLE_F_MULTIPORT);\n\n }\n\n return features;\n\n}\n"}} {"sample_id": "0187688f3270433269fc7d4909ad36dc5c5db7aa", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void dec_store(DisasContext *dc)\n {\n TCGv t, *addr;\n+ unsigned int size;\n+ size = 1 << (dc->opcode & 3);\n+ LOG_DIS(\"s%d%s\\n\", size, dc->type_b ? \"i\" : \"\");\n+ t_sync_flags(dc);\n /* If we get a fault on a dslot, the jmpstate better be in sync. */\n sync_jmpstate(dc);\n addr = compute_ldst_addr(dc, &t);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void dec_store(DisasContext *dc)\n{\n TCGv t, *addr;\n unsigned int size;\n size = 1 << (dc->opcode & 3);\n LOG_DIS(\"s%d%s\\n\", size, dc->type_b ? \"i\" : \"\");\n t_sync_flags(dc);\n /* If we get a fault on a dslot, the jmpstate better be in sync. */\n sync_jmpstate(dc);\n addr = compute_ldst_addr(dc, &t);\n /* Verify alignment if needed. */\n if ((dc->env->pvr.regs[2] & PVR2_UNALIGNED_EXC_MASK) && size > 1) {\n gen_helper_memalign(*addr, tcg_const_tl(dc->rd),\n tcg_const_tl(1), tcg_const_tl(size - 1));\n gen_store(dc, *addr, cpu_R[dc->rd], size);\n if (addr == &t)\n tcg_temp_free(t);"}} {"sample_id": "e1cf5582644ef63528993fb2b88dd3b43b9914c6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n HBitmap *hbitmap_alloc(uint64_t size, int granularity)\n+\n {\n \n HBitmap *hb = g_malloc0(sizeof (struct HBitmap));\n@@ -8,7 +8,7 @@\n \n \n \n+ assert(granularity >= 0 && granularity < 64);\n \n size = (size + (1ULL << granularity) - 1) >> granularity;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "HBitmap *hbitmap_alloc(uint64_t size, int granularity)\n\n{\n\n HBitmap *hb = g_malloc0(sizeof (struct HBitmap));\n\n unsigned i;\n\n\n\n assert(granularity >= 0 && granularity < 64);\n\n size = (size + (1ULL << granularity) - 1) >> granularity;\n\n assert(size <= ((uint64_t)1 << HBITMAP_LOG_MAX_SIZE));\n\n\n\n hb->size = size;\n\n hb->granularity = granularity;\n\n for (i = HBITMAP_LEVELS; i-- > 0; ) {\n\n size = MAX((size + BITS_PER_LONG - 1) >> BITS_PER_LEVEL, 1);\n\n hb->levels[i] = g_malloc0(size * sizeof(unsigned long));\n\n }\n\n\n\n /* We necessarily have free bits in level 0 due to the definition\n\n * of HBITMAP_LEVELS, so use one for a sentinel. This speeds up\n\n * hbitmap_iter_skip_words.\n\n */\n\n assert(size == 1);\n\n hb->levels[0][0] |= 1UL << (BITS_PER_LONG - 1);\n\n return hb;\n\n}\n"}} {"sample_id": "1f51470d044852592922f91000e741c381582cdc_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n+int qemu_chr_open_msmouse(QemuOpts *opts, CharDriverState **_chr)\n \n {\n \n CharDriverState *chr;\n \n+\n+\n chr = g_malloc0(sizeof(CharDriverState));\n \n chr->chr_write = msmouse_chr_write;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int qemu_chr_open_msmouse(QemuOpts *opts, CharDriverState **_chr)\n\n{\n\n CharDriverState *chr;\n\n\n\n chr = g_malloc0(sizeof(CharDriverState));\n\n chr->chr_write = msmouse_chr_write;\n\n chr->chr_close = msmouse_chr_close;\n\n\n\n qemu_add_mouse_event_handler(msmouse_event, chr, 0, \"QEMU Microsoft Mouse\");\n\n\n\n *_chr = chr;\n\n return 0;\n\n}\n"}} {"sample_id": "e2b54464c6a9de5d6b9ad4307696b0215d5e05a4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n return AVERROR_OPTION_NOT_FOUND;\n \n if (o->type != type) {\n+\n+ av_log(obj, AV_LOG_ERROR,\n+\n+ \"The value set by option '%s' is not a %s format\", name, desc);\n+\n return AVERROR(EINVAL);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int set_format(void *obj, const char *name, int fmt, int search_flags,\n\n enum AVOptionType type, const char *desc, int nb_fmts)\n\n{\n\n void *target_obj;\n\n const AVOption *o = av_opt_find2(obj, name, NULL, 0,\n\n search_flags, &target_obj);\n\n int min, max;\n\n const AVClass *class = *(AVClass **)obj;\n\n\n\n if (!o || !target_obj)\n\n return AVERROR_OPTION_NOT_FOUND;\n\n if (o->type != type) {\n\n av_log(obj, AV_LOG_ERROR,\n\n \"The value set by option '%s' is not a %s format\", name, desc);\n\n return AVERROR(EINVAL);\n\n }\n\n\n\n#if LIBAVUTIL_VERSION_MAJOR < 54\n\n if (class->version && class->version < AV_VERSION_INT(52, 11, 100)) {\n\n min = -1;\n\n max = nb_fmts-1;\n\n } else\n\n#endif\n\n {\n\n min = FFMIN(o->min, -1);\n\n max = FFMAX(o->max, nb_fmts-1);\n\n }\n\n if (fmt < min || fmt > max) {\n\n av_log(obj, AV_LOG_ERROR,\n\n \"Value %d for parameter '%s' out of %s format range [%d - %d]\\n\",\n\n fmt, name, desc, min, max);\n\n return AVERROR(ERANGE);\n\n }\n\n *(int *)(((uint8_t *)target_obj) + o->offset) = fmt;\n\n return 0;\n\n}\n"}} {"sample_id": "9bada8971173345ceb37ed1a47b00a01a4dd48cf_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -39,11 +39,11 @@\n case JSON_STRING:\n \n return parse_literal(ctxt);\n+\n+ case JSON_KEYWORD:\n+\n+ return parse_keyword(ctxt);\n+\n default:\n \n parse_error(ctxt, token, \"expecting value\");", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static QObject *parse_value(JSONParserContext *ctxt, va_list *ap)\n\n{\n\n QObject *token;\n\n\n\n token = parser_context_peek_token(ctxt);\n\n if (token == NULL) {\n\n parse_error(ctxt, NULL, \"premature EOI\");\n\n return NULL;\n\n }\n\n\n\n switch (token_get_type(token)) {\n\n case JSON_LCURLY:\n\n return parse_object(ctxt, ap);\n\n case JSON_LSQUARE:\n\n return parse_array(ctxt, ap);\n\n case JSON_ESCAPE:\n\n return parse_escape(ctxt, ap);\n\n case JSON_INTEGER:\n\n case JSON_FLOAT:\n\n case JSON_STRING:\n\n return parse_literal(ctxt);\n\n case JSON_KEYWORD:\n\n return parse_keyword(ctxt);\n\n default:\n\n parse_error(ctxt, token, \"expecting value\");\n\n return NULL;\n\n }\n\n}\n"}} {"sample_id": "32c3047cac9294bb56d23c89a40a22409db5cc70_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n } else {\n \n s->palette_video = 1;\n+\n+ avctx->pix_fmt = PIX_FMT_PAL8;\n+\n+ }\n+\n \n \n dsputil_init(&s->dsp, avctx);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int cinepak_decode_init(AVCodecContext *avctx)\n\n{\n\n CinepakContext *s = avctx->priv_data;\n\n\n\n s->avctx = avctx;\n\n s->width = (avctx->width + 3) & ~3;\n\n s->height = (avctx->height + 3) & ~3;\n\n s->sega_film_skip_bytes = -1; /* uninitialized state */\n\n\n\n // check for paletted data\n\n if ((avctx->palctrl == NULL) || (avctx->bits_per_sample == 40)) {\n\n s->palette_video = 0;\n\n avctx->pix_fmt = PIX_FMT_YUV420P;\n\n } else {\n\n s->palette_video = 1;\n\n avctx->pix_fmt = PIX_FMT_PAL8;\n\n }\n\n\n\n dsputil_init(&s->dsp, avctx);\n\n\n\n s->frame.data[0] = NULL;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "381b487d54ba18c73df9db8452028a330058c505", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n int ret;\n \n+\n+\n+ *pnum = nb_sectors;\n+\n+ /* FIXME We can get errors here, but the bdrv_co_is_allocated interface\n \n * can't pass them on today */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int coroutine_fn qcow2_co_is_allocated(BlockDriverState *bs,\n\n int64_t sector_num, int nb_sectors, int *pnum)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n uint64_t cluster_offset;\n\n int ret;\n\n\n\n *pnum = nb_sectors;\n\n /* FIXME We can get errors here, but the bdrv_co_is_allocated interface\n\n * can't pass them on today */\n\n qemu_co_mutex_lock(&s->lock);\n\n ret = qcow2_get_cluster_offset(bs, sector_num << 9, pnum, &cluster_offset);\n\n qemu_co_mutex_unlock(&s->lock);\n\n if (ret < 0) {\n\n *pnum = 0;\n\n }\n\n\n\n return (cluster_offset != 0);\n\n}\n"}} {"sample_id": "7d1b0095bff7157e856d1d0e6c4295641ced2752_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static inline void store_cpu_offset(TCGv var, int offset)\n \n+{\n \n tcg_gen_st_i32(var, cpu_env, offset);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void store_cpu_offset(TCGv var, int offset)\n\n{\n\n tcg_gen_st_i32(var, cpu_env, offset);\n\n dead_tmp(var);\n\n}\n"}} {"sample_id": "4f298a4b2957b7833bc607c951ca27c458d98d88", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void set_bmc_global_enables(IPMIBmcSim *ibs,\n+\n uint8_t *cmd, unsigned int cmd_len,\n \n uint8_t *rsp, unsigned int *rsp_len,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void set_bmc_global_enables(IPMIBmcSim *ibs,\n\n uint8_t *cmd, unsigned int cmd_len,\n\n uint8_t *rsp, unsigned int *rsp_len,\n\n unsigned int max_rsp_len)\n\n{\n\n IPMI_CHECK_CMD_LEN(3);\n\n set_global_enables(ibs, cmd[2]);\n\n}\n"}} {"sample_id": "8d5c773e323b22402abdd0beef4c7d2fc91dd0eb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,8 +6,8 @@\n \n \n \n+ env->cp15.c3 = value;\n+\n+ tlb_flush(CPU(cpu), 1); /* Flush TLB as domain not tracked in TLB */\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)\n\n{\n\n ARMCPU *cpu = arm_env_get_cpu(env);\n\n\n\n env->cp15.c3 = value;\n\n tlb_flush(CPU(cpu), 1); /* Flush TLB as domain not tracked in TLB */\n\n}\n"}} {"sample_id": "a32354e206895400d17c3de9a8df1de96d3df289", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static uint32_t m5206_mbar_readb(void *opaque, target_phys_addr_t offset)\n \n {\n+\n m5206_mbar_state *s = (m5206_mbar_state *)opaque;\n \n offset &= 0x3ff;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint32_t m5206_mbar_readb(void *opaque, target_phys_addr_t offset)\n\n{\n\n m5206_mbar_state *s = (m5206_mbar_state *)opaque;\n\n offset &= 0x3ff;\n\n if (offset > 0x200) {\n\n hw_error(\"Bad MBAR read offset 0x%x\", (int)offset);\n\n }\n\n if (m5206_mbar_width[offset >> 2] > 1) {\n\n uint16_t val;\n\n val = m5206_mbar_readw(opaque, offset & ~1);\n\n if ((offset & 1) == 0) {\n\n val >>= 8;\n\n }\n\n return val & 0xff;\n\n }\n\n return m5206_mbar_read(s, offset, 1);\n\n}\n"}} {"sample_id": "e1f8c729fa890c67bb4532f22c22ace6fb0e1aaf_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n qemu_get_be32s(f, &s->int_enabled[i]);\n \n for (i = 0; i < 2; i ++)\n+\n+ qemu_get_be32s(f, &s->int_pending[i]);\n+\n+ for (i = 0; i < 2; i ++)\n+\n qemu_get_be32s(f, &s->is_fiq[i]);\n \n qemu_get_be32s(f, &s->int_idle);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pxa2xx_pic_load(QEMUFile *f, void *opaque, int version_id)\n\n{\n\n PXA2xxPICState *s = (PXA2xxPICState *) opaque;\n\n int i;\n\n\n\n for (i = 0; i < 2; i ++)\n\n qemu_get_be32s(f, &s->int_enabled[i]);\n\n for (i = 0; i < 2; i ++)\n\n qemu_get_be32s(f, &s->int_pending[i]);\n\n for (i = 0; i < 2; i ++)\n\n qemu_get_be32s(f, &s->is_fiq[i]);\n\n qemu_get_be32s(f, &s->int_idle);\n\n for (i = 0; i < PXA2XX_PIC_SRCS; i ++)\n\n qemu_get_be32s(f, &s->priority[i]);\n\n\n\n pxa2xx_pic_update(opaque);\n\n return 0;\n\n}\n"}} {"sample_id": "6bdcc018a6ed760b9dfe43539124e420aed83092_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n NBDRequest *request)\n \n+{\n+\n NBDClientSession *s = nbd_get_client_session(bs);\n \n int i = HANDLE_TO_INDEX(s, request->handle);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void nbd_coroutine_end(BlockDriverState *bs,\n\n NBDRequest *request)\n\n{\n\n NBDClientSession *s = nbd_get_client_session(bs);\n\n int i = HANDLE_TO_INDEX(s, request->handle);\n\n\n\n s->recv_coroutine[i] = NULL;\n\n s->in_flight--;\n\n qemu_co_queue_next(&s->free_sema);\n\n\n\n /* Kick the read_reply_co to get the next reply. */\n\n if (s->read_reply_co) {\n\n aio_co_wake(s->read_reply_co);\n\n }\n\n}\n"}} {"sample_id": "d861b05ea30e6ac177de9b679da96194ebe21afc_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n int is_connected)\n \n {\n+\n NetSocketState *s;\n \n s = qemu_mallocz(sizeof(NetSocketState));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static NetSocketState *net_socket_fd_init_stream(VLANState *vlan, int fd, \n\n int is_connected)\n\n{\n\n NetSocketState *s;\n\n s = qemu_mallocz(sizeof(NetSocketState));\n\n if (!s)\n\n return NULL;\n\n s->fd = fd;\n\n s->vc = qemu_new_vlan_client(vlan, \n\n net_socket_receive, s);\n\n snprintf(s->vc->info_str, sizeof(s->vc->info_str),\n\n \"socket: fd=%d\", fd);\n\n if (is_connected) {\n\n net_socket_connect(s);\n\n } else {\n\n qemu_set_fd_handler(s->fd, NULL, net_socket_connect, s);\n\n }\n\n return s;\n\n}\n"}} {"sample_id": "689f65126be8a55e8a1e706cb56b19bb975c20ce", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n a2 = col[8*4];\n \n a3 = col[8*6];\n+\n+ c0 = ((a0 + a2) << (CN_SHIFT - 1)) + (1 << (C_SHIFT - 1));\n+\n+ c2 = ((a0 - a2) << (CN_SHIFT - 1)) + (1 << (C_SHIFT - 1));\n+\n c1 = a1 * C1 + a3 * C2;\n \n c3 = a1 * C2 - a3 * C1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void idct4col_put(uint8_t *dest, int line_size, const DCTELEM *col)\n\n{\n\n int c0, c1, c2, c3, a0, a1, a2, a3;\n\n const uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;\n\n\n\n a0 = col[8*0];\n\n a1 = col[8*2];\n\n a2 = col[8*4];\n\n a3 = col[8*6];\n\n c0 = ((a0 + a2) << (CN_SHIFT - 1)) + (1 << (C_SHIFT - 1));\n\n c2 = ((a0 - a2) << (CN_SHIFT - 1)) + (1 << (C_SHIFT - 1));\n\n c1 = a1 * C1 + a3 * C2;\n\n c3 = a1 * C2 - a3 * C1;\n\n dest[0] = cm[(c0 + c1) >> C_SHIFT];\n\n dest += line_size;\n\n dest[0] = cm[(c2 + c3) >> C_SHIFT];\n\n dest += line_size;\n\n dest[0] = cm[(c2 - c3) >> C_SHIFT];\n\n dest += line_size;\n\n dest[0] = cm[(c0 - c1) >> C_SHIFT];\n\n}\n"}} {"sample_id": "fd859081453f94c3cbd6527289e41b7fddbf645f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static int tpm_passthrough_unix_transfer(TPMPassthruState *tpm_pt,\n+\n+ const TPMLocality *locty_data)\n+\n {\n \n return tpm_passthrough_unix_tx_bufs(tpm_pt,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int tpm_passthrough_unix_transfer(TPMPassthruState *tpm_pt,\n\n const TPMLocality *locty_data)\n\n{\n\n return tpm_passthrough_unix_tx_bufs(tpm_pt,\n\n locty_data->w_buffer.buffer,\n\n locty_data->w_offset,\n\n locty_data->r_buffer.buffer,\n\n locty_data->r_buffer.size);\n\n}\n"}} {"sample_id": "7500781313d11b37772c05a28da20fbc112db478_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+static av_cold int ape_decode_close(AVCodecContext * avctx)\n+\n+{\n+\n+ APEContext *s = avctx->priv_data;\n+\n+ int i;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static av_cold int ape_decode_close(AVCodecContext * avctx)\n\n{\n\n APEContext *s = avctx->priv_data;\n\n int i;\n\n\n\n for (i = 0; i < APE_FILTER_LEVELS; i++)\n\n av_freep(&s->filterbuf[i]);\n\n\n\n av_freep(&s->data);\n\n return 0;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_74", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n addr >>= 2;\n \n+ switch (addr) {\n+\n+ case R_CTRL:\n+\n+ s->regs[addr] = value;\n \n break;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "softusb_write(void *opaque, target_phys_addr_t addr, uint64_t value,\n\n unsigned size)\n\n{\n\n MilkymistSoftUsbState *s = opaque;\n\n\n\n trace_milkymist_softusb_memory_write(addr, value);\n\n\n\n addr >>= 2;\n\n switch (addr) {\n\n case R_CTRL:\n\n s->regs[addr] = value;\n\n break;\n\n\n\n default:\n\n error_report(\"milkymist_softusb: write access to unknown register 0x\"\n\n TARGET_FMT_plx, addr << 2);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "465c28b6b43be2563e0b644ec22cf641fe374d8d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int matroska_ebmlnum_uint(MatroskaDemuxContext *matroska,\n \n uint8_t *data, uint32_t size, uint64_t *num)\n+\n {\n \n ByteIOContext pb;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int matroska_ebmlnum_uint(MatroskaDemuxContext *matroska,\n\n uint8_t *data, uint32_t size, uint64_t *num)\n\n{\n\n ByteIOContext pb;\n\n init_put_byte(&pb, data, size, 0, NULL, NULL, NULL, NULL);\n\n return ebml_read_num(matroska, &pb, 8, num);\n\n}\n"}} {"sample_id": "3e4f910c8d490a1490409a7e381dbbb229f9d272_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static uint32_t ehci_mem_readl(void *ptr, target_phys_addr_t addr)\n \n+{\n+\n+ EHCIState *s = ptr;\n+\n uint32_t val;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint32_t ehci_mem_readl(void *ptr, target_phys_addr_t addr)\n\n{\n\n EHCIState *s = ptr;\n\n uint32_t val;\n\n\n\n val = s->mmio[addr] | (s->mmio[addr+1] << 8) |\n\n (s->mmio[addr+2] << 16) | (s->mmio[addr+3] << 24);\n\n\n\n trace_usb_ehci_mmio_readl(addr, addr2str(addr), val);\n\n return val;\n\n}\n"}} {"sample_id": "be8d812c9635f31f69c30dff9ebf565a07a7dab7_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void ready_residue(vorbis_enc_residue *rc, vorbis_enc_context *venc)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void ready_residue(vorbis_enc_residue *rc, vorbis_enc_context *venc)\n\n{\n\n int i;\n\n assert(rc->type == 2);\n\n rc->maxes = av_mallocz(sizeof(float[2]) * rc->classifications);\n\n for (i = 0; i < rc->classifications; i++) {\n\n int j;\n\n vorbis_enc_codebook * cb;\n\n for (j = 0; j < 8; j++)\n\n if (rc->books[i][j] != -1)\n\n break;\n\n if (j == 8) // zero\n\n continue;\n\n cb = &venc->codebooks[rc->books[i][j]];\n\n assert(cb->ndimentions >= 2);\n\n assert(cb->lookup);\n\n\n\n for (j = 0; j < cb->nentries; j++) {\n\n float a;\n\n if (!cb->lens[j])\n\n continue;\n\n a = fabs(cb->dimentions[j * cb->ndimentions]);\n\n if (a > rc->maxes[i][0])\n\n rc->maxes[i][0] = a;\n\n a = fabs(cb->dimentions[j * cb->ndimentions + 1]);\n\n if (a > rc->maxes[i][1])\n\n rc->maxes[i][1] = a;\n\n }\n\n }\n\n // small bias\n\n for (i = 0; i < rc->classifications; i++) {\n\n rc->maxes[i][0] += 0.8;\n\n rc->maxes[i][1] += 0.8;\n\n }\n\n}\n"}} {"sample_id": "9ac228e02cf16202547e7025ef300369e0db7781_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static int qcow_check(BlockDriverState *bs)\n+\n {\n \n return qcow2_check_refcounts(bs);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int qcow_check(BlockDriverState *bs)\n\n{\n\n return qcow2_check_refcounts(bs);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_247", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n icp_pit_state *s = (icp_pit_state *)opaque;\n \n int n;\n+\n+\n+\n+ n = offset >> 8;\n+\n if (n > 2) {\n \n hw_error(\"%s: Bad timer %d\\n\", __func__, n);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void icp_pit_write(void *opaque, target_phys_addr_t offset,\n\n uint64_t value, unsigned size)\n\n{\n\n icp_pit_state *s = (icp_pit_state *)opaque;\n\n int n;\n\n\n\n n = offset >> 8;\n\n if (n > 2) {\n\n hw_error(\"%s: Bad timer %d\\n\", __func__, n);\n\n }\n\n\n\n arm_timer_write(s->timer[n], offset & 0xff, value);\n\n}\n"}} {"sample_id": "7372c2b926200db295412efbb53f93773b7f1754_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,13 +6,13 @@\n \n int index = IS_USER(s);\n \n+ s->is_mem = 1;\n \n tmp = tcg_temp_new_i32();\n \n switch(opsize) {\n \n+ case OS_BYTE:\n \n if (sign)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static inline TCGv gen_load(DisasContext * s, int opsize, TCGv addr, int sign)\n\n{\n\n TCGv tmp;\n\n int index = IS_USER(s);\n\n s->is_mem = 1;\n\n tmp = tcg_temp_new_i32();\n\n switch(opsize) {\n\n case OS_BYTE:\n\n if (sign)\n\n tcg_gen_qemu_ld8s(tmp, addr, index);\n\n else\n\n tcg_gen_qemu_ld8u(tmp, addr, index);\n\n break;\n\n case OS_WORD:\n\n if (sign)\n\n tcg_gen_qemu_ld16s(tmp, addr, index);\n\n else\n\n tcg_gen_qemu_ld16u(tmp, addr, index);\n\n break;\n\n case OS_LONG:\n\n case OS_SINGLE:\n\n tcg_gen_qemu_ld32u(tmp, addr, index);\n\n break;\n\n default:\n\n qemu_assert(0, \"bad load size\");\n\n }\n\n gen_throws_exception = gen_last_qop;\n\n return tmp;\n\n}\n"}} {"sample_id": "b5da07d4340a8e8e40dcd1900977a76ff31fbb84_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void ff_put_h264_qpel8_mc10_msa(uint8_t *dst, const uint8_t *src,\n \n+ ptrdiff_t stride)\n+\n {\n \n avc_luma_hz_qrt_8w_msa(src - 2, stride, dst, stride, 8, 0);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_put_h264_qpel8_mc10_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n avc_luma_hz_qrt_8w_msa(src - 2, stride, dst, stride, 8, 0);\n\n}\n"}} {"sample_id": "258dfff8394d383beaa639d19912b3f068f67e16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void format_line(void *ptr, int level, const char *fmt, va_list vl,\n \n char part[3][512], int part_size, int *print_prefix, int type[2])\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void format_line(void *ptr, int level, const char *fmt, va_list vl,\n\n char part[3][512], int part_size, int *print_prefix, int type[2])\n\n{\n\n AVClass* avc = ptr ? *(AVClass **) ptr : NULL;\n\n part[0][0] = part[1][0] = part[2][0] = 0;\n\n if(type) type[0] = type[1] = AV_CLASS_CATEGORY_NA + 16;\n\n if (*print_prefix && avc) {\n\n if (avc->parent_log_context_offset) {\n\n AVClass** parent = *(AVClass ***) (((uint8_t *) ptr) +\n\n avc->parent_log_context_offset);\n\n if (parent && *parent) {\n\n snprintf(part[0], part_size, \"[%s @ %p] \",\n\n (*parent)->item_name(parent), parent);\n\n if(type) type[0] = get_category(((uint8_t *) ptr) + avc->parent_log_context_offset);\n\n }\n\n }\n\n snprintf(part[1], part_size, \"[%s @ %p] \",\n\n avc->item_name(ptr), ptr);\n\n if(type) type[1] = get_category(ptr);\n\n }\n\n\n\n vsnprintf(part[2], part_size, fmt, vl);\n\n\n\n *print_prefix = strlen(part[2]) && part[2][strlen(part[2]) - 1] == '\\n';\n\n}\n"}} {"sample_id": "a26e1d4c1f7c93d24250dd9c0786241f92fcdea4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,8 +20,8 @@\n \n put_v(bc, nut->written_packet_size); /* forward ptr */\n \n+\n+\n+ return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int put_packetheader(NUTContext *nut, ByteIOContext *bc, int max_size, int calculate_checksum)\n\n{\n\n put_flush_packet(bc);\n\n nut->packet_start[2]= url_ftell(bc) - 8;\n\n nut->written_packet_size = max_size;\n\n \n\n if(calculate_checksum)\n\n init_checksum(bc, update_adler32, 0);\n\n\n\n /* packet header */\n\n put_v(bc, nut->written_packet_size); /* forward ptr */\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "3feef8ad17af7307373b9e88b9d7ecb98eeb99da", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static target_ulong h_put_term_char(CPUState *env, sPAPREnvironment *spapr,\n+\n+ target_ulong opcode, target_ulong *args)\n+\n+{\n+\n target_ulong reg = args[0];\n \n target_ulong len = args[1];", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static target_ulong h_put_term_char(CPUState *env, sPAPREnvironment *spapr,\n\n target_ulong opcode, target_ulong *args)\n\n{\n\n target_ulong reg = args[0];\n\n target_ulong len = args[1];\n\n target_ulong char0_7 = args[2];\n\n target_ulong char8_15 = args[3];\n\n VIOsPAPRDevice *sdev = spapr_vio_find_by_reg(spapr->vio_bus, reg);\n\n uint8_t buf[16];\n\n\n\n if (!sdev) {\n\n return H_PARAMETER;\n\n }\n\n\n\n if (len > 16) {\n\n return H_PARAMETER;\n\n }\n\n\n\n *((uint64_t *)buf) = cpu_to_be64(char0_7);\n\n *((uint64_t *)buf + 1) = cpu_to_be64(char8_15);\n\n\n\n vty_putchars(sdev, buf, len);\n\n\n\n return H_SUCCESS;\n\n}\n"}} {"sample_id": "92f9a4f13ea29de4644bd0b077643e1dff96ab29", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n * memory space enable bit is off\n \n * According to manual (805-1251.pdf).\n+\n+ * the reset value should be zero unless the boot pin is tied high\n+\n+ * (which is true) and thus it should be PCI_COMMAND_MEMORY.\n+\n */\n \n pci_set_word(dev->config + PCI_COMMAND,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int apb_pci_bridge_initfn(PCIDevice *dev)\n\n{\n\n int rc;\n\n\n\n rc = pci_bridge_initfn(dev);\n\n if (rc < 0) {\n\n return rc;\n\n }\n\n\n\n pci_config_set_vendor_id(dev->config, PCI_VENDOR_ID_SUN);\n\n pci_config_set_device_id(dev->config, PCI_DEVICE_ID_SUN_SIMBA);\n\n\n\n /*\n\n * command register:\n\n * According to PCI bridge spec, after reset\n\n * bus master bit is off\n\n * memory space enable bit is off\n\n * According to manual (805-1251.pdf).\n\n * the reset value should be zero unless the boot pin is tied high\n\n * (which is true) and thus it should be PCI_COMMAND_MEMORY.\n\n */\n\n pci_set_word(dev->config + PCI_COMMAND,\n\n PCI_COMMAND_MEMORY);\n\n pci_set_word(dev->config + PCI_STATUS,\n\n PCI_STATUS_FAST_BACK | PCI_STATUS_66MHZ |\n\n PCI_STATUS_DEVSEL_MEDIUM);\n\n pci_set_byte(dev->config + PCI_REVISION_ID, 0x11);\n\n return 0;\n\n}\n"}} {"sample_id": "f78cd0c243b9149c7f604ecf1006d78e344aa6ca_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,7 +14,7 @@\n \n for(i=0;i<4;i++) {\n \n+ BF(0);\n \n BF(1);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void ff_simple_idct248_put(uint8_t *dest, int line_size, DCTELEM *block)\n\n{\n\n int i;\n\n DCTELEM *ptr;\n\n\n\n /* butterfly */\n\n ptr = block;\n\n for(i=0;i<4;i++) {\n\n BF(0);\n\n BF(1);\n\n BF(2);\n\n BF(3);\n\n BF(4);\n\n BF(5);\n\n BF(6);\n\n BF(7);\n\n ptr += 2 * 8;\n\n }\n\n\n\n /* IDCT8 on each line */\n\n for(i=0; i<8; i++) {\n\n idctRowCondDC_8(block + i*8);\n\n }\n\n\n\n /* IDCT4 and store */\n\n for(i=0;i<8;i++) {\n\n idct4col_put(dest + i, 2 * line_size, block + i);\n\n idct4col_put(dest + line_size + i, 2 * line_size, block + 8 + i);\n\n }\n\n}\n"}} {"sample_id": "473147bed01c0c6c82d85fd79d3e1c1d65542663", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n for(i = 0; i < (buf_size * 8 + bps - 1) / bps; i++) {\n \n for (b = 0; b < bps; b++) {\n+\n+ dst[ i*bps + b ] |= get_bits1(&gb) << plane;\n+\n+ }\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void decodeplane32(uint32_t *dst, const uint8_t *const buf, int buf_size, int bps, int plane)\n\n{\n\n GetBitContext gb;\n\n int i, b;\n\n init_get_bits(&gb, buf, buf_size * 8);\n\n for(i = 0; i < (buf_size * 8 + bps - 1) / bps; i++) {\n\n for (b = 0; b < bps; b++) {\n\n dst[ i*bps + b ] |= get_bits1(&gb) << plane;\n\n }\n\n }\n\n}\n"}} {"sample_id": "2da0d70d5eebe42f9fcd27ee554419ebe2a5da06_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n static inline void RENAME(rgb24ToUV)(uint8_t *dstU, uint8_t *dstV, uint8_t *src1, uint8_t *src2, int width)\n+\n+{\n+\n \tint i;\n+\n+ assert(src1==src2);\n+\n+\tfor(i=0; i>(RGB2YUV_SHIFT+1)) + 128;\n\n\t\tdstV[i]= ((RV*r + GV*g + BV*b)>>(RGB2YUV_SHIFT+1)) + 128;\n\n\t}\n\n}\n"}} {"sample_id": "3718d8ab65f68de2acccbe6a315907805f54e3cc_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n int bdrv_in_use(BlockDriverState *bs)\n \n {\n+\n return bs->in_use;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int bdrv_in_use(BlockDriverState *bs)\n\n{\n\n return bs->in_use;\n\n}\n"}} {"sample_id": "20c334a797bf46a4ee59a6e42be6d5e7c3cda585_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static inline int32_t mipsdsp_add_i32(int32_t a, int32_t b, CPUMIPSState *env)\n \n {\n+\n int32_t temp;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static inline int32_t mipsdsp_add_i32(int32_t a, int32_t b, CPUMIPSState *env)\n\n{\n\n int32_t temp;\n\n\n\n temp = a + b;\n\n\n\n if (MIPSDSP_OVERFLOW(a, b, temp, 0x80000000)) {\n\n set_DSPControl_overflow_flag(1, 20, env);\n\n }\n\n\n\n return temp;\n\n}\n"}} {"sample_id": "d036bb215e0ac1d1fd467239f1d3b7d904cac90a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void pci_device_reset(PCIDevice *dev)\n \n+{\n \n int r;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void pci_device_reset(PCIDevice *dev)\n\n{\n\n int r;\n\n\n\n memset(dev->irq_state, 0, sizeof dev->irq_state);\n\n dev->config[PCI_COMMAND] &= ~(PCI_COMMAND_IO | PCI_COMMAND_MEMORY |\n\n PCI_COMMAND_MASTER);\n\n dev->config[PCI_CACHE_LINE_SIZE] = 0x0;\n\n dev->config[PCI_INTERRUPT_LINE] = 0x0;\n\n for (r = 0; r < PCI_NUM_REGIONS; ++r) {\n\n if (!dev->io_regions[r].size) {\n\n continue;\n\n }\n\n pci_set_long(dev->config + pci_bar(dev, r), dev->io_regions[r].type);\n\n }\n\n pci_update_mappings(dev);\n\n}\n"}} {"sample_id": "da78e382dddc499882120590ae0ac834881a96b8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void qemu_opts_print(QemuOpts *opts, const char *separator)\n+\n+{\n+\n+ QemuOpt *opt;\n+\n QemuOptDesc *desc = opts->list->desc;\n \n const char *sep = \"\";", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_opts_print(QemuOpts *opts, const char *separator)\n\n{\n\n QemuOpt *opt;\n\n QemuOptDesc *desc = opts->list->desc;\n\n const char *sep = \"\";\n\n\n\n if (opts->id) {\n\n printf(\"id=%s\", opts->id); /* passed id_wellformed -> no commas */\n\n sep = separator;\n\n }\n\n\n\n if (desc[0].name == NULL) {\n\n QTAILQ_FOREACH(opt, &opts->head, next) {\n\n printf(\"%s%s=\", sep, opt->name);\n\n escaped_print(opt->str);\n\n sep = separator;\n\n }\n\n return;\n\n }\n\n for (; desc && desc->name; desc++) {\n\n const char *value;\n\n QemuOpt *opt = qemu_opt_find(opts, desc->name);\n\n\n\n value = opt ? opt->str : desc->def_value_str;\n\n if (!value) {\n\n continue;\n\n }\n\n if (desc->type == QEMU_OPT_STRING) {\n\n printf(\"%s%s=\", sep, desc->name);\n\n escaped_print(value);\n\n } else if ((desc->type == QEMU_OPT_SIZE ||\n\n desc->type == QEMU_OPT_NUMBER) && opt) {\n\n printf(\"%s%s=%\" PRId64, sep, desc->name, opt->value.uint);\n\n } else {\n\n printf(\"%s%s=%s\", sep, desc->name, value);\n\n }\n\n sep = separator;\n\n }\n\n}\n"}} {"sample_id": "d96391c1ffeb30a0afa695c86579517c69d9a889", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static inline void check_hwrena(CPUMIPSState *env, int reg)\n \n {\n \n+ if ((env->hflags & MIPS_HFLAG_CP0) || (env->CP0_HWREna & (1 << reg))) {\n \n return;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static inline void check_hwrena(CPUMIPSState *env, int reg)\n\n{\n\n if ((env->hflags & MIPS_HFLAG_CP0) || (env->CP0_HWREna & (1 << reg))) {\n\n return;\n\n }\n\n do_raise_exception(env, EXCP_RI, GETPC());\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -44,11 +44,11 @@\n \n \tt_gen_mov_preg_TN(dc, dc->op2, t[0]);\n \n+\tif (dc->op2 == PR_CCS) {\n+\n+\t\tcris_update_cc_op(dc, CC_OP_FLAGS, 4);\n+\n+\t\tdc->flags_uptodate = 1;\n \n \t}\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static unsigned int dec_move_rp(DisasContext *dc)\n\n{\n\n\tTCGv t[2];\n\n\tDIS(fprintf (logfile, \"move $r%u, $p%u\\n\", dc->op1, dc->op2));\n\n\tcris_cc_mask(dc, 0);\n\n\n\n\tt[0] = tcg_temp_new(TCG_TYPE_TL);\n\n\tif (dc->op2 == PR_CCS) {\n\n\t\tcris_evaluate_flags(dc);\n\n\t\tt_gen_mov_TN_reg(t[0], dc->op1);\n\n\t\tif (dc->tb_flags & U_FLAG) {\n\n\t\t\tt[1] = tcg_temp_new(TCG_TYPE_TL);\n\n\t\t\t/* User space is not allowed to touch all flags. */\n\n\t\t\ttcg_gen_andi_tl(t[0], t[0], 0x39f);\n\n\t\t\ttcg_gen_andi_tl(t[1], cpu_PR[PR_CCS], ~0x39f);\n\n\t\t\ttcg_gen_or_tl(t[0], t[1], t[0]);\n\n\t\t\ttcg_temp_free(t[1]);\n\n\t\t}\n\n\t}\n\n\telse\n\n\t\tt_gen_mov_TN_reg(t[0], dc->op1);\n\n\n\n\tt_gen_mov_preg_TN(dc, dc->op2, t[0]);\n\n\tif (dc->op2 == PR_CCS) {\n\n\t\tcris_update_cc_op(dc, CC_OP_FLAGS, 4);\n\n\t\tdc->flags_uptodate = 1;\n\n\t}\n\n\ttcg_temp_free(t[0]);\n\n\treturn 2;\n\n}\n"}} {"sample_id": "7bd427d801e1e3293a634d3c83beadaa90ffb911_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void pxa2xx_rtc_swupdate(PXA2xxRTCState *s)\n+\n+{\n+\n int64_t rt = qemu_get_clock(rt_clock);\n \n if (s->rtsr & (1 << 12))", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pxa2xx_rtc_swupdate(PXA2xxRTCState *s)\n\n{\n\n int64_t rt = qemu_get_clock(rt_clock);\n\n if (s->rtsr & (1 << 12))\n\n s->last_swcr += (rt - s->last_sw) / 10;\n\n s->last_sw = rt;\n\n}\n"}} {"sample_id": "75ebec11afe49539f71cc1c494e3010f91c86adb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -38,11 +38,11 @@\n \n virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_TSO6);\n \n+ virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_ECN);\n+\n+ }\n+\n+\n \n if (!peer_has_vnet_hdr(n) || !peer_has_ufo(n)) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,\n\n Error **errp)\n\n{\n\n VirtIONet *n = VIRTIO_NET(vdev);\n\n NetClientState *nc = qemu_get_queue(n->nic);\n\n\n\n /* Firstly sync all virtio-net possible supported features */\n\n features |= n->host_features;\n\n\n\n virtio_add_feature(&features, VIRTIO_NET_F_MAC);\n\n\n\n if (!peer_has_vnet_hdr(n)) {\n\n virtio_clear_feature(&features, VIRTIO_NET_F_CSUM);\n\n virtio_clear_feature(&features, VIRTIO_NET_F_HOST_TSO4);\n\n virtio_clear_feature(&features, VIRTIO_NET_F_HOST_TSO6);\n\n virtio_clear_feature(&features, VIRTIO_NET_F_HOST_ECN);\n\n\n\n virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_CSUM);\n\n virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_TSO4);\n\n virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_TSO6);\n\n virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_ECN);\n\n }\n\n\n\n if (!peer_has_vnet_hdr(n) || !peer_has_ufo(n)) {\n\n virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_UFO);\n\n virtio_clear_feature(&features, VIRTIO_NET_F_HOST_UFO);\n\n }\n\n\n\n if (!get_vhost_net(nc->peer)) {\n\n return features;\n\n }\n\n return vhost_net_get_features(get_vhost_net(nc->peer), features);\n\n}\n"}} {"sample_id": "a9fc37f6bc3f2ab90585cb16493da9f6dcfbfbcf_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void qobject_input_optional(Visitor *v, const char *name, bool *present)\n \n+{\n \n QObjectInputVisitor *qiv = to_qiv(v);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void qobject_input_optional(Visitor *v, const char *name, bool *present)\n\n{\n\n QObjectInputVisitor *qiv = to_qiv(v);\n\n QObject *qobj = qobject_input_get_object(qiv, name, false, NULL);\n\n\n\n if (!qobj) {\n\n *present = false;\n\n return;\n\n }\n\n\n\n *present = true;\n\n}\n"}} {"sample_id": "a04c2c707de2ce850f79870e84ac9d7ec7aa9143_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n int ff_unlock_avcodec(const AVCodec *codec)\n+\n {\n \n if (codec->caps_internal & FF_CODEC_CAP_INIT_THREADSAFE || !codec->init)\n+\n+ return 0;\n \n+\n \n av_assert0(ff_avcodec_locked);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int ff_unlock_avcodec(const AVCodec *codec)\n\n{\n\n if (codec->caps_internal & FF_CODEC_CAP_INIT_THREADSAFE || !codec->init)\n\n return 0;\n\n\n\n av_assert0(ff_avcodec_locked);\n\n ff_avcodec_locked = 0;\n\n atomic_fetch_add(&entangled_thread_counter, -1);\n\n if (lockmgr_cb) {\n\n if ((*lockmgr_cb)(&codec_mutex, AV_LOCK_RELEASE))\n\n return -1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a3f1afb43a09e4577571c044c48f2ba9e6e4ad06", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+int qcow2_cache_put(BlockDriverState *bs, Qcow2Cache *c, void **table)\n+\n+{\n+\n+ int i = qcow2_cache_get_table_idx(bs, c, *table);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qcow2_cache_put(BlockDriverState *bs, Qcow2Cache *c, void **table)\n\n{\n\n int i = qcow2_cache_get_table_idx(bs, c, *table);\n\n\n\n if (c->entries[i].offset == 0) {\n\n return -ENOENT;\n\n }\n\n\n\n c->entries[i].ref--;\n\n *table = NULL;\n\n\n\n if (c->entries[i].ref == 0) {\n\n c->entries[i].lru_counter = ++c->lru_counter;\n\n }\n\n\n\n assert(c->entries[i].ref >= 0);\n\n return 0;\n\n}\n"}} {"sample_id": "ef1e1e0782e99c9dcf2b35e5310cdd8ca9211374_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n \n \n+ if (size < 2 || size > 0x10000 || (size & (size - 1))) {\n+\n+ DPRINTF(\"ERROR: ring[%d] size (%d) not a power of 2 \"\n+\n+ \"or in range [2, 64K]\\n\", ring->index, size);\n \n return false;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool desc_ring_set_size(DescRing *ring, uint32_t size)\n\n{\n\n int i;\n\n\n\n if (size < 2 || size > 0x10000 || (size & (size - 1))) {\n\n DPRINTF(\"ERROR: ring[%d] size (%d) not a power of 2 \"\n\n \"or in range [2, 64K]\\n\", ring->index, size);\n\n return false;\n\n }\n\n\n\n for (i = 0; i < ring->size; i++) {\n\n if (ring->info[i].buf) {\n\n g_free(ring->info[i].buf);\n\n }\n\n }\n\n\n\n ring->size = size;\n\n ring->head = ring->tail = 0;\n\n\n\n ring->info = g_realloc(ring->info, size * sizeof(DescInfo));\n\n if (!ring->info) {\n\n return false;\n\n }\n\n\n\n memset(ring->info, 0, size * sizeof(DescInfo));\n\n\n\n for (i = 0; i < size; i++) {\n\n ring->info[i].ring = ring;\n\n }\n\n\n\n return true;\n\n}\n"}} {"sample_id": "5ad4a2b75f85dd854a781a6e03b90320cb3441d3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n \n }\n \n+\n+\n+ len -= l;\n+\n+ addr += l;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "bool address_space_access_valid(AddressSpace *as, hwaddr addr, int len, bool is_write)\n\n{\n\n MemoryRegion *mr;\n\n hwaddr l, xlat;\n\n\n\n rcu_read_lock();\n\n while (len > 0) {\n\n l = len;\n\n mr = address_space_translate(as, addr, &xlat, &l, is_write);\n\n if (!memory_access_is_direct(mr, is_write)) {\n\n l = memory_access_size(mr, l, addr);\n\n if (!memory_region_access_valid(mr, xlat, l, is_write)) {\n\n\n return false;\n\n }\n\n }\n\n\n\n len -= l;\n\n addr += l;\n\n }\n\n\n return true;\n\n}"}} {"sample_id": "bc7c08a2c375acb7ae4d433054415588b176d34c_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n \n \n err = qemu_strtoull(str, &endptr, 0, &res);\n+\n+\n+\n+ g_assert_cmpint(err, ==, 0);\n+\n g_assert_cmpint(res, ==, -321);\n \n g_assert(endptr == str + strlen(str));", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_qemu_strtoull_negative(void)\n\n{\n\n const char *str = \" \\t -321\";\n\n char f = 'X';\n\n const char *endptr = &f;\n\n uint64_t res = 999;\n\n int err;\n\n\n\n err = qemu_strtoull(str, &endptr, 0, &res);\n\n\n\n g_assert_cmpint(err, ==, 0);\n\n g_assert_cmpint(res, ==, -321);\n\n g_assert(endptr == str + strlen(str));\n\n}\n"}} {"sample_id": "f467fc02b475cd45b68aa5fb5f7c78286110ba86", "diff": "--- a/source.c\n+++ b/source.c\n@@ -47,11 +47,11 @@\n tests[test].func(&h, buf0, buf1, codec, chroma_format, bit_depth);\n \n }\n+\n+ }\n+\n+ report(\"%s\", tests[test].name);\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void checkasm_check_h264pred(void)\n\n{\n\n static const struct {\n\n void (*func)(H264PredContext*, uint8_t*, uint8_t*, int, int, int);\n\n const char *name;\n\n } tests[] = {\n\n { check_pred4x4, \"pred4x4\" },\n\n { check_pred8x8, \"pred8x8\" },\n\n { check_pred16x16, \"pred16x16\" },\n\n { check_pred8x8l, \"pred8x8l\" },\n\n };\n\n\n\n DECLARE_ALIGNED(16, uint8_t, buf0)[BUF_SIZE];\n\n DECLARE_ALIGNED(16, uint8_t, buf1)[BUF_SIZE];\n\n H264PredContext h;\n\n int test, codec, chroma_format, bit_depth;\n\n\n\n for (test = 0; test < FF_ARRAY_ELEMS(tests); test++) {\n\n for (codec = 0; codec < 4; codec++) {\n\n int codec_id = codec_ids[codec];\n\n for (bit_depth = 8; bit_depth <= (codec_id == AV_CODEC_ID_H264 ? 10 : 8); bit_depth++)\n\n for (chroma_format = 1; chroma_format <= (codec_id == AV_CODEC_ID_H264 ? 2 : 1); chroma_format++) {\n\n ff_h264_pred_init(&h, codec_id, bit_depth, chroma_format);\n\n tests[test].func(&h, buf0, buf1, codec, chroma_format, bit_depth);\n\n }\n\n }\n\n report(\"%s\", tests[test].name);\n\n }\n\n}\n"}} {"sample_id": "387783749faca39c98571d139c32866923ab5653", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n state->range = ((state->maxval + state->twonear - 1) / state->twonear) + 1;\n \n+\n+\n+ // QBPP = ceil(log2(RANGE))\n+\n+ for(state->qbpp = 0; (1 << state->qbpp) < state->range; state->qbpp++);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_jpegls_init_state(JLSState *state){\n\n int i;\n\n\n\n state->twonear = state->near * 2 + 1;\n\n state->range = ((state->maxval + state->twonear - 1) / state->twonear) + 1;\n\n\n\n // QBPP = ceil(log2(RANGE))\n\n for(state->qbpp = 0; (1 << state->qbpp) < state->range; state->qbpp++);\n\n\n\n if(state->bpp < 8)\n\n state->limit = 16 + 2 * state->bpp - state->qbpp;\n\n else\n\n state->limit = (4 * state->bpp) - state->qbpp;\n\n\n\n for(i = 0; i < 367; i++) {\n\n state->A[i] = FFMAX((state->range + 32) >> 6, 2);\n\n state->N[i] = 1;\n\n }\n\n\n\n}\n"}} {"sample_id": "7372c2b926200db295412efbb53f93773b7f1754", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,14 +4,14 @@\n \n TCGv tmp;\n \n+\n \n switch (opsize) {\n \n case OS_BYTE:\n \n tmp = tcg_temp_new();\n+\n if (sign)\n \n tcg_gen_ext8s_i32(tmp, val);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static inline TCGv gen_extend(TCGv val, int opsize, int sign)\n\n{\n\n TCGv tmp;\n\n\n\n switch (opsize) {\n\n case OS_BYTE:\n\n tmp = tcg_temp_new();\n\n if (sign)\n\n tcg_gen_ext8s_i32(tmp, val);\n\n else\n\n tcg_gen_ext8u_i32(tmp, val);\n\n break;\n\n case OS_WORD:\n\n tmp = tcg_temp_new();\n\n if (sign)\n\n tcg_gen_ext16s_i32(tmp, val);\n\n else\n\n tcg_gen_ext16u_i32(tmp, val);\n\n break;\n\n case OS_LONG:\n\n case OS_SINGLE:\n\n tmp = val;\n\n break;\n\n default:\n\n qemu_assert(0, \"Bad operand size\");\n\n }\n\n return tmp;\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n trace_run_poll_handlers_begin(ctx, max_ns);\n \n+\n+\n+ end_time = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) + max_ns;\n+\n+\n \n do {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool run_poll_handlers(AioContext *ctx, int64_t max_ns)\n\n{\n\n bool progress;\n\n int64_t end_time;\n\n\n\n assert(ctx->notify_me);\n\n assert(qemu_lockcnt_count(&ctx->list_lock) > 0);\n\n assert(ctx->poll_disable_cnt == 0);\n\n\n\n trace_run_poll_handlers_begin(ctx, max_ns);\n\n\n\n end_time = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) + max_ns;\n\n\n\n do {\n\n progress = run_poll_handlers_once(ctx);\n\n } while (!progress && qemu_clock_get_ns(QEMU_CLOCK_REALTIME) < end_time);\n\n\n\n trace_run_poll_handlers_end(ctx, progress);\n\n\n\n return progress;\n\n}\n"}} {"sample_id": "eabbc64728c2fdb74f565aededec2ab023d20699_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n int ret;\n \n \n+\n+ if ((ret = avio_open_dyn_buf(dyn_cp)) < 0)\n+\n+ return ret;\n+\n \n \n if (pb->seekable)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int start_ebml_master_crc32(AVIOContext *pb, AVIOContext **dyn_cp, ebml_master *master,\n\n unsigned int elementid, uint64_t expectedsize)\n\n{\n\n int ret;\n\n\n\n if ((ret = avio_open_dyn_buf(dyn_cp)) < 0)\n\n return ret;\n\n\n\n if (pb->seekable)\n\n *master = start_ebml_master(pb, elementid, expectedsize);\n\n else\n\n *master = start_ebml_master(*dyn_cp, elementid, expectedsize);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "523a59f596a3e62f5a28eb171adba35e71310040", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void pci_bridge_region_cleanup(PCIBridge *br)\n \n+{\n+\n+ PCIBus *parent = br->dev.bus;\n \n pci_bridge_cleanup_alias(&br->alias_io,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void pci_bridge_region_cleanup(PCIBridge *br)\n\n{\n\n PCIBus *parent = br->dev.bus;\n\n pci_bridge_cleanup_alias(&br->alias_io,\n\n parent->address_space_io);\n\n pci_bridge_cleanup_alias(&br->alias_mem,\n\n parent->address_space_mem);\n\n pci_bridge_cleanup_alias(&br->alias_pref_mem,\n\n parent->address_space_mem);\n\n}\n"}} {"sample_id": "f53a829bb9ef14be800556cbc02d8b20fc1050a7_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,5 +7,5 @@\n \n \n qemu_coroutine_enter(s->send_coroutine, NULL);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void nbd_restart_write(void *opaque)\n\n{\n\n NbdClientSession *s = opaque;\n\n\n\n qemu_coroutine_enter(s->send_coroutine, NULL);\n\n}\n"}} {"sample_id": "d861b05ea30e6ac177de9b679da96194ebe21afc_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+VLANClientState *qemu_new_vlan_client(VLANState *vlan,\n \n IOReadHandler *fd_read, void *opaque)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "VLANClientState *qemu_new_vlan_client(VLANState *vlan,\n\n IOReadHandler *fd_read, void *opaque)\n\n{\n\n VLANClientState *vc, **pvc;\n\n vc = qemu_mallocz(sizeof(VLANClientState));\n\n if (!vc)\n\n return NULL;\n\n vc->fd_read = fd_read;\n\n vc->opaque = opaque;\n\n vc->vlan = vlan;\n\n\n\n vc->next = NULL;\n\n pvc = &vlan->first_client;\n\n while (*pvc != NULL)\n\n pvc = &(*pvc)->next;\n\n *pvc = vc;\n\n return vc;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_217", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n uint32_t value)\n \n {\n+\n+ GICState *s = (GICState *)opaque;\n+\n+ if (offset == 0xf00) {\n+\n int cpu;\n \n int irq;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gic_dist_writel(void *opaque, target_phys_addr_t offset,\n\n uint32_t value)\n\n{\n\n GICState *s = (GICState *)opaque;\n\n if (offset == 0xf00) {\n\n int cpu;\n\n int irq;\n\n int mask;\n\n\n\n cpu = gic_get_current_cpu(s);\n\n irq = value & 0x3ff;\n\n switch ((value >> 24) & 3) {\n\n case 0:\n\n mask = (value >> 16) & ALL_CPU_MASK;\n\n break;\n\n case 1:\n\n mask = ALL_CPU_MASK ^ (1 << cpu);\n\n break;\n\n case 2:\n\n mask = 1 << cpu;\n\n break;\n\n default:\n\n DPRINTF(\"Bad Soft Int target filter\\n\");\n\n mask = ALL_CPU_MASK;\n\n break;\n\n }\n\n GIC_SET_PENDING(irq, mask);\n\n gic_update(s);\n\n return;\n\n }\n\n gic_dist_writew(opaque, offset, value & 0xffff);\n\n gic_dist_writew(opaque, offset + 2, value >> 16);\n\n}\n"}} {"sample_id": "ad7f375df681503baa6ebef065818868e1216976", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void qmp_deserialize(void **native_out, void *datap,\n \n+ VisitorFunc visit, Error **errp)\n+\n {\n \n QmpSerializeData *d = datap;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void qmp_deserialize(void **native_out, void *datap,\n\n VisitorFunc visit, Error **errp)\n\n{\n\n QmpSerializeData *d = datap;\n\n QString *output_json = qobject_to_json(qmp_output_get_qobject(d->qov));\n\n QObject *obj = qobject_from_json(qstring_get_str(output_json));\n\n\n\n QDECREF(output_json);\n\n d->qiv = qmp_input_visitor_new(obj);\n\n qobject_decref(obj);\n\n visit(qmp_input_get_visitor(d->qiv), native_out, errp);\n\n}\n"}} {"sample_id": "fc22118d9bb56ec71655b936a29513c140e6c289_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n * Don't allow fetch of user.virtfs namesapce\n \n+ * in case of mapped security\n+\n+ */\n+\n+ errno = EACCES;\n \n return -1;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int local_lremovexattr(FsContext *ctx,\n\n const char *path, const char *name)\n\n{\n\n if ((ctx->fs_sm == SM_MAPPED) &&\n\n (strncmp(name, \"user.virtfs.\", 12) == 0)) {\n\n /*\n\n * Don't allow fetch of user.virtfs namesapce\n\n * in case of mapped security\n\n */\n\n errno = EACCES;\n\n return -1;\n\n }\n\n return lremovexattr(rpath(ctx, path), name);\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_52", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+PPC_OP(check_reservation)\n \n+{\n \n if ((uint32_t)env->reserve == (uint32_t)(T0 & ~0x00000003))\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "PPC_OP(check_reservation)\n\n{\n\n if ((uint32_t)env->reserve == (uint32_t)(T0 & ~0x00000003))\n\n env->reserve = -1;\n\n RETURN();\n\n}\n"}} {"sample_id": "ba5e6bfa1aee29a8f72c5538c565dfb9889cf273", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void vfio_unmap_bar(VFIOPCIDevice *vdev, int nr)\n+\n+{\n+\n+ VFIOBAR *bar = &vdev->bars[nr];\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vfio_unmap_bar(VFIOPCIDevice *vdev, int nr)\n\n{\n\n VFIOBAR *bar = &vdev->bars[nr];\n\n\n\n if (!bar->region.size) {\n\n return;\n\n }\n\n\n\n vfio_bar_quirk_teardown(vdev, nr);\n\n\n\n memory_region_del_subregion(&bar->region.mem, &bar->region.mmap_mem);\n\n munmap(bar->region.mmap, memory_region_size(&bar->region.mmap_mem));\n\n\n\n if (vdev->msix && vdev->msix->table_bar == nr) {\n\n memory_region_del_subregion(&bar->region.mem, &vdev->msix->mmap_mem);\n\n munmap(vdev->msix->mmap, memory_region_size(&vdev->msix->mmap_mem));\n\n }\n\n}\n"}} {"sample_id": "922453bca6a927bb527068ae8679d587cfa45dbc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n vm_state_notify(0, state);\n \n qemu_aio_flush();\n+\n+ bdrv_flush_all();\n+\n+ monitor_protocol_event(QEVENT_STOP, NULL);\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void do_vm_stop(RunState state)\n\n{\n\n if (runstate_is_running()) {\n\n cpu_disable_ticks();\n\n pause_all_vcpus();\n\n runstate_set(state);\n\n vm_state_notify(0, state);\n\n qemu_aio_flush();\n\n bdrv_flush_all();\n\n monitor_protocol_event(QEVENT_STOP, NULL);\n\n }\n\n}\n"}} {"sample_id": "1687a089f103f9b7a1b4a1555068054cb46ee9e9_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n pki_applet->cert_buffer = NULL;\n \n+ if (pki_applet->sign_buffer) {\n+\n+ g_free(pki_applet->sign_buffer);\n+\n+ pki_applet->sign_buffer = NULL;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "cac_applet_pki_reset(VCard *card, int channel)\n\n{\n\n VCardAppletPrivate *applet_private = NULL;\n\n CACPKIAppletData *pki_applet = NULL;\n\n applet_private = vcard_get_current_applet_private(card, channel);\n\n assert(applet_private);\n\n pki_applet = &(applet_private->u.pki_data);\n\n\n\n pki_applet->cert_buffer = NULL;\n\n if (pki_applet->sign_buffer) {\n\n g_free(pki_applet->sign_buffer);\n\n pki_applet->sign_buffer = NULL;\n\n }\n\n pki_applet->cert_buffer_len = 0;\n\n pki_applet->sign_buffer_len = 0;\n\n return VCARD_DONE;\n\n}\n"}} {"sample_id": "c0b91348fe4aec7d2245d95ccabb460a6971e361", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int caca_write_trailer(AVFormatContext *s)\n \n {\n+\n+ CACAContext *c = s->priv_data;\n+\n \n \n av_freep(&c->window_title);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int caca_write_trailer(AVFormatContext *s)\n\n{\n\n CACAContext *c = s->priv_data;\n\n\n\n av_freep(&c->window_title);\n\n\n\n caca_free_dither(c->dither);\n\n caca_free_display(c->display);\n\n caca_free_canvas(c->canvas);\n\n return 0;\n\n}\n"}} {"sample_id": "c508277335e3b6b20cf18e6ea3a35c1fa835c64a_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static inline void vmxnet3_ring_write_curr_cell(Vmxnet3Ring *ring, void *buff)\n+\n {\n \n vmw_shmem_write(vmxnet3_ring_curr_cell_pa(ring), buff, ring->cell_size);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void vmxnet3_ring_write_curr_cell(Vmxnet3Ring *ring, void *buff)\n\n{\n\n vmw_shmem_write(vmxnet3_ring_curr_cell_pa(ring), buff, ring->cell_size);\n\n}\n"}} {"sample_id": "00af685fc974e4941ef2d309a2e8818d311a370c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n if (loglevel & CPU_LOG_INT) {\n \n fprintf(logfile, \"%s: %p n_IRQ %d level %d => pending %08x req %08x\\n\",\n+\n+ __func__, env, n_IRQ, level,\n+\n+ env->pending_interrupts, env->interrupt_request);\n+\n }\n \n #endif", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ppc_set_irq (CPUState *env, int n_IRQ, int level)\n\n{\n\n if (level) {\n\n env->pending_interrupts |= 1 << n_IRQ;\n\n cpu_interrupt(env, CPU_INTERRUPT_HARD);\n\n } else {\n\n env->pending_interrupts &= ~(1 << n_IRQ);\n\n if (env->pending_interrupts == 0)\n\n cpu_reset_interrupt(env, CPU_INTERRUPT_HARD);\n\n }\n\n#if defined(PPC_DEBUG_IRQ)\n\n if (loglevel & CPU_LOG_INT) {\n\n fprintf(logfile, \"%s: %p n_IRQ %d level %d => pending %08x req %08x\\n\",\n\n __func__, env, n_IRQ, level,\n\n env->pending_interrupts, env->interrupt_request);\n\n }\n\n#endif\n\n}\n"}} {"sample_id": "2cdfcf272d1a38e22879aecae83e95be51369b2d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -44,11 +44,11 @@\n \n QTAILQ_INIT(&mr->subregions);\n \n+ memset(&mr->subregions_link, 0, sizeof mr->subregions_link);\n+\n+ QTAILQ_INIT(&mr->coalesced);\n+\n+ mr->name = g_strdup(name);\n \n mr->dirty_log_mask = 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void memory_region_init(MemoryRegion *mr,\n\n const char *name,\n\n uint64_t size)\n\n{\n\n mr->ops = NULL;\n\n mr->parent = NULL;\n\n mr->size = int128_make64(size);\n\n if (size == UINT64_MAX) {\n\n mr->size = int128_2_64();\n\n }\n\n mr->addr = 0;\n\n mr->subpage = false;\n\n mr->enabled = true;\n\n mr->terminates = false;\n\n mr->ram = false;\n\n mr->romd_mode = true;\n\n mr->readonly = false;\n\n mr->rom_device = false;\n\n mr->destructor = memory_region_destructor_none;\n\n mr->priority = 0;\n\n mr->may_overlap = false;\n\n mr->alias = NULL;\n\n QTAILQ_INIT(&mr->subregions);\n\n memset(&mr->subregions_link, 0, sizeof mr->subregions_link);\n\n QTAILQ_INIT(&mr->coalesced);\n\n mr->name = g_strdup(name);\n\n mr->dirty_log_mask = 0;\n\n mr->ioeventfd_nb = 0;\n\n mr->ioeventfds = NULL;\n\n mr->flush_coalesced_mmio = false;\n\n}\n"}} {"sample_id": "149f54b53b7666a3facd45e86eece60ce7d3b114", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,10 +10,10 @@\n \n phys_addr >> TARGET_PAGE_BITS);\n \n+\n+\n+ return !(memory_region_is_ram(section->mr) ||\n+\n memory_region_is_romd(section->mr));\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool cpu_physical_memory_is_io(hwaddr phys_addr)\n\n{\n\n MemoryRegionSection *section;\n\n\n\n section = phys_page_find(address_space_memory.dispatch,\n\n phys_addr >> TARGET_PAGE_BITS);\n\n\n\n return !(memory_region_is_ram(section->mr) ||\n\n memory_region_is_romd(section->mr));\n\n}\n"}} {"sample_id": "5667c493c430256c99002b719383f0e911cb53a8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n double d;\n \n+ char *ptr;\n+\n+ FdMigrationState *s;\n+\n+ const char *value = qdict_get_str(qdict, \"value\");\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void do_migrate_set_speed(Monitor *mon, const QDict *qdict)\n\n{\n\n double d;\n\n char *ptr;\n\n FdMigrationState *s;\n\n const char *value = qdict_get_str(qdict, \"value\");\n\n\n\n d = strtod(value, &ptr);\n\n switch (*ptr) {\n\n case 'G': case 'g':\n\n d *= 1024;\n\n case 'M': case 'm':\n\n d *= 1024;\n\n case 'K': case 'k':\n\n d *= 1024;\n\n default:\n\n break;\n\n }\n\n\n\n max_throttle = (uint32_t)d;\n\n\n\n s = migrate_to_fms(current_migration);\n\n if (s && s->file) {\n\n qemu_file_set_rate_limit(s->file, max_throttle);\n\n }\n\n}\n"}} {"sample_id": "9b2fadda3e0196ffd485adde4fe9cdd6fae35300_38", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void gen_icread(DisasContext *ctx)\n+\n+{\n+\n #if defined(CONFIG_USER_ONLY)\n \n+ gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n \n #else\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_icread(DisasContext *ctx)\n\n{\n\n#if defined(CONFIG_USER_ONLY)\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n#else\n\n if (unlikely(ctx->pr)) {\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n return;\n\n }\n\n /* interpreted as no-op */\n\n#endif\n\n}\n"}} {"sample_id": "9561fda8d90e176bef598ba87c42a1bd6ad03ef7_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ VirtIORNGCcw *dev = VIRTIO_RNG_CCW(obj);\n \n object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_RNG);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void virtio_ccw_rng_instance_init(Object *obj)\n\n{\n\n VirtIORNGCcw *dev = VIRTIO_RNG_CCW(obj);\n\n object_initialize(&dev->vdev, sizeof(dev->vdev), TYPE_VIRTIO_RNG);\n\n object_property_add_child(obj, \"virtio-backend\", OBJECT(&dev->vdev), NULL);\n\n object_property_add_link(obj, \"rng\", TYPE_RNG_BACKEND,\n\n (Object **)&dev->vdev.conf.rng, NULL);\n\n}\n"}} {"sample_id": "b77e7c8e99f9ac726c4eaa2fc3461fd886017dc0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,9 +21,9 @@\n qemu_opt_set_number(opts, \"to\", addr->to, &error_abort);\n \n }\n+\n+ qemu_opt_set(opts, \"host\", addr->host, &error_abort);\n+\n+ qemu_opt_set(opts, \"port\", addr->port, &error_abort);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void inet_addr_to_opts(QemuOpts *opts, const InetSocketAddress *addr)\n\n{\n\n bool ipv4 = addr->ipv4 || !addr->has_ipv4;\n\n bool ipv6 = addr->ipv6 || !addr->has_ipv6;\n\n\n\n if (!ipv4 || !ipv6) {\n\n qemu_opt_set_bool(opts, \"ipv4\", ipv4, &error_abort);\n\n qemu_opt_set_bool(opts, \"ipv6\", ipv6, &error_abort);\n\n }\n\n if (addr->has_to) {\n\n qemu_opt_set_number(opts, \"to\", addr->to, &error_abort);\n\n }\n\n qemu_opt_set(opts, \"host\", addr->host, &error_abort);\n\n qemu_opt_set(opts, \"port\", addr->port, &error_abort);\n\n}\n"}} {"sample_id": "3d948cdf3760b52238038626a7ffa7d30913060b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n error_set(errp, QERR_BLOCK_JOB_NOT_ACTIVE, device);\n \n return;\n+\n+ }\n+\n+\n+\n trace_qmp_block_job_pause(job);\n \n block_job_pause(job);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qmp_block_job_pause(const char *device, Error **errp)\n\n{\n\n BlockJob *job = find_block_job(device);\n\n\n\n if (!job) {\n\n error_set(errp, QERR_BLOCK_JOB_NOT_ACTIVE, device);\n\n return;\n\n }\n\n\n\n trace_qmp_block_job_pause(job);\n\n block_job_pause(job);\n\n}\n"}} {"sample_id": "171c407621b7ff52a0cf128b31651ca927c2dd49", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,7 +14,7 @@\n \n if(cur->pict_type != B_TYPE)\n \n+ cur->ref_count[1] = 0;\n \n for(list=0; list<2; list++){\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void direct_ref_list_init(H264Context * const h){\n\n MpegEncContext * const s = &h->s;\n\n Picture * const ref1 = &h->ref_list[1][0];\n\n Picture * const cur = s->current_picture_ptr;\n\n int list, i, j;\n\n if(cur->pict_type == I_TYPE)\n\n cur->ref_count[0] = 0;\n\n if(cur->pict_type != B_TYPE)\n\n cur->ref_count[1] = 0;\n\n for(list=0; list<2; list++){\n\n cur->ref_count[list] = h->ref_count[list];\n\n for(j=0; jref_count[list]; j++)\n\n cur->ref_poc[list][j] = h->ref_list[list][j].poc;\n\n }\n\n if(cur->pict_type != B_TYPE || h->direct_spatial_mv_pred)\n\n return;\n\n for(list=0; list<2; list++){\n\n for(i=0; iref_count[list]; i++){\n\n const int poc = ref1->ref_poc[list][i];\n\n h->map_col_to_list0[list][i] = PART_NOT_AVAILABLE;\n\n for(j=0; jref_count[list]; j++)\n\n if(h->ref_list[list][j].poc == poc){\n\n h->map_col_to_list0[list][i] = j;\n\n break;\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "d5b68844e6f7c13d30b46cc92ba468e5f92119a6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n BlockBackend *blk;\n \n+ Error *local_err = NULL;\n+\n+\n+\n+ for (blk = blk_next(NULL); blk; blk = blk_next(blk)) {\n \n BlockInfoList *info = g_malloc0(sizeof(*info));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "BlockInfoList *qmp_query_block(Error **errp)\n\n{\n\n BlockInfoList *head = NULL, **p_next = &head;\n\n BlockBackend *blk;\n\n Error *local_err = NULL;\n\n\n\n for (blk = blk_next(NULL); blk; blk = blk_next(blk)) {\n\n BlockInfoList *info = g_malloc0(sizeof(*info));\n\n bdrv_query_info(blk, &info->value, &local_err);\n\n if (local_err) {\n\n error_propagate(errp, local_err);\n\n g_free(info);\n\n qapi_free_BlockInfoList(head);\n\n return NULL;\n\n }\n\n\n\n *p_next = info;\n\n p_next = &info->next;\n\n }\n\n\n\n return head;\n\n}\n"}} {"sample_id": "6a287b739f3a8660d5e4405be1302da8b3e51e88", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n s->ptr += n;\n s->currentframeblocks = nblocks;\n buf += 4;\n+ if (s->samples <= 0) {\n+ *data_size = 0;\n+ return buf_size;\n+ memset(s->decoded0, 0, sizeof(s->decoded0));\n+ memset(s->decoded1, 0, sizeof(s->decoded1));\n /* Initialize the frame decoder */\n init_frame_decoder(s);\n if (!s->data) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int ape_decode_frame(AVCodecContext * avctx,\n void *data, int *data_size,\n const uint8_t * buf, int buf_size)\n{\n APEContext *s = avctx->priv_data;\n int16_t *samples = data;\n int nblocks;\n int i, n;\n int blockstodecode;\n int bytes_used;\n if (buf_size == 0 && !s->samples) {\n *data_size = 0;\n return 0;\n /* should not happen but who knows */\n if (BLOCKS_PER_LOOP * 2 * avctx->channels > *data_size) {\n av_log (avctx, AV_LOG_ERROR, \"Packet size is too big to be handled in lavc! (max is %d where you have %d)\\n\", *data_size, s->samples * 2 * avctx->channels);\n if(!s->samples){\n s->data = av_realloc(s->data, (buf_size + 3) & ~3);\n s->dsp.bswap_buf((uint32_t*)s->data, (const uint32_t*)buf, buf_size >> 2);\n s->ptr = s->last_ptr = s->data;\n s->data_end = s->data + buf_size;\n nblocks = s->samples = bytestream_get_be32(&s->ptr);\n n = bytestream_get_be32(&s->ptr);\n if(n < 0 || n > 3){\n av_log(avctx, AV_LOG_ERROR, \"Incorrect offset passed\\n\");\n s->data = NULL;\n s->ptr += n;\n s->currentframeblocks = nblocks;\n buf += 4;\n if (s->samples <= 0) {\n *data_size = 0;\n return buf_size;\n memset(s->decoded0, 0, sizeof(s->decoded0));\n memset(s->decoded1, 0, sizeof(s->decoded1));\n /* Initialize the frame decoder */\n init_frame_decoder(s);\n if (!s->data) {\n *data_size = 0;\n return buf_size;\n nblocks = s->samples;\n blockstodecode = FFMIN(BLOCKS_PER_LOOP, nblocks);\n if ((s->channels == 1) || (s->frameflags & APE_FRAMECODE_PSEUDO_STEREO))\n ape_unpack_mono(s, blockstodecode);\n else\n ape_unpack_stereo(s, blockstodecode);\n for (i = 0; i < blockstodecode; i++) {\n *samples++ = s->decoded0[i];\n if(s->channels == 2)\n *samples++ = s->decoded1[i];\n s->samples -= blockstodecode;\n *data_size = blockstodecode * 2 * s->channels;\n bytes_used = s->samples ? s->ptr - s->last_ptr : buf_size;\n s->last_ptr = s->ptr;\n return bytes_used;"}} {"sample_id": "1bc04a8880374407c4b12d82ceb8752e12ff5336", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static bool pmsav7_rgnr_vmstate_validate(void *opaque, int version_id)\n \n+{\n+\n ARMCPU *cpu = opaque;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool pmsav7_rgnr_vmstate_validate(void *opaque, int version_id)\n\n{\n\n ARMCPU *cpu = opaque;\n\n\n\n return cpu->env.pmsav7.rnr < cpu->pmsav7_dregion;\n\n}\n"}} {"sample_id": "19dc71045d2833d2b3b77648608687eb687b4af1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -45,11 +45,11 @@\n }\n \n for(i = 1; i < 4; i ++) {\n+\n+ if(!src[i]) continue;\n+\n+\n+\n for(j = 0; j < h >> vsub; j ++) {\n \n memcpy(dst[i], src[i], link->cur_pic->linesize[i]);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void avfilter_draw_slice(AVFilterLink *link, int y, int h)\n\n{\n\n uint8_t *src[4], *dst[4];\n\n int i, j, hsub, vsub;\n\n\n\n /* copy the slice if needed for permission reasons */\n\n if(link->srcpic) {\n\n avcodec_get_chroma_sub_sample(link->format, &hsub, &vsub);\n\n\n\n src[0] = link->srcpic-> data[0] + y * link->srcpic-> linesize[0];\n\n dst[0] = link->cur_pic->data[0] + y * link->cur_pic->linesize[0];\n\n for(i = 1; i < 4; i ++) {\n\n if(link->srcpic->data[i]) {\n\n src[i] = link->srcpic-> data[i] + (y >> vsub) * link->srcpic-> linesize[i];\n\n dst[i] = link->cur_pic->data[i] + (y >> vsub) * link->cur_pic->linesize[i];\n\n } else\n\n src[i] = dst[i] = NULL;\n\n }\n\n for(j = 0; j < h; j ++) {\n\n memcpy(dst[0], src[0], link->cur_pic->linesize[0]);\n\n src[0] += link->srcpic ->linesize[0];\n\n dst[0] += link->cur_pic->linesize[0];\n\n }\n\n for(i = 1; i < 4; i ++) {\n\n if(!src[i]) continue;\n\n\n\n for(j = 0; j < h >> vsub; j ++) {\n\n memcpy(dst[i], src[i], link->cur_pic->linesize[i]);\n\n src[i] += link->srcpic ->linesize[i];\n\n dst[i] += link->cur_pic->linesize[i];\n\n }\n\n }\n\n }\n\n\n\n if(!link_dpad(link).draw_slice)\n\n return;\n\n\n\n link_dpad(link).draw_slice(link, y, h);\n\n}\n"}} {"sample_id": "7cd1e32a860895ccca89eb90a0226efbcd969b55", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,9 +17,9 @@\n if (bdrv_check_request(bs, sector_num, nb_sectors))\n \n return -EIO;\n+\n+\n+\n+ return drv->bdrv_write(bs, sector_num, buf, nb_sectors);\n+\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int bdrv_write(BlockDriverState *bs, int64_t sector_num,\n\n const uint8_t *buf, int nb_sectors)\n\n{\n\n BlockDriver *drv = bs->drv;\n\n if (!bs->drv)\n\n return -ENOMEDIUM;\n\n if (bs->read_only)\n\n return -EACCES;\n\n if (bdrv_check_request(bs, sector_num, nb_sectors))\n\n return -EIO;\n\n\n\n return drv->bdrv_write(bs, sector_num, buf, nb_sectors);\n\n}\n"}} {"sample_id": "b9dbaa409f51545a840929665fa0303b46e7e8a5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n XbinContext *s = avctx->priv_data;\n+\n if (s->y > avctx->height - s->font_height)\n \n return;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void draw_char(AVCodecContext *avctx, int c, int a)\n\n{\n\n XbinContext *s = avctx->priv_data;\n\n if (s->y > avctx->height - s->font_height)\n\n return;\n\n ff_draw_pc_font(s->frame.data[0] + s->y * s->frame.linesize[0] + s->x,\n\n s->frame.linesize[0], s->font, s->font_height, c,\n\n a & 0x0F, a >> 4);\n\n s->x += FONT_WIDTH;\n\n if (s->x >= avctx->width) {\n\n s->x = 0;\n\n s->y += s->font_height;\n\n }\n\n}\n"}} {"sample_id": "ddf21908961073199f3d186204da4810f2ea150b_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -51,9 +51,9 @@\n break;\n \n }\n+\n+\n+\n+ qapi_free_VncServerInfo(si);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vnc_qmp_event(VncState *vs, QAPIEvent event)\n\n{\n\n VncServerInfo *si;\n\n\n\n if (!vs->info) {\n\n return;\n\n }\n\n g_assert(vs->info->base);\n\n\n\n si = vnc_server_info_get(vs->vd);\n\n if (!si) {\n\n return;\n\n }\n\n\n\n switch (event) {\n\n case QAPI_EVENT_VNC_CONNECTED:\n\n qapi_event_send_vnc_connected(si, vs->info->base, &error_abort);\n\n break;\n\n case QAPI_EVENT_VNC_INITIALIZED:\n\n qapi_event_send_vnc_initialized(si, vs->info, &error_abort);\n\n break;\n\n case QAPI_EVENT_VNC_DISCONNECTED:\n\n qapi_event_send_vnc_disconnected(si, vs->info, &error_abort);\n\n break;\n\n default:\n\n break;\n\n }\n\n\n\n qapi_free_VncServerInfo(si);\n\n}\n"}} {"sample_id": "a307d59434ba78b97544b42b8cfd24a1b62e39a6_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n if (rc) {\n \n+ return rc;\n+\n+ }\n+\n+ if (byte != 0) {\n \n return 1;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int spapr_vio_send_crq(VIOsPAPRDevice *dev, uint8_t *crq)\n\n{\n\n int rc;\n\n uint8_t byte;\n\n\n\n if (!dev->crq.qsize) {\n\n fprintf(stderr, \"spapr_vio_send_creq on uninitialized queue\\n\");\n\n return -1;\n\n }\n\n\n\n /* Maybe do a fast path for KVM just writing to the pages */\n\n rc = spapr_vio_dma_read(dev, dev->crq.qladdr + dev->crq.qnext, &byte, 1);\n\n if (rc) {\n\n return rc;\n\n }\n\n if (byte != 0) {\n\n return 1;\n\n }\n\n\n\n rc = spapr_vio_dma_write(dev, dev->crq.qladdr + dev->crq.qnext + 8,\n\n &crq[8], 8);\n\n if (rc) {\n\n return rc;\n\n }\n\n\n\n kvmppc_eieio();\n\n\n\n rc = spapr_vio_dma_write(dev, dev->crq.qladdr + dev->crq.qnext, crq, 8);\n\n if (rc) {\n\n return rc;\n\n }\n\n\n\n dev->crq.qnext = (dev->crq.qnext + 16) % dev->crq.qsize;\n\n\n\n if (dev->signal_state & 1) {\n\n qemu_irq_pulse(dev->qirq);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "185698715dfb18c82ad2a5dbc169908602d43e81_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n uint64_t helper_fctiwz (uint64_t arg)\n \n+{\n+\n+ CPU_DoubleU farg;\n+\n+ farg.ll = arg;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint64_t helper_fctiwz (uint64_t arg)\n\n{\n\n CPU_DoubleU farg;\n\n farg.ll = arg;\n\n\n\n if (unlikely(float64_is_signaling_nan(farg.d))) {\n\n /* sNaN conversion */\n\n farg.ll = fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN | POWERPC_EXCP_FP_VXCVI);\n\n } else if (unlikely(float64_is_nan(farg.d) || float64_is_infinity(farg.d))) {\n\n /* qNan / infinity conversion */\n\n farg.ll = fload_invalid_op_excp(POWERPC_EXCP_FP_VXCVI);\n\n } else {\n\n farg.ll = float64_to_int32_round_to_zero(farg.d, &env->fp_status);\n\n#if USE_PRECISE_EMULATION\n\n /* XXX: higher bits are not supposed to be significant.\n\n * to make tests easier, return the same as a real PowerPC 750\n\n */\n\n farg.ll |= 0xFFF80000ULL << 32;\n\n#endif\n\n }\n\n return farg.ll;\n\n}\n"}} {"sample_id": "7d89f7cbf3ccd98f9a5f58db97effa9afd2d571a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ CryptoContext *c = h->priv_data;\n+\n if (c->hd)\n \n ffurl_close(c->hd);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int crypto_close(URLContext *h)\n\n{\n\n CryptoContext *c = h->priv_data;\n\n if (c->hd)\n\n ffurl_close(c->hd);\n\n av_freep(&c->aes);\n\n av_freep(&c->key);\n\n av_freep(&c->iv);\n\n return 0;\n\n}\n"}} {"sample_id": "8297be80f7cf71e09617669a8bd8b2836dcfd4c3_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,9 +29,9 @@\n \n \n qemu_put_byte(f, S390_TOD_CLOCK_VALUE_PRESENT);\n+\n+ qemu_put_byte(f, tod_high);\n+\n+ qemu_put_be64(f, tod_low);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void gtod_save(QEMUFile *f, void *opaque)\n\n{\n\n uint64_t tod_low;\n\n uint8_t tod_high;\n\n int r;\n\n\n\n r = s390_get_clock(&tod_high, &tod_low);\n\n if (r) {\n\n fprintf(stderr, \"WARNING: Unable to get guest clock for migration. \"\n\n \"Error code %d. Guest clock will not be migrated \"\n\n \"which could cause the guest to hang.\\n\", r);\n\n qemu_put_byte(f, S390_TOD_CLOCK_VALUE_MISSING);\n\n return;\n\n }\n\n\n\n qemu_put_byte(f, S390_TOD_CLOCK_VALUE_PRESENT);\n\n qemu_put_byte(f, tod_high);\n\n qemu_put_be64(f, tod_low);\n\n}\n"}} {"sample_id": "34f2af3d3edf9d57c27811d3780cbc0ece319625", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static XICSState *try_create_xics(const char *type, int nr_servers,\n \n int nr_irqs)\n \n {\n+\n DeviceState *dev;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static XICSState *try_create_xics(const char *type, int nr_servers,\n\n int nr_irqs)\n\n{\n\n DeviceState *dev;\n\n\n\n dev = qdev_create(NULL, type);\n\n qdev_prop_set_uint32(dev, \"nr_servers\", nr_servers);\n\n qdev_prop_set_uint32(dev, \"nr_irqs\", nr_irqs);\n\n if (qdev_init(dev) < 0) {\n\n return NULL;\n\n }\n\n\n\n return XICS_COMMON(dev);\n\n}\n"}} {"sample_id": "591b320ad046b2780c1b2841b836b50ba8192f02", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n unsigned long cur;\n \n+ size_t pos;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint64_t hb_count_between(HBitmap *hb, uint64_t start, uint64_t last)\n\n{\n\n HBitmapIter hbi;\n\n uint64_t count = 0;\n\n uint64_t end = last + 1;\n\n unsigned long cur;\n\n size_t pos;\n\n\n\n hbitmap_iter_init(&hbi, hb, start << hb->granularity);\n\n for (;;) {\n\n pos = hbitmap_iter_next_word(&hbi, &cur);\n\n if (pos >= (end >> BITS_PER_LEVEL)) {\n\n break;\n\n }\n\n count += popcountl(cur);\n\n }\n\n\n\n if (pos == (end >> BITS_PER_LEVEL)) {\n\n /* Drop bits representing the END-th and subsequent items. */\n\n int bit = end & (BITS_PER_LONG - 1);\n\n cur &= (1UL << bit) - 1;\n\n count += popcountl(cur);\n\n }\n\n\n\n return count;\n\n}\n"}} {"sample_id": "f88f79ec9df06d26d84e1d2e0c02d2634b4d8583", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n MIPSCPU *cpu = mips_env_get_cpu(env);\n+\n uint32_t val, old;\n \n+ uint32_t mask = env->CP0_Status_rw_bitmask;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void helper_mtc0_status(CPUMIPSState *env, target_ulong arg1)\n\n{\n\n MIPSCPU *cpu = mips_env_get_cpu(env);\n\n uint32_t val, old;\n\n uint32_t mask = env->CP0_Status_rw_bitmask;\n\n\n\n if (env->insn_flags & ISA_MIPS32R6) {\n\n if (extract32(env->CP0_Status, CP0St_KSU, 2) == 0x3) {\n\n mask &= ~(3 << CP0St_KSU);\n\n }\n\n mask &= ~(0x00180000 & arg1);\n\n }\n\n\n\n val = arg1 & mask;\n\n old = env->CP0_Status;\n\n env->CP0_Status = (env->CP0_Status & ~mask) | val;\n\n if (env->CP0_Config3 & (1 << CP0C3_MT)) {\n\n sync_c0_status(env, env, env->current_tc);\n\n } else {\n\n compute_hflags(env);\n\n }\n\n\n\n if (qemu_loglevel_mask(CPU_LOG_EXEC)) {\n\n qemu_log(\"Status %08x (%08x) => %08x (%08x) Cause %08x\",\n\n old, old & env->CP0_Cause & CP0Ca_IP_mask,\n\n val, val & env->CP0_Cause & CP0Ca_IP_mask,\n\n env->CP0_Cause);\n\n switch (env->hflags & MIPS_HFLAG_KSU) {\n\n case MIPS_HFLAG_UM: qemu_log(\", UM\\n\"); break;\n\n case MIPS_HFLAG_SM: qemu_log(\", SM\\n\"); break;\n\n case MIPS_HFLAG_KM: qemu_log(\"\\n\"); break;\n\n default:\n\n cpu_abort(CPU(cpu), \"Invalid MMU mode!\\n\");\n\n break;\n\n }\n\n }\n\n}\n"}} {"sample_id": "adc370a48fd26b92188fa4848dfb088578b1936c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n switch (df) {\n \n case DF_BYTE:\n+\n+ for (i = 0; i < DF_ELEMENTS(DF_BYTE); i++) {\n+\n+ do_sb(env, addr + (i << DF_BYTE), pwd->b[i],\n+\n env->hflags & MIPS_HFLAG_KSU);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void helper_msa_st_df(CPUMIPSState *env, uint32_t df, uint32_t wd, uint32_t rs,\n\n int32_t s10)\n\n{\n\n wr_t *pwd = &(env->active_fpu.fpr[wd].wr);\n\n target_ulong addr = env->active_tc.gpr[rs] + (s10 << df);\n\n int i;\n\n\n\n switch (df) {\n\n case DF_BYTE:\n\n for (i = 0; i < DF_ELEMENTS(DF_BYTE); i++) {\n\n do_sb(env, addr + (i << DF_BYTE), pwd->b[i],\n\n env->hflags & MIPS_HFLAG_KSU);\n\n }\n\n break;\n\n case DF_HALF:\n\n for (i = 0; i < DF_ELEMENTS(DF_HALF); i++) {\n\n do_sh(env, addr + (i << DF_HALF), pwd->h[i],\n\n env->hflags & MIPS_HFLAG_KSU);\n\n }\n\n break;\n\n case DF_WORD:\n\n for (i = 0; i < DF_ELEMENTS(DF_WORD); i++) {\n\n do_sw(env, addr + (i << DF_WORD), pwd->w[i],\n\n env->hflags & MIPS_HFLAG_KSU);\n\n }\n\n break;\n\n case DF_DOUBLE:\n\n for (i = 0; i < DF_ELEMENTS(DF_DOUBLE); i++) {\n\n do_sd(env, addr + (i << DF_DOUBLE), pwd->d[i],\n\n env->hflags & MIPS_HFLAG_KSU);\n\n }\n\n break;\n\n }\n\n}\n"}} {"sample_id": "7266ae91a111001abda65c79299c9b7e365456b6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,10 +19,10 @@\n insert(150, 200);\n check_n(N - 190 + 50);\n insert(10, 150);\n+ check_n(N);\n+ rm(1, 2);\n+ check_n(N - 1);\n+ qht_reset_size(&ht, 0);\n+ check(0, N, false);\n qht_destroy(&ht);\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void qht_do_test(unsigned int mode, size_t init_entries)\n{\n qht_init(&ht, 0, mode);\n insert(0, N);\n check(0, N, true);\n check_n(N);\n check(-N, -1, false);\n iter_check(N);\n rm(101, 102);\n check_n(N - 1);\n insert(N, N * 2);\n check_n(N + N - 1);\n rm(N, N * 2);\n check_n(N - 1);\n insert(101, 102);\n check_n(N);\n rm(10, 200);\n check_n(N - 190);\n insert(150, 200);\n check_n(N - 190 + 50);\n insert(10, 150);\n check_n(N);\n rm(1, 2);\n check_n(N - 1);\n qht_reset_size(&ht, 0);\n check(0, N, false);\n qht_destroy(&ht);\n}"}} {"sample_id": "7364dbdabb7824d5bde1e341bb6d928282f01c83_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n gpointer user_data)\n \n+{\n \n VncState *vs = user_data;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void vnc_tls_handshake_done(QIOTask *task,\n\n gpointer user_data)\n\n{\n\n VncState *vs = user_data;\n\n Error *err = NULL;\n\n\n\n if (qio_task_propagate_error(task, &err)) {\n\n VNC_DEBUG(\"Handshake failed %s\\n\",\n\n error_get_pretty(err));\n\n vnc_client_error(vs);\n\n error_free(err);\n\n } else {\n\n vs->ioc_tag = qio_channel_add_watch(\n\n vs->ioc, G_IO_IN | G_IO_OUT, vnc_client_io, vs, NULL);\n\n start_auth_vencrypt_subauth(vs);\n\n }\n\n}\n"}} {"sample_id": "5183fac92fc5c574a053dd06b84e735a1ec1cfa6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n int cIdx, i;\n+\n+ uint8_t hash_type;\n+\n+ //uint16_t picture_crc;\n+\n //uint32_t picture_checksum;\n \n GetBitContext *gb = &s->HEVClc->gb;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void decode_nal_sei_decoded_picture_hash(HEVCContext *s)\n\n{\n\n int cIdx, i;\n\n uint8_t hash_type;\n\n //uint16_t picture_crc;\n\n //uint32_t picture_checksum;\n\n GetBitContext *gb = &s->HEVClc->gb;\n\n hash_type = get_bits(gb, 8);\n\n\n\n for (cIdx = 0; cIdx < 3/*((s->sps->chroma_format_idc == 0) ? 1 : 3)*/; cIdx++) {\n\n if (hash_type == 0) {\n\n s->is_md5 = 1;\n\n for (i = 0; i < 16; i++)\n\n s->md5[cIdx][i] = get_bits(gb, 8);\n\n } else if (hash_type == 1) {\n\n // picture_crc = get_bits(gb, 16);\n\n skip_bits(gb, 16);\n\n } else if (hash_type == 2) {\n\n // picture_checksum = get_bits(gb, 32);\n\n skip_bits(gb, 32);\n\n }\n\n }\n\n}\n"}} {"sample_id": "ca390e727d165bf80445035c4b67a7239fdc87c0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n \tint stride= (width+15)&(~15); //assumed / will realloc if needed\n \n+ \n+\n+\tmemset(c, 0, sizeof(PPContext));\n+\n+\tc->cpuCaps= cpuCaps;\n \n \tif(cpuCaps&PP_FORMAT){\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "pp_context_t *pp_get_context(int width, int height, int cpuCaps){\n\n\tPPContext *c= memalign(32, sizeof(PPContext));\n\n\tint i;\n\n\tint stride= (width+15)&(~15); //assumed / will realloc if needed\n\n \n\n\tmemset(c, 0, sizeof(PPContext));\n\n\tc->cpuCaps= cpuCaps;\n\n\tif(cpuCaps&PP_FORMAT){\n\n\t\tc->hChromaSubSample= cpuCaps&0x3;\n\n\t\tc->vChromaSubSample= (cpuCaps>>4)&0x3;\n\n\t}else{\n\n\t\tc->hChromaSubSample= 1;\n\n\t\tc->vChromaSubSample= 1;\n\n\t}\n\n\n\n\treallocBuffers(c, width, height, stride);\n\n \n\n\tc->frameNum=-1;\n\n\n\n\treturn c;\n\n}\n"}} {"sample_id": "b36e391441906c36ed0856b69de84001860402bf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static int virtio_pci_start_ioeventfd(VirtIOPCIProxy *proxy)\n \n {\n+\n int n, r;\n \n \n@@ -14,17 +14,17 @@\n \n return 0;\n \n+ }\n \n \n \n for (n = 0; n < VIRTIO_PCI_QUEUE_MAX; n++) {\n \n+ if (!virtio_queue_get_num(proxy->vdev, n)) {\n \n continue;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int virtio_pci_start_ioeventfd(VirtIOPCIProxy *proxy)\n\n{\n\n int n, r;\n\n\n\n if (!(proxy->flags & VIRTIO_PCI_FLAG_USE_IOEVENTFD) ||\n\n proxy->ioeventfd_disabled ||\n\n proxy->ioeventfd_started) {\n\n return 0;\n\n }\n\n\n\n for (n = 0; n < VIRTIO_PCI_QUEUE_MAX; n++) {\n\n if (!virtio_queue_get_num(proxy->vdev, n)) {\n\n continue;\n\n }\n\n\n\n r = virtio_pci_set_host_notifier_internal(proxy, n, true);\n\n if (r < 0) {\n\n goto assign_error;\n\n }\n\n\n\n virtio_pci_set_host_notifier_fd_handler(proxy, n, true);\n\n }\n\n proxy->ioeventfd_started = true;\n\n return 0;\n\n\n\nassign_error:\n\n while (--n >= 0) {\n\n if (!virtio_queue_get_num(proxy->vdev, n)) {\n\n continue;\n\n }\n\n\n\n virtio_pci_set_host_notifier_fd_handler(proxy, n, false);\n\n virtio_pci_set_host_notifier_internal(proxy, n, false);\n\n }\n\n proxy->ioeventfd_started = false;\n\n proxy->ioeventfd_disabled = true;\n\n return r;\n\n}\n"}} {"sample_id": "d9429b84af2302b6e28bec3c52710cf67eda3cee", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n if ((addr & 0x2000)) {\n \n /* high table */\n+\n+ index = index >= AMDVI_MMIO_REGS_HIGH ? AMDVI_MMIO_REGS_HIGH : index;\n+\n+ trace_amdvi_mmio_read(amdvi_mmio_high[index], addr, size, addr & ~0x07);\n+\n } else {\n \n index = index >= AMDVI_MMIO_REGS_LOW ? AMDVI_MMIO_REGS_LOW : index;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void amdvi_mmio_trace(hwaddr addr, unsigned size)\n\n{\n\n uint8_t index = (addr & ~0x2000) / 8;\n\n\n\n if ((addr & 0x2000)) {\n\n /* high table */\n\n index = index >= AMDVI_MMIO_REGS_HIGH ? AMDVI_MMIO_REGS_HIGH : index;\n\n trace_amdvi_mmio_read(amdvi_mmio_high[index], addr, size, addr & ~0x07);\n\n } else {\n\n index = index >= AMDVI_MMIO_REGS_LOW ? AMDVI_MMIO_REGS_LOW : index;\n\n trace_amdvi_mmio_read(amdvi_mmio_high[index], addr, size, addr & ~0x07);\n\n }\n\n}\n"}} {"sample_id": "87e8788680e16c51f6048af26f3f7830c35207a5_23", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n !memcmp(&p->buf[16 - sizeof(endcode)], endcode, sizeof(endcode)))\n \n return AVPROBE_SCORE_MAX;\n+\n+ return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int gxf_probe(AVProbeData *p) {\n\n static const uint8_t startcode[] = {0, 0, 0, 0, 1, 0xbc}; // start with map packet\n\n static const uint8_t endcode[] = {0, 0, 0, 0, 0xe1, 0xe2};\n\n if (p->buf_size < 16)\n\n return 0;\n\n if (!memcmp(p->buf, startcode, sizeof(startcode)) &&\n\n !memcmp(&p->buf[16 - sizeof(endcode)], endcode, sizeof(endcode)))\n\n return AVPROBE_SCORE_MAX;\n\n return 0;\n\n}\n"}} {"sample_id": "c2e50e3d11a0bf4c973cc30478c1af0f2d5f8e81_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -46,11 +46,11 @@\n \n /* remove the request */\n \n+ QLIST_REMOVE(elem, all);\n+\n+ qemu_aio_release(elem);\n+\n+ }\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void event_notifier_ready(EventNotifier *notifier)\n\n{\n\n ThreadPool *pool = container_of(notifier, ThreadPool, notifier);\n\n ThreadPoolElement *elem, *next;\n\n\n\n event_notifier_test_and_clear(notifier);\n\nrestart:\n\n QLIST_FOREACH_SAFE(elem, &pool->head, all, next) {\n\n if (elem->state != THREAD_CANCELED && elem->state != THREAD_DONE) {\n\n continue;\n\n }\n\n if (elem->state == THREAD_DONE) {\n\n trace_thread_pool_complete(pool, elem, elem->common.opaque,\n\n elem->ret);\n\n }\n\n if (elem->state == THREAD_DONE && elem->common.cb) {\n\n QLIST_REMOVE(elem, all);\n\n /* Read state before ret. */\n\n smp_rmb();\n\n elem->common.cb(elem->common.opaque, elem->ret);\n\n qemu_aio_release(elem);\n\n goto restart;\n\n } else {\n\n /* remove the request */\n\n QLIST_REMOVE(elem, all);\n\n qemu_aio_release(elem);\n\n }\n\n }\n\n}\n"}} {"sample_id": "6b19a7d91c8de9904c67b87203a46e55db4181ab", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,8 +8,8 @@\n \n }\n \n+\n+\n+ return true;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool migration_object_check(MigrationState *ms, Error **errp)\n\n{\n\n if (!migrate_params_check(&ms->parameters, errp)) {\n\n return false;\n\n }\n\n\n\n return true;\n\n}\n"}} {"sample_id": "32baeafeee4f8446c2c3720b9223ad2166ca9d30_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void xvid_idct_put(uint8_t *dest, ptrdiff_t line_size, int16_t *block)\n \n+{\n \n ff_xvid_idct(block);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void xvid_idct_put(uint8_t *dest, ptrdiff_t line_size, int16_t *block)\n\n{\n\n ff_xvid_idct(block);\n\n ff_put_pixels_clamped(block, dest, line_size);\n\n}\n"}} {"sample_id": "383a04a127734d25c1ef7839c489bba297855801", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n {\n \n AVPacket local_pkt;\n+\n \n \n local_pkt = *pkt;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "int ff_write_chained(AVFormatContext *dst, int dst_stream, AVPacket *pkt,\n\n AVFormatContext *src)\n\n{\n\n AVPacket local_pkt;\n\n\n\n local_pkt = *pkt;\n\n local_pkt.stream_index = dst_stream;\n\n if (pkt->pts != AV_NOPTS_VALUE)\n\n local_pkt.pts = av_rescale_q(pkt->pts,\n\n src->streams[pkt->stream_index]->time_base,\n\n dst->streams[dst_stream]->time_base);\n\n if (pkt->dts != AV_NOPTS_VALUE)\n\n local_pkt.dts = av_rescale_q(pkt->dts,\n\n src->streams[pkt->stream_index]->time_base,\n\n dst->streams[dst_stream]->time_base);\n\n if (pkt->duration)\n\n local_pkt.duration = av_rescale_q(pkt->duration,\n\n src->streams[pkt->stream_index]->time_base,\n\n dst->streams[dst_stream]->time_base);\n\n return av_write_frame(dst, &local_pkt);\n\n}\n"}} {"sample_id": "a8f2e5c8fffbaf7fbd4f0efc8efbeebade78008f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int virtio_scsi_vring_init(VirtIOSCSI *s, VirtQueue *vq, int n)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int virtio_scsi_vring_init(VirtIOSCSI *s, VirtQueue *vq, int n)\n\n{\n\n BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(s)));\n\n VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);\n\n int rc;\n\n\n\n /* Set up virtqueue notify */\n\n rc = k->set_host_notifier(qbus->parent, n, true);\n\n if (rc != 0) {\n\n fprintf(stderr, \"virtio-scsi: Failed to set host notifier (%d)\\n\",\n\n rc);\n\n s->dataplane_fenced = true;\n\n return rc;\n\n }\n\n\n\n virtio_queue_aio_set_host_notifier_handler(vq, s->ctx, true, true);\n\n return 0;\n\n}\n"}} {"sample_id": "403e633126b7a781ecd48a29e3355770d46bbf1a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static unsigned __stdcall win32_start_routine(void *arg)\n+\n+{\n+\n+ struct QemuThreadData data = *(struct QemuThreadData *) arg;\n+\n+ QemuThread *thread = data.thread;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static unsigned __stdcall win32_start_routine(void *arg)\n\n{\n\n struct QemuThreadData data = *(struct QemuThreadData *) arg;\n\n QemuThread *thread = data.thread;\n\n\n\n free(arg);\n\n TlsSetValue(qemu_thread_tls_index, thread);\n\n\n\n /*\n\n * Use DuplicateHandle instead of assigning thread->thread in the\n\n * creating thread to avoid races. It's simpler this way than with\n\n * synchronization.\n\n */\n\n DuplicateHandle(GetCurrentProcess(), GetCurrentThread(),\n\n GetCurrentProcess(), &thread->thread,\n\n 0, FALSE, DUPLICATE_SAME_ACCESS);\n\n\n\n qemu_thread_exit(data.start_routine(data.arg));\n\n abort();\n\n}\n"}} {"sample_id": "b3db211f3c80bb996a704d665fe275619f728bd4_51", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,11 +34,11 @@\n \n }\n \n+\n+\n+ qmp_input_push(qiv, qobj, obj, &err);\n+\n+ if (err) {\n \n error_propagate(errp, err);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qmp_input_start_struct(Visitor *v, const char *name, void **obj,\n\n size_t size, Error **errp)\n\n{\n\n QmpInputVisitor *qiv = to_qiv(v);\n\n QObject *qobj = qmp_input_get_object(qiv, name, true, errp);\n\n Error *err = NULL;\n\n\n\n if (obj) {\n\n *obj = NULL;\n\n }\n\n if (!qobj) {\n\n return;\n\n }\n\n if (qobject_type(qobj) != QTYPE_QDICT) {\n\n error_setg(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : \"null\",\n\n \"QDict\");\n\n return;\n\n }\n\n\n\n qmp_input_push(qiv, qobj, obj, &err);\n\n if (err) {\n\n error_propagate(errp, err);\n\n return;\n\n }\n\n\n\n if (obj) {\n\n *obj = g_malloc0(size);\n\n }\n\n}\n"}} {"sample_id": "a77690c41da67d85bab1e784a9f24f18bc63dbd9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,12 +7,12 @@\n BusState *qbus = BUS(qdev_get_parent_bus(qdev));\n \n VirtioBusState *bus = VIRTIO_BUS(qbus);\n+\n VirtioBusClass *klass = VIRTIO_BUS_GET_CLASS(bus);\n \n+ VirtioDeviceClass *vdc = VIRTIO_DEVICE_GET_CLASS(vdev);\n \n+ bool has_iommu = virtio_host_has_feature(vdev, VIRTIO_F_IOMMU_PLATFORM);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void virtio_bus_device_plugged(VirtIODevice *vdev, Error **errp)\n\n{\n\n DeviceState *qdev = DEVICE(vdev);\n\n BusState *qbus = BUS(qdev_get_parent_bus(qdev));\n\n VirtioBusState *bus = VIRTIO_BUS(qbus);\n\n VirtioBusClass *klass = VIRTIO_BUS_GET_CLASS(bus);\n\n VirtioDeviceClass *vdc = VIRTIO_DEVICE_GET_CLASS(vdev);\n\n bool has_iommu = virtio_host_has_feature(vdev, VIRTIO_F_IOMMU_PLATFORM);\n\n\n\n DPRINTF(\"%s: plug device.\\n\", qbus->name);\n\n\n\n if (klass->pre_plugged != NULL) {\n\n klass->pre_plugged(qbus->parent, errp);\n\n }\n\n\n\n /* Get the features of the plugged device. */\n\n assert(vdc->get_features != NULL);\n\n vdev->host_features = vdc->get_features(vdev, vdev->host_features,\n\n errp);\n\n\n\n if (klass->device_plugged != NULL) {\n\n klass->device_plugged(qbus->parent, errp);\n\n }\n\n\n\n if (klass->get_dma_as != NULL && has_iommu) {\n\n virtio_add_feature(&vdev->host_features, VIRTIO_F_IOMMU_PLATFORM);\n\n vdev->dma_as = klass->get_dma_as(qbus->parent);\n\n } else {\n\n vdev->dma_as = &address_space_memory;\n\n }\n\n}\n"}} {"sample_id": "4f4321c11ff6e98583846bfd6f0e81954924b003_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,8 +5,8 @@\n USBWacomState *s = (USBWacomState *) dev;\n \n int ret = 0;\n+\n+\n \n switch (p->pid) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int usb_wacom_handle_data(USBDevice *dev, USBPacket *p)\n\n{\n\n USBWacomState *s = (USBWacomState *) dev;\n\n int ret = 0;\n\n\n\n switch (p->pid) {\n\n case USB_TOKEN_IN:\n\n if (p->devep == 1) {\n\n if (!(s->changed || s->idle))\n\n return USB_RET_NAK;\n\n s->changed = 0;\n\n if (s->mode == WACOM_MODE_HID)\n\n ret = usb_mouse_poll(s, p->data, p->len);\n\n else if (s->mode == WACOM_MODE_WACOM)\n\n ret = usb_wacom_poll(s, p->data, p->len);\n\n break;\n\n }\n\n /* Fall through. */\n\n case USB_TOKEN_OUT:\n\n default:\n\n ret = USB_RET_STALL;\n\n break;\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "0e86c13fe2058adb8c792ebb7c51a6a7ca9d3d55", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void virtio_serial_class_init(ObjectClass *klass, void *data)\n \n {\n+\n DeviceClass *dc = DEVICE_CLASS(klass);\n \n VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void virtio_serial_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);\n\n dc->exit = virtio_serial_device_exit;\n\n dc->props = virtio_serial_properties;\n\n set_bit(DEVICE_CATEGORY_INPUT, dc->categories);\n\n vdc->init = virtio_serial_device_init;\n\n vdc->get_features = get_features;\n\n vdc->get_config = get_config;\n\n vdc->set_config = set_config;\n\n vdc->set_status = set_status;\n\n vdc->reset = vser_reset;\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+\tDIS(fprintf (logfile, \"move $s%u, $r%u\\n\", dc->op2, dc->op1));\n+\n+\tcris_cc_mask(dc, 0);\n \n \ttcg_gen_helper_0_2(helper_movl_reg_sreg, \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static unsigned int dec_move_sr(DisasContext *dc)\n\n{\n\n\tDIS(fprintf (logfile, \"move $s%u, $r%u\\n\", dc->op2, dc->op1));\n\n\tcris_cc_mask(dc, 0);\n\n\ttcg_gen_helper_0_2(helper_movl_reg_sreg, \n\n\t\t\t tcg_const_tl(dc->op1), tcg_const_tl(dc->op2));\n\n\treturn 2;\n\n}\n"}} {"sample_id": "0105ed551cb9610c62b6920a301125781e1161a0_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n ptrdiff_t stride)\n \n+{\n+\n copy_width8_msa(src, stride, dst, stride, 8);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_put_h264_qpel8_mc00_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n copy_width8_msa(src, stride, dst, stride, 8);\n\n}\n"}} {"sample_id": "cd0c6f473532bfaf20a095bc90a18e45162981b5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void helper_slbie(CPUPPCState *env, target_ulong addr)\n+\n {\n \n PowerPCCPU *cpu = ppc_env_get_cpu(env);\n@@ -7,7 +7,7 @@\n ppc_slb_t *slb;\n \n \n+\n slb = slb_lookup(cpu, addr);\n \n if (!slb) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void helper_slbie(CPUPPCState *env, target_ulong addr)\n\n{\n\n PowerPCCPU *cpu = ppc_env_get_cpu(env);\n\n ppc_slb_t *slb;\n\n\n\n slb = slb_lookup(cpu, addr);\n\n if (!slb) {\n\n return;\n\n }\n\n\n\n if (slb->esid & SLB_ESID_V) {\n\n slb->esid &= ~SLB_ESID_V;\n\n\n\n /* XXX: given the fact that segment size is 256 MB or 1TB,\n\n * and we still don't have a tlb_flush_mask(env, n, mask)\n\n * in QEMU, we just invalidate all TLBs\n\n */\n\n tlb_flush(CPU(cpu), 1);\n\n }\n\n}\n"}} {"sample_id": "6e5c4540d18d1e9a5253104df161a7e0d408ca95", "diff": "--- a/source.c\n+++ b/source.c\n@@ -35,11 +35,11 @@\n smbios_add_field(0, offsetof(struct smbios_type_0,\n \n system_bios_major_release),\n+\n+ &major, 1);\n+\n+ smbios_add_field(0, offsetof(struct smbios_type_0,\n+\n system_bios_minor_release),\n \n &minor, 1);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void smbios_build_type_0_fields(const char *t)\n\n{\n\n char buf[1024];\n\n unsigned char major, minor;\n\n\n\n if (get_param_value(buf, sizeof(buf), \"vendor\", t))\n\n smbios_add_field(0, offsetof(struct smbios_type_0, vendor_str),\n\n buf, strlen(buf) + 1);\n\n if (get_param_value(buf, sizeof(buf), \"version\", t))\n\n smbios_add_field(0, offsetof(struct smbios_type_0, bios_version_str),\n\n buf, strlen(buf) + 1);\n\n if (get_param_value(buf, sizeof(buf), \"date\", t))\n\n smbios_add_field(0, offsetof(struct smbios_type_0,\n\n bios_release_date_str),\n\n buf, strlen(buf) + 1);\n\n if (get_param_value(buf, sizeof(buf), \"release\", t)) {\n\n sscanf(buf, \"%hhu.%hhu\", &major, &minor);\n\n smbios_add_field(0, offsetof(struct smbios_type_0,\n\n system_bios_major_release),\n\n &major, 1);\n\n smbios_add_field(0, offsetof(struct smbios_type_0,\n\n system_bios_minor_release),\n\n &minor, 1);\n\n }\n\n}\n"}} {"sample_id": "5a31f2318b8fed1f4711cb86eab6d9b679946878", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n {\n \n AVStream *fst;\n+\n+\n+\n+ if(stream->nb_streams >= FF_ARRAY_ELEMS(stream->streams))\n+\n return NULL;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static AVStream *add_av_stream1(FFServerStream *stream,\n\n AVCodecContext *codec, int copy)\n\n{\n\n AVStream *fst;\n\n\n\n if(stream->nb_streams >= FF_ARRAY_ELEMS(stream->streams))\n\n return NULL;\n\n\n\n fst = av_mallocz(sizeof(AVStream));\n\n if (!fst)\n\n return NULL;\n\n if (copy) {\n\n fst->codec = avcodec_alloc_context3(codec->codec);\n\n if (!fst->codec) {\n\n av_free(fst);\n\n return NULL;\n\n }\n\n avcodec_copy_context(fst->codec, codec);\n\n } else\n\n /* live streams must use the actual feed's codec since it may be\n\n * updated later to carry extradata needed by them.\n\n */\n\n fst->codec = codec;\n\n\n\n fst->priv_data = av_mallocz(sizeof(FeedData));\n\n\n fst->index = stream->nb_streams;\n\n avpriv_set_pts_info(fst, 33, 1, 90000);\n\n fst->sample_aspect_ratio = codec->sample_aspect_ratio;\n\n stream->streams[stream->nb_streams++] = fst;\n\n return fst;\n\n}"}} {"sample_id": "1527e689cfe3d1f0062f7d3935bad6ed027b3bc8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -59,11 +59,11 @@\n *p = ((*p - 128) * fade->factor + 8421367) >> 16;\n \n p++;\n+\n+ }\n+\n+ }\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void draw_slice(AVFilterLink *inlink, int y, int h, int slice_dir)\n\n{\n\n FadeContext *fade = inlink->dst->priv;\n\n AVFilterBufferRef *outpic = inlink->cur_buf;\n\n uint8_t *p;\n\n int i, j, plane;\n\n\n\n if (fade->factor < 65536) {\n\n /* luma or rgb plane */\n\n for (i = 0; i < h; i++) {\n\n p = outpic->data[0] + (y+i) * outpic->linesize[0];\n\n for (j = 0; j < inlink->w * fade->bpp; j++) {\n\n /* fade->factor is using 16 lower-order bits for decimal\n\n * places. 32768 = 1 << 15, it is an integer representation\n\n * of 0.5 and is for rounding. */\n\n *p = (*p * fade->factor + 32768) >> 16;\n\n p++;\n\n }\n\n }\n\n\n\n if (outpic->data[0] && outpic->data[1]) {\n\n /* chroma planes */\n\n for (plane = 1; plane < 3; plane++) {\n\n for (i = 0; i < h; i++) {\n\n p = outpic->data[plane] + ((y+i) >> fade->vsub) * outpic->linesize[plane];\n\n for (j = 0; j < inlink->w >> fade->hsub; j++) {\n\n /* 8421367 = ((128 << 1) + 1) << 15. It is an integer\n\n * representation of 128.5. The .5 is for rounding\n\n * purposes. */\n\n *p = ((*p - 128) * fade->factor + 8421367) >> 16;\n\n p++;\n\n }\n\n }\n\n }\n\n }\n\n }\n\n\n\n avfilter_draw_slice(inlink->dst->outputs[0], y, h, slice_dir);\n\n}\n"}} {"sample_id": "071d4054770205ddb8a58a9e2735069d8fe52af1_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void qdist_init(struct qdist *dist)\n+\n {\n \n dist->entries = g_malloc(sizeof(*dist->entries));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void qdist_init(struct qdist *dist)\n\n{\n\n dist->entries = g_malloc(sizeof(*dist->entries));\n\n dist->size = 1;\n\n dist->n = 0;\n\n}\n"}} {"sample_id": "fc40787abcf8452b8f50d92b7a13243a12972c7a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,20 +1,20 @@\n+target_ulong helper_lwr(CPUMIPSState *env, target_ulong arg1,\n+\n+ target_ulong arg2, int mem_idx)\n+\n+{\n+\n+ target_ulong tmp;\n \n+\n+\n+ tmp = do_lbu(env, arg2, mem_idx);\n \n+ arg1 = (arg1 & 0xFFFFFF00) | tmp;\n+\n+\n \n+ if (GET_LMASK(arg2) >= 1) {\n \n tmp = do_lbu(env, GET_OFFSET(arg2, -1), mem_idx);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "target_ulong helper_lwr(CPUMIPSState *env, target_ulong arg1,\n\n target_ulong arg2, int mem_idx)\n\n{\n\n target_ulong tmp;\n\n\n\n tmp = do_lbu(env, arg2, mem_idx);\n\n arg1 = (arg1 & 0xFFFFFF00) | tmp;\n\n\n\n if (GET_LMASK(arg2) >= 1) {\n\n tmp = do_lbu(env, GET_OFFSET(arg2, -1), mem_idx);\n\n arg1 = (arg1 & 0xFFFF00FF) | (tmp << 8);\n\n }\n\n\n\n if (GET_LMASK(arg2) >= 2) {\n\n tmp = do_lbu(env, GET_OFFSET(arg2, -2), mem_idx);\n\n arg1 = (arg1 & 0xFF00FFFF) | (tmp << 16);\n\n }\n\n\n\n if (GET_LMASK(arg2) == 3) {\n\n tmp = do_lbu(env, GET_OFFSET(arg2, -3), mem_idx);\n\n arg1 = (arg1 & 0x00FFFFFF) | (tmp << 24);\n\n }\n\n return (int32_t)arg1;\n\n}\n"}} {"sample_id": "e91171e30235ae99ab8060988aa3c9536692bba8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n * achievable under QEMU. Otherwise, QEMU spends all\n \n+ * its time generating timer interrupts, and there\n+\n+ * is no forward progress.\n+\n+ * About ten microseconds is the fastest that really works\n \n * on the current generation of host machines.\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ptimer_set_limit(ptimer_state *s, uint64_t limit, int reload)\n\n{\n\n /*\n\n * Artificially limit timeout rate to something\n\n * achievable under QEMU. Otherwise, QEMU spends all\n\n * its time generating timer interrupts, and there\n\n * is no forward progress.\n\n * About ten microseconds is the fastest that really works\n\n * on the current generation of host machines.\n\n */\n\n\n\n if (!use_icount && limit * s->period < 10000 && s->period) {\n\n limit = 10000 / s->period;\n\n }\n\n\n\n s->limit = limit;\n\n if (reload)\n\n s->delta = limit;\n\n if (s->enabled && reload) {\n\n s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);\n\n ptimer_reload(s);\n\n }\n\n}\n"}} {"sample_id": "e774c41cab765f5d12ecfb31e5fa30df41230de0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static inline void update_rice(APERice *rice, int x)\n+\n+{\n+\n+ rice->ksum += ((x + 1) / 2) - ((rice->ksum + 16) >> 5);\n+\n \n \n if (rice->k == 0)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void update_rice(APERice *rice, int x)\n\n{\n\n rice->ksum += ((x + 1) / 2) - ((rice->ksum + 16) >> 5);\n\n\n\n if (rice->k == 0)\n\n rice->k = 1;\n\n else if (rice->ksum < (1 << (rice->k + 4)))\n\n rice->k--;\n\n else if (rice->ksum >= (1 << (rice->k + 5)))\n\n rice->k++;\n\n}\n"}} {"sample_id": "2cbe6bac0337939f023bd1c37a9c455e6d535f3a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,7 +18,7 @@\n \n int cpy_line_width = s->line_size[plane];\n \n+ uint8_t *cpy_src1_data = td->copy_src1->data[plane];\n \n int cpy_src1_line_size = td->copy_src1->linesize[plane];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int filter_slice(AVFilterContext *ctx, void *arg, int job, int nb_jobs)\n\n{\n\n FrameRateContext *s = ctx->priv;\n\n ThreadData *td = arg;\n\n uint16_t src1_factor = td->src1_factor;\n\n uint16_t src2_factor = td->src2_factor;\n\n int plane;\n\n\n\n for (plane = 0; plane < 4 && td->copy_src1->data[plane] && td->copy_src2->data[plane]; plane++) {\n\n int cpy_line_width = s->line_size[plane];\n\n uint8_t *cpy_src1_data = td->copy_src1->data[plane];\n\n int cpy_src1_line_size = td->copy_src1->linesize[plane];\n\n uint8_t *cpy_src2_data = td->copy_src2->data[plane];\n\n int cpy_src2_line_size = td->copy_src2->linesize[plane];\n\n int cpy_src_h = (plane > 0 && plane < 3) ? (td->copy_src1->height >> s->vsub) : (td->copy_src1->height);\n\n uint8_t *cpy_dst_data = s->work->data[plane];\n\n int cpy_dst_line_size = s->work->linesize[plane];\n\n const int start = (cpy_src_h * job ) / nb_jobs;\n\n const int end = (cpy_src_h * (job+1)) / nb_jobs;\n\n cpy_src1_data += start * cpy_src1_line_size;\n\n cpy_src2_data += start * cpy_src2_line_size;\n\n cpy_dst_data += start * cpy_dst_line_size;\n\n\n\n s->blend(cpy_src1_data, cpy_src1_line_size,\n\n cpy_src2_data, cpy_src2_line_size,\n\n cpy_dst_data, cpy_dst_line_size,\n\n cpy_line_width, end - start,\n\n src1_factor, src2_factor, s->max / 2, s->bitdepth);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_44", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n /* do nothing. Masters do not directly interact with the backing store,\n \n * only the working copy so no mutexing required.\n+\n+ */\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bdrv_sync_complete(void *opaque, int ret)\n\n{\n\n /* do nothing. Masters do not directly interact with the backing store,\n\n * only the working copy so no mutexing required.\n\n */\n\n}\n"}} {"sample_id": "50628d3479e4f9aa97e323506856e394fe7ad7a6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+void qemu_console_copy(QemuConsole *con, int src_x, int src_y,\n+\n+ int dst_x, int dst_y, int w, int h)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void qemu_console_copy(QemuConsole *con, int src_x, int src_y,\n\n int dst_x, int dst_y, int w, int h)\n\n{\n\n assert(con->console_type == GRAPHIC_CONSOLE);\n\n dpy_gfx_copy(con, src_x, src_y, dst_x, dst_y, w, h);\n\n}\n"}} {"sample_id": "797d780b1375b1af1d7713685589bfdec9908dc3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void gen_brcond(DisasContext *dc, TCGCond cond,\n \n TCGv_i32 t0, TCGv_i32 t1, uint32_t offset)\n+\n {\n \n int label = gen_new_label();", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_brcond(DisasContext *dc, TCGCond cond,\n\n TCGv_i32 t0, TCGv_i32 t1, uint32_t offset)\n\n{\n\n int label = gen_new_label();\n\n\n\n tcg_gen_brcond_i32(cond, t0, t1, label);\n\n gen_jumpi(dc, dc->next_pc, 0);\n\n gen_set_label(label);\n\n gen_jumpi(dc, dc->pc + offset, 1);\n\n}\n"}} {"sample_id": "7ba7974197090285fdb413c6e1c41aaacd44b9c4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n PCNetState *d = opaque;\n \n \n+\n+ if (addr < 16 && size == 1) {\n+\n+ return pcnet_aprom_writeb(d, addr, data);\n+\n } else if (addr >= 0x10 && addr < 0x20 && size == 2) {\n \n return pcnet_ioport_writew(d, addr, data);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pcnet_ioport_write(void *opaque, target_phys_addr_t addr,\n\n uint64_t data, unsigned size)\n\n{\n\n PCNetState *d = opaque;\n\n\n\n if (addr < 16 && size == 1) {\n\n return pcnet_aprom_writeb(d, addr, data);\n\n } else if (addr >= 0x10 && addr < 0x20 && size == 2) {\n\n return pcnet_ioport_writew(d, addr, data);\n\n } else if (addr >= 0x10 && addr < 0x20 && size == 4) {\n\n return pcnet_ioport_writel(d, addr, data);\n\n }\n\n}\n"}} {"sample_id": "1acd7d594c15aa491729c837ad3519d3469e620a_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void FUNCC(pred16x16_vertical_add)(uint8_t *pix, const int *block_offset,\n \n+ const int16_t *block,\n+\n+ ptrdiff_t stride)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void FUNCC(pred16x16_vertical_add)(uint8_t *pix, const int *block_offset,\n\n const int16_t *block,\n\n ptrdiff_t stride)\n\n{\n\n int i;\n\n for(i=0; i<16; i++)\n\n FUNCC(pred4x4_vertical_add)(pix + block_offset[i], block + i*16*sizeof(pixel), stride);\n\n}\n"}} {"sample_id": "26f6b8c571bcff7b325c7d6cc226c625dd465f8e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n int ffurl_read(URLContext *h, unsigned char *buf, int size)\n+\n {\n \n if (h->flags & AVIO_FLAG_WRITE)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int ffurl_read(URLContext *h, unsigned char *buf, int size)\n\n{\n\n if (h->flags & AVIO_FLAG_WRITE)\n\n return AVERROR(EIO);\n\n return retry_transfer_wrapper(h, buf, size, 1, h->prot->url_read);\n\n}\n"}} {"sample_id": "d70724cec84ff99ffc7f70dd567466acf228b389", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void dump_op_count(void)\n \n+{\n+\n int i;\n+\n FILE *f;\n+\n f = fopen(\"/tmp/op.log\", \"w\");\n \n for(i = INDEX_op_end; i < NB_OPS; i++) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void dump_op_count(void)\n\n{\n\n int i;\n\n FILE *f;\n\n f = fopen(\"/tmp/op.log\", \"w\");\n\n for(i = INDEX_op_end; i < NB_OPS; i++) {\n\n fprintf(f, \"%s %\" PRId64 \"\\n\", tcg_op_defs[i].name, tcg_table_op_count[i]);\n\n }\n\n fclose(f);\n\n}\n"}} {"sample_id": "92c0bba9a95739c92e959fe478cb1acb92fa5446_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static uint32_t omap_l4_io_readw(void *opaque, target_phys_addr_t addr)\n \n {\n+\n+ unsigned int i = (addr - OMAP2_L4_BASE) >> TARGET_PAGE_BITS;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t omap_l4_io_readw(void *opaque, target_phys_addr_t addr)\n\n{\n\n unsigned int i = (addr - OMAP2_L4_BASE) >> TARGET_PAGE_BITS;\n\n\n\n return omap_l4_io_readw_fn[i](omap_l4_io_opaque[i], addr);\n\n}\n"}} {"sample_id": "34056cbba55f0131e8d2698717ab9e86e2da5178", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n RTPMuxContext *s = s1->priv_data;\n \n int len, max_packet_size;\n+\n uint8_t *q;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void ff_rtp_send_h263(AVFormatContext *s1, const uint8_t *buf1, int size)\n\n{\n\n RTPMuxContext *s = s1->priv_data;\n\n int len, max_packet_size;\n\n uint8_t *q;\n\n\n\n max_packet_size = s->max_payload_size;\n\n\n\n while (size > 0) {\n\n q = s->buf;\n\n if ((buf1[0] == 0) && (buf1[1] == 0)) {\n\n *q++ = 0x04;\n\n buf1 += 2;\n\n size -= 2;\n\n } else {\n\n *q++ = 0;\n\n }\n\n *q++ = 0;\n\n\n\n len = FFMIN(max_packet_size - 2, size);\n\n\n\n /* Look for a better place to split the frame into packets. */\n\n if (len < size) {\n\n const uint8_t *end = find_resync_marker_reverse(buf1, buf1 + len);\n\n len = end - buf1;\n\n }\n\n\n\n memcpy(q, buf1, len);\n\n q += len;\n\n\n\n /* 90 KHz time stamp */\n\n s->timestamp = s->cur_timestamp;\n\n ff_rtp_send_data(s1, s->buf, q - s->buf, (len == size));\n\n\n\n buf1 += len;\n\n size -= len;\n\n }\n\n}\n"}} {"sample_id": "0d871bdbaac428601c84d29233a49f7cf6ecb6fc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n setup_sigcontext(&uc->tuc_mcontext, env, set->sig[0]);\n \n+ /* FIXME: Save coprocessor signal frame. */\n+\n+ for(i = 0; i < TARGET_NSIG_WORDS; i++) {\n+\n+ __put_user(set->sig[i], &uc->tuc_sigmask.sig[i]);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void setup_sigframe_v2(struct target_ucontext_v2 *uc,\n\n target_sigset_t *set, CPUState *env)\n\n{\n\n struct target_sigaltstack stack;\n\n int i;\n\n\n\n /* Clear all the bits of the ucontext we don't use. */\n\n memset(uc, 0, offsetof(struct target_ucontext_v2, tuc_mcontext));\n\n\n\n memset(&stack, 0, sizeof(stack));\n\n __put_user(target_sigaltstack_used.ss_sp, &stack.ss_sp);\n\n __put_user(target_sigaltstack_used.ss_size, &stack.ss_size);\n\n __put_user(sas_ss_flags(get_sp_from_cpustate(env)), &stack.ss_flags);\n\n memcpy(&uc->tuc_stack, &stack, sizeof(stack));\n\n\n\n setup_sigcontext(&uc->tuc_mcontext, env, set->sig[0]);\n\n /* FIXME: Save coprocessor signal frame. */\n\n for(i = 0; i < TARGET_NSIG_WORDS; i++) {\n\n __put_user(set->sig[i], &uc->tuc_sigmask.sig[i]);\n\n }\n\n}\n"}} {"sample_id": "7372c2b926200db295412efbb53f93773b7f1754_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n DISAS_INSN(fsave)\n+\n {\n \n /* TODO: Implement fsave. */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "DISAS_INSN(fsave)\n\n{\n\n /* TODO: Implement fsave. */\n\n qemu_assert(0, \"FSAVE not implemented\");\n\n}\n"}} {"sample_id": "a8f2e5c8fffbaf7fbd4f0efc8efbeebade78008f_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void virtio_scsi_handle_ctrl_req(VirtIOSCSI *s, VirtIOSCSIReq *req)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-89", "target_file": "source.c", "files": {"source.c": "void virtio_scsi_handle_ctrl_req(VirtIOSCSI *s, VirtIOSCSIReq *req)\n\n{\n\n VirtIODevice *vdev = (VirtIODevice *)s;\n\n uint32_t type;\n\n int r = 0;\n\n\n\n if (iov_to_buf(req->elem.out_sg, req->elem.out_num, 0,\n\n &type, sizeof(type)) < sizeof(type)) {\n\n virtio_scsi_bad_req();\n\n return;\n\n }\n\n\n\n virtio_tswap32s(vdev, &type);\n\n if (type == VIRTIO_SCSI_T_TMF) {\n\n if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlTMFReq),\n\n sizeof(VirtIOSCSICtrlTMFResp)) < 0) {\n\n virtio_scsi_bad_req();\n\n } else {\n\n r = virtio_scsi_do_tmf(s, req);\n\n }\n\n\n\n } else if (type == VIRTIO_SCSI_T_AN_QUERY ||\n\n type == VIRTIO_SCSI_T_AN_SUBSCRIBE) {\n\n if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlANReq),\n\n sizeof(VirtIOSCSICtrlANResp)) < 0) {\n\n virtio_scsi_bad_req();\n\n } else {\n\n req->resp.an.event_actual = 0;\n\n req->resp.an.response = VIRTIO_SCSI_S_OK;\n\n }\n\n }\n\n if (r == 0) {\n\n virtio_scsi_complete_req(req);\n\n } else {\n\n assert(r == -EINPROGRESS);\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_117", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n case 1:\n \n cpu_outb(addr, val);\n+\n+ break;\n+\n+ case 2:\n+\n cpu_outw(addr, val);\n \n break;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bw_io_write(void *opaque, target_phys_addr_t addr,\n\n uint64_t val, unsigned size)\n\n{\n\n switch (size) {\n\n case 1:\n\n cpu_outb(addr, val);\n\n break;\n\n case 2:\n\n cpu_outw(addr, val);\n\n break;\n\n case 4:\n\n cpu_outl(addr, val);\n\n break;\n\n default:\n\n abort();\n\n }\n\n}\n"}} {"sample_id": "e508a92b621c7160122e99d3754e568f2b8e255e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n uint64_t value)\n \n {\n+\n+ if (ri->crm >= 8) {\n+\n+ return EXCP_UDEF;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int arm946_prbs_write(CPUARMState *env, const ARMCPRegInfo *ri,\n\n uint64_t value)\n\n{\n\n if (ri->crm >= 8) {\n\n return EXCP_UDEF;\n\n }\n\n env->cp15.c6_region[ri->crm] = value;\n\n return 0;\n\n}\n"}} {"sample_id": "f755dea79dc81b0d6a8f6414e0672e165e28d8ba", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n } else {\n \n+ value = *obj;\n+\n+ v->type_int64(v, &value, name, errp);\n+\n+ if (value < 0 || value > UINT16_MAX) {\n \n /* FIXME questionable reuse of errp if callback changed\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void visit_type_uint16(Visitor *v, uint16_t *obj, const char *name, Error **errp)\n\n{\n\n int64_t value;\n\n\n\n if (v->type_uint16) {\n\n v->type_uint16(v, obj, name, errp);\n\n } else {\n\n value = *obj;\n\n v->type_int64(v, &value, name, errp);\n\n if (value < 0 || value > UINT16_MAX) {\n\n /* FIXME questionable reuse of errp if callback changed\n\n value on error */\n\n error_setg(errp, QERR_INVALID_PARAMETER_VALUE,\n\n name ? name : \"null\", \"uint16_t\");\n\n return;\n\n }\n\n *obj = value;\n\n }\n\n}\n"}} {"sample_id": "0dbb48d91e9e97c7eb11f4ebc03c4ff4b6f5b692", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n MpegMuxContext *s = ctx->priv_data;\n \n+ StreamInfo *stream;\n+\n int i;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int mpeg_mux_end(AVFormatContext *ctx)\n\n{\n\n MpegMuxContext *s = ctx->priv_data;\n\n StreamInfo *stream;\n\n int i;\n\n\n\n /* flush each packet */\n\n for(i=0;inb_streams;i++) {\n\n stream = ctx->streams[i]->priv_data;\n\n while (stream->buffer_ptr > 0) {\n\n flush_packet(ctx, i, AV_NOPTS_VALUE, AV_NOPTS_VALUE, s->last_scr);\n\n }\n\n }\n\n\n\n /* End header according to MPEG1 systems standard. We do not write\n\n it as it is usually not needed by decoders and because it\n\n complicates MPEG stream concatenation. */\n\n //put_be32(&ctx->pb, ISO_11172_END_CODE);\n\n //put_flush_packet(&ctx->pb);\n\n\n\n for(i=0;inb_streams;i++)\n\n av_freep(&ctx->streams[i]->priv_data);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "06f4b1e37a08f3fd269ecbfeb0181129e5bfc86e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static double compute_target_time(double frame_current_pts, VideoState *is)\n+\n {\n \n double delay, sync_threshold, diff;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static double compute_target_time(double frame_current_pts, VideoState *is)\n\n{\n\n double delay, sync_threshold, diff;\n\n\n\n /* compute nominal delay */\n\n delay = frame_current_pts - is->frame_last_pts;\n\n if (delay <= 0 || delay >= 10.0) {\n\n /* if incorrect delay, use previous one */\n\n delay = is->frame_last_delay;\n\n } else {\n\n is->frame_last_delay = delay;\n\n }\n\n is->frame_last_pts = frame_current_pts;\n\n\n\n /* update delay to follow master synchronisation source */\n\n if (((is->av_sync_type == AV_SYNC_AUDIO_MASTER && is->audio_st) ||\n\n is->av_sync_type == AV_SYNC_EXTERNAL_CLOCK)) {\n\n /* if video is slave, we try to correct big delays by\n\n duplicating or deleting a frame */\n\n diff = get_video_clock(is) - get_master_clock(is);\n\n\n\n /* skip or repeat frame. We take into account the\n\n delay to compute the threshold. I still don't know\n\n if it is the best guess */\n\n sync_threshold = FFMAX(AV_SYNC_THRESHOLD, delay);\n\n if (fabs(diff) < AV_NOSYNC_THRESHOLD) {\n\n if (diff <= -sync_threshold)\n\n delay = 0;\n\n else if (diff >= sync_threshold)\n\n delay = 2 * delay;\n\n }\n\n }\n\n is->frame_timer += delay;\n\n\n\n av_log(NULL, AV_LOG_TRACE, \"video: delay=%0.3f pts=%0.3f A-V=%f\\n\",\n\n delay, frame_current_pts, -diff);\n\n\n\n return is->frame_timer;\n\n}\n"}} {"sample_id": "6484e422479c93f28e3f8a68258b0eacd3b31e6d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n int qemu_set_fd_handler(int fd,\n+\n+ IOHandler *fd_read,\n+\n IOHandler *fd_write,\n \n void *opaque)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_set_fd_handler(int fd,\n\n IOHandler *fd_read,\n\n IOHandler *fd_write,\n\n void *opaque)\n\n{\n\n return qemu_set_fd_handler2(fd, NULL, fd_read, fd_write, opaque);\n\n}\n"}} {"sample_id": "4c315c27661502a0813b129e41c0bf640c34a8d6_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void xlnx_zynqmp_class_init(ObjectClass *oc, void *data)\n {\n+ DeviceClass *dc = DEVICE_CLASS(oc);\n dc->props = xlnx_zynqmp_props;\n dc->realize = xlnx_zynqmp_realize;\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void xlnx_zynqmp_class_init(ObjectClass *oc, void *data)\n{\n DeviceClass *dc = DEVICE_CLASS(oc);\n dc->props = xlnx_zynqmp_props;\n dc->realize = xlnx_zynqmp_realize;\n}"}} {"sample_id": "42e38c1fd0199155d32f3464aedce282d3d7f6a1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,10 +2,10 @@\n \n {\n \n+ BlockRequest *blkreq;\n \n uint64_t sector;\n+\n \n \n sector = virtio_ldq_p(VIRTIO_DEVICE(req->dev), &req->out.sector);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void virtio_blk_handle_write(VirtIOBlockReq *req, MultiReqBuffer *mrb)\n\n{\n\n BlockRequest *blkreq;\n\n uint64_t sector;\n\n\n\n sector = virtio_ldq_p(VIRTIO_DEVICE(req->dev), &req->out.sector);\n\n\n\n bdrv_acct_start(req->dev->bs, &req->acct, req->qiov.size, BDRV_ACCT_WRITE);\n\n\n\n trace_virtio_blk_handle_write(req, sector, req->qiov.size / 512);\n\n\n\n if (!virtio_blk_sect_range_ok(req->dev, sector, req->qiov.size)) {\n\n virtio_blk_rw_complete(req, -EIO);\n\n return;\n\n }\n\n\n\n if (mrb->num_writes == 32) {\n\n virtio_submit_multiwrite(req->dev->bs, mrb);\n\n }\n\n\n\n blkreq = &mrb->blkreq[mrb->num_writes];\n\n blkreq->sector = sector;\n\n blkreq->nb_sectors = req->qiov.size / BDRV_SECTOR_SIZE;\n\n blkreq->qiov = &req->qiov;\n\n blkreq->cb = virtio_blk_rw_complete;\n\n blkreq->opaque = req;\n\n blkreq->error = 0;\n\n\n\n mrb->num_writes++;\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_38", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,14 +3,14 @@\n {\n \n uint64_t barsize;\n+\n+\n \n s->qtest = qtest_start(cmd);\n \n s->pcibus = qpci_init_pc(NULL);\n+\n+ s->dev = get_device(s->pcibus);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void setup_vm_cmd(IVState *s, const char *cmd, bool msix)\n\n{\n\n uint64_t barsize;\n\n\n\n s->qtest = qtest_start(cmd);\n\n s->pcibus = qpci_init_pc(NULL);\n\n s->dev = get_device(s->pcibus);\n\n\n\n s->reg_base = qpci_iomap(s->dev, 0, &barsize);\n\n g_assert_nonnull(s->reg_base);\n\n g_assert_cmpuint(barsize, ==, 256);\n\n\n\n if (msix) {\n\n qpci_msix_enable(s->dev);\n\n }\n\n\n\n s->mem_base = qpci_iomap(s->dev, 2, &barsize);\n\n g_assert_nonnull(s->mem_base);\n\n g_assert_cmpuint(barsize, ==, TMPSHMSIZE);\n\n\n\n qpci_device_enable(s->dev);\n\n}\n"}} {"sample_id": "d6604b29ef544793479d7fb4e05ef6622bb3e534_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n av_freep(&ctx->twopass_stats.buf);\n \n av_freep(&avctx->coded_frame);\n+\n+ av_freep(&avctx->stats_out);\n+\n+ free_frame_list(ctx->coded_frame_list);\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int vp8_free(AVCodecContext *avctx)\n\n{\n\n VP8Context *ctx = avctx->priv_data;\n\n\n\n vpx_codec_destroy(&ctx->encoder);\n\n av_freep(&ctx->twopass_stats.buf);\n\n av_freep(&avctx->coded_frame);\n\n av_freep(&avctx->stats_out);\n\n free_frame_list(ctx->coded_frame_list);\n\n return 0;\n\n}\n"}} {"sample_id": "fdc94db37e89165964fdf34f1cd7632e44108bd0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n memcpy(x+288, in, 1024*sizeof(x[0]));\n \n+ for (i = 0; i < 32; i++) { // numTimeSlots*RATE = 16*2 as 960 sample frames\n+\n+ // are not supported\n+\n+ dsp->vector_fmul_reverse(z, sbr_qmf_window_ds, x, 320);\n \n sbrdsp->sum64x5(z);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void sbr_qmf_analysis(AVFixedDSPContext *dsp, FFTContext *mdct,\n\n#else\n\nstatic void sbr_qmf_analysis(AVFloatDSPContext *dsp, FFTContext *mdct,\n\n#endif /* USE_FIXED */\n\n SBRDSPContext *sbrdsp, const INTFLOAT *in, INTFLOAT *x,\n\n INTFLOAT z[320], INTFLOAT W[2][32][32][2], int buf_idx)\n\n{\n\n int i;\n\n\n int j;\n\n\n memcpy(x , x+1024, (320-32)*sizeof(x[0]));\n\n memcpy(x+288, in, 1024*sizeof(x[0]));\n\n for (i = 0; i < 32; i++) { // numTimeSlots*RATE = 16*2 as 960 sample frames\n\n // are not supported\n\n dsp->vector_fmul_reverse(z, sbr_qmf_window_ds, x, 320);\n\n sbrdsp->sum64x5(z);\n\n sbrdsp->qmf_pre_shuffle(z);\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n mdct->imdct_half(mdct, z, z+64);\n\n sbrdsp->qmf_post_shuffle(W[buf_idx][i], z);\n\n x += 32;\n\n"}} {"sample_id": "8e9b0d24fb986d4241ae3b77752eca5dab4cb486_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n \n \n+#ifdef CONFIG_VNC_SASL\n+\n+ if (vs->sasl.conn &&\n+\n+ vs->sasl.runSSF &&\n \n !vs->sasl.waitWriteSSF) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vnc_client_write_locked(void *opaque)\n\n{\n\n VncState *vs = opaque;\n\n\n\n#ifdef CONFIG_VNC_SASL\n\n if (vs->sasl.conn &&\n\n vs->sasl.runSSF &&\n\n !vs->sasl.waitWriteSSF) {\n\n vnc_client_write_sasl(vs);\n\n } else\n\n#endif /* CONFIG_VNC_SASL */\n\n {\n\n#ifdef CONFIG_VNC_WS\n\n if (vs->encode_ws) {\n\n vnc_client_write_ws(vs);\n\n } else\n\n#endif /* CONFIG_VNC_WS */\n\n {\n\n vnc_client_write_plain(vs);\n\n }\n\n }\n\n}\n"}} {"sample_id": "113fe792fd4931dd0538f03859278b8719ee4fa2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void nfs_file_close(BlockDriverState *bs)\n \n {\n+\n NFSClient *client = bs->opaque;\n \n nfs_client_close(client);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void nfs_file_close(BlockDriverState *bs)\n\n{\n\n NFSClient *client = bs->opaque;\n\n nfs_client_close(client);\n\n qemu_mutex_destroy(&client->mutex);\n\n}\n"}} {"sample_id": "5f758366c0710d23e43f4d0f83816b98616a13d0_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n bool is_listen = sock->has_server ? sock->server : true;\n \n+ bool is_telnet = sock->has_telnet ? sock->telnet : false;\n \n bool is_waitconnect = sock->has_wait ? sock->wait : false;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static CharDriverState *qmp_chardev_open_socket(ChardevSocket *sock,\n\n Error **errp)\n\n{\n\n SocketAddress *addr = sock->addr;\n\n bool do_nodelay = sock->has_nodelay ? sock->nodelay : false;\n\n bool is_listen = sock->has_server ? sock->server : true;\n\n bool is_telnet = sock->has_telnet ? sock->telnet : false;\n\n bool is_waitconnect = sock->has_wait ? sock->wait : false;\n\n int fd;\n\n\n\n if (is_listen) {\n\n fd = socket_listen(addr, errp);\n\n } else {\n\n fd = socket_connect(addr, errp, NULL, NULL);\n\n }\n\n if (error_is_set(errp)) {\n\n return NULL;\n\n }\n\n return qemu_chr_open_socket_fd(fd, do_nodelay, is_listen,\n\n is_telnet, is_waitconnect, errp);\n\n}\n"}} {"sample_id": "185698715dfb18c82ad2a5dbc169908602d43e81_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static inline uint32_t efsctuiz(uint32_t val)\n \n+{\n+\n+ CPU_FloatU u;\n+\n+\n \n u.l = val;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline uint32_t efsctuiz(uint32_t val)\n\n{\n\n CPU_FloatU u;\n\n\n\n u.l = val;\n\n /* NaN are not treated the same way IEEE 754 does */\n\n if (unlikely(float32_is_nan(u.f)))\n\n return 0;\n\n\n\n return float32_to_uint32_round_to_zero(u.f, &env->vec_status);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_200", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ val = tswap64(val);\n+\n cpu_physical_memory_write(addr, &val, 8);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void stq_phys(target_phys_addr_t addr, uint64_t val)\n\n{\n\n val = tswap64(val);\n\n cpu_physical_memory_write(addr, &val, 8);\n\n}\n"}} {"sample_id": "ffa48cf5ab719e1e181e51b87bc0f5d397b791fa", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void select_soundhw(const char *optarg)\n \n {\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void select_soundhw(const char *optarg)\n\n{\n\n}\n"}} {"sample_id": "eed2bacfd2519e45498b585a147f11b0fd01c3c7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n while (mr->container) {\n \n+ mr = mr->container;\n+\n+ }\n+\n+ QTAILQ_FOREACH(as, &address_spaces, address_spaces_link) {\n \n if (mr == as->root) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static AddressSpace *memory_region_to_address_space(MemoryRegion *mr)\n\n{\n\n AddressSpace *as;\n\n\n\n while (mr->container) {\n\n mr = mr->container;\n\n }\n\n QTAILQ_FOREACH(as, &address_spaces, address_spaces_link) {\n\n if (mr == as->root) {\n\n return as;\n\n }\n\n }\n\n abort();\n\n}\n"}} {"sample_id": "fc3b32958a80bca13309e2695de07b43dd788421_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n \n bios_release_date_str),\n \n+ val, strlen(val) + 1);\n+\n+ }\n+\n+ val = qemu_opt_get(opts, \"release\");\n \n if (val) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void smbios_build_type_0_fields(QemuOpts *opts)\n\n{\n\n const char *val;\n\n unsigned char major, minor;\n\n\n\n val = qemu_opt_get(opts, \"vendor\");\n\n if (val) {\n\n smbios_add_field(0, offsetof(struct smbios_type_0, vendor_str),\n\n val, strlen(val) + 1);\n\n }\n\n val = qemu_opt_get(opts, \"version\");\n\n if (val) {\n\n smbios_add_field(0, offsetof(struct smbios_type_0, bios_version_str),\n\n val, strlen(val) + 1);\n\n }\n\n val = qemu_opt_get(opts, \"date\");\n\n if (val) {\n\n smbios_add_field(0, offsetof(struct smbios_type_0,\n\n bios_release_date_str),\n\n val, strlen(val) + 1);\n\n }\n\n val = qemu_opt_get(opts, \"release\");\n\n if (val) {\n\n if (sscanf(val, \"%hhu.%hhu\", &major, &minor) != 2) {\n\n error_report(\"Invalid release\");\n\n exit(1);\n\n }\n\n smbios_add_field(0, offsetof(struct smbios_type_0,\n\n system_bios_major_release),\n\n &major, 1);\n\n smbios_add_field(0, offsetof(struct smbios_type_0,\n\n system_bios_minor_release),\n\n &minor, 1);\n\n }\n\n}\n"}} {"sample_id": "b2eb849d4b1fdb6f35d5c46958c7f703cf64cfef_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n \t\t\t\t int lines)\n \n+{\n \n int y;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void cirrus_invalidate_region(CirrusVGAState * s, int off_begin,\n\n\t\t\t\t int off_pitch, int bytesperline,\n\n\t\t\t\t int lines)\n\n{\n\n int y;\n\n int off_cur;\n\n int off_cur_end;\n\n\n\n for (y = 0; y < lines; y++) {\n\n\toff_cur = off_begin;\n\n\toff_cur_end = off_cur + bytesperline;\n\n\toff_cur &= TARGET_PAGE_MASK;\n\n\twhile (off_cur < off_cur_end) {\n\n\t cpu_physical_memory_set_dirty(s->vram_offset + off_cur);\n\n\t off_cur += TARGET_PAGE_SIZE;\n\n\t}\n\n\toff_begin += off_pitch;\n\n }\n\n}\n"}} {"sample_id": "7a05995361a7b4376dffb3c7f04a95644251d29f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,7 +14,7 @@\n \n env = &cpu->env;\n \n+ env->cpu_model_str = cpu_model;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "CPUX86State *cpu_x86_init(const char *cpu_model)\n\n{\n\n X86CPU *cpu;\n\n CPUX86State *env;\n\n static int inited;\n\n\n\n cpu = X86_CPU(object_new(TYPE_X86_CPU));\n\n env = &cpu->env;\n\n env->cpu_model_str = cpu_model;\n\n\n\n /* init various static tables used in TCG mode */\n\n if (tcg_enabled() && !inited) {\n\n inited = 1;\n\n optimize_flags_init();\n\n#ifndef CONFIG_USER_ONLY\n\n prev_debug_excp_handler =\n\n cpu_set_debug_excp_handler(breakpoint_handler);\n\n#endif\n\n }\n\n if (cpu_x86_register(cpu, cpu_model) < 0) {\n\n object_delete(OBJECT(cpu));\n\n return NULL;\n\n }\n\n\n\n qemu_init_vcpu(env);\n\n\n\n return env;\n\n}\n"}} {"sample_id": "e549933a270dd2cfc36f2cf9bb6b29acf3dc6d08_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,6 +6,6 @@\n \n avc_luma_midh_qrt_16w_msa(src - (2 * stride) - 2,\n \n+ stride, dst, stride, 16, 0);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_put_h264_qpel16_mc12_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n avc_luma_midh_qrt_16w_msa(src - (2 * stride) - 2,\n\n stride, dst, stride, 16, 0);\n\n}\n"}} {"sample_id": "773de5c786a6050bbf3b33c0e29d1bd519a40b4b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n uint16_t rc;\n \n BusChild *kid;\n+\n SCLPEvent *event;\n \n SCLPEventClass *ec;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static uint16_t handle_write_event_buf(SCLPEventFacility *ef,\n\n EventBufferHeader *event_buf, SCCB *sccb)\n\n{\n\n uint16_t rc;\n\n BusChild *kid;\n\n SCLPEvent *event;\n\n SCLPEventClass *ec;\n\n\n\n QTAILQ_FOREACH(kid, &ef->sbus.qbus.children, sibling) {\n\n DeviceState *qdev = kid->child;\n\n event = (SCLPEvent *) qdev;\n\n ec = SCLP_EVENT_GET_CLASS(event);\n\n\n\n rc = SCLP_RC_INVALID_FUNCTION;\n\n if (ec->write_event_data &&\n\n ec->event_type() == event_buf->type) {\n\n rc = ec->write_event_data(event, event_buf);\n\n break;\n\n }\n\n }\n\n return rc;\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ s->select &= 0xf0; /* clear head */\n+\n+ /* put signature */\n+\n+ s->nsector = 1;\n \n s->sector = 1;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ide_set_signature(IDEState *s)\n\n{\n\n s->select &= 0xf0; /* clear head */\n\n /* put signature */\n\n s->nsector = 1;\n\n s->sector = 1;\n\n if (s->drive_kind == IDE_CD) {\n\n s->lcyl = 0x14;\n\n s->hcyl = 0xeb;\n\n } else if (s->bs) {\n\n s->lcyl = 0;\n\n s->hcyl = 0;\n\n } else {\n\n s->lcyl = 0xff;\n\n s->hcyl = 0xff;\n\n }\n\n}\n"}} {"sample_id": "f76cfe56d9bc281685c5120bf765d29d9323756f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n \n \n+ tb = env->current_tb;\n+\n+ /* if the cpu is currently executing code, we must unlink it and\n+\n+ all the potentially executing TB */\n \n if (tb && !testandset(&interrupt_lock)) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void cpu_unlink_tb(CPUState *env)\n\n{\n\n#if defined(CONFIG_USE_NPTL)\n\n /* FIXME: TB unchaining isn't SMP safe. For now just ignore the\n\n problem and hope the cpu will stop of its own accord. For userspace\n\n emulation this often isn't actually as bad as it sounds. Often\n\n signals are used primarily to interrupt blocking syscalls. */\n\n#else\n\n TranslationBlock *tb;\n\n static spinlock_t interrupt_lock = SPIN_LOCK_UNLOCKED;\n\n\n\n tb = env->current_tb;\n\n /* if the cpu is currently executing code, we must unlink it and\n\n all the potentially executing TB */\n\n if (tb && !testandset(&interrupt_lock)) {\n\n env->current_tb = NULL;\n\n tb_reset_jump_recursive(tb);\n\n resetlock(&interrupt_lock);\n\n }\n\n#endif\n\n}\n"}} {"sample_id": "662234a9a22f1cd0f0ac83b8bb1ffadedca90c0a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void ff_put_h264_qpel16_mc02_msa(uint8_t *dst, const uint8_t *src,\n \n+ ptrdiff_t stride)\n+\n {\n \n avc_luma_vt_16w_msa(src - (stride * 2), stride, dst, stride, 16);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_put_h264_qpel16_mc02_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n avc_luma_vt_16w_msa(src - (stride * 2), stride, dst, stride, 16);\n\n}\n"}} {"sample_id": "5f706fdc164b20b48254eadf7bd413edace34499_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n+static int s390x_write_all_elf64_notes(const char *note_name,\n \n WriteCoreDumpFunction f,\n \n S390CPU *cpu, int id,\n+\n void *opaque)\n+\n {\n \n Note note;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int s390x_write_all_elf64_notes(const char *note_name,\n\n WriteCoreDumpFunction f,\n\n S390CPU *cpu, int id,\n\n void *opaque)\n\n{\n\n Note note;\n\n const NoteFuncDesc *nf;\n\n int note_size;\n\n int ret = -1;\n\n\n\n for (nf = note_func; nf->note_contents_func; nf++) {\n\n memset(¬e, 0, sizeof(note));\n\n note.hdr.n_namesz = cpu_to_be32(sizeof(note.name));\n\n note.hdr.n_descsz = cpu_to_be32(nf->contents_size);\n\n strncpy(note.name, note_name, sizeof(note.name));\n\n (*nf->note_contents_func)(¬e, cpu);\n\n\n\n note_size = sizeof(note) - sizeof(note.contents) + nf->contents_size;\n\n ret = f(¬e, note_size, opaque);\n\n\n\n if (ret < 0) {\n\n return -1;\n\n }\n\n\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "5fb6c7a8b26eab1a22207d24b4784bd2b39ab54b_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)\n \n {\n+\n+ vs->read_handler = func;\n \n vs->read_handler_expect = expecting;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)\n\n{\n\n vs->read_handler = func;\n\n vs->read_handler_expect = expecting;\n\n}\n"}} {"sample_id": "34fb84a97d112d85091369e9ef9ce177a05644e9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n av_cold int ff_dcaadpcm_init(DCAADPCMEncContext *s)\n {\n+ if (!s)\n+ return -1;\n s->private_data = av_malloc(sizeof(premultiplied_coeffs) * DCA_ADPCM_VQCODEBOOK_SZ);\n precalc(s->private_data);\n return 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "av_cold int ff_dcaadpcm_init(DCAADPCMEncContext *s)\n{\n if (!s)\n return -1;\n s->private_data = av_malloc(sizeof(premultiplied_coeffs) * DCA_ADPCM_VQCODEBOOK_SZ);\n precalc(s->private_data);\n return 0;\n}"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_177", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void special_write(void *opaque, target_phys_addr_t addr,\n+\n uint64_t val, unsigned size)\n \n {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void special_write(void *opaque, target_phys_addr_t addr,\n\n uint64_t val, unsigned size)\n\n{\n\n qemu_log(\"pci: special write cycle\");\n\n}\n"}} {"sample_id": "fd34dbea58e097609ff09cf7dcc59f74930195d3_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int mxf_read_sequence(void *arg, AVIOContext *pb, int tag, int size, UID uid)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int mxf_read_sequence(void *arg, AVIOContext *pb, int tag, int size, UID uid)\n\n{\n\n MXFSequence *sequence = arg;\n\n switch(tag) {\n\n case 0x0202:\n\n sequence->duration = avio_rb64(pb);\n\n break;\n\n case 0x0201:\n\n avio_read(pb, sequence->data_definition_ul, 16);\n\n break;\n\n case 0x1001:\n\n sequence->structural_components_count = avio_rb32(pb);\n\n if (sequence->structural_components_count >= UINT_MAX / sizeof(UID))\n\n return -1;\n\n sequence->structural_components_refs = av_malloc(sequence->structural_components_count * sizeof(UID));\n\n if (!sequence->structural_components_refs)\n\n return -1;\n\n avio_skip(pb, 4); /* useless size of objects, always 16 according to specs */\n\n avio_read(pb, (uint8_t *)sequence->structural_components_refs, sequence->structural_components_count * sizeof(UID));\n\n break;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "73d60fa5fae60c8e07e1f295d8c7fd5d04320160", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void set_sensor_type(IPMIBmcSim *ibs,\n \n uint8_t *cmd, unsigned int cmd_len,\n+\n uint8_t *rsp, unsigned int *rsp_len,\n \n unsigned int max_rsp_len)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void set_sensor_type(IPMIBmcSim *ibs,\n\n uint8_t *cmd, unsigned int cmd_len,\n\n uint8_t *rsp, unsigned int *rsp_len,\n\n unsigned int max_rsp_len)\n\n{\n\n IPMISensor *sens;\n\n\n\n\n\n IPMI_CHECK_CMD_LEN(5);\n\n if ((cmd[2] > MAX_SENSORS) ||\n\n !IPMI_SENSOR_GET_PRESENT(ibs->sensors + cmd[2])) {\n\n rsp[2] = IPMI_CC_REQ_ENTRY_NOT_PRESENT;\n\n return;\n\n }\n\n sens = ibs->sensors + cmd[2];\n\n sens->sensor_type = cmd[3];\n\n sens->evt_reading_type_code = cmd[4] & 0x7f;\n\n}\n"}} {"sample_id": "4d8d5467cd6e324fb49ae97b9d5dcee3973d9a19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n+static uint32_t regtype_to_ss(uint8_t type)\n+\n+{\n \n+ if (type & PCI_BASE_ADDRESS_MEM_TYPE_64) {\n+\n return 3;\n+\n }\n \n if (type == PCI_BASE_ADDRESS_SPACE_IO) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint32_t regtype_to_ss(uint8_t type)\n\n{\n\n if (type & PCI_BASE_ADDRESS_MEM_TYPE_64) {\n\n return 3;\n\n }\n\n if (type == PCI_BASE_ADDRESS_SPACE_IO) {\n\n return 1;\n\n }\n\n return 2;\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static inline void write_mem(IVState *s, uint64_t off,\n \n const void *buf, size_t len)\n+\n {\n \n QTestState *qtest = global_qtest;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void write_mem(IVState *s, uint64_t off,\n\n const void *buf, size_t len)\n\n{\n\n QTestState *qtest = global_qtest;\n\n\n\n global_qtest = s->qtest;\n\n qpci_memwrite(s->dev, s->mem_base + off, buf, len);\n\n global_qtest = qtest;\n\n}\n"}} {"sample_id": "31e51d1c15b35dc98b88a301812914b70a2b55dc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int local_statfs(FsContext *s, V9fsPath *fs_path, struct statfs *stbuf)\n+\n+{\n+\n+ char *buffer;\n+\n+ int ret;\n \n char *path = fs_path->data;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int local_statfs(FsContext *s, V9fsPath *fs_path, struct statfs *stbuf)\n\n{\n\n char *buffer;\n\n int ret;\n\n char *path = fs_path->data;\n\n\n\n buffer = rpath(s, path);\n\n ret = statfs(buffer, stbuf);\n\n g_free(buffer);\n\n return ret;\n\n}\n"}} {"sample_id": "0fca8d24ee00284652eecedaa1f922641cdc59b1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void ff_wms_parse_sdp_a_line(AVFormatContext *s, const char *p)\n \n {\n \n@@ -11,7 +11,7 @@\n int len = strlen(p) * 6 / 8;\n \n char *buf = av_mallocz(len);\n+\n av_base64_decode(buf, p, len);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void ff_wms_parse_sdp_a_line(AVFormatContext *s, const char *p)\n\n{\n\n if (av_strstart(p, \"pgmpu:data:application/vnd.ms.wms-hdr.asfv1;base64,\", &p)) {\n\n ByteIOContext pb;\n\n RTSPState *rt = s->priv_data;\n\n int len = strlen(p) * 6 / 8;\n\n char *buf = av_mallocz(len);\n\n av_base64_decode(buf, p, len);\n\n\n\n if (rtp_asf_fix_header(buf, len) < 0)\n\n av_log(s, AV_LOG_ERROR,\n\n \"Failed to fix invalid RTSP-MS/ASF min_pktsize\\n\");\n\n init_packetizer(&pb, buf, len);\n\n if (rt->asf_ctx) {\n\n av_close_input_stream(rt->asf_ctx);\n\n rt->asf_ctx = NULL;\n\n }\n\n av_open_input_stream(&rt->asf_ctx, &pb, \"\", &asf_demuxer, NULL);\n\n rt->asf_pb_pos = url_ftell(&pb);\n\n av_free(buf);\n\n rt->asf_ctx->pb = NULL;\n\n }\n\n}\n"}} {"sample_id": "2cac260768b9d4253737417ea7501cf2950e257f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -40,11 +40,11 @@\n \n }\n \n+\n+\n+ if (ret < 0) {\n+\n+ return -1;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int write_elf_loads(DumpState *s)\n\n{\n\n hwaddr offset;\n\n MemoryMapping *memory_mapping;\n\n uint32_t phdr_index = 1;\n\n int ret;\n\n uint32_t max_index;\n\n\n\n if (s->have_section) {\n\n max_index = s->sh_info;\n\n } else {\n\n max_index = s->phdr_num;\n\n }\n\n\n\n QTAILQ_FOREACH(memory_mapping, &s->list.head, next) {\n\n offset = get_offset(memory_mapping->phys_addr, s);\n\n if (s->dump_info.d_class == ELFCLASS64) {\n\n ret = write_elf64_load(s, memory_mapping, phdr_index++, offset);\n\n } else {\n\n ret = write_elf32_load(s, memory_mapping, phdr_index++, offset);\n\n }\n\n\n\n if (ret < 0) {\n\n return -1;\n\n }\n\n\n\n if (phdr_index >= max_index) {\n\n break;\n\n }\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "b03c38057b7ac4ffb60fa98a26dd4c8d5fa9c54c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n IscsiLun *iscsilun = bs->opaque;\n \n+ bdi->unallocated_blocks_are_zero = !!iscsilun->lbprz;\n+\n+ bdi->can_write_zeroes_with_unmap = iscsilun->lbprz && iscsilun->lbp.lbpws;\n+\n+ /* Guess the internal cluster (page) size of the iscsi target by the means\n \n * of opt_unmap_gran. Transfer the unmap granularity only if it has a\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int iscsi_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)\n\n{\n\n IscsiLun *iscsilun = bs->opaque;\n\n bdi->unallocated_blocks_are_zero = !!iscsilun->lbprz;\n\n bdi->can_write_zeroes_with_unmap = iscsilun->lbprz && iscsilun->lbp.lbpws;\n\n /* Guess the internal cluster (page) size of the iscsi target by the means\n\n * of opt_unmap_gran. Transfer the unmap granularity only if it has a\n\n * reasonable size for bdi->cluster_size */\n\n if (iscsilun->bl.opt_unmap_gran * iscsilun->block_size >= 64 * 1024 &&\n\n iscsilun->bl.opt_unmap_gran * iscsilun->block_size <= 16 * 1024 * 1024) {\n\n bdi->cluster_size = iscsilun->bl.opt_unmap_gran * iscsilun->block_size;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "8a6b28c7b5104263344508df0f4bce97f22cfcaf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,6 +8,6 @@\n \n gen_exception_internal(excp);\n \n+ s->is_jmp = DISAS_JUMP;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gen_exception_internal_insn(DisasContext *s, int offset, int excp)\n\n{\n\n gen_set_condexec(s);\n\n gen_set_pc_im(s, s->pc - offset);\n\n gen_exception_internal(excp);\n\n s->is_jmp = DISAS_JUMP;\n\n}\n"}} {"sample_id": "b456a71c4a1eb5704d135fd08da9a0de8fd81231", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n SCSIRequest *req = &r->req;\n \n+ SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);\n+\n+ bool start = req->cmd.buf[4] & 1;\n+\n+ bool loej = req->cmd.buf[4] & 2; /* load on start, eject on !start */\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int scsi_disk_emulate_start_stop(SCSIDiskReq *r)\n\n{\n\n SCSIRequest *req = &r->req;\n\n SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);\n\n bool start = req->cmd.buf[4] & 1;\n\n bool loej = req->cmd.buf[4] & 2; /* load on start, eject on !start */\n\n\n\n if (s->qdev.type == TYPE_ROM && loej) {\n\n if (!start && !s->tray_open && s->tray_locked) {\n\n scsi_check_condition(r,\n\n bdrv_is_inserted(s->qdev.conf.bs)\n\n ? SENSE_CODE(ILLEGAL_REQ_REMOVAL_PREVENTED)\n\n : SENSE_CODE(NOT_READY_REMOVAL_PREVENTED));\n\n return -1;\n\n }\n\n\n\n if (s->tray_open != !start) {\n\n bdrv_eject(s->qdev.conf.bs, !start);\n\n s->tray_open = !start;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "7e8c49c56154ab5c45d4f07edf0c22728735da35", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,7 +15,7 @@\n r->req.aiocb = NULL;\n \n bdrv_acct_done(s->qdev.conf.bs, &r->acct);\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void scsi_write_complete(void * opaque, int ret)\n\n{\n\n SCSIDiskReq *r = (SCSIDiskReq *)opaque;\n\n SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);\n\n uint32_t n;\n\n\n\n if (r->req.aiocb != NULL) {\n\n r->req.aiocb = NULL;\n\n bdrv_acct_done(s->qdev.conf.bs, &r->acct);\n\n }\n\n\n\n if (ret < 0) {\n\n if (scsi_handle_rw_error(r, -ret)) {\n\n goto done;\n\n }\n\n }\n\n\n\n n = r->qiov.size / 512;\n\n r->sector += n;\n\n r->sector_count -= n;\n\n if (r->sector_count == 0) {\n\n scsi_req_complete(&r->req, GOOD);\n\n } else {\n\n scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);\n\n DPRINTF(\"Write complete tag=0x%x more=%d\\n\", r->req.tag, r->qiov.size);\n\n scsi_req_data(&r->req, r->qiov.size);\n\n }\n\n\n\ndone:\n\n if (!r->req.io_canceled) {\n\n scsi_req_unref(&r->req);\n\n }\n\n}\n"}} {"sample_id": "4d7c71c36467331f1e0c0f17af9f371d33308a9c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n int ff_audio_rechunk_interleave(AVFormatContext *s, AVPacket *out, AVPacket *pkt, int flush,\n+\n int (*get_packet)(AVFormatContext *, AVPacket *, AVPacket *, int),\n \n int (*compare_ts)(AVFormatContext *, AVPacket *, AVPacket *))\n@@ -13,7 +13,7 @@\n if (pkt) {\n \n AVStream *st = s->streams[pkt->stream_index];\n+\n AudioInterleaveContext *aic = st->priv_data;\n \n if (st->codec->codec_type == AVMEDIA_TYPE_AUDIO) {\n@@ -21,7 +21,7 @@\n unsigned new_size = av_fifo_size(aic->fifo) + pkt->size;\n \n if (new_size > aic->fifo_size) {\n+\n if (av_fifo_realloc2(aic->fifo, new_size) < 0)\n \n return -1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int ff_audio_rechunk_interleave(AVFormatContext *s, AVPacket *out, AVPacket *pkt, int flush,\n\n int (*get_packet)(AVFormatContext *, AVPacket *, AVPacket *, int),\n\n int (*compare_ts)(AVFormatContext *, AVPacket *, AVPacket *))\n\n{\n\n int i;\n\n\n\n if (pkt) {\n\n AVStream *st = s->streams[pkt->stream_index];\n\n AudioInterleaveContext *aic = st->priv_data;\n\n if (st->codec->codec_type == AVMEDIA_TYPE_AUDIO) {\n\n unsigned new_size = av_fifo_size(aic->fifo) + pkt->size;\n\n if (new_size > aic->fifo_size) {\n\n if (av_fifo_realloc2(aic->fifo, new_size) < 0)\n\n return -1;\n\n aic->fifo_size = new_size;\n\n }\n\n av_fifo_generic_write(aic->fifo, pkt->data, pkt->size, NULL);\n\n } else {\n\n // rewrite pts and dts to be decoded time line position\n\n pkt->pts = pkt->dts = aic->dts;\n\n aic->dts += pkt->duration;\n\n ff_interleave_add_packet(s, pkt, compare_ts);\n\n }\n\n pkt = NULL;\n\n }\n\n\n\n for (i = 0; i < s->nb_streams; i++) {\n\n AVStream *st = s->streams[i];\n\n if (st->codec->codec_type == AVMEDIA_TYPE_AUDIO) {\n\n AVPacket new_pkt;\n\n while (ff_interleave_new_audio_packet(s, &new_pkt, i, flush))\n\n ff_interleave_add_packet(s, &new_pkt, compare_ts);\n\n }\n\n }\n\n\n\n return get_packet(s, out, pkt, flush);\n\n}\n"}} {"sample_id": "76f5159d7fc4cdea9574dfbb54307735b280bc66_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static uint32_t msix_mmio_readl(void *opaque, target_phys_addr_t addr)\n \n+{\n \n+ PCIDevice *dev = opaque;\n+\n+ unsigned int offset = addr & (MSIX_PAGE_SIZE - 1);\n \n void *page = dev->msix_table_page;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static uint32_t msix_mmio_readl(void *opaque, target_phys_addr_t addr)\n\n{\n\n PCIDevice *dev = opaque;\n\n unsigned int offset = addr & (MSIX_PAGE_SIZE - 1);\n\n void *page = dev->msix_table_page;\n\n uint32_t val = 0;\n\n\n\n memcpy(&val, (void *)((char *)page + offset), 4);\n\n\n\n return val;\n\n}\n"}} {"sample_id": "e1b42f456fad6e797eaf795ed2e400c4e47d5eb4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n memset(buf, 0, 512);\n \n+ nb_sectors--;\n+\n+ sector_num++;\n+\n+ buf += 512;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int bochs_read(BlockDriverState *bs, int64_t sector_num,\n\n uint8_t *buf, int nb_sectors)\n\n{\n\n int ret;\n\n\n\n while (nb_sectors > 0) {\n\n int64_t block_offset = seek_to_sector(bs, sector_num);\n\n if (block_offset >= 0) {\n\n ret = bdrv_pread(bs->file, block_offset, buf, 512);\n\n if (ret != 512) {\n\n return -1;\n\n }\n\n } else\n\n memset(buf, 0, 512);\n\n nb_sectors--;\n\n sector_num++;\n\n buf += 512;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "c1076c3e13a86140cc2ba29866512df8460cc7c2_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -50,10 +50,10 @@\n \n addr, s->xres, s->yres,\n \n+ src_width, -dest_width, -s->dest_width,\n+\n+ s->invalidated,\n+\n+ fn, s->dma_ch[0].palette, miny, maxy);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pxa2xx_lcdc_dma0_redraw_rot180(PXA2xxLCDState *s,\n\n hwaddr addr, int *miny, int *maxy)\n\n{\n\n DisplaySurface *surface = qemu_console_surface(s->con);\n\n int src_width, dest_width;\n\n drawfn fn = NULL;\n\n if (s->dest_width) {\n\n fn = s->line_fn[s->transp][s->bpp];\n\n }\n\n if (!fn) {\n\n return;\n\n }\n\n\n\n src_width = (s->xres + 3) & ~3; /* Pad to a 4 pixels multiple */\n\n if (s->bpp == pxa_lcdc_19pbpp || s->bpp == pxa_lcdc_18pbpp) {\n\n src_width *= 3;\n\n } else if (s->bpp > pxa_lcdc_16bpp) {\n\n src_width *= 4;\n\n } else if (s->bpp > pxa_lcdc_8bpp) {\n\n src_width *= 2;\n\n }\n\n\n\n dest_width = s->xres * s->dest_width;\n\n *miny = 0;\n\n framebuffer_update_display(surface, s->sysmem,\n\n addr, s->xres, s->yres,\n\n src_width, -dest_width, -s->dest_width,\n\n s->invalidated,\n\n fn, s->dma_ch[0].palette, miny, maxy);\n\n}\n"}} {"sample_id": "aec4b054ea36c53c8b887da99f20010133b84378_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void invalid_array_comma(void)\n+\n {\n \n QObject *obj = qobject_from_json(\"[32,}\", NULL);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void invalid_array_comma(void)\n\n{\n\n QObject *obj = qobject_from_json(\"[32,}\", NULL);\n\n g_assert(obj == NULL);\n\n}\n"}} {"sample_id": "e81a982aa5398269a2cc344091ffa4930bdd242f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n PowerPCCPU *cpu = opaque;\n \n+\n+\n _cpu_ppc_store_hdecr(cpu, 0x00000000, 0xFFFFFFFF, 1);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void cpu_ppc_hdecr_cb(void *opaque)\n\n{\n\n PowerPCCPU *cpu = opaque;\n\n\n\n _cpu_ppc_store_hdecr(cpu, 0x00000000, 0xFFFFFFFF, 1);\n\n}\n"}} {"sample_id": "bfe8043e9214d2fc6572cc72b5f2218308747acd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n BDRVQcowState *s = bs->opaque;\n+\n+ int ret;\n+\n \n+\n qemu_co_mutex_lock(&s->lock);\n \n ret = qcow2_cache_flush(bs, s->l2_table_cache);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static coroutine_fn int qcow2_co_flush_to_os(BlockDriverState *bs)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n int ret;\n\n\n\n qemu_co_mutex_lock(&s->lock);\n\n ret = qcow2_cache_flush(bs, s->l2_table_cache);\n\n if (ret < 0) {\n\n qemu_co_mutex_unlock(&s->lock);\n\n return ret;\n\n }\n\n\n\n ret = qcow2_cache_flush(bs, s->refcount_block_cache);\n\n if (ret < 0) {\n\n qemu_co_mutex_unlock(&s->lock);\n\n return ret;\n\n }\n\n qemu_co_mutex_unlock(&s->lock);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "919f3554387e043bdfe10c6369356d1104882183_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+void ff_decode_dxt3(const uint8_t *s, uint8_t *dst,\n \n const unsigned int w, const unsigned int h,\n \n+ const unsigned int stride) {\n+\n unsigned int bx, by, qstride = stride/4;\n \n uint32_t *d = (uint32_t *) dst;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void ff_decode_dxt3(const uint8_t *s, uint8_t *dst,\n\n const unsigned int w, const unsigned int h,\n\n const unsigned int stride) {\n\n unsigned int bx, by, qstride = stride/4;\n\n uint32_t *d = (uint32_t *) dst;\n\n\n\n for (by=0; by < h/4; by++, d += stride-w)\n\n for (bx=0; bx < w/4; bx++, s+=16, d+=4)\n\n dxt1_decode_pixels(s+8, d, qstride, 1, AV_RL64(s));\n\n}\n"}} {"sample_id": "5ec7d09818881b87052c41259e5cb781683977d2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -60,11 +60,11 @@\n \n NULL, NULL, &error_abort);\n \n+ object_property_set_description(obj, PC_MACHINE_VMPORT,\n+\n+ \"Enable vmport (pc & q35)\",\n+\n+ &error_abort);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pc_machine_initfn(Object *obj)\n\n{\n\n PCMachineState *pcms = PC_MACHINE(obj);\n\n\n\n object_property_add(obj, PC_MACHINE_MEMHP_REGION_SIZE, \"int\",\n\n pc_machine_get_hotplug_memory_region_size,\n\n NULL, NULL, NULL, &error_abort);\n\n\n\n pcms->max_ram_below_4g = 0xe0000000; /* 3.5G */\n\n object_property_add(obj, PC_MACHINE_MAX_RAM_BELOW_4G, \"size\",\n\n pc_machine_get_max_ram_below_4g,\n\n pc_machine_set_max_ram_below_4g,\n\n NULL, NULL, &error_abort);\n\n object_property_set_description(obj, PC_MACHINE_MAX_RAM_BELOW_4G,\n\n \"Maximum ram below the 4G boundary (32bit boundary)\",\n\n &error_abort);\n\n\n\n pcms->smm = ON_OFF_AUTO_AUTO;\n\n object_property_add(obj, PC_MACHINE_SMM, \"OnOffAuto\",\n\n pc_machine_get_smm,\n\n pc_machine_set_smm,\n\n NULL, NULL, &error_abort);\n\n object_property_set_description(obj, PC_MACHINE_SMM,\n\n \"Enable SMM (pc & q35)\",\n\n &error_abort);\n\n\n\n pcms->vmport = ON_OFF_AUTO_AUTO;\n\n object_property_add(obj, PC_MACHINE_VMPORT, \"OnOffAuto\",\n\n pc_machine_get_vmport,\n\n pc_machine_set_vmport,\n\n NULL, NULL, &error_abort);\n\n object_property_set_description(obj, PC_MACHINE_VMPORT,\n\n \"Enable vmport (pc & q35)\",\n\n &error_abort);\n\n\n\n /* nvdimm is disabled on default. */\n\n pcms->acpi_nvdimm_state.is_enabled = false;\n\n object_property_add_bool(obj, PC_MACHINE_NVDIMM, pc_machine_get_nvdimm,\n\n pc_machine_set_nvdimm, &error_abort);\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n control->type = ntohl(control->type);\n \n control->len = ntohl(control->len);\n+\n+ control->repeat = ntohl(control->repeat);\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void network_to_control(RDMAControlHeader *control)\n\n{\n\n control->type = ntohl(control->type);\n\n control->len = ntohl(control->len);\n\n control->repeat = ntohl(control->repeat);\n\n}\n"}} {"sample_id": "eb700029c7836798046191d62d595363d92c84d4_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n \n \n+ iovec_off = 0;\n+\n+ buf_off = 0;\n+\n+ for (i = 0; i < iov_cnt && size; i++) {\n \n if (iov_off < (iovec_off + iov[i].iov_len)) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "net_checksum_add_iov(const struct iovec *iov, const unsigned int iov_cnt,\n\n uint32_t iov_off, uint32_t size)\n\n{\n\n size_t iovec_off, buf_off;\n\n unsigned int i;\n\n uint32_t res = 0;\n\n uint32_t seq = 0;\n\n\n\n iovec_off = 0;\n\n buf_off = 0;\n\n for (i = 0; i < iov_cnt && size; i++) {\n\n if (iov_off < (iovec_off + iov[i].iov_len)) {\n\n size_t len = MIN((iovec_off + iov[i].iov_len) - iov_off , size);\n\n void *chunk_buf = iov[i].iov_base + (iov_off - iovec_off);\n\n\n\n res += net_checksum_add_cont(len, chunk_buf, seq);\n\n seq += len;\n\n\n\n buf_off += len;\n\n iov_off += len;\n\n size -= len;\n\n }\n\n iovec_off += iov[i].iov_len;\n\n }\n\n return res;\n\n}\n"}} {"sample_id": "1cd9a6154bc1ac1193c703cea980ed21c3e53792", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n {\n \n int g, idx = 0;\n+\n+ const int bits = (ics->window_sequence[0] == EIGHT_SHORT_SEQUENCE) ? 3 : 5;\n+\n+ for (g = 0; g < ics->num_window_groups; g++) {\n+\n int k = 0;\n \n while (k < ics->max_sfb) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int decode_band_types(AACContext *ac, enum BandType band_type[120],\n\n int band_type_run_end[120], GetBitContext *gb,\n\n IndividualChannelStream *ics)\n\n{\n\n int g, idx = 0;\n\n const int bits = (ics->window_sequence[0] == EIGHT_SHORT_SEQUENCE) ? 3 : 5;\n\n for (g = 0; g < ics->num_window_groups; g++) {\n\n int k = 0;\n\n while (k < ics->max_sfb) {\n\n uint8_t sect_end = k;\n\n int sect_len_incr;\n\n int sect_band_type = get_bits(gb, 4);\n\n if (sect_band_type == 12) {\n\n av_log(ac->avctx, AV_LOG_ERROR, \"invalid band type\\n\");\n\n return -1;\n\n }\n\n while ((sect_len_incr = get_bits(gb, bits)) == (1 << bits) - 1)\n\n sect_end += sect_len_incr;\n\n sect_end += sect_len_incr;\n\n if (get_bits_left(gb) < 0) {\n\n av_log(ac->avctx, AV_LOG_ERROR, overread_err);\n\n return -1;\n\n }\n\n if (sect_end > ics->max_sfb) {\n\n av_log(ac->avctx, AV_LOG_ERROR,\n\n \"Number of bands (%d) exceeds limit (%d).\\n\",\n\n sect_end, ics->max_sfb);\n\n return -1;\n\n }\n\n for (; k < sect_end; k++) {\n\n band_type [idx] = sect_band_type;\n\n band_type_run_end[idx++] = sect_end;\n\n }\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "c572f23a3e7180dbeab5e86583e43ea2afed6271_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n if (!strcmp(version.data, \"9P2000.u\")) {\n s->proto_version = V9FS_PROTO_2000U;\n } else if (!strcmp(version.data, \"9P2000.L\")) {\n+ s->proto_version = V9FS_PROTO_2000L;\n+ } else {\n+ v9fs_string_sprintf(&version, \"unknown\");\n+ }\n+ offset += pdu_marshal(pdu, offset, \"ds\", s->msize, &version);\n complete_pdu(s, pdu, offset);\n v9fs_string_free(&version);\n return;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void v9fs_version(void *opaque)\n{\n V9fsPDU *pdu = opaque;\n V9fsState *s = pdu->s;\n V9fsString version;\n size_t offset = 7;\n pdu_unmarshal(pdu, offset, \"ds\", &s->msize, &version);\n trace_v9fs_version(pdu->tag, pdu->id, s->msize, version.data);\n if (!strcmp(version.data, \"9P2000.u\")) {\n s->proto_version = V9FS_PROTO_2000U;\n } else if (!strcmp(version.data, \"9P2000.L\")) {\n s->proto_version = V9FS_PROTO_2000L;\n } else {\n v9fs_string_sprintf(&version, \"unknown\");\n }\n offset += pdu_marshal(pdu, offset, \"ds\", s->msize, &version);\n complete_pdu(s, pdu, offset);\n v9fs_string_free(&version);\n return;\n}"}} {"sample_id": "2da0d70d5eebe42f9fcd27ee554419ebe2a5da06_15", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,18 +1,18 @@\n static inline void RENAME(rgb15ToUV)(uint8_t *dstU, uint8_t *dstV, uint8_t *src1, uint8_t *src2, int width)\n+\n+{\n+\n \tint i;\n+\n+ assert(src1 == src2);\n+\n+\tfor(i=0; i>5)&0x03E0F81F);\n\n\n\n\t\tint dh2= (dh>>11) + (dh<<21);\n\n\t\tint d= dh2 + dl;\n\n\n\n\t\tint g= d&0x7F;\n\n\t\tint r= (d>>10)&0x7F;\n\n\t\tint b= d>>21;\n\n\t\tdstU[i]= ((RU*r + GU*g + BU*b)>>(RGB2YUV_SHIFT+1-3)) + 128;\n\n\t\tdstV[i]= ((RV*r + GV*g + BV*b)>>(RGB2YUV_SHIFT+1-3)) + 128;\n\n\t}\n\n}\n"}} {"sample_id": "e2a176dfda32f5cf80703c2921a19fe75850c38c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,10 +5,10 @@\n uint32_t ret;\n \n \n+\n+ ret = taihu_cpld_readb(opaque, addr) << 8;\n+\n+ ret |= taihu_cpld_readb(opaque, addr + 1);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t taihu_cpld_readw (void *opaque, hwaddr addr)\n\n{\n\n uint32_t ret;\n\n\n\n ret = taihu_cpld_readb(opaque, addr) << 8;\n\n ret |= taihu_cpld_readb(opaque, addr + 1);\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "f1d3b99154138741161fc52f5a8c373bf71613c6_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n QGuestAllocator *alloc;\n \n+ void *addr;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void pci_basic(void)\n\n{\n\n QVirtioPCIDevice *dev;\n\n QPCIBus *bus;\n\n QVirtQueuePCI *vqpci;\n\n QGuestAllocator *alloc;\n\n void *addr;\n\n\n\n bus = pci_test_start();\n\n dev = virtio_blk_pci_init(bus, PCI_SLOT);\n\n\n\n alloc = pc_alloc_init();\n\n vqpci = (QVirtQueuePCI *)qvirtqueue_setup(&qvirtio_pci, &dev->vdev,\n\n alloc, 0);\n\n\n\n /* MSI-X is not enabled */\n\n addr = dev->addr + VIRTIO_PCI_CONFIG_OFF(false);\n\n\n\n test_basic(&qvirtio_pci, &dev->vdev, alloc, &vqpci->vq,\n\n (uint64_t)(uintptr_t)addr);\n\n\n\n /* End test */\n\n guest_free(alloc, vqpci->vq.desc);\n\n pc_alloc_uninit(alloc);\n\n qvirtio_pci_device_disable(dev);\n\n g_free(dev);\n\n qpci_free_pc(bus);\n\n test_end();\n\n}\n"}} {"sample_id": "5ba03e2dd785362026917e4cc8a1fd2c64e8e62c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n static char *sysbus_get_fw_dev_path(DeviceState *dev)\n \n+{\n+\n+ SysBusDevice *s = SYS_BUS_DEVICE(dev);\n \n+ char path[40];\n+\n+ int off;\n \n+\n \n off = snprintf(path, sizeof(path), \"%s\", qdev_fw_name(dev));\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static char *sysbus_get_fw_dev_path(DeviceState *dev)\n\n{\n\n SysBusDevice *s = SYS_BUS_DEVICE(dev);\n\n char path[40];\n\n int off;\n\n\n\n off = snprintf(path, sizeof(path), \"%s\", qdev_fw_name(dev));\n\n\n\n if (s->num_mmio) {\n\n snprintf(path + off, sizeof(path) - off, \"@\"TARGET_FMT_plx,\n\n s->mmio[0].addr);\n\n } else if (s->num_pio) {\n\n snprintf(path + off, sizeof(path) - off, \"@i%04x\", s->pio[0]);\n\n }\n\n\n\n return g_strdup(path);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_329", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,9 +6,9 @@\n \n GICState **backref = (GICState **)opaque;\n \n+ GICState *s = *backref;\n+\n+ int id = (backref - s->backref);\n \n return gic_cpu_read(s, id, addr);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t gic_do_cpu_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n GICState **backref = (GICState **)opaque;\n\n GICState *s = *backref;\n\n int id = (backref - s->backref);\n\n return gic_cpu_read(s, id, addr);\n\n}\n"}} {"sample_id": "7f526efd17973ec6d2204f7a47b6923e2be31363_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+void palette8tobgr24(const uint8_t *src, uint8_t *dst, unsigned num_pixels, const uint8_t *palette)\n+\n {\n \n \tunsigned i;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void palette8tobgr24(const uint8_t *src, uint8_t *dst, unsigned num_pixels, const uint8_t *palette)\n\n{\n\n\tunsigned i;\n\n/*\n\n\twrites 1 byte o much and might cause alignment issues on some architectures?\n\n\tfor(i=0; iopc2 != 0xFF) {\n \n if (insn->opc3 != 0xFF) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int register_insn (opc_handler_t **ppc_opcodes, opcode_t *insn)\n\n{\n\n if (insn->opc2 != 0xFF) {\n\n if (insn->opc3 != 0xFF) {\n\n if (register_dblind_insn(ppc_opcodes, insn->opc1, insn->opc2,\n\n insn->opc3, &insn->handler) < 0)\n\n return -1;\n\n } else {\n\n if (register_ind_insn(ppc_opcodes, insn->opc1,\n\n insn->opc2, &insn->handler) < 0)\n\n return -1;\n\n }\n\n } else {\n\n if (register_direct_insn(ppc_opcodes, insn->opc1, &insn->handler) < 0)\n\n return -1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "7d553f27fce284805d7f94603932045ee3bbb979_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n }\n \n+ rc = usb_device_init(dev);\n+\n+ if (rc != 0) {\n+\n+ usb_release_port(dev);\n \n return rc;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int usb_qdev_init(DeviceState *qdev)\n\n{\n\n USBDevice *dev = USB_DEVICE(qdev);\n\n int rc;\n\n\n\n pstrcpy(dev->product_desc, sizeof(dev->product_desc),\n\n usb_device_get_product_desc(dev));\n\n dev->auto_attach = 1;\n\n QLIST_INIT(&dev->strings);\n\n usb_ep_init(dev);\n\n rc = usb_claim_port(dev);\n\n if (rc != 0) {\n\n return rc;\n\n }\n\n rc = usb_device_init(dev);\n\n if (rc != 0) {\n\n usb_release_port(dev);\n\n return rc;\n\n }\n\n if (dev->auto_attach) {\n\n rc = usb_device_attach(dev);\n\n if (rc != 0) {\n\n usb_qdev_exit(qdev);\n\n return rc;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "b227a8e9aa5f27d29f77ba90d5eb9d0662a1175e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static int pte64_check (mmu_ctx_t *ctx,\n \n target_ulong pte0, target_ulong pte1, int h, int rw)\n+\n+{\n \n return _pte_check(ctx, 1, pte0, pte1, h, rw);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pte64_check (mmu_ctx_t *ctx,\n\n target_ulong pte0, target_ulong pte1, int h, int rw)\n\n{\n\n return _pte_check(ctx, 1, pte0, pte1, h, rw);\n\n}\n"}} {"sample_id": "5ff998a233d759d0de83ea6f95c383d03d25d88e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+static uint32_t calc_rice_params(RiceContext *rc, int pmin, int pmax,\n \n+ int32_t *data, int n, int pred_order)\n \n {\n \n+ int i;\n \n uint32_t bits[MAX_PARTITION_ORDER+1];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint32_t calc_rice_params(RiceContext *rc, int pmin, int pmax,\n\n int32_t *data, int n, int pred_order)\n\n{\n\n int i;\n\n uint32_t bits[MAX_PARTITION_ORDER+1];\n\n int opt_porder;\n\n RiceContext tmp_rc;\n\n uint32_t *udata;\n\n uint32_t sums[MAX_PARTITION_ORDER+1][MAX_PARTITIONS];\n\n\n\n assert(pmin >= 0 && pmin <= MAX_PARTITION_ORDER);\n\n assert(pmax >= 0 && pmax <= MAX_PARTITION_ORDER);\n\n assert(pmin <= pmax);\n\n\n\n udata = av_malloc(n * sizeof(uint32_t));\n\n for (i = 0; i < n; i++)\n\n udata[i] = (2*data[i]) ^ (data[i]>>31);\n\n\n\n calc_sums(pmin, pmax, udata, n, pred_order, sums);\n\n\n\n opt_porder = pmin;\n\n bits[pmin] = UINT32_MAX;\n\n for (i = pmin; i <= pmax; i++) {\n\n bits[i] = calc_optimal_rice_params(&tmp_rc, i, sums[i], n, pred_order);\n\n if (bits[i] <= bits[opt_porder]) {\n\n opt_porder = i;\n\n *rc = tmp_rc;\n\n }\n\n }\n\n\n\n av_freep(&udata);\n\n return bits[opt_porder];\n\n}\n"}} {"sample_id": "1181d93231e9b807965724587d363c1cfd5a1d0d_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,5 +7,5 @@\n avc_luma_mid_and_aver_dst_4x4_msa(src - (2 * stride) - 2,\n \n stride, dst, stride);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_avg_h264_qpel4_mc22_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n avc_luma_mid_and_aver_dst_4x4_msa(src - (2 * stride) - 2,\n\n stride, dst, stride);\n\n}\n"}} {"sample_id": "72f0d0bf51362011c4d841a89fb8f5cfb16e0bf3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n static int mp_dacl_removexattr(FsContext *ctx,\n+\n+ const char *path, const char *name)\n+\n+{\n \n int ret;\n \n char *buffer;\n+\n+\n \n buffer = rpath(ctx, path);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int mp_dacl_removexattr(FsContext *ctx,\n\n const char *path, const char *name)\n\n{\n\n int ret;\n\n char *buffer;\n\n\n\n buffer = rpath(ctx, path);\n\n ret = lremovexattr(buffer, MAP_ACL_DEFAULT);\n\n if (ret == -1 && errno == ENODATA) {\n\n /*\n\n * We don't get ENODATA error when trying to remove a\n\n * posix acl that is not present. So don't throw the error\n\n * even in case of mapped security model\n\n */\n\n errno = 0;\n\n ret = 0;\n\n }\n\n g_free(buffer);\n\n return ret;\n\n}\n"}} {"sample_id": "594026277250fecf0ba34c9e1498921936c6bfed", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,10 +18,10 @@\n \n s->idct_put= arm_idct_put;\n \n+ s->idct_add= arm_idct_add;\n+\n+ s->idct_permutation_type= FF_NO_IDCT_PERM;\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void MPV_common_init_armv4l(MpegEncContext *s)\n\n{\n\n int i;\n\n const int idct_algo= s->avctx->idct_algo;\n\n\n\n ff_put_pixels_clamped = s->avctx->dsp.put_pixels_clamped;\n\n ff_add_pixels_clamped = s->avctx->dsp.put_pixels_clamped;\n\n\n\n if(idct_algo==FF_IDCT_AUTO || idct_algo==FF_IDCT_ARM){\n\n s->idct_put= arm_idct_put;\n\n s->idct_add= arm_idct_add;\n\n s->idct_permutation_type= FF_NO_IDCT_PERM;\n\n }\n\n}\n"}} {"sample_id": "0a73336d96397c80881219d080518fac6f1ecacb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n+static int net_vhost_chardev_opts(void *opaque,\n+\n+ const char *name, const char *value,\n+\n+ Error **errp)\n+\n+{\n \n+ VhostUserChardevProps *props = opaque;\n+\n \n+\n if (strcmp(name, \"backend\") == 0 && strcmp(value, \"socket\") == 0) {\n \n props->is_socket = true;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int net_vhost_chardev_opts(void *opaque,\n\n const char *name, const char *value,\n\n Error **errp)\n\n{\n\n VhostUserChardevProps *props = opaque;\n\n\n\n if (strcmp(name, \"backend\") == 0 && strcmp(value, \"socket\") == 0) {\n\n props->is_socket = true;\n\n } else if (strcmp(name, \"path\") == 0) {\n\n props->is_unix = true;\n\n } else if (strcmp(name, \"server\") == 0) {\n\n } else {\n\n error_setg(errp,\n\n \"vhost-user does not support a chardev with option %s=%s\",\n\n name, value);\n\n return -1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "45bbbb466cf4a6280076ea5a51f67ef5bedee345_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void div64(uint64_t *plow, uint64_t *phigh, uint64_t b)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void div64(uint64_t *plow, uint64_t *phigh, uint64_t b)\n\n{\n\n uint64_t q, r, a1, a0;\n\n int i, qb;\n\n\n\n a0 = *plow;\n\n a1 = *phigh;\n\n if (a1 == 0) {\n\n q = a0 / b;\n\n r = a0 % b;\n\n *plow = q;\n\n *phigh = r;\n\n } else {\n\n /* XXX: use a better algorithm */\n\n for(i = 0; i < 64; i++) {\n\n a1 = (a1 << 1) | (a0 >> 63);\n\n if (a1 >= b) {\n\n a1 -= b;\n\n qb = 1;\n\n } else {\n\n qb = 0;\n\n }\n\n a0 = (a0 << 1) | qb;\n\n }\n\n#if defined(DEBUG_MULDIV)\n\n printf(\"div: 0x%016llx%016llx / 0x%016llx: q=0x%016llx r=0x%016llx\\n\",\n\n *phigh, *plow, b, a0, a1);\n\n#endif\n\n *plow = a0;\n\n *phigh = a1;\n\n }\n\n}\n"}} {"sample_id": "8ac55351459055f2faee585d9ba2f84707741815_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n HDACodecDevice *dev = HDA_CODEC_DEVICE(qdev);\n+\n+ HDACodecDeviceClass *cdc = HDA_CODEC_DEVICE_GET_CLASS(dev);\n+\n+\n \n if (cdc->exit) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int hda_codec_dev_exit(DeviceState *qdev)\n\n{\n\n HDACodecDevice *dev = HDA_CODEC_DEVICE(qdev);\n\n HDACodecDeviceClass *cdc = HDA_CODEC_DEVICE_GET_CLASS(dev);\n\n\n\n if (cdc->exit) {\n\n cdc->exit(dev);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "e5fda03839e3c61b01d6c60de5625501d01c69d0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n static int bt_hci_name_req(struct bt_hci_s *hci, bdaddr_t *bdaddr)\n \n {\n+\n struct bt_device_s *slave;\n \n evt_remote_name_req_complete params;\n \n int len;\n \n+\n+\n for (slave = hci->device.net->slave; slave; slave = slave->next)\n \n if (slave->page_scan && !bacmp(&slave->bd_addr, bdaddr))", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int bt_hci_name_req(struct bt_hci_s *hci, bdaddr_t *bdaddr)\n\n{\n\n struct bt_device_s *slave;\n\n evt_remote_name_req_complete params;\n\n int len;\n\n\n\n for (slave = hci->device.net->slave; slave; slave = slave->next)\n\n if (slave->page_scan && !bacmp(&slave->bd_addr, bdaddr))\n\n break;\n\n if (!slave)\n\n return -ENODEV;\n\n\n\n bt_hci_event_status(hci, HCI_SUCCESS);\n\n\n\n params.status = HCI_SUCCESS;\n\n bacpy(¶ms.bdaddr, &slave->bd_addr);\n\n len = snprintf(params.name, sizeof(params.name),\n\n \"%s\", slave->lmp_name ?: \"\");\n\n memset(params.name + len, 0, sizeof(params.name) - len);\n\n bt_hci_event(hci, EVT_REMOTE_NAME_REQ_COMPLETE,\n\n ¶ms, EVT_REMOTE_NAME_REQ_COMPLETE_SIZE);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a1f48480497bb462c5d1d589ae393335f50b06e0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n for (i = 0; i < width; i++)\n \n+ ssim += ssim_end1(sum0[i][0] + sum0[i + 1][0] + sum1[i][0] + sum1[i + 1][0],\n+\n+ sum0[i][1] + sum0[i + 1][1] + sum1[i][1] + sum1[i + 1][1],\n+\n+ sum0[i][2] + sum0[i + 1][2] + sum1[i][2] + sum1[i + 1][2],\n \n sum0[i][3] + sum0[i + 1][3] + sum1[i][3] + sum1[i + 1][3]);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static float ssim_end4(int sum0[5][4], int sum1[5][4], int width)\n\n{\n\n float ssim = 0.0;\n\n int i;\n\n\n\n for (i = 0; i < width; i++)\n\n ssim += ssim_end1(sum0[i][0] + sum0[i + 1][0] + sum1[i][0] + sum1[i + 1][0],\n\n sum0[i][1] + sum0[i + 1][1] + sum1[i][1] + sum1[i + 1][1],\n\n sum0[i][2] + sum0[i + 1][2] + sum1[i][2] + sum1[i + 1][2],\n\n sum0[i][3] + sum0[i + 1][3] + sum1[i][3] + sum1[i + 1][3]);\n\n return ssim;\n\n}\n"}} {"sample_id": "7faa8075d898ae56d2c533c530569bb25ab86eaf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void disable_device(PIIX4PMState *s, int slot)\n \n+{\n \n s->ar.gpe.sts[0] |= PIIX4_PCI_HOTPLUG_STATUS;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void disable_device(PIIX4PMState *s, int slot)\n\n{\n\n s->ar.gpe.sts[0] |= PIIX4_PCI_HOTPLUG_STATUS;\n\n s->pci0_status.down |= (1 << slot);\n\n}\n"}} {"sample_id": "69c8944f17cb6c084567a16c080cfa7bc780e668", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n pci_config_set_device_id(d->card.config, PCI_DEVICE_ID_INTEL_82801IR);\n \n \n+\n pci_config_set_class(d->card.config, PCI_CLASS_STORAGE_SATA);\n \n pci_config_set_revision(d->card.config, 0x02);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int pci_ich9_ahci_init(PCIDevice *dev)\n\n{\n\n struct AHCIPCIState *d;\n\n d = DO_UPCAST(struct AHCIPCIState, card, dev);\n\n\n\n pci_config_set_vendor_id(d->card.config, PCI_VENDOR_ID_INTEL);\n\n pci_config_set_device_id(d->card.config, PCI_DEVICE_ID_INTEL_82801IR);\n\n\n\n pci_config_set_class(d->card.config, PCI_CLASS_STORAGE_SATA);\n\n pci_config_set_revision(d->card.config, 0x02);\n\n pci_config_set_prog_interface(d->card.config, AHCI_PROGMODE_MAJOR_REV_1);\n\n\n\n d->card.config[PCI_CACHE_LINE_SIZE] = 0x08; /* Cache line size */\n\n d->card.config[PCI_LATENCY_TIMER] = 0x00; /* Latency timer */\n\n pci_config_set_interrupt_pin(d->card.config, 1);\n\n\n\n /* XXX Software should program this register */\n\n d->card.config[0x90] = 1 << 6; /* Address Map Register - AHCI mode */\n\n\n\n qemu_register_reset(ahci_reset, d);\n\n\n\n /* XXX BAR size should be 1k, but that breaks, so bump it to 4k for now */\n\n pci_register_bar_simple(&d->card, 5, 0x1000, 0, d->ahci.mem);\n\n\n\n msi_init(dev, 0x50, 1, true, false);\n\n\n\n ahci_init(&d->ahci, &dev->qdev, 6);\n\n d->ahci.irq = d->card.irq[0];\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "42a8dadc74f8982fc269e54e3c5627b54d9f83d8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n \n \n VIRTIO_GPU_FILL_CMD(info);\n+\n+\n+\n+\n+ if (info.capset_index == 0) {\n \n resp.capset_id = VIRTIO_GPU_CAPSET_VIRGL;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void virgl_cmd_get_capset_info(VirtIOGPU *g,\n\n struct virtio_gpu_ctrl_command *cmd)\n\n{\n\n struct virtio_gpu_get_capset_info info;\n\n struct virtio_gpu_resp_capset_info resp;\n\n\n\n VIRTIO_GPU_FILL_CMD(info);\n\n\n\n\n if (info.capset_index == 0) {\n\n resp.capset_id = VIRTIO_GPU_CAPSET_VIRGL;\n\n virgl_renderer_get_cap_set(resp.capset_id,\n\n &resp.capset_max_version,\n\n &resp.capset_max_size);\n\n } else {\n\n resp.capset_max_version = 0;\n\n resp.capset_max_size = 0;\n\n }\n\n resp.hdr.type = VIRTIO_GPU_RESP_OK_CAPSET_INFO;\n\n virtio_gpu_ctrl_response(g, cmd, &resp.hdr, sizeof(resp));\n\n}"}} {"sample_id": "ce5b1bbf624b977a55ff7f85bb3871682d03baff_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n CPUState *cs = CPU(obj);\n \n+ LM32CPU *cpu = LM32_CPU(obj);\n \n CPULM32State *env = &cpu->env;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void lm32_cpu_initfn(Object *obj)\n\n{\n\n CPUState *cs = CPU(obj);\n\n LM32CPU *cpu = LM32_CPU(obj);\n\n CPULM32State *env = &cpu->env;\n\n static bool tcg_initialized;\n\n\n\n cs->env_ptr = env;\n\n cpu_exec_init(cs, &error_abort);\n\n\n\n env->flags = 0;\n\n\n\n if (tcg_enabled() && !tcg_initialized) {\n\n tcg_initialized = true;\n\n lm32_translate_init();\n\n }\n\n}\n"}} {"sample_id": "77cb0f5aafc8e6d0c6d3c339f381c9b7921648e0_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n+static void adb_kbd_class_init(ObjectClass *oc, void *data)\n+\n+{\n+\n+ DeviceClass *dc = DEVICE_CLASS(oc);\n+\n+ ADBDeviceClass *adc = ADB_DEVICE_CLASS(oc);\n+\n+ ADBKeyboardClass *akc = ADB_KEYBOARD_CLASS(oc);\n+\n \n \n akc->parent_realize = dc->realize;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void adb_kbd_class_init(ObjectClass *oc, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(oc);\n\n ADBDeviceClass *adc = ADB_DEVICE_CLASS(oc);\n\n ADBKeyboardClass *akc = ADB_KEYBOARD_CLASS(oc);\n\n\n\n akc->parent_realize = dc->realize;\n\n dc->realize = adb_kbd_realizefn;\n\n set_bit(DEVICE_CATEGORY_INPUT, dc->categories);\n\n\n\n adc->devreq = adb_kbd_request;\n\n dc->reset = adb_kbd_reset;\n\n dc->vmsd = &vmstate_adb_kbd;\n\n}\n"}} {"sample_id": "1f001dc7bc9e435bf231a5b0edcad1c7c2bd6214_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,10 +5,10 @@\n IOHandler *fd_read,\n \n IOHandler *fd_write,\n+\n+ void *opaque)\n+\n+\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int default_qemu_set_fd_handler2(int fd,\n\n IOCanReadHandler *fd_read_poll,\n\n IOHandler *fd_read,\n\n IOHandler *fd_write,\n\n void *opaque)\n\n\n\n{\n\n abort();\n\n}\n"}} {"sample_id": "b2bedb214469af55179d907a60cd67fed6b0779e_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n \n \n \t/* make attack rate & decay rate tables */\n+\n+\tfor (i = 0;i < 4;i++) OPL->AR_TABLE[i] = OPL->DR_TABLE[i] = 0;\n+\n+\tfor (i = 4;i <= 60;i++){\n+\n \t\trate = OPL->freqbase;\t\t\t\t\t\t/* frequency rate */\n \n \t\tif( i < 60 ) rate *= 1.0+(i&3)*0.25;\t\t/* b0-1 : x1 , x1.25 , x1.5 , x1.75 */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void init_timetables( FM_OPL *OPL , int ARRATE , int DRRATE )\n\n{\n\n\tint i;\n\n\tdouble rate;\n\n\n\n\t/* make attack rate & decay rate tables */\n\n\tfor (i = 0;i < 4;i++) OPL->AR_TABLE[i] = OPL->DR_TABLE[i] = 0;\n\n\tfor (i = 4;i <= 60;i++){\n\n\t\trate = OPL->freqbase;\t\t\t\t\t\t/* frequency rate */\n\n\t\tif( i < 60 ) rate *= 1.0+(i&3)*0.25;\t\t/* b0-1 : x1 , x1.25 , x1.5 , x1.75 */\n\n\t\trate *= 1<<((i>>2)-1);\t\t\t\t\t\t/* b2-5 : shift bit */\n\n\t\trate *= (double)(EG_ENT<AR_TABLE[i] = rate / ARRATE;\n\n\t\tOPL->DR_TABLE[i] = rate / DRRATE;\n\n\t}\n\n\tfor (i = 60; i < ARRAY_SIZE(OPL->AR_TABLE); i++)\n\n\t{\n\n\t\tOPL->AR_TABLE[i] = EG_AED-1;\n\n\t\tOPL->DR_TABLE[i] = OPL->DR_TABLE[60];\n\n\t}\n\n#if 0\n\n\tfor (i = 0;i < 64 ;i++){\t/* make for overflow area */\n\n\t\tLOG(LOG_WAR,(\"rate %2d , ar %f ms , dr %f ms \\n\",i,\n\n\t\t\t((double)(EG_ENT<AR_TABLE[i]) * (1000.0 / OPL->rate),\n\n\t\t\t((double)(EG_ENT<DR_TABLE[i]) * (1000.0 / OPL->rate) ));\n\n\t}\n\n#endif\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_133", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n qemu_check_nic_model(nd, \"mcf_fec\");\n \n \n+\n+ s = (mcf_fec_state *)g_malloc0(sizeof(mcf_fec_state));\n+\n+ s->sysmem = sysmem;\n+\n s->irq = irq;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void mcf_fec_init(MemoryRegion *sysmem, NICInfo *nd,\n\n target_phys_addr_t base, qemu_irq *irq)\n\n{\n\n mcf_fec_state *s;\n\n\n\n qemu_check_nic_model(nd, \"mcf_fec\");\n\n\n\n s = (mcf_fec_state *)g_malloc0(sizeof(mcf_fec_state));\n\n s->sysmem = sysmem;\n\n s->irq = irq;\n\n\n\n memory_region_init_io(&s->iomem, &mcf_fec_ops, s, \"fec\", 0x400);\n\n memory_region_add_subregion(sysmem, base, &s->iomem);\n\n\n\n s->conf.macaddr = nd->macaddr;\n\n s->conf.peer = nd->netdev;\n\n\n\n s->nic = qemu_new_nic(&net_mcf_fec_info, &s->conf, nd->model, nd->name, s);\n\n\n\n qemu_format_nic_info_str(&s->nic->nc, s->conf.macaddr.a);\n\n}\n"}} {"sample_id": "5a446bc88e49cc6400d0c646ca1eb540a727c9de", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,8 +11,8 @@\n int rnd = 1;\n \n for(i = 0; i < 8; i++) {\n+\n+ a = src[-2];\n \n b = src[-1];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void vc1_h_overlap_c(uint8_t* src, int stride)\n\n{\n\n int i;\n\n int a, b, c, d;\n\n int d1, d2;\n\n int rnd = 1;\n\n for(i = 0; i < 8; i++) {\n\n a = src[-2];\n\n b = src[-1];\n\n c = src[0];\n\n d = src[1];\n\n d1 = (a - d + 3 + rnd) >> 3;\n\n d2 = (a - d + b - c + 4 - rnd) >> 3;\n\n\n\n src[-2] = a - d1;\n\n src[-1] = b - d2;\n\n src[0] = c + d2;\n\n src[1] = d + d1;\n\n src += stride;\n\n rnd = !rnd;\n\n }\n\n}\n"}} {"sample_id": "69b8d83ecf5f6deb9ad94bdaa816aa205430d3e9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,7 +19,7 @@\n int w = inlink->w;\n \n int h = inlink->h;\n+\n int r = gf->radius;\n \n if (p) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void end_frame(AVFilterLink *inlink)\n\n{\n\n GradFunContext *gf = inlink->dst->priv;\n\n AVFilterBufferRef *inpic = inlink->cur_buf;\n\n AVFilterLink *outlink = inlink->dst->outputs[0];\n\n AVFilterBufferRef *outpic = outlink->out_buf;\n\n int p;\n\n\n\n for (p = 0; p < 4 && inpic->data[p]; p++) {\n\n int w = inlink->w;\n\n int h = inlink->h;\n\n int r = gf->radius;\n\n if (p) {\n\n w = gf->chroma_w;\n\n h = gf->chroma_h;\n\n r = gf->chroma_r;\n\n }\n\n\n\n if (FFMIN(w, h) > 2 * r)\n\n filter(gf, outpic->data[p], inpic->data[p], w, h, outpic->linesize[p], inpic->linesize[p], r);\n\n else if (outpic->data[p] != inpic->data[p])\n\n av_image_copy_plane(outpic->data[p], outpic->linesize[p], inpic->data[p], inpic->linesize[p], w, h);\n\n }\n\n\n\n avfilter_draw_slice(outlink, 0, inlink->h, 1);\n\n avfilter_end_frame(outlink);\n\n avfilter_unref_buffer(inpic);\n\n avfilter_unref_buffer(outpic);\n\n}\n"}} {"sample_id": "4a2594ddd35de7ae7c8cd9c6828cfe72245e6dc5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n int abort_on_failure)\n \n+{\n \n QemuOpts *opts;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "int qemu_opts_foreach(QemuOptsList *list, qemu_opts_loopfunc func, void *opaque,\n\n int abort_on_failure)\n\n{\n\n QemuOpts *opts;\n\n int rc = 0;\n\n\n\n QTAILQ_FOREACH(opts, &list->head, next) {\n\n rc = func(opts, opaque);\n\n if (abort_on_failure && rc != 0)\n\n break;\n\n }\n\n return rc;\n\n}\n"}} {"sample_id": "4d1172472cdf28a444321ca8b165ce7326eb919e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n f->iov[f->iovcnt++].iov_len = size;\n \n }\n+\n+\n+\n+ if (f->buf_index >= IO_BUF_SIZE || f->iovcnt >= MAX_IOV_SIZE) {\n+\n qemu_fflush(f);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void add_to_iovec(QEMUFile *f, const uint8_t *buf, int size)\n\n{\n\n /* check for adjacent buffer and coalesce them */\n\n if (f->iovcnt > 0 && buf == f->iov[f->iovcnt - 1].iov_base +\n\n f->iov[f->iovcnt - 1].iov_len) {\n\n f->iov[f->iovcnt - 1].iov_len += size;\n\n } else {\n\n f->iov[f->iovcnt].iov_base = (uint8_t *)buf;\n\n f->iov[f->iovcnt++].iov_len = size;\n\n }\n\n\n\n if (f->buf_index >= IO_BUF_SIZE || f->iovcnt >= MAX_IOV_SIZE) {\n\n qemu_fflush(f);\n\n }\n\n}\n"}} {"sample_id": "5cd5e7015962d8d559afb5154888fd34a8526ddd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,8 +18,8 @@\n \n g_free(shpc->wmask);\n \n+ g_free(shpc->w1cmask);\n+\n+ g_free(shpc);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void shpc_cleanup(PCIDevice *d, MemoryRegion *bar)\n\n{\n\n SHPCDevice *shpc = d->shpc;\n\n d->cap_present &= ~QEMU_PCI_CAP_SHPC;\n\n memory_region_del_subregion(bar, &shpc->mmio);\n\n object_unparent(OBJECT(&shpc->mmio));\n\n /* TODO: cleanup config space changes? */\n\n g_free(shpc->config);\n\n g_free(shpc->cmask);\n\n g_free(shpc->wmask);\n\n g_free(shpc->w1cmask);\n\n g_free(shpc);\n\n}\n"}} {"sample_id": "af19f78f2fe2b969104d4419efd25fdee90a2814_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n clear_blocks = clear_blocks_mmi;\n+\n+ \n+\n+ put_pixels_tab[1][0] = put_pixels8_mmi;\n+\n put_no_rnd_pixels_tab[1][0] = put_pixels8_mmi;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void dsputil_init_mmi(void)\n\n{\n\n clear_blocks = clear_blocks_mmi;\n\n \n\n put_pixels_tab[1][0] = put_pixels8_mmi;\n\n put_no_rnd_pixels_tab[1][0] = put_pixels8_mmi;\n\n \n\n put_pixels_tab[0][0] = put_pixels16_mmi;\n\n put_no_rnd_pixels_tab[0][0] = put_pixels16_mmi;\n\n \n\n get_pixels = get_pixels_mmi;\n\n}\n"}} {"sample_id": "21a933ea33c820515f331c162c9f7053ca6f4129_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n {\n \n+ const char *name = qemu_opt_get(opts, \"name\");\n+\n+\n+\n+ if (name == NULL) {\n \n error_setg(errp, \"chardev: spice channel: no name given\");\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_chr_parse_spice_vmc(QemuOpts *opts, ChardevBackend *backend,\n\n Error **errp)\n\n{\n\n const char *name = qemu_opt_get(opts, \"name\");\n\n\n\n if (name == NULL) {\n\n error_setg(errp, \"chardev: spice channel: no name given\");\n\n return;\n\n }\n\n backend->u.spicevmc = g_new0(ChardevSpiceChannel, 1);\n\n backend->u.spicevmc->type = g_strdup(name);\n\n}\n"}} {"sample_id": "d368ba4376b2c1c24175c74b3733b8fe64dbe8a6_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void sdhci_class_init(ObjectClass *klass, void *data)\n \n {\n+\n+ DeviceClass *dc = DEVICE_CLASS(klass);\n+\n+ SDHCIClass *k = SDHCI_CLASS(klass);\n+\n \n \n dc->vmsd = &sdhci_vmstate;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void sdhci_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n SDHCIClass *k = SDHCI_CLASS(klass);\n\n\n\n dc->vmsd = &sdhci_vmstate;\n\n dc->props = sdhci_properties;\n\n dc->reset = sdhci_generic_reset;\n\n dc->realize = sdhci_realize;\n\n\n\n k->reset = sdhci_reset;\n\n k->mem_read = sdhci_read;\n\n k->mem_write = sdhci_write;\n\n k->send_command = sdhci_send_command;\n\n k->can_issue_command = sdhci_can_issue_command;\n\n k->data_transfer = sdhci_data_transfer;\n\n k->end_data_transfer = sdhci_end_transfer;\n\n k->do_sdma_single = sdhci_sdma_transfer_single_block;\n\n k->do_sdma_multi = sdhci_sdma_transfer_multi_blocks;\n\n k->do_adma = sdhci_do_adma;\n\n k->read_block_from_card = sdhci_read_block_from_card;\n\n k->write_block_to_card = sdhci_write_block_to_card;\n\n k->bdata_read = sdhci_read_dataport;\n\n k->bdata_write = sdhci_write_dataport;\n\n}\n"}} {"sample_id": "65899fe34b09ab4af4b045977460b531ec5c1f73", "diff": "--- a/source.c\n+++ b/source.c\n@@ -63,11 +63,11 @@\n case 1:\n \n s->dmaregs[0] |= DMA_LOADED;\n+\n+ break;\n+\n+ default:\n+\n break;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void dma_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)\n\n{\n\n DMAState *s = opaque;\n\n uint32_t saddr;\n\n\n\n saddr = (addr & DMA_MASK) >> 2;\n\n DPRINTF(\"write dmareg \" TARGET_FMT_plx \": 0x%8.8x -> 0x%8.8x\\n\", addr,\n\n s->dmaregs[saddr], val);\n\n switch (saddr) {\n\n case 0:\n\n if (val & DMA_INTREN) {\n\n if (val & DMA_INTR) {\n\n DPRINTF(\"Raise IRQ\\n\");\n\n qemu_irq_raise(s->irq);\n\n }\n\n } else {\n\n if (s->dmaregs[0] & (DMA_INTR | DMA_INTREN)) {\n\n DPRINTF(\"Lower IRQ\\n\");\n\n qemu_irq_lower(s->irq);\n\n }\n\n }\n\n if (val & DMA_RESET) {\n\n qemu_irq_raise(s->dev_reset);\n\n qemu_irq_lower(s->dev_reset);\n\n } else if (val & DMA_DRAIN_FIFO) {\n\n val &= ~DMA_DRAIN_FIFO;\n\n } else if (val == 0)\n\n val = DMA_DRAIN_FIFO;\n\n val &= 0x0fffffff;\n\n val |= DMA_VER;\n\n break;\n\n case 1:\n\n s->dmaregs[0] |= DMA_LOADED;\n\n break;\n\n default:\n\n break;\n\n }\n\n s->dmaregs[saddr] = val;\n\n}\n"}} {"sample_id": "630530a6529bc3da9ab8aead7053dc753cb9ac77_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n int nb_sectors, int *pnum)\n \n+{\n \n BDRVVmdkState *s = bs->opaque;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int vmdk_is_allocated(BlockDriverState *bs, int64_t sector_num, \n\n int nb_sectors, int *pnum)\n\n{\n\n BDRVVmdkState *s = bs->opaque;\n\n int index_in_cluster, n;\n\n uint64_t cluster_offset;\n\n\n\n cluster_offset = get_cluster_offset(bs, sector_num << 9, 0);\n\n index_in_cluster = sector_num % s->cluster_sectors;\n\n n = s->cluster_sectors - index_in_cluster;\n\n if (n > nb_sectors)\n\n n = nb_sectors;\n\n *pnum = n;\n\n return (cluster_offset != 0);\n\n}\n"}} {"sample_id": "27bb0b2d6f80f058bdb6fcc8fcdfa69b0c8a6d71_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,17 +1,17 @@\n static void update_irq(struct HPETTimer *timer)\n+\n {\n \n+ qemu_irq irq;\n+\n int route;\n+\n \n+\n+ if (timer->tn <= 1 && hpet_in_legacy_mode()) {\n \n+ /* if LegacyReplacementRoute bit is set, HPET specification requires\n+\n * timer0 be routed to IRQ0 in NON-APIC or IRQ2 in the I/O APIC,\n \n * timer1 be routed to IRQ8 in NON-APIC or IRQ8 in the I/O APIC.", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void update_irq(struct HPETTimer *timer)\n\n{\n\n qemu_irq irq;\n\n int route;\n\n\n\n if (timer->tn <= 1 && hpet_in_legacy_mode()) {\n\n /* if LegacyReplacementRoute bit is set, HPET specification requires\n\n * timer0 be routed to IRQ0 in NON-APIC or IRQ2 in the I/O APIC,\n\n * timer1 be routed to IRQ8 in NON-APIC or IRQ8 in the I/O APIC.\n\n */\n\n if (timer->tn == 0) {\n\n irq=timer->state->irqs[0];\n\n } else\n\n irq=timer->state->irqs[8];\n\n } else {\n\n route=timer_int_route(timer);\n\n irq=timer->state->irqs[route];\n\n }\n\n if (timer_enabled(timer) && hpet_enabled()) {\n\n qemu_irq_pulse(irq);\n\n }\n\n}\n"}} {"sample_id": "f5e717f3c735af5c941b458d42615c97028aa916", "diff": "--- a/source.c\n+++ b/source.c\n@@ -47,11 +47,11 @@\n \n closesocket(server_fd);\n \n+ return -1;\n+\n+ }\n+\n+ ff_socket_nonblock(server_fd, 1);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int socket_open_listen(struct sockaddr_in *my_addr)\n\n{\n\n int server_fd, tmp;\n\n\n\n server_fd = socket(AF_INET,SOCK_STREAM,0);\n\n if (server_fd < 0) {\n\n perror (\"socket\");\n\n return -1;\n\n }\n\n\n\n tmp = 1;\n\n setsockopt(server_fd, SOL_SOCKET, SO_REUSEADDR, &tmp, sizeof(tmp));\n\n\n\n\n if (bind (server_fd, (struct sockaddr *) my_addr, sizeof (*my_addr)) < 0) {\n\n char bindmsg[32];\n\n snprintf(bindmsg, sizeof(bindmsg), \"bind(port %d)\", ntohs(my_addr->sin_port));\n\n perror (bindmsg);\n\n closesocket(server_fd);\n\n return -1;\n\n }\n\n\n\n if (listen (server_fd, 5) < 0) {\n\n perror (\"listen\");\n\n closesocket(server_fd);\n\n return -1;\n\n }\n\n ff_socket_nonblock(server_fd, 1);\n\n\n\n return server_fd;\n\n}"}} {"sample_id": "6bdcc018a6ed760b9dfe43539124e420aed83092_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n NBDReply reply;\n \n+ ssize_t ret;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int nbd_client_co_flush(BlockDriverState *bs)\n\n{\n\n NBDClientSession *client = nbd_get_client_session(bs);\n\n NBDRequest request = { .type = NBD_CMD_FLUSH };\n\n NBDReply reply;\n\n ssize_t ret;\n\n\n\n if (!(client->nbdflags & NBD_FLAG_SEND_FLUSH)) {\n\n return 0;\n\n }\n\n\n\n request.from = 0;\n\n request.len = 0;\n\n\n\n nbd_coroutine_start(client, &request);\n\n ret = nbd_co_send_request(bs, &request, NULL);\n\n if (ret < 0) {\n\n reply.error = -ret;\n\n } else {\n\n nbd_co_receive_reply(client, &request, &reply, NULL);\n\n }\n\n nbd_coroutine_end(bs, &request);\n\n return -reply.error;\n\n}\n"}} {"sample_id": "6ad1fa5a49320c101a62d24aa0e7df14c10d7612", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,10 +5,10 @@\n ff_add_pixels_clamped = c->add_pixels_clamped;\n if(idct_algo==FF_IDCT_ARM){\n if(idct_algo==FF_IDCT_AUTO || idct_algo==FF_IDCT_ARM){\n+ c->idct_put= j_rev_dct_ARM_put;\n+ c->idct_add= j_rev_dct_ARM_add;\n+\tc->idct = j_rev_dct_ARM;\n+ c->idct_permutation_type= FF_LIBMPEG2_IDCT_PERM;/* FF_NO_IDCT_PERM */\n } else if (idct_algo==FF_IDCT_SIMPLEARM){\n \tc->idct_put= simple_idct_ARM_put;\n \tc->idct_add= simple_idct_ARM_add;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void dsputil_init_armv4l(DSPContext* c, AVCodecContext *avctx)\n{\n const int idct_algo= avctx->idct_algo;\n ff_put_pixels_clamped = c->put_pixels_clamped;\n ff_add_pixels_clamped = c->add_pixels_clamped;\n if(idct_algo==FF_IDCT_ARM){\n if(idct_algo==FF_IDCT_AUTO || idct_algo==FF_IDCT_ARM){\n c->idct_put= j_rev_dct_ARM_put;\n c->idct_add= j_rev_dct_ARM_add;\n\tc->idct = j_rev_dct_ARM;\n c->idct_permutation_type= FF_LIBMPEG2_IDCT_PERM;/* FF_NO_IDCT_PERM */\n } else if (idct_algo==FF_IDCT_SIMPLEARM){\n\tc->idct_put= simple_idct_ARM_put;\n\tc->idct_add= simple_idct_ARM_add;\n\tc->idct = simple_idct_ARM;\n }\n}"}} {"sample_id": "af7e9e74c6a62a5bcd911726a9e88d28b61490e0_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void openpic_irq_raise(OpenPICState *opp, int n_CPU, IRQ_src_t *src)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void openpic_irq_raise(OpenPICState *opp, int n_CPU, IRQ_src_t *src)\n\n{\n\n int n_ci = IDR_CI0_SHIFT - n_CPU;\n\n\n\n if ((opp->flags & OPENPIC_FLAG_IDE_CRIT) && (src->ide & (1 << n_ci))) {\n\n qemu_irq_raise(opp->dst[n_CPU].irqs[OPENPIC_OUTPUT_CINT]);\n\n } else {\n\n qemu_irq_raise(opp->dst[n_CPU].irqs[OPENPIC_OUTPUT_INT]);\n\n }\n\n}\n"}} {"sample_id": "0ccabeeaef77e240f2a44f78271a8914a23e239b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,8 +12,8 @@\n \n perms & AV_PERM_REUSE ? \"u\" : \"\",\n \n+ perms & AV_PERM_REUSE2 ? \"U\" : \"\");\n+\n+ return buf;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "char *ff_get_ref_perms_string(char *buf, size_t buf_size, int perms)\n\n{\n\n snprintf(buf, buf_size, \"%s%s%s%s%s\",\n\n perms & AV_PERM_READ ? \"r\" : \"\",\n\n perms & AV_PERM_WRITE ? \"w\" : \"\",\n\n perms & AV_PERM_PRESERVE ? \"p\" : \"\",\n\n perms & AV_PERM_REUSE ? \"u\" : \"\",\n\n perms & AV_PERM_REUSE2 ? \"U\" : \"\");\n\n return buf;\n\n}\n"}} {"sample_id": "2dda635410e95843562e5257a8f173e7115a7a1e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n \n \n cpu_list_add(cpu);\n+\n+\n+\n+ if (tcg_enabled() && !cc->tcg_initialized) {\n+\n cc->tcg_initialized = true;\n \n cc->tcg_initialize();", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void cpu_exec_realizefn(CPUState *cpu, Error **errp)\n\n{\n\n CPUClass *cc = CPU_GET_CLASS(cpu);\n\n\n\n cpu_list_add(cpu);\n\n\n\n if (tcg_enabled() && !cc->tcg_initialized) {\n\n cc->tcg_initialized = true;\n\n cc->tcg_initialize();\n\n }\n\n\n\n#ifndef CONFIG_USER_ONLY\n\n if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {\n\n vmstate_register(NULL, cpu->cpu_index, &vmstate_cpu_common, cpu);\n\n }\n\n if (cc->vmsd != NULL) {\n\n vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu);\n\n }\n\n#endif\n\n}\n"}} {"sample_id": "64d7e9a421fea0ac50b44541f5521de455e7cd5d_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,5 +5,5 @@\n PITChannelState *s = &pit->channels[channel];\n \n return pit_get_out1(s, current_time);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int pit_get_out(PITState *pit, int channel, int64_t current_time)\n\n{\n\n PITChannelState *s = &pit->channels[channel];\n\n return pit_get_out1(s, current_time);\n\n}\n"}} {"sample_id": "de0587739011b7636743251a86d48bcd10ab7c22", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n AVRational frame_rate_q;\n \n \n+\n+ memset(frei0r->params, 0, sizeof(frei0r->params));\n+\n+\n+\n if (args)\n \n sscanf(args, \"%127[^:]:%127[^:]:%1023[^:=]%c%255c\",", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int source_init(AVFilterContext *ctx, const char *args, void *opaque)\n\n{\n\n Frei0rContext *frei0r = ctx->priv;\n\n char dl_name[1024], c;\n\n char frame_size[128] = \"\";\n\n char frame_rate[128] = \"\";\n\n AVRational frame_rate_q;\n\n\n\n memset(frei0r->params, 0, sizeof(frei0r->params));\n\n\n\n if (args)\n\n sscanf(args, \"%127[^:]:%127[^:]:%1023[^:=]%c%255c\",\n\n frame_size, frame_rate, dl_name, &c, frei0r->params);\n\n\n\n if (av_parse_video_size(&frei0r->w, &frei0r->h, frame_size) < 0) {\n\n av_log(ctx, AV_LOG_ERROR, \"Invalid frame size: '%s'\\n\", frame_size);\n\n return AVERROR(EINVAL);\n\n }\n\n\n\n if (av_parse_video_rate(&frame_rate_q, frame_rate) < 0 ||\n\n frame_rate_q.den <= 0 || frame_rate_q.num <= 0) {\n\n av_log(ctx, AV_LOG_ERROR, \"Invalid frame rate: '%s'\\n\", frame_rate);\n\n return AVERROR(EINVAL);\n\n }\n\n frei0r->time_base.num = frame_rate_q.den;\n\n frei0r->time_base.den = frame_rate_q.num;\n\n\n\n return frei0r_init(ctx, dl_name, F0R_PLUGIN_TYPE_SOURCE);\n\n}\n"}} {"sample_id": "af9ec3dd1d9e90ec8134b01074b7beb01a1beb1a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n }\n fmt = NULL;\n while ((fmt1 = av_iformat_next(fmt1))) {\n+ if (!is_opened == !(fmt1->flags & AVFMT_NOFILE))\n+ continue;\n+ score = 0;\n+ if (fmt1->read_probe) {\n+ score = fmt1->read_probe(&lpd);\n if(fmt1->extensions && av_match_ext(lpd.filename, fmt1->extensions))\n score = FFMAX(score, nodat ? AVPROBE_SCORE_MAX/4-1 : 1);\n } else if (fmt1->extensions) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "AVInputFormat *av_probe_input_format3(AVProbeData *pd, int is_opened, int *score_ret)\n{\n AVProbeData lpd = *pd;\n AVInputFormat *fmt1 = NULL, *fmt;\n int score, nodat = 0, score_max=0;\n if (lpd.buf_size > 10 && ff_id3v2_match(lpd.buf, ID3v2_DEFAULT_MAGIC)) {\n int id3len = ff_id3v2_tag_len(lpd.buf);\n if (lpd.buf_size > id3len + 16) {\n lpd.buf += id3len;\n lpd.buf_size -= id3len;\n }else\n nodat = 1;\n }\n fmt = NULL;\n while ((fmt1 = av_iformat_next(fmt1))) {\n if (!is_opened == !(fmt1->flags & AVFMT_NOFILE))\n continue;\n score = 0;\n if (fmt1->read_probe) {\n score = fmt1->read_probe(&lpd);\n if(fmt1->extensions && av_match_ext(lpd.filename, fmt1->extensions))\n score = FFMAX(score, nodat ? AVPROBE_SCORE_MAX/4-1 : 1);\n } else if (fmt1->extensions) {\n if (av_match_ext(lpd.filename, fmt1->extensions)) {\n score = 50;\n }\n }\n if (score > score_max) {\n score_max = score;\n fmt = fmt1;\n }else if (score == score_max)\n fmt = NULL;\n }\n *score_ret= score_max;\n return fmt;\n}"}} {"sample_id": "a5b8dd2ce83208cd7d6eb4562339ecf5aae13574_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void dmg_refresh_limits(BlockDriverState *bs, Error **errp)\n+\n {\n \n bs->request_alignment = BDRV_SECTOR_SIZE; /* No sub-sector I/O supported */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void dmg_refresh_limits(BlockDriverState *bs, Error **errp)\n\n{\n\n bs->request_alignment = BDRV_SECTOR_SIZE; /* No sub-sector I/O supported */\n\n}\n"}} {"sample_id": "808fb9f277abda16601e9db938d29aeaf2548585", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n struct xlx_ethlite *s = DO_UPCAST(NICState, nc, nc)->opaque;\n \n int r;\n+\n+ r = !(s->regs[R_RX_CTRL0] & CTRL_S);\n+\n return r;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int eth_can_rx(NetClientState *nc)\n\n{\n\n struct xlx_ethlite *s = DO_UPCAST(NICState, nc, nc)->opaque;\n\n int r;\n\n r = !(s->regs[R_RX_CTRL0] & CTRL_S);\n\n return r;\n\n}\n"}} {"sample_id": "84c202cc37024bd78261e4222e46631ea73c48dd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n \n \n+ for(i=0; i<256;){\n \n repeat= get_bits(gb, 3);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int read_len_table(uint8_t *dst, GetBitContext *gb){\n\n int i, val, repeat;\n\n\n\n for(i=0; i<256;){\n\n repeat= get_bits(gb, 3);\n\n val = get_bits(gb, 5);\n\n if(repeat==0)\n\n repeat= get_bits(gb, 8);\n\n//printf(\"%d %d\\n\", val, repeat);\n\n if(i+repeat > 256) {\n\n av_log(NULL, AV_LOG_ERROR, \"Error reading huffman table\\n\");\n\n return -1;\n\n }\n\n while (repeat--)\n\n dst[i++] = val;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "4c19eb721a5929f2277d33a98bb59963c58c2e3b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,10 +13,10 @@\n QTAILQ_REMOVE(&address_spaces, as, address_spaces_link);\n \n address_space_destroy_dispatch(as);\n+\n+ flatview_destroy(as->current_map);\n+\n+ g_free(as->current_map);\n+\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void address_space_destroy(AddressSpace *as)\n\n{\n\n /* Flush out anything from MemoryListeners listening in on this */\n\n memory_region_transaction_begin();\n\n as->root = NULL;\n\n memory_region_transaction_commit();\n\n QTAILQ_REMOVE(&address_spaces, as, address_spaces_link);\n\n address_space_destroy_dispatch(as);\n\n flatview_destroy(as->current_map);\n\n g_free(as->current_map);\n\n\n}"}} {"sample_id": "94fb0909645de18481cc726ee0ec9b5afa861394_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,22 +1,22 @@\n+static int ram_decompress_buf(RamDecompressState *s, uint8_t *buf, int len)\n+\n+{\n+\n+ int ret, clen;\n+\n+\n+\n+ s->zstream.avail_out = len;\n+\n+ s->zstream.next_out = buf;\n+\n while (s->zstream.avail_out > 0) {\n+\n+ if (s->zstream.avail_in == 0) {\n+\n if (qemu_get_be16(s->f) != RAM_CBLOCK_MAGIC)\n \n+ return -1;\n \n clen = qemu_get_be16(s->f);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int ram_decompress_buf(RamDecompressState *s, uint8_t *buf, int len)\n\n{\n\n int ret, clen;\n\n\n\n s->zstream.avail_out = len;\n\n s->zstream.next_out = buf;\n\n while (s->zstream.avail_out > 0) {\n\n if (s->zstream.avail_in == 0) {\n\n if (qemu_get_be16(s->f) != RAM_CBLOCK_MAGIC)\n\n return -1;\n\n clen = qemu_get_be16(s->f);\n\n if (clen > IOBUF_SIZE)\n\n return -1;\n\n qemu_get_buffer(s->f, s->buf, clen);\n\n s->zstream.avail_in = clen;\n\n s->zstream.next_in = s->buf;\n\n }\n\n ret = inflate(&s->zstream, Z_PARTIAL_FLUSH);\n\n if (ret != Z_OK && ret != Z_STREAM_END) {\n\n return -1;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "7ac2f7e413051aa6ff735a8b9c47ca06dc4607d9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -35,11 +35,11 @@\n \"\\033[%d;3%dm%s\\033[0m\",\n \n (color[level] >> 4) & 15,\n+\n+ color[level] & 15,\n+\n+ str);\n+\n } else if (tint && use_color == 256) {\n \n fprintf(stderr,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void colored_fputs(int level, int tint, const char *str)\n\n{\n\n if (!*str)\n\n return;\n\n\n\n if (use_color < 0)\n\n check_color_terminal();\n\n\n\n#if defined(_WIN32) && !defined(__MINGW32CE__) && HAVE_SETCONSOLETEXTATTRIBUTE\n\n if (use_color && level != AV_LOG_INFO/8)\n\n SetConsoleTextAttribute(con, background | color[level]);\n\n fputs(str, stderr);\n\n if (use_color && level != AV_LOG_INFO/8)\n\n SetConsoleTextAttribute(con, attr_orig);\n\n#else\n\n if (use_color == 1 && level != AV_LOG_INFO/8) {\n\n fprintf(stderr,\n\n \"\\033[%d;3%dm%s\\033[0m\",\n\n (color[level] >> 4) & 15,\n\n color[level] & 15,\n\n str);\n\n } else if (tint && use_color == 256) {\n\n fprintf(stderr,\n\n \"\\033[48;5;%dm\\033[38;5;%dm%s\\033[0m\",\n\n (color[level] >> 16) & 0xff,\n\n tint,\n\n str);\n\n } else if (use_color == 256 && level != AV_LOG_INFO/8) {\n\n fprintf(stderr,\n\n \"\\033[48;5;%dm\\033[38;5;%dm%s\\033[0m\",\n\n (color[level] >> 16) & 0xff,\n\n (color[level] >> 8) & 0xff,\n\n str);\n\n } else\n\n fputs(str, stderr);\n\n#endif\n\n\n\n}\n"}} {"sample_id": "eae74cf906942999bf70e94f034f95c7f831ec63", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n \n \n+ qemu_cond_broadcast(env->halt_cond);\n+\n+ if (!env->thread_kicked) {\n+\n qemu_cpu_kick_thread(env);\n \n env->thread_kicked = true;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_cpu_kick(void *_env)\n\n{\n\n CPUState *env = _env;\n\n\n\n qemu_cond_broadcast(env->halt_cond);\n\n if (!env->thread_kicked) {\n\n qemu_cpu_kick_thread(env);\n\n env->thread_kicked = true;\n\n }\n\n}\n"}} {"sample_id": "2d0d2837dcf786da415cf4165d37f4ddd684ff57_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n \n \n g_free(filename);\n+\n+\n+\n+ if (opts == NULL) {\n+\n return;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pc_fw_add_pflash_drv(void)\n\n{\n\n QemuOpts *opts;\n\n QEMUMachine *machine;\n\n char *filename;\n\n\n\n if (bios_name == NULL) {\n\n bios_name = BIOS_FILENAME;\n\n }\n\n filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);\n\n\n\n opts = drive_add(IF_PFLASH, -1, filename, \"readonly=on\");\n\n\n\n g_free(filename);\n\n\n\n if (opts == NULL) {\n\n return;\n\n }\n\n\n\n machine = find_default_machine();\n\n if (machine == NULL) {\n\n return;\n\n }\n\n\n\n if (!drive_init(opts, machine->use_scsi)) {\n\n qemu_opts_del(opts);\n\n }\n\n}\n"}} {"sample_id": "ad0ebb91cd8b5fdc4a583b03645677771f420a46_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+int spapr_tce_dma_zero(VIOsPAPRDevice *dev, uint64_t taddr, uint32_t size)\n+\n+{\n+\n+ /* FIXME: allocating a temp buffer is nasty, but just stepping\n \n * through writing zeroes is awkward. This will do for now. */\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int spapr_tce_dma_zero(VIOsPAPRDevice *dev, uint64_t taddr, uint32_t size)\n\n{\n\n /* FIXME: allocating a temp buffer is nasty, but just stepping\n\n * through writing zeroes is awkward. This will do for now. */\n\n uint8_t zeroes[size];\n\n\n\n#ifdef DEBUG_TCE\n\n fprintf(stderr, \"spapr_tce_dma_zero taddr=0x%llx size=0x%x\\n\",\n\n (unsigned long long)taddr, size);\n\n#endif\n\n\n\n memset(zeroes, 0, size);\n\n return spapr_tce_dma_write(dev, taddr, zeroes, size);\n\n}\n"}} {"sample_id": "ea60a11e8e2d818e8e56da4da3ff38e23a12bdff", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static int mov_write_gmhd_tag(AVIOContext *pb)\n+\n+{\n+\n+ avio_wb32(pb, 0x20); /* size */\n \n ffio_wfourcc(pb, \"gmhd\");\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mov_write_gmhd_tag(AVIOContext *pb)\n\n{\n\n avio_wb32(pb, 0x20); /* size */\n\n ffio_wfourcc(pb, \"gmhd\");\n\n avio_wb32(pb, 0x18); /* gmin size */\n\n ffio_wfourcc(pb, \"gmin\");/* generic media info */\n\n avio_wb32(pb, 0); /* version & flags */\n\n avio_wb16(pb, 0x40); /* graphics mode = */\n\n avio_wb16(pb, 0x8000); /* opColor (r?) */\n\n avio_wb16(pb, 0x8000); /* opColor (g?) */\n\n avio_wb16(pb, 0x8000); /* opColor (b?) */\n\n avio_wb16(pb, 0); /* balance */\n\n avio_wb16(pb, 0); /* reserved */\n\n return 0x20;\n\n}\n"}} {"sample_id": "9588ec340c3f33c7474b4cd2893046cfdaee42bf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -37,11 +37,11 @@\n \n \n if( nza > 0 )\n+\n+ ctx++;\n+\n+\n+\n if( nzb > 0 )\n \n ctx += 2;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline int get_cabac_cbf_ctx( H264Context *h, int cat, int idx ) {\n\n int nza, nzb;\n\n int ctx = 0;\n\n\n\n if( cat == 0 ) {\n\n nza = h->left_cbp&0x100;\n\n nzb = h-> top_cbp&0x100;\n\n } else if( cat == 1 || cat == 2 ) {\n\n nza = h->non_zero_count_cache[scan8[idx] - 1];\n\n nzb = h->non_zero_count_cache[scan8[idx] - 8];\n\n } else if( cat == 3 ) {\n\n nza = (h->left_cbp>>(6+idx))&0x01;\n\n nzb = (h-> top_cbp>>(6+idx))&0x01;\n\n } else {\n\n assert(cat == 4);\n\n nza = h->non_zero_count_cache[scan8[16+idx] - 1];\n\n nzb = h->non_zero_count_cache[scan8[16+idx] - 8];\n\n }\n\n\n\n if( nza > 0 )\n\n ctx++;\n\n\n\n if( nzb > 0 )\n\n ctx += 2;\n\n\n\n return ctx + 4 * cat;\n\n}\n"}} {"sample_id": "7f87af39dc786a979e7ebba338d0781e366060ed", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n int ram_size)\n \n+{\n+\n+ int isa_bios_size;\n \n MemoryRegion *isa_bios;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void pc_isa_bios_init(MemoryRegion *rom_memory,\n\n MemoryRegion *flash_mem,\n\n int ram_size)\n\n{\n\n int isa_bios_size;\n\n MemoryRegion *isa_bios;\n\n uint64_t flash_size;\n\n void *flash_ptr, *isa_bios_ptr;\n\n\n\n flash_size = memory_region_size(flash_mem);\n\n\n\n /* map the last 128KB of the BIOS in ISA space */\n\n isa_bios_size = flash_size;\n\n if (isa_bios_size > (128 * 1024)) {\n\n isa_bios_size = 128 * 1024;\n\n }\n\n isa_bios = g_malloc(sizeof(*isa_bios));\n\n memory_region_init_ram(isa_bios, NULL, \"isa-bios\", isa_bios_size);\n\n vmstate_register_ram_global(isa_bios);\n\n memory_region_add_subregion_overlap(rom_memory,\n\n 0x100000 - isa_bios_size,\n\n isa_bios,\n\n 1);\n\n\n\n /* copy ISA rom image from top of flash memory */\n\n flash_ptr = memory_region_get_ram_ptr(flash_mem);\n\n isa_bios_ptr = memory_region_get_ram_ptr(isa_bios);\n\n memcpy(isa_bios_ptr,\n\n ((uint8_t*)flash_ptr) + (flash_size - isa_bios_size),\n\n isa_bios_size);\n\n\n\n memory_region_set_readonly(isa_bios, true);\n\n}\n"}} {"sample_id": "1ec26c757d5996468afcc0dced4fad04139574b3_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void kvmppc_pivot_hpt_cpu(CPUState *cs, run_on_cpu_data arg)\n+\n+{\n+\n+ target_ulong sdr1 = arg.target_ptr;\n+\n PowerPCCPU *cpu = POWERPC_CPU(cs);\n \n CPUPPCState *env = &cpu->env;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void kvmppc_pivot_hpt_cpu(CPUState *cs, run_on_cpu_data arg)\n\n{\n\n target_ulong sdr1 = arg.target_ptr;\n\n PowerPCCPU *cpu = POWERPC_CPU(cs);\n\n CPUPPCState *env = &cpu->env;\n\n\n\n /* This is just for the benefit of PR KVM */\n\n cpu_synchronize_state(cs);\n\n env->spr[SPR_SDR1] = sdr1;\n\n if (kvmppc_put_books_sregs(cpu) < 0) {\n\n error_report(\"Unable to update SDR1 in KVM\");\n\n exit(1);\n\n }\n\n}\n"}} {"sample_id": "4d73cd3b3f55fcff433ce64b125b7adb8aaece29", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static int drive_add(const char *file, const char *fmt, ...)\n \n {\n \n va_list ap;\n+\n int index = drive_opt_get_free_idx();\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int drive_add(const char *file, const char *fmt, ...)\n\n{\n\n va_list ap;\n\n int index = drive_opt_get_free_idx();\n\n\n\n if (nb_drives_opt >= MAX_DRIVES || index == -1) {\n\n fprintf(stderr, \"qemu: too many drives\\n\");\n\n exit(1);\n\n }\n\n\n\n drives_opt[index].file = file;\n\n va_start(ap, fmt);\n\n vsnprintf(drives_opt[index].opt,\n\n sizeof(drives_opt[0].opt), fmt, ap);\n\n va_end(ap);\n\n\n\n nb_drives_opt++;\n\n return index;\n\n}\n"}} {"sample_id": "2da0d70d5eebe42f9fcd27ee554419ebe2a5da06_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,18 +1,18 @@\n static inline void RENAME(bgr16ToUV)(uint8_t *dstU, uint8_t *dstV, uint8_t *src1, uint8_t *src2, int width)\n+\n+{\n+\n \tint i;\n+\n+ assert(src1==src2);\n+\n+\tfor(i=0; i>5)&0x07C0F83F);\n\n\n\n\t\tint dh2= (dh>>11) + (dh<<21);\n\n\t\tint d= dh2 + dl;\n\n\n\n\t\tint b= d&0x7F;\n\n\t\tint r= (d>>11)&0x7F;\n\n\t\tint g= d>>21;\n\n\t\tdstU[i]= ((2*RU*r + GU*g + 2*BU*b)>>(RGB2YUV_SHIFT+1-2)) + 128;\n\n\t\tdstV[i]= ((2*RV*r + GV*g + 2*BV*b)>>(RGB2YUV_SHIFT+1-2)) + 128;\n\n\t}\n\n}\n"}} {"sample_id": "dd44d9e316c17f473eff9f4a5a94ad0d7adb157e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int decode_extradata(ADTSContext *adts, uint8_t *buf, int size)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int decode_extradata(ADTSContext *adts, uint8_t *buf, int size)\n\n{\n\n GetBitContext gb;\n\n\n\n init_get_bits(&gb, buf, size * 8);\n\n adts->objecttype = get_bits(&gb, 5) - 1;\n\n adts->sample_rate_index = get_bits(&gb, 4);\n\n adts->channel_conf = get_bits(&gb, 4);\n\n\n\n adts->write_adts = 1;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "c9b83e9c23ecb094ddf987c7c37b8f454cb80615", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n error_setg_errno(errp, -ret,\n \n+ \"Cannot allocate cluster for LUKS header size %zu\",\n+\n+ headerlen);\n+\n+ return -1;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static ssize_t qcow2_crypto_hdr_init_func(QCryptoBlock *block, size_t headerlen,\n\n void *opaque, Error **errp)\n\n{\n\n BlockDriverState *bs = opaque;\n\n BDRVQcow2State *s = bs->opaque;\n\n int64_t ret;\n\n int64_t clusterlen;\n\n\n\n ret = qcow2_alloc_clusters(bs, headerlen);\n\n if (ret < 0) {\n\n error_setg_errno(errp, -ret,\n\n \"Cannot allocate cluster for LUKS header size %zu\",\n\n headerlen);\n\n return -1;\n\n }\n\n\n\n s->crypto_header.length = headerlen;\n\n s->crypto_header.offset = ret;\n\n\n\n /* Zero fill remaining space in cluster so it has predictable\n\n * content in case of future spec changes */\n\n clusterlen = size_to_clusters(s, headerlen) * s->cluster_size;\n\n\n ret = bdrv_pwrite_zeroes(bs->file,\n\n ret + headerlen,\n\n clusterlen - headerlen, 0);\n\n if (ret < 0) {\n\n error_setg_errno(errp, -ret, \"Could not zero fill encryption header\");\n\n return -1;\n\n }\n\n\n\n return ret;\n\n}"}} {"sample_id": "5331773cc33ba26b9e26ace643d926219e46a17b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n return;\n \n+\n+\n+ ff_id3v2_read(s, ID3v2_DEFAULT_MAGIC, &id3v2_extra_meta);\n+\n+ if (id3v2_extra_meta)\n \n ff_id3v2_parse_apic(s, &id3v2_extra_meta);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void read_id3(AVFormatContext *s, uint64_t id3pos)\n\n{\n\n ID3v2ExtraMeta *id3v2_extra_meta = NULL;\n\n if (avio_seek(s->pb, id3pos, SEEK_SET) < 0)\n\n return;\n\n\n\n ff_id3v2_read(s, ID3v2_DEFAULT_MAGIC, &id3v2_extra_meta);\n\n if (id3v2_extra_meta)\n\n ff_id3v2_parse_apic(s, &id3v2_extra_meta);\n\n ff_id3v2_free_extra_meta(&id3v2_extra_meta);\n\n}\n"}} {"sample_id": "0919ac787641db11024912651f3bc5764d4f1286_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n \n \n /* Attach a menelaus PM chip */\n+\n+ dev = i2c_create_slave(s->i2c, \"twl92230\", N8X0_MENELAUS_ADDR);\n+\n+ qdev_connect_gpio_out(dev, 3, s->cpu->irq[0][OMAP_INT_24XX_SYS_NIRQ]);\n+\n \n \n /* Attach a TMP105 PM chip (A0 wired to ground) */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void n8x0_i2c_setup(struct n800_s *s)\n\n{\n\n DeviceState *dev;\n\n qemu_irq tmp_irq = qdev_get_gpio_in(s->cpu->gpio, N8X0_TMP105_GPIO);\n\n\n\n /* Attach the CPU on one end of our I2C bus. */\n\n s->i2c = omap_i2c_bus(s->cpu->i2c[0]);\n\n\n\n /* Attach a menelaus PM chip */\n\n dev = i2c_create_slave(s->i2c, \"twl92230\", N8X0_MENELAUS_ADDR);\n\n qdev_connect_gpio_out(dev, 3, s->cpu->irq[0][OMAP_INT_24XX_SYS_NIRQ]);\n\n\n\n /* Attach a TMP105 PM chip (A0 wired to ground) */\n\n dev = i2c_create_slave(s->i2c, \"tmp105\", N8X0_TMP105_ADDR);\n\n qdev_connect_gpio_out(dev, 0, tmp_irq);\n\n}\n"}} {"sample_id": "18e80c55bb6ec17c05ec0ba717ec83933c2bfc07", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n }\n \n+ if (shift) {\n+\n+ unsigned long unshifted = reserved_va;\n+\n+ p++;\n \n reserved_va <<= shift;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void handle_arg_reserved_va(const char *arg)\n\n{\n\n char *p;\n\n int shift = 0;\n\n reserved_va = strtoul(arg, &p, 0);\n\n switch (*p) {\n\n case 'k':\n\n case 'K':\n\n shift = 10;\n\n break;\n\n case 'M':\n\n shift = 20;\n\n break;\n\n case 'G':\n\n shift = 30;\n\n break;\n\n }\n\n if (shift) {\n\n unsigned long unshifted = reserved_va;\n\n p++;\n\n reserved_va <<= shift;\n\n if (((reserved_va >> shift) != unshifted)\n\n#if HOST_LONG_BITS > TARGET_VIRT_ADDR_SPACE_BITS\n\n || (reserved_va > (1ul << TARGET_VIRT_ADDR_SPACE_BITS))\n\n#endif\n\n ) {\n\n fprintf(stderr, \"Reserved virtual address too big\\n\");\n\n exit(EXIT_FAILURE);\n\n }\n\n }\n\n if (*p) {\n\n fprintf(stderr, \"Unrecognised -R size suffix '%s'\\n\", p);\n\n exit(EXIT_FAILURE);\n\n }\n\n}\n"}} {"sample_id": "12848bfc5d719bad536c5448205a3226be1fda47_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n \n \n+ /* Determine the security model */\n+\n if (fs_ctx->fs_sm == SM_MAPPED) {\n+\n err = mknod(rpath(fs_ctx, path), SM_LOCAL_MODE_BITS|S_IFREG, 0);\n \n if (err == -1) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int local_mknod(FsContext *fs_ctx, const char *path, FsCred *credp)\n\n{\n\n int err = -1;\n\n int serrno = 0;\n\n\n\n /* Determine the security model */\n\n if (fs_ctx->fs_sm == SM_MAPPED) {\n\n err = mknod(rpath(fs_ctx, path), SM_LOCAL_MODE_BITS|S_IFREG, 0);\n\n if (err == -1) {\n\n return err;\n\n }\n\n local_set_xattr(rpath(fs_ctx, path), credp);\n\n if (err == -1) {\n\n serrno = errno;\n\n goto err_end;\n\n }\n\n } else if (fs_ctx->fs_sm == SM_PASSTHROUGH) {\n\n err = mknod(rpath(fs_ctx, path), credp->fc_mode, credp->fc_rdev);\n\n if (err == -1) {\n\n return err;\n\n }\n\n err = local_post_create_passthrough(fs_ctx, path, credp);\n\n if (err == -1) {\n\n serrno = errno;\n\n goto err_end;\n\n }\n\n }\n\n return err;\n\n\n\nerr_end:\n\n remove(rpath(fs_ctx, path));\n\n errno = serrno;\n\n return err;\n\n}\n"}} {"sample_id": "8caa05d8891d0a09dc4c00908c24c6ddfd872bbe", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n bool timerlist_has_timers(QEMUTimerList *timer_list)\n+\n {\n \n return !!timer_list->active_timers;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool timerlist_has_timers(QEMUTimerList *timer_list)\n\n{\n\n return !!timer_list->active_timers;\n\n}\n"}} {"sample_id": "5331773cc33ba26b9e26ace643d926219e46a17b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n off = avio_tell(pb);\n \n ret = avio_read(pb, buf, ID3v2_HEADER_SIZE);\n+\n+ if (ret != ID3v2_HEADER_SIZE) {\n+\n+ avio_seek(pb, off, SEEK_SET);\n+\n break;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void id3v2_read_internal(AVIOContext *pb, AVDictionary **metadata,\n\n AVFormatContext *s, const char *magic,\n\n ID3v2ExtraMeta **extra_meta)\n\n{\n\n int len, ret;\n\n uint8_t buf[ID3v2_HEADER_SIZE];\n\n int found_header;\n\n int64_t off;\n\n\n\n do {\n\n /* save the current offset in case there's nothing to read/skip */\n\n off = avio_tell(pb);\n\n ret = avio_read(pb, buf, ID3v2_HEADER_SIZE);\n\n if (ret != ID3v2_HEADER_SIZE) {\n\n avio_seek(pb, off, SEEK_SET);\n\n break;\n\n }\n\n found_header = ff_id3v2_match(buf, magic);\n\n if (found_header) {\n\n /* parse ID3v2 header */\n\n len = ((buf[6] & 0x7f) << 21) |\n\n ((buf[7] & 0x7f) << 14) |\n\n ((buf[8] & 0x7f) << 7) |\n\n (buf[9] & 0x7f);\n\n id3v2_parse(pb, metadata, s, len, buf[3], buf[5], extra_meta);\n\n } else {\n\n avio_seek(pb, off, SEEK_SET);\n\n }\n\n } while (found_header);\n\n ff_metadata_conv(metadata, NULL, ff_id3v2_34_metadata_conv);\n\n ff_metadata_conv(metadata, NULL, id3v2_2_metadata_conv);\n\n ff_metadata_conv(metadata, NULL, ff_id3v2_4_metadata_conv);\n\n merge_date(metadata);\n\n}\n"}} {"sample_id": "7102fa7073b2cefb33ab4012a11f15fbf297a74b_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void pc_compat_2_0(MachineState *machine)\n+\n+{\n+\n pc_compat_2_1(machine);\n \n smbios_legacy_mode = true;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pc_compat_2_0(MachineState *machine)\n\n{\n\n pc_compat_2_1(machine);\n\n smbios_legacy_mode = true;\n\n has_reserved_memory = false;\n\n pc_set_legacy_acpi_data_size();\n\n}\n"}} {"sample_id": "d2e49aad7259af943b72be761ee5c18e14acd71a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n return g_strdup_printf(\"%sunix:%s%s\", prefix,\n \n addr->u.q_unix.data->path,\n+\n+ is_listen ? \",server\" : \"\");\n+\n+ break;\n+\n case SOCKET_ADDRESS_KIND_FD:\n \n return g_strdup_printf(\"%sfd:%s%s\", prefix, addr->u.fd.data->str,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static char *SocketAddress_to_str(const char *prefix, SocketAddress *addr,\n\n bool is_listen, bool is_telnet)\n\n{\n\n switch (addr->type) {\n\n case SOCKET_ADDRESS_KIND_INET:\n\n return g_strdup_printf(\"%s%s:%s:%s%s\", prefix,\n\n is_telnet ? \"telnet\" : \"tcp\",\n\n addr->u.inet.data->host,\n\n addr->u.inet.data->port,\n\n is_listen ? \",server\" : \"\");\n\n break;\n\n case SOCKET_ADDRESS_KIND_UNIX:\n\n return g_strdup_printf(\"%sunix:%s%s\", prefix,\n\n addr->u.q_unix.data->path,\n\n is_listen ? \",server\" : \"\");\n\n break;\n\n case SOCKET_ADDRESS_KIND_FD:\n\n return g_strdup_printf(\"%sfd:%s%s\", prefix, addr->u.fd.data->str,\n\n is_listen ? \",server\" : \"\");\n\n break;\n\n\n\n\n\n default:\n\n abort();\n\n }\n\n}"}} {"sample_id": "94e7340b5db8bce7866e44e700ffa8fd26585c7e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int nbd_receive_request(int csock, struct nbd_request *request)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int nbd_receive_request(int csock, struct nbd_request *request)\n\n{\n\n uint8_t buf[4 + 4 + 8 + 8 + 4];\n\n uint32_t magic;\n\n\n\n if (read_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {\n\n LOG(\"read failed\");\n\n errno = EINVAL;\n\n return -1;\n\n }\n\n\n\n /* Request\n\n [ 0 .. 3] magic (NBD_REQUEST_MAGIC)\n\n [ 4 .. 7] type (0 == READ, 1 == WRITE)\n\n [ 8 .. 15] handle\n\n [16 .. 23] from\n\n [24 .. 27] len\n\n */\n\n\n\n magic = be32_to_cpup((uint32_t*)buf);\n\n request->type = be32_to_cpup((uint32_t*)(buf + 4));\n\n request->handle = be64_to_cpup((uint64_t*)(buf + 8));\n\n request->from = be64_to_cpup((uint64_t*)(buf + 16));\n\n request->len = be32_to_cpup((uint32_t*)(buf + 24));\n\n\n\n TRACE(\"Got request: \"\n\n \"{ magic = 0x%x, .type = %d, from = %\" PRIu64\" , len = %u }\",\n\n magic, request->type, request->from, request->len);\n\n\n\n if (magic != NBD_REQUEST_MAGIC) {\n\n LOG(\"invalid magic (got 0x%x)\", magic);\n\n errno = EINVAL;\n\n return -1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "e45f7bca735ff7ba965ec1e441199dc7aeb0c8fc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n if (st->codecpar->extradata) {\n \n av_freep(&st->codecpar->extradata);\n+\n+ st->codecpar->extradata_size = 0;\n+\n+ }\n+\n ret = ff_alloc_extradata(st->codecpar,\n \n source_st->codecpar->extradata_size);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int copy_stream_props(AVStream *st, AVStream *source_st)\n\n{\n\n int ret;\n\n\n\n if (st->codecpar->codec_id || !source_st->codecpar->codec_id) {\n\n if (st->codecpar->extradata_size < source_st->codecpar->extradata_size) {\n\n if (st->codecpar->extradata) {\n\n av_freep(&st->codecpar->extradata);\n\n st->codecpar->extradata_size = 0;\n\n }\n\n ret = ff_alloc_extradata(st->codecpar,\n\n source_st->codecpar->extradata_size);\n\n if (ret < 0)\n\n return ret;\n\n }\n\n memcpy(st->codecpar->extradata, source_st->codecpar->extradata,\n\n source_st->codecpar->extradata_size);\n\n return 0;\n\n }\n\n if ((ret = avcodec_parameters_copy(st->codecpar, source_st->codecpar)) < 0)\n\n return ret;\n\n st->r_frame_rate = source_st->r_frame_rate;\n\n st->avg_frame_rate = source_st->avg_frame_rate;\n\n st->time_base = source_st->time_base;\n\n st->sample_aspect_ratio = source_st->sample_aspect_ratio;\n\n\n\n av_dict_copy(&st->metadata, source_st->metadata, 0);\n\n return 0;\n\n}\n"}} {"sample_id": "a6191d098a03f94685ae4c072bfdf10afcd86223_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void quantize_all(DCAEncContext *c)\n \n+{\n+\n+ int sample, band, ch;\n+\n \n \n for (sample = 0; sample < SUBBAND_SAMPLES; sample++)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void quantize_all(DCAEncContext *c)\n\n{\n\n int sample, band, ch;\n\n\n\n for (sample = 0; sample < SUBBAND_SAMPLES; sample++)\n\n for (band = 0; band < 32; band++)\n\n for (ch = 0; ch < c->fullband_channels; ch++)\n\n c->quantized[sample][band][ch] = quantize_value(c->subband[sample][band][ch], c->quant[band][ch]);\n\n}\n"}} {"sample_id": "d38345878cbb89e4d8d33bd79f47836d4e9cd637", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,7 +15,7 @@\n \n \n segments = bytestream_get_le16(&src);\n+\n while (segments--) {\n \n if (mask == 0x10000) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int decode_dsw1(uint8_t *frame, int width, int height,\n\n const uint8_t *src, const uint8_t *src_end)\n\n{\n\n const uint8_t *frame_start = frame;\n\n const uint8_t *frame_end = frame + width * height;\n\n int mask = 0x10000, bitbuf = 0;\n\n int v, offset, count, segments;\n\n\n\n segments = bytestream_get_le16(&src);\n\n while (segments--) {\n\n if (mask == 0x10000) {\n\n if (src >= src_end)\n\n return -1;\n\n bitbuf = bytestream_get_le16(&src);\n\n mask = 1;\n\n }\n\n if (src_end - src < 2 || frame_end - frame < 2)\n\n return -1;\n\n if (bitbuf & mask) {\n\n v = bytestream_get_le16(&src);\n\n offset = (v & 0x1FFF) << 1;\n\n count = ((v >> 13) + 2) << 1;\n\n if (frame - offset < frame_start || frame_end - frame < count)\n\n return -1;\n\n // can't use av_memcpy_backptr() since it can overwrite following pixels\n\n for (v = 0; v < count; v++)\n\n frame[v] = frame[v - offset];\n\n frame += count;\n\n } else if (bitbuf & (mask << 1)) {\n\n frame += bytestream_get_le16(&src);\n\n } else {\n\n *frame++ = *src++;\n\n *frame++ = *src++;\n\n }\n\n mask <<= 2;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a9a72aeefbd3ef8bcbbeeccaf174ee10db2978ac_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static const TPMDriverOps *tpm_driver_find_by_type(enum TpmType type)\n+\n+{\n+\n+ int i;\n \n \n+\n for (i = 0; i < TPM_MAX_DRIVERS && be_drivers[i] != NULL; i++) {\n \n if (be_drivers[i]->type == type) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static const TPMDriverOps *tpm_driver_find_by_type(enum TpmType type)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < TPM_MAX_DRIVERS && be_drivers[i] != NULL; i++) {\n\n if (be_drivers[i]->type == type) {\n\n return be_drivers[i];\n\n }\n\n }\n\n return NULL;\n\n}\n"}} {"sample_id": "87e8788680e16c51f6048af26f3f7830c35207a5_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n return AVPROBE_SCORE_MAX;\n \n else\n+\n+ return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int yuv4_probe(AVProbeData *pd)\n\n{\n\n /* check file header */\n\n if (pd->buf_size <= sizeof(Y4M_MAGIC))\n\n return 0;\n\n if (strncmp(pd->buf, Y4M_MAGIC, sizeof(Y4M_MAGIC)-1)==0)\n\n return AVPROBE_SCORE_MAX;\n\n else\n\n return 0;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_34", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ result->rkey = htonl(result->rkey);\n+\n result->host_addr = htonll(result->host_addr);\n \n };", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void result_to_network(RDMARegisterResult *result)\n\n{\n\n result->rkey = htonl(result->rkey);\n\n result->host_addr = htonll(result->host_addr);\n\n};\n"}} {"sample_id": "9ef91a677110ec200d7b2904fc4bcae5a77329ad_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ if (aiocb->aio_flags & QEMU_AIO_SECTOR_ALIGNED) {\n+\n+ int i;\n+\n+\n \n for (i = 0; i < aiocb->aio_niov; i++)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int aiocb_needs_copy(struct qemu_paiocb *aiocb)\n\n{\n\n if (aiocb->aio_flags & QEMU_AIO_SECTOR_ALIGNED) {\n\n int i;\n\n\n\n for (i = 0; i < aiocb->aio_niov; i++)\n\n if ((uintptr_t) aiocb->aio_iov[i].iov_base % 512)\n\n return 1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "933aa91e31d5cbf9dbc0cf416a988e6011bc4a40", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void cabac_init_decoder(HEVCContext *s)\n \n {\n \n+ GetBitContext *gb = &s->HEVClc->gb;\n \n skip_bits(gb, 1);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void cabac_init_decoder(HEVCContext *s)\n\n{\n\n GetBitContext *gb = &s->HEVClc->gb;\n\n skip_bits(gb, 1);\n\n align_get_bits(gb);\n\n ff_init_cabac_decoder(&s->HEVClc->cc,\n\n gb->buffer + get_bits_count(gb) / 8,\n\n (get_bits_left(gb) + 7) / 8);\n\n}\n"}} {"sample_id": "a625e13208ad0ebf1554aa73c9bf41452520f176_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n tc[3] = tc0_table[index_a][bS[3]];\n \n+ h->h264dsp.h264_h_loop_filter_luma(pix, stride, alpha, beta, tc);\n+\n+ } else {\n+\n+ h->h264dsp.h264_h_loop_filter_luma_intra(pix, stride, alpha, beta);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void av_always_inline filter_mb_edgev( uint8_t *pix, int stride, int16_t bS[4], unsigned int qp, H264Context *h) {\n\n const int qp_bd_offset = 6 * (h->sps.bit_depth_luma - 8);\n\n const unsigned int index_a = qp - qp_bd_offset + h->slice_alpha_c0_offset;\n\n const int alpha = alpha_table[index_a];\n\n const int beta = beta_table[qp - qp_bd_offset + h->slice_beta_offset];\n\n if (alpha ==0 || beta == 0) return;\n\n\n\n if( bS[0] < 4 ) {\n\n int8_t tc[4];\n\n tc[0] = tc0_table[index_a][bS[0]];\n\n tc[1] = tc0_table[index_a][bS[1]];\n\n tc[2] = tc0_table[index_a][bS[2]];\n\n tc[3] = tc0_table[index_a][bS[3]];\n\n h->h264dsp.h264_h_loop_filter_luma(pix, stride, alpha, beta, tc);\n\n } else {\n\n h->h264dsp.h264_h_loop_filter_luma_intra(pix, stride, alpha, beta);\n\n }\n\n}\n"}} {"sample_id": "81e3e75b6461c53724fe7c7918bc54468fcdaf9d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n \n \n pci_default_write_config(d, address, val, len);\n+\n+\n+\n+ if (ranges_overlap(address, len, PCI_COMMAND, 2) ||\n+\n \n \n /* io base/limit */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void pci_bridge_write_config(PCIDevice *d,\n\n uint32_t address, uint32_t val, int len)\n\n{\n\n PCIBridge *s = PCI_BRIDGE(d);\n\n uint16_t oldctl = pci_get_word(d->config + PCI_BRIDGE_CONTROL);\n\n uint16_t newctl;\n\n\n\n pci_default_write_config(d, address, val, len);\n\n\n\n if (ranges_overlap(address, len, PCI_COMMAND, 2) ||\n\n\n\n /* io base/limit */\n\n ranges_overlap(address, len, PCI_IO_BASE, 2) ||\n\n\n\n /* memory base/limit, prefetchable base/limit and\n\n io base/limit upper 16 */\n\n ranges_overlap(address, len, PCI_MEMORY_BASE, 20) ||\n\n\n\n /* vga enable */\n\n ranges_overlap(address, len, PCI_BRIDGE_CONTROL, 2)) {\n\n pci_bridge_update_mappings(s);\n\n }\n\n\n\n newctl = pci_get_word(d->config + PCI_BRIDGE_CONTROL);\n\n if (~oldctl & newctl & PCI_BRIDGE_CTL_BUS_RESET) {\n\n /* Trigger hot reset on 0->1 transition. */\n\n pci_bus_reset(&s->sec_bus);\n\n }\n\n}\n"}} {"sample_id": "494a8ebe713055d3946183f4b395f85a18b43e9e_23", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int proxy_readdir_r(FsContext *ctx, V9fsFidOpenState *fs,\n+\n+ struct dirent *entry,\n \n struct dirent **result)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int proxy_readdir_r(FsContext *ctx, V9fsFidOpenState *fs,\n\n struct dirent *entry,\n\n struct dirent **result)\n\n{\n\n return readdir_r(fs->dir, entry, result);\n\n}\n"}} {"sample_id": "64fbf5e263a0698c6cf6e0580feebe9a6f502ae5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n if(match) {\n \n /* A label of a open link. Make it one of the inputs of the next\n+\n+ filter */\n+\n+ if(match->type != LinkTypeOut) {\n+\n av_log(log_ctx, AV_LOG_ERROR,\n \n \"Label \\\"%s\\\" appears twice as input!\\n\", match->name);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int parse_inputs(const char **buf, AVFilterInOut **currInputs,\n\n AVFilterInOut **openLinks, AVClass *log_ctx)\n\n{\n\n int pad = 0;\n\n\n\n while(**buf == '[') {\n\n char *name = parse_link_name(buf, log_ctx);\n\n AVFilterInOut *match;\n\n\n\n if(!name)\n\n return -1;\n\n\n\n /* First check if the label is not in the openLinks list */\n\n match = extract_inout(name, openLinks);\n\n\n\n if(match) {\n\n /* A label of a open link. Make it one of the inputs of the next\n\n filter */\n\n if(match->type != LinkTypeOut) {\n\n av_log(log_ctx, AV_LOG_ERROR,\n\n \"Label \\\"%s\\\" appears twice as input!\\n\", match->name);\n\n return -1;\n\n }\n\n\n } else {\n\n /* Not in the list, so add it as an input */\n\n match = av_mallocz(sizeof(AVFilterInOut));\n\n match->name = name;\n\n match->type = LinkTypeIn;\n\n match->pad_idx = pad;\n\n }\n\n\n\n insert_inout(currInputs, match);\n\n\n\n *buf += consume_whitespace(*buf);\n\n pad++;\n\n }\n\n\n\n return pad;\n\n}"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_37", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void do_tw (int flags)\n+\n {\n \n if (!likely(!((Ts0 < Ts1 && (flags & 0x10)) ||", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void do_tw (int flags)\n\n{\n\n if (!likely(!((Ts0 < Ts1 && (flags & 0x10)) ||\n\n (Ts0 > Ts1 && (flags & 0x08)) ||\n\n (Ts0 == Ts1 && (flags & 0x04)) ||\n\n (T0 < T1 && (flags & 0x02)) ||\n\n (T0 > T1 && (flags & 0x01)))))\n\n do_raise_exception_err(EXCP_PROGRAM, EXCP_TRAP);\n\n}\n"}} {"sample_id": "5449a787c953f40f0f4312e6f5897775904ffc45", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n fd = buf_descriptor->fd;\n av_free(buf_descriptor);\n res = ioctl (fd, VIDIOC_QBUF, &buf);\n+ if (res < 0) {\n+ av_log(NULL, AV_LOG_ERROR, \"ioctl(VIDIOC_QBUF)\\n\");\n+ pkt->data = NULL;\n+ pkt->size = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void mmap_release_buffer(AVPacket *pkt)\n{\n struct v4l2_buffer buf;\n int res, fd;\n struct buff_data *buf_descriptor = pkt->priv;\n memset(&buf, 0, sizeof(struct v4l2_buffer));\n buf.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;\n buf.memory = V4L2_MEMORY_MMAP;\n buf.index = buf_descriptor->index;\n fd = buf_descriptor->fd;\n av_free(buf_descriptor);\n res = ioctl (fd, VIDIOC_QBUF, &buf);\n if (res < 0) {\n av_log(NULL, AV_LOG_ERROR, \"ioctl(VIDIOC_QBUF)\\n\");\n pkt->data = NULL;\n pkt->size = 0;"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_100", "diff": "--- a/source.c\n+++ b/source.c\n@@ -39,11 +39,11 @@\n sw1 = sw->entries.le_next;\n \n if (sw->rate) {\n+\n+ st_rate_stop (sw->rate);\n+\n+ sw->rate = NULL;\n+\n }\n \n LIST_REMOVE (sw, entries);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque)\n\n{\n\n struct capture_callback *cb;\n\n\n\n for (cb = cap->cb_head.lh_first; cb; cb = cb->entries.le_next) {\n\n if (cb->opaque == cb_opaque) {\n\n cb->ops.destroy (cb_opaque);\n\n LIST_REMOVE (cb, entries);\n\n qemu_free (cb);\n\n\n\n if (!cap->cb_head.lh_first) {\n\n SWVoiceOut *sw = cap->hw.sw_head.lh_first, *sw1;\n\n\n\n while (sw) {\n\n SWVoiceCap *sc = (SWVoiceCap *) sw;\n\n#ifdef DEBUG_CAPTURE\n\n dolog (\"freeing %s\\n\", sw->name);\n\n#endif\n\n\n\n sw1 = sw->entries.le_next;\n\n if (sw->rate) {\n\n st_rate_stop (sw->rate);\n\n sw->rate = NULL;\n\n }\n\n LIST_REMOVE (sw, entries);\n\n LIST_REMOVE (sc, entries);\n\n qemu_free (sc);\n\n sw = sw1;\n\n }\n\n LIST_REMOVE (cap, entries);\n\n qemu_free (cap);\n\n }\n\n return;\n\n }\n\n }\n\n}\n"}} {"sample_id": "669419939c1d36be35196859dc73ec9a194157ad", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void svq3_luma_dc_dequant_idct_c(int16_t *output, int16_t *input, int qp)\n+\n {\n \n const int qmul = svq3_dequant_coeff[qp];\n@@ -19,10 +19,10 @@\n const int z0 = 13 * (input[4 * i + 0] + input[4 * i + 2]);\n \n const int z1 = 13 * (input[4 * i + 0] - input[4 * i + 2]);\n+\n+ const int z2 = 7 * input[4 * i + 1] - 17 * input[4 * i + 3];\n+\n+ const int z3 = 17 * input[4 * i + 1] + 7 * input[4 * i + 3];\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void svq3_luma_dc_dequant_idct_c(int16_t *output, int16_t *input, int qp)\n\n{\n\n const int qmul = svq3_dequant_coeff[qp];\n\n#define stride 16\n\n int i;\n\n int temp[16];\n\n static const uint8_t x_offset[4] = { 0, 1 * stride, 4 * stride, 5 * stride };\n\n\n\n for (i = 0; i < 4; i++) {\n\n const int z0 = 13 * (input[4 * i + 0] + input[4 * i + 2]);\n\n const int z1 = 13 * (input[4 * i + 0] - input[4 * i + 2]);\n\n const int z2 = 7 * input[4 * i + 1] - 17 * input[4 * i + 3];\n\n const int z3 = 17 * input[4 * i + 1] + 7 * input[4 * i + 3];\n\n\n\n temp[4 * i + 0] = z0 + z3;\n\n temp[4 * i + 1] = z1 + z2;\n\n temp[4 * i + 2] = z1 - z2;\n\n temp[4 * i + 3] = z0 - z3;\n\n }\n\n\n\n for (i = 0; i < 4; i++) {\n\n const int offset = x_offset[i];\n\n const int z0 = 13 * (temp[4 * 0 + i] + temp[4 * 2 + i]);\n\n const int z1 = 13 * (temp[4 * 0 + i] - temp[4 * 2 + i]);\n\n const int z2 = 7 * temp[4 * 1 + i] - 17 * temp[4 * 3 + i];\n\n const int z3 = 17 * temp[4 * 1 + i] + 7 * temp[4 * 3 + i];\n\n\n\n output[stride * 0 + offset] = (z0 + z3) * qmul + 0x80000 >> 20;\n\n output[stride * 2 + offset] = (z1 + z2) * qmul + 0x80000 >> 20;\n\n output[stride * 8 + offset] = (z1 - z2) * qmul + 0x80000 >> 20;\n\n output[stride * 10 + offset] = (z0 - z3) * qmul + 0x80000 >> 20;\n\n }\n\n}\n"}} {"sample_id": "0491a2a07a44f6e5e6f34081835e402c07025fd2_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static char *ts_value_string (char *buf, int buf_size, int64_t ts)\n \n {\n+\n+ if (ts == AV_NOPTS_VALUE) {\n+\n+ snprintf(buf, buf_size, \"N/A\");\n \n } else {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static char *ts_value_string (char *buf, int buf_size, int64_t ts)\n\n{\n\n if (ts == AV_NOPTS_VALUE) {\n\n snprintf(buf, buf_size, \"N/A\");\n\n } else {\n\n snprintf(buf, buf_size, \"%\"PRId64, ts);\n\n }\n\n\n\n return buf;\n\n}\n"}} {"sample_id": "ae4d2eb273b167dad748ea4249720319240b1ac2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n \n \n switch (pci_get_word(d->config + PCI_CLASS_DEVICE)) {\n+\n+ case PCI_CLASS_STORAGE_IDE:\n+\n+ pci_piix3_xen_ide_unplug(DEVICE(d));\n+\n break;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void unplug_disks(PCIBus *b, PCIDevice *d, void *o)\n\n{\n\n /* We have to ignore passthrough devices */\n\n if (!strcmp(d->name, \"xen-pci-passthrough\")) {\n\n return;\n\n }\n\n\n\n switch (pci_get_word(d->config + PCI_CLASS_DEVICE)) {\n\n case PCI_CLASS_STORAGE_IDE:\n\n pci_piix3_xen_ide_unplug(DEVICE(d));\n\n break;\n\n\n\n case PCI_CLASS_STORAGE_SCSI:\n\n case PCI_CLASS_STORAGE_EXPRESS:\n\n object_unparent(OBJECT(d));\n\n break;\n\n\n\n default:\n\n break;\n\n }\n\n}\n"}} {"sample_id": "37654d9e6af84003982f8b9a5d59a4aef28e0a79", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n if (offset > sizeof(CPUCRISState)) {\n \n fprintf(stderr, \"wrong store to env at off=%d\\n\", offset);\n+\n+ }\n+\n tcg_gen_st_tl(tn, cpu_env, offset);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void _t_gen_mov_env_TN(int offset, TCGv tn)\n\n{\n\n if (offset > sizeof(CPUCRISState)) {\n\n fprintf(stderr, \"wrong store to env at off=%d\\n\", offset);\n\n }\n\n tcg_gen_st_tl(tn, cpu_env, offset);\n\n}\n"}} {"sample_id": "b3db211f3c80bb996a704d665fe275619f728bd4_57", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void qmp_output_end_list(Visitor *v, void **obj)\n+\n+{\n \n QmpOutputVisitor *qov = to_qov(v);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qmp_output_end_list(Visitor *v, void **obj)\n\n{\n\n QmpOutputVisitor *qov = to_qov(v);\n\n QObject *value = qmp_output_pop(qov, obj);\n\n assert(qobject_type(value) == QTYPE_QLIST);\n\n}\n"}} {"sample_id": "c572f23a3e7180dbeab5e86583e43ea2afed6271_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n int datasync;\n size_t offset = 7;\n V9fsFidState *fidp;\n+ V9fsPDU *pdu = opaque;\n+ V9fsState *s = pdu->s;\n+ pdu_unmarshal(pdu, offset, \"dd\", &fid, &datasync);\n+ fidp = get_fid(pdu, fid);\n+ if (fidp == NULL) {\n err = -ENOENT;\n goto out_nofid;\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void v9fs_fsync(void *opaque)\n{\n int err;\n int32_t fid;\n int datasync;\n size_t offset = 7;\n V9fsFidState *fidp;\n V9fsPDU *pdu = opaque;\n V9fsState *s = pdu->s;\n pdu_unmarshal(pdu, offset, \"dd\", &fid, &datasync);\n fidp = get_fid(pdu, fid);\n if (fidp == NULL) {\n err = -ENOENT;\n goto out_nofid;\n }\n err = v9fs_co_fsync(pdu, fidp, datasync);\n if (!err) {\n err = offset;\n }\n put_fid(pdu, fidp);\nout_nofid:\n complete_pdu(s, pdu, err);\n}"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_64", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n g_source_unref(&ctx->source);\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void aio_context_unref(AioContext *ctx)\n\n{\n\n g_source_unref(&ctx->source);\n\n}\n"}} {"sample_id": "d2eae20790e825656b205dbe347826ff991fb3d8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n cpu = cpu_s390x_init(cpu_model);\n \n cs = CPU(cpu);\n+\n+\n+\n+ ipi_states[i] = cpu;\n+\n cs->halted = 1;\n \n cs->exception_index = EXCP_HLT;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void s390_init_cpus(const char *cpu_model)\n\n{\n\n int i;\n\n\n\n if (cpu_model == NULL) {\n\n cpu_model = \"host\";\n\n }\n\n\n\n ipi_states = g_malloc(sizeof(S390CPU *) * smp_cpus);\n\n\n\n for (i = 0; i < smp_cpus; i++) {\n\n S390CPU *cpu;\n\n CPUState *cs;\n\n\n\n cpu = cpu_s390x_init(cpu_model);\n\n cs = CPU(cpu);\n\n\n\n ipi_states[i] = cpu;\n\n cs->halted = 1;\n\n cs->exception_index = EXCP_HLT;\n\n }\n\n}\n"}} {"sample_id": "79ca616f291124d166ca173e512c4ace1c2fe8b2_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n \n \n bus = pci_get_bus_devfn(&devfn, devaddr);\n+\n+ if (!bus) {\n+\n+ monitor_printf(mon, \"Invalid PCI device address %s\\n\", devaddr);\n+\n return NULL;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static PCIDevice *qemu_pci_hot_add_nic(Monitor *mon,\n\n const char *devaddr,\n\n const char *opts_str)\n\n{\n\n Error *local_err = NULL;\n\n QemuOpts *opts;\n\n PCIBus *bus;\n\n int ret, devfn;\n\n\n\n bus = pci_get_bus_devfn(&devfn, devaddr);\n\n if (!bus) {\n\n monitor_printf(mon, \"Invalid PCI device address %s\\n\", devaddr);\n\n return NULL;\n\n }\n\n if (!((BusState*)bus)->allow_hotplug) {\n\n monitor_printf(mon, \"PCI bus doesn't support hotplug\\n\");\n\n return NULL;\n\n }\n\n\n\n opts = qemu_opts_parse(qemu_find_opts(\"net\"), opts_str ? opts_str : \"\", 0);\n\n if (!opts) {\n\n return NULL;\n\n }\n\n\n\n qemu_opt_set(opts, \"type\", \"nic\");\n\n\n\n ret = net_client_init(opts, 0, &local_err);\n\n if (error_is_set(&local_err)) {\n\n qerror_report_err(local_err);\n\n error_free(local_err);\n\n return NULL;\n\n }\n\n if (nd_table[ret].devaddr) {\n\n monitor_printf(mon, \"Parameter addr not supported\\n\");\n\n return NULL;\n\n }\n\n return pci_nic_init(&nd_table[ret], \"rtl8139\", devaddr);\n\n}\n"}} {"sample_id": "8cdd2e0abbf593a38a146d8dfc998754cefbc27a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n int tpm_register_model(enum TpmModel model)\n \n {\n+\n int i;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int tpm_register_model(enum TpmModel model)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < TPM_MAX_MODELS; i++) {\n\n if (tpm_models[i] == -1) {\n\n tpm_models[i] = model;\n\n return 0;\n\n }\n\n }\n\n error_report(\"Could not register TPM model\");\n\n return 1;\n\n}\n"}} {"sample_id": "de6a1e32fd483db05d957268d5e45e2b1be9cab4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n enum AVIODataMarkerType type, int64_t time)\n \n {\n+\n+ char timebuf[30], content[5] = { 0 };\n+\n+ const char *str;\n+\n switch (type) {\n \n case AVIO_DATA_MARKER_HEADER: str = \"header\"; break;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int io_write_data_type(void *opaque, uint8_t *buf, int size,\n\n enum AVIODataMarkerType type, int64_t time)\n\n{\n\n char timebuf[30], content[5] = { 0 };\n\n const char *str;\n\n switch (type) {\n\n case AVIO_DATA_MARKER_HEADER: str = \"header\"; break;\n\n case AVIO_DATA_MARKER_SYNC_POINT: str = \"sync\"; break;\n\n case AVIO_DATA_MARKER_BOUNDARY_POINT: str = \"boundary\"; break;\n\n case AVIO_DATA_MARKER_UNKNOWN: str = \"unknown\"; break;\n\n case AVIO_DATA_MARKER_TRAILER: str = \"trailer\"; break;\n\n\n }\n\n if (time == AV_NOPTS_VALUE)\n\n snprintf(timebuf, sizeof(timebuf), \"nopts\");\n\n else\n\n snprintf(timebuf, sizeof(timebuf), \"%\"PRId64, time);\n\n // There can be multiple header/trailer callbacks, only log the box type\n\n // for header at out_size == 0\n\n if (type != AVIO_DATA_MARKER_UNKNOWN &&\n\n type != AVIO_DATA_MARKER_TRAILER &&\n\n (type != AVIO_DATA_MARKER_HEADER || out_size == 0) &&\n\n size >= 8)\n\n memcpy(content, &buf[4], 4);\n\n else\n\n snprintf(content, sizeof(content), \"-\");\n\n printf(\"write_data len %d, time %s, type %s atom %s\\n\", size, timebuf, str, content);\n\n return io_write(opaque, buf, size);\n\n}"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_70", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void qemu_bh_cancel(QEMUBH *bh)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_bh_cancel(QEMUBH *bh)\n\n{\n\n bh->scheduled = 0;\n\n}\n"}} {"sample_id": "9ef91a677110ec200d7b2904fc4bcae5a77329ad_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n if (posix_aio_state) {\n \n+ char byte = 0;\n+\n+\n+\n write(posix_aio_state->wfd, &byte, sizeof(byte));\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void aio_signal_handler(int signum)\n\n{\n\n if (posix_aio_state) {\n\n char byte = 0;\n\n\n\n write(posix_aio_state->wfd, &byte, sizeof(byte));\n\n }\n\n\n\n qemu_service_io();\n\n}\n"}} {"sample_id": "9487fb4dea3498eb4711eb023f43199f68701b1e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n yuv2422_1_c_template(SwsContext *c, const int16_t *buf0,\n+ const int16_t *ubuf[2], const int16_t *vbuf[2],\n+ const int16_t *abuf0, uint8_t *dest, int dstW,\n+ int uvalpha, int y, enum PixelFormat target)\n+{\n+ const int16_t *ubuf0 = ubuf[0], *vbuf0 = vbuf[0];\n int i;\n if (uvalpha < 2048) {\n for (i = 0; i < (dstW >> 1); i++) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "yuv2422_1_c_template(SwsContext *c, const int16_t *buf0,\n const int16_t *ubuf[2], const int16_t *vbuf[2],\n const int16_t *abuf0, uint8_t *dest, int dstW,\n int uvalpha, int y, enum PixelFormat target)\n{\n const int16_t *ubuf0 = ubuf[0], *vbuf0 = vbuf[0];\n int i;\n if (uvalpha < 2048) {\n for (i = 0; i < (dstW >> 1); i++) {\n int Y1 = buf0[i * 2] >> 7;\n int Y2 = buf0[i * 2 + 1] >> 7;\n int U = ubuf0[i] >> 7;\n int V = vbuf0[i] >> 7;\n output_pixels(i * 4, Y1, U, Y2, V);\n }\n } else {\n const int16_t *ubuf1 = ubuf[1], *vbuf1 = vbuf[1];\n for (i = 0; i < (dstW >> 1); i++) {\n int Y1 = buf0[i * 2] >> 7;\n int Y2 = buf0[i * 2 + 1] >> 7;\n int U = (ubuf0[i] + ubuf1[i]) >> 8;\n int V = (vbuf0[i] + vbuf1[i]) >> 8;\n output_pixels(i * 4, Y1, U, Y2, V);\n }\n }\n}"}} {"sample_id": "02b33596d09bafed5d58366403a2d369f0d1047e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n \n \n \n+\n+\n+\n qemu_log (\"unknown insn pc=%x opc=%x\\n\", dc->pc, dc->opcode);\n \n dc->abort_at_next_insn = 1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void dec_null(DisasContext *dc)\n\n{\n\n\n\n\n\n\n\n qemu_log (\"unknown insn pc=%x opc=%x\\n\", dc->pc, dc->opcode);\n\n dc->abort_at_next_insn = 1;\n"}} {"sample_id": "b946a1533209f61a93e34898aebb5b43154b99c3_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n void stellaris_enet_init(NICInfo *nd, uint32_t base, qemu_irq irq)\n \n+{\n \n stellaris_enet_state *s;\n+\n+ int iomemtype;\n \n \n \n+ qemu_check_nic_model(nd, \"stellaris\");\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void stellaris_enet_init(NICInfo *nd, uint32_t base, qemu_irq irq)\n\n{\n\n stellaris_enet_state *s;\n\n int iomemtype;\n\n\n\n qemu_check_nic_model(nd, \"stellaris\");\n\n\n\n s = (stellaris_enet_state *)qemu_mallocz(sizeof(stellaris_enet_state));\n\n iomemtype = cpu_register_io_memory(0, stellaris_enet_readfn,\n\n stellaris_enet_writefn, s);\n\n cpu_register_physical_memory(base, 0x00001000, iomemtype);\n\n s->irq = irq;\n\n memcpy(s->macaddr, nd->macaddr, 6);\n\n\n\n if (nd->vlan) {\n\n s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,\n\n stellaris_enet_receive, stellaris_enet_can_receive, s);\n\n qemu_format_nic_info_str(s->vc, s->macaddr);\n\n }\n\n\n\n stellaris_enet_reset(s);\n\n register_savevm(\"stellaris_enet\", -1, 1,\n\n stellaris_enet_save, stellaris_enet_load, s);\n\n}\n"}} {"sample_id": "5cbab1bfdeab274e5d4e3353fa626ba8697eed10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n DeviceClass *dc = DEVICE_CLASS(oc);\n \n+ S390FLICStateClass *fsc = S390_FLIC_COMMON_CLASS(oc);\n+\n+\n+\n+\n dc->realize = kvm_s390_flic_realize;\n \n dc->vmsd = &kvm_s390_flic_vmstate;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void kvm_s390_flic_class_init(ObjectClass *oc, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(oc);\n\n S390FLICStateClass *fsc = S390_FLIC_COMMON_CLASS(oc);\n\n\n\n\n dc->realize = kvm_s390_flic_realize;\n\n dc->vmsd = &kvm_s390_flic_vmstate;\n\n dc->reset = kvm_s390_flic_reset;\n\n fsc->register_io_adapter = kvm_s390_register_io_adapter;\n\n fsc->io_adapter_map = kvm_s390_io_adapter_map;\n\n fsc->add_adapter_routes = kvm_s390_add_adapter_routes;\n\n fsc->release_adapter_routes = kvm_s390_release_adapter_routes;\n\n fsc->clear_io_irq = kvm_s390_clear_io_flic;\n\n}"}} {"sample_id": "167c50d8f94e0ffb880aa5cd2a232a3f32f0df1d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+int target_to_host_signal(int sig)\n+\n {\n \n if (sig >= _NSIG)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int target_to_host_signal(int sig)\n\n{\n\n if (sig >= _NSIG)\n\n return sig;\n\n return target_to_host_signal_table[sig];\n\n}\n"}} {"sample_id": "d6737539e77e78fca9a04914d51996cfd1ccc55c_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n for (row = 4; row--;) {\n \n+ inp0 = src[0];\n+\n+ src += src_stride;\n+\n+ inp1 = src[0];\n \n src += src_stride;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void intra_predict_horiz_16x16_msa(uint8_t *src, int32_t src_stride,\n\n uint8_t *dst, int32_t dst_stride)\n\n{\n\n uint32_t row;\n\n uint8_t inp0, inp1, inp2, inp3;\n\n v16u8 src0, src1, src2, src3;\n\n\n\n for (row = 4; row--;) {\n\n inp0 = src[0];\n\n src += src_stride;\n\n inp1 = src[0];\n\n src += src_stride;\n\n inp2 = src[0];\n\n src += src_stride;\n\n inp3 = src[0];\n\n src += src_stride;\n\n\n\n src0 = (v16u8) __msa_fill_b(inp0);\n\n src1 = (v16u8) __msa_fill_b(inp1);\n\n src2 = (v16u8) __msa_fill_b(inp2);\n\n src3 = (v16u8) __msa_fill_b(inp3);\n\n\n\n ST_UB4(src0, src1, src2, src3, dst, dst_stride);\n\n dst += (4 * dst_stride);\n\n }\n\n}\n"}} {"sample_id": "2d896b454a0e19ec4c1ddbb0e0b65b7e54fcedf3_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static void boston_mach_class_init(MachineClass *mc)\n+\n+{\n+\n+ mc->desc = \"MIPS Boston\";\n+\n mc->init = boston_mach_init;\n \n mc->block_default_type = IF_IDE;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void boston_mach_class_init(MachineClass *mc)\n\n{\n\n mc->desc = \"MIPS Boston\";\n\n mc->init = boston_mach_init;\n\n mc->block_default_type = IF_IDE;\n\n mc->default_ram_size = 2 * G_BYTE;\n\n mc->max_cpus = 16;\n\n}\n"}} {"sample_id": "a87310a62d1885b8f6d6b5b30227cbd9792d2c3c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void machine_cpu_reset(MicroBlazeCPU *cpu)\n+\n+{\n+\n+ CPUMBState *env = &cpu->env;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void machine_cpu_reset(MicroBlazeCPU *cpu)\n\n{\n\n CPUMBState *env = &cpu->env;\n\n\n\n env->pvr.regs[10] = 0x0e000000; /* virtex 6 */\n\n /* setup pvr to match kernel setting */\n\n env->pvr.regs[0] |= (0x14 << 8);\n\n env->pvr.regs[4] = 0xc56b8000;\n\n env->pvr.regs[5] = 0xc56be000;\n\n}\n"}} {"sample_id": "1e9981465f05a0f103d7e09afd975c9c0ff6d132", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void qmp_stop(Error **errp)\n+\n {\n \n vm_stop(RUN_STATE_PAUSED);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void qmp_stop(Error **errp)\n\n{\n\n vm_stop(RUN_STATE_PAUSED);\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_84", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,6 +6,6 @@\n \n /* Keep iterating */\n \n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bdrv_drain(BlockDriverState *bs)\n\n{\n\n while (bdrv_drain_one(bs)) {\n\n /* Keep iterating */\n\n }\n\n}\n"}} {"sample_id": "a26e9c1040afeecf9013da742b0dec7009445f2b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n return AVERROR(EINVAL);\n \n \n+\n+ pic = av_frame_alloc();\n+\n+ if (!pic)\n+\n return AVERROR(ENOMEM);\n \n av_frame_ref(pic, pic_arg);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int amv_encode_picture(AVCodecContext *avctx, AVPacket *pkt,\n\n const AVFrame *pic_arg, int *got_packet)\n\n\n\n{\n\n MpegEncContext *s = avctx->priv_data;\n\n AVFrame *pic;\n\n int i, ret;\n\n int chroma_h_shift, chroma_v_shift;\n\n\n\n av_pix_fmt_get_chroma_sub_sample(avctx->pix_fmt, &chroma_h_shift, &chroma_v_shift);\n\n\n\n //CODEC_FLAG_EMU_EDGE have to be cleared\n\n if(s->avctx->flags & CODEC_FLAG_EMU_EDGE)\n\n return AVERROR(EINVAL);\n\n\n\n pic = av_frame_alloc();\n\n if (!pic)\n\n return AVERROR(ENOMEM);\n\n av_frame_ref(pic, pic_arg);\n\n //picture should be flipped upside-down\n\n for(i=0; i < 3; i++) {\n\n int vsample = i ? 2 >> chroma_v_shift : 2;\n\n pic->data[i] += (pic->linesize[i] * (vsample * (8 * s->mb_height -((s->height/V_MAX)&7)) - 1 ));\n\n pic->linesize[i] *= -1;\n\n }\n\n ret = ff_MPV_encode_picture(avctx, pkt, pic, got_packet);\n\n av_frame_free(&pic);\n\n return ret;\n\n}\n"}} {"sample_id": "0e7106d8b5f7ef4f9df10baf1dfb3db482bcd046", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n unsigned int datalen, uint64_t offset, bool cache)\n \n+{\n+\n return read_write_object(fd, buf, oid, copies, datalen, offset, false,\n \n false, cache);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int read_object(int fd, char *buf, uint64_t oid, int copies,\n\n unsigned int datalen, uint64_t offset, bool cache)\n\n{\n\n return read_write_object(fd, buf, oid, copies, datalen, offset, false,\n\n false, cache);\n\n}\n"}} {"sample_id": "70143a3954e1c4412efb2bf1a3a818adea2d3abf_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void *get_surface(const AVFrame *frame)\n+\n {\n \n return frame->data[3];", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void *get_surface(const AVFrame *frame)\n\n{\n\n return frame->data[3];\n\n}\n"}} {"sample_id": "151c5693258f594541fa9ea585547a0a8dd68abc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,9 +21,9 @@\n g_print(\"\\nresp: %s\\n\", qstring_get_str(qobject_to_json(resp)));\n \n \n+\n+ qobject_decref(resp);\n+\n+ QDECREF(req);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_dispatch_cmd(void)\n\n{\n\n QDict *req = qdict_new();\n\n QObject *resp;\n\n\n\n qdict_put_obj(req, \"execute\", QOBJECT(qstring_from_str(\"user_def_cmd\")));\n\n\n\n resp = qmp_dispatch(QOBJECT(req));\n\n assert(resp != NULL);\n\n assert(!qdict_haskey(qobject_to_qdict(resp), \"error\"));\n\n g_print(\"\\nresp: %s\\n\", qstring_get_str(qobject_to_json(resp)));\n\n\n\n qobject_decref(resp);\n\n QDECREF(req);\n\n}\n"}} {"sample_id": "100b5e0170e86661aaf830869be930a1a201ed08", "diff": "--- a/source.c\n+++ b/source.c\n@@ -64,10 +64,10 @@\n \n #define GEN_HELPER 2\n \n+#include \"helper.h\"\n+\n+\n+\n+ tcg_target_init(s);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void tcg_context_init(TCGContext *s)\n\n{\n\n int op, total_args, n;\n\n TCGOpDef *def;\n\n TCGArgConstraint *args_ct;\n\n int *sorted_args;\n\n\n\n memset(s, 0, sizeof(*s));\n\n s->nb_globals = 0;\n\n \n\n /* Count total number of arguments and allocate the corresponding\n\n space */\n\n total_args = 0;\n\n for(op = 0; op < NB_OPS; op++) {\n\n def = &tcg_op_defs[op];\n\n n = def->nb_iargs + def->nb_oargs;\n\n total_args += n;\n\n }\n\n\n\n args_ct = g_malloc(sizeof(TCGArgConstraint) * total_args);\n\n sorted_args = g_malloc(sizeof(int) * total_args);\n\n\n\n for(op = 0; op < NB_OPS; op++) {\n\n def = &tcg_op_defs[op];\n\n def->args_ct = args_ct;\n\n def->sorted_args = sorted_args;\n\n n = def->nb_iargs + def->nb_oargs;\n\n sorted_args += n;\n\n args_ct += n;\n\n }\n\n\n\n /* Register helpers. */\n\n#define GEN_HELPER 2\n\n#include \"helper.h\"\n\n\n\n tcg_target_init(s);\n\n}\n"}} {"sample_id": "53111180946a56d314a9c1d07d09b9ef91e847b9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+static int armv7m_nvic_init(SysBusDevice *dev)\n \n {\n \n nvic_state *s = NVIC(dev);\n \n+ NVICClass *nc = NVIC_GET_CLASS(s);\n \n \n \n@@ -13,7 +13,7 @@\n s->gic.num_cpu = 1;\n \n /* Tell the common code we're an NVIC */\n+\n s->gic.revision = 0xffffffff;\n \n s->num_irq = s->gic.num_irq;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int armv7m_nvic_init(SysBusDevice *dev)\n\n{\n\n nvic_state *s = NVIC(dev);\n\n NVICClass *nc = NVIC_GET_CLASS(s);\n\n\n\n /* The NVIC always has only one CPU */\n\n s->gic.num_cpu = 1;\n\n /* Tell the common code we're an NVIC */\n\n s->gic.revision = 0xffffffff;\n\n s->num_irq = s->gic.num_irq;\n\n nc->parent_init(dev);\n\n gic_init_irqs_and_distributor(&s->gic, s->num_irq);\n\n /* The NVIC and system controller register area looks like this:\n\n * 0..0xff : system control registers, including systick\n\n * 0x100..0xcff : GIC-like registers\n\n * 0xd00..0xfff : system control registers\n\n * We use overlaying to put the GIC like registers\n\n * over the top of the system control register region.\n\n */\n\n memory_region_init(&s->container, \"nvic\", 0x1000);\n\n /* The system register region goes at the bottom of the priority\n\n * stack as it covers the whole page.\n\n */\n\n memory_region_init_io(&s->sysregmem, &nvic_sysreg_ops, s,\n\n \"nvic_sysregs\", 0x1000);\n\n memory_region_add_subregion(&s->container, 0, &s->sysregmem);\n\n /* Alias the GIC region so we can get only the section of it\n\n * we need, and layer it on top of the system register region.\n\n */\n\n memory_region_init_alias(&s->gic_iomem_alias, \"nvic-gic\", &s->gic.iomem,\n\n 0x100, 0xc00);\n\n memory_region_add_subregion_overlap(&s->container, 0x100,\n\n &s->gic_iomem_alias, 1);\n\n /* Map the whole thing into system memory at the location required\n\n * by the v7M architecture.\n\n */\n\n memory_region_add_subregion(get_system_memory(), 0xe000e000, &s->container);\n\n s->systick.timer = qemu_new_timer_ns(vm_clock, systick_timer_tick, s);\n\n return 0;\n\n}\n"}} {"sample_id": "3748b2b8e8bcedba2de7fe826c4094169a885840", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n int avfilter_graph_add_filter(AVFilterGraph *graph, AVFilterContext *filter)\n+\n+{\n+\n graph->filters = av_realloc(graph->filters,\n \n sizeof(AVFilterContext*) * ++graph->filter_count);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int avfilter_graph_add_filter(AVFilterGraph *graph, AVFilterContext *filter)\n\n{\n\n graph->filters = av_realloc(graph->filters,\n\n sizeof(AVFilterContext*) * ++graph->filter_count);\n\n\n\n if (!graph->filters)\n\n return AVERROR(ENOMEM);\n\n\n\n graph->filters[graph->filter_count - 1] = filter;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_66", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n uint32_t val;\n \n \n+\n+ val = bswap16(cpu_inw(addr & IOPORTS_MASK));\n+\n return val;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t pci_apb_ioreadw (void *opaque, target_phys_addr_t addr)\n\n{\n\n uint32_t val;\n\n\n\n val = bswap16(cpu_inw(addr & IOPORTS_MASK));\n\n return val;\n\n}\n"}} {"sample_id": "4cc896ea5f06f8b1ebcde6d876d9c5b59ef9a016", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void av_register_input_format(AVInputFormat *format)\n \n+{\n+\n+ AVInputFormat **p = last_iformat;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void av_register_input_format(AVInputFormat *format)\n\n{\n\n AVInputFormat **p = last_iformat;\n\n\n\n format->next = NULL;\n\n while(*p || avpriv_atomic_ptr_cas((void * volatile *)p, NULL, format))\n\n p = &(*p)->next;\n\n last_iformat = &format->next;\n\n}\n"}} {"sample_id": "d4d34b0d3f5af5c8e09980da0de2eebe9a27dc71_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -46,11 +46,11 @@\n \n return;\n \n+ }\n+\n+ ret = parse(dev, str, ptr);\n+\n+ error_set_from_qdev_prop_error(errp, ret, dev, prop, str);\n \n g_free(str);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void set_pointer(Object *obj, Visitor *v, Property *prop,\n\n int (*parse)(DeviceState *dev, const char *str, void **ptr),\n\n const char *name, Error **errp)\n\n{\n\n DeviceState *dev = DEVICE(obj);\n\n Error *local_err = NULL;\n\n void **ptr = qdev_get_prop_ptr(dev, prop);\n\n char *str;\n\n int ret;\n\n\n\n if (dev->state != DEV_STATE_CREATED) {\n\n error_set(errp, QERR_PERMISSION_DENIED);\n\n return;\n\n }\n\n\n\n visit_type_str(v, &str, name, &local_err);\n\n if (local_err) {\n\n error_propagate(errp, local_err);\n\n return;\n\n }\n\n if (!*str) {\n\n g_free(str);\n\n *ptr = NULL;\n\n return;\n\n }\n\n ret = parse(dev, str, ptr);\n\n error_set_from_qdev_prop_error(errp, ret, dev, prop, str);\n\n g_free(str);\n\n}\n"}} {"sample_id": "9b2fadda3e0196ffd485adde4fe9cdd6fae35300_43", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void gen_wrteei(DisasContext *ctx)\n+\n+{\n+\n #if defined(CONFIG_USER_ONLY)\n \n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n@@ -10,7 +10,7 @@\n \n if (unlikely(ctx->pr)) {\n \n+ gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n \n return;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void gen_wrteei(DisasContext *ctx)\n\n{\n\n#if defined(CONFIG_USER_ONLY)\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n#else\n\n if (unlikely(ctx->pr)) {\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n return;\n\n }\n\n if (ctx->opcode & 0x00008000) {\n\n tcg_gen_ori_tl(cpu_msr, cpu_msr, (1 << MSR_EE));\n\n /* Stop translation to have a chance to raise an exception */\n\n gen_stop_exception(ctx);\n\n } else {\n\n tcg_gen_andi_tl(cpu_msr, cpu_msr, ~(1 << MSR_EE));\n\n }\n\n#endif\n\n}\n"}} {"sample_id": "ef0d779706c77ca9007527bd8d41e9400682f4e4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int ogg_new_buf(struct ogg *ogg, int idx)\n \n+{\n \n struct ogg_stream *os = ogg->streams + idx;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int ogg_new_buf(struct ogg *ogg, int idx)\n\n{\n\n struct ogg_stream *os = ogg->streams + idx;\n\n uint8_t *nb = av_malloc(os->bufsize);\n\n int size = os->bufpos - os->pstart;\n\n if(os->buf){\n\n memcpy(nb, os->buf + os->pstart, size);\n\n av_free(os->buf);\n\n }\n\n os->buf = nb;\n\n os->bufpos = size;\n\n os->pstart = 0;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "bc994b74ea38579e18f9d9144021c6f8de597a34", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,10 +9,10 @@\n channel_subsys.do_crw_mchk = true;\n \n channel_subsys.crws_lost = false;\n+\n+ channel_subsys.chnmon_active = false;\n+\n+ QTAILQ_INIT(&channel_subsys.io_adapters);\n \n QTAILQ_INIT(&channel_subsys.indicator_addresses);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void css_init(void)\n\n{\n\n QTAILQ_INIT(&channel_subsys.pending_crws);\n\n channel_subsys.sei_pending = false;\n\n channel_subsys.do_crw_mchk = true;\n\n channel_subsys.crws_lost = false;\n\n channel_subsys.chnmon_active = false;\n\n QTAILQ_INIT(&channel_subsys.io_adapters);\n\n QTAILQ_INIT(&channel_subsys.indicator_addresses);\n\n}\n"}} {"sample_id": "e155494cf0b876c45c3c68a9ab6c641aac22dfdf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int qio_channel_command_close(QIOChannel *ioc,\n \n Error **errp)\n+\n {\n \n+ QIOChannelCommand *cioc = QIO_CHANNEL_COMMAND(ioc);\n \n int rv = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static int qio_channel_command_close(QIOChannel *ioc,\n\n Error **errp)\n\n{\n\n QIOChannelCommand *cioc = QIO_CHANNEL_COMMAND(ioc);\n\n int rv = 0;\n\n\n\n /* We close FDs before killing, because that\n\n * gives a better chance of clean shutdown\n\n */\n\n if (close(cioc->writefd) < 0) {\n\n rv = -1;\n\n }\n\n if (close(cioc->readfd) < 0) {\n\n rv = -1;\n\n }\n\n#ifndef WIN32\n\n if (qio_channel_command_abort(cioc, errp) < 0) {\n\n return -1;\n\n }\n\n#endif\n\n if (rv < 0) {\n\n error_setg_errno(errp, errno, \"%s\",\n\n \"Unable to close command\");\n\n }\n\n return rv;\n\n}\n"}} {"sample_id": "8b3b720620a1137a1b794fc3ed64734236f94e06_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n {\n \n int l2_start_index = l2_index & ~(L1_ENTRIES_PER_SECTOR - 1);\n+\n int start_offset = (8 * l2_index) & ~511;\n \n int end_offset = (8 * (l2_index + num) + 511) & ~511;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int write_l2_entries(BlockDriverState *bs, uint64_t *l2_table,\n\n uint64_t l2_offset, int l2_index, int num)\n\n{\n\n int l2_start_index = l2_index & ~(L1_ENTRIES_PER_SECTOR - 1);\n\n int start_offset = (8 * l2_index) & ~511;\n\n int end_offset = (8 * (l2_index + num) + 511) & ~511;\n\n size_t len = end_offset - start_offset;\n\n int ret;\n\n\n\n BLKDBG_EVENT(bs->file, BLKDBG_L2_UPDATE);\n\n ret = bdrv_pwrite(bs->file, l2_offset + start_offset,\n\n &l2_table[l2_start_index], len);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "f3c7d0389fe8a2792fd4c1cf151b885de03c8f62_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n \n \n memory_region_init(&s->container_mem, obj, \"container\", 0x10000000);\n+\n sysbus_init_mmio(sbd, &s->container_mem);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void pxa2xx_pcmcia_initfn(Object *obj)\n\n{\n\n SysBusDevice *sbd = SYS_BUS_DEVICE(obj);\n\n PXA2xxPCMCIAState *s = PXA2XX_PCMCIA(obj);\n\n\n\n memory_region_init(&s->container_mem, obj, \"container\", 0x10000000);\n\n sysbus_init_mmio(sbd, &s->container_mem);\n\n\n\n /* Socket I/O Memory Space */\n\n memory_region_init_io(&s->iomem, NULL, &pxa2xx_pcmcia_io_ops, s,\n\n \"pxa2xx-pcmcia-io\", 0x04000000);\n\n memory_region_add_subregion(&s->container_mem, 0x00000000,\n\n &s->iomem);\n\n\n\n /* Then next 64 MB is reserved */\n\n\n\n /* Socket Attribute Memory Space */\n\n memory_region_init_io(&s->attr_iomem, NULL, &pxa2xx_pcmcia_attr_ops, s,\n\n \"pxa2xx-pcmcia-attribute\", 0x04000000);\n\n memory_region_add_subregion(&s->container_mem, 0x08000000,\n\n &s->attr_iomem);\n\n\n\n /* Socket Common Memory Space */\n\n memory_region_init_io(&s->common_iomem, NULL, &pxa2xx_pcmcia_common_ops, s,\n\n \"pxa2xx-pcmcia-common\", 0x04000000);\n\n memory_region_add_subregion(&s->container_mem, 0x0c000000,\n\n &s->common_iomem);\n\n\n\n s->slot.irq = qemu_allocate_irqs(pxa2xx_pcmcia_set_irq, s, 1)[0];\n\n\n\n object_property_add_link(obj, \"card\", TYPE_PCMCIA_CARD,\n\n (Object **)&s->card,\n\n NULL, /* read-only property */\n\n 0, NULL);\n\n}\n"}} {"sample_id": "07caea315a85ebfe90851f9c2e4ef3fdd24117b5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n int i;\n \n+\n \n for(i = 0; i < nb_nics; i++) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void network_init(void)\n\n{\n\n int i;\n\n\n\n for(i = 0; i < nb_nics; i++) {\n\n NICInfo *nd = &nd_table[i];\n\n const char *default_devaddr = NULL;\n\n\n\n if (i == 0 && (!nd->model || strcmp(nd->model, \"pcnet\") == 0))\n\n /* The malta board has a PCNet card using PCI SLOT 11 */\n\n default_devaddr = \"0b\";\n\n\n\n pci_nic_init(nd, \"pcnet\", default_devaddr);\n\n }\n\n}\n"}} {"sample_id": "62b9fc1571b1354cf596a280b5fe55a9593a7a2f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n \n \n nom = FFABS(nom)/gcd;\n+\n den = FFABS(den)/gcd;\n \n if(nom<=max && den<=max){", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int av_reduce(int *dst_nom, int *dst_den, int64_t nom, int64_t den, int64_t max){\n\n AVRational a0={0,1}, a1={1,0};\n\n int sign= (nom<0) ^ (den<0);\n\n int64_t gcd= ff_gcd(FFABS(nom), FFABS(den));\n\n\n\n nom = FFABS(nom)/gcd;\n\n den = FFABS(den)/gcd;\n\n if(nom<=max && den<=max){\n\n a1= (AVRational){nom, den};\n\n den=0;\n\n }\n\n\n\n while(den){\n\n int64_t x = nom / den;\n\n int64_t next_den= nom - den*x;\n\n int64_t a2n= x*a1.num + a0.num;\n\n int64_t a2d= x*a1.den + a0.den;\n\n\n\n if(a2n > max || a2d > max){\n\n if(a1.num) x= (max - a0.num) / a1.num;\n\n if(a1.den) x= FFMIN(x, (max - a0.den) / a1.den);\n\n\n\n // Won't overflow, sum == original denominator\n\n if (den*(2*x*a1.den + a0.den) > nom*a1.den)\n\n a1 = (AVRational){x*a1.num + a0.num, x*a1.den + a0.den};\n\n break;\n\n }\n\n\n\n a0= a1;\n\n a1= (AVRational){a2n, a2d};\n\n nom= den;\n\n den= next_den;\n\n }\n\n assert(ff_gcd(a1.num, a1.den) == 1);\n\n\n\n *dst_nom = sign ? -a1.num : a1.num;\n\n *dst_den = a1.den;\n\n\n\n return den==0;\n\n}\n"}} {"sample_id": "190f6135b48a97dadd7586f154640bec6468df1b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n ResetEvent(ctx->event);\n \n+ ReleaseMutex(ctx->mutex);\n+\n+ if (!pktl) {\n+\n+ if (s->flags & AVFMT_FLAG_NONBLOCK) {\n \n return AVERROR(EAGAIN);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int dshow_read_packet(AVFormatContext *s, AVPacket *pkt)\n\n{\n\n struct dshow_ctx *ctx = s->priv_data;\n\n AVPacketList *pktl = NULL;\n\n\n\n while (!pktl) {\n\n WaitForSingleObject(ctx->mutex, INFINITE);\n\n pktl = ctx->pktl;\n\n if (pktl) {\n\n *pkt = pktl->pkt;\n\n ctx->pktl = ctx->pktl->next;\n\n av_free(pktl);\n\n ctx->curbufsize -= pkt->size;\n\n }\n\n ResetEvent(ctx->event);\n\n ReleaseMutex(ctx->mutex);\n\n if (!pktl) {\n\n if (s->flags & AVFMT_FLAG_NONBLOCK) {\n\n return AVERROR(EAGAIN);\n\n } else {\n\n WaitForSingleObject(ctx->event, INFINITE);\n\n }\n\n }\n\n }\n\n\n\n return pkt->size;\n\n}\n"}} {"sample_id": "75af1f34cd5b07c3c7fcf86dfc99a42de48a600d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n \n \n+ if (size > INT_MAX) {\n+\n+ return -EIO;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int bdrv_check_byte_request(BlockDriverState *bs, int64_t offset,\n\n size_t size)\n\n{\n\n int64_t len;\n\n\n\n if (size > INT_MAX) {\n\n return -EIO;\n\n }\n\n\n\n if (!bdrv_is_inserted(bs))\n\n return -ENOMEDIUM;\n\n\n\n if (bs->growable)\n\n return 0;\n\n\n\n len = bdrv_getlength(bs);\n\n\n\n if (offset < 0)\n\n return -EIO;\n\n\n\n if ((offset > len) || (len - offset < size))\n\n return -EIO;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "b5ec5ce0e39d6e7ea707d5604a5f6d567dfd2f48_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n \n \n for (i = 0; i < ARRAY_SIZE(x86_defs); i++)\n+\n+ (*cpu_fprintf)(f, \"x86 %16s\\n\", x86_defs[i].name);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void x86_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...))\n\n{\n\n unsigned int i;\n\n\n\n for (i = 0; i < ARRAY_SIZE(x86_defs); i++)\n\n (*cpu_fprintf)(f, \"x86 %16s\\n\", x86_defs[i].name);\n\n}\n"}} {"sample_id": "f8cab062caacba2982a0d0bccd504b11c073caf6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n return 0;\n \n size += get_le32(pb);\n+\n+ blockid = get_le32(pb);\n+\n+ if (blockid == GSTR_TAG) {\n+\n url_fskip(pb, 4);\n \n } else if (blockid != PT00_TAG) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int process_ea_header(AVFormatContext *s) {\n\n uint32_t blockid, size = 0;\n\n EaDemuxContext *ea = s->priv_data;\n\n ByteIOContext *pb = &s->pb;\n\n\n\n blockid = get_le32(pb);\n\n if (blockid == MVhd_TAG) {\n\n size = get_le32(pb);\n\n process_video_header_vp6(s);\n\n url_fskip(pb, size-32);\n\n blockid = get_le32(pb);\n\n }\n\n if (blockid != SCHl_TAG)\n\n return 0;\n\n size += get_le32(pb);\n\n blockid = get_le32(pb);\n\n if (blockid == GSTR_TAG) {\n\n url_fskip(pb, 4);\n\n } else if (blockid != PT00_TAG) {\n\n av_log (s, AV_LOG_ERROR, \"unknown SCHl headerid\\n\");\n\n return 0;\n\n }\n\n\n\n process_audio_header_elements(s);\n\n\n\n /* skip to the start of the data */\n\n url_fseek(pb, size, SEEK_SET);\n\n\n\n return 1;\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_33", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,21 +1,21 @@\n void qvirtqueue_pci_msix_setup(QVirtioPCIDevice *d, QVirtQueuePCI *vqpci,\n \n QGuestAllocator *alloc, uint16_t entry)\n+\n {\n+\n uint16_t vector;\n \n uint32_t control;\n \n+ void *addr;\n+\n+\n+\n+ g_assert(d->pdev->msix_enabled);\n \n+ addr = d->pdev->msix_table + (entry * 16);\n+\n \n \n g_assert_cmpint(entry, >=, 0);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void qvirtqueue_pci_msix_setup(QVirtioPCIDevice *d, QVirtQueuePCI *vqpci,\n\n QGuestAllocator *alloc, uint16_t entry)\n\n{\n\n uint16_t vector;\n\n uint32_t control;\n\n void *addr;\n\n\n\n g_assert(d->pdev->msix_enabled);\n\n addr = d->pdev->msix_table + (entry * 16);\n\n\n\n g_assert_cmpint(entry, >=, 0);\n\n g_assert_cmpint(entry, <, qpci_msix_table_size(d->pdev));\n\n vqpci->msix_entry = entry;\n\n\n\n vqpci->msix_addr = guest_alloc(alloc, 4);\n\n qpci_io_writel(d->pdev, addr + PCI_MSIX_ENTRY_LOWER_ADDR,\n\n vqpci->msix_addr & ~0UL);\n\n qpci_io_writel(d->pdev, addr + PCI_MSIX_ENTRY_UPPER_ADDR,\n\n (vqpci->msix_addr >> 32) & ~0UL);\n\n qpci_io_writel(d->pdev, addr + PCI_MSIX_ENTRY_DATA, vqpci->msix_data);\n\n\n\n control = qpci_io_readl(d->pdev, addr + PCI_MSIX_ENTRY_VECTOR_CTRL);\n\n qpci_io_writel(d->pdev, addr + PCI_MSIX_ENTRY_VECTOR_CTRL,\n\n control & ~PCI_MSIX_ENTRY_CTRL_MASKBIT);\n\n\n\n qvirtio_pci_queue_select(&d->vdev, vqpci->vq.index);\n\n qpci_io_writew(d->pdev, d->addr + VIRTIO_MSI_QUEUE_VECTOR, entry);\n\n vector = qpci_io_readw(d->pdev, d->addr + VIRTIO_MSI_QUEUE_VECTOR);\n\n g_assert_cmphex(vector, !=, VIRTIO_MSI_NO_VECTOR);\n\n}\n"}} {"sample_id": "1ad9f0a464fe78d30ee60b3629f7a825cf2fab13_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n uint64_t token = 0;\n+\n+ hwaddr pte_offset;\n+\n+\n+\n pte_offset = pte_index * HASH_PTE_SIZE_64;\n \n if (cpu->env.external_htab == MMU_HASH64_KVM_MANAGED_HPT) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint64_t ppc_hash64_start_access(PowerPCCPU *cpu, target_ulong pte_index)\n\n{\n\n uint64_t token = 0;\n\n hwaddr pte_offset;\n\n\n\n pte_offset = pte_index * HASH_PTE_SIZE_64;\n\n if (cpu->env.external_htab == MMU_HASH64_KVM_MANAGED_HPT) {\n\n /*\n\n * HTAB is controlled by KVM. Fetch the PTEG into a new buffer.\n\n */\n\n token = kvmppc_hash64_read_pteg(cpu, pte_index);\n\n } else if (cpu->env.external_htab) {\n\n /*\n\n * HTAB is controlled by QEMU. Just point to the internally\n\n * accessible PTEG.\n\n */\n\n token = (uint64_t)(uintptr_t) cpu->env.external_htab + pte_offset;\n\n } else if (cpu->env.htab_base) {\n\n token = cpu->env.htab_base + pte_offset;\n\n }\n\n return token;\n\n}\n"}} {"sample_id": "56ee5a9ad1b385129c40ba4773f99bc5943ae8af", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n int b = gamma_lookup[*buf++];\n #endif\n *tmpptr++ = (r << 16) | (g << 8) | b;\n+ }\n+ s->palettes_count++;\n+ break;\n+ case SHOT_TAG:\n+ if (size < 4)\n new_pal = bytestream_get_le32(&buf);\n if (new_pal < s->palettes_count) {\n s->cur_palette = new_pal;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int xan_decode_frame(AVCodecContext *avctx,\n void *data, int *data_size,\n AVPacket *avpkt)\n{\n const uint8_t *buf = avpkt->data;\n int ret, buf_size = avpkt->size;\n XanContext *s = avctx->priv_data;\n if (avctx->codec->id == CODEC_ID_XAN_WC3) {\n const uint8_t *buf_end = buf + buf_size;\n int tag = 0;\n while (buf_end - buf > 8 && tag != VGA__TAG) {\n unsigned *tmpptr;\n uint32_t new_pal;\n int size;\n int i;\n tag = bytestream_get_le32(&buf);\n size = bytestream_get_be32(&buf);\n size = FFMIN(size, buf_end - buf);\n switch (tag) {\n case PALT_TAG:\n if (size < PALETTE_SIZE)\n if (s->palettes_count >= PALETTES_MAX)\n tmpptr = av_realloc(s->palettes, (s->palettes_count + 1) * AVPALETTE_SIZE);\n if (!tmpptr)\n return AVERROR(ENOMEM);\n s->palettes = tmpptr;\n tmpptr += s->palettes_count * AVPALETTE_COUNT;\n for (i = 0; i < PALETTE_COUNT; i++) {\n#if RUNTIME_GAMMA\n int r = gamma_corr(*buf++);\n int g = gamma_corr(*buf++);\n int b = gamma_corr(*buf++);\n#else\n int r = gamma_lookup[*buf++];\n int g = gamma_lookup[*buf++];\n int b = gamma_lookup[*buf++];\n#endif\n *tmpptr++ = (r << 16) | (g << 8) | b;\n }\n s->palettes_count++;\n break;\n case SHOT_TAG:\n if (size < 4)\n new_pal = bytestream_get_le32(&buf);\n if (new_pal < s->palettes_count) {\n s->cur_palette = new_pal;\n } else\n av_log(avctx, AV_LOG_ERROR, \"Invalid palette selected\\n\");\n break;\n case VGA__TAG:\n break;\n default:\n buf += size;\n break;\n }\n }\n buf_size = buf_end - buf;\n }\n if ((ret = avctx->get_buffer(avctx, &s->current_frame))) {\n av_log(s->avctx, AV_LOG_ERROR, \"get_buffer() failed\\n\");\n return ret;\n }\n s->current_frame.reference = 3;\n if (!s->frame_size)\n s->frame_size = s->current_frame.linesize[0] * s->avctx->height;\n memcpy(s->current_frame.data[1], s->palettes + s->cur_palette * AVPALETTE_COUNT, AVPALETTE_SIZE);\n s->buf = buf;\n s->size = buf_size;\n if (xan_wc3_decode_frame(s) < 0)\n /* release the last frame if it is allocated */\n if (s->last_frame.data[0])\n avctx->release_buffer(avctx, &s->last_frame);\n *data_size = sizeof(AVFrame);\n *(AVFrame*)data = s->current_frame;\n /* shuffle frames */\n FFSWAP(AVFrame, s->current_frame, s->last_frame);\n /* always report that the buffer was completely consumed */\n return buf_size;\n}"}} {"sample_id": "8c56c1a592b5092d91da8d8943c17777d6462a6f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n MemTxResult memory_region_dispatch_write(MemoryRegion *mr,\n hwaddr addr,\n uint64_t data,\n+ unsigned size,\n+ MemTxAttrs attrs)\n+{\n+ if (!memory_region_access_valid(mr, addr, size, true)) {\n+ unassigned_mem_write(mr, addr, data, size);\n return MEMTX_DECODE_ERROR;\n adjust_endianness(mr, &data, size);\n if (mr->ops->write) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "MemTxResult memory_region_dispatch_write(MemoryRegion *mr,\n hwaddr addr,\n uint64_t data,\n unsigned size,\n MemTxAttrs attrs)\n{\n if (!memory_region_access_valid(mr, addr, size, true)) {\n unassigned_mem_write(mr, addr, data, size);\n return MEMTX_DECODE_ERROR;\n adjust_endianness(mr, &data, size);\n if (mr->ops->write) {\n return access_with_adjusted_size(addr, &data, size,\n mr->ops->impl.min_access_size,\n mr->ops->impl.max_access_size,\n memory_region_write_accessor, mr,\n attrs);\n } else if (mr->ops->write_with_attrs) {\n return\n access_with_adjusted_size(addr, &data, size,\n mr->ops->impl.min_access_size,\n mr->ops->impl.max_access_size,\n memory_region_write_with_attrs_accessor,\n mr, attrs);\n } else {\n return access_with_adjusted_size(addr, &data, size, 1, 4,\n memory_region_oldmmio_write_accessor,\n mr, attrs);"}} {"sample_id": "d6c1a327a94437f0ed74ba970b97fd962462bc77", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,7 +14,7 @@\n \n fdctrl->state &= ~FD_CTRL_SLEEP;\n \n+ if (FD_STATE(fdctrl->data_state) == FD_STATE_CMD) {\n \n FLOPPY_ERROR(\"can't read data in CMD state\\n\");\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static uint32_t fdctrl_read_data (fdctrl_t *fdctrl)\n\n{\n\n fdrive_t *cur_drv;\n\n uint32_t retval = 0;\n\n int pos, len;\n\n\n\n cur_drv = get_cur_drv(fdctrl);\n\n fdctrl->state &= ~FD_CTRL_SLEEP;\n\n if (FD_STATE(fdctrl->data_state) == FD_STATE_CMD) {\n\n FLOPPY_ERROR(\"can't read data in CMD state\\n\");\n\n return 0;\n\n }\n\n pos = fdctrl->data_pos;\n\n if (FD_STATE(fdctrl->data_state) == FD_STATE_DATA) {\n\n pos %= FD_SECTOR_LEN;\n\n if (pos == 0) {\n\n len = fdctrl->data_len - fdctrl->data_pos;\n\n if (len > FD_SECTOR_LEN)\n\n len = FD_SECTOR_LEN;\n\n bdrv_read(cur_drv->bs, fd_sector(cur_drv),\n\n fdctrl->fifo, len);\n\n }\n\n }\n\n retval = fdctrl->fifo[pos];\n\n if (++fdctrl->data_pos == fdctrl->data_len) {\n\n fdctrl->data_pos = 0;\n\n /* Switch from transfer mode to status mode\n\n * then from status mode to command mode\n\n */\n\n if (FD_STATE(fdctrl->data_state) == FD_STATE_DATA) {\n\n fdctrl_stop_transfer(fdctrl, 0x20, 0x00, 0x00);\n\n } else {\n\n fdctrl_reset_fifo(fdctrl);\n\n fdctrl_reset_irq(fdctrl);\n\n }\n\n }\n\n FLOPPY_DPRINTF(\"data register: 0x%02x\\n\", retval);\n\n\n\n return retval;\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_32", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,10 +20,10 @@\n \n free(entry->match);\n \n+ free(entry);\n+\n+ }\n+\n+ acl->nentries = 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_acl_reset(qemu_acl *acl)\n\n{\n\n qemu_acl_entry *entry;\n\n\n\n /* Put back to deny by default, so there is no window\n\n * of \"open access\" while the user re-initializes the\n\n * access control list */\n\n acl->defaultDeny = 1;\n\n TAILQ_FOREACH(entry, &acl->entries, next) {\n\n TAILQ_REMOVE(&acl->entries, entry, next);\n\n free(entry->match);\n\n free(entry);\n\n }\n\n acl->nentries = 0;\n\n}\n"}} {"sample_id": "65207c59d99f2260c5f1d3b9c491146616a522aa_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+static void user_monitor_complete(void *opaque, QObject *ret_data)\n+\n+{\n+\n MonitorCompletionData *data = (MonitorCompletionData *)opaque; \n+\n+\n \n if (ret_data) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void user_monitor_complete(void *opaque, QObject *ret_data)\n\n{\n\n MonitorCompletionData *data = (MonitorCompletionData *)opaque; \n\n\n\n if (ret_data) {\n\n data->user_print(data->mon, ret_data);\n\n }\n\n monitor_resume(data->mon);\n\n g_free(data);\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_44", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void qvirtio_pci_set_queue_address(QVirtioDevice *d, uint32_t pfn)\n \n+{\n \n QVirtioPCIDevice *dev = (QVirtioPCIDevice *)d;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void qvirtio_pci_set_queue_address(QVirtioDevice *d, uint32_t pfn)\n\n{\n\n QVirtioPCIDevice *dev = (QVirtioPCIDevice *)d;\n\n qpci_io_writel(dev->pdev, dev->addr + VIRTIO_PCI_QUEUE_PFN, pfn);\n\n}\n"}} {"sample_id": "9be385980d37e8f4fd33f605f5fb1c3d144170a8_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n sigprocmask(SIG_SETMASK, &set, 0);\n \n+\n+\n+ pending = atomic_xchg(&ts->signal_pending, 1);\n+\n+\n \n return pending;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int block_signals(void)\n\n{\n\n TaskState *ts = (TaskState *)thread_cpu->opaque;\n\n sigset_t set;\n\n int pending;\n\n\n\n /* It's OK to block everything including SIGSEGV, because we won't\n\n * run any further guest code before unblocking signals in\n\n * process_pending_signals().\n\n */\n\n sigfillset(&set);\n\n sigprocmask(SIG_SETMASK, &set, 0);\n\n\n\n pending = atomic_xchg(&ts->signal_pending, 1);\n\n\n\n return pending;\n\n}\n"}} {"sample_id": "bf1945af301aff54c33352e75f17aec6cb5269d7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void hybrid4_8_12_cx(float (*in)[2], float (*out)[32][2], const float (*filter)[7][2], int N, int len)\n \n+{\n+\n+ int i, j, ssb;\n+\n+\n \n for (i = 0; i < len; i++, in++) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void hybrid4_8_12_cx(float (*in)[2], float (*out)[32][2], const float (*filter)[7][2], int N, int len)\n\n{\n\n int i, j, ssb;\n\n\n\n for (i = 0; i < len; i++, in++) {\n\n for (ssb = 0; ssb < N; ssb++) {\n\n float sum_re = filter[ssb][6][0] * in[6][0], sum_im = filter[ssb][6][0] * in[6][1];\n\n for (j = 0; j < 6; j++) {\n\n float in0_re = in[j][0];\n\n float in0_im = in[j][1];\n\n float in1_re = in[12-j][0];\n\n float in1_im = in[12-j][1];\n\n sum_re += filter[ssb][j][0] * (in0_re + in1_re) - filter[ssb][j][1] * (in0_im - in1_im);\n\n sum_im += filter[ssb][j][0] * (in0_im + in1_im) + filter[ssb][j][1] * (in0_re - in1_re);\n\n }\n\n out[ssb][i][0] = sum_re;\n\n out[ssb][i][1] = sum_im;\n\n }\n\n }\n\n}\n"}} {"sample_id": "9e6636c72d8d6f0605e23ed820c8487686882b12_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n \n \n if (!job->job_type->set_speed) {\n+\n+ return -ENOTSUP;\n+\n+ }\n+\n rc = job->job_type->set_speed(job, value);\n \n if (rc == 0) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int block_job_set_speed(BlockJob *job, int64_t value)\n\n{\n\n int rc;\n\n\n\n if (!job->job_type->set_speed) {\n\n return -ENOTSUP;\n\n }\n\n rc = job->job_type->set_speed(job, value);\n\n if (rc == 0) {\n\n job->speed = value;\n\n }\n\n return rc;\n\n}\n"}} {"sample_id": "04920fc0faa4760f9c4fc0e73b992b768099be70_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void do_info_roms(Monitor *mon, const QDict *qdict)\n \n {\n+\n Rom *rom;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void do_info_roms(Monitor *mon, const QDict *qdict)\n\n{\n\n Rom *rom;\n\n\n\n QTAILQ_FOREACH(rom, &roms, next) {\n\n if (!rom->fw_file) {\n\n monitor_printf(mon, \"addr=\" TARGET_FMT_plx\n\n \" size=0x%06zx mem=%s name=\\\"%s\\\"\\n\",\n\n rom->addr, rom->romsize,\n\n rom->isrom ? \"rom\" : \"ram\",\n\n rom->name);\n\n } else {\n\n monitor_printf(mon, \"fw=%s/%s\"\n\n \" size=0x%06zx name=\\\"%s\\\"\\n\",\n\n rom->fw_dir,\n\n rom->fw_file,\n\n rom->romsize,\n\n rom->name);\n\n }\n\n }\n\n}\n"}} {"sample_id": "e70377dfa4bbc2e101066ca35675bed4129c5a8c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n dev = s->pbdev[idx];\n \n if (dev && dev->state != ZPCI_FS_RESERVED) {\n+\n+ return dev;\n+\n+ }\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "S390PCIBusDevice *s390_pci_find_next_avail_dev(S390PCIBusDevice *pbdev)\n\n{\n\n int idx = 0;\n\n S390PCIBusDevice *dev = NULL;\n\n S390pciState *s = s390_get_phb();\n\n\n\n if (pbdev) {\n\n idx = (pbdev->fh & FH_MASK_INDEX) + 1;\n\n }\n\n\n\n for (; idx < PCI_SLOT_MAX; idx++) {\n\n dev = s->pbdev[idx];\n\n if (dev && dev->state != ZPCI_FS_RESERVED) {\n\n return dev;\n\n }\n\n }\n\n\n\n return NULL;\n\n}\n"}} {"sample_id": "5f758366c0710d23e43f4d0f83816b98616a13d0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static CharDriverState *qmp_chardev_open_parallel(ChardevHostdev *parallel,\n \n Error **errp)\n+\n {\n \n #ifdef HAVE_CHARDEV_PARPORT", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static CharDriverState *qmp_chardev_open_parallel(ChardevHostdev *parallel,\n\n Error **errp)\n\n{\n\n#ifdef HAVE_CHARDEV_PARPORT\n\n int fd;\n\n\n\n fd = qmp_chardev_open_file_source(parallel->device, O_RDWR, errp);\n\n if (error_is_set(errp)) {\n\n return NULL;\n\n }\n\n return qemu_chr_open_pp_fd(fd);\n\n#else\n\n error_setg(errp, \"character device backend type 'parallel' not supported\");\n\n return NULL;\n\n#endif\n\n}\n"}} {"sample_id": "f6b7f72461673e4d398b1edf9ed2a7fe70d99c47", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n tc[1] = tc0_table[index_a][bS[1]];\n \n+ tc[2] = tc0_table[index_a][bS[2]];\n+\n+ tc[3] = tc0_table[index_a][bS[3]];\n+\n+ h->h264dsp.h264_h_loop_filter_luma(pix, stride, alpha, beta, tc);\n \n } else {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void av_always_inline filter_mb_edgev( uint8_t *pix, int stride, const int16_t bS[4], unsigned int qp, H264Context *h, int intra ) {\n\n const int qp_bd_offset = 6 * (h->sps.bit_depth_luma - 8);\n\n const unsigned int index_a = qp - qp_bd_offset + h->slice_alpha_c0_offset;\n\n const int alpha = alpha_table[index_a];\n\n const int beta = beta_table[qp - qp_bd_offset + h->slice_beta_offset];\n\n if (alpha ==0 || beta == 0) return;\n\n\n\n if( bS[0] < 4 || !intra ) {\n\n int8_t tc[4];\n\n tc[0] = tc0_table[index_a][bS[0]];\n\n tc[1] = tc0_table[index_a][bS[1]];\n\n tc[2] = tc0_table[index_a][bS[2]];\n\n tc[3] = tc0_table[index_a][bS[3]];\n\n h->h264dsp.h264_h_loop_filter_luma(pix, stride, alpha, beta, tc);\n\n } else {\n\n h->h264dsp.h264_h_loop_filter_luma_intra(pix, stride, alpha, beta);\n\n }\n\n}\n"}} {"sample_id": "b51910baf227f0fd64abfa7ad6d8e00150a18194", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n switch (code) {\n \n+ case BRK_OVERFLOW:\n+\n+ case BRK_DIVZERO:\n+\n+ info->si_signo = TARGET_SIGFPE;\n \n \n info->si_code = (code == BRK_OVERFLOW) ? FPE_INTOVF : FPE_INTDIV;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int do_break(CPUMIPSState *env, target_siginfo_t *info,\n\n unsigned int code)\n\n{\n\n int ret = -1;\n\n\n\n switch (code) {\n\n case BRK_OVERFLOW:\n\n case BRK_DIVZERO:\n\n info->si_signo = TARGET_SIGFPE;\n\n\n info->si_code = (code == BRK_OVERFLOW) ? FPE_INTOVF : FPE_INTDIV;\n\n\n\n break;\n\n default:\n\n\n\n\n\n break;\n\n }\n\n\n\n return ret;\n\n}"}} {"sample_id": "06b106889a09277617fc8c542397a9f595ee605a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n+static RAMBlock *unqueue_page(RAMState *rs, ram_addr_t *offset,\n \n ram_addr_t *ram_addr_abs)\n \n {\n \n RAMBlock *block = NULL;\n+\n \n \n qemu_mutex_lock(&rs->src_page_req_mutex);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static RAMBlock *unqueue_page(RAMState *rs, ram_addr_t *offset,\n\n ram_addr_t *ram_addr_abs)\n\n{\n\n RAMBlock *block = NULL;\n\n\n\n qemu_mutex_lock(&rs->src_page_req_mutex);\n\n if (!QSIMPLEQ_EMPTY(&rs->src_page_requests)) {\n\n struct RAMSrcPageRequest *entry =\n\n QSIMPLEQ_FIRST(&rs->src_page_requests);\n\n block = entry->rb;\n\n *offset = entry->offset;\n\n *ram_addr_abs = (entry->offset + entry->rb->offset) &\n\n TARGET_PAGE_MASK;\n\n\n\n if (entry->len > TARGET_PAGE_SIZE) {\n\n entry->len -= TARGET_PAGE_SIZE;\n\n entry->offset += TARGET_PAGE_SIZE;\n\n } else {\n\n memory_region_unref(block->mr);\n\n QSIMPLEQ_REMOVE_HEAD(&rs->src_page_requests, next_req);\n\n g_free(entry);\n\n }\n\n }\n\n qemu_mutex_unlock(&rs->src_page_req_mutex);\n\n\n\n return block;\n\n}\n"}} {"sample_id": "5e715b583dab85735660b15a8d217a69164675fe_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int parse_metadata_ext(DBEContext *s)\n+\n+{\n \n if (s->mtd_ext_size)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int parse_metadata_ext(DBEContext *s)\n\n{\n\n if (s->mtd_ext_size)\n\n skip_input(s, s->key_present + s->mtd_ext_size + 1);\n\n return 0;\n\n}\n"}} {"sample_id": "773eb74babe07bc5c97c32aa564efc40e2d4b00c_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+callback(void *priv_data, int index, uint8_t *buf, int buf_size, int64_t time)\n \n {\n \n AVFormatContext *s = priv_data;\n+\n struct dshow_ctx *ctx = s->priv_data;\n \n AVPacketList **ppktl, *pktl_next;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "callback(void *priv_data, int index, uint8_t *buf, int buf_size, int64_t time)\n\n{\n\n AVFormatContext *s = priv_data;\n\n struct dshow_ctx *ctx = s->priv_data;\n\n AVPacketList **ppktl, *pktl_next;\n\n\n\n// dump_videohdr(s, vdhdr);\n\n\n\n WaitForSingleObject(ctx->mutex, INFINITE);\n\n\n\n if(shall_we_drop(s, index))\n\n goto fail;\n\n\n\n pktl_next = av_mallocz(sizeof(AVPacketList));\n\n if(!pktl_next)\n\n goto fail;\n\n\n\n if(av_new_packet(&pktl_next->pkt, buf_size) < 0) {\n\n av_free(pktl_next);\n\n goto fail;\n\n }\n\n\n\n pktl_next->pkt.stream_index = index;\n\n pktl_next->pkt.pts = time;\n\n memcpy(pktl_next->pkt.data, buf, buf_size);\n\n\n\n for(ppktl = &ctx->pktl ; *ppktl ; ppktl = &(*ppktl)->next);\n\n *ppktl = pktl_next;\n\n ctx->curbufsize[index] += buf_size;\n\n\n\n SetEvent(ctx->event[1]);\n\n ReleaseMutex(ctx->mutex);\n\n\n\n return;\n\nfail:\n\n ReleaseMutex(ctx->mutex);\n\n return;\n\n}\n"}} {"sample_id": "271c0f68b4eae72691721243a1c37f46a3232d61", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n \n \n qemu_mutex_lock(&pool->lock);\n+\n+ if (elem->state == THREAD_QUEUED &&\n+\n+ /* No thread has yet started working on elem. we can try to \"steal\"\n+\n * the item from the worker if we can get a signal from the\n \n * semaphore. Because this is non-blocking, we can do it with", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void thread_pool_cancel(BlockDriverAIOCB *acb)\n\n{\n\n ThreadPoolElement *elem = (ThreadPoolElement *)acb;\n\n ThreadPool *pool = elem->pool;\n\n\n\n trace_thread_pool_cancel(elem, elem->common.opaque);\n\n\n\n qemu_mutex_lock(&pool->lock);\n\n if (elem->state == THREAD_QUEUED &&\n\n /* No thread has yet started working on elem. we can try to \"steal\"\n\n * the item from the worker if we can get a signal from the\n\n * semaphore. Because this is non-blocking, we can do it with\n\n * the lock taken and ensure that elem will remain THREAD_QUEUED.\n\n */\n\n qemu_sem_timedwait(&pool->sem, 0) == 0) {\n\n QTAILQ_REMOVE(&pool->request_list, elem, reqs);\n\n elem->state = THREAD_CANCELED;\n\n event_notifier_set(&pool->notifier);\n\n } else {\n\n pool->pending_cancellations++;\n\n while (elem->state != THREAD_CANCELED && elem->state != THREAD_DONE) {\n\n qemu_cond_wait(&pool->check_cancel, &pool->lock);\n\n }\n\n pool->pending_cancellations--;\n\n }\n\n qemu_mutex_unlock(&pool->lock);\n\n\n}"}} {"sample_id": "7859cc6e39bf86f890bb1c72fd9ba41deb6ce2e7_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,8 +14,8 @@\n \n tlb_entry->addr_write = (tlb_entry->addr_write & TARGET_PAGE_MASK) | TLB_NOTDIRTY;\n \n+ }\n+\n+ }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry,\n\n unsigned long start, unsigned long length)\n\n{\n\n unsigned long addr;\n\n if ((tlb_entry->addr_write & ~TARGET_PAGE_MASK) == io_mem_ram.ram_addr) {\n\n addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend;\n\n if ((addr - start) < length) {\n\n tlb_entry->addr_write = (tlb_entry->addr_write & TARGET_PAGE_MASK) | TLB_NOTDIRTY;\n\n }\n\n }\n\n}\n"}} {"sample_id": "b8ed15d6378f00e158c72c526fa0fce17da77361", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n if (memcmp(buf, \"FLV\", 3))\n \n+ return AVERROR_INVALIDDATA;\n \n buf += 13;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int parse_header(OutputStream *os, const uint8_t *buf, int buf_size)\n\n{\n\n if (buf_size < 13)\n\n return AVERROR_INVALIDDATA;\n\n if (memcmp(buf, \"FLV\", 3))\n\n return AVERROR_INVALIDDATA;\n\n buf += 13;\n\n buf_size -= 13;\n\n while (buf_size >= 11 + 4) {\n\n int type = buf[0];\n\n int size = AV_RB24(&buf[1]) + 11 + 4;\n\n if (size > buf_size)\n\n return AVERROR_INVALIDDATA;\n\n if (type == 8 || type == 9) {\n\n if (os->nb_extra_packets > FF_ARRAY_ELEMS(os->extra_packets))\n\n return AVERROR_INVALIDDATA;\n\n os->extra_packet_sizes[os->nb_extra_packets] = size;\n\n os->extra_packets[os->nb_extra_packets] = av_malloc(size);\n\n if (!os->extra_packets[os->nb_extra_packets])\n\n return AVERROR(ENOMEM);\n\n memcpy(os->extra_packets[os->nb_extra_packets], buf, size);\n\n os->nb_extra_packets++;\n\n } else if (type == 0x12) {\n\n if (os->metadata)\n\n return AVERROR_INVALIDDATA;\n\n os->metadata_size = size - 11 - 4;\n\n os->metadata = av_malloc(os->metadata_size);\n\n if (!os->metadata)\n\n return AVERROR(ENOMEM);\n\n memcpy(os->metadata, buf + 11, os->metadata_size);\n\n }\n\n buf += size;\n\n buf_size -= size;\n\n }\n\n if (!os->metadata)\n\n return AVERROR_INVALIDDATA;\n\n return 0;\n\n}\n"}} {"sample_id": "507dce2536fea4b78a9f4973f77e1fa20cfe1b81_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n \n \n+ if (HAVE_NEON)\n+\n+ ff_rv34dsp_init_neon(c, dsp);\n+\n+ if (ARCH_X86)\n \n ff_rv34dsp_init_x86(c, dsp);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "av_cold void ff_rv34dsp_init(RV34DSPContext *c, DSPContext* dsp) {\n\n c->rv34_inv_transform = rv34_inv_transform_noround_c;\n\n c->rv34_inv_transform_dc = rv34_inv_transform_dc_noround_c;\n\n\n\n c->rv34_idct_add = rv34_idct_add_c;\n\n c->rv34_idct_dc_add = rv34_idct_dc_add_c;\n\n\n\n if (HAVE_NEON)\n\n ff_rv34dsp_init_neon(c, dsp);\n\n if (ARCH_X86)\n\n ff_rv34dsp_init_x86(c, dsp);\n\n}\n"}} {"sample_id": "82d90705fe203cc6e150c10bd61f0dbe6979e8f4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n \n \n for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {\n+\n AioContext *ctx = bdrv_get_aio_context(bs);\n \n if (ctx == qemu_get_aio_context()) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void iothread_stop_all(void)\n\n{\n\n Object *container = object_get_objects_root();\n\n BlockDriverState *bs;\n\n BdrvNextIterator it;\n\n\n\n for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {\n\n AioContext *ctx = bdrv_get_aio_context(bs);\n\n if (ctx == qemu_get_aio_context()) {\n\n continue;\n\n }\n\n aio_context_acquire(ctx);\n\n bdrv_set_aio_context(bs, qemu_get_aio_context());\n\n aio_context_release(ctx);\n\n }\n\n\n\n object_child_foreach(container, iothread_stop, NULL);\n\n}\n"}} {"sample_id": "e87190f5d20d380608f792ceb14d0def1d80e24b_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n AVChapter *chapter = fmt_ctx->chapters[i];\n \n \n+\n+ writer_print_section_header(w, SECTION_ID_CHAPTER);\n+\n+ print_int(\"id\", chapter->id);\n+\n print_q (\"time_base\", chapter->time_base, '/');\n \n print_int(\"start\", chapter->start);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void show_chapters(WriterContext *w, AVFormatContext *fmt_ctx)\n\n{\n\n int i;\n\n\n\n writer_print_section_header(w, SECTION_ID_CHAPTERS);\n\n for (i = 0; i < fmt_ctx->nb_chapters; i++) {\n\n AVChapter *chapter = fmt_ctx->chapters[i];\n\n\n\n writer_print_section_header(w, SECTION_ID_CHAPTER);\n\n print_int(\"id\", chapter->id);\n\n print_q (\"time_base\", chapter->time_base, '/');\n\n print_int(\"start\", chapter->start);\n\n print_time(\"start_time\", chapter->start, &chapter->time_base);\n\n print_int(\"end\", chapter->end);\n\n print_time(\"end_time\", chapter->end, &chapter->time_base);\n\n show_tags(w, chapter->metadata, SECTION_ID_CHAPTER_TAGS);\n\n writer_print_section_footer(w);\n\n }\n\n writer_print_section_footer(w);\n\n}\n"}} {"sample_id": "3a53009fa044a554dbdeacf30a6b8ea3eb02fe63", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n char *object_property_print(Object *obj, const char *name, bool human,\n \n+ Error **errp)\n \n+{\n \n StringOutputVisitor *mo;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "char *object_property_print(Object *obj, const char *name, bool human,\n\n Error **errp)\n\n{\n\n StringOutputVisitor *mo;\n\n char *string;\n\n\n\n mo = string_output_visitor_new(human);\n\n object_property_get(obj, string_output_get_visitor(mo), name, errp);\n\n string = string_output_get_string(mo);\n\n string_output_visitor_cleanup(mo);\n\n return string;\n\n}\n"}} {"sample_id": "72902672dc2ed6281cdb205259c1d52ecf01f6b2_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n+uint64_t HELPER(neon_sub_saturate_s64)(uint64_t src1, uint64_t src2)\n+\n+{\n+\n+ uint64_t res;\n+\n \n+\n res = src1 - src2;\n \n if (((res ^ src1) & SIGNBIT64) && ((src1 ^ src2) & SIGNBIT64)) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "uint64_t HELPER(neon_sub_saturate_s64)(uint64_t src1, uint64_t src2)\n\n{\n\n uint64_t res;\n\n\n\n res = src1 - src2;\n\n if (((res ^ src1) & SIGNBIT64) && ((src1 ^ src2) & SIGNBIT64)) {\n\n env->QF = 1;\n\n res = ((int64_t)src1 >> 63) ^ ~SIGNBIT64;\n\n }\n\n return res;\n\n}\n"}} {"sample_id": "f2c539d3501111f10a2b4e9480ea54c0a3190680", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n int i;\n \n if (lag) { /* Voiced */\n+\n int16_t *vector_ptr = buf + PITCH_MAX;\n \n /* Attenuate */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void residual_interp(int16_t *buf, int16_t *out, int lag,\n\n int gain, int *rseed)\n\n{\n\n int i;\n\n if (lag) { /* Voiced */\n\n int16_t *vector_ptr = buf + PITCH_MAX;\n\n /* Attenuate */\n\n for (i = 0; i < lag; i++)\n\n out[i] = vector_ptr[i - lag] * 3 >> 2;\n\n av_memcpy_backptr((uint8_t*)(out + lag), lag * sizeof(*out),\n\n (FRAME_LEN - lag) * sizeof(*out));\n\n } else { /* Unvoiced */\n\n for (i = 0; i < FRAME_LEN; i++) {\n\n *rseed = *rseed * 521 + 259;\n\n out[i] = gain * *rseed >> 15;\n\n }\n\n memset(buf, 0, (FRAME_LEN + PITCH_MAX) * sizeof(*buf));\n\n }\n\n}\n"}} {"sample_id": "185698715dfb18c82ad2a5dbc169908602d43e81_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n u.f = a1;\n \n a = u.i;\n+\n+ return ( 0xFF800000 < ( a<<1 ) );\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int float32_is_nan( float32 a1 )\n\n{\n\n float32u u;\n\n uint64_t a;\n\n u.f = a1;\n\n a = u.i;\n\n return ( 0xFF800000 < ( a<<1 ) );\n\n}\n"}} {"sample_id": "4a1418e07bdcfaa3177739e04707ecaec75d89e1_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n ioport_write(2, addr, val);\n \n+#ifdef CONFIG_KQEMU\n+\n+ if (env)\n+\n env->last_io_time = cpu_get_time_fast();\n \n #endif", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void cpu_outl(CPUState *env, pio_addr_t addr, uint32_t val)\n\n{\n\n LOG_IOPORT(\"outl: %04\"FMT_pioaddr\" %08\"PRIx32\"\\n\", addr, val);\n\n ioport_write(2, addr, val);\n\n#ifdef CONFIG_KQEMU\n\n if (env)\n\n env->last_io_time = cpu_get_time_fast();\n\n#endif\n\n}\n"}} {"sample_id": "d65aaf3773e4be7ae97df9d867cbe9b36e2fb8a1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+static void tlb_info(Monitor *mon)\n+\n {\n \n+ CPUState *env;\n+\n+ int l1, l2;\n \n uint32_t pgd, pde, pte;\n \n@@ -13,7 +13,7 @@\n env = mon_get_cpu();\n \n \n+\n if (!(env->cr[0] & CR0_PG_MASK)) {\n \n monitor_printf(mon, \"PG disabled\\n\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void tlb_info(Monitor *mon)\n\n{\n\n CPUState *env;\n\n int l1, l2;\n\n uint32_t pgd, pde, pte;\n\n\n\n env = mon_get_cpu();\n\n\n\n if (!(env->cr[0] & CR0_PG_MASK)) {\n\n monitor_printf(mon, \"PG disabled\\n\");\n\n return;\n\n }\n\n pgd = env->cr[3] & ~0xfff;\n\n for(l1 = 0; l1 < 1024; l1++) {\n\n cpu_physical_memory_read(pgd + l1 * 4, (uint8_t *)&pde, 4);\n\n pde = le32_to_cpu(pde);\n\n if (pde & PG_PRESENT_MASK) {\n\n if ((pde & PG_PSE_MASK) && (env->cr[4] & CR4_PSE_MASK)) {\n\n print_pte(mon, (l1 << 22), pde, ~((1 << 20) - 1));\n\n } else {\n\n for(l2 = 0; l2 < 1024; l2++) {\n\n cpu_physical_memory_read((pde & ~0xfff) + l2 * 4,\n\n (uint8_t *)&pte, 4);\n\n pte = le32_to_cpu(pte);\n\n if (pte & PG_PRESENT_MASK) {\n\n print_pte(mon, (l1 << 22) + (l2 << 12),\n\n pte & ~PG_PSE_MASK,\n\n ~0xfff);\n\n }\n\n }\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "1509c018bd5b054a2354e20021ccbac9c934d213_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int get_packet_size(const uint8_t *buf, int size)\n \n {\n+\n+ int score, fec_score, dvhs_score;\n+\n \n \n if (size < (TS_FEC_PACKET_SIZE * 5 + 1))", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int get_packet_size(const uint8_t *buf, int size)\n\n{\n\n int score, fec_score, dvhs_score;\n\n\n\n if (size < (TS_FEC_PACKET_SIZE * 5 + 1))\n\n return AVERROR_INVALIDDATA;\n\n\n\n score = analyze(buf, size, TS_PACKET_SIZE, NULL);\n\n dvhs_score = analyze(buf, size, TS_DVHS_PACKET_SIZE, NULL);\n\n fec_score = analyze(buf, size, TS_FEC_PACKET_SIZE, NULL);\n\n av_dlog(NULL, \"score: %d, dvhs_score: %d, fec_score: %d \\n\",\n\n score, dvhs_score, fec_score);\n\n\n\n if (score > fec_score && score > dvhs_score)\n\n return TS_PACKET_SIZE;\n\n else if (dvhs_score > score && dvhs_score > fec_score)\n\n return TS_DVHS_PACKET_SIZE;\n\n else if (score < fec_score && dvhs_score < fec_score)\n\n return TS_FEC_PACKET_SIZE;\n\n else\n\n return AVERROR_INVALIDDATA;\n\n}\n"}} {"sample_id": "fea505221eaf87889000378d4d33ad0dfd5f4d9d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void handle_msr(DisasContext *s, uint32_t insn, unsigned int op0,\n \n unsigned int op1, unsigned int op2,\n+\n+ unsigned int crn, unsigned int crm, unsigned int rt)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void handle_msr(DisasContext *s, uint32_t insn, unsigned int op0,\n\n unsigned int op1, unsigned int op2,\n\n unsigned int crn, unsigned int crm, unsigned int rt)\n\n{\n\n unsupported_encoding(s, insn);\n\n}\n"}} {"sample_id": "2f448e415f364d0ec4c5556993e44ca183e31c5c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n unsigned len)\n \n {\n+\n UNINState *s = opaque;\n \n PCIHostState *phb = PCI_HOST_BRIDGE(s);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static uint64_t unin_data_read(void *opaque, hwaddr addr,\n\n unsigned len)\n\n{\n\n UNINState *s = opaque;\n\n PCIHostState *phb = PCI_HOST_BRIDGE(s);\n\n uint32_t val;\n\n\n\n val = pci_data_read(phb->bus,\n\n unin_get_config_reg(phb->config_reg, addr),\n\n len);\n\n UNIN_DPRINTF(\"read addr %\" TARGET_FMT_plx \" len %d val %x\\n\",\n\n addr, len, val);\n\n return val;\n\n}\n"}} {"sample_id": "e4533c7a8cdcc79ccdf695f0aaa2e23a5b926ed0_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n is_write = 0;\n \n+ insn = *(uint32_t *)pc;\n+\n+ if ((insn >> 30) == 3) {\n+\n+ switch((insn >> 19) & 0x3f) {\n \n case 0x05: // stb\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int cpu_x86_signal_handler(int host_signum, struct siginfo *info, \n\n void *puc)\n\n{\n\n uint32_t *regs = (uint32_t *)(info + 1);\n\n void *sigmask = (regs + 20);\n\n unsigned long pc;\n\n int is_write;\n\n uint32_t insn;\n\n \n\n /* XXX: is there a standard glibc define ? */\n\n pc = regs[1];\n\n /* XXX: need kernel patch to get write flag faster */\n\n is_write = 0;\n\n insn = *(uint32_t *)pc;\n\n if ((insn >> 30) == 3) {\n\n switch((insn >> 19) & 0x3f) {\n\n case 0x05: // stb\n\n case 0x06: // sth\n\n case 0x04: // st\n\n case 0x07: // std\n\n case 0x24: // stf\n\n case 0x27: // stdf\n\n case 0x25: // stfsr\n\n\tis_write = 1;\n\n\tbreak;\n\n }\n\n }\n\n return handle_cpu_signal(pc, (unsigned long)info->si_addr, \n\n is_write, sigmask);\n\n}\n"}} {"sample_id": "245f7b51c0ea04fb2224b1127430a096c91aee70_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n VncState *vs = cinfo->client_data;\n \n+ Buffer *buffer = &vs->tight_jpeg;\n+\n+\n+\n buffer->offset = buffer->capacity;\n \n buffer_reserve(buffer, 2048);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static boolean jpeg_empty_output_buffer(j_compress_ptr cinfo)\n\n{\n\n VncState *vs = cinfo->client_data;\n\n Buffer *buffer = &vs->tight_jpeg;\n\n\n\n buffer->offset = buffer->capacity;\n\n buffer_reserve(buffer, 2048);\n\n jpeg_init_destination(cinfo);\n\n return TRUE;\n\n}\n"}} {"sample_id": "f186d64d8fda4bb22c15beb8e45b7814fbd8b51e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n assert(replay_data_kind == EVENT_INSTRUCTION);\n \n+ return event == EVENT_INSTRUCTION;\n+\n+ }\n+\n+\n \n while (true) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool replay_next_event_is(int event)\n\n{\n\n bool res = false;\n\n\n\n /* nothing to skip - not all instructions used */\n\n if (replay_state.instructions_count != 0) {\n\n assert(replay_data_kind == EVENT_INSTRUCTION);\n\n return event == EVENT_INSTRUCTION;\n\n }\n\n\n\n while (true) {\n\n if (event == replay_data_kind) {\n\n res = true;\n\n }\n\n switch (replay_data_kind) {\n\n case EVENT_SHUTDOWN:\n\n replay_finish_event();\n\n qemu_system_shutdown_request();\n\n break;\n\n default:\n\n /* clock, time_t, checkpoint and other events */\n\n return res;\n\n }\n\n }\n\n return res;\n\n}\n"}} {"sample_id": "ac531cb6e542b1e61d668604adf9dc5306a948c0_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n START_TEST(qobject_to_qdict_test)\n+\n {\n \n fail_unless(qobject_to_qdict(QOBJECT(tests_dict)) == tests_dict);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "START_TEST(qobject_to_qdict_test)\n\n{\n\n fail_unless(qobject_to_qdict(QOBJECT(tests_dict)) == tests_dict);\n\n}\n"}} {"sample_id": "b3c0bfb6f949d8f1c97f390f951c0bab3e703810", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+ int i;\n+\n+ BDRVVmdkState *s = bs->opaque;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void vmdk_free_extents(BlockDriverState *bs)\n\n{\n\n int i;\n\n BDRVVmdkState *s = bs->opaque;\n\n\n\n for (i = 0; i < s->num_extents; i++) {\n\n g_free(s->extents[i].l1_table);\n\n g_free(s->extents[i].l2_cache);\n\n g_free(s->extents[i].l1_backup_table);\n\n }\n\n g_free(s->extents);\n\n}\n"}} {"sample_id": "20d1f6fec1aa2a33c4cf8162e72ca88ead3d389d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n FFPsyPreprocessContext *ctx;\n \n int i;\n+\n float cutoff_coeff = 0;\n \n ctx = av_mallocz(sizeof(FFPsyPreprocessContext));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "av_cold struct FFPsyPreprocessContext* ff_psy_preprocess_init(AVCodecContext *avctx)\n\n{\n\n FFPsyPreprocessContext *ctx;\n\n int i;\n\n float cutoff_coeff = 0;\n\n ctx = av_mallocz(sizeof(FFPsyPreprocessContext));\n\n ctx->avctx = avctx;\n\n\n\n if (avctx->cutoff > 0)\n\n cutoff_coeff = 2.0 * avctx->cutoff / avctx->sample_rate;\n\n\n\n if (cutoff_coeff)\n\n ctx->fcoeffs = ff_iir_filter_init_coeffs(FF_FILTER_TYPE_BUTTERWORTH, FF_FILTER_MODE_LOWPASS,\n\n FILT_ORDER, cutoff_coeff, 0.0, 0.0);\n\n if (ctx->fcoeffs) {\n\n ctx->fstate = av_mallocz(sizeof(ctx->fstate[0]) * avctx->channels);\n\n for (i = 0; i < avctx->channels; i++)\n\n ctx->fstate[i] = ff_iir_filter_init_state(FILT_ORDER);\n\n }\n\n return ctx;\n\n}\n"}} {"sample_id": "492c30af2567a59413c064f88eb81e1691865195_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n \tctrl->base = base;\n \n+\tctrl->env = env;\n+\n+\tctrl->nr_channels = nr_channels;\n+\n+\tctrl->channels = qemu_mallocz(sizeof ctrl->channels[0] * nr_channels);\n \n \tif (!ctrl->channels)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void *etraxfs_dmac_init(CPUState *env, \n\n\t\t\ttarget_phys_addr_t base, int nr_channels)\n\n{\n\n\tstruct fs_dma_ctrl *ctrl = NULL;\n\n\tint i;\n\n\n\n\tctrl = qemu_mallocz(sizeof *ctrl);\n\n\tif (!ctrl)\n\n\t\treturn NULL;\n\n\n\n\tctrl->base = base;\n\n\tctrl->env = env;\n\n\tctrl->nr_channels = nr_channels;\n\n\tctrl->channels = qemu_mallocz(sizeof ctrl->channels[0] * nr_channels);\n\n\tif (!ctrl->channels)\n\n\t\tgoto err;\n\n\n\n\tfor (i = 0; i < nr_channels; i++)\n\n\t{\n\n\t\tctrl->channels[i].regmap = cpu_register_io_memory(0,\n\n\t\t\t\t\t\t\t\t dma_read, \n\n\t\t\t\t\t\t\t\t dma_write, \n\n\t\t\t\t\t\t\t\t ctrl);\n\n\t\tcpu_register_physical_memory (base + i * 0x2000,\n\n\t\t\t\t\t sizeof ctrl->channels[i].regs, \n\n\t\t\t\t\t ctrl->channels[i].regmap);\n\n\t}\n\n\n\n\t/* Hax, we only support one DMA controller at a time. */\n\n\tetraxfs_dmac = ctrl;\n\n\treturn ctrl;\n\n err:\n\n\tqemu_free(ctrl->channels);\n\n\tqemu_free(ctrl);\n\n\treturn NULL;\n\n}\n"}} {"sample_id": "d65aaf3773e4be7ae97df9d867cbe9b36e2fb8a1_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void print_pte(Monitor *mon, uint32_t addr, uint32_t pte, uint32_t mask)\n+\n {\n \n monitor_printf(mon, \"%08x: %08x %c%c%c%c%c%c%c%c\\n\",", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void print_pte(Monitor *mon, uint32_t addr, uint32_t pte, uint32_t mask)\n\n{\n\n monitor_printf(mon, \"%08x: %08x %c%c%c%c%c%c%c%c\\n\",\n\n addr,\n\n pte & mask,\n\n pte & PG_GLOBAL_MASK ? 'G' : '-',\n\n pte & PG_PSE_MASK ? 'P' : '-',\n\n pte & PG_DIRTY_MASK ? 'D' : '-',\n\n pte & PG_ACCESSED_MASK ? 'A' : '-',\n\n pte & PG_PCD_MASK ? 'C' : '-',\n\n pte & PG_PWT_MASK ? 'T' : '-',\n\n pte & PG_USER_MASK ? 'U' : '-',\n\n pte & PG_RW_MASK ? 'W' : '-');\n\n}\n"}} {"sample_id": "7f0278435df1fa845b3bd9556942f89296d4246b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void qmp_input_type_str(Visitor *v, char **obj, const char *name,\n \n+ Error **errp)\n+\n {\n \n QmpInputVisitor *qiv = to_qiv(v);\n+\n QObject *qobj = qmp_input_get_object(qiv, name, true);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void qmp_input_type_str(Visitor *v, char **obj, const char *name,\n\n Error **errp)\n\n{\n\n QmpInputVisitor *qiv = to_qiv(v);\n\n QObject *qobj = qmp_input_get_object(qiv, name, true);\n\n\n\n if (!qobj || qobject_type(qobj) != QTYPE_QSTRING) {\n\n error_setg(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : \"null\",\n\n \"string\");\n\n return;\n\n }\n\n\n\n *obj = g_strdup(qstring_get_str(qobject_to_qstring(qobj)));\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n \n \n if (!env->watchpoint_hit)\n+\n+ TAILQ_FOREACH(wp, &env->watchpoints, entry)\n+\n+ wp->flags &= ~BP_WATCHPOINT_HIT;\n+\n \n \n if (debug_excp_handler)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void cpu_handle_debug_exception(CPUState *env)\n\n{\n\n CPUWatchpoint *wp;\n\n\n\n if (!env->watchpoint_hit)\n\n TAILQ_FOREACH(wp, &env->watchpoints, entry)\n\n wp->flags &= ~BP_WATCHPOINT_HIT;\n\n\n\n if (debug_excp_handler)\n\n debug_excp_handler(env);\n\n}\n"}} {"sample_id": "57ec555e8ef3c5ef1d77d48dc7cc868e56ddadc9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,8 +3,8 @@\n uint8_t *src, uint8_t *top, int size, int bpp)\n \n {\n+\n+ int i;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void png_filter_row(DSPContext *dsp, uint8_t *dst, int filter_type,\n\n uint8_t *src, uint8_t *top, int size, int bpp)\n\n{\n\n int i;\n\n\n\n switch(filter_type) {\n\n case PNG_FILTER_VALUE_NONE:\n\n memcpy(dst, src, size);\n\n break;\n\n case PNG_FILTER_VALUE_SUB:\n\n dsp->diff_bytes(dst, src, src-bpp, size);\n\n memcpy(dst, src, bpp);\n\n break;\n\n case PNG_FILTER_VALUE_UP:\n\n dsp->diff_bytes(dst, src, top, size);\n\n break;\n\n case PNG_FILTER_VALUE_AVG:\n\n for(i = 0; i < bpp; i++)\n\n dst[i] = src[i] - (top[i] >> 1);\n\n for(; i < size; i++)\n\n dst[i] = src[i] - ((src[i-bpp] + top[i]) >> 1);\n\n break;\n\n case PNG_FILTER_VALUE_PAETH:\n\n for(i = 0; i < bpp; i++)\n\n dst[i] = src[i] - top[i];\n\n sub_png_paeth_prediction(dst+i, src+i, top+i, size-i, bpp);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "2a74440547ea0a15195224fa2b7784b267cbfe15", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n {\n \n QString *qstring = qerror_human(qerror);\n+\n+ loc_push_restore(&qerror->loc);\n+\n error_report(\"%s\", qstring_get_str(qstring));\n \n loc_pop(&qerror->loc);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qerror_print(QError *qerror)\n\n{\n\n QString *qstring = qerror_human(qerror);\n\n loc_push_restore(&qerror->loc);\n\n error_report(\"%s\", qstring_get_str(qstring));\n\n loc_pop(&qerror->loc);\n\n QDECREF(qstring);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_278", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n break;\n \n \n+\n+ case 0x04:\t/* DEBUG_ADDR */\n+\n+ case 0x08:\t/* DEBUG_DATA */\n+\n case 0x0c:\t/* DEBUG_FLAG */\n \n case 0x10:\t/* STATUS */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void omap_mpui_write(void *opaque, target_phys_addr_t addr,\n\n uint64_t value, unsigned size)\n\n{\n\n struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;\n\n\n\n if (size != 4) {\n\n return omap_badwidth_write32(opaque, addr, value);\n\n }\n\n\n\n switch (addr) {\n\n case 0x00:\t/* CTRL */\n\n s->mpui_ctrl = value & 0x007fffff;\n\n break;\n\n\n\n case 0x04:\t/* DEBUG_ADDR */\n\n case 0x08:\t/* DEBUG_DATA */\n\n case 0x0c:\t/* DEBUG_FLAG */\n\n case 0x10:\t/* STATUS */\n\n /* Not in OMAP310 */\n\n case 0x14:\t/* DSP_STATUS */\n\n OMAP_RO_REG(addr);\n\n case 0x18:\t/* DSP_BOOT_CONFIG */\n\n case 0x1c:\t/* DSP_MPUI_CONFIG */\n\n break;\n\n\n\n default:\n\n OMAP_BAD_REG(addr);\n\n }\n\n}\n"}} {"sample_id": "026aeffcb4752054830ba203020ed6eb05bcaba8_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,\n \n \t\t\t s->cirrus_blt_dstpitch, s->cirrus_blt_width,\n+\n+\t\t\t s->cirrus_blt_height);\n+\n+ cirrus_bitblt_reset(s);\n+\n return 1;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop)\n\n{\n\n cirrus_fill_t rop_func;\n\n\n\n if (blit_is_unsafe(s, true)) {\n\n return 0;\n\n }\n\n rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];\n\n rop_func(s, s->vga.vram_ptr + s->cirrus_blt_dstaddr,\n\n s->cirrus_blt_dstpitch,\n\n s->cirrus_blt_width, s->cirrus_blt_height);\n\n cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,\n\n\t\t\t s->cirrus_blt_dstpitch, s->cirrus_blt_width,\n\n\t\t\t s->cirrus_blt_height);\n\n cirrus_bitblt_reset(s);\n\n return 1;\n\n}\n"}} {"sample_id": "2374e73edafff0586cbfb67c333c5a7588f81fd5_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void helper_stl_raw(uint64_t t0, uint64_t t1)\n \n {\n+\n stl_raw(t1, t0);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void helper_stl_raw(uint64_t t0, uint64_t t1)\n\n{\n\n stl_raw(t1, t0);\n\n}\n"}} {"sample_id": "fd56e0612b6454a282fa6a953fdb09281a98c589_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,10 +30,10 @@\n \n pci_for_each_bus(d->bus, piix4_update_bus_hotplug, s);\n \n+ } else {\n+\n+ piix4_update_bus_hotplug(d->bus, s);\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void piix4_pm_machine_ready(Notifier *n, void *opaque)\n\n{\n\n PIIX4PMState *s = container_of(n, PIIX4PMState, machine_ready);\n\n PCIDevice *d = PCI_DEVICE(s);\n\n MemoryRegion *io_as = pci_address_space_io(d);\n\n uint8_t *pci_conf;\n\n\n\n pci_conf = d->config;\n\n pci_conf[0x5f] = 0x10 |\n\n (memory_region_present(io_as, 0x378) ? 0x80 : 0);\n\n pci_conf[0x63] = 0x60;\n\n pci_conf[0x67] = (memory_region_present(io_as, 0x3f8) ? 0x08 : 0) |\n\n (memory_region_present(io_as, 0x2f8) ? 0x90 : 0);\n\n\n\n if (s->use_acpi_pci_hotplug) {\n\n pci_for_each_bus(d->bus, piix4_update_bus_hotplug, s);\n\n } else {\n\n piix4_update_bus_hotplug(d->bus, s);\n\n }\n\n}\n"}} {"sample_id": "b1e242bc565665420661e016127fe07b4b615ecb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n ((N >> R_shift) & 0xFF) - GN,\n ((W >> R_shift) & 0xFF) - GW,\n ((NW >> R_shift) & 0xFF) - GNW);\n+ B = G + epic_decode_component_pred(dc,\n+ ((N >> B_shift) & 0xFF) - GN,\n+ ((W >> B_shift) & 0xFF) - GW,\n+ ((NW >> B_shift) & 0xFF) - GNW);\n+ } else {\n if (x)\n pred = curr_row[x - 1];\n else", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint32_t epic_decode_pixel_pred(ePICContext *dc, int x, int y,\n const uint32_t *curr_row,\n const uint32_t *above_row)\n{\n uint32_t N, W, NW, pred;\n unsigned delta;\n int GN, GW, GNW, R, G, B;\n if (x && y) {\n W = curr_row[x - 1];\n N = above_row[x];\n NW = above_row[x - 1];\n GN = (N >> G_shift) & 0xFF;\n GW = (W >> G_shift) & 0xFF;\n GNW = (NW >> G_shift) & 0xFF;\n G = epic_decode_component_pred(dc, GN, GW, GNW);\n R = G + epic_decode_component_pred(dc,\n ((N >> R_shift) & 0xFF) - GN,\n ((W >> R_shift) & 0xFF) - GW,\n ((NW >> R_shift) & 0xFF) - GNW);\n B = G + epic_decode_component_pred(dc,\n ((N >> B_shift) & 0xFF) - GN,\n ((W >> B_shift) & 0xFF) - GW,\n ((NW >> B_shift) & 0xFF) - GNW);\n } else {\n if (x)\n pred = curr_row[x - 1];\n else\n pred = above_row[x];\n delta = ff_els_decode_unsigned(&dc->els_ctx, &dc->unsigned_rung);\n R = ((pred >> R_shift) & 0xFF) - TOSIGNED(delta);\n delta = ff_els_decode_unsigned(&dc->els_ctx, &dc->unsigned_rung);\n G = ((pred >> G_shift) & 0xFF) - TOSIGNED(delta);\n delta = ff_els_decode_unsigned(&dc->els_ctx, &dc->unsigned_rung);\n B = ((pred >> B_shift) & 0xFF) - TOSIGNED(delta);\n return (R << R_shift) | (G << G_shift) | (B << B_shift);"}} {"sample_id": "307b7715d0256c95444cada36a02882e46bada2f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,10 +24,10 @@\n \n /*\n \n+ * Reason: it crashes FIXME find and document the real reason\n+\n+ */\n+\n+ dk->user_creatable = false;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void spapr_dr_connector_class_init(ObjectClass *k, void *data)\n\n{\n\n DeviceClass *dk = DEVICE_CLASS(k);\n\n sPAPRDRConnectorClass *drck = SPAPR_DR_CONNECTOR_CLASS(k);\n\n\n\n dk->reset = reset;\n\n dk->realize = realize;\n\n dk->unrealize = unrealize;\n\n drck->set_isolation_state = set_isolation_state;\n\n drck->set_allocation_state = set_allocation_state;\n\n drck->release_pending = release_pending;\n\n drck->set_signalled = set_signalled;\n\n /*\n\n * Reason: it crashes FIXME find and document the real reason\n\n */\n\n dk->user_creatable = false;\n\n}\n"}} {"sample_id": "8f5d58ef2c92d7b82d9a6eeefd7c8854a183ba4a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void xlnx_dp_set_dpdma(Object *obj, const char *name, Object *val,\n \n Error **errp)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void xlnx_dp_set_dpdma(Object *obj, const char *name, Object *val,\n\n Error **errp)\n\n{\n\n XlnxDPState *s = XLNX_DP(obj);\n\n if (s->console) {\n\n DisplaySurface *surface = qemu_console_surface(s->console);\n\n XlnxDPDMAState *dma = XLNX_DPDMA(val);\n\n xlnx_dpdma_set_host_data_location(dma, DP_GRAPHIC_DMA_CHANNEL,\n\n surface_data(surface));\n\n }\n\n}\n"}} {"sample_id": "26a83ad0e793465b74a8b06a65f2f6fdc5615413_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n mr->terminates = true;\n \n mr->destructor = memory_region_destructor_rom_device;\n+\n+ mr->ram_addr = qemu_ram_alloc(size, mr);\n+\n+ mr->ram_addr |= cpu_register_io_memory(memory_region_read_thunk,\n+\n memory_region_write_thunk,\n \n mr);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void memory_region_init_rom_device(MemoryRegion *mr,\n\n const MemoryRegionOps *ops,\n\n void *opaque,\n\n const char *name,\n\n uint64_t size)\n\n{\n\n memory_region_init(mr, name, size);\n\n mr->ops = ops;\n\n mr->opaque = opaque;\n\n mr->terminates = true;\n\n mr->destructor = memory_region_destructor_rom_device;\n\n mr->ram_addr = qemu_ram_alloc(size, mr);\n\n mr->ram_addr |= cpu_register_io_memory(memory_region_read_thunk,\n\n memory_region_write_thunk,\n\n mr);\n\n mr->ram_addr |= IO_MEM_ROMD;\n\n mr->backend_registered = true;\n\n}\n"}} {"sample_id": "b3db211f3c80bb996a704d665fe275619f728bd4_48", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,6 +4,6 @@\n \n visitor_output_teardown(data, NULL);\n \n+ visitor_output_setup(data, NULL);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void visitor_reset(TestOutputVisitorData *data)\n\n{\n\n visitor_output_teardown(data, NULL);\n\n visitor_output_setup(data, NULL);\n\n}\n"}} {"sample_id": "b4330a0e02fcbef61d630a369abe5f4421ced659", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n ConcatStream *cs = &cat->cur_file->streams[idx];\n \n AVBitStreamFilterContext *bsf;\n+\n+ int ret;\n+\n+\n+\n if (cat->auto_convert && st->codecpar->codec_id == AV_CODEC_ID_H264 &&\n \n (st->codecpar->extradata_size < 4 || AV_RB32(st->codecpar->extradata) != 1)) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int detect_stream_specific(AVFormatContext *avf, int idx)\n\n{\n\n ConcatContext *cat = avf->priv_data;\n\n AVStream *st = cat->avf->streams[idx];\n\n ConcatStream *cs = &cat->cur_file->streams[idx];\n\n AVBitStreamFilterContext *bsf;\n\n int ret;\n\n\n\n if (cat->auto_convert && st->codecpar->codec_id == AV_CODEC_ID_H264 &&\n\n (st->codecpar->extradata_size < 4 || AV_RB32(st->codecpar->extradata) != 1)) {\n\n av_log(cat->avf, AV_LOG_INFO,\n\n \"Auto-inserting h264_mp4toannexb bitstream filter\\n\");\n\n if (!(bsf = av_bitstream_filter_init(\"h264_mp4toannexb\"))) {\n\n av_log(avf, AV_LOG_ERROR, \"h264_mp4toannexb bitstream filter \"\n\n \"required for H.264 streams\\n\");\n\n return AVERROR_BSF_NOT_FOUND;\n\n }\n\n cs->bsf = bsf;\n\n\n\n cs->avctx = avcodec_alloc_context3(NULL);\n\n if (!cs->avctx)\n\n return AVERROR(ENOMEM);\n\n\n\n /* This really should be part of the bsf work.\n\n Note: input bitstream filtering will not work with bsf that\n\n create extradata from the first packet. */\n\n av_freep(&st->codecpar->extradata);\n\n st->codecpar->extradata_size = 0;\n\n\n\n ret = avcodec_parameters_to_context(cs->avctx, st->codecpar);\n\n if (ret < 0) {\n\n avcodec_free_context(&cs->avctx);\n\n return ret;\n\n }\n\n\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "fd38804b388fdd5f3abd108f260d3e9d625ff7ad", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n break;\n \n+ }\n+\n+ }\n+\n+\n \n if (entry) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static sPAPREventLogEntry *rtas_event_log_dequeue(uint32_t event_mask)\n\n{\n\n sPAPRMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());\n\n sPAPREventLogEntry *entry = NULL;\n\n\n\n QTAILQ_FOREACH(entry, &spapr->pending_events, next) {\n\n const sPAPREventSource *source =\n\n rtas_event_log_to_source(spapr, entry->log_type);\n\n\n\n if (source->mask & event_mask) {\n\n break;\n\n }\n\n }\n\n\n\n if (entry) {\n\n QTAILQ_REMOVE(&spapr->pending_events, entry, next);\n\n }\n\n\n\n return entry;\n\n}\n"}} {"sample_id": "cf04af2086be105ff86088357b83d672d38417d9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int get_cod(Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c,\n uint8_t *properties)\n+{\n+ Jpeg2000CodingStyle tmp;\n+ int compno, ret;\n+ if (bytestream2_get_bytes_left(&s->g) < 5)\n tmp.csty = bytestream2_get_byteu(&s->g);\n // get progression order\n tmp.prog_order = bytestream2_get_byteu(&s->g);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int get_cod(Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c,\n uint8_t *properties)\n{\n Jpeg2000CodingStyle tmp;\n int compno, ret;\n if (bytestream2_get_bytes_left(&s->g) < 5)\n tmp.csty = bytestream2_get_byteu(&s->g);\n // get progression order\n tmp.prog_order = bytestream2_get_byteu(&s->g);\n tmp.nlayers = bytestream2_get_be16u(&s->g);\n tmp.mct = bytestream2_get_byteu(&s->g); // multiple component transformation\n if ((ret = get_cox(s, &tmp)) < 0)\n return ret;\n for (compno = 0; compno < s->ncomponents; compno++)\n if (!(properties[compno] & HAD_COC))\n memcpy(c + compno, &tmp, sizeof(tmp));\n return 0;"}} {"sample_id": "3a9d85491ed2be8158fe93041dcbb34c13dfdb05", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,8 +20,8 @@\n \n \n \n+ cpu_smm_register(&i440fx_set_smm, d);\n+\n+ return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int i440fx_initfn(PCIDevice *dev)\n\n{\n\n PCII440FXState *d = DO_UPCAST(PCII440FXState, dev, dev);\n\n\n\n pci_config_set_vendor_id(d->dev.config, PCI_VENDOR_ID_INTEL);\n\n pci_config_set_device_id(d->dev.config, PCI_DEVICE_ID_INTEL_82441);\n\n d->dev.config[0x08] = 0x02; // revision\n\n pci_config_set_class(d->dev.config, PCI_CLASS_BRIDGE_HOST);\n\n\n\n d->dev.config[I440FX_SMRAM] = 0x02;\n\n\n\n cpu_smm_register(&i440fx_set_smm, d);\n\n return 0;\n\n}\n"}} {"sample_id": "e53c9065ca08a9153ecc73a6a8940bcc6d667e58_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n av_log(NULL, AV_LOG_ERROR, \"%d: %- .12f - %- .12f = % .12g\\n\",\n \n+ i, a[i], b[i], a[i] - b[i]);\n+\n+ return -1;\n+\n+ }\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int compare_doubles(const double *a, const double *b, int len,\n\n double max_diff)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < len; i++) {\n\n if (fabs(a[i] - b[i]) > max_diff) {\n\n av_log(NULL, AV_LOG_ERROR, \"%d: %- .12f - %- .12f = % .12g\\n\",\n\n i, a[i], b[i], a[i] - b[i]);\n\n return -1;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "eca38864a6ce5053e463b8d3fc22b22bc9a49578", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n AVDictionaryEntry *tag = NULL;\n \n+ bytestream_put_le32(p, count);\n+\n+ while ((tag = av_dict_get(*m, \"\", tag, AV_DICT_IGNORE_SUFFIX))) {\n+\n+ unsigned int len1 = strlen(tag->key);\n \n unsigned int len2 = strlen(tag->value);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int ff_vorbiscomment_write(uint8_t **p, AVDictionary **m,\n\n const char *vendor_string)\n\n{\n\n bytestream_put_le32(p, strlen(vendor_string));\n\n bytestream_put_buffer(p, vendor_string, strlen(vendor_string));\n\n if (*m) {\n\n int count = av_dict_count(*m);\n\n AVDictionaryEntry *tag = NULL;\n\n bytestream_put_le32(p, count);\n\n while ((tag = av_dict_get(*m, \"\", tag, AV_DICT_IGNORE_SUFFIX))) {\n\n unsigned int len1 = strlen(tag->key);\n\n unsigned int len2 = strlen(tag->value);\n\n bytestream_put_le32(p, len1+1+len2);\n\n bytestream_put_buffer(p, tag->key, len1);\n\n bytestream_put_byte(p, '=');\n\n bytestream_put_buffer(p, tag->value, len2);\n\n }\n\n } else\n\n bytestream_put_le32(p, 0);\n\n return 0;\n\n}\n"}} {"sample_id": "ec6469a3b1da26247bdb3f5dd5276fabcc1b694a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,22 +1,22 @@\n+static always_inline void gen_op_neg (DisasContext *ctx, TCGv ret, TCGv arg1, int ov_check)\n+\n+{\n+\n int l1, l2;\n+\n \n+\n+ l1 = gen_new_label();\n \n l2 = gen_new_label();\n+\n+#if defined(TARGET_PPC64)\n \n if (ctx->sf_mode) {\n \n tcg_gen_brcondi_tl(TCG_COND_EQ, arg1, INT64_MIN, l1);\n \n+ } else {\n \n TCGv t0 = tcg_temp_new(TCG_TYPE_TL);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static always_inline void gen_op_neg (DisasContext *ctx, TCGv ret, TCGv arg1, int ov_check)\n\n{\n\n int l1, l2;\n\n\n\n l1 = gen_new_label();\n\n l2 = gen_new_label();\n\n#if defined(TARGET_PPC64)\n\n if (ctx->sf_mode) {\n\n tcg_gen_brcondi_tl(TCG_COND_EQ, arg1, INT64_MIN, l1);\n\n } else {\n\n TCGv t0 = tcg_temp_new(TCG_TYPE_TL);\n\n\ttcg_gen_ext32s_tl(t0, arg1);\n\n tcg_gen_brcondi_tl(TCG_COND_EQ, t0, INT32_MIN, l1);\n\n }\n\n#else\n\n tcg_gen_brcondi_tl(TCG_COND_EQ, arg1, INT32_MIN, l1);\n\n#endif\n\n tcg_gen_neg_tl(ret, arg1);\n\n if (ov_check) {\n\n tcg_gen_andi_tl(cpu_xer, cpu_xer, ~(1 << XER_OV));\n\n }\n\n tcg_gen_br(l2);\n\n gen_set_label(l1);\n\n tcg_gen_mov_tl(ret, arg1);\n\n if (ov_check) {\n\n tcg_gen_ori_tl(cpu_xer, cpu_xer, (1 << XER_OV) | (1 << XER_SO));\n\n }\n\n gen_set_label(l2);\n\n if (unlikely(Rc(ctx->opcode) != 0))\n\n gen_set_Rc0(ctx, ret);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_325", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n s->padconf[pad_offset] = prev_value;\n \n break;\n+\n+\n+\n+ default:\n+\n OMAP_BAD_REG(addr);\n \n break;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void omap_sysctl_write8(void *opaque, target_phys_addr_t addr,\n\n uint32_t value)\n\n{\n\n struct omap_sysctl_s *s = (struct omap_sysctl_s *) opaque;\n\n int pad_offset, byte_offset;\n\n int prev_value;\n\n\n\n switch (addr) {\n\n case 0x030 ... 0x140:\t/* CONTROL_PADCONF - only used in the POP */\n\n pad_offset = (addr - 0x30) >> 2;\n\n byte_offset = (addr - 0x30) & (4 - 1);\n\n\n\n prev_value = s->padconf[pad_offset];\n\n prev_value &= ~(0xff << (byte_offset * 8));\n\n prev_value |= ((value & 0x1f1f1f1f) << (byte_offset * 8)) & 0x1f1f1f1f;\n\n s->padconf[pad_offset] = prev_value;\n\n break;\n\n\n\n default:\n\n OMAP_BAD_REG(addr);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "b3a6a2e0417c78ec5491347eb85a7d125a5fefdc_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ flag aSign;\n \n int32 aExp, shiftCount;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int32 floatx80_to_int32_round_to_zero( floatx80 a STATUS_PARAM )\n\n{\n\n flag aSign;\n\n int32 aExp, shiftCount;\n\n uint64_t aSig, savedASig;\n\n int32 z;\n\n\n\n aSig = extractFloatx80Frac( a );\n\n aExp = extractFloatx80Exp( a );\n\n aSign = extractFloatx80Sign( a );\n\n if ( 0x401E < aExp ) {\n\n if ( ( aExp == 0x7FFF ) && (uint64_t) ( aSig<<1 ) ) aSign = 0;\n\n goto invalid;\n\n }\n\n else if ( aExp < 0x3FFF ) {\n\n if ( aExp || aSig ) STATUS(float_exception_flags) |= float_flag_inexact;\n\n return 0;\n\n }\n\n shiftCount = 0x403E - aExp;\n\n savedASig = aSig;\n\n aSig >>= shiftCount;\n\n z = aSig;\n\n if ( aSign ) z = - z;\n\n if ( ( z < 0 ) ^ aSign ) {\n\n invalid:\n\n float_raise( float_flag_invalid STATUS_VAR);\n\n return aSign ? (int32_t) 0x80000000 : 0x7FFFFFFF;\n\n }\n\n if ( ( aSig<env, ipb) & DIAG_KVM_CODE_MASK;\n\n switch (func_code) {\n\n case DIAG_IPL:\n\n kvm_handle_diag_308(cpu, run);\n\n break;\n\n case DIAG_KVM_HYPERCALL:\n\n r = handle_hypercall(cpu, run);\n\n break;\n\n case DIAG_KVM_BREAKPOINT:\n\n r = handle_sw_breakpoint(cpu, run);\n\n break;\n\n default:\n\n DPRINTF(\"KVM: unknown DIAG: 0x%x\\n\", func_code);\n\n r = -1;\n\n break;\n\n }\n\n\n\n return r;\n\n}\n"}} {"sample_id": "009f829dde811af654af7110326aea3a72c05d5e_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static inline void RENAME(yuv2bgr24_2)(SwsContext *c, const uint16_t *buf0,\n+\n+ const uint16_t *buf1, const uint16_t *ubuf0,\n \n const uint16_t *ubuf1, const uint16_t *vbuf0,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void RENAME(yuv2bgr24_2)(SwsContext *c, const uint16_t *buf0,\n\n const uint16_t *buf1, const uint16_t *ubuf0,\n\n const uint16_t *ubuf1, const uint16_t *vbuf0,\n\n const uint16_t *vbuf1, const uint16_t *abuf0,\n\n const uint16_t *abuf1, uint8_t *dest,\n\n int dstW, int yalpha, int uvalpha, int y)\n\n{\n\n x86_reg uv_off = c->uv_off << 1;\n\n\n\n //Note 8280 == DSTW_OFFSET but the preprocessor can't handle that there :(\n\n __asm__ volatile(\n\n \"mov %%\"REG_b\", \"ESP_OFFSET\"(%5) \\n\\t\"\n\n \"mov %4, %%\"REG_b\" \\n\\t\"\n\n \"push %%\"REG_BP\" \\n\\t\"\n\n YSCALEYUV2RGB(%%REGBP, %5, %6)\n\n \"pxor %%mm7, %%mm7 \\n\\t\"\n\n WRITEBGR24(%%REGb, 8280(%5), %%REGBP)\n\n \"pop %%\"REG_BP\" \\n\\t\"\n\n \"mov \"ESP_OFFSET\"(%5), %%\"REG_b\" \\n\\t\"\n\n :: \"c\" (buf0), \"d\" (buf1), \"S\" (ubuf0), \"D\" (ubuf1), \"m\" (dest),\n\n \"a\" (&c->redDither), \"m\"(uv_off)\n\n );\n\n}\n"}} {"sample_id": "26a83ad0e793465b74a8b06a65f2f6fdc5615413", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ assert(mr->backend_registered);\n+\n return mr->ram_addr;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "ram_addr_t memory_region_get_ram_addr(MemoryRegion *mr)\n\n{\n\n assert(mr->backend_registered);\n\n return mr->ram_addr;\n\n}\n"}} {"sample_id": "15bd309af8302661838150de1905acc4df386d19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n \n \n avio_wb32(pb, 0); /* size */\n+\n+ ffio_wfourcc(pb, \"stbl\");\n+\n+ mov_write_stsd_tag(s, pb, mov, track);\n+\n mov_write_stts_tag(pb, track);\n \n if ((track->par->codec_type == AVMEDIA_TYPE_VIDEO ||", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mov_write_stbl_tag(AVFormatContext *s, AVIOContext *pb, MOVMuxContext *mov, MOVTrack *track)\n\n{\n\n int64_t pos = avio_tell(pb);\n\n int ret;\n\n\n\n avio_wb32(pb, 0); /* size */\n\n ffio_wfourcc(pb, \"stbl\");\n\n mov_write_stsd_tag(s, pb, mov, track);\n\n mov_write_stts_tag(pb, track);\n\n if ((track->par->codec_type == AVMEDIA_TYPE_VIDEO ||\n\n track->par->codec_tag == MKTAG('r','t','p',' ')) &&\n\n track->has_keyframes && track->has_keyframes < track->entry)\n\n mov_write_stss_tag(pb, track, MOV_SYNC_SAMPLE);\n\n if (track->mode == MODE_MOV && track->flags & MOV_TRACK_STPS)\n\n mov_write_stss_tag(pb, track, MOV_PARTIAL_SYNC_SAMPLE);\n\n if (track->par->codec_type == AVMEDIA_TYPE_VIDEO &&\n\n track->flags & MOV_TRACK_CTTS && track->entry) {\n\n\n\n if ((ret = mov_write_ctts_tag(pb, track)) < 0)\n\n return ret;\n\n }\n\n mov_write_stsc_tag(pb, track);\n\n mov_write_stsz_tag(pb, track);\n\n mov_write_stco_tag(pb, track);\n\n if (mov->encryption_scheme == MOV_ENC_CENC_AES_CTR) {\n\n ff_mov_cenc_write_stbl_atoms(&track->cenc, pb);\n\n }\n\n if (track->par->codec_id == AV_CODEC_ID_OPUS) {\n\n mov_preroll_write_stbl_atoms(pb, track);\n\n }\n\n return update_size(pb, pos);\n\n}\n"}} {"sample_id": "630530a6529bc3da9ab8aead7053dc753cb9ac77", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n uint8_t *buf, int nb_sectors)\n \n {\n+\n BDRVVmdkState *s = bs->opaque;\n \n int index_in_cluster, n, ret;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int vmdk_read(BlockDriverState *bs, int64_t sector_num, \n\n uint8_t *buf, int nb_sectors)\n\n{\n\n BDRVVmdkState *s = bs->opaque;\n\n int index_in_cluster, n, ret;\n\n uint64_t cluster_offset;\n\n\n\n while (nb_sectors > 0) {\n\n cluster_offset = get_cluster_offset(bs, sector_num << 9, 0);\n\n index_in_cluster = sector_num % s->cluster_sectors;\n\n n = s->cluster_sectors - index_in_cluster;\n\n if (n > nb_sectors)\n\n n = nb_sectors;\n\n if (!cluster_offset) {\n\n // try to read from parent image, if exist\n\n if (s->hd->backing_hd) {\n\n if (!vmdk_is_cid_valid(bs))\n\n return -1;\n\n ret = bdrv_read(s->hd->backing_hd, sector_num, buf, n);\n\n if (ret < 0)\n\n return -1;\n\n } else {\n\n memset(buf, 0, 512 * n);\n\n }\n\n } else {\n\n if(bdrv_pread(s->hd, cluster_offset + index_in_cluster * 512, buf, n * 512) != n * 512)\n\n return -1;\n\n }\n\n nb_sectors -= n;\n\n sector_num += n;\n\n buf += n * 512;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "2758cdedfb7ac61f8b5e4861f99218b6fd43491d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n URLProtocol *ffurl_protocol_next(const URLProtocol *prev)\n \n+{\n \n return prev ? prev->next : first_protocol;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "URLProtocol *ffurl_protocol_next(const URLProtocol *prev)\n\n{\n\n return prev ? prev->next : first_protocol;\n\n}\n"}} {"sample_id": "ce5b1bbf624b977a55ff7f85bb3871682d03baff_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n CPUState *cs = CPU(obj);\n+\n MIPSCPU *cpu = MIPS_CPU(obj);\n \n CPUMIPSState *env = &cpu->env;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void mips_cpu_initfn(Object *obj)\n\n{\n\n CPUState *cs = CPU(obj);\n\n MIPSCPU *cpu = MIPS_CPU(obj);\n\n CPUMIPSState *env = &cpu->env;\n\n\n\n cs->env_ptr = env;\n\n cpu_exec_init(cs, &error_abort);\n\n\n\n if (tcg_enabled()) {\n\n mips_tcg_init();\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_166", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n \t/* Load and decode. FIXME: handle endianness. */\n \n+\tcpu_physical_memory_read (addr, \n+\n+\t\t\t\t (void *) &ctrl->channels[c].current_c, \n+\n+\t\t\t\t sizeof ctrl->channels[c].current_c);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void channel_load_c(struct fs_dma_ctrl *ctrl, int c)\n\n{\n\n\ttarget_phys_addr_t addr = channel_reg(ctrl, c, RW_GROUP_DOWN);\n\n\n\n\t/* Load and decode. FIXME: handle endianness. */\n\n\tcpu_physical_memory_read (addr, \n\n\t\t\t\t (void *) &ctrl->channels[c].current_c, \n\n\t\t\t\t sizeof ctrl->channels[c].current_c);\n\n\n\n\tD(dump_c(c, &ctrl->channels[c].current_c));\n\n\t/* I guess this should update the current pos. */\n\n\tctrl->channels[c].regs[RW_SAVED_DATA] =\n\n\t\t(uint32_t)(unsigned long)ctrl->channels[c].current_c.saved_data;\n\n\tctrl->channels[c].regs[RW_SAVED_DATA_BUF] =\n\n\t\t(uint32_t)(unsigned long)ctrl->channels[c].current_c.saved_data_buf;\n\n}\n"}} {"sample_id": "0058584580b87feb47898e60e4b80c7f425882ad_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static inline void downmix_2f_1r_to_mono(float *samples)\n \n {\n+\n+ int i;\n+\n+\n \n for (i = 0; i < 256; i++) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void downmix_2f_1r_to_mono(float *samples)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < 256; i++) {\n\n samples[i] += (samples[i + 256] + samples[i + 512]);\n\n samples[i + 256] = samples[i + 512] = 0;\n\n }\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_67", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n *\n \n * Then we set UNIT_ATTENTION, by which the guest will\n+\n+ * detect a new CD in the drive. See ide_atapi_cmd() for details.\n+\n+ */\n+\n s->cdrom_changed = 1;\n \n s->events.new_media = true;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ide_cd_change_cb(void *opaque, bool load)\n\n{\n\n IDEState *s = opaque;\n\n uint64_t nb_sectors;\n\n\n\n s->tray_open = !load;\n\n bdrv_get_geometry(s->bs, &nb_sectors);\n\n s->nb_sectors = nb_sectors;\n\n\n\n /*\n\n * First indicate to the guest that a CD has been removed. That's\n\n * done on the next command the guest sends us.\n\n *\n\n * Then we set UNIT_ATTENTION, by which the guest will\n\n * detect a new CD in the drive. See ide_atapi_cmd() for details.\n\n */\n\n s->cdrom_changed = 1;\n\n s->events.new_media = true;\n\n s->events.eject_request = false;\n\n ide_set_irq(s->bus);\n\n}\n"}} {"sample_id": "06bf6d3bc04979bd39ecdc7311d0daf8aee7e10f_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static int poll_frame(AVFilterLink *link)\n+\n+{\n+\n+ AVFilterContext *s = link->src;\n+\n OverlayContext *over = s->priv;\n \n int ret = avfilter_poll_frame(s->inputs[OVERLAY]);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int poll_frame(AVFilterLink *link)\n\n{\n\n AVFilterContext *s = link->src;\n\n OverlayContext *over = s->priv;\n\n int ret = avfilter_poll_frame(s->inputs[OVERLAY]);\n\n\n\n if (ret == AVERROR_EOF)\n\n ret = !!over->overpicref;\n\n\n\n return ret && avfilter_poll_frame(s->inputs[MAIN]);\n\n}\n"}} {"sample_id": "4cdd01d32ee6fe04f8d909bfd3708be6864873a2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n QINCREF(bs->file->bs->full_open_options);\n \n qdict_put_obj(opts, \"raw\", QOBJECT(bs->file->bs->full_open_options));\n+\n+ QINCREF(s->test_file->bs->full_open_options);\n+\n+ qdict_put_obj(opts, \"test\",\n+\n QOBJECT(s->test_file->bs->full_open_options));\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void blkverify_refresh_filename(BlockDriverState *bs)\n\n{\n\n BDRVBlkverifyState *s = bs->opaque;\n\n\n\n /* bs->file->bs has already been refreshed */\n\n bdrv_refresh_filename(s->test_file->bs);\n\n\n\n if (bs->file->bs->full_open_options\n\n && s->test_file->bs->full_open_options)\n\n {\n\n QDict *opts = qdict_new();\n\n qdict_put_obj(opts, \"driver\", QOBJECT(qstring_from_str(\"blkverify\")));\n\n\n\n QINCREF(bs->file->bs->full_open_options);\n\n qdict_put_obj(opts, \"raw\", QOBJECT(bs->file->bs->full_open_options));\n\n QINCREF(s->test_file->bs->full_open_options);\n\n qdict_put_obj(opts, \"test\",\n\n QOBJECT(s->test_file->bs->full_open_options));\n\n\n\n bs->full_open_options = opts;\n\n }\n\n\n\n if (bs->file->bs->exact_filename[0]\n\n && s->test_file->bs->exact_filename[0])\n\n {\n\n snprintf(bs->exact_filename, sizeof(bs->exact_filename),\n\n \"blkverify:%s:%s\",\n\n bs->file->bs->exact_filename,\n\n s->test_file->bs->exact_filename);\n\n }\n\n}\n"}} {"sample_id": "cc40c056d01a95b0a57950d4d8aec9e86060c6b6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n \n \n if (avctx->channels > 2)\n+\n+ return -1;\n+\n+ avctx->frame_size = 32;\n+\n \n \n avctx->coded_frame = avcodec_alloc_frame();", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int adx_encode_init(AVCodecContext *avctx)\n\n{\n\n ADXContext *c = avctx->priv_data;\n\n\n\n if (avctx->channels > 2)\n\n return -1;\n\n avctx->frame_size = 32;\n\n\n\n avctx->coded_frame = avcodec_alloc_frame();\n\n avctx->coded_frame->key_frame = 1;\n\n\n\n /* the cutoff can be adjusted, but this seems to work pretty well */\n\n c->cutoff = 500;\n\n ff_adx_calculate_coeffs(c->cutoff, avctx->sample_rate, COEFF_BITS, c->coeff);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "8be7e7e4c72c048b90e3482557954a24bba43ba7_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n+QemuOpts *qemu_opts_create(QemuOptsList *list, const char *id, int fail_if_exists)\n \n {\n \n+ QemuOpts *opts = NULL;\n \n \n \n if (id) {\n \n if (!id_wellformed(id)) {\n+\n qerror_report(QERR_INVALID_PARAMETER_VALUE, \"id\", \"an identifier\");\n \n error_printf_unless_qmp(\"Identifiers consist of letters, digits, '-', '.', '_', starting with a letter.\\n\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "QemuOpts *qemu_opts_create(QemuOptsList *list, const char *id, int fail_if_exists)\n\n{\n\n QemuOpts *opts = NULL;\n\n\n\n if (id) {\n\n if (!id_wellformed(id)) {\n\n qerror_report(QERR_INVALID_PARAMETER_VALUE, \"id\", \"an identifier\");\n\n error_printf_unless_qmp(\"Identifiers consist of letters, digits, '-', '.', '_', starting with a letter.\\n\");\n\n return NULL;\n\n }\n\n opts = qemu_opts_find(list, id);\n\n if (opts != NULL) {\n\n if (fail_if_exists && !list->merge_lists) {\n\n qerror_report(QERR_DUPLICATE_ID, id, list->name);\n\n return NULL;\n\n } else {\n\n return opts;\n\n }\n\n }\n\n } else if (list->merge_lists) {\n\n opts = qemu_opts_find(list, NULL);\n\n if (opts) {\n\n return opts;\n\n }\n\n }\n\n opts = g_malloc0(sizeof(*opts));\n\n if (id) {\n\n opts->id = g_strdup(id);\n\n }\n\n opts->list = list;\n\n loc_save(&opts->loc);\n\n QTAILQ_INIT(&opts->head);\n\n QTAILQ_INSERT_TAIL(&list->head, opts, next);\n\n return opts;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n int i, idx = 0;\n \n+ for (i = 0; i < BITS_TO_U64S(size); i++) {\n+\n+ uint64_t w = bmp[idx++];\n+\n+ if (sizeof(unsigned long) == 4 && idx < BITS_TO_LONGS(size)) {\n \n w |= ((uint64_t)bmp[idx++]) << 32;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void put_bitmap(QEMUFile *f, void *pv, size_t size)\n\n{\n\n unsigned long *bmp = pv;\n\n int i, idx = 0;\n\n for (i = 0; i < BITS_TO_U64S(size); i++) {\n\n uint64_t w = bmp[idx++];\n\n if (sizeof(unsigned long) == 4 && idx < BITS_TO_LONGS(size)) {\n\n w |= ((uint64_t)bmp[idx++]) << 32;\n\n }\n\n qemu_put_be64(f, w);\n\n }\n\n}\n"}} {"sample_id": "ec3b22326dc07fb8300a577bd6b17c19a0f1bcf7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void http_write_packet(void *opaque, \n \n unsigned char *buf, int size)\n+\n {\n \n HTTPContext *c = opaque;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void http_write_packet(void *opaque, \n\n unsigned char *buf, int size)\n\n{\n\n HTTPContext *c = opaque;\n\n\n\n if (c->buffer_ptr == c->buffer_end || !c->buffer_ptr)\n\n c->buffer_ptr = c->buffer_end = c->buffer;\n\n\n\n if (c->buffer_end - c->buffer + size > IOBUFFER_MAX_SIZE)\n\n abort();\n\n\n\n memcpy(c->buffer_end, buf, size);\n\n c->buffer_end += size;\n\n}\n"}} {"sample_id": "01960e6d21dcfbfc8a03d8fd6284c448cf75865b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n QLIST_REMOVE(entry, list);\n \n+\n+ break;\n+\n+ }\n+\n }\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "int kvm_arch_release_virq_post(int virq)\n\n{\n\n MSIRouteEntry *entry, *next;\n\n QLIST_FOREACH_SAFE(entry, &msi_route_list, list, next) {\n\n if (entry->virq == virq) {\n\n trace_kvm_x86_remove_msi_route(virq);\n\n QLIST_REMOVE(entry, list);\n\n\n break;\n\n }\n\n }\n\n return 0;\n\n}"}} {"sample_id": "03a96b83b539498510e22aab585e41015ba18247", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static int kvm_set_ioeventfd_mmio(int fd, hwaddr addr, uint32_t val,\n \n+ bool assign, uint32_t size, bool datamatch)\n+\n+{\n+\n+ int ret;\n+\n struct kvm_ioeventfd iofd;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int kvm_set_ioeventfd_mmio(int fd, hwaddr addr, uint32_t val,\n\n bool assign, uint32_t size, bool datamatch)\n\n{\n\n int ret;\n\n struct kvm_ioeventfd iofd;\n\n\n\n iofd.datamatch = datamatch ? adjust_ioeventfd_endianness(val, size) : 0;\n\n iofd.addr = addr;\n\n iofd.len = size;\n\n iofd.flags = 0;\n\n iofd.fd = fd;\n\n\n\n if (!kvm_enabled()) {\n\n return -ENOSYS;\n\n }\n\n\n\n if (datamatch) {\n\n iofd.flags |= KVM_IOEVENTFD_FLAG_DATAMATCH;\n\n }\n\n if (!assign) {\n\n iofd.flags |= KVM_IOEVENTFD_FLAG_DEASSIGN;\n\n }\n\n\n\n ret = kvm_vm_ioctl(kvm_state, KVM_IOEVENTFD, &iofd);\n\n\n\n if (ret < 0) {\n\n return -errno;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "ef363ebd596da18f889a7d4845023a23dfac84c9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void mp3_update_xing(AVFormatContext *s)\n+\n+{\n+\n+ MP3Context *mp3 = s->priv_data;\n+\n int i;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void mp3_update_xing(AVFormatContext *s)\n\n{\n\n MP3Context *mp3 = s->priv_data;\n\n int i;\n\n\n\n /* replace \"Xing\" identification string with \"Info\" for CBR files. */\n\n if (!mp3->has_variable_bitrate) {\n\n avio_seek(s->pb, mp3->xing_offset, SEEK_SET);\n\n ffio_wfourcc(s->pb, \"Info\");\n\n }\n\n\n\n avio_seek(s->pb, mp3->xing_offset + 8, SEEK_SET);\n\n avio_wb32(s->pb, mp3->frames);\n\n avio_wb32(s->pb, mp3->size);\n\n\n\n avio_w8(s->pb, 0); // first toc entry has to be zero.\n\n\n\n for (i = 1; i < XING_TOC_SIZE; ++i) {\n\n int j = i * mp3->pos / XING_TOC_SIZE;\n\n int seek_point = 256LL * mp3->bag[j] / mp3->size;\n\n avio_w8(s->pb, FFMIN(seek_point, 255));\n\n }\n\n\n\n avio_seek(s->pb, 0, SEEK_END);\n\n}\n"}} {"sample_id": "872dd82c83745a603d2e07a03d34313eb6467ae4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n }\n \n if (!assign) {\n+\n+ /* Test and clear notifier before after disabling event,\n+\n+ * in case poll callback didn't have time to run. */\n+\n virtio_queue_host_notifier_read(&vq->host_notifier);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void virtio_queue_set_host_notifier_fd_handler(VirtQueue *vq, bool assign,\n\n bool set_handler)\n\n{\n\n if (assign && set_handler) {\n\n event_notifier_set_handler(&vq->host_notifier, true,\n\n virtio_queue_host_notifier_read);\n\n } else {\n\n event_notifier_set_handler(&vq->host_notifier, true, NULL);\n\n }\n\n if (!assign) {\n\n /* Test and clear notifier before after disabling event,\n\n * in case poll callback didn't have time to run. */\n\n virtio_queue_host_notifier_read(&vq->host_notifier);\n\n }\n\n}\n"}} {"sample_id": "07cd8d5676a72d80661e9bfde0a26d83aca4d029", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n int cpu_flags = av_get_cpu_flags();\n+\n+\n+\n+ cavsdsp_init_mmx(c, avctx);\n+\n #if HAVE_AMD3DNOW_INLINE\n \n if (INLINE_AMD3DNOW(cpu_flags))", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "av_cold void ff_cavsdsp_init_x86(CAVSDSPContext *c, AVCodecContext *avctx)\n\n{\n\n int cpu_flags = av_get_cpu_flags();\n\n\n\n cavsdsp_init_mmx(c, avctx);\n\n#if HAVE_AMD3DNOW_INLINE\n\n if (INLINE_AMD3DNOW(cpu_flags))\n\n cavsdsp_init_3dnow(c, avctx);\n\n#endif /* HAVE_AMD3DNOW_INLINE */\n\n#if HAVE_MMXEXT_INLINE\n\n if (INLINE_MMXEXT(cpu_flags)) {\n\n DSPFUNC(put, 0, 16, mmxext);\n\n DSPFUNC(put, 1, 8, mmxext);\n\n DSPFUNC(avg, 0, 16, mmxext);\n\n DSPFUNC(avg, 1, 8, mmxext);\n\n }\n\n#endif\n\n#if HAVE_MMX_EXTERNAL\n\n if (EXTERNAL_MMXEXT(cpu_flags)) {\n\n c->avg_cavs_qpel_pixels_tab[0][0] = avg_cavs_qpel16_mc00_mmxext;\n\n c->avg_cavs_qpel_pixels_tab[1][0] = avg_cavs_qpel8_mc00_mmxext;\n\n }\n\n#endif\n\n#if HAVE_SSE2_EXTERNAL\n\n if (EXTERNAL_SSE2(cpu_flags)) {\n\n c->put_cavs_qpel_pixels_tab[0][0] = put_cavs_qpel16_mc00_sse2;\n\n c->avg_cavs_qpel_pixels_tab[0][0] = avg_cavs_qpel16_mc00_sse2;\n\n }\n\n#endif\n\n}\n"}} {"sample_id": "9745807191a81c45970f780166f44a7f93b18653", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static void gen_ove_cy(DisasContext *dc, TCGv cy)\n \n+{\n \n if (dc->tb_flags & SR_OVE) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_ove_cy(DisasContext *dc, TCGv cy)\n\n{\n\n if (dc->tb_flags & SR_OVE) {\n\n gen_helper_ove(cpu_env, cy);\n\n }\n\n}\n"}} {"sample_id": "e6aed5f404a0983b2971c90e9022f6964a75de0b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,16 +7,16 @@\n uint8_t *line;\n \n for (tileno = 0; tileno < s->numXtiles * s->numYtiles; tileno++){\n+\n J2kTile *tile = s->tile + tileno;\n \n if (s->planar){\n \n+ for (compno = 0; compno < s->ncomponents; compno++){\n \n J2kComponent *comp = tile->comp + compno;\n \n+ int *dst = comp->data;\n \n line = s->picture->data[compno]\n \n@@ -25,7 +25,7 @@\n + comp->coord[0][0];\n \n for (y = comp->coord[1][0]; y < comp->coord[1][1]; y++){\n+\n uint8_t *ptr = line;\n \n for (x = comp->coord[0][0]; x < comp->coord[0][1]; x++)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void copy_frame(J2kEncoderContext *s)\n\n{\n\n int tileno, compno, i, y, x;\n\n uint8_t *line;\n\n for (tileno = 0; tileno < s->numXtiles * s->numYtiles; tileno++){\n\n J2kTile *tile = s->tile + tileno;\n\n if (s->planar){\n\n for (compno = 0; compno < s->ncomponents; compno++){\n\n J2kComponent *comp = tile->comp + compno;\n\n int *dst = comp->data;\n\n line = s->picture->data[compno]\n\n + comp->coord[1][0] * s->picture->linesize[compno]\n\n + comp->coord[0][0];\n\n for (y = comp->coord[1][0]; y < comp->coord[1][1]; y++){\n\n uint8_t *ptr = line;\n\n for (x = comp->coord[0][0]; x < comp->coord[0][1]; x++)\n\n *dst++ = *ptr++ - (1 << 7);\n\n line += s->picture->linesize[compno];\n\n }\n\n }\n\n } else{\n\n line = s->picture->data[0] + tile->comp[0].coord[1][0] * s->picture->linesize[0]\n\n + tile->comp[0].coord[0][0] * s->ncomponents;\n\n\n\n i = 0;\n\n for (y = tile->comp[0].coord[1][0]; y < tile->comp[0].coord[1][1]; y++){\n\n uint8_t *ptr = line;\n\n for (x = tile->comp[0].coord[0][0]; x < tile->comp[0].coord[0][1]; x++, i++){\n\n for (compno = 0; compno < s->ncomponents; compno++){\n\n tile->comp[compno].data[i] = *ptr++ - (1 << 7);\n\n }\n\n }\n\n line += s->picture->linesize[0];\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_83", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n \n \n+ r = *in;\n+\n+ DEBUG(\"slow_bar_readl addr=0x\" TARGET_FMT_plx \" val=0x%08x\\n\", addr, r);\n+\n+\n \n return r;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t slow_bar_readl(void *opaque, target_phys_addr_t addr)\n\n{\n\n AssignedDevRegion *d = opaque;\n\n uint32_t *in = (uint32_t *)(d->u.r_virtbase + addr);\n\n uint32_t r;\n\n\n\n r = *in;\n\n DEBUG(\"slow_bar_readl addr=0x\" TARGET_FMT_plx \" val=0x%08x\\n\", addr, r);\n\n\n\n return r;\n\n}\n"}} {"sample_id": "a4f6be86d67ae30d494fbe8a470bc32b715d75a9_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n int index_a = qp - qp_bd_offset + h->slice_alpha_c0_offset;\n \n int alpha = alpha_table[index_a];\n+\n+ int beta = beta_table[qp - qp_bd_offset + h->slice_beta_offset];\n+\n+ if (alpha ==0 || beta == 0) return;\n+\n \n \n if( bS[0] < 4 ) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void filter_mb_mbaff_edgev( H264Context *h, uint8_t *pix, int stride, const int16_t bS[7], int bsi, int qp ) {\n\n const int qp_bd_offset = 6 * (h->sps.bit_depth_luma - 8);\n\n int index_a = qp - qp_bd_offset + h->slice_alpha_c0_offset;\n\n int alpha = alpha_table[index_a];\n\n int beta = beta_table[qp - qp_bd_offset + h->slice_beta_offset];\n\n if (alpha ==0 || beta == 0) return;\n\n\n\n if( bS[0] < 4 ) {\n\n int8_t tc[4];\n\n tc[0] = tc0_table[index_a][bS[0*bsi]];\n\n tc[1] = tc0_table[index_a][bS[1*bsi]];\n\n tc[2] = tc0_table[index_a][bS[2*bsi]];\n\n tc[3] = tc0_table[index_a][bS[3*bsi]];\n\n h->h264dsp.h264_h_loop_filter_luma_mbaff(pix, stride, alpha, beta, tc);\n\n } else {\n\n h->h264dsp.h264_h_loop_filter_luma_mbaff_intra(pix, stride, alpha, beta);\n\n }\n\n}\n"}} {"sample_id": "42a268c241183877192c376d03bd9b6d527407c7_18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,8 +24,8 @@\n \n gen_set_label(label);\n \n+ tcg_temp_free(tmp);\n+\n+ }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gen_load_store_alignment(DisasContext *dc, int shift,\n\n TCGv_i32 addr, bool no_hw_alignment)\n\n{\n\n if (!option_enabled(dc, XTENSA_OPTION_UNALIGNED_EXCEPTION)) {\n\n tcg_gen_andi_i32(addr, addr, ~0 << shift);\n\n } else if (option_enabled(dc, XTENSA_OPTION_HW_ALIGNMENT) &&\n\n no_hw_alignment) {\n\n int label = gen_new_label();\n\n TCGv_i32 tmp = tcg_temp_new_i32();\n\n tcg_gen_andi_i32(tmp, addr, ~(~0 << shift));\n\n tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, label);\n\n gen_exception_cause_vaddr(dc, LOAD_STORE_ALIGNMENT_CAUSE, addr);\n\n gen_set_label(label);\n\n tcg_temp_free(tmp);\n\n }\n\n}\n"}} {"sample_id": "7ad742b2247a0d6f742a656892b4963fa77744dd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n AVFrame *frame = av_frame_alloc();\n \n+ if (!frame)\n \n return NULL;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static AVFrame *alloc_frame(enum AVPixelFormat pixfmt, int w, int h)\n\n{\n\n AVFrame *frame = av_frame_alloc();\n\n if (!frame)\n\n return NULL;\n\n\n\n frame->format = pixfmt;\n\n frame->width = w;\n\n frame->height = h;\n\n\n\n if (av_frame_get_buffer(frame, 32) < 0)\n\n return NULL;\n\n\n\n return frame;\n\n}\n"}} {"sample_id": "130a03855098a4057c227bc658c0688f8665b71f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n CPUX86State *env;\n \n+ static int inited;\n+\n+\n+\n+ cpu = X86_CPU(object_new(TYPE_X86_CPU));\n \n env = &cpu->env;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "X86CPU *cpu_x86_init(const char *cpu_model)\n\n{\n\n X86CPU *cpu;\n\n CPUX86State *env;\n\n static int inited;\n\n\n\n cpu = X86_CPU(object_new(TYPE_X86_CPU));\n\n env = &cpu->env;\n\n env->cpu_model_str = cpu_model;\n\n\n\n /* init various static tables used in TCG mode */\n\n if (tcg_enabled() && !inited) {\n\n inited = 1;\n\n optimize_flags_init();\n\n#ifndef CONFIG_USER_ONLY\n\n prev_debug_excp_handler =\n\n cpu_set_debug_excp_handler(breakpoint_handler);\n\n#endif\n\n }\n\n if (cpu_x86_register(cpu, cpu_model) < 0) {\n\n object_delete(OBJECT(cpu));\n\n return NULL;\n\n }\n\n\n\n x86_cpu_realize(OBJECT(cpu), NULL);\n\n\n\n return cpu;\n\n}\n"}} {"sample_id": "64607d088132abdb25bf30d93e97d0c8df7b364c_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n }\n \n \n+\n+ prop = g_malloc(sizeof(*prop));\n+\n+ prop->target_obj = target_obj;\n+\n prop->target_name = target_name;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void object_property_add_alias(Object *obj, const char *name,\n\n Object *target_obj, const char *target_name,\n\n Error **errp)\n\n{\n\n AliasProperty *prop;\n\n ObjectProperty *target_prop;\n\n\n\n target_prop = object_property_find(target_obj, target_name, errp);\n\n if (!target_prop) {\n\n return;\n\n }\n\n\n\n prop = g_malloc(sizeof(*prop));\n\n prop->target_obj = target_obj;\n\n prop->target_name = target_name;\n\n\n\n object_property_add(obj, name, target_prop->type,\n\n property_get_alias,\n\n property_set_alias,\n\n property_release_alias,\n\n prop, errp);\n\n}\n"}} {"sample_id": "0058584580b87feb47898e60e4b80c7f425882ad_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,8 +12,8 @@\n \n samples[i + 256] = samples[i + 768];\n \n+ samples[i + 512] = samples[i + 768] = 0;\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void downmix_2f_2r_to_stereo(float *samples)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < 256; i++) {\n\n samples[i] += samples[i + 512];\n\n samples[i + 256] = samples[i + 768];\n\n samples[i + 512] = samples[i + 768] = 0;\n\n }\n\n}\n"}} {"sample_id": "b931bfbf042983f311b3b09894d8030b2755a638_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void vhost_user_stop(VhostUserState *s)\n+\n+{\n+\n if (vhost_user_running(s)) {\n \n vhost_net_cleanup(s->vhost_net);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vhost_user_stop(VhostUserState *s)\n\n{\n\n if (vhost_user_running(s)) {\n\n vhost_net_cleanup(s->vhost_net);\n\n }\n\n\n\n s->vhost_net = 0;\n\n}\n"}} {"sample_id": "196a778428989217b82de042725dc8eb29c8f8d8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void qxl_hard_reset(PCIQXLDevice *d, int loadvm)\n \n+{\n \n dprint(d, 1, \"%s: start%s\\n\", __FUNCTION__,\n+\n loadvm ? \" (loadvm)\" : \"\");\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void qxl_hard_reset(PCIQXLDevice *d, int loadvm)\n\n{\n\n dprint(d, 1, \"%s: start%s\\n\", __FUNCTION__,\n\n loadvm ? \" (loadvm)\" : \"\");\n\n\n\n qemu_mutex_unlock_iothread();\n\n d->ssd.worker->reset_cursor(d->ssd.worker);\n\n d->ssd.worker->reset_image_cache(d->ssd.worker);\n\n qemu_mutex_lock_iothread();\n\n qxl_reset_surfaces(d);\n\n qxl_reset_memslots(d);\n\n\n\n /* pre loadvm reset must not touch QXLRam. This lives in\n\n * device memory, is migrated together with RAM and thus\n\n * already loaded at this point */\n\n if (!loadvm) {\n\n qxl_reset_state(d);\n\n }\n\n qemu_spice_create_host_memslot(&d->ssd);\n\n qxl_soft_reset(d);\n\n\n\n dprint(d, 1, \"%s: done\\n\", __FUNCTION__);\n\n}\n"}} {"sample_id": "07caea315a85ebfe90851f9c2e4ef3fdd24117b5_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ const char *models[2];\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void qemu_check_nic_model(NICInfo *nd, const char *model)\n\n{\n\n const char *models[2];\n\n\n\n models[0] = model;\n\n models[1] = NULL;\n\n\n\n qemu_check_nic_model_list(nd, models, model);\n\n}\n"}} {"sample_id": "5e003f17ec518cd96f5d2ac23ce9e14144426235", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n bool bdrv_all_can_snapshot(BlockDriverState **first_bad_bs)\n \n+{\n \n bool ok = true;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "bool bdrv_all_can_snapshot(BlockDriverState **first_bad_bs)\n\n{\n\n bool ok = true;\n\n BlockDriverState *bs;\n\n BdrvNextIterator it;\n\n\n\n for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {\n\n AioContext *ctx = bdrv_get_aio_context(bs);\n\n\n\n aio_context_acquire(ctx);\n\n if (bdrv_is_inserted(bs) && !bdrv_is_read_only(bs)) {\n\n ok = bdrv_can_snapshot(bs);\n\n }\n\n aio_context_release(ctx);\n\n if (!ok) {\n\n\n goto fail;\n\n }\n\n }\n\n\n\nfail:\n\n *first_bad_bs = bs;\n\n return ok;\n\n}"}} {"sample_id": "1f01e50b8330c24714ddca5841fdbb703076b121_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void qed_plug_allocating_write_reqs(BDRVQEDState *s)\n+\n+{\n \n assert(!s->allocating_write_reqs_plugged);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qed_plug_allocating_write_reqs(BDRVQEDState *s)\n\n{\n\n assert(!s->allocating_write_reqs_plugged);\n\n\n\n s->allocating_write_reqs_plugged = true;\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static inline void t_gen_raise_exception(uint32_t index)\n+\n {\n \n \ttcg_gen_helper_0_1(helper_raise_exception, tcg_const_tl(index));", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void t_gen_raise_exception(uint32_t index)\n\n{\n\n\ttcg_gen_helper_0_1(helper_raise_exception, tcg_const_tl(index));\n\n}\n"}} {"sample_id": "b6fcf32d9b851a83dedcb609091236b97cc4a985", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n UserDefNested *udnp = g_malloc0(sizeof(*udnp));\n+\n+ udnp->string0 = strdup(\"test_string0\");\n+\n+ udnp->dict1.string1 = strdup(\"test_string1\");\n+\n udnp->dict1.dict2.userdef1 = g_malloc0(sizeof(UserDefOne));\n \n udnp->dict1.dict2.userdef1->base = g_new0(UserDefZero, 1);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static UserDefNested *nested_struct_create(void)\n\n{\n\n UserDefNested *udnp = g_malloc0(sizeof(*udnp));\n\n udnp->string0 = strdup(\"test_string0\");\n\n udnp->dict1.string1 = strdup(\"test_string1\");\n\n udnp->dict1.dict2.userdef1 = g_malloc0(sizeof(UserDefOne));\n\n udnp->dict1.dict2.userdef1->base = g_new0(UserDefZero, 1);\n\n udnp->dict1.dict2.userdef1->base->integer = 42;\n\n udnp->dict1.dict2.userdef1->string = strdup(\"test_string\");\n\n udnp->dict1.dict2.string2 = strdup(\"test_string2\");\n\n udnp->dict1.has_dict3 = true;\n\n udnp->dict1.dict3.userdef2 = g_malloc0(sizeof(UserDefOne));\n\n udnp->dict1.dict3.userdef2->base = g_new0(UserDefZero, 1);\n\n udnp->dict1.dict3.userdef2->base->integer = 43;\n\n udnp->dict1.dict3.userdef2->string = strdup(\"test_string\");\n\n udnp->dict1.dict3.string3 = strdup(\"test_string3\");\n\n return udnp;\n\n}\n"}} {"sample_id": "d0d7708ba29cbcc343364a46bff981e0ff88366f_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,9 +19,9 @@\n if (fd < 0) {\n \n return NULL;\n+\n+ }\n+\n+ return qemu_chr_open_pp_fd(fd, errp);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static CharDriverState *qmp_chardev_open_parallel(const char *id,\n\n ChardevBackend *backend,\n\n ChardevReturn *ret,\n\n Error **errp)\n\n{\n\n ChardevHostdev *parallel = backend->u.parallel;\n\n int fd;\n\n\n\n fd = qmp_chardev_open_file_source(parallel->device, O_RDWR, errp);\n\n if (fd < 0) {\n\n return NULL;\n\n }\n\n return qemu_chr_open_pp_fd(fd, errp);\n\n}\n"}} {"sample_id": "812c1057f6175ac9a9829fa2920a2b5783814193", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n {\n \n+ CharDriverState *chr = opaque;\n+\n+\n+\n+ if (cond != G_IO_HUP) {\n \n return FALSE;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static gboolean tcp_chr_chan_close(GIOChannel *channel, GIOCondition cond,\n\n void *opaque)\n\n{\n\n CharDriverState *chr = opaque;\n\n\n\n if (cond != G_IO_HUP) {\n\n return FALSE;\n\n }\n\n\n\n /* connection closed */\n\n tcp_chr_disconnect(chr);\n\n if (chr->fd_hup_tag) {\n\n g_source_remove(chr->fd_hup_tag);\n\n chr->fd_hup_tag = 0;\n\n }\n\n\n\n return TRUE;\n\n}\n"}} {"sample_id": "d32fcad366e5f45d33dab2ee4de0e5729439680b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,10 +12,10 @@\n \n size = vde_recv(s->vde, (char *)buf, sizeof(buf), 0);\n \n+ if (size > 0) {\n+\n+ qemu_send_packet(&s->nc, buf, size);\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vde_to_qemu(void *opaque)\n\n{\n\n VDEState *s = opaque;\n\n uint8_t buf[4096];\n\n int size;\n\n\n\n size = vde_recv(s->vde, (char *)buf, sizeof(buf), 0);\n\n if (size > 0) {\n\n qemu_send_packet(&s->nc, buf, size);\n\n }\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_91", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,9 +13,9 @@\n if (sector > total_sectors || nb_sectors > total_sectors - sector) {\n \n return false;\n+\n+ }\n+\n+ return true;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool ide_sect_range_ok(IDEState *s,\n\n uint64_t sector, uint64_t nb_sectors)\n\n{\n\n uint64_t total_sectors;\n\n\n\n bdrv_get_geometry(s->bs, &total_sectors);\n\n if (sector > total_sectors || nb_sectors > total_sectors - sector) {\n\n return false;\n\n }\n\n return true;\n\n}\n"}} {"sample_id": "bfa0f96586fe2c257cfa574ffb991da493a54da1_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int vp8_alloc_frame(VP8Context *s, AVFrame *f)\n \n {\n+\n int ret;\n \n if ((ret = ff_thread_get_buffer(s->avctx, f)) < 0)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int vp8_alloc_frame(VP8Context *s, AVFrame *f)\n\n{\n\n int ret;\n\n if ((ret = ff_thread_get_buffer(s->avctx, f)) < 0)\n\n return ret;\n\n if (!s->maps_are_invalid && s->num_maps_to_be_freed) {\n\n f->ref_index[0] = s->segmentation_maps[--s->num_maps_to_be_freed];\n\n } else if (!(f->ref_index[0] = av_mallocz(s->mb_width * s->mb_height))) {\n\n ff_thread_release_buffer(s->avctx, f);\n\n return AVERROR(ENOMEM);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "323e6fead07c75f418e4b60704a4f437bb3483b2_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int normalize_samples(AC3EncodeContext *s)\n \n {\n+\n int v = 14 - log2_tab(s, s->windowed_samples, AC3_WINDOW_SIZE);\n \n lshift_tab(s->windowed_samples, AC3_WINDOW_SIZE, v);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int normalize_samples(AC3EncodeContext *s)\n\n{\n\n int v = 14 - log2_tab(s, s->windowed_samples, AC3_WINDOW_SIZE);\n\n lshift_tab(s->windowed_samples, AC3_WINDOW_SIZE, v);\n\n return v - 9;\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_59", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n if (!s->bs || !s->mult_sectors) {\n \n+ ide_abort_command(s);\n+\n+ return true;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool cmd_write_multiple(IDEState *s, uint8_t cmd)\n\n{\n\n bool lba48 = (cmd == WIN_MULTWRITE_EXT);\n\n int n;\n\n\n\n if (!s->bs || !s->mult_sectors) {\n\n ide_abort_command(s);\n\n return true;\n\n }\n\n\n\n ide_cmd_lba48_transform(s, lba48);\n\n\n\n s->req_nb_sectors = s->mult_sectors;\n\n n = MIN(s->nsector, s->req_nb_sectors);\n\n\n\n s->status = SEEK_STAT | READY_STAT;\n\n ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_write);\n\n\n\n s->media_changed = 1;\n\n\n\n return false;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_227", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n \t/* Every channel has a 0x2000 ctrl register map. */\n+\n+\treturn addr >> 13;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline int fs_channel(target_phys_addr_t addr)\n\n{\n\n\t/* Every channel has a 0x2000 ctrl register map. */\n\n\treturn addr >> 13;\n\n}\n"}} {"sample_id": "354fb471bd5faf527f3fa25388b8cffa6bd937d0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void crs_replace_with_free_ranges(GPtrArray *ranges,\n+\n uint64_t start, uint64_t end)\n \n {\n@@ -17,7 +17,7 @@\n for (i = 0; i < ranges->len; i++) {\n \n CrsRangeEntry *used = g_ptr_array_index(ranges, i);\n+\n \n \n if (free_base < used->base) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void crs_replace_with_free_ranges(GPtrArray *ranges,\n\n uint64_t start, uint64_t end)\n\n{\n\n GPtrArray *free_ranges = g_ptr_array_new_with_free_func(crs_range_free);\n\n uint64_t free_base = start;\n\n int i;\n\n\n\n g_ptr_array_sort(ranges, crs_range_compare);\n\n for (i = 0; i < ranges->len; i++) {\n\n CrsRangeEntry *used = g_ptr_array_index(ranges, i);\n\n\n\n if (free_base < used->base) {\n\n crs_range_insert(free_ranges, free_base, used->base - 1);\n\n }\n\n\n\n free_base = used->limit + 1;\n\n }\n\n\n\n if (free_base < end) {\n\n crs_range_insert(free_ranges, free_base, end);\n\n }\n\n\n\n g_ptr_array_set_size(ranges, 0);\n\n for (i = 0; i < free_ranges->len; i++) {\n\n g_ptr_array_add(ranges, g_ptr_array_index(free_ranges, i));\n\n }\n\n\n\n g_ptr_array_free(free_ranges, false);\n\n}\n"}} {"sample_id": "4678124bb9bfb49e93b83f95c4d2feeb443ea38b_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void acpi_add_table(GArray *table_offsets, GArray *table_data)\n+\n+{\n \n uint32_t offset = cpu_to_le32(table_data->len);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void acpi_add_table(GArray *table_offsets, GArray *table_data)\n\n{\n\n uint32_t offset = cpu_to_le32(table_data->len);\n\n g_array_append_val(table_offsets, offset);\n\n}\n"}} {"sample_id": "cdf58f0599c39852ee3beafe5f64af7d57d4215b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -48,8 +48,8 @@\n \n }\n \n+\n+\n+ return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int av_packet_copy_props(AVPacket *dst, const AVPacket *src)\n\n{\n\n int i;\n\n\n\n dst->pts = src->pts;\n\n dst->dts = src->dts;\n\n dst->pos = src->pos;\n\n dst->duration = src->duration;\n\n dst->convergence_duration = src->convergence_duration;\n\n dst->flags = src->flags;\n\n dst->stream_index = src->stream_index;\n\n dst->side_data_elems = src->side_data_elems;\n\n\n\n for (i = 0; i < src->side_data_elems; i++) {\n\n enum AVPacketSideDataType type = src->side_data[i].type;\n\n int size = src->side_data[i].size;\n\n uint8_t *src_data = src->side_data[i].data;\n\n uint8_t *dst_data = av_packet_new_side_data(dst, type, size);\n\n\n\n if (!dst_data) {\n\n av_packet_free_side_data(dst);\n\n return AVERROR(ENOMEM);\n\n }\n\n memcpy(dst_data, src_data, size);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "83d08f2673504a299194dcac1657a13754b5932a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n /*\n \n * BIOS does not set MTRR entries for the 64 bit window, so no need to\n+\n+ * align address to power of two. Align address at 1G, this makes sure\n+\n+ * it can be exactly covered with a PAT entry even when using huge\n+\n * pages.\n \n */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void pc_init_pci64_hole(PcPciInfo *pci_info, uint64_t pci_hole64_start,\n\n uint64_t pci_hole64_size)\n\n{\n\n if ((sizeof(hwaddr) == 4) || (!pci_hole64_size)) {\n\n return;\n\n }\n\n /*\n\n * BIOS does not set MTRR entries for the 64 bit window, so no need to\n\n * align address to power of two. Align address at 1G, this makes sure\n\n * it can be exactly covered with a PAT entry even when using huge\n\n * pages.\n\n */\n\n pci_info->w64.begin = ROUND_UP(pci_hole64_start, 0x1ULL << 30);\n\n pci_info->w64.end = pci_info->w64.begin + pci_hole64_size;\n\n assert(pci_info->w64.begin <= pci_info->w64.end);\n\n}\n"}} {"sample_id": "12d4536f7d911b6d87a766ad7300482ea663cea2_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n bool cpu_exec_all(void)\n+\n {\n \n int r;\n@@ -7,10 +7,10 @@\n \n \n /* Account partial waits to the vm_clock. */\n+\n+ qemu_clock_warp(vm_clock);\n \n+\n \n if (next_cpu == NULL) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "bool cpu_exec_all(void)\n\n{\n\n int r;\n\n\n\n /* Account partial waits to the vm_clock. */\n\n qemu_clock_warp(vm_clock);\n\n\n\n if (next_cpu == NULL) {\n\n next_cpu = first_cpu;\n\n }\n\n for (; next_cpu != NULL && !exit_request; next_cpu = next_cpu->next_cpu) {\n\n CPUState *env = next_cpu;\n\n\n\n qemu_clock_enable(vm_clock,\n\n (env->singlestep_enabled & SSTEP_NOTIMER) == 0);\n\n\n\n#ifndef CONFIG_IOTHREAD\n\n if (qemu_alarm_pending()) {\n\n break;\n\n }\n\n#endif\n\n if (cpu_can_run(env)) {\n\n if (kvm_enabled()) {\n\n r = kvm_cpu_exec(env);\n\n qemu_kvm_eat_signals(env);\n\n } else {\n\n r = tcg_cpu_exec(env);\n\n }\n\n if (r == EXCP_DEBUG) {\n\n cpu_handle_guest_debug(env);\n\n break;\n\n }\n\n } else if (env->stop || env->stopped) {\n\n break;\n\n }\n\n }\n\n exit_request = 0;\n\n return !all_cpu_threads_idle();\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n \n val = s->control_regs.impl;\n \n+ break;\n+\n+ case HOST_VERSION:\n+\n+ val = s->control_regs.version;\n \n break;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t ahci_mem_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n AHCIState *s = opaque;\n\n uint32_t val = 0;\n\n\n\n if (addr < AHCI_GENERIC_HOST_CONTROL_REGS_MAX_ADDR) {\n\n switch (addr) {\n\n case HOST_CAP:\n\n val = s->control_regs.cap;\n\n break;\n\n case HOST_CTL:\n\n val = s->control_regs.ghc;\n\n break;\n\n case HOST_IRQ_STAT:\n\n val = s->control_regs.irqstatus;\n\n break;\n\n case HOST_PORTS_IMPL:\n\n val = s->control_regs.impl;\n\n break;\n\n case HOST_VERSION:\n\n val = s->control_regs.version;\n\n break;\n\n }\n\n\n\n DPRINTF(-1, \"(addr 0x%08X), val 0x%08X\\n\", (unsigned) addr, val);\n\n } else if ((addr >= AHCI_PORT_REGS_START_ADDR) &&\n\n (addr < (AHCI_PORT_REGS_START_ADDR +\n\n (s->ports * AHCI_PORT_ADDR_OFFSET_LEN)))) {\n\n val = ahci_port_read(s, (addr - AHCI_PORT_REGS_START_ADDR) >> 7,\n\n addr & AHCI_PORT_ADDR_OFFSET_MASK);\n\n }\n\n\n\n return val;\n\n}\n"}} {"sample_id": "d57e4e482e3997b1382625c84149ad0b69155fc0_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n |INLCR|IGNCR|ICRNL|IXON);\n \n tty.c_oflag |= OPOST;\n+\n+ tty.c_lflag &= ~(ECHO|ECHONL|ICANON|IEXTEN);\n+\n+ tty.c_cflag &= ~(CSIZE|PARENB);\n+\n tty.c_cflag |= CS8;\n \n tty.c_cc[VMIN] = 1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void term_init(void)\n\n{\n\n struct termios tty;\n\n\n\n tcgetattr (0, &tty);\n\n oldtty = tty;\n\n\n\n tty.c_iflag &= ~(IGNBRK|BRKINT|PARMRK|ISTRIP\n\n |INLCR|IGNCR|ICRNL|IXON);\n\n tty.c_oflag |= OPOST;\n\n tty.c_lflag &= ~(ECHO|ECHONL|ICANON|IEXTEN);\n\n tty.c_cflag &= ~(CSIZE|PARENB);\n\n tty.c_cflag |= CS8;\n\n tty.c_cc[VMIN] = 1;\n\n tty.c_cc[VTIME] = 0;\n\n\n\n tcsetattr (0, TCSANOW, &tty);\n\n\n\n atexit(term_exit);\n\n}\n"}} {"sample_id": "3cff53369acdb3bc0695dd6d5df51457fdaa16ce", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,10 +15,10 @@\n case AMF_DATA_TYPE_NUMBER: return 9;\n \n case AMF_DATA_TYPE_BOOL: return 2;\n+\n case AMF_DATA_TYPE_STRING: return 3 + AV_RB16(data);\n \n+ case AMF_DATA_TYPE_LONG_STRING: return 5 + AV_RB32(data);\n \n case AMF_DATA_TYPE_NULL: return 1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int ff_amf_tag_size(const uint8_t *data, const uint8_t *data_end)\n\n{\n\n const uint8_t *base = data;\n\n\n\n if (data >= data_end)\n\n return -1;\n\n switch (*data++) {\n\n case AMF_DATA_TYPE_NUMBER: return 9;\n\n case AMF_DATA_TYPE_BOOL: return 2;\n\n case AMF_DATA_TYPE_STRING: return 3 + AV_RB16(data);\n\n case AMF_DATA_TYPE_LONG_STRING: return 5 + AV_RB32(data);\n\n case AMF_DATA_TYPE_NULL: return 1;\n\n case AMF_DATA_TYPE_ARRAY:\n\n data += 4;\n\n case AMF_DATA_TYPE_OBJECT:\n\n for (;;) {\n\n int size = bytestream_get_be16(&data);\n\n int t;\n\n if (!size) {\n\n data++;\n\n break;\n\n }\n\n if (data + size >= data_end || data + size < data)\n\n return -1;\n\n data += size;\n\n t = ff_amf_tag_size(data, data_end);\n\n if (t < 0 || data + t >= data_end)\n\n return -1;\n\n data += t;\n\n }\n\n return data - base;\n\n case AMF_DATA_TYPE_OBJECT_END: return 1;\n\n default: return -1;\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_90", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static bool sys_ops_accepts(void *opaque, target_phys_addr_t addr,\n \n+ unsigned size, bool is_write)\n+\n {\n \n return is_write && size == 4;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool sys_ops_accepts(void *opaque, target_phys_addr_t addr,\n\n unsigned size, bool is_write)\n\n{\n\n return is_write && size == 4;\n\n}\n"}} {"sample_id": "366d4f7e0007a5540897fbac6e377c57d8c79a73", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n \n \n+ switch (addr) {\n \n case CG3_REG_BT458_ADDR:\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static uint64_t cg3_reg_read(void *opaque, hwaddr addr, unsigned size)\n\n{\n\n CG3State *s = opaque;\n\n int val;\n\n\n\n switch (addr) {\n\n case CG3_REG_BT458_ADDR:\n\n case CG3_REG_BT458_COLMAP:\n\n val = 0;\n\n break;\n\n case CG3_REG_FBC_CTRL:\n\n val = s->regs[0];\n\n break;\n\n case CG3_REG_FBC_STATUS:\n\n /* monitor ID 6, board type = 1 (color) */\n\n val = s->regs[1] | CG3_SR_1152_900_76_B | CG3_SR_ID_COLOR;\n\n break;\n\n case CG3_REG_FBC_CURSTART ... CG3_REG_SIZE:\n\n val = s->regs[addr - 0x10];\n\n break;\n\n default:\n\n qemu_log_mask(LOG_UNIMP,\n\n \"cg3: Unimplemented register read \"\n\n \"reg 0x%\" HWADDR_PRIx \" size 0x%x\\n\",\n\n addr, size);\n\n val = 0;\n\n break;\n\n }\n\n DPRINTF(\"read %02x from reg %\" HWADDR_PRIx \"\\n\", val, addr);\n\n return val;\n\n}\n"}} {"sample_id": "72dbc610be3272ba36603f78a39cc2d2d8fe0cc3_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n uint32_t multiple8_cnt;\n \n+\n+\n+ for (multiple8_cnt = 4; multiple8_cnt--;) {\n+\n+ avc_luma_midh_qrt_and_aver_dst_4w_msa(src, src_stride, dst, dst_stride,\n \n height, horiz_offset);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void avc_luma_midh_qrt_and_aver_dst_16w_msa(const uint8_t *src,\n\n int32_t src_stride,\n\n uint8_t *dst,\n\n int32_t dst_stride,\n\n int32_t height,\n\n uint8_t horiz_offset)\n\n{\n\n uint32_t multiple8_cnt;\n\n\n\n for (multiple8_cnt = 4; multiple8_cnt--;) {\n\n avc_luma_midh_qrt_and_aver_dst_4w_msa(src, src_stride, dst, dst_stride,\n\n height, horiz_offset);\n\n\n\n src += 4;\n\n dst += 4;\n\n }\n\n}\n"}} {"sample_id": "86f6ae67e157362f3b141649874213ce01dcc622_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void bdrv_dirty_bitmap_deserialize_zeroes(BdrvDirtyBitmap *bitmap,\n \n uint64_t start, uint64_t count,\n+\n+ bool finish)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bdrv_dirty_bitmap_deserialize_zeroes(BdrvDirtyBitmap *bitmap,\n\n uint64_t start, uint64_t count,\n\n bool finish)\n\n{\n\n hbitmap_deserialize_zeroes(bitmap->bitmap, start, count, finish);\n\n}\n"}} {"sample_id": "7ad4c7200111d20eb97eed4f46b6026e3f0b0eef_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n char *dup;\n \n+ size_t i;\n+\n+\n+\n+ if (!s) {\n \n return NULL;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "char *g_strdup(const char *s)\n\n{\n\n char *dup;\n\n size_t i;\n\n\n\n if (!s) {\n\n return NULL;\n\n }\n\n\n\n __coverity_string_null_sink__(s);\n\n __coverity_string_size_sink__(s);\n\n dup = __coverity_alloc_nosize__();\n\n __coverity_mark_as_afm_allocated__(dup, AFM_free);\n\n for (i = 0; (dup[i] = s[i]); i++) ;\n\n return dup;\n\n}\n"}} {"sample_id": "b45c03f585ea9bb1af76c73e82195418c294919d_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n struct omap_mmc_s *omap2_mmc_init(struct omap_target_agent_s *ta,\n+\n BlockBackend *blk, qemu_irq irq, qemu_irq dma[],\n \n omap_clk fclk, omap_clk iclk)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "struct omap_mmc_s *omap2_mmc_init(struct omap_target_agent_s *ta,\n\n BlockBackend *blk, qemu_irq irq, qemu_irq dma[],\n\n omap_clk fclk, omap_clk iclk)\n\n{\n\n struct omap_mmc_s *s = (struct omap_mmc_s *)\n\n g_malloc0(sizeof(struct omap_mmc_s));\n\n\n\n s->irq = irq;\n\n s->dma = dma;\n\n s->clk = fclk;\n\n s->lines = 4;\n\n s->rev = 2;\n\n\n\n omap_mmc_reset(s);\n\n\n\n memory_region_init_io(&s->iomem, NULL, &omap_mmc_ops, s, \"omap.mmc\",\n\n omap_l4_region_size(ta, 0));\n\n omap_l4_attach(ta, 0, &s->iomem);\n\n\n\n /* Instantiate the storage */\n\n s->card = sd_init(blk, false);\n\n if (s->card == NULL) {\n\n exit(1);\n\n }\n\n\n\n s->cdet = qemu_allocate_irq(omap_mmc_cover_cb, s, 0);\n\n sd_set_cb(s->card, NULL, s->cdet);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "fa18f36a461984eae50ab957e47ec78dae3c14fc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n qemu_input_event_send(src, evt);\n \n+ qemu_input_event_sync();\n+\n+ qapi_free_InputEvent(evt);\n+\n+ } else {\n \n qemu_input_queue_event(&kbd_queue, src, evt);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void qemu_input_event_send_key(QemuConsole *src, KeyValue *key, bool down)\n\n{\n\n InputEvent *evt;\n\n evt = qemu_input_event_new_key(key, down);\n\n if (QTAILQ_EMPTY(&kbd_queue)) {\n\n qemu_input_event_send(src, evt);\n\n qemu_input_event_sync();\n\n qapi_free_InputEvent(evt);\n\n } else {\n\n qemu_input_queue_event(&kbd_queue, src, evt);\n\n qemu_input_queue_sync(&kbd_queue);\n\n }\n\n}\n"}} {"sample_id": "db39fcf1f690b02d612e2bfc00980700887abe03_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n s->active = false;\n \n s->sin.subtype = g_strdup(subtype);\n+\n+ chr->opaque = s;\n+\n+ chr->chr_write = spice_chr_write;\n+\n chr->chr_add_watch = spice_chr_add_watch;\n \n chr->chr_close = spice_chr_close;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static CharDriverState *chr_open(const char *subtype,\n\n void (*set_fe_open)(struct CharDriverState *, int))\n\n\n\n{\n\n CharDriverState *chr;\n\n SpiceCharDriver *s;\n\n\n\n chr = g_malloc0(sizeof(CharDriverState));\n\n s = g_malloc0(sizeof(SpiceCharDriver));\n\n s->chr = chr;\n\n s->active = false;\n\n s->sin.subtype = g_strdup(subtype);\n\n chr->opaque = s;\n\n chr->chr_write = spice_chr_write;\n\n chr->chr_add_watch = spice_chr_add_watch;\n\n chr->chr_close = spice_chr_close;\n\n chr->chr_set_fe_open = set_fe_open;\n\n chr->explicit_be_open = true;\n\n chr->chr_fe_event = spice_chr_fe_event;\n\n\n\n QLIST_INSERT_HEAD(&spice_chars, s, next);\n\n\n\n return chr;\n\n}\n"}} {"sample_id": "75af1f34cd5b07c3c7fcf86dfc99a42de48a600d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n return -EINVAL;\n \n+ }\n+\n+\n+\n+ return bdrv_co_do_preadv(bs, sector_num << BDRV_SECTOR_BITS,\n \n nb_sectors << BDRV_SECTOR_BITS, qiov, flags);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int coroutine_fn bdrv_co_do_readv(BlockDriverState *bs,\n\n int64_t sector_num, int nb_sectors, QEMUIOVector *qiov,\n\n BdrvRequestFlags flags)\n\n{\n\n if (nb_sectors < 0 || nb_sectors > (UINT_MAX >> BDRV_SECTOR_BITS)) {\n\n return -EINVAL;\n\n }\n\n\n\n return bdrv_co_do_preadv(bs, sector_num << BDRV_SECTOR_BITS,\n\n nb_sectors << BDRV_SECTOR_BITS, qiov, flags);\n\n}\n"}} {"sample_id": "4ec0beaa593860796feead14132506226a1edf0e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -51,11 +51,11 @@\n return AVERROR_IO;\n \n }\n+\n+ pkt->stream_index = 0;\n+\n+ wc->block_parsed = 1;\n+\n pkt->size = ret + WV_EXTRA_SIZE;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int wv_read_packet(AVFormatContext *s,\n\n AVPacket *pkt)\n\n{\n\n WVContext *wc = s->priv_data;\n\n int ret, samples;\n\n\n\n if (url_feof(&s->pb))\n\n return -EIO;\n\n if(wc->block_parsed){\n\n if(wv_read_block_header(s, &s->pb) < 0)\n\n return -1;\n\n }\n\n\n\n samples = LE_32(wc->extra);\n\n /* should not happen but who knows */\n\n if(samples * 2 * wc->chan > AVCODEC_MAX_AUDIO_FRAME_SIZE){\n\n av_log(s, AV_LOG_ERROR, \"Packet size is too big to be handled in lavc!\\n\");\n\n return -EIO;\n\n }\n\n if(av_new_packet(pkt, wc->blksize + WV_EXTRA_SIZE) < 0)\n\n return AVERROR_NOMEM;\n\n memcpy(pkt->data, wc->extra, WV_EXTRA_SIZE);\n\n ret = get_buffer(&s->pb, pkt->data + WV_EXTRA_SIZE, wc->blksize);\n\n if(ret != wc->blksize){\n\n av_free_packet(pkt);\n\n return AVERROR_IO;\n\n }\n\n pkt->stream_index = 0;\n\n wc->block_parsed = 1;\n\n pkt->size = ret + WV_EXTRA_SIZE;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d6945aeee419a8417b8019c7c92227e12e45b7ad", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n int i;\n \n+ pixel *dst = (pixel *) _dst;\n+\n+ dctcoef *src = (dctcoef *) _src;\n+\n stride /= sizeof(pixel);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void FUNCC(ff_h264_add_pixels4)(uint8_t *_dst, int16_t *_src, int stride)\n\n{\n\n int i;\n\n pixel *dst = (pixel *) _dst;\n\n dctcoef *src = (dctcoef *) _src;\n\n stride /= sizeof(pixel);\n\n\n\n for (i = 0; i < 4; i++) {\n\n dst[0] += src[0];\n\n dst[1] += src[1];\n\n dst[2] += src[2];\n\n dst[3] += src[3];\n\n\n\n dst += stride;\n\n src += 4;\n\n }\n\n\n\n memset(_src, 0, sizeof(dctcoef) * 16);\n\n}\n"}} {"sample_id": "079d0b7f1eedcc634c371fe05b617fdc55c8b762_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n int ret;\n \n+\n+\n+ if (dev == NULL) {\n+\n+ return USB_RET_NODEV;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int usb_handle_packet(USBDevice *dev, USBPacket *p)\n\n{\n\n int ret;\n\n\n\n if (dev == NULL) {\n\n return USB_RET_NODEV;\n\n }\n\n assert(dev->addr == p->devaddr);\n\n assert(dev->state == USB_STATE_DEFAULT);\n\n assert(p->state == USB_PACKET_SETUP);\n\n\n\n if (p->devep == 0) {\n\n /* control pipe */\n\n switch (p->pid) {\n\n case USB_TOKEN_SETUP:\n\n ret = do_token_setup(dev, p);\n\n break;\n\n case USB_TOKEN_IN:\n\n ret = do_token_in(dev, p);\n\n break;\n\n case USB_TOKEN_OUT:\n\n ret = do_token_out(dev, p);\n\n break;\n\n default:\n\n ret = USB_RET_STALL;\n\n break;\n\n }\n\n } else {\n\n /* data pipe */\n\n ret = usb_device_handle_data(dev, p);\n\n }\n\n\n\n if (ret == USB_RET_ASYNC) {\n\n p->ep = usb_ep_get(dev, p->pid, p->devep);\n\n p->state = USB_PACKET_ASYNC;\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "0ecca7a49f8e254c12a3a1de048d738bfbb614c6_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n minor = get_bits(&gb, 8); /* version minor */\n micro = get_bits(&gb, 8); /* version micro */\n av_log(avctx, AV_LOG_INFO, \"Theora bitstream version %d.%d.%d\\n\",\n+\tmajor, minor, micro);\n+ /* FIXME: endianess? */\n+ s->theora = (major << 16) | (minor << 8) | micro;\n+ /* 3.3.0 aka alpha3 has the same frame orientation as original vp3 */\n+ /* but previous versions have the image flipped relative to vp3 */\n if (s->theora < 0x030300)\n {\n \ts->flipped_image = 1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int theora_decode_header(AVCodecContext *avctx, GetBitContext gb)\n{\n Vp3DecodeContext *s = avctx->priv_data;\n int major, minor, micro;\n major = get_bits(&gb, 8); /* version major */\n minor = get_bits(&gb, 8); /* version minor */\n micro = get_bits(&gb, 8); /* version micro */\n av_log(avctx, AV_LOG_INFO, \"Theora bitstream version %d.%d.%d\\n\",\n\tmajor, minor, micro);\n /* FIXME: endianess? */\n s->theora = (major << 16) | (minor << 8) | micro;\n /* 3.3.0 aka alpha3 has the same frame orientation as original vp3 */\n /* but previous versions have the image flipped relative to vp3 */\n if (s->theora < 0x030300)\n {\n\ts->flipped_image = 1;\n av_log(avctx, AV_LOG_DEBUG, \"Old (width = get_bits(&gb, 16) << 4;\n s->height = get_bits(&gb, 16) << 4;\n skip_bits(&gb, 24); /* frame width */\n skip_bits(&gb, 24); /* frame height */\n skip_bits(&gb, 8); /* offset x */\n skip_bits(&gb, 8); /* offset y */\n skip_bits(&gb, 32); /* fps numerator */\n skip_bits(&gb, 32); /* fps denumerator */\n skip_bits(&gb, 24); /* aspect numerator */\n skip_bits(&gb, 24); /* aspect denumerator */\n if (s->theora < 0x030300)\n\tskip_bits(&gb, 5); /* keyframe frequency force */\n skip_bits(&gb, 8); /* colorspace */\n skip_bits(&gb, 24); /* bitrate */\n skip_bits(&gb, 6); /* last(?) quality index */\n if (s->theora >= 0x030300)\n {\n\tskip_bits(&gb, 5); /* keyframe frequency force */\n\tskip_bits(&gb, 5); /* spare bits */\n// align_get_bits(&gb);\n avctx->width = s->width;\n avctx->height = s->height;\n vp3_decode_init(avctx);\n return 0;"}} {"sample_id": "435db4cf29b88b6612e30acda01cd18788dff458_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n ret = opt->value.uint;\n \n+ if (del) {\n+\n+ qemu_opt_del_all(opts, name);\n+\n+ }\n \n return ret;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t qemu_opt_get_number_helper(QemuOpts *opts, const char *name,\n\n uint64_t defval, bool del)\n\n{\n\n QemuOpt *opt = qemu_opt_find(opts, name);\n\n uint64_t ret = defval;\n\n\n\n if (opt == NULL) {\n\n const QemuOptDesc *desc = find_desc_by_name(opts->list->desc, name);\n\n if (desc && desc->def_value_str) {\n\n parse_option_number(name, desc->def_value_str, &ret, &error_abort);\n\n }\n\n return ret;\n\n }\n\n assert(opt->desc && opt->desc->type == QEMU_OPT_NUMBER);\n\n ret = opt->value.uint;\n\n if (del) {\n\n qemu_opt_del_all(opts, name);\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "919c320f7226bf873a9148e1db8994745f9d425d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n if (!ogg->page_list)\n \n return;\n+\n+\n+\n+ for (p = ogg->page_list; p; ) {\n+\n OGGStreamContext *oggstream =\n \n s->streams[p->page.stream_index]->priv_data;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void ogg_write_pages(AVFormatContext *s, int flush)\n\n{\n\n OGGContext *ogg = s->priv_data;\n\n OGGPageList *next, *p;\n\n\n\n if (!ogg->page_list)\n\n return;\n\n\n\n for (p = ogg->page_list; p; ) {\n\n OGGStreamContext *oggstream =\n\n s->streams[p->page.stream_index]->priv_data;\n\n if (oggstream->page_count < 2 && !flush)\n\n break;\n\n ogg_write_page(s, &p->page,\n\n flush && oggstream->page_count == 1 ? 4 : 0); // eos\n\n next = p->next;\n\n av_freep(&p);\n\n p = next;\n\n }\n\n ogg->page_list = p;\n\n}\n"}} {"sample_id": "fa1298c2d623522eda7b4f1f721fcb935abb7360", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void ohci_bus_stop(OHCIState *ohci)\n \n+{\n+\n+ trace_usb_ohci_stop(ohci->name);\n \n+ if (ohci->eof_timer) {\n \n timer_del(ohci->eof_timer);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void ohci_bus_stop(OHCIState *ohci)\n\n{\n\n trace_usb_ohci_stop(ohci->name);\n\n if (ohci->eof_timer) {\n\n timer_del(ohci->eof_timer);\n\n timer_free(ohci->eof_timer);\n\n }\n\n ohci->eof_timer = NULL;\n\n}\n"}} {"sample_id": "9561fda8d90e176bef598ba87c42a1bd6ad03ef7_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void xilinx_axidma_init(Object *obj)\n \n {\n+\n+ XilinxAXIDMA *s = XILINX_AXI_DMA(obj);\n \n SysBusDevice *sbd = SYS_BUS_DEVICE(obj);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void xilinx_axidma_init(Object *obj)\n\n{\n\n XilinxAXIDMA *s = XILINX_AXI_DMA(obj);\n\n SysBusDevice *sbd = SYS_BUS_DEVICE(obj);\n\n\n\n object_property_add_link(obj, \"axistream-connected\", TYPE_STREAM_SLAVE,\n\n (Object **)&s->tx_data_dev, &error_abort);\n\n object_property_add_link(obj, \"axistream-control-connected\",\n\n TYPE_STREAM_SLAVE,\n\n (Object **)&s->tx_control_dev, &error_abort);\n\n\n\n object_initialize(&s->rx_data_dev, sizeof(s->rx_data_dev),\n\n TYPE_XILINX_AXI_DMA_DATA_STREAM);\n\n object_initialize(&s->rx_control_dev, sizeof(s->rx_control_dev),\n\n TYPE_XILINX_AXI_DMA_CONTROL_STREAM);\n\n object_property_add_child(OBJECT(s), \"axistream-connected-target\",\n\n (Object *)&s->rx_data_dev, &error_abort);\n\n object_property_add_child(OBJECT(s), \"axistream-control-connected-target\",\n\n (Object *)&s->rx_control_dev, &error_abort);\n\n\n\n sysbus_init_irq(sbd, &s->streams[0].irq);\n\n sysbus_init_irq(sbd, &s->streams[1].irq);\n\n\n\n memory_region_init_io(&s->iomem, obj, &axidma_ops, s,\n\n \"xlnx.axi-dma\", R_MAX * 4 * 2);\n\n sysbus_init_mmio(sbd, &s->iomem);\n\n}\n"}} {"sample_id": "599d0c45615b7d099d256738a586d0f63bc707e6_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n {\n \n+ char path[PATH_MAX];\n+\n+ char buf[XEN_HOST_PCI_GET_VALUE_BUFFER_SIZE];\n \n int fd, rc;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int xen_host_pci_get_value(XenHostPCIDevice *d, const char *name,\n\n unsigned int *pvalue, int base)\n\n{\n\n char path[PATH_MAX];\n\n char buf[XEN_HOST_PCI_GET_VALUE_BUFFER_SIZE];\n\n int fd, rc;\n\n unsigned long value;\n\n char *endptr;\n\n\n\n rc = xen_host_pci_sysfs_path(d, name, path, sizeof (path));\n\n if (rc) {\n\n return rc;\n\n }\n\n fd = open(path, O_RDONLY);\n\n if (fd == -1) {\n\n XEN_HOST_PCI_LOG(\"Error: Can't open %s: %s\\n\", path, strerror(errno));\n\n return -errno;\n\n }\n\n do {\n\n rc = read(fd, &buf, sizeof (buf) - 1);\n\n if (rc < 0 && errno != EINTR) {\n\n rc = -errno;\n\n goto out;\n\n }\n\n } while (rc < 0);\n\n buf[rc] = 0;\n\n value = strtol(buf, &endptr, base);\n\n if (endptr == buf || *endptr != '\\n') {\n\n rc = -1;\n\n } else if ((value == LONG_MIN || value == LONG_MAX) && errno == ERANGE) {\n\n rc = -errno;\n\n } else {\n\n rc = 0;\n\n *pvalue = value;\n\n }\n\nout:\n\n close(fd);\n\n return rc;\n\n}\n"}} {"sample_id": "ec45bbe5f1921c6553fbf9c0c76b358b0403c22d_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n \tstruct envlist_entry *entry;\n \n+\n+\n \tassert(envlist != NULL);\n+\n \n \n \twhile (envlist->el_entries.lh_first != NULL) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "envlist_free(envlist_t *envlist)\n\n{\n\n\tstruct envlist_entry *entry;\n\n\n\n\tassert(envlist != NULL);\n\n\n\n\twhile (envlist->el_entries.lh_first != NULL) {\n\n\t\tentry = envlist->el_entries.lh_first;\n\n\t\tQLIST_REMOVE(entry, ev_link);\n\n\n\n\t\tfree((char *)entry->ev_var);\n\n\t\tfree(entry);\n\n\t}\n\n\tfree(envlist);\n\n}\n"}} {"sample_id": "1da41cc1c6c3efbe2ed47228068bd80dbdc49d0e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n kd = g_new0(KVMDevice, 1);\n \n kd->mr = mr;\n+\n+ kd->kda.id = devid;\n+\n+ kd->kda.addr = -1;\n+\n QSLIST_INSERT_HEAD(&kvm_devices_head, kd, entries);\n \n memory_region_ref(kd->mr);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void kvm_arm_register_device(MemoryRegion *mr, uint64_t devid)\n\n{\n\n KVMDevice *kd;\n\n\n\n if (!kvm_irqchip_in_kernel()) {\n\n return;\n\n }\n\n\n\n if (QSLIST_EMPTY(&kvm_devices_head)) {\n\n memory_listener_register(&devlistener, NULL);\n\n qemu_add_machine_init_done_notifier(¬ify);\n\n }\n\n kd = g_new0(KVMDevice, 1);\n\n kd->mr = mr;\n\n kd->kda.id = devid;\n\n kd->kda.addr = -1;\n\n QSLIST_INSERT_HEAD(&kvm_devices_head, kd, entries);\n\n memory_region_ref(kd->mr);\n\n}\n"}} {"sample_id": "0b8b8753e4d94901627b3e86431230f2319215c4_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ NFSRPC *task = opaque;\n \n task->complete = 1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void nfs_co_generic_bh_cb(void *opaque)\n\n{\n\n NFSRPC *task = opaque;\n\n task->complete = 1;\n\n qemu_bh_delete(task->bh);\n\n qemu_coroutine_enter(task->co, NULL);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_86", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,6 +10,6 @@\n \n DEBUG(\"slow_bar_writeb addr=0x\" TARGET_FMT_plx \" val=0x%02x\\n\", addr, val);\n \n+ *out = val;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void slow_bar_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)\n\n{\n\n AssignedDevRegion *d = opaque;\n\n uint8_t *out = d->u.r_virtbase + addr;\n\n\n\n DEBUG(\"slow_bar_writeb addr=0x\" TARGET_FMT_plx \" val=0x%02x\\n\", addr, val);\n\n *out = val;\n\n}\n"}} {"sample_id": "c9c3c80af71dd2b7813d1ada9b14cb51df584221_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n {\n \n+ uint32_t val, size, addr;\n \n PCIDevice *dev = find_dev(spapr, 0, rtas_ld(args, 0));\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void rtas_write_pci_config(sPAPREnvironment *spapr,\n\n uint32_t token, uint32_t nargs,\n\n target_ulong args,\n\n uint32_t nret, target_ulong rets)\n\n{\n\n uint32_t val, size, addr;\n\n PCIDevice *dev = find_dev(spapr, 0, rtas_ld(args, 0));\n\n\n\n if (!dev) {\n\n rtas_st(rets, 0, -1);\n\n return;\n\n }\n\n val = rtas_ld(args, 2);\n\n size = rtas_ld(args, 1);\n\n addr = rtas_pci_cfgaddr(rtas_ld(args, 0));\n\n pci_default_write_config(dev, addr, val, size);\n\n rtas_st(rets, 0, 0);\n\n}\n"}} {"sample_id": "49aa46bb4b894ff8bdb0339ee2a5dd3fcfe93ecd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n \n \n+ if (drv && drv->bdrv_eject) {\n+\n+ drv->bdrv_eject(bs, eject_flag);\n+\n+ }\n \n bs->tray_open = eject_flag;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int bdrv_eject(BlockDriverState *bs, int eject_flag)\n\n{\n\n BlockDriver *drv = bs->drv;\n\n\n\n if (bs->locked) {\n\n return -EBUSY;\n\n }\n\n\n\n if (drv && drv->bdrv_eject) {\n\n drv->bdrv_eject(bs, eject_flag);\n\n }\n\n bs->tray_open = eject_flag;\n\n return 0;\n\n}\n"}} {"sample_id": "937470bb5470825e781ae50e92ff973a6b54d80f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n Error **errp,\n \n gpointer opaque)\n+\n {\n \n QIOChannelSocket *ioc = QIO_CHANNEL_SOCKET(qio_task_get_source(task));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int qio_channel_socket_connect_worker(QIOTask *task,\n\n Error **errp,\n\n gpointer opaque)\n\n{\n\n QIOChannelSocket *ioc = QIO_CHANNEL_SOCKET(qio_task_get_source(task));\n\n SocketAddress *addr = opaque;\n\n int ret;\n\n\n\n ret = qio_channel_socket_connect_sync(ioc,\n\n addr,\n\n errp);\n\n\n\n object_unref(OBJECT(ioc));\n\n return ret;\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_48", "diff": "--- a/source.c\n+++ b/source.c\n@@ -48,11 +48,11 @@\n \n \t\ttcg_gen_shri_tl(x, x, 4);\n \n+\n+\n+\t\ttcg_gen_and_tl(x, x, c);\n+\n+\t\ttcg_gen_sub_tl(d, d, x);\n \n \t\ttcg_temp_free(x);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void t_gen_subx_carry(DisasContext *dc, TCGv d)\n\n{\n\n\tif (dc->flagx_known) {\n\n\t\tif (dc->flags_x) {\n\n\t\t\tTCGv c;\n\n \n\n\t\t\tc = tcg_temp_new(TCG_TYPE_TL);\n\n\t\t\tt_gen_mov_TN_preg(c, PR_CCS);\n\n\t\t\t/* C flag is already at bit 0. */\n\n\t\t\ttcg_gen_andi_tl(c, c, C_FLAG);\n\n\t\t\ttcg_gen_sub_tl(d, d, c);\n\n\t\t\ttcg_temp_free(c);\n\n\t\t}\n\n\t} else {\n\n\t\tTCGv x, c;\n\n\n\n\t\tx = tcg_temp_new(TCG_TYPE_TL);\n\n\t\tc = tcg_temp_new(TCG_TYPE_TL);\n\n\t\tt_gen_mov_TN_preg(x, PR_CCS);\n\n\t\ttcg_gen_mov_tl(c, x);\n\n\n\n\t\t/* Propagate carry into d if X is set. Branch free. */\n\n\t\ttcg_gen_andi_tl(c, c, C_FLAG);\n\n\t\ttcg_gen_andi_tl(x, x, X_FLAG);\n\n\t\ttcg_gen_shri_tl(x, x, 4);\n\n\n\n\t\ttcg_gen_and_tl(x, x, c);\n\n\t\ttcg_gen_sub_tl(d, d, x);\n\n\t\ttcg_temp_free(x);\n\n\t\ttcg_temp_free(c);\n\n\t}\n\n}\n"}} {"sample_id": "104d04182d85e8538e8934c072432a05ab7ed999", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n const char * pch = str;\n+\n unsigned int add1 = 0, add2 = 0, add3 = 0, add4 = 0;\n \n \n@@ -11,7 +11,7 @@\n add1 = atoi(pch);\n \n pch = strpbrk(pch,\".\");\n+\n if (pch == 0 || ++pch == 0) goto done;\n \n add2 = atoi(pch);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "int inet_aton (const char * str, struct in_addr * add)\n\n{\n\n const char * pch = str;\n\n unsigned int add1 = 0, add2 = 0, add3 = 0, add4 = 0;\n\n\n\n add1 = atoi(pch);\n\n pch = strpbrk(pch,\".\");\n\n if (pch == 0 || ++pch == 0) goto done;\n\n add2 = atoi(pch);\n\n pch = strpbrk(pch,\".\");\n\n if (pch == 0 || ++pch == 0) goto done;\n\n add3 = atoi(pch);\n\n pch = strpbrk(pch,\".\");\n\n if (pch == 0 || ++pch == 0) goto done;\n\n add4 = atoi(pch);\n\n\n\ndone:\n\n add->s_addr=(add4<<24)+(add3<<16)+(add2<<8)+add1;\n\n\n\n return 1;\n\n}\n"}} {"sample_id": "d66b969b0d9c8eefdcbff4b48535b0fe1501d139_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,10 +2,10 @@\n \n gpointer user_data)\n \n+{\n+\n+ VTDIOTLBEntry *entry = (VTDIOTLBEntry *)value;\n+\n VTDIOTLBPageInvInfo *info = (VTDIOTLBPageInvInfo *)user_data;\n \n uint64_t gfn = info->gfn & info->mask;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static gboolean vtd_hash_remove_by_page(gpointer key, gpointer value,\n\n gpointer user_data)\n\n{\n\n VTDIOTLBEntry *entry = (VTDIOTLBEntry *)value;\n\n VTDIOTLBPageInvInfo *info = (VTDIOTLBPageInvInfo *)user_data;\n\n uint64_t gfn = info->gfn & info->mask;\n\n return (entry->domain_id == info->domain_id) &&\n\n ((entry->gfn & info->mask) == gfn);\n\n}\n"}} {"sample_id": "eabbc64728c2fdb74f565aededec2ab023d20699_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n ebml_master targets;\n \n int ret;\n+\n+\n+\n+ if (!tags->pos) {\n+\n ret = mkv_add_seekhead_entry(mkv->main_seekhead, MATROSKA_ID_TAGS, avio_tell(s->pb));\n \n if (ret < 0) return ret;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mkv_write_tag_targets(AVFormatContext *s,\n\n unsigned int elementid, unsigned int uid,\n\n ebml_master *tags, ebml_master* tag)\n\n{\n\n AVIOContext *pb;\n\n MatroskaMuxContext *mkv = s->priv_data;\n\n ebml_master targets;\n\n int ret;\n\n\n\n if (!tags->pos) {\n\n ret = mkv_add_seekhead_entry(mkv->main_seekhead, MATROSKA_ID_TAGS, avio_tell(s->pb));\n\n if (ret < 0) return ret;\n\n\n\n start_ebml_master_crc32(s->pb, &mkv->tags_bc, tags, MATROSKA_ID_TAGS, 0);\n\n }\n\n pb = mkv->tags_bc;\n\n\n\n *tag = start_ebml_master(pb, MATROSKA_ID_TAG, 0);\n\n targets = start_ebml_master(pb, MATROSKA_ID_TAGTARGETS, 0);\n\n if (elementid)\n\n put_ebml_uint(pb, elementid, uid);\n\n end_ebml_master(pb, targets);\n\n return 0;\n\n}\n"}} {"sample_id": "ac97393dc7c4761af6104fb8fca5f600899f687b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,8 +7,8 @@\n r->start_head = p[1];\n \n r->start_cylinder = p[3] | ((p[2] << 2) & 0x0300);\n+\n+ r->start_sector = p[2] & 0x3f;\n \n r->system = p[4];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void read_partition(uint8_t *p, struct partition_record *r)\n\n{\n\n r->bootable = p[0];\n\n r->start_head = p[1];\n\n r->start_cylinder = p[3] | ((p[2] << 2) & 0x0300);\n\n r->start_sector = p[2] & 0x3f;\n\n r->system = p[4];\n\n r->end_head = p[5];\n\n r->end_cylinder = p[7] | ((p[6] << 2) & 0x300);\n\n r->end_sector = p[6] & 0x3f;\n\n r->start_sector_abs = p[8] | p[9] << 8 | p[10] << 16 | p[11] << 24;\n\n r->nb_sectors_abs = p[12] | p[13] << 8 | p[14] << 16 | p[15] << 24;\n\n}\n"}} {"sample_id": "d3afacc7269fee45d54d1501a46b51f12ea7bb15", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n uint64_t value)\n \n+{\n \n ARMCPU *cpu = arm_env_get_cpu(env);\n+\n+ int timeridx = ri->crm & 1;\n \n uint32_t oldval = env->cp15.c14_timer[timeridx].ctl;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,\n\n uint64_t value)\n\n{\n\n ARMCPU *cpu = arm_env_get_cpu(env);\n\n int timeridx = ri->crm & 1;\n\n uint32_t oldval = env->cp15.c14_timer[timeridx].ctl;\n\n\n\n env->cp15.c14_timer[timeridx].ctl = value & 3;\n\n if ((oldval ^ value) & 1) {\n\n /* Enable toggled */\n\n gt_recalc_timer(cpu, timeridx);\n\n } else if ((oldval & value) & 2) {\n\n /* IMASK toggled: don't need to recalculate,\n\n * just set the interrupt line based on ISTATUS\n\n */\n\n qemu_set_irq(cpu->gt_timer_outputs[timeridx],\n\n (oldval & 4) && (value & 2));\n\n }\n\n}\n"}} {"sample_id": "7d1b0095bff7157e856d1d0e6c4295641ced2752_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void shifter_out_im(TCGv var, int shift)\n+\n {\n \n TCGv tmp = new_tmp();\n@@ -7,7 +7,7 @@\n if (shift == 0) {\n \n tcg_gen_andi_i32(tmp, var, 1);\n+\n } else {\n \n tcg_gen_shri_i32(tmp, var, shift);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void shifter_out_im(TCGv var, int shift)\n\n{\n\n TCGv tmp = new_tmp();\n\n if (shift == 0) {\n\n tcg_gen_andi_i32(tmp, var, 1);\n\n } else {\n\n tcg_gen_shri_i32(tmp, var, shift);\n\n if (shift != 31)\n\n tcg_gen_andi_i32(tmp, tmp, 1);\n\n }\n\n gen_set_CF(tmp);\n\n dead_tmp(tmp);\n\n}\n"}} {"sample_id": "f92f4935acd7d974adfd1deebdf1bb06cbe107ca", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static uint32_t add_weights(uint32_t w1, uint32_t w2)\n+\n+{\n \n uint32_t max = (w1 & 0xFF) > (w2 & 0xFF) ? (w1 & 0xFF) : (w2 & 0xFF);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint32_t add_weights(uint32_t w1, uint32_t w2)\n\n{\n\n uint32_t max = (w1 & 0xFF) > (w2 & 0xFF) ? (w1 & 0xFF) : (w2 & 0xFF);\n\n\n\n return ((w1 & 0xFFFFFF00) + (w2 & 0xFFFFFF00)) | (1 + max);\n\n}\n"}} {"sample_id": "24530f3e060c71b6c57c7a70336f08a13a8b0a3d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n {\n \n+ int ret = qcow2_check_refcounts(bs, result, fix);\n \n if (ret < 0) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int qcow2_check(BlockDriverState *bs, BdrvCheckResult *result,\n\n BdrvCheckMode fix)\n\n{\n\n int ret = qcow2_check_refcounts(bs, result, fix);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n\n\n if (fix && result->check_errors == 0 && result->corruptions == 0) {\n\n return qcow2_mark_clean(bs);\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "b3db211f3c80bb996a704d665fe275619f728bd4_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n {\n \n+ double res = 0, value = 3.14;\n+\n+ Visitor *v;\n+\n+\n \n v = visitor_input_test_init(data, \"%f\", value);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_visitor_in_number(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n double res = 0, value = 3.14;\n\n Visitor *v;\n\n\n\n v = visitor_input_test_init(data, \"%f\", value);\n\n\n\n visit_type_number(v, NULL, &res, &error_abort);\n\n g_assert_cmpfloat(res, ==, value);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_84", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n \n \n+ if (ch == STI_TRACE_CONTROL_CHANNEL) {\n+\n+ /* Flush channel value. */\n+\n+ qemu_chr_fe_write(s->chr, (const uint8_t *) \"\\r\", 1);\n \n } else if (ch == STI_TRACE_CONSOLE_CHANNEL || 1) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void omap_sti_fifo_write(void *opaque, target_phys_addr_t addr,\n\n uint64_t value, unsigned size)\n\n{\n\n struct omap_sti_s *s = (struct omap_sti_s *) opaque;\n\n int ch = addr >> 6;\n\n uint8_t byte = value;\n\n\n\n if (size != 1) {\n\n return omap_badwidth_write8(opaque, addr, size);\n\n }\n\n\n\n if (ch == STI_TRACE_CONTROL_CHANNEL) {\n\n /* Flush channel value. */\n\n qemu_chr_fe_write(s->chr, (const uint8_t *) \"\\r\", 1);\n\n } else if (ch == STI_TRACE_CONSOLE_CHANNEL || 1) {\n\n if (value == 0xc0 || value == 0xc3) {\n\n /* Open channel ch. */\n\n } else if (value == 0x00)\n\n qemu_chr_fe_write(s->chr, (const uint8_t *) \"\\n\", 1);\n\n else\n\n qemu_chr_fe_write(s->chr, &byte, 1);\n\n }\n\n}\n"}} {"sample_id": "15fa08f8451babc88d733bd411d4c94976f9d0f8_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n TCGOp *tcg_op_insert_after(TCGContext *s, TCGOp *old_op,\n+\n+ TCGOpcode opc, int nargs)\n+\n+{\n+\n+ int oi = s->gen_next_op_idx;\n+\n+ int prev = old_op - s->gen_op_buf;\n+\n+ int next = old_op->next;\n+\n TCGOp *new_op;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "TCGOp *tcg_op_insert_after(TCGContext *s, TCGOp *old_op,\n\n TCGOpcode opc, int nargs)\n\n{\n\n int oi = s->gen_next_op_idx;\n\n int prev = old_op - s->gen_op_buf;\n\n int next = old_op->next;\n\n TCGOp *new_op;\n\n\n\n tcg_debug_assert(oi < OPC_BUF_SIZE);\n\n s->gen_next_op_idx = oi + 1;\n\n\n\n new_op = &s->gen_op_buf[oi];\n\n *new_op = (TCGOp){\n\n .opc = opc,\n\n .prev = prev,\n\n .next = next\n\n };\n\n s->gen_op_buf[next].prev = oi;\n\n old_op->next = oi;\n\n\n\n return new_op;\n\n}\n"}} {"sample_id": "96b1a8bb55f1aeb72a943d1001841ff8b0687059_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n machine->cpu_model = \"host\";\n \n }\n+\n+\n+\n+ cpu_states = g_malloc0(sizeof(S390CPU *) * max_cpus);\n+\n \n \n for (i = 0; i < max_cpus; i++) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void s390_init_cpus(MachineState *machine)\n\n{\n\n int i;\n\n gchar *name;\n\n\n\n if (machine->cpu_model == NULL) {\n\n machine->cpu_model = \"host\";\n\n }\n\n\n\n cpu_states = g_malloc0(sizeof(S390CPU *) * max_cpus);\n\n\n\n for (i = 0; i < max_cpus; i++) {\n\n name = g_strdup_printf(\"cpu[%i]\", i);\n\n object_property_add_link(OBJECT(machine), name, TYPE_S390_CPU,\n\n (Object **) &cpu_states[i],\n\n object_property_allow_set_link,\n\n OBJ_PROP_LINK_UNREF_ON_RELEASE,\n\n &error_abort);\n\n g_free(name);\n\n }\n\n\n\n for (i = 0; i < smp_cpus; i++) {\n\n cpu_s390x_init(machine->cpu_model);\n\n }\n\n}\n"}} {"sample_id": "c54616608af442edf4cfb7397a1909c2653efba0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n const char *val;\n+\n+\n+\n+ if (token_get_type(obj) != JSON_OPERATOR) {\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int token_is_operator(QObject *obj, char op)\n\n{\n\n const char *val;\n\n\n\n if (token_get_type(obj) != JSON_OPERATOR) {\n\n return 0;\n\n }\n\n\n\n val = token_get_value(obj);\n\n\n\n return (val[0] == op) && (val[1] == 0);\n\n}\n"}} {"sample_id": "fa166538743d4e28de7374c41332c3e448826f4b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n CoroutineIOCompletion co = {\n .coroutine = qemu_coroutine_self(),\n };\n+ acb = bs->drv->bdrv_aio_readv(bs, sector_num, qiov, nb_sectors,\n+ bdrv_co_io_em_complete, &co);\n+ if (acb == NULL) {\n+ return -EIO;\n+ } else {\n qemu_coroutine_yield();\n return co.ret;\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int coroutine_fn bdrv_driver_preadv(BlockDriverState *bs,\n uint64_t offset, uint64_t bytes,\n QEMUIOVector *qiov, int flags)\n{\n BlockDriver *drv = bs->drv;\n int64_t sector_num;\n unsigned int nb_sectors;\n if (drv->bdrv_co_preadv) {\n return drv->bdrv_co_preadv(bs, offset, bytes, qiov, flags);\n }\n sector_num = offset >> BDRV_SECTOR_BITS;\n nb_sectors = bytes >> BDRV_SECTOR_BITS;\n assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);\n assert((bytes & (BDRV_SECTOR_SIZE - 1)) == 0);\n assert((bytes >> BDRV_SECTOR_BITS) <= BDRV_REQUEST_MAX_SECTORS);\n if (drv->bdrv_co_readv) {\n return drv->bdrv_co_readv(bs, sector_num, nb_sectors, qiov);\n } else {\n BlockAIOCB *acb;\n CoroutineIOCompletion co = {\n .coroutine = qemu_coroutine_self(),\n };\n acb = bs->drv->bdrv_aio_readv(bs, sector_num, qiov, nb_sectors,\n bdrv_co_io_em_complete, &co);\n if (acb == NULL) {\n return -EIO;\n } else {\n qemu_coroutine_yield();\n return co.ret;\n }\n }\n}"}} {"sample_id": "70143a3954e1c4412efb2bf1a3a818adea2d3abf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -54,11 +54,11 @@\n \n #endif\n \n+#if CONFIG_HEVC_VAAPI_HWACCEL\n+\n+ *fmt++ = AV_PIX_FMT_VAAPI;\n+\n+#endif\n \n break;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static enum AVPixelFormat get_format(HEVCContext *s, const HEVCSPS *sps)\n\n{\n\n #define HWACCEL_MAX (CONFIG_HEVC_DXVA2_HWACCEL + CONFIG_HEVC_D3D11VA_HWACCEL + CONFIG_HEVC_VAAPI_HWACCEL + CONFIG_HEVC_VDPAU_HWACCEL)\n\n enum AVPixelFormat pix_fmts[HWACCEL_MAX + 2], *fmt = pix_fmts;\n\n\n\n switch (sps->pix_fmt) {\n\n case AV_PIX_FMT_YUV420P:\n\n case AV_PIX_FMT_YUVJ420P:\n\n#if CONFIG_HEVC_DXVA2_HWACCEL\n\n *fmt++ = AV_PIX_FMT_DXVA2_VLD;\n\n#endif\n\n#if CONFIG_HEVC_D3D11VA_HWACCEL\n\n *fmt++ = AV_PIX_FMT_D3D11VA_VLD;\n\n#endif\n\n#if CONFIG_HEVC_VAAPI_HWACCEL\n\n *fmt++ = AV_PIX_FMT_VAAPI;\n\n#endif\n\n#if CONFIG_HEVC_VDPAU_HWACCEL\n\n *fmt++ = AV_PIX_FMT_VDPAU;\n\n#endif\n\n break;\n\n case AV_PIX_FMT_YUV420P10:\n\n#if CONFIG_HEVC_DXVA2_HWACCEL\n\n *fmt++ = AV_PIX_FMT_DXVA2_VLD;\n\n#endif\n\n#if CONFIG_HEVC_D3D11VA_HWACCEL\n\n *fmt++ = AV_PIX_FMT_D3D11VA_VLD;\n\n#endif\n\n#if CONFIG_HEVC_VAAPI_HWACCEL\n\n *fmt++ = AV_PIX_FMT_VAAPI;\n\n#endif\n\n break;\n\n }\n\n\n\n *fmt++ = sps->pix_fmt;\n\n *fmt = AV_PIX_FMT_NONE;\n\n\n\n return ff_thread_get_format(s->avctx, pix_fmts);\n\n}\n"}} {"sample_id": "f897bf751fbd95e4015b95d202c706548586813a_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static VirtIOBlockReq *virtio_blk_get_request(VirtIOBlock *s)\n \n+{\n \n VirtIOBlockReq *req = virtio_blk_alloc_request(s);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static VirtIOBlockReq *virtio_blk_get_request(VirtIOBlock *s)\n\n{\n\n VirtIOBlockReq *req = virtio_blk_alloc_request(s);\n\n\n\n if (!virtqueue_pop(s->vq, req->elem)) {\n\n virtio_blk_free_request(req);\n\n return NULL;\n\n }\n\n\n\n return req;\n\n}\n"}} {"sample_id": "f3c7d0389fe8a2792fd4c1cf151b885de03c8f62_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ qemu_irq *s = g_malloc0(2 * sizeof(qemu_irq));\n \n s[0] = irq1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2)\n\n{\n\n qemu_irq *s = g_malloc0(2 * sizeof(qemu_irq));\n\n s[0] = irq1;\n\n s[1] = irq2;\n\n return qemu_allocate_irqs(qemu_splitirq, s, 1)[0];\n\n}\n"}} {"sample_id": "4c315c27661502a0813b129e41c0bf640c34a8d6_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ DeviceClass *dc = DEVICE_CLASS(oc);\n+\n+ X86CPUClass *xcc = X86_CPU_CLASS(oc);\n+\n+ uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void host_x86_cpu_class_init(ObjectClass *oc, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(oc);\n\n X86CPUClass *xcc = X86_CPU_CLASS(oc);\n\n uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;\n\n\n\n xcc->kvm_required = true;\n\n\n\n host_cpuid(0x0, 0, &eax, &ebx, &ecx, &edx);\n\n x86_cpu_vendor_words2str(host_cpudef.vendor, ebx, edx, ecx);\n\n\n\n host_cpuid(0x1, 0, &eax, &ebx, &ecx, &edx);\n\n host_cpudef.family = ((eax >> 8) & 0x0F) + ((eax >> 20) & 0xFF);\n\n host_cpudef.model = ((eax >> 4) & 0x0F) | ((eax & 0xF0000) >> 12);\n\n host_cpudef.stepping = eax & 0x0F;\n\n\n\n cpu_x86_fill_model_id(host_cpudef.model_id);\n\n\n\n xcc->cpu_def = &host_cpudef;\n\n host_cpudef.cache_info_passthrough = true;\n\n\n\n /* level, xlevel, xlevel2, and the feature words are initialized on\n\n * instance_init, because they require KVM to be initialized.\n\n */\n\n\n\n dc->props = host_x86_cpu_properties;\n\n\n\n}"}} {"sample_id": "42a268c241183877192c376d03bd9b6d527407c7_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n gen_set_label(l1);\n \n+ tcg_gen_sari_tl(cpu_gpr[rA(ctx->opcode)], cpu_gpr[rS(ctx->opcode)], sh);\n+\n+ tcg_temp_free(t0);\n+\n+ tcg_temp_free(t1);\n \n if (unlikely(Rc(ctx->opcode) != 0))\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gen_sraiq(DisasContext *ctx)\n\n{\n\n int sh = SH(ctx->opcode);\n\n int l1 = gen_new_label();\n\n TCGv t0 = tcg_temp_new();\n\n TCGv t1 = tcg_temp_new();\n\n tcg_gen_shri_tl(t0, cpu_gpr[rS(ctx->opcode)], sh);\n\n tcg_gen_shli_tl(t1, cpu_gpr[rS(ctx->opcode)], 32 - sh);\n\n tcg_gen_or_tl(t0, t0, t1);\n\n gen_store_spr(SPR_MQ, t0);\n\n tcg_gen_movi_tl(cpu_ca, 0);\n\n tcg_gen_brcondi_tl(TCG_COND_EQ, t1, 0, l1);\n\n tcg_gen_brcondi_tl(TCG_COND_GE, cpu_gpr[rS(ctx->opcode)], 0, l1);\n\n tcg_gen_movi_tl(cpu_ca, 1);\n\n gen_set_label(l1);\n\n tcg_gen_sari_tl(cpu_gpr[rA(ctx->opcode)], cpu_gpr[rS(ctx->opcode)], sh);\n\n tcg_temp_free(t0);\n\n tcg_temp_free(t1);\n\n if (unlikely(Rc(ctx->opcode) != 0))\n\n gen_set_Rc0(ctx, cpu_gpr[rA(ctx->opcode)]);\n\n}\n"}} {"sample_id": "523a59f596a3e62f5a28eb171adba35e71310040_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static void pci_bridge_cleanup_alias(MemoryRegion *alias,\n+\n+ MemoryRegion *parent_space)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void pci_bridge_cleanup_alias(MemoryRegion *alias,\n\n MemoryRegion *parent_space)\n\n{\n\n memory_region_del_subregion(parent_space, alias);\n\n memory_region_destroy(alias);\n\n}\n"}} {"sample_id": "4fa4ce7107c6ec432f185307158c5df91ce54308_17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n return -1;\n \n \n+\n+ }\n+\n+ if (dir_path) {\n+\n dirfd = open_by_handle(data->mountfd, dir_path->data, O_PATH);\n \n } else {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int handle_name_to_path(FsContext *ctx, V9fsPath *dir_path,\n\n const char *name, V9fsPath *target)\n\n{\n\n char buffer[PATH_MAX];\n\n struct file_handle *fh;\n\n int dirfd, ret, mnt_id;\n\n struct handle_data *data = (struct handle_data *)ctx->private;\n\n\n\n /* \".\" and \"..\" are not allowed */\n\n if (!strcmp(name, \".\") || !strcmp(name, \"..\")) {\n\n errno = EINVAL;\n\n return -1;\n\n\n\n }\n\n if (dir_path) {\n\n dirfd = open_by_handle(data->mountfd, dir_path->data, O_PATH);\n\n } else {\n\n /* relative to export root */\n\n dirfd = open(rpath(ctx, \".\", buffer), O_DIRECTORY);\n\n }\n\n if (dirfd < 0) {\n\n return dirfd;\n\n }\n\n fh = g_malloc(sizeof(struct file_handle) + data->handle_bytes);\n\n fh->handle_bytes = data->handle_bytes;\n\n /* add a \"./\" at the beginning of the path */\n\n snprintf(buffer, PATH_MAX, \"./%s\", name);\n\n /* flag = 0 imply don't follow symlink */\n\n ret = name_to_handle(dirfd, buffer, fh, &mnt_id, 0);\n\n if (!ret) {\n\n target->data = (char *)fh;\n\n target->size = sizeof(struct file_handle) + data->handle_bytes;\n\n } else {\n\n g_free(fh);\n\n }\n\n close(dirfd);\n\n return ret;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_87", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n case 0: /* CP_IDFIELD */\n \n return 0x41034003;\n+\n+ case 1: /* CP_FLASHPROG */\n+\n+ return 0;\n+\n case 2: /* CP_INTREG */\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t icp_control_read(void *opaque, target_phys_addr_t offset,\n\n unsigned size)\n\n{\n\n switch (offset >> 2) {\n\n case 0: /* CP_IDFIELD */\n\n return 0x41034003;\n\n case 1: /* CP_FLASHPROG */\n\n return 0;\n\n case 2: /* CP_INTREG */\n\n return 0;\n\n case 3: /* CP_DECODE */\n\n return 0x11;\n\n default:\n\n hw_error(\"icp_control_read: Bad offset %x\\n\", (int)offset);\n\n return 0;\n\n }\n\n}\n"}} {"sample_id": "ebe52b592dd5867fce7238f49b8c0416c3eedb6c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n MonFdsetFd *mon_fdset_fd;\n+\n+ MonFdsetFd *mon_fdset_fd_next;\n+\n+\n+\n QLIST_FOREACH_SAFE(mon_fdset_fd, &mon_fdset->fds, next, mon_fdset_fd_next) {\n \n if (mon_fdset_fd->removed ||", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void monitor_fdset_cleanup(MonFdset *mon_fdset)\n\n{\n\n MonFdsetFd *mon_fdset_fd;\n\n MonFdsetFd *mon_fdset_fd_next;\n\n\n\n QLIST_FOREACH_SAFE(mon_fdset_fd, &mon_fdset->fds, next, mon_fdset_fd_next) {\n\n if (mon_fdset_fd->removed ||\n\n (QLIST_EMPTY(&mon_fdset->dup_fds) && mon_refcount == 0)) {\n\n close(mon_fdset_fd->fd);\n\n g_free(mon_fdset_fd->opaque);\n\n QLIST_REMOVE(mon_fdset_fd, next);\n\n g_free(mon_fdset_fd);\n\n }\n\n }\n\n\n\n if (QLIST_EMPTY(&mon_fdset->fds) && QLIST_EMPTY(&mon_fdset->dup_fds)) {\n\n QLIST_REMOVE(mon_fdset, next);\n\n g_free(mon_fdset);\n\n }\n\n}\n"}} {"sample_id": "8be7e7e4c72c048b90e3482557954a24bba43ba7_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n int inet_connect(const char *str, bool block, Error **errp)\n \n {\n+\n QemuOpts *opts;\n \n int sock = -1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int inet_connect(const char *str, bool block, Error **errp)\n\n{\n\n QemuOpts *opts;\n\n int sock = -1;\n\n\n\n opts = qemu_opts_create(&dummy_opts, NULL, 0);\n\n if (inet_parse(opts, str) == 0) {\n\n if (block) {\n\n qemu_opt_set(opts, \"block\", \"on\");\n\n }\n\n sock = inet_connect_opts(opts, errp);\n\n } else {\n\n error_set(errp, QERR_SOCKET_CREATE_FAILED);\n\n }\n\n qemu_opts_del(opts);\n\n return sock;\n\n}\n"}} {"sample_id": "544a3731591f5d53e15f22de00ce5ac758d490b3_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,7 +15,7 @@\n v->visitor.end_struct = qapi_dealloc_end_struct;\n \n v->visitor.start_implicit_struct = qapi_dealloc_start_implicit_struct;\n+\n v->visitor.end_implicit_struct = qapi_dealloc_end_implicit_struct;\n \n v->visitor.start_list = qapi_dealloc_start_list;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "QapiDeallocVisitor *qapi_dealloc_visitor_new(void)\n\n{\n\n QapiDeallocVisitor *v;\n\n\n\n v = g_malloc0(sizeof(*v));\n\n\n\n v->visitor.start_struct = qapi_dealloc_start_struct;\n\n v->visitor.end_struct = qapi_dealloc_end_struct;\n\n v->visitor.start_implicit_struct = qapi_dealloc_start_implicit_struct;\n\n v->visitor.end_implicit_struct = qapi_dealloc_end_implicit_struct;\n\n v->visitor.start_list = qapi_dealloc_start_list;\n\n v->visitor.next_list = qapi_dealloc_next_list;\n\n v->visitor.end_list = qapi_dealloc_end_list;\n\n v->visitor.type_enum = qapi_dealloc_type_enum;\n\n v->visitor.type_int64 = qapi_dealloc_type_int64;\n\n v->visitor.type_uint64 = qapi_dealloc_type_uint64;\n\n v->visitor.type_bool = qapi_dealloc_type_bool;\n\n v->visitor.type_str = qapi_dealloc_type_str;\n\n v->visitor.type_number = qapi_dealloc_type_number;\n\n v->visitor.type_any = qapi_dealloc_type_anything;\n\n v->visitor.start_union = qapi_dealloc_start_union;\n\n\n\n QTAILQ_INIT(&v->stack);\n\n\n\n return v;\n\n}\n"}} {"sample_id": "5543d1abb6e218a9d3b8887b777fd3947c86c4cf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,9 +12,9 @@\n num_irq, GIC_MAXIRQ);\n /* ITLinesNumber is represented as (N / 32) - 1 (see\n * gic_dist_readb) so this is an implementation imposed\n+ * restriction, not an architectural one:\n+ */\n+ if (s->num_irq < 32 || (s->num_irq % 32)) {\n+ error_setg(errp,\n+ \"%d interrupt lines unsupported: not divisible by 32\",\n num_irq);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void arm_gic_common_realize(DeviceState *dev, Error **errp)\n{\n GICState *s = ARM_GIC_COMMON(dev);\n int num_irq = s->num_irq;\n if (s->num_cpu > GIC_NCPU) {\n error_setg(errp, \"requested %u CPUs exceeds GIC maximum %d\",\n s->num_cpu, GIC_NCPU);\n s->num_irq += GIC_BASE_IRQ;\n if (s->num_irq > GIC_MAXIRQ) {\n error_setg(errp,\n \"requested %u interrupt lines exceeds GIC maximum %d\",\n num_irq, GIC_MAXIRQ);\n /* ITLinesNumber is represented as (N / 32) - 1 (see\n * gic_dist_readb) so this is an implementation imposed\n * restriction, not an architectural one:\n */\n if (s->num_irq < 32 || (s->num_irq % 32)) {\n error_setg(errp,\n \"%d interrupt lines unsupported: not divisible by 32\",\n num_irq);"}} {"sample_id": "1760048a5d21bacf0e4838da2f61b2d8db7d2866_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static QPCIDevice *get_device(void)\n \n+{\n+\n QPCIDevice *dev;\n \n QPCIBus *pcibus;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static QPCIDevice *get_device(void)\n\n{\n\n QPCIDevice *dev;\n\n QPCIBus *pcibus;\n\n\n\n pcibus = qpci_init_pc();\n\n dev = NULL;\n\n qpci_device_foreach(pcibus, 0x1af4, 0x1110, save_fn, &dev);\n\n g_assert(dev != NULL);\n\n\n\n return dev;\n\n}\n"}} {"sample_id": "7e84c2498f0ff3999937d18d1e9abaa030400000", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ sc->base = get_seg_base(e1, e2);\n+\n sc->limit = get_seg_limit(e1, e2);\n \n sc->flags = e2;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void load_seg_cache_raw_dt(SegmentCache *sc, uint32_t e1, uint32_t e2)\n\n{\n\n sc->base = get_seg_base(e1, e2);\n\n sc->limit = get_seg_limit(e1, e2);\n\n sc->flags = e2;\n\n}\n"}} {"sample_id": "fdfab37dfeffefbd4533b4158055c9b82d7c3e69_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n \n \n assert(wanted_type == QCOW2_CLUSTER_ZERO ||\n+\n+ wanted_type == QCOW2_CLUSTER_UNALLOCATED);\n+\n+ for (i = 0; i < nb_clusters; i++) {\n+\n uint64_t entry = be64_to_cpu(l2_table[i]);\n \n QCow2ClusterType type = qcow2_get_cluster_type(entry);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int count_contiguous_clusters_unallocated(int nb_clusters,\n\n uint64_t *l2_table,\n\n QCow2ClusterType wanted_type)\n\n{\n\n int i;\n\n\n\n assert(wanted_type == QCOW2_CLUSTER_ZERO ||\n\n wanted_type == QCOW2_CLUSTER_UNALLOCATED);\n\n for (i = 0; i < nb_clusters; i++) {\n\n uint64_t entry = be64_to_cpu(l2_table[i]);\n\n QCow2ClusterType type = qcow2_get_cluster_type(entry);\n\n\n\n if (type != wanted_type || entry & L2E_OFFSET_MASK) {\n\n break;\n\n }\n\n }\n\n\n\n return i;\n\n}\n"}} {"sample_id": "eabb7b91b36b202b4dac2df2d59d698e3aff197a_31", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n bool rhs_is_const)\n \n {\n+\n+ /* Emit either the reg,imm or reg,reg form of a data-processing insn.\n+\n+ * rhs must satisfy the \"rIN\" constraint.\n+\n */\n \n if (rhs_is_const) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void tcg_out_dat_rIN(TCGContext *s, int cond, int opc, int opneg,\n\n TCGArg dst, TCGArg lhs, TCGArg rhs,\n\n bool rhs_is_const)\n\n{\n\n /* Emit either the reg,imm or reg,reg form of a data-processing insn.\n\n * rhs must satisfy the \"rIN\" constraint.\n\n */\n\n if (rhs_is_const) {\n\n int rot = encode_imm(rhs);\n\n if (rot < 0) {\n\n rhs = -rhs;\n\n rot = encode_imm(rhs);\n\n assert(rot >= 0);\n\n opc = opneg;\n\n }\n\n tcg_out_dat_imm(s, cond, opc, dst, lhs, rotl(rhs, rot) | (rot << 7));\n\n } else {\n\n tcg_out_dat_reg(s, cond, opc, dst, lhs, rhs, SHIFT_IMM_LSL(0));\n\n }\n\n}\n"}} {"sample_id": "6acbe4c6f18e7de00481ff30574262b58526de45_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n k->init = lsi_scsi_init;\n \n k->exit = lsi_scsi_uninit;\n+\n+ k->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;\n+\n+ k->device_id = PCI_DEVICE_ID_LSI_53C895A;\n+\n k->class_id = PCI_CLASS_STORAGE_SCSI;\n \n k->subsystem_id = 0x1000;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void lsi_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);\n\n\n\n k->init = lsi_scsi_init;\n\n k->exit = lsi_scsi_uninit;\n\n k->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;\n\n k->device_id = PCI_DEVICE_ID_LSI_53C895A;\n\n k->class_id = PCI_CLASS_STORAGE_SCSI;\n\n k->subsystem_id = 0x1000;\n\n dc->alias = \"lsi\";\n\n dc->reset = lsi_scsi_reset;\n\n dc->vmsd = &vmstate_lsi_scsi;\n\n}\n"}} {"sample_id": "fc19f8a02e45c4d8ad24dd7eb374330b03dfc28e_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int nbd_co_discard(BlockDriverState *bs, int64_t sector_num,\n \n+ int nb_sectors)\n+\n+{\n+\n+ BDRVNBDState *s = bs->opaque;\n \n struct nbd_request request;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int nbd_co_discard(BlockDriverState *bs, int64_t sector_num,\n\n int nb_sectors)\n\n{\n\n BDRVNBDState *s = bs->opaque;\n\n struct nbd_request request;\n\n struct nbd_reply reply;\n\n\n\n if (!(s->nbdflags & NBD_FLAG_SEND_TRIM)) {\n\n return 0;\n\n }\n\n request.type = NBD_CMD_TRIM;\n\n request.from = sector_num * 512;;\n\n request.len = nb_sectors * 512;\n\n\n\n nbd_coroutine_start(s, &request);\n\n if (nbd_co_send_request(s, &request, NULL, 0) == -1) {\n\n reply.error = errno;\n\n } else {\n\n nbd_co_receive_reply(s, &request, &reply, NULL, 0);\n\n }\n\n nbd_coroutine_end(s, &request);\n\n return -reply.error;\n\n}\n"}} {"sample_id": "c23acbaed40101c677dfcfbbfe0d2c230a8e8f44_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void add_pixels_clamped2_c(const DCTELEM *block, uint8_t *restrict pixels,\n \n+ int line_size)\n \n+{\n+\n int i;\n \n uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void add_pixels_clamped2_c(const DCTELEM *block, uint8_t *restrict pixels,\n\n int line_size)\n\n{\n\n int i;\n\n uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;\n\n\n\n /* read the pixels */\n\n for(i=0;i<2;i++) {\n\n pixels[0] = cm[pixels[0] + block[0]];\n\n pixels[1] = cm[pixels[1] + block[1]];\n\n pixels += line_size;\n\n block += 8;\n\n }\n\n}\n"}} {"sample_id": "3456a8d1852e970688b73d03fdc44dde851759e1_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n int flags = s->flags;\n AES_KEY aes_encrypt_key;\n AES_KEY aes_decrypt_key;\n+ uint32_t crypt_method = 0;\n+ QDict *options;\n+ /*\n+ * Backing files are read-only which makes all of their metadata immutable,\n+ * that means we don't have to worry about reopening them here.\n */\n if (s->crypt_method) {\n crypt_method = s->crypt_method;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void qcow2_invalidate_cache(BlockDriverState *bs)\n{\n BDRVQcowState *s = bs->opaque;\n int flags = s->flags;\n AES_KEY aes_encrypt_key;\n AES_KEY aes_decrypt_key;\n uint32_t crypt_method = 0;\n QDict *options;\n /*\n * Backing files are read-only which makes all of their metadata immutable,\n * that means we don't have to worry about reopening them here.\n */\n if (s->crypt_method) {\n crypt_method = s->crypt_method;\n memcpy(&aes_encrypt_key, &s->aes_encrypt_key, sizeof(aes_encrypt_key));\n memcpy(&aes_decrypt_key, &s->aes_decrypt_key, sizeof(aes_decrypt_key));\n }\n qcow2_close(bs);\n options = qdict_new();\n qdict_put(options, QCOW2_OPT_LAZY_REFCOUNTS,\n qbool_from_int(s->use_lazy_refcounts));\n memset(s, 0, sizeof(BDRVQcowState));\n qcow2_open(bs, options, flags, NULL);\n QDECREF(options);\n if (crypt_method) {\n s->crypt_method = crypt_method;\n memcpy(&s->aes_encrypt_key, &aes_encrypt_key, sizeof(aes_encrypt_key));\n memcpy(&s->aes_decrypt_key, &aes_decrypt_key, sizeof(aes_decrypt_key));\n }\n}"}} {"sample_id": "15c2f669e3fb2bc97f7b42d1871f595c0ac24af8_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n QmpInputVisitor *v;\n+\n \n \n+ v = g_malloc0(sizeof(*v));\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "QmpInputVisitor *qmp_input_visitor_new(QObject *obj, bool strict)\n\n{\n\n QmpInputVisitor *v;\n\n\n\n v = g_malloc0(sizeof(*v));\n\n\n\n v->visitor.type = VISITOR_INPUT;\n\n v->visitor.start_struct = qmp_input_start_struct;\n\n v->visitor.end_struct = qmp_input_end_struct;\n\n v->visitor.start_list = qmp_input_start_list;\n\n v->visitor.next_list = qmp_input_next_list;\n\n v->visitor.end_list = qmp_input_end_list;\n\n v->visitor.start_alternate = qmp_input_start_alternate;\n\n v->visitor.type_int64 = qmp_input_type_int64;\n\n v->visitor.type_uint64 = qmp_input_type_uint64;\n\n v->visitor.type_bool = qmp_input_type_bool;\n\n v->visitor.type_str = qmp_input_type_str;\n\n v->visitor.type_number = qmp_input_type_number;\n\n v->visitor.type_any = qmp_input_type_any;\n\n v->visitor.type_null = qmp_input_type_null;\n\n v->visitor.optional = qmp_input_optional;\n\n v->strict = strict;\n\n\n\n v->root = obj;\n\n qobject_incref(obj);\n\n\n\n return v;\n\n}\n"}} {"sample_id": "d3f8d37fe2d0c24ec8bac9c94d5b0e2dc09c0d2a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+int kvm_log_stop(target_phys_addr_t phys_addr, target_phys_addr_t end_addr)\n+\n {\n \n return kvm_dirty_pages_log_change(phys_addr, end_addr,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "int kvm_log_stop(target_phys_addr_t phys_addr, target_phys_addr_t end_addr)\n\n{\n\n return kvm_dirty_pages_log_change(phys_addr, end_addr,\n\n 0,\n\n KVM_MEM_LOG_DIRTY_PAGES);\n\n}\n"}} {"sample_id": "a0c624e299730c8c5800375c2f5f3c6c200053ff", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,16 +1,16 @@\n int ff_v4l2_m2m_codec_end(AVCodecContext *avctx)\n+\n {\n \n V4L2m2mContext* s = avctx->priv_data;\n \n int ret;\n \n+\n+\n+ ret = ff_v4l2_context_set_status(&s->output, VIDIOC_STREAMOFF);\n+\n+ if (ret)\n \n av_log(avctx, AV_LOG_ERROR, \"VIDIOC_STREAMOFF %s\\n\", s->output.name);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int ff_v4l2_m2m_codec_end(AVCodecContext *avctx)\n\n{\n\n V4L2m2mContext* s = avctx->priv_data;\n\n int ret;\n\n\n\n ret = ff_v4l2_context_set_status(&s->output, VIDIOC_STREAMOFF);\n\n if (ret)\n\n av_log(avctx, AV_LOG_ERROR, \"VIDIOC_STREAMOFF %s\\n\", s->output.name);\n\n\n\n ret = ff_v4l2_context_set_status(&s->capture, VIDIOC_STREAMOFF);\n\n if (ret)\n\n av_log(avctx, AV_LOG_ERROR, \"VIDIOC_STREAMOFF %s\\n\", s->capture.name);\n\n\n\n ff_v4l2_context_release(&s->output);\n\n\n\n if (atomic_load(&s->refcount))\n\n av_log(avctx, AV_LOG_ERROR, \"ff_v4l2m2m_codec_end leaving pending buffers\\n\");\n\n\n\n ff_v4l2_context_release(&s->capture);\n\n sem_destroy(&s->refsync);\n\n\n\n /* release the hardware */\n\n if (close(s->fd) < 0 )\n\n av_log(avctx, AV_LOG_ERROR, \"failure closing %s (%s)\\n\", s->devname, av_err2str(AVERROR(errno)));\n\n\n\n s->fd = -1;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a8fb542705ac7e0dcf00908bc47bf49cdd058abe_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void tcp_chr_connect(void *opaque)\n \n {\n+\n CharDriverState *chr = opaque;\n+\n TCPCharDriver *s = chr->opaque;\n \n QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(s->ioc);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void tcp_chr_connect(void *opaque)\n\n{\n\n CharDriverState *chr = opaque;\n\n TCPCharDriver *s = chr->opaque;\n\n QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(s->ioc);\n\n\n\n g_free(chr->filename);\n\n chr->filename = sockaddr_to_str(&sioc->localAddr, sioc->localAddrLen,\n\n &sioc->remoteAddr, sioc->remoteAddrLen,\n\n s->is_listen, s->is_telnet);\n\n\n\n s->connected = 1;\n\n if (s->ioc) {\n\n chr->fd_in_tag = io_add_watch_poll(s->ioc,\n\n tcp_chr_read_poll,\n\n tcp_chr_read, chr);\n\n }\n\n qemu_chr_be_generic_open(chr);\n\n}\n"}} {"sample_id": "eb69b50ad9806c4a3b5900392a5acc9837cffd18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void wm8750_audio_out_cb(void *opaque, int free_b)\n \n+{\n \n struct wm8750_s *s = (struct wm8750_s *) opaque;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void wm8750_audio_out_cb(void *opaque, int free_b)\n\n{\n\n struct wm8750_s *s = (struct wm8750_s *) opaque;\n\n wm8750_out_flush(s);\n\n\n\n s->req_out = free_b;\n\n s->data_req(s->opaque, free_b >> 2, s->req_in >> 2);\n\n}\n"}} {"sample_id": "cd0c6f473532bfaf20a095bc90a18e45162981b5_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n /* XXX: beware: this is false if VLE is supported */\n env->nip = nip & ~((target_ulong)0x00000003);\n hreg_store_msr(env, msr, 1);\n+#if defined(DEBUG_OP)\n+ cpu_dump_rfi(env->nip, env->msr);\n+#endif\n+ /* No need to raise an exception here,\n+ * as rfi is always the last insn of a TB\n */\n cs->interrupt_request |= CPU_INTERRUPT_EXITTB;\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void do_rfi(CPUPPCState *env, target_ulong nip, target_ulong msr,\n target_ulong msrm, int keep_msrh)\n{\n CPUState *cs = CPU(ppc_env_get_cpu(env));\n#if defined(TARGET_PPC64)\n if (msr_is_64bit(env, msr)) {\n nip = (uint64_t)nip;\n msr &= (uint64_t)msrm;\n } else {\n nip = (uint32_t)nip;\n msr = (uint32_t)(msr & msrm);\n if (keep_msrh) {\n msr |= env->msr & ~((uint64_t)0xFFFFFFFF);\n }\n }\n#else\n nip = (uint32_t)nip;\n msr &= (uint32_t)msrm;\n#endif\n /* XXX: beware: this is false if VLE is supported */\n env->nip = nip & ~((target_ulong)0x00000003);\n hreg_store_msr(env, msr, 1);\n#if defined(DEBUG_OP)\n cpu_dump_rfi(env->nip, env->msr);\n#endif\n /* No need to raise an exception here,\n * as rfi is always the last insn of a TB\n */\n cs->interrupt_request |= CPU_INTERRUPT_EXITTB;\n}"}} {"sample_id": "1c275925bfbbc2de84a8f0e09d1dd70bbefb6da3_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -66,11 +66,11 @@\n \n sigsegv:\n \n+ unlock_user_struct(sr, sr_addr, 1);\n+\n+ unlock_user_struct(sc, sc_addr, 1);\n+\n+ qemu_log(\"segfaulting from do_sigreturn\\n\");\n \n force_sig(TARGET_SIGSEGV);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "long do_sigreturn(CPUPPCState *env)\n\n{\n\n struct target_sigcontext *sc = NULL;\n\n struct target_mcontext *sr = NULL;\n\n target_ulong sr_addr = 0, sc_addr;\n\n sigset_t blocked;\n\n target_sigset_t set;\n\n\n\n sc_addr = env->gpr[1] + SIGNAL_FRAMESIZE;\n\n if (!lock_user_struct(VERIFY_READ, sc, sc_addr, 1))\n\n goto sigsegv;\n\n\n\n#if defined(TARGET_PPC64)\n\n set.sig[0] = sc->oldmask + ((long)(sc->_unused[3]) << 32);\n\n#else\n\n if(__get_user(set.sig[0], &sc->oldmask) ||\n\n __get_user(set.sig[1], &sc->_unused[3]))\n\n goto sigsegv;\n\n#endif\n\n target_to_host_sigset_internal(&blocked, &set);\n\n sigprocmask(SIG_SETMASK, &blocked, NULL);\n\n\n\n if (__get_user(sr_addr, &sc->regs))\n\n goto sigsegv;\n\n if (!lock_user_struct(VERIFY_READ, sr, sr_addr, 1))\n\n goto sigsegv;\n\n if (restore_user_regs(env, sr, 1))\n\n goto sigsegv;\n\n\n\n unlock_user_struct(sr, sr_addr, 1);\n\n unlock_user_struct(sc, sc_addr, 1);\n\n return -TARGET_QEMU_ESIGRETURN;\n\n\n\nsigsegv:\n\n unlock_user_struct(sr, sr_addr, 1);\n\n unlock_user_struct(sc, sc_addr, 1);\n\n qemu_log(\"segfaulting from do_sigreturn\\n\");\n\n force_sig(TARGET_SIGSEGV);\n\n return 0;\n\n}\n"}} {"sample_id": "ef0d779706c77ca9007527bd8d41e9400682f4e4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n int idx = ogg->nstreams++;\n \n+ AVStream *st;\n \n struct ogg_stream *os;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int ogg_new_stream(AVFormatContext *s, uint32_t serial, int new_avstream)\n\n{\n\n\n\n struct ogg *ogg = s->priv_data;\n\n int idx = ogg->nstreams++;\n\n AVStream *st;\n\n struct ogg_stream *os;\n\n\n\n ogg->streams = av_realloc (ogg->streams,\n\n ogg->nstreams * sizeof (*ogg->streams));\n\n memset (ogg->streams + idx, 0, sizeof (*ogg->streams));\n\n os = ogg->streams + idx;\n\n os->serial = serial;\n\n os->bufsize = DECODER_BUFFER_SIZE;\n\n os->buf = av_malloc(os->bufsize);\n\n os->header = -1;\n\n\n\n if (new_avstream) {\n\n st = avformat_new_stream(s, NULL);\n\n if (!st)\n\n return AVERROR(ENOMEM);\n\n\n\n st->id = idx;\n\n avpriv_set_pts_info(st, 64, 1, 1000000);\n\n }\n\n\n\n return idx;\n\n}\n"}} {"sample_id": "5a8fec1b33f2c9da89fe565516fff24b09988dc9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void imdct12(INTFLOAT *out, INTFLOAT *in)\n+\n {\n \n INTFLOAT in0, in1, in2, in3, in4, in5, t1, t2;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void imdct12(INTFLOAT *out, INTFLOAT *in)\n\n{\n\n INTFLOAT in0, in1, in2, in3, in4, in5, t1, t2;\n\n\n\n in0 = in[0*3];\n\n in1 = in[1*3] + in[0*3];\n\n in2 = in[2*3] + in[1*3];\n\n in3 = in[3*3] + in[2*3];\n\n in4 = in[4*3] + in[3*3];\n\n in5 = in[5*3] + in[4*3];\n\n in5 += in3;\n\n in3 += in1;\n\n\n\n in2 = MULH3(in2, C3, 2);\n\n in3 = MULH3(in3, C3, 4);\n\n\n\n t1 = in0 - in4;\n\n t2 = MULH3(in1 - in5, C4, 2);\n\n\n\n out[ 7] =\n\n out[10] = t1 + t2;\n\n out[ 1] =\n\n out[ 4] = t1 - t2;\n\n\n\n in0 += SHR(in4, 1);\n\n in4 = in0 + in2;\n\n in5 += 2*in1;\n\n in1 = MULH3(in5 + in3, C5, 1);\n\n out[ 8] =\n\n out[ 9] = in4 + in1;\n\n out[ 2] =\n\n out[ 3] = in4 - in1;\n\n\n\n in0 -= in2;\n\n in5 = MULH3(in5 - in3, C6, 2);\n\n out[ 0] =\n\n out[ 5] = in0 - in5;\n\n out[ 6] =\n\n out[11] = in0 + in5;\n\n}\n"}} {"sample_id": "ac4b32df71bd932838043a4838b86d11e169707f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+av_cold void ff_vp8dsp_init_ppc(VP8DSPContext *c)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "av_cold void ff_vp8dsp_init_ppc(VP8DSPContext *c)\n\n{\n\n#if HAVE_ALTIVEC\n\n if (!(av_get_cpu_flags() & AV_CPU_FLAG_ALTIVEC))\n\n return;\n\n\n\n c->put_vp8_epel_pixels_tab[0][0][0] = put_vp8_pixels16_altivec;\n\n c->put_vp8_epel_pixels_tab[0][0][2] = put_vp8_epel16_h6_altivec;\n\n c->put_vp8_epel_pixels_tab[0][2][0] = put_vp8_epel16_v6_altivec;\n\n c->put_vp8_epel_pixels_tab[0][2][2] = put_vp8_epel16_h6v6_altivec;\n\n\n\n c->put_vp8_epel_pixels_tab[1][0][2] = put_vp8_epel8_h6_altivec;\n\n c->put_vp8_epel_pixels_tab[1][2][0] = put_vp8_epel8_v6_altivec;\n\n c->put_vp8_epel_pixels_tab[1][0][1] = put_vp8_epel8_h4_altivec;\n\n c->put_vp8_epel_pixels_tab[1][1][0] = put_vp8_epel8_v4_altivec;\n\n\n\n c->put_vp8_epel_pixels_tab[1][2][2] = put_vp8_epel8_h6v6_altivec;\n\n c->put_vp8_epel_pixels_tab[1][1][1] = put_vp8_epel8_h4v4_altivec;\n\n c->put_vp8_epel_pixels_tab[1][1][2] = put_vp8_epel8_h6v4_altivec;\n\n c->put_vp8_epel_pixels_tab[1][2][1] = put_vp8_epel8_h4v6_altivec;\n\n\n\n c->put_vp8_epel_pixels_tab[2][0][2] = put_vp8_epel4_h6_altivec;\n\n c->put_vp8_epel_pixels_tab[2][2][0] = put_vp8_epel4_v6_altivec;\n\n c->put_vp8_epel_pixels_tab[2][0][1] = put_vp8_epel4_h4_altivec;\n\n c->put_vp8_epel_pixels_tab[2][1][0] = put_vp8_epel4_v4_altivec;\n\n\n\n c->put_vp8_epel_pixels_tab[2][2][2] = put_vp8_epel4_h6v6_altivec;\n\n c->put_vp8_epel_pixels_tab[2][1][1] = put_vp8_epel4_h4v4_altivec;\n\n c->put_vp8_epel_pixels_tab[2][1][2] = put_vp8_epel4_h6v4_altivec;\n\n c->put_vp8_epel_pixels_tab[2][2][1] = put_vp8_epel4_h4v6_altivec;\n\n#endif /* HAVE_ALTIVEC */\n\n}\n"}} {"sample_id": "908bb9497bcb5543930cc345326afff939a6ffa4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,17 +2,17 @@\n \n int is_read)\n \n+{\n \n BlockInterfaceErrorAction action =\n \n drive_get_on_error(req->dev->bs, is_read);\n \n+ VirtIOBlock *s = req->dev;\n \n \n \n+ if (action == BLOCK_ERR_IGNORE) {\n \n bdrv_mon_event(req->dev->bs, BDRV_ACTION_IGNORE, is_read);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int virtio_blk_handle_rw_error(VirtIOBlockReq *req, int error,\n\n int is_read)\n\n{\n\n BlockInterfaceErrorAction action =\n\n drive_get_on_error(req->dev->bs, is_read);\n\n VirtIOBlock *s = req->dev;\n\n\n\n if (action == BLOCK_ERR_IGNORE) {\n\n bdrv_mon_event(req->dev->bs, BDRV_ACTION_IGNORE, is_read);\n\n return 0;\n\n }\n\n\n\n if ((error == ENOSPC && action == BLOCK_ERR_STOP_ENOSPC)\n\n || action == BLOCK_ERR_STOP_ANY) {\n\n req->next = s->rq;\n\n s->rq = req;\n\n bdrv_mon_event(req->dev->bs, BDRV_ACTION_STOP, is_read);\n\n vm_stop(0);\n\n } else {\n\n virtio_blk_req_complete(req, VIRTIO_BLK_S_IOERR);\n\n bdrv_mon_event(req->dev->bs, BDRV_ACTION_REPORT, is_read);\n\n }\n\n\n\n return 1;\n\n}\n"}} {"sample_id": "fa2a34cd40d124161c748bb0f430dc63c94dd0da_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,8 +26,8 @@\n \n SDL_Quit();\n \n+ av_log(NULL, AV_LOG_QUIET, \"\");\n+\n+ exit(0);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void do_exit(void)\n\n{\n\n if (cur_stream) {\n\n stream_close(cur_stream);\n\n cur_stream = NULL;\n\n }\n\n uninit_opts();\n\n#if CONFIG_AVFILTER\n\n avfilter_uninit();\n\n#endif\n\n avformat_network_deinit();\n\n if (show_status)\n\n printf(\"\\n\");\n\n SDL_Quit();\n\n av_log(NULL, AV_LOG_QUIET, \"\");\n\n exit(0);\n\n}\n"}} {"sample_id": "b626b51a6721e53817155af720243f59072e424f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n struct nbd_request request = {\n \n+ .type = NBD_CMD_DISC,\n+\n+ .from = 0,\n+\n+ .len = 0\n \n };\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void nbd_client_close(BlockDriverState *bs)\n\n{\n\n NbdClientSession *client = nbd_get_client_session(bs);\n\n struct nbd_request request = {\n\n .type = NBD_CMD_DISC,\n\n .from = 0,\n\n .len = 0\n\n };\n\n\n\n if (client->ioc == NULL) {\n\n return;\n\n }\n\n\n\n nbd_send_request(client->ioc, &request);\n\n\n\n nbd_teardown_connection(bs);\n\n}\n"}} {"sample_id": "d6f723b513a0c3c4e58343b7c52a2f9850861fa0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void test_qemu_strtoul_max(void)\n+\n {\n \n const char *str = g_strdup_printf(\"%lu\", ULONG_MAX);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void test_qemu_strtoul_max(void)\n\n{\n\n const char *str = g_strdup_printf(\"%lu\", ULONG_MAX);\n\n char f = 'X';\n\n const char *endptr = &f;\n\n unsigned long res = 999;\n\n int err;\n\n\n\n err = qemu_strtoul(str, &endptr, 0, &res);\n\n\n\n g_assert_cmpint(err, ==, 0);\n\n g_assert_cmpint(res, ==, ULONG_MAX);\n\n g_assert(endptr == str + strlen(str));\n\n}\n"}} {"sample_id": "6e25280216fc23c8387892f76d961559da124528", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,13 +4,13 @@\n \n {\n \n+ CPUS390XState *env = &cpu->env;\n+\n+ uint64_t sccb;\n \n uint32_t code;\n \n+ int r = 0;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int kvm_sclp_service_call(S390CPU *cpu, struct kvm_run *run,\n\n uint16_t ipbh0)\n\n{\n\n CPUS390XState *env = &cpu->env;\n\n uint64_t sccb;\n\n uint32_t code;\n\n int r = 0;\n\n\n\n cpu_synchronize_state(CPU(cpu));\n\n if (env->psw.mask & PSW_MASK_PSTATE) {\n\n enter_pgmcheck(cpu, PGM_PRIVILEGED);\n\n return 0;\n\n }\n\n sccb = env->regs[ipbh0 & 0xf];\n\n code = env->regs[(ipbh0 & 0xf0) >> 4];\n\n\n\n r = sclp_service_call(sccb, code);\n\n if (r < 0) {\n\n enter_pgmcheck(cpu, -r);\n\n }\n\n setcc(cpu, r);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_262", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n \n \n addr &= s->cirrus_addr_mask;\n+\n+\n+\n+ if (((s->vga.sr[0x17] & 0x44) == 0x44) &&\n+\n ((addr & s->linear_mmio_mask) == s->linear_mmio_mask)) {\n \n \t/* memory-mapped I/O */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void cirrus_linear_write(void *opaque, target_phys_addr_t addr,\n\n uint64_t val, unsigned size)\n\n{\n\n CirrusVGAState *s = opaque;\n\n unsigned mode;\n\n\n\n addr &= s->cirrus_addr_mask;\n\n\n\n if (((s->vga.sr[0x17] & 0x44) == 0x44) &&\n\n ((addr & s->linear_mmio_mask) == s->linear_mmio_mask)) {\n\n\t/* memory-mapped I/O */\n\n\tcirrus_mmio_blt_write(s, addr & 0xff, val);\n\n } else if (s->cirrus_srcptr != s->cirrus_srcptr_end) {\n\n\t/* bitblt */\n\n\t*s->cirrus_srcptr++ = (uint8_t) val;\n\n\tif (s->cirrus_srcptr >= s->cirrus_srcptr_end) {\n\n\t cirrus_bitblt_cputovideo_next(s);\n\n\t}\n\n } else {\n\n\t/* video memory */\n\n\tif ((s->vga.gr[0x0B] & 0x14) == 0x14) {\n\n\t addr <<= 4;\n\n\t} else if (s->vga.gr[0x0B] & 0x02) {\n\n\t addr <<= 3;\n\n\t}\n\n\taddr &= s->cirrus_addr_mask;\n\n\n\n\tmode = s->vga.gr[0x05] & 0x7;\n\n\tif (mode < 4 || mode > 5 || ((s->vga.gr[0x0B] & 0x4) == 0)) {\n\n\t *(s->vga.vram_ptr + addr) = (uint8_t) val;\n\n memory_region_set_dirty(&s->vga.vram, addr, 1);\n\n\t} else {\n\n\t if ((s->vga.gr[0x0B] & 0x14) != 0x14) {\n\n\t\tcirrus_mem_writeb_mode4and5_8bpp(s, mode, addr, val);\n\n\t } else {\n\n\t\tcirrus_mem_writeb_mode4and5_16bpp(s, mode, addr, val);\n\n\t }\n\n\t}\n\n }\n\n}\n"}} {"sample_id": "04920fc0faa4760f9c4fc0e73b992b768099be70_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void pc_init_pci_1_6(QEMUMachineInitArgs *args)\n \n+{\n+\n has_pci_info = false;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void pc_init_pci_1_6(QEMUMachineInitArgs *args)\n\n{\n\n has_pci_info = false;\n\n\n pc_init_pci(args);\n\n}"}} {"sample_id": "511aefb0c60e3063ead76d4ba6aabf619eed18ef", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ uint32_t old_pending;\n \n uint32_t le_events = cpu_to_le32(events);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void qxl_send_events(PCIQXLDevice *d, uint32_t events)\n\n{\n\n uint32_t old_pending;\n\n uint32_t le_events = cpu_to_le32(events);\n\n\n\n trace_qxl_send_events(d->id, events);\n\n assert(qemu_spice_display_is_running(&d->ssd));\n\n old_pending = __sync_fetch_and_or(&d->ram->int_pending, le_events);\n\n if ((old_pending & le_events) == le_events) {\n\n return;\n\n }\n\n if (qemu_thread_is_self(&d->main)) {\n\n qxl_update_irq(d);\n\n } else {\n\n if (write(d->pipe[1], d, 1) != 1) {\n\n dprint(d, 1, \"%s: write to pipe failed\\n\", __func__);\n\n }\n\n }\n\n}\n"}} {"sample_id": "dcd913d9ed6c15ea53882894baa343695575abcd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n \n \n+\n+\n+\n+\n+\n av_free(filter);\n \n ts->pids[pid] = NULL;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void mpegts_close_filter(MpegTSContext *ts, MpegTSFilter *filter)\n\n{\n\n int pid;\n\n\n\n pid = filter->pid;\n\n if (filter->type == MPEGTS_SECTION)\n\n av_freep(&filter->u.section_filter.section_buf);\n\n\n\n\n\n\n\n\n\n\n av_free(filter);\n\n ts->pids[pid] = NULL;\n"}} {"sample_id": "560f19f162529d691619ac69ed032321c7f5f1fb_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,7 +12,7 @@\n \n \n \n+ if (!ret) {\n \n return false;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "bool object_property_get_bool(Object *obj, const char *name,\n\n Error **errp)\n\n{\n\n QObject *ret = object_property_get_qobject(obj, name, errp);\n\n QBool *qbool;\n\n bool retval;\n\n\n\n if (!ret) {\n\n return false;\n\n }\n\n qbool = qobject_to_qbool(ret);\n\n if (!qbool) {\n\n error_setg(errp, QERR_INVALID_PARAMETER_TYPE, name, \"boolean\");\n\n retval = false;\n\n } else {\n\n retval = qbool_get_bool(qbool);\n\n }\n\n\n\n QDECREF(qbool);\n\n return retval;\n\n}\n"}} {"sample_id": "0c53d7342b4e8412f3b81eed67f053304813dc5d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static inline void gen_sync_flags(DisasContext *dc)\n+\n+{\n \n /* Sync the tb dependent flag between translate and runtime. */\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void gen_sync_flags(DisasContext *dc)\n\n{\n\n /* Sync the tb dependent flag between translate and runtime. */\n\n if (dc->tb_flags != dc->synced_flags) {\n\n tcg_gen_movi_tl(env_flags, dc->tb_flags);\n\n dc->synced_flags = dc->tb_flags;\n\n }\n\n}\n"}} {"sample_id": "5839e53bbc0fec56021d758aab7610df421ed8c8_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n qemu_irq *irqs;\n+\n int i;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void ahci_init(AHCIState *s, DeviceState *qdev, AddressSpace *as, int ports)\n\n{\n\n qemu_irq *irqs;\n\n int i;\n\n\n\n s->as = as;\n\n s->ports = ports;\n\n s->dev = g_malloc0(sizeof(AHCIDevice) * ports);\n\n ahci_reg_init(s);\n\n /* XXX BAR size should be 1k, but that breaks, so bump it to 4k for now */\n\n memory_region_init_io(&s->mem, OBJECT(qdev), &ahci_mem_ops, s,\n\n \"ahci\", AHCI_MEM_BAR_SIZE);\n\n memory_region_init_io(&s->idp, OBJECT(qdev), &ahci_idp_ops, s,\n\n \"ahci-idp\", 32);\n\n\n\n irqs = qemu_allocate_irqs(ahci_irq_set, s, s->ports);\n\n\n\n for (i = 0; i < s->ports; i++) {\n\n AHCIDevice *ad = &s->dev[i];\n\n\n\n ide_bus_new(&ad->port, sizeof(ad->port), qdev, i, 1);\n\n ide_init2(&ad->port, irqs[i]);\n\n\n\n ad->hba = s;\n\n ad->port_no = i;\n\n ad->port.dma = &ad->dma;\n\n ad->port.dma->ops = &ahci_dma_ops;\n\n }\n\n}\n"}} {"sample_id": "d9f62dde1303286b24ac8ce88be27e2b9b9c5f46_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n OptsVisitor *ov = to_ov(v);\n+\n+\n+\n+ assert(ov->list_mode == LM_STARTED ||\n+\n ov->list_mode == LM_IN_PROGRESS ||\n \n ov->list_mode == LM_SIGNED_INTERVAL ||", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "opts_end_list(Visitor *v)\n\n{\n\n OptsVisitor *ov = to_ov(v);\n\n\n\n assert(ov->list_mode == LM_STARTED ||\n\n ov->list_mode == LM_IN_PROGRESS ||\n\n ov->list_mode == LM_SIGNED_INTERVAL ||\n\n ov->list_mode == LM_UNSIGNED_INTERVAL);\n\n ov->repeated_opts = NULL;\n\n ov->list_mode = LM_NONE;\n\n}\n"}} {"sample_id": "77cb0f5aafc8e6d0c6d3c339f381c9b7921648e0_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,23 +1,23 @@\n+static int adb_mouse_poll(ADBDevice *d, uint8_t *obuf)\n+\n+{\n+\n+ MouseState *s = ADB_MOUSE(d);\n+\n+ int dx, dy;\n+\n+\n+\n+ if (s->last_buttons_state == s->buttons_state &&\n+\n+ s->dx == 0 && s->dy == 0)\n+\n+ return 0;\n+\n+\n+\n+ dx = s->dx;\n+\n if (dx < -63)\n \n dx = -63;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int adb_mouse_poll(ADBDevice *d, uint8_t *obuf)\n\n{\n\n MouseState *s = ADB_MOUSE(d);\n\n int dx, dy;\n\n\n\n if (s->last_buttons_state == s->buttons_state &&\n\n s->dx == 0 && s->dy == 0)\n\n return 0;\n\n\n\n dx = s->dx;\n\n if (dx < -63)\n\n dx = -63;\n\n else if (dx > 63)\n\n dx = 63;\n\n\n\n dy = s->dy;\n\n if (dy < -63)\n\n dy = -63;\n\n else if (dy > 63)\n\n dy = 63;\n\n\n\n s->dx -= dx;\n\n s->dy -= dy;\n\n s->last_buttons_state = s->buttons_state;\n\n\n\n dx &= 0x7f;\n\n dy &= 0x7f;\n\n\n\n if (!(s->buttons_state & MOUSE_EVENT_LBUTTON))\n\n dy |= 0x80;\n\n if (!(s->buttons_state & MOUSE_EVENT_RBUTTON))\n\n dx |= 0x80;\n\n\n\n obuf[0] = dy;\n\n obuf[1] = dx;\n\n return 2;\n\n}\n"}} {"sample_id": "25f8e2f512d87f0a77fc5c0b367dd200a7834d21", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);\n \n \n+\n+ pci_config_set_vendor_id(d->dev.config, PCI_VENDOR_ID_INTEL);\n+\n pci_config_set_device_id(d->dev.config, PCI_DEVICE_ID_INTEL_82371AB);\n \n return pci_piix_ide_initfn(d);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pci_piix4_ide_initfn(PCIDevice *dev)\n\n{\n\n PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev);\n\n\n\n pci_config_set_vendor_id(d->dev.config, PCI_VENDOR_ID_INTEL);\n\n pci_config_set_device_id(d->dev.config, PCI_DEVICE_ID_INTEL_82371AB);\n\n return pci_piix_ide_initfn(d);\n\n}\n"}} {"sample_id": "57623cba1301ee7874687dd7e04c611051638e9d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n WebPContext *s = avctx->priv_data;\n \n+ if (s->has_alpha)\n+\n+ return AV_PIX_FMT_YUVA420P;\n+\n else\n \n return AV_PIX_FMT_YUV420P;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static enum AVPixelFormat webp_get_format(AVCodecContext *avctx,\n\n const enum AVPixelFormat *formats)\n\n{\n\n WebPContext *s = avctx->priv_data;\n\n if (s->has_alpha)\n\n return AV_PIX_FMT_YUVA420P;\n\n else\n\n return AV_PIX_FMT_YUV420P;\n\n}\n"}} {"sample_id": "9f61abc8111c7c43f49ca012e957a108b9cc7610", "diff": "--- a/source.c\n+++ b/source.c\n@@ -35,11 +35,11 @@\n }\n \n avio_write(out, buf, n);\n+\n+ size -= n;\n+\n+ }\n+\n avio_flush(out);\n \n avio_close(out);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int copy_moof(AVFormatContext *s, const char* infile, const char *outfile, int64_t size)\n\n{\n\n AVIOContext *in, *out;\n\n int ret = 0;\n\n if ((ret = avio_open2(&in, infile, AVIO_FLAG_READ, &s->interrupt_callback, NULL)) < 0)\n\n return ret;\n\n if ((ret = avio_open2(&out, outfile, AVIO_FLAG_WRITE, &s->interrupt_callback, NULL)) < 0) {\n\n avio_close(in);\n\n return ret;\n\n }\n\n while (size > 0) {\n\n uint8_t buf[8192];\n\n int n = FFMIN(size, sizeof(buf));\n\n n = avio_read(in, buf, n);\n\n if (n <= 0) {\n\n ret = AVERROR(EIO);\n\n break;\n\n }\n\n avio_write(out, buf, n);\n\n size -= n;\n\n }\n\n avio_flush(out);\n\n avio_close(out);\n\n avio_close(in);\n\n return ret;\n\n}\n"}} {"sample_id": "f61d82c2dfe02a60642a76e8f0034a0244eef2bf_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -54,11 +54,11 @@\n \n /* memory #0 LFB */\n \n+ /* memory #1 memory-mapped I/O */\n+\n+ /* XXX: s->vga.vram_size must be a power of two */\n+\n+ pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &s->pci_bar);\n \n if (device_id == CIRRUS_ID_CLGD5446) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int pci_cirrus_vga_initfn(PCIDevice *dev)\n\n{\n\n PCICirrusVGAState *d = DO_UPCAST(PCICirrusVGAState, dev, dev);\n\n CirrusVGAState *s = &d->cirrus_vga;\n\n PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);\n\n int16_t device_id = pc->device_id;\n\n\n\n\n\n\n\n\n\n\n\n /* setup VGA */\n\n vga_common_init(&s->vga, OBJECT(dev), true);\n\n cirrus_init_common(s, OBJECT(dev), device_id, 1, pci_address_space(dev),\n\n pci_address_space_io(dev));\n\n s->vga.con = graphic_console_init(DEVICE(dev), 0, s->vga.hw_ops, &s->vga);\n\n\n\n /* setup PCI */\n\n\n\n memory_region_init(&s->pci_bar, OBJECT(dev), \"cirrus-pci-bar0\", 0x2000000);\n\n\n\n /* XXX: add byte swapping apertures */\n\n memory_region_add_subregion(&s->pci_bar, 0, &s->cirrus_linear_io);\n\n memory_region_add_subregion(&s->pci_bar, 0x1000000,\n\n &s->cirrus_linear_bitblt_io);\n\n\n\n /* setup memory space */\n\n /* memory #0 LFB */\n\n /* memory #1 memory-mapped I/O */\n\n /* XXX: s->vga.vram_size must be a power of two */\n\n pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_MEM_PREFETCH, &s->pci_bar);\n\n if (device_id == CIRRUS_ID_CLGD5446) {\n\n pci_register_bar(&d->dev, 1, 0, &s->cirrus_mmio_io);\n\n\n return 0;\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_120", "diff": "--- a/source.c\n+++ b/source.c\n@@ -52,11 +52,11 @@\n \n default:\n \n+ IVSHMEM_DPRINTF(\"why are we reading \" TARGET_FMT_plx \"\\n\", addr);\n+\n+ ret = 0;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t ivshmem_io_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n\n\n IVShmemState *s = opaque;\n\n uint32_t ret;\n\n\n\n switch (addr)\n\n {\n\n case INTRMASK:\n\n ret = ivshmem_IntrMask_read(s);\n\n break;\n\n\n\n case INTRSTATUS:\n\n ret = ivshmem_IntrStatus_read(s);\n\n break;\n\n\n\n case IVPOSITION:\n\n /* return my VM ID if the memory is mapped */\n\n if (s->shm_fd > 0) {\n\n ret = s->vm_id;\n\n } else {\n\n ret = -1;\n\n }\n\n break;\n\n\n\n default:\n\n IVSHMEM_DPRINTF(\"why are we reading \" TARGET_FMT_plx \"\\n\", addr);\n\n ret = 0;\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "ca44141d5fb801dd5903102acefd0f2d8e8bb6a1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n DeviceClass *k = DEVICE_CLASS(klass);\n \n+ k->init = ide_qdev_init;\n+\n+ set_bit(DEVICE_CATEGORY_STORAGE, k->categories);\n+\n k->bus_type = TYPE_IDE_BUS;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void ide_device_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *k = DEVICE_CLASS(klass);\n\n k->init = ide_qdev_init;\n\n set_bit(DEVICE_CATEGORY_STORAGE, k->categories);\n\n k->bus_type = TYPE_IDE_BUS;\n\n\n k->props = ide_props;\n\n}"}} {"sample_id": "f929ab0569ff31ed5a59b0b0adb7ce09df3fca39", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n if (!read_yesno()) {\n \n fprintf(stderr, \"Not overwriting - exiting\\n\");\n+\n+ exit_program(1);\n+\n+ }\n+\n }\n \n else {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void assert_file_overwrite(const char *filename)\n\n{\n\n if (file_overwrite && file_skip) {\n\n fprintf(stderr, \"Error, both -y and -n supplied. Exiting.\\n\");\n\n exit_program(1);\n\n }\n\n\n\n if (!file_overwrite &&\n\n (strchr(filename, ':') == NULL || filename[1] == ':' ||\n\n av_strstart(filename, \"file:\", NULL))) {\n\n if (avio_check(filename, 0) == 0) {\n\n if (!using_stdin && !file_skip) {\n\n fprintf(stderr,\"File '%s' already exists. Overwrite ? [y/N] \", filename);\n\n fflush(stderr);\n\n if (!read_yesno()) {\n\n fprintf(stderr, \"Not overwriting - exiting\\n\");\n\n exit_program(1);\n\n }\n\n }\n\n else {\n\n fprintf(stderr,\"File '%s' already exists. Exiting.\\n\", filename);\n\n exit_program(1);\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "aff6cebb41669a25008f76ce3c310001613e6263", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int set_expr(AVExpr **pexpr, const char *expr, void *log_ctx)\n \n+{\n+\n int ret;\n+\n+\n \n if (*pexpr)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int set_expr(AVExpr **pexpr, const char *expr, void *log_ctx)\n\n{\n\n int ret;\n\n\n\n if (*pexpr)\n\n av_expr_free(*pexpr);\n\n *pexpr = NULL;\n\n ret = av_expr_parse(pexpr, expr, var_names,\n\n NULL, NULL, NULL, NULL, 0, log_ctx);\n\n if (ret < 0)\n\n av_log(log_ctx, AV_LOG_ERROR,\n\n \"Error when evaluating the expression '%s'\\n\", expr);\n\n return ret;\n\n}\n"}} {"sample_id": "13a099799e89a76eb921ca452e1b04a7a28a9855_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n enum PixelFormat target)\n \n+{\n+\n+ int yalpha1 = 4095 - yalpha; \\\n+\n+ int i;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "yuv2gray16_2_c_template(SwsContext *c, const uint16_t *buf0,\n\n const uint16_t *buf1, const uint16_t *ubuf0,\n\n const uint16_t *ubuf1, const uint16_t *vbuf0,\n\n const uint16_t *vbuf1, const uint16_t *abuf0,\n\n const uint16_t *abuf1, uint8_t *dest, int dstW,\n\n int yalpha, int uvalpha, int y,\n\n enum PixelFormat target)\n\n{\n\n int yalpha1 = 4095 - yalpha; \\\n\n int i;\n\n\n\n for (i = 0; i < (dstW >> 1); i++) {\n\n const int i2 = 2 * i;\n\n int Y1 = (buf0[i2 ] * yalpha1 + buf1[i2 ] * yalpha) >> 11;\n\n int Y2 = (buf0[i2+1] * yalpha1 + buf1[i2+1] * yalpha) >> 11;\n\n\n\n output_pixel(&dest[2 * i2 + 0], Y1);\n\n output_pixel(&dest[2 * i2 + 2], Y2);\n\n }\n\n}\n"}} {"sample_id": "90e496386fe7fd32c189561f846b7913f95b8cf4_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n {\n \n TCGv_i32 v = tcg_temp_new_i32();\n+\n+\n+\n tcg_gen_ld_i32(v, cpu_env, fp_reg_offset(reg, MO_32));\n \n return v;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)\n\n{\n\n TCGv_i32 v = tcg_temp_new_i32();\n\n\n\n tcg_gen_ld_i32(v, cpu_env, fp_reg_offset(reg, MO_32));\n\n return v;\n\n}\n"}} {"sample_id": "dcc39ee10e82833ce24aa57926c00ffeb1948198_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n void checkasm_check_blockdsp(void)\n \n {\n+\n+ LOCAL_ALIGNED_16(uint16_t, buf0, [6 * 8 * 8]);\n+\n+ LOCAL_ALIGNED_16(uint16_t, buf1, [6 * 8 * 8]);\n+\n \n \n AVCodecContext avctx = { 0 };", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void checkasm_check_blockdsp(void)\n\n{\n\n LOCAL_ALIGNED_16(uint16_t, buf0, [6 * 8 * 8]);\n\n LOCAL_ALIGNED_16(uint16_t, buf1, [6 * 8 * 8]);\n\n\n\n AVCodecContext avctx = { 0 };\n\n BlockDSPContext h;\n\n\n\n ff_blockdsp_init(&h, &avctx);\n\n\n\n check_clear(clear_block, 8 * 8);\n\n check_clear(clear_blocks, 8 * 8 * 6);\n\n\n\n report(\"blockdsp\");\n\n}\n"}} {"sample_id": "2ee4aed86ff2ba38a0e1846de18a9aec38d73015", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,8 +16,8 @@\n \n MIPS_TLB_NB not being a power of two. But so does real silicon. */\n \n+ invalidate_tlb(env->CP0_index & (MIPS_TLB_NB - 1), 0);\n+\n+ fill_tlb(env->CP0_index & (MIPS_TLB_NB - 1));\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void do_tlbwi (void)\n\n{\n\n /* Discard cached TLB entries. We could avoid doing this if the\n\n tlbwi is just upgrading access permissions on the current entry;\n\n that might be a further win. */\n\n mips_tlb_flush_extra (env, MIPS_TLB_NB);\n\n\n\n /* Wildly undefined effects for CP0_index containing a too high value and\n\n MIPS_TLB_NB not being a power of two. But so does real silicon. */\n\n invalidate_tlb(env->CP0_index & (MIPS_TLB_NB - 1), 0);\n\n fill_tlb(env->CP0_index & (MIPS_TLB_NB - 1));\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_95", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n uint8_t *in = d->u.r_virtbase + addr;\n \n uint32_t r;\n+\n+\n+\n+ r = *in;\n+\n DEBUG(\"slow_bar_readl addr=0x\" TARGET_FMT_plx \" val=0x%08x\\n\", addr, r);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t slow_bar_readb(void *opaque, target_phys_addr_t addr)\n\n{\n\n AssignedDevRegion *d = opaque;\n\n uint8_t *in = d->u.r_virtbase + addr;\n\n uint32_t r;\n\n\n\n r = *in;\n\n DEBUG(\"slow_bar_readl addr=0x\" TARGET_FMT_plx \" val=0x%08x\\n\", addr, r);\n\n\n\n return r;\n\n}\n"}} {"sample_id": "220b24c7c97dc033ceab1510549f66d0e7b52ef1_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n+int ff_get_schro_frame_format (SchroChromaFormat schro_pix_fmt,\n+\n+ SchroFrameFormat *schro_frame_fmt)\n+\n+{\n+\n+ unsigned int num_formats = sizeof(schro_pixel_format_map) /\n \n sizeof(schro_pixel_format_map[0]);\n+\n \n \n int idx;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int ff_get_schro_frame_format (SchroChromaFormat schro_pix_fmt,\n\n SchroFrameFormat *schro_frame_fmt)\n\n{\n\n unsigned int num_formats = sizeof(schro_pixel_format_map) /\n\n sizeof(schro_pixel_format_map[0]);\n\n\n\n int idx;\n\n\n\n for (idx = 0; idx < num_formats; ++idx) {\n\n if (schro_pixel_format_map[idx].schro_pix_fmt == schro_pix_fmt) {\n\n *schro_frame_fmt = schro_pixel_format_map[idx].schro_frame_fmt;\n\n return 0;\n\n }\n\n }\n\n return -1;\n\n}\n"}} {"sample_id": "4efe27556dea874030f1cd53a6d70452ee064fba", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n CirrusVGAState *s;\n \n+\n+\n+ s = qemu_mallocz(sizeof(CirrusVGAState));\n+\n+\n \n vga_common_init((VGAState *)s,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void isa_cirrus_vga_init(DisplayState *ds, uint8_t *vga_ram_base,\n\n unsigned long vga_ram_offset, int vga_ram_size)\n\n{\n\n CirrusVGAState *s;\n\n\n\n s = qemu_mallocz(sizeof(CirrusVGAState));\n\n\n\n vga_common_init((VGAState *)s,\n\n ds, vga_ram_base, vga_ram_offset, vga_ram_size);\n\n cirrus_init_common(s, CIRRUS_ID_CLGD5430, 0);\n\n s->console = graphic_console_init(s->ds, s->update, s->invalidate,\n\n s->screen_dump, s->text_update, s);\n\n /* XXX ISA-LFB support */\n\n}\n"}} {"sample_id": "f78cd0c243b9149c7f604ecf1006d78e344aa6ca_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n pixel *dest = (pixel *)dest_;\n+\n int i;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void FUNC(ff_simple_idct_add)(uint8_t *dest_, int line_size, DCTELEM *block)\n\n{\n\n pixel *dest = (pixel *)dest_;\n\n int i;\n\n\n\n line_size /= sizeof(pixel);\n\n\n\n for (i = 0; i < 8; i++)\n\n FUNC(idctRowCondDC)(block + i*8);\n\n\n\n for (i = 0; i < 8; i++)\n\n FUNC(idctSparseColAdd)(dest + i, line_size, block + i);\n\n}\n"}} {"sample_id": "4f298a4b2957b7833bc607c951ca27c458d98d88_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void clear_sel(IPMIBmcSim *ibs,\n+\n uint8_t *cmd, unsigned int cmd_len,\n \n uint8_t *rsp, unsigned int *rsp_len,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void clear_sel(IPMIBmcSim *ibs,\n\n uint8_t *cmd, unsigned int cmd_len,\n\n uint8_t *rsp, unsigned int *rsp_len,\n\n unsigned int max_rsp_len)\n\n{\n\n IPMI_CHECK_CMD_LEN(8);\n\n IPMI_CHECK_RESERVATION(2, ibs->sel.reservation);\n\n if (cmd[4] != 'C' || cmd[5] != 'L' || cmd[6] != 'R') {\n\n rsp[2] = IPMI_CC_INVALID_DATA_FIELD;\n\n return;\n\n }\n\n if (cmd[7] == 0xaa) {\n\n ibs->sel.next_free = 0;\n\n ibs->sel.overflow = 0;\n\n set_timestamp(ibs, ibs->sdr.last_clear);\n\n IPMI_ADD_RSP_DATA(1); /* Erasure complete */\n\n sel_inc_reservation(&ibs->sel);\n\n } else if (cmd[7] == 0) {\n\n IPMI_ADD_RSP_DATA(1); /* Erasure complete */\n\n } else {\n\n rsp[2] = IPMI_CC_INVALID_DATA_FIELD;\n\n return;\n\n }\n\n}\n"}} {"sample_id": "a4f6be86d67ae30d494fbe8a470bc32b715d75a9_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n const int beta = beta_table[qp - qp_bd_offset + h->slice_beta_offset];\n \n+ if (alpha ==0 || beta == 0) return;\n+\n+\n+\n+ if( bS[0] < 4 ) {\n \n int8_t tc[4];\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void av_always_inline filter_mb_edgeh( uint8_t *pix, int stride, const int16_t bS[4], unsigned int qp, H264Context *h ) {\n\n const int qp_bd_offset = 6 * (h->sps.bit_depth_luma - 8);\n\n const unsigned int index_a = qp - qp_bd_offset + h->slice_alpha_c0_offset;\n\n const int alpha = alpha_table[index_a];\n\n const int beta = beta_table[qp - qp_bd_offset + h->slice_beta_offset];\n\n if (alpha ==0 || beta == 0) return;\n\n\n\n if( bS[0] < 4 ) {\n\n int8_t tc[4];\n\n tc[0] = tc0_table[index_a][bS[0]];\n\n tc[1] = tc0_table[index_a][bS[1]];\n\n tc[2] = tc0_table[index_a][bS[2]];\n\n tc[3] = tc0_table[index_a][bS[3]];\n\n h->h264dsp.h264_v_loop_filter_luma(pix, stride, alpha, beta, tc);\n\n } else {\n\n h->h264dsp.h264_v_loop_filter_luma_intra(pix, stride, alpha, beta);\n\n }\n\n}\n"}} {"sample_id": "2d15588124ab1d4c0612cab66f02a716f1509211", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n int i, chan, err;\n \n \n+\n for (chan = 0; chan < s->channels; chan++) {\n \n if (FFMAX(1, s->nmean) >= UINT_MAX / sizeof(int32_t)) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int allocate_buffers(ShortenContext *s)\n\n{\n\n int i, chan, err;\n\n\n\n for (chan = 0; chan < s->channels; chan++) {\n\n if (FFMAX(1, s->nmean) >= UINT_MAX / sizeof(int32_t)) {\n\n av_log(s->avctx, AV_LOG_ERROR, \"nmean too large\\n\");\n\n return AVERROR_INVALIDDATA;\n\n }\n\n if (s->blocksize + s->nwrap >= UINT_MAX / sizeof(int32_t) ||\n\n s->blocksize + s->nwrap <= (unsigned)s->nwrap) {\n\n av_log(s->avctx, AV_LOG_ERROR,\n\n \"s->blocksize + s->nwrap too large\\n\");\n\n return AVERROR_INVALIDDATA;\n\n }\n\n\n\n if ((err = av_reallocp_array(&s->offset[chan],\n\n sizeof(int32_t),\n\n FFMAX(1, s->nmean))) < 0)\n\n return err;\n\n\n\n if ((err = av_reallocp_array(&s->decoded_base[chan], (s->blocksize + s->nwrap),\n\n sizeof(s->decoded_base[0][0]))) < 0)\n\n return err;\n\n for (i = 0; i < s->nwrap; i++)\n\n s->decoded_base[chan][i] = 0;\n\n s->decoded[chan] = s->decoded_base[chan] + s->nwrap;\n\n }\n\n\n\n if ((err = av_reallocp_array(&s->coeffs, s->nwrap, sizeof(*s->coeffs))) < 0)\n\n return err;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n bool qemu_clock_expired(QEMUClockType type)\n+\n+{\n \n return timerlist_expired(\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool qemu_clock_expired(QEMUClockType type)\n\n{\n\n return timerlist_expired(\n\n main_loop_tlg.tl[type]);\n\n}\n"}} {"sample_id": "2d40564aaab3a99fe6ce00fc0fc893c02e9443ec", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int local_post_create_passthrough(FsContext *fs_ctx, const char *path,\n \n+ FsCred *credp)\n+\n {\n \n char buffer[PATH_MAX];", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int local_post_create_passthrough(FsContext *fs_ctx, const char *path,\n\n FsCred *credp)\n\n{\n\n char buffer[PATH_MAX];\n\n\n\n if (chmod(rpath(fs_ctx, path, buffer), credp->fc_mode & 07777) < 0) {\n\n return -1;\n\n }\n\n if (lchown(rpath(fs_ctx, path, buffer), credp->fc_uid,\n\n credp->fc_gid) < 0) {\n\n /*\n\n * If we fail to change ownership and if we are\n\n * using security model none. Ignore the error\n\n */\n\n if ((fs_ctx->export_flags & V9FS_SEC_MASK) != V9FS_SM_NONE) {\n\n return -1;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "13f59ae8157e8ec238fa8aefe5309909a1eeb7e2_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n void qerror_report(const char *fmt, ...)\n \n+{\n+\n+ va_list va;\n+\n+ QError *qerror;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qerror_report(const char *fmt, ...)\n\n{\n\n va_list va;\n\n QError *qerror;\n\n\n\n va_start(va, fmt);\n\n qerror = qerror_from_info(fmt, &va);\n\n va_end(va);\n\n\n\n if (monitor_cur_is_qmp()) {\n\n monitor_set_error(cur_mon, qerror);\n\n } else {\n\n qerror_print(qerror);\n\n QDECREF(qerror);\n\n }\n\n}\n"}} {"sample_id": "3a330134b3effa3494051763b38f12a24715d53a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n virtio_save(&n->vdev, f);\n \n \n+\n+ qemu_put_buffer(f, n->mac, ETH_ALEN);\n+\n+ qemu_put_be32(f, n->tx_timer_active);\n+\n qemu_put_be32(f, n->mergeable_rx_bufs);\n \n qemu_put_be16(f, n->status);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void virtio_net_save(QEMUFile *f, void *opaque)\n\n{\n\n VirtIONet *n = opaque;\n\n\n\n virtio_save(&n->vdev, f);\n\n\n\n qemu_put_buffer(f, n->mac, ETH_ALEN);\n\n qemu_put_be32(f, n->tx_timer_active);\n\n qemu_put_be32(f, n->mergeable_rx_bufs);\n\n qemu_put_be16(f, n->status);\n\n qemu_put_byte(f, n->promisc);\n\n qemu_put_byte(f, n->allmulti);\n\n qemu_put_be32(f, n->mac_table.in_use);\n\n qemu_put_buffer(f, n->mac_table.macs, n->mac_table.in_use * ETH_ALEN);\n\n qemu_put_buffer(f, (uint8_t *)n->vlans, MAX_VLAN >> 3);\n\n qemu_put_be32(f, 0); /* vnet-hdr placeholder */\n\n qemu_put_byte(f, n->mac_table.multi_overflow);\n\n qemu_put_byte(f, n->mac_table.uni_overflow);\n\n qemu_put_byte(f, n->alluni);\n\n qemu_put_byte(f, n->nomulti);\n\n qemu_put_byte(f, n->nouni);\n\n qemu_put_byte(f, n->nobcast);\n\n}\n"}} {"sample_id": "f555a9d0b3c785b698f32e6879e97d0a4b387314", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n new = qht_map_create(n_buckets);\n \n+ resize = true;\n+\n+ }\n+\n+\n \n qht_map_lock_buckets(map);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool qht_reset_size(struct qht *ht, size_t n_elems)\n\n{\n\n struct qht_map *new;\n\n struct qht_map *map;\n\n size_t n_buckets;\n\n bool resize = false;\n\n\n\n n_buckets = qht_elems_to_buckets(n_elems);\n\n\n\n qemu_mutex_lock(&ht->lock);\n\n map = ht->map;\n\n if (n_buckets != map->n_buckets) {\n\n new = qht_map_create(n_buckets);\n\n resize = true;\n\n }\n\n\n\n qht_map_lock_buckets(map);\n\n qht_map_reset__all_locked(map);\n\n if (resize) {\n\n qht_do_resize(ht, new);\n\n }\n\n qht_map_unlock_buckets(map);\n\n qemu_mutex_unlock(&ht->lock);\n\n\n\n return resize;\n\n}\n"}} {"sample_id": "8b3b720620a1137a1b794fc3ed64734236f94e06_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n \n \n+ snapshot_index = find_snapshot_by_id_or_name(bs, snapshot_id);\n \n if (snapshot_index < 0)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n QCowSnapshot *sn;\n\n int i, snapshot_index, l1_size2;\n\n\n\n snapshot_index = find_snapshot_by_id_or_name(bs, snapshot_id);\n\n if (snapshot_index < 0)\n\n return -ENOENT;\n\n sn = &s->snapshots[snapshot_index];\n\n\n\n if (qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, -1) < 0)\n\n goto fail;\n\n\n\n if (qcow2_grow_l1_table(bs, sn->l1_size) < 0)\n\n goto fail;\n\n\n\n s->l1_size = sn->l1_size;\n\n l1_size2 = s->l1_size * sizeof(uint64_t);\n\n /* copy the snapshot l1 table to the current l1 table */\n\n if (bdrv_pread(bs->file, sn->l1_table_offset,\n\n s->l1_table, l1_size2) != l1_size2)\n\n goto fail;\n\n if (bdrv_pwrite(bs->file, s->l1_table_offset,\n\n s->l1_table, l1_size2) != l1_size2)\n\n goto fail;\n\n for(i = 0;i < s->l1_size; i++) {\n\n be64_to_cpus(&s->l1_table[i]);\n\n }\n\n\n\n if (qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 1) < 0)\n\n goto fail;\n\n\n\n#ifdef DEBUG_ALLOC\n\n qcow2_check_refcounts(bs);\n\n#endif\n\n return 0;\n\n fail:\n\n return -EIO;\n\n}\n"}} {"sample_id": "1f51470d044852592922f91000e741c381582cdc_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,17 +1,17 @@\n+static int qemu_chr_open_tty(QemuOpts *opts, CharDriverState **_chr)\n \n {\n \n+ const char *filename = qemu_opt_get(opts, \"path\");\n+\n+ CharDriverState *chr;\n \n int fd;\n \n \n \n+ TFR(fd = qemu_open(filename, O_RDWR | O_NONBLOCK));\n+\n if (fd < 0) {\n \n return -errno;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int qemu_chr_open_tty(QemuOpts *opts, CharDriverState **_chr)\n\n{\n\n const char *filename = qemu_opt_get(opts, \"path\");\n\n CharDriverState *chr;\n\n int fd;\n\n\n\n TFR(fd = qemu_open(filename, O_RDWR | O_NONBLOCK));\n\n if (fd < 0) {\n\n return -errno;\n\n }\n\n tty_serial_init(fd, 115200, 'N', 8, 1);\n\n chr = qemu_chr_open_fd(fd, fd);\n\n chr->chr_ioctl = tty_serial_ioctl;\n\n chr->chr_close = qemu_chr_close_tty;\n\n\n\n *_chr = chr;\n\n return 0;\n\n}\n"}} {"sample_id": "5666dd19dd95d966be00d0c3e7efdfaecc096ff3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n Error **errp)\n \n {\n+\n+ GenericList *retval = *list;\n+\n g_free(retval->value);\n \n *list = retval->next;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static GenericList *qapi_dealloc_next_list(Visitor *v, GenericList **list,\n\n Error **errp)\n\n{\n\n GenericList *retval = *list;\n\n g_free(retval->value);\n\n *list = retval->next;\n\n return retval;\n\n}\n"}} {"sample_id": "2be5064953540d5451480375519389f104eb7909", "diff": "--- a/source.c\n+++ b/source.c\n@@ -49,11 +49,11 @@\n \n \n for (i = 0; i < nevents; i++) {\n+\n+ struct iocb *iocb = events[i].obj;\n+\n+ struct qemu_laiocb *laiocb =\n+\n container_of(iocb, struct qemu_laiocb, iocb);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_laio_completion_cb(void *opaque)\n\n{\n\n struct qemu_laio_state *s = opaque;\n\n\n\n while (1) {\n\n struct io_event events[MAX_EVENTS];\n\n uint64_t val;\n\n ssize_t ret;\n\n struct timespec ts = { 0 };\n\n int nevents, i;\n\n\n\n do {\n\n ret = read(s->efd, &val, sizeof(val));\n\n } while (ret == 1 && errno == EINTR);\n\n\n\n if (ret == -1 && errno == EAGAIN)\n\n break;\n\n\n\n if (ret != 8)\n\n break;\n\n\n\n do {\n\n nevents = io_getevents(s->ctx, val, MAX_EVENTS, events, &ts);\n\n } while (nevents == -EINTR);\n\n\n\n for (i = 0; i < nevents; i++) {\n\n struct iocb *iocb = events[i].obj;\n\n struct qemu_laiocb *laiocb =\n\n container_of(iocb, struct qemu_laiocb, iocb);\n\n\n\n laiocb->ret = io_event_ret(&events[i]);\n\n qemu_laio_enqueue_completed(s, laiocb);\n\n }\n\n }\n\n}\n"}} {"sample_id": "880a7578381d1c7ed4d41c7599ae3cc06567a824_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void gdb_chr_event(void *opaque, int event)\n \n {\n+\n+ switch (event) {\n+\n+ case CHR_EVENT_RESET:\n+\n vm_stop(EXCP_INTERRUPT);\n \n gdb_syscall_state = opaque;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gdb_chr_event(void *opaque, int event)\n\n{\n\n switch (event) {\n\n case CHR_EVENT_RESET:\n\n vm_stop(EXCP_INTERRUPT);\n\n gdb_syscall_state = opaque;\n\n gdb_has_xml = 0;\n\n break;\n\n default:\n\n break;\n\n }\n\n}\n"}} {"sample_id": "42e4126b793d15ec40f3a84017e1d8afecda1b6d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n uint32_t pci_default_read_config(PCIDevice *d,\n \n+ uint32_t address, int len)\n+\n {\n \n uint32_t val = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "uint32_t pci_default_read_config(PCIDevice *d,\n\n uint32_t address, int len)\n\n{\n\n uint32_t val = 0;\n\n assert(len == 1 || len == 2 || len == 4);\n\n len = MIN(len, pci_config_size(d) - address);\n\n memcpy(&val, d->config + address, len);\n\n return le32_to_cpu(val);\n\n}\n"}} {"sample_id": "8297be80f7cf71e09617669a8bd8b2836dcfd4c3_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n return k->keysym2keycode[keysym];\n \n+ } else {\n+\n+ int i;\n+\n+#ifdef XK_ISO_Left_Tab\n \n if (keysym == XK_ISO_Left_Tab) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int keysym2scancode(void *kbd_layout, int keysym)\n\n{\n\n kbd_layout_t *k = kbd_layout;\n\n if (keysym < MAX_NORMAL_KEYCODE) {\n\n if (k->keysym2keycode[keysym] == 0) {\n\n trace_keymap_unmapped(keysym);\n\n fprintf(stderr, \"Warning: no scancode found for keysym %d\\n\",\n\n keysym);\n\n }\n\n return k->keysym2keycode[keysym];\n\n } else {\n\n int i;\n\n#ifdef XK_ISO_Left_Tab\n\n if (keysym == XK_ISO_Left_Tab) {\n\n keysym = XK_Tab;\n\n }\n\n#endif\n\n for (i = 0; i < k->extra_count; i++) {\n\n if (k->keysym2keycode_extra[i].keysym == keysym) {\n\n return k->keysym2keycode_extra[i].keycode;\n\n }\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "3daa41078aedf227ec98b0d1c9d56b77b6d20153", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n scsi_req_ref(req);\n \n+ scsi_req_dequeue(req);\n+\n+ req->io_canceled = true;\n+\n+ if (req->aiocb) {\n \n blk_aio_cancel_async(req->aiocb);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void scsi_req_cancel_async(SCSIRequest *req, Notifier *notifier)\n\n{\n\n trace_scsi_req_cancel(req->dev->id, req->lun, req->tag);\n\n if (notifier) {\n\n notifier_list_add(&req->cancel_notifiers, notifier);\n\n\n\n\n\n\n\n\n\n\n\n scsi_req_ref(req);\n\n scsi_req_dequeue(req);\n\n req->io_canceled = true;\n\n if (req->aiocb) {\n\n blk_aio_cancel_async(req->aiocb);\n\n } else {\n\n scsi_req_cancel_complete(req);\n\n"}} {"sample_id": "72dbc610be3272ba36603f78a39cc2d2d8fe0cc3_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n {\n \n+ avc_luma_midh_qrt_and_aver_dst_8w_msa(src - (2 * stride) - 2,\n+\n stride, dst, stride, 8, 0);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_avg_h264_qpel8_mc12_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n avc_luma_midh_qrt_and_aver_dst_8w_msa(src - (2 * stride) - 2,\n\n stride, dst, stride, 8, 0);\n\n}\n"}} {"sample_id": "e45226adc46e513a1bb39ec2b09fb7c77515ab14_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n int r, b, lo;\n+\n \n \n b = cdt[p2];", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int make_cdt15_entry(int p1, int p2, int16_t *cdt)\n\n{\n\n int r, b, lo;\n\n\n\n b = cdt[p2];\n\n r = cdt[p1] * 1024;\n\n lo = b + r;\n\n return (lo + (lo * (1 << 16))) * 2;\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_45", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static inline void read_mem(IVState *s, uint64_t off, void *buf, size_t len)\n \n {\n+\n QTestState *qtest = global_qtest;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void read_mem(IVState *s, uint64_t off, void *buf, size_t len)\n\n{\n\n QTestState *qtest = global_qtest;\n\n\n\n global_qtest = s->qtest;\n\n qpci_memread(s->dev, s->mem_base + off, buf, len);\n\n global_qtest = qtest;\n\n}\n"}} {"sample_id": "e4a3507e86a1ef1453d603031bca27d5ac4cff3c_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static ssize_t block_crypto_write_func(QCryptoBlock *block,\n \n void *opaque,\n+\n+ size_t offset,\n+\n+ const uint8_t *buf,\n+\n size_t buflen,\n \n Error **errp)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ssize_t block_crypto_write_func(QCryptoBlock *block,\n\n void *opaque,\n\n size_t offset,\n\n const uint8_t *buf,\n\n size_t buflen,\n\n Error **errp)\n\n{\n\n struct BlockCryptoCreateData *data = opaque;\n\n ssize_t ret;\n\n\n\n ret = blk_pwrite(data->blk, offset, buf, buflen, 0);\n\n if (ret < 0) {\n\n error_setg_errno(errp, -ret, \"Could not write encryption header\");\n\n return ret;\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "10c4c98ab7dc18169b37b76f6ea5e60ebe65222b_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,9 +11,9 @@\n for (i = 0; i < s->num_mmio; i++) {\n \n monitor_printf(mon, \"%*smmio \" TARGET_FMT_plx \"/\" TARGET_FMT_plx \"\\n\",\n+\n+ indent, \"\", s->mmio[i].addr, s->mmio[i].size);\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void sysbus_dev_print(Monitor *mon, DeviceState *dev, int indent)\n\n{\n\n SysBusDevice *s = sysbus_from_qdev(dev);\n\n int i;\n\n\n\n for (i = 0; i < s->num_mmio; i++) {\n\n monitor_printf(mon, \"%*smmio \" TARGET_FMT_plx \"/\" TARGET_FMT_plx \"\\n\",\n\n indent, \"\", s->mmio[i].addr, s->mmio[i].size);\n\n }\n\n}\n"}} {"sample_id": "39ac8455106af1ed669b8e10223420cf1ac5b190_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n void spapr_register_hypercall(target_ulong opcode, spapr_hcall_fn fn)\n+\n+{\n+\n+ spapr_hcall_fn old_fn;\n+\n+\n \n assert(opcode <= MAX_HCALL_OPCODE);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void spapr_register_hypercall(target_ulong opcode, spapr_hcall_fn fn)\n\n{\n\n spapr_hcall_fn old_fn;\n\n\n\n assert(opcode <= MAX_HCALL_OPCODE);\n\n assert((opcode & 0x3) == 0);\n\n\n\n old_fn = hypercall_table[opcode / 4];\n\n\n\n assert(!old_fn || (fn == old_fn));\n\n\n\n hypercall_table[opcode / 4] = fn;\n\n}\n"}} {"sample_id": "2884cf205a9a29d89db7a444c5b1613cdfe37acf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n {\n \n int v = 4;\n+\n+\n+\n while (get_bits1(gb)) v++;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline int get_egolomb(GetBitContext *gb)\n\n{\n\n int v = 4;\n\n\n\n while (get_bits1(gb)) v++;\n\n\n\n return (1 << v) + get_bits(gb, v);\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_82", "diff": "--- a/source.c\n+++ b/source.c\n@@ -56,11 +56,11 @@\n \n if (conf->heads < 1 || conf->heads > heads_max) {\n \n+ error_setg(errp, \"heads must be between 1 and %u\", heads_max);\n+\n+ return;\n+\n+ }\n \n if (conf->secs < 1 || conf->secs > secs_max) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void blkconf_geometry(BlockConf *conf, int *ptrans,\n\n unsigned cyls_max, unsigned heads_max, unsigned secs_max,\n\n Error **errp)\n\n{\n\n DriveInfo *dinfo;\n\n\n\n if (!conf->cyls && !conf->heads && !conf->secs) {\n\n /* try to fall back to value set with legacy -drive cyls=... */\n\n dinfo = drive_get_by_blockdev(conf->bs);\n\n conf->cyls = dinfo->cyls;\n\n conf->heads = dinfo->heads;\n\n conf->secs = dinfo->secs;\n\n if (ptrans) {\n\n *ptrans = dinfo->trans;\n\n }\n\n }\n\n if (!conf->cyls && !conf->heads && !conf->secs) {\n\n hd_geometry_guess(conf->bs,\n\n &conf->cyls, &conf->heads, &conf->secs,\n\n ptrans);\n\n } else if (ptrans && *ptrans == BIOS_ATA_TRANSLATION_AUTO) {\n\n *ptrans = hd_bios_chs_auto_trans(conf->cyls, conf->heads, conf->secs);\n\n }\n\n if (conf->cyls || conf->heads || conf->secs) {\n\n if (conf->cyls < 1 || conf->cyls > cyls_max) {\n\n error_setg(errp, \"cyls must be between 1 and %u\", cyls_max);\n\n return;\n\n }\n\n if (conf->heads < 1 || conf->heads > heads_max) {\n\n error_setg(errp, \"heads must be between 1 and %u\", heads_max);\n\n return;\n\n }\n\n if (conf->secs < 1 || conf->secs > secs_max) {\n\n error_setg(errp, \"secs must be between 1 and %u\", secs_max);\n\n return;\n\n }\n\n }\n\n}\n"}} {"sample_id": "fd8b90f5f63de12c1ee1ec1cbe99791c5629c582", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+av_cold void ff_vp9dsp_init(VP9DSPContext *dsp, int bpp)\n \n {\n \n@@ -7,7 +7,7 @@\n ff_vp9dsp_init_8(dsp);\n \n } else if (bpp == 10) {\n+\n ff_vp9dsp_init_10(dsp);\n \n } else {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "av_cold void ff_vp9dsp_init(VP9DSPContext *dsp, int bpp)\n\n{\n\n if (bpp == 8) {\n\n ff_vp9dsp_init_8(dsp);\n\n } else if (bpp == 10) {\n\n ff_vp9dsp_init_10(dsp);\n\n } else {\n\n av_assert0(bpp == 12);\n\n ff_vp9dsp_init_12(dsp);\n\n }\n\n\n\n if (ARCH_X86) ff_vp9dsp_init_x86(dsp, bpp);\n\n if (ARCH_MIPS) ff_vp9dsp_init_mips(dsp, bpp);\n\n}\n"}} {"sample_id": "a39c5c4c6baafcef0c6ec7c6f59bc3fee81b2599", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void ff_dv_offset_reset(DVDemuxContext *c, int64_t frame_offset)\n \n+{\n \n c->frames= frame_offset;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void ff_dv_offset_reset(DVDemuxContext *c, int64_t frame_offset)\n\n{\n\n c->frames= frame_offset;\n\n if (c->ach)\n\n c->abytes= av_rescale_q(c->frames, c->sys->time_base,\n\n (AVRational){8, c->ast[0]->codec->bit_rate});\n\n c->audio_pkt[0].size = c->audio_pkt[1].size = 0;\n\n c->audio_pkt[2].size = c->audio_pkt[3].size = 0;\n\n}\n"}} {"sample_id": "eff235eb2bcd7092901f4698a7907e742f3b7f2f_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static ExitStatus trans_fop_wew_0e(DisasContext *ctx, uint32_t insn,\n \n const DisasInsn *di)\n+\n {\n \n unsigned rt = assemble_rt64(insn);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static ExitStatus trans_fop_wew_0e(DisasContext *ctx, uint32_t insn,\n\n const DisasInsn *di)\n\n{\n\n unsigned rt = assemble_rt64(insn);\n\n unsigned ra = assemble_ra64(insn);\n\n return do_fop_wew(ctx, rt, ra, di->f_wew);\n\n}\n"}} {"sample_id": "60be6340796e66b5ac8aac2d98dde5c79336a89c_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n void migration_bitmap_extend(ram_addr_t old, ram_addr_t new)\n+\n+{\n+\n /* called in qemu main thread, so there is\n+\n+ * no writing race against this migration_bitmap\n+\n */\n \n+ if (migration_bitmap) {\n+\n unsigned long *old_bitmap = migration_bitmap, *bitmap;\n \n bitmap = bitmap_new(new);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void migration_bitmap_extend(ram_addr_t old, ram_addr_t new)\n\n{\n\n /* called in qemu main thread, so there is\n\n * no writing race against this migration_bitmap\n\n */\n\n if (migration_bitmap) {\n\n unsigned long *old_bitmap = migration_bitmap, *bitmap;\n\n bitmap = bitmap_new(new);\n\n\n\n /* prevent migration_bitmap content from being set bit\n\n * by migration_bitmap_sync_range() at the same time.\n\n * it is safe to migration if migration_bitmap is cleared bit\n\n * at the same time.\n\n */\n\n qemu_mutex_lock(&migration_bitmap_mutex);\n\n bitmap_copy(bitmap, old_bitmap, old);\n\n bitmap_set(bitmap, old, new - old);\n\n atomic_rcu_set(&migration_bitmap, bitmap);\n\n qemu_mutex_unlock(&migration_bitmap_mutex);\n\n migration_dirty_pages += new - old;\n\n synchronize_rcu();\n\n g_free(old_bitmap);\n\n }\n\n}\n"}} {"sample_id": "b0f74c87a1dbd6b0c5e4de7f1c5cb40197e3fbe9_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static inline void menelaus_rtc_start(struct menelaus_s *s)\n \n+{\n \n s->rtc.next =+ qemu_get_clock(rt_clock);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void menelaus_rtc_start(struct menelaus_s *s)\n\n{\n\n s->rtc.next =+ qemu_get_clock(rt_clock);\n\n qemu_mod_timer(s->rtc.hz, s->rtc.next);\n\n}\n"}} {"sample_id": "32bafa8fdd098d52fbf1102d5a5e48d29398c0aa_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -52,8 +52,8 @@\n \n }\n \n+\n+\n+ return spec_info;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ImageInfoSpecific *vmdk_get_specific_info(BlockDriverState *bs)\n\n{\n\n int i;\n\n BDRVVmdkState *s = bs->opaque;\n\n ImageInfoSpecific *spec_info = g_new0(ImageInfoSpecific, 1);\n\n ImageInfoList **next;\n\n\n\n *spec_info = (ImageInfoSpecific){\n\n .type = IMAGE_INFO_SPECIFIC_KIND_VMDK,\n\n {\n\n .vmdk = g_new0(ImageInfoSpecificVmdk, 1),\n\n },\n\n };\n\n\n\n *spec_info->u.vmdk = (ImageInfoSpecificVmdk) {\n\n .create_type = g_strdup(s->create_type),\n\n .cid = s->cid,\n\n .parent_cid = s->parent_cid,\n\n };\n\n\n\n next = &spec_info->u.vmdk->extents;\n\n for (i = 0; i < s->num_extents; i++) {\n\n *next = g_new0(ImageInfoList, 1);\n\n (*next)->value = vmdk_get_extent_info(&s->extents[i]);\n\n (*next)->next = NULL;\n\n next = &(*next)->next;\n\n }\n\n\n\n return spec_info;\n\n}\n"}} {"sample_id": "b164d66e35d349de414e2f0d7365a147aba8a620_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n decoded1++;\n \n \n+\n+ /* Combined */\n+\n+ p->buf++;\n+\n \n \n /* Have we filled the history buffer? */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void predictor_decode_stereo(APEContext *ctx, int count)\n\n{\n\n APEPredictor *p = &ctx->predictor;\n\n int32_t *decoded0 = ctx->decoded[0];\n\n int32_t *decoded1 = ctx->decoded[1];\n\n\n\n while (count--) {\n\n /* Predictor Y */\n\n *decoded0 = predictor_update_filter(p, *decoded0, 0, YDELAYA, YDELAYB,\n\n YADAPTCOEFFSA, YADAPTCOEFFSB);\n\n decoded0++;\n\n *decoded1 = predictor_update_filter(p, *decoded1, 1, XDELAYA, XDELAYB,\n\n XADAPTCOEFFSA, XADAPTCOEFFSB);\n\n decoded1++;\n\n\n\n /* Combined */\n\n p->buf++;\n\n\n\n /* Have we filled the history buffer? */\n\n if (p->buf == p->historybuffer + HISTORY_SIZE) {\n\n memmove(p->historybuffer, p->buf,\n\n PREDICTOR_SIZE * sizeof(*p->historybuffer));\n\n p->buf = p->historybuffer;\n\n }\n\n }\n\n}\n"}} {"sample_id": "2d1a35bef0ed96b3f23535e459c552414ccdbafd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n /* Ignore regions with dirty logging, we cannot mark them dirty */\n \n+ if (memory_region_is_logging(section.mr)) {\n+\n+ goto out;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void *vring_map(MemoryRegion **mr, hwaddr phys, hwaddr len,\n\n bool is_write)\n\n{\n\n MemoryRegionSection section = memory_region_find(get_system_memory(), phys, len);\n\n\n\n if (!section.mr || int128_get64(section.size) < len) {\n\n goto out;\n\n }\n\n if (is_write && section.readonly) {\n\n goto out;\n\n }\n\n if (!memory_region_is_ram(section.mr)) {\n\n goto out;\n\n }\n\n\n\n /* Ignore regions with dirty logging, we cannot mark them dirty */\n\n if (memory_region_is_logging(section.mr)) {\n\n goto out;\n\n }\n\n\n\n *mr = section.mr;\n\n return memory_region_get_ram_ptr(section.mr) + section.offset_within_region;\n\n\n\nout:\n\n memory_region_unref(section.mr);\n\n *mr = NULL;\n\n return NULL;\n\n}\n"}} {"sample_id": "9ea242962c4093a5523deef124a98193bbb36730", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n int pw = w, ph = h;\n+\n Jpeg2000TgtNode *res, *t, *t2;\n \n int32_t tt_size;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "Jpeg2000TgtNode *ff_j2k_tag_tree_init(int w, int h)\n\n{\n\n int pw = w, ph = h;\n\n Jpeg2000TgtNode *res, *t, *t2;\n\n int32_t tt_size;\n\n\n\n tt_size = tag_tree_size(w, h);\n\n\n\n t = res = av_mallocz(tt_size, sizeof(*t));\n\n if (!res)\n\n return NULL;\n\n\n\n while (w > 1 || h > 1) {\n\n int i, j;\n\n pw = w;\n\n ph = h;\n\n\n\n w = (w + 1) >> 1;\n\n h = (h + 1) >> 1;\n\n t2 = t + pw * ph;\n\n\n\n for (i = 0; i < ph; i++)\n\n for (j = 0; j < pw; j++)\n\n t[i * pw + j].parent = &t2[(i >> 1) * w + (j >> 1)];\n\n\n\n t = t2;\n\n }\n\n t[0].parent = NULL;\n\n return res;\n\n}\n"}} {"sample_id": "eed752d61da332fb13e9893a175a90fed7b1d7d3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -38,11 +38,11 @@\n \n val += src[abs(sample_index + i)] * (FELEM2)filter[i];\n \n+ v2 += src[abs(sample_index + i)] * (FELEM2)filter[i + c->filter_length];\n+\n+ }\n+\n+ val += (v2 - val) * (FELEML)frac / c->src_incr;\n \n } else {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void SET_TYPE(resample_one)(ResampleContext *c,\n\n void *dst0, int dst_index, const void *src0,\n\n int src_size, int index, int frac)\n\n{\n\n FELEM *dst = dst0;\n\n const FELEM *src = src0;\n\n int i;\n\n int sample_index = index >> c->phase_shift;\n\n FELEM2 val = 0;\n\n FELEM *filter = ((FELEM *)c->filter_bank) +\n\n c->filter_length * (index & c->phase_mask);\n\n\n\n if (sample_index < 0) {\n\n for (i = 0; i < c->filter_length; i++)\n\n val += src[FFABS(sample_index + i) % src_size] *\n\n (FELEM2)filter[i];\n\n } else if (c->linear) {\n\n FELEM2 v2 = 0;\n\n for (i = 0; i < c->filter_length; i++) {\n\n val += src[abs(sample_index + i)] * (FELEM2)filter[i];\n\n v2 += src[abs(sample_index + i)] * (FELEM2)filter[i + c->filter_length];\n\n }\n\n val += (v2 - val) * (FELEML)frac / c->src_incr;\n\n } else {\n\n for (i = 0; i < c->filter_length; i++)\n\n val += src[sample_index + i] * (FELEM2)filter[i];\n\n }\n\n\n\n OUT(dst[dst_index], val);\n\n}\n"}} {"sample_id": "cc84de9570ffe01a9c3c169bd62ab9586a9a080c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n \n \n+ while (penv) {\n+\n+ penv->stop = 0;\n+\n+ penv->stopped = 0;\n \n qemu_thread_signal(penv->thread, SIGUSR1);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void resume_all_vcpus(void)\n\n{\n\n CPUState *penv = first_cpu;\n\n\n\n while (penv) {\n\n penv->stop = 0;\n\n penv->stopped = 0;\n\n qemu_thread_signal(penv->thread, SIGUSR1);\n\n qemu_cpu_kick(penv);\n\n penv = (CPUState *)penv->next_cpu;\n\n }\n\n}\n"}} {"sample_id": "c5a49c63fa26e8825ad101dfe86339ae4c216539_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void spr_read_tbl(DisasContext *ctx, int gprn, int sprn)\n+\n {\n \n if (ctx->tb->cflags & CF_USE_ICOUNT) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void spr_read_tbl(DisasContext *ctx, int gprn, int sprn)\n\n{\n\n if (ctx->tb->cflags & CF_USE_ICOUNT) {\n\n gen_io_start();\n\n }\n\n gen_helper_load_tbl(cpu_gpr[gprn], cpu_env);\n\n if (ctx->tb->cflags & CF_USE_ICOUNT) {\n\n gen_io_end();\n\n gen_stop_exception(ctx);\n\n }\n\n}\n"}} {"sample_id": "c47ee043dc2cc85da710e87524144a720598c096", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n BlockDriverState *bs = blk_bs(blk);\n \n+ char *id;\n+\n+\n \n /* blk_eject is only called by qdevified devices */\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void blk_eject(BlockBackend *blk, bool eject_flag)\n\n{\n\n BlockDriverState *bs = blk_bs(blk);\n\n char *id;\n\n\n\n /* blk_eject is only called by qdevified devices */\n\n assert(!blk->legacy_dev);\n\n\n\n if (bs) {\n\n bdrv_eject(bs, eject_flag);\n\n\n\n id = blk_get_attached_dev_id(blk);\n\n qapi_event_send_device_tray_moved(blk_name(blk), id,\n\n eject_flag, &error_abort);\n\n g_free(id);\n\n\n\n }\n\n}\n"}} {"sample_id": "aa8f057e74ae08014736a690ff41f76c756f75f1_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,10 +7,10 @@\n \n \n virtio_instance_init_common(obj, &dev->vdev, sizeof(dev->vdev),\n+\n+ TYPE_VIRTIO_CRYPTO);\n+\n+ object_property_add_alias(obj, \"cryptodev\", OBJECT(&dev->vdev),\n \n \"cryptodev\", &error_abort);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_crypto_initfn(Object *obj)\n\n{\n\n VirtIOCryptoPCI *dev = VIRTIO_CRYPTO_PCI(obj);\n\n\n\n virtio_instance_init_common(obj, &dev->vdev, sizeof(dev->vdev),\n\n TYPE_VIRTIO_CRYPTO);\n\n object_property_add_alias(obj, \"cryptodev\", OBJECT(&dev->vdev),\n\n \"cryptodev\", &error_abort);\n\n}\n"}} {"sample_id": "a4cc73d629d43c8a4d171d043ff229a959df3ca6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n return NULL;\n \n+ }\n+\n+\n+\n+ s = g_malloc0(sizeof(QEMUFileStdio));\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "QEMUFile *qemu_popen_cmd(const char *command, const char *mode)\n\n{\n\n FILE *stdio_file;\n\n QEMUFileStdio *s;\n\n\n\n stdio_file = popen(command, mode);\n\n if (stdio_file == NULL) {\n\n return NULL;\n\n }\n\n\n\n if (mode == NULL || (mode[0] != 'r' && mode[0] != 'w') || mode[1] != 0) {\n\n fprintf(stderr, \"qemu_popen: Argument validity check failed\\n\");\n\n return NULL;\n\n }\n\n\n\n s = g_malloc0(sizeof(QEMUFileStdio));\n\n\n\n s->stdio_file = stdio_file;\n\n\n\n if(mode[0] == 'r') {\n\n s->file = qemu_fopen_ops(s, &stdio_pipe_read_ops);\n\n } else {\n\n s->file = qemu_fopen_ops(s, &stdio_pipe_write_ops);\n\n }\n\n return s->file;\n\n}\n"}} {"sample_id": "ce5b1bbf624b977a55ff7f85bb3871682d03baff_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,7 +20,7 @@\n \n cc->reset = xtensa_cpu_reset;\n \n+\n \n cc->class_by_name = xtensa_cpu_class_by_name;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void xtensa_cpu_class_init(ObjectClass *oc, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(oc);\n\n CPUClass *cc = CPU_CLASS(oc);\n\n XtensaCPUClass *xcc = XTENSA_CPU_CLASS(cc);\n\n\n\n xcc->parent_realize = dc->realize;\n\n dc->realize = xtensa_cpu_realizefn;\n\n\n\n xcc->parent_reset = cc->reset;\n\n cc->reset = xtensa_cpu_reset;\n\n\n\n cc->class_by_name = xtensa_cpu_class_by_name;\n\n cc->has_work = xtensa_cpu_has_work;\n\n cc->do_interrupt = xtensa_cpu_do_interrupt;\n\n cc->cpu_exec_interrupt = xtensa_cpu_exec_interrupt;\n\n cc->dump_state = xtensa_cpu_dump_state;\n\n cc->set_pc = xtensa_cpu_set_pc;\n\n cc->gdb_read_register = xtensa_cpu_gdb_read_register;\n\n cc->gdb_write_register = xtensa_cpu_gdb_write_register;\n\n cc->gdb_stop_before_watchpoint = true;\n\n#ifndef CONFIG_USER_ONLY\n\n cc->do_unaligned_access = xtensa_cpu_do_unaligned_access;\n\n cc->get_phys_page_debug = xtensa_cpu_get_phys_page_debug;\n\n cc->do_unassigned_access = xtensa_cpu_do_unassigned_access;\n\n#endif\n\n cc->debug_excp_handler = xtensa_breakpoint_handler;\n\n dc->vmsd = &vmstate_xtensa_cpu;\n\n\n\n /*\n\n * Reason: xtensa_cpu_initfn() calls cpu_exec_init(), which saves\n\n * the object in cpus -> dangling pointer after final\n\n * object_unref().\n\n */\n\n dc->cannot_destroy_with_object_finalize_yet = true;\n\n}\n"}} {"sample_id": "fedf0d35aafc4f1f1e5f6dbc80cb23ae1ae49f0b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n int w1, x, y, last_width;\n \n+\n \n last_width = s->width;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void text_console_resize(QemuConsole *s)\n\n{\n\n TextCell *cells, *c, *c1;\n\n int w1, x, y, last_width;\n\n\n\n last_width = s->width;\n\n s->width = surface_width(s->surface) / FONT_WIDTH;\n\n s->height = surface_height(s->surface) / FONT_HEIGHT;\n\n\n\n w1 = last_width;\n\n if (s->width < w1)\n\n w1 = s->width;\n\n\n\n cells = g_malloc(s->width * s->total_height * sizeof(TextCell));\n\n for(y = 0; y < s->total_height; y++) {\n\n c = &cells[y * s->width];\n\n if (w1 > 0) {\n\n c1 = &s->cells[y * last_width];\n\n for(x = 0; x < w1; x++) {\n\n *c++ = *c1++;\n\n }\n\n }\n\n for(x = w1; x < s->width; x++) {\n\n c->ch = ' ';\n\n c->t_attrib = s->t_attrib_default;\n\n c++;\n\n }\n\n }\n\n g_free(s->cells);\n\n s->cells = cells;\n\n}\n"}} {"sample_id": "e1f2641b5926d20f63d36f0de45206be774da8da", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n static void monitor_puts(Monitor *mon, const char *str)\n \n {\n+\n char c;\n \n+\n+\n+ for(;;) {\n \n assert(mon->outbuf_index < sizeof(mon->outbuf) - 1);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void monitor_puts(Monitor *mon, const char *str)\n\n{\n\n char c;\n\n\n\n for(;;) {\n\n assert(mon->outbuf_index < sizeof(mon->outbuf) - 1);\n\n c = *str++;\n\n if (c == '\\0')\n\n break;\n\n if (c == '\\n')\n\n mon->outbuf[mon->outbuf_index++] = '\\r';\n\n mon->outbuf[mon->outbuf_index++] = c;\n\n if (mon->outbuf_index >= (sizeof(mon->outbuf) - 1)\n\n || c == '\\n')\n\n monitor_flush(mon);\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_149", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n uint32_t v;\n \n+ v = dp8393x_readw(opaque, addr);\n+\n+ v |= dp8393x_readw(opaque, addr + 2) << 16;\n \n return v;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t dp8393x_readl(void *opaque, target_phys_addr_t addr)\n\n{\n\n uint32_t v;\n\n v = dp8393x_readw(opaque, addr);\n\n v |= dp8393x_readw(opaque, addr + 2) << 16;\n\n return v;\n\n}\n"}} {"sample_id": "c689b4f1bac352dcfd6ecb9a1d45337de0f1de67", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,9 +6,9 @@\n \n int fd;\n \n+ int64_t ret = -1, handle;\n+\n+\n \n if (!has_mode) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "int64_t qmp_guest_file_open(const char *path, bool has_mode, const char *mode, Error **err)\n\n{\n\n FILE *fh;\n\n int fd;\n\n int64_t ret = -1, handle;\n\n\n\n if (!has_mode) {\n\n mode = \"r\";\n\n }\n\n slog(\"guest-file-open called, filepath: %s, mode: %s\", path, mode);\n\n fh = fopen(path, mode);\n\n if (!fh) {\n\n error_setg_errno(err, errno, \"failed to open file '%s' (mode: '%s')\",\n\n path, mode);\n\n return -1;\n\n }\n\n\n\n /* set fd non-blocking to avoid common use cases (like reading from a\n\n * named pipe) from hanging the agent\n\n */\n\n fd = fileno(fh);\n\n ret = fcntl(fd, F_GETFL);\n\n ret = fcntl(fd, F_SETFL, ret | O_NONBLOCK);\n\n if (ret == -1) {\n\n error_setg_errno(err, errno, \"failed to make file '%s' non-blocking\",\n\n path);\n\n fclose(fh);\n\n return -1;\n\n }\n\n\n\n handle = guest_file_handle_add(fh, err);\n\n if (error_is_set(err)) {\n\n fclose(fh);\n\n return -1;\n\n }\n\n\n\n slog(\"guest-file-open, handle: %d\", handle);\n\n return handle;\n\n}\n"}} {"sample_id": "747a0554ea8ad09404c1f5b80239ebd8d71b291e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int swf_write_packet(AVFormatContext *s, int stream_index, \n \n+ const uint8_t *buf, int size, int64_t pts)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int swf_write_packet(AVFormatContext *s, int stream_index, \n\n const uint8_t *buf, int size, int64_t pts)\n\n{\n\n AVCodecContext *codec = &s->streams[stream_index]->codec;\n\n if (codec->codec_type == CODEC_TYPE_AUDIO)\n\n return swf_write_audio(s, buf, size);\n\n else\n\n return swf_write_video(s, codec, buf, size);\n\n}\n"}} {"sample_id": "afc9c683ed9db01edb357bc8c19edad4282b3a97", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static int asf_build_simple_index(AVFormatContext *s, int stream_index)\n+{\n+ ff_asf_guid g;\n+ ASFContext *asf = s->priv_data;\n+ int64_t current_pos = avio_tell(s->pb);\n int64_t ret;\n if((ret = avio_seek(s->pb, asf->data_object_offset + asf->data_object_size, SEEK_SET)) < 0) {\n return ret;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int asf_build_simple_index(AVFormatContext *s, int stream_index)\n{\n ff_asf_guid g;\n ASFContext *asf = s->priv_data;\n int64_t current_pos = avio_tell(s->pb);\n int64_t ret;\n if((ret = avio_seek(s->pb, asf->data_object_offset + asf->data_object_size, SEEK_SET)) < 0) {\n return ret;\n if ((ret = ff_get_guid(s->pb, &g)) < 0)\n /* the data object can be followed by other top-level objects,\n * skip them until the simple index object is reached */\n while (ff_guidcmp(&g, &ff_asf_simple_index_header)) {\n int64_t gsize = avio_rl64(s->pb);\n if (gsize < 24 || avio_feof(s->pb)) {\n avio_skip(s->pb, gsize - 24);\n if ((ret = ff_get_guid(s->pb, &g)) < 0)\n {\n int64_t itime, last_pos = -1;\n int pct, ict;\n int i;\n int64_t av_unused gsize = avio_rl64(s->pb);\n if ((ret = ff_get_guid(s->pb, &g)) < 0)\n itime = avio_rl64(s->pb);\n pct = avio_rl32(s->pb);\n ict = avio_rl32(s->pb);\n av_log(s, AV_LOG_DEBUG,\n \"itime:0x%\"PRIx64\", pct:%d, ict:%d\\n\", itime, pct, ict);\n for (i = 0; i < ict; i++) {\n int pktnum = avio_rl32(s->pb);\n int pktct = avio_rl16(s->pb);\n int64_t pos = s->internal->data_offset + s->packet_size * (int64_t)pktnum;\n int64_t index_pts = FFMAX(av_rescale(itime, i, 10000) - asf->hdr.preroll, 0);\n if (pos != last_pos) {\n av_log(s, AV_LOG_DEBUG, \"pktnum:%d, pktct:%d pts: %\"PRId64\"\\n\",\n pktnum, pktct, index_pts);\n av_add_index_entry(s->streams[stream_index], pos, index_pts,\n s->packet_size, 0, AVINDEX_KEYFRAME);\n last_pos = pos;\n asf->index_read = ict > 1;\nend:\n// if (avio_feof(s->pb)) {\n// ret = 0;\n// }\n avio_seek(s->pb, current_pos, SEEK_SET);\n return ret;"}} {"sample_id": "474d858fd9551b45a17e1f3a4322de1a88e749b9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,8 +14,8 @@\n \n return ntohs(ssu.in6.sin6_port);\n \n+#endif\n+\n+ return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int get_port(const struct sockaddr_storage *ss)\n\n{\n\n sockaddr_union ssu = (sockaddr_union){.storage = *ss};\n\n if (ss->ss_family == AF_INET)\n\n return ntohs(ssu.in.sin_port);\n\n#if HAVE_STRUCT_SOCKADDR_IN6\n\n if (ss->ss_family == AF_INET6)\n\n return ntohs(ssu.in6.sin6_port);\n\n#endif\n\n return 0;\n\n}\n"}} {"sample_id": "7f0278435df1fa845b3bd9556942f89296d4246b_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n const char *qdict_get_try_str(const QDict *qdict, const char *key)\n+\n+{\n+\n+ QObject *obj;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "const char *qdict_get_try_str(const QDict *qdict, const char *key)\n\n{\n\n QObject *obj;\n\n\n\n obj = qdict_get(qdict, key);\n\n if (!obj || qobject_type(obj) != QTYPE_QSTRING)\n\n return NULL;\n\n\n\n return qstring_get_str(qobject_to_qstring(obj));\n\n}\n"}} {"sample_id": "b3f1c8c413bc83e4a2cc7a63e4eddf9fe6449052", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static void multipath_pr_init(void)\n+\n {\n+\n static struct udev *udev;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void multipath_pr_init(void)\n\n{\n\n static struct udev *udev;\n\n\n\n udev = udev_new();\n\n mpath_lib_init(udev);\n\n}\n"}} {"sample_id": "a9175169cc55ecff23a158dfee7d9cbb0b75d185", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n trace_user_do_rt_sigreturn(env, frame_addr);\n \n if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1)) {\n+\n goto badframe;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "long do_rt_sigreturn(CPUTLGState *env)\n\n{\n\n abi_ulong frame_addr = env->regs[TILEGX_R_SP];\n\n struct target_rt_sigframe *frame;\n\n sigset_t set;\n\n\n\n trace_user_do_rt_sigreturn(env, frame_addr);\n\n if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1)) {\n\n goto badframe;\n\n }\n\n target_to_host_sigset(&set, &frame->uc.tuc_sigmask);\n\n do_sigprocmask(SIG_SETMASK, &set, NULL);\n\n\n\n restore_sigcontext(env, &frame->uc.tuc_mcontext);\n\n if (do_sigaltstack(frame_addr + offsetof(struct target_rt_sigframe,\n\n uc.tuc_stack),\n\n 0, env->regs[TILEGX_R_SP]) == -EFAULT) {\n\n goto badframe;\n\n }\n\n\n\n unlock_user_struct(frame, frame_addr, 0);\n\n return env->regs[TILEGX_R_RE];\n\n\n\n\n\n badframe:\n\n unlock_user_struct(frame, frame_addr, 0);\n\n force_sig(TARGET_SIGSEGV);\n\n}\n"}} {"sample_id": "b2dfd71c4843a762f2befe702adb249cf55baf66", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n MemoryRegionSection *section)\n \n {\n+\n+ /* FIXME: implement */\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vhost_log_start(MemoryListener *listener,\n\n MemoryRegionSection *section)\n\n{\n\n /* FIXME: implement */\n\n}\n"}} {"sample_id": "a9d4a6ef3437d316450c2e30b9ed6a8fd4df4804", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n RMContext *rm = s->priv_data;\n+\n+ AVStream *st;\n+\n+\n \n rm->old_format = 1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int rm_read_header_old(AVFormatContext *s, AVFormatParameters *ap)\n\n{\n\n RMContext *rm = s->priv_data;\n\n AVStream *st;\n\n\n\n rm->old_format = 1;\n\n st = av_new_stream(s, 0);\n\n if (!st)\n\n goto fail;\n\n rm_read_audio_stream_info(s, st, 1);\n\n return 0;\n\n fail:\n\n return -1;\n\n}\n"}} {"sample_id": "1aaee43cf7a43ca8e7f12883ee7e3a35fe5eb84c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n \n \n+ if (QTAILQ_EMPTY(&mouse_handlers)) {\n+\n+ goto out;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void do_info_mice(Monitor *mon, QObject **ret_data)\n\n{\n\n QEMUPutMouseEntry *cursor;\n\n QList *mice_list;\n\n int current;\n\n\n\n mice_list = qlist_new();\n\n\n\n if (QTAILQ_EMPTY(&mouse_handlers)) {\n\n goto out;\n\n }\n\n\n\n current = QTAILQ_FIRST(&mouse_handlers)->index;\n\n\n\n QTAILQ_FOREACH(cursor, &mouse_handlers, node) {\n\n QObject *obj;\n\n obj = qobject_from_jsonf(\"{ 'name': %s, 'index': %d, 'current': %i }\",\n\n cursor->qemu_put_mouse_event_name,\n\n cursor->index,\n\n cursor->index == current);\n\n qlist_append_obj(mice_list, obj);\n\n }\n\n\n\nout:\n\n *ret_data = QOBJECT(mice_list);\n\n}\n"}} {"sample_id": "37f51384ae05bd50f83308339dbffa3e78404874_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n {\n \n IntelIOMMUNotifierNode *node;\n+\n+ VTDContextEntry ce;\n+\n+ int ret;\n+\n \n \n QLIST_FOREACH(node, &(s->notifiers_list), next) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vtd_iotlb_page_invalidate_notify(IntelIOMMUState *s,\n\n uint16_t domain_id, hwaddr addr,\n\n uint8_t am)\n\n{\n\n IntelIOMMUNotifierNode *node;\n\n VTDContextEntry ce;\n\n int ret;\n\n\n\n QLIST_FOREACH(node, &(s->notifiers_list), next) {\n\n VTDAddressSpace *vtd_as = node->vtd_as;\n\n ret = vtd_dev_to_context_entry(s, pci_bus_num(vtd_as->bus),\n\n vtd_as->devfn, &ce);\n\n if (!ret && domain_id == VTD_CONTEXT_ENTRY_DID(ce.hi)) {\n\n vtd_page_walk(&ce, addr, addr + (1 << am) * VTD_PAGE_SIZE,\n\n vtd_page_invalidate_notify_hook,\n\n (void *)&vtd_as->iommu, true);\n\n }\n\n }\n\n}\n"}} {"sample_id": "3b199d29cd597a3518136d78860e172060b9e83d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n RpzaContext *s = avctx->priv_data;\n \n \n+\n+ s->avctx = avctx;\n+\n+ avctx->pix_fmt = AV_PIX_FMT_RGB555;\n+\n \n \n s->frame.data[0] = NULL;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int rpza_decode_init(AVCodecContext *avctx)\n\n{\n\n RpzaContext *s = avctx->priv_data;\n\n\n\n s->avctx = avctx;\n\n avctx->pix_fmt = AV_PIX_FMT_RGB555;\n\n\n\n s->frame.data[0] = NULL;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "f22d85e9e67262db34504f4079745f9843da6a92", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n int64_t ret;\n \n Error *err = NULL;\n+\n+\n+\n+ if (guest_fsfreeze_state.status == GUEST_FSFREEZE_STATUS_FROZEN) {\n+\n ret = qmp_guest_fsfreeze_thaw(&err);\n \n if (ret < 0 || err) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void guest_fsfreeze_cleanup(void)\n\n{\n\n int64_t ret;\n\n Error *err = NULL;\n\n\n\n if (guest_fsfreeze_state.status == GUEST_FSFREEZE_STATUS_FROZEN) {\n\n ret = qmp_guest_fsfreeze_thaw(&err);\n\n if (ret < 0 || err) {\n\n slog(\"failed to clean up frozen filesystems\");\n\n }\n\n }\n\n}\n"}} {"sample_id": "d0cc2fbfa607678866475383c508be84818ceb64", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n return e->fd;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int event_notifier_get_fd(EventNotifier *e)\n\n{\n\n return e->fd;\n\n}\n"}} {"sample_id": "2caf19e90f270abe1e80a3e85acaf0eb5c9d0aac_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n int i;\n \n pixel *src = (pixel*)_src;\n+\n stride /= sizeof(pixel);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void FUNCC(pred16x16_horizontal)(uint8_t *_src, int stride){\n\n int i;\n\n pixel *src = (pixel*)_src;\n\n stride /= sizeof(pixel);\n\n\n\n for(i=0; i<16; i++){\n\n ((pixel4*)(src+i*stride))[0] =\n\n ((pixel4*)(src+i*stride))[1] =\n\n ((pixel4*)(src+i*stride))[2] =\n\n ((pixel4*)(src+i*stride))[3] = PIXEL_SPLAT_X4(src[-1+i*stride]);\n\n }\n\n}\n"}} {"sample_id": "6cf31ef263d36f6b89d9b64f15ca81cef4f24901_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void use_normal_update_speed(WmallDecodeCtx *s, int ich)\n \n {\n+\n int ilms, recent, icoef;\n \n s->update_speed[ich] = 8;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void use_normal_update_speed(WmallDecodeCtx *s, int ich)\n\n{\n\n int ilms, recent, icoef;\n\n s->update_speed[ich] = 8;\n\n for (ilms = s->cdlms_ttl[ich]; ilms >= 0; ilms--) {\n\n recent = s->cdlms[ich][ilms].recent;\n\n if (s->bV3RTM) {\n\n for (icoef = 0; icoef < s->cdlms[ich][ilms].order; icoef++)\n\n s->cdlms[ich][ilms].lms_updates[icoef + recent] /= 2;\n\n } else {\n\n for (icoef = 0; icoef < s->cdlms[ich][ilms].order; icoef++)\n\n s->cdlms[ich][ilms].lms_updates[icoef] /= 2;\n\n }\n\n }\n\n}\n"}} {"sample_id": "384acbf46b70edf0d2c1648aa1a92a90bcf7057d_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n QEMUBH *bh;\n \n+\n+\n+ for (bh = async_context->first_bh; bh; bh = bh->next) {\n+\n+ if (!bh->deleted && bh->scheduled) {\n \n if (bh->idle) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_bh_update_timeout(int *timeout)\n\n{\n\n QEMUBH *bh;\n\n\n\n for (bh = async_context->first_bh; bh; bh = bh->next) {\n\n if (!bh->deleted && bh->scheduled) {\n\n if (bh->idle) {\n\n /* idle bottom halves will be polled at least\n\n * every 10ms */\n\n *timeout = MIN(10, *timeout);\n\n } else {\n\n /* non-idle bottom halves will be executed\n\n * immediately */\n\n *timeout = 0;\n\n break;\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "02c4f26b1517d9e403ec10d6f6ca3c0276d19e43", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n BDRVQcowState *s = bs->opaque;\n \n+ Qcow2Cache *c;\n \n int i;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "Qcow2Cache *qcow2_cache_create(BlockDriverState *bs, int num_tables)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n Qcow2Cache *c;\n\n int i;\n\n\n\n c = g_malloc0(sizeof(*c));\n\n c->size = num_tables;\n\n c->entries = g_malloc0(sizeof(*c->entries) * num_tables);\n\n\n\n for (i = 0; i < c->size; i++) {\n\n c->entries[i].table = qemu_try_blockalign(bs->file, s->cluster_size);\n\n if (c->entries[i].table == NULL) {\n\n goto fail;\n\n }\n\n }\n\n\n\n return c;\n\n\n\nfail:\n\n for (i = 0; i < c->size; i++) {\n\n qemu_vfree(c->entries[i].table);\n\n }\n\n g_free(c->entries);\n\n g_free(c);\n\n return NULL;\n\n}\n"}} {"sample_id": "2b316774f60291f57ca9ecb6a9f0712c532cae34_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,7 +15,7 @@\n gsize bytes_read;\n \n \n+\n len = sizeof(buf);\n \n if (len > s->max_size) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static gboolean fd_chr_read(GIOChannel *chan, GIOCondition cond, void *opaque)\n\n{\n\n CharDriverState *chr = opaque;\n\n FDCharDriver *s = chr->opaque;\n\n int len;\n\n uint8_t buf[READ_BUF_LEN];\n\n GIOStatus status;\n\n gsize bytes_read;\n\n\n\n len = sizeof(buf);\n\n if (len > s->max_size) {\n\n len = s->max_size;\n\n }\n\n if (len == 0) {\n\n return TRUE;\n\n }\n\n\n\n status = g_io_channel_read_chars(chan, (gchar *)buf,\n\n len, &bytes_read, NULL);\n\n if (status == G_IO_STATUS_EOF) {\n\n if (s->fd_in_tag) {\n\n g_source_remove(s->fd_in_tag);\n\n s->fd_in_tag = 0;\n\n }\n\n qemu_chr_be_event(chr, CHR_EVENT_CLOSED);\n\n return FALSE;\n\n }\n\n if (status == G_IO_STATUS_NORMAL) {\n\n qemu_chr_be_write(chr, buf, bytes_read);\n\n }\n\n\n\n return TRUE;\n\n}\n"}} {"sample_id": "b67ea0cd74417b42482499c29feb90914fbf8097_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)\n+\n {\n \n return addr;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)\n\n{\n\n return addr;\n\n}\n"}} {"sample_id": "56706ac0d5723cb549fec2602e798ab1bf6004cd_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,8 +14,8 @@\n \n int *image_line;\n \n+ int frame_index;\n+\n const int numcomps = image->numcomps;\n \n \n@@ -28,7 +28,7 @@\n \n return 0;\n \n+ }\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int libopenjpeg_copy_unpacked8(AVCodecContext *avctx, const AVFrame *frame, opj_image_t *image)\n\n{\n\n int compno;\n\n int x;\n\n int y;\n\n int width;\n\n int height;\n\n int *image_line;\n\n int frame_index;\n\n const int numcomps = image->numcomps;\n\n\n\n for (compno = 0; compno < numcomps; ++compno) {\n\n if (image->comps[compno].w > frame->linesize[compno]) {\n\n av_log(avctx, AV_LOG_ERROR, \"Error: frame's linesize is too small for the image\\n\");\n\n return 0;\n\n }\n\n }\n\n\n\n for (compno = 0; compno < numcomps; ++compno) {\n\n width = avctx->width / image->comps[compno].dx;\n\n height = avctx->height / image->comps[compno].dy;\n\n for (y = 0; y < height; ++y) {\n\n image_line = image->comps[compno].data + y * image->comps[compno].w;\n\n frame_index = y * frame->linesize[compno];\n\n for (x = 0; x < width; ++x)\n\n image_line[x] = frame->data[compno][frame_index++];\n\n for (; x < image->comps[compno].w; ++x) {\n\n image_line[x] = image_line[x - 1];\n\n }\n\n }\n\n for (; y < image->comps[compno].h; ++y) {\n\n image_line = image->comps[compno].data + y * image->comps[compno].w;\n\n for (x = 0; x < image->comps[compno].w; ++x) {\n\n image_line[x] = image_line[x - image->comps[compno].w];\n\n }\n\n }\n\n }\n\n\n\n return 1;\n\n}\n"}} {"sample_id": "42a268c241183877192c376d03bd9b6d527407c7_49", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n /* No error here: 6 bits are used */\n \n tcg_gen_andi_i32(t0, arg2, 0x3F);\n+\n+ tcg_gen_brcondi_i32(TCG_COND_GE, t0, 32, l1);\n+\n+ tcg_gen_shr_i32(ret, arg1, t0);\n+\n tcg_gen_br(l2);\n \n gen_set_label(l1);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_op_evsrwu(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)\n\n{\n\n TCGv_i32 t0;\n\n int l1, l2;\n\n\n\n l1 = gen_new_label();\n\n l2 = gen_new_label();\n\n t0 = tcg_temp_local_new_i32();\n\n /* No error here: 6 bits are used */\n\n tcg_gen_andi_i32(t0, arg2, 0x3F);\n\n tcg_gen_brcondi_i32(TCG_COND_GE, t0, 32, l1);\n\n tcg_gen_shr_i32(ret, arg1, t0);\n\n tcg_gen_br(l2);\n\n gen_set_label(l1);\n\n tcg_gen_movi_i32(ret, 0);\n\n gen_set_label(l2);\n\n tcg_temp_free_i32(t0);\n\n}\n"}} {"sample_id": "97f90cbfe810bb153fc44bde732d9639610783bb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -51,11 +51,11 @@\n tcg_gen_shl_tl(cpu_R[dc->rd], cpu_R[dc->ra], t0);\n \n else {\n+\n+ if (t)\n+\n+ tcg_gen_sar_tl(cpu_R[dc->rd], cpu_R[dc->ra], t0);\n+\n else\n \n tcg_gen_shr_tl(cpu_R[dc->rd], cpu_R[dc->ra], t0);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void dec_barrel(DisasContext *dc)\n\n{\n\n TCGv t0;\n\n unsigned int s, t;\n\n\n\n if ((dc->tb_flags & MSR_EE_FLAG)\n\n && !(dc->env->pvr.regs[2] & PVR2_ILL_OPCODE_EXC_MASK)\n\n && !(dc->env->pvr.regs[0] & PVR0_USE_BARREL_MASK)) {\n\n tcg_gen_movi_tl(cpu_SR[SR_ESR], ESR_EC_ILLEGAL_OP);\n\n t_gen_raise_exception(dc, EXCP_HW_EXCP);\n\n return;\n\n }\n\n\n\n s = dc->imm & (1 << 10);\n\n t = dc->imm & (1 << 9);\n\n\n\n LOG_DIS(\"bs%s%s r%d r%d r%d\\n\",\n\n s ? \"l\" : \"r\", t ? \"a\" : \"l\", dc->rd, dc->ra, dc->rb);\n\n\n\n t0 = tcg_temp_new();\n\n\n\n tcg_gen_mov_tl(t0, *(dec_alu_op_b(dc)));\n\n tcg_gen_andi_tl(t0, t0, 31);\n\n\n\n if (s)\n\n tcg_gen_shl_tl(cpu_R[dc->rd], cpu_R[dc->ra], t0);\n\n else {\n\n if (t)\n\n tcg_gen_sar_tl(cpu_R[dc->rd], cpu_R[dc->ra], t0);\n\n else\n\n tcg_gen_shr_tl(cpu_R[dc->rd], cpu_R[dc->ra], t0);\n\n }\n\n}\n"}} {"sample_id": "fa66b909f382619da15f8c7e323145adfa94fdac_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n+void scsi_bus_legacy_handle_cmdline(SCSIBus *bus)\n \n+{\n \n DriveInfo *dinfo;\n \n int unit;\n \n+\n \n for (unit = 0; unit < MAX_SCSI_DEVS; unit++) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void scsi_bus_legacy_handle_cmdline(SCSIBus *bus)\n\n{\n\n DriveInfo *dinfo;\n\n int unit;\n\n\n\n for (unit = 0; unit < MAX_SCSI_DEVS; unit++) {\n\n dinfo = drive_get(IF_SCSI, bus->busnr, unit);\n\n if (dinfo == NULL) {\n\n continue;\n\n }\n\n scsi_bus_legacy_add_drive(bus, dinfo, unit);\n\n }\n\n}\n"}} {"sample_id": "d8173f264f732a4d14220816de2e54642115e2a7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -39,11 +39,11 @@\n \n \n ret = dv_extract_timecode(c->dv_demux, partial_frame, timecode);\n+\n+ if (ret)\n+\n+ av_dict_set(&s->metadata, \"timecode\", timecode, 0);\n+\n else if (ret < 0)\n \n av_log(s, AV_LOG_ERROR, \"Detected timecode is invalid\\n\");", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int dv_read_timecode(AVFormatContext *s) {\n\n int ret;\n\n char timecode[AV_TIMECODE_STR_SIZE];\n\n int64_t pos = avio_tell(s->pb);\n\n\n\n // Read 3 DIF blocks: Header block and 2 Subcode blocks.\n\n int partial_frame_size = 3 * 80;\n\n uint8_t *partial_frame = av_mallocz(sizeof(*partial_frame) *\n\n partial_frame_size);\n\n\n\n RawDVContext *c = s->priv_data;\n\n ret = avio_read(s->pb, partial_frame, partial_frame_size);\n\n if (ret < 0)\n\n goto finish;\n\n\n\n if (ret < partial_frame_size) {\n\n ret = -1;\n\n goto finish;\n\n }\n\n\n\n ret = dv_extract_timecode(c->dv_demux, partial_frame, timecode);\n\n if (ret)\n\n av_dict_set(&s->metadata, \"timecode\", timecode, 0);\n\n else if (ret < 0)\n\n av_log(s, AV_LOG_ERROR, \"Detected timecode is invalid\\n\");\n\n\n\nfinish:\n\n av_free(partial_frame);\n\n avio_seek(s->pb, pos, SEEK_SET);\n\n return ret;\n\n}\n"}} {"sample_id": "56706ac0d5723cb549fec2602e798ab1bf6004cd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,7 +27,7 @@\n return 0;\n \n }\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int libopenjpeg_copy_packed16(AVCodecContext *avctx, const AVFrame *frame, opj_image_t *image)\n\n{\n\n int compno;\n\n int x;\n\n int y;\n\n int *image_line;\n\n int frame_index;\n\n const int numcomps = image->numcomps;\n\n uint16_t *frame_ptr = (uint16_t*)frame->data[0];\n\n\n\n for (compno = 0; compno < numcomps; ++compno) {\n\n if (image->comps[compno].w > frame->linesize[0] / numcomps) {\n\n av_log(avctx, AV_LOG_ERROR, \"Error: frame's linesize is too small for the image\\n\");\n\n return 0;\n\n }\n\n }\n\n\n\n for (compno = 0; compno < numcomps; ++compno) {\n\n for (y = 0; y < avctx->height; ++y) {\n\n image_line = image->comps[compno].data + y * image->comps[compno].w;\n\n frame_index = y * (frame->linesize[0] / 2) + compno;\n\n for (x = 0; x < avctx->width; ++x) {\n\n image_line[x] = frame_ptr[frame_index];\n\n frame_index += numcomps;\n\n }\n\n for (; x < image->comps[compno].w; ++x) {\n\n image_line[x] = image_line[x - 1];\n\n }\n\n }\n\n for (; y < image->comps[compno].h; ++y) {\n\n image_line = image->comps[compno].data + y * image->comps[compno].w;\n\n for (x = 0; x < image->comps[compno].w; ++x) {\n\n image_line[x] = image_line[x - image->comps[compno].w];\n\n }\n\n }\n\n }\n\n\n\n return 1;\n\n}\n"}} {"sample_id": "c7269e3a2697c189c907832b8a36341cbb40936c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static int get_buffer(AVCodecContext *avctx, AVFrame *pic)\n+\n+{\n+\n pic->type = FF_BUFFER_TYPE_USER;\n \n pic->data[0] = (void *)1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int get_buffer(AVCodecContext *avctx, AVFrame *pic)\n\n{\n\n pic->type = FF_BUFFER_TYPE_USER;\n\n pic->data[0] = (void *)1;\n\n return 0;\n\n}\n"}} {"sample_id": "0188fadb7fe460d8c4c743372b1f7b25773e183e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n {\n \n+\tstruct sigframe_v1 *frame;\n+\n \tabi_ulong frame_addr = get_sigframe(ka, regs, sizeof(*frame));\n \n+\tint i;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void setup_frame_v1(int usig, struct target_sigaction *ka,\n\n target_sigset_t *set, CPUARMState *regs)\n\n{\n\n\tstruct sigframe_v1 *frame;\n\n\tabi_ulong frame_addr = get_sigframe(ka, regs, sizeof(*frame));\n\n\tint i;\n\n\n\n\tif (!lock_user_struct(VERIFY_WRITE, frame, frame_addr, 0))\n\n\t\treturn;\n\n\n\n\tsetup_sigcontext(&frame->sc, regs, set->sig[0]);\n\n\n\n for(i = 1; i < TARGET_NSIG_WORDS; i++) {\n\n if (__put_user(set->sig[i], &frame->extramask[i - 1]))\n\n goto end;\n\n\t}\n\n\n\n setup_return(regs, ka, &frame->retcode, frame_addr, usig,\n\n frame_addr + offsetof(struct sigframe_v1, retcode));\n\n\n\nend:\n\n\tunlock_user_struct(frame, frame_addr, 1);\n\n}\n"}} {"sample_id": "b7fa5c5abb39f819fbb42253711bc13e5cac0e81", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ int fd = open(file, O_RDONLY);\n \n int err = -1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int read_random(uint32_t *dst, const char *file)\n\n{\n\n int fd = open(file, O_RDONLY);\n\n int err = -1;\n\n\n\n if (fd == -1)\n\n return -1;\n\n#if HAVE_FCNTL && defined(O_NONBLOCK)\n\n if (fcntl(fd, F_SETFL, fcntl(fd, F_GETFL) | O_NONBLOCK) != -1)\n\n#endif\n\n err = read(fd, dst, sizeof(*dst));\n\n close(fd);\n\n\n\n return err;\n\n}\n"}} {"sample_id": "21ce148c7ec71ee32834061355a5ecfd1a11f90f_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static inline void cris_ftag_d(unsigned int x)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void cris_ftag_d(unsigned int x)\n\n{\n\n\tregister unsigned int v asm(\"$r10\") = x;\n\n\tasm (\"ftagd\\t[%0]\\n\" : : \"r\" (v) );\n\n}\n"}} {"sample_id": "a03ef88f77af045a2eb9629b5ce774a3fb973c5e_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,10 +9,10 @@\n int ret = bdrv_co_pwritev(bs->file->bs, offset, bytes, qiov, flags);\n \n block_request_create(reqid, bs, qemu_coroutine_self());\n+\n+ qemu_coroutine_yield();\n+\n+\n \n return ret;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int coroutine_fn blkreplay_co_pwritev(BlockDriverState *bs,\n\n uint64_t offset, uint64_t bytes, QEMUIOVector *qiov, int flags)\n\n{\n\n uint64_t reqid = request_id++;\n\n int ret = bdrv_co_pwritev(bs->file->bs, offset, bytes, qiov, flags);\n\n block_request_create(reqid, bs, qemu_coroutine_self());\n\n qemu_coroutine_yield();\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "7385aed20db5d83979f683b9d0048674411e963c_25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n float32 helper_fdtos(CPUSPARCState *env, float64 src)\n \n {\n+\n+ float32 ret;\n+\n clear_float_exceptions(env);\n \n ret = float64_to_float32(src, &env->fp_status);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "float32 helper_fdtos(CPUSPARCState *env, float64 src)\n\n{\n\n float32 ret;\n\n clear_float_exceptions(env);\n\n ret = float64_to_float32(src, &env->fp_status);\n\n check_ieee_exceptions(env);\n\n return ret;\n\n}\n"}} {"sample_id": "8d5c773e323b22402abdd0beef4c7d2fc91dd0eb_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n uint64_t value)\n \n {\n+\n+ ARMCPU *cpu = arm_env_get_cpu(env);\n+\n+\n+\n if (env->cp15.c1_sys == value) {\n \n /* Skip the TLB flush if nothing actually changed; Linux likes", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,\n\n uint64_t value)\n\n{\n\n ARMCPU *cpu = arm_env_get_cpu(env);\n\n\n\n if (env->cp15.c1_sys == value) {\n\n /* Skip the TLB flush if nothing actually changed; Linux likes\n\n * to do a lot of pointless SCTLR writes.\n\n */\n\n return;\n\n }\n\n\n\n env->cp15.c1_sys = value;\n\n /* ??? Lots of these bits are not implemented. */\n\n /* This may enable/disable the MMU, so do a TLB flush. */\n\n tlb_flush(CPU(cpu), 1);\n\n}\n"}} {"sample_id": "d1adad3cca407f493c3637e20ecd4f7124e69212_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n ydst+= lumStride;\n \n }\n+\n+#if COMPILE_TEMPLATE_MMX\n+\n+ __asm__(\n+\n EMMS\" \\n\\t\"\n \n SFENCE\" \\n\\t\"", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void RENAME(yuyvtoyuv420)(uint8_t *ydst, uint8_t *udst, uint8_t *vdst, const uint8_t *src,\n\n long width, long height,\n\n long lumStride, long chromStride, long srcStride)\n\n{\n\n long y;\n\n const long chromWidth= -((-width)>>1);\n\n\n\n for (y=0; ycount--;\n\n\n\n ret = laiocb->ret;\n\n if (ret != -ECANCELED) {\n\n if (ret == laiocb->nbytes)\n\n ret = 0;\n\n else if (ret >= 0)\n\n ret = -EINVAL;\n\n\n\n laiocb->common.cb(laiocb->common.opaque, ret);\n\n }\n\n\n\n qemu_aio_release(laiocb);\n\n}\n"}} {"sample_id": "78016694706776fbfe4be9533704be3180b31623", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static av_cold int vtenc_close(AVCodecContext *avctx)\n \n {\n+\n VTEncContext *vtctx = avctx->priv_data;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static av_cold int vtenc_close(AVCodecContext *avctx)\n\n{\n\n VTEncContext *vtctx = avctx->priv_data;\n\n\n\n if(!vtctx->session) return 0;\n\n\n\n VTCompressionSessionInvalidate(vtctx->session);\n\n pthread_cond_destroy(&vtctx->cv_sample_sent);\n\n pthread_mutex_destroy(&vtctx->lock);\n\n CFRelease(vtctx->session);\n\n vtctx->session = NULL;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "1e39d97af086d525cd0408eaa5d19783ea165906_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void gen_jmp_tb(DisasContext *s, target_ulong eip, int tb_num)\n+\n+{\n+\n+ gen_update_cc_op(s);\n+\n set_cc_op(s, CC_OP_DYNAMIC);\n \n if (s->jmp_opt) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gen_jmp_tb(DisasContext *s, target_ulong eip, int tb_num)\n\n{\n\n gen_update_cc_op(s);\n\n set_cc_op(s, CC_OP_DYNAMIC);\n\n if (s->jmp_opt) {\n\n gen_goto_tb(s, tb_num, eip);\n\n s->is_jmp = DISAS_TB_JUMP;\n\n } else {\n\n gen_jmp_im(eip);\n\n gen_eob(s);\n\n }\n\n}\n"}} {"sample_id": "8be7e7e4c72c048b90e3482557954a24bba43ba7_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ QemuOpts *opts;\n \n char *path, *optstr;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int unix_listen(const char *str, char *ostr, int olen)\n\n{\n\n QemuOpts *opts;\n\n char *path, *optstr;\n\n int sock, len;\n\n\n\n opts = qemu_opts_create(&dummy_opts, NULL, 0);\n\n\n\n optstr = strchr(str, ',');\n\n if (optstr) {\n\n len = optstr - str;\n\n if (len) {\n\n path = g_malloc(len+1);\n\n snprintf(path, len+1, \"%.*s\", len, str);\n\n qemu_opt_set(opts, \"path\", path);\n\n g_free(path);\n\n }\n\n } else {\n\n qemu_opt_set(opts, \"path\", str);\n\n }\n\n\n\n sock = unix_listen_opts(opts);\n\n\n\n if (sock != -1 && ostr)\n\n snprintf(ostr, olen, \"%s%s\", qemu_opt_get(opts, \"path\"), optstr ? optstr : \"\");\n\n qemu_opts_del(opts);\n\n return sock;\n\n}\n"}} {"sample_id": "ded67782e6d06069873adce7f9074d273ae75760", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n uint16_t temp;\n \n \n+\n ret = pci_device_load(&s->dev, f);\n \n if (ret < 0) {\n@@ -23,7 +23,7 @@\n qemu_get_be16s(f, &s->ar.pm1.evt.en);\n \n qemu_get_be16s(f, &s->ar.pm1.cnt.cnt);\n+\n \n \n ret = vmstate_load_state(f, &vmstate_apm, opaque, 1);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int acpi_load_old(QEMUFile *f, void *opaque, int version_id)\n\n{\n\n PIIX4PMState *s = opaque;\n\n int ret, i;\n\n uint16_t temp;\n\n\n\n ret = pci_device_load(&s->dev, f);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n qemu_get_be16s(f, &s->ar.pm1.evt.sts);\n\n qemu_get_be16s(f, &s->ar.pm1.evt.en);\n\n qemu_get_be16s(f, &s->ar.pm1.cnt.cnt);\n\n\n\n ret = vmstate_load_state(f, &vmstate_apm, opaque, 1);\n\n if (ret) {\n\n return ret;\n\n }\n\n\n\n qemu_get_timer(f, s->ar.tmr.timer);\n\n qemu_get_sbe64s(f, &s->ar.tmr.overflow_time);\n\n\n\n qemu_get_be16s(f, (uint16_t *)s->ar.gpe.sts);\n\n for (i = 0; i < 3; i++) {\n\n qemu_get_be16s(f, &temp);\n\n }\n\n\n\n qemu_get_be16s(f, (uint16_t *)s->ar.gpe.en);\n\n for (i = 0; i < 3; i++) {\n\n qemu_get_be16s(f, &temp);\n\n }\n\n\n\n ret = vmstate_load_state(f, &vmstate_pci_status, opaque, 1);\n\n return ret;\n\n}\n"}} {"sample_id": "544a3731591f5d53e15f22de00ce5ac758d490b3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static bool qapi_dealloc_start_union(Visitor *v, bool data_present,\n+\n Error **errp)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static bool qapi_dealloc_start_union(Visitor *v, bool data_present,\n\n Error **errp)\n\n{\n\n return data_present;\n\n}\n"}} {"sample_id": "954d94dd5e13ba7a5e9e049d0f980bddced9644c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n int scale = AV_RB16(in);\n \n int i;\n+\n int s0, s1, s2, d;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void adx_decode(ADXContext *c, int16_t *out, const uint8_t *in, int ch)\n\n{\n\n ADXChannelState *prev = &c->prev[ch];\n\n GetBitContext gb;\n\n int scale = AV_RB16(in);\n\n int i;\n\n int s0, s1, s2, d;\n\n\n\n init_get_bits(&gb, in + 2, (18 - 2) * 8);\n\n s1 = prev->s1;\n\n s2 = prev->s2;\n\n for (i = 0; i < 32; i++) {\n\n d = get_sbits(&gb, 4);\n\n s0 = (BASEVOL * d * scale + SCALE1 * s1 - SCALE2 * s2) >> 14;\n\n s2 = s1;\n\n s1 = av_clip_int16(s0);\n\n *out = s1;\n\n out += c->channels;\n\n }\n\n prev->s1 = s1;\n\n prev->s2 = s2;\n\n}\n"}} {"sample_id": "4524051c32190c1dc13ec2ccd122fd120dbed736", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n char *qemu_find_file(int type, const char *name)\n+\n {\n \n int len;\n@@ -12,14 +12,14 @@\n \n /* Try the name as a straight path first */\n \n+ if (access(name, R_OK) == 0) {\n+\n+ return g_strdup(name);\n+\n }\n+\n switch (type) {\n+\n case QEMU_FILE_TYPE_BIOS:\n \n subdir = \"\";", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "char *qemu_find_file(int type, const char *name)\n\n{\n\n int len;\n\n const char *subdir;\n\n char *buf;\n\n\n\n /* Try the name as a straight path first */\n\n if (access(name, R_OK) == 0) {\n\n return g_strdup(name);\n\n }\n\n switch (type) {\n\n case QEMU_FILE_TYPE_BIOS:\n\n subdir = \"\";\n\n break;\n\n case QEMU_FILE_TYPE_KEYMAP:\n\n subdir = \"keymaps/\";\n\n break;\n\n default:\n\n abort();\n\n }\n\n len = strlen(data_dir) + strlen(name) + strlen(subdir) + 2;\n\n buf = g_malloc0(len);\n\n snprintf(buf, len, \"%s/%s%s\", data_dir, subdir, name);\n\n if (access(buf, R_OK)) {\n\n g_free(buf);\n\n return NULL;\n\n }\n\n return buf;\n\n}\n"}} {"sample_id": "8c55ff393340998faae887dfac19e7ef128e1e58", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n return 0;\n \n+\n+\n+ for (i = 0; i < 3; i++) {\n+\n+ int hshift = (i > 0) ? h->chroma_x_shift : 0;\n \n int vshift = (i > 0) ? h->chroma_y_shift : 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int output_frame(H264Context *h, AVFrame *dst, Picture *srcp)\n\n{\n\n AVFrame *src = &srcp->f;\n\n int i;\n\n int ret = av_frame_ref(dst, src);\n\n if (ret < 0)\n\n return ret;\n\n\n\n av_dict_set(&dst->metadata, \"stereo_mode\", ff_h264_sei_stereo_mode(h), 0);\n\n\n\n if (!srcp->crop)\n\n return 0;\n\n\n\n for (i = 0; i < 3; i++) {\n\n int hshift = (i > 0) ? h->chroma_x_shift : 0;\n\n int vshift = (i > 0) ? h->chroma_y_shift : 0;\n\n int off = ((srcp->crop_left >> hshift) << h->pixel_shift) +\n\n (srcp->crop_top >> vshift) * dst->linesize[i];\n\n dst->data[i] += off;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "9643c25f8d67646857159d6fc021b07e7a659192", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,12 +2,12 @@\n \n gdb_reg_cb get_reg, gdb_reg_cb set_reg,\n \n+ int num_regs, const char *xml, int g_pos)\n+\n+{\n+\n+ GDBRegisterState *s;\n+\n GDBRegisterState **p;\n \n static int last_reg = NUM_CORE_REGS;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void gdb_register_coprocessor(CPUState * env,\n\n gdb_reg_cb get_reg, gdb_reg_cb set_reg,\n\n int num_regs, const char *xml, int g_pos)\n\n{\n\n GDBRegisterState *s;\n\n GDBRegisterState **p;\n\n static int last_reg = NUM_CORE_REGS;\n\n\n\n s = (GDBRegisterState *)g_malloc0(sizeof(GDBRegisterState));\n\n s->base_reg = last_reg;\n\n s->num_regs = num_regs;\n\n s->get_reg = get_reg;\n\n s->set_reg = set_reg;\n\n s->xml = xml;\n\n p = &env->gdb_regs;\n\n while (*p) {\n\n /* Check for duplicates. */\n\n if (strcmp((*p)->xml, xml) == 0)\n\n return;\n\n p = &(*p)->next;\n\n }\n\n /* Add to end of list. */\n\n last_reg += num_regs;\n\n *p = s;\n\n if (g_pos) {\n\n if (g_pos != s->base_reg) {\n\n fprintf(stderr, \"Error: Bad gdb register numbering for '%s'\\n\"\n\n \"Expected %d got %d\\n\", xml, g_pos, s->base_reg);\n\n } else {\n\n num_g_regs = last_reg;\n\n }\n\n }\n\n}\n"}} {"sample_id": "760d88d1d0c409f1afe6f1c91539487413e8b2a9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n if ((*pcc->interrupts_big_endian)(cpu)) {\n \n info->d_endian = ELFDATA2MSB;\n+\n+ } else {\n+\n+ info->d_endian = ELFDATA2LSB;\n+\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "int cpu_get_dump_info(ArchDumpInfo *info,\n\n const struct GuestPhysBlockList *guest_phys_blocks)\n\n{\n\n PowerPCCPU *cpu = POWERPC_CPU(first_cpu);\n\n PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);\n\n\n\n info->d_machine = EM_PPC64;\n\n info->d_class = ELFCLASS64;\n\n if ((*pcc->interrupts_big_endian)(cpu)) {\n\n info->d_endian = ELFDATA2MSB;\n\n } else {\n\n info->d_endian = ELFDATA2LSB;\n\n\n\n\n\n\n\n\n\n return 0;\n"}} {"sample_id": "297a3646c2947ee64a6d42ca264039732c6218e0_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n static void visit_type_TestStruct(Visitor *v, TestStruct **obj,\n+\n const char *name, Error **errp)\n \n+{\n \n Error *err = NULL;\n \n \n+\n visit_start_struct(v, (void **)obj, \"TestStruct\", name, sizeof(TestStruct),\n \n &err);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void visit_type_TestStruct(Visitor *v, TestStruct **obj,\n\n const char *name, Error **errp)\n\n{\n\n Error *err = NULL;\n\n\n\n visit_start_struct(v, (void **)obj, \"TestStruct\", name, sizeof(TestStruct),\n\n &err);\n\n if (err) {\n\n goto out;\n\n }\n\n\n\n visit_type_int(v, &(*obj)->integer, \"integer\", &err);\n\n visit_type_bool(v, &(*obj)->boolean, \"boolean\", &err);\n\n visit_type_str(v, &(*obj)->string, \"string\", &err);\n\n\n\n visit_end_struct(v, &err);\n\n\n\nout:\n\n error_propagate(errp, err);\n\n}\n"}} {"sample_id": "c9262e8a84a29f22fbb5edde5d17f4f6166d5ae1_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n int sec_num = ((rec_list2 >> 32) & 0xffff) + 1;\n \n+ int sec_len = rec_list2 >> 48;\n \n ulong addr = (ulong)load_addr;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "unsigned long virtio_load_direct(ulong rec_list1, ulong rec_list2,\n\n ulong subchan_id, void *load_addr)\n\n{\n\n u8 status;\n\n int sec = rec_list1;\n\n int sec_num = ((rec_list2 >> 32) & 0xffff) + 1;\n\n int sec_len = rec_list2 >> 48;\n\n ulong addr = (ulong)load_addr;\n\n\n\n if (sec_len != virtio_get_block_size()) {\n\n return -1;\n\n }\n\n\n\n sclp_print(\".\");\n\n status = virtio_read_many(sec, (void *)addr, sec_num);\n\n if (status) {\n\n virtio_panic(\"I/O Error\");\n\n }\n\n addr += sec_num * virtio_get_block_size();\n\n\n\n return addr;\n\n}\n"}} {"sample_id": "de9e9d9f17a36ff76c1a02a5348835e5e0a081b0_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static inline void gen_op_eval_fblg(TCGv dst, TCGv src,\n+\n+ unsigned int fcc_offset)\n+\n {\n \n gen_mov_reg_FCC0(dst, src, fcc_offset);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_op_eval_fblg(TCGv dst, TCGv src,\n\n unsigned int fcc_offset)\n\n{\n\n gen_mov_reg_FCC0(dst, src, fcc_offset);\n\n gen_mov_reg_FCC1(cpu_tmp0, src, fcc_offset);\n\n tcg_gen_xor_tl(dst, dst, cpu_tmp0);\n\n}\n"}} {"sample_id": "5c720657c23afd798ae0db7c7362eb859a89ab3d_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,13 +2,13 @@\n \n {\n \n+ AVStream *st;\n \n \n \n if (c->fc->nb_streams < 1)\n \n+ return 0;\n \n st = c->fc->streams[c->fc->nb_streams-1];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int mov_read_smi(MOVContext *c, AVIOContext *pb, MOVAtom atom)\n\n{\n\n AVStream *st;\n\n\n\n if (c->fc->nb_streams < 1)\n\n return 0;\n\n st = c->fc->streams[c->fc->nb_streams-1];\n\n\n\n if ((uint64_t)atom.size > (1<<30))\n\n return AVERROR_INVALIDDATA;\n\n\n\n // currently SVQ3 decoder expect full STSD header - so let's fake it\n\n // this should be fixed and just SMI header should be passed\n\n av_free(st->codec->extradata);\n\n st->codec->extradata = av_mallocz(atom.size + 0x5a + FF_INPUT_BUFFER_PADDING_SIZE);\n\n if (!st->codec->extradata)\n\n return AVERROR(ENOMEM);\n\n st->codec->extradata_size = 0x5a + atom.size;\n\n memcpy(st->codec->extradata, \"SVQ3\", 4); // fake\n\n avio_read(pb, st->codec->extradata + 0x5a, atom.size);\n\n av_log(c->fc, AV_LOG_TRACE, \"Reading SMI %\"PRId64\" %s\\n\", atom.size, st->codec->extradata + 0x5a);\n\n return 0;\n\n}\n"}} {"sample_id": "a0efbf16604770b9d805bcf210ec29942321134f_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n for (i = 0; i < debug_regions->len; i++) {\n \n+ Range *range = &g_array_index(debug_regions, Range, i);\n+\n+ if (addr >= range->begin && addr <= range->end - 1) {\n+\n+ return true;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool qemu_log_in_addr_range(uint64_t addr)\n\n{\n\n if (debug_regions) {\n\n int i = 0;\n\n for (i = 0; i < debug_regions->len; i++) {\n\n Range *range = &g_array_index(debug_regions, Range, i);\n\n if (addr >= range->begin && addr <= range->end - 1) {\n\n return true;\n\n }\n\n }\n\n return false;\n\n } else {\n\n return true;\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_52", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n uint32_t value)\n \n+{\n+\n+ uint32_t addr;\n+\n+ uint16_t mask;\n \n uint16_t v;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bitband_writew(void *opaque, target_phys_addr_t offset,\n\n uint32_t value)\n\n{\n\n uint32_t addr;\n\n uint16_t mask;\n\n uint16_t v;\n\n addr = bitband_addr(opaque, offset) & ~1;\n\n mask = (1 << ((offset >> 2) & 15));\n\n mask = tswap16(mask);\n\n cpu_physical_memory_read(addr, (uint8_t *)&v, 2);\n\n if (value & 1)\n\n v |= mask;\n\n else\n\n v &= ~mask;\n\n cpu_physical_memory_write(addr, (uint8_t *)&v, 2);\n\n}\n"}} {"sample_id": "818584a43ab0ef52c131865128ef110f867726cd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void bdrv_inherited_options(int *child_flags, QDict *child_options,\n \n+ int parent_flags, QDict *parent_options)\n+\n+{\n+\n+ int flags = parent_flags;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bdrv_inherited_options(int *child_flags, QDict *child_options,\n\n int parent_flags, QDict *parent_options)\n\n{\n\n int flags = parent_flags;\n\n\n\n /* Enable protocol handling, disable format probing for bs->file */\n\n flags |= BDRV_O_PROTOCOL;\n\n\n\n /* If the cache mode isn't explicitly set, inherit direct and no-flush from\n\n * the parent. */\n\n qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_DIRECT);\n\n qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_NO_FLUSH);\n\n\n\n /* Inherit the read-only option from the parent if it's not set */\n\n qdict_copy_default(child_options, parent_options, BDRV_OPT_READ_ONLY);\n\n\n\n /* Our block drivers take care to send flushes and respect unmap policy,\n\n * so we can default to enable both on lower layers regardless of the\n\n * corresponding parent options. */\n\n flags |= BDRV_O_UNMAP;\n\n\n\n /* Clear flags that only apply to the top layer */\n\n flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING | BDRV_O_COPY_ON_READ |\n\n BDRV_O_NO_IO);\n\n\n\n *child_flags = flags;\n\n}\n"}} {"sample_id": "a2f55f22b342202e6925561b9ee0b7ec76e8bcd0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,10 +2,10 @@\n \n {\n \n+ const MXFCodecUL *uls = ff_mxf_essence_container_uls;\n+\n+ while (uls->id != CODEC_ID_NONE) {\n+\n if (uls->id == type)\n \n break;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static const MXFCodecUL *mxf_get_essence_container_ul(enum CodecID type)\n\n{\n\n const MXFCodecUL *uls = ff_mxf_essence_container_uls;\n\n while (uls->id != CODEC_ID_NONE) {\n\n if (uls->id == type)\n\n break;\n\n uls++;\n\n }\n\n return uls;\n\n}\n"}} {"sample_id": "b56d417b8d7548e913d928809ce6bb1d6c2563e2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,7 +16,7 @@\n \n return 0;\n \n+ }\n \n /* Normal 4kiB page */\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static unsigned hpte_page_shift(const struct ppc_one_seg_page_size *sps,\n\n uint64_t pte0, uint64_t pte1)\n\n{\n\n int i;\n\n\n\n if (!(pte0 & HPTE64_V_LARGE)) {\n\n if (sps->page_shift != 12) {\n\n /* 4kiB page in a non 4kiB segment */\n\n return 0;\n\n }\n\n /* Normal 4kiB page */\n\n return 12;\n\n }\n\n\n\n for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {\n\n const struct ppc_one_page_size *ps = &sps->enc[i];\n\n uint64_t mask;\n\n\n\n if (!ps->page_shift) {\n\n break;\n\n }\n\n\n\n if (ps->page_shift == 12) {\n\n /* L bit is set so this can't be a 4kiB page */\n\n continue;\n\n }\n\n\n\n mask = ((1ULL << ps->page_shift) - 1) & HPTE64_R_RPN;\n\n\n\n if ((pte1 & mask) == (ps->pte_enc << HPTE64_R_RPN_SHIFT)) {\n\n return ps->page_shift;\n\n }\n\n }\n\n\n\n return 0; /* Bad page size encoding */\n\n}\n"}} {"sample_id": "44d691f7d9b6ebab102a31aa87fe59da8f7feff9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void spapr_core_unplug(HotplugHandler *hotplug_dev, DeviceState *dev,\n+\n+ Error **errp)\n+\n+{\n \n sPAPRCPUCore *core = SPAPR_CPU_CORE(OBJECT(dev));\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void spapr_core_unplug(HotplugHandler *hotplug_dev, DeviceState *dev,\n\n Error **errp)\n\n{\n\n sPAPRCPUCore *core = SPAPR_CPU_CORE(OBJECT(dev));\n\n PowerPCCPU *cpu = POWERPC_CPU(core->threads);\n\n int id = ppc_get_vcpu_dt_id(cpu);\n\n sPAPRDRConnector *drc =\n\n spapr_dr_connector_by_id(SPAPR_DR_CONNECTOR_TYPE_CPU, id);\n\n sPAPRDRConnectorClass *drck;\n\n Error *local_err = NULL;\n\n\n\n g_assert(drc);\n\n\n\n drck = SPAPR_DR_CONNECTOR_GET_CLASS(drc);\n\n drck->detach(drc, dev, spapr_core_release, NULL, &local_err);\n\n if (local_err) {\n\n error_propagate(errp, local_err);\n\n return;\n\n }\n\n\n\n spapr_hotplug_req_remove_by_index(drc);\n\n}\n"}} {"sample_id": "ae4cffd9fc5bc495692920d646d7d1462315cfa6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n \t\tYSCALE_YUV_2_RGBX_C(uint8_t)\n \n \t\t\t((uint8_t*)dest)[0]= r[Y1];\n+\n+\t\t\t((uint8_t*)dest)[1]= g[Y1];\n+\n+\t\t\t((uint8_t*)dest)[2]= b[Y1];\n+\n \t\t\t((uint8_t*)dest)[3]= r[Y2];\n \n \t\t\t((uint8_t*)dest)[4]= g[Y2];", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void yuv2packedXinC(SwsContext *c, int16_t *lumFilter, int16_t **lumSrc, int lumFilterSize,\n\n\t\t\t\t int16_t *chrFilter, int16_t **chrSrc, int chrFilterSize,\n\n\t\t\t\t uint8_t *dest, int dstW, int y)\n\n{\n\n\tint i;\n\n\tswitch(c->dstFormat)\n\n\t{\n\n\tcase IMGFMT_RGB32:\n\n\tcase IMGFMT_BGR32:\n\n\t\tYSCALE_YUV_2_RGBX_C(uint32_t)\n\n\t\t\t((uint32_t*)dest)[i2+0]= r[Y1] + g[Y1] + b[Y1];\n\n\t\t\t((uint32_t*)dest)[i2+1]= r[Y2] + g[Y2] + b[Y2];\n\n\t\t}\n\n\t\tbreak;\n\n\tcase IMGFMT_RGB24:\n\n\t\tYSCALE_YUV_2_RGBX_C(uint8_t)\n\n\t\t\t((uint8_t*)dest)[0]= r[Y1];\n\n\t\t\t((uint8_t*)dest)[1]= g[Y1];\n\n\t\t\t((uint8_t*)dest)[2]= b[Y1];\n\n\t\t\t((uint8_t*)dest)[3]= r[Y2];\n\n\t\t\t((uint8_t*)dest)[4]= g[Y2];\n\n\t\t\t((uint8_t*)dest)[5]= b[Y2];\n\n\t\t\t((uint8_t*)dest)+=6;\n\n\t\t}\n"}} {"sample_id": "4fa62005d0a85df9bb14ea9f53109d7c5f66eeb9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n+static void coroutine_fn v9fs_fix_fid_paths(V9fsPDU *pdu, V9fsPath *olddir,\n \n V9fsString *old_name,\n \n V9fsPath *newdir,\n \n+ V9fsString *new_name)\n+\n {\n \n V9fsFidState *tfidp;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void coroutine_fn v9fs_fix_fid_paths(V9fsPDU *pdu, V9fsPath *olddir,\n\n V9fsString *old_name,\n\n V9fsPath *newdir,\n\n V9fsString *new_name)\n\n{\n\n V9fsFidState *tfidp;\n\n V9fsPath oldpath, newpath;\n\n V9fsState *s = pdu->s;\n\n\n\n\n\n v9fs_path_init(&oldpath);\n\n v9fs_path_init(&newpath);\n\n v9fs_co_name_to_path(pdu, olddir, old_name->data, &oldpath);\n\n v9fs_co_name_to_path(pdu, newdir, new_name->data, &newpath);\n\n\n\n /*\n\n * Fixup fid's pointing to the old name to\n\n * start pointing to the new name\n\n */\n\n for (tfidp = s->fid_list; tfidp; tfidp = tfidp->next) {\n\n if (v9fs_path_is_ancestor(&oldpath, &tfidp->path)) {\n\n /* replace the name */\n\n v9fs_fix_path(&tfidp->path, &newpath, strlen(oldpath.data));\n\n }\n\n }\n\n v9fs_path_free(&oldpath);\n\n v9fs_path_free(&newpath);\n\n}\n"}} {"sample_id": "297a3646c2947ee64a6d42ca264039732c6218e0_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void visit_type_number(Visitor *v, double *obj, const char *name, Error **errp)\n+\n+{\n \n if (!error_is_set(errp)) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void visit_type_number(Visitor *v, double *obj, const char *name, Error **errp)\n\n{\n\n if (!error_is_set(errp)) {\n\n v->type_number(v, obj, name, errp);\n\n }\n\n}\n"}} {"sample_id": "fd34dbea58e097609ff09cf7dcc59f74930195d3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int mxf_read_track(void *arg, AVIOContext *pb, int tag, int size, UID uid)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int mxf_read_track(void *arg, AVIOContext *pb, int tag, int size, UID uid)\n\n{\n\n MXFTrack *track = arg;\n\n switch(tag) {\n\n case 0x4801:\n\n track->track_id = avio_rb32(pb);\n\n break;\n\n case 0x4804:\n\n avio_read(pb, track->track_number, 4);\n\n break;\n\n case 0x4B01:\n\n track->edit_rate.den = avio_rb32(pb);\n\n track->edit_rate.num = avio_rb32(pb);\n\n break;\n\n case 0x4803:\n\n avio_read(pb, track->sequence_ref, 16);\n\n break;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "e509df4bc8eb3aebdda71b826955d581e717fb0e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -65,9 +65,9 @@\n if (frame != out_frame)\n \n av_frame_free(&frame);\n+\n+\n+\n+ return ff_filter_frame(ctx->outputs[0], out_frame);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int compand_nodelay(AVFilterContext *ctx, AVFrame *frame)\n\n{\n\n CompandContext *s = ctx->priv;\n\n AVFilterLink *inlink = ctx->inputs[0];\n\n const int channels = inlink->channels;\n\n const int nb_samples = frame->nb_samples;\n\n AVFrame *out_frame;\n\n int chan, i;\n\n\n\n if (av_frame_is_writable(frame)) {\n\n out_frame = frame;\n\n } else {\n\n out_frame = ff_get_audio_buffer(inlink, nb_samples);\n\n if (!out_frame) {\n\n av_frame_free(&frame);\n\n return AVERROR(ENOMEM);\n\n }\n\n av_frame_copy_props(out_frame, frame);\n\n }\n\n\n\n for (chan = 0; chan < channels; chan++) {\n\n const double *src = (double *)frame->extended_data[chan];\n\n double *dst = (double *)out_frame->extended_data[chan];\n\n ChanParam *cp = &s->channels[chan];\n\n\n\n for (i = 0; i < nb_samples; i++) {\n\n update_volume(cp, fabs(src[i]));\n\n\n\n dst[i] = av_clipd(src[i] * get_volume(s, cp->volume), -1, 1);\n\n }\n\n }\n\n\n\n if (frame != out_frame)\n\n av_frame_free(&frame);\n\n\n\n return ff_filter_frame(ctx->outputs[0], out_frame);\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_59", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void pollfds_poll(GArray *pollfds, int nfds, fd_set *rfds,\n+\n+ fd_set *wfds, fd_set *xfds)\n+\n+{\n+\n int i;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pollfds_poll(GArray *pollfds, int nfds, fd_set *rfds,\n\n fd_set *wfds, fd_set *xfds)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < pollfds->len; i++) {\n\n GPollFD *pfd = &g_array_index(pollfds, GPollFD, i);\n\n int fd = pfd->fd;\n\n int revents = 0;\n\n\n\n if (FD_ISSET(fd, rfds)) {\n\n revents |= G_IO_IN;\n\n }\n\n if (FD_ISSET(fd, wfds)) {\n\n revents |= G_IO_OUT;\n\n }\n\n if (FD_ISSET(fd, xfds)) {\n\n revents |= G_IO_PRI;\n\n }\n\n pfd->revents = revents & pfd->events;\n\n }\n\n}\n"}} {"sample_id": "6c5819c4d685bf5f3c81edb462f4d17fb99ca2b5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ MacIOState *s = MACIO(d);\n \n NewWorldMacIOState *ns = NEWWORLD_MACIO(d);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int macio_newworld_initfn(PCIDevice *d)\n\n{\n\n MacIOState *s = MACIO(d);\n\n NewWorldMacIOState *ns = NEWWORLD_MACIO(d);\n\n SysBusDevice *sysbus_dev;\n\n MemoryRegion *timer_memory = g_new(MemoryRegion, 1);\n\n int i;\n\n int cur_irq = 0;\n\n int ret = macio_common_initfn(d);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n\n\n sysbus_dev = SYS_BUS_DEVICE(&s->cuda);\n\n sysbus_connect_irq(sysbus_dev, 0, ns->irqs[cur_irq++]);\n\n\n\n if (s->pic_mem) {\n\n /* OpenPIC */\n\n memory_region_add_subregion(&s->bar, 0x40000, s->pic_mem);\n\n }\n\n\n\n /* IDE buses */\n\n for (i = 0; i < ARRAY_SIZE(ns->ide); i++) {\n\n qemu_irq irq0 = ns->irqs[cur_irq++];\n\n qemu_irq irq1 = ns->irqs[cur_irq++];\n\n\n\n ret = macio_initfn_ide(s, &ns->ide[i], irq0, irq1, 0x16 + (i * 4));\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n }\n\n\n\n /* Timer */\n\n memory_region_init_io(timer_memory, OBJECT(s), &timer_ops, NULL, \"timer\",\n\n 0x1000);\n\n memory_region_add_subregion(&s->bar, 0x15000, timer_memory);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d6f723b513a0c3c4e58343b7c52a2f9850861fa0_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void test_qemu_strtoull_max(void)\n+\n {\n \n const char *str = g_strdup_printf(\"%llu\", ULLONG_MAX);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void test_qemu_strtoull_max(void)\n\n{\n\n const char *str = g_strdup_printf(\"%llu\", ULLONG_MAX);\n\n char f = 'X';\n\n const char *endptr = &f;\n\n uint64_t res = 999;\n\n int err;\n\n\n\n err = qemu_strtoull(str, &endptr, 0, &res);\n\n\n\n g_assert_cmpint(err, ==, 0);\n\n g_assert_cmpint(res, ==, ULLONG_MAX);\n\n g_assert(endptr == str + strlen(str));\n\n}\n"}} {"sample_id": "478f1c3d5e5463a284ea7efecfc62d47ba3be11a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int decode_phys_chunk(AVCodecContext *avctx, PNGDecContext *s)\n+\n {\n \n if (s->state & PNG_IDAT) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int decode_phys_chunk(AVCodecContext *avctx, PNGDecContext *s)\n\n{\n\n if (s->state & PNG_IDAT) {\n\n av_log(avctx, AV_LOG_ERROR, \"pHYs after IDAT\\n\");\n\n return AVERROR_INVALIDDATA;\n\n }\n\n avctx->sample_aspect_ratio.num = bytestream2_get_be32(&s->gb);\n\n avctx->sample_aspect_ratio.den = bytestream2_get_be32(&s->gb);\n\n if (avctx->sample_aspect_ratio.num < 0 || avctx->sample_aspect_ratio.den < 0)\n\n avctx->sample_aspect_ratio = (AVRational){ 0, 1 };\n\n bytestream2_skip(&s->gb, 1); /* unit specifier */\n\n bytestream2_skip(&s->gb, 4); /* crc */\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d59ce6f34434bf47a9b26138c908650bf9a24be1_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+const char *error_get_pretty(Error *err)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "const char *error_get_pretty(Error *err)\n\n{\n\n return err->msg;\n\n}\n"}} {"sample_id": "1acd7d594c15aa491729c837ad3519d3469e620a_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n void FUNCC(ff_h264_idct8_dc_add)(uint8_t *_dst, int16_t *block, int stride){\n \n int i, j;\n+\n+ int dc = (((dctcoef*)block)[0] + 32) >> 6;\n+\n+ pixel *dst = (pixel*)_dst;\n+\n stride >>= sizeof(pixel)-1;\n \n for( j = 0; j < 8; j++ )", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void FUNCC(ff_h264_idct8_dc_add)(uint8_t *_dst, int16_t *block, int stride){\n\n int i, j;\n\n int dc = (((dctcoef*)block)[0] + 32) >> 6;\n\n pixel *dst = (pixel*)_dst;\n\n stride >>= sizeof(pixel)-1;\n\n for( j = 0; j < 8; j++ )\n\n {\n\n for( i = 0; i < 8; i++ )\n\n dst[i] = av_clip_pixel( dst[i] + dc );\n\n dst += stride;\n\n }\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_78", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n bdrv_get_geometry(s->bs, &nb_sectors);\n \n s->nb_sectors = nb_sectors;\n+\n+\n+\n+ /* Update the identify data buffer. */\n+\n if (s->drive_kind == IDE_CFATA) {\n \n ide_cfata_identify_size(s);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ide_resize_cb(void *opaque)\n\n{\n\n IDEState *s = opaque;\n\n uint64_t nb_sectors;\n\n\n\n if (!s->identify_set) {\n\n return;\n\n }\n\n\n\n bdrv_get_geometry(s->bs, &nb_sectors);\n\n s->nb_sectors = nb_sectors;\n\n\n\n /* Update the identify data buffer. */\n\n if (s->drive_kind == IDE_CFATA) {\n\n ide_cfata_identify_size(s);\n\n } else {\n\n /* IDE_CD uses a different set of callbacks entirely. */\n\n assert(s->drive_kind != IDE_CD);\n\n ide_identify_size(s);\n\n }\n\n}\n"}} {"sample_id": "234779a2b9141d9386289ba5ed86c9d617567646", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n CPUS390XState *env = &cpu->env;\n \n target_ulong raddr;\n+\n int prot;\n \n uint64_t asc = env->psw.mask & PSW_MASK_ASC;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "hwaddr s390_cpu_get_phys_page_debug(CPUState *cs, vaddr vaddr)\n\n{\n\n S390CPU *cpu = S390_CPU(cs);\n\n CPUS390XState *env = &cpu->env;\n\n target_ulong raddr;\n\n int prot;\n\n uint64_t asc = env->psw.mask & PSW_MASK_ASC;\n\n\n\n /* 31-Bit mode */\n\n if (!(env->psw.mask & PSW_MASK_64)) {\n\n vaddr &= 0x7fffffff;\n\n }\n\n\n\n mmu_translate(env, vaddr, MMU_INST_FETCH, asc, &raddr, &prot, false);\n\n\n\n return raddr;\n\n}\n"}} {"sample_id": "eb05e011e248c6fb6baee295e14fd206e136028c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n if (job->co && !job->busy) {\n \n bdrv_coroutine_enter(blk_bs(job->blk), job->co);\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void block_job_enter(BlockJob *job)\n\n{\n\n if (job->co && !job->busy) {\n\n bdrv_coroutine_enter(blk_bs(job->blk), job->co);\n\n }\n\n}\n"}} {"sample_id": "e3694478a98bc2cd702b3b3f0bfb19a100da737e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,7 +16,7 @@\n \n header[i] = avio_r8(s->pb);\n \n+ if (header[i] == '\\n') {\n \n header[i + 1] = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int yuv4_read_packet(AVFormatContext *s, AVPacket *pkt)\n\n{\n\n int i;\n\n char header[MAX_FRAME_HEADER+1];\n\n int ret;\n\n int64_t off = avio_tell(s->pb);\n\n\n\n for (i = 0; i < MAX_FRAME_HEADER; i++) {\n\n header[i] = avio_r8(s->pb);\n\n if (header[i] == '\\n') {\n\n header[i + 1] = 0;\n\n break;\n\n }\n\n }\n\n if (s->pb->error)\n\n return s->pb->error;\n\n else if (s->pb->eof_reached)\n\n return AVERROR_EOF;\n\n else if (i == MAX_FRAME_HEADER)\n\n return AVERROR_INVALIDDATA;\n\n\n\n if (strncmp(header, Y4M_FRAME_MAGIC, strlen(Y4M_FRAME_MAGIC)))\n\n return AVERROR_INVALIDDATA;\n\n\n\n ret = av_get_packet(s->pb, pkt, s->packet_size - Y4M_FRAME_MAGIC_LEN);\n\n if (ret < 0)\n\n return ret;\n\n else if (ret != s->packet_size - Y4M_FRAME_MAGIC_LEN)\n\n return s->pb->eof_reached ? AVERROR_EOF : AVERROR(EIO);\n\n\n\n pkt->stream_index = 0;\n\n pkt->pts = (off - s->internal->data_offset) / s->packet_size;\n\n pkt->duration = 1;\n\n return 0;\n\n}\n"}} {"sample_id": "365aa1131fa61815eb1d672df6ba451bfe7f2cea", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void kvm_apic_realize(DeviceState *dev, Error **errp)\n \n+{\n \n APICCommonState *s = APIC_COMMON(dev);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void kvm_apic_realize(DeviceState *dev, Error **errp)\n\n{\n\n APICCommonState *s = APIC_COMMON(dev);\n\n\n\n memory_region_init_io(&s->io_memory, NULL, &kvm_apic_io_ops, s, \"kvm-apic-msi\",\n\n APIC_SPACE_SIZE);\n\n\n\n if (kvm_has_gsi_routing()) {\n\n msi_nonbroken = true;\n\n }\n\n}\n"}} {"sample_id": "5d47e3728bbd589701f74bb494c9c9825ba23c88_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,5 +5,5 @@\n int ret = pthread_cond_broadcast(cond);\n \n if (ret) die2(ret, \"pthread_cond_broadcast\");\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void cond_broadcast(pthread_cond_t *cond)\n\n{\n\n int ret = pthread_cond_broadcast(cond);\n\n if (ret) die2(ret, \"pthread_cond_broadcast\");\n\n}\n"}} {"sample_id": "de08c606f9ddafe647b6843e2b10a6d6030b0fc0_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n if (!strcmp(sn->id_str, name) || !strcmp(sn->name, name)) {\n \n+ *sn_info = *sn;\n+\n+ ret = 0;\n+\n+ break;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int bdrv_snapshot_find(BlockDriverState *bs, QEMUSnapshotInfo *sn_info,\n\n const char *name)\n\n{\n\n QEMUSnapshotInfo *sn_tab, *sn;\n\n int nb_sns, i, ret;\n\n\n\n ret = -ENOENT;\n\n nb_sns = bdrv_snapshot_list(bs, &sn_tab);\n\n if (nb_sns < 0)\n\n return ret;\n\n for(i = 0; i < nb_sns; i++) {\n\n sn = &sn_tab[i];\n\n if (!strcmp(sn->id_str, name) || !strcmp(sn->name, name)) {\n\n *sn_info = *sn;\n\n ret = 0;\n\n break;\n\n }\n\n }\n\n g_free(sn_tab);\n\n return ret;\n\n}\n"}} {"sample_id": "697ab892786d47008807a49f57b2fd86adfcd098_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -69,8 +69,8 @@\n offsetof(CPUState, fpscr), \"fpscr\");\n cpu_access_type = tcg_global_mem_new_i32(TCG_AREG0,\n offsetof(CPUState, access_type), \"access_type\");\n+ /* register helpers */\n+#define GEN_HELPER 2\n+#include \"helper.h\"\n+ done_init = 1;\n+}", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void ppc_translate_init(void)\n{\n int i;\n char* p;\n size_t cpu_reg_names_size;\n static int done_init = 0;\n if (done_init)\n return;\n cpu_env = tcg_global_reg_new_ptr(TCG_AREG0, \"env\");\n p = cpu_reg_names;\n cpu_reg_names_size = sizeof(cpu_reg_names);\n for (i = 0; i < 8; i++) {\n snprintf(p, cpu_reg_names_size, \"crf%d\", i);\n cpu_crf[i] = tcg_global_mem_new_i32(TCG_AREG0,\n offsetof(CPUState, crf[i]), p);\n p += 5;\n cpu_reg_names_size -= 5;\n }\n for (i = 0; i < 32; i++) {\n snprintf(p, cpu_reg_names_size, \"r%d\", i);\n cpu_gpr[i] = tcg_global_mem_new(TCG_AREG0,\n offsetof(CPUState, gpr[i]), p);\n p += (i < 10) ? 3 : 4;\n cpu_reg_names_size -= (i < 10) ? 3 : 4;\n#if !defined(TARGET_PPC64)\n snprintf(p, cpu_reg_names_size, \"r%dH\", i);\n cpu_gprh[i] = tcg_global_mem_new_i32(TCG_AREG0,\n offsetof(CPUState, gprh[i]), p);\n p += (i < 10) ? 4 : 5;\n cpu_reg_names_size -= (i < 10) ? 4 : 5;\n snprintf(p, cpu_reg_names_size, \"fp%d\", i);\n cpu_fpr[i] = tcg_global_mem_new_i64(TCG_AREG0,\n offsetof(CPUState, fpr[i]), p);\n p += (i < 10) ? 4 : 5;\n cpu_reg_names_size -= (i < 10) ? 4 : 5;\n snprintf(p, cpu_reg_names_size, \"avr%dH\", i);\n#ifdef HOST_WORDS_BIGENDIAN\n cpu_avrh[i] = tcg_global_mem_new_i64(TCG_AREG0,\n offsetof(CPUState, avr[i].u64[0]), p);\n#else\n cpu_avrh[i] = tcg_global_mem_new_i64(TCG_AREG0,\n offsetof(CPUState, avr[i].u64[1]), p);\n p += (i < 10) ? 6 : 7;\n cpu_reg_names_size -= (i < 10) ? 6 : 7;\n snprintf(p, cpu_reg_names_size, \"avr%dL\", i);\n#ifdef HOST_WORDS_BIGENDIAN\n cpu_avrl[i] = tcg_global_mem_new_i64(TCG_AREG0,\n offsetof(CPUState, avr[i].u64[1]), p);\n#else\n cpu_avrl[i] = tcg_global_mem_new_i64(TCG_AREG0,\n offsetof(CPUState, avr[i].u64[0]), p);\n p += (i < 10) ? 6 : 7;\n cpu_reg_names_size -= (i < 10) ? 6 : 7;\n }\n cpu_nip = tcg_global_mem_new(TCG_AREG0,\n offsetof(CPUState, nip), \"nip\");\n cpu_msr = tcg_global_mem_new(TCG_AREG0,\n offsetof(CPUState, msr), \"msr\");\n cpu_ctr = tcg_global_mem_new(TCG_AREG0,\n offsetof(CPUState, ctr), \"ctr\");\n cpu_lr = tcg_global_mem_new(TCG_AREG0,\n offsetof(CPUState, lr), \"lr\");\n cpu_xer = tcg_global_mem_new(TCG_AREG0,\n offsetof(CPUState, xer), \"xer\");\n cpu_reserve = tcg_global_mem_new(TCG_AREG0,\n offsetof(CPUState, reserve_addr),\n \"reserve_addr\");\n cpu_fpscr = tcg_global_mem_new_i32(TCG_AREG0,\n offsetof(CPUState, fpscr), \"fpscr\");\n cpu_access_type = tcg_global_mem_new_i32(TCG_AREG0,\n offsetof(CPUState, access_type), \"access_type\");\n /* register helpers */\n#define GEN_HELPER 2\n#include \"helper.h\"\n done_init = 1;\n}"}} {"sample_id": "269fe4c3ab0cf29329317eb868f8ec90ac761b41_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n trace_pvscsi_update_irq_msi();\n \n msi_notify(d, PVSCSI_VECTOR_COMPLETION);\n+\n+ }\n+\n+ return;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "pvscsi_update_irq_status(PVSCSIState *s)\n\n{\n\n PCIDevice *d = PCI_DEVICE(s);\n\n bool should_raise = s->reg_interrupt_enabled & s->reg_interrupt_status;\n\n\n\n trace_pvscsi_update_irq_level(should_raise, s->reg_interrupt_enabled,\n\n s->reg_interrupt_status);\n\n\n\n if (s->msi_used && msi_enabled(d)) {\n\n if (should_raise) {\n\n trace_pvscsi_update_irq_msi();\n\n msi_notify(d, PVSCSI_VECTOR_COMPLETION);\n\n }\n\n return;\n\n }\n\n\n\n pci_set_irq(d, !!should_raise);\n\n}\n"}} {"sample_id": "9b938c7262e403f5467110609cb20ef1ae6e9df2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n int fd;\n if (cmsg->cmsg_len != CMSG_LEN(sizeof(int)) ||\n cmsg->cmsg_level != SOL_SOCKET ||\n+ cmsg->cmsg_type != SCM_RIGHTS)\n+ continue;\n+ fd = *((int *)CMSG_DATA(cmsg));\n+ if (fd < 0)\n+ continue;\n #ifndef MSG_CMSG_CLOEXEC\n qemu_set_cloexec(fd);\n #endif", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void unix_process_msgfd(CharDriverState *chr, struct msghdr *msg)\n{\n TCPCharDriver *s = chr->opaque;\n struct cmsghdr *cmsg;\n for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) {\n int fd;\n if (cmsg->cmsg_len != CMSG_LEN(sizeof(int)) ||\n cmsg->cmsg_level != SOL_SOCKET ||\n cmsg->cmsg_type != SCM_RIGHTS)\n continue;\n fd = *((int *)CMSG_DATA(cmsg));\n if (fd < 0)\n continue;\n#ifndef MSG_CMSG_CLOEXEC\n qemu_set_cloexec(fd);\n#endif\n if (s->msgfd != -1)\n close(s->msgfd);\n s->msgfd = fd;\n }\n}"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_104", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n }\n \n+ if (size == 4) {\n+\n+ return nvic_readl(opaque, offset);\n+\n+ }\n \n hw_error(\"NVIC: Bad read of size %d at offset 0x%x\\n\", size, offset);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t nvic_sysreg_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n /* At the moment we only support the ID registers for byte/word access.\n\n * This is not strictly correct as a few of the other registers also\n\n * allow byte access.\n\n */\n\n uint32_t offset = addr;\n\n if (offset >= 0xfe0) {\n\n if (offset & 3) {\n\n return 0;\n\n }\n\n return nvic_id[(offset - 0xfe0) >> 2];\n\n }\n\n if (size == 4) {\n\n return nvic_readl(opaque, offset);\n\n }\n\n hw_error(\"NVIC: Bad read of size %d at offset 0x%x\\n\", size, offset);\n\n}\n"}} {"sample_id": "80a5d05108cb218e8cd2e25c6621a3bfef0a832e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static av_cold int vaapi_encode_h264_init(AVCodecContext *avctx)\n \n+{\n \n return ff_vaapi_encode_init(avctx, &vaapi_encode_type_h264);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int vaapi_encode_h264_init(AVCodecContext *avctx)\n\n{\n\n return ff_vaapi_encode_init(avctx, &vaapi_encode_type_h264);\n\n}\n"}} {"sample_id": "38f3ef574b48afc507c6f636ae4393fd36bda072", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int coroutine_fn raw_co_writev(BlockDriverState *bs, int64_t sector_num,\n \n+ int nb_sectors, QEMUIOVector *qiov)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int coroutine_fn raw_co_writev(BlockDriverState *bs, int64_t sector_num,\n\n int nb_sectors, QEMUIOVector *qiov)\n\n{\n\n BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);\n\n return bdrv_co_writev(bs->file, sector_num, nb_sectors, qiov);\n\n}\n"}} {"sample_id": "04001767728fd4ed8b4f9d2ebbb9f9a8c9a7be0d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n /* FIXME - figure out which other formats work */\n \n switch (fmt) {\n+\n+ case IMGFMT_YV12:\n+\n+ case IMGFMT_IYUV:\n+\n case IMGFMT_I420:\n \n return ff_vf_next_query_format(vf, fmt);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int query_format(struct vf_instance *vf, unsigned int fmt)\n\n{\n\n /* FIXME - figure out which other formats work */\n\n switch (fmt) {\n\n case IMGFMT_YV12:\n\n case IMGFMT_IYUV:\n\n case IMGFMT_I420:\n\n return ff_vf_next_query_format(vf, fmt);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "b2c98d9d392c87c9b9e975d30f79924719d9cbbe", "diff": "--- a/source.c\n+++ b/source.c\n@@ -43,9 +43,9 @@\n } else {\n \n /* Only the LOAD AND TEST instruction is available. */\n+\n+ return val == 0;\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int tcg_match_cmpi(TCGType type, tcg_target_long val)\n\n{\n\n if (facilities & FACILITY_EXT_IMM) {\n\n /* The COMPARE IMMEDIATE instruction is available. */\n\n if (type == TCG_TYPE_I32) {\n\n /* We have a 32-bit immediate and can compare against anything. */\n\n return 1;\n\n } else {\n\n /* ??? We have no insight here into whether the comparison is\n\n signed or unsigned. The COMPARE IMMEDIATE insn uses a 32-bit\n\n signed immediate, and the COMPARE LOGICAL IMMEDIATE insn uses\n\n a 32-bit unsigned immediate. If we were to use the (semi)\n\n obvious \"val == (int32_t)val\" we would be enabling unsigned\n\n comparisons vs very large numbers. The only solution is to\n\n take the intersection of the ranges. */\n\n /* ??? Another possible solution is to simply lie and allow all\n\n constants here and force the out-of-range values into a temp\n\n register in tgen_cmp when we have knowledge of the actual\n\n comparison code in use. */\n\n return val >= 0 && val <= 0x7fffffff;\n\n }\n\n } else {\n\n /* Only the LOAD AND TEST instruction is available. */\n\n return val == 0;\n\n }\n\n}\n"}} {"sample_id": "a5cf8262e4eb9c4646434e2c6211ef8608db3233_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n SCSIDevice *d = SCSI_DEVICE(dev);\n \n+ char path[100];\n+\n+\n+\n snprintf(path, sizeof(path), \"channel@%x/%s@%x,%x\", d->channel,\n \n qdev_fw_name(dev), d->id, d->lun);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static char *scsibus_get_fw_dev_path(DeviceState *dev)\n\n{\n\n SCSIDevice *d = SCSI_DEVICE(dev);\n\n char path[100];\n\n\n\n snprintf(path, sizeof(path), \"channel@%x/%s@%x,%x\", d->channel,\n\n qdev_fw_name(dev), d->id, d->lun);\n\n\n\n return strdup(path);\n\n}\n"}} {"sample_id": "0be839a2701369f669532ea5884c15bead1c6e08", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n ram_addr_t offset,\n \n int flags)\n+\n {\n \n static RAMBlock *block = NULL;\n@@ -13,7 +13,7 @@\n uint8_t len;\n \n \n+\n if (flags & RAM_SAVE_FLAG_CONTINUE) {\n \n if (!block) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static inline void *host_from_stream_offset(QEMUFile *f,\n\n ram_addr_t offset,\n\n int flags)\n\n{\n\n static RAMBlock *block = NULL;\n\n char id[256];\n\n uint8_t len;\n\n\n\n if (flags & RAM_SAVE_FLAG_CONTINUE) {\n\n if (!block) {\n\n error_report(\"Ack, bad migration stream!\");\n\n return NULL;\n\n }\n\n\n\n return memory_region_get_ram_ptr(block->mr) + offset;\n\n }\n\n\n\n len = qemu_get_byte(f);\n\n qemu_get_buffer(f, (uint8_t *)id, len);\n\n id[len] = 0;\n\n\n\n QTAILQ_FOREACH(block, &ram_list.blocks, next) {\n\n if (!strncmp(id, block->idstr, sizeof(id)))\n\n return memory_region_get_ram_ptr(block->mr) + offset;\n\n }\n\n\n\n error_report(\"Can't find block %s!\", id);\n\n return NULL;\n\n}\n"}} {"sample_id": "e163ae7b8f80dc4eb38445956929409601a8321c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n bus->parent->num_child_bus--;\n \n+ }\n+\n+\n+ if (bus->qdev_allocated) {\n+\n qemu_free(bus);\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void qbus_free(BusState *bus)\n\n{\n\n DeviceState *dev;\n\n\n\n while ((dev = QLIST_FIRST(&bus->children)) != NULL) {\n\n qdev_free(dev);\n\n }\n\n if (bus->parent) {\n\n QLIST_REMOVE(bus, sibling);\n\n bus->parent->num_child_bus--;\n\n }\n\n\n if (bus->qdev_allocated) {\n\n qemu_free(bus);\n\n }\n\n}"}} {"sample_id": "806d102141b99d4f1e55a97d68b7ea8c8ba3129f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+bool guest_validate_base(unsigned long guest_base)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "bool guest_validate_base(unsigned long guest_base)\n\n{\n\n return 1;\n\n}\n"}} {"sample_id": "dc73c7adc0284871af34100a6062378c07a63569", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n if (ff_mqc_decode(&t1->mqc, t1->mqc.cx_states + ff_jpeg2000_getsigctxno(t1->flags[y+1][x+1] & flags_mask, bandno))) {\n \n+ int xorbit, ctxno = ff_jpeg2000_getsgnctxno(t1->flags[y+1][x+1], &xorbit);\n+\n+ if (bpass_csty_symbol)\n+\n+ t1->data[y][x] = ff_mqc_decode(&t1->mqc, t1->mqc.cx_states + ctxno) ? -mask : mask;\n \n else\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void decode_sigpass(Jpeg2000T1Context *t1, int width, int height,\n\n int bpno, int bandno, int bpass_csty_symbol,\n\n int vert_causal_ctx_csty_symbol)\n\n{\n\n int mask = 3 << (bpno - 1), y0, x, y;\n\n\n\n for (y0 = 0; y0 < height; y0 += 4)\n\n for (x = 0; x < width; x++)\n\n for (y = y0; y < height && y < y0 + 4; y++) {\n\n if ((t1->flags[y+1][x+1] & JPEG2000_T1_SIG_NB)\n\n && !(t1->flags[y+1][x+1] & (JPEG2000_T1_SIG | JPEG2000_T1_VIS))) {\n\n int flags_mask = -1;\n\n if (vert_causal_ctx_csty_symbol && y == y0 + 3)\n\n flags_mask &= ~(JPEG2000_T1_SIG_S | JPEG2000_T1_SIG_SW | JPEG2000_T1_SIG_SE);\n\n if (ff_mqc_decode(&t1->mqc, t1->mqc.cx_states + ff_jpeg2000_getsigctxno(t1->flags[y+1][x+1] & flags_mask, bandno))) {\n\n int xorbit, ctxno = ff_jpeg2000_getsgnctxno(t1->flags[y+1][x+1], &xorbit);\n\n if (bpass_csty_symbol)\n\n t1->data[y][x] = ff_mqc_decode(&t1->mqc, t1->mqc.cx_states + ctxno) ? -mask : mask;\n\n else\n\n t1->data[y][x] = (ff_mqc_decode(&t1->mqc, t1->mqc.cx_states + ctxno) ^ xorbit) ?\n\n -mask : mask;\n\n\n\n ff_jpeg2000_set_significance(t1, x, y,\n\n t1->data[y][x] < 0);\n\n }\n\n t1->flags[y + 1][x + 1] |= JPEG2000_T1_VIS;\n\n }\n\n }\n\n}\n"}} {"sample_id": "eabb7b91b36b202b4dac2df2d59d698e3aff197a_15", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg, TCGReg arg1,\n \n+ intptr_t arg2)\n+\n+{\n+\n+ uint8_t *old_code_ptr = s->code_ptr;\n \n if (type == TCG_TYPE_I32) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg, TCGReg arg1,\n\n intptr_t arg2)\n\n{\n\n uint8_t *old_code_ptr = s->code_ptr;\n\n if (type == TCG_TYPE_I32) {\n\n tcg_out_op_t(s, INDEX_op_st_i32);\n\n tcg_out_r(s, arg);\n\n tcg_out_r(s, arg1);\n\n tcg_out32(s, arg2);\n\n } else {\n\n assert(type == TCG_TYPE_I64);\n\n#if TCG_TARGET_REG_BITS == 64\n\n tcg_out_op_t(s, INDEX_op_st_i64);\n\n tcg_out_r(s, arg);\n\n tcg_out_r(s, arg1);\n\n tcg_out32(s, arg2);\n\n#else\n\n TODO();\n\n#endif\n\n }\n\n old_code_ptr[1] = s->code_ptr - old_code_ptr;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_26", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n uint32_t lduw_phys(target_phys_addr_t addr)\n \n+{\n \n return lduw_phys_internal(addr, DEVICE_NATIVE_ENDIAN);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint32_t lduw_phys(target_phys_addr_t addr)\n\n{\n\n return lduw_phys_internal(addr, DEVICE_NATIVE_ENDIAN);\n\n}\n"}} {"sample_id": "966439a67830239a6c520c5df6c55627b8153c8b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n if (likely((uint64_t)T1 != 0)) {\n+\n xer_ov = 0;\n \n T0 = (uint64_t)T0 / (uint64_t)T1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void do_divduo (void)\n\n{\n\n if (likely((uint64_t)T1 != 0)) {\n\n xer_ov = 0;\n\n T0 = (uint64_t)T0 / (uint64_t)T1;\n\n } else {\n\n xer_so = 1;\n\n xer_ov = 1;\n\n T0 = 0;\n\n }\n\n}\n"}} {"sample_id": "0b8c537fd2fcbd9fa7dd2559c9d4110393d91107", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n c[PCI_SUBSYSTEM_VENDOR_ID + 1] = 0x49;\n \n+ c[PCI_SUBSYSTEM_ID] = 0x4c;\n+\n+ c[PCI_SUBSYSTEM_ID + 1] = 0x4c;\n+\n+#else\n \n c[PCI_SUBSYSTEM_VENDOR_ID] = 0x74;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int es1370_initfn (PCIDevice *dev)\n\n{\n\n ES1370State *s = DO_UPCAST (ES1370State, dev, dev);\n\n uint8_t *c = s->dev.config;\n\n\n\n pci_config_set_vendor_id (c, PCI_VENDOR_ID_ENSONIQ);\n\n pci_config_set_device_id (c, PCI_DEVICE_ID_ENSONIQ_ES1370);\n\n c[PCI_STATUS + 1] = PCI_STATUS_DEVSEL_SLOW >> 8;\n\n pci_config_set_class (c, PCI_CLASS_MULTIMEDIA_AUDIO);\n\n\n\n#if 1\n\n c[PCI_SUBSYSTEM_VENDOR_ID] = 0x42;\n\n c[PCI_SUBSYSTEM_VENDOR_ID + 1] = 0x49;\n\n c[PCI_SUBSYSTEM_ID] = 0x4c;\n\n c[PCI_SUBSYSTEM_ID + 1] = 0x4c;\n\n#else\n\n c[PCI_SUBSYSTEM_VENDOR_ID] = 0x74;\n\n c[PCI_SUBSYSTEM_VENDOR_ID + 1] = 0x12;\n\n c[PCI_SUBSYSTEM_ID] = 0x71;\n\n c[PCI_SUBSYSTEM_ID + 1] = 0x13;\n\n c[PCI_CAPABILITY_LIST] = 0xdc;\n\n c[PCI_INTERRUPT_LINE] = 10;\n\n c[0xdc] = 0x00;\n\n#endif\n\n\n\n /* TODO: RST# value should be 0. */\n\n c[PCI_INTERRUPT_PIN] = 1;\n\n c[PCI_MIN_GNT] = 0x0c;\n\n c[PCI_MAX_LAT] = 0x80;\n\n\n\n pci_register_bar (&s->dev, 0, 256, PCI_BASE_ADDRESS_SPACE_IO, es1370_map);\n\n qemu_register_reset (es1370_on_reset, s);\n\n\n\n AUD_register_card (\"es1370\", &s->card);\n\n es1370_reset (s);\n\n return 0;\n\n}\n"}} {"sample_id": "09e68369a88d7de0f988972bf28eec1b80cc47f9_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n if (!qobj) {\n \n *present = false;\n+\n+ return;\n+\n+ }\n+\n \n \n *present = true;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qmp_input_optional(Visitor *v, const char *name, bool *present)\n\n{\n\n QmpInputVisitor *qiv = to_qiv(v);\n\n QObject *qobj = qmp_input_get_object(qiv, name, false, NULL);\n\n\n\n if (!qobj) {\n\n *present = false;\n\n return;\n\n }\n\n\n\n *present = true;\n\n}\n"}} {"sample_id": "d9f62dde1303286b24ac8ce88be27e2b9b9c5f46_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,8 +16,8 @@\n \n e->is_list_head = true;\n \n+ }\n+\n+ QTAILQ_INSERT_HEAD(&qov->stack, e, node);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qmp_output_push_obj(QmpOutputVisitor *qov, QObject *value)\n\n{\n\n QStackEntry *e = g_malloc0(sizeof(*e));\n\n\n\n assert(qov->root);\n\n assert(value);\n\n e->value = value;\n\n if (qobject_type(e->value) == QTYPE_QLIST) {\n\n e->is_list_head = true;\n\n }\n\n QTAILQ_INSERT_HEAD(&qov->stack, e, node);\n\n}\n"}} {"sample_id": "81efc03f5883cf17a1ad6acedfbb876163d7d06a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ put_ebml_binary(pb, elementid, str, strlen(str));\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void put_ebml_utf8(ByteIOContext *pb, unsigned int elementid, char *str)\n\n{\n\n put_ebml_binary(pb, elementid, str, strlen(str));\n\n}\n"}} {"sample_id": "b3db211f3c80bb996a704d665fe275619f728bd4_42", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n {\n \n int64_t res = 0;\n+\n+ Error *err = NULL;\n+\n+ Visitor *v;\n+\n \n \n /* this will overflow a Qint/int64, so should be deserialized into", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_visitor_in_int_overflow(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n int64_t res = 0;\n\n Error *err = NULL;\n\n Visitor *v;\n\n\n\n /* this will overflow a Qint/int64, so should be deserialized into\n\n * a QFloat/double field instead, leading to an error if we pass it\n\n * to visit_type_int. confirm this.\n\n */\n\n v = visitor_input_test_init(data, \"%f\", DBL_MAX);\n\n\n\n visit_type_int(v, NULL, &res, &err);\n\n error_free_or_abort(&err);\n\n}\n"}} {"sample_id": "67a0fd2a9bca204d2b39f910a97c7137636a0715_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static void coroutine_fn bdrv_get_block_status_above_co_entry(void *opaque)\n+\n+{\n+\n BdrvCoGetBlockStatusData *data = opaque;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void coroutine_fn bdrv_get_block_status_above_co_entry(void *opaque)\n\n{\n\n BdrvCoGetBlockStatusData *data = opaque;\n\n\n\n data->ret = bdrv_co_get_block_status_above(data->bs, data->base,\n\n data->sector_num,\n\n data->nb_sectors,\n\n data->pnum);\n\n data->done = true;\n\n}\n"}} {"sample_id": "06b106889a09277617fc8c542397a9f595ee605a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,12 +14,12 @@\n \n \n \n+ /* No dirty page as there is zero RAM */\n \n+ if (!ram_bytes_total()) {\n \n return pages;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int ram_find_and_save_block(RAMState *rs, bool last_stage)\n\n{\n\n PageSearchStatus pss;\n\n int pages = 0;\n\n bool again, found;\n\n ram_addr_t dirty_ram_abs; /* Address of the start of the dirty page in\n\n ram_addr_t space */\n\n\n\n /* No dirty page as there is zero RAM */\n\n if (!ram_bytes_total()) {\n\n return pages;\n\n }\n\n\n\n pss.block = rs->last_seen_block;\n\n pss.offset = rs->last_offset;\n\n pss.complete_round = false;\n\n\n\n if (!pss.block) {\n\n pss.block = QLIST_FIRST_RCU(&ram_list.blocks);\n\n }\n\n\n\n do {\n\n again = true;\n\n found = get_queued_page(rs, &pss, &dirty_ram_abs);\n\n\n\n if (!found) {\n\n /* priority queue empty, so just search for something dirty */\n\n found = find_dirty_block(rs, &pss, &again, &dirty_ram_abs);\n\n }\n\n\n\n if (found) {\n\n pages = ram_save_host_page(rs, &pss, last_stage, dirty_ram_abs);\n\n }\n\n } while (!pages && again);\n\n\n\n rs->last_seen_block = pss.block;\n\n rs->last_offset = pss.offset;\n\n\n\n return pages;\n\n}\n"}} {"sample_id": "dfd100f242370886bb6732f70f1f7cbd8eb9fedc_17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n QIOChannel **src,\n \n QIOChannel **dst)\n+\n+{\n+\n+ QIOChannelSocket *lioc;\n+\n \n \n lioc = qio_channel_socket_new();", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_io_channel_setup_sync(SocketAddress *listen_addr,\n\n SocketAddress *connect_addr,\n\n QIOChannel **src,\n\n QIOChannel **dst)\n\n{\n\n QIOChannelSocket *lioc;\n\n\n\n lioc = qio_channel_socket_new();\n\n qio_channel_socket_listen_sync(lioc, listen_addr, &error_abort);\n\n\n\n if (listen_addr->type == SOCKET_ADDRESS_KIND_INET) {\n\n SocketAddress *laddr = qio_channel_socket_get_local_address(\n\n lioc, &error_abort);\n\n\n\n g_free(connect_addr->u.inet.data->port);\n\n connect_addr->u.inet.data->port = g_strdup(laddr->u.inet.data->port);\n\n\n\n qapi_free_SocketAddress(laddr);\n\n }\n\n\n\n *src = QIO_CHANNEL(qio_channel_socket_new());\n\n qio_channel_socket_connect_sync(\n\n QIO_CHANNEL_SOCKET(*src), connect_addr, &error_abort);\n\n qio_channel_set_delay(*src, false);\n\n\n\n qio_channel_wait(QIO_CHANNEL(lioc), G_IO_IN);\n\n *dst = QIO_CHANNEL(qio_channel_socket_accept(lioc, &error_abort));\n\n g_assert(*dst);\n\n\n\n test_io_channel_set_socket_bufs(*src, *dst);\n\n\n\n object_unref(OBJECT(lioc));\n\n}\n"}} {"sample_id": "25b422eb4051b9b7473feea1ae848f1e3b4f799f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,9 +13,9 @@\n if (data)\n \n cmd->user_print(mon, data);\n+\n+\n+\n+ qobject_decref(data);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void monitor_call_handler(Monitor *mon, const mon_cmd_t *cmd,\n\n const QDict *params)\n\n{\n\n QObject *data = NULL;\n\n\n\n cmd->mhandler.cmd_new(mon, params, &data);\n\n if (data)\n\n cmd->user_print(mon, data);\n\n\n\n qobject_decref(data);\n\n}\n"}} {"sample_id": "d6604b29ef544793479d7fb4e05ef6622bb3e534_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n av_frame_free(&avctx->coded_frame);\n \n+\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int asv_encode_close(AVCodecContext *avctx)\n\n{\n\n av_frame_free(&avctx->coded_frame);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "b12d92efd6c0d48665383a9baecc13e7ebbd8a22", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ int i;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int mm_decode_pal(MmContext *s)\n\n{\n\n int i;\n\n\n\n bytestream2_skip(&s->gb, 4);\n\n for (i = 0; i < 128; i++) {\n\n s->palette[i] = 0xFF << 24 | bytestream2_get_be24(&s->gb);\n\n s->palette[i+128] = s->palette[i]<<2;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "2a6391232fa58f32469fb61d55343eff32a91083", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n VirtIOPCIProxy *proxy = DO_UPCAST(VirtIOPCIProxy, pci_dev, pci_dev);\n \n struct virtio_pci_cfg_cap *cfg;\n+\n \n \n if (proxy->config_cap &&", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static uint32_t virtio_read_config(PCIDevice *pci_dev,\n\n uint32_t address, int len)\n\n{\n\n VirtIOPCIProxy *proxy = DO_UPCAST(VirtIOPCIProxy, pci_dev, pci_dev);\n\n struct virtio_pci_cfg_cap *cfg;\n\n\n\n if (proxy->config_cap &&\n\n ranges_overlap(address, len, proxy->config_cap + offsetof(struct virtio_pci_cfg_cap,\n\n pci_cfg_data),\n\n sizeof cfg->pci_cfg_data)) {\n\n uint32_t off;\n\n uint32_t len;\n\n\n\n cfg = (void *)(proxy->pci_dev.config + proxy->config_cap);\n\n off = le32_to_cpu(cfg->cap.offset);\n\n len = le32_to_cpu(cfg->cap.length);\n\n\n\n if (len <= sizeof cfg->pci_cfg_data) {\n\n virtio_address_space_read(&proxy->modern_as, off,\n\n cfg->pci_cfg_data, len);\n\n }\n\n }\n\n\n\n return pci_default_read_config(pci_dev, address, len);\n\n}\n"}} {"sample_id": "4a1418e07bdcfaa3177739e04707ecaec75d89e1_17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,6 +10,6 @@\n \n else\n \n+ pages_to_flush[nb_pages_to_flush++] = addr;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void kqemu_flush_page(CPUState *env, target_ulong addr)\n\n{\n\n LOG_INT(\"kqemu_flush_page: addr=\" TARGET_FMT_lx \"\\n\", addr);\n\n if (nb_pages_to_flush >= KQEMU_MAX_PAGES_TO_FLUSH)\n\n nb_pages_to_flush = KQEMU_FLUSH_ALL;\n\n else\n\n pages_to_flush[nb_pages_to_flush++] = addr;\n\n}\n"}} {"sample_id": "7faa40af982960608b117e20fec999b48011e5e0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,10 +10,10 @@\n if (ret != size) {\n av_free_packet(pkt);\n return ret < 0 ? ret : AVERROR(EIO);\n+ if (AV_RB16(pkt->data) & 0x8000) {\n+ av_free_packet(pkt);\n+ return AVERROR_EOF;\n+ pkt->size = size;\n pkt->duration = 1;\n pkt->pts = (pkt->pos - c->header_size) / size;\n return 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int adx_read_packet(AVFormatContext *s, AVPacket *pkt)\n{\n ADXDemuxerContext *c = s->priv_data;\n AVCodecContext *avctx = s->streams[0]->codec;\n int ret, size;\n size = BLOCK_SIZE * avctx->channels;\n pkt->pos = avio_tell(s->pb);\n pkt->stream_index = 0;\n ret = av_get_packet(s->pb, pkt, size);\n if (ret != size) {\n av_free_packet(pkt);\n return ret < 0 ? ret : AVERROR(EIO);\n if (AV_RB16(pkt->data) & 0x8000) {\n av_free_packet(pkt);\n return AVERROR_EOF;\n pkt->size = size;\n pkt->duration = 1;\n pkt->pts = (pkt->pos - c->header_size) / size;\n return 0;"}} {"sample_id": "37f32349ea43f41ee8b9a253977ce1e46f576fc7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,18 +1,18 @@\n int qemu_opts_foreach(QemuOptsList *list, qemu_opts_loopfunc func,\n \n void *opaque, Error **errp)\n+\n {\n \n Location loc;\n \n QemuOpts *opts;\n+\n int rc;\n \n \n \n+ loc_push_none(&loc);\n \n QTAILQ_FOREACH(opts, &list->head, next) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int qemu_opts_foreach(QemuOptsList *list, qemu_opts_loopfunc func,\n\n void *opaque, Error **errp)\n\n{\n\n Location loc;\n\n QemuOpts *opts;\n\n int rc;\n\n\n\n loc_push_none(&loc);\n\n QTAILQ_FOREACH(opts, &list->head, next) {\n\n loc_restore(&opts->loc);\n\n rc = func(opaque, opts, errp);\n\n if (rc) {\n\n return rc;\n\n }\n\n assert(!errp || !*errp);\n\n }\n\n loc_pop(&loc);\n\n return 0;\n\n}\n"}} {"sample_id": "df46189412567906312684eb72ba87c6a86a4cdb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void slirp_cleanup(void)\n+\n {\n \n WSACleanup();", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void slirp_cleanup(void)\n\n{\n\n WSACleanup();\n\n}\n"}} {"sample_id": "0c16c056a4f9dec18fdd56feec82a5db9ff3c15e_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n return true;\n \n }\n+\n+ return false;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "gboolean qcrypto_hash_supports(QCryptoHashAlgorithm alg)\n\n{\n\n if (alg < G_N_ELEMENTS(qcrypto_hash_alg_map)) {\n\n return true;\n\n }\n\n return false;\n\n}\n"}} {"sample_id": "187337f8b0ec0813dd3876d1efe37d415fb81c2e_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n icp_pit_state *s;\n \n \n+\n s = (icp_pit_state *)qemu_mallocz(sizeof(icp_pit_state));\n \n s->base = base;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void icp_pit_init(uint32_t base, qemu_irq *pic, int irq)\n\n{\n\n int iomemtype;\n\n icp_pit_state *s;\n\n\n\n s = (icp_pit_state *)qemu_mallocz(sizeof(icp_pit_state));\n\n s->base = base;\n\n /* Timer 0 runs at the system clock speed (40MHz). */\n\n s->timer[0] = arm_timer_init(40000000, pic[irq]);\n\n /* The other two timers run at 1MHz. */\n\n s->timer[1] = arm_timer_init(1000000, pic[irq + 1]);\n\n s->timer[2] = arm_timer_init(1000000, pic[irq + 2]);\n\n\n\n iomemtype = cpu_register_io_memory(0, icp_pit_readfn,\n\n icp_pit_writefn, s);\n\n cpu_register_physical_memory(base, 0x00000fff, iomemtype);\n\n /* ??? Save/restore. */\n\n}\n"}} {"sample_id": "13289fb5a716e06fb06febb880e5e116d485f82b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,10 +15,10 @@\n return;\n if (has_format && (format == DATA_FORMAT_BASE64)) {\n write_data = g_base64_decode(data, &write_count);\n+ } else {\n+ write_data = (uint8_t *)data;\n+ write_count = strlen(data);\n+ ret = cirmem_chr_write(chr, write_data, write_count);\n+ if (ret < 0) {\n error_setg(errp, \"Failed to write to device %s\", device);\n return;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void qmp_memchar_write(const char *device, const char *data,\n bool has_format, enum DataFormat format,\n Error **errp)\n{\n CharDriverState *chr;\n const uint8_t *write_data;\n int ret;\n size_t write_count;\n chr = qemu_chr_find(device);\n if (!chr) {\n error_setg(errp, \"Device '%s' not found\", device);\n return;\n if (qemu_is_chr(chr, \"memory\")) {\n error_setg(errp,\"%s is not memory char device\", device);\n return;\n if (has_format && (format == DATA_FORMAT_BASE64)) {\n write_data = g_base64_decode(data, &write_count);\n } else {\n write_data = (uint8_t *)data;\n write_count = strlen(data);\n ret = cirmem_chr_write(chr, write_data, write_count);\n if (ret < 0) {\n error_setg(errp, \"Failed to write to device %s\", device);\n return;"}} {"sample_id": "3c892168a02b4ff9ef8c398599940b8f16a32437", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n \tPIIX4PMState *s = opaque;\n+\n+\tuint8_t *pci_conf = s->dev.config;\n+\n+\n \n \tpci_conf[0x58] = 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void piix4_reset(void *opaque)\n\n{\n\n\tPIIX4PMState *s = opaque;\n\n\tuint8_t *pci_conf = s->dev.config;\n\n\n\n\tpci_conf[0x58] = 0;\n\n\tpci_conf[0x59] = 0;\n\n\tpci_conf[0x5a] = 0;\n\n\tpci_conf[0x5b] = 0;\n\n}\n"}} {"sample_id": "bd269ebc82fbaa5fe7ce5bc7c1770ac8acecd884_21", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n const char *model,\n \n const char *name,\n+\n+ const char *host_str)\n+\n+{\n+\n NetClientState *nc;\n \n NetSocketState *s;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int net_socket_listen_init(NetClientState *peer,\n\n const char *model,\n\n const char *name,\n\n const char *host_str)\n\n{\n\n NetClientState *nc;\n\n NetSocketState *s;\n\n SocketAddressLegacy *saddr;\n\n int ret;\n\n Error *local_error = NULL;\n\n\n\n saddr = socket_parse(host_str, &local_error);\n\n if (saddr == NULL) {\n\n error_report_err(local_error);\n\n return -1;\n\n }\n\n\n\n ret = socket_listen(saddr, &local_error);\n\n if (ret < 0) {\n\n qapi_free_SocketAddressLegacy(saddr);\n\n error_report_err(local_error);\n\n return -1;\n\n }\n\n\n\n nc = qemu_new_net_client(&net_socket_info, peer, model, name);\n\n s = DO_UPCAST(NetSocketState, nc, nc);\n\n s->fd = -1;\n\n s->listen_fd = ret;\n\n s->nc.link_down = true;\n\n net_socket_rs_init(&s->rs, net_socket_rs_finalize);\n\n\n\n qemu_set_fd_handler(s->listen_fd, net_socket_accept, NULL, s);\n\n qapi_free_SocketAddressLegacy(saddr);\n\n return 0;\n\n}\n"}} {"sample_id": "996a0d76d7e756e4023ef79bc37bfe629b9eaca7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int local_open(FsContext *ctx, V9fsPath *fs_path,\n+\n+ int flags, V9fsFidOpenState *fs)\n \n+{\n+\n+ char *buffer;\n \n char *path = fs_path->data;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int local_open(FsContext *ctx, V9fsPath *fs_path,\n\n int flags, V9fsFidOpenState *fs)\n\n{\n\n char *buffer;\n\n char *path = fs_path->data;\n\n int fd;\n\n\n\n buffer = rpath(ctx, path);\n\n fd = open(buffer, flags | O_NOFOLLOW);\n\n g_free(buffer);\n\n if (fd == -1) {\n\n return -1;\n\n }\n\n fs->fd = fd;\n\n return fs->fd;\n\n}\n"}} {"sample_id": "b3dd1b8c295636e64ceb14cdc4db6420d7319e38_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {\n \n+ QLIST_FOREACH(mon_fdset_fd_dup, &mon_fdset->dup_fds, next) {\n \n if (mon_fdset_fd_dup->fd == dup_fd) {\n \n+ if (remove) {\n \n QLIST_REMOVE(mon_fdset_fd_dup, next);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int monitor_fdset_dup_fd_find_remove(int dup_fd, bool remove)\n\n{\n\n MonFdset *mon_fdset;\n\n MonFdsetFd *mon_fdset_fd_dup;\n\n\n\n QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {\n\n QLIST_FOREACH(mon_fdset_fd_dup, &mon_fdset->dup_fds, next) {\n\n if (mon_fdset_fd_dup->fd == dup_fd) {\n\n if (remove) {\n\n QLIST_REMOVE(mon_fdset_fd_dup, next);\n\n if (QLIST_EMPTY(&mon_fdset->dup_fds)) {\n\n monitor_fdset_cleanup(mon_fdset);\n\n }\n\n }\n\n return mon_fdset->id;\n\n }\n\n }\n\n }\n\n return -1;\n\n}\n"}} {"sample_id": "5c8467a07c654f6acd9e8e3a436cd5b746bb2f44", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int ivf_write_trailer(AVFormatContext *s)\n \n+{\n+\n AVIOContext *pb = s->pb;\n \n if (pb->seekable) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int ivf_write_trailer(AVFormatContext *s)\n\n{\n\n AVIOContext *pb = s->pb;\n\n if (pb->seekable) {\n\n IVFEncContext *ctx = s->priv_data;\n\n size_t end = avio_tell(pb);\n\n\n\n avio_seek(pb, 24, SEEK_SET);\n\n avio_wl64(pb, ctx->frame_cnt * ctx->sum_delta_pts / (ctx->frame_cnt - 1));\n\n avio_seek(pb, end, SEEK_SET);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "0fdddf80a88ac2efe068990d1878f472bb6b95d9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void init_timers(void)\n+\n+{\n \n init_get_clock();\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void init_timers(void)\n\n{\n\n init_get_clock();\n\n rt_clock = qemu_new_clock(QEMU_TIMER_REALTIME);\n\n vm_clock = qemu_new_clock(QEMU_TIMER_VIRTUAL);\n\n}\n"}} {"sample_id": "f1f57066573e832438cd87600310589fa9cee202", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n /* tray close */\n \n qapi_event_send_device_tray_moved(blk_name(blk),\n+\n+ false, &error_abort);\n+\n+ }\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void blk_dev_change_media_cb(BlockBackend *blk, bool load)\n\n{\n\n if (blk->dev_ops && blk->dev_ops->change_media_cb) {\n\n bool tray_was_closed = !blk_dev_is_tray_open(blk);\n\n\n\n blk->dev_ops->change_media_cb(blk->dev_opaque, load);\n\n if (tray_was_closed) {\n\n /* tray open */\n\n qapi_event_send_device_tray_moved(blk_name(blk),\n\n true, &error_abort);\n\n }\n\n if (load) {\n\n /* tray close */\n\n qapi_event_send_device_tray_moved(blk_name(blk),\n\n false, &error_abort);\n\n }\n\n }\n\n}\n"}} {"sample_id": "12d4536f7d911b6d87a766ad7300482ea663cea2_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n+void qemu_notify_event(void)\n+\n+{\n+\n+ CPUState *env = cpu_single_env;\n \n+\n+\n qemu_event_increment ();\n+\n if (env) {\n \n cpu_exit(env);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void qemu_notify_event(void)\n\n{\n\n CPUState *env = cpu_single_env;\n\n\n\n qemu_event_increment ();\n\n if (env) {\n\n cpu_exit(env);\n\n }\n\n if (next_cpu && env != next_cpu) {\n\n cpu_exit(next_cpu);\n\n }\n\n exit_request = 1;\n\n}\n"}} {"sample_id": "4f5e19e6c570459cd524b29b24374f03860f5149_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n pci_mem_config = cpu_register_io_memory(pci_grackle_config_read,\n \n+ pci_grackle_config_write, s);\n+\n+ pci_mem_data = cpu_register_io_memory(pci_grackle_read,\n+\n+ pci_grackle_write,\n \n &s->host_state);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pci_grackle_init_device(SysBusDevice *dev)\n\n{\n\n GrackleState *s;\n\n int pci_mem_config, pci_mem_data;\n\n\n\n s = FROM_SYSBUS(GrackleState, dev);\n\n\n\n pci_mem_config = cpu_register_io_memory(pci_grackle_config_read,\n\n pci_grackle_config_write, s);\n\n pci_mem_data = cpu_register_io_memory(pci_grackle_read,\n\n pci_grackle_write,\n\n &s->host_state);\n\n sysbus_init_mmio(dev, 0x1000, pci_mem_config);\n\n sysbus_init_mmio(dev, 0x1000, pci_mem_data);\n\n\n\n register_savevm(\"grackle\", 0, 1, pci_grackle_save, pci_grackle_load,\n\n &s->host_state);\n\n qemu_register_reset(pci_grackle_reset, &s->host_state);\n\n return 0;\n\n}\n"}} {"sample_id": "0426d53c6530606bf7641b83f2b755fe61c280ee_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+void visit_get_next_type(Visitor *v, int *obj, const int *qtypes,\n \n+ const char *name, Error **errp)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void visit_get_next_type(Visitor *v, int *obj, const int *qtypes,\n\n const char *name, Error **errp)\n\n{\n\n if (v->get_next_type) {\n\n v->get_next_type(v, obj, qtypes, name, errp);\n\n }\n\n}\n"}} {"sample_id": "afb2aa537954db537d54358997b68f46561fd5a7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static inline int vorbis_residue_decode(vorbis_context *vc, vorbis_residue *vr,\n+\n+ unsigned ch,\n+\n uint8_t *do_not_decode,\n \n float *vec, unsigned vlen)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static inline int vorbis_residue_decode(vorbis_context *vc, vorbis_residue *vr,\n\n unsigned ch,\n\n uint8_t *do_not_decode,\n\n float *vec, unsigned vlen)\n\n{\n\n if (vr->type == 2)\n\n return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, 2);\n\n else if (vr->type == 1)\n\n return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, 1);\n\n else if (vr->type == 0)\n\n return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, 0);\n\n else {\n\n av_log(vc->avccontext, AV_LOG_ERROR, \" Invalid residue type while residue decode?! \\n\");\n\n return AVERROR_INVALIDDATA;\n\n }\n\n}\n"}} {"sample_id": "4dec101acc393fbfe9a8ce0237b9efbae3f20139", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int dxva2_vc1_start_frame(AVCodecContext *avctx,\n \n+ av_unused const uint8_t *buffer,\n+\n+ av_unused uint32_t size)\n+\n+{\n \n const VC1Context *v = avctx->priv_data;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int dxva2_vc1_start_frame(AVCodecContext *avctx,\n\n av_unused const uint8_t *buffer,\n\n av_unused uint32_t size)\n\n{\n\n const VC1Context *v = avctx->priv_data;\n\n AVDXVAContext *ctx = avctx->hwaccel_context;\n\n struct dxva2_picture_context *ctx_pic = v->s.current_picture_ptr->hwaccel_picture_private;\n\n\n\n if (!DXVA_CONTEXT_VALID(avctx, ctx))\n\n return -1;\n\n assert(ctx_pic);\n\n\n\n fill_picture_parameters(avctx, ctx, v, &ctx_pic->pp);\n\n\n\n ctx_pic->bitstream_size = 0;\n\n ctx_pic->bitstream = NULL;\n\n return 0;\n\n}\n"}} {"sample_id": "52c91dac6bd891656f297dab76da51fc8bc61309", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void memory_region_init_alias(MemoryRegion *mr,\n \n+ Object *owner,\n+\n const char *name,\n \n MemoryRegion *orig,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void memory_region_init_alias(MemoryRegion *mr,\n\n Object *owner,\n\n const char *name,\n\n MemoryRegion *orig,\n\n hwaddr offset,\n\n uint64_t size)\n\n{\n\n memory_region_init(mr, owner, name, size);\n\n memory_region_ref(orig);\n\n mr->destructor = memory_region_destructor_alias;\n\n mr->alias = orig;\n\n mr->alias_offset = offset;\n\n}\n"}} {"sample_id": "b5da07d4340a8e8e40dcd1900977a76ff31fbb84_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+void ff_put_h264_qpel4_mc10_msa(uint8_t *dst, const uint8_t *src,\n+\n ptrdiff_t stride)\n \n {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_put_h264_qpel4_mc10_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n avc_luma_hz_qrt_4w_msa(src - 2, stride, dst, stride, 4, 0);\n\n}\n"}} {"sample_id": "43849424cff82803011fad21074531a1101e514e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n \n qemu_purge_queued_packets(nc);\n \n+\n+\n+ if (s->down_script[0])\n+\n+ launch_script(s->down_script, s->down_script_arg, s->fd);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void tap_cleanup(VLANClientState *nc)\n\n{\n\n TAPState *s = DO_UPCAST(TAPState, nc, nc);\n\n\n\n if (s->vhost_net) {\n\n vhost_net_cleanup(s->vhost_net);\n\n\n }\n\n\n\n qemu_purge_queued_packets(nc);\n\n\n\n if (s->down_script[0])\n\n launch_script(s->down_script, s->down_script_arg, s->fd);\n\n\n\n tap_read_poll(s, 0);\n\n tap_write_poll(s, 0);\n\n close(s->fd);\n\n}"}} {"sample_id": "2f014567cfd63e58156f60666f1a61ba147276ab", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static const uint8_t *avc_mp4_find_startcode(const uint8_t *start, const uint8_t *end, int nal_length_size)\n+\n {\n \n+ int res = 0;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static const uint8_t *avc_mp4_find_startcode(const uint8_t *start, const uint8_t *end, int nal_length_size)\n\n{\n\n int res = 0;\n\n\n\n if (end - start < nal_length_size)\n\n return NULL;\n\n while (nal_length_size--)\n\n res = (res << 8) | *start++;\n\n\n\n if (start + res > end || res < 0 || start + res < start)\n\n return NULL;\n\n\n\n return start + res;\n\n}\n"}} {"sample_id": "7effbee66cf457c62f795d9b9ed3a1110b364b89", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n \n size= ffio_limit(s, size);\n \n+\n+\n+ ret= av_new_packet(pkt, size);\n+\n+\n \n if(ret<0)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "int av_get_packet(AVIOContext *s, AVPacket *pkt, int size)\n\n{\n\n int ret;\n\n\n size= ffio_limit(s, size);\n\n\n\n ret= av_new_packet(pkt, size);\n\n\n\n if(ret<0)\n\n return ret;\n\n\n\n pkt->pos= avio_tell(s);\n\n\n\n ret= avio_read(s, pkt->data, size);\n\n if(ret<=0)\n\n av_free_packet(pkt);\n\n else\n\n av_shrink_packet(pkt, ret);\n\n if (pkt->size < orig_size)\n\n pkt->flags |= AV_PKT_FLAG_CORRUPT;\n\n\n\n return ret;\n\n}"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_293", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n sense_len = cmd->frame->header.sense_len;\n \n+ }\n+\n+ if (sense_len) {\n+\n+ pa_lo = le32_to_cpu(cmd->frame->pass.sense_addr_lo);\n \n if (megasas_frame_is_sense64(cmd)) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int megasas_build_sense(MegasasCmd *cmd, uint8_t *sense_ptr,\n\n uint8_t sense_len)\n\n{\n\n uint32_t pa_hi = 0, pa_lo;\n\n target_phys_addr_t pa;\n\n\n\n if (sense_len > cmd->frame->header.sense_len) {\n\n sense_len = cmd->frame->header.sense_len;\n\n }\n\n if (sense_len) {\n\n pa_lo = le32_to_cpu(cmd->frame->pass.sense_addr_lo);\n\n if (megasas_frame_is_sense64(cmd)) {\n\n pa_hi = le32_to_cpu(cmd->frame->pass.sense_addr_hi);\n\n }\n\n pa = ((uint64_t) pa_hi << 32) | pa_lo;\n\n cpu_physical_memory_write(pa, sense_ptr, sense_len);\n\n cmd->frame->header.sense_len = sense_len;\n\n }\n\n return sense_len;\n\n}\n"}} {"sample_id": "f9d7e9feec2a0fd7f7930d01876a70a9b8a4a3b9_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n+static void close_slave(TeeSlave *tee_slave)\n \n {\n \n+ AVFormatContext *avf;\n+\n+ unsigned i;\n+\n+\n+\n avf = tee_slave->avf;\n \n for (i = 0; i < avf->nb_streams; ++i) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void close_slave(TeeSlave *tee_slave)\n\n{\n\n AVFormatContext *avf;\n\n unsigned i;\n\n\n\n avf = tee_slave->avf;\n\n for (i = 0; i < avf->nb_streams; ++i) {\n\n AVBitStreamFilterContext *bsf_next, *bsf = tee_slave->bsfs[i];\n\n while (bsf) {\n\n bsf_next = bsf->next;\n\n av_bitstream_filter_close(bsf);\n\n bsf = bsf_next;\n\n }\n\n }\n\n av_freep(&tee_slave->stream_map);\n\n av_freep(&tee_slave->bsfs);\n\n\n\n ff_format_io_close(avf, &avf->pb);\n\n avformat_free_context(avf);\n\n tee_slave->avf = NULL;\n\n}\n"}} {"sample_id": "586d2142a9f1aa5a1dceb0941e7b3f0953974a8b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -39,11 +39,11 @@\n child_name = object_get_canonical_path_component(OBJECT(drc));\n \n DPRINTFN(\"drc child name: %s\", child_name);\n+\n+ object_property_add_alias(root_container, link_name,\n+\n+ drc->owner, child_name, &err);\n+\n if (err) {\n \n error_report(\"%s\", error_get_pretty(err));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void realize(DeviceState *d, Error **errp)\n\n{\n\n sPAPRDRConnector *drc = SPAPR_DR_CONNECTOR(d);\n\n sPAPRDRConnectorClass *drck = SPAPR_DR_CONNECTOR_GET_CLASS(drc);\n\n Object *root_container;\n\n char link_name[256];\n\n gchar *child_name;\n\n Error *err = NULL;\n\n\n\n DPRINTFN(\"drc realize: %x\", drck->get_index(drc));\n\n /* NOTE: we do this as part of realize/unrealize due to the fact\n\n * that the guest will communicate with the DRC via RTAS calls\n\n * referencing the global DRC index. By unlinking the DRC\n\n * from DRC_CONTAINER_PATH/ we effectively make it\n\n * inaccessible by the guest, since lookups rely on this path\n\n * existing in the composition tree\n\n */\n\n root_container = container_get(object_get_root(), DRC_CONTAINER_PATH);\n\n snprintf(link_name, sizeof(link_name), \"%x\", drck->get_index(drc));\n\n child_name = object_get_canonical_path_component(OBJECT(drc));\n\n DPRINTFN(\"drc child name: %s\", child_name);\n\n object_property_add_alias(root_container, link_name,\n\n drc->owner, child_name, &err);\n\n if (err) {\n\n error_report(\"%s\", error_get_pretty(err));\n\n error_free(err);\n\n object_unref(OBJECT(drc));\n\n }\n\n\n DPRINTFN(\"drc realize complete\");\n\n}"}} {"sample_id": "d0dafebb753f34da61058adf956663de39a815b4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n if(ctx->tok_ptrs[type] >= ctx->tok_lens[type]) {\n \n av_log(ctx->avctx, AV_LOG_ERROR, \"Read token from stream %i out of bounds (%i>=%i)\\n\", type, ctx->tok_ptrs[type], ctx->tok_lens[type]);\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static inline int GET_TOK(TM2Context *ctx,int type) {\n\n if(ctx->tok_ptrs[type] >= ctx->tok_lens[type]) {\n\n av_log(ctx->avctx, AV_LOG_ERROR, \"Read token from stream %i out of bounds (%i>=%i)\\n\", type, ctx->tok_ptrs[type], ctx->tok_lens[type]);\n\n return 0;\n\n }\n\n if(type <= TM2_MOT)\n\n return ctx->deltas[type][ctx->tokens[type][ctx->tok_ptrs[type]++]];\n\n return ctx->tokens[type][ctx->tok_ptrs[type]++];\n\n}\n"}} {"sample_id": "6350b0904615cc0531cc3059ea34db5c009c88aa", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n Error *local_err = NULL;\n \n int64_t value;\n+\n \n \n if (dev->state != DEV_STATE_CREATED) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void set_int32(Object *obj, Visitor *v, void *opaque,\n\n const char *name, Error **errp)\n\n{\n\n DeviceState *dev = DEVICE(obj);\n\n Property *prop = opaque;\n\n int32_t *ptr = qdev_get_prop_ptr(dev, prop);\n\n Error *local_err = NULL;\n\n int64_t value;\n\n\n\n if (dev->state != DEV_STATE_CREATED) {\n\n error_set(errp, QERR_PERMISSION_DENIED);\n\n return;\n\n }\n\n\n\n visit_type_int(v, &value, name, &local_err);\n\n if (local_err) {\n\n error_propagate(errp, local_err);\n\n return;\n\n }\n\n if (value > prop->info->min && value <= prop->info->max) {\n\n *ptr = value;\n\n } else {\n\n error_set(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE,\n\n dev->id?:\"\", name, value, prop->info->min,\n\n prop->info->max);\n\n }\n\n}\n"}} {"sample_id": "21cb1e63a594e36ff350fba41600190fb0a1f42b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n int n;\n \n \n+\n /*\n \n * As of Linux 3.7 the tpm_tis driver does not properly cancel", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void tpm_passthrough_cancel_cmd(TPMBackend *tb)\n\n{\n\n TPMPassthruState *tpm_pt = TPM_PASSTHROUGH(tb);\n\n int n;\n\n\n\n /*\n\n * As of Linux 3.7 the tpm_tis driver does not properly cancel\n\n * commands on all TPM manufacturers' TPMs.\n\n * Only cancel if we're busy so we don't cancel someone else's\n\n * command, e.g., a command executed on the host.\n\n */\n\n if (tpm_pt->tpm_executing) {\n\n if (tpm_pt->cancel_fd >= 0) {\n\n n = write(tpm_pt->cancel_fd, \"-\", 1);\n\n if (n != 1) {\n\n error_report(\"Canceling TPM command failed: %s\",\n\n strerror(errno));\n\n } else {\n\n tpm_pt->tpm_op_canceled = true;\n\n }\n\n } else {\n\n error_report(\"Cannot cancel TPM command due to missing \"\n\n \"TPM sysfs cancel entry\");\n\n }\n\n }\n\n}\n"}} {"sample_id": "932e6a5a4c78250e3cab4f65215214fb0dbf51f7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,8 +3,8 @@\n int size, float Q34, int is_signed, int maxval)\n \n {\n+\n+ int i;\n \n double qc;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void quantize_bands(int (*out)[2], const float *in, const float *scaled,\n\n int size, float Q34, int is_signed, int maxval)\n\n{\n\n int i;\n\n double qc;\n\n for (i = 0; i < size; i++) {\n\n qc = scaled[i] * Q34;\n\n out[i][0] = (int)FFMIN((int)qc, maxval);\n\n out[i][1] = (int)FFMIN((int)(qc + 0.4054), maxval);\n\n if (is_signed && in[i] < 0.0f) {\n\n out[i][0] = -out[i][0];\n\n out[i][1] = -out[i][1];\n\n }\n\n }\n\n}\n"}} {"sample_id": "13f59ae8157e8ec238fa8aefe5309909a1eeb7e2_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n QError *qerr;\n \n+\n+\n+ qerr = qerror_new();\n+\n+ loc_save(&qerr->loc);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static QError *qerror_from_info(const char *fmt, va_list *va)\n\n{\n\n QError *qerr;\n\n\n\n qerr = qerror_new();\n\n loc_save(&qerr->loc);\n\n\n\n qerr->error = error_obj_from_fmt_no_fail(fmt, va);\n\n qerr->err_msg = qerror_format(fmt, qerr->error);\n\n\n\n return qerr;\n\n}\n"}} {"sample_id": "87e8788680e16c51f6048af26f3f7830c35207a5_19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n \n \n+ /* for accuracy, check some header field values */\n+\n+ if (AV_RL32(&p->buf[12]) != 22050 || p->buf[16] != 16 || p->buf[17] != 0)\n+\n+ return 0;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int cin_probe(AVProbeData *p)\n\n{\n\n if (p->buf_size < 18)\n\n return 0;\n\n\n\n /* header starts with this special marker */\n\n if (AV_RL32(&p->buf[0]) != 0x55AA0000)\n\n return 0;\n\n\n\n /* for accuracy, check some header field values */\n\n if (AV_RL32(&p->buf[12]) != 22050 || p->buf[16] != 16 || p->buf[17] != 0)\n\n return 0;\n\n\n\n return AVPROBE_SCORE_MAX;\n\n}\n"}} {"sample_id": "dddc9b7a8ec3a03e48c69991ca7f20f10dd6f022_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,11 +34,11 @@\n \n ptl->profile_compatibility_flag[i] = get_bits1(gb);\n \n+ ptl->progressive_source_flag = get_bits1(gb);\n+\n+ ptl->interlaced_source_flag = get_bits1(gb);\n+\n+ ptl->non_packed_constraint_flag = get_bits1(gb);\n \n ptl->frame_only_constraint_flag = get_bits1(gb);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int decode_profile_tier_level(HEVCContext *s, ProfileTierLevel *ptl)\n\n{\n\n int i;\n\n HEVCLocalContext *lc = s->HEVClc;\n\n GetBitContext *gb = &lc->gb;\n\n\n\n ptl->profile_space = get_bits(gb, 2);\n\n ptl->tier_flag = get_bits1(gb);\n\n ptl->profile_idc = get_bits(gb, 5);\n\n if (ptl->profile_idc == 1)\n\n av_log(s->avctx, AV_LOG_DEBUG, \"Main profile bitstream\\n\");\n\n else if (ptl->profile_idc == 2)\n\n av_log(s->avctx, AV_LOG_DEBUG, \"Main10 profile bitstream\\n\");\n\n else\n\n av_log(s->avctx, AV_LOG_WARNING, \"No profile indication! (%d)\\n\", ptl->profile_idc);\n\n\n\n for (i = 0; i < 32; i++)\n\n ptl->profile_compatibility_flag[i] = get_bits1(gb);\n\n ptl->progressive_source_flag = get_bits1(gb);\n\n ptl->interlaced_source_flag = get_bits1(gb);\n\n ptl->non_packed_constraint_flag = get_bits1(gb);\n\n ptl->frame_only_constraint_flag = get_bits1(gb);\n\n if (get_bits(gb, 16) != 0) // XXX_reserved_zero_44bits[0..15]\n\n return -1;\n\n if (get_bits(gb, 16) != 0) // XXX_reserved_zero_44bits[16..31]\n\n return -1;\n\n if (get_bits(gb, 12) != 0) // XXX_reserved_zero_44bits[32..43]\n\n return -1;\n\n return 0;\n\n}\n"}} {"sample_id": "eabc977973103527bbb8fed69c91cfaa6691f8ab", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static void test_notify(void)\n+\n+{\n+\n g_assert(!aio_poll(ctx, false));\n \n aio_notify(ctx);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_notify(void)\n\n{\n\n g_assert(!aio_poll(ctx, false));\n\n aio_notify(ctx);\n\n g_assert(!aio_poll(ctx, true));\n\n g_assert(!aio_poll(ctx, false));\n\n}\n"}} {"sample_id": "dfd100f242370886bb6732f70f1f7cbd8eb9fedc_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n } else {\n \n fd = -EIO;\n+\n+ }\n+\n+\n+\n return fd;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int connect_to_sdog(BDRVSheepdogState *s, Error **errp)\n\n{\n\n int fd;\n\n\n\n fd = socket_connect(s->addr, NULL, NULL, errp);\n\n\n\n if (s->addr->type == SOCKET_ADDRESS_KIND_INET && fd >= 0) {\n\n int ret = socket_set_nodelay(fd);\n\n if (ret < 0) {\n\n error_report(\"%s\", strerror(errno));\n\n }\n\n }\n\n\n\n if (fd >= 0) {\n\n qemu_set_nonblock(fd);\n\n } else {\n\n fd = -EIO;\n\n }\n\n\n\n return fd;\n\n}\n"}} {"sample_id": "02ce232c5051854bf49e6d2816c65e00f6d7e036", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n clock->type = type;\n clock->enabled = true;\n clock->last = INT64_MIN;\n+ QLIST_INIT(&clock->timerlists);\n+ notifier_list_init(&clock->reset_notifiers);\n main_loop_tlg.tl[type] = timerlist_new(type, NULL, NULL);\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void qemu_clock_init(QEMUClockType type)\n{\n QEMUClock *clock = qemu_clock_ptr(type);\n clock->type = type;\n clock->enabled = true;\n clock->last = INT64_MIN;\n QLIST_INIT(&clock->timerlists);\n notifier_list_init(&clock->reset_notifiers);\n main_loop_tlg.tl[type] = timerlist_new(type, NULL, NULL);\n}"}} {"sample_id": "70fbd3c4bf9850fce733eea2c910c397905fb9a3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,9 +6,9 @@\n \n \n \n+ dc->realize = fsl_imx6_realize;\n+\n+\n \n dc->desc = \"i.MX6 SOC\";\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void fsl_imx6_class_init(ObjectClass *oc, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(oc);\n\n\n\n dc->realize = fsl_imx6_realize;\n\n\n\n dc->desc = \"i.MX6 SOC\";\n\n}\n"}} {"sample_id": "ef0e64a9838c0a20b5cb8a0bd2dcbcc59b0b812d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n \n \n if (count == 0) {\n+\n+ continue;\n+\n+ }\n+\n \n \n /* Got an entry! Submit and exit. */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ide_issue_trim_cb(void *opaque, int ret)\n\n{\n\n TrimAIOCB *iocb = opaque;\n\n if (ret >= 0) {\n\n while (iocb->j < iocb->qiov->niov) {\n\n int j = iocb->j;\n\n while (++iocb->i < iocb->qiov->iov[j].iov_len / 8) {\n\n int i = iocb->i;\n\n uint64_t *buffer = iocb->qiov->iov[j].iov_base;\n\n\n\n /* 6-byte LBA + 2-byte range per entry */\n\n uint64_t entry = le64_to_cpu(buffer[i]);\n\n uint64_t sector = entry & 0x0000ffffffffffffULL;\n\n uint16_t count = entry >> 48;\n\n\n\n if (count == 0) {\n\n continue;\n\n }\n\n\n\n /* Got an entry! Submit and exit. */\n\n iocb->aiocb = blk_aio_pdiscard(iocb->blk,\n\n sector << BDRV_SECTOR_BITS,\n\n count << BDRV_SECTOR_BITS,\n\n ide_issue_trim_cb, opaque);\n\n return;\n\n }\n\n\n\n iocb->j++;\n\n iocb->i = -1;\n\n }\n\n } else {\n\n iocb->ret = ret;\n\n }\n\n\n\n iocb->aiocb = NULL;\n\n if (iocb->bh) {\n\n qemu_bh_schedule(iocb->bh);\n\n }\n\n}\n"}} {"sample_id": "e7834d29f2a8f572a5bdf173d56b5a9b5af16043", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,7 +16,7 @@\n \n inpicref->height = outlink->h;\n \n+ inpicref->interlaced_frame = 0;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int filter_frame(AVFilterLink *inlink, AVFrame *inpicref)\n\n{\n\n AVFilterContext *ctx = inlink->dst;\n\n SeparateFieldsContext *sf = ctx->priv;\n\n AVFilterLink *outlink = ctx->outputs[0];\n\n AVFrame *second;\n\n int i, ret;\n\n\n\n inpicref->height = outlink->h;\n\n inpicref->interlaced_frame = 0;\n\n\n\n second = av_frame_clone(inpicref);\n\n if (!second)\n\n return AVERROR(ENOMEM);\n\n\n\n for (i = 0; i < sf->nb_planes; i++) {\n\n if (!inpicref->top_field_first)\n\n inpicref->data[i] = inpicref->data[i] + inpicref->linesize[i];\n\n else\n\n second->data[i] = second->data[i] + second->linesize[i];\n\n inpicref->linesize[i] *= 2;\n\n second->linesize[i] *= 2;\n\n }\n\n\n\n inpicref->pts = outlink->frame_count * sf->ts_unit;\n\n ret = ff_filter_frame(outlink, inpicref);\n\n if (ret < 0)\n\n return ret;\n\n\n\n second->pts = outlink->frame_count * sf->ts_unit;\n\n return ff_filter_frame(outlink, second);\n\n}\n"}} {"sample_id": "9732baf67850dac57dfc7dc8980bf408889a8973", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void test_server_free(TestServer *server)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void test_server_free(TestServer *server)\n\n{\n\n int i;\n\n\n\n qemu_chr_delete(server->chr);\n\n\n\n for (i = 0; i < server->fds_num; i++) {\n\n close(server->fds[i]);\n\n }\n\n\n\n if (server->log_fd != -1) {\n\n close(server->log_fd);\n\n }\n\n\n\n unlink(server->socket_path);\n\n g_free(server->socket_path);\n\n\n\n\n\n g_free(server->chr_name);\n\n g_free(server);\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_86", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n int bdrv_is_snapshot(BlockDriverState *bs)\n \n {\n+\n return !!(bs->open_flags & BDRV_O_SNAPSHOT);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int bdrv_is_snapshot(BlockDriverState *bs)\n\n{\n\n return !!(bs->open_flags & BDRV_O_SNAPSHOT);\n\n}\n"}} {"sample_id": "0ccb9c1d8128a020720d5c6abf99a470742a1b94_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,27 +1,27 @@\n DISAS_INSN(divl)\n+\n+{\n+\n TCGv num;\n \n+ TCGv den;\n+\n TCGv reg;\n \n+ uint16_t ext;\n+\n+\n \n+ ext = read_im16(env, s);\n+\n+ if (ext & 0x87f8) {\n \n+ gen_exception(s, s->pc - 4, EXCP_UNSUPPORTED);\n \n+ return;\n+\n }\n+\n num = DREG(ext, 12);\n \n reg = DREG(ext, 0);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "DISAS_INSN(divl)\n\n{\n\n TCGv num;\n\n TCGv den;\n\n TCGv reg;\n\n uint16_t ext;\n\n\n\n ext = read_im16(env, s);\n\n if (ext & 0x87f8) {\n\n gen_exception(s, s->pc - 4, EXCP_UNSUPPORTED);\n\n return;\n\n }\n\n num = DREG(ext, 12);\n\n reg = DREG(ext, 0);\n\n tcg_gen_mov_i32(QREG_DIV1, num);\n\n SRC_EA(env, den, OS_LONG, 0, NULL);\n\n tcg_gen_mov_i32(QREG_DIV2, den);\n\n if (ext & 0x0800) {\n\n gen_helper_divs(cpu_env, tcg_const_i32(0));\n\n } else {\n\n gen_helper_divu(cpu_env, tcg_const_i32(0));\n\n }\n\n if ((ext & 7) == ((ext >> 12) & 7)) {\n\n /* div */\n\n tcg_gen_mov_i32 (reg, QREG_DIV1);\n\n } else {\n\n /* rem */\n\n tcg_gen_mov_i32 (reg, QREG_DIV2);\n\n }\n\n set_cc_op(s, CC_OP_FLAGS);\n\n}\n"}} {"sample_id": "3604a76fea6ff37738d4a8f596be38407be74a83_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n } else {\n \n+ LOG_DIS(\"sru r%d, r%d, r%d\\n\", dc->r2, dc->r0, dc->r1);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void dec_sru(DisasContext *dc)\n\n{\n\n if (dc->format == OP_FMT_RI) {\n\n LOG_DIS(\"srui r%d, r%d, %d\\n\", dc->r1, dc->r0, dc->imm5);\n\n } else {\n\n LOG_DIS(\"sru r%d, r%d, r%d\\n\", dc->r2, dc->r0, dc->r1);\n\n }\n\n\n\n if (!(dc->env->features & LM32_FEATURE_SHIFT)) {\n\n if (dc->format == OP_FMT_RI) {\n\n /* TODO: check r1 == 1 during runtime */\n\n } else {\n\n if (dc->imm5 != 1) {\n\n cpu_abort(dc->env, \"hardware shifter is not available\\n\");\n\n }\n\n }\n\n }\n\n\n\n if (dc->format == OP_FMT_RI) {\n\n tcg_gen_shri_tl(cpu_R[dc->r1], cpu_R[dc->r0], dc->imm5);\n\n } else {\n\n TCGv t0 = tcg_temp_new();\n\n tcg_gen_andi_tl(t0, cpu_R[dc->r1], 0x1f);\n\n tcg_gen_shr_tl(cpu_R[dc->r2], cpu_R[dc->r0], t0);\n\n tcg_temp_free(t0);\n\n }\n\n}\n"}} {"sample_id": "e021eeb9f06f4f4d83690d07b47cdcc4172a61e1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n unsigned key_pos = 0;\n \n const char *opts = *ropts;\n+\n+\n+\n+ opts += strspn(opts, WHITESPACES);\n+\n while (is_key_char(*opts)) {\n \n key[key_pos++] = *opts;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int get_key(const char **ropts, const char *delim, char *key, unsigned key_size)\n\n{\n\n unsigned key_pos = 0;\n\n const char *opts = *ropts;\n\n\n\n opts += strspn(opts, WHITESPACES);\n\n while (is_key_char(*opts)) {\n\n key[key_pos++] = *opts;\n\n if (key_pos == key_size)\n\n key_pos--;\n\n (opts)++;\n\n }\n\n opts += strspn(opts, WHITESPACES);\n\n if (!*opts || !strchr(delim, *opts))\n\n return AVERROR(EINVAL);\n\n opts++;\n\n key[key_pos++] = 0;\n\n if (key_pos == key_size)\n\n key[key_pos - 4] = key[key_pos - 3] = key[key_pos - 2] = '.';\n\n *ropts = opts;\n\n return 0;\n\n}\n"}} {"sample_id": "32bafa8fdd098d52fbf1102d5a5e48d29398c0aa_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n NetClientState *peer, Error **errp)\n \n {\n+\n+ const NetdevBridgeOptions *bridge;\n+\n+ const char *helper, *br;\n+\n TAPState *s;\n \n int fd, vnet_hdr;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int net_init_bridge(const NetClientOptions *opts, const char *name,\n\n NetClientState *peer, Error **errp)\n\n{\n\n const NetdevBridgeOptions *bridge;\n\n const char *helper, *br;\n\n TAPState *s;\n\n int fd, vnet_hdr;\n\n\n\n assert(opts->type == NET_CLIENT_OPTIONS_KIND_BRIDGE);\n\n bridge = opts->u.bridge;\n\n\n\n helper = bridge->has_helper ? bridge->helper : DEFAULT_BRIDGE_HELPER;\n\n br = bridge->has_br ? bridge->br : DEFAULT_BRIDGE_INTERFACE;\n\n\n\n fd = net_bridge_run_helper(helper, br, errp);\n\n if (fd == -1) {\n\n return -1;\n\n }\n\n\n\n fcntl(fd, F_SETFL, O_NONBLOCK);\n\n vnet_hdr = tap_probe_vnet_hdr(fd);\n\n s = net_tap_fd_init(peer, \"bridge\", name, fd, vnet_hdr);\n\n\n\n snprintf(s->nc.info_str, sizeof(s->nc.info_str), \"helper=%s,br=%s\", helper,\n\n br);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "ad0ebb91cd8b5fdc4a583b03645677771f420a46", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void spapr_vio_quiesce_one(VIOsPAPRDevice *dev)\n+\n+{\n+\n+ dev->flags &= ~VIO_PAPR_FLAG_DMA_BYPASS;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void spapr_vio_quiesce_one(VIOsPAPRDevice *dev)\n\n{\n\n dev->flags &= ~VIO_PAPR_FLAG_DMA_BYPASS;\n\n\n\n if (dev->rtce_table) {\n\n size_t size = (dev->rtce_window_size >> SPAPR_VIO_TCE_PAGE_SHIFT)\n\n * sizeof(VIOsPAPR_RTCE);\n\n memset(dev->rtce_table, 0, size);\n\n }\n\n\n\n dev->crq.qladdr = 0;\n\n dev->crq.qsize = 0;\n\n dev->crq.qnext = 0;\n\n}\n"}} {"sample_id": "949fc82314cc84162e64a5323764527a542421ce", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int print_bit(DeviceState *dev, Property *prop, char *dest, size_t len)\n \n+{\n+\n uint32_t *p = qdev_get_prop_ptr(dev, prop);\n \n return snprintf(dest, len, (*p & qdev_get_prop_mask(prop)) ? \"on\" : \"off\");", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int print_bit(DeviceState *dev, Property *prop, char *dest, size_t len)\n\n{\n\n uint32_t *p = qdev_get_prop_ptr(dev, prop);\n\n return snprintf(dest, len, (*p & qdev_get_prop_mask(prop)) ? \"on\" : \"off\");\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_44", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,5 +7,5 @@\n iohandler_ctx = aio_context_new(&error_abort);\n \n }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void iohandler_init(void)\n\n{\n\n if (!iohandler_ctx) {\n\n iohandler_ctx = aio_context_new(&error_abort);\n\n }\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_120", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void qemu_update_position(QEMUFile *f, size_t size)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void qemu_update_position(QEMUFile *f, size_t size)\n\n{\n\n f->pos += size;\n\n}\n"}} {"sample_id": "2caf19e90f270abe1e80a3e85acaf0eb5c9d0aac_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void FUNCC(pred4x4_horizontal)(uint8_t *_src, const uint8_t *topright, int _stride){\n \n pixel *src = (pixel*)_src;\n+\n+ int stride = _stride/sizeof(pixel);\n+\n+ ((pixel4*)(src+0*stride))[0]= PIXEL_SPLAT_X4(src[-1+0*stride]);\n \n ((pixel4*)(src+1*stride))[0]= PIXEL_SPLAT_X4(src[-1+1*stride]);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void FUNCC(pred4x4_horizontal)(uint8_t *_src, const uint8_t *topright, int _stride){\n\n pixel *src = (pixel*)_src;\n\n int stride = _stride/sizeof(pixel);\n\n ((pixel4*)(src+0*stride))[0]= PIXEL_SPLAT_X4(src[-1+0*stride]);\n\n ((pixel4*)(src+1*stride))[0]= PIXEL_SPLAT_X4(src[-1+1*stride]);\n\n ((pixel4*)(src+2*stride))[0]= PIXEL_SPLAT_X4(src[-1+2*stride]);\n\n ((pixel4*)(src+3*stride))[0]= PIXEL_SPLAT_X4(src[-1+3*stride]);\n\n}\n"}} {"sample_id": "792773b2255d25c6f5fe9dfa0ae200debab92de4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,10 +11,10 @@\n block_mig_state.submitted = 0;\n \n block_mig_state.read_done = 0;\n+\n block_mig_state.transferred = 0;\n \n+ block_mig_state.total_sector_sum = 0;\n \n block_mig_state.prev_progress = -1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void init_blk_migration(Monitor *mon, QEMUFile *f)\n\n{\n\n BlkMigDevState *bmds;\n\n BlockDriverState *bs;\n\n\n\n block_mig_state.submitted = 0;\n\n block_mig_state.read_done = 0;\n\n block_mig_state.transferred = 0;\n\n block_mig_state.total_sector_sum = 0;\n\n block_mig_state.prev_progress = -1;\n\n\n\n for (bs = bdrv_first; bs != NULL; bs = bs->next) {\n\n if (bs->type == BDRV_TYPE_HD) {\n\n bmds = qemu_mallocz(sizeof(BlkMigDevState));\n\n bmds->bs = bs;\n\n bmds->bulk_completed = 0;\n\n bmds->total_sectors = bdrv_getlength(bs) >> BDRV_SECTOR_BITS;\n\n bmds->completed_sectors = 0;\n\n bmds->shared_base = block_mig_state.shared_base;\n\n\n\n block_mig_state.total_sector_sum += bmds->total_sectors;\n\n\n\n if (bmds->shared_base) {\n\n monitor_printf(mon, \"Start migration for %s with shared base \"\n\n \"image\\n\",\n\n bs->device_name);\n\n } else {\n\n monitor_printf(mon, \"Start full migration for %s\\n\",\n\n bs->device_name);\n\n }\n\n\n\n QSIMPLEQ_INSERT_TAIL(&block_mig_state.bmds_list, bmds, entry);\n\n }\n\n }\n\n}\n"}} {"sample_id": "d6309c170eb99950c9f1d881a5ff7163ae28d353_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n test_data data;\n+\n \n \n memset(&data, 0, sizeof(data));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void test_acpi_q35_tcg_cphp(void)\n\n{\n\n test_data data;\n\n\n\n memset(&data, 0, sizeof(data));\n\n data.machine = MACHINE_Q35;\n\n data.variant = \".cphp\";\n\n test_acpi_one(\" -smp 2,cores=3,sockets=2,maxcpus=6\",\n\n &data);\n\n free_test_data(&data);\n\n}\n"}} {"sample_id": "34c52005605d68f7cd1957b169b6732c7d2447d9_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void move_audio(vorbis_enc_context *venc, float **audio, int *samples, int sf_size)\n \n {\n \n@@ -8,7 +8,7 @@\n \n int subframes = frame_size / sf_size;\n \n+\n \n for (int sf = 0; sf < subframes; sf++) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void move_audio(vorbis_enc_context *venc, float **audio, int *samples, int sf_size)\n\n{\n\n AVFrame *cur = NULL;\n\n int frame_size = 1 << (venc->log2_blocksize[1] - 1);\n\n int subframes = frame_size / sf_size;\n\n\n\n for (int sf = 0; sf < subframes; sf++) {\n\n cur = ff_bufqueue_get(&venc->bufqueue);\n\n *samples += cur->nb_samples;\n\n\n\n for (int ch = 0; ch < venc->channels; ch++) {\n\n const float *input = (float *) cur->extended_data[ch];\n\n const size_t len = cur->nb_samples * sizeof(float);\n\n memcpy(&audio[ch][sf*sf_size], input, len);\n\n }\n\n av_frame_free(&cur);\n\n }\n\n}\n"}} {"sample_id": "f9b89b61f819535b4dbe6c3e9f0d6fc8becf64cb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n switch (AV_RL32(&p->buf[0])) {\n+\n case ISNh_TAG:\n \n case SCHl_TAG:", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int ea_probe(AVProbeData *p)\n\n{\n\n switch (AV_RL32(&p->buf[0])) {\n\n case ISNh_TAG:\n\n case SCHl_TAG:\n\n case SEAD_TAG:\n\n case SHEN_TAG:\n\n case kVGT_TAG:\n\n case MADk_TAG:\n\n case MPCh_TAG:\n\n case MVhd_TAG:\n\n case MVIh_TAG:\n\n break;\n\n default:\n\n return 0;\n\n }\n\n if (AV_RL32(&p->buf[4]) > 0xfffff && AV_RB32(&p->buf[4]) > 0xfffff)\n\n return 0;\n\n\n\n return AVPROBE_SCORE_MAX;\n\n}\n"}} {"sample_id": "e549933a270dd2cfc36f2cf9bb6b29acf3dc6d08_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n uint32_t multiple8_cnt;\n \n \n+\n+ for (multiple8_cnt = 4; multiple8_cnt--;) {\n+\n+ avc_luma_midh_qrt_4w_msa(src, src_stride, dst, dst_stride, height,\n+\n horiz_offset);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void avc_luma_midh_qrt_16w_msa(const uint8_t *src, int32_t src_stride,\n\n uint8_t *dst, int32_t dst_stride,\n\n int32_t height, uint8_t horiz_offset)\n\n{\n\n uint32_t multiple8_cnt;\n\n\n\n for (multiple8_cnt = 4; multiple8_cnt--;) {\n\n avc_luma_midh_qrt_4w_msa(src, src_stride, dst, dst_stride, height,\n\n horiz_offset);\n\n\n\n src += 4;\n\n dst += 4;\n\n }\n\n}\n"}} {"sample_id": "6970c5ff13a47df7ce41b901a4459c587a03d16b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n int idx;\n CPUState *cs;\n+ CPUArchId *cpu_slot;\n+ X86CPUTopoInfo topo;\n+ X86CPU *cpu = X86_CPU(dev);\n+ PCMachineState *pcms = PC_MACHINE(hotplug_dev);\n+ /* if APIC ID is not set, set it based on socket/core/thread properties */\n if (cpu->apic_id == UNASSIGNED_APIC_ID) {\n int max_socket = (max_cpus - 1) / smp_threads / smp_cores;\n if (cpu->socket_id < 0) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void pc_cpu_pre_plug(HotplugHandler *hotplug_dev,\n DeviceState *dev, Error **errp)\n{\n int idx;\n CPUState *cs;\n CPUArchId *cpu_slot;\n X86CPUTopoInfo topo;\n X86CPU *cpu = X86_CPU(dev);\n PCMachineState *pcms = PC_MACHINE(hotplug_dev);\n /* if APIC ID is not set, set it based on socket/core/thread properties */\n if (cpu->apic_id == UNASSIGNED_APIC_ID) {\n int max_socket = (max_cpus - 1) / smp_threads / smp_cores;\n if (cpu->socket_id < 0) {\n error_setg(errp, \"CPU socket-id is not set\");\n } else if (cpu->socket_id > max_socket) {\n error_setg(errp, \"Invalid CPU socket-id: %u must be in range 0:%u\",\n cpu->socket_id, max_socket);\n if (cpu->core_id < 0) {\n error_setg(errp, \"CPU core-id is not set\");\n } else if (cpu->core_id > (smp_cores - 1)) {\n error_setg(errp, \"Invalid CPU core-id: %u must be in range 0:%u\",\n cpu->core_id, smp_cores - 1);\n if (cpu->thread_id < 0) {\n error_setg(errp, \"CPU thread-id is not set\");\n } else if (cpu->thread_id > (smp_threads - 1)) {\n error_setg(errp, \"Invalid CPU thread-id: %u must be in range 0:%u\",\n cpu->thread_id, smp_threads - 1);\n topo.pkg_id = cpu->socket_id;\n topo.core_id = cpu->core_id;\n topo.smt_id = cpu->thread_id;\n cpu->apic_id = apicid_from_topo_ids(smp_cores, smp_threads, &topo);\n cpu_slot = pc_find_cpu_slot(MACHINE(pcms), cpu->apic_id, &idx);\n if (!cpu_slot) {\n MachineState *ms = MACHINE(pcms);\n x86_topo_ids_from_apicid(cpu->apic_id, smp_cores, smp_threads, &topo);\n error_setg(errp, \"Invalid CPU [socket: %u, core: %u, thread: %u] with\"\n \" APIC ID %\" PRIu32 \", valid index range 0:%d\",\n topo.pkg_id, topo.core_id, topo.smt_id, cpu->apic_id,\n ms->possible_cpus->len - 1);\n if (cpu_slot->cpu) {\n error_setg(errp, \"CPU[%d] with APIC ID %\" PRIu32 \" exists\",\n idx, cpu->apic_id);\n /* if 'address' properties socket-id/core-id/thread-id are not set, set them\n * so that machine_query_hotpluggable_cpus would show correct values\n */\n /* TODO: move socket_id/core_id/thread_id checks into x86_cpu_realizefn()\n * once -smp refactoring is complete and there will be CPU private\n * CPUState::nr_cores and CPUState::nr_threads fields instead of globals */\n x86_topo_ids_from_apicid(cpu->apic_id, smp_cores, smp_threads, &topo);\n if (cpu->socket_id != -1 && cpu->socket_id != topo.pkg_id) {\n error_setg(errp, \"property socket-id: %u doesn't match set apic-id:\"\n \" 0x%x (socket-id: %u)\", cpu->socket_id, cpu->apic_id, topo.pkg_id);\n cpu->socket_id = topo.pkg_id;\n if (cpu->core_id != -1 && cpu->core_id != topo.core_id) {\n error_setg(errp, \"property core-id: %u doesn't match set apic-id:\"\n \" 0x%x (core-id: %u)\", cpu->core_id, cpu->apic_id, topo.core_id);\n cpu->core_id = topo.core_id;\n if (cpu->thread_id != -1 && cpu->thread_id != topo.smt_id) {\n error_setg(errp, \"property thread-id: %u doesn't match set apic-id:\"\n \" 0x%x (thread-id: %u)\", cpu->thread_id, cpu->apic_id, topo.smt_id);\n cpu->thread_id = topo.smt_id;\n cs = CPU(cpu);\n cs->cpu_index = idx;\n numa_cpu_pre_plug(cpu_slot, dev, errp);"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_28", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n const uint8_t *buf, int nb_sectors)\n \n+{\n+\n return bdrv_rw_co(bs, sector_num, (uint8_t *)buf, nb_sectors, true, 0);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int bdrv_write(BlockDriverState *bs, int64_t sector_num,\n\n const uint8_t *buf, int nb_sectors)\n\n{\n\n return bdrv_rw_co(bs, sector_num, (uint8_t *)buf, nb_sectors, true, 0);\n\n}\n"}} {"sample_id": "7372c2b926200db295412efbb53f93773b7f1754_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n TCGv tmp;\n \n switch (opsize) {\n+\n case OS_BYTE:\n \n tcg_gen_andi_i32(reg, reg, 0xffffff00);\n@@ -13,7 +13,7 @@\n tmp = tcg_temp_new();\n \n tcg_gen_ext8u_i32(tmp, val);\n+\n tcg_gen_or_i32(reg, reg, tmp);\n \n break;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void gen_partset_reg(int opsize, TCGv reg, TCGv val)\n\n{\n\n TCGv tmp;\n\n switch (opsize) {\n\n case OS_BYTE:\n\n tcg_gen_andi_i32(reg, reg, 0xffffff00);\n\n tmp = tcg_temp_new();\n\n tcg_gen_ext8u_i32(tmp, val);\n\n tcg_gen_or_i32(reg, reg, tmp);\n\n break;\n\n case OS_WORD:\n\n tcg_gen_andi_i32(reg, reg, 0xffff0000);\n\n tmp = tcg_temp_new();\n\n tcg_gen_ext16u_i32(tmp, val);\n\n tcg_gen_or_i32(reg, reg, tmp);\n\n break;\n\n case OS_LONG:\n\n case OS_SINGLE:\n\n tcg_gen_mov_i32(reg, val);\n\n break;\n\n default:\n\n qemu_assert(0, \"Bad operand size\");\n\n break;\n\n }\n\n}\n"}} {"sample_id": "57f5c1b093e1c3ec185770d2a180259205f980be_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n return float32_abs(t0);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "float32 helper_fabs_FT(float32 t0)\n\n{\n\n return float32_abs(t0);\n\n}\n"}} {"sample_id": "7b899f4dd596dbb7d271f7fab36fbfffec84868e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n if (verbose) {\n \n fprintf(stderr, \"\\t%s\\n\", hmp_cmds[i]);\n+\n+ }\n+\n+ response = hmp(hmp_cmds[i]);\n+\n g_free(response);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_commands(void)\n\n{\n\n char *response;\n\n int i;\n\n\n\n for (i = 0; hmp_cmds[i] != NULL; i++) {\n\n if (verbose) {\n\n fprintf(stderr, \"\\t%s\\n\", hmp_cmds[i]);\n\n }\n\n response = hmp(hmp_cmds[i]);\n\n g_free(response);\n\n }\n\n\n\n}\n"}} {"sample_id": "f94b3f64e6572c8cec73a538588f7cd754bcfa88_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,16 +1,16 @@\n+static void test_qga_fstrim(gconstpointer fix)\n+\n+{\n+\n+ const TestFixture *fixture = fix;\n+\n+ QDict *ret;\n+\n+ QList *list;\n+\n+ const QListEntry *entry;\n+\n+\n \n ret = qmp_fd(fixture->fd, \"{'execute': 'guest-fstrim',\"\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void test_qga_fstrim(gconstpointer fix)\n\n{\n\n const TestFixture *fixture = fix;\n\n QDict *ret;\n\n QList *list;\n\n const QListEntry *entry;\n\n\n\n ret = qmp_fd(fixture->fd, \"{'execute': 'guest-fstrim',\"\n\n \" arguments: { minimum: 4194304 } }\");\n\n g_assert_nonnull(ret);\n\n qmp_assert_no_error(ret);\n\n list = qdict_get_qlist(ret, \"return\");\n\n entry = qlist_first(list);\n\n g_assert(qdict_haskey(qobject_to_qdict(entry->value), \"paths\"));\n\n\n\n QDECREF(ret);\n\n}\n"}} {"sample_id": "7d553f27fce284805d7f94603932045ee3bbb979_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static void usb_device_class_init(ObjectClass *klass, void *data)\n+\n+{\n+\n DeviceClass *k = DEVICE_CLASS(klass);\n \n k->bus_type = TYPE_USB_BUS;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void usb_device_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *k = DEVICE_CLASS(klass);\n\n k->bus_type = TYPE_USB_BUS;\n\n k->init = usb_qdev_init;\n\n k->unplug = qdev_simple_unplug_cb;\n\n k->exit = usb_qdev_exit;\n\n k->props = usb_props;\n\n}\n"}} {"sample_id": "3ca5df36a50e3ffd3b24734725bf545617a627a8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n s->packet_loss = 1;\n \n+ s->packet_done = 0;\n \n s->num_saved_bits = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void flush(AVCodecContext *avctx)\n\n{\n\n WmallDecodeCtx *s = avctx->priv_data;\n\n s->packet_loss = 1;\n\n s->packet_done = 0;\n\n s->num_saved_bits = 0;\n\n s->frame_offset = 0;\n\n s->next_packet_start = 0;\n\n s->cdlms[0][0].order = 0;\n\n s->frame.nb_samples = 0;\n\n init_put_bits(&s->pb, s->frame_data, MAX_FRAMESIZE);\n\n}\n"}} {"sample_id": "482f7bf86b43af9f6903c52726fedf82b28bf953", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,8 +28,8 @@\n const char *nextopt;\n if (strstart(opts, \",retrace=\", &nextopt)) {\n if (strstart(opts, \"dumb\", &nextopt))\n+ vga_retrace_method = VGA_RETRACE_DUMB;\n+ else if (strstart(opts, \"precise\", &nextopt))\n+ vga_retrace_method = VGA_RETRACE_PRECISE;\n+ else goto invalid_vga;\n+ } else goto invalid_vga;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void select_vgahw (const char *p)\n{\n const char *opts;\n vga_interface_type = VGA_NONE;\n if (strstart(p, \"std\", &opts)) {\n if (vga_available()) {\n vga_interface_type = VGA_STD;\n fprintf(stderr, \"Error: standard VGA not available\\n\");\n exit(0);\n } else if (strstart(p, \"cirrus\", &opts)) {\n if (cirrus_vga_available()) {\n vga_interface_type = VGA_CIRRUS;\n fprintf(stderr, \"Error: Cirrus VGA not available\\n\");\n exit(0);\n } else if (strstart(p, \"vmware\", &opts)) {\n if (vmware_vga_available()) {\n vga_interface_type = VGA_VMWARE;\n fprintf(stderr, \"Error: VMWare SVGA not available\\n\");\n exit(0);\n } else if (strstart(p, \"xenfb\", &opts)) {\n vga_interface_type = VGA_XENFB;\n } else if (strstart(p, \"qxl\", &opts)) {\n vga_interface_type = VGA_QXL;\n } else if (!strstart(p, \"none\", &opts)) {\n invalid_vga:\n fprintf(stderr, \"Unknown vga type: %s\\n\", p);\n exit(1);\n const char *nextopt;\n if (strstart(opts, \",retrace=\", &nextopt)) {\n if (strstart(opts, \"dumb\", &nextopt))\n vga_retrace_method = VGA_RETRACE_DUMB;\n else if (strstart(opts, \"precise\", &nextopt))\n vga_retrace_method = VGA_RETRACE_PRECISE;\n else goto invalid_vga;\n } else goto invalid_vga;"}} {"sample_id": "4a0f6651434c6f213d830140f575b4ec7858519f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n AVFrame *tmp;\n \n int ret;\n+\n+\n+\n+ av_assert0(avctx->codec_type == AVMEDIA_TYPE_VIDEO);\n+\n \n \n if (!frame->data[0])", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int ff_reget_buffer(AVCodecContext *avctx, AVFrame *frame)\n\n{\n\n AVFrame *tmp;\n\n int ret;\n\n\n\n av_assert0(avctx->codec_type == AVMEDIA_TYPE_VIDEO);\n\n\n\n if (!frame->data[0])\n\n return ff_get_buffer(avctx, frame, AV_GET_BUFFER_FLAG_REF);\n\n\n\n if (av_frame_is_writable(frame)) {\n\n frame->pkt_pts = avctx->internal->pkt ? avctx->internal->pkt->pts : AV_NOPTS_VALUE;\n\n frame->reordered_opaque = avctx->reordered_opaque;\n\n return 0;\n\n }\n\n\n\n tmp = av_frame_alloc();\n\n if (!tmp)\n\n return AVERROR(ENOMEM);\n\n\n\n av_frame_move_ref(tmp, frame);\n\n\n\n ret = ff_get_buffer(avctx, frame, AV_GET_BUFFER_FLAG_REF);\n\n if (ret < 0) {\n\n av_frame_free(&tmp);\n\n return ret;\n\n }\n\n\n\n av_frame_copy(frame, tmp);\n\n av_frame_free(&tmp);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "8bba5c81b1febeb20cdd60f1c18eb0e695cad6d6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -68,10 +68,10 @@\n \n \n \n+ memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));\n+\n+\n+\n+ vnc_dpy_resize(vs->ds, 640, 400);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void vnc_display_init(DisplayState *ds)\n\n{\n\n VncState *vs;\n\n\n\n vs = qemu_mallocz(sizeof(VncState));\n\n if (!vs)\n\n\texit(1);\n\n\n\n ds->opaque = vs;\n\n vnc_state = vs;\n\n vs->display = NULL;\n\n vs->password = NULL;\n\n\n\n vs->lsock = -1;\n\n vs->csock = -1;\n\n vs->depth = 4;\n\n vs->last_x = -1;\n\n vs->last_y = -1;\n\n\n\n vs->ds = ds;\n\n\n\n if (!keyboard_layout)\n\n\tkeyboard_layout = \"en-us\";\n\n\n\n vs->kbd_layout = init_keyboard_layout(keyboard_layout);\n\n if (!vs->kbd_layout)\n\n\texit(1);\n\n\n\n vs->timer = qemu_new_timer(rt_clock, vnc_update_client, vs);\n\n\n\n vs->ds->data = NULL;\n\n vs->ds->dpy_update = vnc_dpy_update;\n\n vs->ds->dpy_resize = vnc_dpy_resize;\n\n vs->ds->dpy_refresh = NULL;\n\n\n\n memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));\n\n\n\n vnc_dpy_resize(vs->ds, 640, 400);\n\n}\n"}} {"sample_id": "57407ea44cc0a3d630b9b89a2be011f1955ce5c1_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void isa_ne2000_cleanup(NetClientState *nc)\n+\n+{\n \n NE2000State *s = qemu_get_nic_opaque(nc);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void isa_ne2000_cleanup(NetClientState *nc)\n\n{\n\n NE2000State *s = qemu_get_nic_opaque(nc);\n\n\n\n s->nic = NULL;\n\n}\n"}} {"sample_id": "3604a76fea6ff37738d4a8f596be38407be74a83_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n if (dc->format == OP_FMT_RI) {\n \n LOG_DIS(\"sli r%d, r%d, %d\\n\", dc->r1, dc->r0, dc->imm5);\n+\n } else {\n \n LOG_DIS(\"sl r%d, r%d, r%d\\n\", dc->r2, dc->r0, dc->r1);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void dec_sl(DisasContext *dc)\n\n{\n\n if (dc->format == OP_FMT_RI) {\n\n LOG_DIS(\"sli r%d, r%d, %d\\n\", dc->r1, dc->r0, dc->imm5);\n\n } else {\n\n LOG_DIS(\"sl r%d, r%d, r%d\\n\", dc->r2, dc->r0, dc->r1);\n\n }\n\n\n\n if (!(dc->env->features & LM32_FEATURE_SHIFT)) {\n\n cpu_abort(dc->env, \"hardware shifter is not available\\n\");\n\n }\n\n\n\n if (dc->format == OP_FMT_RI) {\n\n tcg_gen_shli_tl(cpu_R[dc->r1], cpu_R[dc->r0], dc->imm5);\n\n } else {\n\n TCGv t0 = tcg_temp_new();\n\n tcg_gen_andi_tl(t0, cpu_R[dc->r1], 0x1f);\n\n tcg_gen_shl_tl(cpu_R[dc->r2], cpu_R[dc->r0], t0);\n\n tcg_temp_free(t0);\n\n }\n\n}\n"}} {"sample_id": "a67cb012e6947fb238193afc0f18114f6e20818c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,8 +12,8 @@\n \n return NULL;\n \n+\n+\n c->phase_shift= phase_shift;\n \n c->phase_mask= phase_count-1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "AVResampleContext *av_resample_init(int out_rate, int in_rate, int filter_size, int phase_shift, int linear, double cutoff){\n\n AVResampleContext *c= av_mallocz(sizeof(AVResampleContext));\n\n double factor= FFMIN(out_rate * cutoff / in_rate, 1.0);\n\n int phase_count= 1<phase_shift= phase_shift;\n\n c->phase_mask= phase_count-1;\n\n c->linear= linear;\n\n\n\n c->filter_length= FFMAX((int)ceil(filter_size/factor), 1);\n\n c->filter_bank= av_mallocz(c->filter_length*(phase_count+1)*sizeof(FELEM));\n\n if (!c->filter_bank)\n\n goto error;\n\n if (build_filter(c->filter_bank, factor, c->filter_length, phase_count, 1<filter_bank[c->filter_length*phase_count+1], c->filter_bank, (c->filter_length-1)*sizeof(FELEM));\n\n c->filter_bank[c->filter_length*phase_count]= c->filter_bank[c->filter_length - 1];\n\n\n\n c->src_incr= out_rate;\n\n c->ideal_dst_incr= c->dst_incr= in_rate * phase_count;\n\n c->index= -phase_count*((c->filter_length-1)/2);\n\n\n\n return c;\n\nerror:\n\n av_free(c->filter_bank);\n\n av_free(c);\n\n return NULL;\n\n}\n"}} {"sample_id": "494a8ebe713055d3946183f4b395f85a18b43e9e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n if (!fs->dir) {\n \n serrno = errno;\n+\n+ close(fd);\n+\n+ errno = serrno;\n+\n return -1;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int proxy_opendir(FsContext *ctx,\n\n V9fsPath *fs_path, V9fsFidOpenState *fs)\n\n{\n\n int serrno, fd;\n\n\n\n fs->dir = NULL;\n\n fd = v9fs_request(ctx->private, T_OPEN, NULL, \"sd\", fs_path, O_DIRECTORY);\n\n if (fd < 0) {\n\n errno = -fd;\n\n return -1;\n\n }\n\n fs->dir = fdopendir(fd);\n\n if (!fs->dir) {\n\n serrno = errno;\n\n close(fd);\n\n errno = serrno;\n\n return -1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "919f3554387e043bdfe10c6369356d1104882183", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+void ff_decode_dxt1(const uint8_t *s, uint8_t *dst,\n \n const unsigned int w, const unsigned int h,\n \n+ const unsigned int stride) {\n+\n unsigned int bx, by, qstride = stride/4;\n \n uint32_t *d = (uint32_t *) dst;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void ff_decode_dxt1(const uint8_t *s, uint8_t *dst,\n\n const unsigned int w, const unsigned int h,\n\n const unsigned int stride) {\n\n unsigned int bx, by, qstride = stride/4;\n\n uint32_t *d = (uint32_t *) dst;\n\n\n\n for (by=0; by < h/4; by++, d += stride-w)\n\n for (bx=0; bx < w/4; bx++, s+=8, d+=4)\n\n dxt1_decode_pixels(s, d, qstride, 0, 0LL);\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static QPCIDevice *get_pci_device(void **bmdma_base, void **ide_base)\n \n {\n \n@@ -10,8 +10,8 @@\n \n if (!pcibus) {\n \n+ pcibus = qpci_init_pc(NULL);\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static QPCIDevice *get_pci_device(void **bmdma_base, void **ide_base)\n\n{\n\n QPCIDevice *dev;\n\n uint16_t vendor_id, device_id;\n\n\n\n if (!pcibus) {\n\n pcibus = qpci_init_pc(NULL);\n\n }\n\n\n\n /* Find PCI device and verify it's the right one */\n\n dev = qpci_device_find(pcibus, QPCI_DEVFN(IDE_PCI_DEV, IDE_PCI_FUNC));\n\n g_assert(dev != NULL);\n\n\n\n vendor_id = qpci_config_readw(dev, PCI_VENDOR_ID);\n\n device_id = qpci_config_readw(dev, PCI_DEVICE_ID);\n\n g_assert(vendor_id == PCI_VENDOR_ID_INTEL);\n\n g_assert(device_id == PCI_DEVICE_ID_INTEL_82371SB_1);\n\n\n\n /* Map bmdma BAR */\n\n *bmdma_base = qpci_iomap(dev, 4, NULL);\n\n\n\n *ide_base = qpci_legacy_iomap(dev, IDE_BASE);\n\n\n\n qpci_device_enable(dev);\n\n\n\n return dev;\n\n}\n"}} {"sample_id": "010ec6293409f10b88631c36145944b9c3277ce1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+ EEPRO100State *s = opaque;\n+\n+ TRACE(OTHER, logout(\"%p\\n\", s));\n \n /* TODO: Clearing of multicast table for selective reset, too? */\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void nic_reset(void *opaque)\n\n{\n\n EEPRO100State *s = opaque;\n\n TRACE(OTHER, logout(\"%p\\n\", s));\n\n /* TODO: Clearing of multicast table for selective reset, too? */\n\n memset(&s->mult[0], 0, sizeof(s->mult));\n\n nic_selective_reset(s);\n\n}\n"}} {"sample_id": "fe52840c8760122257be7b7e4893dd951480a71f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void coroutine_enter_cb(void *opaque, int ret)\n \n {\n+\n+ Coroutine *co = opaque;\n \n qemu_coroutine_enter(co, NULL);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void coroutine_enter_cb(void *opaque, int ret)\n\n{\n\n Coroutine *co = opaque;\n\n qemu_coroutine_enter(co, NULL);\n\n}\n"}} {"sample_id": "c6f10a5876a81f7a016714df06730c48210ee419", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,17 +1,17 @@\n+type_init(serial_register_types)\n \n \n+\n+static bool serial_isa_init(ISABus *bus, int index, CharDriverState *chr)\n+\n {\n \n DeviceState *dev;\n \n+ ISADevice *isadev;\n \n \n+\n isadev = isa_try_create(bus, TYPE_ISA_SERIAL);\n \n if (!isadev) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "type_init(serial_register_types)\n\n\n\nstatic bool serial_isa_init(ISABus *bus, int index, CharDriverState *chr)\n\n{\n\n DeviceState *dev;\n\n ISADevice *isadev;\n\n\n\n isadev = isa_try_create(bus, TYPE_ISA_SERIAL);\n\n if (!isadev) {\n\n return false;\n\n }\n\n dev = DEVICE(isadev);\n\n qdev_prop_set_uint32(dev, \"index\", index);\n\n qdev_prop_set_chr(dev, \"chardev\", chr);\n\n if (qdev_init(dev) < 0) {\n\n return false;\n\n }\n\n return true;\n\n}\n"}} {"sample_id": "089da572b956ef0f8f5b8d5917358e07892a77c2_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ uint64_t *copy;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void fw_cfg_add_i64(FWCfgState *s, uint16_t key, uint64_t value)\n\n{\n\n uint64_t *copy;\n\n\n\n copy = g_malloc(sizeof(value));\n\n *copy = cpu_to_le64(value);\n\n fw_cfg_add_bytes(s, key, (uint8_t *)copy, sizeof(value));\n\n}\n"}} {"sample_id": "7d1b0095bff7157e856d1d0e6c4295641ced2752_22", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static inline TCGv gen_ld16s(TCGv addr, int index)\n+\n {\n \n TCGv tmp = new_tmp();", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline TCGv gen_ld16s(TCGv addr, int index)\n\n{\n\n TCGv tmp = new_tmp();\n\n tcg_gen_qemu_ld16s(tmp, addr, index);\n\n return tmp;\n\n}\n"}} {"sample_id": "42a268c241183877192c376d03bd9b6d527407c7_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n gen_set_label(l1);\n \n+ tcg_gen_mov_tl(cpu_gprh[rD(ctx->opcode)], cpu_gprh[rB(ctx->opcode)]);\n+\n+ gen_set_label(l2);\n+\n+ tcg_gen_andi_i32(t0, cpu_crf[ctx->opcode & 0x07], 1 << 2);\n \n tcg_gen_brcondi_i32(TCG_COND_EQ, t0, 0, l3);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_evsel(DisasContext *ctx)\n\n{\n\n int l1 = gen_new_label();\n\n int l2 = gen_new_label();\n\n int l3 = gen_new_label();\n\n int l4 = gen_new_label();\n\n TCGv_i32 t0 = tcg_temp_local_new_i32();\n\n tcg_gen_andi_i32(t0, cpu_crf[ctx->opcode & 0x07], 1 << 3);\n\n tcg_gen_brcondi_i32(TCG_COND_EQ, t0, 0, l1);\n\n tcg_gen_mov_tl(cpu_gprh[rD(ctx->opcode)], cpu_gprh[rA(ctx->opcode)]);\n\n tcg_gen_br(l2);\n\n gen_set_label(l1);\n\n tcg_gen_mov_tl(cpu_gprh[rD(ctx->opcode)], cpu_gprh[rB(ctx->opcode)]);\n\n gen_set_label(l2);\n\n tcg_gen_andi_i32(t0, cpu_crf[ctx->opcode & 0x07], 1 << 2);\n\n tcg_gen_brcondi_i32(TCG_COND_EQ, t0, 0, l3);\n\n tcg_gen_mov_tl(cpu_gpr[rD(ctx->opcode)], cpu_gpr[rA(ctx->opcode)]);\n\n tcg_gen_br(l4);\n\n gen_set_label(l3);\n\n tcg_gen_mov_tl(cpu_gpr[rD(ctx->opcode)], cpu_gpr[rB(ctx->opcode)]);\n\n gen_set_label(l4);\n\n tcg_temp_free_i32(t0);\n\n}\n"}} {"sample_id": "22c3aea8dbaac8616db71b6adf18dee801a24fde", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n \n \n QTAILQ_FOREACH_SAFE(cur, &list->head, next, next) {\n+\n+ if (cur->phys_addr >= begin + length ||\n+\n+ cur->phys_addr + cur->length <= begin) {\n+\n QTAILQ_REMOVE(&list->head, cur, next);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void memory_mapping_filter(MemoryMappingList *list, int64_t begin,\n\n int64_t length)\n\n{\n\n MemoryMapping *cur, *next;\n\n\n\n QTAILQ_FOREACH_SAFE(cur, &list->head, next, next) {\n\n if (cur->phys_addr >= begin + length ||\n\n cur->phys_addr + cur->length <= begin) {\n\n QTAILQ_REMOVE(&list->head, cur, next);\n\n\n list->num--;\n\n continue;\n\n }\n\n\n\n if (cur->phys_addr < begin) {\n\n cur->length -= begin - cur->phys_addr;\n\n if (cur->virt_addr) {\n\n cur->virt_addr += begin - cur->phys_addr;\n\n }\n\n cur->phys_addr = begin;\n\n }\n\n\n\n if (cur->phys_addr + cur->length > begin + length) {\n\n cur->length -= cur->phys_addr + cur->length - begin - length;\n\n }\n\n }\n\n}"}} {"sample_id": "31ccdde298d98b08526dc23059071c9086dec6c2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n const char *get_register_name_32(unsigned int reg)\n+\n {\n \n if (reg > CPU_NB_REGS32) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "const char *get_register_name_32(unsigned int reg)\n\n{\n\n if (reg > CPU_NB_REGS32) {\n\n return NULL;\n\n }\n\n return x86_reg_info_32[reg].name;\n\n}\n"}} {"sample_id": "14e4e26559697cfdea584767be4e68474a0a9c7f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n set_pos(s, i++, col, n1);\n \n+ if (i >= s->rows)\n+\n+ break;\n+\n+ set_pos(s, i++, col, n2);\n \n if (i >= s->rows)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int t15(InterplayACMContext *s, unsigned ind, unsigned col)\n\n{\n\n GetBitContext *gb = &s->gb;\n\n unsigned i, b;\n\n int n1, n2, n3;\n\n\n\n for (i = 0; i < s->rows; i++) {\n\n /* b = (x1) + (x2 * 3) + (x3 * 9) */\n\n b = get_bits(gb, 5);\n\n\n\n\n\n\n\n n1 = (mul_3x3[b] & 0x0F) - 1;\n\n n2 = ((mul_3x3[b] >> 4) & 0x0F) - 1;\n\n n3 = ((mul_3x3[b] >> 8) & 0x0F) - 1;\n\n\n\n set_pos(s, i++, col, n1);\n\n if (i >= s->rows)\n\n break;\n\n set_pos(s, i++, col, n2);\n\n if (i >= s->rows)\n\n break;\n\n set_pos(s, i, col, n3);\n\n\n return 0;\n"}} {"sample_id": "011de2b512a83aa5e9f8899ed5bbf2f31995b90e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n NetSocketState *s = DO_UPCAST(NetSocketState, nc, nc);\n \n qemu_set_fd_handler(s->fd, NULL, NULL, NULL);\n+\n+ close(s->fd);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void net_socket_cleanup(NetClientState *nc)\n\n{\n\n NetSocketState *s = DO_UPCAST(NetSocketState, nc, nc);\n\n qemu_set_fd_handler(s->fd, NULL, NULL, NULL);\n\n close(s->fd);\n\n}\n"}} {"sample_id": "06cc5e2b2d01cb778c966e1b4135062556b3b054", "diff": "--- a/source.c\n+++ b/source.c\n@@ -35,11 +35,11 @@\n \n \n for (i = 0; i < nb_clusters; i++) {\n+\n+ uint64_t old_offset;\n+\n+\n+\n old_offset = be64_to_cpu(l2_table[l2_index + i]);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int zero_single_l2(BlockDriverState *bs, uint64_t offset,\n\n uint64_t nb_clusters, int flags)\n\n{\n\n BDRVQcow2State *s = bs->opaque;\n\n uint64_t *l2_table;\n\n int l2_index;\n\n int ret;\n\n int i;\n\n\n\n ret = get_cluster_table(bs, offset, &l2_table, &l2_index);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n\n\n /* Limit nb_clusters to one L2 table */\n\n nb_clusters = MIN(nb_clusters, s->l2_size - l2_index);\n\n assert(nb_clusters <= INT_MAX);\n\n\n\n for (i = 0; i < nb_clusters; i++) {\n\n uint64_t old_offset;\n\n\n\n old_offset = be64_to_cpu(l2_table[l2_index + i]);\n\n\n\n /* Update L2 entries */\n\n qcow2_cache_entry_mark_dirty(bs, s->l2_table_cache, l2_table);\n\n if (old_offset & QCOW_OFLAG_COMPRESSED || flags & BDRV_REQ_MAY_UNMAP) {\n\n l2_table[l2_index + i] = cpu_to_be64(QCOW_OFLAG_ZERO);\n\n qcow2_free_any_clusters(bs, old_offset, 1, QCOW2_DISCARD_REQUEST);\n\n } else {\n\n l2_table[l2_index + i] |= cpu_to_be64(QCOW_OFLAG_ZERO);\n\n }\n\n }\n\n\n\n qcow2_cache_put(bs, s->l2_table_cache, (void **) &l2_table);\n\n\n\n return nb_clusters;\n\n}\n"}} {"sample_id": "cfaf6d36ae761da1033159d85d670706ffb24fb9_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n QEMUFile *f = opaque;\n \n+ int ret;\n+\n+\n+\n+ ret = qemu_loadvm_state(f);\n \n if (ret < 0) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void fd_accept_incoming_migration(void *opaque)\n\n{\n\n QEMUFile *f = opaque;\n\n int ret;\n\n\n\n ret = qemu_loadvm_state(f);\n\n if (ret < 0) {\n\n fprintf(stderr, \"load of migration failed\\n\");\n\n goto err;\n\n }\n\n qemu_announce_self();\n\n DPRINTF(\"successfully loaded vm state\\n\");\n\n /* we've successfully migrated, close the fd */\n\n qemu_set_fd_handler2(qemu_stdio_fd(f), NULL, NULL, NULL, NULL);\n\n if (autostart)\n\n vm_start();\n\n\n\nerr:\n\n qemu_fclose(f);\n\n}\n"}} {"sample_id": "4f5c2e651a95b950f6a3fb36f2342cbc32515f17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,8 +5,8 @@\n struct ogg *ogg = s->priv_data;\n \n struct ogg_stream *os = ogg->streams + idx;\n+\n+ AVStream *st = s->streams[idx];\n \n dirac_source_params source;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int dirac_header(AVFormatContext *s, int idx)\n\n{\n\n struct ogg *ogg = s->priv_data;\n\n struct ogg_stream *os = ogg->streams + idx;\n\n AVStream *st = s->streams[idx];\n\n dirac_source_params source;\n\n GetBitContext gb;\n\n\n\n // already parsed the header\n\n if (st->codec->codec_id == AV_CODEC_ID_DIRAC)\n\n return 0;\n\n\n\n init_get_bits(&gb, os->buf + os->pstart + 13, (os->psize - 13) * 8);\n\n if (avpriv_dirac_parse_sequence_header(st->codec, &gb, &source) < 0)\n\n return -1;\n\n\n\n st->codec->codec_type = AVMEDIA_TYPE_VIDEO;\n\n st->codec->codec_id = AV_CODEC_ID_DIRAC;\n\n // dirac in ogg always stores timestamps as though the video were interlaced\n\n avpriv_set_pts_info(st, 64, st->codec->framerate.den, 2*st->codec->framerate.num);\n\n return 1;\n\n}\n"}} {"sample_id": "78c2d8722b9118509e3d4ed8bae67c3e4eaa443e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n io_size = ACPI_PCIHP_LEGACY_SIZE;\n \n+\n+\n+ *bus_bsel = ACPI_PCIHP_BSEL_DEFAULT;\n+\n+ object_property_add_uint32_ptr(OBJECT(root_bus), ACPI_PCIHP_PROP_BSEL,\n \n bus_bsel, NULL);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void acpi_pcihp_init(AcpiPciHpState *s, PCIBus *root_bus,\n\n MemoryRegion *address_space_io, bool bridges_enabled)\n\n{\n\n uint16_t io_size = ACPI_PCIHP_SIZE;\n\n\n\n s->root= root_bus;\n\n s->legacy_piix = !bridges_enabled;\n\n\n\n if (s->legacy_piix) {\n\n unsigned *bus_bsel = g_malloc(sizeof *bus_bsel);\n\n\n\n io_size = ACPI_PCIHP_LEGACY_SIZE;\n\n\n\n *bus_bsel = ACPI_PCIHP_BSEL_DEFAULT;\n\n object_property_add_uint32_ptr(OBJECT(root_bus), ACPI_PCIHP_PROP_BSEL,\n\n bus_bsel, NULL);\n\n }\n\n\n\n memory_region_init_io(&s->io, NULL, &acpi_pcihp_io_ops, s,\n\n \"acpi-pci-hotplug\", io_size);\n\n memory_region_add_subregion(address_space_io, ACPI_PCIHP_ADDR, &s->io);\n\n}\n"}} {"sample_id": "f02ca5cbeaf86038834c1953247a1579d7921927_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n if (ct & TCG_CT_CONST)\n \n+ return 1;\n+\n+ else if ((ct & TCG_CT_CONST_S11) && ABS(val) == (ABS(val) & 0x3ff))\n+\n+ return 1;\n \n else if ((ct & TCG_CT_CONST_S13) && ABS(val) == (ABS(val) & 0xfff))\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline int tcg_target_const_match(tcg_target_long val,\n\n const TCGArgConstraint *arg_ct)\n\n{\n\n int ct;\n\n\n\n ct = arg_ct->ct;\n\n if (ct & TCG_CT_CONST)\n\n return 1;\n\n else if ((ct & TCG_CT_CONST_S11) && ABS(val) == (ABS(val) & 0x3ff))\n\n return 1;\n\n else if ((ct & TCG_CT_CONST_S13) && ABS(val) == (ABS(val) & 0xfff))\n\n return 1;\n\n else\n\n return 0;\n\n}\n"}} {"sample_id": "6f37226b687f969bcf6e47a4fb5c28a32d107aa3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,8 +3,8 @@\n {\n \n const H264Context *h = sl->h264;\n+\n+ int alloc_size = FFALIGN(FFABS(linesize) + 32, 32);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int alloc_scratch_buffers(H264SliceContext *sl, int linesize)\n\n{\n\n const H264Context *h = sl->h264;\n\n int alloc_size = FFALIGN(FFABS(linesize) + 32, 32);\n\n\n\n av_fast_malloc(&sl->bipred_scratchpad, &sl->bipred_scratchpad_allocated, 16 * 6 * alloc_size);\n\n // edge emu needs blocksize + filter length - 1\n\n // (= 21x21 for h264)\n\n av_fast_malloc(&sl->edge_emu_buffer, &sl->edge_emu_buffer_allocated, alloc_size * 2 * 21);\n\n\n\n av_fast_malloc(&sl->top_borders[0], &sl->top_borders_allocated[0],\n\n h->mb_width * 16 * 3 * sizeof(uint8_t) * 2);\n\n av_fast_malloc(&sl->top_borders[1], &sl->top_borders_allocated[1],\n\n h->mb_width * 16 * 3 * sizeof(uint8_t) * 2);\n\n\n\n if (!sl->bipred_scratchpad || !sl->edge_emu_buffer ||\n\n !sl->top_borders[0] || !sl->top_borders[1]) {\n\n av_freep(&sl->bipred_scratchpad);\n\n av_freep(&sl->edge_emu_buffer);\n\n av_freep(&sl->top_borders[0]);\n\n av_freep(&sl->top_borders[1]);\n\n\n\n sl->bipred_scratchpad_allocated = 0;\n\n sl->edge_emu_buffer_allocated = 0;\n\n sl->top_borders_allocated[0] = 0;\n\n sl->top_borders_allocated[1] = 0;\n\n return AVERROR(ENOMEM);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "0393cf15dbe3b136647b81676a105815924eebcd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void av_parser_close(AVCodecParserContext *s)\n \n+{\n+\n if(s){\n+\n if (s->parser->parser_close) {\n \n ff_lock_avcodec(NULL);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void av_parser_close(AVCodecParserContext *s)\n\n{\n\n if(s){\n\n if (s->parser->parser_close) {\n\n ff_lock_avcodec(NULL);\n\n s->parser->parser_close(s);\n\n ff_unlock_avcodec();\n\n }\n\n av_free(s->priv_data);\n\n av_free(s);\n\n }\n\n}\n"}} {"sample_id": "db3a5ed7e4422491dac1f83264ebb01f6667ffc8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n int rc;\n \n+\n \n pstrcpy(dev->product_desc, sizeof(dev->product_desc), info->product_desc);\n \n@@ -17,12 +17,12 @@\n dev->auto_attach = 1;\n \n QLIST_INIT(&dev->strings);\n+\n rc = usb_claim_port(dev);\n \n if (rc != 0) {\n+\n+ goto err;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int usb_qdev_init(DeviceState *qdev, DeviceInfo *base)\n\n{\n\n USBDevice *dev = DO_UPCAST(USBDevice, qdev, qdev);\n\n USBDeviceInfo *info = DO_UPCAST(USBDeviceInfo, qdev, base);\n\n int rc;\n\n\n\n pstrcpy(dev->product_desc, sizeof(dev->product_desc), info->product_desc);\n\n dev->info = info;\n\n dev->auto_attach = 1;\n\n QLIST_INIT(&dev->strings);\n\n rc = usb_claim_port(dev);\n\n if (rc != 0) {\n\n goto err;\n\n }\n\n rc = dev->info->init(dev);\n\n if (rc != 0) {\n\n goto err;\n\n }\n\n if (dev->auto_attach) {\n\n rc = usb_device_attach(dev);\n\n if (rc != 0) {\n\n goto err;\n\n }\n\n }\n\n return 0;\n\n\n\nerr:\n\n usb_qdev_exit(qdev);\n\n return rc;\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_45", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+PPC_OP(tlbie)\n \n+{\n \n do_tlbie();\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "PPC_OP(tlbie)\n\n{\n\n do_tlbie();\n\n RETURN();\n\n}\n"}} {"sample_id": "ce81e47c911fcff4f006b3b14b40a396eaa77696", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n while ((c->high >> 15) - (c->low >> 15) < 2) {\n \n if ((c->low ^ c->high) & 0x10000) {\n+\n+ c->high ^= 0x8000;\n+\n c->value ^= 0x8000;\n \n c->low ^= 0x8000;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void arith2_normalise(ArithCoder *c)\n\n{\n\n while ((c->high >> 15) - (c->low >> 15) < 2) {\n\n if ((c->low ^ c->high) & 0x10000) {\n\n c->high ^= 0x8000;\n\n c->value ^= 0x8000;\n\n c->low ^= 0x8000;\n\n }\n\n c->high = c->high << 8 & 0xFFFFFF | 0xFF;\n\n c->value = c->value << 8 & 0xFFFFFF | bytestream2_get_byte(c->gbc.gB);\n\n c->low = c->low << 8 & 0xFFFFFF;\n\n }\n\n}\n"}} {"sample_id": "7a4f74eed51f914e9bbfebaffd4a92ac6791f819", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ H264Context *h = avctx->priv_data;\n+\n+ int i;\n+\n+\n \n memset(h->delayed_pic, 0, sizeof(h->delayed_pic));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void flush_dpb(AVCodecContext *avctx)\n\n{\n\n H264Context *h = avctx->priv_data;\n\n int i;\n\n\n\n memset(h->delayed_pic, 0, sizeof(h->delayed_pic));\n\n\n\n ff_h264_flush_change(h);\n\n\n\n if (h->DPB)\n\n for (i = 0; i < H264_MAX_PICTURE_COUNT; i++)\n\n ff_h264_unref_picture(h, &h->DPB[i]);\n\n h->cur_pic_ptr = NULL;\n\n ff_h264_unref_picture(h, &h->cur_pic);\n\n\n\n h->mb_y = 0;\n\n\n\n ff_h264_free_tables(h);\n\n h->context_initialized = 0;\n\n}\n"}} {"sample_id": "8917c3bdba37d6fe4393db0fad3fabbde9530d6b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void slirp_select_fill(int *pnfds, fd_set *readfds,\n \n+ fd_set *writefds, fd_set *xfds)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void slirp_select_fill(int *pnfds, fd_set *readfds,\n\n fd_set *writefds, fd_set *xfds)\n\n{\n\n}\n"}} {"sample_id": "dedc5eae2324b3c4a6d25af2138396aa5dc3d9e0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void xtensa_cpu_list(FILE *f, fprintf_function cpu_fprintf)\n \n {\n+\n+ cpu_fprintf(f, \"Available CPUs:\\n\"\n \n \" Xtensa core\\n\");\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void xtensa_cpu_list(FILE *f, fprintf_function cpu_fprintf)\n\n{\n\n cpu_fprintf(f, \"Available CPUs:\\n\"\n\n \" Xtensa core\\n\");\n\n}\n"}} {"sample_id": "983bff3530782d51c46c8d7c0e17e2a9dfe5fb77_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n \n \n if (o->have_children) {\n+\n return;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void usb_mtp_object_readdir(MTPState *s, MTPObject *o)\n\n{\n\n struct dirent *entry;\n\n DIR *dir;\n\n\n\n if (o->have_children) {\n\n return;\n\n }\n\n o->have_children = true;\n\n\n\n dir = opendir(o->path);\n\n if (!dir) {\n\n return;\n\n }\n\n#ifdef __linux__\n\n int watchfd = usb_mtp_add_watch(s->inotifyfd, o->path);\n\n if (watchfd == -1) {\n\n fprintf(stderr, \"usb-mtp: failed to add watch for %s\\n\", o->path);\n\n } else {\n\n trace_usb_mtp_inotify_event(s->dev.addr, o->path,\n\n 0, \"Watch Added\");\n\n o->watchfd = watchfd;\n\n }\n\n#endif\n\n while ((entry = readdir(dir)) != NULL) {\n\n usb_mtp_add_child(s, o, entry->d_name);\n\n }\n\n closedir(dir);\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_41", "diff": "--- a/source.c\n+++ b/source.c\n@@ -56,11 +56,11 @@\n \n return ret;\n \n+ }\n+\n+\n+\n+ /*\n \n * SEND was received with new bytes, now try again.\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int qemu_rdma_get_buffer(void *opaque, uint8_t *buf,\n\n int64_t pos, int size)\n\n{\n\n QEMUFileRDMA *r = opaque;\n\n RDMAContext *rdma = r->rdma;\n\n RDMAControlHeader head;\n\n int ret = 0;\n\n\n\n CHECK_ERROR_STATE();\n\n\n\n /*\n\n * First, we hold on to the last SEND message we\n\n * were given and dish out the bytes until we run\n\n * out of bytes.\n\n */\n\n r->len = qemu_rdma_fill(r->rdma, buf, size, 0);\n\n if (r->len) {\n\n return r->len;\n\n }\n\n\n\n /*\n\n * Once we run out, we block and wait for another\n\n * SEND message to arrive.\n\n */\n\n ret = qemu_rdma_exchange_recv(rdma, &head, RDMA_CONTROL_QEMU_FILE);\n\n\n\n if (ret < 0) {\n\n rdma->error_state = ret;\n\n return ret;\n\n }\n\n\n\n /*\n\n * SEND was received with new bytes, now try again.\n\n */\n\n return qemu_rdma_fill(r->rdma, buf, size, 0);\n\n}\n"}} {"sample_id": "34a8dcd031d637273cdea021e5a79cf720c4c51c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n if(smk->type_tbl)\n \n+ av_free(smk->type_tbl);\n+\n+\n+\n+ if (smk->pic.data[0])\n \n avctx->release_buffer(avctx, &smk->pic);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int decode_end(AVCodecContext *avctx)\n\n{\n\n SmackVContext * const smk = (SmackVContext *)avctx->priv_data;\n\n\n\n if(smk->mmap_tbl)\n\n av_free(smk->mmap_tbl);\n\n if(smk->mclr_tbl)\n\n av_free(smk->mclr_tbl);\n\n if(smk->full_tbl)\n\n av_free(smk->full_tbl);\n\n if(smk->type_tbl)\n\n av_free(smk->type_tbl);\n\n\n\n if (smk->pic.data[0])\n\n avctx->release_buffer(avctx, &smk->pic);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_326", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static uint64_t jazz_led_read(void *opaque, target_phys_addr_t addr,\n \n unsigned int size)\n+\n+{\n+\n+ LedState *s = opaque;\n+\n uint8_t val;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t jazz_led_read(void *opaque, target_phys_addr_t addr,\n\n unsigned int size)\n\n{\n\n LedState *s = opaque;\n\n uint8_t val;\n\n\n\n val = s->segments;\n\n trace_jazz_led_read(addr, val);\n\n\n\n return val;\n\n}\n"}} {"sample_id": "963f76144897d3f7684d82ec21e51dd50ea1106e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static av_always_inline int even(uint64_t layout)\n+\n {\n \n return (!layout || (layout & (layout - 1)));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static av_always_inline int even(uint64_t layout)\n\n{\n\n return (!layout || (layout & (layout - 1)));\n\n}\n"}} {"sample_id": "3e36aba757f76673007a80b3cd56a4062c2e3462", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int mp_pacl_setxattr(FsContext *ctx, const char *path, const char *name,\n+\n+ void *value, size_t size, int flags)\n+\n+{\n+\n+ char *buffer;\n \n int ret;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int mp_pacl_setxattr(FsContext *ctx, const char *path, const char *name,\n\n void *value, size_t size, int flags)\n\n{\n\n char *buffer;\n\n int ret;\n\n\n\n buffer = rpath(ctx, path);\n\n ret = lsetxattr(buffer, MAP_ACL_ACCESS, value, size, flags);\n\n g_free(buffer);\n\n return ret;\n\n}\n"}} {"sample_id": "e46ab997506e8aa84344c29553ebacca7993904c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n struct ogg *ogg = s->priv_data;\n \n AVIOContext *bc = s->pb;\n+\n struct ogg_state *ost = ogg->state;\n \n int i, err;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int ogg_restore(AVFormatContext *s)\n\n{\n\n struct ogg *ogg = s->priv_data;\n\n AVIOContext *bc = s->pb;\n\n struct ogg_state *ost = ogg->state;\n\n int i, err;\n\n\n\n if (!ost)\n\n return 0;\n\n\n\n ogg->state = ost->next;\n\n\n\n for (i = 0; i < ogg->nstreams; i++)\n\n av_freep(&ogg->streams[i].buf);\n\n\n\n avio_seek(bc, ost->pos, SEEK_SET);\n\n ogg->page_pos = -1;\n\n ogg->curidx = ost->curidx;\n\n ogg->nstreams = ost->nstreams;\n\n if ((err = av_reallocp_array(&ogg->streams, ogg->nstreams,\n\n sizeof(*ogg->streams))) < 0) {\n\n ogg->nstreams = 0;\n\n return err;\n\n } else\n\n memcpy(ogg->streams, ost->streams,\n\n ost->nstreams * sizeof(*ogg->streams));\n\n\n\n av_free(ost);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "eb7a20a3616085d46aa6b4b4224e15587ec67e6e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n DeviceClass *dc = DEVICE_CLASS(klass);\n \n+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);\n+\n+\n+\n+ k->config_read = i6300esb_config_read;\n \n k->config_write = i6300esb_config_write;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void i6300esb_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);\n\n\n\n k->config_read = i6300esb_config_read;\n\n k->config_write = i6300esb_config_write;\n\n k->realize = i6300esb_realize;\n\n\n k->vendor_id = PCI_VENDOR_ID_INTEL;\n\n k->device_id = PCI_DEVICE_ID_INTEL_ESB_9;\n\n k->class_id = PCI_CLASS_SYSTEM_OTHER;\n\n dc->reset = i6300esb_reset;\n\n dc->vmsd = &vmstate_i6300esb;\n\n set_bit(DEVICE_CATEGORY_MISC, dc->categories);\n\n}"}} {"sample_id": "fedf0d35aafc4f1f1e5f6dbc80cb23ae1ae49f0b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n QEMUPutLEDEntry *qemu_add_led_event_handler(QEMUPutLEDEvent *func,\n \n+ void *opaque)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "QEMUPutLEDEntry *qemu_add_led_event_handler(QEMUPutLEDEvent *func,\n\n void *opaque)\n\n{\n\n QEMUPutLEDEntry *s;\n\n\n\n s = g_malloc0(sizeof(QEMUPutLEDEntry));\n\n\n\n s->put_led = func;\n\n s->opaque = opaque;\n\n QTAILQ_INSERT_TAIL(&led_handlers, s, next);\n\n return s;\n\n}\n"}} {"sample_id": "8b2fce0d3f5a56c40c28899c9237210ca8f9cf75", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static inline void RENAME(yuv2yuvX)(SwsContext *c, int16_t *lumFilter, int16_t **lumSrc, int lumFilterSize,\n \n int16_t *chrFilter, int16_t **chrSrc, int chrFilterSize,\n+\n+ uint8_t *dest, uint8_t *uDest, uint8_t *vDest, long dstW, long chrDstW)\n \n+{\n+\n #ifdef HAVE_MMX\n \n if (c->flags & SWS_ACCURATE_RND){", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void RENAME(yuv2yuvX)(SwsContext *c, int16_t *lumFilter, int16_t **lumSrc, int lumFilterSize,\n\n int16_t *chrFilter, int16_t **chrSrc, int chrFilterSize,\n\n uint8_t *dest, uint8_t *uDest, uint8_t *vDest, long dstW, long chrDstW)\n\n{\n\n#ifdef HAVE_MMX\n\n if (c->flags & SWS_ACCURATE_RND){\n\n if (uDest){\n\n YSCALEYUV2YV12X_ACCURATE( 0, CHR_MMX_FILTER_OFFSET, uDest, chrDstW)\n\n YSCALEYUV2YV12X_ACCURATE(4096, CHR_MMX_FILTER_OFFSET, vDest, chrDstW)\n\n }\n\n\n\n YSCALEYUV2YV12X_ACCURATE(0, LUM_MMX_FILTER_OFFSET, dest, dstW)\n\n }else{\n\n if (uDest){\n\n YSCALEYUV2YV12X( 0, CHR_MMX_FILTER_OFFSET, uDest, chrDstW)\n\n YSCALEYUV2YV12X(4096, CHR_MMX_FILTER_OFFSET, vDest, chrDstW)\n\n }\n\n\n\n YSCALEYUV2YV12X(0, LUM_MMX_FILTER_OFFSET, dest, dstW)\n\n }\n\n#else\n\n#ifdef HAVE_ALTIVEC\n\nyuv2yuvX_altivec_real(lumFilter, lumSrc, lumFilterSize,\n\n chrFilter, chrSrc, chrFilterSize,\n\n dest, uDest, vDest, dstW, chrDstW);\n\n#else //HAVE_ALTIVEC\n\nyuv2yuvXinC(lumFilter, lumSrc, lumFilterSize,\n\n chrFilter, chrSrc, chrFilterSize,\n\n dest, uDest, vDest, dstW, chrDstW);\n\n#endif //!HAVE_ALTIVEC\n\n#endif /* HAVE_MMX */\n\n}\n"}} {"sample_id": "5839e53bbc0fec56021d758aab7610df421ed8c8_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n const char **formats = NULL;\n \n+\n \n QLIST_FOREACH(drv, &bdrv_drivers, list) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void bdrv_iterate_format(void (*it)(void *opaque, const char *name),\n\n void *opaque)\n\n{\n\n BlockDriver *drv;\n\n int count = 0;\n\n const char **formats = NULL;\n\n\n\n QLIST_FOREACH(drv, &bdrv_drivers, list) {\n\n if (drv->format_name) {\n\n bool found = false;\n\n int i = count;\n\n while (formats && i && !found) {\n\n found = !strcmp(formats[--i], drv->format_name);\n\n }\n\n\n\n if (!found) {\n\n formats = g_realloc(formats, (count + 1) * sizeof(char *));\n\n formats[count++] = drv->format_name;\n\n it(opaque, drv->format_name);\n\n }\n\n }\n\n }\n\n g_free(formats);\n\n}\n"}} {"sample_id": "c6d2283068026035a6468aae9dcde953bd7521ac", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,18 +1,18 @@\n void bdrv_set_dirty_tracking(BlockDriverState *bs, int enable)\n \n {\n+\n+ int64_t bitmap_size;\n+\n+\n+\n+ if (enable) {\n \n+ if (bs->dirty_tracking == 0) {\n+\n int64_t i;\n \n+ uint8_t test;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void bdrv_set_dirty_tracking(BlockDriverState *bs, int enable)\n\n{\n\n int64_t bitmap_size;\n\n\n\n if (enable) {\n\n if (bs->dirty_tracking == 0) {\n\n int64_t i;\n\n uint8_t test;\n\n\n\n bitmap_size = (bdrv_getlength(bs) >> BDRV_SECTOR_BITS);\n\n bitmap_size /= BDRV_SECTORS_PER_DIRTY_CHUNK;\n\n bitmap_size++;\n\n\n\n bs->dirty_bitmap = qemu_mallocz(bitmap_size);\n\n\n\n bs->dirty_tracking = enable;\n\n for(i = 0; i < bitmap_size; i++) test = bs->dirty_bitmap[i]; \n\n }\n\n } else {\n\n if (bs->dirty_tracking != 0) {\n\n qemu_free(bs->dirty_bitmap);\n\n bs->dirty_tracking = enable;\n\n }\n\n }\n\n}\n"}} {"sample_id": "b018ddf633f77195e9ae859c6d940a334e68879f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n uint64_t val, unsigned size)\n \n {\n+\n+#ifdef DEBUG_UNASSIGNED\n+\n+ printf(\"Unassigned mem write \" TARGET_FMT_plx \" = 0x%\"PRIx64\"\\n\", addr, val);\n \n #endif\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void unassigned_mem_write(void *opaque, hwaddr addr,\n\n uint64_t val, unsigned size)\n\n{\n\n#ifdef DEBUG_UNASSIGNED\n\n printf(\"Unassigned mem write \" TARGET_FMT_plx \" = 0x%\"PRIx64\"\\n\", addr, val);\n\n#endif\n\n#if defined(TARGET_ALPHA) || defined(TARGET_SPARC) || defined(TARGET_MICROBLAZE)\n\n cpu_unassigned_access(cpu_single_env, addr, 1, 0, 0, size);\n\n#endif\n\n}\n"}} {"sample_id": "cec939597722663f322941b4c12e00a583e63504", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n int x, y;\n \n+ int offset = ((offsets + offsetd + 1) | 1) << log2_denom;\n \n asm volatile(\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void ff_h264_biweight_WxH_mmx2(uint8_t *dst, uint8_t *src, int stride, int log2_denom, int weightd, int weights, int offsetd, int offsets, int w, int h)\n\n{\n\n int x, y;\n\n int offset = ((offsets + offsetd + 1) | 1) << log2_denom;\n\n asm volatile(\n\n \"movd %0, %%mm3 \\n\\t\"\n\n \"movd %1, %%mm4 \\n\\t\"\n\n \"movd %2, %%mm5 \\n\\t\"\n\n \"movd %3, %%mm6 \\n\\t\"\n\n \"pshufw $0, %%mm3, %%mm3 \\n\\t\"\n\n \"pshufw $0, %%mm4, %%mm4 \\n\\t\"\n\n \"pshufw $0, %%mm5, %%mm5 \\n\\t\"\n\n \"pxor %%mm7, %%mm7 \\n\\t\"\n\n :: \"g\"(weightd), \"g\"(weights), \"g\"(offset), \"g\"(log2_denom+1)\n\n );\n\n for(y=0; yregs[R_EDX], set);\n \n+ kvm_getput_reg(®s.rsi, &env->regs[R_ESI], set);\n+\n+ kvm_getput_reg(®s.rdi, &env->regs[R_EDI], set);\n+\n+ kvm_getput_reg(®s.rsp, &env->regs[R_ESP], set);\n \n kvm_getput_reg(®s.rbp, &env->regs[R_EBP], set);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int kvm_getput_regs(CPUState *env, int set)\n\n{\n\n struct kvm_regs regs;\n\n int ret = 0;\n\n\n\n if (!set) {\n\n ret = kvm_vcpu_ioctl(env, KVM_GET_REGS, ®s);\n\n if (ret < 0)\n\n return ret;\n\n }\n\n\n\n kvm_getput_reg(®s.rax, &env->regs[R_EAX], set);\n\n kvm_getput_reg(®s.rbx, &env->regs[R_EBX], set);\n\n kvm_getput_reg(®s.rcx, &env->regs[R_ECX], set);\n\n kvm_getput_reg(®s.rdx, &env->regs[R_EDX], set);\n\n kvm_getput_reg(®s.rsi, &env->regs[R_ESI], set);\n\n kvm_getput_reg(®s.rdi, &env->regs[R_EDI], set);\n\n kvm_getput_reg(®s.rsp, &env->regs[R_ESP], set);\n\n kvm_getput_reg(®s.rbp, &env->regs[R_EBP], set);\n\n#ifdef TARGET_X86_64\n\n kvm_getput_reg(®s.r8, &env->regs[8], set);\n\n kvm_getput_reg(®s.r9, &env->regs[9], set);\n\n kvm_getput_reg(®s.r10, &env->regs[10], set);\n\n kvm_getput_reg(®s.r11, &env->regs[11], set);\n\n kvm_getput_reg(®s.r12, &env->regs[12], set);\n\n kvm_getput_reg(®s.r13, &env->regs[13], set);\n\n kvm_getput_reg(®s.r14, &env->regs[14], set);\n\n kvm_getput_reg(®s.r15, &env->regs[15], set);\n\n#endif\n\n\n\n kvm_getput_reg(®s.rflags, &env->eflags, set);\n\n kvm_getput_reg(®s.rip, &env->eip, set);\n\n\n\n if (set)\n\n ret = kvm_vcpu_ioctl(env, KVM_SET_REGS, ®s);\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "64e69d50a394a48de7607f178d53c192443f9066", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void net_check_clients(void)\n \n {\n+\n VLANState *vlan;\n \n VLANClientState *vc;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void net_check_clients(void)\n\n{\n\n VLANState *vlan;\n\n VLANClientState *vc;\n\n int has_nic, has_host_dev;\n\n\n\n QTAILQ_FOREACH(vlan, &vlans, next) {\n\n QTAILQ_FOREACH(vc, &vlan->clients, next) {\n\n switch (vc->info->type) {\n\n case NET_CLIENT_TYPE_NIC:\n\n has_nic = 1;\n\n break;\n\n case NET_CLIENT_TYPE_SLIRP:\n\n case NET_CLIENT_TYPE_TAP:\n\n case NET_CLIENT_TYPE_SOCKET:\n\n case NET_CLIENT_TYPE_VDE:\n\n has_host_dev = 1;\n\n break;\n\n default: ;\n\n }\n\n }\n\n if (has_host_dev && !has_nic)\n\n fprintf(stderr, \"Warning: vlan %d with no nics\\n\", vlan->id);\n\n if (has_nic && !has_host_dev)\n\n fprintf(stderr,\n\n \"Warning: vlan %d is not connected to host network\\n\",\n\n vlan->id);\n\n }\n\n QTAILQ_FOREACH(vc, &non_vlan_clients, next) {\n\n if (!vc->peer) {\n\n fprintf(stderr, \"Warning: %s %s has no peer\\n\",\n\n vc->info->type == NET_CLIENT_TYPE_NIC ? \"nic\" : \"netdev\",\n\n vc->name);\n\n }\n\n }\n\n}\n"}} {"sample_id": "b9bec74bcb16519a876ec21cd5277c526a9b512d_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,10 +2,10 @@\n \n {\n \n+ int n;\n+\n+\n+\n for (n = 0; n < nb_hw_breakpoint; n++)\n \n if (hw_breakpoint[n].addr == addr && hw_breakpoint[n].type == type &&", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int find_hw_breakpoint(target_ulong addr, int len, int type)\n\n{\n\n int n;\n\n\n\n for (n = 0; n < nb_hw_breakpoint; n++)\n\n if (hw_breakpoint[n].addr == addr && hw_breakpoint[n].type == type &&\n\n (hw_breakpoint[n].len == len || len == -1))\n\n return n;\n\n return -1;\n\n}\n"}} {"sample_id": "53510bfc1256711365cd2a841649f3ad5a79790f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n unsigned int queue_no,\n \n+ unsigned int vector,\n \n MSIMessage msg)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int kvm_virtio_pci_vq_vector_unmask(VirtIOPCIProxy *proxy,\n\n unsigned int queue_no,\n\n unsigned int vector,\n\n MSIMessage msg)\n\n{\n\n VirtQueue *vq = virtio_get_queue(proxy->vdev, queue_no);\n\n EventNotifier *n = virtio_queue_get_guest_notifier(vq);\n\n VirtIOIRQFD *irqfd = &proxy->vector_irqfd[vector];\n\n int ret;\n\n\n\n if (irqfd->msg.data != msg.data || irqfd->msg.address != msg.address) {\n\n ret = kvm_irqchip_update_msi_route(kvm_state, irqfd->virq, msg);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n }\n\n\n\n /* If guest supports masking, irqfd is already setup, unmask it.\n\n * Otherwise, set it up now.\n\n */\n\n if (proxy->vdev->guest_notifier_mask) {\n\n proxy->vdev->guest_notifier_mask(proxy->vdev, queue_no, false);\n\n /* Test after unmasking to avoid losing events. */\n\n if (proxy->vdev->guest_notifier_pending &&\n\n proxy->vdev->guest_notifier_pending(proxy->vdev, queue_no)) {\n\n event_notifier_set(n);\n\n }\n\n } else {\n\n ret = kvm_virtio_pci_irqfd_use(proxy, queue_no, vector);\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "4ce03a95e27d618a2c65b1ed134a72b48bbbff00", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n unsigned int frame_type, packet_size, padding, frame_size;\n \n+\n+\n+ avio_rb16(pb); /* channel number */\n+\n+ frame_type = avio_rb16(pb);\n \n packet_size = avio_rb32(pb);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int lmlm4_read_packet(AVFormatContext *s, AVPacket *pkt) {\n\n AVIOContext *pb = s->pb;\n\n int ret;\n\n unsigned int frame_type, packet_size, padding, frame_size;\n\n\n\n avio_rb16(pb); /* channel number */\n\n frame_type = avio_rb16(pb);\n\n packet_size = avio_rb32(pb);\n\n padding = -packet_size & 511;\n\n frame_size = packet_size - 8;\n\n\n\n if (frame_type > LMLM4_MPEG1L2 || frame_type == LMLM4_INVALID) {\n\n av_log(s, AV_LOG_ERROR, \"invalid or unsupported frame_type\\n\");\n\n return AVERROR(EIO);\n\n }\n\n if (packet_size > LMLM4_MAX_PACKET_SIZE) {\n\n av_log(s, AV_LOG_ERROR, \"packet size exceeds maximum\\n\");\n\n return AVERROR(EIO);\n\n }\n\n\n\n if ((ret = av_get_packet(pb, pkt, frame_size)) <= 0)\n\n return AVERROR(EIO);\n\n\n\n avio_skip(pb, padding);\n\n\n\n switch (frame_type) {\n\n case LMLM4_I_FRAME:\n\n pkt->flags = AV_PKT_FLAG_KEY;\n\n case LMLM4_P_FRAME:\n\n case LMLM4_B_FRAME:\n\n pkt->stream_index = 0;\n\n break;\n\n case LMLM4_MPEG1L2:\n\n pkt->stream_index = 1;\n\n break;\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "74474750f1ac522730dae271a5ea5003caa8b73c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void align_position(AVIOContext *pb, int64_t offset, uint64_t size)\n+\n {\n \n if (avio_tell(pb) != offset + size)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void align_position(AVIOContext *pb, int64_t offset, uint64_t size)\n\n{\n\n if (avio_tell(pb) != offset + size)\n\n avio_seek(pb, offset + size, SEEK_SET);\n\n}\n"}} {"sample_id": "b8664c929437d6d079e16979c496a2db40cf2324", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n const uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;\n \n+\n+\n+ a = 3*(q0 - p0);\n+\n+\n \n if (is4tap)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_always_inline void filter_common(uint8_t *p, ptrdiff_t stride, int is4tap)\n\n{\n\n LOAD_PIXELS\n\n int a, f1, f2;\n\n const uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;\n\n\n\n a = 3*(q0 - p0);\n\n\n\n if (is4tap)\n\n a += clip_int8(p1 - q1);\n\n\n\n a = clip_int8(a);\n\n\n\n // We deviate from the spec here with c(a+3) >> 3\n\n // since that's what libvpx does.\n\n f1 = FFMIN(a+4, 127) >> 3;\n\n f2 = FFMIN(a+3, 127) >> 3;\n\n\n\n // Despite what the spec says, we do need to clamp here to\n\n // be bitexact with libvpx.\n\n p[-1*stride] = cm[p0 + f2];\n\n p[ 0*stride] = cm[q0 - f1];\n\n\n\n // only used for _inner on blocks without high edge variance\n\n if (!is4tap) {\n\n a = (f1+1)>>1;\n\n p[-2*stride] = cm[p1 + a];\n\n p[ 1*stride] = cm[q1 - a];\n\n }\n\n}\n"}} {"sample_id": "63a37d0e1ec59377af9fb7973ffc847f928ba851", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n get_bits(gb, 4); // active_video_parameter_set_id\n \n+ get_bits(gb, 1); // self_contained_cvs_flag\n+\n+ get_bits(gb, 1); // num_sps_ids_minus1\n+\n+ num_sps_ids_minus1 = get_ue_golomb_long(gb); // num_sps_ids_minus1\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void active_parameter_sets(HEVCContext *s)\n\n{\n\n GetBitContext *gb = &s->HEVClc->gb;\n\n int num_sps_ids_minus1;\n\n int i;\n\n\n\n get_bits(gb, 4); // active_video_parameter_set_id\n\n get_bits(gb, 1); // self_contained_cvs_flag\n\n get_bits(gb, 1); // num_sps_ids_minus1\n\n num_sps_ids_minus1 = get_ue_golomb_long(gb); // num_sps_ids_minus1\n\n\n\n s->active_seq_parameter_set_id = get_ue_golomb_long(gb);\n\n\n\n for (i = 1; i <= num_sps_ids_minus1; i++)\n\n get_ue_golomb_long(gb); // active_seq_parameter_set_id[i]\n\n}\n"}} {"sample_id": "e04fb07fd1676e9facd7f3f878c1bbe03bccd26b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void rbd_finish_aiocb(rbd_completion_t c, RADOSCB *rcb)\n+\n {\n \n+ int ret;\n+\n+ rcb->ret = rbd_aio_get_return_value(c);\n+\n rbd_aio_release(c);\n \n ret = qemu_rbd_send_pipe(rcb->s, rcb);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void rbd_finish_aiocb(rbd_completion_t c, RADOSCB *rcb)\n\n{\n\n int ret;\n\n rcb->ret = rbd_aio_get_return_value(c);\n\n rbd_aio_release(c);\n\n ret = qemu_rbd_send_pipe(rcb->s, rcb);\n\n if (ret < 0) {\n\n error_report(\"failed writing to acb->s->fds\");\n\n g_free(rcb);\n\n }\n\n}\n"}} {"sample_id": "d62030ffcaf14dd801918fe26e670d68fdc21984", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void RENAME(mix8to2)(SAMPLE **out, const SAMPLE **in, COEFF *coeffp, integer len){\n \n int i;\n+\n \n \n for(i=0; iheader_len[0] = 51;\n+\n+ oggstream->header[0] = av_mallocz(51); // per ogg flac specs\n \n p = oggstream->header[0];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int ogg_build_flac_headers(AVCodecContext *avctx,\n\n OGGStreamContext *oggstream, int bitexact)\n\n{\n\n const char *vendor = bitexact ? \"ffmpeg\" : LIBAVFORMAT_IDENT;\n\n enum FLACExtradataFormat format;\n\n uint8_t *streaminfo;\n\n uint8_t *p;\n\n if (!ff_flac_is_extradata_valid(avctx, &format, &streaminfo))\n\n return -1;\n\n oggstream->header_len[0] = 51;\n\n oggstream->header[0] = av_mallocz(51); // per ogg flac specs\n\n p = oggstream->header[0];\n\n\n\n bytestream_put_byte(&p, 0x7F);\n\n bytestream_put_buffer(&p, \"FLAC\", 4);\n\n bytestream_put_byte(&p, 1); // major version\n\n bytestream_put_byte(&p, 0); // minor version\n\n bytestream_put_be16(&p, 1); // headers packets without this one\n\n bytestream_put_buffer(&p, \"fLaC\", 4);\n\n bytestream_put_byte(&p, 0x00); // streaminfo\n\n bytestream_put_be24(&p, 34);\n\n bytestream_put_buffer(&p, streaminfo, FLAC_STREAMINFO_SIZE);\n\n oggstream->header_len[1] = 1+3+4+strlen(vendor)+4;\n\n oggstream->header[1] = av_mallocz(oggstream->header_len[1]);\n\n p = oggstream->header[1];\n\n\n\n bytestream_put_byte(&p, 0x84); // last metadata block and vorbis comment\n\n bytestream_put_be24(&p, oggstream->header_len[1] - 4);\n\n bytestream_put_le32(&p, strlen(vendor));\n\n bytestream_put_buffer(&p, vendor, strlen(vendor));\n\n bytestream_put_le32(&p, 0); // user comment list length\n\n return 0;\n\n}"}} {"sample_id": "a0b753dfd3920df146a5f4d05e442e3c522900c7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -66,11 +66,11 @@\n \n cpu->env->regs[15] = 0x00000000;\n \n+\n+\n+ /* Interrupt line of NIC is connected to GPIO line 36 */\n+\n+ smc91c111_init(&nd_table[0], 0x04000300,\n \n pxa2xx_gpio_in_get(cpu->gpio)[36]);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void connex_init(ram_addr_t ram_size, int vga_ram_size,\n\n const char *boot_device,\n\n const char *kernel_filename, const char *kernel_cmdline,\n\n const char *initrd_filename, const char *cpu_model)\n\n{\n\n struct pxa2xx_state_s *cpu;\n\n int index;\n\n\n\n uint32_t connex_rom = 0x01000000;\n\n uint32_t connex_ram = 0x04000000;\n\n\n\n if (ram_size < (connex_ram + connex_rom + PXA2XX_INTERNAL_SIZE)) {\n\n fprintf(stderr, \"This platform requires %i bytes of memory\\n\",\n\n connex_ram + connex_rom + PXA2XX_INTERNAL_SIZE);\n\n exit(1);\n\n }\n\n\n\n cpu = pxa255_init(connex_ram);\n\n\n\n index = drive_get_index(IF_PFLASH, 0, 0);\n\n if (index == -1) {\n\n fprintf(stderr, \"A flash image must be given with the \"\n\n \"'pflash' parameter\\n\");\n\n exit(1);\n\n }\n\n\n\n if (!pflash_cfi01_register(0x00000000, qemu_ram_alloc(connex_rom),\n\n drives_table[index].bdrv, sector_len, connex_rom / sector_len,\n\n 2, 0, 0, 0, 0)) {\n\n fprintf(stderr, \"qemu: Error registering flash memory.\\n\");\n\n exit(1);\n\n }\n\n\n\n cpu->env->regs[15] = 0x00000000;\n\n\n\n /* Interrupt line of NIC is connected to GPIO line 36 */\n\n smc91c111_init(&nd_table[0], 0x04000300,\n\n pxa2xx_gpio_in_get(cpu->gpio)[36]);\n\n}\n"}} {"sample_id": "ac4b32df71bd932838043a4838b86d11e169707f_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void vp8_idct_dc_add4uv_c(uint8_t *dst, int16_t block[4][16],\n+\n+ ptrdiff_t stride)\n+\n+{\n \n vp8_idct_dc_add_c(dst + stride * 0 + 0, block[0], stride);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void vp8_idct_dc_add4uv_c(uint8_t *dst, int16_t block[4][16],\n\n ptrdiff_t stride)\n\n{\n\n vp8_idct_dc_add_c(dst + stride * 0 + 0, block[0], stride);\n\n vp8_idct_dc_add_c(dst + stride * 0 + 4, block[1], stride);\n\n vp8_idct_dc_add_c(dst + stride * 4 + 0, block[2], stride);\n\n vp8_idct_dc_add_c(dst + stride * 4 + 4, block[3], stride);\n\n}\n"}} {"sample_id": "5e5a94b60518002e8ecc7afa78a9e7565b23e38f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+bdrv_acct_done(BlockDriverState *bs, BlockAcctCookie *cookie)\n+\n+{\n+\n+ assert(cookie->type < BDRV_MAX_IOTYPE);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "bdrv_acct_done(BlockDriverState *bs, BlockAcctCookie *cookie)\n\n{\n\n assert(cookie->type < BDRV_MAX_IOTYPE);\n\n\n\n bs->stats.nr_bytes[cookie->type] += cookie->bytes;\n\n bs->stats.nr_ops[cookie->type]++;\n\n bs->stats.total_time_ns[cookie->type] += get_clock() -\n\n cookie->start_time_ns;\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_55", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void bdrv_iterate_format(void (*it)(void *opaque, const char *name),\n+\n+ void *opaque)\n+\n+{\n+\n BlockDriver *drv;\n \n int count = 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bdrv_iterate_format(void (*it)(void *opaque, const char *name),\n\n void *opaque)\n\n{\n\n BlockDriver *drv;\n\n int count = 0;\n\n int i;\n\n const char **formats = NULL;\n\n\n\n QLIST_FOREACH(drv, &bdrv_drivers, list) {\n\n if (drv->format_name) {\n\n bool found = false;\n\n int i = count;\n\n while (formats && i && !found) {\n\n found = !strcmp(formats[--i], drv->format_name);\n\n }\n\n\n\n if (!found) {\n\n formats = g_renew(const char *, formats, count + 1);\n\n formats[count++] = drv->format_name;\n\n }\n\n }\n\n }\n\n\n\n qsort(formats, count, sizeof(formats[0]), qsort_strcmp);\n\n\n\n for (i = 0; i < count; i++) {\n\n it(opaque, formats[i]);\n\n }\n\n\n\n g_free(formats);\n\n}\n"}} {"sample_id": "80db0e7822962554c91bef05d784c898e8ab1c3c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n {\n \n+ MachineState *machine = MACHINE(qdev_get_machine());\n+\n+\n+\n+ state->dev_count = machine->ram_slots;\n \n if (!state->dev_count) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void acpi_memory_hotplug_init(MemoryRegion *as, Object *owner,\n\n MemHotplugState *state)\n\n{\n\n MachineState *machine = MACHINE(qdev_get_machine());\n\n\n\n state->dev_count = machine->ram_slots;\n\n if (!state->dev_count) {\n\n return;\n\n }\n\n\n\n state->devs = g_malloc0(sizeof(*state->devs) * state->dev_count);\n\n memory_region_init_io(&state->io, owner, &acpi_memory_hotplug_ops, state,\n\n \"acpi-mem-hotplug\", ACPI_MEMORY_HOTPLUG_IO_LEN);\n\n memory_region_add_subregion(as, ACPI_MEMORY_HOTPLUG_BASE, &state->io);\n\n}\n"}} {"sample_id": "c3bd1d60af97e8d2568dac9fcce7bdabb4ff93c8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n for (count = 0; fmts[count] != -1; count++)\n \n+ ;\n+\n+\n+\n+ formats = av_mallocz(sizeof(*formats));\n \n if (count)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "AVFilterFormats *ff_make_format_list(const int *fmts)\n\n{\n\n AVFilterFormats *formats;\n\n int count;\n\n\n\n for (count = 0; fmts[count] != -1; count++)\n\n ;\n\n\n\n formats = av_mallocz(sizeof(*formats));\n\n if (count)\n\n formats->formats = av_malloc(sizeof(*formats->formats) * count);\n\n formats->nb_formats = count;\n\n memcpy(formats->formats, fmts, sizeof(*formats->formats) * count);\n\n\n\n return formats;\n\n}\n"}} {"sample_id": "c7ded42d5dfc0124008b5b9b13a1a342324885ed", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n \n \n+ if (s->inplace) {\n \n AVFrame *frame = NULL;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int activate(AVFilterContext *ctx)\n\n{\n\n PreMultiplyContext *s = ctx->priv;\n\n\n\n if (s->inplace) {\n\n AVFrame *frame = NULL;\n\n AVFrame *out = NULL;\n\n int ret, status;\n\n int64_t pts;\n\n\n\n if ((ret = ff_inlink_consume_frame(ctx->inputs[0], &frame)) > 0) {\n\n if ((ret = filter_frame(ctx, &out, frame, frame)) < 0)\n\n return ret;\n\n av_frame_free(&frame);\n\n ret = ff_filter_frame(ctx->outputs[0], out);\n\n }\n\n if (ret < 0) {\n\n return ret;\n\n } else if (ff_inlink_acknowledge_status(ctx->inputs[0], &status, &pts)) {\n\n ff_outlink_set_status(ctx->outputs[0], status, pts);\n\n return 0;\n\n } else {\n\n if (ff_outlink_frame_wanted(ctx->outputs[0]))\n\n ff_inlink_request_frame(ctx->inputs[0]);\n\n return 0;\n\n }\n\n } else {\n\n return ff_framesync_activate(&s->fs);\n\n }\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void start_ahci_device(AHCIQState *ahci)\n+\n+{\n \n /* Map AHCI's ABAR (BAR5) */\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void start_ahci_device(AHCIQState *ahci)\n\n{\n\n /* Map AHCI's ABAR (BAR5) */\n\n ahci->hba_base = qpci_iomap(ahci->dev, 5, &ahci->barsize);\n\n g_assert(ahci->hba_base);\n\n\n\n /* turns on pci.cmd.iose, pci.cmd.mse and pci.cmd.bme */\n\n qpci_device_enable(ahci->dev);\n\n}\n"}} {"sample_id": "185698715dfb18c82ad2a5dbc169908602d43e81_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,5 +7,5 @@\n u.f = a1;\n \n return ( ( u.i.high & 0x7FFF ) == 0x7FFF ) && (bits64) ( u.i.low<<1 );\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int floatx80_is_nan( floatx80 a1 )\n\n{\n\n floatx80u u;\n\n u.f = a1;\n\n return ( ( u.i.high & 0x7FFF ) == 0x7FFF ) && (bits64) ( u.i.low<<1 );\n\n}\n"}} {"sample_id": "6cabe1f303b9d76458c00f00df7f477449a13b2f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n * to acquire it since this path will get to it first.\n \n * So use another lock to provide fairness.\n+\n+ */\n+\n+ qemu_mutex_lock(&qemu_fair_mutex);\n+\n qemu_mutex_unlock(&qemu_fair_mutex);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_wait_io_event(CPUState *env)\n\n{\n\n while (!tcg_has_work())\n\n qemu_cond_timedwait(env->halt_cond, &qemu_global_mutex, 1000);\n\n\n\n qemu_mutex_unlock(&qemu_global_mutex);\n\n\n\n /*\n\n * Users of qemu_global_mutex can be starved, having no chance\n\n * to acquire it since this path will get to it first.\n\n * So use another lock to provide fairness.\n\n */\n\n qemu_mutex_lock(&qemu_fair_mutex);\n\n qemu_mutex_unlock(&qemu_fair_mutex);\n\n\n\n qemu_mutex_lock(&qemu_global_mutex);\n\n qemu_wait_io_event_common(env);\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_61", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void migrate_del_blocker(Error *reason)\n \n {\n+\n migration_blockers = g_slist_remove(migration_blockers, reason);\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void migrate_del_blocker(Error *reason)\n\n{\n\n migration_blockers = g_slist_remove(migration_blockers, reason);\n\n}\n"}} {"sample_id": "c9c3c80af71dd2b7813d1ada9b14cb51df584221_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n uint32_t nret, target_ulong rets)\n \n {\n+\n uint32_t val, size, addr;\n \n PCIDevice *dev = find_dev(spapr, 0, rtas_ld(args, 0));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void rtas_read_pci_config(sPAPREnvironment *spapr,\n\n uint32_t token, uint32_t nargs,\n\n target_ulong args,\n\n uint32_t nret, target_ulong rets)\n\n{\n\n uint32_t val, size, addr;\n\n PCIDevice *dev = find_dev(spapr, 0, rtas_ld(args, 0));\n\n\n\n if (!dev) {\n\n rtas_st(rets, 0, -1);\n\n return;\n\n }\n\n size = rtas_ld(args, 1);\n\n addr = rtas_pci_cfgaddr(rtas_ld(args, 0));\n\n val = pci_default_read_config(dev, addr, size);\n\n rtas_st(rets, 0, 0);\n\n rtas_st(rets, 1, val);\n\n}\n"}} {"sample_id": "f524bc3b3da5bd595840fca93d43a9852b8d066f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n do {\n \n+ rc = read(fd, &buf, sizeof (buf) - 1);\n+\n+ if (rc < 0 && errno != EINTR) {\n+\n+ rc = -errno;\n \n goto out;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int xen_host_pci_get_value(XenHostPCIDevice *d, const char *name,\n\n unsigned int *pvalue, int base)\n\n{\n\n char path[PATH_MAX];\n\n char buf[XEN_HOST_PCI_GET_VALUE_BUFFER_SIZE];\n\n int fd, rc;\n\n unsigned long value;\n\n char *endptr;\n\n\n\n xen_host_pci_sysfs_path(d, name, path, sizeof(path));\n\n\n\n fd = open(path, O_RDONLY);\n\n if (fd == -1) {\n\n XEN_HOST_PCI_LOG(\"Error: Can't open %s: %s\\n\", path, strerror(errno));\n\n return -errno;\n\n }\n\n do {\n\n rc = read(fd, &buf, sizeof (buf) - 1);\n\n if (rc < 0 && errno != EINTR) {\n\n rc = -errno;\n\n goto out;\n\n }\n\n } while (rc < 0);\n\n buf[rc] = 0;\n\n value = strtol(buf, &endptr, base);\n\n if (endptr == buf || *endptr != '\\n') {\n\n rc = -1;\n\n } else if ((value == LONG_MIN || value == LONG_MAX) && errno == ERANGE) {\n\n rc = -errno;\n\n } else {\n\n rc = 0;\n\n *pvalue = value;\n\n }\n\nout:\n\n close(fd);\n\n return rc;\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n if (islit) {\n \n+ TCGv tmp = tcg_const_i64(lit);\n+\n+ tcg_gen_helper_1_2(helper, cpu_ir[rc], cpu_ir[ra], tmp);\n+\n+ tcg_temp_free(tmp);\n \n } else\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static always_inline void gen_arith3 (void *helper,\n\n int ra, int rb, int rc,\n\n int islit, uint8_t lit)\n\n{\n\n if (unlikely(rc == 31))\n\n return;\n\n\n\n if (ra != 31) {\n\n if (islit) {\n\n TCGv tmp = tcg_const_i64(lit);\n\n tcg_gen_helper_1_2(helper, cpu_ir[rc], cpu_ir[ra], tmp);\n\n tcg_temp_free(tmp);\n\n } else\n\n tcg_gen_helper_1_2(helper, cpu_ir[rc], cpu_ir[ra], cpu_ir[rb]);\n\n } else {\n\n TCGv tmp1 = tcg_const_i64(0);\n\n if (islit) {\n\n TCGv tmp2 = tcg_const_i64(lit);\n\n tcg_gen_helper_1_2(helper, cpu_ir[rc], tmp1, tmp2);\n\n tcg_temp_free(tmp2);\n\n } else\n\n tcg_gen_helper_1_2(helper, cpu_ir[rc], tmp1, cpu_ir[rb]);\n\n tcg_temp_free(tmp1);\n\n }\n\n}\n"}} {"sample_id": "a6191d098a03f94685ae4c072bfdf10afcd86223", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,11 +34,11 @@\n \n c->abits[band][ch] = 8 + mul32(snr_cb - 222, 69000000);\n \n+ ret |= USED_NABITS;\n+\n+ } else if (snr_cb >= 0) {\n+\n+ c->abits[band][ch] = 2 + mul32(snr_cb, 106000000);\n \n ret |= USED_NABITS;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int init_quantization_noise(DCAEncContext *c, int noise)\n\n{\n\n int ch, band, ret = 0;\n\n\n\n c->consumed_bits = 132 + 493 * c->fullband_channels;\n\n if (c->lfe_channel)\n\n c->consumed_bits += 72;\n\n\n\n /* attempt to guess the bit distribution based on the prevoius frame */\n\n for (ch = 0; ch < c->fullband_channels; ch++) {\n\n for (band = 0; band < 32; band++) {\n\n int snr_cb = c->peak_cb[band][ch] - c->band_masking_cb[band] - noise;\n\n\n\n if (snr_cb >= 1312) {\n\n c->abits[band][ch] = 26;\n\n ret |= USED_26ABITS;\n\n } else if (snr_cb >= 222) {\n\n c->abits[band][ch] = 8 + mul32(snr_cb - 222, 69000000);\n\n ret |= USED_NABITS;\n\n } else if (snr_cb >= 0) {\n\n c->abits[band][ch] = 2 + mul32(snr_cb, 106000000);\n\n ret |= USED_NABITS;\n\n } else {\n\n c->abits[band][ch] = 1;\n\n ret |= USED_1ABITS;\n\n }\n\n }\n\n }\n\n\n\n for (band = 0; band < 32; band++)\n\n for (ch = 0; ch < c->fullband_channels; ch++) {\n\n c->consumed_bits += bit_consumption[c->abits[band][ch]];\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "2ed1ebcf65edf6757d8904000889ce52cc0a9d1b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+int qemu_timedate_diff(struct tm *tm)\n+\n+{\n+\n+ time_t seconds;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_timedate_diff(struct tm *tm)\n\n{\n\n time_t seconds;\n\n\n\n if (rtc_date_offset == -1)\n\n if (rtc_utc)\n\n seconds = mktimegm(tm);\n\n else {\n\n struct tm tmp = *tm;\n\n tmp.tm_isdst = -1; /* use timezone to figure it out */\n\n seconds = mktime(&tmp);\n\n\t}\n\n else\n\n seconds = mktimegm(tm) + rtc_date_offset;\n\n\n\n return seconds - time(NULL);\n\n}\n"}} {"sample_id": "e23a1b33b53d25510320b26d9f154e19c6c99725", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n RamDevice *d;\n \n+\n \n /* allocate RAM */\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void ram_init(target_phys_addr_t addr, ram_addr_t RAM_size,\n\n uint64_t max_mem)\n\n{\n\n DeviceState *dev;\n\n SysBusDevice *s;\n\n RamDevice *d;\n\n\n\n /* allocate RAM */\n\n if ((uint64_t)RAM_size > max_mem) {\n\n fprintf(stderr,\n\n \"qemu: Too much memory for this machine: %d, maximum %d\\n\",\n\n (unsigned int)(RAM_size / (1024 * 1024)),\n\n (unsigned int)(max_mem / (1024 * 1024)));\n\n exit(1);\n\n }\n\n dev = qdev_create(NULL, \"memory\");\n\n s = sysbus_from_qdev(dev);\n\n\n\n d = FROM_SYSBUS(RamDevice, s);\n\n d->size = RAM_size;\n\n qdev_init(dev);\n\n\n\n sysbus_mmio_map(s, 0, addr);\n\n}\n"}} {"sample_id": "bd5c51ee6c4f1c79cae5ad2516d711a27b4ea8ec_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,6 +8,6 @@\n \n s->idle_tag = 0;\n \n+ return FALSE;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static gboolean qemu_chr_be_generic_open_bh(gpointer opaque)\n\n{\n\n CharDriverState *s = opaque;\n\n qemu_chr_be_event(s, CHR_EVENT_OPENED);\n\n s->idle_tag = 0;\n\n return FALSE;\n\n}\n"}} {"sample_id": "dc491fead04a92a612df93b85b0ebf9dcc3f6684", "diff": "--- a/source.c\n+++ b/source.c\n@@ -49,11 +49,11 @@\n \n \" 'id': 'usbdev%d'\"\n \n+ \"}}\", port);\n+\n+ response = qmp(cmd);\n+\n+ g_free(cmd);\n \n g_assert(response);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void usb_test_hotplug(const char *hcd_id, const int port,\n\n void (*port_check)(void))\n\n{\n\n QDict *response;\n\n char *cmd;\n\n\n\n cmd = g_strdup_printf(\"{'execute': 'device_add',\"\n\n \" 'arguments': {\"\n\n \" 'driver': 'usb-tablet',\"\n\n \" 'port': '%d',\"\n\n \" 'bus': '%s.0',\"\n\n \" 'id': 'usbdev%d'\"\n\n \"}}\", port, hcd_id, port);\n\n response = qmp(cmd);\n\n g_free(cmd);\n\n g_assert(response);\n\n g_assert(!qdict_haskey(response, \"error\"));\n\n\n\n\n if (port_check) {\n\n port_check();\n\n }\n\n\n\n cmd = g_strdup_printf(\"{'execute': 'device_del',\"\n\n \" 'arguments': {\"\n\n \" 'id': 'usbdev%d'\"\n\n \"}}\", port);\n\n response = qmp(cmd);\n\n g_free(cmd);\n\n g_assert(response);\n\n g_assert(qdict_haskey(response, \"event\"));\n\n g_assert(!strcmp(qdict_get_str(response, \"event\"), \"DEVICE_DELETED\"));\n\n\n}"}} {"sample_id": "532bc727c34665370ab0ba94a9536fd3a6c2c5bc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n \n \n+ if (s->file->ops->put_buffer || s->file->ops->writev_buffer) {\n+\n+ int fd = fileno(s->stdio_file);\n+\n+ struct stat st;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int stdio_fclose(void *opaque)\n\n{\n\n QEMUFileStdio *s = opaque;\n\n int ret = 0;\n\n\n\n if (s->file->ops->put_buffer || s->file->ops->writev_buffer) {\n\n int fd = fileno(s->stdio_file);\n\n struct stat st;\n\n\n\n ret = fstat(fd, &st);\n\n if (ret == 0 && S_ISREG(st.st_mode)) {\n\n /*\n\n * If the file handle is a regular file make sure the\n\n * data is flushed to disk before signaling success.\n\n */\n\n ret = fsync(fd);\n\n if (ret != 0) {\n\n ret = -errno;\n\n return ret;\n\n }\n\n }\n\n }\n\n if (fclose(s->stdio_file) == EOF) {\n\n ret = -errno;\n\n }\n\n g_free(s);\n\n return ret;\n\n}\n"}} {"sample_id": "3176217c60ca7828712985092d9102d331ea4f3d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n mmco_index = 1;\n \n+ if (FIELD_PICTURE(h)) {\n+\n+ mmco[0].short_pic_num *= 2;\n+\n+ mmco[1].opcode = MMCO_SHORT2UNUSED;\n \n mmco[1].short_pic_num = mmco[0].short_pic_num + 1;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int ff_generate_sliding_window_mmcos(H264Context *h, int first_slice)\n\n{\n\n MMCO mmco_temp[MAX_MMCO_COUNT], *mmco = first_slice ? h->mmco : mmco_temp;\n\n int mmco_index = 0, i = 0;\n\n\n\n assert(h->long_ref_count + h->short_ref_count <= h->sps.ref_frame_count);\n\n\n\n if (h->short_ref_count &&\n\n h->long_ref_count + h->short_ref_count == h->sps.ref_frame_count &&\n\n !(FIELD_PICTURE(h) && !h->first_field && h->cur_pic_ptr->reference)) {\n\n mmco[0].opcode = MMCO_SHORT2UNUSED;\n\n mmco[0].short_pic_num = h->short_ref[h->short_ref_count - 1]->frame_num;\n\n mmco_index = 1;\n\n if (FIELD_PICTURE(h)) {\n\n mmco[0].short_pic_num *= 2;\n\n mmco[1].opcode = MMCO_SHORT2UNUSED;\n\n mmco[1].short_pic_num = mmco[0].short_pic_num + 1;\n\n mmco_index = 2;\n\n }\n\n }\n\n\n\n if (first_slice) {\n\n h->mmco_index = mmco_index;\n\n } else if (!first_slice && mmco_index >= 0 &&\n\n (mmco_index != h->mmco_index ||\n\n (i = check_opcodes(h->mmco, mmco_temp, mmco_index)))) {\n\n av_log(h->avctx, AV_LOG_ERROR,\n\n \"Inconsistent MMCO state between slices [%d, %d, %d]\\n\",\n\n mmco_index, h->mmco_index, i);\n\n return AVERROR_INVALIDDATA;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "aa2c364b4cf2fae4d9c8acf53ee4436ed533902d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void qemu_cpu_kick(void *_env)\n \n {\n+\n CPUState *env = _env;\n \n qemu_cond_broadcast(env->halt_cond);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void qemu_cpu_kick(void *_env)\n\n{\n\n CPUState *env = _env;\n\n qemu_cond_broadcast(env->halt_cond);\n\n qemu_thread_signal(env->thread, SIG_IPI);\n\n}\n"}} {"sample_id": "a2b257d6212ade772473f86bf0637480b2578a7e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n phys_mem_alloc = alloc;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void phys_mem_set_alloc(void *(*alloc)(size_t))\n\n{\n\n phys_mem_alloc = alloc;\n\n}\n"}} {"sample_id": "4bb7b0daf8ea34bcc582642d35a2e4902f7841db", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n QVirtIOSCSI *vs;\n \n uint8_t buf[512] = { 0 };\n+\n+ const uint8_t write_same_cdb[CDB_SIZE] = { 0x41, 0x00, 0x00, 0x00, 0x00,\n+\n+ 0x01, 0x00, 0x00, 0x02, 0x00 };\n+\n \n \n qvirtio_scsi_start(\"-drive file=blkdebug::null-co://,if=none,id=dr1\"", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_unaligned_write_same(void)\n\n{\n\n QVirtIOSCSI *vs;\n\n uint8_t buf[512] = { 0 };\n\n const uint8_t write_same_cdb[CDB_SIZE] = { 0x41, 0x00, 0x00, 0x00, 0x00,\n\n 0x01, 0x00, 0x00, 0x02, 0x00 };\n\n\n\n qvirtio_scsi_start(\"-drive file=blkdebug::null-co://,if=none,id=dr1\"\n\n \",format=raw,file.align=4k \"\n\n \"-device scsi-disk,drive=dr1,lun=0,scsi-id=1\");\n\n vs = qvirtio_scsi_pci_init(PCI_SLOT);\n\n\n\n g_assert_cmphex(0, ==,\n\n virtio_scsi_do_command(vs, write_same_cdb, NULL, 0, buf, 512));\n\n\n\n qvirtio_scsi_pci_free(vs);\n\n qvirtio_scsi_stop();\n\n}\n"}} {"sample_id": "2b584959ed300ddff4acba0d7554becad5f274fd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n {\n \n bs->cyls = cyls;\n+\n+ bs->heads = heads;\n+\n bs->secs = secs;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bdrv_set_geometry_hint(BlockDriverState *bs,\n\n int cyls, int heads, int secs)\n\n{\n\n bs->cyls = cyls;\n\n bs->heads = heads;\n\n bs->secs = secs;\n\n}\n"}} {"sample_id": "67335a4558d3cad2173aac0ce13b6c096b077c41", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n if (bkt->avg > THROTTLE_VALUE_MAX || bkt->max > THROTTLE_VALUE_MAX) {\n error_setg(errp, \"bps/iops/max values must be within [0, %lld]\",\n THROTTLE_VALUE_MAX);\n+ if (!bkt->burst_length) {\n+ error_setg(errp, \"the burst length cannot be 0\");\n+ if (bkt->burst_length > 1 && !bkt->max) {\n+ error_setg(errp, \"burst length set without burst rate\");\n+ if (bkt->max && !bkt->avg) {\n error_setg(errp, \"bps_max/iops_max require corresponding\"\n \" bps/iops values\");\n if (bkt->max && bkt->max < bkt->avg) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "bool throttle_is_valid(ThrottleConfig *cfg, Error **errp)\n{\n int i;\n bool bps_flag, ops_flag;\n bool bps_max_flag, ops_max_flag;\n bps_flag = cfg->buckets[THROTTLE_BPS_TOTAL].avg &&\n (cfg->buckets[THROTTLE_BPS_READ].avg ||\n cfg->buckets[THROTTLE_BPS_WRITE].avg);\n ops_flag = cfg->buckets[THROTTLE_OPS_TOTAL].avg &&\n (cfg->buckets[THROTTLE_OPS_READ].avg ||\n cfg->buckets[THROTTLE_OPS_WRITE].avg);\n bps_max_flag = cfg->buckets[THROTTLE_BPS_TOTAL].max &&\n (cfg->buckets[THROTTLE_BPS_READ].max ||\n cfg->buckets[THROTTLE_BPS_WRITE].max);\n ops_max_flag = cfg->buckets[THROTTLE_OPS_TOTAL].max &&\n (cfg->buckets[THROTTLE_OPS_READ].max ||\n cfg->buckets[THROTTLE_OPS_WRITE].max);\n if (bps_flag || ops_flag || bps_max_flag || ops_max_flag) {\n error_setg(errp, \"bps/iops/max total values and read/write values\"\n \" cannot be used at the same time\");\n if (cfg->op_size &&\n !cfg->buckets[THROTTLE_OPS_TOTAL].avg &&\n !cfg->buckets[THROTTLE_OPS_READ].avg &&\n !cfg->buckets[THROTTLE_OPS_WRITE].avg) {\n error_setg(errp, \"iops size requires an iops value to be set\");\n for (i = 0; i < BUCKETS_COUNT; i++) {\n LeakyBucket *bkt = &cfg->buckets[i];\n if (bkt->avg > THROTTLE_VALUE_MAX || bkt->max > THROTTLE_VALUE_MAX) {\n error_setg(errp, \"bps/iops/max values must be within [0, %lld]\",\n THROTTLE_VALUE_MAX);\n if (!bkt->burst_length) {\n error_setg(errp, \"the burst length cannot be 0\");\n if (bkt->burst_length > 1 && !bkt->max) {\n error_setg(errp, \"burst length set without burst rate\");\n if (bkt->max && !bkt->avg) {\n error_setg(errp, \"bps_max/iops_max require corresponding\"\n \" bps/iops values\");\n if (bkt->max && bkt->max < bkt->avg) {\n error_setg(errp, \"bps_max/iops_max cannot be lower than bps/iops\");\n return true;"}} {"sample_id": "5836d16812cda6b93380632802d56411972e3148_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ FWCfgState *s = FW_CFG(dev);\n+\n+ MachineState *machine = MACHINE(qdev_get_machine());\n+\n+\n \n assert(!object_resolve_path(FW_CFG_PATH, NULL));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void fw_cfg_init1(DeviceState *dev)\n\n{\n\n FWCfgState *s = FW_CFG(dev);\n\n MachineState *machine = MACHINE(qdev_get_machine());\n\n\n\n assert(!object_resolve_path(FW_CFG_PATH, NULL));\n\n\n\n object_property_add_child(OBJECT(machine), FW_CFG_NAME, OBJECT(s), NULL);\n\n\n\n qdev_init_nofail(dev);\n\n\n\n fw_cfg_add_bytes(s, FW_CFG_SIGNATURE, (char *)\"QEMU\", 4);\n\n fw_cfg_add_bytes(s, FW_CFG_UUID, &qemu_uuid, 16);\n\n fw_cfg_add_i16(s, FW_CFG_NOGRAPHIC, (uint16_t)!machine->enable_graphics);\n\n fw_cfg_add_i16(s, FW_CFG_NB_CPUS, (uint16_t)smp_cpus);\n\n fw_cfg_add_i16(s, FW_CFG_BOOT_MENU, (uint16_t)boot_menu);\n\n fw_cfg_bootsplash(s);\n\n fw_cfg_reboot(s);\n\n\n\n s->machine_ready.notify = fw_cfg_machine_ready;\n\n qemu_add_machine_init_done_notifier(&s->machine_ready);\n\n}\n"}} {"sample_id": "f4a6ce5155aab2a7ed7b9032a72187b37b3bfffe", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n env->sr = 0x2700;\n \n #endif\n+\n+ m68k_switch_sp(env);\n+\n+ /* ??? FP regs should be initialized to NaN. */\n+\n cpu_m68k_set_ccr(env, 0);\n \n /* TODO: We should set PC from the interrupt vector. */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void m68k_cpu_reset(CPUState *s)\n\n{\n\n M68kCPU *cpu = M68K_CPU(s);\n\n M68kCPUClass *mcc = M68K_CPU_GET_CLASS(cpu);\n\n CPUM68KState *env = &cpu->env;\n\n\n\n mcc->parent_reset(s);\n\n\n\n memset(env, 0, offsetof(CPUM68KState, end_reset_fields));\n\n#if !defined(CONFIG_USER_ONLY)\n\n env->sr = 0x2700;\n\n#endif\n\n m68k_switch_sp(env);\n\n /* ??? FP regs should be initialized to NaN. */\n\n cpu_m68k_set_ccr(env, 0);\n\n /* TODO: We should set PC from the interrupt vector. */\n\n env->pc = 0;\n\n}\n"}} {"sample_id": "2e8bc7874bb674b7d6837706b1249bf871941637", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n BlockDriverState **file)\n \n+{\n+\n+ BlockDriverState *p;\n+\n+ int64_t ret = 0;\n \n bool first = true;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int64_t coroutine_fn bdrv_co_get_block_status_above(BlockDriverState *bs,\n\n BlockDriverState *base,\n\n bool want_zero,\n\n int64_t sector_num,\n\n int nb_sectors,\n\n int *pnum,\n\n BlockDriverState **file)\n\n{\n\n BlockDriverState *p;\n\n int64_t ret = 0;\n\n bool first = true;\n\n\n\n assert(bs != base);\n\n for (p = bs; p != base; p = backing_bs(p)) {\n\n ret = bdrv_co_get_block_status(p, want_zero, sector_num, nb_sectors,\n\n pnum, file);\n\n if (ret < 0) {\n\n break;\n\n }\n\n if (ret & BDRV_BLOCK_ZERO && ret & BDRV_BLOCK_EOF && !first) {\n\n /*\n\n * Reading beyond the end of the file continues to read\n\n * zeroes, but we can only widen the result to the\n\n * unallocated length we learned from an earlier\n\n * iteration.\n\n */\n\n *pnum = nb_sectors;\n\n }\n\n if (ret & (BDRV_BLOCK_ZERO | BDRV_BLOCK_DATA)) {\n\n break;\n\n }\n\n /* [sector_num, pnum] unallocated on this layer, which could be only\n\n * the first part of [sector_num, nb_sectors]. */\n\n nb_sectors = MIN(nb_sectors, *pnum);\n\n first = false;\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "e69a17f65e9f12f33c48b04a789e49d40a8993f5_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ set_bit(q->queue, n_IRQ);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void IRQ_setbit(IRQQueue *q, int n_IRQ)\n\n{\n\n set_bit(q->queue, n_IRQ);\n\n}\n"}} {"sample_id": "2c0ef9f411ae6081efa9eca5b3eab2dbeee45a6c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,8 +8,8 @@\n \n visit(qapi_dealloc_get_visitor(qdv), &native_in, errp);\n \n+\n+\n+ qapi_dealloc_visitor_cleanup(qdv);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void dealloc_helper(void *native_in, VisitorFunc visit, Error **errp)\n\n{\n\n QapiDeallocVisitor *qdv = qapi_dealloc_visitor_new();\n\n\n\n visit(qapi_dealloc_get_visitor(qdv), &native_in, errp);\n\n\n\n qapi_dealloc_visitor_cleanup(qdv);\n\n}\n"}} {"sample_id": "8630b2cd36c57918acfe18302fe77d1ceefbd676", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static inline av_flatten int get_symbol_inline(RangeCoder *c, uint8_t *state,\n \n int is_signed)\n+\n {\n \n if (get_rac(c, state + 0))", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static inline av_flatten int get_symbol_inline(RangeCoder *c, uint8_t *state,\n\n int is_signed)\n\n{\n\n if (get_rac(c, state + 0))\n\n return 0;\n\n else {\n\n int i, e, a;\n\n e = 0;\n\n while (get_rac(c, state + 1 + FFMIN(e, 9))) { // 1..10\n\n e++;\n\n if (e > 31)\n\n return AVERROR_INVALIDDATA;\n\n }\n\n\n\n a = 1;\n\n for (i = e - 1; i >= 0; i--)\n\n a += a + get_rac(c, state + 22 + FFMIN(i, 9)); // 22..31\n\n\n\n e = -(is_signed && get_rac(c, state + 11 + FFMIN(e, 10))); // 11..21\n\n return (a ^ e) - e;\n\n }\n\n}\n"}} {"sample_id": "891fb2cd4592b6fe76106a69e0ca40efbf82726a_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -38,11 +38,11 @@\n \n trace_usb_ehci_port_reset(port, 0);\n \n+ if (dev) {\n+\n+ usb_attach(&s->ports[port], dev);\n+\n+ usb_send_msg(dev, USB_MSG_RESET);\n \n *portsc &= ~PORTSC_CSC;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void handle_port_status_write(EHCIState *s, int port, uint32_t val)\n\n{\n\n uint32_t *portsc = &s->portsc[port];\n\n USBDevice *dev = s->ports[port].dev;\n\n\n\n /* Clear rwc bits */\n\n *portsc &= ~(val & PORTSC_RWC_MASK);\n\n /* The guest may clear, but not set the PED bit */\n\n *portsc &= val | ~PORTSC_PED;\n\n /* POWNER is masked out by RO_MASK as it is RO when we've no companion */\n\n handle_port_owner_write(s, port, val);\n\n /* And finally apply RO_MASK */\n\n val &= PORTSC_RO_MASK;\n\n\n\n if ((val & PORTSC_PRESET) && !(*portsc & PORTSC_PRESET)) {\n\n trace_usb_ehci_port_reset(port, 1);\n\n }\n\n\n\n if (!(val & PORTSC_PRESET) &&(*portsc & PORTSC_PRESET)) {\n\n trace_usb_ehci_port_reset(port, 0);\n\n if (dev) {\n\n usb_attach(&s->ports[port], dev);\n\n usb_send_msg(dev, USB_MSG_RESET);\n\n *portsc &= ~PORTSC_CSC;\n\n }\n\n\n\n /*\n\n * Table 2.16 Set the enable bit(and enable bit change) to indicate\n\n * to SW that this port has a high speed device attached\n\n */\n\n if (dev && (dev->speedmask & USB_SPEED_MASK_HIGH)) {\n\n val |= PORTSC_PED;\n\n }\n\n }\n\n\n\n *portsc &= ~PORTSC_RO_MASK;\n\n *portsc |= val;\n\n}\n"}} {"sample_id": "0b5a24454fc551f0294fe93821e8c643214a55f5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n acb->req.error = bdrv_co_do_writev(bs, acb->req.sector,\n \n acb->req.nb_sectors, acb->req.qiov, acb->req.flags);\n+\n+ }\n+\n+\n+\n acb->bh = aio_bh_new(bdrv_get_aio_context(bs), bdrv_co_em_bh, acb);\n \n qemu_bh_schedule(acb->bh);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void coroutine_fn bdrv_co_do_rw(void *opaque)\n\n{\n\n BlockAIOCBCoroutine *acb = opaque;\n\n BlockDriverState *bs = acb->common.bs;\n\n\n\n if (!acb->is_write) {\n\n acb->req.error = bdrv_co_do_readv(bs, acb->req.sector,\n\n acb->req.nb_sectors, acb->req.qiov, acb->req.flags);\n\n } else {\n\n acb->req.error = bdrv_co_do_writev(bs, acb->req.sector,\n\n acb->req.nb_sectors, acb->req.qiov, acb->req.flags);\n\n }\n\n\n\n acb->bh = aio_bh_new(bdrv_get_aio_context(bs), bdrv_co_em_bh, acb);\n\n qemu_bh_schedule(acb->bh);\n\n}\n"}} {"sample_id": "98c8573eb37bf5d7bb0c07225985a78537c73101", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+int kvm_set_ioeventfd_pio_word(int fd, uint16_t addr, uint16_t val, bool assign)\n+\n+{\n+\n+ struct kvm_ioeventfd kick = {\n \n .datamatch = val,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int kvm_set_ioeventfd_pio_word(int fd, uint16_t addr, uint16_t val, bool assign)\n\n{\n\n struct kvm_ioeventfd kick = {\n\n .datamatch = val,\n\n .addr = addr,\n\n .len = 2,\n\n .flags = KVM_IOEVENTFD_FLAG_DATAMATCH | KVM_IOEVENTFD_FLAG_PIO,\n\n .fd = fd,\n\n };\n\n int r;\n\n if (!kvm_enabled())\n\n return -ENOSYS;\n\n if (!assign)\n\n kick.flags |= KVM_IOEVENTFD_FLAG_DEASSIGN;\n\n r = kvm_vm_ioctl(kvm_state, KVM_IOEVENTFD, &kick);\n\n if (r < 0)\n\n return r;\n\n return 0;\n\n}\n"}} {"sample_id": "7f0317cfc8da620cdb38cb5cfec5f82b8dd05403", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n int rc, int *result)\n \n+{\n \n BlockDriverState *bs;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static BlockJob *test_block_job_start(unsigned int iterations,\n\n bool use_timer,\n\n int rc, int *result)\n\n{\n\n BlockDriverState *bs;\n\n TestBlockJob *s;\n\n TestBlockJobCBData *data;\n\n\n\n data = g_new0(TestBlockJobCBData, 1);\n\n bs = bdrv_new();\n\n s = block_job_create(&test_block_job_driver, bs, 0, test_block_job_cb,\n\n data, &error_abort);\n\n s->iterations = iterations;\n\n s->use_timer = use_timer;\n\n s->rc = rc;\n\n s->result = result;\n\n s->common.co = qemu_coroutine_create(test_block_job_run);\n\n data->job = s;\n\n data->result = result;\n\n qemu_coroutine_enter(s->common.co, s);\n\n return &s->common;\n\n}\n"}} {"sample_id": "f5695926235c9b2a60af07b21c2d6f1db990cc2a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n \n \n if ((error = pa_simple_write(s->pa, buf, size, &error))) {\n+\n+ av_log(s, AV_LOG_ERROR, \"pa_simple_write failed: %s\\n\", pa_strerror(error));\n+\n+ return AVERROR(EIO);\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pulse_write_packet(AVFormatContext *h, AVPacket *pkt)\n\n{\n\n PulseData *s = h->priv_data;\n\n int size = pkt->size;\n\n uint8_t *buf = pkt->data;\n\n int error;\n\n\n\n if (s->stream_index != pkt->stream_index)\n\n return 0;\n\n\n\n if ((error = pa_simple_write(s->pa, buf, size, &error))) {\n\n av_log(s, AV_LOG_ERROR, \"pa_simple_write failed: %s\\n\", pa_strerror(error));\n\n return AVERROR(EIO);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d663640c04f2aab810915c556390211d75457704_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n BDRVQcowState *s = bs->opaque;\n \n uint64_t cluster_offset;\n+\n int ret;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int coroutine_fn qcow2_co_is_allocated(BlockDriverState *bs,\n\n int64_t sector_num, int nb_sectors, int *pnum)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n uint64_t cluster_offset;\n\n int ret;\n\n\n\n *pnum = nb_sectors;\n\n /* FIXME We can get errors here, but the bdrv_co_is_allocated interface\n\n * can't pass them on today */\n\n qemu_co_mutex_lock(&s->lock);\n\n ret = qcow2_get_cluster_offset(bs, sector_num << 9, pnum, &cluster_offset);\n\n qemu_co_mutex_unlock(&s->lock);\n\n if (ret < 0) {\n\n *pnum = 0;\n\n }\n\n\n\n return (cluster_offset != 0) || (ret == QCOW2_CLUSTER_ZERO);\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_125", "diff": "--- a/source.c\n+++ b/source.c\n@@ -49,11 +49,11 @@\n ERROR(errp, \"listening on socket!\");\n \n goto err;\n+\n+ }\n+\n+\n+\n DPRINTF(\"rdma_listen success\\n\");\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void rdma_start_incoming_migration(const char *host_port, Error **errp)\n\n{\n\n int ret;\n\n RDMAContext *rdma;\n\n Error *local_err = NULL;\n\n\n\n DPRINTF(\"Starting RDMA-based incoming migration\\n\");\n\n rdma = qemu_rdma_data_init(host_port, &local_err);\n\n\n\n if (rdma == NULL) {\n\n goto err;\n\n }\n\n\n\n ret = qemu_rdma_dest_init(rdma, &local_err);\n\n\n\n if (ret) {\n\n goto err;\n\n }\n\n\n\n DPRINTF(\"qemu_rdma_dest_init success\\n\");\n\n\n\n ret = rdma_listen(rdma->listen_id, 5);\n\n\n\n if (ret) {\n\n ERROR(errp, \"listening on socket!\");\n\n goto err;\n\n }\n\n\n\n DPRINTF(\"rdma_listen success\\n\");\n\n\n\n qemu_set_fd_handler2(rdma->channel->fd, NULL,\n\n rdma_accept_incoming_migration, NULL,\n\n (void *)(intptr_t) rdma);\n\n return;\n\nerr:\n\n error_propagate(errp, local_err);\n\n g_free(rdma);\n\n}\n"}} {"sample_id": "1f467220cfd1664782b1fe210bbc9342ad460fd2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,9 +14,9 @@\n \n int x, y;\n \n+ uint8_t *pin, *pout;\n+\n+ for (y = y0; y < (y0 + h); y++) {\n \n pin = cur_buf->data[0] + y * cur_buf->linesize[0] + extract->rgba_map[A];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int draw_slice(AVFilterLink *inlink, int y0, int h, int slice_dir)\n\n{\n\n AlphaExtractContext *extract = inlink->dst->priv;\n\n AVFilterBufferRef *cur_buf = inlink->cur_buf;\n\n AVFilterBufferRef *out_buf = inlink->dst->outputs[0]->out_buf;\n\n\n\n if (extract->is_packed_rgb) {\n\n int x, y;\n\n uint8_t *pin, *pout;\n\n for (y = y0; y < (y0 + h); y++) {\n\n pin = cur_buf->data[0] + y * cur_buf->linesize[0] + extract->rgba_map[A];\n\n pout = out_buf->data[0] + y * out_buf->linesize[0];\n\n for (x = 0; x < out_buf->video->w; x++) {\n\n *pout = *pin;\n\n pout += 1;\n\n pin += 4;\n\n }\n\n }\n\n } else if (cur_buf->linesize[A] == out_buf->linesize[Y]) {\n\n const int linesize = cur_buf->linesize[A];\n\n memcpy(out_buf->data[Y] + y0 * linesize,\n\n cur_buf->data[A] + y0 * linesize,\n\n linesize * h);\n\n } else {\n\n const int linesize = FFMIN(out_buf->linesize[Y], cur_buf->linesize[A]);\n\n int y;\n\n for (y = y0; y < (y0 + h); y++) {\n\n memcpy(out_buf->data[Y] + y * out_buf->linesize[Y],\n\n cur_buf->data[A] + y * cur_buf->linesize[A],\n\n linesize);\n\n }\n\n }\n\n return ff_draw_slice(inlink->dst->outputs[0], y0, h, slice_dir);\n\n}\n"}} {"sample_id": "c6572fa0d2b81bc3a9ca5716f975f2bf59c62e6c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -48,11 +48,11 @@\n \n \n \n+ s->log = logs.log;\n+\n+\n+\n+exit:\n \n return ret;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int vhdx_log_write_and_flush(BlockDriverState *bs, BDRVVHDXState *s,\n\n void *data, uint32_t length, uint64_t offset)\n\n{\n\n int ret = 0;\n\n VHDXLogSequence logs = { .valid = true,\n\n .count = 1,\n\n .hdr = { 0 } };\n\n\n\n\n\n /* Make sure data written (new and/or changed blocks) is stable\n\n * on disk, before creating log entry */\n\n bdrv_flush(bs);\n\n ret = vhdx_log_write(bs, s, data, length, offset);\n\n if (ret < 0) {\n\n goto exit;\n\n }\n\n logs.log = s->log;\n\n\n\n /* Make sure log is stable on disk */\n\n bdrv_flush(bs);\n\n ret = vhdx_log_flush(bs, s, &logs);\n\n if (ret < 0) {\n\n goto exit;\n\n }\n\n\n\n s->log = logs.log;\n\n\n\nexit:\n\n return ret;\n\n}\n"}} {"sample_id": "47d4be12c3997343e436c6cca89aefbbbeb70863_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n int err = 0;\n \n if (!nptr) {\n+\n if (endptr) {\n \n *endptr = nptr;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int qemu_strtoll(const char *nptr, const char **endptr, int base,\n\n int64_t *result)\n\n{\n\n char *p;\n\n int err = 0;\n\n if (!nptr) {\n\n if (endptr) {\n\n *endptr = nptr;\n\n }\n\n err = -EINVAL;\n\n } else {\n\n errno = 0;\n\n *result = strtoll(nptr, &p, base);\n\n err = check_strtox_error(endptr, p, errno);\n\n }\n\n return err;\n\n}\n"}} {"sample_id": "b853d4cbf2062813e84f9bb880feff8daf467e05", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n }\n \n \n+\n+ if (cpu->irqstate_saved_size == 0) {\n+\n+ return 0;\n+\n }\n \n irq_state.buf = (uint64_t) cpu->irqstate;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int kvm_s390_vcpu_interrupt_post_load(S390CPU *cpu)\n\n{\n\n CPUState *cs = CPU(cpu);\n\n struct kvm_s390_irq_state irq_state;\n\n int r;\n\n\n\n if (!kvm_check_extension(kvm_state, KVM_CAP_S390_IRQ_STATE)) {\n\n return -ENOSYS;\n\n }\n\n\n\n if (cpu->irqstate_saved_size == 0) {\n\n return 0;\n\n }\n\n irq_state.buf = (uint64_t) cpu->irqstate;\n\n irq_state.len = cpu->irqstate_saved_size;\n\n\n\n r = kvm_vcpu_ioctl(cs, KVM_S390_SET_IRQ_STATE, &irq_state);\n\n if (r) {\n\n error_report(\"Setting interrupt state failed %d\", r);\n\n }\n\n return r;\n\n}\n"}} {"sample_id": "eabb7b91b36b202b4dac2df2d59d698e3aff197a_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,8 +3,8 @@\n {\n \n ptrdiff_t disp = tcg_ptr_byte_diff(target, pc);\n+\n+ assert(in_range_b(disp));\n \n return disp & 0x3fffffc;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t reloc_pc24_val(tcg_insn_unit *pc, tcg_insn_unit *target)\n\n{\n\n ptrdiff_t disp = tcg_ptr_byte_diff(target, pc);\n\n assert(in_range_b(disp));\n\n return disp & 0x3fffffc;\n\n}\n"}} {"sample_id": "87e8788680e16c51f6048af26f3f7830c35207a5_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n if ((magic_number != FLIC_FILE_MAGIC_1) &&\n \n (magic_number != FLIC_FILE_MAGIC_2) &&\n+\n+ (magic_number != FLIC_FILE_MAGIC_3))\n+\n+ return 0;\n+\n \n \n return AVPROBE_SCORE_MAX;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int flic_probe(AVProbeData *p)\n\n{\n\n int magic_number;\n\n\n\n if (p->buf_size < 6)\n\n return 0;\n\n\n\n magic_number = AV_RL16(&p->buf[4]);\n\n if ((magic_number != FLIC_FILE_MAGIC_1) &&\n\n (magic_number != FLIC_FILE_MAGIC_2) &&\n\n (magic_number != FLIC_FILE_MAGIC_3))\n\n return 0;\n\n\n\n return AVPROBE_SCORE_MAX;\n\n}\n"}} {"sample_id": "0fbc20740342713f282b118b4a446c4c43df3f4a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,9 +6,9 @@\n \n struct kvm_irq_routing_entry *entry;\n \n+ int n;\n+\n+\n \n for (n = 0; n < s->irq_routes->nr; n++) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int kvm_update_routing_entry(KVMState *s,\n\n struct kvm_irq_routing_entry *new_entry)\n\n{\n\n struct kvm_irq_routing_entry *entry;\n\n int n;\n\n\n\n for (n = 0; n < s->irq_routes->nr; n++) {\n\n entry = &s->irq_routes->entries[n];\n\n if (entry->gsi != new_entry->gsi) {\n\n continue;\n\n }\n\n\n\n entry->type = new_entry->type;\n\n entry->flags = new_entry->flags;\n\n entry->u = new_entry->u;\n\n\n\n kvm_irqchip_commit_routes(s);\n\n\n\n return 0;\n\n }\n\n\n\n return -ESRCH;\n\n}\n"}} {"sample_id": "247e658784ead984f96021acb9c95052ba599f26_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n char buf[CONTROL_BUFFER_SIZE], opts_format[20];\n \n AVDictionary *opts = NULL;\n+\n+ FTPContext *s = h->priv_data;\n+\n+\n+\n if (!s->conn_data) {\n \n /* Enter passive mode */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ftp_connect_data_connection(URLContext *h)\n\n{\n\n int err;\n\n char buf[CONTROL_BUFFER_SIZE], opts_format[20];\n\n AVDictionary *opts = NULL;\n\n FTPContext *s = h->priv_data;\n\n\n\n if (!s->conn_data) {\n\n /* Enter passive mode */\n\n if ((err = ftp_passive_mode(s)) < 0) {\n\n av_dlog(h, \"Set passive mode failed\\n\");\n\n return err;\n\n }\n\n /* Open data connection */\n\n ff_url_join(buf, sizeof(buf), \"tcp\", NULL, s->hostname, s->server_data_port, NULL);\n\n if (s->rw_timeout != -1) {\n\n snprintf(opts_format, sizeof(opts_format), \"%d\", s->rw_timeout);\n\n av_dict_set(&opts, \"timeout\", opts_format, 0);\n\n } /* if option is not given, don't pass it and let tcp use its own default */\n\n err = ffurl_open(&s->conn_data, buf, AVIO_FLAG_READ_WRITE,\n\n &h->interrupt_callback, &opts);\n\n av_dict_free(&opts);\n\n if (err < 0)\n\n return err;\n\n\n\n if (s->position)\n\n if ((err = ftp_restart(s, s->position)) < 0)\n\n return err;\n\n }\n\n s->state = READY;\n\n return 0;\n\n}\n"}} {"sample_id": "908c67fca4b2c12a9b2336aa9c188f84468b60b7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,10 +2,10 @@\n \n {\n \n+ if (dc->ccount_delta > 0) {\n+\n+ TCGv_i32 tmp = tcg_const_i32(dc->ccount_delta);\n+\n dc->ccount_delta = 0;\n \n gen_helper_advance_ccount(cpu_env, tmp);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gen_advance_ccount(DisasContext *dc)\n\n{\n\n if (dc->ccount_delta > 0) {\n\n TCGv_i32 tmp = tcg_const_i32(dc->ccount_delta);\n\n dc->ccount_delta = 0;\n\n gen_helper_advance_ccount(cpu_env, tmp);\n\n tcg_temp_free(tmp);\n\n }\n\n}\n"}} {"sample_id": "3e8c4f96890294e1b7de2d22ab3cfec7e1d7c48f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n (tag >> 16) & 0xff,\n \n (tag >> 24) & 0xff,\n+\n+ size);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void print_tag(const char *str, unsigned int tag, int size)\n\n{\n\n dprintf(NULL, \"%s: tag=%c%c%c%c size=0x%x\\n\",\n\n str, tag & 0xff,\n\n (tag >> 8) & 0xff,\n\n (tag >> 16) & 0xff,\n\n (tag >> 24) & 0xff,\n\n size);\n\n}\n"}} {"sample_id": "c5a49c63fa26e8825ad101dfe86339ae4c216539_18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void spr_write_tbl(DisasContext *ctx, int sprn, int gprn)\n+\n {\n \n if (ctx->tb->cflags & CF_USE_ICOUNT) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void spr_write_tbl(DisasContext *ctx, int sprn, int gprn)\n\n{\n\n if (ctx->tb->cflags & CF_USE_ICOUNT) {\n\n gen_io_start();\n\n }\n\n gen_helper_store_tbl(cpu_env, cpu_gpr[gprn]);\n\n if (ctx->tb->cflags & CF_USE_ICOUNT) {\n\n gen_io_end();\n\n gen_stop_exception(ctx);\n\n }\n\n}\n"}} {"sample_id": "0058584580b87feb47898e60e4b80c7f425882ad_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n samples[i + 256] += samples[i + 512];\n \n samples[i + 512] = 0;\n+\n+ }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void downmix_2f_1r_to_dolby(float *samples)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < 256; i++) {\n\n samples[i] -= samples[i + 512];\n\n samples[i + 256] += samples[i + 512];\n\n samples[i + 512] = 0;\n\n }\n\n}\n"}} {"sample_id": "a4d70941cd4a82f7db9fbaa2148d60ce550e7611", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,9 +16,9 @@\n \n memcpy(&fst->codec, codec, sizeof(AVCodecContext));\n \n+\n+ stream->streams[stream->nb_streams++] = fst;\n+\n+ return fst;\n+\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "AVStream *add_av_stream1(FFStream *stream, AVCodecContext *codec)\n\n{\n\n AVStream *fst;\n\n\n\n fst = av_mallocz(sizeof(AVStream));\n\n if (!fst)\n\n return NULL;\n\n fst->priv_data = av_mallocz(sizeof(FeedData));\n\n memcpy(&fst->codec, codec, sizeof(AVCodecContext));\n\n\n stream->streams[stream->nb_streams++] = fst;\n\n return fst;\n\n}"}} {"sample_id": "47d4be12c3997343e436c6cca89aefbbbeb70863_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n const char *str = \"\";\n \n char f = 'X';\n+\n+ const char *endptr = &f;\n+\n int64_t res = 999;\n \n int err;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_qemu_strtoll_empty(void)\n\n{\n\n const char *str = \"\";\n\n char f = 'X';\n\n const char *endptr = &f;\n\n int64_t res = 999;\n\n int err;\n\n\n\n err = qemu_strtoll(str, &endptr, 0, &res);\n\n\n\n g_assert_cmpint(err, ==, 0);\n\n g_assert_cmpint(res, ==, 0);\n\n g_assert(endptr == str);\n\n}\n"}} {"sample_id": "3e353773721596971db2d0abc7015e7ea3d3af07", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n+int boot_sector_init(const char *fname)\n+\n {\n+\n FILE *f = fopen(fname, \"w\");\n \n size_t len = sizeof boot_sector;\n \n \n \n+ if (!f) {\n+\n fprintf(stderr, \"Couldn't open \\\"%s\\\": %s\", fname, strerror(errno));\n \n return 1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int boot_sector_init(const char *fname)\n\n{\n\n FILE *f = fopen(fname, \"w\");\n\n size_t len = sizeof boot_sector;\n\n\n\n if (!f) {\n\n fprintf(stderr, \"Couldn't open \\\"%s\\\": %s\", fname, strerror(errno));\n\n return 1;\n\n }\n\n\n\n /* For Open Firmware based system, we can use a Forth script instead */\n\n if (strcmp(qtest_get_arch(), \"ppc64\") == 0) {\n\n len = sprintf((char *)boot_sector, \"\\\\ Bootscript\\n%x %x c! %x %x c!\\n\",\n\n LOW(SIGNATURE), BOOT_SECTOR_ADDRESS + SIGNATURE_OFFSET,\n\n HIGH(SIGNATURE), BOOT_SECTOR_ADDRESS + SIGNATURE_OFFSET + 1);\n\n }\n\n\n\n fwrite(boot_sector, 1, len, f);\n\n fclose(f);\n\n return 0;\n\n}\n"}} {"sample_id": "6bc03a695bc4c1ecd212263c4a3c9cf638d025e0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int dyn_buf_write(void *opaque, uint8_t *buf, int buf_size)\n \n+{\n \n DynBuffer *d = opaque;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int dyn_buf_write(void *opaque, uint8_t *buf, int buf_size)\n\n{\n\n DynBuffer *d = opaque;\n\n int new_size, new_allocated_size;\n\n\n\n /* reallocate buffer if needed */\n\n new_size = d->pos + buf_size;\n\n new_allocated_size = d->allocated_size;\n\n if(new_size < d->pos || new_size > INT_MAX/2)\n\n return -1;\n\n while (new_size > new_allocated_size) {\n\n if (!new_allocated_size)\n\n new_allocated_size = new_size;\n\n else\n\n new_allocated_size += new_allocated_size / 2 + 1;\n\n }\n\n\n\n if (new_allocated_size > d->allocated_size) {\n\n d->buffer = av_realloc(d->buffer, new_allocated_size);\n\n if(d->buffer == NULL)\n\n return -1234;\n\n d->allocated_size = new_allocated_size;\n\n }\n\n memcpy(d->buffer + d->pos, buf, buf_size);\n\n d->pos = new_size;\n\n if (d->pos > d->size)\n\n d->size = d->pos;\n\n return buf_size;\n\n}\n"}} {"sample_id": "bae8196d9f97916de6323e70e3e374362ee16ec4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ MirrorBlockJob *s = container_of(job, MirrorBlockJob, common);\n+\n \n \n mirror_drain(s);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void coroutine_fn mirror_pause(BlockJob *job)\n\n{\n\n MirrorBlockJob *s = container_of(job, MirrorBlockJob, common);\n\n\n\n mirror_drain(s);\n\n}\n"}} {"sample_id": "d218a86a0da7b2630828d31393d52295f0e311e9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n s->time_base.num = pts_num/gcd;\n \n+ s->time_base.den = pts_den/gcd;\n+\n+\n+\n+ if(gcd>1)\n \n av_log(NULL, AV_LOG_DEBUG, \"st:%d removing common factor %d from timebase\\n\", s->index, gcd);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void av_set_pts_info(AVStream *s, int pts_wrap_bits,\n\n unsigned int pts_num, unsigned int pts_den)\n\n{\n\n unsigned int gcd= av_gcd(pts_num, pts_den);\n\n s->pts_wrap_bits = pts_wrap_bits;\n\n s->time_base.num = pts_num/gcd;\n\n s->time_base.den = pts_den/gcd;\n\n\n\n if(gcd>1)\n\n av_log(NULL, AV_LOG_DEBUG, \"st:%d removing common factor %d from timebase\\n\", s->index, gcd);\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_22", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n for (i = 0; i < iovcnt; i++) {\n \n+ size_t len = iov[i].iov_len;\n+\n+\n+\n+ memcpy(packet->data + packet->size, iov[i].iov_base, len);\n \n packet->size += len;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ssize_t qemu_enqueue_packet_iov(VLANClientState *sender,\n\n const struct iovec *iov, int iovcnt,\n\n NetPacketSent *sent_cb)\n\n{\n\n VLANPacket *packet;\n\n size_t max_len = 0;\n\n int i;\n\n\n\n max_len = calc_iov_length(iov, iovcnt);\n\n\n\n packet = qemu_malloc(sizeof(VLANPacket) + max_len);\n\n packet->sender = sender;\n\n packet->sent_cb = sent_cb;\n\n packet->size = 0;\n\n\n\n for (i = 0; i < iovcnt; i++) {\n\n size_t len = iov[i].iov_len;\n\n\n\n memcpy(packet->data + packet->size, iov[i].iov_base, len);\n\n packet->size += len;\n\n }\n\n\n\n TAILQ_INSERT_TAIL(&sender->vlan->send_queue, packet, entry);\n\n\n\n return packet->size;\n\n}\n"}} {"sample_id": "40f860cd6c1aa0d3399e3f8158f20bdc5b2bfbfe", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+void restore_state_to_opc(CPUARMState *env, TranslationBlock *tb, int pc_pos)\n+\n+{\n+\n if (is_a64(env)) {\n \n env->pc = tcg_ctx.gen_opc_pc[pc_pos];", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void restore_state_to_opc(CPUARMState *env, TranslationBlock *tb, int pc_pos)\n\n{\n\n if (is_a64(env)) {\n\n env->pc = tcg_ctx.gen_opc_pc[pc_pos];\n\n } else {\n\n env->regs[15] = tcg_ctx.gen_opc_pc[pc_pos];\n\n }\n\n env->condexec_bits = gen_opc_condexec_bits[pc_pos];\n\n}\n"}} {"sample_id": "cdb3081269347fd9271fd1b7a9df312e2953bdd9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+ notifier_remove(n);\n+\n+ if (mr->iommu_ops->notify_stopped &&\n \n QLIST_EMPTY(&mr->iommu_notify.notifiers)) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void memory_region_unregister_iommu_notifier(MemoryRegion *mr, Notifier *n)\n\n{\n\n notifier_remove(n);\n\n if (mr->iommu_ops->notify_stopped &&\n\n QLIST_EMPTY(&mr->iommu_notify.notifiers)) {\n\n mr->iommu_ops->notify_stopped(mr);\n\n }\n\n}\n"}} {"sample_id": "7bd427d801e1e3293a634d3c83beadaa90ffb911_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;\n \n qemu_mod_timer(vd->timer, qemu_get_clock(rt_clock) +\n+\n+ vd->timer_interval);\n+\n+ return;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vnc_refresh(void *opaque)\n\n{\n\n VncDisplay *vd = opaque;\n\n VncState *vs, *vn;\n\n int has_dirty, rects = 0;\n\n\n\n vga_hw_update();\n\n\n\n if (vnc_trylock_display(vd)) {\n\n vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;\n\n qemu_mod_timer(vd->timer, qemu_get_clock(rt_clock) +\n\n vd->timer_interval);\n\n return;\n\n }\n\n\n\n has_dirty = vnc_refresh_server_surface(vd);\n\n vnc_unlock_display(vd);\n\n\n\n QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {\n\n rects += vnc_update_client(vs, has_dirty);\n\n /* vs might be free()ed here */\n\n }\n\n\n\n /* vd->timer could be NULL now if the last client disconnected,\n\n * in this case don't update the timer */\n\n if (vd->timer == NULL)\n\n return;\n\n\n\n if (has_dirty && rects) {\n\n vd->timer_interval /= 2;\n\n if (vd->timer_interval < VNC_REFRESH_INTERVAL_BASE)\n\n vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;\n\n } else {\n\n vd->timer_interval += VNC_REFRESH_INTERVAL_INC;\n\n if (vd->timer_interval > VNC_REFRESH_INTERVAL_MAX)\n\n vd->timer_interval = VNC_REFRESH_INTERVAL_MAX;\n\n }\n\n qemu_mod_timer(vd->timer, qemu_get_clock(rt_clock) + vd->timer_interval);\n\n}\n"}} {"sample_id": "c3ab0004ae4dffc32494ae84dd15cfaa909a7884_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static inline void RENAME(bgr24ToUV)(uint8_t *dstU, uint8_t *dstV, const uint8_t *src1, const uint8_t *src2, int width, uint32_t *unused)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void RENAME(bgr24ToUV)(uint8_t *dstU, uint8_t *dstV, const uint8_t *src1, const uint8_t *src2, int width, uint32_t *unused)\n\n{\n\n#if COMPILE_TEMPLATE_MMX\n\n RENAME(bgr24ToUV_mmx)(dstU, dstV, src1, width, PIX_FMT_BGR24);\n\n#else\n\n int i;\n\n for (i=0; i>RGB2YUV_SHIFT;\n\n dstV[i]= (RV*r + GV*g + BV*b + (257<<(RGB2YUV_SHIFT-1)))>>RGB2YUV_SHIFT;\n\n }\n\n#endif /* COMPILE_TEMPLATE_MMX */\n\n assert(src1 == src2);\n\n}\n"}} {"sample_id": "d6737539e77e78fca9a04914d51996cfd1ccc55c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n v8u16 add;\n \n+ v4u32 sum;\n+\n+\n+\n+ src_top = LD_UB(src - stride);\n \n add = __msa_hadd_u_h(src_top, src_top);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void intra_predict_mad_cow_dc_l0t_8x8_msa(uint8_t *src, int32_t stride)\n\n{\n\n uint8_t lp_cnt;\n\n uint32_t src0, src1, src2 = 0;\n\n uint32_t out0, out1, out2;\n\n v16u8 src_top;\n\n v8u16 add;\n\n v4u32 sum;\n\n\n\n src_top = LD_UB(src - stride);\n\n add = __msa_hadd_u_h(src_top, src_top);\n\n sum = __msa_hadd_u_w(add, add);\n\n src0 = __msa_copy_u_w((v4i32) sum, 0);\n\n src1 = __msa_copy_u_w((v4i32) sum, 1);\n\n\n\n for (lp_cnt = 0; lp_cnt < 4; lp_cnt++) {\n\n src2 += src[lp_cnt * stride - 1];\n\n }\n\n src2 = (src0 + src2 + 4) >> 3;\n\n src0 = (src0 + 2) >> 2;\n\n src1 = (src1 + 2) >> 2;\n\n out0 = src0 * 0x01010101;\n\n out1 = src1 * 0x01010101;\n\n out2 = src2 * 0x01010101;\n\n\n\n for (lp_cnt = 4; lp_cnt--;) {\n\n SW(out2, src);\n\n SW(out1, src + 4);\n\n SW(out0, src + stride * 4);\n\n SW(out1, src + stride * 4 + 4);\n\n src += stride;\n\n }\n\n}\n"}} {"sample_id": "285c015f1077a1d357dacdccc22ab02fd4aefe0a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n int res, i;\n const struct dc1394_frame_format *fmt = NULL;\n const struct dc1394_frame_rate *fps = NULL;\n+ if (dc1394_read_common(c, &fmt, &fps) != 0)\n+ return -1;\n+ /* Now let us prep the hardware. */\n+ dc1394->d = dc1394_new();\n+ if (dc1394_camera_enumerate(dc1394->d, &list) != DC1394_SUCCESS || !list) {\n av_log(c, AV_LOG_ERROR, \"Unable to look for an IIDC camera.\\n\");\n if (list->num == 0) {\n av_log(c, AV_LOG_ERROR, \"No cameras found.\\n\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-89", "target_file": "source.c", "files": {"source.c": "static int dc1394_read_header(AVFormatContext *c)\n{\n dc1394_data* dc1394 = c->priv_data;\n dc1394camera_list_t *list;\n int res, i;\n const struct dc1394_frame_format *fmt = NULL;\n const struct dc1394_frame_rate *fps = NULL;\n if (dc1394_read_common(c, &fmt, &fps) != 0)\n return -1;\n /* Now let us prep the hardware. */\n dc1394->d = dc1394_new();\n if (dc1394_camera_enumerate(dc1394->d, &list) != DC1394_SUCCESS || !list) {\n av_log(c, AV_LOG_ERROR, \"Unable to look for an IIDC camera.\\n\");\n if (list->num == 0) {\n av_log(c, AV_LOG_ERROR, \"No cameras found.\\n\");\n /* FIXME: To select a specific camera I need to search in list its guid */\n dc1394->camera = dc1394_camera_new (dc1394->d, list->ids[0].guid);\n if (list->num > 1) {\n av_log(c, AV_LOG_INFO, \"Working with the first camera found\\n\");\n /* Freeing list of cameras */\n dc1394_camera_free_list (list);\n /* Select MAX Speed possible from the cam */\n if (dc1394->camera->bmode_capable>0) {\n dc1394_video_set_operation_mode(dc1394->camera, DC1394_OPERATION_MODE_1394B);\n i = DC1394_ISO_SPEED_800;\n } else {\n i = DC1394_ISO_SPEED_400;\n for (res = DC1394_FAILURE; i >= DC1394_ISO_SPEED_MIN && res != DC1394_SUCCESS; i--) {\n res=dc1394_video_set_iso_speed(dc1394->camera, i);\n if (res != DC1394_SUCCESS) {\n av_log(c, AV_LOG_ERROR, \"Couldn't set ISO Speed\\n\");\n goto out_camera;\n if (dc1394_video_set_mode(dc1394->camera, fmt->frame_size_id) != DC1394_SUCCESS) {\n av_log(c, AV_LOG_ERROR, \"Couldn't set video format\\n\");\n goto out_camera;\n if (dc1394_video_set_framerate(dc1394->camera,fps->frame_rate_id) != DC1394_SUCCESS) {\n av_log(c, AV_LOG_ERROR, \"Couldn't set framerate %d \\n\",fps->frame_rate);\n goto out_camera;\n if (dc1394_capture_setup(dc1394->camera, 10, DC1394_CAPTURE_FLAGS_DEFAULT)!=DC1394_SUCCESS) {\n av_log(c, AV_LOG_ERROR, \"Cannot setup camera \\n\");\n goto out_camera;\n if (dc1394_video_set_transmission(dc1394->camera, DC1394_ON) !=DC1394_SUCCESS) {\n av_log(c, AV_LOG_ERROR, \"Cannot start capture\\n\");\n goto out_camera;\n return 0;\nout_camera:\n dc1394_capture_stop(dc1394->camera);\n dc1394_video_set_transmission(dc1394->camera, DC1394_OFF);\n dc1394_camera_free (dc1394->camera);\nout:\n dc1394_free(dc1394->d);\n return -1;"}} {"sample_id": "695a766bff4cd8414a84e58159506d72b4e44892", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int64_t ff_read_timestamp(AVFormatContext *s, int stream_index, int64_t *ppos, int64_t pos_limit,\n \n+ int64_t (*read_timestamp)(struct AVFormatContext *, int , int64_t *, int64_t ))\n+\n {\n \n return wrap_timestamp(s->streams[stream_index], read_timestamp(s, stream_index, ppos, pos_limit));", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int64_t ff_read_timestamp(AVFormatContext *s, int stream_index, int64_t *ppos, int64_t pos_limit,\n\n int64_t (*read_timestamp)(struct AVFormatContext *, int , int64_t *, int64_t ))\n\n{\n\n return wrap_timestamp(s->streams[stream_index], read_timestamp(s, stream_index, ppos, pos_limit));\n\n}\n"}} {"sample_id": "07c114bbf389c09c99fd451b0b0fddf88962f512", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,19 +1,19 @@\n static MemoryRegionSection *address_space_lookup_region(AddressSpaceDispatch *d,\n \n hwaddr addr,\n+\n+ bool resolve_subpage)\n+\n {\n \n+ MemoryRegionSection *section = atomic_read(&d->mru_section);\n \n subpage_t *subpage;\n \n bool update;\n \n+\n+\n if (section && section != &d->map.sections[PHYS_SECTION_UNASSIGNED] &&\n \n section_covers_addr(section, addr)) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static MemoryRegionSection *address_space_lookup_region(AddressSpaceDispatch *d,\n\n hwaddr addr,\n\n bool resolve_subpage)\n\n{\n\n MemoryRegionSection *section = atomic_read(&d->mru_section);\n\n subpage_t *subpage;\n\n bool update;\n\n\n\n if (section && section != &d->map.sections[PHYS_SECTION_UNASSIGNED] &&\n\n section_covers_addr(section, addr)) {\n\n update = false;\n\n } else {\n\n section = phys_page_find(d, addr);\n\n update = true;\n\n }\n\n if (resolve_subpage && section->mr->subpage) {\n\n subpage = container_of(section->mr, subpage_t, iomem);\n\n section = &d->map.sections[subpage->sub_section[SUBPAGE_IDX(addr)]];\n\n }\n\n if (update) {\n\n atomic_set(&d->mru_section, section);\n\n }\n\n return section;\n\n}\n"}} {"sample_id": "dcc39ee10e82833ce24aa57926c00ffeb1948198_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -48,11 +48,11 @@\n \n a->inv_qscale = 10;\n \n+ }\n+\n+\n+\n+ for (i = 0; i < 64; i++) {\n \n int index = ff_asv_scantab[i];\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int decode_init(AVCodecContext *avctx)\n\n{\n\n ASV1Context *const a = avctx->priv_data;\n\n const int scale = avctx->codec_id == AV_CODEC_ID_ASV1 ? 1 : 2;\n\n int i;\n\n\n\n if (avctx->extradata_size < 1) {\n\n av_log(avctx, AV_LOG_ERROR, \"No extradata provided\\n\");\n\n return AVERROR_INVALIDDATA;\n\n }\n\n\n\n ff_asv_common_init(avctx);\n\n ff_blockdsp_init(&a->bdsp, avctx);\n\n ff_idctdsp_init(&a->idsp, avctx);\n\n init_vlcs(a);\n\n ff_init_scantable(a->idsp.idct_permutation, &a->scantable, ff_asv_scantab);\n\n avctx->pix_fmt = AV_PIX_FMT_YUV420P;\n\n\n\n a->inv_qscale = avctx->extradata[0];\n\n if (a->inv_qscale == 0) {\n\n av_log(avctx, AV_LOG_ERROR, \"illegal qscale 0\\n\");\n\n if (avctx->codec_id == AV_CODEC_ID_ASV1)\n\n a->inv_qscale = 6;\n\n else\n\n a->inv_qscale = 10;\n\n }\n\n\n\n for (i = 0; i < 64; i++) {\n\n int index = ff_asv_scantab[i];\n\n\n\n a->intra_matrix[i] = 64 * scale * ff_mpeg1_default_intra_matrix[index] /\n\n a->inv_qscale;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "b7680cb6078bd7294a3dd86473d3f2fdee991dd0_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void qemu_thread_self(QemuThread *thread)\n \n+{\n \n thread->thread = pthread_self();\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_thread_self(QemuThread *thread)\n\n{\n\n thread->thread = pthread_self();\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static bool block_is_active(void *opaque)\n+\n {\n \n return block_mig_state.blk_enable == 1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static bool block_is_active(void *opaque)\n\n{\n\n return block_mig_state.blk_enable == 1;\n\n}\n"}} {"sample_id": "7bd427d801e1e3293a634d3c83beadaa90ffb911_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,8 +6,8 @@\n \n if (s->rtsr & (1 << 15))\n \n+ s->last_swcr += rt - s->last_pi;\n+\n+ s->last_pi = rt;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pxa2xx_rtc_piupdate(PXA2xxRTCState *s)\n\n{\n\n int64_t rt = qemu_get_clock(rt_clock);\n\n if (s->rtsr & (1 << 15))\n\n s->last_swcr += rt - s->last_pi;\n\n s->last_pi = rt;\n\n}\n"}} {"sample_id": "710aec915d208246891b68e2ba61b54951edc508", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,9 +11,9 @@\n ErrorClass_lookup[err->err_class],\n \n qerror_human(err));\n+\n+\n+\n+ return qobject_to_qdict(obj);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static QDict *build_qmp_error_dict(const QError *err)\n\n{\n\n QObject *obj;\n\n\n\n obj = qobject_from_jsonf(\"{ 'error': { 'class': %s, 'desc': %p } }\",\n\n ErrorClass_lookup[err->err_class],\n\n qerror_human(err));\n\n\n\n return qobject_to_qdict(obj);\n\n}\n"}} {"sample_id": "0d9acba8fddbf970c7353083e6a60b47017ce3e4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n AudioState *audio;\n \n+ musicpal_audio_state *s;\n+\n+ i2c_interface *i2c;\n \n int iomemtype;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static i2c_interface *musicpal_audio_init(qemu_irq irq)\n\n{\n\n AudioState *audio;\n\n musicpal_audio_state *s;\n\n i2c_interface *i2c;\n\n int iomemtype;\n\n\n\n audio = AUD_init();\n\n if (!audio) {\n\n AUD_log(audio_name, \"No audio state\\n\");\n\n return NULL;\n\n }\n\n\n\n s = qemu_mallocz(sizeof(musicpal_audio_state));\n\n s->irq = irq;\n\n\n\n i2c = qemu_mallocz(sizeof(i2c_interface));\n\n i2c->bus = i2c_init_bus();\n\n i2c->current_addr = -1;\n\n\n\n s->wm = wm8750_init(i2c->bus, audio);\n\n if (!s->wm)\n\n return NULL;\n\n i2c_set_slave_address(s->wm, MP_WM_ADDR);\n\n wm8750_data_req_set(s->wm, audio_callback, s);\n\n\n\n iomemtype = cpu_register_io_memory(0, musicpal_audio_readfn,\n\n musicpal_audio_writefn, s);\n\n cpu_register_physical_memory(MP_AUDIO_BASE, MP_AUDIO_SIZE, iomemtype);\n\n\n\n qemu_register_reset(musicpal_audio_reset, s);\n\n\n\n return i2c;\n\n}\n"}} {"sample_id": "494a8ebe713055d3946183f4b395f85a18b43e9e_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n sock_id = atoi(ctx->fs_root);\n \n if (sock_id < 0) {\n+\n+ fprintf(stderr, \"socket descriptor not initialized\\n\");\n+\n+ }\n+\n }\n \n if (sock_id < 0) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int proxy_init(FsContext *ctx)\n\n{\n\n V9fsProxy *proxy = g_malloc(sizeof(V9fsProxy));\n\n int sock_id;\n\n\n\n if (ctx->export_flags & V9FS_PROXY_SOCK_NAME) {\n\n sock_id = connect_namedsocket(ctx->fs_root);\n\n } else {\n\n sock_id = atoi(ctx->fs_root);\n\n if (sock_id < 0) {\n\n fprintf(stderr, \"socket descriptor not initialized\\n\");\n\n }\n\n }\n\n if (sock_id < 0) {\n\n g_free(proxy);\n\n return -1;\n\n }\n\n g_free(ctx->fs_root);\n\n ctx->fs_root = NULL;\n\n\n\n proxy->in_iovec.iov_base = g_malloc(PROXY_MAX_IO_SZ + PROXY_HDR_SZ);\n\n proxy->in_iovec.iov_len = PROXY_MAX_IO_SZ + PROXY_HDR_SZ;\n\n proxy->out_iovec.iov_base = g_malloc(PROXY_MAX_IO_SZ + PROXY_HDR_SZ);\n\n proxy->out_iovec.iov_len = PROXY_MAX_IO_SZ + PROXY_HDR_SZ;\n\n\n\n ctx->private = proxy;\n\n proxy->sockfd = sock_id;\n\n qemu_mutex_init(&proxy->mutex);\n\n\n\n ctx->export_flags |= V9FS_PATHNAME_FSCONTEXT;\n\n ctx->exops.get_st_gen = proxy_ioc_getversion;\n\n return 0;\n\n}\n"}} {"sample_id": "3aa80988430f41847e1b78d165440ac03503b6d0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -35,11 +35,11 @@\n \n \n env->sregs[SR_ESR] = ESR_EC_UNALIGNED_DATA | (wr << 10) \\\n+\n+ | (dr & 31) << 5;\n+\n+ if (size == 4) {\n+\n env->sregs[SR_ESR] |= 1 << 11;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void helper_memalign(uint32_t addr, uint32_t dr, uint32_t wr, uint32_t size)\n\n{\n\n uint32_t mask;\n\n\n\n switch (size) {\n\n case 4: mask = 3; break;\n\n case 2: mask = 1; break;\n\n default:\n\n case 1: mask = 0; break;\n\n }\n\n\n\n if (addr & mask) {\n\n qemu_log(\"unaligned access addr=%x size=%d, wr=%d\\n\",\n\n addr, size, wr);\n\n if (!(env->sregs[SR_MSR] & MSR_EE)) {\n\n return;\n\n }\n\n\n\n env->sregs[SR_ESR] = ESR_EC_UNALIGNED_DATA | (wr << 10) \\\n\n | (dr & 31) << 5;\n\n if (size == 4) {\n\n env->sregs[SR_ESR] |= 1 << 11;\n\n }\n\n helper_raise_exception(EXCP_HW_EXCP);\n\n }\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_69", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ return strcmp(a, b);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int qsort_strcmp(const void *a, const void *b)\n\n{\n\n return strcmp(a, b);\n\n}\n"}} {"sample_id": "b5eff355460643d09e533024360fe0522f368c07_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+static int bdrv_wr_badreq_sectors(BlockDriverState *bs,\n+\n+ int64_t sector_num, int nb_sectors)\n+\n+{\n \n+ if (sector_num < 0 ||\n \n nb_sectors < 0)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int bdrv_wr_badreq_sectors(BlockDriverState *bs,\n\n int64_t sector_num, int nb_sectors)\n\n{\n\n if (sector_num < 0 ||\n\n nb_sectors < 0)\n\n return 1;\n\n\n\n if (sector_num > bs->total_sectors - nb_sectors) {\n\n if (bs->autogrow)\n\n bs->total_sectors = sector_num + nb_sectors;\n\n else\n\n return 1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_34", "diff": "--- a/source.c\n+++ b/source.c\n@@ -45,9 +45,9 @@\n blk_dev_change_media_cb(bs->blk, true);\n \n }\n+\n+ }\n+\n+ return ret;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int bdrv_set_key(BlockDriverState *bs, const char *key)\n\n{\n\n int ret;\n\n if (bs->backing_hd && bs->backing_hd->encrypted) {\n\n ret = bdrv_set_key(bs->backing_hd, key);\n\n if (ret < 0)\n\n return ret;\n\n if (!bs->encrypted)\n\n return 0;\n\n }\n\n if (!bs->encrypted) {\n\n return -EINVAL;\n\n } else if (!bs->drv || !bs->drv->bdrv_set_key) {\n\n return -ENOMEDIUM;\n\n }\n\n ret = bs->drv->bdrv_set_key(bs, key);\n\n if (ret < 0) {\n\n bs->valid_key = 0;\n\n } else if (!bs->valid_key) {\n\n bs->valid_key = 1;\n\n if (bs->blk) {\n\n /* call the change callback now, we skipped it on open */\n\n blk_dev_change_media_cb(bs->blk, true);\n\n }\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "10c4c98ab7dc18169b37b76f6ea5e60ebe65222b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,8 +6,8 @@\n \n info->qdev.init = ssi_slave_init;\n \n+ info->qdev.bus_type = BUS_TYPE_SSI;\n+\n+ qdev_register(&info->qdev);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ssi_register_slave(SSISlaveInfo *info)\n\n{\n\n assert(info->qdev.size >= sizeof(SSISlave));\n\n info->qdev.init = ssi_slave_init;\n\n info->qdev.bus_type = BUS_TYPE_SSI;\n\n qdev_register(&info->qdev);\n\n}\n"}} {"sample_id": "5f5a1318653c08e435cfa52f60b6a712815b659d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n uint32_t virtio_config_readb(VirtIODevice *vdev, uint32_t addr)\n \n {\n+\n+ VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);\n \n uint8_t val;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "uint32_t virtio_config_readb(VirtIODevice *vdev, uint32_t addr)\n\n{\n\n VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);\n\n uint8_t val;\n\n\n\n k->get_config(vdev, vdev->config);\n\n\n\n if (addr > (vdev->config_len - sizeof(val)))\n\n return (uint32_t)-1;\n\n\n\n val = ldub_p(vdev->config + addr);\n\n return val;\n\n}\n"}} {"sample_id": "e2193b53eab9f207544a75ebaf51871b7a1a7931_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,8 +32,8 @@\n \n }\n \n+\n+\n+ return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int update_streams_from_subdemuxer(AVFormatContext *s, struct playlist *pls)\n\n{\n\n while (pls->n_main_streams < pls->ctx->nb_streams) {\n\n int ist_idx = pls->n_main_streams;\n\n AVStream *st = avformat_new_stream(s, NULL);\n\n AVStream *ist = pls->ctx->streams[ist_idx];\n\n\n\n if (!st)\n\n return AVERROR(ENOMEM);\n\n\n\n st->id = pls->index;\n\n set_stream_info_from_input_stream(st, pls, ist);\n\n\n\n dynarray_add(&pls->main_streams, &pls->n_main_streams, st);\n\n\n\n add_stream_to_programs(s, pls, st);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "721d6f2dc5437df21ae17923b29fa2be847764c7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n \n \n \n+ for (i = 0; i < n/2; i++)\n+\n+ s->csc2[i] = 0.5 / sin((M_PI / (2*n) * (2*i + 1)));\n+\n+\n \n switch(inverse) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "av_cold int ff_dct_init(DCTContext *s, int nbits, enum DCTTransformType inverse)\n\n{\n\n int n = 1 << nbits;\n\n int i;\n\n\n\n s->nbits = nbits;\n\n s->inverse = inverse;\n\n\n\n ff_init_ff_cos_tabs(nbits+2);\n\n\n\n s->costab = ff_cos_tabs[nbits+2];\n\n\n\n s->csc2 = av_malloc(n/2 * sizeof(FFTSample));\n\n\n\n if (ff_rdft_init(&s->rdft, nbits, inverse == DCT_III) < 0) {\n\n av_free(s->csc2);\n\n return -1;\n\n }\n\n\n\n for (i = 0; i < n/2; i++)\n\n s->csc2[i] = 0.5 / sin((M_PI / (2*n) * (2*i + 1)));\n\n\n\n switch(inverse) {\n\n case DCT_I : s->dct_calc = ff_dct_calc_I_c; break;\n\n case DCT_II : s->dct_calc = ff_dct_calc_II_c ; break;\n\n case DCT_III: s->dct_calc = ff_dct_calc_III_c; break;\n\n case DST_I : s->dct_calc = ff_dst_calc_I_c; break;\n\n }\n\n\n\n if (inverse == DCT_II && nbits == 5)\n\n s->dct_calc = dct32_func;\n\n\n\n s->dct32 = dct32;\n\n if (HAVE_MMX) ff_dct_init_mmx(s);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "e9064c9ce8ed18c3a3aab61e58e663b8f5b0c551_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n const uint8_t *raw = buf + (s->avctx->width*s->avctx->height/16);\n \n int x,y,i;\n+\n \n \n i = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void cmv_decode_inter(CmvContext * s, const uint8_t *buf, const uint8_t *buf_end){\n\n const uint8_t *raw = buf + (s->avctx->width*s->avctx->height/16);\n\n int x,y,i;\n\n\n\n i = 0;\n\n for(y=0; yavctx->height/4; y++)\n\n for(x=0; xavctx->width/4 && buf+iframe.data[0] + (y*4)*s->frame.linesize[0] + x*4;\n\n if (raw+16frame.linesize[0], raw+4, 4);\n\n memcpy(dst+2*s->frame.linesize[0], raw+8, 4);\n\n memcpy(dst+3*s->frame.linesize[0], raw+12, 4);\n\n raw+=16;\n\n }else if(raw> 4)) - 7;\n\n if (s->last2_frame.data[0])\n\n cmv_motcomp(s->frame.data[0], s->frame.linesize[0],\n\n s->last2_frame.data[0], s->last2_frame.linesize[0],\n\n x*4, y*4, xoffset, yoffset, s->avctx->width, s->avctx->height);\n\n raw++;\n\n }\n\n }else{ /* inter using last frame as reference */\n\n int xoffset = (buf[i] & 0xF) - 7;\n\n int yoffset = ((buf[i] >> 4)) - 7;\n\n cmv_motcomp(s->frame.data[0], s->frame.linesize[0],\n\n s->last_frame.data[0], s->last_frame.linesize[0],\n\n x*4, y*4, xoffset, yoffset, s->avctx->width, s->avctx->height);\n\n }\n\n i++;\n\n }\n\n}\n"}} {"sample_id": "0ee143558d55b590774dba69cff5a16eda089a4d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,7 +12,7 @@\n \n while (prefix_val < 5 && GET_CABAC(elem_offset[CU_QP_DELTA] + inc)) {\n \n+ prefix_val++;\n \n inc = 1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int ff_hevc_cu_qp_delta_abs(HEVCContext *s)\n\n{\n\n int prefix_val = 0;\n\n int suffix_val = 0;\n\n int inc = 0;\n\n\n\n while (prefix_val < 5 && GET_CABAC(elem_offset[CU_QP_DELTA] + inc)) {\n\n prefix_val++;\n\n inc = 1;\n\n }\n\n if (prefix_val >= 5) {\n\n int k = 0;\n\n while (k < CABAC_MAX_BIN && get_cabac_bypass(&s->HEVClc->cc)) {\n\n suffix_val += 1 << k;\n\n k++;\n\n }\n\n if (k == CABAC_MAX_BIN)\n\n av_log(s->avctx, AV_LOG_ERROR, \"CABAC_MAX_BIN : %d\\n\", k);\n\n\n\n while (k--)\n\n suffix_val += get_cabac_bypass(&s->HEVClc->cc) << k;\n\n }\n\n return prefix_val + suffix_val;\n\n}\n"}} {"sample_id": "c9262e8a84a29f22fbb5edde5d17f4f6166d5ae1_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n write_subsystem_identification();\n \n /*\n+\n * The IPL PSW is at address 0. We also must not overwrite the\n \n * content of non-BIOS memory after we loaded the guest, so we", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void jump_to_IPL_code(uint64_t address)\n\n{\n\n /* store the subsystem information _after_ the bootmap was loaded */\n\n write_subsystem_identification();\n\n /*\n\n * The IPL PSW is at address 0. We also must not overwrite the\n\n * content of non-BIOS memory after we loaded the guest, so we\n\n * save the original content and restore it in jump_to_IPL_2.\n\n */\n\n ResetInfo *current = 0;\n\n\n\n save = *current;\n\n current->ipl_addr = (uint32_t) (uint64_t) &jump_to_IPL_2;\n\n current->ipl_continue = address & 0x7fffffff;\n\n\n\n debug_print_int(\"set IPL addr to\", current->ipl_continue);\n\n\n\n /* Ensure the guest output starts fresh */\n\n sclp_print(\"\\n\");\n\n\n\n /*\n\n * HACK ALERT.\n\n * We use the load normal reset to keep r15 unchanged. jump_to_IPL_2\n\n * can then use r15 as its stack pointer.\n\n */\n\n asm volatile(\"lghi 1,1\\n\\t\"\n\n \"diag 1,1,0x308\\n\\t\"\n\n : : : \"1\", \"memory\");\n\n virtio_panic(\"\\n! IPL returns !\\n\");\n\n}\n"}} {"sample_id": "c7f8d0f3a52b5ef8fdcd305cce438f67d7e06a9f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n \n \n+ if (object_dynamic_cast(OBJECT(dev), TYPE_NVDIMM)) {\n+\n+ nvdimm_acpi_hotplug(&pcms->acpi_nvdimm_state);\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pc_dimm_post_plug(HotplugHandler *hotplug_dev,\n\n DeviceState *dev, Error **errp)\n\n{\n\n PCMachineState *pcms = PC_MACHINE(hotplug_dev);\n\n\n\n if (object_dynamic_cast(OBJECT(dev), TYPE_NVDIMM)) {\n\n nvdimm_acpi_hotplug(&pcms->acpi_nvdimm_state);\n\n }\n\n}\n"}} {"sample_id": "2d6ee8e7e17227d5eb8c6e9a054dd88d5b37c5ae", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n } else if (s->recv_fifo.count >= s->recv_fifo.itl) {\n \n+ tmp_iir = UART_IIR_RDI;\n+\n+ }\n+\n+ } else if ((s->ier & UART_IER_THRI) && s->thr_ipending) {\n \n tmp_iir = UART_IIR_THRI;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void serial_update_irq(SerialState *s)\n\n{\n\n uint8_t tmp_iir = UART_IIR_NO_INT;\n\n\n\n if ((s->ier & UART_IER_RLSI) && (s->lsr & UART_LSR_INT_ANY)) {\n\n tmp_iir = UART_IIR_RLSI;\n\n } else if ((s->ier & UART_IER_RDI) && s->timeout_ipending) {\n\n /* Note that(s->ier & UART_IER_RDI) can mask this interrupt,\n\n * this is not in the specification but is observed on existing\n\n * hardware. */\n\n tmp_iir = UART_IIR_CTI;\n\n } else if ((s->ier & UART_IER_RDI) && (s->lsr & UART_LSR_DR)) {\n\n if (!(s->fcr & UART_FCR_FE)) {\n\n tmp_iir = UART_IIR_RDI;\n\n } else if (s->recv_fifo.count >= s->recv_fifo.itl) {\n\n tmp_iir = UART_IIR_RDI;\n\n }\n\n } else if ((s->ier & UART_IER_THRI) && s->thr_ipending) {\n\n tmp_iir = UART_IIR_THRI;\n\n } else if ((s->ier & UART_IER_MSI) && (s->msr & UART_MSR_ANY_DELTA)) {\n\n tmp_iir = UART_IIR_MSI;\n\n }\n\n\n\n s->iir = tmp_iir | (s->iir & 0xF0);\n\n\n\n if (tmp_iir != UART_IIR_NO_INT) {\n\n qemu_irq_raise(s->irq);\n\n } else {\n\n qemu_irq_lower(s->irq);\n\n }\n\n}\n"}} {"sample_id": "0db5b2b9f8a96298eeba7988d43c4eb44220fab3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n uint8_t *p, *p0;\n \n+\n+\n+ ff_metadata_conv(m, ff_vorbiscomment_metadata_conv, NULL);\n+\n+\n \n size = offset + ff_vorbiscomment_length(*m, vendor) + framing_bit;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint8_t *ogg_write_vorbiscomment(int offset, int bitexact,\n\n int *header_len, AVDictionary **m, int framing_bit)\n\n{\n\n const char *vendor = bitexact ? \"ffmpeg\" : LIBAVFORMAT_IDENT;\n\n int size;\n\n uint8_t *p, *p0;\n\n\n\n ff_metadata_conv(m, ff_vorbiscomment_metadata_conv, NULL);\n\n\n\n size = offset + ff_vorbiscomment_length(*m, vendor) + framing_bit;\n\n p = av_mallocz(size);\n\n if (!p)\n\n return NULL;\n\n p0 = p;\n\n\n\n p += offset;\n\n ff_vorbiscomment_write(&p, m, vendor);\n\n if (framing_bit)\n\n bytestream_put_byte(&p, 1);\n\n\n\n *header_len = size;\n\n return p0;\n\n}\n"}} {"sample_id": "c9ad19c57b4e35dda507ec636443069048a4ad72", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n void helper_fxtract(void)\n \n+{\n \n+ CPU86_LDoubleU temp;\n+\n+ unsigned int expdif;\n+\n+\n \n temp.d = ST0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void helper_fxtract(void)\n\n{\n\n CPU86_LDoubleU temp;\n\n unsigned int expdif;\n\n\n\n temp.d = ST0;\n\n expdif = EXPD(temp) - EXPBIAS;\n\n /*DP exponent bias*/\n\n ST0 = expdif;\n\n fpush();\n\n BIASEXPONENT(temp);\n\n ST0 = temp.d;\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n return timerlist_has_timers(\n+\n+ main_loop_tlg.tl[type]);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool qemu_clock_has_timers(QEMUClockType type)\n\n{\n\n return timerlist_has_timers(\n\n main_loop_tlg.tl[type]);\n\n}\n"}} {"sample_id": "3cb0bec6870cf0bb7879f7bfd4119ef39a02a464", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n \n \n+ while ((pid = waitpid(-1, &status, WNOHANG)) > 0) {\n \n FFServerStream *feed;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void handle_child_exit(int sig)\n\n{\n\n pid_t pid;\n\n int status;\n\n\n\n while ((pid = waitpid(-1, &status, WNOHANG)) > 0) {\n\n FFServerStream *feed;\n\n\n\n for (feed = config.first_feed; feed; feed = feed->next) {\n\n if (feed->pid == pid) {\n\n int uptime = time(0) - feed->pid_start;\n\n\n\n feed->pid = 0;\n\n fprintf(stderr, \"%s: Pid %d exited with status %d after %d seconds\\n\", feed->filename, pid, status, uptime);\n\n\n\n if (uptime < 30)\n\n /* Turn off any more restarts */\n\n feed->child_argv = 0;\n\n }\n\n }\n\n }\n\n\n\n need_to_start_children = 1;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_132", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,8 +16,8 @@\n \n }\n \n+\n+\n+ return result;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static inline uint8_t *ram_chunk_end(const RDMALocalBlock *rdma_ram_block,\n\n uint64_t i)\n\n{\n\n uint8_t *result = ram_chunk_start(rdma_ram_block, i) +\n\n (1UL << RDMA_REG_CHUNK_SHIFT);\n\n\n\n if (result > (rdma_ram_block->local_host_addr + rdma_ram_block->length)) {\n\n result = rdma_ram_block->local_host_addr + rdma_ram_block->length;\n\n }\n\n\n\n return result;\n\n}\n"}} {"sample_id": "a1bb73849fbd7d992b6ac2cf30c034244fb2299d_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void helper_rfi(CPUPPCState *env)\n+\n {\n \n do_rfi(env, env->spr[SPR_SRR0], env->spr[SPR_SRR1],", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void helper_rfi(CPUPPCState *env)\n\n{\n\n do_rfi(env, env->spr[SPR_SRR0], env->spr[SPR_SRR1],\n\n ~((target_ulong)0x783F0000), 1);\n\n}\n"}} {"sample_id": "84a3a53cf61ef691478bd91afa455c801696053c_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,14 +3,14 @@\n {\n \n DeviceState *dev = DEVICE(sbd);\n+\n struct omap2_gpif_s *s = OMAP2_GPIO(dev);\n \n+ int i;\n \n \n \n+ if (!s->iclk) {\n \n hw_error(\"omap2-gpio: iclk not connected\\n\");\n \n@@ -18,8 +18,8 @@\n \n if (s->mpu_model < omap3430) {\n \n+ s->modulecount = (s->mpu_model < omap2430) ? 4 : 5;\n+\n memory_region_init_io(&s->iomem, OBJECT(s), &omap2_gpif_top_ops, s,\n \n \"omap2.gpio\", 0x1000);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int omap2_gpio_init(SysBusDevice *sbd)\n\n{\n\n DeviceState *dev = DEVICE(sbd);\n\n struct omap2_gpif_s *s = OMAP2_GPIO(dev);\n\n int i;\n\n\n\n if (!s->iclk) {\n\n hw_error(\"omap2-gpio: iclk not connected\\n\");\n\n }\n\n if (s->mpu_model < omap3430) {\n\n s->modulecount = (s->mpu_model < omap2430) ? 4 : 5;\n\n memory_region_init_io(&s->iomem, OBJECT(s), &omap2_gpif_top_ops, s,\n\n \"omap2.gpio\", 0x1000);\n\n sysbus_init_mmio(sbd, &s->iomem);\n\n } else {\n\n s->modulecount = 6;\n\n }\n\n s->modules = g_new0(struct omap2_gpio_s, s->modulecount);\n\n s->handler = g_new0(qemu_irq, s->modulecount * 32);\n\n qdev_init_gpio_in(dev, omap2_gpio_set, s->modulecount * 32);\n\n qdev_init_gpio_out(dev, s->handler, s->modulecount * 32);\n\n for (i = 0; i < s->modulecount; i++) {\n\n struct omap2_gpio_s *m = &s->modules[i];\n\n if (!s->fclk[i]) {\n\n hw_error(\"omap2-gpio: fclk%d not connected\\n\", i);\n\n }\n\n m->revision = (s->mpu_model < omap3430) ? 0x18 : 0x25;\n\n m->handler = &s->handler[i * 32];\n\n sysbus_init_irq(sbd, &m->irq[0]); /* mpu irq */\n\n sysbus_init_irq(sbd, &m->irq[1]); /* dsp irq */\n\n sysbus_init_irq(sbd, &m->wkup);\n\n memory_region_init_io(&m->iomem, OBJECT(s), &omap2_gpio_module_ops, m,\n\n \"omap.gpio-module\", 0x1000);\n\n sysbus_init_mmio(sbd, &m->iomem);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "982263ce714ffcc4c7c41a7b255bd29e093912fe_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n replay_state.current_step += count;\n if (replay_state.instructions_count == 0) {\n assert(replay_state.data_kind == EVENT_INSTRUCTION);\n+ replay_finish_event();\n+ /* Wake up iothread. This is required because\n+ timers will not expire until clock counters\n+ will be read from the log. */\n+ qemu_notify_event();\n }\n }\n replay_mutex_unlock();", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void replay_account_executed_instructions(void)\n{\n if (replay_mode == REPLAY_MODE_PLAY) {\n replay_mutex_lock();\n if (replay_state.instructions_count > 0) {\n int count = (int)(replay_get_current_step()\n - replay_state.current_step);\n replay_state.instructions_count -= count;\n replay_state.current_step += count;\n if (replay_state.instructions_count == 0) {\n assert(replay_state.data_kind == EVENT_INSTRUCTION);\n replay_finish_event();\n /* Wake up iothread. This is required because\n timers will not expire until clock counters\n will be read from the log. */\n qemu_notify_event();\n }\n }\n replay_mutex_unlock();\n }\n}"}} {"sample_id": "1ee24514aed34760fb2863d98bea3a1b705d9c9f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ NvmeDeleteQ *c = (NvmeDeleteQ *)cmd;\n \n NvmeCQueue *cq;\n \n+ uint16_t qid = le16_to_cpu(c->qid);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static uint16_t nvme_del_cq(NvmeCtrl *n, NvmeCmd *cmd)\n\n{\n\n NvmeDeleteQ *c = (NvmeDeleteQ *)cmd;\n\n NvmeCQueue *cq;\n\n uint16_t qid = le16_to_cpu(c->qid);\n\n\n\n if (!qid || nvme_check_cqid(n, qid)) {\n\n return NVME_INVALID_CQID | NVME_DNR;\n\n }\n\n\n\n cq = n->cq[qid];\n\n if (!QTAILQ_EMPTY(&cq->sq_list)) {\n\n return NVME_INVALID_QUEUE_DEL;\n\n }\n\n nvme_free_cq(cq, n);\n\n return NVME_SUCCESS;\n\n}\n"}} {"sample_id": "06b106889a09277617fc8c542397a9f595ee605a_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+ram_addr_t migration_bitmap_find_dirty(RAMState *rs, RAMBlock *rb,\n \n ram_addr_t start,\n \n@@ -11,7 +11,7 @@\n unsigned long nr = base + (start >> TARGET_PAGE_BITS);\n \n uint64_t rb_size = rb->used_length;\n+\n unsigned long size = base + (rb_size >> TARGET_PAGE_BITS);\n \n unsigned long *bitmap;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "ram_addr_t migration_bitmap_find_dirty(RAMState *rs, RAMBlock *rb,\n\n ram_addr_t start,\n\n ram_addr_t *ram_addr_abs)\n\n{\n\n unsigned long base = rb->offset >> TARGET_PAGE_BITS;\n\n unsigned long nr = base + (start >> TARGET_PAGE_BITS);\n\n uint64_t rb_size = rb->used_length;\n\n unsigned long size = base + (rb_size >> TARGET_PAGE_BITS);\n\n unsigned long *bitmap;\n\n\n\n unsigned long next;\n\n\n\n bitmap = atomic_rcu_read(&rs->ram_bitmap)->bmap;\n\n if (rs->ram_bulk_stage && nr > base) {\n\n next = nr + 1;\n\n } else {\n\n next = find_next_bit(bitmap, size, nr);\n\n }\n\n\n\n *ram_addr_abs = next << TARGET_PAGE_BITS;\n\n return (next - base) << TARGET_PAGE_BITS;\n\n}\n"}} {"sample_id": "7385aed20db5d83979f683b9d0048674411e963c_30", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void helper_fitoq(CPUSPARCState *env, int32_t src)\n \n {\n+\n+ /* No possible exceptions converting int to long double. */\n \n QT0 = int32_to_float128(src, &env->fp_status);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void helper_fitoq(CPUSPARCState *env, int32_t src)\n\n{\n\n /* No possible exceptions converting int to long double. */\n\n QT0 = int32_to_float128(src, &env->fp_status);\n\n}\n"}} {"sample_id": "9543cd593ed8249e9885598fc53de163c9d4e2d3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n char val_str[128];\n \n int64_t size = fmt_ctx->pb ? avio_size(fmt_ctx->pb) : -1;\n+\n \n \n print_section_header(\"format\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void show_format(WriterContext *w, AVFormatContext *fmt_ctx)\n\n{\n\n char val_str[128];\n\n int64_t size = fmt_ctx->pb ? avio_size(fmt_ctx->pb) : -1;\n\n\n\n print_section_header(\"format\");\n\n print_str(\"filename\", fmt_ctx->filename);\n\n print_int(\"nb_streams\", fmt_ctx->nb_streams);\n\n print_str(\"format_name\", fmt_ctx->iformat->name);\n\n print_str(\"format_long_name\", fmt_ctx->iformat->long_name);\n\n print_time(\"start_time\", fmt_ctx->start_time, &AV_TIME_BASE_Q);\n\n print_time(\"duration\", fmt_ctx->duration, &AV_TIME_BASE_Q);\n\n if (size >= 0) print_val (\"size\", size, unit_byte_str);\n\n else print_str_opt(\"size\", \"N/A\");\n\n if (fmt_ctx->bit_rate > 0) print_val (\"bit_rate\", fmt_ctx->bit_rate, unit_bit_per_second_str);\n\n else print_str_opt(\"bit_rate\", \"N/A\");\n\n show_tags(fmt_ctx->metadata);\n\n print_section_footer(\"format\");\n\n fflush(stdout);\n\n}\n"}} {"sample_id": "857d4f46c31d2f4d57d2f0fad9dfb584262bf9b9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void bdrv_aio_bh_cb(void *opaque)\n \n+{\n \n BlockDriverAIOCBSync *acb = opaque;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void bdrv_aio_bh_cb(void *opaque)\n\n{\n\n BlockDriverAIOCBSync *acb = opaque;\n\n\n\n if (!acb->is_write)\n\n qemu_iovec_from_buf(acb->qiov, 0, acb->bounce, acb->qiov->size);\n\n qemu_vfree(acb->bounce);\n\n acb->common.cb(acb->common.opaque, acb->ret);\n\n qemu_bh_delete(acb->bh);\n\n acb->bh = NULL;\n\n qemu_aio_release(acb);\n\n}\n"}} {"sample_id": "4a1418e07bdcfaa3177739e04707ecaec75d89e1_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void kqemu_record_pc(unsigned long pc)\n+\n+{\n+\n+ unsigned long h;\n+\n PCRecord **pr, *r;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void kqemu_record_pc(unsigned long pc)\n\n{\n\n unsigned long h;\n\n PCRecord **pr, *r;\n\n\n\n h = pc / PC_REC_SIZE;\n\n h = h ^ (h >> PC_REC_HASH_BITS);\n\n h &= (PC_REC_HASH_SIZE - 1);\n\n pr = &pc_rec_hash[h];\n\n for(;;) {\n\n r = *pr;\n\n if (r == NULL)\n\n break;\n\n if (r->pc == pc) {\n\n r->count++;\n\n return;\n\n }\n\n pr = &r->next;\n\n }\n\n r = malloc(sizeof(PCRecord));\n\n r->count = 1;\n\n r->pc = pc;\n\n r->next = NULL;\n\n *pr = r;\n\n nb_pc_records++;\n\n}\n"}} {"sample_id": "aae4f5108d04041bb264a9c547f05c4f0d18c9c7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n mxf->local_tags = av_calloc(item_num, item_len);\n \n+ if (!mxf->local_tags)\n+\n+ return AVERROR(ENOMEM);\n+\n+ mxf->local_tags_count = item_num;\n \n avio_read(pb, mxf->local_tags, item_num*item_len);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int mxf_read_primer_pack(void *arg, AVIOContext *pb, int tag, int size, UID uid, int64_t klv_offset)\n\n{\n\n MXFContext *mxf = arg;\n\n int item_num = avio_rb32(pb);\n\n int item_len = avio_rb32(pb);\n\n\n\n if (item_len != 18) {\n\n avpriv_request_sample(pb, \"Primer pack item length %d\", item_len);\n\n return AVERROR_PATCHWELCOME;\n\n }\n\n if (item_num > 65536) {\n\n av_log(mxf->fc, AV_LOG_ERROR, \"item_num %d is too large\\n\", item_num);\n\n return AVERROR_INVALIDDATA;\n\n }\n\n\n\n\n\n mxf->local_tags = av_calloc(item_num, item_len);\n\n if (!mxf->local_tags)\n\n return AVERROR(ENOMEM);\n\n mxf->local_tags_count = item_num;\n\n avio_read(pb, mxf->local_tags, item_num*item_len);\n\n return 0;\n\n}"}} {"sample_id": "167351020420c285b67cdf0603501b3d3b15e3f7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void pxa2xx_screen_dump(void *opaque, const char *filename)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void pxa2xx_screen_dump(void *opaque, const char *filename)\n\n{\n\n /* TODO */\n\n}\n"}} {"sample_id": "ee640c625e190a0c0e6b8966adc0e4720fb75200_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n vmxnet3_init_msix(VMXNET3State *s)\n \n+{\n \n PCIDevice *d = PCI_DEVICE(s);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "vmxnet3_init_msix(VMXNET3State *s)\n\n{\n\n PCIDevice *d = PCI_DEVICE(s);\n\n int res = msix_init(d, VMXNET3_MAX_INTRS,\n\n &s->msix_bar,\n\n VMXNET3_MSIX_BAR_IDX, VMXNET3_OFF_MSIX_TABLE,\n\n &s->msix_bar,\n\n VMXNET3_MSIX_BAR_IDX, VMXNET3_OFF_MSIX_PBA(s),\n\n VMXNET3_MSIX_OFFSET(s));\n\n\n\n if (0 > res) {\n\n VMW_WRPRN(\"Failed to initialize MSI-X, error %d\", res);\n\n s->msix_used = false;\n\n } else {\n\n if (!vmxnet3_use_msix_vectors(s, VMXNET3_MAX_INTRS)) {\n\n VMW_WRPRN(\"Failed to use MSI-X vectors, error %d\", res);\n\n msix_uninit(d, &s->msix_bar, &s->msix_bar);\n\n s->msix_used = false;\n\n } else {\n\n s->msix_used = true;\n\n }\n\n }\n\n return s->msix_used;\n\n}\n"}} {"sample_id": "966439a67830239a6c520c5df6c55627b8153c8b_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n if (likely(!(((int64_t)T0 == INT64_MIN && (int64_t)T1 == -1ULL) ||\n+\n (int64_t)T1 == 0))) {\n \n xer_ov = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void do_divdo (void)\n\n{\n\n if (likely(!(((int64_t)T0 == INT64_MIN && (int64_t)T1 == -1ULL) ||\n\n (int64_t)T1 == 0))) {\n\n xer_ov = 0;\n\n T0 = (int64_t)T0 / (int64_t)T1;\n\n } else {\n\n xer_so = 1;\n\n xer_ov = 1;\n\n T0 = (-1ULL) * ((uint64_t)T0 >> 63);\n\n }\n\n}\n"}} {"sample_id": "32bafa8fdd098d52fbf1102d5a5e48d29398c0aa_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n connect_addr->type = SOCKET_ADDRESS_KIND_UNIX;\n \n+ connect_addr->u.q_unix = g_new0(UnixSocketAddress, 1);\n+\n+ connect_addr->u.q_unix->path = g_strdup(TEST_SOCKET);\n+\n+\n \n test_io_channel(async, listen_addr, connect_addr, true);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_io_channel_unix(bool async)\n\n{\n\n SocketAddress *listen_addr = g_new0(SocketAddress, 1);\n\n SocketAddress *connect_addr = g_new0(SocketAddress, 1);\n\n\n\n#define TEST_SOCKET \"test-io-channel-socket.sock\"\n\n listen_addr->type = SOCKET_ADDRESS_KIND_UNIX;\n\n listen_addr->u.q_unix = g_new0(UnixSocketAddress, 1);\n\n listen_addr->u.q_unix->path = g_strdup(TEST_SOCKET);\n\n\n\n connect_addr->type = SOCKET_ADDRESS_KIND_UNIX;\n\n connect_addr->u.q_unix = g_new0(UnixSocketAddress, 1);\n\n connect_addr->u.q_unix->path = g_strdup(TEST_SOCKET);\n\n\n\n test_io_channel(async, listen_addr, connect_addr, true);\n\n\n\n qapi_free_SocketAddress(listen_addr);\n\n qapi_free_SocketAddress(connect_addr);\n\n unlink(TEST_SOCKET);\n\n}\n"}} {"sample_id": "788cf9f8c8cbda53843e060540f3e91a060eb744_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,19 +1,19 @@\n+static int img_open_password(BlockBackend *blk, const char *filename,\n+\n+ int flags, bool quiet)\n+\n+{\n+\n+ BlockDriverState *bs;\n+\n+ char password[256];\n \n+\n+\n bs = blk_bs(blk);\n \n if (bdrv_is_encrypted(bs) && bdrv_key_required(bs) &&\n+\n !(flags & BDRV_O_NO_IO)) {\n \n qprintf(quiet, \"Disk image '%s' is encrypted.\\n\", filename);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int img_open_password(BlockBackend *blk, const char *filename,\n\n int flags, bool quiet)\n\n{\n\n BlockDriverState *bs;\n\n char password[256];\n\n\n\n bs = blk_bs(blk);\n\n if (bdrv_is_encrypted(bs) && bdrv_key_required(bs) &&\n\n !(flags & BDRV_O_NO_IO)) {\n\n qprintf(quiet, \"Disk image '%s' is encrypted.\\n\", filename);\n\n if (qemu_read_password(password, sizeof(password)) < 0) {\n\n error_report(\"No password given\");\n\n return -1;\n\n }\n\n if (bdrv_set_key(bs, password) < 0) {\n\n error_report(\"invalid password\");\n\n return -1;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "f6c6483b259a2395ee44cfa966f622e0f2dbe2ae", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void migration_end(void)\n \n+{\n+\n+ if (migration_bitmap) {\n+\n+ memory_global_dirty_log_stop();\n \n g_free(migration_bitmap);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void migration_end(void)\n\n{\n\n if (migration_bitmap) {\n\n memory_global_dirty_log_stop();\n\n g_free(migration_bitmap);\n\n migration_bitmap = NULL;\n\n }\n\n\n\n if (XBZRLE.cache) {\n\n cache_fini(XBZRLE.cache);\n\n g_free(XBZRLE.cache);\n\n g_free(XBZRLE.encoded_buf);\n\n g_free(XBZRLE.current_buf);\n\n g_free(XBZRLE.decoded_buf);\n\n XBZRLE.cache = NULL;\n\n\n\n\n }\n\n}"}} {"sample_id": "4a3adebb1854d48f0c67958e164c6b2f29d44064", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n if (!bit) {\n \n+ continue;\n+\n+ }\n+\n+\n \n return bit - 1 + i * 32;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int kvm_irqchip_get_virq(KVMState *s)\n\n{\n\n uint32_t *word = s->used_gsi_bitmap;\n\n int max_words = ALIGN(s->gsi_count, 32) / 32;\n\n int i, bit;\n\n bool retry = true;\n\n\n\nagain:\n\n /* Return the lowest unused GSI in the bitmap */\n\n for (i = 0; i < max_words; i++) {\n\n bit = ffs(~word[i]);\n\n if (!bit) {\n\n continue;\n\n }\n\n\n\n return bit - 1 + i * 32;\n\n }\n\n if (retry) {\n\n retry = false;\n\n kvm_flush_dynamic_msi_routes(s);\n\n goto again;\n\n }\n\n return -ENOSPC;\n\n\n\n}\n"}} {"sample_id": "4e47e39ab0ded72c0af174131ecf49d588d66c12_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static void update_sse_status(CPUX86State *env)\n \n+{\n \n int rnd_type;\n \n@@ -11,8 +11,8 @@\n switch (env->mxcsr & SSE_RC_MASK) {\n \n default:\n+\n+ case SSE_RC_NEAR:\n \n rnd_type = float_round_nearest_even;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void update_sse_status(CPUX86State *env)\n\n{\n\n int rnd_type;\n\n\n\n /* set rounding mode */\n\n switch (env->mxcsr & SSE_RC_MASK) {\n\n default:\n\n case SSE_RC_NEAR:\n\n rnd_type = float_round_nearest_even;\n\n break;\n\n case SSE_RC_DOWN:\n\n rnd_type = float_round_down;\n\n break;\n\n case SSE_RC_UP:\n\n rnd_type = float_round_up;\n\n break;\n\n case SSE_RC_CHOP:\n\n rnd_type = float_round_to_zero;\n\n break;\n\n }\n\n set_float_rounding_mode(rnd_type, &env->sse_status);\n\n\n\n /* set denormals are zero */\n\n set_flush_inputs_to_zero((env->mxcsr & SSE_DAZ) ? 1 : 0, &env->sse_status);\n\n\n\n /* set flush to zero */\n\n set_flush_to_zero((env->mxcsr & SSE_FZ) ? 1 : 0, &env->fp_status);\n\n}\n"}} {"sample_id": "a4696aa2fe88c21927835e59d543eb2efbfabaef", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n RTPDemuxContext *s = s1->priv_data;\n \n+ uint32_t rtp_ts;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void rtcp_send_sr(AVFormatContext *s1, int64_t ntp_time)\n\n{\n\n RTPDemuxContext *s = s1->priv_data;\n\n uint32_t rtp_ts;\n\n\n\n#if defined(DEBUG)\n\n printf(\"RTCP: %02x %\"PRIx64\" %x\\n\", s->payload_type, ntp_time, s->timestamp);\n\n#endif\n\n\n\n if (s->first_rtcp_ntp_time == AV_NOPTS_VALUE) s->first_rtcp_ntp_time = ntp_time;\n\n s->last_rtcp_ntp_time = ntp_time;\n\n rtp_ts = av_rescale_q(ntp_time - s->first_rtcp_ntp_time, AV_TIME_BASE_Q,\n\n s1->streams[0]->time_base) + s->base_timestamp;\n\n put_byte(s1->pb, (RTP_VERSION << 6));\n\n put_byte(s1->pb, 200);\n\n put_be16(s1->pb, 6); /* length in words - 1 */\n\n put_be32(s1->pb, s->ssrc);\n\n put_be32(s1->pb, ntp_time / 1000000);\n\n put_be32(s1->pb, ((ntp_time % 1000000) << 32) / 1000000);\n\n put_be32(s1->pb, rtp_ts);\n\n put_be32(s1->pb, s->packet_count);\n\n put_be32(s1->pb, s->octet_count);\n\n put_flush_packet(s1->pb);\n\n}\n"}} {"sample_id": "e3f5ec2b5e92706e3b807059f79b1fb5d936e567_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+ MIPSnetState *s = opaque;\n+\n+\n \n if (s->busy)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mipsnet_can_receive(void *opaque)\n\n{\n\n MIPSnetState *s = opaque;\n\n\n\n if (s->busy)\n\n return 0;\n\n return !mipsnet_buffer_full(s);\n\n}\n"}} {"sample_id": "f36aec3b5e18c4c167612d0051a6d5b6144b3552_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,9 +7,9 @@\n {\n \n int16_t *samples = data;\n+\n MACEContext *ctx = avctx->priv_data;\n+\n int i, j, k;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int mace3_decode_frame(AVCodecContext *avctx,\n\n void *data, int *data_size,\n\n const uint8_t *buf, int buf_size)\n\n{\n\n int16_t *samples = data;\n\n MACEContext *ctx = avctx->priv_data;\n\n int i, j, k;\n\n\n\n for(i = 0; i < avctx->channels; i++) {\n\n int16_t *output = samples + i;\n\n\n\n for (j=0; j < buf_size / 2 / avctx->channels; j++)\n\n for (k=0; k < 2; k++) {\n\n uint8_t pkt = buf[i*2 + j*2*avctx->channels + k];\n\n chomp3(&ctx->chd[i], output, pkt &7, MACEtab1, MACEtab2,\n\n 8, avctx->channels);\n\n output += avctx->channels;\n\n chomp3(&ctx->chd[i], output,(pkt >> 3) &3, MACEtab3, MACEtab4,\n\n 4, avctx->channels);\n\n output += avctx->channels;\n\n chomp3(&ctx->chd[i], output, pkt >> 5 , MACEtab1, MACEtab2,\n\n 8, avctx->channels);\n\n output += avctx->channels;\n\n }\n\n }\n\n\n\n *data_size = 2 * 3 * buf_size;\n\n\n\n return buf_size;\n\n}\n"}} {"sample_id": "bcd7bf7eeb09a395cc01698842d1b8be9af483fc_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n int weight_src, int offset)\n \n {\n+\n+ avc_wgt_8width_msa(src, stride,\n+\n height, log2_denom, weight_src, offset);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_weight_h264_pixels8_8_msa(uint8_t *src, int stride,\n\n int height, int log2_denom,\n\n int weight_src, int offset)\n\n{\n\n avc_wgt_8width_msa(src, stride,\n\n height, log2_denom, weight_src, offset);\n\n}\n"}} {"sample_id": "3098dba01c7daab60762b6f6624ea88c0d6cb65a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n for (other = first_cpu; other; other = other->next_cpu) {\n \n+ if (other->running) {\n+\n+ pending_cpus++;\n+\n+ cpu_interrupt(other, CPU_INTERRUPT_EXIT);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void start_exclusive(void)\n\n{\n\n CPUState *other;\n\n pthread_mutex_lock(&exclusive_lock);\n\n exclusive_idle();\n\n\n\n pending_cpus = 1;\n\n /* Make all other cpus stop executing. */\n\n for (other = first_cpu; other; other = other->next_cpu) {\n\n if (other->running) {\n\n pending_cpus++;\n\n cpu_interrupt(other, CPU_INTERRUPT_EXIT);\n\n }\n\n }\n\n if (pending_cpus > 1) {\n\n pthread_cond_wait(&exclusive_cond, &exclusive_lock);\n\n }\n\n}\n"}} {"sample_id": "2b316774f60291f57ca9ecb6a9f0712c532cae34_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,7 +15,7 @@\n if (!s->connected || s->max_size <= 0) {\n \n return TRUE;\n+\n }\n \n len = sizeof(buf);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static gboolean tcp_chr_read(GIOChannel *chan, GIOCondition cond, void *opaque)\n\n{\n\n CharDriverState *chr = opaque;\n\n TCPCharDriver *s = chr->opaque;\n\n uint8_t buf[READ_BUF_LEN];\n\n int len, size;\n\n\n\n if (!s->connected || s->max_size <= 0) {\n\n return TRUE;\n\n }\n\n len = sizeof(buf);\n\n if (len > s->max_size)\n\n len = s->max_size;\n\n size = tcp_chr_recv(chr, (void *)buf, len);\n\n if (size == 0) {\n\n /* connection closed */\n\n s->connected = 0;\n\n if (s->listen_chan) {\n\n s->listen_tag = g_io_add_watch(s->listen_chan, G_IO_IN, tcp_chr_accept, chr);\n\n }\n\n if (s->tag) {\n\n g_source_remove(s->tag);\n\n s->tag = 0;\n\n }\n\n g_io_channel_unref(s->chan);\n\n s->chan = NULL;\n\n closesocket(s->fd);\n\n s->fd = -1;\n\n qemu_chr_be_event(chr, CHR_EVENT_CLOSED);\n\n } else if (size > 0) {\n\n if (s->do_telnetopt)\n\n tcp_chr_process_IAC_bytes(chr, s, buf, &size);\n\n if (size > 0)\n\n qemu_chr_be_write(chr, buf, size);\n\n }\n\n\n\n return TRUE;\n\n}\n"}} {"sample_id": "64e69e80920d82df3fa679bc41b13770d2f99360", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n iscsi_aio_cancel(BlockDriverAIOCB *blockacb)\n \n {\n+\n IscsiAIOCB *acb = (IscsiAIOCB *)blockacb;\n+\n+ IscsiLun *iscsilun = acb->iscsilun;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "iscsi_aio_cancel(BlockDriverAIOCB *blockacb)\n\n{\n\n IscsiAIOCB *acb = (IscsiAIOCB *)blockacb;\n\n IscsiLun *iscsilun = acb->iscsilun;\n\n\n\n acb->common.cb(acb->common.opaque, -ECANCELED);\n\n acb->canceled = 1;\n\n\n\n /* send a task mgmt call to the target to cancel the task on the target */\n\n iscsi_task_mgmt_abort_task_async(iscsilun->iscsi, acb->task,\n\n iscsi_abort_task_cb, NULL);\n\n\n\n /* then also cancel the task locally in libiscsi */\n\n iscsi_scsi_task_cancel(iscsilun->iscsi, acb->task);\n\n}\n"}} {"sample_id": "3b199d29cd597a3518136d78860e172060b9e83d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n \n \n+ seq->avctx = avctx;\n+\n+ avctx->pix_fmt = AV_PIX_FMT_PAL8;\n+\n+\n \n seq->frame.data[0] = NULL;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int seqvideo_decode_init(AVCodecContext *avctx)\n\n{\n\n SeqVideoContext *seq = avctx->priv_data;\n\n\n\n seq->avctx = avctx;\n\n avctx->pix_fmt = AV_PIX_FMT_PAL8;\n\n\n\n seq->frame.data[0] = NULL;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "b626b51a6721e53817155af720243f59072e424f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -42,11 +42,11 @@\n \n if (ret < 0) {\n \n+ reply.error = -ret;\n+\n+ } else {\n+\n+ nbd_co_receive_reply(client, &request, &reply, NULL);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int nbd_client_co_pwritev(BlockDriverState *bs, uint64_t offset,\n\n uint64_t bytes, QEMUIOVector *qiov, int flags)\n\n{\n\n NbdClientSession *client = nbd_get_client_session(bs);\n\n struct nbd_request request = {\n\n .type = NBD_CMD_WRITE,\n\n .from = offset,\n\n .len = bytes,\n\n };\n\n struct nbd_reply reply;\n\n ssize_t ret;\n\n\n\n if (flags & BDRV_REQ_FUA) {\n\n assert(client->nbdflags & NBD_FLAG_SEND_FUA);\n\n request.type |= NBD_CMD_FLAG_FUA;\n\n }\n\n\n\n assert(bytes <= NBD_MAX_BUFFER_SIZE);\n\n\n\n nbd_coroutine_start(client, &request);\n\n ret = nbd_co_send_request(bs, &request, qiov);\n\n if (ret < 0) {\n\n reply.error = -ret;\n\n } else {\n\n nbd_co_receive_reply(client, &request, &reply, NULL);\n\n }\n\n nbd_coroutine_end(client, &request);\n\n return -reply.error;\n\n}\n"}} {"sample_id": "9bb234b3b170299c39c9e88cfe7da5434a92d99d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void OPPROTO op_sdiv_T1_T0(void)\n+{\n+ int64_t x0;\n+ int32_t x1;\n x0 = T0 | ((int64_t) (env->y) << 32);\n x1 = T1;\n x0 = x0 / x1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void OPPROTO op_sdiv_T1_T0(void)\n{\n int64_t x0;\n int32_t x1;\n x0 = T0 | ((int64_t) (env->y) << 32);\n x1 = T1;\n x0 = x0 / x1;\n if ((int32_t) x0 != x0) {\n\tT0 = x0 < 0? 0x80000000: 0x7fffffff;\n\tT1 = 1;\n } else {\n\tT0 = x0;\n\tT1 = 0;\n FORCE_RET();"}} {"sample_id": "c88930a6866e74953e931ae749781e98e486e5c8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n CharDriverState *chr;\n \n \n+\n if (is_daemonized()) {\n \n error_report(\"cannot use stdio with -daemonize\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static CharDriverState *qemu_chr_open_stdio(ChardevStdio *opts)\n\n{\n\n CharDriverState *chr;\n\n\n\n if (is_daemonized()) {\n\n error_report(\"cannot use stdio with -daemonize\");\n\n return NULL;\n\n }\n\n old_fd0_flags = fcntl(0, F_GETFL);\n\n tcgetattr (0, &oldtty);\n\n qemu_set_nonblock(0);\n\n atexit(term_exit);\n\n\n\n chr = qemu_chr_open_fd(0, 1);\n\n chr->chr_close = qemu_chr_close_stdio;\n\n chr->chr_set_echo = qemu_chr_set_echo_stdio;\n\n if (opts->has_signal) {\n\n stdio_allow_signal = opts->signal;\n\n }\n\n qemu_chr_fe_set_echo(chr, false);\n\n\n\n return chr;\n\n}\n"}} {"sample_id": "0ce6a434176e274a7e86bcaa268542c5cc402696", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void qemu_acl_reset(qemu_acl *acl)\n+\n {\n+\n qemu_acl_entry *entry;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void qemu_acl_reset(qemu_acl *acl)\n\n{\n\n qemu_acl_entry *entry;\n\n\n\n /* Put back to deny by default, so there is no window\n\n * of \"open access\" while the user re-initializes the\n\n * access control list */\n\n acl->defaultDeny = 1;\n\n QTAILQ_FOREACH(entry, &acl->entries, next) {\n\n QTAILQ_REMOVE(&acl->entries, entry, next);\n\n free(entry->match);\n\n free(entry);\n\n }\n\n acl->nentries = 0;\n\n}\n"}} {"sample_id": "db374790c75fa4ef947abcb5019fcf21d0b2de85", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int read_probe(AVProbeData *pd)\n+\n {\n \n if (pd->buf[0] == 'J' && pd->buf[1] == 'V' && strlen(MAGIC) <= pd->buf_size - 4 &&", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int read_probe(AVProbeData *pd)\n\n{\n\n if (pd->buf[0] == 'J' && pd->buf[1] == 'V' && strlen(MAGIC) <= pd->buf_size - 4 &&\n\n !memcmp(pd->buf + 4, MAGIC, strlen(MAGIC)))\n\n return AVPROBE_SCORE_MAX;\n\n return 0;\n\n}\n"}} {"sample_id": "6f1ec38ce2193d3d4cacd87edb452c6d7ba751ec", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n if (!g->switch_point)\n \n+ return;\n+\n+ /* XXX: check this for 8000Hz case */\n+\n+ n = 1;\n \n } else {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void compute_antialias_fixed(MPADecodeContext *s, GranuleDef *g)\n\n{\n\n int32_t *ptr, *csa;\n\n int n, i;\n\n\n\n /* we antialias only \"long\" bands */\n\n if (g->block_type == 2) {\n\n if (!g->switch_point)\n\n return;\n\n /* XXX: check this for 8000Hz case */\n\n n = 1;\n\n } else {\n\n n = SBLIMIT - 1;\n\n }\n\n\n\n ptr = g->sb_hybrid + 18;\n\n for(i = n;i > 0;i--) {\n\n int tmp0, tmp1, tmp2;\n\n csa = &csa_table[0][0];\n\n#define INT_AA(j) \\\n\n tmp0 = ptr[-1-j];\\\n\n tmp1 = ptr[ j];\\\n\n tmp2= MULH(tmp0 + tmp1, csa[0+4*j]);\\\n\n ptr[-1-j] = 4*(tmp2 - MULH(tmp1, csa[2+4*j]));\\\n\n ptr[ j] = 4*(tmp2 + MULH(tmp0, csa[3+4*j]));\n\n\n\n INT_AA(0)\n\n INT_AA(1)\n\n INT_AA(2)\n\n INT_AA(3)\n\n INT_AA(4)\n\n INT_AA(5)\n\n INT_AA(6)\n\n INT_AA(7)\n\n\n\n ptr += 18;\n\n }\n\n}\n"}} {"sample_id": "c3ab0004ae4dffc32494ae84dd15cfaa909a7884_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static inline void RENAME(hyscale)(SwsContext *c, uint16_t *dst, int dstWidth, const uint8_t *src, int srcW, int xInc,\n+\n const int16_t *hLumFilter,\n \n const int16_t *hLumFilterPos, int hLumFilterSize,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void RENAME(hyscale)(SwsContext *c, uint16_t *dst, int dstWidth, const uint8_t *src, int srcW, int xInc,\n\n const int16_t *hLumFilter,\n\n const int16_t *hLumFilterPos, int hLumFilterSize,\n\n uint8_t *formatConvBuffer,\n\n uint32_t *pal, int isAlpha)\n\n{\n\n void (*toYV12)(uint8_t *, const uint8_t *, int, uint32_t *) = isAlpha ? c->alpToYV12 : c->lumToYV12;\n\n void (*convertRange)(uint16_t *, int) = isAlpha ? NULL : c->lumConvertRange;\n\n\n\n src += isAlpha ? c->alpSrcOffset : c->lumSrcOffset;\n\n\n\n if (toYV12) {\n\n toYV12(formatConvBuffer, src, srcW, pal);\n\n src= formatConvBuffer;\n\n }\n\n\n\n if (!c->hyscale_fast) {\n\n c->hScale(dst, dstWidth, src, srcW, xInc, hLumFilter, hLumFilterPos, hLumFilterSize);\n\n } else { // fast bilinear upscale / crap downscale\n\n c->hyscale_fast(c, dst, dstWidth, src, srcW, xInc);\n\n }\n\n\n\n if (convertRange)\n\n convertRange(dst, dstWidth);\n\n}\n"}} {"sample_id": "1c02e2a17104fe7fc11893125864dc0daf1e6d5b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -42,11 +42,11 @@\n \n s->l2_size * sizeof(uint64_t));\n \n+ if (ret < 0) {\n+\n+\n+ return ret;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int l2_load(BlockDriverState *bs, uint64_t l2_offset,\n\n uint64_t **l2_table)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n int min_index;\n\n int ret;\n\n\n\n /* seek if the table for the given offset is in the cache */\n\n\n\n *l2_table = seek_l2_table(s, l2_offset);\n\n if (*l2_table != NULL) {\n\n return 0;\n\n }\n\n\n\n /* not found: load a new entry in the least used one */\n\n\n\n min_index = l2_cache_new_entry(bs);\n\n *l2_table = s->l2_cache + (min_index << s->l2_bits);\n\n\n\n BLKDBG_EVENT(bs->file, BLKDBG_L2_LOAD);\n\n ret = bdrv_pread(bs->file, l2_offset, *l2_table,\n\n s->l2_size * sizeof(uint64_t));\n\n if (ret < 0) {\n\n\n return ret;\n\n }\n\n\n\n s->l2_cache_offsets[min_index] = l2_offset;\n\n s->l2_cache_counts[min_index] = 1;\n\n\n\n return 0;\n\n}"}} {"sample_id": "6f2d8978728c48ca46f5c01835438508aace5c64_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void OPPROTO op_405_check_satu (void)\n \n+{\n \n if (unlikely(T0 < T2)) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void OPPROTO op_405_check_satu (void)\n\n{\n\n if (unlikely(T0 < T2)) {\n\n /* Saturate result */\n\n T0 = -1;\n\n }\n\n RETURN();\n\n}\n"}} {"sample_id": "c3e10c7b4377c1cbc0a4fbc12312c2cf41c0cda7_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+void OPPROTO op_405_check_ov (void)\n+\n+{\n \n do_405_check_ov();\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void OPPROTO op_405_check_ov (void)\n\n{\n\n do_405_check_ov();\n\n RETURN();\n\n}\n"}} {"sample_id": "26c208cf0ff59efd7786528884a64d35fc42e9bf_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n double sync_threshold, diff;\n+\n+\n+\n+ /* update delay to follow master synchronisation source */\n+\n if (get_master_sync_type(is) != AV_SYNC_VIDEO_MASTER) {\n \n /* if video is slave, we try to correct big delays by", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static double compute_target_delay(double delay, VideoState *is)\n\n{\n\n double sync_threshold, diff;\n\n\n\n /* update delay to follow master synchronisation source */\n\n if (get_master_sync_type(is) != AV_SYNC_VIDEO_MASTER) {\n\n /* if video is slave, we try to correct big delays by\n\n duplicating or deleting a frame */\n\n diff = get_video_clock(is) - get_master_clock(is);\n\n\n\n /* skip or repeat frame. We take into account the\n\n delay to compute the threshold. I still don't know\n\n if it is the best guess */\n\n sync_threshold = FFMAX(AV_SYNC_THRESHOLD, delay);\n\n if (fabs(diff) < AV_NOSYNC_THRESHOLD) {\n\n if (diff <= -sync_threshold)\n\n delay = 0;\n\n else if (diff >= sync_threshold)\n\n delay = 2 * delay;\n\n }\n\n }\n\n\n\n av_dlog(NULL, \"video: delay=%0.3f A-V=%f\\n\",\n\n delay, -diff);\n\n\n\n return delay;\n\n}\n"}} {"sample_id": "b40acf99bef69fa8ab0f9092ff162fde945eec12_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void portio_list_destroy(PortioList *piolist)\n \n+{\n+\n g_free(piolist->regions);\n \n g_free(piolist->aliases);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void portio_list_destroy(PortioList *piolist)\n\n{\n\n g_free(piolist->regions);\n\n g_free(piolist->aliases);\n\n}\n"}} {"sample_id": "f0c9d64a68b776374ec4732424a3e27753ce37b6_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void acpi_set_pci_info(void)\n \n+{\n \n PCIBus *bus = find_i440fx(); /* TODO: Q35 support */\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void acpi_set_pci_info(void)\n\n{\n\n PCIBus *bus = find_i440fx(); /* TODO: Q35 support */\n\n unsigned bsel_alloc = 0;\n\n\n\n if (bus) {\n\n /* Scan all PCI buses. Set property to enable acpi based hotplug. */\n\n pci_for_each_bus_depth_first(bus, acpi_set_bsel, NULL, &bsel_alloc);\n\n }\n\n}\n"}} {"sample_id": "5c720657c23afd798ae0db7c7362eb859a89ab3d_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n uint64_t size;\n \n+ uint8_t *buf;\n \n int err;\n \n@@ -15,7 +15,7 @@\n if (c->fc->nb_streams < 1) // will happen with jp2 files\n \n return 0;\n+\n st= c->fc->streams[c->fc->nb_streams-1];\n \n size= (uint64_t)st->codec->extradata_size + atom.size + 8 + FF_INPUT_BUFFER_PADDING_SIZE;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int mov_read_extradata(MOVContext *c, AVIOContext *pb, MOVAtom atom)\n\n{\n\n AVStream *st;\n\n uint64_t size;\n\n uint8_t *buf;\n\n int err;\n\n\n\n if (c->fc->nb_streams < 1) // will happen with jp2 files\n\n return 0;\n\n st= c->fc->streams[c->fc->nb_streams-1];\n\n size= (uint64_t)st->codec->extradata_size + atom.size + 8 + FF_INPUT_BUFFER_PADDING_SIZE;\n\n if (size > INT_MAX || (uint64_t)atom.size > INT_MAX)\n\n return AVERROR_INVALIDDATA;\n\n if ((err = av_reallocp(&st->codec->extradata, size)) < 0) {\n\n st->codec->extradata_size = 0;\n\n return err;\n\n }\n\n buf = st->codec->extradata + st->codec->extradata_size;\n\n st->codec->extradata_size= size - FF_INPUT_BUFFER_PADDING_SIZE;\n\n AV_WB32( buf , atom.size + 8);\n\n AV_WL32( buf + 4, atom.type);\n\n avio_read(pb, buf + 8, atom.size);\n\n return 0;\n\n}\n"}} {"sample_id": "b6fcf32d9b851a83dedcb609091236b97cc4a985_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n visit_type_UserDefNestedList(v, (UserDefNestedList **)native, NULL, errp);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void visit_nested_struct_list(Visitor *v, void **native, Error **errp)\n\n{\n\n visit_type_UserDefNestedList(v, (UserDefNestedList **)native, NULL, errp);\n\n}\n"}} {"sample_id": "a0c624e299730c8c5800375c2f5f3c6c200053ff_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,16 +1,16 @@\n static void v4l2_free_buffer(void *opaque, uint8_t *unused)\n \n {\n+\n+ V4L2Buffer* avbuf = opaque;\n+\n V4L2m2mContext *s = buf_to_m2mctx(avbuf);\n \n+\n+\n atomic_fetch_sub_explicit(&s->refcount, 1, memory_order_acq_rel);\n \n+ if (s->reinit) {\n \n if (!atomic_load(&s->refcount))\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void v4l2_free_buffer(void *opaque, uint8_t *unused)\n\n{\n\n V4L2Buffer* avbuf = opaque;\n\n V4L2m2mContext *s = buf_to_m2mctx(avbuf);\n\n\n\n atomic_fetch_sub_explicit(&s->refcount, 1, memory_order_acq_rel);\n\n if (s->reinit) {\n\n if (!atomic_load(&s->refcount))\n\n sem_post(&s->refsync);\n\n return;\n\n }\n\n\n\n if (avbuf->context->streamon) {\n\n ff_v4l2_buffer_enqueue(avbuf);\n\n return;\n\n }\n\n\n\n if (!atomic_load(&s->refcount))\n\n ff_v4l2_m2m_codec_end(s->avctx);\n\n}\n"}} {"sample_id": "12d69ac03b45156356b240424623719f15d8143e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n \n aio_set_event_notifier(ctx, &data.e, NULL);\n \n+ g_assert(!aio_poll(ctx, false));\n+\n+ g_assert_cmpint(data.n, ==, 1);\n+\n+\n \n event_notifier_cleanup(&data.e);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_wait_event_notifier(void)\n\n{\n\n EventNotifierTestData data = { .n = 0, .active = 1 };\n\n event_notifier_init(&data.e, false);\n\n aio_set_event_notifier(ctx, &data.e, event_ready_cb);\n\n g_assert(!aio_poll(ctx, false));\n\n g_assert_cmpint(data.n, ==, 0);\n\n g_assert_cmpint(data.active, ==, 1);\n\n\n\n event_notifier_set(&data.e);\n\n g_assert(aio_poll(ctx, false));\n\n g_assert_cmpint(data.n, ==, 1);\n\n g_assert_cmpint(data.active, ==, 0);\n\n\n\n g_assert(!aio_poll(ctx, false));\n\n g_assert_cmpint(data.n, ==, 1);\n\n g_assert_cmpint(data.active, ==, 0);\n\n\n\n aio_set_event_notifier(ctx, &data.e, NULL);\n\n g_assert(!aio_poll(ctx, false));\n\n g_assert_cmpint(data.n, ==, 1);\n\n\n\n event_notifier_cleanup(&data.e);\n\n}\n"}} {"sample_id": "a83000f5e3fac30a7f213af1ba6a8f827622854d_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,10 +26,10 @@\n \n /* Leak the table */\n \n+ }\n+\n+\n+\n+ return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int kvmppc_remove_spapr_tce(void *table, int fd, uint32_t window_size)\n\n{\n\n long len;\n\n\n\n if (fd < 0) {\n\n return -1;\n\n }\n\n\n\n len = (window_size / SPAPR_TCE_PAGE_SIZE)*sizeof(sPAPRTCE);\n\n if ((munmap(table, len) < 0) ||\n\n (close(fd) < 0)) {\n\n fprintf(stderr, \"KVM: Unexpected error removing TCE table: %s\",\n\n strerror(errno));\n\n /* Leak the table */\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "e3751aa6ec8147ab7ca2649d4daadf8d4dce27d5_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void do_hybrid_window(int order, int n, int non_rec, const float *in,\n+\n+ float *out, float *hist, float *out2,\n+\n+ const float *window)\n+\n {\n \n int i;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void do_hybrid_window(int order, int n, int non_rec, const float *in,\n\n float *out, float *hist, float *out2,\n\n const float *window)\n\n{\n\n int i;\n\n float buffer1[order + 1];\n\n float buffer2[order + 1];\n\n float work[order + n + non_rec];\n\n\n\n /* update history */\n\n memmove(hist, hist + n, (order + non_rec)*sizeof(*hist));\n\n\n\n for (i=0; i < n; i++)\n\n hist[order + non_rec + i] = in[n-i-1];\n\n\n\n colmult(work, window, hist, order + n + non_rec);\n\n\n\n convolve(buffer1, work + order , n , order);\n\n convolve(buffer2, work + order + n, non_rec, order);\n\n\n\n for (i=0; i <= order; i++) {\n\n out2[i] = out2[i] * 0.5625 + buffer1[i];\n\n out [i] = out2[i] + buffer2[i];\n\n }\n\n\n\n /* Multiply by the white noise correcting factor (WNCF) */\n\n *out *= 257./256.;\n\n}\n"}} {"sample_id": "53c05b1eacd5f7dbfa3651b45e797adaea0a5ff8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n MpegEncContext * const s = &h->s;\n \n+ const int mb_xy= s->mb_x + s->mb_y*s->mb_stride;\n+\n+ int n;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void write_back_non_zero_count(H264Context *h){\n\n MpegEncContext * const s = &h->s;\n\n const int mb_xy= s->mb_x + s->mb_y*s->mb_stride;\n\n int n;\n\n\n\n for( n = 0; n < 16+4+4; n++ )\n\n h->non_zero_count[mb_xy][n] = h->non_zero_count_cache[scan8[n]];\n\n}\n"}} {"sample_id": "0379f474ddebfc69f42fa8231d86687cf29d997b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n NBDExport *exp;\n \n \n+\n+ csock = client->sock;\n+\n+ if (length) {\n+\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int nbd_handle_list(NBDClient *client, uint32_t length)\n\n{\n\n int csock;\n\n NBDExport *exp;\n\n\n\n csock = client->sock;\n\n if (length) {\n\n\n\n\n return nbd_send_rep(csock, NBD_REP_ERR_INVALID, NBD_OPT_LIST);\n\n\n\n\n /* For each export, send a NBD_REP_SERVER reply. */\n\n QTAILQ_FOREACH(exp, &exports, next) {\n\n if (nbd_send_rep_list(csock, exp)) {\n\n return -EINVAL;\n\n\n\n /* Finish with a NBD_REP_ACK. */\n\n return nbd_send_rep(csock, NBD_REP_ACK, NBD_OPT_LIST);\n"}} {"sample_id": "4cbd6c41fa3aa901e12e8158e8d22dd8f70f7a90", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n if (!kvm_check_extension(kvm_state, KVM_CAP_IRQ_ROUTING)) {\n \n+ /* nothing to do */\n+\n+ return 0;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int kvm_s390_io_adapter_map(S390FLICState *fs, uint32_t id,\n\n uint64_t map_addr, bool do_map)\n\n{\n\n struct kvm_s390_io_adapter_req req = {\n\n .id = id,\n\n .type = do_map ? KVM_S390_IO_ADAPTER_MAP : KVM_S390_IO_ADAPTER_UNMAP,\n\n .addr = map_addr,\n\n };\n\n struct kvm_device_attr attr = {\n\n .group = KVM_DEV_FLIC_ADAPTER_MODIFY,\n\n .addr = (uint64_t)&req,\n\n };\n\n KVMS390FLICState *flic = KVM_S390_FLIC(fs);\n\n int r;\n\n\n\n if (!kvm_check_extension(kvm_state, KVM_CAP_IRQ_ROUTING)) {\n\n /* nothing to do */\n\n return 0;\n\n }\n\n\n\n r = ioctl(flic->fd, KVM_SET_DEVICE_ATTR, &attr);\n\n return r ? -errno : 0;\n\n}\n"}} {"sample_id": "341404f753fdbcddebb9fbce51f2ef057cceb79c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n VqaContext *s = avctx->priv_data;\n \n \n+\n+ av_free(s->codebook);\n+\n+ av_free(s->next_codebook_buffer);\n+\n av_free(s->decode_buffer);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int vqa_decode_end(AVCodecContext *avctx)\n\n{\n\n VqaContext *s = avctx->priv_data;\n\n\n\n av_free(s->codebook);\n\n av_free(s->next_codebook_buffer);\n\n av_free(s->decode_buffer);\n\n\n\n if (s->frame.data[0])\n\n avctx->release_buffer(avctx, &s->frame);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "515b69f8f8e9a24cfaee95d8c1f63f265d8582fe_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n int size = 16 >> i;\n \n for (j = 0; j < 16; j++)\n+\n+ if (check_func(tab[i][j], \"%s_h264_qpel_%d_mc%d%d_%d\", op_name, size, j & 3, j >> 2, bit_depth)) {\n+\n+ randomize_buffers();\n+\n call_ref(dst0, src0, (ptrdiff_t)size * SIZEOF_PIXEL);\n \n call_new(dst1, src1, (ptrdiff_t)size * SIZEOF_PIXEL);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void checkasm_check_h264qpel(void)\n\n{\n\n LOCAL_ALIGNED_16(uint8_t, buf0, [BUF_SIZE]);\n\n LOCAL_ALIGNED_16(uint8_t, buf1, [BUF_SIZE]);\n\n LOCAL_ALIGNED_16(uint8_t, dst0, [BUF_SIZE]);\n\n LOCAL_ALIGNED_16(uint8_t, dst1, [BUF_SIZE]);\n\n H264QpelContext h;\n\n int op, bit_depth, i, j;\n\n\n\n for (op = 0; op < 2; op++) {\n\n qpel_mc_func (*tab)[16] = op ? h.avg_h264_qpel_pixels_tab : h.put_h264_qpel_pixels_tab;\n\n const char *op_name = op ? \"avg\" : \"put\";\n\n\n\n for (bit_depth = 8; bit_depth <= 10; bit_depth++) {\n\n ff_h264qpel_init(&h, bit_depth);\n\n for (i = 0; i < (op ? 3 : 4); i++) {\n\n int size = 16 >> i;\n\n for (j = 0; j < 16; j++)\n\n if (check_func(tab[i][j], \"%s_h264_qpel_%d_mc%d%d_%d\", op_name, size, j & 3, j >> 2, bit_depth)) {\n\n randomize_buffers();\n\n call_ref(dst0, src0, (ptrdiff_t)size * SIZEOF_PIXEL);\n\n call_new(dst1, src1, (ptrdiff_t)size * SIZEOF_PIXEL);\n\n if (memcmp(buf0, buf1, BUF_SIZE) || memcmp(dst0, dst1, BUF_SIZE))\n\n fail();\n\n bench_new(dst1, src1, (ptrdiff_t)size * SIZEOF_PIXEL);\n\n }\n\n }\n\n }\n\n report(\"%s\", op_name);\n\n }\n\n}\n"}} {"sample_id": "45b7bd7c53b41bc5ff6fc2158831f2b1b1256113", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+int ff_h264_check_intra_pred_mode(H264Context *h, int mode){\n \n MpegEncContext * const s = &h->s;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int ff_h264_check_intra_pred_mode(H264Context *h, int mode){\n\n MpegEncContext * const s = &h->s;\n\n static const int8_t top [7]= {LEFT_DC_PRED8x8, 1,-1,-1};\n\n static const int8_t left[7]= { TOP_DC_PRED8x8,-1, 2,-1,DC_128_PRED8x8};\n\n\n\n if(mode > 6U) {\n\n av_log(h->s.avctx, AV_LOG_ERROR, \"out of range intra chroma pred mode at %d %d\\n\", s->mb_x, s->mb_y);\n\n return -1;\n\n }\n\n\n\n if(!(h->top_samples_available&0x8000)){\n\n mode= top[ mode ];\n\n if(mode<0){\n\n av_log(h->s.avctx, AV_LOG_ERROR, \"top block unavailable for requested intra mode at %d %d\\n\", s->mb_x, s->mb_y);\n\n return -1;\n\n }\n\n }\n\n\n\n if((h->left_samples_available&0x8080) != 0x8080){\n\n mode= left[ mode ];\n\n if(h->left_samples_available&0x8080){ //mad cow disease mode, aka MBAFF + constrained_intra_pred\n\n mode= ALZHEIMER_DC_L0T_PRED8x8 + (!(h->left_samples_available&0x8000)) + 2*(mode == DC_128_PRED8x8);\n\n }\n\n if(mode<0){\n\n av_log(h->s.avctx, AV_LOG_ERROR, \"left block unavailable for requested intra mode at %d %d\\n\", s->mb_x, s->mb_y);\n\n return -1;\n\n }\n\n }\n\n\n\n return mode;\n\n}\n"}} {"sample_id": "ea375f9ab8c76686dca0af8cb4f87a4eb569cad3_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,7 +20,7 @@\n len = strlen(se->idstr);\n qemu_put_byte(f, len);\n qemu_put_buffer(f, (uint8_t *)se->idstr, len);\n+ qemu_put_be32(f, se->instance_id);\n qemu_put_be32(f, se->version_id);\n vmstate_save(f, se);\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int qemu_savevm_state_complete(Monitor *mon, QEMUFile *f)\n{\n SaveStateEntry *se;\n QTAILQ_FOREACH(se, &savevm_handlers, entry) {\n if (se->save_live_state == NULL)\n continue;\n /* Section type */\n qemu_put_byte(f, QEMU_VM_SECTION_END);\n qemu_put_be32(f, se->section_id);\n se->save_live_state(mon, f, QEMU_VM_SECTION_END, se->opaque);\n }\n QTAILQ_FOREACH(se, &savevm_handlers, entry) {\n int len;\n\tif (se->save_state == NULL && se->vmsd == NULL)\n\t continue;\n /* Section type */\n qemu_put_byte(f, QEMU_VM_SECTION_FULL);\n qemu_put_be32(f, se->section_id);\n /* ID string */\n len = strlen(se->idstr);\n qemu_put_byte(f, len);\n qemu_put_buffer(f, (uint8_t *)se->idstr, len);\n qemu_put_be32(f, se->instance_id);\n qemu_put_be32(f, se->version_id);\n vmstate_save(f, se);\n }\n qemu_put_byte(f, QEMU_VM_EOF);\n if (qemu_file_has_error(f))\n return -EIO;\n return 0;\n}"}} {"sample_id": "8caff63699a9bd6b82556bd527ff023c443ada2d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n /* setup pci memory mapping */\n \n+ pc_pci_as_mapping_init(OBJECT(mch), mch->system_memory,\n \n mch->pci_address_space);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void mch_realize(PCIDevice *d, Error **errp)\n\n{\n\n int i;\n\n MCHPCIState *mch = MCH_PCI_DEVICE(d);\n\n\n\n /* setup pci memory mapping */\n\n pc_pci_as_mapping_init(OBJECT(mch), mch->system_memory,\n\n mch->pci_address_space);\n\n\n\n /* smram */\n\n cpu_smm_register(&mch_set_smm, mch);\n\n memory_region_init_alias(&mch->smram_region, OBJECT(mch), \"smram-region\",\n\n mch->pci_address_space, 0xa0000, 0x20000);\n\n memory_region_add_subregion_overlap(mch->system_memory, 0xa0000,\n\n &mch->smram_region, 1);\n\n memory_region_set_enabled(&mch->smram_region, false);\n\n init_pam(DEVICE(mch), mch->ram_memory, mch->system_memory,\n\n mch->pci_address_space, &mch->pam_regions[0],\n\n PAM_BIOS_BASE, PAM_BIOS_SIZE);\n\n for (i = 0; i < 12; ++i) {\n\n init_pam(DEVICE(mch), mch->ram_memory, mch->system_memory,\n\n mch->pci_address_space, &mch->pam_regions[i+1],\n\n PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE);\n\n }\n\n /* Intel IOMMU (VT-d) */\n\n if (qemu_opt_get_bool(qemu_get_machine_opts(), \"iommu\", false)) {\n\n mch_init_dmar(mch);\n\n }\n\n}\n"}} {"sample_id": "a0fa2cb8ccf0b73cfd3ac01d557401a2303c0de4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n \n \n r = sclp_service_call(sccb, code);\n+\n+ if (r < 0) {\n+\n+ enter_pgmcheck(cpu, -r);\n+\n }\n \n setcc(cpu, r);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int kvm_sclp_service_call(S390CPU *cpu, struct kvm_run *run,\n\n uint16_t ipbh0)\n\n{\n\n CPUS390XState *env = &cpu->env;\n\n uint32_t sccb;\n\n uint64_t code;\n\n int r = 0;\n\n\n\n cpu_synchronize_state(CPU(cpu));\n\n if (env->psw.mask & PSW_MASK_PSTATE) {\n\n enter_pgmcheck(cpu, PGM_PRIVILEGED);\n\n return 0;\n\n }\n\n sccb = env->regs[ipbh0 & 0xf];\n\n code = env->regs[(ipbh0 & 0xf0) >> 4];\n\n\n\n r = sclp_service_call(sccb, code);\n\n if (r < 0) {\n\n enter_pgmcheck(cpu, -r);\n\n }\n\n setcc(cpu, r);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "feeee5aca765606818e00f5a19d19f141f4ae365_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static int bdrv_has_snapshot(BlockDriverState *bs)\n+\n {\n \n return (bs &&", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int bdrv_has_snapshot(BlockDriverState *bs)\n\n{\n\n return (bs &&\n\n !bdrv_is_removable(bs) &&\n\n !bdrv_is_read_only(bs));\n\n}\n"}} {"sample_id": "636ced8e1dc8248a1353b416240b93d70ad03edb_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ char sdp[16384];\n \n int i;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void print_sdp(void)\n\n{\n\n char sdp[16384];\n\n int i;\n\n AVFormatContext **avc = av_malloc(sizeof(*avc) * nb_output_files);\n\n\n\n if (!avc)\n\n exit(1);\n\n for (i = 0; i < nb_output_files; i++)\n\n avc[i] = output_files[i]->ctx;\n\n\n\n av_sdp_create(avc, nb_output_files, sdp, sizeof(sdp));\n\n printf(\"SDP:\\n%s\\n\", sdp);\n\n fflush(stdout);\n\n av_freep(&avc);\n\n}\n"}} {"sample_id": "9c7d64eb2a47033c9697fb4a5a540af1aa3915ab", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n uint32_t hash;\n \n int32_t val;\n+\n+\n+\n+ val = i;\n+\n hash = i;\n \n p = qht_lookup(&ht, is_equal, &val, hash);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void check(int a, int b, bool expected)\n\n{\n\n struct qht_stats stats;\n\n int i;\n\n\n\n\n for (i = a; i < b; i++) {\n\n void *p;\n\n uint32_t hash;\n\n int32_t val;\n\n\n\n val = i;\n\n hash = i;\n\n p = qht_lookup(&ht, is_equal, &val, hash);\n\n g_assert_true(!!p == expected);\n\n }\n\n rcu_read_unlock();\n\n\n\n qht_statistics_init(&ht, &stats);\n\n if (stats.used_head_buckets) {\n\n g_assert_cmpfloat(qdist_avg(&stats.chain), >=, 1.0);\n\n }\n\n g_assert_cmpuint(stats.head_buckets, >, 0);\n\n qht_statistics_destroy(&stats);\n\n}"}} {"sample_id": "69dde1ad36b7d95b8b9268f414aa6c076212ed41", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n put_tag(pb, \"ftyp\");\n \n \n+\n+ if (!strcmp(\"3gp\", s->oformat->name))\n+\n+ put_tag(pb, \"3gp4\");\n+\n else\n \n put_tag(pb, \"isom\");", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int mov_write_ftyp_tag(ByteIOContext *pb, AVFormatContext *s)\n\n{\n\n put_be32(pb, 0x14 ); /* size */\n\n put_tag(pb, \"ftyp\");\n\n\n\n if (!strcmp(\"3gp\", s->oformat->name))\n\n put_tag(pb, \"3gp4\");\n\n else\n\n put_tag(pb, \"isom\");\n\n\n\n put_be32(pb, 0x200 );\n\n\n\n if (!strcmp(\"3gp\", s->oformat->name))\n\n put_tag(pb, \"3gp4\");\n\n else\n\n put_tag(pb, \"mp41\");\n\n\n\n return 0x14;\n\n}\n"}} {"sample_id": "edcc51fb8e15b704955d742559215697598927bb_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int add_doubles_metadata(int count,\n \n const char *name, const char *sep,\n \n@@ -11,7 +11,7 @@\n int i;\n \n double *dp;\n+\n \n \n if (count >= INT_MAX / sizeof(int64_t) || count <= 0)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int add_doubles_metadata(int count,\n\n const char *name, const char *sep,\n\n TiffContext *s)\n\n{\n\n char *ap;\n\n int i;\n\n double *dp;\n\n\n\n if (count >= INT_MAX / sizeof(int64_t) || count <= 0)\n\n return AVERROR_INVALIDDATA;\n\n if (bytestream2_get_bytes_left(&s->gb) < count * sizeof(int64_t))\n\n return AVERROR_INVALIDDATA;\n\n\n\n dp = av_malloc(count * sizeof(double));\n\n if (!dp)\n\n return AVERROR(ENOMEM);\n\n\n\n for (i = 0; i < count; i++)\n\n dp[i] = tget_double(&s->gb, s->le);\n\n ap = doubles2str(dp, count, sep);\n\n av_freep(&dp);\n\n if (!ap)\n\n return AVERROR(ENOMEM);\n\n av_dict_set(avpriv_frame_get_metadatap(&s->picture), name, ap, AV_DICT_DONT_STRDUP_VAL);\n\n return 0;\n\n}\n"}} {"sample_id": "c52ab08aee6f7d4717fc6b517174043126bd302f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void gen_eob(DisasContext *s)\n \n {\n+\n gen_eob_inhibit_irq(s, false);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gen_eob(DisasContext *s)\n\n{\n\n gen_eob_inhibit_irq(s, false);\n\n}\n"}} {"sample_id": "242acf3af4605adce933906bdc053b2414181ec7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n saddr.sin_addr.s_addr = so->so_faddr.s_addr;\n \n }\n+\n+ daddr.sin_addr = so->so_laddr;\n+\n+ daddr.sin_port = so->so_lport;\n+\n \n \n return udp_output2(so, m, &saddr, &daddr, so->so_iptos);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int udp_output(struct socket *so, struct mbuf *m,\n\n struct sockaddr_in *addr)\n\n\n\n{\n\n struct sockaddr_in saddr, daddr;\n\n\n\n saddr = *addr;\n\n if ((so->so_faddr.s_addr & htonl(0xffffff00)) == special_addr.s_addr) {\n\n if ((so->so_faddr.s_addr & htonl(0x000000ff)) == htonl(0xff))\n\n saddr.sin_addr.s_addr = alias_addr.s_addr;\n\n else if (addr->sin_addr.s_addr == loopback_addr.s_addr ||\n\n ((so->so_faddr.s_addr & htonl(CTL_DNS)) == htonl(CTL_DNS)))\n\n saddr.sin_addr.s_addr = so->so_faddr.s_addr;\n\n }\n\n daddr.sin_addr = so->so_laddr;\n\n daddr.sin_port = so->so_lport;\n\n\n\n return udp_output2(so, m, &saddr, &daddr, so->so_iptos);\n\n}\n"}} {"sample_id": "2374e73edafff0586cbfb67c333c5a7588f81fd5_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void helper_restore_mode (void)\n \n+{\n \n env->ps = (env->ps & ~0xC) | env->saved_mode;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void helper_restore_mode (void)\n\n{\n\n env->ps = (env->ps & ~0xC) | env->saved_mode;\n\n}\n"}} {"sample_id": "cece491daa9f4c7c908e016f4e285a49d37cb17c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n \n \n+ if (BITS_LEFT(length,gb) < 16)\n+\n+ return;\n+\n+ level = qdm2_get_vlc(gb, &vlc_tab_level, 0, 2);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void init_quantized_coeffs_elem0 (int8_t *quantized_coeffs, GetBitContext *gb, int length)\n\n{\n\n int i, k, run, level, diff;\n\n\n\n if (BITS_LEFT(length,gb) < 16)\n\n return;\n\n level = qdm2_get_vlc(gb, &vlc_tab_level, 0, 2);\n\n\n\n quantized_coeffs[0] = level;\n\n\n\n for (i = 0; i < 7; ) {\n\n if (BITS_LEFT(length,gb) < 16)\n\n break;\n\n run = qdm2_get_vlc(gb, &vlc_tab_run, 0, 1) + 1;\n\n\n\n if (BITS_LEFT(length,gb) < 16)\n\n break;\n\n diff = qdm2_get_se_vlc(&vlc_tab_diff, gb, 2);\n\n\n\n for (k = 1; k <= run; k++)\n\n quantized_coeffs[i + k] = (level + ((k * diff) / run));\n\n\n\n level += diff;\n\n i += run;\n\n }\n\n}\n"}} {"sample_id": "d6af26c55c1ea30f85a7d9edbc373f53be1743ee", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static inline int get_len(LZOContext *c, int x, int mask)\n \n {\n+\n int cnt = x & mask;\n \n if (!cnt) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static inline int get_len(LZOContext *c, int x, int mask)\n\n{\n\n int cnt = x & mask;\n\n if (!cnt) {\n\n while (!(x = get_byte(c)))\n\n cnt += 255;\n\n cnt += mask + x;\n\n }\n\n return cnt;\n\n}\n"}} {"sample_id": "220b24c7c97dc033ceab1510549f66d0e7b52ef1_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void libschroedinger_decode_frame_free(void *frame)\n+\n {\n \n schro_frame_unref(frame);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void libschroedinger_decode_frame_free(void *frame)\n\n{\n\n schro_frame_unref(frame);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n lan9118_writew(opaque, offset, (uint32_t)val);\n \n+ return;\n+\n+ case 4:\n+\n+ lan9118_writel(opaque, offset, val, size);\n \n return;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void lan9118_16bit_mode_write(void *opaque, target_phys_addr_t offset,\n\n uint64_t val, unsigned size)\n\n{\n\n switch (size) {\n\n case 2:\n\n lan9118_writew(opaque, offset, (uint32_t)val);\n\n return;\n\n case 4:\n\n lan9118_writel(opaque, offset, val, size);\n\n return;\n\n }\n\n\n\n hw_error(\"lan9118_write: Bad size 0x%x\\n\", size);\n\n}\n"}} {"sample_id": "f06ee3d4aa547df8d7d2317b2b6db7a88c1f3744_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,7 +18,7 @@\n \n */\n \n+ if (s->bs->backing_hd) {\n \n int64_t l = bdrv_getlength(s->bs->backing_hd);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void qed_read_backing_file(BDRVQEDState *s, uint64_t pos,\n\n QEMUIOVector *qiov,\n\n BlockDriverCompletionFunc *cb, void *opaque)\n\n{\n\n uint64_t backing_length = 0;\n\n size_t size;\n\n\n\n /* If there is a backing file, get its length. Treat the absence of a\n\n * backing file like a zero length backing file.\n\n */\n\n if (s->bs->backing_hd) {\n\n int64_t l = bdrv_getlength(s->bs->backing_hd);\n\n if (l < 0) {\n\n cb(opaque, l);\n\n return;\n\n }\n\n backing_length = l;\n\n }\n\n\n\n /* Zero all sectors if reading beyond the end of the backing file */\n\n if (pos >= backing_length ||\n\n pos + qiov->size > backing_length) {\n\n qemu_iovec_memset(qiov, 0, 0, qiov->size);\n\n }\n\n\n\n /* Complete now if there are no backing file sectors to read */\n\n if (pos >= backing_length) {\n\n cb(opaque, 0);\n\n return;\n\n }\n\n\n\n /* If the read straddles the end of the backing file, shorten it */\n\n size = MIN((uint64_t)backing_length - pos, qiov->size);\n\n\n\n BLKDBG_EVENT(s->bs->file, BLKDBG_READ_BACKING_AIO);\n\n bdrv_aio_readv(s->bs->backing_hd, pos / BDRV_SECTOR_SIZE,\n\n qiov, size / BDRV_SECTOR_SIZE, cb, opaque);\n\n}\n"}} {"sample_id": "82a1d575757d5bc9b0b218fe89c77f8de06a7d39", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,9 +16,9 @@\n \n \n \n+ for(i = 0; i < 256; i++)\n+\n+ nodes[i].count = bytestream_get_le32(&src);\n \n size -= 1024;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int fraps2_decode_plane(FrapsContext *s, uint8_t *dst, int stride, int w,\n\n int h, const uint8_t *src, int size, int Uoff,\n\n const int step)\n\n{\n\n int i, j;\n\n GetBitContext gb;\n\n VLC vlc;\n\n Node nodes[512];\n\n\n\n for(i = 0; i < 256; i++)\n\n nodes[i].count = bytestream_get_le32(&src);\n\n size -= 1024;\n\n if (ff_huff_build_tree(s->avctx, &vlc, 256, nodes, huff_cmp,\n\n FF_HUFFMAN_FLAG_ZERO_COUNT) < 0)\n\n return -1;\n\n /* we have built Huffman table and are ready to decode plane */\n\n\n\n /* convert bits so they may be used by standard bitreader */\n\n s->dsp.bswap_buf((uint32_t *)s->tmpbuf, (const uint32_t *)src, size >> 2);\n\n\n\n init_get_bits(&gb, s->tmpbuf, size * 8);\n\n for(j = 0; j < h; j++){\n\n for(i = 0; i < w*step; i += step){\n\n dst[i] = get_vlc2(&gb, vlc.table, 9, 3);\n\n /* lines are stored as deltas between previous lines\n\n * and we need to add 0x80 to the first lines of chroma planes\n\n */\n\n if(j) dst[i] += dst[i - stride];\n\n else if(Uoff) dst[i] += 0x80;\n\n }\n\n dst += stride;\n\n if(get_bits_left(&gb) < 0){\n\n free_vlc(&vlc);\n\n return -1;\n\n }\n\n }\n\n free_vlc(&vlc);\n\n return 0;\n\n}\n"}} {"sample_id": "375092332eeaa6e47561ce47fd36144cdaf964d0_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static ssize_t test_block_write_func(QCryptoBlock *block,\n \n+ size_t offset,\n+\n+ const uint8_t *buf,\n+\n+ size_t buflen,\n \n Error **errp,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ssize_t test_block_write_func(QCryptoBlock *block,\n\n size_t offset,\n\n const uint8_t *buf,\n\n size_t buflen,\n\n Error **errp,\n\n void *opaque)\n\n{\n\n Buffer *header = opaque;\n\n\n\n g_assert_cmpint(buflen + offset, <=, header->capacity);\n\n\n\n memcpy(header->buffer + offset, buf, buflen);\n\n header->offset = offset + buflen;\n\n\n\n return buflen;\n\n}\n"}} {"sample_id": "2caf19e90f270abe1e80a3e85acaf0eb5c9d0aac_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void FUNCC(pred4x4_127_dc)(uint8_t *_src, const uint8_t *topright, int _stride){\n \n pixel *src = (pixel*)_src;\n+\n int stride = _stride/sizeof(pixel);\n \n ((pixel4*)(src+0*stride))[0]=", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void FUNCC(pred4x4_127_dc)(uint8_t *_src, const uint8_t *topright, int _stride){\n\n pixel *src = (pixel*)_src;\n\n int stride = _stride/sizeof(pixel);\n\n ((pixel4*)(src+0*stride))[0]=\n\n ((pixel4*)(src+1*stride))[0]=\n\n ((pixel4*)(src+2*stride))[0]=\n\n ((pixel4*)(src+3*stride))[0]= PIXEL_SPLAT_X4((1<<(BIT_DEPTH-1))-1);\n\n}\n"}} {"sample_id": "f090c9d4ad5812fb92843d6470a1111c15190c4c_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n flag zSign;\n+\n+\n+\n+ if ( a == 0 ) return 0;\n+\n if ( a == (sbits64) LIT64( 0x8000000000000000 ) ) {\n \n return packFloat64( 1, 0x43E, 0 );", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "float64 int64_to_float64( int64 a STATUS_PARAM )\n\n{\n\n flag zSign;\n\n\n\n if ( a == 0 ) return 0;\n\n if ( a == (sbits64) LIT64( 0x8000000000000000 ) ) {\n\n return packFloat64( 1, 0x43E, 0 );\n\n }\n\n zSign = ( a < 0 );\n\n return normalizeRoundAndPackFloat64( zSign, 0x43C, zSign ? - a : a STATUS_VAR );\n\n\n\n}\n"}} {"sample_id": "0752706de257b38763006ff5bb6b39a97e669ba2_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n+void net_slirp_smb(const char *exported_dir)\n \n {\n \n+ struct in_addr vserver_addr = { .s_addr = 0 };\n \n \n \n+ if (legacy_smb_export) {\n \n fprintf(stderr, \"-smb given twice\\n\");\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void net_slirp_smb(const char *exported_dir)\n\n{\n\n struct in_addr vserver_addr = { .s_addr = 0 };\n\n\n\n if (legacy_smb_export) {\n\n fprintf(stderr, \"-smb given twice\\n\");\n\n exit(1);\n\n }\n\n legacy_smb_export = exported_dir;\n\n if (!QTAILQ_EMPTY(&slirp_stacks)) {\n\n slirp_smb(QTAILQ_FIRST(&slirp_stacks), NULL, exported_dir,\n\n vserver_addr);\n\n }\n\n}\n"}} {"sample_id": "9ef91a677110ec200d7b2904fc4bcae5a77329ad_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n \n \n if (posix_aio_state)\n+\n+ return 0;\n+\n+\n+\n s = qemu_malloc(sizeof(PosixAioState));\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int posix_aio_init(void)\n\n{\n\n struct sigaction act;\n\n PosixAioState *s;\n\n int fds[2];\n\n struct qemu_paioinit ai;\n\n \n\n if (posix_aio_state)\n\n return 0;\n\n\n\n s = qemu_malloc(sizeof(PosixAioState));\n\n\n\n sigfillset(&act.sa_mask);\n\n act.sa_flags = 0; /* do not restart syscalls to interrupt select() */\n\n act.sa_handler = aio_signal_handler;\n\n sigaction(SIGUSR2, &act, NULL);\n\n\n\n s->first_aio = NULL;\n\n if (pipe(fds) == -1) {\n\n fprintf(stderr, \"failed to create pipe\\n\");\n\n return -errno;\n\n }\n\n\n\n s->rfd = fds[0];\n\n s->wfd = fds[1];\n\n\n\n fcntl(s->rfd, F_SETFL, O_NONBLOCK);\n\n fcntl(s->wfd, F_SETFL, O_NONBLOCK);\n\n\n\n qemu_aio_set_fd_handler(s->rfd, posix_aio_read, NULL, posix_aio_flush, s);\n\n\n\n memset(&ai, 0, sizeof(ai));\n\n ai.aio_threads = 64;\n\n ai.aio_num = 64;\n\n qemu_paio_init(&ai);\n\n\n\n posix_aio_state = s;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "3facfc99daecd10c2b87761d111d4dee1e3736b7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -41,11 +41,11 @@\n s->vp8dsp.vp8_h_loop_filter16_inner(dst[0]+12, s->linesize, bedge_lim, inner_limit, hev_thresh);\n \n s->vp8dsp.vp8_h_loop_filter8_inner (dst[1]+ 4, s->uvlinesize, bedge_lim, inner_limit, hev_thresh);\n+\n+ s->vp8dsp.vp8_h_loop_filter8_inner (dst[2]+ 4, s->uvlinesize, bedge_lim, inner_limit, hev_thresh);\n+\n+ }\n+\n \n \n if (mb_y) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void filter_mb(VP8Context *s, uint8_t *dst[3], VP8Macroblock *mb, int mb_x, int mb_y)\n\n{\n\n int filter_level, inner_limit, hev_thresh, mbedge_lim, bedge_lim;\n\n\n\n filter_level_for_mb(s, mb, &filter_level, &inner_limit, &hev_thresh);\n\n if (!filter_level)\n\n return;\n\n\n\n mbedge_lim = 2*(filter_level+2) + inner_limit;\n\n bedge_lim = 2* filter_level + inner_limit;\n\n\n\n if (mb_x) {\n\n s->vp8dsp.vp8_h_loop_filter16(dst[0], s->linesize, mbedge_lim, inner_limit, hev_thresh);\n\n s->vp8dsp.vp8_h_loop_filter8 (dst[1], s->uvlinesize, mbedge_lim, inner_limit, hev_thresh);\n\n s->vp8dsp.vp8_h_loop_filter8 (dst[2], s->uvlinesize, mbedge_lim, inner_limit, hev_thresh);\n\n }\n\n\n\n if (!mb->skip || mb->mode == MODE_I4x4 || mb->mode == VP8_MVMODE_SPLIT) {\n\n s->vp8dsp.vp8_h_loop_filter16_inner(dst[0]+ 4, s->linesize, bedge_lim, inner_limit, hev_thresh);\n\n s->vp8dsp.vp8_h_loop_filter16_inner(dst[0]+ 8, s->linesize, bedge_lim, inner_limit, hev_thresh);\n\n s->vp8dsp.vp8_h_loop_filter16_inner(dst[0]+12, s->linesize, bedge_lim, inner_limit, hev_thresh);\n\n s->vp8dsp.vp8_h_loop_filter8_inner (dst[1]+ 4, s->uvlinesize, bedge_lim, inner_limit, hev_thresh);\n\n s->vp8dsp.vp8_h_loop_filter8_inner (dst[2]+ 4, s->uvlinesize, bedge_lim, inner_limit, hev_thresh);\n\n }\n\n\n\n if (mb_y) {\n\n s->vp8dsp.vp8_v_loop_filter16(dst[0], s->linesize, mbedge_lim, inner_limit, hev_thresh);\n\n s->vp8dsp.vp8_v_loop_filter8 (dst[1], s->uvlinesize, mbedge_lim, inner_limit, hev_thresh);\n\n s->vp8dsp.vp8_v_loop_filter8 (dst[2], s->uvlinesize, mbedge_lim, inner_limit, hev_thresh);\n\n }\n\n\n\n if (!mb->skip || mb->mode == MODE_I4x4 || mb->mode == VP8_MVMODE_SPLIT) {\n\n s->vp8dsp.vp8_v_loop_filter16_inner(dst[0]+ 4*s->linesize, s->linesize, bedge_lim, inner_limit, hev_thresh);\n\n s->vp8dsp.vp8_v_loop_filter16_inner(dst[0]+ 8*s->linesize, s->linesize, bedge_lim, inner_limit, hev_thresh);\n\n s->vp8dsp.vp8_v_loop_filter16_inner(dst[0]+12*s->linesize, s->linesize, bedge_lim, inner_limit, hev_thresh);\n\n s->vp8dsp.vp8_v_loop_filter8_inner (dst[1]+ 4*s->uvlinesize, s->uvlinesize, bedge_lim, inner_limit, hev_thresh);\n\n s->vp8dsp.vp8_v_loop_filter8_inner (dst[2]+ 4*s->uvlinesize, s->uvlinesize, bedge_lim, inner_limit, hev_thresh);\n\n }\n\n}\n"}} {"sample_id": "01ecb7172b684f1c4b3e748f95c5a9a494ca36ec_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static float get_band_cost_ZERO_mips(struct AACEncContext *s,\n \n PutBitContext *pb, const float *in,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static float get_band_cost_ZERO_mips(struct AACEncContext *s,\n\n PutBitContext *pb, const float *in,\n\n const float *scaled, int size, int scale_idx,\n\n int cb, const float lambda, const float uplim,\n\n int *bits)\n\n{\n\n int i;\n\n float cost = 0;\n\n\n\n for (i = 0; i < size; i += 4) {\n\n cost += in[i ] * in[i ];\n\n cost += in[i+1] * in[i+1];\n\n cost += in[i+2] * in[i+2];\n\n cost += in[i+3] * in[i+3];\n\n }\n\n if (bits)\n\n *bits = 0;\n\n return cost * lambda;\n\n}\n"}} {"sample_id": "92f2b88cea48c6aeba8de568a45f2ed958f3c298", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n {\n int w;\n if (blit_is_unsafe(s, true)) {\n+ return 0;\n+ }\n+ s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC;\n+ s->cirrus_srcptr = &s->cirrus_bltbuf[0];\n+ s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];\n if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {\n \tif (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {\n \t s->cirrus_blt_srcpitch = 8;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int cirrus_bitblt_cputovideo(CirrusVGAState * s)\n{\n int w;\n if (blit_is_unsafe(s, true)) {\n return 0;\n }\n s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC;\n s->cirrus_srcptr = &s->cirrus_bltbuf[0];\n s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];\n if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {\n\tif (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {\n\t s->cirrus_blt_srcpitch = 8;\n\t} else {\n /* XXX: check for 24 bpp */\n\t s->cirrus_blt_srcpitch = 8 * 8 * s->cirrus_blt_pixelwidth;\n\t}\n\ts->cirrus_srccounter = s->cirrus_blt_srcpitch;\n } else {\n\tif (s->cirrus_blt_mode & CIRRUS_BLTMODE_COLOREXPAND) {\n w = s->cirrus_blt_width / s->cirrus_blt_pixelwidth;\n if (s->cirrus_blt_modeext & CIRRUS_BLTMODEEXT_DWORDGRANULARITY)\n s->cirrus_blt_srcpitch = ((w + 31) >> 5);\n else\n s->cirrus_blt_srcpitch = ((w + 7) >> 3);\n\t} else {\n /* always align input size to 32 bits */\n\t s->cirrus_blt_srcpitch = (s->cirrus_blt_width + 3) & ~3;\n\t}\n s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height;\n }\n s->cirrus_srcptr = s->cirrus_bltbuf;\n s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;\n cirrus_update_memory_access(s);\n return 1;\n}"}} {"sample_id": "80a5d05108cb218e8cd2e25c6621a3bfef0a832e_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -66,8 +66,8 @@\n \n vaapi_encode_mjpeg_init_tables(avctx);\n \n+\n+\n+ return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int vaapi_encode_mjpeg_init_internal(AVCodecContext *avctx)\n\n{\n\n static const VAConfigAttrib default_config_attributes[] = {\n\n { .type = VAConfigAttribRTFormat,\n\n .value = VA_RT_FORMAT_YUV420 },\n\n { .type = VAConfigAttribEncPackedHeaders,\n\n .value = VA_ENC_PACKED_HEADER_SEQUENCE },\n\n };\n\n\n\n VAAPIEncodeContext *ctx = avctx->priv_data;\n\n VAAPIEncodeMJPEGContext *priv = ctx->priv_data;\n\n int i;\n\n\n\n ctx->va_profile = VAProfileJPEGBaseline;\n\n ctx->va_entrypoint = VAEntrypointEncPicture;\n\n\n\n ctx->input_width = avctx->width;\n\n ctx->input_height = avctx->height;\n\n ctx->aligned_width = FFALIGN(ctx->input_width, 8);\n\n ctx->aligned_height = FFALIGN(ctx->input_height, 8);\n\n\n\n for (i = 0; i < FF_ARRAY_ELEMS(default_config_attributes); i++) {\n\n ctx->config_attributes[ctx->nb_config_attributes++] =\n\n default_config_attributes[i];\n\n }\n\n\n\n priv->quality = avctx->global_quality;\n\n if (priv->quality < 1 || priv->quality > 100) {\n\n av_log(avctx, AV_LOG_ERROR, \"Invalid quality value %d \"\n\n \"(must be 1-100).\\n\", priv->quality);\n\n return AVERROR(EINVAL);\n\n }\n\n\n\n vaapi_encode_mjpeg_init_tables(avctx);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d25a7dabf242163ce95b60f6f75cf017b1715d55_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void colo_old_packet_check_one_conn(void *opaque,\n+\n void *user_data)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void colo_old_packet_check_one_conn(void *opaque,\n\n void *user_data)\n\n{\n\n Connection *conn = opaque;\n\n GList *result = NULL;\n\n int64_t check_time = REGULAR_PACKET_CHECK_MS;\n\n\n\n result = g_queue_find_custom(&conn->primary_list,\n\n &check_time,\n\n (GCompareFunc)colo_old_packet_check_one);\n\n\n\n if (result) {\n\n /* do checkpoint will flush old packet */\n\n /* TODO: colo_notify_checkpoint();*/\n\n }\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_23", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ qemu_rec_mutex_unlock(&ctx->lock);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void aio_context_release(AioContext *ctx)\n\n{\n\n qemu_rec_mutex_unlock(&ctx->lock);\n\n}\n"}} {"sample_id": "1e7398a140f7a6bd9f5a438e7ad0f1ef50990e25_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+bool vhost_net_query(VHostNetState *net, VirtIODevice *dev)\n+\n {\n \n return false;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-89", "target_file": "source.c", "files": {"source.c": "bool vhost_net_query(VHostNetState *net, VirtIODevice *dev)\n\n{\n\n return false;\n\n}\n"}} {"sample_id": "1195fed9e6790bd8fd86b0dc33e2442d70355ac6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n uint32_t data = val & E1000_MDIC_DATA_MASK;\n \n+ uint32_t addr = ((val & E1000_MDIC_REG_MASK) >> E1000_MDIC_REG_SHIFT);\n+\n+\n+\n+ if ((val & E1000_MDIC_PHY_MASK) >> E1000_MDIC_PHY_SHIFT != 1) // phy #\n \n val = s->mac_reg[MDIC] | E1000_MDIC_ERROR;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "set_mdic(E1000State *s, int index, uint32_t val)\n\n{\n\n uint32_t data = val & E1000_MDIC_DATA_MASK;\n\n uint32_t addr = ((val & E1000_MDIC_REG_MASK) >> E1000_MDIC_REG_SHIFT);\n\n\n\n if ((val & E1000_MDIC_PHY_MASK) >> E1000_MDIC_PHY_SHIFT != 1) // phy #\n\n val = s->mac_reg[MDIC] | E1000_MDIC_ERROR;\n\n else if (val & E1000_MDIC_OP_READ) {\n\n DBGOUT(MDIC, \"MDIC read reg 0x%x\\n\", addr);\n\n if (!(phy_regcap[addr] & PHY_R)) {\n\n DBGOUT(MDIC, \"MDIC read reg %x unhandled\\n\", addr);\n\n val |= E1000_MDIC_ERROR;\n\n } else\n\n val = (val ^ data) | s->phy_reg[addr];\n\n } else if (val & E1000_MDIC_OP_WRITE) {\n\n DBGOUT(MDIC, \"MDIC write reg 0x%x, value 0x%x\\n\", addr, data);\n\n if (!(phy_regcap[addr] & PHY_W)) {\n\n DBGOUT(MDIC, \"MDIC write reg %x unhandled\\n\", addr);\n\n val |= E1000_MDIC_ERROR;\n\n } else {\n\n if (addr < NPHYWRITEOPS && phyreg_writeops[addr]) {\n\n phyreg_writeops[addr](s, index, data);\n\n }\n\n s->phy_reg[addr] = data;\n\n }\n\n }\n\n s->mac_reg[MDIC] = val | E1000_MDIC_READY;\n\n\n\n if (val & E1000_MDIC_INT_EN) {\n\n set_ics(s, 0, E1000_ICR_MDAC);\n\n }\n\n}\n"}} {"sample_id": "daa76aa416b1e18ab1fac650ff53d966d8f21f68_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n+void qemu_set_log_filename(const char *filename)\n \n {\n \n char *pidstr;\n \n+ g_free(logfilename);\n+\n \n \n pidstr = strstr(filename, \"%\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void qemu_set_log_filename(const char *filename)\n\n{\n\n char *pidstr;\n\n g_free(logfilename);\n\n\n\n pidstr = strstr(filename, \"%\");\n\n if (pidstr) {\n\n /* We only accept one %d, no other format strings */\n\n if (pidstr[1] != 'd' || strchr(pidstr + 2, '%')) {\n\n error_report(\"Bad logfile format: %s\", filename);\n\n logfilename = NULL;\n\n } else {\n\n logfilename = g_strdup_printf(filename, getpid());\n\n }\n\n } else {\n\n logfilename = g_strdup(filename);\n\n }\n\n qemu_log_close();\n\n qemu_set_log(qemu_loglevel);\n\n}\n"}} {"sample_id": "babf4fe01a808327d53977ba319c113a930180b1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void idr(H264Context *h){\n \n int i;\n+\n ff_h264_remove_all_refs(h);\n \n h->prev_frame_num= 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void idr(H264Context *h){\n\n int i;\n\n ff_h264_remove_all_refs(h);\n\n h->prev_frame_num= 0;\n\n h->prev_frame_num_offset= 0;\n\n h->prev_poc_msb=\n\n h->prev_poc_lsb= 0;\n\n for (i = 0; i < MAX_DELAYED_PIC_COUNT; i++)\n\n h->last_pocs[i] = INT_MIN;\n\n}\n"}} {"sample_id": "c4d9d19645a484298a67e9021060bc7c2b081d0f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void qemu_aio_wait_all(void)\n \n+{\n+\n while (qemu_aio_wait()) {\n \n /* Do nothing */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_aio_wait_all(void)\n\n{\n\n while (qemu_aio_wait()) {\n\n /* Do nothing */\n\n }\n\n}\n"}} {"sample_id": "0b8b8753e4d94901627b3e86431230f2319215c4_41", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void test_co_queue(void)\n \n {\n+\n+ Coroutine *c1;\n+\n Coroutine *c2;\n+\n \n \n c1 = qemu_coroutine_create(c1_fn);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void test_co_queue(void)\n\n{\n\n Coroutine *c1;\n\n Coroutine *c2;\n\n\n\n c1 = qemu_coroutine_create(c1_fn);\n\n c2 = qemu_coroutine_create(c2_fn);\n\n\n\n qemu_coroutine_enter(c1, c2);\n\n memset(c1, 0xff, sizeof(Coroutine));\n\n qemu_coroutine_enter(c2, NULL);\n\n}\n"}} {"sample_id": "1181d93231e9b807965724587d363c1cfd5a1d0d_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void ff_avg_h264_qpel16_mc31_msa(uint8_t *dst, const uint8_t *src,\n \n+ ptrdiff_t stride)\n+\n+{\n \n avc_luma_hv_qrt_and_aver_dst_16x16_msa(src - 2,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_avg_h264_qpel16_mc31_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n avc_luma_hv_qrt_and_aver_dst_16x16_msa(src - 2,\n\n src - (stride * 2) +\n\n sizeof(uint8_t), stride,\n\n dst, stride);\n\n}\n"}} {"sample_id": "7c5ce99bd92fb480b7235cbc9a005f7e6d31f1d7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n const int16_t **lumSrc, int lumFilterSize,\n \n+ const int16_t *chrFilter, const int16_t **chrUSrc,\n \n const int16_t **chrVSrc, int chrFilterSize,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "yuv2mono_X_c_template(SwsContext *c, const int16_t *lumFilter,\n\n const int16_t **lumSrc, int lumFilterSize,\n\n const int16_t *chrFilter, const int16_t **chrUSrc,\n\n const int16_t **chrVSrc, int chrFilterSize,\n\n const int16_t **alpSrc, uint8_t *dest, int dstW,\n\n int y, enum PixelFormat target)\n\n{\n\n const uint8_t * const d128=dither_8x8_220[y&7];\n\n uint8_t *g = c->table_gU[128] + c->table_gV[128];\n\n int i;\n\n int acc = 0;\n\n\n\n for (i = 0; i < dstW - 1; i += 2) {\n\n int j;\n\n int Y1 = 1 << 18;\n\n int Y2 = 1 << 18;\n\n\n\n for (j = 0; j < lumFilterSize; j++) {\n\n Y1 += lumSrc[j][i] * lumFilter[j];\n\n Y2 += lumSrc[j][i+1] * lumFilter[j];\n\n }\n\n Y1 >>= 19;\n\n Y2 >>= 19;\n\n if ((Y1 | Y2) & 0x100) {\n\n Y1 = av_clip_uint8(Y1);\n\n Y2 = av_clip_uint8(Y2);\n\n }\n\n acc += acc + g[Y1 + d128[(i + 0) & 7]];\n\n acc += acc + g[Y2 + d128[(i + 1) & 7]];\n\n if ((i & 7) == 6) {\n\n output_pixel(*dest++, acc);\n\n }\n\n }\n\n}\n"}} {"sample_id": "27c7ca9c12bb42d5c44d46f24cd970469d0ef55a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n ff_read_frame_flush(s);\n \n+\n+\n+ if (!state)\n+\n+ return;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_restore_parser_state(AVFormatContext *s, AVParserState *state)\n\n{\n\n int i;\n\n AVStream *st;\n\n AVParserStreamState *ss;\n\n ff_read_frame_flush(s);\n\n\n\n if (!state)\n\n return;\n\n\n\n avio_seek(s->pb, state->fpos, SEEK_SET);\n\n\n\n // copy context structures\n\n s->cur_st = state->cur_st;\n\n s->packet_buffer = state->packet_buffer;\n\n s->raw_packet_buffer = state->raw_packet_buffer;\n\n s->raw_packet_buffer_remaining_size = state->raw_packet_buffer_remaining_size;\n\n\n\n // copy stream structures\n\n for (i = 0; i < state->nb_streams; i++) {\n\n st = s->streams[i];\n\n ss = &state->stream_states[i];\n\n\n\n st->parser = ss->parser;\n\n st->last_IP_pts = ss->last_IP_pts;\n\n st->cur_dts = ss->cur_dts;\n\n st->reference_dts = ss->reference_dts;\n\n st->cur_ptr = ss->cur_ptr;\n\n st->cur_len = ss->cur_len;\n\n st->probe_packets = ss->probe_packets;\n\n st->cur_pkt = ss->cur_pkt;\n\n }\n\n\n\n av_free(state->stream_states);\n\n av_free(state);\n\n}\n"}} {"sample_id": "adb2a9b5d4d5170f0b58b9f92f816048f6b8932b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,7 +14,7 @@\n \n .offset_within_address_space = base,\n \n+ .size = TARGET_PAGE_SIZE,\n \n };\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void register_subpage(MemoryRegionSection *section)\n\n{\n\n subpage_t *subpage;\n\n target_phys_addr_t base = section->offset_within_address_space\n\n & TARGET_PAGE_MASK;\n\n MemoryRegionSection *existing = phys_page_find(base >> TARGET_PAGE_BITS);\n\n MemoryRegionSection subsection = {\n\n .offset_within_address_space = base,\n\n .size = TARGET_PAGE_SIZE,\n\n };\n\n target_phys_addr_t start, end;\n\n\n\n assert(existing->mr->subpage || existing->mr == &io_mem_unassigned);\n\n\n\n if (!(existing->mr->subpage)) {\n\n subpage = subpage_init(base);\n\n subsection.mr = &subpage->iomem;\n\n phys_page_set(base >> TARGET_PAGE_BITS, 1,\n\n phys_section_add(&subsection));\n\n } else {\n\n subpage = container_of(existing->mr, subpage_t, iomem);\n\n }\n\n start = section->offset_within_address_space & ~TARGET_PAGE_MASK;\n\n end = start + section->size;\n\n subpage_register(subpage, start, end, phys_section_add(section));\n\n}\n"}} {"sample_id": "9bd4a9f4eec8c8843b54126253bb9d77af95bbb3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -50,11 +50,11 @@\n \n av_freep(&st->codec->extradata);\n \n+ st->codec->extradata_size = 0;\n+\n+ st->codec->extradata = av_mallocz(strlen(buf) + FF_INPUT_BUFFER_PADDING_SIZE);\n+\n+ if (!st->codec->extradata)\n \n return AVERROR(ENOMEM);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mov_rewrite_dvd_sub_extradata(AVStream *st)\n\n{\n\n char pal_s[256];\n\n char buf[256];\n\n int pal_s_pos = 0;\n\n uint8_t *src = st->codec->extradata;\n\n int i;\n\n\n\n if (st->codec->extradata_size != 64)\n\n return 0;\n\n\n\n for (i = 0; i < 16; i++) {\n\n uint32_t yuv = AV_RB32(src + i * 4);\n\n uint32_t rgba = yuv_to_rgba(yuv);\n\n\n\n snprintf(pal_s + pal_s_pos, sizeof(pal_s) - pal_s_pos, \"%06x%s\", rgba,\n\n i != 15 ? \", \" : \"\");\n\n pal_s_pos = strlen(pal_s);\n\n if (pal_s_pos >= sizeof(pal_s))\n\n return 0;\n\n }\n\n\n\n snprintf(buf, sizeof(buf), \"size: %dx%d\\npalette: %s\\n\",\n\n st->codec->width, st->codec->height, pal_s);\n\n\n\n av_freep(&st->codec->extradata);\n\n st->codec->extradata_size = 0;\n\n st->codec->extradata = av_mallocz(strlen(buf) + FF_INPUT_BUFFER_PADDING_SIZE);\n\n if (!st->codec->extradata)\n\n return AVERROR(ENOMEM);\n\n st->codec->extradata_size = strlen(buf);\n\n memcpy(st->codec->extradata, buf, st->codec->extradata_size);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "c4e6024adc18df8ff82157227e2b4159f77951f9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n \n \n \n+\n+ avio_close(avf2->pb);\n+\n+ avf2->pb = NULL;\n+\n avformat_free_context(avf2);\n \n tee->slaves[i].avf = NULL;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void close_slaves(AVFormatContext *avf)\n\n{\n\n TeeContext *tee = avf->priv_data;\n\n AVFormatContext *avf2;\n\n unsigned i, j;\n\n\n\n for (i = 0; i < tee->nb_slaves; i++) {\n\n avf2 = tee->slaves[i].avf;\n\n\n\n for (j = 0; j < avf2->nb_streams; j++) {\n\n AVBitStreamFilterContext *bsf_next, *bsf = tee->slaves[i].bsfs[j];\n\n while (bsf) {\n\n bsf_next = bsf->next;\n\n av_bitstream_filter_close(bsf);\n\n bsf = bsf_next;\n\n }\n\n }\n\n av_freep(&tee->slaves[i].stream_map);\n\n\n\n\n avio_close(avf2->pb);\n\n avf2->pb = NULL;\n\n avformat_free_context(avf2);\n\n tee->slaves[i].avf = NULL;\n\n }\n\n}"}} {"sample_id": "3403e5eb884f3a74c40fe7cccc103f848c040215", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void parse_option_number(const char *name, const char *value,\n+\n uint64_t *ret, Error **errp)\n+\n+{\n \n char *postfix;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void parse_option_number(const char *name, const char *value,\n\n uint64_t *ret, Error **errp)\n\n{\n\n char *postfix;\n\n uint64_t number;\n\n\n\n number = strtoull(value, &postfix, 0);\n\n if (*postfix != '\\0') {\n\n error_setg(errp, QERR_INVALID_PARAMETER_VALUE, name, \"a number\");\n\n return;\n\n }\n\n *ret = number;\n\n}\n"}} {"sample_id": "681868cbbe8a596860c454d34f259941e0c44d73", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,9 +12,9 @@\n \n MERGE(i_tex_bits);\n \n+ MERGE(p_tex_bits);\n+\n+ MERGE(i_count);\n \n MERGE(f_count);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void merge_context_after_encode(MpegEncContext *dst, MpegEncContext *src){\n\n int i;\n\n\n\n MERGE(dct_count[0]); //note, the other dct vars are not part of the context\n\n MERGE(dct_count[1]);\n\n MERGE(mv_bits);\n\n MERGE(i_tex_bits);\n\n MERGE(p_tex_bits);\n\n MERGE(i_count);\n\n MERGE(f_count);\n\n MERGE(b_count);\n\n MERGE(skip_count);\n\n MERGE(misc_bits);\n\n MERGE(er.error_count);\n\n MERGE(padding_bug_score);\n\n MERGE(current_picture.f->error[0]);\n\n MERGE(current_picture.f->error[1]);\n\n MERGE(current_picture.f->error[2]);\n\n\n\n if(dst->avctx->noise_reduction){\n\n for(i=0; i<64; i++){\n\n MERGE(dct_error_sum[0][i]);\n\n MERGE(dct_error_sum[1][i]);\n\n }\n\n }\n\n\n\n assert(put_bits_count(&src->pb) % 8 ==0);\n\n assert(put_bits_count(&dst->pb) % 8 ==0);\n\n avpriv_copy_bits(&dst->pb, src->pb.buf, put_bits_count(&src->pb));\n\n flush_put_bits(&dst->pb);\n\n}\n"}} {"sample_id": "98f343395e937fa1db3a28dfb4f303f97cfddd6c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n struct endp_data *endp = priv;\n \n USBRedirDevice *dev = endp->dev;\n+\n struct buf_packet *bufp;\n \n int i;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int usbredir_get_bufpq(QEMUFile *f, void *priv, size_t unused)\n\n{\n\n struct endp_data *endp = priv;\n\n USBRedirDevice *dev = endp->dev;\n\n struct buf_packet *bufp;\n\n int i;\n\n\n\n endp->bufpq_size = qemu_get_be32(f);\n\n for (i = 0; i < endp->bufpq_size; i++) {\n\n bufp = g_malloc(sizeof(struct buf_packet));\n\n bufp->len = qemu_get_be32(f);\n\n bufp->status = qemu_get_be32(f);\n\n bufp->offset = 0;\n\n bufp->data = qemu_oom_check(malloc(bufp->len)); /* regular malloc! */\n\n bufp->free_on_destroy = bufp->data;\n\n qemu_get_buffer(f, bufp->data, bufp->len);\n\n QTAILQ_INSERT_TAIL(&endp->bufpq, bufp, next);\n\n DPRINTF(\"get_bufpq %d/%d len %d status %d\\n\", i + 1, endp->bufpq_size,\n\n bufp->len, bufp->status);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "7ec1e5ea4bd0700fa48da86bffa2fcc6146c410a_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n r_asi = gen_get_asi(dc, insn);\n \n+ r_size = tcg_const_i32(1);\n+\n+ r_sign = tcg_const_i32(0);\n+\n+ gen_helper_ld_asi(d64, cpu_env, addr, r_asi, r_size, r_sign);\n \n tcg_temp_free_i32(r_sign);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gen_ldstub_asi(DisasContext *dc, TCGv dst, TCGv addr, int insn)\n\n{\n\n TCGv_i32 r_asi, r_size, r_sign;\n\n TCGv_i64 s64, d64 = tcg_temp_new_i64();\n\n\n\n r_asi = gen_get_asi(dc, insn);\n\n r_size = tcg_const_i32(1);\n\n r_sign = tcg_const_i32(0);\n\n gen_helper_ld_asi(d64, cpu_env, addr, r_asi, r_size, r_sign);\n\n tcg_temp_free_i32(r_sign);\n\n\n\n s64 = tcg_const_i64(0xff);\n\n gen_helper_st_asi(cpu_env, addr, s64, r_asi, r_size);\n\n tcg_temp_free_i64(s64);\n\n tcg_temp_free_i32(r_size);\n\n tcg_temp_free_i32(r_asi);\n\n\n\n tcg_gen_trunc_i64_tl(dst, d64);\n\n tcg_temp_free_i64(d64);\n\n}\n"}} {"sample_id": "7150d34a1d60851d73d6ab6783b12b1d25e68f86", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n const testdef_t *test = data;\n \n char *args;\n+\n char tmpname[] = \"/tmp/qtest-boot-serial-XXXXXX\";\n \n int fd;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void test_machine(const void *data)\n\n{\n\n const testdef_t *test = data;\n\n char *args;\n\n char tmpname[] = \"/tmp/qtest-boot-serial-XXXXXX\";\n\n int fd;\n\n\n\n fd = mkstemp(tmpname);\n\n g_assert(fd != -1);\n\n\n\n args = g_strdup_printf(\"-M %s,accel=tcg -chardev file,id=serial0,path=%s\"\n\n \" -serial chardev:serial0 %s\", test->machine,\n\n tmpname, test->extra);\n\n\n\n qtest_start(args);\n\n unlink(tmpname);\n\n\n\n check_guest_output(test, fd);\n\n qtest_quit(global_qtest);\n\n\n\n g_free(args);\n\n close(fd);\n\n}\n"}} {"sample_id": "96b1a8bb55f1aeb72a943d1001841ff8b0687059", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n \n \n+ cpu = S390_CPU(object_new(TYPE_S390_CPU));\n+\n+\n+\n object_property_set_bool(OBJECT(cpu), true, \"realized\", NULL);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "S390CPU *cpu_s390x_init(const char *cpu_model)\n\n{\n\n S390CPU *cpu;\n\n\n\n cpu = S390_CPU(object_new(TYPE_S390_CPU));\n\n\n\n object_property_set_bool(OBJECT(cpu), true, \"realized\", NULL);\n\n\n\n return cpu;\n\n}\n"}} {"sample_id": "ad0ebb91cd8b5fdc4a583b03645677771f420a46_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,18 +3,18 @@\n {\n \n struct viosrp_adapter_info *sinfo;\n+\n struct mad_adapter_info_data info;\n \n int rc;\n+\n \n \n sinfo = &req->iu.mad.adapter_info;\n \n \n \n+#if 0 /* What for ? */\n \n rc = spapr_tce_dma_read(&s->vdev, be64_to_cpu(sinfo->buffer),\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int vscsi_send_adapter_info(VSCSIState *s, vscsi_req *req)\n\n{\n\n struct viosrp_adapter_info *sinfo;\n\n struct mad_adapter_info_data info;\n\n int rc;\n\n\n\n sinfo = &req->iu.mad.adapter_info;\n\n\n\n#if 0 /* What for ? */\n\n rc = spapr_tce_dma_read(&s->vdev, be64_to_cpu(sinfo->buffer),\n\n &info, be16_to_cpu(sinfo->common.length));\n\n if (rc) {\n\n fprintf(stderr, \"vscsi_send_adapter_info: DMA read failure !\\n\");\n\n }\n\n#endif\n\n memset(&info, 0, sizeof(info));\n\n strcpy(info.srp_version, SRP_VERSION);\n\n strncpy(info.partition_name, \"qemu\", sizeof(\"qemu\"));\n\n info.partition_number = cpu_to_be32(0);\n\n info.mad_version = cpu_to_be32(1);\n\n info.os_type = cpu_to_be32(2);\n\n info.port_max_txu[0] = cpu_to_be32(VSCSI_MAX_SECTORS << 9);\n\n\n\n rc = spapr_tce_dma_write(&s->vdev, be64_to_cpu(sinfo->buffer),\n\n &info, be16_to_cpu(sinfo->common.length));\n\n if (rc) {\n\n fprintf(stderr, \"vscsi_send_adapter_info: DMA write failure !\\n\");\n\n }\n\n\n\n sinfo->common.status = rc ? cpu_to_be32(1) : 0;\n\n\n\n return vscsi_send_iu(s, req, sizeof(*sinfo), VIOSRP_MAD_FORMAT);\n\n}\n"}} {"sample_id": "1ee24514aed34760fb2863d98bea3a1b705d9c9f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n NvmeRwCmd *rw = (NvmeRwCmd *)cmd;\n \n+ const uint8_t lba_index = NVME_ID_NS_FLBAS_INDEX(ns->id_ns.flbas);\n \n const uint8_t data_shift = ns->id_ns.lbaf[lba_index].ds;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint16_t nvme_write_zeros(NvmeCtrl *n, NvmeNamespace *ns, NvmeCmd *cmd,\n\n NvmeRequest *req)\n\n{\n\n NvmeRwCmd *rw = (NvmeRwCmd *)cmd;\n\n const uint8_t lba_index = NVME_ID_NS_FLBAS_INDEX(ns->id_ns.flbas);\n\n const uint8_t data_shift = ns->id_ns.lbaf[lba_index].ds;\n\n uint64_t slba = le64_to_cpu(rw->slba);\n\n uint32_t nlb = le16_to_cpu(rw->nlb) + 1;\n\n uint64_t aio_slba = slba << (data_shift - BDRV_SECTOR_BITS);\n\n uint32_t aio_nlb = nlb << (data_shift - BDRV_SECTOR_BITS);\n\n\n\n if (slba + nlb > ns->id_ns.nsze) {\n\n return NVME_LBA_RANGE | NVME_DNR;\n\n }\n\n\n\n req->has_sg = false;\n\n block_acct_start(blk_get_stats(n->conf.blk), &req->acct, 0,\n\n BLOCK_ACCT_WRITE);\n\n req->aiocb = blk_aio_pwrite_zeroes(n->conf.blk, aio_slba, aio_nlb,\n\n BDRV_REQ_MAY_UNMAP, nvme_rw_cb, req);\n\n return NVME_NO_COMPLETE;\n\n}\n"}} {"sample_id": "4a1418e07bdcfaa3177739e04707ecaec75d89e1_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -40,8 +40,8 @@\n \n flushed */\n \n+ if (dirty_flags == 0xff)\n+\n+ tlb_set_dirty(cpu_single_env, cpu_single_env->mem_io_vaddr);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void notdirty_mem_writew(void *opaque, target_phys_addr_t ram_addr,\n\n uint32_t val)\n\n{\n\n int dirty_flags;\n\n dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];\n\n if (!(dirty_flags & CODE_DIRTY_FLAG)) {\n\n#if !defined(CONFIG_USER_ONLY)\n\n tb_invalidate_phys_page_fast(ram_addr, 2);\n\n dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];\n\n#endif\n\n }\n\n stw_p(qemu_get_ram_ptr(ram_addr), val);\n\n#ifdef CONFIG_KQEMU\n\n if (cpu_single_env->kqemu_enabled &&\n\n (dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)\n\n kqemu_modify_page(cpu_single_env, ram_addr);\n\n#endif\n\n dirty_flags |= (0xff & ~CODE_DIRTY_FLAG);\n\n phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;\n\n /* we remove the notdirty callback only if the code has been\n\n flushed */\n\n if (dirty_flags == 0xff)\n\n tlb_set_dirty(cpu_single_env, cpu_single_env->mem_io_vaddr);\n\n}\n"}} {"sample_id": "71407786054cad26de7ef66718b2a57a4bcb49b5_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static bool virtio_scsi_data_plane_handle_event(VirtIODevice *vdev,\n \n VirtQueue *vq)\n+\n {\n \n VirtIOSCSI *s = VIRTIO_SCSI(vdev);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static bool virtio_scsi_data_plane_handle_event(VirtIODevice *vdev,\n\n VirtQueue *vq)\n\n{\n\n VirtIOSCSI *s = VIRTIO_SCSI(vdev);\n\n\n\n assert(s->ctx && s->dataplane_started);\n\n return virtio_scsi_handle_event_vq(s, vq);\n\n}\n"}} {"sample_id": "155ec6edf82692bcf3a5f87d2bc697404f4e5aaf_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n LOAD_COMMON\n \n+ \n+\n+ //FIXME factorize\n+\n+\n \n cmp_sub= s->dsp.mb_cmp[size];\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int inline get_mb_score(MpegEncContext * s, int mx, int my, int src_index,\n\n int ref_index)\n\n{\n\n// const int check_luma= s->dsp.me_sub_cmp != s->dsp.mb_cmp;\n\n MotionEstContext * const c= &s->me;\n\n const int size= 0;\n\n const int h= 16;\n\n const int penalty_factor= c->mb_penalty_factor;\n\n const int flags= c->mb_flags;\n\n const int qpel= flags & FLAG_QPEL;\n\n const int mask= 1+2*qpel;\n\n me_cmp_func cmp_sub, chroma_cmp_sub;\n\n int d;\n\n\n\n LOAD_COMMON\n\n \n\n //FIXME factorize\n\n\n\n cmp_sub= s->dsp.mb_cmp[size];\n\n chroma_cmp_sub= s->dsp.mb_cmp[size+1];\n\n \n\n assert(!c->skip);\n\n assert(c->avctx->me_sub_cmp != c->avctx->mb_cmp);\n\n\n\n d= cmp(s, mx>>(qpel+1), my>>(qpel+1), mx&mask, my&mask, size, h, ref_index, src_index, cmp_sub, chroma_cmp_sub, flags);\n\n //FIXME check cbp before adding penalty for (0,0) vector\n\n if(mx || my || size>0)\n\n d += (mv_penalty[mx - pred_x] + mv_penalty[my - pred_y])*penalty_factor;\n\n \n\n return d;\n\n}\n"}} {"sample_id": "b40acf99bef69fa8ab0f9092ff162fde945eec12_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void cpu_outl(pio_addr_t addr, uint32_t val)\n \n {\n+\n+ LOG_IOPORT(\"outl: %04\"FMT_pioaddr\" %08\"PRIx32\"\\n\", addr, val);\n \n trace_cpu_out(addr, val);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void cpu_outl(pio_addr_t addr, uint32_t val)\n\n{\n\n LOG_IOPORT(\"outl: %04\"FMT_pioaddr\" %08\"PRIx32\"\\n\", addr, val);\n\n trace_cpu_out(addr, val);\n\n ioport_write(2, addr, val);\n\n}\n"}} {"sample_id": "3b39d734141a71296d08af3d4c32f872fafd782e_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n vaddr addr, unsigned size,\n \n+ MMUAccessType access_type,\n \n int mmu_idx, MemTxAttrs attrs,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,\n\n vaddr addr, unsigned size,\n\n MMUAccessType access_type,\n\n int mmu_idx, MemTxAttrs attrs,\n\n MemTxResult response, uintptr_t retaddr)\n\n{\n\n ARMCPU *cpu = ARM_CPU(cs);\n\n ARMMMUFaultInfo fi = {};\n\n\n\n /* now we have a real cpu fault */\n\n cpu_restore_state(cs, retaddr);\n\n\n\n /* The EA bit in syndromes and fault status registers is an\n\n * IMPDEF classification of external aborts. ARM implementations\n\n * usually use this to indicate AXI bus Decode error (0) or\n\n * Slave error (1); in QEMU we follow that.\n\n */\n\n fi.ea = (response != MEMTX_DECODE_ERROR);\n\n fi.type = ARMFault_SyncExternal;\n\n deliver_fault(cpu, addr, access_type, mmu_idx, &fi);\n\n}\n"}} {"sample_id": "68d553587c0aa271c3eb2902921b503740d775b6_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n for(i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {\n \n+ cpu_physical_memory_rw(addr,(uint8_t *)buf, sizeof(*buf), 0);\n+\n+ *buf = le32_to_cpu(*buf);\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline int get_dwords(uint32_t addr, uint32_t *buf, int num)\n\n{\n\n int i;\n\n\n\n for(i = 0; i < num; i++, buf++, addr += sizeof(*buf)) {\n\n cpu_physical_memory_rw(addr,(uint8_t *)buf, sizeof(*buf), 0);\n\n *buf = le32_to_cpu(*buf);\n\n }\n\n\n\n return 1;\n\n}\n"}} {"sample_id": "8f90b5e91df59fde0dfecc6738ff39f3edf14be5_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n bdrv_io_unplugged_end(bs);\n \n+ bdrv_parent_drained_end(bs);\n+\n+ aio_context_release(aio_context);\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bdrv_drain_all_end(void)\n\n{\n\n BlockDriverState *bs;\n\n BdrvNextIterator it;\n\n BlockJob *job = NULL;\n\n\n\n for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {\n\n AioContext *aio_context = bdrv_get_aio_context(bs);\n\n\n\n aio_context_acquire(aio_context);\n\n aio_enable_external(aio_context);\n\n bdrv_io_unplugged_end(bs);\n\n bdrv_parent_drained_end(bs);\n\n aio_context_release(aio_context);\n\n }\n\n\n\n while ((job = block_job_next(job))) {\n\n AioContext *aio_context = blk_get_aio_context(job->blk);\n\n\n\n aio_context_acquire(aio_context);\n\n block_job_resume(job);\n\n aio_context_release(aio_context);\n\n }\n\n}\n"}} {"sample_id": "c3ab0004ae4dffc32494ae84dd15cfaa909a7884", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static inline void RENAME(rgb24ToUV_half)(uint8_t *dstU, uint8_t *dstV, const uint8_t *src1, const uint8_t *src2, int width, uint32_t *unused)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void RENAME(rgb24ToUV_half)(uint8_t *dstU, uint8_t *dstV, const uint8_t *src1, const uint8_t *src2, int width, uint32_t *unused)\n\n{\n\n int i;\n\n assert(src1==src2);\n\n for (i=0; i>(RGB2YUV_SHIFT+1);\n\n dstV[i]= (RV*r + GV*g + BV*b + (257<>(RGB2YUV_SHIFT+1);\n\n }\n\n}\n"}} {"sample_id": "a0efbf16604770b9d805bcf210ec29942321134f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n void *opaque, Error **errp)\n \n+{\n+\n+ PCIHostState *h = PCI_HOST_BRIDGE(obj);\n+\n+ Range w64;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void i440fx_pcihost_get_pci_hole64_start(Object *obj, Visitor *v,\n\n const char *name,\n\n void *opaque, Error **errp)\n\n{\n\n PCIHostState *h = PCI_HOST_BRIDGE(obj);\n\n Range w64;\n\n\n\n pci_bus_get_w64_range(h->bus, &w64);\n\n\n\n visit_type_uint64(v, name, &w64.begin, errp);\n\n}\n"}} {"sample_id": "5819e3e072f41cbf81ad80d822a5c468a91f54e0_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n s->fd = -1;\n \n return -1;\n+\n+ } else {\n+\n+ break;\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int get_char(GDBState *s)\n\n{\n\n uint8_t ch;\n\n int ret;\n\n\n\n for(;;) {\n\n ret = qemu_recv(s->fd, &ch, 1, 0);\n\n if (ret < 0) {\n\n if (errno == ECONNRESET)\n\n s->fd = -1;\n\n if (errno != EINTR && errno != EAGAIN)\n\n return -1;\n\n } else if (ret == 0) {\n\n close(s->fd);\n\n s->fd = -1;\n\n return -1;\n\n } else {\n\n break;\n\n }\n\n }\n\n return ch;\n\n}\n"}} {"sample_id": "df83eabd5245828cbca32060aa191d8b03bc5d50", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,19 +1,19 @@\n+static int guest_get_network_stats(const char *name,\n+\n+ GuestNetworkInterfaceStat *stats)\n+\n+{\n+\n+ DWORD if_index = 0;\n+\n+ MIB_IFROW a_mid_ifrow;\n+\n+ memset(&a_mid_ifrow, 0, sizeof(a_mid_ifrow));\n+\n+ if_index = get_interface_index(name);\n+\n+ a_mid_ifrow.dwIndex = if_index;\n+\n if (NO_ERROR == GetIfEntry(&a_mid_ifrow)) {\n \n stats->rx_bytes = a_mid_ifrow.dwInOctets;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int guest_get_network_stats(const char *name,\n\n GuestNetworkInterfaceStat *stats)\n\n{\n\n DWORD if_index = 0;\n\n MIB_IFROW a_mid_ifrow;\n\n memset(&a_mid_ifrow, 0, sizeof(a_mid_ifrow));\n\n if_index = get_interface_index(name);\n\n a_mid_ifrow.dwIndex = if_index;\n\n if (NO_ERROR == GetIfEntry(&a_mid_ifrow)) {\n\n stats->rx_bytes = a_mid_ifrow.dwInOctets;\n\n stats->rx_packets = a_mid_ifrow.dwInUcastPkts;\n\n stats->rx_errs = a_mid_ifrow.dwInErrors;\n\n stats->rx_dropped = a_mid_ifrow.dwInDiscards;\n\n stats->tx_bytes = a_mid_ifrow.dwOutOctets;\n\n stats->tx_packets = a_mid_ifrow.dwOutUcastPkts;\n\n stats->tx_errs = a_mid_ifrow.dwOutErrors;\n\n stats->tx_dropped = a_mid_ifrow.dwOutDiscards;\n\n return 0;\n\n }\n\n return -1;\n\n}\n"}} {"sample_id": "29ba091136a5e04574f7bfc1b17536c923958f6f_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n fprintf(stderr, \"%s version \" FFMPEG_VERSION \", Copyright (c) %d-%d the FFmpeg developers\\n\",\n \n+ program_name, program_birth_year, this_year);\n+\n+ fprintf(stderr, \" built on %s %s with %s %s\\n\",\n+\n __DATE__, __TIME__, CC_TYPE, CC_VERSION);\n \n fprintf(stderr, \" configuration: \" FFMPEG_CONFIGURATION \"\\n\");", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void show_banner(void)\n\n{\n\n fprintf(stderr, \"%s version \" FFMPEG_VERSION \", Copyright (c) %d-%d the FFmpeg developers\\n\",\n\n program_name, program_birth_year, this_year);\n\n fprintf(stderr, \" built on %s %s with %s %s\\n\",\n\n __DATE__, __TIME__, CC_TYPE, CC_VERSION);\n\n fprintf(stderr, \" configuration: \" FFMPEG_CONFIGURATION \"\\n\");\n\n print_all_libs_info(stderr, INDENT|SHOW_CONFIG);\n\n print_all_libs_info(stderr, INDENT|SHOW_VERSION);\n\n}\n"}} {"sample_id": "b1e749c02172583ca85bb3a964a9b39221f9ac39", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n }\n \n+\n+\n+ if (!handled && propagate_accel) {\n+\n+ handled = gtk_window_activate_key(GTK_WINDOW(widget), key);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static gboolean gd_window_key_event(GtkWidget *widget, GdkEventKey *key, void *opaque)\n\n{\n\n GtkDisplayState *s = opaque;\n\n GtkAccelGroupEntry *entries;\n\n guint n_entries = 0;\n\n gboolean propagate_accel = TRUE;\n\n gboolean handled = FALSE;\n\n\n\n entries = gtk_accel_group_query(s->accel_group, key->keyval,\n\n key->state, &n_entries);\n\n if (n_entries) {\n\n const char *quark = g_quark_to_string(entries[0].accel_path_quark);\n\n\n\n if (gd_is_grab_active(s) && strstart(quark, \"/File/\", NULL)) {\n\n propagate_accel = FALSE;\n\n }\n\n }\n\n\n\n if (!handled && propagate_accel) {\n\n handled = gtk_window_activate_key(GTK_WINDOW(widget), key);\n\n }\n\n if (handled) {\n\n gtk_release_modifiers(s);\n\n } else {\n\n handled = gtk_window_propagate_key_event(GTK_WINDOW(widget), key);\n\n }\n\n\n\n return handled;\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_28", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,16 +1,16 @@\n+void do_addeo (void)\n+\n {\n+\n+ T2 = T0;\n \n+ T0 += T1 + xer_ca;\n \n+ if (likely(!(T0 < T2 || (xer_ca == 1 && T0 == T2)))) {\n+\n xer_ca = 0;\n+\n+ } else {\n \n xer_ca = 1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void do_addeo (void)\n\n{\n\n T2 = T0;\n\n T0 += T1 + xer_ca;\n\n if (likely(!(T0 < T2 || (xer_ca == 1 && T0 == T2)))) {\n\n xer_ca = 0;\n\n } else {\n\n xer_ca = 1;\n\n }\n\n if (likely(!((T2 ^ T1 ^ (-1)) & (T2 ^ T0) & (1 << 31)))) {\n\n xer_ov = 0;\n\n } else {\n\n xer_so = 1;\n\n xer_ov = 1;\n\n }\n\n}\n"}} {"sample_id": "c99a55d38dd5b5131f3fcbbaf41828a09ee62544", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n set_feature(&cpu->env, ARM_FEATURE_VFP);\n \n+ set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);\n+\n+ set_feature(&cpu->env, ARM_FEATURE_CACHE_TEST_CLEAN);\n+\n+\n cpu->midr = 0x41069265;\n \n cpu->reset_fpsid = 0x41011090;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void arm926_initfn(Object *obj)\n\n{\n\n ARMCPU *cpu = ARM_CPU(obj);\n\n\n\n cpu->dtb_compatible = \"arm,arm926\";\n\n set_feature(&cpu->env, ARM_FEATURE_V5);\n\n set_feature(&cpu->env, ARM_FEATURE_VFP);\n\n set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);\n\n set_feature(&cpu->env, ARM_FEATURE_CACHE_TEST_CLEAN);\n\n\n cpu->midr = 0x41069265;\n\n cpu->reset_fpsid = 0x41011090;\n\n cpu->ctr = 0x1dd20d2;\n\n cpu->reset_sctlr = 0x00090078;\n\n}"}} {"sample_id": "7d1b0095bff7157e856d1d0e6c4295641ced2752_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void gen_rfe(DisasContext *s, TCGv pc, TCGv cpsr)\n \n+{\n \n gen_set_cpsr(cpsr, 0xffffffff);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void gen_rfe(DisasContext *s, TCGv pc, TCGv cpsr)\n\n{\n\n gen_set_cpsr(cpsr, 0xffffffff);\n\n dead_tmp(cpsr);\n\n store_reg(s, 15, pc);\n\n s->is_jmp = DISAS_UPDATE;\n\n}\n"}} {"sample_id": "e6494061690df2af7368752f35f5c22b5856e83c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,9 +9,9 @@\n if (s)\n \n s->cancel(s);\n+\n+\n+\n+ return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int do_migrate_cancel(Monitor *mon, const QDict *qdict, QObject **ret_data)\n\n{\n\n MigrationState *s = current_migration;\n\n\n\n if (s)\n\n s->cancel(s);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a0ccd2123ee2f83a1f081e4c39013c3316f9ec7a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -61,11 +61,11 @@\n }\n \n \n+\n+ pci_register_bar(dev, bar_nr, PCI_BASE_ADDRESS_SPACE_MEMORY,\n+\n+ &dev->msix_exclusive_bar);\n+\n \n \n return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int msix_init_exclusive_bar(PCIDevice *dev, unsigned short nentries,\n\n uint8_t bar_nr)\n\n{\n\n int ret;\n\n char *name;\n\n\n\n /*\n\n * Migration compatibility dictates that this remains a 4k\n\n * BAR with the vector table in the lower half and PBA in\n\n * the upper half. Do not use these elsewhere!\n\n */\n\n#define MSIX_EXCLUSIVE_BAR_SIZE 4096\n\n#define MSIX_EXCLUSIVE_BAR_TABLE_OFFSET 0\n\n#define MSIX_EXCLUSIVE_BAR_PBA_OFFSET (MSIX_EXCLUSIVE_BAR_SIZE / 2)\n\n#define MSIX_EXCLUSIVE_CAP_OFFSET 0\n\n\n\n if (nentries * PCI_MSIX_ENTRY_SIZE > MSIX_EXCLUSIVE_BAR_PBA_OFFSET) {\n\n return -EINVAL;\n\n }\n\n\n\n name = g_strdup_printf(\"%s-msix\", dev->name);\n\n memory_region_init(&dev->msix_exclusive_bar, OBJECT(dev), name, MSIX_EXCLUSIVE_BAR_SIZE);\n\n g_free(name);\n\n\n\n ret = msix_init(dev, nentries, &dev->msix_exclusive_bar, bar_nr,\n\n MSIX_EXCLUSIVE_BAR_TABLE_OFFSET, &dev->msix_exclusive_bar,\n\n bar_nr, MSIX_EXCLUSIVE_BAR_PBA_OFFSET,\n\n MSIX_EXCLUSIVE_CAP_OFFSET);\n\n if (ret) {\n\n return ret;\n\n }\n\n\n\n pci_register_bar(dev, bar_nr, PCI_BASE_ADDRESS_SPACE_MEMORY,\n\n &dev->msix_exclusive_bar);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "3d344c2aabb7bc9b414321e3c52872901edebdda_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n if (!so->entry) {\n \n+ return NULL;\n+\n+ }\n+\n+ tail->next = g_malloc0(size);\n \n return tail->next;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static GenericList *qmp_input_next_list(Visitor *v, GenericList *tail,\n\n size_t size)\n\n{\n\n QmpInputVisitor *qiv = to_qiv(v);\n\n StackObject *so = &qiv->stack[qiv->nb_stack - 1];\n\n\n\n if (!so->entry) {\n\n return NULL;\n\n }\n\n tail->next = g_malloc0(size);\n\n return tail->next;\n\n}\n"}} {"sample_id": "0bb05eaff04d30609a98c0dae80bb5dba3e4e799", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n size_t qemu_file_set_rate_limit(QEMUFile *f, size_t new_rate)\n+\n {\n \n if (f->set_rate_limit)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "size_t qemu_file_set_rate_limit(QEMUFile *f, size_t new_rate)\n\n{\n\n if (f->set_rate_limit)\n\n return f->set_rate_limit(f->opaque, new_rate);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "ce5b1bbf624b977a55ff7f85bb3871682d03baff_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n XtensaCPU *cpu = XTENSA_CPU(obj);\n \n+ XtensaCPUClass *xcc = XTENSA_CPU_GET_CLASS(obj);\n \n CPUXtensaState *env = &cpu->env;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void xtensa_cpu_initfn(Object *obj)\n\n{\n\n CPUState *cs = CPU(obj);\n\n XtensaCPU *cpu = XTENSA_CPU(obj);\n\n XtensaCPUClass *xcc = XTENSA_CPU_GET_CLASS(obj);\n\n CPUXtensaState *env = &cpu->env;\n\n static bool tcg_inited;\n\n\n\n cs->env_ptr = env;\n\n env->config = xcc->config;\n\n cpu_exec_init(cs, &error_abort);\n\n\n\n if (tcg_enabled() && !tcg_inited) {\n\n tcg_inited = true;\n\n xtensa_translate_init();\n\n }\n\n}\n"}} {"sample_id": "e7b95918fca1c3d057d35f77ba58ee2d00d03151", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,8 +7,8 @@\n height = (height + 1) & ~1;\n \n if (quality >= 0)\n+\n+ get_quant_quality(c, quality);\n \n if (width != c->width || height != c->height) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int codec_reinit(AVCodecContext *avctx, int width, int height, int quality) {\n\n NuvContext *c = avctx->priv_data;\n\n width = (width + 1) & ~1;\n\n height = (height + 1) & ~1;\n\n if (quality >= 0)\n\n get_quant_quality(c, quality);\n\n if (width != c->width || height != c->height) {\n\n if (av_image_check_size(height, width, 0, avctx) < 0)\n\n return 0;\n\n avctx->width = c->width = width;\n\n avctx->height = c->height = height;\n\n c->decomp_size = c->height * c->width * 3 / 2;\n\n c->decomp_buf = av_realloc(c->decomp_buf, c->decomp_size + AV_LZO_OUTPUT_PADDING);\n\n if (!c->decomp_buf) {\n\n av_log(avctx, AV_LOG_ERROR, \"Can't allocate decompression buffer.\\n\");\n\n return 0;\n\n }\n\n rtjpeg_decode_init(&c->rtj, &c->dsp, c->width, c->height, c->lq, c->cq);\n\n } else if (quality != c->quality)\n\n rtjpeg_decode_init(&c->rtj, &c->dsp, c->width, c->height, c->lq, c->cq);\n\n return 1;\n\n}\n"}} {"sample_id": "f36aec3b5e18c4c167612d0051a6d5b6144b3552", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void chomp3(ChannelData *ctx, int16_t *output, uint8_t val,\n \n+ const uint16_t tab1[],\n \n const int16_t *tab2, int tab2_stride,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void chomp3(ChannelData *ctx, int16_t *output, uint8_t val,\n\n const uint16_t tab1[],\n\n const int16_t *tab2, int tab2_stride,\n\n uint32_t numChannels)\n\n{\n\n int16_t current;\n\n\n\n current = tab2[((ctx->index & 0x7f0) >> 4)*tab2_stride + val];\n\n\n\n current = mace_broken_clip_int16(current + ctx->lev);\n\n\n\n ctx->lev = current - (current >> 3);\n\n *output = QT_8S_2_16S(current);\n\n if (( ctx->index += tab1[val]-(ctx->index >> 5) ) < 0)\n\n ctx->index = 0;\n\n}\n"}} {"sample_id": "adb435522b86b3fca2324cb8c94e17b55ae071f1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,14 +4,14 @@\n \n {\n \n+ int ret = qcow2_check_metadata_overlap(bs, ign, offset, size);\n \n+\n+\n+ if (ret < 0) {\n+\n+ return ret;\n+\n } else if (ret > 0) {\n \n int metadata_ol_bitnr = ffs(ret) - 1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int qcow2_pre_write_overlap_check(BlockDriverState *bs, int ign, int64_t offset,\n\n int64_t size)\n\n{\n\n int ret = qcow2_check_metadata_overlap(bs, ign, offset, size);\n\n\n\n if (ret < 0) {\n\n return ret;\n\n } else if (ret > 0) {\n\n int metadata_ol_bitnr = ffs(ret) - 1;\n\n char *message;\n\n\n\n assert(metadata_ol_bitnr < QCOW2_OL_MAX_BITNR);\n\n\n\n fprintf(stderr, \"qcow2: Preventing invalid write on metadata (overlaps \"\n\n \"with %s); image marked as corrupt.\\n\",\n\n metadata_ol_names[metadata_ol_bitnr]);\n\n message = g_strdup_printf(\"Prevented %s overwrite\",\n\n metadata_ol_names[metadata_ol_bitnr]);\n\n qapi_event_send_block_image_corrupted(bdrv_get_device_name(bs),\n\n message,\n\n true,\n\n offset,\n\n true,\n\n size,\n\n true,\n\n &error_abort);\n\n g_free(message);\n\n\n\n qcow2_mark_corrupt(bs);\n\n bs->drv = NULL; /* make BDS unusable */\n\n return -EIO;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "89cad9f3ec6b30d7550fb5704475fc9c3393a066", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n QDict *qdict_get_qdict(const QDict *qdict, const char *key)\n+\n {\n \n return qobject_to_qdict(qdict_get_obj(qdict, key, QTYPE_QDICT));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "QDict *qdict_get_qdict(const QDict *qdict, const char *key)\n\n{\n\n return qobject_to_qdict(qdict_get_obj(qdict, key, QTYPE_QDICT));\n\n}\n"}} {"sample_id": "9aebf3b89281a173d2dfeee379b800be5e3f363e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n if (id) {\n \n if (!id_wellformed(id)) {\n+\n+ error_set(errp,QERR_INVALID_PARAMETER_VALUE, \"id\", \"an identifier\");\n+\n+#if 0 /* conversion from qerror_report() to error_set() broke this: */\n+\n error_printf_unless_qmp(\"Identifiers consist of letters, digits, '-', '.', '_', starting with a letter.\\n\");\n \n #endif", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "QemuOpts *qemu_opts_create(QemuOptsList *list, const char *id,\n\n int fail_if_exists, Error **errp)\n\n{\n\n QemuOpts *opts = NULL;\n\n\n\n if (id) {\n\n if (!id_wellformed(id)) {\n\n error_set(errp,QERR_INVALID_PARAMETER_VALUE, \"id\", \"an identifier\");\n\n#if 0 /* conversion from qerror_report() to error_set() broke this: */\n\n error_printf_unless_qmp(\"Identifiers consist of letters, digits, '-', '.', '_', starting with a letter.\\n\");\n\n#endif\n\n return NULL;\n\n }\n\n opts = qemu_opts_find(list, id);\n\n if (opts != NULL) {\n\n if (fail_if_exists && !list->merge_lists) {\n\n error_setg(errp, \"Duplicate ID '%s' for %s\", id, list->name);\n\n return NULL;\n\n } else {\n\n return opts;\n\n }\n\n }\n\n } else if (list->merge_lists) {\n\n opts = qemu_opts_find(list, NULL);\n\n if (opts) {\n\n return opts;\n\n }\n\n }\n\n opts = g_malloc0(sizeof(*opts));\n\n opts->id = g_strdup(id);\n\n opts->list = list;\n\n loc_save(&opts->loc);\n\n QTAILQ_INIT(&opts->head);\n\n QTAILQ_INSERT_TAIL(&list->head, opts, next);\n\n return opts;\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_46", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n void do_divwo (void)\n+\n+{\n+\n if (likely(!((Ts0 == INT32_MIN && Ts1 == -1) || Ts1 == 0))) {\n+\n+ xer_ov = 0;\n \n T0 = (Ts0 / Ts1);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void do_divwo (void)\n\n{\n\n if (likely(!((Ts0 == INT32_MIN && Ts1 == -1) || Ts1 == 0))) {\n\n xer_ov = 0;\n\n T0 = (Ts0 / Ts1);\n\n } else {\n\n xer_so = 1;\n\n xer_ov = 1;\n\n T0 = (-1) * ((uint32_t)T0 >> 31);\n\n }\n\n}\n"}} {"sample_id": "2f75bd73c319a1224a64a1b5ad680b1a37ed2d7a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n {\n \n+ sigset_t set, oldset;\n+\n+ int err;\n+\n pthread_attr_t attr;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void qemu_thread_create(QemuThread *thread, const char *name,\n\n void *(*start_routine)(void*),\n\n void *arg, int mode)\n\n{\n\n sigset_t set, oldset;\n\n int err;\n\n pthread_attr_t attr;\n\n\n\n err = pthread_attr_init(&attr);\n\n if (err) {\n\n error_exit(err, __func__);\n\n }\n\n if (mode == QEMU_THREAD_DETACHED) {\n\n err = pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);\n\n if (err) {\n\n error_exit(err, __func__);\n\n }\n\n }\n\n\n\n /* Leave signal handling to the iothread. */\n\n sigfillset(&set);\n\n pthread_sigmask(SIG_SETMASK, &set, &oldset);\n\n err = pthread_create(&thread->thread, &attr, start_routine, arg);\n\n if (err)\n\n error_exit(err, __func__);\n\n\n\n if (name_threads) {\n\n qemu_thread_set_name(thread, name);\n\n }\n\n\n\n pthread_sigmask(SIG_SETMASK, &oldset, NULL);\n\n\n\n pthread_attr_destroy(&attr);\n\n}\n"}} {"sample_id": "ac1970fbe8ad5a70174f462109ac0f6c7bf1bc43_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n MemoryRegionSection *section)\n \n+{\n+\n cpu_register_physical_memory_log(section, section->readonly);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void core_region_add(MemoryListener *listener,\n\n MemoryRegionSection *section)\n\n{\n\n cpu_register_physical_memory_log(section, section->readonly);\n\n}\n"}} {"sample_id": "7a6ab45e19b615b9285b9cfa2bbc1fee012bc8d7_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n fprintf(stderr, \"Nonono!\\n\");\n \n+ mapping_t* mapping;\n+\n+ direntry_t* direntry;\n+\n+ assert(vvv->mapping.size >= vvv->mapping.item_size * vvv->mapping.next);\n \n assert(vvv->directory.size >= vvv->directory.item_size * vvv->directory.next);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void checkpoint(void) {\n\n assert(((mapping_t*)array_get(&(vvv->mapping), 0))->end == 2);\n\n check1(vvv);\n\n check2(vvv);\n\n assert(!vvv->current_mapping || vvv->current_fd || (vvv->current_mapping->mode & MODE_DIRECTORY));\n\n#if 0\n\n if (((direntry_t*)vvv->directory.pointer)[1].attributes != 0xf)\n\n fprintf(stderr, \"Nonono!\\n\");\n\n mapping_t* mapping;\n\n direntry_t* direntry;\n\n assert(vvv->mapping.size >= vvv->mapping.item_size * vvv->mapping.next);\n\n assert(vvv->directory.size >= vvv->directory.item_size * vvv->directory.next);\n\n if (vvv->mapping.next<47)\n\n return;\n\n assert((mapping = array_get(&(vvv->mapping), 47)));\n\n assert(mapping->dir_index < vvv->directory.next);\n\n direntry = array_get(&(vvv->directory), mapping->dir_index);\n\n assert(!memcmp(direntry->name, \"USB H \", 11) || direntry->name[0]==0);\n\n#endif\n\n}\n"}} {"sample_id": "11ab1e409ff272c8c0bce62f48a3767546547c6c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n if (HAVE_NEON) {\n \n+ s->fft_permute = ff_fft_permute_neon;\n+\n+ s->fft_calc = ff_fft_calc_neon;\n+\n+ s->imdct_calc = ff_imdct_calc_neon;\n \n s->imdct_half = ff_imdct_half_neon;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "av_cold void ff_fft_init_arm(FFTContext *s)\n\n{\n\n if (HAVE_NEON) {\n\n s->fft_permute = ff_fft_permute_neon;\n\n s->fft_calc = ff_fft_calc_neon;\n\n s->imdct_calc = ff_imdct_calc_neon;\n\n s->imdct_half = ff_imdct_half_neon;\n\n s->mdct_calc = ff_mdct_calc_neon;\n\n s->permutation = FF_MDCT_PERM_INTERLEAVE;\n\n }\n\n}\n"}} {"sample_id": "7f526efd17973ec6d2204f7a47b6923e2be31363_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static inline void RENAME(yuv422ptoyuy2)(const uint8_t *ysrc, const uint8_t *usrc, const uint8_t *vsrc, uint8_t *dst,\n \n \tunsigned int width, unsigned int height,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void RENAME(yuv422ptoyuy2)(const uint8_t *ysrc, const uint8_t *usrc, const uint8_t *vsrc, uint8_t *dst,\n\n\tunsigned int width, unsigned int height,\n\n\tint lumStride, int chromStride, int dstStride)\n\n{\n\n\tRENAME(yuvPlanartoyuy2)(ysrc, usrc, vsrc, dst, width, height, lumStride, chromStride, dstStride, 1);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_105", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,5 +5,5 @@\n {\n \n cpu_outb(addr & IOPORTS_MASK, val);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pci_apb_iowriteb (void *opaque, target_phys_addr_t addr,\n\n uint32_t val)\n\n{\n\n cpu_outb(addr & IOPORTS_MASK, val);\n\n}\n"}} {"sample_id": "8417cebfda193c7f9ca70be5e308eaa92cf84b94", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static uint64_t addrrange_end(AddrRange r)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static uint64_t addrrange_end(AddrRange r)\n\n{\n\n return r.start + r.size;\n\n}\n"}} {"sample_id": "faadf50e2962dd54175647a80bd6fc4319c91973_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void init_excp_4xx_real (CPUPPCState *env)\n+\n {\n \n #if !defined(CONFIG_USER_ONLY)\n@@ -9,11 +9,11 @@\n env->excp_vectors[POWERPC_EXCP_MCHECK] = 0x00000200;\n \n env->excp_vectors[POWERPC_EXCP_EXTERNAL] = 0x00000500;\n+\n+ env->excp_vectors[POWERPC_EXCP_ALIGN] = 0x00000600;\n+\n env->excp_vectors[POWERPC_EXCP_PROGRAM] = 0x00000700;\n+\n env->excp_vectors[POWERPC_EXCP_SYSCALL] = 0x00000C00;\n \n env->excp_vectors[POWERPC_EXCP_PIT] = 0x00001000;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void init_excp_4xx_real (CPUPPCState *env)\n\n{\n\n#if !defined(CONFIG_USER_ONLY)\n\n env->excp_vectors[POWERPC_EXCP_CRITICAL] = 0x00000100;\n\n env->excp_vectors[POWERPC_EXCP_MCHECK] = 0x00000200;\n\n env->excp_vectors[POWERPC_EXCP_EXTERNAL] = 0x00000500;\n\n env->excp_vectors[POWERPC_EXCP_ALIGN] = 0x00000600;\n\n env->excp_vectors[POWERPC_EXCP_PROGRAM] = 0x00000700;\n\n env->excp_vectors[POWERPC_EXCP_SYSCALL] = 0x00000C00;\n\n env->excp_vectors[POWERPC_EXCP_PIT] = 0x00001000;\n\n env->excp_vectors[POWERPC_EXCP_FIT] = 0x00001010;\n\n env->excp_vectors[POWERPC_EXCP_WDT] = 0x00001020;\n\n env->excp_vectors[POWERPC_EXCP_DEBUG] = 0x00002000;\n\n env->excp_prefix = 0x00000000;\n\n env->ivor_mask = 0x0000FFF0;\n\n env->ivpr_mask = 0xFFFF0000;\n\n /* Hardware reset vector */\n\n env->hreset_vector = 0xFFFFFFFCUL;\n\n#endif\n\n}\n"}} {"sample_id": "23dce3873f3aee6ee7d4a1c17dd26fb5f453bc5a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n bdrv_register(&bdrv_http);\n \n bdrv_register(&bdrv_https);\n+\n+ bdrv_register(&bdrv_ftp);\n+\n bdrv_register(&bdrv_ftps);\n \n bdrv_register(&bdrv_tftp);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void curl_block_init(void)\n\n{\n\n bdrv_register(&bdrv_http);\n\n bdrv_register(&bdrv_https);\n\n bdrv_register(&bdrv_ftp);\n\n bdrv_register(&bdrv_ftps);\n\n bdrv_register(&bdrv_tftp);\n\n}\n"}} {"sample_id": "ea1e630c47e70672a7933c048090601ce09c8195", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static int rv34_decoder_alloc(RV34DecContext *r)\n \n+{\n+\n+ r->intra_types_stride = r->s.mb_width * 4 + 4;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int rv34_decoder_alloc(RV34DecContext *r)\n\n{\n\n r->intra_types_stride = r->s.mb_width * 4 + 4;\n\n\n\n r->cbp_chroma = av_malloc(r->s.mb_stride * r->s.mb_height *\n\n sizeof(*r->cbp_chroma));\n\n r->cbp_luma = av_malloc(r->s.mb_stride * r->s.mb_height *\n\n sizeof(*r->cbp_luma));\n\n r->deblock_coefs = av_malloc(r->s.mb_stride * r->s.mb_height *\n\n sizeof(*r->deblock_coefs));\n\n r->intra_types_hist = av_malloc(r->intra_types_stride * 4 * 2 *\n\n sizeof(*r->intra_types_hist));\n\n r->mb_type = av_mallocz(r->s.mb_stride * r->s.mb_height *\n\n sizeof(*r->mb_type));\n\n\n\n if (!(r->cbp_chroma && r->cbp_luma && r->deblock_coefs &&\n\n r->intra_types_hist && r->mb_type)) {\n\n rv34_decoder_free(r);\n\n return AVERROR(ENOMEM);\n\n }\n\n\n\n r->intra_types = r->intra_types_hist + r->intra_types_stride * 4;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "40ff6d7e8dceca227e7f8a3e8e0d58b2c66d19b4_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n int val;\n \n+ int s;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int tcp_start_incoming_migration(const char *host_port)\n\n{\n\n struct sockaddr_in addr;\n\n int val;\n\n int s;\n\n\n\n if (parse_host_port(&addr, host_port) < 0) {\n\n fprintf(stderr, \"invalid host/port combination: %s\\n\", host_port);\n\n return -EINVAL;\n\n }\n\n\n\n s = socket(PF_INET, SOCK_STREAM, 0);\n\n if (s == -1)\n\n return -socket_error();\n\n\n\n val = 1;\n\n setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (const char *)&val, sizeof(val));\n\n\n\n if (bind(s, (struct sockaddr *)&addr, sizeof(addr)) == -1)\n\n goto err;\n\n\n\n if (listen(s, 1) == -1)\n\n goto err;\n\n\n\n qemu_set_fd_handler2(s, NULL, tcp_accept_incoming_migration, NULL,\n\n (void *)(unsigned long)s);\n\n\n\n return 0;\n\n\n\nerr:\n\n close(s);\n\n return -socket_error();\n\n}\n"}} {"sample_id": "428098165de4c3edfe42c1b7f00627d287015863_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+static int mlib_YUV2RGB420_24(SwsContext *c, uint8_t* src[], int srcStride[], int srcSliceY,\n \n+ int srcSliceH, uint8_t* dst[], int dstStride[]){\n+\n if(c->srcFormat == PIX_FMT_YUV422P){\n \n+\tsrcStride[1] *= 2;\n \n \tsrcStride[2] *= 2;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int mlib_YUV2RGB420_24(SwsContext *c, uint8_t* src[], int srcStride[], int srcSliceY,\n\n int srcSliceH, uint8_t* dst[], int dstStride[]){\n\n if(c->srcFormat == PIX_FMT_YUV422P){\n\n\tsrcStride[1] *= 2;\n\n\tsrcStride[2] *= 2;\n\n }\n\n\n\n assert(srcStride[1] == srcStride[2]);\n\n\n\n mlib_VideoColorYUV2RGB420(dst[0]+srcSliceY*dstStride[0], src[0], src[1], src[2], c->dstW,\n\n\t\t\t srcSliceH, dstStride[0], srcStride[0], srcStride[1]);\n\n return srcSliceH;\n\n}\n"}} {"sample_id": "9835abb6d63fb07613994ae90e72fef758149408", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n return ff_neterrno();\n \n+\n+\n+ ret = poll(&lp, 1, timeout >= 0 ? timeout : -1);\n+\n+ if (ret <= 0)\n \n return AVERROR(ETIMEDOUT);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int ff_listen_bind(int fd, const struct sockaddr *addr,\n\n socklen_t addrlen, int timeout)\n\n{\n\n int ret;\n\n int reuse = 1;\n\n struct pollfd lp = { fd, POLLIN, 0 };\n\n setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &reuse, sizeof(reuse));\n\n ret = bind(fd, addr, addrlen);\n\n if (ret)\n\n return ff_neterrno();\n\n\n\n ret = listen(fd, 1);\n\n if (ret)\n\n return ff_neterrno();\n\n\n\n ret = poll(&lp, 1, timeout >= 0 ? timeout : -1);\n\n if (ret <= 0)\n\n return AVERROR(ETIMEDOUT);\n\n\n\n ret = accept(fd, NULL, NULL);\n\n if (ret < 0)\n\n return ff_neterrno();\n\n\n\n closesocket(fd);\n\n\n\n ff_socket_nonblock(ret, 1);\n\n return ret;\n\n}\n"}} {"sample_id": "0a41faa9a77dc83d8d933e99f1ba902ecd146e79_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n av_cold int vp56_free(AVCodecContext *avctx)\n {\n VP56Context *s = avctx->priv_data;\n+ int pt;\n+ av_freep(&s->qscale_table);\n+ av_freep(&s->above_blocks);\n av_freep(&s->macroblocks);\n av_freep(&s->edge_emu_buffer_alloc);\n if (s->framep[VP56_FRAME_GOLDEN]->data[0])", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "av_cold int vp56_free(AVCodecContext *avctx)\n{\n VP56Context *s = avctx->priv_data;\n int pt;\n av_freep(&s->qscale_table);\n av_freep(&s->above_blocks);\n av_freep(&s->macroblocks);\n av_freep(&s->edge_emu_buffer_alloc);\n if (s->framep[VP56_FRAME_GOLDEN]->data[0])\n avctx->release_buffer(avctx, s->framep[VP56_FRAME_GOLDEN]);\n if (s->framep[VP56_FRAME_GOLDEN2]->data[0])\n avctx->release_buffer(avctx, s->framep[VP56_FRAME_GOLDEN2]);\n if (s->framep[VP56_FRAME_PREVIOUS]->data[0])\n avctx->release_buffer(avctx, s->framep[VP56_FRAME_PREVIOUS]);\n return 0;"}} {"sample_id": "7e7e59409294af9caa63808e56c5cc824c98b4fc_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static inline unsigned char gif_clut_index(uint8_t r, uint8_t g, uint8_t b)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline unsigned char gif_clut_index(uint8_t r, uint8_t g, uint8_t b)\n\n{\n\n return ((((r)/47)%6)*6*6+(((g)/47)%6)*6+(((b)/47)%6));\n\n}\n"}} {"sample_id": "9c8922acadb5187c274250d6cde653b7bad2559e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int tls_read(URLContext *h, uint8_t *buf, int size)\n \n+{\n+\n TLSContext *c = h->priv_data;\n \n size_t processed = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int tls_read(URLContext *h, uint8_t *buf, int size)\n\n{\n\n TLSContext *c = h->priv_data;\n\n size_t processed = 0;\n\n int ret = SSLRead(c->ssl_context, buf, size, &processed);\n\n ret = map_ssl_error(ret, processed);\n\n if (ret > 0)\n\n return ret;\n\n if (ret == 0)\n\n return AVERROR_EOF;\n\n return print_tls_error(h, ret);\n\n}\n"}} {"sample_id": "550830f9351291c585c963204ad9127998b1c1ce", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n while (nb_sectors > 0) {\n \n+ ret = cow_co_is_allocated(bs, sector_num, nb_sectors, &n);\n+\n+ if (ret < 0) {\n+\n+ return ret;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int coroutine_fn cow_read(BlockDriverState *bs, int64_t sector_num,\n\n uint8_t *buf, int nb_sectors)\n\n{\n\n BDRVCowState *s = bs->opaque;\n\n int ret, n;\n\n\n\n while (nb_sectors > 0) {\n\n ret = cow_co_is_allocated(bs, sector_num, nb_sectors, &n);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n if (ret) {\n\n ret = bdrv_pread(bs->file,\n\n s->cow_sectors_offset + sector_num * 512,\n\n buf, n * 512);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n } else {\n\n if (bs->backing_hd) {\n\n /* read from the base image */\n\n ret = bdrv_read(bs->backing_hd, sector_num, buf, n);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n } else {\n\n memset(buf, 0, n * 512);\n\n }\n\n }\n\n nb_sectors -= n;\n\n sector_num += n;\n\n buf += n * 512;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "2cbe6bac0337939f023bd1c37a9c455e6d535f3a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n uint16_t *src1w = (uint16_t *)src1;\n \n uint16_t *src2w = (uint16_t *)src2;\n+\n width /= 2;\n \n src1_linesize /= 2;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void blend_frames16_c(BLEND_FUNC_PARAMS)\n\n{\n\n int line, pixel;\n\n uint16_t *dstw = (uint16_t *)dst;\n\n uint16_t *src1w = (uint16_t *)src1;\n\n uint16_t *src2w = (uint16_t *)src2;\n\n width /= 2;\n\n src1_linesize /= 2;\n\n src2_linesize /= 2;\n\n dst_linesize /= 2;\n\n for (line = 0; line < height; line++) {\n\n for (pixel = 0; pixel < width; pixel++)\n\n dstw[pixel] = ((src1w[pixel] * factor1) + (src2w[pixel] * factor2) + half) >> shift;\n\n src1w += src1_linesize;\n\n src2w += src2_linesize;\n\n dstw += dst_linesize;\n\n }\n\n}\n"}} {"sample_id": "069ab0eb8a46bc4ff6f4d4d81bf037d3441347da", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,4 +3,4 @@\n VMMouseState *s = container_of(d, VMMouseState, dev.qdev);\n s->status = 0xffff;\n s->queue_size = VMMOUSE_QUEUE_SIZE;\n+}", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void vmmouse_reset(DeviceState *d)\n{\n VMMouseState *s = container_of(d, VMMouseState, dev.qdev);\n s->status = 0xffff;\n s->queue_size = VMMOUSE_QUEUE_SIZE;\n}"}} {"sample_id": "4a1418e07bdcfaa3177739e04707ecaec75d89e1_32", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ int64_t total;\n+\n+ total = qemu_time;\n+\n+ if (total == 0)\n \n total = 1;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void do_info_profile(Monitor *mon)\n\n{\n\n int64_t total;\n\n total = qemu_time;\n\n if (total == 0)\n\n total = 1;\n\n monitor_printf(mon, \"async time %\" PRId64 \" (%0.3f)\\n\",\n\n dev_time, dev_time / (double)ticks_per_sec);\n\n monitor_printf(mon, \"qemu time %\" PRId64 \" (%0.3f)\\n\",\n\n qemu_time, qemu_time / (double)ticks_per_sec);\n\n monitor_printf(mon, \"kqemu time %\" PRId64 \" (%0.3f %0.1f%%) count=%\"\n\n PRId64 \" int=%\" PRId64 \" excp=%\" PRId64 \" intr=%\"\n\n PRId64 \"\\n\",\n\n kqemu_time, kqemu_time / (double)ticks_per_sec,\n\n kqemu_time / (double)total * 100.0,\n\n kqemu_exec_count,\n\n kqemu_ret_int_count,\n\n kqemu_ret_excp_count,\n\n kqemu_ret_intr_count);\n\n qemu_time = 0;\n\n kqemu_time = 0;\n\n kqemu_exec_count = 0;\n\n dev_time = 0;\n\n kqemu_ret_int_count = 0;\n\n kqemu_ret_excp_count = 0;\n\n kqemu_ret_intr_count = 0;\n\n#ifdef CONFIG_KQEMU\n\n kqemu_record_dump();\n\n#endif\n\n}\n"}} {"sample_id": "d9f62dde1303286b24ac8ce88be27e2b9b9c5f46_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,9 +7,9 @@\n QList *list = qlist_new();\n \n \n+\n+ qmp_output_add(qov, name, list);\n+\n qmp_output_push(qov, list);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qmp_output_start_list(Visitor *v, const char *name, Error **errp)\n\n{\n\n QmpOutputVisitor *qov = to_qov(v);\n\n QList *list = qlist_new();\n\n\n\n qmp_output_add(qov, name, list);\n\n qmp_output_push(qov, list);\n\n}\n"}} {"sample_id": "d1b4259f1ab18af24e6a297edb6a8f71691f3256_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,8 +12,8 @@\n \n /* A backend didn't support modern virtio. */\n \n+ dev->max_rev = 0;\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_ccw_post_plugged(DeviceState *d, Error **errp)\n\n{\n\n VirtioCcwDevice *dev = VIRTIO_CCW_DEVICE(d);\n\n VirtIODevice *vdev = virtio_bus_get_device(&dev->bus);\n\n\n\n if (!virtio_host_has_feature(vdev, VIRTIO_F_VERSION_1)) {\n\n /* A backend didn't support modern virtio. */\n\n dev->max_rev = 0;\n\n }\n\n}\n"}} {"sample_id": "978f2205c791de0e02c8802a645bea657408abfd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n for(;;) {\n \n+ t = *pt;\n+\n+ if (!t)\n+\n+ break;\n \n if (t == ts) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void timer_del(QEMUTimer *ts)\n\n{\n\n QEMUTimer **pt, *t;\n\n\n\n pt = &ts->timer_list->active_timers;\n\n for(;;) {\n\n t = *pt;\n\n if (!t)\n\n break;\n\n if (t == ts) {\n\n *pt = t->next;\n\n break;\n\n }\n\n pt = &t->next;\n\n }\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_141", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int get_int8(QEMUFile *f, void *pv, size_t size)\n+\n+{\n \n int8_t *v = pv;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int get_int8(QEMUFile *f, void *pv, size_t size)\n\n{\n\n int8_t *v = pv;\n\n qemu_get_s8s(f, v);\n\n return 0;\n\n}\n"}} {"sample_id": "a7afc6b8c13c70e9c40b4f666be80600f8ad0b3d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void qtest_add_func(const char *str, void (*fn))\n+\n+{\n \n gchar *path = g_strdup_printf(\"/%s/%s\", qtest_get_arch(), str);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "void qtest_add_func(const char *str, void (*fn))\n\n{\n\n gchar *path = g_strdup_printf(\"/%s/%s\", qtest_get_arch(), str);\n\n g_test_add_func(path, fn);\n\n\n}"}} {"sample_id": "10ee2aaa417d8d8978cdb2bbed55ebb152df5f6b_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -41,11 +41,11 @@\n if (!(val & (GC_WR | GC_CR)))\n \n s->glob_cnt = val & GC_VALID_MASK;\n+\n+ dolog (\"glob_cnt <- %#x (glob_cnt %#x)\\n\", val, s->glob_cnt);\n+\n+ break;\n+\n case GLOB_STA:\n \n s->glob_sta &= ~(val & GS_WCLEAR_MASK);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void nabm_writel (void *opaque, uint32_t addr, uint32_t val)\n\n{\n\n PCIAC97LinkState *d = opaque;\n\n AC97LinkState *s = &d->ac97;\n\n AC97BusMasterRegs *r = NULL;\n\n uint32_t index = addr - s->base[1];\n\n switch (index) {\n\n case PI_BDBAR:\n\n case PO_BDBAR:\n\n case MC_BDBAR:\n\n r = &s->bm_regs[GET_BM (index)];\n\n r->bdbar = val & ~3;\n\n dolog (\"BDBAR[%d] <- %#x (bdbar %#x)\\n\",\n\n GET_BM (index), val, r->bdbar);\n\n break;\n\n case GLOB_CNT:\n\n if (val & GC_WR)\n\n warm_reset (s);\n\n if (val & GC_CR)\n\n cold_reset (s);\n\n if (!(val & (GC_WR | GC_CR)))\n\n s->glob_cnt = val & GC_VALID_MASK;\n\n dolog (\"glob_cnt <- %#x (glob_cnt %#x)\\n\", val, s->glob_cnt);\n\n break;\n\n case GLOB_STA:\n\n s->glob_sta &= ~(val & GS_WCLEAR_MASK);\n\n s->glob_sta |= (val & ~(GS_WCLEAR_MASK | GS_RO_MASK)) & GS_VALID_MASK;\n\n dolog (\"glob_sta <- %#x (glob_sta %#x)\\n\", val, s->glob_sta);\n\n break;\n\n default:\n\n dolog (\"U nabm writel %#x <- %#x\\n\", addr, val);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "79997def65fd2313b48a5f3c3a884c6149ae9b5d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n return ret;\n \n \n+\n+ mdct->window = ff_ac3_window;\n+\n+\n+\n FF_ALLOC_OR_GOTO(avctx, mdct->xcos1, n4 * sizeof(*mdct->xcos1), mdct_alloc_fail);\n \n FF_ALLOC_OR_GOTO(avctx, mdct->xsin1, n4 * sizeof(*mdct->xsin1), mdct_alloc_fail);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int mdct_init(AVCodecContext *avctx, AC3MDCTContext *mdct,\n\n int nbits)\n\n{\n\n int i, n, n4, ret;\n\n\n\n n = 1 << nbits;\n\n n4 = n >> 2;\n\n\n\n mdct->nbits = nbits;\n\n\n\n ret = fft_init(avctx, mdct, nbits - 2);\n\n if (ret)\n\n return ret;\n\n\n\n mdct->window = ff_ac3_window;\n\n\n\n FF_ALLOC_OR_GOTO(avctx, mdct->xcos1, n4 * sizeof(*mdct->xcos1), mdct_alloc_fail);\n\n FF_ALLOC_OR_GOTO(avctx, mdct->xsin1, n4 * sizeof(*mdct->xsin1), mdct_alloc_fail);\n\n FF_ALLOC_OR_GOTO(avctx, mdct->rot_tmp, n * sizeof(*mdct->rot_tmp), mdct_alloc_fail);\n\n FF_ALLOC_OR_GOTO(avctx, mdct->cplx_tmp, n4 * sizeof(*mdct->cplx_tmp), mdct_alloc_fail);\n\n\n\n for (i = 0; i < n4; i++) {\n\n float alpha = 2.0 * M_PI * (i + 1.0 / 8.0) / n;\n\n mdct->xcos1[i] = FIX15(-cos(alpha));\n\n mdct->xsin1[i] = FIX15(-sin(alpha));\n\n }\n\n\n\n return 0;\n\nmdct_alloc_fail:\n\n mdct_end(mdct);\n\n return AVERROR(ENOMEM);\n\n}\n"}} {"sample_id": "9005b2a7589540a3733b3abdcfbccfe7746cd1a1_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ return s->chr_write(s, buf, len);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_chr_fe_write(CharDriverState *s, const uint8_t *buf, int len)\n\n{\n\n return s->chr_write(s, buf, len);\n\n}\n"}} {"sample_id": "d8b7e0adf562277180f96ecbd7f1777a384a0308_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n BlockDriverCompletionFunc *cb, void *opaque)\n \n {\n+\n+ return bdrv_aio_writev(bs->file, sector_num, qiov, nb_sectors, cb, opaque);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static BlockDriverAIOCB *raw_aio_writev(BlockDriverState *bs,\n\n int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,\n\n BlockDriverCompletionFunc *cb, void *opaque)\n\n{\n\n return bdrv_aio_writev(bs->file, sector_num, qiov, nb_sectors, cb, opaque);\n\n}\n"}} {"sample_id": "26ef65beab852caf2b1ef4976e3473f2d525164d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n Error *local_err = NULL;\n \n PCMachineState *pcms = PC_MACHINE(hotplug_dev);\n+\n \n \n if (pcms->acpi_dev) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void pc_cpu_plug(HotplugHandler *hotplug_dev,\n\n DeviceState *dev, Error **errp)\n\n{\n\n CPUArchId *found_cpu;\n\n HotplugHandlerClass *hhc;\n\n Error *local_err = NULL;\n\n PCMachineState *pcms = PC_MACHINE(hotplug_dev);\n\n\n\n if (pcms->acpi_dev) {\n\n hhc = HOTPLUG_HANDLER_GET_CLASS(pcms->acpi_dev);\n\n hhc->plug(HOTPLUG_HANDLER(pcms->acpi_dev), dev, &local_err);\n\n if (local_err) {\n\n goto out;\n\n }\n\n }\n\n\n\n /* increment the number of CPUs */\n\n pcms->boot_cpus++;\n\n if (dev->hotplugged) {\n\n rtc_set_cpus_count(pcms->rtc, pcms->boot_cpus);\n\n fw_cfg_modify_i16(pcms->fw_cfg, FW_CFG_NB_CPUS, pcms->boot_cpus);\n\n }\n\n\n\n found_cpu = pc_find_cpu_slot(pcms, CPU(dev), NULL);\n\n found_cpu->cpu = CPU(dev);\n\nout:\n\n error_propagate(errp, local_err);\n\n}\n"}} {"sample_id": "5c6c0e513600ba57c3e73b7151d3c0664438f7b5_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void scsi_req_data(SCSIRequest *req, int len)\n \n+{\n \n trace_scsi_req_data(req->dev->id, req->lun, req->tag, len);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void scsi_req_data(SCSIRequest *req, int len)\n\n{\n\n trace_scsi_req_data(req->dev->id, req->lun, req->tag, len);\n\n req->bus->ops->complete(req->bus, SCSI_REASON_DATA, req->tag, len);\n\n}\n"}} {"sample_id": "5fb6c7a8b26eab1a22207d24b4784bd2b39ab54b_18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n size_t len) {\n \n+ struct VncState *vs = (struct VncState *)transport;\n+\n+ int ret;\n+\n+\n \n retry:\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ssize_t vnc_tls_pull(gnutls_transport_ptr_t transport,\n\n void *data,\n\n size_t len) {\n\n struct VncState *vs = (struct VncState *)transport;\n\n int ret;\n\n\n\n retry:\n\n ret = recv(vs->csock, data, len, 0);\n\n if (ret < 0) {\n\n\tif (errno == EINTR)\n\n\t goto retry;\n\n\treturn -1;\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "ddf21908961073199f3d186204da4810f2ea150b_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -44,11 +44,11 @@\n \n info->base->service = g_strdup(serv);\n \n+ info->base->family = inet_netfamily(sa.ss_family);\n+\n+ info->base->websocket = client->websocket;\n+\n+\n \n if (client->tls) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static VncClientInfo *qmp_query_vnc_client(const VncState *client)\n\n{\n\n struct sockaddr_storage sa;\n\n socklen_t salen = sizeof(sa);\n\n char host[NI_MAXHOST];\n\n char serv[NI_MAXSERV];\n\n VncClientInfo *info;\n\n\n\n if (getpeername(client->csock, (struct sockaddr *)&sa, &salen) < 0) {\n\n return NULL;\n\n }\n\n\n\n if (getnameinfo((struct sockaddr *)&sa, salen,\n\n host, sizeof(host),\n\n serv, sizeof(serv),\n\n NI_NUMERICHOST | NI_NUMERICSERV) < 0) {\n\n return NULL;\n\n }\n\n\n\n info = g_malloc0(sizeof(*info));\n\n info->base = g_malloc0(sizeof(*info->base));\n\n info->base->host = g_strdup(host);\n\n info->base->service = g_strdup(serv);\n\n info->base->family = inet_netfamily(sa.ss_family);\n\n info->base->websocket = client->websocket;\n\n\n\n if (client->tls) {\n\n info->x509_dname = qcrypto_tls_session_get_peer_name(client->tls);\n\n info->has_x509_dname = info->x509_dname != NULL;\n\n }\n\n#ifdef CONFIG_VNC_SASL\n\n if (client->sasl.conn && client->sasl.username) {\n\n info->has_sasl_username = true;\n\n info->sasl_username = g_strdup(client->sasl.username);\n\n }\n\n#endif\n\n\n\n return info;\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_64", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n block_acct_done(bdrv_get_stats(n->conf.bs), &req->acct);\n \n+ if (!ret) {\n+\n+ req->status = NVME_SUCCESS;\n+\n+ } else {\n \n req->status = NVME_INTERNAL_DEV_ERROR;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void nvme_rw_cb(void *opaque, int ret)\n\n{\n\n NvmeRequest *req = opaque;\n\n NvmeSQueue *sq = req->sq;\n\n NvmeCtrl *n = sq->ctrl;\n\n NvmeCQueue *cq = n->cq[sq->cqid];\n\n\n\n block_acct_done(bdrv_get_stats(n->conf.bs), &req->acct);\n\n if (!ret) {\n\n req->status = NVME_SUCCESS;\n\n } else {\n\n req->status = NVME_INTERNAL_DEV_ERROR;\n\n }\n\n\n\n qemu_sglist_destroy(&req->qsg);\n\n nvme_enqueue_req_completion(cq, req);\n\n}\n"}} {"sample_id": "323e6fead07c75f418e4b60704a4f437bb3483b2_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,13 +5,13 @@\n int blk, ch, i;\n \n \n+\n for (ch = 0; ch < s->channels; ch++) {\n \n for (blk = 0; blk < AC3_MAX_BLOCKS; blk++) {\n \n AC3Block *block = &s->blocks[blk];\n+\n uint8_t *exp = block->exp[ch];\n \n int32_t *coef = block->fixed_coef[ch];", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void extract_exponents(AC3EncodeContext *s)\n\n{\n\n int blk, ch, i;\n\n\n\n for (ch = 0; ch < s->channels; ch++) {\n\n for (blk = 0; blk < AC3_MAX_BLOCKS; blk++) {\n\n AC3Block *block = &s->blocks[blk];\n\n uint8_t *exp = block->exp[ch];\n\n int32_t *coef = block->fixed_coef[ch];\n\n int exp_shift = block->exp_shift[ch];\n\n for (i = 0; i < AC3_MAX_COEFS; i++) {\n\n int e;\n\n int v = abs(coef[i]);\n\n if (v == 0)\n\n e = 24;\n\n else {\n\n e = 23 - av_log2(v) + exp_shift;\n\n if (e >= 24) {\n\n e = 24;\n\n coef[i] = 0;\n\n }\n\n av_assert2(e >= 0);\n\n }\n\n exp[i] = e;\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "ca203e9985cd2dcf42a0c0853940850d3a8edf3a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n memcpy(ctx->bands, bands, sizeof(ctx->bands[0]) * num_lens);\n \n memcpy(ctx->num_bands, num_bands, sizeof(ctx->num_bands[0]) * num_lens);\n+\n+\n+\n+ /* assign channels to groups (with virtual channels for coupling) */\n+\n for (i = 0; i < num_groups; i++) {\n \n /* NOTE: Add 1 to handle the AAC chan_config without modification.", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "av_cold int ff_psy_init(FFPsyContext *ctx, AVCodecContext *avctx, int num_lens,\n\n const uint8_t **bands, const int* num_bands,\n\n int num_groups, const uint8_t *group_map)\n\n{\n\n int i, j, k = 0;\n\n\n\n ctx->avctx = avctx;\n\n ctx->ch = av_mallocz_array(sizeof(ctx->ch[0]), avctx->channels * 2);\n\n ctx->group = av_mallocz_array(sizeof(ctx->group[0]), num_groups);\n\n ctx->bands = av_malloc_array (sizeof(ctx->bands[0]), num_lens);\n\n ctx->num_bands = av_malloc_array (sizeof(ctx->num_bands[0]), num_lens);\n\n\n\n\n if (!ctx->ch || !ctx->group || !ctx->bands || !ctx->num_bands) {\n\n ff_psy_end(ctx);\n\n return AVERROR(ENOMEM);\n\n }\n\n\n\n memcpy(ctx->bands, bands, sizeof(ctx->bands[0]) * num_lens);\n\n memcpy(ctx->num_bands, num_bands, sizeof(ctx->num_bands[0]) * num_lens);\n\n\n\n /* assign channels to groups (with virtual channels for coupling) */\n\n for (i = 0; i < num_groups; i++) {\n\n /* NOTE: Add 1 to handle the AAC chan_config without modification.\n\n * This has the side effect of allowing an array of 0s to map\n\n * to one channel per group.\n\n */\n\n ctx->group[i].num_ch = group_map[i] + 1;\n\n for (j = 0; j < ctx->group[i].num_ch * 2; j++)\n\n ctx->group[i].ch[j] = &ctx->ch[k++];\n\n }\n\n\n\n switch (ctx->avctx->codec_id) {\n\n case AV_CODEC_ID_AAC:\n\n ctx->model = &ff_aac_psy_model;\n\n break;\n\n }\n\n if (ctx->model->init)\n\n return ctx->model->init(ctx);\n\n return 0;\n\n}"}} {"sample_id": "bc7e128a6e8e2a79d0ff7cab5e8a799b3ea042ea", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n AVStream *st = s->streams[0];\n if (avio_read(pb, preamble, AUD_CHUNK_PREAMBLE_SIZE) !=\n AUD_CHUNK_PREAMBLE_SIZE)\n+ return AVERROR(EIO);\n+ /* validate the chunk */\n+ if (AV_RL32(&preamble[4]) != AUD_CHUNK_SIGNATURE)\n+ chunk_size = AV_RL16(&preamble[0]);\n+ if (st->codecpar->codec_id == AV_CODEC_ID_WESTWOOD_SND1) {\n /* For Westwood SND1 audio we need to add the output size and input\n size to the start of the packet to match what is in VQA.\n Specifically, this is needed to signal when a packet should be", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int wsaud_read_packet(AVFormatContext *s,\n AVPacket *pkt)\n{\n AVIOContext *pb = s->pb;\n unsigned char preamble[AUD_CHUNK_PREAMBLE_SIZE];\n unsigned int chunk_size;\n int ret = 0;\n AVStream *st = s->streams[0];\n if (avio_read(pb, preamble, AUD_CHUNK_PREAMBLE_SIZE) !=\n AUD_CHUNK_PREAMBLE_SIZE)\n return AVERROR(EIO);\n /* validate the chunk */\n if (AV_RL32(&preamble[4]) != AUD_CHUNK_SIGNATURE)\n chunk_size = AV_RL16(&preamble[0]);\n if (st->codecpar->codec_id == AV_CODEC_ID_WESTWOOD_SND1) {\n /* For Westwood SND1 audio we need to add the output size and input\n size to the start of the packet to match what is in VQA.\n Specifically, this is needed to signal when a packet should be\n decoding as raw 8-bit pcm or variable-size ADPCM. */\n int out_size = AV_RL16(&preamble[2]);\n if ((ret = av_new_packet(pkt, chunk_size + 4)) < 0)\n return ret;\n if ((ret = avio_read(pb, &pkt->data[4], chunk_size)) != chunk_size)\n return ret < 0 ? ret : AVERROR(EIO);\n AV_WL16(&pkt->data[0], out_size);\n AV_WL16(&pkt->data[2], chunk_size);\n pkt->duration = out_size;\n } else {\n ret = av_get_packet(pb, pkt, chunk_size);\n if (ret != chunk_size)\n return AVERROR(EIO);\n /* 2 samples/byte, 1 or 2 samples per frame depending on stereo */\n pkt->duration = (chunk_size * 2) / st->codecpar->channels;\n pkt->stream_index = st->index;\n return ret;"}} {"sample_id": "b172c56a6d849554f7e43adc95983a9d6c042689_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n /* Create new timer */\n \n tb_env->decr_timer = qemu_new_timer(vm_clock, &cpu_ppc_decr_cb, env);\n+\n+#if defined(TARGET_PPC64H)\n+\n+ tb_env->hdecr_timer = qemu_new_timer(vm_clock, &cpu_ppc_hdecr_cb, env);\n+\n #endif /* defined(TARGET_PPC64H) */\n \n cpu_ppc_set_tb_clk(env, freq);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "clk_setup_cb cpu_ppc_tb_init (CPUState *env, uint32_t freq)\n\n{\n\n ppc_tb_t *tb_env;\n\n\n\n tb_env = qemu_mallocz(sizeof(ppc_tb_t));\n\n if (tb_env == NULL)\n\n return NULL;\n\n env->tb_env = tb_env;\n\n /* Create new timer */\n\n tb_env->decr_timer = qemu_new_timer(vm_clock, &cpu_ppc_decr_cb, env);\n\n#if defined(TARGET_PPC64H)\n\n tb_env->hdecr_timer = qemu_new_timer(vm_clock, &cpu_ppc_hdecr_cb, env);\n\n#endif /* defined(TARGET_PPC64H) */\n\n cpu_ppc_set_tb_clk(env, freq);\n\n\n\n return &cpu_ppc_set_tb_clk;\n\n}\n"}} {"sample_id": "0b8b8753e4d94901627b3e86431230f2319215c4_37", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,8 +5,8 @@\n {\n \n Coroutine *co;\n+\n+ CoWriteZeroes data = {\n \n .blk = blk,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int do_co_pwrite_zeroes(BlockBackend *blk, int64_t offset,\n\n int64_t count, int flags, int64_t *total)\n\n{\n\n Coroutine *co;\n\n CoWriteZeroes data = {\n\n .blk = blk,\n\n .offset = offset,\n\n .count = count,\n\n .total = total,\n\n .flags = flags,\n\n .done = false,\n\n };\n\n\n\n if (count >> BDRV_SECTOR_BITS > INT_MAX) {\n\n return -ERANGE;\n\n }\n\n\n\n co = qemu_coroutine_create(co_pwrite_zeroes_entry);\n\n qemu_coroutine_enter(co, &data);\n\n while (!data.done) {\n\n aio_poll(blk_get_aio_context(blk), true);\n\n }\n\n if (data.ret < 0) {\n\n return data.ret;\n\n } else {\n\n return 1;\n\n }\n\n}\n"}} {"sample_id": "bd269ebc82fbaa5fe7ce5bc7c1770ac8acecd884_30", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n }\n \n /* TODO SOCKET_ADDRESS_LEGACY_KIND_FD when fd has AF_UNIX */\n+\n+ vd->is_unix = saddr[0]->type == SOCKET_ADDRESS_LEGACY_KIND_UNIX;\n+\n+ sioc = qio_channel_socket_new();\n+\n qio_channel_set_name(QIO_CHANNEL(sioc), \"vnc-reverse\");\n \n if (qio_channel_socket_connect_sync(sioc, saddr[0], errp) < 0) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int vnc_display_connect(VncDisplay *vd,\n\n SocketAddressLegacy **saddr,\n\n size_t nsaddr,\n\n SocketAddressLegacy **wsaddr,\n\n size_t nwsaddr,\n\n Error **errp)\n\n{\n\n /* connect to viewer */\n\n QIOChannelSocket *sioc = NULL;\n\n if (nwsaddr != 0) {\n\n error_setg(errp, \"Cannot use websockets in reverse mode\");\n\n return -1;\n\n }\n\n if (nsaddr != 1) {\n\n error_setg(errp, \"Expected a single address in reverse mode\");\n\n return -1;\n\n }\n\n /* TODO SOCKET_ADDRESS_LEGACY_KIND_FD when fd has AF_UNIX */\n\n vd->is_unix = saddr[0]->type == SOCKET_ADDRESS_LEGACY_KIND_UNIX;\n\n sioc = qio_channel_socket_new();\n\n qio_channel_set_name(QIO_CHANNEL(sioc), \"vnc-reverse\");\n\n if (qio_channel_socket_connect_sync(sioc, saddr[0], errp) < 0) {\n\n return -1;\n\n }\n\n vnc_connect(vd, sioc, false, false);\n\n object_unref(OBJECT(sioc));\n\n return 0;\n\n}\n"}} {"sample_id": "3872425343439555e543cd606c44a79dbcc168d4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n if (addrlen < 0)\n \n return -TARGET_EINVAL;\n+\n+\n+\n+ addr = alloca(addrlen+1);\n+\n \n \n ret = target_to_host_sockaddr(addr, target_addr, addrlen);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static abi_long do_bind(int sockfd, abi_ulong target_addr,\n\n socklen_t addrlen)\n\n{\n\n void *addr;\n\n abi_long ret;\n\n\n\n if (addrlen < 0)\n\n return -TARGET_EINVAL;\n\n\n\n addr = alloca(addrlen+1);\n\n\n\n ret = target_to_host_sockaddr(addr, target_addr, addrlen);\n\n if (ret)\n\n return ret;\n\n\n\n return get_errno(bind(sockfd, addr, addrlen));\n\n}\n"}} {"sample_id": "364031f17932814484657e5551ba12957d993d7e_17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -40,8 +40,8 @@\n \n v9fs_synth_direntry(node, entry, off);\n \n+ *result = entry;\n+\n+ return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int v9fs_synth_get_dentry(V9fsSynthNode *dir, struct dirent *entry,\n\n struct dirent **result, off_t off)\n\n{\n\n int i = 0;\n\n V9fsSynthNode *node;\n\n\n\n rcu_read_lock();\n\n QLIST_FOREACH(node, &dir->child, sibling) {\n\n /* This is the off child of the directory */\n\n if (i == off) {\n\n break;\n\n }\n\n i++;\n\n }\n\n rcu_read_unlock();\n\n if (!node) {\n\n /* end of directory */\n\n *result = NULL;\n\n return 0;\n\n }\n\n v9fs_synth_direntry(node, entry, off);\n\n *result = entry;\n\n return 0;\n\n}\n"}} {"sample_id": "4d1628e832dfc6ec02b0d196f6cc250aaa7bf3b3_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+uint64_t helper_addqv(CPUAlphaState *env, uint64_t op1, uint64_t op2)\n+\n+{\n+\n+ uint64_t tmp = op1;\n \n+ op1 += op2;\n \n if (unlikely((tmp ^ op2 ^ (-1ULL)) & (tmp ^ op1) & (1ULL << 63))) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "uint64_t helper_addqv(CPUAlphaState *env, uint64_t op1, uint64_t op2)\n\n{\n\n uint64_t tmp = op1;\n\n op1 += op2;\n\n if (unlikely((tmp ^ op2 ^ (-1ULL)) & (tmp ^ op1) & (1ULL << 63))) {\n\n arith_excp(env, GETPC(), EXC_M_IOV, 0);\n\n }\n\n return op1;\n\n}\n"}} {"sample_id": "4a1418e07bdcfaa3177739e04707ecaec75d89e1_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void kqemu_flush(CPUState *env, int global)\n+\n+{\n \n LOG_INT(\"kqemu_flush:\\n\");\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void kqemu_flush(CPUState *env, int global)\n\n{\n\n LOG_INT(\"kqemu_flush:\\n\");\n\n nb_pages_to_flush = KQEMU_FLUSH_ALL;\n\n}\n"}} {"sample_id": "6796a1dd8c14843b77925cb83a3ef88706ae1dd0_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void ff_put_h264_qpel8_mc03_msa(uint8_t *dst, const uint8_t *src,\n \n+ ptrdiff_t stride)\n+\n {\n \n avc_luma_vt_qrt_8w_msa(src - (stride * 2), stride, dst, stride, 8, 1);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_put_h264_qpel8_mc03_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n avc_luma_vt_qrt_8w_msa(src - (stride * 2), stride, dst, stride, 8, 1);\n\n}\n"}} {"sample_id": "8dfbaa6ac450c4ec2646b1ca08a4017052a90c1d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -49,11 +49,11 @@\n while (--n >= 0) {\n \n if (!virtio_queue_get_num(vdev, n)) {\n+\n+ continue;\n+\n+ }\n+\n r = virtio_ccw_set_guest2host_notifier(dev, n, false, false);\n \n assert(r >= 0);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_ccw_start_ioeventfd(VirtioCcwDevice *dev)\n\n{\n\n VirtIODevice *vdev;\n\n int n, r;\n\n\n\n if (!(dev->flags & VIRTIO_CCW_FLAG_USE_IOEVENTFD) ||\n\n dev->ioeventfd_disabled ||\n\n dev->ioeventfd_started) {\n\n return;\n\n }\n\n vdev = virtio_bus_get_device(&dev->bus);\n\n for (n = 0; n < VIRTIO_PCI_QUEUE_MAX; n++) {\n\n if (!virtio_queue_get_num(vdev, n)) {\n\n continue;\n\n }\n\n r = virtio_ccw_set_guest2host_notifier(dev, n, true, true);\n\n if (r < 0) {\n\n goto assign_error;\n\n }\n\n }\n\n dev->ioeventfd_started = true;\n\n return;\n\n\n\n assign_error:\n\n while (--n >= 0) {\n\n if (!virtio_queue_get_num(vdev, n)) {\n\n continue;\n\n }\n\n r = virtio_ccw_set_guest2host_notifier(dev, n, false, false);\n\n assert(r >= 0);\n\n }\n\n dev->ioeventfd_started = false;\n\n /* Disable ioeventfd for this device. */\n\n dev->flags &= ~VIRTIO_CCW_FLAG_USE_IOEVENTFD;\n\n error_report(\"%s: failed. Fallback to userspace (slower).\", __func__);\n\n}\n"}} {"sample_id": "6e0d8c06c7af61859e8d7bc2351a607d8abeab75_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n video_qmax = atoi(arg);\n+\n+ if (video_qmax < 0 ||\n+\n+ video_qmax > 31) {\n \n fprintf(stderr, \"qmax must be >= 1 and <= 31\\n\");\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void opt_qmax(const char *arg)\n\n{\n\n video_qmax = atoi(arg);\n\n if (video_qmax < 0 ||\n\n video_qmax > 31) {\n\n fprintf(stderr, \"qmax must be >= 1 and <= 31\\n\");\n\n exit(1);\n\n }\n\n}\n"}} {"sample_id": "4b236b621bf090509c4a0be372edfd31d13b289a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n \n \n+ tb_env = g_malloc0(sizeof(ppc_tb_t));\n \n env->tb_env = tb_env;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "clk_setup_cb cpu_ppc_tb_init (CPUPPCState *env, uint32_t freq)\n\n{\n\n PowerPCCPU *cpu = ppc_env_get_cpu(env);\n\n ppc_tb_t *tb_env;\n\n\n\n tb_env = g_malloc0(sizeof(ppc_tb_t));\n\n env->tb_env = tb_env;\n\n tb_env->flags = PPC_DECR_UNDERFLOW_TRIGGERED;\n\n if (env->insns_flags & PPC_SEGMENT_64B) {\n\n /* All Book3S 64bit CPUs implement level based DEC logic */\n\n tb_env->flags |= PPC_DECR_UNDERFLOW_LEVEL;\n\n }\n\n /* Create new timer */\n\n tb_env->decr_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, &cpu_ppc_decr_cb, cpu);\n\n if (0) {\n\n /* XXX: find a suitable condition to enable the hypervisor decrementer\n\n */\n\n tb_env->hdecr_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, &cpu_ppc_hdecr_cb,\n\n cpu);\n\n } else {\n\n tb_env->hdecr_timer = NULL;\n\n }\n\n cpu_ppc_set_tb_clk(env, freq);\n\n\n\n return &cpu_ppc_set_tb_clk;\n\n}\n"}} {"sample_id": "0479097859372a760843ad1b9c6ed3705c6423ca_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n DeviceState *dev, Error **errp)\n \n {\n+\n+ sPAPRMachineState *spapr = SPAPR_MACHINE(hotplug_dev);\n+\n+ Error *local_err = NULL;\n \n PCDIMMDevice *dimm = PC_DIMM(dev);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void spapr_memory_unplug_request(HotplugHandler *hotplug_dev,\n\n DeviceState *dev, Error **errp)\n\n{\n\n sPAPRMachineState *spapr = SPAPR_MACHINE(hotplug_dev);\n\n Error *local_err = NULL;\n\n PCDIMMDevice *dimm = PC_DIMM(dev);\n\n PCDIMMDeviceClass *ddc = PC_DIMM_GET_CLASS(dimm);\n\n MemoryRegion *mr = ddc->get_memory_region(dimm);\n\n uint64_t size = memory_region_size(mr);\n\n uint32_t nr_lmbs = size / SPAPR_MEMORY_BLOCK_SIZE;\n\n uint64_t addr_start, addr;\n\n int i;\n\n sPAPRDRConnector *drc;\n\n addr_start = object_property_get_uint(OBJECT(dimm), PC_DIMM_ADDR_PROP,\n\n &local_err);\n\n if (local_err) {\n\n goto out;\n\n }\n\n\n\n spapr_pending_dimm_unplugs_add(spapr, nr_lmbs, dimm);\n\n\n\n addr = addr_start;\n\n for (i = 0; i < nr_lmbs; i++) {\n\n drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB,\n\n addr / SPAPR_MEMORY_BLOCK_SIZE);\n\n g_assert(drc);\n\n\n\n spapr_drc_detach(drc);\n\n addr += SPAPR_MEMORY_BLOCK_SIZE;\n\n }\n\n\n\n drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB,\n\n addr_start / SPAPR_MEMORY_BLOCK_SIZE);\n\n spapr_hotplug_req_remove_by_count_indexed(SPAPR_DR_CONNECTOR_TYPE_LMB,\n\n nr_lmbs, spapr_drc_index(drc));\n\nout:\n\n error_propagate(errp, local_err);\n\n}\n"}} {"sample_id": "6b728b31163bbd0788fe7d537931c4624cd24215", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void verify_irqchip_in_kernel(Error **errp)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void verify_irqchip_in_kernel(Error **errp)\n\n{\n\n if (kvm_irqchip_in_kernel()) {\n\n return;\n\n }\n\n error_setg(errp, \"pci-assign requires KVM with in-kernel irqchip enabled\");\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_37", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,8 +8,8 @@\n \n QLIST_FOREACH(timer_list, &clock->timerlists, list) {\n \n+ timerlist_notify(timer_list);\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_clock_notify(QEMUClockType type)\n\n{\n\n QEMUTimerList *timer_list;\n\n QEMUClock *clock = qemu_clock_ptr(type);\n\n QLIST_FOREACH(timer_list, &clock->timerlists, list) {\n\n timerlist_notify(timer_list);\n\n }\n\n}\n"}} {"sample_id": "486637af8ef29ec215e0e0b7ecd3b5470f0e04e5_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ return ((float) (mantissa * scale_factors[exp]));\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline float to_float(uint8_t exp, int16_t mantissa)\n\n{\n\n return ((float) (mantissa * scale_factors[exp]));\n\n}\n"}} {"sample_id": "ab3ad07f89c7f9e03c17c98e1d1a02dbf61c605c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n if (type != E820_RAM) {\n \n /* old FW_CFG_E820_TABLE entry -- reservations only */\n+\n if (index >= E820_NR_ENTRIES) {\n \n return -EBUSY;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int e820_add_entry(uint64_t address, uint64_t length, uint32_t type)\n\n{\n\n int index = le32_to_cpu(e820_reserve.count);\n\n struct e820_entry *entry;\n\n\n\n if (type != E820_RAM) {\n\n /* old FW_CFG_E820_TABLE entry -- reservations only */\n\n if (index >= E820_NR_ENTRIES) {\n\n return -EBUSY;\n\n }\n\n entry = &e820_reserve.entry[index++];\n\n\n\n entry->address = cpu_to_le64(address);\n\n entry->length = cpu_to_le64(length);\n\n entry->type = cpu_to_le32(type);\n\n\n\n e820_reserve.count = cpu_to_le32(index);\n\n }\n\n\n\n /* new \"etc/e820\" file -- include ram too */\n\n e820_table = g_realloc(e820_table,\n\n sizeof(struct e820_entry) * (e820_entries+1));\n\n e820_table[e820_entries].address = cpu_to_le64(address);\n\n e820_table[e820_entries].length = cpu_to_le64(length);\n\n e820_table[e820_entries].type = cpu_to_le32(type);\n\n e820_entries++;\n\n\n\n return e820_entries;\n\n}\n"}} {"sample_id": "22bfa75eafc21522afbb265091faa9cc0649e9fb_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n /* non-idle bottom halves will be executed\n \n * immediately */\n+\n+ *timeout = 0;\n+\n+ break;\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void aio_bh_update_timeout(AioContext *ctx, uint32_t *timeout)\n\n{\n\n QEMUBH *bh;\n\n\n\n for (bh = ctx->first_bh; bh; bh = bh->next) {\n\n if (!bh->deleted && bh->scheduled) {\n\n if (bh->idle) {\n\n /* idle bottom halves will be polled at least\n\n * every 10ms */\n\n *timeout = MIN(10, *timeout);\n\n } else {\n\n /* non-idle bottom halves will be executed\n\n * immediately */\n\n *timeout = 0;\n\n break;\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "f3a06403b82c7f036564e4caf18b52ce6885fcfb_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n GuestFileHandle *gfh;\n \n int64_t handle;\n+\n \n \n handle = ga_get_fd_handle(ga_state, errp);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int64_t guest_file_handle_add(HANDLE fh, Error **errp)\n\n{\n\n GuestFileHandle *gfh;\n\n int64_t handle;\n\n\n\n handle = ga_get_fd_handle(ga_state, errp);\n\n if (handle < 0) {\n\n return -1;\n\n }\n\n gfh = g_malloc0(sizeof(GuestFileHandle));\n\n gfh->id = handle;\n\n gfh->fh = fh;\n\n QTAILQ_INSERT_TAIL(&guest_file_state.filehandles, gfh, next);\n\n\n\n return handle;\n\n}\n"}} {"sample_id": "c5e6fb7e4ac6e7083682e7f45d27d1e73b3a1a97_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static void ebus_mmio_mapfunc(PCIDevice *pci_dev, int region_num,\n+\n+ pcibus_t addr, pcibus_t size, int type)\n+\n+{\n+\n EBUS_DPRINTF(\"Mapping region %d registers at %\" FMT_PCIBUS \"\\n\",\n \n region_num, addr);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void ebus_mmio_mapfunc(PCIDevice *pci_dev, int region_num,\n\n pcibus_t addr, pcibus_t size, int type)\n\n{\n\n EBUS_DPRINTF(\"Mapping region %d registers at %\" FMT_PCIBUS \"\\n\",\n\n region_num, addr);\n\n switch (region_num) {\n\n case 0:\n\n isa_mmio_init(addr, 0x1000000);\n\n break;\n\n case 1:\n\n isa_mmio_init(addr, 0x800000);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "8ec14402029d783720f4312ed8a925548e1dad61", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n if (packet_enqueue(s, PRIMARY_IN)) {\n \n+ trace_colo_compare_main(\"primary: unsupported packet in\");\n+\n+ compare_chr_send(s,\n+\n+ pri_rs->buf,\n \n pri_rs->packet_len,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void compare_pri_rs_finalize(SocketReadState *pri_rs)\n\n{\n\n CompareState *s = container_of(pri_rs, CompareState, pri_rs);\n\n\n\n if (packet_enqueue(s, PRIMARY_IN)) {\n\n trace_colo_compare_main(\"primary: unsupported packet in\");\n\n compare_chr_send(s,\n\n pri_rs->buf,\n\n pri_rs->packet_len,\n\n pri_rs->vnet_hdr_len);\n\n } else {\n\n /* compare connection */\n\n g_queue_foreach(&s->conn_list, colo_compare_connection, s);\n\n }\n\n}\n"}} {"sample_id": "7d1476898fd58d6ae5c054e6afddf18c335d9d89", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n s->sssr |= SSSR_TFS;\n \n+ else\n+\n+ s->sssr &= ~SSSR_TFS;\n+\n+ if (s->rx_level)\n \n s->sssr |= SSSR_RNE;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pxa2xx_ssp_fifo_update(PXA2xxSSPState *s)\n\n{\n\n s->sssr &= ~(0xf << 12);\t/* Clear RFL */\n\n s->sssr &= ~(0xf << 8);\t/* Clear TFL */\n\n s->sssr &= ~SSSR_TNF;\n\n if (s->enable) {\n\n s->sssr |= ((s->rx_level - 1) & 0xf) << 12;\n\n if (s->rx_level >= SSCR1_RFT(s->sscr[1]))\n\n s->sssr |= SSSR_RFS;\n\n else\n\n s->sssr &= ~SSSR_RFS;\n\n if (0 <= SSCR1_TFT(s->sscr[1]))\n\n s->sssr |= SSSR_TFS;\n\n else\n\n s->sssr &= ~SSSR_TFS;\n\n if (s->rx_level)\n\n s->sssr |= SSSR_RNE;\n\n else\n\n s->sssr &= ~SSSR_RNE;\n\n s->sssr |= SSSR_TNF;\n\n }\n\n\n\n pxa2xx_ssp_int_update(s);\n\n}\n"}} {"sample_id": "6481a36010d8f7d834676f17ba555d0a3815c760", "diff": "--- a/source.c\n+++ b/source.c\n@@ -50,11 +50,11 @@\n \n level_buf[i] = level;\n \n+ run_buf[i] = run;\n+\n+ }\n+\n+ if(dequant(h,level_buf, run_buf, block, ff_cavs_dequant_mul[qp],\n \n ff_cavs_dequant_shift[qp], i))\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int decode_residual_block(AVSContext *h, GetBitContext *gb,\n\n const struct dec_2dvlc *r, int esc_golomb_order,\n\n int qp, uint8_t *dst, int stride) {\n\n int i, level_code, esc_code, level, run, mask;\n\n DCTELEM level_buf[65];\n\n uint8_t run_buf[65];\n\n DCTELEM *block = h->block;\n\n\n\n for(i=0;i<65;i++) {\n\n level_code = get_ue_code(gb,r->golomb_order);\n\n if(level_code >= ESCAPE_CODE) {\n\n run = ((level_code - ESCAPE_CODE) >> 1) + 1;\n\n esc_code = get_ue_code(gb,esc_golomb_order);\n\n level = esc_code + (run > r->max_run ? 1 : r->level_add[run]);\n\n while(level > r->inc_limit)\n\n r++;\n\n mask = -(level_code & 1);\n\n level = (level^mask) - mask;\n\n } else {\n\n level = r->rltab[level_code][0];\n\n if(!level) //end of block signal\n\n break;\n\n run = r->rltab[level_code][1];\n\n r += r->rltab[level_code][2];\n\n }\n\n level_buf[i] = level;\n\n run_buf[i] = run;\n\n }\n\n if(dequant(h,level_buf, run_buf, block, ff_cavs_dequant_mul[qp],\n\n ff_cavs_dequant_shift[qp], i))\n\n return -1;\n\n h->cdsp.cavs_idct8_add(dst,block,stride);\n\n h->s.dsp.clear_block(block);\n\n return 0;\n\n}\n"}} {"sample_id": "e3751aa6ec8147ab7ca2649d4daadf8d4dce27d5_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n \n \n+ if (buf_size < avctx->block_align) {\n+\n+ av_log(avctx, AV_LOG_ERROR,\n+\n+ \"Error! Input buffer is too small [%d<%d]\\n\",\n \n buf_size, avctx->block_align);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ra288_decode_frame(AVCodecContext * avctx, void *data,\n\n int *data_size, const uint8_t * buf,\n\n int buf_size)\n\n{\n\n int16_t *out = data;\n\n int i, j;\n\n RA288Context *ractx = avctx->priv_data;\n\n GetBitContext gb;\n\n\n\n if (buf_size < avctx->block_align) {\n\n av_log(avctx, AV_LOG_ERROR,\n\n \"Error! Input buffer is too small [%d<%d]\\n\",\n\n buf_size, avctx->block_align);\n\n return 0;\n\n }\n\n\n\n init_get_bits(&gb, buf, avctx->block_align * 8);\n\n\n\n for (i=0; i < 32; i++) {\n\n float gain = amptable[get_bits(&gb, 3)];\n\n int cb_coef = get_bits(&gb, 6 + (i&1));\n\n\n\n decode(ractx, gain, cb_coef);\n\n\n\n for (j=0; j < 5; j++)\n\n *(out++) = 8 * ractx->sp_block[4 - j];\n\n\n\n if ((i & 7) == 3)\n\n backward_filter(ractx);\n\n }\n\n\n\n *data_size = (char *)out - (char *)data;\n\n return avctx->block_align;\n\n}\n"}} {"sample_id": "03010579835a17450693888f8b35a66817668d68_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n uint32_t addr = le32_to_cpu(data->fadt_table.dsdt);\n \n+\n+\n+ test_dst_table(&dsdt_table, addr);\n+\n+ ACPI_ASSERT_CMP(dsdt_table.header.signature, \"DSDT\");\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_acpi_dsdt_table(test_data *data)\n\n{\n\n AcpiSdtTable dsdt_table;\n\n uint32_t addr = le32_to_cpu(data->fadt_table.dsdt);\n\n\n\n test_dst_table(&dsdt_table, addr);\n\n ACPI_ASSERT_CMP(dsdt_table.header.signature, \"DSDT\");\n\n\n\n /* Since DSDT isn't in RSDT, add DSDT to ASL test tables list manually */\n\n g_array_append_val(data->tables, dsdt_table);\n\n}\n"}} {"sample_id": "76d8c77430e9e0110623705bfb54d922cc2ac3ea", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int decode_interrupt_cb(void *ctx)\n+\n {\n \n return received_nb_signals > transcode_init_done;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int decode_interrupt_cb(void *ctx)\n\n{\n\n return received_nb_signals > transcode_init_done;\n\n}\n"}} {"sample_id": "ba4bcb191aa8b5fa66131544bf9ebf1f17ff7d9a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ av_log_set_level(AV_LOG_DEBUG);\n+\n return opt_default(NULL, opt, arg);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int opt_codec_debug(void *optctx, const char *opt, const char *arg)\n\n{\n\n av_log_set_level(AV_LOG_DEBUG);\n\n return opt_default(NULL, opt, arg);\n\n}\n"}} {"sample_id": "48ce11ff972c733afaed3e2a2613a2e56081ec92_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -59,9 +59,9 @@\n \n \n if (timeout >= 0 && timeout < *cur_timeout) {\n+\n+ *cur_timeout = timeout;\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void glib_select_fill(int *max_fd, fd_set *rfds, fd_set *wfds,\n\n fd_set *xfds, uint32_t *cur_timeout)\n\n{\n\n GMainContext *context = g_main_context_default();\n\n int i;\n\n int timeout = 0;\n\n\n\n g_main_context_prepare(context, &max_priority);\n\n\n\n n_poll_fds = g_main_context_query(context, max_priority, &timeout,\n\n poll_fds, ARRAY_SIZE(poll_fds));\n\n g_assert(n_poll_fds <= ARRAY_SIZE(poll_fds));\n\n\n\n for (i = 0; i < n_poll_fds; i++) {\n\n GPollFD *p = &poll_fds[i];\n\n\n\n if ((p->events & G_IO_IN)) {\n\n FD_SET(p->fd, rfds);\n\n *max_fd = MAX(*max_fd, p->fd);\n\n }\n\n if ((p->events & G_IO_OUT)) {\n\n FD_SET(p->fd, wfds);\n\n *max_fd = MAX(*max_fd, p->fd);\n\n }\n\n if ((p->events & G_IO_ERR)) {\n\n FD_SET(p->fd, xfds);\n\n *max_fd = MAX(*max_fd, p->fd);\n\n }\n\n }\n\n\n\n if (timeout >= 0 && timeout < *cur_timeout) {\n\n *cur_timeout = timeout;\n\n }\n\n}\n"}} {"sample_id": "e3cffe6fad29e07d401eabb913a6d88501d5c143_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void gen_sync(DisasContext *ctx)\n \n {\n+\n uint32_t l = (ctx->opcode >> 21) & 3;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void gen_sync(DisasContext *ctx)\n\n{\n\n uint32_t l = (ctx->opcode >> 21) & 3;\n\n\n\n /*\n\n * We may need to check for a pending TLB flush.\n\n *\n\n * We do this on ptesync (l == 2) on ppc64 and any sync pn ppc32.\n\n *\n\n * Additionally, this can only happen in kernel mode however so\n\n * check MSR_PR as well.\n\n */\n\n if (((l == 2) || !(ctx->insns_flags & PPC_64B)) && !ctx->pr) {\n\n gen_check_tlb_flush(ctx);\n\n }\n\n}\n"}} {"sample_id": "ac1970fbe8ad5a70174f462109ac0f6c7bf1bc43", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n target_phys_addr_t addr;\n \n+ uint16_t section_index = phys_section_add(section);\n+\n+\n+\n+ assert(size);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void register_multipage(MemoryRegionSection *section)\n\n{\n\n target_phys_addr_t start_addr = section->offset_within_address_space;\n\n ram_addr_t size = section->size;\n\n target_phys_addr_t addr;\n\n uint16_t section_index = phys_section_add(section);\n\n\n\n assert(size);\n\n\n\n addr = start_addr;\n\n phys_page_set(addr >> TARGET_PAGE_BITS, size >> TARGET_PAGE_BITS,\n\n section_index);\n\n}\n"}} {"sample_id": "fcf73f66a67f5e58c18216f8c8651e38cf4d90af", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void qmp_input_type_int(Visitor *v, int64_t *obj, const char *name,\n \n+ Error **errp)\n+\n+{\n \n QmpInputVisitor *qiv = to_qiv(v);\n+\n QObject *qobj = qmp_input_get_object(qiv, name, true);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void qmp_input_type_int(Visitor *v, int64_t *obj, const char *name,\n\n Error **errp)\n\n{\n\n QmpInputVisitor *qiv = to_qiv(v);\n\n QObject *qobj = qmp_input_get_object(qiv, name, true);\n\n\n\n if (!qobj || qobject_type(qobj) != QTYPE_QINT) {\n\n error_setg(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : \"null\",\n\n \"integer\");\n\n return;\n\n }\n\n\n\n *obj = qint_get_int(qobject_to_qint(qobj));\n\n}\n"}} {"sample_id": "d470ad42acfc73c45d3e8ed5311a491160b4c100_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -71,10 +71,10 @@\n if (num < max_transfer) {\n qemu_vfree(iov.iov_base);\n iov.iov_base = NULL;\n+ offset += num;\n+ bytes -= num;\n+fail:\n+ if (ret == 0 && need_flush) {\n+ ret = bdrv_co_flush(bs);\n qemu_vfree(iov.iov_base);\n return ret;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,\n int64_t offset, int bytes, BdrvRequestFlags flags)\n{\n BlockDriver *drv = bs->drv;\n QEMUIOVector qiov;\n struct iovec iov = {0};\n int ret = 0;\n bool need_flush = false;\n int head = 0;\n int tail = 0;\n int max_write_zeroes = MIN_NON_ZERO(bs->bl.max_pwrite_zeroes, INT_MAX);\n int alignment = MAX(bs->bl.pwrite_zeroes_alignment,\n bs->bl.request_alignment);\n int max_transfer = MIN_NON_ZERO(bs->bl.max_transfer, MAX_BOUNCE_BUFFER);\n assert(alignment % bs->bl.request_alignment == 0);\n head = offset % alignment;\n tail = (offset + bytes) % alignment;\n max_write_zeroes = QEMU_ALIGN_DOWN(max_write_zeroes, alignment);\n assert(max_write_zeroes >= bs->bl.request_alignment);\n while (bytes > 0 && !ret) {\n int num = bytes;\n /* Align request. Block drivers can expect the \"bulk\" of the request\n * to be aligned, and that unaligned requests do not cross cluster\n * boundaries.\n */\n if (head) {\n /* Make a small request up to the first aligned sector. For\n * convenience, limit this request to max_transfer even if\n * we don't need to fall back to writes. */\n num = MIN(MIN(bytes, max_transfer), alignment - head);\n head = (head + num) % alignment;\n assert(num < max_write_zeroes);\n } else if (tail && num > alignment) {\n /* Shorten the request to the last aligned sector. */\n num -= tail;\n /* limit request size */\n if (num > max_write_zeroes) {\n num = max_write_zeroes;\n ret = -ENOTSUP;\n /* First try the efficient write zeroes operation */\n if (drv->bdrv_co_pwrite_zeroes) {\n ret = drv->bdrv_co_pwrite_zeroes(bs, offset, num,\n flags & bs->supported_zero_flags);\n if (ret != -ENOTSUP && (flags & BDRV_REQ_FUA) &&\n !(bs->supported_zero_flags & BDRV_REQ_FUA)) {\n need_flush = true;\n } else {\n assert(!bs->supported_zero_flags);\n if (ret == -ENOTSUP) {\n /* Fall back to bounce buffer if write zeroes is unsupported */\n BdrvRequestFlags write_flags = flags & ~BDRV_REQ_ZERO_WRITE;\n if ((flags & BDRV_REQ_FUA) &&\n !(bs->supported_write_flags & BDRV_REQ_FUA)) {\n /* No need for bdrv_driver_pwrite() to do a fallback\n * flush on each chunk; use just one at the end */\n write_flags &= ~BDRV_REQ_FUA;\n need_flush = true;\n num = MIN(num, max_transfer);\n iov.iov_len = num;\n if (iov.iov_base == NULL) {\n iov.iov_base = qemu_try_blockalign(bs, num);\n if (iov.iov_base == NULL) {\n ret = -ENOMEM;\n goto fail;\n memset(iov.iov_base, 0, num);\n qemu_iovec_init_external(&qiov, &iov, 1);\n ret = bdrv_driver_pwritev(bs, offset, num, &qiov, write_flags);\n /* Keep bounce buffer around if it is big enough for all\n * all future requests.\n */\n if (num < max_transfer) {\n qemu_vfree(iov.iov_base);\n iov.iov_base = NULL;\n offset += num;\n bytes -= num;\nfail:\n if (ret == 0 && need_flush) {\n ret = bdrv_co_flush(bs);\n qemu_vfree(iov.iov_base);\n return ret;"}} {"sample_id": "7f526efd17973ec6d2204f7a47b6923e2be31363_21", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+void rgb32tobgr24(const uint8_t *src, uint8_t *dst, unsigned int src_size)\n+\n+{\n \n \tunsigned i;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void rgb32tobgr24(const uint8_t *src, uint8_t *dst, unsigned int src_size)\n\n{\n\n\tunsigned i;\n\n\tunsigned num_pixels = src_size >> 2;\n\n\tfor(i=0; icap_irq_xics_enabled) {\n+\n+ return;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void xics_kvm_cpu_setup(XICSState *xics, PowerPCCPU *cpu)\n\n{\n\n CPUState *cs;\n\n ICPState *ss;\n\n KVMXICSState *xicskvm = XICS_SPAPR_KVM(xics);\n\n\n\n cs = CPU(cpu);\n\n ss = &xics->ss[cs->cpu_index];\n\n\n\n assert(cs->cpu_index < xics->nr_servers);\n\n if (xicskvm->kernel_xics_fd == -1) {\n\n abort();\n\n }\n\n\n\n /*\n\n * If we are reusing a parked vCPU fd corresponding to the CPU\n\n * which was hot-removed earlier we don't have to renable\n\n * KVM_CAP_IRQ_XICS capability again.\n\n */\n\n if (ss->cap_irq_xics_enabled) {\n\n return;\n\n }\n\n\n\n if (xicskvm->kernel_xics_fd != -1) {\n\n int ret;\n\n\n\n ret = kvm_vcpu_enable_cap(cs, KVM_CAP_IRQ_XICS, 0,\n\n xicskvm->kernel_xics_fd,\n\n kvm_arch_vcpu_id(cs));\n\n if (ret < 0) {\n\n error_report(\"Unable to connect CPU%ld to kernel XICS: %s\",\n\n kvm_arch_vcpu_id(cs), strerror(errno));\n\n exit(1);\n\n }\n\n ss->cap_irq_xics_enabled = true;\n\n }\n\n}\n"}} {"sample_id": "b0f74c87a1dbd6b0c5e4de7f1c5cb40197e3fbe9_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n struct menelaus_s *s = (struct menelaus_s *)\n \n+ i2c_slave_init(bus, 0, sizeof(struct menelaus_s));\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "i2c_slave *twl92230_init(i2c_bus *bus, qemu_irq irq)\n\n{\n\n struct menelaus_s *s = (struct menelaus_s *)\n\n i2c_slave_init(bus, 0, sizeof(struct menelaus_s));\n\n\n\n s->i2c.event = menelaus_event;\n\n s->i2c.recv = menelaus_rx;\n\n s->i2c.send = menelaus_tx;\n\n\n\n s->irq = irq;\n\n s->rtc.hz = qemu_new_timer(rt_clock, menelaus_rtc_hz, s);\n\n s->in = qemu_allocate_irqs(menelaus_gpio_set, s, 3);\n\n s->pwrbtn = qemu_allocate_irqs(menelaus_pwrbtn_set, s, 1)[0];\n\n\n\n menelaus_reset(&s->i2c);\n\n\n\n register_savevm(\"menelaus\", -1, 0, menelaus_save, menelaus_load, s);\n\n\n\n return &s->i2c;\n\n}\n"}} {"sample_id": "c364c974d9ab90e25e7887f516da65d2811ba5e3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n PCIBus *bus;\n \n int devfn, rc;\n+\n \n \n /* initialize cap_present for pci_is_express() and pci_config_size() */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int pci_qdev_init(DeviceState *qdev, DeviceInfo *base)\n\n{\n\n PCIDevice *pci_dev = (PCIDevice *)qdev;\n\n PCIDeviceInfo *info = container_of(base, PCIDeviceInfo, qdev);\n\n PCIBus *bus;\n\n int devfn, rc;\n\n\n\n /* initialize cap_present for pci_is_express() and pci_config_size() */\n\n if (info->is_express) {\n\n pci_dev->cap_present |= QEMU_PCI_CAP_EXPRESS;\n\n }\n\n\n\n bus = FROM_QBUS(PCIBus, qdev_get_parent_bus(qdev));\n\n devfn = pci_dev->devfn;\n\n pci_dev = do_pci_register_device(pci_dev, bus, base->name, devfn,\n\n info->config_read, info->config_write,\n\n info->header_type);\n\n assert(pci_dev);\n\n rc = info->init(pci_dev);\n\n if (rc != 0)\n\n return rc;\n\n if (qdev->hotplugged)\n\n bus->hotplug(pci_dev, 1);\n\n return 0;\n\n}\n"}} {"sample_id": "29112db8c0f65886e69cbbd6f4e5c44d2d14d238", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n+static int set_palette(AVFrame * frame, const uint8_t * palette_buffer, int buf_size)\n+\n {\n+\n uint32_t * palette = (uint32_t *)frame->data[1];\n+\n int a;\n+\n \n \n if (buf_size < 256*3)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int set_palette(AVFrame * frame, const uint8_t * palette_buffer, int buf_size)\n\n{\n\n uint32_t * palette = (uint32_t *)frame->data[1];\n\n int a;\n\n\n\n if (buf_size < 256*3)\n\n return AVERROR_INVALIDDATA;\n\n\n\n for(a = 0; a < 256; a++){\n\n palette[a] = AV_RB24(&palette_buffer[a * 3]) * 4;\n\n }\n\n frame->palette_has_changed = 1;\n\n return 256*3;\n\n}\n"}} {"sample_id": "cbe1beb7a1eaa34e0c24b4897395dac017e5d16f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n }\n \n+ if (blkp && !qemu_co_queue_empty(&blkp->throttled_reqs[0])) {\n+\n+ return true;\n+\n+ }\n \n if (blkp && !qemu_co_queue_empty(&blkp->throttled_reqs[1])) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool bdrv_requests_pending(BlockDriverState *bs)\n\n{\n\n BdrvChild *child;\n\n BlockBackendPublic *blkp = bs->blk ? blk_get_public(bs->blk) : NULL;\n\n\n\n if (!QLIST_EMPTY(&bs->tracked_requests)) {\n\n return true;\n\n }\n\n if (blkp && !qemu_co_queue_empty(&blkp->throttled_reqs[0])) {\n\n return true;\n\n }\n\n if (blkp && !qemu_co_queue_empty(&blkp->throttled_reqs[1])) {\n\n return true;\n\n }\n\n\n\n QLIST_FOREACH(child, &bs->children, next) {\n\n if (bdrv_requests_pending(child->bs)) {\n\n return true;\n\n }\n\n }\n\n\n\n return false;\n\n}\n"}} {"sample_id": "7717f248eebdcfe6de400404d0cf65dcb3633308", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void openrisc_pic_cpu_handler(void *opaque, int irq, int level)\n \n {\n+\n OpenRISCCPU *cpu = (OpenRISCCPU *)opaque;\n \n CPUState *cs = CPU(cpu);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void openrisc_pic_cpu_handler(void *opaque, int irq, int level)\n\n{\n\n OpenRISCCPU *cpu = (OpenRISCCPU *)opaque;\n\n CPUState *cs = CPU(cpu);\n\n uint32_t irq_bit = 1 << irq;\n\n\n\n if (irq > 31 || irq < 0) {\n\n return;\n\n }\n\n\n\n if (level) {\n\n cpu->env.picsr |= irq_bit;\n\n } else {\n\n cpu->env.picsr &= ~irq_bit;\n\n }\n\n\n\n if (cpu->env.picsr & cpu->env.picmr) {\n\n cpu_interrupt(cs, CPU_INTERRUPT_HARD);\n\n } else {\n\n cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);\n\n cpu->env.picsr = 0;\n\n }\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_70", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n \n \n+ s->smart_selftest_data = qemu_blockalign(s->bs, 512);\n+\n+ memset(s->smart_selftest_data, 0, 512);\n+\n+\n \n s->sector_write_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ide_init1(IDEBus *bus, int unit)\n\n{\n\n static int drive_serial = 1;\n\n IDEState *s = &bus->ifs[unit];\n\n\n\n s->bus = bus;\n\n s->unit = unit;\n\n s->drive_serial = drive_serial++;\n\n /* we need at least 2k alignment for accessing CDROMs using O_DIRECT */\n\n s->io_buffer_total_len = IDE_DMA_BUF_SECTORS*512 + 4;\n\n s->io_buffer = qemu_memalign(2048, s->io_buffer_total_len);\n\n memset(s->io_buffer, 0, s->io_buffer_total_len);\n\n\n\n s->smart_selftest_data = qemu_blockalign(s->bs, 512);\n\n memset(s->smart_selftest_data, 0, 512);\n\n\n\n s->sector_write_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,\n\n ide_sector_write_timer_cb, s);\n\n}\n"}} {"sample_id": "1f01e50b8330c24714ddca5841fdbb703076b121_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n struct iovec iov = {\n \n+ .iov_base = table->offsets,\n+\n+ .iov_len = s->header.cluster_size * s->header.table_size,\n+\n+ };\n \n qemu_iovec_init_external(&qiov, &iov, 1);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int qed_read_table(BDRVQEDState *s, uint64_t offset, QEDTable *table)\n\n{\n\n QEMUIOVector qiov;\n\n int noffsets;\n\n int i, ret;\n\n\n\n struct iovec iov = {\n\n .iov_base = table->offsets,\n\n .iov_len = s->header.cluster_size * s->header.table_size,\n\n };\n\n qemu_iovec_init_external(&qiov, &iov, 1);\n\n\n\n trace_qed_read_table(s, offset, table);\n\n\n\n ret = bdrv_preadv(s->bs->file, offset, &qiov);\n\n if (ret < 0) {\n\n goto out;\n\n }\n\n\n\n /* Byteswap offsets */\n\n qed_acquire(s);\n\n noffsets = qiov.size / sizeof(uint64_t);\n\n for (i = 0; i < noffsets; i++) {\n\n table->offsets[i] = le64_to_cpu(table->offsets[i]);\n\n }\n\n qed_release(s);\n\n\n\n ret = 0;\n\nout:\n\n /* Completion */\n\n trace_qed_read_table_cb(s, table, ret);\n\n return ret;\n\n}\n"}} {"sample_id": "46232aaacb66733d3e16dcbd0d26c32ec388801d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ ICCDeviceClass *idc = ICC_DEVICE_CLASS(klass);\n+\n+ DeviceClass *dc = DEVICE_CLASS(klass);\n+\n+\n \n dc->vmsd = &vmstate_apic_common;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void apic_common_class_init(ObjectClass *klass, void *data)\n\n{\n\n ICCDeviceClass *idc = ICC_DEVICE_CLASS(klass);\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n\n\n dc->vmsd = &vmstate_apic_common;\n\n dc->reset = apic_reset_common;\n\n dc->props = apic_properties_common;\n\n idc->realize = apic_common_realize;\n\n /*\n\n * Reason: APIC and CPU need to be wired up by\n\n * x86_cpu_apic_create()\n\n */\n\n dc->cannot_instantiate_with_device_add_yet = true;\n\n}\n"}} {"sample_id": "a61c67828dea7c64edaf226cadb45b4ffcc1d411", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n if (!sigterm_reported) {\n \n sigterm_reported = (write(sigterm_wfd, \"\", 1) == 1);\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void termsig_handler(int signum)\n\n{\n\n static int sigterm_reported;\n\n if (!sigterm_reported) {\n\n sigterm_reported = (write(sigterm_wfd, \"\", 1) == 1);\n\n }\n\n}\n"}} {"sample_id": "97e89ee914411384dcda771d38bf89f13726d71e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void gen_check_privilege(DisasContext *dc)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void gen_check_privilege(DisasContext *dc)\n\n{\n\n if (dc->cring) {\n\n gen_exception_cause(dc, PRIVILEGED_CAUSE);\n\n dc->is_jmp = DISAS_UPDATE;\n\n }\n\n}\n"}} {"sample_id": "db56a7507ee7c1e095d2eef451d5a487f614edff_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static inline int draw_glyph_yuv(AVFilterBufferRef *picref, FT_Bitmap *bitmap, unsigned int x,\n \n unsigned int y, unsigned int width, unsigned int height,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static inline int draw_glyph_yuv(AVFilterBufferRef *picref, FT_Bitmap *bitmap, unsigned int x,\n\n unsigned int y, unsigned int width, unsigned int height,\n\n const uint8_t yuva_color[4], int hsub, int vsub)\n\n{\n\n int r, c, alpha;\n\n unsigned int luma_pos, chroma_pos1, chroma_pos2;\n\n uint8_t src_val;\n\n\n\n for (r = 0; r < bitmap->rows && r+y < height; r++) {\n\n for (c = 0; c < bitmap->width && c+x < width; c++) {\n\n /* get intensity value in the glyph bitmap (source) */\n\n src_val = GET_BITMAP_VAL(r, c);\n\n if (!src_val)\n\n continue;\n\n\n\n SET_PIXEL_YUV(picref, yuva_color, src_val, c+x, y+r, hsub, vsub);\n\n }\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "e3187a45dd02a7490f9191c16527dc28a4ba45b9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,17 +1,17 @@\n static int local_chmod(FsContext *fs_ctx, V9fsPath *fs_path, FsCred *credp)\n+\n {\n+\n char *buffer;\n+\n+ int ret = -1;\n+\n char *path = fs_path->data;\n+\n+\n+\n if (fs_ctx->export_flags & V9FS_SM_MAPPED) {\n+\n buffer = rpath(fs_ctx, path);\n \n ret = local_set_xattr(buffer, credp);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int local_chmod(FsContext *fs_ctx, V9fsPath *fs_path, FsCred *credp)\n\n{\n\n char *buffer;\n\n int ret = -1;\n\n char *path = fs_path->data;\n\n\n\n if (fs_ctx->export_flags & V9FS_SM_MAPPED) {\n\n buffer = rpath(fs_ctx, path);\n\n ret = local_set_xattr(buffer, credp);\n\n g_free(buffer);\n\n } else if (fs_ctx->export_flags & V9FS_SM_MAPPED_FILE) {\n\n return local_set_mapped_file_attr(fs_ctx, path, credp);\n\n } else if ((fs_ctx->export_flags & V9FS_SM_PASSTHROUGH) ||\n\n (fs_ctx->export_flags & V9FS_SM_NONE)) {\n\n buffer = rpath(fs_ctx, path);\n\n ret = chmod(buffer, credp->fc_mode);\n\n g_free(buffer);\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "001bcd29556b32c1afd686c03f6bdd65dd0e9a36", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int modify_current_stream(HTTPContext *c, char *rates)\n+{\n+ int i;\n+ FFStream *req = c->stream;\n+ int action_required = 0;\n+ for (i = 0; i < req->nb_streams; i++) {\n AVCodecContext *codec = &req->streams[i]->codec;\n switch(rates[i]) {\n case 0:", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int modify_current_stream(HTTPContext *c, char *rates)\n{\n int i;\n FFStream *req = c->stream;\n int action_required = 0;\n for (i = 0; i < req->nb_streams; i++) {\n AVCodecContext *codec = &req->streams[i]->codec;\n switch(rates[i]) {\n case 0:\n c->switch_feed_streams[i] = req->feed_streams[i];\n break;\n case 1:\n c->switch_feed_streams[i] = find_stream_in_feed(req->feed, codec, codec->bit_rate / 2);\n break;\n case 2:\n /* Wants off or slow */\n c->switch_feed_streams[i] = find_stream_in_feed(req->feed, codec, codec->bit_rate / 4);\n#ifdef WANTS_OFF\n /* This doesn't work well when it turns off the only stream! */\n c->switch_feed_streams[i] = -2;\n c->feed_streams[i] = -2;\n#endif\n break;\n }\n if (c->switch_feed_streams[i] >= 0 && c->switch_feed_streams[i] != c->feed_streams[i])\n action_required = 1;\n }\n return action_required;\n}"}} {"sample_id": "d9f62dde1303286b24ac8ce88be27e2b9b9c5f46_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n {\n \n+ GenericList *list = *listp;\n+\n+ QmpOutputVisitor *qov = to_qov(v);\n+\n+ QStackEntry *e = QTAILQ_FIRST(&qov->stack);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static GenericList *qmp_output_next_list(Visitor *v, GenericList **listp,\n\n size_t size)\n\n{\n\n GenericList *list = *listp;\n\n QmpOutputVisitor *qov = to_qov(v);\n\n QStackEntry *e = QTAILQ_FIRST(&qov->stack);\n\n\n\n assert(e);\n\n if (e->is_list_head) {\n\n e->is_list_head = false;\n\n return list;\n\n }\n\n\n\n return list ? list->next : NULL;\n\n}\n"}} {"sample_id": "57e49b40745ceb6c198cc58274b705afb5f20493", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void patch_reloc(uint8_t *code_ptr, int type,\n \n+ tcg_target_long value, tcg_target_long addend)\n+\n+{\n+\n+ value += addend;\n \n switch (type) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void patch_reloc(uint8_t *code_ptr, int type,\n\n tcg_target_long value, tcg_target_long addend)\n\n{\n\n value += addend;\n\n switch (type) {\n\n case R_SPARC_32:\n\n if (value != (uint32_t)value)\n\n tcg_abort();\n\n *(uint32_t *)code_ptr = value;\n\n break;\n\n case R_SPARC_WDISP22:\n\n value -= (long)code_ptr;\n\n value >>= 2;\n\n if (!check_fit(value, 22))\n\n tcg_abort();\n\n *(uint32_t *)code_ptr = ((*(uint32_t *)code_ptr) & ~0x3fffff) | value;\n\n break;\n\n default:\n\n tcg_abort();\n\n }\n\n}\n"}} {"sample_id": "6092666ebdc68b2634db050689292c71a5c368c0_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void phys_sections_clear(PhysPageMap *map)\n \n+{\n+\n+ while (map->sections_nb > 0) {\n+\n MemoryRegionSection *section = &map->sections[--map->sections_nb];\n \n phys_section_destroy(section->mr);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void phys_sections_clear(PhysPageMap *map)\n\n{\n\n while (map->sections_nb > 0) {\n\n MemoryRegionSection *section = &map->sections[--map->sections_nb];\n\n phys_section_destroy(section->mr);\n\n }\n\n g_free(map->sections);\n\n g_free(map->nodes);\n\n}\n"}} {"sample_id": "b505f15b1530d72682b3314e84936f80fe6e43b2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,25 +1,25 @@\n void ff_slice_thread_free(AVCodecContext *avctx)\n \n+{\n+\n+ SliceThreadContext *c = avctx->internal->thread_ctx;\n+\n+ int i;\n+\n+\n+\n+ pthread_mutex_lock(&c->current_job_lock);\n \n c->done = 1;\n \n pthread_cond_broadcast(&c->current_job_cond);\n+\n+ for (i = 0; i < c->thread_count; i++)\n+\n pthread_cond_broadcast(&c->progress_cond[i]);\n \n pthread_mutex_unlock(&c->current_job_lock);\n+\n \n \n for (i=0; ithread_count; i++)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void ff_slice_thread_free(AVCodecContext *avctx)\n\n{\n\n SliceThreadContext *c = avctx->internal->thread_ctx;\n\n int i;\n\n\n\n pthread_mutex_lock(&c->current_job_lock);\n\n c->done = 1;\n\n pthread_cond_broadcast(&c->current_job_cond);\n\n for (i = 0; i < c->thread_count; i++)\n\n pthread_cond_broadcast(&c->progress_cond[i]);\n\n pthread_mutex_unlock(&c->current_job_lock);\n\n\n\n for (i=0; ithread_count; i++)\n\n pthread_join(c->workers[i], NULL);\n\n\n\n for (i = 0; i < c->thread_count; i++) {\n\n pthread_mutex_destroy(&c->progress_mutex[i]);\n\n pthread_cond_destroy(&c->progress_cond[i]);\n\n }\n\n\n\n pthread_mutex_destroy(&c->current_job_lock);\n\n pthread_cond_destroy(&c->current_job_cond);\n\n pthread_cond_destroy(&c->last_job_cond);\n\n\n\n av_freep(&c->entries);\n\n av_freep(&c->progress_mutex);\n\n av_freep(&c->progress_cond);\n\n\n\n av_freep(&c->workers);\n\n av_freep(&avctx->internal->thread_ctx);\n\n}\n"}} {"sample_id": "773b93ee0684a9b9d1f0029a936a251411289027_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void dump_regs(struct ucontext *uc)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void dump_regs(struct ucontext *uc)\n\n{\n\n}\n"}} {"sample_id": "79798f7c57b098c78e0bbc6becd64b9888b013d1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int unpack_parse_unit(DiracParseUnit *pu, DiracParseContext *pc,\n+\n+ int offset)\n+\n {\n \n uint8_t *start = pc->buffer + offset;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int unpack_parse_unit(DiracParseUnit *pu, DiracParseContext *pc,\n\n int offset)\n\n{\n\n uint8_t *start = pc->buffer + offset;\n\n uint8_t *end = pc->buffer + pc->index;\n\n if (start < pc->buffer || (start + 13 > end))\n\n return 0;\n\n pu->pu_type = start[4];\n\n\n\n pu->next_pu_offset = AV_RB32(start + 5);\n\n pu->prev_pu_offset = AV_RB32(start + 9);\n\n\n\n if (pu->pu_type == 0x10 && pu->next_pu_offset == 0)\n\n pu->next_pu_offset = 13;\n\n\n\n return 1;\n\n}\n"}} {"sample_id": "46c5874e9cd752ed8ded31af03472edd8fc3efc1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n \n \n+ QLIST_FOREACH(sphb, &spapr->phbs, list) {\n+\n+ if (sphb->buid != buid) {\n+\n+ continue;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static sPAPRPHBState *find_phb(sPAPREnvironment *spapr, uint64_t buid)\n\n{\n\n sPAPRPHBState *sphb;\n\n\n\n QLIST_FOREACH(sphb, &spapr->phbs, list) {\n\n if (sphb->buid != buid) {\n\n continue;\n\n }\n\n return sphb;\n\n }\n\n\n\n return NULL;\n\n}\n"}} {"sample_id": "f61eddcb2bb5cbbdd1d911b7e937db9affc29028_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n if (index == MAX_SCLP_CONSOLES) {\n \n fprintf(stderr, \"qemu: too many sclp consoles\\n\");\n+\n+ exit(1);\n+\n+ }\n+\n \n \n assert(arch_type == QEMU_ARCH_S390X);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int sclp_parse(const char *devname)\n\n{\n\n QemuOptsList *device = qemu_find_opts(\"device\");\n\n static int index = 0;\n\n char label[32];\n\n QemuOpts *dev_opts;\n\n\n\n if (strcmp(devname, \"none\") == 0) {\n\n return 0;\n\n }\n\n if (index == MAX_SCLP_CONSOLES) {\n\n fprintf(stderr, \"qemu: too many sclp consoles\\n\");\n\n exit(1);\n\n }\n\n\n\n assert(arch_type == QEMU_ARCH_S390X);\n\n\n\n dev_opts = qemu_opts_create(device, NULL, 0, NULL);\n\n qemu_opt_set(dev_opts, \"driver\", \"sclpconsole\", &error_abort);\n\n\n\n snprintf(label, sizeof(label), \"sclpcon%d\", index);\n\n sclp_hds[index] = qemu_chr_new(label, devname, NULL);\n\n if (!sclp_hds[index]) {\n\n fprintf(stderr, \"qemu: could not connect sclp console\"\n\n \" to character backend '%s'\\n\", devname);\n\n return -1;\n\n }\n\n qemu_opt_set(dev_opts, \"chardev\", label, &error_abort);\n\n\n\n index++;\n\n return 0;\n\n}\n"}} {"sample_id": "b1e309865f6b4f67841c811faa5022e492095906", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n unsigned char ival = byte + 0x16;\n \n const unsigned char * ptr = src + byte*2;\n+\n unsigned char val = ival;\n \n unsigned char *dest_end = dest + dest_len;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int xan_huffman_decode(unsigned char *dest, const unsigned char *src,\n\n int dest_len)\n\n{\n\n unsigned char byte = *src++;\n\n unsigned char ival = byte + 0x16;\n\n const unsigned char * ptr = src + byte*2;\n\n unsigned char val = ival;\n\n unsigned char *dest_end = dest + dest_len;\n\n GetBitContext gb;\n\n\n\n init_get_bits(&gb, ptr, 0); // FIXME: no src size available\n\n\n\n while ( val != 0x16 ) {\n\n val = src[val - 0x17 + get_bits1(&gb) * byte];\n\n\n\n if ( val < 0x16 ) {\n\n if (dest + 1 > dest_end)\n\n return 0;\n\n *dest++ = val;\n\n val = ival;\n\n }\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "3c70251780647d49e09522bbe22758c841e37a9a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,13 +7,13 @@\n \n \n if (i1 <= i0 + 1) {\n+\n if (i0 == 1)\n+\n p[1] = (p[1] * I_LFTG_K + (1<<16)) >> 17;\n+\n else\n+\n p[0] = (p[0] * I_LFTG_X + (1<<15)) >> 16;\n \n return;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void sr_1d97_int(int32_t *p, int i0, int i1)\n\n{\n\n int i;\n\n\n\n if (i1 <= i0 + 1) {\n\n if (i0 == 1)\n\n p[1] = (p[1] * I_LFTG_K + (1<<16)) >> 17;\n\n else\n\n p[0] = (p[0] * I_LFTG_X + (1<<15)) >> 16;\n\n return;\n\n }\n\n\n\n extend97_int(p, i0, i1);\n\n\n\n for (i = (i0 >> 1) - 1; i < (i1 >> 1) + 2; i++)\n\n p[2 * i] -= (I_LFTG_DELTA * (p[2 * i - 1] + p[2 * i + 1]) + (1 << 15)) >> 16;\n\n /* step 4 */\n\n for (i = (i0 >> 1) - 1; i < (i1 >> 1) + 1; i++)\n\n p[2 * i + 1] -= (I_LFTG_GAMMA * (p[2 * i] + p[2 * i + 2]) + (1 << 15)) >> 16;\n\n /*step 5*/\n\n for (i = (i0 >> 1); i < (i1 >> 1) + 1; i++)\n\n p[2 * i] += (I_LFTG_BETA * (p[2 * i - 1] + p[2 * i + 1]) + (1 << 15)) >> 16;\n\n /* step 6 */\n\n for (i = (i0 >> 1); i < (i1 >> 1); i++)\n\n p[2 * i + 1] += (I_LFTG_ALPHA * (p[2 * i] + p[2 * i + 2]) + (1 << 15)) >> 16;\n\n}\n"}} {"sample_id": "efec3dd631d94160288392721a5f9c39e50fb2bc_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void vapic_class_init(ObjectClass *klass, void *data)\n \n+{\n \n DeviceClass *dc = DEVICE_CLASS(klass);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void vapic_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n\n\n dc->no_user = 1;\n\n dc->reset = vapic_reset;\n\n dc->vmsd = &vmstate_vapic;\n\n dc->realize = vapic_realize;\n\n}\n"}} {"sample_id": "187337f8b0ec0813dd3876d1efe37d415fb81c2e_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n qemu_mallocz(sizeof(struct pxa2xx_dma_state_s));\n \n \n+\n s->channels = channels;\n \n s->chan = qemu_mallocz(sizeof(struct pxa2xx_dma_channel_s) * s->channels);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static struct pxa2xx_dma_state_s *pxa2xx_dma_init(target_phys_addr_t base,\n\n qemu_irq irq, int channels)\n\n{\n\n int i, iomemtype;\n\n struct pxa2xx_dma_state_s *s;\n\n s = (struct pxa2xx_dma_state_s *)\n\n qemu_mallocz(sizeof(struct pxa2xx_dma_state_s));\n\n\n\n s->channels = channels;\n\n s->chan = qemu_mallocz(sizeof(struct pxa2xx_dma_channel_s) * s->channels);\n\n s->base = base;\n\n s->irq = irq;\n\n s->handler = (pxa2xx_dma_handler_t) pxa2xx_dma_request;\n\n s->req = qemu_mallocz(sizeof(uint8_t) * PXA2XX_DMA_NUM_REQUESTS);\n\n\n\n memset(s->chan, 0, sizeof(struct pxa2xx_dma_channel_s) * s->channels);\n\n for (i = 0; i < s->channels; i ++)\n\n s->chan[i].state = DCSR_STOPINTR;\n\n\n\n memset(s->req, 0, sizeof(uint8_t) * PXA2XX_DMA_NUM_REQUESTS);\n\n\n\n iomemtype = cpu_register_io_memory(0, pxa2xx_dma_readfn,\n\n pxa2xx_dma_writefn, s);\n\n cpu_register_physical_memory(base, 0x0000ffff, iomemtype);\n\n\n\n register_savevm(\"pxa2xx_dma\", 0, 0, pxa2xx_dma_save, pxa2xx_dma_load, s);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "6ab3fc32ea640026726bc5f9f4db622d0954fb8a_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n unsigned width)\n \n+{\n \n DebugconState *s = opaque;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void debugcon_ioport_write(void *opaque, hwaddr addr, uint64_t val,\n\n unsigned width)\n\n{\n\n DebugconState *s = opaque;\n\n unsigned char ch = val;\n\n\n\n#ifdef DEBUG_DEBUGCON\n\n printf(\" [debugcon: write addr=0x%04\" HWADDR_PRIx \" val=0x%02\" PRIx64 \"]\\n\", addr, val);\n\n#endif\n\n\n\n qemu_chr_fe_write(s->chr, &ch, 1);\n\n}\n"}} {"sample_id": "bdf3d3bf9dce398acce608de77da205e08bdace3_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void opt_video_channel(const char *arg)\n \n {\n+\n video_channel = strtol(arg, NULL, 0);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void opt_video_channel(const char *arg)\n\n{\n\n video_channel = strtol(arg, NULL, 0);\n\n}\n"}} {"sample_id": "1e9b65bb1bad51735cab6c861c29b592dccabf0e_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+void error_set(Error **errp, ErrorClass err_class, const char *fmt, ...)\n \n {\n+\n va_list ap;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void error_set(Error **errp, ErrorClass err_class, const char *fmt, ...)\n\n{\n\n va_list ap;\n\n\n\n va_start(ap, fmt);\n\n error_setv(errp, err_class, fmt, ap);\n\n va_end(ap);\n\n}\n"}} {"sample_id": "311107a65d0105044d1691b5e85d6f30879b0eb4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n http_log(\"Codecs do not match for stream %d\\n\", stream);\n \n matches = 0;\n+\n+ } else if (CHECK_CODEC(bit_rate) || CHECK_CODEC(flags)) {\n+\n+ http_log(\"Codec bitrates do not match for stream %d\\n\", stream);\n+\n matches = 0;\n \n } else if (ccf->codec_type == AVMEDIA_TYPE_VIDEO) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int check_codec_match(AVCodecContext *ccf, AVCodecContext *ccs, int stream)\n\n{\n\n int matches = 1;\n\n\n\n#define CHECK_CODEC(x) (ccf->x != ccs->x)\n\n if (CHECK_CODEC(codec_id) || CHECK_CODEC(codec_type)) {\n\n http_log(\"Codecs do not match for stream %d\\n\", stream);\n\n matches = 0;\n\n } else if (CHECK_CODEC(bit_rate) || CHECK_CODEC(flags)) {\n\n http_log(\"Codec bitrates do not match for stream %d\\n\", stream);\n\n matches = 0;\n\n } else if (ccf->codec_type == AVMEDIA_TYPE_VIDEO) {\n\n if (CHECK_CODEC(time_base.den) ||\n\n CHECK_CODEC(time_base.num) ||\n\n CHECK_CODEC(width) ||\n\n CHECK_CODEC(height)) {\n\n http_log(\"Codec width, height or framerate do not match for stream %d\\n\", stream);\n\n matches = 0;\n\n }\n\n } else if (ccf->codec_type == AVMEDIA_TYPE_AUDIO) {\n\n if (CHECK_CODEC(sample_rate) ||\n\n CHECK_CODEC(channels) ||\n\n CHECK_CODEC(frame_size)) {\n\n http_log(\"Codec sample_rate, channels, frame_size do not match for stream %d\\n\", stream);\n\n matches = 0;\n\n }\n\n } else {\n\n http_log(\"Unknown codec type for stream %d\\n\", stream);\n\n matches = 0;\n\n }\n\n\n\n return matches;\n\n}\n"}} {"sample_id": "f06b2031a31cdd3acf6f61a977e505b8c6b58f73_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+ g_assert(c->method == GA_CHANNEL_UNIX_LISTEN);\n+\n+ g_assert(c->listen_channel);\n \n g_io_channel_shutdown(c->listen_channel, true, NULL);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ga_channel_listen_close(GAChannel *c)\n\n{\n\n g_assert(c->method == GA_CHANNEL_UNIX_LISTEN);\n\n g_assert(c->listen_channel);\n\n g_io_channel_shutdown(c->listen_channel, true, NULL);\n\n g_io_channel_unref(c->listen_channel);\n\n c->listen_channel = NULL;\n\n}\n"}} {"sample_id": "52e60cdd342dc48116edb81b443ba8c0a0c6f1a3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n rn = extract32(insn, 5, 5);\n \n op4 = extract32(insn, 0, 5);\n+\n+\n+\n+ if (op4 != 0x0 || op3 != 0x0 || op2 != 0x1f) {\n+\n unallocated_encoding(s);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)\n\n{\n\n unsigned int opc, op2, op3, rn, op4;\n\n\n\n opc = extract32(insn, 21, 4);\n\n op2 = extract32(insn, 16, 5);\n\n op3 = extract32(insn, 10, 6);\n\n rn = extract32(insn, 5, 5);\n\n op4 = extract32(insn, 0, 5);\n\n\n\n if (op4 != 0x0 || op3 != 0x0 || op2 != 0x1f) {\n\n unallocated_encoding(s);\n\n\n }\n\n\n\n switch (opc) {\n\n case 0: /* BR */\n\n case 2: /* RET */\n\n break;\n\n case 1: /* BLR */\n\n tcg_gen_movi_i64(cpu_reg(s, 30), s->pc);\n\n break;\n\n case 4: /* ERET */\n\n\n\n\n case 5: /* DRPS */\n\n if (rn != 0x1f) {\n\n unallocated_encoding(s);\n\n } else {\n\n unsupported_encoding(s, insn);\n\n }\n\n\n default:\n\n unallocated_encoding(s);\n\n\n }\n\n\n\n tcg_gen_mov_i64(cpu_pc, cpu_reg(s, rn));\n\n\n}"}} {"sample_id": "31ce5e0c49821d92fb30cce2f3055ef33613b287", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,9 +6,9 @@\n \n int cpu_index = qdict_get_int(qdict, \"cpu_index\");\n \n+ int bank = qdict_get_int(qdict, \"bank\");\n \n+ uint64_t status = qdict_get_int(qdict, \"status\");\n \n uint64_t mcg_status = qdict_get_int(qdict, \"mcg_status\");\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void do_inject_mce(Monitor *mon, const QDict *qdict)\n\n{\n\n CPUState *cenv;\n\n int cpu_index = qdict_get_int(qdict, \"cpu_index\");\n\n int bank = qdict_get_int(qdict, \"bank\");\n\n uint64_t status = qdict_get_int(qdict, \"status\");\n\n uint64_t mcg_status = qdict_get_int(qdict, \"mcg_status\");\n\n uint64_t addr = qdict_get_int(qdict, \"addr\");\n\n uint64_t misc = qdict_get_int(qdict, \"misc\");\n\n\n\n for (cenv = first_cpu; cenv != NULL; cenv = cenv->next_cpu)\n\n if (cenv->cpu_index == cpu_index && cenv->mcg_cap) {\n\n cpu_inject_x86_mce(cenv, bank, status, mcg_status, addr, misc);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "d8245c3bcdd162891825a52cf55e4e8173d85a18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static av_cold int cinvideo_decode_end(AVCodecContext *avctx)\n \n+{\n \n+ CinVideoContext *cin = avctx->priv_data;\n+\n int i;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static av_cold int cinvideo_decode_end(AVCodecContext *avctx)\n\n{\n\n CinVideoContext *cin = avctx->priv_data;\n\n int i;\n\n\n\n if (cin->frame.data[0])\n\n avctx->release_buffer(avctx, &cin->frame);\n\n\n\n for (i = 0; i < 3; ++i)\n\n av_free(cin->bitmap_table[i]);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "7c10068da10aa288195f5eb5d7e34eb2d8ff7447", "diff": "--- a/source.c\n+++ b/source.c\n@@ -40,11 +40,11 @@\n display->region_id = region_id;\n display->x_pos = AV_RB16(buf);\n buf += 2;\n+ display->y_pos = AV_RB16(buf);\n+ buf += 2;\n+ *tmp_ptr = display->next;\n+ display->next = ctx->display_list;\n+ ctx->display_list = display;\n ff_dlog(avctx, \"Region %d, (%d,%d)\\n\", region_id, display->x_pos, display->y_pos);\n while (tmp_display_list) {\n display = tmp_display_list;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int dvbsub_parse_page_segment(AVCodecContext *avctx,\n const uint8_t *buf, int buf_size, AVSubtitle *sub, int *got_output)\n{\n DVBSubContext *ctx = avctx->priv_data;\n DVBSubRegionDisplay *display;\n DVBSubRegionDisplay *tmp_display_list, **tmp_ptr;\n const uint8_t *buf_end = buf + buf_size;\n int region_id;\n int page_state;\n int timeout;\n int version;\n if (buf_size < 1)\n return AVERROR_INVALIDDATA;\n timeout = *buf++;\n version = ((*buf)>>4) & 15;\n page_state = ((*buf++) >> 2) & 3;\n if (ctx->version == version) {\n return 0;\n ctx->time_out = timeout;\n ctx->version = version;\n ff_dlog(avctx, \"Page time out %ds, state %d\\n\", ctx->time_out, page_state);\n if(ctx->compute_edt == 1)\n save_subtitle_set(avctx, sub, got_output);\n if (page_state == 1 || page_state == 2) {\n delete_regions(ctx);\n delete_objects(ctx);\n delete_cluts(ctx);\n tmp_display_list = ctx->display_list;\n ctx->display_list = NULL;\n while (buf + 5 < buf_end) {\n region_id = *buf++;\n buf += 1;\n display = tmp_display_list;\n tmp_ptr = &tmp_display_list;\n tmp_ptr = &display->next;\n if (!display) {\n display = av_mallocz(sizeof(DVBSubRegionDisplay));\n if (!display)\n return AVERROR(ENOMEM);\n display->region_id = region_id;\n display->x_pos = AV_RB16(buf);\n buf += 2;\n display->y_pos = AV_RB16(buf);\n buf += 2;\n *tmp_ptr = display->next;\n display->next = ctx->display_list;\n ctx->display_list = display;\n ff_dlog(avctx, \"Region %d, (%d,%d)\\n\", region_id, display->x_pos, display->y_pos);\n while (tmp_display_list) {\n display = tmp_display_list;\n tmp_display_list = display->next;\n av_freep(&display);\n return 0;"}} {"sample_id": "8be7e7e4c72c048b90e3482557954a24bba43ba7_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n int unix_connect(const char *path)\n \n {\n+\n QemuOpts *opts;\n \n int sock;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int unix_connect(const char *path)\n\n{\n\n QemuOpts *opts;\n\n int sock;\n\n\n\n opts = qemu_opts_create(&dummy_opts, NULL, 0);\n\n qemu_opt_set(opts, \"path\", path);\n\n sock = unix_connect_opts(opts);\n\n qemu_opts_del(opts);\n\n return sock;\n\n}\n"}} {"sample_id": "dcd3418a35aab7ef283b68ed9997ce4ac204094e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n {\n \n enum AVColorPrimaries pri = avctx->color_primaries;\n+\n+ switch (pri) {\n+\n+ case AVCOL_PRI_UNSPECIFIED:\n+\n *primaries = NULL;\n \n break;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int get_cv_color_primaries(AVCodecContext *avctx,\n\n CFStringRef *primaries)\n\n{\n\n enum AVColorPrimaries pri = avctx->color_primaries;\n\n switch (pri) {\n\n case AVCOL_PRI_UNSPECIFIED:\n\n *primaries = NULL;\n\n break;\n\n\n\n case AVCOL_PRI_BT709:\n\n *primaries = kCVImageBufferColorPrimaries_ITU_R_709_2;\n\n break;\n\n\n\n case AVCOL_PRI_BT2020:\n\n *primaries = kCVImageBufferColorPrimaries_ITU_R_2020;\n\n break;\n\n\n\n default:\n\n av_log(avctx, AV_LOG_ERROR, \"Color primaries %s is not supported.\\n\", av_color_primaries_name(pri));\n\n *primaries = NULL;\n\n return -1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "5fb6c7a8b26eab1a22207d24b4784bd2b39ab54b_17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static uint16_t read_u16(uint8_t *data, size_t offset)\n+\n {\n \n return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint16_t read_u16(uint8_t *data, size_t offset)\n\n{\n\n return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);\n\n}\n"}} {"sample_id": "2ad645d2854746b55ddfd1d8e951f689cca5d78f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int setup_common(char *argv[], int argv_sz)\n \n+{\n \n memset(cur_ide, 0, sizeof(cur_ide));\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int setup_common(char *argv[], int argv_sz)\n\n{\n\n memset(cur_ide, 0, sizeof(cur_ide));\n\n return append_arg(0, argv, argv_sz,\n\n g_strdup(\"-nodefaults -display none\"));\n\n}\n"}} {"sample_id": "e634b89c6ed2309814de7a89bd7c5ced96f59291_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -46,11 +46,11 @@\n \n fdt, fdt_start_offset, !dev->hotplugged, errp);\n \n+out:\n+\n+ if (*errp) {\n+\n+ g_free(fdt);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void spapr_phb_add_pci_device(sPAPRDRConnector *drc,\n\n sPAPRPHBState *phb,\n\n PCIDevice *pdev,\n\n Error **errp)\n\n{\n\n sPAPRDRConnectorClass *drck = SPAPR_DR_CONNECTOR_GET_CLASS(drc);\n\n DeviceState *dev = DEVICE(pdev);\n\n int drc_index = drck->get_index(drc);\n\n void *fdt = NULL;\n\n int fdt_start_offset = 0, fdt_size;\n\n\n\n if (dev->hotplugged) {\n\n fdt = create_device_tree(&fdt_size);\n\n fdt_start_offset = spapr_create_pci_child_dt(phb, pdev,\n\n drc_index, NULL,\n\n fdt, 0);\n\n if (!fdt_start_offset) {\n\n error_setg(errp, \"Failed to create pci child device tree node\");\n\n goto out;\n\n }\n\n }\n\n\n\n drck->attach(drc, DEVICE(pdev),\n\n fdt, fdt_start_offset, !dev->hotplugged, errp);\n\nout:\n\n if (*errp) {\n\n g_free(fdt);\n\n }\n\n}\n"}} {"sample_id": "44b6789299a8acca3f25331bc411055cafc7bb06", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n+static BlockAIOCB *blkverify_aio_readv(BlockDriverState *bs,\n+\n+ int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,\n+\n+ BlockCompletionFunc *cb, void *opaque)\n+\n+{\n+\n+ BDRVBlkverifyState *s = bs->opaque;\n+\n BlkverifyAIOCB *acb = blkverify_aio_get(bs, false, sector_num, qiov,\n \n nb_sectors, cb, opaque);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static BlockAIOCB *blkverify_aio_readv(BlockDriverState *bs,\n\n int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,\n\n BlockCompletionFunc *cb, void *opaque)\n\n{\n\n BDRVBlkverifyState *s = bs->opaque;\n\n BlkverifyAIOCB *acb = blkverify_aio_get(bs, false, sector_num, qiov,\n\n nb_sectors, cb, opaque);\n\n\n\n acb->verify = blkverify_verify_readv;\n\n acb->buf = qemu_blockalign(bs->file->bs, qiov->size);\n\n qemu_iovec_init(&acb->raw_qiov, acb->qiov->niov);\n\n qemu_iovec_clone(&acb->raw_qiov, qiov, acb->buf);\n\n\n\n bdrv_aio_readv(s->test_file, sector_num, qiov, nb_sectors,\n\n blkverify_aio_cb, acb);\n\n bdrv_aio_readv(bs->file, sector_num, &acb->raw_qiov, nb_sectors,\n\n blkverify_aio_cb, acb);\n\n return &acb->common;\n\n}\n"}} {"sample_id": "3fd3c4b37c116cce7e9810fcc15a0a2cf15115a5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,7 +14,7 @@\n \n \n \n+ /* Check the pages is dirty and if it is send it */\n \n if (migration_bitmap_clear_dirty(dirty_ram_abs)) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int ram_save_target_page(MigrationState *ms, QEMUFile *f,\n\n RAMBlock *block, ram_addr_t offset,\n\n bool last_stage,\n\n uint64_t *bytes_transferred,\n\n ram_addr_t dirty_ram_abs)\n\n{\n\n int res = 0;\n\n\n\n /* Check the pages is dirty and if it is send it */\n\n if (migration_bitmap_clear_dirty(dirty_ram_abs)) {\n\n unsigned long *unsentmap;\n\n if (compression_switch && migrate_use_compression()) {\n\n res = ram_save_compressed_page(f, block, offset,\n\n last_stage,\n\n bytes_transferred);\n\n } else {\n\n res = ram_save_page(f, block, offset, last_stage,\n\n bytes_transferred);\n\n }\n\n\n\n if (res < 0) {\n\n return res;\n\n }\n\n unsentmap = atomic_rcu_read(&migration_bitmap_rcu)->unsentmap;\n\n if (unsentmap) {\n\n clear_bit(dirty_ram_abs >> TARGET_PAGE_BITS, unsentmap);\n\n }\n\n last_sent_block = block;\n\n }\n\n\n\n return res;\n\n}\n"}} {"sample_id": "e638073c569e801ce9def2016a84f955cbbca779", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n VFIODevice *vdev = opaque;\n \n uint64_t val = ((uint64_t)1 << (size * 8)) - 1;\n+\n+\n+\n+ /* Load the ROM lazily when the guest tries to read it */\n+\n if (unlikely(!vdev->rom)) {\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size)\n\n{\n\n VFIODevice *vdev = opaque;\n\n uint64_t val = ((uint64_t)1 << (size * 8)) - 1;\n\n\n\n /* Load the ROM lazily when the guest tries to read it */\n\n if (unlikely(!vdev->rom)) {\n\n\n\n\n\n\n\n\n memcpy(&val, vdev->rom + addr,\n\n (addr < vdev->rom_size) ? MIN(size, vdev->rom_size - addr) : 0);\n\n\n\n DPRINTF(\"%s(%04x:%02x:%02x.%x, 0x%\"HWADDR_PRIx\", 0x%x) = 0x%\"PRIx64\"\\n\",\n\n __func__, vdev->host.domain, vdev->host.bus, vdev->host.slot,\n\n vdev->host.function, addr, size, val);\n\n\n\n return val;\n"}} {"sample_id": "e0ef439588ce1ede747f82b77d893190c1cc9f4d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n BDRVBlkdebugState *s = bs->opaque;\n BlkdebugRule *rule = NULL;\n QSIMPLEQ_FOREACH(rule, &s->active_rules, active_next) {\n+ uint64_t inject_offset = rule->options.inject.offset;\n+ if (inject_offset == -1 ||\n+ (inject_offset >= offset && inject_offset < offset + bytes))\n {\n break;\n if (rule && rule->options.inject.error) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "blkdebug_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes,\n QEMUIOVector *qiov, int flags)\n{\n BDRVBlkdebugState *s = bs->opaque;\n BlkdebugRule *rule = NULL;\n QSIMPLEQ_FOREACH(rule, &s->active_rules, active_next) {\n uint64_t inject_offset = rule->options.inject.offset;\n if (inject_offset == -1 ||\n (inject_offset >= offset && inject_offset < offset + bytes))\n {\n break;\n if (rule && rule->options.inject.error) {\n return inject_error(bs, rule);\n return bdrv_co_pwritev(bs->file, offset, bytes, qiov, flags);"}} {"sample_id": "6ab3fc32ea640026726bc5f9f4db622d0954fb8a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,7 +16,7 @@\n \n case PARA_REG_DATA:\n \n+ s->dataw = val;\n \n parallel_update_irq(s);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "parallel_ioport_write_sw(void *opaque, uint32_t addr, uint32_t val)\n\n{\n\n ParallelState *s = opaque;\n\n\n\n pdebug(\"write addr=0x%02x val=0x%02x\\n\", addr, val);\n\n\n\n addr &= 7;\n\n switch(addr) {\n\n case PARA_REG_DATA:\n\n s->dataw = val;\n\n parallel_update_irq(s);\n\n break;\n\n case PARA_REG_CTR:\n\n val |= 0xc0;\n\n if ((val & PARA_CTR_INIT) == 0 ) {\n\n s->status = PARA_STS_BUSY;\n\n s->status |= PARA_STS_ACK;\n\n s->status |= PARA_STS_ONLINE;\n\n s->status |= PARA_STS_ERROR;\n\n }\n\n else if (val & PARA_CTR_SELECT) {\n\n if (val & PARA_CTR_STROBE) {\n\n s->status &= ~PARA_STS_BUSY;\n\n if ((s->control & PARA_CTR_STROBE) == 0)\n\n qemu_chr_fe_write(s->chr, &s->dataw, 1);\n\n } else {\n\n if (s->control & PARA_CTR_INTEN) {\n\n s->irq_pending = 1;\n\n }\n\n }\n\n }\n\n parallel_update_irq(s);\n\n s->control = val;\n\n break;\n\n }\n\n}\n"}} {"sample_id": "42a268c241183877192c376d03bd9b6d527407c7_34", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n int cond = dc->op2;\n+\n+\n+\n+ LOG_DIS(\"s%s $r%u\\n\",\n+\n cc_name(cond), dc->op1);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int dec_scc_r(CPUCRISState *env, DisasContext *dc)\n\n{\n\n int cond = dc->op2;\n\n\n\n LOG_DIS(\"s%s $r%u\\n\",\n\n cc_name(cond), dc->op1);\n\n\n\n if (cond != CC_A) {\n\n int l1;\n\n\n\n gen_tst_cc(dc, cpu_R[dc->op1], cond);\n\n l1 = gen_new_label();\n\n tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_R[dc->op1], 0, l1);\n\n tcg_gen_movi_tl(cpu_R[dc->op1], 1);\n\n gen_set_label(l1);\n\n } else {\n\n tcg_gen_movi_tl(cpu_R[dc->op1], 1);\n\n }\n\n\n\n cris_cc_mask(dc, 0);\n\n return 2;\n\n}\n"}} {"sample_id": "21ce148c7ec71ee32834061355a5ecfd1a11f90f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static inline int cris_swap(const int mode, int x)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline int cris_swap(const int mode, int x)\n\n{\n\n\tswitch (mode)\n\n\t{\n\n\t\tcase N: asm (\"swapn\\t%0\\n\" : \"+r\" (x) : \"0\" (x)); break;\n\n\t\tcase W: asm (\"swapw\\t%0\\n\" : \"+r\" (x) : \"0\" (x)); break;\n\n\t\tcase B: asm (\"swapb\\t%0\\n\" : \"+r\" (x) : \"0\" (x)); break;\n\n\t\tcase R: asm (\"swapr\\t%0\\n\" : \"+r\" (x) : \"0\" (x)); break;\n\n\t\tcase B|R: asm (\"swapbr\\t%0\\n\" : \"+r\" (x) : \"0\" (x)); break;\n\n\t\tcase W|R: asm (\"swapwr\\t%0\\n\" : \"+r\" (x) : \"0\" (x)); break;\n\n\t\tcase W|B: asm (\"swapwb\\t%0\\n\" : \"+r\" (x) : \"0\" (x)); break;\n\n\t\tcase W|B|R: asm (\"swapwbr\\t%0\\n\" : \"+r\" (x) : \"0\" (x)); break;\n\n\t\tcase N|R: asm (\"swapnr\\t%0\\n\" : \"+r\" (x) : \"0\" (x)); break;\n\n\t\tcase N|B: asm (\"swapnb\\t%0\\n\" : \"+r\" (x) : \"0\" (x)); break;\n\n\t\tcase N|B|R: asm (\"swapnbr\\t%0\\n\" : \"+r\" (x) : \"0\" (x)); break;\n\n\t\tcase N|W: asm (\"swapnw\\t%0\\n\" : \"+r\" (x) : \"0\" (x)); break;\n\n\t\tdefault:\n\n\t\t\terr();\n\n\t\t\tbreak;\n\n\t}\n\n\treturn x;\n\n}\n"}} {"sample_id": "e0dd114c163bfba86a736dae00fb70758e1c0200", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n PITChannelState *s;\n \n+ s = &pit_state.channels[0];\n+\n qemu_del_timer(s->irq_timer);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void hpet_pit_disable(void) {\n\n PITChannelState *s;\n\n s = &pit_state.channels[0];\n\n qemu_del_timer(s->irq_timer);\n\n}\n"}} {"sample_id": "f3e4ce4af336f2ea306fa0f40ec1a5149864ca8c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n BackupBlockJob *s = container_of(job, BackupBlockJob, common);\n \n+\n \n if (speed < 0) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void backup_set_speed(BlockJob *job, int64_t speed, Error **errp)\n\n{\n\n BackupBlockJob *s = container_of(job, BackupBlockJob, common);\n\n\n\n if (speed < 0) {\n\n error_setg(errp, QERR_INVALID_PARAMETER, \"speed\");\n\n return;\n\n }\n\n ratelimit_set_speed(&s->limit, speed / BDRV_SECTOR_SIZE, SLICE_TIME);\n\n}\n"}} {"sample_id": "efec3dd631d94160288392721a5f9c39e50fb2bc_37", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ DeviceClass *dc = DEVICE_CLASS(klass);\n \n SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void virtual_css_bridge_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);\n\n\n\n k->init = virtual_css_bridge_init;\n\n dc->no_user = 1;\n\n}\n"}} {"sample_id": "57407ea44cc0a3d630b9b89a2be011f1955ce5c1_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,6 +6,6 @@\n \n \n \n+ n->nic = NULL;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_net_cleanup(NetClientState *nc)\n\n{\n\n VirtIONet *n = qemu_get_nic_opaque(nc);\n\n\n\n n->nic = NULL;\n\n}\n"}} {"sample_id": "b20909195745c34a819aed14ae996b60ab0f591f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n iscsi_aio_read16_cb(struct iscsi_context *iscsi, int status,\n \n void *command_data, void *opaque)\n+\n {\n \n IscsiAIOCB *acb = opaque;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "iscsi_aio_read16_cb(struct iscsi_context *iscsi, int status,\n\n void *command_data, void *opaque)\n\n{\n\n IscsiAIOCB *acb = opaque;\n\n\n\n trace_iscsi_aio_read16_cb(iscsi, status, acb, acb->canceled);\n\n\n\n if (acb->canceled) {\n\n qemu_aio_release(acb);\n\n return;\n\n }\n\n\n\n acb->status = 0;\n\n if (status != 0) {\n\n error_report(\"Failed to read16 data from iSCSI lun. %s\",\n\n iscsi_get_error(iscsi));\n\n acb->status = -EIO;\n\n }\n\n\n\n iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_24", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,23 +4,23 @@\n \n uint8_t addr;\n \n+ uint16_t val;\n \n uint32_t table;\n \n uint8_t bir_table;\n \n uint8_t bir_pba;\n+\n+ void *offset;\n \n \n \n+ addr = qpci_find_capability(dev, PCI_CAP_ID_MSIX);\n \n+ g_assert_cmphex(addr, !=, 0);\n+\n+\n \n val = qpci_config_readw(dev, addr + PCI_MSIX_FLAGS);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void qpci_msix_enable(QPCIDevice *dev)\n\n{\n\n uint8_t addr;\n\n uint16_t val;\n\n uint32_t table;\n\n uint8_t bir_table;\n\n uint8_t bir_pba;\n\n void *offset;\n\n\n\n addr = qpci_find_capability(dev, PCI_CAP_ID_MSIX);\n\n g_assert_cmphex(addr, !=, 0);\n\n\n\n val = qpci_config_readw(dev, addr + PCI_MSIX_FLAGS);\n\n qpci_config_writew(dev, addr + PCI_MSIX_FLAGS, val | PCI_MSIX_FLAGS_ENABLE);\n\n\n\n table = qpci_config_readl(dev, addr + PCI_MSIX_TABLE);\n\n bir_table = table & PCI_MSIX_FLAGS_BIRMASK;\n\n offset = qpci_iomap(dev, bir_table, NULL);\n\n dev->msix_table = offset + (table & ~PCI_MSIX_FLAGS_BIRMASK);\n\n\n\n table = qpci_config_readl(dev, addr + PCI_MSIX_PBA);\n\n bir_pba = table & PCI_MSIX_FLAGS_BIRMASK;\n\n if (bir_pba != bir_table) {\n\n offset = qpci_iomap(dev, bir_pba, NULL);\n\n }\n\n dev->msix_pba = offset + (table & ~PCI_MSIX_FLAGS_BIRMASK);\n\n\n\n g_assert(dev->msix_table != NULL);\n\n g_assert(dev->msix_pba != NULL);\n\n dev->msix_enabled = true;\n\n}\n"}} {"sample_id": "224944895efe6ac23e3b8f9d35abfee9f5c6c440", "diff": "--- a/source.c\n+++ b/source.c\n@@ -61,9 +61,9 @@\n \n \n s->last_scr=scr;\n+\n+\n+\n+ return scr;\n+\n } ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int64_t update_scr(AVFormatContext *ctx,int stream_index,int64_t pts)\n\n{\n\n MpegMuxContext *s = ctx->priv_data;\n\n int64_t scr;\n\n\n\n if (s->is_vcd)\n\n /* Since the data delivery rate is constant, SCR is computed\n\n using the formula C + i * 1200 where C is the start constant\n\n and i is the pack index.\n\n It is recommended that SCR 0 is at the beginning of the VCD front\n\n margin (a sequence of empty Form 2 sectors on the CD).\n\n It is recommended that the front margin is 30 sectors long, so\n\n we use C = 30*1200 = 36000\n\n (Note that even if the front margin is not 30 sectors the file\n\n will still be correct according to the standard. It just won't have\n\n the \"recommended\" value).*/\n\n scr = 36000 + s->packet_number * 1200;\n\n else {\n\n /* XXX I believe this calculation of SCR is wrong. SCR\n\n specifies at which time the data should enter the decoder.\n\n Two packs cannot enter the decoder at the same time. */\n\n\n\n /* XXX: system clock should be computed precisely, especially for\n\n CBR case. The current mode gives at least something coherent */\n\n if (stream_index == s->scr_stream_index\n\n && pts != AV_NOPTS_VALUE)\n\n scr = pts;\n\n else\n\n scr = s->last_scr;\n\n }\n\n\n\n s->last_scr=scr;\n\n\n\n return scr;\n\n} \n"}} {"sample_id": "7797a73947d5c0e63dd5552b348cf66c384b4555_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static void pxa2xx_pcmcia_realize(DeviceState *dev, Error **errp)\n+\n+{\n \n PXA2xxPCMCIAState *s = PXA2XX_PCMCIA(dev);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void pxa2xx_pcmcia_realize(DeviceState *dev, Error **errp)\n\n{\n\n PXA2xxPCMCIAState *s = PXA2XX_PCMCIA(dev);\n\n\n\n pcmcia_socket_register(&s->slot);\n\n}\n"}} {"sample_id": "ddca7f86ac022289840e0200fd4050b2b58e9176_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,9 +11,9 @@\n for (i = 0; i < nwnames; i++) {\n \n offset += pdu_marshal(pdu, offset, \"Q\", &qids[i]);\n+\n+ }\n+\n+ return offset;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int v9fs_walk_marshal(V9fsPDU *pdu, uint16_t nwnames, V9fsQID *qids)\n\n{\n\n int i;\n\n size_t offset = 7;\n\n offset += pdu_marshal(pdu, offset, \"w\", nwnames);\n\n for (i = 0; i < nwnames; i++) {\n\n offset += pdu_marshal(pdu, offset, \"Q\", &qids[i]);\n\n }\n\n return offset;\n\n}\n"}} {"sample_id": "0b8b8753e4d94901627b3e86431230f2319215c4_19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void migration_fd_process_incoming(QEMUFile *f)\n+\n {\n \n+ Coroutine *co = qemu_coroutine_create(process_incoming_migration_co);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void migration_fd_process_incoming(QEMUFile *f)\n\n{\n\n Coroutine *co = qemu_coroutine_create(process_incoming_migration_co);\n\n\n\n migrate_decompress_threads_create();\n\n qemu_file_set_blocking(f, false);\n\n qemu_coroutine_enter(co, f);\n\n}\n"}} {"sample_id": "42e4126b793d15ec40f3a84017e1d8afecda1b6d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void pci_data_write(PCIBus *s, uint32_t addr, uint32_t val, int len)\n \n {\n+\n PCIDevice *pci_dev = pci_dev_find_by_addr(s, addr);\n+\n uint32_t config_addr = addr & (PCI_CONFIG_SPACE_SIZE - 1);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void pci_data_write(PCIBus *s, uint32_t addr, uint32_t val, int len)\n\n{\n\n PCIDevice *pci_dev = pci_dev_find_by_addr(s, addr);\n\n uint32_t config_addr = addr & (PCI_CONFIG_SPACE_SIZE - 1);\n\n\n\n if (!pci_dev)\n\n return;\n\n\n\n PCI_DPRINTF(\"%s: %s: addr=%02\" PRIx32 \" val=%08\" PRIx32 \" len=%d\\n\",\n\n __func__, pci_dev->name, config_addr, val, len);\n\n pci_dev->config_write(pci_dev, config_addr, val, len);\n\n}\n"}} {"sample_id": "7cfd527525a7d6b1c904890a6b84c1227846415e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n uint64_t *bytes)\n \n+{\n \n+ bool need_cow;\n \n int ret = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int mirror_cow_align(MirrorBlockJob *s, int64_t *offset,\n\n uint64_t *bytes)\n\n{\n\n bool need_cow;\n\n int ret = 0;\n\n int64_t align_offset = *offset;\n\n unsigned int align_bytes = *bytes;\n\n int max_bytes = s->granularity * s->max_iov;\n\n\n\n assert(*bytes < INT_MAX);\n\n need_cow = !test_bit(*offset / s->granularity, s->cow_bitmap);\n\n need_cow |= !test_bit((*offset + *bytes - 1) / s->granularity,\n\n s->cow_bitmap);\n\n if (need_cow) {\n\n bdrv_round_to_clusters(blk_bs(s->target), *offset, *bytes,\n\n &align_offset, &align_bytes);\n\n }\n\n\n\n if (align_bytes > max_bytes) {\n\n align_bytes = max_bytes;\n\n if (need_cow) {\n\n align_bytes = QEMU_ALIGN_DOWN(align_bytes, s->target_cluster_size);\n\n }\n\n }\n\n /* Clipping may result in align_bytes unaligned to chunk boundary, but\n\n * that doesn't matter because it's already the end of source image. */\n\n align_bytes = mirror_clip_bytes(s, align_offset, align_bytes);\n\n\n\n ret = align_offset + align_bytes - (*offset + *bytes);\n\n *offset = align_offset;\n\n *bytes = align_bytes;\n\n assert(ret >= 0);\n\n return ret;\n\n}\n"}} {"sample_id": "e23a1b33b53d25510320b26d9f154e19c6c99725_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n ISABus *isa_bus_new(DeviceState *dev)\n \n {\n+\n if (isabus) {\n \n fprintf(stderr, \"Can't create a second ISA bus\\n\");\n+\n return NULL;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "ISABus *isa_bus_new(DeviceState *dev)\n\n{\n\n if (isabus) {\n\n fprintf(stderr, \"Can't create a second ISA bus\\n\");\n\n return NULL;\n\n }\n\n if (NULL == dev) {\n\n dev = qdev_create(NULL, \"isabus-bridge\");\n\n qdev_init(dev);\n\n }\n\n\n\n isabus = FROM_QBUS(ISABus, qbus_create(&isa_bus_info, dev, NULL));\n\n return isabus;\n\n}\n"}} {"sample_id": "88c725c78e87eecb061f882177c7a6a2ac1059ad", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n kroute.flags = 0;\n \n+ kroute.u.msi.address_lo = (uint32_t)msg.address;\n+\n+ kroute.u.msi.address_hi = msg.address >> 32;\n+\n+ kroute.u.msi.data = le32_to_cpu(msg.data);\n \n if (kvm_msi_devid_required()) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int kvm_irqchip_update_msi_route(KVMState *s, int virq, MSIMessage msg,\n\n PCIDevice *dev)\n\n{\n\n struct kvm_irq_routing_entry kroute = {};\n\n\n\n if (kvm_gsi_direct_mapping()) {\n\n return 0;\n\n }\n\n\n\n if (!kvm_irqchip_in_kernel()) {\n\n return -ENOSYS;\n\n }\n\n\n\n kroute.gsi = virq;\n\n kroute.type = KVM_IRQ_ROUTING_MSI;\n\n kroute.flags = 0;\n\n kroute.u.msi.address_lo = (uint32_t)msg.address;\n\n kroute.u.msi.address_hi = msg.address >> 32;\n\n kroute.u.msi.data = le32_to_cpu(msg.data);\n\n if (kvm_msi_devid_required()) {\n\n kroute.flags = KVM_MSI_VALID_DEVID;\n\n kroute.u.msi.devid = pci_requester_id(dev);\n\n }\n\n if (kvm_arch_fixup_msi_route(&kroute, msg.address, msg.data, dev)) {\n\n return -EINVAL;\n\n }\n\n\n\n trace_kvm_irqchip_update_msi_route(virq);\n\n\n\n return kvm_update_routing_entry(s, &kroute);\n\n}\n"}} {"sample_id": "645c9496f7083c105ecd32f32532496af6aadf62", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n \n \n+ nc = qemu_find_netdev(id);\n \n if (!nc) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void qmp_netdev_del(const char *id, Error **errp)\n\n{\n\n NetClientState *nc;\n\n\n\n nc = qemu_find_netdev(id);\n\n if (!nc) {\n\n error_set(errp, QERR_DEVICE_NOT_FOUND, id);\n\n return;\n\n }\n\n\n\n qemu_del_net_client(nc);\n\n qemu_opts_del(qemu_opts_find(qemu_find_opts_err(\"netdev\", errp), id));\n\n}\n"}} {"sample_id": "bdf026317daa3b9dfa281f29e96fbb6fd48394c8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,18 +2,18 @@\n \n {\n \n+ uint32_t *word = s->used_gsi_bitmap;\n+\n int max_words = ALIGN(s->gsi_count, 32) / 32;\n \n int i, zeroes;\n \n bool retry = true;\n \n+\n+\n+again:\n+\n /* Return the lowest unused GSI in the bitmap */\n \n for (i = 0; i < max_words; i++) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int kvm_irqchip_get_virq(KVMState *s)\n\n{\n\n uint32_t *word = s->used_gsi_bitmap;\n\n int max_words = ALIGN(s->gsi_count, 32) / 32;\n\n int i, zeroes;\n\n bool retry = true;\n\n\n\nagain:\n\n /* Return the lowest unused GSI in the bitmap */\n\n for (i = 0; i < max_words; i++) {\n\n zeroes = ctz32(~word[i]);\n\n if (zeroes == 32) {\n\n continue;\n\n }\n\n\n\n return zeroes + i * 32;\n\n }\n\n if (!s->direct_msi && retry) {\n\n retry = false;\n\n kvm_flush_dynamic_msi_routes(s);\n\n goto again;\n\n }\n\n return -ENOSPC;\n\n\n\n}\n"}} {"sample_id": "3b098d56979d2f7fd707c5be85555d114353a28d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,10 +5,10 @@\n {\n \n StringSerializeData *d = datap;\n+\n+\n+\n+ d->string = string_output_get_string(d->sov);\n \n d->siv = string_input_visitor_new(d->string);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void string_deserialize(void **native_out, void *datap,\n\n VisitorFunc visit, Error **errp)\n\n{\n\n StringSerializeData *d = datap;\n\n\n\n d->string = string_output_get_string(d->sov);\n\n d->siv = string_input_visitor_new(d->string);\n\n visit(d->siv, native_out, errp);\n\n}\n"}} {"sample_id": "0ed93d84edabc7656f5c998ae1a346fe8b94ca54", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n ret = laiocb->ret;\n \n+ if (ret != -ECANCELED) {\n+\n+ if (ret == laiocb->nbytes) {\n+\n+ ret = 0;\n \n } else if (ret >= 0) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_laio_process_completion(struct qemu_laiocb *laiocb)\n\n{\n\n int ret;\n\n\n\n ret = laiocb->ret;\n\n if (ret != -ECANCELED) {\n\n if (ret == laiocb->nbytes) {\n\n ret = 0;\n\n } else if (ret >= 0) {\n\n /* Short reads mean EOF, pad with zeros. */\n\n if (laiocb->is_read) {\n\n qemu_iovec_memset(laiocb->qiov, ret, 0,\n\n laiocb->qiov->size - ret);\n\n } else {\n\n ret = -ENOSPC;\n\n }\n\n }\n\n }\n\n\n\n laiocb->ret = ret;\n\n if (laiocb->co) {\n\n qemu_coroutine_enter(laiocb->co);\n\n } else {\n\n laiocb->common.cb(laiocb->common.opaque, ret);\n\n qemu_aio_unref(laiocb);\n\n }\n\n}\n"}} {"sample_id": "0b5538c300a56c3cfb33022840fe0b4968147e7a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void __attribute__((constructor)) st_init(void)\n+\n {\n \n atexit(st_flush_trace_buffer);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void __attribute__((constructor)) st_init(void)\n\n{\n\n atexit(st_flush_trace_buffer);\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_45", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n return -ENOMEDIUM;\n \n }\n+\n+ if (drv->bdrv_get_allocated_file_size) {\n+\n+ return drv->bdrv_get_allocated_file_size(bs);\n+\n }\n \n if (bs->file) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int64_t bdrv_get_allocated_file_size(BlockDriverState *bs)\n\n{\n\n BlockDriver *drv = bs->drv;\n\n if (!drv) {\n\n return -ENOMEDIUM;\n\n }\n\n if (drv->bdrv_get_allocated_file_size) {\n\n return drv->bdrv_get_allocated_file_size(bs);\n\n }\n\n if (bs->file) {\n\n return bdrv_get_allocated_file_size(bs->file);\n\n }\n\n return -ENOTSUP;\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_45", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static bool event_notifier_poll(void *opaque)\n \n+{\n+\n+ EventNotifier *e = opaque;\n \n AioContext *ctx = container_of(e, AioContext, notifier);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool event_notifier_poll(void *opaque)\n\n{\n\n EventNotifier *e = opaque;\n\n AioContext *ctx = container_of(e, AioContext, notifier);\n\n\n\n return atomic_read(&ctx->notified);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_30", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void check_reserved_space (target_phys_addr_t *start,\n \n+ target_phys_addr_t *length)\n+\n+{\n+\n+ target_phys_addr_t begin = *start;\n \n target_phys_addr_t end = *start + *length;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void check_reserved_space (target_phys_addr_t *start,\n\n target_phys_addr_t *length)\n\n{\n\n target_phys_addr_t begin = *start;\n\n target_phys_addr_t end = *start + *length;\n\n\n\n if (end >= 0x1e000000LL && end < 0x1f100000LL)\n\n end = 0x1e000000LL;\n\n if (begin >= 0x1e000000LL && begin < 0x1f100000LL)\n\n begin = 0x1f100000LL;\n\n if (end >= 0x1fc00000LL && end < 0x1fd00000LL)\n\n end = 0x1fc00000LL;\n\n if (begin >= 0x1fc00000LL && begin < 0x1fd00000LL)\n\n begin = 0x1fd00000LL;\n\n /* XXX: This is broken when a reserved range splits the requested range */\n\n if (end >= 0x1f100000LL && begin < 0x1e000000LL)\n\n end = 0x1e000000LL;\n\n if (end >= 0x1fd00000LL && begin < 0x1fc00000LL)\n\n end = 0x1fc00000LL;\n\n\n\n *start = begin;\n\n *length = end - begin;\n\n}\n"}} {"sample_id": "20c334a797bf46a4ee59a6e42be6d5e7c3cda585", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static inline uint32_t mipsdsp_sat32_sub(int32_t a, int32_t b,\n \n CPUMIPSState *env)\n+\n+{\n \n int32_t temp;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static inline uint32_t mipsdsp_sat32_sub(int32_t a, int32_t b,\n\n CPUMIPSState *env)\n\n{\n\n int32_t temp;\n\n\n\n temp = a - b;\n\n if (MIPSDSP_OVERFLOW(a, -b, temp, 0x80000000)) {\n\n if (a > 0) {\n\n temp = 0x7FFFFFFF;\n\n } else {\n\n temp = 0x80000000;\n\n }\n\n set_DSPControl_overflow_flag(1, 20, env);\n\n }\n\n\n\n return temp & 0xFFFFFFFFull;\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_46", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n bs->copy_on_read++;\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bdrv_enable_copy_on_read(BlockDriverState *bs)\n\n{\n\n bs->copy_on_read++;\n\n}\n"}} {"sample_id": "284b432662b6e137148ff9d13ef2b554cb14b4ae", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n write_image_header(s);\n \n avio_write(s->pb, pkt->data, pkt->size);\n+\n+ return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int fits_write_packet(AVFormatContext *s, AVPacket *pkt)\n\n{\n\n write_image_header(s);\n\n avio_write(s->pb, pkt->data, pkt->size);\n\n return 0;\n\n}\n"}} {"sample_id": "b9bec74bcb16519a876ec21cd5277c526a9b512d_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n if (set)\n \n+ *kvm_reg = *qemu_reg;\n+\n+ else\n \n *qemu_reg = *kvm_reg;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void kvm_getput_reg(__u64 *kvm_reg, target_ulong *qemu_reg, int set)\n\n{\n\n if (set)\n\n *kvm_reg = *qemu_reg;\n\n else\n\n *qemu_reg = *kvm_reg;\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_45", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static always_inline void gen_qemu_ldg (TCGv t0, TCGv t1, int flags)\n \n+{\n+\n+ TCGv tmp = tcg_temp_new(TCG_TYPE_I64);\n \n tcg_gen_qemu_ld64(tmp, t1, flags);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static always_inline void gen_qemu_ldg (TCGv t0, TCGv t1, int flags)\n\n{\n\n TCGv tmp = tcg_temp_new(TCG_TYPE_I64);\n\n tcg_gen_qemu_ld64(tmp, t1, flags);\n\n tcg_gen_helper_1_1(helper_memory_to_g, t0, tmp);\n\n tcg_temp_free(tmp);\n\n}\n"}} {"sample_id": "fd97fd4408040a9a6dfaf2fdaeca1c566db6d0aa", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n+static long gethugepagesize(const char *path, Error **errp)\n \n {\n \n+ struct statfs fs;\n \n int ret;\n+\n+\n \n do {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static long gethugepagesize(const char *path, Error **errp)\n\n{\n\n struct statfs fs;\n\n int ret;\n\n\n\n do {\n\n ret = statfs(path, &fs);\n\n } while (ret != 0 && errno == EINTR);\n\n\n\n if (ret != 0) {\n\n error_setg_errno(errp, errno, \"failed to get page size of file %s\",\n\n path);\n\n return 0;\n\n }\n\n\n\n return fs.f_bsize;\n\n}\n"}} {"sample_id": "4a1418e07bdcfaa3177739e04707ecaec75d89e1_26", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n ioport_write(0, addr, val);\n \n+#ifdef CONFIG_KQEMU\n+\n+ if (env)\n+\n env->last_io_time = cpu_get_time_fast();\n \n #endif", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void cpu_outb(CPUState *env, pio_addr_t addr, uint8_t val)\n\n{\n\n LOG_IOPORT(\"outb: %04\"FMT_pioaddr\" %02\"PRIx8\"\\n\", addr, val);\n\n ioport_write(0, addr, val);\n\n#ifdef CONFIG_KQEMU\n\n if (env)\n\n env->last_io_time = cpu_get_time_fast();\n\n#endif\n\n}\n"}} {"sample_id": "8b33d9eeba91422ee2d73b6936ad57262d18cf5a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static int raw_write_scrubbed_bootsect(BlockDriverState *bs,\n+\n+ const uint8_t *buf)\n+\n+{\n \n uint8_t bootsect[512];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int raw_write_scrubbed_bootsect(BlockDriverState *bs,\n\n const uint8_t *buf)\n\n{\n\n uint8_t bootsect[512];\n\n\n\n /* scrub the dangerous signature */\n\n memcpy(bootsect, buf, 512);\n\n memset(bootsect, 0, 4);\n\n\n\n return bdrv_write(bs->file, 0, bootsect, 1);\n\n}\n"}} {"sample_id": "550bda741cfe0e471a70e40529a9ab02d31b7049", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n av_cold void ff_dsputil_init_alpha(DSPContext *c, AVCodecContext *avctx)\n \n {\n+\n+ const int high_bit_depth = avctx->bits_per_raw_sample > 8;\n \n \n \n@@ -13,12 +13,12 @@\n c->put_pixels_clamped = put_pixels_clamped_mvi_asm;\n \n c->add_pixels_clamped = add_pixels_clamped_mvi_asm;\n+\n+\n+\n+ if (!high_bit_depth)\n+\n+ c->get_pixels = get_pixels_mvi;\n \n c->diff_pixels = diff_pixels_mvi;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "av_cold void ff_dsputil_init_alpha(DSPContext *c, AVCodecContext *avctx)\n\n{\n\n const int high_bit_depth = avctx->bits_per_raw_sample > 8;\n\n\n\n /* amask clears all bits that correspond to present features. */\n\n if (amask(AMASK_MVI) == 0) {\n\n c->put_pixels_clamped = put_pixels_clamped_mvi_asm;\n\n c->add_pixels_clamped = add_pixels_clamped_mvi_asm;\n\n\n\n if (!high_bit_depth)\n\n c->get_pixels = get_pixels_mvi;\n\n c->diff_pixels = diff_pixels_mvi;\n\n c->sad[0] = pix_abs16x16_mvi_asm;\n\n c->sad[1] = pix_abs8x8_mvi;\n\n c->pix_abs[0][0] = pix_abs16x16_mvi_asm;\n\n c->pix_abs[1][0] = pix_abs8x8_mvi;\n\n c->pix_abs[0][1] = pix_abs16x16_x2_mvi;\n\n c->pix_abs[0][2] = pix_abs16x16_y2_mvi;\n\n c->pix_abs[0][3] = pix_abs16x16_xy2_mvi;\n\n }\n\n\n\n put_pixels_clamped_axp_p = c->put_pixels_clamped;\n\n add_pixels_clamped_axp_p = c->add_pixels_clamped;\n\n\n\n if (!avctx->lowres && avctx->bits_per_raw_sample <= 8 &&\n\n (avctx->idct_algo == FF_IDCT_AUTO ||\n\n avctx->idct_algo == FF_IDCT_SIMPLEALPHA)) {\n\n c->idct_put = ff_simple_idct_put_axp;\n\n c->idct_add = ff_simple_idct_add_axp;\n\n c->idct = ff_simple_idct_axp;\n\n }\n\n}\n"}} {"sample_id": "e8ede0a8bb5298a6979bcf7ed84ef64a64a4e3fe_15", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+float32 HELPER(ucf64_df2si)(float64 x, CPUUniCore32State *env)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "float32 HELPER(ucf64_df2si)(float64 x, CPUUniCore32State *env)\n\n{\n\n return ucf64_itos(float64_to_int32(x, &env->ucf64.fp_status));\n\n}\n"}} {"sample_id": "f8de16605cf9864e258d91e95be0ed76bdeac744", "diff": "--- a/source.c\n+++ b/source.c\n@@ -40,9 +40,9 @@\n /* how many allocated clusters ? */\n c = count_contiguous_clusters(nb_clusters, s->cluster_size,\n &l2_table[l2_index], 0, QCOW_OFLAG_COPIED);\n+ nb_available = (c * s->cluster_sectors);\n+out:\n+ if (nb_available > nb_needed)\n+ nb_available = nb_needed;\n+ *num = nb_available - index_in_cluster;\n return cluster_offset & ~QCOW_OFLAG_COPIED;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static uint64_t get_cluster_offset(BlockDriverState *bs,\n uint64_t offset, int *num)\n{\n BDRVQcowState *s = bs->opaque;\n int l1_index, l2_index;\n uint64_t l2_offset, *l2_table, cluster_offset;\n int l1_bits, c;\n int index_in_cluster, nb_available, nb_needed, nb_clusters;\n index_in_cluster = (offset >> 9) & (s->cluster_sectors - 1);\n nb_needed = *num + index_in_cluster;\n l1_bits = s->l2_bits + s->cluster_bits;\n /* compute how many bytes there are between the offset and\n * the end of the l1 entry\n */\n nb_available = (1 << l1_bits) - (offset & ((1 << l1_bits) - 1));\n /* compute the number of available sectors */\n nb_available = (nb_available >> 9) + index_in_cluster;\n cluster_offset = 0;\n /* seek the the l2 offset in the l1 table */\n l1_index = offset >> l1_bits;\n if (l1_index >= s->l1_size)\n goto out;\n l2_offset = s->l1_table[l1_index];\n /* seek the l2 table of the given l2 offset */\n if (!l2_offset)\n goto out;\n /* load the l2 table in memory */\n l2_offset &= ~QCOW_OFLAG_COPIED;\n l2_table = l2_load(bs, l2_offset);\n if (l2_table == NULL)\n return 0;\n /* find the cluster offset for the given disk offset */\n l2_index = (offset >> s->cluster_bits) & (s->l2_size - 1);\n cluster_offset = be64_to_cpu(l2_table[l2_index]);\n nb_clusters = size_to_clusters(s, nb_needed << 9);\n if (!cluster_offset) {\n /* how many empty clusters ? */\n c = count_contiguous_free_clusters(nb_clusters, &l2_table[l2_index]);\n } else {\n /* how many allocated clusters ? */\n c = count_contiguous_clusters(nb_clusters, s->cluster_size,\n &l2_table[l2_index], 0, QCOW_OFLAG_COPIED);\n nb_available = (c * s->cluster_sectors);\nout:\n if (nb_available > nb_needed)\n nb_available = nb_needed;\n *num = nb_available - index_in_cluster;\n return cluster_offset & ~QCOW_OFLAG_COPIED;"}} {"sample_id": "87e8788680e16c51f6048af26f3f7830c35207a5_28", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int h261_probe(AVProbeData *p)\n+\n+{\n+\n+ int code;\n+\n const uint8_t *d;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int h261_probe(AVProbeData *p)\n\n{\n\n int code;\n\n const uint8_t *d;\n\n\n\n if (p->buf_size < 6)\n\n return 0;\n\n d = p->buf;\n\n code = (d[0] << 12) | (d[1] << 4) | (d[2] >> 4);\n\n if (code == 0x10) {\n\n return 50;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_59", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+int bdrv_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)\n+\n+{\n+\n BlockDriver *drv = bs->drv;\n \n if (!drv)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int bdrv_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)\n\n{\n\n BlockDriver *drv = bs->drv;\n\n if (!drv)\n\n return -ENOMEDIUM;\n\n if (!drv->bdrv_get_info)\n\n return -ENOTSUP;\n\n memset(bdi, 0, sizeof(*bdi));\n\n return drv->bdrv_get_info(bs, bdi);\n\n}\n"}} {"sample_id": "cfcd396bae11de94ad4a729361bc9b7b05f04c27", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n for (i = 0; i < s->channels; i++)\n \n {\n+\n+ s->decoded[i] = av_realloc(s->decoded[i], sizeof(int32_t)*s->max_blocksize);\n+\n+ }\n+\n \n \n s->bitstream= av_fast_realloc(s->bitstream, &s->allocated_bitstream_size, s->max_framesize);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void allocate_buffers(FLACContext *s){\n\n int i;\n\n\n\n assert(s->max_blocksize);\n\n\n\n if(s->max_framesize == 0 && s->max_blocksize){\n\n s->max_framesize= (s->channels * s->bps * s->max_blocksize + 7)/ 8; //FIXME header overhead\n\n }\n\n\n\n for (i = 0; i < s->channels; i++)\n\n {\n\n s->decoded[i] = av_realloc(s->decoded[i], sizeof(int32_t)*s->max_blocksize);\n\n }\n\n\n\n s->bitstream= av_fast_realloc(s->bitstream, &s->allocated_bitstream_size, s->max_framesize);\n\n}\n"}} {"sample_id": "2c6942fa7b332a95286071b92d233853e1000948_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n BlockDriverState *bs;\n \n \n+\n+ bs_list = qlist_new();\n+\n+\n+\n QTAILQ_FOREACH(bs, &bdrv_states, list) {\n \n QObject *bs_obj;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bdrv_info(Monitor *mon, QObject **ret_data)\n\n{\n\n QList *bs_list;\n\n BlockDriverState *bs;\n\n\n\n bs_list = qlist_new();\n\n\n\n QTAILQ_FOREACH(bs, &bdrv_states, list) {\n\n QObject *bs_obj;\n\n\n\n bs_obj = qobject_from_jsonf(\"{ 'device': %s, 'type': 'unknown', \"\n\n \"'removable': %i, 'locked': %i }\",\n\n bs->device_name, bs->removable,\n\n bdrv_dev_is_medium_locked(bs));\n\n\n\n if (bs->drv) {\n\n QObject *obj;\n\n QDict *bs_dict = qobject_to_qdict(bs_obj);\n\n\n\n obj = qobject_from_jsonf(\"{ 'file': %s, 'ro': %i, 'drv': %s, \"\n\n \"'encrypted': %i }\",\n\n bs->filename, bs->read_only,\n\n bs->drv->format_name,\n\n bdrv_is_encrypted(bs));\n\n if (bs->backing_file[0] != '\\0') {\n\n QDict *qdict = qobject_to_qdict(obj);\n\n qdict_put(qdict, \"backing_file\",\n\n qstring_from_str(bs->backing_file));\n\n }\n\n\n\n qdict_put_obj(bs_dict, \"inserted\", obj);\n\n }\n\n qlist_append_obj(bs_list, bs_obj);\n\n }\n\n\n\n *ret_data = QOBJECT(bs_list);\n\n}\n"}} {"sample_id": "30fb2ca603e8b8d0f02630ef18bc0d0637a88ffa_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static int qemu_balloon(ram_addr_t target, MonitorCompletion cb, void *opaque)\n+\n {\n \n if (!balloon_event_fn) {\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int qemu_balloon(ram_addr_t target, MonitorCompletion cb, void *opaque)\n\n{\n\n if (!balloon_event_fn) {\n\n return 0;\n\n }\n\n trace_balloon_event(balloon_opaque, target);\n\n balloon_event_fn(balloon_opaque, target, cb, opaque);\n\n return 1;\n\n}\n"}} {"sample_id": "1753f3dc177a82f8b3c5ea8d2a32737db9411dd4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n NvmeRequest *req = opaque;\n+\n NvmeSQueue *sq = req->sq;\n \n NvmeCtrl *n = sq->ctrl;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void nvme_rw_cb(void *opaque, int ret)\n\n{\n\n NvmeRequest *req = opaque;\n\n NvmeSQueue *sq = req->sq;\n\n NvmeCtrl *n = sq->ctrl;\n\n NvmeCQueue *cq = n->cq[sq->cqid];\n\n\n\n block_acct_done(blk_get_stats(n->conf.blk), &req->acct);\n\n if (!ret) {\n\n req->status = NVME_SUCCESS;\n\n } else {\n\n req->status = NVME_INTERNAL_DEV_ERROR;\n\n }\n\n if (req->has_sg) {\n\n qemu_sglist_destroy(&req->qsg);\n\n }\n\n nvme_enqueue_req_completion(cq, req);\n\n}\n"}} {"sample_id": "e0e2d644096c79a71099b176d08f465f6803a8b1_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static uint16_t vring_used_idx(VirtQueue *vq)\n+\n {\n \n VRingMemoryRegionCaches *caches = atomic_rcu_read(&vq->vring.caches);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static uint16_t vring_used_idx(VirtQueue *vq)\n\n{\n\n VRingMemoryRegionCaches *caches = atomic_rcu_read(&vq->vring.caches);\n\n hwaddr pa = offsetof(VRingUsed, idx);\n\n return virtio_lduw_phys_cached(vq->vdev, &caches->used, pa);\n\n}\n"}} {"sample_id": "5255fcf8e47acd059e2f0d414841c40231c1bd22_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n }\n \n+ if (vec->active && vec->prio < active_prio) {\n+\n+ active_prio = vec->prio;\n+\n+ }\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void nvic_recompute_state(NVICState *s)\n\n{\n\n int i;\n\n int pend_prio = NVIC_NOEXC_PRIO;\n\n int active_prio = NVIC_NOEXC_PRIO;\n\n int pend_irq = 0;\n\n\n\n for (i = 1; i < s->num_irq; i++) {\n\n VecInfo *vec = &s->vectors[i];\n\n\n\n if (vec->enabled && vec->pending && vec->prio < pend_prio) {\n\n pend_prio = vec->prio;\n\n pend_irq = i;\n\n }\n\n if (vec->active && vec->prio < active_prio) {\n\n active_prio = vec->prio;\n\n }\n\n }\n\n\n\n if (active_prio > 0) {\n\n active_prio &= nvic_gprio_mask(s);\n\n }\n\n\n\n s->vectpending = pend_irq;\n\n s->exception_prio = active_prio;\n\n\n\n trace_nvic_recompute_state(s->vectpending, s->exception_prio);\n\n}\n"}} {"sample_id": "d369f20763a857eac544a5289a046d0285a91df8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,17 +1,17 @@\n static int local_chown(FsContext *fs_ctx, V9fsPath *fs_path, FsCred *credp)\n+\n {\n+\n char *buffer;\n+\n+ int ret = -1;\n+\n char *path = fs_path->data;\n \n+\n \n if ((credp->fc_uid == -1 && credp->fc_gid == -1) ||\n+\n (fs_ctx->export_flags & V9FS_SM_PASSTHROUGH) ||\n \n (fs_ctx->export_flags & V9FS_SM_NONE)) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int local_chown(FsContext *fs_ctx, V9fsPath *fs_path, FsCred *credp)\n\n{\n\n char *buffer;\n\n int ret = -1;\n\n char *path = fs_path->data;\n\n\n\n if ((credp->fc_uid == -1 && credp->fc_gid == -1) ||\n\n (fs_ctx->export_flags & V9FS_SM_PASSTHROUGH) ||\n\n (fs_ctx->export_flags & V9FS_SM_NONE)) {\n\n buffer = rpath(fs_ctx, path);\n\n ret = lchown(buffer, credp->fc_uid, credp->fc_gid);\n\n g_free(buffer);\n\n } else if (fs_ctx->export_flags & V9FS_SM_MAPPED) {\n\n buffer = rpath(fs_ctx, path);\n\n ret = local_set_xattr(buffer, credp);\n\n g_free(buffer);\n\n } else if (fs_ctx->export_flags & V9FS_SM_MAPPED_FILE) {\n\n return local_set_mapped_file_attr(fs_ctx, path, credp);\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "85f94f868fcd868f0f605e9d3c1ad6351c557190", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n \n \n if (SDL_GetAppState() & SDL_APPINPUTFOCUS) {\n+\n+ SDL_GetMouseState(&mouse_x, &mouse_y);\n+\n+ if (mouse_x > 0 && mouse_x < real_screen->w - 1 &&\n+\n mouse_y > 0 && mouse_y < real_screen->h - 1) {\n \n sdl_grab_start();", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void absolute_mouse_grab(void)\n\n{\n\n int mouse_x, mouse_y;\n\n\n\n if (SDL_GetAppState() & SDL_APPINPUTFOCUS) {\n\n SDL_GetMouseState(&mouse_x, &mouse_y);\n\n if (mouse_x > 0 && mouse_x < real_screen->w - 1 &&\n\n mouse_y > 0 && mouse_y < real_screen->h - 1) {\n\n sdl_grab_start();\n\n }\n\n }\n\n}\n"}} {"sample_id": "65207c59d99f2260c5f1d3b9c491146616a522aa_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void qmp_monitor_complete(void *opaque, QObject *ret_data)\n+\n {\n \n monitor_protocol_emitter(opaque, ret_data);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void qmp_monitor_complete(void *opaque, QObject *ret_data)\n\n{\n\n monitor_protocol_emitter(opaque, ret_data);\n\n}\n"}} {"sample_id": "5b08fc106d3146ddc1447d82d4770fc402fc363b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n curses_keyboard_setup();\n \n atexit(curses_atexit);\n+\n+\n+\n+#ifndef _WIN32\n+\n signal(SIGINT, SIG_DFL);\n \n signal(SIGQUIT, SIG_DFL);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void curses_display_init(DisplayState *ds, int full_screen)\n\n{\n\n#ifndef _WIN32\n\n if (!isatty(1)) {\n\n fprintf(stderr, \"We need a terminal output\\n\");\n\n exit(1);\n\n }\n\n#endif\n\n\n\n curses_setup();\n\n curses_keyboard_setup();\n\n atexit(curses_atexit);\n\n\n\n#ifndef _WIN32\n\n signal(SIGINT, SIG_DFL);\n\n signal(SIGQUIT, SIG_DFL);\n\n#if defined(SIGWINCH) && defined(KEY_RESIZE)\n\n /* some curses implementations provide a handler, but we\n\n * want to be sure this is handled regardless of the library */\n\n signal(SIGWINCH, curses_winch_handler);\n\n#endif\n\n#endif\n\n\n\n ds->data = (void *) screen;\n\n ds->linesize = 0;\n\n ds->depth = 0;\n\n ds->width = 640;\n\n ds->height = 400;\n\n ds->dpy_update = curses_update;\n\n ds->dpy_resize = curses_resize;\n\n ds->dpy_refresh = curses_refresh;\n\n ds->dpy_text_cursor = curses_cursor_position;\n\n\n\n invalidate = 1;\n\n\n\n /* Standard VGA initial text mode dimensions */\n\n curses_resize(ds, 80, 25);\n\n}\n"}} {"sample_id": "3ab9a2a5577d445252724af4067d2a7c8a378efa_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void rv40_v_strong_loop_filter(uint8_t *src, const int stride,\n \n const int alpha, const int lims,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void rv40_v_strong_loop_filter(uint8_t *src, const int stride,\n\n const int alpha, const int lims,\n\n const int dmode, const int chroma)\n\n{\n\n rv40_strong_loop_filter(src, 1, stride, alpha, lims, dmode, chroma);\n\n}\n"}} {"sample_id": "3c529d935923a70519557d420db1d5a09a65086a_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,11 +34,11 @@\n \n break;\n \n+ } else if (*pacb == acb) {\n+\n+ *pacb = acb->next;\n+\n+ raw_fd_pool_put(acb);\n \n qemu_aio_release(acb);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void raw_aio_cancel(BlockDriverAIOCB *blockacb)\n\n{\n\n int ret;\n\n RawAIOCB *acb = (RawAIOCB *)blockacb;\n\n RawAIOCB **pacb;\n\n\n\n ret = aio_cancel(acb->aiocb.aio_fildes, &acb->aiocb);\n\n if (ret == AIO_NOTCANCELED) {\n\n /* fail safe: if the aio could not be canceled, we wait for\n\n it */\n\n while (aio_error(&acb->aiocb) == EINPROGRESS);\n\n }\n\n\n\n /* remove the callback from the queue */\n\n pacb = &posix_aio_state->first_aio;\n\n for(;;) {\n\n if (*pacb == NULL) {\n\n break;\n\n } else if (*pacb == acb) {\n\n *pacb = acb->next;\n\n raw_fd_pool_put(acb);\n\n qemu_aio_release(acb);\n\n break;\n\n }\n\n pacb = &acb->next;\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_216", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n unsigned size)\n \n+{\n+\n+ E1000State *s = opaque;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t e1000_io_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n E1000State *s = opaque;\n\n\n\n (void)s;\n\n return 0;\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_48", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+void qpci_memwrite(QPCIDevice *dev, void *data, const void *buf, size_t len)\n+\n+{\n+\n uintptr_t addr = (uintptr_t)data;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void qpci_memwrite(QPCIDevice *dev, void *data, const void *buf, size_t len)\n\n{\n\n uintptr_t addr = (uintptr_t)data;\n\n\n\n g_assert(addr >= QPCI_PIO_LIMIT);\n\n dev->bus->memwrite(dev->bus, addr, buf, len);\n\n}\n"}} {"sample_id": "47882fa4975bf0b58dd74474329fdd7154e8f04c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void net_tx_pkt_init(struct NetTxPkt **pkt, PCIDevice *pci_dev,\n \n uint32_t max_frags, bool has_virt_hdr)\n+\n+{\n \n struct NetTxPkt *p = g_malloc0(sizeof *p);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void net_tx_pkt_init(struct NetTxPkt **pkt, PCIDevice *pci_dev,\n\n uint32_t max_frags, bool has_virt_hdr)\n\n{\n\n struct NetTxPkt *p = g_malloc0(sizeof *p);\n\n\n\n p->pci_dev = pci_dev;\n\n\n\n p->vec = g_malloc((sizeof *p->vec) *\n\n (max_frags + NET_TX_PKT_PL_START_FRAG));\n\n\n\n p->raw = g_malloc((sizeof *p->raw) * max_frags);\n\n\n\n p->max_payload_frags = max_frags;\n\n p->max_raw_frags = max_frags;\n\n p->has_virt_hdr = has_virt_hdr;\n\n p->vec[NET_TX_PKT_VHDR_FRAG].iov_base = &p->virt_hdr;\n\n p->vec[NET_TX_PKT_VHDR_FRAG].iov_len =\n\n p->has_virt_hdr ? sizeof p->virt_hdr : 0;\n\n p->vec[NET_TX_PKT_L2HDR_FRAG].iov_base = &p->l2_hdr;\n\n p->vec[NET_TX_PKT_L3HDR_FRAG].iov_base = &p->l3_hdr;\n\n\n\n *pkt = p;\n\n}\n"}} {"sample_id": "c89d416a2b0fb6a21224186b10af4c4a3feee31b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n e1000e_write_ps_rx_descr(E1000ECore *core, uint8_t *desc,\n \n struct NetRxPkt *pkt,\n+\n const E1000E_RSSInfo *rss_info,\n \n size_t ps_hdr_len,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "e1000e_write_ps_rx_descr(E1000ECore *core, uint8_t *desc,\n\n struct NetRxPkt *pkt,\n\n const E1000E_RSSInfo *rss_info,\n\n size_t ps_hdr_len,\n\n uint16_t(*written)[MAX_PS_BUFFERS])\n\n{\n\n int i;\n\n union e1000_rx_desc_packet_split *d =\n\n (union e1000_rx_desc_packet_split *) desc;\n\n\n\n memset(d, 0, sizeof(*d));\n\n\n\n d->wb.middle.length0 = cpu_to_le16((*written)[0]);\n\n\n\n for (i = 0; i < PS_PAGE_BUFFERS; i++) {\n\n d->wb.upper.length[i] = cpu_to_le16((*written)[i + 1]);\n\n }\n\n\n\n e1000e_build_rx_metadata(core, pkt, pkt != NULL,\n\n rss_info,\n\n &d->wb.lower.hi_dword.rss,\n\n &d->wb.lower.mrq,\n\n &d->wb.middle.status_error,\n\n &d->wb.lower.hi_dword.csum_ip.ip_id,\n\n &d->wb.middle.vlan);\n\n\n\n d->wb.upper.header_status =\n\n cpu_to_le16(ps_hdr_len | (ps_hdr_len ? E1000_RXDPS_HDRSTAT_HDRSP : 0));\n\n\n\n trace_e1000e_rx_desc_ps_write((*written)[0], (*written)[1],\n\n (*written)[2], (*written)[3]);\n\n}\n"}} {"sample_id": "36802b6b1ed7887aeae5d027f86a969400f8824a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n int target_bits = 0;\n+\n \n \n if (host_bits & float_flag_invalid)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline int vfp_exceptbits_from_host(int host_bits)\n\n{\n\n int target_bits = 0;\n\n\n\n if (host_bits & float_flag_invalid)\n\n target_bits |= 1;\n\n if (host_bits & float_flag_divbyzero)\n\n target_bits |= 2;\n\n if (host_bits & float_flag_overflow)\n\n target_bits |= 4;\n\n if (host_bits & float_flag_underflow)\n\n target_bits |= 8;\n\n if (host_bits & float_flag_inexact)\n\n target_bits |= 0x10;\n\n if (host_bits & float_flag_input_denormal)\n\n target_bits |= 0x80;\n\n return target_bits;\n\n}\n"}} {"sample_id": "193982c6f9424779b53a168fe32ebc30a776cbf1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void do_pci_unregister_device(PCIDevice *pci_dev)\n \n {\n+\n pci_dev->bus->devices[pci_dev->devfn] = NULL;\n \n pci_config_free(pci_dev);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void do_pci_unregister_device(PCIDevice *pci_dev)\n\n{\n\n pci_dev->bus->devices[pci_dev->devfn] = NULL;\n\n pci_config_free(pci_dev);\n\n\n\n memory_region_del_subregion(&pci_dev->bus_master_container_region,\n\n &pci_dev->bus_master_enable_region);\n\n address_space_destroy(&pci_dev->bus_master_as);\n\n}\n"}} {"sample_id": "c34c762015fec023c3ea5cf3629cbac462a80973", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n error_setg(errp, \"No MTTCG when icount is enabled\");\n \n } else {\n+\n+\n+\n+\n+\n if (!check_tcg_memory_orders_compatible()) {\n \n error_report(\"Guest expects a stronger memory ordering \"", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void qemu_tcg_configure(QemuOpts *opts, Error **errp)\n\n{\n\n const char *t = qemu_opt_get(opts, \"thread\");\n\n if (t) {\n\n if (strcmp(t, \"multi\") == 0) {\n\n if (TCG_OVERSIZED_GUEST) {\n\n error_setg(errp, \"No MTTCG when guest word size > hosts\");\n\n } else if (use_icount) {\n\n error_setg(errp, \"No MTTCG when icount is enabled\");\n\n } else {\n\n\n\n\n\n if (!check_tcg_memory_orders_compatible()) {\n\n error_report(\"Guest expects a stronger memory ordering \"\n\n \"than the host provides\");\n\n error_printf(\"This may cause strange/hard to debug errors\");\n\n }\n\n mttcg_enabled = true;\n\n }\n\n } else if (strcmp(t, \"single\") == 0) {\n\n mttcg_enabled = false;\n\n } else {\n\n error_setg(errp, \"Invalid 'thread' setting %s\", t);\n\n }\n\n } else {\n\n mttcg_enabled = default_mttcg_enabled();\n\n }\n\n}"}} {"sample_id": "745f4bcc2c1deaa562cce01fa52e38b0220aed31", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n AVFrame *frame)\n \n+{\n+\n+ const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(frame->format);\n+\n+ uint8_t *p, *p0;\n \n int plane;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void draw_bar(TestSourceContext *test, const uint8_t color[4],\n\n int x, int y, int w, int h,\n\n AVFrame *frame)\n\n{\n\n const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(frame->format);\n\n uint8_t *p, *p0;\n\n int plane;\n\n\n\n x = FFMIN(x, test->w - 1);\n\n y = FFMIN(y, test->h - 1);\n\n w = FFMIN(w, test->w - x);\n\n h = FFMIN(h, test->h - y);\n\n\n\n av_assert0(x + w <= test->w);\n\n av_assert0(y + h <= test->h);\n\n\n\n for (plane = 0; frame->data[plane]; plane++) {\n\n const int c = color[plane];\n\n const int linesize = frame->linesize[plane];\n\n int i, px, py, pw, ph;\n\n\n\n if (plane == 1 || plane == 2) {\n\n px = x >> desc->log2_chroma_w;\n\n pw = AV_CEIL_RSHIFT(w, desc->log2_chroma_w);\n\n py = y >> desc->log2_chroma_h;\n\n ph = AV_CEIL_RSHIFT(h, desc->log2_chroma_h);\n\n } else {\n\n px = x;\n\n pw = w;\n\n py = y;\n\n ph = h;\n\n }\n\n\n\n p0 = p = frame->data[plane] + py * linesize + px;\n\n memset(p, c, pw);\n\n p += linesize;\n\n for (i = 1; i < ph; i++, p += linesize)\n\n memcpy(p, p0, pw);\n\n }\n\n}\n"}} {"sample_id": "c23acbaed40101c677dfcfbbfe0d2c230a8e8f44_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void ff_jref_idct1_add(uint8_t *dest, int line_size, DCTELEM *block)\n+\n+{\n \n uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void ff_jref_idct1_add(uint8_t *dest, int line_size, DCTELEM *block)\n\n{\n\n uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;\n\n\n\n dest[0] = cm[dest[0] + ((block[0] + 4)>>3)];\n\n}\n"}} {"sample_id": "32c813e6c2a857b93b897901b7e20281397528a3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,8 +6,8 @@\n \n return 0;\n \n+ }\n+\n+ return alg_block_len[alg];\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "size_t qcrypto_cipher_get_block_len(QCryptoCipherAlgorithm alg)\n\n{\n\n if (alg >= G_N_ELEMENTS(alg_key_len)) {\n\n return 0;\n\n }\n\n return alg_block_len[alg];\n\n}\n"}} {"sample_id": "fc22118d9bb56ec71655b936a29513c140e6c289_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n void *value, size_t size, int flags)\n \n+{\n+\n+ if ((ctx->fs_sm == SM_MAPPED) &&\n+\n+ (strncmp(name, \"user.virtfs.\", 12) == 0)) {\n \n /*\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int local_lsetxattr(FsContext *ctx, const char *path, const char *name,\n\n void *value, size_t size, int flags)\n\n{\n\n if ((ctx->fs_sm == SM_MAPPED) &&\n\n (strncmp(name, \"user.virtfs.\", 12) == 0)) {\n\n /*\n\n * Don't allow fetch of user.virtfs namesapce\n\n * in case of mapped security\n\n */\n\n errno = EACCES;\n\n return -1;\n\n }\n\n return lsetxattr(rpath(ctx, path), name, value, size, flags);\n\n}\n"}} {"sample_id": "f293709c6af7a65a9bcec09cdba7a60183657a3e_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n+static __attribute__((unused)) void map_exec(void *addr, long size)\n+\n+{\n+\n+ unsigned long start, end, page_size;\n+\n+\n+\n+ page_size = getpagesize();\n \n start = (unsigned long)addr;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static __attribute__((unused)) void map_exec(void *addr, long size)\n\n{\n\n unsigned long start, end, page_size;\n\n\n\n page_size = getpagesize();\n\n start = (unsigned long)addr;\n\n start &= ~(page_size - 1);\n\n\n\n end = (unsigned long)addr + size;\n\n end += page_size - 1;\n\n end &= ~(page_size - 1);\n\n\n\n mprotect((void *)start, end - start,\n\n PROT_READ | PROT_WRITE | PROT_EXEC);\n\n}\n"}} {"sample_id": "345e7072ab867ee1e56cbf857dbc93d37f168294", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n \n if ((ret = graph_insert_fifos(graphctx, log_ctx)) < 0)\n+\n+\n+ if ((ret = graph_config_formats(graphctx, log_ctx)))\n+\n+\n if ((ret = graph_config_links(graphctx, log_ctx)))\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int avfilter_graph_config(AVFilterGraph *graphctx, void *log_ctx)\n\n{\n\n int ret;\n\n\n\n if ((ret = graph_check_validity(graphctx, log_ctx)))\n\n\n if ((ret = graph_insert_fifos(graphctx, log_ctx)) < 0)\n\n\n if ((ret = graph_config_formats(graphctx, log_ctx)))\n\n\n if ((ret = graph_config_links(graphctx, log_ctx)))\n\n\n\n\n if ((ret = graph_config_pointers(graphctx, log_ctx)))\n\n\n\n\n return 0;\n\n}"}} {"sample_id": "4a1418e07bdcfaa3177739e04707ecaec75d89e1_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,8 +12,8 @@\n \n cpu_loop_exit();\n \n+ }\n+\n+#endif\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void helper_lret_protected(int shift, int addend)\n\n{\n\n helper_ret_protected(shift, 0, addend);\n\n#ifdef CONFIG_KQEMU\n\n if (kqemu_is_ok(env)) {\n\n env->exception_index = -1;\n\n cpu_loop_exit();\n\n }\n\n#endif\n\n}\n"}} {"sample_id": "ae392c416c69a020226c768d9c3af08b29dd6d96", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n PCIDevice *dev = opaque;\n \n+ unsigned int offset = addr & (MSIX_PAGE_SIZE - 1) & ~0x3;\n \n int vector = offset / PCI_MSIX_ENTRY_SIZE;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void msix_mmio_write(void *opaque, target_phys_addr_t addr,\n\n uint64_t val, unsigned size)\n\n{\n\n PCIDevice *dev = opaque;\n\n unsigned int offset = addr & (MSIX_PAGE_SIZE - 1) & ~0x3;\n\n int vector = offset / PCI_MSIX_ENTRY_SIZE;\n\n\n\n /* MSI-X page includes a read-only PBA and a writeable Vector Control. */\n\n if (vector >= dev->msix_entries_nr) {\n\n return;\n\n }\n\n\n\n pci_set_long(dev->msix_table_page + offset, val);\n\n msix_handle_mask_update(dev, vector);\n\n}\n"}} {"sample_id": "2caf19e90f270abe1e80a3e85acaf0eb5c9d0aac_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n int i;\n \n+ pixel *src = (pixel*)_src;\n+\n int stride = _stride/sizeof(pixel);\n+\n+ const pixel4 a= ((pixel4*)(src-stride))[0];\n \n const pixel4 b= ((pixel4*)(src-stride))[1];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void FUNCC(pred8x8_vertical)(uint8_t *_src, int _stride){\n\n int i;\n\n pixel *src = (pixel*)_src;\n\n int stride = _stride/sizeof(pixel);\n\n const pixel4 a= ((pixel4*)(src-stride))[0];\n\n const pixel4 b= ((pixel4*)(src-stride))[1];\n\n\n\n for(i=0; i<8; i++){\n\n ((pixel4*)(src+i*stride))[0]= a;\n\n ((pixel4*)(src+i*stride))[1]= b;\n\n }\n\n}\n"}} {"sample_id": "a15fcc3cf69ee3d408f60d6cc316488d2b0249b4_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n size_t size, Error **errp)\n \n+{\n \n Error *err = NULL;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void visit_start_list(Visitor *v, const char *name, GenericList **list,\n\n size_t size, Error **errp)\n\n{\n\n Error *err = NULL;\n\n\n\n assert(!list || size >= sizeof(GenericList));\n\n v->start_list(v, name, list, size, &err);\n\n if (list && v->type == VISITOR_INPUT) {\n\n assert(!(err && *list));\n\n }\n\n error_propagate(errp, err);\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_39", "diff": "--- a/source.c\n+++ b/source.c\n@@ -49,11 +49,11 @@\n g_free(blk->buf);\n \n g_free(blk);\n+\n+\n+\n+ block_mig_state.read_done--;\n+\n block_mig_state.transferred++;\n \n assert(block_mig_state.read_done >= 0);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int flush_blks(QEMUFile *f)\n\n{\n\n BlkMigBlock *blk;\n\n int ret = 0;\n\n\n\n DPRINTF(\"%s Enter submitted %d read_done %d transferred %d\\n\",\n\n __FUNCTION__, block_mig_state.submitted, block_mig_state.read_done,\n\n block_mig_state.transferred);\n\n\n\n blk_mig_lock();\n\n while ((blk = QSIMPLEQ_FIRST(&block_mig_state.blk_list)) != NULL) {\n\n if (qemu_file_rate_limit(f)) {\n\n break;\n\n }\n\n if (blk->ret < 0) {\n\n ret = blk->ret;\n\n break;\n\n }\n\n\n\n QSIMPLEQ_REMOVE_HEAD(&block_mig_state.blk_list, entry);\n\n blk_mig_unlock();\n\n blk_send(f, blk);\n\n blk_mig_lock();\n\n\n\n g_free(blk->buf);\n\n g_free(blk);\n\n\n\n block_mig_state.read_done--;\n\n block_mig_state.transferred++;\n\n assert(block_mig_state.read_done >= 0);\n\n }\n\n blk_mig_unlock();\n\n\n\n DPRINTF(\"%s Exit submitted %d read_done %d transferred %d\\n\", __FUNCTION__,\n\n block_mig_state.submitted, block_mig_state.read_done,\n\n block_mig_state.transferred);\n\n return ret;\n\n}\n"}} {"sample_id": "5c6c0e513600ba57c3e73b7151d3c0664438f7b5_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n int n;\n \n \n+\n cdb[0] = 3;\n \n cdb[1] = 0;\n+\n cdb[2] = 0;\n \n cdb[3] = 0;\n@@ -21,7 +21,7 @@\n cdb[4] = 96;\n \n cdb[5] = 0;\n+\n req->sensing = 1;\n \n n = sdev->info->send_command(sdev, req->qtag, cdb, req->lun);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void vscsi_send_request_sense(VSCSIState *s, vscsi_req *req)\n\n{\n\n SCSIDevice *sdev = req->sdev;\n\n uint8_t *cdb = req->iu.srp.cmd.cdb;\n\n int n;\n\n\n\n cdb[0] = 3;\n\n cdb[1] = 0;\n\n cdb[2] = 0;\n\n cdb[3] = 0;\n\n cdb[4] = 96;\n\n cdb[5] = 0;\n\n req->sensing = 1;\n\n n = sdev->info->send_command(sdev, req->qtag, cdb, req->lun);\n\n dprintf(\"VSCSI: Queued request sense tag 0x%x\\n\", req->qtag);\n\n if (n < 0) {\n\n fprintf(stderr, \"VSCSI: REQUEST_SENSE wants write data !?!?!?\\n\");\n\n sdev->info->cancel_io(sdev, req->qtag);\n\n vscsi_makeup_sense(s, req, HARDWARE_ERROR, 0, 0);\n\n vscsi_send_rsp(s, req, CHECK_CONDITION, 0, 0);\n\n vscsi_put_req(s, req);\n\n return;\n\n } else if (n == 0) {\n\n return;\n\n }\n\n sdev->info->read_data(sdev, req->qtag);\n\n}\n"}} {"sample_id": "c3203fa5b2c17a1c446e44c87788fef21b4af5f4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int get_current_cpu(void)\n+\n {\n \n return cpu_single_env->cpu_index;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int get_current_cpu(void)\n\n{\n\n return cpu_single_env->cpu_index;\n\n}\n"}} {"sample_id": "fe026ba960790a004adfcff33f44f96b05538e5c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -42,11 +42,11 @@\n \n \n \n+ if (glyph->bitmap.pixel_mode != FT_PIXEL_MODE_MONO &&\n+\n+ glyph->bitmap.pixel_mode != FT_PIXEL_MODE_GRAY)\n+\n+ return AVERROR(EINVAL);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int draw_glyphs(DrawTextContext *s, AVFrame *frame,\n\n int width, int height,\n\n const uint8_t rgbcolor[4], const uint8_t yuvcolor[4],\n\n int x, int y)\n\n{\n\n char *text = HAVE_LOCALTIME_R ? s->expanded_text : s->text;\n\n uint32_t code = 0;\n\n int i;\n\n uint8_t *p;\n\n Glyph *glyph = NULL;\n\n\n\n for (i = 0, p = text; *p; i++) {\n\n Glyph dummy = { 0 };\n\n GET_UTF8(code, *p++, continue;);\n\n\n\n /* skip new line chars, just go to new line */\n\n if (code == '\\n' || code == '\\r' || code == '\\t')\n\n continue;\n\n\n\n dummy.code = code;\n\n glyph = av_tree_find(s->glyphs, &dummy, (void *)glyph_cmp, NULL);\n\n\n\n if (glyph->bitmap.pixel_mode != FT_PIXEL_MODE_MONO &&\n\n glyph->bitmap.pixel_mode != FT_PIXEL_MODE_GRAY)\n\n return AVERROR(EINVAL);\n\n\n\n if (s->is_packed_rgb) {\n\n draw_glyph_rgb(frame, &glyph->bitmap,\n\n s->positions[i].x+x, s->positions[i].y+y, width, height,\n\n s->pixel_step[0], rgbcolor, s->rgba_map, s->alpha);\n\n } else {\n\n draw_glyph_yuv(frame, &glyph->bitmap,\n\n s->positions[i].x+x, s->positions[i].y+y, width, height,\n\n yuvcolor, s->hsub, s->vsub, s->alpha);\n\n }\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "20784087eb875e22cf0021989e61716304b63c84", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static inline void test_server_connect(TestServer *server)\n+\n {\n \n test_server_create_chr(server, \",reconnect=1\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void test_server_connect(TestServer *server)\n\n{\n\n test_server_create_chr(server, \",reconnect=1\");\n\n}\n"}} {"sample_id": "1cadab602343c4f577d2710a43bc66fde5a0d20b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n ipts_min = ipts;\n \n file_index = ist->file_index;\n+\n+ }\n+\n+ }\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int select_input_file(uint8_t *no_packet)\n\n{\n\n int64_t ipts_min = INT64_MAX;\n\n int i, file_index = -1;\n\n\n\n for (i = 0; i < nb_input_streams; i++) {\n\n InputStream *ist = input_streams[i];\n\n int64_t ipts = ist->pts;\n\n\n\n if (ist->discard || no_packet[ist->file_index])\n\n continue;\n\n if (!input_files[ist->file_index]->eof_reached) {\n\n if (ipts < ipts_min) {\n\n ipts_min = ipts;\n\n file_index = ist->file_index;\n\n }\n\n }\n\n }\n\n\n\n return file_index;\n\n}\n"}} {"sample_id": "910f738b851a263396fc85b2052e47f884ffead3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n const gchar *class, *desc;\n \n \n+\n ret = qmp_fd(fixture->fd, \"{'execute': 'guest-ping', \"\n \n \"'arguments': {'foo': 42 }}\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_qga_invalid_args(gconstpointer fix)\n\n{\n\n const TestFixture *fixture = fix;\n\n QDict *ret, *error;\n\n const gchar *class, *desc;\n\n\n\n ret = qmp_fd(fixture->fd, \"{'execute': 'guest-ping', \"\n\n \"'arguments': {'foo': 42 }}\");\n\n g_assert_nonnull(ret);\n\n\n\n error = qdict_get_qdict(ret, \"error\");\n\n class = qdict_get_try_str(error, \"class\");\n\n desc = qdict_get_try_str(error, \"desc\");\n\n\n\n g_assert_cmpstr(class, ==, \"GenericError\");\n\n g_assert_cmpstr(desc, ==, \"QMP input object member 'foo' is unexpected\");\n\n\n\n QDECREF(ret);\n\n}\n"}} {"sample_id": "7e7e2ebc942da8285931ceabf12823e165dced8b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -37,11 +37,11 @@\n \n \n VNC_DEBUG(\"Start TLS VeNCrypt handshake process\\n\");\n+\n+ if (vnc_start_vencrypt_handshake(vs) < 0) {\n+\n+ VNC_DEBUG(\"Failed to start TLS handshake\\n\");\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int protocol_client_vencrypt_auth(VncState *vs, uint8_t *data, size_t len)\n\n{\n\n int auth = read_u32(data, 0);\n\n\n\n if (auth != vs->vd->subauth) {\n\n VNC_DEBUG(\"Rejecting auth %d\\n\", auth);\n\n vnc_write_u8(vs, 0); /* Reject auth */\n\n vnc_flush(vs);\n\n vnc_client_error(vs);\n\n } else {\n\n VNC_DEBUG(\"Accepting auth %d, setting up TLS for handshake\\n\", auth);\n\n vnc_write_u8(vs, 1); /* Accept auth */\n\n vnc_flush(vs);\n\n\n\n if (vnc_tls_client_setup(vs, NEED_X509_AUTH(vs)) < 0) {\n\n VNC_DEBUG(\"Failed to setup TLS\\n\");\n\n return 0;\n\n }\n\n\n\n VNC_DEBUG(\"Start TLS VeNCrypt handshake process\\n\");\n\n if (vnc_start_vencrypt_handshake(vs) < 0) {\n\n VNC_DEBUG(\"Failed to start TLS handshake\\n\");\n\n return 0;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "bec1631100323fac0900aea71043d5c4e22fc2fa_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n \n \n+ if (l->has_value) {\n+\n+ tcg_out_goto(s, cond, l->u.value_ptr);\n+\n+ } else {\n \n tcg_out_reloc(s, s->code_ptr, R_ARM_PC24, label_index, 0);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void tcg_out_goto_label(TCGContext *s, int cond, int label_index)\n\n{\n\n TCGLabel *l = &s->labels[label_index];\n\n\n\n if (l->has_value) {\n\n tcg_out_goto(s, cond, l->u.value_ptr);\n\n } else {\n\n tcg_out_reloc(s, s->code_ptr, R_ARM_PC24, label_index, 0);\n\n tcg_out_b_noaddr(s, cond);\n\n }\n\n}\n"}} {"sample_id": "8a048fe6f8bf41de93c091a7a9b3132bedc1b41c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int get_riff(AVFormatContext *s, AVIOContext *pb)\n \n+{\n \n AVIContext *avi = s->priv_data;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int get_riff(AVFormatContext *s, AVIOContext *pb)\n\n{\n\n AVIContext *avi = s->priv_data;\n\n char header[8];\n\n int i;\n\n\n\n /* check RIFF header */\n\n avio_read(pb, header, 4);\n\n avi->riff_end = avio_rl32(pb); /* RIFF chunk size */\n\n avi->riff_end += avio_tell(pb); /* RIFF chunk end */\n\n avio_read(pb, header + 4, 4);\n\n\n\n for (i = 0; avi_headers[i][0]; i++)\n\n if (!memcmp(header, avi_headers[i], 8))\n\n break;\n\n if (!avi_headers[i][0])\n\n return AVERROR_INVALIDDATA;\n\n\n\n if (header[7] == 0x19)\n\n av_log(s, AV_LOG_INFO,\n\n \"This file has been generated by a totally broken muxer.\\n\");\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n \tsize_t envname_len;\n \n+\n+\n+\tif ((envlist == NULL) || (env == NULL))\n+\n+\t\treturn (EINVAL);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "envlist_unsetenv(envlist_t *envlist, const char *env)\n\n{\n\n\tstruct envlist_entry *entry;\n\n\tsize_t envname_len;\n\n\n\n\tif ((envlist == NULL) || (env == NULL))\n\n\t\treturn (EINVAL);\n\n\n\n\t/* env is not allowed to contain '=' */\n\n\tif (strchr(env, '=') != NULL)\n\n\t\treturn (EINVAL);\n\n\n\n\t/*\n\n\t * Find out the requested entry and remove\n\n\t * it from the list.\n\n\t */\n\n\tenvname_len = strlen(env);\n\n\tfor (entry = envlist->el_entries.lh_first; entry != NULL;\n\n\t entry = entry->ev_link.le_next) {\n\n\t\tif (strncmp(entry->ev_var, env, envname_len) == 0)\n\n\t\t\tbreak;\n\n\t}\n\n\tif (entry != NULL) {\n\n\t\tLIST_REMOVE(entry, ev_link);\n\n\t\tfree((char *)entry->ev_var);\n\n\t\tfree(entry);\n\n\n\n\t\tenvlist->el_count--;\n\n\t}\n\n\treturn (0);\n\n}\n"}} {"sample_id": "cf1e0786ed64e69614760bfb4ecd7adbde8e6094_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -45,11 +45,11 @@\n ff_h264dsp_init(&h->h264dsp, h->sps.bit_depth_luma,\n \n h->sps.chroma_format_idc);\n+\n+ ff_h264chroma_init(&h->h264chroma, h->sps.bit_depth_chroma);\n+\n+ ff_h264qpel_init(&h->h264qpel, h->sps.bit_depth_luma);\n+\n ff_h264_pred_init(&h->hpc, h->avctx->codec_id, h->sps.bit_depth_luma,\n \n h->sps.chroma_format_idc);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int ff_h264_set_parameter_from_sps(H264Context *h)\n\n{\n\n if (h->flags & CODEC_FLAG_LOW_DELAY ||\n\n (h->sps.bitstream_restriction_flag &&\n\n !h->sps.num_reorder_frames)) {\n\n if (h->avctx->has_b_frames > 1 || h->delayed_pic[0])\n\n av_log(h->avctx, AV_LOG_WARNING, \"Delayed frames seen. \"\n\n \"Reenabling low delay requires a codec flush.\\n\");\n\n else\n\n h->low_delay = 1;\n\n }\n\n\n\n if (h->avctx->has_b_frames < 2)\n\n h->avctx->has_b_frames = !h->low_delay;\n\n\n\n if (h->avctx->bits_per_raw_sample != h->sps.bit_depth_luma ||\n\n h->cur_chroma_format_idc != h->sps.chroma_format_idc) {\n\n if (h->sps.bit_depth_luma >= 8 && h->sps.bit_depth_luma <= 10) {\n\n h->avctx->bits_per_raw_sample = h->sps.bit_depth_luma;\n\n h->cur_chroma_format_idc = h->sps.chroma_format_idc;\n\n h->pixel_shift = h->sps.bit_depth_luma > 8;\n\n\n\n ff_h264dsp_init(&h->h264dsp, h->sps.bit_depth_luma,\n\n h->sps.chroma_format_idc);\n\n ff_h264chroma_init(&h->h264chroma, h->sps.bit_depth_chroma);\n\n ff_h264qpel_init(&h->h264qpel, h->sps.bit_depth_luma);\n\n ff_h264_pred_init(&h->hpc, h->avctx->codec_id, h->sps.bit_depth_luma,\n\n h->sps.chroma_format_idc);\n\n if (CONFIG_ERROR_RESILIENCE)\n\n ff_me_cmp_init(&h->mecc, h->avctx);\n\n ff_videodsp_init(&h->vdsp, h->sps.bit_depth_luma);\n\n } else {\n\n av_log(h->avctx, AV_LOG_ERROR, \"Unsupported bit depth %d\\n\",\n\n h->sps.bit_depth_luma);\n\n return AVERROR_INVALIDDATA;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "3e36aba757f76673007a80b3cd56a4062c2e3462_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+int pt_setxattr(FsContext *ctx, const char *path, const char *name, void *value,\n+\n+ size_t size, int flags)\n+\n+{\n+\n+ char *buffer;\n \n int ret;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "int pt_setxattr(FsContext *ctx, const char *path, const char *name, void *value,\n\n size_t size, int flags)\n\n{\n\n char *buffer;\n\n int ret;\n\n\n\n buffer = rpath(ctx, path);\n\n ret = lsetxattr(buffer, name, value, size, flags);\n\n g_free(buffer);\n\n return ret;\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_61", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,9 +21,9 @@\n \ttcg_gen_and_tl(t0, t0, d);\n \n \ttcg_gen_xor_tl(d, d, t0);\n+\n+\ttcg_temp_free(t0);\n+\n+\ttcg_temp_free(t_31);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void t_gen_lsl(TCGv d, TCGv a, TCGv b)\n\n{\n\n\tTCGv t0, t_31;\n\n\n\n\tt0 = tcg_temp_new(TCG_TYPE_TL);\n\n\tt_31 = tcg_const_tl(31);\n\n\ttcg_gen_shl_tl(d, a, b);\n\n\n\n\ttcg_gen_sub_tl(t0, t_31, b);\n\n\ttcg_gen_sar_tl(t0, t0, t_31);\n\n\ttcg_gen_and_tl(t0, t0, d);\n\n\ttcg_gen_xor_tl(d, d, t0);\n\n\ttcg_temp_free(t0);\n\n\ttcg_temp_free(t_31);\n\n}\n"}} {"sample_id": "f090c9d4ad5812fb92843d6470a1111c15190c4c_17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,8 +10,8 @@\n \n v = float64_to_int64((a + v) STATUS_VAR);\n \n+\n+\n+ return v - INT64_MIN;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint64_t float64_to_uint64 (float64 a STATUS_PARAM)\n\n{\n\n int64_t v;\n\n\n\n v = int64_to_float64(INT64_MIN STATUS_VAR);\n\n v = float64_to_int64((a + v) STATUS_VAR);\n\n\n\n return v - INT64_MIN;\n\n}\n"}} {"sample_id": "d63cb48db9016328a7a69f3a1c2938cd3dfc9d1a_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void store_booke_tsr (CPUState *env, target_ulong val)\n+\n+{\n+\n LOG_TB(\"%s: val \" TARGET_FMT_lx \"\\n\", __func__, val);\n \n env->spr[SPR_40x_TSR] &= ~(val & 0xFC000000);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void store_booke_tsr (CPUState *env, target_ulong val)\n\n{\n\n LOG_TB(\"%s: val \" TARGET_FMT_lx \"\\n\", __func__, val);\n\n env->spr[SPR_40x_TSR] &= ~(val & 0xFC000000);\n\n if (val & 0x80000000)\n\n ppc_set_irq(env, PPC_INTERRUPT_PIT, 0);\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_88", "diff": "--- a/source.c\n+++ b/source.c\n@@ -43,11 +43,11 @@\n /* it don't have a valid subsection name */\n \n return 0;\n+\n+ }\n+\n+ sub_vmsd = vmstate_get_subsection(vmsd->subsections, idstr);\n+\n if (sub_vmsd == NULL) {\n \n return -ENOENT;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd,\n\n void *opaque)\n\n{\n\n while (qemu_peek_byte(f, 0) == QEMU_VM_SUBSECTION) {\n\n char idstr[256];\n\n int ret;\n\n uint8_t version_id, len, size;\n\n const VMStateDescription *sub_vmsd;\n\n\n\n len = qemu_peek_byte(f, 1);\n\n if (len < strlen(vmsd->name) + 1) {\n\n /* subsection name has be be \"section_name/a\" */\n\n return 0;\n\n }\n\n size = qemu_peek_buffer(f, (uint8_t *)idstr, len, 2);\n\n if (size != len) {\n\n return 0;\n\n }\n\n idstr[size] = 0;\n\n\n\n if (strncmp(vmsd->name, idstr, strlen(vmsd->name)) != 0) {\n\n /* it don't have a valid subsection name */\n\n return 0;\n\n }\n\n sub_vmsd = vmstate_get_subsection(vmsd->subsections, idstr);\n\n if (sub_vmsd == NULL) {\n\n return -ENOENT;\n\n }\n\n qemu_file_skip(f, 1); /* subsection */\n\n qemu_file_skip(f, 1); /* len */\n\n qemu_file_skip(f, len); /* idstr */\n\n version_id = qemu_get_be32(f);\n\n\n\n ret = vmstate_load_state(f, sub_vmsd, opaque, version_id);\n\n if (ret) {\n\n return ret;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "326b9e98a391d542cc33c4c91782ff4ba51edfc5_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n float128 float128_scalbn( float128 a, int n STATUS_PARAM )\n \n+{\n \n flag aSign;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "float128 float128_scalbn( float128 a, int n STATUS_PARAM )\n\n{\n\n flag aSign;\n\n int32 aExp;\n\n uint64_t aSig0, aSig1;\n\n\n\n aSig1 = extractFloat128Frac1( a );\n\n aSig0 = extractFloat128Frac0( a );\n\n aExp = extractFloat128Exp( a );\n\n aSign = extractFloat128Sign( a );\n\n if ( aExp == 0x7FFF ) {\n\n return a;\n\n }\n\n if ( aExp != 0 )\n\n aSig0 |= LIT64( 0x0001000000000000 );\n\n else if ( aSig0 == 0 && aSig1 == 0 )\n\n return a;\n\n\n\n aExp += n - 1;\n\n return normalizeRoundAndPackFloat128( aSign, aExp, aSig0, aSig1\n\n STATUS_VAR );\n\n\n\n}\n"}} {"sample_id": "5f3e31012e334f3410e04abae7f88565df17c91a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,16 +2,16 @@\n \n {\n \n+ if (use_icount) {\n+\n return cpu_get_icount();\n+\n+ }\n+\n+ if (!timers_state.cpu_ticks_enabled) {\n \n+ return timers_state.cpu_ticks_offset;\n+\n } else {\n \n int64_t ticks;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int64_t cpu_get_ticks(void)\n\n{\n\n if (use_icount) {\n\n return cpu_get_icount();\n\n }\n\n if (!timers_state.cpu_ticks_enabled) {\n\n return timers_state.cpu_ticks_offset;\n\n } else {\n\n int64_t ticks;\n\n ticks = cpu_get_real_ticks();\n\n if (timers_state.cpu_ticks_prev > ticks) {\n\n /* Note: non increasing ticks may happen if the host uses\n\n software suspend */\n\n timers_state.cpu_ticks_offset += timers_state.cpu_ticks_prev - ticks;\n\n }\n\n timers_state.cpu_ticks_prev = ticks;\n\n return ticks + timers_state.cpu_ticks_offset;\n\n }\n\n}\n"}} {"sample_id": "848696bf353750899832c51005f1bd3540da5c29_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,16 +1,16 @@\n static int qxl_init_primary(PCIDevice *dev)\n \n {\n+\n PCIQXLDevice *qxl = DO_UPCAST(PCIQXLDevice, pci, dev);\n \n VGACommonState *vga = &qxl->vga;\n \n PortioList *qxl_vga_port_list = g_new(PortioList, 1);\n \n+ int rc;\n+\n+\n \n qxl->id = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int qxl_init_primary(PCIDevice *dev)\n\n{\n\n PCIQXLDevice *qxl = DO_UPCAST(PCIQXLDevice, pci, dev);\n\n VGACommonState *vga = &qxl->vga;\n\n PortioList *qxl_vga_port_list = g_new(PortioList, 1);\n\n int rc;\n\n\n\n qxl->id = 0;\n\n qxl_init_ramsize(qxl);\n\n vga->vram_size_mb = qxl->vga.vram_size >> 20;\n\n vga_common_init(vga, OBJECT(dev), true);\n\n vga_init(vga, OBJECT(dev),\n\n pci_address_space(dev), pci_address_space_io(dev), false);\n\n portio_list_init(qxl_vga_port_list, OBJECT(dev), qxl_vga_portio_list,\n\n vga, \"vga\");\n\n portio_list_set_flush_coalesced(qxl_vga_port_list);\n\n portio_list_add(qxl_vga_port_list, pci_address_space_io(dev), 0x3b0);\n\n\n\n vga->con = graphic_console_init(DEVICE(dev), 0, &qxl_ops, qxl);\n\n qemu_spice_display_init_common(&qxl->ssd);\n\n\n\n rc = qxl_init_common(qxl);\n\n if (rc != 0) {\n\n return rc;\n\n }\n\n\n\n qxl->ssd.dcl.ops = &display_listener_ops;\n\n qxl->ssd.dcl.con = vga->con;\n\n register_displaychangelistener(&qxl->ssd.dcl);\n\n return rc;\n\n}\n"}} {"sample_id": "7d1b0095bff7157e856d1d0e6c4295641ced2752_17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+ TCGv_i64 tmp1 = tcg_temp_new_i64();\n \n+ TCGv_i64 tmp2 = tcg_temp_new_i64();\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static TCGv_i64 gen_muls_i64_i32(TCGv a, TCGv b)\n\n{\n\n TCGv_i64 tmp1 = tcg_temp_new_i64();\n\n TCGv_i64 tmp2 = tcg_temp_new_i64();\n\n\n\n tcg_gen_ext_i32_i64(tmp1, a);\n\n dead_tmp(a);\n\n tcg_gen_ext_i32_i64(tmp2, b);\n\n dead_tmp(b);\n\n tcg_gen_mul_i64(tmp1, tmp1, tmp2);\n\n tcg_temp_free_i64(tmp2);\n\n return tmp1;\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_66", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+PPC_OP(test_ctrz)\n+\n+{\n \n T0 = (regs->ctr == 0);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "PPC_OP(test_ctrz)\n\n{\n\n T0 = (regs->ctr == 0);\n\n RETURN();\n\n}\n"}} {"sample_id": "9561fda8d90e176bef598ba87c42a1bd6ad03ef7_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void xilinx_enet_init(Object *obj)\n \n {\n+\n+ XilinxAXIEnet *s = XILINX_AXI_ENET(obj);\n \n SysBusDevice *sbd = SYS_BUS_DEVICE(obj);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void xilinx_enet_init(Object *obj)\n\n{\n\n XilinxAXIEnet *s = XILINX_AXI_ENET(obj);\n\n SysBusDevice *sbd = SYS_BUS_DEVICE(obj);\n\n\n\n object_property_add_link(obj, \"axistream-connected\", TYPE_STREAM_SLAVE,\n\n (Object **) &s->tx_data_dev, &error_abort);\n\n object_property_add_link(obj, \"axistream-control-connected\",\n\n TYPE_STREAM_SLAVE,\n\n (Object **) &s->tx_control_dev, &error_abort);\n\n\n\n object_initialize(&s->rx_data_dev, sizeof(s->rx_data_dev),\n\n TYPE_XILINX_AXI_ENET_DATA_STREAM);\n\n object_initialize(&s->rx_control_dev, sizeof(s->rx_control_dev),\n\n TYPE_XILINX_AXI_ENET_CONTROL_STREAM);\n\n object_property_add_child(OBJECT(s), \"axistream-connected-target\",\n\n (Object *)&s->rx_data_dev, &error_abort);\n\n object_property_add_child(OBJECT(s), \"axistream-control-connected-target\",\n\n (Object *)&s->rx_control_dev, &error_abort);\n\n\n\n sysbus_init_irq(sbd, &s->irq);\n\n\n\n memory_region_init_io(&s->iomem, OBJECT(s), &enet_ops, s, \"enet\", 0x40000);\n\n sysbus_init_mmio(sbd, &s->iomem);\n\n}\n"}} {"sample_id": "7385aed20db5d83979f683b9d0048674411e963c_28", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,6 +10,6 @@\n \n check_ieee_exceptions(env);\n \n+ return ret;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "float32 helper_fqtos(CPUSPARCState *env)\n\n{\n\n float32 ret;\n\n clear_float_exceptions(env);\n\n ret = float128_to_float32(QT1, &env->fp_status);\n\n check_ieee_exceptions(env);\n\n return ret;\n\n}\n"}} {"sample_id": "47d4be12c3997343e436c6cca89aefbbbeb70863_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n int err = 0;\n \n if (!nptr) {\n+\n if (endptr) {\n \n *endptr = nptr;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int qemu_strtoull(const char *nptr, const char **endptr, int base,\n\n uint64_t *result)\n\n{\n\n char *p;\n\n int err = 0;\n\n if (!nptr) {\n\n if (endptr) {\n\n *endptr = nptr;\n\n }\n\n err = -EINVAL;\n\n } else {\n\n errno = 0;\n\n *result = strtoull(nptr, &p, base);\n\n err = check_strtox_error(endptr, p, errno);\n\n }\n\n return err;\n\n}\n"}} {"sample_id": "527224830aad6aaf5fc5ed9ff6c5f12c80ff906c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n {\n \n+ const uint8_t *buf = avpkt->data;\n \n+ int buf_size = avpkt->size;\n \n+ IdcinContext *s = avctx->priv_data;\n \n const uint8_t *pal = av_packet_get_side_data(avpkt, AV_PKT_DATA_PALETTE, NULL);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int idcin_decode_frame(AVCodecContext *avctx,\n\n void *data, int *data_size,\n\n AVPacket *avpkt)\n\n{\n\n const uint8_t *buf = avpkt->data;\n\n int buf_size = avpkt->size;\n\n IdcinContext *s = avctx->priv_data;\n\n const uint8_t *pal = av_packet_get_side_data(avpkt, AV_PKT_DATA_PALETTE, NULL);\n\n\n\n s->buf = buf;\n\n s->size = buf_size;\n\n\n\n if (s->frame.data[0])\n\n avctx->release_buffer(avctx, &s->frame);\n\n\n\n if (avctx->get_buffer(avctx, &s->frame)) {\n\n av_log(avctx, AV_LOG_ERROR, \"get_buffer() failed\\n\");\n\n return -1;\n\n }\n\n\n\n idcin_decode_vlcs(s);\n\n\n\n if (pal) {\n\n s->frame.palette_has_changed = 1;\n\n memcpy(s->pal, pal, AVPALETTE_SIZE);\n\n }\n\n /* make the palette available on the way out */\n\n memcpy(s->frame.data[1], s->pal, AVPALETTE_SIZE);\n\n\n\n *data_size = sizeof(AVFrame);\n\n *(AVFrame*)data = s->frame;\n\n\n\n /* report that the buffer was completely consumed */\n\n return buf_size;\n\n}\n"}} {"sample_id": "fc49f22c3b735db5aaac5f98e40b7124a2be13b8_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n+static int alloc_audio_output_buf(AVCodecContext *dec, AVCodecContext *enc,\n+\n+ int nb_samples, int *buf_linesize)\n+\n {\n+\n+ int64_t audio_buf_samples;\n+\n+ int audio_buf_size;\n+\n+\n+\n /* calculate required number of samples to allocate */\n \n audio_buf_samples = ((int64_t)nb_samples * enc->sample_rate + dec->sample_rate) /", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int alloc_audio_output_buf(AVCodecContext *dec, AVCodecContext *enc,\n\n int nb_samples, int *buf_linesize)\n\n{\n\n int64_t audio_buf_samples;\n\n int audio_buf_size;\n\n\n\n /* calculate required number of samples to allocate */\n\n audio_buf_samples = ((int64_t)nb_samples * enc->sample_rate + dec->sample_rate) /\n\n dec->sample_rate;\n\n audio_buf_samples = 4 * audio_buf_samples + 10000; // safety factors for resampling\n\n audio_buf_samples = FFMAX(audio_buf_samples, enc->frame_size);\n\n if (audio_buf_samples > INT_MAX)\n\n return AVERROR(EINVAL);\n\n\n\n audio_buf_size = av_samples_get_buffer_size(buf_linesize, enc->channels,\n\n audio_buf_samples,\n\n enc->sample_fmt, 0);\n\n if (audio_buf_size < 0)\n\n return audio_buf_size;\n\n\n\n av_fast_malloc(&audio_buf, &allocated_audio_buf_size, audio_buf_size);\n\n if (!audio_buf)\n\n return AVERROR(ENOMEM);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "06b106889a09277617fc8c542397a9f595ee605a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n+static int ram_save_host_page(RAMState *rs, PageSearchStatus *pss,\n \n bool last_stage,\n \n+ ram_addr_t dirty_ram_abs)\n \n {\n \n int tmppages, pages = 0;\n \n+ size_t pagesize = qemu_ram_pagesize(pss->block);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int ram_save_host_page(RAMState *rs, PageSearchStatus *pss,\n\n bool last_stage,\n\n ram_addr_t dirty_ram_abs)\n\n{\n\n int tmppages, pages = 0;\n\n size_t pagesize = qemu_ram_pagesize(pss->block);\n\n\n\n do {\n\n tmppages = ram_save_target_page(rs, pss, last_stage, dirty_ram_abs);\n\n if (tmppages < 0) {\n\n return tmppages;\n\n }\n\n\n\n pages += tmppages;\n\n pss->offset += TARGET_PAGE_SIZE;\n\n dirty_ram_abs += TARGET_PAGE_SIZE;\n\n } while (pss->offset & (pagesize - 1));\n\n\n\n /* The offset we leave with is the last one we looked at */\n\n pss->offset -= TARGET_PAGE_SIZE;\n\n return pages;\n\n}\n"}} {"sample_id": "04e00c92ef75629a241ebc50537f75de0867928d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+void pcie_aer_inject_error_print(Monitor *mon, const QObject *data)\n+\n+{\n+\n+ QDict *qdict;\n+\n+ int devfn;\n \n assert(qobject_type(data) == QTYPE_QDICT);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void pcie_aer_inject_error_print(Monitor *mon, const QObject *data)\n\n{\n\n QDict *qdict;\n\n int devfn;\n\n assert(qobject_type(data) == QTYPE_QDICT);\n\n qdict = qobject_to_qdict(data);\n\n\n\n devfn = (int)qdict_get_int(qdict, \"devfn\");\n\n monitor_printf(mon, \"OK id: %s root bus: %s, bus: %x devfn: %x.%x\\n\",\n\n qdict_get_str(qdict, \"id\"),\n\n qdict_get_str(qdict, \"root_bus\"),\n\n (int) qdict_get_int(qdict, \"bus\"),\n\n PCI_SLOT(devfn), PCI_FUNC(devfn));\n\n}\n"}} {"sample_id": "d57e4e482e3997b1382625c84149ad0b69155fc0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n int i, ret;\n \n+\n+\n+ printf(\"password: \");\n+\n+ fflush(stdout);\n \n term_init();\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int read_password(char *buf, int buf_size)\n\n{\n\n uint8_t ch;\n\n int i, ret;\n\n\n\n printf(\"password: \");\n\n fflush(stdout);\n\n term_init();\n\n i = 0;\n\n for(;;) {\n\n ret = read(0, &ch, 1);\n\n if (ret == -1) {\n\n if (errno == EAGAIN || errno == EINTR) {\n\n continue;\n\n } else {\n\n break;\n\n }\n\n } else if (ret == 0) {\n\n ret = -1;\n\n break;\n\n } else {\n\n if (ch == '\\r') {\n\n ret = 0;\n\n break;\n\n }\n\n if (i < (buf_size - 1))\n\n buf[i++] = ch;\n\n }\n\n }\n\n term_exit();\n\n buf[i] = '\\0';\n\n printf(\"\\n\");\n\n return ret;\n\n}\n"}} {"sample_id": "d9a3501c33a1f88350c935785dbf5435e9ffabe6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n AVDictionary *tmp = NULL;\n int ret = 0;\n while ((t = av_dict_get(*options, \"\", t, AV_DICT_IGNORE_SUFFIX))) {\n+ ret = av_opt_set(obj, t->key, t->value, 0);\n+ if (ret == AVERROR_OPTION_NOT_FOUND)\n+ av_dict_set(&tmp, t->key, t->value, 0);\n+ else if (ret < 0) {\n av_log(obj, AV_LOG_ERROR, \"Error setting option %s to value %s.\\n\", t->key, t->value);\n break;\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int av_opt_set_dict(void *obj, AVDictionary **options)\n{\n AVDictionaryEntry *t = NULL;\n AVDictionary *tmp = NULL;\n int ret = 0;\n while ((t = av_dict_get(*options, \"\", t, AV_DICT_IGNORE_SUFFIX))) {\n ret = av_opt_set(obj, t->key, t->value, 0);\n if (ret == AVERROR_OPTION_NOT_FOUND)\n av_dict_set(&tmp, t->key, t->value, 0);\n else if (ret < 0) {\n av_log(obj, AV_LOG_ERROR, \"Error setting option %s to value %s.\\n\", t->key, t->value);\n break;\n }\n ret = 0;\n }\n av_dict_free(options);\n *options = tmp;\n return ret;\n}"}} {"sample_id": "5ce45c7a2b15cda0a4d8f6c38c4036df25dc9c42", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n ICH9LPCState *lpc = arg;\n \n \n+\n /* ACPI specs 3.0, 4.7.2.5 */\n \n acpi_pm1_cnt_update(&lpc->pm.acpi_regs,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void ich9_apm_ctrl_changed(uint32_t val, void *arg)\n\n{\n\n ICH9LPCState *lpc = arg;\n\n\n\n /* ACPI specs 3.0, 4.7.2.5 */\n\n acpi_pm1_cnt_update(&lpc->pm.acpi_regs,\n\n val == ICH9_APM_ACPI_ENABLE,\n\n val == ICH9_APM_ACPI_DISABLE);\n\n if (val == ICH9_APM_ACPI_ENABLE || val == ICH9_APM_ACPI_DISABLE) {\n\n return;\n\n }\n\n\n\n /* SMI_EN = PMBASE + 30. SMI control and enable register */\n\n if (lpc->pm.smi_en & ICH9_PMIO_SMI_EN_APMC_EN) {\n\n cpu_interrupt(current_cpu, CPU_INTERRUPT_SMI);\n\n }\n\n}\n"}} {"sample_id": "788cf9f8c8cbda53843e060540f3e91a060eb744_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,35 +1,35 @@\n+int qemu_read_password(char *buf, int buf_size)\n+\n+{\n+\n+ uint8_t ch;\n+\n+ int i, ret;\n+\n+\n+\n+ printf(\"password: \");\n+\n fflush(stdout);\n+\n term_init();\n+\n+ i = 0;\n+\n for (;;) {\n+\n+ ret = read(0, &ch, 1);\n \n if (ret == -1) {\n+\n+ if (errno == EAGAIN || errno == EINTR) {\n \n continue;\n \n+ } else {\n+\n+ break;\n+\n }\n \n } else if (ret == 0) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "int qemu_read_password(char *buf, int buf_size)\n\n{\n\n uint8_t ch;\n\n int i, ret;\n\n\n\n printf(\"password: \");\n\n fflush(stdout);\n\n term_init();\n\n i = 0;\n\n for (;;) {\n\n ret = read(0, &ch, 1);\n\n if (ret == -1) {\n\n if (errno == EAGAIN || errno == EINTR) {\n\n continue;\n\n } else {\n\n break;\n\n }\n\n } else if (ret == 0) {\n\n ret = -1;\n\n break;\n\n } else {\n\n if (ch == '\\r' ||\n\n ch == '\\n') {\n\n ret = 0;\n\n break;\n\n }\n\n if (i < (buf_size - 1)) {\n\n buf[i++] = ch;\n\n }\n\n }\n\n }\n\n term_exit();\n\n buf[i] = '\\0';\n\n printf(\"\\n\");\n\n return ret;\n\n}\n"}} {"sample_id": "524d18d8bd463431b120eeb5f9f3d1064a1c19e4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n features++;\n \n+ }\n+\n+\n+\n+ oc = cpu_class_by_name(TYPE_S390_CPU, name);\n \n if (!oc) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "S390CPU *cpu_s390x_create(const char *cpu_model, Error **errp)\n\n{\n\n static bool features_parsed;\n\n char *name, *features;\n\n const char *typename;\n\n ObjectClass *oc;\n\n CPUClass *cc;\n\n\n\n name = g_strdup(cpu_model);\n\n features = strchr(name, ',');\n\n if (features) {\n\n features[0] = 0;\n\n features++;\n\n }\n\n\n\n oc = cpu_class_by_name(TYPE_S390_CPU, name);\n\n if (!oc) {\n\n error_setg(errp, \"Unknown CPU definition \\'%s\\'\", name);\n\n g_free(name);\n\n return NULL;\n\n }\n\n typename = object_class_get_name(oc);\n\n\n\n if (!features_parsed) {\n\n features_parsed = true;\n\n cc = CPU_CLASS(oc);\n\n cc->parse_features(typename, features, errp);\n\n }\n\n g_free(name);\n\n\n\n if (*errp) {\n\n return NULL;\n\n }\n\n return S390_CPU(CPU(object_new(typename)));\n\n}\n"}} {"sample_id": "b8852e87d9d113096342c3e0977266cda0fe9ee5_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int vmdk_L2update(BlockDriverState *bs, VmdkMetaData *m_data)\n \n+{\n \n BDRVVmdkState *s = bs->opaque;\n+\n \n \n /* update L2 table */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int vmdk_L2update(BlockDriverState *bs, VmdkMetaData *m_data)\n\n{\n\n BDRVVmdkState *s = bs->opaque;\n\n\n\n /* update L2 table */\n\n if (bdrv_pwrite(bs->file, ((int64_t)m_data->l2_offset * 512) + (m_data->l2_index * sizeof(m_data->offset)),\n\n &(m_data->offset), sizeof(m_data->offset)) != sizeof(m_data->offset))\n\n return -1;\n\n /* update backup L2 table */\n\n if (s->l1_backup_table_offset != 0) {\n\n m_data->l2_offset = s->l1_backup_table[m_data->l1_index];\n\n if (bdrv_pwrite(bs->file, ((int64_t)m_data->l2_offset * 512) + (m_data->l2_index * sizeof(m_data->offset)),\n\n &(m_data->offset), sizeof(m_data->offset)) != sizeof(m_data->offset))\n\n return -1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "4f4f6976d80614e2d81cea4385885876f24bb257", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n \n \n ctxt->free(cipher);\n+\n+ g_free(cipher);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qcrypto_cipher_free(QCryptoCipher *cipher)\n\n{\n\n QCryptoCipherBuiltin *ctxt = cipher->opaque;\n\n if (!cipher) {\n\n return;\n\n }\n\n\n\n ctxt->free(cipher);\n\n g_free(cipher);\n\n}\n"}} {"sample_id": "faadf50e2962dd54175647a80bd6fc4319c91973_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ gen_spr_ne_601(env);\n \n gen_spr_620(env);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void init_proc_620 (CPUPPCState *env)\n\n{\n\n gen_spr_ne_601(env);\n\n gen_spr_620(env);\n\n /* Time base */\n\n gen_tbl(env);\n\n /* Hardware implementation registers */\n\n /* XXX : not implemented */\n\n spr_register(env, SPR_HID0, \"HID0\",\n\n SPR_NOACCESS, SPR_NOACCESS,\n\n &spr_read_generic, &spr_write_generic,\n\n 0x00000000);\n\n /* Memory management */\n\n gen_low_BATs(env);\n\n gen_high_BATs(env);\n\n init_excp_620(env);\n\n env->dcache_line_size = 64;\n\n env->icache_line_size = 64;\n\n /* XXX: TODO: initialize internal interrupt controller */\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_32", "diff": "--- a/source.c\n+++ b/source.c\n@@ -42,11 +42,11 @@\n \n \ttcg_gen_mov_tl(org_s, s);\n \n+\n+\n+\ttcg_gen_shli_tl(t, org_s, bitrev[0].shift);\n+\n+\ttcg_gen_andi_tl(d, t, bitrev[0].mask);\n \n \tfor (i = 1; i < sizeof bitrev / sizeof bitrev[0]; i++) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void t_gen_swapr(TCGv d, TCGv s)\n\n{\n\n\tstruct {\n\n\t\tint shift; /* LSL when positive, LSR when negative. */\n\n\t\tuint32_t mask;\n\n\t} bitrev [] = {\n\n\t\t{7, 0x80808080},\n\n\t\t{5, 0x40404040},\n\n\t\t{3, 0x20202020},\n\n\t\t{1, 0x10101010},\n\n\t\t{-1, 0x08080808},\n\n\t\t{-3, 0x04040404},\n\n\t\t{-5, 0x02020202},\n\n\t\t{-7, 0x01010101}\n\n\t};\n\n\tint i;\n\n\tTCGv t, org_s;\n\n\n\n\t/* d and s refer the same object. */\n\n\tt = tcg_temp_new(TCG_TYPE_TL);\n\n\torg_s = tcg_temp_new(TCG_TYPE_TL);\n\n\ttcg_gen_mov_tl(org_s, s);\n\n\n\n\ttcg_gen_shli_tl(t, org_s, bitrev[0].shift);\n\n\ttcg_gen_andi_tl(d, t, bitrev[0].mask);\n\n\tfor (i = 1; i < sizeof bitrev / sizeof bitrev[0]; i++) {\n\n\t\tif (bitrev[i].shift >= 0) {\n\n\t\t\ttcg_gen_shli_tl(t, org_s, bitrev[i].shift);\n\n\t\t} else {\n\n\t\t\ttcg_gen_shri_tl(t, org_s, -bitrev[i].shift);\n\n\t\t}\n\n\t\ttcg_gen_andi_tl(t, t, bitrev[i].mask);\n\n\t\ttcg_gen_or_tl(d, d, t);\n\n\t}\n\n\ttcg_temp_free(t);\n\n\ttcg_temp_free(org_s);\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n return g_strdup(bdrv_get_device_name(ptr));\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static char *print_drive(void *ptr)\n\n{\n\n return g_strdup(bdrv_get_device_name(ptr));\n\n}\n"}} {"sample_id": "9c12a6f24d8bfd0e0d81a4a77f515e32d15547c1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n struct socket *so;\n \n+ struct socket *head = (is_udp ? &udb : &tcb);\n+\n+ struct sockaddr_in addr;\n+\n+ int port = htons(host_port);\n \n socklen_t addr_len;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int slirp_remove_hostfwd(int is_udp, struct in_addr host_addr, int host_port)\n\n{\n\n struct socket *so;\n\n struct socket *head = (is_udp ? &udb : &tcb);\n\n struct sockaddr_in addr;\n\n int port = htons(host_port);\n\n socklen_t addr_len;\n\n int n = 0;\n\n\n\n loop_again:\n\n for (so = head->so_next; so != head; so = so->so_next) {\n\n addr_len = sizeof(addr);\n\n if (getsockname(so->s, (struct sockaddr *)&addr, &addr_len) == 0 &&\n\n addr.sin_addr.s_addr == host_addr.s_addr &&\n\n addr.sin_port == port) {\n\n close(so->s);\n\n sofree(so);\n\n n++;\n\n goto loop_again;\n\n }\n\n }\n\n\n\n return n;\n\n}\n"}} {"sample_id": "c23acbaed40101c677dfcfbbfe0d2c230a8e8f44_21", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void ff_jref_idct1_put(uint8_t *dest, int line_size, DCTELEM *block)\n+\n+{\n \n uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void ff_jref_idct1_put(uint8_t *dest, int line_size, DCTELEM *block)\n\n{\n\n uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;\n\n\n\n dest[0] = cm[(block[0] + 4)>>3];\n\n}\n"}} {"sample_id": "44e6eeb30de8e2d20db56284984da4615763525c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,31 +1,31 @@\n static int print_device_sinks(AVOutputFormat *fmt, AVDictionary *opts)\n \n+{\n \n+ int ret, i;\n \n AVFormatContext *dev = NULL;\n \n AVDeviceInfoList *device_list = NULL;\n \n+ AVDictionary *tmp_opts = NULL;\n \n+\n+\n if (!fmt || !fmt->priv_class || !AV_IS_OUTPUT_DEVICE(fmt->priv_class->category))\n \n+ return AVERROR(EINVAL);\n+\n+\n \n printf(\"Audo-detected sinks for %s:\\n\", fmt->name);\n \n if (!fmt->get_device_list) {\n \n ret = AVERROR(ENOSYS);\n+\n printf(\"Cannot list sinks. Not implemented.\\n\");\n+\n goto fail;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int print_device_sinks(AVOutputFormat *fmt, AVDictionary *opts)\n\n{\n\n int ret, i;\n\n AVFormatContext *dev = NULL;\n\n AVDeviceInfoList *device_list = NULL;\n\n AVDictionary *tmp_opts = NULL;\n\n\n\n if (!fmt || !fmt->priv_class || !AV_IS_OUTPUT_DEVICE(fmt->priv_class->category))\n\n return AVERROR(EINVAL);\n\n\n\n printf(\"Audo-detected sinks for %s:\\n\", fmt->name);\n\n if (!fmt->get_device_list) {\n\n ret = AVERROR(ENOSYS);\n\n printf(\"Cannot list sinks. Not implemented.\\n\");\n\n goto fail;\n\n }\n\n\n\n if ((ret = avformat_alloc_output_context2(&dev, fmt, NULL, NULL)) < 0) {\n\n printf(\"Cannot open device: %s.\\n\", fmt->name);\n\n goto fail;\n\n }\n\n av_dict_copy(&tmp_opts, opts, 0);\n\n av_opt_set_dict2(dev, &tmp_opts, AV_OPT_SEARCH_CHILDREN);\n\n\n\n if ((ret = avdevice_list_devices(dev, &device_list)) < 0) {\n\n printf(\"Cannot list sinks.\\n\");\n\n goto fail;\n\n }\n\n\n\n for (i = 0; i < device_list->nb_devices; i++) {\n\n printf(\"%s %s [%s]\\n\", device_list->default_device == i ? \"*\" : \" \",\n\n device_list->devices[i]->device_name, device_list->devices[i]->device_description);\n\n }\n\n\n\n fail:\n\n av_dict_free(&tmp_opts);\n\n avdevice_free_list_devices(&device_list);\n\n avformat_free_context(dev);\n\n return ret;\n\n}\n"}} {"sample_id": "f2d089425d43735b5369f70f3a36b712440578e5_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n uint64_t tmp;\n \n \n+\n+ tmp = (*value >> shift) & mask;\n+\n+ if (mr->subpage) {\n+\n trace_memory_region_subpage_write(get_cpu_index(), mr, addr, tmp, size);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static MemTxResult memory_region_write_accessor(MemoryRegion *mr,\n\n hwaddr addr,\n\n uint64_t *value,\n\n unsigned size,\n\n unsigned shift,\n\n uint64_t mask,\n\n MemTxAttrs attrs)\n\n{\n\n uint64_t tmp;\n\n\n\n tmp = (*value >> shift) & mask;\n\n if (mr->subpage) {\n\n trace_memory_region_subpage_write(get_cpu_index(), mr, addr, tmp, size);\n\n\n\n\n\n\n } else if (TRACE_MEMORY_REGION_OPS_WRITE_ENABLED) {\n\n hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);\n\n trace_memory_region_ops_write(get_cpu_index(), mr, abs_addr, tmp, size);\n\n }\n\n mr->ops->write(mr->opaque, addr, tmp, size);\n\n return MEMTX_OK;\n\n}"}} {"sample_id": "2a633c461e96cb9a856292c46917653bd43959c8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int virtio_blk_load(QEMUFile *f, void *opaque, int version_id)\n \n {\n+\n VirtIOBlock *s = opaque;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int virtio_blk_load(QEMUFile *f, void *opaque, int version_id)\n\n{\n\n VirtIOBlock *s = opaque;\n\n\n\n if (version_id != 2)\n\n return -EINVAL;\n\n\n\n virtio_load(&s->vdev, f);\n\n while (qemu_get_sbyte(f)) {\n\n VirtIOBlockReq *req = virtio_blk_alloc_request(s);\n\n qemu_get_buffer(f, (unsigned char*)&req->elem, sizeof(req->elem));\n\n req->next = s->rq;\n\n s->rq = req;\n\n\n\n virtqueue_map_sg(req->elem.in_sg, req->elem.in_addr,\n\n req->elem.in_num, 1);\n\n virtqueue_map_sg(req->elem.out_sg, req->elem.out_addr,\n\n req->elem.out_num, 0);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_161", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void fw_cfg_ctl_mem_write(void *opaque, target_phys_addr_t addr,\n+\n uint64_t value, unsigned size)\n \n {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void fw_cfg_ctl_mem_write(void *opaque, target_phys_addr_t addr,\n\n uint64_t value, unsigned size)\n\n{\n\n fw_cfg_select(opaque, (uint16_t)value);\n\n}\n"}} {"sample_id": "b7394c8394d38cb38b6db14eb431cac7a91e7140", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n \n \n env->exception_injected = -1;\n+\n+ env->interrupt_injected = -1;\n+\n+ env->xcr0 = 1;\n+\n if (kvm_irqchip_in_kernel()) {\n \n env->mp_state = cpu_is_bsp(cpu) ? KVM_MP_STATE_RUNNABLE :", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void kvm_arch_reset_vcpu(X86CPU *cpu)\n\n{\n\n CPUX86State *env = &cpu->env;\n\n\n\n env->exception_injected = -1;\n\n env->interrupt_injected = -1;\n\n env->xcr0 = 1;\n\n if (kvm_irqchip_in_kernel()) {\n\n env->mp_state = cpu_is_bsp(cpu) ? KVM_MP_STATE_RUNNABLE :\n\n KVM_MP_STATE_UNINITIALIZED;\n\n } else {\n\n env->mp_state = KVM_MP_STATE_RUNNABLE;\n\n }\n\n\n\n if (cpu->hyperv_synic) {\n\n int i;\n\n for (i = 0; i < ARRAY_SIZE(env->msr_hv_synic_sint); i++) {\n\n env->msr_hv_synic_sint[i] = HV_SINT_MASKED;\n\n }\n\n }\n\n}\n"}} {"sample_id": "5839e53bbc0fec56021d758aab7610df421ed8c8_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void add_user_command(char *optarg)\n+\n {\n \n cmdline = g_realloc(cmdline, ++ncmdline * sizeof(char *));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void add_user_command(char *optarg)\n\n{\n\n cmdline = g_realloc(cmdline, ++ncmdline * sizeof(char *));\n\n cmdline[ncmdline-1] = optarg;\n\n}\n"}} {"sample_id": "6886b98036a8f8f5bce8b10756ce080084cef11b_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+ /* XXX: restore cpu registers saved in host registers */\n+\n+\n \n cpu->exception_index = -1;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void cpu_resume_from_signal(CPUState *cpu, void *puc)\n\n{\n\n /* XXX: restore cpu registers saved in host registers */\n\n\n\n cpu->exception_index = -1;\n\n siglongjmp(cpu->jmp_env, 1);\n\n}\n"}} {"sample_id": "79c4a338e4b2bf0bc6f81c9f455994f673a92f78", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n {\n \n XMVDemuxContext *xmv = s->priv_data;\n+\n+ int result;\n+\n+\n+\n if (xmv->video.current_frame == xmv->video.frame_count) {\n \n /* No frames left in this packet, so we fetch a new one */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int xmv_read_packet(AVFormatContext *s,\n\n AVPacket *pkt)\n\n{\n\n XMVDemuxContext *xmv = s->priv_data;\n\n int result;\n\n\n\n if (xmv->video.current_frame == xmv->video.frame_count) {\n\n /* No frames left in this packet, so we fetch a new one */\n\n\n\n result = xmv_fetch_new_packet(s);\n\n if (result)\n\n return result;\n\n }\n\n\n\n if (xmv->current_stream == 0) {\n\n /* Fetch a video frame */\n\n\n\n result = xmv_fetch_video_packet(s, pkt);\n\n } else {\n\n /* Fetch an audio frame */\n\n\n\n result = xmv_fetch_audio_packet(s, pkt, xmv->current_stream - 1);\n\n }\n\n if (result)\n\n return result;\n\n\n\n\n\n /* Increase our counters */\n\n if (++xmv->current_stream >= xmv->stream_count) {\n\n xmv->current_stream = 0;\n\n xmv->video.current_frame += 1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "6a4832caaede15e3d918b1408ff83fe30324507b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n DIRAC_PIXOP(avg, ff_avg, mmxext)\n \n \n+\n+void ff_put_dirac_pixels16_sse2(uint8_t *dst, const uint8_t *src[5], int stride, int h)\n+\n+{\n+\n if (h&3)\n \n ff_put_dirac_pixels16_c(dst, src, stride, h);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "DIRAC_PIXOP(put, ff_put, mmx)\n\nDIRAC_PIXOP(avg, ff_avg, mmx)\n\nDIRAC_PIXOP(avg, ff_avg, mmxext)\n\n\n\nvoid ff_put_dirac_pixels16_sse2(uint8_t *dst, const uint8_t *src[5], int stride, int h)\n\n{\n\n if (h&3)\n\n ff_put_dirac_pixels16_c(dst, src, stride, h);\n\n else\n\n ff_put_pixels16_sse2(dst, src[0], stride, h);\n\n}\n"}} {"sample_id": "0c22311b56e66115675c4a96e4c78547886a4171_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,9 +6,9 @@\n \n if (frame_padright < 0) {\n \n+ fprintf(stderr, \"Incorrect right pad size\\n\");\n+\n+ av_exit(1);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void opt_frame_pad_right(const char *arg)\n\n{\n\n frame_padright = atoi(arg);\n\n if (frame_padright < 0) {\n\n fprintf(stderr, \"Incorrect right pad size\\n\");\n\n av_exit(1);\n\n }\n\n}\n"}} {"sample_id": "ad96090a01d848df67d70c5259ed8aa321fa8716_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int ram_load(QEMUFile *f, void *opaque, int version_id)\n+\n+{\n+\n+ ram_addr_t addr;\n+\n int flags;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ram_load(QEMUFile *f, void *opaque, int version_id)\n\n{\n\n ram_addr_t addr;\n\n int flags;\n\n\n\n if (version_id != 3)\n\n return -EINVAL;\n\n\n\n do {\n\n addr = qemu_get_be64(f);\n\n\n\n flags = addr & ~TARGET_PAGE_MASK;\n\n addr &= TARGET_PAGE_MASK;\n\n\n\n if (flags & RAM_SAVE_FLAG_MEM_SIZE) {\n\n if (addr != last_ram_offset)\n\n return -EINVAL;\n\n }\n\n\n\n if (flags & RAM_SAVE_FLAG_COMPRESS) {\n\n uint8_t ch = qemu_get_byte(f);\n\n memset(qemu_get_ram_ptr(addr), ch, TARGET_PAGE_SIZE);\n\n#ifndef _WIN32\n\n if (ch == 0 &&\n\n (!kvm_enabled() || kvm_has_sync_mmu())) {\n\n madvise(qemu_get_ram_ptr(addr), TARGET_PAGE_SIZE, MADV_DONTNEED);\n\n }\n\n#endif\n\n } else if (flags & RAM_SAVE_FLAG_PAGE) {\n\n qemu_get_buffer(f, qemu_get_ram_ptr(addr), TARGET_PAGE_SIZE);\n\n }\n\n if (qemu_file_has_error(f)) {\n\n return -EIO;\n\n }\n\n } while (!(flags & RAM_SAVE_FLAG_EOS));\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "c9ce8c4da65b0c2b1dc82cbf2328ff3e23d76943", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n \n \n assert(bs != base);\n+\n+ for (p = bs; p != base; p = backing_bs(p)) {\n+\n+ ret = bdrv_co_get_block_status(p, sector_num, nb_sectors, pnum, file);\n+\n if (ret < 0) {\n \n break;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int64_t coroutine_fn bdrv_co_get_block_status_above(BlockDriverState *bs,\n\n BlockDriverState *base,\n\n int64_t sector_num,\n\n int nb_sectors,\n\n int *pnum,\n\n BlockDriverState **file)\n\n{\n\n BlockDriverState *p;\n\n int64_t ret = 0;\n\n bool first = true;\n\n\n\n assert(bs != base);\n\n for (p = bs; p != base; p = backing_bs(p)) {\n\n ret = bdrv_co_get_block_status(p, sector_num, nb_sectors, pnum, file);\n\n if (ret < 0) {\n\n break;\n\n }\n\n if (ret & BDRV_BLOCK_ZERO && ret & BDRV_BLOCK_EOF && !first) {\n\n /*\n\n * Reading beyond the end of the file continues to read\n\n * zeroes, but we can only widen the result to the\n\n * unallocated length we learned from an earlier\n\n * iteration.\n\n */\n\n *pnum = nb_sectors;\n\n }\n\n if (ret & (BDRV_BLOCK_ZERO | BDRV_BLOCK_DATA)) {\n\n break;\n\n }\n\n /* [sector_num, pnum] unallocated on this layer, which could be only\n\n * the first part of [sector_num, nb_sectors]. */\n\n nb_sectors = MIN(nb_sectors, *pnum);\n\n first = false;\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "1a2a1d90775b5be03254d123e4b617145a269572", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n while (ctx->rc.range <= BOTTOM_VALUE) {\n \n+ ctx->rc.buffer = (ctx->rc.buffer << 8) | bytestream_get_byte(&ctx->ptr);\n+\n+ ctx->rc.low = (ctx->rc.low << 8) | ((ctx->rc.buffer >> 1) & 0xFF);\n \n ctx->rc.range <<= 8;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void range_dec_normalize(APEContext * ctx)\n\n{\n\n while (ctx->rc.range <= BOTTOM_VALUE) {\n\n ctx->rc.buffer = (ctx->rc.buffer << 8) | bytestream_get_byte(&ctx->ptr);\n\n ctx->rc.low = (ctx->rc.low << 8) | ((ctx->rc.buffer >> 1) & 0xFF);\n\n ctx->rc.range <<= 8;\n\n }\n\n}\n"}} {"sample_id": "7d2aabe262846ddeda1785d42ff4d7964e8ac1c8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n tmp = gen_muls_i64_i32(a, b);\n \n+ tcg_gen_mov_i64(dest, tmp);\n+\n+\n+ break;\n+\n case 5:\n \n tmp = gen_mulu_i64_i32(a, b);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void gen_neon_mull(TCGv_i64 dest, TCGv a, TCGv b, int size, int u)\n\n{\n\n TCGv_i64 tmp;\n\n\n\n switch ((size << 1) | u) {\n\n case 0: gen_helper_neon_mull_s8(dest, a, b); break;\n\n case 1: gen_helper_neon_mull_u8(dest, a, b); break;\n\n case 2: gen_helper_neon_mull_s16(dest, a, b); break;\n\n case 3: gen_helper_neon_mull_u16(dest, a, b); break;\n\n case 4:\n\n tmp = gen_muls_i64_i32(a, b);\n\n tcg_gen_mov_i64(dest, tmp);\n\n\n break;\n\n case 5:\n\n tmp = gen_mulu_i64_i32(a, b);\n\n tcg_gen_mov_i64(dest, tmp);\n\n\n break;\n\n default: abort();\n\n }\n\n\n\n /* gen_helper_neon_mull_[su]{8|16} do not free their parameters.\n\n Don't forget to clean them now. */\n\n if (size < 2) {\n\n tcg_temp_free_i32(a);\n\n tcg_temp_free_i32(b);\n\n }\n\n}"}} {"sample_id": "4500bc98a6aab1734d865afaeade3509eb65b560", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,11 +34,11 @@\n \n \n \n+ load_asl(exp_data.ssdt_tables, exp_sdt);\n+\n+ exp_asl = normalize_asl(exp_sdt->asl);\n+\n+\n \n g_assert(!g_strcmp0(asl->str, exp_asl->str));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_acpi_asl(test_data *data)\n\n{\n\n int i;\n\n AcpiSdtTable *sdt, *exp_sdt;\n\n test_data exp_data;\n\n\n\n memset(&exp_data, 0, sizeof(exp_data));\n\n exp_data.ssdt_tables = load_expected_aml(data);\n\n dump_aml_files(data);\n\n for (i = 0; i < data->ssdt_tables->len; ++i) {\n\n GString *asl, *exp_asl;\n\n\n\n sdt = &g_array_index(data->ssdt_tables, AcpiSdtTable, i);\n\n exp_sdt = &g_array_index(exp_data.ssdt_tables, AcpiSdtTable, i);\n\n\n\n load_asl(data->ssdt_tables, sdt);\n\n asl = normalize_asl(sdt->asl);\n\n\n\n load_asl(exp_data.ssdt_tables, exp_sdt);\n\n exp_asl = normalize_asl(exp_sdt->asl);\n\n\n\n g_assert(!g_strcmp0(asl->str, exp_asl->str));\n\n g_string_free(asl, true);\n\n g_string_free(exp_asl, true);\n\n }\n\n\n\n free_test_data(&exp_data);\n\n}\n"}} {"sample_id": "aea2a33c73f28ecd8f10b242ecadddcc79c1c28b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void bdrv_eject(BlockDriverState *bs, int eject_flag)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void bdrv_eject(BlockDriverState *bs, int eject_flag)\n\n{\n\n BlockDriver *drv = bs->drv;\n\n int ret;\n\n\n\n if (!drv || !drv->bdrv_eject) {\n\n ret = -ENOTSUP;\n\n } else {\n\n ret = drv->bdrv_eject(bs, eject_flag);\n\n }\n\n if (ret == -ENOTSUP) {\n\n if (eject_flag)\n\n bdrv_close(bs);\n\n }\n\n}\n"}} {"sample_id": "7d1b0095bff7157e856d1d0e6c4295641ced2752_40", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,10 +12,10 @@\n \n case 0:\n \n+ tmp = gen_ld8u(addr, IS_USER(s));\n \n break;\n+\n case 1:\n \n tmp = gen_ld16u(addr, IS_USER(s));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_load_exclusive(DisasContext *s, int rt, int rt2,\n\n TCGv addr, int size)\n\n{\n\n TCGv tmp;\n\n\n\n switch (size) {\n\n case 0:\n\n tmp = gen_ld8u(addr, IS_USER(s));\n\n break;\n\n case 1:\n\n tmp = gen_ld16u(addr, IS_USER(s));\n\n break;\n\n case 2:\n\n case 3:\n\n tmp = gen_ld32(addr, IS_USER(s));\n\n break;\n\n default:\n\n abort();\n\n }\n\n tcg_gen_mov_i32(cpu_exclusive_val, tmp);\n\n store_reg(s, rt, tmp);\n\n if (size == 3) {\n\n TCGv tmp2 = new_tmp();\n\n tcg_gen_addi_i32(tmp2, addr, 4);\n\n tmp = gen_ld32(tmp2, IS_USER(s));\n\n dead_tmp(tmp2);\n\n tcg_gen_mov_i32(cpu_exclusive_high, tmp);\n\n store_reg(s, rt2, tmp);\n\n }\n\n tcg_gen_mov_i32(cpu_exclusive_addr, addr);\n\n}\n"}} {"sample_id": "1a751ebfbb2d7a696b889d8208cb5ffc83c090b1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n NonBlockingConnectHandler *callback, void *opaque)\n \n+{\n+\n+ QemuOpts *opts;\n+\n+ int fd;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "int socket_connect(SocketAddress *addr, Error **errp,\n\n NonBlockingConnectHandler *callback, void *opaque)\n\n{\n\n QemuOpts *opts;\n\n int fd;\n\n\n\n opts = qemu_opts_create_nofail(&socket_optslist);\n\n switch (addr->kind) {\n\n case SOCKET_ADDRESS_KIND_INET:\n\n inet_addr_to_opts(opts, addr->inet);\n\n fd = inet_connect_opts(opts, errp, callback, opaque);\n\n break;\n\n\n\n case SOCKET_ADDRESS_KIND_UNIX:\n\n qemu_opt_set(opts, \"path\", addr->q_unix->path);\n\n fd = unix_connect_opts(opts, errp, callback, opaque);\n\n break;\n\n\n\n case SOCKET_ADDRESS_KIND_FD:\n\n fd = monitor_get_fd(cur_mon, addr->fd->str, errp);\n\n if (callback) {\n\n\n callback(fd, opaque);\n\n }\n\n break;\n\n\n\n default:\n\n abort();\n\n }\n\n qemu_opts_del(opts);\n\n return fd;\n\n}"}} {"sample_id": "7f2fe444a39bca733d390b6608801c5f002bfd31", "diff": "--- a/source.c\n+++ b/source.c\n@@ -46,11 +46,11 @@\n \n d->mv_dir= s->mv_dir;\n \n+ d->pb= s->pb;\n+\n+ d->block= s->block;\n+\n+ for(i=0; i<6; i++)\n \n d->block_last_index[i]= s->block_last_index[i];\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void copy_context_after_encode(MpegEncContext *d, MpegEncContext *s, int type){\n\n int i;\n\n\n\n memcpy(d->mv, s->mv, 2*4*2*sizeof(int)); \n\n memcpy(d->last_mv, s->last_mv, 2*2*2*sizeof(int)); //FIXME is memcpy faster then a loop?\n\n \n\n /* mpeg1 */\n\n d->mb_incr= s->mb_incr;\n\n for(i=0; i<3; i++)\n\n d->last_dc[i]= s->last_dc[i];\n\n \n\n /* statistics */\n\n d->mv_bits= s->mv_bits;\n\n d->i_tex_bits= s->i_tex_bits;\n\n d->p_tex_bits= s->p_tex_bits;\n\n d->i_count= s->i_count;\n\n d->p_count= s->p_count;\n\n d->skip_count= s->skip_count;\n\n d->misc_bits= s->misc_bits;\n\n\n\n d->mb_intra= s->mb_intra;\n\n d->mb_skiped= s->mb_skiped;\n\n d->mv_type= s->mv_type;\n\n d->mv_dir= s->mv_dir;\n\n d->pb= s->pb;\n\n d->block= s->block;\n\n for(i=0; i<6; i++)\n\n d->block_last_index[i]= s->block_last_index[i];\n\n}\n"}} {"sample_id": "1e34cf9681ec549e26f30daaabc1ce58d60446f7_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,8 +7,8 @@\n uint32_t data;\n \n \n+\n+ if (dev->pdev->msix_enabled) {\n \n g_assert_cmpint(dev->config_msix_entry, !=, -1);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static bool qvirtio_pci_get_config_isr_status(QVirtioDevice *d)\n\n{\n\n QVirtioPCIDevice *dev = (QVirtioPCIDevice *)d;\n\n uint32_t data;\n\n\n\n if (dev->pdev->msix_enabled) {\n\n g_assert_cmpint(dev->config_msix_entry, !=, -1);\n\n if (qpci_msix_masked(dev->pdev, dev->config_msix_entry)) {\n\n /* No ISR checking should be done if masked, but read anyway */\n\n return qpci_msix_pending(dev->pdev, dev->config_msix_entry);\n\n } else {\n\n data = readl(dev->config_msix_addr);\n\n writel(dev->config_msix_addr, 0);\n\n return data == dev->config_msix_data;\n\n }\n\n } else {\n\n return qpci_io_readb(dev->pdev, dev->addr + QVIRTIO_PCI_ISR_STATUS) & 2;\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_73", "diff": "--- a/source.c\n+++ b/source.c\n@@ -49,11 +49,11 @@\n case 0x14:\t/* SR4 */\n \n return s->setup[3];\n+\n+ case 0x18:\t/* SR5 */\n+\n+ return s->setup[4];\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t omap_uwire_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n struct omap_uwire_s *s = (struct omap_uwire_s *) opaque;\n\n int offset = addr & OMAP_MPUI_REG_MASK;\n\n\n\n if (size != 2) {\n\n return omap_badwidth_read16(opaque, addr);\n\n }\n\n\n\n switch (offset) {\n\n case 0x00:\t/* RDR */\n\n s->control &= ~(1 << 15);\t\t\t/* RDRB */\n\n return s->rxbuf;\n\n\n\n case 0x04:\t/* CSR */\n\n return s->control;\n\n\n\n case 0x08:\t/* SR1 */\n\n return s->setup[0];\n\n case 0x0c:\t/* SR2 */\n\n return s->setup[1];\n\n case 0x10:\t/* SR3 */\n\n return s->setup[2];\n\n case 0x14:\t/* SR4 */\n\n return s->setup[3];\n\n case 0x18:\t/* SR5 */\n\n return s->setup[4];\n\n }\n\n\n\n OMAP_BAD_REG(addr);\n\n return 0;\n\n}\n"}} {"sample_id": "b690d679c1ca65d71b0544a2331d50e9f0f95116", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void qapi_dealloc_type_str(Visitor *v, char **obj, const char *name,\n+\n+ Error **errp)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qapi_dealloc_type_str(Visitor *v, char **obj, const char *name,\n\n Error **errp)\n\n{\n\n g_free(*obj);\n\n}\n"}} {"sample_id": "f8ed85ac992c48814d916d5df4d44f9a971c5de4_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n {\n \n+ DeviceState *dev;\n \n SysBusDevice *s;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void lx60_net_init(MemoryRegion *address_space,\n\n hwaddr base,\n\n hwaddr descriptors,\n\n hwaddr buffers,\n\n qemu_irq irq, NICInfo *nd)\n\n{\n\n DeviceState *dev;\n\n SysBusDevice *s;\n\n MemoryRegion *ram;\n\n\n\n dev = qdev_create(NULL, \"open_eth\");\n\n qdev_set_nic_properties(dev, nd);\n\n qdev_init_nofail(dev);\n\n\n\n s = SYS_BUS_DEVICE(dev);\n\n sysbus_connect_irq(s, 0, irq);\n\n memory_region_add_subregion(address_space, base,\n\n sysbus_mmio_get_region(s, 0));\n\n memory_region_add_subregion(address_space, descriptors,\n\n sysbus_mmio_get_region(s, 1));\n\n\n\n ram = g_malloc(sizeof(*ram));\n\n memory_region_init_ram(ram, OBJECT(s), \"open_eth.ram\", 16384, &error_abort);\n\n vmstate_register_ram_global(ram);\n\n memory_region_add_subregion(address_space, buffers, ram);\n\n}\n"}} {"sample_id": "62be4e3a5041e84304aa23637da623a205c53ecc_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n ram_addr_t qemu_ram_alloc(ram_addr_t size, MemoryRegion *mr, Error **errp)\n \n+{\n \n return qemu_ram_alloc_from_ptr(size, NULL, mr, errp);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "ram_addr_t qemu_ram_alloc(ram_addr_t size, MemoryRegion *mr, Error **errp)\n\n{\n\n return qemu_ram_alloc_from_ptr(size, NULL, mr, errp);\n\n}\n"}} {"sample_id": "9ee0cb201e6bfe03549a649fd165a85cfed34d05", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n blk_mig_cleanup();\n \n+ return ret;\n+\n+ }\n+\n+\n \n blk_mig_reset_dirty_cursor();\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int block_save_complete(QEMUFile *f, void *opaque)\n\n{\n\n int ret;\n\n\n\n DPRINTF(\"Enter save live complete submitted %d transferred %d\\n\",\n\n block_mig_state.submitted, block_mig_state.transferred);\n\n\n\n ret = flush_blks(f);\n\n if (ret) {\n\n blk_mig_cleanup();\n\n return ret;\n\n }\n\n\n\n blk_mig_reset_dirty_cursor();\n\n\n\n /* we know for sure that save bulk is completed and\n\n all async read completed */\n\n assert(block_mig_state.submitted == 0);\n\n\n\n do {\n\n ret = blk_mig_save_dirty_block(f, 0);\n\n } while (ret == 0);\n\n\n\n blk_mig_cleanup();\n\n if (ret) {\n\n return ret;\n\n }\n\n /* report completion */\n\n qemu_put_be64(f, (100 << BDRV_SECTOR_BITS) | BLK_MIG_FLAG_PROGRESS);\n\n\n\n DPRINTF(\"Block migration completed\\n\");\n\n\n\n qemu_put_be64(f, BLK_MIG_FLAG_EOS);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "45ed0be146b7433d1123f09eb1a984210a311625", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void gen_spr_power8_fscr(CPUPPCState *env)\n+\n {\n \n spr_register_kvm(env, SPR_FSCR, \"FSCR\",", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_spr_power8_fscr(CPUPPCState *env)\n\n{\n\n spr_register_kvm(env, SPR_FSCR, \"FSCR\",\n\n SPR_NOACCESS, SPR_NOACCESS,\n\n &spr_read_generic, &spr_write_generic,\n\n KVM_REG_PPC_FSCR, 0x00000000);\n\n}\n"}} {"sample_id": "e62fbc54d459d4cc8e91dc0938383a7f4c13768c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n cc->do_interrupt = ppc_cpu_do_interrupt;\n \n+ cc->dump_state = ppc_cpu_dump_state;\n+\n+ cc->dump_statistics = ppc_cpu_dump_statistics;\n+\n+ cc->set_pc = ppc_cpu_set_pc;\n \n cc->gdb_read_register = ppc_cpu_gdb_read_register;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void ppc_cpu_class_init(ObjectClass *oc, void *data)\n\n{\n\n PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);\n\n CPUClass *cc = CPU_CLASS(oc);\n\n DeviceClass *dc = DEVICE_CLASS(oc);\n\n\n\n pcc->parent_realize = dc->realize;\n\n dc->realize = ppc_cpu_realizefn;\n\n dc->unrealize = ppc_cpu_unrealizefn;\n\n\n\n pcc->parent_reset = cc->reset;\n\n cc->reset = ppc_cpu_reset;\n\n\n\n cc->class_by_name = ppc_cpu_class_by_name;\n\n cc->do_interrupt = ppc_cpu_do_interrupt;\n\n cc->dump_state = ppc_cpu_dump_state;\n\n cc->dump_statistics = ppc_cpu_dump_statistics;\n\n cc->set_pc = ppc_cpu_set_pc;\n\n cc->gdb_read_register = ppc_cpu_gdb_read_register;\n\n cc->gdb_write_register = ppc_cpu_gdb_write_register;\n\n#ifndef CONFIG_USER_ONLY\n\n cc->get_phys_page_debug = ppc_cpu_get_phys_page_debug;\n\n cc->vmsd = &vmstate_ppc_cpu;\n\n\n\n\n\n\n\n\n cc->gdb_num_core_regs = 71;\n\n\n cc->gdb_core_xml_file = \"power64-core.xml\";\n\n#else\n\n cc->gdb_core_xml_file = \"power-core.xml\";\n\n\n}"}} {"sample_id": "b106ad9185f35fc4ad669555ad0e79e276083bd7_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,29 +1,29 @@\n int qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset,\n \n int nb_clusters)\n+\n {\n \n BDRVQcowState *s = bs->opaque;\n \n+ uint64_t cluster_index;\n \n+ uint64_t old_free_cluster_index;\n+\n+ uint64_t i;\n+\n+ int refcount, ret;\n+\n+\n \n assert(nb_clusters >= 0);\n+\n+ if (nb_clusters == 0) {\n+\n return 0;\n \n }\n+\n \n \n /* Check how many clusters there are free */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset,\n\n int nb_clusters)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n uint64_t cluster_index;\n\n uint64_t old_free_cluster_index;\n\n uint64_t i;\n\n int refcount, ret;\n\n\n\n assert(nb_clusters >= 0);\n\n if (nb_clusters == 0) {\n\n return 0;\n\n }\n\n\n\n /* Check how many clusters there are free */\n\n cluster_index = offset >> s->cluster_bits;\n\n for(i = 0; i < nb_clusters; i++) {\n\n refcount = get_refcount(bs, cluster_index++);\n\n\n\n if (refcount < 0) {\n\n return refcount;\n\n } else if (refcount != 0) {\n\n break;\n\n }\n\n }\n\n\n\n /* And then allocate them */\n\n old_free_cluster_index = s->free_cluster_index;\n\n s->free_cluster_index = cluster_index + i;\n\n\n\n ret = update_refcount(bs, offset, i << s->cluster_bits, 1,\n\n QCOW2_DISCARD_NEVER);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n\n\n s->free_cluster_index = old_free_cluster_index;\n\n\n\n return i;\n\n}\n"}} {"sample_id": "49bf712a892901bd6a2e8815d085487180894d8c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n int coef_begin, int coef_end)\n \n+{\n+\n+ int icoef, pred, ilms, num_lms, residue, input;\n+\n+\n \n num_lms = s->cdlms_ttl[ch];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void revert_cdlms(WmallDecodeCtx *s, int ch,\n\n int coef_begin, int coef_end)\n\n{\n\n int icoef, pred, ilms, num_lms, residue, input;\n\n\n\n num_lms = s->cdlms_ttl[ch];\n\n for (ilms = num_lms - 1; ilms >= 0; ilms--) {\n\n for (icoef = coef_begin; icoef < coef_end; icoef++) {\n\n pred = 1 << (s->cdlms[ch][ilms].scaling - 1);\n\n residue = s->channel_residues[ch][icoef];\n\n pred += s->dsp.scalarproduct_and_madd_int16(s->cdlms[ch][ilms].coefs,\n\n s->cdlms[ch][ilms].lms_prevvalues\n\n + s->cdlms[ch][ilms].recent,\n\n s->cdlms[ch][ilms].lms_updates\n\n + s->cdlms[ch][ilms].recent,\n\n s->cdlms[ch][ilms].order,\n\n WMASIGN(residue));\n\n input = residue + (pred >> s->cdlms[ch][ilms].scaling);\n\n lms_update(s, ch, ilms, input);\n\n s->channel_residues[ch][icoef] = input;\n\n }\n\n }\n\n\n}"}} {"sample_id": "d28fca153bb27ff965b9eb26d73327fa4d2402c8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,10 +12,10 @@\n \n dc->vmsd = &pci_vpb_vmstate;\n \n+ dc->props = pci_vpb_properties;\n+\n+ /* Reason: object_unref() hangs */\n+\n+ dc->cannot_destroy_with_object_finalize_yet = true;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pci_vpb_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n\n\n dc->realize = pci_vpb_realize;\n\n dc->reset = pci_vpb_reset;\n\n dc->vmsd = &pci_vpb_vmstate;\n\n dc->props = pci_vpb_properties;\n\n /* Reason: object_unref() hangs */\n\n dc->cannot_destroy_with_object_finalize_yet = true;\n\n}\n"}} {"sample_id": "01ecb7172b684f1c4b3e748f95c5a9a494ca36ec_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static float quantize_band_cost(struct AACEncContext *s, const float *in,\n+\n const float *scaled, int size, int scale_idx,\n \n int cb, const float lambda, const float uplim,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static float quantize_band_cost(struct AACEncContext *s, const float *in,\n\n const float *scaled, int size, int scale_idx,\n\n int cb, const float lambda, const float uplim,\n\n int *bits, int rtz)\n\n{\n\n return get_band_cost(s, NULL, in, scaled, size, scale_idx, cb, lambda, uplim, bits);\n\n}\n"}} {"sample_id": "297a3646c2947ee64a6d42ca264039732c6218e0_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void visit_end_struct(Visitor *v, Error **errp)\n+\n {\n \n assert(!error_is_set(errp));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void visit_end_struct(Visitor *v, Error **errp)\n\n{\n\n assert(!error_is_set(errp));\n\n v->end_struct(v, errp);\n\n}\n"}} {"sample_id": "4733a12dd17a91d606e0079ff9bb48b9f419cbef", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n int len = strlen(p) * 6 / 8;\n \n+ char *buf = av_mallocz(len);\n+\n+ av_base64_decode(buf, p, len);\n+\n+\n \n if (rtp_asf_fix_header(buf, len) < 0)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int ff_wms_parse_sdp_a_line(AVFormatContext *s, const char *p)\n\n{\n\n int ret = 0;\n\n if (av_strstart(p, \"pgmpu:data:application/vnd.ms.wms-hdr.asfv1;base64,\", &p)) {\n\n AVIOContext pb;\n\n RTSPState *rt = s->priv_data;\n\n AVDictionary *opts = NULL;\n\n int len = strlen(p) * 6 / 8;\n\n char *buf = av_mallocz(len);\n\n av_base64_decode(buf, p, len);\n\n\n\n if (rtp_asf_fix_header(buf, len) < 0)\n\n av_log(s, AV_LOG_ERROR,\n\n \"Failed to fix invalid RTSP-MS/ASF min_pktsize\\n\");\n\n init_packetizer(&pb, buf, len);\n\n if (rt->asf_ctx) {\n\n avformat_close_input(&rt->asf_ctx);\n\n }\n\n if (!(rt->asf_ctx = avformat_alloc_context()))\n\n return AVERROR(ENOMEM);\n\n rt->asf_ctx->pb = &pb;\n\n av_dict_set(&opts, \"no_resync_search\", \"1\", 0);\n\n ret = avformat_open_input(&rt->asf_ctx, \"\", &ff_asf_demuxer, &opts);\n\n av_dict_free(&opts);\n\n if (ret < 0)\n\n return ret;\n\n av_dict_copy(&s->metadata, rt->asf_ctx->metadata, 0);\n\n rt->asf_pb_pos = avio_tell(&pb);\n\n av_free(buf);\n\n rt->asf_ctx->pb = NULL;\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "442c3a8cb1785d74f8e2d7ab35b1862b7088436b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static inline void expand_category(COOKContext *q, int *category,\n \n int *category_index)\n+\n {\n \n int i;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void expand_category(COOKContext *q, int *category,\n\n int *category_index)\n\n{\n\n int i;\n\n for (i = 0; i < q->num_vectors; i++)\n\n ++category[category_index[i]];\n\n}\n"}} {"sample_id": "b8664c929437d6d079e16979c496a2db40cf2324_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -39,11 +39,11 @@\n dsp->vp8_v_loop_filter_simple = vp8_v_loop_filter_simple_c;\n \n dsp->vp8_h_loop_filter_simple = vp8_h_loop_filter_simple_c;\n+\n+\n+\n+ VP8_MC_FUNC(0, 16);\n+\n VP8_MC_FUNC(1, 8);\n \n VP8_MC_FUNC(2, 4);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "av_cold void ff_vp8dsp_init(VP8DSPContext *dsp)\n\n{\n\n dsp->vp8_luma_dc_wht = vp8_luma_dc_wht_c;\n\n dsp->vp8_luma_dc_wht_dc = vp8_luma_dc_wht_dc_c;\n\n dsp->vp8_idct_add = vp8_idct_add_c;\n\n dsp->vp8_idct_dc_add = vp8_idct_dc_add_c;\n\n dsp->vp8_idct_dc_add4y = vp8_idct_dc_add4y_c;\n\n dsp->vp8_idct_dc_add4uv = vp8_idct_dc_add4uv_c;\n\n\n\n dsp->vp8_v_loop_filter16y = vp8_v_loop_filter16_c;\n\n dsp->vp8_h_loop_filter16y = vp8_h_loop_filter16_c;\n\n dsp->vp8_v_loop_filter8uv = vp8_v_loop_filter8uv_c;\n\n dsp->vp8_h_loop_filter8uv = vp8_h_loop_filter8uv_c;\n\n\n\n dsp->vp8_v_loop_filter16y_inner = vp8_v_loop_filter16_inner_c;\n\n dsp->vp8_h_loop_filter16y_inner = vp8_h_loop_filter16_inner_c;\n\n dsp->vp8_v_loop_filter8uv_inner = vp8_v_loop_filter8uv_inner_c;\n\n dsp->vp8_h_loop_filter8uv_inner = vp8_h_loop_filter8uv_inner_c;\n\n\n\n dsp->vp8_v_loop_filter_simple = vp8_v_loop_filter_simple_c;\n\n dsp->vp8_h_loop_filter_simple = vp8_h_loop_filter_simple_c;\n\n\n\n VP8_MC_FUNC(0, 16);\n\n VP8_MC_FUNC(1, 8);\n\n VP8_MC_FUNC(2, 4);\n\n\n\n VP8_BILINEAR_MC_FUNC(0, 16);\n\n VP8_BILINEAR_MC_FUNC(1, 8);\n\n VP8_BILINEAR_MC_FUNC(2, 4);\n\n\n\n if (ARCH_ARM)\n\n ff_vp8dsp_init_arm(dsp);\n\n if (ARCH_PPC)\n\n ff_vp8dsp_init_ppc(dsp);\n\n if (ARCH_X86)\n\n ff_vp8dsp_init_x86(dsp);\n\n}\n"}} {"sample_id": "a980a065fb5e86d6dec337e6cb6ff432f1a143c9_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n s->filter = 0;\n \n s->vendorid = 0x1234;\n+\n+\n+\n+ qemu_macaddr_default_if_unset(&s->conf.macaddr);\n+\n s->nic = qemu_new_nic(&net_usbnet_info, &s->conf,\n \n s->dev.qdev.info->name, s->dev.qdev.id, s);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int usb_net_initfn(USBDevice *dev)\n\n{\n\n USBNetState *s = DO_UPCAST(USBNetState, dev, dev);\n\n\n\n s->dev.speed = USB_SPEED_FULL;\n\n\n\n s->rndis = 1;\n\n s->rndis_state = RNDIS_UNINITIALIZED;\n\n QTAILQ_INIT(&s->rndis_resp);\n\n\n\n s->medium = 0;\t/* NDIS_MEDIUM_802_3 */\n\n s->speed = 1000000; /* 100MBps, in 100Bps units */\n\n s->media_state = 0;\t/* NDIS_MEDIA_STATE_CONNECTED */;\n\n s->filter = 0;\n\n s->vendorid = 0x1234;\n\n\n\n qemu_macaddr_default_if_unset(&s->conf.macaddr);\n\n s->nic = qemu_new_nic(&net_usbnet_info, &s->conf,\n\n s->dev.qdev.info->name, s->dev.qdev.id, s);\n\n qemu_format_nic_info_str(&s->nic->nc, s->conf.macaddr.a);\n\n snprintf(s->usbstring_mac, sizeof(s->usbstring_mac),\n\n \"%02x%02x%02x%02x%02x%02x\",\n\n 0x40,\n\n s->conf.macaddr.a[1],\n\n s->conf.macaddr.a[2],\n\n s->conf.macaddr.a[3],\n\n s->conf.macaddr.a[4],\n\n s->conf.macaddr.a[5]);\n\n usb_desc_set_string(dev, STRING_ETHADDR, s->usbstring_mac);\n\n\n\n add_boot_device_path(s->conf.bootindex, &dev->qdev, \"/ethernet@0\");\n\n return 0;\n\n}\n"}} {"sample_id": "e45a2872fafe631c14aee9f79d0963d68c4fc1fd_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n \n \n POWERPC_TBL_START_COUNT(altivec_put_pixels16_num, 1);\n+\n+\n+\n+ for(i=0; il);\n \n *((uint32_t*)(block+4)) = (((const struct unaligned_32 *) (pixels+4))->l);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void put_pixels16_altivec(uint8_t *block, const uint8_t *pixels, int line_size, int h)\n\n{\n\nPOWERPC_TBL_DECLARE(altivec_put_pixels16_num, 1);\n\n#ifdef ALTIVEC_USE_REFERENCE_C_CODE\n\n int i;\n\n\n\nPOWERPC_TBL_START_COUNT(altivec_put_pixels16_num, 1);\n\n\n\n for(i=0; il);\n\n *((uint32_t*)(block+4)) = (((const struct unaligned_32 *) (pixels+4))->l);\n\n *((uint32_t*)(block+8)) = (((const struct unaligned_32 *) (pixels+8))->l);\n\n *((uint32_t*)(block+12)) = (((const struct unaligned_32 *) (pixels+12))->l);\n\n pixels+=line_size;\n\n block +=line_size;\n\n }\n\n\n\nPOWERPC_TBL_STOP_COUNT(altivec_put_pixels16_num, 1);\n\n\n\n#else /* ALTIVEC_USE_REFERENCE_C_CODE */\n\n register vector unsigned char pixelsv1, pixelsv2;\n\n register vector unsigned char perm = vec_lvsl(0, pixels);\n\n int i;\n\n\n\nPOWERPC_TBL_START_COUNT(altivec_put_pixels16_num, 1);\n\n\n\n for(i=0; ipriv_data;\n+\n uint32_t mask = XCB_CW_OVERRIDE_REDIRECT | XCB_CW_EVENT_MASK;\n \n uint32_t values[] = { 1,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void setup_window(AVFormatContext *s)\n\n{\n\n XCBGrabContext *c = s->priv_data;\n\n uint32_t mask = XCB_CW_OVERRIDE_REDIRECT | XCB_CW_EVENT_MASK;\n\n uint32_t values[] = { 1,\n\n XCB_EVENT_MASK_EXPOSURE |\n\n XCB_EVENT_MASK_STRUCTURE_NOTIFY };\n\n xcb_rectangle_t rect = { 0, 0, c->width, c->height };\n\n\n\n c->window = xcb_generate_id(c->conn);\n\n\n\n xcb_create_window(c->conn, XCB_COPY_FROM_PARENT,\n\n c->window,\n\n c->screen->root,\n\n c->x - c->region_border,\n\n c->y - c->region_border,\n\n c->width + c->region_border * 2,\n\n c->height + c->region_border * 2,\n\n 0,\n\n XCB_WINDOW_CLASS_INPUT_OUTPUT,\n\n XCB_COPY_FROM_PARENT,\n\n mask, values);\n\n\n\n#if CONFIG_LIBXCB_SHAPE\n\n xcb_shape_rectangles(c->conn, XCB_SHAPE_SO_SUBTRACT,\n\n XCB_SHAPE_SK_BOUNDING, XCB_CLIP_ORDERING_UNSORTED,\n\n c->window,\n\n c->region_border, c->region_border,\n\n 1, &rect);\n\n#endif\n\n\n\n xcb_map_window(c->conn, c->window);\n\n\n\n draw_rectangle(s);\n\n}\n"}} {"sample_id": "658ae5a7b90139a6a296cd4cd83643d843964796", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static uint16List **host_memory_append_node(uint16List **node,\n+\n+ unsigned long value)\n+\n {\n \n *node = g_malloc0(sizeof(**node));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static uint16List **host_memory_append_node(uint16List **node,\n\n unsigned long value)\n\n{\n\n *node = g_malloc0(sizeof(**node));\n\n (*node)->value = value;\n\n return &(*node)->next;\n\n}\n"}} {"sample_id": "00b8702581f312aa46f797a8b3153d9b2892d967", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n void *opaque, Error **errp)\n \n+{\n \n DeviceState *dev = DEVICE(obj);\n+\n+ Property *prop = opaque;\n \n PCIHostDeviceAddress *addr = qdev_get_prop_ptr(dev, prop);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void get_pci_host_devaddr(Object *obj, Visitor *v, const char *name,\n\n void *opaque, Error **errp)\n\n{\n\n DeviceState *dev = DEVICE(obj);\n\n Property *prop = opaque;\n\n PCIHostDeviceAddress *addr = qdev_get_prop_ptr(dev, prop);\n\n char buffer[] = \"xxxx:xx:xx.x\";\n\n char *p = buffer;\n\n int rc = 0;\n\n\n\n rc = snprintf(buffer, sizeof(buffer), \"%04x:%02x:%02x.%d\",\n\n addr->domain, addr->bus, addr->slot, addr->function);\n\n assert(rc == sizeof(buffer) - 1);\n\n\n\n visit_type_str(v, name, &p, errp);\n\n}\n"}} {"sample_id": "cf081fca4e3cc02a309659b571ab0c5b225ea4cf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,9 +17,9 @@\n MAX(bs->bl.write_zeroes_alignment,\n \n s->extents[i].cluster_sectors);\n+\n+ }\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vmdk_refresh_limits(BlockDriverState *bs, Error **errp)\n\n{\n\n BDRVVmdkState *s = bs->opaque;\n\n int i;\n\n\n\n for (i = 0; i < s->num_extents; i++) {\n\n if (!s->extents[i].flat) {\n\n bs->bl.write_zeroes_alignment =\n\n MAX(bs->bl.write_zeroes_alignment,\n\n s->extents[i].cluster_sectors);\n\n }\n\n }\n\n}\n"}} {"sample_id": "6e42e6c4b410dbef8b593c2d796a5dad95f89ee4_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n void palette8torgb32(const uint8_t *src, uint8_t *dst, long num_pixels, const uint8_t *palette)\n+\n+{\n \n+\tlong i;\n+\n+\n+\n+/*\n+\n+\tfor(i=0; iaudio_block.block_output;\n\n\n\n for (i = 0; i < 256; i++)\n\n output[1][i] += (output[2][i] + output[3][i]);\n\n memset(output[2], 0, sizeof(output[2]));\n\n memset(output[3], 0, sizeof(output[3]));\n\n\n\n}\n"}} {"sample_id": "b0ad5a455d7e5352d4c86ba945112011dbeadfb8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static inline int is_bit_set(BlockDriverState *bs, int64_t bitnum)\n \n {\n+\n+ uint64_t offset = sizeof(struct cow_header_v2) + bitnum / 8;\n \n uint8_t bitmap;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline int is_bit_set(BlockDriverState *bs, int64_t bitnum)\n\n{\n\n uint64_t offset = sizeof(struct cow_header_v2) + bitnum / 8;\n\n uint8_t bitmap;\n\n\n\n if (bdrv_pread(bs->file, offset, &bitmap, sizeof(bitmap)) !=\n\n\t sizeof(bitmap)) {\n\n return -errno;\n\n }\n\n\n\n return !!(bitmap & (1 << (bitnum % 8)));\n\n}\n"}} {"sample_id": "301cc4f37050ed5c08aec8de6d4e22ede2ce9a9f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static const AVOption *av_set_number(void *obj, const char *name, double num, int den, int64_t intnum){\n \n const AVOption *o= av_find_opt(obj, name, NULL, 0, 0);\n+\n void *dst;\n \n if(!o || o->offset<=0)\n@@ -17,7 +17,7 @@\n return NULL;\n \n }\n+\n \n \n dst= ((uint8_t*)obj) + o->offset;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static const AVOption *av_set_number(void *obj, const char *name, double num, int den, int64_t intnum){\n\n const AVOption *o= av_find_opt(obj, name, NULL, 0, 0);\n\n void *dst;\n\n if(!o || o->offset<=0)\n\n return NULL;\n\n\n\n if(o->max*den < num*intnum || o->min*den > num*intnum) {\n\n av_log(NULL, AV_LOG_ERROR, \"Value %lf for parameter '%s' out of range\\n\", num, name);\n\n return NULL;\n\n }\n\n\n\n dst= ((uint8_t*)obj) + o->offset;\n\n\n\n switch(o->type){\n\n case FF_OPT_TYPE_FLAGS:\n\n case FF_OPT_TYPE_INT: *(int *)dst= llrint(num/den)*intnum; break;\n\n case FF_OPT_TYPE_INT64: *(int64_t *)dst= llrint(num/den)*intnum; break;\n\n case FF_OPT_TYPE_FLOAT: *(float *)dst= num*intnum/den; break;\n\n case FF_OPT_TYPE_DOUBLE:*(double *)dst= num*intnum/den; break;\n\n case FF_OPT_TYPE_RATIONAL:\n\n if((int)num == num) *(AVRational*)dst= (AVRational){num*intnum, den};\n\n else *(AVRational*)dst= av_d2q(num*intnum/den, 1<<24);\n\n break;\n\n default:\n\n return NULL;\n\n }\n\n return o;\n\n}\n"}} {"sample_id": "96e35046e4a97df5b4e1e24e217eb1e1701c7c71", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n QObject *event_data;\n \n+ VirtIONet *n = qemu_get_nic_opaque(nc);\n \n+\n \n if (nc->rxfilter_notify_enabled) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void rxfilter_notify(NetClientState *nc)\n\n{\n\n QObject *event_data;\n\n VirtIONet *n = qemu_get_nic_opaque(nc);\n\n\n\n if (nc->rxfilter_notify_enabled) {\n\n if (n->netclient_name) {\n\n event_data = qobject_from_jsonf(\"{ 'name': %s, 'path': %s }\",\n\n n->netclient_name,\n\n object_get_canonical_path(OBJECT(n->qdev)));\n\n } else {\n\n event_data = qobject_from_jsonf(\"{ 'path': %s }\",\n\n object_get_canonical_path(OBJECT(n->qdev)));\n\n }\n\n monitor_protocol_event(QEVENT_NIC_RX_FILTER_CHANGED, event_data);\n\n qobject_decref(event_data);\n\n\n\n /* disable event notification to avoid events flooding */\n\n nc->rxfilter_notify_enabled = 0;\n\n }\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_36", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n bool timerlistgroup_run_timers(QEMUTimerListGroup *tlg)\n \n+{\n+\n+ QEMUClockType type;\n+\n bool progress = false;\n \n for (type = 0; type < QEMU_CLOCK_MAX; type++) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool timerlistgroup_run_timers(QEMUTimerListGroup *tlg)\n\n{\n\n QEMUClockType type;\n\n bool progress = false;\n\n for (type = 0; type < QEMU_CLOCK_MAX; type++) {\n\n progress |= timerlist_run_timers(tlg->tl[type]);\n\n }\n\n return progress;\n\n}\n"}} {"sample_id": "0c8f86ea98945678622c6e4b070c4218a53a0d19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void rocker_class_init(ObjectClass *klass, void *data)\n \n {\n+\n DeviceClass *dc = DEVICE_CLASS(klass);\n \n PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void rocker_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);\n\n\n\n k->init = pci_rocker_init;\n\n k->exit = pci_rocker_uninit;\n\n k->vendor_id = PCI_VENDOR_ID_REDHAT;\n\n k->device_id = PCI_DEVICE_ID_REDHAT_ROCKER;\n\n k->revision = ROCKER_PCI_REVISION;\n\n k->class_id = PCI_CLASS_NETWORK_OTHER;\n\n set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);\n\n dc->desc = \"Rocker Switch\";\n\n dc->reset = rocker_reset;\n\n dc->props = rocker_properties;\n\n dc->vmsd = &rocker_vmsd;\n\n}\n"}} {"sample_id": "6864fa38972081833f79b39df74b9c08cc94f6cc_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int pci_apb_map_irq(PCIDevice *pci_dev, int irq_num)\n \n {\n+\n return ((pci_dev->devfn & 0x18) >> 1) + irq_num;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pci_apb_map_irq(PCIDevice *pci_dev, int irq_num)\n\n{\n\n return ((pci_dev->devfn & 0x18) >> 1) + irq_num;\n\n}\n"}} {"sample_id": "a00676e48e49a3d794d6d2063ceca539e945a4a4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int read_dcs(AVCodecContext *avctx, GetBitContext *gb, Bundle *b,\n \n+ int start_bits, int has_sign)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int read_dcs(AVCodecContext *avctx, GetBitContext *gb, Bundle *b,\n\n int start_bits, int has_sign)\n\n{\n\n int i, j, len, len2, bsize, sign, v, v2;\n\n int16_t *dst = (int16_t*)b->cur_dec;\n\n\n\n CHECK_READ_VAL(gb, b, len);\n\n v = get_bits(gb, start_bits - has_sign);\n\n if (v && has_sign) {\n\n sign = -get_bits1(gb);\n\n v = (v ^ sign) - sign;\n\n }\n\n *dst++ = v;\n\n len--;\n\n for (i = 0; i < len; i += 8) {\n\n len2 = FFMIN(len - i, 8);\n\n bsize = get_bits(gb, 4);\n\n if (bsize) {\n\n for (j = 0; j < len2; j++) {\n\n v2 = get_bits(gb, bsize);\n\n if (v2) {\n\n sign = -get_bits1(gb);\n\n v2 = (v2 ^ sign) - sign;\n\n }\n\n v += v2;\n\n *dst++ = v;\n\n if (v < -32768 || v > 32767) {\n\n av_log(avctx, AV_LOG_ERROR, \"DC value went out of bounds: %d\\n\", v);\n\n return -1;\n\n }\n\n }\n\n } else {\n\n for (j = 0; j < len2; j++)\n\n *dst++ = v;\n\n }\n\n }\n\n\n\n b->cur_dec = (uint8_t*)dst;\n\n return 0;\n\n}\n"}} {"sample_id": "c7f8d0f3a52b5ef8fdcd305cce438f67d7e06a9f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n HotplugHandlerClass *hdc = HOTPLUG_HANDLER_GET_CLASS(plug_handler);\n \n+\n+\n+ if (hdc->post_plug) {\n+\n hdc->post_plug(plug_handler, plugged_dev, errp);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void hotplug_handler_post_plug(HotplugHandler *plug_handler,\n\n DeviceState *plugged_dev,\n\n Error **errp)\n\n{\n\n HotplugHandlerClass *hdc = HOTPLUG_HANDLER_GET_CLASS(plug_handler);\n\n\n\n if (hdc->post_plug) {\n\n hdc->post_plug(plug_handler, plugged_dev, errp);\n\n }\n\n}\n"}} {"sample_id": "5bbf90be97203c472f47da070c0040b464c0460f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n hwaddr addr,\n \n uint64_t data,\n+\n+ unsigned size)\n+\n+{\n+\n if (!memory_region_access_valid(mr, addr, size, true)) {\n \n return; /* FIXME: better signalling */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void memory_region_dispatch_write(MemoryRegion *mr,\n\n hwaddr addr,\n\n uint64_t data,\n\n unsigned size)\n\n{\n\n if (!memory_region_access_valid(mr, addr, size, true)) {\n\n return; /* FIXME: better signalling */\n\n }\n\n\n\n adjust_endianness(mr, &data, size);\n\n\n\n if (!mr->ops->write) {\n\n mr->ops->old_mmio.write[bitops_ctzl(size)](mr->opaque, addr, data);\n\n return;\n\n }\n\n\n\n /* FIXME: support unaligned access */\n\n access_with_adjusted_size(addr, &data, size,\n\n mr->ops->impl.min_access_size,\n\n mr->ops->impl.max_access_size,\n\n memory_region_write_accessor, mr);\n\n}\n"}} {"sample_id": "e2779de053b64f023de382fd87b3596613d47d1e_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n *value = base_address_with_flags(&s->real_device.io_regions[index]);\n \n \n+\n+ /* set emulate mask depend on BAR flag */\n+\n+ switch (s->bases[index].bar_flag) {\n+\n case XEN_PT_BAR_FLAG_MEM:\n \n bar_emu_mask = XEN_PT_BAR_MEM_EMU_MASK;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int xen_pt_bar_reg_read(XenPCIPassthroughState *s, XenPTReg *cfg_entry,\n\n uint32_t *value, uint32_t valid_mask)\n\n{\n\n XenPTRegInfo *reg = cfg_entry->reg;\n\n uint32_t valid_emu_mask = 0;\n\n uint32_t bar_emu_mask = 0;\n\n int index;\n\n\n\n /* get BAR index */\n\n index = xen_pt_bar_offset_to_index(reg->offset);\n\n if (index < 0 || index >= PCI_NUM_REGIONS - 1) {\n\n XEN_PT_ERR(&s->dev, \"Internal error: Invalid BAR index [%d].\\n\", index);\n\n return -1;\n\n }\n\n\n\n /* use fixed-up value from kernel sysfs */\n\n *value = base_address_with_flags(&s->real_device.io_regions[index]);\n\n\n\n /* set emulate mask depend on BAR flag */\n\n switch (s->bases[index].bar_flag) {\n\n case XEN_PT_BAR_FLAG_MEM:\n\n bar_emu_mask = XEN_PT_BAR_MEM_EMU_MASK;\n\n break;\n\n case XEN_PT_BAR_FLAG_IO:\n\n bar_emu_mask = XEN_PT_BAR_IO_EMU_MASK;\n\n break;\n\n case XEN_PT_BAR_FLAG_UPPER:\n\n bar_emu_mask = XEN_PT_BAR_ALLF;\n\n break;\n\n default:\n\n break;\n\n }\n\n\n\n /* emulate BAR */\n\n valid_emu_mask = bar_emu_mask & valid_mask;\n\n *value = XEN_PT_MERGE_VALUE(*value, cfg_entry->data, ~valid_emu_mask);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "0240ded8bb1580147ed2ff1748df439a3b41e38f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n regs->ARM_pc = infop->entry;\n \n regs->ARM_sp = infop->start_stack;\n+\n+ regs->ARM_r2 = tswapl(stack[2]); /* envp */\n+\n+ regs->ARM_r1 = tswapl(stack[1]); /* argv */\n+\n /* XXX: it seems that r0 is zeroed after ! */\n \n // regs->ARM_r0 = tswapl(stack[0]); /* argc */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop)\n\n{\n\n target_long *stack = (void *)infop->start_stack;\n\n memset(regs, 0, sizeof(*regs));\n\n regs->ARM_cpsr = 0x10;\n\n regs->ARM_pc = infop->entry;\n\n regs->ARM_sp = infop->start_stack;\n\n regs->ARM_r2 = tswapl(stack[2]); /* envp */\n\n regs->ARM_r1 = tswapl(stack[1]); /* argv */\n\n /* XXX: it seems that r0 is zeroed after ! */\n\n // regs->ARM_r0 = tswapl(stack[0]); /* argc */\n\n}\n"}} {"sample_id": "cfaadf0e89e7c2a47462d5f96390c9a9b4de037c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static uint64_t fw_cfg_data_mem_read(void *opaque, hwaddr addr,\n \n+ unsigned size)\n+\n {\n \n return fw_cfg_read(opaque);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t fw_cfg_data_mem_read(void *opaque, hwaddr addr,\n\n unsigned size)\n\n{\n\n return fw_cfg_read(opaque);\n\n}\n"}} {"sample_id": "20c334a797bf46a4ee59a6e42be6d5e7c3cda585_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static inline uint16_t mipsdsp_sat16_sub(int16_t a, int16_t b,\n \n CPUMIPSState *env)\n+\n+{\n \n int16_t temp;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static inline uint16_t mipsdsp_sat16_sub(int16_t a, int16_t b,\n\n CPUMIPSState *env)\n\n{\n\n int16_t temp;\n\n\n\n temp = a - b;\n\n if (MIPSDSP_OVERFLOW(a, -b, temp, 0x8000)) {\n\n if (a > 0) {\n\n temp = 0x7FFF;\n\n } else {\n\n temp = 0x8000;\n\n }\n\n set_DSPControl_overflow_flag(1, 20, env);\n\n }\n\n\n\n return temp;\n\n}\n"}} {"sample_id": "d0cc2fbfa607678866475383c508be84818ceb64_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,8 +3,8 @@\n {\n \n uint64_t value;\n+\n+ int r = read(e->fd, &value, sizeof(value));\n \n return r == sizeof(value);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int event_notifier_test_and_clear(EventNotifier *e)\n\n{\n\n uint64_t value;\n\n int r = read(e->fd, &value, sizeof(value));\n\n return r == sizeof(value);\n\n}\n"}} {"sample_id": "2ee73ac3a855fb0cfba3db91fdd1ecebdbc6f971", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void OPPROTO op_fdiv_STN_ST0(void)\n+\n {\n \n ST(PARAM1) /= ST0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void OPPROTO op_fdiv_STN_ST0(void)\n\n{\n\n ST(PARAM1) /= ST0;\n\n}\n"}} {"sample_id": "12f86b5b3e1bdf75e0a467d771c16cc42f3a1f1a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n qemu_mutex_init(&fit_buf->lock);\n+\n+ fit_buf->fit = g_array_new(false, true /* clear */, 1);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void nvdimm_init_fit_buffer(NvdimmFitBuffer *fit_buf)\n\n{\n\n qemu_mutex_init(&fit_buf->lock);\n\n fit_buf->fit = g_array_new(false, true /* clear */, 1);\n\n}\n"}} {"sample_id": "c83c66c3b58893a4dc056e272822beb88fe9ec7f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,10 +7,10 @@\n const char *device = qdict_get_str(qdict, \"device\");\n \n const char *base = qdict_get_try_str(qdict, \"base\");\n+\n+\n+\n+ qmp_block_stream(device, base != NULL, base, &error);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void hmp_block_stream(Monitor *mon, const QDict *qdict)\n\n{\n\n Error *error = NULL;\n\n const char *device = qdict_get_str(qdict, \"device\");\n\n const char *base = qdict_get_try_str(qdict, \"base\");\n\n\n\n qmp_block_stream(device, base != NULL, base, &error);\n\n\n\n hmp_handle_error(mon, &error);\n\n}\n"}} {"sample_id": "a89f364ae8740dfc31b321eed9ee454e996dc3c1_39", "diff": "--- a/source.c\n+++ b/source.c\n@@ -35,11 +35,11 @@\n \n \n default:\n+\n+ printf(\"%s: Bad register \" REG_FMT \"\\n\", __FUNCTION__, addr);\n+\n+ break;\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pxa2xx_cm_write(void *opaque, hwaddr addr,\n\n uint64_t value, unsigned size)\n\n{\n\n PXA2xxState *s = (PXA2xxState *) opaque;\n\n\n\n switch (addr) {\n\n case CCCR:\n\n case CKEN:\n\n s->cm_regs[addr >> 2] = value;\n\n break;\n\n\n\n case OSCC:\n\n s->cm_regs[addr >> 2] &= ~0x6c;\n\n s->cm_regs[addr >> 2] |= value & 0x6e;\n\n if ((value >> 1) & 1)\t\t\t/* OON */\n\n s->cm_regs[addr >> 2] |= 1 << 0;\t/* Oscillator is now stable */\n\n break;\n\n\n\n default:\n\n printf(\"%s: Bad register \" REG_FMT \"\\n\", __FUNCTION__, addr);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_101", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n PRINT_DEBUG_EXTEND(\"%s [0x%04x] -> 0x%04x\\n\", reg_p->name,\n \n+ (uint32_t)offset, s->reg[i]);\n+\n+ return s->reg[i];\n+\n+ }\n \n reg_p++;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t exynos4210_pmu_read(void *opaque, target_phys_addr_t offset,\n\n unsigned size)\n\n{\n\n Exynos4210PmuState *s = (Exynos4210PmuState *)opaque;\n\n unsigned i;\n\n const Exynos4210PmuReg *reg_p = exynos4210_pmu_regs;\n\n\n\n for (i = 0; i < PMU_NUM_OF_REGISTERS; i++) {\n\n if (reg_p->offset == offset) {\n\n PRINT_DEBUG_EXTEND(\"%s [0x%04x] -> 0x%04x\\n\", reg_p->name,\n\n (uint32_t)offset, s->reg[i]);\n\n return s->reg[i];\n\n }\n\n reg_p++;\n\n }\n\n PRINT_DEBUG(\"QEMU PMU ERROR: bad read offset 0x%04x\\n\", (uint32_t)offset);\n\n return 0;\n\n}\n"}} {"sample_id": "a2db2a1edd06a50b8a862c654cf993368cf9f1d9_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n }\n \n xen_be_printf(xendev, 2, \"bind evtchn port %d\\n\", xendev->local_port);\n+\n+ qemu_set_fd_handler(xc_evtchn_fd(xendev->evtchndev),\n+\n+ xen_be_evtchn_event, NULL, xendev);\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int xen_be_bind_evtchn(struct XenDevice *xendev)\n\n{\n\n if (xendev->local_port != -1) {\n\n return 0;\n\n }\n\n xendev->local_port = xc_evtchn_bind_interdomain\n\n (xendev->evtchndev, xendev->dom, xendev->remote_port);\n\n if (xendev->local_port == -1) {\n\n xen_be_printf(xendev, 0, \"xc_evtchn_bind_interdomain failed\\n\");\n\n return -1;\n\n }\n\n xen_be_printf(xendev, 2, \"bind evtchn port %d\\n\", xendev->local_port);\n\n qemu_set_fd_handler(xc_evtchn_fd(xendev->evtchndev),\n\n xen_be_evtchn_event, NULL, xendev);\n\n return 0;\n\n}\n"}} {"sample_id": "ee951a37d8873bff7aa58e23222dfd984111b6cb_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n if (isabus->assigned & (1 << isairq)) {\n \n hw_error(\"isa irq %d already assigned\", isairq);\n+\n+ }\n+\n+ isabus->assigned |= (1 << isairq);\n+\n return isabus->irqs[isairq];\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "qemu_irq isa_reserve_irq(int isairq)\n\n{\n\n if (isairq < 0 || isairq > 15) {\n\n hw_error(\"isa irq %d invalid\", isairq);\n\n }\n\n if (isabus->assigned & (1 << isairq)) {\n\n hw_error(\"isa irq %d already assigned\", isairq);\n\n }\n\n isabus->assigned |= (1 << isairq);\n\n return isabus->irqs[isairq];\n\n}\n"}} {"sample_id": "973945804d95878375b487c0c5c9b2556c5e4543_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n int i;\n \n+ uint32_t col;\n+\n+\n+\n+ if (!(addr & 4)) {\n \n s->tmpblit = val;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void tcx_stip_writel(void *opaque, hwaddr addr,\n\n uint64_t val, unsigned size)\n\n{\n\n TCXState *s = opaque;\n\n int i;\n\n uint32_t col;\n\n\n\n if (!(addr & 4)) {\n\n s->tmpblit = val;\n\n } else {\n\n addr = (addr >> 3) & 0xfffff;\n\n col = cpu_to_be32(s->tmpblit);\n\n if (s->depth == 24) {\n\n for (i = 0; i < 32; i++) {\n\n if (val & 0x80000000) {\n\n s->vram[addr + i] = s->tmpblit;\n\n s->vram24[addr + i] = col;\n\n }\n\n val <<= 1;\n\n }\n\n } else {\n\n for (i = 0; i < 32; i++) {\n\n if (val & 0x80000000) {\n\n s->vram[addr + i] = s->tmpblit;\n\n }\n\n val <<= 1;\n\n }\n\n }\n\n memory_region_set_dirty(&s->vram_mem, addr, 32);\n\n }\n\n}\n"}} {"sample_id": "b0cd14fb1dab4b044f7fe6b53ac635409849de77_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static enum AVHWDeviceType hw_device_match_type_by_hwaccel(enum HWAccelID hwaccel_id)\n+\n+{\n+\n+ int i;\n \n if (hwaccel_id == HWACCEL_NONE)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static enum AVHWDeviceType hw_device_match_type_by_hwaccel(enum HWAccelID hwaccel_id)\n\n{\n\n int i;\n\n if (hwaccel_id == HWACCEL_NONE)\n\n return AV_HWDEVICE_TYPE_NONE;\n\n for (i = 0; hwaccels[i].name; i++) {\n\n if (hwaccels[i].id == hwaccel_id)\n\n return hwaccels[i].device_type;\n\n }\n\n return AV_HWDEVICE_TYPE_NONE;\n\n}\n"}} {"sample_id": "2a8e7499093cd33a607ebd7c1cd591169aa68a3e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void error_mem_write(void *opaque, hwaddr addr,\n+\n uint64_t value, unsigned size)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void error_mem_write(void *opaque, hwaddr addr,\n\n uint64_t value, unsigned size)\n\n{\n\n abort();\n\n}\n"}} {"sample_id": "3df9caf88f5c0859ae380101fea47609ba1dbfbd_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n \n \n+ DPRINTF(\"Cancel tag=0x%x\\n\", req->tag);\n+\n+ if (r->req.aiocb) {\n+\n+ bdrv_aio_cancel(r->req.aiocb);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void scsi_cancel_io(SCSIRequest *req)\n\n{\n\n SCSIDiskReq *r = DO_UPCAST(SCSIDiskReq, req, req);\n\n\n\n DPRINTF(\"Cancel tag=0x%x\\n\", req->tag);\n\n if (r->req.aiocb) {\n\n bdrv_aio_cancel(r->req.aiocb);\n\n\n\n /* This reference was left in by scsi_*_data. We take ownership of\n\n * it the moment scsi_req_cancel is called, independent of whether\n\n * bdrv_aio_cancel completes the request or not. */\n\n scsi_req_unref(&r->req);\n\n }\n\n r->req.aiocb = NULL;\n\n}\n"}} {"sample_id": "77cb0f5aafc8e6d0c6d3c339f381c9b7921648e0_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static void adb_mouse_event(void *opaque,\n+\n+ int dx1, int dy1, int dz1, int buttons_state)\n+\n+{\n+\n MouseState *s = opaque;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void adb_mouse_event(void *opaque,\n\n int dx1, int dy1, int dz1, int buttons_state)\n\n{\n\n MouseState *s = opaque;\n\n\n\n s->dx += dx1;\n\n s->dy += dy1;\n\n s->dz += dz1;\n\n s->buttons_state = buttons_state;\n\n}\n"}} {"sample_id": "eb8a1a1cbda15d776d6d505f14f61c7852f6a51a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n bkt.max = 15;\n bkt.level = 1.5;\n /* leak an op work of time */\n+ throttle_leak_bucket(&bkt, NANOSECONDS_PER_SECOND / 150);\n+ g_assert(bkt.avg == 150);\n+ g_assert(bkt.max == 15);\n+ g_assert(double_cmp(bkt.level, 0.5));\n+ /* leak again emptying the bucket */\n throttle_leak_bucket(&bkt, NANOSECONDS_PER_SECOND / 150);\n g_assert(bkt.avg == 150);\n g_assert(bkt.max == 15);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_leak_bucket(void)\n{\n throttle_config_init(&cfg);\n bkt = cfg.buckets[THROTTLE_BPS_TOTAL];\n /* set initial value */\n bkt.avg = 150;\n bkt.max = 15;\n bkt.level = 1.5;\n /* leak an op work of time */\n throttle_leak_bucket(&bkt, NANOSECONDS_PER_SECOND / 150);\n g_assert(bkt.avg == 150);\n g_assert(bkt.max == 15);\n g_assert(double_cmp(bkt.level, 0.5));\n /* leak again emptying the bucket */\n throttle_leak_bucket(&bkt, NANOSECONDS_PER_SECOND / 150);\n g_assert(bkt.avg == 150);\n g_assert(bkt.max == 15);\n g_assert(double_cmp(bkt.level, 0));\n /* check that the bucket level won't go lower */\n throttle_leak_bucket(&bkt, NANOSECONDS_PER_SECOND / 150);\n g_assert(bkt.avg == 150);\n g_assert(bkt.max == 15);\n g_assert(double_cmp(bkt.level, 0));\n}"}} {"sample_id": "32c3047cac9294bb56d23c89a40a22409db5cc70_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int smc_decode_init(AVCodecContext *avctx)\n+\n+{\n+\n+ SmcContext *s = avctx->priv_data;\n+\n \n \n s->avctx = avctx;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int smc_decode_init(AVCodecContext *avctx)\n\n{\n\n SmcContext *s = avctx->priv_data;\n\n\n\n s->avctx = avctx;\n\n avctx->pix_fmt = PIX_FMT_PAL8;\n\n dsputil_init(&s->dsp, avctx);\n\n\n\n s->frame.data[0] = NULL;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "f19af812a32c1398d48c3550d11dbc6aafbb2bfc_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,28 +1,28 @@\n static void adx_decode(short *out,const unsigned char *in,PREV *prev)\n+\n+{\n+\n+\tint scale = ((in[0]<<8)|(in[1]));\n+\n+\tint i;\n+\n+\tint s0,s1,s2,d;\n+\n+\n+\n+//\tprintf(\"%x \",scale);\n+\n+\n \n+\tin+=2;\n \n \ts1 = prev->s1;\n \n \ts2 = prev->s2;\n \n \tfor(i=0;i<16;i++) {\n+\n+\t\td = in[i];\n \n \t\t// d>>=4; if (d&8) d-=16;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void adx_decode(short *out,const unsigned char *in,PREV *prev)\n\n{\n\n\tint scale = ((in[0]<<8)|(in[1]));\n\n\tint i;\n\n\tint s0,s1,s2,d;\n\n\n\n//\tprintf(\"%x \",scale);\n\n\n\n\tin+=2;\n\n\ts1 = prev->s1;\n\n\ts2 = prev->s2;\n\n\tfor(i=0;i<16;i++) {\n\n\t\td = in[i];\n\n\t\t// d>>=4; if (d&8) d-=16;\n\n\t\td = ((signed char)d >> 4);\n\n\t\ts0 = (BASEVOL*d*scale + SCALE1*s1 - SCALE2*s2)>>14;\n\n\t\tCLIP(s0);\n\n\t\t*out++=s0;\n\n\t\ts2 = s1;\n\n\t\ts1 = s0;\n\n\n\n\t\td = in[i];\n\n\t\t//d&=15; if (d&8) d-=16;\n\n\t\td = ((signed char)(d<<4) >> 4);\n\n\t\ts0 = (BASEVOL*d*scale + SCALE1*s1 - SCALE2*s2)>>14;\n\n\t\tCLIP(s0);\n\n\t\t*out++=s0;\n\n\t\ts2 = s1;\n\n\t\ts1 = s0;\n\n\t}\n\n\tprev->s1 = s1;\n\n\tprev->s2 = s2;\n\n\n\n}\n"}} {"sample_id": "326b9e98a391d542cc33c4c91782ff4ba51edfc5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n float64 float64_scalbn( float64 a, int n STATUS_PARAM )\n \n+{\n \n flag aSign;\n \n int16 aExp;\n \n+ uint64_t aSig;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "float64 float64_scalbn( float64 a, int n STATUS_PARAM )\n\n{\n\n flag aSign;\n\n int16 aExp;\n\n uint64_t aSig;\n\n\n\n a = float64_squash_input_denormal(a STATUS_VAR);\n\n aSig = extractFloat64Frac( a );\n\n aExp = extractFloat64Exp( a );\n\n aSign = extractFloat64Sign( a );\n\n\n\n if ( aExp == 0x7FF ) {\n\n return a;\n\n }\n\n if ( aExp != 0 )\n\n aSig |= LIT64( 0x0010000000000000 );\n\n else if ( aSig == 0 )\n\n return a;\n\n\n\n aExp += n - 1;\n\n aSig <<= 10;\n\n return normalizeRoundAndPackFloat64( aSign, aExp, aSig STATUS_VAR );\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_93", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void put_buffer(QEMUFile *f, void *pv, size_t size)\n \n {\n+\n+ uint8_t *v = pv;\n \n qemu_put_buffer(f, v, size);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void put_buffer(QEMUFile *f, void *pv, size_t size)\n\n{\n\n uint8_t *v = pv;\n\n qemu_put_buffer(f, v, size);\n\n}\n"}} {"sample_id": "d045c466d9e62b4321fadf586d024d54ddfd8bd4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ IscsiLun *iscsilun = opaque;\n+\n+\n+\n+ aio_context_acquire(iscsilun->aio_context);\n \n if (iscsi_get_nops_in_flight(iscsilun->iscsi) >= MAX_NOP_FAILURES) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void iscsi_nop_timed_event(void *opaque)\n\n{\n\n IscsiLun *iscsilun = opaque;\n\n\n\n aio_context_acquire(iscsilun->aio_context);\n\n if (iscsi_get_nops_in_flight(iscsilun->iscsi) >= MAX_NOP_FAILURES) {\n\n error_report(\"iSCSI: NOP timeout. Reconnecting...\");\n\n iscsilun->request_timed_out = true;\n\n } else if (iscsi_nop_out_async(iscsilun->iscsi, NULL, NULL, 0, NULL) != 0) {\n\n error_report(\"iSCSI: failed to sent NOP-Out. Disabling NOP messages.\");\n\n goto out;\n\n }\n\n\n\n timer_mod(iscsilun->nop_timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME) + NOP_INTERVAL);\n\n iscsi_set_events(iscsilun);\n\n\n\nout:\n\n aio_context_release(iscsilun->aio_context);\n\n}\n"}} {"sample_id": "f04db28b86654d1c7ff805b40eff27bba6b0f686", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static block_number_t eckd_block_num(BootMapPointer *p)\n+\n+{\n+\n+ const uint64_t sectors = virtio_get_sectors();\n+\n const uint64_t heads = virtio_get_heads();\n \n const uint64_t cylinder = p->eckd.cylinder", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static block_number_t eckd_block_num(BootMapPointer *p)\n\n{\n\n const uint64_t sectors = virtio_get_sectors();\n\n const uint64_t heads = virtio_get_heads();\n\n const uint64_t cylinder = p->eckd.cylinder\n\n + ((p->eckd.head & 0xfff0) << 12);\n\n const uint64_t head = p->eckd.head & 0x000f;\n\n const block_number_t block = sectors * heads * cylinder\n\n + sectors * head\n\n + p->eckd.sector\n\n - 1; /* block nr starts with zero */\n\n return block;\n\n}\n"}} {"sample_id": "185698715dfb18c82ad2a5dbc169908602d43e81_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static inline uint32_t efsctui(uint32_t val)\n+\n+{\n+\n+ CPU_FloatU u;\n+\n \n \n u.l = val;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline uint32_t efsctui(uint32_t val)\n\n{\n\n CPU_FloatU u;\n\n\n\n u.l = val;\n\n /* NaN are not treated the same way IEEE 754 does */\n\n if (unlikely(float32_is_nan(u.f)))\n\n return 0;\n\n\n\n return float32_to_uint32(u.f, &env->vec_status);\n\n}\n"}} {"sample_id": "a646836784a0fc50fee6f9a0d3fb968289714128", "diff": "--- a/source.c\n+++ b/source.c\n@@ -41,11 +41,11 @@\n }\n \n s->create_type = g_strdup(ct);\n+\n+ s->desc_offset = 0;\n+\n+ ret = vmdk_parse_extents(buf, bs, bs->file->exact_filename, errp);\n+\n exit:\n \n return ret;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int vmdk_open_desc_file(BlockDriverState *bs, int flags, char *buf,\n\n Error **errp)\n\n{\n\n int ret;\n\n char ct[128];\n\n BDRVVmdkState *s = bs->opaque;\n\n\n\n if (vmdk_parse_description(buf, \"createType\", ct, sizeof(ct))) {\n\n error_setg(errp, \"invalid VMDK image descriptor\");\n\n ret = -EINVAL;\n\n goto exit;\n\n }\n\n if (strcmp(ct, \"monolithicFlat\") &&\n\n strcmp(ct, \"vmfs\") &&\n\n strcmp(ct, \"vmfsSparse\") &&\n\n strcmp(ct, \"twoGbMaxExtentSparse\") &&\n\n strcmp(ct, \"twoGbMaxExtentFlat\")) {\n\n error_setg(errp, \"Unsupported image type '%s'\", ct);\n\n ret = -ENOTSUP;\n\n goto exit;\n\n }\n\n s->create_type = g_strdup(ct);\n\n s->desc_offset = 0;\n\n ret = vmdk_parse_extents(buf, bs, bs->file->exact_filename, errp);\n\nexit:\n\n return ret;\n\n}\n"}} {"sample_id": "446f16a6906e9d05aa9ce0dde727d4f731a89298", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n+static XICSState *xics_system_init(int nr_servers, int nr_irqs)\n \n {\n+\n+ XICSState *icp = NULL;\n+\n \n+\n if (kvm_enabled()) {\n \n+ QemuOpts *machine_opts = qemu_get_machine_opts();\n \n bool irqchip_allowed = qemu_opt_get_bool(machine_opts,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static XICSState *xics_system_init(int nr_servers, int nr_irqs)\n\n{\n\n XICSState *icp = NULL;\n\n\n\n if (kvm_enabled()) {\n\n QemuOpts *machine_opts = qemu_get_machine_opts();\n\n bool irqchip_allowed = qemu_opt_get_bool(machine_opts,\n\n \"kernel_irqchip\", true);\n\n bool irqchip_required = qemu_opt_get_bool(machine_opts,\n\n \"kernel_irqchip\", false);\n\n Error *err = NULL;\n\n\n\n if (irqchip_allowed) {\n\n icp = try_create_xics(TYPE_KVM_XICS, nr_servers, nr_irqs, &err);\n\n }\n\n if (irqchip_required && !icp) {\n\n error_report(\"kernel_irqchip requested but unavailable: %s\",\n\n error_get_pretty(err));\n\n }\n\n }\n\n\n\n if (!icp) {\n\n icp = try_create_xics(TYPE_XICS, nr_servers, nr_irqs, &error_abort);\n\n }\n\n\n\n return icp;\n\n}\n"}} {"sample_id": "8b714d3747e6870db85dd9382adb8ee371633092", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,8 +5,8 @@\n {\n \n QmpInputVisitor *qiv = to_qiv(v);\n+\n+ const QObject *qobj = qmp_input_get_object(qiv, name);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void qmp_input_start_struct(Visitor *v, void **obj, const char *kind,\n\n const char *name, size_t size, Error **errp)\n\n{\n\n QmpInputVisitor *qiv = to_qiv(v);\n\n const QObject *qobj = qmp_input_get_object(qiv, name);\n\n\n\n if (!qobj || qobject_type(qobj) != QTYPE_QDICT) {\n\n error_set(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : \"null\",\n\n \"QDict\");\n\n return;\n\n }\n\n\n\n qmp_input_push(qiv, qobj, errp);\n\n if (error_is_set(errp)) {\n\n return;\n\n }\n\n\n\n if (obj) {\n\n *obj = g_malloc0(size);\n\n }\n\n}\n"}} {"sample_id": "2f9606b3736c3be4dbd606c46525c7b770ced119_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void buffer_append(Buffer *buffer, const void *data, size_t len)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void buffer_append(Buffer *buffer, const void *data, size_t len)\n\n{\n\n memcpy(buffer->buffer + buffer->offset, data, len);\n\n buffer->offset += len;\n\n}\n"}} {"sample_id": "bd269ebc82fbaa5fe7ce5bc7c1770ac8acecd884_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n QIOTask *task;\n \n struct QIODNSResolverLookupData *data =\n+\n+ g_new0(struct QIODNSResolverLookupData, 1);\n+\n+\n+\n data->addr = QAPI_CLONE(SocketAddressLegacy, addr);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qio_dns_resolver_lookup_async(QIODNSResolver *resolver,\n\n SocketAddressLegacy *addr,\n\n QIOTaskFunc func,\n\n gpointer opaque,\n\n GDestroyNotify notify)\n\n{\n\n QIOTask *task;\n\n struct QIODNSResolverLookupData *data =\n\n g_new0(struct QIODNSResolverLookupData, 1);\n\n\n\n data->addr = QAPI_CLONE(SocketAddressLegacy, addr);\n\n\n\n task = qio_task_new(OBJECT(resolver), func, opaque, notify);\n\n\n\n qio_task_run_in_thread(task,\n\n qio_dns_resolver_lookup_worker,\n\n data,\n\n qio_dns_resolver_lookup_data_free);\n\n}\n"}} {"sample_id": "c1568af597d71b2171c9b2ffffb336c2fdee205e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static int v9fs_do_open2(V9fsState *s, V9fsCreateState *vs)\n+\n+{\n+\n+ FsCred cred;\n \n int flags;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int v9fs_do_open2(V9fsState *s, V9fsCreateState *vs)\n\n{\n\n FsCred cred;\n\n int flags;\n\n\n\n cred_init(&cred);\n\n cred.fc_uid = vs->fidp->uid;\n\n cred.fc_mode = vs->perm & 0777;\n\n flags = omode_to_uflags(vs->mode) | O_CREAT;\n\n\n\n return s->ops->open2(&s->ctx, vs->fullname.data, flags, &cred);\n\n}\n"}} {"sample_id": "d7b7e580096255c766f7b1e7502a9151b95091e8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n QPCIDevice *dev;\n uint16_t bmdma_base;\n+ uintptr_t guest_prdt;\n+ size_t len;\n+ bool from_dev;\n+ uint8_t status;\n+ int flags;\n dev = get_pci_device(&bmdma_base);\n flags = cmd & ~0xff;\n cmd &= 0xff;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int send_dma_request(int cmd, uint64_t sector, int nb_sectors,\n PrdtEntry *prdt, int prdt_entries)\n{\n QPCIDevice *dev;\n uint16_t bmdma_base;\n uintptr_t guest_prdt;\n size_t len;\n bool from_dev;\n uint8_t status;\n int flags;\n dev = get_pci_device(&bmdma_base);\n flags = cmd & ~0xff;\n cmd &= 0xff;\n switch (cmd) {\n case CMD_READ_DMA:\n from_dev = true;\n break;\n case CMD_WRITE_DMA:\n from_dev = false;\n break;\n default:\n g_assert_not_reached();\n /* Select device 0 */\n outb(IDE_BASE + reg_device, 0 | LBA);\n /* Stop any running transfer, clear any pending interrupt */\n outb(bmdma_base + bmreg_cmd, 0);\n outb(bmdma_base + bmreg_status, BM_STS_INTR);\n /* Setup PRDT */\n len = sizeof(*prdt) * prdt_entries;\n guest_prdt = guest_alloc(guest_malloc, len);\n memwrite(guest_prdt, prdt, len);\n outl(bmdma_base + bmreg_prdt, guest_prdt);\n /* ATA DMA command */\n outb(IDE_BASE + reg_nsectors, nb_sectors);\n outb(IDE_BASE + reg_lba_low, sector & 0xff);\n outb(IDE_BASE + reg_lba_middle, (sector >> 8) & 0xff);\n outb(IDE_BASE + reg_lba_high, (sector >> 16) & 0xff);\n outb(IDE_BASE + reg_command, cmd);\n /* Start DMA transfer */\n outb(bmdma_base + bmreg_cmd, BM_CMD_START | (from_dev ? BM_CMD_WRITE : 0));\n if (flags & CMDF_ABORT) {\n outb(bmdma_base + bmreg_cmd, 0);\n /* Wait for the DMA transfer to complete */\n do {\n status = inb(bmdma_base + bmreg_status);\n } while ((status & (BM_STS_ACTIVE | BM_STS_INTR)) == BM_STS_ACTIVE);\n g_assert_cmpint(get_irq(IDE_PRIMARY_IRQ), ==, !!(status & BM_STS_INTR));\n /* Check IDE status code */\n assert_bit_set(inb(IDE_BASE + reg_status), DRDY);\n assert_bit_clear(inb(IDE_BASE + reg_status), BSY | DRQ);\n /* Reading the status register clears the IRQ */\n g_assert(!get_irq(IDE_PRIMARY_IRQ));\n /* Stop DMA transfer if still active */\n if (status & BM_STS_ACTIVE) {\n outb(bmdma_base + bmreg_cmd, 0);\n free_pci_device(dev);\n return status;"}} {"sample_id": "4e2e4e6355959a1af011167b0db5ac7ffd3adf94_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n s->max_gsi = gsi_bits;\n \n \n+\n+ /* Mark any over-allocated bits as already in use */\n+\n+ for (i = gsi_count; i < gsi_bits; i++) {\n+\n set_gsi(s, i);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void kvm_init_irq_routing(KVMState *s)\n\n{\n\n int gsi_count;\n\n\n\n gsi_count = kvm_check_extension(s, KVM_CAP_IRQ_ROUTING);\n\n if (gsi_count > 0) {\n\n unsigned int gsi_bits, i;\n\n\n\n /* Round up so we can search ints using ffs */\n\n gsi_bits = ALIGN(gsi_count, 32);\n\n s->used_gsi_bitmap = g_malloc0(gsi_bits / 8);\n\n s->max_gsi = gsi_bits;\n\n\n\n /* Mark any over-allocated bits as already in use */\n\n for (i = gsi_count; i < gsi_bits; i++) {\n\n set_gsi(s, i);\n\n }\n\n }\n\n\n\n s->irq_routes = g_malloc0(sizeof(*s->irq_routes));\n\n s->nr_allocated_irq_routes = 0;\n\n\n\n kvm_arch_init_irq_routing(s);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_77", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n \n \n+ default:\n+\n+ error_report(\"milkymist_softusb: read access to unknown register 0x\"\n+\n+ TARGET_FMT_plx, addr << 2);\n \n break;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t softusb_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n MilkymistSoftUsbState *s = opaque;\n\n uint32_t r = 0;\n\n\n\n addr >>= 2;\n\n switch (addr) {\n\n case R_CTRL:\n\n r = s->regs[addr];\n\n break;\n\n\n\n default:\n\n error_report(\"milkymist_softusb: read access to unknown register 0x\"\n\n TARGET_FMT_plx, addr << 2);\n\n break;\n\n }\n\n\n\n trace_milkymist_softusb_memory_read(addr << 2, r);\n\n\n\n return r;\n\n}\n"}} {"sample_id": "364889cf9c1f3c5e816a30d30d714a84765cfc29", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n int sws_getColorspaceDetails(SwsContext *c, int **inv_table, int *srcRange, int **table, int *dstRange, int *brightness, int *contrast, int *saturation)\n+\n {\n \n if (isYUV(c->dstFormat) || isGray(c->dstFormat)) return -1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int sws_getColorspaceDetails(SwsContext *c, int **inv_table, int *srcRange, int **table, int *dstRange, int *brightness, int *contrast, int *saturation)\n\n{\n\n if (isYUV(c->dstFormat) || isGray(c->dstFormat)) return -1;\n\n\n\n *inv_table = c->srcColorspaceTable;\n\n *table = c->dstColorspaceTable;\n\n *srcRange = c->srcRange;\n\n *dstRange = c->dstRange;\n\n *brightness= c->brightness;\n\n *contrast = c->contrast;\n\n *saturation= c->saturation;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n \n \n+ /* reset dma provider too */\n+\n+ if (bus->dma->ops->reset) {\n+\n+ bus->dma->ops->reset(bus->dma);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ide_bus_reset(IDEBus *bus)\n\n{\n\n bus->unit = 0;\n\n bus->cmd = 0;\n\n ide_reset(&bus->ifs[0]);\n\n ide_reset(&bus->ifs[1]);\n\n ide_clear_hob(bus);\n\n\n\n /* pending async DMA */\n\n if (bus->dma->aiocb) {\n\n#ifdef DEBUG_AIO\n\n printf(\"aio_cancel\\n\");\n\n#endif\n\n bdrv_aio_cancel(bus->dma->aiocb);\n\n bus->dma->aiocb = NULL;\n\n }\n\n\n\n /* reset dma provider too */\n\n if (bus->dma->ops->reset) {\n\n bus->dma->ops->reset(bus->dma);\n\n }\n\n}\n"}} {"sample_id": "9ed5726c043958359b0f1fa44ab3e4f25f9d9a47_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+target_ulong helper_dmt(target_ulong arg1)\n+\n+{\n \n // TODO\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "target_ulong helper_dmt(target_ulong arg1)\n\n{\n\n // TODO\n\n arg1 = 0;\n\n // rt = arg1\n\n\n\n return arg1;\n\n}\n"}} {"sample_id": "d8b2239bcd8872a5c5f7534d1658fc2365caab2d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n cpu_restore_state_from_tb(cpu, tb, retaddr);\n if (tb->cflags & CF_NOCACHE) {\n /* one-shot translation, invalidate it immediately */\n+ tb_phys_invalidate(tb, -1);\n+ tb_free(tb);\n+ r = true;\n tb_unlock();", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "bool cpu_restore_state(CPUState *cpu, uintptr_t retaddr)\n{\n TranslationBlock *tb;\n bool r = false;\n tb_lock();\n tb = tb_find_pc(retaddr);\n if (tb) {\n cpu_restore_state_from_tb(cpu, tb, retaddr);\n if (tb->cflags & CF_NOCACHE) {\n /* one-shot translation, invalidate it immediately */\n tb_phys_invalidate(tb, -1);\n tb_free(tb);\n r = true;\n tb_unlock();"}} {"sample_id": "882b3b97697affb36ca3d174f42f846232008979_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ SubchSet *set;\n \n uint8_t real_cssid;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "bool css_schid_final(int m, uint8_t cssid, uint8_t ssid, uint16_t schid)\n\n{\n\n SubchSet *set;\n\n uint8_t real_cssid;\n\n\n\n real_cssid = (!m && (cssid == 0)) ? channel_subsys.default_cssid : cssid;\n\n if (real_cssid > MAX_CSSID || ssid > MAX_SSID ||\n\n !channel_subsys.css[real_cssid] ||\n\n !channel_subsys.css[real_cssid]->sch_set[ssid]) {\n\n return true;\n\n }\n\n set = channel_subsys.css[real_cssid]->sch_set[ssid];\n\n return schid > find_last_bit(set->schids_used,\n\n (MAX_SCHID + 1) / sizeof(unsigned long));\n\n}\n"}} {"sample_id": "2975725f6b3d634dbe924ea9d9f4d86b8a5b217d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -44,11 +44,11 @@\n \n if (ret != 0) {\n \n+ return ret;\n+\n+ }\n+\n+ ret = qemu_file_get_error(f);\n \n if (ret != 0) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_savevm_state_iterate(Monitor *mon, QEMUFile *f)\n\n{\n\n SaveStateEntry *se;\n\n int ret = 1;\n\n\n\n QTAILQ_FOREACH(se, &savevm_handlers, entry) {\n\n if (se->save_live_state == NULL)\n\n continue;\n\n\n\n /* Section type */\n\n qemu_put_byte(f, QEMU_VM_SECTION_PART);\n\n qemu_put_be32(f, se->section_id);\n\n\n\n ret = se->save_live_state(mon, f, QEMU_VM_SECTION_PART, se->opaque);\n\n if (!ret) {\n\n /* Do not proceed to the next vmstate before this one reported\n\n completion of the current stage. This serializes the migration\n\n and reduces the probability that a faster changing state is\n\n synchronized over and over again. */\n\n break;\n\n }\n\n }\n\n if (ret != 0) {\n\n return ret;\n\n }\n\n ret = qemu_file_get_error(f);\n\n if (ret != 0) {\n\n qemu_savevm_state_cancel(mon, f);\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "3acace1333d6b75628fe6e6786ad3cd2db766f0e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n EBX = 0x756e6547;\n \n ECX = 0x6c65746e;\n+\n+ EDX = 0x49656e69;\n+\n+ } else {\n+\n /* EAX = 1 info */\n \n EAX = 0x52b;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void helper_cpuid(void)\n\n{\n\n if (EAX == 0) {\n\n EAX = 1; /* max EAX index supported */\n\n EBX = 0x756e6547;\n\n ECX = 0x6c65746e;\n\n EDX = 0x49656e69;\n\n } else {\n\n /* EAX = 1 info */\n\n EAX = 0x52b;\n\n EBX = 0;\n\n ECX = 0;\n\n EDX = CPUID_FP87 | CPUID_VME | CPUID_DE | CPUID_PSE |\n\n CPUID_TSC | CPUID_MSR | CPUID_MCE |\n\n CPUID_CX8;\n\n }\n\n}\n"}} {"sample_id": "d6604b29ef544793479d7fb4e05ef6622bb3e534_25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n av_frame_free(&avctx->coded_frame);\n \n+ av_freep(&s->scratch);\n+\n+\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int ljpeg_encode_close(AVCodecContext *avctx)\n\n{\n\n LJpegEncContext *s = avctx->priv_data;\n\n\n\n av_frame_free(&avctx->coded_frame);\n\n av_freep(&s->scratch);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "323ad19bcc601d3ec9cb6f0f5b4d67b602fc519e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void ppc_cpu_unrealizefn(DeviceState *dev, Error **errp)\n \n {\n+\n+ PowerPCCPU *cpu = POWERPC_CPU(dev);\n \n CPUPPCState *env = &cpu->env;\n \n@@ -11,8 +11,8 @@\n int i, j;\n \n \n+\n+ cpu_exec_exit(CPU(dev));\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void ppc_cpu_unrealizefn(DeviceState *dev, Error **errp)\n\n{\n\n PowerPCCPU *cpu = POWERPC_CPU(dev);\n\n CPUPPCState *env = &cpu->env;\n\n opc_handler_t **table;\n\n int i, j;\n\n\n\n cpu_exec_exit(CPU(dev));\n\n\n\n for (i = 0; i < PPC_CPU_OPCODES_LEN; i++) {\n\n if (env->opcodes[i] == &invalid_handler) {\n\n continue;\n\n }\n\n if (is_indirect_opcode(env->opcodes[i])) {\n\n table = ind_table(env->opcodes[i]);\n\n for (j = 0; j < PPC_CPU_INDIRECT_OPCODES_LEN; j++) {\n\n if (table[j] != &invalid_handler &&\n\n is_indirect_opcode(table[j])) {\n\n g_free((opc_handler_t *)((uintptr_t)table[j] &\n\n ~PPC_INDIRECT));\n\n }\n\n }\n\n g_free((opc_handler_t *)((uintptr_t)env->opcodes[i] &\n\n ~PPC_INDIRECT));\n\n }\n\n }\n\n}\n"}} {"sample_id": "498f21405a286f718a0767c791b7d2db19f4e5bd_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,10 +16,10 @@\n \n }\n \n+\n+\n+ QLIST_INSERT_HEAD(&s->inflight_aiocb_head, aiocb, aiocb_siblings);\n+\n+ return false;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool check_overwrapping_aiocb(BDRVSheepdogState *s, SheepdogAIOCB *aiocb)\n\n{\n\n SheepdogAIOCB *cb;\n\n\n\n QLIST_FOREACH(cb, &s->inflight_aiocb_head, aiocb_siblings) {\n\n if (AIOCBOverwrapping(aiocb, cb)) {\n\n return true;\n\n }\n\n }\n\n\n\n QLIST_INSERT_HEAD(&s->inflight_aiocb_head, aiocb, aiocb_siblings);\n\n return false;\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_21", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void bdrv_aio_bh_cb(void *opaque)\n \n+{\n+\n+ BlockAIOCBSync *acb = opaque;\n+\n+\n \n if (!acb->is_write && acb->ret >= 0) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bdrv_aio_bh_cb(void *opaque)\n\n{\n\n BlockAIOCBSync *acb = opaque;\n\n\n\n if (!acb->is_write && acb->ret >= 0) {\n\n qemu_iovec_from_buf(acb->qiov, 0, acb->bounce, acb->qiov->size);\n\n }\n\n qemu_vfree(acb->bounce);\n\n acb->common.cb(acb->common.opaque, acb->ret);\n\n qemu_bh_delete(acb->bh);\n\n acb->bh = NULL;\n\n qemu_aio_unref(acb);\n\n}\n"}} {"sample_id": "1d0817d56b66797118880358ea7d7a2acfdca429", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static float voice_factor(float *p_vector, float p_gain,\n \n float *f_vector, float f_gain,\n+\n CELPMContext *ctx)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static float voice_factor(float *p_vector, float p_gain,\n\n float *f_vector, float f_gain,\n\n CELPMContext *ctx)\n\n{\n\n double p_ener = (double) ctx->dot_productf(p_vector, p_vector,\n\n AMRWB_SFR_SIZE) *\n\n p_gain * p_gain;\n\n double f_ener = (double) ctx->dot_productf(f_vector, f_vector,\n\n AMRWB_SFR_SIZE) *\n\n f_gain * f_gain;\n\n\n\n return (p_ener - f_ener) / (p_ener + f_ener);\n\n}\n"}} {"sample_id": "890241ab6942a0186eaf485dabf266a5a7aac428", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void migrate_check_parameter(QTestState *who, const char *parameter,\n \n+ const char *value)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void migrate_check_parameter(QTestState *who, const char *parameter,\n\n const char *value)\n\n{\n\n QDict *rsp, *rsp_return;\n\n const char *result;\n\n\n\n rsp = wait_command(who, \"{ 'execute': 'query-migrate-parameters' }\");\n\n rsp_return = qdict_get_qdict(rsp, \"return\");\n\n result = g_strdup_printf(\"%\" PRId64,\n\n qdict_get_try_int(rsp_return, parameter, -1));\n\n g_assert_cmpstr(result, ==, value);\n\n QDECREF(rsp);\n\n}\n"}} {"sample_id": "4b1f5e5090abed6c618c8ba380cd7d28d140f867_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n void av_register_input_format(AVInputFormat *format)\n \n {\n+\n+ AVInputFormat **p = &first_iformat;\n+\n+\n \n while (*p != NULL)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void av_register_input_format(AVInputFormat *format)\n\n{\n\n AVInputFormat **p = &first_iformat;\n\n\n\n while (*p != NULL)\n\n p = &(*p)->next;\n\n\n\n *p = format;\n\n format->next = NULL;\n\n}\n"}} {"sample_id": "517ff12c7d000fa1f5b1e989b22fb86a286f9cc2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -60,8 +60,8 @@\n \n qemu_put_be64(f, dev->routes.adapter.ind_offset);\n \n+ qemu_put_byte(f, dev->thinint_isc);\n+\n+ qemu_put_be32(f, dev->revision);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_ccw_save_config(DeviceState *d, QEMUFile *f)\n\n{\n\n VirtioCcwDevice *dev = VIRTIO_CCW_DEVICE(d);\n\n CcwDevice *ccw_dev = CCW_DEVICE(d);\n\n SubchDev *s = ccw_dev->sch;\n\n VirtIODevice *vdev = virtio_ccw_get_vdev(s);\n\n\n\n subch_device_save(s, f);\n\n if (dev->indicators != NULL) {\n\n qemu_put_be32(f, dev->indicators->len);\n\n qemu_put_be64(f, dev->indicators->addr);\n\n } else {\n\n qemu_put_be32(f, 0);\n\n qemu_put_be64(f, 0UL);\n\n }\n\n if (dev->indicators2 != NULL) {\n\n qemu_put_be32(f, dev->indicators2->len);\n\n qemu_put_be64(f, dev->indicators2->addr);\n\n } else {\n\n qemu_put_be32(f, 0);\n\n qemu_put_be64(f, 0UL);\n\n }\n\n if (dev->summary_indicator != NULL) {\n\n qemu_put_be32(f, dev->summary_indicator->len);\n\n qemu_put_be64(f, dev->summary_indicator->addr);\n\n } else {\n\n qemu_put_be32(f, 0);\n\n qemu_put_be64(f, 0UL);\n\n }\n\n qemu_put_be16(f, vdev->config_vector);\n\n qemu_put_be64(f, dev->routes.adapter.ind_offset);\n\n qemu_put_byte(f, dev->thinint_isc);\n\n qemu_put_be32(f, dev->revision);\n\n}\n"}} {"sample_id": "12f8def0e02232d7c6416ad9b66640f973c531d1_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void qemu_mutex_lock(QemuMutex *mutex)\n+\n+{\n+\n EnterCriticalSection(&mutex->lock);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void qemu_mutex_lock(QemuMutex *mutex)\n\n{\n\n EnterCriticalSection(&mutex->lock);\n\n\n\n /* Win32 CRITICAL_SECTIONs are recursive. Assert that we're not\n\n * using them as such.\n\n */\n\n assert(mutex->owner == 0);\n\n mutex->owner = GetCurrentThreadId();\n\n}\n"}} {"sample_id": "becf8217deb2afc347d5172d9f30c8a8964b8b27_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n void s390x_cpu_do_unaligned_access(CPUState *cs, vaddr addr,\n \n MMUAccessType access_type,\n+\n+ int mmu_idx, uintptr_t retaddr)\n+\n+{\n+\n S390CPU *cpu = S390_CPU(cs);\n \n CPUS390XState *env = &cpu->env;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void s390x_cpu_do_unaligned_access(CPUState *cs, vaddr addr,\n\n MMUAccessType access_type,\n\n int mmu_idx, uintptr_t retaddr)\n\n{\n\n S390CPU *cpu = S390_CPU(cs);\n\n CPUS390XState *env = &cpu->env;\n\n\n\n if (retaddr) {\n\n cpu_restore_state(cs, retaddr);\n\n }\n\n program_interrupt(env, PGM_SPECIFICATION, ILEN_LATER);\n\n}\n"}} {"sample_id": "ee9f36a88eb3e2706ea659acb0ca80c414fa5d8a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n url_fseek(bc, nut->packet_size_pos, SEEK_SET);\n \n for(i=get_length(size); i < get_length(nut->written_packet_size); i+=7)\n+\n+ put_byte(bc, 0x80);\n+\n+ put_v(bc, size);\n+\n \n \n url_fseek(bc, cur, SEEK_SET);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int update_packetheader(NUTContext *nut, ByteIOContext *bc, int additional_size){\n\n int64_t start= nut->packet_start;\n\n int64_t cur= url_ftell(bc);\n\n int size= cur - start + additional_size;\n\n \n\n if(size != nut->written_packet_size){\n\n int i;\n\n\n\n assert( size <= nut->written_packet_size );\n\n \n\n url_fseek(bc, nut->packet_size_pos, SEEK_SET);\n\n for(i=get_length(size); i < get_length(nut->written_packet_size); i+=7)\n\n put_byte(bc, 0x80);\n\n put_v(bc, size);\n\n\n\n url_fseek(bc, cur, SEEK_SET);\n\n nut->written_packet_size= size; //FIXME may fail if multiple updates with differing sizes, as get_length may differ\n\n }\n\n \n\n return 0;\n\n}\n"}} {"sample_id": "e3e09d87c6e69c2da684d5aacabe3124ebcb6f8e_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void trigger_page_fault(CPUS390XState *env, target_ulong vaddr,\n+\n+ uint32_t type, uint64_t asc, int rw)\n+\n+{\n \n CPUState *cs = CPU(s390_env_get_cpu(env));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void trigger_page_fault(CPUS390XState *env, target_ulong vaddr,\n\n uint32_t type, uint64_t asc, int rw)\n\n{\n\n CPUState *cs = CPU(s390_env_get_cpu(env));\n\n int ilen = ILEN_LATER;\n\n int bits = trans_bits(env, asc);\n\n\n\n /* Code accesses have an undefined ilc. */\n\n if (rw == 2) {\n\n ilen = 2;\n\n }\n\n\n\n DPRINTF(\"%s: vaddr=%016\" PRIx64 \" bits=%d\\n\", __func__, vaddr, bits);\n\n\n\n stq_phys(cs->as,\n\n env->psa + offsetof(LowCore, trans_exc_code), vaddr | bits);\n\n trigger_pgm_exception(env, type, ilen);\n\n}\n"}} {"sample_id": "05b7a635dc1e5266fb367ce8b0019a0830317879", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n int sample)\n \n+{\n \n /* No need to keep track of smaller samples, since describing them\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void sample_queue_push(HintSampleQueue *queue, uint8_t *data, int size,\n\n int sample)\n\n{\n\n /* No need to keep track of smaller samples, since describing them\n\n * with immediates is more efficient. */\n\n if (size <= 14)\n\n return;\n\n if (!queue->samples || queue->len >= queue->size) {\n\n HintSample *samples;\n\n samples = av_realloc(queue->samples, sizeof(HintSample) * (queue->size + 10));\n\n if (!samples)\n\n return;\n\n queue->size += 10;\n\n queue->samples = samples;\n\n }\n\n queue->samples[queue->len].data = data;\n\n queue->samples[queue->len].size = size;\n\n queue->samples[queue->len].sample_number = sample;\n\n queue->samples[queue->len].offset = 0;\n\n queue->samples[queue->len].own_data = 0;\n\n queue->len++;\n\n}\n"}} {"sample_id": "27af7d6ea5015e5ef1f7985eab94a8a218267a2b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ if (ram_bulk_stage || !migrate_use_xbzrle()) {\n \n return;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void xbzrle_cache_zero_page(ram_addr_t current_addr)\n\n{\n\n if (ram_bulk_stage || !migrate_use_xbzrle()) {\n\n return;\n\n }\n\n\n\n /* We don't care if this fails to allocate a new cache page\n\n * as long as it updated an old one */\n\n cache_insert(XBZRLE.cache, current_addr, ZERO_TARGET_PAGE);\n\n}\n"}} {"sample_id": "9bf3eb2ca542dd9306cb2e72fc68e02ba3e56e2e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -49,11 +49,11 @@\n tcg_gen_brcondi_i32(cond, r_tmp2, 0, l1);\n \n tcg_gen_mov_i32(fp1, fp0);\n+\n+ tcg_temp_free(fp0);\n+\n+ gen_set_label(l1);\n+\n tcg_gen_andi_i32(r_tmp2, r_tmp1, 0x2);\n \n tcg_gen_brcondi_i32(cond, r_tmp2, 0, l2);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_movcf_ps (int fs, int fd, int cc, int tf)\n\n{\n\n int cond;\n\n TCGv r_tmp1 = tcg_temp_local_new(TCG_TYPE_I32);\n\n TCGv r_tmp2 = tcg_temp_local_new(TCG_TYPE_I32);\n\n TCGv fp0 = tcg_temp_local_new(TCG_TYPE_I32);\n\n TCGv fph0 = tcg_temp_local_new(TCG_TYPE_I32);\n\n TCGv fp1 = tcg_temp_local_new(TCG_TYPE_I32);\n\n TCGv fph1 = tcg_temp_local_new(TCG_TYPE_I32);\n\n int l1 = gen_new_label();\n\n int l2 = gen_new_label();\n\n\n\n if (tf)\n\n cond = TCG_COND_EQ;\n\n else\n\n cond = TCG_COND_NE;\n\n\n\n gen_load_fpr32(fp0, fs);\n\n gen_load_fpr32h(fph0, fs);\n\n gen_load_fpr32(fp1, fd);\n\n gen_load_fpr32h(fph1, fd);\n\n get_fp_cond(r_tmp1);\n\n tcg_gen_shri_i32(r_tmp1, r_tmp1, cc);\n\n tcg_gen_andi_i32(r_tmp2, r_tmp1, 0x1);\n\n tcg_gen_brcondi_i32(cond, r_tmp2, 0, l1);\n\n tcg_gen_mov_i32(fp1, fp0);\n\n tcg_temp_free(fp0);\n\n gen_set_label(l1);\n\n tcg_gen_andi_i32(r_tmp2, r_tmp1, 0x2);\n\n tcg_gen_brcondi_i32(cond, r_tmp2, 0, l2);\n\n tcg_gen_mov_i32(fph1, fph0);\n\n tcg_temp_free(fph0);\n\n gen_set_label(l2);\n\n tcg_temp_free(r_tmp1);\n\n tcg_temp_free(r_tmp2);\n\n gen_store_fpr32(fp1, fd);\n\n gen_store_fpr32h(fph1, fd);\n\n tcg_temp_free(fp1);\n\n tcg_temp_free(fph1);\n\n}\n"}} {"sample_id": "692d88b4085559f1254d0e04d64a849ce8ab5932_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n CharDriverState *qemu_chr_alloc(ChardevCommon *backend, Error **errp)\n \n {\n+\n CharDriverState *chr = g_malloc0(sizeof(CharDriverState));\n \n qemu_mutex_init(&chr->chr_write_lock);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "CharDriverState *qemu_chr_alloc(ChardevCommon *backend, Error **errp)\n\n{\n\n CharDriverState *chr = g_malloc0(sizeof(CharDriverState));\n\n qemu_mutex_init(&chr->chr_write_lock);\n\n\n\n chr->mux_idx = -1;\n\n if (backend->has_logfile) {\n\n int flags = O_WRONLY | O_CREAT;\n\n if (backend->has_logappend &&\n\n backend->logappend) {\n\n flags |= O_APPEND;\n\n } else {\n\n flags |= O_TRUNC;\n\n }\n\n chr->logfd = qemu_open(backend->logfile, flags, 0666);\n\n if (chr->logfd < 0) {\n\n error_setg_errno(errp, errno,\n\n \"Unable to open logfile %s\",\n\n backend->logfile);\n\n g_free(chr);\n\n return NULL;\n\n }\n\n } else {\n\n chr->logfd = -1;\n\n }\n\n\n\n return chr;\n\n}\n"}} {"sample_id": "c9a621176e479b8106056ed992fddf34d9d0d206", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n again:\n /* check if we can really output */\n if (!slirp_can_output())\n+ return;\n+\t/*\n+\t * See which queue to get next packet from\n+\t * If there's something in the fastq, select it immediately\n+\t */\n \tif (if_fastq.ifq_next != &if_fastq) {\n \t\tifm = if_fastq.ifq_next;\n \t} else {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-89", "target_file": "source.c", "files": {"source.c": "if_start(void)\n{\n\tstruct mbuf *ifm, *ifqt;\n\tDEBUG_CALL(\"if_start\");\n\tif (if_queued == 0)\n\t return; /* Nothing to do */\n again:\n /* check if we can really output */\n if (!slirp_can_output())\n return;\n\t/*\n\t * See which queue to get next packet from\n\t * If there's something in the fastq, select it immediately\n\t */\n\tif (if_fastq.ifq_next != &if_fastq) {\n\t\tifm = if_fastq.ifq_next;\n\t} else {\n\t\t/* Nothing on fastq, see if next_m is valid */\n\t\tif (next_m != &if_batchq)\n\t\t ifm = next_m;\n\t\telse\n\t\t ifm = if_batchq.ifq_next;\n\t\t/* Set which packet to send on next iteration */\n\t\tnext_m = ifm->ifq_next;\n\t}\n\t/* Remove it from the queue */\n\tifqt = ifm->ifq_prev;\n\tremque(ifm);\n\t--if_queued;\n\t/* If there are more packets for this session, re-queue them */\n\tif (ifm->ifs_next != /* ifm->ifs_prev != */ ifm) {\n\t\tinsque(ifm->ifs_next, ifqt);\n\t\tifs_remque(ifm);\n\t}\n\t/* Update so_queued */\n\tif (ifm->ifq_so) {\n\t\tif (--ifm->ifq_so->so_queued == 0)\n\t\t /* If there's no more queued, reset nqueued */\n\t\t ifm->ifq_so->so_nqueued = 0;\n\t}\n\t/* Encapsulate the packet for sending */\n if_encap(ifm->m_data, ifm->m_len);\n\tif (if_queued)\n\t goto again;\n}"}} {"sample_id": "56943e8cc14b7eeeab67d1942fa5d8bcafe3e53f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n /* share a single thread for all cpus with TCG */\n \n+ if (!tcg_cpu_thread) {\n+\n+ cpu->thread = g_malloc0(sizeof(QemuThread));\n+\n+ cpu->halt_cond = g_malloc0(sizeof(QemuCond));\n \n qemu_cond_init(cpu->halt_cond);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_tcg_init_vcpu(CPUState *cpu)\n\n{\n\n char thread_name[VCPU_THREAD_NAME_SIZE];\n\n static QemuCond *tcg_halt_cond;\n\n static QemuThread *tcg_cpu_thread;\n\n\n\n tcg_cpu_address_space_init(cpu, cpu->as);\n\n\n\n /* share a single thread for all cpus with TCG */\n\n if (!tcg_cpu_thread) {\n\n cpu->thread = g_malloc0(sizeof(QemuThread));\n\n cpu->halt_cond = g_malloc0(sizeof(QemuCond));\n\n qemu_cond_init(cpu->halt_cond);\n\n tcg_halt_cond = cpu->halt_cond;\n\n snprintf(thread_name, VCPU_THREAD_NAME_SIZE, \"CPU %d/TCG\",\n\n cpu->cpu_index);\n\n qemu_thread_create(cpu->thread, thread_name, qemu_tcg_cpu_thread_fn,\n\n cpu, QEMU_THREAD_JOINABLE);\n\n#ifdef _WIN32\n\n cpu->hThread = qemu_thread_get_handle(cpu->thread);\n\n#endif\n\n while (!cpu->created) {\n\n qemu_cond_wait(&qemu_cpu_cond, &qemu_global_mutex);\n\n }\n\n tcg_cpu_thread = cpu->thread;\n\n } else {\n\n cpu->thread = tcg_cpu_thread;\n\n cpu->halt_cond = tcg_halt_cond;\n\n }\n\n}\n"}} {"sample_id": "45a50b1668822c23afc2a89f724654e176518bc4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n RomResetData *rrd = _rrd;\n \n \n+\n+ cpu_physical_memory_write_rom(rrd->addr, rrd->data, rrd->size);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void option_rom_reset(void *_rrd)\n\n{\n\n RomResetData *rrd = _rrd;\n\n\n\n cpu_physical_memory_write_rom(rrd->addr, rrd->data, rrd->size);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_285", "diff": "--- a/source.c\n+++ b/source.c\n@@ -56,11 +56,11 @@\n \n case 0x150: return s->rfsr;\n \n+ case 0x180: return s->erdsr;\n+\n+ case 0x184: return s->etdsr;\n+\n+ case 0x188: return s->emrbr;\n \n default:\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t mcf_fec_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n mcf_fec_state *s = (mcf_fec_state *)opaque;\n\n switch (addr & 0x3ff) {\n\n case 0x004: return s->eir;\n\n case 0x008: return s->eimr;\n\n case 0x010: return s->rx_enabled ? (1 << 24) : 0; /* RDAR */\n\n case 0x014: return 0; /* TDAR */\n\n case 0x024: return s->ecr;\n\n case 0x040: return s->mmfr;\n\n case 0x044: return s->mscr;\n\n case 0x064: return 0; /* MIBC */\n\n case 0x084: return s->rcr;\n\n case 0x0c4: return s->tcr;\n\n case 0x0e4: /* PALR */\n\n return (s->conf.macaddr.a[0] << 24) | (s->conf.macaddr.a[1] << 16)\n\n | (s->conf.macaddr.a[2] << 8) | s->conf.macaddr.a[3];\n\n break;\n\n case 0x0e8: /* PAUR */\n\n return (s->conf.macaddr.a[4] << 24) | (s->conf.macaddr.a[5] << 16) | 0x8808;\n\n case 0x0ec: return 0x10000; /* OPD */\n\n case 0x118: return 0;\n\n case 0x11c: return 0;\n\n case 0x120: return 0;\n\n case 0x124: return 0;\n\n case 0x144: return s->tfwr;\n\n case 0x14c: return 0x600;\n\n case 0x150: return s->rfsr;\n\n case 0x180: return s->erdsr;\n\n case 0x184: return s->etdsr;\n\n case 0x188: return s->emrbr;\n\n default:\n\n hw_error(\"mcf_fec_read: Bad address 0x%x\\n\", (int)addr);\n\n return 0;\n\n }\n\n}\n"}} {"sample_id": "12848bfc5d719bad536c5448205a3226be1fda47_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int local_chmod(FsContext *fs_ctx, const char *path, FsCred *credp)\n \n {\n+\n if (fs_ctx->fs_sm == SM_MAPPED) {\n \n return local_set_xattr(rpath(fs_ctx, path), credp);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int local_chmod(FsContext *fs_ctx, const char *path, FsCred *credp)\n\n{\n\n if (fs_ctx->fs_sm == SM_MAPPED) {\n\n return local_set_xattr(rpath(fs_ctx, path), credp);\n\n } else if (fs_ctx->fs_sm == SM_PASSTHROUGH) {\n\n return chmod(rpath(fs_ctx, path), credp->fc_mode);\n\n }\n\n return -1;\n\n}\n"}} {"sample_id": "4c315c27661502a0813b129e41c0bf640c34a8d6_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n cc->handle_mmu_fault = arm_cpu_handle_mmu_fault;\n #else\n cc->do_interrupt = arm_cpu_do_interrupt;\n+ cc->get_phys_page_debug = arm_cpu_get_phys_page_debug;\n+ cc->vmsd = &vmstate_arm_cpu;\n+ cc->virtio_is_big_endian = arm_cpu_is_big_endian;\n+#endif\n+ cc->gdb_num_core_regs = 26;\n cc->gdb_core_xml_file = \"arm-core.xml\";\n cc->gdb_stop_before_watchpoint = true;\n cc->debug_excp_handler = arm_debug_excp_handler;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void arm_cpu_class_init(ObjectClass *oc, void *data)\n{\n ARMCPUClass *acc = ARM_CPU_CLASS(oc);\n CPUClass *cc = CPU_CLASS(acc);\n DeviceClass *dc = DEVICE_CLASS(oc);\n acc->parent_realize = dc->realize;\n dc->realize = arm_cpu_realizefn;\n dc->props = arm_cpu_properties;\n acc->parent_reset = cc->reset;\n cc->reset = arm_cpu_reset;\n cc->class_by_name = arm_cpu_class_by_name;\n cc->has_work = arm_cpu_has_work;\n cc->cpu_exec_interrupt = arm_cpu_exec_interrupt;\n cc->dump_state = arm_cpu_dump_state;\n cc->set_pc = arm_cpu_set_pc;\n cc->gdb_read_register = arm_cpu_gdb_read_register;\n cc->gdb_write_register = arm_cpu_gdb_write_register;\n#ifdef CONFIG_USER_ONLY\n cc->handle_mmu_fault = arm_cpu_handle_mmu_fault;\n#else\n cc->do_interrupt = arm_cpu_do_interrupt;\n cc->get_phys_page_debug = arm_cpu_get_phys_page_debug;\n cc->vmsd = &vmstate_arm_cpu;\n cc->virtio_is_big_endian = arm_cpu_is_big_endian;\n#endif\n cc->gdb_num_core_regs = 26;\n cc->gdb_core_xml_file = \"arm-core.xml\";\n cc->gdb_stop_before_watchpoint = true;\n cc->debug_excp_handler = arm_debug_excp_handler;\n cc->disas_set_info = arm_disas_set_info;\n}"}} {"sample_id": "6eed92a2b7977b7aa91554e9911106462681d242", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n \n \n+ while (n--) {\n+\n+ uint8_t d = *src++;\n+\n+ val = av_clip(val + table[d & 0x0f], -127, 128);\n \n *dst++ = val;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int delta_decode(int8_t *dst, const uint8_t *src, int src_size,\n\n int8_t val, const int8_t *table)\n\n{\n\n int n = src_size;\n\n int8_t *dst0 = dst;\n\n\n\n while (n--) {\n\n uint8_t d = *src++;\n\n val = av_clip(val + table[d & 0x0f], -127, 128);\n\n *dst++ = val;\n\n val = av_clip(val + table[d >> 4] , -127, 128);\n\n *dst++ = val;\n\n }\n\n\n\n return dst-dst0;\n\n}\n"}} {"sample_id": "b9bec74bcb16519a876ec21cd5277c526a9b512d_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n struct kvm_fpu fpu;\n+\n+ int i, ret;\n+\n+\n+\n ret = kvm_vcpu_ioctl(env, KVM_GET_FPU, &fpu);\n \n if (ret < 0)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int kvm_get_fpu(CPUState *env)\n\n{\n\n struct kvm_fpu fpu;\n\n int i, ret;\n\n\n\n ret = kvm_vcpu_ioctl(env, KVM_GET_FPU, &fpu);\n\n if (ret < 0)\n\n return ret;\n\n\n\n env->fpstt = (fpu.fsw >> 11) & 7;\n\n env->fpus = fpu.fsw;\n\n env->fpuc = fpu.fcw;\n\n for (i = 0; i < 8; ++i)\n\n\tenv->fptags[i] = !((fpu.ftwx >> i) & 1);\n\n memcpy(env->fpregs, fpu.fpr, sizeof env->fpregs);\n\n memcpy(env->xmm_regs, fpu.xmm, sizeof env->xmm_regs);\n\n env->mxcsr = fpu.mxcsr;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "231bb267644ee3a9ebfd9c7f42d5d41610194b45", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+int qcow2_pre_write_overlap_check(BlockDriverState *bs, int chk, int64_t offset,\n+\n int64_t size)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int qcow2_pre_write_overlap_check(BlockDriverState *bs, int chk, int64_t offset,\n\n int64_t size)\n\n{\n\n int ret = qcow2_check_metadata_overlap(bs, chk, offset, size);\n\n\n\n if (ret < 0) {\n\n return ret;\n\n } else if (ret > 0) {\n\n int metadata_ol_bitnr = ffs(ret) - 1;\n\n char *message;\n\n QObject *data;\n\n\n\n assert(metadata_ol_bitnr < QCOW2_OL_MAX_BITNR);\n\n\n\n fprintf(stderr, \"qcow2: Preventing invalid write on metadata (overlaps \"\n\n \"with %s); image marked as corrupt.\\n\",\n\n metadata_ol_names[metadata_ol_bitnr]);\n\n message = g_strdup_printf(\"Prevented %s overwrite\",\n\n metadata_ol_names[metadata_ol_bitnr]);\n\n data = qobject_from_jsonf(\"{ 'device': %s, 'msg': %s, 'offset': %\"\n\n PRId64 \", 'size': %\" PRId64 \" }\", bs->device_name, message,\n\n offset, size);\n\n monitor_protocol_event(QEVENT_BLOCK_IMAGE_CORRUPTED, data);\n\n g_free(message);\n\n qobject_decref(data);\n\n\n\n qcow2_mark_corrupt(bs);\n\n bs->drv = NULL; /* make BDS unusable */\n\n return -EIO;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "2d528d45ecf5ee3c1a566a9f3d664464925ef830", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ CharDriverState *chr;\n \n FDCharDriver *s;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static CharDriverState *qemu_chr_open_fd(int fd_in, int fd_out)\n\n{\n\n CharDriverState *chr;\n\n FDCharDriver *s;\n\n\n\n chr = qemu_chr_alloc();\n\n s = g_malloc0(sizeof(FDCharDriver));\n\n s->fd_in = io_channel_from_fd(fd_in);\n\n s->fd_out = io_channel_from_fd(fd_out);\n\n qemu_set_nonblock(fd_out);\n\n s->chr = chr;\n\n chr->opaque = s;\n\n chr->chr_add_watch = fd_chr_add_watch;\n\n chr->chr_write = fd_chr_write;\n\n chr->chr_update_read_handler = fd_chr_update_read_handler;\n\n chr->chr_close = fd_chr_close;\n\n\n\n return chr;\n\n}\n"}} {"sample_id": "5712db6ae5101db645f71edc393368cd59bfd314_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,20 +1,20 @@\n+FWCfgState *fw_cfg_init(uint32_t ctl_port, uint32_t data_port,\n+\n+ hwaddr ctl_addr, hwaddr data_addr)\n+\n+{\n+\n+ DeviceState *dev;\n+\n+ SysBusDevice *d;\n \n FWCfgState *s;\n \n+\n+\n dev = qdev_create(NULL, TYPE_FW_CFG);\n+\n+ qdev_prop_set_uint32(dev, \"ctl_iobase\", ctl_port);\n \n qdev_prop_set_uint32(dev, \"data_iobase\", data_port);\n \n@@ -25,7 +25,7 @@\n s = FW_CFG(dev);\n \n \n+\n assert(!object_resolve_path(FW_CFG_PATH, NULL));\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "FWCfgState *fw_cfg_init(uint32_t ctl_port, uint32_t data_port,\n\n hwaddr ctl_addr, hwaddr data_addr)\n\n{\n\n DeviceState *dev;\n\n SysBusDevice *d;\n\n FWCfgState *s;\n\n\n\n dev = qdev_create(NULL, TYPE_FW_CFG);\n\n qdev_prop_set_uint32(dev, \"ctl_iobase\", ctl_port);\n\n qdev_prop_set_uint32(dev, \"data_iobase\", data_port);\n\n d = SYS_BUS_DEVICE(dev);\n\n\n\n s = FW_CFG(dev);\n\n\n\n assert(!object_resolve_path(FW_CFG_PATH, NULL));\n\n\n\n object_property_add_child(qdev_get_machine(), FW_CFG_NAME, OBJECT(s), NULL);\n\n\n\n qdev_init_nofail(dev);\n\n\n\n if (ctl_addr) {\n\n sysbus_mmio_map(d, 0, ctl_addr);\n\n }\n\n if (data_addr) {\n\n sysbus_mmio_map(d, 1, data_addr);\n\n }\n\n fw_cfg_add_bytes(s, FW_CFG_SIGNATURE, (char *)\"QEMU\", 4);\n\n fw_cfg_add_bytes(s, FW_CFG_UUID, qemu_uuid, 16);\n\n fw_cfg_add_i16(s, FW_CFG_NOGRAPHIC, (uint16_t)(display_type == DT_NOGRAPHIC));\n\n fw_cfg_add_i16(s, FW_CFG_NB_CPUS, (uint16_t)smp_cpus);\n\n fw_cfg_add_i16(s, FW_CFG_BOOT_MENU, (uint16_t)boot_menu);\n\n fw_cfg_bootsplash(s);\n\n fw_cfg_reboot(s);\n\n\n\n s->machine_ready.notify = fw_cfg_machine_ready;\n\n qemu_add_machine_init_done_notifier(&s->machine_ready);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "75af1f34cd5b07c3c7fcf86dfc99a42de48a600d_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n uint64_t total_sectors;\n \n \n+\n+ if (nb_sectors > INT_MAX) {\n+\n+ return false;\n+\n }\n \n if (sector & dev->sector_mask) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool virtio_blk_sect_range_ok(VirtIOBlock *dev,\n\n uint64_t sector, size_t size)\n\n{\n\n uint64_t nb_sectors = size >> BDRV_SECTOR_BITS;\n\n uint64_t total_sectors;\n\n\n\n if (nb_sectors > INT_MAX) {\n\n return false;\n\n }\n\n if (sector & dev->sector_mask) {\n\n return false;\n\n }\n\n if (size % dev->conf.conf.logical_block_size) {\n\n return false;\n\n }\n\n blk_get_geometry(dev->blk, &total_sectors);\n\n if (sector > total_sectors || nb_sectors > total_sectors - sector) {\n\n return false;\n\n }\n\n return true;\n\n}\n"}} {"sample_id": "be48e9951214a78ebef025cefecfc77be3d1c13c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void qxl_check_state(PCIQXLDevice *d)\n+\n+{\n+\n QXLRam *ram = d->ram;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void qxl_check_state(PCIQXLDevice *d)\n\n{\n\n QXLRam *ram = d->ram;\n\n\n\n assert(SPICE_RING_IS_EMPTY(&ram->cmd_ring));\n\n assert(SPICE_RING_IS_EMPTY(&ram->cursor_ring));\n\n}\n"}} {"sample_id": "ea53854a54bc54dddeec0c56572adf53384e960c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n int slot;\n \n \n+\n+ for (slot = 0; slot < 32; slot++) {\n+\n+ int fn;\n+\n \n \n for (fn = 0; fn < 8; fn++) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void qpci_device_foreach(QPCIBus *bus, int vendor_id, int device_id,\n\n void (*func)(QPCIDevice *dev, int devfn, void *data),\n\n void *data)\n\n{\n\n int slot;\n\n\n\n for (slot = 0; slot < 32; slot++) {\n\n int fn;\n\n\n\n for (fn = 0; fn < 8; fn++) {\n\n QPCIDevice *dev;\n\n\n\n dev = qpci_device_find(bus, QPCI_DEVFN(slot, fn));\n\n if (!dev) {\n\n continue;\n\n }\n\n\n\n if (vendor_id != -1 &&\n\n qpci_config_readw(dev, PCI_VENDOR_ID) != vendor_id) {\n\n\n continue;\n\n }\n\n\n\n if (device_id != -1 &&\n\n qpci_config_readw(dev, PCI_DEVICE_ID) != device_id) {\n\n\n continue;\n\n }\n\n\n\n func(dev, QPCI_DEVFN(slot, fn), data);\n\n }\n\n }\n\n}"}} {"sample_id": "9d0b45ade864f3d2ccd8610149fe1fff53c4e937", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,20 +1,20 @@\n+static int nprobe(AVFormatContext *s, uint8_t *enc_header, int size,\n \n+ const uint8_t *n_val)\n \n+{\n \n OMAContext *oc = s->priv_data;\n \n uint32_t pos, taglen, datalen;\n \n+ struct AVDES av_des;\n \n \n \n if (!enc_header || !n_val)\n \n+ return -1;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int nprobe(AVFormatContext *s, uint8_t *enc_header, int size,\n\n const uint8_t *n_val)\n\n{\n\n OMAContext *oc = s->priv_data;\n\n uint32_t pos, taglen, datalen;\n\n struct AVDES av_des;\n\n\n\n if (!enc_header || !n_val)\n\n return -1;\n\n\n\n pos = OMA_ENC_HEADER_SIZE + oc->k_size;\n\n if (!memcmp(&enc_header[pos], \"EKB \", 4))\n\n pos += 32;\n\n\n\n if (AV_RB32(&enc_header[pos]) != oc->rid)\n\n av_log(s, AV_LOG_DEBUG, \"Mismatching RID\\n\");\n\n\n\n taglen = AV_RB32(&enc_header[pos + 32]);\n\n datalen = AV_RB32(&enc_header[pos + 36]) >> 4;\n\n\n\n if (taglen + (((uint64_t)datalen) << 4) + 44 > size)\n\n return -1;\n\n\n\n pos += 44 + taglen;\n\n\n\n av_des_init(&av_des, n_val, 192, 1);\n\n while (datalen-- > 0) {\n\n av_des_crypt(&av_des, oc->r_val, &enc_header[pos], 2, NULL, 1);\n\n kset(s, oc->r_val, NULL, 16);\n\n if (!rprobe(s, enc_header, oc->r_val))\n\n return 0;\n\n pos += 16;\n\n }\n\n\n\n return -1;\n\n}\n"}} {"sample_id": "79db7ac6ef235a06c3049d7792eda39da28ee3fd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int context_init(H264Context *h){\n \n+ MpegEncContext * const s = &h->s;\n+\n \n \n CHECKED_ALLOCZ(h->top_borders[0], h->s.mb_width * (16+8+8) * sizeof(uint8_t))", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int context_init(H264Context *h){\n\n MpegEncContext * const s = &h->s;\n\n\n\n CHECKED_ALLOCZ(h->top_borders[0], h->s.mb_width * (16+8+8) * sizeof(uint8_t))\n\n CHECKED_ALLOCZ(h->top_borders[1], h->s.mb_width * (16+8+8) * sizeof(uint8_t))\n\n\n\n // edge emu needs blocksize + filter length - 1 (=17x17 for halfpel / 21x21 for h264)\n\n CHECKED_ALLOCZ(s->allocated_edge_emu_buffer,\n\n (s->width+64)*2*21*2); //(width + edge + align)*interlaced*MBsize*tolerance\n\n s->edge_emu_buffer= s->allocated_edge_emu_buffer + (s->width+64)*2*21;\n\n return 0;\n\nfail:\n\n return -1; // free_tables will clean up for us\n\n}\n"}} {"sample_id": "b47b35250fbfa062aedf6ab6e5faab84c4a76f4f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,8 +19,8 @@\n for (j = 0; j < sizeof(command_to_handler); j++) {\n \n if ((j & handlers[i].mask) == handlers[i].value) {\n+\n+ command_to_handler[j] = i;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static int fdctrl_init_common(FDCtrl *fdctrl)\n\n{\n\n int i, j;\n\n static int command_tables_inited = 0;\n\n\n\n /* Fill 'command_to_handler' lookup table */\n\n if (!command_tables_inited) {\n\n command_tables_inited = 1;\n\n for (i = ARRAY_SIZE(handlers) - 1; i >= 0; i--) {\n\n for (j = 0; j < sizeof(command_to_handler); j++) {\n\n if ((j & handlers[i].mask) == handlers[i].value) {\n\n command_to_handler[j] = i;\n\n }\n\n }\n\n }\n\n }\n\n\n\n FLOPPY_DPRINTF(\"init controller\\n\");\n\n fdctrl->fifo = qemu_memalign(512, FD_SECTOR_LEN);\n\n fdctrl->fifo_size = 512;\n\n fdctrl->result_timer = qemu_new_timer(vm_clock,\n\n fdctrl_result_timer, fdctrl);\n\n\n\n fdctrl->version = 0x90; /* Intel 82078 controller */\n\n fdctrl->config = FD_CONFIG_EIS | FD_CONFIG_EFIFO; /* Implicit seek, polling & FIFO enabled */\n\n fdctrl->num_floppies = MAX_FD;\n\n\n\n if (fdctrl->dma_chann != -1)\n\n DMA_register_channel(fdctrl->dma_chann, &fdctrl_transfer_handler, fdctrl);\n\n fdctrl_connect_drives(fdctrl);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "39bbdebb1ed8eb9c9b0cd6db85afde6ba89d86e4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n av_freep(&ctx->frm0);\n \n+ av_freep(&ctx->frm1);\n+\n+ av_freep(&ctx->frm2);\n+\n+ av_freep(&ctx->stored_frame);\n \n av_freep(&ctx->rle_buf);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void destroy_buffers(SANMVideoContext *ctx)\n\n{\n\n av_freep(&ctx->frm0);\n\n av_freep(&ctx->frm1);\n\n av_freep(&ctx->frm2);\n\n av_freep(&ctx->stored_frame);\n\n av_freep(&ctx->rle_buf);\n\n ctx->frm0_size =\n\n ctx->frm1_size =\n\n ctx->frm2_size = 0;\n\n\n}"}} {"sample_id": "17e2377abf16c3951d7d34521ceade4d7dc31d01_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n return malloc(size);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void *qemu_malloc(size_t size)\n\n{\n\n return malloc(size);\n\n}\n"}} {"sample_id": "68f593b48433842f3407586679fe07f3e5199ab9_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n switch(ext_type) {\n \n+ case 0x1:\n+\n+ /* sequence ext */\n+\n+ mpeg_decode_sequence_extension(s);\n \n break;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void mpeg_decode_extension(AVCodecContext *avctx, \n\n UINT8 *buf, int buf_size)\n\n{\n\n Mpeg1Context *s1 = avctx->priv_data;\n\n MpegEncContext *s = &s1->mpeg_enc_ctx;\n\n int ext_type;\n\n\n\n init_get_bits(&s->gb, buf, buf_size);\n\n \n\n ext_type = get_bits(&s->gb, 4);\n\n switch(ext_type) {\n\n case 0x1:\n\n /* sequence ext */\n\n mpeg_decode_sequence_extension(s);\n\n break;\n\n case 0x3:\n\n /* quant matrix extension */\n\n mpeg_decode_quant_matrix_extension(s);\n\n break;\n\n case 0x8:\n\n /* picture extension */\n\n mpeg_decode_picture_coding_extension(s);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "6a744d261930f8101132bc6d207b6eac41d9cf18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n #if HAVE_BIGENDIAN\n+\n+ int i;\n+\n+ for (i = 0; i < s->frame.blocksize * s->channels; i++) {\n+\n int16_t smp = av_le2ne16(samples[i]);\n \n av_md5_update(s->md5ctx, (uint8_t *)&smp, 2);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void update_md5_sum(FlacEncodeContext *s, const int16_t *samples)\n\n{\n\n#if HAVE_BIGENDIAN\n\n int i;\n\n for (i = 0; i < s->frame.blocksize * s->channels; i++) {\n\n int16_t smp = av_le2ne16(samples[i]);\n\n av_md5_update(s->md5ctx, (uint8_t *)&smp, 2);\n\n }\n\n#else\n\n av_md5_update(s->md5ctx, (const uint8_t *)samples, s->frame.blocksize*s->channels*2);\n\n#endif\n\n}\n"}} {"sample_id": "a8fb542705ac7e0dcf00908bc47bf49cdd058abe", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,10 +12,10 @@\n \n \n \n+ s->ioc = QIO_CHANNEL(sioc);\n+\n object_ref(OBJECT(sioc));\n+\n \n \n if (s->do_nodelay) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int tcp_chr_new_client(CharDriverState *chr, QIOChannelSocket *sioc)\n\n{\n\n TCPCharDriver *s = chr->opaque;\n\n if (s->ioc != NULL) {\n\n\treturn -1;\n\n }\n\n\n\n s->ioc = QIO_CHANNEL(sioc);\n\n object_ref(OBJECT(sioc));\n\n\n\n if (s->do_nodelay) {\n\n qio_channel_set_delay(s->ioc, false);\n\n }\n\n if (s->listen_tag) {\n\n g_source_remove(s->listen_tag);\n\n s->listen_tag = 0;\n\n }\n\n\n\n if (s->do_telnetopt) {\n\n tcp_chr_telnet_init(chr);\n\n } else {\n\n tcp_chr_connect(chr);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d2164ad35c411d97abd2aa5c6f160283d215e214_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n qemu_get_be32s(f, &v2);\n \n+\n+\n+ if (*v == v2) {\n+\n+ return 0;\n \n \n error_report(\"%\" PRIx32 \" != %\" PRIx32, *v, v2);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int get_uint32_equal(QEMUFile *f, void *pv, size_t size,\n\n VMStateField *field)\n\n{\n\n uint32_t *v = pv;\n\n uint32_t v2;\n\n qemu_get_be32s(f, &v2);\n\n\n\n if (*v == v2) {\n\n return 0;\n\n\n error_report(\"%\" PRIx32 \" != %\" PRIx32, *v, v2);\n\n\n\n\n return -EINVAL;\n"}} {"sample_id": "f9505923a344a56c3ff36925adb7f0c3c9a3996c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n MpegEncContext *s = &h->s;\n \n int frame_rate_code;\n+\n+ int width, height;\n+\n+\n+\n h->profile = get_bits(&s->gb,8);\n \n h->level = get_bits(&s->gb,8);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int decode_seq_header(AVSContext *h) {\n\n MpegEncContext *s = &h->s;\n\n int frame_rate_code;\n\n int width, height;\n\n\n\n h->profile = get_bits(&s->gb,8);\n\n h->level = get_bits(&s->gb,8);\n\n skip_bits1(&s->gb); //progressive sequence\n\n width = get_bits(&s->gb,14);\n\n height = get_bits(&s->gb,14);\n\n if ((s->width || s->height) && (s->width != width || s->height != height)) {\n\n av_log_missing_feature(s, \"Width/height changing in CAVS is\", 0);\n\n return -1;\n\n\n\n\n\n\n s->width = width;\n\n s->height = height;\n\n skip_bits(&s->gb,2); //chroma format\n\n skip_bits(&s->gb,3); //sample_precision\n\n h->aspect_ratio = get_bits(&s->gb,4);\n\n frame_rate_code = get_bits(&s->gb,4);\n\n skip_bits(&s->gb,18);//bit_rate_lower\n\n skip_bits1(&s->gb); //marker_bit\n\n skip_bits(&s->gb,12);//bit_rate_upper\n\n s->low_delay = get_bits1(&s->gb);\n\n h->mb_width = (s->width + 15) >> 4;\n\n h->mb_height = (s->height + 15) >> 4;\n\n h->s.avctx->time_base.den = avpriv_frame_rate_tab[frame_rate_code].num;\n\n h->s.avctx->time_base.num = avpriv_frame_rate_tab[frame_rate_code].den;\n\n h->s.avctx->width = s->width;\n\n h->s.avctx->height = s->height;\n\n if(!h->top_qp)\n\n ff_cavs_init_top_lines(h);\n\n return 0;\n"}} {"sample_id": "81174dae3f9189519cd60c7b79e91c291b021bbe_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void serial_reset(void *opaque)\n+\n+{\n \n SerialState *s = opaque;\n \n \n+\n s->divider = 0;\n \n s->rbr = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void serial_reset(void *opaque)\n\n{\n\n SerialState *s = opaque;\n\n\n\n s->divider = 0;\n\n s->rbr = 0;\n\n s->ier = 0;\n\n s->iir = UART_IIR_NO_INT;\n\n s->lcr = 0;\n\n s->mcr = 0;\n\n s->lsr = UART_LSR_TEMT | UART_LSR_THRE;\n\n s->msr = UART_MSR_DCD | UART_MSR_DSR | UART_MSR_CTS;\n\n s->scr = 0;\n\n\n\n s->thr_ipending = 0;\n\n s->last_break_enable = 0;\n\n qemu_irq_lower(s->irq);\n\n}\n"}} {"sample_id": "0920a17199d23b3def3a60fa1fbbdeadcdda452d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n static Visitor *visitor_input_test_init_raw(TestInputVisitorData *data,\n+\n+ const char *json_string)\n+\n+{\n+\n+ Visitor *v;\n+\n+\n \n data->obj = qobject_from_json(json_string);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static Visitor *visitor_input_test_init_raw(TestInputVisitorData *data,\n\n const char *json_string)\n\n{\n\n Visitor *v;\n\n\n\n data->obj = qobject_from_json(json_string);\n\n\n\n g_assert(data->obj != NULL);\n\n\n\n data->qiv = qmp_input_visitor_new(data->obj);\n\n g_assert(data->qiv != NULL);\n\n\n\n v = qmp_input_get_visitor(data->qiv);\n\n g_assert(v != NULL);\n\n\n\n return v;\n\n}\n"}} {"sample_id": "cc05c43ad942165ecc6ffd39e41991bee43af044_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n+static bool memory_region_dispatch_write(MemoryRegion *mr,\n \n hwaddr addr,\n+\n uint64_t data,\n \n unsigned size)\n+\n {\n+\n if (!memory_region_access_valid(mr, addr, size, true)) {\n+\n unassigned_mem_write(mr, addr, data, size);\n \n return true;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static bool memory_region_dispatch_write(MemoryRegion *mr,\n\n hwaddr addr,\n\n uint64_t data,\n\n unsigned size)\n\n{\n\n if (!memory_region_access_valid(mr, addr, size, true)) {\n\n unassigned_mem_write(mr, addr, data, size);\n\n return true;\n\n }\n\n\n\n adjust_endianness(mr, &data, size);\n\n\n\n if (mr->ops->write) {\n\n access_with_adjusted_size(addr, &data, size,\n\n mr->ops->impl.min_access_size,\n\n mr->ops->impl.max_access_size,\n\n memory_region_write_accessor, mr);\n\n } else {\n\n access_with_adjusted_size(addr, &data, size, 1, 4,\n\n memory_region_oldmmio_write_accessor, mr);\n\n }\n\n return false;\n\n}\n"}} {"sample_id": "70556264a89a268efba1d7e8e341adcdd7881eb4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n+bool qvirtio_wait_config_isr(const QVirtioBus *bus, QVirtioDevice *d,\n \n uint64_t timeout)\n \n {\n \n+ do {\n+\n clock_step(100);\n \n if (bus->get_config_isr_status(d)) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "bool qvirtio_wait_config_isr(const QVirtioBus *bus, QVirtioDevice *d,\n\n uint64_t timeout)\n\n{\n\n do {\n\n clock_step(100);\n\n if (bus->get_config_isr_status(d)) {\n\n break; /* It has ended */\n\n }\n\n } while (--timeout);\n\n\n\n return timeout != 0;\n\n}\n"}} {"sample_id": "821c447675728ca06c8d2e4ac8a0e7a1adf775b8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n \n * because we are sure we have enough space for the status\n \n+ */\n+\n+ msg_size = proxy_marshal(iovec, 0, \"ddd\", header.type,\n+\n+ header.size, status);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int send_status(int sockfd, struct iovec *iovec, int status)\n\n{\n\n ProxyHeader header;\n\n int retval, msg_size;\n\n\n\n if (status < 0) {\n\n header.type = T_ERROR;\n\n } else {\n\n header.type = T_SUCCESS;\n\n\n header.size = sizeof(status);\n\n /*\n\n * marshal the return status. We don't check error.\n\n * because we are sure we have enough space for the status\n\n */\n\n msg_size = proxy_marshal(iovec, 0, \"ddd\", header.type,\n\n header.size, status);\n\n\n\n\n retval = socket_write(sockfd, iovec->iov_base, msg_size);\n\n if (retval < 0) {\n\n return retval;\n\n\n return 0;\n"}} {"sample_id": "864699227911909ef1e33ecf91bf3c900715a9b1_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void loadvm_postcopy_handle_run_bh(void *opaque)\n \n+{\n \n Error *local_err = NULL;\n \n@@ -15,7 +15,7 @@\n */\n \n cpu_synchronize_all_post_init();\n+\n \n \n qemu_announce_self();", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void loadvm_postcopy_handle_run_bh(void *opaque)\n\n{\n\n Error *local_err = NULL;\n\n MigrationIncomingState *mis = opaque;\n\n\n\n /* TODO we should move all of this lot into postcopy_ram.c or a shared code\n\n * in migration.c\n\n */\n\n cpu_synchronize_all_post_init();\n\n\n\n qemu_announce_self();\n\n\n\n /* Make sure all file formats flush their mutable metadata */\n\n bdrv_invalidate_cache_all(&local_err);\n\n if (local_err) {\n\n error_report_err(local_err);\n\n }\n\n\n\n trace_loadvm_postcopy_handle_run_cpu_sync();\n\n cpu_synchronize_all_post_init();\n\n\n\n trace_loadvm_postcopy_handle_run_vmstart();\n\n\n\n if (autostart) {\n\n /* Hold onto your hats, starting the CPU */\n\n vm_start();\n\n } else {\n\n /* leave it paused and let management decide when to start the CPU */\n\n runstate_set(RUN_STATE_PAUSED);\n\n }\n\n\n\n qemu_bh_delete(mis->bh);\n\n}\n"}} {"sample_id": "373166636b9f07c60d7c32610bd346acf7d143e9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n if (ret < 0) {\n \n error_setg(errp,\n+\n \"Unable to initialize GNUTLS library: %s\",\n \n gnutls_strerror(ret));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int qcrypto_init(Error **errp)\n\n{\n\n#ifdef CONFIG_GNUTLS\n\n int ret;\n\n ret = gnutls_global_init();\n\n if (ret < 0) {\n\n error_setg(errp,\n\n \"Unable to initialize GNUTLS library: %s\",\n\n gnutls_strerror(ret));\n\n return -1;\n\n }\n\n#ifdef DEBUG_GNUTLS\n\n gnutls_global_set_log_level(10);\n\n gnutls_global_set_log_function(qcrypto_gnutls_log);\n\n#endif\n\n#endif\n\n\n\n#ifdef CONFIG_GCRYPT\n\n if (!gcry_check_version(GCRYPT_VERSION)) {\n\n error_setg(errp, \"Unable to initialize gcrypt\");\n\n return -1;\n\n }\n\n#ifdef QCRYPTO_INIT_GCRYPT_THREADS\n\n gcry_control(GCRYCTL_SET_THREAD_CBS, &qcrypto_gcrypt_thread_impl);\n\n#endif /* QCRYPTO_INIT_GCRYPT_THREADS */\n\n gcry_control(GCRYCTL_INITIALIZATION_FINISHED, 0);\n\n#endif\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "5c6c0e513600ba57c3e73b7151d3c0664438f7b5_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n SCSIRequest *scsi_req_alloc(size_t size, SCSIDevice *d, uint32_t tag, uint32_t lun)\n+\n {\n+\n SCSIRequest *req;\n \n \n \n req = qemu_mallocz(size);\n+\n /* Two references: one is passed back to the HBA, one is in d->requests. */\n+\n req->refcount = 2;\n \n req->bus = scsi_bus_from_device(d);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "SCSIRequest *scsi_req_alloc(size_t size, SCSIDevice *d, uint32_t tag, uint32_t lun)\n\n{\n\n SCSIRequest *req;\n\n\n\n req = qemu_mallocz(size);\n\n /* Two references: one is passed back to the HBA, one is in d->requests. */\n\n req->refcount = 2;\n\n req->bus = scsi_bus_from_device(d);\n\n req->dev = d;\n\n req->tag = tag;\n\n req->lun = lun;\n\n req->status = -1;\n\n req->enqueued = true;\n\n trace_scsi_req_alloc(req->dev->id, req->lun, req->tag);\n\n QTAILQ_INSERT_TAIL(&d->requests, req, next);\n\n return req;\n\n}\n"}} {"sample_id": "4f5e19e6c570459cd524b29b24374f03860f5149_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int pci_unin_agp_init_device(SysBusDevice *dev)\n \n+{\n+\n+ UNINState *s;\n+\n+ int pci_mem_config, pci_mem_data;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pci_unin_agp_init_device(SysBusDevice *dev)\n\n{\n\n UNINState *s;\n\n int pci_mem_config, pci_mem_data;\n\n\n\n /* Uninorth AGP bus */\n\n s = FROM_SYSBUS(UNINState, dev);\n\n\n\n pci_mem_config = cpu_register_io_memory(pci_unin_config_read,\n\n pci_unin_config_write, s);\n\n pci_mem_data = cpu_register_io_memory(pci_unin_main_read,\n\n pci_unin_main_write, &s->host_state);\n\n sysbus_init_mmio(dev, 0x1000, pci_mem_config);\n\n sysbus_init_mmio(dev, 0x1000, pci_mem_data);\n\n return 0;\n\n}\n"}} {"sample_id": "e8ede0a8bb5298a6979bcf7ed84ef64a64a4e3fe_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n union {\n+\n+ uint32_t i;\n+\n+ float32 s;\n \n } v;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline float32 ucf64_itos(uint32_t i)\n\n{\n\n union {\n\n uint32_t i;\n\n float32 s;\n\n } v;\n\n\n\n v.i = i;\n\n return v.s;\n\n}\n"}} {"sample_id": "bd269ebc82fbaa5fe7ce5bc7c1770ac8acecd884_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n void qio_channel_socket_connect_async(QIOChannelSocket *ioc,\n \n SocketAddressLegacy *addr,\n+\n+ QIOTaskFunc callback,\n+\n+ gpointer opaque,\n+\n GDestroyNotify destroy)\n \n {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qio_channel_socket_connect_async(QIOChannelSocket *ioc,\n\n SocketAddressLegacy *addr,\n\n QIOTaskFunc callback,\n\n gpointer opaque,\n\n GDestroyNotify destroy)\n\n{\n\n QIOTask *task = qio_task_new(\n\n OBJECT(ioc), callback, opaque, destroy);\n\n SocketAddressLegacy *addrCopy;\n\n\n\n addrCopy = QAPI_CLONE(SocketAddressLegacy, addr);\n\n\n\n /* socket_connect() does a non-blocking connect(), but it\n\n * still blocks in DNS lookups, so we must use a thread */\n\n trace_qio_channel_socket_connect_async(ioc, addr);\n\n qio_task_run_in_thread(task,\n\n qio_channel_socket_connect_worker,\n\n addrCopy,\n\n (GDestroyNotify)qapi_free_SocketAddressLegacy);\n\n}\n"}} {"sample_id": "d57e4e482e3997b1382625c84149ad0b69155fc0_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n tcsetattr (0, TCSANOW, &oldtty);\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void term_exit(void)\n\n{\n\n tcsetattr (0, TCSANOW, &oldtty);\n\n}\n"}} {"sample_id": "b1306823d0b3ae998c8e10ad832004eb13bdd93e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ av_freep(dst);\n+\n *dst = av_strdup(val);\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int set_string(void *obj, const AVOption *o, const char *val, uint8_t **dst)\n\n{\n\n av_freep(dst);\n\n *dst = av_strdup(val);\n\n return 0;\n\n}\n"}} {"sample_id": "b45c03f585ea9bb1af76c73e82195418c294919d_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static struct omap_sti_s *omap_sti_init(struct omap_target_agent_s *ta,\n+\n MemoryRegion *sysmem,\n \n hwaddr channel_base, qemu_irq irq, omap_clk clk,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static struct omap_sti_s *omap_sti_init(struct omap_target_agent_s *ta,\n\n MemoryRegion *sysmem,\n\n hwaddr channel_base, qemu_irq irq, omap_clk clk,\n\n CharDriverState *chr)\n\n{\n\n struct omap_sti_s *s = (struct omap_sti_s *)\n\n g_malloc0(sizeof(struct omap_sti_s));\n\n\n\n s->irq = irq;\n\n omap_sti_reset(s);\n\n\n\n s->chr = chr ?: qemu_chr_new(\"null\", \"null\", NULL);\n\n\n\n memory_region_init_io(&s->iomem, NULL, &omap_sti_ops, s, \"omap.sti\",\n\n omap_l4_region_size(ta, 0));\n\n omap_l4_attach(ta, 0, &s->iomem);\n\n\n\n memory_region_init_io(&s->iomem_fifo, NULL, &omap_sti_fifo_ops, s,\n\n \"omap.sti.fifo\", 0x10000);\n\n memory_region_add_subregion(sysmem, channel_base, &s->iomem_fifo);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "537d3e8e6beea9a0fbd6469eb38450e718244dad", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n if (unlikely((ra != 0 && reg < ra && (reg + num_used_regs) > ra) ||\n \n (reg < rb && (reg + num_used_regs) > rb))) {\n+\n+ helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,\n+\n+ POWERPC_EXCP_INVAL |\n+\n POWERPC_EXCP_INVAL_LSWX);\n \n } else {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void helper_lswx(CPUPPCState *env, target_ulong addr, uint32_t reg,\n\n uint32_t ra, uint32_t rb)\n\n{\n\n if (likely(xer_bc != 0)) {\n\n int num_used_regs = (xer_bc + 3) / 4;\n\n if (unlikely((ra != 0 && reg < ra && (reg + num_used_regs) > ra) ||\n\n (reg < rb && (reg + num_used_regs) > rb))) {\n\n helper_raise_exception_err(env, POWERPC_EXCP_PROGRAM,\n\n POWERPC_EXCP_INVAL |\n\n POWERPC_EXCP_INVAL_LSWX);\n\n } else {\n\n helper_lsw(env, addr, xer_bc, reg);\n\n }\n\n }\n\n}\n"}} {"sample_id": "a392bf657015c9a79a5a13adfbfb15086c1943b9_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n const uint8_t *src, int src_size,\n \n+ int id, int bpp)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int dxtory_decode_v1_rgb(AVCodecContext *avctx, AVFrame *pic,\n\n const uint8_t *src, int src_size,\n\n int id, int bpp)\n\n{\n\n int h;\n\n uint8_t *dst;\n\n int ret;\n\n\n\n if (src_size < avctx->width * avctx->height * bpp) {\n\n av_log(avctx, AV_LOG_ERROR, \"packet too small\\n\");\n\n return AVERROR_INVALIDDATA;\n\n }\n\n\n\n avctx->pix_fmt = id;\n\n if ((ret = ff_get_buffer(avctx, pic, 0)) < 0)\n\n return ret;\n\n\n\n dst = pic->data[0];\n\n for (h = 0; h < avctx->height; h++) {\n\n memcpy(dst, src, avctx->width * bpp);\n\n src += avctx->width * bpp;\n\n dst += pic->linesize[0];\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "68f593b48433842f3407586679fe07f3e5199ab9_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n printf(\"%6X, %2d, %3d\\n\", s->bits[i][j], s->len[i][j], j);\n \n+}\n+\n+#endif\n+\n+ init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int read_huffman_tables(HYuvContext *s, uint8_t *src, int length){\n\n GetBitContext gb;\n\n int i;\n\n \n\n init_get_bits(&gb, src, length);\n\n \n\n for(i=0; i<3; i++){\n\n read_len_table(s->len[i], &gb);\n\n \n\n if(generate_bits_table(s->bits[i], s->len[i])<0){\n\n return -1;\n\n }\n\n#if 0\n\nfor(j=0; j<256; j++){\n\nprintf(\"%6X, %2d, %3d\\n\", s->bits[i][j], s->len[i][j], j);\n\n}\n\n#endif\n\n init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4);\n\n }\n\n \n\n return 0;\n\n}\n"}} {"sample_id": "688b057aece53003f9d5a1dadc8961482dc2d948", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void qdev_init_gpio_out_named(DeviceState *dev, qemu_irq *pins,\n const char *name, int n)\n+{\n+ NamedGPIOList *gpio_list = qdev_get_named_gpio_list(dev, name);\n assert(gpio_list->num_in == 0 || !name);\n assert(gpio_list->num_out == 0);\n gpio_list->num_out = n;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void qdev_init_gpio_out_named(DeviceState *dev, qemu_irq *pins,\n const char *name, int n)\n{\n NamedGPIOList *gpio_list = qdev_get_named_gpio_list(dev, name);\n assert(gpio_list->num_in == 0 || !name);\n assert(gpio_list->num_out == 0);\n gpio_list->num_out = n;\n gpio_list->out = pins;"}} {"sample_id": "0fbc20740342713f282b118b4a446c4c43df3f4a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n int kvm_irqchip_update_msi_route(KVMState *s, int virq, MSIMessage msg)\n+\n {\n \n struct kvm_irq_routing_entry kroute;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int kvm_irqchip_update_msi_route(KVMState *s, int virq, MSIMessage msg)\n\n{\n\n struct kvm_irq_routing_entry kroute;\n\n\n\n if (!kvm_irqchip_in_kernel()) {\n\n return -ENOSYS;\n\n }\n\n\n\n kroute.gsi = virq;\n\n kroute.type = KVM_IRQ_ROUTING_MSI;\n\n kroute.flags = 0;\n\n kroute.u.msi.address_lo = (uint32_t)msg.address;\n\n kroute.u.msi.address_hi = msg.address >> 32;\n\n kroute.u.msi.data = le32_to_cpu(msg.data);\n\n\n\n return kvm_update_routing_entry(s, &kroute);\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_56", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n sysbus_init_mmio(sbd, &s->iomem);\n \n+ sysbus_init_irq(sbd, &s->irq[0]);\n+\n+ sysbus_init_irq(sbd, &s->irq[1]);\n+\n+ qdev_init_gpio_out(dev, s->cardstatus, 2);\n \n dinfo = drive_get_next(IF_SD);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pl181_init(SysBusDevice *sbd)\n\n{\n\n DeviceState *dev = DEVICE(sbd);\n\n PL181State *s = PL181(dev);\n\n DriveInfo *dinfo;\n\n\n\n memory_region_init_io(&s->iomem, OBJECT(s), &pl181_ops, s, \"pl181\", 0x1000);\n\n sysbus_init_mmio(sbd, &s->iomem);\n\n sysbus_init_irq(sbd, &s->irq[0]);\n\n sysbus_init_irq(sbd, &s->irq[1]);\n\n qdev_init_gpio_out(dev, s->cardstatus, 2);\n\n dinfo = drive_get_next(IF_SD);\n\n s->card = sd_init(dinfo ? blk_bs(blk_by_legacy_dinfo(dinfo)) : NULL, false);\n\n if (s->card == NULL) {\n\n return -1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "ba3517aa6f573d280d80866e776885be7f01de77", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n av_freep(&avcodec_opts[i]);\n \n av_freep(&avformat_opts->key);\n+\n+ av_freep(&avformat_opts);\n+\n+#if CONFIG_SWSCALE\n+\n av_freep(&sws_opts);\n \n #endif", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void uninit_opts(void)\n\n{\n\n int i;\n\n for (i = 0; i < AVMEDIA_TYPE_NB; i++)\n\n av_freep(&avcodec_opts[i]);\n\n av_freep(&avformat_opts->key);\n\n av_freep(&avformat_opts);\n\n#if CONFIG_SWSCALE\n\n av_freep(&sws_opts);\n\n#endif\n\n\n\n}"}} {"sample_id": "856d72454f03aea26fd61c728762ef9cd1d71512_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,9 +15,9 @@\n \n \n as->current_map = new_view;\n+\n+ flatview_destroy(old_view);\n+\n+ address_space_update_ioeventfds(as);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void address_space_update_topology(AddressSpace *as)\n\n{\n\n FlatView *old_view = as->current_map;\n\n FlatView *new_view = generate_memory_topology(as->root);\n\n\n\n address_space_update_topology_pass(as, old_view, new_view, false);\n\n address_space_update_topology_pass(as, old_view, new_view, true);\n\n\n\n as->current_map = new_view;\n\n flatview_destroy(old_view);\n\n address_space_update_ioeventfds(as);\n\n}\n"}} {"sample_id": "083300bea935d125b83f60d7030f78a7ffb0f3df", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n int ff_thread_ref_frame(ThreadFrame *dst, ThreadFrame *src)\n \n+{\n \n int ret;\n \n \n+\n dst->owner = src->owner;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int ff_thread_ref_frame(ThreadFrame *dst, ThreadFrame *src)\n\n{\n\n int ret;\n\n\n\n dst->owner = src->owner;\n\n\n\n ret = av_frame_ref(dst->f, src->f);\n\n if (ret < 0)\n\n return ret;\n\n\n\n av_assert0(!dst->progress);\n\n\n\n if (src->progress &&\n\n !(dst->progress = av_buffer_ref(src->progress))) {\n\n ff_thread_release_buffer(dst->owner, dst);\n\n return AVERROR(ENOMEM);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "2e96f5278095d44f090a4d89507e62d27cccf3b9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ V4L2m2mContext *s = buf_to_m2mctx(avbuf);\n \n AVRational v4l2_timebase = { 1, USEC_PER_SEC };\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static inline uint64_t v4l2_get_pts(V4L2Buffer *avbuf)\n\n{\n\n V4L2m2mContext *s = buf_to_m2mctx(avbuf);\n\n AVRational v4l2_timebase = { 1, USEC_PER_SEC };\n\n int64_t v4l2_pts;\n\n\n\n /* convert pts back to encoder timebase */\n\n v4l2_pts = avbuf->buf.timestamp.tv_sec * USEC_PER_SEC + avbuf->buf.timestamp.tv_usec;\n\n\n\n return av_rescale_q(v4l2_pts, v4l2_timebase, s->avctx->time_base);\n\n}\n"}} {"sample_id": "b5aec39672dc6084b43fa3f77764a6f549255a53", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n long len;\n \n \n+\n if (fd < 0) {\n \n return -1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int kvmppc_remove_spapr_tce(void *table, int fd, uint32_t window_size)\n\n{\n\n long len;\n\n\n\n if (fd < 0) {\n\n return -1;\n\n }\n\n\n\n len = (window_size / SPAPR_VIO_TCE_PAGE_SIZE)*sizeof(VIOsPAPR_RTCE);\n\n if ((munmap(table, len) < 0) ||\n\n (close(fd) < 0)) {\n\n fprintf(stderr, \"KVM: Unexpected error removing KVM SPAPR TCE \"\n\n \"table: %s\", strerror(errno));\n\n /* Leak the table */\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "58a83c61496eeb0d31571a07a51bc1947e3379ac", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem,\n \n unsigned int len)\n+\n+{\n+\n vq->last_avail_idx--;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem,\n\n unsigned int len)\n\n{\n\n vq->last_avail_idx--;\n\n\n virtqueue_unmap_sg(vq, elem, len);\n\n}"}} {"sample_id": "1a6245a5b0b4e8d822c739b403fc67c8a7bc8d12_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n size -= ret;\n \n+ }\n+\n+\n+\n+ g_free(buffer);\n \n return dropped;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ssize_t drop_sync(int fd, size_t size)\n\n{\n\n ssize_t ret, dropped = size;\n\n uint8_t *buffer = g_malloc(MIN(65536, size));\n\n\n\n while (size > 0) {\n\n ret = read_sync(fd, buffer, MIN(65536, size));\n\n if (ret < 0) {\n\n g_free(buffer);\n\n return ret;\n\n }\n\n\n\n assert(ret <= size);\n\n size -= ret;\n\n }\n\n\n\n g_free(buffer);\n\n return dropped;\n\n}\n"}} {"sample_id": "2bf3aa85f08186b8162b76e7e8efe5b5a44306a6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n uint8_t *p)\n \n+{\n \n int pages = -1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int save_zero_page(RAMState *rs, RAMBlock *block, ram_addr_t offset,\n\n uint8_t *p)\n\n{\n\n int pages = -1;\n\n\n\n if (is_zero_range(p, TARGET_PAGE_SIZE)) {\n\n rs->zero_pages++;\n\n rs->bytes_transferred +=\n\n save_page_header(rs, block, offset | RAM_SAVE_FLAG_COMPRESS);\n\n qemu_put_byte(rs->f, 0);\n\n rs->bytes_transferred += 1;\n\n pages = 1;\n\n }\n\n\n\n return pages;\n\n}\n"}} {"sample_id": "3ab9a2a5577d445252724af4067d2a7c8a378efa_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static av_always_inline int rv40_loop_filter_strength(uint8_t *src,\n \n int step, int stride,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static av_always_inline int rv40_loop_filter_strength(uint8_t *src,\n\n int step, int stride,\n\n int beta, int beta2,\n\n int edge,\n\n int *p1, int *q1)\n\n{\n\n int sum_p1p0 = 0, sum_q1q0 = 0, sum_p1p2 = 0, sum_q1q2 = 0;\n\n int strong0 = 0, strong1 = 0;\n\n uint8_t *ptr;\n\n int i;\n\n\n\n for (i = 0, ptr = src; i < 4; i++, ptr += stride) {\n\n sum_p1p0 += ptr[-2*step] - ptr[-1*step];\n\n sum_q1q0 += ptr[ 1*step] - ptr[ 0*step];\n\n }\n\n\n\n *p1 = FFABS(sum_p1p0) < (beta << 2);\n\n *q1 = FFABS(sum_q1q0) < (beta << 2);\n\n\n\n if(!*p1 && !*q1)\n\n return 0;\n\n\n\n if (!edge)\n\n return 0;\n\n\n\n for (i = 0, ptr = src; i < 4; i++, ptr += stride) {\n\n sum_p1p2 += ptr[-2*step] - ptr[-3*step];\n\n sum_q1q2 += ptr[ 1*step] - ptr[ 2*step];\n\n }\n\n\n\n strong0 = *p1 && (FFABS(sum_p1p2) < beta2);\n\n strong1 = *q1 && (FFABS(sum_q1q2) < beta2);\n\n\n\n return strong0 && strong1;\n\n}\n"}} {"sample_id": "aab99135b63522267c6fdae04712cb2f02c8c7de_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n if (state == SPAPR_DR_ALLOCATION_STATE_USABLE) {\n \n /* if there's no resource/device associated with the DRC, there's\n+\n+ * no way for us to put it in an allocation state consistent with\n+\n+ * being 'USABLE'. PAPR 2.7, 13.5.3.4 documents that this should\n+\n * result in an RTAS return code of -3 / \"no such indicator\"\n \n */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static uint32_t set_allocation_state(sPAPRDRConnector *drc,\n\n sPAPRDRAllocationState state)\n\n{\n\n sPAPRDRConnectorClass *drck = SPAPR_DR_CONNECTOR_GET_CLASS(drc);\n\n\n\n DPRINTFN(\"drc: %x, set_allocation_state: %x\", get_index(drc), state);\n\n\n\n if (state == SPAPR_DR_ALLOCATION_STATE_USABLE) {\n\n /* if there's no resource/device associated with the DRC, there's\n\n * no way for us to put it in an allocation state consistent with\n\n * being 'USABLE'. PAPR 2.7, 13.5.3.4 documents that this should\n\n * result in an RTAS return code of -3 / \"no such indicator\"\n\n */\n\n if (!drc->dev) {\n\n return RTAS_OUT_NO_SUCH_INDICATOR;\n\n }\n\n }\n\n\n\n if (drc->type != SPAPR_DR_CONNECTOR_TYPE_PCI) {\n\n drc->allocation_state = state;\n\n if (drc->awaiting_release &&\n\n drc->allocation_state == SPAPR_DR_ALLOCATION_STATE_UNUSABLE) {\n\n DPRINTFN(\"finalizing device removal\");\n\n drck->detach(drc, DEVICE(drc->dev), drc->detach_cb,\n\n drc->detach_cb_opaque, NULL);\n\n\n\n }\n\n }\n\n return RTAS_OUT_SUCCESS;\n\n}"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_21", "diff": "--- a/source.c\n+++ b/source.c\n@@ -50,10 +50,10 @@\n \n fn(node->opaque);\n \n+ }\n+\n+ }\n+\n+ qemu_lockcnt_dec(&ctx->list_lock);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void poll_set_started(AioContext *ctx, bool started)\n\n{\n\n AioHandler *node;\n\n\n\n if (started == ctx->poll_started) {\n\n return;\n\n }\n\n\n\n ctx->poll_started = started;\n\n\n\n qemu_lockcnt_inc(&ctx->list_lock);\n\n QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) {\n\n IOHandler *fn;\n\n\n\n if (node->deleted) {\n\n continue;\n\n }\n\n\n\n if (started) {\n\n fn = node->io_poll_begin;\n\n } else {\n\n fn = node->io_poll_end;\n\n }\n\n\n\n if (fn) {\n\n fn(node->opaque);\n\n }\n\n }\n\n qemu_lockcnt_dec(&ctx->list_lock);\n\n}\n"}} {"sample_id": "9e41bade85ef338afd983c109368d1bbbe931f80_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int pxa2xx_i2c_slave_init(I2CSlave *i2c)\n \n+{\n+\n /* Nothing to do. */\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pxa2xx_i2c_slave_init(I2CSlave *i2c)\n\n{\n\n /* Nothing to do. */\n\n return 0;\n\n}\n"}} {"sample_id": "6265eb26a375179f193f792e4f0d49036d2cf052", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n int parse_host_src_port(struct sockaddr_in *haddr,\n+\n struct sockaddr_in *saddr,\n \n const char *input_str)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int parse_host_src_port(struct sockaddr_in *haddr,\n\n struct sockaddr_in *saddr,\n\n const char *input_str)\n\n{\n\n char *str = strdup(input_str);\n\n char *host_str = str;\n\n char *src_str;\n\n const char *src_str2;\n\n char *ptr;\n\n\n\n /*\n\n * Chop off any extra arguments at the end of the string which\n\n * would start with a comma, then fill in the src port information\n\n * if it was provided else use the \"any address\" and \"any port\".\n\n */\n\n if ((ptr = strchr(str,',')))\n\n *ptr = '\\0';\n\n\n\n if ((src_str = strchr(input_str,'@'))) {\n\n *src_str = '\\0';\n\n src_str++;\n\n }\n\n\n\n if (parse_host_port(haddr, host_str) < 0)\n\n goto fail;\n\n\n\n src_str2 = src_str;\n\n if (!src_str || *src_str == '\\0')\n\n src_str2 = \":0\";\n\n\n\n if (parse_host_port(saddr, src_str2) < 0)\n\n goto fail;\n\n\n\n free(str);\n\n return(0);\n\n\n\nfail:\n\n free(str);\n\n return -1;\n\n}\n"}} {"sample_id": "05b0337025f629d0a6c6321147f06d0da5e32a62", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n {\n YuvPixel p;\n int y, y0;\n+ for (y = 0; y < mp->avctx->height; ++y) {\n+ if (mp->changes_map[y * mp->avctx->width] != 0) {\n+ memset(mp->gradient_scale, 1, sizeof(mp->gradient_scale));\n+ p = mp_get_yuv_from_rgb(mp, 0, y);\n+ } else {\n p.y += mp_gradient(mp, 0, mp_get_vlc(mp, gb));\n p.y = av_clip(p.y, 0, 31);\n if ((y & 3) == 0) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void mp_decode_frame_helper(MotionPixelsContext *mp, GetBitContext *gb)\n{\n YuvPixel p;\n int y, y0;\n for (y = 0; y < mp->avctx->height; ++y) {\n if (mp->changes_map[y * mp->avctx->width] != 0) {\n memset(mp->gradient_scale, 1, sizeof(mp->gradient_scale));\n p = mp_get_yuv_from_rgb(mp, 0, y);\n } else {\n p.y += mp_gradient(mp, 0, mp_get_vlc(mp, gb));\n p.y = av_clip(p.y, 0, 31);\n if ((y & 3) == 0) {\n p.v += mp_gradient(mp, 1, mp_get_vlc(mp, gb));\n p.v = av_clip(p.v, -32, 31);\n p.u += mp_gradient(mp, 2, mp_get_vlc(mp, gb));\n p.u = av_clip(p.u, -32, 31);\n }\n mp->vpt[y] = p;\n mp_set_rgb_from_yuv(mp, 0, y, &p);\n }\n }\n for (y0 = 0; y0 < 2; ++y0)\n for (y = y0; y < mp->avctx->height; y += 2)\n mp_decode_line(mp, gb, y);\n}"}} {"sample_id": "bb23bf8fd7fb4771b0f08a4ee1ba8fe6ca16d14f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n int avfilter_process_command(AVFilterContext *filter, const char *cmd, const char *arg, char *res, int res_len, int flags)\n+{\n+ if(!strcmp(cmd, \"ping\")){\n av_strlcatf(res, res_len, \"pong from:%s %s\\n\", filter->filter->name, filter->name);\n return 0;\n }else if(!strcmp(cmd, \"enable\")) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "int avfilter_process_command(AVFilterContext *filter, const char *cmd, const char *arg, char *res, int res_len, int flags)\n{\n if(!strcmp(cmd, \"ping\")){\n av_strlcatf(res, res_len, \"pong from:%s %s\\n\", filter->filter->name, filter->name);\n return 0;\n }else if(!strcmp(cmd, \"enable\")) {\n return set_enable_expr(filter, arg);\n }else if(filter->filter->process_command) {\n return filter->filter->process_command(filter, cmd, arg, res, res_len, flags);\n return AVERROR(ENOSYS);"}} {"sample_id": "c3adb5b9168a57790b5074489b6f0275ac3cc8b5_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void dma_aio_cancel(BlockDriverAIOCB *acb)\n \n {\n+\n DMAAIOCB *dbs = container_of(acb, DMAAIOCB, common);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void dma_aio_cancel(BlockDriverAIOCB *acb)\n\n{\n\n DMAAIOCB *dbs = container_of(acb, DMAAIOCB, common);\n\n\n\n if (dbs->acb) {\n\n bdrv_aio_cancel(dbs->acb);\n\n }\n\n}\n"}} {"sample_id": "364031f17932814484657e5551ba12957d993d7e_19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,5 +7,5 @@\n errno = ENOTSUP;\n \n return -1;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ssize_t v9fs_synth_llistxattr(FsContext *ctx, V9fsPath *path,\n\n void *value, size_t size)\n\n{\n\n errno = ENOTSUP;\n\n return -1;\n\n}\n"}} {"sample_id": "8194f35a0c71a3bf169459bf715bea53b7bbc904_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n void helper_retry(void)\n+\n+{\n+\n+ env->pc = env->tsptr->tpc;\n+\n+ env->npc = env->tsptr->tnpc;\n \n+ PUT_CCR(env, env->tsptr->tstate >> 32);\n \n env->asi = (env->tsptr->tstate >> 24) & 0xff;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void helper_retry(void)\n\n{\n\n env->pc = env->tsptr->tpc;\n\n env->npc = env->tsptr->tnpc;\n\n PUT_CCR(env, env->tsptr->tstate >> 32);\n\n env->asi = (env->tsptr->tstate >> 24) & 0xff;\n\n change_pstate((env->tsptr->tstate >> 8) & 0xf3f);\n\n PUT_CWP64(env, env->tsptr->tstate & 0xff);\n\n env->tl--;\n\n env->tsptr = &env->ts[env->tl & MAXTL_MASK];\n\n}\n"}} {"sample_id": "5f8632d3c3d7bc5ef24166ba7cf90fcfb2adbf7d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ has_pci_info = false;\n+\n+ has_acpi_build = false;\n+\n+ smbios_defaults = false;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void pc_init_pci_no_kvmclock(MachineState *machine)\n\n{\n\n has_pci_info = false;\n\n has_acpi_build = false;\n\n smbios_defaults = false;\n\n\n\n\n\n\n x86_cpu_compat_disable_kvm_features(FEAT_KVM, KVM_FEATURE_PV_EOI);\n\n enable_compat_apic_id_mode();\n\n pc_init1(machine, 1, 0);\n\n}"}} {"sample_id": "f22d85e9e67262db34504f4079745f9843da6a92_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n guest_fsfreeze_state.status = GUEST_FSFREEZE_STATUS_THAWED;\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void guest_fsfreeze_init(void)\n\n{\n\n guest_fsfreeze_state.status = GUEST_FSFREEZE_STATUS_THAWED;\n\n}\n"}} {"sample_id": "d68a6f3a6deb2f5eee198b6fa46877a20227d86e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -38,11 +38,11 @@\n \n tcg_gen_andi_i32(rm, t1, 0xff000000);\n \n+ tcg_gen_shri_i32(tmp, t0, 8);\n+\n+ tcg_gen_andi_i32(tmp, tmp, 0xff0000);\n+\n+ tcg_gen_or_i32(rm, rm, tmp);\n \n tcg_gen_shri_i32(tmp, t1, 8);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gen_neon_zip_u8(TCGv t0, TCGv t1)\n\n{\n\n TCGv rd, rm, tmp;\n\n\n\n rd = new_tmp();\n\n rm = new_tmp();\n\n tmp = new_tmp();\n\n\n\n tcg_gen_andi_i32(rd, t0, 0xff);\n\n tcg_gen_shli_i32(tmp, t1, 8);\n\n tcg_gen_andi_i32(tmp, tmp, 0xff00);\n\n tcg_gen_or_i32(rd, rd, tmp);\n\n tcg_gen_shli_i32(tmp, t0, 16);\n\n tcg_gen_andi_i32(tmp, tmp, 0xff0000);\n\n tcg_gen_or_i32(rd, rd, tmp);\n\n tcg_gen_shli_i32(tmp, t1, 24);\n\n tcg_gen_andi_i32(tmp, tmp, 0xff000000);\n\n tcg_gen_or_i32(rd, rd, tmp);\n\n\n\n tcg_gen_andi_i32(rm, t1, 0xff000000);\n\n tcg_gen_shri_i32(tmp, t0, 8);\n\n tcg_gen_andi_i32(tmp, tmp, 0xff0000);\n\n tcg_gen_or_i32(rm, rm, tmp);\n\n tcg_gen_shri_i32(tmp, t1, 8);\n\n tcg_gen_andi_i32(tmp, tmp, 0xff00);\n\n tcg_gen_or_i32(rm, rm, tmp);\n\n tcg_gen_shri_i32(tmp, t0, 16);\n\n tcg_gen_andi_i32(tmp, tmp, 0xff);\n\n tcg_gen_or_i32(t1, rm, tmp);\n\n tcg_gen_mov_i32(t0, rd);\n\n\n\n dead_tmp(tmp);\n\n dead_tmp(rm);\n\n dead_tmp(rd);\n\n}\n"}} {"sample_id": "3e4f910c8d490a1490409a7e381dbbb229f9d272", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,7 +19,7 @@\n error_printf_unless_qmp(\n \n \"firstport value of %u makes companion take ports %u - %u, which \"\n+\n \"is outside of the valid range of 0 - %u\\n\", firstport, firstport,\n \n firstport + portcount - 1, NB_PORTS - 1);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int ehci_register_companion(USBBus *bus, USBPort *ports[],\n\n uint32_t portcount, uint32_t firstport)\n\n{\n\n EHCIState *s = container_of(bus, EHCIState, bus);\n\n uint32_t i;\n\n\n\n if (firstport + portcount > NB_PORTS) {\n\n qerror_report(QERR_INVALID_PARAMETER_VALUE, \"firstport\",\n\n \"firstport on masterbus\");\n\n error_printf_unless_qmp(\n\n \"firstport value of %u makes companion take ports %u - %u, which \"\n\n \"is outside of the valid range of 0 - %u\\n\", firstport, firstport,\n\n firstport + portcount - 1, NB_PORTS - 1);\n\n return -1;\n\n }\n\n\n\n for (i = 0; i < portcount; i++) {\n\n if (s->companion_ports[firstport + i]) {\n\n qerror_report(QERR_INVALID_PARAMETER_VALUE, \"masterbus\",\n\n \"an USB masterbus\");\n\n error_printf_unless_qmp(\n\n \"port %u on masterbus %s already has a companion assigned\\n\",\n\n firstport + i, bus->qbus.name);\n\n return -1;\n\n }\n\n }\n\n\n\n for (i = 0; i < portcount; i++) {\n\n s->companion_ports[firstport + i] = ports[i];\n\n s->ports[firstport + i].speedmask |=\n\n USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL;\n\n /* Ensure devs attached before the initial reset go to the companion */\n\n s->portsc[firstport + i] = PORTSC_POWNER;\n\n }\n\n\n\n s->companion_count++;\n\n s->mmio[0x05] = (s->companion_count << 4) | portcount;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "973b1a6b9070e2bf17d17568cbaf4043ce931f51", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n return ff_h264_decoder.flush(avctx);\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vdadec_flush(AVCodecContext *avctx)\n\n{\n\n return ff_h264_decoder.flush(avctx);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_123", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n if ((offset == 0x100) || (offset == 0x108) || (offset == 0x10C)) {\n \n value |= 0x30000000;\n+\n+ }\n+\n+\n+\n return value;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t hb_regs_read(void *opaque, target_phys_addr_t offset,\n\n unsigned size)\n\n{\n\n uint32_t *regs = opaque;\n\n uint32_t value = regs[offset/4];\n\n\n\n if ((offset == 0x100) || (offset == 0x108) || (offset == 0x10C)) {\n\n value |= 0x30000000;\n\n }\n\n\n\n return value;\n\n}\n"}} {"sample_id": "8e758dee663bfda2ccfe0076914bf49108055386", "diff": "--- a/source.c\n+++ b/source.c\n@@ -57,11 +57,11 @@\n \n \n \n+err:\n+\n+ while (--i >= 0) {\n+\n+ obj = sc->threads + i * size;\n \n object_unparent(obj);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void spapr_cpu_core_realize(DeviceState *dev, Error **errp)\n\n{\n\n sPAPRCPUCore *sc = SPAPR_CPU_CORE(OBJECT(dev));\n\n CPUCore *cc = CPU_CORE(OBJECT(dev));\n\n const char *typename = object_class_get_name(sc->cpu_class);\n\n size_t size = object_type_get_instance_size(typename);\n\n Error *local_err = NULL;\n\n Object *obj;\n\n int i;\n\n\n\n sc->threads = g_malloc0(size * cc->nr_threads);\n\n for (i = 0; i < cc->nr_threads; i++) {\n\n char id[32];\n\n void *obj = sc->threads + i * size;\n\n\n\n object_initialize(obj, size, typename);\n\n snprintf(id, sizeof(id), \"thread[%d]\", i);\n\n object_property_add_child(OBJECT(sc), id, obj, &local_err);\n\n if (local_err) {\n\n goto err;\n\n }\n\n\n }\n\n object_child_foreach(OBJECT(dev), spapr_cpu_core_realize_child, &local_err);\n\n if (local_err) {\n\n goto err;\n\n } else {\n\n return;\n\n }\n\n\n\nerr:\n\n while (--i >= 0) {\n\n obj = sc->threads + i * size;\n\n object_unparent(obj);\n\n }\n\n g_free(sc->threads);\n\n error_propagate(errp, local_err);\n\n}"}} {"sample_id": "70976a7926b42d87e0c575412b85a8f5c1e48fad", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n #ifdef WORDS_BIGENDIAN\n \n+ stq_p(mem_buf, env->avr[n].u64[0]);\n \n stq_p(mem_buf+8, env->avr[n].u64[1]);\n \n+#else\n \n stq_p(mem_buf, env->avr[n].u64[1]);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int gdb_get_avr_reg(CPUState *env, uint8_t *mem_buf, int n)\n\n{\n\n if (n < 32) {\n\n#ifdef WORDS_BIGENDIAN\n\n stq_p(mem_buf, env->avr[n].u64[0]);\n\n stq_p(mem_buf+8, env->avr[n].u64[1]);\n\n#else\n\n stq_p(mem_buf, env->avr[n].u64[1]);\n\n stq_p(mem_buf+8, env->avr[n].u64[0]);\n\n#endif\n\n return 16;\n\n }\n\n if (n == 33) {\n\n stl_p(mem_buf, env->vscr);\n\n return 4;\n\n }\n\n if (n == 34) {\n\n stl_p(mem_buf, (uint32_t)env->spr[SPR_VRSAVE]);\n\n return 4;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "b5eff355460643d09e533024360fe0522f368c07_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n BlockDriverAIOCB *bdrv_aio_write(BlockDriverState *bs, int64_t sector_num,\n \n const uint8_t *buf, int nb_sectors,\n+\n BlockDriverCompletionFunc *cb, void *opaque)\n+\n {\n \n BlockDriver *drv = bs->drv;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "BlockDriverAIOCB *bdrv_aio_write(BlockDriverState *bs, int64_t sector_num,\n\n const uint8_t *buf, int nb_sectors,\n\n BlockDriverCompletionFunc *cb, void *opaque)\n\n{\n\n BlockDriver *drv = bs->drv;\n\n BlockDriverAIOCB *ret;\n\n\n\n if (!drv)\n\n return NULL;\n\n if (bs->read_only)\n\n return NULL;\n\n if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors))\n\n return NULL;\n\n if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {\n\n memcpy(bs->boot_sector_data, buf, 512);\n\n }\n\n\n\n ret = drv->bdrv_aio_write(bs, sector_num, buf, nb_sectors, cb, opaque);\n\n\n\n if (ret) {\n\n\t/* Update stats even though technically transfer has not happened. */\n\n\tbs->wr_bytes += (unsigned) nb_sectors * SECTOR_SIZE;\n\n\tbs->wr_ops ++;\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "4a1418e07bdcfaa3177739e04707ecaec75d89e1_21", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n ram_addr_t addr;\n \n if ((last_ram_offset + size) > kqemu_phys_ram_size) {\n+\n+ fprintf(stderr, \"Not enough memory (requested_size = %\" PRIu64 \", max memory = %\" PRIu64 \")\\n\",\n+\n+ (uint64_t)size, (uint64_t)kqemu_phys_ram_size);\n+\n abort();\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ram_addr_t kqemu_ram_alloc(ram_addr_t size)\n\n{\n\n ram_addr_t addr;\n\n if ((last_ram_offset + size) > kqemu_phys_ram_size) {\n\n fprintf(stderr, \"Not enough memory (requested_size = %\" PRIu64 \", max memory = %\" PRIu64 \")\\n\",\n\n (uint64_t)size, (uint64_t)kqemu_phys_ram_size);\n\n abort();\n\n }\n\n addr = last_ram_offset;\n\n last_ram_offset = TARGET_PAGE_ALIGN(last_ram_offset + size);\n\n return addr;\n\n}\n"}} {"sample_id": "0058584580b87feb47898e60e4b80c7f425882ad_18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,9 +11,9 @@\n samples[i] -= samples[i + 512];\n \n samples[i + 256] += samples[i + 768];\n+\n+ samples[i + 512] = samples[i + 768] = 0;\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void downmix_2f_2r_to_dolby(float *samples)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < 256; i++) {\n\n samples[i] -= samples[i + 512];\n\n samples[i + 256] += samples[i + 768];\n\n samples[i + 512] = samples[i + 768] = 0;\n\n }\n\n}\n"}} {"sample_id": "ec50dd4634ae06091e61f42b7ba975f9ed510ad0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n RockerSwitch *qmp_query_rocker(const char *name, Error **errp)\n+\n {\n \n RockerSwitch *rocker = g_malloc0(sizeof(*rocker));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "RockerSwitch *qmp_query_rocker(const char *name, Error **errp)\n\n{\n\n RockerSwitch *rocker = g_malloc0(sizeof(*rocker));\n\n Rocker *r;\n\n\n\n r = rocker_find(name);\n\n if (!r) {\n\n error_set(errp, ERROR_CLASS_GENERIC_ERROR,\n\n \"rocker %s not found\", name);\n\n return NULL;\n\n }\n\n\n\n rocker->name = g_strdup(r->name);\n\n rocker->id = r->switch_id;\n\n rocker->ports = r->fp_ports;\n\n\n\n return rocker;\n\n}\n"}} {"sample_id": "12d4536f7d911b6d87a766ad7300482ea663cea2_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,17 +1,17 @@\n+void qemu_init_vcpu(void *_env)\n+\n+{\n+\n+ CPUState *env = _env;\n+\n+ int r;\n+\n+\n+\n env->nr_cores = smp_cores;\n+\n env->nr_threads = smp_threads;\n+\n \n \n if (kvm_enabled()) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void qemu_init_vcpu(void *_env)\n\n{\n\n CPUState *env = _env;\n\n int r;\n\n\n\n env->nr_cores = smp_cores;\n\n env->nr_threads = smp_threads;\n\n\n\n if (kvm_enabled()) {\n\n r = kvm_init_vcpu(env);\n\n if (r < 0) {\n\n fprintf(stderr, \"kvm_init_vcpu failed: %s\\n\", strerror(-r));\n\n exit(1);\n\n }\n\n qemu_kvm_init_cpu_signals(env);\n\n } else {\n\n qemu_tcg_init_cpu_signals();\n\n }\n\n}\n"}} {"sample_id": "dfd100f242370886bb6732f70f1f7cbd8eb9fedc_25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n char *socket_address_to_string(struct SocketAddress *addr, Error **errp)\n \n {\n+\n+ char *buf;\n+\n+ InetSocketAddress *inet;\n+\n \n \n switch (addr->type) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "char *socket_address_to_string(struct SocketAddress *addr, Error **errp)\n\n{\n\n char *buf;\n\n InetSocketAddress *inet;\n\n\n\n switch (addr->type) {\n\n case SOCKET_ADDRESS_KIND_INET:\n\n inet = addr->u.inet.data;\n\n if (strchr(inet->host, ':') == NULL) {\n\n buf = g_strdup_printf(\"%s:%s\", inet->host, inet->port);\n\n } else {\n\n buf = g_strdup_printf(\"[%s]:%s\", inet->host, inet->port);\n\n }\n\n break;\n\n\n\n case SOCKET_ADDRESS_KIND_UNIX:\n\n buf = g_strdup(addr->u.q_unix.data->path);\n\n break;\n\n\n\n case SOCKET_ADDRESS_KIND_FD:\n\n buf = g_strdup(addr->u.fd.data->str);\n\n break;\n\n\n\n case SOCKET_ADDRESS_KIND_VSOCK:\n\n buf = g_strdup_printf(\"%s:%s\",\n\n addr->u.vsock.data->cid,\n\n addr->u.vsock.data->port);\n\n break;\n\n\n\n default:\n\n abort();\n\n }\n\n return buf;\n\n}\n"}} {"sample_id": "543f8f13e256a081dd820375e9575439b659ccd8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n \"-device ide-cd,drive=sr0,bus=ide.0\", tmp_path);\n \n+ qtest_irq_intercept_in(global_qtest, \"ioapic\");\n+\n+\n+\n+ guest_buf = guest_alloc(guest_malloc, len);\n \n prdt[0].addr = cpu_to_le32(guest_buf);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_cdrom_dma(void)\n\n{\n\n static const size_t len = ATAPI_BLOCK_SIZE;\n\n char *pattern = g_malloc(ATAPI_BLOCK_SIZE * 16);\n\n char *rx = g_malloc0(len);\n\n uintptr_t guest_buf;\n\n PrdtEntry prdt[1];\n\n FILE *fh;\n\n\n\n ide_test_start(\"-drive if=none,file=%s,media=cdrom,format=raw,id=sr0,index=0 \"\n\n \"-device ide-cd,drive=sr0,bus=ide.0\", tmp_path);\n\n qtest_irq_intercept_in(global_qtest, \"ioapic\");\n\n\n\n guest_buf = guest_alloc(guest_malloc, len);\n\n prdt[0].addr = cpu_to_le32(guest_buf);\n\n prdt[0].size = cpu_to_le32(len | PRDT_EOT);\n\n\n\n generate_pattern(pattern, ATAPI_BLOCK_SIZE * 16, ATAPI_BLOCK_SIZE);\n\n fh = fopen(tmp_path, \"w+\");\n\n fwrite(pattern, ATAPI_BLOCK_SIZE, 16, fh);\n\n fclose(fh);\n\n\n\n send_dma_request(CMD_PACKET, 0, 1, prdt, 1, send_scsi_cdb_read10);\n\n\n\n /* Read back data from guest memory into local qtest memory */\n\n memread(guest_buf, rx, len);\n\n g_assert_cmpint(memcmp(pattern, rx, len), ==, 0);\n\n\n\n g_free(pattern);\n\n g_free(rx);\n\n test_bmdma_teardown();\n\n}\n"}} {"sample_id": "cdd85eb2804018ab46a742ebf64dc5366b9fae73_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n int kvm_arch_fixup_msi_route(struct kvm_irq_routing_entry *route,\n \n+ uint64_t address, uint32_t data, PCIDevice *dev)\n \n+{\n \n S390PCIBusDevice *pbdev;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int kvm_arch_fixup_msi_route(struct kvm_irq_routing_entry *route,\n\n uint64_t address, uint32_t data, PCIDevice *dev)\n\n{\n\n S390PCIBusDevice *pbdev;\n\n uint32_t fid = data >> ZPCI_MSI_VEC_BITS;\n\n uint32_t vec = data & ZPCI_MSI_VEC_MASK;\n\n\n\n pbdev = s390_pci_find_dev_by_fid(fid);\n\n if (!pbdev) {\n\n DPRINTF(\"add_msi_route no dev\\n\");\n\n return -ENODEV;\n\n }\n\n\n\n pbdev->routes.adapter.ind_offset = vec;\n\n\n\n route->type = KVM_IRQ_ROUTING_S390_ADAPTER;\n\n route->flags = 0;\n\n route->u.adapter.summary_addr = pbdev->routes.adapter.summary_addr;\n\n route->u.adapter.ind_addr = pbdev->routes.adapter.ind_addr;\n\n route->u.adapter.summary_offset = pbdev->routes.adapter.summary_offset;\n\n route->u.adapter.ind_offset = pbdev->routes.adapter.ind_offset;\n\n route->u.adapter.adapter_id = pbdev->routes.adapter.adapter_id;\n\n return 0;\n\n}\n"}} {"sample_id": "e30004fa733ec64b6ff90678098c1f1132d4d603_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void read_len_table(uint8_t *dst, GetBitContext *gb){\n \n int i, val, repeat;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void read_len_table(uint8_t *dst, GetBitContext *gb){\n\n int i, val, repeat;\n\n\n\n for(i=0; i<256;){\n\n repeat= get_bits(gb, 3);\n\n val = get_bits(gb, 5);\n\n if(repeat==0)\n\n repeat= get_bits(gb, 8);\n\n//printf(\"%d %d\\n\", val, repeat);\n\n while (repeat--)\n\n dst[i++] = val;\n\n }\n\n}\n"}} {"sample_id": "98cb5dccb192b0082626080890dac413473573c6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void ahci_reg_init(AHCIState *s)\n \n+{\n \n int i;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void ahci_reg_init(AHCIState *s)\n\n{\n\n int i;\n\n\n\n s->control_regs.cap = (s->ports - 1) |\n\n (AHCI_NUM_COMMAND_SLOTS << 8) |\n\n (AHCI_SUPPORTED_SPEED_GEN1 << AHCI_SUPPORTED_SPEED) |\n\n HOST_CAP_NCQ | HOST_CAP_AHCI;\n\n\n\n s->control_regs.impl = (1 << s->ports) - 1;\n\n\n\n s->control_regs.version = AHCI_VERSION_1_0;\n\n\n\n for (i = 0; i < s->ports; i++) {\n\n s->dev[i].port_state = STATE_RUN;\n\n }\n\n}\n"}} {"sample_id": "f6774f905fb3cfdc319523ac640be30b14c1bc55_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n int mb_x, mb_y;\n \n \n+\n for(mb_y=s->start_mb_y; mb_y < s->end_mb_y; mb_y++) {\n \n for(mb_x=0; mb_x < s->mb_width; mb_x++) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int mb_var_thread(AVCodecContext *c, void *arg){\n\n MpegEncContext *s= *(void**)arg;\n\n int mb_x, mb_y;\n\n\n\n for(mb_y=s->start_mb_y; mb_y < s->end_mb_y; mb_y++) {\n\n for(mb_x=0; mb_x < s->mb_width; mb_x++) {\n\n int xx = mb_x * 16;\n\n int yy = mb_y * 16;\n\n uint8_t *pix = s->new_picture.f.data[0] + (yy * s->linesize) + xx;\n\n int varc;\n\n int sum = s->dsp.pix_sum(pix, s->linesize);\n\n\n\n varc = (s->dsp.pix_norm1(pix, s->linesize) - (((unsigned)sum*sum)>>8) + 500 + 128)>>8;\n\n\n\n s->current_picture.mb_var [s->mb_stride * mb_y + mb_x] = varc;\n\n s->current_picture.mb_mean[s->mb_stride * mb_y + mb_x] = (sum+128)>>8;\n\n s->me.mb_var_sum_temp += varc;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "83548fe894cdb455cc127f754d09905b6d23c173_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n int ret;\n+\n+ uint8_t buf[ID3v1_TAG_SIZE];\n+\n+ int64_t filesize, position = avio_tell(s->pb);\n+\n \n \n if (s->pb->seekable) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_id3v1_read(AVFormatContext *s)\n\n{\n\n int ret;\n\n uint8_t buf[ID3v1_TAG_SIZE];\n\n int64_t filesize, position = avio_tell(s->pb);\n\n\n\n if (s->pb->seekable) {\n\n /* XXX: change that */\n\n filesize = avio_size(s->pb);\n\n if (filesize > 128) {\n\n avio_seek(s->pb, filesize - 128, SEEK_SET);\n\n ret = avio_read(s->pb, buf, ID3v1_TAG_SIZE);\n\n if (ret == ID3v1_TAG_SIZE) {\n\n parse_tag(s, buf);\n\n }\n\n avio_seek(s->pb, position, SEEK_SET);\n\n }\n\n }\n\n}\n"}} {"sample_id": "9fbf4a58c90183b30bb2c8ad971ccce7e6716a16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n hwaddr physical;\n \n+ int prot;\n \n int access_type;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "hwaddr cpu_mips_translate_address(CPUMIPSState *env, target_ulong address, int rw)\n\n{\n\n hwaddr physical;\n\n int prot;\n\n int access_type;\n\n int ret = 0;\n\n\n\n /* data access */\n\n access_type = ACCESS_INT;\n\n ret = get_physical_address(env, &physical, &prot,\n\n address, rw, access_type);\n\n if (ret != TLBRET_MATCH) {\n\n raise_mmu_exception(env, address, rw, ret);\n\n return -1LL;\n\n } else {\n\n return physical;\n\n }\n\n}\n"}} {"sample_id": "5ff998a233d759d0de83ea6f95c383d03d25d88e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void calc_sums(int pmin, int pmax, uint32_t *data, int n, int pred_order,\n \n uint32_t sums[][MAX_PARTITIONS])\n \n@@ -6,7 +6,7 @@\n \n int i, j;\n \n+ int parts;\n \n uint32_t *res, *res_end;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void calc_sums(int pmin, int pmax, uint32_t *data, int n, int pred_order,\n\n uint32_t sums[][MAX_PARTITIONS])\n\n{\n\n int i, j;\n\n int parts;\n\n uint32_t *res, *res_end;\n\n\n\n /* sums for highest level */\n\n parts = (1 << pmax);\n\n res = &data[pred_order];\n\n res_end = &data[n >> pmax];\n\n for (i = 0; i < parts; i++) {\n\n uint32_t sum = 0;\n\n while (res < res_end)\n\n sum += *(res++);\n\n sums[pmax][i] = sum;\n\n res_end += n >> pmax;\n\n }\n\n /* sums for lower levels */\n\n for (i = pmax - 1; i >= pmin; i--) {\n\n parts = (1 << i);\n\n for (j = 0; j < parts; j++)\n\n sums[i][j] = sums[i+1][2*j] + sums[i+1][2*j+1];\n\n }\n\n}\n"}} {"sample_id": "6a4832caaede15e3d918b1408ff83fe30324507b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n if (h&3) {\n \n+ ff_avg_dirac_pixels32_c(dst, src, stride, h);\n+\n+ } else {\n+\n ff_avg_pixels16_sse2(dst , src[0] , stride, h);\n \n ff_avg_pixels16_sse2(dst+16, src[0]+16, stride, h);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_avg_dirac_pixels32_sse2(uint8_t *dst, const uint8_t *src[5], int stride, int h)\n\n{\n\n if (h&3) {\n\n ff_avg_dirac_pixels32_c(dst, src, stride, h);\n\n } else {\n\n ff_avg_pixels16_sse2(dst , src[0] , stride, h);\n\n ff_avg_pixels16_sse2(dst+16, src[0]+16, stride, h);\n\n }\n\n}\n"}} {"sample_id": "f6774f905fb3cfdc319523ac640be30b14c1bc55_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void x8_init_block_index(MpegEncContext *s){ //FIXME maybe merge with ff_*\n+\n+//not s->linesize as this would be wrong for field pics\n+\n+//not that IntraX8 has interlacing support ;)\n+\n const int linesize = s->current_picture.f.linesize[0];\n \n const int uvlinesize = s->current_picture.f.linesize[1];", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void x8_init_block_index(MpegEncContext *s){ //FIXME maybe merge with ff_*\n\n//not s->linesize as this would be wrong for field pics\n\n//not that IntraX8 has interlacing support ;)\n\n const int linesize = s->current_picture.f.linesize[0];\n\n const int uvlinesize = s->current_picture.f.linesize[1];\n\n\n\n s->dest[0] = s->current_picture.f.data[0];\n\n s->dest[1] = s->current_picture.f.data[1];\n\n s->dest[2] = s->current_picture.f.data[2];\n\n\n\n s->dest[0] += s->mb_y * linesize << 3;\n\n s->dest[1] += ( s->mb_y&(~1) ) * uvlinesize << 2;//chroma blocks are on add rows\n\n s->dest[2] += ( s->mb_y&(~1) ) * uvlinesize << 2;\n\n}\n"}} {"sample_id": "b164d66e35d349de414e2f0d7365a147aba8a620_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,11 +34,11 @@\n \n \n \n+ /* Decorrelate and scale to output depth */\n+\n+ while (count--) {\n+\n+ left = *decoded1 - (*decoded0 / 2);\n \n right = left + *decoded0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ape_unpack_stereo(APEContext *ctx, int count)\n\n{\n\n int32_t left, right;\n\n int32_t *decoded0 = ctx->decoded[0];\n\n int32_t *decoded1 = ctx->decoded[1];\n\n\n\n if (ctx->frameflags & APE_FRAMECODE_STEREO_SILENCE) {\n\n /* We are pure silence, so we're done. */\n\n av_log(ctx->avctx, AV_LOG_DEBUG, \"pure silence stereo\\n\");\n\n return;\n\n }\n\n\n\n entropy_decode(ctx, count, 1);\n\n ape_apply_filters(ctx, decoded0, decoded1, count);\n\n\n\n /* Now apply the predictor decoding */\n\n predictor_decode_stereo(ctx, count);\n\n\n\n /* Decorrelate and scale to output depth */\n\n while (count--) {\n\n left = *decoded1 - (*decoded0 / 2);\n\n right = left + *decoded0;\n\n\n\n *(decoded0++) = left;\n\n *(decoded1++) = right;\n\n }\n\n}\n"}} {"sample_id": "c6d2283068026035a6468aae9dcde953bd7521ac_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void set_dirty_bitmap(BlockDriverState *bs, int64_t sector_num,\n \n int nb_sectors, int dirty)\n+\n {\n+\n int64_t start, end;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void set_dirty_bitmap(BlockDriverState *bs, int64_t sector_num,\n\n int nb_sectors, int dirty)\n\n{\n\n int64_t start, end;\n\n\n\n start = sector_num / BDRV_SECTORS_PER_DIRTY_CHUNK;\n\n end = (sector_num + nb_sectors) / BDRV_SECTORS_PER_DIRTY_CHUNK;\n\n\n\n for (; start <= end; start++) {\n\n bs->dirty_bitmap[start] = dirty;\n\n }\n\n}\n"}} {"sample_id": "daece4c6745b42e8b1e171fb4bf485d5d64fc53f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,5 +5,5 @@\n update_external_clock_pts(is, pts);\n \n }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void check_external_clock_sync(VideoState *is, double pts) {\n\n if (fabs(get_external_clock(is) - pts) > AV_NOSYNC_THRESHOLD) {\n\n update_external_clock_pts(is, pts);\n\n }\n\n}\n"}} {"sample_id": "43b434210e597d484aef57c4139c3126d22b7e2b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n \n \n+ av_assert0(context_count && h->slice_ctx[context_count - 1].mb_y < h->mb_height);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int ff_h264_execute_decode_slices(H264Context *h, unsigned context_count)\n\n{\n\n AVCodecContext *const avctx = h->avctx;\n\n H264SliceContext *sl;\n\n int i;\n\n\n\n av_assert0(context_count && h->slice_ctx[context_count - 1].mb_y < h->mb_height);\n\n\n\n if (h->avctx->hwaccel ||\n\n h->avctx->codec->capabilities & CODEC_CAP_HWACCEL_VDPAU)\n\n return 0;\n\n if (context_count == 1) {\n\n int ret = decode_slice(avctx, &h->slice_ctx[0]);\n\n h->mb_y = h->slice_ctx[0].mb_y;\n\n return ret;\n\n } else {\n\n av_assert0(context_count > 0);\n\n for (i = 1; i < context_count; i++) {\n\n sl = &h->slice_ctx[i];\n\n if (CONFIG_ERROR_RESILIENCE) {\n\n sl->er.error_count = 0;\n\n }\n\n }\n\n\n\n avctx->execute(avctx, decode_slice, h->slice_ctx,\n\n NULL, context_count, sizeof(h->slice_ctx[0]));\n\n\n\n /* pull back stuff from slices to master context */\n\n sl = &h->slice_ctx[context_count - 1];\n\n h->mb_y = sl->mb_y;\n\n if (CONFIG_ERROR_RESILIENCE) {\n\n for (i = 1; i < context_count; i++)\n\n h->slice_ctx[0].er.error_count += h->slice_ctx[i].er.error_count;\n\n }\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "fdbd924b84e85ac5c80f01ee059ed5c81d3cc205", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n int err;\n \n RV34DecContext *r = avctx->priv_data;\n+\n \n \n r->s.avctx = avctx;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int ff_rv34_decode_init_thread_copy(AVCodecContext *avctx)\n\n{\n\n int err;\n\n RV34DecContext *r = avctx->priv_data;\n\n\n\n r->s.avctx = avctx;\n\n\n\n if (avctx->internal->is_copy) {\n\n r->tmp_b_block_base = NULL;\n\n if ((err = ff_MPV_common_init(&r->s)) < 0)\n\n return err;\n\n if ((err = rv34_decoder_alloc(r)) < 0)\n\n return err;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d0df2934ca63a1d5c31602e6558f341bd738bd07", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n } else if (frame_threading_supported && (avctx->thread_type & FF_THREAD_FRAME)) {\n \n avctx->active_thread_type = FF_THREAD_FRAME;\n+\n+ } else {\n+\n+ avctx->active_thread_type = FF_THREAD_SLICE;\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void validate_thread_parameters(AVCodecContext *avctx)\n\n{\n\n int frame_threading_supported = (avctx->codec->capabilities & CODEC_CAP_FRAME_THREADS)\n\n && !(avctx->flags & CODEC_FLAG_TRUNCATED)\n\n && !(avctx->flags & CODEC_FLAG_LOW_DELAY)\n\n && !(avctx->flags2 & CODEC_FLAG2_CHUNKS);\n\n if (avctx->thread_count == 1) {\n\n avctx->active_thread_type = 0;\n\n } else if (frame_threading_supported && (avctx->thread_type & FF_THREAD_FRAME)) {\n\n avctx->active_thread_type = FF_THREAD_FRAME;\n\n } else {\n\n avctx->active_thread_type = FF_THREAD_SLICE;\n\n }\n\n}\n"}} {"sample_id": "de50a20a4cc368d241d67c600f8c0f667186a8b5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void bdrv_io_limits_enable(BlockDriverState *bs)\n \n+{\n \n assert(!bs->io_limits_enabled);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void bdrv_io_limits_enable(BlockDriverState *bs)\n\n{\n\n assert(!bs->io_limits_enabled);\n\n throttle_init(&bs->throttle_state,\n\n bdrv_get_aio_context(bs),\n\n QEMU_CLOCK_VIRTUAL,\n\n bdrv_throttle_read_timer_cb,\n\n bdrv_throttle_write_timer_cb,\n\n bs);\n\n bs->io_limits_enabled = true;\n\n}\n"}} {"sample_id": "1da41cc1c6c3efbe2ed47228068bd80dbdc49d0e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n if (kvm_vm_ioctl(kvm_state, KVM_ARM_SET_DEVICE_ADDR,\n \n+ &kd->kda) < 0) {\n+\n+ fprintf(stderr, \"KVM_ARM_SET_DEVICE_ADDRESS failed: %s\\n\",\n+\n+ strerror(errno));\n \n abort();\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void kvm_arm_machine_init_done(Notifier *notifier, void *data)\n\n{\n\n KVMDevice *kd, *tkd;\n\n\n\n memory_listener_unregister(&devlistener);\n\n QSLIST_FOREACH_SAFE(kd, &kvm_devices_head, entries, tkd) {\n\n if (kd->kda.addr != -1) {\n\n if (kvm_vm_ioctl(kvm_state, KVM_ARM_SET_DEVICE_ADDR,\n\n &kd->kda) < 0) {\n\n fprintf(stderr, \"KVM_ARM_SET_DEVICE_ADDRESS failed: %s\\n\",\n\n strerror(errno));\n\n abort();\n\n }\n\n }\n\n memory_region_unref(kd->mr);\n\n g_free(kd);\n\n }\n\n}\n"}} {"sample_id": "3b098d56979d2f7fd707c5be85555d114353a28d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n data->qov = qmp_output_visitor_new();\n \n+ g_assert(data->qov != NULL);\n+\n+\n+\n data->ov = qmp_output_get_visitor(data->qov);\n \n g_assert(data->ov != NULL);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void visitor_output_setup(TestOutputVisitorData *data,\n\n const void *unused)\n\n{\n\n data->qov = qmp_output_visitor_new();\n\n g_assert(data->qov != NULL);\n\n\n\n data->ov = qmp_output_get_visitor(data->qov);\n\n g_assert(data->ov != NULL);\n\n}\n"}} {"sample_id": "98e42a249e7891d295228ff19892450ba1f09092", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n enum AVCodecID av_guess_codec(AVOutputFormat *fmt, const char *short_name,\n \n+ const char *filename, const char *mime_type,\n \n enum AVMediaType type)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "enum AVCodecID av_guess_codec(AVOutputFormat *fmt, const char *short_name,\n\n const char *filename, const char *mime_type,\n\n enum AVMediaType type)\n\n{\n\n if (av_match_name(\"segment\", fmt->name) || av_match_name(\"ssegment\", fmt->name)) {\n\n fmt = av_guess_format(NULL, filename, NULL);\n\n }\n\n\n\n if (type == AVMEDIA_TYPE_VIDEO) {\n\n enum AVCodecID codec_id = AV_CODEC_ID_NONE;\n\n\n\n#if CONFIG_IMAGE2_MUXER\n\n if (!strcmp(fmt->name, \"image2\") || !strcmp(fmt->name, \"image2pipe\")) {\n\n codec_id = ff_guess_image2_codec(filename);\n\n }\n\n#endif\n\n if (codec_id == AV_CODEC_ID_NONE)\n\n codec_id = fmt->video_codec;\n\n return codec_id;\n\n } else if (type == AVMEDIA_TYPE_AUDIO)\n\n return fmt->audio_codec;\n\n else if (type == AVMEDIA_TYPE_SUBTITLE)\n\n return fmt->subtitle_codec;\n\n else\n\n return AV_CODEC_ID_NONE;\n\n}\n"}} {"sample_id": "bdb5ee3064d5ae786b0bcb6cf6ff4e3554a72990", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n rom->isrom ? \"rom\" : \"ram\",\n \n+ rom->name);\n+\n+ } else {\n+\n+ monitor_printf(mon, \"fw=%s%s%s\"\n \n \" size=0x%06zx name=\\\"%s\\\" \\n\",\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void do_info_roms(Monitor *mon)\n\n{\n\n Rom *rom;\n\n\n\n QTAILQ_FOREACH(rom, &roms, next) {\n\n if (!rom->fw_file) {\n\n monitor_printf(mon, \"addr=\" TARGET_FMT_plx\n\n \" size=0x%06zx mem=%s name=\\\"%s\\\" \\n\",\n\n rom->addr, rom->romsize,\n\n rom->isrom ? \"rom\" : \"ram\",\n\n rom->name);\n\n } else {\n\n monitor_printf(mon, \"fw=%s%s%s\"\n\n \" size=0x%06zx name=\\\"%s\\\" \\n\",\n\n rom->fw_dir ? rom->fw_dir : \"\",\n\n rom->fw_dir ? \"/\" : \"\",\n\n rom->fw_file,\n\n rom->romsize,\n\n rom->name);\n\n }\n\n }\n\n}\n"}} {"sample_id": "0aa7a205c899c516d906673efbe9457f7af0dd3c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n \n \n+ p = str;\n+\n+ while (*p != '\\0') {\n+\n+ p = get_opt_name(name_buf, name_buf_size, p, '=');\n \n if (*p != '=') {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int check_params(const char * const *params, const char *str)\n\n{\n\n int name_buf_size = 1;\n\n const char *p;\n\n char *name_buf;\n\n int i, len;\n\n int ret = 0;\n\n\n\n for (i = 0; params[i] != NULL; i++) {\n\n len = strlen(params[i]) + 1;\n\n if (len > name_buf_size) {\n\n name_buf_size = len;\n\n }\n\n }\n\n name_buf = qemu_malloc(name_buf_size);\n\n\n\n p = str;\n\n while (*p != '\\0') {\n\n p = get_opt_name(name_buf, name_buf_size, p, '=');\n\n if (*p != '=') {\n\n ret = -1;\n\n break;\n\n }\n\n p++;\n\n for(i = 0; params[i] != NULL; i++)\n\n if (!strcmp(params[i], name_buf))\n\n break;\n\n if (params[i] == NULL) {\n\n ret = -1;\n\n break;\n\n }\n\n p = get_opt_value(NULL, 0, p);\n\n if (*p != ',')\n\n break;\n\n p++;\n\n }\n\n\n\n qemu_free(name_buf);\n\n return ret;\n\n}\n"}} {"sample_id": "13a099799e89a76eb921ca452e1b04a7a28a9855_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n uint8_t *aDest, int dstW, int chrDstW)\n \n {\n+\n+ int p= 4;\n+\n+ const int16_t *src[4]= { alpSrc + dstW, lumSrc + dstW, chrUSrc + chrDstW, chrVSrc + chrDstW };\n+\n uint8_t *dst[4]= { aDest, dest, uDest, vDest };\n \n x86_reg counter[4]= { dstW, dstW, chrDstW, chrDstW };", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void RENAME(yuv2yuv1)(SwsContext *c, const int16_t *lumSrc,\n\n const int16_t *chrUSrc, const int16_t *chrVSrc,\n\n const int16_t *alpSrc,\n\n uint8_t *dest, uint8_t *uDest, uint8_t *vDest,\n\n uint8_t *aDest, int dstW, int chrDstW)\n\n{\n\n int p= 4;\n\n const int16_t *src[4]= { alpSrc + dstW, lumSrc + dstW, chrUSrc + chrDstW, chrVSrc + chrDstW };\n\n uint8_t *dst[4]= { aDest, dest, uDest, vDest };\n\n x86_reg counter[4]= { dstW, dstW, chrDstW, chrDstW };\n\n\n\n while (p--) {\n\n if (dst[p]) {\n\n __asm__ volatile(\n\n \"mov %2, %%\"REG_a\" \\n\\t\"\n\n \".p2align 4 \\n\\t\" /* FIXME Unroll? */\n\n \"1: \\n\\t\"\n\n \"movq (%0, %%\"REG_a\", 2), %%mm0 \\n\\t\"\n\n \"movq 8(%0, %%\"REG_a\", 2), %%mm1 \\n\\t\"\n\n \"psraw $7, %%mm0 \\n\\t\"\n\n \"psraw $7, %%mm1 \\n\\t\"\n\n \"packuswb %%mm1, %%mm0 \\n\\t\"\n\n MOVNTQ(%%mm0, (%1, %%REGa))\n\n \"add $8, %%\"REG_a\" \\n\\t\"\n\n \"jnc 1b \\n\\t\"\n\n :: \"r\" (src[p]), \"r\" (dst[p] + counter[p]),\n\n \"g\" (-counter[p])\n\n : \"%\"REG_a\n\n );\n\n }\n\n }\n\n}\n"}} {"sample_id": "cf818be4f2f1e06bf63da3a6b55a4c3620952070", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ int lo, hi;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int make_ydt24_entry(int p1, int p2, int16_t *ydt)\n\n{\n\n int lo, hi;\n\n\n\n lo = ydt[p1];\n\n hi = ydt[p2];\n\n return (lo + (hi << 8) + (hi << 16)) << 1;\n\n}\n"}} {"sample_id": "80ca19f766aea8f4724aac1b3faa772d25163c8a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n pix = *s->stream_ptr++;\n \n \n+\n+ for (y = 0; y < 8; y++) {\n+\n+ memset(s->pixel_ptr, pix, 8);\n+\n s->pixel_ptr += s->stride;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ipvideo_decode_block_opcode_0xE(IpvideoContext *s)\n\n{\n\n int y;\n\n unsigned char pix;\n\n\n\n /* 1-color encoding: the whole block is 1 solid color */\n\n CHECK_STREAM_PTR(1);\n\n pix = *s->stream_ptr++;\n\n\n\n for (y = 0; y < 8; y++) {\n\n memset(s->pixel_ptr, pix, 8);\n\n s->pixel_ptr += s->stride;\n\n }\n\n\n\n /* report success */\n\n return 0;\n\n}\n"}} {"sample_id": "7da76e12cc5cc902dda4c168d8d608fd4e61cbc5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n \n \n if (msix_enabled(pci_dev)) {\n+\n+ trace_usb_xhci_irq_msix(v);\n+\n+ msix_notify(pci_dev, v);\n+\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void xhci_intr_raise(XHCIState *xhci, int v)\n\n{\n\n PCIDevice *pci_dev = PCI_DEVICE(xhci);\n\n\n\n\n xhci->intr[v].erdp_low |= ERDP_EHB;\n\n xhci->intr[v].iman |= IMAN_IP;\n\n xhci->usbsts |= USBSTS_EINT;\n\n\n\n\n\n\n if (!(xhci->intr[v].iman & IMAN_IE)) {\n\n\n\n\n\n if (!(xhci->usbcmd & USBCMD_INTE)) {\n\n\n\n\n\n if (msix_enabled(pci_dev)) {\n\n trace_usb_xhci_irq_msix(v);\n\n msix_notify(pci_dev, v);\n\n\n\n\n\n if (msi_enabled(pci_dev)) {\n\n trace_usb_xhci_irq_msi(v);\n\n msi_notify(pci_dev, v);\n\n\n\n\n\n if (v == 0) {\n\n trace_usb_xhci_irq_intx(1);\n\n pci_irq_assert(pci_dev);\n\n"}} {"sample_id": "d5b93ddfefe63d5869a8eb97ea3474867d3b105b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n int xen_be_init(void)\n \n+{\n+\n+ xenstore = xs_daemon_open();\n+\n+ if (!xenstore) {\n \n xen_be_printf(NULL, 0, \"can't connect to xenstored\\n\");\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int xen_be_init(void)\n\n{\n\n xenstore = xs_daemon_open();\n\n if (!xenstore) {\n\n xen_be_printf(NULL, 0, \"can't connect to xenstored\\n\");\n\n return -1;\n\n }\n\n\n\n if (qemu_set_fd_handler(xs_fileno(xenstore), xenstore_update, NULL, NULL) < 0) {\n\n goto err;\n\n }\n\n\n\n xen_xc = xc_interface_open();\n\n if (xen_xc == -1) {\n\n xen_be_printf(NULL, 0, \"can't open xen interface\\n\");\n\n goto err;\n\n }\n\n return 0;\n\n\n\nerr:\n\n qemu_set_fd_handler(xs_fileno(xenstore), NULL, NULL, NULL);\n\n xs_daemon_close(xenstore);\n\n xenstore = NULL;\n\n\n\n return -1;\n\n}\n"}} {"sample_id": "e23a1b33b53d25510320b26d9f154e19c6c99725_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n PCIDevice *d;\n \n+ I440FXState *s;\n \n PIIX3State *piix3;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "PCIBus *i440fx_init(PCII440FXState **pi440fx_state, int *piix3_devfn, qemu_irq *pic)\n\n{\n\n DeviceState *dev;\n\n PCIBus *b;\n\n PCIDevice *d;\n\n I440FXState *s;\n\n PIIX3State *piix3;\n\n\n\n dev = qdev_create(NULL, \"i440FX-pcihost\");\n\n s = FROM_SYSBUS(I440FXState, sysbus_from_qdev(dev));\n\n b = pci_bus_new(&s->busdev.qdev, NULL, 0);\n\n s->bus = b;\n\n qdev_init(dev);\n\n\n\n d = pci_create_simple(b, 0, \"i440FX\");\n\n *pi440fx_state = DO_UPCAST(PCII440FXState, dev, d);\n\n\n\n piix3 = DO_UPCAST(PIIX3State, dev,\n\n pci_create_simple(b, -1, \"PIIX3\"));\n\n piix3->pic = pic;\n\n pci_bus_irqs(b, piix3_set_irq, pci_slot_get_pirq, piix3, 4);\n\n (*pi440fx_state)->piix3 = piix3;\n\n\n\n *piix3_devfn = piix3->dev.devfn;\n\n\n\n return b;\n\n}\n"}} {"sample_id": "ad8efe4b6e27f0ea87d6510c11ae11377eade93d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n monitor_hd[i] = NULL;\n }\n is_first_init = 0;\n+ }\n+ for (i = 0; i < MAX_MON; i++) {\n+ if (monitor_hd[i] == NULL) {\n+ monitor_hd[i] = hd;\n break;\n }\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void monitor_init(CharDriverState *hd, int show_banner)\n{\n int i;\n if (is_first_init) {\n for (i = 0; i < MAX_MON; i++) {\n monitor_hd[i] = NULL;\n }\n is_first_init = 0;\n }\n for (i = 0; i < MAX_MON; i++) {\n if (monitor_hd[i] == NULL) {\n monitor_hd[i] = hd;\n break;\n }\n }\n hide_banner = !show_banner;\n qemu_chr_add_handlers(hd, term_can_read, term_read, term_event, NULL);\n}"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,6 +6,6 @@\n \n qemu_get_8s(f, v);\n \n+ return 0;\n+\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int get_uint8(QEMUFile *f, void *pv, size_t size)\n\n{\n\n uint8_t *v = pv;\n\n qemu_get_8s(f, v);\n\n return 0;\n\n}\n"}} {"sample_id": "b227a8e9aa5f27d29f77ba90d5eb9d0662a1175e_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int pte32_check (mmu_ctx_t *ctx,\n \n+ target_ulong pte0, target_ulong pte1, int h, int rw)\n+\n {\n \n return _pte_check(ctx, 0, pte0, pte1, h, rw);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pte32_check (mmu_ctx_t *ctx,\n\n target_ulong pte0, target_ulong pte1, int h, int rw)\n\n{\n\n return _pte_check(ctx, 0, pte0, pte1, h, rw);\n\n}\n"}} {"sample_id": "ec7f04c13a6e6e483cc86e576aff7700e42cd59e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n {\n \n+ uint8_t indices[16];\n \n int x, y;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void rgtc_block_internal(uint8_t *dst, ptrdiff_t stride,\n\n const uint8_t *block,\n\n const int *color_tab)\n\n{\n\n uint8_t indices[16];\n\n int x, y;\n\n\n\n decompress_indices(indices, block + 2);\n\n\n\n /* Only one or two channels are stored at most, since it only used to\n\n * compress specular (black and white) or normal (red and green) maps.\n\n * Although the standard says to zero out unused components, many\n\n * implementations fill all of them with the same value. */\n\n for (y = 0; y < 4; y++) {\n\n for (x = 0; x < 4; x++) {\n\n int i = indices[x + y * 4];\n\n /* Interval expansion from [-1 1] or [0 1] to [0 255]. */\n\n int c = color_tab[i];\n\n uint32_t pixel = RGBA(c, c, c, 255);\n\n AV_WL32(dst + x * 4 + y * stride, pixel);\n\n }\n\n }\n\n}\n"}} {"sample_id": "bb00021de0b5908bc2c3ca467ad9a2b0c9c36459", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,7 +15,7 @@\n error_setg(&bs->backing_blocker,\n \n \"device is used as backing hd of '%s'\",\n+\n bdrv_get_device_name(bs));\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd)\n\n{\n\n\n\n if (bs->backing_hd) {\n\n assert(bs->backing_blocker);\n\n bdrv_op_unblock_all(bs->backing_hd, bs->backing_blocker);\n\n } else if (backing_hd) {\n\n error_setg(&bs->backing_blocker,\n\n \"device is used as backing hd of '%s'\",\n\n bdrv_get_device_name(bs));\n\n }\n\n\n\n bs->backing_hd = backing_hd;\n\n if (!backing_hd) {\n\n error_free(bs->backing_blocker);\n\n bs->backing_blocker = NULL;\n\n goto out;\n\n }\n\n bs->open_flags &= ~BDRV_O_NO_BACKING;\n\n pstrcpy(bs->backing_file, sizeof(bs->backing_file), backing_hd->filename);\n\n pstrcpy(bs->backing_format, sizeof(bs->backing_format),\n\n backing_hd->drv ? backing_hd->drv->format_name : \"\");\n\n\n\n bdrv_op_block_all(bs->backing_hd, bs->backing_blocker);\n\n /* Otherwise we won't be able to commit due to check in bdrv_commit */\n\n bdrv_op_unblock(bs->backing_hd, BLOCK_OP_TYPE_COMMIT,\n\n bs->backing_blocker);\n\nout:\n\n bdrv_refresh_limits(bs, NULL);\n\n}\n"}} {"sample_id": "ac4b32df71bd932838043a4838b86d11e169707f_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+int check_tm_pred8x8_mode(int mode, int mb_x, int mb_y)\n+\n {\n \n if (!mb_x)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int check_tm_pred8x8_mode(int mode, int mb_x, int mb_y)\n\n{\n\n if (!mb_x)\n\n return mb_y ? VERT_PRED8x8 : DC_129_PRED8x8;\n\n else\n\n return mb_y ? mode : HOR_PRED8x8;\n\n}\n"}} {"sample_id": "8b3b720620a1137a1b794fc3ed64734236f94e06_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,7 +16,7 @@\n \n \n \n+ /* cannot proceed if image has snapshots */\n \n if (s->nb_snapshots) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int qcow2_truncate(BlockDriverState *bs, int64_t offset)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n int ret, new_l1_size;\n\n\n\n if (offset & 511) {\n\n return -EINVAL;\n\n }\n\n\n\n /* cannot proceed if image has snapshots */\n\n if (s->nb_snapshots) {\n\n return -ENOTSUP;\n\n }\n\n\n\n /* shrinking is currently not supported */\n\n if (offset < bs->total_sectors * 512) {\n\n return -ENOTSUP;\n\n }\n\n\n\n new_l1_size = size_to_l1(s, offset);\n\n ret = qcow2_grow_l1_table(bs, new_l1_size);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n\n\n /* write updated header.size */\n\n offset = cpu_to_be64(offset);\n\n ret = bdrv_pwrite(bs->file, offsetof(QCowHeader, size),\n\n &offset, sizeof(uint64_t));\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n\n\n s->l1_vm_state_index = new_l1_size;\n\n return 0;\n\n}\n"}} {"sample_id": "f0da370a523d76fb5f48e58537f26a9d949e9c05", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,22 +1,22 @@\n+static void display_picref(AVFilterBufferRef *picref, AVRational time_base)\n \n {\n \n+ int x, y;\n \n+ uint8_t *p0, *p;\n \n int64_t delay;\n+\n \n+\n if (picref->pts != AV_NOPTS_VALUE) {\n+\n if (last_pts != AV_NOPTS_VALUE) {\n+\n /* sleep roughly the right amount of time;\n \n+ * usleep is in microseconds, just like AV_TIME_BASE. */\n \n delay = av_rescale_q(picref->pts - last_pts,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void display_picref(AVFilterBufferRef *picref, AVRational time_base)\n\n{\n\n int x, y;\n\n uint8_t *p0, *p;\n\n int64_t delay;\n\n\n\n if (picref->pts != AV_NOPTS_VALUE) {\n\n if (last_pts != AV_NOPTS_VALUE) {\n\n /* sleep roughly the right amount of time;\n\n * usleep is in microseconds, just like AV_TIME_BASE. */\n\n delay = av_rescale_q(picref->pts - last_pts,\n\n time_base, AV_TIME_BASE_Q);\n\n if (delay > 0 && delay < 1000000)\n\n usleep(delay);\n\n }\n\n last_pts = picref->pts;\n\n }\n\n\n\n /* Trivial ASCII grayscale display. */\n\n p0 = picref->data[0];\n\n puts(\"\\033c\");\n\n for (y = 0; y < picref->video->h; y++) {\n\n p = p0;\n\n for (x = 0; x < picref->video->w; x++)\n\n putchar(\" .-+#\"[*(p++) / 52]);\n\n putchar('\\n');\n\n p0 += picref->linesize[0];\n\n }\n\n fflush(stdout);\n\n}\n"}} {"sample_id": "1bcef683bf840a928d633755031ac572d5fdb851", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n if (!context.err) {\n \n+ vm_start();\n+\n+ return 0;\n+\n+ } else {\n \n return -1;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int do_cont(Monitor *mon, const QDict *qdict, QObject **ret_data)\n\n{\n\n struct bdrv_iterate_context context = { mon, 0 };\n\n\n\n if (incoming_expected) {\n\n qerror_report(QERR_MIGRATION_EXPECTED);\n\n return -1;\n\n }\n\n bdrv_iterate(encrypted_bdrv_it, &context);\n\n /* only resume the vm if all keys are set and valid */\n\n if (!context.err) {\n\n vm_start();\n\n return 0;\n\n } else {\n\n return -1;\n\n }\n\n}\n"}} {"sample_id": "7effbee66cf457c62f795d9b9ed3a1110b364b89_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n \n pkt->stream_index = 0;\n+\n+ return 0;\n+\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int apc_read_packet(AVFormatContext *s, AVPacket *pkt)\n\n{\n\n if (av_get_packet(s->pb, pkt, MAX_READ_SIZE) <= 0)\n\n return AVERROR(EIO);\n\n\n pkt->stream_index = 0;\n\n return 0;\n\n}"}} {"sample_id": "973b1a6b9070e2bf17d17568cbaf4043ce931f51_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,8 +12,8 @@\n \n if (ctx->h264_initialized)\n \n+ ff_h264_decoder.close(avctx);\n+\n+ return 0;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int vdadec_close(AVCodecContext *avctx)\n\n{\n\n VDADecoderContext *ctx = avctx->priv_data;\n\n /* release buffers and decoder */\n\n ff_vda_destroy_decoder(&ctx->vda_ctx);\n\n /* close H.264 decoder */\n\n if (ctx->h264_initialized)\n\n ff_h264_decoder.close(avctx);\n\n return 0;\n\n}\n"}} {"sample_id": "f5438c0500bb22c97b30987d2e0eab953416c7c5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n char buf[1024];\n \n \n+\n+ p = cmdline;\n+\n+ nb_args = 0;\n+\n for(;;) {\n \n while (qemu_isspace(*p))", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void parse_cmdline(const char *cmdline,\n\n int *pnb_args, char **args)\n\n{\n\n const char *p;\n\n int nb_args, ret;\n\n char buf[1024];\n\n\n\n p = cmdline;\n\n nb_args = 0;\n\n for(;;) {\n\n while (qemu_isspace(*p))\n\n p++;\n\n if (*p == '\\0')\n\n break;\n\n if (nb_args >= MAX_ARGS)\n\n break;\n\n ret = get_str(buf, sizeof(buf), &p);\n\n args[nb_args] = g_strdup(buf);\n\n nb_args++;\n\n if (ret < 0)\n\n break;\n\n }\n\n *pnb_args = nb_args;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_309", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n case 0x08:\t/* READ_TIM */\n \n return omap_timer_read(s);\n+\n+ }\n+\n+\n+\n OMAP_BAD_REG(addr);\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t omap_mpu_timer_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n struct omap_mpu_timer_s *s = (struct omap_mpu_timer_s *) opaque;\n\n\n\n if (size != 4) {\n\n return omap_badwidth_read32(opaque, addr);\n\n }\n\n\n\n switch (addr) {\n\n case 0x00:\t/* CNTL_TIMER */\n\n return (s->enable << 5) | (s->ptv << 2) | (s->ar << 1) | s->st;\n\n\n\n case 0x04:\t/* LOAD_TIM */\n\n break;\n\n\n\n case 0x08:\t/* READ_TIM */\n\n return omap_timer_read(s);\n\n }\n\n\n\n OMAP_BAD_REG(addr);\n\n return 0;\n\n}\n"}} {"sample_id": "3a130f4ef07f4532500473aeab43c86a3c2991c8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n \n \n if (mr->ops->old_portio) {\n+\n+ const MemoryRegionPortio *mrp = find_portio(mr, offset, width, false);\n+\n+\n+\n *data = ((uint64_t)1 << (width * 8)) - 1;\n \n if (mrp) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void memory_region_iorange_read(IORange *iorange,\n\n uint64_t offset,\n\n unsigned width,\n\n uint64_t *data)\n\n{\n\n MemoryRegion *mr = container_of(iorange, MemoryRegion, iorange);\n\n\n\n if (mr->ops->old_portio) {\n\n const MemoryRegionPortio *mrp = find_portio(mr, offset, width, false);\n\n\n\n *data = ((uint64_t)1 << (width * 8)) - 1;\n\n if (mrp) {\n\n *data = mrp->read(mr->opaque, offset - mrp->offset);\n\n }\n\n return;\n\n }\n\n *data = mr->ops->read(mr->opaque, offset, width);\n\n}\n"}} {"sample_id": "6482b0ffd12ce83810c10b1a3884a75eba2ade1a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void cpu_inject_ext(S390CPU *cpu, uint32_t code, uint32_t param,\n+\n+ uint64_t param64)\n+\n+{\n+\n CPUS390XState *env = &cpu->env;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void cpu_inject_ext(S390CPU *cpu, uint32_t code, uint32_t param,\n\n uint64_t param64)\n\n{\n\n CPUS390XState *env = &cpu->env;\n\n\n\n if (env->ext_index == MAX_EXT_QUEUE - 1) {\n\n /* ugh - can't queue anymore. Let's drop. */\n\n return;\n\n }\n\n\n\n env->ext_index++;\n\n assert(env->ext_index < MAX_EXT_QUEUE);\n\n\n\n env->ext_queue[env->ext_index].code = code;\n\n env->ext_queue[env->ext_index].param = param;\n\n env->ext_queue[env->ext_index].param64 = param64;\n\n\n\n env->pending_int |= INTERRUPT_EXT;\n\n cpu_interrupt(CPU(cpu), CPU_INTERRUPT_HARD);\n\n}\n"}} {"sample_id": "dd44d9e316c17f473eff9f4a5a94ad0d7adb157e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int adts_write_header(AVFormatContext *s)\n \n {\n+\n ADTSContext *adts = s->priv_data;\n \n AVCodecContext *avc = s->streams[0]->codec;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int adts_write_header(AVFormatContext *s)\n\n{\n\n ADTSContext *adts = s->priv_data;\n\n AVCodecContext *avc = s->streams[0]->codec;\n\n\n\n if(avc->extradata_size > 0)\n\n decode_extradata(adts, avc->extradata, avc->extradata_size);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "56ad3e54dad6cdcee8668d170df161d89581846f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+ssize_t pt_getxattr(FsContext *ctx, const char *path, const char *name,\n+\n+ void *value, size_t size)\n+\n+{\n+\n+ char *buffer;\n \n ssize_t ret;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "ssize_t pt_getxattr(FsContext *ctx, const char *path, const char *name,\n\n void *value, size_t size)\n\n{\n\n char *buffer;\n\n ssize_t ret;\n\n\n\n buffer = rpath(ctx, path);\n\n ret = lgetxattr(buffer, name, value, size);\n\n g_free(buffer);\n\n return ret;\n\n}\n"}} {"sample_id": "fd56e0612b6454a282fa6a953fdb09281a98c589_18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n memcpy(lpc->chip_config + addr, &val, len);\n \n pci_bus_fire_intx_routing_notifier(lpc->d.bus);\n+\n+ ich9_cc_update(lpc);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ich9_cc_write(void *opaque, hwaddr addr,\n\n uint64_t val, unsigned len)\n\n{\n\n ICH9LPCState *lpc = (ICH9LPCState *)opaque;\n\n\n\n ich9_cc_addr_len(&addr, &len);\n\n memcpy(lpc->chip_config + addr, &val, len);\n\n pci_bus_fire_intx_routing_notifier(lpc->d.bus);\n\n ich9_cc_update(lpc);\n\n}\n"}} {"sample_id": "786a4ea82ec9c87e3a895cf41081029b285a5fe5_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n bitmap_size = bdrv_nb_sectors(bs);\n \n if (bitmap_size < 0) {\n+\n+ error_setg_errno(errp, -bitmap_size, \"could not get length of device\");\n+\n+ errno = -bitmap_size;\n+\n return NULL;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "BdrvDirtyBitmap *bdrv_create_dirty_bitmap(BlockDriverState *bs, int granularity,\n\n Error **errp)\n\n{\n\n int64_t bitmap_size;\n\n BdrvDirtyBitmap *bitmap;\n\n\n\n assert((granularity & (granularity - 1)) == 0);\n\n\n\n granularity >>= BDRV_SECTOR_BITS;\n\n assert(granularity);\n\n bitmap_size = bdrv_nb_sectors(bs);\n\n if (bitmap_size < 0) {\n\n error_setg_errno(errp, -bitmap_size, \"could not get length of device\");\n\n errno = -bitmap_size;\n\n return NULL;\n\n }\n\n bitmap = g_new0(BdrvDirtyBitmap, 1);\n\n bitmap->bitmap = hbitmap_alloc(bitmap_size, ffs(granularity) - 1);\n\n QLIST_INSERT_HEAD(&bs->dirty_bitmaps, bitmap, list);\n\n return bitmap;\n\n}\n"}} {"sample_id": "5b6d5596807e546d87f0afd1fb760b0f887b5c97", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n file_oformat = guess_format(arg, NULL, NULL);\n \n+ if (!file_iformat && !file_oformat) {\n+\n+ fprintf(stderr, \"Unknown input or output format: %s\\n\", arg);\n+\n+ exit(1);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void opt_format(const char *arg)\n\n{\n\n /* compatibility stuff for pgmyuv */\n\n if (!strcmp(arg, \"pgmyuv\")) {\n\n opt_image_format(arg);\n\n arg = \"image\";\n\n }\n\n\n\n file_iformat = av_find_input_format(arg);\n\n file_oformat = guess_format(arg, NULL, NULL);\n\n if (!file_iformat && !file_oformat) {\n\n fprintf(stderr, \"Unknown input or output format: %s\\n\", arg);\n\n exit(1);\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_295", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n section = &phys_sections[phys_section_rom];\n \n+ }\n+\n+ io_mem_write(section->mr, addr, val, 4);\n+\n+ } else {\n \n unsigned long addr1 = (memory_region_get_ram_addr(section->mr)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void stl_phys_notdirty(target_phys_addr_t addr, uint32_t val)\n\n{\n\n uint8_t *ptr;\n\n MemoryRegionSection *section;\n\n\n\n section = phys_page_find(address_space_memory.dispatch, addr >> TARGET_PAGE_BITS);\n\n\n\n if (!memory_region_is_ram(section->mr) || section->readonly) {\n\n addr = memory_region_section_addr(section, addr);\n\n if (memory_region_is_ram(section->mr)) {\n\n section = &phys_sections[phys_section_rom];\n\n }\n\n io_mem_write(section->mr, addr, val, 4);\n\n } else {\n\n unsigned long addr1 = (memory_region_get_ram_addr(section->mr)\n\n & TARGET_PAGE_MASK)\n\n + memory_region_section_addr(section, addr);\n\n ptr = qemu_get_ram_ptr(addr1);\n\n stl_p(ptr, val);\n\n\n\n if (unlikely(in_migration)) {\n\n if (!cpu_physical_memory_is_dirty(addr1)) {\n\n /* invalidate code */\n\n tb_invalidate_phys_page_range(addr1, addr1 + 4, 0);\n\n /* set dirty bit */\n\n cpu_physical_memory_set_dirty_flags(\n\n addr1, (0xff & ~CODE_DIRTY_FLAG));\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "183216b21870f21c86c904a7530d53682d7db46d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n int i;\n \n+ ThreadContext *c= avctx->internal->frame_thread_encoder;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void ff_frame_thread_encoder_free(AVCodecContext *avctx){\n\n int i;\n\n ThreadContext *c= avctx->internal->frame_thread_encoder;\n\n\n\n pthread_mutex_lock(&c->task_fifo_mutex);\n\n c->exit = 1;\n\n pthread_cond_broadcast(&c->task_fifo_cond);\n\n pthread_mutex_unlock(&c->task_fifo_mutex);\n\n\n\n for (i=0; ithread_count; i++) {\n\n pthread_join(c->worker[i], NULL);\n\n }\n\n\n\n pthread_mutex_destroy(&c->task_fifo_mutex);\n\n pthread_mutex_destroy(&c->finished_task_mutex);\n\n pthread_mutex_destroy(&c->buffer_mutex);\n\n pthread_cond_destroy(&c->task_fifo_cond);\n\n pthread_cond_destroy(&c->finished_task_cond);\n\n av_fifo_freep(&c->task_fifo);\n\n av_freep(&avctx->internal->frame_thread_encoder);\n\n}\n"}} {"sample_id": "384acbf46b70edf0d2c1648aa1a92a90bcf7057d_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,9 +23,9 @@\n \n \n async_context_pop();\n+\n+\n+\n+ return ret;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qed_write_l1_table_sync(BDRVQEDState *s, unsigned int index,\n\n unsigned int n)\n\n{\n\n int ret = -EINPROGRESS;\n\n\n\n async_context_push();\n\n\n\n qed_write_l1_table(s, index, n, qed_sync_cb, &ret);\n\n while (ret == -EINPROGRESS) {\n\n qemu_aio_wait();\n\n }\n\n\n\n async_context_pop();\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "190563f9a90c9df8ad32fc7f3e4b166deda949a6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n if (!s->in_len) {\n \n+ ret = USB_RET_NAK;\n+\n+ return ret;\n+\n+ }\n \n ret = s->in_len - s->in_ptr;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int usb_net_handle_datain(USBNetState *s, USBPacket *p)\n\n{\n\n int ret = USB_RET_NAK;\n\n\n\n if (s->in_ptr > s->in_len) {\n\n s->in_ptr = s->in_len = 0;\n\n ret = USB_RET_NAK;\n\n return ret;\n\n }\n\n if (!s->in_len) {\n\n ret = USB_RET_NAK;\n\n return ret;\n\n }\n\n ret = s->in_len - s->in_ptr;\n\n if (ret > p->iov.size) {\n\n ret = p->iov.size;\n\n }\n\n usb_packet_copy(p, &s->in_buf[s->in_ptr], ret);\n\n s->in_ptr += ret;\n\n if (s->in_ptr >= s->in_len &&\n\n (is_rndis(s) || (s->in_len & (64 - 1)) || !ret)) {\n\n /* no short packet necessary */\n\n s->in_ptr = s->in_len = 0;\n\n }\n\n\n\n#ifdef TRAFFIC_DEBUG\n\n fprintf(stderr, \"usbnet: data in len %zu return %d\", p->iov.size, ret);\n\n iov_hexdump(p->iov.iov, p->iov.niov, stderr, \"usbnet\", ret);\n\n#endif\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "ddfa3751c092feaf1e080f66587024689dfe603c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n static int get_cod(J2kDecoderContext *s, J2kCodingStyle *c, uint8_t *properties)\n \n {\n+\n J2kCodingStyle tmp;\n+\n int compno;\n \n \n \n+ if (s->buf_end - s->buf < 5)\n \n return AVERROR(EINVAL);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int get_cod(J2kDecoderContext *s, J2kCodingStyle *c, uint8_t *properties)\n\n{\n\n J2kCodingStyle tmp;\n\n int compno;\n\n\n\n if (s->buf_end - s->buf < 5)\n\n return AVERROR(EINVAL);\n\n\n\n tmp.log2_prec_width =\n\n tmp.log2_prec_height = 15;\n\n\n\n tmp.csty = bytestream_get_byte(&s->buf);\n\n\n\n if (bytestream_get_byte(&s->buf)){ // progression level\n\n av_log(s->avctx, AV_LOG_ERROR, \"only LRCP progression supported\\n\");\n\n return -1;\n\n }\n\n\n\n tmp.nlayers = bytestream_get_be16(&s->buf);\n\n tmp.mct = bytestream_get_byte(&s->buf); // multiple component transformation\n\n\n\n get_cox(s, &tmp);\n\n for (compno = 0; compno < s->ncomponents; compno++){\n\n if (!(properties[compno] & HAD_COC))\n\n memcpy(c + compno, &tmp, sizeof(J2kCodingStyle));\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "c3e10c7b4377c1cbc0a4fbc12312c2cf41c0cda7_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void OPPROTO op_subfme (void)\n \n+{\n+\n T0 = ~T0 + xer_ca - 1;\n \n if (likely((uint32_t)T0 != (uint32_t)-1))", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void OPPROTO op_subfme (void)\n\n{\n\n T0 = ~T0 + xer_ca - 1;\n\n if (likely((uint32_t)T0 != (uint32_t)-1))\n\n xer_ca = 1;\n\n RETURN();\n\n}\n"}} {"sample_id": "2898bc522da6adebda5cbbd9036defe22e3b9bcf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void FUNCC(ff_h264_chroma_dc_dequant_idct)(int16_t *_block, int qmul){\n \n const int stride= 16*2;\n+\n const int xStride= 16;\n \n int a,b,c,d,e;\n@@ -11,10 +11,10 @@\n \n \n a= block[stride*0 + xStride*0];\n+\n+ b= block[stride*0 + xStride*1];\n+\n+ c= block[stride*1 + xStride*0];\n \n d= block[stride*1 + xStride*1];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void FUNCC(ff_h264_chroma_dc_dequant_idct)(int16_t *_block, int qmul){\n\n const int stride= 16*2;\n\n const int xStride= 16;\n\n int a,b,c,d,e;\n\n dctcoef *block = (dctcoef*)_block;\n\n\n\n a= block[stride*0 + xStride*0];\n\n b= block[stride*0 + xStride*1];\n\n c= block[stride*1 + xStride*0];\n\n d= block[stride*1 + xStride*1];\n\n\n\n e= a-b;\n\n a= a+b;\n\n b= c-d;\n\n c= c+d;\n\n\n\n block[stride*0 + xStride*0]= ((a+c)*qmul) >> 7;\n\n block[stride*0 + xStride*1]= ((e+b)*qmul) >> 7;\n\n block[stride*1 + xStride*0]= ((a-c)*qmul) >> 7;\n\n block[stride*1 + xStride*1]= ((e-b)*qmul) >> 7;\n\n}\n"}} {"sample_id": "9ef91a677110ec200d7b2904fc4bcae5a77329ad_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static int posix_aio_flush(void *opaque)\n+\n {\n \n PosixAioState *s = opaque;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int posix_aio_flush(void *opaque)\n\n{\n\n PosixAioState *s = opaque;\n\n return !!s->first_aio;\n\n}\n"}} {"sample_id": "4678124bb9bfb49e93b83f95c4d2feeb443ea38b_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n &rsdt->table_offset_entry[i],\n \n sizeof(uint32_t));\n+\n+ }\n+\n+ build_header(linker, table_data,\n+\n (void *)rsdt, \"RSDT\", rsdt_len, 1, oem_id, oem_table_id);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "build_rsdt(GArray *table_data, BIOSLinker *linker, GArray *table_offsets,\n\n const char *oem_id, const char *oem_table_id)\n\n{\n\n AcpiRsdtDescriptorRev1 *rsdt;\n\n size_t rsdt_len;\n\n int i;\n\n const int table_data_len = (sizeof(uint32_t) * table_offsets->len);\n\n\n\n rsdt_len = sizeof(*rsdt) + table_data_len;\n\n rsdt = acpi_data_push(table_data, rsdt_len);\n\n memcpy(rsdt->table_offset_entry, table_offsets->data, table_data_len);\n\n for (i = 0; i < table_offsets->len; ++i) {\n\n /* rsdt->table_offset_entry to be filled by Guest linker */\n\n bios_linker_loader_add_pointer(linker,\n\n ACPI_BUILD_TABLE_FILE,\n\n ACPI_BUILD_TABLE_FILE,\n\n &rsdt->table_offset_entry[i],\n\n sizeof(uint32_t));\n\n }\n\n build_header(linker, table_data,\n\n (void *)rsdt, \"RSDT\", rsdt_len, 1, oem_id, oem_table_id);\n\n}\n"}} {"sample_id": "14bc7aaa860e4d71f4966d4679b3fab547f5e0af", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static int check_video_codec_tag(int codec_tag) {\n+\n+ if (codec_tag <= 0 || codec_tag > 15) {\n \n+ return AVERROR(ENOSYS);\n \n } else\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int check_video_codec_tag(int codec_tag) {\n\n if (codec_tag <= 0 || codec_tag > 15) {\n\n return AVERROR(ENOSYS);\n\n } else\n\n return 0;\n\n}\n"}} {"sample_id": "aba232cfa9b193604ed98f3fa505378d006b1b3b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,7 +15,7 @@\n return -1;\n \n }\n+\n avio_wl24(pb, 0); //frames count will be here\n \n avio_w8(pb, 0xC5);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int vc1test_write_header(AVFormatContext *s)\n\n{\n\n AVCodecContext *avc = s->streams[0]->codec;\n\n AVIOContext *pb = s->pb;\n\n\n\n if (avc->codec_id != CODEC_ID_WMV3) {\n\n av_log(s, AV_LOG_ERROR, \"Only WMV3 is accepted!\\n\");\n\n return -1;\n\n }\n\n avio_wl24(pb, 0); //frames count will be here\n\n avio_w8(pb, 0xC5);\n\n avio_wl32(pb, 4);\n\n avio_write(pb, avc->extradata, 4);\n\n avio_wl32(pb, avc->height);\n\n avio_wl32(pb, avc->width);\n\n avio_wl32(pb, 0xC);\n\n avio_wl24(pb, 0); // hrd_buffer\n\n avio_w8(pb, 0x80); // level|cbr|res1\n\n avio_wl32(pb, 0); // hrd_rate\n\n if (s->streams[0]->r_frame_rate.den && s->streams[0]->r_frame_rate.num == 1)\n\n avio_wl32(pb, s->streams[0]->r_frame_rate.den);\n\n else\n\n avio_wl32(pb, 0xFFFFFFFF); //variable framerate\n\n avpriv_set_pts_info(s->streams[0], 32, 1, 1000);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d25228e7befac33b665cd9250292de47ae6b78b5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void spapr_machine_2_3_class_init(ObjectClass *oc, void *data)\n \n+{\n+\n+ MachineClass *mc = MACHINE_CLASS(oc);\n+\n \n \n mc->name = \"pseries-2.3\";", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void spapr_machine_2_3_class_init(ObjectClass *oc, void *data)\n\n{\n\n MachineClass *mc = MACHINE_CLASS(oc);\n\n\n\n mc->name = \"pseries-2.3\";\n\n mc->desc = \"pSeries Logical Partition (PAPR compliant) v2.3\";\n\n mc->alias = \"pseries\";\n\n mc->is_default = 1;\n\n}\n"}} {"sample_id": "b307446e04232b3a87e9da04886895a8e5a4a407_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void mips_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,\n \n int flags)\n+\n {\n+\n MIPSCPU *cpu = MIPS_CPU(cs);\n \n CPUMIPSState *env = &cpu->env;\n@@ -13,8 +13,8 @@\n \n \n cpu_fprintf(f, \"pc=0x\" TARGET_FMT_lx \" HI=0x\" TARGET_FMT_lx\n+\n+ \" LO=0x\" TARGET_FMT_lx \" ds %04x \"\n \n TARGET_FMT_lx \" \" TARGET_FMT_ld \"\\n\",\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void mips_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,\n\n int flags)\n\n{\n\n MIPSCPU *cpu = MIPS_CPU(cs);\n\n CPUMIPSState *env = &cpu->env;\n\n int i;\n\n\n\n cpu_fprintf(f, \"pc=0x\" TARGET_FMT_lx \" HI=0x\" TARGET_FMT_lx\n\n \" LO=0x\" TARGET_FMT_lx \" ds %04x \"\n\n TARGET_FMT_lx \" \" TARGET_FMT_ld \"\\n\",\n\n env->active_tc.PC, env->active_tc.HI[0], env->active_tc.LO[0],\n\n env->hflags, env->btarget, env->bcond);\n\n for (i = 0; i < 32; i++) {\n\n if ((i & 3) == 0)\n\n cpu_fprintf(f, \"GPR%02d:\", i);\n\n cpu_fprintf(f, \" %s \" TARGET_FMT_lx, regnames[i], env->active_tc.gpr[i]);\n\n if ((i & 3) == 3)\n\n cpu_fprintf(f, \"\\n\");\n\n }\n\n\n\n cpu_fprintf(f, \"CP0 Status 0x%08x Cause 0x%08x EPC 0x\" TARGET_FMT_lx \"\\n\",\n\n env->CP0_Status, env->CP0_Cause, env->CP0_EPC);\n\n cpu_fprintf(f, \" Config0 0x%08x Config1 0x%08x LLAddr 0x%016\"\n\n PRIx64 \"\\n\",\n\n env->CP0_Config0, env->CP0_Config1, env->lladdr);\n\n cpu_fprintf(f, \" Config2 0x%08x Config3 0x%08x\\n\",\n\n env->CP0_Config2, env->CP0_Config3);\n\n cpu_fprintf(f, \" Config4 0x%08x Config5 0x%08x\\n\",\n\n env->CP0_Config4, env->CP0_Config5);\n\n if (env->hflags & MIPS_HFLAG_FPU)\n\n fpu_dump_state(env, f, cpu_fprintf, flags);\n\n#if defined(TARGET_MIPS64) && defined(MIPS_DEBUG_SIGN_EXTENSIONS)\n\n cpu_mips_check_sign_extensions(env, f, cpu_fprintf, flags);\n\n#endif\n\n}\n"}} {"sample_id": "21a933ea33c820515f331c162c9f7053ca6f4129", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void qemu_chr_parse_common(QemuOpts *opts, ChardevCommon *backend)\n+\n+{\n+\n+ const char *logfile = qemu_opt_get(opts, \"logfile\");\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_chr_parse_common(QemuOpts *opts, ChardevCommon *backend)\n\n{\n\n const char *logfile = qemu_opt_get(opts, \"logfile\");\n\n\n\n backend->has_logfile = logfile != NULL;\n\n backend->logfile = logfile ? g_strdup(logfile) : NULL;\n\n\n\n backend->has_logappend = true;\n\n backend->logappend = qemu_opt_get_bool(opts, \"logappend\", false);\n\n}\n"}} {"sample_id": "0d1460226fb05c92fa3ad869ca39090ff13cf6bc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n return 1;\n \n+ }\n+\n+ }\n+\n+ }\n \n return 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int curl_aio_flush(void *opaque)\n\n{\n\n BDRVCURLState *s = opaque;\n\n int i, j;\n\n\n\n for (i=0; i < CURL_NUM_STATES; i++) {\n\n for(j=0; j < CURL_NUM_ACB; j++) {\n\n if (s->states[i].acb[j]) {\n\n return 1;\n\n }\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "e92714c71a2f50b8420126e952cadb653fa0ef93", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ DeviceState *dev;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "DeviceState *qdev_create(BusState *bus, const char *name)\n\n{\n\n DeviceState *dev;\n\n\n\n dev = qdev_try_create(bus, name);\n\n if (!dev) {\n\n hw_error(\"Unknown device '%s' for bus '%s'\\n\", name, bus->info->name);\n\n }\n\n\n\n return dev;\n\n}\n"}} {"sample_id": "d30107814c8d02f1896bd57249aef1b5aaed38c9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n int64_t HELPER(nabs_i64)(int64_t val)\n \n {\n+\n+ if (val < 0) {\n+\n return val;\n \n } else {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int64_t HELPER(nabs_i64)(int64_t val)\n\n{\n\n if (val < 0) {\n\n return val;\n\n } else {\n\n return -val;\n\n }\n\n}\n"}} {"sample_id": "0c9390d978cbf61e8f16c9f580fa96b305c43568_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void nbd_client_new(NBDExport *exp,\n \n QIOChannelSocket *sioc,\n \n@@ -13,7 +13,7 @@\n NBDClient *client;\n \n NBDClientNewData *data = g_new(NBDClientNewData, 1);\n+\n \n \n client = g_malloc0(sizeof(NBDClient));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void nbd_client_new(NBDExport *exp,\n\n QIOChannelSocket *sioc,\n\n QCryptoTLSCreds *tlscreds,\n\n const char *tlsaclname,\n\n void (*close_fn)(NBDClient *))\n\n{\n\n NBDClient *client;\n\n NBDClientNewData *data = g_new(NBDClientNewData, 1);\n\n\n\n client = g_malloc0(sizeof(NBDClient));\n\n client->refcount = 1;\n\n client->exp = exp;\n\n client->tlscreds = tlscreds;\n\n if (tlscreds) {\n\n object_ref(OBJECT(client->tlscreds));\n\n }\n\n client->tlsaclname = g_strdup(tlsaclname);\n\n client->sioc = sioc;\n\n object_ref(OBJECT(client->sioc));\n\n client->ioc = QIO_CHANNEL(sioc);\n\n object_ref(OBJECT(client->ioc));\n\n client->close = close_fn;\n\n\n\n data->client = client;\n\n data->co = qemu_coroutine_create(nbd_co_client_start, data);\n\n qemu_coroutine_enter(data->co);\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n AioContext *ctx = (AioContext *) source;\n \n+\n+\n+ assert(callback == NULL);\n+\n aio_dispatch(ctx, true);\n \n return true;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "aio_ctx_dispatch(GSource *source,\n\n GSourceFunc callback,\n\n gpointer user_data)\n\n{\n\n AioContext *ctx = (AioContext *) source;\n\n\n\n assert(callback == NULL);\n\n aio_dispatch(ctx, true);\n\n return true;\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_23", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,9 +13,9 @@\n bs->open_flags |= BDRV_O_CACHE_WB;\n \n } else {\n+\n+ bs->open_flags &= ~BDRV_O_CACHE_WB;\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bdrv_set_enable_write_cache(BlockDriverState *bs, bool wce)\n\n{\n\n bs->enable_write_cache = wce;\n\n\n\n /* so a reopen() will preserve wce */\n\n if (wce) {\n\n bs->open_flags |= BDRV_O_CACHE_WB;\n\n } else {\n\n bs->open_flags &= ~BDRV_O_CACHE_WB;\n\n }\n\n}\n"}} {"sample_id": "3ab9a2a5577d445252724af4067d2a7c8a378efa_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void rv40_v_weak_loop_filter(uint8_t *src, const int stride,\n \n const int filter_p1, const int filter_q1,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void rv40_v_weak_loop_filter(uint8_t *src, const int stride,\n\n const int filter_p1, const int filter_q1,\n\n const int alpha, const int beta,\n\n const int lim_p0q0, const int lim_q1,\n\n const int lim_p1)\n\n{\n\n rv40_weak_loop_filter(src, 1, stride, filter_p1, filter_q1,\n\n alpha, beta, lim_p0q0, lim_q1, lim_p1);\n\n}\n"}} {"sample_id": "81ffbf5ab1458e357a761f1272105a55829b351e_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n \n \n again:\n+\n+ entry = readdir(fs->dir.stream);\n+\n+ if (!entry) {\n+\n return NULL;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static struct dirent *local_readdir(FsContext *ctx, V9fsFidOpenState *fs)\n\n{\n\n struct dirent *entry;\n\n\n\nagain:\n\n entry = readdir(fs->dir.stream);\n\n if (!entry) {\n\n return NULL;\n\n }\n\n\n\n if (ctx->export_flags & V9FS_SM_MAPPED) {\n\n entry->d_type = DT_UNKNOWN;\n\n } else if (ctx->export_flags & V9FS_SM_MAPPED_FILE) {\n\n if (local_is_mapped_file_metadata(ctx, entry->d_name)) {\n\n /* skip the meta data directory */\n\n goto again;\n\n }\n\n entry->d_type = DT_UNKNOWN;\n\n }\n\n\n\n return entry;\n\n}\n"}} {"sample_id": "7e240f95818310ed721321e62130aa1c69f9cbe6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n uint32_t id)\n {\n int i;\n+ MatroskaLevel1Element *elem;\n+ // Some files link to all clusters; useless.\n+ if (id == MATROSKA_ID_CLUSTER)\n+ // There can be multiple seekheads.\n+ if (id != MATROSKA_ID_SEEKHEAD) {\n for (i = 0; i < matroska->num_level1_elems; i++) {\n if (matroska->level1_elems[i].id == id)\n return &matroska->level1_elems[i];", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static MatroskaLevel1Element *matroska_find_level1_elem(MatroskaDemuxContext *matroska,\n uint32_t id)\n{\n int i;\n MatroskaLevel1Element *elem;\n // Some files link to all clusters; useless.\n if (id == MATROSKA_ID_CLUSTER)\n // There can be multiple seekheads.\n if (id != MATROSKA_ID_SEEKHEAD) {\n for (i = 0; i < matroska->num_level1_elems; i++) {\n if (matroska->level1_elems[i].id == id)\n return &matroska->level1_elems[i];\n }\n }\n // Only a completely broken file would have more elements.\n // It also provides a low-effort way to escape from circular seekheads\n // (every iteration will add a level1 entry).\n if (matroska->num_level1_elems >= FF_ARRAY_ELEMS(matroska->level1_elems)) {\n av_log(matroska->ctx, AV_LOG_ERROR, \"Too many level1 elements or circular seekheads.\\n\");\n }\n elem = &matroska->level1_elems[matroska->num_level1_elems++];\n *elem = (MatroskaLevel1Element){.id = id};\n return elem;\n}"}} {"sample_id": "9561fda8d90e176bef598ba87c42a1bd6ad03ef7_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void object_get_link_property(Object *obj, Visitor *v, void *opaque,\n+\n const char *name, Error **errp)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void object_get_link_property(Object *obj, Visitor *v, void *opaque,\n\n const char *name, Error **errp)\n\n{\n\n Object **child = opaque;\n\n gchar *path;\n\n\n\n if (*child) {\n\n path = object_get_canonical_path(*child);\n\n visit_type_str(v, &path, name, errp);\n\n g_free(path);\n\n } else {\n\n path = (gchar *)\"\";\n\n visit_type_str(v, &path, name, errp);\n\n }\n\n}\n"}} {"sample_id": "a9eb4f0899de04a3093a04f461611c6f0664398e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -45,11 +45,11 @@\n codec_string, codec->name);\n \n codec = encoder ?\n+\n+ avcodec_find_encoder(codec->id) :\n+\n+ avcodec_find_decoder(codec->id);\n+\n if (!(codec->capabilities & CODEC_CAP_EXPERIMENTAL))\n \n fprintf(stderr, \"Or use the non experimental %s '%s'.\\n\",", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static enum CodecID find_codec_or_die(const char *name, int type, int encoder, int strict)\n\n{\n\n const char *codec_string = encoder ? \"encoder\" : \"decoder\";\n\n AVCodec *codec;\n\n\n\n if(!name)\n\n return CODEC_ID_NONE;\n\n codec = encoder ?\n\n avcodec_find_encoder_by_name(name) :\n\n avcodec_find_decoder_by_name(name);\n\n if(!codec) {\n\n fprintf(stderr, \"Unknown %s '%s'\\n\", codec_string, name);\n\n ffmpeg_exit(1);\n\n }\n\n if(codec->type != type) {\n\n fprintf(stderr, \"Invalid %s type '%s'\\n\", codec_string, name);\n\n ffmpeg_exit(1);\n\n }\n\n if(codec->capabilities & CODEC_CAP_EXPERIMENTAL &&\n\n strict > FF_COMPLIANCE_EXPERIMENTAL) {\n\n fprintf(stderr, \"%s '%s' is experimental and might produce bad \"\n\n \"results.\\nAdd '-strict experimental' if you want to use it.\\n\",\n\n codec_string, codec->name);\n\n codec = encoder ?\n\n avcodec_find_encoder(codec->id) :\n\n avcodec_find_decoder(codec->id);\n\n if (!(codec->capabilities & CODEC_CAP_EXPERIMENTAL))\n\n fprintf(stderr, \"Or use the non experimental %s '%s'.\\n\",\n\n codec_string, codec->name);\n\n ffmpeg_exit(1);\n\n }\n\n return codec->id;\n\n}\n"}} {"sample_id": "2d896b454a0e19ec4c1ddbb0e0b65b7e54fcedf3_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,18 +1,18 @@\n+static uint64_t boston_lcd_read(void *opaque, hwaddr addr,\n+\n+ unsigned size)\n+\n+{\n+\n+ BostonState *s = opaque;\n+\n+ uint64_t val = 0;\n+\n+\n+\n+ switch (size) {\n \n+ case 8:\n \n val |= (uint64_t)s->lcd_content[(addr + 7) & 0x7] << 56;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint64_t boston_lcd_read(void *opaque, hwaddr addr,\n\n unsigned size)\n\n{\n\n BostonState *s = opaque;\n\n uint64_t val = 0;\n\n\n\n switch (size) {\n\n case 8:\n\n val |= (uint64_t)s->lcd_content[(addr + 7) & 0x7] << 56;\n\n val |= (uint64_t)s->lcd_content[(addr + 6) & 0x7] << 48;\n\n val |= (uint64_t)s->lcd_content[(addr + 5) & 0x7] << 40;\n\n val |= (uint64_t)s->lcd_content[(addr + 4) & 0x7] << 32;\n\n /* fall through */\n\n case 4:\n\n val |= (uint64_t)s->lcd_content[(addr + 3) & 0x7] << 24;\n\n val |= (uint64_t)s->lcd_content[(addr + 2) & 0x7] << 16;\n\n /* fall through */\n\n case 2:\n\n val |= (uint64_t)s->lcd_content[(addr + 1) & 0x7] << 8;\n\n /* fall through */\n\n case 1:\n\n val |= (uint64_t)s->lcd_content[(addr + 0) & 0x7];\n\n break;\n\n }\n\n\n\n return val;\n\n}\n"}} {"sample_id": "a32354e206895400d17c3de9a8df1de96d3df289_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n uint32_t value)\n \n+{\n \n m5206_mbar_state *s = (m5206_mbar_state *)opaque;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void m5206_mbar_writel(void *opaque, target_phys_addr_t offset,\n\n uint32_t value)\n\n{\n\n m5206_mbar_state *s = (m5206_mbar_state *)opaque;\n\n int width;\n\n offset &= 0x3ff;\n\n if (offset > 0x200) {\n\n hw_error(\"Bad MBAR write offset 0x%x\", (int)offset);\n\n }\n\n width = m5206_mbar_width[offset >> 2];\n\n if (width < 4) {\n\n m5206_mbar_writew(opaque, offset, value >> 16);\n\n m5206_mbar_writew(opaque, offset + 2, value & 0xffff);\n\n return;\n\n }\n\n m5206_mbar_write(s, offset, value, 4);\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n if (bs && bs->drv && bs->drv->bdrv_debug_remove_breakpoint) {\n \n+ return bs->drv->bdrv_debug_remove_breakpoint(bs, tag);\n+\n+ }\n+\n+\n \n return -ENOTSUP;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int bdrv_debug_remove_breakpoint(BlockDriverState *bs, const char *tag)\n\n{\n\n while (bs && bs->drv && !bs->drv->bdrv_debug_remove_breakpoint) {\n\n bs = bs->file;\n\n }\n\n\n\n if (bs && bs->drv && bs->drv->bdrv_debug_remove_breakpoint) {\n\n return bs->drv->bdrv_debug_remove_breakpoint(bs, tag);\n\n }\n\n\n\n return -ENOTSUP;\n\n}\n"}} {"sample_id": "f0c9d64a68b776374ec4732424a3e27753ce37b6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n unsigned *bsel_alloc = opaque;\n \n+ unsigned *bus_bsel;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void *acpi_set_bsel(PCIBus *bus, void *opaque)\n\n{\n\n unsigned *bsel_alloc = opaque;\n\n unsigned *bus_bsel;\n\n\n\n if (qbus_is_hotpluggable(BUS(bus))) {\n\n bus_bsel = g_malloc(sizeof *bus_bsel);\n\n\n\n *bus_bsel = (*bsel_alloc)++;\n\n object_property_add_uint32_ptr(OBJECT(bus), ACPI_PCIHP_PROP_BSEL,\n\n bus_bsel, NULL);\n\n }\n\n\n\n return bsel_alloc;\n\n}\n"}} {"sample_id": "932e71cd57bab4e6206e1355c6425290721bbe34", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void mvp_init (CPUMIPSState *env, const mips_def_t *def)\n \n {\n+\n+ env->mvp = qemu_mallocz(sizeof(CPUMIPSMVPContext));\n+\n+\n+\n /* MVPConf1 implemented, TLB sharable, no gating storage support,\n \n programmable cache partitioning implemented, number of allocatable", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void mvp_init (CPUMIPSState *env, const mips_def_t *def)\n\n{\n\n env->mvp = qemu_mallocz(sizeof(CPUMIPSMVPContext));\n\n\n\n /* MVPConf1 implemented, TLB sharable, no gating storage support,\n\n programmable cache partitioning implemented, number of allocatable\n\n and sharable TLB entries, MVP has allocatable TCs, 2 VPEs\n\n implemented, 5 TCs implemented. */\n\n env->mvp->CP0_MVPConf0 = (1 << CP0MVPC0_M) | (1 << CP0MVPC0_TLBS) |\n\n (0 << CP0MVPC0_GS) | (1 << CP0MVPC0_PCP) |\n\n// TODO: actually do 2 VPEs.\n\n// (1 << CP0MVPC0_TCA) | (0x1 << CP0MVPC0_PVPE) |\n\n// (0x04 << CP0MVPC0_PTC);\n\n (1 << CP0MVPC0_TCA) | (0x0 << CP0MVPC0_PVPE) |\n\n (0x04 << CP0MVPC0_PTC);\n\n /* Usermode has no TLB support */\n\n if (!env->user_mode_only)\n\n env->mvp->CP0_MVPConf0 |= (env->tlb->nb_tlb << CP0MVPC0_PTLBE);\n\n\n\n /* Allocatable CP1 have media extensions, allocatable CP1 have FP support,\n\n no UDI implemented, no CP2 implemented, 1 CP1 implemented. */\n\n env->mvp->CP0_MVPConf1 = (1 << CP0MVPC1_CIM) | (1 << CP0MVPC1_CIF) |\n\n (0x0 << CP0MVPC1_PCX) | (0x0 << CP0MVPC1_PCP2) |\n\n (0x1 << CP0MVPC1_PCP1);\n\n}\n"}} {"sample_id": "ce5b1bbf624b977a55ff7f85bb3871682d03baff_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n CPUState *cs = CPU(obj);\n+\n SuperHCPU *cpu = SUPERH_CPU(obj);\n \n CPUSH4State *env = &cpu->env;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void superh_cpu_initfn(Object *obj)\n\n{\n\n CPUState *cs = CPU(obj);\n\n SuperHCPU *cpu = SUPERH_CPU(obj);\n\n CPUSH4State *env = &cpu->env;\n\n\n\n cs->env_ptr = env;\n\n cpu_exec_init(cs, &error_abort);\n\n\n\n env->movcal_backup_tail = &(env->movcal_backup);\n\n\n\n if (tcg_enabled()) {\n\n sh4_translate_init();\n\n }\n\n}\n"}} {"sample_id": "aa92d6c4609e174fc6884e4b7b87367fac33cbe9_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static int coroutine_fn nfs_co_readv(BlockDriverState *bs,\n+\n+ int64_t sector_num, int nb_sectors,\n+\n+ QEMUIOVector *iov)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int coroutine_fn nfs_co_readv(BlockDriverState *bs,\n\n int64_t sector_num, int nb_sectors,\n\n QEMUIOVector *iov)\n\n{\n\n NFSClient *client = bs->opaque;\n\n NFSRPC task;\n\n\n\n nfs_co_init_task(client, &task);\n\n task.iov = iov;\n\n\n\n if (nfs_pread_async(client->context, client->fh,\n\n sector_num * BDRV_SECTOR_SIZE,\n\n nb_sectors * BDRV_SECTOR_SIZE,\n\n nfs_co_generic_cb, &task) != 0) {\n\n return -ENOMEM;\n\n }\n\n\n\n while (!task.complete) {\n\n nfs_set_events(client);\n\n qemu_coroutine_yield();\n\n }\n\n\n\n if (task.ret < 0) {\n\n return task.ret;\n\n }\n\n\n\n /* zero pad short reads */\n\n if (task.ret < iov->size) {\n\n qemu_iovec_memset(iov, task.ret, 0, iov->size - task.ret);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d6604b29ef544793479d7fb4e05ef6622bb3e534_35", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static av_cold int pnm_encode_close(AVCodecContext *avctx)\n \n {\n+\n+ av_frame_free(&avctx->coded_frame);\n \n return 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int pnm_encode_close(AVCodecContext *avctx)\n\n{\n\n av_frame_free(&avctx->coded_frame);\n\n return 0;\n\n}\n"}} {"sample_id": "965424dad112211fc5887d96bd093773c133416c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -52,11 +52,11 @@\n \n s->lambda= s->lambda_table[0];\n \n+ //FIXME broken\n+\n+ }else\n+\n+ s->lambda= s->current_picture.quality;\n \n //printf(\"%d %d\\n\", s->avctx->global_quality, s->current_picture.quality);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int estimate_qp(MpegEncContext *s, int dry_run){\n\n if (s->next_lambda){\n\n s->current_picture_ptr->quality=\n\n s->current_picture.quality = s->next_lambda;\n\n if(!dry_run) s->next_lambda= 0;\n\n } else if (!s->fixed_qscale) {\n\n s->current_picture_ptr->quality=\n\n s->current_picture.quality = ff_rate_estimate_qscale(s, dry_run);\n\n if (s->current_picture.quality < 0)\n\n return -1;\n\n }\n\n\n\n if(s->adaptive_quant){\n\n switch(s->codec_id){\n\n case CODEC_ID_MPEG4:\n\n if (CONFIG_MPEG4_ENCODER)\n\n ff_clean_mpeg4_qscales(s);\n\n break;\n\n case CODEC_ID_H263:\n\n case CODEC_ID_H263P:\n\n case CODEC_ID_FLV1:\n\n if (CONFIG_H263_ENCODER||CONFIG_H263P_ENCODER||CONFIG_FLV_ENCODER)\n\n ff_clean_h263_qscales(s);\n\n break;\n\n }\n\n\n\n s->lambda= s->lambda_table[0];\n\n //FIXME broken\n\n }else\n\n s->lambda= s->current_picture.quality;\n\n//printf(\"%d %d\\n\", s->avctx->global_quality, s->current_picture.quality);\n\n update_qscale(s);\n\n return 0;\n\n}\n"}} {"sample_id": "4977e467a50a690a46af5988d568eaab2e5933c7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static int raw_read_packet(AVFormatContext *s, AVPacket *pkt)\n \n {\n+\n+ TAKDemuxContext *tc = s->priv_data;\n+\n+ int ret;\n+\n \n \n if (tc->mlast_frame) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int raw_read_packet(AVFormatContext *s, AVPacket *pkt)\n\n{\n\n TAKDemuxContext *tc = s->priv_data;\n\n int ret;\n\n\n\n if (tc->mlast_frame) {\n\n AVIOContext *pb = s->pb;\n\n int64_t size, left;\n\n\n\n left = tc->data_end - avio_tell(s->pb);\n\n size = FFMIN(left, 1024);\n\n if (size <= 0)\n\n return AVERROR_EOF;\n\n\n\n ret = av_get_packet(pb, pkt, size);\n\n if (ret < 0)\n\n return ret;\n\n\n\n pkt->stream_index = 0;\n\n } else {\n\n ret = ff_raw_read_partial_packet(s, pkt);\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "7dfba6dfbf805cf99c4ae89f6194bc9205dfbefe", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n {\n \n+ case R_TCSR:\n+\n+ if (value & TCSR_TINT)\n+\n+ value &= ~TCSR_TINT;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "timer_write(void *opaque, hwaddr addr,\n\n uint64_t val64, unsigned int size)\n\n{\n\n struct timerblock *t = opaque;\n\n struct xlx_timer *xt;\n\n unsigned int timer;\n\n uint32_t value = val64;\n\n\n\n addr >>= 2;\n\n timer = timer_from_addr(addr);\n\n xt = &t->timers[timer];\n\n D(fprintf(stderr, \"%s addr=%x val=%x (timer=%d off=%d)\\n\",\n\n __func__, addr * 4, value, timer, addr & 3));\n\n /* Further decoding to address a specific timers reg. */\n\n addr &= 3;\n\n switch (addr) \n\n {\n\n case R_TCSR:\n\n if (value & TCSR_TINT)\n\n value &= ~TCSR_TINT;\n\n\n\n xt->regs[addr] = value;\n\n if (value & TCSR_ENT)\n\n timer_enable(xt);\n\n break;\n\n \n\n default:\n\n if (addr < ARRAY_SIZE(xt->regs))\n\n xt->regs[addr] = value;\n\n break;\n\n }\n\n timer_update_irq(t);\n\n}\n"}} {"sample_id": "70d54392f5015b9c6594fcae558f59f952501e3b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,5 +7,5 @@\n s->width = width;\n \n s->height = height;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void avcodec_set_dimensions(AVCodecContext *s, int width, int height){\n\n s->coded_width = width;\n\n s->coded_height= height;\n\n s->width = width;\n\n s->height = height;\n\n}\n"}} {"sample_id": "a89f364ae8740dfc31b321eed9ee454e996dc3c1_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ DeviceState *dev;\n+\n+\n+\n+ if (nand_flash_ids[chip_id].size == 0) {\n \n hw_error(\"%s: Unsupported NAND chip ID.\\n\", __FUNCTION__);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "DeviceState *nand_init(BlockBackend *blk, int manf_id, int chip_id)\n\n{\n\n DeviceState *dev;\n\n\n\n if (nand_flash_ids[chip_id].size == 0) {\n\n hw_error(\"%s: Unsupported NAND chip ID.\\n\", __FUNCTION__);\n\n }\n\n dev = DEVICE(object_new(TYPE_NAND));\n\n qdev_prop_set_uint8(dev, \"manufacturer_id\", manf_id);\n\n qdev_prop_set_uint8(dev, \"chip_id\", chip_id);\n\n if (blk) {\n\n qdev_prop_set_drive(dev, \"drive\", blk, &error_fatal);\n\n }\n\n\n\n qdev_init_nofail(dev);\n\n return dev;\n\n}\n"}} {"sample_id": "4c2e5f8f46a17966dc45b5a3e07b97434c0eabdf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static int qcow2_mark_clean(BlockDriverState *bs)\n \n {\n+\n BDRVQcowState *s = bs->opaque;\n \n \n+\n if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {\n \n int ret = bdrv_flush(bs);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int qcow2_mark_clean(BlockDriverState *bs)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n\n\n if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {\n\n int ret = bdrv_flush(bs);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n\n\n s->incompatible_features &= ~QCOW2_INCOMPAT_DIRTY;\n\n return qcow2_update_header(bs);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "931da6a5e9dd54563fe5d4d30b7bd4d0a0218c87_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n avpriv_fmt_conversion_table[i].codec_id == codec_id) {\n \n+ return avpriv_fmt_conversion_table[i].ff_fmt;\n+\n+ }\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "enum AVPixelFormat avpriv_fmt_v4l2ff(uint32_t v4l2_fmt, enum AVCodecID codec_id)\n\n{\n\n int i;\n\n\n\n for (i = 0; avpriv_fmt_conversion_table[i].codec_id != AV_CODEC_ID_NONE; i++) {\n\n if (avpriv_fmt_conversion_table[i].v4l2_fmt == v4l2_fmt &&\n\n avpriv_fmt_conversion_table[i].codec_id == codec_id) {\n\n return avpriv_fmt_conversion_table[i].ff_fmt;\n\n }\n\n }\n\n\n\n return AV_PIX_FMT_NONE;\n\n}\n"}} {"sample_id": "4a1418e07bdcfaa3177739e04707ecaec75d89e1_23", "diff": "--- a/source.c\n+++ b/source.c\n@@ -38,11 +38,11 @@\n \n \n \n+ phys_ram_dirty = qemu_realloc(phys_ram_dirty,\n+\n+ (last_ram_offset + size) >> TARGET_PAGE_BITS);\n+\n+ memset(phys_ram_dirty + (last_ram_offset >> TARGET_PAGE_BITS),\n \n 0xff, size >> TARGET_PAGE_BITS);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "ram_addr_t qemu_ram_alloc(ram_addr_t size)\n\n{\n\n RAMBlock *new_block;\n\n\n\n#ifdef CONFIG_KQEMU\n\n if (kqemu_phys_ram_base) {\n\n return kqemu_ram_alloc(size);\n\n }\n\n#endif\n\n\n\n size = TARGET_PAGE_ALIGN(size);\n\n new_block = qemu_malloc(sizeof(*new_block));\n\n\n\n new_block->host = qemu_vmalloc(size);\n\n new_block->offset = last_ram_offset;\n\n new_block->length = size;\n\n\n\n new_block->next = ram_blocks;\n\n ram_blocks = new_block;\n\n\n\n phys_ram_dirty = qemu_realloc(phys_ram_dirty,\n\n (last_ram_offset + size) >> TARGET_PAGE_BITS);\n\n memset(phys_ram_dirty + (last_ram_offset >> TARGET_PAGE_BITS),\n\n 0xff, size >> TARGET_PAGE_BITS);\n\n\n\n last_ram_offset += size;\n\n\n\n if (kvm_enabled())\n\n kvm_setup_guest_memory(new_block->host, size);\n\n\n\n return new_block->offset;\n\n}\n"}} {"sample_id": "97e89ee914411384dcda771d38bf89f13726d71e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void gen_check_cpenable(DisasContext *dc, unsigned cp)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void gen_check_cpenable(DisasContext *dc, unsigned cp)\n\n{\n\n if (option_enabled(dc, XTENSA_OPTION_COPROCESSOR) &&\n\n !(dc->cpenable & (1 << cp))) {\n\n gen_exception_cause(dc, COPROCESSOR0_DISABLED + cp);\n\n dc->is_jmp = DISAS_UPDATE;\n\n }\n\n}\n"}} {"sample_id": "2bf9febc95e5bcef8edb10ebc967325917b9c958", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n uint64_t *values)\n \n+{\n \n uint32_t *propcells;\n \n@@ -19,7 +19,7 @@\n uint32_t hival;\n \n \n+\n propcells = g_new0(uint32_t, numvalues * 2);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "int qemu_fdt_setprop_sized_cells_from_array(void *fdt,\n\n const char *node_path,\n\n const char *property,\n\n int numvalues,\n\n uint64_t *values)\n\n{\n\n uint32_t *propcells;\n\n uint64_t value;\n\n int cellnum, vnum, ncells;\n\n uint32_t hival;\n\n\n\n propcells = g_new0(uint32_t, numvalues * 2);\n\n\n\n cellnum = 0;\n\n for (vnum = 0; vnum < numvalues; vnum++) {\n\n ncells = values[vnum * 2];\n\n if (ncells != 1 && ncells != 2) {\n\n return -1;\n\n }\n\n value = values[vnum * 2 + 1];\n\n hival = cpu_to_be32(value >> 32);\n\n if (ncells > 1) {\n\n propcells[cellnum++] = hival;\n\n } else if (hival != 0) {\n\n return -1;\n\n }\n\n propcells[cellnum++] = cpu_to_be32(value);\n\n }\n\n\n\n return qemu_fdt_setprop(fdt, node_path, property, propcells,\n\n cellnum * sizeof(uint32_t));\n\n}\n"}} {"sample_id": "1bd075f29ea6d11853475c7c42734595720c3ac6_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n iscsi_unmap_cb(struct iscsi_context *iscsi, int status,\n \n void *command_data, void *opaque)\n+\n+{\n+\n IscsiAIOCB *acb = opaque;\n \n \n@@ -12,8 +12,8 @@\n \n qemu_aio_release(acb);\n \n+ scsi_free_scsi_task(acb->task);\n+\n acb->task = NULL;\n \n return;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "iscsi_unmap_cb(struct iscsi_context *iscsi, int status,\n\n void *command_data, void *opaque)\n\n{\n\n IscsiAIOCB *acb = opaque;\n\n\n\n if (acb->canceled != 0) {\n\n qemu_aio_release(acb);\n\n scsi_free_scsi_task(acb->task);\n\n acb->task = NULL;\n\n return;\n\n }\n\n\n\n acb->status = 0;\n\n if (status < 0) {\n\n error_report(\"Failed to unmap data on iSCSI lun. %s\",\n\n iscsi_get_error(iscsi));\n\n acb->status = -EIO;\n\n }\n\n\n\n iscsi_schedule_bh(acb);\n\n scsi_free_scsi_task(acb->task);\n\n acb->task = NULL;\n\n}\n"}} {"sample_id": "bfa0f96586fe2c257cfa574ffb991da493a54da1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n+static void vp8_decode_flush_impl(AVCodecContext *avctx, int force, int is_close)\n \n {\n+\n VP8Context *s = avctx->priv_data;\n+\n int i;\n \n+\n+\n if (!avctx->is_copy || force) {\n \n for (i = 0; i < 5; i++)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void vp8_decode_flush_impl(AVCodecContext *avctx, int force, int is_close)\n\n{\n\n VP8Context *s = avctx->priv_data;\n\n int i;\n\n\n\n if (!avctx->is_copy || force) {\n\n for (i = 0; i < 5; i++)\n\n if (s->frames[i].data[0])\n\n vp8_release_frame(s, &s->frames[i], is_close);\n\n }\n\n memset(s->framep, 0, sizeof(s->framep));\n\n\n\n free_buffers(s);\n\n s->maps_are_invalid = 1;\n\n}\n"}} {"sample_id": "32be264cea542b4dc721b10092bf1dfe511a28ee_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n {\n \n+ int i;\n \n float *output = sce->ret_buf;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void apply_window_and_mdct(AACEncContext *s, SingleChannelElement *sce,\n\n float *audio)\n\n{\n\n int i;\n\n float *output = sce->ret_buf;\n\n\n\n apply_window[sce->ics.window_sequence[0]](s->fdsp, sce, audio);\n\n\n\n if (sce->ics.window_sequence[0] != EIGHT_SHORT_SEQUENCE)\n\n s->mdct1024.mdct_calc(&s->mdct1024, sce->coeffs, output);\n\n else\n\n for (i = 0; i < 1024; i += 128)\n\n s->mdct128.mdct_calc(&s->mdct128, sce->coeffs + i, output + i*2);\n\n memcpy(audio, audio + 1024, sizeof(audio[0]) * 1024);\n\n memcpy(sce->pcoeffs, sce->coeffs, sizeof(sce->pcoeffs));\n\n}\n"}} {"sample_id": "38129c26c51b933d7db423f904ba0cd6a88ca1ed", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n int cmdutils_read_file(const char *filename, char **bufptr, size_t *size)\n \n+{\n+\n+ int ret;\n+\n+ FILE *f = fopen(filename, \"rb\");\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int cmdutils_read_file(const char *filename, char **bufptr, size_t *size)\n\n{\n\n int ret;\n\n FILE *f = fopen(filename, \"rb\");\n\n\n\n if (!f) {\n\n av_log(NULL, AV_LOG_ERROR, \"Cannot read file '%s': %s\\n\", filename,\n\n strerror(errno));\n\n return AVERROR(errno);\n\n }\n\n fseek(f, 0, SEEK_END);\n\n *size = ftell(f);\n\n fseek(f, 0, SEEK_SET);\n\n *bufptr = av_malloc(*size + 1);\n\n if (!*bufptr) {\n\n av_log(NULL, AV_LOG_ERROR, \"Could not allocate file buffer\\n\");\n\n fclose(f);\n\n return AVERROR(ENOMEM);\n\n }\n\n ret = fread(*bufptr, 1, *size, f);\n\n if (ret < *size) {\n\n av_free(*bufptr);\n\n if (ferror(f)) {\n\n av_log(NULL, AV_LOG_ERROR, \"Error while reading file '%s': %s\\n\",\n\n filename, strerror(errno));\n\n ret = AVERROR(errno);\n\n } else\n\n ret = AVERROR_EOF;\n\n } else {\n\n ret = 0;\n\n (*bufptr)[(*size)++] = '\\0';\n\n }\n\n\n\n fclose(f);\n\n return ret;\n\n}\n"}} {"sample_id": "e41029b378b4a65a0b89b5a8dc087aca6b5d012d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ TCGv t0;\n \n TCGv_i32 t1, t2, t3;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_lswx(DisasContext *ctx)\n\n{\n\n TCGv t0;\n\n TCGv_i32 t1, t2, t3;\n\n gen_set_access_type(ctx, ACCESS_INT);\n\n /* NIP cannot be restored if the memory exception comes from an helper */\n\n gen_update_nip(ctx, ctx->nip - 4);\n\n t0 = tcg_temp_new();\n\n gen_addr_reg_index(ctx, t0);\n\n t1 = tcg_const_i32(rD(ctx->opcode));\n\n t2 = tcg_const_i32(rA(ctx->opcode));\n\n t3 = tcg_const_i32(rB(ctx->opcode));\n\n gen_helper_lswx(cpu_env, t0, t1, t2, t3);\n\n tcg_temp_free(t0);\n\n tcg_temp_free_i32(t1);\n\n tcg_temp_free_i32(t2);\n\n tcg_temp_free_i32(t3);\n\n}\n"}} {"sample_id": "049e24a191c212d9468db84169197887f2c91586", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n \n \n /* Don't actually halt the CPU, just yield back to top\n+\n+ * level loop. This is not going into a \"low power state\"\n+\n+ * (ie halting until some event occurs), so we never take\n+\n * a configurable trap to a different exception level.\n \n */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void HELPER(wfe)(CPUARMState *env)\n\n{\n\n CPUState *cs = CPU(arm_env_get_cpu(env));\n\n\n\n /* Don't actually halt the CPU, just yield back to top\n\n * level loop. This is not going into a \"low power state\"\n\n * (ie halting until some event occurs), so we never take\n\n * a configurable trap to a different exception level.\n\n */\n\n cs->exception_index = EXCP_YIELD;\n\n cpu_loop_exit(cs);\n\n}\n"}} {"sample_id": "7bc155163ec08a0302526d7e19d08c8053f932f0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n unsigned char pixel, count;\n \n unsigned char *orig = out_buf;\n+\n \n \n while (1) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int expand_rle_row(SgiState *s, uint8_t *out_buf,\n\n uint8_t *out_end, int pixelstride)\n\n{\n\n unsigned char pixel, count;\n\n unsigned char *orig = out_buf;\n\n\n\n while (1) {\n\n if (bytestream2_get_bytes_left(&s->g) < 1)\n\n return AVERROR_INVALIDDATA;\n\n pixel = bytestream2_get_byteu(&s->g);\n\n if (!(count = (pixel & 0x7f))) {\n\n return (out_buf - orig) / pixelstride;\n\n }\n\n\n\n /* Check for buffer overflow. */\n\n if(out_buf + pixelstride * count >= out_end) return -1;\n\n\n\n if (pixel & 0x80) {\n\n while (count--) {\n\n *out_buf = bytestream2_get_byte(&s->g);\n\n out_buf += pixelstride;\n\n }\n\n } else {\n\n pixel = bytestream2_get_byte(&s->g);\n\n\n\n while (count--) {\n\n *out_buf = pixel;\n\n out_buf += pixelstride;\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "ae100046ca32b0b83031a60d0c3cdfc5ceb9f874", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n if (bytestream2_get_bytes_left(gbytes) < entries * 12) {\n \n return AVERROR_INVALIDDATA;\n+\n+ }\n+\n+\n+\n for (i = 0; i < entries; i++) {\n \n if ((ret = exif_decode_tag(logctx, gbytes, le, depth, metadata)) < 0) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int avpriv_exif_decode_ifd(void *logctx, GetByteContext *gbytes, int le,\n\n int depth, AVDictionary **metadata)\n\n{\n\n int i, ret;\n\n int entries;\n\n\n\n entries = ff_tget_short(gbytes, le);\n\n\n\n if (bytestream2_get_bytes_left(gbytes) < entries * 12) {\n\n return AVERROR_INVALIDDATA;\n\n }\n\n\n\n for (i = 0; i < entries; i++) {\n\n if ((ret = exif_decode_tag(logctx, gbytes, le, depth, metadata)) < 0) {\n\n return ret;\n\n }\n\n }\n\n\n\n // return next IDF offset or 0x000000000 or a value < 0 for failure\n\n return ff_tget_long(gbytes, le);\n\n}\n"}} {"sample_id": "aea390e4be652d5b5457771d25eded0dba14fe37_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static bool pte32_match(target_ulong pte0, target_ulong pte1,\n \n bool secondary, target_ulong ptem)\n+\n+{\n+\n return (pte0 & HPTE32_V_VALID)\n \n && (secondary == !!(pte0 & HPTE32_V_SECONDARY))", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool pte32_match(target_ulong pte0, target_ulong pte1,\n\n bool secondary, target_ulong ptem)\n\n{\n\n return (pte0 & HPTE32_V_VALID)\n\n && (secondary == !!(pte0 & HPTE32_V_SECONDARY))\n\n && HPTE32_V_COMPARE(pte0, ptem);\n\n}\n"}} {"sample_id": "b737a2c52857b214be246ff615c6293730033cfa", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n \n \n+ if (p->buf_size < 16)\n \n return 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int mpc8_probe(AVProbeData *p)\n\n{\n\n const uint8_t *bs = p->buf + 4;\n\n const uint8_t *bs_end = bs + p->buf_size;\n\n int64_t size;\n\n\n\n if (p->buf_size < 16)\n\n return 0;\n\n if (AV_RL32(p->buf) != TAG_MPCK)\n\n return 0;\n\n while (bs < bs_end + 3) {\n\n int header_found = (bs[0] == 'S' && bs[1] == 'H');\n\n if (bs[0] < 'A' || bs[0] > 'Z' || bs[1] < 'A' || bs[1] > 'Z')\n\n return 0;\n\n bs += 2;\n\n size = bs_get_v(&bs);\n\n if (size < 2)\n\n return 0;\n\n if (bs + size - 2 >= bs_end)\n\n return AVPROBE_SCORE_EXTENSION - 1; // seems to be valid MPC but no header yet\n\n if (header_found) {\n\n if (size < 11 || size > 28)\n\n return 0;\n\n if (!AV_RL32(bs)) //zero CRC is invalid\n\n return 0;\n\n return AVPROBE_SCORE_MAX;\n\n } else {\n\n bs += size - 2;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "1b0952445522af73b0e78420a9078b3653923703_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+void hbitmap_iter_init(HBitmapIter *hbi, const HBitmap *hb, uint64_t first)\n+\n+{\n+\n+ unsigned i, bit;\n \n uint64_t pos;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void hbitmap_iter_init(HBitmapIter *hbi, const HBitmap *hb, uint64_t first)\n\n{\n\n unsigned i, bit;\n\n uint64_t pos;\n\n\n\n hbi->hb = hb;\n\n pos = first >> hb->granularity;\n\n\n hbi->pos = pos >> BITS_PER_LEVEL;\n\n hbi->granularity = hb->granularity;\n\n\n\n for (i = HBITMAP_LEVELS; i-- > 0; ) {\n\n bit = pos & (BITS_PER_LONG - 1);\n\n pos >>= BITS_PER_LEVEL;\n\n\n\n /* Drop bits representing items before first. */\n\n hbi->cur[i] = hb->levels[i][pos] & ~((1UL << bit) - 1);\n\n\n\n /* We have already added level i+1, so the lowest set bit has\n\n * been processed. Clear it.\n\n */\n\n if (i != HBITMAP_LEVELS - 1) {\n\n hbi->cur[i] &= ~(1UL << bit);\n\n }\n\n }\n\n}"}} {"sample_id": "a9fc37f6bc3f2ab90585cb16493da9f6dcfbfbcf_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n QObjectInputVisitor *qiv = to_qiv(v);\n \n QObject *qobj = qobject_input_get_object(qiv, name, true, errp);\n+\n QInt *qint;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void qobject_input_type_int64(Visitor *v, const char *name, int64_t *obj,\n\n Error **errp)\n\n{\n\n QObjectInputVisitor *qiv = to_qiv(v);\n\n QObject *qobj = qobject_input_get_object(qiv, name, true, errp);\n\n QInt *qint;\n\n\n\n if (!qobj) {\n\n return;\n\n }\n\n qint = qobject_to_qint(qobj);\n\n if (!qint) {\n\n error_setg(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : \"null\",\n\n \"integer\");\n\n return;\n\n }\n\n\n\n *obj = qint_get_int(qint);\n\n}\n"}} {"sample_id": "21ef45d71221b4577330fe3aacfb06afad91ad46_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void vnc_dpy_update(DisplayChangeListener *dcl,\n \n+ DisplayState *ds,\n \n int x, int y, int w, int h)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void vnc_dpy_update(DisplayChangeListener *dcl,\n\n DisplayState *ds,\n\n int x, int y, int w, int h)\n\n{\n\n int i;\n\n VncDisplay *vd = ds->opaque;\n\n struct VncSurface *s = &vd->guest;\n\n int width = ds_get_width(ds);\n\n int height = ds_get_height(ds);\n\n\n\n h += y;\n\n\n\n /* round x down to ensure the loop only spans one 16-pixel block per,\n\n iteration. otherwise, if (x % 16) != 0, the last iteration may span\n\n two 16-pixel blocks but we only mark the first as dirty\n\n */\n\n w += (x % 16);\n\n x -= (x % 16);\n\n\n\n x = MIN(x, width);\n\n y = MIN(y, height);\n\n w = MIN(x + w, width) - x;\n\n h = MIN(h, height);\n\n\n\n for (; y < h; y++)\n\n for (i = 0; i < w; i += 16)\n\n set_bit((x + i) / 16, s->dirty[y]);\n\n}\n"}} {"sample_id": "4d1628e832dfc6ec02b0d196f6cc250aaa7bf3b3_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+uint64_t helper_sublv(CPUAlphaState *env, uint64_t op1, uint64_t op2)\n+\n+{\n+\n+ uint32_t res;\n \n+ res = op1 - op2;\n \n if (unlikely((op1 ^ op2) & (res ^ op1) & (1UL << 31))) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "uint64_t helper_sublv(CPUAlphaState *env, uint64_t op1, uint64_t op2)\n\n{\n\n uint32_t res;\n\n res = op1 - op2;\n\n if (unlikely((op1 ^ op2) & (res ^ op1) & (1UL << 31))) {\n\n arith_excp(env, GETPC(), EXC_M_IOV, 0);\n\n }\n\n return res;\n\n}\n"}} {"sample_id": "38e047b50d2bfd1df99fbbca884c9f1db0785ff4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,9 +6,9 @@\n \n qemu_mutex_init(&ram_list.mutex);\n \n+ memory_map_init();\n+\n+ io_mem_init();\n \n #endif\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void cpu_exec_init_all(void)\n\n{\n\n#if !defined(CONFIG_USER_ONLY)\n\n qemu_mutex_init(&ram_list.mutex);\n\n memory_map_init();\n\n io_mem_init();\n\n#endif\n\n}\n"}} {"sample_id": "de82815db1c89da058b7fb941dab137d6d9ab738", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void qcow2_close(BlockDriverState *bs)\n \n+{\n \n BDRVQcowState *s = bs->opaque;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void qcow2_close(BlockDriverState *bs)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n g_free(s->l1_table);\n\n /* else pre-write overlap checks in cache_destroy may crash */\n\n s->l1_table = NULL;\n\n\n\n if (!(bs->open_flags & BDRV_O_INCOMING)) {\n\n qcow2_cache_flush(bs, s->l2_table_cache);\n\n qcow2_cache_flush(bs, s->refcount_block_cache);\n\n\n\n qcow2_mark_clean(bs);\n\n }\n\n\n\n qcow2_cache_destroy(bs, s->l2_table_cache);\n\n qcow2_cache_destroy(bs, s->refcount_block_cache);\n\n\n\n g_free(s->unknown_header_fields);\n\n cleanup_unknown_header_ext(bs);\n\n\n\n g_free(s->cluster_cache);\n\n qemu_vfree(s->cluster_data);\n\n qcow2_refcount_close(bs);\n\n qcow2_free_snapshots(bs);\n\n}\n"}} {"sample_id": "ddfa3751c092feaf1e080f66587024689dfe603c_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int get_qcc(J2kDecoderContext *s, int n, J2kQuantStyle *q, uint8_t *properties)\n \n+{\n+\n int compno;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int get_qcc(J2kDecoderContext *s, int n, J2kQuantStyle *q, uint8_t *properties)\n\n{\n\n int compno;\n\n\n\n if (s->buf_end - s->buf < 1)\n\n return AVERROR(EINVAL);\n\n\n\n compno = bytestream_get_byte(&s->buf);\n\n properties[compno] |= HAD_QCC;\n\n return get_qcx(s, n-1, q+compno);\n\n}\n"}} {"sample_id": "710aec915d208246891b68e2ba61b54951edc508_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void monitor_protocol_emitter(Monitor *mon, QObject *data,\n+\n+ QError *err)\n+\n+{\n \n QDict *qmp;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void monitor_protocol_emitter(Monitor *mon, QObject *data,\n\n QError *err)\n\n{\n\n QDict *qmp;\n\n\n\n trace_monitor_protocol_emitter(mon);\n\n\n\n if (!err) {\n\n /* success response */\n\n qmp = qdict_new();\n\n if (data) {\n\n qobject_incref(data);\n\n qdict_put_obj(qmp, \"return\", data);\n\n } else {\n\n /* return an empty QDict by default */\n\n qdict_put(qmp, \"return\", qdict_new());\n\n }\n\n } else {\n\n /* error response */\n\n qmp = build_qmp_error_dict(err);\n\n }\n\n\n\n if (mon->mc->id) {\n\n qdict_put_obj(qmp, \"id\", mon->mc->id);\n\n mon->mc->id = NULL;\n\n }\n\n\n\n monitor_json_emitter(mon, QOBJECT(qmp));\n\n QDECREF(qmp);\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_133", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void unix_start_outgoing_migration(MigrationState *s, const char *path, Error **errp)\n \n+{\n \n unix_nonblocking_connect(path, unix_wait_for_connect, s, errp);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "void unix_start_outgoing_migration(MigrationState *s, const char *path, Error **errp)\n\n{\n\n unix_nonblocking_connect(path, unix_wait_for_connect, s, errp);\n\n}\n"}} {"sample_id": "6998a9f4c4e069f515c50614179f4cfc7d0184f5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,8 +5,8 @@\n int ret;\n if (s->icy_metadata_headers)\n len += strlen(s->icy_metadata_headers);\n+ if ((ret = av_reallocp(&s->icy_metadata_headers, len)) < 0)\n+ return ret;\n+ av_strlcatf(s->icy_metadata_headers, len, \"%s: %s\\n\", tag, p);\n return 0;\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int parse_icy(HTTPContext *s, const char *tag, const char *p)\n{\n int len = 4 + strlen(p) + strlen(tag);\n int is_first = !s->icy_metadata_headers;\n int ret;\n if (s->icy_metadata_headers)\n len += strlen(s->icy_metadata_headers);\n if ((ret = av_reallocp(&s->icy_metadata_headers, len)) < 0)\n return ret;\n av_strlcatf(s->icy_metadata_headers, len, \"%s: %s\\n\", tag, p);\n return 0;\n}"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,10 +7,10 @@\n port->opaque = opaque;\n \n port->index = index;\n+\n+ port->attach = attach;\n+\n+ TAILQ_INSERT_TAIL(&bus->free, port, next);\n \n bus->nfree++;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void usb_register_port(USBBus *bus, USBPort *port, void *opaque, int index,\n\n usb_attachfn attach)\n\n{\n\n port->opaque = opaque;\n\n port->index = index;\n\n port->attach = attach;\n\n TAILQ_INSERT_TAIL(&bus->free, port, next);\n\n bus->nfree++;\n\n}\n"}} {"sample_id": "70afb8ff90e9d922ed729e6dbabaff6d67c461aa", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+#ifdef TARGET_I386\n \n uint32_t old = ((CPUX86State*)cpu_env)->regs[R_EAX];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void do_compare_and_swap32(void *cpu_env, int num)\n\n{\n\n#ifdef TARGET_I386\n\n uint32_t old = ((CPUX86State*)cpu_env)->regs[R_EAX];\n\n uint32_t *value = (uint32_t*)((CPUX86State*)cpu_env)->regs[R_ECX];\n\n DPRINTF(\"commpage: compare_and_swap32(%x,new,%p)\\n\", old, value);\n\n\n\n if(value && old == tswap32(*value))\n\n {\n\n uint32_t new = ((CPUX86State*)cpu_env)->regs[R_EDX];\n\n *value = tswap32(new);\n\n /* set zf flag */\n\n ((CPUX86State*)cpu_env)->eflags |= 0x40;\n\n }\n\n else\n\n {\n\n ((CPUX86State*)cpu_env)->regs[R_EAX] = tswap32(*value);\n\n /* unset zf flag */\n\n ((CPUX86State*)cpu_env)->eflags &= ~0x40;\n\n }\n\n#else\n\n qerror(\"do_compare_and_swap32 unimplemented\");\n\n#endif\n\n}\n"}} {"sample_id": "a97fed52e57385fc749e6f6ef95be7ebdb81ba9b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+void ppc_store_msr_32 (CPUPPCState *env, uint32_t value)\n+\n {\n \n do_store_msr(env,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void ppc_store_msr_32 (CPUPPCState *env, uint32_t value)\n\n{\n\n do_store_msr(env,\n\n (do_load_msr(env) & ~0xFFFFFFFFULL) | (value & 0xFFFFFFFF));\n\n}\n"}} {"sample_id": "99b9cc0679585b2d495d7d31ce556549b6b2721c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n now.size);\n \n register_subpage(d, &now);\n+\n+ remain.size -= now.size;\n+\n+ remain.offset_within_address_space += now.size;\n+\n remain.offset_within_region += now.size;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void mem_add(MemoryListener *listener, MemoryRegionSection *section)\n\n{\n\n AddressSpaceDispatch *d = container_of(listener, AddressSpaceDispatch, listener);\n\n MemoryRegionSection now = limit(*section), remain = limit(*section);\n\n\n\n if ((now.offset_within_address_space & ~TARGET_PAGE_MASK)\n\n || (now.size < TARGET_PAGE_SIZE)) {\n\n now.size = MIN(TARGET_PAGE_ALIGN(now.offset_within_address_space)\n\n - now.offset_within_address_space,\n\n now.size);\n\n register_subpage(d, &now);\n\n remain.size -= now.size;\n\n remain.offset_within_address_space += now.size;\n\n remain.offset_within_region += now.size;\n\n }\n\n while (remain.size >= TARGET_PAGE_SIZE) {\n\n now = remain;\n\n if (remain.offset_within_region & ~TARGET_PAGE_MASK) {\n\n now.size = TARGET_PAGE_SIZE;\n\n register_subpage(d, &now);\n\n } else {\n\n now.size &= TARGET_PAGE_MASK;\n\n register_multipage(d, &now);\n\n }\n\n remain.size -= now.size;\n\n remain.offset_within_address_space += now.size;\n\n remain.offset_within_region += now.size;\n\n }\n\n now = remain;\n\n if (now.size) {\n\n register_subpage(d, &now);\n\n }\n\n}\n"}} {"sample_id": "d96391c1ffeb30a0afa695c86579517c69d9a889_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n target_ulong helper_rdhwr_performance(CPUMIPSState *env)\n+\n {\n \n check_hwrena(env, 4);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "target_ulong helper_rdhwr_performance(CPUMIPSState *env)\n\n{\n\n check_hwrena(env, 4);\n\n return env->CP0_Performance0;\n\n}\n"}} {"sample_id": "284197e41f0fe98d58ce5e8acd4966c91f28c4bd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void nvdimm_acpi_hotplug(AcpiNVDIMMState *state)\n \n {\n+\n nvdimm_build_fit_buffer(&state->fit_buf);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void nvdimm_acpi_hotplug(AcpiNVDIMMState *state)\n\n{\n\n nvdimm_build_fit_buffer(&state->fit_buf);\n\n}\n"}} {"sample_id": "8dea1dd406189dae6108104faf27f397835ae871_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ uint32_t dmalen;\n \n int target;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static uint32_t get_cmd(ESPState *s, uint8_t *buf)\n\n{\n\n uint32_t dmalen;\n\n int target;\n\n\n\n dmalen = s->rregs[ESP_TCLO] | (s->rregs[ESP_TCMID] << 8);\n\n target = s->wregs[ESP_WBUSID] & 7;\n\n DPRINTF(\"get_cmd: len %d target %d\\n\", dmalen, target);\n\n if (s->dma) {\n\n s->dma_memory_read(s->dma_opaque, buf, dmalen);\n\n } else {\n\n buf[0] = 0;\n\n memcpy(&buf[1], s->ti_buf, dmalen);\n\n dmalen++;\n\n }\n\n\n\n s->ti_size = 0;\n\n s->ti_rptr = 0;\n\n s->ti_wptr = 0;\n\n\n\n if (s->current_dev) {\n\n /* Started a new command before the old one finished. Cancel it. */\n\n s->current_dev->cancel_io(s->current_dev, 0);\n\n s->async_len = 0;\n\n }\n\n\n\n if (target >= ESP_MAX_DEVS || !s->scsi_dev[target]) {\n\n // No such drive\n\n s->rregs[ESP_RSTAT] = 0;\n\n s->rregs[ESP_RINTR] = INTR_DC;\n\n s->rregs[ESP_RSEQ] = SEQ_0;\n\n esp_raise_irq(s);\n\n return 0;\n\n }\n\n s->current_dev = s->scsi_dev[target];\n\n return dmalen;\n\n}\n"}} {"sample_id": "b0cd14fb1dab4b044f7fe6b53ac635409849de77_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n if (hwaccels[i].pix_fmt == pix_fmt &&\n \n+ (!selected_hwaccel_id || selected_hwaccel_id == HWACCEL_AUTO || hwaccels[i].id == selected_hwaccel_id))\n+\n+ return &hwaccels[i];\n+\n return NULL;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static const HWAccel *get_hwaccel(enum AVPixelFormat pix_fmt, enum HWAccelID selected_hwaccel_id)\n\n{\n\n int i;\n\n for (i = 0; hwaccels[i].name; i++)\n\n if (hwaccels[i].pix_fmt == pix_fmt &&\n\n (!selected_hwaccel_id || selected_hwaccel_id == HWACCEL_AUTO || hwaccels[i].id == selected_hwaccel_id))\n\n return &hwaccels[i];\n\n return NULL;\n\n}\n"}} {"sample_id": "bf937a7965c1d1a6dce4f615d0ead2e2ab505004", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void bt_dummy_lmp_disconnect_master(struct bt_link_s *link)\n+\n {\n \n fprintf(stderr, \"%s: stray LMP_detach received, fixme\\n\", __func__);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bt_dummy_lmp_disconnect_master(struct bt_link_s *link)\n\n{\n\n fprintf(stderr, \"%s: stray LMP_detach received, fixme\\n\", __func__);\n\n exit(-1);\n\n}\n"}} {"sample_id": "8bc396fc0e8769a056375c1c211f389ce0e3ecc5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n s->framep[VP56_FRAME_CURRENT]->key_frame = !vp56_rac_get(c);\n \n vp56_rac_get(c);\n+\n+ ff_vp56_init_dequant(s, vp56_rac_gets(c, 6));\n+\n+ if (s->framep[VP56_FRAME_CURRENT]->key_frame)\n+\n {\n \n vp56_rac_gets(c, 8);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size,\n\n int *golden_frame)\n\n{\n\n VP56RangeCoder *c = &s->c;\n\n int rows, cols;\n\n\n\n ff_vp56_init_range_decoder(&s->c, buf, buf_size);\n\n s->framep[VP56_FRAME_CURRENT]->key_frame = !vp56_rac_get(c);\n\n vp56_rac_get(c);\n\n ff_vp56_init_dequant(s, vp56_rac_gets(c, 6));\n\n if (s->framep[VP56_FRAME_CURRENT]->key_frame)\n\n {\n\n vp56_rac_gets(c, 8);\n\n if(vp56_rac_gets(c, 5) > 5)\n\n\n vp56_rac_gets(c, 2);\n\n if (vp56_rac_get(c)) {\n\n av_log(s->avctx, AV_LOG_ERROR, \"interlacing not supported\\n\");\n\n\n\n rows = vp56_rac_gets(c, 8); /* number of stored macroblock rows */\n\n cols = vp56_rac_gets(c, 8); /* number of stored macroblock cols */\n\n\n\n\n\n\n vp56_rac_gets(c, 8); /* number of displayed macroblock rows */\n\n vp56_rac_gets(c, 8); /* number of displayed macroblock cols */\n\n vp56_rac_gets(c, 2);\n\n if (!s->macroblocks || /* first frame */\n\n 16*cols != s->avctx->coded_width ||\n\n 16*rows != s->avctx->coded_height) {\n\n avcodec_set_dimensions(s->avctx, 16*cols, 16*rows);\n\n return 2;\n\n\n } else if (!s->macroblocks)\n\n\n return 1;\n"}} {"sample_id": "0b357a8095e72b092cc5c2aacc2f806db75ecae3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n \n \n switch (o->type) {\n+\n+ case AV_OPT_TYPE_FLAGS:\n+\n+ case AV_OPT_TYPE_INT: *(int *)dst= llrint(num/den)*intnum; break;\n+\n case AV_OPT_TYPE_INT64: *(int64_t *)dst= llrint(num/den)*intnum; break;\n \n case AV_OPT_TYPE_FLOAT: *(float *)dst= num*intnum/den; break;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int write_number(void *obj, const AVOption *o, void *dst, double num, int den, int64_t intnum)\n\n{\n\n if (o->max*den < num*intnum || o->min*den > num*intnum) {\n\n av_log(obj, AV_LOG_ERROR, \"Value %f for parameter '%s' out of range\\n\",\n\n num*intnum/den, o->name);\n\n return AVERROR(ERANGE);\n\n }\n\n\n\n switch (o->type) {\n\n case AV_OPT_TYPE_FLAGS:\n\n case AV_OPT_TYPE_INT: *(int *)dst= llrint(num/den)*intnum; break;\n\n case AV_OPT_TYPE_INT64: *(int64_t *)dst= llrint(num/den)*intnum; break;\n\n case AV_OPT_TYPE_FLOAT: *(float *)dst= num*intnum/den; break;\n\n case AV_OPT_TYPE_DOUBLE:*(double *)dst= num*intnum/den; break;\n\n case AV_OPT_TYPE_RATIONAL:\n\n if ((int)num == num) *(AVRational*)dst= (AVRational){num*intnum, den};\n\n else *(AVRational*)dst= av_d2q(num*intnum/den, 1<<24);\n\n break;\n\n default:\n\n return AVERROR(EINVAL);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "fd56e0612b6454a282fa6a953fdb09281a98c589_25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n MemoryRegion *pci_address_space_io(PCIDevice *dev)\n \n+{\n \n return dev->bus->address_space_io;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "MemoryRegion *pci_address_space_io(PCIDevice *dev)\n\n{\n\n return dev->bus->address_space_io;\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_62", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n offset = offset >> 9;\n \n+ offset_end = (offset_end + 511) >> 9;\n+\n+ bdrv_write(pfl->bs, offset, pfl->storage + (offset << 9),\n+\n+ offset_end - offset);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pflash_update(pflash_t *pfl, int offset,\n\n int size)\n\n{\n\n int offset_end;\n\n if (pfl->bs) {\n\n offset_end = offset + size;\n\n /* round to sectors */\n\n offset = offset >> 9;\n\n offset_end = (offset_end + 511) >> 9;\n\n bdrv_write(pfl->bs, offset, pfl->storage + (offset << 9),\n\n offset_end - offset);\n\n }\n\n}\n"}} {"sample_id": "f929ab0569ff31ed5a59b0b0adb7ce09df3fca39_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n my = y + deltay;\n \n+\n+\n+ /* check MV against frame boundaries */\n+\n+ if ((mx < 0) || (mx > ri->width - sz) ||\n \n (my < 0) || (my > ri->height - sz)) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void apply_motion_generic(RoqContext *ri, int x, int y, int deltax,\n\n int deltay, int sz)\n\n{\n\n int mx, my, cp;\n\n\n\n mx = x + deltax;\n\n my = y + deltay;\n\n\n\n /* check MV against frame boundaries */\n\n if ((mx < 0) || (mx > ri->width - sz) ||\n\n (my < 0) || (my > ri->height - sz)) {\n\n av_log(ri->avctx, AV_LOG_ERROR, \"motion vector out of bounds: MV = (%d, %d), boundaries = (0, 0, %d, %d)\\n\",\n\n mx, my, ri->width, ri->height);\n\n return;\n\n }\n\n\n\n if (ri->last_frame->data[0] == NULL) {\n\n av_log(ri->avctx, AV_LOG_ERROR, \"Invalid decode type. Invalid header?\\n\");\n\n return;\n\n }\n\n\n\n for(cp = 0; cp < 3; cp++) {\n\n int outstride = ri->current_frame->linesize[cp];\n\n int instride = ri->last_frame ->linesize[cp];\n\n block_copy(ri->current_frame->data[cp] + y*outstride + x,\n\n ri->last_frame->data[cp] + my*instride + mx,\n\n outstride, instride, sz);\n\n }\n\n}\n"}} {"sample_id": "56f289f383a871e871f944c7226920b35794efe6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n {\n int mod_state, win;\n struct sdl2_console *scon = get_scon_from_window(ev->key.windowID);\n+ if (alt_grab) {\n+ mod_state = (SDL_GetModState() & (gui_grab_code | KMOD_LSHIFT)) ==\n+ (gui_grab_code | KMOD_LSHIFT);\n+ } else if (ctrl_grab) {\n+ mod_state = (SDL_GetModState() & KMOD_RCTRL) == KMOD_RCTRL;\n } else {\n mod_state = (SDL_GetModState() & gui_grab_code) == gui_grab_code;\n gui_key_modifier_pressed = mod_state;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void handle_keydown(SDL_Event *ev)\n{\n int mod_state, win;\n struct sdl2_console *scon = get_scon_from_window(ev->key.windowID);\n if (alt_grab) {\n mod_state = (SDL_GetModState() & (gui_grab_code | KMOD_LSHIFT)) ==\n (gui_grab_code | KMOD_LSHIFT);\n } else if (ctrl_grab) {\n mod_state = (SDL_GetModState() & KMOD_RCTRL) == KMOD_RCTRL;\n } else {\n mod_state = (SDL_GetModState() & gui_grab_code) == gui_grab_code;\n gui_key_modifier_pressed = mod_state;\n if (gui_key_modifier_pressed) {\n switch (ev->key.keysym.scancode) {\n case SDL_SCANCODE_2:\n case SDL_SCANCODE_3:\n case SDL_SCANCODE_4:\n case SDL_SCANCODE_5:\n case SDL_SCANCODE_6:\n case SDL_SCANCODE_7:\n case SDL_SCANCODE_8:\n case SDL_SCANCODE_9:\n win = ev->key.keysym.scancode - SDL_SCANCODE_1;\n if (win < sdl2_num_outputs) {\n sdl2_console[win].hidden = !sdl2_console[win].hidden;\n if (sdl2_console[win].real_window) {\n if (sdl2_console[win].hidden) {\n SDL_HideWindow(sdl2_console[win].real_window);\n } else {\n SDL_ShowWindow(sdl2_console[win].real_window);\n gui_keysym = 1;\n break;\n case SDL_SCANCODE_F:\n toggle_full_screen(scon);\n gui_keysym = 1;\n break;\n case SDL_SCANCODE_U:\n sdl2_window_destroy(scon);\n sdl2_window_create(scon);\n if (!scon->opengl) {\n /* re-create scon->texture */\n sdl2_2d_switch(&scon->dcl, scon->surface);\n gui_keysym = 1;\n break;\n#if 0\n case SDL_SCANCODE_KP_PLUS:\n case SDL_SCANCODE_KP_MINUS:\n if (!gui_fullscreen) {\n int scr_w, scr_h;\n int width, height;\n SDL_GetWindowSize(scon->real_window, &scr_w, &scr_h);\n width = MAX(scr_w + (ev->key.keysym.scancode ==\n SDL_SCANCODE_KP_PLUS ? 50 : -50),\n 160);\n height = (surface_height(scon->surface) * width) /\n surface_width(scon->surface);\n fprintf(stderr, \"%s: scale to %dx%d\\n\",\n __func__, width, height);\n sdl_scale(scon, width, height);\n sdl2_redraw(scon);\n gui_keysym = 1;\n#endif\n default:\n break;\n if (!gui_keysym) {\n sdl2_process_key(scon, &ev->key);"}} {"sample_id": "28143b409f698210d85165ca518235ac7e7c5ac5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n }\n \n+\n+\n+ for (i = 0; i < xcrs.nr_xcrs; i++) {\n+\n+ /* Only support xcr0 now */\n \n if (xcrs.xcrs[i].xcr == 0) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int kvm_get_xcrs(X86CPU *cpu)\n\n{\n\n CPUX86State *env = &cpu->env;\n\n int i, ret;\n\n struct kvm_xcrs xcrs;\n\n\n\n if (!kvm_has_xcrs()) {\n\n return 0;\n\n }\n\n\n\n ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_XCRS, &xcrs);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n\n\n for (i = 0; i < xcrs.nr_xcrs; i++) {\n\n /* Only support xcr0 now */\n\n if (xcrs.xcrs[i].xcr == 0) {\n\n env->xcr0 = xcrs.xcrs[i].value;\n\n break;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "8b33d9eeba91422ee2d73b6936ad57262d18cf5a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,18 +1,18 @@\n+static int check_for_block_signature(BlockDriverState *bs, const uint8_t *buf)\n+\n {\n \n static const uint8_t signatures[][4] = {\n \n+ { 'Q', 'F', 'I', 0xfb }, /* qcow/qcow2 */\n+\n+ { 'C', 'O', 'W', 'D' }, /* VMDK3 */\n+\n+ { 'V', 'M', 'D', 'K' }, /* VMDK4 */\n+\n { 'O', 'O', 'O', 'M' }, /* UML COW */\n \n+ {}\n \n };\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int check_for_block_signature(BlockDriverState *bs, const uint8_t *buf)\n\n{\n\n static const uint8_t signatures[][4] = {\n\n { 'Q', 'F', 'I', 0xfb }, /* qcow/qcow2 */\n\n { 'C', 'O', 'W', 'D' }, /* VMDK3 */\n\n { 'V', 'M', 'D', 'K' }, /* VMDK4 */\n\n { 'O', 'O', 'O', 'M' }, /* UML COW */\n\n {}\n\n };\n\n int i;\n\n\n\n for (i = 0; signatures[i][0] != 0; i++) {\n\n if (memcmp(buf, signatures[i], 4) == 0) {\n\n return 1;\n\n }\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "dae7ff04160901a30a35af05f2f149b289c4f0b1_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int my_log2(unsigned int i)\n \n+{\n \n unsigned int iLog2 = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int my_log2(unsigned int i)\n\n{\n\n unsigned int iLog2 = 0;\n\n while ((i >> iLog2) > 1)\n\n\tiLog2++;\n\n return iLog2;\n\n}\n"}} {"sample_id": "76349f5ba8f4e2f0b8c93c12ec0950a8bc77408a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n char *normal_boot_order = opaque;\n \n static int first = 1;\n+\n \n \n /* Restore boot order and remove ourselves after the first boot */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void restore_boot_order(void *opaque)\n\n{\n\n char *normal_boot_order = opaque;\n\n static int first = 1;\n\n\n\n /* Restore boot order and remove ourselves after the first boot */\n\n if (first) {\n\n first = 0;\n\n return;\n\n }\n\n\n\n qemu_boot_set(normal_boot_order, NULL);\n\n\n\n qemu_unregister_reset(restore_boot_order, normal_boot_order);\n\n g_free(normal_boot_order);\n\n}\n"}} {"sample_id": "bd2bfa4c52e5f4dc6dbaa5be0521aedc31cb53d9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -35,11 +35,11 @@\n * with registered range.\n \n */\n+\n+ if (iommu_notifier->start > entry.iova + entry.addr_mask + 1 ||\n+\n+ iommu_notifier->end < entry.iova) {\n+\n continue;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void memory_region_notify_iommu(MemoryRegion *mr,\n\n IOMMUTLBEntry entry)\n\n{\n\n IOMMUNotifier *iommu_notifier;\n\n IOMMUNotifierFlag request_flags;\n\n\n\n assert(memory_region_is_iommu(mr));\n\n\n\n if (entry.perm & IOMMU_RW) {\n\n request_flags = IOMMU_NOTIFIER_MAP;\n\n } else {\n\n request_flags = IOMMU_NOTIFIER_UNMAP;\n\n }\n\n\n\n IOMMU_NOTIFIER_FOREACH(iommu_notifier, mr) {\n\n /*\n\n * Skip the notification if the notification does not overlap\n\n * with registered range.\n\n */\n\n if (iommu_notifier->start > entry.iova + entry.addr_mask + 1 ||\n\n iommu_notifier->end < entry.iova) {\n\n continue;\n\n }\n\n if (iommu_notifier->notifier_flags & request_flags) {\n\n iommu_notifier->notify(iommu_notifier, &entry);\n\n }\n\n }\n\n}\n"}} {"sample_id": "6eab3de16d36c48a983366b09d0a0029a5260bc3_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n PCI_STATUS_FAST_BACK | PCI_STATUS_66MHZ |\n \n+ PCI_STATUS_DEVSEL_MEDIUM);\n+\n+ pci_set_byte(dev->config + PCI_REVISION_ID, 0x11);\n+\n+ pci_set_byte(dev->config + PCI_HEADER_TYPE,\n \n pci_get_byte(dev->config + PCI_HEADER_TYPE) |\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void apb_pci_bridge_init(PCIBus *b)\n\n{\n\n PCIDevice *dev = pci_bridge_get_device(b);\n\n\n\n /*\n\n * command register:\n\n * According to PCI bridge spec, after reset\n\n * bus master bit is off\n\n * memory space enable bit is off\n\n * According to manual (805-1251.pdf).\n\n * the reset value should be zero unless the boot pin is tied high\n\n * (which is true) and thus it should be PCI_COMMAND_MEMORY.\n\n */\n\n pci_set_word(dev->config + PCI_COMMAND,\n\n PCI_COMMAND_MEMORY);\n\n pci_set_word(dev->config + PCI_STATUS,\n\n PCI_STATUS_FAST_BACK | PCI_STATUS_66MHZ |\n\n PCI_STATUS_DEVSEL_MEDIUM);\n\n pci_set_byte(dev->config + PCI_REVISION_ID, 0x11);\n\n pci_set_byte(dev->config + PCI_HEADER_TYPE,\n\n pci_get_byte(dev->config + PCI_HEADER_TYPE) |\n\n PCI_HEADER_TYPE_MULTI_FUNCTION);\n\n}\n"}} {"sample_id": "66dc50f7057b9a0191f54e55764412202306858d_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n+int do_subchannel_work_passthrough(SubchDev *sch)\n+\n {\n \n int ret = 0;\n \n SCSW *s = &sch->curr_status.scsw;\n \n+\n \n+ if (s->ctrl & SCSW_FCTL_CLEAR_FUNC) {\n \n /* TODO: Clear handling */\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "int do_subchannel_work_passthrough(SubchDev *sch)\n\n{\n\n int ret = 0;\n\n SCSW *s = &sch->curr_status.scsw;\n\n\n\n if (s->ctrl & SCSW_FCTL_CLEAR_FUNC) {\n\n /* TODO: Clear handling */\n\n sch_handle_clear_func(sch);\n\n } else if (s->ctrl & SCSW_FCTL_HALT_FUNC) {\n\n /* TODO: Halt handling */\n\n sch_handle_halt_func(sch);\n\n } else if (s->ctrl & SCSW_FCTL_START_FUNC) {\n\n ret = sch_handle_start_func_passthrough(sch);\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "29d1df66adb3723d1e7f2d363984b50792fb7c11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n if (e > 31)\n \n return 0;\n+\n+ m = (m + (1 << (e - 1))) >> e;\n+\n+\n+\n return m;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline int l3_unscale(int value, int exponent)\n\n{\n\n unsigned int m;\n\n int e;\n\n\n\n e = table_4_3_exp [4 * value + (exponent & 3)];\n\n m = table_4_3_value[4 * value + (exponent & 3)];\n\n e -= exponent >> 2;\n\n assert(e >= 1);\n\n if (e > 31)\n\n return 0;\n\n m = (m + (1 << (e - 1))) >> e;\n\n\n\n return m;\n\n}\n"}} {"sample_id": "56c4bfb3f07f3107894c00281276aea4f5e8834d_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,16 +1,16 @@\n static ram_addr_t get_start_block(DumpState *s)\n+\n {\n+\n RAMBlock *block;\n \n+\n+\n if (!s->has_filter) {\n \n+ s->block = QTAILQ_FIRST(&ram_list.blocks);\n+\n+ return 0;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static ram_addr_t get_start_block(DumpState *s)\n\n{\n\n RAMBlock *block;\n\n\n\n if (!s->has_filter) {\n\n s->block = QTAILQ_FIRST(&ram_list.blocks);\n\n return 0;\n\n }\n\n\n\n QTAILQ_FOREACH(block, &ram_list.blocks, next) {\n\n if (block->offset >= s->begin + s->length ||\n\n block->offset + block->length <= s->begin) {\n\n /* This block is out of the range */\n\n continue;\n\n }\n\n\n\n s->block = block;\n\n if (s->begin > block->offset) {\n\n s->start = s->begin - block->offset;\n\n } else {\n\n s->start = 0;\n\n }\n\n return s->start;\n\n }\n\n\n\n return -1;\n\n}\n"}} {"sample_id": "8aa1331c09a9b899f48d97f097bb49b7d458be1c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -41,11 +41,11 @@\n extent->l1_size = l1_size;\n \n extent->l1_entry_sectors = l2_size * cluster_sectors;\n+\n+ extent->l2_size = l2_size;\n+\n+ extent->cluster_sectors = cluster_sectors;\n+\n \n \n if (s->num_extents > 1) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static VmdkExtent *vmdk_add_extent(BlockDriverState *bs,\n\n BlockDriverState *file, bool flat, int64_t sectors,\n\n int64_t l1_offset, int64_t l1_backup_offset,\n\n uint32_t l1_size,\n\n int l2_size, unsigned int cluster_sectors)\n\n{\n\n VmdkExtent *extent;\n\n BDRVVmdkState *s = bs->opaque;\n\n\n\n s->extents = g_realloc(s->extents,\n\n (s->num_extents + 1) * sizeof(VmdkExtent));\n\n extent = &s->extents[s->num_extents];\n\n s->num_extents++;\n\n\n\n memset(extent, 0, sizeof(VmdkExtent));\n\n extent->file = file;\n\n extent->flat = flat;\n\n extent->sectors = sectors;\n\n extent->l1_table_offset = l1_offset;\n\n extent->l1_backup_table_offset = l1_backup_offset;\n\n extent->l1_size = l1_size;\n\n extent->l1_entry_sectors = l2_size * cluster_sectors;\n\n extent->l2_size = l2_size;\n\n extent->cluster_sectors = cluster_sectors;\n\n\n\n if (s->num_extents > 1) {\n\n extent->end_sector = (*(extent - 1)).end_sector + extent->sectors;\n\n } else {\n\n extent->end_sector = extent->sectors;\n\n }\n\n bs->total_sectors = extent->end_sector;\n\n return extent;\n\n}\n"}} {"sample_id": "54fd08136e4ac8b88b88b15c397010e3b0de379f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,10 +32,10 @@\n \n s->msix->ctrl_offset = real_offset;\n \n+\n+\n+ *data = reg->init_val;\n+\n+ return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int xen_pt_msixctrl_reg_init(XenPCIPassthroughState *s,\n\n XenPTRegInfo *reg, uint32_t real_offset,\n\n uint32_t *data)\n\n{\n\n PCIDevice *d = &s->dev;\n\n uint16_t reg_field = 0;\n\n\n\n /* use I/O device register's value as initial value */\n\n reg_field = pci_get_word(d->config + real_offset);\n\n\n\n if (reg_field & PCI_MSIX_FLAGS_ENABLE) {\n\n XEN_PT_LOG(d, \"MSIX already enabled, disabling it first\\n\");\n\n xen_host_pci_set_word(&s->real_device, real_offset,\n\n reg_field & ~PCI_MSIX_FLAGS_ENABLE);\n\n }\n\n\n\n s->msix->ctrl_offset = real_offset;\n\n\n\n *data = reg->init_val;\n\n return 0;\n\n}\n"}} {"sample_id": "373211d828f351d86908d47828444f620bfd176d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n \n \n+ avio_wb32(pb, 20);\n+\n+ ffio_wfourcc(pb, \"clef\");\n+\n+ avio_wb32(pb, 0);\n \n avio_wb32(pb, width << 16);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mov_write_tapt_tag(AVIOContext *pb, MOVTrack *track)\n\n{\n\n int32_t width = av_rescale(track->enc->sample_aspect_ratio.num, track->enc->width,\n\n track->enc->sample_aspect_ratio.den);\n\n\n\n int64_t pos = avio_tell(pb);\n\n\n\n avio_wb32(pb, 0); /* size */\n\n ffio_wfourcc(pb, \"tapt\");\n\n\n\n avio_wb32(pb, 20);\n\n ffio_wfourcc(pb, \"clef\");\n\n avio_wb32(pb, 0);\n\n avio_wb32(pb, width << 16);\n\n avio_wb32(pb, track->enc->height << 16);\n\n\n\n avio_wb32(pb, 20);\n\n ffio_wfourcc(pb, \"enof\");\n\n avio_wb32(pb, 0);\n\n avio_wb32(pb, track->enc->width << 16);\n\n avio_wb32(pb, track->enc->height << 16);\n\n\n\n return updateSize(pb, pos);\n\n};\n"}} {"sample_id": "e12ed72e5c00dd3375b8bd107200e4d7e950276a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n unsigned long *p = map + BIT_WORD(start);\n const long size = start + nr;\n int bits_to_set = BITS_PER_LONG - (start % BITS_PER_LONG);\n+ unsigned long mask_to_set = BITMAP_FIRST_WORD_MASK(start);\n+ while (nr - bits_to_set >= 0) {\n+ *p |= mask_to_set;\n+ nr -= bits_to_set;\n bits_to_set = BITS_PER_LONG;\n mask_to_set = ~0UL;\n p++;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void bitmap_set(unsigned long *map, long start, long nr)\n{\n unsigned long *p = map + BIT_WORD(start);\n const long size = start + nr;\n int bits_to_set = BITS_PER_LONG - (start % BITS_PER_LONG);\n unsigned long mask_to_set = BITMAP_FIRST_WORD_MASK(start);\n while (nr - bits_to_set >= 0) {\n *p |= mask_to_set;\n nr -= bits_to_set;\n bits_to_set = BITS_PER_LONG;\n mask_to_set = ~0UL;\n p++;\n }\n if (nr) {\n mask_to_set &= BITMAP_LAST_WORD_MASK(size);\n *p |= mask_to_set;\n }\n}"}} {"sample_id": "a5cf8262e4eb9c4646434e2c6211ef8608db3233_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n int off;\n \n+\n+\n+ off = snprintf(path, sizeof(path), \"%s\", qdev_fw_name(dev));\n+\n+ if (d->ioport_id) {\n \n snprintf(path + off, sizeof(path) - off, \"@%04x\", d->ioport_id);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static char *isabus_get_fw_dev_path(DeviceState *dev)\n\n{\n\n ISADevice *d = (ISADevice*)dev;\n\n char path[40];\n\n int off;\n\n\n\n off = snprintf(path, sizeof(path), \"%s\", qdev_fw_name(dev));\n\n if (d->ioport_id) {\n\n snprintf(path + off, sizeof(path) - off, \"@%04x\", d->ioport_id);\n\n }\n\n\n\n return strdup(path);\n\n}\n"}} {"sample_id": "eabb7b91b36b202b4dac2df2d59d698e3aff197a_32", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n /* Emit either the reg,imm or reg,reg form of a data-processing insn.\n \n+ * rhs must satisfy the \"rI\" constraint.\n+\n+ */\n+\n+ if (rhs_is_const) {\n \n int rot = encode_imm(rhs);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void tcg_out_dat_rI(TCGContext *s, int cond, int opc, TCGArg dst,\n\n TCGArg lhs, TCGArg rhs, int rhs_is_const)\n\n{\n\n /* Emit either the reg,imm or reg,reg form of a data-processing insn.\n\n * rhs must satisfy the \"rI\" constraint.\n\n */\n\n if (rhs_is_const) {\n\n int rot = encode_imm(rhs);\n\n assert(rot >= 0);\n\n tcg_out_dat_imm(s, cond, opc, dst, lhs, rotl(rhs, rot) | (rot << 7));\n\n } else {\n\n tcg_out_dat_reg(s, cond, opc, dst, lhs, rhs, SHIFT_IMM_LSL(0));\n\n }\n\n}\n"}} {"sample_id": "bcaa9099b3648b47060e1724a97dc98b63c83702", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static int decode_rle(uint8_t *bitmap, int linesize, int w, int h,\n const uint8_t *buf, int start, int buf_size, int is_8bit)\n {\n+ GetBitContext gb;\n+ int bit_len;\n+ int x, y, len, color;\n+ uint8_t *d;\n+ if (start >= buf_size)\n bit_len = (buf_size - start) * 8;\n init_get_bits(&gb, buf + start, bit_len);\n x = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int decode_rle(uint8_t *bitmap, int linesize, int w, int h,\n const uint8_t *buf, int start, int buf_size, int is_8bit)\n{\n GetBitContext gb;\n int bit_len;\n int x, y, len, color;\n uint8_t *d;\n if (start >= buf_size)\n bit_len = (buf_size - start) * 8;\n init_get_bits(&gb, buf + start, bit_len);\n x = 0;\n y = 0;\n d = bitmap;\n for(;;) {\n if (get_bits_count(&gb) > bit_len)\n if (is_8bit)\n len = decode_run_8bit(&gb, &color);\n else\n len = decode_run_2bit(&gb, &color);\n len = FFMIN(len, w - x);\n memset(d + x, color, len);\n x += len;\n if (x >= w) {\n y++;\n if (y >= h)\n break;\n d += linesize;\n x = 0;\n /* byte align */\n align_get_bits(&gb);\n }\n }\n return 0;\n}"}} {"sample_id": "364031f17932814484657e5551ba12957d993d7e_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n V9fsSynthOpenState *synth_open = fs->private;\n \n V9fsSynthNode *node = synth_open->node;\n+\n+ if (!node->attr->read) {\n+\n+ errno = EPERM;\n+\n return -1;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ssize_t v9fs_synth_preadv(FsContext *ctx, V9fsFidOpenState *fs,\n\n const struct iovec *iov,\n\n int iovcnt, off_t offset)\n\n{\n\n int i, count = 0, rcount;\n\n V9fsSynthOpenState *synth_open = fs->private;\n\n V9fsSynthNode *node = synth_open->node;\n\n if (!node->attr->read) {\n\n errno = EPERM;\n\n return -1;\n\n }\n\n for (i = 0; i < iovcnt; i++) {\n\n rcount = node->attr->read(iov[i].iov_base, iov[i].iov_len,\n\n offset, node->private);\n\n offset += rcount;\n\n count += rcount;\n\n /* If we read less than requested. we are done */\n\n if (rcount < iov[i].iov_len) {\n\n break;\n\n }\n\n }\n\n return count;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_321", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n retval = 0;\n \n break;\n+\n+ case MFI_OMSG0:\n+\n+ case MFI_OSP0:\n+\n retval = (megasas_use_msix(s) ? MFI_FWSTATE_MSIX_SUPPORTED : 0) |\n \n (s->fw_state & MFI_FWSTATE_MASK) |", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t megasas_mmio_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n MegasasState *s = opaque;\n\n uint32_t retval = 0;\n\n\n\n switch (addr) {\n\n case MFI_IDB:\n\n retval = 0;\n\n break;\n\n case MFI_OMSG0:\n\n case MFI_OSP0:\n\n retval = (megasas_use_msix(s) ? MFI_FWSTATE_MSIX_SUPPORTED : 0) |\n\n (s->fw_state & MFI_FWSTATE_MASK) |\n\n ((s->fw_sge & 0xff) << 16) |\n\n (s->fw_cmds & 0xFFFF);\n\n break;\n\n case MFI_OSTS:\n\n if (megasas_intr_enabled(s) && s->doorbell) {\n\n retval = MFI_1078_RM | 1;\n\n }\n\n break;\n\n case MFI_OMSK:\n\n retval = s->intr_mask;\n\n break;\n\n case MFI_ODCR0:\n\n retval = s->doorbell;\n\n break;\n\n default:\n\n trace_megasas_mmio_invalid_readl(addr);\n\n break;\n\n }\n\n trace_megasas_mmio_readl(addr, retval);\n\n return retval;\n\n}\n"}} {"sample_id": "5e600185453e1a0ded70a59701f60a0022a88e42", "diff": "--- a/source.c\n+++ b/source.c\n@@ -56,11 +56,11 @@\n \n \"error initializing filter '%s' with args '%s'\\n\", name, args);\n \n+ return NULL;\n+\n+ }\n+\n+\n \n return filt;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static AVFilterContext *create_filter(AVFilterGraph *ctx, int index,\n\n const char *name, const char *args,\n\n AVClass *log_ctx)\n\n{\n\n AVFilterContext *filt;\n\n\n\n AVFilter *filterdef;\n\n char inst_name[30];\n\n\n\n snprintf(inst_name, sizeof(inst_name), \"Parsed filter %d\", index);\n\n\n\n if(!(filterdef = avfilter_get_by_name(name))) {\n\n av_log(log_ctx, AV_LOG_ERROR,\n\n \"no such filter: '%s'\\n\", name);\n\n return NULL;\n\n }\n\n\n\n if(!(filt = avfilter_open(filterdef, inst_name))) {\n\n av_log(log_ctx, AV_LOG_ERROR,\n\n \"error creating filter '%s'\\n\", name);\n\n return NULL;\n\n }\n\n\n\n if(avfilter_graph_add_filter(ctx, filt) < 0)\n\n return NULL;\n\n\n\n if(avfilter_init_filter(filt, args, NULL)) {\n\n av_log(log_ctx, AV_LOG_ERROR,\n\n \"error initializing filter '%s' with args '%s'\\n\", name, args);\n\n return NULL;\n\n }\n\n\n\n return filt;\n\n}\n"}} {"sample_id": "56c4bfb3f07f3107894c00281276aea4f5e8834d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n static int dump_iterate(DumpState *s)\n+\n {\n \n RAMBlock *block;\n+\n+ int64_t size;\n \n int ret;\n+\n+\n \n while (1) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int dump_iterate(DumpState *s)\n\n{\n\n RAMBlock *block;\n\n int64_t size;\n\n int ret;\n\n\n\n while (1) {\n\n block = s->block;\n\n\n\n size = block->length;\n\n if (s->has_filter) {\n\n size -= s->start;\n\n if (s->begin + s->length < block->offset + block->length) {\n\n size -= block->offset + block->length - (s->begin + s->length);\n\n }\n\n }\n\n ret = write_memory(s, block, s->start, size);\n\n if (ret == -1) {\n\n return ret;\n\n }\n\n\n\n ret = get_next_block(s, block);\n\n if (ret == 1) {\n\n dump_completed(s);\n\n return 0;\n\n }\n\n }\n\n}\n"}} {"sample_id": "082c6681b6c4af0035d9dad34a4a784be8c21dbe", "diff": "--- a/source.c\n+++ b/source.c\n@@ -35,11 +35,11 @@\n env->excp_vectors[POWERPC_EXCP_DSTLB] = 0x00001200;\n \n env->excp_vectors[POWERPC_EXCP_IABR] = 0x00001300;\n+\n+ env->excp_vectors[POWERPC_EXCP_SMI] = 0x00001400;\n+\n+ env->excp_vectors[POWERPC_EXCP_WDT] = 0x00001500;\n+\n env->excp_vectors[POWERPC_EXCP_EMUL] = 0x00001600;\n \n env->excp_prefix = 0xFFF00000UL;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void init_excp_602 (CPUPPCState *env)\n\n{\n\n#if !defined(CONFIG_USER_ONLY)\n\n env->excp_vectors[POWERPC_EXCP_RESET] = 0x00000100;\n\n env->excp_vectors[POWERPC_EXCP_MCHECK] = 0x00000200;\n\n env->excp_vectors[POWERPC_EXCP_DSI] = 0x00000300;\n\n env->excp_vectors[POWERPC_EXCP_ISI] = 0x00000400;\n\n env->excp_vectors[POWERPC_EXCP_EXTERNAL] = 0x00000500;\n\n env->excp_vectors[POWERPC_EXCP_ALIGN] = 0x00000600;\n\n env->excp_vectors[POWERPC_EXCP_PROGRAM] = 0x00000700;\n\n env->excp_vectors[POWERPC_EXCP_FPU] = 0x00000800;\n\n env->excp_vectors[POWERPC_EXCP_DECR] = 0x00000900;\n\n env->excp_vectors[POWERPC_EXCP_SYSCALL] = 0x00000C00;\n\n env->excp_vectors[POWERPC_EXCP_TRACE] = 0x00000D00;\n\n env->excp_vectors[POWERPC_EXCP_FPA] = 0x00000E00;\n\n env->excp_vectors[POWERPC_EXCP_IFTLB] = 0x00001000;\n\n env->excp_vectors[POWERPC_EXCP_DLTLB] = 0x00001100;\n\n env->excp_vectors[POWERPC_EXCP_DSTLB] = 0x00001200;\n\n env->excp_vectors[POWERPC_EXCP_IABR] = 0x00001300;\n\n env->excp_vectors[POWERPC_EXCP_SMI] = 0x00001400;\n\n env->excp_vectors[POWERPC_EXCP_WDT] = 0x00001500;\n\n env->excp_vectors[POWERPC_EXCP_EMUL] = 0x00001600;\n\n env->excp_prefix = 0xFFF00000UL;\n\n /* Hardware reset vector */\n\n env->hreset_vector = 0xFFFFFFFCUL;\n\n#endif\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,8 +24,8 @@\n \n \n \n+ qemu_iovec_init_external(&qiov, &iov, 1);\n+\n+ return bdrv_pwritev(bs, offset, &qiov);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int bdrv_pwrite(BlockDriverState *bs, int64_t offset,\n\n const void *buf, int bytes)\n\n{\n\n QEMUIOVector qiov;\n\n struct iovec iov = {\n\n .iov_base = (void *) buf,\n\n .iov_len = bytes,\n\n };\n\n\n\n if (bytes < 0) {\n\n return -EINVAL;\n\n }\n\n\n\n qemu_iovec_init_external(&qiov, &iov, 1);\n\n return bdrv_pwritev(bs, offset, &qiov);\n\n}\n"}} {"sample_id": "3a661f1eabf7e8db66e28489884d9b54aacb94ea_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -44,11 +44,11 @@\n \n }\n \n+\n+\n+\n+ ctxt->free = qcrypto_cipher_free_aes;\n+\n ctxt->setiv = qcrypto_cipher_setiv_aes;\n \n ctxt->encrypt = qcrypto_cipher_encrypt_aes;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int qcrypto_cipher_init_aes(QCryptoCipher *cipher,\n\n const uint8_t *key, size_t nkey,\n\n Error **errp)\n\n{\n\n QCryptoCipherBuiltin *ctxt;\n\n\n\n if (cipher->mode != QCRYPTO_CIPHER_MODE_CBC &&\n\n cipher->mode != QCRYPTO_CIPHER_MODE_ECB) {\n\n error_setg(errp, \"Unsupported cipher mode %d\", cipher->mode);\n\n return -1;\n\n }\n\n\n\n ctxt = g_new0(QCryptoCipherBuiltin, 1);\n\n\n\n if (AES_set_encrypt_key(key, nkey * 8, &ctxt->state.aes.encrypt_key) != 0) {\n\n error_setg(errp, \"Failed to set encryption key\");\n\n goto error;\n\n }\n\n\n\n if (AES_set_decrypt_key(key, nkey * 8, &ctxt->state.aes.decrypt_key) != 0) {\n\n error_setg(errp, \"Failed to set decryption key\");\n\n goto error;\n\n }\n\n\n\n\n ctxt->free = qcrypto_cipher_free_aes;\n\n ctxt->setiv = qcrypto_cipher_setiv_aes;\n\n ctxt->encrypt = qcrypto_cipher_encrypt_aes;\n\n ctxt->decrypt = qcrypto_cipher_decrypt_aes;\n\n\n\n cipher->opaque = ctxt;\n\n\n\n return 0;\n\n\n\n error:\n\n g_free(ctxt);\n\n return -1;\n\n}"}} {"sample_id": "a89f364ae8740dfc31b321eed9ee454e996dc3c1_43", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n int output = (s->clk && s->enable) ? s->level : 0;\n+\n+\n+\n+ if (output != s->output) {\n \n s->output = output;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void omap_pwl_update(struct omap_pwl_s *s)\n\n{\n\n int output = (s->clk && s->enable) ? s->level : 0;\n\n\n\n if (output != s->output) {\n\n s->output = output;\n\n printf(\"%s: Backlight now at %i/256\\n\", __FUNCTION__, output);\n\n }\n\n}\n"}} {"sample_id": "882b3b97697affb36ca3d174f42f846232008979", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static int css_add_virtual_chpid(uint8_t cssid, uint8_t chpid, uint8_t type)\n \n {\n+\n+ CssImage *css;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int css_add_virtual_chpid(uint8_t cssid, uint8_t chpid, uint8_t type)\n\n{\n\n CssImage *css;\n\n\n\n trace_css_chpid_add(cssid, chpid, type);\n\n if (cssid > MAX_CSSID) {\n\n return -EINVAL;\n\n }\n\n css = channel_subsys.css[cssid];\n\n if (!css) {\n\n return -EINVAL;\n\n }\n\n if (css->chpids[chpid].in_use) {\n\n return -EEXIST;\n\n }\n\n css->chpids[chpid].in_use = 1;\n\n css->chpids[chpid].type = type;\n\n css->chpids[chpid].is_virtual = 1;\n\n\n\n css_generate_chp_crws(cssid, chpid);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "1ec83d9a9e472f485897ac92bad9631d551a8c5b_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,8 +10,8 @@\n \n case TIFF_LONG : return tget_long(p, le);\n \n+ default : return UINT_MAX;\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static unsigned tget(const uint8_t **p, int type, int le)\n\n{\n\n switch (type) {\n\n case TIFF_BYTE : return *(*p)++;\n\n case TIFF_SHORT: return tget_short(p, le);\n\n case TIFF_LONG : return tget_long(p, le);\n\n default : return UINT_MAX;\n\n }\n\n}\n"}} {"sample_id": "dd673288a8ff73ad77fcc1c255486d2466a772e1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n env->mp_state = cpu_is_bsp(env) ? KVM_MP_STATE_RUNNABLE :\n \n+ KVM_MP_STATE_UNINITIALIZED;\n+\n+ } else {\n+\n+ env->mp_state = KVM_MP_STATE_RUNNABLE;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void kvm_arch_reset_vcpu(CPUX86State *env)\n\n{\n\n env->exception_injected = -1;\n\n env->interrupt_injected = -1;\n\n env->xcr0 = 1;\n\n if (kvm_irqchip_in_kernel()) {\n\n env->mp_state = cpu_is_bsp(env) ? KVM_MP_STATE_RUNNABLE :\n\n KVM_MP_STATE_UNINITIALIZED;\n\n } else {\n\n env->mp_state = KVM_MP_STATE_RUNNABLE;\n\n }\n\n}\n"}} {"sample_id": "fed50c4304eecb352e29ce789cdb96ea84d6162f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void av_set_cpu_flags_mask(int mask)\n+\n {\n \n cpu_flags = get_cpu_flags() & mask;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void av_set_cpu_flags_mask(int mask)\n\n{\n\n cpu_flags = get_cpu_flags() & mask;\n\n}\n"}} {"sample_id": "94b037f2a451b3dc855f9f2c346e5049a361bd55_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n if (report && (t->running_async || t->running_retry)) {\n \n+ t->status = report;\n+\n+ xhci_xfer_report(t);\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int xhci_ep_nuke_one_xfer(XHCITransfer *t, TRBCCode report)\n\n{\n\n int killed = 0;\n\n\n\n if (report && (t->running_async || t->running_retry)) {\n\n t->status = report;\n\n xhci_xfer_report(t);\n\n }\n\n\n\n if (t->running_async) {\n\n usb_cancel_packet(&t->packet);\n\n t->running_async = 0;\n\n killed = 1;\n\n }\n\n if (t->running_retry) {\n\n XHCIEPContext *epctx = t->xhci->slots[t->slotid-1].eps[t->epid-1];\n\n if (epctx) {\n\n epctx->retry = NULL;\n\n timer_del(epctx->kick_timer);\n\n }\n\n t->running_retry = 0;\n\n killed = 1;\n\n }\n\n g_free(t->trbs);\n\n\n\n t->trbs = NULL;\n\n t->trb_count = t->trb_alloced = 0;\n\n\n\n return killed;\n\n}\n"}} {"sample_id": "4099df586a0f16522383c4e4a9613e7c2dcd2491", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n \n \n fd = open(filename, O_WRONLY | O_BINARY);\n+\n+ if (fd < 0)\n+\n+ return -EIO;\n+\n \n \n if (fstat(fd, &stat_buf) < 0)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int hdev_create(const char *filename, QEMUOptionParameter *options)\n\n{\n\n int fd;\n\n int ret = 0;\n\n struct stat stat_buf;\n\n int64_t total_size = 0;\n\n\n\n /* Read out options */\n\n while (options && options->name) {\n\n if (!strcmp(options->name, \"size\")) {\n\n total_size = options->value.n / 512;\n\n }\n\n options++;\n\n }\n\n\n\n fd = open(filename, O_WRONLY | O_BINARY);\n\n if (fd < 0)\n\n return -EIO;\n\n\n\n if (fstat(fd, &stat_buf) < 0)\n\n ret = -EIO;\n\n else if (!S_ISBLK(stat_buf.st_mode))\n\n ret = -EIO;\n\n else if (lseek(fd, 0, SEEK_END) < total_size * 512)\n\n ret = -ENOSPC;\n\n\n\n close(fd);\n\n return ret;\n\n}\n"}} {"sample_id": "857d4f46c31d2f4d57d2f0fad9dfb584262bf9b9_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n int64_t sector_num,\n \n QEMUIOVector *qiov,\n+\n int nb_sectors,\n+\n BlockDriverCompletionFunc *cb,\n \n void *opaque,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static BlockDriverAIOCB *bdrv_aio_rw_vector(BlockDriverState *bs,\n\n int64_t sector_num,\n\n QEMUIOVector *qiov,\n\n int nb_sectors,\n\n BlockDriverCompletionFunc *cb,\n\n void *opaque,\n\n int is_write)\n\n\n\n{\n\n BlockDriverAIOCBSync *acb;\n\n\n\n acb = qemu_aio_get(&bdrv_em_aiocb_info, bs, cb, opaque);\n\n acb->is_write = is_write;\n\n acb->qiov = qiov;\n\n acb->bounce = qemu_blockalign(bs, qiov->size);\n\n acb->bh = aio_bh_new(bdrv_get_aio_context(bs), bdrv_aio_bh_cb, acb);\n\n\n\n if (is_write) {\n\n qemu_iovec_to_buf(acb->qiov, 0, acb->bounce, qiov->size);\n\n acb->ret = bs->drv->bdrv_write(bs, sector_num, acb->bounce, nb_sectors);\n\n } else {\n\n acb->ret = bs->drv->bdrv_read(bs, sector_num, acb->bounce, nb_sectors);\n\n }\n\n\n\n qemu_bh_schedule(acb->bh);\n\n\n\n return &acb->common;\n\n}\n"}} {"sample_id": "0919ac787641db11024912651f3bc5764d4f1286_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n s->pins = qemu_allocate_irqs(omap_set_intr, s, nbanks * 32);\n \n if (pins)\n+\n+ *pins = s->pins;\n+\n+\n+\n memory_region_init_io(&s->mmio, &omap_inth_mem_ops, s, \"omap-intc\", size);\n \n memory_region_add_subregion(get_system_memory(), base, &s->mmio);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "struct omap_intr_handler_s *omap_inth_init(target_phys_addr_t base,\n\n unsigned long size, unsigned char nbanks, qemu_irq **pins,\n\n qemu_irq parent_irq, qemu_irq parent_fiq, omap_clk clk)\n\n{\n\n struct omap_intr_handler_s *s = (struct omap_intr_handler_s *)\n\n g_malloc0(sizeof(struct omap_intr_handler_s) +\n\n sizeof(struct omap_intr_handler_bank_s) * nbanks);\n\n\n\n s->parent_intr[0] = parent_irq;\n\n s->parent_intr[1] = parent_fiq;\n\n s->nbanks = nbanks;\n\n s->pins = qemu_allocate_irqs(omap_set_intr, s, nbanks * 32);\n\n if (pins)\n\n *pins = s->pins;\n\n\n\n memory_region_init_io(&s->mmio, &omap_inth_mem_ops, s, \"omap-intc\", size);\n\n memory_region_add_subregion(get_system_memory(), base, &s->mmio);\n\n\n\n omap_inth_reset(s);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "6e42e6c4b410dbef8b593c2d796a5dad95f89ee4_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n void rgb16tobgr16(const uint8_t *src, uint8_t *dst, long src_size)\n+\n+{\n+\n \tlong i;\n+\n+\tlong num_pixels = src_size >> 1;\n+\n+\n+\n+\tfor(i=0; i> 1;\n\n\n\n\tfor(i=0; i>5;\n\n\t b = (rgb&0xF800)>>11;\n\n\t dst[2*i] = (b&0x1F) | ((g&0x3F)<<5) | ((r&0x1F)<<11);\n\n\t}\n\n}\n"}} {"sample_id": "f3b2bea3c76ba9283b957f1373e7cebdbf863059", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,8 +9,8 @@\n USBDevice *dev;\n \n \n+\n+ dev = USB_DEVICE(qdev_try_create(&bus->qbus, name));\n \n if (!dev) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static USBDevice *usb_try_create_simple(USBBus *bus, const char *name,\n\n Error **errp)\n\n{\n\n Error *err = NULL;\n\n USBDevice *dev;\n\n\n\n dev = USB_DEVICE(qdev_try_create(&bus->qbus, name));\n\n if (!dev) {\n\n error_setg(errp, \"Failed to create USB device '%s'\", name);\n\n return NULL;\n\n }\n\n object_property_set_bool(OBJECT(dev), true, \"realized\", &err);\n\n if (err) {\n\n error_propagate(errp, err);\n\n error_prepend(errp, \"Failed to initialize USB device '%s': \",\n\n name);\n\n object_unparent(OBJECT(dev));\n\n return NULL;\n\n }\n\n return dev;\n\n}\n"}} {"sample_id": "221f902f1dc167bdc0bfdff6b6af3214ae3cc1f4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n uint16_t *prev = prev1;\n \n+ uint16_t *cur = cur1;\n+\n+ uint16_t *next = next1;\n+\n int x;\n \n uint16_t *prev2 = parity ? prev : cur ;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void filter_edges_16bit(void *dst1, void *prev1, void *cur1, void *next1,\n\n int w, int prefs, int mrefs, int parity, int mode)\n\n{\n\n uint16_t *dst = dst1;\n\n uint16_t *prev = prev1;\n\n uint16_t *cur = cur1;\n\n uint16_t *next = next1;\n\n int x;\n\n uint16_t *prev2 = parity ? prev : cur ;\n\n uint16_t *next2 = parity ? cur : next;\n\n mrefs /= 2;\n\n prefs /= 2;\n\n\n\n FILTER(0, 3, 0)\n\n\n\n dst = (uint16_t*)dst1 + w - 3;\n\n prev = (uint16_t*)prev1 + w - 3;\n\n cur = (uint16_t*)cur1 + w - 3;\n\n next = (uint16_t*)next1 + w - 3;\n\n prev2 = (uint16_t*)(parity ? prev : cur);\n\n next2 = (uint16_t*)(parity ? cur : next);\n\n\n\n FILTER(w - 3, w, 0)\n\n}\n"}} {"sample_id": "687db4ed2ecd5fd74c94fbb420482823cca4ab7e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void blkverify_err(BlkverifyAIOCB *acb, const char *fmt, ...)\n \n {\n+\n va_list ap;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void blkverify_err(BlkverifyAIOCB *acb, const char *fmt, ...)\n\n{\n\n va_list ap;\n\n\n\n va_start(ap, fmt);\n\n fprintf(stderr, \"blkverify: %s sector_num=%ld nb_sectors=%d \",\n\n acb->is_write ? \"write\" : \"read\", acb->sector_num,\n\n acb->nb_sectors);\n\n vfprintf(stderr, fmt, ap);\n\n fprintf(stderr, \"\\n\");\n\n va_end(ap);\n\n exit(1);\n\n}\n"}} {"sample_id": "f67a0d115254461649470452058fa3c28c0df294_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -60,10 +60,10 @@\n \n \n \n+ generate_joint_tables(s);\n+\n+\n+\n+ return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int read_old_huffman_tables(HYuvContext *s)\n\n{\n\n GetBitContext gb;\n\n int i;\n\n\n\n init_get_bits(&gb, classic_shift_luma,\n\n classic_shift_luma_table_size * 8);\n\n if (read_len_table(s->len[0], &gb) < 0)\n\n return -1;\n\n\n\n init_get_bits(&gb, classic_shift_chroma,\n\n classic_shift_chroma_table_size * 8);\n\n if (read_len_table(s->len[1], &gb) < 0)\n\n return -1;\n\n\n\n for(i=0; i<256; i++) s->bits[0][i] = classic_add_luma [i];\n\n for(i=0; i<256; i++) s->bits[1][i] = classic_add_chroma[i];\n\n\n\n if (s->bitstream_bpp >= 24) {\n\n memcpy(s->bits[1], s->bits[0], 256 * sizeof(uint32_t));\n\n memcpy(s->len[1] , s->len [0], 256 * sizeof(uint8_t));\n\n }\n\n memcpy(s->bits[2], s->bits[1], 256 * sizeof(uint32_t));\n\n memcpy(s->len[2] , s->len [1], 256 * sizeof(uint8_t));\n\n\n\n for (i = 0; i < 3; i++) {\n\n ff_free_vlc(&s->vlc[i]);\n\n init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1,\n\n s->bits[i], 4, 4, 0);\n\n }\n\n\n\n generate_joint_tables(s);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "0699dbb8478886826dedb1c33a0b74142a1cd863", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n ret->av_class = &avfilter_class;\n \n ret->filter = filter;\n+\n+ ret->name = inst_name ? av_strdup(inst_name) : NULL;\n+\n+ if (filter->priv_size)\n+\n ret->priv = av_mallocz(filter->priv_size);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int avfilter_open(AVFilterContext **filter_ctx, AVFilter *filter, const char *inst_name)\n\n{\n\n AVFilterContext *ret;\n\n *filter_ctx = NULL;\n\n\n\n if (!filter)\n\n return AVERROR(EINVAL);\n\n\n\n ret = av_mallocz(sizeof(AVFilterContext));\n\n\n\n ret->av_class = &avfilter_class;\n\n ret->filter = filter;\n\n ret->name = inst_name ? av_strdup(inst_name) : NULL;\n\n if (filter->priv_size)\n\n ret->priv = av_mallocz(filter->priv_size);\n\n\n\n ret->input_count = pad_count(filter->inputs);\n\n if (ret->input_count) {\n\n ret->input_pads = av_malloc(sizeof(AVFilterPad) * ret->input_count);\n\n memcpy(ret->input_pads, filter->inputs, sizeof(AVFilterPad) * ret->input_count);\n\n ret->inputs = av_mallocz(sizeof(AVFilterLink*) * ret->input_count);\n\n }\n\n\n\n ret->output_count = pad_count(filter->outputs);\n\n if (ret->output_count) {\n\n ret->output_pads = av_malloc(sizeof(AVFilterPad) * ret->output_count);\n\n memcpy(ret->output_pads, filter->outputs, sizeof(AVFilterPad) * ret->output_count);\n\n ret->outputs = av_mallocz(sizeof(AVFilterLink*) * ret->output_count);\n\n }\n\n\n\n *filter_ctx = ret;\n\n return 0;\n\n}\n"}} {"sample_id": "fcf73f66a67f5e58c18216f8c8651e38cf4d90af_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n static void qmp_input_type_number(Visitor *v, double *obj, const char *name,\n \n+ Error **errp)\n+\n+{\n \n QmpInputVisitor *qiv = to_qiv(v);\n+\n+ QObject *qobj = qmp_input_get_object(qiv, name, true);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void qmp_input_type_number(Visitor *v, double *obj, const char *name,\n\n Error **errp)\n\n{\n\n QmpInputVisitor *qiv = to_qiv(v);\n\n QObject *qobj = qmp_input_get_object(qiv, name, true);\n\n\n\n if (!qobj || (qobject_type(qobj) != QTYPE_QFLOAT &&\n\n qobject_type(qobj) != QTYPE_QINT)) {\n\n error_setg(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : \"null\",\n\n \"number\");\n\n return;\n\n }\n\n\n\n if (qobject_type(qobj) == QTYPE_QINT) {\n\n *obj = qint_get_int(qobject_to_qint(qobj));\n\n } else {\n\n *obj = qfloat_get_double(qobject_to_qfloat(qobj));\n\n }\n\n}\n"}} {"sample_id": "0a982b1bf3953dc8640c4d6e619fb1132ebbebc3_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -39,9 +39,9 @@\n }\n \n seek_data = g_new0(GuestFileSeek, 1);\n+\n+ seek_data->position = new_pos.QuadPart;\n+\n+ return seek_data;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "GuestFileSeek *qmp_guest_file_seek(int64_t handle, int64_t offset,\n\n int64_t whence, Error **errp)\n\n{\n\n GuestFileHandle *gfh;\n\n GuestFileSeek *seek_data;\n\n HANDLE fh;\n\n LARGE_INTEGER new_pos, off_pos;\n\n off_pos.QuadPart = offset;\n\n BOOL res;\n\n gfh = guest_file_handle_find(handle, errp);\n\n if (!gfh) {\n\n return NULL;\n\n }\n\n\n\n fh = gfh->fh;\n\n res = SetFilePointerEx(fh, off_pos, &new_pos, whence);\n\n if (!res) {\n\n error_setg_win32(errp, GetLastError(), \"failed to seek file\");\n\n return NULL;\n\n }\n\n seek_data = g_new0(GuestFileSeek, 1);\n\n seek_data->position = new_pos.QuadPart;\n\n return seek_data;\n\n}\n"}} {"sample_id": "bec1631100323fac0900aea71043d5c4e22fc2fa_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n } else {\n \n+ tcg_out16(s, RI_BRC | (cc << 4));\n+\n+ tcg_out_reloc(s, s->code_ptr, R_390_PC16DBL, labelno, -2);\n+\n+ s->code_ptr += 1;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void tgen_branch(TCGContext *s, int cc, int labelno)\n\n{\n\n TCGLabel* l = &s->labels[labelno];\n\n if (l->has_value) {\n\n tgen_gotoi(s, cc, l->u.value_ptr);\n\n } else if (USE_LONG_BRANCHES) {\n\n tcg_out16(s, RIL_BRCL | (cc << 4));\n\n tcg_out_reloc(s, s->code_ptr, R_390_PC32DBL, labelno, -2);\n\n s->code_ptr += 2;\n\n } else {\n\n tcg_out16(s, RI_BRC | (cc << 4));\n\n tcg_out_reloc(s, s->code_ptr, R_390_PC16DBL, labelno, -2);\n\n s->code_ptr += 1;\n\n }\n\n}\n"}} {"sample_id": "ee9f36a88eb3e2706ea659acb0ca80c414fa5d8a_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,10 +36,10 @@\n \n s1 %= BASE;\n \n+ s2 %= BASE;\n+\n+ }\n+\n+ return (s2 << 16) | s1;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t adler32(uint32_t adler, const uint8_t *buf, unsigned int len)\n\n{\n\n unsigned long s1 = adler & 0xffff;\n\n unsigned long s2 = (adler >> 16) & 0xffff;\n\n int k;\n\n\n\n if (buf == NULL) return 1L;\n\n\n\n while (len > 0) {\n\n k = len < NMAX ? len : NMAX;\n\n len -= k;\n\n while (k >= 16) {\n\n DO16(buf);\n\n k -= 16;\n\n }\n\n if (k != 0) do {\n\n DO1(buf);\n\n } while (--k);\n\n s1 %= BASE;\n\n s2 %= BASE;\n\n }\n\n return (s2 << 16) | s1;\n\n}\n"}} {"sample_id": "ab8131afee34d6aa427bd56ac18c4d3b6df80728", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n static void booke_update_fixed_timer(CPUPPCState *env,\n \n+ uint8_t target_bit,\n \n+ uint64_t *next,\n \n struct QEMUTimer *timer)\n \n+{\n+\n ppc_tb_t *tb_env = env->tb_env;\n \n uint64_t lapse;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void booke_update_fixed_timer(CPUPPCState *env,\n\n uint8_t target_bit,\n\n uint64_t *next,\n\n struct QEMUTimer *timer)\n\n{\n\n ppc_tb_t *tb_env = env->tb_env;\n\n uint64_t lapse;\n\n uint64_t tb;\n\n uint64_t period = 1 << (target_bit + 1);\n\n uint64_t now;\n\n\n\n now = qemu_get_clock_ns(vm_clock);\n\n tb = cpu_ppc_get_tb(tb_env, now, tb_env->tb_offset);\n\n\n\n lapse = period - ((tb - (1 << target_bit)) & (period - 1));\n\n\n\n *next = now + muldiv64(lapse, get_ticks_per_sec(), tb_env->tb_freq);\n\n\n\n /* XXX: If expire time is now. We can't run the callback because we don't\n\n * have access to it. So we just set the timer one nanosecond later.\n\n */\n\n\n\n if (*next == now) {\n\n (*next)++;\n\n }\n\n\n\n qemu_mod_timer(timer, *next);\n\n}\n"}} {"sample_id": "89bcb77726e222aee9d8536f0310d805f7d39fac", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n * 10 - Epoch start, previous objects and palettes can be released\n * 11 - Epoch continue, previous objects and palettes can be released\n *\n+ * reserved 6 bits discarded\n+ */\n+ state = bytestream_get_byte(&buf) >> 6;\n+ if (state != 0) {\n+ flush_cache(avctx);\n /*\n * skip palette_update_flag (0x80),\n */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int parse_presentation_segment(AVCodecContext *avctx,\n const uint8_t *buf, int buf_size,\n int64_t pts)\n{\n PGSSubContext *ctx = avctx->priv_data;\n int i, state, ret;\n const uint8_t *buf_end = buf + buf_size;\n // Video descriptor\n int w = bytestream_get_be16(&buf);\n int h = bytestream_get_be16(&buf);\n uint16_t object_index;\n ctx->presentation.pts = pts;\n av_dlog(avctx, \"Video Dimensions %dx%d\\n\",\n w, h);\n ret = ff_set_dimensions(avctx, w, h);\n if (ret < 0)\n return ret;\n /* Skip 1 bytes of unknown, frame rate */\n buf++;\n // Composition descriptor\n ctx->presentation.id_number = bytestream_get_be16(&buf);\n /*\n * state is a 2 bit field that defines pgs epoch boundaries\n * 00 - Normal, previously defined objects and palettes are still valid\n * 01 - Acquisition point, previous objects and palettes can be released\n * 10 - Epoch start, previous objects and palettes can be released\n * 11 - Epoch continue, previous objects and palettes can be released\n *\n * reserved 6 bits discarded\n */\n state = bytestream_get_byte(&buf) >> 6;\n if (state != 0) {\n flush_cache(avctx);\n /*\n * skip palette_update_flag (0x80),\n */\n buf += 1;\n ctx->presentation.palette_id = bytestream_get_byte(&buf);\n ctx->presentation.object_count = bytestream_get_byte(&buf);\n if (ctx->presentation.object_count > MAX_OBJECT_REFS) {\n av_log(avctx, AV_LOG_ERROR,\n \"Invalid number of presentation objects %d\\n\",\n ctx->presentation.object_count);\n ctx->presentation.object_count = 2;\n if (avctx->err_recognition & AV_EF_EXPLODE) {\n for (i = 0; i < ctx->presentation.object_count; i++)\n {\n ctx->presentation.objects[i].id = bytestream_get_be16(&buf);\n ctx->presentation.objects[i].window_id = bytestream_get_byte(&buf);\n ctx->presentation.objects[i].composition_flag = bytestream_get_byte(&buf);\n ctx->presentation.objects[i].x = bytestream_get_be16(&buf);\n ctx->presentation.objects[i].y = bytestream_get_be16(&buf);\n // If cropping\n if (ctx->presentation.objects[i].composition_flag & 0x80) {\n ctx->presentation.objects[i].crop_x = bytestream_get_be16(&buf);\n ctx->presentation.objects[i].crop_y = bytestream_get_be16(&buf);\n ctx->presentation.objects[i].crop_w = bytestream_get_be16(&buf);\n ctx->presentation.objects[i].crop_h = bytestream_get_be16(&buf);\n av_dlog(avctx, \"Subtitle Placement x=%d, y=%d\\n\",\n ctx->presentation.objects[i].x, ctx->presentation.objects[i].y);\n if (ctx->presentation.objects[i].x > avctx->width ||\n ctx->presentation.objects[i].y > avctx->height) {\n av_log(avctx, AV_LOG_ERROR, \"Subtitle out of video bounds. x = %d, y = %d, video width = %d, video height = %d.\\n\",\n ctx->presentation.objects[i].x,\n ctx->presentation.objects[i].y,\n avctx->width, avctx->height);\n ctx->presentation.objects[i].x = 0;\n ctx->presentation.objects[i].y = 0;\n if (avctx->err_recognition & AV_EF_EXPLODE) {\n return 0;"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n fprintf(stderr, \"qemu: tried to set invalid watchpoint at \"\n \n+ TARGET_FMT_lx \", len=\" TARGET_FMT_lu \"\\n\", addr, len);\n+\n+ return -EINVAL;\n+\n+ }\n \n wp = qemu_malloc(sizeof(*wp));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int cpu_watchpoint_insert(CPUState *env, target_ulong addr, target_ulong len,\n\n int flags, CPUWatchpoint **watchpoint)\n\n{\n\n target_ulong len_mask = ~(len - 1);\n\n CPUWatchpoint *wp;\n\n\n\n /* sanity checks: allow power-of-2 lengths, deny unaligned watchpoints */\n\n if ((len != 1 && len != 2 && len != 4 && len != 8) || (addr & ~len_mask)) {\n\n fprintf(stderr, \"qemu: tried to set invalid watchpoint at \"\n\n TARGET_FMT_lx \", len=\" TARGET_FMT_lu \"\\n\", addr, len);\n\n return -EINVAL;\n\n }\n\n wp = qemu_malloc(sizeof(*wp));\n\n\n\n wp->vaddr = addr;\n\n wp->len_mask = len_mask;\n\n wp->flags = flags;\n\n\n\n /* keep all GDB-injected watchpoints in front */\n\n if (flags & BP_GDB)\n\n TAILQ_INSERT_HEAD(&env->watchpoints, wp, entry);\n\n else\n\n TAILQ_INSERT_TAIL(&env->watchpoints, wp, entry);\n\n\n\n tlb_flush_page(env, addr);\n\n\n\n if (watchpoint)\n\n *watchpoint = wp;\n\n return 0;\n\n}\n"}} {"sample_id": "2a7e6857cd3178d705a49c4adde2f3af26ed3ae1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -46,11 +46,11 @@\n \n info->server = qmp_query_server_entry(\n \n+ vd->lwebsock, true, info->server);\n+\n+ }\n+\n+\n \n item = g_new0(VncInfo2List, 1);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "VncInfo2List *qmp_query_vnc_servers(Error **errp)\n\n{\n\n VncInfo2List *item, *prev = NULL;\n\n VncInfo2 *info;\n\n VncDisplay *vd;\n\n DeviceState *dev;\n\n\n\n QTAILQ_FOREACH(vd, &vnc_displays, next) {\n\n info = g_new0(VncInfo2, 1);\n\n info->id = g_strdup(vd->id);\n\n info->clients = qmp_query_client_list(vd);\n\n qmp_query_auth(vd, info);\n\n if (vd->dcl.con) {\n\n dev = DEVICE(object_property_get_link(OBJECT(vd->dcl.con),\n\n \"device\", NULL));\n\n info->has_display = true;\n\n info->display = g_strdup(dev->id);\n\n }\n\n if (vd->lsock != NULL) {\n\n info->server = qmp_query_server_entry(\n\n vd->lsock, false, info->server);\n\n }\n\n if (vd->lwebsock != NULL) {\n\n info->server = qmp_query_server_entry(\n\n vd->lwebsock, true, info->server);\n\n }\n\n\n\n item = g_new0(VncInfo2List, 1);\n\n item->value = info;\n\n item->next = prev;\n\n prev = item;\n\n }\n\n return prev;\n\n}\n"}} {"sample_id": "c24e7517ee4a98e90eee5f0f07708a1fa12326b3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n DeviceState *dev;\n \n Error *err = NULL;\n+\n \n \n driver = bdrv_is_sg(bdrv) ? \"scsi-generic\" : \"scsi-disk\";", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, BlockDriverState *bdrv,\n\n int unit, bool removable, int bootindex,\n\n const char *serial, Error **errp)\n\n{\n\n const char *driver;\n\n DeviceState *dev;\n\n Error *err = NULL;\n\n\n\n driver = bdrv_is_sg(bdrv) ? \"scsi-generic\" : \"scsi-disk\";\n\n dev = qdev_create(&bus->qbus, driver);\n\n qdev_prop_set_uint32(dev, \"scsi-id\", unit);\n\n if (bootindex >= 0) {\n\n qdev_prop_set_int32(dev, \"bootindex\", bootindex);\n\n }\n\n if (object_property_find(OBJECT(dev), \"removable\", NULL)) {\n\n qdev_prop_set_bit(dev, \"removable\", removable);\n\n }\n\n if (serial) {\n\n qdev_prop_set_string(dev, \"serial\", serial);\n\n }\n\n if (qdev_prop_set_drive(dev, \"drive\", bdrv) < 0) {\n\n error_setg(errp, \"Setting drive property failed\");\n\n qdev_free(dev);\n\n return NULL;\n\n }\n\n object_property_set_bool(OBJECT(dev), true, \"realized\", &err);\n\n if (err != NULL) {\n\n error_propagate(errp, err);\n\n qdev_free(dev);\n\n return NULL;\n\n }\n\n return SCSI_DEVICE(dev);\n\n}\n"}} {"sample_id": "d7b61ecc61f84d23f98f1ee270fb48b41834ca00_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n /* revision */\n \n+ d->config[0x08] = 0x00;\n+\n+ pci_config_set_class(d->config, PCI_CLASS_BRIDGE_HOST);\n+\n+ /* cache line size */\n \n d->config[0x0C] = 0x08;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int u3_agp_pci_host_init(PCIDevice *d)\n\n{\n\n pci_config_set_vendor_id(d->config, PCI_VENDOR_ID_APPLE);\n\n pci_config_set_device_id(d->config, PCI_DEVICE_ID_APPLE_U3_AGP);\n\n /* revision */\n\n d->config[0x08] = 0x00;\n\n pci_config_set_class(d->config, PCI_CLASS_BRIDGE_HOST);\n\n /* cache line size */\n\n d->config[0x0C] = 0x08;\n\n /* latency timer */\n\n d->config[0x0D] = 0x10;\n\n return 0;\n\n}\n"}} {"sample_id": "0b8b8753e4d94901627b3e86431230f2319215c4_42", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void test_self(void)\n \n+{\n+\n Coroutine *coroutine;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void test_self(void)\n\n{\n\n Coroutine *coroutine;\n\n\n\n coroutine = qemu_coroutine_create(verify_self);\n\n qemu_coroutine_enter(coroutine, &coroutine);\n\n}\n"}} {"sample_id": "ff2b68aa70d10b7eae813b04e9a23723dbd89ebd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n+static void nbd_client_close(NBDClient *client)\n+\n+{\n+\n qemu_set_fd_handler2(client->sock, NULL, NULL, NULL, NULL);\n \n close(client->sock);\n+\n client->sock = -1;\n \n if (client->close) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void nbd_client_close(NBDClient *client)\n\n{\n\n qemu_set_fd_handler2(client->sock, NULL, NULL, NULL, NULL);\n\n close(client->sock);\n\n client->sock = -1;\n\n if (client->close) {\n\n client->close(client);\n\n }\n\n nbd_client_put(client);\n\n}\n"}} {"sample_id": "5706db1deb061ee9affdcea81e59c4c2cad7c41e_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int line_out_init (HWVoiceOut *hw, struct audsettings *as)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int line_out_init (HWVoiceOut *hw, struct audsettings *as)\n\n{\n\n SpiceVoiceOut *out = container_of (hw, SpiceVoiceOut, hw);\n\n struct audsettings settings;\n\n\n\n#if SPICE_INTERFACE_PLAYBACK_MAJOR > 1 || SPICE_INTERFACE_PLAYBACK_MINOR >= 3\n\n settings.freq = spice_server_get_best_playback_rate(NULL);\n\n#else\n\n settings.freq = SPICE_INTERFACE_PLAYBACK_FREQ;\n\n#endif\n\n settings.nchannels = SPICE_INTERFACE_PLAYBACK_CHAN;\n\n settings.fmt = AUD_FMT_S16;\n\n settings.endianness = AUDIO_HOST_ENDIANNESS;\n\n\n\n audio_pcm_init_info (&hw->info, &settings);\n\n hw->samples = LINE_OUT_SAMPLES;\n\n out->active = 0;\n\n\n\n out->sin.base.sif = &playback_sif.base;\n\n qemu_spice_add_interface (&out->sin.base);\n\n#if SPICE_INTERFACE_PLAYBACK_MAJOR > 1 || SPICE_INTERFACE_PLAYBACK_MINOR >= 3\n\n spice_server_set_playback_rate(&out->sin, settings.freq);\n\n#endif\n\n return 0;\n\n}\n"}} {"sample_id": "3a8f2a9ce51036ab2d25bcc31114b5cbb72ab44b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n assert(!(size & (size - 1))); /* power of 2 */\n+\n assert(size >= PCIE_MMCFG_SIZE_MIN);\n \n assert(size <= PCIE_MMCFG_SIZE_MAX);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void pcie_host_mmcfg_init(PCIExpressHost *e, uint32_t size)\n\n{\n\n assert(!(size & (size - 1))); /* power of 2 */\n\n assert(size >= PCIE_MMCFG_SIZE_MIN);\n\n assert(size <= PCIE_MMCFG_SIZE_MAX);\n\n e->size = size;\n\n memory_region_init_io(&e->mmio, OBJECT(e), &pcie_mmcfg_ops, e,\n\n \"pcie-mmcfg\", e->size);\n\n}\n"}} {"sample_id": "d185c094b404b4ff392b77d1244c0233da7d53bd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n gpointer user_data)\n \n {\n+\n+ return g_io_watch_funcs.dispatch(source, callback, user_data);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static gboolean io_watch_poll_dispatch(GSource *source, GSourceFunc callback,\n\n gpointer user_data)\n\n{\n\n return g_io_watch_funcs.dispatch(source, callback, user_data);\n\n}\n"}} {"sample_id": "a779602584b43578e8baa69b367ba7d64e973dd0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int decode_mb(MadContext *s, AVFrame *frame, int inter)\n \n+{\n \n int mv_map = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int decode_mb(MadContext *s, AVFrame *frame, int inter)\n\n{\n\n int mv_map = 0;\n\n int mv_x, mv_y;\n\n int j;\n\n\n\n if (inter) {\n\n int v = decode210(&s->gb);\n\n if (v < 2) {\n\n mv_map = v ? get_bits(&s->gb, 6) : 63;\n\n mv_x = decode_motion(&s->gb);\n\n mv_y = decode_motion(&s->gb);\n\n }\n\n }\n\n\n\n for (j=0; j<6; j++) {\n\n if (mv_map & (1<gb);\n\n if (s->last_frame->data[0])\n\n comp_block(s, frame, s->mb_x, s->mb_y, j, mv_x, mv_y, add);\n\n } else {\n\n s->dsp.clear_block(s->block);\n\n if(decode_block_intra(s, s->block) < 0)\n\n return -1;\n\n idct_put(s, frame, s->block, s->mb_x, s->mb_y, j);\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "f8762027a33e2f5d0915c56a904962b1481f75c1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n socklen_t addrlen;\n \n+ int ret;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int socket_accept(int sock)\n\n{\n\n struct sockaddr_un addr;\n\n socklen_t addrlen;\n\n int ret;\n\n\n\n addrlen = sizeof(addr);\n\n do {\n\n ret = accept(sock, (struct sockaddr *)&addr, &addrlen);\n\n } while (ret == -1 && errno == EINTR);\n\n g_assert_no_errno(ret);\n\n close(sock);\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "83f338f73ecb88cc6f85d6e7b81ebef112ce07be_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n CPUDebugExcpHandler *cpu_set_debug_excp_handler(CPUDebugExcpHandler *handler)\n \n+{\n+\n+ CPUDebugExcpHandler *old_handler = debug_excp_handler;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "CPUDebugExcpHandler *cpu_set_debug_excp_handler(CPUDebugExcpHandler *handler)\n\n{\n\n CPUDebugExcpHandler *old_handler = debug_excp_handler;\n\n\n\n debug_excp_handler = handler;\n\n return old_handler;\n\n}\n"}} {"sample_id": "7f3be0f20ff8d976ab982cc06026cac0600f1fb6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void virtio_gpu_cleanup_mapping(struct virtio_gpu_simple_resource *res)\n \n+{\n \n virtio_gpu_cleanup_mapping_iov(res->iov, res->iov_cnt);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void virtio_gpu_cleanup_mapping(struct virtio_gpu_simple_resource *res)\n\n{\n\n virtio_gpu_cleanup_mapping_iov(res->iov, res->iov_cnt);\n\n g_free(res->iov);\n\n res->iov = NULL;\n\n res->iov_cnt = 0;\n\n}\n"}} {"sample_id": "31e8fd86f24b4eec8a1708d712bf0532460bb0a5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n r->req.resid -= r->req.sg->size;\n r->req.aiocb = dma_bdrv_read(s->qdev.conf.bs, r->req.sg, r->sector,\n scsi_dma_complete, r);\n+ } else {\n+ n = scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);\n+ bdrv_acct_start(s->qdev.conf.bs, &r->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ);\n+ r->req.aiocb = bdrv_aio_readv(s->qdev.conf.bs, r->sector, &r->qiov, n,\n+ scsi_read_complete, r);\n done:\n if (!r->req.io_canceled) {\n scsi_req_unref(&r->req);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void scsi_do_read(void *opaque, int ret)\n{\n SCSIDiskReq *r = opaque;\n SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);\n uint32_t n;\n if (r->req.aiocb != NULL) {\n r->req.aiocb = NULL;\n bdrv_acct_done(s->qdev.conf.bs, &r->acct);\n if (ret < 0) {\n if (scsi_handle_rw_error(r, -ret)) {\n goto done;\n if (r->req.sg) {\n dma_acct_start(s->qdev.conf.bs, &r->acct, r->req.sg, BDRV_ACCT_READ);\n r->req.resid -= r->req.sg->size;\n r->req.aiocb = dma_bdrv_read(s->qdev.conf.bs, r->req.sg, r->sector,\n scsi_dma_complete, r);\n } else {\n n = scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);\n bdrv_acct_start(s->qdev.conf.bs, &r->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ);\n r->req.aiocb = bdrv_aio_readv(s->qdev.conf.bs, r->sector, &r->qiov, n,\n scsi_read_complete, r);\ndone:\n if (!r->req.io_canceled) {\n scsi_req_unref(&r->req);"}} {"sample_id": "66b9b43c42049bcae37668e890fedde9a72c8167_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n+static void watch_mem_write(void *opaque, hwaddr addr,\n+\n uint64_t val, unsigned size)\n+\n {\n+\n check_watchpoint(addr & ~TARGET_PAGE_MASK, size, BP_MEM_WRITE);\n+\n switch (size) {\n \n case 1:", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void watch_mem_write(void *opaque, hwaddr addr,\n\n uint64_t val, unsigned size)\n\n{\n\n check_watchpoint(addr & ~TARGET_PAGE_MASK, size, BP_MEM_WRITE);\n\n switch (size) {\n\n case 1:\n\n stb_phys(&address_space_memory, addr, val);\n\n break;\n\n case 2:\n\n stw_phys(&address_space_memory, addr, val);\n\n break;\n\n case 4:\n\n stl_phys(&address_space_memory, addr, val);\n\n break;\n\n default: abort();\n\n }\n\n}\n"}} {"sample_id": "8bcf5840ea2a6a92c75ab3219f89fe0b8a53cf50", "diff": "--- a/source.c\n+++ b/source.c\n@@ -42,11 +42,11 @@\n \n cf->idx_ref = av_buffer_pool_get(ctx->decoder_pool);\n \n+ if (!cf->idx_ref) {\n+\n+ av_log(avctx, AV_LOG_ERROR, \"No decoder surfaces left\\n\");\n+\n+ ret = AVERROR(ENOMEM);\n \n goto fail;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int ff_nvdec_start_frame(AVCodecContext *avctx, AVFrame *frame)\n\n{\n\n NVDECContext *ctx = avctx->internal->hwaccel_priv_data;\n\n FrameDecodeData *fdd = (FrameDecodeData*)frame->private_ref->data;\n\n NVDECFrame *cf = NULL;\n\n int ret;\n\n\n\n ctx->bitstream_len = 0;\n\n ctx->nb_slices = 0;\n\n\n\n if (fdd->hwaccel_priv)\n\n return 0;\n\n\n\n cf = av_mallocz(sizeof(*cf));\n\n if (!cf)\n\n return AVERROR(ENOMEM);\n\n\n\n cf->decoder_ref = av_buffer_ref(ctx->decoder_ref);\n\n if (!cf->decoder_ref)\n\n goto fail;\n\n\n\n cf->idx_ref = av_buffer_pool_get(ctx->decoder_pool);\n\n if (!cf->idx_ref) {\n\n av_log(avctx, AV_LOG_ERROR, \"No decoder surfaces left\\n\");\n\n ret = AVERROR(ENOMEM);\n\n goto fail;\n\n }\n\n cf->idx = *(unsigned int*)cf->idx_ref->data;\n\n\n\n fdd->hwaccel_priv = cf;\n\n fdd->hwaccel_priv_free = nvdec_fdd_priv_free;\n\n fdd->post_process = nvdec_retrieve_data;\n\n\n\n return 0;\n\nfail:\n\n nvdec_fdd_priv_free(cf);\n\n return ret;\n\n\n\n}\n"}} {"sample_id": "d1f558b3628d3ab99fd93a98b5758ef1be45a5da", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n case DCA_SYNCWORD_CORE_14B_LE:\n \n return avpriv_dca_convert_bitstream(src, src_size, dst, max_size);\n+\n+ default:\n+\n+ return AVERROR_INVALIDDATA;\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int convert_bitstream(const uint8_t *src, int src_size, uint8_t *dst, int max_size)\n\n{\n\n switch (AV_RB32(src)) {\n\n case DCA_SYNCWORD_CORE_BE:\n\n case DCA_SYNCWORD_SUBSTREAM:\n\n memcpy(dst, src, src_size);\n\n return src_size;\n\n case DCA_SYNCWORD_CORE_LE:\n\n case DCA_SYNCWORD_CORE_14B_BE:\n\n case DCA_SYNCWORD_CORE_14B_LE:\n\n return avpriv_dca_convert_bitstream(src, src_size, dst, max_size);\n\n default:\n\n return AVERROR_INVALIDDATA;\n\n }\n\n}\n"}} {"sample_id": "dcfd14b3741983c466ad92fa2ae91eeafce3e5d5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,9 +25,9 @@\n if (last1 == last)\n \n break;\n+\n+ addr = last1 + 1;\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void arm_cache_flush(abi_ulong start, abi_ulong last)\n\n{\n\n abi_ulong addr, last1;\n\n\n\n if (last < start)\n\n return;\n\n addr = start;\n\n for(;;) {\n\n last1 = ((addr + TARGET_PAGE_SIZE) & TARGET_PAGE_MASK) - 1;\n\n if (last1 > last)\n\n last1 = last;\n\n tb_invalidate_page_range(addr, last1 + 1);\n\n if (last1 == last)\n\n break;\n\n addr = last1 + 1;\n\n }\n\n}\n"}} {"sample_id": "c77b858c4cafe74cd663bdd1bc9d96a487b20e14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,8 +14,8 @@\n \n ((pixel4*)(src+y*stride))[1] = PIXEL_SPLAT_X4(l##y)\n \n+ ROW(0); ROW(1); ROW(2); ROW(3); ROW(4); ROW(5); ROW(6); ROW(7);\n+\n+#undef ROW\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void FUNCC(pred8x8l_horizontal)(uint8_t *p_src, int has_topleft, int has_topright, int p_stride)\n\n{\n\n pixel *src = (pixel*)p_src;\n\n int stride = p_stride>>(sizeof(pixel)-1);\n\n\n\n PREDICT_8x8_LOAD_LEFT;\n\n#define ROW(y) ((pixel4*)(src+y*stride))[0] =\\\n\n ((pixel4*)(src+y*stride))[1] = PIXEL_SPLAT_X4(l##y)\n\n ROW(0); ROW(1); ROW(2); ROW(3); ROW(4); ROW(5); ROW(6); ROW(7);\n\n#undef ROW\n\n}\n"}} {"sample_id": "f17fd4fdf0df3d2f3444399d04c38d22b9a3e1b7_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,9 +33,9 @@\n str = \"crap\";\n \n res = qemu_strtosz(str, &endptr);\n+\n+ g_assert_cmpint(res, ==, -EINVAL);\n+\n+ g_assert(endptr == str);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_qemu_strtosz_invalid(void)\n\n{\n\n const char *str;\n\n char *endptr = NULL;\n\n int64_t res;\n\n\n\n str = \"\";\n\n res = qemu_strtosz(str, &endptr);\n\n g_assert_cmpint(res, ==, -EINVAL);\n\n g_assert(endptr == str);\n\n\n\n str = \" \\t \";\n\n res = qemu_strtosz(str, &endptr);\n\n g_assert_cmpint(res, ==, -EINVAL);\n\n g_assert(endptr == str);\n\n\n\n str = \"crap\";\n\n res = qemu_strtosz(str, &endptr);\n\n g_assert_cmpint(res, ==, -EINVAL);\n\n g_assert(endptr == str);\n\n}\n"}} {"sample_id": "adc39b28a5264591b9f8e5838a752c3d547e8110", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n const uint8_t *src_data[4], const int src_linesizes[4],\n \n+ enum AVPixelFormat pix_fmt, int width, int height)\n+\n+{\n+\n+ const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(pix_fmt);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void av_image_copy(uint8_t *dst_data[4], int dst_linesizes[4],\n\n const uint8_t *src_data[4], const int src_linesizes[4],\n\n enum AVPixelFormat pix_fmt, int width, int height)\n\n{\n\n const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(pix_fmt);\n\n\n\n if (!desc || desc->flags & PIX_FMT_HWACCEL)\n\n\n\n\n if (desc->flags & PIX_FMT_PAL ||\n\n desc->flags & PIX_FMT_PSEUDOPAL) {\n\n av_image_copy_plane(dst_data[0], dst_linesizes[0],\n\n src_data[0], src_linesizes[0],\n\n width, height);\n\n /* copy the palette */\n\n memcpy(dst_data[1], src_data[1], 4*256);\n\n } else {\n\n int i, planes_nb = 0;\n\n\n\n for (i = 0; i < desc->nb_components; i++)\n\n planes_nb = FFMAX(planes_nb, desc->comp[i].plane + 1);\n\n\n\n for (i = 0; i < planes_nb; i++) {\n\n int h = height;\n\n int bwidth = av_image_get_linesize(pix_fmt, width, i);\n\n\n\n\n\n if (i == 1 || i == 2) {\n\n h= -((-height)>>desc->log2_chroma_h);\n\n\n av_image_copy_plane(dst_data[i], dst_linesizes[i],\n\n src_data[i], src_linesizes[i],\n\n bwidth, h);\n\n\n"}} {"sample_id": "7e7e2ebc942da8285931ceabf12823e165dced8b_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -44,11 +44,11 @@\n \n \n \n+ default: /* Should not be possible, but just in case */\n+\n+ VNC_DEBUG(\"Reject subauth %d server bug\\n\", vs->vd->auth);\n+\n+ vnc_write_u8(vs, 1);\n \n if (vs->minor >= 8) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void start_auth_vencrypt_subauth(VncState *vs)\n\n{\n\n switch (vs->vd->subauth) {\n\n case VNC_AUTH_VENCRYPT_TLSNONE:\n\n case VNC_AUTH_VENCRYPT_X509NONE:\n\n VNC_DEBUG(\"Accept TLS auth none\\n\");\n\n vnc_write_u32(vs, 0); /* Accept auth completion */\n\n start_client_init(vs);\n\n break;\n\n\n\n case VNC_AUTH_VENCRYPT_TLSVNC:\n\n case VNC_AUTH_VENCRYPT_X509VNC:\n\n VNC_DEBUG(\"Start TLS auth VNC\\n\");\n\n start_auth_vnc(vs);\n\n break;\n\n\n\n#ifdef CONFIG_VNC_SASL\n\n case VNC_AUTH_VENCRYPT_TLSSASL:\n\n case VNC_AUTH_VENCRYPT_X509SASL:\n\n VNC_DEBUG(\"Start TLS auth SASL\\n\");\n\n return start_auth_sasl(vs);\n\n#endif /* CONFIG_VNC_SASL */\n\n\n\n default: /* Should not be possible, but just in case */\n\n VNC_DEBUG(\"Reject subauth %d server bug\\n\", vs->vd->auth);\n\n vnc_write_u8(vs, 1);\n\n if (vs->minor >= 8) {\n\n static const char err[] = \"Unsupported authentication type\";\n\n vnc_write_u32(vs, sizeof(err));\n\n vnc_write(vs, err, sizeof(err));\n\n }\n\n vnc_client_error(vs);\n\n }\n\n}\n"}} {"sample_id": "d6085e3ace20bc9b0fa625d8d79b22668710e217_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n return 0;\n \n+\n+\n+ n->has_ufo = qemu_peer_has_ufo(qemu_get_queue(n->nic));\n+\n \n \n return n->has_ufo;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int peer_has_ufo(VirtIONet *n)\n\n{\n\n if (!peer_has_vnet_hdr(n))\n\n return 0;\n\n\n\n n->has_ufo = qemu_peer_has_ufo(qemu_get_queue(n->nic));\n\n\n\n return n->has_ufo;\n\n}\n"}} {"sample_id": "8cd1c0febe88b757e915e9af15559575c21ca728", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static void pcx_palette(const uint8_t **src, uint32_t *dst, unsigned int pallen) {\n+\n unsigned int i;\n+\n \n \n for (i=0; ierr_recv && av_fifo_size(mq->fifo) < mq->elsize) {\n \n if ((flags & AV_THREAD_MESSAGE_NONBLOCK))", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int av_thread_message_queue_recv_locked(AVThreadMessageQueue *mq,\n\n void *msg,\n\n unsigned flags)\n\n{\n\n while (!mq->err_recv && av_fifo_size(mq->fifo) < mq->elsize) {\n\n if ((flags & AV_THREAD_MESSAGE_NONBLOCK))\n\n return AVERROR(EAGAIN);\n\n pthread_cond_wait(&mq->cond, &mq->lock);\n\n }\n\n if (av_fifo_size(mq->fifo) < mq->elsize)\n\n return mq->err_recv;\n\n av_fifo_generic_read(mq->fifo, msg, mq->elsize, NULL);\n\n pthread_cond_signal(&mq->cond);\n\n return 0;\n\n}\n"}} {"sample_id": "8d6ef7c9fe880c710dd55cfe7a0f076be475bede", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n struct QOSState *qs = g_malloc(sizeof(QOSState));\n \n+\n+\n+ cmdline = g_strdup_vprintf(cmdline_fmt, ap);\n+\n+ qs->qts = qtest_start(cmdline);\n \n qs->ops = ops;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "QOSState *qtest_vboot(QOSOps *ops, const char *cmdline_fmt, va_list ap)\n\n{\n\n char *cmdline;\n\n\n\n struct QOSState *qs = g_malloc(sizeof(QOSState));\n\n\n\n cmdline = g_strdup_vprintf(cmdline_fmt, ap);\n\n qs->qts = qtest_start(cmdline);\n\n qs->ops = ops;\n\n qtest_irq_intercept_in(global_qtest, \"ioapic\");\n\n if (ops && ops->init_allocator) {\n\n qs->alloc = ops->init_allocator(ALLOC_NO_FLAGS);\n\n }\n\n\n\n g_free(cmdline);\n\n return qs;\n\n}\n"}} {"sample_id": "fd6e513ee1dc13174256de8adaeeb2c2691eee95_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int mov_read_wide(MOVContext *c, ByteIOContext *pb, MOV_atom_t atom)\n \n+{\n \n int err;\n \n@@ -11,7 +11,7 @@\n #ifdef DEBUG\n \n print_atom(\"wide\", atom);\n+\n debug_indent++;\n \n #endif", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int mov_read_wide(MOVContext *c, ByteIOContext *pb, MOV_atom_t atom)\n\n{\n\n int err;\n\n uint32_t type;\n\n\n\n#ifdef DEBUG\n\n print_atom(\"wide\", atom);\n\n debug_indent++;\n\n#endif\n\n if (atom.size < 8)\n\n return 0; /* continue */\n\n if (get_be32(pb) != 0) { /* 0 sized mdat atom... use the 'wide' atom size */\n\n url_fskip(pb, atom.size - 4);\n\n return 0;\n\n }\n\n atom.type = get_le32(pb);\n\n atom.offset += 8;\n\n atom.size -= 8;\n\n if (type != MKTAG('m', 'd', 'a', 't')) {\n\n url_fskip(pb, atom.size);\n\n return 0;\n\n }\n\n err = mov_read_mdat(c, pb, atom);\n\n#ifdef DEBUG\n\n debug_indent--;\n\n#endif\n\n return err;\n\n}\n"}} {"sample_id": "39ee3af3a85fedb55b9eeb1a0bc81a2460eeaa01", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void AcpiCpuHotplug_add(ACPIGPE *gpe, AcpiCpuHotplug *g, CPUState *cpu)\n \n+{\n+\n+ CPUClass *k = CPU_GET_CLASS(cpu);\n+\n int64_t cpu_id;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void AcpiCpuHotplug_add(ACPIGPE *gpe, AcpiCpuHotplug *g, CPUState *cpu)\n\n{\n\n CPUClass *k = CPU_GET_CLASS(cpu);\n\n int64_t cpu_id;\n\n\n\n *gpe->sts = *gpe->sts | ACPI_CPU_HOTPLUG_STATUS;\n\n cpu_id = k->get_arch_id(CPU(cpu));\n\n\n g->sts[cpu_id / 8] |= (1 << (cpu_id % 8));\n\n}"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_261", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n } else {\n \n tmp = (tmp & 0x00ff) | (value << 8);\n+\n+ }\n+\n+ m5206_mbar_writew(opaque, offset & ~1, tmp);\n+\n return;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void m5206_mbar_writeb(void *opaque, target_phys_addr_t offset,\n\n uint32_t value)\n\n{\n\n m5206_mbar_state *s = (m5206_mbar_state *)opaque;\n\n int width;\n\n offset &= 0x3ff;\n\n if (offset >= 0x200) {\n\n hw_error(\"Bad MBAR write offset 0x%x\", (int)offset);\n\n }\n\n width = m5206_mbar_width[offset >> 2];\n\n if (width > 1) {\n\n uint32_t tmp;\n\n tmp = m5206_mbar_readw(opaque, offset & ~1);\n\n if (offset & 1) {\n\n tmp = (tmp & 0xff00) | value;\n\n } else {\n\n tmp = (tmp & 0x00ff) | (value << 8);\n\n }\n\n m5206_mbar_writew(opaque, offset & ~1, tmp);\n\n return;\n\n }\n\n m5206_mbar_write(s, offset, value, 1);\n\n}\n"}} {"sample_id": "0491a2a07a44f6e5e6f34081835e402c07025fd2_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static inline void writer_print_string(WriterContext *wctx,\n \n+ const char *key, const char *val)\n+\n {\n \n wctx->writer->print_string(wctx, key, val);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void writer_print_string(WriterContext *wctx,\n\n const char *key, const char *val)\n\n{\n\n wctx->writer->print_string(wctx, key, val);\n\n wctx->nb_item++;\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_53", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n DriveInfo *drive_get_by_id(const char *id)\n \n+{\n+\n+ DriveInfo *dinfo;\n+\n+\n \n TAILQ_FOREACH(dinfo, &drives, next) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "DriveInfo *drive_get_by_id(const char *id)\n\n{\n\n DriveInfo *dinfo;\n\n\n\n TAILQ_FOREACH(dinfo, &drives, next) {\n\n if (strcmp(id, dinfo->id))\n\n continue;\n\n return dinfo;\n\n }\n\n return NULL;\n\n}\n"}} {"sample_id": "2399d4e7cec22ecf1c51062d2ebfd45220dbaace", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n * that the guest is currently busy-looping. Yield control back to the\n \n * top level loop so that a more deserving VCPU has a chance to run.\n+\n+ */\n+\n+ cs->exception_index = EXCP_YIELD;\n+\n cpu_loop_exit(cs);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void HELPER(yield)(CPUARMState *env)\n\n{\n\n ARMCPU *cpu = arm_env_get_cpu(env);\n\n CPUState *cs = CPU(cpu);\n\n\n\n /* When running in MTTCG we don't generate jumps to the yield and\n\n * WFE helpers as it won't affect the scheduling of other vCPUs.\n\n * If we wanted to more completely model WFE/SEV so we don't busy\n\n * spin unnecessarily we would need to do something more involved.\n\n */\n\n g_assert(!parallel_cpus);\n\n\n\n /* This is a non-trappable hint instruction that generally indicates\n\n * that the guest is currently busy-looping. Yield control back to the\n\n * top level loop so that a more deserving VCPU has a chance to run.\n\n */\n\n cs->exception_index = EXCP_YIELD;\n\n cpu_loop_exit(cs);\n\n}\n"}} {"sample_id": "7d1b0095bff7157e856d1d0e6c4295641ced2752_25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,8 +6,8 @@\n \n TCGv tmpl;\n \n+ TCGv tmph;\n+\n \n \n /* Load 64-bit value rd:rn. */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_addq(DisasContext *s, TCGv_i64 val, int rlow, int rhigh)\n\n{\n\n TCGv_i64 tmp;\n\n TCGv tmpl;\n\n TCGv tmph;\n\n\n\n /* Load 64-bit value rd:rn. */\n\n tmpl = load_reg(s, rlow);\n\n tmph = load_reg(s, rhigh);\n\n tmp = tcg_temp_new_i64();\n\n tcg_gen_concat_i32_i64(tmp, tmpl, tmph);\n\n dead_tmp(tmpl);\n\n dead_tmp(tmph);\n\n tcg_gen_add_i64(val, val, tmp);\n\n tcg_temp_free_i64(tmp);\n\n}\n"}} {"sample_id": "6886b98036a8f8f5bce8b10756ce080084cef11b_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n CPUWatchpoint *wp_hit = cs->watchpoint_hit;\n \n \n+\n+ if (wp_hit && wp_hit->flags & BP_CPU) {\n+\n+ /* FIXME: When the storage-alteration-space control bit is set,\n+\n the exception should only be triggered if the memory access\n \n is done using an address space with the storage-alteration-event", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void s390x_cpu_debug_excp_handler(CPUState *cs)\n\n{\n\n S390CPU *cpu = S390_CPU(cs);\n\n CPUS390XState *env = &cpu->env;\n\n CPUWatchpoint *wp_hit = cs->watchpoint_hit;\n\n\n\n if (wp_hit && wp_hit->flags & BP_CPU) {\n\n /* FIXME: When the storage-alteration-space control bit is set,\n\n the exception should only be triggered if the memory access\n\n is done using an address space with the storage-alteration-event\n\n bit set. We have no way to detect that with the current\n\n watchpoint code. */\n\n cs->watchpoint_hit = NULL;\n\n\n\n env->per_address = env->psw.addr;\n\n env->per_perc_atmid |= PER_CODE_EVENT_STORE | get_per_atmid(env);\n\n /* FIXME: We currently no way to detect the address space used\n\n to trigger the watchpoint. For now just consider it is the\n\n current default ASC. This turn to be true except when MVCP\n\n and MVCS instrutions are not used. */\n\n env->per_perc_atmid |= env->psw.mask & (PSW_MASK_ASC) >> 46;\n\n\n\n /* Remove all watchpoints to re-execute the code. A PER exception\n\n will be triggered, it will call load_psw which will recompute\n\n the watchpoints. */\n\n cpu_watchpoint_remove_all(cs, BP_CPU);\n\n cpu_resume_from_signal(cs, NULL);\n\n }\n\n}\n"}} {"sample_id": "03d83ba34b2070878909eae18dfac0f519503777", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n \n \n+ if (avctx->width > 65535 || avctx->height > 65535) {\n+\n+ av_log(avctx, AV_LOG_ERROR, \"GIF does not support resolutions above 65535x65535\\n\");\n+\n+ return AVERROR(EINVAL);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int gif_encode_init(AVCodecContext *avctx)\n\n{\n\n GIFContext *s = avctx->priv_data;\n\n\n\n if (avctx->width > 65535 || avctx->height > 65535) {\n\n av_log(avctx, AV_LOG_ERROR, \"GIF does not support resolutions above 65535x65535\\n\");\n\n return AVERROR(EINVAL);\n\n }\n\n#if FF_API_CODED_FRAME\n\nFF_DISABLE_DEPRECATION_WARNINGS\n\n avctx->coded_frame->pict_type = AV_PICTURE_TYPE_I;\n\n avctx->coded_frame->key_frame = 1;\n\nFF_ENABLE_DEPRECATION_WARNINGS\n\n#endif\n\n\n\n s->transparent_index = -1;\n\n\n\n s->lzw = av_mallocz(ff_lzw_encode_state_size);\n\n s->buf = av_malloc(avctx->width*avctx->height*2);\n\n s->tmpl = av_malloc(avctx->width);\n\n if (!s->tmpl || !s->buf || !s->lzw)\n\n return AVERROR(ENOMEM);\n\n\n\n if (avpriv_set_systematic_pal2(s->palette, avctx->pix_fmt) < 0)\n\n av_assert0(avctx->pix_fmt == AV_PIX_FMT_PAL8);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d135f3c514ac1723256c8e0f5cdd466fe98a2578_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n int x, y;\n \n pixel *src = (pixel*)_src;\n+\n ptrdiff_t srcstride = _srcstride / sizeof(pixel);\n \n pixel *dst = (pixel *)_dst;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void FUNC(put_hevc_qpel_bi_w_v)(uint8_t *_dst, ptrdiff_t _dststride, uint8_t *_src, ptrdiff_t _srcstride,\n\n int16_t *src2,\n\n int height, int denom, int wx0, int wx1,\n\n int ox0, int ox1, intptr_t mx, intptr_t my, int width)\n\n{\n\n int x, y;\n\n pixel *src = (pixel*)_src;\n\n ptrdiff_t srcstride = _srcstride / sizeof(pixel);\n\n pixel *dst = (pixel *)_dst;\n\n ptrdiff_t dststride = _dststride / sizeof(pixel);\n\n\n\n const int8_t *filter = ff_hevc_qpel_filters[my - 1];\n\n\n\n int shift = 14 + 1 - BIT_DEPTH;\n\n int log2Wd = denom + shift - 1;\n\n\n\n ox0 = ox0 * (1 << (BIT_DEPTH - 8));\n\n ox1 = ox1 * (1 << (BIT_DEPTH - 8));\n\n for (y = 0; y < height; y++) {\n\n for (x = 0; x < width; x++)\n\n dst[x] = av_clip_pixel(((QPEL_FILTER(src, srcstride) >> (BIT_DEPTH - 8)) * wx1 + src2[x] * wx0 +\n\n ((ox0 + ox1 + 1) << log2Wd)) >> (log2Wd + 1));\n\n src += srcstride;\n\n dst += dststride;\n\n src2 += MAX_PB_SIZE;\n\n }\n\n}\n"}} {"sample_id": "550830f9351291c585c963204ad9127998b1c1ce_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,10 +2,10 @@\n \n const uint8_t *buf, int nb_sectors)\n \n+{\n+\n+ int ret;\n+\n BDRVCowState *s = bs->opaque;\n \n qemu_co_mutex_lock(&s->lock);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static coroutine_fn int cow_co_write(BlockDriverState *bs, int64_t sector_num,\n\n const uint8_t *buf, int nb_sectors)\n\n{\n\n int ret;\n\n BDRVCowState *s = bs->opaque;\n\n qemu_co_mutex_lock(&s->lock);\n\n ret = cow_write(bs, sector_num, buf, nb_sectors);\n\n qemu_co_mutex_unlock(&s->lock);\n\n return ret;\n\n}\n"}} {"sample_id": "486637af8ef29ec215e0e0b7ecd3b5470f0e04e5_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ int i;\n+\n+ float (*output)[256] = ctx->audio_block.block_output;\n+\n+\n \n for (i = 0; i < 256; i++) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void mix_3f_2r_to_stereo(AC3DecodeContext *ctx)\n\n{\n\n int i;\n\n float (*output)[256] = ctx->audio_block.block_output;\n\n\n\n for (i = 0; i < 256; i++) {\n\n output[1][i] += (output[2][i] + output[4][i]);\n\n output[2][i] += (output[3][i] + output[5][i]);\n\n }\n\n memset(output[3], 0, sizeof(output[3]));\n\n memset(output[4], 0, sizeof(output[4]));\n\n memset(output[5], 0, sizeof(output[5]));\n\n}\n"}} {"sample_id": "9633fcc6a02f23e3ef00aa5fe3fe9c41f57c3456", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void init_proc_750cx (CPUPPCState *env)\n \n {\n+\n gen_spr_ne_601(env);\n \n gen_spr_7xx(env);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void init_proc_750cx (CPUPPCState *env)\n\n{\n\n gen_spr_ne_601(env);\n\n gen_spr_7xx(env);\n\n /* XXX : not implemented */\n\n spr_register(env, SPR_L2CR, \"L2CR\",\n\n SPR_NOACCESS, SPR_NOACCESS,\n\n &spr_read_generic, NULL,\n\n 0x00000000);\n\n /* Time base */\n\n gen_tbl(env);\n\n /* Thermal management */\n\n gen_spr_thrm(env);\n\n /* This register is not implemented but is present for compatibility */\n\n spr_register(env, SPR_SDA, \"SDA\",\n\n SPR_NOACCESS, SPR_NOACCESS,\n\n &spr_read_generic, &spr_write_generic,\n\n 0x00000000);\n\n /* Hardware implementation registers */\n\n /* XXX : not implemented */\n\n spr_register(env, SPR_HID0, \"HID0\",\n\n SPR_NOACCESS, SPR_NOACCESS,\n\n &spr_read_generic, &spr_write_generic,\n\n 0x00000000);\n\n /* XXX : not implemented */\n\n spr_register(env, SPR_HID1, \"HID1\",\n\n SPR_NOACCESS, SPR_NOACCESS,\n\n &spr_read_generic, &spr_write_generic,\n\n 0x00000000);\n\n /* Memory management */\n\n gen_low_BATs(env);\n\n /* PowerPC 750cx has 8 DBATs and 8 IBATs */\n\n gen_high_BATs(env);\n\n init_excp_750cx(env);\n\n env->dcache_line_size = 32;\n\n env->icache_line_size = 32;\n\n /* Allocate hardware IRQ controller */\n\n ppc6xx_irq_init(env);\n\n}\n"}} {"sample_id": "514e73ecebc0aeadef218e91e36ee42b3d145c93", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n int do_balloon(Monitor *mon, const QDict *params,\n \n+\t MonitorCompletion cb, void *opaque)\n+\n+{\n+\n+ int ret;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int do_balloon(Monitor *mon, const QDict *params,\n\n\t MonitorCompletion cb, void *opaque)\n\n{\n\n int ret;\n\n\n\n if (kvm_enabled() && !kvm_has_sync_mmu()) {\n\n qerror_report(QERR_KVM_MISSING_CAP, \"synchronous MMU\", \"balloon\");\n\n return -1;\n\n }\n\n\n\n ret = qemu_balloon(qdict_get_int(params, \"value\"));\n\n if (ret == 0) {\n\n qerror_report(QERR_DEVICE_NOT_ACTIVE, \"balloon\");\n\n return -1;\n\n }\n\n\n\n cb(opaque, NULL);\n\n return 0;\n\n}\n"}} {"sample_id": "d2889a3efc3851e62de69cb9d88fb784c28e0ed8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void OPPROTO op_movl_npc_T0(void)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void OPPROTO op_movl_npc_T0(void)\n\n{\n\n env->npc = T0;\n\n}\n"}} {"sample_id": "95129d6fc9ead97155627a4ca0cfd37282883658_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n VirtIONet *n = VIRTIO_NET(vdev);\n \n int i;\n+\n+\n+\n+ virtio_net_set_multiqueue(n,\n+\n __virtio_has_feature(features, VIRTIO_NET_F_MQ));\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)\n\n{\n\n VirtIONet *n = VIRTIO_NET(vdev);\n\n int i;\n\n\n\n virtio_net_set_multiqueue(n,\n\n __virtio_has_feature(features, VIRTIO_NET_F_MQ));\n\n\n\n virtio_net_set_mrg_rx_bufs(n,\n\n __virtio_has_feature(features,\n\n VIRTIO_NET_F_MRG_RXBUF),\n\n __virtio_has_feature(features,\n\n VIRTIO_F_VERSION_1));\n\n\n\n if (n->has_vnet_hdr) {\n\n n->curr_guest_offloads =\n\n virtio_net_guest_offloads_by_features(features);\n\n virtio_net_apply_guest_offloads(n);\n\n }\n\n\n\n for (i = 0; i < n->max_queues; i++) {\n\n NetClientState *nc = qemu_get_subqueue(n->nic, i);\n\n\n\n if (!get_vhost_net(nc->peer)) {\n\n continue;\n\n }\n\n vhost_net_ack_features(get_vhost_net(nc->peer), features);\n\n }\n\n\n\n if (__virtio_has_feature(features, VIRTIO_NET_F_CTRL_VLAN)) {\n\n memset(n->vlans, 0, MAX_VLAN >> 3);\n\n } else {\n\n memset(n->vlans, 0xff, MAX_VLAN >> 3);\n\n }\n\n}\n"}} {"sample_id": "55b4e80b047300e1512df02887b7448ba3786b62", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,9 +11,9 @@\n subpage_t *subpage = container_of(mr, subpage_t, iomem);\n \n object_unref(OBJECT(&subpage->iomem));\n+\n+ g_free(subpage);\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void phys_section_destroy(MemoryRegion *mr)\n\n{\n\n memory_region_unref(mr);\n\n\n\n if (mr->subpage) {\n\n subpage_t *subpage = container_of(mr, subpage_t, iomem);\n\n object_unref(OBJECT(&subpage->iomem));\n\n g_free(subpage);\n\n }\n\n}\n"}} {"sample_id": "c6a6a5e3bb7120e1eb33eca6364a290229c1e72e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,6 +10,6 @@\n \n cpu_to_be16wu((uint16_t *)(data + sloc),\n \n+ do_cksum(data + css, data + n));\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "putsum(uint8_t *data, uint32_t n, uint32_t sloc, uint32_t css, uint32_t cse)\n\n{\n\n if (cse && cse < n)\n\n n = cse + 1;\n\n if (sloc < n-1)\n\n cpu_to_be16wu((uint16_t *)(data + sloc),\n\n do_cksum(data + css, data + n));\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_49", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n \n \n+ if ((nvram->size < MIN_NVRAM_SIZE) || (nvram->size > MAX_NVRAM_SIZE)) {\n+\n+ fprintf(stderr, \"spapr-nvram must be between %d and %d bytes in size\\n\",\n+\n+ MIN_NVRAM_SIZE, MAX_NVRAM_SIZE);\n \n return -1;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int spapr_nvram_init(VIOsPAPRDevice *dev)\n\n{\n\n sPAPRNVRAM *nvram = VIO_SPAPR_NVRAM(dev);\n\n\n\n if (nvram->drive) {\n\n nvram->size = bdrv_getlength(nvram->drive);\n\n } else {\n\n nvram->size = DEFAULT_NVRAM_SIZE;\n\n nvram->buf = g_malloc0(nvram->size);\n\n }\n\n\n\n if ((nvram->size < MIN_NVRAM_SIZE) || (nvram->size > MAX_NVRAM_SIZE)) {\n\n fprintf(stderr, \"spapr-nvram must be between %d and %d bytes in size\\n\",\n\n MIN_NVRAM_SIZE, MAX_NVRAM_SIZE);\n\n return -1;\n\n }\n\n\n\n spapr_rtas_register(RTAS_NVRAM_FETCH, \"nvram-fetch\", rtas_nvram_fetch);\n\n spapr_rtas_register(RTAS_NVRAM_STORE, \"nvram-store\", rtas_nvram_store);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "8540dcfd7af14da4080770dfbfa997cffdd0878b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n const int b_stride= s->b_width << s->block_max_depth;\n \n+ BlockNode *block= &s->block[mb_x + mb_y * b_stride];\n \n BlockNode backup[4]= {block[0], block[1], block[b_stride], block[b_stride+1]};\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static av_always_inline int check_4block_inter(SnowContext *s, int mb_x, int mb_y, int p0, int p1, int ref, int *best_rd){\n\n const int b_stride= s->b_width << s->block_max_depth;\n\n BlockNode *block= &s->block[mb_x + mb_y * b_stride];\n\n BlockNode backup[4]= {block[0], block[1], block[b_stride], block[b_stride+1]};\n\n int rd, index, value;\n\n\n\n assert(mb_x>=0 && mb_y>=0);\n\n assert(mb_xme_cache_generation + (p0>>10) + (p1<<6) + (block->ref<<12);\n\n if(s->me_cache[index] == value)\n\n return 0;\n\n s->me_cache[index]= value;\n\n\n\n block->mx= p0;\n\n block->my= p1;\n\n block->ref= ref;\n\n block->type &= ~BLOCK_INTRA;\n\n block[1]= block[b_stride]= block[b_stride+1]= *block;\n\n\n\n rd= get_4block_rd(s, mb_x, mb_y, 0);\n\n\n\n//FIXME chroma\n\n if(rd < *best_rd){\n\n *best_rd= rd;\n\n return 1;\n\n }else{\n\n block[0]= backup[0];\n\n block[1]= backup[1];\n\n block[b_stride]= backup[2];\n\n block[b_stride+1]= backup[3];\n\n return 0;\n\n }\n\n}\n"}} {"sample_id": "459cc34290b2823403f9820345c8a83f66495e1d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n unsupported_encoding(s, insn);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void disas_fp_2src(DisasContext *s, uint32_t insn)\n\n{\n\n unsupported_encoding(s, insn);\n\n}\n"}} {"sample_id": "71e605f80313a632cc6714cde7bd240042dbdd95", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static int fifo_put(SerialState *s, int fifo, uint8_t chr)\n \n+{\n+\n+ SerialFIFO *f = (fifo) ? &s->recv_fifo : &s->xmit_fifo;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int fifo_put(SerialState *s, int fifo, uint8_t chr)\n\n{\n\n SerialFIFO *f = (fifo) ? &s->recv_fifo : &s->xmit_fifo;\n\n\n\n f->data[f->head++] = chr;\n\n\n\n if (f->head == UART_FIFO_LENGTH)\n\n f->head = 0;\n\n f->count++;\n\n\n\n return 1;\n\n}\n"}} {"sample_id": "cc05c43ad942165ecc6ffd39e41991bee43af044", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void access_with_adjusted_size(hwaddr addr,\n \n uint64_t *value,\n \n@@ -12,11 +12,11 @@\n \n hwaddr addr,\n \n+ uint64_t *value,\n \n unsigned size,\n \n+ unsigned shift,\n \n uint64_t mask),\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void access_with_adjusted_size(hwaddr addr,\n\n uint64_t *value,\n\n unsigned size,\n\n unsigned access_size_min,\n\n unsigned access_size_max,\n\n void (*access)(MemoryRegion *mr,\n\n hwaddr addr,\n\n uint64_t *value,\n\n unsigned size,\n\n unsigned shift,\n\n uint64_t mask),\n\n MemoryRegion *mr)\n\n{\n\n uint64_t access_mask;\n\n unsigned access_size;\n\n unsigned i;\n\n\n\n if (!access_size_min) {\n\n access_size_min = 1;\n\n }\n\n if (!access_size_max) {\n\n access_size_max = 4;\n\n }\n\n\n\n /* FIXME: support unaligned access? */\n\n access_size = MAX(MIN(size, access_size_max), access_size_min);\n\n access_mask = -1ULL >> (64 - access_size * 8);\n\n if (memory_region_big_endian(mr)) {\n\n for (i = 0; i < size; i += access_size) {\n\n access(mr, addr + i, value, access_size,\n\n (size - access_size - i) * 8, access_mask);\n\n }\n\n } else {\n\n for (i = 0; i < size; i += access_size) {\n\n access(mr, addr + i, value, access_size, i * 8, access_mask);\n\n }\n\n }\n\n}\n"}} {"sample_id": "bf7aa45e7b378691ea0e8616a2aeae2aaabb7bc3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n g_free(vs->display);\n \n+ vs->display = NULL;\n+\n+ if (vs->lsock != -1) {\n+\n+ qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);\n \n close(vs->lsock);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vnc_display_close(VncDisplay *vs)\n\n{\n\n if (!vs)\n\n return;\n\n g_free(vs->display);\n\n vs->display = NULL;\n\n if (vs->lsock != -1) {\n\n qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);\n\n close(vs->lsock);\n\n vs->lsock = -1;\n\n }\n\n#ifdef CONFIG_VNC_WS\n\n g_free(vs->ws_display);\n\n vs->ws_display = NULL;\n\n if (vs->lwebsock != -1) {\n\n qemu_set_fd_handler2(vs->lwebsock, NULL, NULL, NULL, NULL);\n\n close(vs->lwebsock);\n\n vs->lwebsock = -1;\n\n }\n\n#endif /* CONFIG_VNC_WS */\n\n vs->auth = VNC_AUTH_INVALID;\n\n#ifdef CONFIG_VNC_TLS\n\n vs->subauth = VNC_AUTH_INVALID;\n\n vs->tls.x509verify = 0;\n\n#endif\n\n}\n"}} {"sample_id": "428098165de4c3edfe42c1b7f00627d287015863", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n+static inline void cvtyuvtoRGB (SwsContext *c,\n+\n+\t\t\t vector signed short Y, vector signed short U, vector signed short V,\n+\n+\t\t\t vector signed short *R, vector signed short *G, vector signed short *B)\n+\n+{\n+\n+ vector signed short vx,ux,uvx;\n+\n+\n \n Y = vec_mradds (Y, c->CY, c->OY);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void cvtyuvtoRGB (SwsContext *c,\n\n\t\t\t vector signed short Y, vector signed short U, vector signed short V,\n\n\t\t\t vector signed short *R, vector signed short *G, vector signed short *B)\n\n{\n\n vector signed short vx,ux,uvx;\n\n\n\n Y = vec_mradds (Y, c->CY, c->OY);\n\n U = vec_sub (U,(vector signed short)\n\n \t\t\tvec_splat((vector signed short)AVV(128),0));\n\n V = vec_sub (V,(vector signed short)\n\n \t\t\tvec_splat((vector signed short)AVV(128),0));\n\n\n\n // ux = (CBU*(u<CSHIFT)+0x4000)>>15;\n\n ux = vec_sl (U, c->CSHIFT);\n\n *B = vec_mradds (ux, c->CBU, Y);\n\n\n\n // vx = (CRV*(v<CSHIFT)+0x4000)>>15;\n\n vx = vec_sl (V, c->CSHIFT);\n\n *R = vec_mradds (vx, c->CRV, Y);\n\n\n\n // uvx = ((CGU*u) + (CGV*v))>>15;\n\n uvx = vec_mradds (U, c->CGU, Y);\n\n *G = vec_mradds (V, c->CGV, uvx);\n\n}\n"}} {"sample_id": "f9aebe2ef52ff0dcb733999f57e00a7b430303c6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n uint8_t *config;\n \n+ int i;\n+\n+\n+\n+ assert(size == pci_config_size(s));\n \n config = qemu_malloc(size);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int get_pci_config_device(QEMUFile *f, void *pv, size_t size)\n\n{\n\n PCIDevice *s = container_of(pv, PCIDevice, config);\n\n uint8_t *config;\n\n int i;\n\n\n\n assert(size == pci_config_size(s));\n\n config = qemu_malloc(size);\n\n\n\n qemu_get_buffer(f, config, size);\n\n for (i = 0; i < size; ++i) {\n\n if ((config[i] ^ s->config[i]) & s->cmask[i] & ~s->wmask[i]) {\n\n qemu_free(config);\n\n return -EINVAL;\n\n }\n\n }\n\n memcpy(s->config, config, size);\n\n\n\n pci_update_mappings(s);\n\n\n\n qemu_free(config);\n\n return 0;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_266", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n case 0x14:\t/* EMIFS_CS1_CONFIG */\n \n case 0x18:\t/* EMIFS_CS2_CONFIG */\n+\n+ case 0x1c:\t/* EMIFS_CS3_CONFIG */\n+\n+ case 0x24:\t/* EMIFF_MRS */\n+\n case 0x28:\t/* TIMEOUT1 */\n \n case 0x2c:\t/* TIMEOUT2 */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t omap_tcmi_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;\n\n uint32_t ret;\n\n\n\n if (size != 4) {\n\n return omap_badwidth_read32(opaque, addr);\n\n }\n\n\n\n switch (addr) {\n\n case 0x00:\t/* IMIF_PRIO */\n\n case 0x04:\t/* EMIFS_PRIO */\n\n case 0x08:\t/* EMIFF_PRIO */\n\n case 0x0c:\t/* EMIFS_CONFIG */\n\n case 0x10:\t/* EMIFS_CS0_CONFIG */\n\n case 0x14:\t/* EMIFS_CS1_CONFIG */\n\n case 0x18:\t/* EMIFS_CS2_CONFIG */\n\n case 0x1c:\t/* EMIFS_CS3_CONFIG */\n\n case 0x24:\t/* EMIFF_MRS */\n\n case 0x28:\t/* TIMEOUT1 */\n\n case 0x2c:\t/* TIMEOUT2 */\n\n case 0x30:\t/* TIMEOUT3 */\n\n case 0x3c:\t/* EMIFF_SDRAM_CONFIG_2 */\n\n case 0x40:\t/* EMIFS_CFG_DYN_WAIT */\n\n return s->tcmi_regs[addr >> 2];\n\n\n\n case 0x20:\t/* EMIFF_SDRAM_CONFIG */\n\n ret = s->tcmi_regs[addr >> 2];\n\n s->tcmi_regs[addr >> 2] &= ~1; /* XXX: Clear SLRF on SDRAM access */\n\n /* XXX: We can try using the VGA_DIRTY flag for this */\n\n return ret;\n\n }\n\n\n\n OMAP_BAD_REG(addr);\n\n return 0;\n\n}\n"}} {"sample_id": "eef9f19eea26cd8b4553459118f87d7150b53c5a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void flash_sync_page(Flash *s, int page)\n+\n {\n \n QEMUIOVector *iov = g_new(QEMUIOVector, 1);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void flash_sync_page(Flash *s, int page)\n\n{\n\n QEMUIOVector *iov = g_new(QEMUIOVector, 1);\n\n\n\n if (!s->blk || blk_is_read_only(s->blk)) {\n\n return;\n\n }\n\n\n\n qemu_iovec_init(iov, 1);\n\n qemu_iovec_add(iov, s->storage + page * s->pi->page_size,\n\n s->pi->page_size);\n\n blk_aio_pwritev(s->blk, page * s->pi->page_size, iov, 0,\n\n blk_sync_complete, iov);\n\n}\n"}} {"sample_id": "7983e829336f68b6df6952dd4b03493b1486fcf5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n while (len > 0) {\n \n+ ret = qemu_chr_fe_write(scon->chr, buf, len);\n+\n+ if (ret == 0) {\n+\n+ /* a pty doesn't seem to be connected - no error */\n \n len = 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int write_console_data(SCLPEvent *event, const uint8_t *buf, int len)\n\n{\n\n int ret = 0;\n\n const uint8_t *buf_offset;\n\n\n\n SCLPConsoleLM *scon = SCLPLM_CONSOLE(event);\n\n\n\n if (!scon->chr) {\n\n /* If there's no backend, we can just say we consumed all data. */\n\n return len;\n\n }\n\n\n\n buf_offset = buf;\n\n while (len > 0) {\n\n ret = qemu_chr_fe_write(scon->chr, buf, len);\n\n if (ret == 0) {\n\n /* a pty doesn't seem to be connected - no error */\n\n len = 0;\n\n } else if (ret == -EAGAIN || (ret > 0 && ret < len)) {\n\n len -= ret;\n\n buf_offset += ret;\n\n } else {\n\n len = 0;\n\n }\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "494cb81741f867319f11ecfa0949168baf9f01d7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -55,11 +55,11 @@\n VNC_DEBUG(\"Handshake done, switching to TLS data mode\\n\");\n \n qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);\n+\n+\n+\n+ start_auth_vencrypt_subauth(vs);\n+\n \n \n return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int vnc_start_vencrypt_handshake(struct VncState *vs) {\n\n int ret;\n\n\n\n if ((ret = gnutls_handshake(vs->tls.session)) < 0) {\n\n if (!gnutls_error_is_fatal(ret)) {\n\n VNC_DEBUG(\"Handshake interrupted (blocking)\\n\");\n\n if (!gnutls_record_get_direction(vs->tls.session))\n\n qemu_set_fd_handler(vs->csock, vnc_tls_handshake_io, NULL, vs);\n\n else\n\n qemu_set_fd_handler(vs->csock, NULL, vnc_tls_handshake_io, vs);\n\n return 0;\n\n }\n\n VNC_DEBUG(\"Handshake failed %s\\n\", gnutls_strerror(ret));\n\n vnc_client_error(vs);\n\n return -1;\n\n }\n\n\n\n if (vs->vd->tls.x509verify) {\n\n if (vnc_tls_validate_certificate(vs) < 0) {\n\n VNC_DEBUG(\"Client verification failed\\n\");\n\n vnc_client_error(vs);\n\n return -1;\n\n } else {\n\n VNC_DEBUG(\"Client verification passed\\n\");\n\n }\n\n }\n\n\n\n VNC_DEBUG(\"Handshake done, switching to TLS data mode\\n\");\n\n qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);\n\n\n\n start_auth_vencrypt_subauth(vs);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "4f5e19e6c570459cd524b29b24374f03860f5149_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n pci_mem_config = cpu_register_io_memory(pci_unin_config_read,\n \n+ pci_unin_config_write, s);\n+\n+ pci_mem_data = cpu_register_io_memory(pci_unin_read,\n+\n+ pci_unin_write, s);\n \n sysbus_init_mmio(dev, 0x1000, pci_mem_config);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pci_unin_internal_init_device(SysBusDevice *dev)\n\n{\n\n UNINState *s;\n\n int pci_mem_config, pci_mem_data;\n\n\n\n /* Uninorth internal bus */\n\n s = FROM_SYSBUS(UNINState, dev);\n\n\n\n pci_mem_config = cpu_register_io_memory(pci_unin_config_read,\n\n pci_unin_config_write, s);\n\n pci_mem_data = cpu_register_io_memory(pci_unin_read,\n\n pci_unin_write, s);\n\n sysbus_init_mmio(dev, 0x1000, pci_mem_config);\n\n sysbus_init_mmio(dev, 0x1000, pci_mem_data);\n\n return 0;\n\n}\n"}} {"sample_id": "5064357588a187672ca64c169dc6e6e406777629", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n uint8_t *s1, *s2, *d;\n for(;height > 0; height--) {\n s1 = src;\n+ s2 = src + src_wrap;\n+ d = dst;\n+ for(w = width;w > 0; w--) {\n+ c = (s1[0] + s2[0]) >> 1;\n+ d[0] = c;\n d[1] = c;\n s1++;\n s2++;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void conv411(uint8_t *dst, int dst_wrap, \n uint8_t *src, int src_wrap,\n int width, int height)\n{\n int w, c;\n uint8_t *s1, *s2, *d;\n for(;height > 0; height--) {\n s1 = src;\n s2 = src + src_wrap;\n d = dst;\n for(w = width;w > 0; w--) {\n c = (s1[0] + s2[0]) >> 1;\n d[0] = c;\n d[1] = c;\n s1++;\n s2++;\n d += 2;\n }\n src += src_wrap * 2;\n dst += dst_wrap;\n }\n}"}} {"sample_id": "715c54071a43ab978dc12b9da22a5016203ed284", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,8 +26,8 @@\n \n }\n \n+\n+\n+ return rc;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int spapr_check_htab_fd(sPAPRMachineState *spapr)\n\n{\n\n int rc = 0;\n\n\n\n if (spapr->htab_fd_stale) {\n\n close(spapr->htab_fd);\n\n spapr->htab_fd = kvmppc_get_htab_fd(false);\n\n if (spapr->htab_fd < 0) {\n\n error_report(\"Unable to open fd for reading hash table from KVM: \"\n\n \"%s\", strerror(errno));\n\n rc = -1;\n\n }\n\n spapr->htab_fd_stale = false;\n\n }\n\n\n\n return rc;\n\n}\n"}} {"sample_id": "9be385980d37e8f4fd33f605f5fb1c3d144170a8_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,10 +20,10 @@\n \n \n \n+ ret = entry->value;\n+\n+\n+\n+ return ret;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "QObject *qlist_peek(QList *qlist)\n\n{\n\n QListEntry *entry;\n\n QObject *ret;\n\n\n\n if (qlist == NULL || QTAILQ_EMPTY(&qlist->head)) {\n\n return NULL;\n\n }\n\n\n\n entry = QTAILQ_FIRST(&qlist->head);\n\n\n\n ret = entry->value;\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "e53c9065ca08a9153ecc73a6a8940bcc6d667e58_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n fdsp->vector_dmul_scalar(odst, v1, scale, LEN);\n \n \n+\n+ if (ret = compare_doubles(cdst, odst, LEN, DBL_EPSILON))\n+\n+ av_log(NULL, AV_LOG_ERROR, \"vector_dmul_scalar failed\\n\");\n+\n \n \n return ret;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int test_vector_dmul_scalar(AVFloatDSPContext *fdsp, AVFloatDSPContext *cdsp,\n\n const double *v1, double scale)\n\n{\n\n LOCAL_ALIGNED(32, double, cdst, [LEN]);\n\n LOCAL_ALIGNED(32, double, odst, [LEN]);\n\n int ret;\n\n\n\n cdsp->vector_dmul_scalar(cdst, v1, scale, LEN);\n\n fdsp->vector_dmul_scalar(odst, v1, scale, LEN);\n\n\n\n if (ret = compare_doubles(cdst, odst, LEN, DBL_EPSILON))\n\n av_log(NULL, AV_LOG_ERROR, \"vector_dmul_scalar failed\\n\");\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "b5da07d4340a8e8e40dcd1900977a76ff31fbb84_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+void ff_put_h264_qpel4_mc30_msa(uint8_t *dst, const uint8_t *src,\n+\n ptrdiff_t stride)\n \n {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_put_h264_qpel4_mc30_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n avc_luma_hz_qrt_4w_msa(src - 2, stride, dst, stride, 4, 1);\n\n}\n"}} {"sample_id": "bdb5ee3064d5ae786b0bcb6cf6ff4e3554a72990_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ if (!rom_enable_driver_roms)\n+\n return 0;\n \n return rom_add_file(file, \"vgaroms\", file, 0);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int rom_add_vga(const char *file)\n\n{\n\n if (!rom_enable_driver_roms)\n\n return 0;\n\n return rom_add_file(file, \"vgaroms\", file, 0);\n\n}\n"}} {"sample_id": "13a099799e89a76eb921ca452e1b04a7a28a9855_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n const uint16_t *abuf1, uint8_t *dest, int dstW,\n \n int yalpha, int uvalpha, int y,\n+\n+ enum PixelFormat target)\n+\n+{\n+\n const uint8_t * const d128 = dither_8x8_220[y & 7];\n \n uint8_t *g = c->table_gU[128] + c->table_gV[128];", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "yuv2mono_2_c_template(SwsContext *c, const uint16_t *buf0,\n\n const uint16_t *buf1, const uint16_t *ubuf0,\n\n const uint16_t *ubuf1, const uint16_t *vbuf0,\n\n const uint16_t *vbuf1, const uint16_t *abuf0,\n\n const uint16_t *abuf1, uint8_t *dest, int dstW,\n\n int yalpha, int uvalpha, int y,\n\n enum PixelFormat target)\n\n{\n\n const uint8_t * const d128 = dither_8x8_220[y & 7];\n\n uint8_t *g = c->table_gU[128] + c->table_gV[128];\n\n int yalpha1 = 4095 - yalpha;\n\n int i;\n\n\n\n for (i = 0; i < dstW - 7; i += 8) {\n\n int acc = g[((buf0[i ] * yalpha1 + buf1[i ] * yalpha) >> 19) + d128[0]];\n\n acc += acc + g[((buf0[i + 1] * yalpha1 + buf1[i + 1] * yalpha) >> 19) + d128[1]];\n\n acc += acc + g[((buf0[i + 2] * yalpha1 + buf1[i + 2] * yalpha) >> 19) + d128[2]];\n\n acc += acc + g[((buf0[i + 3] * yalpha1 + buf1[i + 3] * yalpha) >> 19) + d128[3]];\n\n acc += acc + g[((buf0[i + 4] * yalpha1 + buf1[i + 4] * yalpha) >> 19) + d128[4]];\n\n acc += acc + g[((buf0[i + 5] * yalpha1 + buf1[i + 5] * yalpha) >> 19) + d128[5]];\n\n acc += acc + g[((buf0[i + 6] * yalpha1 + buf1[i + 6] * yalpha) >> 19) + d128[6]];\n\n acc += acc + g[((buf0[i + 7] * yalpha1 + buf1[i + 7] * yalpha) >> 19) + d128[7]];\n\n output_pixel(*dest++, acc);\n\n }\n\n}\n"}} {"sample_id": "1a89b60885ccc2abf7cc50275fcee70d0347425e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n const uint32_t broadcast_addr =\n \n ~slirp->vnetwork_mask.s_addr | slirp->vnetwork_addr.s_addr;\n+\n ArpTable *arptbl = &slirp->arp_table;\n \n int i;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void arp_table_add(Slirp *slirp, uint32_t ip_addr, uint8_t ethaddr[ETH_ALEN])\n\n{\n\n const uint32_t broadcast_addr =\n\n ~slirp->vnetwork_mask.s_addr | slirp->vnetwork_addr.s_addr;\n\n ArpTable *arptbl = &slirp->arp_table;\n\n int i;\n\n\n\n DEBUG_CALL(\"arp_table_add\");\n\n DEBUG_ARG(\"ip = 0x%x\", ip_addr);\n\n DEBUG_ARGS((dfd, \" hw addr = %02x:%02x:%02x:%02x:%02x:%02x\\n\",\n\n ethaddr[0], ethaddr[1], ethaddr[2],\n\n ethaddr[3], ethaddr[4], ethaddr[5]));\n\n\n\n /* Check 0.0.0.0/8 invalid source-only addresses */\n\n assert((ip_addr & htonl(~(0xf << 28))) != 0);\n\n\n\n if (ip_addr == 0xffffffff || ip_addr == broadcast_addr) {\n\n /* Do not register broadcast addresses */\n\n return;\n\n }\n\n\n\n /* Search for an entry */\n\n for (i = 0; i < ARP_TABLE_SIZE; i++) {\n\n if (arptbl->table[i].ar_sip == ip_addr) {\n\n /* Update the entry */\n\n memcpy(arptbl->table[i].ar_sha, ethaddr, ETH_ALEN);\n\n return;\n\n }\n\n }\n\n\n\n /* No entry found, create a new one */\n\n arptbl->table[arptbl->next_victim].ar_sip = ip_addr;\n\n memcpy(arptbl->table[arptbl->next_victim].ar_sha, ethaddr, ETH_ALEN);\n\n arptbl->next_victim = (arptbl->next_victim + 1) % ARP_TABLE_SIZE;\n\n}\n"}} {"sample_id": "97392553656a7f4fabde9ded4d2b7f538d98ee17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n int i;\n \n \n+\n for (i = 0; i < ctx->nb_outputs; i++) {\n \n av_freep(&ctx->output_pads[i].name);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static av_cold void movie_uninit(AVFilterContext *ctx)\n\n{\n\n MovieContext *movie = ctx->priv;\n\n int i;\n\n\n\n for (i = 0; i < ctx->nb_outputs; i++) {\n\n av_freep(&ctx->output_pads[i].name);\n\n if (movie->st[i].st)\n\n avcodec_close(movie->st[i].st->codec);\n\n }\n\n av_freep(&movie->st);\n\n av_freep(&movie->out_index);\n\n av_frame_free(&movie->frame);\n\n if (movie->format_ctx)\n\n avformat_close_input(&movie->format_ctx);\n\n}\n"}} {"sample_id": "dcd042282d855edf70df90b7d61d33b515320b7a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n AioContext *bdrv_get_aio_context(BlockDriverState *bs)\n+\n+{\n \n /* Currently BlockDriverState always uses the main loop AioContext */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "AioContext *bdrv_get_aio_context(BlockDriverState *bs)\n\n{\n\n /* Currently BlockDriverState always uses the main loop AioContext */\n\n return qemu_get_aio_context();\n\n}\n"}} {"sample_id": "72b6ffc76653214b69a94a7b1643ff80df134486", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n NBDRequest *request,\n \n+ NBDReply *reply,\n \n QEMUIOVector *qiov)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void nbd_co_receive_reply(NBDClientSession *s,\n\n NBDRequest *request,\n\n NBDReply *reply,\n\n QEMUIOVector *qiov)\n\n{\n\n int ret;\n\n\n\n /* Wait until we're woken up by nbd_read_reply_entry. */\n\n qemu_coroutine_yield();\n\n *reply = s->reply;\n\n if (reply->handle != request->handle ||\n\n !s->ioc) {\n\n reply->error = EIO;\n\n } else {\n\n if (qiov && reply->error == 0) {\n\n ret = nbd_rwv(s->ioc, qiov->iov, qiov->niov, request->len, true,\n\n NULL);\n\n if (ret != request->len) {\n\n reply->error = EIO;\n\n }\n\n }\n\n\n\n /* Tell the read handler to read another header. */\n\n s->reply.handle = 0;\n\n }\n\n}\n"}} {"sample_id": "ac4b32df71bd932838043a4838b86d11e169707f_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static void vp8_h_loop_filter_simple_c(uint8_t *dst, ptrdiff_t stride, int flim)\n+\n+{\n+\n int i;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void vp8_h_loop_filter_simple_c(uint8_t *dst, ptrdiff_t stride, int flim)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < 16; i++)\n\n if (simple_limit(dst + i * stride, 1, flim))\n\n filter_common(dst + i * stride, 1, 1);\n\n}\n"}} {"sample_id": "77cb0f5aafc8e6d0c6d3c339f381c9b7921648e0_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n+static void adb_kbd_reset(DeviceState *dev)\n+\n+{\n+\n+ ADBDevice *d = ADB_DEVICE(dev);\n+\n+ KBDState *s = ADB_KEYBOARD(dev);\n+\n+\n \n d->handler = 1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void adb_kbd_reset(DeviceState *dev)\n\n{\n\n ADBDevice *d = ADB_DEVICE(dev);\n\n KBDState *s = ADB_KEYBOARD(dev);\n\n\n\n d->handler = 1;\n\n d->devaddr = ADB_DEVID_KEYBOARD;\n\n memset(s->data, 0, sizeof(s->data));\n\n s->rptr = 0;\n\n s->wptr = 0;\n\n s->count = 0;\n\n}\n"}} {"sample_id": "721671ade77f4046b45893fbb7864ca84b9504cd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,10 +2,10 @@\n \n {\n \n+ bool progress;\n+\n+\n+\n progress = aio_bh_poll(ctx);\n \n progress |= aio_dispatch_handlers(ctx, INVALID_HANDLE_VALUE);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool aio_dispatch(AioContext *ctx)\n\n{\n\n bool progress;\n\n\n\n progress = aio_bh_poll(ctx);\n\n progress |= aio_dispatch_handlers(ctx, INVALID_HANDLE_VALUE);\n\n progress |= timerlistgroup_run_timers(&ctx->tlg);\n\n return progress;\n\n}\n"}} {"sample_id": "32bafa8fdd098d52fbf1102d5a5e48d29398c0aa_25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n .has_format = has_format,\n \n+ .format = (char *) format,\n+\n+ .has_mode = has_mode,\n+\n+ .mode = mode,\n \n };\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qmp_blockdev_snapshot_sync(bool has_device, const char *device,\n\n bool has_node_name, const char *node_name,\n\n const char *snapshot_file,\n\n bool has_snapshot_node_name,\n\n const char *snapshot_node_name,\n\n bool has_format, const char *format,\n\n bool has_mode, NewImageMode mode, Error **errp)\n\n{\n\n BlockdevSnapshotSync snapshot = {\n\n .has_device = has_device,\n\n .device = (char *) device,\n\n .has_node_name = has_node_name,\n\n .node_name = (char *) node_name,\n\n .snapshot_file = (char *) snapshot_file,\n\n .has_snapshot_node_name = has_snapshot_node_name,\n\n .snapshot_node_name = (char *) snapshot_node_name,\n\n .has_format = has_format,\n\n .format = (char *) format,\n\n .has_mode = has_mode,\n\n .mode = mode,\n\n };\n\n TransactionAction action = {\n\n .type = TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT_SYNC,\n\n .u.blockdev_snapshot_sync = &snapshot,\n\n };\n\n blockdev_do_action(&action, errp);\n\n}\n"}} {"sample_id": "8841d9dfc7f871cec7c3401a8a2d31ad34e881f7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static inline void check_privileged(DisasContext *s)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static inline void check_privileged(DisasContext *s)\n\n{\n\n if (s->tb->flags & (PSW_MASK_PSTATE >> 32)) {\n\n gen_program_exception(s, PGM_PRIVILEGED);\n\n }\n\n}\n"}} {"sample_id": "7effbee66cf457c62f795d9b9ed3a1110b364b89_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int rso_read_packet(AVFormatContext *s, AVPacket *pkt)\n \n+{\n+\n+ int bps = av_get_bits_per_sample(s->streams[0]->codec->codec_id);\n+\n+ int ret = av_get_packet(s->pb, pkt, BLOCK_SIZE * bps >> 3);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int rso_read_packet(AVFormatContext *s, AVPacket *pkt)\n\n{\n\n int bps = av_get_bits_per_sample(s->streams[0]->codec->codec_id);\n\n int ret = av_get_packet(s->pb, pkt, BLOCK_SIZE * bps >> 3);\n\n\n\n if (ret < 0)\n\n return ret;\n\n\n\n\n pkt->stream_index = 0;\n\n\n\n /* note: we need to modify the packet size here to handle the last packet */\n\n pkt->size = ret;\n\n\n\n return 0;\n\n}"}} {"sample_id": "fcd19d6c8db514b017662166d014ac8560fbe8f5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n if (s->tile[tileno].comp) {\n \n+ for (compno = 0; compno < s->ncomponents; compno++) {\n+\n+ Jpeg2000Component *comp = s->tile[tileno].comp + compno;\n+\n+ Jpeg2000CodingStyle *codsty = s->tile[tileno].codsty + compno;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void jpeg2000_dec_cleanup(Jpeg2000DecoderContext *s)\n\n{\n\n int tileno, compno;\n\n for (tileno = 0; tileno < s->numXtiles * s->numYtiles; tileno++) {\n\n if (s->tile[tileno].comp) {\n\n for (compno = 0; compno < s->ncomponents; compno++) {\n\n Jpeg2000Component *comp = s->tile[tileno].comp + compno;\n\n Jpeg2000CodingStyle *codsty = s->tile[tileno].codsty + compno;\n\n\n\n ff_jpeg2000_cleanup(comp, codsty);\n\n }\n\n av_freep(&s->tile[tileno].comp);\n\n }\n\n }\n\n av_freep(&s->tile);\n\n\n\n s->numXtiles = s->numYtiles = 0;\n\n}"}} {"sample_id": "d368ba4376b2c1c24175c74b3733b8fe64dbe8a6_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n SDHC_DATA_INHIBIT | SDHC_DAT_LINE_ACTIVE);\n \n s->blkgap &= ~(SDHC_STOP_AT_GAP_REQ | SDHC_CONTINUE_REQ);\n+\n+ s->stopped_state = sdhc_not_stopped;\n+\n+ s->norintsts &= ~(SDHC_NIS_WBUFRDY | SDHC_NIS_RBUFRDY |\n+\n SDHC_NIS_DMA | SDHC_NIS_TRSCMP | SDHC_NIS_BLKGAP);\n \n break;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void sdhci_reset_write(SDHCIState *s, uint8_t value)\n\n{\n\n switch (value) {\n\n case SDHC_RESET_ALL:\n\n DEVICE_GET_CLASS(s)->reset(DEVICE(s));\n\n break;\n\n case SDHC_RESET_CMD:\n\n s->prnsts &= ~SDHC_CMD_INHIBIT;\n\n s->norintsts &= ~SDHC_NIS_CMDCMP;\n\n break;\n\n case SDHC_RESET_DATA:\n\n s->data_count = 0;\n\n s->prnsts &= ~(SDHC_SPACE_AVAILABLE | SDHC_DATA_AVAILABLE |\n\n SDHC_DOING_READ | SDHC_DOING_WRITE |\n\n SDHC_DATA_INHIBIT | SDHC_DAT_LINE_ACTIVE);\n\n s->blkgap &= ~(SDHC_STOP_AT_GAP_REQ | SDHC_CONTINUE_REQ);\n\n s->stopped_state = sdhc_not_stopped;\n\n s->norintsts &= ~(SDHC_NIS_WBUFRDY | SDHC_NIS_RBUFRDY |\n\n SDHC_NIS_DMA | SDHC_NIS_TRSCMP | SDHC_NIS_BLKGAP);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "306a06e5f766acaf26b71397a5692c65b65a61c7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -37,11 +37,11 @@\n }\n \n \n+\n+ crypto = qcrypto_block_create(create_opts,\n+\n+ block_crypto_init_func,\n+\n block_crypto_write_func,\n \n &data,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int block_crypto_create_generic(QCryptoBlockFormat format,\n\n const char *filename,\n\n QemuOpts *opts,\n\n Error **errp)\n\n{\n\n int ret = -EINVAL;\n\n QCryptoBlockCreateOptions *create_opts = NULL;\n\n QCryptoBlock *crypto = NULL;\n\n struct BlockCryptoCreateData data = {\n\n .size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0),\n\n BDRV_SECTOR_SIZE),\n\n .opts = opts,\n\n .filename = filename,\n\n };\n\n\n\n create_opts = block_crypto_create_opts_init(format, opts, errp);\n\n if (!create_opts) {\n\n return -1;\n\n }\n\n\n\n crypto = qcrypto_block_create(create_opts,\n\n block_crypto_init_func,\n\n block_crypto_write_func,\n\n &data,\n\n errp);\n\n\n\n if (!crypto) {\n\n ret = -EIO;\n\n goto cleanup;\n\n }\n\n\n\n ret = 0;\n\n cleanup:\n\n qcrypto_block_free(crypto);\n\n blk_unref(data.blk);\n\n qapi_free_QCryptoBlockCreateOptions(create_opts);\n\n return ret;\n\n}\n"}} {"sample_id": "5a571d324129ce367584ad9d92aae1d286f389a2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n {\n \n #ifdef DEBUG\n+\n+ int ii;\n+\n \n \n for (ii = 0; ii < 32; ii++) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void h264_free_context(PayloadContext *data)\n\n{\n\n#ifdef DEBUG\n\n int ii;\n\n\n\n for (ii = 0; ii < 32; ii++) {\n\n if (data->packet_types_received[ii])\n\n av_log(NULL, AV_LOG_DEBUG, \"Received %d packets of type %d\\n\",\n\n data->packet_types_received[ii], ii);\n\n }\n\n#endif\n\n\n\n assert(data);\n\n assert(data->cookie == MAGIC_COOKIE);\n\n\n\n // avoid stale pointers (assert)\n\n data->cookie = DEAD_COOKIE;\n\n\n\n // and clear out this...\n\n av_free(data);\n\n}\n"}} {"sample_id": "60f10e0ad37418cc697765d85b0bc22db70f726a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void pred8x8_left_dc_rv40_c(uint8_t *src, int stride){\n \n+ int i;\n \n int dc0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void pred8x8_left_dc_rv40_c(uint8_t *src, int stride){\n\n int i;\n\n int dc0;\n\n\n\n dc0=0;\n\n for(i=0;i<8; i++)\n\n dc0+= src[-1+i*stride];\n\n dc0= 0x01010101*((dc0 + 4)>>3);\n\n\n\n for(i=0; i<8; i++){\n\n ((uint32_t*)(src+i*stride))[0]=\n\n ((uint32_t*)(src+i*stride))[1]= dc0;\n\n }\n\n}\n"}} {"sample_id": "5b956f415a356449a4171d5e0c7d9a25bbc84b5a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n \n \n+ if (r->req.io_canceled) {\n+\n+ scsi_req_cancel_complete(&r->req);\n+\n+ goto done;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void scsi_do_read(SCSIDiskReq *r, int ret)\n\n{\n\n SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);\n\n SCSIDiskClass *sdc = (SCSIDiskClass *) object_get_class(OBJECT(s));\n\n\n\n assert (r->req.aiocb == NULL);\n\n\n\n if (r->req.io_canceled) {\n\n scsi_req_cancel_complete(&r->req);\n\n goto done;\n\n }\n\n\n\n if (ret < 0) {\n\n if (scsi_handle_rw_error(r, -ret, false)) {\n\n goto done;\n\n }\n\n }\n\n\n\n /* The request is used as the AIO opaque value, so add a ref. */\n\n scsi_req_ref(&r->req);\n\n\n\n if (r->req.sg) {\n\n dma_acct_start(s->qdev.conf.blk, &r->acct, r->req.sg, BLOCK_ACCT_READ);\n\n r->req.resid -= r->req.sg->size;\n\n r->req.aiocb = dma_blk_io(blk_get_aio_context(s->qdev.conf.blk),\n\n r->req.sg, r->sector << BDRV_SECTOR_BITS,\n\n sdc->dma_readv, r, scsi_dma_complete, r,\n\n DMA_DIRECTION_FROM_DEVICE);\n\n } else {\n\n scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);\n\n block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct,\n\n r->qiov.size, BLOCK_ACCT_READ);\n\n r->req.aiocb = sdc->dma_readv(r->sector, &r->qiov,\n\n scsi_read_complete, r, r);\n\n }\n\n\n\ndone:\n\n scsi_req_unref(&r->req);\n\n}\n"}} {"sample_id": "bc7c08a2c375acb7ae4d433054415588b176d34c_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n const char *endptr = &f;\n \n+ unsigned long res = 999;\n+\n+ int err;\n+\n+\n \n err = qemu_strtoul(str, &endptr, 0, &res);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_qemu_strtoul_max(void)\n\n{\n\n char *str = g_strdup_printf(\"%lu\", ULONG_MAX);\n\n char f = 'X';\n\n const char *endptr = &f;\n\n unsigned long res = 999;\n\n int err;\n\n\n\n err = qemu_strtoul(str, &endptr, 0, &res);\n\n\n\n g_assert_cmpint(err, ==, 0);\n\n g_assert_cmpint(res, ==, ULONG_MAX);\n\n g_assert(endptr == str + strlen(str));\n\n g_free(str);\n\n}\n"}} {"sample_id": "6643e2f001f207bdb85646a4c48d1e13244d87c3_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -40,8 +40,8 @@\n \n abort();\n \n+ }\n+\n+ }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void kvm_do_inject_x86_mce(void *_data)\n\n{\n\n struct kvm_x86_mce_data *data = _data;\n\n int r;\n\n\n\n /* If there is an MCE exception being processed, ignore this SRAO MCE */\n\n if ((data->env->mcg_cap & MCG_SER_P) &&\n\n !(data->mce->status & MCI_STATUS_AR)) {\n\n r = kvm_mce_in_exception(data->env);\n\n if (r == -1) {\n\n fprintf(stderr, \"Failed to get MCE status\\n\");\n\n } else if (r) {\n\n return;\n\n }\n\n }\n\n\n\n r = kvm_set_mce(data->env, data->mce);\n\n if (r < 0) {\n\n perror(\"kvm_set_mce FAILED\");\n\n if (data->abort_on_error) {\n\n abort();\n\n }\n\n }\n\n}\n"}} {"sample_id": "72700d7e733948fa7fbb735ccdf2209931c88476", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void spapr_phb_vfio_class_init(ObjectClass *klass, void *data)\n \n+{\n \n+ DeviceClass *dc = DEVICE_CLASS(klass);\n \n sPAPRPHBClass *spc = SPAPR_PCI_HOST_BRIDGE_CLASS(klass);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void spapr_phb_vfio_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n sPAPRPHBClass *spc = SPAPR_PCI_HOST_BRIDGE_CLASS(klass);\n\n\n\n dc->props = spapr_phb_vfio_properties;\n\n spc->finish_realize = spapr_phb_vfio_finish_realize;\n\n}\n"}} {"sample_id": "3e9fab690d59ac15956c3733fe0794ce1ae4c4af_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -59,11 +59,11 @@\n if (bs0->drv && bs0->backing_hd) {\n bs0 = bs0->backing_hd;\n (*p_image_info)->has_backing_image = true;\n+ p_image_info = &((*p_image_info)->backing_image);\n+ } else {\n+ break;\n+ }\n+ }\n }\n *p_info = info;\n return;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void bdrv_query_info(BlockDriverState *bs,\n BlockInfo **p_info,\n Error **errp)\n{\n BlockInfo *info = g_malloc0(sizeof(*info));\n BlockDriverState *bs0;\n ImageInfo **p_image_info;\n Error *local_err = NULL;\n info->device = g_strdup(bs->device_name);\n info->type = g_strdup(\"unknown\");\n info->locked = bdrv_dev_is_medium_locked(bs);\n info->removable = bdrv_dev_has_removable_media(bs);\n if (bdrv_dev_has_removable_media(bs)) {\n info->has_tray_open = true;\n info->tray_open = bdrv_dev_is_tray_open(bs);\n }\n if (bdrv_iostatus_is_enabled(bs)) {\n info->has_io_status = true;\n info->io_status = bs->iostatus;\n }\n if (bs->dirty_bitmap) {\n info->has_dirty = true;\n info->dirty = g_malloc0(sizeof(*info->dirty));\n info->dirty->count = bdrv_get_dirty_count(bs) * BDRV_SECTOR_SIZE;\n info->dirty->granularity =\n ((int64_t) BDRV_SECTOR_SIZE << hbitmap_granularity(bs->dirty_bitmap));\n }\n if (bs->drv) {\n info->has_inserted = true;\n info->inserted = g_malloc0(sizeof(*info->inserted));\n info->inserted->file = g_strdup(bs->filename);\n info->inserted->ro = bs->read_only;\n info->inserted->drv = g_strdup(bs->drv->format_name);\n info->inserted->encrypted = bs->encrypted;\n info->inserted->encryption_key_missing = bdrv_key_required(bs);\n if (bs->backing_file[0]) {\n info->inserted->has_backing_file = true;\n info->inserted->backing_file = g_strdup(bs->backing_file);\n }\n info->inserted->backing_file_depth = bdrv_get_backing_file_depth(bs);\n if (bs->io_limits_enabled) {\n ThrottleConfig cfg;\n throttle_get_config(&bs->throttle_state, &cfg);\n info->inserted->bps = cfg.buckets[THROTTLE_BPS_TOTAL].avg;\n info->inserted->bps_rd = cfg.buckets[THROTTLE_BPS_READ].avg;\n info->inserted->bps_wr = cfg.buckets[THROTTLE_BPS_WRITE].avg;\n info->inserted->iops = cfg.buckets[THROTTLE_OPS_TOTAL].avg;\n info->inserted->iops_rd = cfg.buckets[THROTTLE_OPS_READ].avg;\n info->inserted->iops_wr = cfg.buckets[THROTTLE_OPS_WRITE].avg;\n }\n bs0 = bs;\n p_image_info = &info->inserted->image;\n while (1) {\n bdrv_query_image_info(bs0, p_image_info, &local_err);\n if (error_is_set(&local_err)) {\n error_propagate(errp, local_err);\n goto err;\n }\n if (bs0->drv && bs0->backing_hd) {\n bs0 = bs0->backing_hd;\n (*p_image_info)->has_backing_image = true;\n p_image_info = &((*p_image_info)->backing_image);\n } else {\n break;\n }\n }\n }\n *p_info = info;\n return;\n err:\n qapi_free_BlockInfo(info);\n}"}} {"sample_id": "0eb28a42284ec32e6f283985d2d638474a05eba4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -39,11 +39,11 @@\n }\n \n if (value < min || value > max) {\n+\n+ error_set(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE,\n+\n+ dev->id?:\"\", name, (int64_t)value, min, max);\n+\n return;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void set_blocksize(Object *obj, Visitor *v, void *opaque,\n\n const char *name, Error **errp)\n\n{\n\n DeviceState *dev = DEVICE(obj);\n\n Property *prop = opaque;\n\n uint16_t value, *ptr = qdev_get_prop_ptr(dev, prop);\n\n Error *local_err = NULL;\n\n const int64_t min = 512;\n\n const int64_t max = 32768;\n\n\n\n if (dev->realized) {\n\n qdev_prop_set_after_realize(dev, name, errp);\n\n return;\n\n }\n\n\n\n visit_type_uint16(v, &value, name, &local_err);\n\n if (local_err) {\n\n error_propagate(errp, local_err);\n\n return;\n\n }\n\n if (value < min || value > max) {\n\n error_set(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE,\n\n dev->id?:\"\", name, (int64_t)value, min, max);\n\n return;\n\n }\n\n\n\n /* We rely on power-of-2 blocksizes for bitmasks */\n\n if ((value & (value - 1)) != 0) {\n\n error_setg(errp,\n\n \"Property %s.%s doesn't take value '%\" PRId64 \"', it's not a power of 2\",\n\n dev->id ?: \"\", name, (int64_t)value);\n\n return;\n\n }\n\n\n\n *ptr = value;\n\n}\n"}} {"sample_id": "c004de0b1c5b44849f9619910c173d1a2204c16e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void gif_fill_rect(AVFrame *picture, uint32_t color, int l, int t, int w, int h)\n \n {\n+\n const int linesize = picture->linesize[0] / sizeof(uint32_t);\n \n const uint32_t *py = (uint32_t *)picture->data[0] + t * linesize;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void gif_fill_rect(AVFrame *picture, uint32_t color, int l, int t, int w, int h)\n\n{\n\n const int linesize = picture->linesize[0] / sizeof(uint32_t);\n\n const uint32_t *py = (uint32_t *)picture->data[0] + t * linesize;\n\n const uint32_t *pr, *pb = py + (t + h) * linesize;\n\n uint32_t *px;\n\n\n\n for (; py < pb; py += linesize) {\n\n px = (uint32_t *)py + l;\n\n pr = px + w;\n\n\n\n for (; px < pr; px++)\n\n *px = color;\n\n }\n\n}\n"}} {"sample_id": "d6604b29ef544793479d7fb4e05ef6622bb3e534_38", "diff": "--- a/source.c\n+++ b/source.c\n@@ -37,11 +37,11 @@\n if (ctx->nvenc_ctx)\n \n nv->nvEncDestroyEncoder(ctx->nvenc_ctx);\n+\n+\n+\n+ if (ctx->cu_context)\n+\n ctx->nvel.cu_ctx_destroy(ctx->cu_context);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "av_cold int ff_nvenc_encode_close(AVCodecContext *avctx)\n\n{\n\n NVENCContext *ctx = avctx->priv_data;\n\n NV_ENCODE_API_FUNCTION_LIST *nv = &ctx->nvel.nvenc_funcs;\n\n int i;\n\n\n\n av_frame_free(&avctx->coded_frame);\n\n\n\n if (ctx->in) {\n\n for (i = 0; i < ctx->nb_surfaces; ++i) {\n\n nv->nvEncDestroyInputBuffer(ctx->nvenc_ctx, ctx->in[i].in);\n\n nv->nvEncDestroyBitstreamBuffer(ctx->nvenc_ctx, ctx->out[i].out);\n\n }\n\n }\n\n\n\n av_freep(&ctx->in);\n\n av_freep(&ctx->out);\n\n\n\n if (ctx->nvenc_ctx)\n\n nv->nvEncDestroyEncoder(ctx->nvenc_ctx);\n\n\n\n if (ctx->cu_context)\n\n ctx->nvel.cu_ctx_destroy(ctx->cu_context);\n\n\n\n if (ctx->nvel.nvenc)\n\n dlclose(ctx->nvel.nvenc);\n\n\n\n if (ctx->nvel.cuda)\n\n dlclose(ctx->nvel.cuda);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_52", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n entry = qdict_find(qdict, key, hash);\n \n+ if (entry) {\n+\n+ /* replace key's value */\n+\n+ qobject_decref(entry->value);\n \n entry->value = value;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qdict_put_obj(QDict *qdict, const char *key, QObject *value)\n\n{\n\n unsigned int hash;\n\n QDictEntry *entry;\n\n\n\n hash = tdb_hash(key) % QDICT_HASH_SIZE;\n\n entry = qdict_find(qdict, key, hash);\n\n if (entry) {\n\n /* replace key's value */\n\n qobject_decref(entry->value);\n\n entry->value = value;\n\n } else {\n\n /* allocate a new entry */\n\n entry = alloc_entry(key, value);\n\n LIST_INSERT_HEAD(&qdict->table[hash], entry, next);\n\n }\n\n\n\n qdict->size++;\n\n}\n"}} {"sample_id": "187337f8b0ec0813dd3876d1efe37d415fb81c2e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n qemu_irq irq0, qemu_irq irq1)\n \n {\n+\n int iomemtype;\n \n pl181_state *s;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void pl181_init(uint32_t base, BlockDriverState *bd,\n\n qemu_irq irq0, qemu_irq irq1)\n\n{\n\n int iomemtype;\n\n pl181_state *s;\n\n\n\n s = (pl181_state *)qemu_mallocz(sizeof(pl181_state));\n\n iomemtype = cpu_register_io_memory(0, pl181_readfn,\n\n pl181_writefn, s);\n\n cpu_register_physical_memory(base, 0x00000fff, iomemtype);\n\n s->base = base;\n\n s->card = sd_init(bd);\n\n s->irq[0] = irq0;\n\n s->irq[1] = irq1;\n\n qemu_register_reset(pl181_reset, s);\n\n pl181_reset(s);\n\n /* ??? Save/restore. */\n\n}\n"}} {"sample_id": "1dc42050185d63c1de5d16146fbaee92640af187_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,11 +34,11 @@\n \n if (!outpicref)\n \n+ return AVERROR(ENOMEM);\n+\n+ }\n+\n+\n \n ret = ff_start_frame(outlink, avfilter_ref_buffer(outpicref, ~0));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int start_frame(AVFilterLink *inlink, AVFilterBufferRef *inpicref)\n\n{\n\n AVFilterLink *outlink = inlink->dst->outputs[0];\n\n AVFilterBufferRef *outpicref = NULL;\n\n int ret = 0;\n\n\n\n if (inpicref->perms & AV_PERM_PRESERVE) {\n\n outpicref = ff_get_video_buffer(outlink, AV_PERM_WRITE,\n\n outlink->w, outlink->h);\n\n if (!outpicref)\n\n return AVERROR(ENOMEM);\n\n\n\n avfilter_copy_buffer_ref_props(outpicref, inpicref);\n\n outpicref->video->w = outlink->w;\n\n outpicref->video->h = outlink->h;\n\n } else {\n\n outpicref = avfilter_ref_buffer(inpicref, ~0);\n\n if (!outpicref)\n\n return AVERROR(ENOMEM);\n\n }\n\n\n\n ret = ff_start_frame(outlink, avfilter_ref_buffer(outpicref, ~0));\n\n if (ret < 0) {\n\n avfilter_unref_bufferp(&outpicref);\n\n return ret;\n\n }\n\n\n\n outlink->out_buf = outpicref;\n\n return 0;\n\n}\n"}} {"sample_id": "b931bfbf042983f311b3b09894d8030b2755a638", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n VhostUserState *s = DO_UPCAST(VhostUserState, nc, nc);\n \n+\n+\n+ vhost_user_stop(s);\n \n qemu_purge_queued_packets(nc);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vhost_user_cleanup(NetClientState *nc)\n\n{\n\n VhostUserState *s = DO_UPCAST(VhostUserState, nc, nc);\n\n\n\n vhost_user_stop(s);\n\n qemu_purge_queued_packets(nc);\n\n}\n"}} {"sample_id": "26e92f65525ef4446a500d85e185cf78835922aa", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,10 +5,10 @@\n DeviceState *dev;\n \n \n+\n+ dev = qdev_create(NULL, \"realview_sysctl\");\n+\n+ qdev_prop_set_uint32(dev, \"sys_id\", sys_id);\n \n qdev_init_nofail(dev);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void arm_sysctl_init(uint32_t base, uint32_t sys_id)\n\n{\n\n DeviceState *dev;\n\n\n\n dev = qdev_create(NULL, \"realview_sysctl\");\n\n qdev_prop_set_uint32(dev, \"sys_id\", sys_id);\n\n qdev_init_nofail(dev);\n\n sysbus_mmio_map(sysbus_from_qdev(dev), 0, base);\n\n}\n"}} {"sample_id": "a8a6da4a0e059b2aab66627a96b63c3632c477c2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,22 +1,22 @@\n+static av_cold void init_mdct_win(TwinContext *tctx)\n+\n {\n \n int i,j;\n \n const ModeTab *mtab = tctx->mtab;\n+\n int size_s = mtab->size / mtab->fmode[FT_SHORT].sub;\n+\n int size_m = mtab->size / mtab->fmode[FT_MEDIUM].sub;\n+\n+ int channels = tctx->avctx->channels;\n+\n+ float norm = channels == 1 ? 2. : 1.;\n \n \n \n+ for (i = 0; i < 3; i++) {\n \n int bsize = tctx->mtab->size/tctx->mtab->fmode[i].sub;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static av_cold void init_mdct_win(TwinContext *tctx)\n\n{\n\n int i,j;\n\n const ModeTab *mtab = tctx->mtab;\n\n int size_s = mtab->size / mtab->fmode[FT_SHORT].sub;\n\n int size_m = mtab->size / mtab->fmode[FT_MEDIUM].sub;\n\n int channels = tctx->avctx->channels;\n\n float norm = channels == 1 ? 2. : 1.;\n\n\n\n for (i = 0; i < 3; i++) {\n\n int bsize = tctx->mtab->size/tctx->mtab->fmode[i].sub;\n\n ff_mdct_init(&tctx->mdct_ctx[i], av_log2(bsize) + 1, 1,\n\n -sqrt(norm/bsize) / (1<<15));\n\n }\n\n\n\n tctx->tmp_buf = av_malloc(mtab->size * sizeof(*tctx->tmp_buf));\n\n\n\n tctx->spectrum = av_malloc(2*mtab->size*channels*sizeof(float));\n\n tctx->curr_frame = av_malloc(2*mtab->size*channels*sizeof(float));\n\n tctx->prev_frame = av_malloc(2*mtab->size*channels*sizeof(float));\n\n\n\n for (i = 0; i < 3; i++) {\n\n int m = 4*mtab->size/mtab->fmode[i].sub;\n\n double freq = 2*M_PI/m;\n\n tctx->cos_tabs[i] = av_malloc((m/4)*sizeof(*tctx->cos_tabs));\n\n\n\n for (j = 0; j <= m/8; j++)\n\n tctx->cos_tabs[i][j] = cos((2*j + 1)*freq);\n\n for (j = 1; j < m/8; j++)\n\n tctx->cos_tabs[i][m/4-j] = tctx->cos_tabs[i][j];\n\n }\n\n\n\n\n\n ff_init_ff_sine_windows(av_log2(size_m));\n\n ff_init_ff_sine_windows(av_log2(size_s/2));\n\n ff_init_ff_sine_windows(av_log2(mtab->size));\n\n}\n"}} {"sample_id": "364031f17932814484657e5551ba12957d993d7e_28", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static int v9fs_synth_symlink(FsContext *fs_ctx, const char *oldpath,\n \n V9fsPath *newpath, const char *buf, FsCred *credp)\n+\n+{\n \n errno = EPERM;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int v9fs_synth_symlink(FsContext *fs_ctx, const char *oldpath,\n\n V9fsPath *newpath, const char *buf, FsCred *credp)\n\n{\n\n errno = EPERM;\n\n return -1;\n\n}\n"}} {"sample_id": "c3299726874829e8eb7a937c247956ab3c2ccae6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -45,11 +45,11 @@\n ctx->lsp[0] = ctx->lsp_buf[0];\n \n ctx->lsp[1] = ctx->lsp_buf[1];\n+\n+ memcpy(ctx->lsp[0], lsp_init, 10 * sizeof(int16_t));\n+\n+\n+\n ctx->exc = &ctx->exc_base[PITCH_DELAY_MAX+INTERPOL_LEN];\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int decoder_init(AVCodecContext * avctx)\n\n{\n\n G729Context* ctx = avctx->priv_data;\n\n int i,k;\n\n\n\n if (avctx->channels != 1) {\n\n av_log(avctx, AV_LOG_ERROR, \"Only mono sound is supported (requested channels: %d).\\n\", avctx->channels);\n\n return AVERROR(EINVAL);\n\n }\n\n avctx->sample_fmt = AV_SAMPLE_FMT_S16;\n\n\n\n /* Both 8kbit/s and 6.4kbit/s modes uses two subframes per frame. */\n\n avctx->frame_size = SUBFRAME_SIZE << 1;\n\n\n\n ctx->gain_coeff = 16384; // 1.0 in (1.14)\n\n\n\n for (k = 0; k < MA_NP + 1; k++) {\n\n ctx->past_quantizer_outputs[k] = ctx->past_quantizer_output_buf[k];\n\n for (i = 1; i < 11; i++)\n\n ctx->past_quantizer_outputs[k][i - 1] = (18717 * i) >> 3;\n\n }\n\n\n\n ctx->lsp[0] = ctx->lsp_buf[0];\n\n ctx->lsp[1] = ctx->lsp_buf[1];\n\n memcpy(ctx->lsp[0], lsp_init, 10 * sizeof(int16_t));\n\n\n\n ctx->exc = &ctx->exc_base[PITCH_DELAY_MAX+INTERPOL_LEN];\n\n\n\n /* random seed initialization */\n\n ctx->rand_value = 21845;\n\n\n\n /* quantized prediction error */\n\n for(i=0; i<4; i++)\n\n ctx->quant_energy[i] = -14336; // -14 in (5.10)\n\n\n\n avctx->dsp_mask= ~AV_CPU_FLAG_FORCE;\n\n dsputil_init(&ctx->dsp, avctx);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "8607f5c3072caeebbe0217df28651fffd3a79fd9_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n VIRTQUEUE_MAX_SIZE, 1);\n \n virtqueue_map_iovec(elem->out_sg, elem->out_addr, &elem->out_num,\n+\n+ VIRTQUEUE_MAX_SIZE, 0);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void virtqueue_map(VirtQueueElement *elem)\n\n{\n\n virtqueue_map_iovec(elem->in_sg, elem->in_addr, &elem->in_num,\n\n VIRTQUEUE_MAX_SIZE, 1);\n\n virtqueue_map_iovec(elem->out_sg, elem->out_addr, &elem->out_num,\n\n VIRTQUEUE_MAX_SIZE, 0);\n\n}\n"}} {"sample_id": "4b1f5e5090abed6c618c8ba380cd7d28d140f867", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,9 +15,9 @@\n break;\n \n po++;\n+\n+ }\n+\n+ return po;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static const OptionDef *find_option(const OptionDef *po, const char *name)\n\n{\n\n const char *p = strchr(name, ':');\n\n int len = p ? p - name : strlen(name);\n\n\n\n while (po->name != NULL) {\n\n if (!strncmp(name, po->name, len) && strlen(po->name) == len)\n\n break;\n\n po++;\n\n }\n\n return po;\n\n}\n"}} {"sample_id": "a8f171151f0f027abb06f72e48c44929616a84cb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n FileContext *c = h->priv_data;\n \n+ int r = write(c->fd, buf, size);\n+\n return (-1 == r)?AVERROR(errno):r;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int file_write(URLContext *h, const unsigned char *buf, int size)\n\n{\n\n FileContext *c = h->priv_data;\n\n int r = write(c->fd, buf, size);\n\n return (-1 == r)?AVERROR(errno):r;\n\n}\n"}} {"sample_id": "a01672d3968cf91208666d371784110bfde9d4f8_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void kvm_client_set_memory(struct CPUPhysMemoryClient *client,\n+\n target_phys_addr_t start_addr,\n \n ram_addr_t size, ram_addr_t phys_offset,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void kvm_client_set_memory(struct CPUPhysMemoryClient *client,\n\n target_phys_addr_t start_addr,\n\n ram_addr_t size, ram_addr_t phys_offset,\n\n bool log_dirty)\n\n{\n\n kvm_set_phys_mem(start_addr, size, phys_offset, log_dirty);\n\n}\n"}} {"sample_id": "4c315c27661502a0813b129e41c0bf640c34a8d6_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n cc->dump_state = mb_cpu_dump_state;\n cc->set_pc = mb_cpu_set_pc;\n cc->gdb_read_register = mb_cpu_gdb_read_register;\n+ cc->gdb_write_register = mb_cpu_gdb_write_register;\n+#ifdef CONFIG_USER_ONLY\n+ cc->handle_mmu_fault = mb_cpu_handle_mmu_fault;\n+#else\n+ cc->do_unassigned_access = mb_cpu_unassigned_access;\n cc->get_phys_page_debug = mb_cpu_get_phys_page_debug;\n #endif\n dc->vmsd = &vmstate_mb_cpu;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void mb_cpu_class_init(ObjectClass *oc, void *data)\n{\n DeviceClass *dc = DEVICE_CLASS(oc);\n CPUClass *cc = CPU_CLASS(oc);\n MicroBlazeCPUClass *mcc = MICROBLAZE_CPU_CLASS(oc);\n mcc->parent_realize = dc->realize;\n dc->realize = mb_cpu_realizefn;\n mcc->parent_reset = cc->reset;\n cc->reset = mb_cpu_reset;\n cc->has_work = mb_cpu_has_work;\n cc->do_interrupt = mb_cpu_do_interrupt;\n cc->cpu_exec_interrupt = mb_cpu_exec_interrupt;\n cc->dump_state = mb_cpu_dump_state;\n cc->set_pc = mb_cpu_set_pc;\n cc->gdb_read_register = mb_cpu_gdb_read_register;\n cc->gdb_write_register = mb_cpu_gdb_write_register;\n#ifdef CONFIG_USER_ONLY\n cc->handle_mmu_fault = mb_cpu_handle_mmu_fault;\n#else\n cc->do_unassigned_access = mb_cpu_unassigned_access;\n cc->get_phys_page_debug = mb_cpu_get_phys_page_debug;\n#endif\n dc->vmsd = &vmstate_mb_cpu;\n dc->props = mb_properties;\n cc->gdb_num_core_regs = 32 + 5;\n cc->disas_set_info = mb_disas_set_info;\n}"}} {"sample_id": "7fe4a41c262e2529dc79f77f6fe63c5309fa2fd9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n w_lim = w;\n } else {\n w_lim = w - (w_lim % VNC_DIRTY_PIXELS_PER_BIT);\n+ for (i = 0; i < h; i++) {\n+ for (x = 0; x <= w_lim;\n+ x += s, src_row += cmp_bytes, dst_row += cmp_bytes) {\n+ if (x == w_lim) {\n+ if ((s = w - w_lim) == 0)\n break;\n } else if (!x) {\n s = (VNC_DIRTY_PIXELS_PER_BIT -", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void vnc_dpy_copy(DisplayChangeListener *dcl,\n int src_x, int src_y,\n int dst_x, int dst_y, int w, int h)\n{\n VncDisplay *vd = container_of(dcl, VncDisplay, dcl);\n VncState *vs, *vn;\n uint8_t *src_row;\n uint8_t *dst_row;\n int i, x, y, pitch, inc, w_lim, s;\n int cmp_bytes;\n vnc_refresh_server_surface(vd);\n QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {\n if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {\n vs->force_update = 1;\n vnc_update_client(vs, 1, true);\n /* vs might be free()ed here */\n /* do bitblit op on the local surface too */\n pitch = vnc_server_fb_stride(vd);\n src_row = vnc_server_fb_ptr(vd, src_x, src_y);\n dst_row = vnc_server_fb_ptr(vd, dst_x, dst_y);\n y = dst_y;\n inc = 1;\n if (dst_y > src_y) {\n /* copy backwards */\n src_row += pitch * (h-1);\n dst_row += pitch * (h-1);\n pitch = -pitch;\n y = dst_y + h - 1;\n inc = -1;\n w_lim = w - (VNC_DIRTY_PIXELS_PER_BIT - (dst_x % VNC_DIRTY_PIXELS_PER_BIT));\n if (w_lim < 0) {\n w_lim = w;\n } else {\n w_lim = w - (w_lim % VNC_DIRTY_PIXELS_PER_BIT);\n for (i = 0; i < h; i++) {\n for (x = 0; x <= w_lim;\n x += s, src_row += cmp_bytes, dst_row += cmp_bytes) {\n if (x == w_lim) {\n if ((s = w - w_lim) == 0)\n break;\n } else if (!x) {\n s = (VNC_DIRTY_PIXELS_PER_BIT -\n (dst_x % VNC_DIRTY_PIXELS_PER_BIT));\n s = MIN(s, w_lim);\n } else {\n s = VNC_DIRTY_PIXELS_PER_BIT;\n cmp_bytes = s * VNC_SERVER_FB_BYTES;\n if (memcmp(src_row, dst_row, cmp_bytes) == 0)\n continue;\n memmove(dst_row, src_row, cmp_bytes);\n QTAILQ_FOREACH(vs, &vd->clients, next) {\n if (!vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {\n set_bit(((x + dst_x) / VNC_DIRTY_PIXELS_PER_BIT),\n vs->dirty[y]);\n src_row += pitch - w * VNC_SERVER_FB_BYTES;\n dst_row += pitch - w * VNC_SERVER_FB_BYTES;\n y += inc;\n QTAILQ_FOREACH(vs, &vd->clients, next) {\n if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {\n vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);"}} {"sample_id": "6aff24c6a61c6fec31e555c7748ba6085b7b2c06", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n error_propagate(errp, local_err);\n \n+ object_unref(OBJECT(cpu));\n+\n+ cpu = NULL;\n+\n+ }\n \n return cpu;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static X86CPU *pc_new_cpu(const char *cpu_model, int64_t apic_id,\n\n Error **errp)\n\n{\n\n X86CPU *cpu = NULL;\n\n Error *local_err = NULL;\n\n\n\n cpu = cpu_x86_create(cpu_model, &local_err);\n\n if (local_err != NULL) {\n\n goto out;\n\n }\n\n\n\n object_property_set_int(OBJECT(cpu), apic_id, \"apic-id\", &local_err);\n\n object_property_set_bool(OBJECT(cpu), true, \"realized\", &local_err);\n\n\n\nout:\n\n if (local_err) {\n\n error_propagate(errp, local_err);\n\n object_unref(OBJECT(cpu));\n\n cpu = NULL;\n\n }\n\n return cpu;\n\n}\n"}} {"sample_id": "b3db211f3c80bb996a704d665fe275619f728bd4_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,5 +5,5 @@\n {\n \n test_native_list(data, unused, USER_DEF_NATIVE_LIST_UNION_KIND_INTEGER);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_visitor_out_native_list_int(TestOutputVisitorData *data,\n\n const void *unused)\n\n{\n\n test_native_list(data, unused, USER_DEF_NATIVE_LIST_UNION_KIND_INTEGER);\n\n}\n"}} {"sample_id": "30fd3e27907dfd1c0c66cc1339657af1a2ce1d4b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n int *fds,\n \n size_t nfds,\n+\n+ Error **errp)\n+\n+{\n+\n QIOChannelFile *fioc = QIO_CHANNEL_FILE(ioc);\n \n ssize_t ret;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ssize_t qio_channel_file_writev(QIOChannel *ioc,\n\n const struct iovec *iov,\n\n size_t niov,\n\n int *fds,\n\n size_t nfds,\n\n Error **errp)\n\n{\n\n QIOChannelFile *fioc = QIO_CHANNEL_FILE(ioc);\n\n ssize_t ret;\n\n\n\n retry:\n\n ret = writev(fioc->fd, iov, niov);\n\n if (ret <= 0) {\n\n if (errno == EAGAIN ||\n\n errno == EWOULDBLOCK) {\n\n return QIO_CHANNEL_ERR_BLOCK;\n\n }\n\n if (errno == EINTR) {\n\n goto retry;\n\n }\n\n error_setg_errno(errp, errno,\n\n \"Unable to write to file\");\n\n return -1;\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_50", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n return -EMFILE;\n \n+ }\n+\n+ qemu_notify_bh = qemu_bh_new(notify_event_cb, NULL);\n+\n+ gpollfds = g_array_new(FALSE, FALSE, sizeof(GPollFD));\n \n src = aio_get_g_source(qemu_aio_context);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_init_main_loop(Error **errp)\n\n{\n\n int ret;\n\n GSource *src;\n\n Error *local_error = NULL;\n\n\n\n init_clocks();\n\n\n\n ret = qemu_signal_init();\n\n if (ret) {\n\n return ret;\n\n }\n\n\n\n qemu_aio_context = aio_context_new(&local_error);\n\n if (!qemu_aio_context) {\n\n error_propagate(errp, local_error);\n\n return -EMFILE;\n\n }\n\n qemu_notify_bh = qemu_bh_new(notify_event_cb, NULL);\n\n gpollfds = g_array_new(FALSE, FALSE, sizeof(GPollFD));\n\n src = aio_get_g_source(qemu_aio_context);\n\n g_source_set_name(src, \"aio-context\");\n\n g_source_attach(src, NULL);\n\n g_source_unref(src);\n\n src = iohandler_get_g_source();\n\n g_source_set_name(src, \"io-handler\");\n\n g_source_attach(src, NULL);\n\n g_source_unref(src);\n\n return 0;\n\n}\n"}} {"sample_id": "b47d8efa9f430c332bf96ce6eede169eb48422ad", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int vfio_pci_hot_reset_multi(VFIOPCIDevice *vdev)\n \n {\n+\n return vfio_pci_hot_reset(vdev, false);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int vfio_pci_hot_reset_multi(VFIOPCIDevice *vdev)\n\n{\n\n return vfio_pci_hot_reset(vdev, false);\n\n}\n"}} {"sample_id": "abd7f08b2353f43274b785db8c7224f082ef4d31", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n \n \n+ virgl_renderer_get_cap_set(gc.capset_id, &max_ver,\n+\n+ &max_size);\n+\n+ resp = g_malloc(sizeof(*resp) + max_size);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virgl_cmd_get_capset(VirtIOGPU *g,\n\n struct virtio_gpu_ctrl_command *cmd)\n\n{\n\n struct virtio_gpu_get_capset gc;\n\n struct virtio_gpu_resp_capset *resp;\n\n uint32_t max_ver, max_size;\n\n VIRTIO_GPU_FILL_CMD(gc);\n\n\n\n virgl_renderer_get_cap_set(gc.capset_id, &max_ver,\n\n &max_size);\n\n resp = g_malloc(sizeof(*resp) + max_size);\n\n\n\n resp->hdr.type = VIRTIO_GPU_RESP_OK_CAPSET;\n\n virgl_renderer_fill_caps(gc.capset_id,\n\n gc.capset_version,\n\n (void *)resp->capset_data);\n\n virtio_gpu_ctrl_response(g, cmd, &resp->hdr, sizeof(*resp) + max_size);\n\n g_free(resp);\n\n}\n"}} {"sample_id": "68f593b48433842f3407586679fe07f3e5199ab9_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -51,11 +51,11 @@\n if(s->codec_id==CODEC_ID_MPEG4)\n \n ret= mpeg4_decode_video_packet_header(s);\n+\n+ else\n+\n+ ret= h263_decode_gob_header(s);\n+\n if(ret>=0)\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int ff_h263_resync(MpegEncContext *s){\n\n int left, ret;\n\n \n\n if(s->codec_id==CODEC_ID_MPEG4)\n\n skip_bits1(&s->gb);\n\n \n\n align_get_bits(&s->gb);\n\n\n\n if(show_bits(&s->gb, 16)==0){\n\n if(s->codec_id==CODEC_ID_MPEG4)\n\n ret= mpeg4_decode_video_packet_header(s);\n\n else\n\n ret= h263_decode_gob_header(s);\n\n if(ret>=0)\n\n return 0;\n\n }\n\n //ok, its not where its supposed to be ...\n\n s->gb= s->last_resync_gb;\n\n align_get_bits(&s->gb);\n\n left= s->gb.size*8 - get_bits_count(&s->gb);\n\n \n\n for(;left>16+1+5+5; left-=8){ \n\n if(show_bits(&s->gb, 16)==0){\n\n GetBitContext bak= s->gb;\n\n\n\n if(s->codec_id==CODEC_ID_MPEG4)\n\n ret= mpeg4_decode_video_packet_header(s);\n\n else\n\n ret= h263_decode_gob_header(s);\n\n if(ret>=0)\n\n return 0;\n\n\n\n s->gb= bak;\n\n }\n\n skip_bits(&s->gb, 8);\n\n }\n\n \n\n return -1;\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_80", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n \n cd_data_to_raw(buf, lba);\n \n+ break;\n+\n+ default:\n+\n+ ret = -EIO;\n \n break;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int cd_read_sector(IDEState *s, int lba, uint8_t *buf, int sector_size)\n\n{\n\n int ret;\n\n\n\n switch(sector_size) {\n\n case 2048:\n\n block_acct_start(bdrv_get_stats(s->bs), &s->acct,\n\n 4 * BDRV_SECTOR_SIZE, BLOCK_ACCT_READ);\n\n ret = bdrv_read(s->bs, (int64_t)lba << 2, buf, 4);\n\n block_acct_done(bdrv_get_stats(s->bs), &s->acct);\n\n break;\n\n case 2352:\n\n block_acct_start(bdrv_get_stats(s->bs), &s->acct,\n\n 4 * BDRV_SECTOR_SIZE, BLOCK_ACCT_READ);\n\n ret = bdrv_read(s->bs, (int64_t)lba << 2, buf + 16, 4);\n\n block_acct_done(bdrv_get_stats(s->bs), &s->acct);\n\n if (ret < 0)\n\n return ret;\n\n cd_data_to_raw(buf, lba);\n\n break;\n\n default:\n\n ret = -EIO;\n\n break;\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "056dfcb695cde3c62b7dc1d5ed6d2e38b3a73e29", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n return true;\n \n+ }\n+\n+ count++;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool vfio_blacklist_opt_rom(VFIOPCIDevice *vdev)\n\n{\n\n PCIDevice *pdev = &vdev->pdev;\n\n uint16_t vendor_id, device_id;\n\n int count = 0;\n\n\n\n vendor_id = pci_get_word(pdev->config + PCI_VENDOR_ID);\n\n device_id = pci_get_word(pdev->config + PCI_DEVICE_ID);\n\n\n\n while (count < ARRAY_SIZE(romblacklist)) {\n\n if (romblacklist[count].vendor_id == vendor_id &&\n\n romblacklist[count].device_id == device_id) {\n\n return true;\n\n }\n\n count++;\n\n }\n\n\n\n return false;\n\n}\n"}} {"sample_id": "f671d173c7e1da555b693e8b14f3ed0852601809", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,10 +18,10 @@\n \n chksum=(((chksum&0xfe)>>1)|((chksum&0x01)?0x80:0)) + c;\n \n+ }\n+\n+\n+\n+ return chksum;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline uint8_t fat_chksum(const direntry_t* entry)\n\n{\n\n uint8_t chksum=0;\n\n int i;\n\n\n\n for(i=0;i<11;i++) {\n\n unsigned char c;\n\n\n\n c = (i < 8) ? entry->name[i] : entry->extension[i-8];\n\n chksum=(((chksum&0xfe)>>1)|((chksum&0x01)?0x80:0)) + c;\n\n }\n\n\n\n return chksum;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n struct ibv_sge sge = {\n \n .addr = (uint64_t)(rdma->wr_data[idx].control),\n+\n+ .length = RDMA_CONTROL_MAX_BUFFER,\n+\n+ .lkey = rdma->wr_data[idx].control_mr->lkey,\n+\n };\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int qemu_rdma_post_recv_control(RDMAContext *rdma, int idx)\n\n{\n\n struct ibv_recv_wr *bad_wr;\n\n struct ibv_sge sge = {\n\n .addr = (uint64_t)(rdma->wr_data[idx].control),\n\n .length = RDMA_CONTROL_MAX_BUFFER,\n\n .lkey = rdma->wr_data[idx].control_mr->lkey,\n\n };\n\n\n\n struct ibv_recv_wr recv_wr = {\n\n .wr_id = RDMA_WRID_RECV_CONTROL + idx,\n\n .sg_list = &sge,\n\n .num_sge = 1,\n\n };\n\n\n\n\n\n if (ibv_post_recv(rdma->qp, &recv_wr, &bad_wr)) {\n\n return -1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "c23acbaed40101c677dfcfbbfe0d2c230a8e8f44_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n void FUNCC(ff_h264_idct8_dc_add)(uint8_t *_dst, DCTELEM *block, int stride){\n \n int i, j;\n+\n int dc = (((dctcoef*)block)[0] + 32) >> 6;\n \n INIT_CLIP\n \n+ pixel *dst = (pixel*)_dst;\n \n stride /= sizeof(pixel);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void FUNCC(ff_h264_idct8_dc_add)(uint8_t *_dst, DCTELEM *block, int stride){\n\n int i, j;\n\n int dc = (((dctcoef*)block)[0] + 32) >> 6;\n\n INIT_CLIP\n\n pixel *dst = (pixel*)_dst;\n\n stride /= sizeof(pixel);\n\n for( j = 0; j < 8; j++ )\n\n {\n\n for( i = 0; i < 8; i++ )\n\n dst[i] = CLIP( dst[i] + dc );\n\n dst += stride;\n\n }\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_24", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n \n \n+ TAILQ_FOREACH(re, &reset_handlers, entry) {\n+\n+ if (re->func == func && re->opaque == opaque) {\n+\n+ TAILQ_REMOVE(&reset_handlers, re, entry);\n \n qemu_free(re);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_unregister_reset(QEMUResetHandler *func, void *opaque)\n\n{\n\n QEMUResetEntry *re;\n\n\n\n TAILQ_FOREACH(re, &reset_handlers, entry) {\n\n if (re->func == func && re->opaque == opaque) {\n\n TAILQ_REMOVE(&reset_handlers, re, entry);\n\n qemu_free(re);\n\n return;\n\n }\n\n }\n\n}\n"}} {"sample_id": "fd56e0612b6454a282fa6a953fdb09281a98c589_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n return dev->bus->address_space_mem;\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "MemoryRegion *pci_address_space(PCIDevice *dev)\n\n{\n\n return dev->bus->address_space_mem;\n\n}\n"}} {"sample_id": "1bd280f73076b7a58371585b95b08379f2445332", "diff": "--- a/source.c\n+++ b/source.c\n@@ -47,11 +47,11 @@\n \n data_size = FFMAX(avpkt->size, AVCODEC_MAX_AUDIO_FRAME_SIZE);\n \n+ samples = av_malloc(data_size);\n+\n+ if (!samples)\n+\n+ goto fail;\n \n ret = avcodec_decode_audio3(st->codec, samples,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int try_decode_frame(AVStream *st, AVPacket *avpkt)\n\n{\n\n int16_t *samples;\n\n AVCodec *codec;\n\n int got_picture, data_size, ret=0;\n\n AVFrame picture;\n\n\n\n if(!st->codec->codec){\n\n codec = avcodec_find_decoder(st->codec->codec_id);\n\n if (!codec)\n\n return -1;\n\n ret = avcodec_open(st->codec, codec);\n\n if (ret < 0)\n\n return ret;\n\n }\n\n\n\n if(!has_codec_parameters(st->codec)){\n\n switch(st->codec->codec_type) {\n\n case CODEC_TYPE_VIDEO:\n\n\n ret = avcodec_decode_video2(st->codec, &picture,\n\n &got_picture, avpkt);\n\n break;\n\n case CODEC_TYPE_AUDIO:\n\n data_size = FFMAX(avpkt->size, AVCODEC_MAX_AUDIO_FRAME_SIZE);\n\n samples = av_malloc(data_size);\n\n if (!samples)\n\n goto fail;\n\n ret = avcodec_decode_audio3(st->codec, samples,\n\n &data_size, avpkt);\n\n av_free(samples);\n\n break;\n\n default:\n\n break;\n\n }\n\n }\n\n fail:\n\n return ret;\n\n}"}} {"sample_id": "b9ce1454e14ec918acb90d899ce7724f69682f45", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,9 +15,9 @@\n if (f->buf_index >= f->buf_size)\n \n return 0;\n+\n+ }\n+\n+ return f->buf[f->buf_index++];\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_get_byte(QEMUFile *f)\n\n{\n\n if (f->is_write)\n\n abort();\n\n\n\n if (f->buf_index >= f->buf_size) {\n\n qemu_fill_buffer(f);\n\n if (f->buf_index >= f->buf_size)\n\n return 0;\n\n }\n\n return f->buf[f->buf_index++];\n\n}\n"}} {"sample_id": "8d06b149271cbd5b19bed5bde8da5ecef40ecbc6_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static int smc91c111_can_receive(NetClientState *nc)\n \n+{\n+\n+ smc91c111_state *s = qemu_get_nic_opaque(nc);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int smc91c111_can_receive(NetClientState *nc)\n\n{\n\n smc91c111_state *s = qemu_get_nic_opaque(nc);\n\n\n\n if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST))\n\n return 1;\n\n if (s->allocated == (1 << NUM_PACKETS) - 1)\n\n return 0;\n\n return 1;\n\n}\n"}} {"sample_id": "ac43fa508cc1cfe6d6f67c8eb99dc012e52c164e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static uint64_t pci_host_data_read(void *opaque,\n \n hwaddr addr, unsigned len)\n+\n {\n \n PCIHostState *s = opaque;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint64_t pci_host_data_read(void *opaque,\n\n hwaddr addr, unsigned len)\n\n{\n\n PCIHostState *s = opaque;\n\n uint32_t val;\n\n if (!(s->config_reg & (1 << 31)))\n\n return 0xffffffff;\n\n val = pci_data_read(s->bus, s->config_reg | (addr & 3), len);\n\n PCI_DPRINTF(\"read addr \" TARGET_FMT_plx \" len %d val %x\\n\",\n\n addr, len, val);\n\n return val;\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_35", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,8 +6,8 @@\n \n g_free(pollfds);\n \n+ g_free(nodes);\n+\n+ nalloc = 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pollfds_cleanup(Notifier *n, void *unused)\n\n{\n\n g_assert(npfd == 0);\n\n g_free(pollfds);\n\n g_free(nodes);\n\n nalloc = 0;\n\n}\n"}} {"sample_id": "d00bff20b2b48796e4bd2d0b83819c159f60a25f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n \n \n+ if((buf == NULL) || (buf_size < s->checksum_size))\n+\n+ return 0;\n+\n+\n \n *data_size = s->channels * s->frame_size * sizeof(int16_t);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int qdm2_decode_frame(AVCodecContext *avctx,\n\n void *data, int *data_size,\n\n uint8_t *buf, int buf_size)\n\n{\n\n QDM2Context *s = avctx->priv_data;\n\n\n\n if((buf == NULL) || (buf_size < s->checksum_size))\n\n return 0;\n\n\n\n *data_size = s->channels * s->frame_size * sizeof(int16_t);\n\n\n\n av_log(avctx, AV_LOG_DEBUG, \"decode(%d): %p[%d] -> %p[%d]\\n\",\n\n buf_size, buf, s->checksum_size, data, *data_size);\n\n\n\n qdm2_decode(s, buf, data);\n\n\n\n // reading only when next superblock found\n\n if (s->sub_packet == 0) {\n\n return s->checksum_size;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "9a10bbb4e83b184faef6fa744396a6775283c0aa", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,9 +9,9 @@\n qemu_register_wakeup_notifier(&ar->wakeup);\n \n memory_region_init_io(&ar->pm1.cnt.io, memory_region_owner(parent),\n+\n+ &acpi_pm_cnt_ops, ar, \"acpi-cnt\", 2);\n+\n+ memory_region_add_subregion(parent, 4, &ar->pm1.cnt.io);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void acpi_pm1_cnt_init(ACPIREGS *ar, MemoryRegion *parent, uint8_t s4_val)\n\n{\n\n ar->pm1.cnt.s4_val = s4_val;\n\n ar->wakeup.notify = acpi_notify_wakeup;\n\n qemu_register_wakeup_notifier(&ar->wakeup);\n\n memory_region_init_io(&ar->pm1.cnt.io, memory_region_owner(parent),\n\n &acpi_pm_cnt_ops, ar, \"acpi-cnt\", 2);\n\n memory_region_add_subregion(parent, 4, &ar->pm1.cnt.io);\n\n}\n"}} {"sample_id": "ad0ebb91cd8b5fdc4a583b03645677771f420a46_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,19 +5,19 @@\n int rc;\n \n uint8_t byte;\n+\n \n \n if (!dev->crq.qsize) {\n \n fprintf(stderr, \"spapr_vio_send_creq on uninitialized queue\\n\");\n \n+ return -1;\n \n }\n \n \n+\n /* Maybe do a fast path for KVM just writing to the pages */\n \n rc = spapr_tce_dma_read(dev, dev->crq.qladdr + dev->crq.qnext, &byte, 1);\n@@ -25,7 +25,7 @@\n if (rc) {\n \n return rc;\n+\n }\n \n if (byte != 0) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "int spapr_vio_send_crq(VIOsPAPRDevice *dev, uint8_t *crq)\n\n{\n\n int rc;\n\n uint8_t byte;\n\n\n\n if (!dev->crq.qsize) {\n\n fprintf(stderr, \"spapr_vio_send_creq on uninitialized queue\\n\");\n\n return -1;\n\n }\n\n\n\n /* Maybe do a fast path for KVM just writing to the pages */\n\n rc = spapr_tce_dma_read(dev, dev->crq.qladdr + dev->crq.qnext, &byte, 1);\n\n if (rc) {\n\n return rc;\n\n }\n\n if (byte != 0) {\n\n return 1;\n\n }\n\n\n\n rc = spapr_tce_dma_write(dev, dev->crq.qladdr + dev->crq.qnext + 8,\n\n &crq[8], 8);\n\n if (rc) {\n\n return rc;\n\n }\n\n\n\n kvmppc_eieio();\n\n\n\n rc = spapr_tce_dma_write(dev, dev->crq.qladdr + dev->crq.qnext, crq, 8);\n\n if (rc) {\n\n return rc;\n\n }\n\n\n\n dev->crq.qnext = (dev->crq.qnext + 16) % dev->crq.qsize;\n\n\n\n if (dev->signal_state & 1) {\n\n qemu_irq_pulse(dev->qirq);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "565e0c6d866ce08d4b06427456d3d1f4fd856e9c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -37,11 +37,11 @@\n mov_write_string_metadata(s, pb, \"desc\", \"description\",1);\n \n mov_write_string_metadata(s, pb, \"ldes\", \"synopsis\" , 1);\n+\n+ mov_write_string_metadata(s, pb, \"tvsh\", \"show\" , 1);\n+\n+ mov_write_string_metadata(s, pb, \"tven\", \"episode_id\",1);\n+\n mov_write_string_metadata(s, pb, \"tvnn\", \"network\" , 1);\n \n mov_write_trkn_tag(pb, mov, s);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mov_write_ilst_tag(AVIOContext *pb, MOVMuxContext *mov,\n\n AVFormatContext *s)\n\n{\n\n int64_t pos = avio_tell(pb);\n\n avio_wb32(pb, 0); /* size */\n\n ffio_wfourcc(pb, \"ilst\");\n\n mov_write_string_metadata(s, pb, \"\\251nam\", \"title\" , 1);\n\n mov_write_string_metadata(s, pb, \"\\251ART\", \"artist\" , 1);\n\n mov_write_string_metadata(s, pb, \"aART\", \"album_artist\", 1);\n\n mov_write_string_metadata(s, pb, \"\\251wrt\", \"composer\" , 1);\n\n mov_write_string_metadata(s, pb, \"\\251alb\", \"album\" , 1);\n\n mov_write_string_metadata(s, pb, \"\\251day\", \"date\" , 1);\n\n mov_write_string_tag(pb, \"\\251too\", LIBAVFORMAT_IDENT, 0, 1);\n\n mov_write_string_metadata(s, pb, \"\\251cmt\", \"comment\" , 1);\n\n mov_write_string_metadata(s, pb, \"\\251gen\", \"genre\" , 1);\n\n mov_write_string_metadata(s, pb, \"\\251cpy\", \"copyright\", 1);\n\n mov_write_string_metadata(s, pb, \"\\251grp\", \"grouping\" , 1);\n\n mov_write_string_metadata(s, pb, \"\\251lyr\", \"lyrics\" , 1);\n\n mov_write_string_metadata(s, pb, \"desc\", \"description\",1);\n\n mov_write_string_metadata(s, pb, \"ldes\", \"synopsis\" , 1);\n\n mov_write_string_metadata(s, pb, \"tvsh\", \"show\" , 1);\n\n mov_write_string_metadata(s, pb, \"tven\", \"episode_id\",1);\n\n mov_write_string_metadata(s, pb, \"tvnn\", \"network\" , 1);\n\n mov_write_trkn_tag(pb, mov, s);\n\n return update_size(pb, pos);\n\n}\n"}} {"sample_id": "d33271213437ed1834b0a50540d79e877e1cd894", "diff": "--- a/source.c\n+++ b/source.c\n@@ -39,11 +39,11 @@\n if (srclen > destlen) {\n \n srclen = destlen;\n+\n+ }\n+\n+\n+\n for (; destlen && srclen; src++, dest++, destlen--, srclen--) {\n \n v = cpu_ldub_data_ra(env, src, ra);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint32_t HELPER(mvcl)(CPUS390XState *env, uint32_t r1, uint32_t r2)\n\n{\n\n uintptr_t ra = GETPC();\n\n uint64_t destlen = env->regs[r1 + 1] & 0xffffff;\n\n uint64_t dest = get_address(env, r1);\n\n uint64_t srclen = env->regs[r2 + 1] & 0xffffff;\n\n uint64_t src = get_address(env, r2);\n\n uint8_t pad = env->regs[r2 + 1] >> 24;\n\n uint8_t v;\n\n uint32_t cc;\n\n\n\n if (destlen == srclen) {\n\n cc = 0;\n\n } else if (destlen < srclen) {\n\n cc = 1;\n\n } else {\n\n cc = 2;\n\n }\n\n\n\n if (srclen > destlen) {\n\n srclen = destlen;\n\n }\n\n\n\n for (; destlen && srclen; src++, dest++, destlen--, srclen--) {\n\n v = cpu_ldub_data_ra(env, src, ra);\n\n cpu_stb_data_ra(env, dest, v, ra);\n\n }\n\n\n\n for (; destlen; dest++, destlen--) {\n\n cpu_stb_data_ra(env, dest, pad, ra);\n\n }\n\n\n\n env->regs[r1 + 1] = destlen;\n\n /* can't use srclen here, we trunc'ed it */\n\n env->regs[r2 + 1] -= src - env->regs[r2];\n\n set_address(env, r1, dest);\n\n set_address(env, r2, src);\n\n\n\n return cc;\n\n}\n"}} {"sample_id": "2b147555f78c3c20080b201fd1506467fa0ddf43", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n \n \n+ if (!kvm_s390_supports_mem_limit(s)) {\n+\n+ return 0;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int kvm_s390_set_mem_limit(KVMState *s, uint64_t new_limit, uint64_t *hw_limit)\n\n{\n\n int rc;\n\n\n\n struct kvm_device_attr attr = {\n\n .group = KVM_S390_VM_MEM_CTRL,\n\n .attr = KVM_S390_VM_MEM_LIMIT_SIZE,\n\n .addr = (uint64_t) &new_limit,\n\n };\n\n\n\n if (!kvm_s390_supports_mem_limit(s)) {\n\n return 0;\n\n }\n\n\n\n rc = kvm_s390_query_mem_limit(s, hw_limit);\n\n if (rc) {\n\n return rc;\n\n } else if (*hw_limit < new_limit) {\n\n return -E2BIG;\n\n }\n\n\n\n return kvm_vm_ioctl(s, KVM_SET_DEVICE_ATTR, &attr);\n\n}\n"}} {"sample_id": "469f3da42ef4af347fa7831e1cc0bd35d17f5b83", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,10 +7,10 @@\n AspeedSoCClass *sc = ASPEED_SOC_CLASS(oc);\n \n \n+\n+ sc->info = (AspeedSoCInfo *) data;\n+\n+ dc->realize = aspeed_soc_realize;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void aspeed_soc_class_init(ObjectClass *oc, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(oc);\n\n AspeedSoCClass *sc = ASPEED_SOC_CLASS(oc);\n\n\n\n sc->info = (AspeedSoCInfo *) data;\n\n dc->realize = aspeed_soc_realize;\n\n\n\n}"}} {"sample_id": "7fb758cd8ed08e4a37f10e25003953d13c68b8cd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n \n \n if (INLINE_SSE2(cpu_flags) && (cpu_flags & AV_CPU_FLAG_SSE2SLOW)) {\n+\n+ c->lpc_apply_welch_window = lpc_apply_welch_window_sse2;\n+\n+ c->lpc_compute_autocorr = lpc_compute_autocorr_sse2;\n+\n }\n \n #endif /* HAVE_SSE2_INLINE */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "av_cold void ff_lpc_init_x86(LPCContext *c)\n\n{\n\n#if HAVE_SSE2_INLINE\n\n int cpu_flags = av_get_cpu_flags();\n\n\n\n if (INLINE_SSE2(cpu_flags) && (cpu_flags & AV_CPU_FLAG_SSE2SLOW)) {\n\n c->lpc_apply_welch_window = lpc_apply_welch_window_sse2;\n\n c->lpc_compute_autocorr = lpc_compute_autocorr_sse2;\n\n }\n\n#endif /* HAVE_SSE2_INLINE */\n\n}\n"}} {"sample_id": "e91171e30235ae99ab8060988aa3c9536692bba8_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n if (s->delta == 0 || s->period == 0) {\n \n+ fprintf(stderr, \"Timer with period zero, disabling\\n\");\n+\n+ s->enabled = 0;\n+\n+ return;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ptimer_reload(ptimer_state *s)\n\n{\n\n if (s->delta == 0) {\n\n ptimer_trigger(s);\n\n s->delta = s->limit;\n\n }\n\n if (s->delta == 0 || s->period == 0) {\n\n fprintf(stderr, \"Timer with period zero, disabling\\n\");\n\n s->enabled = 0;\n\n return;\n\n }\n\n\n\n s->last_event = s->next_event;\n\n s->next_event = s->last_event + s->delta * s->period;\n\n if (s->period_frac) {\n\n s->next_event += ((int64_t)s->period_frac * s->delta) >> 32;\n\n }\n\n timer_mod(s->timer, s->next_event);\n\n}\n"}} {"sample_id": "e1833e1f96456fd8fc17463246fe0b2050e68efb_21", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void spr_write_ibatu_h (void *opaque, int sprn)\n \n {\n+\n+ DisasContext *ctx = opaque;\n+\n \n \n gen_op_store_ibatu((sprn - SPR_IBAT4U) / 2);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void spr_write_ibatu_h (void *opaque, int sprn)\n\n{\n\n DisasContext *ctx = opaque;\n\n\n\n gen_op_store_ibatu((sprn - SPR_IBAT4U) / 2);\n\n RET_STOP(ctx);\n\n}\n"}} {"sample_id": "4d9ad7f793605abd9806fc932b3e04e028894565_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n uint64_t HELPER(neon_abdl_u64)(uint32_t a, uint32_t b)\n \n+{\n \n uint64_t result;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "uint64_t HELPER(neon_abdl_u64)(uint32_t a, uint32_t b)\n\n{\n\n uint64_t result;\n\n DO_ABD(result, a, b, uint32_t);\n\n return result;\n\n}\n"}} {"sample_id": "eb159d13ee36a9ef2a83e3ab66f1b2ae1cc2d9f1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static int check_opt(const CmdArgs *cmd_args, const char *name, QDict *args)\n+\n+{\n+\n+ if (!cmd_args->optional) {\n \n qerror_report(QERR_MISSING_PARAMETER, name);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int check_opt(const CmdArgs *cmd_args, const char *name, QDict *args)\n\n{\n\n if (!cmd_args->optional) {\n\n qerror_report(QERR_MISSING_PARAMETER, name);\n\n return -1;\n\n }\n\n\n\n if (cmd_args->type == '-') {\n\n /* handlers expect a value, they need to be changed */\n\n qdict_put(args, name, qint_from_int(0));\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "966439a67830239a6c520c5df6c55627b8153c8b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void OPPROTO op_set_Rc0 (void)\n+\n {\n \n env->crf[0] = T0 | xer_ov;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void OPPROTO op_set_Rc0 (void)\n\n{\n\n env->crf[0] = T0 | xer_ov;\n\n RETURN();\n\n}\n"}} {"sample_id": "5fb6c7a8b26eab1a22207d24b4784bd2b39ab54b_15", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n \n \n #if defined(_VNC_DEBUG) && _VNC_DEBUG >= 2\n+\n+ gnutls_global_set_log_level(10);\n+\n+ gnutls_global_set_log_function(vnc_debug_gnutls_log);\n+\n #endif\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int vnc_tls_initialize(void)\n\n{\n\n static int tlsinitialized = 0;\n\n\n\n if (tlsinitialized)\n\n\treturn 1;\n\n\n\n if (gnutls_global_init () < 0)\n\n\treturn 0;\n\n\n\n /* XXX ought to re-generate diffie-hellmen params periodically */\n\n if (gnutls_dh_params_init (&dh_params) < 0)\n\n\treturn 0;\n\n if (gnutls_dh_params_generate2 (dh_params, DH_BITS) < 0)\n\n\treturn 0;\n\n\n\n#if defined(_VNC_DEBUG) && _VNC_DEBUG >= 2\n\n gnutls_global_set_log_level(10);\n\n gnutls_global_set_log_function(vnc_debug_gnutls_log);\n\n#endif\n\n\n\n tlsinitialized = 1;\n\n\n\n return 1;\n\n}\n"}} {"sample_id": "e4f4fb1eca795e36f363b4647724221e774523c1_18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n \n * migration, otherwise first 24 gsi routes will be invalid.\n \n+\n+ k->post_load = ioapic_update_kvm_routes;\n+\n+ dc->reset = ioapic_reset_common;\n+\n dc->props = ioapic_properties;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void ioapic_class_init(ObjectClass *klass, void *data)\n\n{\n\n IOAPICCommonClass *k = IOAPIC_COMMON_CLASS(klass);\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n\n\n k->realize = ioapic_realize;\n\n\n * If APIC is in kernel, we need to update the kernel cache after\n\n * migration, otherwise first 24 gsi routes will be invalid.\n\n\n k->post_load = ioapic_update_kvm_routes;\n\n dc->reset = ioapic_reset_common;\n\n dc->props = ioapic_properties;\n\n\n\n\n\n\n}"}} {"sample_id": "da032427786d9db4ab21014998cb1245083d6c85_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+void checkasm_check_vf_interlace(void)\n+\n+{\n+\n+ check_lowpass_line(8);\n \n report(\"lowpass_line_8\");\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void checkasm_check_vf_interlace(void)\n\n{\n\n check_lowpass_line(8);\n\n report(\"lowpass_line_8\");\n\n\n\n check_lowpass_line(16);\n\n report(\"lowpass_line_16\");\n\n}\n"}} {"sample_id": "6da528d14de29138ca5ac43d6d059889dd24f464", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n /* XXX missing r0 handling */\n+\n+ env->cc_op = 0;\n+\n+#ifdef CONFIG_USER_ONLY\n \n memmove(g2h(r1), g2h(r2), TARGET_PAGE_SIZE);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void HELPER(mvpg)(CPUS390XState *env, uint64_t r0, uint64_t r1, uint64_t r2)\n\n{\n\n /* XXX missing r0 handling */\n\n env->cc_op = 0;\n\n#ifdef CONFIG_USER_ONLY\n\n memmove(g2h(r1), g2h(r2), TARGET_PAGE_SIZE);\n\n#else\n\n mvc_fast_memmove(env, TARGET_PAGE_SIZE, r1, r2);\n\n#endif\n\n}\n"}} {"sample_id": "95280c31cda79bb1d0968afc7b19a220b3a9d986", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n int copy_count;\n+\n uint8_t *end_ptr;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void cirrus_bitblt_cputovideo_next(CirrusVGAState * s)\n\n{\n\n int copy_count;\n\n uint8_t *end_ptr;\n\n\n\n if (s->cirrus_srccounter > 0) {\n\n if (s->cirrus_blt_mode & CIRRUS_BLTMODE_PATTERNCOPY) {\n\n cirrus_bitblt_common_patterncopy(s, s->cirrus_bltbuf);\n\n the_end:\n\n s->cirrus_srccounter = 0;\n\n cirrus_bitblt_reset(s);\n\n } else {\n\n /* at least one scan line */\n\n do {\n\n (*s->cirrus_rop)(s, s->vga.vram_ptr + s->cirrus_blt_dstaddr,\n\n s->cirrus_bltbuf, 0, 0, s->cirrus_blt_width, 1);\n\n cirrus_invalidate_region(s, s->cirrus_blt_dstaddr, 0,\n\n s->cirrus_blt_width, 1);\n\n s->cirrus_blt_dstaddr += s->cirrus_blt_dstpitch;\n\n s->cirrus_srccounter -= s->cirrus_blt_srcpitch;\n\n if (s->cirrus_srccounter <= 0)\n\n goto the_end;\n\n /* more bytes than needed can be transferred because of\n\n word alignment, so we keep them for the next line */\n\n /* XXX: keep alignment to speed up transfer */\n\n end_ptr = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;\n\n copy_count = s->cirrus_srcptr_end - end_ptr;\n\n memmove(s->cirrus_bltbuf, end_ptr, copy_count);\n\n s->cirrus_srcptr = s->cirrus_bltbuf + copy_count;\n\n s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;\n\n } while (s->cirrus_srcptr >= s->cirrus_srcptr_end);\n\n }\n\n }\n\n}\n"}} {"sample_id": "ad96090a01d848df67d70c5259ed8aa321fa8716", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n return last_ram_offset;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint64_t ram_bytes_total(void)\n\n{\n\n return last_ram_offset;\n\n}\n"}} {"sample_id": "7f526efd17973ec6d2204f7a47b6923e2be31363_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+void rgb15tobgr16(const uint8_t *src, uint8_t *dst, unsigned int src_size)\n+\n+{\n \n \tunsigned i;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void rgb15tobgr16(const uint8_t *src, uint8_t *dst, unsigned int src_size)\n\n{\n\n\tunsigned i;\n\n\tunsigned num_pixels = src_size >> 1;\n\n\t\n\n\tfor(i=0; i>5;\n\n\t b = (rgb&0x7C00)>>10;\n\n\t dst[2*i] = (b&0x1F) | ((g&0x3F)<<5) | ((r&0x1F)<<11);\n\n\t}\n\n}\n"}} {"sample_id": "e6a3ee5f7981e7df40aa581ebc245fd0a7d3bed0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n #ifdef TARGET_ABI32\n \n+ case CTLTYPE_LONG:\n+\n+ case CTLTYPE_ULONG:\n+\n+ *(uint32_t *)holdp = tswap32(*(long *)holdp);\n \n break;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int sysctl_oldcvt(void *holdp, size_t holdlen, uint32_t kind)\n\n{\n\n switch (kind & CTLTYPE) {\n\n case CTLTYPE_INT:\n\n case CTLTYPE_UINT:\n\n *(uint32_t *)holdp = tswap32(*(uint32_t *)holdp);\n\n break;\n\n#ifdef TARGET_ABI32\n\n case CTLTYPE_LONG:\n\n case CTLTYPE_ULONG:\n\n *(uint32_t *)holdp = tswap32(*(long *)holdp);\n\n break;\n\n#else\n\n case CTLTYPE_LONG:\n\n *(uint64_t *)holdp = tswap64(*(long *)holdp);\n\n case CTLTYPE_ULONG:\n\n *(uint64_t *)holdp = tswap64(*(unsigned long *)holdp);\n\n break;\n\n#endif\n\n#if !defined(__FreeBSD_version) || __FreeBSD_version < 900031\n\n case CTLTYPE_QUAD:\n\n#else\n\n case CTLTYPE_U64:\n\n#endif\n\n *(uint64_t *)holdp = tswap64(*(uint64_t *)holdp);\n\n break;\n\n case CTLTYPE_STRING:\n\n break;\n\n default:\n\n /* XXX unhandled */\n\n return -1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_76", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n \n \n+ if (offset < 0x40) {\n+\n+ arm_timer_write(s->timer[1], offset - 0x20, value);\n+\n+ return;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void sp804_write(void *opaque, target_phys_addr_t offset,\n\n uint64_t value, unsigned size)\n\n{\n\n sp804_state *s = (sp804_state *)opaque;\n\n\n\n if (offset < 0x20) {\n\n arm_timer_write(s->timer[0], offset, value);\n\n return;\n\n }\n\n\n\n if (offset < 0x40) {\n\n arm_timer_write(s->timer[1], offset - 0x20, value);\n\n return;\n\n }\n\n\n\n /* Technically we could be writing to the Test Registers, but not likely */\n\n hw_error(\"%s: Bad offset %x\\n\", __func__, (int)offset);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n switch (addr) {\n \n+ case R_SR:\n+\n+ case R_CR:\n+\n+ case R_PERIOD:\n \n r = s->regs[addr];\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t timer_read(void *opaque, target_phys_addr_t addr, unsigned size)\n\n{\n\n LM32TimerState *s = opaque;\n\n uint32_t r = 0;\n\n\n\n addr >>= 2;\n\n switch (addr) {\n\n case R_SR:\n\n case R_CR:\n\n case R_PERIOD:\n\n r = s->regs[addr];\n\n break;\n\n case R_SNAPSHOT:\n\n r = (uint32_t)ptimer_get_count(s->ptimer);\n\n break;\n\n default:\n\n error_report(\"lm32_timer: read access to unknown register 0x\"\n\n TARGET_FMT_plx, addr << 2);\n\n break;\n\n }\n\n\n\n trace_lm32_timer_memory_read(addr << 2, r);\n\n return r;\n\n}\n"}} {"sample_id": "631c56a8e46dea41585f3e7b3ef9c52b49faa385_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n int avformat_network_deinit(void)\n \n+{\n+\n+#if CONFIG_NETWORK\n+\n ff_network_close();\n \n ff_tls_deinit();", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int avformat_network_deinit(void)\n\n{\n\n#if CONFIG_NETWORK\n\n ff_network_close();\n\n ff_tls_deinit();\n\n ff_network_inited_globally = 0;\n\n#endif\n\n return 0;\n\n}\n"}} {"sample_id": "bda1c56c474c137957c261dcf9df4fd3232a8b43", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n if( tc0[i] < 0 ) {\n \n pix += 4*ystride;\n+\n+ continue;\n+\n+ }\n+\n for( d = 0; d < 4; d++ ) {\n \n const int p0 = pix[-1*xstride];", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void h264_loop_filter_luma_c(uint8_t *pix, int xstride, int ystride, int alpha, int beta, int *tc0)\n\n{\n\n int i, d;\n\n for( i = 0; i < 4; i++ ) {\n\n if( tc0[i] < 0 ) {\n\n pix += 4*ystride;\n\n continue;\n\n }\n\n for( d = 0; d < 4; d++ ) {\n\n const int p0 = pix[-1*xstride];\n\n const int p1 = pix[-2*xstride];\n\n const int p2 = pix[-3*xstride];\n\n const int q0 = pix[0];\n\n const int q1 = pix[1*xstride];\n\n const int q2 = pix[2*xstride];\n\n \n\n if( ABS( p0 - q0 ) < alpha &&\n\n ABS( p1 - p0 ) < beta &&\n\n ABS( q1 - q0 ) < beta ) {\n\n \n\n int tc = tc0[i];\n\n int i_delta;\n\n \n\n if( ABS( p2 - p0 ) < beta ) {\n\n pix[-2*xstride] = p1 + clip( ( p2 + ( ( p0 + q0 + 1 ) >> 1 ) - ( p1 << 1 ) ) >> 1, -tc0[i], tc0[i] );\n\n tc++;\n\n }\n\n if( ABS( q2 - q0 ) < beta ) {\n\n pix[xstride] = q1 + clip( ( q2 + ( ( p0 + q0 + 1 ) >> 1 ) - ( q1 << 1 ) ) >> 1, -tc0[i], tc0[i] );\n\n tc++;\n\n }\n\n \n\n i_delta = clip( (((q0 - p0 ) << 2) + (p1 - q1) + 4) >> 3, -tc, tc );\n\n pix[-xstride] = clip_uint8( p0 + i_delta ); /* p0' */\n\n pix[0] = clip_uint8( q0 - i_delta ); /* q0' */\n\n }\n\n pix += ystride;\n\n }\n\n }\n\n}\n"}} {"sample_id": "5eafc8b46644764f8aef1b7b2ecae53ee8034822", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void release_delayed_buffers(PerThreadContext *p)\n \n {\n+\n FrameThreadContext *fctx = p->parent;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void release_delayed_buffers(PerThreadContext *p)\n\n{\n\n FrameThreadContext *fctx = p->parent;\n\n\n\n while (p->num_released_buffers > 0) {\n\n AVFrame *f = &p->released_buffers[--p->num_released_buffers];\n\n\n\n pthread_mutex_lock(&fctx->buffer_mutex);\n\n free_progress(f);\n\n f->thread_opaque = NULL;\n\n\n\n f->owner->release_buffer(f->owner, f);\n\n pthread_mutex_unlock(&fctx->buffer_mutex);\n\n }\n\n}\n"}} {"sample_id": "20c86571ccc71412781d4a4813e4693e0c42aec6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+int av_buffersink_get_frame(AVFilterContext *ctx, AVFrame *frame)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int av_buffersink_get_frame(AVFilterContext *ctx, AVFrame *frame)\n\n{\n\n BufferSinkContext *s = ctx->priv;\n\n AVFilterLink *link = ctx->inputs[0];\n\n int ret;\n\n\n\n if ((ret = ff_request_frame(link)) < 0)\n\n return ret;\n\n\n\n if (!s->cur_frame)\n\n return AVERROR(EINVAL);\n\n\n\n av_frame_move_ref(frame, s->cur_frame);\n\n av_frame_free(&s->cur_frame);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "b02ef3d92b19ad304a84433d3817f0903296ebc7_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,11 +34,11 @@\n \n + SCLP_STARTING_SUBINCREMENT_ID;\n \n+ for (i = 0; i < assigned; i++) {\n+\n+ attach_info->entries[i] = cpu_to_be32(subincrement_id);\n+\n+ subincrement_id += SCLP_INCREMENT_UNIT;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void attach_storage_element(SCLPDevice *sclp, SCCB *sccb,\n\n uint16_t element)\n\n{\n\n int i, assigned, subincrement_id;\n\n AttachStorageElement *attach_info = (AttachStorageElement *) sccb;\n\n sclpMemoryHotplugDev *mhd = get_sclp_memory_hotplug_dev();\n\n\n\n assert(mhd);\n\n\n\n if (element != 1) {\n\n sccb->h.response_code = cpu_to_be16(SCLP_RC_INVALID_SCLP_COMMAND);\n\n return;\n\n }\n\n\n\n assigned = mhd->standby_mem_size >> mhd->increment_size;\n\n attach_info->assigned = cpu_to_be16(assigned);\n\n subincrement_id = ((ram_size >> mhd->increment_size) << 16)\n\n + SCLP_STARTING_SUBINCREMENT_ID;\n\n for (i = 0; i < assigned; i++) {\n\n attach_info->entries[i] = cpu_to_be32(subincrement_id);\n\n subincrement_id += SCLP_INCREMENT_UNIT;\n\n }\n\n sccb->h.response_code = cpu_to_be16(SCLP_RC_NORMAL_COMPLETION);\n\n}\n"}} {"sample_id": "4aca716a531b0bc1f05c96209cf30577d6e48baa", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n static int scale_vector(int16_t *vector, int length)\n \n+{\n \n+ int bits, max = 0;\n+\n int64_t scale;\n \n+ int i;\n \n+\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int scale_vector(int16_t *vector, int length)\n\n{\n\n int bits, max = 0;\n\n int64_t scale;\n\n int i;\n\n\n\n\n\n for (i = 0; i < length; i++)\n\n max = FFMAX(max, FFABS(vector[i]));\n\n\n\n max = FFMIN(max, 0x7FFF);\n\n bits = normalize_bits(max, 15);\n\n scale = (bits == 15) ? 0x7FFF : (1 << bits);\n\n\n\n for (i = 0; i < length; i++)\n\n vector[i] = av_clipl_int32(vector[i] * scale << 1) >> 4;\n\n\n\n return bits - 3;\n\n}\n"}} {"sample_id": "c42a1388a6d1bfd8001bf6a4241d8ca27e49326d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n {\n \n+ AVCodecParameters *par = stream->codecpar;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int sdp_parse_fmtp_config_h264(AVFormatContext *s,\n\n AVStream *stream,\n\n PayloadContext *h264_data,\n\n const char *attr, const char *value)\n\n{\n\n AVCodecParameters *par = stream->codecpar;\n\n\n\n if (!strcmp(attr, \"packetization-mode\")) {\n\n av_log(s, AV_LOG_DEBUG, \"RTP Packetization Mode: %d\\n\", atoi(value));\n\n h264_data->packetization_mode = atoi(value);\n\n /*\n\n * Packetization Mode:\n\n * 0 or not present: Single NAL mode (Only nals from 1-23 are allowed)\n\n * 1: Non-interleaved Mode: 1-23, 24 (STAP-A), 28 (FU-A) are allowed.\n\n * 2: Interleaved Mode: 25 (STAP-B), 26 (MTAP16), 27 (MTAP24), 28 (FU-A),\n\n * and 29 (FU-B) are allowed.\n\n */\n\n if (h264_data->packetization_mode > 1)\n\n av_log(s, AV_LOG_ERROR,\n\n \"Interleaved RTP mode is not supported yet.\\n\");\n\n } else if (!strcmp(attr, \"profile-level-id\")) {\n\n if (strlen(value) == 6)\n\n parse_profile_level_id(s, h264_data, value);\n\n } else if (!strcmp(attr, \"sprop-parameter-sets\")) {\n\n int ret;\n\n if (value[strlen(value) - 1] == ',') {\n\n av_log(s, AV_LOG_WARNING, \"Missing PPS in sprop-parameter-sets, ignoring\\n\");\n\n return 0;\n\n }\n\n par->extradata_size = 0;\n\n av_freep(&par->extradata);\n\n ret = ff_h264_parse_sprop_parameter_sets(s, &par->extradata,\n\n &par->extradata_size, value);\n\n av_log(s, AV_LOG_DEBUG, \"Extradata set to %p (size: %d)\\n\",\n\n par->extradata, par->extradata_size);\n\n return ret;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "6bd79ba59f46a8b3133f28faae53b75540469803", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n uint8_t *base_lag_int, int subframe, enum Mode mode)\n \n+{\n \n if (subframe == 0 || (subframe == 2 && mode != MODE_6k60)) {\n \n@@ -10,7 +10,7 @@\n \n *lag_int = (pitch_index + 69) >> 1;\n \n+ *lag_frac = (pitch_index - (*lag_int << 1) + 68) << 1;\n \n } else {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void decode_pitch_lag_low(int *lag_int, int *lag_frac, int pitch_index,\n\n uint8_t *base_lag_int, int subframe, enum Mode mode)\n\n{\n\n if (subframe == 0 || (subframe == 2 && mode != MODE_6k60)) {\n\n if (pitch_index < 116) {\n\n *lag_int = (pitch_index + 69) >> 1;\n\n *lag_frac = (pitch_index - (*lag_int << 1) + 68) << 1;\n\n } else {\n\n *lag_int = pitch_index - 24;\n\n *lag_frac = 0;\n\n }\n\n // XXX: same problem as before\n\n *base_lag_int = av_clip(*lag_int - 8 - (*lag_frac < 0),\n\n AMRWB_P_DELAY_MIN, AMRWB_P_DELAY_MAX - 15);\n\n } else {\n\n *lag_int = (pitch_index + 1) >> 1;\n\n *lag_frac = (pitch_index - (*lag_int << 1)) << 1;\n\n *lag_int += *base_lag_int;\n\n }\n\n}\n"}} {"sample_id": "2bed1ba77fae50bc8b5e68ede2d80b652b30c3b8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n }\n \n+ } else if (object_dynamic_cast(OBJECT(dev), TYPE_PCI_DEVICE)) {\n+\n+ if (!xen_enabled()) {\n+\n+ acpi_pcihp_device_plug_cb(hotplug_dev, &s->acpi_pci_hotplug, dev,\n \n errp);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void piix4_device_plug_cb(HotplugHandler *hotplug_dev,\n\n DeviceState *dev, Error **errp)\n\n{\n\n PIIX4PMState *s = PIIX4_PM(hotplug_dev);\n\n\n\n if (s->acpi_memory_hotplug.is_enabled &&\n\n object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {\n\n if (object_dynamic_cast(OBJECT(dev), TYPE_NVDIMM)) {\n\n nvdimm_acpi_plug_cb(hotplug_dev, dev);\n\n } else {\n\n acpi_memory_plug_cb(hotplug_dev, &s->acpi_memory_hotplug,\n\n dev, errp);\n\n }\n\n } else if (object_dynamic_cast(OBJECT(dev), TYPE_PCI_DEVICE)) {\n\n if (!xen_enabled()) {\n\n acpi_pcihp_device_plug_cb(hotplug_dev, &s->acpi_pci_hotplug, dev,\n\n errp);\n\n }\n\n } else if (object_dynamic_cast(OBJECT(dev), TYPE_CPU)) {\n\n if (s->cpu_hotplug_legacy) {\n\n legacy_acpi_cpu_plug_cb(hotplug_dev, &s->gpe_cpu, dev, errp);\n\n } else {\n\n acpi_cpu_plug_cb(hotplug_dev, &s->cpuhp_state, dev, errp);\n\n }\n\n } else {\n\n error_setg(errp, \"acpi: device plug request for not supported device\"\n\n \" type: %s\", object_get_typename(OBJECT(dev)));\n\n }\n\n}\n"}} {"sample_id": "ce87711df563a9d2d0537a062b86bb91b15ea1a0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n for (i = 0; i < entries; i++) {\n \n+ if ((ret = exif_decode_tag(avctx, gbytes, le, depth, metadata)) < 0) {\n+\n+ return ret;\n+\n+ }\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int avpriv_exif_decode_ifd(AVCodecContext *avctx, GetByteContext *gbytes, int le,\n\n int depth, AVDictionary **metadata)\n\n{\n\n int i, ret;\n\n int entries;\n\n\n\n entries = ff_tget_short(gbytes, le);\n\n\n\n if (bytestream2_get_bytes_left(gbytes) < entries * 12) {\n\n return AVERROR_INVALIDDATA;\n\n }\n\n\n\n for (i = 0; i < entries; i++) {\n\n if ((ret = exif_decode_tag(avctx, gbytes, le, depth, metadata)) < 0) {\n\n return ret;\n\n }\n\n }\n\n\n\n // return next IDF offset or 0x000000000 or a value < 0 for failure\n\n return ff_tget_long(gbytes, le);\n\n}\n"}} {"sample_id": "34bc07c5282a631c2663ae1ded0a186f46f64612", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static void increase_dynamic_storage(IVShmemState *s, int new_min_size) {\n \n \n+\n int j, old_nb_alloc;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void increase_dynamic_storage(IVShmemState *s, int new_min_size) {\n\n\n\n int j, old_nb_alloc;\n\n\n\n old_nb_alloc = s->nb_peers;\n\n\n\n while (new_min_size >= s->nb_peers)\n\n s->nb_peers = s->nb_peers * 2;\n\n\n\n IVSHMEM_DPRINTF(\"bumping storage to %d guests\\n\", s->nb_peers);\n\n s->peers = g_realloc(s->peers, s->nb_peers * sizeof(Peer));\n\n\n\n /* zero out new pointers */\n\n for (j = old_nb_alloc; j < s->nb_peers; j++) {\n\n s->peers[j].eventfds = NULL;\n\n s->peers[j].nb_eventfds = 0;\n\n }\n\n}\n"}} {"sample_id": "8786db7cb96f8ce5c75c6e1e074319c9dca8d356_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n FlatRange *fr;\n \n+ unsigned ioeventfd_nb = 0;\n \n MemoryRegionIoeventfd *ioeventfds = NULL;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void address_space_update_ioeventfds(AddressSpace *as)\n\n{\n\n FlatRange *fr;\n\n unsigned ioeventfd_nb = 0;\n\n MemoryRegionIoeventfd *ioeventfds = NULL;\n\n AddrRange tmp;\n\n unsigned i;\n\n\n\n FOR_EACH_FLAT_RANGE(fr, &as->current_map) {\n\n for (i = 0; i < fr->mr->ioeventfd_nb; ++i) {\n\n tmp = addrrange_shift(fr->mr->ioeventfds[i].addr,\n\n int128_sub(fr->addr.start,\n\n int128_make64(fr->offset_in_region)));\n\n if (addrrange_intersects(fr->addr, tmp)) {\n\n ++ioeventfd_nb;\n\n ioeventfds = g_realloc(ioeventfds,\n\n ioeventfd_nb * sizeof(*ioeventfds));\n\n ioeventfds[ioeventfd_nb-1] = fr->mr->ioeventfds[i];\n\n ioeventfds[ioeventfd_nb-1].addr = tmp;\n\n }\n\n }\n\n }\n\n\n\n address_space_add_del_ioeventfds(as, ioeventfds, ioeventfd_nb,\n\n as->ioeventfds, as->ioeventfd_nb);\n\n\n\n g_free(as->ioeventfds);\n\n as->ioeventfds = ioeventfds;\n\n as->ioeventfd_nb = ioeventfd_nb;\n\n}\n"}} {"sample_id": "aade9884e95c6f6da5a856da95501bc14a6225aa", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,9 +13,9 @@\n apad->whole_len -= frame->nb_samples;\n \n \n+\n+ apad->next_pts = frame->pts + av_rescale_q(frame->nb_samples, (AVRational){1, inlink->sample_rate}, inlink->time_base);\n+\n+ return ff_filter_frame(ctx->outputs[0], frame);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int filter_frame(AVFilterLink *inlink, AVFrame *frame)\n\n{\n\n AVFilterContext *ctx = inlink->dst;\n\n APadContext *apad = ctx->priv;\n\n\n\n if (apad->whole_len)\n\n apad->whole_len -= frame->nb_samples;\n\n\n\n apad->next_pts = frame->pts + av_rescale_q(frame->nb_samples, (AVRational){1, inlink->sample_rate}, inlink->time_base);\n\n return ff_filter_frame(ctx->outputs[0], frame);\n\n}\n"}} {"sample_id": "786a4ea82ec9c87e3a895cf41081029b285a5fe5_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ uint8_t *status = shpc->config + SHPC_SLOT_STATUS(slot);\n+\n return (pci_get_word(status) & msk) >> (ffs(msk) - 1);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint16_t shpc_get_status(SHPCDevice *shpc, int slot, uint16_t msk)\n\n{\n\n uint8_t *status = shpc->config + SHPC_SLOT_STATUS(slot);\n\n return (pci_get_word(status) & msk) >> (ffs(msk) - 1);\n\n}\n"}} {"sample_id": "dd84efe3c76a5ebf3db254b02870edd193d1a1e7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ int sh, sm, ss, sc, eh, em, es, ec;\n+\n uint64_t start, end;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int ass_get_duration(const uint8_t *p)\n\n{\n\n int sh, sm, ss, sc, eh, em, es, ec;\n\n uint64_t start, end;\n\n\n\n if (sscanf(p, \"%*[^,],%d:%d:%d%*c%d,%d:%d:%d%*c%d\",\n\n &sh, &sm, &ss, &sc, &eh, &em, &es, &ec) != 8)\n\n return 0;\n\n start = 3600000*sh + 60000*sm + 1000*ss + 10*sc;\n\n end = 3600000*eh + 60000*em + 1000*es + 10*ec;\n\n return end - start;\n\n}\n"}} {"sample_id": "ad02b96ad86baf6dd72a43b04876b2d6ea957112", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,9 +9,9 @@\n }\n \n if (qemu_put_kbd_event) {\n+\n+ qemu_put_kbd_event(qemu_put_kbd_event_opaque, keycode);\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void kbd_put_keycode(int keycode)\n\n{\n\n if (!runstate_is_running()) {\n\n return;\n\n }\n\n if (qemu_put_kbd_event) {\n\n qemu_put_kbd_event(qemu_put_kbd_event_opaque, keycode);\n\n }\n\n}\n"}} {"sample_id": "089fac77a6bf9199a5ec161e9c27850f0a680541", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n \n if (ff_alsa_xrun_recover(s1, res) < 0) {\n \n+ av_log(s1, AV_LOG_ERROR, \"ALSA read error: %s\\n\",\n+\n+ snd_strerror(res));\n+\n+ av_free_packet(pkt);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int audio_read_packet(AVFormatContext *s1, AVPacket *pkt)\n\n{\n\n AlsaData *s = s1->priv_data;\n\n AVStream *st = s1->streams[0];\n\n int res;\n\n snd_htimestamp_t timestamp;\n\n snd_pcm_uframes_t ts_delay;\n\n\n\n if (av_new_packet(pkt, s->period_size) < 0) {\n\n return AVERROR(EIO);\n\n }\n\n\n\n while ((res = snd_pcm_readi(s->h, pkt->data, pkt->size / s->frame_size)) < 0) {\n\n if (res == -EAGAIN) {\n\n av_free_packet(pkt);\n\n\n\n return AVERROR(EAGAIN);\n\n }\n\n if (ff_alsa_xrun_recover(s1, res) < 0) {\n\n av_log(s1, AV_LOG_ERROR, \"ALSA read error: %s\\n\",\n\n snd_strerror(res));\n\n av_free_packet(pkt);\n\n\n\n return AVERROR(EIO);\n\n }\n\n }\n\n\n\n snd_pcm_htimestamp(s->h, &ts_delay, ×tamp);\n\n ts_delay += res;\n\n pkt->pts = timestamp.tv_sec * 1000000LL\n\n + (timestamp.tv_nsec * st->codec->sample_rate\n\n - ts_delay * 1000000000LL + st->codec->sample_rate * 500LL)\n\n / (st->codec->sample_rate * 1000LL);\n\n\n\n pkt->size = res * s->frame_size;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "4fc9af53d88c0a2a810704a06cb39a7182982e4e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n /* XXX: we assume that nb_sectors == 0 is suppored by the async read */\n \n if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {\n+\n+ memcpy(buf, bs->boot_sector_data, 512);\n+\n+ sector_num++;\n+\n nb_sectors--;\n \n buf += 512;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "BlockDriverAIOCB *bdrv_aio_read(BlockDriverState *bs, int64_t sector_num,\n\n uint8_t *buf, int nb_sectors,\n\n BlockDriverCompletionFunc *cb, void *opaque)\n\n{\n\n BlockDriver *drv = bs->drv;\n\n BlockDriverAIOCB *ret;\n\n\n\n if (!drv)\n\n return NULL;\n\n\n\n /* XXX: we assume that nb_sectors == 0 is suppored by the async read */\n\n if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {\n\n memcpy(buf, bs->boot_sector_data, 512);\n\n sector_num++;\n\n nb_sectors--;\n\n buf += 512;\n\n }\n\n\n\n ret = drv->bdrv_aio_read(bs, sector_num, buf, nb_sectors, cb, opaque);\n\n\n\n if (ret) {\n\n\t/* Update stats even though technically transfer has not happened. */\n\n\tbs->rd_bytes += (unsigned) nb_sectors * SECTOR_SIZE;\n\n\tbs->rd_ops ++;\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "a4d18a3f54e5b0277234d8fcff65dff8516417a0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,10 +2,10 @@\n \n {\n \n+ AVFilterContext *ctx = fs->parent;\n \n LUT2Context *s = fs->opaque;\n+\n AVFilterLink *outlink = ctx->outputs[0];\n \n AVFrame *out, *srcx, *srcy;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int process_frame(FFFrameSync *fs)\n\n{\n\n AVFilterContext *ctx = fs->parent;\n\n LUT2Context *s = fs->opaque;\n\n AVFilterLink *outlink = ctx->outputs[0];\n\n AVFrame *out, *srcx, *srcy;\n\n int ret;\n\n\n\n if ((ret = ff_framesync2_get_frame(&s->fs, 0, &srcx, 0)) < 0 ||\n\n (ret = ff_framesync2_get_frame(&s->fs, 1, &srcy, 0)) < 0)\n\n return ret;\n\n\n\n if (ctx->is_disabled) {\n\n out = av_frame_clone(srcx);\n\n if (!out)\n\n return AVERROR(ENOMEM);\n\n } else {\n\n out = ff_get_video_buffer(outlink, outlink->w, outlink->h);\n\n if (!out)\n\n return AVERROR(ENOMEM);\n\n av_frame_copy_props(out, srcx);\n\n\n\n s->lut2(s, out, srcx, srcy);\n\n }\n\n\n\n out->pts = av_rescale_q(s->fs.pts, s->fs.time_base, outlink->time_base);\n\n\n\n return ff_filter_frame(outlink, out);\n\n}\n"}} {"sample_id": "2578a546183da09d49d5bba8ab5e982dece1dede", "diff": "--- a/source.c\n+++ b/source.c\n@@ -46,8 +46,8 @@\n \n }\n \n+\n+\n+ put_bits(&s->pb, 3, 0); /* ignored */\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_rv10_encode_picture_header(MpegEncContext *s, int picture_number)\n\n{\n\n int full_frame= 0;\n\n\n\n avpriv_align_put_bits(&s->pb);\n\n\n\n put_bits(&s->pb, 1, 1); /* marker */\n\n\n\n put_bits(&s->pb, 1, (s->pict_type == AV_PICTURE_TYPE_P));\n\n\n\n put_bits(&s->pb, 1, 0); /* not PB frame */\n\n\n\n put_bits(&s->pb, 5, s->qscale);\n\n\n\n if (s->pict_type == AV_PICTURE_TYPE_I) {\n\n /* specific MPEG like DC coding not used */\n\n }\n\n /* if multiple packets per frame are sent, the position at which\n\n to display the macroblocks is coded here */\n\n if(!full_frame){\n\n put_bits(&s->pb, 6, 0); /* mb_x */\n\n put_bits(&s->pb, 6, 0); /* mb_y */\n\n put_bits(&s->pb, 12, s->mb_width * s->mb_height);\n\n }\n\n\n\n put_bits(&s->pb, 3, 0); /* ignored */\n\n}\n"}} {"sample_id": "9487fb4dea3498eb4711eb023f43199f68701b1e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n *abuf1 = hasAlpha ? abuf[1] : NULL;\n int yalpha1 = 4095 - yalpha;\n int uvalpha1 = 4095 - uvalpha;\n+ int i;\n+ for (i = 0; i < (dstW >> 1); i++) {\n+ int Y1 = (buf0[i * 2] * yalpha1 + buf1[i * 2] * yalpha) >> 19;\n+ int Y2 = (buf0[i * 2 + 1] * yalpha1 + buf1[i * 2 + 1] * yalpha) >> 19;\n+ int U = (ubuf0[i] * uvalpha1 + ubuf1[i] * uvalpha) >> 19;\n int V = (vbuf0[i] * uvalpha1 + vbuf1[i] * uvalpha) >> 19;\n int A1, A2;\n const void *r = c->table_rV[V],", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "yuv2rgb_2_c_template(SwsContext *c, const int16_t *buf[2],\n const int16_t *ubuf[2], const int16_t *vbuf[2],\n const int16_t *abuf[2], uint8_t *dest, int dstW,\n int yalpha, int uvalpha, int y,\n enum PixelFormat target, int hasAlpha)\n{\n const int16_t *buf0 = buf[0], *buf1 = buf[1],\n *ubuf0 = ubuf[0], *ubuf1 = ubuf[1],\n *vbuf0 = vbuf[0], *vbuf1 = vbuf[1],\n *abuf0 = hasAlpha ? abuf[0] : NULL,\n *abuf1 = hasAlpha ? abuf[1] : NULL;\n int yalpha1 = 4095 - yalpha;\n int uvalpha1 = 4095 - uvalpha;\n int i;\n for (i = 0; i < (dstW >> 1); i++) {\n int Y1 = (buf0[i * 2] * yalpha1 + buf1[i * 2] * yalpha) >> 19;\n int Y2 = (buf0[i * 2 + 1] * yalpha1 + buf1[i * 2 + 1] * yalpha) >> 19;\n int U = (ubuf0[i] * uvalpha1 + ubuf1[i] * uvalpha) >> 19;\n int V = (vbuf0[i] * uvalpha1 + vbuf1[i] * uvalpha) >> 19;\n int A1, A2;\n const void *r = c->table_rV[V],\n *g = (c->table_gU[U] + c->table_gV[V]),\n *b = c->table_bU[U];\n if (hasAlpha) {\n A1 = (abuf0[i * 2 ] * yalpha1 + abuf1[i * 2 ] * yalpha) >> 19;\n A2 = (abuf0[i * 2 + 1] * yalpha1 + abuf1[i * 2 + 1] * yalpha) >> 19;\n }\n yuv2rgb_write(dest, i, Y1, Y2, hasAlpha ? A1 : 0, hasAlpha ? A2 : 0,\n r, g, b, y, target, hasAlpha);\n }\n}"}} {"sample_id": "4d9ad7f793605abd9806fc932b3e04e028894565_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n uint64_t HELPER(neon_abdl_u32)(uint32_t a, uint32_t b)\n \n {\n+\n+ uint64_t tmp;\n \n uint64_t result;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "uint64_t HELPER(neon_abdl_u32)(uint32_t a, uint32_t b)\n\n{\n\n uint64_t tmp;\n\n uint64_t result;\n\n DO_ABD(result, a, b, uint16_t);\n\n DO_ABD(tmp, a >> 16, b >> 16, uint16_t);\n\n return result | (tmp << 32);\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_43", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void qvirtio_pci_device_disable(QVirtioPCIDevice *d)\n+\n+{\n \n qpci_iounmap(d->pdev, d->addr);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void qvirtio_pci_device_disable(QVirtioPCIDevice *d)\n\n{\n\n qpci_iounmap(d->pdev, d->addr);\n\n d->addr = NULL;\n\n}\n"}} {"sample_id": "35c2c8dc8c0899882a8e0d349d93bd657772f1e7_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n const char *qemu_get_version(void)\n+\n {\n \n return qemu_version;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "const char *qemu_get_version(void)\n\n{\n\n return qemu_version;\n\n}\n"}} {"sample_id": "027d9a7d2911e993cdcbd21c7c35d1dd058f05bb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void cpu_exit(CPUState *cpu)\n+\n {\n+\n cpu->exit_request = 1;\n \n /* Ensure cpu_exec will see the exit request after TCG has exited. */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void cpu_exit(CPUState *cpu)\n\n{\n\n cpu->exit_request = 1;\n\n /* Ensure cpu_exec will see the exit request after TCG has exited. */\n\n smp_wmb();\n\n cpu->tcg_exit_req = 1;\n\n}\n"}} {"sample_id": "79b78a6bd47722ce23bc74287cd6322756698f09", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void spapr_add_lmbs(DeviceState *dev, uint64_t addr, uint64_t size,\n \n uint32_t node, Error **errp)\n \n@@ -14,7 +14,7 @@\n \n void *fdt;\n \n+\n \n for (i = 0; i < nr_lmbs; i++) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void spapr_add_lmbs(DeviceState *dev, uint64_t addr, uint64_t size,\n\n uint32_t node, Error **errp)\n\n{\n\n sPAPRDRConnector *drc;\n\n sPAPRDRConnectorClass *drck;\n\n uint32_t nr_lmbs = size/SPAPR_MEMORY_BLOCK_SIZE;\n\n int i, fdt_offset, fdt_size;\n\n void *fdt;\n\n\n\n for (i = 0; i < nr_lmbs; i++) {\n\n drc = spapr_dr_connector_by_id(SPAPR_DR_CONNECTOR_TYPE_LMB,\n\n addr/SPAPR_MEMORY_BLOCK_SIZE);\n\n g_assert(drc);\n\n\n\n fdt = create_device_tree(&fdt_size);\n\n fdt_offset = spapr_populate_memory_node(fdt, node, addr,\n\n SPAPR_MEMORY_BLOCK_SIZE);\n\n\n\n drck = SPAPR_DR_CONNECTOR_GET_CLASS(drc);\n\n drck->attach(drc, dev, fdt, fdt_offset, !dev->hotplugged, errp);\n\n addr += SPAPR_MEMORY_BLOCK_SIZE;\n\n }\n\n /* send hotplug notification to the\n\n * guest only in case of hotplugged memory\n\n */\n\n if (dev->hotplugged) {\n\n spapr_hotplug_req_add_by_count(SPAPR_DR_CONNECTOR_TYPE_LMB, nr_lmbs);\n\n }\n\n}\n"}} {"sample_id": "83898cce62ba25a473af6a164388105994481e9c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n int boot_sector_init(char *fname)\n \n+{\n \n int fd, ret;\n \n size_t len = sizeof boot_sector;\n \n+\n+\n fd = mkstemp(fname);\n+\n if (fd < 0) {\n \n fprintf(stderr, \"Couldn't open \\\"%s\\\": %s\", fname, strerror(errno));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int boot_sector_init(char *fname)\n\n{\n\n int fd, ret;\n\n size_t len = sizeof boot_sector;\n\n\n\n fd = mkstemp(fname);\n\n if (fd < 0) {\n\n fprintf(stderr, \"Couldn't open \\\"%s\\\": %s\", fname, strerror(errno));\n\n return 1;\n\n }\n\n\n\n /* For Open Firmware based system, we can use a Forth script instead */\n\n if (strcmp(qtest_get_arch(), \"ppc64\") == 0) {\n\n len = sprintf((char *)boot_sector, \"\\\\ Bootscript\\n%x %x c! %x %x c!\\n\",\n\n LOW(SIGNATURE), BOOT_SECTOR_ADDRESS + SIGNATURE_OFFSET,\n\n HIGH(SIGNATURE), BOOT_SECTOR_ADDRESS + SIGNATURE_OFFSET + 1);\n\n }\n\n\n\n ret = write(fd, boot_sector, len);\n\n close(fd);\n\n\n\n if (ret != len) {\n\n fprintf(stderr, \"Could not write \\\"%s\\\"\", fname);\n\n return 1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "ef4760626e88bc3e7a1b46c7370378cbd12d379f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static uint16_t eepro100_read2(EEPRO100State * s, uint32_t addr)\n+\n {\n \n uint16_t val;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static uint16_t eepro100_read2(EEPRO100State * s, uint32_t addr)\n\n{\n\n uint16_t val;\n\n if (addr <= sizeof(s->mem) - sizeof(val)) {\n\n memcpy(&val, &s->mem[addr], sizeof(val));\n\n }\n\n\n\n switch (addr) {\n\n case SCBStatus:\n\n case SCBCmd:\n\n TRACE(OTHER, logout(\"addr=%s val=0x%04x\\n\", regname(addr), val));\n\n break;\n\n case SCBeeprom:\n\n val = eepro100_read_eeprom(s);\n\n TRACE(OTHER, logout(\"addr=%s val=0x%04x\\n\", regname(addr), val));\n\n break;\n\n default:\n\n logout(\"addr=%s val=0x%04x\\n\", regname(addr), val);\n\n missing(\"unknown word read\");\n\n }\n\n return val;\n\n}\n"}} {"sample_id": "6d0b908a628a7086fa855c68b217cc1e2a5c4c19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,8 +11,8 @@\n \n \n fd_set fdset = dispr->fdset;\n+\n+\n \n /* wait until some of sockets become readable. */\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "dispatcher_wait(Dispatcher *dispr, uint32_t timeout)\n\n{\n\n struct timeval tv;\n\n tv.tv_sec = timeout / 1000000;\n\n tv.tv_usec = timeout % 1000000;\n\n\n\n fd_set fdset = dispr->fdset;\n\n\n\n /* wait until some of sockets become readable. */\n\n int rc = select(dispr->max_sock + 1, &fdset, 0, 0, &tv);\n\n\n\n if (rc == -1) {\n\n vubr_die(\"select\");\n\n }\n\n\n\n /* Timeout */\n\n if (rc == 0) {\n\n return 0;\n\n }\n\n\n\n /* Now call callback for every ready socket. */\n\n\n\n int sock;\n\n for (sock = 0; sock < dispr->max_sock + 1; sock++)\n\n if (FD_ISSET(sock, &fdset)) {\n\n Event *e = &dispr->events[sock];\n\n e->callback(sock, e->ctx);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "885b7c44e4f8b7a012a92770a0dba8b238662caa", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,20 +1,20 @@\n static void do_interrupt_user(CPUX86State *env, int intno, int is_int,\n+\n+ int error_code, target_ulong next_eip)\n+\n+{\n+\n+ SegmentCache *dt;\n+\n target_ulong ptr;\n+\n int dpl, cpl, shift;\n+\n+ uint32_t e2;\n+\n+\n+\n+ dt = &env->idt;\n \n if (env->hflags & HF_LMA_MASK) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void do_interrupt_user(CPUX86State *env, int intno, int is_int,\n\n int error_code, target_ulong next_eip)\n\n{\n\n SegmentCache *dt;\n\n target_ulong ptr;\n\n int dpl, cpl, shift;\n\n uint32_t e2;\n\n\n\n dt = &env->idt;\n\n if (env->hflags & HF_LMA_MASK) {\n\n shift = 4;\n\n } else {\n\n shift = 3;\n\n }\n\n ptr = dt->base + (intno << shift);\n\n e2 = cpu_ldl_kernel(env, ptr + 4);\n\n\n\n dpl = (e2 >> DESC_DPL_SHIFT) & 3;\n\n cpl = env->hflags & HF_CPL_MASK;\n\n /* check privilege if software int */\n\n if (is_int && dpl < cpl) {\n\n raise_exception_err(env, EXCP0D_GPF, (intno << shift) + 2);\n\n }\n\n\n\n /* Since we emulate only user space, we cannot do more than\n\n exiting the emulation with the suitable exception and error\n\n code. So update EIP for INT 0x80 and EXCP_SYSCALL. */\n\n if (is_int || intno == EXCP_SYSCALL) {\n\n env->eip = next_eip;\n\n }\n\n}\n"}} {"sample_id": "9a75b0a037e3a8030992244353f17b62f6daf2ab_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,19 +1,19 @@\n+static QPCIDevice *get_ahci_device(uint32_t *fingerprint)\n+\n+{\n+\n+ QPCIDevice *ahci;\n+\n+ uint32_t ahci_fingerprint;\n+\n+ QPCIBus *pcibus;\n+\n+\n \n+ pcibus = qpci_init_pc();\n+\n \n+\n /* Find the AHCI PCI device and verify it's the right one. */\n \n ahci = qpci_device_find(pcibus, QPCI_DEVFN(0x1F, 0x02));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static QPCIDevice *get_ahci_device(uint32_t *fingerprint)\n\n{\n\n QPCIDevice *ahci;\n\n uint32_t ahci_fingerprint;\n\n QPCIBus *pcibus;\n\n\n\n pcibus = qpci_init_pc();\n\n\n\n /* Find the AHCI PCI device and verify it's the right one. */\n\n ahci = qpci_device_find(pcibus, QPCI_DEVFN(0x1F, 0x02));\n\n g_assert(ahci != NULL);\n\n\n\n ahci_fingerprint = qpci_config_readl(ahci, PCI_VENDOR_ID);\n\n\n\n switch (ahci_fingerprint) {\n\n case AHCI_INTEL_ICH9:\n\n break;\n\n default:\n\n /* Unknown device. */\n\n g_assert_not_reached();\n\n }\n\n\n\n if (fingerprint) {\n\n *fingerprint = ahci_fingerprint;\n\n }\n\n return ahci;\n\n}\n"}} {"sample_id": "b7581b5c839d1e293bb9dc34352a76df9d3158a9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n * for(i=0 ; i> (off*8)) | (0x37c511f2 << (32-(off*8))));\n\n bytes += 3 + off;\n\n for (i = 0; i < bytes/4; i++)\n\n obuf[i] = c ^ buf[i];\n\n\n\n return off;\n\n}\n"}} {"sample_id": "7e2515e87c41e2e658aaed466e11cbdf1ea8bcb1_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int term_can_read(void *opaque)\n+\n {\n \n return 128;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int term_can_read(void *opaque)\n\n{\n\n return 128;\n\n}\n"}} {"sample_id": "2ef0f392711445e173a56b2c073dedb021ae3783", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int rac_get_model_sym(RangeCoder *c, Model *m)\n+\n {\n \n int prob, prob2, helper, val;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int rac_get_model_sym(RangeCoder *c, Model *m)\n\n{\n\n int prob, prob2, helper, val;\n\n int end, end2;\n\n\n\n prob = 0;\n\n prob2 = c->range;\n\n c->range >>= MODEL_SCALE;\n\n val = 0;\n\n end = m->num_syms >> 1;\n\n end2 = m->num_syms;\n\n do {\n\n helper = m->freqs[end] * c->range;\n\n if (helper <= c->low) {\n\n val = end;\n\n prob = helper;\n\n } else {\n\n end2 = end;\n\n prob2 = helper;\n\n }\n\n end = (end2 + val) >> 1;\n\n } while (end != val);\n\n c->low -= prob;\n\n c->range = prob2 - prob;\n\n if (c->range < RAC_BOTTOM)\n\n rac_normalise(c);\n\n\n\n model_update(m, val);\n\n\n\n return val;\n\n}\n"}} {"sample_id": "69d4c703a549f0630793a67b16a8fc6bc14c8654", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n union semun semun;\n \n+ struct semid_ds semid_ds;\n \n int i, ret;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static inline abi_long target_to_host_semarray(int semid, unsigned short **host_array,\n\n abi_ulong target_addr)\n\n{\n\n int nsems;\n\n unsigned short *array;\n\n union semun semun;\n\n struct semid_ds semid_ds;\n\n int i, ret;\n\n\n\n semun.buf = &semid_ds;\n\n\n\n ret = semctl(semid, 0, IPC_STAT, semun);\n\n if (ret == -1)\n\n return get_errno(ret);\n\n\n\n nsems = semid_ds.sem_nsems;\n\n\n\n *host_array = malloc(nsems*sizeof(unsigned short));\n\n array = lock_user(VERIFY_READ, target_addr,\n\n nsems*sizeof(unsigned short), 1);\n\n if (!array)\n\n return -TARGET_EFAULT;\n\n\n\n for(i=0; ifp_status);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "float64 helper_fitod(CPUSPARCState *env, int32_t src)\n\n{\n\n /* No possible exceptions converting int to double. */\n\n return int32_to_float64(src, &env->fp_status);\n\n}\n"}} {"sample_id": "e23a1b33b53d25510320b26d9f154e19c6c99725_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n DeviceState *dev;\n+\n SysBusDevice *s;\n \n GrackleState *d;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "PCIBus *pci_grackle_init(uint32_t base, qemu_irq *pic)\n\n{\n\n DeviceState *dev;\n\n SysBusDevice *s;\n\n GrackleState *d;\n\n\n\n dev = qdev_create(NULL, \"grackle\");\n\n qdev_init(dev);\n\n s = sysbus_from_qdev(dev);\n\n d = FROM_SYSBUS(GrackleState, s);\n\n d->host_state.bus = pci_register_bus(&d->busdev.qdev, \"pci\",\n\n pci_grackle_set_irq,\n\n pci_grackle_map_irq,\n\n pic, 0, 4);\n\n\n\n pci_create_simple(d->host_state.bus, 0, \"grackle\");\n\n\n\n sysbus_mmio_map(s, 0, base);\n\n sysbus_mmio_map(s, 1, base + 0x00200000);\n\n\n\n return d->host_state.bus;\n\n}\n"}} {"sample_id": "0b8b8753e4d94901627b3e86431230f2319215c4_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void nbd_restart_write(void *opaque)\n \n+{\n \n BlockDriverState *bs = opaque;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void nbd_restart_write(void *opaque)\n\n{\n\n BlockDriverState *bs = opaque;\n\n\n\n qemu_coroutine_enter(nbd_get_client_session(bs)->send_coroutine, NULL);\n\n}\n"}} {"sample_id": "47d4be12c3997343e436c6cca89aefbbbeb70863_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,8 +3,8 @@\n {\n \n const char *str = \"\";\n+\n+ int64_t res = 999;\n \n int err;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_qemu_strtoll_full_empty(void)\n\n{\n\n const char *str = \"\";\n\n int64_t res = 999;\n\n int err;\n\n\n\n err = qemu_strtoll(str, NULL, 0, &res);\n\n\n\n g_assert_cmpint(err, ==, 0);\n\n g_assert_cmpint(res, ==, 0);\n\n}\n"}} {"sample_id": "77c6c7369035c25d9d4babd920dbe691e3453cfc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n g_malloc0(sizeof(struct omap_gpmc_s));\n \n+\n+\n+ memory_region_init_io(&s->iomem, &omap_gpmc_ops, s, \"omap-gpmc\", 0x1000);\n+\n+ memory_region_add_subregion(get_system_memory(), base, &s->iomem);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "struct omap_gpmc_s *omap_gpmc_init(target_phys_addr_t base, qemu_irq irq)\n\n{\n\n struct omap_gpmc_s *s = (struct omap_gpmc_s *)\n\n g_malloc0(sizeof(struct omap_gpmc_s));\n\n\n\n memory_region_init_io(&s->iomem, &omap_gpmc_ops, s, \"omap-gpmc\", 0x1000);\n\n memory_region_add_subregion(get_system_memory(), base, &s->iomem);\n\n\n\n\n omap_gpmc_reset(s);\n\n\n\n return s;\n\n}"}} {"sample_id": "bdb11366b9370e97fb436444c697c01fe839dc11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,8 +20,8 @@\n \n hw_error(\"CPU can only have one NVIC\\n\");\n \n+ env->v7m.nvic = s;\n+\n+ register_savevm(\"armv7m_nvic\", -1, 1, nvic_save, nvic_load, s);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void armv7m_nvic_init(SysBusDevice *dev)\n\n{\n\n nvic_state *s= FROM_SYSBUSGIC(nvic_state, dev);\n\n CPUState *env;\n\n\n\n env = qdev_get_prop_ptr(&dev->qdev, \"cpu\");\n\n gic_init(&s->gic);\n\n cpu_register_physical_memory(0xe000e000, 0x1000, s->gic.iomemtype);\n\n s->systick.timer = qemu_new_timer(vm_clock, systick_timer_tick, s);\n\n if (env->v7m.nvic)\n\n hw_error(\"CPU can only have one NVIC\\n\");\n\n env->v7m.nvic = s;\n\n register_savevm(\"armv7m_nvic\", -1, 1, nvic_save, nvic_load, s);\n\n}\n"}} {"sample_id": "f9158b01d0f3effb58e87fb07db0382bc1e47de5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n c->factor = factor;\n c->filter_length = FFMAX((int)ceil(filter_size/factor), 1);\n c->filter_alloc = FFALIGN(c->filter_length, 8);\n+ c->filter_bank = av_calloc(c->filter_alloc, (phase_count+1)*c->felem_size);\n+ c->filter_type = filter_type;\n+ c->kaiser_beta = kaiser_beta;\n+ if (!c->filter_bank)\n+ if (build_filter(c, (void*)c->filter_bank, factor, c->filter_length, c->filter_alloc, phase_count, 1<filter_shift, filter_type, kaiser_beta))\n memcpy(c->filter_bank + (c->filter_alloc*phase_count+1)*c->felem_size, c->filter_bank, (c->filter_alloc-1)*c->felem_size);\n memcpy(c->filter_bank + (c->filter_alloc*phase_count )*c->felem_size, c->filter_bank + (c->filter_alloc - 1)*c->felem_size, c->felem_size);\n c->compensation_distance= 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static ResampleContext *resample_init(ResampleContext *c, int out_rate, int in_rate, int filter_size, int phase_shift, int linear,\n double cutoff0, enum AVSampleFormat format, enum SwrFilterType filter_type, int kaiser_beta,\n double precision, int cheby){\n double cutoff = cutoff0? cutoff0 : 0.97;\n double factor= FFMIN(out_rate * cutoff / in_rate, 1.0);\n int phase_count= 1<phase_shift != phase_shift || c->linear!=linear || c->factor != factor\n || c->filter_length != FFMAX((int)ceil(filter_size/factor), 1) || c->format != format\n || c->filter_type != filter_type || c->kaiser_beta != kaiser_beta) {\n c = av_mallocz(sizeof(*c));\n if (!c)\n return NULL;\n c->format= format;\n c->felem_size= av_get_bytes_per_sample(c->format);\n switch(c->format){\n case AV_SAMPLE_FMT_S16P:\n c->filter_shift = 15;\n break;\n case AV_SAMPLE_FMT_S32P:\n c->filter_shift = 30;\n break;\n case AV_SAMPLE_FMT_FLTP:\n case AV_SAMPLE_FMT_DBLP:\n c->filter_shift = 0;\n break;\n default:\n av_log(NULL, AV_LOG_ERROR, \"Unsupported sample format\\n\");\n av_assert0(0);\n c->phase_shift = phase_shift;\n c->phase_mask = phase_count - 1;\n c->linear = linear;\n c->factor = factor;\n c->filter_length = FFMAX((int)ceil(filter_size/factor), 1);\n c->filter_alloc = FFALIGN(c->filter_length, 8);\n c->filter_bank = av_calloc(c->filter_alloc, (phase_count+1)*c->felem_size);\n c->filter_type = filter_type;\n c->kaiser_beta = kaiser_beta;\n if (!c->filter_bank)\n if (build_filter(c, (void*)c->filter_bank, factor, c->filter_length, c->filter_alloc, phase_count, 1<filter_shift, filter_type, kaiser_beta))\n memcpy(c->filter_bank + (c->filter_alloc*phase_count+1)*c->felem_size, c->filter_bank, (c->filter_alloc-1)*c->felem_size);\n memcpy(c->filter_bank + (c->filter_alloc*phase_count )*c->felem_size, c->filter_bank + (c->filter_alloc - 1)*c->felem_size, c->felem_size);\n c->compensation_distance= 0;\n if(!av_reduce(&c->src_incr, &c->dst_incr, out_rate, in_rate * (int64_t)phase_count, INT32_MAX/2))\n c->ideal_dst_incr= c->dst_incr;\n c->index= -phase_count*((c->filter_length-1)/2);\n c->frac= 0;\n return c;\nerror:\n av_freep(&c->filter_bank);\n av_free(c);\n return NULL;"}} {"sample_id": "a84f0e8d8f293df3c535f9b893730a835bed6520", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n av_cold int ff_vp8_decode_free(AVCodecContext *avctx)\n+{\n+ VP8Context *s = avctx->priv_data;\n int i;\n vp8_decode_flush_impl(avctx, 1);\n for (i = 0; i < FF_ARRAY_ELEMS(s->frames); i++)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "av_cold int ff_vp8_decode_free(AVCodecContext *avctx)\n{\n VP8Context *s = avctx->priv_data;\n int i;\n vp8_decode_flush_impl(avctx, 1);\n for (i = 0; i < FF_ARRAY_ELEMS(s->frames); i++)\n av_frame_free(&s->frames[i].tf.f);\n}"}} {"sample_id": "cbcfa0418f0c196afa765f5c9837b9344d1adcf3_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int64_t qemu_get_clock_ns(QEMUClock *clock)\n\n{\n\n return 0;\n\n}\n"}} {"sample_id": "9ef91a677110ec200d7b2904fc4bcae5a77329ad", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n ssize_t ret = qemu_paio_return(aiocb);\n \n \n+\n+ if (ret < 0)\n+\n+ ret = -ret;\n+\n else\n \n ret = 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_paio_error(struct qemu_paiocb *aiocb)\n\n{\n\n ssize_t ret = qemu_paio_return(aiocb);\n\n\n\n if (ret < 0)\n\n ret = -ret;\n\n else\n\n ret = 0;\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "323e6fead07c75f418e4b60704a4f437bb3483b2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n int blk, ch;\n \n \n+\n \n \n for (blk = 0; blk < AC3_MAX_BLOCKS; blk++) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void quantize_mantissas(AC3EncodeContext *s)\n\n{\n\n int blk, ch;\n\n\n\n\n\n for (blk = 0; blk < AC3_MAX_BLOCKS; blk++) {\n\n AC3Block *block = &s->blocks[blk];\n\n s->mant1_cnt = s->mant2_cnt = s->mant4_cnt = 0;\n\n s->qmant1_ptr = s->qmant2_ptr = s->qmant4_ptr = NULL;\n\n\n\n for (ch = 0; ch < s->channels; ch++) {\n\n quantize_mantissas_blk_ch(s, block->fixed_coef[ch], block->exp_shift[ch],\n\n block->exp[ch], block->bap[ch],\n\n block->qmant[ch], s->nb_coefs[ch]);\n\n }\n\n }\n\n}\n"}} {"sample_id": "af7e9e74c6a62a5bcd911726a9e88d28b61490e0_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n unsigned len)\n \n+{\n \n OpenPICState *opp = opaque;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void openpic_src_write(void *opaque, hwaddr addr, uint64_t val,\n\n unsigned len)\n\n{\n\n OpenPICState *opp = opaque;\n\n int idx;\n\n\n\n DPRINTF(\"%s: addr %08x <= %08x\\n\", __func__, addr, val);\n\n if (addr & 0xF)\n\n return;\n\n addr = addr & 0xFFF0;\n\n idx = addr >> 5;\n\n if (addr & 0x10) {\n\n /* EXDE / IFEDE / IEEDE */\n\n write_IRQreg_ide(opp, idx, val);\n\n } else {\n\n /* EXVP / IFEVP / IEEVP */\n\n write_IRQreg_ipvp(opp, idx, val);\n\n }\n\n}\n"}} {"sample_id": "3d4d16f4dc101e16f643acc44dfffdbaf2a8f01c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ HWVoiceIn *hw = NULL;\n+\n \n \n while ((hw = audio_pcm_hw_find_any_enabled_in (hw))) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void audio_run_in (AudioState *s)\n\n{\n\n HWVoiceIn *hw = NULL;\n\n\n\n while ((hw = audio_pcm_hw_find_any_enabled_in (hw))) {\n\n SWVoiceIn *sw;\n\n int captured, min;\n\n\n\n captured = hw->pcm_ops->run_in (hw);\n\n\n\n min = audio_pcm_hw_find_min_in (hw);\n\n hw->total_samples_captured += captured - min;\n\n hw->ts_helper += captured;\n\n\n\n for (sw = hw->sw_head.lh_first; sw; sw = sw->entries.le_next) {\n\n sw->total_hw_samples_acquired -= min;\n\n\n\n if (sw->active) {\n\n int avail;\n\n\n\n avail = audio_get_avail (sw);\n\n if (avail > 0) {\n\n sw->callback.fn (sw->callback.opaque, avail);\n\n }\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "c04c3282b4334ff64cfd69d40fea010602e830fd_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n if (!st)\n \n return AVERROR_NOMEM;\n+\n+ if (ap) {\n+\n+ id = s->iformat->value;\n+\n if (id == CODEC_ID_RAWVIDEO) {\n \n st->codec->codec_type = CODEC_TYPE_VIDEO;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int raw_read_header(AVFormatContext *s, AVFormatParameters *ap)\n\n{\n\n AVStream *st;\n\n int id;\n\n\n\n st = av_new_stream(s, 0);\n\n if (!st)\n\n return AVERROR_NOMEM;\n\n if (ap) {\n\n id = s->iformat->value;\n\n if (id == CODEC_ID_RAWVIDEO) {\n\n st->codec->codec_type = CODEC_TYPE_VIDEO;\n\n } else {\n\n st->codec->codec_type = CODEC_TYPE_AUDIO;\n\n }\n\n st->codec->codec_id = id;\n\n\n\n switch(st->codec->codec_type) {\n\n case CODEC_TYPE_AUDIO:\n\n st->codec->sample_rate = ap->sample_rate;\n\n st->codec->channels = ap->channels;\n\n av_set_pts_info(st, 64, 1, st->codec->sample_rate);\n\n break;\n\n case CODEC_TYPE_VIDEO:\n\n av_set_pts_info(st, 64, ap->time_base.num, ap->time_base.den);\n\n st->codec->width = ap->width;\n\n st->codec->height = ap->height;\n\n st->codec->pix_fmt = ap->pix_fmt;\n\n if(st->codec->pix_fmt == PIX_FMT_NONE)\n\n st->codec->pix_fmt= PIX_FMT_YUV420P;\n\n break;\n\n default:\n\n return -1;\n\n }\n\n } else {\n\n return -1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "6260ab60a80fd8baebf79f9ce9299b0db72333b5_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void blend_image_rgb(AVFilterContext *ctx, AVFrame *dst, const AVFrame *src, int x, int y)\n \n+{\n \n blend_image_packed_rgb(ctx, dst, src, 0, x, y, 0);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void blend_image_rgb(AVFilterContext *ctx, AVFrame *dst, const AVFrame *src, int x, int y)\n\n{\n\n blend_image_packed_rgb(ctx, dst, src, 0, x, y, 0);\n\n}\n"}} {"sample_id": "1a3d142f1f1e65f554cba84d8a515684ecb390d0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n BFIContext *bfi = avctx->priv_data;\n \n+ avctx->pix_fmt = AV_PIX_FMT_PAL8;\n+\n+ bfi->dst = av_mallocz(avctx->width * avctx->height);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static av_cold int bfi_decode_init(AVCodecContext *avctx)\n\n{\n\n BFIContext *bfi = avctx->priv_data;\n\n avctx->pix_fmt = AV_PIX_FMT_PAL8;\n\n bfi->dst = av_mallocz(avctx->width * avctx->height);\n\n\n\n return 0;\n\n}"}} {"sample_id": "67a0fd2a9bca204d2b39f910a97c7137636a0715_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,8 +6,8 @@\n \n {\n \n+ return bdrv_get_block_status_above(bs, backing_bs(bs),\n+\n+ sector_num, nb_sectors, pnum);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int64_t bdrv_get_block_status(BlockDriverState *bs,\n\n int64_t sector_num,\n\n int nb_sectors, int *pnum)\n\n{\n\n return bdrv_get_block_status_above(bs, backing_bs(bs),\n\n sector_num, nb_sectors, pnum);\n\n}\n"}} {"sample_id": "33577b47c64435fcc2a1bc01c7e82534256f1fc3_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n int qemu_chr_fe_ioctl(CharDriverState *s, int cmd, void *arg)\n+\n+{\n \n if (!s->chr_ioctl)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_chr_fe_ioctl(CharDriverState *s, int cmd, void *arg)\n\n{\n\n if (!s->chr_ioctl)\n\n return -ENOTSUP;\n\n return s->chr_ioctl(s, cmd, arg);\n\n}\n"}} {"sample_id": "0058584580b87feb47898e60e4b80c7f425882ad_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static inline void downmix_mono_to_stereo(float *samples)\n \n {\n+\n+ int i;\n+\n \n \n for (i = 0; i < 256; i++)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void downmix_mono_to_stereo(float *samples)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < 256; i++)\n\n samples[i + 256] = samples[i];\n\n}\n"}} {"sample_id": "d5a8ee60a0fbc20a2c2d02f3bda1bb1bd365f1ee", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n BlockDeviceInfoList *qmp_query_named_block_nodes(Error **errp)\n+\n {\n \n return bdrv_named_nodes_list();", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-89", "target_file": "source.c", "files": {"source.c": "BlockDeviceInfoList *qmp_query_named_block_nodes(Error **errp)\n\n{\n\n return bdrv_named_nodes_list();\n\n}\n"}} {"sample_id": "702200358197a0ea5ea82d1d6540c785bb04fae4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n \n \n /* Free allocated memory buffers. */\n+\n+ av_free(q->mlt_window);\n+\n+ av_free(q->mlt_precos);\n+\n av_free(q->mlt_presin);\n \n av_free(q->mlt_postcos);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int cook_decode_close(AVCodecContext *avctx)\n\n{\n\n int i;\n\n COOKContext *q = avctx->priv_data;\n\n av_log(NULL,AV_LOG_DEBUG, \"Deallocating memory.\\n\");\n\n\n\n /* Free allocated memory buffers. */\n\n av_free(q->mlt_window);\n\n av_free(q->mlt_precos);\n\n av_free(q->mlt_presin);\n\n av_free(q->mlt_postcos);\n\n av_free(q->frame_reorder_index);\n\n av_free(q->frame_reorder_buffer);\n\n av_free(q->decoded_bytes_buffer);\n\n\n\n /* Free the transform. */\n\n ff_fft_end(&q->fft_ctx);\n\n\n\n /* Free the VLC tables. */\n\n for (i=0 ; i<13 ; i++) {\n\n free_vlc(&q->envelope_quant_index[i]);\n\n }\n\n for (i=0 ; i<7 ; i++) {\n\n free_vlc(&q->sqvh[i]);\n\n }\n\n if(q->nb_channels==2 && q->joint_stereo==1 ){\n\n free_vlc(&q->ccpl);\n\n }\n\n\n\n av_log(NULL,AV_LOG_DEBUG,\"Memory deallocated.\\n\");\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "bcfa4d60144fb879f0ffef0a6d174faa37b2df82_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n NetClientState *ncs[MAX_QUEUE_NUM];\n \n \n+\n if (nb_args != 2) {\n \n return;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void netdev_del_completion(ReadLineState *rs, int nb_args, const char *str)\n\n{\n\n int len, count, i;\n\n NetClientState *ncs[MAX_QUEUE_NUM];\n\n\n\n if (nb_args != 2) {\n\n return;\n\n }\n\n\n\n len = strlen(str);\n\n readline_set_completion_index(rs, len);\n\n count = qemu_find_net_clients_except(NULL, ncs, NET_CLIENT_OPTIONS_KIND_NIC,\n\n MAX_QUEUE_NUM);\n\n for (i = 0; i < count; i++) {\n\n QemuOpts *opts;\n\n const char *name = ncs[i]->name;\n\n if (strncmp(str, name, len)) {\n\n continue;\n\n }\n\n opts = qemu_opts_find(qemu_find_opts_err(\"netdev\", NULL), name);\n\n if (opts) {\n\n readline_add_completion(rs, name);\n\n }\n\n }\n\n}\n"}} {"sample_id": "3a661f1eabf7e8db66e28489884d9b54aacb94ea_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n int qcrypto_cipher_setiv(QCryptoCipher *cipher,\n \n+ const uint8_t *iv, size_t niv,\n+\n Error **errp)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int qcrypto_cipher_setiv(QCryptoCipher *cipher,\n\n const uint8_t *iv, size_t niv,\n\n Error **errp)\n\n{\n\n QCryptoCipherNettle *ctx = cipher->opaque;\n\n if (niv != ctx->niv) {\n\n error_setg(errp, \"Expected IV size %zu not %zu\",\n\n ctx->niv, niv);\n\n return -1;\n\n }\n\n memcpy(ctx->iv, iv, niv);\n\n return 0;\n\n}\n"}} {"sample_id": "2b31a9c613f95383d5106f8c1cbcee8eb291090f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -72,8 +72,8 @@\n \n return ret;\n \n+ pkt->stream_index = 0;\n+\n+ return ret;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int iff_read_packet(AVFormatContext *s,\n\n AVPacket *pkt)\n\n{\n\n IffDemuxContext *iff = s->priv_data;\n\n AVIOContext *pb = s->pb;\n\n AVStream *st = s->streams[0];\n\n int ret;\n\n int64_t pos = avio_tell(pb);\n\n\n\n if (pos >= iff->body_end)\n\n return AVERROR_EOF;\n\n\n\n if (st->codec->codec_type == AVMEDIA_TYPE_AUDIO) {\n\n if (st->codec->codec_tag == ID_MAUD) {\n\n ret = av_get_packet(pb, pkt, FFMIN(iff->body_end - pos, 1024 * st->codec->block_align));\n\n } else {\n\n ret = av_get_packet(pb, pkt, iff->body_size);\n\n }\n\n } else if (st->codec->codec_type == AVMEDIA_TYPE_VIDEO) {\n\n uint8_t *buf;\n\n\n\n if (av_new_packet(pkt, iff->body_size + 2) < 0) {\n\n return AVERROR(ENOMEM);\n\n }\n\n\n\n buf = pkt->data;\n\n bytestream_put_be16(&buf, 2);\n\n ret = avio_read(pb, buf, iff->body_size);\n\n\n\n } else {\n\n av_assert0(0);\n\n }\n\n\n\n if (pos == iff->body_pos)\n\n pkt->flags |= AV_PKT_FLAG_KEY;\n\n if (ret < 0)\n\n return ret;\n\n pkt->stream_index = 0;\n\n return ret;\n\n}"}} {"sample_id": "6e42e6c4b410dbef8b593c2d796a5dad95f89ee4_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,16 +1,16 @@\n void rgb24tobgr32(const uint8_t *src, uint8_t *dst, long src_size)\n+\n+{\n \n+\tlong i;\n+\n+\tfor(i=0; 3*i BGR32 (= A,R,G,B) */\n \n \t\t\tdst[4*i + 0] = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void rgb24tobgr32(const uint8_t *src, uint8_t *dst, long src_size)\n\n{\n\n\tlong i;\n\n\tfor(i=0; 3*i BGR32 (= A,R,G,B) */\n\n\t\t\tdst[4*i + 0] = 0;\n\n\t\t\tdst[4*i + 1] = src[3*i + 0];\n\n\t\t\tdst[4*i + 2] = src[3*i + 1];\n\n\t\t\tdst[4*i + 3] = src[3*i + 2];\n\n\t\t#else\n\n\t\t\tdst[4*i + 0] = src[3*i + 2];\n\n\t\t\tdst[4*i + 1] = src[3*i + 1];\n\n\t\t\tdst[4*i + 2] = src[3*i + 0];\n\n\t\t\tdst[4*i + 3] = 0;\n\n\t\t#endif\n\n\t}\n\n}\n"}} {"sample_id": "765a707000e838c30b18d712fe6cb3dd8e0435f3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static int megasas_handle_dcmd(MegasasState *s, MegasasCmd *cmd)\n+\n {\n \n int opcode, len;\n \n+ int retval = 0;\n+\n const struct dcmd_cmd_tbl_t *cmdptr = dcmd_cmd_tbl;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int megasas_handle_dcmd(MegasasState *s, MegasasCmd *cmd)\n\n{\n\n int opcode, len;\n\n int retval = 0;\n\n const struct dcmd_cmd_tbl_t *cmdptr = dcmd_cmd_tbl;\n\n\n\n opcode = le32_to_cpu(cmd->frame->dcmd.opcode);\n\n trace_megasas_handle_dcmd(cmd->index, opcode);\n\n len = megasas_map_dcmd(s, cmd);\n\n if (len < 0) {\n\n return MFI_STAT_MEMORY_NOT_AVAILABLE;\n\n }\n\n while (cmdptr->opcode != -1 && cmdptr->opcode != opcode) {\n\n cmdptr++;\n\n }\n\n if (cmdptr->opcode == -1) {\n\n trace_megasas_dcmd_unhandled(cmd->index, opcode, len);\n\n retval = megasas_dcmd_dummy(s, cmd);\n\n } else {\n\n trace_megasas_dcmd_enter(cmd->index, cmdptr->desc, len);\n\n retval = cmdptr->func(s, cmd);\n\n }\n\n if (retval != MFI_STAT_INVALID_STATUS) {\n\n megasas_finish_dcmd(cmd, len);\n\n }\n\n return retval;\n\n}\n"}} {"sample_id": "ddf21908961073199f3d186204da4810f2ea150b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n g_assert_cmpint(udnp1->dict1->dict2->userdef->base->integer, ==,\n \n+ udnp2->dict1->dict2->userdef->base->integer);\n+\n+ g_assert_cmpstr(udnp1->dict1->dict2->userdef->string, ==,\n+\n+ udnp2->dict1->dict2->userdef->string);\n \n g_assert_cmpstr(udnp1->dict1->dict2->string, ==,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void nested_struct_compare(UserDefTwo *udnp1, UserDefTwo *udnp2)\n\n{\n\n g_assert(udnp1);\n\n g_assert(udnp2);\n\n g_assert_cmpstr(udnp1->string0, ==, udnp2->string0);\n\n g_assert_cmpstr(udnp1->dict1->string1, ==, udnp2->dict1->string1);\n\n g_assert_cmpint(udnp1->dict1->dict2->userdef->base->integer, ==,\n\n udnp2->dict1->dict2->userdef->base->integer);\n\n g_assert_cmpstr(udnp1->dict1->dict2->userdef->string, ==,\n\n udnp2->dict1->dict2->userdef->string);\n\n g_assert_cmpstr(udnp1->dict1->dict2->string, ==,\n\n udnp2->dict1->dict2->string);\n\n g_assert(udnp1->dict1->has_dict3 == udnp2->dict1->has_dict3);\n\n g_assert_cmpint(udnp1->dict1->dict3->userdef->base->integer, ==,\n\n udnp2->dict1->dict3->userdef->base->integer);\n\n g_assert_cmpstr(udnp1->dict1->dict3->userdef->string, ==,\n\n udnp2->dict1->dict3->userdef->string);\n\n g_assert_cmpstr(udnp1->dict1->dict3->string, ==,\n\n udnp2->dict1->dict3->string);\n\n}\n"}} {"sample_id": "d1048bef9df0aacde9a54bf9b5b97a6e10950d8c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static bool pc_machine_get_vmport(Object *obj, Error **errp)\n \n {\n+\n+ PCMachineState *pcms = PC_MACHINE(obj);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool pc_machine_get_vmport(Object *obj, Error **errp)\n\n{\n\n PCMachineState *pcms = PC_MACHINE(obj);\n\n\n\n return pcms->vmport;\n\n}\n"}} {"sample_id": "754f84663e8b3a88fa2e953b195d59230393fb8d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n /* FIXME how to correctly detect RLE ??? */\n if (avctx->height * istride == avpkt->size) { /* assume uncompressed */\n int linesize = av_image_get_linesize(avctx->pix_fmt, avctx->width, 0);\n+ uint8_t *ptr = s->frame->data[0];\n+ uint8_t *buf = avpkt->data + (avctx->height-1)*istride;\n+ int i, j;\n+ for (i = 0; i < avctx->height; i++) {\n+ if (avctx->bits_per_coded_sample == 4) {\n for (j = 0; j < avctx->width - 1; j += 2) {\n ptr[j+0] = buf[j>>1] >> 4;\n ptr[j+1] = buf[j>>1] & 0xF;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int msrle_decode_frame(AVCodecContext *avctx,\n void *data, int *got_frame,\n AVPacket *avpkt)\n{\n const uint8_t *buf = avpkt->data;\n int buf_size = avpkt->size;\n MsrleContext *s = avctx->priv_data;\n int istride = FFALIGN(avctx->width*avctx->bits_per_coded_sample, 32) / 8;\n int ret;\n s->buf = buf;\n s->size = buf_size;\n if ((ret = ff_reget_buffer(avctx, s->frame)) < 0)\n return ret;\n if (avctx->bits_per_coded_sample > 1 && avctx->bits_per_coded_sample <= 8) {\n const uint8_t *pal = av_packet_get_side_data(avpkt, AV_PKT_DATA_PALETTE, NULL);\n if (pal) {\n s->frame->palette_has_changed = 1;\n memcpy(s->pal, pal, AVPALETTE_SIZE);\n }\n /* make the palette available */\n memcpy(s->frame->data[1], s->pal, AVPALETTE_SIZE);\n }\n /* FIXME how to correctly detect RLE ??? */\n if (avctx->height * istride == avpkt->size) { /* assume uncompressed */\n int linesize = av_image_get_linesize(avctx->pix_fmt, avctx->width, 0);\n uint8_t *ptr = s->frame->data[0];\n uint8_t *buf = avpkt->data + (avctx->height-1)*istride;\n int i, j;\n for (i = 0; i < avctx->height; i++) {\n if (avctx->bits_per_coded_sample == 4) {\n for (j = 0; j < avctx->width - 1; j += 2) {\n ptr[j+0] = buf[j>>1] >> 4;\n ptr[j+1] = buf[j>>1] & 0xF;\n }\n if (avctx->width & 1)\n ptr[j+0] = buf[j>>1] >> 4;\n } else {\n memcpy(ptr, buf, linesize);\n }\n buf -= istride;\n ptr += s->frame->linesize[0];\n }\n } else {\n bytestream2_init(&s->gb, buf, buf_size);\n ff_msrle_decode(avctx, (AVPicture*)s->frame, avctx->bits_per_coded_sample, &s->gb);\n }\n if ((ret = av_frame_ref(data, s->frame)) < 0)\n return ret;\n *got_frame = 1;\n /* report that the buffer was completely consumed */\n return buf_size;\n}"}} {"sample_id": "2caf19e90f270abe1e80a3e85acaf0eb5c9d0aac_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void FUNCC(pred4x4_129_dc)(uint8_t *_src, const uint8_t *topright, int _stride){\n \n pixel *src = (pixel*)_src;\n+\n int stride = _stride/sizeof(pixel);\n \n ((pixel4*)(src+0*stride))[0]=", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void FUNCC(pred4x4_129_dc)(uint8_t *_src, const uint8_t *topright, int _stride){\n\n pixel *src = (pixel*)_src;\n\n int stride = _stride/sizeof(pixel);\n\n ((pixel4*)(src+0*stride))[0]=\n\n ((pixel4*)(src+1*stride))[0]=\n\n ((pixel4*)(src+2*stride))[0]=\n\n ((pixel4*)(src+3*stride))[0]= PIXEL_SPLAT_X4((1<<(BIT_DEPTH-1))+1);\n\n}\n"}} {"sample_id": "81b23ef82cd1be29ca3d69ab7e98b5b5e55926ce", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n static int xen_pt_cmd_reg_write(XenPCIPassthroughState *s, XenPTReg *cfg_entry,\n+\n uint16_t *val, uint16_t dev_value,\n \n+ uint16_t valid_mask)\n+\n+{\n \n XenPTRegInfo *reg = cfg_entry->reg;\n \n+ uint16_t writable_mask = 0;\n \n uint16_t throughable_mask = 0;\n \n@@ -17,7 +17,7 @@\n \n \n if (s->is_virtfn) {\n+\n emu_mask |= PCI_COMMAND_MEMORY;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static int xen_pt_cmd_reg_write(XenPCIPassthroughState *s, XenPTReg *cfg_entry,\n\n uint16_t *val, uint16_t dev_value,\n\n uint16_t valid_mask)\n\n{\n\n XenPTRegInfo *reg = cfg_entry->reg;\n\n uint16_t writable_mask = 0;\n\n uint16_t throughable_mask = 0;\n\n uint16_t emu_mask = reg->emu_mask;\n\n\n\n if (s->is_virtfn) {\n\n emu_mask |= PCI_COMMAND_MEMORY;\n\n }\n\n\n\n /* modify emulate register */\n\n writable_mask = ~reg->ro_mask & valid_mask;\n\n cfg_entry->data = XEN_PT_MERGE_VALUE(*val, cfg_entry->data, writable_mask);\n\n\n\n /* create value for writing to I/O device register */\n\n throughable_mask = ~emu_mask & valid_mask;\n\n\n\n if (*val & PCI_COMMAND_INTX_DISABLE) {\n\n throughable_mask |= PCI_COMMAND_INTX_DISABLE;\n\n } else {\n\n if (s->machine_irq) {\n\n throughable_mask |= PCI_COMMAND_INTX_DISABLE;\n\n }\n\n }\n\n\n\n *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "26fc6ffec45c954cd8ca46342ac75cd90bcc7e02", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n for (x = 0; x < image->numcomps; x++)\n \n+ adjust[x] = FFMAX(FFMIN(av_pix_fmt_desc_get(picture->format)->comp[x].depth_minus1 + 1 - image->comps[x].prec, 8), 0);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void libopenjpeg_copyto16(AVFrame *picture, opj_image_t *image) {\n\n int *comp_data;\n\n uint16_t *img_ptr;\n\n int index, x, y;\n\n int adjust[4];\n\n for (x = 0; x < image->numcomps; x++)\n\n adjust[x] = FFMAX(FFMIN(av_pix_fmt_desc_get(picture->format)->comp[x].depth_minus1 + 1 - image->comps[x].prec, 8), 0);\n\n\n\n for (index = 0; index < image->numcomps; index++) {\n\n comp_data = image->comps[index].data;\n\n for (y = 0; y < image->comps[index].h; y++) {\n\n img_ptr = (uint16_t*) (picture->data[index] + y * picture->linesize[index]);\n\n for (x = 0; x < image->comps[index].w; x++) {\n\n *img_ptr = 0x8000 * image->comps[index].sgnd + (*comp_data << adjust[index]);\n\n img_ptr++;\n\n comp_data++;\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "dd09c36159858c66ab6e47c688e4177dd3912bf0_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void gen_write_xer(TCGv src)\n+\n {\n \n tcg_gen_andi_tl(cpu_xer, src,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void gen_write_xer(TCGv src)\n\n{\n\n tcg_gen_andi_tl(cpu_xer, src,\n\n ~((1u << XER_SO) | (1u << XER_OV) | (1u << XER_CA)));\n\n tcg_gen_extract_tl(cpu_so, src, XER_SO, 1);\n\n tcg_gen_extract_tl(cpu_ov, src, XER_OV, 1);\n\n tcg_gen_extract_tl(cpu_ca, src, XER_CA, 1);\n\n}\n"}} {"sample_id": "cfb08fbafcd946341bdf14103293887763802697_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,7 +12,7 @@\n \n fdctrl->msr |= FD_MSR_RQM | FD_MSR_DIO;\n \n+ fdctrl->status0 = status0;\n \n return;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void fdctrl_raise_irq(FDCtrl *fdctrl, uint8_t status0)\n\n{\n\n /* Sparc mutation */\n\n if (fdctrl->sun4m && (fdctrl->msr & FD_MSR_CMDBUSY)) {\n\n /* XXX: not sure */\n\n fdctrl->msr &= ~FD_MSR_CMDBUSY;\n\n fdctrl->msr |= FD_MSR_RQM | FD_MSR_DIO;\n\n fdctrl->status0 = status0;\n\n return;\n\n }\n\n if (!(fdctrl->sra & FD_SRA_INTPEND)) {\n\n qemu_set_irq(fdctrl->irq, 1);\n\n fdctrl->sra |= FD_SRA_INTPEND;\n\n }\n\n if (status0 & FD_SR0_SEEK) {\n\n FDrive *cur_drv;\n\n /* A seek clears the disk change line (if a disk is inserted) */\n\n cur_drv = get_cur_drv(fdctrl);\n\n if (cur_drv->max_track) {\n\n cur_drv->media_changed = 0;\n\n }\n\n }\n\n\n\n fdctrl->reset_sensei = 0;\n\n fdctrl->status0 = status0;\n\n FLOPPY_DPRINTF(\"Set interrupt status to 0x%02x\\n\", fdctrl->status0);\n\n}\n"}} {"sample_id": "ac4b32df71bd932838043a4838b86d11e169707f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n+av_cold int ff_vp8_decode_init(AVCodecContext *avctx)\n \n {\n \n VP8Context *s = avctx->priv_data;\n \n int ret;\n+\n+\n \n s->avctx = avctx;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "av_cold int ff_vp8_decode_init(AVCodecContext *avctx)\n\n{\n\n VP8Context *s = avctx->priv_data;\n\n int ret;\n\n\n\n s->avctx = avctx;\n\n avctx->pix_fmt = AV_PIX_FMT_YUV420P;\n\n avctx->internal->allocate_progress = 1;\n\n\n\n ff_videodsp_init(&s->vdsp, 8);\n\n ff_h264_pred_init(&s->hpc, AV_CODEC_ID_VP8, 8, 1);\n\n ff_vp8dsp_init(&s->vp8dsp);\n\n\n\n if ((ret = vp8_init_frames(s)) < 0) {\n\n ff_vp8_decode_free(avctx);\n\n return ret;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d6604b29ef544793479d7fb4e05ef6622bb3e534_33", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static av_cold int sunrast_encode_close(AVCodecContext *avctx)\n \n {\n+\n+ av_frame_free(&avctx->coded_frame);\n \n return 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int sunrast_encode_close(AVCodecContext *avctx)\n\n{\n\n av_frame_free(&avctx->coded_frame);\n\n return 0;\n\n}\n"}} {"sample_id": "2aab7c2dfaca4386c38e5d565cd2bf73096bcc86_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void ff_put_h264_qpel16_mc13_msa(uint8_t *dst, const uint8_t *src,\n+\n+ ptrdiff_t stride)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_put_h264_qpel16_mc13_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n avc_luma_hv_qrt_16w_msa(src + stride - 2,\n\n src - (stride * 2), stride, dst, stride, 16);\n\n}\n"}} {"sample_id": "a03ef88f77af045a2eb9629b5ce774a3fb973c5e_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,10 +5,10 @@\n {\n \n uint64_t reqid = request_id++;\n+\n+ int ret = bdrv_co_preadv(bs->file->bs, offset, bytes, qiov, flags);\n+\n+ block_request_create(reqid, bs, qemu_coroutine_self());\n \n qemu_coroutine_yield();\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int coroutine_fn blkreplay_co_preadv(BlockDriverState *bs,\n\n uint64_t offset, uint64_t bytes, QEMUIOVector *qiov, int flags)\n\n{\n\n uint64_t reqid = request_id++;\n\n int ret = bdrv_co_preadv(bs->file->bs, offset, bytes, qiov, flags);\n\n block_request_create(reqid, bs, qemu_coroutine_self());\n\n qemu_coroutine_yield();\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "b7f43fe46029d8fd0594cd599fa2599dcce0f553", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n Object *object_dynamic_cast(Object *obj, const char *typename)\n+\n {\n \n if (object_class_dynamic_cast(object_get_class(obj), typename)) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "Object *object_dynamic_cast(Object *obj, const char *typename)\n\n{\n\n if (object_class_dynamic_cast(object_get_class(obj), typename)) {\n\n return obj;\n\n }\n\n\n\n return NULL;\n\n}\n"}} {"sample_id": "eabb7b91b36b202b4dac2df2d59d698e3aff197a_21", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n opi = STW, opx = STWX;\n \n } else {\n+\n+ opi = STD, opx = STDX;\n+\n+ }\n+\n tcg_out_mem_long(s, opi, opx, arg, arg1, arg2);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg,\n\n TCGReg arg1, intptr_t arg2)\n\n{\n\n int opi, opx;\n\n\n\n assert(TCG_TARGET_REG_BITS == 64 || type == TCG_TYPE_I32);\n\n if (type == TCG_TYPE_I32) {\n\n opi = STW, opx = STWX;\n\n } else {\n\n opi = STD, opx = STDX;\n\n }\n\n tcg_out_mem_long(s, opi, opx, arg, arg1, arg2);\n\n}\n"}} {"sample_id": "df8bf7a7fe75eb5d5caffa55f5cd4292b757aea6_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n const struct iovec *iov, int iovcnt,\n \n+ size_t iovoff, bool strip_vlan)\n \n+{\n \n uint16_t tci = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void net_rx_pkt_attach_iovec(struct NetRxPkt *pkt,\n\n const struct iovec *iov, int iovcnt,\n\n size_t iovoff, bool strip_vlan)\n\n{\n\n uint16_t tci = 0;\n\n uint16_t ploff = iovoff;\n\n assert(pkt);\n\n pkt->vlan_stripped = false;\n\n\n\n if (strip_vlan) {\n\n pkt->vlan_stripped = eth_strip_vlan(iov, iovcnt, iovoff, pkt->ehdr_buf,\n\n &ploff, &tci);\n\n }\n\n\n\n pkt->tci = tci;\n\n\n\n net_rx_pkt_pull_data(pkt, iov, iovcnt, ploff);\n\n}\n"}} {"sample_id": "7149fce2cac0474a5fbc5b47add1158cd8bb283e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n int ady = FFABS(dy);\n \n int sy = dy < 0 ? -1 : 1;\n+\n buf[x0] = ff_vorbis_floor1_inverse_db_table[y0];\n \n if (ady*2 <= adx) { // optimized common case", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void render_line(int x0, int y0, int x1, int y1, float *buf)\n\n{\n\n int dy = y1 - y0;\n\n int adx = x1 - x0;\n\n int ady = FFABS(dy);\n\n int sy = dy < 0 ? -1 : 1;\n\n buf[x0] = ff_vorbis_floor1_inverse_db_table[y0];\n\n if (ady*2 <= adx) { // optimized common case\n\n render_line_unrolled(x0, y0, x1, sy, ady, adx, buf);\n\n } else {\n\n int base = dy / adx;\n\n int x = x0;\n\n int y = y0;\n\n int err = -adx;\n\n ady -= FFABS(base) * adx;\n\n while (++x < x1) {\n\n y += base;\n\n err += ady;\n\n if (err >= 0) {\n\n err -= adx;\n\n y += sy;\n\n }\n\n buf[x] = ff_vorbis_floor1_inverse_db_table[y];\n\n }\n\n }\n\n}\n"}} {"sample_id": "9cf0419bb1a2cf929dcf458d435ae3c3bfb5d3ab", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n err = mov_read_default(c, pb, atom);\n \n /* we parsed the 'moov' atom, we can terminate the parsing as soon as we find the 'mdat' */\n+\n+ /* so we don't parse the whole file if over a network */\n+\n+ c->found_moov=1;\n+\n if(c->found_mdat)\n \n return 1; /* found both, just go */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mov_read_moov(MOVContext *c, ByteIOContext *pb, MOV_atom_t atom)\n\n{\n\n int err;\n\n\n\n err = mov_read_default(c, pb, atom);\n\n /* we parsed the 'moov' atom, we can terminate the parsing as soon as we find the 'mdat' */\n\n /* so we don't parse the whole file if over a network */\n\n c->found_moov=1;\n\n if(c->found_mdat)\n\n return 1; /* found both, just go */\n\n return 0; /* now go for mdat */\n\n}\n"}} {"sample_id": "2c5b1d2a479273cec4c1be491745f48b0808b508", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void HELPER(wer)(CPUXtensaState *env, uint32_t data, uint32_t addr)\n \n+{\n+\n address_space_stl(env->address_space_er, addr, data,\n \n (MemTxAttrs){0}, NULL);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void HELPER(wer)(CPUXtensaState *env, uint32_t data, uint32_t addr)\n\n{\n\n address_space_stl(env->address_space_er, addr, data,\n\n (MemTxAttrs){0}, NULL);\n\n}\n"}} {"sample_id": "3335ddddf9e5ba7743dc8e3f767f4ef857ccd20c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n unsigned int sclp_active_selection_mask;\n+\n+ unsigned int sclp_cp_receive_mask;\n+\n+\n+\n ReadEventData *red = (ReadEventData *) sccb;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void read_event_data(SCLPEventFacility *ef, SCCB *sccb)\n\n{\n\n unsigned int sclp_active_selection_mask;\n\n unsigned int sclp_cp_receive_mask;\n\n\n\n ReadEventData *red = (ReadEventData *) sccb;\n\n\n\n if (be16_to_cpu(sccb->h.length) != SCCB_SIZE) {\n\n sccb->h.response_code = cpu_to_be16(SCLP_RC_INSUFFICIENT_SCCB_LENGTH);\n\n goto out;\n\n }\n\n\n\n sclp_cp_receive_mask = ef->receive_mask;\n\n\n\n /* get active selection mask */\n\n switch (sccb->h.function_code) {\n\n case SCLP_UNCONDITIONAL_READ:\n\n sclp_active_selection_mask = sclp_cp_receive_mask;\n\n break;\n\n case SCLP_SELECTIVE_READ:\n\n if (!(sclp_cp_receive_mask & be32_to_cpu(red->mask))) {\n\n sccb->h.response_code =\n\n cpu_to_be16(SCLP_RC_INVALID_SELECTION_MASK);\n\n goto out;\n\n }\n\n sclp_active_selection_mask = be32_to_cpu(red->mask);\n\n break;\n\n default:\n\n sccb->h.response_code = cpu_to_be16(SCLP_RC_INVALID_FUNCTION);\n\n goto out;\n\n }\n\n sccb->h.response_code = cpu_to_be16(\n\n handle_sccb_read_events(ef, sccb, sclp_active_selection_mask));\n\n\n\nout:\n\n return;\n\n}\n"}} {"sample_id": "0ba1f53191221b541b938df86a39eeccfb87f996", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n void virtio_scsi_common_realize(DeviceState *dev, Error **errp,\n \n+ HandleOutput ctrl, HandleOutput evt,\n+\n+ HandleOutput cmd)\n+\n+{\n \n VirtIODevice *vdev = VIRTIO_DEVICE(dev);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void virtio_scsi_common_realize(DeviceState *dev, Error **errp,\n\n HandleOutput ctrl, HandleOutput evt,\n\n HandleOutput cmd)\n\n{\n\n VirtIODevice *vdev = VIRTIO_DEVICE(dev);\n\n VirtIOSCSICommon *s = VIRTIO_SCSI_COMMON(dev);\n\n int i;\n\n\n\n virtio_init(vdev, \"virtio-scsi\", VIRTIO_ID_SCSI,\n\n sizeof(VirtIOSCSIConfig));\n\n\n\n if (s->conf.num_queues <= 0 || s->conf.num_queues > VIRTIO_PCI_QUEUE_MAX) {\n\n error_setg(errp, \"Invalid number of queues (= %\" PRId32 \"), \"\n\n \"must be a positive integer less than %d.\",\n\n s->conf.num_queues, VIRTIO_PCI_QUEUE_MAX);\n\n virtio_cleanup(vdev);\n\n return;\n\n }\n\n s->cmd_vqs = g_malloc0(s->conf.num_queues * sizeof(VirtQueue *));\n\n s->sense_size = VIRTIO_SCSI_SENSE_SIZE;\n\n s->cdb_size = VIRTIO_SCSI_CDB_SIZE;\n\n\n\n s->ctrl_vq = virtio_add_queue(vdev, VIRTIO_SCSI_VQ_SIZE,\n\n ctrl);\n\n s->event_vq = virtio_add_queue(vdev, VIRTIO_SCSI_VQ_SIZE,\n\n evt);\n\n for (i = 0; i < s->conf.num_queues; i++) {\n\n s->cmd_vqs[i] = virtio_add_queue(vdev, VIRTIO_SCSI_VQ_SIZE,\n\n cmd);\n\n }\n\n\n\n if (s->conf.iothread) {\n\n virtio_scsi_set_iothread(VIRTIO_SCSI(s), s->conf.iothread);\n\n }\n\n}\n"}} {"sample_id": "b20909195745c34a819aed14ae996b60ab0f591f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n iscsi_readv_writev_bh_cb(void *p)\n \n {\n+\n IscsiAIOCB *acb = p;\n \n \n+\n qemu_bh_delete(acb->bh);\n \n+\n+\n if (!acb->canceled) {\n \n acb->common.cb(acb->common.opaque, acb->status);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "iscsi_readv_writev_bh_cb(void *p)\n\n{\n\n IscsiAIOCB *acb = p;\n\n\n\n qemu_bh_delete(acb->bh);\n\n\n\n if (!acb->canceled) {\n\n acb->common.cb(acb->common.opaque, acb->status);\n\n }\n\n\n\n qemu_aio_release(acb);\n\n\n\n if (acb->canceled) {\n\n return;\n\n }\n\n\n\n scsi_free_scsi_task(acb->task);\n\n acb->task = NULL;\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_58", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n if (done_init)\n \n return;\n+\n+\n+\n+ cpu_env = tcg_global_reg_new(TCG_TYPE_PTR, TCG_AREG0, \"env\");\n+\n \n \n p = cpu_reg_names;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void alpha_translate_init(void)\n\n{\n\n int i;\n\n char *p;\n\n static int done_init = 0;\n\n\n\n if (done_init)\n\n return;\n\n\n\n cpu_env = tcg_global_reg_new(TCG_TYPE_PTR, TCG_AREG0, \"env\");\n\n\n\n p = cpu_reg_names;\n\n for (i = 0; i < 31; i++) {\n\n sprintf(p, \"ir%d\", i);\n\n cpu_ir[i] = tcg_global_mem_new(TCG_TYPE_I64, TCG_AREG0,\n\n offsetof(CPUState, ir[i]), p);\n\n p += (i < 10) ? 4 : 5;\n\n\n\n sprintf(p, \"fir%d\", i);\n\n cpu_fir[i] = tcg_global_mem_new(TCG_TYPE_I64, TCG_AREG0,\n\n offsetof(CPUState, fir[i]), p);\n\n p += (i < 10) ? 5 : 6;\n\n }\n\n\n\n cpu_pc = tcg_global_mem_new(TCG_TYPE_I64, TCG_AREG0,\n\n offsetof(CPUState, pc), \"pc\");\n\n\n\n cpu_lock = tcg_global_mem_new(TCG_TYPE_I64, TCG_AREG0,\n\n offsetof(CPUState, lock), \"lock\");\n\n\n\n /* register helpers */\n\n#undef DEF_HELPER\n\n#define DEF_HELPER(ret, name, params) tcg_register_helper(name, #name);\n\n#include \"helper.h\"\n\n\n\n done_init = 1;\n\n}\n"}} {"sample_id": "3df9caf88f5c0859ae380101fea47609ba1dbfbd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -63,11 +63,11 @@\n \n \n done:\n+\n+ if (!r->req.io_canceled) {\n+\n+ scsi_req_unref(&r->req);\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void scsi_write_complete(void * opaque, int ret)\n\n{\n\n SCSIDiskReq *r = (SCSIDiskReq *)opaque;\n\n SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);\n\n uint32_t n;\n\n\n\n if (r->req.aiocb != NULL) {\n\n r->req.aiocb = NULL;\n\n block_acct_done(bdrv_get_stats(s->qdev.conf.bs), &r->acct);\n\n }\n\n if (r->req.io_canceled) {\n\n goto done;\n\n }\n\n\n\n if (ret < 0) {\n\n if (scsi_handle_rw_error(r, -ret)) {\n\n goto done;\n\n }\n\n }\n\n\n\n n = r->qiov.size / 512;\n\n r->sector += n;\n\n r->sector_count -= n;\n\n if (r->sector_count == 0) {\n\n scsi_write_do_fua(r);\n\n return;\n\n } else {\n\n scsi_init_iovec(r, SCSI_DMA_BUF_SIZE);\n\n DPRINTF(\"Write complete tag=0x%x more=%zd\\n\", r->req.tag, r->qiov.size);\n\n scsi_req_data(&r->req, r->qiov.size);\n\n }\n\n\n\ndone:\n\n if (!r->req.io_canceled) {\n\n scsi_req_unref(&r->req);\n\n }\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_68", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n BlockDriverState *value)\n \n+{\n+\n+ Error *err = NULL;\n+\n+ const char *bdrv_name = value ? bdrv_get_device_name(value) : \"\";\n \n object_property_set_str(OBJECT(dev), bdrv_name,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qdev_prop_set_drive(DeviceState *dev, const char *name,\n\n BlockDriverState *value)\n\n{\n\n Error *err = NULL;\n\n const char *bdrv_name = value ? bdrv_get_device_name(value) : \"\";\n\n object_property_set_str(OBJECT(dev), bdrv_name,\n\n name, &err);\n\n if (err) {\n\n qerror_report_err(err);\n\n error_free(err);\n\n return -1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "5e54769c921a3d8cd8858444f5a3fa62cc44260e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void check_suspend_mode(GuestSuspendMode mode, Error **errp)\n \n {\n+\n SYSTEM_POWER_CAPABILITIES sys_pwr_caps;\n \n Error *local_err = NULL;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void check_suspend_mode(GuestSuspendMode mode, Error **errp)\n\n{\n\n SYSTEM_POWER_CAPABILITIES sys_pwr_caps;\n\n Error *local_err = NULL;\n\n\n\n if (error_is_set(errp)) {\n\n return;\n\n }\n\n ZeroMemory(&sys_pwr_caps, sizeof(sys_pwr_caps));\n\n if (!GetPwrCapabilities(&sys_pwr_caps)) {\n\n error_set(&local_err, QERR_QGA_COMMAND_FAILED,\n\n \"failed to determine guest suspend capabilities\");\n\n goto out;\n\n }\n\n\n\n switch (mode) {\n\n case GUEST_SUSPEND_MODE_DISK:\n\n if (!sys_pwr_caps.SystemS4) {\n\n error_set(&local_err, QERR_QGA_COMMAND_FAILED,\n\n \"suspend-to-disk not supported by OS\");\n\n }\n\n break;\n\n case GUEST_SUSPEND_MODE_RAM:\n\n if (!sys_pwr_caps.SystemS3) {\n\n error_set(&local_err, QERR_QGA_COMMAND_FAILED,\n\n \"suspend-to-ram not supported by OS\");\n\n }\n\n break;\n\n default:\n\n error_set(&local_err, QERR_INVALID_PARAMETER_VALUE, \"mode\",\n\n \"GuestSuspendMode\");\n\n }\n\n\n\nout:\n\n if (local_err) {\n\n error_propagate(errp, local_err);\n\n }\n\n}\n"}} {"sample_id": "ac4b32df71bd932838043a4838b86d11e169707f_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+int check_intra_pred8x8_mode_emuedge(int mode, int mb_x, int mb_y)\n \n {\n+\n+ switch (mode) {\n+\n case DC_PRED8x8:\n \n return check_dc_pred8x8_mode(mode, mb_x, mb_y);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int check_intra_pred8x8_mode_emuedge(int mode, int mb_x, int mb_y)\n\n{\n\n switch (mode) {\n\n case DC_PRED8x8:\n\n return check_dc_pred8x8_mode(mode, mb_x, mb_y);\n\n case VERT_PRED8x8:\n\n return !mb_y ? DC_127_PRED8x8 : mode;\n\n case HOR_PRED8x8:\n\n return !mb_x ? DC_129_PRED8x8 : mode;\n\n case PLANE_PRED8x8: /* TM */\n\n return check_tm_pred8x8_mode(mode, mb_x, mb_y);\n\n }\n\n return mode;\n\n}\n"}} {"sample_id": "cccb45751e93142d71be78f6bb90bbfb50ee13be", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void fill_gv_table(int table[256 + 2*YUVRGB_TABLE_HEADROOM], const int elemsize, const int inc)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void fill_gv_table(int table[256 + 2*YUVRGB_TABLE_HEADROOM], const int elemsize, const int inc)\n\n{\n\n int i;\n\n int off = -(inc >> 9);\n\n\n\n for (i = 0; i < 256 + 2*YUVRGB_TABLE_HEADROOM; i++) {\n\n int64_t cb = av_clip(i-YUVRGB_TABLE_HEADROOM, 0, 255)*inc;\n\n table[i] = elemsize * (off + (cb >> 16));\n\n }\n\n}\n"}} {"sample_id": "a9416dc62c36079b93b4951c894a0b15e53bb38c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,10 +36,10 @@\n visit_type_int64(v, NULL, &tail->value, &error_abort);\n tail = (int64List *)visit_next_list(v, (GenericList *)tail, sizeof(*res));\n g_assert(tail);\n+ visit_type_int64(v, NULL, &tail->value, &error_abort);\n+ g_assert_cmpint(tail->value, ==, 2);\n+ tail = (int64List *)visit_next_list(v, (GenericList *)tail, sizeof(*res));\n+ g_assert(tail);\n+ visit_check_list(v, &err);\n error_free_or_abort(&err);\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_visitor_in_intList(TestInputVisitorData *data,\n const void *unused)\n{\n /* Note: the visitor *sorts* ranges *unsigned* */\n int64_t expect1[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 20 };\n int64_t expect2[] = { 32767, -32768, -32767 };\n int64_t expect3[] = { INT64_MAX, INT64_MIN };\n uint64_t expect4[] = { UINT64_MAX };\n Error *err = NULL;\n int64List *res = NULL;\n int64List *tail;\n Visitor *v;\n int64_t val;\n /* Valid lists */\n v = visitor_input_test_init(data, \"1,2,0,2-4,20,5-9,1-8\");\n check_ilist(v, expect1, ARRAY_SIZE(expect1));\n v = visitor_input_test_init(data, \"32767,-32768--32767\");\n check_ilist(v, expect2, ARRAY_SIZE(expect2));\n v = visitor_input_test_init(data,\n \"-9223372036854775808,9223372036854775807\");\n check_ilist(v, expect3, ARRAY_SIZE(expect3));\n v = visitor_input_test_init(data, \"18446744073709551615\");\n check_ulist(v, expect4, ARRAY_SIZE(expect4));\n /* Empty list is invalid (weird) */\n v = visitor_input_test_init(data, \"\");\n visit_type_int64List(v, NULL, &res, &err);\n error_free_or_abort(&err);\n /* Not a list */\n v = visitor_input_test_init(data, \"not an int list\");\n visit_type_int64List(v, NULL, &res, &err);\n error_free_or_abort(&err);\n g_assert(!res);\n /* Unvisited list tail */\n v = visitor_input_test_init(data, \"0,2-3\");\n /* Would be simpler if the visitor genuinely supported virtual walks */\n visit_type_int64(v, NULL, &tail->value, &error_abort);\n tail = (int64List *)visit_next_list(v, (GenericList *)tail, sizeof(*res));\n g_assert(tail);\n visit_type_int64(v, NULL, &tail->value, &error_abort);\n g_assert_cmpint(tail->value, ==, 2);\n tail = (int64List *)visit_next_list(v, (GenericList *)tail, sizeof(*res));\n g_assert(tail);\n visit_check_list(v, &err);\n error_free_or_abort(&err);\n}"}} {"sample_id": "bf937a7965c1d1a6dce4f615d0ead2e2ab505004_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void l2cap_channel_close(struct l2cap_instance_s *l2cap,\n+\n+ int cid, int source_cid)\n+\n+{\n \n struct l2cap_chan_s *ch = NULL;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void l2cap_channel_close(struct l2cap_instance_s *l2cap,\n\n int cid, int source_cid)\n\n{\n\n struct l2cap_chan_s *ch = NULL;\n\n\n\n /* According to Volume 3, section 6.1.1, pg 1048 of BT Core V2.0, a\n\n * connection in CLOSED state still responds with a L2CAP_DisconnectRsp\n\n * message on an L2CAP_DisconnectReq event. */\n\n if (unlikely(cid < L2CAP_CID_ALLOC)) {\n\n l2cap_command_reject_cid(l2cap, l2cap->last_id, L2CAP_REJ_CID_INVAL,\n\n cid, source_cid);\n\n return;\n\n }\n\n if (likely(cid >= L2CAP_CID_ALLOC && cid < L2CAP_CID_MAX))\n\n ch = l2cap->cid[cid];\n\n\n\n if (likely(ch)) {\n\n if (ch->remote_cid != source_cid) {\n\n fprintf(stderr, \"%s: Ignoring a Disconnection Request with the \"\n\n \"invalid SCID %04x.\\n\", __func__, source_cid);\n\n return;\n\n }\n\n\n\n l2cap->cid[cid] = NULL;\n\n\n\n ch->params.close(ch->params.opaque);\n\n g_free(ch);\n\n }\n\n\n\n l2cap_disconnection_response(l2cap, cid, source_cid);\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_70", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,\n \n+ BlockCompletionFunc *cb, void *opaque)\n+\n {\n \n return bdrv_aio_rw_vector(bs, sector_num, qiov, nb_sectors, cb, opaque, 0);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static BlockAIOCB *bdrv_aio_readv_em(BlockDriverState *bs,\n\n int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,\n\n BlockCompletionFunc *cb, void *opaque)\n\n{\n\n return bdrv_aio_rw_vector(bs, sector_num, qiov, nb_sectors, cb, opaque, 0);\n\n}\n"}} {"sample_id": "d6604b29ef544793479d7fb4e05ef6622bb3e534_39", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n avctx->coded_frame = av_frame_alloc();\n+\n+ if (!avctx->coded_frame)\n+\n+ return AVERROR(ENOMEM);\n+\n \n \n avctx->coded_frame->pict_type = AV_PICTURE_TYPE_I;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int pnm_encode_init(AVCodecContext *avctx)\n\n{\n\n avctx->coded_frame = av_frame_alloc();\n\n if (!avctx->coded_frame)\n\n return AVERROR(ENOMEM);\n\n\n\n avctx->coded_frame->pict_type = AV_PICTURE_TYPE_I;\n\n avctx->coded_frame->key_frame = 1;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "f1710638edb2e98008c2a733ffda63ef32b50411", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n QCryptoHmac *qcrypto_hmac_new(QCryptoHashAlgorithm alg,\n \n const uint8_t *key, size_t nkey,\n+\n Error **errp)\n+\n {\n \n QCryptoHmac *hmac;\n@@ -13,7 +13,7 @@\n Error *err2 = NULL;\n \n QCryptoHmacDriver *drv = NULL;\n+\n \n \n #ifdef CONFIG_AF_ALG", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "QCryptoHmac *qcrypto_hmac_new(QCryptoHashAlgorithm alg,\n\n const uint8_t *key, size_t nkey,\n\n Error **errp)\n\n{\n\n QCryptoHmac *hmac;\n\n void *ctx = NULL;\n\n Error *err2 = NULL;\n\n QCryptoHmacDriver *drv = NULL;\n\n\n\n#ifdef CONFIG_AF_ALG\n\n ctx = qcrypto_afalg_hmac_ctx_new(alg, key, nkey, &err2);\n\n if (ctx) {\n\n drv = &qcrypto_hmac_afalg_driver;\n\n }\n\n#endif\n\n\n\n if (!ctx) {\n\n ctx = qcrypto_hmac_ctx_new(alg, key, nkey, errp);\n\n if (!ctx) {\n\n return NULL;\n\n }\n\n\n\n drv = &qcrypto_hmac_lib_driver;\n\n error_free(err2);\n\n }\n\n\n\n hmac = g_new0(QCryptoHmac, 1);\n\n hmac->alg = alg;\n\n hmac->opaque = ctx;\n\n hmac->driver = (void *)drv;\n\n\n\n return hmac;\n\n}\n"}} {"sample_id": "237ccd8a165d2128e8c6bcb14c8c6c3e793cfe05", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static av_always_inline int get_dst_color_err(PaletteUseContext *s,\n \n+ uint32_t c, int *er, int *eg, int *eb,\n+\n+ const enum color_search_method search_method)\n+\n+{\n \n const uint8_t a = c >> 24 & 0xff;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_always_inline int get_dst_color_err(PaletteUseContext *s,\n\n uint32_t c, int *er, int *eg, int *eb,\n\n const enum color_search_method search_method)\n\n{\n\n const uint8_t a = c >> 24 & 0xff;\n\n const uint8_t r = c >> 16 & 0xff;\n\n const uint8_t g = c >> 8 & 0xff;\n\n const uint8_t b = c & 0xff;\n\n const int dstx = color_get(s, c, a, r, g, b, search_method);\n\n const uint32_t dstc = s->palette[dstx];\n\n *er = r - (dstc >> 16 & 0xff);\n\n *eg = g - (dstc >> 8 & 0xff);\n\n *eb = b - (dstc & 0xff);\n\n return dstx;\n\n}\n"}} {"sample_id": "e494f44c051d7dccc038a603ab22532b87dd1705_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int can_safely_read(GetBitContext* gb, uint64_t bits) {\n \n return get_bits_left(gb) >= bits;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int can_safely_read(GetBitContext* gb, uint64_t bits) {\n\n return get_bits_left(gb) >= bits;\n\n}\n"}} {"sample_id": "d0393d79bc3d61c9f2ff832c0e273b7774ff0269", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length)\n \n+{\n+\n GetBitContext gb;\n+\n+ int i;\n \n+\n \n+ init_get_bits(&gb, src, length * 8);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length)\n\n{\n\n GetBitContext gb;\n\n int i;\n\n\n\n init_get_bits(&gb, src, length * 8);\n\n\n\n for (i = 0; i < 3; i++) {\n\n if (read_len_table(s->len[i], &gb) < 0)\n\n return -1;\n\n if (ff_huffyuv_generate_bits_table(s->bits[i], s->len[i]) < 0)\n\n return -1;\n\n ff_free_vlc(&s->vlc[i]);\n\n init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1,\n\n s->bits[i], 4, 4, 0);\n\n }\n\n\n\n generate_joint_tables(s);\n\n\n\n return (get_bits_count(&gb) + 7) / 8;\n\n}\n"}} {"sample_id": "87e8788680e16c51f6048af26f3f7830c35207a5_18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n if (p->buf[0] == 'F' && p->buf[1] == 'O' &&\n \n p->buf[2] == 'R' && p->buf[3] == 'M' &&\n+\n+ p->buf[8] == 'A' && p->buf[9] == 'I' &&\n+\n+ p->buf[10] == 'F' && (p->buf[11] == 'F' || p->buf[11] == 'C'))\n+\n return AVPROBE_SCORE_MAX;\n \n else", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int aiff_probe(AVProbeData *p)\n\n{\n\n /* check file header */\n\n if (p->buf_size < 16)\n\n return 0;\n\n if (p->buf[0] == 'F' && p->buf[1] == 'O' &&\n\n p->buf[2] == 'R' && p->buf[3] == 'M' &&\n\n p->buf[8] == 'A' && p->buf[9] == 'I' &&\n\n p->buf[10] == 'F' && (p->buf[11] == 'F' || p->buf[11] == 'C'))\n\n return AVPROBE_SCORE_MAX;\n\n else\n\n return 0;\n\n}\n"}} {"sample_id": "dc7588c1eb3008bda53dde1d6b890cd299758155", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ RBDAIOCB *acb = rcb->acb;\n+\n+ int64_t r;\n+\n+\n \n r = rcb->ret;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_rbd_complete_aio(RADOSCB *rcb)\n\n{\n\n RBDAIOCB *acb = rcb->acb;\n\n int64_t r;\n\n\n\n r = rcb->ret;\n\n\n\n if (acb->cmd == RBD_AIO_WRITE ||\n\n acb->cmd == RBD_AIO_DISCARD) {\n\n if (r < 0) {\n\n acb->ret = r;\n\n acb->error = 1;\n\n } else if (!acb->error) {\n\n acb->ret = rcb->size;\n\n }\n\n } else {\n\n if (r < 0) {\n\n memset(rcb->buf, 0, rcb->size);\n\n acb->ret = r;\n\n acb->error = 1;\n\n } else if (r < rcb->size) {\n\n memset(rcb->buf + r, 0, rcb->size - r);\n\n if (!acb->error) {\n\n acb->ret = rcb->size;\n\n }\n\n } else if (!acb->error) {\n\n acb->ret = r;\n\n }\n\n }\n\n /* Note that acb->bh can be NULL in case where the aio was cancelled */\n\n acb->bh = qemu_bh_new(rbd_aio_bh_cb, acb);\n\n qemu_bh_schedule(acb->bh);\n\n g_free(rcb);\n\n}\n"}} {"sample_id": "d1fdf257d52822695f5ace6c586e059aa17d4b79_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -38,11 +38,11 @@\n \n \n \n+ magic = ldl_be_p(buf);\n+\n+ request->flags = lduw_be_p(buf + 4);\n+\n+ request->type = lduw_be_p(buf + 6);\n \n request->handle = ldq_be_p(buf + 8);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ssize_t nbd_receive_request(QIOChannel *ioc, NBDRequest *request)\n\n{\n\n uint8_t buf[NBD_REQUEST_SIZE];\n\n uint32_t magic;\n\n ssize_t ret;\n\n\n\n ret = read_sync(ioc, buf, sizeof(buf), NULL);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n\n\n /* Request\n\n [ 0 .. 3] magic (NBD_REQUEST_MAGIC)\n\n [ 4 .. 5] flags (NBD_CMD_FLAG_FUA, ...)\n\n [ 6 .. 7] type (NBD_CMD_READ, ...)\n\n [ 8 .. 15] handle\n\n [16 .. 23] from\n\n [24 .. 27] len\n\n */\n\n\n\n magic = ldl_be_p(buf);\n\n request->flags = lduw_be_p(buf + 4);\n\n request->type = lduw_be_p(buf + 6);\n\n request->handle = ldq_be_p(buf + 8);\n\n request->from = ldq_be_p(buf + 16);\n\n request->len = ldl_be_p(buf + 24);\n\n\n\n TRACE(\"Got request: { magic = 0x%\" PRIx32 \", .flags = %\" PRIx16\n\n \", .type = %\" PRIx16 \", from = %\" PRIu64 \", len = %\" PRIu32 \" }\",\n\n magic, request->flags, request->type, request->from, request->len);\n\n\n\n if (magic != NBD_REQUEST_MAGIC) {\n\n LOG(\"invalid magic (got 0x%\" PRIx32 \")\", magic);\n\n return -EINVAL;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "42a268c241183877192c376d03bd9b6d527407c7_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,10 +16,10 @@\n \n tcg_gen_movi_tl(cpu_gpr[rD(ctx->opcode)], 0);\n \n+ gen_set_label(l2);\n+\n+ if (unlikely(Rc(ctx->opcode) != 0))\n+\n+ gen_set_Rc0(ctx, cpu_gpr[rD(ctx->opcode)]);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gen_doz(DisasContext *ctx)\n\n{\n\n int l1 = gen_new_label();\n\n int l2 = gen_new_label();\n\n tcg_gen_brcond_tl(TCG_COND_GE, cpu_gpr[rB(ctx->opcode)], cpu_gpr[rA(ctx->opcode)], l1);\n\n tcg_gen_sub_tl(cpu_gpr[rD(ctx->opcode)], cpu_gpr[rB(ctx->opcode)], cpu_gpr[rA(ctx->opcode)]);\n\n tcg_gen_br(l2);\n\n gen_set_label(l1);\n\n tcg_gen_movi_tl(cpu_gpr[rD(ctx->opcode)], 0);\n\n gen_set_label(l2);\n\n if (unlikely(Rc(ctx->opcode) != 0))\n\n gen_set_Rc0(ctx, cpu_gpr[rD(ctx->opcode)]);\n\n}\n"}} {"sample_id": "d68c05380cebf563915412182643a8be04ef890b_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,9 +15,9 @@\n }\n \n if (EXTERNAL_AVX(cpu_flags)) {\n+\n+ m->update_lls = ff_update_lls_avx;\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "av_cold void ff_init_lls_x86(LLSModel *m)\n\n{\n\n int cpu_flags = av_get_cpu_flags();\n\n if (EXTERNAL_SSE2(cpu_flags)) {\n\n m->update_lls = ff_update_lls_sse2;\n\n if (m->indep_count >= 4)\n\n m->evaluate_lls = ff_evaluate_lls_sse2;\n\n }\n\n if (EXTERNAL_AVX(cpu_flags)) {\n\n m->update_lls = ff_update_lls_avx;\n\n }\n\n}\n"}} {"sample_id": "9bc9732faeff09828fe38c0ebe2401ee131a6fca", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n struct nbd_request *request)\n \n+{\n \n int i = HANDLE_TO_INDEX(s, request->handle);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void nbd_coroutine_end(NbdClientSession *s,\n\n struct nbd_request *request)\n\n{\n\n int i = HANDLE_TO_INDEX(s, request->handle);\n\n s->recv_coroutine[i] = NULL;\n\n if (s->in_flight-- == MAX_NBD_REQUESTS) {\n\n qemu_co_mutex_unlock(&s->free_sema);\n\n }\n\n}\n"}} {"sample_id": "db486cc334aafd3dbdaf107388e37fc3d6d3e171_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static void range_merge(Range *range1, Range *range2)\n+\n+{\n \n+ if (range1->end < range2->end) {\n+\n range1->end = range2->end;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void range_merge(Range *range1, Range *range2)\n\n{\n\n if (range1->end < range2->end) {\n\n range1->end = range2->end;\n\n }\n\n if (range1->begin > range2->begin) {\n\n range1->begin = range2->begin;\n\n }\n\n}\n"}} {"sample_id": "c39ce112b60ffafbaf700853e32bea74cbb2c148_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n void *hba_private)\n \n {\n+\n+ return d->info->alloc_req(d, tag, lun, hba_private);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "SCSIRequest *scsi_req_new(SCSIDevice *d, uint32_t tag, uint32_t lun,\n\n void *hba_private)\n\n{\n\n return d->info->alloc_req(d, tag, lun, hba_private);\n\n}\n"}} {"sample_id": "c23acbaed40101c677dfcfbbfe0d2c230a8e8f44_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void add_pixels_clamped4_c(const DCTELEM *block, uint8_t *restrict pixels,\n \n+ int line_size)\n \n+{\n+\n+ int i;\n+\n uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void add_pixels_clamped4_c(const DCTELEM *block, uint8_t *restrict pixels,\n\n int line_size)\n\n{\n\n int i;\n\n uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;\n\n\n\n /* read the pixels */\n\n for(i=0;i<4;i++) {\n\n pixels[0] = cm[pixels[0] + block[0]];\n\n pixels[1] = cm[pixels[1] + block[1]];\n\n pixels[2] = cm[pixels[2] + block[2]];\n\n pixels[3] = cm[pixels[3] + block[3]];\n\n pixels += line_size;\n\n block += 8;\n\n }\n\n}\n"}} {"sample_id": "2c62f08ddbf3fa80dc7202eb9a2ea60ae44e2cc5_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n {\n \n BlizzardState *s = (BlizzardState *) opaque;\n+\n+ DisplaySurface *surface = qemu_console_surface(s->con);\n+\n+\n+\n blizzard_update_display(opaque);\n \n if (s && surface_data(surface)) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void blizzard_screen_dump(void *opaque, const char *filename,\n\n bool cswitch, Error **errp)\n\n{\n\n BlizzardState *s = (BlizzardState *) opaque;\n\n DisplaySurface *surface = qemu_console_surface(s->con);\n\n\n\n blizzard_update_display(opaque);\n\n if (s && surface_data(surface)) {\n\n ppm_save(filename, surface, errp);\n\n }\n\n}\n"}} {"sample_id": "f1c21a200bcbc9bbd54fc336016ac16c2e015012", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void read_table(AVFormatContext *avctx, AVStream *st,\n \n int (*parse)(AVFormatContext *avctx, AVStream *st,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void read_table(AVFormatContext *avctx, AVStream *st,\n\n int (*parse)(AVFormatContext *avctx, AVStream *st,\n\n const char *name, int size))\n\n{\n\n int count, i;\n\n AVIOContext *pb = avctx->pb;\n\n avio_skip(pb, 4);\n\n count = avio_rb32(pb);\n\n avio_skip(pb, 4);\n\n for (i = 0; i < count; i++) {\n\n char name[17];\n\n int size;\n\n avio_read(pb, name, 16);\n\n name[sizeof(name) - 1] = 0;\n\n size = avio_rb32(pb);\n\n if (parse(avctx, st, name, size) < 0) {\n\n avpriv_request_sample(avctx, \"Variable %s\", name);\n\n avio_skip(pb, size);\n\n }\n\n }\n\n}\n"}} {"sample_id": "c20fd872257fb9abd2ce99741937c0f65aa162b7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n MultiReqBuffer mrb = {\n \n .num_writes = 0,\n+\n+ };\n+\n+\n+\n qemu_bh_delete(s->bh);\n \n s->bh = NULL;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_blk_dma_restart_bh(void *opaque)\n\n{\n\n VirtIOBlock *s = opaque;\n\n VirtIOBlockReq *req = s->rq;\n\n MultiReqBuffer mrb = {\n\n .num_writes = 0,\n\n };\n\n\n\n qemu_bh_delete(s->bh);\n\n s->bh = NULL;\n\n\n\n s->rq = NULL;\n\n\n\n while (req) {\n\n virtio_blk_handle_request(req, &mrb);\n\n req = req->next;\n\n }\n\n\n\n if (mrb.num_writes > 0) {\n\n do_multiwrite(s->bs, mrb.blkreq, mrb.num_writes);\n\n }\n\n}\n"}} {"sample_id": "530c0bbd73e1b658c9266582072847de1fbdff10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n assert(src->size >= soffset);\n \n for (i = 0, done = 0; done < sbytes && i < src->niov; i++) {\n+\n+ if (soffset < siov[i].iov_len) {\n+\n+ size_t len = MIN(siov[i].iov_len - soffset, sbytes - done);\n+\n qemu_iovec_add(dst, siov[i].iov_base + soffset, len);\n \n done += len;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_iovec_concat(QEMUIOVector *dst,\n\n QEMUIOVector *src, size_t soffset, size_t sbytes)\n\n{\n\n int i;\n\n size_t done;\n\n struct iovec *siov = src->iov;\n\n assert(dst->nalloc != -1);\n\n assert(src->size >= soffset);\n\n for (i = 0, done = 0; done < sbytes && i < src->niov; i++) {\n\n if (soffset < siov[i].iov_len) {\n\n size_t len = MIN(siov[i].iov_len - soffset, sbytes - done);\n\n qemu_iovec_add(dst, siov[i].iov_base + soffset, len);\n\n done += len;\n\n soffset = 0;\n\n } else {\n\n soffset -= siov[i].iov_len;\n\n }\n\n }\n\n /* return done; */\n\n}\n"}} {"sample_id": "e07c82688e8187dbafac489b7c15427252974021", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void store_slice_c(uint8_t *dst, const int16_t *src,\n \n int dst_stride, int src_stride,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void store_slice_c(uint8_t *dst, const int16_t *src,\n\n int dst_stride, int src_stride,\n\n int width, int height, int log2_scale)\n\n{\n\n int y, x;\n\n\n\n#define STORE(pos) do { \\\n\n temp = ((src[x + y * src_stride + pos] << log2_scale) + d[pos]) >> 8; \\\n\n if (temp & 0x100) temp = ~(temp >> 31); \\\n\n dst[x + y * dst_stride + pos] = temp; \\\n\n} while (0)\n\n\n\n for (y = 0; y < height; y++) {\n\n const uint8_t *d = dither[y&7];\n\n for (x = 0; x < width; x += 8) {\n\n int temp;\n\n STORE(0);\n\n STORE(1);\n\n STORE(2);\n\n STORE(3);\n\n STORE(4);\n\n STORE(5);\n\n STORE(6);\n\n STORE(7);\n\n }\n\n }\n\n}\n"}} {"sample_id": "441692ddd8321d5e0f09b163e86410e578d87236_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,14 +6,14 @@\n \n \n \n+ blankbuf = g_malloc(512);\n \n tmpbuf = g_malloc(512);\n+\n memset(blankbuf, 0xff, 512);\n \n for (; num > 0; num--, sec++) {\n+\n if (s->blk_cur) {\n \n int erasesec = s->secs_cur + (sec >> 5);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static inline int onenand_erase(OneNANDState *s, int sec, int num)\n\n{\n\n uint8_t *blankbuf, *tmpbuf;\n\n\n\n blankbuf = g_malloc(512);\n\n tmpbuf = g_malloc(512);\n\n memset(blankbuf, 0xff, 512);\n\n for (; num > 0; num--, sec++) {\n\n if (s->blk_cur) {\n\n int erasesec = s->secs_cur + (sec >> 5);\n\n if (blk_write(s->blk_cur, sec, blankbuf, 1) < 0) {\n\n goto fail;\n\n }\n\n if (blk_read(s->blk_cur, erasesec, tmpbuf, 1) < 0) {\n\n goto fail;\n\n }\n\n memcpy(tmpbuf + ((sec & 31) << 4), blankbuf, 1 << 4);\n\n if (blk_write(s->blk_cur, erasesec, tmpbuf, 1) < 0) {\n\n goto fail;\n\n }\n\n } else {\n\n if (sec + 1 > s->secs_cur) {\n\n goto fail;\n\n }\n\n memcpy(s->current + (sec << 9), blankbuf, 512);\n\n memcpy(s->current + (s->secs_cur << 9) + (sec << 4),\n\n blankbuf, 1 << 4);\n\n }\n\n }\n\n\n\n g_free(tmpbuf);\n\n g_free(blankbuf);\n\n return 0;\n\n\n\nfail:\n\n g_free(tmpbuf);\n\n g_free(blankbuf);\n\n return 1;\n\n}\n"}} {"sample_id": "2da0d70d5eebe42f9fcd27ee554419ebe2a5da06_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,17 +1,17 @@\n static inline void RENAME(bgr32ToUV)(uint8_t *dstU, uint8_t *dstV, uint8_t *src1, uint8_t *src2, int width)\n+\n+{\n+\n \tint i;\n+\n+ assert(src1 == src2);\n+\n+\tfor(i=0; i>8;\n\n\t\tconst int r= l>>16;\n\n\n\n\t\tdstU[i]= ((RU*r + GU*g + BU*b)>>(RGB2YUV_SHIFT+1)) + 128;\n\n\t\tdstV[i]= ((RV*r + GV*g + BV*b)>>(RGB2YUV_SHIFT+1)) + 128;\n\n\t}\n\n}\n"}} {"sample_id": "7d5e199ade76c53ec316ab6779800581bb47c50a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n size_t size)\n \n {\n+\n+ return tail->next;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static GenericList *qmp_output_next_list(Visitor *v, GenericList *tail,\n\n size_t size)\n\n{\n\n return tail->next;\n\n}\n"}} {"sample_id": "ad96090a01d848df67d70c5259ed8aa321fa8716_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void do_acpitable_option(const char *optarg)\n \n+{\n+\n+ if (acpi_table_add(optarg) < 0) {\n \n fprintf(stderr, \"Wrong acpi table provided\\n\");\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void do_acpitable_option(const char *optarg)\n\n{\n\n if (acpi_table_add(optarg) < 0) {\n\n fprintf(stderr, \"Wrong acpi table provided\\n\");\n\n exit(1);\n\n }\n\n}\n"}} {"sample_id": "9dc44aa5829eb3131a01378a738dee28a382bbc1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,7 +12,7 @@\n \n sigset_t set, oldset;\n \n+ int i = 0;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void *do_touch_pages(void *arg)\n\n{\n\n MemsetThread *memset_args = (MemsetThread *)arg;\n\n char *addr = memset_args->addr;\n\n uint64_t numpages = memset_args->numpages;\n\n uint64_t hpagesize = memset_args->hpagesize;\n\n sigset_t set, oldset;\n\n int i = 0;\n\n\n\n /* unblock SIGBUS */\n\n sigemptyset(&set);\n\n sigaddset(&set, SIGBUS);\n\n pthread_sigmask(SIG_UNBLOCK, &set, &oldset);\n\n\n\n if (sigsetjmp(memset_args->env, 1)) {\n\n memset_thread_failed = true;\n\n } else {\n\n for (i = 0; i < numpages; i++) {\n\n memset(addr, 0, 1);\n\n addr += hpagesize;\n\n }\n\n }\n\n pthread_sigmask(SIG_SETMASK, &oldset, NULL);\n\n return NULL;\n\n}\n"}} {"sample_id": "aafed1175df76603e94c99a7748968780d6548d2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,14 +4,14 @@\n \n AVFilterContext *ctx = inlink->dst;\n \n+ ChannelMapContext *s = ctx->priv;\n+\n int i, err = 0;\n+\n const char *channel_name;\n+\n char layout_name[256];\n+\n \n \n if (s->mode == MAP_PAIR_STR_INT || s->mode == MAP_PAIR_STR_STR) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int channelmap_config_input(AVFilterLink *inlink)\n\n{\n\n AVFilterContext *ctx = inlink->dst;\n\n ChannelMapContext *s = ctx->priv;\n\n int i, err = 0;\n\n const char *channel_name;\n\n char layout_name[256];\n\n\n\n if (s->mode == MAP_PAIR_STR_INT || s->mode == MAP_PAIR_STR_STR) {\n\n for (i = 0; i < s->nch; i++) {\n\n s->map[i].in_channel_idx = av_get_channel_layout_channel_index(\n\n inlink->channel_layout, s->map[i].in_channel);\n\n if (s->map[i].in_channel_idx < 0) {\n\n channel_name = av_get_channel_name(s->map[i].in_channel);\n\n av_get_channel_layout_string(layout_name, sizeof(layout_name),\n\n 0, inlink->channel_layout);\n\n av_log(ctx, AV_LOG_ERROR,\n\n \"input channel '%s' not available from input layout '%s'\\n\",\n\n channel_name, layout_name);\n\n err = AVERROR(EINVAL);\n\n }\n\n }\n\n }\n\n\n\n return err;\n\n}\n"}} {"sample_id": "8108551a5c4c4c9696582c73d000f94b12cd95a5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n (uint32_t *)info->pict.data[1]);\n \n+ gif_image_write_image(pb, 0, 0, info->width, info->height, \n+\n+ info->pict.data[0], info->pict.linesize[0], \n+\n+ PIX_FMT_PAL8);\n \n put_byte(pb, 0x3b);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int gif_write(ByteIOContext *pb, AVImageInfo *info)\n\n{\n\n gif_image_write_header(pb, info->width, info->height, \n\n (uint32_t *)info->pict.data[1]);\n\n gif_image_write_image(pb, 0, 0, info->width, info->height, \n\n info->pict.data[0], info->pict.linesize[0], \n\n PIX_FMT_PAL8);\n\n put_byte(pb, 0x3b);\n\n put_flush_packet(pb);\n\n return 0;\n\n}\n"}} {"sample_id": "c77549c510370eaaa2e2bb1f15d1a30f29e30950", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n {\n \n RTSPState *rt = s->priv_data;\n+\n int ret;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int rtsp_read_header(AVFormatContext *s,\n\n AVFormatParameters *ap)\n\n{\n\n RTSPState *rt = s->priv_data;\n\n int ret;\n\n\n\n ret = ff_rtsp_connect(s);\n\n if (ret)\n\n return ret;\n\n\n\n rt->real_setup_cache = av_mallocz(2 * s->nb_streams * sizeof(*rt->real_setup_cache));\n\n if (!rt->real_setup_cache)\n\n return AVERROR(ENOMEM);\n\n rt->real_setup = rt->real_setup_cache + s->nb_streams * sizeof(*rt->real_setup);\n\n\n\n if (ap->initial_pause) {\n\n /* do not start immediately */\n\n } else {\n\n if (rtsp_read_play(s) < 0) {\n\n ff_rtsp_close_streams(s);\n\n ff_rtsp_close_connections(s);\n\n return AVERROR_INVALIDDATA;\n\n }\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "5ac2731cf821a7ecae90786d9052891afb09dfc2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+void usb_packet_set_state(USBPacket *p, USBPacketState state)\n \n {\n \n static const char *name[] = {\n+\n [USB_PACKET_UNDEFINED] = \"undef\",\n \n [USB_PACKET_SETUP] = \"setup\",", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "void usb_packet_set_state(USBPacket *p, USBPacketState state)\n\n{\n\n static const char *name[] = {\n\n [USB_PACKET_UNDEFINED] = \"undef\",\n\n [USB_PACKET_SETUP] = \"setup\",\n\n [USB_PACKET_QUEUED] = \"queued\",\n\n [USB_PACKET_ASYNC] = \"async\",\n\n [USB_PACKET_COMPLETE] = \"complete\",\n\n [USB_PACKET_CANCELED] = \"canceled\",\n\n };\n\n USBDevice *dev = p->ep->dev;\n\n USBBus *bus = usb_bus_from_device(dev);\n\n\n\n trace_usb_packet_state_change(bus->busnr, dev->port->path, p->ep->nr,\n\n p, name[p->state], name[state]);\n\n p->state = state;\n\n}\n"}} {"sample_id": "cb11e7b2f3878575f23d49454c02d8dce35c8d35", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n cli = g_strdup_printf(\"%s create -f %s %s %uM\", abs_path,\n \n+ fmt, file, size_mb);\n+\n+ ret = g_spawn_command_line_sync(cli, &out, &out2, &rc, &err);\n+\n+ if (err) {\n \n fprintf(stderr, \"%s\\n\", err->message);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void mkimg(const char *file, const char *fmt, unsigned size_mb)\n\n{\n\n gchar *cli;\n\n bool ret;\n\n int rc;\n\n GError *err = NULL;\n\n char *qemu_img_path;\n\n gchar *out, *out2;\n\n char *abs_path;\n\n\n\n qemu_img_path = getenv(\"QTEST_QEMU_IMG\");\n\n abs_path = realpath(qemu_img_path, NULL);\n\n assert(qemu_img_path);\n\n\n\n cli = g_strdup_printf(\"%s create -f %s %s %uM\", abs_path,\n\n fmt, file, size_mb);\n\n ret = g_spawn_command_line_sync(cli, &out, &out2, &rc, &err);\n\n if (err) {\n\n fprintf(stderr, \"%s\\n\", err->message);\n\n g_error_free(err);\n\n }\n\n g_assert(ret && !err);\n\n\n\n /* In glib 2.34, we have g_spawn_check_exit_status. in 2.12, we don't.\n\n * glib 2.43.91 implementation assumes that any non-zero is an error for\n\n * windows, but uses extra precautions for Linux. However,\n\n * 0 is only possible if the program exited normally, so that should be\n\n * sufficient for our purposes on all platforms, here. */\n\n if (rc) {\n\n fprintf(stderr, \"qemu-img returned status code %d\\n\", rc);\n\n }\n\n g_assert(!rc);\n\n\n\n g_free(out);\n\n g_free(out2);\n\n g_free(cli);\n\n free(abs_path);\n\n}\n"}} {"sample_id": "26f2e2f3f73f0da088e6765291d0839ebb077b03", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,24 +1,24 @@\n+static int write_representation(AVFormatContext *s, AVStream *stream, int id,\n \n int output_width, int output_height,\n \n int output_sample_rate) {\n \n+ AVDictionaryEntry *irange = av_dict_get(stream->metadata, INITIALIZATION_RANGE, NULL, 0);\n \n AVDictionaryEntry *cues_start = av_dict_get(stream->metadata, CUES_START, NULL, 0);\n+\n+ AVDictionaryEntry *cues_end = av_dict_get(stream->metadata, CUES_END, NULL, 0);\n \n AVDictionaryEntry *filename = av_dict_get(stream->metadata, FILENAME, NULL, 0);\n \n+ AVDictionaryEntry *bandwidth = av_dict_get(stream->metadata, BANDWIDTH, NULL, 0);\n+\n+ if (!irange || cues_start == NULL || cues_end == NULL || filename == NULL ||\n+\n+ !bandwidth) {\n+\n+ return -1;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int write_representation(AVFormatContext *s, AVStream *stream, int id,\n\n int output_width, int output_height,\n\n int output_sample_rate) {\n\n AVDictionaryEntry *irange = av_dict_get(stream->metadata, INITIALIZATION_RANGE, NULL, 0);\n\n AVDictionaryEntry *cues_start = av_dict_get(stream->metadata, CUES_START, NULL, 0);\n\n AVDictionaryEntry *cues_end = av_dict_get(stream->metadata, CUES_END, NULL, 0);\n\n AVDictionaryEntry *filename = av_dict_get(stream->metadata, FILENAME, NULL, 0);\n\n AVDictionaryEntry *bandwidth = av_dict_get(stream->metadata, BANDWIDTH, NULL, 0);\n\n if (!irange || cues_start == NULL || cues_end == NULL || filename == NULL ||\n\n !bandwidth) {\n\n return -1;\n\n }\n\n avio_printf(s->pb, \"pb, \" bandwidth=\\\"%s\\\"\", bandwidth->value);\n\n if (stream->codec->codec_type == AVMEDIA_TYPE_VIDEO && output_width)\n\n avio_printf(s->pb, \" width=\\\"%d\\\"\", stream->codec->width);\n\n if (stream->codec->codec_type == AVMEDIA_TYPE_VIDEO && output_height)\n\n avio_printf(s->pb, \" height=\\\"%d\\\"\", stream->codec->height);\n\n if (stream->codec->codec_type = AVMEDIA_TYPE_AUDIO && output_sample_rate)\n\n avio_printf(s->pb, \" audioSamplingRate=\\\"%d\\\"\", stream->codec->sample_rate);\n\n avio_printf(s->pb, \">\\n\");\n\n avio_printf(s->pb, \"%s\\n\", filename->value);\n\n avio_printf(s->pb, \"pb, \" indexRange=\\\"%s-%s\\\">\\n\", cues_start->value, cues_end->value);\n\n avio_printf(s->pb, \"pb, \" range=\\\"0-%s\\\" />\\n\", irange->value);\n\n avio_printf(s->pb, \"\\n\");\n\n avio_printf(s->pb, \"\\n\");\n\n return 0;\n\n}\n"}} {"sample_id": "4445b1d27ee65ceee12b71bc20242996c8eb5cf8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,11 +34,11 @@\n \n /* A device present at reset is ready to go, same as coldplugged */\n \n+ drc->state = drck->ready_state;\n+\n+ } else {\n+\n+ drc->state = drck->empty_state;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void spapr_drc_reset(sPAPRDRConnector *drc)\n\n{\n\n sPAPRDRConnectorClass *drck = SPAPR_DR_CONNECTOR_GET_CLASS(drc);\n\n\n\n trace_spapr_drc_reset(spapr_drc_index(drc));\n\n\n\n g_free(drc->ccs);\n\n drc->ccs = NULL;\n\n\n\n /* immediately upon reset we can safely assume DRCs whose devices\n\n * are pending removal can be safely removed.\n\n */\n\n if (drc->unplug_requested) {\n\n spapr_drc_release(drc);\n\n }\n\n\n\n if (drc->dev) {\n\n /* A device present at reset is ready to go, same as coldplugged */\n\n drc->state = drck->ready_state;\n\n } else {\n\n drc->state = drck->empty_state;\n\n }\n\n}\n"}} {"sample_id": "8e91ed308062e742610e4cfdfd4a09bc045ead45", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,15 +2,15 @@\n \n {\n \n+ int l1, l2;\n+\n+\n+\n+ l1 = gen_new_label();\n \n l2 = gen_new_label();\n \n+ tcg_gen_mov_tl(cpu_cc_src, src1);\n \n tcg_gen_mov_tl(cpu_cc_src2, src2);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void gen_op_sdivx(TCGv dst, TCGv src1, TCGv src2)\n\n{\n\n int l1, l2;\n\n\n\n l1 = gen_new_label();\n\n l2 = gen_new_label();\n\n tcg_gen_mov_tl(cpu_cc_src, src1);\n\n tcg_gen_mov_tl(cpu_cc_src2, src2);\n\n gen_trap_ifdivzero_tl(cpu_cc_src2);\n\n tcg_gen_brcondi_tl(TCG_COND_NE, cpu_cc_src, INT64_MIN, l1);\n\n tcg_gen_brcondi_tl(TCG_COND_NE, cpu_cc_src2, -1, l1);\n\n tcg_gen_movi_i64(dst, INT64_MIN);\n\n tcg_gen_br(l2);\n\n gen_set_label(l1);\n\n tcg_gen_div_i64(dst, cpu_cc_src, cpu_cc_src2);\n\n gen_set_label(l2);\n\n}\n"}} {"sample_id": "5839e53bbc0fec56021d758aab7610df421ed8c8_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n int64_t sectors;\n \n+\n \n if (!bdrv_is_read_only(bs)) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void init_blk_migration_it(void *opaque, BlockDriverState *bs)\n\n{\n\n BlkMigDevState *bmds;\n\n int64_t sectors;\n\n\n\n if (!bdrv_is_read_only(bs)) {\n\n sectors = bdrv_nb_sectors(bs);\n\n if (sectors <= 0) {\n\n return;\n\n }\n\n\n\n bmds = g_malloc0(sizeof(BlkMigDevState));\n\n bmds->bs = bs;\n\n bmds->bulk_completed = 0;\n\n bmds->total_sectors = sectors;\n\n bmds->completed_sectors = 0;\n\n bmds->shared_base = block_mig_state.shared_base;\n\n alloc_aio_bitmap(bmds);\n\n error_setg(&bmds->blocker, \"block device is in use by migration\");\n\n bdrv_op_block_all(bs, bmds->blocker);\n\n bdrv_ref(bs);\n\n\n\n block_mig_state.total_sector_sum += sectors;\n\n\n\n if (bmds->shared_base) {\n\n DPRINTF(\"Start migration for %s with shared base image\\n\",\n\n bs->device_name);\n\n } else {\n\n DPRINTF(\"Start full migration for %s\\n\", bs->device_name);\n\n }\n\n\n\n QSIMPLEQ_INSERT_TAIL(&block_mig_state.bmds_list, bmds, entry);\n\n }\n\n}\n"}} {"sample_id": "5c8d6f008c0555b54cf10550fa86199a2cfabbca", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n if (!channel_subsys.sei_pending) {\n \n css_queue_crw(CRW_RSC_CSS, CRW_ERC_EVENT, 0, cssid);\n+\n+ }\n+\n channel_subsys.sei_pending = true;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void css_generate_css_crws(uint8_t cssid)\n\n{\n\n if (!channel_subsys.sei_pending) {\n\n css_queue_crw(CRW_RSC_CSS, CRW_ERC_EVENT, 0, cssid);\n\n }\n\n channel_subsys.sei_pending = true;\n\n}\n"}} {"sample_id": "2e6fc7eb1a4af1b127df5f07b8bb28af891946fa_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ bdrv_lock_medium(bs->file->bs, locked);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void raw_lock_medium(BlockDriverState *bs, bool locked)\n\n{\n\n bdrv_lock_medium(bs->file->bs, locked);\n\n}\n"}} {"sample_id": "79761c6681f0d1cc1c027116fcb4382d41ed3ece_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n void qemu_sem_wait(QemuSemaphore *sem)\n \n+{\n+\n+#if defined(__APPLE__) || defined(__NetBSD__)\n \n pthread_mutex_lock(&sem->lock);\n+\n --sem->count;\n \n while (sem->count < 0) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void qemu_sem_wait(QemuSemaphore *sem)\n\n{\n\n#if defined(__APPLE__) || defined(__NetBSD__)\n\n pthread_mutex_lock(&sem->lock);\n\n --sem->count;\n\n while (sem->count < 0) {\n\n pthread_cond_wait(&sem->cond, &sem->lock);\n\n }\n\n pthread_mutex_unlock(&sem->lock);\n\n#else\n\n int rc;\n\n\n\n do {\n\n rc = sem_wait(&sem->sem);\n\n } while (rc == -1 && errno == EINTR);\n\n if (rc < 0) {\n\n error_exit(errno, __func__);\n\n }\n\n#endif\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_340", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,10 +16,10 @@\n \n \n \n+ addr = start_addr;\n+\n+ phys_page_set(d, addr >> TARGET_PAGE_BITS, size >> TARGET_PAGE_BITS,\n+\n+ section_index);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void register_multipage(AddressSpaceDispatch *d, MemoryRegionSection *section)\n\n{\n\n target_phys_addr_t start_addr = section->offset_within_address_space;\n\n ram_addr_t size = section->size;\n\n target_phys_addr_t addr;\n\n uint16_t section_index = phys_section_add(section);\n\n\n\n assert(size);\n\n\n\n addr = start_addr;\n\n phys_page_set(d, addr >> TARGET_PAGE_BITS, size >> TARGET_PAGE_BITS,\n\n section_index);\n\n}\n"}} {"sample_id": "b3be28969b797b27d7f7f806827e9898e4ee08f0_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n return 0;\n \n }\n+\n+ qemu_put_be32(f, blen);\n+\n+ f->buf_index += blen;\n+\n return blen + sizeof(int32_t);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "ssize_t qemu_put_compression_data(QEMUFile *f, const uint8_t *p, size_t size,\n\n int level)\n\n{\n\n ssize_t blen = IO_BUF_SIZE - f->buf_index - sizeof(int32_t);\n\n\n\n if (blen < compressBound(size)) {\n\n return 0;\n\n }\n\n if (compress2(f->buf + f->buf_index + sizeof(int32_t), (uLongf *)&blen,\n\n (Bytef *)p, size, level) != Z_OK) {\n\n error_report(\"Compress Failed!\");\n\n return 0;\n\n }\n\n qemu_put_be32(f, blen);\n\n f->buf_index += blen;\n\n return blen + sizeof(int32_t);\n\n}\n"}} {"sample_id": "67fc07d3fba681f3362f7644a69b7a581a2670e8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n __asm__ (\"imul %0\\n\\t\"\n \n : \"=d\" (*phigh), \"=a\" (*plow)\n+\n : \"a\" (a), \"0\" (b)\n \n );", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void muls64(int64_t *phigh, int64_t *plow, int64_t a, int64_t b)\n\n{\n\n#if defined(__x86_64__)\n\n __asm__ (\"imul %0\\n\\t\"\n\n : \"=d\" (*phigh), \"=a\" (*plow)\n\n : \"a\" (a), \"0\" (b)\n\n );\n\n#else\n\n int64_t ph;\n\n uint64_t pm1, pm2, pl;\n\n\n\n pl = (uint64_t)((uint32_t)a) * (uint64_t)((uint32_t)b);\n\n pm1 = (a >> 32) * (uint32_t)b;\n\n pm2 = (uint32_t)a * (b >> 32);\n\n ph = (a >> 32) * (b >> 32);\n\n\n\n ph += (int64_t)pm1 >> 32;\n\n pm1 = (uint64_t)((uint32_t)pm1) + pm2 + (pl >> 32);\n\n\n\n *phigh = ph + ((int64_t)pm1 >> 32);\n\n *plow = (pm1 << 32) + (uint32_t)pl;\n\n#endif\n\n}\n"}} {"sample_id": "7fc3fcefe2fc5966c6aa1ef4f10e9740d8d73bf2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void qio_channel_websock_handshake_send_res_ok(QIOChannelWebsock *ioc,\n \n const char *key,\n+\n Error **errp)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void qio_channel_websock_handshake_send_res_ok(QIOChannelWebsock *ioc,\n\n const char *key,\n\n Error **errp)\n\n{\n\n char combined_key[QIO_CHANNEL_WEBSOCK_CLIENT_KEY_LEN +\n\n QIO_CHANNEL_WEBSOCK_GUID_LEN + 1];\n\n char *accept = NULL;\n\n char *date = qio_channel_websock_date_str();\n\n\n\n g_strlcpy(combined_key, key, QIO_CHANNEL_WEBSOCK_CLIENT_KEY_LEN + 1);\n\n g_strlcat(combined_key, QIO_CHANNEL_WEBSOCK_GUID,\n\n QIO_CHANNEL_WEBSOCK_CLIENT_KEY_LEN +\n\n QIO_CHANNEL_WEBSOCK_GUID_LEN + 1);\n\n\n\n /* hash and encode it */\n\n if (qcrypto_hash_base64(QCRYPTO_HASH_ALG_SHA1,\n\n combined_key,\n\n QIO_CHANNEL_WEBSOCK_CLIENT_KEY_LEN +\n\n QIO_CHANNEL_WEBSOCK_GUID_LEN,\n\n &accept,\n\n errp) < 0) {\n\n qio_channel_websock_handshake_send_res_err(\n\n ioc, QIO_CHANNEL_WEBSOCK_HANDSHAKE_RES_SERVER_ERR);\n\n return;\n\n }\n\n\n\n qio_channel_websock_handshake_send_res(\n\n ioc, QIO_CHANNEL_WEBSOCK_HANDSHAKE_RES_OK, date, accept);\n\n\n\n g_free(date);\n\n g_free(accept);\n\n}\n"}} {"sample_id": "e0706e9cc8f30a8242d2b140edace7bf76170506", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n unsigned int v = get_unary(gb, 1, 128);\n+\n+ return (v << k) | get_bits_long(gb, k);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int get_rice_un(GetBitContext *gb, int k)\n\n{\n\n unsigned int v = get_unary(gb, 1, 128);\n\n return (v << k) | get_bits_long(gb, k);\n\n}\n"}} {"sample_id": "e42349cbd6afd1f6838e719184e3d07190c02de7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n /* All 32-bit XORs can be performed with 1 48-bit insn. */\n \n+ return 1;\n+\n+ }\n+\n+\n \n /* Look for negative values. These are best to load with LGHI. */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int tcg_match_xori(TCGType type, tcg_target_long val)\n\n{\n\n if ((s390_facilities & FACILITY_EXT_IMM) == 0) {\n\n return 0;\n\n }\n\n\n\n if (type == TCG_TYPE_I32) {\n\n /* All 32-bit XORs can be performed with 1 48-bit insn. */\n\n return 1;\n\n }\n\n\n\n /* Look for negative values. These are best to load with LGHI. */\n\n if (val < 0 && val == (int32_t)val) {\n\n return 0;\n\n }\n\n\n\n return 1;\n\n}\n"}} {"sample_id": "e977ca2645cc6b23589ddf97ab08861064ba8792", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n \n \n+ if (filter->filter->uninit)\n \n filter->filter->uninit(filter);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void avfilter_free(AVFilterContext *filter)\n\n{\n\n int i;\n\n AVFilterLink *link;\n\n\n\n if (filter->filter->uninit)\n\n filter->filter->uninit(filter);\n\n\n\n for (i = 0; i < filter->input_count; i++) {\n\n if ((link = filter->inputs[i])) {\n\n if (link->src)\n\n link->src->outputs[link->srcpad - link->src->output_pads] = NULL;\n\n avfilter_formats_unref(&link->in_formats);\n\n avfilter_formats_unref(&link->out_formats);\n\n }\n\n av_freep(&link);\n\n }\n\n for (i = 0; i < filter->output_count; i++) {\n\n if ((link = filter->outputs[i])) {\n\n if (link->dst)\n\n link->dst->inputs[link->dstpad - link->dst->input_pads] = NULL;\n\n avfilter_formats_unref(&link->in_formats);\n\n avfilter_formats_unref(&link->out_formats);\n\n }\n\n av_freep(&link);\n\n }\n\n\n\n av_freep(&filter->name);\n\n av_freep(&filter->input_pads);\n\n av_freep(&filter->output_pads);\n\n av_freep(&filter->inputs);\n\n av_freep(&filter->outputs);\n\n av_freep(&filter->priv);\n\n av_free(filter);\n\n}\n"}} {"sample_id": "5029a406334ad0eaf92130e23d596e405a8a5aa0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n if(pic->data[0] && pic->type!=FF_BUFFER_TYPE_SHARED){\n \n free_frame_buffer(s, pic);\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void free_picture(MpegEncContext *s, Picture *pic){\n\n int i;\n\n\n\n if(pic->data[0] && pic->type!=FF_BUFFER_TYPE_SHARED){\n\n free_frame_buffer(s, pic);\n\n }\n\n\n\n av_freep(&pic->mb_var);\n\n av_freep(&pic->mc_mb_var);\n\n av_freep(&pic->mb_mean);\n\n av_freep(&pic->mbskip_table);\n\n av_freep(&pic->qscale_table);\n\n av_freep(&pic->mb_type_base);\n\n av_freep(&pic->dct_coeff);\n\n av_freep(&pic->pan_scan);\n\n pic->mb_type= NULL;\n\n for(i=0; i<2; i++){\n\n av_freep(&pic->motion_val_base[i]);\n\n av_freep(&pic->ref_index[i]);\n\n }\n\n\n\n if(pic->type == FF_BUFFER_TYPE_SHARED){\n\n for(i=0; i<4; i++){\n\n pic->base[i]=\n\n pic->data[i]= NULL;\n\n }\n\n pic->type= 0;\n\n }\n\n}\n"}} {"sample_id": "e7852674d5013bffd0bb8e822a7521f76677a60b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n USBNetState *s = DO_UPCAST(NICState, nc, nc)->opaque;\n+\n struct rndis_packet_msg_type *msg;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static ssize_t usbnet_receive(VLANClientState *nc, const uint8_t *buf, size_t size)\n\n{\n\n USBNetState *s = DO_UPCAST(NICState, nc, nc)->opaque;\n\n struct rndis_packet_msg_type *msg;\n\n\n\n if (is_rndis(s)) {\n\n msg = (struct rndis_packet_msg_type *) s->in_buf;\n\n if (!s->rndis_state == RNDIS_DATA_INITIALIZED)\n\n return -1;\n\n if (size + sizeof(struct rndis_packet_msg_type) > sizeof(s->in_buf))\n\n return -1;\n\n\n\n memset(msg, 0, sizeof(struct rndis_packet_msg_type));\n\n msg->MessageType = cpu_to_le32(RNDIS_PACKET_MSG);\n\n msg->MessageLength = cpu_to_le32(size + sizeof(struct rndis_packet_msg_type));\n\n msg->DataOffset = cpu_to_le32(sizeof(struct rndis_packet_msg_type) - 8);\n\n msg->DataLength = cpu_to_le32(size);\n\n /* msg->OOBDataOffset;\n\n * msg->OOBDataLength;\n\n * msg->NumOOBDataElements;\n\n * msg->PerPacketInfoOffset;\n\n * msg->PerPacketInfoLength;\n\n * msg->VcHandle;\n\n * msg->Reserved;\n\n */\n\n memcpy(msg + 1, buf, size);\n\n s->in_len = size + sizeof(struct rndis_packet_msg_type);\n\n } else {\n\n if (size > sizeof(s->in_buf))\n\n return -1;\n\n memcpy(s->in_buf, buf, size);\n\n s->in_len = size;\n\n }\n\n s->in_ptr = 0;\n\n return size;\n\n}\n"}} {"sample_id": "d87576e38df760ef1cb635197d51f207e2a8eda9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n GICv3CPUState *cs = icc_cs_from_env(env);\n \n+ uint64_t value = 0;\n \n int i;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint64_t ich_elrsr_read(CPUARMState *env, const ARMCPRegInfo *ri)\n\n{\n\n GICv3CPUState *cs = icc_cs_from_env(env);\n\n uint64_t value = 0;\n\n int i;\n\n\n\n for (i = 0; i < cs->num_list_regs; i++) {\n\n uint64_t lr = cs->ich_lr_el2[i];\n\n\n\n if ((lr & ICH_LR_EL2_STATE_MASK) == 0 &&\n\n ((lr & ICH_LR_EL2_HW) == 1 || (lr & ICH_LR_EL2_EOI) == 0)) {\n\n value |= (1 << i);\n\n }\n\n }\n\n\n\n trace_gicv3_ich_elrsr_read(gicv3_redist_affid(cs), value);\n\n return value;\n\n}\n"}} {"sample_id": "2f11aa141a01f97c5d2a015bd9dbdb27314b79c4_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n+static int vf_open(vf_instance_t *vf, char *args)\n+\n+{\n+\n+ vf->config=config;\n+\n+ vf->query_format=query_format;\n+\n+ vf->put_image=put_image;\n+\n+ vf->uninit=uninit;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-89", "target_file": "source.c", "files": {"source.c": "static int vf_open(vf_instance_t *vf, char *args)\n\n{\n\n vf->config=config;\n\n vf->query_format=query_format;\n\n vf->put_image=put_image;\n\n vf->uninit=uninit;\n\n\n\n vf->priv = calloc(1, sizeof (struct vf_priv_s));\n\n vf->priv->skipline = 0;\n\n vf->priv->scalew = 1;\n\n vf->priv->scaleh = 2;\n\n if (args) sscanf(args, \"%d:%d:%d\", &vf->priv->skipline, &vf->priv->scalew, &vf->priv->scaleh);\n\n\n\n return 1;\n\n}\n"}} {"sample_id": "026aeffcb4752054830ba203020ed6eb05bcaba8_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n uint8_t *dst,\n \n+ int dstpitch, int bltwidth,int bltheight)\n+\n {\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void cirrus_bitblt_fill_nop(CirrusVGAState *s,\n\n uint8_t *dst,\n\n int dstpitch, int bltwidth,int bltheight)\n\n{\n\n}\n"}} {"sample_id": "0b5538c300a56c3cfb33022840fe0b4968147e7a_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static bool write_header(FILE *fp)\n+\n+{\n+\n static const TraceRecord header = {\n \n .event = HEADER_EVENT_ID,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static bool write_header(FILE *fp)\n\n{\n\n static const TraceRecord header = {\n\n .event = HEADER_EVENT_ID,\n\n .timestamp_ns = HEADER_MAGIC,\n\n .x1 = HEADER_VERSION,\n\n };\n\n\n\n return fwrite(&header, sizeof header, 1, fp) == 1;\n\n}\n"}} {"sample_id": "9d40cd8a68cfc7606f4548cc9e812bab15c6dc28", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,10 +36,10 @@\n \n v7m_push(env, env->regs[3]);\n \n+ v7m_push(env, env->regs[2]);\n+\n+ v7m_push(env, env->regs[1]);\n+\n+ v7m_push(env, env->regs[0]);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void v7m_push_stack(ARMCPU *cpu)\n\n{\n\n /* Do the \"set up stack frame\" part of exception entry,\n\n * similar to pseudocode PushStack().\n\n */\n\n CPUARMState *env = &cpu->env;\n\n uint32_t xpsr = xpsr_read(env);\n\n\n\n /* Align stack pointer if the guest wants that */\n\n if ((env->regs[13] & 4) && (env->v7m.ccr & R_V7M_CCR_STKALIGN_MASK)) {\n\n env->regs[13] -= 4;\n\n xpsr |= XPSR_SPREALIGN;\n\n }\n\n /* Switch to the handler mode. */\n\n v7m_push(env, xpsr);\n\n v7m_push(env, env->regs[15]);\n\n v7m_push(env, env->regs[14]);\n\n v7m_push(env, env->regs[12]);\n\n v7m_push(env, env->regs[3]);\n\n v7m_push(env, env->regs[2]);\n\n v7m_push(env, env->regs[1]);\n\n v7m_push(env, env->regs[0]);\n\n}\n"}} {"sample_id": "548459080b1bd698a2e475e5d177b6e7d2538537", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,8 +7,8 @@\n int i, num_coeff;\n \n \n+\n+ /* Is it a skip block? */\n \n if (get_bits1(gb)) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int fic_decode_block(FICContext *ctx, GetBitContext *gb,\n\n uint8_t *dst, int stride, int16_t *block, int *is_p)\n\n{\n\n int i, num_coeff;\n\n\n\n /* Is it a skip block? */\n\n if (get_bits1(gb)) {\n\n *is_p = 1;\n\n return 0;\n\n }\n\n\n\n memset(block, 0, sizeof(*block) * 64);\n\n\n\n num_coeff = get_bits(gb, 7);\n\n if (num_coeff > 64)\n\n return AVERROR_INVALIDDATA;\n\n\n\n for (i = 0; i < num_coeff; i++)\n\n block[ff_zigzag_direct[i]] = get_se_golomb(gb) *\n\n ctx->qmat[ff_zigzag_direct[i]];\n\n\n\n fic_idct_put(dst, stride, block);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_269", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n unsigned size)\n \n {\n+\n+ HeathrowPICS *s = opaque;\n+\n+ HeathrowPIC *pic;\n+\n unsigned int n;\n \n uint32_t value;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t pic_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n HeathrowPICS *s = opaque;\n\n HeathrowPIC *pic;\n\n unsigned int n;\n\n uint32_t value;\n\n\n\n n = ((addr & 0xfff) - 0x10) >> 4;\n\n if (n >= 2) {\n\n value = 0;\n\n } else {\n\n pic = &s->pics[n];\n\n switch(addr & 0xf) {\n\n case 0x0:\n\n value = pic->events;\n\n break;\n\n case 0x4:\n\n value = pic->mask;\n\n break;\n\n case 0xc:\n\n value = pic->levels;\n\n break;\n\n default:\n\n value = 0;\n\n break;\n\n }\n\n }\n\n PIC_DPRINTF(\"readl: \" TARGET_FMT_plx \" %u: %08x\\n\", addr, n, value);\n\n return value;\n\n}\n"}} {"sample_id": "4f4321c11ff6e98583846bfd6f0e81954924b003_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,18 +1,18 @@\n static int usb_net_handle_statusin(USBNetState *s, USBPacket *p)\n \n+{\n+\n+ int ret = 8;\n \n+\n \n+ if (p->len < 8)\n+\n+ return USB_RET_STALL;\n+\n+\n \n+ ((le32 *) p->data)[0] = cpu_to_le32(1);\n \n ((le32 *) p->data)[1] = cpu_to_le32(0);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int usb_net_handle_statusin(USBNetState *s, USBPacket *p)\n\n{\n\n int ret = 8;\n\n\n\n if (p->len < 8)\n\n return USB_RET_STALL;\n\n\n\n ((le32 *) p->data)[0] = cpu_to_le32(1);\n\n ((le32 *) p->data)[1] = cpu_to_le32(0);\n\n if (!s->rndis_resp.tqh_first)\n\n ret = USB_RET_NAK;\n\n\n\n#ifdef TRAFFIC_DEBUG\n\n fprintf(stderr, \"usbnet: interrupt poll len %u return %d\", p->len, ret);\n\n {\n\n int i;\n\n fprintf(stderr, \":\");\n\n for (i = 0; i < ret; i++) {\n\n if (!(i & 15))\n\n fprintf(stderr, \"\\n%04x:\", i);\n\n fprintf(stderr, \" %02x\", p->data[i]);\n\n }\n\n fprintf(stderr, \"\\n\\n\");\n\n }\n\n#endif\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "b09ea7d55cfab5a75912bb56ed1fcd757604a759_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n \n \n s->apicbase = 0xfee00000 |\n+\n+ (bsp ? MSR_IA32_APICBASE_BSP : 0) | MSR_IA32_APICBASE_ENABLE;\n+\n+\n+\n apic_init_ipi(s);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void apic_reset(void *opaque)\n\n{\n\n APICState *s = opaque;\n\n int bsp = cpu_is_bsp(s->cpu_env);\n\n\n\n s->apicbase = 0xfee00000 |\n\n (bsp ? MSR_IA32_APICBASE_BSP : 0) | MSR_IA32_APICBASE_ENABLE;\n\n\n\n apic_init_ipi(s);\n\n\n\n if (bsp) {\n\n /*\n\n * LINT0 delivery mode on CPU #0 is set to ExtInt at initialization\n\n * time typically by BIOS, so PIC interrupt can be delivered to the\n\n * processor when local APIC is enabled.\n\n */\n\n s->lvt[APIC_LVT_LINT0] = 0x700;\n\n }\n\n}\n"}} {"sample_id": "32bafa8fdd098d52fbf1102d5a5e48d29398c0aa_19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -39,11 +39,11 @@\n tcp_chr_disconnect(chr);\n \n }\n+\n+ object_unref(OBJECT(s->ioc));\n+\n+ s->ioc = QIO_CHANNEL(tioc);\n+\n \n \n qio_channel_tls_handshake(tioc,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void tcp_chr_tls_init(CharDriverState *chr)\n\n{\n\n TCPCharDriver *s = chr->opaque;\n\n QIOChannelTLS *tioc;\n\n Error *err = NULL;\n\n\n\n if (s->is_listen) {\n\n tioc = qio_channel_tls_new_server(\n\n s->ioc, s->tls_creds,\n\n NULL, /* XXX Use an ACL */\n\n &err);\n\n } else {\n\n tioc = qio_channel_tls_new_client(\n\n s->ioc, s->tls_creds,\n\n s->addr->u.inet->host,\n\n &err);\n\n }\n\n if (tioc == NULL) {\n\n error_free(err);\n\n tcp_chr_disconnect(chr);\n\n }\n\n object_unref(OBJECT(s->ioc));\n\n s->ioc = QIO_CHANNEL(tioc);\n\n\n\n qio_channel_tls_handshake(tioc,\n\n tcp_chr_tls_handshake,\n\n chr,\n\n NULL);\n\n}\n"}} {"sample_id": "d5e6f437c5508614803d11e59ee16a758dde09ef", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n .opaque = opaque,\n \n };\n+\n+\n+\n+ bdrv_replace_child(child, child_bs);\n+\n \n \n return child;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,\n\n const char *child_name,\n\n const BdrvChildRole *child_role,\n\n void *opaque)\n\n{\n\n BdrvChild *child = g_new(BdrvChild, 1);\n\n *child = (BdrvChild) {\n\n .bs = NULL,\n\n .name = g_strdup(child_name),\n\n .role = child_role,\n\n .opaque = opaque,\n\n };\n\n\n\n bdrv_replace_child(child, child_bs);\n\n\n\n return child;\n\n}\n"}} {"sample_id": "2c0ef9f411ae6081efa9eca5b3eab2dbeee45a6c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n v->visitor.type_bool = qapi_dealloc_type_bool;\n \n v->visitor.type_str = qapi_dealloc_type_str;\n+\n+ v->visitor.type_number = qapi_dealloc_type_number;\n+\n+ v->visitor.type_any = qapi_dealloc_type_anything;\n+\n v->visitor.type_null = qapi_dealloc_type_null;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "QapiDeallocVisitor *qapi_dealloc_visitor_new(void)\n\n{\n\n QapiDeallocVisitor *v;\n\n\n\n v = g_malloc0(sizeof(*v));\n\n\n\n v->visitor.type = VISITOR_DEALLOC;\n\n v->visitor.start_struct = qapi_dealloc_start_struct;\n\n v->visitor.end_struct = qapi_dealloc_end_struct;\n\n v->visitor.start_alternate = qapi_dealloc_start_alternate;\n\n v->visitor.end_alternate = qapi_dealloc_end_alternate;\n\n v->visitor.start_list = qapi_dealloc_start_list;\n\n v->visitor.next_list = qapi_dealloc_next_list;\n\n v->visitor.end_list = qapi_dealloc_end_list;\n\n v->visitor.type_int64 = qapi_dealloc_type_int64;\n\n v->visitor.type_uint64 = qapi_dealloc_type_uint64;\n\n v->visitor.type_bool = qapi_dealloc_type_bool;\n\n v->visitor.type_str = qapi_dealloc_type_str;\n\n v->visitor.type_number = qapi_dealloc_type_number;\n\n v->visitor.type_any = qapi_dealloc_type_anything;\n\n v->visitor.type_null = qapi_dealloc_type_null;\n\n\n\n return v;\n\n}\n"}} {"sample_id": "e668d1b8545f1c79cf869bd78813cb1e52216f45", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void build_guest_fsinfo_for_virtual_device(char const *syspath,\n \n GuestFilesystemInfo *fs,\n+\n Error **errp)\n \n {\n@@ -9,20 +9,20 @@\n DIR *dir;\n \n char *dirpath;\n+\n struct dirent entry, *result;\n+\n+\n+\n dirpath = g_strdup_printf(\"%s/slaves\", syspath);\n+\n dir = opendir(dirpath);\n \n+ if (!dir) {\n+\n+ error_setg_errno(errp, errno, \"opendir(\\\"%s\\\")\", dirpath);\n+\n+ g_free(dirpath);\n \n return;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void build_guest_fsinfo_for_virtual_device(char const *syspath,\n\n GuestFilesystemInfo *fs,\n\n Error **errp)\n\n{\n\n DIR *dir;\n\n char *dirpath;\n\n struct dirent entry, *result;\n\n\n\n dirpath = g_strdup_printf(\"%s/slaves\", syspath);\n\n dir = opendir(dirpath);\n\n if (!dir) {\n\n error_setg_errno(errp, errno, \"opendir(\\\"%s\\\")\", dirpath);\n\n g_free(dirpath);\n\n return;\n\n }\n\n g_free(dirpath);\n\n\n\n for (;;) {\n\n if (readdir_r(dir, &entry, &result) != 0) {\n\n error_setg_errno(errp, errno, \"readdir_r(\\\"%s\\\")\", dirpath);\n\n break;\n\n }\n\n if (!result) {\n\n break;\n\n }\n\n\n\n if (entry.d_type == DT_LNK) {\n\n g_debug(\" slave device '%s'\", entry.d_name);\n\n dirpath = g_strdup_printf(\"%s/slaves/%s\", syspath, entry.d_name);\n\n build_guest_fsinfo_for_device(dirpath, fs, errp);\n\n g_free(dirpath);\n\n\n\n if (*errp) {\n\n break;\n\n }\n\n }\n\n }\n\n\n\n closedir(dir);\n\n}\n"}} {"sample_id": "a89f364ae8740dfc31b321eed9ee454e996dc3c1_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void bt_dummy_lmp_acl_resp(struct bt_link_s *link,\n+\n+ const uint8_t *data, int start, int len)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bt_dummy_lmp_acl_resp(struct bt_link_s *link,\n\n const uint8_t *data, int start, int len)\n\n{\n\n fprintf(stderr, \"%s: stray ACL response PDU, fixme\\n\", __FUNCTION__);\n\n exit(-1);\n\n}\n"}} {"sample_id": "b9c8388710a06544812739eedc0a40d3451491dc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void *av_mallocz_static(unsigned int size)\n+\n+{\n+\n+ void *ptr = av_mallocz(size);\n+\n \n+\n if(ptr){\n \n array_static =av_fast_realloc(array_static, &allocated_static, sizeof(void*)*(last_static+1));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void *av_mallocz_static(unsigned int size)\n\n{\n\n void *ptr = av_mallocz(size);\n\n\n\n if(ptr){\n\n array_static =av_fast_realloc(array_static, &allocated_static, sizeof(void*)*(last_static+1));\n\n if(!array_static)\n\n return NULL;\n\n array_static[last_static++] = ptr;\n\n }\n\n\n\n return ptr;\n\n}\n"}} {"sample_id": "445f0a8b666a34e6402f6ae96c6804c8bc024baa", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n int avcodec_check_dimensions(void *av_log_ctx, unsigned int w, unsigned int h){\n+\n+ if((int)w>0 && (int)h>0 && (w+128)*(uint64_t)(h+128) < INT_MAX/4)\n+\n return 0;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int avcodec_check_dimensions(void *av_log_ctx, unsigned int w, unsigned int h){\n\n if((int)w>0 && (int)h>0 && (w+128)*(uint64_t)(h+128) < INT_MAX/4)\n\n return 0;\n\n\n\n av_log(av_log_ctx, AV_LOG_ERROR, \"picture size invalid (%ux%u)\\n\", w, h);\n\n return -1;\n\n}\n"}} {"sample_id": "cb45de6798956975c4b13a6233f7a00d2239b61a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,12 +8,12 @@\n \n int64_t val;\n \n+ char *endptr;\n+\n+\n \n opt = lookup_scalar(ov, name, errp);\n+\n if (!opt) {\n \n return;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "opts_type_size(Visitor *v, uint64_t *obj, const char *name, Error **errp)\n\n{\n\n OptsVisitor *ov = DO_UPCAST(OptsVisitor, visitor, v);\n\n const QemuOpt *opt;\n\n int64_t val;\n\n char *endptr;\n\n\n\n opt = lookup_scalar(ov, name, errp);\n\n if (!opt) {\n\n return;\n\n }\n\n\n\n val = strtosz_suffix(opt->str ? opt->str : \"\", &endptr,\n\n STRTOSZ_DEFSUFFIX_B);\n\n if (val != -1 && *endptr == '\\0') {\n\n *obj = val;\n\n processed(ov, name);\n\n return;\n\n }\n\n error_set(errp, QERR_INVALID_PARAMETER_VALUE, opt->name,\n\n \"a size value representible as a non-negative int64\");\n\n}\n"}} {"sample_id": "92e483f8ed70d88d4f64337f65bae212502735d4_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int cmp(const void *a, const void *b)\n+\n+{\n \n const double va = *(const double *)a, vb = *(const double *)b;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int cmp(const void *a, const void *b)\n\n{\n\n const double va = *(const double *)a, vb = *(const double *)b;\n\n return va < vb ? -1 : ( va > vb ? 1 : 0 );\n\n}\n"}} {"sample_id": "f2d089425d43735b5369f70f3a36b712440578e5_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n if (mr->subpage) {\n \n+ trace_memory_region_subpage_write(get_cpu_index(), mr, addr, tmp, size);\n+\n+\n+\n+\n \n \n } else if (TRACE_MEMORY_REGION_OPS_WRITE_ENABLED) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static MemTxResult memory_region_write_with_attrs_accessor(MemoryRegion *mr,\n\n hwaddr addr,\n\n uint64_t *value,\n\n unsigned size,\n\n unsigned shift,\n\n uint64_t mask,\n\n MemTxAttrs attrs)\n\n{\n\n uint64_t tmp;\n\n\n\n tmp = (*value >> shift) & mask;\n\n if (mr->subpage) {\n\n trace_memory_region_subpage_write(get_cpu_index(), mr, addr, tmp, size);\n\n\n\n\n\n\n } else if (TRACE_MEMORY_REGION_OPS_WRITE_ENABLED) {\n\n hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);\n\n trace_memory_region_ops_write(get_cpu_index(), mr, abs_addr, tmp, size);\n\n }\n\n return mr->ops->write_with_attrs(mr->opaque, addr, tmp, size, attrs);\n\n}"}} {"sample_id": "d41f3e750d2c06c613cb1b8db7724f0fbc0a2b14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n int mapped_node_id; /* set by -numa option */\n \n+ int node_id = object_property_get_int(OBJECT(dev), \"node-id\", &error_abort);\n+\n+\n+\n+ /* by default CPUState::numa_node was 0 if it wasn't set explicitly\n \n * TODO: make it error when incomplete numa mapping support is removed\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void numa_cpu_pre_plug(const CPUArchId *slot, DeviceState *dev, Error **errp)\n\n{\n\n int mapped_node_id; /* set by -numa option */\n\n int node_id = object_property_get_int(OBJECT(dev), \"node-id\", &error_abort);\n\n\n\n /* by default CPUState::numa_node was 0 if it wasn't set explicitly\n\n * TODO: make it error when incomplete numa mapping support is removed\n\n */\n\n mapped_node_id = slot->props.node_id;\n\n if (!slot->props.has_node_id) {\n\n mapped_node_id = 0;\n\n }\n\n\n\n if (node_id == CPU_UNSET_NUMA_NODE_ID) {\n\n /* due to bug in libvirt, it doesn't pass node-id from props on\n\n * device_add as expected, so we have to fix it up here */\n\n object_property_set_int(OBJECT(dev), mapped_node_id, \"node-id\", errp);\n\n } else if (node_id != mapped_node_id) {\n\n error_setg(errp, \"node-id=%d must match numa node specified \"\n\n \"with -numa option\", node_id);\n\n }\n\n}\n"}} {"sample_id": "6f2d8978728c48ca46f5c01835438508aace5c64_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void OPPROTO op_divw (void)\n+\n+{\n \n if (unlikely(((int32_t)T0 == INT32_MIN && (int32_t)T1 == -1) ||\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void OPPROTO op_divw (void)\n\n{\n\n if (unlikely(((int32_t)T0 == INT32_MIN && (int32_t)T1 == -1) ||\n\n (int32_t)T1 == 0)) {\n\n T0 = (int32_t)((-1) * ((uint32_t)T0 >> 31));\n\n } else {\n\n T0 = (int32_t)T0 / (int32_t)T1;\n\n }\n\n RETURN();\n\n}\n"}} {"sample_id": "2c62f08ddbf3fa80dc7202eb9a2ea60ae44e2cc5_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n {\n \n PCIQXLDevice *qxl = opaque;\n+\n+ VGACommonState *vga = &qxl->vga;\n+\n+\n+\n switch (qxl->mode) {\n \n case QXL_MODE_COMPAT:", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qxl_hw_screen_dump(void *opaque, const char *filename, bool cswitch,\n\n Error **errp)\n\n{\n\n PCIQXLDevice *qxl = opaque;\n\n VGACommonState *vga = &qxl->vga;\n\n\n\n switch (qxl->mode) {\n\n case QXL_MODE_COMPAT:\n\n case QXL_MODE_NATIVE:\n\n qxl_render_update(qxl);\n\n ppm_save(filename, qxl->ssd.ds, errp);\n\n break;\n\n case QXL_MODE_VGA:\n\n vga->screen_dump(vga, filename, cswitch, errp);\n\n break;\n\n default:\n\n break;\n\n }\n\n}\n"}} {"sample_id": "9bada8971173345ceb37ed1a47b00a01a4dd48cf_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static QObject *parser_context_peek_token(JSONParserContext *ctxt)\n+\n+{\n \n assert(!g_queue_is_empty(ctxt->buf));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static QObject *parser_context_peek_token(JSONParserContext *ctxt)\n\n{\n\n assert(!g_queue_is_empty(ctxt->buf));\n\n return g_queue_peek_head(ctxt->buf);\n\n}\n"}} {"sample_id": "c29c1dd312f39ec18a3c6177c6da09a75e095d70", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n if (len < 0) {\n error_setg_errno(errp, -len, \"unable to get length for '%s'\",\n BackupBlockJob *job = block_job_create(&backup_job_driver, bs, speed,\n+ cb, opaque, errp);\n+ if (!job) {\n+ bdrv_op_block_all(target, job->common.blocker);\n+ job->on_source_error = on_source_error;\n+ job->on_target_error = on_target_error;\n job->target = target;\n job->sync_mode = sync_mode;\n job->common.len = len;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void backup_start(BlockDriverState *bs, BlockDriverState *target,\n int64_t speed, MirrorSyncMode sync_mode,\n BlockdevOnError on_source_error,\n BlockdevOnError on_target_error,\n BlockCompletionFunc *cb, void *opaque,\n Error **errp)\n{\n int64_t len;\n assert(bs);\n assert(target);\n assert(cb);\n if (bs == target) {\n error_setg(errp, \"Source and target cannot be the same\");\n if ((on_source_error == BLOCKDEV_ON_ERROR_STOP ||\n on_source_error == BLOCKDEV_ON_ERROR_ENOSPC) &&\n !bdrv_iostatus_is_enabled(bs)) {\n error_set(errp, QERR_INVALID_PARAMETER, \"on-source-error\");\n len = bdrv_getlength(bs);\n if (len < 0) {\n error_setg_errno(errp, -len, \"unable to get length for '%s'\",\n BackupBlockJob *job = block_job_create(&backup_job_driver, bs, speed,\n cb, opaque, errp);\n if (!job) {\n bdrv_op_block_all(target, job->common.blocker);\n job->on_source_error = on_source_error;\n job->on_target_error = on_target_error;\n job->target = target;\n job->sync_mode = sync_mode;\n job->common.len = len;\n job->common.co = qemu_coroutine_create(backup_run);\n qemu_coroutine_enter(job->common.co, job);"}} {"sample_id": "28dc6e729137ba7927f46ba15c337417b8708fe8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n int c0, c1, c2, c3, a0, a1, a2, a3;\n \n+\n+\n a0 = col[8*0];\n \n a1 = col[8*2];", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void idct4col_put(uint8_t *dest, int line_size, const int16_t *col)\n\n{\n\n int c0, c1, c2, c3, a0, a1, a2, a3;\n\n\n\n a0 = col[8*0];\n\n a1 = col[8*2];\n\n a2 = col[8*4];\n\n a3 = col[8*6];\n\n c0 = ((a0 + a2) << (CN_SHIFT - 1)) + (1 << (C_SHIFT - 1));\n\n c2 = ((a0 - a2) << (CN_SHIFT - 1)) + (1 << (C_SHIFT - 1));\n\n c1 = a1 * C1 + a3 * C2;\n\n c3 = a1 * C2 - a3 * C1;\n\n dest[0] = av_clip_uint8((c0 + c1) >> C_SHIFT);\n\n dest += line_size;\n\n dest[0] = av_clip_uint8((c2 + c3) >> C_SHIFT);\n\n dest += line_size;\n\n dest[0] = av_clip_uint8((c2 - c3) >> C_SHIFT);\n\n dest += line_size;\n\n dest[0] = av_clip_uint8((c0 - c1) >> C_SHIFT);\n\n}\n"}} {"sample_id": "f20b67173ca6a05b8c3dee02dad3b7243b96292b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,5 +7,5 @@\n for (i = 0; i < num; i++)\n \n arr[i] = (float)cof[i]/INT32_MAX;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void conv_to_float(float *arr, int32_t *cof, int num)\n\n{\n\n int i;\n\n for (i = 0; i < num; i++)\n\n arr[i] = (float)cof[i]/INT32_MAX;\n\n}\n"}} {"sample_id": "73034e9e087aa51b85cf86b6c81ef92f7e1e9d09", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n AddressSpace *as = memory_region_to_address_space(address_space);\n \n AddrRange range = addrrange_make(int128_make64(addr),\n+\n+ int128_make64(size));\n+\n+ FlatRange *fr = address_space_lookup(as, range);\n+\n MemoryRegionSection ret = { .mr = NULL, .size = 0 };\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "MemoryRegionSection memory_region_find(MemoryRegion *address_space,\n\n hwaddr addr, uint64_t size)\n\n{\n\n AddressSpace *as = memory_region_to_address_space(address_space);\n\n AddrRange range = addrrange_make(int128_make64(addr),\n\n int128_make64(size));\n\n FlatRange *fr = address_space_lookup(as, range);\n\n MemoryRegionSection ret = { .mr = NULL, .size = 0 };\n\n\n\n if (!fr) {\n\n return ret;\n\n }\n\n\n\n while (fr > as->current_map->ranges\n\n && addrrange_intersects(fr[-1].addr, range)) {\n\n --fr;\n\n }\n\n\n\n ret.mr = fr->mr;\n\n range = addrrange_intersection(range, fr->addr);\n\n ret.offset_within_region = fr->offset_in_region;\n\n ret.offset_within_region += int128_get64(int128_sub(range.start,\n\n fr->addr.start));\n\n ret.size = int128_get64(range.size);\n\n ret.offset_within_address_space = int128_get64(range.start);\n\n ret.readonly = fr->readonly;\n\n return ret;\n\n}\n"}} {"sample_id": "a726d7fd4e0b112b276678ea9da9c9b3097e8b8f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n (o = c->opt_find(obj, name, unit, opt_flags, search_flags)))\n \n+ return o;\n+\n+\n+\n+ while (o = av_next_option(obj, o)) {\n \n if (!strcmp(o->name, name) && (!unit || (o->unit && !strcmp(o->unit, unit))) &&\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "const AVOption *av_opt_find(void *obj, const char *name, const char *unit,\n\n int opt_flags, int search_flags)\n\n{\n\n AVClass *c = *(AVClass**)obj;\n\n const AVOption *o = NULL;\n\n\n\n if (c->opt_find && search_flags & AV_OPT_SEARCH_CHILDREN &&\n\n (o = c->opt_find(obj, name, unit, opt_flags, search_flags)))\n\n return o;\n\n\n\n while (o = av_next_option(obj, o)) {\n\n if (!strcmp(o->name, name) && (!unit || (o->unit && !strcmp(o->unit, unit))) &&\n\n (o->flags & opt_flags) == opt_flags)\n\n return o;\n\n }\n\n return NULL;\n\n}\n"}} {"sample_id": "5a0f6b099f3e8fcb95a80e3ffe52b3bf369efe24", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static unsigned char get_ref_idx(AVFrame *frame)\n \n+{\n+\n+ FrameDecodeData *fdd;\n+\n+ NVDECFrame *cf;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static unsigned char get_ref_idx(AVFrame *frame)\n\n{\n\n FrameDecodeData *fdd;\n\n NVDECFrame *cf;\n\n\n\n if (!frame || !frame->private_ref)\n\n return 255;\n\n\n\n fdd = (FrameDecodeData*)frame->private_ref->data;\n\n cf = (NVDECFrame*)fdd->hwaccel_priv;\n\n\n\n return cf->idx;\n\n}\n"}} {"sample_id": "acfb23ad3dd8d0ab385a10e483776ba7dcf927ad_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void wait_for_aio(void)\n \n {\n+\n+ while (aio_poll(ctx, true)) {\n \n /* Do nothing */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void wait_for_aio(void)\n\n{\n\n while (aio_poll(ctx, true)) {\n\n /* Do nothing */\n\n }\n\n}\n"}} {"sample_id": "1e7398a140f7a6bd9f5a438e7ad0f1ef50990e25_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+bool vhost_dev_query(struct vhost_dev *hdev, VirtIODevice *vdev)\n+\n+{\n+\n+ BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));\n \n VirtioBusState *vbus = VIRTIO_BUS(qbus);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-89", "target_file": "source.c", "files": {"source.c": "bool vhost_dev_query(struct vhost_dev *hdev, VirtIODevice *vdev)\n\n{\n\n BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));\n\n VirtioBusState *vbus = VIRTIO_BUS(qbus);\n\n VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(vbus);\n\n\n\n return !k->query_guest_notifiers ||\n\n k->query_guest_notifiers(qbus->parent) ||\n\n hdev->force;\n\n}\n"}} {"sample_id": "909a196d2754388d3b15a34b688095c655792124", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n uint32_t r;\n+\n+\n+\n+ r = fdt_get_phandle(fdt, findnode_nofail(fdt, path));\n+\n if (r <= 0) {\n \n fprintf(stderr, \"%s: Couldn't get phandle for %s: %s\\n\", __func__,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint32_t qemu_devtree_get_phandle(void *fdt, const char *path)\n\n{\n\n uint32_t r;\n\n\n\n r = fdt_get_phandle(fdt, findnode_nofail(fdt, path));\n\n if (r <= 0) {\n\n fprintf(stderr, \"%s: Couldn't get phandle for %s: %s\\n\", __func__,\n\n path, fdt_strerror(r));\n\n exit(1);\n\n }\n\n\n\n return r;\n\n}\n"}} {"sample_id": "51daafb02eaf96e0743a37ce95a7f5d02c1fa3c2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static av_noinline void emulated_edge_mc_sse(uint8_t * buf,const uint8_t *src,\n+\n ptrdiff_t buf_stride,\n \n ptrdiff_t src_stride,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static av_noinline void emulated_edge_mc_sse(uint8_t * buf,const uint8_t *src,\n\n ptrdiff_t buf_stride,\n\n ptrdiff_t src_stride,\n\n int block_w, int block_h,\n\n int src_x, int src_y, int w, int h)\n\n{\n\n emulated_edge_mc(buf, src, buf_stride, src_stride, block_w, block_h,\n\n src_x, src_y, w, h, vfixtbl_sse, &ff_emu_edge_vvar_sse,\n\n hfixtbl_sse, &ff_emu_edge_hvar_sse);\n\n}\n"}} {"sample_id": "60819e694ee5733741da91ebc237b20621de5bc3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,6 +3,6 @@\n IVI5DecContext *ctx = avctx->priv_data;\n ff_ivi_free_buffers(&ctx->planes[0]);\n if (ctx->frame.data[0])\n+ avctx->release_buffer(avctx, &ctx->frame);\n+ return 0;\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static av_cold int decode_close(AVCodecContext *avctx)\n{\n IVI5DecContext *ctx = avctx->priv_data;\n ff_ivi_free_buffers(&ctx->planes[0]);\n if (ctx->frame.data[0])\n avctx->release_buffer(avctx, &ctx->frame);\n return 0;\n}"}} {"sample_id": "4a9f9cb24de52e93aae7539a004dd20314ca1c0c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,5 +7,5 @@\n float32 f1 = make_float32(b);\n \n return (float32_compare_quiet(f0, f1, NFS) == -1) ? a : b;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint32_t HELPER(neon_min_f32)(uint32_t a, uint32_t b)\n\n{\n\n float32 f0 = make_float32(a);\n\n float32 f1 = make_float32(b);\n\n return (float32_compare_quiet(f0, f1, NFS) == -1) ? a : b;\n\n}\n"}} {"sample_id": "6a5b69a959483c7404576a7dc54221ced41e6515_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,9 +9,9 @@\n int overflow = 0;\n \n int64_t x0;\n+\n+ int32_t x1;\n+\n \n \n x0 = (a & 0xffffffff) | ((int64_t) (env->y) << 32);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static target_ulong helper_sdiv_common(CPUSPARCState *env, target_ulong a,\n\n target_ulong b, int cc)\n\n{\n\n SPARCCPU *cpu = sparc_env_get_cpu(env);\n\n int overflow = 0;\n\n int64_t x0;\n\n int32_t x1;\n\n\n\n x0 = (a & 0xffffffff) | ((int64_t) (env->y) << 32);\n\n x1 = (b & 0xffffffff);\n\n\n\n if (x1 == 0) {\n\n cpu_restore_state(CPU(cpu), GETPC());\n\n helper_raise_exception(env, TT_DIV_ZERO);\n\n }\n\n\n\n x0 = x0 / x1;\n\n if ((int32_t) x0 != x0) {\n\n x0 = x0 < 0 ? 0x80000000 : 0x7fffffff;\n\n overflow = 1;\n\n }\n\n\n\n if (cc) {\n\n env->cc_dst = x0;\n\n env->cc_src2 = overflow;\n\n env->cc_op = CC_OP_DIV;\n\n }\n\n return x0;\n\n}\n"}} {"sample_id": "6359872877269fa0c1874587676e952d30f9b79f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+ogm_dshow_header(AVFormatContext *s, int idx)\n+{\n+ struct ogg *ogg = s->priv_data;\n+ struct ogg_stream *os = ogg->streams + idx;\n+ AVStream *st = s->streams[idx];\n uint8_t *p = os->buf + os->pstart;\n uint32_t t;\n if(!(*p & 1))", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "ogm_dshow_header(AVFormatContext *s, int idx)\n{\n struct ogg *ogg = s->priv_data;\n struct ogg_stream *os = ogg->streams + idx;\n AVStream *st = s->streams[idx];\n uint8_t *p = os->buf + os->pstart;\n uint32_t t;\n if(!(*p & 1))\n return 0;\n if(*p != 1)\n return 1;\n t = AV_RL32(p + 96);\n if(t == 0x05589f80){\n st->codec->codec_type = AVMEDIA_TYPE_VIDEO;\n st->codec->codec_id = ff_codec_get_id(ff_codec_bmp_tags, AV_RL32(p + 68));\n avpriv_set_pts_info(st, 64, AV_RL64(p + 164), 10000000);\n st->codec->width = AV_RL32(p + 176);\n st->codec->height = AV_RL32(p + 180);\n } else if(t == 0x05589f81){\n st->codec->codec_type = AVMEDIA_TYPE_AUDIO;\n st->codec->codec_id = ff_codec_get_id(ff_codec_wav_tags, AV_RL16(p + 124));\n st->codec->channels = AV_RL16(p + 126);\n st->codec->sample_rate = AV_RL32(p + 128);\n st->codec->bit_rate = AV_RL32(p + 132) * 8;\n }\n return 1;\n}"}} {"sample_id": "13f1c773640171efa8175b1ba6dcd624c1ad68c1_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -53,11 +53,11 @@\n kernel_filename);\n \n exit(1);\n+\n+ }\n+\n+ cpu->env.pc = entry;\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void cpu_openrisc_load_kernel(ram_addr_t ram_size,\n\n const char *kernel_filename,\n\n OpenRISCCPU *cpu)\n\n{\n\n long kernel_size;\n\n uint64_t elf_entry;\n\n hwaddr entry;\n\n\n\n if (kernel_filename && !qtest_enabled()) {\n\n kernel_size = load_elf(kernel_filename, NULL, NULL,\n\n &elf_entry, NULL, NULL, 1, EM_OPENRISC,\n\n 1, 0);\n\n entry = elf_entry;\n\n if (kernel_size < 0) {\n\n kernel_size = load_uimage(kernel_filename,\n\n &entry, NULL, NULL, NULL, NULL);\n\n }\n\n if (kernel_size < 0) {\n\n kernel_size = load_image_targphys(kernel_filename,\n\n KERNEL_LOAD_ADDR,\n\n ram_size - KERNEL_LOAD_ADDR);\n\n entry = KERNEL_LOAD_ADDR;\n\n }\n\n\n\n if (kernel_size < 0) {\n\n fprintf(stderr, \"QEMU: couldn't load the kernel '%s'\\n\",\n\n kernel_filename);\n\n exit(1);\n\n }\n\n cpu->env.pc = entry;\n\n }\n\n}\n"}} {"sample_id": "62a2554ec2630896d1299e1a282a64c7f3b00da0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n \n \n+ ret = cds_check_len(cds, len);\n+\n+ if (ret <= 0) {\n+\n+ return ret;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int ccw_dstream_rw_noflags(CcwDataStream *cds, void *buff, int len,\n\n CcwDataStreamOp op)\n\n{\n\n int ret;\n\n\n\n ret = cds_check_len(cds, len);\n\n if (ret <= 0) {\n\n return ret;\n\n\n\n\n\n if (op == CDS_OP_A) {\n\n goto incr;\n\n\n ret = address_space_rw(&address_space_memory, cds->cda,\n\n MEMTXATTRS_UNSPECIFIED, buff, len, op);\n\n if (ret != MEMTX_OK) {\n\n cds->flags |= CDS_F_STREAM_BROKEN;\n\n return -EINVAL;\n\n\nincr:\n\n cds->at_byte += len;\n\n cds->cda += len;\n\n return 0;\n"}} {"sample_id": "e3f5ec2b5e92706e3b807059f79b1fb5d936e567_17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n \treturn;\n \n \n+\n+ rc = netdev->rx_ring.req_cons;\n+\n+ rp = netdev->rx_ring.sring->req_prod;\n+\n xen_rmb(); /* Ensure we see queued requests up to 'rp'. */\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void net_rx_packet(void *opaque, const uint8_t *buf, size_t size)\n\n{\n\n struct XenNetDev *netdev = opaque;\n\n netif_rx_request_t rxreq;\n\n RING_IDX rc, rp;\n\n void *page;\n\n\n\n if (netdev->xendev.be_state != XenbusStateConnected)\n\n\treturn;\n\n\n\n rc = netdev->rx_ring.req_cons;\n\n rp = netdev->rx_ring.sring->req_prod;\n\n xen_rmb(); /* Ensure we see queued requests up to 'rp'. */\n\n\n\n if (rc == rp || RING_REQUEST_CONS_OVERFLOW(&netdev->rx_ring, rc)) {\n\n\txen_be_printf(&netdev->xendev, 2, \"no buffer, drop packet\\n\");\n\n\treturn;\n\n }\n\n if (size > XC_PAGE_SIZE - NET_IP_ALIGN) {\n\n\txen_be_printf(&netdev->xendev, 0, \"packet too big (%lu > %ld)\",\n\n\t\t (unsigned long)size, XC_PAGE_SIZE - NET_IP_ALIGN);\n\n\treturn;\n\n }\n\n\n\n memcpy(&rxreq, RING_GET_REQUEST(&netdev->rx_ring, rc), sizeof(rxreq));\n\n netdev->rx_ring.req_cons = ++rc;\n\n\n\n page = xc_gnttab_map_grant_ref(netdev->xendev.gnttabdev,\n\n\t\t\t\t netdev->xendev.dom,\n\n\t\t\t\t rxreq.gref, PROT_WRITE);\n\n if (page == NULL) {\n\n\txen_be_printf(&netdev->xendev, 0, \"error: rx gref dereference failed (%d)\\n\",\n\n rxreq.gref);\n\n\tnet_rx_response(netdev, &rxreq, NETIF_RSP_ERROR, 0, 0, 0);\n\n\treturn;\n\n }\n\n memcpy(page + NET_IP_ALIGN, buf, size);\n\n xc_gnttab_munmap(netdev->xendev.gnttabdev, page, 1);\n\n net_rx_response(netdev, &rxreq, NETIF_RSP_OKAY, NET_IP_ALIGN, size, 0);\n\n}\n"}} {"sample_id": "297a3646c2947ee64a6d42ca264039732c6218e0_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,16 +1,16 @@\n void visit_type_int32(Visitor *v, int32_t *obj, const char *name, Error **errp)\n \n+{\n+\n+ int64_t value;\n \n+ if (!error_is_set(errp)) {\n+\n+ if (v->type_int32) {\n+\n v->type_int32(v, obj, name, errp);\n \n+ } else {\n \n value = *obj;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void visit_type_int32(Visitor *v, int32_t *obj, const char *name, Error **errp)\n\n{\n\n int64_t value;\n\n if (!error_is_set(errp)) {\n\n if (v->type_int32) {\n\n v->type_int32(v, obj, name, errp);\n\n } else {\n\n value = *obj;\n\n v->type_int(v, &value, name, errp);\n\n if (value < INT32_MIN || value > INT32_MAX) {\n\n error_set(errp, QERR_INVALID_PARAMETER_VALUE, name ? name : \"null\",\n\n \"int32_t\");\n\n return;\n\n }\n\n *obj = value;\n\n }\n\n }\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_33", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n {\n \n ThreadPool *pool = opaque;\n+\n+\n+\n qemu_mutex_lock(&pool->lock);\n \n do_spawn_thread(pool);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void spawn_thread_bh_fn(void *opaque)\n\n{\n\n ThreadPool *pool = opaque;\n\n\n\n qemu_mutex_lock(&pool->lock);\n\n do_spawn_thread(pool);\n\n qemu_mutex_unlock(&pool->lock);\n\n}\n"}} {"sample_id": "7385ac0ba2456159a52b9b2cbb5f6c71921d0c23", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n if (unlikely(!(env->fpu->fcr0 & (1 << FCR0_3D))))\n+\n+ generate_exception(ctx, EXCP_RI);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static always_inline void check_cp1_3d(CPUState *env, DisasContext *ctx)\n\n{\n\n if (unlikely(!(env->fpu->fcr0 & (1 << FCR0_3D))))\n\n generate_exception(ctx, EXCP_RI);\n\n}\n"}} {"sample_id": "bdd81addf4033ce26e6cd180b060f63095f3ded9_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n VFIOQuirk *quirk;\n \n+\n \n /*\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void vfio_vga_probe_ati_3c3_quirk(VFIOPCIDevice *vdev)\n\n{\n\n VFIOQuirk *quirk;\n\n\n\n /*\n\n * As long as the BAR is >= 256 bytes it will be aligned such that the\n\n * lower byte is always zero. Filter out anything else, if it exists.\n\n */\n\n if (!vfio_pci_is(vdev, PCI_VENDOR_ID_ATI, PCI_ANY_ID) ||\n\n !vdev->bars[4].ioport || vdev->bars[4].region.size < 256) {\n\n return;\n\n }\n\n\n\n quirk = g_malloc0(sizeof(*quirk));\n\n quirk->mem = g_malloc0(sizeof(MemoryRegion));\n\n quirk->nr_mem = 1;\n\n\n\n memory_region_init_io(quirk->mem, OBJECT(vdev), &vfio_ati_3c3_quirk, vdev,\n\n \"vfio-ati-3c3-quirk\", 1);\n\n memory_region_add_subregion(&vdev->vga.region[QEMU_PCI_VGA_IO_HI].mem,\n\n 3 /* offset 3 bytes from 0x3c0 */, quirk->mem);\n\n\n\n QLIST_INSERT_HEAD(&vdev->vga.region[QEMU_PCI_VGA_IO_HI].quirks,\n\n quirk, next);\n\n\n\n trace_vfio_quirk_ati_3c3_probe(vdev->vbasedev.name);\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_57", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n \t\t\ttcg_gen_qemu_ld8s(dst, addr, mem_index);\n \n+\t\telse\n+\n+\t\t\ttcg_gen_qemu_ld8u(dst, addr, mem_index);\n+\n+\t}\n \n \telse if (size == 2) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gen_load(DisasContext *dc, TCGv dst, TCGv addr, \n\n\t\t unsigned int size, int sign)\n\n{\n\n\tint mem_index = cpu_mmu_index(dc->env);\n\n\n\n\t/* If we get a fault on a delayslot we must keep the jmp state in\n\n\t the cpu-state to be able to re-execute the jmp. */\n\n\tif (dc->delayed_branch == 1)\n\n\t\tcris_store_direct_jmp(dc);\n\n\n\n\tif (size == 1) {\n\n\t\tif (sign)\n\n\t\t\ttcg_gen_qemu_ld8s(dst, addr, mem_index);\n\n\t\telse\n\n\t\t\ttcg_gen_qemu_ld8u(dst, addr, mem_index);\n\n\t}\n\n\telse if (size == 2) {\n\n\t\tif (sign)\n\n\t\t\ttcg_gen_qemu_ld16s(dst, addr, mem_index);\n\n\t\telse\n\n\t\t\ttcg_gen_qemu_ld16u(dst, addr, mem_index);\n\n\t}\n\n\telse if (size == 4) {\n\n\t\ttcg_gen_qemu_ld32u(dst, addr, mem_index);\n\n\t}\n\n\telse if (size == 8) {\n\n\t\ttcg_gen_qemu_ld64(dst, addr, mem_index);\n\n\t}\n\n}\n"}} {"sample_id": "9005b2a7589540a3733b3abdcfbccfe7746cd1a1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void pty_chr_update_read_handler(CharDriverState *chr)\n+\n+{\n+\n+ PtyCharDriver *s = chr->opaque;\n \n GPollFD pfd;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pty_chr_update_read_handler(CharDriverState *chr)\n\n{\n\n PtyCharDriver *s = chr->opaque;\n\n GPollFD pfd;\n\n\n\n pfd.fd = g_io_channel_unix_get_fd(s->fd);\n\n pfd.events = G_IO_OUT;\n\n pfd.revents = 0;\n\n g_poll(&pfd, 1, 0);\n\n if (pfd.revents & G_IO_HUP) {\n\n pty_chr_state(chr, 0);\n\n } else {\n\n pty_chr_state(chr, 1);\n\n }\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void do_405_check_ov (void)\n+\n+{\n \n+ if (likely(((T1 ^ T2) >> 31) || !((T0 ^ T2) >> 31))) {\n+\n xer_ov = 0;\n \n } else {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void do_405_check_ov (void)\n\n{\n\n if (likely(((T1 ^ T2) >> 31) || !((T0 ^ T2) >> 31))) {\n\n xer_ov = 0;\n\n } else {\n\n xer_ov = 1;\n\n xer_so = 1;\n\n }\n\n}\n"}} {"sample_id": "ba3ecda05e933acf6fff618716b6f6d2ed6a5a07", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n #endif\n \n+\n+\n+ case POWERPC_MMU_32B:\n+\n+ case POWERPC_MMU_601:\n \n return ppc_hash32_get_phys_page_debug(env, addr);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "hwaddr ppc_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)\n\n{\n\n PowerPCCPU *cpu = POWERPC_CPU(cs);\n\n CPUPPCState *env = &cpu->env;\n\n mmu_ctx_t ctx;\n\n\n\n switch (env->mmu_model) {\n\n#if defined(TARGET_PPC64)\n\n case POWERPC_MMU_64B:\n\n case POWERPC_MMU_2_03:\n\n case POWERPC_MMU_2_06:\n\n\n case POWERPC_MMU_2_07:\n\n\n return ppc_hash64_get_phys_page_debug(env, addr);\n\n#endif\n\n\n\n case POWERPC_MMU_32B:\n\n case POWERPC_MMU_601:\n\n return ppc_hash32_get_phys_page_debug(env, addr);\n\n\n\n default:\n\n ;\n\n }\n\n\n\n if (unlikely(get_physical_address(env, &ctx, addr, 0, ACCESS_INT) != 0)) {\n\n\n\n /* Some MMUs have separate TLBs for code and data. If we only try an\n\n * ACCESS_INT, we may not be able to read instructions mapped by code\n\n * TLBs, so we also try a ACCESS_CODE.\n\n */\n\n if (unlikely(get_physical_address(env, &ctx, addr, 0,\n\n ACCESS_CODE) != 0)) {\n\n return -1;\n\n }\n\n }\n\n\n\n return ctx.raddr & TARGET_PAGE_MASK;\n\n}"}} {"sample_id": "eabb7b91b36b202b4dac2df2d59d698e3aff197a_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static inline void reloc_pc26(tcg_insn_unit *code_ptr, tcg_insn_unit *target)\n+\n+{\n \n ptrdiff_t offset = target - code_ptr;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void reloc_pc26(tcg_insn_unit *code_ptr, tcg_insn_unit *target)\n\n{\n\n ptrdiff_t offset = target - code_ptr;\n\n assert(offset == sextract64(offset, 0, 26));\n\n /* read instruction, mask away previous PC_REL26 parameter contents,\n\n set the proper offset, then write back the instruction. */\n\n *code_ptr = deposit32(*code_ptr, 0, 26, offset);\n\n}\n"}} {"sample_id": "0fbc9bbbbb39b9a6f62d57f237052b64eefac578", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n AVFrame *out, AVFrame *in)\n \n+{\n \n NPPScaleContext *s = ctx->priv;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int nppscale_resize(AVFilterContext *ctx, NPPScaleStageContext *stage,\n\n AVFrame *out, AVFrame *in)\n\n{\n\n NPPScaleContext *s = ctx->priv;\n\n NppStatus err;\n\n int i;\n\n\n\n for (i = 0; i < FF_ARRAY_ELEMS(in->data) && in->data[i]; i++) {\n\n int iw = stage->planes_in[i].width;\n\n int ih = stage->planes_in[i].height;\n\n int ow = stage->planes_out[i].width;\n\n int oh = stage->planes_out[i].height;\n\n\n\n err = nppiResizeSqrPixel_8u_C1R(in->data[i], (NppiSize){ iw, ih },\n\n in->linesize[i], (NppiRect){ 0, 0, iw, ih },\n\n out->data[i], out->linesize[i],\n\n (NppiRect){ 0, 0, ow, oh },\n\n (double)ow / iw, (double)oh / ih,\n\n 0.0, 0.0, s->interp_algo);\n\n if (err != NPP_SUCCESS) {\n\n av_log(ctx, AV_LOG_ERROR, \"NPP resize error: %d\\n\", err);\n\n return AVERROR_UNKNOWN;\n\n }\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "79c5a10cdda1aed00d7ee4ef87de2ef8c854f4a5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor)\n \n+{\n \n QEMUCursor *c;\n \n@@ -8,15 +8,15 @@\n \n size_t size;\n \n+\n \n c = cursor_alloc(cursor->header.width, cursor->header.height);\n+\n+ c->hot_x = cursor->header.hot_spot_x;\n+\n+ c->hot_y = cursor->header.hot_spot_y;\n \n+ switch (cursor->header.type) {\n \n case SPICE_CURSOR_TYPE_ALPHA:\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor)\n\n{\n\n QEMUCursor *c;\n\n uint8_t *image, *mask;\n\n size_t size;\n\n\n\n c = cursor_alloc(cursor->header.width, cursor->header.height);\n\n c->hot_x = cursor->header.hot_spot_x;\n\n c->hot_y = cursor->header.hot_spot_y;\n\n switch (cursor->header.type) {\n\n case SPICE_CURSOR_TYPE_ALPHA:\n\n size = sizeof(uint32_t) * cursor->header.width * cursor->header.height;\n\n memcpy(c->data, cursor->chunk.data, size);\n\n if (qxl->debug > 2) {\n\n cursor_print_ascii_art(c, \"qxl/alpha\");\n\n }\n\n break;\n\n case SPICE_CURSOR_TYPE_MONO:\n\n mask = cursor->chunk.data;\n\n image = mask + cursor_get_mono_bpl(c) * c->width;\n\n cursor_set_mono(c, 0xffffff, 0x000000, image, 1, mask);\n\n if (qxl->debug > 2) {\n\n cursor_print_ascii_art(c, \"qxl/mono\");\n\n }\n\n break;\n\n default:\n\n fprintf(stderr, \"%s: not implemented: type %d\\n\",\n\n __FUNCTION__, cursor->header.type);\n\n goto fail;\n\n }\n\n return c;\n\n\n\nfail:\n\n cursor_put(c);\n\n return NULL;\n\n}\n"}} {"sample_id": "b3a62939561e07bc34493444fa926b6137cba4e8_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n idx = s->nb_globals;\n \n tcg_temp_alloc(s, s->nb_globals + 1);\n+\n+ ts = &s->temps[s->nb_globals];\n+\n+ ts->base_type = type;\n+\n ts->type = type;\n \n ts->fixed_reg = 1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline int tcg_global_reg_new_internal(TCGType type, int reg,\n\n const char *name)\n\n{\n\n TCGContext *s = &tcg_ctx;\n\n TCGTemp *ts;\n\n int idx;\n\n\n\n#if TCG_TARGET_REG_BITS == 32\n\n if (type != TCG_TYPE_I32)\n\n tcg_abort();\n\n#endif\n\n if (tcg_regset_test_reg(s->reserved_regs, reg))\n\n tcg_abort();\n\n idx = s->nb_globals;\n\n tcg_temp_alloc(s, s->nb_globals + 1);\n\n ts = &s->temps[s->nb_globals];\n\n ts->base_type = type;\n\n ts->type = type;\n\n ts->fixed_reg = 1;\n\n ts->reg = reg;\n\n ts->name = name;\n\n s->nb_globals++;\n\n tcg_regset_set_reg(s->reserved_regs, reg);\n\n return idx;\n\n}\n"}} {"sample_id": "b5d2bf964be338bf8e86a01619646332729b434e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static inline int decode_bytes(const uint8_t *inbuffer, uint8_t *out, int bytes)\n \n+{\n \n static const uint32_t tab[4] = {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static inline int decode_bytes(const uint8_t *inbuffer, uint8_t *out, int bytes)\n\n{\n\n static const uint32_t tab[4] = {\n\n AV_BE2NE32C(0x37c511f2), AV_BE2NE32C(0xf237c511),\n\n AV_BE2NE32C(0x11f237c5), AV_BE2NE32C(0xc511f237),\n\n };\n\n int i, off;\n\n uint32_t c;\n\n const uint32_t *buf;\n\n uint32_t *obuf = (uint32_t *) out;\n\n /* FIXME: 64 bit platforms would be able to do 64 bits at a time.\n\n * I'm too lazy though, should be something like\n\n * for (i = 0; i < bitamount / 64; i++)\n\n * (int64_t) out[i] = 0x37c511f237c511f2 ^ av_be2ne64(int64_t) in[i]);\n\n * Buffer alignment needs to be checked. */\n\n\n\n off = (intptr_t) inbuffer & 3;\n\n buf = (const uint32_t *) (inbuffer - off);\n\n c = tab[off];\n\n bytes += 3 + off;\n\n for (i = 0; i < bytes / 4; i++)\n\n obuf[i] = c ^ buf[i];\n\n\n\n return off;\n\n}\n"}} {"sample_id": "5df6a1855b62dc653515d919e48c5b6f00c48f32", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n e1000_link_up(E1000State *s)\n {\n s->mac_reg[STATUS] |= E1000_STATUS_LU;\n+ s->phy_reg[PHY_STATUS] |= MII_SR_LINK_STATUS;\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "e1000_link_up(E1000State *s)\n{\n s->mac_reg[STATUS] |= E1000_STATUS_LU;\n s->phy_reg[PHY_STATUS] |= MII_SR_LINK_STATUS;\n}"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_334", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static void omap_id_write(void *opaque, target_phys_addr_t addr,\n+\n+ uint64_t value, unsigned size)\n+\n {\n \n if (size != 4) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void omap_id_write(void *opaque, target_phys_addr_t addr,\n\n uint64_t value, unsigned size)\n\n{\n\n if (size != 4) {\n\n return omap_badwidth_write32(opaque, addr, value);\n\n }\n\n\n\n OMAP_BAD_REG(addr);\n\n}\n"}} {"sample_id": "d6478bc7e92db4669fac701d7bb8c51756b61d8a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n return 8;\n \n+ }\n+\n+ if (n == 32) {\n+\n+ /* FPSCR not implemented */\n \n return 4;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int gdb_set_float_reg(CPUPPCState *env, uint8_t *mem_buf, int n)\n\n{\n\n if (n < 32) {\n\n env->fpr[n] = ldfq_p(mem_buf);\n\n return 8;\n\n }\n\n if (n == 32) {\n\n /* FPSCR not implemented */\n\n return 4;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "0058584580b87feb47898e60e4b80c7f425882ad_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n tmp1 = (ctx->samples + 256)[start];\n \n+ ctx->samples[start] = tmp0 + tmp1;\n+\n+ (ctx->samples + 256)[start] = tmp0 - tmp1;\n+\n+ start++;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int _do_rematrixing(AC3DecodeContext *ctx, int start, int end)\n\n{\n\n float tmp0, tmp1;\n\n\n\n while (start < end) {\n\n tmp0 = ctx->samples[start];\n\n tmp1 = (ctx->samples + 256)[start];\n\n ctx->samples[start] = tmp0 + tmp1;\n\n (ctx->samples + 256)[start] = tmp0 - tmp1;\n\n start++;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "acbe59829e448aa63bdccc6ee484b7e1ac605e25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n BdrvCheckMode fix)\n \n+{\n+\n return qcow2_check_refcounts(bs, result, fix);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int qcow2_check(BlockDriverState *bs, BdrvCheckResult *result,\n\n BdrvCheckMode fix)\n\n{\n\n return qcow2_check_refcounts(bs, result, fix);\n\n}\n"}} {"sample_id": "7d1b0095bff7157e856d1d0e6c4295641ced2752_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static inline TCGv load_reg(DisasContext *s, int reg)\n+\n {\n \n TCGv tmp = new_tmp();", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline TCGv load_reg(DisasContext *s, int reg)\n\n{\n\n TCGv tmp = new_tmp();\n\n load_reg_var(s, tmp, reg);\n\n return tmp;\n\n}\n"}} {"sample_id": "79ca616f291124d166ca173e512c4ace1c2fe8b2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void do_pci_device_hot_remove(Monitor *mon, const QDict *qdict)\n \n+{\n \n pci_device_hot_remove(mon, qdict_get_str(qdict, \"pci_addr\"));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void do_pci_device_hot_remove(Monitor *mon, const QDict *qdict)\n\n{\n\n pci_device_hot_remove(mon, qdict_get_str(qdict, \"pci_addr\"));\n\n}\n"}} {"sample_id": "b3db211f3c80bb996a704d665fe275619f728bd4_29", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n \n \n+ v = validate_test_init(data, \"{ 'integer': -42, 'boolean': true, 'string': 'foo', 'extra': 42 }\");\n+\n+\n+\n+ visit_type_TestStruct(v, NULL, &p, &err);\n \n error_free_or_abort(&err);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_validate_fail_struct(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n TestStruct *p = NULL;\n\n Error *err = NULL;\n\n Visitor *v;\n\n\n\n v = validate_test_init(data, \"{ 'integer': -42, 'boolean': true, 'string': 'foo', 'extra': 42 }\");\n\n\n\n visit_type_TestStruct(v, NULL, &p, &err);\n\n error_free_or_abort(&err);\n\n g_assert(!p);\n\n}\n"}} {"sample_id": "e48e84ea80cb2e7fe6e48196ce187cfba6e3eb2c_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void scsi_device_purge_requests(SCSIDevice *sdev, SCSISense sense)\n+\n+{\n+\n+ SCSIRequest *req;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void scsi_device_purge_requests(SCSIDevice *sdev, SCSISense sense)\n\n{\n\n SCSIRequest *req;\n\n\n\n while (!QTAILQ_EMPTY(&sdev->requests)) {\n\n req = QTAILQ_FIRST(&sdev->requests);\n\n scsi_req_cancel(req);\n\n }\n\n sdev->unit_attention = sense;\n\n}\n"}} {"sample_id": "f8b6cc0070aab8b75bd082582c829be1353f395f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n qdev_prop_set(dev, name, &value, PROP_TYPE_DRIVE);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qdev_prop_set_drive(DeviceState *dev, const char *name, DriveInfo *value)\n\n{\n\n qdev_prop_set(dev, name, &value, PROP_TYPE_DRIVE);\n\n}\n"}} {"sample_id": "eb5d4f5329df83ea15244b47f7fbca21adaae41b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,10 +5,10 @@\n int i;\n \n \n+\n+ for (i = 0; i < NB_BOOTP_CLIENTS; i++) {\n+\n+ slirp->bootp_clients[i].allocated = qemu_get_be16(f);\n \n qemu_get_buffer(f, slirp->bootp_clients[i].macaddr, 6);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void slirp_bootp_load(QEMUFile *f, Slirp *slirp)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < NB_BOOTP_CLIENTS; i++) {\n\n slirp->bootp_clients[i].allocated = qemu_get_be16(f);\n\n qemu_get_buffer(f, slirp->bootp_clients[i].macaddr, 6);\n\n }\n\n}\n"}} {"sample_id": "e23a1b33b53d25510320b26d9f154e19c6c99725_23", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n ISADevice *dev;\n \n+ m48t59_t *s;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "m48t59_t *m48t59_init_isa(uint32_t io_base, uint16_t size, int type)\n\n{\n\n M48t59ISAState *d;\n\n ISADevice *dev;\n\n m48t59_t *s;\n\n\n\n dev = isa_create(\"m48t59_isa\");\n\n qdev_prop_set_uint32(&dev->qdev, \"type\", type);\n\n qdev_prop_set_uint32(&dev->qdev, \"size\", size);\n\n qdev_prop_set_uint32(&dev->qdev, \"io_base\", io_base);\n\n qdev_init(&dev->qdev);\n\n d = DO_UPCAST(M48t59ISAState, busdev, dev);\n\n s = &d->state;\n\n\n\n if (io_base != 0) {\n\n register_ioport_read(io_base, 0x04, 1, NVRAM_readb, s);\n\n register_ioport_write(io_base, 0x04, 1, NVRAM_writeb, s);\n\n }\n\n\n\n return s;\n\n}\n"}} {"sample_id": "cd48d7e8f322cdb05692b023b168816ed6306fc4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n \n \n /* add the timer in the sorted list */\n+\n+ /* NOTE: this code must be signal safe because\n+\n+ qemu_timer_expired() can be called from a signal. */\n+\n pt = &active_timers[ts->clock->type];\n \n for(;;) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_mod_timer(QEMUTimer *ts, int64_t expire_time)\n\n{\n\n QEMUTimer **pt, *t;\n\n\n\n qemu_del_timer(ts);\n\n\n\n /* add the timer in the sorted list */\n\n /* NOTE: this code must be signal safe because\n\n qemu_timer_expired() can be called from a signal. */\n\n pt = &active_timers[ts->clock->type];\n\n for(;;) {\n\n t = *pt;\n\n if (!t)\n\n break;\n\n if (t->expire_time > expire_time)\n\n break;\n\n pt = &t->next;\n\n }\n\n ts->expire_time = expire_time;\n\n ts->next = *pt;\n\n *pt = ts;\n\n\n\n /* Rearm if necessary */\n\n if (pt == &active_timers[ts->clock->type]) {\n\n if ((alarm_timer->flags & ALARM_FLAG_EXPIRED) == 0) {\n\n qemu_rearm_alarm_timer(alarm_timer);\n\n }\n\n /* Interrupt execution to force deadline recalculation. */\n\n if (use_icount)\n\n qemu_notify_event();\n\n }\n\n}\n"}} {"sample_id": "b181e04777da67acbc7448f87e4ae9f1518e08b2_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ const char *filename = qemu_opt_get(opts, \"path\");\n \n CharDriverState *chr;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static CharDriverState *qemu_chr_open_pp(QemuOpts *opts)\n\n{\n\n const char *filename = qemu_opt_get(opts, \"path\");\n\n CharDriverState *chr;\n\n int fd;\n\n\n\n fd = open(filename, O_RDWR);\n\n if (fd < 0)\n\n return NULL;\n\n\n\n chr = g_malloc0(sizeof(CharDriverState));\n\n chr->opaque = (void *)(intptr_t)fd;\n\n chr->chr_write = null_chr_write;\n\n chr->chr_ioctl = pp_ioctl;\n\n return chr;\n\n}\n"}} {"sample_id": "5650e331a733711b809bc27f968500f0f5530126", "diff": "--- a/source.c\n+++ b/source.c\n@@ -54,11 +54,11 @@\n \n if (c->csty & JPEG2000_CSTY_PREC) {\n \n+ int i;\n+\n+ for (i = 0; i < c->nreslevels; i++) {\n+\n+ byte = bytestream_get_byte(&s->buf);\n \n c->log2_prec_widths[i] = byte & 0x0F; // precinct PPx\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int get_cox(Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c)\n\n{\n\n uint8_t byte;\n\n\n\n if (s->buf_end - s->buf < 5)\n\n return AVERROR(EINVAL);\n\n c->nreslevels = bytestream_get_byte(&s->buf) + 1; // num of resolution levels - 1\n\n\n\n /* compute number of resolution levels to decode */\n\n if (c->nreslevels < s->reduction_factor)\n\n c->nreslevels2decode = 1;\n\n else\n\n c->nreslevels2decode = c->nreslevels - s->reduction_factor;\n\n\n\n c->log2_cblk_width = bytestream_get_byte(&s->buf) + 2; // cblk width\n\n c->log2_cblk_height = bytestream_get_byte(&s->buf) + 2; // cblk height\n\n\n\n c->cblk_style = bytestream_get_byte(&s->buf);\n\n if (c->cblk_style != 0) { // cblk style\n\n av_log(s->avctx, AV_LOG_ERROR, \"no extra cblk styles supported\\n\");\n\n return -1;\n\n }\n\n c->transform = bytestream_get_byte(&s->buf); // DWT transformation type\n\n /* set integer 9/7 DWT in case of BITEXACT flag */\n\n if ((s->avctx->flags & CODEC_FLAG_BITEXACT) && (c->transform == FF_DWT97))\n\n c->transform = FF_DWT97_INT;\n\n\n\n if (c->csty & JPEG2000_CSTY_PREC) {\n\n int i;\n\n for (i = 0; i < c->nreslevels; i++) {\n\n byte = bytestream_get_byte(&s->buf);\n\n c->log2_prec_widths[i] = byte & 0x0F; // precinct PPx\n\n c->log2_prec_heights[i] = (byte >> 4) & 0x0F; // precinct PPy\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "a33c7dd21362a694692d0dc30fdbffae5a5d837e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int decode_hybrid(const uint8_t *sptr, uint8_t *dptr, int dx, int dy,\n \n int h, int w, int stride, const uint32_t *pal)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int decode_hybrid(const uint8_t *sptr, uint8_t *dptr, int dx, int dy,\n\n int h, int w, int stride, const uint32_t *pal)\n\n{\n\n int x, y;\n\n const uint8_t *orig_src = sptr;\n\n\n\n for (y = dx + h; y > dx; y--) {\n\n uint8_t *dst = dptr + (y * stride) + dy * 3;\n\n for (x = 0; x < w; x++) {\n\n if (*sptr & 0x80) {\n\n /* 15-bit color */\n\n unsigned c = AV_RB16(sptr) & ~0x8000;\n\n unsigned b = c & 0x1F;\n\n unsigned g = (c >> 5) & 0x1F;\n\n unsigned r = c >> 10;\n\n /* 000aaabb -> aaabbaaa */\n\n *dst++ = (b << 3) | (b >> 2);\n\n *dst++ = (g << 3) | (g >> 2);\n\n *dst++ = (r << 3) | (r >> 2);\n\n sptr += 2;\n\n } else {\n\n /* palette index */\n\n uint32_t c = pal[*sptr++];\n\n bytestream_put_le24(&dst, c);\n\n }\n\n }\n\n }\n\n return sptr - orig_src;\n\n}\n"}} {"sample_id": "09d5929f3721613fbb9ac9e74265c89c70df2ce0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n curval = stack[sp]->val;\n while (curval < threshold && sp >= 0) {\n if (curval < stack[sp]->val)\n+ curval = stack[sp]->val;\n+ while (curval < threshold) {\n+ int ret;\n+ if ((ret = get_bits(s, 1)) > 0) {\n+ stack[sp]->vis++;\n break;\n } else if (!ret)\n curval++;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int tag_tree_decode(Jpeg2000DecoderContext *s, Jpeg2000TgtNode *node,\n int threshold)\n{\n Jpeg2000TgtNode *stack[30];\n int sp = -1, curval = 0;\n while (node && !node->vis) {\n stack[++sp] = node;\n node = node->parent;\n }\n if (node)\n curval = node->val;\n else\n curval = stack[sp]->val;\n while (curval < threshold && sp >= 0) {\n if (curval < stack[sp]->val)\n curval = stack[sp]->val;\n while (curval < threshold) {\n int ret;\n if ((ret = get_bits(s, 1)) > 0) {\n stack[sp]->vis++;\n break;\n } else if (!ret)\n curval++;\n else\n return ret;\n }\n stack[sp]->val = curval;\n sp--;\n }\n return curval;\n}"}} {"sample_id": "9d4c0f4f0a71e74fd7e04d73620268484d693adf_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static sPAPRDREntitySense logical_entity_sense(sPAPRDRConnector *drc)\n \n {\n+\n+ if (drc->dev\n+\n+ && (drc->allocation_state != SPAPR_DR_ALLOCATION_STATE_UNUSABLE)) {\n \n return SPAPR_DR_ENTITY_SENSE_PRESENT;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static sPAPRDREntitySense logical_entity_sense(sPAPRDRConnector *drc)\n\n{\n\n if (drc->dev\n\n && (drc->allocation_state != SPAPR_DR_ALLOCATION_STATE_UNUSABLE)) {\n\n return SPAPR_DR_ENTITY_SENSE_PRESENT;\n\n } else {\n\n return SPAPR_DR_ENTITY_SENSE_UNUSABLE;\n\n }\n\n}\n"}} {"sample_id": "40a50b0a73d185c85cf62023f07e3091861081bb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void qemu_set_log(int log_flags, bool use_own_buffers)\n \n {\n+\n qemu_loglevel = log_flags;\n+\n if (qemu_loglevel && !qemu_logfile) {\n \n qemu_logfile = fopen(logfilename, log_append ? \"a\" : \"w\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void qemu_set_log(int log_flags, bool use_own_buffers)\n\n{\n\n qemu_loglevel = log_flags;\n\n if (qemu_loglevel && !qemu_logfile) {\n\n qemu_logfile = fopen(logfilename, log_append ? \"a\" : \"w\");\n\n if (!qemu_logfile) {\n\n perror(logfilename);\n\n _exit(1);\n\n }\n\n /* must avoid mmap() usage of glibc by setting a buffer \"by hand\" */\n\n if (use_own_buffers) {\n\n static char logfile_buf[4096];\n\n\n\n setvbuf(qemu_logfile, logfile_buf, _IOLBF, sizeof(logfile_buf));\n\n } else {\n\n#if defined(_WIN32)\n\n /* Win32 doesn't support line-buffering, so use unbuffered output. */\n\n setvbuf(qemu_logfile, NULL, _IONBF, 0);\n\n#else\n\n setvbuf(qemu_logfile, NULL, _IOLBF, 0);\n\n#endif\n\n log_append = 1;\n\n }\n\n }\n\n if (!qemu_loglevel && qemu_logfile) {\n\n fclose(qemu_logfile);\n\n qemu_logfile = NULL;\n\n }\n\n}\n"}} {"sample_id": "15fa08f8451babc88d733bd411d4c94976f9d0f8_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,17 +1,17 @@\n+static inline TCGOp *tcg_emit_op(TCGOpcode opc)\n+\n+{\n+\n+ TCGContext *ctx = tcg_ctx;\n+\n+ int oi = ctx->gen_next_op_idx;\n+\n+ int ni = oi + 1;\n+\n+ int pi = oi - 1;\n+\n+ TCGOp *op = &ctx->gen_op_buf[oi];\n+\n \n \n tcg_debug_assert(oi < OPC_BUF_SIZE);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static inline TCGOp *tcg_emit_op(TCGOpcode opc)\n\n{\n\n TCGContext *ctx = tcg_ctx;\n\n int oi = ctx->gen_next_op_idx;\n\n int ni = oi + 1;\n\n int pi = oi - 1;\n\n TCGOp *op = &ctx->gen_op_buf[oi];\n\n\n\n tcg_debug_assert(oi < OPC_BUF_SIZE);\n\n ctx->gen_op_buf[0].prev = oi;\n\n ctx->gen_next_op_idx = ni;\n\n\n\n memset(op, 0, offsetof(TCGOp, args));\n\n op->opc = opc;\n\n op->prev = pi;\n\n op->next = ni;\n\n\n\n return op;\n\n}\n"}} {"sample_id": "0c53d7342b4e8412f3b81eed67f053304813dc5d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void gen_ove_ov(DisasContext *dc, TCGv ov)\n+\n {\n \n gen_helper_ove(cpu_env, ov);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_ove_ov(DisasContext *dc, TCGv ov)\n\n{\n\n gen_helper_ove(cpu_env, ov);\n\n}\n"}} {"sample_id": "57d3e1b3f52d07d215ed96df946ee01f8d9f9526", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+void rng_backend_open(RngBackend *s, Error **errp)\n+\n {\n \n object_property_set_bool(OBJECT(s), true, \"opened\", errp);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void rng_backend_open(RngBackend *s, Error **errp)\n\n{\n\n object_property_set_bool(OBJECT(s), true, \"opened\", errp);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_206", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ return ldq_phys_internal(addr, DEVICE_BIG_ENDIAN);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint64_t ldq_be_phys(target_phys_addr_t addr)\n\n{\n\n return ldq_phys_internal(addr, DEVICE_BIG_ENDIAN);\n\n}\n"}} {"sample_id": "42a268c241183877192c376d03bd9b6d527407c7_35", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,8 +20,8 @@\n \n gen_set_label(l1);\n \n+ tcg_gen_andi_i32(cpu_flags, cpu_flags, ~DELAY_SLOT_TRUE);\n+\n+ gen_jump(ctx);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gen_delayed_conditional_jump(DisasContext * ctx)\n\n{\n\n int l1;\n\n TCGv ds;\n\n\n\n l1 = gen_new_label();\n\n ds = tcg_temp_new();\n\n tcg_gen_andi_i32(ds, cpu_flags, DELAY_SLOT_TRUE);\n\n tcg_gen_brcondi_i32(TCG_COND_NE, ds, 0, l1);\n\n gen_goto_tb(ctx, 1, ctx->pc + 2);\n\n gen_set_label(l1);\n\n tcg_gen_andi_i32(cpu_flags, cpu_flags, ~DELAY_SLOT_TRUE);\n\n gen_jump(ctx);\n\n}\n"}} {"sample_id": "d732dcb442ce810709f48d7a105b573efda118a2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n for(i = 0;i < count; i++) {\n \n+ base = tswapl(target_vec[i].iov_base);\n+\n+ unlock_user(vec[i].iov_base, base, copy ? vec[i].iov_len : 0);\n+\n+ }\n \n unlock_user (target_vec, target_addr, 0);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static abi_long unlock_iovec(struct iovec *vec, abi_ulong target_addr,\n\n int count, int copy)\n\n{\n\n struct target_iovec *target_vec;\n\n abi_ulong base;\n\n int i;\n\n\n\n target_vec = lock_user(VERIFY_READ, target_addr, count * sizeof(struct target_iovec), 1);\n\n if (!target_vec)\n\n return -TARGET_EFAULT;\n\n for(i = 0;i < count; i++) {\n\n base = tswapl(target_vec[i].iov_base);\n\n unlock_user(vec[i].iov_base, base, copy ? vec[i].iov_len : 0);\n\n }\n\n unlock_user (target_vec, target_addr, 0);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "ee951a37d8873bff7aa58e23222dfd984111b6cb_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n }\n \n isabus->assigned |= (1 << isairq);\n+\n+ dev->isairq[dev->nirqs] = isairq;\n+\n+ *p = isabus->irqs[isairq];\n+\n dev->nirqs++;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void isa_init_irq(ISADevice *dev, qemu_irq *p, int isairq)\n\n{\n\n assert(dev->nirqs < ARRAY_SIZE(dev->isairq));\n\n if (isabus->assigned & (1 << isairq)) {\n\n hw_error(\"isa irq %d already assigned\", isairq);\n\n }\n\n isabus->assigned |= (1 << isairq);\n\n dev->isairq[dev->nirqs] = isairq;\n\n *p = isabus->irqs[isairq];\n\n dev->nirqs++;\n\n}\n"}} {"sample_id": "a6baa60807f88ba7d97b1787797fb58882ccbfb9_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n {\n \n BlockStats *s;\n+\n+\n+\n+ s = bdrv_query_bds_stats(bs, query_backing);\n+\n \n \n if (blk) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static BlockStats *bdrv_query_stats(BlockBackend *blk,\n\n const BlockDriverState *bs,\n\n bool query_backing)\n\n{\n\n BlockStats *s;\n\n\n\n s = bdrv_query_bds_stats(bs, query_backing);\n\n\n\n if (blk) {\n\n s->has_device = true;\n\n s->device = g_strdup(blk_name(blk));\n\n bdrv_query_blk_stats(s->stats, blk);\n\n }\n\n\n\n return s;\n\n}\n"}} {"sample_id": "3896cd11a107f241f06b06a336322aef2f372fdd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n \n \n+ frame = mxf->last_indexed_edit_unit + mxf->edit_units_count;\n+\n+\n+\n+ // write system metadata pack\n \n avio_write(pb, system_metadata_pack_key, 16);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void mxf_write_system_item(AVFormatContext *s)\n\n{\n\n MXFContext *mxf = s->priv_data;\n\n AVIOContext *pb = s->pb;\n\n unsigned frame;\n\n uint32_t time_code;\n\n\n\n frame = mxf->last_indexed_edit_unit + mxf->edit_units_count;\n\n\n\n // write system metadata pack\n\n avio_write(pb, system_metadata_pack_key, 16);\n\n klv_encode_ber4_length(pb, 57);\n\n avio_w8(pb, 0x5c); // UL, user date/time stamp, picture and sound item present\n\n avio_w8(pb, 0x04); // content package rate\n\n avio_w8(pb, 0x00); // content package type\n\n avio_wb16(pb, 0x00); // channel handle\n\n avio_wb16(pb, mxf->tc.start + frame); // continuity count\n\n if (mxf->essence_container_count > 1)\n\n avio_write(pb, multiple_desc_ul, 16);\n\n else {\n\n MXFStreamContext *sc = s->streams[0]->priv_data;\n\n avio_write(pb, mxf_essence_container_uls[sc->index].container_ul, 16);\n\n }\n\n avio_w8(pb, 0);\n\n avio_wb64(pb, 0);\n\n avio_wb64(pb, 0); // creation date/time stamp\n\n\n\n avio_w8(pb, 0x81); // SMPTE 12M time code\n\n time_code = av_timecode_get_smpte_from_framenum(&mxf->tc, frame);\n\n avio_wb32(pb, time_code);\n\n avio_wb32(pb, 0); // binary group data\n\n avio_wb64(pb, 0);\n\n\n\n // write system metadata package set\n\n avio_write(pb, system_metadata_package_set_key, 16);\n\n klv_encode_ber4_length(pb, 35);\n\n avio_w8(pb, 0x83); // UMID\n\n avio_wb16(pb, 0x20);\n\n mxf_write_umid(s, 1);\n\n}\n"}} {"sample_id": "8b33d9eeba91422ee2d73b6936ad57262d18cf5a_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n static int raw_write(BlockDriverState *bs, int64_t sector_num,\n+\n+ const uint8_t *buf, int nb_sectors)\n+\n+{\n+\n if (check_write_unsafe(bs, sector_num, buf, nb_sectors)) {\n+\n int ret;\n \n \n+\n ret = raw_write_scrubbed_bootsect(bs, buf);\n \n if (ret < 0) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int raw_write(BlockDriverState *bs, int64_t sector_num,\n\n const uint8_t *buf, int nb_sectors)\n\n{\n\n if (check_write_unsafe(bs, sector_num, buf, nb_sectors)) {\n\n int ret;\n\n\n\n ret = raw_write_scrubbed_bootsect(bs, buf);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n\n\n ret = bdrv_write(bs->file, 1, buf + 512, nb_sectors - 1);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n\n\n return ret + 512;\n\n }\n\n\n\n return bdrv_write(bs->file, sector_num, buf, nb_sectors);\n\n}\n"}} {"sample_id": "7f4ec4364bc4a73036660c1c6a3c4801db524e9e_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -41,11 +41,11 @@\n st->codec->channel_layout = avpriv_ac3_channel_layout_tab[acmod];\n \n if (lfeon)\n+\n+ st->codec->channel_layout |= AV_CH_LOW_FREQUENCY;\n+\n+ *ast = bsmod;\n+\n if (st->codec->channels > 1 && bsmod == 0x7)\n \n *ast = AV_AUDIO_SERVICE_TYPE_KARAOKE;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mov_read_dac3(MOVContext *c, AVIOContext *pb, MOVAtom atom)\n\n{\n\n AVStream *st;\n\n enum AVAudioServiceType *ast;\n\n int ac3info, acmod, lfeon, bsmod;\n\n\n\n if (c->fc->nb_streams < 1)\n\n return 0;\n\n st = c->fc->streams[c->fc->nb_streams-1];\n\n\n\n ast = (enum AVAudioServiceType*)ff_stream_new_side_data(st, AV_PKT_DATA_AUDIO_SERVICE_TYPE,\n\n sizeof(*ast));\n\n if (!ast)\n\n return AVERROR(ENOMEM);\n\n\n\n ac3info = avio_rb24(pb);\n\n bsmod = (ac3info >> 14) & 0x7;\n\n acmod = (ac3info >> 11) & 0x7;\n\n lfeon = (ac3info >> 10) & 0x1;\n\n st->codec->channels = ((int[]){2,1,2,3,3,4,4,5})[acmod] + lfeon;\n\n st->codec->channel_layout = avpriv_ac3_channel_layout_tab[acmod];\n\n if (lfeon)\n\n st->codec->channel_layout |= AV_CH_LOW_FREQUENCY;\n\n *ast = bsmod;\n\n if (st->codec->channels > 1 && bsmod == 0x7)\n\n *ast = AV_AUDIO_SERVICE_TYPE_KARAOKE;\n\n\n\n st->codec->audio_service_type = *ast;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "ef4c71e8f83a46fb31a11f0a066efb90821c579f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n int z;\n \n+ const char *effect;\n+\n+\n+\n+ effect = fp->amount == 0 ? \"none\" : fp->amount < 0 ? \"blur\" : \"sharpen\";\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void init_filter_param(AVFilterContext *ctx, FilterParam *fp, const char *effect_type, int width)\n\n{\n\n int z;\n\n const char *effect;\n\n\n\n effect = fp->amount == 0 ? \"none\" : fp->amount < 0 ? \"blur\" : \"sharpen\";\n\n\n\n av_log(ctx, AV_LOG_VERBOSE, \"effect:%s type:%s msize_x:%d msize_y:%d amount:%0.2f\\n\",\n\n effect, effect_type, fp->msize_x, fp->msize_y, fp->amount / 65535.0);\n\n\n\n for (z = 0; z < 2 * fp->steps_y; z++)\n\n fp->sc[z] = av_malloc(sizeof(*(fp->sc[z])) * (width + 2 * fp->steps_x));\n\n}\n"}} {"sample_id": "1d16a1cf99488f16492b1bb48e023f4da8377e07_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,10 +10,10 @@\n \n if(nnz==1 && block[i*16]) ff_h264_idct8_dc_add_mmx2(dst + block_offset[i], block + i*16, stride);\n \n+ else ff_h264_idct8_add_sse2 (dst + block_offset[i], block + i*16, stride);\n+\n+ }\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ff_h264_idct8_add4_sse2(uint8_t *dst, const int *block_offset, DCTELEM *block, int stride, const uint8_t nnzc[6*8]){\n\n int i;\n\n for(i=0; i<16; i+=4){\n\n int nnz = nnzc[ scan8[i] ];\n\n if(nnz){\n\n if(nnz==1 && block[i*16]) ff_h264_idct8_dc_add_mmx2(dst + block_offset[i], block + i*16, stride);\n\n else ff_h264_idct8_add_sse2 (dst + block_offset[i], block + i*16, stride);\n\n }\n\n }\n\n}\n"}} {"sample_id": "e9a07334fb6ee08ddd61787c102d36e7e781efef_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,8 +10,8 @@\n g364fb_draw_blank(s);\n } else if (s->depth == 8) {\n g364fb_draw_graphic8(s);\n+ } else {\n+ error_report(\"g364: unknown guest depth %d\", s->depth);\n+ }\n+ qemu_irq_raise(s->irq);\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void g364fb_update_display(void *opaque)\n{\n G364State *s = opaque;\n if (s->width == 0 || s->height == 0)\n return;\n if (s->width != ds_get_width(s->ds) || s->height != ds_get_height(s->ds)) {\n qemu_console_resize(s->ds, s->width, s->height);\n }\n if (s->ctla & CTLA_FORCE_BLANK) {\n g364fb_draw_blank(s);\n } else if (s->depth == 8) {\n g364fb_draw_graphic8(s);\n } else {\n error_report(\"g364: unknown guest depth %d\", s->depth);\n }\n qemu_irq_raise(s->irq);\n}"}} {"sample_id": "9ef617246b629109e2779835b9a3a8400029484d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n }\n \n+\n+\n+ assert(index != 0 && desc->str[index] != NULL);\n+\n+ dst = snprintf(serial, sizeof(serial), \"%s\", desc->str[index]);\n \n path = qdev_get_dev_path(hcd);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void usb_desc_create_serial(USBDevice *dev)\n\n{\n\n DeviceState *hcd = dev->qdev.parent_bus->parent;\n\n const USBDesc *desc = usb_device_get_usb_desc(dev);\n\n int index = desc->id.iSerialNumber;\n\n char serial[64];\n\n char *path;\n\n int dst;\n\n\n\n if (dev->serial) {\n\n /* 'serial' usb bus property has priority if present */\n\n usb_desc_set_string(dev, index, dev->serial);\n\n return;\n\n }\n\n\n\n assert(index != 0 && desc->str[index] != NULL);\n\n dst = snprintf(serial, sizeof(serial), \"%s\", desc->str[index]);\n\n path = qdev_get_dev_path(hcd);\n\n if (path) {\n\n dst += snprintf(serial+dst, sizeof(serial)-dst, \"-%s\", path);\n\n }\n\n dst += snprintf(serial+dst, sizeof(serial)-dst, \"-%s\", dev->port->path);\n\n usb_desc_set_string(dev, index, serial);\n\n\n}"}} {"sample_id": "0a73336d96397c80881219d080518fac6f1ecacb_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,19 +1,19 @@\n+static int find_and_check_chardev(CharDriverState **chr,\n \n char *chr_name,\n \n Error **errp)\n+\n {\n+\n+ CompareChardevProps props;\n \n \n+\n+ *chr = qemu_chr_find(chr_name);\n \n if (*chr == NULL) {\n+\n error_setg(errp, \"Device '%s' not found\",\n \n chr_name);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int find_and_check_chardev(CharDriverState **chr,\n\n char *chr_name,\n\n Error **errp)\n\n{\n\n CompareChardevProps props;\n\n\n\n *chr = qemu_chr_find(chr_name);\n\n if (*chr == NULL) {\n\n error_setg(errp, \"Device '%s' not found\",\n\n chr_name);\n\n return 1;\n\n }\n\n\n\n memset(&props, 0, sizeof(props));\n\n if (qemu_opt_foreach((*chr)->opts, compare_chardev_opts, &props, errp)) {\n\n return 1;\n\n }\n\n\n\n if (!props.is_socket) {\n\n error_setg(errp, \"chardev \\\"%s\\\" is not a tcp socket\",\n\n chr_name);\n\n return 1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "60ea0a5236ceac03b8d3ab3b73bda04d04c17273", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,9 +11,9 @@\n uint8_t *out_end;\n \n \n+\n+ /* Test buffer size. */\n+\n if (offset * s->depth > bytestream2_get_bytes_left(&s->g))\n \n return AVERROR_INVALIDDATA;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int read_uncompressed_sgi(unsigned char* out_buf, SgiState *s)\n\n{\n\n int x, y, z;\n\n unsigned int offset = s->height * s->width * s->bytes_per_channel;\n\n GetByteContext gp[4];\n\n uint8_t *out_end;\n\n\n\n /* Test buffer size. */\n\n if (offset * s->depth > bytestream2_get_bytes_left(&s->g))\n\n return AVERROR_INVALIDDATA;\n\n\n\n /* Create a reader for each plane */\n\n for (z = 0; z < s->depth; z++) {\n\n gp[z] = s->g;\n\n bytestream2_skip(&gp[z], z * offset);\n\n }\n\n\n\n for (y = s->height - 1; y >= 0; y--) {\n\n out_end = out_buf + (y * s->linesize);\n\n if (s->bytes_per_channel == 1) {\n\n for (x = s->width; x > 0; x--) {\n\n bytestream2_get_bufferu(&gp[z], out_end, s->depth);\n\n out_end += s->depth;\n\n }\n\n } else {\n\n uint16_t *out16 = (uint16_t *)out_end;\n\n for (x = s->width; x > 0; x--)\n\n for (z = 0; z < s->depth; z++)\n\n *out16++ = bytestream2_get_ne16u(&gp[z]);\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "e3f5ec2b5e92706e3b807059f79b1fb5d936e567_22", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void slirp_receive(void *opaque, const uint8_t *buf, size_t size)\n+\n+{\n+\n #ifdef DEBUG_SLIRP\n \n printf(\"slirp input:\\n\");", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void slirp_receive(void *opaque, const uint8_t *buf, size_t size)\n\n{\n\n#ifdef DEBUG_SLIRP\n\n printf(\"slirp input:\\n\");\n\n hex_dump(stdout, buf, size);\n\n#endif\n\n slirp_input(buf, size);\n\n}\n"}} {"sample_id": "94c3db85b4cc1d4e078859834a761bcc9d988780", "diff": "--- a/source.c\n+++ b/source.c\n@@ -52,8 +52,8 @@\n \n \n \n+ g_free(enum_str);\n+\n+ *obj = value;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void input_type_enum(Visitor *v, int *obj, const char *strings[],\n\n const char *kind, const char *name,\n\n Error **errp)\n\n{\n\n int64_t value = 0;\n\n char *enum_str;\n\n\n\n assert(strings);\n\n\n\n visit_type_str(v, &enum_str, name, errp);\n\n if (error_is_set(errp)) {\n\n return;\n\n }\n\n\n\n while (strings[value] != NULL) {\n\n if (strcmp(strings[value], enum_str) == 0) {\n\n break;\n\n }\n\n value++;\n\n }\n\n\n\n if (strings[value] == NULL) {\n\n error_set(errp, QERR_INVALID_PARAMETER, name ? name : \"null\");\n\n g_free(enum_str);\n\n return;\n\n }\n\n\n\n g_free(enum_str);\n\n *obj = value;\n\n}\n"}} {"sample_id": "b54ca0c3df4f21315bebdb96dc81cdf1abb9b214", "diff": "--- a/source.c\n+++ b/source.c\n@@ -35,11 +35,11 @@\n rsdp_table, &rsdp->rsdt_physical_address,\n \n sizeof rsdp->rsdt_physical_address);\n+\n+ rsdp->checksum = 0;\n+\n+ /* Checksum to be filled by Guest linker */\n+\n bios_linker_loader_add_checksum(linker, ACPI_BUILD_RSDP_FILE,\n \n rsdp, rsdp, sizeof *rsdp, &rsdp->checksum);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "build_rsdp(GArray *rsdp_table, GArray *linker, unsigned rsdt)\n\n{\n\n AcpiRsdpDescriptor *rsdp = acpi_data_push(rsdp_table, sizeof *rsdp);\n\n\n\n bios_linker_loader_alloc(linker, ACPI_BUILD_RSDP_FILE, 16,\n\n true /* fseg memory */);\n\n\n\n memcpy(&rsdp->signature, \"RSD PTR \", sizeof(rsdp->signature));\n\n memcpy(rsdp->oem_id, ACPI_BUILD_APPNAME6, sizeof(rsdp->oem_id));\n\n rsdp->length = cpu_to_le32(sizeof(*rsdp));\n\n rsdp->revision = 0x02;\n\n\n\n /* Point to RSDT */\n\n rsdp->rsdt_physical_address = cpu_to_le32(rsdt);\n\n /* Address to be filled by Guest linker */\n\n bios_linker_loader_add_pointer(linker, ACPI_BUILD_RSDP_FILE,\n\n ACPI_BUILD_TABLE_FILE,\n\n rsdp_table, &rsdp->rsdt_physical_address,\n\n sizeof rsdp->rsdt_physical_address);\n\n rsdp->checksum = 0;\n\n /* Checksum to be filled by Guest linker */\n\n bios_linker_loader_add_checksum(linker, ACPI_BUILD_RSDP_FILE,\n\n rsdp, rsdp, sizeof *rsdp, &rsdp->checksum);\n\n\n\n return rsdp_table;\n\n}\n"}} {"sample_id": "016d2e1dfa21b64a524d3629fdd317d4c25bc3b8_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static int restore_sigcontext(CPUSH4State *regs, struct target_sigcontext *sc,\n+\n target_ulong *r0_p)\n \n {\n@@ -19,7 +19,7 @@\n COPY(gregs[4]); COPY(gregs[5]);\n \n COPY(gregs[6]); COPY(gregs[7]);\n+\n COPY(gregs[8]); COPY(gregs[9]);\n \n COPY(gregs[10]); COPY(gregs[11]);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int restore_sigcontext(CPUSH4State *regs, struct target_sigcontext *sc,\n\n target_ulong *r0_p)\n\n{\n\n unsigned int err = 0;\n\n int i;\n\n\n\n#define COPY(x) __get_user(regs->x, &sc->sc_##x)\n\n COPY(gregs[1]);\n\n COPY(gregs[2]); COPY(gregs[3]);\n\n COPY(gregs[4]); COPY(gregs[5]);\n\n COPY(gregs[6]); COPY(gregs[7]);\n\n COPY(gregs[8]); COPY(gregs[9]);\n\n COPY(gregs[10]); COPY(gregs[11]);\n\n COPY(gregs[12]); COPY(gregs[13]);\n\n COPY(gregs[14]); COPY(gregs[15]);\n\n COPY(gbr); COPY(mach);\n\n COPY(macl); COPY(pr);\n\n COPY(sr); COPY(pc);\n\n#undef COPY\n\n\n\n for (i=0; i<16; i++) {\n\n __get_user(regs->fregs[i], &sc->sc_fpregs[i]);\n\n }\n\n __get_user(regs->fpscr, &sc->sc_fpscr);\n\n __get_user(regs->fpul, &sc->sc_fpul);\n\n\n\n regs->tra = -1; /* disable syscall checks */\n\n __get_user(*r0_p, &sc->sc_gregs[0]);\n\n return err;\n\n}\n"}} {"sample_id": "7fe7b68b32ba609faeeee03556aac0eb1b187c91", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ BDRVNBDState *s = opaque;\n \n uint64_t i;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void nbd_reply_ready(void *opaque)\n\n{\n\n BDRVNBDState *s = opaque;\n\n uint64_t i;\n\n\n\n if (s->reply.handle == 0) {\n\n /* No reply already in flight. Fetch a header. */\n\n if (nbd_receive_reply(s->sock, &s->reply) < 0) {\n\n s->reply.handle = 0;\n\n goto fail;\n\n }\n\n }\n\n\n\n /* There's no need for a mutex on the receive side, because the\n\n * handler acts as a synchronization point and ensures that only\n\n * one coroutine is called until the reply finishes. */\n\n i = HANDLE_TO_INDEX(s, s->reply.handle);\n\n if (i >= MAX_NBD_REQUESTS) {\n\n goto fail;\n\n }\n\n\n\n if (s->recv_coroutine[i]) {\n\n qemu_coroutine_enter(s->recv_coroutine[i], NULL);\n\n return;\n\n }\n\n\n\nfail:\n\n for (i = 0; i < MAX_NBD_REQUESTS; i++) {\n\n if (s->recv_coroutine[i]) {\n\n qemu_coroutine_enter(s->recv_coroutine[i], NULL);\n\n }\n\n }\n\n}\n"}} {"sample_id": "e45a2872fafe631c14aee9f79d0963d68c4fc1fd_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n fprintf(stderr, \"PowerPC performance report\\n Values are from the Time Base register, and represent 4 bus cycles.\\n\");\n \n+#else /* POWERPC_PERF_USE_PMC */\n+\n+ fprintf(stderr, \"PowerPC performance report\\n Values are from the PMC registers, and represent whatever the registers are set to record.\\n\");\n+\n+#endif /* POWERPC_PERF_USE_PMC */\n \n for(i = 0 ; i < powerpc_perf_total ; i++)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void powerpc_display_perf_report(void)\n\n{\n\n int i;\n\n#ifndef POWERPC_PERF_USE_PMC\n\n fprintf(stderr, \"PowerPC performance report\\n Values are from the Time Base register, and represent 4 bus cycles.\\n\");\n\n#else /* POWERPC_PERF_USE_PMC */\n\n fprintf(stderr, \"PowerPC performance report\\n Values are from the PMC registers, and represent whatever the registers are set to record.\\n\");\n\n#endif /* POWERPC_PERF_USE_PMC */\n\n for(i = 0 ; i < powerpc_perf_total ; i++)\n\n {\n\n if (perfdata[i][powerpc_data_num] != (unsigned long long)0)\n\n fprintf(stderr, \" Function \\\"%s\\\" (pmc1):\\n\\tmin: %llu\\n\\tmax: %llu\\n\\tavg: %1.2lf (%llu)\\n\",\n\n perfname[i],\n\n perfdata[i][powerpc_data_min],\n\n perfdata[i][powerpc_data_max],\n\n (double)perfdata[i][powerpc_data_sum] /\n\n (double)perfdata[i][powerpc_data_num],\n\n perfdata[i][powerpc_data_num]);\n\n#ifdef POWERPC_PERF_USE_PMC\n\n if (perfdata_pmc2[i][powerpc_data_num] != (unsigned long long)0)\n\n fprintf(stderr, \" Function \\\"%s\\\" (pmc2):\\n\\tmin: %llu\\n\\tmax: %llu\\n\\tavg: %1.2lf (%llu)\\n\",\n\n perfname[i],\n\n perfdata_pmc2[i][powerpc_data_min],\n\n perfdata_pmc2[i][powerpc_data_max],\n\n (double)perfdata_pmc2[i][powerpc_data_sum] /\n\n (double)perfdata_pmc2[i][powerpc_data_num],\n\n perfdata_pmc2[i][powerpc_data_num]);\n\n if (perfdata_pmc3[i][powerpc_data_num] != (unsigned long long)0)\n\n fprintf(stderr, \" Function \\\"%s\\\" (pmc3):\\n\\tmin: %llu\\n\\tmax: %llu\\n\\tavg: %1.2lf (%llu)\\n\",\n\n perfname[i],\n\n perfdata_pmc3[i][powerpc_data_min],\n\n perfdata_pmc3[i][powerpc_data_max],\n\n (double)perfdata_pmc3[i][powerpc_data_sum] /\n\n (double)perfdata_pmc3[i][powerpc_data_num],\n\n perfdata_pmc3[i][powerpc_data_num]);\n\n#endif\n\n }\n\n}\n"}} {"sample_id": "36b15c79aa1bef5fe7543f9f2629b6413720bbfb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void qemu_sgl_init_external(VirtIOSCSIReq *req, struct iovec *sg,\n \n+ hwaddr *addr, int num)\n+\n+{\n+\n QEMUSGList *qsgl = &req->qsgl;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_sgl_init_external(VirtIOSCSIReq *req, struct iovec *sg,\n\n hwaddr *addr, int num)\n\n{\n\n QEMUSGList *qsgl = &req->qsgl;\n\n\n\n qemu_sglist_init(qsgl, DEVICE(req->dev), num, &address_space_memory);\n\n while (num--) {\n\n qemu_sglist_add(qsgl, *(addr++), (sg++)->iov_len);\n\n }\n\n}\n"}} {"sample_id": "3a03bfa5a219fe06779706315f2555622b51193c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n int qemu_accept(int s, struct sockaddr *addr, socklen_t *addrlen)\n \n {\n+\n int ret;\n \n \n+\n #ifdef CONFIG_ACCEPT4\n \n ret = accept4(s, addr, addrlen, SOCK_CLOEXEC);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "int qemu_accept(int s, struct sockaddr *addr, socklen_t *addrlen)\n\n{\n\n int ret;\n\n\n\n#ifdef CONFIG_ACCEPT4\n\n ret = accept4(s, addr, addrlen, SOCK_CLOEXEC);\n\n#else\n\n ret = accept(s, addr, addrlen);\n\n if (ret >= 0) {\n\n qemu_set_cloexec(ret);\n\n }\n\n#endif\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "42a268c241183877192c376d03bd9b6d527407c7_42", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,9 +19,9 @@\n } else {\n \n tcg_gen_op4ii_i64(INDEX_op_brcond_i64, arg1, arg2, cond, label);\n+\n+ }\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void tcg_gen_brcond_i64(TCGCond cond, TCGv_i64 arg1, TCGv_i64 arg2, int label)\n\n{\n\n if (cond == TCG_COND_ALWAYS) {\n\n tcg_gen_br(label);\n\n } else if (cond != TCG_COND_NEVER) {\n\n if (TCG_TARGET_REG_BITS == 32) {\n\n tcg_gen_op6ii_i32(INDEX_op_brcond2_i32, TCGV_LOW(arg1),\n\n TCGV_HIGH(arg1), TCGV_LOW(arg2),\n\n TCGV_HIGH(arg2), cond, label);\n\n } else {\n\n tcg_gen_op4ii_i64(INDEX_op_brcond_i64, arg1, arg2, cond, label);\n\n }\n\n }\n\n}\n"}} {"sample_id": "ac03ee5331612e44beb393df2b578c951d27dc0d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n target_ulong cs_base, pc;\n \n+ uint32_t flags;\n+\n+ uint32_t cflags = 1 | CF_IGNORE_ICOUNT;\n+\n+\n \n if (sigsetjmp(cpu->jmp_env, 0) == 0) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void cpu_exec_step(CPUState *cpu)\n\n{\n\n CPUClass *cc = CPU_GET_CLASS(cpu);\n\n TranslationBlock *tb;\n\n target_ulong cs_base, pc;\n\n uint32_t flags;\n\n uint32_t cflags = 1 | CF_IGNORE_ICOUNT;\n\n\n\n if (sigsetjmp(cpu->jmp_env, 0) == 0) {\n\n tb = tb_lookup__cpu_state(cpu, &pc, &cs_base, &flags,\n\n cflags & CF_HASH_MASK);\n\n if (tb == NULL) {\n\n mmap_lock();\n\n tb_lock();\n\n tb = tb_gen_code(cpu, pc, cs_base, flags, cflags);\n\n tb_unlock();\n\n mmap_unlock();\n\n }\n\n\n\n cc->cpu_exec_enter(cpu);\n\n /* execute the generated code */\n\n trace_exec_tb(tb, pc);\n\n cpu_tb_exec(cpu, tb);\n\n cc->cpu_exec_exit(cpu);\n\n } else {\n\n /* We may have exited due to another problem here, so we need\n\n * to reset any tb_locks we may have taken but didn't release.\n\n * The mmap_lock is dropped by tb_gen_code if it runs out of\n\n * memory.\n\n */\n\n#ifndef CONFIG_SOFTMMU\n\n tcg_debug_assert(!have_mmap_lock());\n\n#endif\n\n tb_lock_reset();\n\n }\n\n}\n"}} {"sample_id": "ca488ad480360dfafcb5766f7bfbb567a0638979", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int decode_block(ALSDecContext *ctx, ALSBlockData *bd)\n \n {\n+\n unsigned int smp;\n \n+\n \n // read block type flag and read the samples accordingly\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int decode_block(ALSDecContext *ctx, ALSBlockData *bd)\n\n{\n\n unsigned int smp;\n\n\n\n // read block type flag and read the samples accordingly\n\n if (*bd->const_block)\n\n decode_const_block_data(ctx, bd);\n\n else if (decode_var_block_data(ctx, bd))\n\n return -1;\n\n\n\n // TODO: read RLSLMS extension data\n\n\n\n if (*bd->shift_lsbs)\n\n for (smp = 0; smp < bd->block_length; smp++)\n\n bd->raw_samples[smp] <<= *bd->shift_lsbs;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_22", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n */\n \n ctx->poll_max_ns = max_ns;\n+\n+ ctx->poll_ns = 0;\n+\n+ ctx->poll_grow = grow;\n+\n ctx->poll_shrink = shrink;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns,\n\n int64_t grow, int64_t shrink, Error **errp)\n\n{\n\n /* No thread synchronization here, it doesn't matter if an incorrect value\n\n * is used once.\n\n */\n\n ctx->poll_max_ns = max_ns;\n\n ctx->poll_ns = 0;\n\n ctx->poll_grow = grow;\n\n ctx->poll_shrink = shrink;\n\n\n\n aio_notify(ctx);\n\n}\n"}} {"sample_id": "3dc6f8693694a649a9c83f1e2746565b47683923_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n error_report(\"warning: ssh server %s does not support fsync\",\n \n s->inet->host);\n+\n+ if (what) {\n+\n+ error_report(\"to support fsync, you need %s\", what);\n+\n }\n \n s->unsafe_flush_warning = true;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void unsafe_flush_warning(BDRVSSHState *s, const char *what)\n\n{\n\n if (!s->unsafe_flush_warning) {\n\n error_report(\"warning: ssh server %s does not support fsync\",\n\n s->inet->host);\n\n if (what) {\n\n error_report(\"to support fsync, you need %s\", what);\n\n }\n\n s->unsafe_flush_warning = true;\n\n }\n\n}\n"}} {"sample_id": "eb2f9b024d68884a3b25e63e4dbf90b67f8da236_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void vmsvga_init(struct vmsvga_state_s *s,\n+\n MemoryRegion *address_space, MemoryRegion *io)\n \n {\n+\n DisplaySurface *surface;\n \n \n@@ -11,8 +11,8 @@\n s->scratch_size = SVGA_SCRATCH_SIZE;\n \n s->scratch = g_malloc(s->scratch_size * 4);\n+\n+\n \n s->vga.con = graphic_console_init(vmsvga_update_display,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void vmsvga_init(struct vmsvga_state_s *s,\n\n MemoryRegion *address_space, MemoryRegion *io)\n\n{\n\n DisplaySurface *surface;\n\n\n\n s->scratch_size = SVGA_SCRATCH_SIZE;\n\n s->scratch = g_malloc(s->scratch_size * 4);\n\n\n\n s->vga.con = graphic_console_init(vmsvga_update_display,\n\n vmsvga_invalidate_display,\n\n vmsvga_screen_dump,\n\n vmsvga_text_update, s);\n\n surface = qemu_console_surface(s->vga.con);\n\n\n\n s->fifo_size = SVGA_FIFO_SIZE;\n\n memory_region_init_ram(&s->fifo_ram, \"vmsvga.fifo\", s->fifo_size);\n\n vmstate_register_ram_global(&s->fifo_ram);\n\n s->fifo_ptr = memory_region_get_ram_ptr(&s->fifo_ram);\n\n\n\n vga_common_init(&s->vga);\n\n vga_init(&s->vga, address_space, io, true);\n\n vmstate_register(NULL, 0, &vmstate_vga_common, &s->vga);\n\n /* Save some values here in case they are changed later.\n\n * This is suspicious and needs more though why it is needed. */\n\n s->depth = surface_bits_per_pixel(surface);\n\n s->bypp = surface_bytes_per_pixel(surface);\n\n}\n"}} {"sample_id": "0b9f0e2fd7c5070fa06cd6bd5ec69055e3a7d2b1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n fd = qemu_chr_fe_get_msgfd(cur_mon->chr);\n \n+ if (fd == -1) {\n+\n+ error_set(errp, QERR_FD_NOT_SUPPLIED);\n+\n+ return;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void qmp_getfd(const char *fdname, Error **errp)\n\n{\n\n mon_fd_t *monfd;\n\n int fd;\n\n\n\n fd = qemu_chr_fe_get_msgfd(cur_mon->chr);\n\n if (fd == -1) {\n\n error_set(errp, QERR_FD_NOT_SUPPLIED);\n\n return;\n\n }\n\n\n\n if (qemu_isdigit(fdname[0])) {\n\n\n error_set(errp, QERR_INVALID_PARAMETER_VALUE, \"fdname\",\n\n \"a name not starting with a digit\");\n\n return;\n\n }\n\n\n\n QLIST_FOREACH(monfd, &cur_mon->fds, next) {\n\n if (strcmp(monfd->name, fdname) != 0) {\n\n continue;\n\n }\n\n\n\n close(monfd->fd);\n\n monfd->fd = fd;\n\n return;\n\n }\n\n\n\n monfd = g_malloc0(sizeof(mon_fd_t));\n\n monfd->name = g_strdup(fdname);\n\n monfd->fd = fd;\n\n\n\n QLIST_INSERT_HEAD(&cur_mon->fds, monfd, next);\n\n}"}} {"sample_id": "630530a6529bc3da9ab8aead7053dc753cb9ac77_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n char desc[DESC_SIZE];\n \n+ char parent_img_name[1024];\n \n \n \n@@ -20,7 +20,7 @@\n \n \n \n+ if ((p_name = strstr(desc,\"parentFileNameHint\")) != 0) {\n \n char *end_name;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int vmdk_parent_open(BlockDriverState *bs, const char * filename)\n\n{\n\n BDRVVmdkState *s = bs->opaque;\n\n char *p_name; \n\n char desc[DESC_SIZE];\n\n char parent_img_name[1024];\n\n\n\n /* the descriptor offset = 0x200 */\n\n if (bdrv_pread(s->hd, 0x200, desc, DESC_SIZE) != DESC_SIZE)\n\n return -1;\n\n\n\n if ((p_name = strstr(desc,\"parentFileNameHint\")) != 0) {\n\n char *end_name;\n\n struct stat file_buf;\n\n\n\n p_name += sizeof(\"parentFileNameHint\") + 1;\n\n if ((end_name = strchr(p_name,'\\\"')) == 0)\n\n return -1;\n\n \n\n strncpy(s->hd->backing_file, p_name, end_name - p_name);\n\n if (stat(s->hd->backing_file, &file_buf) != 0) {\n\n path_combine(parent_img_name, sizeof(parent_img_name),\n\n filename, s->hd->backing_file);\n\n } else {\n\n strcpy(parent_img_name, s->hd->backing_file);\n\n }\n\n\n\n s->hd->backing_hd = bdrv_new(\"\");\n\n if (!s->hd->backing_hd) {\n\n failure:\n\n bdrv_close(s->hd);\n\n return -1;\n\n }\n\n if (bdrv_open(s->hd->backing_hd, parent_img_name, 0) < 0)\n\n goto failure;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "c43567c12042cf401b039bfc94a5f85e1cc1e796", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n \n \n+ ret->type = ORG_QEMU_X_UNION1_KIND___ORG_QEMU_X_BRANCH;\n+\n+ ret->u.__org_qemu_x_branch = strdup(\"blah1\");\n+\n+\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "__org_qemu_x_Union1 *qmp___org_qemu_x_command(__org_qemu_x_EnumList *a,\n\n __org_qemu_x_StructList *b,\n\n __org_qemu_x_Union2 *c,\n\n __org_qemu_x_Alt *d,\n\n Error **errp)\n\n{\n\n __org_qemu_x_Union1 *ret = g_new0(__org_qemu_x_Union1, 1);\n\n\n\n ret->type = ORG_QEMU_X_UNION1_KIND___ORG_QEMU_X_BRANCH;\n\n ret->u.__org_qemu_x_branch = strdup(\"blah1\");\n\n\n\n\n\n\n\n return ret;\n"}} {"sample_id": "b61359781958759317ee6fd1a45b59be0b7dbbe1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n NULL, /* memory_region_set_container */\n \n NULL, NULL, &error_abort);\n+\n+ op->resolve = memory_region_resolve_container;\n+\n+\n+\n object_property_add(OBJECT(mr), \"addr\", \"uint64\",\n \n memory_region_get_addr,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void memory_region_initfn(Object *obj)\n\n{\n\n MemoryRegion *mr = MEMORY_REGION(obj);\n\n ObjectProperty *op;\n\n\n\n mr->ops = &unassigned_mem_ops;\n\n mr->enabled = true;\n\n mr->romd_mode = true;\n\n mr->global_locking = true;\n\n mr->destructor = memory_region_destructor_none;\n\n QTAILQ_INIT(&mr->subregions);\n\n QTAILQ_INIT(&mr->coalesced);\n\n\n\n op = object_property_add(OBJECT(mr), \"container\",\n\n \"link<\" TYPE_MEMORY_REGION \">\",\n\n memory_region_get_container,\n\n NULL, /* memory_region_set_container */\n\n NULL, NULL, &error_abort);\n\n op->resolve = memory_region_resolve_container;\n\n\n\n object_property_add(OBJECT(mr), \"addr\", \"uint64\",\n\n memory_region_get_addr,\n\n NULL, /* memory_region_set_addr */\n\n NULL, NULL, &error_abort);\n\n object_property_add(OBJECT(mr), \"priority\", \"uint32\",\n\n memory_region_get_priority,\n\n NULL, /* memory_region_set_priority */\n\n NULL, NULL, &error_abort);\n\n object_property_add_bool(OBJECT(mr), \"may-overlap\",\n\n memory_region_get_may_overlap,\n\n NULL, /* memory_region_set_may_overlap */\n\n &error_abort);\n\n object_property_add(OBJECT(mr), \"size\", \"uint64\",\n\n memory_region_get_size,\n\n NULL, /* memory_region_set_size, */\n\n NULL, NULL, &error_abort);\n\n}\n"}} {"sample_id": "e3f5ec2b5e92706e3b807059f79b1fb5d936e567_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n dp8393xState *s = opaque;\n+\n+\n+\n+ if (!(s->regs[SONIC_CR] & SONIC_CR_RXEN))\n \n return 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int nic_can_receive(void *opaque)\n\n{\n\n dp8393xState *s = opaque;\n\n\n\n if (!(s->regs[SONIC_CR] & SONIC_CR_RXEN))\n\n return 0;\n\n if (s->regs[SONIC_ISR] & SONIC_ISR_RBE)\n\n return 0;\n\n return 1;\n\n}\n"}} {"sample_id": "23979dc5411befabe9049e37075b2b6320debc4e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n \n \n+ if (dec_alu_op_b_is_small_imm(dc)) {\n+\n+ int32_t offset = (int32_t)((int16_t)dc->imm); /* sign-extend. */\n+\n+\n \n tcg_gen_movi_tl(env_btarget, dc->pc + offset);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void dec_bcc(DisasContext *dc)\n\n{\n\n unsigned int cc;\n\n unsigned int dslot;\n\n\n\n cc = EXTRACT_FIELD(dc->ir, 21, 23);\n\n dslot = dc->ir & (1 << 25);\n\n LOG_DIS(\"bcc%s r%d %x\\n\", dslot ? \"d\" : \"\", dc->ra, dc->imm);\n\n\n\n dc->delayed_branch = 1;\n\n if (dslot) {\n\n dc->delayed_branch = 2;\n\n dc->tb_flags |= D_FLAG;\n\n tcg_gen_st_tl(tcg_const_tl(dc->type_b && (dc->tb_flags & IMM_FLAG)),\n\n cpu_env, offsetof(CPUState, bimm));\n\n }\n\n\n\n if (dec_alu_op_b_is_small_imm(dc)) {\n\n int32_t offset = (int32_t)((int16_t)dc->imm); /* sign-extend. */\n\n\n\n tcg_gen_movi_tl(env_btarget, dc->pc + offset);\n\n } else {\n\n tcg_gen_movi_tl(env_btarget, dc->pc);\n\n tcg_gen_add_tl(env_btarget, env_btarget, *(dec_alu_op_b(dc)));\n\n }\n\n dc->jmp = JMP_INDIRECT;\n\n eval_cc(dc, cc, env_btaken, cpu_R[dc->ra], tcg_const_tl(0));\n\n}\n"}} {"sample_id": "6e42e6c4b410dbef8b593c2d796a5dad95f89ee4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n void rgb16tobgr15(const uint8_t *src, uint8_t *dst, long src_size)\n+\n+{\n+\n \tlong i;\n+\n+\tlong num_pixels = src_size >> 1;\n+\n+\n+\n+\tfor(i=0; i> 1;\n\n\n\n\tfor(i=0; i>5;\n\n\t b = (rgb&0xF800)>>11;\n\n\t dst[2*i] = (b&0x1F) | ((g&0x1F)<<5) | ((r&0x1F)<<10);\n\n\t}\n\n}\n"}} {"sample_id": "c23acbaed40101c677dfcfbbfe0d2c230a8e8f44_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,22 +1,22 @@\n static inline void FUNC(idctSparseColAdd)(pixel *dest, int line_size,\n \n+ DCTELEM *col)\n \n+{\n \n+ int a0, a1, a2, a3, b0, b1, b2, b3;\n \n+ INIT_CLIP;\n \n+\n \n+ IDCT_COLS;\n \n+\n \n+ dest[0] = CLIP(dest[0] + ((a0 + b0) >> COL_SHIFT));\n \n+ dest += line_size;\n \n dest[0] = CLIP(dest[0] + ((a1 + b1) >> COL_SHIFT));\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void FUNC(idctSparseColAdd)(pixel *dest, int line_size,\n\n DCTELEM *col)\n\n{\n\n int a0, a1, a2, a3, b0, b1, b2, b3;\n\n INIT_CLIP;\n\n\n\n IDCT_COLS;\n\n\n\n dest[0] = CLIP(dest[0] + ((a0 + b0) >> COL_SHIFT));\n\n dest += line_size;\n\n dest[0] = CLIP(dest[0] + ((a1 + b1) >> COL_SHIFT));\n\n dest += line_size;\n\n dest[0] = CLIP(dest[0] + ((a2 + b2) >> COL_SHIFT));\n\n dest += line_size;\n\n dest[0] = CLIP(dest[0] + ((a3 + b3) >> COL_SHIFT));\n\n dest += line_size;\n\n dest[0] = CLIP(dest[0] + ((a3 - b3) >> COL_SHIFT));\n\n dest += line_size;\n\n dest[0] = CLIP(dest[0] + ((a2 - b2) >> COL_SHIFT));\n\n dest += line_size;\n\n dest[0] = CLIP(dest[0] + ((a1 - b1) >> COL_SHIFT));\n\n dest += line_size;\n\n dest[0] = CLIP(dest[0] + ((a0 - b0) >> COL_SHIFT));\n\n}\n"}} {"sample_id": "2be0e25f4b6a4f91e39388cc365bbe53b56ab62a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,9 +8,9 @@\n mr->destructor(mr);\n \n memory_region_clear_coalescing(mr);\n+\n+ g_free((char *)mr->name);\n+\n+ g_free(mr->ioeventfds);\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void memory_region_destroy(MemoryRegion *mr)\n\n{\n\n assert(QTAILQ_EMPTY(&mr->subregions));\n\n\n mr->destructor(mr);\n\n memory_region_clear_coalescing(mr);\n\n g_free((char *)mr->name);\n\n g_free(mr->ioeventfds);\n\n}"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n TAILQ_FOREACH(chr, &chardevs, next) {\n \n monitor_printf(mon, \"%s: filename=%s\\n\", chr->label, chr->filename);\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_chr_info(Monitor *mon)\n\n{\n\n CharDriverState *chr;\n\n\n\n TAILQ_FOREACH(chr, &chardevs, next) {\n\n monitor_printf(mon, \"%s: filename=%s\\n\", chr->label, chr->filename);\n\n }\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_63", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static inline void gen_addr_imm_index (DisasContext *ctx)\n \n {\n+\n target_long simm = SIMM(ctx->opcode);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void gen_addr_imm_index (DisasContext *ctx)\n\n{\n\n target_long simm = SIMM(ctx->opcode);\n\n\n\n if (rA(ctx->opcode) == 0) {\n\n gen_op_set_T0(simm);\n\n } else {\n\n gen_op_load_gpr_T0(rA(ctx->opcode));\n\n if (likely(simm != 0))\n\n gen_op_addi(simm);\n\n }\n\n}\n"}} {"sample_id": "2dbafdc012d3ea81a97fec6226ca82d644539c9a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void coroutine_fn wait_for_overlapping_requests(BlockDriverState *bs,\n+\n+ BdrvTrackedRequest *self, int64_t offset, unsigned int bytes)\n+\n+{\n \n BdrvTrackedRequest *req;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void coroutine_fn wait_for_overlapping_requests(BlockDriverState *bs,\n\n BdrvTrackedRequest *self, int64_t offset, unsigned int bytes)\n\n{\n\n BdrvTrackedRequest *req;\n\n int64_t cluster_offset;\n\n unsigned int cluster_bytes;\n\n bool retry;\n\n\n\n /* If we touch the same cluster it counts as an overlap. This guarantees\n\n * that allocating writes will be serialized and not race with each other\n\n * for the same cluster. For example, in copy-on-read it ensures that the\n\n * CoR read and write operations are atomic and guest writes cannot\n\n * interleave between them.\n\n */\n\n round_bytes_to_clusters(bs, offset, bytes, &cluster_offset, &cluster_bytes);\n\n\n\n do {\n\n retry = false;\n\n QLIST_FOREACH(req, &bs->tracked_requests, list) {\n\n if (req == self) {\n\n continue;\n\n }\n\n if (tracked_request_overlaps(req, cluster_offset, cluster_bytes)) {\n\n /* Hitting this means there was a reentrant request, for\n\n * example, a block driver issuing nested requests. This must\n\n * never happen since it means deadlock.\n\n */\n\n assert(qemu_coroutine_self() != req->co);\n\n\n\n qemu_co_queue_wait(&req->wait_queue);\n\n retry = true;\n\n break;\n\n }\n\n }\n\n } while (retry);\n\n}\n"}} {"sample_id": "f2d089425d43735b5369f70f3a36b712440578e5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n if (mr->subpage) {\n \n+ trace_memory_region_subpage_read(get_cpu_index(), mr, addr, tmp, size);\n+\n+\n+\n+\n \n \n } else if (TRACE_MEMORY_REGION_OPS_READ_ENABLED) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static MemTxResult memory_region_read_accessor(MemoryRegion *mr,\n\n hwaddr addr,\n\n uint64_t *value,\n\n unsigned size,\n\n unsigned shift,\n\n uint64_t mask,\n\n MemTxAttrs attrs)\n\n{\n\n uint64_t tmp;\n\n\n\n tmp = mr->ops->read(mr->opaque, addr, size);\n\n if (mr->subpage) {\n\n trace_memory_region_subpage_read(get_cpu_index(), mr, addr, tmp, size);\n\n\n\n\n\n\n } else if (TRACE_MEMORY_REGION_OPS_READ_ENABLED) {\n\n hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr);\n\n trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size);\n\n }\n\n *value |= (tmp & mask) << shift;\n\n return MEMTX_OK;\n\n}"}} {"sample_id": "406c20754a29586f6dc1fccacbca3792be24922c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n s->rx_mask = 0xffff;\n \n+ s->intr = 0x00;\n+\n+ s->mask = 0x06;\n+\n+ s->idx = 0;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "struct MUSBState *musb_init(qemu_irq *irqs)\n\n{\n\n MUSBState *s = g_malloc0(sizeof(*s));\n\n int i;\n\n\n\n s->irqs = irqs;\n\n\n\n s->faddr = 0x00;\n\n s->power = MGC_M_POWER_HSENAB;\n\n s->tx_intr = 0x0000;\n\n s->rx_intr = 0x0000;\n\n s->tx_mask = 0xffff;\n\n s->rx_mask = 0xffff;\n\n s->intr = 0x00;\n\n s->mask = 0x06;\n\n s->idx = 0;\n\n\n\n /* TODO: _DW */\n\n s->ep[0].config = MGC_M_CONFIGDATA_SOFTCONE | MGC_M_CONFIGDATA_DYNFIFO;\n\n for (i = 0; i < 16; i ++) {\n\n s->ep[i].fifosize = 64;\n\n s->ep[i].maxp[0] = 0x40;\n\n s->ep[i].maxp[1] = 0x40;\n\n s->ep[i].musb = s;\n\n s->ep[i].epnum = i;\n\n usb_packet_init(&s->ep[i].packey[0].p);\n\n usb_packet_init(&s->ep[i].packey[1].p);\n\n }\n\n\n\n usb_bus_new(&s->bus, &musb_bus_ops, NULL /* FIXME */);\n\n usb_register_port(&s->bus, &s->port, s, 0, &musb_port_ops,\n\n USB_SPEED_MASK_LOW | USB_SPEED_MASK_FULL);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "0c2aaa882d124f05b7bf0a4a4abba3293f4d6d84_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void common_end(FFV1Context *s){\n \n int i;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void common_end(FFV1Context *s){\n\n int i;\n\n\n\n for(i=0; iplane_count; i++){\n\n PlaneContext *p= &s->plane[i];\n\n\n\n av_freep(&p->state);\n\n }\n\n}\n"}} {"sample_id": "4dfbc7a7559ccab666a8fd39de4224eb4b02c768", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n \n \n+ avio_skip(pb, 1); /* one byte has been read ahead */\n \n avio_skip(pb, 2);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int msnwc_tcp_read_packet(AVFormatContext *ctx, AVPacket *pkt)\n\n{\n\n AVIOContext *pb = ctx->pb;\n\n uint16_t keyframe;\n\n uint32_t size, timestamp;\n\n\n\n avio_skip(pb, 1); /* one byte has been read ahead */\n\n avio_skip(pb, 2);\n\n avio_skip(pb, 2);\n\n keyframe = avio_rl16(pb);\n\n size = avio_rl32(pb);\n\n avio_skip(pb, 4);\n\n avio_skip(pb, 4);\n\n timestamp = avio_rl32(pb);\n\n\n\n if(!size || av_get_packet(pb, pkt, size) != size)\n\n return -1;\n\n\n\n avio_skip(pb, 1); /* Read ahead one byte of struct size like read_header */\n\n\n\n pkt->pts = timestamp;\n\n pkt->dts = timestamp;\n\n pkt->stream_index = 0;\n\n\n\n /* Some aMsn generated videos (or was it Mercury Messenger?) don't set\n\n * this bit and rely on the codec to get keyframe information */\n\n if(keyframe&1)\n\n pkt->flags |= AV_PKT_FLAG_KEY;\n\n\n\n return HEADER_SIZE + size;\n\n}\n"}} {"sample_id": "aafd659518356d1ae3624830a36816f154d94d83", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n \n \n+ s->nbits = nbits;\n \n s->inverse = trans == IRDFT || trans == IRIDFT;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "av_cold int ff_rdft_init(RDFTContext *s, int nbits, enum RDFTransformType trans)\n\n{\n\n int n = 1 << nbits;\n\n int i;\n\n const double theta = (trans == RDFT || trans == IRIDFT ? -1 : 1)*2*M_PI/n;\n\n\n\n s->nbits = nbits;\n\n s->inverse = trans == IRDFT || trans == IRIDFT;\n\n s->sign_convention = trans == RIDFT || trans == IRIDFT ? 1 : -1;\n\n\n\n if (nbits < 4 || nbits > 16)\n\n return -1;\n\n\n\n if (ff_fft_init(&s->fft, nbits-1, trans == IRDFT || trans == RIDFT) < 0)\n\n return -1;\n\n\n\n s->tcos = ff_cos_tabs[nbits-4];\n\n s->tsin = ff_sin_tabs[nbits-4]+(trans == RDFT || trans == IRIDFT)*(n>>2);\n\n for (i = 0; i < (n>>2); i++) {\n\n s->tcos[i] = cos(i*theta);\n\n s->tsin[i] = sin(i*theta);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "54f254f973a1b2ed0f3571390f4de060adfe23e8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -44,11 +44,11 @@\n \n int n;\n \n+ n = (addr >> 1) & 7;\n+\n+ if (n >= NB_PORTS)\n+\n+ goto read_default;\n \n port = &s->ports[n];\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t uhci_ioport_readw(void *opaque, uint32_t addr)\n\n{\n\n UHCIState *s = opaque;\n\n uint32_t val;\n\n\n\n addr &= 0x1f;\n\n switch(addr) {\n\n case 0x00:\n\n val = s->cmd;\n\n break;\n\n case 0x02:\n\n val = s->status;\n\n break;\n\n case 0x04:\n\n val = s->intr;\n\n break;\n\n case 0x06:\n\n val = s->frnum;\n\n break;\n\n case 0x10 ... 0x1f:\n\n {\n\n UHCIPort *port;\n\n int n;\n\n n = (addr >> 1) & 7;\n\n if (n >= NB_PORTS)\n\n goto read_default;\n\n port = &s->ports[n];\n\n val = port->ctrl;\n\n }\n\n break;\n\n default:\n\n read_default:\n\n val = 0xff7f; /* disabled port */\n\n break;\n\n }\n\n#ifdef DEBUG\n\n printf(\"uhci readw port=0x%04x val=0x%04x\\n\", addr, val);\n\n#endif\n\n return val;\n\n}\n"}} {"sample_id": "e8b36ba92e0394815b64d96b00e81db3c851f6e2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n s->config[0x05] = 0x00;\n \n+ s->config[0x06] = 0xa0; // status = fast back-to-back, 66MHz, no error\n+\n+ s->config[0x07] = 0x03; // status = medium devsel\n+\n+ s->config[0x08] = 0x01; // revision\n \n s->config[0x09] = 0x00; // programming i/f\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "pci_ebus_init1(PCIDevice *s)\n\n{\n\n isa_bus_new(&s->qdev);\n\n\n\n pci_config_set_vendor_id(s->config, PCI_VENDOR_ID_SUN);\n\n pci_config_set_device_id(s->config, PCI_DEVICE_ID_SUN_EBUS);\n\n s->config[0x04] = 0x06; // command = bus master, pci mem\n\n s->config[0x05] = 0x00;\n\n s->config[0x06] = 0xa0; // status = fast back-to-back, 66MHz, no error\n\n s->config[0x07] = 0x03; // status = medium devsel\n\n s->config[0x08] = 0x01; // revision\n\n s->config[0x09] = 0x00; // programming i/f\n\n pci_config_set_class(s->config, PCI_CLASS_BRIDGE_OTHER);\n\n s->config[0x0D] = 0x0a; // latency_timer\n\n\n\n pci_register_bar(s, 0, 0x1000000, PCI_BASE_ADDRESS_SPACE_MEMORY,\n\n ebus_mmio_mapfunc);\n\n pci_register_bar(s, 1, 0x800000, PCI_BASE_ADDRESS_SPACE_MEMORY,\n\n ebus_mmio_mapfunc);\n\n return 0;\n\n}\n"}} {"sample_id": "0e3afacd4d8fbe1c21e0bc16bd707809cd87380f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int add_tonal_components(float *spectrum, int num_components,\n \n+ TonalComponent *components)\n+\n+{\n+\n+ int i, j, last_pos = -1;\n \n float *input, *output;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int add_tonal_components(float *spectrum, int num_components,\n\n TonalComponent *components)\n\n{\n\n int i, j, last_pos = -1;\n\n float *input, *output;\n\n\n\n for (i = 0; i < num_components; i++) {\n\n last_pos = FFMAX(components[i].pos + components[i].num_coefs, last_pos);\n\n input = components[i].coef;\n\n output = &spectrum[components[i].pos];\n\n\n\n for (j = 0; j < components[i].num_coefs; j++)\n\n output[i] += input[i];\n\n }\n\n\n\n return last_pos;\n\n}\n"}} {"sample_id": "0ac7cc2af500b948510f2481c22e84a57b0a2447", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n qs = qstring_from_substr(\"virtualization\", 3, 9);\n \n+ fail_unless(qs != NULL);\n+\n+ fail_unless(strcmp(qstring_get_str(qs), \"tualiza\") == 0);\n+\n \n \n QDECREF(qs);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "START_TEST(qstring_from_substr_test)\n\n{\n\n QString *qs;\n\n\n\n qs = qstring_from_substr(\"virtualization\", 3, 9);\n\n fail_unless(qs != NULL);\n\n fail_unless(strcmp(qstring_get_str(qs), \"tualiza\") == 0);\n\n\n\n QDECREF(qs);\n\n}\n"}} {"sample_id": "81ffbf5ab1458e357a761f1272105a55829b351e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ return !strcmp(name, VIRTFS_META_DIR);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool local_is_mapped_file_metadata(FsContext *fs_ctx, const char *name)\n\n{\n\n return !strcmp(name, VIRTFS_META_DIR);\n\n}\n"}} {"sample_id": "fe345a3d5d7ed4bc2965c65542832b1fa785ae9d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void diag288_timer_expired(void *dev)\n \n+{\n \n qemu_log_mask(CPU_LOG_RESET, \"Watchdog timer expired.\\n\");\n \n+ watchdog_perform_action();\n \n /* Reset the watchdog only if the guest was notified about expiry. */\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void diag288_timer_expired(void *dev)\n\n{\n\n qemu_log_mask(CPU_LOG_RESET, \"Watchdog timer expired.\\n\");\n\n watchdog_perform_action();\n\n /* Reset the watchdog only if the guest was notified about expiry. */\n\n switch (get_watchdog_action()) {\n\n case WDT_DEBUG:\n\n case WDT_NONE:\n\n case WDT_PAUSE:\n\n return;\n\n }\n\n wdt_diag288_reset(dev);\n\n}\n"}} {"sample_id": "15e9c4afdc8efbf8da86bb3f7eaf374310b44bf8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -35,11 +35,11 @@\n s->input_state[i] = 0;\n \n continue;\n+\n+ }\n+\n+ } else if (ret < 0)\n+\n return ret;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int request_samples(AVFilterContext *ctx, int min_samples)\n\n{\n\n MixContext *s = ctx->priv;\n\n int i, ret;\n\n\n\n av_assert0(s->nb_inputs > 1);\n\n\n\n for (i = 1; i < s->nb_inputs; i++) {\n\n ret = 0;\n\n if (!(s->input_state[i] & INPUT_ON))\n\n continue;\n\n if (av_audio_fifo_size(s->fifos[i]) >= min_samples)\n\n continue;\n\n ret = ff_request_frame(ctx->inputs[i]);\n\n if (ret == AVERROR_EOF) {\n\n s->input_state[i] |= INPUT_EOF;\n\n if (av_audio_fifo_size(s->fifos[i]) == 0) {\n\n s->input_state[i] = 0;\n\n continue;\n\n }\n\n } else if (ret < 0)\n\n return ret;\n\n }\n\n return output_frame(ctx->outputs[0], 1);\n\n}\n"}} {"sample_id": "baa61b9870dd7e0bb07e0ae61c6ec805db13f699", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n+static int virtio_balloon_device_exit(DeviceState *qdev)\n+\n+{\n \n VirtIOBalloon *s = VIRTIO_BALLOON(qdev);\n+\n VirtIODevice *vdev = VIRTIO_DEVICE(qdev);\n+\n \n \n balloon_stats_destroy_timer(s);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int virtio_balloon_device_exit(DeviceState *qdev)\n\n{\n\n VirtIOBalloon *s = VIRTIO_BALLOON(qdev);\n\n VirtIODevice *vdev = VIRTIO_DEVICE(qdev);\n\n\n\n balloon_stats_destroy_timer(s);\n\n qemu_remove_balloon_handler(s);\n\n unregister_savevm(qdev, \"virtio-balloon\", s);\n\n virtio_cleanup(vdev);\n\n return 0;\n\n}\n"}} {"sample_id": "3604a76fea6ff37738d4a8f596be38407be74a83_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void dec_ill(DisasContext *dc)\n+\n {\n \n cpu_abort(dc->env, \"unknown opcode 0x%02x\\n\", dc->opcode);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void dec_ill(DisasContext *dc)\n\n{\n\n cpu_abort(dc->env, \"unknown opcode 0x%02x\\n\", dc->opcode);\n\n}\n"}} {"sample_id": "441cbac0c7e641780decbc674a9a68c6a5200f71", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n \"'string': 'str', \"\n \n+ \"'boolean': true }\");\n+\n+ /* TODO when generator bug is fixed, add 'integer': 41 */\n+\n+\n \n visit_type_UserDefFlatUnion(v, &tmp, NULL, &err);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_validate_union_flat(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n UserDefFlatUnion *tmp = NULL;\n\n Visitor *v;\n\n Error *err = NULL;\n\n\n\n v = validate_test_init(data,\n\n \"{ 'enum1': 'value1', \"\n\n \"'string': 'str', \"\n\n \"'boolean': true }\");\n\n /* TODO when generator bug is fixed, add 'integer': 41 */\n\n\n\n visit_type_UserDefFlatUnion(v, &tmp, NULL, &err);\n\n g_assert(!err);\n\n qapi_free_UserDefFlatUnion(tmp);\n\n}\n"}} {"sample_id": "cdb3081269347fd9271fd1b7a9df312e2953bdd9_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n const char *name,\n \n+ uint64_t size)\n+\n+{\n+\n+ memory_region_init(mr, owner, name, size);\n \n mr->iommu_ops = ops,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void memory_region_init_iommu(MemoryRegion *mr,\n\n Object *owner,\n\n const MemoryRegionIOMMUOps *ops,\n\n const char *name,\n\n uint64_t size)\n\n{\n\n memory_region_init(mr, owner, name, size);\n\n mr->iommu_ops = ops,\n\n mr->terminates = true; /* then re-forwards */\n\n notifier_list_init(&mr->iommu_notify);\n\n}\n"}} {"sample_id": "265804b5d755502438b4d42a3682f54e03ea4d32", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n Object *obj = object_new(type);\n+\n+ TestIf *iobj = TEST_IF(obj);\n+\n+ TestIfClass *ioc = TEST_IF_GET_CLASS(iobj);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void test_interface_impl(const char *type)\n\n{\n\n Object *obj = object_new(type);\n\n TestIf *iobj = TEST_IF(obj);\n\n TestIfClass *ioc = TEST_IF_GET_CLASS(iobj);\n\n\n\n g_assert(iobj);\n\n g_assert(ioc->test == PATTERN);\n\n\n}"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_27", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n \t\t dc->op1, dc->op2));\n \n+\tcris_cc_mask(dc, CC_MASK_NZ);\n+\n+\tt0 = tcg_temp_new(TCG_TYPE_TL);\n+\n+\tdec_prep_alu_r(dc, dc->op1, dc->op2, 4, 0, cpu_R[dc->op2], t0);\n \n \tcris_alu(dc, CC_OP_LZ, cpu_R[dc->op2], cpu_R[dc->op2], t0, 4);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static unsigned int dec_lz_r(DisasContext *dc)\n\n{\n\n\tTCGv t0;\n\n\tDIS(fprintf (logfile, \"lz $r%u, $r%u\\n\",\n\n\t\t dc->op1, dc->op2));\n\n\tcris_cc_mask(dc, CC_MASK_NZ);\n\n\tt0 = tcg_temp_new(TCG_TYPE_TL);\n\n\tdec_prep_alu_r(dc, dc->op1, dc->op2, 4, 0, cpu_R[dc->op2], t0);\n\n\tcris_alu(dc, CC_OP_LZ, cpu_R[dc->op2], cpu_R[dc->op2], t0, 4);\n\n\ttcg_temp_free(t0);\n\n\treturn 2;\n\n}\n"}} {"sample_id": "556c2b60714e7dae3ed0eb3488910435263dc09f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,6 +7,6 @@\n blk_drain_all();\n \n \n+ return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int aio_flush_f(BlockBackend *blk, int argc, char **argv)\n\n{\n\n\n\n blk_drain_all();\n\n\n return 0;\n\n}"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_48", "diff": "--- a/source.c\n+++ b/source.c\n@@ -64,11 +64,11 @@\n \n }\n \n+\n+\n+ monfd = qemu_mallocz(sizeof(mon_fd_t));\n+\n+ monfd->name = qemu_strdup(fdname);\n \n monfd->fd = fd;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void do_getfd(Monitor *mon, const QDict *qdict)\n\n{\n\n const char *fdname = qdict_get_str(qdict, \"fdname\");\n\n mon_fd_t *monfd;\n\n int fd;\n\n\n\n fd = qemu_chr_get_msgfd(mon->chr);\n\n if (fd == -1) {\n\n monitor_printf(mon, \"getfd: no file descriptor supplied via SCM_RIGHTS\\n\");\n\n return;\n\n }\n\n\n\n if (qemu_isdigit(fdname[0])) {\n\n monitor_printf(mon, \"getfd: monitor names may not begin with a number\\n\");\n\n return;\n\n }\n\n\n\n fd = dup(fd);\n\n if (fd == -1) {\n\n monitor_printf(mon, \"Failed to dup() file descriptor: %s\\n\",\n\n strerror(errno));\n\n return;\n\n }\n\n\n\n LIST_FOREACH(monfd, &mon->fds, next) {\n\n if (strcmp(monfd->name, fdname) != 0) {\n\n continue;\n\n }\n\n\n\n close(monfd->fd);\n\n monfd->fd = fd;\n\n return;\n\n }\n\n\n\n monfd = qemu_mallocz(sizeof(mon_fd_t));\n\n monfd->name = qemu_strdup(fdname);\n\n monfd->fd = fd;\n\n\n\n LIST_INSERT_HEAD(&mon->fds, monfd, next);\n\n}\n"}} {"sample_id": "1c5b712c0a643a039d6f34269b4102de313a050a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void interpolate_refplane(DiracContext *s, DiracFrame *ref, int plane, int width, int height)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void interpolate_refplane(DiracContext *s, DiracFrame *ref, int plane, int width, int height)\n\n{\n\n /* chroma allocates an edge of 8 when subsampled\n\n which for 4:2:2 means an h edge of 16 and v edge of 8\n\n just use 8 for everything for the moment */\n\n int i, edge = EDGE_WIDTH/2;\n\n\n\n ref->hpel[plane][0] = ref->avframe->data[plane];\n\n s->mpvencdsp.draw_edges(ref->hpel[plane][0], ref->avframe->linesize[plane], width, height, edge, edge, EDGE_TOP | EDGE_BOTTOM); /* EDGE_TOP | EDGE_BOTTOM values just copied to make it build, this needs to be ensured */\n\n\n\n /* no need for hpel if we only have fpel vectors */\n\n if (!s->mv_precision)\n\n return;\n\n\n\n for (i = 1; i < 4; i++) {\n\n if (!ref->hpel_base[plane][i])\n\n ref->hpel_base[plane][i] = av_malloc((height+2*edge) * ref->avframe->linesize[plane] + 32);\n\n /* we need to be 16-byte aligned even for chroma */\n\n ref->hpel[plane][i] = ref->hpel_base[plane][i] + edge*ref->avframe->linesize[plane] + 16;\n\n }\n\n\n\n if (!ref->interpolated[plane]) {\n\n s->diracdsp.dirac_hpel_filter(ref->hpel[plane][1], ref->hpel[plane][2],\n\n ref->hpel[plane][3], ref->hpel[plane][0],\n\n ref->avframe->linesize[plane], width, height);\n\n s->mpvencdsp.draw_edges(ref->hpel[plane][1], ref->avframe->linesize[plane], width, height, edge, edge, EDGE_TOP | EDGE_BOTTOM);\n\n s->mpvencdsp.draw_edges(ref->hpel[plane][2], ref->avframe->linesize[plane], width, height, edge, edge, EDGE_TOP | EDGE_BOTTOM);\n\n s->mpvencdsp.draw_edges(ref->hpel[plane][3], ref->avframe->linesize[plane], width, height, edge, edge, EDGE_TOP | EDGE_BOTTOM);\n\n }\n\n ref->interpolated[plane] = 1;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_143", "diff": "--- a/source.c\n+++ b/source.c\n@@ -43,11 +43,11 @@\n if (block_mig_state.total_sector_sum != 0) {\n \n progress = completed_sector_sum * 100 /\n+\n+ block_mig_state.total_sector_sum;\n+\n+ } else {\n+\n progress = 100;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int blk_mig_save_bulked_block(QEMUFile *f)\n\n{\n\n int64_t completed_sector_sum = 0;\n\n BlkMigDevState *bmds;\n\n int progress;\n\n int ret = 0;\n\n\n\n QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {\n\n if (bmds->bulk_completed == 0) {\n\n if (mig_save_device_bulk(f, bmds) == 1) {\n\n /* completed bulk section for this device */\n\n bmds->bulk_completed = 1;\n\n }\n\n completed_sector_sum += bmds->completed_sectors;\n\n ret = 1;\n\n break;\n\n } else {\n\n completed_sector_sum += bmds->completed_sectors;\n\n }\n\n }\n\n\n\n if (block_mig_state.total_sector_sum != 0) {\n\n progress = completed_sector_sum * 100 /\n\n block_mig_state.total_sector_sum;\n\n } else {\n\n progress = 100;\n\n }\n\n if (progress != block_mig_state.prev_progress) {\n\n block_mig_state.prev_progress = progress;\n\n qemu_put_be64(f, (progress << BDRV_SECTOR_BITS)\n\n | BLK_MIG_FLAG_PROGRESS);\n\n DPRINTF(\"Completed %d %%\\r\", progress);\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "198a0039c5fca224a77e9761e2350dd9cc102ad0_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void vnc_client_error(VncState *vs)\n+\n {\n \n vnc_client_io_error(vs, -1, EINVAL);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void vnc_client_error(VncState *vs)\n\n{\n\n vnc_client_io_error(vs, -1, EINVAL);\n\n}\n"}} {"sample_id": "47d4be12c3997343e436c6cca89aefbbbeb70863_15", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n const char *str = \" \\t \";\n \n char f = 'X';\n+\n+ const char *endptr = &f;\n+\n uint64_t res = 999;\n \n int err;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_qemu_strtoull_whitespace(void)\n\n{\n\n const char *str = \" \\t \";\n\n char f = 'X';\n\n const char *endptr = &f;\n\n uint64_t res = 999;\n\n int err;\n\n\n\n err = qemu_strtoull(str, &endptr, 0, &res);\n\n\n\n g_assert_cmpint(err, ==, 0);\n\n g_assert_cmpint(res, ==, 0);\n\n g_assert(endptr == str);\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_85", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ RwCo *rwco = opaque;\n+\n \n \n rwco->ret = bdrv_co_flush(rwco->bs);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void coroutine_fn bdrv_flush_co_entry(void *opaque)\n\n{\n\n RwCo *rwco = opaque;\n\n\n\n rwco->ret = bdrv_co_flush(rwco->bs);\n\n}\n"}} {"sample_id": "b476c99d01519277e3494a10dc0329d07157ae02", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void memory_region_finalize(Object *obj)\n+\n+{\n+\n+ MemoryRegion *mr = MEMORY_REGION(obj);\n+\n \n \n assert(QTAILQ_EMPTY(&mr->subregions));", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void memory_region_finalize(Object *obj)\n\n{\n\n MemoryRegion *mr = MEMORY_REGION(obj);\n\n\n\n assert(QTAILQ_EMPTY(&mr->subregions));\n\n assert(memory_region_transaction_depth == 0);\n\n mr->destructor(mr);\n\n memory_region_clear_coalescing(mr);\n\n g_free((char *)mr->name);\n\n g_free(mr->ioeventfds);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_131", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n s->timer.irq = irq;\n \n s->timer.clk = clk;\n+\n+ s->timer.timer = qemu_new_timer_ns(vm_clock, omap_timer_tick, &s->timer);\n+\n+ omap_wd_timer_reset(s);\n+\n omap_timer_clk_setup(&s->timer);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static struct omap_watchdog_timer_s *omap_wd_timer_init(MemoryRegion *memory,\n\n target_phys_addr_t base,\n\n qemu_irq irq, omap_clk clk)\n\n{\n\n struct omap_watchdog_timer_s *s = (struct omap_watchdog_timer_s *)\n\n g_malloc0(sizeof(struct omap_watchdog_timer_s));\n\n\n\n s->timer.irq = irq;\n\n s->timer.clk = clk;\n\n s->timer.timer = qemu_new_timer_ns(vm_clock, omap_timer_tick, &s->timer);\n\n omap_wd_timer_reset(s);\n\n omap_timer_clk_setup(&s->timer);\n\n\n\n memory_region_init_io(&s->iomem, &omap_wd_timer_ops, s,\n\n \"omap-wd-timer\", 0x100);\n\n memory_region_add_subregion(memory, base, &s->iomem);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "8d857c543402911f46ad38b093ab9aaf5b9a9a18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n PUT_COEFF(ac);\n }\n // 4 bits per coefficient\n+ ALIGN(4);\n+ if (get_bits_count(gb) + (coeff << 2) >= gb->size_in_bits)\n+ while (coeff) {\n+ ac = get_sbits(gb, 4);\n+ if (ac == -8)\n break; // continue with more bits\n PUT_COEFF(ac);\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline int get_block(GetBitContext *gb, DCTELEM *block, const uint8_t *scan,\n const uint32_t *quant) {\n int coeff, i, n;\n int8_t ac;\n uint8_t dc = get_bits(gb, 8);\n // block not coded\n if (dc == 255)\n // number of non-zero coefficients\n coeff = get_bits(gb, 6);\n // normally we would only need to clear the (63 - coeff) last values,\n // but since we do not know where they are we just clear the whole block\n memset(block, 0, 64 * sizeof(DCTELEM));\n // 2 bits per coefficient\n while (coeff) {\n ac = get_sbits(gb, 2);\n if (ac == -2)\n break; // continue with more bits\n PUT_COEFF(ac);\n }\n // 4 bits per coefficient\n ALIGN(4);\n if (get_bits_count(gb) + (coeff << 2) >= gb->size_in_bits)\n while (coeff) {\n ac = get_sbits(gb, 4);\n if (ac == -8)\n break; // continue with more bits\n PUT_COEFF(ac);\n }\n // 8 bits per coefficient\n ALIGN(8);\n if (get_bits_count(gb) + (coeff << 3) >= gb->size_in_bits)\n while (coeff) {\n ac = get_sbits(gb, 8);\n PUT_COEFF(ac);\n }\n PUT_COEFF(dc);\n return 1;\n}"}} {"sample_id": "167bc3d2fa100590b5a9d8fd9f19ae0207197447", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n s->base = base;\n \n+ s->ds = ds;\n+\n+ iomemtype = cpu_register_io_memory(0, musicpal_lcd_readfn,\n+\n+ musicpal_lcd_writefn, s);\n \n cpu_register_physical_memory(base, MP_LCD_SIZE, iomemtype);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void musicpal_lcd_init(DisplayState *ds, uint32_t base)\n\n{\n\n musicpal_lcd_state *s;\n\n int iomemtype;\n\n\n\n s = qemu_mallocz(sizeof(musicpal_lcd_state));\n\n if (!s)\n\n return;\n\n s->base = base;\n\n s->ds = ds;\n\n iomemtype = cpu_register_io_memory(0, musicpal_lcd_readfn,\n\n musicpal_lcd_writefn, s);\n\n cpu_register_physical_memory(base, MP_LCD_SIZE, iomemtype);\n\n\n\n graphic_console_init(ds, lcd_refresh, NULL, NULL, NULL, s);\n\n dpy_resize(ds, 128*3, 64*3);\n\n}\n"}} {"sample_id": "26227d91865ddfbfe35c9ff84853cc469e1c7daf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static inline int *DEC_UPAIR(int *dst, unsigned idx, unsigned sign)\n \n+{\n \n dst[0] = (idx & 15) * (1 - (sign & 0xFFFFFFFE));\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline int *DEC_UPAIR(int *dst, unsigned idx, unsigned sign)\n\n{\n\n dst[0] = (idx & 15) * (1 - (sign & 0xFFFFFFFE));\n\n dst[1] = (idx >> 4 & 15) * (1 - ((sign & 1) << 1));\n\n\n\n return dst + 2;\n\n}\n"}} {"sample_id": "cf7330c759345de2efe9c0df7921189ac5ff11d3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ PtyCharDriver *s = chr->opaque;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int pty_chr_write(CharDriverState *chr, const uint8_t *buf, int len)\n\n{\n\n PtyCharDriver *s = chr->opaque;\n\n\n\n if (!s->connected) {\n\n /* guest sends data, check for (re-)connect */\n\n pty_chr_update_read_handler_locked(chr);\n\n return 0;\n\n }\n\n return io_channel_send(s->fd, buf, len);\n\n}\n"}} {"sample_id": "70976a7926b42d87e0c575412b85a8f5c1e48fad_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n #if defined(TARGET_PPC64)\n \n+ target_ulong lo = (uint32_t)env->gpr[n];\n \n target_ulong hi = (target_ulong)ldl_p(mem_buf) << 32;\n \n+ env->gpr[n] = lo | hi;\n \n #else\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int gdb_set_spe_reg(CPUState *env, uint8_t *mem_buf, int n)\n\n{\n\n if (n < 32) {\n\n#if defined(TARGET_PPC64)\n\n target_ulong lo = (uint32_t)env->gpr[n];\n\n target_ulong hi = (target_ulong)ldl_p(mem_buf) << 32;\n\n env->gpr[n] = lo | hi;\n\n#else\n\n env->gprh[n] = ldl_p(mem_buf);\n\n#endif\n\n return 4;\n\n }\n\n if (n == 33) {\n\n env->spe_acc = ldq_p(mem_buf);\n\n return 8;\n\n }\n\n if (n == 34) {\n\n /* SPEFSCR not implemented */\n\n return 4;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "4c7b023d56e09a78a587d036db1b64bf7c493b3d_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n FrameDecodeData *fdd;\n+\n+ NVDECFrame *cf;\n+\n+\n+\n if (!frame || !frame->private_ref)\n \n return -1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int get_ref_idx(AVFrame *frame)\n\n{\n\n FrameDecodeData *fdd;\n\n NVDECFrame *cf;\n\n\n\n if (!frame || !frame->private_ref)\n\n return -1;\n\n\n\n fdd = (FrameDecodeData*)frame->private_ref->data;\n\n cf = (NVDECFrame*)fdd->hwaccel_priv;\n\n\n\n return cf->idx;\n\n}\n"}} {"sample_id": "ce137829e7e58fcdc5ba63b5e256f972e80be438_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n \n \n if(!array ||\n+\n \t index_to<0 || index_to>=array->next ||\n \n \t index_from<0 || index_from>=array->next)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static inline int array_roll(array_t* array,int index_to,int index_from,int count)\n\n{\n\n char* buf;\n\n char* from;\n\n char* to;\n\n int is;\n\n\n\n if(!array ||\n\n\t index_to<0 || index_to>=array->next ||\n\n\t index_from<0 || index_from>=array->next)\n\n\treturn -1;\n\n\n\n if(index_to==index_from)\n\n\treturn 0;\n\n\n\n is=array->item_size;\n\n from=array->pointer+index_from*is;\n\n to=array->pointer+index_to*is;\n\n buf=g_malloc(is*count);\n\n memcpy(buf,from,is*count);\n\n\n\n if(index_topeer) {\n \n return -EBUSY;\n+\n+ }\n+\n bs->peer = qdev;\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int bdrv_attach(BlockDriverState *bs, DeviceState *qdev)\n\n{\n\n if (bs->peer) {\n\n return -EBUSY;\n\n }\n\n bs->peer = qdev;\n\n return 0;\n\n}\n"}} {"sample_id": "233aa5c2d1cf4655ffe335025a68cf5454f87dad", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n QemuOpts *opts;\n+\n int sock = -1;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int inet_connect(const char *str, Error **errp)\n\n{\n\n QemuOpts *opts;\n\n int sock = -1;\n\n\n\n opts = qemu_opts_create(&dummy_opts, NULL, 0, NULL);\n\n if (inet_parse(opts, str) == 0) {\n\n sock = inet_connect_opts(opts, true, NULL, errp);\n\n } else {\n\n error_set(errp, QERR_SOCKET_CREATE_FAILED);\n\n }\n\n qemu_opts_del(opts);\n\n return sock;\n\n}\n"}} {"sample_id": "4fa4ce7107c6ec432f185307158c5df91ce54308_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,8 +20,8 @@\n \n return -1;\n \n+ }\n+\n+ return lgetxattr(rpath(ctx, path, buffer), name, value, size);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ssize_t mp_user_getxattr(FsContext *ctx, const char *path,\n\n const char *name, void *value, size_t size)\n\n{\n\n char buffer[PATH_MAX];\n\n if (strncmp(name, \"user.virtfs.\", 12) == 0) {\n\n /*\n\n * Don't allow fetch of user.virtfs namesapce\n\n * in case of mapped security\n\n */\n\n errno = ENOATTR;\n\n return -1;\n\n }\n\n return lgetxattr(rpath(ctx, path, buffer), name, value, size);\n\n}\n"}} {"sample_id": "cdbf6e165988ab9d7c01da03b9e27bb8ac0c76aa_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -66,10 +66,10 @@\n \n qemu_chr_be_write(chr, buf, size);\n \n+ }\n+\n+\n+\n+ return TRUE;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static gboolean tcp_chr_read(GIOChannel *chan, GIOCondition cond, void *opaque)\n\n{\n\n CharDriverState *chr = opaque;\n\n TCPCharDriver *s = chr->opaque;\n\n uint8_t buf[READ_BUF_LEN];\n\n int len, size;\n\n\n\n if (!s->connected || s->max_size <= 0) {\n\n return FALSE;\n\n }\n\n len = sizeof(buf);\n\n if (len > s->max_size)\n\n len = s->max_size;\n\n size = tcp_chr_recv(chr, (void *)buf, len);\n\n if (size == 0) {\n\n /* connection closed */\n\n s->connected = 0;\n\n if (s->listen_chan) {\n\n s->listen_tag = g_io_add_watch(s->listen_chan, G_IO_IN, tcp_chr_accept, chr);\n\n }\n\n if (s->tag) {\n\n g_source_remove(s->tag);\n\n s->tag = 0;\n\n }\n\n g_io_channel_unref(s->chan);\n\n s->chan = NULL;\n\n closesocket(s->fd);\n\n s->fd = -1;\n\n qemu_chr_be_event(chr, CHR_EVENT_CLOSED);\n\n } else if (size > 0) {\n\n if (s->do_telnetopt)\n\n tcp_chr_process_IAC_bytes(chr, s, buf, &size);\n\n if (size > 0)\n\n qemu_chr_be_write(chr, buf, size);\n\n }\n\n\n\n return TRUE;\n\n}\n"}} {"sample_id": "eb2a770b178b9040c3fc04ee31dc38d1775db09a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n static int qcrypto_cipher_setiv_aes(QCryptoCipher *cipher,\n \n+ const uint8_t *iv, size_t niv,\n+\n Error **errp)\n \n+{\n+\n+ QCryptoCipherBuiltin *ctxt = cipher->opaque;\n+\n if (niv != 16) {\n \n error_setg(errp, \"IV must be 16 bytes not %zu\", niv);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int qcrypto_cipher_setiv_aes(QCryptoCipher *cipher,\n\n const uint8_t *iv, size_t niv,\n\n Error **errp)\n\n{\n\n QCryptoCipherBuiltin *ctxt = cipher->opaque;\n\n if (niv != 16) {\n\n error_setg(errp, \"IV must be 16 bytes not %zu\", niv);\n\n return -1;\n\n }\n\n\n\n g_free(ctxt->state.aes.iv);\n\n ctxt->state.aes.iv = g_new0(uint8_t, niv);\n\n memcpy(ctxt->state.aes.iv, iv, niv);\n\n ctxt->state.aes.niv = niv;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "b40acf99bef69fa8ab0f9092ff162fde945eec12_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+ uint8_t val;\n+\n+ val = ioport_read(0, addr);\n \n trace_cpu_in(addr, val);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint8_t cpu_inb(pio_addr_t addr)\n\n{\n\n uint8_t val;\n\n val = ioport_read(0, addr);\n\n trace_cpu_in(addr, val);\n\n LOG_IOPORT(\"inb : %04\"FMT_pioaddr\" %02\"PRIx8\"\\n\", addr, val);\n\n return val;\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_52", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void bdrv_flush_io_queue(BlockDriverState *bs)\n \n+{\n+\n+ BlockDriver *drv = bs->drv;\n+\n if (drv && drv->bdrv_flush_io_queue) {\n \n drv->bdrv_flush_io_queue(bs);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bdrv_flush_io_queue(BlockDriverState *bs)\n\n{\n\n BlockDriver *drv = bs->drv;\n\n if (drv && drv->bdrv_flush_io_queue) {\n\n drv->bdrv_flush_io_queue(bs);\n\n } else if (bs->file) {\n\n bdrv_flush_io_queue(bs->file);\n\n }\n\n}\n"}} {"sample_id": "cac8de2da5c4935773128335c11b806faa73e19d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void copy_context_reset(AVCodecContext *avctx)\n {\n av_opt_free(avctx);\n+ av_freep(&avctx->rc_override);\n+ av_freep(&avctx->intra_matrix);\n+ av_freep(&avctx->inter_matrix);\n av_freep(&avctx->extradata);\n av_freep(&avctx->subtitle_header);\n av_buffer_unref(&avctx->hw_frames_ctx);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void copy_context_reset(AVCodecContext *avctx)\n{\n av_opt_free(avctx);\n av_freep(&avctx->rc_override);\n av_freep(&avctx->intra_matrix);\n av_freep(&avctx->inter_matrix);\n av_freep(&avctx->extradata);\n av_freep(&avctx->subtitle_header);\n av_buffer_unref(&avctx->hw_frames_ctx);\n avctx->subtitle_header_size = 0;\n avctx->extradata_size = 0;\n}"}} {"sample_id": "7d49f79f1cd47783a963a757a6563b9cac29db62", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n int16_t *out = data;\n \n int i;\n+\n+\n+\n+ if(!buf)\n+\n return 0;\n \n if(buf_size < s->checksum_size)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int qdm2_decode_frame(AVCodecContext *avctx,\n\n void *data, int *data_size,\n\n AVPacket *avpkt)\n\n{\n\n const uint8_t *buf = avpkt->data;\n\n int buf_size = avpkt->size;\n\n QDM2Context *s = avctx->priv_data;\n\n int16_t *out = data;\n\n int i;\n\n\n\n if(!buf)\n\n return 0;\n\n if(buf_size < s->checksum_size)\n\n return -1;\n\n\n\n av_log(avctx, AV_LOG_DEBUG, \"decode(%d): %p[%d] -> %p[%d]\\n\",\n\n buf_size, buf, s->checksum_size, data, *data_size);\n\n\n\n for (i = 0; i < 16; i++) {\n\n if (qdm2_decode(s, buf, out) < 0)\n\n return -1;\n\n out += s->channels * s->frame_size;\n\n }\n\n\n\n *data_size = (uint8_t*)out - (uint8_t*)data;\n\n\n\n return s->checksum_size;\n\n}\n"}} {"sample_id": "df3c286c53ac51e7267f2761c7a0c62e11b6e815", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n strerror(-ret));\n \n exit(1);\n+\n+ } else {\n+\n+ DPRINTF(\"Enabled KVM_CAP_SPLIT_IRQCHIP\\n\");\n+\n kvm_split_irqchip = true;\n \n return 1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int kvm_arch_irqchip_create(MachineState *ms, KVMState *s)\n\n{\n\n int ret;\n\n if (machine_kernel_irqchip_split(ms)) {\n\n ret = kvm_vm_enable_cap(s, KVM_CAP_SPLIT_IRQCHIP, 0, 24);\n\n if (ret) {\n\n error_report(\"Could not enable split irqchip mode: %s\\n\",\n\n strerror(-ret));\n\n exit(1);\n\n } else {\n\n DPRINTF(\"Enabled KVM_CAP_SPLIT_IRQCHIP\\n\");\n\n kvm_split_irqchip = true;\n\n return 1;\n\n }\n\n } else {\n\n return 0;\n\n }\n\n}\n"}} {"sample_id": "8607f5c3072caeebbe0217df28651fffd3a79fd9_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n int i)\n \n {\n+\n+ hwaddr pa;\n+\n+ virtio_tswap32s(vq->vdev, &uelem->id);\n \n virtio_tswap32s(vq->vdev, &uelem->len);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void vring_used_write(VirtQueue *vq, VRingUsedElem *uelem,\n\n int i)\n\n{\n\n hwaddr pa;\n\n virtio_tswap32s(vq->vdev, &uelem->id);\n\n virtio_tswap32s(vq->vdev, &uelem->len);\n\n pa = vq->vring.used + offsetof(VRingUsed, ring[i]);\n\n address_space_write(&address_space_memory, pa, MEMTXATTRS_UNSPECIFIED,\n\n (void *)uelem, sizeof(VRingUsedElem));\n\n}\n"}} {"sample_id": "41cbc23c5ca37a8b841915d7d252a02106d58b1e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n static char buf[16];\n \n if (addr < PCI_IO_SIZE) {\n+\n+ const char *r = reg[addr / 4];\n+\n+ if (r != 0) {\n+\n sprintf(buf, \"%s+%u\", r, addr % 4);\n \n } else {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static char *regname(uint32_t addr)\n\n{\n\n static char buf[16];\n\n if (addr < PCI_IO_SIZE) {\n\n const char *r = reg[addr / 4];\n\n if (r != 0) {\n\n sprintf(buf, \"%s+%u\", r, addr % 4);\n\n } else {\n\n sprintf(buf, \"0x%02x\", addr);\n\n }\n\n } else {\n\n sprintf(buf, \"??? 0x%08x\", addr);\n\n }\n\n return buf;\n\n}\n"}} {"sample_id": "79d16c21a565927943486b26789caa62413ff371", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,23 +7,23 @@\n struct virtio_gpu_simple_resource *res, *tmp;\n \n int i;\n+\n+\n+\n+ g->enable = 0;\n+\n \n+\n+ QTAILQ_FOREACH_SAFE(res, &g->reslist, next, tmp) {\n \n+ virtio_gpu_resource_destroy(g, res);\n \n }\n \n for (i = 0; i < g->conf.max_outputs; i++) {\n \n #if 0\n+\n g->req_state[i].x = 0;\n \n g->req_state[i].y = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void virtio_gpu_reset(VirtIODevice *vdev)\n\n{\n\n VirtIOGPU *g = VIRTIO_GPU(vdev);\n\n struct virtio_gpu_simple_resource *res, *tmp;\n\n int i;\n\n\n\n g->enable = 0;\n\n\n\n QTAILQ_FOREACH_SAFE(res, &g->reslist, next, tmp) {\n\n virtio_gpu_resource_destroy(g, res);\n\n }\n\n for (i = 0; i < g->conf.max_outputs; i++) {\n\n#if 0\n\n g->req_state[i].x = 0;\n\n g->req_state[i].y = 0;\n\n if (i == 0) {\n\n g->req_state[0].width = 1024;\n\n g->req_state[0].height = 768;\n\n } else {\n\n g->req_state[i].width = 0;\n\n g->req_state[i].height = 0;\n\n }\n\n#endif\n\n g->scanout[i].resource_id = 0;\n\n g->scanout[i].width = 0;\n\n g->scanout[i].height = 0;\n\n g->scanout[i].x = 0;\n\n g->scanout[i].y = 0;\n\n g->scanout[i].ds = NULL;\n\n }\n\n g->enabled_output_bitmask = 1;\n\n\n\n#ifdef CONFIG_VIRGL\n\n if (g->use_virgl_renderer) {\n\n virtio_gpu_virgl_reset(g);\n\n g->use_virgl_renderer = 0;\n\n }\n\n#endif\n\n}\n"}} {"sample_id": "b12e4d3bb8df994f042ff1216fb8de2b967aab9e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n \n \n size = d->size;\n+\n+ av_free(d);\n+\n+ av_free(s);\n+\n return size;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int ffio_close_null_buf(AVIOContext *s)\n\n{\n\n DynBuffer *d = s->opaque;\n\n int size;\n\n\n\n avio_flush(s);\n\n\n\n size = d->size;\n\n av_free(d);\n\n av_free(s);\n\n return size;\n\n}\n"}} {"sample_id": "0f53994f7ad4d34e0a0a4a10cb71b2f936e25e3f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int kvm_put_xsave(CPUState *env)\n+\n {\n \n #ifdef KVM_CAP_XSAVE\n@@ -18,7 +18,7 @@\n \n \n \n+ xsave = qemu_memalign(4096, sizeof(struct kvm_xsave));\n \n memset(xsave, 0, sizeof(struct kvm_xsave));\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int kvm_put_xsave(CPUState *env)\n\n{\n\n#ifdef KVM_CAP_XSAVE\n\n int i;\n\n struct kvm_xsave* xsave;\n\n uint16_t cwd, swd, twd, fop;\n\n\n\n if (!kvm_has_xsave())\n\n return kvm_put_fpu(env);\n\n\n\n xsave = qemu_memalign(4096, sizeof(struct kvm_xsave));\n\n memset(xsave, 0, sizeof(struct kvm_xsave));\n\n cwd = swd = twd = fop = 0;\n\n swd = env->fpus & ~(7 << 11);\n\n swd |= (env->fpstt & 7) << 11;\n\n cwd = env->fpuc;\n\n for (i = 0; i < 8; ++i)\n\n twd |= (!env->fptags[i]) << i;\n\n xsave->region[0] = (uint32_t)(swd << 16) + cwd;\n\n xsave->region[1] = (uint32_t)(fop << 16) + twd;\n\n memcpy(&xsave->region[XSAVE_ST_SPACE], env->fpregs,\n\n sizeof env->fpregs);\n\n memcpy(&xsave->region[XSAVE_XMM_SPACE], env->xmm_regs,\n\n sizeof env->xmm_regs);\n\n xsave->region[XSAVE_MXCSR] = env->mxcsr;\n\n *(uint64_t *)&xsave->region[XSAVE_XSTATE_BV] = env->xstate_bv;\n\n memcpy(&xsave->region[XSAVE_YMMH_SPACE], env->ymmh_regs,\n\n sizeof env->ymmh_regs);\n\n return kvm_vcpu_ioctl(env, KVM_SET_XSAVE, xsave);\n\n#else\n\n return kvm_put_fpu(env);\n\n#endif\n\n}\n"}} {"sample_id": "048c5fd1bfc787adcb1b726ce997e87fe44545fd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n int64_t offset, int count)\n \n {\n+\n int ret;\n \n BDRVQcow2State *s = bs->opaque;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static coroutine_fn int qcow2_co_pdiscard(BlockDriverState *bs,\n\n int64_t offset, int count)\n\n{\n\n int ret;\n\n BDRVQcow2State *s = bs->opaque;\n\n\n\n if (!QEMU_IS_ALIGNED(offset | count, s->cluster_size)) {\n\n assert(count < s->cluster_size);\n\n return -ENOTSUP;\n\n }\n\n\n\n qemu_co_mutex_lock(&s->lock);\n\n ret = qcow2_discard_clusters(bs, offset, count >> BDRV_SECTOR_BITS,\n\n QCOW2_DISCARD_REQUEST, false);\n\n qemu_co_mutex_unlock(&s->lock);\n\n return ret;\n\n}\n"}} {"sample_id": "dfd100f242370886bb6732f70f1f7cbd8eb9fedc_27", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n case SOCKET_ADDRESS_FLAT_TYPE_VSOCK:\n \n+ addr->type = SOCKET_ADDRESS_KIND_VSOCK;\n+\n+ addr->u.vsock.data = QAPI_CLONE(VsockSocketAddress,\n+\n+ &addr_flat->u.vsock);\n \n break;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "SocketAddress *socket_address_crumple(SocketAddressFlat *addr_flat)\n\n{\n\n SocketAddress *addr = g_new(SocketAddress, 1);\n\n\n\n switch (addr_flat->type) {\n\n case SOCKET_ADDRESS_FLAT_TYPE_INET:\n\n addr->type = SOCKET_ADDRESS_KIND_INET;\n\n addr->u.inet.data = QAPI_CLONE(InetSocketAddress,\n\n &addr_flat->u.inet);\n\n break;\n\n case SOCKET_ADDRESS_FLAT_TYPE_UNIX:\n\n addr->type = SOCKET_ADDRESS_KIND_UNIX;\n\n addr->u.q_unix.data = QAPI_CLONE(UnixSocketAddress,\n\n &addr_flat->u.q_unix);\n\n break;\n\n case SOCKET_ADDRESS_FLAT_TYPE_VSOCK:\n\n addr->type = SOCKET_ADDRESS_KIND_VSOCK;\n\n addr->u.vsock.data = QAPI_CLONE(VsockSocketAddress,\n\n &addr_flat->u.vsock);\n\n break;\n\n case SOCKET_ADDRESS_FLAT_TYPE_FD:\n\n addr->type = SOCKET_ADDRESS_KIND_FD;\n\n addr->u.fd.data = QAPI_CLONE(String, &addr_flat->u.fd);\n\n break;\n\n default:\n\n abort();\n\n }\n\n\n\n return addr;\n\n}\n"}} {"sample_id": "5eaaffaf64d1854493f0fe9ec822eed1b3cd9fe1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n ff_dct_init(&dct, 5, DCT_II);\n \n+ ff_init_mpadsp_tabs_float();\n+\n+ ff_init_mpadsp_tabs_fixed();\n+\n+\n \n s->apply_window_float = ff_mpadsp_apply_window_float;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "av_cold void ff_mpadsp_init(MPADSPContext *s)\n\n{\n\n DCTContext dct;\n\n\n\n ff_dct_init(&dct, 5, DCT_II);\n\n ff_init_mpadsp_tabs_float();\n\n ff_init_mpadsp_tabs_fixed();\n\n\n\n s->apply_window_float = ff_mpadsp_apply_window_float;\n\n s->apply_window_fixed = ff_mpadsp_apply_window_fixed;\n\n\n\n s->dct32_float = dct.dct32;\n\n s->dct32_fixed = ff_dct32_fixed;\n\n\n\n s->imdct36_blocks_float = ff_imdct36_blocks_float;\n\n s->imdct36_blocks_fixed = ff_imdct36_blocks_fixed;\n\n\n\n if (ARCH_AARCH64) ff_mpadsp_init_aarch64(s);\n\n if (ARCH_ARM) ff_mpadsp_init_arm(s);\n\n if (ARCH_PPC) ff_mpadsp_init_ppc(s);\n\n if (ARCH_X86) ff_mpadsp_init_x86(s);\n\n if (HAVE_MIPSFPU) ff_mpadsp_init_mipsfpu(s);\n\n if (HAVE_MIPSDSP) ff_mpadsp_init_mipsdsp(s);\n\n}\n"}} {"sample_id": "9be52d48d9137e05361dd1ffb6b1fb3677e1fb47", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n for (i = 0; i < AC3_MAX_COEFS; i++) {\n \n int e;\n+\n+ int v = abs(SCALE_COEF(block->mdct_coef[ch][i]));\n+\n+ if (v == 0)\n+\n e = 24;\n \n else {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void extract_exponents(AC3EncodeContext *s)\n\n{\n\n int blk, ch, i;\n\n\n\n for (ch = 0; ch < s->channels; ch++) {\n\n for (blk = 0; blk < AC3_MAX_BLOCKS; blk++) {\n\n AC3Block *block = &s->blocks[blk];\n\n for (i = 0; i < AC3_MAX_COEFS; i++) {\n\n int e;\n\n int v = abs(SCALE_COEF(block->mdct_coef[ch][i]));\n\n if (v == 0)\n\n e = 24;\n\n else {\n\n e = 23 - av_log2(v) + block->exp_shift[ch];\n\n if (e >= 24) {\n\n e = 24;\n\n block->mdct_coef[ch][i] = 0;\n\n }\n\n }\n\n block->exp[ch][i] = e;\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "ce5b1bbf624b977a55ff7f85bb3871682d03baff_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n CPUState *cs = CPU(obj);\n+\n OpenRISCCPU *cpu = OPENRISC_CPU(obj);\n \n static int inited;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void openrisc_cpu_initfn(Object *obj)\n\n{\n\n CPUState *cs = CPU(obj);\n\n OpenRISCCPU *cpu = OPENRISC_CPU(obj);\n\n static int inited;\n\n\n\n cs->env_ptr = &cpu->env;\n\n cpu_exec_init(cs, &error_abort);\n\n\n\n#ifndef CONFIG_USER_ONLY\n\n cpu_openrisc_mmu_init(cpu);\n\n#endif\n\n\n\n if (tcg_enabled() && !inited) {\n\n inited = 1;\n\n openrisc_translate_init();\n\n }\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_69", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,6 +6,6 @@\n \n reg->current_index = ntohl(reg->current_index);\n \n+ reg->chunks = ntohll(reg->chunks);\n+\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void network_to_register(RDMARegister *reg)\n\n{\n\n reg->key.current_addr = ntohll(reg->key.current_addr);\n\n reg->current_index = ntohl(reg->current_index);\n\n reg->chunks = ntohll(reg->chunks);\n\n}\n"}} {"sample_id": "b1ade3d1821a29174963b28cd0caa5f7ed394998", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n void ff_celp_lp_synthesis_filterf(float *out,\n \n const float* filter_coeffs,\n+\n+ const float* in,\n+\n+ int buffer_length,\n+\n int filter_length)\n \n {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_celp_lp_synthesis_filterf(float *out,\n\n const float* filter_coeffs,\n\n const float* in,\n\n int buffer_length,\n\n int filter_length)\n\n{\n\n int i,n;\n\n\n\n // Avoids a +1 in the inner loop.\n\n filter_length++;\n\n\n\n for (n = 0; n < buffer_length; n++) {\n\n out[n] = in[n];\n\n for (i = 1; i < filter_length; i++)\n\n out[n] -= filter_coeffs[i-1] * out[n-i];\n\n }\n\n}\n"}} {"sample_id": "0b54f3c0878a3acaa9142e4f24942e762d97e350_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static int gif_read_close(AVFormatContext *s1)\n+\n+{\n+\n GifState *s = s1->priv_data;\n \n av_free(s->image_buf);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int gif_read_close(AVFormatContext *s1)\n\n{\n\n GifState *s = s1->priv_data;\n\n av_free(s->image_buf);\n\n return 0;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_107", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void put_unused_buffer(QEMUFile *f, void *pv, size_t size)\n+\n+{\n+\n+ static const uint8_t buf[1024];\n \n int block_len;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void put_unused_buffer(QEMUFile *f, void *pv, size_t size)\n\n{\n\n static const uint8_t buf[1024];\n\n int block_len;\n\n\n\n while (size > 0) {\n\n block_len = MIN(sizeof(buf), size);\n\n size -= block_len;\n\n qemu_put_buffer(f, buf, block_len);\n\n }\n\n}\n"}} {"sample_id": "5e885275f1eda3f0281747d9c78d072adb8bc940", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n int ff_MPV_lowest_referenced_row(MpegEncContext *s, int dir)\n \n {\n+\n int my_max = INT_MIN, my_min = INT_MAX, qpel_shift = !s->quarter_sample;\n \n int my, off, i, mvs;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int ff_MPV_lowest_referenced_row(MpegEncContext *s, int dir)\n\n{\n\n int my_max = INT_MIN, my_min = INT_MAX, qpel_shift = !s->quarter_sample;\n\n int my, off, i, mvs;\n\n\n\n if (s->picture_structure != PICT_FRAME) goto unhandled;\n\n\n\n switch (s->mv_type) {\n\n case MV_TYPE_16X16:\n\n mvs = 1;\n\n break;\n\n case MV_TYPE_16X8:\n\n mvs = 2;\n\n break;\n\n case MV_TYPE_8X8:\n\n mvs = 4;\n\n break;\n\n default:\n\n goto unhandled;\n\n }\n\n\n\n for (i = 0; i < mvs; i++) {\n\n my = s->mv[dir][i][1]<> 6;\n\n\n\n return FFMIN(FFMAX(s->mb_y + off, 0), s->mb_height-1);\n\nunhandled:\n\n return s->mb_height-1;\n\n}\n"}} {"sample_id": "5e715b583dab85735660b15a8d217a69164675fe", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static int parse_key(DBEContext *s)\n+\n+{\n+\n+ int key = 0;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int parse_key(DBEContext *s)\n\n{\n\n int key = 0;\n\n\n\n if (s->key_present && s->input_size > 0)\n\n key = AV_RB24(s->input) >> 24 - s->word_bits;\n\n\n\n skip_input(s, s->key_present);\n\n return key;\n\n}\n"}} {"sample_id": "0b06ef3bdd17742ae50c0662d3fe8ed944648890", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,8 +3,8 @@\n {\n \n /* Always run first iteration so any pending completion BHs run */\n+\n+ bool busy = true;\n \n BlockDriverState *bs;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void bdrv_drain_all(void)\n\n{\n\n /* Always run first iteration so any pending completion BHs run */\n\n bool busy = true;\n\n BlockDriverState *bs;\n\n\n\n while (busy) {\n\n /* FIXME: We do not have timer support here, so this is effectively\n\n * a busy wait.\n\n */\n\n QTAILQ_FOREACH(bs, &bdrv_states, list) {\n\n if (bdrv_start_throttled_reqs(bs)) {\n\n busy = true;\n\n }\n\n }\n\n\n\n busy = bdrv_requests_pending_all();\n\n busy |= aio_poll(qemu_get_aio_context(), busy);\n\n }\n\n}\n"}} {"sample_id": "2c6942fa7b332a95286071b92d233853e1000948", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n int64_t bdrv_getlength(BlockDriverState *bs)\n \n+{\n+\n+ BlockDriver *drv = bs->drv;\n+\n+ if (!drv)\n \n return -ENOMEDIUM;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int64_t bdrv_getlength(BlockDriverState *bs)\n\n{\n\n BlockDriver *drv = bs->drv;\n\n if (!drv)\n\n return -ENOMEDIUM;\n\n\n\n if (bs->growable || bs->removable) {\n\n if (drv->bdrv_getlength) {\n\n return drv->bdrv_getlength(bs);\n\n }\n\n }\n\n return bs->total_sectors * BDRV_SECTOR_SIZE;\n\n}\n"}} {"sample_id": "5dafc53f1fb091d242f2179ffcb43bb28af36d1e_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n fseek(f->outfile, f->buf_offset, SEEK_SET);\n \n+ fwrite(f->buf, 1, f->buf_index, f->outfile);\n+\n+ } else {\n+\n+ bdrv_pwrite(f->bs, f->base_offset + f->buf_offset,\n \n f->buf, f->buf_index);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_fflush(QEMUFile *f)\n\n{\n\n if (!f->is_writable)\n\n return;\n\n if (f->buf_index > 0) {\n\n if (f->is_file) {\n\n fseek(f->outfile, f->buf_offset, SEEK_SET);\n\n fwrite(f->buf, 1, f->buf_index, f->outfile);\n\n } else {\n\n bdrv_pwrite(f->bs, f->base_offset + f->buf_offset,\n\n f->buf, f->buf_index);\n\n }\n\n f->buf_offset += f->buf_index;\n\n f->buf_index = 0;\n\n }\n\n}\n"}} {"sample_id": "ef0c6d9b01de773e5a1177de5fcbb981aac44d65", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void free_device_list(AVOpenCLDeviceList *device_list)\n \n+{\n \n int i, j;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void free_device_list(AVOpenCLDeviceList *device_list)\n\n{\n\n int i, j;\n\n if (!device_list)\n\n return;\n\n for (i = 0; i < device_list->platform_num; i++) {\n\n if (!device_list->platform_node[i])\n\n continue;\n\n for (j = 0; j < device_list->platform_node[i]->device_num; j++) {\n\n av_freep(&(device_list->platform_node[i]->device_node[j]->device_name));\n\n av_freep(&(device_list->platform_node[i]->device_node[j]));\n\n }\n\n av_freep(&device_list->platform_node[i]->device_node);\n\n av_freep(&(device_list->platform_node[i]->platform_name));\n\n av_freep(&device_list->platform_node[i]);\n\n }\n\n av_freep(&device_list->platform_node);\n\n device_list->platform_num = 0;\n\n}\n"}} {"sample_id": "2c62f08ddbf3fa80dc7202eb9a2ea60ae44e2cc5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n if (size < 0) {\n \n+ hw_error(\"Load kernel error: '%s'\\n\", kernel_filename);\n+\n+ }\n+\n+\n \n /* cheat curses that we have a graphic console, only under ocd console */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void puv3_load_kernel(const char *kernel_filename)\n\n{\n\n int size;\n\n\n\n assert(kernel_filename != NULL);\n\n\n\n /* only zImage format supported */\n\n size = load_image_targphys(kernel_filename, KERNEL_LOAD_ADDR,\n\n KERNEL_MAX_SIZE);\n\n if (size < 0) {\n\n hw_error(\"Load kernel error: '%s'\\n\", kernel_filename);\n\n }\n\n\n\n /* cheat curses that we have a graphic console, only under ocd console */\n\n graphic_console_init(NULL, NULL, NULL, NULL, NULL);\n\n}\n"}} {"sample_id": "ae50b2747f77944faa79eb914272b54eb30b63b3_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,10 +5,10 @@\n int i;\n \n NICInfo *nic;\n+\n+\n+\n+ for (i = 0; i < MAX_NICS; i++) {\n \n nic = &nd_table[i];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void destroy_nic(dev_match_fn *match_fn, void *arg)\n\n{\n\n int i;\n\n NICInfo *nic;\n\n\n\n for (i = 0; i < MAX_NICS; i++) {\n\n nic = &nd_table[i];\n\n if (nic->used) {\n\n if (nic->private && match_fn(nic->private, arg)) {\n\n if (nic->vlan) {\n\n VLANClientState *vc;\n\n vc = qemu_find_vlan_client(nic->vlan, nic->private);\n\n if (vc)\n\n qemu_del_vlan_client(vc);\n\n }\n\n net_client_uninit(nic);\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "8f6e699ddbcad32480fa64796ccf44cbaf5b4b91", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n \n \n if (s->waiting == 1 || !s->current || req->hba_private != s->current ||\n+\n+ (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {\n+\n+ if (lsi_queue_req(s, req, len)) {\n+\n return;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void lsi_transfer_data(SCSIRequest *req, uint32_t len)\n\n{\n\n LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);\n\n int out;\n\n\n\n if (s->waiting == 1 || !s->current || req->hba_private != s->current ||\n\n (lsi_irq_on_rsl(s) && !(s->scntl1 & LSI_SCNTL1_CON))) {\n\n if (lsi_queue_req(s, req, len)) {\n\n return;\n\n }\n\n }\n\n\n\n out = (s->sstat1 & PHASE_MASK) == PHASE_DO;\n\n\n\n /* host adapter (re)connected */\n\n DPRINTF(\"Data ready tag=0x%x len=%d\\n\", req->tag, len);\n\n s->current->dma_len = len;\n\n s->command_complete = 1;\n\n if (s->waiting) {\n\n if (s->waiting == 1 || s->dbc == 0) {\n\n lsi_resume_script(s);\n\n } else {\n\n lsi_do_dma(s, out);\n\n }\n\n }\n\n}\n"}} {"sample_id": "e17408283562be359f16a7e12ddfee7509d6fe11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -35,11 +35,11 @@\n }\n \n \n+\n+ /* Attempt to detect via a floppy specific ioctl */\n+\n+ ret = ioctl(fd, FDGETPRM, &fdparam);\n+\n if (ret >= 0)\n \n prio = 100;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int floppy_probe_device(const char *filename)\n\n{\n\n int fd, ret;\n\n int prio = 0;\n\n struct floppy_struct fdparam;\n\n struct stat st;\n\n\n\n if (strstart(filename, \"/dev/fd\", NULL))\n\n prio = 50;\n\n\n\n fd = open(filename, O_RDONLY | O_NONBLOCK);\n\n if (fd < 0) {\n\n goto out;\n\n }\n\n ret = fstat(fd, &st);\n\n if (ret == -1 || !S_ISBLK(st.st_mode)) {\n\n goto outc;\n\n }\n\n\n\n /* Attempt to detect via a floppy specific ioctl */\n\n ret = ioctl(fd, FDGETPRM, &fdparam);\n\n if (ret >= 0)\n\n prio = 100;\n\n\n\noutc:\n\n close(fd);\n\nout:\n\n return prio;\n\n}\n"}} {"sample_id": "02ffa034fb747f09a4f5658ed64871dcee4aaca2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void sigaction_invoke(struct sigaction *action,\n+\n struct qemu_signalfd_siginfo *info)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void sigaction_invoke(struct sigaction *action,\n\n struct qemu_signalfd_siginfo *info)\n\n{\n\n siginfo_t si = { 0 };\n\n si.si_signo = info->ssi_signo;\n\n si.si_errno = info->ssi_errno;\n\n si.si_code = info->ssi_code;\n\n\n\n /* Convert the minimal set of fields defined by POSIX.\n\n * Positive si_code values are reserved for kernel-generated\n\n * signals, where the valid siginfo fields are determined by\n\n * the signal number. But according to POSIX, it is unspecified\n\n * whether SI_USER and SI_QUEUE have values less than or equal to\n\n * zero.\n\n */\n\n if (info->ssi_code == SI_USER || info->ssi_code == SI_QUEUE ||\n\n info->ssi_code <= 0) {\n\n /* SIGTERM, etc. */\n\n si.si_pid = info->ssi_pid;\n\n si.si_uid = info->ssi_uid;\n\n } else if (info->ssi_signo == SIGILL || info->ssi_signo == SIGFPE ||\n\n info->ssi_signo == SIGSEGV || info->ssi_signo == SIGBUS) {\n\n si.si_addr = (void *)(uintptr_t)info->ssi_addr;\n\n } else if (info->ssi_signo == SIGCHLD) {\n\n si.si_pid = info->ssi_pid;\n\n si.si_status = info->ssi_status;\n\n si.si_uid = info->ssi_uid;\n\n }\n\n action->sa_sigaction(info->ssi_signo, &si, NULL);\n\n}\n"}} {"sample_id": "08844473820c93541fc47bdfeae0f2cc88cfab59", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static int coroutine_fn bdrv_co_writev_em(BlockDriverState *bs,\n+\n int64_t sector_num, int nb_sectors,\n \n QEMUIOVector *iov)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int coroutine_fn bdrv_co_writev_em(BlockDriverState *bs,\n\n int64_t sector_num, int nb_sectors,\n\n QEMUIOVector *iov)\n\n{\n\n return bdrv_co_io_em(bs, sector_num, nb_sectors, iov, true);\n\n}\n"}} {"sample_id": "34779e8c3991f7fcd74b2045478abcef67dbeb15_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,7 +16,7 @@\n \n test_init(&td);\n \n+\n \n stop_tco(&td);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void test_tco_second_timeout_pause(void)\n\n{\n\n TestData td;\n\n const uint16_t ticks = TCO_SECS_TO_TICKS(32);\n\n QDict *ad;\n\n\n\n td.args = \"-watchdog-action pause\";\n\n td.noreboot = false;\n\n test_init(&td);\n\n\n\n stop_tco(&td);\n\n clear_tco_status(&td);\n\n reset_on_second_timeout(true);\n\n set_tco_timeout(&td, TCO_SECS_TO_TICKS(16));\n\n load_tco(&td);\n\n start_tco(&td);\n\n clock_step(ticks * TCO_TICK_NSEC * 2);\n\n ad = get_watchdog_action();\n\n g_assert(!strcmp(qdict_get_str(ad, \"action\"), \"pause\"));\n\n QDECREF(ad);\n\n\n\n stop_tco(&td);\n\n qtest_end();\n\n}\n"}} {"sample_id": "7d5e199ade76c53ec316ab6779800581bb47c50a_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -44,10 +44,10 @@\n \n *result = NULL;\n \n+ v->result = result;\n+\n+\n+\n+ return &v->visitor;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "Visitor *qmp_output_visitor_new(QObject **result)\n\n{\n\n QmpOutputVisitor *v;\n\n\n\n v = g_malloc0(sizeof(*v));\n\n\n\n v->visitor.type = VISITOR_OUTPUT;\n\n v->visitor.start_struct = qmp_output_start_struct;\n\n v->visitor.end_struct = qmp_output_end_struct;\n\n v->visitor.start_list = qmp_output_start_list;\n\n v->visitor.next_list = qmp_output_next_list;\n\n v->visitor.end_list = qmp_output_end_list;\n\n v->visitor.type_int64 = qmp_output_type_int64;\n\n v->visitor.type_uint64 = qmp_output_type_uint64;\n\n v->visitor.type_bool = qmp_output_type_bool;\n\n v->visitor.type_str = qmp_output_type_str;\n\n v->visitor.type_number = qmp_output_type_number;\n\n v->visitor.type_any = qmp_output_type_any;\n\n v->visitor.type_null = qmp_output_type_null;\n\n v->visitor.complete = qmp_output_complete;\n\n v->visitor.free = qmp_output_free;\n\n\n\n *result = NULL;\n\n v->result = result;\n\n\n\n return &v->visitor;\n\n}\n"}} {"sample_id": "2884cf5b934808f547b5268a51be631805c25857_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n \n \n if (!gd_is_grab_active(s) && gd_grab_on_hover(s)) {\n+\n+ gd_ungrab_keyboard(s);\n+\n+ }\n+\n \n \n return TRUE;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static gboolean gd_leave_event(GtkWidget *widget, GdkEventCrossing *crossing,\n\n gpointer opaque)\n\n{\n\n VirtualConsole *vc = opaque;\n\n GtkDisplayState *s = vc->s;\n\n\n\n if (!gd_is_grab_active(s) && gd_grab_on_hover(s)) {\n\n gd_ungrab_keyboard(s);\n\n }\n\n\n\n return TRUE;\n\n}\n"}} {"sample_id": "e01b444523e2b0c663b42b3e8f44ef48a6153051", "diff": "--- a/source.c\n+++ b/source.c\n@@ -58,11 +58,11 @@\n \n }\n \n+ }\n+\n+ if (nx == 0) {\n+\n+ access |= PAGE_EXEC;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ppc_hash32_pp_check(int key, int pp, int nx)\n\n{\n\n int access;\n\n\n\n /* Compute access rights */\n\n access = 0;\n\n if (key == 0) {\n\n switch (pp) {\n\n case 0x0:\n\n case 0x1:\n\n case 0x2:\n\n access |= PAGE_WRITE;\n\n /* No break here */\n\n case 0x3:\n\n access |= PAGE_READ;\n\n break;\n\n }\n\n } else {\n\n switch (pp) {\n\n case 0x0:\n\n access = 0;\n\n break;\n\n case 0x1:\n\n case 0x3:\n\n access = PAGE_READ;\n\n break;\n\n case 0x2:\n\n access = PAGE_READ | PAGE_WRITE;\n\n break;\n\n }\n\n }\n\n if (nx == 0) {\n\n access |= PAGE_EXEC;\n\n }\n\n\n\n return access;\n\n}\n"}} {"sample_id": "eb700029c7836798046191d62d595363d92c84d4_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n bool net_tx_pkt_send(struct NetTxPkt *pkt, NetClientState *nc)\n+\n+{\n+\n+ assert(pkt);\n+\n \n \n if (!pkt->has_virt_hdr &&", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool net_tx_pkt_send(struct NetTxPkt *pkt, NetClientState *nc)\n\n{\n\n assert(pkt);\n\n\n\n if (!pkt->has_virt_hdr &&\n\n pkt->virt_hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {\n\n net_tx_pkt_do_sw_csum(pkt);\n\n }\n\n\n\n /*\n\n * Since underlying infrastructure does not support IP datagrams longer\n\n * than 64K we should drop such packets and don't even try to send\n\n */\n\n if (VIRTIO_NET_HDR_GSO_NONE != pkt->virt_hdr.gso_type) {\n\n if (pkt->payload_len >\n\n ETH_MAX_IP_DGRAM_LEN -\n\n pkt->vec[NET_TX_PKT_L3HDR_FRAG].iov_len) {\n\n return false;\n\n }\n\n }\n\n\n\n if (pkt->has_virt_hdr ||\n\n pkt->virt_hdr.gso_type == VIRTIO_NET_HDR_GSO_NONE) {\n\n qemu_sendv_packet(nc, pkt->vec,\n\n pkt->payload_frags + NET_TX_PKT_PL_START_FRAG);\n\n return true;\n\n }\n\n\n\n return net_tx_pkt_do_sw_fragmentation(pkt, nc);\n\n}\n"}} {"sample_id": "6886867e9880830d735d8ae6f6cc63ed9eb2be0c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -45,11 +45,11 @@\n }\n \n memory_region_unref(mr);\n+\n+ return;\n+\n+ }\n+\n if (is_write) {\n \n address_space_write(as, bounce.addr, bounce.buffer, access_len);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len,\n\n int is_write, hwaddr access_len)\n\n{\n\n if (buffer != bounce.buffer) {\n\n MemoryRegion *mr;\n\n ram_addr_t addr1;\n\n\n\n mr = qemu_ram_addr_from_host(buffer, &addr1);\n\n assert(mr != NULL);\n\n if (is_write) {\n\n while (access_len) {\n\n unsigned l;\n\n l = TARGET_PAGE_SIZE;\n\n if (l > access_len)\n\n l = access_len;\n\n invalidate_and_set_dirty(addr1, l);\n\n addr1 += l;\n\n access_len -= l;\n\n }\n\n }\n\n if (xen_enabled()) {\n\n xen_invalidate_map_cache_entry(buffer);\n\n }\n\n memory_region_unref(mr);\n\n return;\n\n }\n\n if (is_write) {\n\n address_space_write(as, bounce.addr, bounce.buffer, access_len);\n\n }\n\n qemu_vfree(bounce.buffer);\n\n bounce.buffer = NULL;\n\n memory_region_unref(bounce.mr);\n\n cpu_notify_map_clients();\n\n}\n"}} {"sample_id": "ba801af429aaa68f6cc03842c8b6be81a6ede65a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n env->CP0_Wired = arg1 % env->tlb->nb_tlb;\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void helper_mtc0_wired(CPUMIPSState *env, target_ulong arg1)\n\n{\n\n env->CP0_Wired = arg1 % env->tlb->nb_tlb;\n\n}\n"}} {"sample_id": "f68826989cd4d1217797251339579c57b3c0934e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n if (ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) {\n \n return -1;\n+\n+ }\n+\n+ ring_size = ri->numPages * PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE;\n+\n len_log2 = pvscsi_log2(ring_size - 1);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "pvscsi_ring_init_msg(PVSCSIRingInfo *m, PVSCSICmdDescSetupMsgRing *ri)\n\n{\n\n int i;\n\n uint32_t len_log2;\n\n uint32_t ring_size;\n\n\n\n if (ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) {\n\n return -1;\n\n }\n\n ring_size = ri->numPages * PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE;\n\n len_log2 = pvscsi_log2(ring_size - 1);\n\n\n\n m->msg_len_mask = MASK(len_log2);\n\n\n\n m->filled_msg_ptr = 0;\n\n\n\n for (i = 0; i < ri->numPages; i++) {\n\n m->msg_ring_pages_pa[i] = ri->ringPPNs[i] << VMW_PAGE_SHIFT;\n\n }\n\n\n\n RS_SET_FIELD(m, msgProdIdx, 0);\n\n RS_SET_FIELD(m, msgConsIdx, 0);\n\n RS_SET_FIELD(m, msgNumEntriesLog2, len_log2);\n\n\n\n trace_pvscsi_ring_init_msg(len_log2);\n\n\n\n /* Flush ring state page changes */\n\n smp_wmb();\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "478f1c3d5e5463a284ea7efecfc62d47ba3be11a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n bytestream2_skip(&s->gb, length);\n \n+\n \n /* decode one line if possible */\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int png_decode_idat(PNGDecContext *s, int length)\n\n{\n\n int ret;\n\n s->zstream.avail_in = FFMIN(length, bytestream2_get_bytes_left(&s->gb));\n\n s->zstream.next_in = (unsigned char *)s->gb.buffer;\n\n bytestream2_skip(&s->gb, length);\n\n\n\n /* decode one line if possible */\n\n while (s->zstream.avail_in > 0) {\n\n ret = inflate(&s->zstream, Z_PARTIAL_FLUSH);\n\n if (ret != Z_OK && ret != Z_STREAM_END) {\n\n av_log(s->avctx, AV_LOG_ERROR, \"inflate returned error %d\\n\", ret);\n\n return AVERROR_EXTERNAL;\n\n }\n\n if (s->zstream.avail_out == 0) {\n\n if (!(s->state & PNG_ALLIMAGE)) {\n\n png_handle_row(s);\n\n }\n\n s->zstream.avail_out = s->crow_size;\n\n s->zstream.next_out = s->crow_buf;\n\n }\n\n if (ret == Z_STREAM_END && s->zstream.avail_in > 0) {\n\n av_log(NULL, AV_LOG_WARNING,\n\n \"%d undecompressed bytes left in buffer\\n\", s->zstream.avail_in);\n\n return 0;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "d3b12f5dec4b27ebab58fb5797cb67bacced773b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n for(ppe = &first_polling_entry; *ppe != NULL; ppe = &(*ppe)->next) {\n \n pe = *ppe;\n+\n+ if (pe->func == func && pe->opaque == opaque) {\n+\n+ *ppe = pe->next;\n+\n g_free(pe);\n \n break;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_del_polling_cb(PollingFunc *func, void *opaque)\n\n{\n\n PollingEntry **ppe, *pe;\n\n for(ppe = &first_polling_entry; *ppe != NULL; ppe = &(*ppe)->next) {\n\n pe = *ppe;\n\n if (pe->func == func && pe->opaque == opaque) {\n\n *ppe = pe->next;\n\n g_free(pe);\n\n break;\n\n }\n\n }\n\n}\n"}} {"sample_id": "187337f8b0ec0813dd3876d1efe37d415fb81c2e_17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n int iomemtype;\n \n+\n \n s = (arm_sysctl_state *)qemu_mallocz(sizeof(arm_sysctl_state));\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void arm_sysctl_init(uint32_t base, uint32_t sys_id)\n\n{\n\n arm_sysctl_state *s;\n\n int iomemtype;\n\n\n\n s = (arm_sysctl_state *)qemu_mallocz(sizeof(arm_sysctl_state));\n\n if (!s)\n\n return;\n\n s->base = base;\n\n s->sys_id = sys_id;\n\n iomemtype = cpu_register_io_memory(0, arm_sysctl_readfn,\n\n arm_sysctl_writefn, s);\n\n cpu_register_physical_memory(base, 0x00000fff, iomemtype);\n\n /* ??? Save/restore. */\n\n}\n"}} {"sample_id": "6f2d8978728c48ca46f5c01835438508aace5c64_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void do_brinc (void)\n \n+{\n \n uint32_t a, b, d, mask;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void do_brinc (void)\n\n{\n\n uint32_t a, b, d, mask;\n\n\n\n mask = (uint32_t)(-1UL) >> MASKBITS;\n\n b = T1_64 & mask;\n\n a = T0_64 & mask;\n\n d = word_reverse(1 + word_reverse(a | ~mask));\n\n T0_64 = (T0_64 & ~mask) | (d & mask);\n\n}\n"}} {"sample_id": "90fc00a623de44e137fe1601b91356e8cd8bdd54", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n int i;\n \n+\n \n if (AV_RB24(ptr) == 0xEFBBBF)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int microdvd_probe(AVProbeData *p)\n\n{\n\n unsigned char c;\n\n const uint8_t *ptr = p->buf;\n\n int i;\n\n\n\n if (AV_RB24(ptr) == 0xEFBBBF)\n\n ptr += 3; /* skip UTF-8 BOM */\n\n\n\n for (i=0; i<3; i++) {\n\n if (sscanf(ptr, \"{%*d}{}%c\", &c) != 1 &&\n\n sscanf(ptr, \"{%*d}{%*d}%c\", &c) != 1 &&\n\n sscanf(ptr, \"{DEFAULT}{}%c\", &c) != 1)\n\n return 0;\n\n ptr += strcspn(ptr, \"\\n\") + 1;\n\n }\n\n return AVPROBE_SCORE_MAX;\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_32", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,6 +8,6 @@\n \n \n \n+ return bdrv_co_do_readv(bs, sector_num, nb_sectors, qiov, 0);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int coroutine_fn bdrv_co_readv(BlockDriverState *bs, int64_t sector_num,\n\n int nb_sectors, QEMUIOVector *qiov)\n\n{\n\n trace_bdrv_co_readv(bs, sector_num, nb_sectors);\n\n\n\n return bdrv_co_do_readv(bs, sector_num, nb_sectors, qiov, 0);\n\n}\n"}} {"sample_id": "5e5a94b60518002e8ecc7afa78a9e7565b23e38f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+bdrv_acct_start(BlockDriverState *bs, BlockAcctCookie *cookie, int64_t bytes,\n+\n+ enum BlockAcctType type)\n+\n+{\n \n assert(type < BDRV_MAX_IOTYPE);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "bdrv_acct_start(BlockDriverState *bs, BlockAcctCookie *cookie, int64_t bytes,\n\n enum BlockAcctType type)\n\n{\n\n assert(type < BDRV_MAX_IOTYPE);\n\n\n\n cookie->bytes = bytes;\n\n cookie->start_time_ns = get_clock();\n\n cookie->type = type;\n\n}\n"}} {"sample_id": "9487fb4dea3498eb4711eb023f43199f68701b1e_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n enum PixelFormat target)\n {\n const int16_t *buf0 = buf[0], *buf1 = buf[1],\n+ *ubuf0 = ubuf[0], *ubuf1 = ubuf[1],\n+ *vbuf0 = vbuf[0], *vbuf1 = vbuf[1];\n+ int yalpha1 = 4095 - yalpha;\n+ int uvalpha1 = 4095 - uvalpha;\n+ int i;\n for (i = 0; i < (dstW >> 1); i++) {\n int Y1 = (buf0[i * 2] * yalpha1 + buf1[i * 2] * yalpha) >> 19;\n int Y2 = (buf0[i * 2 + 1] * yalpha1 + buf1[i * 2 + 1] * yalpha) >> 19;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "yuv2422_2_c_template(SwsContext *c, const int16_t *buf[2],\n const int16_t *ubuf[2], const int16_t *vbuf[2],\n const int16_t *abuf[2], uint8_t *dest, int dstW,\n int yalpha, int uvalpha, int y,\n enum PixelFormat target)\n{\n const int16_t *buf0 = buf[0], *buf1 = buf[1],\n *ubuf0 = ubuf[0], *ubuf1 = ubuf[1],\n *vbuf0 = vbuf[0], *vbuf1 = vbuf[1];\n int yalpha1 = 4095 - yalpha;\n int uvalpha1 = 4095 - uvalpha;\n int i;\n for (i = 0; i < (dstW >> 1); i++) {\n int Y1 = (buf0[i * 2] * yalpha1 + buf1[i * 2] * yalpha) >> 19;\n int Y2 = (buf0[i * 2 + 1] * yalpha1 + buf1[i * 2 + 1] * yalpha) >> 19;\n int U = (ubuf0[i] * uvalpha1 + ubuf1[i] * uvalpha) >> 19;\n int V = (vbuf0[i] * uvalpha1 + vbuf1[i] * uvalpha) >> 19;\n output_pixels(i * 4, Y1, U, Y2, V);\n }\n}"}} {"sample_id": "75554a3ca10a7ad295d2a3d2e14ee6ba90f94c8b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n else\n \n /* TODO inverted pulse on timer->out_val == 1? */\n+\n+ qemu_irq_pulse(timer->out);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void omap_gp_timer_trigger(struct omap_gp_timer_s *timer)\n\n{\n\n if (timer->pt)\n\n /* TODO in overflow-and-match mode if the first event to\n\n * occurs is the match, don't toggle. */\n\n omap_gp_timer_out(timer, !timer->out_val);\n\n else\n\n /* TODO inverted pulse on timer->out_val == 1? */\n\n qemu_irq_pulse(timer->out);\n\n}\n"}} {"sample_id": "e211e255aa399d68239ffa42c9cc7a52eb3d55a9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void ff_bink_idct_put_c(uint8_t *dest, int linesize, DCTELEM *block)\n \n+{\n \n int i;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void ff_bink_idct_put_c(uint8_t *dest, int linesize, DCTELEM *block)\n\n{\n\n int i;\n\n DCTELEM temp[64];\n\n for (i = 0; i < 8; i++)\n\n bink_idct_col(&temp[i], &block[i]);\n\n for (i = 0; i < 8; i++) {\n\n IDCT_ROW( (&dest[i*linesize]), (&temp[8*i]) );\n\n }\n\n}\n"}} {"sample_id": "9b2fadda3e0196ffd485adde4fe9cdd6fae35300_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void gen_msgsnd(DisasContext *ctx)\n+\n+{\n+\n #if defined(CONFIG_USER_ONLY)\n \n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n+\n #else\n \n if (unlikely(ctx->pr)) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_msgsnd(DisasContext *ctx)\n\n{\n\n#if defined(CONFIG_USER_ONLY)\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n#else\n\n if (unlikely(ctx->pr)) {\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n return;\n\n }\n\n\n\n gen_helper_msgsnd(cpu_gpr[rB(ctx->opcode)]);\n\n#endif\n\n}\n"}} {"sample_id": "b853cfe7eaf13b7d4ff3ceba7098544ccc049df8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n event.user.data1 = opaque;\n \n+ if (!is->refresh && (!is->paused || is->force_refresh)) {\n+\n+ is->refresh = 1;\n+\n+ SDL_PushEvent(&event);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int refresh_thread(void *opaque)\n\n{\n\n VideoState *is= opaque;\n\n while (!is->abort_request) {\n\n SDL_Event event;\n\n event.type = FF_REFRESH_EVENT;\n\n event.user.data1 = opaque;\n\n if (!is->refresh && (!is->paused || is->force_refresh)) {\n\n is->refresh = 1;\n\n SDL_PushEvent(&event);\n\n }\n\n //FIXME ideally we should wait the correct time but SDLs event passing is so slow it would be silly\n\n av_usleep(is->audio_st && is->show_mode != SHOW_MODE_VIDEO ? rdftspeed*1000 : 5000);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_53", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,6 +4,6 @@\n \n bool *v = pv;\n \n+ qemu_put_byte(f, *v);\n+\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void put_bool(QEMUFile *f, void *pv, size_t size)\n\n{\n\n bool *v = pv;\n\n qemu_put_byte(f, *v);\n\n}\n"}} {"sample_id": "b8af5b2d5f67b0e1b274f8532f42a47bfe46ea3b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n gen_spr_power8_tce_address_control(env);\n gen_spr_power8_ids(env);\n gen_spr_power8_ebb(env);\n+ gen_spr_power8_fscr(env);\n+ gen_spr_power8_pmu_sup(env);\n+ gen_spr_power8_pmu_user(env);\n+ gen_spr_power8_tm(env);\n+ gen_spr_power8_pspb(env);\n gen_spr_vtb(env);\n gen_spr_power8_ic(env);\n gen_spr_power8_book4(env);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void init_proc_POWER9(CPUPPCState *env)\n{\n /* Common Registers */\n init_proc_book3s_common(env);\n gen_spr_book3s_207_dbg(env);\n /* POWER8 Specific Registers */\n gen_spr_book3s_ids(env);\n gen_spr_amr(env);\n gen_spr_iamr(env);\n gen_spr_book3s_purr(env);\n gen_spr_power5p_common(env);\n gen_spr_power5p_lpar(env);\n gen_spr_power5p_ear(env);\n gen_spr_power6_common(env);\n gen_spr_power6_dbg(env);\n gen_spr_power8_tce_address_control(env);\n gen_spr_power8_ids(env);\n gen_spr_power8_ebb(env);\n gen_spr_power8_fscr(env);\n gen_spr_power8_pmu_sup(env);\n gen_spr_power8_pmu_user(env);\n gen_spr_power8_tm(env);\n gen_spr_power8_pspb(env);\n gen_spr_vtb(env);\n gen_spr_power8_ic(env);\n gen_spr_power8_book4(env);\n gen_spr_power8_rpr(env);\n /* POWER9 Specific registers */\n spr_register_kvm(env, SPR_TIDR, \"TIDR\", NULL, NULL,\n KVM_REG_PPC_TIDR, 0);\n /* env variables */\n#if !defined(CONFIG_USER_ONLY)\n env->slb_nr = 32;\n#endif\n env->ci_large_pages = true;\n env->dcache_line_size = 128;\n env->icache_line_size = 128;\n /* Allocate hardware IRQ controller */\n init_excp_POWER8(env);\n ppcPOWER7_irq_init(ppc_env_get_cpu(env));\n}"}} {"sample_id": "b3a62939561e07bc34493444fa926b6137cba4e8_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n s->frame_start = start;\n \n+ s->frame_end = start + size;\n+\n s->frame_reg = reg;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void tcg_set_frame(TCGContext *s, int reg, intptr_t start, intptr_t size)\n\n{\n\n s->frame_start = start;\n\n s->frame_end = start + size;\n\n s->frame_reg = reg;\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -40,11 +40,11 @@\n \n if (s->tray_open != !start) {\n \n+ bdrv_eject(s->bs, !start);\n+\n+ s->tray_open = !start;\n+\n+ }\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void cmd_start_stop_unit(IDEState *s, uint8_t* buf)\n\n{\n\n int sense;\n\n bool start = buf[4] & 1;\n\n bool loej = buf[4] & 2; /* load on start, eject on !start */\n\n int pwrcnd = buf[4] & 0xf0;\n\n\n\n if (pwrcnd) {\n\n /* eject/load only happens for power condition == 0 */\n\n return;\n\n }\n\n\n\n if (loej) {\n\n if (!start && !s->tray_open && s->tray_locked) {\n\n sense = bdrv_is_inserted(s->bs)\n\n ? NOT_READY : ILLEGAL_REQUEST;\n\n ide_atapi_cmd_error(s, sense, ASC_MEDIA_REMOVAL_PREVENTED);\n\n return;\n\n }\n\n\n\n if (s->tray_open != !start) {\n\n bdrv_eject(s->bs, !start);\n\n s->tray_open = !start;\n\n }\n\n }\n\n\n\n ide_atapi_cmd_ok(s);\n\n}\n"}} {"sample_id": "e1c37d0e94048502f9874e6356ce7136d4b05bdb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int qemu_savevm_state(Monitor *mon, QEMUFile *f)\n+\n+{\n+\n+ int ret;\n+\n \n \n if (qemu_savevm_state_blocked(mon)) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int qemu_savevm_state(Monitor *mon, QEMUFile *f)\n\n{\n\n int ret;\n\n\n\n if (qemu_savevm_state_blocked(mon)) {\n\n ret = -EINVAL;\n\n goto out;\n\n }\n\n\n\n ret = qemu_savevm_state_begin(f, 0, 0);\n\n if (ret < 0)\n\n goto out;\n\n\n\n do {\n\n ret = qemu_savevm_state_iterate(f);\n\n if (ret < 0)\n\n goto out;\n\n } while (ret == 0);\n\n\n\n ret = qemu_savevm_state_complete(f);\n\n\n\nout:\n\n if (ret == 0) {\n\n ret = qemu_file_get_error(f);\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "75f27498220e6ff6f78bf08fbe2cc662ec76ba89", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,8 +32,8 @@\n \n error_setg(errp, \"acpi: device plug request for not supported device\"\n \n+ \" type: %s\", object_get_typename(OBJECT(dev)));\n+\n+ }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ich9_pm_device_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,\n\n Error **errp)\n\n{\n\n ICH9LPCState *lpc = ICH9_LPC_DEVICE(hotplug_dev);\n\n\n\n if (lpc->pm.acpi_memory_hotplug.is_enabled &&\n\n object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {\n\n acpi_memory_plug_cb(hotplug_dev, &lpc->pm.acpi_memory_hotplug,\n\n dev, errp);\n\n } else if (object_dynamic_cast(OBJECT(dev), TYPE_CPU)) {\n\n if (lpc->pm.cpu_hotplug_legacy) {\n\n legacy_acpi_cpu_plug_cb(hotplug_dev, &lpc->pm.gpe_cpu, dev, errp);\n\n } else {\n\n acpi_cpu_plug_cb(hotplug_dev, &lpc->pm.cpuhp_state, dev, errp);\n\n }\n\n } else {\n\n error_setg(errp, \"acpi: device plug request for not supported device\"\n\n \" type: %s\", object_get_typename(OBJECT(dev)));\n\n }\n\n}\n"}} {"sample_id": "cdd5cc12ba8cf0c068da319370bdd3ba45eaf7ac", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n if (virtio_queue_empty(n->rx_vq) ||\n \n+ (n->mergeable_rx_bufs &&\n+\n+ !virtqueue_avail_bytes(n->rx_vq, bufsize, 0))) {\n+\n+ virtio_queue_set_notification(n->rx_vq, 1);\n \n return 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int do_virtio_net_can_receive(VirtIONet *n, int bufsize)\n\n{\n\n if (!virtio_queue_ready(n->rx_vq) ||\n\n !(n->vdev.status & VIRTIO_CONFIG_S_DRIVER_OK))\n\n return 0;\n\n\n\n if (virtio_queue_empty(n->rx_vq) ||\n\n (n->mergeable_rx_bufs &&\n\n !virtqueue_avail_bytes(n->rx_vq, bufsize, 0))) {\n\n virtio_queue_set_notification(n->rx_vq, 1);\n\n return 0;\n\n }\n\n\n\n virtio_queue_set_notification(n->rx_vq, 0);\n\n return 1;\n\n}\n"}} {"sample_id": "0fb6395c0cb5046432a80d608ddde7a3b2f8a9ae", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n \"'string': 'str', \"\n \n+ \"'boolean': true }\");\n+\n+ /* TODO when generator bug is fixed, add 'integer': 41 */\n+\n+\n \n visit_type_UserDefFlatUnion(v, &tmp, NULL, &errp);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_validate_union_flat(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n UserDefFlatUnion *tmp = NULL;\n\n Visitor *v;\n\n Error *errp = NULL;\n\n\n\n v = validate_test_init(data,\n\n \"{ 'enum1': 'value1', \"\n\n \"'string': 'str', \"\n\n \"'boolean': true }\");\n\n /* TODO when generator bug is fixed, add 'integer': 41 */\n\n\n\n visit_type_UserDefFlatUnion(v, &tmp, NULL, &errp);\n\n g_assert(!error_is_set(&errp));\n\n qapi_free_UserDefFlatUnion(tmp);\n\n}\n"}} {"sample_id": "ffbb1705a33df8e2fb12b24d96663d63b22eaf8b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n if ((event_mask & EVENT_MASK_EPOW) == 0) {\n \n+ return NULL;\n+\n+ }\n+\n+\n \n QTAILQ_FOREACH(entry, &spapr->pending_events, next) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static sPAPREventLogEntry *rtas_event_log_dequeue(uint32_t event_mask,\n\n bool exception)\n\n{\n\n sPAPRMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());\n\n sPAPREventLogEntry *entry = NULL;\n\n\n\n /* we only queue EPOW events atm. */\n\n if ((event_mask & EVENT_MASK_EPOW) == 0) {\n\n return NULL;\n\n }\n\n\n\n QTAILQ_FOREACH(entry, &spapr->pending_events, next) {\n\n if (entry->exception != exception) {\n\n continue;\n\n }\n\n\n\n /* EPOW and hotplug events are surfaced in the same manner */\n\n if (entry->log_type == RTAS_LOG_TYPE_EPOW ||\n\n entry->log_type == RTAS_LOG_TYPE_HOTPLUG) {\n\n break;\n\n }\n\n }\n\n\n\n if (entry) {\n\n QTAILQ_REMOVE(&spapr->pending_events, entry, next);\n\n }\n\n\n\n return entry;\n\n}\n"}} {"sample_id": "6e0d8677cb443e7408c0b7a25a93c6596d7fa380_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void OPPROTO op_decq_ECX(void)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void OPPROTO op_decq_ECX(void)\n\n{\n\n ECX--;\n\n}\n"}} {"sample_id": "d157ed5f7235f3d2d5596a514ad7507b18e24b88_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -41,11 +41,11 @@\n }\n \n }\n+\n+\n+\n+ if (rule && rule->options.inject.error) {\n+\n return inject_error(bs, rule);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "blkdebug_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes,\n\n QEMUIOVector *qiov, int flags)\n\n{\n\n BDRVBlkdebugState *s = bs->opaque;\n\n BlkdebugRule *rule = NULL;\n\n\n\n /* Sanity check block layer guarantees */\n\n assert(QEMU_IS_ALIGNED(offset, bs->bl.request_alignment));\n\n assert(QEMU_IS_ALIGNED(bytes, bs->bl.request_alignment));\n\n if (bs->bl.max_transfer) {\n\n assert(bytes <= bs->bl.max_transfer);\n\n }\n\n\n\n QSIMPLEQ_FOREACH(rule, &s->active_rules, active_next) {\n\n uint64_t inject_offset = rule->options.inject.offset;\n\n\n\n if (inject_offset == -1 ||\n\n (inject_offset >= offset && inject_offset < offset + bytes))\n\n {\n\n break;\n\n }\n\n }\n\n\n\n if (rule && rule->options.inject.error) {\n\n return inject_error(bs, rule);\n\n }\n\n\n\n return bdrv_co_pwritev(bs->file, offset, bytes, qiov, flags);\n\n}\n"}} {"sample_id": "b20e61e0d52eef57cf5db55087b16e0b5207e730", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n char *bdref_key_dot;\n \n+ const char *reference;\n+\n+\n+\n+ assert(pbs);\n \n assert(*pbs == NULL);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int bdrv_open_image(BlockDriverState **pbs, const char *filename,\n\n QDict *options, const char *bdref_key, int flags,\n\n bool allow_none, Error **errp)\n\n{\n\n QDict *image_options;\n\n int ret;\n\n char *bdref_key_dot;\n\n const char *reference;\n\n\n\n assert(pbs);\n\n assert(*pbs == NULL);\n\n\n\n bdref_key_dot = g_strdup_printf(\"%s.\", bdref_key);\n\n qdict_extract_subqdict(options, &image_options, bdref_key_dot);\n\n g_free(bdref_key_dot);\n\n\n\n reference = qdict_get_try_str(options, bdref_key);\n\n if (!filename && !reference && !qdict_size(image_options)) {\n\n if (allow_none) {\n\n ret = 0;\n\n } else {\n\n error_setg(errp, \"A block device must be specified for \\\"%s\\\"\",\n\n bdref_key);\n\n ret = -EINVAL;\n\n }\n\n\n goto done;\n\n }\n\n\n\n ret = bdrv_open(pbs, filename, reference, image_options, flags, NULL, errp);\n\n\n\ndone:\n\n qdict_del(options, bdref_key);\n\n return ret;\n\n}"}} {"sample_id": "15c2f669e3fb2bc97f7b42d1871f595c0ac24af8_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n {\n \n+ QObject *arg;\n \n QDict *qdict;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_visitor_out_null(TestOutputVisitorData *data,\n\n const void *unused)\n\n{\n\n QObject *arg;\n\n QDict *qdict;\n\n QObject *nil;\n\n\n\n visit_start_struct(data->ov, NULL, NULL, 0, &error_abort);\n\n visit_type_null(data->ov, \"a\", &error_abort);\n\n visit_end_struct(data->ov, &error_abort);\n\n arg = qmp_output_get_qobject(data->qov);\n\n g_assert(qobject_type(arg) == QTYPE_QDICT);\n\n qdict = qobject_to_qdict(arg);\n\n g_assert_cmpint(qdict_size(qdict), ==, 1);\n\n nil = qdict_get(qdict, \"a\");\n\n g_assert(nil);\n\n g_assert(qobject_type(nil) == QTYPE_QNULL);\n\n qobject_decref(arg);\n\n}\n"}} {"sample_id": "cb08687180683a755d0fe9d425280d0e4d1e6db2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int vqf_read_seek(AVFormatContext *s,\n \n int stream_index, int64_t timestamp, int flags)\n+\n {\n \n VqfContext *c = s->priv_data;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int vqf_read_seek(AVFormatContext *s,\n\n int stream_index, int64_t timestamp, int flags)\n\n{\n\n VqfContext *c = s->priv_data;\n\n AVStream *st;\n\n int ret;\n\n int64_t pos;\n\n\n\n st = s->streams[stream_index];\n\n pos = av_rescale_rnd(timestamp * st->codec->bit_rate,\n\n st->time_base.num,\n\n st->time_base.den * (int64_t)c->frame_bit_len,\n\n (flags & AVSEEK_FLAG_BACKWARD) ?\n\n AV_ROUND_DOWN : AV_ROUND_UP);\n\n pos *= c->frame_bit_len;\n\n\n\n st->cur_dts = av_rescale(pos, st->time_base.den,\n\n st->codec->bit_rate * (int64_t)st->time_base.num);\n\n\n\n if ((ret = avio_seek(s->pb, ((pos-7) >> 3) + s->internal->data_offset, SEEK_SET)) < 0)\n\n return ret;\n\n\n\n c->remaining_bits = -7 - ((pos-7)&7);\n\n return 0;\n\n}\n"}} {"sample_id": "e806b4db1477a1c6bfda7bba28c7f26c47f18e1e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,17 +3,17 @@\n {\n \n sPAPRPHBState *sphb = opaque;\n+\n+ GHashTableIter iter;\n+\n+ gpointer key, value;\n \n int i;\n+\n+\n+\n+ g_free(sphb->msi_devs);\n+\n sphb->msi_devs = NULL;\n \n sphb->msi_devs_num = g_hash_table_size(sphb->msi);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void spapr_pci_pre_save(void *opaque)\n\n{\n\n sPAPRPHBState *sphb = opaque;\n\n GHashTableIter iter;\n\n gpointer key, value;\n\n int i;\n\n\n\n g_free(sphb->msi_devs);\n\n sphb->msi_devs = NULL;\n\n sphb->msi_devs_num = g_hash_table_size(sphb->msi);\n\n if (!sphb->msi_devs_num) {\n\n return;\n\n }\n\n sphb->msi_devs = g_malloc(sphb->msi_devs_num * sizeof(spapr_pci_msi_mig));\n\n\n\n g_hash_table_iter_init(&iter, sphb->msi);\n\n for (i = 0; g_hash_table_iter_next(&iter, &key, &value); ++i) {\n\n sphb->msi_devs[i].key = *(uint32_t *) key;\n\n sphb->msi_devs[i].value = *(spapr_pci_msi *) value;\n\n }\n\n\n\n if (sphb->pre_2_8_migration) {\n\n sphb->mig_liobn = sphb->dma_liobn[0];\n\n sphb->mig_mem_win_addr = sphb->mem_win_addr;\n\n sphb->mig_mem_win_size = sphb->mem_win_size;\n\n sphb->mig_io_win_addr = sphb->io_win_addr;\n\n sphb->mig_io_win_size = sphb->io_win_size;\n\n\n\n if ((sphb->mem64_win_size != 0)\n\n && (sphb->mem64_win_addr\n\n == (sphb->mem_win_addr + sphb->mem_win_size))) {\n\n sphb->mig_mem_win_size += sphb->mem64_win_size;\n\n }\n\n }\n\n}\n"}} {"sample_id": "6e42e6c4b410dbef8b593c2d796a5dad95f89ee4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void palette8tobgr15(const uint8_t *src, uint8_t *dst, long num_pixels, const uint8_t *palette)\n+\n+{\n+\n \tlong i;\n \n \tfor(i=0; ioutput.offset)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void vnc_flush(VncState *vs)\n\n{\n\n if (vs->output.offset)\n\n vnc_client_write(vs);\n\n}\n"}} {"sample_id": "582b55a96ac4f66cea64d82e47651bd5ef38a8ec", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n hwaddr addr1;\n \n MemoryRegion *mr;\n+\n+\n+\n+ while (len > 0) {\n+\n l = len;\n \n mr = address_space_translate(&address_space_memory,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void cpu_physical_memory_write_rom(hwaddr addr,\n\n const uint8_t *buf, int len)\n\n{\n\n hwaddr l;\n\n uint8_t *ptr;\n\n hwaddr addr1;\n\n MemoryRegion *mr;\n\n\n\n while (len > 0) {\n\n l = len;\n\n mr = address_space_translate(&address_space_memory,\n\n addr, &addr1, &l, true);\n\n\n\n if (!(memory_region_is_ram(mr) ||\n\n memory_region_is_romd(mr))) {\n\n /* do nothing */\n\n } else {\n\n addr1 += memory_region_get_ram_addr(mr);\n\n /* ROM/RAM case */\n\n ptr = qemu_get_ram_ptr(addr1);\n\n memcpy(ptr, buf, l);\n\n invalidate_and_set_dirty(addr1, l);\n\n }\n\n len -= l;\n\n buf += l;\n\n addr += l;\n\n }\n\n}\n"}} {"sample_id": "d25a7dabf242163ce95b60f6f75cf017b1715d55", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void colo_old_packet_check(void *opaque)\n \n+{\n \n CompareState *s = opaque;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void colo_old_packet_check(void *opaque)\n\n{\n\n CompareState *s = opaque;\n\n\n\n g_queue_foreach(&s->conn_list, colo_old_packet_check_one_conn, NULL);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_327", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n {\n \n+ ram_addr_t raddr = addr;\n+\n+ void *ptr = qemu_get_ram_ptr(raddr);\n+\n+ switch (size) {\n \n case 1: return ldub_p(ptr);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t subpage_ram_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n ram_addr_t raddr = addr;\n\n void *ptr = qemu_get_ram_ptr(raddr);\n\n switch (size) {\n\n case 1: return ldub_p(ptr);\n\n case 2: return lduw_p(ptr);\n\n case 4: return ldl_p(ptr);\n\n default: abort();\n\n }\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_69", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n }\n \n+ opts = qemu_mallocz(sizeof(*opts));\n+\n+ if (id) {\n+\n+ opts->id = qemu_strdup(id);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "QemuOpts *qemu_opts_create(QemuOptsList *list, const char *id, int fail_if_exists)\n\n{\n\n QemuOpts *opts = NULL;\n\n\n\n if (id) {\n\n opts = qemu_opts_find(list, id);\n\n if (opts != NULL) {\n\n if (fail_if_exists) {\n\n fprintf(stderr, \"tried to create id \\\"%s\\\" twice for \\\"%s\\\"\\n\",\n\n id, list->name);\n\n return NULL;\n\n } else {\n\n return opts;\n\n }\n\n }\n\n }\n\n opts = qemu_mallocz(sizeof(*opts));\n\n if (id) {\n\n opts->id = qemu_strdup(id);\n\n }\n\n opts->list = list;\n\n TAILQ_INIT(&opts->head);\n\n TAILQ_INSERT_TAIL(&list->head, opts, next);\n\n return opts;\n\n}\n"}} {"sample_id": "d4551293d68a1876df87400be6c71c657756d0bb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+ if (data && qobject_type(data) == QTYPE_QDICT) {\n+\n+ return qdict_haskey(qobject_to_qdict(data), \"__mon_async\");\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int is_async_return(const QObject *data)\n\n{\n\n if (data && qobject_type(data) == QTYPE_QDICT) {\n\n return qdict_haskey(qobject_to_qdict(data), \"__mon_async\");\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "40fa6a2fa2c255293a780a194eecae5df52644a1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int decode_dc_progressive(MJpegDecodeContext *s, int16_t *block,\n+\n int component, int dc_index,\n \n uint16_t *quant_matrix, int Al)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int decode_dc_progressive(MJpegDecodeContext *s, int16_t *block,\n\n int component, int dc_index,\n\n uint16_t *quant_matrix, int Al)\n\n{\n\n int val;\n\n s->bdsp.clear_block(block);\n\n val = mjpeg_decode_dc(s, dc_index);\n\n if (val == 0xfffff) {\n\n av_log(s->avctx, AV_LOG_ERROR, \"error dc\\n\");\n\n return AVERROR_INVALIDDATA;\n\n }\n\n val = (val * (quant_matrix[0] << Al)) + s->last_dc[component];\n\n s->last_dc[component] = val;\n\n block[0] = val;\n\n return 0;\n\n}\n"}} {"sample_id": "0ac241bcf9f9d99a252a352a162f4b13b24732ab", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n hwaddr uc32_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)\n+\n+{\n+\n UniCore32CPU *cpu = UNICORE32_CPU(cs);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "hwaddr uc32_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)\n\n{\n\n UniCore32CPU *cpu = UNICORE32_CPU(cs);\n\n\n\n cpu_abort(CPU(cpu), \"%s not supported yet\\n\", __func__);\n\n return addr;\n\n}\n"}} {"sample_id": "c0644771ebedbd8f47f3c24816445e30111d226b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,17 +2,17 @@\n \n {\n \n+ Error *err = NULL;\n \n+ Visitor *v;\n \n QDict *qdict;\n \n+ AltNumStr *ans;\n+\n+ AltNumInt *ani;\n+\n+\n \n /*\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void test_keyval_visit_alternate(void)\n\n{\n\n Error *err = NULL;\n\n Visitor *v;\n\n QDict *qdict;\n\n AltNumStr *ans;\n\n AltNumInt *ani;\n\n\n\n /*\n\n * Can't do scalar alternate variants other than string. You get\n\n * the string variant if there is one, else an error.\n\n */\n\n qdict = keyval_parse(\"a=1,b=2\", NULL, &error_abort);\n\n v = qobject_input_visitor_new_keyval(QOBJECT(qdict));\n\n QDECREF(qdict);\n\n visit_start_struct(v, NULL, NULL, 0, &error_abort);\n\n visit_type_AltNumStr(v, \"a\", &ans, &error_abort);\n\n g_assert_cmpint(ans->type, ==, QTYPE_QSTRING);\n\n g_assert_cmpstr(ans->u.s, ==, \"1\");\n\n qapi_free_AltNumStr(ans);\n\n visit_type_AltNumInt(v, \"a\", &ani, &err);\n\n error_free_or_abort(&err);\n\n visit_end_struct(v, NULL);\n\n visit_free(v);\n\n}\n"}} {"sample_id": "bc7c08a2c375acb7ae4d433054415588b176d34c_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void test_qemu_strtoul_full_max(void)\n \n+{\n+\n+ char *str = g_strdup_printf(\"%lu\", ULONG_MAX);\n+\n+ unsigned long res = 999;\n \n int err;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_qemu_strtoul_full_max(void)\n\n{\n\n char *str = g_strdup_printf(\"%lu\", ULONG_MAX);\n\n unsigned long res = 999;\n\n int err;\n\n\n\n err = qemu_strtoul(str, NULL, 0, &res);\n\n\n\n g_assert_cmpint(err, ==, 0);\n\n g_assert_cmpint(res, ==, ULONG_MAX);\n\n g_free(str);\n\n}\n"}} {"sample_id": "17bb18ce16b45e61248c5238074fa9cf8bc547bf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n \n \n /* XXX implement */\n+\n+#if 0\n+\n+ env->storage_keys[r2 / TARGET_PAGE_SIZE] &= ~SK_REFERENCED;\n+\n #endif\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint32_t HELPER(rrbe)(uint32_t r1, uint64_t r2)\n\n{\n\n if (r2 > ram_size) {\n\n return 0;\n\n }\n\n\n\n /* XXX implement */\n\n#if 0\n\n env->storage_keys[r2 / TARGET_PAGE_SIZE] &= ~SK_REFERENCED;\n\n#endif\n\n\n\n /*\n\n * cc\n\n *\n\n * 0 Reference bit zero; change bit zero\n\n * 1 Reference bit zero; change bit one\n\n * 2 Reference bit one; change bit zero\n\n * 3 Reference bit one; change bit one\n\n */\n\n return 0;\n\n}\n"}} {"sample_id": "60f10e0ad37418cc697765d85b0bc22db70f726a_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void pred8x8_dc_rv40_c(uint8_t *src, int stride){\n \n+ int i;\n \n int dc0=0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void pred8x8_dc_rv40_c(uint8_t *src, int stride){\n\n int i;\n\n int dc0=0;\n\n\n\n for(i=0;i<4; i++){\n\n dc0+= src[-1+i*stride] + src[i-stride];\n\n dc0+= src[4+i-stride];\n\n dc0+= src[-1+(i+4)*stride];\n\n }\n\n dc0= 0x01010101*((dc0 + 8)>>4);\n\n\n\n for(i=0; i<4; i++){\n\n ((uint32_t*)(src+i*stride))[0]= dc0;\n\n ((uint32_t*)(src+i*stride))[1]= dc0;\n\n }\n\n for(i=4; i<8; i++){\n\n ((uint32_t*)(src+i*stride))[0]= dc0;\n\n ((uint32_t*)(src+i*stride))[1]= dc0;\n\n }\n\n}\n"}} {"sample_id": "22a7e19b50cc1627dd16e22c5e89b1f92f1d0c0e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n \n \n+ width = st->codec->width;\n \n height = st->codec->height;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int rawvideo_read_packet(AVFormatContext *s, AVPacket *pkt)\n\n{\n\n int packet_size, ret, width, height;\n\n AVStream *st = s->streams[0];\n\n\n\n width = st->codec->width;\n\n height = st->codec->height;\n\n\n\n packet_size = avpicture_get_size(st->codec->pix_fmt, width, height);\n\n if (packet_size < 0)\n\n return -1;\n\n\n\n ret= av_get_packet(s->pb, pkt, packet_size);\n\n pkt->pts=\n\n pkt->dts= pkt->pos / packet_size;\n\n\n\n pkt->stream_index = 0;\n\n if (ret != packet_size)\n\n return AVERROR(EIO);\n\n return 0;\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_35", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n \n \n d.args = NULL;\n+\n d.noreboot = true;\n \n+ test_init(&d);\n+\n \n \n stop_tco(&d);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_tco2_status_bits(void)\n\n{\n\n TestData d;\n\n uint16_t ticks = 8;\n\n uint16_t val;\n\n int ret;\n\n\n\n d.args = NULL;\n\n d.noreboot = true;\n\n test_init(&d);\n\n\n\n stop_tco(&d);\n\n clear_tco_status(&d);\n\n reset_on_second_timeout(true);\n\n set_tco_timeout(&d, ticks);\n\n load_tco(&d);\n\n start_tco(&d);\n\n clock_step(ticks * TCO_TICK_NSEC * 2);\n\n\n\n val = qpci_io_readw(d.dev, d.tco_io_base + TCO2_STS);\n\n ret = val & (TCO_SECOND_TO_STS | TCO_BOOT_STS) ? 1 : 0;\n\n g_assert(ret == 1);\n\n qpci_io_writew(d.dev, d.tco_io_base + TCO2_STS, val);\n\n g_assert_cmpint(qpci_io_readw(d.dev, d.tco_io_base + TCO2_STS), ==, 0);\n\n qtest_end();\n\n}\n"}} {"sample_id": "7f526efd17973ec6d2204f7a47b6923e2be31363_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+void rgb16tobgr15(const uint8_t *src, uint8_t *dst, unsigned int src_size)\n+\n+{\n \n \tunsigned i;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void rgb16tobgr15(const uint8_t *src, uint8_t *dst, unsigned int src_size)\n\n{\n\n\tunsigned i;\n\n\tunsigned num_pixels = src_size >> 1;\n\n\t\n\n\tfor(i=0; i>5;\n\n\t b = (rgb&0xF800)>>11;\n\n\t dst[2*i] = (b&0x1F) | ((g&0x1F)<<5) | ((r&0x1F)<<10);\n\n\t}\n\n}\n"}} {"sample_id": "048c74c4379789d03c857cea038ec00d95b68eaf_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n {\n \n RTCState *s = opaque;\n+\n+\n+\n qemu_put_be32(f, s->irq_coalesced);\n \n qemu_put_be32(f, s->period);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void rtc_save_td(QEMUFile *f, void *opaque)\n\n{\n\n RTCState *s = opaque;\n\n\n\n qemu_put_be32(f, s->irq_coalesced);\n\n qemu_put_be32(f, s->period);\n\n}\n"}} {"sample_id": "8a5956ad6392f115521dad774055c737c49fb0dd_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ struct list_element *new_el;\n+\n+ int i;\n+\n+ nthreadsrunning = 0;\n \n srand(time(0));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void rcu_qtest_init(void)\n\n{\n\n struct list_element *new_el;\n\n int i;\n\n nthreadsrunning = 0;\n\n srand(time(0));\n\n for (i = 0; i < RCU_Q_LEN; i++) {\n\n new_el = g_new(struct list_element, 1);\n\n new_el->val = i;\n\n QLIST_INSERT_HEAD_RCU(&Q_list_head, new_el, entry);\n\n }\n\n atomic_add(&n_nodes, RCU_Q_LEN);\n\n}\n"}} {"sample_id": "2de7e26891db3d5b7f214fa485a5e946b17a57b9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n } else {\n \n+ qdev_prop_allow_set_link_before_realize(obj, name, val, &local_err);\n+\n+ }\n+\n+\n \n error_propagate(errp, local_err);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pc_dimm_check_memdev_is_busy(const Object *obj, const char *name,\n\n Object *val, Error **errp)\n\n{\n\n Error *local_err = NULL;\n\n\n\n if (host_memory_backend_is_mapped(MEMORY_BACKEND(val))) {\n\n char *path = object_get_canonical_path_component(val);\n\n error_setg(&local_err, \"can't use already busy memdev: %s\", path);\n\n g_free(path);\n\n } else {\n\n qdev_prop_allow_set_link_before_realize(obj, name, val, &local_err);\n\n }\n\n\n\n error_propagate(errp, local_err);\n\n}\n"}} {"sample_id": "d1adad3cca407f493c3637e20ecd4f7124e69212_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n long lumStride, long chromStride, long srcStride)\n \n+{\n+\n+ long y;\n+\n+ const long chromWidth= -((-width)>>1);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void RENAME(yuyvtoyuv422)(uint8_t *ydst, uint8_t *udst, uint8_t *vdst, const uint8_t *src,\n\n long width, long height,\n\n long lumStride, long chromStride, long srcStride)\n\n{\n\n long y;\n\n const long chromWidth= -((-width)>>1);\n\n\n\n for (y=0; ypcihost);\n\n uint32_t pciaddr;\n\n uint16_t status;\n\n\n\n DPRINTF(\"bonito_spciconf_writew \"TARGET_FMT_plx\" val %x\\n\", addr, val);\n\n assert((addr & 0x1) == 0);\n\n\n\n pciaddr = bonito_sbridge_pciaddr(s, addr);\n\n\n\n if (pciaddr == 0xffffffff) {\n\n return;\n\n }\n\n\n\n /* set the pci address in s->config_reg */\n\n phb->config_reg = (pciaddr) | (1u << 31);\n\n pci_data_write(phb->bus, phb->config_reg, val, 2);\n\n\n\n /* clear PCI_STATUS_REC_MASTER_ABORT and PCI_STATUS_REC_TARGET_ABORT */\n\n status = pci_get_word(d->config + PCI_STATUS);\n\n status &= ~(PCI_STATUS_REC_MASTER_ABORT | PCI_STATUS_REC_TARGET_ABORT);\n\n pci_set_word(d->config + PCI_STATUS, status);\n\n}\n"}} {"sample_id": "6d6eabd399eb20b69d10234ef746f2d3d4c72dcb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static inline int mjpeg_decode_dc(MJpegDecodeContext *s, int dc_index)\n \n {\n+\n int code;\n \n code = get_vlc2(&s->gb, s->vlcs[0][dc_index].table, 9, 2);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline int mjpeg_decode_dc(MJpegDecodeContext *s, int dc_index)\n\n{\n\n int code;\n\n code = get_vlc2(&s->gb, s->vlcs[0][dc_index].table, 9, 2);\n\n if (code < 0) {\n\n av_log(s->avctx, AV_LOG_WARNING,\n\n \"mjpeg_decode_dc: bad vlc: %d:%d (%p)\\n\",\n\n 0, dc_index, &s->vlcs[0][dc_index]);\n\n return 0xffff;\n\n }\n\n\n\n if (code)\n\n return get_xbits(&s->gb, code);\n\n else\n\n return 0;\n\n}\n"}} {"sample_id": "6d3cb1f970ee85361618f7ff02869180394e012d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+int cache_insert(PageCache *cache, uint64_t addr, uint8_t *pdata)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int cache_insert(PageCache *cache, uint64_t addr, uint8_t *pdata)\n\n{\n\n\n\n CacheItem *it = NULL;\n\n\n\n g_assert(cache);\n\n g_assert(cache->page_cache);\n\n\n\n /* actual update of entry */\n\n it = cache_get_by_addr(cache, addr);\n\n\n\n /* allocate page */\n\n if (!it->it_data) {\n\n it->it_data = g_try_malloc(cache->page_size);\n\n if (!it->it_data) {\n\n DPRINTF(\"Error allocating page\\n\");\n\n return -1;\n\n }\n\n cache->num_items++;\n\n }\n\n\n\n memcpy(it->it_data, pdata, cache->page_size);\n\n\n\n it->it_age = ++cache->max_item_age;\n\n it->it_addr = addr;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "42a268c241183877192c376d03bd9b6d527407c7_36", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n {\n \n+ int jumpLabel;\n+\n+ jumpLabel = gen_new_label();\n+\n+ tcg_gen_brcond_tl(cond, r1, r2, jumpLabel);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_branch_cond(DisasContext *ctx, TCGCond cond, TCGv r1,\n\n TCGv r2, int16_t address)\n\n{\n\n int jumpLabel;\n\n jumpLabel = gen_new_label();\n\n tcg_gen_brcond_tl(cond, r1, r2, jumpLabel);\n\n\n\n gen_goto_tb(ctx, 1, ctx->next_pc);\n\n\n\n gen_set_label(jumpLabel);\n\n gen_goto_tb(ctx, 0, ctx->pc + address * 2);\n\n}\n"}} {"sample_id": "abd696e4f74a9d30801c6ae2693efe4e5979c2f2_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n void sclp_print(const char *str)\n \n+{\n+\n+ int len = _strlen(str);\n+\n+ WriteEventData *sccb = (void*)_sccb;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void sclp_print(const char *str)\n\n{\n\n int len = _strlen(str);\n\n WriteEventData *sccb = (void*)_sccb;\n\n\n\n sccb->h.length = sizeof(WriteEventData) + len;\n\n sccb->h.function_code = SCLP_FC_NORMAL_WRITE;\n\n sccb->ebh.length = sizeof(EventBufferHeader) + len;\n\n sccb->ebh.type = SCLP_EVENT_ASCII_CONSOLE_DATA;\n\n sccb->ebh.flags = 0;\n\n _memcpy(sccb->data, str, len);\n\n\n\n sclp_service_call(SCLP_CMD_WRITE_EVENT_DATA, sccb);\n\n}\n"}} {"sample_id": "698feb5e13a2d763369909ce33f2bd7a7c1c11c0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n {\n \n+ struct vhost_dev *dev = container_of(listener, struct vhost_dev,\n+\n+ iommu_listener);\n+\n+ struct vhost_iommu *iommu;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vhost_iommu_region_add(MemoryListener *listener,\n\n MemoryRegionSection *section)\n\n{\n\n struct vhost_dev *dev = container_of(listener, struct vhost_dev,\n\n iommu_listener);\n\n struct vhost_iommu *iommu;\n\n\n\n if (!memory_region_is_iommu(section->mr)) {\n\n return;\n\n }\n\n\n\n iommu = g_malloc0(sizeof(*iommu));\n\n iommu->n.notify = vhost_iommu_unmap_notify;\n\n iommu->n.notifier_flags = IOMMU_NOTIFIER_UNMAP;\n\n iommu->mr = section->mr;\n\n iommu->iommu_offset = section->offset_within_address_space -\n\n section->offset_within_region;\n\n iommu->hdev = dev;\n\n memory_region_register_iommu_notifier(section->mr, &iommu->n);\n\n QLIST_INSERT_HEAD(&dev->iommu_list, iommu, iommu_next);\n\n /* TODO: can replay help performance here? */\n\n}\n"}} {"sample_id": "c572f23a3e7180dbeab5e86583e43ea2afed6271_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n int32_t fid, err = 0;\n V9fsPDU *pdu = opaque;\n V9fsState *s = pdu->s;\n+ glock = g_malloc(sizeof(*glock));\n+ pdu_unmarshal(pdu, offset, \"dbqqds\", &fid, &glock->type,\n+ &glock->start, &glock->length, &glock->proc_id,\n+ &glock->client_id);\n+ trace_v9fs_getlock(pdu->tag, pdu->id, fid,\n glock->type, glock->start, glock->length);\n fidp = get_fid(pdu, fid);\n if (fidp == NULL) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void v9fs_getlock(void *opaque)\n{\n size_t offset = 7;\n struct stat stbuf;\n V9fsFidState *fidp;\n V9fsGetlock *glock;\n int32_t fid, err = 0;\n V9fsPDU *pdu = opaque;\n V9fsState *s = pdu->s;\n glock = g_malloc(sizeof(*glock));\n pdu_unmarshal(pdu, offset, \"dbqqds\", &fid, &glock->type,\n &glock->start, &glock->length, &glock->proc_id,\n &glock->client_id);\n trace_v9fs_getlock(pdu->tag, pdu->id, fid,\n glock->type, glock->start, glock->length);\n fidp = get_fid(pdu, fid);\n if (fidp == NULL) {\n err = -ENOENT;\n goto out_nofid;\n }\n err = v9fs_co_fstat(pdu, fidp->fs.fd, &stbuf);\n if (err < 0) {\n goto out;\n }\n glock->type = P9_LOCK_TYPE_UNLCK;\n offset += pdu_marshal(pdu, offset, \"bqqds\", glock->type,\n glock->start, glock->length, glock->proc_id,\n &glock->client_id);\n err = offset;\nout:\n put_fid(pdu, fidp);\nout_nofid:\n complete_pdu(s, pdu, err);\n v9fs_string_free(&glock->client_id);\n g_free(glock);\n}"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_31", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static inline void neon_load_reg64(TCGv var, int reg)\n \n+{\n \n tcg_gen_ld_i64(var, cpu_env, vfp_reg_offset(1, reg));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void neon_load_reg64(TCGv var, int reg)\n\n{\n\n tcg_gen_ld_i64(var, cpu_env, vfp_reg_offset(1, reg));\n\n}\n"}} {"sample_id": "0c0aef1caf0cb5dd3b294f9fff923175036bd985", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n av_dict_set(options, \"method\", c->method, 0);\n \n } else if (proto && http_base_proto) {\n+\n+ av_log(c, AV_LOG_WARNING, \"No HTTP method set, hls muxer defaulting to method PUT.\\n\");\n+\n+ av_dict_set(options, \"method\", \"PUT\", 0);\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void set_http_options(AVFormatContext *s, AVDictionary **options, HLSContext *c)\n\n{\n\n const char *proto = avio_find_protocol_name(s->filename);\n\n int http_base_proto = !av_strcasecmp(proto, \"http\") || !av_strcasecmp(proto, \"https\");\n\n\n\n if (c->method) {\n\n av_dict_set(options, \"method\", c->method, 0);\n\n } else if (proto && http_base_proto) {\n\n av_log(c, AV_LOG_WARNING, \"No HTTP method set, hls muxer defaulting to method PUT.\\n\");\n\n av_dict_set(options, \"method\", \"PUT\", 0);\n\n }\n\n}\n"}} {"sample_id": "ccbcfedd17fd2d13521fcee66810d0df464ec1cc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n int qemu_devtree_nop_node(void *fdt, const char *node_path)\n+\n+{\n+\n+ int offset;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "int qemu_devtree_nop_node(void *fdt, const char *node_path)\n\n{\n\n int offset;\n\n\n\n offset = fdt_path_offset(fdt, node_path);\n\n if (offset < 0)\n\n return offset;\n\n\n\n return fdt_nop_node(fdt, offset);\n\n}\n"}} {"sample_id": "e4afbf4fb4d026510700cb40bb72dea9aef14e3b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int nbd_can_accept(void *opaque)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int nbd_can_accept(void *opaque)\n\n{\n\n return nb_fds < shared;\n\n}\n"}} {"sample_id": "f090c9d4ad5812fb92843d6470a1111c15190c4c_19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+float64 uint64_to_float64( uint64 a STATUS_PARAM )\n+\n {\n \n if ( a == 0 ) return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "float64 uint64_to_float64( uint64 a STATUS_PARAM )\n\n{\n\n if ( a == 0 ) return 0;\n\n return normalizeRoundAndPackFloat64( 0, 0x43C, a STATUS_VAR );\n\n\n\n}\n"}} {"sample_id": "e9b8523d52ca84d5012168db24fec2d50e73cf22", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int parse_fade(struct sbg_parser *p, struct sbg_fade *fr)\n+\n {\n \n struct sbg_fade f;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int parse_fade(struct sbg_parser *p, struct sbg_fade *fr)\n\n{\n\n struct sbg_fade f;\n\n\n\n if (lex_char(p, '<'))\n\n f.in = SBG_FADE_SILENCE;\n\n else if (lex_char(p, '-'))\n\n f.in = SBG_FADE_SAME;\n\n else if (lex_char(p, '='))\n\n f.in = SBG_FADE_ADAPT;\n\n else\n\n return 0;\n\n if (lex_char(p, '>'))\n\n f.out = SBG_FADE_SILENCE;\n\n else if (lex_char(p, '-'))\n\n f.out = SBG_FADE_SAME;\n\n else if (lex_char(p, '='))\n\n f.out = SBG_FADE_ADAPT;\n\n else\n\n return AVERROR_INVALIDDATA;\n\n *fr = f;\n\n return 1;\n\n}\n"}} {"sample_id": "f53a829bb9ef14be800556cbc02d8b20fc1050a7_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n }\n \n+ offset += NBD_MAX_SECTORS * 512;\n+\n+ sector_num += NBD_MAX_SECTORS;\n+\n+ nb_sectors -= NBD_MAX_SECTORS;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int nbd_client_session_co_readv(NbdClientSession *client, int64_t sector_num,\n\n int nb_sectors, QEMUIOVector *qiov)\n\n{\n\n int offset = 0;\n\n int ret;\n\n while (nb_sectors > NBD_MAX_SECTORS) {\n\n ret = nbd_co_readv_1(client, sector_num,\n\n NBD_MAX_SECTORS, qiov, offset);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n offset += NBD_MAX_SECTORS * 512;\n\n sector_num += NBD_MAX_SECTORS;\n\n nb_sectors -= NBD_MAX_SECTORS;\n\n }\n\n return nbd_co_readv_1(client, sector_num, nb_sectors, qiov, offset);\n\n}\n"}} {"sample_id": "f6d49a0dc84aade2adf150c25afb66cbda1d5528", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void d3d11va_device_uninit(AVHWDeviceContext *hwdev)\n \n+{\n+\n+ AVD3D11VADeviceContext *device_hwctx = hwdev->hwctx;\n+\n+\n \n if (device_hwctx->device)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void d3d11va_device_uninit(AVHWDeviceContext *hwdev)\n\n{\n\n AVD3D11VADeviceContext *device_hwctx = hwdev->hwctx;\n\n\n\n if (device_hwctx->device)\n\n ID3D11Device_Release(device_hwctx->device);\n\n\n\n if (device_hwctx->device_context)\n\n ID3D11DeviceContext_Release(device_hwctx->device_context);\n\n\n\n if (device_hwctx->video_device)\n\n ID3D11VideoDevice_Release(device_hwctx->video_device);\n\n\n\n if (device_hwctx->video_context)\n\n ID3D11VideoContext_Release(device_hwctx->video_context);\n\n\n\n if (device_hwctx->lock == d3d11va_default_lock)\n\n CloseHandle(device_hwctx->lock_ctx);\n\n}\n"}} {"sample_id": "fd56e0612b6454a282fa6a953fdb09281a98c589_21", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n /* Other bus types might support multiple devices at slots 0-31 */\n \n return pci_dev->bus->devices[PCI_DEVFN(PCI_SLOT(pci_dev->devfn), 0)];\n+\n+ }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "PCIDevice *pci_get_function_0(PCIDevice *pci_dev)\n\n{\n\n if(pcie_has_upstream_port(pci_dev)) {\n\n /* With an upstream PCIe port, we only support 1 device at slot 0 */\n\n return pci_dev->bus->devices[0];\n\n } else {\n\n /* Other bus types might support multiple devices at slots 0-31 */\n\n return pci_dev->bus->devices[PCI_DEVFN(PCI_SLOT(pci_dev->devfn), 0)];\n\n }\n\n}\n"}} {"sample_id": "dd321ecfc2e82e6f9578b986060b1aa3f036bd98_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -35,11 +35,11 @@\n timeout_source = g_timeout_source_new(REGULAR_PACKET_CHECK_MS);\n \n g_source_set_callback(timeout_source,\n+\n+ (GSourceFunc)check_old_packet_regular, s, NULL);\n+\n+ g_source_attach(timeout_source, s->worker_context);\n+\n \n \n g_main_loop_run(s->compare_loop);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void *colo_compare_thread(void *opaque)\n\n{\n\n CompareState *s = opaque;\n\n GSource *timeout_source;\n\n\n\n s->worker_context = g_main_context_new();\n\n\n\n qemu_chr_fe_set_handlers(&s->chr_pri_in, compare_chr_can_read,\n\n compare_pri_chr_in, NULL, NULL,\n\n s, s->worker_context, true);\n\n qemu_chr_fe_set_handlers(&s->chr_sec_in, compare_chr_can_read,\n\n compare_sec_chr_in, NULL, NULL,\n\n s, s->worker_context, true);\n\n\n\n s->compare_loop = g_main_loop_new(s->worker_context, FALSE);\n\n\n\n /* To kick any packets that the secondary doesn't match */\n\n timeout_source = g_timeout_source_new(REGULAR_PACKET_CHECK_MS);\n\n g_source_set_callback(timeout_source,\n\n (GSourceFunc)check_old_packet_regular, s, NULL);\n\n g_source_attach(timeout_source, s->worker_context);\n\n\n\n g_main_loop_run(s->compare_loop);\n\n\n\n g_source_unref(timeout_source);\n\n g_main_loop_unref(s->compare_loop);\n\n g_main_context_unref(s->worker_context);\n\n return NULL;\n\n}\n"}} {"sample_id": "10c4c98ab7dc18169b37b76f6ea5e60ebe65222b_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,8 +6,8 @@\n \n info->qdev.init = i2c_slave_qdev_init;\n \n+ info->qdev.bus_type = BUS_TYPE_I2C;\n+\n+ qdev_register(&info->qdev);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void i2c_register_slave(I2CSlaveInfo *info)\n\n{\n\n assert(info->qdev.size >= sizeof(i2c_slave));\n\n info->qdev.init = i2c_slave_qdev_init;\n\n info->qdev.bus_type = BUS_TYPE_I2C;\n\n qdev_register(&info->qdev);\n\n}\n"}} {"sample_id": "7e2515e87c41e2e658aaed466e11cbdf1ea8bcb1_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n term_cmd_buf_index = term_cmd_buf_size;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void term_eol(void)\n\n{\n\n term_cmd_buf_index = term_cmd_buf_size;\n\n}\n"}} {"sample_id": "d3392718e1fcf0859fb7c0774a8e946bacb8419c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n+static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)\n \n {\n+\n /* Do the \"take the exception\" parts of exception entry,\n \n * but not the pushing of state to the stack. This is\n \n+ * similar to the pseudocode ExceptionTaken() function.\n \n */\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)\n\n{\n\n /* Do the \"take the exception\" parts of exception entry,\n\n * but not the pushing of state to the stack. This is\n\n * similar to the pseudocode ExceptionTaken() function.\n\n */\n\n CPUARMState *env = &cpu->env;\n\n uint32_t addr;\n\n\n\n armv7m_nvic_acknowledge_irq(env->nvic);\n\n write_v7m_control_spsel(env, 0);\n\n arm_clear_exclusive(env);\n\n /* Clear IT bits */\n\n env->condexec_bits = 0;\n\n env->regs[14] = lr;\n\n addr = arm_v7m_load_vector(cpu);\n\n env->regs[15] = addr & 0xfffffffe;\n\n env->thumb = addr & 1;\n\n}\n"}} {"sample_id": "53593e90d13264dc88b3281ddf75ceaa641df05a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void gen_check_sr(DisasContext *dc, uint32_t sr)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void gen_check_sr(DisasContext *dc, uint32_t sr)\n\n{\n\n if (!xtensa_option_bits_enabled(dc->config, sregnames[sr].opt_bits)) {\n\n if (sregnames[sr].name) {\n\n qemu_log(\"SR %s is not configured\\n\", sregnames[sr].name);\n\n } else {\n\n qemu_log(\"SR %d is not implemented\\n\", sr);\n\n }\n\n gen_exception_cause(dc, ILLEGAL_INSTRUCTION_CAUSE);\n\n }\n\n}\n"}} {"sample_id": "0e9b9edae7bebfd31fdbead4ccbbce03876a7edd_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n memcpy(h->oem_id, ACPI_BUILD_APPNAME6, 6);\n \n }\n+\n+\n+\n+ if (oem_table_id) {\n+\n strncpy((char *)h->oem_table_id, oem_table_id, sizeof(h->oem_table_id));\n \n } else {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "build_header(GArray *linker, GArray *table_data,\n\n AcpiTableHeader *h, const char *sig, int len, uint8_t rev,\n\n const char *oem_id, const char *oem_table_id)\n\n{\n\n memcpy(&h->signature, sig, 4);\n\n h->length = cpu_to_le32(len);\n\n h->revision = rev;\n\n\n\n if (oem_id) {\n\n strncpy((char *)h->oem_id, oem_id, sizeof h->oem_id);\n\n } else {\n\n memcpy(h->oem_id, ACPI_BUILD_APPNAME6, 6);\n\n }\n\n\n\n if (oem_table_id) {\n\n strncpy((char *)h->oem_table_id, oem_table_id, sizeof(h->oem_table_id));\n\n } else {\n\n memcpy(h->oem_table_id, ACPI_BUILD_APPNAME4, 4);\n\n memcpy(h->oem_table_id + 4, sig, 4);\n\n }\n\n\n\n h->oem_revision = cpu_to_le32(1);\n\n memcpy(h->asl_compiler_id, ACPI_BUILD_APPNAME4, 4);\n\n h->asl_compiler_revision = cpu_to_le32(1);\n\n h->checksum = 0;\n\n /* Checksum to be filled in by Guest linker */\n\n bios_linker_loader_add_checksum(linker, ACPI_BUILD_TABLE_FILE,\n\n table_data, h, len, &h->checksum);\n\n}\n"}} {"sample_id": "fd56e0612b6454a282fa6a953fdb09281a98c589_28", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,9 +13,9 @@\n memory_region_del_subregion(&pci_dev->bus_master_container_region,\n \n &pci_dev->bus_master_enable_region);\n+\n+ }\n+\n+ address_space_destroy(&pci_dev->bus_master_as);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void do_pci_unregister_device(PCIDevice *pci_dev)\n\n{\n\n pci_dev->bus->devices[pci_dev->devfn] = NULL;\n\n pci_config_free(pci_dev);\n\n\n\n if (memory_region_is_mapped(&pci_dev->bus_master_enable_region)) {\n\n memory_region_del_subregion(&pci_dev->bus_master_container_region,\n\n &pci_dev->bus_master_enable_region);\n\n }\n\n address_space_destroy(&pci_dev->bus_master_as);\n\n}\n"}} {"sample_id": "1b3a7e1f42c3d89253e9837ada98e6bfb0cbab2f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static av_noinline void emulated_edge_mc_sse(uint8_t *buf, ptrdiff_t buf_stride,\n+\n const uint8_t *src, ptrdiff_t src_stride,\n \n int block_w, int block_h,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static av_noinline void emulated_edge_mc_sse(uint8_t *buf, ptrdiff_t buf_stride,\n\n const uint8_t *src, ptrdiff_t src_stride,\n\n int block_w, int block_h,\n\n int src_x, int src_y, int w, int h)\n\n{\n\n emulated_edge_mc(buf, buf_stride, src, src_stride, block_w, block_h, src_x,\n\n src_y, w, h, vfixtbl_sse, &ff_emu_edge_vvar_sse, hfixtbl_sse,\n\n#if ARCH_X86_64\n\n &ff_emu_edge_hvar_sse\n\n#else\n\n &ff_emu_edge_hvar_mmx\n\n#endif\n\n );\n\n}\n"}} {"sample_id": "3e305e4a4752f70c0b5c3cf5b43ec957881714f7_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n void vncws_tls_handshake_io(void *opaque)\n \n+{\n+\n+ VncState *vs = (VncState *)opaque;\n \n \n \n+ if (!vs->tls.session) {\n \n VNC_DEBUG(\"TLS Websocket setup\\n\");\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void vncws_tls_handshake_io(void *opaque)\n\n{\n\n VncState *vs = (VncState *)opaque;\n\n\n\n if (!vs->tls.session) {\n\n VNC_DEBUG(\"TLS Websocket setup\\n\");\n\n if (vnc_tls_client_setup(vs, vs->vd->tls.x509cert != NULL) < 0) {\n\n return;\n\n }\n\n }\n\n VNC_DEBUG(\"Handshake IO continue\\n\");\n\n vncws_start_tls_handshake(vs);\n\n}\n"}} {"sample_id": "46e1af3b0f2c28936dfa88063cc5a35f466f5ac3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -54,11 +54,11 @@\n \n syms[i] = he[i].sym;\n \n+ code += 0x80000000u >> (he[i].len - 1);\n+\n+ }\n+\n+\n \n return init_vlc_sparse(vlc, FFMIN(he[last].len, 9), last + 1,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int build_huff(const uint8_t *src, VLC *vlc)\n\n{\n\n int i;\n\n HuffEntry he[256];\n\n int last;\n\n uint32_t codes[256];\n\n uint8_t bits[256];\n\n uint8_t syms[256];\n\n uint32_t code;\n\n\n\n for (i = 0; i < 256; i++) {\n\n he[i].sym = i;\n\n he[i].len = *src++;\n\n }\n\n qsort(he, 256, sizeof(*he), huff_cmp);\n\n\n\n if (!he[0].len || he[0].len > 32)\n\n return -1;\n\n\n\n last = 255;\n\n while (he[last].len == 255 && last)\n\n last--;\n\n\n\n code = 1;\n\n for (i = last; i >= 0; i--) {\n\n codes[i] = code >> (32 - he[i].len);\n\n bits[i] = he[i].len;\n\n syms[i] = he[i].sym;\n\n code += 0x80000000u >> (he[i].len - 1);\n\n }\n\n\n\n return init_vlc_sparse(vlc, FFMIN(he[last].len, 9), last + 1,\n\n bits, sizeof(*bits), sizeof(*bits),\n\n codes, sizeof(*codes), sizeof(*codes),\n\n syms, sizeof(*syms), sizeof(*syms), 0);\n\n}\n"}} {"sample_id": "b88be742fac7a77a8095e8155ba8790db4b77568_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,28 +1,28 @@\n static void encode_signal_range(VC2EncContext *s)\n+\n+{\n+\n+ int idx;\n+\n+ AVCodecContext *avctx = s->avctx;\n+\n+ const AVPixFmtDescriptor *fmt = av_pix_fmt_desc_get(avctx->pix_fmt);\n+\n+ const int depth = fmt->comp[0].depth;\n+\n if (depth == 8 && avctx->color_range == AVCOL_RANGE_JPEG) {\n \n+ idx = 1;\n+\n+ s->bpp = 1;\n+\n s->diff_offset = 128;\n+\n } else if (depth == 8 && (avctx->color_range == AVCOL_RANGE_MPEG ||\n+\n avctx->color_range == AVCOL_RANGE_UNSPECIFIED)) {\n \n+ idx = 2;\n \n s->bpp = 1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void encode_signal_range(VC2EncContext *s)\n\n{\n\n int idx;\n\n AVCodecContext *avctx = s->avctx;\n\n const AVPixFmtDescriptor *fmt = av_pix_fmt_desc_get(avctx->pix_fmt);\n\n const int depth = fmt->comp[0].depth;\n\n if (depth == 8 && avctx->color_range == AVCOL_RANGE_JPEG) {\n\n idx = 1;\n\n s->bpp = 1;\n\n s->diff_offset = 128;\n\n } else if (depth == 8 && (avctx->color_range == AVCOL_RANGE_MPEG ||\n\n avctx->color_range == AVCOL_RANGE_UNSPECIFIED)) {\n\n idx = 2;\n\n s->bpp = 1;\n\n s->diff_offset = 128;\n\n } else if (depth == 10) {\n\n idx = 3;\n\n s->bpp = 2;\n\n s->diff_offset = 512;\n\n } else {\n\n idx = 4;\n\n s->bpp = 2;\n\n s->diff_offset = 2048;\n\n }\n\n put_bits(&s->pb, 1, !s->strict_compliance);\n\n if (!s->strict_compliance)\n\n put_vc2_ue_uint(&s->pb, idx);\n\n}\n"}} {"sample_id": "45bbbb466cf4a6280076ea5a51f67ef5bedee345_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void helper_divl_EAX_T0(void)\n+\n+{\n \n unsigned int den, q, r;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void helper_divl_EAX_T0(void)\n\n{\n\n unsigned int den, q, r;\n\n uint64_t num;\n\n \n\n num = ((uint32_t)EAX) | ((uint64_t)((uint32_t)EDX) << 32);\n\n den = T0;\n\n if (den == 0) {\n\n raise_exception(EXCP00_DIVZ);\n\n }\n\n#ifdef BUGGY_GCC_DIV64\n\n r = div32(&q, num, den);\n\n#else\n\n q = (num / den);\n\n r = (num % den);\n\n#endif\n\n EAX = (uint32_t)q;\n\n EDX = (uint32_t)r;\n\n}\n"}} {"sample_id": "b8664c929437d6d079e16979c496a2db40cf2324_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n \n \n+ if (have_armv6(cpu_flags))\n+\n+ ff_vp8dsp_init_armv6(dsp);\n+\n if (have_neon(cpu_flags))\n \n ff_vp8dsp_init_neon(dsp);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "av_cold void ff_vp8dsp_init_arm(VP8DSPContext *dsp)\n\n{\n\n int cpu_flags = av_get_cpu_flags();\n\n\n\n if (have_armv6(cpu_flags))\n\n ff_vp8dsp_init_armv6(dsp);\n\n if (have_neon(cpu_flags))\n\n ff_vp8dsp_init_neon(dsp);\n\n}\n"}} {"sample_id": "ce137829e7e58fcdc5ba63b5e256f972e80be438_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static inline void array_free(array_t* array)\n+\n {\n \n if(array->pointer)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void array_free(array_t* array)\n\n{\n\n if(array->pointer)\n\n free(array->pointer);\n\n array->size=array->next=0;\n\n}\n"}} {"sample_id": "acc163c6ab52d2235767852262c64c7f6b273d1c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n sample *samples = (sample *) OUT(out);\n \n+ int i, j;\n+\n+\n+\n for (j = 0; j < len; j++)\n \n for (i = 0; i < channels; i++)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void FUNC(flac_decorrelate_indep_c)(uint8_t **out, int32_t **in,\n\n int channels, int len, int shift)\n\n{\n\n sample *samples = (sample *) OUT(out);\n\n int i, j;\n\n\n\n for (j = 0; j < len; j++)\n\n for (i = 0; i < channels; i++)\n\n S(samples, i, j) = in[i][j] << shift;\n\n}\n"}} {"sample_id": "2119882c7eb7e2c612b24fc0c8d86f5887d6f1c3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n BlkMigDevState *bmds;\n+\n+\n+\n+ QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {\n \n aio_context_acquire(blk_get_aio_context(bmds->blk));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void unset_dirty_tracking(void)\n\n{\n\n BlkMigDevState *bmds;\n\n\n\n QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {\n\n aio_context_acquire(blk_get_aio_context(bmds->blk));\n\n bdrv_release_dirty_bitmap(blk_bs(bmds->blk), bmds->dirty_bitmap);\n\n aio_context_release(blk_get_aio_context(bmds->blk));\n\n }\n\n}\n"}} {"sample_id": "ea776abca628d855e03c4929da3864985afd8aae", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n if (bdrv_enable_write_cache(s->bs))\n \n features |= (1 << VIRTIO_BLK_F_WCE);\n+\n+\n+\n+ if (bdrv_is_read_only(s->bs))\n+\n features |= 1 << VIRTIO_BLK_F_RO;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t virtio_blk_get_features(VirtIODevice *vdev, uint32_t features)\n\n{\n\n VirtIOBlock *s = to_virtio_blk(vdev);\n\n\n\n features |= (1 << VIRTIO_BLK_F_SEG_MAX);\n\n features |= (1 << VIRTIO_BLK_F_GEOMETRY);\n\n features |= (1 << VIRTIO_BLK_F_TOPOLOGY);\n\n features |= (1 << VIRTIO_BLK_F_BLK_SIZE);\n\n features |= (1 << VIRTIO_BLK_F_SCSI);\n\n\n\n features |= (1 << VIRTIO_BLK_F_CONFIG_WCE);\n\n if (bdrv_enable_write_cache(s->bs))\n\n features |= (1 << VIRTIO_BLK_F_WCE);\n\n\n\n if (bdrv_is_read_only(s->bs))\n\n features |= 1 << VIRTIO_BLK_F_RO;\n\n\n\n return features;\n\n}\n"}} {"sample_id": "26a83ad0e793465b74a8b06a65f2f6fdc5615413_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n memory_region_init(mr, name, size);\n \n mr->ram = true;\n+\n+ mr->terminates = true;\n+\n+ mr->destructor = memory_region_destructor_ram;\n+\n mr->ram_addr = qemu_ram_alloc(size, mr);\n \n mr->backend_registered = true;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void memory_region_init_ram(MemoryRegion *mr,\n\n const char *name,\n\n uint64_t size)\n\n{\n\n memory_region_init(mr, name, size);\n\n mr->ram = true;\n\n mr->terminates = true;\n\n mr->destructor = memory_region_destructor_ram;\n\n mr->ram_addr = qemu_ram_alloc(size, mr);\n\n mr->backend_registered = true;\n\n}\n"}} {"sample_id": "4956d0e5a6a555d31345c913485bcc4e0a53481e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n int64_t av_add_stable(AVRational ts_tb, int64_t ts, AVRational inc_tb, int64_t inc)\n \n {\n+\n+ inc_tb = av_mul_q(inc_tb, (AVRational) {inc, 1});\n+\n+\n+\n if (av_cmp_q(inc_tb, ts_tb) < 0) {\n \n //increase step is too small for even 1 step to be representable", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int64_t av_add_stable(AVRational ts_tb, int64_t ts, AVRational inc_tb, int64_t inc)\n\n{\n\n inc_tb = av_mul_q(inc_tb, (AVRational) {inc, 1});\n\n\n\n if (av_cmp_q(inc_tb, ts_tb) < 0) {\n\n //increase step is too small for even 1 step to be representable\n\n return ts;\n\n } else {\n\n int64_t old = av_rescale_q(ts, ts_tb, inc_tb);\n\n int64_t old_ts = av_rescale_q(old, inc_tb, ts_tb);\n\n return av_rescale_q(old + 1, inc_tb, ts_tb) + (ts - old_ts);\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_141", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n memory_region_init_io(&s->iomem, &omap_os_timer_ops, s,\n \n \"omap-os-timer\", 0x800);\n+\n+ memory_region_add_subregion(memory, base, &s->iomem);\n+\n+\n+\n return s;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static struct omap_32khz_timer_s *omap_os_timer_init(MemoryRegion *memory,\n\n target_phys_addr_t base,\n\n qemu_irq irq, omap_clk clk)\n\n{\n\n struct omap_32khz_timer_s *s = (struct omap_32khz_timer_s *)\n\n g_malloc0(sizeof(struct omap_32khz_timer_s));\n\n\n\n s->timer.irq = irq;\n\n s->timer.clk = clk;\n\n s->timer.timer = qemu_new_timer_ns(vm_clock, omap_timer_tick, &s->timer);\n\n omap_os_timer_reset(s);\n\n omap_timer_clk_setup(&s->timer);\n\n\n\n memory_region_init_io(&s->iomem, &omap_os_timer_ops, s,\n\n \"omap-os-timer\", 0x800);\n\n memory_region_add_subregion(memory, base, &s->iomem);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "0266f2c733911ca3f70e009e3230c790c800e524_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,10 +18,10 @@\n \n else\n \n+ set_lcd_pixel(s, x, y, 0);\n+\n+\n+\n+ dpy_update(s->ds, 0, 0, 128*3, 64*3);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void lcd_refresh(void *opaque)\n\n{\n\n musicpal_lcd_state *s = opaque;\n\n int x, y;\n\n\n\n for (x = 0; x < 128; x++)\n\n for (y = 0; y < 64; y++)\n\n if (s->video_ram[x + (y/8)*128] & (1 << (y % 8)))\n\n set_lcd_pixel(s, x, y, MP_LCD_TEXTCOLOR);\n\n else\n\n set_lcd_pixel(s, x, y, 0);\n\n\n\n dpy_update(s->ds, 0, 0, 128*3, 64*3);\n\n}\n"}} {"sample_id": "54421cb17bc744bad15f2b1adb4adefdaea83c10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n } else {\n \n+ create_flags = OPEN_EXISTING;\n+\n+ }\n+\n+#ifdef QEMU_TOOL\n \n overlapped = FILE_ATTRIBUTE_NORMAL;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int raw_open(BlockDriverState *bs, const char *filename, int flags)\n\n{\n\n BDRVRawState *s = bs->opaque;\n\n int access_flags, create_flags;\n\n DWORD overlapped;\n\n\n\n s->type = FTYPE_FILE;\n\n\n\n if ((flags & BDRV_O_ACCESS) == O_RDWR) {\n\n access_flags = GENERIC_READ | GENERIC_WRITE;\n\n } else {\n\n access_flags = GENERIC_READ;\n\n }\n\n if (flags & BDRV_O_CREAT) {\n\n create_flags = CREATE_ALWAYS;\n\n } else {\n\n create_flags = OPEN_EXISTING;\n\n }\n\n#ifdef QEMU_TOOL\n\n overlapped = FILE_ATTRIBUTE_NORMAL;\n\n#else\n\n overlapped = FILE_FLAG_OVERLAPPED;\n\n#endif\n\n s->hfile = CreateFile(filename, access_flags, \n\n FILE_SHARE_READ, NULL,\n\n create_flags, overlapped, NULL);\n\n if (s->hfile == INVALID_HANDLE_VALUE) \n\n return -1;\n\n return 0;\n\n}\n"}} {"sample_id": "880a7578381d1c7ed4d41c7599ae3cc06567a824_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n int gdbserver_start(int port)\n \n+{\n+\n+ gdbserver_fd = gdbserver_open(port);\n+\n if (gdbserver_fd < 0)\n \n return -1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int gdbserver_start(int port)\n\n{\n\n gdbserver_fd = gdbserver_open(port);\n\n if (gdbserver_fd < 0)\n\n return -1;\n\n /* accept connections */\n\n gdb_accept (NULL);\n\n return 0;\n\n}\n"}} {"sample_id": "0931304788ecac6c7871f570c7ac8407b54e30c6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n int qemu_chr_fe_write_all(CharDriverState *s, const uint8_t *buf, int len)\n \n+{\n \n int offset = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int qemu_chr_fe_write_all(CharDriverState *s, const uint8_t *buf, int len)\n\n{\n\n int offset = 0;\n\n int res;\n\n\n\n qemu_mutex_lock(&s->chr_write_lock);\n\n while (offset < len) {\n\n do {\n\n res = s->chr_write(s, buf + offset, len - offset);\n\n if (res == -1 && errno == EAGAIN) {\n\n g_usleep(100);\n\n }\n\n } while (res == -1 && errno == EAGAIN);\n\n\n\n if (res <= 0) {\n\n break;\n\n }\n\n\n\n offset += res;\n\n }\n\n qemu_mutex_unlock(&s->chr_write_lock);\n\n\n\n if (res < 0) {\n\n return res;\n\n }\n\n return offset;\n\n}\n"}} {"sample_id": "e1833e1f96456fd8fc17463246fe0b2050e68efb_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static inline void gen_speundef (DisasContext *ctx)\n \n+{\n \n RET_INVAL(ctx);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_speundef (DisasContext *ctx)\n\n{\n\n RET_INVAL(ctx);\n\n}\n"}} {"sample_id": "67a0fd2a9bca204d2b39f910a97c7137636a0715_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n uint64_t offset = sector_num * BDRV_SECTOR_SIZE;\n \n+ unsigned long start = offset / object_size,\n+\n+ end = DIV_ROUND_UP((sector_num + nb_sectors) *\n+\n+ BDRV_SECTOR_SIZE, object_size);\n \n unsigned long idx;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "sd_co_get_block_status(BlockDriverState *bs, int64_t sector_num, int nb_sectors,\n\n int *pnum)\n\n{\n\n BDRVSheepdogState *s = bs->opaque;\n\n SheepdogInode *inode = &s->inode;\n\n uint32_t object_size = (UINT32_C(1) << inode->block_size_shift);\n\n uint64_t offset = sector_num * BDRV_SECTOR_SIZE;\n\n unsigned long start = offset / object_size,\n\n end = DIV_ROUND_UP((sector_num + nb_sectors) *\n\n BDRV_SECTOR_SIZE, object_size);\n\n unsigned long idx;\n\n int64_t ret = BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID | offset;\n\n\n\n for (idx = start; idx < end; idx++) {\n\n if (inode->data_vdi_id[idx] == 0) {\n\n break;\n\n }\n\n }\n\n if (idx == start) {\n\n /* Get the longest length of unallocated sectors */\n\n ret = 0;\n\n for (idx = start + 1; idx < end; idx++) {\n\n if (inode->data_vdi_id[idx] != 0) {\n\n break;\n\n }\n\n }\n\n }\n\n\n\n *pnum = (idx - start) * object_size / BDRV_SECTOR_SIZE;\n\n if (*pnum > nb_sectors) {\n\n *pnum = nb_sectors;\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_314", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n uint64_t val, unsigned size)\n \n+{\n+\n+ IVShmemState *s = opaque;\n+\n+\n \n uint16_t dest = val >> 16;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ivshmem_io_write(void *opaque, target_phys_addr_t addr,\n\n uint64_t val, unsigned size)\n\n{\n\n IVShmemState *s = opaque;\n\n\n\n uint16_t dest = val >> 16;\n\n uint16_t vector = val & 0xff;\n\n\n\n addr &= 0xfc;\n\n\n\n IVSHMEM_DPRINTF(\"writing to addr \" TARGET_FMT_plx \"\\n\", addr);\n\n switch (addr)\n\n {\n\n case INTRMASK:\n\n ivshmem_IntrMask_write(s, val);\n\n break;\n\n\n\n case INTRSTATUS:\n\n ivshmem_IntrStatus_write(s, val);\n\n break;\n\n\n\n case DOORBELL:\n\n /* check that dest VM ID is reasonable */\n\n if (dest > s->max_peer) {\n\n IVSHMEM_DPRINTF(\"Invalid destination VM ID (%d)\\n\", dest);\n\n break;\n\n }\n\n\n\n /* check doorbell range */\n\n if (vector < s->peers[dest].nb_eventfds) {\n\n IVSHMEM_DPRINTF(\"Notifying VM %d on vector %d\\n\", dest, vector);\n\n event_notifier_set(&s->peers[dest].eventfds[vector]);\n\n }\n\n break;\n\n default:\n\n IVSHMEM_DPRINTF(\"Invalid VM Doorbell VM %d\\n\", dest);\n\n }\n\n}\n"}} {"sample_id": "eabb7b91b36b202b4dac2df2d59d698e3aff197a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,9 +11,9 @@\n tcg_out_i(s, arg);\n \n } else {\n+\n+ tcg_out_r(s, arg);\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void tcg_out_ri(TCGContext *s, int const_arg, TCGArg arg)\n\n{\n\n if (const_arg) {\n\n assert(const_arg == 1);\n\n tcg_out8(s, TCG_CONST);\n\n tcg_out_i(s, arg);\n\n } else {\n\n tcg_out_r(s, arg);\n\n }\n\n}\n"}} {"sample_id": "ba7806ad92a2f6b1625cfa67d44dc1b71e3be44e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void add_user_command(char *optarg)\n+\n+{\n+\n+ ncmdline++;\n+\n cmdline = realloc(cmdline, ncmdline * sizeof(char *));\n \n if (!cmdline) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void add_user_command(char *optarg)\n\n{\n\n ncmdline++;\n\n cmdline = realloc(cmdline, ncmdline * sizeof(char *));\n\n if (!cmdline) {\n\n perror(\"realloc\");\n\n exit(1);\n\n }\n\n cmdline[ncmdline-1] = optarg;\n\n}\n"}} {"sample_id": "65cdadd2e2de76f7db3bf6b7d8dd8c67abff9659", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n Suite *s;\n \n TCase *qint_public_tcase;\n+\n+\n+\n+ s = suite_create(\"QInt test-suite\");\n+\n \n \n qint_public_tcase = tcase_create(\"Public Interface\");", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static Suite *qint_suite(void)\n\n{\n\n Suite *s;\n\n TCase *qint_public_tcase;\n\n\n\n s = suite_create(\"QInt test-suite\");\n\n\n\n qint_public_tcase = tcase_create(\"Public Interface\");\n\n suite_add_tcase(s, qint_public_tcase);\n\n tcase_add_test(qint_public_tcase, qint_from_int_test);\n\n tcase_add_test(qint_public_tcase, qint_destroy_test);\n\n tcase_add_test(qint_public_tcase, qint_from_int64_test);\n\n tcase_add_test(qint_public_tcase, qint_get_int_test);\n\n tcase_add_test(qint_public_tcase, qobject_to_qint_test);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_90", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n slirp_cleanup(s->slirp);\n \n+ slirp_smb_cleanup(s);\n+\n+ TAILQ_REMOVE(&slirp_stacks, s, entry);\n+\n qemu_free(s);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void net_slirp_cleanup(VLANClientState *vc)\n\n{\n\n SlirpState *s = vc->opaque;\n\n\n\n slirp_cleanup(s->slirp);\n\n slirp_smb_cleanup(s);\n\n TAILQ_REMOVE(&slirp_stacks, s, entry);\n\n qemu_free(s);\n\n}\n"}} {"sample_id": "8d5c773e323b22402abdd0beef4c7d2fc91dd0eb_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n \n \n+ if (env->cp15.contextidr_el1 != value && !arm_feature(env, ARM_FEATURE_MPU)\n+\n+ && !extended_addresses_enabled(env)) {\n+\n+ /* For VMSA (when not using the LPAE long descriptor page table\n \n * format) this register includes the ASID, so do a TLB flush.\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri,\n\n uint64_t value)\n\n{\n\n ARMCPU *cpu = arm_env_get_cpu(env);\n\n\n\n if (env->cp15.contextidr_el1 != value && !arm_feature(env, ARM_FEATURE_MPU)\n\n && !extended_addresses_enabled(env)) {\n\n /* For VMSA (when not using the LPAE long descriptor page table\n\n * format) this register includes the ASID, so do a TLB flush.\n\n * For PMSA it is purely a process ID and no action is needed.\n\n */\n\n tlb_flush(CPU(cpu), 1);\n\n }\n\n env->cp15.contextidr_el1 = value;\n\n}\n"}} {"sample_id": "b1b27b64262fdace45e5ab134c4438338076cb98", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static int nbd_co_writev_1(NbdClientSession *client, int64_t sector_num,\n+\n int nb_sectors, QEMUIOVector *qiov,\n \n+ int offset)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int nbd_co_writev_1(NbdClientSession *client, int64_t sector_num,\n\n int nb_sectors, QEMUIOVector *qiov,\n\n int offset)\n\n{\n\n struct nbd_request request;\n\n struct nbd_reply reply;\n\n ssize_t ret;\n\n\n\n request.type = NBD_CMD_WRITE;\n\n if (!bdrv_enable_write_cache(client->bs) &&\n\n (client->nbdflags & NBD_FLAG_SEND_FUA)) {\n\n request.type |= NBD_CMD_FLAG_FUA;\n\n }\n\n\n\n request.from = sector_num * 512;\n\n request.len = nb_sectors * 512;\n\n\n\n nbd_coroutine_start(client, &request);\n\n ret = nbd_co_send_request(client, &request, qiov, offset);\n\n if (ret < 0) {\n\n reply.error = -ret;\n\n } else {\n\n nbd_co_receive_reply(client, &request, &reply, NULL, 0);\n\n }\n\n nbd_coroutine_end(client, &request);\n\n return -reply.error;\n\n}\n"}} {"sample_id": "b544c1aba8681c2fe5d6715fbd37cf6caf1bc7bb_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void coroutine_fn resend_aioreq(BDRVSheepdogState *s, AIOReq *aio_req)\n \n+{\n \n SheepdogAIOCB *acb = aio_req->aiocb;\n \n@@ -13,15 +13,15 @@\n if (acb->aiocb_type == AIOCB_WRITE_UDATA && is_data_obj(aio_req->oid)) {\n \n int idx = data_oid_to_idx(aio_req->oid);\n+\n \n \n+ if (is_data_obj_writable(&s->inode, idx)) {\n \n goto out;\n \n }\n+\n \n \n if (check_simultaneous_create(s, aio_req)) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void coroutine_fn resend_aioreq(BDRVSheepdogState *s, AIOReq *aio_req)\n\n{\n\n SheepdogAIOCB *acb = aio_req->aiocb;\n\n bool create = false;\n\n\n\n /* check whether this request becomes a CoW one */\n\n if (acb->aiocb_type == AIOCB_WRITE_UDATA && is_data_obj(aio_req->oid)) {\n\n int idx = data_oid_to_idx(aio_req->oid);\n\n\n\n if (is_data_obj_writable(&s->inode, idx)) {\n\n goto out;\n\n }\n\n\n\n if (check_simultaneous_create(s, aio_req)) {\n\n return;\n\n }\n\n\n\n if (s->inode.data_vdi_id[idx]) {\n\n aio_req->base_oid = vid_to_data_oid(s->inode.data_vdi_id[idx], idx);\n\n aio_req->flags |= SD_FLAG_CMD_COW;\n\n }\n\n create = true;\n\n }\n\nout:\n\n if (is_data_obj(aio_req->oid)) {\n\n add_aio_request(s, aio_req, acb->qiov->iov, acb->qiov->niov, create,\n\n acb->aiocb_type);\n\n } else {\n\n struct iovec iov;\n\n iov.iov_base = &s->inode;\n\n iov.iov_len = sizeof(s->inode);\n\n add_aio_request(s, aio_req, &iov, 1, false, AIOCB_WRITE_UDATA);\n\n }\n\n}\n"}} {"sample_id": "99683a307776a7638ccce236a4ce5aa3e914e77d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+void put_string(PutBitContext * pbc, char *s)\n \n {\n \n while(*s){\n+\n put_bits(pbc, 8, *s);\n \n s++;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void put_string(PutBitContext * pbc, char *s)\n\n{\n\n while(*s){\n\n put_bits(pbc, 8, *s);\n\n s++;\n\n }\n\n put_bits(pbc, 8, 0);\n\n}\n"}} {"sample_id": "fa0f62c37d90c0760bddccba2054578e2c61ae1a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,11 +34,11 @@\n \n stream->buffer_ptr += len;\n \n+ buf += len;\n+\n+ size -= len;\n+\n+ while (stream->buffer_ptr >= s->packet_data_max_size) {\n \n /* output the packet */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mpeg_mux_write_packet(AVFormatContext *ctx, int stream_index,\n\n const uint8_t *buf, int size, int64_t pts)\n\n{\n\n MpegMuxContext *s = ctx->priv_data;\n\n AVStream *st = ctx->streams[stream_index];\n\n StreamInfo *stream = st->priv_data;\n\n int len;\n\n \n\n while (size > 0) {\n\n /* set pts */\n\n if (stream->start_pts == -1) {\n\n stream->start_pts = pts;\n\n }\n\n len = s->packet_data_max_size - stream->buffer_ptr;\n\n if (len > size)\n\n len = size;\n\n memcpy(stream->buffer + stream->buffer_ptr, buf, len);\n\n stream->buffer_ptr += len;\n\n buf += len;\n\n size -= len;\n\n while (stream->buffer_ptr >= s->packet_data_max_size) {\n\n /* output the packet */\n\n if (stream->start_pts == -1)\n\n stream->start_pts = pts;\n\n flush_packet(ctx, stream_index, 0);\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_35", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n struct device_config *conf;\n+\n+ int rc;\n+\n+\n+\n TAILQ_FOREACH(conf, &device_configs, next) {\n \n if (conf->type != type)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int foreach_device_config(int type, int (*func)(const char *cmdline))\n\n{\n\n struct device_config *conf;\n\n int rc;\n\n\n\n TAILQ_FOREACH(conf, &device_configs, next) {\n\n if (conf->type != type)\n\n continue;\n\n rc = func(conf->cmdline);\n\n if (0 != rc)\n\n return rc;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "c2e50e3d11a0bf4c973cc30478c1af0f2d5f8e81_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n \n \n QLIST_INIT(&pool->head);\n+\n+ QTAILQ_INIT(&pool->request_list);\n+\n+\n+\n aio_set_event_notifier(ctx, &pool->notifier, event_notifier_ready);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void thread_pool_init_one(ThreadPool *pool, AioContext *ctx)\n\n{\n\n if (!ctx) {\n\n ctx = qemu_get_aio_context();\n\n }\n\n\n\n memset(pool, 0, sizeof(*pool));\n\n event_notifier_init(&pool->notifier, false);\n\n pool->ctx = ctx;\n\n qemu_mutex_init(&pool->lock);\n\n qemu_cond_init(&pool->check_cancel);\n\n qemu_cond_init(&pool->worker_stopped);\n\n qemu_sem_init(&pool->sem, 0);\n\n pool->max_threads = 64;\n\n pool->new_thread_bh = aio_bh_new(ctx, spawn_thread_bh_fn, pool);\n\n\n\n QLIST_INIT(&pool->head);\n\n QTAILQ_INIT(&pool->request_list);\n\n\n\n aio_set_event_notifier(ctx, &pool->notifier, event_notifier_ready);\n\n}\n"}} {"sample_id": "40f8f0c31b6009e802175463c97f3b9e6f7c5d0f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void pcie_aer_msg(PCIDevice *dev, const PCIEAERMsg *msg)\n+\n+{\n+\n+ uint8_t type;\n+\n \n \n while (dev) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pcie_aer_msg(PCIDevice *dev, const PCIEAERMsg *msg)\n\n{\n\n uint8_t type;\n\n\n\n while (dev) {\n\n if (!pci_is_express(dev)) {\n\n /* just ignore it */\n\n /* TODO: Shouldn't we set PCI_STATUS_SIG_SYSTEM_ERROR?\n\n * Consider e.g. a PCI bridge above a PCI Express device. */\n\n return;\n\n }\n\n\n\n type = pcie_cap_get_type(dev);\n\n if ((type == PCI_EXP_TYPE_ROOT_PORT ||\n\n type == PCI_EXP_TYPE_UPSTREAM ||\n\n type == PCI_EXP_TYPE_DOWNSTREAM) &&\n\n !pcie_aer_msg_vbridge(dev, msg)) {\n\n return;\n\n }\n\n if (!pcie_aer_msg_alldev(dev, msg)) {\n\n return;\n\n }\n\n if (type == PCI_EXP_TYPE_ROOT_PORT) {\n\n pcie_aer_msg_root_port(dev, msg);\n\n /* Root port can notify system itself,\n\n or send the error message to root complex event collector. */\n\n /*\n\n * if root port is associated with an event collector,\n\n * return the root complex event collector here.\n\n * For now root complex event collector isn't supported.\n\n */\n\n return;\n\n }\n\n dev = pci_bridge_get_device(dev->bus);\n\n }\n\n}\n"}} {"sample_id": "67a0fd2a9bca204d2b39f910a97c7137636a0715_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,9 +15,9 @@\n } else if (*n < 0) {\n \n return 0;\n+\n+ }\n+\n+ return BDRV_BLOCK_DATA;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int64_t coroutine_fn vvfat_co_get_block_status(BlockDriverState *bs,\n\n\tint64_t sector_num, int nb_sectors, int* n)\n\n{\n\n BDRVVVFATState* s = bs->opaque;\n\n *n = s->sector_count - sector_num;\n\n if (*n > nb_sectors) {\n\n *n = nb_sectors;\n\n } else if (*n < 0) {\n\n return 0;\n\n }\n\n return BDRV_BLOCK_DATA;\n\n}\n"}} {"sample_id": "494a8ebe713055d3946183f4b395f85a18b43e9e_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n const char *socket = qemu_opt_get(opts, \"socket\");\n \n+ const char *sock_fd = qemu_opt_get(opts, \"sock_fd\");\n+\n+\n+\n+ if (!socket && !sock_fd) {\n \n fprintf(stderr, \"socket and sock_fd none of the option specified\\n\");\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int proxy_parse_opts(QemuOpts *opts, struct FsDriverEntry *fs)\n\n{\n\n const char *socket = qemu_opt_get(opts, \"socket\");\n\n const char *sock_fd = qemu_opt_get(opts, \"sock_fd\");\n\n\n\n if (!socket && !sock_fd) {\n\n fprintf(stderr, \"socket and sock_fd none of the option specified\\n\");\n\n return -1;\n\n }\n\n if (socket && sock_fd) {\n\n fprintf(stderr, \"Both socket and sock_fd options specified\\n\");\n\n return -1;\n\n }\n\n if (socket) {\n\n fs->path = g_strdup(socket);\n\n fs->export_flags = V9FS_PROXY_SOCK_NAME;\n\n } else {\n\n fs->path = g_strdup(sock_fd);\n\n fs->export_flags = V9FS_PROXY_SOCK_FD;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "a89f364ae8740dfc31b321eed9ee454e996dc3c1_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n {\n \n+ if (chipselect < 0 || chipselect > 3) {\n+\n+ fprintf(stderr, \"%s: Bad chipselect %i\\n\", __FUNCTION__, chipselect);\n+\n exit(-1);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void omap_uwire_attach(struct omap_uwire_s *s,\n\n uWireSlave *slave, int chipselect)\n\n{\n\n if (chipselect < 0 || chipselect > 3) {\n\n fprintf(stderr, \"%s: Bad chipselect %i\\n\", __FUNCTION__, chipselect);\n\n exit(-1);\n\n }\n\n\n\n s->chip[chipselect] = slave;\n\n}\n"}} {"sample_id": "e3f5ec2b5e92706e3b807059f79b1fb5d936e567_19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n memset(msg, 0, sizeof(struct rndis_packet_msg_type));\n \n+ msg->MessageType = cpu_to_le32(RNDIS_PACKET_MSG);\n+\n+ msg->MessageLength = cpu_to_le32(size + sizeof(struct rndis_packet_msg_type));\n+\n+ msg->DataOffset = cpu_to_le32(sizeof(struct rndis_packet_msg_type) - 8);\n \n msg->DataLength = cpu_to_le32(size);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void usbnet_receive(void *opaque, const uint8_t *buf, size_t size)\n\n{\n\n USBNetState *s = opaque;\n\n struct rndis_packet_msg_type *msg;\n\n\n\n if (s->rndis) {\n\n msg = (struct rndis_packet_msg_type *) s->in_buf;\n\n if (!s->rndis_state == RNDIS_DATA_INITIALIZED)\n\n return;\n\n if (size + sizeof(struct rndis_packet_msg_type) > sizeof(s->in_buf))\n\n return;\n\n\n\n memset(msg, 0, sizeof(struct rndis_packet_msg_type));\n\n msg->MessageType = cpu_to_le32(RNDIS_PACKET_MSG);\n\n msg->MessageLength = cpu_to_le32(size + sizeof(struct rndis_packet_msg_type));\n\n msg->DataOffset = cpu_to_le32(sizeof(struct rndis_packet_msg_type) - 8);\n\n msg->DataLength = cpu_to_le32(size);\n\n /* msg->OOBDataOffset;\n\n * msg->OOBDataLength;\n\n * msg->NumOOBDataElements;\n\n * msg->PerPacketInfoOffset;\n\n * msg->PerPacketInfoLength;\n\n * msg->VcHandle;\n\n * msg->Reserved;\n\n */\n\n memcpy(msg + 1, buf, size);\n\n s->in_len = size + sizeof(struct rndis_packet_msg_type);\n\n } else {\n\n if (size > sizeof(s->in_buf))\n\n return;\n\n memcpy(s->in_buf, buf, size);\n\n s->in_len = size;\n\n }\n\n s->in_ptr = 0;\n\n}\n"}} {"sample_id": "b45c03f585ea9bb1af76c73e82195418c294919d_22", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static struct omap_eac_s *omap_eac_init(struct omap_target_agent_s *ta,\n+\n qemu_irq irq, qemu_irq *drq, omap_clk fclk, omap_clk iclk)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static struct omap_eac_s *omap_eac_init(struct omap_target_agent_s *ta,\n\n qemu_irq irq, qemu_irq *drq, omap_clk fclk, omap_clk iclk)\n\n{\n\n struct omap_eac_s *s = (struct omap_eac_s *)\n\n g_malloc0(sizeof(struct omap_eac_s));\n\n\n\n s->irq = irq;\n\n s->codec.rxdrq = *drq ++;\n\n s->codec.txdrq = *drq;\n\n omap_eac_reset(s);\n\n\n\n AUD_register_card(\"OMAP EAC\", &s->codec.card);\n\n\n\n memory_region_init_io(&s->iomem, NULL, &omap_eac_ops, s, \"omap.eac\",\n\n omap_l4_region_size(ta, 0));\n\n omap_l4_attach(ta, 0, &s->iomem);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "fb1a3a051d89975f26296163066bb0745ecca49d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ int64_t now, last;\n+\n+ QEMUClock *clock = qemu_clock_ptr(type);\n+\n+\n \n switch (type) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int64_t qemu_clock_get_ns(QEMUClockType type)\n\n{\n\n int64_t now, last;\n\n QEMUClock *clock = qemu_clock_ptr(type);\n\n\n\n switch (type) {\n\n case QEMU_CLOCK_REALTIME:\n\n return get_clock();\n\n default:\n\n case QEMU_CLOCK_VIRTUAL:\n\n if (use_icount) {\n\n return cpu_get_icount();\n\n } else {\n\n return cpu_get_clock();\n\n }\n\n case QEMU_CLOCK_HOST:\n\n now = get_clock_realtime();\n\n last = clock->last;\n\n clock->last = now;\n\n if (now < last) {\n\n notifier_list_notify(&clock->reset_notifiers, &now);\n\n }\n\n return now;\n\n case QEMU_CLOCK_VIRTUAL_RT:\n\n return cpu_get_clock();\n\n }\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_56", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n tcg_gen_andi_i64(tmp, cpu_ir[rb], 7);\n \n+ tcg_gen_shli_i64(tmp, tmp, 3);\n+\n+ tcg_gen_shr_i64(cpu_ir[rc], cpu_ir[ra], tmp);\n+\n+ tcg_temp_free(tmp);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static always_inline void gen_ext_l(void (*tcg_gen_ext_i64)(TCGv t0, TCGv t1),\n\n int ra, int rb, int rc,\n\n int islit, uint8_t lit)\n\n{\n\n if (unlikely(rc == 31))\n\n return;\n\n\n\n if (ra != 31) {\n\n if (islit) {\n\n tcg_gen_shri_i64(cpu_ir[rc], cpu_ir[ra], (lit & 7) * 8);\n\n } else {\n\n TCGv tmp = tcg_temp_new(TCG_TYPE_I64);\n\n tcg_gen_andi_i64(tmp, cpu_ir[rb], 7);\n\n tcg_gen_shli_i64(tmp, tmp, 3);\n\n tcg_gen_shr_i64(cpu_ir[rc], cpu_ir[ra], tmp);\n\n tcg_temp_free(tmp);\n\n }\n\n if (tcg_gen_ext_i64)\n\n tcg_gen_ext_i64(cpu_ir[rc], cpu_ir[rc]);\n\n } else\n\n tcg_gen_movi_i64(cpu_ir[rc], 0);\n\n}\n"}} {"sample_id": "870111c8ed95df62a101eae0acd08c84233a6341_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void ide_init1(IDEBus *bus, int unit, DriveInfo *dinfo)\n+\n+{\n+\n+ static int drive_serial = 1;\n+\n IDEState *s = &bus->ifs[unit];\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ide_init1(IDEBus *bus, int unit, DriveInfo *dinfo)\n\n{\n\n static int drive_serial = 1;\n\n IDEState *s = &bus->ifs[unit];\n\n\n\n s->bus = bus;\n\n s->unit = unit;\n\n s->drive_serial = drive_serial++;\n\n s->io_buffer = qemu_blockalign(s->bs, IDE_DMA_BUF_SECTORS*512 + 4);\n\n s->io_buffer_total_len = IDE_DMA_BUF_SECTORS*512 + 4;\n\n s->smart_selftest_data = qemu_blockalign(s->bs, 512);\n\n s->sector_write_timer = qemu_new_timer(vm_clock,\n\n ide_sector_write_timer_cb, s);\n\n ide_init_drive(s, dinfo, NULL);\n\n}\n"}} {"sample_id": "12fd28535891572be7aaf862a03019257dafa425", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int spapr_tce_table_realize(DeviceState *dev)\n \n+{\n+\n sPAPRTCETable *tcet = SPAPR_TCE_TABLE(dev);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int spapr_tce_table_realize(DeviceState *dev)\n\n{\n\n sPAPRTCETable *tcet = SPAPR_TCE_TABLE(dev);\n\n\n\n if (kvm_enabled()) {\n\n tcet->table = kvmppc_create_spapr_tce(tcet->liobn,\n\n tcet->nb_table <<\n\n tcet->page_shift,\n\n &tcet->fd,\n\n tcet->vfio_accel);\n\n }\n\n\n\n if (!tcet->table) {\n\n size_t table_size = tcet->nb_table * sizeof(uint64_t);\n\n tcet->table = g_malloc0(table_size);\n\n }\n\n\n\n trace_spapr_iommu_new_table(tcet->liobn, tcet, tcet->table, tcet->fd);\n\n\n\n memory_region_init_iommu(&tcet->iommu, OBJECT(dev), &spapr_iommu_ops,\n\n \"iommu-spapr\",\n\n (uint64_t)tcet->nb_table << tcet->page_shift);\n\n\n\n QLIST_INSERT_HEAD(&spapr_tce_tables, tcet, list);\n\n\n\n vmstate_register(DEVICE(tcet), tcet->liobn, &vmstate_spapr_tce_table,\n\n tcet);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "f7c40aa1e7feb50bc4d4bc171fa811bdd9a93e51", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void s390_pci_iommu_enable(S390PCIBusDevice *pbdev)\n+\n+{\n+\n uint64_t size = pbdev->pal - pbdev->pba + 1;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void s390_pci_iommu_enable(S390PCIBusDevice *pbdev)\n\n{\n\n uint64_t size = pbdev->pal - pbdev->pba + 1;\n\n\n\n memory_region_init_iommu(&pbdev->iommu_mr, OBJECT(&pbdev->mr),\n\n &s390_iommu_ops, \"iommu-s390\", size);\n\n memory_region_add_subregion(&pbdev->mr, pbdev->pba, &pbdev->iommu_mr);\n\n pbdev->iommu_enabled = true;\n\n}\n"}} {"sample_id": "2ec4a84dca603a24a8131297036dfe30eed33dd7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int get_video_frame(VideoState *is, AVFrame *frame)\n \n+{\n \n int got_picture;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int get_video_frame(VideoState *is, AVFrame *frame)\n\n{\n\n int got_picture;\n\n\n\n if ((got_picture = decoder_decode_frame(&is->viddec, frame)) < 0)\n\n return -1;\n\n\n\n if (got_picture) {\n\n double dpts = NAN;\n\n\n\n if (frame->pts != AV_NOPTS_VALUE)\n\n dpts = av_q2d(is->video_st->time_base) * frame->pts;\n\n\n\n frame->sample_aspect_ratio = av_guess_sample_aspect_ratio(is->ic, is->video_st, frame);\n\n\n\n if (framedrop>0 || (framedrop && get_master_sync_type(is) != AV_SYNC_VIDEO_MASTER)) {\n\n if (frame->pts != AV_NOPTS_VALUE) {\n\n double diff = dpts - get_master_clock(is);\n\n if (!isnan(diff) && fabs(diff) < AV_NOSYNC_THRESHOLD &&\n\n diff - is->frame_last_filter_delay < 0 &&\n\n is->viddec.pkt_serial == is->vidclk.serial &&\n\n is->videoq.nb_packets) {\n\n is->frame_drops_early++;\n\n av_frame_unref(frame);\n\n got_picture = 0;\n\n }\n\n }\n\n }\n\n }\n\n\n\n return got_picture;\n\n}\n"}} {"sample_id": "2a74440547ea0a15195224fa2b7784b267cbfe15_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n if (!fmt) {\n \n+ qerror_abort(qerr, \"QDict not specified\");\n+\n+ }\n+\n+\n \n qerror_set_data(qerr, fmt, va);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "QError *qerror_from_info(const char *file, int linenr, const char *func,\n\n const char *fmt, va_list *va)\n\n{\n\n QError *qerr;\n\n\n\n qerr = qerror_new();\n\n loc_save(&qerr->loc);\n\n qerr->linenr = linenr;\n\n qerr->file = file;\n\n qerr->func = func;\n\n\n\n if (!fmt) {\n\n qerror_abort(qerr, \"QDict not specified\");\n\n }\n\n\n\n qerror_set_data(qerr, fmt, va);\n\n qerror_set_desc(qerr, fmt);\n\n\n\n return qerr;\n\n}\n"}} {"sample_id": "bae8196d9f97916de6323e70e3e374362ee16ec4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,9 +29,9 @@\n aio_poll(block_job_get_aio_context(job), true);\n \n }\n+\n+\n+\n+ block_job_unref(job);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void block_job_detach_aio_context(void *opaque)\n\n{\n\n BlockJob *job = opaque;\n\n\n\n /* In case the job terminates during aio_poll()... */\n\n block_job_ref(job);\n\n\n\n block_job_pause(job);\n\n\n\n if (!job->paused) {\n\n /* If job is !job->busy this kicks it into the next pause point. */\n\n block_job_enter(job);\n\n }\n\n while (!job->paused && !job->completed) {\n\n aio_poll(block_job_get_aio_context(job), true);\n\n }\n\n\n\n block_job_unref(job);\n\n}\n"}} {"sample_id": "a5b8dd2ce83208cd7d6eb4562339ecf5aae13574", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void vvfat_refresh_limits(BlockDriverState *bs, Error **errp)\n \n+{\n \n bs->request_alignment = BDRV_SECTOR_SIZE; /* No sub-sector I/O supported */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vvfat_refresh_limits(BlockDriverState *bs, Error **errp)\n\n{\n\n bs->request_alignment = BDRV_SECTOR_SIZE; /* No sub-sector I/O supported */\n\n}\n"}} {"sample_id": "6e0d8677cb443e7408c0b7a25a93c6596d7fa380_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void OPPROTO op_addq_ESI_T0(void)\n \n {\n+\n ESI = (ESI + T0);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void OPPROTO op_addq_ESI_T0(void)\n\n{\n\n ESI = (ESI + T0);\n\n}\n"}} {"sample_id": "f55df62998681c7702f008ce7c12a00b15e33f53", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,14 +12,14 @@\n \n band->zero_mem[k] = ((band->zero_mem[k] * 255) >> 8) + \\\n \n+ d*((band->diff_mem[k]^cur_diff) < 0 ? -128 : 128); \\\n \n band->diff_mem[k] = tmp; \\\n \n s_zero += (tmp * band->zero_mem[k]) >> 15; \\\n \n } while (0)\n+\n if (cur_diff) {\n \n ACCUM(5, band->diff_mem[4], 1);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void s_zero(int cur_diff, struct G722Band *band)\n\n{\n\n int s_zero = 0;\n\n\n\n #define ACCUM(k, x, d) do { \\\n\n int tmp = x; \\\n\n band->zero_mem[k] = ((band->zero_mem[k] * 255) >> 8) + \\\n\n d*((band->diff_mem[k]^cur_diff) < 0 ? -128 : 128); \\\n\n band->diff_mem[k] = tmp; \\\n\n s_zero += (tmp * band->zero_mem[k]) >> 15; \\\n\n } while (0)\n\n if (cur_diff) {\n\n ACCUM(5, band->diff_mem[4], 1);\n\n ACCUM(4, band->diff_mem[3], 1);\n\n ACCUM(3, band->diff_mem[2], 1);\n\n ACCUM(2, band->diff_mem[1], 1);\n\n ACCUM(1, band->diff_mem[0], 1);\n\n ACCUM(0, cur_diff << 1, 1);\n\n } else {\n\n ACCUM(5, band->diff_mem[4], 0);\n\n ACCUM(4, band->diff_mem[3], 0);\n\n ACCUM(3, band->diff_mem[2], 0);\n\n ACCUM(2, band->diff_mem[1], 0);\n\n ACCUM(1, band->diff_mem[0], 0);\n\n ACCUM(0, cur_diff << 1, 0);\n\n }\n\n #undef ACCUM\n\n band->s_zero = s_zero;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_129", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,8 +12,8 @@\n \n sub++;\n \n+ }\n+\n+ return NULL;\n+\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": " vmstate_get_subsection(const VMStateSubsection *sub, char *idstr)\n\n{\n\n while (sub && sub->needed) {\n\n if (strcmp(idstr, sub->vmsd->name) == 0) {\n\n return sub->vmsd;\n\n }\n\n sub++;\n\n }\n\n return NULL;\n\n}\n"}} {"sample_id": "88be7b4be4aa17c88247e162bdd7577ea79db94f_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n int bdrv_all_delete_snapshot(const char *name, BlockDriverState **first_bad_bs,\n \n+ Error **err)\n+\n {\n+\n int ret = 0;\n \n BlockDriverState *bs;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int bdrv_all_delete_snapshot(const char *name, BlockDriverState **first_bad_bs,\n\n Error **err)\n\n{\n\n int ret = 0;\n\n BlockDriverState *bs;\n\n BdrvNextIterator *it = NULL;\n\n QEMUSnapshotInfo sn1, *snapshot = &sn1;\n\n\n\n while (ret == 0 && (it = bdrv_next(it, &bs))) {\n\n AioContext *ctx = bdrv_get_aio_context(bs);\n\n\n\n aio_context_acquire(ctx);\n\n if (bdrv_can_snapshot(bs) &&\n\n bdrv_snapshot_find(bs, snapshot, name) >= 0) {\n\n ret = bdrv_snapshot_delete_by_id_or_name(bs, name, err);\n\n }\n\n aio_context_release(ctx);\n\n }\n\n\n\n *first_bad_bs = bs;\n\n return ret;\n\n}\n"}} {"sample_id": "4f2d3d705c1ae7dce29254e2c4645c84e77a74d4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,9 +11,9 @@\n } else {\n \n char *dst = qdev_get_prop_ptr(dev, props);\n+\n+ memcpy(dst, src, props->info->size);\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qdev_prop_cpy(DeviceState *dev, Property *props, void *src)\n\n{\n\n if (props->info->type == PROP_TYPE_BIT) {\n\n bool *defval = src;\n\n bit_prop_set(dev, props, *defval);\n\n } else {\n\n char *dst = qdev_get_prop_ptr(dev, props);\n\n memcpy(dst, src, props->info->size);\n\n }\n\n}\n"}} {"sample_id": "7c36ee216f1e668e2c2af1573bd9dbbb2a501f48", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void sbr_qmf_deint_bfly_c(INTFLOAT *v, const INTFLOAT *src0, const INTFLOAT *src1)\n \n {\n+\n+ int i;\n \n for (i = 0; i < 64; i++) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void sbr_qmf_deint_bfly_c(INTFLOAT *v, const INTFLOAT *src0, const INTFLOAT *src1)\n\n{\n\n int i;\n\n for (i = 0; i < 64; i++) {\n\n v[ i] = AAC_SRA_R((src0[i] - src1[63 - i]), 5);\n\n v[127 - i] = AAC_SRA_R((src0[i] + src1[63 - i]), 5);\n\n }\n\n}\n"}} {"sample_id": "b45c03f585ea9bb1af76c73e82195418c294919d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static struct omap_mpu_timer_s *omap_mpu_timer_init(MemoryRegion *system_memory,\n+\n hwaddr base,\n \n qemu_irq irq, omap_clk clk)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static struct omap_mpu_timer_s *omap_mpu_timer_init(MemoryRegion *system_memory,\n\n hwaddr base,\n\n qemu_irq irq, omap_clk clk)\n\n{\n\n struct omap_mpu_timer_s *s = (struct omap_mpu_timer_s *)\n\n g_malloc0(sizeof(struct omap_mpu_timer_s));\n\n\n\n s->irq = irq;\n\n s->clk = clk;\n\n s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, omap_timer_tick, s);\n\n s->tick = qemu_bh_new(omap_timer_fire, s);\n\n omap_mpu_timer_reset(s);\n\n omap_timer_clk_setup(s);\n\n\n\n memory_region_init_io(&s->iomem, NULL, &omap_mpu_timer_ops, s,\n\n \"omap-mpu-timer\", 0x100);\n\n\n\n memory_region_add_subregion(system_memory, base, &s->iomem);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "32bafa8fdd098d52fbf1102d5a5e48d29398c0aa_28", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n case 270:\n \n if (move->axis == INPUT_AXIS_X) {\n+\n+ move->axis = INPUT_AXIS_Y;\n+\n+ move->value = INPUT_EVENT_ABS_SIZE - 1 - move->value;\n+\n } else if (move->axis == INPUT_AXIS_Y) {\n \n move->axis = INPUT_AXIS_X;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_input_transform_abs_rotate(InputEvent *evt)\n\n{\n\n InputMoveEvent *move = evt->u.abs;\n\n switch (graphic_rotate) {\n\n case 90:\n\n if (move->axis == INPUT_AXIS_X) {\n\n move->axis = INPUT_AXIS_Y;\n\n } else if (move->axis == INPUT_AXIS_Y) {\n\n move->axis = INPUT_AXIS_X;\n\n move->value = INPUT_EVENT_ABS_SIZE - 1 - move->value;\n\n }\n\n break;\n\n case 180:\n\n move->value = INPUT_EVENT_ABS_SIZE - 1 - move->value;\n\n break;\n\n case 270:\n\n if (move->axis == INPUT_AXIS_X) {\n\n move->axis = INPUT_AXIS_Y;\n\n move->value = INPUT_EVENT_ABS_SIZE - 1 - move->value;\n\n } else if (move->axis == INPUT_AXIS_Y) {\n\n move->axis = INPUT_AXIS_X;\n\n }\n\n break;\n\n }\n\n}\n"}} {"sample_id": "bb5fc20f7c1c65e95030da3629dd0d7a0cce38cd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void monitor_readline_cb(void *opaque, const char *input)\n \n+{\n+\n pstrcpy(monitor_readline_buf, monitor_readline_buf_size, input);\n \n monitor_readline_started = 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void monitor_readline_cb(void *opaque, const char *input)\n\n{\n\n pstrcpy(monitor_readline_buf, monitor_readline_buf_size, input);\n\n monitor_readline_started = 0;\n\n}\n"}} {"sample_id": "90a09b69d7f5d4fc5622c6aec69d5ceef1a72c04", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n int end = fc->list[fc->list[FFMIN(i+1, fc->values - 1)].sort].x;\n \n int j;\n+\n float average = 0;\n \n begin = (position + begin) / 2;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void floor_fit(venc_context_t * venc, floor_t * fc, float * coeffs, int * posts, int samples) {\n\n int range = 255 / fc->multiplier + 1;\n\n int i;\n\n for (i = 0; i < fc->values; i++) {\n\n int position = fc->list[fc->list[i].sort].x;\n\n int begin = fc->list[fc->list[FFMAX(i-1, 0)].sort].x;\n\n int end = fc->list[fc->list[FFMIN(i+1, fc->values - 1)].sort].x;\n\n int j;\n\n float average = 0;\n\n begin = (position + begin) / 2;\n\n end = (position + end ) / 2;\n\n\n\n assert(end <= samples);\n\n for (j = begin; j < end; j++) average += fabs(coeffs[j]);\n\n average /= end - begin;\n\n average /= 32; // MAGIC!\n\n for (j = 0; j < range; j++) if (floor1_inverse_db_table[j * fc->multiplier] > average) break;\n\n posts[fc->list[i].sort] = j;\n\n }\n\n}\n"}} {"sample_id": "53cb28cbfea038f8ad50132dc8a684e638c7d48b_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n return address_space_memory.dispatch->sections[index & ~TARGET_PAGE_MASK].mr;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "MemoryRegion *iotlb_to_region(hwaddr index)\n\n{\n\n return address_space_memory.dispatch->sections[index & ~TARGET_PAGE_MASK].mr;\n\n}\n"}} {"sample_id": "cb65b32c97b06fc611b53c1ab77a2edbaadee84f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -37,11 +37,11 @@\n \n \n if (base + 4 <= pkt->size) {\n+\n+ uint32_t v = AV_RB32(pkt->data + base);\n+\n+\n+\n if (MKBETAG('X','i','n','g') == v || MKBETAG('I','n','f','o') == v)\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mp3_write_audio_packet(AVFormatContext *s, AVPacket *pkt)\n\n{\n\n MP3Context *mp3 = s->priv_data;\n\n\n\n if (pkt && pkt->data && pkt->size >= 4) {\n\n MPADecodeHeader c;\n\n int av_unused base;\n\n\n\n avpriv_mpegaudio_decode_header(&c, AV_RB32(pkt->data));\n\n\n\n if (!mp3->initial_bitrate)\n\n mp3->initial_bitrate = c.bit_rate;\n\n if ((c.bit_rate == 0) || (mp3->initial_bitrate != c.bit_rate))\n\n mp3->has_variable_bitrate = 1;\n\n\n\n#ifdef FILTER_VBR_HEADERS\n\n /* filter out XING and INFO headers. */\n\n base = 4 + xing_offtbl[c.lsf == 1][c.nb_channels == 1];\n\n\n\n if (base + 4 <= pkt->size) {\n\n uint32_t v = AV_RB32(pkt->data + base);\n\n\n\n if (MKBETAG('X','i','n','g') == v || MKBETAG('I','n','f','o') == v)\n\n return 0;\n\n }\n\n\n\n /* filter out VBRI headers. */\n\n base = 4 + 32;\n\n\n\n if (base + 4 <= pkt->size && MKBETAG('V','B','R','I') == AV_RB32(pkt->data + base))\n\n return 0;\n\n#endif\n\n\n\n if (mp3->xing_offset)\n\n mp3_xing_add_frame(mp3, pkt);\n\n }\n\n\n\n return ff_raw_write_packet(s, pkt);\n\n}\n"}} {"sample_id": "25ba3a681213390e9212dbc987d61843c3b41d5b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n target_ulong do_load_msr (CPUPPCState *env)\n+\n {\n \n return", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "target_ulong do_load_msr (CPUPPCState *env)\n\n{\n\n return\n\n#if defined (TARGET_PPC64)\n\n ((target_ulong)msr_sf << MSR_SF) |\n\n ((target_ulong)msr_isf << MSR_ISF) |\n\n ((target_ulong)msr_hv << MSR_HV) |\n\n#endif\n\n ((target_ulong)msr_ucle << MSR_UCLE) |\n\n ((target_ulong)msr_vr << MSR_VR) | /* VR / SPE */\n\n ((target_ulong)msr_ap << MSR_AP) |\n\n ((target_ulong)msr_sa << MSR_SA) |\n\n ((target_ulong)msr_key << MSR_KEY) |\n\n ((target_ulong)msr_pow << MSR_POW) | /* POW / WE */\n\n ((target_ulong)msr_tgpr << MSR_TGPR) | /* TGPR / CE */\n\n ((target_ulong)msr_ile << MSR_ILE) |\n\n ((target_ulong)msr_ee << MSR_EE) |\n\n ((target_ulong)msr_pr << MSR_PR) |\n\n ((target_ulong)msr_fp << MSR_FP) |\n\n ((target_ulong)msr_me << MSR_ME) |\n\n ((target_ulong)msr_fe0 << MSR_FE0) |\n\n ((target_ulong)msr_se << MSR_SE) | /* SE / DWE / UBLE */\n\n ((target_ulong)msr_be << MSR_BE) | /* BE / DE */\n\n ((target_ulong)msr_fe1 << MSR_FE1) |\n\n ((target_ulong)msr_al << MSR_AL) |\n\n ((target_ulong)msr_ip << MSR_IP) |\n\n ((target_ulong)msr_ir << MSR_IR) | /* IR / IS */\n\n ((target_ulong)msr_dr << MSR_DR) | /* DR / DS */\n\n ((target_ulong)msr_pe << MSR_PE) | /* PE / EP */\n\n ((target_ulong)msr_px << MSR_PX) | /* PX / PMM */\n\n ((target_ulong)msr_ri << MSR_RI) |\n\n ((target_ulong)msr_le << MSR_LE);\n\n}\n"}} {"sample_id": "4fc9af53d88c0a2a810704a06cb39a7182982e4e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n {\n \n bs->boot_sector_enabled = 1;\n+\n+ if (size > 512)\n+\n size = 512;\n \n memcpy(bs->boot_sector_data, data, size);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bdrv_set_boot_sector(BlockDriverState *bs, const uint8_t *data, int size)\n\n{\n\n bs->boot_sector_enabled = 1;\n\n if (size > 512)\n\n size = 512;\n\n memcpy(bs->boot_sector_data, data, size);\n\n memset(bs->boot_sector_data + size, 0, 512 - size);\n\n}\n"}} {"sample_id": "e0cb42ae4bc4438ba4ec0760df2d830b8759b255_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void common_unbind(struct common *c)\n \n {\n+\n xen_be_unbind_evtchn(&c->xendev);\n \n if (c->page) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void common_unbind(struct common *c)\n\n{\n\n xen_be_unbind_evtchn(&c->xendev);\n\n if (c->page) {\n\n\tmunmap(c->page, XC_PAGE_SIZE);\n\n\tc->page = NULL;\n\n }\n\n}\n"}} {"sample_id": "4a9c9ea0d318bec2f67848c5ceaf4ad5bcb91d09", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n \n \n+\n+ return ret < 0 ? ret : ret * BDRV_SECTOR_SIZE;\n+\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int64_t bdrv_getlength(BlockDriverState *bs)\n\n{\n\n int64_t ret = bdrv_nb_sectors(bs);\n\n\n\n\n return ret < 0 ? ret : ret * BDRV_SECTOR_SIZE;\n\n}"}} {"sample_id": "92c0bba9a95739c92e959fe478cb1acb92fa5446_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,6 +8,6 @@\n \n \n \n+ return omap_l4_io_writew_fn[i](omap_l4_io_opaque[i], addr, value);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void omap_l4_io_writew(void *opaque, target_phys_addr_t addr,\n\n uint32_t value)\n\n{\n\n unsigned int i = (addr - OMAP2_L4_BASE) >> TARGET_PAGE_BITS;\n\n\n\n return omap_l4_io_writew_fn[i](omap_l4_io_opaque[i], addr, value);\n\n}\n"}} {"sample_id": "6a4d1c9063174234ca439244cf8f5f534afa1c28", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n int i;\n \n+ for (i = 0; hwaccels[i].name; i++)\n+\n+ if (hwaccels[i].pix_fmt == pix_fmt)\n \n return &hwaccels[i];\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static const HWAccel *get_hwaccel(enum AVPixelFormat pix_fmt)\n\n{\n\n int i;\n\n for (i = 0; hwaccels[i].name; i++)\n\n if (hwaccels[i].pix_fmt == pix_fmt)\n\n return &hwaccels[i];\n\n return NULL;\n\n}\n"}} {"sample_id": "bc38e83793be5f7a184c88be55e556453a25224b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n const uint8_t *buf, int len)\n \n+{\n \n+ int len1;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int ff_mpegts_parse_packet(MpegTSContext *ts, AVPacket *pkt,\n\n const uint8_t *buf, int len)\n\n{\n\n int len1;\n\n\n\n len1 = len;\n\n ts->pkt = pkt;\n\n ts->stop_parse = 0;\n\n for(;;) {\n\n if (ts->stop_parse>0)\n\n break;\n\n if (len < TS_PACKET_SIZE)\n\n return -1;\n\n if (buf[0] != 0x47) {\n\n buf++;\n\n len--;\n\n } else {\n\n handle_packet(ts, buf);\n\n buf += TS_PACKET_SIZE;\n\n len -= TS_PACKET_SIZE;\n\n }\n\n }\n\n return len1 - len;\n\n}\n"}} {"sample_id": "21ef45d71221b4577330fe3aacfb06afad91ad46_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void vnc_display_close(DisplayState *ds)\n+\n {\n \n VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void vnc_display_close(DisplayState *ds)\n\n{\n\n VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;\n\n\n\n if (!vs)\n\n return;\n\n if (vs->display) {\n\n g_free(vs->display);\n\n vs->display = NULL;\n\n }\n\n if (vs->lsock != -1) {\n\n qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);\n\n close(vs->lsock);\n\n vs->lsock = -1;\n\n }\n\n#ifdef CONFIG_VNC_WS\n\n g_free(vs->ws_display);\n\n vs->ws_display = NULL;\n\n if (vs->lwebsock != -1) {\n\n qemu_set_fd_handler2(vs->lwebsock, NULL, NULL, NULL, NULL);\n\n close(vs->lwebsock);\n\n vs->lwebsock = -1;\n\n }\n\n#endif /* CONFIG_VNC_WS */\n\n vs->auth = VNC_AUTH_INVALID;\n\n#ifdef CONFIG_VNC_TLS\n\n vs->subauth = VNC_AUTH_INVALID;\n\n vs->tls.x509verify = 0;\n\n#endif\n\n}\n"}} {"sample_id": "088ed5314694031e07e02e9d364c9d486a60e704", "diff": "--- a/source.c\n+++ b/source.c\n@@ -43,11 +43,11 @@\n \n \n for (i = 0; i < s->nb_chapters; i++) {\n+\n+ AVChapter *ch = s->chapters[i];\n+\n+\n+\n if (!av_dict_get(ch->metadata, \"\", NULL, AV_DICT_IGNORE_SUFFIX))\n \n continue;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mkv_write_tags(AVFormatContext *s)\n\n{\n\n ebml_master tags = {0};\n\n int i, ret;\n\n\n\n ff_metadata_conv_ctx(s, ff_mkv_metadata_conv, NULL);\n\n\n\n if (av_dict_get(s->metadata, \"\", NULL, AV_DICT_IGNORE_SUFFIX)) {\n\n ret = mkv_write_tag(s, s->metadata, 0, 0, &tags);\n\n if (ret < 0) return ret;\n\n }\n\n\n\n for (i = 0; i < s->nb_streams; i++) {\n\n AVStream *st = s->streams[i];\n\n\n\n if (!av_dict_get(st->metadata, \"\", 0, AV_DICT_IGNORE_SUFFIX))\n\n continue;\n\n\n\n ret = mkv_write_tag(s, st->metadata, MATROSKA_ID_TAGTARGETS_TRACKUID, i + 1, &tags);\n\n if (ret < 0) return ret;\n\n }\n\n\n\n for (i = 0; i < s->nb_chapters; i++) {\n\n AVChapter *ch = s->chapters[i];\n\n\n\n if (!av_dict_get(ch->metadata, \"\", NULL, AV_DICT_IGNORE_SUFFIX))\n\n continue;\n\n\n\n ret = mkv_write_tag(s, ch->metadata, MATROSKA_ID_TAGTARGETS_CHAPTERUID, ch->id, &tags);\n\n if (ret < 0) return ret;\n\n }\n\n\n\n if (tags.pos)\n\n end_ebml_master(s->pb, tags);\n\n return 0;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_341", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void pci_apb_iowritel (void *opaque, target_phys_addr_t addr,\n \n+ uint32_t val)\n+\n {\n \n cpu_outl(addr & IOPORTS_MASK, bswap32(val));", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pci_apb_iowritel (void *opaque, target_phys_addr_t addr,\n\n uint32_t val)\n\n{\n\n cpu_outl(addr & IOPORTS_MASK, bswap32(val));\n\n}\n"}} {"sample_id": "7285477ab11831b1cf56e45878a89170dd06d9b9_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static SCSIRequest *scsi_new_request(SCSIDevice *d, uint32_t tag,\n+\n+ uint32_t lun, void *hba_private)\n+\n+{\n+\n SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);\n \n SCSIRequest *req;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static SCSIRequest *scsi_new_request(SCSIDevice *d, uint32_t tag,\n\n uint32_t lun, void *hba_private)\n\n{\n\n SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, d);\n\n SCSIRequest *req;\n\n SCSIDiskReq *r;\n\n\n\n req = scsi_req_alloc(&scsi_disk_reqops, &s->qdev, tag, lun, hba_private);\n\n r = DO_UPCAST(SCSIDiskReq, req, req);\n\n r->iov.iov_base = qemu_blockalign(s->bs, SCSI_DMA_BUF_SIZE);\n\n return req;\n\n}\n"}} {"sample_id": "2d40a09b6e73230b160a505f01ed1acf169e1d9f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static int libquvi_close(AVFormatContext *s)\n+\n+{\n+\n LibQuviContext *qc = s->priv_data;\n \n if (qc->fmtctx)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int libquvi_close(AVFormatContext *s)\n\n{\n\n LibQuviContext *qc = s->priv_data;\n\n if (qc->fmtctx)\n\n avformat_close_input(&qc->fmtctx);\n\n return 0;\n\n}\n"}} {"sample_id": "7e09797c299712cafa7bc05dd57c1b13afcc6039_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)\n+\n {\n \n return simple_mpu_ap_bits(env->cp15.c5_insn);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static uint64_t pmsav5_insn_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)\n\n{\n\n return simple_mpu_ap_bits(env->cp15.c5_insn);\n\n}\n"}} {"sample_id": "c599d4d6d6e9bfdb64e54c33a22cb26e3496b96d_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,7 +16,7 @@\n \n * not, then the user is trying to mess with us.\n \n+ */\n \n frame_addr = env->regs[13];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static long do_rt_sigreturn_v2(CPUARMState *env)\n\n{\n\n abi_ulong frame_addr;\n\n struct rt_sigframe_v2 *frame = NULL;\n\n\n\n /*\n\n * Since we stacked the signal on a 64-bit boundary,\n\n * then 'sp' should be word aligned here. If it's\n\n * not, then the user is trying to mess with us.\n\n */\n\n frame_addr = env->regs[13];\n\n trace_user_do_rt_sigreturn(env, frame_addr);\n\n if (frame_addr & 7) {\n\n goto badframe;\n\n }\n\n\n\n if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1)) {\n\n goto badframe;\n\n }\n\n\n\n if (do_sigframe_return_v2(env, frame_addr, &frame->uc)) {\n\n goto badframe;\n\n }\n\n\n\n unlock_user_struct(frame, frame_addr, 0);\n\n return -TARGET_QEMU_ESIGRETURN;\n\n\n\nbadframe:\n\n unlock_user_struct(frame, frame_addr, 0);\n\n force_sig(TARGET_SIGSEGV /* , current */);\n\n return 0;\n\n}\n"}} {"sample_id": "a879125b47c3ae554c01824f996a64a45a86556e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static uint16_t qpci_pc_config_readw(QPCIBus *bus, int devfn, uint8_t offset)\n+\n {\n \n outl(0xcf8, (1 << 31) | (devfn << 8) | offset);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint16_t qpci_pc_config_readw(QPCIBus *bus, int devfn, uint8_t offset)\n\n{\n\n outl(0xcf8, (1 << 31) | (devfn << 8) | offset);\n\n return inw(0xcfc);\n\n}\n"}} {"sample_id": "55e1819c509b3d9c10a54678b9c585bbda13889e_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void qnull_destroy_obj(QObject *obj)\n+\n {\n \n assert(0);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qnull_destroy_obj(QObject *obj)\n\n{\n\n assert(0);\n\n}\n"}} {"sample_id": "de13d2161473d02ae97ec0f8e4503147554892dd_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n uint32_t io_int_word)\n \n+{\n+\n+ if (kvm_enabled()) {\n+\n+ kvm_s390_io_interrupt(cpu, subchannel_id, subchannel_nr, io_int_parm,\n \n io_int_word);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void s390_io_interrupt(S390CPU *cpu, uint16_t subchannel_id,\n\n uint16_t subchannel_nr, uint32_t io_int_parm,\n\n uint32_t io_int_word)\n\n{\n\n if (kvm_enabled()) {\n\n kvm_s390_io_interrupt(cpu, subchannel_id, subchannel_nr, io_int_parm,\n\n io_int_word);\n\n } else {\n\n cpu_inject_io(cpu, subchannel_id, subchannel_nr, io_int_parm,\n\n io_int_word);\n\n }\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+uint8_t qpci_io_readb(QPCIDevice *dev, void *data)\n+\n+{\n+\n uintptr_t addr = (uintptr_t)data;\n \n+\n \n if (addr < QPCI_PIO_LIMIT) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "uint8_t qpci_io_readb(QPCIDevice *dev, void *data)\n\n{\n\n uintptr_t addr = (uintptr_t)data;\n\n\n\n if (addr < QPCI_PIO_LIMIT) {\n\n return dev->bus->pio_readb(dev->bus, addr);\n\n } else {\n\n uint8_t val;\n\n dev->bus->memread(dev->bus, addr, &val, sizeof(val));\n\n return val;\n\n }\n\n}\n"}} {"sample_id": "ec4c48397641dbaf4ae8df36c32aaa5a311a11bf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static const AVClass *ff_avio_child_class_next(const AVClass *prev)\n+\n {\n \n return prev ? NULL : &ffurl_context_class;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static const AVClass *ff_avio_child_class_next(const AVClass *prev)\n\n{\n\n return prev ? NULL : &ffurl_context_class;\n\n}\n"}} {"sample_id": "18f1c729b88eb7f0f408332132b85dc896bfb145", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n s = &d->ne2000;\n \n s->irq = d->dev.irq[0];\n+\n+\n+\n+ qemu_macaddr_default_if_unset(&s->c.macaddr);\n+\n ne2000_reset(s);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pci_ne2000_init(PCIDevice *pci_dev)\n\n{\n\n PCINE2000State *d = DO_UPCAST(PCINE2000State, dev, pci_dev);\n\n NE2000State *s;\n\n uint8_t *pci_conf;\n\n\n\n pci_conf = d->dev.config;\n\n pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_REALTEK);\n\n pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_REALTEK_8029);\n\n pci_config_set_class(pci_conf, PCI_CLASS_NETWORK_ETHERNET);\n\n /* TODO: RST# value should be 0. PCI spec 6.2.4 */\n\n pci_conf[PCI_INTERRUPT_PIN] = 1; // interrupt pin 0\n\n\n\n pci_register_bar(&d->dev, 0, 0x100,\n\n PCI_BASE_ADDRESS_SPACE_IO, ne2000_map);\n\n s = &d->ne2000;\n\n s->irq = d->dev.irq[0];\n\n\n\n qemu_macaddr_default_if_unset(&s->c.macaddr);\n\n ne2000_reset(s);\n\n\n\n s->nic = qemu_new_nic(&net_ne2000_info, &s->c,\n\n pci_dev->qdev.info->name, pci_dev->qdev.id, s);\n\n qemu_format_nic_info_str(&s->nic->nc, s->c.macaddr.a);\n\n\n\n if (!pci_dev->qdev.hotplugged) {\n\n static int loaded = 0;\n\n if (!loaded) {\n\n rom_add_option(\"pxe-ne2k_pci.rom\", -1);\n\n loaded = 1;\n\n }\n\n }\n\n\n\n add_boot_device_path(s->c.bootindex, &pci_dev->qdev, \"/ethernet-phy@0\");\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "84fd9dd3f78ced9d41e1160d43862bb620cb462a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n \n \n if (table == NULL) {\n+\n+ /* Use g_direct_hash/equal for direct pointer comparisons on func. */\n+\n+ table = g_hash_table_new(NULL, NULL);\n+\n s->helpers = table;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void tcg_register_helper(void *func, const char *name)\n\n{\n\n TCGContext *s = &tcg_ctx;\n\n GHashTable *table = s->helpers;\n\n\n\n if (table == NULL) {\n\n /* Use g_direct_hash/equal for direct pointer comparisons on func. */\n\n table = g_hash_table_new(NULL, NULL);\n\n s->helpers = table;\n\n }\n\n\n\n g_hash_table_insert(table, (gpointer)func, (gpointer)name);\n\n}\n"}} {"sample_id": "323e6fead07c75f418e4b60704a4f437bb3483b2_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,13 +11,13 @@\n \n \n n = 1 << mdct->nbits;\n+\n n2 = n >> 1;\n \n n4 = n >> 2;\n \n \n+\n /* shift to simplify computations */\n \n for (i = 0; i rot_tmp;\n\n IComplex *x = mdct->cplx_tmp;\n\n\n\n n = 1 << mdct->nbits;\n\n n2 = n >> 1;\n\n n4 = n >> 2;\n\n\n\n /* shift to simplify computations */\n\n for (i = 0; i > 1;\n\n im = -((int)rot[n2+2*i] - (int)rot[n2-1-2*i]) >> 1;\n\n CMUL(x[i].re, x[i].im, re, im, -mdct->xcos1[i], mdct->xsin1[i]);\n\n }\n\n\n\n fft(mdct, x, mdct->nbits - 2);\n\n\n\n /* post rotation */\n\n for (i = 0; i < n4; i++) {\n\n re = x[i].re;\n\n im = x[i].im;\n\n CMUL(out[n2-1-2*i], out[2*i], re, im, mdct->xsin1[i], mdct->xcos1[i]);\n\n }\n\n}\n"}} {"sample_id": "031380d8770d2df6c386e4aeabd412007d3ebd54", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n struct timeval t2;\n \n+\n+\n+ gettimeofday(&t2, NULL);\n+\n+\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void aio_write_done(void *opaque, int ret)\n\n{\n\n struct aio_ctx *ctx = opaque;\n\n struct timeval t2;\n\n\n\n gettimeofday(&t2, NULL);\n\n\n\n\n\n if (ret < 0) {\n\n printf(\"aio_write failed: %s\\n\", strerror(-ret));\n\n goto out;\n\n }\n\n\n\n if (ctx->qflag) {\n\n goto out;\n\n }\n\n\n\n /* Finally, report back -- -C gives a parsable format */\n\n t2 = tsub(t2, ctx->t1);\n\n print_report(\"wrote\", &t2, ctx->offset, ctx->qiov.size,\n\n ctx->qiov.size, 1, ctx->Cflag);\n\nout:\n\n qemu_io_free(ctx->buf);\n\n free(ctx);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_132", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,8 +20,8 @@\n \n default:\n \n+ return 0;\n+\n+ }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t mv88w8618_flashcfg_read(void *opaque,\n\n target_phys_addr_t offset,\n\n unsigned size)\n\n{\n\n mv88w8618_flashcfg_state *s = opaque;\n\n\n\n switch (offset) {\n\n case MP_FLASHCFG_CFGR0:\n\n return s->cfgr0;\n\n\n\n default:\n\n return 0;\n\n }\n\n}\n"}} {"sample_id": "f1d6f013b2078140fb701978d720abecde7cd73f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -49,11 +49,11 @@\n av_des_init(&av_des, n_val, 192, 1);\n \n while (datalen-- > 0) {\n+\n+ av_des_crypt(&av_des, oc->r_val, &enc_header[pos], 2, NULL, 1);\n+\n+ kset(s, oc->r_val, NULL, 16);\n+\n if (!rprobe(s, enc_header, oc->r_val))\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int nprobe(AVFormatContext *s, uint8_t *enc_header, int size, const uint8_t *n_val)\n\n{\n\n OMAContext *oc = s->priv_data;\n\n uint32_t pos, taglen, datalen;\n\n struct AVDES av_des;\n\n\n\n if (!enc_header || !n_val)\n\n return -1;\n\n\n\n pos = OMA_ENC_HEADER_SIZE + oc->k_size;\n\n if (!memcmp(&enc_header[pos], \"EKB \", 4))\n\n pos += 32;\n\n\n\n if (AV_RB32(&enc_header[pos]) != oc->rid)\n\n av_log(s, AV_LOG_DEBUG, \"Mismatching RID\\n\");\n\n\n\n taglen = AV_RB32(&enc_header[pos+32]);\n\n datalen = AV_RB32(&enc_header[pos+36]) >> 4;\n\n\n\n if(taglen + (((uint64_t)datalen)<<4) + 44 > size)\n\n return -1;\n\n\n\n pos += 44 + taglen;\n\n\n\n av_des_init(&av_des, n_val, 192, 1);\n\n while (datalen-- > 0) {\n\n av_des_crypt(&av_des, oc->r_val, &enc_header[pos], 2, NULL, 1);\n\n kset(s, oc->r_val, NULL, 16);\n\n if (!rprobe(s, enc_header, oc->r_val))\n\n return 0;\n\n pos += 16;\n\n }\n\n\n\n return -1;\n\n}\n"}} {"sample_id": "24f50d7ea5896a30b0e78f68884586bb8b40ff97", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void tcg_target_init(TCGContext *s)\n \n+{\n \n tcg_regset_set32(tcg_target_available_regs[TCG_TYPE_I32], 0, 0xffffffff);\n \n+ tcg_regset_set32(tcg_target_call_clobber_regs, 0,\n \n (1 << TCG_REG_R0) |\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void tcg_target_init(TCGContext *s)\n\n{\n\n tcg_regset_set32(tcg_target_available_regs[TCG_TYPE_I32], 0, 0xffffffff);\n\n tcg_regset_set32(tcg_target_call_clobber_regs, 0,\n\n (1 << TCG_REG_R0) |\n\n#ifdef _CALL_DARWIN\n\n (1 << TCG_REG_R2) |\n\n#endif\n\n (1 << TCG_REG_R3) |\n\n (1 << TCG_REG_R4) |\n\n (1 << TCG_REG_R5) |\n\n (1 << TCG_REG_R6) |\n\n (1 << TCG_REG_R7) |\n\n (1 << TCG_REG_R8) |\n\n (1 << TCG_REG_R9) |\n\n (1 << TCG_REG_R10) |\n\n (1 << TCG_REG_R11) |\n\n (1 << TCG_REG_R12)\n\n );\n\n\n\n tcg_regset_clear(s->reserved_regs);\n\n tcg_regset_set_reg(s->reserved_regs, TCG_REG_R0);\n\n tcg_regset_set_reg(s->reserved_regs, TCG_REG_R1);\n\n#ifndef _CALL_DARWIN\n\n tcg_regset_set_reg(s->reserved_regs, TCG_REG_R2);\n\n#endif\n\n#ifdef _CALL_SYSV\n\n tcg_regset_set_reg(s->reserved_regs, TCG_REG_R13);\n\n#endif\n\n\n\n tcg_add_target_add_op_defs(ppc_op_defs);\n\n}\n"}} {"sample_id": "ac531cb6e542b1e61d668604adf9dc5306a948c0_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n const char *key = \"key\";\n \n const char *str = \"string\";\n+\n+\n+\n+ qdict_put(tests_dict, key, qstring_from_str(str));\n+\n \n \n p = qdict_get_str(tests_dict, key);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "START_TEST(qdict_get_str_test)\n\n{\n\n const char *p;\n\n const char *key = \"key\";\n\n const char *str = \"string\";\n\n\n\n qdict_put(tests_dict, key, qstring_from_str(str));\n\n\n\n p = qdict_get_str(tests_dict, key);\n\n fail_unless(p != NULL);\n\n fail_unless(strcmp(p, str) == 0);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_146", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n /* SCU */\n \n switch (offset) {\n+\n+ case 0: /* Control register. */\n+\n+ s->scu_control = value & 1;\n+\n break;\n \n case 0x0c: /* Invalidate all. */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void mpcore_scu_write(void *opaque, target_phys_addr_t offset,\n\n uint64_t value, unsigned size)\n\n{\n\n mpcore_priv_state *s = (mpcore_priv_state *)opaque;\n\n /* SCU */\n\n switch (offset) {\n\n case 0: /* Control register. */\n\n s->scu_control = value & 1;\n\n break;\n\n case 0x0c: /* Invalidate all. */\n\n /* This is a no-op as cache is not emulated. */\n\n break;\n\n default:\n\n hw_error(\"mpcore_priv_read: Bad offset %x\\n\", (int)offset);\n\n }\n\n}\n"}} {"sample_id": "0d82d0e8b98cf0ea03a45f8542d835ebd3a84cd3_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int64_t buffered_get_rate_limit(void *opaque)\n \n+{\n+\n QEMUFileBuffered *s = opaque;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int64_t buffered_get_rate_limit(void *opaque)\n\n{\n\n QEMUFileBuffered *s = opaque;\n\n \n\n return s->xfer_limit;\n\n}\n"}} {"sample_id": "68931a4082812f56657b39168e815c48f0ab0a8c_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,10 +2,10 @@\n \n {\n \n+ static const LxBoardDesc ml605_board = {\n+\n+ .flash_base = 0xf8000000,\n+\n .flash_size = 0x01000000,\n \n .flash_sector_size = 0x20000,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void xtensa_ml605_init(MachineState *machine)\n\n{\n\n static const LxBoardDesc ml605_board = {\n\n .flash_base = 0xf8000000,\n\n .flash_size = 0x01000000,\n\n .flash_sector_size = 0x20000,\n\n .sram_size = 0x2000000,\n\n };\n\n lx_init(&ml605_board, machine);\n\n}\n"}} {"sample_id": "f929ab0569ff31ed5a59b0b0adb7ce09df3fca39_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n if( vo_len > 0 ) {\n \n /* We need to store the header, so extract it */\n+\n+ if( avctx->extradata == NULL ) {\n+\n+ avctx->extradata = av_malloc(vo_len);\n+\n memcpy(avctx->extradata, pkt->data, vo_len);\n \n avctx->extradata_size = vo_len;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int xvid_strip_vol_header(AVCodecContext *avctx,\n\n AVPacket *pkt,\n\n unsigned int header_len,\n\n unsigned int frame_len) {\n\n int vo_len = 0, i;\n\n\n\n for( i = 0; i < header_len - 3; i++ ) {\n\n if( pkt->data[i] == 0x00 &&\n\n pkt->data[i+1] == 0x00 &&\n\n pkt->data[i+2] == 0x01 &&\n\n pkt->data[i+3] == 0xB6 ) {\n\n vo_len = i;\n\n break;\n\n }\n\n }\n\n\n\n if( vo_len > 0 ) {\n\n /* We need to store the header, so extract it */\n\n if( avctx->extradata == NULL ) {\n\n avctx->extradata = av_malloc(vo_len);\n\n memcpy(avctx->extradata, pkt->data, vo_len);\n\n avctx->extradata_size = vo_len;\n\n }\n\n /* Less dangerous now, memmove properly copies the two\n\n chunks of overlapping data */\n\n memmove(pkt->data, &pkt->data[vo_len], frame_len - vo_len);\n\n pkt->size = frame_len - vo_len;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "afea4e1410654154018587dd35c1b250ba4d8ec4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static bool megasas_use_msi(MegasasState *s)\n+\n {\n \n return s->msi != ON_OFF_AUTO_OFF;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static bool megasas_use_msi(MegasasState *s)\n\n{\n\n return s->msi != ON_OFF_AUTO_OFF;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_97", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n \n \n s = migrate_get_current();\n+\n+ s->bandwidth_limit = value;\n+\n+ if (s->file) {\n+\n qemu_file_set_rate_limit(s->file, s->bandwidth_limit / XFER_LIMIT_RATIO);\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void qmp_migrate_set_speed(int64_t value, Error **errp)\n\n{\n\n MigrationState *s;\n\n\n\n if (value < 0) {\n\n value = 0;\n\n }\n\n if (value > SIZE_MAX) {\n\n value = SIZE_MAX;\n\n }\n\n\n\n s = migrate_get_current();\n\n s->bandwidth_limit = value;\n\n if (s->file) {\n\n qemu_file_set_rate_limit(s->file, s->bandwidth_limit / XFER_LIMIT_RATIO);\n\n }\n\n}\n"}} {"sample_id": "474d858fd9551b45a17e1f3a4322de1a88e749b9_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n #if HAVE_STRUCT_SOCKADDR_IN6\n \n+ else if (ss->ss_family == AF_INET6)\n+\n+ ssu.in6.sin6_port = htons(port);\n+\n+#endif\n \n *ss = ssu.storage;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void set_port(struct sockaddr_storage *ss, int port)\n\n{\n\n sockaddr_union ssu = (sockaddr_union){.storage = *ss};\n\n if (ss->ss_family == AF_INET)\n\n ssu.in.sin_port = htons(port);\n\n#if HAVE_STRUCT_SOCKADDR_IN6\n\n else if (ss->ss_family == AF_INET6)\n\n ssu.in6.sin6_port = htons(port);\n\n#endif\n\n *ss = ssu.storage;\n\n}\n"}} {"sample_id": "c60174e847082ab9f70720f86509a3353f816fad", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int usb_device_post_load(void *opaque, int version_id)\n+\n+{\n+\n+ USBDevice *dev = opaque;\n+\n \n \n if (dev->state == USB_STATE_NOTATTACHED) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int usb_device_post_load(void *opaque, int version_id)\n\n{\n\n USBDevice *dev = opaque;\n\n\n\n if (dev->state == USB_STATE_NOTATTACHED) {\n\n dev->attached = 0;\n\n } else {\n\n dev->attached = 1;\n\n\n\n\n\n\n return 0;\n"}} {"sample_id": "77cb0f5aafc8e6d0c6d3c339f381c9b7921648e0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static void adb_kbd_realizefn(DeviceState *dev, Error **errp)\n+\n+{\n+\n ADBKeyboardClass *akc = ADB_KEYBOARD_GET_CLASS(dev);\n \n akc->parent_realize(dev, errp);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void adb_kbd_realizefn(DeviceState *dev, Error **errp)\n\n{\n\n ADBKeyboardClass *akc = ADB_KEYBOARD_GET_CLASS(dev);\n\n akc->parent_realize(dev, errp);\n\n qemu_input_handler_register(dev, &adb_keyboard_handler);\n\n}\n"}} {"sample_id": "7a5b6af13a45ae7109900dee03a436819302126c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,7 +12,7 @@\n \n switch (remote->kind) {\n \n+ case SOCKET_ADDRESS_KIND_INET:\n \n qemu_opt_set(opts, \"host\", remote->inet->host);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int socket_dgram(SocketAddress *remote, SocketAddress *local, Error **errp)\n\n{\n\n QemuOpts *opts;\n\n int fd;\n\n\n\n opts = qemu_opts_create_nofail(&socket_optslist);\n\n switch (remote->kind) {\n\n case SOCKET_ADDRESS_KIND_INET:\n\n qemu_opt_set(opts, \"host\", remote->inet->host);\n\n qemu_opt_set(opts, \"port\", remote->inet->port);\n\n if (local) {\n\n qemu_opt_set(opts, \"localaddr\", local->inet->host);\n\n qemu_opt_set(opts, \"localport\", local->inet->port);\n\n }\n\n fd = inet_dgram_opts(opts, errp);\n\n break;\n\n\n\n default:\n\n error_setg(errp, \"socket type unsupported for datagram\");\n\n return -1;\n\n }\n\n qemu_opts_del(opts);\n\n return fd;\n\n}\n"}} {"sample_id": "3faa303a47e0c3b59a53988e0f76018930c6cb1a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n if(is_block2){\n \n decode_coeff(dst+8, coeffs[1], 2, gb, vlc, q_ac1);\n+\n+ decode_coeff(dst+1, coeffs[2], 2, gb, vlc, q_ac1);\n+\n+ }else{\n+\n decode_coeff(dst+1, coeffs[1], 2, gb, vlc, q_ac1);\n \n decode_coeff(dst+8, coeffs[2], 2, gb, vlc, q_ac1);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void decode_subblock3(DCTELEM *dst, int code, const int is_block2, GetBitContext *gb, VLC *vlc,\n\n int q_dc, int q_ac1, int q_ac2)\n\n{\n\n int coeffs[4];\n\n\n\n coeffs[0] = modulo_three_table[code][0];\n\n coeffs[1] = modulo_three_table[code][1];\n\n coeffs[2] = modulo_three_table[code][2];\n\n coeffs[3] = modulo_three_table[code][3];\n\n decode_coeff(dst , coeffs[0], 3, gb, vlc, q_dc);\n\n if(is_block2){\n\n decode_coeff(dst+8, coeffs[1], 2, gb, vlc, q_ac1);\n\n decode_coeff(dst+1, coeffs[2], 2, gb, vlc, q_ac1);\n\n }else{\n\n decode_coeff(dst+1, coeffs[1], 2, gb, vlc, q_ac1);\n\n decode_coeff(dst+8, coeffs[2], 2, gb, vlc, q_ac1);\n\n }\n\n decode_coeff(dst+9, coeffs[3], 2, gb, vlc, q_ac2);\n\n}\n"}} {"sample_id": "6cec5487990bf3f1f22b3fcb871978255e92ae0d_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,8 +3,8 @@\n {\n \n int i, j;\n+\n+ int has_fg, has_bg;\n \n uint8_t *last_fg, *last_bg;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void send_framebuffer_update_hextile(VncState *vs, int x, int y, int w, int h)\n\n{\n\n int i, j;\n\n int has_fg, has_bg;\n\n uint8_t *last_fg, *last_bg;\n\n\n\n vnc_framebuffer_update(vs, x, y, w, h, 5);\n\n\n\n last_fg = (uint8_t *) malloc(vs->depth);\n\n last_bg = (uint8_t *) malloc(vs->depth);\n\n has_fg = has_bg = 0;\n\n for (j = y; j < (y + h); j += 16) {\n\n\tfor (i = x; i < (x + w); i += 16) {\n\n vs->send_hextile_tile(vs, i, j,\n\n MIN(16, x + w - i), MIN(16, y + h - j),\n\n last_bg, last_fg, &has_bg, &has_fg);\n\n\t}\n\n }\n\n free(last_fg);\n\n free(last_bg);\n\n\n\n}\n"}} {"sample_id": "ddca7f86ac022289840e0200fd4050b2b58e9176_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n \n \n+ fidp = clunk_fid(s, fid);\n+\n+ if (fidp == NULL) {\n+\n+ err = -ENOENT;\n \n goto out_nofid;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void v9fs_clunk(void *opaque)\n\n{\n\n int err;\n\n int32_t fid;\n\n size_t offset = 7;\n\n V9fsFidState *fidp;\n\n V9fsPDU *pdu = opaque;\n\n V9fsState *s = pdu->s;\n\n\n\n pdu_unmarshal(pdu, offset, \"d\", &fid);\n\n trace_v9fs_clunk(pdu->tag, pdu->id, fid);\n\n\n\n fidp = clunk_fid(s, fid);\n\n if (fidp == NULL) {\n\n err = -ENOENT;\n\n goto out_nofid;\n\n }\n\n /*\n\n * Bump the ref so that put_fid will\n\n * free the fid.\n\n */\n\n fidp->ref++;\n\n err = offset;\n\n\n\n put_fid(pdu, fidp);\n\nout_nofid:\n\n complete_pdu(s, pdu, err);\n\n}\n"}} {"sample_id": "38d553322891c8e47182f05199d19888422167dc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void av_image_copy(uint8_t *dst_data[4], int dst_linesizes[4],\n \n const uint8_t *src_data[4], const int src_linesizes[4],\n+\n enum PixelFormat pix_fmt, int width, int height)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void av_image_copy(uint8_t *dst_data[4], int dst_linesizes[4],\n\n const uint8_t *src_data[4], const int src_linesizes[4],\n\n enum PixelFormat pix_fmt, int width, int height)\n\n{\n\n const AVPixFmtDescriptor *desc = &av_pix_fmt_descriptors[pix_fmt];\n\n\n\n if (desc->flags & PIX_FMT_HWACCEL)\n\n return;\n\n\n\n if (desc->flags & PIX_FMT_PAL) {\n\n av_image_copy_plane(dst_data[0], dst_linesizes[0],\n\n src_data[0], src_linesizes[0],\n\n width, height);\n\n /* copy the palette */\n\n memcpy(dst_data[1], src_data[1], 4*256);\n\n } else {\n\n int i, planes_nb = 0;\n\n\n\n for (i = 0; i < desc->nb_components; i++)\n\n planes_nb = FFMAX(planes_nb, desc->comp[i].plane + 1);\n\n\n\n for (i = 0; i < planes_nb; i++) {\n\n int h = height;\n\n int bwidth = av_image_get_linesize(pix_fmt, width, i);\n\n if (i == 1 || i == 2) {\n\n h= -((-height)>>desc->log2_chroma_h);\n\n }\n\n av_image_copy_plane(dst_data[i], dst_linesizes[i],\n\n src_data[i], src_linesizes[i],\n\n bwidth, h);\n\n }\n\n }\n\n}\n"}} {"sample_id": "cdd85eb2804018ab46a742ebf64dc5366b9fae73_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n uint8_t *msg_data;\n \n \n+\n if (offset % PCI_MSIX_ENTRY_SIZE != 8) {\n \n return;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void update_msix_table_msg_data(S390PCIBusDevice *pbdev, uint64_t offset,\n\n uint64_t *data, uint8_t len)\n\n{\n\n uint32_t val;\n\n uint8_t *msg_data;\n\n\n\n if (offset % PCI_MSIX_ENTRY_SIZE != 8) {\n\n return;\n\n }\n\n\n\n if (len != 4) {\n\n DPRINTF(\"access msix table msg data but len is %d\\n\", len);\n\n return;\n\n }\n\n\n\n msg_data = (uint8_t *)data - offset % PCI_MSIX_ENTRY_SIZE +\n\n PCI_MSIX_ENTRY_VECTOR_CTRL;\n\n val = pci_get_long(msg_data) | (pbdev->fid << ZPCI_MSI_VEC_BITS);\n\n pci_set_long(msg_data, val);\n\n DPRINTF(\"update msix msg_data to 0x%\" PRIx64 \"\\n\", *data);\n\n}\n"}} {"sample_id": "12d4536f7d911b6d87a766ad7300482ea663cea2_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+void qemu_cpu_kick_self(void)\n+\n+{\n+\n+#ifndef _WIN32\n \n assert(cpu_single_env);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void qemu_cpu_kick_self(void)\n\n{\n\n#ifndef _WIN32\n\n assert(cpu_single_env);\n\n\n\n raise(SIG_IPI);\n\n#else\n\n abort();\n\n#endif\n\n}\n"}} {"sample_id": "2b1a4c5b3411c3030a5bdbd70d80bc606be570f7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ MovieContext *movie = outlink->src->priv;\n \n int ret;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int amovie_request_frame(AVFilterLink *outlink)\n\n{\n\n MovieContext *movie = outlink->src->priv;\n\n int ret;\n\n\n\n if (movie->is_done)\n\n return AVERROR_EOF;\n\n if ((ret = amovie_get_samples(outlink)) < 0)\n\n return ret;\n\n\n\n avfilter_filter_samples(outlink, avfilter_ref_buffer(movie->samplesref, ~0));\n\n avfilter_unref_buffer(movie->samplesref);\n\n movie->samplesref = NULL;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "97b83deb557679c909465456acaa723c2ba34948", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n (vring_avail_flags(vq) & VRING_AVAIL_F_NO_INTERRUPT))\n \n+ return;\n+\n+\n+\n vdev->isr |= 0x01;\n \n virtio_update_irq(vdev);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void virtio_notify(VirtIODevice *vdev, VirtQueue *vq)\n\n{\n\n /* Always notify when queue is empty */\n\n if ((vq->inuse || vring_avail_idx(vq) != vq->last_avail_idx) &&\n\n (vring_avail_flags(vq) & VRING_AVAIL_F_NO_INTERRUPT))\n\n return;\n\n\n\n vdev->isr |= 0x01;\n\n virtio_update_irq(vdev);\n\n}\n"}} {"sample_id": "537848ee62195fc06c328b1cd64f4218f404a7f1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n if (ret <= 0) {\n \n if (ret == 0) {\n+\n VNC_DEBUG(\"Closing down client sock: EOF\\n\");\n \n } else if (ret != QIO_CHANNEL_ERR_BLOCK) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "ssize_t vnc_client_io_error(VncState *vs, ssize_t ret, Error **errp)\n\n{\n\n if (ret <= 0) {\n\n if (ret == 0) {\n\n VNC_DEBUG(\"Closing down client sock: EOF\\n\");\n\n } else if (ret != QIO_CHANNEL_ERR_BLOCK) {\n\n VNC_DEBUG(\"Closing down client sock: ret %zd (%s)\\n\",\n\n ret, errp ? error_get_pretty(*errp) : \"Unknown\");\n\n }\n\n\n\n vnc_disconnect_start(vs);\n\n if (errp) {\n\n error_free(*errp);\n\n *errp = NULL;\n\n }\n\n return 0;\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "081dd1fe36f0ccc04130d1edd136c787c5f8cc50", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void nbd_refresh_limits(BlockDriverState *bs, Error **errp)\n+\n {\n \n bs->bl.max_pdiscard = NBD_MAX_BUFFER_SIZE;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void nbd_refresh_limits(BlockDriverState *bs, Error **errp)\n\n{\n\n bs->bl.max_pdiscard = NBD_MAX_BUFFER_SIZE;\n\n bs->bl.max_pwrite_zeroes = NBD_MAX_BUFFER_SIZE;\n\n bs->bl.max_transfer = NBD_MAX_BUFFER_SIZE;\n\n}\n"}} {"sample_id": "ac4b32df71bd932838043a4838b86d11e169707f_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static av_always_inline int simple_limit(uint8_t *p, ptrdiff_t stride, int flim)\n+\n {\n \n LOAD_PIXELS", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static av_always_inline int simple_limit(uint8_t *p, ptrdiff_t stride, int flim)\n\n{\n\n LOAD_PIXELS\n\n return 2 * FFABS(p0 - q0) + (FFABS(p1 - q1) >> 1) <= flim;\n\n}\n"}} {"sample_id": "0afdedcafb4d524abfe2c958f17aafe4f1ab8d9a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n } else {\n \n+ /* fall back on uncompressed */\n+\n+ count = count_pixels(ptr, w-x, bpp, 0);\n+\n+ *out++ = (count ^ xor_raw) + add_raw;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int ff_rle_encode(uint8_t *outbuf, int out_size, const uint8_t *ptr , int bpp, int w,\n\n int add_rep, int xor_rep, int add_raw, int xor_raw)\n\n{\n\n int count, x;\n\n uint8_t *out = outbuf;\n\n\n\n for(x = 0; x < w; x += count) {\n\n /* see if we can encode the next set of pixels with RLE */\n\n if((count = count_pixels(ptr, w-x, bpp, 1)) > 1) {\n\n if(out + bpp + 1 > outbuf + out_size) return -1;\n\n *out++ = (count ^ xor_rep) + add_rep;\n\n memcpy(out, ptr, bpp);\n\n out += bpp;\n\n } else {\n\n /* fall back on uncompressed */\n\n count = count_pixels(ptr, w-x, bpp, 0);\n\n *out++ = (count ^ xor_raw) + add_raw;\n\n\n\n if(out + bpp*count > outbuf + out_size) return -1;\n\n memcpy(out, ptr, bpp * count);\n\n out += bpp * count;\n\n }\n\n\n\n ptr += count * bpp;\n\n }\n\n\n\n return out - outbuf;\n\n}\n"}} {"sample_id": "b3415e4c5f9205820fd6c9211ad50a4df2692a36", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void *av_fast_realloc(void *ptr, unsigned int *size, size_t min_size)\n \n+{\n \n if (min_size < *size)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void *av_fast_realloc(void *ptr, unsigned int *size, size_t min_size)\n\n{\n\n if (min_size < *size)\n\n return ptr;\n\n\n\n min_size = FFMAX(17 * min_size / 16 + 32, min_size);\n\n\n\n ptr = av_realloc(ptr, min_size);\n\n /* we could set this to the unmodified min_size but this is safer\n\n * if the user lost the ptr and uses NULL now\n\n */\n\n if (!ptr)\n\n min_size = 0;\n\n\n\n *size = min_size;\n\n\n\n return ptr;\n\n}\n"}} {"sample_id": "a89f364ae8740dfc31b321eed9ee454e996dc3c1_26", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n return;\n \n+ }\n+\n+\n+\n+ for (;;) {\n \n if (!(d->corb_ctl & ICH6_CORBCTL_RUN)) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void intel_hda_corb_run(IntelHDAState *d)\n\n{\n\n hwaddr addr;\n\n uint32_t rp, verb;\n\n\n\n if (d->ics & ICH6_IRS_BUSY) {\n\n dprint(d, 2, \"%s: [icw] verb 0x%08x\\n\", __FUNCTION__, d->icw);\n\n intel_hda_send_command(d, d->icw);\n\n return;\n\n }\n\n\n\n for (;;) {\n\n if (!(d->corb_ctl & ICH6_CORBCTL_RUN)) {\n\n dprint(d, 2, \"%s: !run\\n\", __FUNCTION__);\n\n return;\n\n }\n\n if ((d->corb_rp & 0xff) == d->corb_wp) {\n\n dprint(d, 2, \"%s: corb ring empty\\n\", __FUNCTION__);\n\n return;\n\n }\n\n if (d->rirb_count == d->rirb_cnt) {\n\n dprint(d, 2, \"%s: rirb count reached\\n\", __FUNCTION__);\n\n return;\n\n }\n\n\n\n rp = (d->corb_rp + 1) & 0xff;\n\n addr = intel_hda_addr(d->corb_lbase, d->corb_ubase);\n\n verb = ldl_le_pci_dma(&d->pci, addr + 4*rp);\n\n d->corb_rp = rp;\n\n\n\n dprint(d, 2, \"%s: [rp 0x%x] verb 0x%08x\\n\", __FUNCTION__, rp, verb);\n\n intel_hda_send_command(d, verb);\n\n }\n\n}\n"}} {"sample_id": "2572b37a4751cc967582d7d04f21d9bf97187ae5_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n container_of(blockacb, BlockDriverAIOCBCoroutine, common);\n \n+ bool done = false;\n+\n+\n+\n+ acb->done = &done;\n \n while (!done) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bdrv_aio_co_cancel_em(BlockDriverAIOCB *blockacb)\n\n{\n\n BlockDriverAIOCBCoroutine *acb =\n\n container_of(blockacb, BlockDriverAIOCBCoroutine, common);\n\n bool done = false;\n\n\n\n acb->done = &done;\n\n while (!done) {\n\n qemu_aio_wait();\n\n }\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_30", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+PPC_OP(btest_T1) \n \n+{\n \n+ if (T0) {\n \n+ regs->nip = T1 & ~3;\n \n } else {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "PPC_OP(btest_T1) \n\n{\n\n if (T0) {\n\n regs->nip = T1 & ~3;\n\n } else {\n\n regs->nip = PARAM1;\n\n }\n\n RETURN();\n\n}\n"}} {"sample_id": "92e483f8ed70d88d4f64337f65bae212502735d4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int compare_ocl_device_desc(const void *a, const void *b)\n+\n {\n \n return ((const OpenCLDeviceBenchmark*)a)->runtime - ((const OpenCLDeviceBenchmark*)b)->runtime;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int compare_ocl_device_desc(const void *a, const void *b)\n\n{\n\n return ((const OpenCLDeviceBenchmark*)a)->runtime - ((const OpenCLDeviceBenchmark*)b)->runtime;\n\n}\n"}} {"sample_id": "12987f89007ee82b9d3a6090085dfaef8461ab8b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int gxf_seek(AVFormatContext *s, int stream_index, int64_t timestamp, int flags) {\n+\n int res = 0;\n \n uint64_t pos;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int gxf_seek(AVFormatContext *s, int stream_index, int64_t timestamp, int flags) {\n\n int res = 0;\n\n uint64_t pos;\n\n uint64_t maxlen = 100 * 1024 * 1024;\n\n AVStream *st = s->streams[0];\n\n int64_t start_time = s->streams[stream_index]->start_time;\n\n int64_t found;\n\n int idx;\n\n if (timestamp < start_time) timestamp = start_time;\n\n idx = av_index_search_timestamp(st, timestamp - start_time,\n\n AVSEEK_FLAG_ANY | AVSEEK_FLAG_BACKWARD);\n\n if (idx < 0)\n\n return -1;\n\n pos = st->index_entries[idx].pos;\n\n if (idx < st->nb_index_entries - 2)\n\n maxlen = st->index_entries[idx + 2].pos - pos;\n\n maxlen = FFMAX(maxlen, 200 * 1024);\n\n res = avio_seek(s->pb, pos, SEEK_SET);\n\n if (res < 0)\n\n return res;\n\n found = gxf_resync_media(s, maxlen, -1, timestamp);\n\n if (FFABS(found - timestamp) > 4)\n\n return -1;\n\n return 0;\n\n}\n"}} {"sample_id": "40ff6d7e8dceca227e7f8a3e8e0d58b2c66d19b4_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static CharDriverState *qemu_chr_open_file_out(QemuOpts *opts)\n \n+{\n \n int fd_out;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static CharDriverState *qemu_chr_open_file_out(QemuOpts *opts)\n\n{\n\n int fd_out;\n\n\n\n TFR(fd_out = open(qemu_opt_get(opts, \"path\"),\n\n O_WRONLY | O_TRUNC | O_CREAT | O_BINARY, 0666));\n\n if (fd_out < 0)\n\n return NULL;\n\n return qemu_chr_open_fd(-1, fd_out);\n\n}\n"}} {"sample_id": "e5c67ab552fb056827b5b40356c0ef235e975e7e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n int error = rule->options.inject.error;\n \n bool immediately = rule->options.inject.immediately;\n+\n \n \n if (rule->options.inject.once) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int inject_error(BlockDriverState *bs, BlkdebugRule *rule)\n\n{\n\n BDRVBlkdebugState *s = bs->opaque;\n\n int error = rule->options.inject.error;\n\n bool immediately = rule->options.inject.immediately;\n\n\n\n if (rule->options.inject.once) {\n\n QSIMPLEQ_REMOVE(&s->active_rules, rule, BlkdebugRule, active_next);\n\n remove_rule(rule);\n\n }\n\n\n\n if (!immediately) {\n\n aio_bh_schedule_oneshot(bdrv_get_aio_context(bs), error_callback_bh,\n\n qemu_coroutine_self());\n\n qemu_coroutine_yield();\n\n }\n\n\n\n return -error;\n\n}\n"}} {"sample_id": "6687b79d636cd60ed9adb1177d0d946b58fa7717_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+int net_init_dump(QemuOpts *opts, const char *name, VLANState *vlan)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int net_init_dump(QemuOpts *opts, const char *name, VLANState *vlan)\n\n{\n\n int len;\n\n const char *file;\n\n char def_file[128];\n\n\n\n assert(vlan);\n\n\n\n file = qemu_opt_get(opts, \"file\");\n\n if (!file) {\n\n snprintf(def_file, sizeof(def_file), \"qemu-vlan%d.pcap\", vlan->id);\n\n file = def_file;\n\n }\n\n\n\n len = qemu_opt_get_size(opts, \"len\", 65536);\n\n\n\n return net_dump_init(vlan, \"dump\", name, file, len);\n\n}\n"}} {"sample_id": "db39fcf1f690b02d612e2bfc00980700887abe03_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n CharDriverState *chr = NULL;\n \n NetCharDriver *s = NULL;\n+\n+\n+\n+ chr = g_malloc0(sizeof(CharDriverState));\n+\n s = g_malloc0(sizeof(NetCharDriver));\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static CharDriverState *qemu_chr_open_udp_fd(int fd)\n\n{\n\n CharDriverState *chr = NULL;\n\n NetCharDriver *s = NULL;\n\n\n\n chr = g_malloc0(sizeof(CharDriverState));\n\n s = g_malloc0(sizeof(NetCharDriver));\n\n\n\n s->fd = fd;\n\n s->chan = io_channel_from_socket(s->fd);\n\n s->bufcnt = 0;\n\n s->bufptr = 0;\n\n chr->opaque = s;\n\n chr->chr_write = udp_chr_write;\n\n chr->chr_update_read_handler = udp_chr_update_read_handler;\n\n chr->chr_close = udp_chr_close;\n\n /* be isn't opened until we get a connection */\n\n chr->explicit_be_open = true;\n\n return chr;\n\n}\n"}} {"sample_id": "8190483196148f765c65785876f7b893d64b6cdd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n const char virtio_name[] = \"virtio-net-\";\n \n+\n \n driver = qemu_opt_get(opts, \"driver\");\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int net_vhost_check_net(void *opaque, QemuOpts *opts, Error **errp)\n\n{\n\n const char *name = opaque;\n\n const char *driver, *netdev;\n\n const char virtio_name[] = \"virtio-net-\";\n\n\n\n driver = qemu_opt_get(opts, \"driver\");\n\n netdev = qemu_opt_get(opts, \"netdev\");\n\n\n\n if (!driver || !netdev) {\n\n return 0;\n\n }\n\n\n\n if (strcmp(netdev, name) == 0 &&\n\n strncmp(driver, virtio_name, strlen(virtio_name)) != 0) {\n\n error_report(\"vhost-user requires frontend driver virtio-net-*\");\n\n return -1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "2a7e8dda090af586f3d0b3d157054a9e18776a52", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void do_change_vnc(const char *target)\n \n {\n+\n+ if (strcmp(target, \"passwd\") == 0 ||\n \n \tstrcmp(target, \"password\") == 0) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void do_change_vnc(const char *target)\n\n{\n\n if (strcmp(target, \"passwd\") == 0 ||\n\n\tstrcmp(target, \"password\") == 0) {\n\n\tchar password[9];\n\n\tmonitor_readline(\"Password: \", 1, password, sizeof(password)-1);\n\n\tpassword[sizeof(password)-1] = '\\0';\n\n\tif (vnc_display_password(NULL, password) < 0)\n\n\t term_printf(\"could not set VNC server password\\n\");\n\n } else {\n\n\tif (vnc_display_open(NULL, target) < 0)\n\n\t term_printf(\"could not start VNC server on %s\\n\", target);\n\n }\n\n}\n"}} {"sample_id": "76ef2cf5493a215efc351f48ae7094d6c183fcac", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n int raw_get_aio_fd(BlockDriverState *bs)\n \n+{\n+\n+ BDRVRawState *s;\n+\n+\n \n if (!bs->drv) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int raw_get_aio_fd(BlockDriverState *bs)\n\n{\n\n BDRVRawState *s;\n\n\n\n if (!bs->drv) {\n\n return -ENOMEDIUM;\n\n }\n\n\n\n if (bs->drv == bdrv_find_format(\"raw\")) {\n\n bs = bs->file;\n\n }\n\n\n\n /* raw-posix has several protocols so just check for raw_aio_readv */\n\n if (bs->drv->bdrv_aio_readv != raw_aio_readv) {\n\n return -ENOTSUP;\n\n }\n\n\n\n s = bs->opaque;\n\n if (!s->use_aio) {\n\n return -ENOTSUP;\n\n }\n\n return s->fd;\n\n}\n"}} {"sample_id": "51dcdbd319f8d46834d8155defc8d384a9958a73", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void s390_program_interrupt(CPUS390XState *env, uint32_t code, int ilen,\n+\n+ uintptr_t ra)\n+\n+{\n+\n #ifdef CONFIG_TCG\n \n S390CPU *cpu = s390_env_get_cpu(env);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void s390_program_interrupt(CPUS390XState *env, uint32_t code, int ilen,\n\n uintptr_t ra)\n\n{\n\n#ifdef CONFIG_TCG\n\n S390CPU *cpu = s390_env_get_cpu(env);\n\n\n\n if (tcg_enabled()) {\n\n cpu_restore_state(CPU(cpu), ra);\n\n }\n\n#endif\n\n program_interrupt(env, code, ilen);\n\n}\n"}} {"sample_id": "6baebed7698a37a0ac5168faf26023426b0ac940", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n static void vnc_resize(VncState *vs)\n \n {\n+\n+ DisplayState *ds = vs->ds;\n+\n+\n \n+ int size_changed;\n \n+\n+\n vs->old_data = qemu_realloc(vs->old_data, ds_get_linesize(ds) * ds_get_height(ds));\n \n \n@@ -19,8 +19,8 @@\n fprintf(stderr, \"vnc: memory allocation failed\\n\");\n \n exit(1);\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void vnc_resize(VncState *vs)\n\n{\n\n DisplayState *ds = vs->ds;\n\n\n\n int size_changed;\n\n\n\n vs->old_data = qemu_realloc(vs->old_data, ds_get_linesize(ds) * ds_get_height(ds));\n\n\n\n if (vs->old_data == NULL) {\n\n fprintf(stderr, \"vnc: memory allocation failed\\n\");\n\n exit(1);\n\n }\n\n\n\n if (ds_get_bytes_per_pixel(ds) != vs->serverds.pf.bytes_per_pixel)\n\n console_color_init(ds);\n\n vnc_colordepth(vs);\n\n size_changed = ds_get_width(ds) != vs->serverds.width ||\n\n ds_get_height(ds) != vs->serverds.height;\n\n vs->serverds = *(ds->surface);\n\n if (size_changed) {\n\n if (vs->csock != -1 && vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {\n\n vnc_write_u8(vs, 0); /* msg id */\n\n vnc_write_u8(vs, 0);\n\n vnc_write_u16(vs, 1); /* number of rects */\n\n vnc_framebuffer_update(vs, 0, 0, ds_get_width(ds), ds_get_height(ds),\n\n VNC_ENCODING_DESKTOPRESIZE);\n\n vnc_flush(vs);\n\n }\n\n }\n\n\n\n memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));\n\n memset(vs->old_data, 42, ds_get_linesize(vs->ds) * ds_get_height(vs->ds));\n\n}\n"}} {"sample_id": "635db18f68ded6abec11cd4cf64ebc15c1c6b190_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ Monitor *mon;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void monitor_qapi_event_emit(QAPIEvent event, QDict *qdict)\n\n{\n\n Monitor *mon;\n\n\n\n trace_monitor_protocol_event_emit(event, qdict);\n\n QLIST_FOREACH(mon, &mon_list, entry) {\n\n if (monitor_is_qmp(mon) && mon->qmp.in_command_mode) {\n\n monitor_json_emitter(mon, QOBJECT(qdict));\n\n }\n\n }\n\n}\n"}} {"sample_id": "b4049b74b97f30fe944c63b5f158ec9e87bd2593_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n return &qemu_clocks[type];\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "QEMUClock *qemu_clock_ptr(QEMUClockType type)\n\n{\n\n return &qemu_clocks[type];\n\n}\n"}} {"sample_id": "1da45e0c4cf4719fa75898d019e0874b9b2bc774", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,13 +10,13 @@\n \n if (iscsilun->allocmap == NULL) {\n \n+ return;\n \n }\n \n /* expand to entirely contain all affected clusters */\n \n+ cl_num_expanded = sector_num / iscsilun->cluster_sectors;\n \n nb_cls_expanded = DIV_ROUND_UP(sector_num + nb_sectors,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "iscsi_allocmap_update(IscsiLun *iscsilun, int64_t sector_num,\n\n int nb_sectors, bool allocated, bool valid)\n\n{\n\n int64_t cl_num_expanded, nb_cls_expanded, cl_num_shrunk, nb_cls_shrunk;\n\n\n\n if (iscsilun->allocmap == NULL) {\n\n return;\n\n }\n\n /* expand to entirely contain all affected clusters */\n\n cl_num_expanded = sector_num / iscsilun->cluster_sectors;\n\n nb_cls_expanded = DIV_ROUND_UP(sector_num + nb_sectors,\n\n iscsilun->cluster_sectors) - cl_num_expanded;\n\n /* shrink to touch only completely contained clusters */\n\n cl_num_shrunk = DIV_ROUND_UP(sector_num, iscsilun->cluster_sectors);\n\n nb_cls_shrunk = (sector_num + nb_sectors) / iscsilun->cluster_sectors\n\n - cl_num_shrunk;\n\n if (allocated) {\n\n bitmap_set(iscsilun->allocmap, cl_num_expanded, nb_cls_expanded);\n\n } else {\n\n bitmap_clear(iscsilun->allocmap, cl_num_shrunk, nb_cls_shrunk);\n\n }\n\n\n\n if (iscsilun->allocmap_valid == NULL) {\n\n return;\n\n }\n\n if (valid) {\n\n bitmap_set(iscsilun->allocmap_valid, cl_num_shrunk, nb_cls_shrunk);\n\n } else {\n\n bitmap_clear(iscsilun->allocmap_valid, cl_num_expanded,\n\n nb_cls_expanded);\n\n }\n\n}\n"}} {"sample_id": "c23acbaed40101c677dfcfbbfe0d2c230a8e8f44_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n static void vp8_idct_dc_add_c(uint8_t *dst, DCTELEM block[16], ptrdiff_t stride)\n \n+{\n \n int i, dc = (block[0] + 4) >> 3;\n+\n+ uint8_t *cm = ff_cropTbl + MAX_NEG_CROP + dc;\n+\n+ block[0] = 0;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void vp8_idct_dc_add_c(uint8_t *dst, DCTELEM block[16], ptrdiff_t stride)\n\n{\n\n int i, dc = (block[0] + 4) >> 3;\n\n uint8_t *cm = ff_cropTbl + MAX_NEG_CROP + dc;\n\n block[0] = 0;\n\n\n\n for (i = 0; i < 4; i++) {\n\n dst[0] = cm[dst[0]];\n\n dst[1] = cm[dst[1]];\n\n dst[2] = cm[dst[2]];\n\n dst[3] = cm[dst[3]];\n\n dst += stride;\n\n }\n\n}\n"}} {"sample_id": "16c429166ddf1736972b6ccce84bd3509ec16a34_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n+static int append_extradata(APNGDemuxContext *ctx, AVIOContext *pb, int len)\n+\n {\n \n int previous_size = ctx->extra_data_size;\n \n+ int new_size, ret;\n \n+ uint8_t *new_extradata;\n+\n+\n \n if (previous_size > INT_MAX - len)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int append_extradata(APNGDemuxContext *ctx, AVIOContext *pb, int len)\n\n{\n\n int previous_size = ctx->extra_data_size;\n\n int new_size, ret;\n\n uint8_t *new_extradata;\n\n\n\n if (previous_size > INT_MAX - len)\n\n return AVERROR_INVALIDDATA;\n\n\n\n new_size = previous_size + len;\n\n new_extradata = av_realloc(ctx->extra_data, new_size + AV_INPUT_BUFFER_PADDING_SIZE);\n\n if (!new_extradata)\n\n return AVERROR(ENOMEM);\n\n ctx->extra_data = new_extradata;\n\n ctx->extra_data_size = new_size;\n\n\n\n if ((ret = avio_read(pb, ctx->extra_data + previous_size, len)) < 0)\n\n return ret;\n\n\n\n return previous_size;\n\n}\n"}} {"sample_id": "a8a21be9855e0bb0947a7325d0d1741a8814f21e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n /* FIXME error_setg(errp, ...) on failure */\n \n const NetdevBridgeOptions *bridge;\n+\n const char *helper, *br;\n \n TAPState *s;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int net_init_bridge(const NetClientOptions *opts, const char *name,\n\n NetClientState *peer, Error **errp)\n\n{\n\n /* FIXME error_setg(errp, ...) on failure */\n\n const NetdevBridgeOptions *bridge;\n\n const char *helper, *br;\n\n TAPState *s;\n\n int fd, vnet_hdr;\n\n\n\n assert(opts->kind == NET_CLIENT_OPTIONS_KIND_BRIDGE);\n\n bridge = opts->bridge;\n\n\n\n helper = bridge->has_helper ? bridge->helper : DEFAULT_BRIDGE_HELPER;\n\n br = bridge->has_br ? bridge->br : DEFAULT_BRIDGE_INTERFACE;\n\n\n\n fd = net_bridge_run_helper(helper, br);\n\n if (fd == -1) {\n\n return -1;\n\n }\n\n\n\n fcntl(fd, F_SETFL, O_NONBLOCK);\n\n vnet_hdr = tap_probe_vnet_hdr(fd);\n\n s = net_tap_fd_init(peer, \"bridge\", name, fd, vnet_hdr);\n\n\n\n snprintf(s->nc.info_str, sizeof(s->nc.info_str), \"helper=%s,br=%s\", helper,\n\n br);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "3e305e4a4752f70c0b5c3cf5b43ec957881714f7_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n+static gnutls_anon_server_credentials_t vnc_tls_initialize_anon_cred(void)\n+\n+{\n+\n+ gnutls_anon_server_credentials_t anon_cred;\n+\n int ret;\n+\n+\n \n if ((ret = gnutls_anon_allocate_server_credentials(&anon_cred)) < 0) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static gnutls_anon_server_credentials_t vnc_tls_initialize_anon_cred(void)\n\n{\n\n gnutls_anon_server_credentials_t anon_cred;\n\n int ret;\n\n\n\n if ((ret = gnutls_anon_allocate_server_credentials(&anon_cred)) < 0) {\n\n VNC_DEBUG(\"Cannot allocate credentials %s\\n\", gnutls_strerror(ret));\n\n return NULL;\n\n }\n\n\n\n gnutls_anon_set_server_dh_params(anon_cred, dh_params);\n\n\n\n return anon_cred;\n\n}\n"}} {"sample_id": "e2779de053b64f023de382fd87b3596613d47d1e_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n writable_mask = reg->emu_mask & ~reg->ro_mask & valid_mask;\n \n+ cfg_entry->data = XEN_PT_MERGE_VALUE(*val, cfg_entry->data, writable_mask);\n+\n+\n+\n+ /* create value for writing to I/O device register */\n \n *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int xen_pt_byte_reg_write(XenPCIPassthroughState *s, XenPTReg *cfg_entry,\n\n uint8_t *val, uint8_t dev_value,\n\n uint8_t valid_mask)\n\n{\n\n XenPTRegInfo *reg = cfg_entry->reg;\n\n uint8_t writable_mask = 0;\n\n uint8_t throughable_mask = get_throughable_mask(s, reg, valid_mask);\n\n\n\n /* modify emulate register */\n\n writable_mask = reg->emu_mask & ~reg->ro_mask & valid_mask;\n\n cfg_entry->data = XEN_PT_MERGE_VALUE(*val, cfg_entry->data, writable_mask);\n\n\n\n /* create value for writing to I/O device register */\n\n *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "88be7b4be4aa17c88247e162bdd7577ea79db94f_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,24 +1,24 @@\n+BdrvNextIterator *bdrv_next(BdrvNextIterator *it, BlockDriverState **bs)\n+\n+{\n+\n+ if (!it) {\n \n it = g_new(BdrvNextIterator, 1);\n \n *it = (BdrvNextIterator) {\n+\n+ .phase = BDRV_NEXT_BACKEND_ROOTS,\n+\n+ };\n \n }\n \n \n \n+ /* First, return all root nodes of BlockBackends. In order to avoid\n+\n+ * returning a BDS twice when multiple BBs refer to it, we only return it\n \n * if the BB is the first one in the parent list of the BDS. */\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "BdrvNextIterator *bdrv_next(BdrvNextIterator *it, BlockDriverState **bs)\n\n{\n\n if (!it) {\n\n it = g_new(BdrvNextIterator, 1);\n\n *it = (BdrvNextIterator) {\n\n .phase = BDRV_NEXT_BACKEND_ROOTS,\n\n };\n\n }\n\n\n\n /* First, return all root nodes of BlockBackends. In order to avoid\n\n * returning a BDS twice when multiple BBs refer to it, we only return it\n\n * if the BB is the first one in the parent list of the BDS. */\n\n if (it->phase == BDRV_NEXT_BACKEND_ROOTS) {\n\n do {\n\n it->blk = blk_all_next(it->blk);\n\n *bs = it->blk ? blk_bs(it->blk) : NULL;\n\n } while (it->blk && (*bs == NULL || bdrv_first_blk(*bs) != it->blk));\n\n\n\n if (*bs) {\n\n return it;\n\n }\n\n it->phase = BDRV_NEXT_MONITOR_OWNED;\n\n }\n\n\n\n /* Then return the monitor-owned BDSes without a BB attached. Ignore all\n\n * BDSes that are attached to a BlockBackend here; they have been handled\n\n * by the above block already */\n\n do {\n\n it->bs = bdrv_next_monitor_owned(it->bs);\n\n *bs = it->bs;\n\n } while (*bs && bdrv_has_blk(*bs));\n\n\n\n return *bs ? it : NULL;\n\n}\n"}} {"sample_id": "1ad9f0a464fe78d30ee60b3629f7a825cf2fab13_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n struct kvm_get_htab_buf *hpte_buf;\n \n+\n+\n+ ghf.flags = 0;\n+\n+ ghf.start_index = pte_index;\n \n htab_fd = kvm_vm_ioctl(kvm_state, KVM_PPC_GET_HTAB_FD, &ghf);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint64_t kvmppc_hash64_read_pteg(PowerPCCPU *cpu, target_ulong pte_index)\n\n{\n\n int htab_fd;\n\n struct kvm_get_htab_fd ghf;\n\n struct kvm_get_htab_buf *hpte_buf;\n\n\n\n ghf.flags = 0;\n\n ghf.start_index = pte_index;\n\n htab_fd = kvm_vm_ioctl(kvm_state, KVM_PPC_GET_HTAB_FD, &ghf);\n\n if (htab_fd < 0) {\n\n goto error_out;\n\n }\n\n\n\n hpte_buf = g_malloc0(sizeof(*hpte_buf));\n\n /*\n\n * Read the hpte group\n\n */\n\n if (read(htab_fd, hpte_buf, sizeof(*hpte_buf)) < 0) {\n\n goto out_close;\n\n }\n\n\n\n close(htab_fd);\n\n return (uint64_t)(uintptr_t) hpte_buf->hpte;\n\n\n\nout_close:\n\n g_free(hpte_buf);\n\n close(htab_fd);\n\nerror_out:\n\n return 0;\n\n}\n"}} {"sample_id": "679aa175e84f5f80b32b307fce5a6b92729e0e61_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -41,11 +41,11 @@\n (irq < GIC_INTERNAL || GIC_TARGET(irq) & cm)) {\n \n if (GIC_GET_PRIORITY(irq, cpu) < best_prio) {\n+\n+ best_prio = GIC_GET_PRIORITY(irq, cpu);\n+\n+ best_irq = irq;\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void gic_update(GICState *s)\n\n{\n\n int best_irq;\n\n int best_prio;\n\n int irq;\n\n int level;\n\n int cpu;\n\n int cm;\n\n\n\n for (cpu = 0; cpu < NUM_CPU(s); cpu++) {\n\n cm = 1 << cpu;\n\n s->current_pending[cpu] = 1023;\n\n if (!s->enabled || !s->cpu_enabled[cpu]) {\n\n qemu_irq_lower(s->parent_irq[cpu]);\n\n return;\n\n }\n\n best_prio = 0x100;\n\n best_irq = 1023;\n\n for (irq = 0; irq < s->num_irq; irq++) {\n\n if (GIC_TEST_ENABLED(irq, cm) && gic_test_pending(s, irq, cm) &&\n\n (irq < GIC_INTERNAL || GIC_TARGET(irq) & cm)) {\n\n if (GIC_GET_PRIORITY(irq, cpu) < best_prio) {\n\n best_prio = GIC_GET_PRIORITY(irq, cpu);\n\n best_irq = irq;\n\n }\n\n }\n\n }\n\n level = 0;\n\n if (best_prio < s->priority_mask[cpu]) {\n\n s->current_pending[cpu] = best_irq;\n\n if (best_prio < s->running_priority[cpu]) {\n\n DPRINTF(\"Raised pending IRQ %d (cpu %d)\\n\", best_irq, cpu);\n\n level = 1;\n\n }\n\n }\n\n qemu_set_irq(s->parent_irq[cpu], level);\n\n }\n\n}\n"}} {"sample_id": "b2c98d9d392c87c9b9e975d30f79924719d9cbbe_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,8 +30,8 @@\n \n tcg_out_sh64(s, RSY_SLLG, dest, src, TCG_REG_NONE, 48);\n \n+ tcg_out_sh64(s, RSY_SRAG, dest, dest, TCG_REG_NONE, 48);\n+\n+ }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void tgen_ext16s(TCGContext *s, TCGType type, TCGReg dest, TCGReg src)\n\n{\n\n if (facilities & FACILITY_EXT_IMM) {\n\n tcg_out_insn(s, RRE, LGHR, dest, src);\n\n return;\n\n }\n\n\n\n if (type == TCG_TYPE_I32) {\n\n if (dest == src) {\n\n tcg_out_sh32(s, RS_SLL, dest, TCG_REG_NONE, 16);\n\n } else {\n\n tcg_out_sh64(s, RSY_SLLG, dest, src, TCG_REG_NONE, 16);\n\n }\n\n tcg_out_sh32(s, RS_SRA, dest, TCG_REG_NONE, 16);\n\n } else {\n\n tcg_out_sh64(s, RSY_SLLG, dest, src, TCG_REG_NONE, 48);\n\n tcg_out_sh64(s, RSY_SRAG, dest, dest, TCG_REG_NONE, 48);\n\n }\n\n}\n"}} {"sample_id": "57d24225595af78b0fd836d4d145f5d181e320a2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,9 +15,9 @@\n ost->is_past_recording_time = 1;\n \n return 0;\n+\n+ }\n+\n+ return 1;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int check_recording_time(OutputStream *ost)\n\n{\n\n OutputFile *of = output_files[ost->file_index];\n\n\n\n if (of->recording_time != INT64_MAX &&\n\n av_compare_ts(ost->sync_opts - ost->first_pts, ost->st->codec->time_base, of->recording_time,\n\n AV_TIME_BASE_Q) >= 0) {\n\n ost->is_past_recording_time = 1;\n\n return 0;\n\n }\n\n return 1;\n\n}\n"}} {"sample_id": "b4054100f675b395204f1a0471fba0b06fe08e9f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n static void close_decoder(QSVContext *q)\n \n {\n+\n+ QSVFrame *cur;\n+\n+\n+\n+ if (q->session)\n \n MFXVideoDECODE_Close(q->session);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void close_decoder(QSVContext *q)\n\n{\n\n QSVFrame *cur;\n\n\n\n if (q->session)\n\n MFXVideoDECODE_Close(q->session);\n\n\n\n while (q->async_fifo && av_fifo_size(q->async_fifo)) {\n\n QSVFrame *out_frame;\n\n mfxSyncPoint *sync;\n\n\n\n av_fifo_generic_read(q->async_fifo, &out_frame, sizeof(out_frame), NULL);\n\n av_fifo_generic_read(q->async_fifo, &sync, sizeof(sync), NULL);\n\n\n\n av_freep(&sync);\n\n }\n\n\n\n cur = q->work_frames;\n\n while (cur) {\n\n q->work_frames = cur->next;\n\n av_frame_free(&cur->frame);\n\n av_freep(&cur);\n\n cur = q->work_frames;\n\n }\n\n\n\n q->engine_ready = 0;\n\n q->reinit_pending = 0;\n\n}\n"}} {"sample_id": "a8dbe9514f865f6a8efb304a720025cb1ef9ae3f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n int i;\n+\n+\n+\n+ if (s->iformat->read_close)\n+\n s->iformat->read_close(s);\n \n for(i=0;inb_streams;i++) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void av_close_input_file(AVFormatContext *s)\n\n{\n\n int i;\n\n\n\n if (s->iformat->read_close)\n\n s->iformat->read_close(s);\n\n for(i=0;inb_streams;i++) {\n\n av_free(s->streams[i]);\n\n }\n\n if (s->packet_buffer) {\n\n AVPacketList *p, *p1;\n\n p = s->packet_buffer;\n\n while (p != NULL) {\n\n p1 = p->next;\n\n av_free_packet(&p->pkt);\n\n av_free(p);\n\n p = p1;\n\n }\n\n s->packet_buffer = NULL;\n\n }\n\n if (!(s->iformat->flags & AVFMT_NOFILE)) {\n\n url_fclose(&s->pb);\n\n }\n\n av_free(s->priv_data);\n\n av_free(s);\n\n}\n"}} {"sample_id": "cc8fa0e80836c51ba644d910cd89540a5bc83fc2_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n \n \n+ if (out) {\n+\n+ g_free(out);\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool iasl_installed(void)\n\n{\n\n gchar *out = NULL, *out_err = NULL;\n\n bool ret;\n\n\n\n /* pass 'out' and 'out_err' in order to be redirected */\n\n ret = g_spawn_command_line_sync(\"iasl\", &out, &out_err, NULL, NULL);\n\n\n\n if (out_err) {\n\n ret = ret && (out_err[0] == '\\0');\n\n g_free(out_err);\n\n }\n\n\n\n if (out) {\n\n g_free(out);\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "036f7166c73a9e0cc1b2f10c03763e61894a1033_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n \n switch (ret) {\n \n+ case -EEXIST:\n+\n+ fprintf(stderr, \"property \\\"%s.%s\\\": \\\"%s\\\" is already in use\\n\",\n+\n+ dev->info->name, name, value);\n \n break;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qdev_prop_parse(DeviceState *dev, const char *name, const char *value)\n\n{\n\n Property *prop;\n\n int ret;\n\n\n\n prop = qdev_prop_find(dev, name);\n\n if (!prop) {\n\n fprintf(stderr, \"property \\\"%s.%s\\\" not found\\n\",\n\n dev->info->name, name);\n\n return -1;\n\n }\n\n if (!prop->info->parse) {\n\n fprintf(stderr, \"property \\\"%s.%s\\\" has no parser\\n\",\n\n dev->info->name, name);\n\n return -1;\n\n }\n\n ret = prop->info->parse(dev, prop, value);\n\n if (ret < 0) {\n\n switch (ret) {\n\n case -EEXIST:\n\n fprintf(stderr, \"property \\\"%s.%s\\\": \\\"%s\\\" is already in use\\n\",\n\n dev->info->name, name, value);\n\n break;\n\n default:\n\n case -EINVAL:\n\n fprintf(stderr, \"property \\\"%s.%s\\\": failed to parse \\\"%s\\\"\\n\",\n\n dev->info->name, name, value);\n\n break;\n\n case -ENOENT:\n\n fprintf(stderr, \"property \\\"%s.%s\\\": could not find \\\"%s\\\"\\n\",\n\n dev->info->name, name, value);\n\n break;\n\n }\n\n return -1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "e30f328c7429d4e891ce6da26af95c607f392739", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n VirtQueueElement elem;\n \n+ VirtQueue *vq;\n+\n+ size_t offset = 0;\n+\n+ size_t len = 0;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static size_t write_to_port(VirtIOSerialPort *port,\n\n const uint8_t *buf, size_t size)\n\n{\n\n VirtQueueElement elem;\n\n VirtQueue *vq;\n\n size_t offset = 0;\n\n size_t len = 0;\n\n\n\n vq = port->ivq;\n\n if (!virtio_queue_ready(vq)) {\n\n return 0;\n\n }\n\n if (!size) {\n\n return 0;\n\n }\n\n\n\n while (offset < size) {\n\n int i;\n\n\n\n if (!virtqueue_pop(vq, &elem)) {\n\n break;\n\n }\n\n\n\n for (i = 0; offset < size && i < elem.in_num; i++) {\n\n len = MIN(elem.in_sg[i].iov_len, size - offset);\n\n\n\n memcpy(elem.in_sg[i].iov_base, buf + offset, len);\n\n offset += len;\n\n }\n\n virtqueue_push(vq, &elem, len);\n\n }\n\n\n\n virtio_notify(&port->vser->vdev, vq);\n\n return offset;\n\n}\n"}} {"sample_id": "1c275925bfbbc2de84a8f0e09d1dd70bbefb6da3_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n qemu_log(\"%s: frame_addr 0x%llx\\n\", __FUNCTION__,\n \n (unsigned long long)frame_addr);\n+\n+ target_sigset_t target_set;\n+\n+ sigset_t set;\n+\n \n \n if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1)) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "long do_sigreturn(CPUS390XState *env)\n\n{\n\n sigframe *frame;\n\n abi_ulong frame_addr = env->regs[15];\n\n qemu_log(\"%s: frame_addr 0x%llx\\n\", __FUNCTION__,\n\n (unsigned long long)frame_addr);\n\n target_sigset_t target_set;\n\n sigset_t set;\n\n\n\n if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1)) {\n\n goto badframe;\n\n }\n\n if (__get_user(target_set.sig[0], &frame->sc.oldmask[0])) {\n\n goto badframe;\n\n }\n\n\n\n target_to_host_sigset_internal(&set, &target_set);\n\n sigprocmask(SIG_SETMASK, &set, NULL); /* ~_BLOCKABLE? */\n\n\n\n if (restore_sigregs(env, &frame->sregs)) {\n\n goto badframe;\n\n }\n\n\n\n unlock_user_struct(frame, frame_addr, 0);\n\n return env->regs[2];\n\n\n\nbadframe:\n\n unlock_user_struct(frame, frame_addr, 0);\n\n force_sig(TARGET_SIGSEGV);\n\n return 0;\n\n}\n"}} {"sample_id": "cfaadf0e89e7c2a47462d5f96390c9a9b4de037c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void fw_cfg_mem_realize(DeviceState *dev, Error **errp)\n \n {\n+\n+ FWCfgMemState *s = FW_CFG_MEM(dev);\n+\n+ SysBusDevice *sbd = SYS_BUS_DEVICE(dev);\n+\n \n \n memory_region_init_io(&s->ctl_iomem, OBJECT(s), &fw_cfg_ctl_mem_ops,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void fw_cfg_mem_realize(DeviceState *dev, Error **errp)\n\n{\n\n FWCfgMemState *s = FW_CFG_MEM(dev);\n\n SysBusDevice *sbd = SYS_BUS_DEVICE(dev);\n\n\n\n memory_region_init_io(&s->ctl_iomem, OBJECT(s), &fw_cfg_ctl_mem_ops,\n\n FW_CFG(s), \"fwcfg.ctl\", FW_CFG_SIZE);\n\n sysbus_init_mmio(sbd, &s->ctl_iomem);\n\n\n\n memory_region_init_io(&s->data_iomem, OBJECT(s), &fw_cfg_data_mem_ops,\n\n FW_CFG(s), \"fwcfg.data\",\n\n fw_cfg_data_mem_ops.valid.max_access_size);\n\n sysbus_init_mmio(sbd, &s->data_iomem);\n\n}\n"}} {"sample_id": "28ec2598ff7d74bd9556a1786f45fc5df2aacfe1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n return -1;\n \n+ }\n+\n+\n+\n+ object_property_add_child(container_get(object_get_root(), \"/objects\"),\n \n id, obj, NULL);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int object_create(QemuOpts *opts, void *opaque)\n\n{\n\n const char *type = qemu_opt_get(opts, \"qom-type\");\n\n const char *id = qemu_opts_id(opts);\n\n Object *obj;\n\n\n\n g_assert(type != NULL);\n\n\n\n if (id == NULL) {\n\n qerror_report(QERR_MISSING_PARAMETER, \"id\");\n\n return -1;\n\n }\n\n\n\n obj = object_new(type);\n\n if (qemu_opt_foreach(opts, object_set_property, obj, 1) < 0) {\n\n return -1;\n\n }\n\n\n\n object_property_add_child(container_get(object_get_root(), \"/objects\"),\n\n id, obj, NULL);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "b45c03f585ea9bb1af76c73e82195418c294919d_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static struct omap_mcbsp_s *omap_mcbsp_init(MemoryRegion *system_memory,\n+\n hwaddr base,\n \n qemu_irq txirq, qemu_irq rxirq,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static struct omap_mcbsp_s *omap_mcbsp_init(MemoryRegion *system_memory,\n\n hwaddr base,\n\n qemu_irq txirq, qemu_irq rxirq,\n\n qemu_irq *dma, omap_clk clk)\n\n{\n\n struct omap_mcbsp_s *s = (struct omap_mcbsp_s *)\n\n g_malloc0(sizeof(struct omap_mcbsp_s));\n\n\n\n s->txirq = txirq;\n\n s->rxirq = rxirq;\n\n s->txdrq = dma[0];\n\n s->rxdrq = dma[1];\n\n s->sink_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, omap_mcbsp_sink_tick, s);\n\n s->source_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, omap_mcbsp_source_tick, s);\n\n omap_mcbsp_reset(s);\n\n\n\n memory_region_init_io(&s->iomem, NULL, &omap_mcbsp_ops, s, \"omap-mcbsp\", 0x800);\n\n memory_region_add_subregion(system_memory, base, &s->iomem);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "4a48aaa9f52dbac148be24f591de2f28c58ccb5d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n if (ret < 0) {\n if (!gnutls_error_is_fatal(ret)) {\n VNC_DEBUG(\"Handshake interrupted (blocking)\\n\");\n+ if (!gnutls_record_get_direction(vs->tls.session)) {\n+ qemu_set_fd_handler(vs->csock, vncws_tls_handshake_io,\n+ NULL, vs);\n+ qemu_set_fd_handler(vs->csock, NULL, vncws_tls_handshake_io,\n vs);\n return 0;\n VNC_DEBUG(\"Handshake failed %s\\n\", gnutls_strerror(ret));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int vncws_start_tls_handshake(struct VncState *vs)\n{\n int ret = gnutls_handshake(vs->tls.session);\n if (ret < 0) {\n if (!gnutls_error_is_fatal(ret)) {\n VNC_DEBUG(\"Handshake interrupted (blocking)\\n\");\n if (!gnutls_record_get_direction(vs->tls.session)) {\n qemu_set_fd_handler(vs->csock, vncws_tls_handshake_io,\n NULL, vs);\n qemu_set_fd_handler(vs->csock, NULL, vncws_tls_handshake_io,\n vs);\n return 0;\n VNC_DEBUG(\"Handshake failed %s\\n\", gnutls_strerror(ret));\n VNC_DEBUG(\"Handshake done, switching to TLS data mode\\n\");\n qemu_set_fd_handler2(vs->csock, NULL, vncws_handshake_read, NULL, vs);\n return 0;"}} {"sample_id": "f366e729f9231e7176e96dba16ddfb6b4b3ab1a8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void adb_keyboard_event(DeviceState *dev, QemuConsole *src,\n \n InputEvent *evt)\n+\n+{\n+\n+ KBDState *s = (KBDState *)dev;\n+\n int qcode, keycode;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void adb_keyboard_event(DeviceState *dev, QemuConsole *src,\n\n InputEvent *evt)\n\n{\n\n KBDState *s = (KBDState *)dev;\n\n int qcode, keycode;\n\n\n\n qcode = qemu_input_key_value_to_qcode(evt->u.key.data->key);\n\n if (qcode >= ARRAY_SIZE(qcode_to_adb_keycode)) {\n\n return;\n\n }\n\n keycode = qcode_to_adb_keycode[qcode];\n\n\n\n if (evt->u.key.data->down == false) { /* if key release event */\n\n keycode = keycode | 0x80; /* create keyboard break code */\n\n }\n\n\n\n adb_kbd_put_keycode(s, keycode);\n\n}\n"}} {"sample_id": "9b2fadda3e0196ffd485adde4fe9cdd6fae35300_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n static void gen_tlbivax_booke206(DisasContext *ctx)\n+\n+{\n+\n+#if defined(CONFIG_USER_ONLY)\n \n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n \n #else\n \n TCGv t0;\n+\n if (unlikely(ctx->pr)) {\n \n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_tlbivax_booke206(DisasContext *ctx)\n\n{\n\n#if defined(CONFIG_USER_ONLY)\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n#else\n\n TCGv t0;\n\n if (unlikely(ctx->pr)) {\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n return;\n\n }\n\n\n\n t0 = tcg_temp_new();\n\n gen_addr_reg_index(ctx, t0);\n\n\n\n gen_helper_booke206_tlbivax(cpu_env, t0);\n\n tcg_temp_free(t0);\n\n#endif\n\n}\n"}} {"sample_id": "0058584580b87feb47898e60e4b80c7f425882ad_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n sync_info->crc1 = get_bits(gb, 16);\n \n sync_info->fscod = get_bits(gb, 2);\n+\n+ if (sync_info->fscod == 0x03)\n+\n+ return -1;\n+\n sync_info->frmsizecod = get_bits(gb, 6);\n \n if (sync_info->frmsizecod >= 0x38)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ac3_parse_sync_info(AC3DecodeContext *ctx)\n\n{\n\n ac3_sync_info *sync_info = &ctx->sync_info;\n\n GetBitContext *gb = &ctx->gb;\n\n\n\n sync_info->sync_word = get_bits(gb, 16);\n\n sync_info->crc1 = get_bits(gb, 16);\n\n sync_info->fscod = get_bits(gb, 2);\n\n if (sync_info->fscod == 0x03)\n\n return -1;\n\n sync_info->frmsizecod = get_bits(gb, 6);\n\n if (sync_info->frmsizecod >= 0x38)\n\n return -1;\n\n sync_info->sampling_rate = ac3_freqs[sync_info->fscod];\n\n sync_info->bit_rate = ac3_bitratetab[sync_info->frmsizecod >> 1];\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n \tif (r < 0 || r > 15)\n \n \t\tfprintf(stderr, \"wrong register write $p%d\\n\", r);\n+\n+\tif (r == PR_BZ || r == PR_WZ || r == PR_DZ)\n+\n+\t\treturn;\n+\n \telse if (r == PR_SRS)\n \n \t\ttcg_gen_andi_tl(cpu_PR[r], tn, 3);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void t_gen_mov_preg_TN(DisasContext *dc, int r, TCGv tn)\n\n{\n\n\tif (r < 0 || r > 15)\n\n\t\tfprintf(stderr, \"wrong register write $p%d\\n\", r);\n\n\tif (r == PR_BZ || r == PR_WZ || r == PR_DZ)\n\n\t\treturn;\n\n\telse if (r == PR_SRS)\n\n\t\ttcg_gen_andi_tl(cpu_PR[r], tn, 3);\n\n\telse {\n\n\t\tif (r == PR_PID) \n\n\t\t\ttcg_gen_helper_0_1(helper_tlb_flush_pid, tn);\n\n\t\tif (dc->tb_flags & S_FLAG && r == PR_SPC) \n\n\t\t\ttcg_gen_helper_0_1(helper_spc_write, tn);\n\n\t\telse if (r == PR_CCS)\n\n\t\t\tdc->cpustate_changed = 1;\n\n\t\ttcg_gen_mov_tl(cpu_PR[r], tn);\n\n\t}\n\n}\n"}} {"sample_id": "9a4c0e220d8a4f82b5665d0ee95ef94d8e1509d5_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n virtio_pci_modern_mem_region_unmap(proxy, &proxy->device);\n \n virtio_pci_modern_mem_region_unmap(proxy, &proxy->notify);\n+\n+ if (modern_pio) {\n+\n+ virtio_pci_modern_io_region_unmap(proxy, &proxy->notify_pio);\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_pci_device_unplugged(DeviceState *d)\n\n{\n\n VirtIOPCIProxy *proxy = VIRTIO_PCI(d);\n\n bool modern = !(proxy->flags & VIRTIO_PCI_FLAG_DISABLE_MODERN);\n\n bool modern_pio = proxy->flags & VIRTIO_PCI_FLAG_MODERN_PIO_NOTIFY;\n\n\n\n virtio_pci_stop_ioeventfd(proxy);\n\n\n\n if (modern) {\n\n virtio_pci_modern_mem_region_unmap(proxy, &proxy->common);\n\n virtio_pci_modern_mem_region_unmap(proxy, &proxy->isr);\n\n virtio_pci_modern_mem_region_unmap(proxy, &proxy->device);\n\n virtio_pci_modern_mem_region_unmap(proxy, &proxy->notify);\n\n if (modern_pio) {\n\n virtio_pci_modern_io_region_unmap(proxy, &proxy->notify_pio);\n\n }\n\n }\n\n}\n"}} {"sample_id": "7e2515e87c41e2e658aaed466e11cbdf1ea8bcb1_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n \n \n+ for (i = 0; i < TERM_MAX_CMDS; i++) {\n+\n+\tif (term_history[i] == NULL)\n+\n \t break;\n \n \tterm_printf(\"%d: '%s'\\n\", i, term_history[i]);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void do_info_history (void)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < TERM_MAX_CMDS; i++) {\n\n\tif (term_history[i] == NULL)\n\n\t break;\n\n\tterm_printf(\"%d: '%s'\\n\", i, term_history[i]);\n\n }\n\n}\n"}} {"sample_id": "124fe7fb1b7a1db8cb2ebb9edae84716ffaf37ce", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n {\n VReaderListEntry *current_entry;\n VReaderListEntry *next_entry = NULL;\n+ VReaderList *list = vreader_get_reader_list();\n+ for (current_entry = vreader_list_get_first(list); current_entry;\n+ current_entry = next_entry) {\n VReader *vreader = vreader_list_get_reader(current_entry);\n next_entry = vreader_list_get_next(current_entry);\n vreader_queue_card_event(vreader);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "vcard_emul_replay_insertion_events(void)\n{\n VReaderListEntry *current_entry;\n VReaderListEntry *next_entry = NULL;\n VReaderList *list = vreader_get_reader_list();\n for (current_entry = vreader_list_get_first(list); current_entry;\n current_entry = next_entry) {\n VReader *vreader = vreader_list_get_reader(current_entry);\n next_entry = vreader_list_get_next(current_entry);\n vreader_queue_card_event(vreader);\n }\n}"}} {"sample_id": "b7b5233ad7fdd9985bb6d05b7919f3a20723ff2c_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+void *g_malloc(size_t size)\n+\n+{\n+\n+ char * p;\n+\n size += 16;\n \n p = bsd_vmalloc(size);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void *g_malloc(size_t size)\n\n{\n\n char * p;\n\n size += 16;\n\n p = bsd_vmalloc(size);\n\n *(size_t *)p = size;\n\n return p + 16;\n\n}\n"}} {"sample_id": "5c8d6f008c0555b54cf10550fa86199a2cfabbca_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void css_generate_sch_crws(uint8_t cssid, uint8_t ssid, uint16_t schid,\n+\n+ int hotplugged, int add)\n+\n+{\n+\n uint8_t guest_cssid;\n \n bool chain_crw;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void css_generate_sch_crws(uint8_t cssid, uint8_t ssid, uint16_t schid,\n\n int hotplugged, int add)\n\n{\n\n uint8_t guest_cssid;\n\n bool chain_crw;\n\n\n\n if (add && !hotplugged) {\n\n return;\n\n }\n\n if (channel_subsys.max_cssid == 0) {\n\n /* Default cssid shows up as 0. */\n\n guest_cssid = (cssid == channel_subsys.default_cssid) ? 0 : cssid;\n\n } else {\n\n /* Show real cssid to the guest. */\n\n guest_cssid = cssid;\n\n }\n\n /*\n\n * Only notify for higher subchannel sets/channel subsystems if the\n\n * guest has enabled it.\n\n */\n\n if ((ssid > channel_subsys.max_ssid) ||\n\n (guest_cssid > channel_subsys.max_cssid) ||\n\n ((channel_subsys.max_cssid == 0) &&\n\n (cssid != channel_subsys.default_cssid))) {\n\n return;\n\n }\n\n chain_crw = (channel_subsys.max_ssid > 0) ||\n\n (channel_subsys.max_cssid > 0);\n\n css_queue_crw(CRW_RSC_SUBCH, CRW_ERC_IPI, chain_crw ? 1 : 0, schid);\n\n if (chain_crw) {\n\n css_queue_crw(CRW_RSC_SUBCH, CRW_ERC_IPI, 0,\n\n (guest_cssid << 8) | (ssid << 4));\n\n }\n\n /* RW_ERC_IPI --> clear pending interrupts */\n\n css_clear_io_interrupt(css_do_build_subchannel_id(cssid, ssid), schid);\n\n}\n"}} {"sample_id": "dd561441b1e849df7d8681c6f32af82d4088dafd_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void h264_v_loop_filter_chroma_intra_c(uint8_t *pix, int stride, int alpha, int beta)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void h264_v_loop_filter_chroma_intra_c(uint8_t *pix, int stride, int alpha, int beta)\n\n{\n\n h264_loop_filter_chroma_intra_c(pix, stride, 1, alpha, beta);\n\n}\n"}} {"sample_id": "2d3aa28cc2cf382aa04cd577e0be542175eea9bd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void object_property_set_link(Object *obj, Object *value,\n+\n const char *name, Error **errp)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "void object_property_set_link(Object *obj, Object *value,\n\n const char *name, Error **errp)\n\n{\n\n object_property_set_str(obj, object_get_canonical_path(value),\n\n name, errp);\n\n}\n"}} {"sample_id": "4eb938102b3d533e142de23e255e46da1326fc5a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n if (f->last_error == 0) {\n \n f->last_error = ret;\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_file_set_error(QEMUFile *f, int ret)\n\n{\n\n if (f->last_error == 0) {\n\n f->last_error = ret;\n\n }\n\n}\n"}} {"sample_id": "9b7a8bddac52bd05dddb28afd4dff92739946d3b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int udp_close(URLContext *h)\n+\n {\n \n UDPContext *s = h->priv_data;\n \n+\n \n if (s->is_multicast && (h->flags & AVIO_FLAG_READ))\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int udp_close(URLContext *h)\n\n{\n\n UDPContext *s = h->priv_data;\n\n\n\n if (s->is_multicast && (h->flags & AVIO_FLAG_READ))\n\n udp_leave_multicast_group(s->udp_fd, (struct sockaddr *)&s->dest_addr,(struct sockaddr *)&s->local_addr_storage);\n\n closesocket(s->udp_fd);\n\n#if HAVE_PTHREAD_CANCEL\n\n if (s->thread_started) {\n\n int ret;\n\n pthread_cancel(s->circular_buffer_thread);\n\n ret = pthread_join(s->circular_buffer_thread, NULL);\n\n if (ret != 0)\n\n av_log(h, AV_LOG_ERROR, \"pthread_join(): %s\\n\", strerror(ret));\n\n pthread_mutex_destroy(&s->mutex);\n\n pthread_cond_destroy(&s->cond);\n\n }\n\n#endif\n\n av_fifo_freep(&s->fifo);\n\n return 0;\n\n}\n"}} {"sample_id": "009f829dde811af654af7110326aea3a72c05d5e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static inline void RENAME(yuv2bgr24_1)(SwsContext *c, const uint16_t *buf0,\n+\n const uint16_t *ubuf0, const uint16_t *ubuf1,\n \n+ const uint16_t *vbuf0, const uint16_t *vbuf1,\n \n+ const uint16_t *abuf0, uint8_t *dest,\n \n int dstW, int uvalpha, enum PixelFormat dstFormat,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void RENAME(yuv2bgr24_1)(SwsContext *c, const uint16_t *buf0,\n\n const uint16_t *ubuf0, const uint16_t *ubuf1,\n\n const uint16_t *vbuf0, const uint16_t *vbuf1,\n\n const uint16_t *abuf0, uint8_t *dest,\n\n int dstW, int uvalpha, enum PixelFormat dstFormat,\n\n int flags, int y)\n\n{\n\n x86_reg uv_off = c->uv_off << 1;\n\n const uint16_t *buf1= buf0; //FIXME needed for RGB1/BGR1\n\n\n\n if (uvalpha < 2048) { // note this is not correct (shifts chrominance by 0.5 pixels) but it is a bit faster\n\n __asm__ volatile(\n\n \"mov %%\"REG_b\", \"ESP_OFFSET\"(%5) \\n\\t\"\n\n \"mov %4, %%\"REG_b\" \\n\\t\"\n\n \"push %%\"REG_BP\" \\n\\t\"\n\n YSCALEYUV2RGB1(%%REGBP, %5, %6)\n\n \"pxor %%mm7, %%mm7 \\n\\t\"\n\n WRITEBGR24(%%REGb, 8280(%5), %%REGBP)\n\n \"pop %%\"REG_BP\" \\n\\t\"\n\n \"mov \"ESP_OFFSET\"(%5), %%\"REG_b\" \\n\\t\"\n\n :: \"c\" (buf0), \"d\" (buf1), \"S\" (ubuf0), \"D\" (ubuf1), \"m\" (dest),\n\n \"a\" (&c->redDither), \"m\"(uv_off)\n\n );\n\n } else {\n\n __asm__ volatile(\n\n \"mov %%\"REG_b\", \"ESP_OFFSET\"(%5) \\n\\t\"\n\n \"mov %4, %%\"REG_b\" \\n\\t\"\n\n \"push %%\"REG_BP\" \\n\\t\"\n\n YSCALEYUV2RGB1b(%%REGBP, %5, %6)\n\n \"pxor %%mm7, %%mm7 \\n\\t\"\n\n WRITEBGR24(%%REGb, 8280(%5), %%REGBP)\n\n \"pop %%\"REG_BP\" \\n\\t\"\n\n \"mov \"ESP_OFFSET\"(%5), %%\"REG_b\" \\n\\t\"\n\n :: \"c\" (buf0), \"d\" (buf1), \"S\" (ubuf0), \"D\" (ubuf1), \"m\" (dest),\n\n \"a\" (&c->redDither), \"m\"(uv_off)\n\n );\n\n }\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_45", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int qemu_rdma_registration_start(QEMUFile *f, void *opaque,\n+\n+ uint64_t flags)\n+\n+{\n+\n QEMUFileRDMA *rfile = opaque;\n \n RDMAContext *rdma = rfile->rdma;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int qemu_rdma_registration_start(QEMUFile *f, void *opaque,\n\n uint64_t flags)\n\n{\n\n QEMUFileRDMA *rfile = opaque;\n\n RDMAContext *rdma = rfile->rdma;\n\n\n\n CHECK_ERROR_STATE();\n\n\n\n DDDPRINTF(\"start section: %\" PRIu64 \"\\n\", flags);\n\n qemu_put_be64(f, RAM_SAVE_FLAG_HOOK);\n\n qemu_fflush(f);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "fd56e0612b6454a282fa6a953fdb09281a98c589_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n ACPI_PCIHP_PROP_BSEL \"' set\");\n \n return;\n+\n+ }\n+\n+\n+\n /* Don't send event when device is enabled during qemu machine creation:\n \n * it is present on boot, no hotplug event is necessary. We do send an", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void acpi_pcihp_device_plug_cb(HotplugHandler *hotplug_dev, AcpiPciHpState *s,\n\n DeviceState *dev, Error **errp)\n\n{\n\n PCIDevice *pdev = PCI_DEVICE(dev);\n\n int slot = PCI_SLOT(pdev->devfn);\n\n int bsel = acpi_pcihp_get_bsel(pdev->bus);\n\n if (bsel < 0) {\n\n error_setg(errp, \"Unsupported bus. Bus doesn't have property '\"\n\n ACPI_PCIHP_PROP_BSEL \"' set\");\n\n return;\n\n }\n\n\n\n /* Don't send event when device is enabled during qemu machine creation:\n\n * it is present on boot, no hotplug event is necessary. We do send an\n\n * event when the device is disabled later. */\n\n if (!dev->hotplugged) {\n\n return;\n\n }\n\n\n\n s->acpi_pcihp_pci_status[bsel].up |= (1U << slot);\n\n acpi_send_event(DEVICE(hotplug_dev), ACPI_PCI_HOTPLUG_STATUS);\n\n}\n"}} {"sample_id": "1ec83d9a9e472f485897ac92bad9631d551a8c5b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n case TIFF_SHORT : return add_shorts_metadata(buf, count, name, sep, s);\n \n default : return AVERROR_INVALIDDATA;\n+\n+ };\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int add_metadata(const uint8_t **buf, int count, int type,\n\n const char *name, const char *sep, TiffContext *s)\n\n{\n\n switch(type) {\n\n case TIFF_DOUBLE: return add_doubles_metadata(buf, count, name, sep, s);\n\n case TIFF_SHORT : return add_shorts_metadata(buf, count, name, sep, s);\n\n default : return AVERROR_INVALIDDATA;\n\n };\n\n}\n"}} {"sample_id": "056fca7b51d949aa0e18e0eb647838874a53bcbe_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n \n \n sc = I2C_SLAVE_GET_CLASS(QLIST_FIRST(&bus->current_devs)->elt);\n+\n+ if (sc->recv) {\n+\n+ return sc->recv(QLIST_FIRST(&bus->current_devs)->elt);\n+\n }\n \n return -1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int i2c_recv(I2CBus *bus)\n\n{\n\n I2CSlaveClass *sc;\n\n\n\n if ((QLIST_EMPTY(&bus->current_devs)) || (bus->broadcast)) {\n\n return -1;\n\n }\n\n\n\n sc = I2C_SLAVE_GET_CLASS(QLIST_FIRST(&bus->current_devs)->elt);\n\n if (sc->recv) {\n\n return sc->recv(QLIST_FIRST(&bus->current_devs)->elt);\n\n }\n\n return -1;\n\n}\n"}} {"sample_id": "09b23786b3986502ee88d4907356979127169bdd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,21 +1,21 @@\n+static const uint8_t *pcx_rle_decode(const uint8_t *src,\n \n const uint8_t *end,\n \n+ uint8_t *dst,\n \n+ unsigned int bytes_per_scanline,\n+\n int compressed)\n+\n {\n \n unsigned int i = 0;\n \n+ unsigned char run, value;\n+\n \n+\n if (compressed) {\n \n while (i < bytes_per_scanline && src < end) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static const uint8_t *pcx_rle_decode(const uint8_t *src,\n\n const uint8_t *end,\n\n uint8_t *dst,\n\n unsigned int bytes_per_scanline,\n\n int compressed)\n\n{\n\n unsigned int i = 0;\n\n unsigned char run, value;\n\n\n\n if (compressed) {\n\n while (i < bytes_per_scanline && src < end) {\n\n run = 1;\n\n value = *src++;\n\n if (value >= 0xc0 && src < end) {\n\n run = value & 0x3f;\n\n value = *src++;\n\n }\n\n while (i < bytes_per_scanline && run--)\n\n dst[i++] = value;\n\n }\n\n } else {\n\n memcpy(dst, src, bytes_per_scanline);\n\n src += bytes_per_scanline;\n\n }\n\n\n\n return src;\n\n}\n"}} {"sample_id": "de258eb07db6cf893ef1bfad8c0cedc0b983db55", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void page_set_flags(target_ulong start, target_ulong end, int flags)\n \n+{\n \n target_ulong addr, len;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void page_set_flags(target_ulong start, target_ulong end, int flags)\n\n{\n\n target_ulong addr, len;\n\n\n\n /* This function should never be called with addresses outside the\n\n guest address space. If this assert fires, it probably indicates\n\n a missing call to h2g_valid. */\n\n#if TARGET_ABI_BITS > L1_MAP_ADDR_SPACE_BITS\n\n assert(end < ((target_ulong)1 << L1_MAP_ADDR_SPACE_BITS));\n\n#endif\n\n assert(start < end);\n\n assert_memory_lock();\n\n\n\n start = start & TARGET_PAGE_MASK;\n\n end = TARGET_PAGE_ALIGN(end);\n\n\n\n if (flags & PAGE_WRITE) {\n\n flags |= PAGE_WRITE_ORG;\n\n }\n\n\n\n for (addr = start, len = end - start;\n\n len != 0;\n\n len -= TARGET_PAGE_SIZE, addr += TARGET_PAGE_SIZE) {\n\n PageDesc *p = page_find_alloc(addr >> TARGET_PAGE_BITS, 1);\n\n\n\n /* If the write protection bit is set, then we invalidate\n\n the code inside. */\n\n if (!(p->flags & PAGE_WRITE) &&\n\n (flags & PAGE_WRITE) &&\n\n p->first_tb) {\n\n tb_invalidate_phys_page(addr, 0);\n\n }\n\n p->flags = flags;\n\n }\n\n}\n"}} {"sample_id": "89f26e6b7b5e5c9657f2abd6ef5a336bea11add2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n * the fifo-reading code, and the next byte of data\n * to read is always fifo[63 - fifopointer].\n */\n+ int fptr;\n+ int cs = prefetch_cs(s->prefetch.config1);\n+ int is16bit = (((s->cs_file[cs].config[0] >> 12) & 3) != 0);\n+ int bytes;\n+ /* Don't believe the bit of the OMAP TRM that says that COUNTVALUE\n * and TRANSFERCOUNT are in units of 16 bit words for 16 bit NAND.\n * Instead believe the bit that says it is always a byte count.\n */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void fill_prefetch_fifo(struct omap_gpmc_s *s)\n{\n /* Fill the prefetch FIFO by reading data from NAND.\n * We do this synchronously, unlike the hardware which\n * will do this asynchronously. We refill when the\n * FIFO has THRESHOLD bytes free, and we always refill\n * as much data as possible starting at the top end\n * of the FIFO.\n * (We have to refill at THRESHOLD rather than waiting\n * for the FIFO to empty to allow for the case where\n * the FIFO size isn't an exact multiple of THRESHOLD\n * and we're doing DMA transfers.)\n * This means we never need to handle wrap-around in\n * the fifo-reading code, and the next byte of data\n * to read is always fifo[63 - fifopointer].\n */\n int fptr;\n int cs = prefetch_cs(s->prefetch.config1);\n int is16bit = (((s->cs_file[cs].config[0] >> 12) & 3) != 0);\n int bytes;\n /* Don't believe the bit of the OMAP TRM that says that COUNTVALUE\n * and TRANSFERCOUNT are in units of 16 bit words for 16 bit NAND.\n * Instead believe the bit that says it is always a byte count.\n */\n bytes = 64 - s->prefetch.fifopointer;\n if (bytes > s->prefetch.count) {\n bytes = s->prefetch.count;\n s->prefetch.count -= bytes;\n s->prefetch.fifopointer += bytes;\n fptr = 64 - s->prefetch.fifopointer;\n /* Move the existing data in the FIFO so it sits just\n * before what we're about to read in\n */\n while (fptr < (64 - bytes)) {\n s->prefetch.fifo[fptr] = s->prefetch.fifo[fptr + bytes];\n fptr++;\n while (fptr < 64) {\n uint32_t v = omap_nand_read(&s->cs_file[cs], 0, 2);\n s->prefetch.fifo[fptr++] = v & 0xff;\n s->prefetch.fifo[fptr++] = (v >> 8) & 0xff;\n } else {\n s->prefetch.fifo[fptr++] = omap_nand_read(&s->cs_file[cs], 0, 1);\n if (s->prefetch.startengine && (s->prefetch.count == 0)) {\n /* This was the final transfer: raise TERMINALCOUNTSTATUS */\n s->irqst |= 2;\n s->prefetch.startengine = 0;\n /* If there are any bytes in the FIFO at this point then\n * we must raise a DMA request (either this is a final part\n * transfer, or we filled the FIFO in which case we certainly\n * have THRESHOLD bytes available)\n */\n if (s->prefetch.fifopointer != 0) {\n omap_gpmc_dma_update(s, 1);\n omap_gpmc_int_update(s);"}} {"sample_id": "665f119fbad97c05c2603673ac6b2dcbf0d0e9e1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static bool check_irqchip_in_kernel(void)\n \n+{\n \n+ if (kvm_irqchip_in_kernel()) {\n+\n return true;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static bool check_irqchip_in_kernel(void)\n\n{\n\n if (kvm_irqchip_in_kernel()) {\n\n return true;\n\n }\n\n error_report(\"pci-assign: error: requires KVM with in-kernel irqchip \"\n\n \"enabled\");\n\n return false;\n\n}\n"}} {"sample_id": "a78b1299f1bbb9608e3e3a36a7f16cf700a2789d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n case SIGSEGV:\n \n+ case SIGBUS:\n+\n+ case SIGTRAP:\n+\n+ if (info->si_code && (info->si_segvflags & __ISR_VALID)) {\n \n /* ISR.W (write-access) is bit 33: */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int cpu_signal_handler(int host_signum, void *pinfo, void *puc)\n\n{\n\n siginfo_t *info = pinfo;\n\n ucontext_t *uc = puc;\n\n unsigned long ip;\n\n int is_write = 0;\n\n\n\n ip = uc->uc_mcontext.sc_ip;\n\n switch (host_signum) {\n\n case SIGILL:\n\n case SIGFPE:\n\n case SIGSEGV:\n\n case SIGBUS:\n\n case SIGTRAP:\n\n if (info->si_code && (info->si_segvflags & __ISR_VALID)) {\n\n /* ISR.W (write-access) is bit 33: */\n\n is_write = (info->si_isr >> 33) & 1;\n\n }\n\n break;\n\n\n\n default:\n\n break;\n\n }\n\n return handle_cpu_signal(ip, (unsigned long)info->si_addr,\n\n is_write,\n\n (sigset_t *)&uc->uc_sigmask);\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_140", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int get_bool(QEMUFile *f, void *pv, size_t size)\n \n+{\n+\n bool *v = pv;\n \n *v = qemu_get_byte(f);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int get_bool(QEMUFile *f, void *pv, size_t size)\n\n{\n\n bool *v = pv;\n\n *v = qemu_get_byte(f);\n\n return 0;\n\n}\n"}} {"sample_id": "ee640c625e190a0c0e6b8966adc0e4720fb75200_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int gen_rp_interrupts_init(PCIDevice *d, Error **errp)\n \n+{\n \n int rc;\n+\n \n \n rc = msix_init_exclusive_bar(d, GEN_PCIE_ROOT_PORT_MSIX_NR_VECTOR, 0);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int gen_rp_interrupts_init(PCIDevice *d, Error **errp)\n\n{\n\n int rc;\n\n\n\n rc = msix_init_exclusive_bar(d, GEN_PCIE_ROOT_PORT_MSIX_NR_VECTOR, 0);\n\n\n\n if (rc < 0) {\n\n assert(rc == -ENOTSUP);\n\n error_setg(errp, \"Unable to init msix vectors\");\n\n } else {\n\n msix_vector_use(d, 0);\n\n }\n\n\n\n return rc;\n\n}\n"}} {"sample_id": "f3ced3c59287dabc253f83f0c70aa4934470c15e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n /* The QOM tests will trigger tlb_flushes without setting up TCG\n \n+ * so we bug out here in that case.\n \n */\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void tlb_flush_nocheck(CPUState *cpu)\n\n{\n\n CPUArchState *env = cpu->env_ptr;\n\n\n\n /* The QOM tests will trigger tlb_flushes without setting up TCG\n\n * so we bug out here in that case.\n\n */\n\n if (!tcg_enabled()) {\n\n return;\n\n }\n\n\n\n assert_cpu_is_self(cpu);\n\n tlb_debug(\"(count: %d)\\n\", tlb_flush_count++);\n\n\n\n tb_lock();\n\n\n\n memset(env->tlb_table, -1, sizeof(env->tlb_table));\n\n memset(env->tlb_v_table, -1, sizeof(env->tlb_v_table));\n\n memset(cpu->tb_jmp_cache, 0, sizeof(cpu->tb_jmp_cache));\n\n\n\n env->vtlb_index = 0;\n\n env->tlb_flush_addr = -1;\n\n env->tlb_flush_mask = 0;\n\n\n\n tb_unlock();\n\n\n\n atomic_mb_set(&cpu->pending_tlb_flush, 0);\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n PPC_OP(setcrfbit)\n+\n+{\n \n T1 = (T1 & PARAM(1)) | (T0 << PARAM(2)); \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "PPC_OP(setcrfbit)\n\n{\n\n T1 = (T1 & PARAM(1)) | (T0 << PARAM(2)); \n\n RETURN();\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n+PPC_OP(subfc)\n+\n+{\n+\n T0 = T1 - T0;\n+\n if (T0 <= T1) {\n+\n xer_ca = 1;\n \n } else {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "PPC_OP(subfc)\n\n{\n\n T0 = T1 - T0;\n\n if (T0 <= T1) {\n\n xer_ca = 1;\n\n } else {\n\n xer_ca = 0;\n\n }\n\n RETURN();\n\n}\n"}} {"sample_id": "973945804d95878375b487c0c5c9b2556c5e4543", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n \n }\n \n+ val <<= 1;\n+\n+ }\n+\n+ } else {\n \n for (i = 0; i < 32; i++) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void tcx_rstip_writel(void *opaque, hwaddr addr,\n\n uint64_t val, unsigned size)\n\n{\n\n TCXState *s = opaque;\n\n int i;\n\n uint32_t col;\n\n\n\n if (!(addr & 4)) {\n\n s->tmpblit = val;\n\n } else {\n\n addr = (addr >> 3) & 0xfffff;\n\n col = cpu_to_be32(s->tmpblit);\n\n if (s->depth == 24) {\n\n for (i = 0; i < 32; i++) {\n\n if (val & 0x80000000) {\n\n s->vram[addr + i] = s->tmpblit;\n\n s->vram24[addr + i] = col;\n\n s->cplane[addr + i] = col;\n\n }\n\n val <<= 1;\n\n }\n\n } else {\n\n for (i = 0; i < 32; i++) {\n\n if (val & 0x80000000) {\n\n s->vram[addr + i] = s->tmpblit;\n\n }\n\n val <<= 1;\n\n }\n\n }\n\n memory_region_set_dirty(&s->vram_mem, addr, 32);\n\n }\n\n}\n"}} {"sample_id": "eabb7b91b36b202b4dac2df2d59d698e3aff197a_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n void tb_set_jmp_target1(uintptr_t jmp_addr, uintptr_t addr)\n \n {\n+\n+ uint32_t *ptr = (uint32_t *)jmp_addr;\n+\n+ uintptr_t disp = addr - jmp_addr;\n+\n \n \n /* We can reach the entire address space for 32-bit. For 64-bit", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void tb_set_jmp_target1(uintptr_t jmp_addr, uintptr_t addr)\n\n{\n\n uint32_t *ptr = (uint32_t *)jmp_addr;\n\n uintptr_t disp = addr - jmp_addr;\n\n\n\n /* We can reach the entire address space for 32-bit. For 64-bit\n\n the code_gen_buffer can't be larger than 2GB. */\n\n assert(disp == (int32_t)disp);\n\n\n\n *ptr = CALL | (uint32_t)disp >> 2;\n\n flush_icache_range(jmp_addr, jmp_addr + 4);\n\n}\n"}} {"sample_id": "1ea879e5580f63414693655fcf0328559cdce138_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ audio_pcm_init_info (&hw->info, as);\n+\n hw->samples = 1024;\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int no_init_in (HWVoiceIn *hw, audsettings_t *as)\n\n{\n\n audio_pcm_init_info (&hw->info, as);\n\n hw->samples = 1024;\n\n return 0;\n\n}\n"}} {"sample_id": "9a2fd4347c40321f5cbb4ab4220e759fcbf87d03_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+qcrypto_tls_creds_x509_init(Object *obj)\n {\n object_property_add_bool(obj, \"loaded\",\n qcrypto_tls_creds_x509_prop_get_loaded,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "qcrypto_tls_creds_x509_init(Object *obj)\n{\n object_property_add_bool(obj, \"loaded\",\n qcrypto_tls_creds_x509_prop_get_loaded,\n qcrypto_tls_creds_x509_prop_set_loaded,\n}"}} {"sample_id": "903585dec63ee83bd8149006e31f92ea789b38e3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n p->initrd_size = initrd_size;\n \n+\n+\n+ qemu_register_reset(ppce500_reset_device_tree, p);\n+\n+\n \n /* Issue the device tree loader once, so that we get the size of the blob */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ppce500_prep_device_tree(MachineState *machine,\n\n PPCE500Params *params,\n\n hwaddr addr,\n\n hwaddr initrd_base,\n\n hwaddr initrd_size)\n\n{\n\n DeviceTreeParams *p = g_new(DeviceTreeParams, 1);\n\n p->machine = machine;\n\n p->params = *params;\n\n p->addr = addr;\n\n p->initrd_base = initrd_base;\n\n p->initrd_size = initrd_size;\n\n\n\n qemu_register_reset(ppce500_reset_device_tree, p);\n\n\n\n /* Issue the device tree loader once, so that we get the size of the blob */\n\n return ppce500_load_device_tree(machine, params, addr, initrd_base,\n\n initrd_size, true);\n\n}\n"}} {"sample_id": "b3be28969b797b27d7f7f806827e9898e4ee08f0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n RAM_SAVE_FLAG_COMPRESS_PAGE);\n \n+ blen = qemu_put_compression_data(param->file, p, TARGET_PAGE_SIZE,\n+\n+ migrate_compress_level());\n+\n+ bytes_sent += blen;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int do_compress_ram_page(CompressParam *param)\n\n{\n\n int bytes_sent, blen;\n\n uint8_t *p;\n\n RAMBlock *block = param->block;\n\n ram_addr_t offset = param->offset;\n\n\n\n p = block->host + (offset & TARGET_PAGE_MASK);\n\n\n\n bytes_sent = save_page_header(param->file, block, offset |\n\n RAM_SAVE_FLAG_COMPRESS_PAGE);\n\n blen = qemu_put_compression_data(param->file, p, TARGET_PAGE_SIZE,\n\n migrate_compress_level());\n\n bytes_sent += blen;\n\n\n\n return bytes_sent;\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_92", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void send_qmp_error_event(BlockDriverState *bs,\n \n BlockErrorAction action,\n+\n+ bool is_read, int error)\n+\n+{\n+\n IoOperationType optype;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void send_qmp_error_event(BlockDriverState *bs,\n\n BlockErrorAction action,\n\n bool is_read, int error)\n\n{\n\n IoOperationType optype;\n\n\n\n optype = is_read ? IO_OPERATION_TYPE_READ : IO_OPERATION_TYPE_WRITE;\n\n qapi_event_send_block_io_error(bdrv_get_device_name(bs), optype, action,\n\n bdrv_iostatus_is_enabled(bs),\n\n error == ENOSPC, strerror(error),\n\n &error_abort);\n\n}\n"}} {"sample_id": "dbffbdcfff69431b622866ac5ea78df74fdc02d4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n \n \n if (!drv) {\n+\n return -ENOMEDIUM;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int coroutine_fn bdrv_co_do_readv(BlockDriverState *bs,\n\n int64_t sector_num, int nb_sectors, QEMUIOVector *qiov)\n\n{\n\n BlockDriver *drv = bs->drv;\n\n\n\n if (!drv) {\n\n return -ENOMEDIUM;\n\n }\n\n if (bdrv_check_request(bs, sector_num, nb_sectors)) {\n\n return -EIO;\n\n }\n\n\n\n /* throttling disk read I/O */\n\n if (bs->io_limits_enabled) {\n\n bdrv_io_limits_intercept(bs, false, nb_sectors);\n\n }\n\n\n\n return drv->bdrv_co_readv(bs, sector_num, nb_sectors, qiov);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_201", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ return lduw_phys_internal(addr, DEVICE_LITTLE_ENDIAN);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint32_t lduw_le_phys(target_phys_addr_t addr)\n\n{\n\n return lduw_phys_internal(addr, DEVICE_LITTLE_ENDIAN);\n\n}\n"}} {"sample_id": "e1cf5582644ef63528993fb2b88dd3b43b9914c6_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void qemu_iovec_init(QEMUIOVector *qiov, int alloc_hint)\n+\n {\n \n qiov->iov = g_malloc(alloc_hint * sizeof(struct iovec));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void qemu_iovec_init(QEMUIOVector *qiov, int alloc_hint)\n\n{\n\n qiov->iov = g_malloc(alloc_hint * sizeof(struct iovec));\n\n qiov->niov = 0;\n\n qiov->nalloc = alloc_hint;\n\n qiov->size = 0;\n\n}\n"}} {"sample_id": "6f2d8978728c48ca46f5c01835438508aace5c64_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n ret = (int64_t)T0 >> (T1 & 0x3FUL);\n \n if (likely(ret >= 0 || ((int64_t)T0 & ((1 << T1) - 1)) == 0)) {\n+\n xer_ca = 0;\n \n } else {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void do_srad (void)\n\n{\n\n int64_t ret;\n\n\n\n if (likely(!(T1 & 0x40UL))) {\n\n if (likely((uint64_t)T1 != 0)) {\n\n ret = (int64_t)T0 >> (T1 & 0x3FUL);\n\n if (likely(ret >= 0 || ((int64_t)T0 & ((1 << T1) - 1)) == 0)) {\n\n xer_ca = 0;\n\n } else {\n\n xer_ca = 1;\n\n }\n\n } else {\n\n ret = T0;\n\n xer_ca = 0;\n\n }\n\n } else {\n\n ret = (-1) * ((uint64_t)T0 >> 63);\n\n if (likely(ret >= 0 || ((uint64_t)T0 & ~0x8000000000000000ULL) == 0)) {\n\n xer_ca = 0;\n\n } else {\n\n xer_ca = 1;\n\n }\n\n }\n\n T0 = ret;\n\n}\n"}} {"sample_id": "1dde716ed6719c341c1bfa427781f0715af90cbc_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n error_report(\"Failed to write16 data to iSCSI lun. %s\",\n \n+ iscsi_get_error(iscsi));\n+\n+ acb->status = -EIO;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "iscsi_aio_write16_cb(struct iscsi_context *iscsi, int status,\n\n void *command_data, void *opaque)\n\n{\n\n IscsiAIOCB *acb = opaque;\n\n\n\n trace_iscsi_aio_write16_cb(iscsi, status, acb, acb->canceled);\n\n\n\n g_free(acb->buf);\n\n acb->buf = NULL;\n\n\n\n if (acb->canceled != 0) {\n\n return;\n\n }\n\n\n\n acb->status = 0;\n\n if (status < 0) {\n\n error_report(\"Failed to write16 data to iSCSI lun. %s\",\n\n iscsi_get_error(iscsi));\n\n acb->status = -EIO;\n\n }\n\n\n\n iscsi_schedule_bh(acb);\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_26", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+ if (!bs) {\n+\n+ return QTAILQ_FIRST(&graph_bdrv_states);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "BlockDriverState *bdrv_next_node(BlockDriverState *bs)\n\n{\n\n if (!bs) {\n\n return QTAILQ_FIRST(&graph_bdrv_states);\n\n }\n\n return QTAILQ_NEXT(bs, node_list);\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_40", "diff": "--- a/source.c\n+++ b/source.c\n@@ -37,11 +37,11 @@\n \n \n n = s->nsector;\n+\n+ if (n > s->req_nb_sectors) {\n+\n+ n = s->req_nb_sectors;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ide_sector_read_cb(void *opaque, int ret)\n\n{\n\n IDEState *s = opaque;\n\n int n;\n\n\n\n s->pio_aiocb = NULL;\n\n s->status &= ~BUSY_STAT;\n\n\n\n if (ret == -ECANCELED) {\n\n return;\n\n }\n\n block_acct_done(bdrv_get_stats(s->bs), &s->acct);\n\n if (ret != 0) {\n\n if (ide_handle_rw_error(s, -ret, IDE_RETRY_PIO |\n\n IDE_RETRY_READ)) {\n\n return;\n\n }\n\n }\n\n\n\n n = s->nsector;\n\n if (n > s->req_nb_sectors) {\n\n n = s->req_nb_sectors;\n\n }\n\n\n\n /* Allow the guest to read the io_buffer */\n\n ide_transfer_start(s, s->io_buffer, n * BDRV_SECTOR_SIZE, ide_sector_read);\n\n\n\n ide_set_irq(s->bus);\n\n\n\n ide_set_sector(s, ide_get_sector(s) + n);\n\n s->nsector -= n;\n\n}\n"}} {"sample_id": "93c26503e01808bfb8cea3c25eae5be63147380e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n BlockBackend *blk = child->opaque;\n+\n \n \n if (blk->disable_perm) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int blk_root_inactivate(BdrvChild *child)\n\n{\n\n BlockBackend *blk = child->opaque;\n\n\n\n if (blk->disable_perm) {\n\n return 0;\n\n }\n\n\n\n /* Only inactivate BlockBackends for guest devices (which are inactive at\n\n * this point because the VM is stopped) and unattached monitor-owned\n\n * BlockBackends. If there is still any other user like a block job, then\n\n * we simply can't inactivate the image. */\n\n if (!blk->dev && !blk->name[0]) {\n\n return -EPERM;\n\n }\n\n\n\n blk->disable_perm = true;\n\n if (blk->root) {\n\n bdrv_child_try_set_perm(blk->root, 0, BLK_PERM_ALL, &error_abort);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d65b9114f35c1afe2a7061f0a1ec957d33ba02b5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static int file_close_dir(URLContext *h)\n+\n+{\n+\n+#if HAVE_DIRENT_H\n \n FileContext *c = h->priv_data;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int file_close_dir(URLContext *h)\n\n{\n\n#if HAVE_DIRENT_H\n\n FileContext *c = h->priv_data;\n\n closedir(c->dir);\n\n return 0;\n\n#else\n\n return AVERROR(ENOSYS);\n\n#endif /* HAVE_DIRENT_H */\n\n}\n"}} {"sample_id": "f53a829bb9ef14be800556cbc02d8b20fc1050a7_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,6 +4,6 @@\n \n aio_set_fd_handler(bdrv_get_aio_context(client->bs), client->sock,\n \n+ NULL, NULL, NULL);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void nbd_client_session_detach_aio_context(NbdClientSession *client)\n\n{\n\n aio_set_fd_handler(bdrv_get_aio_context(client->bs), client->sock,\n\n NULL, NULL, NULL);\n\n}\n"}} {"sample_id": "a9a72aeefbd3ef8bcbbeeccaf174ee10db2978ac_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void tpm_display_backend_drivers(void)\n+\n {\n+\n+ int i;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void tpm_display_backend_drivers(void)\n\n{\n\n int i;\n\n\n\n fprintf(stderr, \"Supported TPM types (choose only one):\\n\");\n\n\n\n for (i = 0; i < TPM_MAX_DRIVERS && be_drivers[i] != NULL; i++) {\n\n fprintf(stderr, \"%12s %s\\n\",\n\n TpmType_lookup[be_drivers[i]->type], be_drivers[i]->desc());\n\n }\n\n fprintf(stderr, \"\\n\");\n\n}\n"}} {"sample_id": "7c560456707bfe53eb1728fcde759be7d9418b62_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n break;\n \n+ }\n+\n+ MISC_DPRINTF(\"Read diagnostic LED reg 0x\" TARGET_FMT_plx \" = %x\\n\", addr,\n+\n+ ret);\n \n return ret;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t slavio_led_mem_reads(void *opaque, target_phys_addr_t addr)\n\n{\n\n MiscState *s = opaque;\n\n uint32_t ret = 0, saddr;\n\n\n\n saddr = addr & LED_MAXADDR;\n\n switch (saddr) {\n\n case 0:\n\n ret = s->leds;\n\n break;\n\n default:\n\n break;\n\n }\n\n MISC_DPRINTF(\"Read diagnostic LED reg 0x\" TARGET_FMT_plx \" = %x\\n\", addr,\n\n ret);\n\n return ret;\n\n}\n"}} {"sample_id": "7f526efd17973ec6d2204f7a47b6923e2be31363_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+void palette8torgb16(const uint8_t *src, uint8_t *dst, unsigned num_pixels, const uint8_t *palette)\n+\n {\n \n \tunsigned i;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void palette8torgb16(const uint8_t *src, uint8_t *dst, unsigned num_pixels, const uint8_t *palette)\n\n{\n\n\tunsigned i;\n\n\tfor(i=0; isc_onstack);\n \n __put_user(set->sig[0], &sc->sc_mask);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int setup_sigcontext(struct target_sigcontext *sc, CPUAlphaState *env,\n\n abi_ulong frame_addr, target_sigset_t *set)\n\n{\n\n int i, err = 0;\n\n\n\n __put_user(on_sig_stack(frame_addr), &sc->sc_onstack);\n\n __put_user(set->sig[0], &sc->sc_mask);\n\n __put_user(env->pc, &sc->sc_pc);\n\n __put_user(8, &sc->sc_ps);\n\n\n\n for (i = 0; i < 31; ++i) {\n\n __put_user(env->ir[i], &sc->sc_regs[i]);\n\n }\n\n __put_user(0, &sc->sc_regs[31]);\n\n\n\n for (i = 0; i < 31; ++i) {\n\n __put_user(env->fir[i], &sc->sc_fpregs[i]);\n\n }\n\n __put_user(0, &sc->sc_fpregs[31]);\n\n __put_user(cpu_alpha_load_fpcr(env), &sc->sc_fpcr);\n\n\n\n __put_user(0, &sc->sc_traparg_a0); /* FIXME */\n\n __put_user(0, &sc->sc_traparg_a1); /* FIXME */\n\n __put_user(0, &sc->sc_traparg_a2); /* FIXME */\n\n\n\n return err;\n\n}\n"}} {"sample_id": "570745cc5114ea13d0054f73776533f5e6e538f8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n return NULL;\n \n dynarray_add(&s->chapters, &s->nb_chapters, chapter);\n+\n+ }\n+\n+ if(chapter->title)\n+\n av_free(chapter->title);\n \n chapter->title = av_strdup(title);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "AVChapter *ff_new_chapter(AVFormatContext *s, int id, AVRational time_base, int64_t start, int64_t end, const char *title)\n\n{\n\n AVChapter *chapter = NULL;\n\n int i;\n\n\n\n for(i=0; inb_chapters; i++)\n\n if(s->chapters[i]->id == id)\n\n chapter = s->chapters[i];\n\n\n\n if(!chapter){\n\n chapter= av_mallocz(sizeof(AVChapter));\n\n if(!chapter)\n\n return NULL;\n\n dynarray_add(&s->chapters, &s->nb_chapters, chapter);\n\n }\n\n if(chapter->title)\n\n av_free(chapter->title);\n\n chapter->title = av_strdup(title);\n\n chapter->id = id;\n\n chapter->time_base= time_base;\n\n chapter->start = start;\n\n chapter->end = end;\n\n\n\n return chapter;\n\n}\n"}} {"sample_id": "e3cffe6fad29e07d401eabb913a6d88501d5c143", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n /* MSR:POW cannot be set by any form of rfi */\n \n msr &= ~(1ULL << MSR_POW);\n+\n \n \n #if defined(TARGET_PPC64)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void do_rfi(CPUPPCState *env, target_ulong nip, target_ulong msr)\n\n{\n\n CPUState *cs = CPU(ppc_env_get_cpu(env));\n\n\n\n /* MSR:POW cannot be set by any form of rfi */\n\n msr &= ~(1ULL << MSR_POW);\n\n\n\n#if defined(TARGET_PPC64)\n\n /* Switching to 32-bit ? Crop the nip */\n\n if (!msr_is_64bit(env, msr)) {\n\n nip = (uint32_t)nip;\n\n }\n\n#else\n\n nip = (uint32_t)nip;\n\n#endif\n\n /* XXX: beware: this is false if VLE is supported */\n\n env->nip = nip & ~((target_ulong)0x00000003);\n\n hreg_store_msr(env, msr, 1);\n\n#if defined(DEBUG_OP)\n\n cpu_dump_rfi(env->nip, env->msr);\n\n#endif\n\n /* No need to raise an exception here,\n\n * as rfi is always the last insn of a TB\n\n */\n\n cs->interrupt_request |= CPU_INTERRUPT_EXITTB;\n\n\n\n /* Context synchronizing: check if TCG TLB needs flush */\n\n check_tlb_flush(env);\n\n}\n"}} {"sample_id": "755667eebc0b6303814faadef047870071ccb5c6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n /* XXX: dummy values */\n stream->packet_max_size = 4096;\n stream->nb_packets = 0;\n+ stream->total_frames = stream->nb_packets;\n+ break;\n+ default:\n+ return -1;\n+ if (rv10_write_header(s, 0, 0))\n return AVERROR_INVALIDDATA;\n avio_flush(s->pb);\n return 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int rm_write_header(AVFormatContext *s)\n{\n RMMuxContext *rm = s->priv_data;\n StreamInfo *stream;\n int n;\n AVCodecContext *codec;\n for(n=0;nnb_streams;n++) {\n s->streams[n]->id = n;\n codec = s->streams[n]->codec;\n stream = &rm->streams[n];\n memset(stream, 0, sizeof(StreamInfo));\n stream->num = n;\n stream->bit_rate = codec->bit_rate;\n stream->enc = codec;\n switch(codec->codec_type) {\n case AVMEDIA_TYPE_AUDIO:\n rm->audio_stream = stream;\n stream->frame_rate = (float)codec->sample_rate / (float)codec->frame_size;\n /* XXX: dummy values */\n stream->packet_max_size = 1024;\n stream->nb_packets = 0;\n stream->total_frames = stream->nb_packets;\n break;\n case AVMEDIA_TYPE_VIDEO:\n rm->video_stream = stream;\n stream->frame_rate = (float)codec->time_base.den / (float)codec->time_base.num;\n /* XXX: dummy values */\n stream->packet_max_size = 4096;\n stream->nb_packets = 0;\n stream->total_frames = stream->nb_packets;\n break;\n default:\n return -1;\n if (rv10_write_header(s, 0, 0))\n return AVERROR_INVALIDDATA;\n avio_flush(s->pb);\n return 0;"}} {"sample_id": "134d42d614768b2803e551621f6654dab1fdc2d2_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void acpi_align_size(GArray *blob, unsigned align)\n+\n+{\n+\n+ /* Align size to multiple of given size. This reduces the chance\n \n * we need to change size in the future (breaking cross version migration).\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void acpi_align_size(GArray *blob, unsigned align)\n\n{\n\n /* Align size to multiple of given size. This reduces the chance\n\n * we need to change size in the future (breaking cross version migration).\n\n */\n\n g_array_set_size(blob, (ROUND_UP(acpi_data_len(blob), align) +\n\n g_array_get_element_size(blob) - 1) /\n\n g_array_get_element_size(blob));\n\n}\n"}} {"sample_id": "bec1631100323fac0900aea71043d5c4e22fc2fa_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void tcg_out_brcond64(TCGContext *s, TCGCond cond,\n+\n+ TCGArg arg1, TCGArg arg2, int const_arg2,\n+\n int label_index, int small)\n \n {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void tcg_out_brcond64(TCGContext *s, TCGCond cond,\n\n TCGArg arg1, TCGArg arg2, int const_arg2,\n\n int label_index, int small)\n\n{\n\n tcg_out_cmp(s, arg1, arg2, const_arg2, P_REXW);\n\n tcg_out_jxx(s, tcg_cond_to_jcc[cond], label_index, small);\n\n}\n"}} {"sample_id": "d63cb48db9016328a7a69f3a1c2938cd3dfc9d1a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n ppcemb_timer = tb_env->opaque;\n \n+ env->spr[SPR_40x_TSR] |= 1 << 27;\n+\n+ if ((env->spr[SPR_40x_TCR] >> 26) & 0x1)\n+\n+ ppc_set_irq(env, PPC_INTERRUPT_PIT, 1);\n \n start_stop_pit(env, tb_env, 1);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void cpu_4xx_pit_cb (void *opaque)\n\n{\n\n CPUState *env;\n\n ppc_tb_t *tb_env;\n\n ppcemb_timer_t *ppcemb_timer;\n\n\n\n env = opaque;\n\n tb_env = env->tb_env;\n\n ppcemb_timer = tb_env->opaque;\n\n env->spr[SPR_40x_TSR] |= 1 << 27;\n\n if ((env->spr[SPR_40x_TCR] >> 26) & 0x1)\n\n ppc_set_irq(env, PPC_INTERRUPT_PIT, 1);\n\n start_stop_pit(env, tb_env, 1);\n\n LOG_TB(\"%s: ar %d ir %d TCR \" TARGET_FMT_lx \" TSR \" TARGET_FMT_lx \" \"\n\n \"%016\" PRIx64 \"\\n\", __func__,\n\n (int)((env->spr[SPR_40x_TCR] >> 22) & 0x1),\n\n (int)((env->spr[SPR_40x_TCR] >> 26) & 0x1),\n\n env->spr[SPR_40x_TCR], env->spr[SPR_40x_TSR],\n\n ppcemb_timer->pit_reload);\n\n}\n"}} {"sample_id": "12c3e120fe8f8d6881001eade390d8a5c185783d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n \n \n if (get_bits1(&s->gb)) /* Motion difference = 0 */\n+\n return pred;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int h263p_decode_umotion(MpegEncContext * s, int pred)\n\n{\n\n int code = 0, sign;\n\n\n\n if (get_bits1(&s->gb)) /* Motion difference = 0 */\n\n return pred;\n\n\n\n code = 2 + get_bits1(&s->gb);\n\n\n\n while (get_bits1(&s->gb))\n\n {\n\n code <<= 1;\n\n code += get_bits1(&s->gb);\n\n if (code >= 32768) {\n\n avpriv_request_sample(s->avctx, \"Huge DMV\");\n\n return AVERROR_INVALIDDATA;\n\n }\n\n }\n\n sign = code & 1;\n\n code >>= 1;\n\n\n\n code = (sign) ? (pred - code) : (pred + code);\n\n ff_tlog(s->avctx,\"H.263+ UMV Motion = %d\\n\", code);\n\n return code;\n\n\n\n}\n"}} {"sample_id": "59800ec8e52bcfa271fa61fb0aae19205ef1b7f1_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n \n \n if (unlikely((float64_is_infinity(farg1.d) && float64_is_zero(farg2.d)) ||\n+\n+ (float64_is_zero(farg1.d) && float64_is_infinity(farg2.d)))) {\n+\n+ /* Multiplication of zero by infinity */\n+\n farg1.ll = fload_invalid_op_excp(env, POWERPC_EXCP_FP_VXIMZ);\n \n } else {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint64_t helper_fmadd(CPUPPCState *env, uint64_t arg1, uint64_t arg2,\n\n uint64_t arg3)\n\n{\n\n CPU_DoubleU farg1, farg2, farg3;\n\n\n\n farg1.ll = arg1;\n\n farg2.ll = arg2;\n\n farg3.ll = arg3;\n\n\n\n if (unlikely((float64_is_infinity(farg1.d) && float64_is_zero(farg2.d)) ||\n\n (float64_is_zero(farg1.d) && float64_is_infinity(farg2.d)))) {\n\n /* Multiplication of zero by infinity */\n\n farg1.ll = fload_invalid_op_excp(env, POWERPC_EXCP_FP_VXIMZ);\n\n } else {\n\n if (unlikely(float64_is_signaling_nan(farg1.d) ||\n\n float64_is_signaling_nan(farg2.d) ||\n\n float64_is_signaling_nan(farg3.d))) {\n\n /* sNaN operation */\n\n fload_invalid_op_excp(env, POWERPC_EXCP_FP_VXSNAN);\n\n }\n\n /* This is the way the PowerPC specification defines it */\n\n float128 ft0_128, ft1_128;\n\n\n\n ft0_128 = float64_to_float128(farg1.d, &env->fp_status);\n\n ft1_128 = float64_to_float128(farg2.d, &env->fp_status);\n\n ft0_128 = float128_mul(ft0_128, ft1_128, &env->fp_status);\n\n if (unlikely(float128_is_infinity(ft0_128) &&\n\n float64_is_infinity(farg3.d) &&\n\n float128_is_neg(ft0_128) != float64_is_neg(farg3.d))) {\n\n /* Magnitude subtraction of infinities */\n\n farg1.ll = fload_invalid_op_excp(env, POWERPC_EXCP_FP_VXISI);\n\n } else {\n\n ft1_128 = float64_to_float128(farg3.d, &env->fp_status);\n\n ft0_128 = float128_add(ft0_128, ft1_128, &env->fp_status);\n\n farg1.d = float128_to_float64(ft0_128, &env->fp_status);\n\n }\n\n }\n\n\n\n return farg1.ll;\n\n}\n"}} {"sample_id": "b18f1141d0afa00de11a8e079f4f5305c9e36893", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n Visitor *v;\n \n+\n+\n+ v = validate_test_init(data, \"{ 'string': 'c', 'integer': 41, 'boolean': true }\");\n+\n+\n \n visit_type_UserDefFlatUnion(v, &tmp, NULL, &err);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_validate_fail_union_flat(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n UserDefFlatUnion *tmp = NULL;\n\n Error *err = NULL;\n\n Visitor *v;\n\n\n\n v = validate_test_init(data, \"{ 'string': 'c', 'integer': 41, 'boolean': true }\");\n\n\n\n visit_type_UserDefFlatUnion(v, &tmp, NULL, &err);\n\n g_assert(err);\n\n\n qapi_free_UserDefFlatUnion(tmp);\n\n}"}} {"sample_id": "c04c3282b4334ff64cfd69d40fea010602e830fd_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n st->codec->codec_type = CODEC_TYPE_VIDEO;\n \n+ st->codec->codec_id = s->iformat->value;\n+\n+ st->need_parsing = 1;\n+\n+\n \n /* for mjpeg, specify frame rate */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int video_read_header(AVFormatContext *s,\n\n AVFormatParameters *ap)\n\n{\n\n AVStream *st;\n\n\n\n st = av_new_stream(s, 0);\n\n if (!st)\n\n return AVERROR_NOMEM;\n\n\n\n st->codec->codec_type = CODEC_TYPE_VIDEO;\n\n st->codec->codec_id = s->iformat->value;\n\n st->need_parsing = 1;\n\n\n\n /* for mjpeg, specify frame rate */\n\n /* for mpeg4 specify it too (most mpeg4 streams dont have the fixed_vop_rate set ...)*/\n\n if (ap && ap->time_base.num) {\n\n av_set_pts_info(st, 64, ap->time_base.num, ap->time_base.den);\n\n } else if ( st->codec->codec_id == CODEC_ID_MJPEG ||\n\n st->codec->codec_id == CODEC_ID_MPEG4 ||\n\n st->codec->codec_id == CODEC_ID_H264) {\n\n av_set_pts_info(st, 64, 1, 25);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "2d528d45ecf5ee3c1a566a9f3d664464925ef830_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ CharDriverState *chr;\n \n WinCharState *s;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static CharDriverState *qemu_chr_open_win_path(const char *filename)\n\n{\n\n CharDriverState *chr;\n\n WinCharState *s;\n\n\n\n chr = qemu_chr_alloc();\n\n s = g_malloc0(sizeof(WinCharState));\n\n chr->opaque = s;\n\n chr->chr_write = win_chr_write;\n\n chr->chr_close = win_chr_close;\n\n\n\n if (win_chr_init(chr, filename) < 0) {\n\n g_free(s);\n\n g_free(chr);\n\n return NULL;\n\n }\n\n return chr;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_70", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n \n \n if (f->last_error) {\n+\n+ return;\n+\n+ }\n+\n \n \n f->bytes_xfer += size;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void qemu_put_buffer_async(QEMUFile *f, const uint8_t *buf, int size)\n\n{\n\n if (!f->ops->writev_buffer) {\n\n qemu_put_buffer(f, buf, size);\n\n return;\n\n }\n\n\n\n if (f->last_error) {\n\n return;\n\n }\n\n\n\n f->bytes_xfer += size;\n\n add_to_iovec(f, buf, size);\n\n}\n"}} {"sample_id": "2bd01ac1e238c76e201ba21f314cec46437d2c5a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void string_deserialize(void **native_out, void *datap,\n \n+ VisitorFunc visit, Error **errp)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void string_deserialize(void **native_out, void *datap,\n\n VisitorFunc visit, Error **errp)\n\n{\n\n StringSerializeData *d = datap;\n\n\n\n d->siv = string_input_visitor_new(string_output_get_string(d->sov));\n\n visit(string_input_get_visitor(d->siv), native_out, errp);\n\n}\n"}} {"sample_id": "1108b2f8a939fb5778d384149e2f1b99062a72da_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,8 +6,8 @@\n \n uint8_t *conf = d->pci.config;\n \n+\n+\n d->name = object_get_typename(OBJECT(d));\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void intel_hda_realize(PCIDevice *pci, Error **errp)\n\n{\n\n IntelHDAState *d = INTEL_HDA(pci);\n\n uint8_t *conf = d->pci.config;\n\n\n\n d->name = object_get_typename(OBJECT(d));\n\n\n\n pci_config_set_interrupt_pin(conf, 1);\n\n\n\n /* HDCTL off 0x40 bit 0 selects signaling mode (1-HDA, 0 - Ac97) 18.1.19 */\n\n conf[0x40] = 0x01;\n\n\n\n memory_region_init_io(&d->mmio, OBJECT(d), &intel_hda_mmio_ops, d,\n\n \"intel-hda\", 0x4000);\n\n pci_register_bar(&d->pci, 0, 0, &d->mmio);\n\n if (d->msi != ON_OFF_AUTO_OFF) {\n\n /* TODO check for errors */\n\n msi_init(&d->pci, d->old_msi_addr ? 0x50 : 0x60, 1, true, false);\n\n }\n\n\n\n hda_codec_bus_init(DEVICE(pci), &d->codecs, sizeof(d->codecs),\n\n intel_hda_response, intel_hda_xfer);\n\n}\n"}} {"sample_id": "713f490467e0d4b64e4d2e8f5ee98034235d2010", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n if(v->rangeredfrm) {\n \n int i, j, k;\n+\n+ for(k = 0; k < 6; k++)\n+\n+ for(j = 0; j < 8; j++)\n+\n for(i = 0; i < 8; i++)\n \n block[k][i + j*8] = (block[k][i + j*8] - 64) << 1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vc1_put_block(VC1Context *v, DCTELEM block[6][64])\n\n{\n\n uint8_t *Y;\n\n int ys, us, vs;\n\n DSPContext *dsp = &v->s.dsp;\n\n\n\n if(v->rangeredfrm) {\n\n int i, j, k;\n\n for(k = 0; k < 6; k++)\n\n for(j = 0; j < 8; j++)\n\n for(i = 0; i < 8; i++)\n\n block[k][i + j*8] = (block[k][i + j*8] - 64) << 1;\n\n\n\n }\n\n ys = v->s.current_picture.linesize[0];\n\n us = v->s.current_picture.linesize[1];\n\n vs = v->s.current_picture.linesize[2];\n\n Y = v->s.dest[0];\n\n\n\n dsp->put_pixels_clamped(block[0], Y, ys);\n\n dsp->put_pixels_clamped(block[1], Y + 8, ys);\n\n Y += ys * 8;\n\n dsp->put_pixels_clamped(block[2], Y, ys);\n\n dsp->put_pixels_clamped(block[3], Y + 8, ys);\n\n\n\n if(!(v->s.flags & CODEC_FLAG_GRAY)) {\n\n dsp->put_pixels_clamped(block[4], v->s.dest[1], us);\n\n dsp->put_pixels_clamped(block[5], v->s.dest[2], vs);\n\n }\n\n}\n"}} {"sample_id": "5104a1f65088285ddf870aa641b9061064e8757d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n }\n \n+\n+\n+ gtk_window_set_title(GTK_WINDOW(s->window), title);\n+\n+\n \n g_free(title);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gd_update_caption(GtkDisplayState *s)\n\n{\n\n const char *status = \"\";\n\n gchar *title;\n\n\n\n if (!runstate_is_running()) {\n\n status = \" [Stopped]\";\n\n }\n\n\n\n if (qemu_name) {\n\n title = g_strdup_printf(\"QEMU (%s)%s\", qemu_name, status);\n\n } else {\n\n title = g_strdup_printf(\"QEMU%s\", status);\n\n }\n\n\n\n gtk_window_set_title(GTK_WINDOW(s->window), title);\n\n\n\n g_free(title);\n\n}\n"}} {"sample_id": "1181d93231e9b807965724587d363c1cfd5a1d0d_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+void ff_avg_h264_qpel8_mc33_msa(uint8_t *dst, const uint8_t *src,\n+\n+ ptrdiff_t stride)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_avg_h264_qpel8_mc33_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n avc_luma_hv_qrt_and_aver_dst_8x8_msa(src + stride - 2,\n\n src - (stride * 2) +\n\n sizeof(uint8_t), stride, dst, stride);\n\n}\n"}} {"sample_id": "ce1ebb31a9a0e556a89cd7681082af19fbc1cced_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static unsigned tget(GetByteContext *gb, int type, int le)\n+\n+{\n+\n+ switch (type) {\n \n case TIFF_BYTE : return bytestream2_get_byteu(gb);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static unsigned tget(GetByteContext *gb, int type, int le)\n\n{\n\n switch (type) {\n\n case TIFF_BYTE : return bytestream2_get_byteu(gb);\n\n case TIFF_SHORT: return tget_short(gb, le);\n\n case TIFF_LONG : return tget_long(gb, le);\n\n default : return UINT_MAX;\n\n }\n\n}\n"}} {"sample_id": "a4a1c70dc759e5b81627e96564f344ab43ea86eb_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n if (qiv->errname) {\n \n g_string_truncate(qiv->errname, 0);\n+\n+ } else {\n+\n+ qiv->errname = g_string_new(\"\");\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static const char *full_name(QObjectInputVisitor *qiv, const char *name)\n\n{\n\n StackObject *so;\n\n char buf[32];\n\n\n\n if (qiv->errname) {\n\n g_string_truncate(qiv->errname, 0);\n\n } else {\n\n qiv->errname = g_string_new(\"\");\n\n }\n\n\n\n QSLIST_FOREACH(so , &qiv->stack, node) {\n\n if (qobject_type(so->obj) == QTYPE_QDICT) {\n\n g_string_prepend(qiv->errname, name);\n\n g_string_prepend_c(qiv->errname, '.');\n\n } else {\n\n snprintf(buf, sizeof(buf), \"[%u]\", so->index);\n\n g_string_prepend(qiv->errname, buf);\n\n }\n\n name = so->name;\n\n }\n\n\n\n if (name) {\n\n g_string_prepend(qiv->errname, name);\n\n } else if (qiv->errname->str[0] == '.') {\n\n g_string_erase(qiv->errname, 0, 1);\n\n } else {\n\n return \"\";\n\n }\n\n\n\n return qiv->errname->str;\n\n}\n"}} {"sample_id": "c6bf8e0e0cf04b40a8a22426e00ebbd727331d8b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void migration_bitmap_sync(void)\n \n {\n+\n+ uint64_t num_dirty_pages_init = ram_list.dirty_pages;\n+\n+\n \n trace_migration_bitmap_sync_start();\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void migration_bitmap_sync(void)\n\n{\n\n uint64_t num_dirty_pages_init = ram_list.dirty_pages;\n\n\n\n trace_migration_bitmap_sync_start();\n\n memory_global_sync_dirty_bitmap(get_system_memory());\n\n trace_migration_bitmap_sync_end(ram_list.dirty_pages\n\n - num_dirty_pages_init);\n\n}\n"}} {"sample_id": "1acd7d594c15aa491729c837ad3519d3469e620a_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n pix[5]= v += block[5];\n \n pix[6]= v += block[6];\n+\n+ pix[7]= v + block[7];\n+\n+ pix+= stride;\n+\n block+= 8;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void FUNCC(pred8x8l_horizontal_add)(uint8_t *_pix, const int16_t *_block,\n\n ptrdiff_t stride)\n\n{\n\n int i;\n\n pixel *pix = (pixel*)_pix;\n\n const dctcoef *block = (const dctcoef*)_block;\n\n stride >>= sizeof(pixel)-1;\n\n for(i=0; i<8; i++){\n\n pixel v = pix[-1];\n\n pix[0]= v += block[0];\n\n pix[1]= v += block[1];\n\n pix[2]= v += block[2];\n\n pix[3]= v += block[3];\n\n pix[4]= v += block[4];\n\n pix[5]= v += block[5];\n\n pix[6]= v += block[6];\n\n pix[7]= v + block[7];\n\n pix+= stride;\n\n block+= 8;\n\n }\n\n}\n"}} {"sample_id": "79c18be7dfe660ab48f9f535e6cabd38c9f1d73b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+ float32 f0 = make_float32(a);\n+\n+ float32 f1 = make_float32(b);\n \n return float32_val((float32_compare_quiet(f0, f1, NFS) == 1)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint32_t HELPER(neon_abd_f32)(uint32_t a, uint32_t b)\n\n{\n\n float32 f0 = make_float32(a);\n\n float32 f1 = make_float32(b);\n\n return float32_val((float32_compare_quiet(f0, f1, NFS) == 1)\n\n ? float32_sub(f0, f1, NFS)\n\n : float32_sub(f1, f0, NFS));\n\n}\n"}} {"sample_id": "20c334a797bf46a4ee59a6e42be6d5e7c3cda585_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static inline uint16_t mipsdsp_sub_i16(int16_t a, int16_t b, CPUMIPSState *env)\n \n {\n+\n int16_t temp;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static inline uint16_t mipsdsp_sub_i16(int16_t a, int16_t b, CPUMIPSState *env)\n\n{\n\n int16_t temp;\n\n\n\n temp = a - b;\n\n if (MIPSDSP_OVERFLOW(a, -b, temp, 0x8000)) {\n\n set_DSPControl_overflow_flag(1, 20, env);\n\n }\n\n\n\n return temp;\n\n}\n"}} {"sample_id": "65cdadd2e2de76f7db3bf6b7d8dd8c67abff9659_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n START_TEST(qint_from_int64_test)\n+\n+{\n+\n+ QInt *qi;\n \n const int64_t value = 0x1234567890abcdefLL;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "START_TEST(qint_from_int64_test)\n\n{\n\n QInt *qi;\n\n const int64_t value = 0x1234567890abcdefLL;\n\n\n\n qi = qint_from_int(value);\n\n fail_unless((int64_t) qi->value == value);\n\n\n\n QDECREF(qi);\n\n}\n"}} {"sample_id": "5039d6e23586fe6bbedc5e4fe302b48a66890ade_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void cpu_request_exit(void *opaque, int irq, int level)\n+\n+{\n+\n CPUState *cpu = current_cpu;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void cpu_request_exit(void *opaque, int irq, int level)\n\n{\n\n CPUState *cpu = current_cpu;\n\n\n\n if (cpu && level) {\n\n cpu_exit(cpu);\n\n }\n\n}\n"}} {"sample_id": "b25f23e7dbc6bc0dcda010222a4f178669d1aedc_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static QObject *qdict_get_obj(const QDict *qdict, const char *key, QType type)\n+\n+{\n+\n+ QObject *obj;\n+\n \n \n obj = qdict_get(qdict, key);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static QObject *qdict_get_obj(const QDict *qdict, const char *key, QType type)\n\n{\n\n QObject *obj;\n\n\n\n obj = qdict_get(qdict, key);\n\n assert(obj != NULL);\n\n assert(qobject_type(obj) == type);\n\n\n\n return obj;\n\n}\n"}} {"sample_id": "e92f0e1910f0655a0edd8d87c5a7262d36517a89_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n DiscardCo rwco = {\n \n+ .bs = bs,\n \n .offset = offset,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "int bdrv_pdiscard(BlockDriverState *bs, int64_t offset, int count)\n\n{\n\n Coroutine *co;\n\n DiscardCo rwco = {\n\n .bs = bs,\n\n .offset = offset,\n\n .count = count,\n\n .ret = NOT_DONE,\n\n };\n\n\n\n if (qemu_in_coroutine()) {\n\n /* Fast-path if already in coroutine context */\n\n bdrv_pdiscard_co_entry(&rwco);\n\n } else {\n\n co = qemu_coroutine_create(bdrv_pdiscard_co_entry, &rwco);\n\n qemu_coroutine_enter(co);\n\n BDRV_POLL_WHILE(bs, rwco.ret == NOT_DONE);\n\n }\n\n\n\n return rwco.ret;\n\n}\n"}} {"sample_id": "a03ef88f77af045a2eb9629b5ce774a3fb973c5e_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n /* throttling disk I/O */\n \n+ if (blk->public.throttle_state) {\n+\n+ throttle_group_co_io_limits_intercept(blk, bytes, true);\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int coroutine_fn blk_co_pwritev(BlockBackend *blk, int64_t offset,\n\n unsigned int bytes, QEMUIOVector *qiov,\n\n BdrvRequestFlags flags)\n\n{\n\n int ret;\n\n\n\n trace_blk_co_pwritev(blk, blk_bs(blk), offset, bytes, flags);\n\n\n\n ret = blk_check_byte_request(blk, offset, bytes);\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n\n\n /* throttling disk I/O */\n\n if (blk->public.throttle_state) {\n\n throttle_group_co_io_limits_intercept(blk, bytes, true);\n\n }\n\n\n\n if (!blk->enable_write_cache) {\n\n flags |= BDRV_REQ_FUA;\n\n }\n\n\n\n return bdrv_co_pwritev(blk_bs(blk), offset, bytes, qiov, flags);\n\n}\n"}} {"sample_id": "7e7e59409294af9caa63808e56c5cc824c98b4fc_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -46,11 +46,11 @@\n \n p += 3;\n \n+ }\n+\n+ p += src_wrap;\n+\n+ q += dst_wrap;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void rgb24_to_rgb555(AVPicture *dst, AVPicture *src,\n\n int width, int height)\n\n{\n\n const unsigned char *p;\n\n unsigned char *q;\n\n int r, g, b, dst_wrap, src_wrap;\n\n int x, y;\n\n\n\n p = src->data[0];\n\n src_wrap = src->linesize[0] - 3 * width;\n\n\n\n q = dst->data[0];\n\n dst_wrap = dst->linesize[0] - 2 * width;\n\n\n\n for(y=0;y> 3) << 10) | ((g >> 3) << 5) | (b >> 3) | 0x8000;\n\n q += 2;\n\n p += 3;\n\n }\n\n p += src_wrap;\n\n q += dst_wrap;\n\n }\n\n}\n"}} {"sample_id": "bfb1ac14029ee72b19296109fba880c0551755d5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+\tstruct tcpcb *tp = sototcpcb(so);\n+\n+\n+\n+\tDEBUG_CALL(\"sorecvoob\");\n \n \tDEBUG_ARG(\"so = %p\", so);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "sorecvoob(struct socket *so)\n\n{\n\n\tstruct tcpcb *tp = sototcpcb(so);\n\n\n\n\tDEBUG_CALL(\"sorecvoob\");\n\n\tDEBUG_ARG(\"so = %p\", so);\n\n\n\n\t/*\n\n\t * We take a guess at how much urgent data has arrived.\n\n\t * In most situations, when urgent data arrives, the next\n\n\t * read() should get all the urgent data. This guess will\n\n\t * be wrong however if more data arrives just after the\n\n\t * urgent data, or the read() doesn't return all the\n\n\t * urgent data.\n\n\t */\n\n\tsoread(so);\n\n\ttp->snd_up = tp->snd_una + so->so_snd.sb_cc;\n\n\ttp->t_force = 1;\n\n\ttcp_output(tp);\n\n\ttp->t_force = 0;\n\n}\n"}} {"sample_id": "590fe5722b522e492a9c78adadae4def35b137dd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int virtio_ccw_set_vqs(SubchDev *sch, uint64_t addr, uint32_t align,\n \n+ uint16_t index, uint16_t num)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int virtio_ccw_set_vqs(SubchDev *sch, uint64_t addr, uint32_t align,\n\n uint16_t index, uint16_t num)\n\n{\n\n VirtIODevice *vdev = virtio_ccw_get_vdev(sch);\n\n\n\n if (index > VIRTIO_PCI_QUEUE_MAX) {\n\n return -EINVAL;\n\n }\n\n\n\n /* Current code in virtio.c relies on 4K alignment. */\n\n if (addr && (align != 4096)) {\n\n return -EINVAL;\n\n }\n\n\n\n if (!vdev) {\n\n return -EINVAL;\n\n }\n\n\n\n virtio_queue_set_addr(vdev, index, addr);\n\n if (!addr) {\n\n virtio_queue_set_vector(vdev, index, 0);\n\n } else {\n\n /* Fail if we don't have a big enough queue. */\n\n /* TODO: Add interface to handle vring.num changing */\n\n if (virtio_queue_get_num(vdev, index) > num) {\n\n return -EINVAL;\n\n }\n\n virtio_queue_set_vector(vdev, index, index);\n\n }\n\n /* tell notify handler in case of config change */\n\n vdev->config_vector = VIRTIO_PCI_QUEUE_MAX;\n\n return 0;\n\n}\n"}} {"sample_id": "31d657130b02b151a2fe6739f782d9d504b2cfda", "diff": "--- a/source.c\n+++ b/source.c\n@@ -51,11 +51,11 @@\n \n \n /* rectangles are AV_PIX_FMT_PAL8, but we have no guarantee that the\n+\n+ palettes for all rectangles are identical or compatible */\n+\n+ ist->resample_pix_fmt = ifilter->format = AV_PIX_FMT_RGB32;\n+\n \n \n ist->sub2video.frame = av_frame_alloc();", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int sub2video_prepare(InputStream *ist, InputFilter *ifilter)\n\n{\n\n AVFormatContext *avf = input_files[ist->file_index]->ctx;\n\n int i, w, h;\n\n\n\n /* Compute the size of the canvas for the subtitles stream.\n\n If the subtitles codecpar has set a size, use it. Otherwise use the\n\n maximum dimensions of the video streams in the same file. */\n\n w = ifilter->width;\n\n h = ifilter->height;\n\n if (!(w && h)) {\n\n for (i = 0; i < avf->nb_streams; i++) {\n\n if (avf->streams[i]->codecpar->codec_type == AVMEDIA_TYPE_VIDEO) {\n\n w = FFMAX(w, avf->streams[i]->codecpar->width);\n\n h = FFMAX(h, avf->streams[i]->codecpar->height);\n\n }\n\n }\n\n if (!(w && h)) {\n\n w = FFMAX(w, 720);\n\n h = FFMAX(h, 576);\n\n }\n\n av_log(avf, AV_LOG_INFO, \"sub2video: using %dx%d canvas\\n\", w, h);\n\n }\n\n ist->sub2video.w = ist->resample_width = w;\n\n ist->sub2video.h = ist->resample_height = h;\n\n\n\n /* rectangles are AV_PIX_FMT_PAL8, but we have no guarantee that the\n\n palettes for all rectangles are identical or compatible */\n\n ist->resample_pix_fmt = ifilter->format = AV_PIX_FMT_RGB32;\n\n\n\n ist->sub2video.frame = av_frame_alloc();\n\n if (!ist->sub2video.frame)\n\n return AVERROR(ENOMEM);\n\n ist->sub2video.last_pts = INT64_MIN;\n\n return 0;\n\n}\n"}} {"sample_id": "cd41a671b370a3dd603963432d2b02f1e5990fb7_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,10 +2,10 @@\n \n {\n \n+ VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);\n+\n+\n+\n if (((s->vdev.guest_features >> VIRTIO_SCSI_F_HOTPLUG) & 1) &&\n \n (s->vdev.status & VIRTIO_CONFIG_S_DRIVER_OK)) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_scsi_hotplug(SCSIBus *bus, SCSIDevice *dev)\n\n{\n\n VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);\n\n\n\n if (((s->vdev.guest_features >> VIRTIO_SCSI_F_HOTPLUG) & 1) &&\n\n (s->vdev.status & VIRTIO_CONFIG_S_DRIVER_OK)) {\n\n virtio_scsi_push_event(s, dev, VIRTIO_SCSI_T_TRANSPORT_RESET,\n\n VIRTIO_SCSI_EVT_RESET_RESCAN);\n\n }\n\n}\n"}} {"sample_id": "ed6bc28e8a448b9005af50eed12893c5f7711c6e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n {\n \n+ const uint32_t broadcast_addr =\n \n ~slirp->vnetwork_mask.s_addr | slirp->vnetwork_addr.s_addr;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "bool arp_table_search(Slirp *slirp, uint32_t ip_addr,\n\n uint8_t out_ethaddr[ETH_ALEN])\n\n{\n\n const uint32_t broadcast_addr =\n\n ~slirp->vnetwork_mask.s_addr | slirp->vnetwork_addr.s_addr;\n\n ArpTable *arptbl = &slirp->arp_table;\n\n int i;\n\n\n\n DEBUG_CALL(\"arp_table_search\");\n\n DEBUG_ARG(\"ip = 0x%x\", ip_addr);\n\n\n\n /* Check 0.0.0.0/8 invalid source-only addresses */\n\n assert((ip_addr & htonl(~(0xf << 28))) != 0);\n\n\n\n /* If broadcast address */\n\n if (ip_addr == 0xffffffff || ip_addr == broadcast_addr) {\n\n /* return Ethernet broadcast address */\n\n memset(out_ethaddr, 0xff, ETH_ALEN);\n\n return 1;\n\n }\n\n\n\n for (i = 0; i < ARP_TABLE_SIZE; i++) {\n\n if (arptbl->table[i].ar_sip == ip_addr) {\n\n memcpy(out_ethaddr, arptbl->table[i].ar_sha, ETH_ALEN);\n\n DEBUG_ARGS((dfd, \" found hw addr = %02x:%02x:%02x:%02x:%02x:%02x\\n\",\n\n out_ethaddr[0], out_ethaddr[1], out_ethaddr[2],\n\n out_ethaddr[3], out_ethaddr[4], out_ethaddr[5]));\n\n return 1;\n\n }\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "b3a62939561e07bc34493444fa926b6137cba4e8_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n \n \n idx = tcg_global_reg_new_internal(TCG_TYPE_I32, reg, name);\n+\n+ return MAKE_TCGV_I32(idx);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "TCGv_i32 tcg_global_reg_new_i32(int reg, const char *name)\n\n{\n\n int idx;\n\n\n\n idx = tcg_global_reg_new_internal(TCG_TYPE_I32, reg, name);\n\n return MAKE_TCGV_I32(idx);\n\n}\n"}} {"sample_id": "4d29b50a41810684ad34e44352a630eb1dd94b58", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,8 +3,8 @@\n {\n \n AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);\n+\n+\n \n DPRINTF(ad->port_no, \"dma done\\n\");\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int ahci_dma_set_inactive(IDEDMA *dma)\n\n{\n\n AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);\n\n\n\n DPRINTF(ad->port_no, \"dma done\\n\");\n\n\n\n /* update d2h status */\n\n ahci_write_fis_d2h(ad, NULL);\n\n\n\n ad->dma_cb = NULL;\n\n\n\n /* maybe we still have something to process, check later */\n\n ad->check_bh = qemu_bh_new(ahci_check_cmd_bh, ad);\n\n qemu_bh_schedule(ad->check_bh);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "7633378d5fbe932c9d38ae8961ef035d1ed26bfd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void aarch64_cpu_set_pc(CPUState *cs, vaddr value)\n \n+{\n \n ARMCPU *cpu = ARM_CPU(cs);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void aarch64_cpu_set_pc(CPUState *cs, vaddr value)\n\n{\n\n ARMCPU *cpu = ARM_CPU(cs);\n\n /*\n\n * TODO: this will need updating for system emulation,\n\n * when the core may be in AArch32 mode.\n\n */\n\n cpu->env.pc = value;\n\n}\n"}} {"sample_id": "7d48a0f7217474899c5f5920b21f4cfdf4efa8d1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ uint8_t *compressed_data = NULL;\n+\n+ uint8_t *data = NULL;\n+\n+ gsize len;\n \n ssize_t bytes;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int load_image_gzipped(const char *filename, hwaddr addr, uint64_t max_sz)\n\n{\n\n uint8_t *compressed_data = NULL;\n\n uint8_t *data = NULL;\n\n gsize len;\n\n ssize_t bytes;\n\n int ret = -1;\n\n\n\n if (!g_file_get_contents(filename, (char **) &compressed_data, &len,\n\n NULL)) {\n\n goto out;\n\n }\n\n\n\n /* Is it a gzip-compressed file? */\n\n if (len < 2 ||\n\n compressed_data[0] != 0x1f ||\n\n compressed_data[1] != 0x8b) {\n\n goto out;\n\n }\n\n\n\n if (max_sz > LOAD_IMAGE_MAX_GUNZIP_BYTES) {\n\n max_sz = LOAD_IMAGE_MAX_GUNZIP_BYTES;\n\n }\n\n\n\n data = g_malloc(max_sz);\n\n bytes = gunzip(data, max_sz, compressed_data, len);\n\n if (bytes < 0) {\n\n fprintf(stderr, \"%s: unable to decompress gzipped kernel file\\n\",\n\n filename);\n\n goto out;\n\n }\n\n\n\n rom_add_blob_fixed(filename, data, bytes, addr);\n\n ret = bytes;\n\n\n\n out:\n\n g_free(compressed_data);\n\n g_free(data);\n\n return ret;\n\n}\n"}} {"sample_id": "6cb7ee859a1b28aae8eab7f88908c9c9262b8a5c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void qemu_vfree(void *ptr)\n+\n {\n \n /* may be useful some day, but currently we do not need to free */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_vfree(void *ptr)\n\n{\n\n /* may be useful some day, but currently we do not need to free */\n\n}\n"}} {"sample_id": "24952847ad50f1b120287fdc4469b78108eef33c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n \n \n+ if (qemu_input_is_absolute() || absolute_enabled) {\n+\n+ int scr_w, scr_h;\n+\n+ SDL_GetWindowSize(scon->real_window, &scr_w, &scr_h);\n \n max_x = scr_w - 1;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void handle_mousemotion(SDL_Event *ev)\n\n{\n\n int max_x, max_y;\n\n struct sdl2_console *scon = get_scon_from_window(ev->key.windowID);\n\n\n\n if (qemu_input_is_absolute() || absolute_enabled) {\n\n int scr_w, scr_h;\n\n SDL_GetWindowSize(scon->real_window, &scr_w, &scr_h);\n\n max_x = scr_w - 1;\n\n max_y = scr_h - 1;\n\n if (gui_grab && (ev->motion.x == 0 || ev->motion.y == 0 ||\n\n ev->motion.x == max_x || ev->motion.y == max_y)) {\n\n sdl_grab_end(scon);\n\n }\n\n if (!gui_grab &&\n\n (ev->motion.x > 0 && ev->motion.x < max_x &&\n\n ev->motion.y > 0 && ev->motion.y < max_y)) {\n\n sdl_grab_start(scon);\n\n }\n\n }\n\n if (gui_grab || qemu_input_is_absolute() || absolute_enabled) {\n\n sdl_send_mouse_event(scon, ev->motion.xrel, ev->motion.yrel,\n\n ev->motion.x, ev->motion.y, ev->motion.state);\n\n }\n\n}\n"}} {"sample_id": "f17fd4fdf0df3d2f3444399d04c38d22b9a3e1b7_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n \n \n+ str = \"1kiB\";\n+\n+ res = qemu_strtosz(str, &endptr);\n+\n+ g_assert_cmpint(res, ==, 1024);\n \n g_assert(endptr == str + 2);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_qemu_strtosz_trailing(void)\n\n{\n\n const char *str;\n\n char *endptr = NULL;\n\n int64_t res;\n\n\n\n str = \"123xxx\";\n\n res = qemu_strtosz_MiB(str, &endptr);\n\n g_assert_cmpint(res, ==, 123 * M_BYTE);\n\n g_assert(endptr == str + 3);\n\n\n\n res = qemu_strtosz(str, NULL);\n\n g_assert_cmpint(res, ==, -EINVAL);\n\n\n\n str = \"1kiB\";\n\n res = qemu_strtosz(str, &endptr);\n\n g_assert_cmpint(res, ==, 1024);\n\n g_assert(endptr == str + 2);\n\n\n\n res = qemu_strtosz(str, NULL);\n\n g_assert_cmpint(res, ==, -EINVAL);\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_38", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n while ((vma = vma_first(mm)) != NULL) {\n \n+ TAILQ_REMOVE(&mm->mm_mmap, vma, vma_link);\n+\n+ qemu_free(vma);\n+\n }\n \n qemu_free(mm);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vma_delete(struct mm_struct *mm)\n\n{\n\n struct vm_area_struct *vma;\n\n\n\n while ((vma = vma_first(mm)) != NULL) {\n\n TAILQ_REMOVE(&mm->mm_mmap, vma, vma_link);\n\n qemu_free(vma);\n\n }\n\n qemu_free(mm);\n\n}\n"}} {"sample_id": "eabb7b91b36b202b4dac2df2d59d698e3aff197a_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,5 +5,5 @@\n assert(src == sextract64(src, 0, 22));\n \n return tcg_opc_a5(qp, OPC_ADDL_A5, dst, src, TCG_REG_R0);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline uint64_t tcg_opc_movi_a(int qp, TCGReg dst, int64_t src)\n\n{\n\n assert(src == sextract64(src, 0, 22));\n\n return tcg_opc_a5(qp, OPC_ADDL_A5, dst, src, TCG_REG_R0);\n\n}\n"}} {"sample_id": "1e39d97af086d525cd0408eaa5d19783ea165906_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void gen_exception(DisasContext *s, int trapno, target_ulong cur_eip)\n \n {\n+\n+ gen_update_cc_op(s);\n+\n gen_jmp_im(cur_eip);\n \n gen_helper_raise_exception(cpu_env, tcg_const_i32(trapno));", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gen_exception(DisasContext *s, int trapno, target_ulong cur_eip)\n\n{\n\n gen_update_cc_op(s);\n\n gen_jmp_im(cur_eip);\n\n gen_helper_raise_exception(cpu_env, tcg_const_i32(trapno));\n\n s->is_jmp = DISAS_TB_JUMP;\n\n}\n"}} {"sample_id": "98f28ad7a7d26e5e77c5cb37b262d76d6ccd963d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n \n \n if (!conf->bs) {\n+\n+ error_report(\"virtio-blk-pci: drive property not set\");\n+\n+\n+\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "VirtIODevice *virtio_blk_init(DeviceState *dev, BlockConf *conf)\n\n{\n\n VirtIOBlock *s;\n\n int cylinders, heads, secs;\n\n static int virtio_blk_id;\n\n DriveInfo *dinfo;\n\n\n\n if (!conf->bs) {\n\n error_report(\"virtio-blk-pci: drive property not set\");\n\n\n\n\n\n\n\n\n\n s = (VirtIOBlock *)virtio_common_init(\"virtio-blk\", VIRTIO_ID_BLOCK,\n\n sizeof(struct virtio_blk_config),\n\n sizeof(VirtIOBlock));\n\n\n\n s->vdev.get_config = virtio_blk_update_config;\n\n s->vdev.get_features = virtio_blk_get_features;\n\n s->vdev.reset = virtio_blk_reset;\n\n s->bs = conf->bs;\n\n s->conf = conf;\n\n s->rq = NULL;\n\n s->sector_mask = (s->conf->logical_block_size / BDRV_SECTOR_SIZE) - 1;\n\n bdrv_guess_geometry(s->bs, &cylinders, &heads, &secs);\n\n\n\n /* NB: per existing s/n string convention the string is terminated\n\n * by '\\0' only when less than sizeof (s->sn)\n\n */\n\n dinfo = drive_get_by_blockdev(s->bs);\n\n strncpy(s->sn, dinfo->serial, sizeof (s->sn));\n\n\n\n s->vq = virtio_add_queue(&s->vdev, 128, virtio_blk_handle_output);\n\n\n\n qemu_add_vm_change_state_handler(virtio_blk_dma_restart_cb, s);\n\n register_savevm(dev, \"virtio-blk\", virtio_blk_id++, 2,\n\n virtio_blk_save, virtio_blk_load, s);\n\n bdrv_set_removable(s->bs, 0);\n\n\n\n return &s->vdev;\n"}} {"sample_id": "ac4b32df71bd932838043a4838b86d11e169707f_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n+static int read_mv_component(VP56RangeCoder *c, const uint8_t *p)\n \n {\n \n int bit, x = 0;\n \n+\n \n+ if (vp56_rac_get_prob_branchy(c, p[0])) {\n \n int i;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int read_mv_component(VP56RangeCoder *c, const uint8_t *p)\n\n{\n\n int bit, x = 0;\n\n\n\n if (vp56_rac_get_prob_branchy(c, p[0])) {\n\n int i;\n\n\n\n for (i = 0; i < 3; i++)\n\n x += vp56_rac_get_prob(c, p[9 + i]) << i;\n\n for (i = 9; i > 3; i--)\n\n x += vp56_rac_get_prob(c, p[9 + i]) << i;\n\n if (!(x & 0xFFF0) || vp56_rac_get_prob(c, p[12]))\n\n x += 8;\n\n } else {\n\n // small_mvtree\n\n const uint8_t *ps = p + 2;\n\n bit = vp56_rac_get_prob(c, *ps);\n\n ps += 1 + 3 * bit;\n\n x += 4 * bit;\n\n bit = vp56_rac_get_prob(c, *ps);\n\n ps += 1 + bit;\n\n x += 2 * bit;\n\n x += vp56_rac_get_prob(c, *ps);\n\n }\n\n\n\n return (x && vp56_rac_get_prob(c, p[1])) ? -x : x;\n\n}\n"}} {"sample_id": "9b2fadda3e0196ffd485adde4fe9cdd6fae35300_24", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void gen_slbia(DisasContext *ctx)\n+\n+{\n+\n #if defined(CONFIG_USER_ONLY)\n \n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n+\n #else\n \n if (unlikely(ctx->pr)) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_slbia(DisasContext *ctx)\n\n{\n\n#if defined(CONFIG_USER_ONLY)\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n#else\n\n if (unlikely(ctx->pr)) {\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC);\n\n return;\n\n }\n\n gen_helper_slbia(cpu_env);\n\n#endif\n\n}\n"}} {"sample_id": "3eff1f46f08a360a4ae9f834ce9fef4c45bf6f0f_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n continue;\n \n }\n+\n+\n+\n+ tswap32s(&req->req.tmf->type);\n+\n if (req->req.tmf->type == VIRTIO_SCSI_T_TMF) {\n \n if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlTMFReq),", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_scsi_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq)\n\n{\n\n VirtIOSCSI *s = (VirtIOSCSI *)vdev;\n\n VirtIOSCSIReq *req;\n\n\n\n while ((req = virtio_scsi_pop_req(s, vq))) {\n\n int type;\n\n\n\n if (iov_to_buf(req->elem.out_sg, req->elem.out_num, 0,\n\n &type, sizeof(type)) < sizeof(type)) {\n\n virtio_scsi_bad_req();\n\n continue;\n\n }\n\n\n\n tswap32s(&req->req.tmf->type);\n\n if (req->req.tmf->type == VIRTIO_SCSI_T_TMF) {\n\n if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlTMFReq),\n\n sizeof(VirtIOSCSICtrlTMFResp)) < 0) {\n\n virtio_scsi_bad_req();\n\n } else {\n\n virtio_scsi_do_tmf(s, req);\n\n }\n\n\n\n } else if (req->req.tmf->type == VIRTIO_SCSI_T_AN_QUERY ||\n\n req->req.tmf->type == VIRTIO_SCSI_T_AN_SUBSCRIBE) {\n\n if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlANReq),\n\n sizeof(VirtIOSCSICtrlANResp)) < 0) {\n\n virtio_scsi_bad_req();\n\n } else {\n\n req->resp.an->event_actual = 0;\n\n req->resp.an->response = VIRTIO_SCSI_S_OK;\n\n }\n\n }\n\n virtio_scsi_complete_req(req);\n\n }\n\n}\n"}} {"sample_id": "79997def65fd2313b48a5f3c3a884c6149ae9b5d_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -40,11 +40,11 @@\n \n }\n \n+\n+\n+ fft(mdct, x, mdct->nbits - 2);\n+\n+\n \n /* post rotation */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void mdct512(AC3MDCTContext *mdct, int32_t *out, int16_t *in)\n\n{\n\n int i, re, im, n, n2, n4;\n\n int16_t *rot = mdct->rot_tmp;\n\n IComplex *x = mdct->cplx_tmp;\n\n\n\n n = 1 << mdct->nbits;\n\n n2 = n >> 1;\n\n n4 = n >> 2;\n\n\n\n /* shift to simplify computations */\n\n for (i = 0; i > 1;\n\n im = -((int)rot[n2+2*i] - (int)rot[n2-1-2*i]) >> 1;\n\n CMUL(x[i].re, x[i].im, re, im, -mdct->xcos1[i], mdct->xsin1[i], 15);\n\n }\n\n\n\n fft(mdct, x, mdct->nbits - 2);\n\n\n\n /* post rotation */\n\n for (i = 0; i < n4; i++) {\n\n re = x[i].re;\n\n im = x[i].im;\n\n CMUL(out[n2-1-2*i], out[2*i], re, im, mdct->xsin1[i], mdct->xcos1[i], 0);\n\n }\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+\tTCGv t0;\n+\n+\tDIS(fprintf (logfile, \"move $p%u, $r%u\\n\", dc->op1, dc->op2));\n+\n+\tcris_cc_mask(dc, 0);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static unsigned int dec_move_pr(DisasContext *dc)\n\n{\n\n\tTCGv t0;\n\n\tDIS(fprintf (logfile, \"move $p%u, $r%u\\n\", dc->op1, dc->op2));\n\n\tcris_cc_mask(dc, 0);\n\n\n\n\tif (dc->op2 == PR_CCS)\n\n\t\tcris_evaluate_flags(dc);\n\n\n\n\tt0 = tcg_temp_new(TCG_TYPE_TL);\n\n\tt_gen_mov_TN_preg(t0, dc->op2);\n\n\tcris_alu(dc, CC_OP_MOVE,\n\n\t\t cpu_R[dc->op1], cpu_R[dc->op1], t0, preg_sizes[dc->op2]);\n\n\ttcg_temp_free(t0);\n\n\treturn 2;\n\n}\n"}} {"sample_id": "a38469e1da7b4829a2fba4279d8420a33f96832e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -43,11 +43,11 @@\n }\n \n printf(\"-%-17s %s\\n\", buf, po->help);\n+\n+ }\n+\n+ }\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void show_help(void)\n\n{\n\n const OptionDef *po;\n\n int i, expert;\n\n\n\n printf(\"ffmpeg version \" FFMPEG_VERSION \", Copyright (c) 2000,2001 Gerard Lantau\\n\"\n\n \"usage: ffmpeg [[options] -i input_file]... {[options] outfile}...\\n\"\n\n \"Hyper fast MPEG1/MPEG4/H263/RV and AC3/MPEG audio encoder\\n\"\n\n \"\\n\"\n\n \"Main options are:\\n\");\n\n for(i=0;i<2;i++) {\n\n if (i == 1)\n\n printf(\"\\nAdvanced options are:\\n\");\n\n for(po = options; po->name != NULL; po++) {\n\n char buf[64];\n\n expert = (po->flags & OPT_EXPERT) != 0;\n\n if (expert == i) {\n\n strcpy(buf, po->name);\n\n if (po->flags & HAS_ARG) {\n\n strcat(buf, \" \");\n\n strcat(buf, po->argname);\n\n }\n\n printf(\"-%-17s %s\\n\", buf, po->help);\n\n }\n\n }\n\n }\n\n\n\n exit(1);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_230", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n \n \n+ case 0x08:\t/* DSP_IDLECT2 */\n+\n+ s->clkm.dsp_idlect2 = value & 0x0037;\n+\n+ diff = s->clkm.dsp_idlect1 ^ value;\n \n omap_clkdsp_idlect2_update(s, diff, value);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void omap_clkdsp_write(void *opaque, target_phys_addr_t addr,\n\n uint64_t value, unsigned size)\n\n{\n\n struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque;\n\n uint16_t diff;\n\n\n\n if (size != 2) {\n\n return omap_badwidth_write16(opaque, addr, value);\n\n }\n\n\n\n switch (addr) {\n\n case 0x04:\t/* DSP_IDLECT1 */\n\n diff = s->clkm.dsp_idlect1 ^ value;\n\n s->clkm.dsp_idlect1 = value & 0x01f7;\n\n omap_clkdsp_idlect1_update(s, diff, value);\n\n break;\n\n\n\n case 0x08:\t/* DSP_IDLECT2 */\n\n s->clkm.dsp_idlect2 = value & 0x0037;\n\n diff = s->clkm.dsp_idlect1 ^ value;\n\n omap_clkdsp_idlect2_update(s, diff, value);\n\n break;\n\n\n\n case 0x14:\t/* DSP_RSTCT2 */\n\n s->clkm.dsp_rstct2 = value & 0x0001;\n\n break;\n\n\n\n case 0x18:\t/* DSP_SYSST */\n\n s->clkm.cold_start &= value & 0x3f;\n\n break;\n\n\n\n default:\n\n OMAP_BAD_REG(addr);\n\n }\n\n}\n"}} {"sample_id": "df63f130c880c078e4b0ab0652fcb86d31ac1cdd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n case FLV_CODECID_VP6A :\n \n+ if (!flv->alpha_stream) {\n+\n+ AVCodecContext *alpha_codec;\n+\n+ flv->alpha_stream = av_new_stream(s, 2);\n \n if (flv->alpha_stream) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int flv_set_video_codec(AVFormatContext *s, AVStream *vstream, int flv_codecid) {\n\n FLVContext *flv = s->priv_data;\n\n AVCodecContext *vcodec = vstream->codec;\n\n switch(flv_codecid) {\n\n case FLV_CODECID_H263 : vcodec->codec_id = CODEC_ID_FLV1 ; break;\n\n case FLV_CODECID_SCREEN: vcodec->codec_id = CODEC_ID_FLASHSV; break;\n\n case FLV_CODECID_VP6A :\n\n if (!flv->alpha_stream) {\n\n AVCodecContext *alpha_codec;\n\n flv->alpha_stream = av_new_stream(s, 2);\n\n if (flv->alpha_stream) {\n\n av_set_pts_info(flv->alpha_stream, 24, 1, 1000);\n\n alpha_codec = flv->alpha_stream->codec;\n\n alpha_codec->codec_type = CODEC_TYPE_VIDEO;\n\n alpha_codec->codec_id = CODEC_ID_VP6F;\n\n alpha_codec->extradata_size = 1;\n\n alpha_codec->extradata = av_malloc(1);\n\n }\n\n }\n\n case FLV_CODECID_VP6 : vcodec->codec_id = CODEC_ID_VP6F ;\n\n if(vcodec->extradata_size != 1) {\n\n vcodec->extradata_size = 1;\n\n vcodec->extradata = av_malloc(1);\n\n }\n\n vcodec->extradata[0] = get_byte(&s->pb);\n\n if (flv->alpha_stream)\n\n flv->alpha_stream->codec->extradata[0] = vcodec->extradata[0];\n\n return 1; // 1 byte body size adjustment for flv_read_packet()\n\n default:\n\n av_log(s, AV_LOG_INFO, \"Unsupported video codec (%x)\\n\", flv_codecid);\n\n vcodec->codec_tag = flv_codecid;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "1af5f60f6aafa5f2653e7ea7cd054b0a4f31c103", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n int *bounding_values)\n \n {\n+\n+ unsigned char *end;\n+\n+ int filter_value;\n+\n \n \n for (end= first_pixel + 8*stride; first_pixel < end; first_pixel += stride) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void horizontal_filter(unsigned char *first_pixel, int stride,\n\n int *bounding_values)\n\n{\n\n unsigned char *end;\n\n int filter_value;\n\n\n\n for (end= first_pixel + 8*stride; first_pixel < end; first_pixel += stride) {\n\n filter_value =\n\n (first_pixel[-2] - first_pixel[ 1])\n\n +3*(first_pixel[ 0] - first_pixel[-1]);\n\n filter_value = bounding_values[(filter_value + 4) >> 3];\n\n first_pixel[-1] = clip_uint8(first_pixel[-1] + filter_value);\n\n first_pixel[ 0] = clip_uint8(first_pixel[ 0] - filter_value);\n\n }\n\n}\n"}} {"sample_id": "0c9ab5ef9c1ee852c80c859c9e07efe8730b57ed", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n if (shift > 0) {\n \n int offset = 1 << (shift - 1);\n+\n for (y = 0; y < size; y++) {\n \n for (x = 0; x < size; x++) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void FUNC(dequant)(int16_t *coeffs, int16_t log2_size)\n\n{\n\n int shift = 15 - BIT_DEPTH - log2_size;\n\n int x, y;\n\n int size = 1 << log2_size;\n\n\n\n if (shift > 0) {\n\n int offset = 1 << (shift - 1);\n\n for (y = 0; y < size; y++) {\n\n for (x = 0; x < size; x++) {\n\n *coeffs = (*coeffs + offset) >> shift;\n\n coeffs++;\n\n }\n\n }\n\n } else {\n\n for (y = 0; y < size; y++) {\n\n for (x = 0; x < size; x++) {\n\n *coeffs = *coeffs << -shift;\n\n coeffs++;\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "32bafa8fdd098d52fbf1102d5a5e48d29398c0aa_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n return;\n \n }\n+\n+\n+\n+ action = common->action->u.block_dirty_bitmap_add;\n+\n /* AIO context taken and released within qmp_block_dirty_bitmap_add */\n \n qmp_block_dirty_bitmap_add(action->node, action->name,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void block_dirty_bitmap_add_prepare(BlkActionState *common,\n\n Error **errp)\n\n{\n\n Error *local_err = NULL;\n\n BlockDirtyBitmapAdd *action;\n\n BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,\n\n common, common);\n\n\n\n if (action_check_completion_mode(common, errp) < 0) {\n\n return;\n\n }\n\n\n\n action = common->action->u.block_dirty_bitmap_add;\n\n /* AIO context taken and released within qmp_block_dirty_bitmap_add */\n\n qmp_block_dirty_bitmap_add(action->node, action->name,\n\n action->has_granularity, action->granularity,\n\n &local_err);\n\n\n\n if (!local_err) {\n\n state->prepared = true;\n\n } else {\n\n error_propagate(errp, local_err);\n\n }\n\n}\n"}} {"sample_id": "21ce148c7ec71ee32834061355a5ecfd1a11f90f_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static inline int64_t add64(const int64_t a, const int64_t b)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline int64_t add64(const int64_t a, const int64_t b)\n\n{\n\n\treturn a + b;\n\n}\n"}} {"sample_id": "079d0b7f1eedcc634c371fe05b617fdc55c8b762_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n case USB_TOKEN_OUT:\n \n switch (p->devep) {\n+\n+ case 1:\n+\n+ ret = usb_audio_handle_dataout(s, p);\n+\n break;\n \n default:", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int usb_audio_handle_data(USBDevice *dev, USBPacket *p)\n\n{\n\n USBAudioState *s = (USBAudioState *) dev;\n\n int ret = 0;\n\n\n\n switch (p->pid) {\n\n case USB_TOKEN_OUT:\n\n switch (p->devep) {\n\n case 1:\n\n ret = usb_audio_handle_dataout(s, p);\n\n break;\n\n default:\n\n goto fail;\n\n }\n\n break;\n\n\n\n default:\n\nfail:\n\n ret = USB_RET_STALL;\n\n break;\n\n }\n\n if (ret == USB_RET_STALL && s->debug) {\n\n fprintf(stderr, \"usb-audio: failed data transaction: \"\n\n \"pid 0x%x ep 0x%x len 0x%zx\\n\",\n\n p->pid, p->devep, p->iov.size);\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "069d89b8a8dc5a9af4733bca14763b45bbb2546f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ struct iovec *sg = get_sg(pdu, rx);\n+\n+ size_t offset = *offsetp;\n+\n+ unsigned int count;\n \n int32_t size;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void pprint_data(V9fsPDU *pdu, int rx, size_t *offsetp, const char *name)\n\n{\n\n struct iovec *sg = get_sg(pdu, rx);\n\n size_t offset = *offsetp;\n\n unsigned int count;\n\n int32_t size;\n\n int total, i, j;\n\n ssize_t len;\n\n\n\n if (rx) {\n\n count = pdu->elem.in_num;\n\n } else\n\n count = pdu->elem.out_num;\n\n }\n"}} {"sample_id": "c89d416a2b0fb6a21224186b10af4c4a3feee31b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n e1000e_write_ext_rx_descr(E1000ECore *core, uint8_t *desc,\n \n+ struct NetRxPkt *pkt,\n \n const E1000E_RSSInfo *rss_info,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "e1000e_write_ext_rx_descr(E1000ECore *core, uint8_t *desc,\n\n struct NetRxPkt *pkt,\n\n const E1000E_RSSInfo *rss_info,\n\n uint16_t length)\n\n{\n\n union e1000_rx_desc_extended *d = (union e1000_rx_desc_extended *) desc;\n\n\n\n memset(d, 0, sizeof(*d));\n\n\n\n d->wb.upper.length = cpu_to_le16(length);\n\n\n\n e1000e_build_rx_metadata(core, pkt, pkt != NULL,\n\n rss_info,\n\n &d->wb.lower.hi_dword.rss,\n\n &d->wb.lower.mrq,\n\n &d->wb.upper.status_error,\n\n &d->wb.lower.hi_dword.csum_ip.ip_id,\n\n &d->wb.upper.vlan);\n\n}\n"}} {"sample_id": "f3ba91a3f1d9e99aebfe22278b0633f996e3fbe1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,7 +24,7 @@\n \n // av_log(NULL, AV_LOG_DEBUG, \"Checking: %s\\n\", d->name);\n \n+ av_assert0(d->log2_chroma_w <= 3);\n \n av_assert0(d->log2_chroma_h <= 3);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void ff_check_pixfmt_descriptors(void){\n\n int i, j;\n\n\n\n for (i=0; iname && !d->nb_components && !d->log2_chroma_w && !d->log2_chroma_h && !d->flags)\n\n continue;\n\n// av_log(NULL, AV_LOG_DEBUG, \"Checking: %s\\n\", d->name);\n\n av_assert0(d->log2_chroma_w <= 3);\n\n av_assert0(d->log2_chroma_h <= 3);\n\n av_assert0(d->nb_components <= 4);\n\n av_assert0(d->name && d->name[0]);\n\n av_assert0((d->nb_components==4 || d->nb_components==2) == !!(d->flags & AV_PIX_FMT_FLAG_ALPHA));\n\n av_assert2(av_get_pix_fmt(d->name) == i);\n\n\n\n for (j=0; jcomp); j++) {\n\n const AVComponentDescriptor *c = &d->comp[j];\n\n if(j>=d->nb_components) {\n\n av_assert0(!c->plane && !c->step_minus1 && !c->offset_plus1 && !c->shift && !c->depth_minus1);\n\n continue;\n\n }\n\n if (d->flags & AV_PIX_FMT_FLAG_BITSTREAM) {\n\n av_assert0(c->step_minus1 >= c->depth_minus1);\n\n } else {\n\n av_assert0(8*(c->step_minus1+1) >= c->depth_minus1+1);\n\n }\n\n av_read_image_line(tmp, (void*)data, linesize, d, 0, 0, j, 2, 0);\n\n if (!strncmp(d->name, \"bayer_\", 6))\n\n continue;\n\n av_assert0(tmp[0] == 0 && tmp[1] == 0);\n\n tmp[0] = tmp[1] = (1<<(c->depth_minus1 + 1)) - 1;\n\n av_write_image_line(tmp, data, linesize, d, 0, 0, j, 2);\n\n }\n\n }\n\n}\n"}} {"sample_id": "faadf50e2962dd54175647a80bd6fc4319c91973_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void init_excp_602 (CPUPPCState *env)\n+\n {\n \n #if !defined(CONFIG_USER_ONLY)\n@@ -18,9 +18,9 @@\n \n env->excp_vectors[POWERPC_EXCP_PROGRAM] = 0x00000700;\n \n+ env->excp_vectors[POWERPC_EXCP_FPU] = 0x00000800;\n \n+ env->excp_vectors[POWERPC_EXCP_DECR] = 0x00000900;\n \n env->excp_vectors[POWERPC_EXCP_SYSCALL] = 0x00000C00;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void init_excp_602 (CPUPPCState *env)\n\n{\n\n#if !defined(CONFIG_USER_ONLY)\n\n env->excp_vectors[POWERPC_EXCP_RESET] = 0x00000100;\n\n env->excp_vectors[POWERPC_EXCP_MCHECK] = 0x00000200;\n\n env->excp_vectors[POWERPC_EXCP_DSI] = 0x00000300;\n\n env->excp_vectors[POWERPC_EXCP_ISI] = 0x00000400;\n\n env->excp_vectors[POWERPC_EXCP_EXTERNAL] = 0x00000500;\n\n env->excp_vectors[POWERPC_EXCP_ALIGN] = 0x00000600;\n\n env->excp_vectors[POWERPC_EXCP_PROGRAM] = 0x00000700;\n\n env->excp_vectors[POWERPC_EXCP_FPU] = 0x00000800;\n\n env->excp_vectors[POWERPC_EXCP_DECR] = 0x00000900;\n\n env->excp_vectors[POWERPC_EXCP_SYSCALL] = 0x00000C00;\n\n env->excp_vectors[POWERPC_EXCP_TRACE] = 0x00000D00;\n\n env->excp_vectors[POWERPC_EXCP_FPA] = 0x00000E00;\n\n env->excp_vectors[POWERPC_EXCP_IFTLB] = 0x00001000;\n\n env->excp_vectors[POWERPC_EXCP_DLTLB] = 0x00001100;\n\n env->excp_vectors[POWERPC_EXCP_DSTLB] = 0x00001200;\n\n env->excp_vectors[POWERPC_EXCP_IABR] = 0x00001300;\n\n env->excp_vectors[POWERPC_EXCP_SMI] = 0x00001400;\n\n env->excp_vectors[POWERPC_EXCP_WDT] = 0x00001500;\n\n env->excp_vectors[POWERPC_EXCP_EMUL] = 0x00001600;\n\n env->excp_prefix = 0xFFF00000;\n\n /* Hardware reset vector */\n\n env->hreset_vector = 0xFFFFFFFCUL;\n\n#endif\n\n}\n"}} {"sample_id": "5c6c0e513600ba57c3e73b7151d3c0664438f7b5_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n+static void scsi_cancel_io(SCSIDevice *d, uint32_t tag)\n+\n+{\n+\n+ DPRINTF(\"scsi_cancel_io 0x%x\\n\", tag);\n+\n+ SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);\n+\n+ SCSIGenericReq *r;\n+\n DPRINTF(\"Cancel tag=0x%x\\n\", tag);\n \n r = scsi_find_request(s, tag);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void scsi_cancel_io(SCSIDevice *d, uint32_t tag)\n\n{\n\n DPRINTF(\"scsi_cancel_io 0x%x\\n\", tag);\n\n SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, d);\n\n SCSIGenericReq *r;\n\n DPRINTF(\"Cancel tag=0x%x\\n\", tag);\n\n r = scsi_find_request(s, tag);\n\n if (r) {\n\n if (r->req.aiocb)\n\n bdrv_aio_cancel(r->req.aiocb);\n\n r->req.aiocb = NULL;\n\n scsi_req_dequeue(&r->req);\n\n }\n\n}\n"}} {"sample_id": "dc0bc0f84ec3ecc475182c5c2934ca8ef5a45de2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -46,11 +46,11 @@\n \n \n \n+ frame_bits = process_exponents(s, mdct_coef, exp_shift, exp, exp_strategy,\n+\n+ encoded_exp, num_exp_groups, grouped_exp);\n+\n+\n \n compute_bit_allocation(s, bap, encoded_exp, exp_strategy, frame_bits);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ac3_encode_frame(AVCodecContext *avctx,\n\n unsigned char *frame, int buf_size, void *data)\n\n{\n\n AC3EncodeContext *s = avctx->priv_data;\n\n const int16_t *samples = data;\n\n int16_t planar_samples[AC3_MAX_CHANNELS][AC3_BLOCK_SIZE+AC3_FRAME_SIZE];\n\n int32_t mdct_coef[AC3_MAX_BLOCKS][AC3_MAX_CHANNELS][AC3_MAX_COEFS];\n\n uint8_t exp[AC3_MAX_BLOCKS][AC3_MAX_CHANNELS][AC3_MAX_COEFS];\n\n uint8_t exp_strategy[AC3_MAX_BLOCKS][AC3_MAX_CHANNELS];\n\n uint8_t encoded_exp[AC3_MAX_BLOCKS][AC3_MAX_CHANNELS][AC3_MAX_COEFS];\n\n uint8_t num_exp_groups[AC3_MAX_BLOCKS][AC3_MAX_CHANNELS];\n\n uint8_t grouped_exp[AC3_MAX_BLOCKS][AC3_MAX_CHANNELS][AC3_MAX_EXP_GROUPS];\n\n uint8_t bap[AC3_MAX_BLOCKS][AC3_MAX_CHANNELS][AC3_MAX_COEFS];\n\n int8_t exp_shift[AC3_MAX_BLOCKS][AC3_MAX_CHANNELS];\n\n uint16_t qmant[AC3_MAX_BLOCKS][AC3_MAX_CHANNELS][AC3_MAX_COEFS];\n\n int frame_bits;\n\n\n\n if (s->bit_alloc.sr_code == 1)\n\n adjust_frame_size(s);\n\n\n\n deinterleave_input_samples(s, samples, planar_samples);\n\n\n\n apply_mdct(s, planar_samples, exp_shift, mdct_coef);\n\n\n\n frame_bits = process_exponents(s, mdct_coef, exp_shift, exp, exp_strategy,\n\n encoded_exp, num_exp_groups, grouped_exp);\n\n\n\n compute_bit_allocation(s, bap, encoded_exp, exp_strategy, frame_bits);\n\n\n\n quantize_mantissas(s, mdct_coef, exp_shift, encoded_exp, bap, qmant);\n\n\n\n output_frame(s, frame, exp_strategy, num_exp_groups, grouped_exp, bap, qmant);\n\n\n\n return s->frame_size;\n\n}\n"}} {"sample_id": "61cd19b8bc32185c8caf64d89d1b0909877a0707", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static av_always_inline void paint_raw(uint8_t *dst, int w, int h,\n \n const uint8_t *src, int bpp,\n \n+ int be, int stride)\n+\n {\n \n int i, j, p;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static av_always_inline void paint_raw(uint8_t *dst, int w, int h,\n\n const uint8_t *src, int bpp,\n\n int be, int stride)\n\n{\n\n int i, j, p;\n\n for (j = 0; j < h; j++) {\n\n for (i = 0; i < w; i++) {\n\n p = vmnc_get_pixel(src, bpp, be);\n\n src += bpp;\n\n switch (bpp) {\n\n case 1:\n\n dst[i] = p;\n\n break;\n\n case 2:\n\n ((uint16_t*)dst)[i] = p;\n\n break;\n\n case 4:\n\n ((uint32_t*)dst)[i] = p;\n\n break;\n\n }\n\n }\n\n dst += stride;\n\n }\n\n}\n"}} {"sample_id": "213189ab65d83ecd9072f27c80a15dcb91b6bdbf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void ide_dma_restart_cb(void *opaque, int running, int reason)\n \n {\n+\n+ BMDMAState *bm = opaque;\n+\n+ if (!running)\n+\n return;\n \n if (bm->status & BM_STATUS_DMA_RETRY) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ide_dma_restart_cb(void *opaque, int running, int reason)\n\n{\n\n BMDMAState *bm = opaque;\n\n if (!running)\n\n return;\n\n if (bm->status & BM_STATUS_DMA_RETRY) {\n\n bm->status &= ~BM_STATUS_DMA_RETRY;\n\n ide_dma_restart(bm->ide_if);\n\n } else if (bm->status & BM_STATUS_PIO_RETRY) {\n\n bm->status &= ~BM_STATUS_PIO_RETRY;\n\n ide_sector_write(bm->ide_if);\n\n }\n\n}\n"}} {"sample_id": "17e2377abf16c3951d7d34521ceade4d7dc31d01", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n free(ptr);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_free(void *ptr)\n\n{\n\n free(ptr);\n\n}\n"}} {"sample_id": "a4f6be86d67ae30d494fbe8a470bc32b715d75a9_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n const int qp_bd_offset = 6 * (h->sps.bit_depth_luma - 8);\n \n const unsigned int index_a = qp - qp_bd_offset + h->slice_alpha_c0_offset;\n+\n+ const int alpha = alpha_table[index_a];\n+\n+ const int beta = beta_table[qp - qp_bd_offset + h->slice_beta_offset];\n+\n if (alpha ==0 || beta == 0) return;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void av_always_inline filter_mb_edgecv( uint8_t *pix, int stride, const int16_t bS[4], unsigned int qp, H264Context *h ) {\n\n const int qp_bd_offset = 6 * (h->sps.bit_depth_luma - 8);\n\n const unsigned int index_a = qp - qp_bd_offset + h->slice_alpha_c0_offset;\n\n const int alpha = alpha_table[index_a];\n\n const int beta = beta_table[qp - qp_bd_offset + h->slice_beta_offset];\n\n if (alpha ==0 || beta == 0) return;\n\n\n\n if( bS[0] < 4 ) {\n\n int8_t tc[4];\n\n tc[0] = tc0_table[index_a][bS[0]]+1;\n\n tc[1] = tc0_table[index_a][bS[1]]+1;\n\n tc[2] = tc0_table[index_a][bS[2]]+1;\n\n tc[3] = tc0_table[index_a][bS[3]]+1;\n\n h->h264dsp.h264_h_loop_filter_chroma(pix, stride, alpha, beta, tc);\n\n } else {\n\n h->h264dsp.h264_h_loop_filter_chroma_intra(pix, stride, alpha, beta);\n\n }\n\n}\n"}} {"sample_id": "428098165de4c3edfe42c1b7f00627d287015863_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+static int mlib_YUV2ABGR420_32(SwsContext *c, uint8_t* src[], int srcStride[], int srcSliceY,\n \n+ int srcSliceH, uint8_t* dst[], int dstStride[]){\n+\n if(c->srcFormat == PIX_FMT_YUV422P){\n \n+\tsrcStride[1] *= 2;\n \n \tsrcStride[2] *= 2;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int mlib_YUV2ABGR420_32(SwsContext *c, uint8_t* src[], int srcStride[], int srcSliceY,\n\n int srcSliceH, uint8_t* dst[], int dstStride[]){\n\n if(c->srcFormat == PIX_FMT_YUV422P){\n\n\tsrcStride[1] *= 2;\n\n\tsrcStride[2] *= 2;\n\n }\n\n\n\n assert(srcStride[1] == srcStride[2]);\n\n\n\n mlib_VideoColorYUV2ABGR420(dst[0]+srcSliceY*dstStride[0], src[0], src[1], src[2], c->dstW,\n\n\t\t\t srcSliceH, dstStride[0], srcStride[0], srcStride[1]);\n\n return srcSliceH;\n\n}\n"}} {"sample_id": "bc488ec28aec4bc91ba47283c49c9f7f25696eaa_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n \n c->get_pixels = get_pixels_8_c;\n \n+ }\n+\n+ break;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "av_cold void ff_pixblockdsp_init(PixblockDSPContext *c, AVCodecContext *avctx)\n\n{\n\n const unsigned high_bit_depth = avctx->bits_per_raw_sample > 8;\n\n\n\n\n c->diff_pixels = diff_pixels_c;\n\n\n\n switch (avctx->bits_per_raw_sample) {\n\n case 9:\n\n case 10:\n\n case 12:\n\n case 14:\n\n c->get_pixels = get_pixels_16_c;\n\n break;\n\n default:\n\n if (avctx->bits_per_raw_sample<=8 || avctx->codec_type != AVMEDIA_TYPE_VIDEO) {\n\n c->get_pixels = get_pixels_8_c;\n\n }\n\n break;\n\n }\n\n\n\n if (ARCH_ALPHA)\n\n ff_pixblockdsp_init_alpha(c, avctx, high_bit_depth);\n\n if (ARCH_ARM)\n\n ff_pixblockdsp_init_arm(c, avctx, high_bit_depth);\n\n if (ARCH_PPC)\n\n ff_pixblockdsp_init_ppc(c, avctx, high_bit_depth);\n\n if (ARCH_X86)\n\n ff_pixblockdsp_init_x86(c, avctx, high_bit_depth);\n\n if (ARCH_MIPS)\n\n ff_pixblockdsp_init_mips(c, avctx, high_bit_depth);\n\n}"}} {"sample_id": "3954d33ab7f82f5a5fa0ced231849920265a5fec_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n info = (VIOsPAPRDeviceInfo *)qdev_get_info(&dev->qdev);\n \n \n+\n+ if (mode & ~info->signal_mask) {\n+\n+ return H_PARAMETER;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static target_ulong h_vio_signal(CPUState *env, sPAPREnvironment *spapr,\n\n target_ulong opcode,\n\n target_ulong *args)\n\n{\n\n target_ulong reg = args[0];\n\n target_ulong mode = args[1];\n\n VIOsPAPRDevice *dev = spapr_vio_find_by_reg(spapr->vio_bus, reg);\n\n VIOsPAPRDeviceInfo *info;\n\n\n\n if (!dev) {\n\n return H_PARAMETER;\n\n }\n\n\n\n info = (VIOsPAPRDeviceInfo *)qdev_get_info(&dev->qdev);\n\n\n\n if (mode & ~info->signal_mask) {\n\n return H_PARAMETER;\n\n }\n\n\n\n dev->signal_state = mode;\n\n\n\n return H_SUCCESS;\n\n}\n"}} {"sample_id": "e69a17f65e9f12f33c48b04a789e49d40a8993f5_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static inline int IRQ_testbit(IRQQueue *q, int n_IRQ)\n \n {\n+\n return test_bit(q->queue, n_IRQ);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline int IRQ_testbit(IRQQueue *q, int n_IRQ)\n\n{\n\n return test_bit(q->queue, n_IRQ);\n\n}\n"}} {"sample_id": "4843227b2ca6876d07caddddd62e58e52d67e94f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,12 +5,12 @@\n {\n \n const uint8_t *const buf_start = buf;\n+\n+ unsigned x;\n \n for (x = 0; x < dst_size && buf < buf_end;) {\n+\n+ unsigned length;\n \n const int8_t value = *buf++;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int decode_byterun(uint8_t *dst, int dst_size,\n\n const uint8_t *buf, const uint8_t *const buf_end)\n\n{\n\n const uint8_t *const buf_start = buf;\n\n unsigned x;\n\n for (x = 0; x < dst_size && buf < buf_end;) {\n\n unsigned length;\n\n const int8_t value = *buf++;\n\n if (value >= 0) {\n\n length = value + 1;\n\n memcpy(dst + x, buf, FFMIN3(length, dst_size - x, buf_end - buf));\n\n buf += length;\n\n } else if (value > -128) {\n\n length = -value + 1;\n\n memset(dst + x, *buf++, FFMIN(length, dst_size - x));\n\n } else { // noop\n\n continue;\n\n }\n\n x += length;\n\n }\n\n if (x < dst_size) {\n\n av_log(NULL, AV_LOG_WARNING, \"decode_byterun ended before plane size\\n\");\n\n memset(dst+x, 0, dst_size - x);\n\n }\n\n return buf - buf_start;\n\n}\n"}} {"sample_id": "de1568a452d8348917fee533fe17517131dccf95", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,20 +1,20 @@\n static int add_file(AVFormatContext *avf, char *filename, ConcatFile **rfile,\n \n unsigned *nb_files_alloc)\n+\n {\n \n ConcatContext *cat = avf->priv_data;\n+\n ConcatFile *file;\n \n+ char *url;\n \n+ size_t url_len;\n \n \n \n+ if (cat->safe > 0 && !safe_filename(filename)) {\n \n av_log(avf, AV_LOG_ERROR, \"Unsafe file name '%s'\\n\", filename);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int add_file(AVFormatContext *avf, char *filename, ConcatFile **rfile,\n\n unsigned *nb_files_alloc)\n\n{\n\n ConcatContext *cat = avf->priv_data;\n\n ConcatFile *file;\n\n char *url;\n\n size_t url_len;\n\n\n\n if (cat->safe > 0 && !safe_filename(filename)) {\n\n av_log(avf, AV_LOG_ERROR, \"Unsafe file name '%s'\\n\", filename);\n\n return AVERROR(EPERM);\n\n }\n\n url_len = strlen(avf->filename) + strlen(filename) + 16;\n\n if (!(url = av_malloc(url_len)))\n\n return AVERROR(ENOMEM);\n\n ff_make_absolute_url(url, url_len, avf->filename, filename);\n\n av_free(filename);\n\n\n\n if (cat->nb_files >= *nb_files_alloc) {\n\n size_t n = FFMAX(*nb_files_alloc * 2, 16);\n\n ConcatFile *new_files;\n\n if (n <= cat->nb_files || n > SIZE_MAX / sizeof(*cat->files) ||\n\n !(new_files = av_realloc(cat->files, n * sizeof(*cat->files))))\n\n return AVERROR(ENOMEM);\n\n cat->files = new_files;\n\n *nb_files_alloc = n;\n\n }\n\n\n\n file = &cat->files[cat->nb_files++];\n\n memset(file, 0, sizeof(*file));\n\n *rfile = file;\n\n\n\n file->url = url;\n\n file->start_time = AV_NOPTS_VALUE;\n\n file->duration = AV_NOPTS_VALUE;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "1509d739a036b9838e12f28dac9f09ac37bc3928", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,10 +14,10 @@\n \n \n \n+\n+ if (s->staging_texture)\n+\n+ ID3D11Texture2D_Release(s->staging_texture);\n+\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void d3d11va_frames_uninit(AVHWFramesContext *ctx)\n\n{\n\n AVD3D11VAFramesContext *frames_hwctx = ctx->hwctx;\n\n D3D11VAFramesContext *s = ctx->internal->priv;\n\n\n\n if (frames_hwctx->texture)\n\n ID3D11Texture2D_Release(frames_hwctx->texture);\n\n\n\n\n if (s->staging_texture)\n\n ID3D11Texture2D_Release(s->staging_texture);\n\n\n}"}} {"sample_id": "6fea8454acff29735ea46184cb183ca6ff42e514", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,21 +9,21 @@\n char empty[32768];\n \n char* bu =(char*)(((long)empty + 32) & ~0xf);\n+\n+\n+\n+ int sum = 0;\n+\n+\n+\n+ while (pix->name)\n \n+ {\n+\n+\tint i;\n+\n+ uint64_t te, ts;\n+\n op_pixels_func func = pix->func;\n \n \tchar* im = bu;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static test_speed(int step)\n\n{\n\n const struct pix_func* pix = pix_func;\n\n const int linesize = 720;\n\n char empty[32768];\n\n char* bu =(char*)(((long)empty + 32) & ~0xf);\n\n\n\n int sum = 0;\n\n\n\n while (pix->name)\n\n {\n\n\tint i;\n\n uint64_t te, ts;\n\n op_pixels_func func = pix->func;\n\n\tchar* im = bu;\n\n\n\n\tif (!(pix->mm_flags & mm_flags))\n\n continue;\n\n\n\n\tprintf(\"%30s... \", pix->name);\n\n fflush(stdout);\n\n\tts = rdtsc();\n\n\tfor(i=0; i<100000; i++){\n\n\t func(im, im + 1000, linesize, 16);\n\n\t im += step;\n\n\t if (im > bu + 20000)\n\n\t\tim = bu;\n\n\t}\n\n\tte = rdtsc();\n\n emms();\n\n\tprintf(\"% 9d\\n\", (int)(te - ts));\n\n sum += (te - ts) / 100000;\n\n\tif (pix->mm_flags & PAD)\n\n puts(\"\");\n\n pix++;\n\n }\n\n\n\n printf(\"Total sum: %d\\n\", sum);\n\n}\n"}} {"sample_id": "11ca3416f92744f376c08e5f31bcbe5d9b44acb2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n for (j = 0; j < avctx->width; j++) {\n val = AV_RL32(src);\n u[j] = (val >> 2) & 0x3FF;\n+ y[j] = (val >> 12) & 0x3FF;\n+ v[j] = (val >> 22);\n+ src += 4;\n+ y += pic->linesize[0] >> 1;\n+ u += pic->linesize[1] >> 1;\n v += pic->linesize[2] >> 1;\n *data_size = sizeof(AVFrame);\n *(AVFrame *)data = *pic;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int v410_decode_frame(AVCodecContext *avctx, void *data,\n int *data_size, AVPacket *avpkt)\n{\n AVFrame *pic = avctx->coded_frame;\n uint8_t *src = avpkt->data;\n uint16_t *y, *u, *v;\n uint32_t val;\n int i, j;\n if (pic->data[0])\n avctx->release_buffer(avctx, pic);\n pic->reference = 0;\n if (avctx->get_buffer(avctx, pic) < 0) {\n av_log(avctx, AV_LOG_ERROR, \"Could not allocate buffer.\\n\");\n return AVERROR(ENOMEM);\n pic->key_frame = 1;\n pic->pict_type = FF_I_TYPE;\n y = (uint16_t *)pic->data[0];\n u = (uint16_t *)pic->data[1];\n v = (uint16_t *)pic->data[2];\n for (i = 0; i < avctx->height; i++) {\n for (j = 0; j < avctx->width; j++) {\n val = AV_RL32(src);\n u[j] = (val >> 2) & 0x3FF;\n y[j] = (val >> 12) & 0x3FF;\n v[j] = (val >> 22);\n src += 4;\n y += pic->linesize[0] >> 1;\n u += pic->linesize[1] >> 1;\n v += pic->linesize[2] >> 1;\n *data_size = sizeof(AVFrame);\n *(AVFrame *)data = *pic;\n return avpkt->size;"}} {"sample_id": "4d1628e832dfc6ec02b0d196f6cc250aaa7bf3b3_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+uint64_t helper_addlv(CPUAlphaState *env, uint64_t op1, uint64_t op2)\n+\n+{\n+\n+ uint64_t tmp = op1;\n \n+ op1 = (uint32_t)(op1 + op2);\n \n if (unlikely((tmp ^ op2 ^ (-1UL)) & (tmp ^ op1) & (1UL << 31))) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "uint64_t helper_addlv(CPUAlphaState *env, uint64_t op1, uint64_t op2)\n\n{\n\n uint64_t tmp = op1;\n\n op1 = (uint32_t)(op1 + op2);\n\n if (unlikely((tmp ^ op2 ^ (-1UL)) & (tmp ^ op1) & (1UL << 31))) {\n\n arith_excp(env, GETPC(), EXC_M_IOV, 0);\n\n }\n\n return op1;\n\n}\n"}} {"sample_id": "f6774f905fb3cfdc319523ac640be30b14c1bc55_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,13 +3,13 @@\n {\n \n int x, y, plane;\n+\n int score = 0;\n \n int64_t score64 = 0;\n \n+\n+\n for (plane = 0; plane < 3; plane++) {\n \n const int stride = p->f.linesize[plane];", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int skip_check(MpegEncContext *s, Picture *p, Picture *ref)\n\n{\n\n int x, y, plane;\n\n int score = 0;\n\n int64_t score64 = 0;\n\n\n\n for (plane = 0; plane < 3; plane++) {\n\n const int stride = p->f.linesize[plane];\n\n const int bw = plane ? 1 : 2;\n\n for (y = 0; y < s->mb_height * bw; y++) {\n\n for (x = 0; x < s->mb_width * bw; x++) {\n\n int off = p->shared ? 0 : 16;\n\n uint8_t *dptr = p->f.data[plane] + 8 * (x + y * stride) + off;\n\n uint8_t *rptr = ref->f.data[plane] + 8 * (x + y * stride);\n\n int v = s->dsp.frame_skip_cmp[1](s, dptr, rptr, stride, 8);\n\n\n\n switch (s->avctx->frame_skip_exp) {\n\n case 0: score = FFMAX(score, v); break;\n\n case 1: score += FFABS(v); break;\n\n case 2: score += v * v; break;\n\n case 3: score64 += FFABS(v * v * (int64_t)v); break;\n\n case 4: score64 += v * v * (int64_t)(v * v); break;\n\n }\n\n }\n\n }\n\n }\n\n\n\n if (score)\n\n score64 = score;\n\n\n\n if (score64 < s->avctx->frame_skip_threshold)\n\n return 1;\n\n if (score64 < ((s->avctx->frame_skip_factor * (int64_t)s->lambda) >> 8))\n\n return 1;\n\n return 0;\n\n}\n"}} {"sample_id": "aedbe19297907143f17b733a7ff0e0534377bed1_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+int qemu_reset_requested_get(void)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "int qemu_reset_requested_get(void)\n\n{\n\n return reset_requested;\n\n}\n"}} {"sample_id": "07e95cd529af345fdeea230913f68eff5b925bb6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,16 +1,16 @@\n+static char *qio_channel_websock_handshake_entry(const char *handshake,\n+\n+ size_t handshake_len,\n+\n+ const char *name)\n+\n+{\n+\n+ char *begin, *end, *ret = NULL;\n \n char *line = g_strdup_printf(\"%s%s: \",\n+\n+ QIO_CHANNEL_WEBSOCK_HANDSHAKE_DELIM,\n \n name);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static char *qio_channel_websock_handshake_entry(const char *handshake,\n\n size_t handshake_len,\n\n const char *name)\n\n{\n\n char *begin, *end, *ret = NULL;\n\n char *line = g_strdup_printf(\"%s%s: \",\n\n QIO_CHANNEL_WEBSOCK_HANDSHAKE_DELIM,\n\n name);\n\n begin = g_strstr_len(handshake, handshake_len, line);\n\n if (begin != NULL) {\n\n begin += strlen(line);\n\n end = g_strstr_len(begin, handshake_len - (begin - handshake),\n\n QIO_CHANNEL_WEBSOCK_HANDSHAKE_DELIM);\n\n if (end != NULL) {\n\n ret = g_strndup(begin, end - begin);\n\n }\n\n }\n\n g_free(line);\n\n return ret;\n\n}\n"}} {"sample_id": "7b46add7257628bffac96d3002308d1f9e1ed172", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n int av_cold ff_celt_pvq_init(CeltPVQ **pvq, int encode)\n \n {\n+\n+ CeltPVQ *s = av_malloc(sizeof(CeltPVQ));\n+\n+ if (!s)\n+\n return AVERROR(ENOMEM);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int av_cold ff_celt_pvq_init(CeltPVQ **pvq, int encode)\n\n{\n\n CeltPVQ *s = av_malloc(sizeof(CeltPVQ));\n\n if (!s)\n\n return AVERROR(ENOMEM);\n\n\n\n s->pvq_search = ppp_pvq_search_c;\n\n s->quant_band = encode ? pvq_encode_band : pvq_decode_band;\n\n s->band_cost = pvq_band_cost;\n\n\n\n if (ARCH_X86)\n\n ff_opus_dsp_init_x86(s);\n\n\n\n *pvq = s;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "e2779de053b64f023de382fd87b3596613d47d1e_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n /* align memory type resource size */\n \n r_size = xen_pt_get_emul_size(base->bar_flag, r_size);\n+\n+\n+\n+ /* set emulate mask and read-only mask */\n+\n bar_ro_mask = (reg->ro_mask | (r_size - 1)) & ~PCI_ROM_ADDRESS_ENABLE;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int xen_pt_exp_rom_bar_reg_write(XenPCIPassthroughState *s,\n\n XenPTReg *cfg_entry, uint32_t *val,\n\n uint32_t dev_value, uint32_t valid_mask)\n\n{\n\n XenPTRegInfo *reg = cfg_entry->reg;\n\n XenPTRegion *base = NULL;\n\n PCIDevice *d = (PCIDevice *)&s->dev;\n\n uint32_t writable_mask = 0;\n\n uint32_t throughable_mask = get_throughable_mask(s, reg, valid_mask);\n\n pcibus_t r_size = 0;\n\n uint32_t bar_ro_mask = 0;\n\n\n\n r_size = d->io_regions[PCI_ROM_SLOT].size;\n\n base = &s->bases[PCI_ROM_SLOT];\n\n /* align memory type resource size */\n\n r_size = xen_pt_get_emul_size(base->bar_flag, r_size);\n\n\n\n /* set emulate mask and read-only mask */\n\n bar_ro_mask = (reg->ro_mask | (r_size - 1)) & ~PCI_ROM_ADDRESS_ENABLE;\n\n\n\n /* modify emulate register */\n\n writable_mask = ~bar_ro_mask & valid_mask;\n\n cfg_entry->data = XEN_PT_MERGE_VALUE(*val, cfg_entry->data, writable_mask);\n\n\n\n /* create value for writing to I/O device register */\n\n *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "fba72476c6b7be60ac74c5bcdc06c61242d1fe4f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+ ICH9LPCState *lpc = ICH9_LPC_DEVICE(lpc_pci);\n+\n+\n \n ich9_pm_init(lpc_pci, &lpc->pm, qemu_allocate_irq(ich9_set_sci, lpc, 0));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ich9_lpc_pm_init(PCIDevice *lpc_pci)\n\n{\n\n ICH9LPCState *lpc = ICH9_LPC_DEVICE(lpc_pci);\n\n\n\n ich9_pm_init(lpc_pci, &lpc->pm, qemu_allocate_irq(ich9_set_sci, lpc, 0));\n\n ich9_lpc_reset(&lpc->d.qdev);\n\n}\n"}} {"sample_id": "afebf470ca73c17cc8393bfd7eeebfdf6809c2b8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n \n \n char *buffer = NULL;\n+\n+ av_dict_copy(&dict, m, 0);\n+\n+ print_dict(dict);\n+\n av_dict_get_string(dict, &buffer, val, pair);\n \n printf(\"%s\\n\", buffer);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_separators(const AVDictionary *m, const char pair, const char val)\n\n{\n\n AVDictionary *dict = NULL;\n\n char pairs[] = {pair , '\\0'};\n\n char vals[] = {val, '\\0'};\n\n\n\n char *buffer = NULL;\n\n av_dict_copy(&dict, m, 0);\n\n print_dict(dict);\n\n av_dict_get_string(dict, &buffer, val, pair);\n\n printf(\"%s\\n\", buffer);\n\n av_dict_free(&dict);\n\n av_dict_parse_string(&dict, buffer, vals, pairs, 0);\n\n av_freep(&buffer);\n\n print_dict(dict);\n\n av_dict_free(&dict);\n\n}\n"}} {"sample_id": "33e66b86d89040f0a9e99aa53deb74ce8936a649_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n const char *driver;\n \n DeviceState *dev;\n+\n \n \n driver = bdrv_is_sg(dinfo->bdrv) ? \"scsi-generic\" : \"scsi-disk\";", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, DriveInfo *dinfo, int unit)\n\n{\n\n const char *driver;\n\n DeviceState *dev;\n\n\n\n driver = bdrv_is_sg(dinfo->bdrv) ? \"scsi-generic\" : \"scsi-disk\";\n\n dev = qdev_create(&bus->qbus, driver);\n\n qdev_prop_set_uint32(dev, \"scsi-id\", unit);\n\n qdev_prop_set_drive(dev, \"drive\", dinfo);\n\n qdev_init(dev);\n\n return DO_UPCAST(SCSIDevice, qdev, dev);\n\n}\n"}} {"sample_id": "f9f46db444a2dfc2ebf1f9f7d4b42163ab33187d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -40,11 +40,11 @@\n \n default:\n \n+ /* Nothing is stored, but protection is checked and the\n+\n+ cacheline is marked dirty. */\n+\n+#ifndef CONFIG_USER_ONLY\n \n probe_write(env, addr, cpu_mmu_index(env, 0), ra);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void HELPER(stby_e)(CPUHPPAState *env, target_ulong addr, target_ulong val)\n\n{\n\n uintptr_t ra = GETPC();\n\n\n\n switch (addr & 3) {\n\n case 3:\n\n /* The 3 byte store must appear atomic. */\n\n if (parallel_cpus) {\n\n atomic_store_3(env, addr - 3, val, 0xffffff00u, ra);\n\n } else {\n\n cpu_stw_data_ra(env, addr - 3, val >> 16, ra);\n\n cpu_stb_data_ra(env, addr - 1, val >> 8, ra);\n\n }\n\n break;\n\n case 2:\n\n cpu_stw_data_ra(env, addr - 2, val >> 16, ra);\n\n break;\n\n case 1:\n\n cpu_stb_data_ra(env, addr - 1, val >> 24, ra);\n\n break;\n\n default:\n\n /* Nothing is stored, but protection is checked and the\n\n cacheline is marked dirty. */\n\n#ifndef CONFIG_USER_ONLY\n\n probe_write(env, addr, cpu_mmu_index(env, 0), ra);\n\n#endif\n\n break;\n\n }\n\n}\n"}} {"sample_id": "af60314291af3cabda18d27f928b0e0ff899cc76", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static bool vhost_section(MemoryRegionSection *section)\n+\n {\n \n return memory_region_is_ram(section->mr);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static bool vhost_section(MemoryRegionSection *section)\n\n{\n\n return memory_region_is_ram(section->mr);\n\n}\n"}} {"sample_id": "9745807191a81c45970f780166f44a7f93b18653_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n+static void gen_ove_cyov(DisasContext *dc, TCGv cy, TCGv ov)\n \n+{\n+\n+ if (dc->tb_flags & SR_OVE) {\n+\n TCGv t0 = tcg_temp_new();\n \n tcg_gen_or_tl(t0, cy, ov);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_ove_cyov(DisasContext *dc, TCGv cy, TCGv ov)\n\n{\n\n if (dc->tb_flags & SR_OVE) {\n\n TCGv t0 = tcg_temp_new();\n\n tcg_gen_or_tl(t0, cy, ov);\n\n gen_helper_ove(cpu_env, t0);\n\n tcg_temp_free(t0);\n\n }\n\n}\n"}} {"sample_id": "3d948cdf3760b52238038626a7ffa7d30913060b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n bs = bdrv_find(device);\n \n+ if (!bs || !bs->job) {\n+\n+ return NULL;\n+\n }\n \n return bs->job;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static BlockJob *find_block_job(const char *device)\n\n{\n\n BlockDriverState *bs;\n\n\n\n bs = bdrv_find(device);\n\n if (!bs || !bs->job) {\n\n return NULL;\n\n }\n\n return bs->job;\n\n}\n"}} {"sample_id": "2c62f08ddbf3fa80dc7202eb9a2ea60ae44e2cc5_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n qdev_init_gpio_in(&s->busdev.qdev, pl110_mux_ctrl_set, 1);\n \n s->con = graphic_console_init(pl110_update_display,\n+\n+ pl110_invalidate_display,\n+\n+ NULL, NULL, s);\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pl110_init(SysBusDevice *dev)\n\n{\n\n pl110_state *s = FROM_SYSBUS(pl110_state, dev);\n\n\n\n memory_region_init_io(&s->iomem, &pl110_ops, s, \"pl110\", 0x1000);\n\n sysbus_init_mmio(dev, &s->iomem);\n\n sysbus_init_irq(dev, &s->irq);\n\n qdev_init_gpio_in(&s->busdev.qdev, pl110_mux_ctrl_set, 1);\n\n s->con = graphic_console_init(pl110_update_display,\n\n pl110_invalidate_display,\n\n NULL, NULL, s);\n\n return 0;\n\n}\n"}} {"sample_id": "0c22311b56e66115675c4a96e4c78547886a4171", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void opt_frame_pad_left(const char *arg)\n \n {\n+\n+ frame_padleft = atoi(arg);\n+\n if (frame_padleft < 0) {\n \n fprintf(stderr, \"Incorrect left pad size\\n\");", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void opt_frame_pad_left(const char *arg)\n\n{\n\n frame_padleft = atoi(arg);\n\n if (frame_padleft < 0) {\n\n fprintf(stderr, \"Incorrect left pad size\\n\");\n\n av_exit(1);\n\n }\n\n}\n"}} {"sample_id": "0e9b9edae7bebfd31fdbead4ccbbce03876a7edd_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n AcpiTableMcfg *mcfg;\n \n const char *sig;\n+\n+ int len = sizeof(*mcfg) + 1 * sizeof(mcfg->allocation[0]);\n+\n+\n+\n mcfg = acpi_data_push(table_data, len);\n \n mcfg->allocation[0].address = cpu_to_le64(info->mcfg_base);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "build_mcfg_q35(GArray *table_data, GArray *linker, AcpiMcfgInfo *info)\n\n{\n\n AcpiTableMcfg *mcfg;\n\n const char *sig;\n\n int len = sizeof(*mcfg) + 1 * sizeof(mcfg->allocation[0]);\n\n\n\n mcfg = acpi_data_push(table_data, len);\n\n mcfg->allocation[0].address = cpu_to_le64(info->mcfg_base);\n\n /* Only a single allocation so no need to play with segments */\n\n mcfg->allocation[0].pci_segment = cpu_to_le16(0);\n\n mcfg->allocation[0].start_bus_number = 0;\n\n mcfg->allocation[0].end_bus_number = PCIE_MMCFG_BUS(info->mcfg_size - 1);\n\n\n\n /* MCFG is used for ECAM which can be enabled or disabled by guest.\n\n * To avoid table size changes (which create migration issues),\n\n * always create the table even if there are no allocations,\n\n * but set the signature to a reserved value in this case.\n\n * ACPI spec requires OSPMs to ignore such tables.\n\n */\n\n if (info->mcfg_base == PCIE_BASE_ADDR_UNMAPPED) {\n\n /* Reserved signature: ignored by OSPM */\n\n sig = \"QEMU\";\n\n } else {\n\n sig = \"MCFG\";\n\n }\n\n build_header(linker, table_data, (void *)mcfg, sig, len, 1, NULL, NULL);\n\n}\n"}} {"sample_id": "9100d4d6327b077c44e5fdbc8082255f11953978", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ int64_t filesize, duration;\n \n int bit_rate, i;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void av_estimate_timings_from_bit_rate(AVFormatContext *ic)\n\n{\n\n int64_t filesize, duration;\n\n int bit_rate, i;\n\n AVStream *st;\n\n\n\n /* if bit_rate is already set, we believe it */\n\n if (ic->bit_rate == 0) {\n\n bit_rate = 0;\n\n for(i=0;inb_streams;i++) {\n\n st = ic->streams[i];\n\n bit_rate += st->codec->bit_rate;\n\n }\n\n ic->bit_rate = bit_rate;\n\n }\n\n\n\n /* if duration is already set, we believe it */\n\n if (ic->duration == AV_NOPTS_VALUE &&\n\n ic->bit_rate != 0 &&\n\n ic->file_size != 0) {\n\n filesize = ic->file_size;\n\n if (filesize > 0) {\n\n for(i = 0; i < ic->nb_streams; i++) {\n\n st = ic->streams[i];\n\n duration= av_rescale(8*filesize, st->time_base.den, ic->bit_rate*(int64_t)st->time_base.num);\n\n if (st->duration == AV_NOPTS_VALUE)\n\n st->duration = duration;\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "318347234d7069b62d38391dd27e269a3107d668_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n sPAPRDIMMState *ds = spapr_pending_dimm_unplugs_find(spapr, PC_DIMM(dev));\n \n+\n+\n+ if (--ds->nr_lmbs) {\n+\n+ return;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void spapr_lmb_release(DeviceState *dev, void *opaque)\n\n{\n\n HotplugHandler *hotplug_ctrl = qdev_get_hotplug_handler(dev);\n\n sPAPRMachineState *spapr = SPAPR_MACHINE(hotplug_ctrl);\n\n sPAPRDIMMState *ds = spapr_pending_dimm_unplugs_find(spapr, PC_DIMM(dev));\n\n\n\n if (--ds->nr_lmbs) {\n\n return;\n\n }\n\n\n\n spapr_pending_dimm_unplugs_remove(spapr, ds);\n\n\n\n /*\n\n * Now that all the LMBs have been removed by the guest, call the\n\n * pc-dimm unplug handler to cleanup up the pc-dimm device.\n\n */\n\n hotplug_handler_unplug(hotplug_ctrl, dev, &error_abort);\n\n}\n"}} {"sample_id": "13a099799e89a76eb921ca452e1b04a7a28a9855_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n __asm__ volatile(\n \n \"mov %%\"REG_b\", \"ESP_OFFSET\"(%5) \\n\\t\"\n+\n+ \"mov %4, %%\"REG_b\" \\n\\t\"\n+\n+ \"push %%\"REG_BP\" \\n\\t\"\n+\n YSCALEYUV2RGB(%%REGBP, %5)\n \n \"pxor %%mm7, %%mm7 \\n\\t\"", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void RENAME(yuv2rgb565_2)(SwsContext *c, const uint16_t *buf0,\n\n const uint16_t *buf1, const uint16_t *ubuf0,\n\n const uint16_t *ubuf1, const uint16_t *vbuf0,\n\n const uint16_t *vbuf1, const uint16_t *abuf0,\n\n const uint16_t *abuf1, uint8_t *dest,\n\n int dstW, int yalpha, int uvalpha, int y)\n\n{\n\n //Note 8280 == DSTW_OFFSET but the preprocessor can't handle that there :(\n\n __asm__ volatile(\n\n \"mov %%\"REG_b\", \"ESP_OFFSET\"(%5) \\n\\t\"\n\n \"mov %4, %%\"REG_b\" \\n\\t\"\n\n \"push %%\"REG_BP\" \\n\\t\"\n\n YSCALEYUV2RGB(%%REGBP, %5)\n\n \"pxor %%mm7, %%mm7 \\n\\t\"\n\n /* mm2=B, %%mm4=G, %%mm5=R, %%mm7=0 */\n\n#ifdef DITHER1XBPP\n\n \"paddusb \"BLUE_DITHER\"(%5), %%mm2 \\n\\t\"\n\n \"paddusb \"GREEN_DITHER\"(%5), %%mm4 \\n\\t\"\n\n \"paddusb \"RED_DITHER\"(%5), %%mm5 \\n\\t\"\n\n#endif\n\n WRITERGB16(%%REGb, 8280(%5), %%REGBP)\n\n \"pop %%\"REG_BP\" \\n\\t\"\n\n \"mov \"ESP_OFFSET\"(%5), %%\"REG_b\" \\n\\t\"\n\n :: \"c\" (buf0), \"d\" (buf1), \"S\" (ubuf0), \"D\" (ubuf1), \"m\" (dest),\n\n \"a\" (&c->redDither)\n\n );\n\n}\n"}} {"sample_id": "6acbe4c6f18e7de00481ff30574262b58526de45_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n if (dc->fw_name) {\n \n+ return dc->fw_name;\n+\n+ } else if (dc->alias) {\n+\n+ return dc->alias;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "const char *qdev_fw_name(DeviceState *dev)\n\n{\n\n DeviceClass *dc = DEVICE_GET_CLASS(dev);\n\n\n\n if (dc->fw_name) {\n\n return dc->fw_name;\n\n } else if (dc->alias) {\n\n return dc->alias;\n\n }\n\n\n\n return object_get_typename(OBJECT(dev));\n\n}\n"}} {"sample_id": "cbba331aa02f29870581ff0b7ded7477b279ae2c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n int64_t ts, const AVRational *time_base, int is_duration)\n \n+{\n+\n+ char buf[128];\n+\n+\n \n if ((!is_duration && ts == AV_NOPTS_VALUE) || (is_duration && ts == 0)) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void writer_print_time(WriterContext *wctx, const char *key,\n\n int64_t ts, const AVRational *time_base, int is_duration)\n\n{\n\n char buf[128];\n\n\n\n if ((!is_duration && ts == AV_NOPTS_VALUE) || (is_duration && ts == 0)) {\n\n writer_print_string(wctx, key, \"N/A\", 1);\n\n } else {\n\n double d = ts * av_q2d(*time_base);\n\n struct unit_value uv;\n\n uv.val.d = d;\n\n uv.unit = unit_second_str;\n\n value_string(buf, sizeof(buf), uv);\n\n writer_print_string(wctx, key, buf, 0);\n\n }\n\n}\n"}} {"sample_id": "1acd7d594c15aa491729c837ad3519d3469e620a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n const int16_t *block,\n \n+ ptrdiff_t stride)\n+\n+{\n \n int i;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void FUNCC(pred8x8_horizontal_add)(uint8_t *pix, const int *block_offset,\n\n const int16_t *block,\n\n ptrdiff_t stride)\n\n{\n\n int i;\n\n for(i=0; i<4; i++)\n\n FUNCC(pred4x4_horizontal_add)(pix + block_offset[i], block + i*16*sizeof(pixel), stride);\n\n}\n"}} {"sample_id": "68d553587c0aa271c3eb2902921b503740d775b6_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+ uint32_t *qh = (uint32_t *) &q->qh;\n+\n+ uint32_t dwords = sizeof(EHCIqh) >> 2;\n \n uint32_t addr = NLPTR_GET(q->qhaddr);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ehci_flush_qh(EHCIQueue *q)\n\n{\n\n uint32_t *qh = (uint32_t *) &q->qh;\n\n uint32_t dwords = sizeof(EHCIqh) >> 2;\n\n uint32_t addr = NLPTR_GET(q->qhaddr);\n\n\n\n put_dwords(addr + 3 * sizeof(uint32_t), qh + 3, dwords - 3);\n\n}\n"}} {"sample_id": "1fdd4b7be3655d39c3594bc215eb1df5ce225c7d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n \n \n /* AioContext is released in .clean() */\n+\n+ state->aio_context = blk_get_aio_context(blk);\n+\n+ aio_context_acquire(state->aio_context);\n+\n \n \n qmp_drive_backup(backup->device, backup->target,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void drive_backup_prepare(BlkTransactionState *common, Error **errp)\n\n{\n\n DriveBackupState *state = DO_UPCAST(DriveBackupState, common, common);\n\n BlockBackend *blk;\n\n DriveBackup *backup;\n\n Error *local_err = NULL;\n\n\n\n assert(common->action->kind == TRANSACTION_ACTION_KIND_DRIVE_BACKUP);\n\n backup = common->action->drive_backup;\n\n\n\n blk = blk_by_name(backup->device);\n\n if (!blk) {\n\n error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,\n\n \"Device '%s' not found\", backup->device);\n\n return;\n\n }\n\n\n\n /* AioContext is released in .clean() */\n\n state->aio_context = blk_get_aio_context(blk);\n\n aio_context_acquire(state->aio_context);\n\n\n\n qmp_drive_backup(backup->device, backup->target,\n\n backup->has_format, backup->format,\n\n backup->sync,\n\n backup->has_mode, backup->mode,\n\n backup->has_speed, backup->speed,\n\n backup->has_bitmap, backup->bitmap,\n\n backup->has_on_source_error, backup->on_source_error,\n\n backup->has_on_target_error, backup->on_target_error,\n\n &local_err);\n\n if (local_err) {\n\n error_propagate(errp, local_err);\n\n return;\n\n }\n\n\n\n state->bs = blk_bs(blk);\n\n state->job = state->bs->job;\n\n}\n"}} {"sample_id": "4f97558e100f66f953ba7576b0ced146e6846997", "diff": "--- a/source.c\n+++ b/source.c\n@@ -36,11 +36,11 @@\n \n qemu_file_set_blocking(mis->from_src_file, true);\n \n+\n+\n+ /* TODO: COLO checkpoint restore loop */\n+\n+\n \n out:\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void *colo_process_incoming_thread(void *opaque)\n\n{\n\n MigrationIncomingState *mis = opaque;\n\n\n\n migrate_set_state(&mis->state, MIGRATION_STATUS_ACTIVE,\n\n MIGRATION_STATUS_COLO);\n\n\n\n mis->to_src_file = qemu_file_get_return_path(mis->from_src_file);\n\n if (!mis->to_src_file) {\n\n error_report(\"COLO incoming thread: Open QEMUFile to_src_file failed\");\n\n goto out;\n\n }\n\n /*\n\n * Note: the communication between Primary side and Secondary side\n\n * should be sequential, we set the fd to unblocked in migration incoming\n\n * coroutine, and here we are in the COLO incoming thread, so it is ok to\n\n * set the fd back to blocked.\n\n */\n\n qemu_file_set_blocking(mis->from_src_file, true);\n\n\n\n /* TODO: COLO checkpoint restore loop */\n\n\n\nout:\n\n if (mis->to_src_file) {\n\n qemu_fclose(mis->to_src_file);\n\n }\n\n migration_incoming_exit_colo();\n\n\n\n return NULL;\n\n}\n"}} {"sample_id": "364031f17932814484657e5551ba12957d993d7e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n }\n \n qemu_mutex_lock(&v9fs_synth_mutex);\n+\n+ QLIST_FOREACH(tmp, &parent->child, sibling) {\n+\n+ if (!strcmp(tmp->name, name)) {\n+\n ret = EEXIST;\n \n goto err_out;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_v9fs_synth_mkdir(V9fsSynthNode *parent, int mode,\n\n const char *name, V9fsSynthNode **result)\n\n{\n\n int ret;\n\n V9fsSynthNode *node, *tmp;\n\n\n\n if (!v9fs_synth_fs) {\n\n return EAGAIN;\n\n }\n\n if (!name || (strlen(name) >= NAME_MAX)) {\n\n return EINVAL;\n\n }\n\n if (!parent) {\n\n parent = &v9fs_synth_root;\n\n }\n\n qemu_mutex_lock(&v9fs_synth_mutex);\n\n QLIST_FOREACH(tmp, &parent->child, sibling) {\n\n if (!strcmp(tmp->name, name)) {\n\n ret = EEXIST;\n\n goto err_out;\n\n }\n\n }\n\n /* Add the name */\n\n node = v9fs_add_dir_node(parent, mode, name, NULL, v9fs_synth_node_count++);\n\n v9fs_add_dir_node(node, parent->attr->mode, \"..\",\n\n parent->attr, parent->attr->inode);\n\n v9fs_add_dir_node(node, node->attr->mode, \".\",\n\n node->attr, node->attr->inode);\n\n *result = node;\n\n ret = 0;\n\nerr_out:\n\n qemu_mutex_unlock(&v9fs_synth_mutex);\n\n return ret;\n\n}\n"}} {"sample_id": "3f26c1227e3b08010f2a65379cecf4cb4b5933fa", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,5 +5,5 @@\n cpu_abort(env, \"cp15 insn %08x\\n\", insn);\n \n return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint32_t HELPER(get_cp15)(CPUState *env, uint32_t insn)\n\n{\n\n cpu_abort(env, \"cp15 insn %08x\\n\", insn);\n\n return 0;\n\n}\n"}} {"sample_id": "210b580b106fa798149e28aa13c66b325a43204e_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n tm.tm_mon = rtas_ld(args, 1) - 1;\n \n tm.tm_mday = rtas_ld(args, 2);\n+\n+ tm.tm_hour = rtas_ld(args, 3);\n+\n+ tm.tm_min = rtas_ld(args, 4);\n+\n tm.tm_sec = rtas_ld(args, 5);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void rtas_set_time_of_day(sPAPREnvironment *spapr,\n\n uint32_t token, uint32_t nargs,\n\n target_ulong args,\n\n uint32_t nret, target_ulong rets)\n\n{\n\n struct tm tm;\n\n\n\n tm.tm_year = rtas_ld(args, 0) - 1900;\n\n tm.tm_mon = rtas_ld(args, 1) - 1;\n\n tm.tm_mday = rtas_ld(args, 2);\n\n tm.tm_hour = rtas_ld(args, 3);\n\n tm.tm_min = rtas_ld(args, 4);\n\n tm.tm_sec = rtas_ld(args, 5);\n\n\n\n /* Just generate a monitor event for the change */\n\n rtc_change_mon_event(&tm);\n\n spapr->rtc_offset = qemu_timedate_diff(&tm);\n\n\n\n rtas_st(rets, 0, 0); /* Success */\n\n}\n"}} {"sample_id": "53111180946a56d314a9c1d07d09b9ef91e847b9_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,19 +1,19 @@\n+static int arm_gic_init(SysBusDevice *dev)\n \n+{\n \n+ /* Device instance init function for the GIC sysbus device */\n \n int i;\n \n GICState *s = FROM_SYSBUS(GICState, dev);\n \n ARMGICClass *agc = ARM_GIC_GET_CLASS(s);\n+\n \n+\n agc->parent_init(dev);\n+\n \n \n gic_init_irqs_and_distributor(s, s->num_irq);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int arm_gic_init(SysBusDevice *dev)\n\n{\n\n /* Device instance init function for the GIC sysbus device */\n\n int i;\n\n GICState *s = FROM_SYSBUS(GICState, dev);\n\n ARMGICClass *agc = ARM_GIC_GET_CLASS(s);\n\n\n\n agc->parent_init(dev);\n\n\n\n gic_init_irqs_and_distributor(s, s->num_irq);\n\n\n\n /* Memory regions for the CPU interfaces (NVIC doesn't have these):\n\n * a region for \"CPU interface for this core\", then a region for\n\n * \"CPU interface for core 0\", \"for core 1\", ...\n\n * NB that the memory region size of 0x100 applies for the 11MPCore\n\n * and also cores following the GIC v1 spec (ie A9).\n\n * GIC v2 defines a larger memory region (0x1000) so this will need\n\n * to be extended when we implement A15.\n\n */\n\n memory_region_init_io(&s->cpuiomem[0], &gic_thiscpu_ops, s,\n\n \"gic_cpu\", 0x100);\n\n for (i = 0; i < NUM_CPU(s); i++) {\n\n s->backref[i] = s;\n\n memory_region_init_io(&s->cpuiomem[i+1], &gic_cpu_ops, &s->backref[i],\n\n \"gic_cpu\", 0x100);\n\n }\n\n /* Distributor */\n\n sysbus_init_mmio(dev, &s->iomem);\n\n /* cpu interfaces (one for \"current cpu\" plus one per cpu) */\n\n for (i = 0; i <= NUM_CPU(s); i++) {\n\n sysbus_init_mmio(dev, &s->cpuiomem[i]);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "ac47e014bbaf5163871a8beb7522015e0bc27615_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n if (adts->write_adts) {\n \n+ ff_adts_write_frame_header(adts, buf, pkt->size, adts->pce_size);\n+\n+ avio_write(pb, buf, ADTS_HEADER_SIZE);\n+\n+ if (adts->pce_size) {\n \n avio_write(pb, adts->pce_data, adts->pce_size);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int adts_write_packet(AVFormatContext *s, AVPacket *pkt)\n\n{\n\n ADTSContext *adts = s->priv_data;\n\n AVIOContext *pb = s->pb;\n\n uint8_t buf[ADTS_HEADER_SIZE];\n\n\n\n if (!pkt->size)\n\n return 0;\n\n if (adts->write_adts) {\n\n ff_adts_write_frame_header(adts, buf, pkt->size, adts->pce_size);\n\n avio_write(pb, buf, ADTS_HEADER_SIZE);\n\n if (adts->pce_size) {\n\n avio_write(pb, adts->pce_data, adts->pce_size);\n\n adts->pce_size = 0;\n\n }\n\n }\n\n avio_write(pb, pkt->data, pkt->size);\n\n avio_flush(pb);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "eb700029c7836798046191d62d595363d92c84d4_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n return net_tx_pkt_parse_headers(pkt) &&\n+\n+ net_tx_pkt_rebuild_payload(pkt);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool net_tx_pkt_parse(struct NetTxPkt *pkt)\n\n{\n\n return net_tx_pkt_parse_headers(pkt) &&\n\n net_tx_pkt_rebuild_payload(pkt);\n\n}\n"}} {"sample_id": "644ead5be1a851abff16886240c5c6fc1c5137c0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n int i;\n \n uint64_t res;\n+\n uint64_t x = *data;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void fimd_swap_data(unsigned int swap_ctl, uint64_t *data)\n\n{\n\n int i;\n\n uint64_t res;\n\n uint64_t x = *data;\n\n\n\n if (swap_ctl & FIMD_WINCON_SWAP_BITS) {\n\n res = 0;\n\n for (i = 0; i < 64; i++) {\n\n if (x & (1ULL << (64 - i))) {\n\n res |= (1ULL << i);\n\n }\n\n }\n\n x = res;\n\n }\n\n\n\n if (swap_ctl & FIMD_WINCON_SWAP_BYTE) {\n\n x = bswap64(x);\n\n }\n\n\n\n if (swap_ctl & FIMD_WINCON_SWAP_HWORD) {\n\n x = ((x & 0x000000000000FFFFULL) << 48) |\n\n ((x & 0x00000000FFFF0000ULL) << 16) |\n\n ((x & 0x0000FFFF00000000ULL) >> 16) |\n\n ((x & 0xFFFF000000000000ULL) >> 48);\n\n }\n\n\n\n if (swap_ctl & FIMD_WINCON_SWAP_WORD) {\n\n x = ((x & 0x00000000FFFFFFFFULL) << 32) |\n\n ((x & 0xFFFFFFFF00000000ULL) >> 32);\n\n }\n\n\n\n *data = x;\n\n}\n"}} {"sample_id": "bcd7bf7eeb09a395cc01698842d1b8be9af483fc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n uint8_t bs2 = 1;\n \n+ uint8_t bs3 = 1;\n+\n+\n+\n+ if (tc[0] < 0)\n \n bs0 = 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_h264_v_lpf_chroma_inter_msa(uint8_t *data, int img_width,\n\n int alpha, int beta, int8_t *tc)\n\n{\n\n uint8_t bs0 = 1;\n\n uint8_t bs1 = 1;\n\n uint8_t bs2 = 1;\n\n uint8_t bs3 = 1;\n\n\n\n if (tc[0] < 0)\n\n bs0 = 0;\n\n if (tc[1] < 0)\n\n bs1 = 0;\n\n if (tc[2] < 0)\n\n bs2 = 0;\n\n if (tc[3] < 0)\n\n bs3 = 0;\n\n\n\n avc_loopfilter_cb_or_cr_inter_edge_hor_msa(data,\n\n bs0, bs1, bs2, bs3,\n\n tc[0], tc[1], tc[2], tc[3],\n\n alpha, beta,\n\n img_width);\n\n}\n"}} {"sample_id": "372579427a5040a26dfee78464b50e2bdf27ef26_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n if (cpu->stop) {\n \n cpu->stop = false;\n+\n cpu->stopped = true;\n \n qemu_cond_broadcast(&qemu_pause_cond);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void qemu_wait_io_event_common(CPUState *cpu)\n\n{\n\n if (cpu->stop) {\n\n cpu->stop = false;\n\n cpu->stopped = true;\n\n qemu_cond_broadcast(&qemu_pause_cond);\n\n }\n\n process_queued_cpu_work(cpu);\n\n cpu->thread_kicked = false;\n\n}\n"}} {"sample_id": "e2779de053b64f023de382fd87b3596613d47d1e_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n writable_mask = reg->emu_mask & ~reg->ro_mask & valid_mask;\n \n cfg_entry->data = XEN_PT_MERGE_VALUE(*val, cfg_entry->data, writable_mask);\n+\n+ s->msi->addr_lo = cfg_entry->data;\n+\n+\n+\n /* create value for writing to I/O device register */\n \n *val = XEN_PT_MERGE_VALUE(*val, dev_value, 0);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int xen_pt_msgaddr32_reg_write(XenPCIPassthroughState *s,\n\n XenPTReg *cfg_entry, uint32_t *val,\n\n uint32_t dev_value, uint32_t valid_mask)\n\n{\n\n XenPTRegInfo *reg = cfg_entry->reg;\n\n uint32_t writable_mask = 0;\n\n uint32_t old_addr = cfg_entry->data;\n\n\n\n /* modify emulate register */\n\n writable_mask = reg->emu_mask & ~reg->ro_mask & valid_mask;\n\n cfg_entry->data = XEN_PT_MERGE_VALUE(*val, cfg_entry->data, writable_mask);\n\n s->msi->addr_lo = cfg_entry->data;\n\n\n\n /* create value for writing to I/O device register */\n\n *val = XEN_PT_MERGE_VALUE(*val, dev_value, 0);\n\n\n\n /* update MSI */\n\n if (cfg_entry->data != old_addr) {\n\n if (s->msi->mapped) {\n\n xen_pt_msi_update(s);\n\n }\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d9f62dde1303286b24ac8ce88be27e2b9b9c5f46_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static GenericList *qmp_input_next_list(Visitor *v, GenericList **list,\n \n+ size_t size)\n+\n+{\n+\n+ QmpInputVisitor *qiv = to_qiv(v);\n \n GenericList *entry;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static GenericList *qmp_input_next_list(Visitor *v, GenericList **list,\n\n size_t size)\n\n{\n\n QmpInputVisitor *qiv = to_qiv(v);\n\n GenericList *entry;\n\n StackObject *so = &qiv->stack[qiv->nb_stack - 1];\n\n\n\n if (!so->entry) {\n\n return NULL;\n\n }\n\n\n\n entry = g_malloc0(size);\n\n if (so->first) {\n\n *list = entry;\n\n so->first = false;\n\n } else {\n\n (*list)->next = entry;\n\n }\n\n\n\n return entry;\n\n}\n"}} {"sample_id": "058bc4b57f9d6b39d9a6748b4049e1be3fde3dac_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void phys_sections_clear(void)\n+\n {\n \n phys_sections_nb = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void phys_sections_clear(void)\n\n{\n\n phys_sections_nb = 0;\n\n}\n"}} {"sample_id": "c9262e8a84a29f22fbb5edde5d17f4f6166d5ae1_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n uint32_t offset = find_iso_bc();\n \n int i;\n+\n \n \n if (!offset) {\n@@ -17,7 +17,7 @@\n }\n \n \n+\n read_iso_sector(offset, sec, \"Failed to read El Torito boot catalog\");\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static IsoBcSection *find_iso_bc_entry(void)\n\n{\n\n IsoBcEntry *e = (IsoBcEntry *)sec;\n\n uint32_t offset = find_iso_bc();\n\n int i;\n\n\n\n if (!offset) {\n\n return NULL;\n\n }\n\n\n\n read_iso_sector(offset, sec, \"Failed to read El Torito boot catalog\");\n\n\n\n if (!is_iso_bc_valid(e)) {\n\n /* The validation entry is mandatory */\n\n virtio_panic(\"No valid boot catalog found!\\n\");\n\n return NULL;\n\n }\n\n\n\n /*\n\n * Each entry has 32 bytes size, so one sector cannot contain > 64 entries.\n\n * We consider only boot catalogs with no more than 64 entries.\n\n */\n\n for (i = 1; i < ISO_BC_ENTRY_PER_SECTOR; i++) {\n\n if (e[i].id == ISO_BC_BOOTABLE_SECTION) {\n\n if (is_iso_bc_entry_compatible(&e[i].body.sect)) {\n\n return &e[i].body.sect;\n\n }\n\n }\n\n }\n\n\n\n virtio_panic(\"No suitable boot entry found on ISO-9660 media!\\n\");\n\n\n\n return NULL;\n\n}\n"}} {"sample_id": "8a9ee4b102a0620984d9963350bb378c778acb9d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n ch_data->bs_var_bord[1] = get_bits(gb, 2);\n ch_data->bs_num_rel[1] = get_bits(gb, 2);\n ch_data->bs_num_env[1] = ch_data->bs_num_rel[1] + 1;\n+ for (i = 0; i < ch_data->bs_num_rel[1]; i++)\n+ ch_data->bs_rel_bord[1][i] = 2 * get_bits(gb, 2) + 2;\n+ ch_data->bs_pointer = get_bits(gb, ceil_log2[ch_data->bs_num_env[1]]);\n+ for (i = 0; i < ch_data->bs_num_env[1]; i++)\n+ ch_data->bs_freq_res[ch_data->bs_num_env[1] - i] = get_bits1(gb);\n break;\n case VARFIX:\n ch_data->bs_var_bord[0] = get_bits(gb, 2);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,\n GetBitContext *gb, SBRData *ch_data)\n{\n int i;\n ch_data->bs_freq_res[0] = ch_data->bs_freq_res[ch_data->bs_num_env[1]];\n ch_data->bs_num_env[0] = ch_data->bs_num_env[1];\n ch_data->bs_amp_res = sbr->bs_amp_res_header;\n switch (ch_data->bs_frame_class = get_bits(gb, 2)) {\n case FIXFIX:\n ch_data->bs_num_env[1] = 1 << get_bits(gb, 2);\n if (ch_data->bs_num_env[1] == 1)\n ch_data->bs_amp_res = 0;\n ch_data->bs_freq_res[1] = get_bits1(gb);\n for (i = 1; i < ch_data->bs_num_env[1]; i++)\n ch_data->bs_freq_res[i + 1] = ch_data->bs_freq_res[1];\n break;\n case FIXVAR:\n ch_data->bs_var_bord[1] = get_bits(gb, 2);\n ch_data->bs_num_rel[1] = get_bits(gb, 2);\n ch_data->bs_num_env[1] = ch_data->bs_num_rel[1] + 1;\n for (i = 0; i < ch_data->bs_num_rel[1]; i++)\n ch_data->bs_rel_bord[1][i] = 2 * get_bits(gb, 2) + 2;\n ch_data->bs_pointer = get_bits(gb, ceil_log2[ch_data->bs_num_env[1]]);\n for (i = 0; i < ch_data->bs_num_env[1]; i++)\n ch_data->bs_freq_res[ch_data->bs_num_env[1] - i] = get_bits1(gb);\n break;\n case VARFIX:\n ch_data->bs_var_bord[0] = get_bits(gb, 2);\n ch_data->bs_num_rel[0] = get_bits(gb, 2);\n ch_data->bs_num_env[1] = ch_data->bs_num_rel[0] + 1;\n for (i = 0; i < ch_data->bs_num_rel[0]; i++)\n ch_data->bs_rel_bord[0][i] = 2 * get_bits(gb, 2) + 2;\n ch_data->bs_pointer = get_bits(gb, ceil_log2[ch_data->bs_num_env[1]]);\n get_bits1_vector(gb, ch_data->bs_freq_res + 1, ch_data->bs_num_env[1]);\n break;\n case VARVAR:\n ch_data->bs_var_bord[0] = get_bits(gb, 2);\n ch_data->bs_var_bord[1] = get_bits(gb, 2);\n ch_data->bs_num_rel[0] = get_bits(gb, 2);\n ch_data->bs_num_rel[1] = get_bits(gb, 2);\n ch_data->bs_num_env[1] = ch_data->bs_num_rel[0] + ch_data->bs_num_rel[1] + 1;\n for (i = 0; i < ch_data->bs_num_rel[0]; i++)\n ch_data->bs_rel_bord[0][i] = 2 * get_bits(gb, 2) + 2;\n for (i = 0; i < ch_data->bs_num_rel[1]; i++)\n ch_data->bs_rel_bord[1][i] = 2 * get_bits(gb, 2) + 2;\n ch_data->bs_pointer = get_bits(gb, ceil_log2[ch_data->bs_num_env[1]]);\n get_bits1_vector(gb, ch_data->bs_freq_res + 1, ch_data->bs_num_env[1]);\n break;\n }\n if (ch_data->bs_pointer > ch_data->bs_num_env[1] + 1) {\n av_log(ac->avccontext, AV_LOG_ERROR,\n \"Invalid bitstream, bs_pointer points to a middle noise border outside the time borders table: %d\\n\",\n ch_data->bs_pointer);\n return -1;\n }\n if (ch_data->bs_frame_class == FIXFIX && ch_data->bs_num_env[1] > 4) {\n av_log(ac->avccontext, AV_LOG_ERROR,\n \"Invalid bitstream, too many SBR envelopes in FIXFIX type SBR frame: %d\\n\",\n ch_data->bs_num_env[1]);\n return -1;\n }\n if (ch_data->bs_frame_class == VARVAR && ch_data->bs_num_env[1] > 5) {\n av_log(ac->avccontext, AV_LOG_ERROR,\n \"Invalid bitstream, too many SBR envelopes in VARVAR type SBR frame: %d\\n\",\n ch_data->bs_num_env[1]);\n return -1;\n }\n ch_data->bs_num_noise = (ch_data->bs_num_env[1] > 1) + 1;\n return 0;\n}"}} {"sample_id": "e70377dfa4bbc2e101066ca35675bed4129c5a8c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,9 +21,9 @@\n }\n \n }\n+\n+\n+\n+ return NULL;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "S390PCIBusDevice *s390_pci_find_dev_by_fid(uint32_t fid)\n\n{\n\n S390PCIBusDevice *pbdev;\n\n int i;\n\n S390pciState *s = s390_get_phb();\n\n\n\n for (i = 0; i < PCI_SLOT_MAX; i++) {\n\n pbdev = s->pbdev[i];\n\n if (pbdev && pbdev->fid == fid) {\n\n return pbdev;\n\n }\n\n }\n\n\n\n return NULL;\n\n}\n"}} {"sample_id": "7ec1e5ea4bd0700fa48da86bffa2fcc6146c410a_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n TCGv_i32 r_asi = gen_get_asi(dc, insn);\n \n+\n+\n+ gen_helper_cas_asi(dst, cpu_env, addr, val1, val2, r_asi);\n+\n+ tcg_temp_free_i32(r_asi);\n \n gen_store_gpr(dc, rd, dst);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gen_cas_asi(DisasContext *dc, TCGv addr, TCGv val2,\n\n int insn, int rd)\n\n{\n\n TCGv val1 = gen_load_gpr(dc, rd);\n\n TCGv dst = gen_dest_gpr(dc, rd);\n\n TCGv_i32 r_asi = gen_get_asi(dc, insn);\n\n\n\n gen_helper_cas_asi(dst, cpu_env, addr, val1, val2, r_asi);\n\n tcg_temp_free_i32(r_asi);\n\n gen_store_gpr(dc, rd, dst);\n\n}\n"}} {"sample_id": "5245c04da332ab9585133ad55f8ec7a06d43b0b0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,8 +6,8 @@\n \n return simple_limit(p, stride, 2*E+I)\n \n+ && FFABS(p3-p2) <= I && FFABS(p2-p1) <= I && FFABS(p1-p0) <= I\n+\n+ && FFABS(q3-q2) <= I && FFABS(q2-q1) <= I && FFABS(q1-q0) <= I;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_always_inline int normal_limit(uint8_t *p, int stride, int E, int I)\n\n{\n\n LOAD_PIXELS\n\n return simple_limit(p, stride, 2*E+I)\n\n && FFABS(p3-p2) <= I && FFABS(p2-p1) <= I && FFABS(p1-p0) <= I\n\n && FFABS(q3-q2) <= I && FFABS(q2-q1) <= I && FFABS(q1-q0) <= I;\n\n}\n"}} {"sample_id": "0493e42eb2f9fbf42d0aee0b48a84f81f19fb7fa", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n \"lea (%3, %3), %%\"REG_a\" \\n\\t\"\n \n \"movq (%1), %%mm0 \\n\\t\"\n+\n+ \".p2align 3 \\n\\t\"\n+\n+ \"1: \\n\\t\"\n+\n \"movq (%1, %3), %%mm1 \\n\\t\"\n \n \"movq (%1, %%\"REG_a\"),%%mm2 \\n\\t\"", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void DEF(put, pixels8_y2)(uint8_t *block, const uint8_t *pixels, ptrdiff_t line_size, int h)\n\n{\n\n MOVQ_BFE(mm6);\n\n __asm__ volatile(\n\n \"lea (%3, %3), %%\"REG_a\" \\n\\t\"\n\n \"movq (%1), %%mm0 \\n\\t\"\n\n \".p2align 3 \\n\\t\"\n\n \"1: \\n\\t\"\n\n \"movq (%1, %3), %%mm1 \\n\\t\"\n\n \"movq (%1, %%\"REG_a\"),%%mm2 \\n\\t\"\n\n PAVGBP(%%mm1, %%mm0, %%mm4, %%mm2, %%mm1, %%mm5)\n\n \"movq %%mm4, (%2) \\n\\t\"\n\n \"movq %%mm5, (%2, %3) \\n\\t\"\n\n \"add %%\"REG_a\", %1 \\n\\t\"\n\n \"add %%\"REG_a\", %2 \\n\\t\"\n\n \"movq (%1, %3), %%mm1 \\n\\t\"\n\n \"movq (%1, %%\"REG_a\"),%%mm0 \\n\\t\"\n\n PAVGBP(%%mm1, %%mm2, %%mm4, %%mm0, %%mm1, %%mm5)\n\n \"movq %%mm4, (%2) \\n\\t\"\n\n \"movq %%mm5, (%2, %3) \\n\\t\"\n\n \"add %%\"REG_a\", %1 \\n\\t\"\n\n \"add %%\"REG_a\", %2 \\n\\t\"\n\n \"subl $4, %0 \\n\\t\"\n\n \"jnz 1b \\n\\t\"\n\n :\"+g\"(h), \"+S\"(pixels), \"+D\"(block)\n\n :\"r\"((x86_reg)line_size)\n\n :REG_a, \"memory\");\n\n}\n"}} {"sample_id": "d22b0bd7fc85f991275ffc60a550ed42f4c1b04c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,10 +21,10 @@\n \"hello world \\\"embedded string\\\"\" },\n \n { \"\\\"hello world\\\\nwith new line\\\"\", \"hello world\\nwith new line\" },\n+\n { \"\\\"single byte utf-8 \\\\u0020\\\"\", \"single byte utf-8 \", .skip = 1 },\n \n+ { \"\\\"double byte utf-8 \\\\u00A2\\\"\", \"double byte utf-8 \\xc2\\xa2\" },\n \n { \"\\\"triple byte utf-8 \\\\u20AC\\\"\", \"triple byte utf-8 \\xe2\\x82\\xac\" },\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "START_TEST(escaped_string)\n\n{\n\n int i;\n\n struct {\n\n const char *encoded;\n\n const char *decoded;\n\n int skip;\n\n } test_cases[] = {\n\n { \"\\\"\\\\\\\"\\\"\", \"\\\"\" },\n\n { \"\\\"hello world \\\\\\\"embedded string\\\\\\\"\\\"\",\n\n \"hello world \\\"embedded string\\\"\" },\n\n { \"\\\"hello world\\\\nwith new line\\\"\", \"hello world\\nwith new line\" },\n\n { \"\\\"single byte utf-8 \\\\u0020\\\"\", \"single byte utf-8 \", .skip = 1 },\n\n { \"\\\"double byte utf-8 \\\\u00A2\\\"\", \"double byte utf-8 \\xc2\\xa2\" },\n\n { \"\\\"triple byte utf-8 \\\\u20AC\\\"\", \"triple byte utf-8 \\xe2\\x82\\xac\" },\n\n {}\n\n };\n\n\n\n for (i = 0; test_cases[i].encoded; i++) {\n\n QObject *obj;\n\n QString *str;\n\n\n\n obj = qobject_from_json(test_cases[i].encoded);\n\n\n\n fail_unless(obj != NULL);\n\n fail_unless(qobject_type(obj) == QTYPE_QSTRING);\n\n \n\n str = qobject_to_qstring(obj);\n\n fail_unless(strcmp(qstring_get_str(str), test_cases[i].decoded) == 0);\n\n\n\n if (test_cases[i].skip == 0) {\n\n str = qobject_to_json(obj);\n\n fail_unless(strcmp(qstring_get_str(str), test_cases[i].encoded) == 0);\n\n\n\n qobject_decref(obj);\n\n }\n\n\n\n QDECREF(str);\n\n }\n\n}\n"}} {"sample_id": "d4f7d8386693beb987382ece8bb7499955620388", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,8 +16,8 @@\n \n i += split_field_half_ref_list(dest, dest_len, src + long_i,\n \n+ src_len - long_i, parity);\n+\n+ return i;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int split_field_ref_list(Picture *dest, int dest_len,\n\n Picture *src, int src_len,\n\n int parity, int long_i){\n\n\n\n int i = split_field_half_ref_list(dest, dest_len, src, long_i, parity);\n\n dest += i;\n\n dest_len -= i;\n\n\n\n i += split_field_half_ref_list(dest, dest_len, src + long_i,\n\n src_len - long_i, parity);\n\n return i;\n\n}\n"}} {"sample_id": "7bd427d801e1e3293a634d3c83beadaa90ffb911_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n qemu_mod_timer(timer->timer, qemu_get_clock(rt_clock) + ms);\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void timer_start(SpiceTimer *timer, uint32_t ms)\n\n{\n\n qemu_mod_timer(timer->timer, qemu_get_clock(rt_clock) + ms);\n\n}\n"}} {"sample_id": "bb593904c18e22ea0671dfa1b02e24982f2bf0ea", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ tcg_gen_ld_tl(cpu_gpr[gprn], cpu_env, offsetof(CPUState, sdr1));\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void spr_read_sdr1 (void *opaque, int gprn, int sprn)\n\n{\n\n tcg_gen_ld_tl(cpu_gpr[gprn], cpu_env, offsetof(CPUState, sdr1));\n\n}\n"}} {"sample_id": "c489780203f9b22aca5539ec7589b7140bdc951f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n QmpInputVisitor *qiv = to_qiv(v);\n QObject *qobj = qmp_input_get_object(qiv, name, true);\n qobject_incref(qobj);\n+ *obj = qobj;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void qmp_input_type_any(Visitor *v, const char *name, QObject **obj,\n Error **errp)\n{\n QmpInputVisitor *qiv = to_qiv(v);\n QObject *qobj = qmp_input_get_object(qiv, name, true);\n qobject_incref(qobj);\n *obj = qobj;"}} {"sample_id": "65a8e1f6413a0f6f79894da710b5d6d43361d27d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n size_t mptsas_config_manufacturing_1(MPTSASState *s, uint8_t **data, int address)\n+\n {\n \n /* VPD - all zeros */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "size_t mptsas_config_manufacturing_1(MPTSASState *s, uint8_t **data, int address)\n\n{\n\n /* VPD - all zeros */\n\n return MPTSAS_CONFIG_PACK(1, MPI_CONFIG_PAGETYPE_MANUFACTURING, 0x00,\n\n \"s256\");\n\n}\n"}} {"sample_id": "dc9121210eaf34e768901ffc6992dd13062c743a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,7 +22,7 @@\n } else if (strstart(uri, \"fd:\", &p)) {\n s = fd_start_outgoing_migration(mon, p, max_throttle, detach, \n blk, inc);\n+#endif\n } else {\n monitor_printf(mon, \"unknown migration protocol: %s\\n\", uri);\n if (s == NULL) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int do_migrate(Monitor *mon, const QDict *qdict, QObject **ret_data)\n{\n MigrationState *s = NULL;\n const char *p;\n int detach = qdict_get_try_bool(qdict, \"detach\", 0);\n int blk = qdict_get_try_bool(qdict, \"blk\", 0);\n int inc = qdict_get_try_bool(qdict, \"inc\", 0);\n const char *uri = qdict_get_str(qdict, \"uri\");\n if (current_migration &&\n current_migration->get_status(current_migration) == MIG_STATE_ACTIVE) {\n monitor_printf(mon, \"migration already in progress\\n\");\n if (strstart(uri, \"tcp:\", &p)) {\n s = tcp_start_outgoing_migration(mon, p, max_throttle, detach,\n blk, inc);\n#if !defined(WIN32)\n } else if (strstart(uri, \"exec:\", &p)) {\n s = exec_start_outgoing_migration(mon, p, max_throttle, detach,\n blk, inc);\n } else if (strstart(uri, \"unix:\", &p)) {\n s = unix_start_outgoing_migration(mon, p, max_throttle, detach,\n blk, inc);\n } else if (strstart(uri, \"fd:\", &p)) {\n s = fd_start_outgoing_migration(mon, p, max_throttle, detach, \n blk, inc);\n#endif\n } else {\n monitor_printf(mon, \"unknown migration protocol: %s\\n\", uri);\n if (s == NULL) {\n monitor_printf(mon, \"migration failed\\n\");\n if (current_migration) {\n current_migration->release(current_migration);\n current_migration = s;\n return 0;"}} {"sample_id": "ac4b32df71bd932838043a4838b86d11e169707f_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void vp8_idct_dc_add4y_c(uint8_t *dst, int16_t block[4][16],\n+\n+ ptrdiff_t stride)\n+\n+{\n \n vp8_idct_dc_add_c(dst + 0, block[0], stride);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void vp8_idct_dc_add4y_c(uint8_t *dst, int16_t block[4][16],\n\n ptrdiff_t stride)\n\n{\n\n vp8_idct_dc_add_c(dst + 0, block[0], stride);\n\n vp8_idct_dc_add_c(dst + 4, block[1], stride);\n\n vp8_idct_dc_add_c(dst + 8, block[2], stride);\n\n vp8_idct_dc_add_c(dst + 12, block[3], stride);\n\n}\n"}} {"sample_id": "5f8b6491f20732e0a31e64bbf75b62def579e044_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n BlockDriverState *bs,\n \n+ int64_t sector_num,\n+\n+ int nb_sectors, bool is_write)\n+\n+{\n \n *req = (BdrvTrackedRequest){\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void tracked_request_begin(BdrvTrackedRequest *req,\n\n BlockDriverState *bs,\n\n int64_t sector_num,\n\n int nb_sectors, bool is_write)\n\n{\n\n *req = (BdrvTrackedRequest){\n\n .bs = bs,\n\n .sector_num = sector_num,\n\n .nb_sectors = nb_sectors,\n\n .is_write = is_write,\n\n\n };\n\n\n\n qemu_co_queue_init(&req->wait_queue);\n\n\n\n QLIST_INSERT_HEAD(&bs->tracked_requests, req, list);\n\n}"}} {"sample_id": "cd41a671b370a3dd603963432d2b02f1e5990fb7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);\n+\n+\n+\n+ if (((s->vdev.guest_features >> VIRTIO_SCSI_F_CHANGE) & 1) &&\n \n (s->vdev.status & VIRTIO_CONFIG_S_DRIVER_OK) &&\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_scsi_change(SCSIBus *bus, SCSIDevice *dev, SCSISense sense)\n\n{\n\n VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);\n\n\n\n if (((s->vdev.guest_features >> VIRTIO_SCSI_F_CHANGE) & 1) &&\n\n (s->vdev.status & VIRTIO_CONFIG_S_DRIVER_OK) &&\n\n dev->type != TYPE_ROM) {\n\n virtio_scsi_push_event(s, dev, VIRTIO_SCSI_T_PARAM_CHANGE,\n\n sense.asc | (sense.ascq << 8));\n\n }\n\n}\n"}} {"sample_id": "7d1b0095bff7157e856d1d0e6c4295641ced2752_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void gen_logicq_cc(TCGv_i64 val)\n+\n {\n \n+ TCGv tmp = new_tmp();\n \n gen_helper_logicq_cc(tmp, val);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_logicq_cc(TCGv_i64 val)\n\n{\n\n TCGv tmp = new_tmp();\n\n gen_helper_logicq_cc(tmp, val);\n\n gen_logic_CC(tmp);\n\n dead_tmp(tmp);\n\n}\n"}} {"sample_id": "09aaa1602f9381c0e0fb539390b1793e51bdfc7b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+void register_watchdogs(void)\n+\n+{\n \n wdt_ib700_init();\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void register_watchdogs(void)\n\n{\n\n wdt_ib700_init();\n\n wdt_i6300esb_init();\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_26", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n unsigned long *bmp = pv;\n+\n+ int i, idx = 0;\n+\n+ for (i = 0; i < BITS_TO_U64S(size); i++) {\n+\n uint64_t w = qemu_get_be64(f);\n \n bmp[idx++] = w;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int get_bitmap(QEMUFile *f, void *pv, size_t size)\n\n{\n\n unsigned long *bmp = pv;\n\n int i, idx = 0;\n\n for (i = 0; i < BITS_TO_U64S(size); i++) {\n\n uint64_t w = qemu_get_be64(f);\n\n bmp[idx++] = w;\n\n if (sizeof(unsigned long) == 4 && idx < BITS_TO_LONGS(size)) {\n\n bmp[idx++] = w >> 32;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "2caf19e90f270abe1e80a3e85acaf0eb5c9d0aac_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n pixel *src = (pixel*)_src;\n \n+ int stride = _stride/sizeof(pixel);\n \n const int dc= ( src[-stride] + src[1-stride] + src[2-stride] + src[3-stride] + 2) >>2;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void FUNCC(pred4x4_top_dc)(uint8_t *_src, const uint8_t *topright, int _stride){\n\n pixel *src = (pixel*)_src;\n\n int stride = _stride/sizeof(pixel);\n\n const int dc= ( src[-stride] + src[1-stride] + src[2-stride] + src[3-stride] + 2) >>2;\n\n\n\n ((pixel4*)(src+0*stride))[0]=\n\n ((pixel4*)(src+1*stride))[0]=\n\n ((pixel4*)(src+2*stride))[0]=\n\n ((pixel4*)(src+3*stride))[0]= PIXEL_SPLAT_X4(dc);\n\n}\n"}} {"sample_id": "ad674e53b5cce265fadafbde2c6a4f190345cd00", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+static void next(DBDMA_channel *ch)\n+\n+{\n+\n uint32_t cp;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void next(DBDMA_channel *ch)\n\n{\n\n uint32_t cp;\n\n\n\n ch->regs[DBDMA_STATUS] &= cpu_to_be32(~BT);\n\n\n\n cp = be32_to_cpu(ch->regs[DBDMA_CMDPTR_LO]);\n\n ch->regs[DBDMA_CMDPTR_LO] = cpu_to_be32(cp + sizeof(dbdma_cmd));\n\n dbdma_cmdptr_load(ch);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_240", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static uint32_t bonito_spciconf_readl(void *opaque, target_phys_addr_t addr)\n \n+{\n+\n+ PCIBonitoState *s = opaque;\n+\n+ PCIDevice *d = PCI_DEVICE(s);\n \n PCIHostState *phb = PCI_HOST_BRIDGE(s->pcihost);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t bonito_spciconf_readl(void *opaque, target_phys_addr_t addr)\n\n{\n\n PCIBonitoState *s = opaque;\n\n PCIDevice *d = PCI_DEVICE(s);\n\n PCIHostState *phb = PCI_HOST_BRIDGE(s->pcihost);\n\n uint32_t pciaddr;\n\n uint16_t status;\n\n\n\n DPRINTF(\"bonito_spciconf_readl \"TARGET_FMT_plx\"\\n\", addr);\n\n assert((addr & 0x3) == 0);\n\n\n\n pciaddr = bonito_sbridge_pciaddr(s, addr);\n\n\n\n if (pciaddr == 0xffffffff) {\n\n return 0xffffffff;\n\n }\n\n\n\n /* set the pci address in s->config_reg */\n\n phb->config_reg = (pciaddr) | (1u << 31);\n\n\n\n /* clear PCI_STATUS_REC_MASTER_ABORT and PCI_STATUS_REC_TARGET_ABORT */\n\n status = pci_get_word(d->config + PCI_STATUS);\n\n status &= ~(PCI_STATUS_REC_MASTER_ABORT | PCI_STATUS_REC_TARGET_ABORT);\n\n pci_set_word(d->config + PCI_STATUS, status);\n\n\n\n return pci_data_read(phb->bus, phb->config_reg, 4);\n\n}\n"}} {"sample_id": "b8852e87d9d113096342c3e0977266cda0fe9ee5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n \n \n /* the descriptor offset = 0x200 */\n+\n if (bdrv_pread(bs->file, 0x200, desc, DESC_SIZE) != DESC_SIZE)\n \n return -1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int vmdk_write_cid(BlockDriverState *bs, uint32_t cid)\n\n{\n\n char desc[DESC_SIZE], tmp_desc[DESC_SIZE];\n\n char *p_name, *tmp_str;\n\n\n\n /* the descriptor offset = 0x200 */\n\n if (bdrv_pread(bs->file, 0x200, desc, DESC_SIZE) != DESC_SIZE)\n\n return -1;\n\n\n\n tmp_str = strstr(desc,\"parentCID\");\n\n pstrcpy(tmp_desc, sizeof(tmp_desc), tmp_str);\n\n if ((p_name = strstr(desc,\"CID\")) != NULL) {\n\n p_name += sizeof(\"CID\");\n\n snprintf(p_name, sizeof(desc) - (p_name - desc), \"%x\\n\", cid);\n\n pstrcat(desc, sizeof(desc), tmp_desc);\n\n }\n\n\n\n if (bdrv_pwrite(bs->file, 0x200, desc, DESC_SIZE) != DESC_SIZE)\n\n return -1;\n\n return 0;\n\n}\n"}} {"sample_id": "7d1b0095bff7157e856d1d0e6c4295641ced2752_44", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,7 +14,7 @@\n \n default: abort();\n \n+ }\n \n } else {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void gen_neon_widen(TCGv_i64 dest, TCGv src, int size, int u)\n\n{\n\n if (u) {\n\n switch (size) {\n\n case 0: gen_helper_neon_widen_u8(dest, src); break;\n\n case 1: gen_helper_neon_widen_u16(dest, src); break;\n\n case 2: tcg_gen_extu_i32_i64(dest, src); break;\n\n default: abort();\n\n }\n\n } else {\n\n switch (size) {\n\n case 0: gen_helper_neon_widen_s8(dest, src); break;\n\n case 1: gen_helper_neon_widen_s16(dest, src); break;\n\n case 2: tcg_gen_ext_i32_i64(dest, src); break;\n\n default: abort();\n\n }\n\n }\n\n dead_tmp(src);\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_46", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n #ifdef CONFIG_PPOLL\n+\n+ if (timeout < 0) {\n+\n+ return ppoll((struct pollfd *)fds, nfds, NULL, NULL);\n+\n } else {\n \n struct timespec ts;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qemu_poll_ns(GPollFD *fds, guint nfds, int64_t timeout)\n\n{\n\n#ifdef CONFIG_PPOLL\n\n if (timeout < 0) {\n\n return ppoll((struct pollfd *)fds, nfds, NULL, NULL);\n\n } else {\n\n struct timespec ts;\n\n int64_t tvsec = timeout / 1000000000LL;\n\n /* Avoid possibly overflowing and specifying a negative number of\n\n * seconds, which would turn a very long timeout into a busy-wait.\n\n */\n\n if (tvsec > (int64_t)INT32_MAX) {\n\n tvsec = INT32_MAX;\n\n }\n\n ts.tv_sec = tvsec;\n\n ts.tv_nsec = timeout % 1000000000LL;\n\n return ppoll((struct pollfd *)fds, nfds, &ts, NULL);\n\n }\n\n#else\n\n return g_poll(fds, nfds, qemu_timeout_ns_to_ms(timeout));\n\n#endif\n\n}\n"}} {"sample_id": "d6604b29ef544793479d7fb4e05ef6622bb3e534_23", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n \n \n+ if (avctx->width > 4095 || avctx->height > 4095) {\n+\n+ av_log(avctx, AV_LOG_ERROR,\n+\n+ \"Input dimensions too large, input must be max 4096x4096 !\\n\");\n \n return AVERROR_INVALIDDATA;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int flashsv_encode_init(AVCodecContext *avctx)\n\n{\n\n FlashSVContext *s = avctx->priv_data;\n\n\n\n s->avctx = avctx;\n\n\n\n if (avctx->width > 4095 || avctx->height > 4095) {\n\n av_log(avctx, AV_LOG_ERROR,\n\n \"Input dimensions too large, input must be max 4096x4096 !\\n\");\n\n return AVERROR_INVALIDDATA;\n\n }\n\n\n\n // Needed if zlib unused or init aborted before deflateInit\n\n memset(&s->zstream, 0, sizeof(z_stream));\n\n\n\n s->last_key_frame = 0;\n\n\n\n s->image_width = avctx->width;\n\n s->image_height = avctx->height;\n\n\n\n s->tmpblock = av_mallocz(3 * 256 * 256);\n\n s->encbuffer = av_mallocz(s->image_width * s->image_height * 3);\n\n\n\n if (!s->tmpblock || !s->encbuffer) {\n\n av_log(avctx, AV_LOG_ERROR, \"Memory allocation failed.\\n\");\n\n return AVERROR(ENOMEM);\n\n }\n\n\n\n avctx->coded_frame = av_frame_alloc();\n\n if (!avctx->coded_frame) {\n\n flashsv_encode_end(avctx);\n\n return AVERROR(ENOMEM);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "3bc36a401e0f33e63a4d2c58b646ddf78efb567c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,12 +8,12 @@\n \n HCIInfo *hci;\n \n+ const char *name = \"usb-bt-dongle\";\n \n \n \n+ if (*cmdline) {\n+\n hci = hci_init(cmdline);\n \n } else {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static USBDevice *usb_bt_init(USBBus *bus, const char *cmdline)\n\n{\n\n USBDevice *dev;\n\n struct USBBtState *s;\n\n HCIInfo *hci;\n\n const char *name = \"usb-bt-dongle\";\n\n\n\n if (*cmdline) {\n\n hci = hci_init(cmdline);\n\n } else {\n\n hci = bt_new_hci(qemu_find_bt_vlan(0));\n\n }\n\n if (!hci)\n\n return NULL;\n\n\n\n dev = usb_create(bus, name);\n\n s = DO_UPCAST(struct USBBtState, dev, dev);\n\n s->hci = hci;\n\n if (qdev_init(&dev->qdev) < 0) {\n\n error_report(\"Failed to initialize USB device '%s'\", name);\n\n return NULL;\n\n }\n\n\n\n return dev;\n\n}\n"}} {"sample_id": "a980f7f2c2f4d7e9a1eba4f804cd66dbd458b6d4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n qtest_end();\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qvirtio_scsi_stop(void)\n\n{\n\n qtest_end();\n\n}\n"}} {"sample_id": "9f2130f58d5dd4e1fcb435cca08bf77e7c32e6c6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -60,11 +60,11 @@\n \n \t}\n \n+ }\n+\n+ if (oops) /* should not happen */\n+\n+ xen_pv_printf(&xenfb->c.xendev, 0, \"%s: oops: convert %d -> %d bpp?\\n\",\n \n __FUNCTION__, xenfb->depth, bpp);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void xenfb_guest_copy(struct XenFB *xenfb, int x, int y, int w, int h)\n\n{\n\n DisplaySurface *surface = qemu_console_surface(xenfb->c.con);\n\n int line, oops = 0;\n\n int bpp = surface_bits_per_pixel(surface);\n\n int linesize = surface_stride(surface);\n\n uint8_t *data = surface_data(surface);\n\n\n\n if (!is_buffer_shared(surface)) {\n\n switch (xenfb->depth) {\n\n case 8:\n\n if (bpp == 16) {\n\n BLT(uint8_t, uint16_t, 3, 3, 2, 5, 6, 5);\n\n } else if (bpp == 32) {\n\n BLT(uint8_t, uint32_t, 3, 3, 2, 8, 8, 8);\n\n } else {\n\n oops = 1;\n\n }\n\n break;\n\n case 24:\n\n if (bpp == 16) {\n\n BLT(uint32_t, uint16_t, 8, 8, 8, 5, 6, 5);\n\n } else if (bpp == 32) {\n\n BLT(uint32_t, uint32_t, 8, 8, 8, 8, 8, 8);\n\n } else {\n\n oops = 1;\n\n }\n\n break;\n\n default:\n\n oops = 1;\n\n\t}\n\n }\n\n if (oops) /* should not happen */\n\n xen_pv_printf(&xenfb->c.xendev, 0, \"%s: oops: convert %d -> %d bpp?\\n\",\n\n __FUNCTION__, xenfb->depth, bpp);\n\n\n\n dpy_gfx_update(xenfb->c.con, x, y, w, h);\n\n}\n"}} {"sample_id": "fb135139fd3992eb1f0eacc9cfd878e05b95ec46", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n return av_str2id(img_tags, filename);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "enum AVCodecID ff_guess_image2_codec(const char *filename)\n\n{\n\n return av_str2id(img_tags, filename);\n\n}\n"}} {"sample_id": "dec2fa8cc7089605d1d934d65dd2709cfe8aece2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static AVCodec *AVCodecInitialize(enum AVCodecID codec_id)\n \n+{\n \n AVCodec *res;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static AVCodec *AVCodecInitialize(enum AVCodecID codec_id)\n\n{\n\n AVCodec *res;\n\n avcodec_register_all();\n\n av_log_set_level(AV_LOG_PANIC);\n\n res = avcodec_find_decoder(codec_id);\n\n if (!res)\n\n error(\"Failed to find decoder\");\n\n return res;\n\n}\n"}} {"sample_id": "260fecf13b0d30621dc88da03dc1b502b7358c6b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -50,11 +50,11 @@\n \n pstrcpy(bs->backing_format, sizeof(bs->backing_format),\n \n+ backing_hd->drv ? backing_hd->drv->format_name : \"\");\n+\n+\n+\n+ bdrv_op_block_all(backing_hd, bs->backing_blocker);\n \n /* Otherwise we won't be able to commit due to check in bdrv_commit */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd)\n\n{\n\n if (backing_hd) {\n\n bdrv_ref(backing_hd);\n\n }\n\n\n\n if (bs->backing) {\n\n assert(bs->backing_blocker);\n\n bdrv_op_unblock_all(bs->backing->bs, bs->backing_blocker);\n\n bdrv_unref_child(bs, bs->backing);\n\n } else if (backing_hd) {\n\n error_setg(&bs->backing_blocker,\n\n \"node is used as backing hd of '%s'\",\n\n bdrv_get_device_or_node_name(bs));\n\n }\n\n\n\n if (!backing_hd) {\n\n error_free(bs->backing_blocker);\n\n bs->backing_blocker = NULL;\n\n bs->backing = NULL;\n\n goto out;\n\n }\n\n bs->backing = bdrv_attach_child(bs, backing_hd, &child_backing);\n\n bs->open_flags &= ~BDRV_O_NO_BACKING;\n\n pstrcpy(bs->backing_file, sizeof(bs->backing_file), backing_hd->filename);\n\n pstrcpy(bs->backing_format, sizeof(bs->backing_format),\n\n backing_hd->drv ? backing_hd->drv->format_name : \"\");\n\n\n\n bdrv_op_block_all(backing_hd, bs->backing_blocker);\n\n /* Otherwise we won't be able to commit due to check in bdrv_commit */\n\n bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_COMMIT_TARGET,\n\n bs->backing_blocker);\n\nout:\n\n bdrv_refresh_limits(bs, NULL);\n\n}\n"}} {"sample_id": "0ead93120eb7bd770b32adc00b5ec1ee721626dc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static bool is_sector_request_lun_aligned(int64_t sector_num, int nb_sectors,\n+\n IscsiLun *iscsilun)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static bool is_sector_request_lun_aligned(int64_t sector_num, int nb_sectors,\n\n IscsiLun *iscsilun)\n\n{\n\n assert(nb_sectors < BDRV_REQUEST_MAX_SECTORS);\n\n return is_byte_request_lun_aligned(sector_num << BDRV_SECTOR_BITS,\n\n nb_sectors << BDRV_SECTOR_BITS,\n\n iscsilun);\n\n}\n"}} {"sample_id": "f293709c6af7a65a9bcec09cdba7a60183657a3e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void tcg_exec_init(unsigned long tb_size)\n \n+{\n \n cpu_gen_init();\n+\n code_gen_alloc(tb_size);\n \n page_init();", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void tcg_exec_init(unsigned long tb_size)\n\n{\n\n cpu_gen_init();\n\n code_gen_alloc(tb_size);\n\n page_init();\n\n#if defined(CONFIG_SOFTMMU)\n\n /* There's no guest base to take into account, so go ahead and\n\n initialize the prologue now. */\n\n tcg_prologue_init(&tcg_ctx);\n\n#endif\n\n}\n"}} {"sample_id": "1195fed9e6790bd8fd86b0dc33e2442d70355ac6_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n set_phy_ctrl(E1000State *s, int index, uint16_t val)\n \n {\n+\n+ /*\n+\n+ * QEMU 1.3 does not support link auto-negotiation emulation, so if we\n+\n * migrate during auto negotiation, after migration the link will be\n \n * down.", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "set_phy_ctrl(E1000State *s, int index, uint16_t val)\n\n{\n\n /*\n\n * QEMU 1.3 does not support link auto-negotiation emulation, so if we\n\n * migrate during auto negotiation, after migration the link will be\n\n * down.\n\n */\n\n if (!(s->compat_flags & E1000_FLAG_AUTONEG)) {\n\n return;\n\n }\n\n if ((val & MII_CR_AUTO_NEG_EN) && (val & MII_CR_RESTART_AUTO_NEG)) {\n\n e1000_link_down(s);\n\n DBGOUT(PHY, \"Start link auto negotiation\\n\");\n\n timer_mod(s->autoneg_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 500);\n\n }\n\n}\n"}} {"sample_id": "fc78b0cb7e115ae494861c37a9928cff74df8db9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n if (s->last_rtcp_ntp_time != AV_NOPTS_VALUE) {\n+\n int64_t addend;\n \n int delta_timestamp;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void finalize_packet(RTPDemuxContext *s, AVPacket *pkt, uint32_t timestamp)\n\n{\n\n if (s->last_rtcp_ntp_time != AV_NOPTS_VALUE) {\n\n int64_t addend;\n\n int delta_timestamp;\n\n\n\n /* compute pts from timestamp with received ntp_time */\n\n delta_timestamp = timestamp - s->last_rtcp_timestamp;\n\n /* convert to the PTS timebase */\n\n addend = av_rescale(s->last_rtcp_ntp_time - s->first_rtcp_ntp_time, s->st->time_base.den, (uint64_t)s->st->time_base.num << 32);\n\n pkt->pts = addend + delta_timestamp;\n\n }\n\n}\n"}} {"sample_id": "a03ef88f77af045a2eb9629b5ce774a3fb973c5e_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,8 +14,8 @@\n \n \n \n+ return bdrv_co_pwritev(child->bs, sector_num << BDRV_SECTOR_BITS,\n+\n+ nb_sectors << BDRV_SECTOR_BITS, qiov, flags);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int coroutine_fn bdrv_co_do_writev(BdrvChild *child,\n\n int64_t sector_num, int nb_sectors, QEMUIOVector *qiov,\n\n BdrvRequestFlags flags)\n\n{\n\n if (nb_sectors < 0 || nb_sectors > BDRV_REQUEST_MAX_SECTORS) {\n\n return -EINVAL;\n\n }\n\n\n\n return bdrv_co_pwritev(child->bs, sector_num << BDRV_SECTOR_BITS,\n\n nb_sectors << BDRV_SECTOR_BITS, qiov, flags);\n\n}\n"}} {"sample_id": "0bf8264e2d2bd19c1eecf9bde0e59284ef47eabb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,9 +11,9 @@\n scsi_req_build_sense(req, req->bus->unit_attention);\n \n }\n+\n+ scsi_req_complete(req, CHECK_CONDITION);\n+\n+ return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int32_t scsi_unit_attention(SCSIRequest *req, uint8_t *buf)\n\n{\n\n if (req->dev && req->dev->unit_attention.key == UNIT_ATTENTION) {\n\n scsi_req_build_sense(req, req->dev->unit_attention);\n\n } else if (req->bus->unit_attention.key == UNIT_ATTENTION) {\n\n scsi_req_build_sense(req, req->bus->unit_attention);\n\n }\n\n scsi_req_complete(req, CHECK_CONDITION);\n\n return 0;\n\n}\n"}} {"sample_id": "fea7d77d3ea287d3b1878648f3049fc6bb4fd57b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n relation = float32_compare(t0, t1, &env->fp_status);\n \n+ if (unlikely(relation == float_relation_unordered)) {\n+\n+ update_fpscr(env, GETPC());\n+\n+ } else {\n \n env->sr_t = (relation == float_relation_equal);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void helper_fcmp_eq_FT(CPUSH4State *env, float32 t0, float32 t1)\n\n{\n\n int relation;\n\n\n\n set_float_exception_flags(0, &env->fp_status);\n\n relation = float32_compare(t0, t1, &env->fp_status);\n\n if (unlikely(relation == float_relation_unordered)) {\n\n update_fpscr(env, GETPC());\n\n } else {\n\n env->sr_t = (relation == float_relation_equal);\n\n }\n\n}\n"}} {"sample_id": "465e1dadbef7596a3eb87089a66bb4ecdc26d3c4_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,10 +14,10 @@\n \n stream->last_pts= pts;\n \n+ if( nut->frame_code[frame_code].flags & FLAG_PTS \n+\n+ && nut->frame_code[frame_code].flags & FLAG_FULL_PTS)\n+\n+ stream->last_full_pts= pts;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void update(NUTContext *nut, int stream_index, int64_t frame_start, int frame_type, int frame_code, int key_frame, int size, int64_t pts){\n\n StreamContext *stream= &nut->stream[stream_index];\n\n \n\n stream->last_key_frame= key_frame;\n\n nut->last_frame_start[ frame_type ]= frame_start;\n\n update_lru(stream->lru_pts_delta, pts - stream->last_pts, 3);\n\n update_lru(stream->lru_size , size, 2);\n\n stream->last_pts= pts;\n\n if( nut->frame_code[frame_code].flags & FLAG_PTS \n\n && nut->frame_code[frame_code].flags & FLAG_FULL_PTS)\n\n stream->last_full_pts= pts;\n\n}\n"}} {"sample_id": "7bd427d801e1e3293a634d3c83beadaa90ffb911_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ int iomemtype;\n+\n+ struct omap_lpg_s *s = (struct omap_lpg_s *)\n+\n+ qemu_mallocz(sizeof(struct omap_lpg_s));\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static struct omap_lpg_s *omap_lpg_init(target_phys_addr_t base, omap_clk clk)\n\n{\n\n int iomemtype;\n\n struct omap_lpg_s *s = (struct omap_lpg_s *)\n\n qemu_mallocz(sizeof(struct omap_lpg_s));\n\n\n\n s->tm = qemu_new_timer(rt_clock, omap_lpg_tick, s);\n\n\n\n omap_lpg_reset(s);\n\n\n\n iomemtype = cpu_register_io_memory(omap_lpg_readfn,\n\n omap_lpg_writefn, s, DEVICE_NATIVE_ENDIAN);\n\n cpu_register_physical_memory(base, 0x800, iomemtype);\n\n\n\n omap_clk_adduser(clk, qemu_allocate_irqs(omap_lpg_clk_update, s, 1)[0]);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "b5ef6f8eb452c37b19d973d61548725d7b91113e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -37,11 +37,11 @@\n \n av_pix_fmt_descriptors[st->codec->pix_fmt].name,\n \n+ codec->name,\n+\n+ av_pix_fmt_descriptors[codec->pix_fmts[0]].name);\n+\n+ st->codec->pix_fmt = codec->pix_fmts[0];\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void choose_pixel_fmt(AVStream *st, AVCodec *codec)\n\n{\n\n if(codec && codec->pix_fmts){\n\n const enum PixelFormat *p= codec->pix_fmts;\n\n if(st->codec->strict_std_compliance <= FF_COMPLIANCE_UNOFFICIAL){\n\n if(st->codec->codec_id==CODEC_ID_MJPEG){\n\n p= (const enum PixelFormat[]){PIX_FMT_YUVJ420P, PIX_FMT_YUVJ422P, PIX_FMT_YUV420P, PIX_FMT_YUV422P, PIX_FMT_NONE};\n\n }else if(st->codec->codec_id==CODEC_ID_LJPEG){\n\n p= (const enum PixelFormat[]){PIX_FMT_YUVJ420P, PIX_FMT_YUVJ422P, PIX_FMT_YUVJ444P, PIX_FMT_YUV420P, PIX_FMT_YUV422P, PIX_FMT_YUV444P, PIX_FMT_BGRA, PIX_FMT_NONE};\n\n }\n\n }\n\n for(; *p!=-1; p++){\n\n if(*p == st->codec->pix_fmt)\n\n break;\n\n }\n\n if (*p == -1) {\n\n\n av_log(NULL, AV_LOG_WARNING,\n\n \"Incompatible pixel format '%s' for codec '%s', auto-selecting format '%s'\\n\",\n\n av_pix_fmt_descriptors[st->codec->pix_fmt].name,\n\n codec->name,\n\n av_pix_fmt_descriptors[codec->pix_fmts[0]].name);\n\n st->codec->pix_fmt = codec->pix_fmts[0];\n\n }\n\n }\n\n}"}} {"sample_id": "b181e04777da67acbc7448f87e4ae9f1518e08b2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ const char *filename = qemu_opt_get(opts, \"path\");\n \n CharDriverState *chr;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static CharDriverState *qemu_chr_open_tty(QemuOpts *opts)\n\n{\n\n const char *filename = qemu_opt_get(opts, \"path\");\n\n CharDriverState *chr;\n\n int fd;\n\n\n\n TFR(fd = open(filename, O_RDWR | O_NONBLOCK));\n\n if (fd < 0) {\n\n return NULL;\n\n }\n\n tty_serial_init(fd, 115200, 'N', 8, 1);\n\n chr = qemu_chr_open_fd(fd, fd);\n\n if (!chr) {\n\n close(fd);\n\n return NULL;\n\n }\n\n chr->chr_ioctl = tty_serial_ioctl;\n\n chr->chr_close = qemu_chr_close_tty;\n\n return chr;\n\n}\n"}} {"sample_id": "0fbf50b6ec126600dca115adb1563c657cc27695_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,8 +3,8 @@\n const char *name,\n \n MemoryRegion *address_space_mem,\n+\n+ MemoryRegion *address_space_io,\n \n uint8_t devfn_min)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void pci_bus_init(PCIBus *bus, DeviceState *parent,\n\n const char *name,\n\n MemoryRegion *address_space_mem,\n\n MemoryRegion *address_space_io,\n\n uint8_t devfn_min)\n\n{\n\n assert(PCI_FUNC(devfn_min) == 0);\n\n bus->devfn_min = devfn_min;\n\n bus->address_space_mem = address_space_mem;\n\n bus->address_space_io = address_space_io;\n\n\n\n\n\n memory_region_init_io(&bus->master_abort_mem, OBJECT(bus),\n\n &master_abort_mem_ops, bus, \"pci-master-abort\",\n\n memory_region_size(bus->address_space_mem));\n\n memory_region_add_subregion_overlap(bus->address_space_mem,\n\n 0, &bus->master_abort_mem,\n\n MASTER_ABORT_MEM_PRIORITY);\n\n\n\n /* host bridge */\n\n QLIST_INIT(&bus->child);\n\n\n\n pci_host_bus_register(bus, parent);\n\n\n\n vmstate_register(NULL, -1, &vmstate_pcibus, bus);\n\n}\n"}} {"sample_id": "2296f194dfde4c0a54f249d3fdb8c8ca21dc611b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static struct pathelem *add_entry(struct pathelem *root, const char *name)\n \n {\n+\n+ root->num_entries++;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static struct pathelem *add_entry(struct pathelem *root, const char *name)\n\n{\n\n root->num_entries++;\n\n\n\n root = realloc(root, sizeof(*root)\n\n + sizeof(root->entries[0])*root->num_entries);\n\n\n\n root->entries[root->num_entries-1] = new_entry(root->pathname, root, name);\n\n root->entries[root->num_entries-1]\n\n = add_dir_maybe(root->entries[root->num_entries-1]);\n\n return root;\n\n}\n"}} {"sample_id": "1e9981465f05a0f103d7e09afd975c9c0ff6d132_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void qmp_cont(Error **errp)\n \n+{\n+\n Error *local_err = NULL;\n+\n \n \n if (runstate_check(RUN_STATE_INMIGRATE)) {\n@@ -16,7 +16,7 @@\n \n runstate_check(RUN_STATE_SHUTDOWN)) {\n \n+ error_set(errp, QERR_RESET_REQUIRED);\n \n return;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void qmp_cont(Error **errp)\n\n{\n\n Error *local_err = NULL;\n\n\n\n if (runstate_check(RUN_STATE_INMIGRATE)) {\n\n error_set(errp, QERR_MIGRATION_EXPECTED);\n\n return;\n\n } else if (runstate_check(RUN_STATE_INTERNAL_ERROR) ||\n\n runstate_check(RUN_STATE_SHUTDOWN)) {\n\n error_set(errp, QERR_RESET_REQUIRED);\n\n return;\n\n } else if (runstate_check(RUN_STATE_SUSPENDED)) {\n\n return;\n\n }\n\n\n\n bdrv_iterate(iostatus_bdrv_it, NULL);\n\n bdrv_iterate(encrypted_bdrv_it, &local_err);\n\n if (local_err) {\n\n error_propagate(errp, local_err);\n\n return;\n\n }\n\n\n\n vm_start();\n\n}\n"}} {"sample_id": "3e0f7126b53b395d9e79df57b2e626eb99ad846b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void inner_add_yblock_bw_16_obmc_32_mmx(const uint8_t *obmc, const long obmc_stride, uint8_t * * block, int b_w, long b_h,\n+\n int src_x, int src_y, long src_stride, slice_buffer * sb, int add, uint8_t * dst8){\n \n snow_inner_add_yblock_mmx_header", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void inner_add_yblock_bw_16_obmc_32_mmx(const uint8_t *obmc, const long obmc_stride, uint8_t * * block, int b_w, long b_h,\n\n int src_x, int src_y, long src_stride, slice_buffer * sb, int add, uint8_t * dst8){\n\nsnow_inner_add_yblock_mmx_header\n\nsnow_inner_add_yblock_mmx_start(\"mm1\", \"mm5\", \"3\", \"0\", \"0\")\n\nsnow_inner_add_yblock_mmx_accum(\"2\", \"16\", \"0\")\n\nsnow_inner_add_yblock_mmx_accum(\"1\", \"512\", \"0\")\n\nsnow_inner_add_yblock_mmx_accum(\"0\", \"528\", \"0\")\n\nsnow_inner_add_yblock_mmx_mix(\"0\", \"0\")\n\n\n\nsnow_inner_add_yblock_mmx_start(\"mm1\", \"mm5\", \"3\", \"8\", \"8\")\n\nsnow_inner_add_yblock_mmx_accum(\"2\", \"24\", \"8\")\n\nsnow_inner_add_yblock_mmx_accum(\"1\", \"520\", \"8\")\n\nsnow_inner_add_yblock_mmx_accum(\"0\", \"536\", \"8\")\n\nsnow_inner_add_yblock_mmx_mix(\"32\", \"8\")\n\nsnow_inner_add_yblock_mmx_end(\"32\")\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_322", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void arm_thiswdog_write(void *opaque, target_phys_addr_t addr,\n+\n+ uint64_t value, unsigned size)\n+\n {\n \n arm_mptimer_state *s = (arm_mptimer_state *)opaque;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void arm_thiswdog_write(void *opaque, target_phys_addr_t addr,\n\n uint64_t value, unsigned size)\n\n{\n\n arm_mptimer_state *s = (arm_mptimer_state *)opaque;\n\n int id = get_current_cpu(s);\n\n timerblock_write(&s->timerblock[id * 2 + 1], addr, value, size);\n\n}\n"}} {"sample_id": "4ab29b8214cc4b54e0c1a8270b610a340311470e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void fdt_add_gic_node(const VirtBoardInfo *vbi)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void fdt_add_gic_node(const VirtBoardInfo *vbi)\n\n{\n\n uint32_t gic_phandle;\n\n\n\n gic_phandle = qemu_fdt_alloc_phandle(vbi->fdt);\n\n qemu_fdt_setprop_cell(vbi->fdt, \"/\", \"interrupt-parent\", gic_phandle);\n\n\n\n qemu_fdt_add_subnode(vbi->fdt, \"/intc\");\n\n /* 'cortex-a15-gic' means 'GIC v2' */\n\n qemu_fdt_setprop_string(vbi->fdt, \"/intc\", \"compatible\",\n\n \"arm,cortex-a15-gic\");\n\n qemu_fdt_setprop_cell(vbi->fdt, \"/intc\", \"#interrupt-cells\", 3);\n\n qemu_fdt_setprop(vbi->fdt, \"/intc\", \"interrupt-controller\", NULL, 0);\n\n qemu_fdt_setprop_sized_cells(vbi->fdt, \"/intc\", \"reg\",\n\n 2, vbi->memmap[VIRT_GIC_DIST].base,\n\n 2, vbi->memmap[VIRT_GIC_DIST].size,\n\n 2, vbi->memmap[VIRT_GIC_CPU].base,\n\n 2, vbi->memmap[VIRT_GIC_CPU].size);\n\n qemu_fdt_setprop_cell(vbi->fdt, \"/intc\", \"phandle\", gic_phandle);\n\n}\n"}} {"sample_id": "c7cacb3e7a2e9fdf929c993b98268e4179147cbb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static char *qemu_rbd_parse_clientname(const char *conf, char *clientname)\n+\n+{\n+\n+ const char *p = conf;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static char *qemu_rbd_parse_clientname(const char *conf, char *clientname)\n\n{\n\n const char *p = conf;\n\n\n\n while (*p) {\n\n int len;\n\n const char *end = strchr(p, ':');\n\n\n\n if (end) {\n\n len = end - p;\n\n } else {\n\n len = strlen(p);\n\n }\n\n\n\n if (strncmp(p, \"id=\", 3) == 0) {\n\n len -= 3;\n\n strncpy(clientname, p + 3, len);\n\n clientname[len] = '\\0';\n\n return clientname;\n\n }\n\n if (end == NULL) {\n\n break;\n\n }\n\n p = end + 1;\n\n }\n\n return NULL;\n\n}\n"}} {"sample_id": "38931fa8cfb074a08ce65fd1982bd4a5bef9d6fb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void usb_hid_changed(HIDState *hs)\n+\n+{\n+\n+ USBHIDState *us = container_of(hs, USBHIDState, hid);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void usb_hid_changed(HIDState *hs)\n\n{\n\n USBHIDState *us = container_of(hs, USBHIDState, hid);\n\n\n\n us->changed = 1;\n\n\n\n if (us->datain) {\n\n us->datain(us->datain_opaque);\n\n }\n\n\n\n usb_wakeup(&us->dev);\n\n}\n"}} {"sample_id": "f3a06403b82c7f036564e4caf18b52ce6885fcfb_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n GACommandState *ga_command_state_new(void)\n+\n {\n \n GACommandState *cs = g_malloc0(sizeof(GACommandState));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "GACommandState *ga_command_state_new(void)\n\n{\n\n GACommandState *cs = g_malloc0(sizeof(GACommandState));\n\n cs->groups = NULL;\n\n return cs;\n\n}\n"}} {"sample_id": "bf8d492405feaee2c1685b3b9d5e03228ed3e47f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ DeviceClass *dc = DEVICE_CLASS(klass);\n+\n+ PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);\n+\n+\n \n hc->root_bus_path = i440fx_pcihost_root_bus_path;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void i440fx_pcihost_class_init(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);\n\n\n\n hc->root_bus_path = i440fx_pcihost_root_bus_path;\n\n dc->realize = i440fx_pcihost_realize;\n\n dc->fw_name = \"pci\";\n\n dc->props = i440fx_props;\n\n\n\n}"}} {"sample_id": "a8bdf2405c6027f45a899eaaa6ba74e97c1c2701_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -37,11 +37,11 @@\n return -1;\n \n \n+\n+\n+ avctx->priv_data = gsm_create();\n+\n+\n \n switch(avctx->codec_id) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static av_cold int libgsm_encode_init(AVCodecContext *avctx) {\n\n if (avctx->channels > 1) {\n\n av_log(avctx, AV_LOG_ERROR, \"Mono required for GSM, got %d channels\\n\",\n\n avctx->channels);\n\n return -1;\n\n\n\n\n if (avctx->sample_rate != 8000) {\n\n av_log(avctx, AV_LOG_ERROR, \"Sample rate 8000Hz required for GSM, got %dHz\\n\",\n\n avctx->sample_rate);\n\n if (avctx->strict_std_compliance > FF_COMPLIANCE_UNOFFICIAL)\n\n return -1;\n\n\n if (avctx->bit_rate != 13000 /* Official */ &&\n\n avctx->bit_rate != 13200 /* Very common */ &&\n\n avctx->bit_rate != 0 /* Unknown; a.o. mov does not set bitrate when decoding */ ) {\n\n av_log(avctx, AV_LOG_ERROR, \"Bitrate 13000bps required for GSM, got %dbps\\n\",\n\n avctx->bit_rate);\n\n if (avctx->strict_std_compliance > FF_COMPLIANCE_UNOFFICIAL)\n\n return -1;\n\n\n\n\n avctx->priv_data = gsm_create();\n\n\n\n switch(avctx->codec_id) {\n\n case CODEC_ID_GSM:\n\n avctx->frame_size = GSM_FRAME_SIZE;\n\n avctx->block_align = GSM_BLOCK_SIZE;\n\n break;\n\n case CODEC_ID_GSM_MS: {\n\n int one = 1;\n\n gsm_option(avctx->priv_data, GSM_OPT_WAV49, &one);\n\n avctx->frame_size = 2*GSM_FRAME_SIZE;\n\n avctx->block_align = GSM_MS_BLOCK_SIZE;\n\n\n\n\n\n avctx->coded_frame= avcodec_alloc_frame();\n\n\n\n\n\n\n\n return 0;\n"}} {"sample_id": "f36aec3b5e18c4c167612d0051a6d5b6144b3552_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void chomp6(ChannelData *ctx, int16_t *output, uint8_t val,\n \n+ const uint16_t tab1[],\n \n const int16_t *tab2, int tab2_stride,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void chomp6(ChannelData *ctx, int16_t *output, uint8_t val,\n\n const uint16_t tab1[],\n\n const int16_t *tab2, int tab2_stride,\n\n uint32_t numChannels)\n\n{\n\n int16_t current;\n\n\n\n current = tab2[((ctx->index & 0x7f0) >> 4)*tab2_stride + val];\n\n\n\n if ((ctx->previous ^ current) >= 0) {\n\n ctx->factor = FFMIN(ctx->factor + 506, 32767);\n\n } else {\n\n if (ctx->factor - 314 < -32768)\n\n ctx->factor = -32767;\n\n else\n\n ctx->factor -= 314;\n\n }\n\n\n\n current = mace_broken_clip_int16(current + ctx->level);\n\n\n\n ctx->level = ((current*ctx->factor) >> 15);\n\n current >>= 1;\n\n\n\n output[0] = QT_8S_2_16S(ctx->previous + ctx->prev2 -\n\n ((ctx->prev2-current) >> 2));\n\n output[numChannels] = QT_8S_2_16S(ctx->previous + current +\n\n ((ctx->prev2-current) >> 2));\n\n ctx->prev2 = ctx->previous;\n\n ctx->previous = current;\n\n\n\n if ((ctx->index += tab1[val] - (ctx->index >> 5)) < 0)\n\n ctx->index = 0;\n\n}\n"}} {"sample_id": "0f3f1f302fd2021a5ce6cb170321d0a0d35bdec5_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -40,11 +40,11 @@\n \n \n \n+ /* Now we can tell the host to read */\n+\n+ vring_wait_reply(&block, 0);\n+\n+\n \n drain_irqs(block.schid);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int virtio_read_many(ulong sector, void *load_addr, int sec_num)\n\n{\n\n struct virtio_blk_outhdr out_hdr;\n\n u8 status;\n\n\n\n /* Tell the host we want to read */\n\n out_hdr.type = VIRTIO_BLK_T_IN;\n\n out_hdr.ioprio = 99;\n\n out_hdr.sector = sector;\n\n\n\n vring_send_buf(&block, &out_hdr, sizeof(out_hdr), VRING_DESC_F_NEXT);\n\n\n\n /* This is where we want to receive data */\n\n vring_send_buf(&block, load_addr, SECTOR_SIZE * sec_num,\n\n VRING_DESC_F_WRITE | VRING_HIDDEN_IS_CHAIN |\n\n VRING_DESC_F_NEXT);\n\n\n\n /* status field */\n\n vring_send_buf(&block, &status, sizeof(u8), VRING_DESC_F_WRITE |\n\n VRING_HIDDEN_IS_CHAIN);\n\n\n\n /* Now we can tell the host to read */\n\n vring_wait_reply(&block, 0);\n\n\n\n drain_irqs(block.schid);\n\n\n\n return status;\n\n}\n"}} {"sample_id": "d07cc1f12d8e15c167857852c39190d770763824", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n \n \n kroute.gsi = virq;\n+\n+ kroute.type = KVM_IRQ_ROUTING_MSI;\n+\n+ kroute.flags = 0;\n+\n kroute.u.msi.address_lo = (uint32_t)msg.address;\n \n kroute.u.msi.address_hi = msg.address >> 32;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int kvm_irqchip_add_msi_route(KVMState *s, MSIMessage msg)\n\n{\n\n struct kvm_irq_routing_entry kroute;\n\n int virq;\n\n\n\n if (!kvm_gsi_routing_enabled()) {\n\n return -ENOSYS;\n\n }\n\n\n\n virq = kvm_irqchip_get_virq(s);\n\n if (virq < 0) {\n\n return virq;\n\n }\n\n\n\n kroute.gsi = virq;\n\n kroute.type = KVM_IRQ_ROUTING_MSI;\n\n kroute.flags = 0;\n\n kroute.u.msi.address_lo = (uint32_t)msg.address;\n\n kroute.u.msi.address_hi = msg.address >> 32;\n\n kroute.u.msi.data = msg.data;\n\n\n\n kvm_add_routing_entry(s, &kroute);\n\n\n\n return virq;\n\n}\n"}} {"sample_id": "91479dd0b5bd3b087b92ddd7bc3f2c54982cfe17_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n tcase_add_test(qlist_public_tcase, qlist_new_test);\n \n tcase_add_test(qlist_public_tcase, qlist_append_test);\n+\n+ tcase_add_test(qlist_public_tcase, qobject_to_qlist_test);\n+\n+ tcase_add_test(qlist_public_tcase, qlist_destroy_test);\n+\n tcase_add_test(qlist_public_tcase, qlist_iter_test);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static Suite *QList_suite(void)\n\n{\n\n Suite *s;\n\n TCase *qlist_public_tcase;\n\n\n\n s = suite_create(\"QList suite\");\n\n\n\n qlist_public_tcase = tcase_create(\"Public Interface\");\n\n suite_add_tcase(s, qlist_public_tcase);\n\n tcase_add_test(qlist_public_tcase, qlist_new_test);\n\n tcase_add_test(qlist_public_tcase, qlist_append_test);\n\n tcase_add_test(qlist_public_tcase, qobject_to_qlist_test);\n\n tcase_add_test(qlist_public_tcase, qlist_destroy_test);\n\n tcase_add_test(qlist_public_tcase, qlist_iter_test);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "4ed658ca925249021789d6a51fd6f99f68213f28", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n bus = sysbus_get_default();\n \n \n+\n+\n+ qdev_set_parent_bus(dev, bus);\n+\n+ qdev_prop_set_globals(dev);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "DeviceState *qdev_try_create(BusState *bus, const char *name)\n\n{\n\n DeviceState *dev;\n\n\n\n\n\n\n dev = DEVICE(object_new(name));\n\n if (!dev) {\n\n\n\n\n\n if (!bus) {\n\n bus = sysbus_get_default();\n\n\n\n\n qdev_set_parent_bus(dev, bus);\n\n qdev_prop_set_globals(dev);\n\n\n\n return dev;\n"}} {"sample_id": "fe0f4e56577a2dbd373bb50b0ae2d49e69d822fc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n \n \n if (!src->buf) {\n+\n+ ret = packet_alloc(&dst->buf, src->size);\n+\n+ if (ret < 0)\n+\n goto fail;\n \n memcpy(dst->buf->data, src->data, src->size);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int av_packet_ref(AVPacket *dst, AVPacket *src)\n\n{\n\n int ret;\n\n\n\n ret = av_packet_copy_props(dst, src);\n\n if (ret < 0)\n\n return ret;\n\n\n\n if (!src->buf) {\n\n ret = packet_alloc(&dst->buf, src->size);\n\n if (ret < 0)\n\n goto fail;\n\n memcpy(dst->buf->data, src->data, src->size);\n\n } else\n\n dst->buf = av_buffer_ref(src->buf);\n\n\n\n dst->size = src->size;\n\n dst->data = dst->buf->data;\n\n return 0;\n\nfail:\n\n av_packet_free_side_data(dst);\n\n return ret;\n\n}\n"}} {"sample_id": "b854bc196f5c4b4e3299c0b0ee63cf828ece9e77_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,6 +4,6 @@\n \n {\n \n+ return addr >= 0xe1010000 && addr < 0xe1020004;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int omap_validate_tipb_mpui_addr(struct omap_mpu_state_s *s,\n\n target_phys_addr_t addr)\n\n{\n\n return addr >= 0xe1010000 && addr < 0xe1020004;\n\n}\n"}} {"sample_id": "dd5d61795690e339ae271692e7ab9df66b5eb153", "diff": "--- a/source.c\n+++ b/source.c\n@@ -47,11 +47,11 @@\n }\n \n \n+\n+ filter(ctx);\n+\n+\n+\n return ff_filter_frame(ctx->outputs[0], av_frame_clone(idet->cur));\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int filter_frame(AVFilterLink *link, AVFrame *picref)\n\n{\n\n AVFilterContext *ctx = link->dst;\n\n IDETContext *idet = ctx->priv;\n\n\n\n if (idet->prev)\n\n av_frame_free(&idet->prev);\n\n idet->prev = idet->cur;\n\n idet->cur = idet->next;\n\n idet->next = picref;\n\n\n\n if (!idet->cur)\n\n return 0;\n\n\n\n if (!idet->prev)\n\n idet->prev = av_frame_clone(idet->cur);\n\n\n\n if (!idet->csp)\n\n idet->csp = av_pix_fmt_desc_get(link->format);\n\n if (idet->csp->comp[0].depth_minus1 / 8 == 1){\n\n idet->filter_line = (ff_idet_filter_func)ff_idet_filter_line_c_16bit;\n\n if (ARCH_X86)\n\n ff_idet_init_x86(idet, 1);\n\n }\n\n\n\n filter(ctx);\n\n\n\n return ff_filter_frame(ctx->outputs[0], av_frame_clone(idet->cur));\n\n}\n"}} {"sample_id": "32bafa8fdd098d52fbf1102d5a5e48d29398c0aa_17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n NetClientState *peer, Error **errp)\n \n+{\n+\n+ const NetdevHubPortOptions *hubport;\n+\n+\n \n assert(opts->type == NET_CLIENT_OPTIONS_KIND_HUBPORT);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int net_init_hubport(const NetClientOptions *opts, const char *name,\n\n NetClientState *peer, Error **errp)\n\n{\n\n const NetdevHubPortOptions *hubport;\n\n\n\n assert(opts->type == NET_CLIENT_OPTIONS_KIND_HUBPORT);\n\n assert(!peer);\n\n hubport = opts->u.hubport;\n\n\n\n net_hub_add_port(hubport->hubid, name);\n\n return 0;\n\n}\n"}} {"sample_id": "a1f0cce2ac0243572ff72aa561da67fe3766a395_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,7 +14,7 @@\n \n r->io_header.dxfer_direction = direction;\n \n+ r->io_header.dxferp = r->buf;\n \n r->io_header.dxfer_len = r->buflen;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int execute_command(BlockDriverState *bdrv,\n\n SCSIGenericReq *r, int direction,\n\n\t\t\t BlockDriverCompletionFunc *complete)\n\n{\n\n SCSIGenericState *s = DO_UPCAST(SCSIGenericState, qdev, r->req.dev);\n\n\n\n r->io_header.interface_id = 'S';\n\n r->io_header.dxfer_direction = direction;\n\n r->io_header.dxferp = r->buf;\n\n r->io_header.dxfer_len = r->buflen;\n\n r->io_header.cmdp = r->req.cmd.buf;\n\n r->io_header.cmd_len = r->req.cmd.len;\n\n r->io_header.mx_sb_len = sizeof(s->sensebuf);\n\n r->io_header.sbp = s->sensebuf;\n\n r->io_header.timeout = MAX_UINT;\n\n r->io_header.usr_ptr = r;\n\n r->io_header.flags |= SG_FLAG_DIRECT_IO;\n\n\n\n r->req.aiocb = bdrv_aio_ioctl(bdrv, SG_IO, &r->io_header, complete, r);\n\n if (r->req.aiocb == NULL) {\n\n BADF(\"execute_command: read failed !\\n\");\n\n return -1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "efcb9383b974114e5f682e531346006f8f2466c0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void emulate_spapr_hypercall(CPUPPCState *env)\n+\n {\n \n env->gpr[3] = spapr_hypercall(env, env->gpr[3], &env->gpr[4]);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void emulate_spapr_hypercall(CPUPPCState *env)\n\n{\n\n env->gpr[3] = spapr_hypercall(env, env->gpr[3], &env->gpr[4]);\n\n}\n"}} {"sample_id": "14a10fc39923b3af07c8c46d22cb20843bee3a72", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void mips_cpu_realizefn(DeviceState *dev, Error **errp)\n+\n {\n+\n MIPSCPU *cpu = MIPS_CPU(dev);\n \n MIPSCPUClass *mcc = MIPS_CPU_GET_CLASS(dev);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void mips_cpu_realizefn(DeviceState *dev, Error **errp)\n\n{\n\n MIPSCPU *cpu = MIPS_CPU(dev);\n\n MIPSCPUClass *mcc = MIPS_CPU_GET_CLASS(dev);\n\n\n\n cpu_reset(CPU(cpu));\n\n\n\n mcc->parent_realize(dev, errp);\n\n}\n"}} {"sample_id": "e5c67ab552fb056827b5b40356c0ef235e975e7e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static void error_callback_bh(void *opaque)\n+\n+{\n \n Coroutine *co = opaque;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void error_callback_bh(void *opaque)\n\n{\n\n Coroutine *co = opaque;\n\n qemu_coroutine_enter(co);\n\n}\n"}} {"sample_id": "2b215b7f5af0ef9be79c697d8990e6958a134f98", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int hls_slice_data_wpp(HEVCContext *s, const uint8_t *nal, int length)\n {\n+ HEVCLocalContext *lc = s->HEVClc;\n+ int *ret = av_malloc_array(s->sh.num_entry_point_offsets + 1, sizeof(int));\n+ int *arg = av_malloc_array(s->sh.num_entry_point_offsets + 1, sizeof(int));\n+ int offset;\n+ int startheader, cmpt = 0;\n int i, j, res = 0;\n if (!s->sList[1]) {\n ff_alloc_entries(s->avctx, s->sh.num_entry_point_offsets + 1);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int hls_slice_data_wpp(HEVCContext *s, const uint8_t *nal, int length)\n{\n HEVCLocalContext *lc = s->HEVClc;\n int *ret = av_malloc_array(s->sh.num_entry_point_offsets + 1, sizeof(int));\n int *arg = av_malloc_array(s->sh.num_entry_point_offsets + 1, sizeof(int));\n int offset;\n int startheader, cmpt = 0;\n int i, j, res = 0;\n if (!s->sList[1]) {\n ff_alloc_entries(s->avctx, s->sh.num_entry_point_offsets + 1);\n for (i = 1; i < s->threads_number; i++) {\n s->sList[i] = av_malloc(sizeof(HEVCContext));\n memcpy(s->sList[i], s, sizeof(HEVCContext));\n s->HEVClcList[i] = av_mallocz(sizeof(HEVCLocalContext));\n s->sList[i]->HEVClc = s->HEVClcList[i];\n offset = (lc->gb.index >> 3);\n for (j = 0, cmpt = 0, startheader = offset + s->sh.entry_point_offset[0]; j < s->skipped_bytes; j++) {\n if (s->skipped_bytes_pos[j] >= offset && s->skipped_bytes_pos[j] < startheader) {\n startheader--;\n cmpt++;\n for (i = 1; i < s->sh.num_entry_point_offsets; i++) {\n offset += (s->sh.entry_point_offset[i - 1] - cmpt);\n for (j = 0, cmpt = 0, startheader = offset\n + s->sh.entry_point_offset[i]; j < s->skipped_bytes; j++) {\n if (s->skipped_bytes_pos[j] >= offset && s->skipped_bytes_pos[j] < startheader) {\n startheader--;\n cmpt++;\n s->sh.size[i - 1] = s->sh.entry_point_offset[i] - cmpt;\n s->sh.offset[i - 1] = offset;\n if (s->sh.num_entry_point_offsets != 0) {\n offset += s->sh.entry_point_offset[s->sh.num_entry_point_offsets - 1] - cmpt;\n s->sh.size[s->sh.num_entry_point_offsets - 1] = length - offset;\n s->sh.offset[s->sh.num_entry_point_offsets - 1] = offset;\n s->data = nal;\n for (i = 1; i < s->threads_number; i++) {\n s->sList[i]->HEVClc->first_qp_group = 1;\n s->sList[i]->HEVClc->qp_y = s->sList[0]->HEVClc->qp_y;\n memcpy(s->sList[i], s, sizeof(HEVCContext));\n s->sList[i]->HEVClc = s->HEVClcList[i];\n avpriv_atomic_int_set(&s->wpp_err, 0);\n ff_reset_entries(s->avctx);\n for (i = 0; i <= s->sh.num_entry_point_offsets; i++) {\n arg[i] = i;\n ret[i] = 0;\n if (s->pps->entropy_coding_sync_enabled_flag)\n s->avctx->execute2(s->avctx, (void *) hls_decode_entry_wpp, arg, ret, s->sh.num_entry_point_offsets + 1);\n for (i = 0; i <= s->sh.num_entry_point_offsets; i++)\n res += ret[i];\n return res;"}} {"sample_id": "6ef4716cecdfa1b3794c1a33edba9840e1aa6b5f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n for (p = devices; *p != '\\0'; p++) {\n \n+ /* Allowed boot devices are:\n+\n+ * a-b: floppy disk drives\n+\n+ * c-f: IDE disk drives\n \n * g-m: machine implementation dependent drives\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void validate_bootdevices(char *devices)\n\n{\n\n /* We just do some generic consistency checks */\n\n const char *p;\n\n int bitmap = 0;\n\n\n\n for (p = devices; *p != '\\0'; p++) {\n\n /* Allowed boot devices are:\n\n * a-b: floppy disk drives\n\n * c-f: IDE disk drives\n\n * g-m: machine implementation dependent drives\n\n * n-p: network devices\n\n * It's up to each machine implementation to check if the given boot\n\n * devices match the actual hardware implementation and firmware\n\n * features.\n\n */\n\n if (*p < 'a' || *p > 'p') {\n\n fprintf(stderr, \"Invalid boot device '%c'\\n\", *p);\n\n exit(1);\n\n }\n\n if (bitmap & (1 << (*p - 'a'))) {\n\n fprintf(stderr, \"Boot device '%c' was given twice\\n\", *p);\n\n exit(1);\n\n }\n\n bitmap |= 1 << (*p - 'a');\n\n }\n\n}\n"}} {"sample_id": "bb3e9e1fd7ab62b60780c66d68b2d7bfd8758e61", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,5 +7,5 @@\n \n \n return SIZE_BUFFER_VT220 - scon->iov_data_len;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int chr_can_read(void *opaque)\n\n{\n\n SCLPConsole *scon = opaque;\n\n\n\n return SIZE_BUFFER_VT220 - scon->iov_data_len;\n\n}\n"}} {"sample_id": "a8ff69ce2bad1c4bb043e88ea35f5ab5691d4f3c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -44,11 +44,11 @@\n \n s->slice_height = s->mb_height / code;\n \n+\n+\n+ if(s->avctx->debug&FF_DEBUG_PICT_INFO){\n+\n+ av_log(s->avctx, AV_LOG_DEBUG, \"fps:%d, br:%d, qpbit:%d, abt_flag:%d, j_type_bit:%d, tl_mv_flag:%d, mbrl_bit:%d, code:%d, flag3:%d, slices:%d\\n\",\n \n fps, s->bit_rate, w->mspel_bit, w->abt_flag, w->j_type_bit, w->top_left_mv_flag, w->per_mb_rl_bit, code, w->flag3,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int decode_ext_header(Wmv2Context *w){\n\n MpegEncContext * const s= &w->s;\n\n GetBitContext gb;\n\n int fps;\n\n int code;\n\n\n\n if(s->avctx->extradata_size<4) return -1;\n\n\n\n init_get_bits(&gb, s->avctx->extradata, s->avctx->extradata_size*8);\n\n\n\n fps = get_bits(&gb, 5);\n\n s->bit_rate = get_bits(&gb, 11)*1024;\n\n w->mspel_bit = get_bits1(&gb);\n\n w->flag3 = get_bits1(&gb);\n\n w->abt_flag = get_bits1(&gb);\n\n w->j_type_bit = get_bits1(&gb);\n\n w->top_left_mv_flag= get_bits1(&gb);\n\n w->per_mb_rl_bit = get_bits1(&gb);\n\n code = get_bits(&gb, 3);\n\n\n\n if(code==0) return -1;\n\n\n\n s->slice_height = s->mb_height / code;\n\n\n\n if(s->avctx->debug&FF_DEBUG_PICT_INFO){\n\n av_log(s->avctx, AV_LOG_DEBUG, \"fps:%d, br:%d, qpbit:%d, abt_flag:%d, j_type_bit:%d, tl_mv_flag:%d, mbrl_bit:%d, code:%d, flag3:%d, slices:%d\\n\",\n\n fps, s->bit_rate, w->mspel_bit, w->abt_flag, w->j_type_bit, w->top_left_mv_flag, w->per_mb_rl_bit, code, w->flag3,\n\n code);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "fb7b5c0df6e3c501973ce4d57eb2b1d4344a519d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n sc->realize = scsi_block_realize;\n \n+ sc->unrealize = scsi_unrealize;\n+\n+ sc->alloc_req = scsi_block_new_request;\n+\n+ sc->parse_cdb = scsi_block_parse_cdb;\n \n dc->fw_name = \"disk\";\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void scsi_block_class_initfn(ObjectClass *klass, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass);\n\n\n\n sc->realize = scsi_block_realize;\n\n sc->unrealize = scsi_unrealize;\n\n sc->alloc_req = scsi_block_new_request;\n\n sc->parse_cdb = scsi_block_parse_cdb;\n\n dc->fw_name = \"disk\";\n\n dc->desc = \"SCSI block device passthrough\";\n\n dc->reset = scsi_disk_reset;\n\n dc->props = scsi_block_properties;\n\n dc->vmsd = &vmstate_scsi_disk_state;\n\n}\n"}} {"sample_id": "d597655f771979c70c08f8f8ed84c1319da121e8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n int i, bytes = 1;\n \n+ while (val >> bytes*8) bytes++;\n+\n+\n+\n put_ebml_id(pb, elementid);\n \n put_ebml_num(pb, bytes, 0);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void put_ebml_uint(ByteIOContext *pb, unsigned int elementid, uint64_t val)\n\n{\n\n int i, bytes = 1;\n\n while (val >> bytes*8) bytes++;\n\n\n\n put_ebml_id(pb, elementid);\n\n put_ebml_num(pb, bytes, 0);\n\n for (i = bytes - 1; i >= 0; i--)\n\n put_byte(pb, val >> i*8);\n\n}\n"}} {"sample_id": "6e42e6c4b410dbef8b593c2d796a5dad95f89ee4_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void palette8torgb15(const uint8_t *src, uint8_t *dst, long num_pixels, const uint8_t *palette)\n+\n+{\n+\n \tlong i;\n \n \tfor(i=0; iinterface_info = *interface_info;\n\n\n\n /*\n\n * If we receive interface info after the device has already been\n\n * connected (ie on a set_config), re-check the filter.\n\n */\n\n if (qemu_timer_pending(dev->attach_timer) || dev->dev.attached) {\n\n if (usbredir_check_filter(dev)) {\n\n ERROR(\"Device no longer matches filter after interface info \"\n\n \"change, disconnecting!\\n\");\n\n }\n\n }\n\n}\n"}} {"sample_id": "5fb6c7a8b26eab1a22207d24b4784bd2b39ab54b_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n vnc_write_u8(vs, 2);\n \n+\n+\n+ vnc_read_when(vs, protocol_client_vencrypt_init, 2);\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int start_auth_vencrypt(VncState *vs)\n\n{\n\n /* Send VeNCrypt version 0.2 */\n\n vnc_write_u8(vs, 0);\n\n vnc_write_u8(vs, 2);\n\n\n\n vnc_read_when(vs, protocol_client_vencrypt_init, 2);\n\n return 0;\n\n}\n"}} {"sample_id": "87e8788680e16c51f6048af26f3f7830c35207a5_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int avs_probe(AVProbeData * p)\n \n+{\n+\n+ const uint8_t *d;\n+\n+\n \n if (p->buf_size < 2)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int avs_probe(AVProbeData * p)\n\n{\n\n const uint8_t *d;\n\n\n\n if (p->buf_size < 2)\n\n return 0;\n\n d = p->buf;\n\n if (d[0] == 'w' && d[1] == 'W' && d[2] == 0x10 && d[3] == 0)\n\n return 50;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "384acbf46b70edf0d2c1648aa1a92a90bcf7057d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void async_context_push(void)\n \n {\n+\n+ struct AsyncContext *new = qemu_mallocz(sizeof(*new));\n+\n new->parent = async_context;\n \n new->id = async_context->id + 1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void async_context_push(void)\n\n{\n\n struct AsyncContext *new = qemu_mallocz(sizeof(*new));\n\n new->parent = async_context;\n\n new->id = async_context->id + 1;\n\n async_context = new;\n\n}\n"}} {"sample_id": "2da0d70d5eebe42f9fcd27ee554419ebe2a5da06_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n static inline void RENAME(uyvyToUV)(uint8_t *dstU, uint8_t *dstV, uint8_t *src1, uint8_t *src2, long width)\n+\n+{\n+\n #ifdef HAVE_MMX\n+\n+\tasm volatile(\n \n+\t\t\"movq \"MANGLE(bm01010101)\", %%mm4\\n\\t\"\n \n \t\t\"mov %0, %%\"REG_a\"\t\t\\n\\t\"\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static inline void RENAME(uyvyToUV)(uint8_t *dstU, uint8_t *dstV, uint8_t *src1, uint8_t *src2, long width)\n\n{\n\n#ifdef HAVE_MMX\n\n\tasm volatile(\n\n\t\t\"movq \"MANGLE(bm01010101)\", %%mm4\\n\\t\"\n\n\t\t\"mov %0, %%\"REG_a\"\t\t\\n\\t\"\n\n\t\t\"1:\t\t\t\t\\n\\t\"\n\n\t\t\"movq (%1, %%\"REG_a\",4), %%mm0\t\\n\\t\"\n\n\t\t\"movq 8(%1, %%\"REG_a\",4), %%mm1\t\\n\\t\"\n\n\t\t\"pand %%mm4, %%mm0\t\t\\n\\t\"\n\n\t\t\"pand %%mm4, %%mm1\t\t\\n\\t\"\n\n\t\t\"packuswb %%mm1, %%mm0\t\t\\n\\t\"\n\n\t\t\"movq %%mm0, %%mm1\t\t\\n\\t\"\n\n\t\t\"psrlw $8, %%mm0\t\t\\n\\t\"\n\n\t\t\"pand %%mm4, %%mm1\t\t\\n\\t\"\n\n\t\t\"packuswb %%mm0, %%mm0\t\t\\n\\t\"\n\n\t\t\"packuswb %%mm1, %%mm1\t\t\\n\\t\"\n\n\t\t\"movd %%mm0, (%3, %%\"REG_a\")\t\\n\\t\"\n\n\t\t\"movd %%mm1, (%2, %%\"REG_a\")\t\\n\\t\"\n\n\t\t\"add $4, %%\"REG_a\"\t\t\\n\\t\"\n\n\t\t\" js 1b\t\t\t\t\\n\\t\"\n\n\t\t: : \"g\" (-width), \"r\" (src1+width*4), \"r\" (dstU+width), \"r\" (dstV+width)\n\n\t\t: \"%\"REG_a\n\n\t);\n\n#else\n\n\tint i;\n\n\tfor(i=0; ienable_write_cache;\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int bdrv_enable_write_cache(BlockDriverState *bs)\n\n{\n\n return bs->enable_write_cache;\n\n}\n"}} {"sample_id": "81bad50ec40311797c38a7691844c7d2df9b3823", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n target_ulong helper_evpe(CPUMIPSState *env)\n+\n {\n \n+ CPUMIPSState *other_cpu = first_cpu;\n+\n target_ulong prev = env->mvp->CP0_MVPControl;\n \n+\n+\n do {\n \n if (other_cpu != env", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "target_ulong helper_evpe(CPUMIPSState *env)\n\n{\n\n CPUMIPSState *other_cpu = first_cpu;\n\n target_ulong prev = env->mvp->CP0_MVPControl;\n\n\n\n do {\n\n if (other_cpu != env\n\n /* If the VPE is WFI, don't disturb its sleep. */\n\n && !mips_vpe_is_wfi(other_cpu)) {\n\n /* Enable the VPE. */\n\n other_cpu->mvp->CP0_MVPControl |= (1 << CP0MVPCo_EVP);\n\n mips_vpe_wake(other_cpu); /* And wake it up. */\n\n }\n\n other_cpu = other_cpu->next_cpu;\n\n } while (other_cpu);\n\n return prev;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_147", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n {\n \n+ PCIBonitoState *s = opaque;\n+\n+\n \n ((uint32_t *)(&s->boncop))[addr/sizeof(uint32_t)] = val & 0xffffffff;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bonito_cop_writel(void *opaque, target_phys_addr_t addr,\n\n uint64_t val, unsigned size)\n\n{\n\n PCIBonitoState *s = opaque;\n\n\n\n ((uint32_t *)(&s->boncop))[addr/sizeof(uint32_t)] = val & 0xffffffff;\n\n}\n"}} {"sample_id": "fd8f5e37557596e14a859d8edf3dc24523bd4400", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n entry.cksum.offset = cpu_to_le32(checksum - (uint8_t *)table);\n \n+ entry.cksum.start = cpu_to_le32((uint8_t *)start - (uint8_t *)table);\n+\n+ entry.cksum.length = cpu_to_le32(size);\n+\n+\n \n g_array_append_val(linker, entry);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bios_linker_loader_add_checksum(GArray *linker, const char *file,\n\n void *table,\n\n void *start, unsigned size,\n\n uint8_t *checksum)\n\n{\n\n BiosLinkerLoaderEntry entry;\n\n\n\n memset(&entry, 0, sizeof entry);\n\n strncpy(entry.cksum.file, file, sizeof entry.cksum.file - 1);\n\n entry.command = cpu_to_le32(BIOS_LINKER_LOADER_COMMAND_ADD_CHECKSUM);\n\n entry.cksum.offset = cpu_to_le32(checksum - (uint8_t *)table);\n\n entry.cksum.start = cpu_to_le32((uint8_t *)start - (uint8_t *)table);\n\n entry.cksum.length = cpu_to_le32(size);\n\n\n\n g_array_append_val(linker, entry);\n\n}\n"}} {"sample_id": "cf48b006400e34e1177d0ca22d1cdb5c900a199a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static inline int get_ue_code(GetBitContext *gb, int order)\n \n+{\n+\n if (order) {\n+\n int ret = get_ue_golomb(gb) << order;\n \n return ret + get_bits(gb, order);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline int get_ue_code(GetBitContext *gb, int order)\n\n{\n\n if (order) {\n\n int ret = get_ue_golomb(gb) << order;\n\n return ret + get_bits(gb, order);\n\n }\n\n return get_ue_golomb(gb);\n\n}\n"}} {"sample_id": "ae50b2747f77944faa79eb914272b54eb30b63b3_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n \n \n s = qemu_mallocz(sizeof(MIPSnetState));\n+\n \n \n register_ioport_write(base, 36, 1, mipsnet_ioport_write, s);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void mipsnet_init (int base, qemu_irq irq, NICInfo *nd)\n\n{\n\n MIPSnetState *s;\n\n\n\n qemu_check_nic_model(nd, \"mipsnet\");\n\n\n\n s = qemu_mallocz(sizeof(MIPSnetState));\n\n\n\n register_ioport_write(base, 36, 1, mipsnet_ioport_write, s);\n\n register_ioport_read(base, 36, 1, mipsnet_ioport_read, s);\n\n register_ioport_write(base, 36, 2, mipsnet_ioport_write, s);\n\n register_ioport_read(base, 36, 2, mipsnet_ioport_read, s);\n\n register_ioport_write(base, 36, 4, mipsnet_ioport_write, s);\n\n register_ioport_read(base, 36, 4, mipsnet_ioport_read, s);\n\n\n\n s->io_base = base;\n\n s->irq = irq;\n\n if (nd && nd->vlan) {\n\n s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,\n\n mipsnet_can_receive, mipsnet_receive, NULL,\n\n mipsnet_cleanup, s);\n\n } else {\n\n s->vc = NULL;\n\n }\n\n\n\n qemu_format_nic_info_str(s->vc, nd->macaddr);\n\n\n\n mipsnet_reset(s);\n\n register_savevm(\"mipsnet\", 0, 0, mipsnet_save, mipsnet_load, s);\n\n}\n"}} {"sample_id": "0008afc59c240271827d8a0fc747179da905050f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int dv_write_header(AVFormatContext *s)\n+\n+{\n \n s->priv_data = dv_init_mux(s);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int dv_write_header(AVFormatContext *s)\n\n{\n\n s->priv_data = dv_init_mux(s);\n\n if (!s->priv_data) {\n\n av_log(s, AV_LOG_ERROR, \"Can't initialize DV format!\\n\"\n\n \"Make sure that you supply exactly two streams:\\n\"\n\n \" video: 25fps or 29.97fps, audio: 2ch/48Khz/PCM\\n\"\n\n \" (50Mbps allows an optional second audio stream)\\n\");\n\n return -1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "6cf31ef263d36f6b89d9b64f15ca81cef4f24901_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void use_high_update_speed(WmallDecodeCtx *s, int ich)\n \n {\n+\n int ilms, recent, icoef;\n \n s->update_speed[ich] = 16;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void use_high_update_speed(WmallDecodeCtx *s, int ich)\n\n{\n\n int ilms, recent, icoef;\n\n s->update_speed[ich] = 16;\n\n for (ilms = s->cdlms_ttl[ich]; ilms >= 0; ilms--) {\n\n recent = s->cdlms[ich][ilms].recent;\n\n if (s->bV3RTM) {\n\n for (icoef = 0; icoef < s->cdlms[ich][ilms].order; icoef++)\n\n s->cdlms[ich][ilms].lms_updates[icoef + recent] *= 2;\n\n } else {\n\n for (icoef = 0; icoef < s->cdlms[ich][ilms].order; icoef++)\n\n s->cdlms[ich][ilms].lms_updates[icoef] *= 2;\n\n }\n\n }\n\n}\n"}} {"sample_id": "6e0d8677cb443e7408c0b7a25a93c6596d7fa380_21", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n ECX = (ECX & ~0xffff) | ((ECX - 1) & 0xffff);\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void OPPROTO op_decw_ECX(void)\n\n{\n\n ECX = (ECX & ~0xffff) | ((ECX - 1) & 0xffff);\n\n}\n"}} {"sample_id": "f1219091edd20e3b92544025c2b6dd5e4d98b61b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n {\n \n if (val)\n+\n+ val |= E1000_ICR_INT_ASSERTED;\n+\n s->mac_reg[ICR] = val;\n \n s->mac_reg[ICS] = val;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "set_interrupt_cause(E1000State *s, int index, uint32_t val)\n\n{\n\n if (val)\n\n val |= E1000_ICR_INT_ASSERTED;\n\n s->mac_reg[ICR] = val;\n\n s->mac_reg[ICS] = val;\n\n qemu_set_irq(s->dev.irq[0], (s->mac_reg[IMS] & s->mac_reg[ICR]) != 0);\n\n}\n"}} {"sample_id": "0e321191224c8cd137eef41da3257e096965c3d6_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n \n \n+ start >>= hb->granularity;\n+\n+ last >>= hb->granularity;\n+\n+ count = last - start + 1;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void hbitmap_set(HBitmap *hb, uint64_t start, uint64_t count)\n\n{\n\n /* Compute range in the last layer. */\n\n uint64_t last = start + count - 1;\n\n\n\n trace_hbitmap_set(hb, start, count,\n\n start >> hb->granularity, last >> hb->granularity);\n\n\n\n start >>= hb->granularity;\n\n last >>= hb->granularity;\n\n count = last - start + 1;\n\n\n\n\n hb->count += count - hb_count_between(hb, start, last);\n\n hb_set_between(hb, HBITMAP_LEVELS - 1, start, last);\n\n}"}} {"sample_id": "9f61abc8111c7c43f49ca012e957a108b9cc7610_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ AVDictionary *tmp = NULL;\n+\n+ int ret;\n+\n+\n \n av_dict_copy(&tmp, c->avio_opts, 0);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int open_in(HLSContext *c, AVIOContext **in, const char *url)\n\n{\n\n AVDictionary *tmp = NULL;\n\n int ret;\n\n\n\n av_dict_copy(&tmp, c->avio_opts, 0);\n\n\n\n ret = avio_open2(in, url, AVIO_FLAG_READ, c->interrupt_callback, &tmp);\n\n\n\n av_dict_free(&tmp);\n\n return ret;\n\n}\n"}} {"sample_id": "011de2b512a83aa5e9f8899ed5bbf2f31995b90e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n if (fd < 0 && errno != EINTR) {\n \n+ return;\n+\n+ } else if (fd >= 0) {\n+\n+ break;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void net_socket_accept(void *opaque)\n\n{\n\n NetSocketListenState *s = opaque;\n\n NetSocketState *s1;\n\n struct sockaddr_in saddr;\n\n socklen_t len;\n\n int fd;\n\n\n\n for(;;) {\n\n len = sizeof(saddr);\n\n fd = qemu_accept(s->fd, (struct sockaddr *)&saddr, &len);\n\n if (fd < 0 && errno != EINTR) {\n\n return;\n\n } else if (fd >= 0) {\n\n break;\n\n }\n\n }\n\n s1 = net_socket_fd_init(s->peer, s->model, s->name, fd, 1);\n\n if (s1) {\n\n snprintf(s1->nc.info_str, sizeof(s1->nc.info_str),\n\n \"socket: connection from %s:%d\",\n\n inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));\n\n }\n\n}\n"}} {"sample_id": "ad674e53b5cce265fadafbde2c6a4f190345cd00_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void stop(DBDMA_channel *ch)\n+\n {\n \n ch->regs[DBDMA_STATUS] &= cpu_to_be32(~(ACTIVE|DEAD|FLUSH));", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void stop(DBDMA_channel *ch)\n\n{\n\n ch->regs[DBDMA_STATUS] &= cpu_to_be32(~(ACTIVE|DEAD|FLUSH));\n\n\n\n /* the stop command does not increment command pointer */\n\n}\n"}} {"sample_id": "f36aec3b5e18c4c167612d0051a6d5b6144b3552_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,9 +6,9 @@\n \n {\n \n+ int16_t *samples = data;\n \n+ MACEContext *ctx = avctx->priv_data;\n \n int i, j;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int mace6_decode_frame(AVCodecContext *avctx,\n\n void *data, int *data_size,\n\n const uint8_t *buf, int buf_size)\n\n{\n\n int16_t *samples = data;\n\n MACEContext *ctx = avctx->priv_data;\n\n int i, j;\n\n\n\n for(i = 0; i < avctx->channels; i++) {\n\n int16_t *output = samples + i;\n\n\n\n for (j = 0; j < buf_size / avctx->channels; j++) {\n\n uint8_t pkt = buf[i + j*avctx->channels];\n\n\n\n chomp6(&ctx->chd[i], output, pkt >> 5 , MACEtab1, MACEtab2,\n\n 8, avctx->channels);\n\n output += avctx->channels << 1;\n\n chomp6(&ctx->chd[i], output,(pkt >> 3) & 3, MACEtab3, MACEtab4,\n\n 4, avctx->channels);\n\n output += avctx->channels << 1;\n\n chomp6(&ctx->chd[i], output, pkt & 7, MACEtab1, MACEtab2,\n\n 8, avctx->channels);\n\n output += avctx->channels << 1;\n\n }\n\n }\n\n\n\n *data_size = 2 * 6 * buf_size;\n\n\n\n return buf_size;\n\n}\n"}} {"sample_id": "36778660d7fd0748a6129916e47ecedd67bdb758_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n hwaddr get_pteg_offset32(PowerPCCPU *cpu, hwaddr hash)\n+\n+{\n \n CPUPPCState *env = &cpu->env;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "hwaddr get_pteg_offset32(PowerPCCPU *cpu, hwaddr hash)\n\n{\n\n CPUPPCState *env = &cpu->env;\n\n\n\n return (hash * HASH_PTEG_SIZE_32) & env->htab_mask;\n\n}\n"}} {"sample_id": "ce8c8b7bd8958fde291f7736016015864e7638a2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n rsp = qmp_dispatch(QOBJECT(req));\n \n+ if (rsp) {\n+\n+ ret = send_response(s, rsp);\n+\n+ if (ret) {\n \n g_warning(\"error sending response: %s\", strerror(ret));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void process_command(GAState *s, QDict *req)\n\n{\n\n QObject *rsp = NULL;\n\n int ret;\n\n\n\n g_assert(req);\n\n g_debug(\"processing command\");\n\n rsp = qmp_dispatch(QOBJECT(req));\n\n if (rsp) {\n\n ret = send_response(s, rsp);\n\n if (ret) {\n\n g_warning(\"error sending response: %s\", strerror(ret));\n\n }\n\n qobject_decref(rsp);\n\n } else {\n\n g_warning(\"error getting response\");\n\n }\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_72", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static BlockAIOCB *bdrv_aio_writev_em(BlockDriverState *bs,\n \n+ int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,\n+\n BlockCompletionFunc *cb, void *opaque)\n \n {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static BlockAIOCB *bdrv_aio_writev_em(BlockDriverState *bs,\n\n int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,\n\n BlockCompletionFunc *cb, void *opaque)\n\n{\n\n return bdrv_aio_rw_vector(bs, sector_num, qiov, nb_sectors, cb, opaque, 1);\n\n}\n"}} {"sample_id": "28343139330f557e00293933a4697c7d0fc19c56", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int mov_write_single_packet(AVFormatContext *s, AVPacket *pkt)\n+{\n+ MOVMuxContext *mov = s->priv_data;\n+ MOVTrack *trk = &mov->tracks[pkt->stream_index];\n+ AVCodecParameters *par = trk->par;\n+ int64_t frag_duration = 0;\n int size = pkt->size;\n if (mov->flags & FF_MOV_FLAG_FRAG_DISCONT) {\n int i;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int mov_write_single_packet(AVFormatContext *s, AVPacket *pkt)\n{\n MOVMuxContext *mov = s->priv_data;\n MOVTrack *trk = &mov->tracks[pkt->stream_index];\n AVCodecParameters *par = trk->par;\n int64_t frag_duration = 0;\n int size = pkt->size;\n if (mov->flags & FF_MOV_FLAG_FRAG_DISCONT) {\n int i;\n for (i = 0; i < s->nb_streams; i++)\n mov->tracks[i].frag_discont = 1;\n mov->flags &= ~FF_MOV_FLAG_FRAG_DISCONT;\n }\n if (!pkt->size) {\n if (trk->start_dts == AV_NOPTS_VALUE && trk->frag_discont) {\n trk->start_dts = pkt->dts;\n if (pkt->pts != AV_NOPTS_VALUE)\n trk->start_cts = pkt->pts - pkt->dts;\n else\n trk->start_cts = 0;\n }\n if (trk->par->codec_id == AV_CODEC_ID_MP4ALS) {\n int side_size = 0;\n uint8_t *side = av_packet_get_side_data(pkt, AV_PKT_DATA_NEW_EXTRADATA, &side_size);\n if (side && side_size > 0 && (side_size != par->extradata_size || memcmp(side, par->extradata, side_size))) {\n void *newextra = av_mallocz(side_size + AV_INPUT_BUFFER_PADDING_SIZE);\n if (!newextra)\n return AVERROR(ENOMEM);\n av_free(par->extradata);\n par->extradata = newextra;\n memcpy(par->extradata, side, side_size);\n par->extradata_size = side_size;\n mov->need_rewrite_extradata = 1;\n }\n }\n return 0; /* Discard 0 sized packets */\n }\n if (trk->entry && pkt->stream_index < s->nb_streams)\n frag_duration = av_rescale_q(pkt->dts - trk->cluster[0].dts,\n s->streams[pkt->stream_index]->time_base,\n AV_TIME_BASE_Q);\n if ((mov->max_fragment_duration &&\n frag_duration >= mov->max_fragment_duration) ||\n (mov->max_fragment_size && mov->mdat_size + size >= mov->max_fragment_size) ||\n (mov->flags & FF_MOV_FLAG_FRAG_KEYFRAME &&\n par->codec_type == AVMEDIA_TYPE_VIDEO &&\n trk->entry && pkt->flags & AV_PKT_FLAG_KEY)) {\n if (frag_duration >= mov->min_fragment_duration) {\n // Set the duration of this track to line up with the next\n // sample in this track. This avoids relying on AVPacket\n // duration, but only helps for this particular track, not\n // for the other ones that are flushed at the same time.\n trk->track_duration = pkt->dts - trk->start_dts;\n if (pkt->pts != AV_NOPTS_VALUE)\n trk->end_pts = pkt->pts;\n else\n trk->end_pts = pkt->dts;\n trk->end_reliable = 1;\n mov_auto_flush_fragment(s, 0);\n }\n }\n return ff_mov_write_packet(s, pkt);\n}"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_43", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n \t dinfo->bus == bus &&\n \n+\t dinfo->unit == unit)\n+\n+ return dinfo;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "DriveInfo *drive_get(BlockInterfaceType type, int bus, int unit)\n\n{\n\n DriveInfo *dinfo;\n\n\n\n /* seek interface, bus and unit */\n\n\n\n TAILQ_FOREACH(dinfo, &drives, next) {\n\n if (dinfo->type == type &&\n\n\t dinfo->bus == bus &&\n\n\t dinfo->unit == unit)\n\n return dinfo;\n\n }\n\n\n\n return NULL;\n\n}\n"}} {"sample_id": "cf2b7c01f81c1fb3283a1390c0ca9a2f81f4f4a8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n register const uint8_t *src = c->in;\n \n+ register uint8_t *dst = c->out;\n+\n+\n+ if (cnt > c->in_end - src) {\n+\n cnt = FFMAX(c->in_end - src, 0);\n \n c->error |= AV_LZO_INPUT_DEPLETED;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static inline void copy(LZOContext *c, int cnt)\n\n{\n\n register const uint8_t *src = c->in;\n\n register uint8_t *dst = c->out;\n\n\n if (cnt > c->in_end - src) {\n\n cnt = FFMAX(c->in_end - src, 0);\n\n c->error |= AV_LZO_INPUT_DEPLETED;\n\n }\n\n if (cnt > c->out_end - dst) {\n\n cnt = FFMAX(c->out_end - dst, 0);\n\n c->error |= AV_LZO_OUTPUT_FULL;\n\n }\n\n#if defined(INBUF_PADDED) && defined(OUTBUF_PADDED)\n\n AV_COPY32U(dst, src);\n\n src += 4;\n\n dst += 4;\n\n cnt -= 4;\n\n if (cnt > 0)\n\n#endif\n\n memcpy(dst, src, cnt);\n\n c->in = src + cnt;\n\n c->out = dst + cnt;\n\n}"}} {"sample_id": "7f2fe444a39bca733d390b6608801c5f002bfd31_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n \n \n for(i=0; i>(16-bits));\n+\n+#else\n+\n int bytes= length>>3;\n \n int bits= length&7;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void copy_bits(PutBitContext *pb, UINT8 *src, int length)\n\n{\n\n#if 1\n\n int bytes= length>>4;\n\n int bits= length&15;\n\n int i;\n\n\n\n for(i=0; i>(16-bits));\n\n#else\n\n int bytes= length>>3;\n\n int bits= length&7;\n\n int i;\n\n\n\n for(i=0; i>(8-bits));\n\n#endif\n\n}\n"}} {"sample_id": "8176bd1a4689ff08b0e85984563ad8288110f1a7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n int out=0;\n \n+ \n \n+ assert(a >= (1<<16));\n \n a<<=16;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint64_t log16(uint64_t a){\n\n int i;\n\n int out=0;\n\n \n\n assert(a >= (1<<16));\n\n a<<=16;\n\n \n\n for(i=19;i>=0;i--){\n\n if(a<(exp16_table[i]<<16)) continue;\n\n out |= 1<capabilities);\n \n int num_capabilities =\n+\n+ 1 + ((mhHeader->length - sizeof(VSCMsgInit)) / sizeof(uint32_t));\n+\n+ int i;\n+\n QemuThread thread_id;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "on_host_init(VSCMsgHeader *mhHeader, VSCMsgInit *incoming)\n\n{\n\n uint32_t *capabilities = (incoming->capabilities);\n\n int num_capabilities =\n\n 1 + ((mhHeader->length - sizeof(VSCMsgInit)) / sizeof(uint32_t));\n\n int i;\n\n QemuThread thread_id;\n\n\n\n incoming->version = ntohl(incoming->version);\n\n if (incoming->version != VSCARD_VERSION) {\n\n if (verbose > 0) {\n\n printf(\"warning: host has version %d, we have %d\\n\",\n\n verbose, VSCARD_VERSION);\n\n }\n\n }\n\n if (incoming->magic != VSCARD_MAGIC) {\n\n printf(\"unexpected magic: got %d, expected %d\\n\",\n\n incoming->magic, VSCARD_MAGIC);\n\n return -1;\n\n }\n\n for (i = 0 ; i < num_capabilities; ++i) {\n\n capabilities[i] = ntohl(capabilities[i]);\n\n }\n\n /* Future: check capabilities */\n\n /* remove whatever reader might be left in qemu,\n\n * in case of an unclean previous exit. */\n\n send_msg(VSC_ReaderRemove, VSCARD_MINIMAL_READER_ID, NULL, 0);\n\n /* launch the event_thread. This will trigger reader adds for all the\n\n * existing readers */\n\n qemu_thread_create(&thread_id, \"vsc/event\", event_thread, NULL, 0);\n\n return 0;\n\n}\n"}} {"sample_id": "8dfd5f96515ca20c4eb109cb0ee28e2bb32fc505", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,8 +24,8 @@\n \n if (ioc->io_err) {\n \n+ error_free(ioc->io_err);\n+\n+ }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qio_channel_websock_finalize(Object *obj)\n\n{\n\n QIOChannelWebsock *ioc = QIO_CHANNEL_WEBSOCK(obj);\n\n\n\n buffer_free(&ioc->encinput);\n\n buffer_free(&ioc->encoutput);\n\n buffer_free(&ioc->rawinput);\n\n buffer_free(&ioc->rawoutput);\n\n object_unref(OBJECT(ioc->master));\n\n if (ioc->io_tag) {\n\n g_source_remove(ioc->io_tag);\n\n }\n\n if (ioc->io_err) {\n\n error_free(ioc->io_err);\n\n }\n\n}\n"}} {"sample_id": "abd696e4f74a9d30801c6ae2693efe4e5979c2f2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n \n \n+ virtio_reset(schid);\n+\n+\n+\n+ config.index = 0;\n \n if (run_ccw(schid, CCW_CMD_READ_VQ_CONF, &config, sizeof(config))) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void virtio_setup_block(struct subchannel_id schid)\n\n{\n\n struct vq_info_block info;\n\n struct vq_config_block config = {};\n\n\n\n virtio_reset(schid);\n\n\n\n config.index = 0;\n\n if (run_ccw(schid, CCW_CMD_READ_VQ_CONF, &config, sizeof(config))) {\n\n virtio_panic(\"Could not get block device configuration\\n\");\n\n }\n\n vring_init(&block, config.num, (void*)(100 * 1024 * 1024),\n\n KVM_S390_VIRTIO_RING_ALIGN);\n\n\n\n info.queue = (100ULL * 1024ULL* 1024ULL);\n\n info.align = KVM_S390_VIRTIO_RING_ALIGN;\n\n info.index = 0;\n\n info.num = config.num;\n\n block.schid = schid;\n\n\n\n if (!run_ccw(schid, CCW_CMD_SET_VQ, &info, sizeof(info))) {\n\n virtio_set_status(schid, VIRTIO_CONFIG_S_DRIVER_OK);\n\n }\n\n}\n"}} {"sample_id": "57407ea44cc0a3d630b9b89a2be011f1955ce5c1_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,5 +7,5 @@\n \n \n s->nic = NULL;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void minimac2_cleanup(NetClientState *nc)\n\n{\n\n MilkymistMinimac2State *s = qemu_get_nic_opaque(nc);\n\n\n\n s->nic = NULL;\n\n}\n"}} {"sample_id": "ad2d30f79d3b0812f02c741be2189796b788d6d7_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ DPRINTF(\"Command complete tag=0x%x status=%d sense=%d\\n\",\n \n r->req.tag, status, sense);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void scsi_command_complete(SCSIDiskReq *r, int status, int sense)\n\n{\n\n DPRINTF(\"Command complete tag=0x%x status=%d sense=%d\\n\",\n\n r->req.tag, status, sense);\n\n scsi_req_set_status(r, status, sense);\n\n scsi_req_complete(&r->req);\n\n scsi_remove_request(r);\n\n}\n"}} {"sample_id": "eca1bdf415c454093dfc7eb983cd49287c043967", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+void cpu_reset(CPUM68KState *env)\n+{\n+ memset(env, 0, offsetof(CPUM68KState, breakpoints));\n #if !defined (CONFIG_USER_ONLY)\n env->sr = 0x2700;\n #endif", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void cpu_reset(CPUM68KState *env)\n{\n memset(env, 0, offsetof(CPUM68KState, breakpoints));\n#if !defined (CONFIG_USER_ONLY)\n env->sr = 0x2700;\n#endif\n m68k_switch_sp(env);\n /* ??? FP regs should be initialized to NaN. */\n env->cc_op = CC_OP_FLAGS;\n /* TODO: We should set PC from the interrupt vector. */\n env->pc = 0;\n tlb_flush(env, 1);"}} {"sample_id": "a1e985833cde3208b0f57c4c7e640b60fbc6c54d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n if (pvr == ppc_defs[i].pvr) {\n \n return &ppc_defs[i];\n+\n+ }\n+\n+ }\n+\n \n \n return NULL;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static const ppc_def_t *ppc_find_by_pvr (uint32_t pvr)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < ARRAY_SIZE(ppc_defs); i++) {\n\n /* If we have an exact match, we're done */\n\n if (pvr == ppc_defs[i].pvr) {\n\n return &ppc_defs[i];\n\n }\n\n }\n\n\n\n return NULL;\n\n}\n"}} {"sample_id": "f090c9d4ad5812fb92843d6470a1111c15190c4c_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ set_opf64(PARAM1, 0);\n+\n FORCE_RET();\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "OP(zerof64)\n\n{\n\n set_opf64(PARAM1, 0);\n\n FORCE_RET();\n\n}\n"}} {"sample_id": "f6e1c96730ebbcebbd0341329d51d3d3a36b4fa1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int ffm_is_avail_data(AVFormatContext *s, int size)\n \n {\n+\n FFMContext *ffm = s->priv_data;\n \n int64_t pos, avail_size;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int ffm_is_avail_data(AVFormatContext *s, int size)\n\n{\n\n FFMContext *ffm = s->priv_data;\n\n int64_t pos, avail_size;\n\n int len;\n\n\n\n len = ffm->packet_end - ffm->packet_ptr;\n\n if (size <= len)\n\n return 1;\n\n pos = avio_tell(s->pb);\n\n if (!ffm->write_index) {\n\n if (pos == ffm->file_size)\n\n return AVERROR_EOF;\n\n avail_size = ffm->file_size - pos;\n\n } else {\n\n if (pos == ffm->write_index) {\n\n /* exactly at the end of stream */\n\n if (ffm->server_attached)\n\n return AVERROR(EAGAIN);\n\n else\n\n return AVERROR_INVALIDDATA;\n\n } else if (pos < ffm->write_index) {\n\n avail_size = ffm->write_index - pos;\n\n } else {\n\n avail_size = (ffm->file_size - pos) + (ffm->write_index - FFM_PACKET_SIZE);\n\n }\n\n }\n\n avail_size = (avail_size / ffm->packet_size) * (ffm->packet_size - FFM_HEADER_SIZE) + len;\n\n if (size <= avail_size)\n\n return 1;\n\n else if (ffm->server_attached)\n\n return AVERROR(EAGAIN);\n\n else\n\n return AVERROR_INVALIDDATA;\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_57", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,9 +6,9 @@\n \n QEMUClockType type;\n \n+ for (type = 0; type < QEMU_CLOCK_MAX; type++) {\n+\n+ tlg->tl[type] = timerlist_new(type, cb, opaque);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void timerlistgroup_init(QEMUTimerListGroup *tlg,\n\n QEMUTimerListNotifyCB *cb, void *opaque)\n\n{\n\n QEMUClockType type;\n\n for (type = 0; type < QEMU_CLOCK_MAX; type++) {\n\n tlg->tl[type] = timerlist_new(type, cb, opaque);\n\n }\n\n}\n"}} {"sample_id": "5edea431d0616737e5a5f58cefc07ba5b2e0875f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n int av_write_frame(AVFormatContext *s, AVPacket *pkt)\n \n+{\n \n int ret;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int av_write_frame(AVFormatContext *s, AVPacket *pkt)\n\n{\n\n int ret;\n\n\n\n compute_pkt_fields2(s->streams[pkt->stream_index], pkt);\n\n \n\n truncate_ts(s->streams[pkt->stream_index], pkt);\n\n\n\n ret= s->oformat->write_packet(s, pkt);\n\n if(!ret)\n\n ret= url_ferror(&s->pb);\n\n return ret;\n\n}\n"}} {"sample_id": "4fa4ce7107c6ec432f185307158c5df91ce54308_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static ssize_t mp_pacl_getxattr(FsContext *ctx, const char *path,\n \n+ const char *name, void *value, size_t size)\n+\n {\n \n char buffer[PATH_MAX];", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ssize_t mp_pacl_getxattr(FsContext *ctx, const char *path,\n\n const char *name, void *value, size_t size)\n\n{\n\n char buffer[PATH_MAX];\n\n return lgetxattr(rpath(ctx, path, buffer), MAP_ACL_ACCESS, value, size);\n\n}\n"}} {"sample_id": "297a3646c2947ee64a6d42ca264039732c6218e0_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void visit_optional(Visitor *v, bool *present, const char *name,\n+\n Error **errp)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void visit_optional(Visitor *v, bool *present, const char *name,\n\n Error **errp)\n\n{\n\n if (!error_is_set(errp) && v->optional) {\n\n v->optional(v, present, name, errp);\n\n }\n\n}\n"}} {"sample_id": "ae100046ca32b0b83031a60d0c3cdfc5ceb9f874_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ GetByteContext gb;\n+\n+ uint8_t *data = st->codecpar->extradata;\n+\n+ int data_size = st->codecpar->extradata_size;\n \n int tag, offset;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int avi_extract_stream_metadata(AVFormatContext *s, AVStream *st)\n\n{\n\n GetByteContext gb;\n\n uint8_t *data = st->codecpar->extradata;\n\n int data_size = st->codecpar->extradata_size;\n\n int tag, offset;\n\n\n\n if (!data || data_size < 8) {\n\n return AVERROR_INVALIDDATA;\n\n }\n\n\n\n bytestream2_init(&gb, data, data_size);\n\n\n\n tag = bytestream2_get_le32(&gb);\n\n\n\n switch (tag) {\n\n case MKTAG('A', 'V', 'I', 'F'):\n\n // skip 4 byte padding\n\n bytestream2_skip(&gb, 4);\n\n offset = bytestream2_tell(&gb);\n\n bytestream2_init(&gb, data + offset, data_size - offset);\n\n\n\n // decode EXIF tags from IFD, AVI is always little-endian\n\n return avpriv_exif_decode_ifd(s, &gb, 1, 0, &st->metadata);\n\n break;\n\n case MKTAG('C', 'A', 'S', 'I'):\n\n avpriv_request_sample(s, \"RIFF stream data tag type CASI (%u)\", tag);\n\n break;\n\n case MKTAG('Z', 'o', 'r', 'a'):\n\n avpriv_request_sample(s, \"RIFF stream data tag type Zora (%u)\", tag);\n\n break;\n\n default:\n\n break;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "82cbbdc6a0958b49c77639a60906e30d02e6bb7b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n IOHandler *io_write,\n \n+ AioFlushHandler *io_flush,\n+\n+ void *opaque)\n+\n+{\n \n aio_set_fd_handler(qemu_aio_context, fd, io_read, io_write, io_flush,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_aio_set_fd_handler(int fd,\n\n IOHandler *io_read,\n\n IOHandler *io_write,\n\n AioFlushHandler *io_flush,\n\n void *opaque)\n\n{\n\n aio_set_fd_handler(qemu_aio_context, fd, io_read, io_write, io_flush,\n\n opaque);\n\n\n\n qemu_set_fd_handler2(fd, NULL, io_read, io_write, opaque);\n\n}\n"}} {"sample_id": "27a69bb088bee6d4efea254659422fb9c751b3c7_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -44,10 +44,10 @@\n \n tcg_gen_mov_i32(cpu_gpr[rD(ctx->opcode)], cpu_gprh[rB(ctx->opcode)]);\n \n+ tcg_gen_mov_i32(cpu_gprh[rD(ctx->opcode)], cpu_gpr[rA(ctx->opcode)]);\n+\n+ }\n+\n+#endif\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_evmergelohi(DisasContext *ctx)\n\n{\n\n if (unlikely(!ctx->spe_enabled)) {\n\n gen_exception(ctx, POWERPC_EXCP_APU);\n\n return;\n\n }\n\n#if defined(TARGET_PPC64)\n\n TCGv t0 = tcg_temp_new();\n\n TCGv t1 = tcg_temp_new();\n\n tcg_gen_shri_tl(t0, cpu_gpr[rB(ctx->opcode)], 32);\n\n tcg_gen_shli_tl(t1, cpu_gpr[rA(ctx->opcode)], 32);\n\n tcg_gen_or_tl(cpu_gpr[rD(ctx->opcode)], t0, t1);\n\n tcg_temp_free(t0);\n\n tcg_temp_free(t1);\n\n#else\n\n if (rD(ctx->opcode) == rA(ctx->opcode)) {\n\n TCGv_i32 tmp = tcg_temp_new_i32();\n\n tcg_gen_mov_i32(tmp, cpu_gpr[rA(ctx->opcode)]);\n\n tcg_gen_mov_i32(cpu_gpr[rD(ctx->opcode)], cpu_gprh[rB(ctx->opcode)]);\n\n tcg_gen_mov_i32(cpu_gprh[rD(ctx->opcode)], tmp);\n\n tcg_temp_free_i32(tmp);\n\n } else {\n\n tcg_gen_mov_i32(cpu_gpr[rD(ctx->opcode)], cpu_gprh[rB(ctx->opcode)]);\n\n tcg_gen_mov_i32(cpu_gprh[rD(ctx->opcode)], cpu_gpr[rA(ctx->opcode)]);\n\n }\n\n#endif\n\n}\n"}} {"sample_id": "9d5614d582d23ec96b167583557bf3f25f64f050", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,8 +5,8 @@\n assert(timer != NULL);\n \n \n+\n+\n \n ptimer_stop(timer->ptimer);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void grlib_gptimer_enable(GPTimer *timer)\n\n{\n\n assert(timer != NULL);\n\n\n\n\n\n ptimer_stop(timer->ptimer);\n\n\n\n if (!(timer->config & GPTIMER_ENABLE)) {\n\n /* Timer disabled */\n\n trace_grlib_gptimer_disabled(timer->id, timer->config);\n\n return;\n\n }\n\n\n\n /* ptimer is triggered when the counter reach 0 but GPTimer is triggered at\n\n underflow. Set count + 1 to simulate the GPTimer behavior. */\n\n\n\n trace_grlib_gptimer_enable(timer->id, timer->counter + 1);\n\n\n\n ptimer_set_count(timer->ptimer, timer->counter + 1);\n\n ptimer_run(timer->ptimer, 1);\n\n}\n"}} {"sample_id": "b563afe6fa9345a62750055998a28a3926c02334", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n &new_extradata_size);\n int jp_dualmono_size;\n const uint8_t *jp_dualmono = av_packet_get_side_data(avpkt,\n+ AV_PKT_DATA_JP_DUALMONO,\n+ &jp_dualmono_size);\n+ if (new_extradata && 0) {\n+ av_free(avctx->extradata);\n+ avctx->extradata = av_mallocz(new_extradata_size +\n FF_INPUT_BUFFER_PADDING_SIZE);\n if (!avctx->extradata)\n return AVERROR(ENOMEM);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int aac_decode_frame(AVCodecContext *avctx, void *data,\n int *got_frame_ptr, AVPacket *avpkt)\n{\n AACContext *ac = avctx->priv_data;\n const uint8_t *buf = avpkt->data;\n int buf_size = avpkt->size;\n GetBitContext gb;\n int buf_consumed;\n int buf_offset;\n int err;\n int new_extradata_size;\n const uint8_t *new_extradata = av_packet_get_side_data(avpkt,\n AV_PKT_DATA_NEW_EXTRADATA,\n &new_extradata_size);\n int jp_dualmono_size;\n const uint8_t *jp_dualmono = av_packet_get_side_data(avpkt,\n AV_PKT_DATA_JP_DUALMONO,\n &jp_dualmono_size);\n if (new_extradata && 0) {\n av_free(avctx->extradata);\n avctx->extradata = av_mallocz(new_extradata_size +\n FF_INPUT_BUFFER_PADDING_SIZE);\n if (!avctx->extradata)\n return AVERROR(ENOMEM);\n avctx->extradata_size = new_extradata_size;\n memcpy(avctx->extradata, new_extradata, new_extradata_size);\n push_output_configuration(ac);\n if (decode_audio_specific_config(ac, ac->avctx, &ac->oc[1].m4ac,\n avctx->extradata,\n avctx->extradata_size*8, 1) < 0) {\n pop_output_configuration(ac);\n }\n }\n ac->dmono_mode = 0;\n if (jp_dualmono && jp_dualmono_size > 0)\n ac->dmono_mode = 1 + *jp_dualmono;\n if (ac->force_dmono_mode >= 0)\n ac->dmono_mode = ac->force_dmono_mode;\n init_get_bits(&gb, buf, buf_size * 8);\n if ((err = aac_decode_frame_int(avctx, data, got_frame_ptr, &gb, avpkt)) < 0)\n return err;\n buf_consumed = (get_bits_count(&gb) + 7) >> 3;\n for (buf_offset = buf_consumed; buf_offset < buf_size; buf_offset++)\n if (buf[buf_offset])\n break;\n return buf_size > buf_offset ? buf_consumed : buf_size;\n}"}} {"sample_id": "48d6556dd46d4f4fac10d0f4a819e314887cd50e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n \n \n hdr->video_frame_type = avio_r8(pb);\n+\n+ hdr->audio_frame_type = avio_r8(pb);\n+\n+ hdr->pal_colors_count = avio_rl16(pb);\n+\n hdr->video_frame_size = avio_rl32(pb);\n \n hdr->audio_frame_size = avio_rl32(pb);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int cin_read_frame_header(CinDemuxContext *cin, AVIOContext *pb) {\n\n CinFrameHeader *hdr = &cin->frame_header;\n\n\n\n hdr->video_frame_type = avio_r8(pb);\n\n hdr->audio_frame_type = avio_r8(pb);\n\n hdr->pal_colors_count = avio_rl16(pb);\n\n hdr->video_frame_size = avio_rl32(pb);\n\n hdr->audio_frame_size = avio_rl32(pb);\n\n\n\n if (pb->eof_reached || pb->error)\n\n return AVERROR(EIO);\n\n\n\n if (avio_rl32(pb) != 0xAA55AA55)\n\n\n\n\n\n\n return 0;\n\n}"}} {"sample_id": "d8dccf69ff2df7014a2bb8e0e17828a820f45b27", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+int av_buffersink_get_frame_flags(AVFilterContext *ctx, AVFrame *frame, int flags)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int av_buffersink_get_frame_flags(AVFilterContext *ctx, AVFrame *frame, int flags)\n\n{\n\n BufferSinkContext *buf = ctx->priv;\n\n AVFilterLink *inlink = ctx->inputs[0];\n\n int ret;\n\n AVFrame *cur_frame;\n\n\n\n /* no picref available, fetch it from the filterchain */\n\n if (!av_fifo_size(buf->fifo)) {\n\n if (flags & AV_BUFFERSINK_FLAG_NO_REQUEST)\n\n return AVERROR(EAGAIN);\n\n if ((ret = ff_request_frame(inlink)) < 0)\n\n return ret;\n\n }\n\n\n\n if (!av_fifo_size(buf->fifo))\n\n return AVERROR(EINVAL);\n\n\n\n if (flags & AV_BUFFERSINK_FLAG_PEEK) {\n\n cur_frame = *((AVFrame **)av_fifo_peek2(buf->fifo, 0));\n\n av_frame_ref(frame, cur_frame); /* TODO check failure */\n\n } else {\n\n av_fifo_generic_read(buf->fifo, &cur_frame, sizeof(cur_frame), NULL);\n\n av_frame_move_ref(frame, cur_frame);\n\n av_frame_free(&cur_frame);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "3eae34d50fc52ff7b8367f9ade1cd189bfc1a221", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n \n \n mxf_write_generic_desc(s, st, key, size+5+12+8+8);\n+\n \n \n // audio locked", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void mxf_write_generic_sound_common(AVFormatContext *s, AVStream *st, const UID key, unsigned size)\n\n{\n\n AVIOContext *pb = s->pb;\n\n\n\n mxf_write_generic_desc(s, st, key, size+5+12+8+8);\n\n\n\n // audio locked\n\n mxf_write_local_tag(pb, 1, 0x3D02);\n\n avio_w8(pb, 1);\n\n\n\n // write audio sampling rate\n\n mxf_write_local_tag(pb, 8, 0x3D03);\n\n avio_wb32(pb, st->codec->sample_rate);\n\n avio_wb32(pb, 1);\n\n\n\n mxf_write_local_tag(pb, 4, 0x3D07);\n\n avio_wb32(pb, st->codec->channels);\n\n\n\n mxf_write_local_tag(pb, 4, 0x3D01);\n\n avio_wb32(pb, av_get_bits_per_sample(st->codec->codec_id));\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_62", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int get_uint64(QEMUFile *f, void *pv, size_t size)\n+\n+{\n \n uint64_t *v = pv;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int get_uint64(QEMUFile *f, void *pv, size_t size)\n\n{\n\n uint64_t *v = pv;\n\n qemu_get_be64s(f, v);\n\n return 0;\n\n}\n"}} {"sample_id": "747a0554ea8ad09404c1f5b80239ebd8d71b291e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,16 +4,16 @@\n \n {\n \n+ PutBitContext p;\n+\n uint8_t buf[256];\n \n+\n+\n init_put_bits(&p, buf, sizeof(buf));\n+\n+ \n+\n put_bits(&p, 1, 1); /* a, d present */\n \n put_bits(&p, 5, 20); /* nb bits */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void put_swf_matrix(ByteIOContext *pb,\n\n int a, int b, int c, int d, int tx, int ty)\n\n{\n\n PutBitContext p;\n\n uint8_t buf[256];\n\n\n\n init_put_bits(&p, buf, sizeof(buf));\n\n \n\n put_bits(&p, 1, 1); /* a, d present */\n\n put_bits(&p, 5, 20); /* nb bits */\n\n put_bits(&p, 20, a);\n\n put_bits(&p, 20, d);\n\n \n\n put_bits(&p, 1, 1); /* b, c present */\n\n put_bits(&p, 5, 20); /* nb bits */\n\n put_bits(&p, 20, c);\n\n put_bits(&p, 20, b);\n\n\n\n put_bits(&p, 5, 20); /* nb bits */\n\n put_bits(&p, 20, tx);\n\n put_bits(&p, 20, ty);\n\n\n\n flush_put_bits(&p);\n\n put_buffer(pb, buf, pbBufPtr(&p) - p.buf);\n\n}\n"}} {"sample_id": "c4e554701ec27b31b1b6396130b8bb2aaa0d4ad0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n AVFormatParameters *ap)\n \n {\n+\n+ RawDVContext *c = s->priv_data;\n+\n c->dv_demux = dv_init_demux(s);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int dv_read_header(AVFormatContext *s,\n\n AVFormatParameters *ap)\n\n{\n\n RawDVContext *c = s->priv_data;\n\n c->dv_demux = dv_init_demux(s);\n\n \n\n return c->dv_demux ? 0 : -1;\n\n}\n"}} {"sample_id": "86a6a9bf551ffa183880480b37c5836d3916687a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -65,9 +65,9 @@\n return 0;\n \n }\n+\n+ return (reventry->paddr_index << MCACHE_BUCKET_SHIFT) +\n+\n+ ((unsigned long) ptr - (unsigned long) entry->vaddr_base);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "ram_addr_t xen_ram_addr_from_mapcache(void *ptr)\n\n{\n\n MapCacheEntry *entry = NULL;\n\n MapCacheRev *reventry;\n\n hwaddr paddr_index;\n\n hwaddr size;\n\n int found = 0;\n\n\n\n QTAILQ_FOREACH(reventry, &mapcache->locked_entries, next) {\n\n if (reventry->vaddr_req == ptr) {\n\n paddr_index = reventry->paddr_index;\n\n size = reventry->size;\n\n found = 1;\n\n break;\n\n }\n\n }\n\n if (!found) {\n\n fprintf(stderr, \"%s, could not find %p\\n\", __func__, ptr);\n\n QTAILQ_FOREACH(reventry, &mapcache->locked_entries, next) {\n\n DPRINTF(\" \"TARGET_FMT_plx\" -> %p is present\\n\", reventry->paddr_index,\n\n reventry->vaddr_req);\n\n }\n\n abort();\n\n return 0;\n\n }\n\n\n\n entry = &mapcache->entry[paddr_index % mapcache->nr_buckets];\n\n while (entry && (entry->paddr_index != paddr_index || entry->size != size)) {\n\n entry = entry->next;\n\n }\n\n if (!entry) {\n\n DPRINTF(\"Trying to find address %p that is not in the mapcache!\\n\", ptr);\n\n return 0;\n\n }\n\n return (reventry->paddr_index << MCACHE_BUCKET_SHIFT) +\n\n ((unsigned long) ptr - (unsigned long) entry->vaddr_base);\n\n}\n"}} {"sample_id": "ad196a9d0c14f681f010bb4b979030ec125ba976_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -38,11 +38,11 @@\n \n if (slirp_smb_export) {\n \n+ slirp_smb(slirp_smb_export);\n+\n+ }\n+\n+#endif\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int net_slirp_init(VLANState *vlan, const char *model, const char *name,\n\n int restricted, const char *ip)\n\n{\n\n if (slirp_in_use) {\n\n /* slirp only supports a single instance so far */\n\n return -1;\n\n }\n\n if (!slirp_inited) {\n\n slirp_inited = 1;\n\n slirp_init(restricted, ip);\n\n\n\n while (slirp_redirs) {\n\n struct slirp_config_str *config = slirp_redirs;\n\n\n\n slirp_redirection(NULL, config->str);\n\n slirp_redirs = config->next;\n\n qemu_free(config);\n\n }\n\n#ifndef _WIN32\n\n if (slirp_smb_export) {\n\n slirp_smb(slirp_smb_export);\n\n }\n\n#endif\n\n }\n\n\n\n slirp_vc = qemu_new_vlan_client(vlan, model, name, NULL, slirp_receive,\n\n NULL, net_slirp_cleanup, NULL);\n\n slirp_vc->info_str[0] = '\\0';\n\n slirp_in_use = 1;\n\n return 0;\n\n}\n"}} {"sample_id": "ebcf7c3227906382205141beb2d0467f245472d1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ int count, i;\n \n \n+\n+ if (avctx->bits_per_coded_sample > 8) {\n \n av_log(avctx, AV_LOG_ERROR, \"bit_per_coded_sample > 8 not supported\\n\");\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int ff_cmap_read_palette(AVCodecContext *avctx, uint32_t *pal)\n\n{\n\n int count, i;\n\n\n\n if (avctx->bits_per_coded_sample > 8) {\n\n av_log(avctx, AV_LOG_ERROR, \"bit_per_coded_sample > 8 not supported\\n\");\n\n return AVERROR_INVALIDDATA;\n\n }\n\n\n\n count = 1 << avctx->bits_per_coded_sample;\n\n if (avctx->extradata_size < count * 3) {\n\n av_log(avctx, AV_LOG_ERROR, \"palette data underflow\\n\");\n\n return AVERROR_INVALIDDATA;\n\n }\n\n for (i=0; i < count; i++) {\n\n pal[i] = 0xFF000000 | AV_RB24( avctx->extradata + i*3 );\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "32bafa8fdd098d52fbf1102d5a5e48d29398c0aa_22", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n .device = (char *) device,\n \n+ .name = (char *) name\n+\n+ };\n+\n+ TransactionAction action = {\n \n .type = TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT_INTERNAL_SYNC,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qmp_blockdev_snapshot_internal_sync(const char *device,\n\n const char *name,\n\n Error **errp)\n\n{\n\n BlockdevSnapshotInternal snapshot = {\n\n .device = (char *) device,\n\n .name = (char *) name\n\n };\n\n TransactionAction action = {\n\n .type = TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT_INTERNAL_SYNC,\n\n .u.blockdev_snapshot_internal_sync = &snapshot,\n\n };\n\n blockdev_do_action(&action, errp);\n\n}\n"}} {"sample_id": "5d97d9d53ea1cc2c28411ad734565372ddeccc32_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int get_packetheader(NUTContext *nut, ByteIOContext *bc, int calculate_checksum)\n \n {\n+\n int64_t start, size;\n \n // start= url_ftell(bc) - 8;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int get_packetheader(NUTContext *nut, ByteIOContext *bc, int calculate_checksum)\n\n{\n\n int64_t start, size;\n\n// start= url_ftell(bc) - 8;\n\n\n\n size= get_v(bc);\n\n\n\n init_checksum(bc, calculate_checksum ? av_crc04C11DB7_update : NULL, 1);\n\n\n\n// nut->packet_start[2] = start;\n\n// nut->written_packet_size= size;\n\n\n\n return size;\n\n}\n"}} {"sample_id": "7f763a5d994bbddb50705d2e50decdf52937521f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+static int spapr_set_associativity(void *fdt, sPAPREnvironment *spapr)\n \n {\n \n+ int ret = 0, offset;\n \n+ CPUPPCState *env;\n \n char cpu_model[32];\n \n@@ -15,8 +15,8 @@\n assert(spapr->cpu_model);\n \n \n+\n+ for (env = first_cpu; env != NULL; env = env->next_cpu) {\n \n uint32_t associativity[] = {cpu_to_be32(0x5),\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int spapr_set_associativity(void *fdt, sPAPREnvironment *spapr)\n\n{\n\n int ret = 0, offset;\n\n CPUPPCState *env;\n\n char cpu_model[32];\n\n int smt = kvmppc_smt_threads();\n\n\n\n assert(spapr->cpu_model);\n\n\n\n for (env = first_cpu; env != NULL; env = env->next_cpu) {\n\n uint32_t associativity[] = {cpu_to_be32(0x5),\n\n cpu_to_be32(0x0),\n\n cpu_to_be32(0x0),\n\n cpu_to_be32(0x0),\n\n cpu_to_be32(env->numa_node),\n\n cpu_to_be32(env->cpu_index)};\n\n\n\n if ((env->cpu_index % smt) != 0) {\n\n continue;\n\n }\n\n\n\n snprintf(cpu_model, 32, \"/cpus/%s@%x\", spapr->cpu_model,\n\n env->cpu_index);\n\n\n\n offset = fdt_path_offset(fdt, cpu_model);\n\n if (offset < 0) {\n\n return offset;\n\n }\n\n\n\n ret = fdt_setprop(fdt, offset, \"ibm,associativity\", associativity,\n\n sizeof(associativity));\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "4d9ad7f793605abd9806fc932b3e04e028894565_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n uint64_t HELPER(neon_abdl_u16)(uint32_t a, uint32_t b)\n \n {\n+\n+ uint64_t tmp;\n \n+ uint64_t result;\n \n+ DO_ABD(result, a, b, uint8_t);\n \n DO_ABD(tmp, a >> 8, b >> 8, uint8_t);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "uint64_t HELPER(neon_abdl_u16)(uint32_t a, uint32_t b)\n\n{\n\n uint64_t tmp;\n\n uint64_t result;\n\n DO_ABD(result, a, b, uint8_t);\n\n DO_ABD(tmp, a >> 8, b >> 8, uint8_t);\n\n result |= tmp << 16;\n\n DO_ABD(tmp, a >> 16, b >> 16, uint8_t);\n\n result |= tmp << 32;\n\n DO_ABD(tmp, a >> 24, b >> 24, uint8_t);\n\n result |= tmp << 48;\n\n return result;\n\n}\n"}} {"sample_id": "2222e0a633070f7f3eafcc9d0e95e7f1a4e6fe36", "diff": "--- a/source.c\n+++ b/source.c\n@@ -40,11 +40,11 @@\n * elsewhere in the function as the state machine dictates.\n */\n hs->kbd.modifiers |= 1 << (hid_code & 0x0f);\n+ return;\n+ case 0xea ... 0xef:\n+ abort();\n+ default:\n+ break;\n if (keycode & (1 << 7)) {\n for (i = hs->kbd.keys - 1; i >= 0; i--) {\n if (hs->kbd.key[i] == hid_code) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void hid_keyboard_process_keycode(HIDState *hs)\n{\n uint8_t hid_code, index, key;\n int i, keycode, slot;\n if (hs->n == 0) {\n return;\n slot = hs->head & QUEUE_MASK; QUEUE_INCR(hs->head); hs->n--;\n keycode = hs->kbd.keycodes[slot];\n key = keycode & 0x7f;\n index = key | ((hs->kbd.modifiers & (1 << 8)) >> 1);\n hid_code = hid_usage_keys[index];\n hs->kbd.modifiers &= ~(1 << 8);\n switch (hid_code) {\n case 0x00:\n return;\n case 0xe0:\n assert(key == 0x1d);\n if (hs->kbd.modifiers & (1 << 9)) {\n /* The hid_codes for the 0xe1/0x1d scancode sequence are 0xe9/0xe0.\n * Here we're processing the second hid_code. By dropping bit 9\n * and setting bit 8, the scancode after 0x1d will access the\n * second half of the table.\n */\n hs->kbd.modifiers ^= (1 << 8) | (1 << 9);\n return;\n /* fall through to process Ctrl_L */\n case 0xe1 ... 0xe7:\n /* Ctrl_L/Ctrl_R, Shift_L/Shift_R, Alt_L/Alt_R, Win_L/Win_R.\n * Handle releases here, or fall through to process presses.\n */\n if (keycode & (1 << 7)) {\n hs->kbd.modifiers &= ~(1 << (hid_code & 0x0f));\n return;\n /* fall through */\n case 0xe8 ... 0xe9:\n /* USB modifiers are just 1 byte long. Bits 8 and 9 of\n * hs->kbd.modifiers implement a state machine that detects the\n * 0xe0 and 0xe1/0x1d sequences. These bits do not follow the\n * usual rules where bit 7 marks released keys; they are cleared\n * elsewhere in the function as the state machine dictates.\n */\n hs->kbd.modifiers |= 1 << (hid_code & 0x0f);\n return;\n case 0xea ... 0xef:\n abort();\n default:\n break;\n if (keycode & (1 << 7)) {\n for (i = hs->kbd.keys - 1; i >= 0; i--) {\n if (hs->kbd.key[i] == hid_code) {\n hs->kbd.key[i] = hs->kbd.key[-- hs->kbd.keys];\n hs->kbd.key[hs->kbd.keys] = 0x00;\n break;\n if (i < 0) {\n return;\n } else {\n for (i = hs->kbd.keys - 1; i >= 0; i--) {\n if (hs->kbd.key[i] == hid_code) {\n break;\n if (i < 0) {\n if (hs->kbd.keys < sizeof(hs->kbd.key)) {\n hs->kbd.key[hs->kbd.keys++] = hid_code;\n } else {\n return;"}} {"sample_id": "4af9193ae954f87225e1ba5d527f6a13e37b1e0e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n /* TODO: Check client args type */\n \n \n+\n+out:\n+\n+ QDECREF(cmd_args);\n+\n return err;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int qmp_check_client_args(const mon_cmd_t *cmd, QDict *client_args)\n\n{\n\n int flags, err;\n\n QDict *cmd_args;\n\n\n\n cmd_args = qdict_from_args_type(cmd->args_type);\n\n\n\n flags = 0;\n\n err = check_mandatory_args(cmd_args, client_args, &flags);\n\n if (err) {\n\n goto out;\n\n }\n\n\n\n /* TODO: Check client args type */\n\n\n\nout:\n\n QDECREF(cmd_args);\n\n return err;\n\n}\n"}} {"sample_id": "7b53f2940e3bf43ae50c929330a4837ca4da7a94", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int irq_cpu_hotplug_init(SCLPEvent *event)\n+\n {\n \n irq_cpu_hotplug = *qemu_allocate_irqs(trigger_signal, event, 1);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int irq_cpu_hotplug_init(SCLPEvent *event)\n\n{\n\n irq_cpu_hotplug = *qemu_allocate_irqs(trigger_signal, event, 1);\n\n return 0;\n\n}\n"}} {"sample_id": "7d61d892327d803ae43d14500601e48031b4632c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,8 +10,8 @@\n \n abi_long ret;\n \n+\n+\n if ((int)addrlen < 0) {\n \n return -TARGET_EINVAL;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static abi_long do_sendto(int fd, abi_ulong msg, size_t len, int flags,\n\n abi_ulong target_addr, socklen_t addrlen)\n\n{\n\n void *addr;\n\n void *host_msg;\n\n abi_long ret;\n\n\n\n if ((int)addrlen < 0) {\n\n return -TARGET_EINVAL;\n\n }\n\n\n\n host_msg = lock_user(VERIFY_READ, msg, len, 1);\n\n if (!host_msg)\n\n return -TARGET_EFAULT;\n\n if (fd_trans_target_to_host_data(fd)) {\n\n ret = fd_trans_target_to_host_data(fd)(host_msg, len);\n\n if (ret < 0) {\n\n unlock_user(host_msg, msg, 0);\n\n return ret;\n\n }\n\n }\n\n if (target_addr) {\n\n addr = alloca(addrlen+1);\n\n ret = target_to_host_sockaddr(fd, addr, target_addr, addrlen);\n\n if (ret) {\n\n unlock_user(host_msg, msg, 0);\n\n return ret;\n\n }\n\n ret = get_errno(safe_sendto(fd, host_msg, len, flags, addr, addrlen));\n\n } else {\n\n ret = get_errno(safe_sendto(fd, host_msg, len, flags, NULL, 0));\n\n }\n\n unlock_user(host_msg, msg, 0);\n\n return ret;\n\n}\n"}} {"sample_id": "9036de1a8ad6c565a4e5d8cd124ad8dd05e7d4d4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n {\n \n+ VLANState *vlan;\n+\n VLANClientState *vc;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void net_host_device_remove(Monitor *mon, int vlan_id, const char *device)\n\n{\n\n VLANState *vlan;\n\n VLANClientState *vc;\n\n\n\n vlan = qemu_find_vlan(vlan_id);\n\n if (!vlan) {\n\n monitor_printf(mon, \"can't find vlan %d\\n\", vlan_id);\n\n return;\n\n }\n\n\n\n for(vc = vlan->first_client; vc != NULL; vc = vc->next)\n\n if (!strcmp(vc->name, device))\n\n break;\n\n\n\n if (!vc) {\n\n monitor_printf(mon, \"can't find device %s\\n\", device);\n\n return;\n\n }\n\n qemu_del_vlan_client(vc);\n\n}\n"}} {"sample_id": "f738cfc843055238ad969782db69156929873832", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ BlockBackend *blk;\n+\n+\n+\n+ blk = g_new0(BlockBackend, 1);\n \n blk->refcnt = 1;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "BlockBackend *blk_new(uint64_t perm, uint64_t shared_perm)\n\n{\n\n BlockBackend *blk;\n\n\n\n blk = g_new0(BlockBackend, 1);\n\n blk->refcnt = 1;\n\n blk->perm = perm;\n\n blk->shared_perm = shared_perm;\n\n blk_set_enable_write_cache(blk, true);\n\n\n\n qemu_co_mutex_init(&blk->public.throttle_group_member.throttled_reqs_lock);\n\n qemu_co_queue_init(&blk->public.throttle_group_member.throttled_reqs[0]);\n\n qemu_co_queue_init(&blk->public.throttle_group_member.throttled_reqs[1]);\n\n block_acct_init(&blk->stats);\n\n\n\n notifier_list_init(&blk->remove_bs_notifiers);\n\n notifier_list_init(&blk->insert_bs_notifiers);\n\n\n\n QTAILQ_INSERT_TAIL(&block_backends, blk, link);\n\n return blk;\n\n}\n"}} {"sample_id": "19494f811a43c6bc226aa272d86300d9229224fe_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n qemu_irq get_cps_irq(MIPSCPSState *s, int pin_number)\n+\n+{\n+\n+ MIPSCPU *cpu = MIPS_CPU(first_cpu);\n \n CPUMIPSState *env = &cpu->env;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "qemu_irq get_cps_irq(MIPSCPSState *s, int pin_number)\n\n{\n\n MIPSCPU *cpu = MIPS_CPU(first_cpu);\n\n CPUMIPSState *env = &cpu->env;\n\n\n\n assert(pin_number < s->num_irq);\n\n\n\n /* TODO: return GIC pins once implemented */\n\n return env->irq[pin_number];\n\n}\n"}} {"sample_id": "741aca793623afeff1d18816f416cc65104b7ef9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,8 +3,8 @@\n ResampleContext *c= s->resample;\n \n // sample_delta += (c->ideal_dst_incr - c->dst_incr)*(int64_t)c->compensation_distance / c->ideal_dst_incr;\n+\n+ c->compensation_distance= compensation_distance;\n \n c->dst_incr = c->ideal_dst_incr - c->ideal_dst_incr * (int64_t)sample_delta / compensation_distance;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void swr_compensate(struct SwrContext *s, int sample_delta, int compensation_distance){\n\n ResampleContext *c= s->resample;\n\n// sample_delta += (c->ideal_dst_incr - c->dst_incr)*(int64_t)c->compensation_distance / c->ideal_dst_incr;\n\n c->compensation_distance= compensation_distance;\n\n c->dst_incr = c->ideal_dst_incr - c->ideal_dst_incr * (int64_t)sample_delta / compensation_distance;\n\n}\n"}} {"sample_id": "baf35cb90204d75404892aa4e52628ae7a00669b_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,16 +2,16 @@\n \n const uint8_t *buf, int nb_sectors)\n \n+{\n \n+ int async_ret;\n+\n BlockDriverAIOCB *acb;\n \n \n \n async_ret = NOT_DONE;\n+\n qemu_aio_wait_start();\n \n acb = bdrv_aio_write(bs, sector_num, buf, nb_sectors,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int bdrv_write_em(BlockDriverState *bs, int64_t sector_num,\n\n const uint8_t *buf, int nb_sectors)\n\n{\n\n int async_ret;\n\n BlockDriverAIOCB *acb;\n\n\n\n async_ret = NOT_DONE;\n\n qemu_aio_wait_start();\n\n acb = bdrv_aio_write(bs, sector_num, buf, nb_sectors,\n\n bdrv_rw_em_cb, &async_ret);\n\n if (acb == NULL) {\n\n qemu_aio_wait_end();\n\n return -1;\n\n }\n\n while (async_ret == NOT_DONE) {\n\n qemu_aio_wait();\n\n }\n\n qemu_aio_wait_end();\n\n return async_ret;\n\n}\n"}} {"sample_id": "0e830094ad0dc251613a0aa3234d9c5c397e02e6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -38,11 +38,11 @@\n if (nb_channels > INT_MAX / align ||\n \n (int64_t)nb_channels * nb_samples > (INT_MAX - (align * nb_channels)) / sample_size)\n+\n+\n+\n+\n+ line_size = planar ? FFALIGN(nb_samples * sample_size, align) :\n \n FFALIGN(nb_samples * sample_size * nb_channels, align);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int av_samples_get_buffer_size(int *linesize, int nb_channels, int nb_samples,\n\n enum AVSampleFormat sample_fmt, int align)\n\n{\n\n int line_size;\n\n int sample_size = av_get_bytes_per_sample(sample_fmt);\n\n int planar = av_sample_fmt_is_planar(sample_fmt);\n\n\n\n /* validate parameter ranges */\n\n if (!sample_size || nb_samples <= 0 || nb_channels <= 0)\n\n\n\n\n /* auto-select alignment if not specified */\n\n if (!align) {\n\n\n\n align = 1;\n\n nb_samples = FFALIGN(nb_samples, 32);\n\n }\n\n\n\n /* check for integer overflow */\n\n if (nb_channels > INT_MAX / align ||\n\n (int64_t)nb_channels * nb_samples > (INT_MAX - (align * nb_channels)) / sample_size)\n\n\n\n\n line_size = planar ? FFALIGN(nb_samples * sample_size, align) :\n\n FFALIGN(nb_samples * sample_size * nb_channels, align);\n\n if (linesize)\n\n *linesize = line_size;\n\n\n\n return planar ? line_size * nb_channels : line_size;\n\n}"}} {"sample_id": "4207117c93357347500235952ce7891688089cb1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static void akita_init(int ram_size, int vga_ram_size, int boot_device,\n+\n+ DisplayState *ds, const char **fd_filename, int snapshot,\n \n const char *kernel_filename, const char *kernel_cmdline,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void akita_init(int ram_size, int vga_ram_size, int boot_device,\n\n DisplayState *ds, const char **fd_filename, int snapshot,\n\n const char *kernel_filename, const char *kernel_cmdline,\n\n const char *initrd_filename, const char *cpu_model)\n\n{\n\n spitz_common_init(ram_size, vga_ram_size, ds, kernel_filename,\n\n kernel_cmdline, initrd_filename, akita, 0x2e8);\n\n}\n"}} {"sample_id": "3f7638ec4093100a63b18cbacd45dcd847f7c06b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n CPUState *env = _env;\n+\n+\n+\n+ if (kvm_enabled())\n \n kvm_init_vcpu(env);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_init_vcpu(void *_env)\n\n{\n\n CPUState *env = _env;\n\n\n\n if (kvm_enabled())\n\n kvm_init_vcpu(env);\n\n env->nr_cores = smp_cores;\n\n env->nr_threads = smp_threads;\n\n return;\n\n}\n"}} {"sample_id": "8417f904bad50021b432dfea12613345d9fb1f68", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n S390CPU *cpu = S390_CPU(cs);\n \n CPUS390XState *env = &cpu->env;\n+\n+\n+\n return (cs->interrupt_request & CPU_INTERRUPT_HARD) &&\n \n (env->psw.mask & PSW_MASK_EXT);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool s390_cpu_has_work(CPUState *cs)\n\n{\n\n S390CPU *cpu = S390_CPU(cs);\n\n CPUS390XState *env = &cpu->env;\n\n\n\n return (cs->interrupt_request & CPU_INTERRUPT_HARD) &&\n\n (env->psw.mask & PSW_MASK_EXT);\n\n}\n"}} {"sample_id": "e81a982aa5398269a2cc344091ffa4930bdd242f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n {\n \n+ ppc_tb_t *tb_env = cpu->env.tb_env;\n+\n+\n+\n if (tb_env->hdecr_timer != NULL) {\n \n __cpu_ppc_store_decr(cpu, &tb_env->hdecr_next, tb_env->hdecr_timer,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void _cpu_ppc_store_hdecr(PowerPCCPU *cpu, uint32_t hdecr,\n\n uint32_t value, int is_excp)\n\n{\n\n ppc_tb_t *tb_env = cpu->env.tb_env;\n\n\n\n if (tb_env->hdecr_timer != NULL) {\n\n __cpu_ppc_store_decr(cpu, &tb_env->hdecr_next, tb_env->hdecr_timer,\n\n &cpu_ppc_hdecr_excp, hdecr, value, is_excp);\n\n }\n\n}\n"}} {"sample_id": "b1424e0381a7f1c9969079eca4458d5f20bf1859", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n #ifdef HOST_WORDS_BIGENDIAN\n \n+ surface->flags = QEMU_BIG_ENDIAN_FLAG;\n+\n+#endif\n+\n+\n \n return surface;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "DisplaySurface *qemu_create_displaysurface_from(int width, int height, int bpp,\n\n int linesize, uint8_t *data)\n\n{\n\n DisplaySurface *surface = g_new0(DisplaySurface, 1);\n\n\n\n surface->pf = qemu_default_pixelformat(bpp);\n\n\n\n surface->format = qemu_pixman_get_format(&surface->pf);\n\n assert(surface->format != 0);\n\n surface->image = pixman_image_create_bits(surface->format,\n\n width, height,\n\n (void *)data, linesize);\n\n assert(surface->image != NULL);\n\n\n\n#ifdef HOST_WORDS_BIGENDIAN\n\n surface->flags = QEMU_BIG_ENDIAN_FLAG;\n\n#endif\n\n\n\n return surface;\n\n}\n"}} {"sample_id": "6573d9c63885aaf533366ab5c68318d1cf1a0fcc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n return job ? job->user_paused : 0;\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool block_job_user_paused(BlockJob *job)\n\n{\n\n return job ? job->user_paused : 0;\n\n}\n"}} {"sample_id": "d96391c1ffeb30a0afa695c86579517c69d9a889_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n target_ulong helper_rdhwr_xnp(CPUMIPSState *env)\n+\n {\n \n check_hwrena(env, 5);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "target_ulong helper_rdhwr_xnp(CPUMIPSState *env)\n\n{\n\n check_hwrena(env, 5);\n\n return (env->CP0_Config5 >> CP0C5_XNP) & 1;\n\n}\n"}} {"sample_id": "c363843a53553cbda6d42d98e8fbd165eda193fb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n while (bsf_ctx) {\n \n+ AVPacket new_pkt = *pkt;\n+\n+ ret = av_bitstream_filter_filter(bsf_ctx, enc_ctx, NULL,\n+\n+ &new_pkt.data, &new_pkt.size,\n \n pkt->data, pkt->size,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int filter_packet(void *log_ctx, AVPacket *pkt,\n\n AVFormatContext *fmt_ctx, AVBitStreamFilterContext *bsf_ctx)\n\n{\n\n AVCodecContext *enc_ctx = fmt_ctx->streams[pkt->stream_index]->codec;\n\n int ret = 0;\n\n\n\n while (bsf_ctx) {\n\n AVPacket new_pkt = *pkt;\n\n ret = av_bitstream_filter_filter(bsf_ctx, enc_ctx, NULL,\n\n &new_pkt.data, &new_pkt.size,\n\n pkt->data, pkt->size,\n\n pkt->flags & AV_PKT_FLAG_KEY);\n\n if (ret == 0 && new_pkt.data != pkt->data && new_pkt.destruct) {\n\n if ((ret = av_copy_packet(&new_pkt, pkt)) < 0)\n\n break;\n\n ret = 1;\n\n }\n\n\n\n if (ret > 0) {\n\n av_free_packet(pkt);\n\n new_pkt.buf = av_buffer_create(new_pkt.data, new_pkt.size,\n\n av_buffer_default_free, NULL, 0);\n\n if (!new_pkt.buf)\n\n break;\n\n }\n\n if (ret < 0) {\n\n av_log(log_ctx, AV_LOG_ERROR,\n\n \"Failed to filter bitstream with filter %s for stream %d in file '%s' with codec %s\\n\",\n\n bsf_ctx->filter->name, pkt->stream_index, fmt_ctx->filename,\n\n avcodec_get_name(enc_ctx->codec_id));\n\n }\n\n *pkt = new_pkt;\n\n\n\n bsf_ctx = bsf_ctx->next;\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "b8664c929437d6d079e16979c496a2db40cf2324_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,8 +6,8 @@\n \n vp8_idct_dc_add_c(dst+ 4, block[1], stride);\n \n+ vp8_idct_dc_add_c(dst+ 8, block[2], stride);\n+\n+ vp8_idct_dc_add_c(dst+12, block[3], stride);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vp8_idct_dc_add4y_c(uint8_t *dst, int16_t block[4][16], ptrdiff_t stride)\n\n{\n\n vp8_idct_dc_add_c(dst+ 0, block[0], stride);\n\n vp8_idct_dc_add_c(dst+ 4, block[1], stride);\n\n vp8_idct_dc_add_c(dst+ 8, block[2], stride);\n\n vp8_idct_dc_add_c(dst+12, block[3], stride);\n\n}\n"}} {"sample_id": "1964a397063967acc5ce71a2a24ed26e74824ee1_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n /* This is a best 1st approximation. ns to ms */\n \n+ s->expected_downtime = max_downtime/1000000;\n+\n+\n+\n+ s->cleanup_bh = qemu_bh_new(migrate_fd_cleanup, s);\n \n s->file = qemu_fopen_ops(s, &migration_file_ops);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void migrate_fd_connect(MigrationState *s)\n\n{\n\n s->state = MIG_STATE_ACTIVE;\n\n trace_migrate_set_state(MIG_STATE_ACTIVE);\n\n\n\n s->bytes_xfer = 0;\n\n /* This is a best 1st approximation. ns to ms */\n\n s->expected_downtime = max_downtime/1000000;\n\n\n\n s->cleanup_bh = qemu_bh_new(migrate_fd_cleanup, s);\n\n s->file = qemu_fopen_ops(s, &migration_file_ops);\n\n\n\n qemu_file_set_rate_limit(s->file,\n\n s->bandwidth_limit / XFER_LIMIT_RATIO);\n\n\n\n qemu_thread_create(&s->thread, migration_thread, s,\n\n QEMU_THREAD_JOINABLE);\n\n notifier_list_notify(&migration_state_notifiers, s);\n\n}\n"}} {"sample_id": "fdd26fca3ce66863e547560fbde1a444fc5d71b7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+void qtest_quit(QTestState *s)\n+\n+{\n+\n+ int status;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "void qtest_quit(QTestState *s)\n\n{\n\n int status;\n\n\n\n pid_t pid = qtest_qemu_pid(s);\n\n if (pid != -1) {\n\n kill(pid, SIGTERM);\n\n waitpid(pid, &status, 0);\n\n }\n\n\n\n\n\n\n unlink(s->pid_file);\n\n unlink(s->socket_path);\n\n unlink(s->qmp_socket_path);\n\n g_free(s->pid_file);\n\n g_free(s->socket_path);\n\n g_free(s->qmp_socket_path);\n\n\n}"}} {"sample_id": "d6b64b2b606fe0fe5f2208e84ff7a28445de666a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void tcg_prologue_init(TCGContext *s)\n {\n /* init global prologue and epilogue */\n+ s->code_buf = s->code_gen_prologue;\n+ s->code_ptr = s->code_buf;\n tcg_target_qemu_prologue(s);\n flush_icache_range((tcg_target_ulong)s->code_buf,\n (tcg_target_ulong)s->code_ptr);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void tcg_prologue_init(TCGContext *s)\n{\n /* init global prologue and epilogue */\n s->code_buf = s->code_gen_prologue;\n s->code_ptr = s->code_buf;\n tcg_target_qemu_prologue(s);\n flush_icache_range((tcg_target_ulong)s->code_buf,\n (tcg_target_ulong)s->code_ptr);"}} {"sample_id": "71d0770c4cec9f1dc04f4dadcbf7fd6c335030a9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n BlockDriverCompletionFunc *cb, void *opaque)\n {\n return bdrv_aio_rw_vector(bs, sector_num, iov, nb_sectors,\n+ cb, opaque, 0);\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "BlockDriverAIOCB *bdrv_aio_readv(BlockDriverState *bs, int64_t sector_num,\n QEMUIOVector *iov, int nb_sectors,\n BlockDriverCompletionFunc *cb, void *opaque)\n{\n return bdrv_aio_rw_vector(bs, sector_num, iov, nb_sectors,\n cb, opaque, 0);\n}"}} {"sample_id": "0cd09c3a6cc2230ba38c462fc410b4acce59eb6f_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -47,11 +47,11 @@\n \n \n if (!get_vhost_net(nc->peer)) {\n+\n+ return features;\n+\n+ }\n+\n return vhost_net_get_features(get_vhost_net(nc->peer), features);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t virtio_net_get_features(VirtIODevice *vdev, uint32_t features)\n\n{\n\n VirtIONet *n = VIRTIO_NET(vdev);\n\n NetClientState *nc = qemu_get_queue(n->nic);\n\n\n\n features |= (1 << VIRTIO_NET_F_MAC);\n\n\n\n if (!peer_has_vnet_hdr(n)) {\n\n features &= ~(0x1 << VIRTIO_NET_F_CSUM);\n\n features &= ~(0x1 << VIRTIO_NET_F_HOST_TSO4);\n\n features &= ~(0x1 << VIRTIO_NET_F_HOST_TSO6);\n\n features &= ~(0x1 << VIRTIO_NET_F_HOST_ECN);\n\n\n\n features &= ~(0x1 << VIRTIO_NET_F_GUEST_CSUM);\n\n features &= ~(0x1 << VIRTIO_NET_F_GUEST_TSO4);\n\n features &= ~(0x1 << VIRTIO_NET_F_GUEST_TSO6);\n\n features &= ~(0x1 << VIRTIO_NET_F_GUEST_ECN);\n\n }\n\n\n\n if (!peer_has_vnet_hdr(n) || !peer_has_ufo(n)) {\n\n features &= ~(0x1 << VIRTIO_NET_F_GUEST_UFO);\n\n features &= ~(0x1 << VIRTIO_NET_F_HOST_UFO);\n\n }\n\n\n\n if (!get_vhost_net(nc->peer)) {\n\n return features;\n\n }\n\n return vhost_net_get_features(get_vhost_net(nc->peer), features);\n\n}\n"}} {"sample_id": "1ec83d9a9e472f485897ac92bad9631d551a8c5b_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,10 +28,10 @@\n \n if (!ap)\n \n+ return AVERROR(ENOMEM);\n+\n+ av_dict_set(&s->picture.metadata, name, ap, AV_DICT_DONT_STRDUP_VAL);\n+\n+ return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int add_doubles_metadata(const uint8_t **buf, int count,\n\n const char *name, const char *sep,\n\n TiffContext *s)\n\n{\n\n char *ap;\n\n int i;\n\n double *dp = av_malloc(count * sizeof(double));\n\n if (!dp)\n\n return AVERROR(ENOMEM);\n\n\n\n for (i = 0; i < count; i++)\n\n dp[i] = tget_double(buf, s->le);\n\n ap = doubles2str(dp, count, sep);\n\n av_freep(&dp);\n\n if (!ap)\n\n return AVERROR(ENOMEM);\n\n av_dict_set(&s->picture.metadata, name, ap, AV_DICT_DONT_STRDUP_VAL);\n\n return 0;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_170", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n char *testname;\n \n+\n+\n+ trace_lm32_sys_memory_write(addr, value);\n+\n+\n \n addr >>= 2;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void sys_write(void *opaque, target_phys_addr_t addr,\n\n uint64_t value, unsigned size)\n\n{\n\n LM32SysState *s = opaque;\n\n char *testname;\n\n\n\n trace_lm32_sys_memory_write(addr, value);\n\n\n\n addr >>= 2;\n\n switch (addr) {\n\n case R_CTRL:\n\n qemu_system_shutdown_request();\n\n break;\n\n case R_PASSFAIL:\n\n s->regs[addr] = value;\n\n testname = (char *)s->testname;\n\n qemu_log(\"TC %-16s %s\\n\", testname, (value) ? \"FAILED\" : \"OK\");\n\n break;\n\n case R_TESTNAME:\n\n s->regs[addr] = value;\n\n copy_testname(s);\n\n break;\n\n\n\n default:\n\n error_report(\"lm32_sys: write access to unknown register 0x\"\n\n TARGET_FMT_plx, addr << 2);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "f5f601afcec6c1081128fe5a0f831788ca9f56ed", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,15 +5,15 @@\n struct sigframe *frame;\n \n abi_ulong frame_addr = env->regs[R_ESP] - 8;\n+\n+ target_sigset_t target_set;\n \n+ sigset_t set;\n \n int eax, i;\n \n \n+\n #if defined(DEBUG_SIGNAL)\n \n fprintf(stderr, \"do_sigreturn\\n\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "long do_sigreturn(CPUX86State *env)\n\n{\n\n struct sigframe *frame;\n\n abi_ulong frame_addr = env->regs[R_ESP] - 8;\n\n target_sigset_t target_set;\n\n sigset_t set;\n\n int eax, i;\n\n\n\n#if defined(DEBUG_SIGNAL)\n\n fprintf(stderr, \"do_sigreturn\\n\");\n\n#endif\n\n if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))\n\n goto badframe;\n\n /* set blocked signals */\n\n if (__get_user(target_set.sig[0], &frame->sc.oldmask))\n\n goto badframe;\n\n for(i = 1; i < TARGET_NSIG_WORDS; i++) {\n\n if (__get_user(target_set.sig[i], &frame->extramask[i - 1]))\n\n goto badframe;\n\n }\n\n\n\n target_to_host_sigset_internal(&set, &target_set);\n\n do_sigprocmask(SIG_SETMASK, &set, NULL);\n\n\n\n /* restore registers */\n\n if (restore_sigcontext(env, &frame->sc, &eax))\n\n goto badframe;\n\n unlock_user_struct(frame, frame_addr, 0);\n\n return eax;\n\n\n\nbadframe:\n\n unlock_user_struct(frame, frame_addr, 0);\n\n force_sig(TARGET_SIGSEGV);\n\n return 0;\n\n}\n"}} {"sample_id": "058bc4b57f9d6b39d9a6748b4049e1be3fde3dac_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n \n \n if (lp->ptr == PHYS_MAP_NODE_NIL) {\n+\n return;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void destroy_l2_mapping(PhysPageEntry *lp, unsigned level)\n\n{\n\n unsigned i;\n\n PhysPageEntry *p;\n\n\n\n if (lp->ptr == PHYS_MAP_NODE_NIL) {\n\n return;\n\n }\n\n\n\n p = phys_map_nodes[lp->ptr];\n\n for (i = 0; i < L2_SIZE; ++i) {\n\n if (!p[i].is_leaf) {\n\n destroy_l2_mapping(&p[i], level - 1);\n\n } else {\n\n destroy_page_desc(p[i].ptr);\n\n }\n\n }\n\n lp->is_leaf = 0;\n\n lp->ptr = PHYS_MAP_NODE_NIL;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_249", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n void pstrcpy_targphys(const char *name, target_phys_addr_t dest, int buf_size,\n \n const char *source)\n+\n+{\n+\n+ const char *nulp;\n+\n char *ptr;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void pstrcpy_targphys(const char *name, target_phys_addr_t dest, int buf_size,\n\n const char *source)\n\n{\n\n const char *nulp;\n\n char *ptr;\n\n\n\n if (buf_size <= 0) return;\n\n nulp = memchr(source, 0, buf_size);\n\n if (nulp) {\n\n rom_add_blob_fixed(name, source, (nulp - source) + 1, dest);\n\n } else {\n\n rom_add_blob_fixed(name, source, buf_size, dest);\n\n ptr = rom_ptr(dest + buf_size - 1);\n\n *ptr = 0;\n\n }\n\n}\n"}} {"sample_id": "8786db7cb96f8ce5c75c6e1e074319c9dca8d356_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static FlatRange *address_space_lookup(AddressSpace *as, AddrRange addr)\n+\n {\n \n return bsearch(&addr, as->current_map.ranges, as->current_map.nr,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static FlatRange *address_space_lookup(AddressSpace *as, AddrRange addr)\n\n{\n\n return bsearch(&addr, as->current_map.ranges, as->current_map.nr,\n\n sizeof(FlatRange), cmp_flatrange_addr);\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_41", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n const char *name = reg2str(reg);\n+\n QTestState *qtest = global_qtest;\n \n unsigned res;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline unsigned in_reg(IVState *s, enum Reg reg)\n\n{\n\n const char *name = reg2str(reg);\n\n QTestState *qtest = global_qtest;\n\n unsigned res;\n\n\n\n global_qtest = s->qtest;\n\n res = qpci_io_readl(s->dev, s->reg_base + reg);\n\n g_test_message(\"*%s -> %x\\n\", name, res);\n\n global_qtest = qtest;\n\n\n\n return res;\n\n}\n"}} {"sample_id": "5839e53bbc0fec56021d758aab7610df421ed8c8_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n \n \n+ assert((granularity & (granularity - 1)) == 0);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "BdrvDirtyBitmap *bdrv_create_dirty_bitmap(BlockDriverState *bs, int granularity,\n\n Error **errp)\n\n{\n\n int64_t bitmap_size;\n\n BdrvDirtyBitmap *bitmap;\n\n\n\n assert((granularity & (granularity - 1)) == 0);\n\n\n\n granularity >>= BDRV_SECTOR_BITS;\n\n assert(granularity);\n\n bitmap_size = bdrv_nb_sectors(bs);\n\n if (bitmap_size < 0) {\n\n error_setg_errno(errp, -bitmap_size, \"could not get length of device\");\n\n errno = -bitmap_size;\n\n return NULL;\n\n }\n\n bitmap = g_malloc0(sizeof(BdrvDirtyBitmap));\n\n bitmap->bitmap = hbitmap_alloc(bitmap_size, ffs(granularity) - 1);\n\n QLIST_INSERT_HEAD(&bs->dirty_bitmaps, bitmap, list);\n\n return bitmap;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n unsigned size)\n \n {\n+\n+ return ~(uint64_t)0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t kvm_apic_mem_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n return ~(uint64_t)0;\n\n}\n"}} {"sample_id": "897fa7cff21a98b260a5b3e73eae39273fa60272_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static uint32_t memory_region_read_thunk_n(void *_mr,\n \n+ target_phys_addr_t addr,\n+\n+ unsigned size)\n+\n+{\n \n MemoryRegion *mr = _mr;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t memory_region_read_thunk_n(void *_mr,\n\n target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n MemoryRegion *mr = _mr;\n\n uint64_t data = 0;\n\n\n\n if (!memory_region_access_valid(mr, addr, size)) {\n\n return -1U; /* FIXME: better signalling */\n\n }\n\n\n\n if (!mr->ops->read) {\n\n return mr->ops->old_mmio.read[bitops_ffsl(size)](mr->opaque, addr);\n\n }\n\n\n\n /* FIXME: support unaligned access */\n\n access_with_adjusted_size(addr + mr->offset, &data, size,\n\n mr->ops->impl.min_access_size,\n\n mr->ops->impl.max_access_size,\n\n memory_region_read_accessor, mr);\n\n\n\n return data;\n\n}\n"}} {"sample_id": "9307c4c1d93939db9b04117b654253af5113dc21_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,10 +7,10 @@\n \n \n for (i = 0; i < MAX_DISKS; i++) {\n+\n+ if (bs_table[i])\n+\n+ bdrv_commit(bs_table[i]);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void do_commit(int argc, const char **argv)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < MAX_DISKS; i++) {\n\n if (bs_table[i])\n\n bdrv_commit(bs_table[i]);\n\n }\n\n}\n"}} {"sample_id": "50833c9f7b4e1922197a8955669f8ab3589c8cef_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void put_line(uint8_t *dst, int size, int width, const int *runs)\n \n {\n+\n PutBitContext pb;\n \n int run, mode = ~0, pix_left = width, run_idx = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void put_line(uint8_t *dst, int size, int width, const int *runs)\n\n{\n\n PutBitContext pb;\n\n int run, mode = ~0, pix_left = width, run_idx = 0;\n\n\n\n init_put_bits(&pb, dst, size * 8);\n\n while (pix_left > 0) {\n\n run = runs[run_idx++];\n\n mode = ~mode;\n\n pix_left -= run;\n\n for (; run > 16; run -= 16)\n\n put_sbits(&pb, 16, mode);\n\n if (run)\n\n put_sbits(&pb, run, mode);\n\n }\n\n flush_put_bits(&pb);\n\n}\n"}} {"sample_id": "ac531cb6e542b1e61d668604adf9dc5306a948c0_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,11 +34,11 @@\n \n fail_unless(count == qdict_size(tests_dict));\n \n+\n+\n+ /* Do it again to test restarting */\n+\n+ count = 0;\n \n for (ent = qdict_first(tests_dict); ent; ent = qdict_next(tests_dict, ent)){\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "START_TEST(qdict_iterapi_test)\n\n{\n\n int count;\n\n const QDictEntry *ent;\n\n\n\n fail_unless(qdict_first(tests_dict) == NULL);\n\n\n\n qdict_put(tests_dict, \"key1\", qint_from_int(1));\n\n qdict_put(tests_dict, \"key2\", qint_from_int(2));\n\n qdict_put(tests_dict, \"key3\", qint_from_int(3));\n\n\n\n count = 0;\n\n for (ent = qdict_first(tests_dict); ent; ent = qdict_next(tests_dict, ent)){\n\n fail_unless(qdict_haskey(tests_dict, qdict_entry_key(ent)) == 1);\n\n count++;\n\n }\n\n\n\n fail_unless(count == qdict_size(tests_dict));\n\n\n\n /* Do it again to test restarting */\n\n count = 0;\n\n for (ent = qdict_first(tests_dict); ent; ent = qdict_next(tests_dict, ent)){\n\n fail_unless(qdict_haskey(tests_dict, qdict_entry_key(ent)) == 1);\n\n count++;\n\n }\n\n\n\n fail_unless(count == qdict_size(tests_dict));\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_89", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n {\n \n rdma->wr_data[idx].control_len = head->len;\n+\n+ rdma->wr_data[idx].control_curr =\n+\n rdma->wr_data[idx].control + sizeof(RDMAControlHeader);\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void qemu_rdma_move_header(RDMAContext *rdma, int idx,\n\n RDMAControlHeader *head)\n\n{\n\n rdma->wr_data[idx].control_len = head->len;\n\n rdma->wr_data[idx].control_curr =\n\n rdma->wr_data[idx].control + sizeof(RDMAControlHeader);\n\n}\n"}} {"sample_id": "a97d6fe6fbb97630d77253d20bdce78f76d01850", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n {\n \n if (xen_hvm_init() != 0) {\n+\n+ hw_error(\"xen hardware virtual machine initialisation failed\");\n+\n }\n \n pc_init_pci(args);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pc_xen_hvm_init(QEMUMachineInitArgs *args)\n\n{\n\n if (xen_hvm_init() != 0) {\n\n hw_error(\"xen hardware virtual machine initialisation failed\");\n\n }\n\n pc_init_pci(args);\n\n}\n"}} {"sample_id": "158f0545d81b2aca1c936490f80d13988616910e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n ASS *ass = &ctx->ass;\n+\n int i;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "ASSStyle *ff_ass_style_get(ASSSplitContext *ctx, const char *style)\n\n{\n\n ASS *ass = &ctx->ass;\n\n int i;\n\n\n\n if (!style || !*style)\n\n style = \"Default\";\n\n for (i=0; istyles_count; i++)\n\n if (!strcmp(ass->styles[i].name, style))\n\n return ass->styles + i;\n\n return NULL;\n\n}\n"}} {"sample_id": "f80256b7eebfbe20683b3a2b2720ad9991313761", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n array->pointer = g_realloc(array->pointer, new_size);\n \n+ if (!array->pointer)\n+\n+ return -1;\n+\n+\n array->size = new_size;\n \n array->next = index + 1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static inline int array_ensure_allocated(array_t* array, int index)\n\n{\n\n if((index + 1) * array->item_size > array->size) {\n\n int new_size = (index + 32) * array->item_size;\n\n array->pointer = g_realloc(array->pointer, new_size);\n\n if (!array->pointer)\n\n return -1;\n\n\n array->size = new_size;\n\n array->next = index + 1;\n\n }\n\n\n\n return 0;\n\n}"}} {"sample_id": "3eff1f46f08a360a4ae9f834ce9fef4c45bf6f0f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void virtio_scsi_command_complete(SCSIRequest *r, uint32_t status,\n \n size_t resid)\n+\n+{\n+\n+ VirtIOSCSIReq *req = r->hba_private;\n+\n uint8_t sense[SCSI_SENSE_BUF_SIZE];\n \n uint32_t sense_len;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_scsi_command_complete(SCSIRequest *r, uint32_t status,\n\n size_t resid)\n\n{\n\n VirtIOSCSIReq *req = r->hba_private;\n\n uint8_t sense[SCSI_SENSE_BUF_SIZE];\n\n uint32_t sense_len;\n\n\n\n if (r->io_canceled) {\n\n return;\n\n }\n\n\n\n req->resp.cmd->response = VIRTIO_SCSI_S_OK;\n\n req->resp.cmd->status = status;\n\n if (req->resp.cmd->status == GOOD) {\n\n req->resp.cmd->resid = tswap32(resid);\n\n } else {\n\n req->resp.cmd->resid = 0;\n\n sense_len = scsi_req_get_sense(r, sense, sizeof(sense));\n\n sense_len = MIN(sense_len, req->resp_size - sizeof(req->resp.cmd));\n\n memcpy(req->resp.cmd->sense, sense, sense_len);\n\n req->resp.cmd->sense_len = tswap32(sense_len);\n\n }\n\n virtio_scsi_complete_cmd_req(req);\n\n}\n"}} {"sample_id": "af7e9e74c6a62a5bcd911726a9e88d28b61490e0_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void IRQ_check(OpenPICState *opp, IRQ_queue_t *q)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void IRQ_check(OpenPICState *opp, IRQ_queue_t *q)\n\n{\n\n int next, i;\n\n int priority;\n\n\n\n next = -1;\n\n priority = -1;\n\n\n\n if (!q->pending) {\n\n /* IRQ bitmap is empty */\n\n goto out;\n\n }\n\n\n\n for (i = 0; i < opp->max_irq; i++) {\n\n if (IRQ_testbit(q, i)) {\n\n DPRINTF(\"IRQ_check: irq %d set ipvp_pr=%d pr=%d\\n\",\n\n i, IPVP_PRIORITY(opp->src[i].ipvp), priority);\n\n if (IPVP_PRIORITY(opp->src[i].ipvp) > priority) {\n\n next = i;\n\n priority = IPVP_PRIORITY(opp->src[i].ipvp);\n\n }\n\n }\n\n }\n\n\n\nout:\n\n q->next = next;\n\n q->priority = priority;\n\n}\n"}} {"sample_id": "a1e5be5c1a0c98206a1ae034d278702f5c8ef2a3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n PulseData *s = h->priv_data;\n \n+ pa_usec_t latency;\n+\n+ int neg;\n+\n+ pa_threaded_mainloop_lock(s->mainloop);\n \n pa_stream_get_latency(s->stream, &latency, &neg);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pulse_get_output_timestamp(AVFormatContext *h, int stream, int64_t *dts, int64_t *wall)\n\n{\n\n PulseData *s = h->priv_data;\n\n pa_usec_t latency;\n\n int neg;\n\n pa_threaded_mainloop_lock(s->mainloop);\n\n pa_stream_get_latency(s->stream, &latency, &neg);\n\n pa_threaded_mainloop_unlock(s->mainloop);\n\n *wall = av_gettime();\n\n *dts = s->timestamp - (neg ? -latency : latency);\n\n}\n"}} {"sample_id": "58ac321135af890b503ebe56d0d00e184779918f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n ide_transfer_stop(s);\n s->status |= BUSY_STAT;\n if (n > s->req_nb_sectors) {\n+ n = s->req_nb_sectors;\n+#if defined(DEBUG_IDE)\n+ printf(\"sector=%\" PRId64 \"\\n\", sector_num);\n+#endif\n+ s->iov.iov_base = s->io_buffer;\n s->iov.iov_len = n * BDRV_SECTOR_SIZE;\n qemu_iovec_init_external(&s->qiov, &s->iov, 1);\n bdrv_acct_start(s->bs, &s->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void ide_sector_read(IDEState *s)\n{\n int64_t sector_num;\n int n;\n s->status = READY_STAT | SEEK_STAT;\n s->error = 0; /* not needed by IDE spec, but needed by Windows */\n sector_num = ide_get_sector(s);\n n = s->nsector;\n if (n == 0) {\n ide_transfer_stop(s);\n s->status |= BUSY_STAT;\n if (n > s->req_nb_sectors) {\n n = s->req_nb_sectors;\n#if defined(DEBUG_IDE)\n printf(\"sector=%\" PRId64 \"\\n\", sector_num);\n#endif\n s->iov.iov_base = s->io_buffer;\n s->iov.iov_len = n * BDRV_SECTOR_SIZE;\n qemu_iovec_init_external(&s->qiov, &s->iov, 1);\n bdrv_acct_start(s->bs, &s->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ);\n s->pio_aiocb = bdrv_aio_readv(s->bs, sector_num, &s->qiov, n,\n ide_sector_read_cb, s);"}} {"sample_id": "5669b44de5b3b607a3a4749e0c8c5ddfd723e76b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n /* Enable protocol handling, disable format probing for bs->file */\n+\n+ flags |= BDRV_O_PROTOCOL;\n+\n+\n+\n /* Our block drivers take care to send flushes and respect unmap policy,\n \n * so we can enable both unconditionally on lower layers. */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int bdrv_inherited_flags(int flags)\n\n{\n\n /* Enable protocol handling, disable format probing for bs->file */\n\n flags |= BDRV_O_PROTOCOL;\n\n\n\n /* Our block drivers take care to send flushes and respect unmap policy,\n\n * so we can enable both unconditionally on lower layers. */\n\n flags |= BDRV_O_CACHE_WB | BDRV_O_UNMAP;\n\n\n\n /* The backing file of a temporary snapshot is read-only */\n\n if (flags & BDRV_O_SNAPSHOT) {\n\n flags &= ~BDRV_O_RDWR;\n\n }\n\n\n\n /* Clear flags that only apply to the top layer */\n\n flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING);\n\n\n\n return flags;\n\n}\n"}} {"sample_id": "db486cc334aafd3dbdaf107388e37fc3d6d3e171_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,28 +1,28 @@\n GList *range_list_insert(GList *list, Range *data)\n+\n+{\n+\n+ GList *l, *next = NULL;\n+\n Range *r, *nextr;\n+\n+\n+\n+ if (!list) {\n+\n+ list = g_list_insert_sorted(list, data, range_compare);\n+\n+ return list;\n+\n+ }\n \n+\n \n nextr = data;\n+\n l = list;\n \n+ while (l && l != next && nextr) {\n \n r = l->data;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "GList *range_list_insert(GList *list, Range *data)\n\n{\n\n GList *l, *next = NULL;\n\n Range *r, *nextr;\n\n\n\n if (!list) {\n\n list = g_list_insert_sorted(list, data, range_compare);\n\n return list;\n\n }\n\n\n\n nextr = data;\n\n l = list;\n\n while (l && l != next && nextr) {\n\n r = l->data;\n\n if (ranges_can_merge(r, nextr)) {\n\n range_merge(r, nextr);\n\n l = g_list_remove_link(l, next);\n\n next = g_list_next(l);\n\n if (next) {\n\n nextr = next->data;\n\n } else {\n\n nextr = NULL;\n\n }\n\n } else {\n\n l = g_list_next(l);\n\n }\n\n }\n\n\n\n if (!l) {\n\n list = g_list_insert_sorted(list, data, range_compare);\n\n }\n\n\n\n return list;\n\n}\n"}} {"sample_id": "dcc39ee10e82833ce24aa57926c00ffeb1948198_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,10 +34,10 @@\n \n else\n \n+ pix_fmts = mpeg12_pixfmt_list_444;\n+\n+\n+\n+ return ff_get_format(avctx, pix_fmts);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static enum AVPixelFormat mpeg_get_pixelformat(AVCodecContext *avctx)\n\n{\n\n Mpeg1Context *s1 = avctx->priv_data;\n\n MpegEncContext *s = &s1->mpeg_enc_ctx;\n\n const enum AVPixelFormat *pix_fmts;\n\n\n\n#if FF_API_XVMC\n\nFF_DISABLE_DEPRECATION_WARNINGS\n\n if (avctx->xvmc_acceleration)\n\n return ff_get_format(avctx, pixfmt_xvmc_mpg2_420);\n\nFF_ENABLE_DEPRECATION_WARNINGS\n\n#endif /* FF_API_XVMC */\n\n\n\n if (s->chroma_format < 2)\n\n pix_fmts = mpeg12_hwaccel_pixfmt_list_420;\n\n else if (s->chroma_format == 2)\n\n pix_fmts = mpeg12_pixfmt_list_422;\n\n else\n\n pix_fmts = mpeg12_pixfmt_list_444;\n\n\n\n return ff_get_format(avctx, pix_fmts);\n\n}\n"}} {"sample_id": "2e664b9c1e73c80aab91070c1eb7676f04bdd12d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n PerThreadContext *p;\n \n+ atomic_int *progress = f->progress ? (atomic_int*)f->progress->data : NULL;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "void ff_thread_report_progress(ThreadFrame *f, int n, int field)\n\n{\n\n PerThreadContext *p;\n\n atomic_int *progress = f->progress ? (atomic_int*)f->progress->data : NULL;\n\n\n\n if (!progress ||\n\n atomic_load_explicit(&progress[field], memory_order_relaxed) >= n)\n\n return;\n\n\n\n p = f->owner[field]->internal->thread_ctx;\n\n\n\n if (f->owner[field]->debug&FF_DEBUG_THREADS)\n\n av_log(f->owner[field], AV_LOG_DEBUG,\n\n \"%p finished %d field %d\\n\", progress, n, field);\n\n\n\n pthread_mutex_lock(&p->progress_mutex);\n\n\n\n atomic_store_explicit(&progress[field], n, memory_order_release);\n\n\n\n pthread_cond_broadcast(&p->progress_cond);\n\n pthread_mutex_unlock(&p->progress_mutex);\n\n}\n"}} {"sample_id": "5fb6c7a8b26eab1a22207d24b4784bd2b39ab54b_19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n if (!gnutls_record_get_direction(vs->tls_session))\n \n qemu_set_fd_handler(vs->csock, vnc_handshake_io, NULL, vs);\n+\n+ else\n+\n+ qemu_set_fd_handler(vs->csock, NULL, vnc_handshake_io, vs);\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int vnc_continue_handshake(struct VncState *vs) {\n\n int ret;\n\n\n\n if ((ret = gnutls_handshake(vs->tls_session)) < 0) {\n\n if (!gnutls_error_is_fatal(ret)) {\n\n VNC_DEBUG(\"Handshake interrupted (blocking)\\n\");\n\n if (!gnutls_record_get_direction(vs->tls_session))\n\n qemu_set_fd_handler(vs->csock, vnc_handshake_io, NULL, vs);\n\n else\n\n qemu_set_fd_handler(vs->csock, NULL, vnc_handshake_io, vs);\n\n return 0;\n\n }\n\n VNC_DEBUG(\"Handshake failed %s\\n\", gnutls_strerror(ret));\n\n vnc_client_error(vs);\n\n return -1;\n\n }\n\n\n\n if (vs->vd->x509verify) {\n\n\tif (vnc_validate_certificate(vs) < 0) {\n\n\t VNC_DEBUG(\"Client verification failed\\n\");\n\n\t vnc_client_error(vs);\n\n\t return -1;\n\n\t} else {\n\n\t VNC_DEBUG(\"Client verification passed\\n\");\n\n\t}\n\n }\n\n\n\n VNC_DEBUG(\"Handshake done, switching to TLS data mode\\n\");\n\n vs->wiremode = VNC_WIREMODE_TLS;\n\n qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);\n\n\n\n return start_auth_vencrypt_subauth(vs);\n\n}\n"}} {"sample_id": "245f7b51c0ea04fb2224b1127430a096c91aee70_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n break;\n \n+ }\n+\n+ } else {\n+\n+ switch (vs->ds->surface->pf.bits_per_pixel) {\n \n case 8:\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void vnc_hextile_set_pixel_conversion(VncState *vs, int generic)\n\n{\n\n if (!generic) {\n\n switch (vs->ds->surface->pf.bits_per_pixel) {\n\n case 8:\n\n vs->send_hextile_tile = send_hextile_tile_8;\n\n break;\n\n case 16:\n\n vs->send_hextile_tile = send_hextile_tile_16;\n\n break;\n\n case 32:\n\n vs->send_hextile_tile = send_hextile_tile_32;\n\n break;\n\n }\n\n } else {\n\n switch (vs->ds->surface->pf.bits_per_pixel) {\n\n case 8:\n\n vs->send_hextile_tile = send_hextile_tile_generic_8;\n\n break;\n\n case 16:\n\n vs->send_hextile_tile = send_hextile_tile_generic_16;\n\n break;\n\n case 32:\n\n vs->send_hextile_tile = send_hextile_tile_generic_32;\n\n break;\n\n }\n\n }\n\n}\n"}} {"sample_id": "a8ff69ce2bad1c4bb043e88ea35f5ab5691d4f3c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n put_bits(&pb, 1, w->per_mb_rl_bit=1);\n \n put_bits(&pb, 3, code=1);\n+\n+\n+\n+ flush_put_bits(&pb);\n+\n \n \n s->slice_height = s->mb_height / code;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int encode_ext_header(Wmv2Context *w){\n\n MpegEncContext * const s= &w->s;\n\n PutBitContext pb;\n\n int code;\n\n\n\n init_put_bits(&pb, s->avctx->extradata, s->avctx->extradata_size);\n\n\n\n put_bits(&pb, 5, s->avctx->time_base.den / s->avctx->time_base.num); //yes 29.97 -> 29\n\n put_bits(&pb, 11, FFMIN(s->bit_rate/1024, 2047));\n\n\n\n put_bits(&pb, 1, w->mspel_bit=1);\n\n put_bits(&pb, 1, w->flag3=1);\n\n put_bits(&pb, 1, w->abt_flag=1);\n\n put_bits(&pb, 1, w->j_type_bit=1);\n\n put_bits(&pb, 1, w->top_left_mv_flag=0);\n\n put_bits(&pb, 1, w->per_mb_rl_bit=1);\n\n put_bits(&pb, 3, code=1);\n\n\n\n flush_put_bits(&pb);\n\n\n\n s->slice_height = s->mb_height / code;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "32bafa8fdd098d52fbf1102d5a5e48d29398c0aa_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n .port = NULL, /* Filled in later */\n \n };\n+\n+\n+\n+ test_io_channel(async, listen_addr, connect_addr, false);\n+\n \n \n qapi_free_SocketAddress(listen_addr);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_io_channel_ipv6(bool async)\n\n{\n\n SocketAddress *listen_addr = g_new0(SocketAddress, 1);\n\n SocketAddress *connect_addr = g_new0(SocketAddress, 1);\n\n\n\n listen_addr->type = SOCKET_ADDRESS_KIND_INET;\n\n listen_addr->u.inet = g_new(InetSocketAddress, 1);\n\n *listen_addr->u.inet = (InetSocketAddress) {\n\n .host = g_strdup(\"::1\"),\n\n .port = NULL, /* Auto-select */\n\n };\n\n\n\n connect_addr->type = SOCKET_ADDRESS_KIND_INET;\n\n connect_addr->u.inet = g_new(InetSocketAddress, 1);\n\n *connect_addr->u.inet = (InetSocketAddress) {\n\n .host = g_strdup(\"::1\"),\n\n .port = NULL, /* Filled in later */\n\n };\n\n\n\n test_io_channel(async, listen_addr, connect_addr, false);\n\n\n\n qapi_free_SocketAddress(listen_addr);\n\n qapi_free_SocketAddress(connect_addr);\n\n}\n"}} {"sample_id": "24fa90499f8b24bcba2960a3316d797f9b80b5e9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n void qemu_mutex_init(QemuMutex *mutex)\n \n+{\n+\n+ int err;\n+\n+ pthread_mutexattr_t mutexattr;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void qemu_mutex_init(QemuMutex *mutex)\n\n{\n\n int err;\n\n pthread_mutexattr_t mutexattr;\n\n\n\n pthread_mutexattr_init(&mutexattr);\n\n pthread_mutexattr_settype(&mutexattr, PTHREAD_MUTEX_ERRORCHECK);\n\n err = pthread_mutex_init(&mutex->lock, &mutexattr);\n\n pthread_mutexattr_destroy(&mutexattr);\n\n if (err)\n\n error_exit(err, __func__);\n\n}\n"}} {"sample_id": "a32354e206895400d17c3de9a8df1de96d3df289_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n uint32_t value)\n \n+{\n \n m5206_mbar_state *s = (m5206_mbar_state *)opaque;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void m5206_mbar_writeb(void *opaque, target_phys_addr_t offset,\n\n uint32_t value)\n\n{\n\n m5206_mbar_state *s = (m5206_mbar_state *)opaque;\n\n int width;\n\n offset &= 0x3ff;\n\n if (offset > 0x200) {\n\n hw_error(\"Bad MBAR write offset 0x%x\", (int)offset);\n\n }\n\n width = m5206_mbar_width[offset >> 2];\n\n if (width > 1) {\n\n uint32_t tmp;\n\n tmp = m5206_mbar_readw(opaque, offset & ~1);\n\n if (offset & 1) {\n\n tmp = (tmp & 0xff00) | value;\n\n } else {\n\n tmp = (tmp & 0x00ff) | (value << 8);\n\n }\n\n m5206_mbar_writew(opaque, offset & ~1, tmp);\n\n return;\n\n }\n\n m5206_mbar_write(s, offset, value, 1);\n\n}\n"}} {"sample_id": "c88d6bded69804617f412a60c7375cc93f8687a5_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n int i;\n \n \n+\n+ switch (offset) {\n+\n+ case MP_PIT_TIMER1_LENGTH ... MP_PIT_TIMER4_LENGTH:\n+\n t = &s->timer[offset >> 2];\n \n t->limit = value;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void mv88w8618_pit_write(void *opaque, target_phys_addr_t offset,\n\n uint32_t value)\n\n{\n\n mv88w8618_pit_state *s = opaque;\n\n mv88w8618_timer_state *t;\n\n int i;\n\n\n\n switch (offset) {\n\n case MP_PIT_TIMER1_LENGTH ... MP_PIT_TIMER4_LENGTH:\n\n t = &s->timer[offset >> 2];\n\n t->limit = value;\n\n ptimer_set_limit(t->ptimer, t->limit, 1);\n\n break;\n\n\n\n case MP_PIT_CONTROL:\n\n for (i = 0; i < 4; i++) {\n\n if (value & 0xf) {\n\n t = &s->timer[i];\n\n ptimer_set_limit(t->ptimer, t->limit, 0);\n\n ptimer_set_freq(t->ptimer, t->freq);\n\n ptimer_run(t->ptimer, 0);\n\n }\n\n value >>= 4;\n\n }\n\n break;\n\n\n\n case MP_BOARD_RESET:\n\n if (value == MP_BOARD_RESET_MAGIC) {\n\n qemu_system_reset_request();\n\n }\n\n break;\n\n }\n\n}\n"}} {"sample_id": "9561fda8d90e176bef598ba87c42a1bd6ad03ef7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n \n \n if (qdev_hotplug) {\n+\n assert(bus->allow_hotplug);\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void bus_add_child(BusState *bus, DeviceState *child)\n\n{\n\n char name[32];\n\n BusChild *kid = g_malloc0(sizeof(*kid));\n\n\n\n if (qdev_hotplug) {\n\n assert(bus->allow_hotplug);\n\n }\n\n\n\n kid->index = bus->max_index++;\n\n kid->child = child;\n\n object_ref(OBJECT(kid->child));\n\n\n\n QTAILQ_INSERT_HEAD(&bus->children, kid, sibling);\n\n\n\n /* This transfers ownership of kid->child to the property. */\n\n snprintf(name, sizeof(name), \"child[%d]\", kid->index);\n\n object_property_add_link(OBJECT(bus), name,\n\n object_get_typename(OBJECT(child)),\n\n (Object **)&kid->child,\n\n NULL);\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_106", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n if (new_len <= qsb->size) {\n+\n+ qsb->used = new_len;\n+\n+ } else {\n \n qsb->used = qsb->size;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "size_t qsb_set_length(QEMUSizedBuffer *qsb, size_t new_len)\n\n{\n\n if (new_len <= qsb->size) {\n\n qsb->used = new_len;\n\n } else {\n\n qsb->used = qsb->size;\n\n }\n\n return qsb->used;\n\n}\n"}} {"sample_id": "21ef45d71221b4577330fe3aacfb06afad91ad46_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n void vnc_display_init(DisplayState *ds)\n \n+{\n+\n+ VncDisplay *vs = g_malloc0(sizeof(*vs));\n \n \n \n@@ -14,8 +14,8 @@\n \n dcl->idle = 1;\n \n+ vnc_display = vs;\n+\n \n \n vs->lsock = -1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void vnc_display_init(DisplayState *ds)\n\n{\n\n VncDisplay *vs = g_malloc0(sizeof(*vs));\n\n\n\n dcl = g_malloc0(sizeof(DisplayChangeListener));\n\n\n\n ds->opaque = vs;\n\n dcl->idle = 1;\n\n vnc_display = vs;\n\n\n\n vs->lsock = -1;\n\n#ifdef CONFIG_VNC_WS\n\n vs->lwebsock = -1;\n\n#endif\n\n\n\n vs->ds = ds;\n\n QTAILQ_INIT(&vs->clients);\n\n vs->expires = TIME_MAX;\n\n\n\n if (keyboard_layout)\n\n vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);\n\n else\n\n vs->kbd_layout = init_keyboard_layout(name2keysym, \"en-us\");\n\n\n\n if (!vs->kbd_layout)\n\n exit(1);\n\n\n\n qemu_mutex_init(&vs->mutex);\n\n vnc_start_worker_thread();\n\n\n\n dcl->ops = &dcl_ops;\n\n register_displaychangelistener(ds, dcl);\n\n}\n"}} {"sample_id": "088eca28164c8cd3b72b0c3d3f9e3fe5ee5cb28f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static inline int available_samples(AVFrame *out)\n \n+{\n \n int bytes_per_sample = av_get_bytes_per_sample(out->format);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline int available_samples(AVFrame *out)\n\n{\n\n int bytes_per_sample = av_get_bytes_per_sample(out->format);\n\n int samples = out->linesize[0] / bytes_per_sample;\n\n\n\n if (av_sample_fmt_is_planar(out->format)) {\n\n return samples;\n\n } else {\n\n int channels = av_get_channel_layout_nb_channels(out->channel_layout);\n\n return samples / channels;\n\n }\n\n}\n"}} {"sample_id": "22f15f5735389e992ec9aed43b0680e75746b3a1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n \n \n while (band < num_bands) {\n+\n+ band_type = get_bits(gb, 4);\n+\n+ run_len = 1;\n+\n do {\n \n run = get_bits(gb, bits_per_sect);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int on2avc_decode_band_types(On2AVCContext *c, GetBitContext *gb)\n\n{\n\n int bits_per_sect = c->is_long ? 5 : 3;\n\n int esc_val = (1 << bits_per_sect) - 1;\n\n int num_bands = c->num_bands * c->num_windows;\n\n int band = 0, i, band_type, run_len, run;\n\n\n\n while (band < num_bands) {\n\n band_type = get_bits(gb, 4);\n\n run_len = 1;\n\n do {\n\n run = get_bits(gb, bits_per_sect);\n\n run_len += run;\n\n } while (run == esc_val);\n\n if (band + run_len > num_bands) {\n\n av_log(c->avctx, AV_LOG_ERROR, \"Invalid band type run\\n\");\n\n return AVERROR_INVALIDDATA;\n\n }\n\n for (i = band; i < band + run_len; i++) {\n\n c->band_type[i] = band_type;\n\n c->band_run_end[i] = band + run_len;\n\n }\n\n band += run_len;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "02a08fef079469c005d48fe2d181f0e0eb5752ae", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n Error **errp)\n \n+{\n+\n+ s->get_error = socket_errno;\n+\n+ s->write = socket_write;\n \n s->close = tcp_close;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int tcp_start_outgoing_migration(MigrationState *s, const char *host_port,\n\n Error **errp)\n\n{\n\n s->get_error = socket_errno;\n\n s->write = socket_write;\n\n s->close = tcp_close;\n\n\n\n s->fd = inet_connect(host_port, false, errp);\n\n\n\n if (!error_is_set(errp)) {\n\n migrate_fd_connect(s);\n\n } else if (error_is_type(*errp, QERR_SOCKET_CONNECT_IN_PROGRESS)) {\n\n DPRINTF(\"connect in progress\\n\");\n\n qemu_set_fd_handler2(s->fd, NULL, NULL, tcp_wait_for_connect, s);\n\n } else if (error_is_type(*errp, QERR_SOCKET_CREATE_FAILED)) {\n\n DPRINTF(\"connect failed\\n\");\n\n return -1;\n\n } else if (error_is_type(*errp, QERR_SOCKET_CONNECT_FAILED)) {\n\n DPRINTF(\"connect failed\\n\");\n\n migrate_fd_error(s);\n\n return -1;\n\n } else {\n\n DPRINTF(\"unknown error\\n\");\n\n return -1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "cd3b29b745b0ff393b2d37317837bc726b8dacc8_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n {\n \n+ TCGMemOp opc = get_memop(oi);\n+\n #ifdef CONFIG_SOFTMMU\n \n unsigned mem_index = get_mmuidx(oi);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void tcg_out_qemu_st(TCGContext* s, TCGReg data_reg, TCGReg addr_reg,\n\n TCGMemOpIdx oi)\n\n{\n\n TCGMemOp opc = get_memop(oi);\n\n#ifdef CONFIG_SOFTMMU\n\n unsigned mem_index = get_mmuidx(oi);\n\n tcg_insn_unit *label_ptr;\n\n TCGReg base_reg;\n\n\n\n base_reg = tcg_out_tlb_read(s, addr_reg, opc, mem_index, 0);\n\n\n\n label_ptr = s->code_ptr + 1;\n\n tcg_out_insn(s, RI, BRC, S390_CC_NE, 0);\n\n\n\n tcg_out_qemu_st_direct(s, opc, data_reg, base_reg, TCG_REG_R2, 0);\n\n\n\n add_qemu_ldst_label(s, 0, oi, data_reg, addr_reg, s->code_ptr, label_ptr);\n\n#else\n\n TCGReg index_reg;\n\n tcg_target_long disp;\n\n\n\n tcg_prepare_user_ldst(s, &addr_reg, &index_reg, &disp);\n\n tcg_out_qemu_st_direct(s, opc, data_reg, addr_reg, index_reg, disp);\n\n#endif\n\n}\n"}} {"sample_id": "e1c57ab86f3c4ea6532b51cfecf32770b45f5e7a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n memory_region_init(mr, owner, name, size);\n \n+ mr->ram = true;\n+\n+ mr->terminates = true;\n+\n+ mr->destructor = memory_region_destructor_ram;\n \n mr->ram_addr = qemu_ram_alloc(size, mr);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void memory_region_init_ram(MemoryRegion *mr,\n\n Object *owner,\n\n const char *name,\n\n uint64_t size)\n\n{\n\n memory_region_init(mr, owner, name, size);\n\n mr->ram = true;\n\n mr->terminates = true;\n\n mr->destructor = memory_region_destructor_ram;\n\n mr->ram_addr = qemu_ram_alloc(size, mr);\n\n}\n"}} {"sample_id": "68f8d33becbd73b4d0aa277f472a6e8e72ea6849", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n if(v){\n \n const int a= FFABS(v);\n+\n+ const int e= av_log2(a);\n+\n+ put_rac(c, state+0, 0);\n+\n \n \n assert(e<=9);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void put_symbol_inline(RangeCoder *c, uint8_t *state, int v, int is_signed){\n\n int i;\n\n\n\n if(v){\n\n const int a= FFABS(v);\n\n const int e= av_log2(a);\n\n put_rac(c, state+0, 0);\n\n\n\n assert(e<=9);\n\n\n\n for(i=0; i=0; i--){\n\n put_rac(c, state+22+i, (a>>i)&1); //22..31\n\n }\n\n\n\n if(is_signed)\n\n put_rac(c, state+11 + e, v < 0); //11..21\n\n }else{\n\n put_rac(c, state+0, 1);\n\n }\n\n}\n"}} {"sample_id": "e4f4fb1eca795e36f363b4647724221e774523c1_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n dc->realize = spapr_phb_realize;\n \n+ dc->props = spapr_phb_properties;\n+\n+ dc->reset = spapr_phb_reset;\n+\n+ dc->vmsd = &vmstate_spapr_pci;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void spapr_phb_class_init(ObjectClass *klass, void *data)\n\n{\n\n PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n HotplugHandlerClass *hp = HOTPLUG_HANDLER_CLASS(klass);\n\n\n\n hc->root_bus_path = spapr_phb_root_bus_path;\n\n dc->realize = spapr_phb_realize;\n\n dc->props = spapr_phb_properties;\n\n dc->reset = spapr_phb_reset;\n\n dc->vmsd = &vmstate_spapr_pci;\n\n\n\n set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);\n\n hp->plug = spapr_phb_hot_plug_child;\n\n hp->unplug = spapr_phb_hot_unplug_child;\n\n}"}} {"sample_id": "85f94f868fcd868f0f605e9d3c1ad6351c557190_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n if (is_graphic_console() &&\n \n (kbd_mouse_is_absolute() || absolute_enabled)) {\n+\n+ max_x = real_screen->w - 1;\n+\n+ max_y = real_screen->h - 1;\n+\n if (gui_grab && (ev->motion.x == 0 || ev->motion.y == 0 ||\n \n ev->motion.x == max_x || ev->motion.y == max_y)) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void handle_mousemotion(DisplayState *ds, SDL_Event *ev)\n\n{\n\n int max_x, max_y;\n\n\n\n if (is_graphic_console() &&\n\n (kbd_mouse_is_absolute() || absolute_enabled)) {\n\n max_x = real_screen->w - 1;\n\n max_y = real_screen->h - 1;\n\n if (gui_grab && (ev->motion.x == 0 || ev->motion.y == 0 ||\n\n ev->motion.x == max_x || ev->motion.y == max_y)) {\n\n sdl_grab_end();\n\n }\n\n if (!gui_grab && SDL_GetAppState() & SDL_APPINPUTFOCUS &&\n\n (ev->motion.x > 0 && ev->motion.x < max_x &&\n\n ev->motion.y > 0 && ev->motion.y < max_y)) {\n\n sdl_grab_start();\n\n }\n\n }\n\n if (gui_grab || kbd_mouse_is_absolute() || absolute_enabled) {\n\n sdl_send_mouse_event(ev->motion.xrel, ev->motion.yrel, 0,\n\n ev->motion.x, ev->motion.y, ev->motion.state);\n\n }\n\n}\n"}} {"sample_id": "120119225a5363f89822addb472085631d2157bc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n int avfilter_default_query_formats(AVFilterContext *ctx)\n+\n {\n \n enum AVMediaType type = ctx->inputs [0] ? ctx->inputs [0]->type :", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-89", "target_file": "source.c", "files": {"source.c": "int avfilter_default_query_formats(AVFilterContext *ctx)\n\n{\n\n enum AVMediaType type = ctx->inputs [0] ? ctx->inputs [0]->type :\n\n ctx->outputs[0] ? ctx->outputs[0]->type :\n\n AVMEDIA_TYPE_VIDEO;\n\n\n\n avfilter_set_common_formats(ctx, avfilter_all_formats(type));\n\n return 0;\n\n}\n"}} {"sample_id": "58ac321135af890b503ebe56d0d00e184779918f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,10 +2,10 @@\n {\n int64_t sector_num;\n int n;\n+ s->status = READY_STAT | SEEK_STAT | BUSY_STAT;\n+ sector_num = ide_get_sector(s);\n+#if defined(DEBUG_IDE)\n+ printf(\"sector=%\" PRId64 \"\\n\", sector_num);\n #endif\n n = s->nsector;\n if (n > s->req_nb_sectors) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void ide_sector_write(IDEState *s)\n{\n int64_t sector_num;\n int n;\n s->status = READY_STAT | SEEK_STAT | BUSY_STAT;\n sector_num = ide_get_sector(s);\n#if defined(DEBUG_IDE)\n printf(\"sector=%\" PRId64 \"\\n\", sector_num);\n#endif\n n = s->nsector;\n if (n > s->req_nb_sectors) {\n n = s->req_nb_sectors;\n s->iov.iov_base = s->io_buffer;\n s->iov.iov_len = n * BDRV_SECTOR_SIZE;\n qemu_iovec_init_external(&s->qiov, &s->iov, 1);\n bdrv_acct_start(s->bs, &s->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ);\n s->pio_aiocb = bdrv_aio_writev(s->bs, sector_num, &s->qiov, n,\n ide_sector_write_cb, s);"}} {"sample_id": "46e407554968e7258c874f4caf517172ffa285cf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n int i, b, c_idx = 0;\n int16_t *dst = (int16_t *)_dst;\n+ DiracGolombLUT *future[4], *l = &lut_ctx[2*LUT_SIZE + buf[0]];\n+ INIT_RESIDUE(res);\n+ for (b = 1; b <= bytes; b++) {\n+ future[0] = &lut_ctx[buf[b]];\n+ future[1] = future[0] + 1*LUT_SIZE;\n future[2] = future[0] + 2*LUT_SIZE;\n future[3] = future[0] + 3*LUT_SIZE;\n if ((c_idx + 1) > coeffs)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int ff_dirac_golomb_read_16bit(DiracGolombLUT *lut_ctx, const uint8_t *buf,\n int bytes, uint8_t *_dst, int coeffs)\n{\n int i, b, c_idx = 0;\n int16_t *dst = (int16_t *)_dst;\n DiracGolombLUT *future[4], *l = &lut_ctx[2*LUT_SIZE + buf[0]];\n INIT_RESIDUE(res);\n for (b = 1; b <= bytes; b++) {\n future[0] = &lut_ctx[buf[b]];\n future[1] = future[0] + 1*LUT_SIZE;\n future[2] = future[0] + 2*LUT_SIZE;\n future[3] = future[0] + 3*LUT_SIZE;\n if ((c_idx + 1) > coeffs)\n return c_idx;\n if (res_bits && l->sign) {\n int32_t coeff = 1;\n APPEND_RESIDUE(res, l->preamble);\n for (i = 0; i < (res_bits >> 1) - 1; i++) {\n coeff <<= 1;\n coeff |= (res >> (RSIZE_BITS - 2*i - 2)) & 1;\n }\n dst[c_idx++] = l->sign * (coeff - 1);\n }\n for (i = 0; i < LUT_BITS; i++)\n dst[c_idx + i] = l->ready[i];\n c_idx += l->ready_num;\n APPEND_RESIDUE(res, l->leftover);\n l = future[l->need_s ? 3 : !res_bits ? 2 : res_bits & 1];\n }\n return c_idx;\n}"}} {"sample_id": "9745807191a81c45970f780166f44a7f93b18653_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n static void gen_div(DisasContext *dc, TCGv dest, TCGv srca, TCGv srcb)\n+\n {\n+\n+ TCGv sr_ov = tcg_temp_new();\n \n TCGv t0 = tcg_temp_new();\n+\n+\n+\n tcg_gen_setcondi_tl(TCG_COND_EQ, sr_ov, srcb, 0);\n \n /* The result of divide-by-zero is undefined.", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_div(DisasContext *dc, TCGv dest, TCGv srca, TCGv srcb)\n\n{\n\n TCGv sr_ov = tcg_temp_new();\n\n TCGv t0 = tcg_temp_new();\n\n\n\n tcg_gen_setcondi_tl(TCG_COND_EQ, sr_ov, srcb, 0);\n\n /* The result of divide-by-zero is undefined.\n\n Supress the host-side exception by dividing by 1. */\n\n tcg_gen_or_tl(t0, srcb, sr_ov);\n\n tcg_gen_div_tl(dest, srca, t0);\n\n tcg_temp_free(t0);\n\n\n\n tcg_gen_deposit_tl(cpu_sr, cpu_sr, sr_ov, ctz32(SR_OV), 1);\n\n\n\n gen_ove_ov(dc, sr_ov);\n\n tcg_temp_free(sr_ov);\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_65", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n QCowAIOCB *next;\n \n+\n+\n+ /* Take the request off the list of running requests */\n+\n+ if (m->nb_clusters != 0) {\n \n LIST_REMOVE(m, next_in_flight);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void run_dependent_requests(QCowL2Meta *m)\n\n{\n\n QCowAIOCB *req;\n\n QCowAIOCB *next;\n\n\n\n /* Take the request off the list of running requests */\n\n if (m->nb_clusters != 0) {\n\n LIST_REMOVE(m, next_in_flight);\n\n }\n\n\n\n /*\n\n * Restart all dependent requests.\n\n * Can't use LIST_FOREACH here - the next link might not be the same\n\n * any more after the callback (request could depend on a different\n\n * request now)\n\n */\n\n for (req = m->dependent_requests.lh_first; req != NULL; req = next) {\n\n next = req->next_depend.le_next;\n\n qcow_aio_write_cb(req, 0);\n\n }\n\n\n\n /* Empty the list for the next part of the request */\n\n LIST_INIT(&m->dependent_requests);\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_48", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,10 +28,10 @@\n \n aio_context_release(aio_context);\n \n+ }\n+\n+\n+\n+ return result;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int bdrv_flush_all(void)\n\n{\n\n BlockDriverState *bs = NULL;\n\n int result = 0;\n\n\n\n while ((bs = bdrv_next(bs))) {\n\n AioContext *aio_context = bdrv_get_aio_context(bs);\n\n int ret;\n\n\n\n aio_context_acquire(aio_context);\n\n ret = bdrv_flush(bs);\n\n if (ret < 0 && !result) {\n\n result = ret;\n\n }\n\n aio_context_release(aio_context);\n\n }\n\n\n\n return result;\n\n}\n"}} {"sample_id": "aea14095ea91f792ee43ee52fe6032cd8cdd7190", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n void mips_cpu_do_unaligned_access(CPUState *cs, vaddr addr,\n \n+ int is_write, int is_user, uintptr_t retaddr)\n+\n+{\n+\n MIPSCPU *cpu = MIPS_CPU(cs);\n \n CPUMIPSState *env = &cpu->env;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void mips_cpu_do_unaligned_access(CPUState *cs, vaddr addr,\n\n int is_write, int is_user, uintptr_t retaddr)\n\n{\n\n MIPSCPU *cpu = MIPS_CPU(cs);\n\n CPUMIPSState *env = &cpu->env;\n\n\n\n env->CP0_BadVAddr = addr;\n\n do_raise_exception(env, (is_write == 1) ? EXCP_AdES : EXCP_AdEL, retaddr);\n\n}\n"}} {"sample_id": "2da0d70d5eebe42f9fcd27ee554419ebe2a5da06_18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n static inline void RENAME(rgb15ToY)(uint8_t *dst, uint8_t *src, int width)\n+\n+{\n \n+\tint i;\n+\n+\tfor(i=0; i>5)&0x1F;\n\n\t\tint b= (d>>10)&0x1F;\n\n\n\n\t\tdst[i]= ((RY*r + GY*g + BY*b)>>(RGB2YUV_SHIFT-3)) + 16;\n\n\t}\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_26", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n \ttcg_gen_trunc_i64_i32(d, t0);\n \n \ttcg_gen_shri_i64(t0, t0, 32);\n+\n+\ttcg_gen_trunc_i64_i32(d2, t0);\n+\n+\n+\n \ttcg_temp_free(t0);\n \n \ttcg_temp_free(t1);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void t_gen_mulu(TCGv d, TCGv d2, TCGv a, TCGv b)\n\n{\n\n\tTCGv t0, t1;\n\n\n\n\tt0 = tcg_temp_new(TCG_TYPE_I64);\n\n\tt1 = tcg_temp_new(TCG_TYPE_I64);\n\n\n\n\ttcg_gen_extu_i32_i64(t0, a);\n\n\ttcg_gen_extu_i32_i64(t1, b);\n\n\ttcg_gen_mul_i64(t0, t0, t1);\n\n\n\n\ttcg_gen_trunc_i64_i32(d, t0);\n\n\ttcg_gen_shri_i64(t0, t0, 32);\n\n\ttcg_gen_trunc_i64_i32(d2, t0);\n\n\n\n\ttcg_temp_free(t0);\n\n\ttcg_temp_free(t1);\n\n}\n"}} {"sample_id": "ae261c86aaed62e7acddafab8262a2bf286d40b7_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n if (bdrv_pread(bs->file, s->desc_offset, desc, DESC_SIZE) != DESC_SIZE) {\n \n+ return 0;\n+\n+ }\n+\n+\n \n if (parent) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t vmdk_read_cid(BlockDriverState *bs, int parent)\n\n{\n\n char desc[DESC_SIZE];\n\n uint32_t cid;\n\n const char *p_name, *cid_str;\n\n size_t cid_str_size;\n\n BDRVVmdkState *s = bs->opaque;\n\n\n\n if (bdrv_pread(bs->file, s->desc_offset, desc, DESC_SIZE) != DESC_SIZE) {\n\n return 0;\n\n }\n\n\n\n if (parent) {\n\n cid_str = \"parentCID\";\n\n cid_str_size = sizeof(\"parentCID\");\n\n } else {\n\n cid_str = \"CID\";\n\n cid_str_size = sizeof(\"CID\");\n\n }\n\n\n\n if ((p_name = strstr(desc,cid_str)) != NULL) {\n\n p_name += cid_str_size;\n\n sscanf(p_name,\"%x\",&cid);\n\n }\n\n\n\n return cid;\n\n}\n"}} {"sample_id": "dad42bc5a134f60164eab2dfb0892b761603e1e1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n if (src->format == AV_PIX_FMT_VIDEOTOOLBOX && src->buf[0]->size == 1)\n \n+ return AVERROR_EXTERNAL;\n+\n+\n+\n+ ret = av_frame_ref(dst, src);\n \n if (ret < 0)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int output_frame(H264Context *h, AVFrame *dst, H264Picture *srcp)\n\n{\n\n AVFrame *src = srcp->f;\n\n int ret;\n\n\n\n if (src->format == AV_PIX_FMT_VIDEOTOOLBOX && src->buf[0]->size == 1)\n\n return AVERROR_EXTERNAL;\n\n\n\n ret = av_frame_ref(dst, src);\n\n if (ret < 0)\n\n return ret;\n\n\n\n av_dict_set(&dst->metadata, \"stereo_mode\", ff_h264_sei_stereo_mode(&h->sei.frame_packing), 0);\n\n\n\n if (srcp->sei_recovery_frame_cnt == 0)\n\n dst->key_frame = 1;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n yield_until_fd_readable(s->fd);\n \n } else if (errno != EINTR) {\n+\n+ break;\n+\n+ }\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int unix_get_buffer(void *opaque, uint8_t *buf, int64_t pos, int size)\n\n{\n\n QEMUFileSocket *s = opaque;\n\n ssize_t len;\n\n\n\n for (;;) {\n\n len = read(s->fd, buf, size);\n\n if (len != -1) {\n\n break;\n\n }\n\n if (errno == EAGAIN) {\n\n yield_until_fd_readable(s->fd);\n\n } else if (errno != EINTR) {\n\n break;\n\n }\n\n }\n\n\n\n if (len == -1) {\n\n len = -errno;\n\n }\n\n return len;\n\n}\n"}} {"sample_id": "e57ca75ce3b2bd33102573a8c0555d62e1bcfceb_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,9 +29,9 @@\n env->spr[SPR_HIOR] = 0;\n \n \n+\n+ ppc_hash64_set_external_hpt(cpu, spapr->htab, spapr->htab_shift,\n+\n+ &error_fatal);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void spapr_cpu_reset(void *opaque)\n\n{\n\n sPAPRMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());\n\n PowerPCCPU *cpu = opaque;\n\n CPUState *cs = CPU(cpu);\n\n CPUPPCState *env = &cpu->env;\n\n\n\n cpu_reset(cs);\n\n\n\n /* All CPUs start halted. CPU0 is unhalted from the machine level\n\n * reset code and the rest are explicitly started up by the guest\n\n * using an RTAS call */\n\n cs->halted = 1;\n\n\n\n env->spr[SPR_HIOR] = 0;\n\n\n\n ppc_hash64_set_external_hpt(cpu, spapr->htab, spapr->htab_shift,\n\n &error_fatal);\n\n}\n"}} {"sample_id": "378a5b9c5f1a8b51dee3b954713d18f330fbb027", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ uint8_t buf[8];\n+\n+ int i;\n+\n+\n \n for(i=0;i<8;i++)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ffm_write_write_index(int fd, int64_t pos)\n\n{\n\n uint8_t buf[8];\n\n int i;\n\n\n\n for(i=0;i<8;i++)\n\n buf[i] = (pos >> (56 - i * 8)) & 0xff;\n\n lseek(fd, 8, SEEK_SET);\n\n if (write(fd, buf, 8) != 8)\n\n return AVERROR(EIO);\n\n return 8;\n\n}\n"}} {"sample_id": "2bfa067d0b636e7b2004fb0ad5a53d0d48c6de32", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,8 +5,8 @@\n VAAPIEncodeContext *ctx = avctx->priv_data;\n \n VAAPIEncodePicture *pic, *next;\n+\n+\n \n for (pic = ctx->pic_start; pic; pic = next) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "av_cold int ff_vaapi_encode_close(AVCodecContext *avctx)\n\n{\n\n VAAPIEncodeContext *ctx = avctx->priv_data;\n\n VAAPIEncodePicture *pic, *next;\n\n\n\n for (pic = ctx->pic_start; pic; pic = next) {\n\n next = pic->next;\n\n vaapi_encode_free(avctx, pic);\n\n }\n\n\n\n if (ctx->va_context != VA_INVALID_ID)\n\n vaDestroyContext(ctx->hwctx->display, ctx->va_context);\n\n\n\n if (ctx->va_config != VA_INVALID_ID)\n\n vaDestroyConfig(ctx->hwctx->display, ctx->va_config);\n\n\n\n if (ctx->codec->close)\n\n ctx->codec->close(avctx);\n\n\n\n av_freep(&ctx->codec_sequence_params);\n\n av_freep(&ctx->codec_picture_params);\n\n\n\n av_buffer_unref(&ctx->recon_frames_ref);\n\n av_buffer_unref(&ctx->input_frames_ref);\n\n av_buffer_unref(&ctx->device_ref);\n\n\n\n av_freep(&ctx->priv_data);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "1687a089f103f9b7a1b4a1555068054cb46ee9e9_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,10 +16,10 @@\n \n }\n \n+ list->head = NULL;\n+\n+ list->tail = NULL;\n+\n+ g_free(list);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "vreader_list_delete(VReaderList *list)\n\n{\n\n VReaderListEntry *current_entry;\n\n VReaderListEntry *next_entry = NULL;\n\n for (current_entry = vreader_list_get_first(list); current_entry;\n\n current_entry = next_entry) {\n\n next_entry = vreader_list_get_next(current_entry);\n\n vreader_list_entry_delete(current_entry);\n\n }\n\n list->head = NULL;\n\n list->tail = NULL;\n\n g_free(list);\n\n}\n"}} {"sample_id": "32f0c658283e2451add02a6ee5c719efa877a34c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -66,11 +66,11 @@\n \n dest[2*linesize] = cm[dest[2*linesize] + ((t2 + t4) >> 7)];\n \n+ dest[3*linesize] = cm[dest[3*linesize] + ((t1 - t3) >> 7)];\n+\n+\n+\n+ src ++;\n \n dest++;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vc1_inv_trans_4x4_c(uint8_t *dest, int linesize, DCTELEM *block)\n\n{\n\n int i;\n\n register int t1,t2,t3,t4;\n\n DCTELEM *src, *dst;\n\n const uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;\n\n\n\n src = block;\n\n dst = block;\n\n for(i = 0; i < 4; i++){\n\n t1 = 17 * (src[0] + src[2]) + 4;\n\n t2 = 17 * (src[0] - src[2]) + 4;\n\n t3 = 22 * src[1] + 10 * src[3];\n\n t4 = 22 * src[3] - 10 * src[1];\n\n\n\n dst[0] = (t1 + t3) >> 3;\n\n dst[1] = (t2 - t4) >> 3;\n\n dst[2] = (t2 + t4) >> 3;\n\n dst[3] = (t1 - t3) >> 3;\n\n\n\n src += 8;\n\n dst += 8;\n\n }\n\n\n\n src = block;\n\n for(i = 0; i < 4; i++){\n\n t1 = 17 * (src[ 0] + src[16]) + 64;\n\n t2 = 17 * (src[ 0] - src[16]) + 64;\n\n t3 = 22 * src[ 8] + 10 * src[24];\n\n t4 = 22 * src[24] - 10 * src[ 8];\n\n\n\n dest[0*linesize] = cm[dest[0*linesize] + ((t1 + t3) >> 7)];\n\n dest[1*linesize] = cm[dest[1*linesize] + ((t2 - t4) >> 7)];\n\n dest[2*linesize] = cm[dest[2*linesize] + ((t2 + t4) >> 7)];\n\n dest[3*linesize] = cm[dest[3*linesize] + ((t1 - t3) >> 7)];\n\n\n\n src ++;\n\n dest++;\n\n }\n\n}\n"}} {"sample_id": "7e7e2ebc942da8285931ceabf12823e165dced8b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n struct sockaddr_in addr;\n \n+ socklen_t addrlen = sizeof(addr);\n+\n+\n+\n+ /* Catch-up */\n \n vga_hw_update();\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vnc_listen_read(void *opaque)\n\n{\n\n VncDisplay *vs = opaque;\n\n struct sockaddr_in addr;\n\n socklen_t addrlen = sizeof(addr);\n\n\n\n /* Catch-up */\n\n vga_hw_update();\n\n\n\n int csock = qemu_accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);\n\n if (csock != -1) {\n\n vnc_connect(vs, csock);\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_94", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n stb_p(qemu_get_ram_ptr(ram_addr), val);\n \n+ break;\n+\n+ case 2:\n+\n+ stw_p(qemu_get_ram_ptr(ram_addr), val);\n \n break;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void notdirty_mem_write(void *opaque, target_phys_addr_t ram_addr,\n\n uint64_t val, unsigned size)\n\n{\n\n int dirty_flags;\n\n dirty_flags = cpu_physical_memory_get_dirty_flags(ram_addr);\n\n if (!(dirty_flags & CODE_DIRTY_FLAG)) {\n\n#if !defined(CONFIG_USER_ONLY)\n\n tb_invalidate_phys_page_fast(ram_addr, size);\n\n dirty_flags = cpu_physical_memory_get_dirty_flags(ram_addr);\n\n#endif\n\n }\n\n switch (size) {\n\n case 1:\n\n stb_p(qemu_get_ram_ptr(ram_addr), val);\n\n break;\n\n case 2:\n\n stw_p(qemu_get_ram_ptr(ram_addr), val);\n\n break;\n\n case 4:\n\n stl_p(qemu_get_ram_ptr(ram_addr), val);\n\n break;\n\n default:\n\n abort();\n\n }\n\n dirty_flags |= (0xff & ~CODE_DIRTY_FLAG);\n\n cpu_physical_memory_set_dirty_flags(ram_addr, dirty_flags);\n\n /* we remove the notdirty callback only if the code has been\n\n flushed */\n\n if (dirty_flags == 0xff)\n\n tlb_set_dirty(cpu_single_env, cpu_single_env->mem_io_vaddr);\n\n}\n"}} {"sample_id": "f81e551229070f01bf747eda3f05960182db9d2a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n uint32_t pcba = pnv_xscom_pcba(chip, addr);\n \n uint64_t val = 0;\n+\n MemTxResult result;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint64_t xscom_read(void *opaque, hwaddr addr, unsigned width)\n\n{\n\n PnvChip *chip = opaque;\n\n uint32_t pcba = pnv_xscom_pcba(chip, addr);\n\n uint64_t val = 0;\n\n MemTxResult result;\n\n\n\n /* Handle some SCOMs here before dispatch */\n\n val = xscom_read_default(chip, pcba);\n\n if (val != -1) {\n\n goto complete;\n\n }\n\n\n\n val = address_space_ldq(&chip->xscom_as, pcba << 3, MEMTXATTRS_UNSPECIFIED,\n\n &result);\n\n if (result != MEMTX_OK) {\n\n qemu_log_mask(LOG_GUEST_ERROR, \"XSCOM read failed at @0x%\"\n\n HWADDR_PRIx \" pcba=0x%08x\\n\", addr, pcba);\n\n xscom_complete(current_cpu, HMER_XSCOM_FAIL | HMER_XSCOM_DONE);\n\n return 0;\n\n }\n\n\n\ncomplete:\n\n xscom_complete(current_cpu, HMER_XSCOM_DONE);\n\n return val;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_76", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void network_to_remote_block(RDMARemoteBlock *rb)\n \n {\n+\n+ rb->remote_host_addr = ntohll(rb->remote_host_addr);\n+\n rb->offset = ntohll(rb->offset);\n \n rb->length = ntohll(rb->length);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void network_to_remote_block(RDMARemoteBlock *rb)\n\n{\n\n rb->remote_host_addr = ntohll(rb->remote_host_addr);\n\n rb->offset = ntohll(rb->offset);\n\n rb->length = ntohll(rb->length);\n\n rb->remote_rkey = ntohl(rb->remote_rkey);\n\n}\n"}} {"sample_id": "6e8fe448154e1aa0928cb0d2e1aecb7255c751cc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n Wmv2Context * const w= avctx->priv_data;\n \n \n+\n if(ff_MPV_encode_init(avctx) < 0)\n \n return -1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static av_cold int wmv2_encode_init(AVCodecContext *avctx){\n\n Wmv2Context * const w= avctx->priv_data;\n\n\n\n if(ff_MPV_encode_init(avctx) < 0)\n\n return -1;\n\n\n\n ff_wmv2_common_init(w);\n\n\n\n avctx->extradata_size= 4;\n\n avctx->extradata= av_mallocz(avctx->extradata_size + 10);\n\n encode_ext_header(w);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "c627e7526a902dd5bb1907dbbd5cf961679dfa68", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void rc4030_reset(DeviceState *dev)\n \n+{\n \n rc4030State *s = RC4030(dev);\n \n int i;\n+\n \n \n s->config = 0x410; /* some boards seem to accept 0x104 too */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void rc4030_reset(DeviceState *dev)\n\n{\n\n rc4030State *s = RC4030(dev);\n\n int i;\n\n\n\n s->config = 0x410; /* some boards seem to accept 0x104 too */\n\n s->revision = 1;\n\n s->invalid_address_register = 0;\n\n\n\n memset(s->dma_regs, 0, sizeof(s->dma_regs));\n\n rc4030_dma_tt_update(s, 0, 0);\n\n\n\n s->remote_failed_address = s->memory_failed_address = 0;\n\n s->cache_maint = 0;\n\n s->cache_ptag = s->cache_ltag = 0;\n\n s->cache_bmask = 0;\n\n\n\n s->memory_refresh_rate = 0x18186;\n\n s->nvram_protect = 7;\n\n for (i = 0; i < 15; i++)\n\n s->rem_speed[i] = 7;\n\n s->imr_jazz = 0x10; /* XXX: required by firmware, but why? */\n\n s->isr_jazz = 0;\n\n\n\n s->itr = 0;\n\n\n\n qemu_irq_lower(s->timer_irq);\n\n qemu_irq_lower(s->jazz_bus_irq);\n\n}\n"}} {"sample_id": "26a83ad0e793465b74a8b06a65f2f6fdc5615413_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -49,11 +49,11 @@\n cpu_register_physical_memory_log(int128_get64(fr->addr.start),\n \n int128_get64(fr->addr.size),\n+\n+ phys_offset,\n+\n+ region_offset,\n+\n fr->dirty_log_mask);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void as_memory_range_add(AddressSpace *as, FlatRange *fr)\n\n{\n\n ram_addr_t phys_offset, region_offset;\n\n\n\n memory_region_prepare_ram_addr(fr->mr);\n\n\n\n phys_offset = fr->mr->ram_addr;\n\n region_offset = fr->offset_in_region;\n\n /* cpu_register_physical_memory_log() wants region_offset for\n\n * mmio, but prefers offseting phys_offset for RAM. Humour it.\n\n */\n\n if ((phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM) {\n\n phys_offset += region_offset;\n\n region_offset = 0;\n\n }\n\n\n\n if (!fr->readable) {\n\n phys_offset &= ~TARGET_PAGE_MASK & ~IO_MEM_ROMD;\n\n }\n\n\n\n if (fr->readonly) {\n\n phys_offset |= IO_MEM_ROM;\n\n }\n\n\n\n cpu_register_physical_memory_log(int128_get64(fr->addr.start),\n\n int128_get64(fr->addr.size),\n\n phys_offset,\n\n region_offset,\n\n fr->dirty_log_mask);\n\n}\n"}} {"sample_id": "21ce148c7ec71ee32834061355a5ecfd1a11f90f_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static inline int cris_abs(int n)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline int cris_abs(int n)\n\n{\n\n\tint r;\n\n\tasm (\"abs\\t%1, %0\\n\" : \"=r\" (r) : \"r\" (n));\n\n\treturn r;\n\n}\n"}} {"sample_id": "74942685cb457c01937686892878403a409baf27", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n \n \n+ av_dict_copy(&tmp, opts, 0);\n+\n+\n+\n+ av_opt_set_dict(var->input, &tmp);\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int url_connect(struct variant *var, AVDictionary *opts)\n\n{\n\n AVDictionary *tmp = NULL;\n\n int ret;\n\n\n\n av_dict_copy(&tmp, opts, 0);\n\n\n\n av_opt_set_dict(var->input, &tmp);\n\n\n\n if ((ret = ffurl_connect(var->input, NULL)) < 0) {\n\n ffurl_close(var->input);\n\n var->input = NULL;\n\n }\n\n\n\n av_dict_free(&tmp);\n\n return ret;\n\n}\n"}} {"sample_id": "1dc42050185d63c1de5d16146fbaee92640af187_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n \n \n for (i = 0; i < ctx->nb_outputs; i++) {\n+\n+ ret = ff_filter_samples(inlink->dst->outputs[i],\n+\n+ avfilter_ref_buffer(samplesref, ~AV_PERM_WRITE));\n+\n if (ret < 0)\n \n break;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int filter_samples(AVFilterLink *inlink, AVFilterBufferRef *samplesref)\n\n{\n\n AVFilterContext *ctx = inlink->dst;\n\n int i, ret = 0;\n\n\n\n for (i = 0; i < ctx->nb_outputs; i++) {\n\n ret = ff_filter_samples(inlink->dst->outputs[i],\n\n avfilter_ref_buffer(samplesref, ~AV_PERM_WRITE));\n\n if (ret < 0)\n\n break;\n\n }\n\n avfilter_unref_buffer(samplesref);\n\n return ret;\n\n}\n"}} {"sample_id": "9745807191a81c45970f780166f44a7f93b18653_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,24 +1,24 @@\n static void gen_addc(DisasContext *dc, TCGv dest, TCGv srca, TCGv srcb)\n \n {\n+\n+ TCGv t0 = tcg_const_tl(0);\n+\n+ TCGv res = tcg_temp_new();\n+\n+ TCGv sr_cy = tcg_temp_new();\n+\n TCGv sr_ov = tcg_temp_new();\n+\n \n \n tcg_gen_shri_tl(sr_cy, cpu_sr, ctz32(SR_CY));\n+\n+ tcg_gen_andi_tl(sr_cy, sr_cy, 1);\n+\n+\n+\n+ tcg_gen_add2_tl(res, sr_cy, srca, t0, sr_cy, t0);\n \n tcg_gen_add2_tl(res, sr_cy, res, sr_cy, srcb, t0);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_addc(DisasContext *dc, TCGv dest, TCGv srca, TCGv srcb)\n\n{\n\n TCGv t0 = tcg_const_tl(0);\n\n TCGv res = tcg_temp_new();\n\n TCGv sr_cy = tcg_temp_new();\n\n TCGv sr_ov = tcg_temp_new();\n\n\n\n tcg_gen_shri_tl(sr_cy, cpu_sr, ctz32(SR_CY));\n\n tcg_gen_andi_tl(sr_cy, sr_cy, 1);\n\n\n\n tcg_gen_add2_tl(res, sr_cy, srca, t0, sr_cy, t0);\n\n tcg_gen_add2_tl(res, sr_cy, res, sr_cy, srcb, t0);\n\n tcg_gen_xor_tl(sr_ov, srca, srcb);\n\n tcg_gen_xor_tl(t0, res, srcb);\n\n tcg_gen_andc_tl(sr_ov, t0, sr_ov);\n\n tcg_temp_free(t0);\n\n\n\n tcg_gen_mov_tl(dest, res);\n\n tcg_temp_free(res);\n\n\n\n tcg_gen_shri_tl(sr_ov, sr_ov, TARGET_LONG_BITS - 1);\n\n tcg_gen_deposit_tl(cpu_sr, cpu_sr, sr_cy, ctz32(SR_CY), 1);\n\n tcg_gen_deposit_tl(cpu_sr, cpu_sr, sr_ov, ctz32(SR_OV), 1);\n\n\n\n gen_ove_cyov(dc, sr_ov, sr_cy);\n\n tcg_temp_free(sr_ov);\n\n tcg_temp_free(sr_cy);\n\n}\n"}} {"sample_id": "8a9e0e7b890b2598da94646bf6a7272f3d3924de", "diff": "--- a/source.c\n+++ b/source.c\n@@ -34,10 +34,10 @@\n \n error_setg(errp, \"Memory backend has bad page size. \"\n \n+ \"Use 'memory-backend-file' with correct mem-path.\");\n+\n+ return;\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void spapr_memory_pre_plug(HotplugHandler *hotplug_dev, DeviceState *dev,\n\n Error **errp)\n\n{\n\n PCDIMMDevice *dimm = PC_DIMM(dev);\n\n PCDIMMDeviceClass *ddc = PC_DIMM_GET_CLASS(dimm);\n\n MemoryRegion *mr = ddc->get_memory_region(dimm);\n\n uint64_t size = memory_region_size(mr);\n\n char *mem_dev;\n\n\n\n if (size % SPAPR_MEMORY_BLOCK_SIZE) {\n\n error_setg(errp, \"Hotplugged memory size must be a multiple of \"\n\n \"%lld MB\", SPAPR_MEMORY_BLOCK_SIZE / M_BYTE);\n\n return;\n\n }\n\n\n\n mem_dev = object_property_get_str(OBJECT(dimm), PC_DIMM_MEMDEV_PROP, NULL);\n\n if (mem_dev && !kvmppc_is_mem_backend_page_size_ok(mem_dev)) {\n\n error_setg(errp, \"Memory backend has bad page size. \"\n\n \"Use 'memory-backend-file' with correct mem-path.\");\n\n return;\n\n }\n\n}\n"}} {"sample_id": "125acd215250ead008938266efcacd56743f3a2a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -35,11 +35,11 @@\n sanitize_channel_layouts(ctx, ctx->inputs[i]->out_channel_layouts);\n \n for (i = 0; i < ctx->nb_outputs; i++)\n+\n+ sanitize_channel_layouts(ctx, ctx->outputs[i]->in_channel_layouts);\n+\n+\n+\n formats = ff_all_formats(type);\n \n if (!formats)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int filter_query_formats(AVFilterContext *ctx)\n\n{\n\n int ret, i;\n\n AVFilterFormats *formats;\n\n AVFilterChannelLayouts *chlayouts;\n\n AVFilterFormats *samplerates;\n\n enum AVMediaType type = ctx->inputs && ctx->inputs [0] ? ctx->inputs [0]->type :\n\n ctx->outputs && ctx->outputs[0] ? ctx->outputs[0]->type :\n\n AVMEDIA_TYPE_VIDEO;\n\n\n\n if ((ret = ctx->filter->query_formats(ctx)) < 0) {\n\n av_log(ctx, AV_LOG_ERROR, \"Query format failed for '%s': %s\\n\",\n\n ctx->name, av_err2str(ret));\n\n return ret;\n\n }\n\n\n\n for (i = 0; i < ctx->nb_inputs; i++)\n\n sanitize_channel_layouts(ctx, ctx->inputs[i]->out_channel_layouts);\n\n for (i = 0; i < ctx->nb_outputs; i++)\n\n sanitize_channel_layouts(ctx, ctx->outputs[i]->in_channel_layouts);\n\n\n\n formats = ff_all_formats(type);\n\n if (!formats)\n\n return AVERROR(ENOMEM);\n\n ff_set_common_formats(ctx, formats);\n\n if (type == AVMEDIA_TYPE_AUDIO) {\n\n samplerates = ff_all_samplerates();\n\n if (!samplerates)\n\n return AVERROR(ENOMEM);\n\n ff_set_common_samplerates(ctx, samplerates);\n\n chlayouts = ff_all_channel_layouts();\n\n if (!chlayouts)\n\n return AVERROR(ENOMEM);\n\n ff_set_common_channel_layouts(ctx, chlayouts);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "ad07cd69ecaffbaa015459a46975ab32e50df805_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);\n \n VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);\n+\n+\n+\n+ assert(!s->ctx);\n+\n s->ctx = iothread_get_aio_context(vs->conf.iothread);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void virtio_scsi_set_iothread(VirtIOSCSI *s, IOThread *iothread)\n\n{\n\n BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(s)));\n\n VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);\n\n VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);\n\n\n\n assert(!s->ctx);\n\n s->ctx = iothread_get_aio_context(vs->conf.iothread);\n\n\n\n /* Don't try if transport does not support notifiers. */\n\n if (!k->set_guest_notifiers || !k->ioeventfd_assign) {\n\n fprintf(stderr, \"virtio-scsi: Failed to set iothread \"\n\n \"(transport does not support notifiers)\");\n\n exit(1);\n\n }\n\n}\n"}} {"sample_id": "a2b8dde65947bfabf42269e124ef83ecf9c5974a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -38,11 +38,11 @@\n \n \n \n+ if (pal) {\n+\n+ frame->palette_has_changed = 1;\n+\n+ memcpy(s->pal, pal, AVPALETTE_SIZE);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int idcin_decode_frame(AVCodecContext *avctx,\n\n void *data, int *got_frame,\n\n AVPacket *avpkt)\n\n{\n\n const uint8_t *buf = avpkt->data;\n\n int buf_size = avpkt->size;\n\n IdcinContext *s = avctx->priv_data;\n\n const uint8_t *pal = av_packet_get_side_data(avpkt, AV_PKT_DATA_PALETTE, NULL);\n\n AVFrame *frame = data;\n\n int ret;\n\n\n\n s->buf = buf;\n\n s->size = buf_size;\n\n\n\n if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)\n\n return ret;\n\n\n\n if (idcin_decode_vlcs(s, frame))\n\n return AVERROR_INVALIDDATA;\n\n\n\n if (pal) {\n\n frame->palette_has_changed = 1;\n\n memcpy(s->pal, pal, AVPALETTE_SIZE);\n\n }\n\n /* make the palette available on the way out */\n\n memcpy(frame->data[1], s->pal, AVPALETTE_SIZE);\n\n\n\n *got_frame = 1;\n\n\n\n /* report that the buffer was completely consumed */\n\n return buf_size;\n\n}\n"}} {"sample_id": "3ab9a2a5577d445252724af4067d2a7c8a378efa_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void rv40_h_strong_loop_filter(uint8_t *src, const int stride,\n \n const int alpha, const int lims,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void rv40_h_strong_loop_filter(uint8_t *src, const int stride,\n\n const int alpha, const int lims,\n\n const int dmode, const int chroma)\n\n{\n\n rv40_strong_loop_filter(src, stride, 1, alpha, lims, dmode, chroma);\n\n}\n"}} {"sample_id": "92cb05574b7bd489be81f9c58497dc7dfe5d8859", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,10 +2,10 @@\n \n {\n \n+ if (guessed_disk_nature) {\n+\n+ return (blk_cfg.blk_size == 512);\n+\n }\n \n return (blk_cfg.geometry.heads == 255)", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool virtio_disk_is_scsi(void)\n\n{\n\n if (guessed_disk_nature) {\n\n return (blk_cfg.blk_size == 512);\n\n }\n\n return (blk_cfg.geometry.heads == 255)\n\n && (blk_cfg.geometry.sectors == 63)\n\n && (blk_cfg.blk_size == 512);\n\n}\n"}} {"sample_id": "daca33659d12fd85062bc1798f4eb7ffeb83cc3c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n const char *codec_string = encoder ? \"encoder\" : \"decoder\";\n+\n AVCodec *codec;\n \n if (c->codec->capabilities & CODEC_CAP_EXPERIMENTAL &&", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void assert_codec_experimental(AVCodecContext *c, int encoder)\n\n{\n\n const char *codec_string = encoder ? \"encoder\" : \"decoder\";\n\n AVCodec *codec;\n\n if (c->codec->capabilities & CODEC_CAP_EXPERIMENTAL &&\n\n c->strict_std_compliance > FF_COMPLIANCE_EXPERIMENTAL) {\n\n av_log(NULL, AV_LOG_ERROR, \"%s '%s' is experimental and might produce bad \"\n\n \"results.\\nAdd '-strict experimental' if you want to use it.\\n\",\n\n codec_string, c->codec->name);\n\n codec = encoder ? avcodec_find_encoder(codec->id) : avcodec_find_decoder(codec->id);\n\n if (!(codec->capabilities & CODEC_CAP_EXPERIMENTAL))\n\n av_log(NULL, AV_LOG_ERROR, \"Or use the non experimental %s '%s'.\\n\",\n\n codec_string, codec->name);\n\n ffmpeg_exit(1);\n\n }\n\n}\n"}} {"sample_id": "ac531cb6e542b1e61d668604adf9dc5306a948c0_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n qdict = qdict_new();\n \n+ qdict_put_obj(qdict, \"num\", QOBJECT(qint_from_int(0)));\n+\n+ qdict_put_obj(qdict, \"str\", QOBJECT(qstring_from_str(\"foo\")));\n+\n \n \n QDECREF(qdict);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "START_TEST(qdict_destroy_simple_test)\n\n{\n\n QDict *qdict;\n\n\n\n qdict = qdict_new();\n\n qdict_put_obj(qdict, \"num\", QOBJECT(qint_from_int(0)));\n\n qdict_put_obj(qdict, \"str\", QOBJECT(qstring_from_str(\"foo\")));\n\n\n\n QDECREF(qdict);\n\n}\n"}} {"sample_id": "37d1e4d9bfac846a1331375aab3d13b54a048c01", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void nfs_process_write(void *arg)\n \n+{\n+\n+ NFSClient *client = arg;\n+\n \n \n aio_context_acquire(client->aio_context);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void nfs_process_write(void *arg)\n\n{\n\n NFSClient *client = arg;\n\n\n\n aio_context_acquire(client->aio_context);\n\n nfs_service(client->context, POLLOUT);\n\n nfs_set_events(client);\n\n aio_context_release(client->aio_context);\n\n}\n"}} {"sample_id": "e2a176dfda32f5cf80703c2921a19fe75850c38c_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n ret |= taihu_cpld_readb(opaque, addr + 1) << 16;\n \n ret |= taihu_cpld_readb(opaque, addr + 2) << 8;\n+\n+ ret |= taihu_cpld_readb(opaque, addr + 3);\n+\n+\n+\n return ret;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t taihu_cpld_readl (void *opaque, hwaddr addr)\n\n{\n\n uint32_t ret;\n\n\n\n ret = taihu_cpld_readb(opaque, addr) << 24;\n\n ret |= taihu_cpld_readb(opaque, addr + 1) << 16;\n\n ret |= taihu_cpld_readb(opaque, addr + 2) << 8;\n\n ret |= taihu_cpld_readb(opaque, addr + 3);\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "fd56e0612b6454a282fa6a953fdb09281a98c589_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n PCIIORegion *r;\n \n+ int i;\n+\n+ pcibus_t new_addr;\n+\n+\n \n for(i = 0; i < PCI_NUM_REGIONS; i++) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pci_update_mappings(PCIDevice *d)\n\n{\n\n PCIIORegion *r;\n\n int i;\n\n pcibus_t new_addr;\n\n\n\n for(i = 0; i < PCI_NUM_REGIONS; i++) {\n\n r = &d->io_regions[i];\n\n\n\n /* this region isn't registered */\n\n if (!r->size)\n\n continue;\n\n\n\n new_addr = pci_bar_address(d, i, r->type, r->size);\n\n\n\n /* This bar isn't changed */\n\n if (new_addr == r->addr)\n\n continue;\n\n\n\n /* now do the real mapping */\n\n if (r->addr != PCI_BAR_UNMAPPED) {\n\n trace_pci_update_mappings_del(d, pci_bus_num(d->bus),\n\n PCI_SLOT(d->devfn),\n\n PCI_FUNC(d->devfn),\n\n i, r->addr, r->size);\n\n memory_region_del_subregion(r->address_space, r->memory);\n\n }\n\n r->addr = new_addr;\n\n if (r->addr != PCI_BAR_UNMAPPED) {\n\n trace_pci_update_mappings_add(d, pci_bus_num(d->bus),\n\n PCI_SLOT(d->devfn),\n\n PCI_FUNC(d->devfn),\n\n i, r->addr, r->size);\n\n memory_region_add_subregion_overlap(r->address_space,\n\n r->addr, r->memory, 1);\n\n }\n\n }\n\n\n\n pci_update_vga(d);\n\n}\n"}} {"sample_id": "307b7715d0256c95444cada36a02882e46bada2f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void set_signalled(sPAPRDRConnector *drc)\n \n {\n+\n drc->signalled = true;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void set_signalled(sPAPRDRConnector *drc)\n\n{\n\n drc->signalled = true;\n\n}\n"}} {"sample_id": "281bde27894f994d0982ab9283f15d6073ae352c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n if (ret != 0)\n \n av_log(h, AV_LOG_ERROR, \"pthread_join(): %s\\n\", strerror(ret));\n+\n+ }\n+\n+\n+\n pthread_mutex_destroy(&s->mutex);\n \n pthread_cond_destroy(&s->cond);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int udp_close(URLContext *h)\n\n{\n\n UDPContext *s = h->priv_data;\n\n int ret;\n\n\n\n if (s->is_multicast && (h->flags & AVIO_FLAG_READ))\n\n udp_leave_multicast_group(s->udp_fd, (struct sockaddr *)&s->dest_addr);\n\n closesocket(s->udp_fd);\n\n av_fifo_free(s->fifo);\n\n#if HAVE_PTHREADS\n\n if (s->thread_started) {\n\n pthread_cancel(s->circular_buffer_thread);\n\n ret = pthread_join(s->circular_buffer_thread, NULL);\n\n if (ret != 0)\n\n av_log(h, AV_LOG_ERROR, \"pthread_join(): %s\\n\", strerror(ret));\n\n }\n\n\n\n pthread_mutex_destroy(&s->mutex);\n\n pthread_cond_destroy(&s->cond);\n\n#endif\n\n return 0;\n\n}\n"}} {"sample_id": "5d7fd045cafeac1831c1999cb9e1251b7906c6b2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n CPU_QuadU x1, x2;\n \n+\n+\n+ x2.ll.upper = env->fregs[f2].ll;\n+\n+ x2.ll.lower = env->fregs[f2 + 2].ll;\n \n x1.q = float128_chs(x2.q);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint32_t HELPER(lcxbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)\n\n{\n\n CPU_QuadU x1, x2;\n\n\n\n x2.ll.upper = env->fregs[f2].ll;\n\n x2.ll.lower = env->fregs[f2 + 2].ll;\n\n x1.q = float128_chs(x2.q);\n\n env->fregs[f1].ll = x1.ll.upper;\n\n env->fregs[f1 + 2].ll = x1.ll.lower;\n\n return set_cc_nz_f128(x1.q);\n\n}\n"}} {"sample_id": "44729bc0204fd8bdc29c234fc663229e44420b09", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n ebml_master metaseek, seekentry;\n+\n int64_t currentpos;\n \n int i;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int64_t mkv_write_seekhead(AVIOContext *pb, mkv_seekhead *seekhead)\n\n{\n\n ebml_master metaseek, seekentry;\n\n int64_t currentpos;\n\n int i;\n\n\n\n currentpos = avio_tell(pb);\n\n\n\n if (seekhead->reserved_size > 0)\n\n if (avio_seek(pb, seekhead->filepos, SEEK_SET) < 0)\n\n return -1;\n\n\n\n metaseek = start_ebml_master(pb, MATROSKA_ID_SEEKHEAD, seekhead->reserved_size);\n\n for (i = 0; i < seekhead->num_entries; i++) {\n\n mkv_seekhead_entry *entry = &seekhead->entries[i];\n\n\n\n seekentry = start_ebml_master(pb, MATROSKA_ID_SEEKENTRY, MAX_SEEKENTRY_SIZE);\n\n\n\n put_ebml_id(pb, MATROSKA_ID_SEEKID);\n\n put_ebml_num(pb, ebml_id_size(entry->elementid), 0);\n\n put_ebml_id(pb, entry->elementid);\n\n\n\n put_ebml_uint(pb, MATROSKA_ID_SEEKPOSITION, entry->segmentpos);\n\n end_ebml_master(pb, seekentry);\n\n }\n\n end_ebml_master(pb, metaseek);\n\n\n\n if (seekhead->reserved_size > 0) {\n\n uint64_t remaining = seekhead->filepos + seekhead->reserved_size - avio_tell(pb);\n\n put_ebml_void(pb, remaining);\n\n avio_seek(pb, currentpos, SEEK_SET);\n\n\n\n currentpos = seekhead->filepos;\n\n }\n\n av_free(seekhead->entries);\n\n av_free(seekhead);\n\n\n\n return currentpos;\n\n}\n"}} {"sample_id": "856d72454f03aea26fd61c728762ef9cd1d71512_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ /* Flush out anything from MemoryListeners listening in on this */\n+\n+ memory_region_transaction_begin();\n+\n+ as->root = NULL;\n \n memory_region_transaction_commit();\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void address_space_destroy(AddressSpace *as)\n\n{\n\n /* Flush out anything from MemoryListeners listening in on this */\n\n memory_region_transaction_begin();\n\n as->root = NULL;\n\n memory_region_transaction_commit();\n\n QTAILQ_REMOVE(&address_spaces, as, address_spaces_link);\n\n address_space_destroy_dispatch(as);\n\n flatview_destroy(as->current_map);\n\n g_free(as->name);\n\n g_free(as->current_map);\n\n g_free(as->ioeventfds);\n\n}\n"}} {"sample_id": "27852f2f1dec3749ea79883b70484c841169f747", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,9 +6,9 @@\n \n int fd, ret;\n \n+\n+\n+ av_strstart(filename, \"unix:\", &filename);\n \n s->addr.sun_family = AF_UNIX;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int unix_open(URLContext *h, const char *filename, int flags)\n\n{\n\n UnixContext *s = h->priv_data;\n\n int fd, ret;\n\n\n\n av_strstart(filename, \"unix:\", &filename);\n\n s->addr.sun_family = AF_UNIX;\n\n av_strlcpy(s->addr.sun_path, filename, sizeof(s->addr.sun_path));\n\n\n\n if ((fd = ff_socket(AF_UNIX, s->type, 0)) < 0)\n\n return ff_neterrno();\n\n\n\n if (s->listen) {\n\n fd = ff_listen_bind(fd, (struct sockaddr *)&s->addr,\n\n sizeof(s->addr), s->timeout, h);\n\n if (fd < 0) {\n\n ret = fd;\n\n goto fail;\n\n }\n\n } else {\n\n ret = ff_listen_connect(fd, (struct sockaddr *)&s->addr,\n\n sizeof(s->addr), s->timeout, h, 0);\n\n if (ret < 0)\n\n goto fail;\n\n }\n\n\n\n s->fd = fd;\n\n\n\n return 0;\n\n\n\nfail:\n\n if (s->listen && AVUNERROR(ret) != EADDRINUSE)\n\n unlink(s->addr.sun_path);\n\n if (fd >= 0)\n\n closesocket(fd);\n\n return ret;\n\n}\n"}} {"sample_id": "2d0d2837dcf786da415cf4165d37f4ddd684ff57", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int drive_init_func(QemuOpts *opts, void *opaque)\n+\n+{\n \n int *use_scsi = opaque;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int drive_init_func(QemuOpts *opts, void *opaque)\n\n{\n\n int *use_scsi = opaque;\n\n\n\n return drive_init(opts, *use_scsi) == NULL;\n\n}\n"}} {"sample_id": "e71ca21f308432cac3deaabe522ac1b856471162", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,8 +6,8 @@\n \n {\n \n+ MotionEstContext * const c= &s->me;\n+\n me_cmp_func cmpf, chroma_cmpf;\n \n int next_dir=-1;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static av_always_inline int small_diamond_search(MpegEncContext * s, int *best, int dmin,\n\n int src_index, int ref_index, int const penalty_factor,\n\n int size, int h, int flags)\n\n{\n\n MotionEstContext * const c= &s->me;\n\n me_cmp_func cmpf, chroma_cmpf;\n\n int next_dir=-1;\n\n LOAD_COMMON\n\n LOAD_COMMON2\n\n unsigned map_generation = c->map_generation;\n\n\n\n cmpf = s->mecc.me_cmp[size];\n\n chroma_cmpf = s->mecc.me_cmp[size + 1];\n\n\n\n { /* ensure that the best point is in the MAP as h/qpel refinement needs it */\n\n const unsigned key = (best[1]<xmin) CHECK_MV_DIR(x-1, y , 0)\n\n if(dir!=3 && y>ymin) CHECK_MV_DIR(x , y-1, 1)\n\n if(dir!=0 && x POOL_BATCH_SIZE) {\n\n /* Slow path; a good place to register the destructor, too. */\n\n if (!coroutine_pool_cleanup_notifier.notify) {\n\n coroutine_pool_cleanup_notifier.notify = coroutine_pool_cleanup;\n\n qemu_thread_atexit_add(&coroutine_pool_cleanup_notifier);\n\n }\n\n\n\n /* This is not exact; there could be a little skew between\n\n * release_pool_size and the actual size of release_pool. But\n\n * it is just a heuristic, it does not need to be perfect.\n\n */\n\n alloc_pool_size = atomic_xchg(&release_pool_size, 0);\n\n QSLIST_MOVE_ATOMIC(&alloc_pool, &release_pool);\n\n co = QSLIST_FIRST(&alloc_pool);\n\n }\n\n }\n\n if (co) {\n\n QSLIST_REMOVE_HEAD(&alloc_pool, pool_next);\n\n alloc_pool_size--;\n\n }\n\n }\n\n\n\n if (!co) {\n\n co = qemu_coroutine_new();\n\n }\n\n\n\n co->entry = entry;\n\n QSIMPLEQ_INIT(&co->co_queue_wakeup);\n\n return co;\n\n}\n"}} {"sample_id": "302fa283789a2f9b1199c327047cfad2258a23a2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n const char *memory_region_name(const MemoryRegion *mr)\n+\n {\n \n return object_get_canonical_path_component(OBJECT(mr));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "const char *memory_region_name(const MemoryRegion *mr)\n\n{\n\n return object_get_canonical_path_component(OBJECT(mr));\n\n}\n"}} {"sample_id": "6f2d8978728c48ca46f5c01835438508aace5c64_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n ret = (int32_t)T0 >> (T1 & 0x1fUL);\n \n if (likely(ret >= 0 || ((int32_t)T0 & ((1 << T1) - 1)) == 0)) {\n+\n xer_ca = 0;\n \n } else {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void do_sraw (void)\n\n{\n\n int32_t ret;\n\n\n\n if (likely(!(T1 & 0x20UL))) {\n\n if (likely((uint32_t)T1 != 0)) {\n\n ret = (int32_t)T0 >> (T1 & 0x1fUL);\n\n if (likely(ret >= 0 || ((int32_t)T0 & ((1 << T1) - 1)) == 0)) {\n\n xer_ca = 0;\n\n } else {\n\n xer_ca = 1;\n\n }\n\n } else {\n\n ret = T0;\n\n xer_ca = 0;\n\n }\n\n } else {\n\n ret = (-1) * ((uint32_t)T0 >> 31);\n\n if (likely(ret >= 0 || ((uint32_t)T0 & ~0x80000000UL) == 0)) {\n\n xer_ca = 0;\n\n } else {\n\n xer_ca = 1;\n\n }\n\n }\n\n T0 = ret;\n\n}\n"}} {"sample_id": "439e2a6e10ed7f5da819bf7dcaa54b8cfdbeab0d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+ Aml *var = aml_opcode(0x88 /* IndexOp */);\n+\n+ aml_append(var, arg1);\n \n aml_append(var, idx);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "Aml *aml_index(Aml *arg1, Aml *idx)\n\n{\n\n Aml *var = aml_opcode(0x88 /* IndexOp */);\n\n aml_append(var, arg1);\n\n aml_append(var, idx);\n\n build_append_byte(var->buf, 0x00 /* NullNameOp */);\n\n return var;\n\n}\n"}} {"sample_id": "d135f3c514ac1723256c8e0f5cdd466fe98a2578", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,7 +11,7 @@\n int x, y;\n \n pixel *src = (pixel*)_src;\n+\n ptrdiff_t srcstride = _srcstride / sizeof(pixel);\n \n pixel *dst = (pixel *)_dst;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void FUNC(put_hevc_qpel_bi_w_h)(uint8_t *_dst, ptrdiff_t _dststride, uint8_t *_src, ptrdiff_t _srcstride,\n\n int16_t *src2,\n\n int height, int denom, int wx0, int wx1,\n\n int ox0, int ox1, intptr_t mx, intptr_t my, int width)\n\n{\n\n int x, y;\n\n pixel *src = (pixel*)_src;\n\n ptrdiff_t srcstride = _srcstride / sizeof(pixel);\n\n pixel *dst = (pixel *)_dst;\n\n ptrdiff_t dststride = _dststride / sizeof(pixel);\n\n\n\n const int8_t *filter = ff_hevc_qpel_filters[mx - 1];\n\n\n\n int shift = 14 + 1 - BIT_DEPTH;\n\n int log2Wd = denom + shift - 1;\n\n\n\n ox0 = ox0 * (1 << (BIT_DEPTH - 8));\n\n ox1 = ox1 * (1 << (BIT_DEPTH - 8));\n\n for (y = 0; y < height; y++) {\n\n for (x = 0; x < width; x++)\n\n dst[x] = av_clip_pixel(((QPEL_FILTER(src, 1) >> (BIT_DEPTH - 8)) * wx1 + src2[x] * wx0 +\n\n ((ox0 + ox1 + 1) << log2Wd)) >> (log2Wd + 1));\n\n src += srcstride;\n\n dst += dststride;\n\n src2 += MAX_PB_SIZE;\n\n }\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_144", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void put_int64(QEMUFile *f, void *pv, size_t size)\n+\n+{\n \n int64_t *v = pv;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void put_int64(QEMUFile *f, void *pv, size_t size)\n\n{\n\n int64_t *v = pv;\n\n qemu_put_sbe64s(f, v);\n\n}\n"}} {"sample_id": "bf8d492405feaee2c1685b3b9d5e03228ed3e47f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void pxb_host_class_init(ObjectClass *class, void *data)\n+\n+{\n+\n+ DeviceClass *dc = DEVICE_CLASS(class);\n+\n SysBusDeviceClass *sbc = SYS_BUS_DEVICE_CLASS(class);\n \n PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(class);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void pxb_host_class_init(ObjectClass *class, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(class);\n\n SysBusDeviceClass *sbc = SYS_BUS_DEVICE_CLASS(class);\n\n PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(class);\n\n\n\n dc->fw_name = \"pci\";\n\n\n\n sbc->explicit_ofw_unit_address = pxb_host_ofw_unit_address;\n\n hc->root_bus_path = pxb_host_root_bus_path;\n\n}"}} {"sample_id": "f0d2a4d4d63dd2f0f3ecb2d591b979b0e7f24a22", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n if (acb->canceled != 0) {\n \n return;\n+\n+ }\n+\n+\n+\n acb->status = 0;\n \n if (status != 0) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "iscsi_aio_read16_cb(struct iscsi_context *iscsi, int status,\n\n void *command_data, void *opaque)\n\n{\n\n IscsiAIOCB *acb = opaque;\n\n\n\n trace_iscsi_aio_read16_cb(iscsi, status, acb, acb->canceled);\n\n\n\n if (acb->canceled != 0) {\n\n return;\n\n }\n\n\n\n acb->status = 0;\n\n if (status != 0) {\n\n if (status == SCSI_STATUS_CHECK_CONDITION\n\n && acb->task->sense.key == SCSI_SENSE_UNIT_ATTENTION\n\n && acb->retries-- > 0) {\n\n if (acb->task != NULL) {\n\n scsi_free_scsi_task(acb->task);\n\n acb->task = NULL;\n\n }\n\n if (iscsi_aio_readv_acb(acb) == 0) {\n\n iscsi_set_events(acb->iscsilun);\n\n return;\n\n }\n\n }\n\n error_report(\"Failed to read16 data from iSCSI lun. %s\",\n\n iscsi_get_error(iscsi));\n\n acb->status = -EIO;\n\n }\n\n\n\n iscsi_schedule_bh(acb);\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+void OPPROTO op_addzeo (void)\n+\n+{\n \n do_addzeo();\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void OPPROTO op_addzeo (void)\n\n{\n\n do_addzeo();\n\n RETURN();\n\n}\n"}} {"sample_id": "bcd7bf7eeb09a395cc01698842d1b8be9af483fc_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n int32_t dst_stride,\n \n+ int32_t height,\n+\n+ int32_t log2_denom,\n+\n+ int32_t src_weight,\n \n int32_t dst_weight,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void avc_biwgt_4width_msa(uint8_t *src,\n\n int32_t src_stride,\n\n uint8_t *dst,\n\n int32_t dst_stride,\n\n int32_t height,\n\n int32_t log2_denom,\n\n int32_t src_weight,\n\n int32_t dst_weight,\n\n int32_t offset_in)\n\n{\n\n if (2 == height) {\n\n avc_biwgt_4x2_msa(src, src_stride, dst, dst_stride,\n\n log2_denom, src_weight, dst_weight,\n\n offset_in);\n\n } else {\n\n avc_biwgt_4x4multiple_msa(src, src_stride, dst, dst_stride,\n\n height, log2_denom, src_weight,\n\n dst_weight, offset_in);\n\n }\n\n}\n"}} {"sample_id": "3a1e8074d74ad2acbcedf28d35aebedc3573f19e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -52,11 +52,11 @@\n \n \n \n+ if (!vring_setup(&r->vring, VIRTIO_DEVICE(s), n)) {\n+\n+ fprintf(stderr, \"virtio-scsi: VRing setup failed\\n\");\n+\n+ goto fail_vring;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static VirtIOSCSIVring *virtio_scsi_vring_init(VirtIOSCSI *s,\n\n VirtQueue *vq,\n\n EventNotifierHandler *handler,\n\n int n)\n\n{\n\n BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(s)));\n\n VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);\n\n VirtIOSCSIVring *r;\n\n int rc;\n\n\n\n /* Set up virtqueue notify */\n\n rc = k->set_host_notifier(qbus->parent, n, true);\n\n if (rc != 0) {\n\n fprintf(stderr, \"virtio-scsi: Failed to set host notifier (%d)\\n\",\n\n rc);\n\n s->dataplane_fenced = true;\n\n return NULL;\n\n }\n\n\n\n r = g_new(VirtIOSCSIVring, 1);\n\n r->host_notifier = *virtio_queue_get_host_notifier(vq);\n\n r->guest_notifier = *virtio_queue_get_guest_notifier(vq);\n\n aio_set_event_notifier(s->ctx, &r->host_notifier, false,\n\n handler);\n\n\n\n r->parent = s;\n\n\n\n if (!vring_setup(&r->vring, VIRTIO_DEVICE(s), n)) {\n\n fprintf(stderr, \"virtio-scsi: VRing setup failed\\n\");\n\n goto fail_vring;\n\n }\n\n return r;\n\n\n\nfail_vring:\n\n aio_set_event_notifier(s->ctx, &r->host_notifier, false,\n\n NULL);\n\n k->set_host_notifier(qbus->parent, n, false);\n\n g_free(r);\n\n return NULL;\n\n}\n"}} {"sample_id": "a2db2a1edd06a50b8a862c654cf993368cf9f1d9_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,8 +16,8 @@\n \n timer_del(state->buffered_io_timer);\n \n+ xc_evtchn_unmask(state->xce_handle, state->bufioreq_local_port);\n+\n+ }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void handle_buffered_io(void *opaque)\n\n{\n\n XenIOState *state = opaque;\n\n\n\n if (handle_buffered_iopage(state)) {\n\n timer_mod(state->buffered_io_timer,\n\n BUFFER_IO_MAX_DELAY + qemu_clock_get_ms(QEMU_CLOCK_REALTIME));\n\n } else {\n\n timer_del(state->buffered_io_timer);\n\n xc_evtchn_unmask(state->xce_handle, state->bufioreq_local_port);\n\n }\n\n}\n"}} {"sample_id": "9ff7f5bddbe5814bafe5e798d2cf1087b58dc7b6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void exynos4210_init_board_irqs(Exynos4210Irq *s)\n \n {\n+\n uint32_t grp, bit, irq_id, n;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void exynos4210_init_board_irqs(Exynos4210Irq *s)\n\n{\n\n uint32_t grp, bit, irq_id, n;\n\n\n\n for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {\n\n s->board_irqs[n] = qemu_irq_split(s->int_combiner_irq[n],\n\n s->ext_combiner_irq[n]);\n\n\n\n irq_id = 0;\n\n if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 4) ||\n\n n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4)) {\n\n /* MCT_G0 is passed to External GIC */\n\n irq_id = EXT_GIC_ID_MCT_G0;\n\n }\n\n if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 5) ||\n\n n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 5)) {\n\n /* MCT_G1 is passed to External and GIC */\n\n irq_id = EXT_GIC_ID_MCT_G1;\n\n }\n\n if (irq_id) {\n\n s->board_irqs[n] = qemu_irq_split(s->int_combiner_irq[n],\n\n s->ext_gic_irq[irq_id-32]);\n\n }\n\n\n\n }\n\n for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {\n\n /* these IDs are passed to Internal Combiner and External GIC */\n\n grp = EXYNOS4210_COMBINER_GET_GRP_NUM(n);\n\n bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);\n\n irq_id = combiner_grp_to_gic_id[grp -\n\n EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];\n\n\n\n if (irq_id) {\n\n s->board_irqs[n] = qemu_irq_split(s->int_combiner_irq[n],\n\n s->ext_gic_irq[irq_id-32]);\n\n }\n\n }\n\n}\n"}} {"sample_id": "508a24f8dc63e74bd9917e6f0c4cdbb744741ef0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n \n \n avctx->pix_fmt = PIX_FMT_XVMC_MPEG2_IDCT;\n+\n+ avctx->xvmc_acceleration = 2;//2 - the blocks are packed!\n+\n+\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int mpeg_mc_decode_init(AVCodecContext *avctx){\n\n if( avctx->thread_count > 1)\n\n return -1;\n\n if( !(avctx->slice_flags & SLICE_FLAG_CODED_ORDER) )\n\n return -1;\n\n if( !(avctx->slice_flags & SLICE_FLAG_ALLOW_FIELD) ){\n\n av_dlog(avctx, \"mpeg12.c: XvMC decoder will work better if SLICE_FLAG_ALLOW_FIELD is set\\n\");\n\n }\n\n mpeg_decode_init(avctx);\n\n\n\n avctx->pix_fmt = PIX_FMT_XVMC_MPEG2_IDCT;\n\n avctx->xvmc_acceleration = 2;//2 - the blocks are packed!\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "4fa4ce7107c6ec432f185307158c5df91ce54308_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n \n \n if ((fs_ctx->export_flags & V9FS_SM_MAPPED) ||\n+\n+ (fs_ctx->export_flags & V9FS_SM_MAPPED_FILE)) {\n+\n+ int fd;\n+\n fd = open(rpath(fs_ctx, path, buffer), O_RDONLY | O_NOFOLLOW);\n \n if (fd == -1) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ssize_t local_readlink(FsContext *fs_ctx, V9fsPath *fs_path,\n\n char *buf, size_t bufsz)\n\n{\n\n ssize_t tsize = -1;\n\n char buffer[PATH_MAX];\n\n char *path = fs_path->data;\n\n\n\n if ((fs_ctx->export_flags & V9FS_SM_MAPPED) ||\n\n (fs_ctx->export_flags & V9FS_SM_MAPPED_FILE)) {\n\n int fd;\n\n fd = open(rpath(fs_ctx, path, buffer), O_RDONLY | O_NOFOLLOW);\n\n if (fd == -1) {\n\n return -1;\n\n }\n\n do {\n\n tsize = read(fd, (void *)buf, bufsz);\n\n } while (tsize == -1 && errno == EINTR);\n\n close(fd);\n\n return tsize;\n\n } else if ((fs_ctx->export_flags & V9FS_SM_PASSTHROUGH) ||\n\n (fs_ctx->export_flags & V9FS_SM_NONE)) {\n\n tsize = readlink(rpath(fs_ctx, path, buffer), buf, bufsz);\n\n }\n\n return tsize;\n\n}\n"}} {"sample_id": "d85f4222b4681da7ebf8a90b26e085a68fa2c55a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -44,11 +44,11 @@\n \n keybuf, G_N_ELEMENTS(keybuf),\n \n+ &err);\n+\n+\n+\n+ if (!s->cipher) {\n \n /* XXX would be nice if errors in this method could\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int qcow_set_key(BlockDriverState *bs, const char *key)\n\n{\n\n BDRVQcowState *s = bs->opaque;\n\n uint8_t keybuf[16];\n\n int len, i;\n\n Error *err;\n\n\n\n memset(keybuf, 0, 16);\n\n len = strlen(key);\n\n if (len > 16)\n\n len = 16;\n\n /* XXX: we could compress the chars to 7 bits to increase\n\n entropy */\n\n for(i = 0;i < len;i++) {\n\n keybuf[i] = key[i];\n\n }\n\n assert(bs->encrypted);\n\n\n\n qcrypto_cipher_free(s->cipher);\n\n s->cipher = qcrypto_cipher_new(\n\n QCRYPTO_CIPHER_ALG_AES_128,\n\n QCRYPTO_CIPHER_MODE_CBC,\n\n keybuf, G_N_ELEMENTS(keybuf),\n\n &err);\n\n\n\n if (!s->cipher) {\n\n /* XXX would be nice if errors in this method could\n\n * be properly propagate to the caller. Would need\n\n * the bdrv_set_key() API signature to be fixed. */\n\n error_free(err);\n\n return -1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "5dafc53f1fb091d242f2179ffcb43bb28af36d1e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+void qemu_fclose(QEMUFile *f)\n+\n+{\n+\n if (f->is_writable)\n \n qemu_fflush(f);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_fclose(QEMUFile *f)\n\n{\n\n if (f->is_writable)\n\n qemu_fflush(f);\n\n if (f->is_file) {\n\n fclose(f->outfile);\n\n }\n\n qemu_free(f);\n\n}\n"}} {"sample_id": "1b37b3442f78a77844fdaf7f53e5f04e4ce8f1d6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n {\n \n g_free(gconf->server);\n+\n+ g_free(gconf->volname);\n+\n g_free(gconf->image);\n \n g_free(gconf->transport);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_gluster_gconf_free(GlusterConf *gconf)\n\n{\n\n g_free(gconf->server);\n\n g_free(gconf->volname);\n\n g_free(gconf->image);\n\n g_free(gconf->transport);\n\n g_free(gconf);\n\n}\n"}} {"sample_id": "7a2efd2e447d5e7c7c0af61417a838b042fb7d0a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n av_crc_init(crc_2D, 0, 16, 0x002D, sizeof(crc_2D));\n \n+ crc_init_2D = 1;\n+\n+ }\n+\n \n \n return 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int av_cold ff_mlp_init_crc2D(AVCodecParserContext *s)\n\n{\n\n if (!crc_init_2D) {\n\n av_crc_init(crc_2D, 0, 16, 0x002D, sizeof(crc_2D));\n\n crc_init_2D = 1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "2b75f848238651ef1bb407f66fa38d68775782bf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n GSList *list = NULL, *item;\n \n ram_addr_t size = ram_size;\n+\n+\n+\n+ pc_dimm_build_list(qdev_get_machine(), &list);\n+\n for (item = list; item; item = g_slist_next(item)) {\n \n Object *obj = OBJECT(item->data);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static ram_addr_t get_current_ram_size(void)\n\n{\n\n GSList *list = NULL, *item;\n\n ram_addr_t size = ram_size;\n\n\n\n pc_dimm_build_list(qdev_get_machine(), &list);\n\n for (item = list; item; item = g_slist_next(item)) {\n\n Object *obj = OBJECT(item->data);\n\n size += object_property_get_int(obj, PC_DIMM_SIZE_PROP, &error_abort);\n\n }\n\n g_slist_free(list);\n\n\n\n return size;\n\n}\n"}} {"sample_id": "88b062c2036cfd05b5111147736a08ba05ea05a9_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n qed_write_l2_table(s, request, index, n, flush, qed_sync_cb, &ret);\n \n while (ret == -EINPROGRESS) {\n+\n+ aio_poll(bdrv_get_aio_context(s->bs), true);\n+\n+ }\n+\n \n \n return ret;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qed_write_l2_table_sync(BDRVQEDState *s, QEDRequest *request,\n\n unsigned int index, unsigned int n, bool flush)\n\n{\n\n int ret = -EINPROGRESS;\n\n\n\n qed_write_l2_table(s, request, index, n, flush, qed_sync_cb, &ret);\n\n while (ret == -EINPROGRESS) {\n\n aio_poll(bdrv_get_aio_context(s->bs), true);\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_232", "diff": "--- a/source.c\n+++ b/source.c\n@@ -59,11 +59,11 @@\n default:\n \n error_report(\"milkymist_pfpu: read access to unknown register 0x\"\n+\n+ TARGET_FMT_plx, addr << 2);\n+\n+ break;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t pfpu_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n MilkymistPFPUState *s = opaque;\n\n uint32_t r = 0;\n\n\n\n addr >>= 2;\n\n switch (addr) {\n\n case R_CTL:\n\n case R_MESHBASE:\n\n case R_HMESHLAST:\n\n case R_VMESHLAST:\n\n case R_CODEPAGE:\n\n case R_VERTICES:\n\n case R_COLLISIONS:\n\n case R_STRAYWRITES:\n\n case R_LASTDMA:\n\n case R_PC:\n\n case R_DREGBASE:\n\n case R_CODEBASE:\n\n r = s->regs[addr];\n\n break;\n\n case GPR_BEGIN ... GPR_END:\n\n r = s->gp_regs[addr - GPR_BEGIN];\n\n break;\n\n case MICROCODE_BEGIN ... MICROCODE_END:\n\n r = s->microcode[get_microcode_address(s, addr)];\n\n break;\n\n\n\n default:\n\n error_report(\"milkymist_pfpu: read access to unknown register 0x\"\n\n TARGET_FMT_plx, addr << 2);\n\n break;\n\n }\n\n\n\n trace_milkymist_pfpu_memory_read(addr << 2, r);\n\n\n\n return r;\n\n}\n"}} {"sample_id": "d0cc2fbfa607678866475383c508be84818ceb64_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,6 +6,6 @@\n \n int r = write(e->fd, &value, sizeof(value));\n \n+ return r == sizeof(value);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int event_notifier_set(EventNotifier *e)\n\n{\n\n uint64_t value = 1;\n\n int r = write(e->fd, &value, sizeof(value));\n\n return r == sizeof(value);\n\n}\n"}} {"sample_id": "30e5210a706ca6b52cbefa8b71e40ae614ffd6e5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n qapi_event_send_watchdog(WATCHDOG_EXPIRATION_ACTION_RESET, &error_abort);\n \n qemu_system_reset_request();\n+\n break;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "void watchdog_perform_action(void)\n\n{\n\n switch (watchdog_action) {\n\n case WDT_RESET: /* same as 'system_reset' in monitor */\n\n qapi_event_send_watchdog(WATCHDOG_EXPIRATION_ACTION_RESET, &error_abort);\n\n qemu_system_reset_request();\n\n break;\n\n\n\n case WDT_SHUTDOWN: /* same as 'system_powerdown' in monitor */\n\n qapi_event_send_watchdog(WATCHDOG_EXPIRATION_ACTION_SHUTDOWN, &error_abort);\n\n qemu_system_powerdown_request();\n\n break;\n\n\n\n case WDT_POWEROFF: /* same as 'quit' command in monitor */\n\n qapi_event_send_watchdog(WATCHDOG_EXPIRATION_ACTION_POWEROFF, &error_abort);\n\n exit(0);\n\n\n\n case WDT_PAUSE: /* same as 'stop' command in monitor */\n\n qapi_event_send_watchdog(WATCHDOG_EXPIRATION_ACTION_PAUSE, &error_abort);\n\n vm_stop(RUN_STATE_WATCHDOG);\n\n break;\n\n\n\n case WDT_DEBUG:\n\n qapi_event_send_watchdog(WATCHDOG_EXPIRATION_ACTION_DEBUG, &error_abort);\n\n fprintf(stderr, \"watchdog: timer fired\\n\");\n\n break;\n\n\n\n case WDT_NONE:\n\n qapi_event_send_watchdog(WATCHDOG_EXPIRATION_ACTION_NONE, &error_abort);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "37ec7d291eacedfacdce21332f4c719f2be79d12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n init_get_bits(gb, avctx->extradata, avctx->extradata_size * 8);\n \n+ ret = ff_mpeg4_decode_picture_header(dec_ctx, gb);\n+\n+\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int mpeg4_decode_header(AVCodecParserContext *s1, AVCodecContext *avctx,\n\n const uint8_t *buf, int buf_size)\n\n{\n\n struct Mp4vParseContext *pc = s1->priv_data;\n\n Mpeg4DecContext *dec_ctx = &pc->dec_ctx;\n\n MpegEncContext *s = &dec_ctx->m;\n\n GetBitContext gb1, *gb = &gb1;\n\n int ret;\n\n\n\n s->avctx = avctx;\n\n s->current_picture_ptr = &s->current_picture;\n\n\n\n if (avctx->extradata_size && pc->first_picture) {\n\n init_get_bits(gb, avctx->extradata, avctx->extradata_size * 8);\n\n ret = ff_mpeg4_decode_picture_header(dec_ctx, gb);\n\n\n\n }\n\n\n\n init_get_bits(gb, buf, 8 * buf_size);\n\n ret = ff_mpeg4_decode_picture_header(dec_ctx, gb);\n\n if (s->width && (!avctx->width || !avctx->height ||\n\n !avctx->coded_width || !avctx->coded_height)) {\n\n ret = ff_set_dimensions(avctx, s->width, s->height);\n\n\n return ret;\n\n }\n\n if((s1->flags & PARSER_FLAG_USE_CODEC_TS) && s->avctx->time_base.den>0 && ret>=0){\n\n av_assert1(s1->pts == AV_NOPTS_VALUE);\n\n av_assert1(s1->dts == AV_NOPTS_VALUE);\n\n\n\n s1->pts = av_rescale_q(s->time, (AVRational){1, s->avctx->time_base.den}, (AVRational){1, 1200000});\n\n }\n\n\n\n s1->pict_type = s->pict_type;\n\n pc->first_picture = 0;\n\n return ret;\n\n}"}} {"sample_id": "ddca7f86ac022289840e0200fd4050b2b58e9176_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,5 +5,5 @@\n {\n \n return v9fs_packunpack(dst, out_sg, out_num, offset, size, 0);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static size_t v9fs_unpack(void *dst, struct iovec *out_sg, int out_num,\n\n size_t offset, size_t size)\n\n{\n\n return v9fs_packunpack(dst, out_sg, out_num, offset, size, 0);\n\n}\n"}} {"sample_id": "debaaa114a8877a939533ba846e64168fb287b7b_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,10 +7,10 @@\n \n \n ahci = ahci_boot();\n+\n+ ahci_pci_enable(ahci);\n+\n+ ahci_test_hba_spec(ahci);\n \n ahci_shutdown(ahci);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_hba_spec(void)\n\n{\n\n AHCIQState *ahci;\n\n\n\n ahci = ahci_boot();\n\n ahci_pci_enable(ahci);\n\n ahci_test_hba_spec(ahci);\n\n ahci_shutdown(ahci);\n\n}\n"}} {"sample_id": "28213cb6a61a724e2cb1e3a76d2bb17aa0ce9b36_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -47,11 +47,11 @@\n h->asl_compiler_revision = cpu_to_le32(1);\n \n h->checksum = 0;\n+\n+ /* Checksum to be filled in by Guest linker */\n+\n+ bios_linker_loader_add_checksum(linker, ACPI_BUILD_TABLE_FILE,\n+\n h, len, &h->checksum);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "build_header(BIOSLinker *linker, GArray *table_data,\n\n AcpiTableHeader *h, const char *sig, int len, uint8_t rev,\n\n const char *oem_id, const char *oem_table_id)\n\n{\n\n memcpy(&h->signature, sig, 4);\n\n h->length = cpu_to_le32(len);\n\n h->revision = rev;\n\n\n\n if (oem_id) {\n\n strncpy((char *)h->oem_id, oem_id, sizeof h->oem_id);\n\n } else {\n\n memcpy(h->oem_id, ACPI_BUILD_APPNAME6, 6);\n\n }\n\n\n\n if (oem_table_id) {\n\n strncpy((char *)h->oem_table_id, oem_table_id, sizeof(h->oem_table_id));\n\n } else {\n\n memcpy(h->oem_table_id, ACPI_BUILD_APPNAME4, 4);\n\n memcpy(h->oem_table_id + 4, sig, 4);\n\n }\n\n\n\n h->oem_revision = cpu_to_le32(1);\n\n memcpy(h->asl_compiler_id, ACPI_BUILD_APPNAME4, 4);\n\n h->asl_compiler_revision = cpu_to_le32(1);\n\n h->checksum = 0;\n\n /* Checksum to be filled in by Guest linker */\n\n bios_linker_loader_add_checksum(linker, ACPI_BUILD_TABLE_FILE,\n\n h, len, &h->checksum);\n\n}\n"}} {"sample_id": "7c9e527659c67d4d7b41d9504f93d2d7ee482488", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static BlockAIOCB *hdev_aio_ioctl(BlockDriverState *bs,\n unsigned long int req, void *buf,\n+ BlockCompletionFunc *cb, void *opaque)\n+{\n+ BDRVRawState *s = bs->opaque;\n+ RawPosixAIOData *acb;\n ThreadPool *pool;\n if (fd_open(bs) < 0)\n return NULL;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static BlockAIOCB *hdev_aio_ioctl(BlockDriverState *bs,\n unsigned long int req, void *buf,\n BlockCompletionFunc *cb, void *opaque)\n{\n BDRVRawState *s = bs->opaque;\n RawPosixAIOData *acb;\n ThreadPool *pool;\n if (fd_open(bs) < 0)\n return NULL;\n acb = g_new(RawPosixAIOData, 1);\n acb->bs = bs;\n acb->aio_type = QEMU_AIO_IOCTL;\n acb->aio_fildes = s->fd;\n acb->aio_offset = 0;\n acb->aio_ioctl_buf = buf;\n acb->aio_ioctl_cmd = req;\n pool = aio_get_thread_pool(bdrv_get_aio_context(bs));\n return thread_pool_submit_aio(pool, aio_worker, acb, cb, opaque);"}} {"sample_id": "0d6ff71ae3c7ac3a446d295ef71884a05093b37c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n const struct ip *iph = (const struct ip *)ifm->m_data;\n \n+ int ret;\n+\n+\n+\n+ if (ifm->m_len + ETH_HLEN > sizeof(buf)) {\n \n return 1;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int if_encap(Slirp *slirp, struct mbuf *ifm)\n\n{\n\n uint8_t buf[1600];\n\n struct ethhdr *eh = (struct ethhdr *)buf;\n\n uint8_t ethaddr[ETH_ALEN];\n\n const struct ip *iph = (const struct ip *)ifm->m_data;\n\n int ret;\n\n\n\n if (ifm->m_len + ETH_HLEN > sizeof(buf)) {\n\n return 1;\n\n }\n\n\n\n switch (iph->ip_v) {\n\n case IPVERSION:\n\n ret = if_encap4(slirp, ifm, eh, ethaddr);\n\n if (ret < 2) {\n\n return ret;\n\n }\n\n break;\n\n\n\n default:\n\n /* Do not assert while we don't manage IP6VERSION */\n\n /* assert(0); */\n\n break;\n\n }\n\n\n\n memcpy(eh->h_dest, ethaddr, ETH_ALEN);\n\n DEBUG_ARGS((dfd, \" src = %02x:%02x:%02x:%02x:%02x:%02x\\n\",\n\n eh->h_source[0], eh->h_source[1], eh->h_source[2],\n\n eh->h_source[3], eh->h_source[4], eh->h_source[5]));\n\n DEBUG_ARGS((dfd, \" dst = %02x:%02x:%02x:%02x:%02x:%02x\\n\",\n\n eh->h_dest[0], eh->h_dest[1], eh->h_dest[2],\n\n eh->h_dest[3], eh->h_dest[4], eh->h_dest[5]));\n\n memcpy(buf + sizeof(struct ethhdr), ifm->m_data, ifm->m_len);\n\n slirp_output(slirp->opaque, buf, ifm->m_len + ETH_HLEN);\n\n return 1;\n\n}\n"}} {"sample_id": "363e13f86eb60bce1e112a35a4c107505a69c9fe_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void test_visitor_out_enum(TestOutputVisitorData *data,\n \n+ const void *unused)\n+\n+{\n+\n+ QObject *obj;\n \n EnumOne i;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_visitor_out_enum(TestOutputVisitorData *data,\n\n const void *unused)\n\n{\n\n QObject *obj;\n\n EnumOne i;\n\n\n\n for (i = 0; i < ENUM_ONE__MAX; i++) {\n\n visit_type_EnumOne(data->ov, \"unused\", &i, &error_abort);\n\n\n\n obj = visitor_get(data);\n\n g_assert(qobject_type(obj) == QTYPE_QSTRING);\n\n g_assert_cmpstr(qstring_get_str(qobject_to_qstring(obj)), ==,\n\n EnumOne_lookup[i]);\n\n visitor_reset(data);\n\n }\n\n}\n"}} {"sample_id": "45fe15c25a5c9feea6e0f78434f5e9f632de9d94_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void msi_uninit(struct PCIDevice *dev)\n+\n+{\n \n uint16_t flags = pci_get_word(dev->config + msi_flags_off(dev));\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void msi_uninit(struct PCIDevice *dev)\n\n{\n\n uint16_t flags = pci_get_word(dev->config + msi_flags_off(dev));\n\n uint8_t cap_size = msi_cap_sizeof(flags);\n\n pci_del_capability(dev, PCI_CAP_ID_MSIX, cap_size);\n\n MSI_DEV_PRINTF(dev, \"uninit\\n\");\n\n}\n"}} {"sample_id": "5dd7a535b71a0f2f8e7af75c5d694174359ce323", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,8 +5,8 @@\n struct iscsi_context *iscsi = iscsilun->iscsi;\n \n int ev = iscsi_which_events(iscsi);\n+\n+\n \n if (ev != iscsilun->events) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "iscsi_set_events(IscsiLun *iscsilun)\n\n{\n\n struct iscsi_context *iscsi = iscsilun->iscsi;\n\n int ev = iscsi_which_events(iscsi);\n\n\n\n if (ev != iscsilun->events) {\n\n aio_set_fd_handler(iscsilun->aio_context,\n\n iscsi_get_fd(iscsi),\n\n (ev & POLLIN) ? iscsi_process_read : NULL,\n\n (ev & POLLOUT) ? iscsi_process_write : NULL,\n\n iscsilun);\n\n iscsilun->events = ev;\n\n }\n\n\n\n /* newer versions of libiscsi may return zero events. In this\n\n * case start a timer to ensure we are able to return to service\n\n * once this situation changes. */\n\n if (!ev) {\n\n timer_mod(iscsilun->event_timer,\n\n qemu_clock_get_ms(QEMU_CLOCK_REALTIME) + EVENT_INTERVAL);\n\n }\n\n}\n"}} {"sample_id": "8f5d58ef2c92d7b82d9a6eeefd7c8854a183ba4a_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void isa_ipmi_bmc_check(Object *obj, const char *name,\n \n Object *val, Error **errp)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void isa_ipmi_bmc_check(Object *obj, const char *name,\n\n Object *val, Error **errp)\n\n{\n\n IPMIBmc *bmc = IPMI_BMC(val);\n\n\n\n if (bmc->intf)\n\n error_setg(errp, \"BMC object is already in use\");\n\n}\n"}} {"sample_id": "4782a23b270ecbb9ce0ca6f3f1b60857a09cef0e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void do_svc_interrupt(CPUS390XState *env)\n \n {\n+\n+ uint64_t mask, addr;\n+\n+ LowCore *lowcore;\n+\n hwaddr len = TARGET_PAGE_SIZE;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void do_svc_interrupt(CPUS390XState *env)\n\n{\n\n uint64_t mask, addr;\n\n LowCore *lowcore;\n\n hwaddr len = TARGET_PAGE_SIZE;\n\n\n\n lowcore = cpu_physical_memory_map(env->psa, &len, 1);\n\n\n\n lowcore->svc_code = cpu_to_be16(env->int_svc_code);\n\n lowcore->svc_ilen = cpu_to_be16(env->int_svc_ilen);\n\n lowcore->svc_old_psw.mask = cpu_to_be64(get_psw_mask(env));\n\n lowcore->svc_old_psw.addr = cpu_to_be64(env->psw.addr + env->int_svc_ilen);\n\n mask = be64_to_cpu(lowcore->svc_new_psw.mask);\n\n addr = be64_to_cpu(lowcore->svc_new_psw.addr);\n\n\n\n cpu_physical_memory_unmap(lowcore, len, 1, len);\n\n\n\n load_psw(env, mask, addr);\n\n}\n"}} {"sample_id": "f8b0aa25599782eef91edc00ebf620bd14db720c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n \t * Since we stacked the signal on a 64-bit boundary,\n \n \t * then 'sp' should be word aligned here. If it's\n+\n+\t * not, then the user is trying to mess with us.\n+\n+\t */\n+\n \tif (env->regs[13] & 7)\n \n \t\tgoto badframe;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "long do_rt_sigreturn(CPUState *env)\n\n{\n\n\tstruct rt_sigframe *frame;\n\n sigset_t host_set;\n\n\n\n\t/*\n\n\t * Since we stacked the signal on a 64-bit boundary,\n\n\t * then 'sp' should be word aligned here. If it's\n\n\t * not, then the user is trying to mess with us.\n\n\t */\n\n\tif (env->regs[13] & 7)\n\n\t\tgoto badframe;\n\n\n\n\tframe = (struct rt_sigframe *)env->regs[13];\n\n\n\n#if 0\n\n\tif (verify_area(VERIFY_READ, frame, sizeof (*frame)))\n\n\t\tgoto badframe;\n\n#endif\n\n target_to_host_sigset(&host_set, &frame->uc.tuc_sigmask);\n\n sigprocmask(SIG_SETMASK, &host_set, NULL);\n\n\n\n\tif (restore_sigcontext(env, &frame->uc.tuc_mcontext))\n\n\t\tgoto badframe;\n\n\n\n\tif (do_sigaltstack(h2g(&frame->uc.tuc_stack), 0, get_sp_from_cpustate(env)) == -EFAULT)\n\n\t\tgoto badframe;\n\n\n\n#if 0\n\n\t/* Send SIGTRAP if we're single-stepping */\n\n\tif (ptrace_cancel_bpt(current))\n\n\t\tsend_sig(SIGTRAP, current, 1);\n\n#endif\n\n\treturn env->regs[0];\n\n\n\nbadframe:\n\n force_sig(SIGSEGV /* , current */);\n\n\treturn 0;\n\n}\n"}} {"sample_id": "950d94ba0671e7f154a9e87a277f8efbddcee28f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,8 +2,8 @@\n \n VirtIODevice *dev)\n \n+{\n+\n struct vhost_vring_file file = { .fd = -1 };\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void vhost_net_stop_one(struct vhost_net *net,\n\n VirtIODevice *dev)\n\n{\n\n struct vhost_vring_file file = { .fd = -1 };\n\n\n\n if (net->nc->info->type == NET_CLIENT_DRIVER_TAP) {\n\n for (file.index = 0; file.index < net->dev.nvqs; ++file.index) {\n\n const VhostOps *vhost_ops = net->dev.vhost_ops;\n\n int r = vhost_ops->vhost_net_set_backend(&net->dev, &file);\n\n assert(r >= 0);\n\n }\n\n }\n\n if (net->nc->info->poll) {\n\n net->nc->info->poll(net->nc, true);\n\n }\n\n vhost_dev_stop(&net->dev, dev);\n\n vhost_dev_disable_notifiers(&net->dev, dev);\n\n}\n"}} {"sample_id": "e701cd96c2d5dc034e7615967d208db3d953e111", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n av_assert0(AV_SAMPLE_FMT_DBLP == 9);\n \n+ av_assert0(AVMEDIA_TYPE_ATTACHMENT == 4);\n+\n+ av_assert0(AV_PICTURE_TYPE_BI == 7);\n+\n+ av_assert0(LIBAVUTIL_VERSION_MICRO >= 100);\n \n av_assert0(HAVE_MMX2 == HAVE_MMXEXT);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "unsigned avutil_version(void)\n\n{\n\n av_assert0(AV_PIX_FMT_VDA_VLD == 81); //check if the pix fmt enum has not had anything inserted or removed by mistake\n\n av_assert0(AV_SAMPLE_FMT_DBLP == 9);\n\n av_assert0(AVMEDIA_TYPE_ATTACHMENT == 4);\n\n av_assert0(AV_PICTURE_TYPE_BI == 7);\n\n av_assert0(LIBAVUTIL_VERSION_MICRO >= 100);\n\n av_assert0(HAVE_MMX2 == HAVE_MMXEXT);\n\n\n\n if (av_sat_dadd32(1, 2) != 5) {\n\n av_log(NULL, AV_LOG_FATAL, \"Libavutil has been build with a broken binutils, please upgrade binutils and rebuild\\n\");\n\n abort();\n\n }\n\n\n\n ff_check_pixfmt_descriptors();\n\n\n\n return LIBAVUTIL_VERSION_INT;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_33", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n \n \n+ /* If we cannot merge it, we flush the current buffer first. */\n+\n+ if (!qemu_rdma_buffer_mergable(rdma, current_addr, len)) {\n+\n+ ret = qemu_rdma_write_flush(f, rdma);\n \n if (ret) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int qemu_rdma_write(QEMUFile *f, RDMAContext *rdma,\n\n uint64_t block_offset, uint64_t offset,\n\n uint64_t len)\n\n{\n\n uint64_t current_addr = block_offset + offset;\n\n uint64_t index = rdma->current_index;\n\n uint64_t chunk = rdma->current_chunk;\n\n int ret;\n\n\n\n /* If we cannot merge it, we flush the current buffer first. */\n\n if (!qemu_rdma_buffer_mergable(rdma, current_addr, len)) {\n\n ret = qemu_rdma_write_flush(f, rdma);\n\n if (ret) {\n\n return ret;\n\n }\n\n rdma->current_length = 0;\n\n rdma->current_addr = current_addr;\n\n\n\n ret = qemu_rdma_search_ram_block(rdma, block_offset,\n\n offset, len, &index, &chunk);\n\n if (ret) {\n\n fprintf(stderr, \"ram block search failed\\n\");\n\n return ret;\n\n }\n\n rdma->current_index = index;\n\n rdma->current_chunk = chunk;\n\n }\n\n\n\n /* merge it */\n\n rdma->current_length += len;\n\n\n\n /* flush it if buffer is too large */\n\n if (rdma->current_length >= RDMA_MERGE_MAX) {\n\n return qemu_rdma_write_flush(f, rdma);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "ca2209d67af0a73fe0edb2fce1cea2445dbfd8db", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n HEVCParserContext *ctx = s->priv_data;\n \n ParseContext *pc = &ctx->pc;\n+\n int i;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int hevc_find_frame_end(AVCodecParserContext *s, const uint8_t *buf,\n\n int buf_size)\n\n{\n\n HEVCParserContext *ctx = s->priv_data;\n\n ParseContext *pc = &ctx->pc;\n\n int i;\n\n\n\n for (i = 0; i < buf_size; i++) {\n\n int nut;\n\n\n\n pc->state64 = (pc->state64 << 8) | buf[i];\n\n\n\n if (((pc->state64 >> 3 * 8) & 0xFFFFFF) != START_CODE)\n\n continue;\n\n\n\n nut = (pc->state64 >> 2 * 8 + 1) & 0x3F;\n\n // Beginning of access unit\n\n if ((nut >= HEVC_NAL_VPS && nut <= HEVC_NAL_AUD) || nut == HEVC_NAL_SEI_PREFIX ||\n\n (nut >= 41 && nut <= 44) || (nut >= 48 && nut <= 55)) {\n\n if (pc->frame_start_found) {\n\n pc->frame_start_found = 0;\n\n return i - 5;\n\n }\n\n } else if (nut <= HEVC_NAL_RASL_R ||\n\n (nut >= HEVC_NAL_BLA_W_LP && nut <= HEVC_NAL_CRA_NUT)) {\n\n int first_slice_segment_in_pic_flag = buf[i] >> 7;\n\n if (first_slice_segment_in_pic_flag) {\n\n if (!pc->frame_start_found) {\n\n pc->frame_start_found = 1;\n\n } else { // First slice of next frame found\n\n pc->frame_start_found = 0;\n\n return i - 5;\n\n }\n\n }\n\n }\n\n }\n\n\n\n return END_NOT_FOUND;\n\n}\n"}} {"sample_id": "cc276c85d15272df6e44fb3252657a43cbd49555_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n snprintf(buf, buf_size, \"%d channels\", nb_channels);\n \n+ if (channel_layout) {\n+\n+ int i, ch;\n+\n+ av_strlcat(buf, \" (\", buf_size);\n \n for (i = 0, ch = 0; i < 64; i++) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void av_get_channel_layout_string(char *buf, int buf_size,\n\n int nb_channels, int64_t channel_layout)\n\n{\n\n int i;\n\n\n\n if (nb_channels <= 0)\n\n nb_channels = av_get_channel_layout_nb_channels(channel_layout);\n\n\n\n for (i = 0; channel_layout_map[i].name; i++)\n\n if (nb_channels == channel_layout_map[i].nb_channels &&\n\n channel_layout == channel_layout_map[i].layout) {\n\n av_strlcpy(buf, channel_layout_map[i].name, buf_size);\n\n return;\n\n }\n\n\n\n snprintf(buf, buf_size, \"%d channels\", nb_channels);\n\n if (channel_layout) {\n\n int i, ch;\n\n av_strlcat(buf, \" (\", buf_size);\n\n for (i = 0, ch = 0; i < 64; i++) {\n\n if ((channel_layout & (1L << i))) {\n\n const char *name = get_channel_name(i);\n\n if (name) {\n\n if (ch > 0)\n\n av_strlcat(buf, \"|\", buf_size);\n\n av_strlcat(buf, name, buf_size);\n\n }\n\n ch++;\n\n }\n\n }\n\n av_strlcat(buf, \")\", buf_size);\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_276", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n for (i = 0; i < regs_number; i++) {\n \n+ if (offset == exynos4210_uart_regs[i].offset) {\n+\n+ return exynos4210_uart_regs[i].name;\n+\n+ }\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static const char *exynos4210_uart_regname(target_phys_addr_t offset)\n\n{\n\n\n\n int regs_number = sizeof(exynos4210_uart_regs) / sizeof(Exynos4210UartReg);\n\n int i;\n\n\n\n for (i = 0; i < regs_number; i++) {\n\n if (offset == exynos4210_uart_regs[i].offset) {\n\n return exynos4210_uart_regs[i].name;\n\n }\n\n }\n\n\n\n return NULL;\n\n}\n"}} {"sample_id": "cc785c349de002596a4f4d116e62846fc18d7b9e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n printf(\"offset %\" PRId64 \" is not sector aligned\\n\",\n \n+ offset);\n+\n+ return 0;\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int alloc_f(int argc, char **argv)\n\n{\n\n int64_t offset;\n\n int nb_sectors, remaining;\n\n char s1[64];\n\n int num, sum_alloc;\n\n int ret;\n\n\n\n offset = cvtnum(argv[1]);\n\n if (offset & 0x1ff) {\n\n printf(\"offset %\" PRId64 \" is not sector aligned\\n\",\n\n offset);\n\n return 0;\n\n }\n\n\n\n if (argc == 3) {\n\n nb_sectors = cvtnum(argv[2]);\n\n } else {\n\n nb_sectors = 1;\n\n }\n\n\n\n remaining = nb_sectors;\n\n sum_alloc = 0;\n\n while (remaining) {\n\n ret = bdrv_is_allocated(bs, offset >> 9, nb_sectors, &num);\n\n remaining -= num;\n\n if (ret) {\n\n sum_alloc += num;\n\n }\n\n }\n\n\n\n cvtstr(offset, s1, sizeof(s1));\n\n\n\n printf(\"%d/%d sectors allocated at offset %s\\n\",\n\n sum_alloc, nb_sectors, s1);\n\n return 0;\n\n}\n"}} {"sample_id": "7474f1be701f136b224af5e1abe55e97dc3f29a5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n return NULL;\n \n+ }\n+\n+ dev = DEVICE(object_new(type));\n+\n+ if (!dev) {\n \n return NULL;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "DeviceState *qdev_try_create(BusState *bus, const char *type)\n\n{\n\n DeviceState *dev;\n\n\n\n if (object_class_by_name(type) == NULL) {\n\n return NULL;\n\n }\n\n dev = DEVICE(object_new(type));\n\n if (!dev) {\n\n return NULL;\n\n }\n\n\n\n if (!bus) {\n\n\n\n\n\n\n\n bus = sysbus_get_default();\n\n }\n\n\n\n qdev_set_parent_bus(dev, bus);\n\n object_unref(OBJECT(dev));\n\n return dev;\n\n}"}} {"sample_id": "6e0d8677cb443e7408c0b7a25a93c6596d7fa380", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void OPPROTO op_mov_T0_cc(void)\n \n+{\n \n T0 = cc_table[CC_OP].compute_all();\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void OPPROTO op_mov_T0_cc(void)\n\n{\n\n T0 = cc_table[CC_OP].compute_all();\n\n}\n"}} {"sample_id": "0ddbd0536296f5a36c8f225edd4d14441be6b153", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n \n \n if (!kvmppc_get_pvinfo(env, &pvinfo)) {\n+\n memcpy(buf, pvinfo.hcall, buf_len);\n \n return 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int kvmppc_get_hypercall(CPUPPCState *env, uint8_t *buf, int buf_len)\n\n{\n\n uint32_t *hc = (uint32_t*)buf;\n\n struct kvm_ppc_pvinfo pvinfo;\n\n\n\n if (!kvmppc_get_pvinfo(env, &pvinfo)) {\n\n memcpy(buf, pvinfo.hcall, buf_len);\n\n return 0;\n\n }\n\n\n\n /*\n\n * Fallback to always fail hypercalls regardless of endianness:\n\n *\n\n * tdi 0,r0,72 (becomes b .+8 in wrong endian, nop in good endian)\n\n * li r3, -1\n\n * b .+8 (becomes nop in wrong endian)\n\n * bswap32(li r3, -1)\n\n */\n\n\n\n hc[0] = cpu_to_be32(0x08000048);\n\n hc[1] = cpu_to_be32(0x3860ffff);\n\n hc[2] = cpu_to_be32(0x48000008);\n\n hc[3] = cpu_to_be32(bswap32(0x3860ffff));\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "4be746345f13e99e468c60acbd3a355e8183e3ce_71", "diff": "--- a/source.c\n+++ b/source.c\n@@ -38,11 +38,11 @@\n \n /* LCHS guess with heads <= 16: use as physical geometry */\n \n+ *pcyls = cylinders;\n+\n+ *pheads = heads;\n+\n+ *psecs = secs;\n \n /* disable any translation to be in sync with\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void hd_geometry_guess(BlockDriverState *bs,\n\n uint32_t *pcyls, uint32_t *pheads, uint32_t *psecs,\n\n int *ptrans)\n\n{\n\n int cylinders, heads, secs, translation;\n\n\n\n if (guess_disk_lchs(bs, &cylinders, &heads, &secs) < 0) {\n\n /* no LCHS guess: use a standard physical disk geometry */\n\n guess_chs_for_size(bs, pcyls, pheads, psecs);\n\n translation = hd_bios_chs_auto_trans(*pcyls, *pheads, *psecs);\n\n } else if (heads > 16) {\n\n /* LCHS guess with heads > 16 means that a BIOS LBA\n\n translation was active, so a standard physical disk\n\n geometry is OK */\n\n guess_chs_for_size(bs, pcyls, pheads, psecs);\n\n translation = *pcyls * *pheads <= 131072\n\n ? BIOS_ATA_TRANSLATION_LARGE\n\n : BIOS_ATA_TRANSLATION_LBA;\n\n } else {\n\n /* LCHS guess with heads <= 16: use as physical geometry */\n\n *pcyls = cylinders;\n\n *pheads = heads;\n\n *psecs = secs;\n\n /* disable any translation to be in sync with\n\n the logical geometry */\n\n translation = BIOS_ATA_TRANSLATION_NONE;\n\n }\n\n if (ptrans) {\n\n *ptrans = translation;\n\n }\n\n trace_hd_geometry_guess(bs, *pcyls, *pheads, *psecs, translation);\n\n}\n"}} {"sample_id": "15c2f669e3fb2bc97f7b42d1871f595c0ac24af8_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n {\n \n+ Error *err = NULL;\n \n VirtIOBalloon *s = opaque;\n \n@@ -17,12 +17,12 @@\n if (err) {\n \n goto out;\n+\n }\n \n+ visit_type_int(v, \"last-update\", &s->stats_last_update, &err);\n+\n+ if (err) {\n \n goto out_end;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void balloon_stats_get_all(Object *obj, Visitor *v, const char *name,\n\n void *opaque, Error **errp)\n\n{\n\n Error *err = NULL;\n\n VirtIOBalloon *s = opaque;\n\n int i;\n\n\n\n visit_start_struct(v, name, NULL, 0, &err);\n\n if (err) {\n\n goto out;\n\n }\n\n visit_type_int(v, \"last-update\", &s->stats_last_update, &err);\n\n if (err) {\n\n goto out_end;\n\n }\n\n\n\n visit_start_struct(v, \"stats\", NULL, 0, &err);\n\n if (err) {\n\n goto out_end;\n\n }\n\n for (i = 0; i < VIRTIO_BALLOON_S_NR; i++) {\n\n visit_type_uint64(v, balloon_stat_names[i], &s->stats[i], &err);\n\n if (err) {\n\n break;\n\n }\n\n }\n\n error_propagate(errp, err);\n\n err = NULL;\n\n visit_end_struct(v, &err);\n\n\n\nout_end:\n\n error_propagate(errp, err);\n\n err = NULL;\n\n visit_end_struct(v, &err);\n\nout:\n\n error_propagate(errp, err);\n\n}\n"}} {"sample_id": "717adf960933da0650d995f050d457063d591914", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n if (err == 0 && endptr == p) {\n \n err = EINVAL;\n+\n+ }\n+\n+ if (!next && *endptr) {\n+\n return -EINVAL;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int check_strtox_error(const char *p, char *endptr, const char **next,\n\n int err)\n\n{\n\n if (err == 0 && endptr == p) {\n\n err = EINVAL;\n\n }\n\n if (!next && *endptr) {\n\n return -EINVAL;\n\n }\n\n if (next) {\n\n *next = endptr;\n\n }\n\n return -err;\n\n}\n"}} {"sample_id": "dc0ad40de2b0d6995eb842e56b22f9096bd539ff", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,8 +3,8 @@\n int len)\n \n {\n+\n+ while (len-- >= 0)\n \n mant_cnt[bap[len]]++;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ac3_update_bap_counts_c(uint16_t mant_cnt[16], uint8_t *bap,\n\n int len)\n\n{\n\n while (len-- >= 0)\n\n mant_cnt[bap[len]]++;\n\n}\n"}} {"sample_id": "5839e53bbc0fec56021d758aab7610df421ed8c8_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,10 +5,10 @@\n {\n \n int ret = 0;\n+\n BDRVGlusterReopenState *reop_s;\n \n+ GlusterConf *gconf = NULL;\n \n int open_flags = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int qemu_gluster_reopen_prepare(BDRVReopenState *state,\n\n BlockReopenQueue *queue, Error **errp)\n\n{\n\n int ret = 0;\n\n BDRVGlusterReopenState *reop_s;\n\n GlusterConf *gconf = NULL;\n\n int open_flags = 0;\n\n\n\n assert(state != NULL);\n\n assert(state->bs != NULL);\n\n\n\n state->opaque = g_malloc0(sizeof(BDRVGlusterReopenState));\n\n reop_s = state->opaque;\n\n\n\n qemu_gluster_parse_flags(state->flags, &open_flags);\n\n\n\n gconf = g_malloc0(sizeof(GlusterConf));\n\n\n\n reop_s->glfs = qemu_gluster_init(gconf, state->bs->filename, errp);\n\n if (reop_s->glfs == NULL) {\n\n ret = -errno;\n\n goto exit;\n\n }\n\n\n\n reop_s->fd = glfs_open(reop_s->glfs, gconf->image, open_flags);\n\n if (reop_s->fd == NULL) {\n\n /* reops->glfs will be cleaned up in _abort */\n\n ret = -errno;\n\n goto exit;\n\n }\n\n\n\nexit:\n\n /* state->opaque will be freed in either the _abort or _commit */\n\n qemu_gluster_gconf_free(gconf);\n\n return ret;\n\n}\n"}} {"sample_id": "4987faee78b9869f8f4646b8dd971d459df218a5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n ff_h264dsp_init(&h->h264dsp, h->sps.bit_depth_luma,\n h->sps.chroma_format_idc);\n ff_h264chroma_init(&h->h264chroma, h->sps.bit_depth_chroma);\n+ ff_h264qpel_init(&h->h264qpel, h->sps.bit_depth_luma);\n+ ff_h264_pred_init(&h->hpc, h->avctx->codec_id, h->sps.bit_depth_luma,\n+ h->sps.chroma_format_idc);\n+ h->dsp.dct_bits = h->sps.bit_depth_luma > 8 ? 32 : 16;\n+ ff_dsputil_init(&h->dsp, h->avctx);\n ff_videodsp_init(&h->vdsp, h->sps.bit_depth_luma);\n } else {\n av_log(h->avctx, AV_LOG_ERROR, \"Unsupported bit depth: %d\\n\",", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int h264_set_parameter_from_sps(H264Context *h)\n{\n if (h->flags & CODEC_FLAG_LOW_DELAY ||\n (h->sps.bitstream_restriction_flag &&\n !h->sps.num_reorder_frames)) {\n if (h->avctx->has_b_frames > 1 || h->delayed_pic[0])\n av_log(h->avctx, AV_LOG_WARNING, \"Delayed frames seen. \"\n \"Reenabling low delay requires a codec flush.\\n\");\n else\n h->low_delay = 1;\n if (h->avctx->has_b_frames < 2)\n h->avctx->has_b_frames = !h->low_delay;\n if (h->avctx->bits_per_raw_sample != h->sps.bit_depth_luma ||\n h->cur_chroma_format_idc != h->sps.chroma_format_idc) {\n if (h->avctx->codec &&\n h->avctx->codec->capabilities & CODEC_CAP_HWACCEL_VDPAU &&\n (h->sps.bit_depth_luma != 8 || h->sps.chroma_format_idc > 1)) {\n av_log(h->avctx, AV_LOG_ERROR,\n \"VDPAU decoding does not support video colorspace.\\n\");\n return AVERROR_INVALIDDATA;\n if (h->sps.bit_depth_luma >= 8 && h->sps.bit_depth_luma <= 10) {\n h->avctx->bits_per_raw_sample = h->sps.bit_depth_luma;\n h->cur_chroma_format_idc = h->sps.chroma_format_idc;\n h->pixel_shift = h->sps.bit_depth_luma > 8;\n ff_h264dsp_init(&h->h264dsp, h->sps.bit_depth_luma,\n h->sps.chroma_format_idc);\n ff_h264chroma_init(&h->h264chroma, h->sps.bit_depth_chroma);\n ff_h264qpel_init(&h->h264qpel, h->sps.bit_depth_luma);\n ff_h264_pred_init(&h->hpc, h->avctx->codec_id, h->sps.bit_depth_luma,\n h->sps.chroma_format_idc);\n h->dsp.dct_bits = h->sps.bit_depth_luma > 8 ? 32 : 16;\n ff_dsputil_init(&h->dsp, h->avctx);\n ff_videodsp_init(&h->vdsp, h->sps.bit_depth_luma);\n } else {\n av_log(h->avctx, AV_LOG_ERROR, \"Unsupported bit depth: %d\\n\",\n h->sps.bit_depth_luma);\n return AVERROR_INVALIDDATA;\n return 0;"}} {"sample_id": "87e8788680e16c51f6048af26f3f7830c35207a5_22", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,10 +16,10 @@\n \n p->buf[10] == 'I' && (p->buf[11] == ' ' || p->buf[11] == 0x19))\n \n+ return AVPROBE_SCORE_MAX;\n+\n+ else\n+\n+ return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int avi_probe(AVProbeData *p)\n\n{\n\n /* check file header */\n\n if (p->buf_size <= 32)\n\n return 0;\n\n if (p->buf[0] == 'R' && p->buf[1] == 'I' &&\n\n p->buf[2] == 'F' && p->buf[3] == 'F' &&\n\n p->buf[8] == 'A' && p->buf[9] == 'V' &&\n\n p->buf[10] == 'I' && (p->buf[11] == ' ' || p->buf[11] == 0x19))\n\n return AVPROBE_SCORE_MAX;\n\n else\n\n return 0;\n\n}\n"}} {"sample_id": "299b520cd4092be3c53f8380b81315c33927d9d3_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,12 +3,12 @@\n const char* strmmu, CPUState *env1)\n \n {\n+\n+ unsigned int i;\n+\n+ target_ulong mask;\n+\n+\n \n for (i = 0; i < 64; i++) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void demap_tlb(SparcTLBEntry *tlb, target_ulong demap_addr,\n\n const char* strmmu, CPUState *env1)\n\n{\n\n unsigned int i;\n\n target_ulong mask;\n\n\n\n for (i = 0; i < 64; i++) {\n\n if (TTE_IS_VALID(tlb[i].tte)) {\n\n\n\n mask = 0xffffffffffffe000ULL;\n\n mask <<= 3 * ((tlb[i].tte >> 61) & 3);\n\n\n\n if ((demap_addr & mask) == (tlb[i].tag & mask)) {\n\n replace_tlb_entry(&tlb[i], 0, 0, env1);\n\n#ifdef DEBUG_MMU\n\n DPRINTF_MMU(\"%s demap invalidated entry [%02u]\\n\", strmmu, i);\n\n dump_mmu(env1);\n\n#endif\n\n }\n\n //return;\n\n }\n\n }\n\n\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_72", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n vma->vma_start = start;\n \n+ vma->vma_end = end;\n+\n+ vma->vma_flags = flags;\n+\n+\n \n TAILQ_INSERT_TAIL(&mm->mm_mmap, vma, vma_link);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int vma_add_mapping(struct mm_struct *mm, abi_ulong start,\n\n abi_ulong end, abi_ulong flags)\n\n{\n\n struct vm_area_struct *vma;\n\n\n\n if ((vma = qemu_mallocz(sizeof (*vma))) == NULL)\n\n return (-1);\n\n\n\n vma->vma_start = start;\n\n vma->vma_end = end;\n\n vma->vma_flags = flags;\n\n\n\n TAILQ_INSERT_TAIL(&mm->mm_mmap, vma, vma_link);\n\n mm->mm_count++;\n\n\n\n return (0);\n\n}\n"}} {"sample_id": "9c5ce8db2e5c2769ed2fd3d91928dd1853b5ce7c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -61,11 +61,11 @@\n }\n \n case RTAS_SYSPARM_UUID:\n+\n+ ret = sysparm_st(buffer, length, qemu_uuid, (qemu_uuid_set ? 16 : 0));\n+\n+ break;\n+\n default:\n \n ret = RTAS_OUT_NOT_SUPPORTED;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void rtas_ibm_get_system_parameter(PowerPCCPU *cpu,\n\n sPAPRMachineState *spapr,\n\n uint32_t token, uint32_t nargs,\n\n target_ulong args,\n\n uint32_t nret, target_ulong rets)\n\n{\n\n target_ulong parameter = rtas_ld(args, 0);\n\n target_ulong buffer = rtas_ld(args, 1);\n\n target_ulong length = rtas_ld(args, 2);\n\n target_ulong ret;\n\n\n\n switch (parameter) {\n\n case RTAS_SYSPARM_SPLPAR_CHARACTERISTICS: {\n\n char *param_val = g_strdup_printf(\"MaxEntCap=%d,\"\n\n \"DesMem=%llu,\"\n\n \"DesProcs=%d,\"\n\n \"MaxPlatProcs=%d\",\n\n max_cpus,\n\n current_machine->ram_size / M_BYTE,\n\n smp_cpus,\n\n max_cpus);\n\n ret = sysparm_st(buffer, length, param_val, strlen(param_val) + 1);\n\n g_free(param_val);\n\n break;\n\n }\n\n case RTAS_SYSPARM_DIAGNOSTICS_RUN_MODE: {\n\n uint8_t param_val = DIAGNOSTICS_RUN_MODE_DISABLED;\n\n\n\n ret = sysparm_st(buffer, length, ¶m_val, sizeof(param_val));\n\n break;\n\n }\n\n case RTAS_SYSPARM_UUID:\n\n ret = sysparm_st(buffer, length, qemu_uuid, (qemu_uuid_set ? 16 : 0));\n\n break;\n\n default:\n\n ret = RTAS_OUT_NOT_SUPPORTED;\n\n }\n\n\n\n rtas_st(rets, 0, ret);\n\n}\n"}} {"sample_id": "f2e933d20d5fd6c38bda227359b79bcc81654f99", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,12 +4,12 @@\n \n int64_t v;\n \n+ uint_fast16_t res;\n \n \n \n v = float64_to_int64_round_to_zero(a STATUS_VAR);\n+\n if (v < 0) {\n \n res = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "uint_fast16_t float64_to_uint16_round_to_zero(float64 a STATUS_PARAM)\n\n{\n\n int64_t v;\n\n uint_fast16_t res;\n\n\n\n v = float64_to_int64_round_to_zero(a STATUS_VAR);\n\n if (v < 0) {\n\n res = 0;\n\n float_raise( float_flag_invalid STATUS_VAR);\n\n } else if (v > 0xffff) {\n\n res = 0xffff;\n\n float_raise( float_flag_invalid STATUS_VAR);\n\n } else {\n\n res = v;\n\n }\n\n return res;\n\n}\n"}} {"sample_id": "7c560456707bfe53eb1728fcde759be7d9418b62_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,5 +5,5 @@\n printf(\"ECC: Unsupported read 0x\" TARGET_FMT_plx \" 0000\\n\", addr);\n \n return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t ecc_mem_readw(void *opaque, target_phys_addr_t addr)\n\n{\n\n printf(\"ECC: Unsupported read 0x\" TARGET_FMT_plx \" 0000\\n\", addr);\n\n return 0;\n\n}\n"}} {"sample_id": "c401ae8c9cd4e335dca59661f2849e7a26b5eb31", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n sPAPRDRConnectorClass *drck = SPAPR_DR_CONNECTOR_CLASS(k);\n \n \n+\n+ dk->reset = reset;\n+\n+ dk->realize = realize;\n+\n dk->unrealize = unrealize;\n \n drck->set_isolation_state = set_isolation_state;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void spapr_dr_connector_class_init(ObjectClass *k, void *data)\n\n{\n\n DeviceClass *dk = DEVICE_CLASS(k);\n\n sPAPRDRConnectorClass *drck = SPAPR_DR_CONNECTOR_CLASS(k);\n\n\n\n dk->reset = reset;\n\n dk->realize = realize;\n\n dk->unrealize = unrealize;\n\n drck->set_isolation_state = set_isolation_state;\n\n drck->set_indicator_state = set_indicator_state;\n\n drck->set_allocation_state = set_allocation_state;\n\n drck->get_index = get_index;\n\n drck->get_type = get_type;\n\n drck->get_name = get_name;\n\n drck->get_fdt = get_fdt;\n\n drck->set_configured = set_configured;\n\n drck->entity_sense = entity_sense;\n\n drck->attach = attach;\n\n drck->detach = detach;\n\n drck->release_pending = release_pending;\n\n\n\n\n\n}"}} {"sample_id": "147ee4cf065a20bbba10292b496a037e6573cd6e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n fctx->delaying = 1;\n \n fctx->prev_thread = NULL;\n+\n+ // Make sure decode flush calls with size=0 won't return old frames\n+\n+ for (int i = 0; i < avctx->thread_count; i++)\n+\n fctx->threads[i].got_frame = 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_thread_flush(AVCodecContext *avctx)\n\n{\n\n FrameThreadContext *fctx = avctx->thread_opaque;\n\n\n\n if (!avctx->thread_opaque) return;\n\n\n\n park_frame_worker_threads(fctx, avctx->thread_count);\n\n if (fctx->prev_thread) {\n\n if (fctx->prev_thread != &fctx->threads[0])\n\n update_context_from_thread(fctx->threads[0].avctx, fctx->prev_thread->avctx, 0);\n\n if (avctx->codec->flush)\n\n avctx->codec->flush(fctx->threads[0].avctx);\n\n }\n\n\n\n fctx->next_decoding = fctx->next_finished = 0;\n\n fctx->delaying = 1;\n\n fctx->prev_thread = NULL;\n\n // Make sure decode flush calls with size=0 won't return old frames\n\n for (int i = 0; i < avctx->thread_count; i++)\n\n fctx->threads[i].got_frame = 0;\n\n}\n"}} {"sample_id": "2af2a1b8d05a1a64c5005ed930137632b9d5aa22", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,9 +31,9 @@\n s->hci->acl_recv = usb_bt_out_hci_packet_acl;\n \n \n+\n+ usb_bt_handle_reset(&s->dev);\n+\n+\n+\n return dev;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "USBDevice *usb_bt_init(HCIInfo *hci)\n\n{\n\n USBDevice *dev;\n\n struct USBBtState *s;\n\n\n\n if (!hci)\n\n\n dev = usb_create_simple(NULL /* FIXME */, \"usb-bt-dongle\");\n\n\n\n\n s = DO_UPCAST(struct USBBtState, dev, dev);\n\n s->dev.opaque = s;\n\n\n\n s->hci = hci;\n\n s->hci->opaque = s;\n\n s->hci->evt_recv = usb_bt_out_hci_packet_event;\n\n s->hci->acl_recv = usb_bt_out_hci_packet_acl;\n\n\n\n usb_bt_handle_reset(&s->dev);\n\n\n\n return dev;\n"}} {"sample_id": "41d4e5ec9f77acaca706d00ee4baaf5324274da5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,8 +22,8 @@\n \n \n qemu_chr_fe_deinit(&s->chr, true);\n+\n+\n+\n+\n+ qemu_purge_queued_packets(nc);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void vhost_user_cleanup(NetClientState *nc)\n\n{\n\n VhostUserState *s = DO_UPCAST(VhostUserState, nc, nc);\n\n\n\n if (s->vhost_net) {\n\n vhost_net_cleanup(s->vhost_net);\n\n g_free(s->vhost_net);\n\n s->vhost_net = NULL;\n\n\n if (nc->queue_index == 0) {\n\n\n\n\n\n qemu_chr_fe_deinit(&s->chr, true);\n\n\n\n\n qemu_purge_queued_packets(nc);\n"}} {"sample_id": "37f51384ae05bd50f83308339dbffa3e78404874_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,5 +5,5 @@\n uint32_t ce_agaw = vtd_ce_get_agaw(ce);\n \n return 1ULL << MIN(ce_agaw, VTD_MGAW);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline uint64_t vtd_iova_limit(VTDContextEntry *ce)\n\n{\n\n uint32_t ce_agaw = vtd_ce_get_agaw(ce);\n\n return 1ULL << MIN(ce_agaw, VTD_MGAW);\n\n}\n"}} {"sample_id": "f800d6508d7e8fbd8d9777b775d333a4f02112ef", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n \n \n \n+ // make sure VLC tables will be loaded when cid is parsed\n+\n+ ctx->cid = -1;\n+\n+\n \n ctx->rows = av_mallocz_array(avctx->thread_count, sizeof(RowContext));\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static av_cold int dnxhd_decode_init_thread_copy(AVCodecContext *avctx)\n\n{\n\n DNXHDContext *ctx = avctx->priv_data;\n\n\n\n\n // make sure VLC tables will be loaded when cid is parsed\n\n ctx->cid = -1;\n\n\n\n ctx->rows = av_mallocz_array(avctx->thread_count, sizeof(RowContext));\n\n if (!ctx->rows)\n\n return AVERROR(ENOMEM);\n\n\n\n return 0;\n\n}"}} {"sample_id": "621ff94d5074d88253a5818c6b9c4db718fbfc65_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n goto out;\n \n+ }\n+\n+ /* change bootindex to a new one */\n+\n+ *prop->bootindex = boot_index;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void device_set_bootindex(Object *obj, Visitor *v, const char *name,\n\n void *opaque, Error **errp)\n\n{\n\n BootIndexProperty *prop = opaque;\n\n int32_t boot_index;\n\n Error *local_err = NULL;\n\n\n\n visit_type_int32(v, name, &boot_index, &local_err);\n\n if (local_err) {\n\n goto out;\n\n }\n\n /* check whether bootindex is present in fw_boot_order list */\n\n check_boot_index(boot_index, &local_err);\n\n if (local_err) {\n\n goto out;\n\n }\n\n /* change bootindex to a new one */\n\n *prop->bootindex = boot_index;\n\n\n\n add_boot_device_path(*prop->bootindex, prop->dev, prop->suffix);\n\n\n\nout:\n\n if (local_err) {\n\n error_propagate(errp, local_err);\n\n }\n\n}\n"}} {"sample_id": "13a099799e89a76eb921ca452e1b04a7a28a9855_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n const uint16_t *ubuf1, const uint16_t *vbuf0,\n \n+ const uint16_t *vbuf1, const uint16_t *abuf0,\n+\n+ const uint16_t *abuf1, uint8_t *dest, int dstW,\n+\n+ int yalpha, int uvalpha, int y,\n \n enum PixelFormat target)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "yuv2rgb48_2_c_template(SwsContext *c, const uint16_t *buf0,\n\n const uint16_t *buf1, const uint16_t *ubuf0,\n\n const uint16_t *ubuf1, const uint16_t *vbuf0,\n\n const uint16_t *vbuf1, const uint16_t *abuf0,\n\n const uint16_t *abuf1, uint8_t *dest, int dstW,\n\n int yalpha, int uvalpha, int y,\n\n enum PixelFormat target)\n\n{\n\n int yalpha1 = 4095 - yalpha;\n\n int uvalpha1 = 4095 - uvalpha;\n\n int i;\n\n\n\n for (i = 0; i < (dstW >> 1); i++) {\n\n int Y1 = (buf0[i * 2] * yalpha1 + buf1[i * 2] * yalpha) >> 19;\n\n int Y2 = (buf0[i * 2 + 1] * yalpha1 + buf1[i * 2 + 1] * yalpha) >> 19;\n\n int U = (ubuf0[i] * uvalpha1 + ubuf1[i] * uvalpha) >> 19;\n\n int V = (vbuf0[i] * uvalpha1 + vbuf1[i] * uvalpha) >> 19;\n\n const uint8_t *r = (const uint8_t *) c->table_rV[V],\n\n *g = (const uint8_t *)(c->table_gU[U] + c->table_gV[V]),\n\n *b = (const uint8_t *) c->table_bU[U];\n\n\n\n dest[ 0] = dest[ 1] = r_b[Y1];\n\n dest[ 2] = dest[ 3] = g[Y1];\n\n dest[ 4] = dest[ 5] = b_r[Y1];\n\n dest[ 6] = dest[ 7] = r_b[Y2];\n\n dest[ 8] = dest[ 9] = g[Y2];\n\n dest[10] = dest[11] = b_r[Y2];\n\n dest += 12;\n\n }\n\n}\n"}} {"sample_id": "a0efbf16604770b9d805bcf210ec29942321134f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void string_output_append_range(StringOutputVisitor *sov,\n+\n+ int64_t s, int64_t e)\n+\n {\n \n Range *r = g_malloc0(sizeof(*r));", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void string_output_append_range(StringOutputVisitor *sov,\n\n int64_t s, int64_t e)\n\n{\n\n Range *r = g_malloc0(sizeof(*r));\n\n r->begin = s;\n\n r->end = e + 1;\n\n sov->ranges = range_list_insert(sov->ranges, r);\n\n}\n"}} {"sample_id": "7cc84d241ba6ef8e27e4d057176a4ad385ad3d59_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int advanced_decode_picture_secondary_header(VC9Context *v)\n+\n+{\n \n GetBitContext *gb = &v->s.gb;\n \n@@ -11,9 +11,9 @@\n switch(v->s.pict_type)\n \n {\n+\n+ case P_TYPE: status = decode_p_picture_secondary_header(v); break;\n+\n case B_TYPE: status = decode_b_picture_secondary_header(v); break;\n \n case BI_TYPE:", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int advanced_decode_picture_secondary_header(VC9Context *v)\n\n{\n\n GetBitContext *gb = &v->s.gb;\n\n int index, status = 0;\n\n\n\n switch(v->s.pict_type)\n\n {\n\n case P_TYPE: status = decode_p_picture_secondary_header(v); break;\n\n case B_TYPE: status = decode_b_picture_secondary_header(v); break;\n\n case BI_TYPE:\n\n case I_TYPE: status = decode_i_picture_secondary_header(v); break; \n\n }\n\n if (status<0) return FRAME_SKIPED;\n\n\n\n /* AC Syntax */\n\n v->ac_table_level = decode012(gb);\n\n if (v->s.pict_type == I_TYPE || v->s.pict_type == BI_TYPE)\n\n {\n\n v->ac2_table_level = decode012(gb);\n\n }\n\n /* DC Syntax */\n\n index = decode012(gb);\n\n v->luma_dc_vlc = &ff_msmp4_dc_luma_vlc[index];\n\n v->chroma_dc_vlc = &ff_msmp4_dc_chroma_vlc[index];\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "4b7a6bf402bd064605c287eecadc493ccf2d4897", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n case KVM_REG_SIZE_U32:\n \n+ v32 = cpu->cpreg_values[i];\n+\n+ r.addr = (uintptr_t)&v32;\n+\n+ break;\n \n case KVM_REG_SIZE_U64:\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool write_list_to_kvmstate(ARMCPU *cpu)\n\n{\n\n CPUState *cs = CPU(cpu);\n\n int i;\n\n bool ok = true;\n\n\n\n for (i = 0; i < cpu->cpreg_array_len; i++) {\n\n struct kvm_one_reg r;\n\n uint64_t regidx = cpu->cpreg_indexes[i];\n\n uint32_t v32;\n\n int ret;\n\n\n\n r.id = regidx;\n\n switch (regidx & KVM_REG_SIZE_MASK) {\n\n case KVM_REG_SIZE_U32:\n\n v32 = cpu->cpreg_values[i];\n\n r.addr = (uintptr_t)&v32;\n\n break;\n\n case KVM_REG_SIZE_U64:\n\n r.addr = (uintptr_t)(cpu->cpreg_values + i);\n\n break;\n\n default:\n\n abort();\n\n }\n\n ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &r);\n\n if (ret) {\n\n /* We might fail for \"unknown register\" and also for\n\n * \"you tried to set a register which is constant with\n\n * a different value from what it actually contains\".\n\n */\n\n ok = false;\n\n }\n\n }\n\n return ok;\n\n}\n"}} {"sample_id": "b46dcd5209a77254345ae098b83a872634c5591b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static int check_timecode(void *log_ctx, AVTimecode *tc)\n+\n {\n \n if (tc->fps <= 0) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int check_timecode(void *log_ctx, AVTimecode *tc)\n\n{\n\n if (tc->fps <= 0) {\n\n av_log(log_ctx, AV_LOG_ERROR, \"Timecode frame rate must be specified\\n\");\n\n return AVERROR(EINVAL);\n\n }\n\n if ((tc->flags & AV_TIMECODE_FLAG_DROPFRAME) && tc->fps != 30 && tc->fps != 60) {\n\n av_log(log_ctx, AV_LOG_ERROR, \"Drop frame is only allowed with 30000/1001 or 60000/1001 FPS\\n\");\n\n return AVERROR(EINVAL);\n\n }\n\n if (check_fps(tc->fps) < 0) {\n\n av_log(log_ctx, AV_LOG_WARNING, \"Using non-standard frame rate %d/%d\\n\",\n\n tc->rate.num, tc->rate.den);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "83d768b5640946b7da55ce8335509df297e2c7cd_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void virtio_queue_guest_notifier_read(EventNotifier *n)\n \n {\n+\n VirtQueue *vq = container_of(n, VirtQueue, guest_notifier);\n \n if (event_notifier_test_and_clear(n)) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void virtio_queue_guest_notifier_read(EventNotifier *n)\n\n{\n\n VirtQueue *vq = container_of(n, VirtQueue, guest_notifier);\n\n if (event_notifier_test_and_clear(n)) {\n\n virtio_irq(vq);\n\n }\n\n}\n"}} {"sample_id": "f68945d42bab700d95b87f62e0898606ce2421ed_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n continue;\n \n }\n+\n+ if (se->ops && se->ops->is_active) {\n+\n+ if (!se->ops->is_active(se->opaque)) {\n+\n continue;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int qemu_savevm_state_iterate(QEMUFile *f)\n\n{\n\n SaveStateEntry *se;\n\n int ret = 1;\n\n\n\n trace_savevm_state_iterate();\n\n QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {\n\n if (!se->ops || !se->ops->save_live_iterate) {\n\n continue;\n\n }\n\n if (se->ops && se->ops->is_active) {\n\n if (!se->ops->is_active(se->opaque)) {\n\n continue;\n\n }\n\n }\n\n if (qemu_file_rate_limit(f)) {\n\n return 0;\n\n }\n\n trace_savevm_section_start(se->idstr, se->section_id);\n\n\n\n save_section_header(f, se, QEMU_VM_SECTION_PART);\n\n\n\n ret = se->ops->save_live_iterate(f, se->opaque);\n\n trace_savevm_section_end(se->idstr, se->section_id, ret);\n\n\n\n\n if (ret < 0) {\n\n qemu_file_set_error(f, ret);\n\n }\n\n if (ret <= 0) {\n\n /* Do not proceed to the next vmstate before this one reported\n\n completion of the current stage. This serializes the migration\n\n and reduces the probability that a faster changing state is\n\n synchronized over and over again. */\n\n break;\n\n }\n\n }\n\n return ret;\n\n}"}} {"sample_id": "5839e53bbc0fec56021d758aab7610df421ed8c8_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int vhdx_create_new_headers(BlockDriverState *bs, uint64_t image_size,\n \n uint32_t log_size)\n+\n {\n \n int ret = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int vhdx_create_new_headers(BlockDriverState *bs, uint64_t image_size,\n\n uint32_t log_size)\n\n{\n\n int ret = 0;\n\n VHDXHeader *hdr = NULL;\n\n\n\n hdr = g_malloc0(sizeof(VHDXHeader));\n\n\n\n hdr->signature = VHDX_HEADER_SIGNATURE;\n\n hdr->sequence_number = g_random_int();\n\n hdr->log_version = 0;\n\n hdr->version = 1;\n\n hdr->log_length = log_size;\n\n hdr->log_offset = VHDX_HEADER_SECTION_END;\n\n vhdx_guid_generate(&hdr->file_write_guid);\n\n vhdx_guid_generate(&hdr->data_write_guid);\n\n\n\n ret = vhdx_write_header(bs, hdr, VHDX_HEADER1_OFFSET, false);\n\n if (ret < 0) {\n\n goto exit;\n\n }\n\n hdr->sequence_number++;\n\n ret = vhdx_write_header(bs, hdr, VHDX_HEADER2_OFFSET, false);\n\n if (ret < 0) {\n\n goto exit;\n\n }\n\n\n\nexit:\n\n g_free(hdr);\n\n return ret;\n\n}\n"}} {"sample_id": "a9fc37f6bc3f2ab90585cb16493da9f6dcfbfbcf_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n QObject *qobj = qobject_input_get_object(qiv, name, true, errp);\n \n+ QString *qstr;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void qobject_input_type_str(Visitor *v, const char *name, char **obj,\n\n Error **errp)\n\n{\n\n QObjectInputVisitor *qiv = to_qiv(v);\n\n QObject *qobj = qobject_input_get_object(qiv, name, true, errp);\n\n QString *qstr;\n\n\n\n *obj = NULL;\n\n if (!qobj) {\n\n return;\n\n }\n\n qstr = qobject_to_qstring(qobj);\n\n if (!qstr) {\n\n error_setg(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : \"null\",\n\n \"string\");\n\n return;\n\n }\n\n\n\n *obj = g_strdup(qstring_get_str(qstr));\n\n}\n"}} {"sample_id": "52ae646d4a3ebdcdcc973492c6a56f2c49b6578f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n return (tc_ptr >= (uintptr_t)tcg_ctx.code_gen_buffer &&\n \n tc_ptr < (uintptr_t)(tcg_ctx.code_gen_buffer +\n+\n+ tcg_ctx.code_gen_buffer_max_size));\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool is_tcg_gen_code(uintptr_t tc_ptr)\n\n{\n\n /* This can be called during code generation, code_gen_buffer_max_size\n\n is used instead of code_gen_ptr for upper boundary checking */\n\n return (tc_ptr >= (uintptr_t)tcg_ctx.code_gen_buffer &&\n\n tc_ptr < (uintptr_t)(tcg_ctx.code_gen_buffer +\n\n tcg_ctx.code_gen_buffer_max_size));\n\n}\n"}} {"sample_id": "c629a4bc9725a1ec64c4c89894ef27c758024516", "diff": "--- a/source.c\n+++ b/source.c\n@@ -41,11 +41,11 @@\n gdb_set_stop_cpu(env);\n \n debug_requested = EXCP_DEBUG;\n+\n+ break;\n+\n+ }\n+\n }\n \n return tcg_has_work();", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool tcg_cpu_exec(void)\n\n{\n\n int ret = 0;\n\n\n\n if (next_cpu == NULL)\n\n next_cpu = first_cpu;\n\n for (; next_cpu != NULL; next_cpu = next_cpu->next_cpu) {\n\n CPUState *env = cur_cpu = next_cpu;\n\n\n\n qemu_clock_enable(vm_clock,\n\n (cur_cpu->singlestep_enabled & SSTEP_NOTIMER) == 0);\n\n\n\n if (qemu_alarm_pending())\n\n break;\n\n if (cpu_can_run(env))\n\n ret = qemu_cpu_exec(env);\n\n else if (env->stop)\n\n break;\n\n\n\n if (ret == EXCP_DEBUG) {\n\n gdb_set_stop_cpu(env);\n\n debug_requested = EXCP_DEBUG;\n\n break;\n\n }\n\n }\n\n return tcg_has_work();\n\n}\n"}} {"sample_id": "240f64b6dc3346d044d7beb7cc3a53668ce47384", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n QObject *obj;\n \n+ InputEvent *dst = NULL;\n+\n+\n+\n+ qov = qmp_output_visitor_new();\n \n ov = qmp_output_get_visitor(qov);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static InputEvent *qapi_clone_InputEvent(InputEvent *src)\n\n{\n\n QmpOutputVisitor *qov;\n\n QmpInputVisitor *qiv;\n\n Visitor *ov, *iv;\n\n QObject *obj;\n\n InputEvent *dst = NULL;\n\n\n\n qov = qmp_output_visitor_new();\n\n ov = qmp_output_get_visitor(qov);\n\n visit_type_InputEvent(ov, NULL, &src, &error_abort);\n\n obj = qmp_output_get_qobject(qov);\n\n qmp_output_visitor_cleanup(qov);\n\n if (!obj) {\n\n return NULL;\n\n }\n\n\n\n qiv = qmp_input_visitor_new(obj, false);\n\n iv = qmp_input_get_visitor(qiv);\n\n visit_type_InputEvent(iv, NULL, &dst, &error_abort);\n\n qmp_input_visitor_cleanup(qiv);\n\n qobject_decref(obj);\n\n\n\n return dst;\n\n}\n"}} {"sample_id": "2bf4aa2e937737deb781706673f806d4388cf796", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n uint64_t min1v = h[0].val;\n \n+ up[h[0].name] = next;\n+\n+ h[0].val = INT64_MAX;\n+\n+ heap_sift(h, 0, size);\n \n up[h[0].name] = next;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void generate_len_table(uint8_t *dst, uint64_t *stats, int size){\n\n heap_elem_t h[size];\n\n int up[2*size];\n\n int len[2*size];\n\n int offset, i, next;\n\n\n\n for(offset=1; ; offset<<=1){\n\n for(i=0; i=0; i--)\n\n heap_sift(h, i, size);\n\n\n\n for(next=size; next=size; i--)\n\n len[i] = len[up[i]] + 1;\n\n for(i=0; i 32) break;\n\n }\n\n if(i==size) break;\n\n }\n\n}\n"}} {"sample_id": "568e18b15e2ddf494fd8926707d34ca08c8edce5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+void fifo_realloc(FifoBuffer *f, int new_size){\n+\n int old_size= f->end - f->buffer;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void fifo_realloc(FifoBuffer *f, int new_size){\n\n int old_size= f->end - f->buffer;\n\n \n\n if(old_size < new_size){\n\n uint8_t *old= f->buffer;\n\n\n\n f->buffer= av_realloc(f->buffer, new_size);\n\n\n\n f->rptr += f->buffer - old;\n\n f->wptr += f->buffer - old;\n\n\n\n if(f->wptr < f->rptr){\n\n memmove(f->rptr + new_size - old_size, f->rptr, f->buffer + old_size - f->rptr);\n\n f->rptr += new_size - old_size;\n\n }\n\n f->end= f->buffer + new_size;\n\n }\n\n}\n"}} {"sample_id": "eb159d13ee36a9ef2a83e3ab66f1b2ae1cc2d9f1_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n BlockDriverState *bs;\n \n+ int force = qdict_get_int(qdict, \"force\");\n+\n+ const char *filename = qdict_get_str(qdict, \"device\");\n+\n+\n \n bs = bdrv_find(filename);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int do_eject(Monitor *mon, const QDict *qdict, QObject **ret_data)\n\n{\n\n BlockDriverState *bs;\n\n int force = qdict_get_int(qdict, \"force\");\n\n const char *filename = qdict_get_str(qdict, \"device\");\n\n\n\n bs = bdrv_find(filename);\n\n if (!bs) {\n\n qerror_report(QERR_DEVICE_NOT_FOUND, filename);\n\n return -1;\n\n }\n\n return eject_device(mon, bs, force);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_239", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n uint64_t value, unsigned size)\n \n {\n+\n+ arm_mptimer_state *s = (arm_mptimer_state *)opaque;\n+\n int id = get_current_cpu(s);\n \n timerblock_write(&s->timerblock[id * 2], addr, value, size);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void arm_thistimer_write(void *opaque, target_phys_addr_t addr,\n\n uint64_t value, unsigned size)\n\n{\n\n arm_mptimer_state *s = (arm_mptimer_state *)opaque;\n\n int id = get_current_cpu(s);\n\n timerblock_write(&s->timerblock[id * 2], addr, value, size);\n\n}\n"}} {"sample_id": "8a5956ad6392f115521dad774055c737c49fb0dd_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n QLIST_FOREACH_RCU(el, &Q_list_head, entry) {\n \n+ j = atomic_read(&el->val);\n+\n+ (void)j;\n+\n+ n_reads_local++;\n \n if (goflag == GOFLAG_STOP) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void *rcu_q_reader(void *arg)\n\n{\n\n long long j, n_reads_local = 0;\n\n struct list_element *el;\n\n\n\n *(struct rcu_reader_data **)arg = &rcu_reader;\n\n atomic_inc(&nthreadsrunning);\n\n while (goflag == GOFLAG_INIT) {\n\n g_usleep(1000);\n\n }\n\n\n\n while (goflag == GOFLAG_RUN) {\n\n rcu_read_lock();\n\n QLIST_FOREACH_RCU(el, &Q_list_head, entry) {\n\n j = atomic_read(&el->val);\n\n (void)j;\n\n n_reads_local++;\n\n if (goflag == GOFLAG_STOP) {\n\n break;\n\n }\n\n }\n\n rcu_read_unlock();\n\n\n\n g_usleep(100);\n\n }\n\n atomic_add(&n_reads, n_reads_local);\n\n return NULL;\n\n}\n"}} {"sample_id": "eb751f06db9f627c8b5c63d08836a39f7572bf56", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int mkv_field_order(MatroskaDemuxContext *matroska, int64_t field_order)\n \n+{\n \n int major, minor, micro, bttb = 0;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int mkv_field_order(MatroskaDemuxContext *matroska, int64_t field_order)\n\n{\n\n int major, minor, micro, bttb = 0;\n\n\n\n /* workaround a bug in our Matroska muxer, introduced in version 57.36 alongside\n\n * this function, and fixed in 57.52 */\n\n if (sscanf(matroska->muxingapp, \"Lavf%d.%d.%d\", &major, &minor, µ) == 3)\n\n bttb = (major == 57 && minor >= 36 && minor <= 51 && micro >= 100);\n\n\n\n switch (field_order) {\n\n case MATROSKA_VIDEO_FIELDORDER_PROGRESSIVE:\n\n return AV_FIELD_PROGRESSIVE;\n\n case MATROSKA_VIDEO_FIELDORDER_UNDETERMINED:\n\n return AV_FIELD_UNKNOWN;\n\n case MATROSKA_VIDEO_FIELDORDER_TT:\n\n return AV_FIELD_TT;\n\n case MATROSKA_VIDEO_FIELDORDER_BB:\n\n return AV_FIELD_BB;\n\n case MATROSKA_VIDEO_FIELDORDER_BT:\n\n return bttb ? AV_FIELD_TB : AV_FIELD_BT;\n\n case MATROSKA_VIDEO_FIELDORDER_TB:\n\n return bttb ? AV_FIELD_BT : AV_FIELD_TB;\n\n default:\n\n return AV_FIELD_UNKNOWN;\n\n }\n\n}\n"}} {"sample_id": "7a39fe588251ba042c91bf23d53b0ba820bf964c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n int kvm_arch_post_run(CPUState *env, struct kvm_run *run)\n \n {\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int kvm_arch_post_run(CPUState *env, struct kvm_run *run)\n\n{\n\n return 0;\n\n}\n"}} {"sample_id": "a369da5f31ddbdeb32a7f76622e480d3995fbb00", "diff": "--- a/source.c\n+++ b/source.c\n@@ -60,11 +60,11 @@\n \n if (pci_bus) {\n \n+ dev = pci_vga_init(pci_bus);\n+\n+ } else {\n+\n+ dev = isa_vga_init(isa_bus);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "DeviceState *pc_vga_init(ISABus *isa_bus, PCIBus *pci_bus)\n\n{\n\n DeviceState *dev = NULL;\n\n\n\n if (cirrus_vga_enabled) {\n\n if (pci_bus) {\n\n dev = pci_cirrus_vga_init(pci_bus);\n\n } else {\n\n dev = isa_cirrus_vga_init(get_system_memory());\n\n }\n\n } else if (vmsvga_enabled) {\n\n if (pci_bus) {\n\n dev = pci_vmsvga_init(pci_bus);\n\n if (!dev) {\n\n fprintf(stderr, \"Warning: vmware_vga not available,\"\n\n \" using standard VGA instead\\n\");\n\n dev = pci_vga_init(pci_bus);\n\n }\n\n } else {\n\n fprintf(stderr, \"%s: vmware_vga: no PCI bus\\n\", __FUNCTION__);\n\n }\n\n#ifdef CONFIG_SPICE\n\n } else if (qxl_enabled) {\n\n if (pci_bus) {\n\n dev = &pci_create_simple(pci_bus, -1, \"qxl-vga\")->qdev;\n\n } else {\n\n fprintf(stderr, \"%s: qxl: no PCI bus\\n\", __FUNCTION__);\n\n }\n\n#endif\n\n } else if (std_vga_enabled) {\n\n if (pci_bus) {\n\n dev = pci_vga_init(pci_bus);\n\n } else {\n\n dev = isa_vga_init(isa_bus);\n\n }\n\n }\n\n\n\n return dev;\n\n}\n"}} {"sample_id": "1b3b018aa4e43d7bf87df5cdf28c69a9ad5a6cbc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ const uint8_t *p;\n \n int c;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static inline int get16(const uint8_t **pp, const uint8_t *p_end)\n\n{\n\n const uint8_t *p;\n\n int c;\n\n\n\n p = *pp;\n\n if ((p + 1) >= p_end)\n\n return AVERROR_INVALIDDATA;\n\n c = AV_RB16(p);\n\n p += 2;\n\n *pp = p;\n\n return c;\n\n}\n"}} {"sample_id": "9959a52b14bcfa3e5baeb3fc8a86c04bbc0d3d5d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n int64_t pos;\n \n+ int ret;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int ast_read_packet(AVFormatContext *s, AVPacket *pkt)\n\n{\n\n uint32_t type, size;\n\n int64_t pos;\n\n int ret;\n\n\n\n if (avio_feof(s->pb))\n\n return AVERROR_EOF;\n\n\n\n pos = avio_tell(s->pb);\n\n type = avio_rl32(s->pb);\n\n size = avio_rb32(s->pb);\n\n if (size > INT_MAX / s->streams[0]->codecpar->channels)\n\n return AVERROR_INVALIDDATA;\n\n\n\n size *= s->streams[0]->codecpar->channels;\n\n if ((ret = avio_skip(s->pb, 24)) < 0) // padding\n\n return ret;\n\n\n\n if (type == MKTAG('B','L','C','K')) {\n\n ret = av_get_packet(s->pb, pkt, size);\n\n pkt->stream_index = 0;\n\n pkt->pos = pos;\n\n } else {\n\n av_log(s, AV_LOG_ERROR, \"unknown chunk %x\\n\", type);\n\n avio_skip(s->pb, size);\n\n ret = AVERROR_INVALIDDATA;\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "9fac508ca46f93450ec232299dfd15ac70b6f326", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static inline int wnv1_get_code(WNV1Context *w, int base_value)\n \n {\n+\n int v = get_vlc2(&w->gb, code_vlc.table, CODE_VLC_BITS, 1);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline int wnv1_get_code(WNV1Context *w, int base_value)\n\n{\n\n int v = get_vlc2(&w->gb, code_vlc.table, CODE_VLC_BITS, 1);\n\n\n\n if (v == 15)\n\n return ff_reverse[get_bits(&w->gb, 8 - w->shift)];\n\n else\n\n return base_value + ((v - 7) << w->shift);\n\n}\n"}} {"sample_id": "2ad645d2854746b55ddfd1d8e951f689cca5d78f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ QTestState *s;\n \n const char *machine = data;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void test_nop(gconstpointer data)\n\n{\n\n QTestState *s;\n\n const char *machine = data;\n\n char *args;\n\n\n\n args = g_strdup_printf(\"-display none -machine %s\", machine);\n\n s = qtest_start(args);\n\n if (s) {\n\n qtest_quit(s);\n\n }\n\n g_free(args);\n\n}\n"}} {"sample_id": "cab39afb1a9c8a86a00485fbba12a9ba26bea57d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n avio_wb32(pb, 0); /* size */\n \n+ ffio_wfourcc(pb, \"name\"); /* Data format */\n+\n+ avio_wb16(pb, strlen(reel_name)); /* string size */\n+\n avio_wb16(pb, track->language); /* langcode */\n \n avio_write(pb, reel_name, strlen(reel_name)); /* reel name */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mov_write_source_reference_tag(AVIOContext *pb, MOVTrack *track, const char *reel_name){\n\n int64_t pos = avio_tell(pb);\n\n avio_wb32(pb, 0); /* size */\n\n ffio_wfourcc(pb, \"name\"); /* Data format */\n\n avio_wb16(pb, strlen(reel_name)); /* string size */\n\n avio_wb16(pb, track->language); /* langcode */\n\n avio_write(pb, reel_name, strlen(reel_name)); /* reel name */\n\n return update_size(pb,pos);\n\n}\n"}} {"sample_id": "ddbcc48b646737c8bff7f8e28e0a69dca65509cf_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n user = av_strtok(credencials, \":\", &end);\n \n+ pass = av_strtok(end, \":\", &end);\n+\n+\n+\n+ if (!user) {\n \n user = \"anonymous\";\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ftp_auth(FTPContext *s)\n\n{\n\n const char *user = NULL, *pass = NULL;\n\n char *end = NULL, buf[CONTROL_BUFFER_SIZE], credencials[CREDENTIALS_BUFFER_SIZE];\n\n int err;\n\n const int user_codes[] = {331, 230, 0};\n\n const int pass_codes[] = {230, 0};\n\n\n\n /* Authentication may be repeated, original string has to be saved */\n\n av_strlcpy(credencials, s->credencials, sizeof(credencials));\n\n\n\n user = av_strtok(credencials, \":\", &end);\n\n pass = av_strtok(end, \":\", &end);\n\n\n\n if (!user) {\n\n user = \"anonymous\";\n\n pass = s->anonymous_password ? s->anonymous_password : \"nopassword\";\n\n }\n\n\n\n snprintf(buf, sizeof(buf), \"USER %s\\r\\n\", user);\n\n err = ftp_send_command(s, buf, user_codes, NULL);\n\n if (err == 331) {\n\n if (pass) {\n\n snprintf(buf, sizeof(buf), \"PASS %s\\r\\n\", pass);\n\n err = ftp_send_command(s, buf, pass_codes, NULL);\n\n } else\n\n return AVERROR(EACCES);\n\n }\n\n if (!err)\n\n return AVERROR(EACCES);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "8e91d9652ea5048d9014e7636e12c6ed4732d7b7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n char filename[40];\n time_t today2 = time(NULL);\n struct tm *today = localtime(&today2);\n+ snprintf(filename, sizeof(filename), \"vstats_%02d%02d%02d.log\", today->tm_hour, today->tm_min,\n+ today->tm_sec);\n return opt_vstats_file(NULL, opt, filename);\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int opt_vstats(void *optctx, const char *opt, const char *arg)\n{\n char filename[40];\n time_t today2 = time(NULL);\n struct tm *today = localtime(&today2);\n snprintf(filename, sizeof(filename), \"vstats_%02d%02d%02d.log\", today->tm_hour, today->tm_min,\n today->tm_sec);\n return opt_vstats_file(NULL, opt, filename);\n}"}} {"sample_id": "79482e5ab38a05ca8869040b0d8b8f451f16ff62", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,21 +1,21 @@\n static inline void gen_op_arith_add(DisasContext *ctx, TCGv ret, TCGv arg1,\n \n+ TCGv arg2, bool add_ca, bool compute_ca,\n \n bool compute_ov, bool compute_rc0)\n \n+{\n+\n+ TCGv t0 = ret;\n+\n \n+\n if (((compute_ca && add_ca) || compute_ov)\n+\n && (TCGV_EQUAL(ret, arg1) || TCGV_EQUAL(ret, arg2))) {\n \n t0 = tcg_temp_new();\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static inline void gen_op_arith_add(DisasContext *ctx, TCGv ret, TCGv arg1,\n\n TCGv arg2, bool add_ca, bool compute_ca,\n\n bool compute_ov, bool compute_rc0)\n\n{\n\n TCGv t0 = ret;\n\n\n\n if (((compute_ca && add_ca) || compute_ov)\n\n && (TCGV_EQUAL(ret, arg1) || TCGV_EQUAL(ret, arg2))) {\n\n t0 = tcg_temp_new();\n\n }\n\n\n\n if (compute_ca) {\n\n TCGv zero = tcg_const_tl(0);\n\n if (add_ca) {\n\n tcg_gen_add2_tl(t0, cpu_ca, arg1, zero, cpu_ca, zero);\n\n tcg_gen_add2_tl(t0, cpu_ca, t0, cpu_ca, arg2, zero);\n\n } else {\n\n tcg_gen_add2_tl(t0, cpu_ca, arg1, zero, arg2, zero);\n\n }\n\n tcg_temp_free(zero);\n\n } else {\n\n tcg_gen_add_tl(t0, arg1, arg2);\n\n if (add_ca) {\n\n tcg_gen_add_tl(t0, t0, cpu_ca);\n\n }\n\n }\n\n\n\n if (compute_ov) {\n\n gen_op_arith_compute_ov(ctx, t0, arg1, arg2, 0);\n\n }\n\n if (unlikely(compute_rc0)) {\n\n gen_set_Rc0(ctx, t0);\n\n }\n\n\n\n if (!TCGV_EQUAL(t0, ret)) {\n\n tcg_gen_mov_tl(ret, t0);\n\n tcg_temp_free(t0);\n\n }\n\n}\n"}} {"sample_id": "1dd3a44753f10970ded50950d28353c00bfcaf91", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int bdrv_check_byte_request(BlockDriverState *bs, int64_t offset,\n+ size_t size)\n+{\n+ int64_t len;\n if (!bdrv_is_inserted(bs))\n return -ENOMEDIUM;\n if (bs->growable)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int bdrv_check_byte_request(BlockDriverState *bs, int64_t offset,\n size_t size)\n{\n int64_t len;\n if (!bdrv_is_inserted(bs))\n return -ENOMEDIUM;\n if (bs->growable)\n return 0;\n len = bdrv_getlength(bs);\n if (offset < 0)\n if ((offset > len) || (len - offset < size))\n return 0;"}} {"sample_id": "fae2afb10e3fdceab612c62a2b1e8b944ff578d9_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,8 +16,8 @@\n \n qxl_log_cmd_draw_copy(qxl, &draw->u.copy, group_id);\n \n+ break;\n+\n+ }\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qxl_log_cmd_draw(PCIQXLDevice *qxl, QXLDrawable *draw, int group_id)\n\n{\n\n fprintf(stderr, \": surface_id %d type %s effect %s\",\n\n draw->surface_id,\n\n qxl_name(qxl_draw_type, draw->type),\n\n qxl_name(qxl_draw_effect, draw->effect));\n\n switch (draw->type) {\n\n case QXL_DRAW_COPY:\n\n qxl_log_cmd_draw_copy(qxl, &draw->u.copy, group_id);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "187337f8b0ec0813dd3876d1efe37d415fb81c2e_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n int iomemtype;\n \n \n+\n s = (vpb_sic_state *)qemu_mallocz(sizeof(vpb_sic_state));\n \n if (!s)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static qemu_irq *vpb_sic_init(uint32_t base, qemu_irq *parent, int irq)\n\n{\n\n vpb_sic_state *s;\n\n qemu_irq *qi;\n\n int iomemtype;\n\n\n\n s = (vpb_sic_state *)qemu_mallocz(sizeof(vpb_sic_state));\n\n if (!s)\n\n return NULL;\n\n qi = qemu_allocate_irqs(vpb_sic_set_irq, s, 32);\n\n s->base = base;\n\n s->parent = parent;\n\n s->irq = irq;\n\n iomemtype = cpu_register_io_memory(0, vpb_sic_readfn,\n\n vpb_sic_writefn, s);\n\n cpu_register_physical_memory(base, 0x00000fff, iomemtype);\n\n /* ??? Save/restore. */\n\n return qi;\n\n}\n"}} {"sample_id": "b946a1533209f61a93e34898aebb5b43154b99c3_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n char *init_group = strlen(group) ? (char *)group : NULL;\n \n+ char *init_sock = strlen(sock) ? (char *)sock : NULL;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int net_vde_init(VLANState *vlan, const char *model,\n\n const char *name, const char *sock,\n\n int port, const char *group, int mode)\n\n{\n\n VDEState *s;\n\n char *init_group = strlen(group) ? (char *)group : NULL;\n\n char *init_sock = strlen(sock) ? (char *)sock : NULL;\n\n\n\n struct vde_open_args args = {\n\n .port = port,\n\n .group = init_group,\n\n .mode = mode,\n\n };\n\n\n\n s = qemu_mallocz(sizeof(VDEState));\n\n s->vde = vde_open(init_sock, \"QEMU\", &args);\n\n if (!s->vde){\n\n free(s);\n\n return -1;\n\n }\n\n s->vc = qemu_new_vlan_client(vlan, model, name, vde_from_qemu, NULL, s);\n\n qemu_set_fd_handler(vde_datafd(s->vde), vde_to_qemu, NULL, s);\n\n snprintf(s->vc->info_str, sizeof(s->vc->info_str), \"sock=%s,fd=%d\",\n\n sock, vde_datafd(s->vde));\n\n return 0;\n\n}\n"}} {"sample_id": "202a6697ba54293235ce2d7bd5724f4f461e417f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n rdt_new_extradata (void)\n+\n+{\n+\n PayloadContext *rdt = av_mallocz(sizeof(PayloadContext));\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "rdt_new_extradata (void)\n\n{\n\n PayloadContext *rdt = av_mallocz(sizeof(PayloadContext));\n\n\n\n av_open_input_stream(&rdt->rmctx, NULL, \"\", &rdt_demuxer, NULL);\n\n\n\n return rdt;\n\n}\n"}} {"sample_id": "33876dfad64bc481f59c5e9ccf60db78624c4b93", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n static int xenstore_scan(const char *type, int dom, struct XenDevOps *ops)\n \n {\n+\n struct XenDevice *xendev;\n+\n char path[XEN_BUFSIZE], token[XEN_BUFSIZE];\n+\n+ char **dev = NULL, *dom0;\n \n unsigned int cdev, j;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int xenstore_scan(const char *type, int dom, struct XenDevOps *ops)\n\n{\n\n struct XenDevice *xendev;\n\n char path[XEN_BUFSIZE], token[XEN_BUFSIZE];\n\n char **dev = NULL, *dom0;\n\n unsigned int cdev, j;\n\n\n\n /* setup watch */\n\n dom0 = xs_get_domain_path(xenstore, 0);\n\n snprintf(token, sizeof(token), \"be:%p:%d:%p\", type, dom, ops);\n\n snprintf(path, sizeof(path), \"%s/backend/%s/%d\", dom0, type, dom);\n\n free(dom0);\n\n if (!xs_watch(xenstore, path, token)) {\n\n xen_be_printf(NULL, 0, \"xen be: watching backend path (%s) failed\\n\", path);\n\n return -1;\n\n }\n\n\n\n /* look for backends */\n\n dev = xs_directory(xenstore, 0, path, &cdev);\n\n if (!dev) {\n\n return 0;\n\n }\n\n for (j = 0; j < cdev; j++) {\n\n xendev = xen_be_get_xendev(type, dom, atoi(dev[j]), ops);\n\n if (xendev == NULL) {\n\n continue;\n\n }\n\n xen_be_check_state(xendev);\n\n }\n\n free(dev);\n\n return 0;\n\n}\n"}} {"sample_id": "e0dfe5b18919a6a4deb841dcf3212e3e998c95e5_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n OpenPICState *opp = opaque;\n+\n+ uint32_t retval;\n+\n+ int idx;\n+\n \n \n DPRINTF(\"%s: addr %#\" HWADDR_PRIx \"\\n\", __func__, addr);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t openpic_src_read(void *opaque, uint64_t addr, unsigned len)\n\n{\n\n OpenPICState *opp = opaque;\n\n uint32_t retval;\n\n int idx;\n\n\n\n DPRINTF(\"%s: addr %#\" HWADDR_PRIx \"\\n\", __func__, addr);\n\n retval = 0xFFFFFFFF;\n\n if (addr & 0xF) {\n\n return retval;\n\n }\n\n addr = addr & 0xFFF0;\n\n idx = addr >> 5;\n\n if (addr & 0x10) {\n\n /* EXDE / IFEDE / IEEDE */\n\n retval = read_IRQreg_idr(opp, idx);\n\n } else {\n\n /* EXVP / IFEVP / IEEVP */\n\n retval = read_IRQreg_ivpr(opp, idx);\n\n }\n\n DPRINTF(\"%s: => 0x%08x\\n\", __func__, retval);\n\n\n\n return retval;\n\n}\n"}} {"sample_id": "03cef34aa66662e2ab3681d290e7c5a6634f4058_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -37,11 +37,11 @@\n \n \n if (ist->hwaccel_device) {\n+\n+ for (i = 0; i < FF_ARRAY_ELEMS(impl_map); i++)\n+\n+ if (!strcmp(ist->hwaccel_device, impl_map[i].name)) {\n+\n impl = impl_map[i].impl;\n \n break;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static mfxIMPL choose_implementation(const InputStream *ist)\n\n{\n\n static const struct {\n\n const char *name;\n\n mfxIMPL impl;\n\n } impl_map[] = {\n\n { \"auto\", MFX_IMPL_AUTO },\n\n { \"sw\", MFX_IMPL_SOFTWARE },\n\n { \"hw\", MFX_IMPL_HARDWARE },\n\n { \"auto_any\", MFX_IMPL_AUTO_ANY },\n\n { \"hw_any\", MFX_IMPL_HARDWARE_ANY },\n\n { \"hw2\", MFX_IMPL_HARDWARE2 },\n\n { \"hw3\", MFX_IMPL_HARDWARE3 },\n\n { \"hw4\", MFX_IMPL_HARDWARE4 },\n\n };\n\n\n\n mfxIMPL impl = MFX_IMPL_AUTO_ANY;\n\n int i;\n\n\n\n if (ist->hwaccel_device) {\n\n for (i = 0; i < FF_ARRAY_ELEMS(impl_map); i++)\n\n if (!strcmp(ist->hwaccel_device, impl_map[i].name)) {\n\n impl = impl_map[i].impl;\n\n break;\n\n }\n\n if (i == FF_ARRAY_ELEMS(impl_map))\n\n impl = strtol(ist->hwaccel_device, NULL, 0);\n\n }\n\n\n\n return impl;\n\n}\n"}} {"sample_id": "b69c2e0e6dab87bb90fece1d0de47c28394aa8e6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n int64_t timestamp, int flags)\n \n+{\n \n YopDecContext *yop = s->priv_data;\n \n@@ -10,7 +10,7 @@\n \n int frame_count;\n \n+\n \n av_free_packet(&yop->video_packet);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int yop_read_seek(AVFormatContext *s, int stream_index,\n\n int64_t timestamp, int flags)\n\n{\n\n YopDecContext *yop = s->priv_data;\n\n int64_t frame_pos, pos_min, pos_max;\n\n int frame_count;\n\n\n\n av_free_packet(&yop->video_packet);\n\n\n\n if (!stream_index)\n\n return -1;\n\n\n\n pos_min = s->data_offset;\n\n pos_max = avio_size(s->pb) - yop->frame_size;\n\n frame_count = (pos_max - pos_min) / yop->frame_size;\n\n\n\n timestamp = FFMAX(0, FFMIN(frame_count, timestamp));\n\n\n\n frame_pos = timestamp * yop->frame_size + pos_min;\n\n yop->odd_frame = timestamp & 1;\n\n\n\n avio_seek(s->pb, frame_pos, SEEK_SET);\n\n return 0;\n\n}\n"}} {"sample_id": "3ab9a2a5577d445252724af4067d2a7c8a378efa_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int rv40_h_loop_filter_strength(uint8_t *src, int stride,\n \n int beta, int beta2, int edge,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int rv40_h_loop_filter_strength(uint8_t *src, int stride,\n\n int beta, int beta2, int edge,\n\n int *p1, int *q1)\n\n{\n\n return rv40_loop_filter_strength(src, stride, 1, beta, beta2, edge, p1, q1);\n\n}\n"}} {"sample_id": "78e8fde26c032931ca2ae13bfc7c59e38afd17ee", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,7 +14,7 @@\n \n dprintf(\"handle dcr write\\n\");\n \n+ ret = kvmppc_handle_dcr_write(env, run->dcr.dcrn, run->dcr.data);\n \n } else {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "int kvm_arch_handle_exit(CPUPPCState *env, struct kvm_run *run)\n\n{\n\n int ret;\n\n\n\n switch (run->exit_reason) {\n\n case KVM_EXIT_DCR:\n\n if (run->dcr.is_write) {\n\n dprintf(\"handle dcr write\\n\");\n\n ret = kvmppc_handle_dcr_write(env, run->dcr.dcrn, run->dcr.data);\n\n } else {\n\n dprintf(\"handle dcr read\\n\");\n\n ret = kvmppc_handle_dcr_read(env, run->dcr.dcrn, &run->dcr.data);\n\n }\n\n break;\n\n case KVM_EXIT_HLT:\n\n dprintf(\"handle halt\\n\");\n\n ret = kvmppc_handle_halt(env);\n\n break;\n\n#ifdef CONFIG_PSERIES\n\n case KVM_EXIT_PAPR_HCALL:\n\n dprintf(\"handle PAPR hypercall\\n\");\n\n run->papr_hcall.ret = spapr_hypercall(env, run->papr_hcall.nr,\n\n run->papr_hcall.args);\n\n ret = 1;\n\n break;\n\n#endif\n\n default:\n\n fprintf(stderr, \"KVM: unknown exit reason %d\\n\", run->exit_reason);\n\n ret = -1;\n\n break;\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "8f5d58ef2c92d7b82d9a6eeefd7c8854a183ba4a_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+virtio_crypto_check_cryptodev_is_used(Object *obj, const char *name,\n \n Object *val, Error **errp)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "virtio_crypto_check_cryptodev_is_used(Object *obj, const char *name,\n\n Object *val, Error **errp)\n\n{\n\n if (cryptodev_backend_is_used(CRYPTODEV_BACKEND(val))) {\n\n char *path = object_get_canonical_path_component(val);\n\n error_setg(errp,\n\n \"can't use already used cryptodev backend: %s\", path);\n\n g_free(path);\n\n } else {\n\n qdev_prop_allow_set_link_before_realize(obj, name, val, errp);\n\n }\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_96", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void caps_to_network(RDMACapabilities *cap)\n+\n {\n \n cap->version = htonl(cap->version);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void caps_to_network(RDMACapabilities *cap)\n\n{\n\n cap->version = htonl(cap->version);\n\n cap->flags = htonl(cap->flags);\n\n}\n"}} {"sample_id": "64d7e9a421fea0ac50b44541f5521de455e7cd5d_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n int pit_get_initial_count(PITState *pit, int channel)\n \n+{\n+\n PITChannelState *s = &pit->channels[channel];\n \n return s->count;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int pit_get_initial_count(PITState *pit, int channel)\n\n{\n\n PITChannelState *s = &pit->channels[channel];\n\n return s->count;\n\n}\n"}} {"sample_id": "187337f8b0ec0813dd3876d1efe37d415fb81c2e_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n struct pxa2xx_gpio_info_s *s;\n \n+\n \n s = (struct pxa2xx_gpio_info_s *)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "struct pxa2xx_gpio_info_s *pxa2xx_gpio_init(target_phys_addr_t base,\n\n CPUState *env, qemu_irq *pic, int lines)\n\n{\n\n int iomemtype;\n\n struct pxa2xx_gpio_info_s *s;\n\n\n\n s = (struct pxa2xx_gpio_info_s *)\n\n qemu_mallocz(sizeof(struct pxa2xx_gpio_info_s));\n\n memset(s, 0, sizeof(struct pxa2xx_gpio_info_s));\n\n s->base = base;\n\n s->pic = pic;\n\n s->lines = lines;\n\n s->cpu_env = env;\n\n\n\n iomemtype = cpu_register_io_memory(0, pxa2xx_gpio_readfn,\n\n pxa2xx_gpio_writefn, s);\n\n cpu_register_physical_memory(base, 0x00000fff, iomemtype);\n\n\n\n register_savevm(\"pxa2xx_gpio\", 0, 0,\n\n pxa2xx_gpio_save, pxa2xx_gpio_load, s);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "69c07db04625cb243db6e8a0ac0a8e3973dd961a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,8 +14,8 @@\n \n fd = qemu_open(tpm_pt->options->cancel_path, O_WRONLY);\n \n+ if (fd < 0) {\n+\n error_report(\"Could not open TPM cancel path : %s\",\n \n strerror(errno));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int tpm_passthrough_open_sysfs_cancel(TPMPassthruState *tpm_pt)\n\n{\n\n int fd = -1;\n\n char *dev;\n\n char path[PATH_MAX];\n\n\n\n if (tpm_pt->options->cancel_path) {\n\n fd = qemu_open(tpm_pt->options->cancel_path, O_WRONLY);\n\n if (fd < 0) {\n\n error_report(\"Could not open TPM cancel path : %s\",\n\n strerror(errno));\n\n }\n\n return fd;\n\n }\n\n\n\n dev = strrchr(tpm_pt->tpm_dev, '/');\n\n if (dev) {\n\n dev++;\n\n if (snprintf(path, sizeof(path), \"/sys/class/misc/%s/device/cancel\",\n\n dev) < sizeof(path)) {\n\n fd = qemu_open(path, O_WRONLY);\n\n if (fd >= 0) {\n\n tpm_pt->options->cancel_path = g_strdup(path);\n\n } else {\n\n error_report(\"tpm_passthrough: Could not open TPM cancel \"\n\n \"path %s : %s\", path, strerror(errno));\n\n }\n\n }\n\n } else {\n\n error_report(\"tpm_passthrough: Bad TPM device path %s\",\n\n tpm_pt->tpm_dev);\n\n }\n\n\n\n return fd;\n\n}\n"}} {"sample_id": "c8057f951d64de93bfd01569c0a725baa9f94372", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void handle_arg_cpu(const char *arg)\n \n+{\n \n cpu_model = strdup(arg);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void handle_arg_cpu(const char *arg)\n\n{\n\n cpu_model = strdup(arg);\n\n if (cpu_model == NULL || strcmp(cpu_model, \"?\") == 0) {\n\n /* XXX: implement xxx_cpu_list for targets that still miss it */\n\n#if defined(cpu_list_id)\n\n cpu_list_id(stdout, &fprintf, \"\");\n\n#elif defined(cpu_list)\n\n cpu_list(stdout, &fprintf); /* deprecated */\n\n#endif\n\n exit(1);\n\n }\n\n}\n"}} {"sample_id": "396f929762d10ba2c7b38f7e8a2276dd066be2d7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,6 +2,6 @@\n \n {\n \n+ readline_start(\"(qemu) \", 0, monitor_handle_command1, NULL);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void monitor_start_input(void)\n\n{\n\n readline_start(\"(qemu) \", 0, monitor_handle_command1, NULL);\n\n}\n"}} {"sample_id": "3a3567d337d3ee6fb2e2fcc1d27cd045ed97ae9b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n io_remove_watch_poll(s->fd_tag);\n \n s->fd_tag = 0;\n+\n }\n \n s->connected = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void pty_chr_state(CharDriverState *chr, int connected)\n\n{\n\n PtyCharDriver *s = chr->opaque;\n\n\n\n if (!connected) {\n\n if (s->fd_tag) {\n\n io_remove_watch_poll(s->fd_tag);\n\n s->fd_tag = 0;\n\n }\n\n s->connected = 0;\n\n /* (re-)connect poll interval for idle guests: once per second.\n\n * We check more frequently in case the guests sends data to\n\n * the virtual device linked to our pty. */\n\n pty_chr_rearm_timer(chr, 1000);\n\n } else {\n\n if (s->timer_tag) {\n\n g_source_remove(s->timer_tag);\n\n s->timer_tag = 0;\n\n }\n\n if (!s->connected) {\n\n qemu_chr_be_generic_open(chr);\n\n s->connected = 1;\n\n s->fd_tag = io_add_watch_poll(s->fd, pty_chr_read_poll, pty_chr_read, chr);\n\n }\n\n }\n\n}\n"}} {"sample_id": "5c720657c23afd798ae0db7c7362eb859a89ab3d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n {\n \n AVStream *st;\n+\n uint8_t profile_level;\n \n \n@@ -11,7 +11,7 @@\n if (c->fc->nb_streams < 1)\n \n return 0;\n+\n st = c->fc->streams[c->fc->nb_streams-1];\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int mov_read_dvc1(MOVContext *c, AVIOContext *pb, MOVAtom atom)\n\n{\n\n AVStream *st;\n\n uint8_t profile_level;\n\n\n\n if (c->fc->nb_streams < 1)\n\n return 0;\n\n st = c->fc->streams[c->fc->nb_streams-1];\n\n\n\n if (atom.size >= (1<<28) || atom.size < 7)\n\n return AVERROR_INVALIDDATA;\n\n\n\n profile_level = avio_r8(pb);\n\n if ((profile_level & 0xf0) != 0xc0)\n\n return 0;\n\n\n\n av_free(st->codec->extradata);\n\n st->codec->extradata = av_mallocz(atom.size - 7 + FF_INPUT_BUFFER_PADDING_SIZE);\n\n if (!st->codec->extradata)\n\n return AVERROR(ENOMEM);\n\n st->codec->extradata_size = atom.size - 7;\n\n avio_seek(pb, 6, SEEK_CUR);\n\n avio_read(pb, st->codec->extradata, st->codec->extradata_size);\n\n return 0;\n\n}\n"}} {"sample_id": "94e7340b5db8bce7866e44e700ffa8fd26585c7e_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int nbd_send_reply(int csock, struct nbd_reply *reply)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int nbd_send_reply(int csock, struct nbd_reply *reply)\n\n{\n\n uint8_t buf[4 + 4 + 8];\n\n\n\n /* Reply\n\n [ 0 .. 3] magic (NBD_REPLY_MAGIC)\n\n [ 4 .. 7] error (0 == no error)\n\n [ 7 .. 15] handle\n\n */\n\n cpu_to_be32w((uint32_t*)buf, NBD_REPLY_MAGIC);\n\n cpu_to_be32w((uint32_t*)(buf + 4), reply->error);\n\n cpu_to_be64w((uint64_t*)(buf + 8), reply->handle);\n\n\n\n TRACE(\"Sending response to client\");\n\n\n\n if (write_sync(csock, buf, sizeof(buf)) != sizeof(buf)) {\n\n LOG(\"writing to socket failed\");\n\n errno = EINVAL;\n\n return -1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "6021615bbe393381f23b34a7cd0dcfd1a42687ba", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n if ((s->attributes & ATTR_BLINK))\n \n bg += 8;\n+\n+ if ((s->attributes & ATTR_REVERSE))\n+\n+ FFSWAP(int, fg, bg);\n+\n if ((s->attributes & ATTR_CONCEALED))\n \n fg = bg;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void draw_char(AVCodecContext *avctx, int c)\n\n{\n\n AnsiContext *s = avctx->priv_data;\n\n int fg = s->fg;\n\n int bg = s->bg;\n\n\n\n if ((s->attributes & ATTR_BOLD))\n\n fg += 8;\n\n if ((s->attributes & ATTR_BLINK))\n\n bg += 8;\n\n if ((s->attributes & ATTR_REVERSE))\n\n FFSWAP(int, fg, bg);\n\n if ((s->attributes & ATTR_CONCEALED))\n\n fg = bg;\n\n ff_draw_pc_font(s->frame->data[0] + s->y * s->frame->linesize[0] + s->x,\n\n s->frame->linesize[0], s->font, s->font_height, c, fg, bg);\n\n s->x += FONT_WIDTH;\n\n if (s->x >= avctx->width) {\n\n s->x = 0;\n\n hscroll(avctx);\n\n }\n\n}\n"}} {"sample_id": "b3ce84fea466f3bca2ff85d158744f00c0f429bd_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n TYPE_DEVICE);\n \n if (oc) {\n+\n+ DeviceClass *dc = DEVICE_CLASS(oc);\n+\n+\n+\n if (dc->hotpluggable) {\n \n /* If hotpluggable then skip not_used checking. */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int qdev_add_one_global(QemuOpts *opts, void *opaque)\n\n{\n\n GlobalProperty *g;\n\n ObjectClass *oc;\n\n\n\n g = g_malloc0(sizeof(*g));\n\n g->driver = qemu_opt_get(opts, \"driver\");\n\n g->property = qemu_opt_get(opts, \"property\");\n\n g->value = qemu_opt_get(opts, \"value\");\n\n oc = object_class_dynamic_cast(object_class_by_name(g->driver),\n\n TYPE_DEVICE);\n\n if (oc) {\n\n DeviceClass *dc = DEVICE_CLASS(oc);\n\n\n\n if (dc->hotpluggable) {\n\n /* If hotpluggable then skip not_used checking. */\n\n g->not_used = false;\n\n } else {\n\n /* Maybe a typo. */\n\n g->not_used = true;\n\n }\n\n } else {\n\n /* Maybe a typo. */\n\n g->not_used = true;\n\n }\n\n qdev_prop_register_global(g);\n\n return 0;\n\n}\n"}} {"sample_id": "b3db211f3c80bb996a704d665fe275619f728bd4_26", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n va_list *ap)\n \n+{\n+\n+ visitor_input_teardown(data, NULL);\n+\n+\n \n data->obj = qobject_from_jsonv(json_string, ap);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static Visitor *visitor_input_test_init_internal(TestInputVisitorData *data,\n\n const char *json_string,\n\n va_list *ap)\n\n{\n\n visitor_input_teardown(data, NULL);\n\n\n\n data->obj = qobject_from_jsonv(json_string, ap);\n\n g_assert(data->obj);\n\n\n\n data->qiv = qmp_input_visitor_new(data->obj, false);\n\n g_assert(data->qiv);\n\n return data->qiv;\n\n}\n"}} {"sample_id": "a70c27e813346a11e5fff3d329ecba82fb76826a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n int m, r;\n \n+\n \n m = (mode & 3);\n \n@@ -17,7 +17,7 @@\n src -= stride;\n \n tptr = tmp;\n+\n for(j = 0; j < 11; j++) {\n \n for(i = 0; i < 8; i++)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void vc1_mspel_mc(uint8_t *dst, const uint8_t *src, int stride, int mode, int rnd)\n\n{\n\n int i, j;\n\n uint8_t tmp[8*11], *tptr;\n\n int m, r;\n\n\n\n m = (mode & 3);\n\n r = rnd;\n\n src -= stride;\n\n tptr = tmp;\n\n for(j = 0; j < 11; j++) {\n\n for(i = 0; i < 8; i++)\n\n tptr[i] = vc1_mspel_filter(src + i, 1, m, r);\n\n src += stride;\n\n tptr += 8;\n\n }\n\n r = 1 - rnd;\n\n m = (mode >> 2) & 3;\n\n\n\n tptr = tmp + 8;\n\n for(j = 0; j < 8; j++) {\n\n for(i = 0; i < 8; i++)\n\n dst[i] = vc1_mspel_filter(tptr + i, 8, m, r);\n\n dst += stride;\n\n tptr += 8;\n\n }\n\n}\n"}} {"sample_id": "802f045a5f61b781df55e4492d896b4d20503ba7_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+void qemu_system_shutdown_request(void)\n+\n+{\n \n trace_qemu_system_shutdown_request();\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qemu_system_shutdown_request(void)\n\n{\n\n trace_qemu_system_shutdown_request();\n\n replay_shutdown_request();\n\n /* TODO - add a parameter to allow callers to specify reason */\n\n shutdown_requested = SHUTDOWN_CAUSE_HOST_ERROR;\n\n qemu_notify_event();\n\n}\n"}} {"sample_id": "4a1418e07bdcfaa3177739e04707ecaec75d89e1_19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -47,11 +47,11 @@\n \n \n /* we must restore the default rounding state */\n+\n+ asm volatile (\"fninit\");\n+\n+ fpuc = 0x037f | (env->fpuc & (3 << 10));\n+\n asm volatile(\"fldcw %0\" : : \"m\" (fpuc));\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void save_native_fp_fxsave(CPUState *env)\n\n{\n\n struct fpxstate *fp = &fpx1;\n\n int fptag, i, j;\n\n uint16_t fpuc;\n\n\n\n asm volatile (\"fxsave %0\" : : \"m\" (*fp));\n\n env->fpuc = fp->fpuc;\n\n env->fpstt = (fp->fpus >> 11) & 7;\n\n env->fpus = fp->fpus & ~0x3800;\n\n fptag = fp->fptag ^ 0xff;\n\n for(i = 0;i < 8; i++) {\n\n env->fptags[i] = (fptag >> i) & 1;\n\n }\n\n j = env->fpstt;\n\n for(i = 0;i < 8; i++) {\n\n memcpy(&env->fpregs[j].d, &fp->fpregs1[i * 16], 10);\n\n j = (j + 1) & 7;\n\n }\n\n if (env->cpuid_features & CPUID_SSE) {\n\n env->mxcsr = fp->mxcsr;\n\n memcpy(env->xmm_regs, fp->xmm_regs, CPU_NB_REGS * 16);\n\n }\n\n\n\n /* we must restore the default rounding state */\n\n asm volatile (\"fninit\");\n\n fpuc = 0x037f | (env->fpuc & (3 << 10));\n\n asm volatile(\"fldcw %0\" : : \"m\" (fpuc));\n\n}\n"}} {"sample_id": "d0bce760e04b1658a3b4ac95be2839ae20fd86db", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n OMAPI2C *s = g_malloc0(sizeof(*s));\n \n I2CAdapter *i2c = (I2CAdapter *)s;\n+\n uint16_t data;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "I2CAdapter *omap_i2c_create(uint64_t addr)\n\n{\n\n OMAPI2C *s = g_malloc0(sizeof(*s));\n\n I2CAdapter *i2c = (I2CAdapter *)s;\n\n uint16_t data;\n\n\n\n s->addr = addr;\n\n\n\n i2c->send = omap_i2c_send;\n\n i2c->recv = omap_i2c_recv;\n\n\n\n /* verify the mmio address by looking for a known signature */\n\n memread(addr + OMAP_I2C_REV, &data, 2);\n\n g_assert_cmphex(data, ==, 0x34);\n\n\n\n return i2c;\n\n}\n"}} {"sample_id": "6c150fbd341ac10b8559abcfd5915cfff17b70c6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n DeviceState *dev,\n \n uint8_t **exp_cap, Error **errp)\n+\n {\n \n *exp_cap = hotplug_dev->config + hotplug_dev->exp.exp_cap;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void pcie_cap_slot_hotplug_common(PCIDevice *hotplug_dev,\n\n DeviceState *dev,\n\n uint8_t **exp_cap, Error **errp)\n\n{\n\n *exp_cap = hotplug_dev->config + hotplug_dev->exp.exp_cap;\n\n uint16_t sltsta = pci_get_word(*exp_cap + PCI_EXP_SLTSTA);\n\n\n\n PCIE_DEV_PRINTF(PCI_DEVICE(dev), \"hotplug state: 0x%x\\n\", sltsta);\n\n if (sltsta & PCI_EXP_SLTSTA_EIS) {\n\n /* the slot is electromechanically locked.\n\n * This error is propagated up to qdev and then to HMP/QMP.\n\n */\n\n error_setg_errno(errp, -EBUSY, \"slot is electromechanically locked\");\n\n }\n\n}\n"}} {"sample_id": "e3f5ec2b5e92706e3b807059f79b1fb5d936e567_24", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,8 +14,8 @@\n \n return 0;\n \n+\n+\n+ return sizeof(s->buffer)-16;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int pcnet_can_receive(void *opaque)\n\n{\n\n PCNetState *s = opaque;\n\n if (CSR_STOP(s) || CSR_SPND(s))\n\n return 0;\n\n\n\n if (s->recv_pos > 0)\n\n return 0;\n\n\n\n return sizeof(s->buffer)-16;\n\n}\n"}} {"sample_id": "37f51384ae05bd50f83308339dbffa3e78404874_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n {\n \n s->root = vtd_get_quad_raw(s, DMAR_RTADDR_REG);\n+\n+ s->root_extended = s->root & VTD_RTADDR_RTT;\n+\n s->root &= VTD_RTADDR_ADDR_MASK(VTD_HOST_ADDRESS_WIDTH);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vtd_root_table_setup(IntelIOMMUState *s)\n\n{\n\n s->root = vtd_get_quad_raw(s, DMAR_RTADDR_REG);\n\n s->root_extended = s->root & VTD_RTADDR_RTT;\n\n s->root &= VTD_RTADDR_ADDR_MASK(VTD_HOST_ADDRESS_WIDTH);\n\n\n\n trace_vtd_reg_dmar_root(s->root, s->root_extended);\n\n}\n"}} {"sample_id": "e0c6cce44729d94e2a5507a4b6d031f23e8bd7b6_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n \n \n+ if (dct_algo == FF_DCT_AUTO || dct_algo == FF_DCT_MMX) {\n+\n+#if HAVE_MMX_INLINE\n+\n+ if (mm_flags & AV_CPU_FLAG_MMX && HAVE_MMX)\n \n s->dct_quantize = dct_quantize_MMX;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_MPV_encode_init_x86(MpegEncContext *s)\n\n{\n\n int mm_flags = av_get_cpu_flags();\n\n const int dct_algo = s->avctx->dct_algo;\n\n\n\n if (dct_algo == FF_DCT_AUTO || dct_algo == FF_DCT_MMX) {\n\n#if HAVE_MMX_INLINE\n\n if (mm_flags & AV_CPU_FLAG_MMX && HAVE_MMX)\n\n s->dct_quantize = dct_quantize_MMX;\n\n#endif\n\n#if HAVE_MMXEXT_INLINE\n\n if (mm_flags & AV_CPU_FLAG_MMXEXT && HAVE_MMXEXT)\n\n s->dct_quantize = dct_quantize_MMX2;\n\n#endif\n\n#if HAVE_SSE2_INLINE\n\n if (mm_flags & AV_CPU_FLAG_SSE2 && HAVE_SSE2)\n\n s->dct_quantize = dct_quantize_SSE2;\n\n#endif\n\n#if HAVE_SSSE3_INLINE\n\n if (mm_flags & AV_CPU_FLAG_SSSE3)\n\n s->dct_quantize = dct_quantize_SSSE3;\n\n#endif\n\n }\n\n}\n"}} {"sample_id": "cc9c1ed14e876d724107fe72f74dcac71a003fbc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ TranslationBlock *tb;\n+\n+\n+\n+ tb = s->tb;\n \n if (use_goto_tb(s, n, dest)) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_goto_tb(DisasContext *s, int n, uint64_t dest)\n\n{\n\n TranslationBlock *tb;\n\n\n\n tb = s->tb;\n\n if (use_goto_tb(s, n, dest)) {\n\n tcg_gen_goto_tb(n);\n\n gen_a64_set_pc_im(dest);\n\n tcg_gen_exit_tb((intptr_t)tb + n);\n\n s->is_jmp = DISAS_TB_JUMP;\n\n } else {\n\n gen_a64_set_pc_im(dest);\n\n if (s->singlestep_enabled) {\n\n gen_exception_internal(EXCP_DEBUG);\n\n }\n\n tcg_gen_exit_tb(0);\n\n s->is_jmp = DISAS_JUMP;\n\n }\n\n}\n"}} {"sample_id": "465e1dadbef7596a3eb87089a66bb4ecdc26d3c4_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static uint64_t get_v(ByteIOContext *bc)\n \n+{\n+\n+ uint64_t val = 0;\n+\n+\n \n for(; bytes_left(bc) > 0; )\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t get_v(ByteIOContext *bc)\n\n{\n\n uint64_t val = 0;\n\n\n\n for(; bytes_left(bc) > 0; )\n\n {\n\n\tint tmp = get_byte(bc);\n\n\n\n\tif (tmp&0x80)\n\n\t val= (val<<7) + tmp - 0x80;\n\n\telse\n\n\t return (val<<7) + tmp;\n\n }\n\n return -1;\n\n}\n"}} {"sample_id": "5b220e1e19c17b202d83d9be0868d152109ae8f0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n {\n \n+ MpegTSService *service;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static MpegTSService *mpegts_add_service(MpegTSWrite *ts, int sid,\n\n const char *provider_name,\n\n const char *name)\n\n{\n\n MpegTSService *service;\n\n\n\n service = av_mallocz(sizeof(MpegTSService));\n\n if (!service)\n\n return NULL;\n\n service->pmt.pid = ts->pmt_start_pid + ts->nb_services;\n\n service->sid = sid;\n\n service->provider_name = av_strdup(provider_name);\n\n service->name = av_strdup(name);\n\n service->pcr_pid = 0x1fff;\n\n dynarray_add(&ts->services, &ts->nb_services, service);\n\n return service;\n\n}\n"}} {"sample_id": "0b8b8753e4d94901627b3e86431230f2319215c4_31", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,8 +6,8 @@\n \n {\n \n+ Coroutine *co;\n+\n RwCo rwco = {\n \n .child = child,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int bdrv_prwv_co(BdrvChild *child, int64_t offset,\n\n QEMUIOVector *qiov, bool is_write,\n\n BdrvRequestFlags flags)\n\n{\n\n Coroutine *co;\n\n RwCo rwco = {\n\n .child = child,\n\n .offset = offset,\n\n .qiov = qiov,\n\n .is_write = is_write,\n\n .ret = NOT_DONE,\n\n .flags = flags,\n\n };\n\n\n\n if (qemu_in_coroutine()) {\n\n /* Fast-path if already in coroutine context */\n\n bdrv_rw_co_entry(&rwco);\n\n } else {\n\n AioContext *aio_context = bdrv_get_aio_context(child->bs);\n\n\n\n co = qemu_coroutine_create(bdrv_rw_co_entry);\n\n qemu_coroutine_enter(co, &rwco);\n\n while (rwco.ret == NOT_DONE) {\n\n aio_poll(aio_context, true);\n\n }\n\n }\n\n return rwco.ret;\n\n}\n"}} {"sample_id": "12848bfc5d719bad536c5448205a3226be1fda47_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int local_post_create_passthrough(FsContext *fs_ctx, const char *path,\n \n+ FsCred *credp)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int local_post_create_passthrough(FsContext *fs_ctx, const char *path,\n\n FsCred *credp)\n\n{\n\n if (chmod(rpath(fs_ctx, path), credp->fc_mode & 07777) < 0) {\n\n return -1;\n\n }\n\n if (chown(rpath(fs_ctx, path), credp->fc_uid, credp->fc_gid) < 0) {\n\n return -1;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "10f5a72f70862d299ddbdf226d6dc71fa4ae34dd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -60,11 +60,11 @@\n continue;\n \n }\n+\n+ }\n+\n+\n+\n virtio_blk_req_complete(req, VIRTIO_BLK_S_OK);\n \n block_acct_done(blk_get_stats(req->dev->blk), &req->acct);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void virtio_blk_rw_complete(void *opaque, int ret)\n\n{\n\n VirtIOBlockReq *next = opaque;\n\n\n\n while (next) {\n\n VirtIOBlockReq *req = next;\n\n next = req->mr_next;\n\n trace_virtio_blk_rw_complete(req, ret);\n\n\n\n if (req->qiov.nalloc != -1) {\n\n /* If nalloc is != 1 req->qiov is a local copy of the original\n\n * external iovec. It was allocated in submit_merged_requests\n\n * to be able to merge requests. */\n\n qemu_iovec_destroy(&req->qiov);\n\n }\n\n\n\n if (ret) {\n\n int p = virtio_ldl_p(VIRTIO_DEVICE(req->dev), &req->out.type);\n\n bool is_read = !(p & VIRTIO_BLK_T_OUT);\n\n /* Note that memory may be dirtied on read failure. If the\n\n * virtio request is not completed here, as is the case for\n\n * BLOCK_ERROR_ACTION_STOP, the memory may not be copied\n\n * correctly during live migration. While this is ugly,\n\n * it is acceptable because the device is free to write to\n\n * the memory until the request is completed (which will\n\n * happen on the other side of the migration).\n\n\n if (virtio_blk_handle_rw_error(req, -ret, is_read)) {\n\n\n\n\n\n continue;\n\n }\n\n }\n\n\n\n virtio_blk_req_complete(req, VIRTIO_BLK_S_OK);\n\n block_acct_done(blk_get_stats(req->dev->blk), &req->acct);\n\n virtio_blk_free_request(req);\n\n }\n\n}"}} {"sample_id": "2dc7fdf33d28940255f171b8ea4b692d9d5b7a7d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n \n return NULL;\n+\n+ }\n+\n+\n+\n offset = c->argv[1];\n \n if (offset > o->stat.st_size) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static MTPData *usb_mtp_get_partial_object(MTPState *s, MTPControl *c,\n\n MTPObject *o)\n\n{\n\n MTPData *d = usb_mtp_data_alloc(c);\n\n off_t offset;\n\n\n\n trace_usb_mtp_op_get_partial_object(s->dev.addr, o->handle, o->path,\n\n c->argv[1], c->argv[2]);\n\n\n\n d->fd = open(o->path, O_RDONLY);\n\n if (d->fd == -1) {\n\n\n return NULL;\n\n }\n\n\n\n offset = c->argv[1];\n\n if (offset > o->stat.st_size) {\n\n offset = o->stat.st_size;\n\n }\n\n lseek(d->fd, offset, SEEK_SET);\n\n\n\n d->length = c->argv[2];\n\n if (d->length > o->stat.st_size - offset) {\n\n d->length = o->stat.st_size - offset;\n\n }\n\n\n\n return d;\n\n}"}} {"sample_id": "8cd1c0febe88b757e915e9af15559575c21ca728_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static av_cold int pcx_init(AVCodecContext *avctx) {\n \n PCXContext *s = avctx->priv_data;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static av_cold int pcx_init(AVCodecContext *avctx) {\n\n PCXContext *s = avctx->priv_data;\n\n\n\n avcodec_get_frame_defaults(&s->picture);\n\n avctx->coded_frame= &s->picture;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "4c8ae0f60e63478aea0a1741cca95474b68fb949", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static inline bool migration_bitmap_test_and_reset_dirty(MemoryRegion *mr,\n+\n+ ram_addr_t offset)\n+\n+{\n \n bool ret;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline bool migration_bitmap_test_and_reset_dirty(MemoryRegion *mr,\n\n ram_addr_t offset)\n\n{\n\n bool ret;\n\n int nr = (mr->ram_addr + offset) >> TARGET_PAGE_BITS;\n\n\n\n ret = test_and_clear_bit(nr, migration_bitmap);\n\n\n\n if (ret) {\n\n migration_dirty_pages--;\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "1a0d9b503d2e9c4278d6e93d40873dff9d191a25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,8 +20,8 @@\n \n return AVERROR_EOF;\n \n+ }\n+\n+ return open_file(avf, fileno);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int open_next_file(AVFormatContext *avf)\n\n{\n\n ConcatContext *cat = avf->priv_data;\n\n unsigned fileno = cat->cur_file - cat->files;\n\n\n\n if (cat->cur_file->duration == AV_NOPTS_VALUE)\n\n cat->cur_file->duration = cat->avf->duration - (cat->cur_file->file_inpoint - cat->cur_file->file_start_time);\n\n\n\n if (++fileno >= cat->nb_files) {\n\n cat->eof = 1;\n\n return AVERROR_EOF;\n\n }\n\n return open_file(avf, fileno);\n\n}\n"}} {"sample_id": "862c1d2f0573c81ed0929b685c55959906b4300c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n for (i=0; channel_layout_map[i].name; i++)\n \n+ if (nb_channels == channel_layout_map[i].nb_channels &&\n+\n+ channel_layout == channel_layout_map[i].layout) {\n+\n+ snprintf(buf, buf_size, channel_layout_map[i].name);\n \n return;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void avcodec_get_channel_layout_string(char *buf, int buf_size, int nb_channels, int64_t channel_layout)\n\n{\n\n int i;\n\n\n\n if (channel_layout==0)\n\n channel_layout = avcodec_guess_channel_layout(nb_channels, CODEC_ID_NONE, NULL);\n\n\n\n for (i=0; channel_layout_map[i].name; i++)\n\n if (nb_channels == channel_layout_map[i].nb_channels &&\n\n channel_layout == channel_layout_map[i].layout) {\n\n snprintf(buf, buf_size, channel_layout_map[i].name);\n\n return;\n\n }\n\n\n\n snprintf(buf, buf_size, \"%d channels\", nb_channels);\n\n if (channel_layout) {\n\n int i,ch;\n\n av_strlcat(buf, \" (\", buf_size);\n\n for(i=0,ch=0; i<64; i++) {\n\n if ((channel_layout & (1L<0) av_strlcat(buf, \"|\", buf_size);\n\n av_strlcat(buf, name, buf_size);\n\n }\n\n ch++;\n\n }\n\n }\n\n av_strlcat(buf, \")\", buf_size);\n\n }\n\n}\n"}} {"sample_id": "895b00f62a7e86724dc7352d67c7808d37366130_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n read_count = fread(buf, 1, count, fh);\n if (ferror(fh)) {\n error_setg_errno(errp, errno, \"failed to read file\");\n+ slog(\"guest-file-read failed, handle: %\" PRId64, handle);\n+ } else {\n+ buf[read_count] = 0;\n+ read_data = g_new0(GuestFileRead, 1);\n+ read_data->count = read_count;\n read_data->eof = feof(fh);\n if (read_count) {\n read_data->buf_b64 = g_base64_encode(buf, read_count);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "struct GuestFileRead *qmp_guest_file_read(int64_t handle, bool has_count,\n int64_t count, Error **errp)\n{\n GuestFileHandle *gfh = guest_file_handle_find(handle, errp);\n GuestFileRead *read_data = NULL;\n guchar *buf;\n FILE *fh;\n size_t read_count;\n if (!gfh) {\n if (!has_count) {\n count = QGA_READ_COUNT_DEFAULT;\n } else if (count < 0) {\n error_setg(errp, \"value '%\" PRId64 \"' is invalid for argument count\",\n count);\n fh = gfh->fh;\n buf = g_malloc0(count+1);\n read_count = fread(buf, 1, count, fh);\n if (ferror(fh)) {\n error_setg_errno(errp, errno, \"failed to read file\");\n slog(\"guest-file-read failed, handle: %\" PRId64, handle);\n } else {\n buf[read_count] = 0;\n read_data = g_new0(GuestFileRead, 1);\n read_data->count = read_count;\n read_data->eof = feof(fh);\n if (read_count) {\n read_data->buf_b64 = g_base64_encode(buf, read_count);\n gfh->state = RW_STATE_READING;\n g_free(buf);\n clearerr(fh);\n return read_data;"}} {"sample_id": "185698715dfb18c82ad2a5dbc169908602d43e81_15", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static inline uint32_t efsctsf(uint32_t val)\n+\n+{\n+\n+ CPU_FloatU u;\n \n float32 tmp;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline uint32_t efsctsf(uint32_t val)\n\n{\n\n CPU_FloatU u;\n\n float32 tmp;\n\n\n\n u.l = val;\n\n /* NaN are not treated the same way IEEE 754 does */\n\n if (unlikely(float32_is_nan(u.f)))\n\n return 0;\n\n tmp = uint64_to_float32(1ULL << 32, &env->vec_status);\n\n u.f = float32_mul(u.f, tmp, &env->vec_status);\n\n\n\n return float32_to_int32(u.f, &env->vec_status);\n\n}\n"}} {"sample_id": "2f448e415f364d0ec4c5556993e44ca183e31c5c_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n unsigned size)\n \n {\n+\n MacIONVRAMState *s = opaque;\n \n uint32_t value;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint64_t macio_nvram_readb(void *opaque, hwaddr addr,\n\n unsigned size)\n\n{\n\n MacIONVRAMState *s = opaque;\n\n uint32_t value;\n\n\n\n addr = (addr >> s->it_shift) & (s->size - 1);\n\n value = s->data[addr];\n\n NVR_DPRINTF(\"readb addr %04x val %x\\n\", (int)addr, value);\n\n\n\n return value;\n\n}\n"}} {"sample_id": "7595ed743914b9de1d146213dedc1e007283f723", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n \n \n+ for (i = 1; i < 3; i++) {\n+\n+ EventNotifierTestData data = { .n = 0, .active = 10, .auto_set = true };\n+\n+ event_notifier_init(&data.e, false);\n \n aio_set_event_notifier(ctx, &data.e, true, event_ready_cb);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void test_aio_external_client(void)\n\n{\n\n int i, j;\n\n\n\n for (i = 1; i < 3; i++) {\n\n EventNotifierTestData data = { .n = 0, .active = 10, .auto_set = true };\n\n event_notifier_init(&data.e, false);\n\n aio_set_event_notifier(ctx, &data.e, true, event_ready_cb);\n\n event_notifier_set(&data.e);\n\n for (j = 0; j < i; j++) {\n\n aio_disable_external(ctx);\n\n }\n\n for (j = 0; j < i; j++) {\n\n assert(!aio_poll(ctx, false));\n\n assert(event_notifier_test_and_clear(&data.e));\n\n event_notifier_set(&data.e);\n\n aio_enable_external(ctx);\n\n }\n\n assert(aio_poll(ctx, false));\n\n\n event_notifier_cleanup(&data.e);\n\n }\n\n}"}} {"sample_id": "7f595609b49615b07c50b7182c4ef125c39cb5da_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,10 +16,10 @@\n \n uc->handle_reset = usb_hid_handle_reset;\n \n+ uc->handle_control = usb_hid_handle_control;\n+\n+ uc->handle_data = usb_hid_handle_data;\n+\n+ uc->handle_destroy = usb_hid_handle_destroy;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void usb_keyboard_class_initfn(ObjectClass *klass, void *data)\n\n{\n\n USBDeviceClass *uc = USB_DEVICE_CLASS(klass);\n\n\n\n uc->init = usb_keyboard_initfn;\n\n uc->product_desc = \"QEMU USB Keyboard\";\n\n uc->usb_desc = &desc_keyboard;\n\n uc->handle_packet = usb_generic_handle_packet;\n\n uc->handle_reset = usb_hid_handle_reset;\n\n uc->handle_control = usb_hid_handle_control;\n\n uc->handle_data = usb_hid_handle_data;\n\n uc->handle_destroy = usb_hid_handle_destroy;\n\n}\n"}} {"sample_id": "c3e10c7b4377c1cbc0a4fbc12312c2cf41c0cda7_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static always_inline void gen_op_subfo_64 (void)\n+\n {\n+\n gen_op_move_T2_T0();\n \n gen_op_subf();", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static always_inline void gen_op_subfo_64 (void)\n\n{\n\n gen_op_move_T2_T0();\n\n gen_op_subf();\n\n gen_op_check_subfo_64();\n\n}\n"}} {"sample_id": "200bf596b96820186883953de9bda26cac8e6bd7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n ARMCPU *cpu = ARM_CPU(obj);\n \n+ set_feature(&cpu->env, ARM_FEATURE_V6K);\n+\n+ set_feature(&cpu->env, ARM_FEATURE_VFP);\n+\n+ set_feature(&cpu->env, ARM_FEATURE_VAPA);\n \n cpu->midr = ARM_CPUID_ARM11MPCORE;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void arm11mpcore_initfn(Object *obj)\n\n{\n\n ARMCPU *cpu = ARM_CPU(obj);\n\n set_feature(&cpu->env, ARM_FEATURE_V6K);\n\n set_feature(&cpu->env, ARM_FEATURE_VFP);\n\n set_feature(&cpu->env, ARM_FEATURE_VAPA);\n\n cpu->midr = ARM_CPUID_ARM11MPCORE;\n\n cpu->reset_fpsid = 0x410120b4;\n\n cpu->mvfr0 = 0x11111111;\n\n cpu->mvfr1 = 0x00000000;\n\n cpu->ctr = 0x1dd20d2;\n\n cpu->id_pfr0 = 0x111;\n\n cpu->id_pfr1 = 0x1;\n\n cpu->id_dfr0 = 0;\n\n cpu->id_afr0 = 0x2;\n\n cpu->id_mmfr0 = 0x01100103;\n\n cpu->id_mmfr1 = 0x10020302;\n\n cpu->id_mmfr2 = 0x01222000;\n\n cpu->id_isar0 = 0x00100011;\n\n cpu->id_isar1 = 0x12002111;\n\n cpu->id_isar2 = 0x11221011;\n\n cpu->id_isar3 = 0x01102131;\n\n cpu->id_isar4 = 0x141;\n\n}\n"}} {"sample_id": "ce5b1bbf624b977a55ff7f85bb3871682d03baff_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,7 +20,7 @@\n \n cc->reset = superh_cpu_reset;\n \n+\n \n cc->class_by_name = superh_cpu_class_by_name;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void superh_cpu_class_init(ObjectClass *oc, void *data)\n\n{\n\n DeviceClass *dc = DEVICE_CLASS(oc);\n\n CPUClass *cc = CPU_CLASS(oc);\n\n SuperHCPUClass *scc = SUPERH_CPU_CLASS(oc);\n\n\n\n scc->parent_realize = dc->realize;\n\n dc->realize = superh_cpu_realizefn;\n\n\n\n scc->parent_reset = cc->reset;\n\n cc->reset = superh_cpu_reset;\n\n\n\n cc->class_by_name = superh_cpu_class_by_name;\n\n cc->has_work = superh_cpu_has_work;\n\n cc->do_interrupt = superh_cpu_do_interrupt;\n\n cc->cpu_exec_interrupt = superh_cpu_exec_interrupt;\n\n cc->dump_state = superh_cpu_dump_state;\n\n cc->set_pc = superh_cpu_set_pc;\n\n cc->synchronize_from_tb = superh_cpu_synchronize_from_tb;\n\n cc->gdb_read_register = superh_cpu_gdb_read_register;\n\n cc->gdb_write_register = superh_cpu_gdb_write_register;\n\n#ifdef CONFIG_USER_ONLY\n\n cc->handle_mmu_fault = superh_cpu_handle_mmu_fault;\n\n#else\n\n cc->get_phys_page_debug = superh_cpu_get_phys_page_debug;\n\n#endif\n\n cc->disas_set_info = superh_cpu_disas_set_info;\n\n\n\n cc->gdb_num_core_regs = 59;\n\n\n\n dc->vmsd = &vmstate_sh_cpu;\n\n\n\n /*\n\n * Reason: superh_cpu_initfn() calls cpu_exec_init(), which saves\n\n * the object in cpus -> dangling pointer after final\n\n * object_unref().\n\n */\n\n dc->cannot_destroy_with_object_finalize_yet = true;\n\n}\n"}} {"sample_id": "e9a07334fb6ee08ddd61787c102d36e7e781efef", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n if (!f)\n return;\n if (s->ctla & CTLA_FORCE_BLANK) {\n+ /* blank screen */\n+ fprintf(f, \"P4\\n%d %d\\n\",\n+ s->width, s->height);\n+ for (y = 0; y < s->height; y++)\n+ for (x = 0; x < s->width; x++)\n fputc(0, f);\n } else {\n data_buffer = s->vram + s->top_of_screen;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void g364fb_screen_dump(void *opaque, const char *filename)\n{\n G364State *s = opaque;\n int y, x;\n uint8_t index;\n uint8_t *data_buffer;\n FILE *f;\n if (s->depth != 8) {\n error_report(\"g364: unknown guest depth %d\", s->depth);\n return;\n }\n f = fopen(filename, \"wb\");\n if (!f)\n return;\n if (s->ctla & CTLA_FORCE_BLANK) {\n /* blank screen */\n fprintf(f, \"P4\\n%d %d\\n\",\n s->width, s->height);\n for (y = 0; y < s->height; y++)\n for (x = 0; x < s->width; x++)\n fputc(0, f);\n } else {\n data_buffer = s->vram + s->top_of_screen;\n fprintf(f, \"P6\\n%d %d\\n%d\\n\",\n s->width, s->height, 255);\n for (y = 0; y < s->height; y++)\n for (x = 0; x < s->width; x++, data_buffer++) {\n index = *data_buffer;\n fputc(s->color_palette[index][0], f);\n fputc(s->color_palette[index][1], f);\n fputc(s->color_palette[index][2], f);\n }\n }\n fclose(f);\n}"}} {"sample_id": "82a3d1f81f8e401c6c34cba541970197aba2bb9a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n AlphaCPU *cpu;\n \n ObjectClass *cpu_class;\n+\n+\n+\n+ cpu_class = alpha_cpu_class_by_name(cpu_model);\n+\n if (cpu_class == NULL) {\n \n /* Default to ev67; no reason not to emulate insns by default. */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "AlphaCPU *cpu_alpha_init(const char *cpu_model)\n\n{\n\n AlphaCPU *cpu;\n\n ObjectClass *cpu_class;\n\n\n\n cpu_class = alpha_cpu_class_by_name(cpu_model);\n\n if (cpu_class == NULL) {\n\n /* Default to ev67; no reason not to emulate insns by default. */\n\n cpu_class = object_class_by_name(TYPE(\"ev67\"));\n\n }\n\n cpu = ALPHA_CPU(object_new(object_class_get_name(cpu_class)));\n\n\n\n object_property_set_bool(OBJECT(cpu), true, \"realized\", NULL);\n\n\n\n return cpu;\n\n}\n"}} {"sample_id": "f53671c054ba0b5d5b10e2a7294786fa2f73479e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,12 +3,12 @@\n {\n \n s->txint = 1;\n+\n if (!s->rxint_under_svc) {\n \n s->txint_under_svc = 1;\n \n+ if (s->chn == chn_a) {\n \n s->rregs[R_INTR] |= INTR_TXINTA;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static inline void set_txint(ChannelState *s)\n\n{\n\n s->txint = 1;\n\n if (!s->rxint_under_svc) {\n\n s->txint_under_svc = 1;\n\n if (s->chn == chn_a) {\n\n s->rregs[R_INTR] |= INTR_TXINTA;\n\n if (s->wregs[W_MINTR] & MINTR_STATUSHI)\n\n s->otherchn->rregs[R_IVEC] = IVEC_HITXINTA;\n\n else\n\n s->otherchn->rregs[R_IVEC] = IVEC_LOTXINTA;\n\n } else {\n\n s->rregs[R_IVEC] = IVEC_TXINTB;\n\n s->otherchn->rregs[R_INTR] |= INTR_TXINTB;\n\n }\n\n escc_update_irq(s);\n\n }\n\n}\n"}} {"sample_id": "40f16dd1279e7f26357b3c4b3838a89ffc6153da", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,8 +9,8 @@\n \n \n if (ret) {\n+\n+ DPRINTF(\"IO error ret %d\\n\", ret);\n \n scsi_command_complete(r, ret);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void scsi_read_complete(void * opaque, int ret)\n\n{\n\n SCSIGenericReq *r = (SCSIGenericReq *)opaque;\n\n int len;\n\n\n\n if (ret) {\n\n DPRINTF(\"IO error ret %d\\n\", ret);\n\n scsi_command_complete(r, ret);\n\n return;\n\n }\n\n len = r->io_header.dxfer_len - r->io_header.resid;\n\n DPRINTF(\"Data ready tag=0x%x len=%d\\n\", r->req.tag, len);\n\n\n\n r->len = -1;\n\n r->req.bus->complete(r->req.bus, SCSI_REASON_DATA, r->req.tag, len);\n\n if (len == 0)\n\n scsi_command_complete(r, 0);\n\n}\n"}} {"sample_id": "32bafa8fdd098d52fbf1102d5a5e48d29398c0aa_29", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void qemu_chr_parse_pipe(QemuOpts *opts, ChardevBackend *backend,\n \n Error **errp)\n+\n+{\n+\n+ const char *device = qemu_opt_get(opts, \"path\");\n+\n ChardevHostdev *dev;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qemu_chr_parse_pipe(QemuOpts *opts, ChardevBackend *backend,\n\n Error **errp)\n\n{\n\n const char *device = qemu_opt_get(opts, \"path\");\n\n ChardevHostdev *dev;\n\n\n\n if (device == NULL) {\n\n error_setg(errp, \"chardev: pipe: no device path given\");\n\n return;\n\n }\n\n dev = backend->u.pipe = g_new0(ChardevHostdev, 1);\n\n qemu_chr_parse_common(opts, qapi_ChardevHostdev_base(dev));\n\n dev->device = g_strdup(device);\n\n}\n"}} {"sample_id": "f1e173049ecc9de03817385ba8962d14cba779db_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n *nmsedec += getnmsedec_sig(t1->data[y][x], bpno + NMSEDEC_FRACBITS);\n \n+ ff_jpeg2000_set_significance(t1, x, y, t1->flags[y+1][x+1] >> 15);\n+\n+ }\n+\n+ t1->flags[y+1][x+1] |= JPEG2000_T1_VIS;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void encode_sigpass(Jpeg2000T1Context *t1, int width, int height, int bandno, int *nmsedec, int bpno)\n\n{\n\n int y0, x, y, mask = 1 << (bpno + NMSEDEC_FRACBITS);\n\n for (y0 = 0; y0 < height; y0 += 4)\n\n for (x = 0; x < width; x++)\n\n for (y = y0; y < height && y < y0+4; y++){\n\n if (!(t1->flags[y+1][x+1] & JPEG2000_T1_SIG) && (t1->flags[y+1][x+1] & JPEG2000_T1_SIG_NB)){\n\n int ctxno = ff_jpeg2000_getsigctxno(t1->flags[y+1][x+1], bandno),\n\n bit = t1->data[y][x] & mask ? 1 : 0;\n\n ff_mqc_encode(&t1->mqc, t1->mqc.cx_states + ctxno, bit);\n\n if (bit){\n\n int xorbit;\n\n int ctxno = ff_jpeg2000_getsgnctxno(t1->flags[y+1][x+1], &xorbit);\n\n ff_mqc_encode(&t1->mqc, t1->mqc.cx_states + ctxno, (t1->flags[y+1][x+1] >> 15) ^ xorbit);\n\n *nmsedec += getnmsedec_sig(t1->data[y][x], bpno + NMSEDEC_FRACBITS);\n\n ff_jpeg2000_set_significance(t1, x, y, t1->flags[y+1][x+1] >> 15);\n\n }\n\n t1->flags[y+1][x+1] |= JPEG2000_T1_VIS;\n\n }\n\n }\n\n}\n"}} {"sample_id": "14a10fc39923b3af07c8c46d22cb20843bee3a72_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void openrisc_cpu_realizefn(DeviceState *dev, Error **errp)\n+\n {\n+\n OpenRISCCPU *cpu = OPENRISC_CPU(dev);\n \n OpenRISCCPUClass *occ = OPENRISC_CPU_GET_CLASS(dev);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void openrisc_cpu_realizefn(DeviceState *dev, Error **errp)\n\n{\n\n OpenRISCCPU *cpu = OPENRISC_CPU(dev);\n\n OpenRISCCPUClass *occ = OPENRISC_CPU_GET_CLASS(dev);\n\n\n\n cpu_reset(CPU(cpu));\n\n\n\n occ->parent_realize(dev, errp);\n\n}\n"}} {"sample_id": "c20fd872257fb9abd2ce99741937c0f65aa162b7_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n {\n \n if (req->out->sector & req->dev->sector_mask) {\n+\n+ virtio_blk_rw_complete(req, -EIO);\n+\n+ return;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_blk_handle_write(BlockRequest *blkreq, int *num_writes,\n\n VirtIOBlockReq *req)\n\n{\n\n if (req->out->sector & req->dev->sector_mask) {\n\n virtio_blk_rw_complete(req, -EIO);\n\n return;\n\n }\n\n\n\n if (*num_writes == 32) {\n\n do_multiwrite(req->dev->bs, blkreq, *num_writes);\n\n *num_writes = 0;\n\n }\n\n\n\n blkreq[*num_writes].sector = req->out->sector;\n\n blkreq[*num_writes].nb_sectors = req->qiov.size / BDRV_SECTOR_SIZE;\n\n blkreq[*num_writes].qiov = &req->qiov;\n\n blkreq[*num_writes].cb = virtio_blk_rw_complete;\n\n blkreq[*num_writes].opaque = req;\n\n blkreq[*num_writes].error = 0;\n\n\n\n (*num_writes)++;\n\n}\n"}} {"sample_id": "d0855f1235ed203700a3a24fc7e138490c272117", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n CFDictionarySetValue( classesToMatch, CFSTR( kIOMediaEjectableKey ), kCFBooleanTrue );\n \n+ }\n+\n+ kernResult = IOServiceGetMatchingServices( masterPort, classesToMatch, mediaIterator );\n+\n+ if ( KERN_SUCCESS != kernResult )\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "kern_return_t FindEjectableCDMedia( io_iterator_t *mediaIterator )\n\n{\n\n kern_return_t kernResult;\n\n mach_port_t masterPort;\n\n CFMutableDictionaryRef classesToMatch;\n\n\n\n kernResult = IOMasterPort( MACH_PORT_NULL, &masterPort );\n\n if ( KERN_SUCCESS != kernResult ) {\n\n printf( \"IOMasterPort returned %d\\n\", kernResult );\n\n }\n\n\n\n classesToMatch = IOServiceMatching( kIOCDMediaClass );\n\n if ( classesToMatch == NULL ) {\n\n printf( \"IOServiceMatching returned a NULL dictionary.\\n\" );\n\n } else {\n\n CFDictionarySetValue( classesToMatch, CFSTR( kIOMediaEjectableKey ), kCFBooleanTrue );\n\n }\n\n kernResult = IOServiceGetMatchingServices( masterPort, classesToMatch, mediaIterator );\n\n if ( KERN_SUCCESS != kernResult )\n\n {\n\n printf( \"IOServiceGetMatchingServices returned %d\\n\", kernResult );\n\n }\n\n\n\n return kernResult;\n\n}\n"}} {"sample_id": "22956a3755749b9cf6375ad024d58c1d277100bf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n rc = spapr_vio_dma_write(&s->vdev, req->crq.s.IU_data_ptr,\n \n &req->iu, length);\n+\n if (rc) {\n \n fprintf(stderr, \"vscsi_send_iu: DMA write failure !\\n\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int vscsi_send_iu(VSCSIState *s, vscsi_req *req,\n\n uint64_t length, uint8_t format)\n\n{\n\n long rc, rc1;\n\n\n\n /* First copy the SRP */\n\n rc = spapr_vio_dma_write(&s->vdev, req->crq.s.IU_data_ptr,\n\n &req->iu, length);\n\n if (rc) {\n\n fprintf(stderr, \"vscsi_send_iu: DMA write failure !\\n\");\n\n }\n\n\n\n req->crq.s.valid = 0x80;\n\n req->crq.s.format = format;\n\n req->crq.s.reserved = 0x00;\n\n req->crq.s.timeout = cpu_to_be16(0x0000);\n\n req->crq.s.IU_length = cpu_to_be16(length);\n\n req->crq.s.IU_data_ptr = req->iu.srp.rsp.tag; /* right byte order */\n\n\n\n if (rc == 0) {\n\n req->crq.s.status = 0x99; /* Just needs to be non-zero */\n\n } else {\n\n req->crq.s.status = 0x00;\n\n }\n\n\n\n rc1 = spapr_vio_send_crq(&s->vdev, req->crq.raw);\n\n if (rc1) {\n\n fprintf(stderr, \"vscsi_send_iu: Error sending response\\n\");\n\n return rc1;\n\n }\n\n\n\n return rc;\n\n}\n"}} {"sample_id": "e29d2d9c92e19b0caf05a2064d132ccdecdfc3d5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n if (oc->oformat->check_bitstream) {\n \n+ int ret = oc->oformat->check_bitstream(oc, pkt);\n+\n+ if (ret == 1) {\n+\n+ AVStream *st = s->streams[pkt->stream_index];\n \n AVStream *ost = oc->streams[pkt->stream_index];\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int seg_check_bitstream(struct AVFormatContext *s, const AVPacket *pkt)\n\n{\n\n SegmentContext *seg = s->priv_data;\n\n AVFormatContext *oc = seg->avf;\n\n if (oc->oformat->check_bitstream) {\n\n int ret = oc->oformat->check_bitstream(oc, pkt);\n\n if (ret == 1) {\n\n AVStream *st = s->streams[pkt->stream_index];\n\n AVStream *ost = oc->streams[pkt->stream_index];\n\n st->internal->bsfcs = ost->internal->bsfcs;\n\n st->internal->nb_bsfcs = ost->internal->nb_bsfcs;\n\n ost->internal->bsfcs = NULL;\n\n ost->internal->nb_bsfcs = 0;\n\n }\n\n return ret;\n\n }\n\n return 1;\n\n}\n"}} {"sample_id": "e23a1b33b53d25510320b26d9f154e19c6c99725_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n target_phys_addr_t mem_base,\n \n qemu_irq *pic, PCIBus **bus2, PCIBus **bus3)\n+\n {\n \n DeviceState *dev;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "PCIBus *pci_apb_init(target_phys_addr_t special_base,\n\n target_phys_addr_t mem_base,\n\n qemu_irq *pic, PCIBus **bus2, PCIBus **bus3)\n\n{\n\n DeviceState *dev;\n\n SysBusDevice *s;\n\n APBState *d;\n\n\n\n /* Ultrasparc PBM main bus */\n\n dev = qdev_create(NULL, \"pbm\");\n\n qdev_init(dev);\n\n s = sysbus_from_qdev(dev);\n\n /* apb_config */\n\n sysbus_mmio_map(s, 0, special_base + 0x2000ULL);\n\n /* pci_ioport */\n\n sysbus_mmio_map(s, 1, special_base + 0x2000000ULL);\n\n /* mem_config: XXX size should be 4G-prom */\n\n sysbus_mmio_map(s, 2, special_base + 0x1000000ULL);\n\n /* mem_data */\n\n sysbus_mmio_map(s, 3, mem_base);\n\n d = FROM_SYSBUS(APBState, s);\n\n d->host_state.bus = pci_register_bus(&d->busdev.qdev, \"pci\",\n\n pci_apb_set_irq, pci_pbm_map_irq, pic,\n\n 0, 32);\n\n pci_create_simple(d->host_state.bus, 0, \"pbm\");\n\n /* APB secondary busses */\n\n *bus2 = pci_bridge_init(d->host_state.bus, 8, PCI_VENDOR_ID_SUN,\n\n PCI_DEVICE_ID_SUN_SIMBA, pci_apb_map_irq,\n\n \"Advanced PCI Bus secondary bridge 1\");\n\n *bus3 = pci_bridge_init(d->host_state.bus, 9, PCI_VENDOR_ID_SUN,\n\n PCI_DEVICE_ID_SUN_SIMBA, pci_apb_map_irq,\n\n \"Advanced PCI Bus secondary bridge 2\");\n\n\n\n return d->host_state.bus;\n\n}\n"}} {"sample_id": "7fb439115de7354b3ac2becf24457acaf828296b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n \n \n+ nc = net_hub_find_client_by_name(vlan_id, device);\n+\n+ if (!nc) {\n+\n+ error_report(\"Host network device '%s' on hub '%d' not found\",\n \n device, vlan_id);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void hmp_host_net_remove(Monitor *mon, const QDict *qdict)\n\n{\n\n NetClientState *nc;\n\n int vlan_id = qdict_get_int(qdict, \"vlan_id\");\n\n const char *device = qdict_get_str(qdict, \"device\");\n\n\n\n nc = net_hub_find_client_by_name(vlan_id, device);\n\n if (!nc) {\n\n error_report(\"Host network device '%s' on hub '%d' not found\",\n\n device, vlan_id);\n\n return;\n\n }\n\n if (!net_host_check_device(nc->model)) {\n\n error_report(\"invalid host network device '%s'\", device);\n\n return;\n\n }\n\n\n\n qemu_del_net_client(nc->peer);\n\n qemu_del_net_client(nc);\n\n}\n"}} {"sample_id": "9a78eead0c74333a394c0f7bbfc4423ac746fcd5_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n max = ARRAY_SIZE(ppc_defs);\n \n+ for (i = 0; i < max; i++) {\n+\n+ (*cpu_fprintf)(f, \"PowerPC %-16s PVR %08x\\n\",\n+\n ppc_defs[i].name, ppc_defs[i].pvr);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ppc_cpu_list (FILE *f, int (*cpu_fprintf)(FILE *f, const char *fmt, ...))\n\n{\n\n int i, max;\n\n\n\n max = ARRAY_SIZE(ppc_defs);\n\n for (i = 0; i < max; i++) {\n\n (*cpu_fprintf)(f, \"PowerPC %-16s PVR %08x\\n\",\n\n ppc_defs[i].name, ppc_defs[i].pvr);\n\n }\n\n}\n"}} {"sample_id": "465e1dadbef7596a3eb87089a66bb4ecdc26d3c4_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n if(pos >= 0)\n \n url_fseek(bc, pos, SEEK_SET); //note, this may fail if the stream isnt seekable, but that shouldnt matter, as in this case we simply start where we are currently\n+\n+\n+\n+ while(bytes_left(bc)){\n+\n state= (state<<8) | get_byte(bc);\n \n if((state>>56) != 'N')", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t find_any_startcode(ByteIOContext *bc, int64_t pos){\n\n uint64_t state=0;\n\n \n\n if(pos >= 0)\n\n url_fseek(bc, pos, SEEK_SET); //note, this may fail if the stream isnt seekable, but that shouldnt matter, as in this case we simply start where we are currently\n\n\n\n while(bytes_left(bc)){\n\n state= (state<<8) | get_byte(bc);\n\n if((state>>56) != 'N')\n\n continue;\n\n switch(state){\n\n case MAIN_STARTCODE:\n\n case STREAM_STARTCODE:\n\n case KEYFRAME_STARTCODE:\n\n case INFO_STARTCODE:\n\n case INDEX_STARTCODE:\n\n return state;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "74892d2468b9f0c56b915ce94848d6f7fac39740", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+static bool qemu_vmstop_requested(RunState *r)\n+\n+{\n+\n+ if (vmstop_requested < RUN_STATE_MAX) {\n \n+ *r = vmstop_requested;\n \n vmstop_requested = RUN_STATE_MAX;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static bool qemu_vmstop_requested(RunState *r)\n\n{\n\n if (vmstop_requested < RUN_STATE_MAX) {\n\n *r = vmstop_requested;\n\n vmstop_requested = RUN_STATE_MAX;\n\n return true;\n\n }\n\n\n\n return false;\n\n}\n"}} {"sample_id": "c572f23a3e7180dbeab5e86583e43ea2afed6271_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -37,11 +37,11 @@\n \n \n \n+ fidp = get_fid(pdu, fid);\n+\n+ if (fidp == NULL) {\n+\n+ err = -ENOENT;\n \n goto out_nofid;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void v9fs_mknod(void *opaque)\n\n{\n\n\n\n int mode;\n\n gid_t gid;\n\n int32_t fid;\n\n V9fsQID qid;\n\n int err = 0;\n\n int major, minor;\n\n size_t offset = 7;\n\n V9fsString name;\n\n struct stat stbuf;\n\n V9fsFidState *fidp;\n\n V9fsPDU *pdu = opaque;\n\n V9fsState *s = pdu->s;\n\n\n\n pdu_unmarshal(pdu, offset, \"dsdddd\", &fid, &name, &mode,\n\n &major, &minor, &gid);\n\n\n\n\n fidp = get_fid(pdu, fid);\n\n if (fidp == NULL) {\n\n err = -ENOENT;\n\n goto out_nofid;\n\n }\n\n err = v9fs_co_mknod(pdu, fidp, &name, fidp->uid, gid,\n\n makedev(major, minor), mode, &stbuf);\n\n if (err < 0) {\n\n goto out;\n\n }\n\n stat_to_qid(&stbuf, &qid);\n\n err = offset;\n\n err += pdu_marshal(pdu, offset, \"Q\", &qid);\n\nout:\n\n put_fid(pdu, fidp);\n\nout_nofid:\n\n trace_v9fs_mknod_return(pdu->tag, pdu->id, qid.type, qid.version, qid.path);\n\n complete_pdu(s, pdu, err);\n\n v9fs_string_free(&name);\n\n}"}} {"sample_id": "08942ac17922d923a7cc5cf9854e9cc4b150b942", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n uint64_t txaddr;\n /* Check if we are in bound */\n if (taddr >= dev->rtce_window_size) {\n+#ifdef DEBUG_TCE\n+ fprintf(stderr, \"spapr_tce_dma_read out of bounds\\n\");\n+#endif\n+ return H_DEST_PARM;\n+ tce = dev->rtce_table[taddr >> SPAPR_VIO_TCE_PAGE_SHIFT].tce;\n /* How much til end of page ? */\n lsize = MIN(size, ((~taddr) & SPAPR_VIO_TCE_PAGE_MASK) + 1);\n /* Check TCE */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int spapr_tce_dma_read(VIOsPAPRDevice *dev, uint64_t taddr, void *buf,\n uint32_t size)\n{\n#ifdef DEBUG_TCE\n fprintf(stderr, \"spapr_tce_dma_write taddr=0x%llx size=0x%x\\n\",\n (unsigned long long)taddr, size);\n#endif\n while (size) {\n uint64_t tce;\n uint32_t lsize;\n uint64_t txaddr;\n /* Check if we are in bound */\n if (taddr >= dev->rtce_window_size) {\n#ifdef DEBUG_TCE\n fprintf(stderr, \"spapr_tce_dma_read out of bounds\\n\");\n#endif\n return H_DEST_PARM;\n tce = dev->rtce_table[taddr >> SPAPR_VIO_TCE_PAGE_SHIFT].tce;\n /* How much til end of page ? */\n lsize = MIN(size, ((~taddr) & SPAPR_VIO_TCE_PAGE_MASK) + 1);\n /* Check TCE */\n if (!(tce & 1)) {\n return H_DEST_PARM;\n /* Translate */\n txaddr = (tce & ~SPAPR_VIO_TCE_PAGE_MASK) |\n (taddr & SPAPR_VIO_TCE_PAGE_MASK);\n#ifdef DEBUG_TCE\n fprintf(stderr, \" -> write to txaddr=0x%llx, size=0x%x\\n\",\n (unsigned long long)txaddr, lsize);\n#endif\n /* Do it */\n cpu_physical_memory_read(txaddr, buf, lsize);\n buf += lsize;\n taddr += lsize;\n size -= lsize;\n return H_SUCCESS;"}} {"sample_id": "b2d1fe67d09d2b6c7da647fbcea6ca0148c206d3_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void bufp_alloc(USBRedirDevice *dev,\n \n uint8_t *data, int len, int status, uint8_t ep)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void bufp_alloc(USBRedirDevice *dev,\n\n uint8_t *data, int len, int status, uint8_t ep)\n\n{\n\n struct buf_packet *bufp;\n\n\n\n if (!dev->endpoint[EP2I(ep)].bufpq_dropping_packets &&\n\n dev->endpoint[EP2I(ep)].bufpq_size >\n\n 2 * dev->endpoint[EP2I(ep)].bufpq_target_size) {\n\n DPRINTF(\"bufpq overflow, dropping packets ep %02X\\n\", ep);\n\n dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 1;\n\n }\n\n /* Since we're interupting the stream anyways, drop enough packets to get\n\n back to our target buffer size */\n\n if (dev->endpoint[EP2I(ep)].bufpq_dropping_packets) {\n\n if (dev->endpoint[EP2I(ep)].bufpq_size >\n\n dev->endpoint[EP2I(ep)].bufpq_target_size) {\n\n free(data);\n\n return;\n\n }\n\n dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;\n\n }\n\n\n\n bufp = g_malloc(sizeof(struct buf_packet));\n\n bufp->data = data;\n\n bufp->len = len;\n\n bufp->status = status;\n\n QTAILQ_INSERT_TAIL(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);\n\n dev->endpoint[EP2I(ep)].bufpq_size++;\n\n}\n"}} {"sample_id": "d6737539e77e78fca9a04914d51996cfd1ccc55c_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n for (lp_cnt = 4; lp_cnt--;) {\n \n+ SD(out0, src);\n+\n+ SD(out1, src + stride * 4);\n+\n+ src += stride;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void intra_predict_mad_cow_dc_l00_8x8_msa(uint8_t *src, int32_t stride)\n\n{\n\n uint8_t lp_cnt;\n\n uint32_t src0 = 0;\n\n uint64_t out0, out1;\n\n\n\n for (lp_cnt = 0; lp_cnt < 4; lp_cnt++) {\n\n src0 += src[lp_cnt * stride - 1];\n\n }\n\n\n\n src0 = (src0 + 2) >> 2;\n\n out0 = src0 * 0x0101010101010101;\n\n out1 = 0x8080808080808080;\n\n\n\n for (lp_cnt = 4; lp_cnt--;) {\n\n SD(out0, src);\n\n SD(out1, src + stride * 4);\n\n src += stride;\n\n }\n\n}\n"}} {"sample_id": "ee7a642b0e5da1730cfc66008d2f2976fa37a692", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n int stat_all = 0;\n \n int i;\n+\n+ int best_score = 0;\n+\n+\n+\n memset(stat, 0, packet_size * sizeof(*stat));\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int analyze(const uint8_t *buf, int size, int packet_size, int *index,\n\n int probe)\n\n{\n\n int stat[TS_MAX_PACKET_SIZE];\n\n int stat_all = 0;\n\n int i;\n\n int best_score = 0;\n\n\n\n memset(stat, 0, packet_size * sizeof(*stat));\n\n\n\n for (i = 0; i < size - 3; i++) {\n\n if (buf[i] == 0x47 &&\n\n (!probe || (!(buf[i + 1] & 0x80) && buf[i + 3] != 0x47))) {\n\n int x = i % packet_size;\n\n stat[x]++;\n\n stat_all++;\n\n if (stat[x] > best_score) {\n\n best_score = stat[x];\n\n if (index)\n\n *index = x;\n\n }\n\n }\n\n }\n\n\n\n return best_score - FFMAX(stat_all - 10*best_score, 0)/10;\n\n}\n"}} {"sample_id": "458f3b2c953bdc7110896cb3691251023652523f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n QOSState *qs;\n \n struct tm tm;\n+\n uint32_t ns;\n \n uint64_t ret;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void test_rtas_get_time_of_day(void)\n\n{\n\n QOSState *qs;\n\n struct tm tm;\n\n uint32_t ns;\n\n uint64_t ret;\n\n time_t t1, t2;\n\n\n\n qs = qtest_spapr_boot(\"-machine pseries\");\n\n g_assert(qs != NULL);\n\n\n\n t1 = time(NULL);\n\n ret = qrtas_get_time_of_day(qs->alloc, &tm, &ns);\n\n g_assert_cmpint(ret, ==, 0);\n\n t2 = mktimegm(&tm);\n\n g_assert(t2 - t1 < 5); /* 5 sec max to run the test */\n\n\n\n qtest_shutdown(qs);\n\n}\n"}} {"sample_id": "ef76dc59fa5203d146a2acf85a0ad5a5971a4824_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,5 +5,5 @@\n QObject *obj = qobject_from_json(\"[32,}\");\n \n fail_unless(obj == NULL);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "START_TEST(invalid_array_comma)\n\n{\n\n QObject *obj = qobject_from_json(\"[32,}\");\n\n fail_unless(obj == NULL);\n\n}\n"}} {"sample_id": "1a974679d097e878401cc1a425c3ed612be1581e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n int value;\n+\n+\n+\n+ value = get_vlc2(gb, vlc->table, vlc->bits, depth);\n+\n \n \n /* stage-2, 3 bits exponent escape sequence */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int qdm2_get_vlc (GetBitContext *gb, VLC *vlc, int flag, int depth)\n\n{\n\n int value;\n\n\n\n value = get_vlc2(gb, vlc->table, vlc->bits, depth);\n\n\n\n /* stage-2, 3 bits exponent escape sequence */\n\n if (value-- == 0)\n\n value = get_bits (gb, get_bits (gb, 3) + 1);\n\n\n\n /* stage-3, optional */\n\n if (flag) {\n\n int tmp = vlc_stage3_values[value];\n\n\n\n if ((value & ~3) > 0)\n\n tmp += get_bits (gb, (value >> 2));\n\n value = tmp;\n\n }\n\n\n\n return value;\n\n}\n"}} {"sample_id": "c447ab0e746c6b4d8d703a55190ae7444199e502", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n int mode;\n \n int i;\n+\n int8_t dc[6];\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int tgq_decode_mb(TgqContext *s, AVFrame *frame, int mb_y, int mb_x)\n\n{\n\n int mode;\n\n int i;\n\n int8_t dc[6];\n\n\n\n mode = bytestream2_get_byte(&s->gb);\n\n if (mode > 12) {\n\n GetBitContext gb;\n\n init_get_bits8(&gb, s->gb.buffer, FFMIN(bytestream2_get_bytes_left(&s->gb), mode));\n\n for (i = 0; i < 6; i++)\n\n tgq_decode_block(s, s->block[i], &gb);\n\n tgq_idct_put_mb(s, s->block, frame, mb_x, mb_y);\n\n bytestream2_skip(&s->gb, mode);\n\n } else {\n\n if (mode == 3) {\n\n memset(dc, bytestream2_get_byte(&s->gb), 4);\n\n dc[4] = bytestream2_get_byte(&s->gb);\n\n dc[5] = bytestream2_get_byte(&s->gb);\n\n } else if (mode == 6) {\n\n bytestream2_get_buffer(&s->gb, dc, 6);\n\n } else if (mode == 12) {\n\n for (i = 0; i < 6; i++) {\n\n dc[i] = bytestream2_get_byte(&s->gb);\n\n bytestream2_skip(&s->gb, 1);\n\n }\n\n } else {\n\n av_log(s->avctx, AV_LOG_ERROR, \"unsupported mb mode %i\\n\", mode);\n\n return -1;\n\n }\n\n tgq_idct_put_mb_dconly(s, frame, mb_x, mb_y, dc);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "d9968827032039d99b38db7ad3598767e1a53bbb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ tcg_gen_st_i32(var, cpu_env, offsetof(CPUState, iwmmxt.cregs[reg]));\n+\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static inline void iwmmxt_store_creg(int reg, TCGv var)\n\n{\n\n tcg_gen_st_i32(var, cpu_env, offsetof(CPUState, iwmmxt.cregs[reg]));\n\n\n}"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void elcr_ioport_write(void *opaque, target_phys_addr_t addr,\n+\n+ uint64_t val, unsigned size)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void elcr_ioport_write(void *opaque, target_phys_addr_t addr,\n\n uint64_t val, unsigned size)\n\n{\n\n PICCommonState *s = opaque;\n\n s->elcr = val & s->elcr_mask;\n\n}\n"}} {"sample_id": "2391e46430fa2af28542124dbcfc935c0a5ce82c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n mvs = 1;\n \n+ break;\n+\n+ case MV_TYPE_16X8:\n+\n+ mvs = 2;\n \n break;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int ff_mpv_lowest_referenced_row(MpegEncContext *s, int dir)\n\n{\n\n int my_max = INT_MIN, my_min = INT_MAX, qpel_shift = !s->quarter_sample;\n\n int my, off, i, mvs;\n\n\n\n if (s->picture_structure != PICT_FRAME || s->mcsel)\n\n goto unhandled;\n\n\n\n switch (s->mv_type) {\n\n case MV_TYPE_16X16:\n\n mvs = 1;\n\n break;\n\n case MV_TYPE_16X8:\n\n mvs = 2;\n\n break;\n\n case MV_TYPE_8X8:\n\n mvs = 4;\n\n break;\n\n default:\n\n goto unhandled;\n\n }\n\n\n\n for (i = 0; i < mvs; i++) {\n\n my = s->mv[dir][i][1]<> 6;\n\n\n\n return FFMIN(FFMAX(s->mb_y + off, 0), s->mb_height-1);\n\nunhandled:\n\n return s->mb_height-1;\n\n}\n"}} {"sample_id": "eabb7b91b36b202b4dac2df2d59d698e3aff197a_19", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n tcg_out_op_t(s, INDEX_op_movi_i64);\n \n+ tcg_out_r(s, t0);\n+\n+ tcg_out64(s, arg);\n+\n+#else\n \n TODO();\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void tcg_out_movi(TCGContext *s, TCGType type,\n\n TCGReg t0, tcg_target_long arg)\n\n{\n\n uint8_t *old_code_ptr = s->code_ptr;\n\n uint32_t arg32 = arg;\n\n if (type == TCG_TYPE_I32 || arg == arg32) {\n\n tcg_out_op_t(s, INDEX_op_movi_i32);\n\n tcg_out_r(s, t0);\n\n tcg_out32(s, arg32);\n\n } else {\n\n assert(type == TCG_TYPE_I64);\n\n#if TCG_TARGET_REG_BITS == 64\n\n tcg_out_op_t(s, INDEX_op_movi_i64);\n\n tcg_out_r(s, t0);\n\n tcg_out64(s, arg);\n\n#else\n\n TODO();\n\n#endif\n\n }\n\n old_code_ptr[1] = s->code_ptr - old_code_ptr;\n\n}\n"}} {"sample_id": "d7a4155265416a1c8f3067b59e68bf5fda1d6215_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,11 +28,11 @@\n \n * to link status bit in mac_reg[STATUS].\n \n+ * Alternatively, restart link negotiation if it was in progress. */\n+\n+ nc->link_down = (s->mac_reg[STATUS] & E1000_STATUS_LU) == 0;\n+\n+\n \n if (s->compat_flags & E1000_FLAG_AUTONEG &&\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int e1000_post_load(void *opaque, int version_id)\n\n{\n\n E1000State *s = opaque;\n\n NetClientState *nc = qemu_get_queue(s->nic);\n\n\n\n if (!(s->compat_flags & E1000_FLAG_MIT)) {\n\n s->mac_reg[ITR] = s->mac_reg[RDTR] = s->mac_reg[RADV] =\n\n s->mac_reg[TADV] = 0;\n\n s->mit_irq_level = false;\n\n }\n\n s->mit_ide = 0;\n\n s->mit_timer_on = false;\n\n\n\n /* nc.link_down can't be migrated, so infer link_down according\n\n * to link status bit in mac_reg[STATUS].\n\n * Alternatively, restart link negotiation if it was in progress. */\n\n nc->link_down = (s->mac_reg[STATUS] & E1000_STATUS_LU) == 0;\n\n\n\n if (s->compat_flags & E1000_FLAG_AUTONEG &&\n\n s->phy_reg[PHY_CTRL] & MII_CR_AUTO_NEG_EN &&\n\n s->phy_reg[PHY_CTRL] & MII_CR_RESTART_AUTO_NEG &&\n\n !(s->phy_reg[PHY_STATUS] & MII_SR_AUTONEG_COMPLETE)) {\n\n nc->link_down = false;\n\n timer_mod(s->autoneg_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 500);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "ba223c29da480b40b38678c66636ee9910973a47", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,11 +24,11 @@\n \n /* invalidate code */\n \n+ tb_invalidate_phys_page_range(addr1, addr1 + l, 0);\n+\n+ /* set dirty bit */\n+\n+ phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] |=\n \n (0xff & ~CODE_DIRTY_FLAG);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void cpu_physical_memory_unmap(void *buffer, target_phys_addr_t len,\n\n int is_write, target_phys_addr_t access_len)\n\n{\n\n if (buffer != bounce.buffer) {\n\n if (is_write) {\n\n unsigned long addr1 = (uint8_t *)buffer - phys_ram_base;\n\n while (access_len) {\n\n unsigned l;\n\n l = TARGET_PAGE_SIZE;\n\n if (l > access_len)\n\n l = access_len;\n\n if (!cpu_physical_memory_is_dirty(addr1)) {\n\n /* invalidate code */\n\n tb_invalidate_phys_page_range(addr1, addr1 + l, 0);\n\n /* set dirty bit */\n\n phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] |=\n\n (0xff & ~CODE_DIRTY_FLAG);\n\n }\n\n addr1 += l;\n\n access_len -= l;\n\n }\n\n }\n\n return;\n\n }\n\n if (is_write) {\n\n cpu_physical_memory_write(bounce.addr, bounce.buffer, access_len);\n\n }\n\n qemu_free(bounce.buffer);\n\n bounce.buffer = NULL;\n\n\n}"}} {"sample_id": "677ef6230b603571ae05125db469f7b4c8912a77", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void helper_lock(void)\n+\n {\n \n spin_lock(&global_cpu_lock);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void helper_lock(void)\n\n{\n\n spin_lock(&global_cpu_lock);\n\n}\n"}} {"sample_id": "1ca87d600bc069fe4cf497c410b4f794e88a122d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+static int applehttp_close(URLContext *h)\n+\n+{\n+\n+ AppleHTTPContext *s = h->priv_data;\n+\n+\n \n free_segment_list(s);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int applehttp_close(URLContext *h)\n\n{\n\n AppleHTTPContext *s = h->priv_data;\n\n\n\n free_segment_list(s);\n\n free_variant_list(s);\n\n ffurl_close(s->seg_hd);\n\n av_free(s);\n\n return 0;\n\n}\n"}} {"sample_id": "d00b261816872d3e48adca584fca80ca21985f3b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,7 +12,7 @@\n \n int bits = qdict_get_try_int(qdict, \"bits\", -1);\n \n+ int has_channels = qdict_haskey(qdict, \"nchannels\");\n \n int nchannels = qdict_get_try_int(qdict, \"nchannels\", -1);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void do_wav_capture(Monitor *mon, const QDict *qdict)\n\n{\n\n const char *path = qdict_get_str(qdict, \"path\");\n\n int has_freq = qdict_haskey(qdict, \"freq\");\n\n int freq = qdict_get_try_int(qdict, \"freq\", -1);\n\n int has_bits = qdict_haskey(qdict, \"bits\");\n\n int bits = qdict_get_try_int(qdict, \"bits\", -1);\n\n int has_channels = qdict_haskey(qdict, \"nchannels\");\n\n int nchannels = qdict_get_try_int(qdict, \"nchannels\", -1);\n\n CaptureState *s;\n\n\n\n s = qemu_mallocz (sizeof (*s));\n\n\n\n freq = has_freq ? freq : 44100;\n\n bits = has_bits ? bits : 16;\n\n nchannels = has_channels ? nchannels : 2;\n\n\n\n if (wav_start_capture (s, path, freq, bits, nchannels)) {\n\n monitor_printf(mon, \"Faied to add wave capture\\n\");\n\n qemu_free (s);\n\n }\n\n QLIST_INSERT_HEAD (&capture_head, s, entries);\n\n}\n"}} {"sample_id": "d81be0a60a6dea2bc48ec29f9466eee63984ed34", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ AVFilterContext *avctx = inlink->dst;\n \n AVFilterLink *outlink = avctx->outputs[0];\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static AVFrame *hwmap_get_buffer(AVFilterLink *inlink, int w, int h)\n\n{\n\n AVFilterContext *avctx = inlink->dst;\n\n AVFilterLink *outlink = avctx->outputs[0];\n\n HWMapContext *ctx = avctx->priv;\n\n\n\n if (ctx->map_backwards) {\n\n AVFrame *src, *dst;\n\n int err;\n\n\n\n src = ff_get_video_buffer(outlink, w, h);\n\n if (!src) {\n\n av_log(avctx, AV_LOG_ERROR, \"Failed to allocate source \"\n\n \"frame for software mapping.\\n\");\n\n return NULL;\n\n }\n\n\n\n dst = av_frame_alloc();\n\n if (!dst) {\n\n av_frame_free(&src);\n\n return NULL;\n\n }\n\n\n\n err = av_hwframe_map(dst, src, ctx->mode);\n\n if (err) {\n\n av_log(avctx, AV_LOG_ERROR, \"Failed to map frame to \"\n\n \"software: %d.\\n\", err);\n\n av_frame_free(&src);\n\n av_frame_free(&dst);\n\n return NULL;\n\n }\n\n\n\n av_frame_free(&src);\n\n return dst;\n\n } else {\n\n return ff_default_get_video_buffer(inlink, w, h);\n\n }\n\n}\n"}} {"sample_id": "5923f85fb82df7c8c60a89458a5ae856045e5ab1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void test_visitor_in_uint(TestInputVisitorData *data,\n+\n const void *unused)\n \n {\n@@ -16,8 +16,8 @@\n \n Visitor *v;\n \n+\n+\n v = visitor_input_test_init(data, \"%d\", value);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void test_visitor_in_uint(TestInputVisitorData *data,\n\n const void *unused)\n\n{\n\n Error *err = NULL;\n\n uint64_t res = 0;\n\n int64_t i64;\n\n double dbl;\n\n int value = 42;\n\n Visitor *v;\n\n\n\n v = visitor_input_test_init(data, \"%d\", value);\n\n\n\n visit_type_uint64(v, NULL, &res, &error_abort);\n\n g_assert_cmpuint(res, ==, (uint64_t)value);\n\n\n\n visit_type_int(v, NULL, &i64, &error_abort);\n\n g_assert_cmpint(i64, ==, value);\n\n\n\n visit_type_number(v, NULL, &dbl, &error_abort);\n\n g_assert_cmpfloat(dbl, ==, value);\n\n\n\n /* BUG: value between INT64_MIN and -1 accepted modulo 2^64 */\n\n v = visitor_input_test_init(data, \"%d\", -value);\n\n\n\n visit_type_uint64(v, NULL, &res, &error_abort);\n\n g_assert_cmpuint(res, ==, (uint64_t)-value);\n\n\n\n /* BUG: value between INT64_MAX+1 and UINT64_MAX rejected */\n\n\n\n v = visitor_input_test_init(data, \"18446744073709551574\");\n\n\n\n visit_type_uint64(v, NULL, &res, &err);\n\n error_free_or_abort(&err);\n\n\n\n visit_type_number(v, NULL, &dbl, &error_abort);\n\n g_assert_cmpfloat(dbl, ==, 18446744073709552000.0);\n\n}\n"}} {"sample_id": "e175bce587936bf479889881488821ea8d61c89c_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,13 +3,13 @@\n {\n \n CPUBreakpoint *bp;\n+\n \n \n if (env->watchpoint_hit) {\n \n if (env->watchpoint_hit->flags & BP_CPU) {\n+\n env->watchpoint_hit = NULL;\n \n if (check_hw_breakpoints(env, 0))", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void breakpoint_handler(CPUX86State *env)\n\n{\n\n CPUBreakpoint *bp;\n\n\n\n if (env->watchpoint_hit) {\n\n if (env->watchpoint_hit->flags & BP_CPU) {\n\n env->watchpoint_hit = NULL;\n\n if (check_hw_breakpoints(env, 0))\n\n raise_exception(env, EXCP01_DB);\n\n else\n\n cpu_resume_from_signal(env, NULL);\n\n }\n\n } else {\n\n QTAILQ_FOREACH(bp, &env->breakpoints, entry)\n\n if (bp->pc == env->eip) {\n\n if (bp->flags & BP_CPU) {\n\n check_hw_breakpoints(env, 1);\n\n raise_exception(env, EXCP01_DB);\n\n }\n\n break;\n\n }\n\n }\n\n}\n"}} {"sample_id": "129c7d1c536d0c67a8781cb09fb5bdb3d0f6a2d0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n error_setg(errp, \"NBD server address missing\");\n \n goto done;\n+\n+ }\n+\n+\n+\n crumpled_addr = qdict_crumple(addr, errp);\n \n if (!crumpled_addr) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static SocketAddress *nbd_config(BDRVNBDState *s, QDict *options, Error **errp)\n\n{\n\n SocketAddress *saddr = NULL;\n\n QDict *addr = NULL;\n\n QObject *crumpled_addr = NULL;\n\n Visitor *iv = NULL;\n\n Error *local_err = NULL;\n\n\n\n qdict_extract_subqdict(options, &addr, \"server.\");\n\n if (!qdict_size(addr)) {\n\n error_setg(errp, \"NBD server address missing\");\n\n goto done;\n\n }\n\n\n\n crumpled_addr = qdict_crumple(addr, errp);\n\n if (!crumpled_addr) {\n\n goto done;\n\n }\n\n\n\n\n\n\n\n\n\n\n\n iv = qobject_input_visitor_new(crumpled_addr);\n\n visit_type_SocketAddress(iv, NULL, &saddr, &local_err);\n\n if (local_err) {\n\n error_propagate(errp, local_err);\n\n goto done;\n\n }\n\n\n\ndone:\n\n QDECREF(addr);\n\n qobject_decref(crumpled_addr);\n\n visit_free(iv);\n\n return saddr;\n\n}"}} {"sample_id": "7e2515e87c41e2e658aaed466e11cbdf1ea8bcb1_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,8 +10,8 @@\n \n if (bs_table[i])\n \n+ bdrv_commit(bs_table[i]);\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void do_commit(void)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < MAX_DISKS; i++) {\n\n if (bs_table[i])\n\n bdrv_commit(bs_table[i]);\n\n }\n\n}\n"}} {"sample_id": "e83980455c8c7eb066405de512be7c4bace3ac4d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void virtio_ccw_device_plugged(DeviceState *d)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void virtio_ccw_device_plugged(DeviceState *d)\n\n{\n\n VirtioCcwDevice *dev = VIRTIO_CCW_DEVICE(d);\n\n SubchDev *sch = dev->sch;\n\n\n\n sch->id.cu_model = virtio_bus_get_vdev_id(&dev->bus);\n\n\n\n css_generate_sch_crws(sch->cssid, sch->ssid, sch->schid,\n\n d->hotplugged, 1);\n\n}\n"}} {"sample_id": "348295838384941d1e5420d10e57366c4e303d45_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,9 +4,9 @@\n \n if (s->blocker) {\n \n+ blk_op_unblock_all(s->conf->conf.blk, s->blocker);\n+\n+ error_free(s->blocker);\n \n s->blocker = NULL;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void data_plane_remove_op_blockers(VirtIOBlockDataPlane *s)\n\n{\n\n if (s->blocker) {\n\n blk_op_unblock_all(s->conf->conf.blk, s->blocker);\n\n error_free(s->blocker);\n\n s->blocker = NULL;\n\n }\n\n}\n"}} {"sample_id": "4e59c8ecf1433b85b539c5e89bb68cfe8b839866", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,7 +8,7 @@\n \n int err;\n \n+ AVDictionary *opts;\n \n AVFormatContext *ic;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "int av_open_input_stream(AVFormatContext **ic_ptr,\n\n AVIOContext *pb, const char *filename,\n\n AVInputFormat *fmt, AVFormatParameters *ap)\n\n{\n\n int err;\n\n AVDictionary *opts;\n\n AVFormatContext *ic;\n\n AVFormatParameters default_ap;\n\n\n\n if(!ap){\n\n ap=&default_ap;\n\n memset(ap, 0, sizeof(default_ap));\n\n }\n\n opts = convert_format_parameters(ap);\n\n\n\n if(!ap->prealloced_context)\n\n ic = avformat_alloc_context();\n\n else\n\n ic = *ic_ptr;\n\n if (!ic) {\n\n err = AVERROR(ENOMEM);\n\n goto fail;\n\n }\n\n if (pb && fmt && fmt->flags & AVFMT_NOFILE)\n\n av_log(ic, AV_LOG_WARNING, \"Custom AVIOContext makes no sense and \"\n\n \"will be ignored with AVFMT_NOFILE format.\\n\");\n\n else\n\n ic->pb = pb;\n\n\n\n err = avformat_open_input(&ic, filename, fmt, &opts);\n\n ic->pb = ic->pb ? ic->pb : pb; // don't leak custom pb if it wasn't set above\n\n\n\n *ic_ptr = ic;\n\nfail:\n\n av_dict_free(&opts);\n\n return err;\n\n}\n"}} {"sample_id": "339064d5063924e5176842abbf6c8089f3479c5b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n bool bdrv_qiov_is_aligned(BlockDriverState *bs, QEMUIOVector *qiov)\n \n {\n+\n int i;\n \n+\n \n for (i = 0; i < qiov->niov; i++) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "bool bdrv_qiov_is_aligned(BlockDriverState *bs, QEMUIOVector *qiov)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < qiov->niov; i++) {\n\n if ((uintptr_t) qiov->iov[i].iov_base % bs->buffer_alignment) {\n\n return false;\n\n }\n\n if (qiov->iov[i].iov_len % bs->buffer_alignment) {\n\n return false;\n\n }\n\n }\n\n\n\n return true;\n\n}\n"}} {"sample_id": "d8a499f17ee5f05407874f29f69f0e3e3198a853", "diff": "--- a/source.c\n+++ b/source.c\n@@ -41,11 +41,11 @@\n trace_exec_tb_nocache(tb, tb->pc);\n \n cpu_tb_exec(cpu, tb->tc_ptr);\n+\n+ cpu->current_tb = NULL;\n+\n+ tb_phys_invalidate(tb, -1);\n+\n tb_free(tb);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void cpu_exec_nocache(CPUArchState *env, int max_cycles,\n\n TranslationBlock *orig_tb)\n\n{\n\n CPUState *cpu = ENV_GET_CPU(env);\n\n TranslationBlock *tb;\n\n target_ulong pc = orig_tb->pc;\n\n target_ulong cs_base = orig_tb->cs_base;\n\n uint64_t flags = orig_tb->flags;\n\n\n\n /* Should never happen.\n\n We only end up here when an existing TB is too long. */\n\n if (max_cycles > CF_COUNT_MASK)\n\n max_cycles = CF_COUNT_MASK;\n\n\n\n /* tb_gen_code can flush our orig_tb, invalidate it now */\n\n tb_phys_invalidate(orig_tb, -1);\n\n tb = tb_gen_code(cpu, pc, cs_base, flags,\n\n max_cycles);\n\n cpu->current_tb = tb;\n\n /* execute the generated code */\n\n trace_exec_tb_nocache(tb, tb->pc);\n\n cpu_tb_exec(cpu, tb->tc_ptr);\n\n cpu->current_tb = NULL;\n\n tb_phys_invalidate(tb, -1);\n\n tb_free(tb);\n\n}\n"}} {"sample_id": "3a3b8502e6f0c8d30865c5f36d2c3ae4114000b5_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n target_ulong spapr_rtas_call(PowerPCCPU *cpu, sPAPREnvironment *spapr,\n+\n+ uint32_t token, uint32_t nargs, target_ulong args,\n \n uint32_t nret, target_ulong rets)\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "target_ulong spapr_rtas_call(PowerPCCPU *cpu, sPAPREnvironment *spapr,\n\n uint32_t token, uint32_t nargs, target_ulong args,\n\n uint32_t nret, target_ulong rets)\n\n{\n\n if ((token >= TOKEN_BASE)\n\n && ((token - TOKEN_BASE) < TOKEN_MAX)) {\n\n struct rtas_call *call = rtas_table + (token - TOKEN_BASE);\n\n\n\n if (call->fn) {\n\n call->fn(cpu, spapr, token, nargs, args, nret, rets);\n\n return H_SUCCESS;\n\n }\n\n }\n\n\n\n /* HACK: Some Linux early debug code uses RTAS display-character,\n\n * but assumes the token value is 0xa (which it is on some real\n\n * machines) without looking it up in the device tree. This\n\n * special case makes this work */\n\n if (token == 0xa) {\n\n rtas_display_character(cpu, spapr, 0xa, nargs, args, nret, rets);\n\n return H_SUCCESS;\n\n }\n\n\n\n hcall_dprintf(\"Unknown RTAS token 0x%x\\n\", token);\n\n rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);\n\n return H_PARAMETER;\n\n}\n"}} {"sample_id": "b40acf99bef69fa8ab0f9092ff162fde945eec12_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n MemoryRegionIORange *mrio\n \n+ = container_of(iorange, MemoryRegionIORange, iorange);\n+\n+ MemoryRegion *mr = mrio->mr;\n+\n+\n \n offset += mrio->offset;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void memory_region_iorange_write(IORange *iorange,\n\n uint64_t offset,\n\n unsigned width,\n\n uint64_t data)\n\n{\n\n MemoryRegionIORange *mrio\n\n = container_of(iorange, MemoryRegionIORange, iorange);\n\n MemoryRegion *mr = mrio->mr;\n\n\n\n offset += mrio->offset;\n\n if (mr->ops->old_portio) {\n\n const MemoryRegionPortio *mrp = find_portio(mr, offset - mrio->offset,\n\n width, true);\n\n\n\n if (mrp) {\n\n mrp->write(mr->opaque, offset, data);\n\n } else if (width == 2) {\n\n mrp = find_portio(mr, offset - mrio->offset, 1, true);\n\n assert(mrp);\n\n mrp->write(mr->opaque, offset, data & 0xff);\n\n mrp->write(mr->opaque, offset + 1, data >> 8);\n\n }\n\n return;\n\n }\n\n access_with_adjusted_size(offset, &data, width,\n\n mr->ops->impl.min_access_size,\n\n mr->ops->impl.max_access_size,\n\n memory_region_write_accessor, mr);\n\n}\n"}} {"sample_id": "c2f3029fbc5e7beb4cfb7ac264e10838fada524e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n /* Map AHCI's ABAR (BAR5) */\n \n+ *hba_base = qpci_iomap(ahci, 5, NULL);\n+\n+\n+\n /* turns on pci.cmd.iose, pci.cmd.mse and pci.cmd.bme */\n \n qpci_device_enable(ahci);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static QPCIDevice *start_ahci_device(QPCIDevice *ahci, void **hba_base)\n\n{\n\n /* Map AHCI's ABAR (BAR5) */\n\n *hba_base = qpci_iomap(ahci, 5, NULL);\n\n\n\n /* turns on pci.cmd.iose, pci.cmd.mse and pci.cmd.bme */\n\n qpci_device_enable(ahci);\n\n\n\n return ahci;\n\n}\n"}} {"sample_id": "80792eb9257588d9a554605f3411cbc7ed51e9bc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,10 +26,10 @@\n * Objects using the same ID (which can happen in cases where\n * qemu_opts_parse() is used to parse the object params, such as\n * with hmp_object_add() at the time of this comment), we need to\n+ * check for this in user_creatable_del() and remove the QemuOpts if\n+ * it is present.\n+ *\n+ * The below check ensures this works as expected.\n+ */\n g_assert_null(qemu_opts_find(&qemu_object_opts, \"dev0\"));\n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void test_dummy_createcmdl(void)\n{\n QemuOpts *opts;\n DummyObject *dobj;\n Error *err = NULL;\n const char *params = TYPE_DUMMY \\\n \",id=dev0,\" \\\n \"bv=yes,sv=Hiss hiss hiss,av=platypus\";\n qemu_add_opts(&qemu_object_opts);\n opts = qemu_opts_parse(&qemu_object_opts, params, true, &err);\n g_assert(err == NULL);\n g_assert(opts);\n dobj = DUMMY_OBJECT(user_creatable_add_opts(opts, &err));\n g_assert(err == NULL);\n g_assert(dobj);\n g_assert_cmpstr(dobj->sv, ==, \"Hiss hiss hiss\");\n g_assert(dobj->bv == true);\n g_assert(dobj->av == DUMMY_PLATYPUS);\n user_creatable_del(\"dev0\", &err);\n g_assert(err == NULL);\n error_free(err);\n /*\n * cmdline-parsing via qemu_opts_parse() results in a QemuOpts entry\n * corresponding to the Object's ID to be added to the QemuOptsList\n * for objects. To avoid having this entry conflict with future\n * Objects using the same ID (which can happen in cases where\n * qemu_opts_parse() is used to parse the object params, such as\n * with hmp_object_add() at the time of this comment), we need to\n * check for this in user_creatable_del() and remove the QemuOpts if\n * it is present.\n *\n * The below check ensures this works as expected.\n */\n g_assert_null(qemu_opts_find(&qemu_object_opts, \"dev0\"));\n}"}} {"sample_id": "6c86462220a1c7f5d673663d31d297627a2868a6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -59,11 +59,11 @@\n SCSW_ACTL_SUSP);\n \n sch->channel_prog = 0x0;\n+\n+ sch->last_cmd_valid = false;\n+\n+ s->dstat = 0;\n+\n s->cstat = 0;\n \n ret = 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int css_do_xsch(SubchDev *sch)\n\n{\n\n SCSW *s = &sch->curr_status.scsw;\n\n PMCW *p = &sch->curr_status.pmcw;\n\n int ret;\n\n\n\n if (~(p->flags) & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA)) {\n\n ret = -ENODEV;\n\n goto out;\n\n }\n\n\n\n if (!(s->ctrl & SCSW_CTRL_MASK_FCTL) ||\n\n ((s->ctrl & SCSW_CTRL_MASK_FCTL) != SCSW_FCTL_START_FUNC) ||\n\n (!(s->ctrl &\n\n (SCSW_ACTL_RESUME_PEND | SCSW_ACTL_START_PEND | SCSW_ACTL_SUSP))) ||\n\n (s->ctrl & SCSW_ACTL_SUBCH_ACTIVE)) {\n\n ret = -EINPROGRESS;\n\n goto out;\n\n }\n\n\n\n if (s->ctrl & SCSW_CTRL_MASK_STCTL) {\n\n ret = -EBUSY;\n\n goto out;\n\n }\n\n\n\n /* Cancel the current operation. */\n\n s->ctrl &= ~(SCSW_FCTL_START_FUNC |\n\n SCSW_ACTL_RESUME_PEND |\n\n SCSW_ACTL_START_PEND |\n\n SCSW_ACTL_SUSP);\n\n sch->channel_prog = 0x0;\n\n sch->last_cmd_valid = false;\n\n s->dstat = 0;\n\n s->cstat = 0;\n\n ret = 0;\n\n\n\nout:\n\n return ret;\n\n}\n"}} {"sample_id": "b015872c0d0823e70776e98b865509ec1287e2f6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n if (!PPC_ALTIVEC(av_get_cpu_flags()))\n \n+ return;\n+\n+\n+\n c->add_bytes = add_bytes_altivec;\n \n #endif /* HAVE_ALTIVEC && HAVE_BIGENDIAN */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "av_cold void ff_huffyuvdsp_init_ppc(HuffYUVDSPContext *c)\n\n{\n\n#if HAVE_ALTIVEC && HAVE_BIGENDIAN\n\n if (!PPC_ALTIVEC(av_get_cpu_flags()))\n\n return;\n\n\n\n c->add_bytes = add_bytes_altivec;\n\n#endif /* HAVE_ALTIVEC && HAVE_BIGENDIAN */\n\n}\n"}} {"sample_id": "c60bf3391bf4cb79b7adc6650094e21671ddaabd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n /* if the line ends with a space, it means we want to complete the\n \n+ next arg */\n+\n+ len = strlen(cmdline);\n+\n+ if (len > 0 && qemu_isspace(cmdline[len - 1])) {\n \n if (nb_args >= MAX_ARGS) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void monitor_find_completion(Monitor *mon,\n\n const char *cmdline)\n\n{\n\n char *args[MAX_ARGS];\n\n int nb_args, len;\n\n\n\n /* 1. parse the cmdline */\n\n if (parse_cmdline(cmdline, &nb_args, args) < 0) {\n\n return;\n\n }\n\n#ifdef DEBUG_COMPLETION\n\n for (i = 0; i < nb_args; i++) {\n\n monitor_printf(mon, \"arg%d = '%s'\\n\", i, args[i]);\n\n }\n\n#endif\n\n\n\n /* if the line ends with a space, it means we want to complete the\n\n next arg */\n\n len = strlen(cmdline);\n\n if (len > 0 && qemu_isspace(cmdline[len - 1])) {\n\n if (nb_args >= MAX_ARGS) {\n\n goto cleanup;\n\n }\n\n args[nb_args++] = g_strdup(\"\");\n\n }\n\n\n\n /* 2. auto complete according to args */\n\n monitor_find_completion_by_table(mon, mon->cmd_table, args, nb_args);\n\n\n\ncleanup:\n\n free_cmdline_args(args, nb_args);\n\n}\n"}} {"sample_id": "fcf73f66a67f5e58c18216f8c8651e38cf4d90af_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n QInt *qobject_to_qint(const QObject *obj)\n+\n {\n \n if (qobject_type(obj) != QTYPE_QINT)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "QInt *qobject_to_qint(const QObject *obj)\n\n{\n\n if (qobject_type(obj) != QTYPE_QINT)\n\n return NULL;\n\n\n\n return container_of(obj, QInt, base);\n\n}\n"}} {"sample_id": "6b4495401bdf442457b713b7e3994b465c55af35_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+pcie_cap_v1_fill(uint8_t *exp_cap, uint8_t port, uint8_t type, uint8_t version)\n \n {\n \n+ /* capability register\n \n interrupt message number defaults to 0 */\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "pcie_cap_v1_fill(uint8_t *exp_cap, uint8_t port, uint8_t type, uint8_t version)\n\n{\n\n /* capability register\n\n interrupt message number defaults to 0 */\n\n pci_set_word(exp_cap + PCI_EXP_FLAGS,\n\n ((type << PCI_EXP_FLAGS_TYPE_SHIFT) & PCI_EXP_FLAGS_TYPE) |\n\n version);\n\n\n\n /* device capability register\n\n * table 7-12:\n\n * roll based error reporting bit must be set by all\n\n * Functions conforming to the ECN, PCI Express Base\n\n * Specification, Revision 1.1., or subsequent PCI Express Base\n\n * Specification revisions.\n\n */\n\n pci_set_long(exp_cap + PCI_EXP_DEVCAP, PCI_EXP_DEVCAP_RBER);\n\n\n\n pci_set_long(exp_cap + PCI_EXP_LNKCAP,\n\n (port << PCI_EXP_LNKCAP_PN_SHIFT) |\n\n PCI_EXP_LNKCAP_ASPMS_0S |\n\n PCI_EXP_LNK_MLW_1 |\n\n PCI_EXP_LNK_LS_25);\n\n\n\n pci_set_word(exp_cap + PCI_EXP_LNKSTA,\n\n PCI_EXP_LNK_MLW_1 | PCI_EXP_LNK_LS_25 |PCI_EXP_LNKSTA_DLLLA);\n\n}\n"}} {"sample_id": "6f442fe83821a06c5408056c7879e83a74f2ff32", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void test_read_without_media(void)\n \n+{\n \n uint8_t ret;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static void test_read_without_media(void)\n\n{\n\n uint8_t ret;\n\n\n\n ret = send_read_command();\n\n g_assert(ret == 0);\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_55", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n int l1, l2;\n \n+ TCGv tmp;\n+\n+\n+\n+ l1 = gen_new_label();\n \n l2 = gen_new_label();\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static always_inline void gen_fbcond (DisasContext *ctx,\n\n void* func,\n\n int ra, int32_t disp16)\n\n{\n\n int l1, l2;\n\n TCGv tmp;\n\n\n\n l1 = gen_new_label();\n\n l2 = gen_new_label();\n\n if (ra != 31) {\n\n tmp = tcg_temp_new(TCG_TYPE_I64);\n\n tcg_gen_helper_1_1(func, tmp, cpu_fir[ra]);\n\n } else {\n\n tmp = tcg_const_i64(0);\n\n tcg_gen_helper_1_1(func, tmp, tmp);\n\n }\n\n tcg_gen_brcondi_i64(TCG_COND_NE, tmp, 0, l1);\n\n tcg_gen_movi_i64(cpu_pc, ctx->pc);\n\n tcg_gen_br(l2);\n\n gen_set_label(l1);\n\n tcg_gen_movi_i64(cpu_pc, ctx->pc + (int64_t)(disp16 << 2));\n\n gen_set_label(l2);\n\n}\n"}} {"sample_id": "c5e6fb7e4ac6e7083682e7f45d27d1e73b3a1a97", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n+pci_ebus_init1(PCIDevice *s)\n+\n {\n+\n isa_bus_new(&s->qdev);\n \n \n \n+ s->config[0x04] = 0x06; // command = bus master, pci mem\n+\n s->config[0x05] = 0x00;\n \n s->config[0x06] = 0xa0; // status = fast back-to-back, 66MHz, no error", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "pci_ebus_init1(PCIDevice *s)\n\n{\n\n isa_bus_new(&s->qdev);\n\n\n\n s->config[0x04] = 0x06; // command = bus master, pci mem\n\n s->config[0x05] = 0x00;\n\n s->config[0x06] = 0xa0; // status = fast back-to-back, 66MHz, no error\n\n s->config[0x07] = 0x03; // status = medium devsel\n\n s->config[0x09] = 0x00; // programming i/f\n\n s->config[0x0D] = 0x0a; // latency_timer\n\n\n\n pci_register_bar(s, 0, 0x1000000, PCI_BASE_ADDRESS_SPACE_MEMORY,\n\n ebus_mmio_mapfunc);\n\n pci_register_bar(s, 1, 0x800000, PCI_BASE_ADDRESS_SPACE_MEMORY,\n\n ebus_mmio_mapfunc);\n\n return 0;\n\n}\n"}} {"sample_id": "b15a9888a8f8e8cc9784ffd8d5d0307900fb78bb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,10 +22,10 @@\n \n /* note: we need to modify the packet size here to handle the last\n \n+ packet */\n+\n+ pkt->size = ret;\n+\n+ return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int sol_read_packet(AVFormatContext *s,\n\n AVPacket *pkt)\n\n{\n\n int ret;\n\n\n\n if (s->pb->eof_reached)\n\n return AVERROR(EIO);\n\n ret= av_get_packet(s->pb, pkt, MAX_SIZE);\n\n\n\n pkt->stream_index = 0;\n\n\n\n /* note: we need to modify the packet size here to handle the last\n\n packet */\n\n pkt->size = ret;\n\n return 0;\n\n}"}} {"sample_id": "debaaa114a8877a939533ba846e64168fb287b7b_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static AHCIQState *ahci_boot_and_enable(void)\n \n+{\n+\n+ AHCIQState *ahci;\n+\n ahci = ahci_boot();\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static AHCIQState *ahci_boot_and_enable(void)\n\n{\n\n AHCIQState *ahci;\n\n ahci = ahci_boot();\n\n\n\n ahci_pci_enable(ahci);\n\n ahci_hba_enable(ahci);\n\n\n\n return ahci;\n\n}\n"}} {"sample_id": "8e87d146d798ca25d8f3a4520a6deb7946b39d73", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,7 +20,7 @@\n \n for (i=0; i> 2);\n\n\n\n if (s > 31) {\n\n for (i=0; i 0) {\n\n round = 1 << (s-1);\n\n for (i=0; i> 32);\n\n dst[i] = ((int)(out+round) >> s) * ssign;\n\n }\n\n }\n\n else {\n\n s = s + 32;\n\n round = 1U << (s-1);\n\n for (i=0; i> s);\n\n dst[i] = out * ssign;\n\n }\n\n }\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,16 +1,16 @@\n void do_subfzeo (void)\n+\n {\n+\n+ T1 = T0;\n \n+ T0 = ~T0 + xer_ca;\n+\n if (likely(!((~T1 ^ (-1)) & ((~T1) ^ T0) & (1 << 31)))) {\n+\n+ xer_ov = 0;\n \n+ } else {\n \n xer_ov = 1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void do_subfzeo (void)\n\n{\n\n T1 = T0;\n\n T0 = ~T0 + xer_ca;\n\n if (likely(!((~T1 ^ (-1)) & ((~T1) ^ T0) & (1 << 31)))) {\n\n xer_ov = 0;\n\n } else {\n\n xer_ov = 1;\n\n xer_so = 1;\n\n }\n\n if (likely(T0 >= ~T1)) {\n\n xer_ca = 0;\n\n } else {\n\n xer_ca = 1;\n\n }\n\n}\n"}} {"sample_id": "a718978ed58abc1ad92567a9c17525136be02a71", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int32_t ide_nop_int32(IDEDMA *dma, int x)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int32_t ide_nop_int32(IDEDMA *dma, int x)\n\n{\n\n return 0;\n\n}\n"}} {"sample_id": "ee9a569ab88edd0755402aaf31ec0c69decf7756_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n \n \n tcet->bypass = false;\n+\n+ memset(tcet->table, 0, table_size);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void spapr_tce_reset(DeviceState *dev)\n\n{\n\n sPAPRTCETable *tcet = SPAPR_TCE_TABLE(dev);\n\n size_t table_size = tcet->nb_table * sizeof(uint64_t);\n\n\n\n tcet->bypass = false;\n\n memset(tcet->table, 0, table_size);\n\n}\n"}} {"sample_id": "afff2b15e89ac81c113f2ebfd729aaa02b40edb6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,17 +1,17 @@\n QemuConsole *graphic_console_init(DeviceState *dev, uint32_t head,\n+\n const GraphicHwOps *hw_ops,\n \n void *opaque)\n \n {\n \n+ Error *local_err = NULL;\n \n int width = 640;\n \n+ int height = 480;\n+\n QemuConsole *s;\n \n DisplayState *ds;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "QemuConsole *graphic_console_init(DeviceState *dev, uint32_t head,\n\n const GraphicHwOps *hw_ops,\n\n void *opaque)\n\n{\n\n Error *local_err = NULL;\n\n int width = 640;\n\n int height = 480;\n\n QemuConsole *s;\n\n DisplayState *ds;\n\n\n\n ds = get_alloc_displaystate();\n\n trace_console_gfx_new();\n\n s = new_console(ds, GRAPHIC_CONSOLE);\n\n s->hw_ops = hw_ops;\n\n s->hw = opaque;\n\n if (dev) {\n\n object_property_set_link(OBJECT(s), OBJECT(dev),\n\n \"device\", &local_err);\n\n object_property_set_int(OBJECT(s), head,\n\n \"head\", &local_err);\n\n }\n\n\n\n s->surface = qemu_create_displaysurface(width, height);\n\n return s;\n\n}\n"}} {"sample_id": "fec9ccb7e6fdc6844b1e2d1bb95436b36f47a412", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n int ret;\n \n+\n+\n+ *frame_size_ptr= 0;\n+\n+ ret = avctx->codec->decode(avctx, samples, frame_size_ptr, \n \n buf, buf_size);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int avcodec_decode_audio(AVCodecContext *avctx, int16_t *samples, \n\n int *frame_size_ptr,\n\n uint8_t *buf, int buf_size)\n\n{\n\n int ret;\n\n\n\n *frame_size_ptr= 0;\n\n ret = avctx->codec->decode(avctx, samples, frame_size_ptr, \n\n buf, buf_size);\n\n avctx->frame_number++;\n\n return ret;\n\n}\n"}} {"sample_id": "636ced8e1dc8248a1353b416240b93d70ad03edb_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n void *grow_array(void *array, int elem_size, int *size, int new_size)\n \n {\n+\n if (new_size >= INT_MAX / elem_size) {\n \n av_log(NULL, AV_LOG_ERROR, \"Array too big.\\n\");\n \n exit(1);\n+\n }\n \n if (*size < new_size) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void *grow_array(void *array, int elem_size, int *size, int new_size)\n\n{\n\n if (new_size >= INT_MAX / elem_size) {\n\n av_log(NULL, AV_LOG_ERROR, \"Array too big.\\n\");\n\n exit(1);\n\n }\n\n if (*size < new_size) {\n\n uint8_t *tmp = av_realloc(array, new_size*elem_size);\n\n if (!tmp) {\n\n av_log(NULL, AV_LOG_ERROR, \"Could not alloc buffer.\\n\");\n\n exit(1);\n\n }\n\n memset(tmp + *size*elem_size, 0, (new_size-*size) * elem_size);\n\n *size = new_size;\n\n return tmp;\n\n }\n\n return array;\n\n}\n"}} {"sample_id": "f3c7d0389fe8a2792fd4c1cf151b885de03c8f62_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void microdrive_realize(DeviceState *dev, Error **errp)\n \n+{\n \n MicroDriveState *md = MICRODRIVE(dev);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void microdrive_realize(DeviceState *dev, Error **errp)\n\n{\n\n MicroDriveState *md = MICRODRIVE(dev);\n\n\n\n ide_init2(&md->bus, qemu_allocate_irqs(md_set_irq, md, 1)[0]);\n\n}\n"}} {"sample_id": "7d1b0095bff7157e856d1d0e6c4295641ced2752_39", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void gen_neon_dup_low16(TCGv var)\n+\n {\n \n TCGv tmp = new_tmp();\n+\n tcg_gen_ext16u_i32(var, var);\n \n tcg_gen_shli_i32(tmp, var, 16);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_neon_dup_low16(TCGv var)\n\n{\n\n TCGv tmp = new_tmp();\n\n tcg_gen_ext16u_i32(var, var);\n\n tcg_gen_shli_i32(tmp, var, 16);\n\n tcg_gen_or_i32(var, var, tmp);\n\n dead_tmp(tmp);\n\n}\n"}} {"sample_id": "4ab4183d766f10f9fc35cd9ef4acee39f241986f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void usb_serial_read(void *opaque, const uint8_t *buf, int size)\n \n+{\n+\n+ USBSerialState *s = opaque;\n+\n int first_size = RECV_BUF - s->recv_ptr;\n \n if (first_size > size)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void usb_serial_read(void *opaque, const uint8_t *buf, int size)\n\n{\n\n USBSerialState *s = opaque;\n\n int first_size = RECV_BUF - s->recv_ptr;\n\n if (first_size > size)\n\n first_size = size;\n\n memcpy(s->recv_buf + s->recv_ptr + s->recv_used, buf, first_size);\n\n if (size > first_size)\n\n memcpy(s->recv_buf, buf + first_size, size - first_size);\n\n s->recv_used += size;\n\n}\n"}} {"sample_id": "786a4ea82ec9c87e3a895cf41081029b285a5fe5_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -61,9 +61,9 @@\n DPRINTF(\"cfgaddr %x pciaddr %x busno %x devno %d funno %d regno %d\\n\",\n \n cfgaddr, pciaddr, pci_bus_num(phb->bus), devno, funno, regno);\n+\n+\n+\n+ return pciaddr;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t bonito_sbridge_pciaddr(void *opaque, hwaddr addr)\n\n{\n\n PCIBonitoState *s = opaque;\n\n PCIHostState *phb = PCI_HOST_BRIDGE(s->pcihost);\n\n uint32_t cfgaddr;\n\n uint32_t idsel;\n\n uint32_t devno;\n\n uint32_t funno;\n\n uint32_t regno;\n\n uint32_t pciaddr;\n\n\n\n /* support type0 pci config */\n\n if ((s->regs[BONITO_PCIMAP_CFG] & 0x10000) != 0x0) {\n\n return 0xffffffff;\n\n }\n\n\n\n cfgaddr = addr & 0xffff;\n\n cfgaddr |= (s->regs[BONITO_PCIMAP_CFG] & 0xffff) << 16;\n\n\n\n idsel = (cfgaddr & BONITO_PCICONF_IDSEL_MASK) >> BONITO_PCICONF_IDSEL_OFFSET;\n\n devno = ffs(idsel) - 1;\n\n funno = (cfgaddr & BONITO_PCICONF_FUN_MASK) >> BONITO_PCICONF_FUN_OFFSET;\n\n regno = (cfgaddr & BONITO_PCICONF_REG_MASK) >> BONITO_PCICONF_REG_OFFSET;\n\n\n\n if (idsel == 0) {\n\n fprintf(stderr, \"error in bonito pci config address \" TARGET_FMT_plx\n\n \",pcimap_cfg=%x\\n\", addr, s->regs[BONITO_PCIMAP_CFG]);\n\n exit(1);\n\n }\n\n pciaddr = PCI_ADDR(pci_bus_num(phb->bus), devno, funno, regno);\n\n DPRINTF(\"cfgaddr %x pciaddr %x busno %x devno %d funno %d regno %d\\n\",\n\n cfgaddr, pciaddr, pci_bus_num(phb->bus), devno, funno, regno);\n\n\n\n return pciaddr;\n\n}\n"}} {"sample_id": "7f526efd17973ec6d2204f7a47b6923e2be31363_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static inline void RENAME(uyvyToY)(uint8_t *dst, uint8_t *src, int width)\n+\n {\n \n #ifdef HAVE_MMX", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void RENAME(uyvyToY)(uint8_t *dst, uint8_t *src, int width)\n\n{\n\n#ifdef HAVE_MMX\n\n\tasm volatile(\n\n\t\t\"mov %0, %%\"REG_a\"\t\t\\n\\t\"\n\n\t\t\"1:\t\t\t\t\\n\\t\"\n\n\t\t\"movq (%1, %%\"REG_a\",2), %%mm0\t\\n\\t\"\n\n\t\t\"movq 8(%1, %%\"REG_a\",2), %%mm1\t\\n\\t\"\n\n\t\t\"psrlw $8, %%mm0\t\t\\n\\t\"\n\n\t\t\"psrlw $8, %%mm1\t\t\\n\\t\"\n\n\t\t\"packuswb %%mm1, %%mm0\t\t\\n\\t\"\n\n\t\t\"movq %%mm0, (%2, %%\"REG_a\")\t\\n\\t\"\n\n\t\t\"add $8, %%\"REG_a\"\t\t\\n\\t\"\n\n\t\t\" js 1b\t\t\t\t\\n\\t\"\n\n\t\t: : \"g\" ((long)-width), \"r\" (src+width*2), \"r\" (dst+width)\n\n\t\t: \"%\"REG_a\n\n\t);\n\n#else\n\n\tint i;\n\n\tfor(i=0; iextradata, avctx->extradata_size);\n \n data[avctx->extradata_size] = '\\0';\n \n cur = data;\n \n \n+\n while (*cur) {\n \n if (strncmp(\"palette:\", cur, 8) == 0) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static av_cold int dvdsub_init(AVCodecContext *avctx)\n\n{\n\n DVDSubContext *ctx = avctx->priv_data;\n\n char *data, *cur;\n\n\n\n if (!avctx->extradata || !avctx->extradata_size)\n\n return 0;\n\n\n\n data = av_malloc(avctx->extradata_size + 1);\n\n if (!data)\n\n return AVERROR(ENOMEM);\n\n memcpy(data, avctx->extradata, avctx->extradata_size);\n\n data[avctx->extradata_size] = '\\0';\n\n cur = data;\n\n\n\n while (*cur) {\n\n if (strncmp(\"palette:\", cur, 8) == 0) {\n\n int i;\n\n char *p = cur + 8;\n\n ctx->has_palette = 1;\n\n for (i = 0; i < 16; i++) {\n\n ctx->palette[i] = strtoul(p, &p, 16);\n\n while (*p == ',' || av_isspace(*p))\n\n p++;\n\n }\n\n } else if (!strncmp(\"size:\", cur, 5)) {\n\n int w, h;\n\n if (sscanf(cur + 5, \"%dx%d\", &w, &h) == 2) {\n\n int ret = ff_set_dimensions(avctx, w, h);\n\n if (ret < 0)\n\n return ret;\n\n }\n\n }\n\n cur += strcspn(cur, \"\\n\\r\");\n\n cur += strspn(cur, \"\\n\\r\");\n\n }\n\n av_free(data);\n\n return 0;\n\n}\n"}} {"sample_id": "ddf21908961073199f3d186204da4810f2ea150b_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n VncServerInfo *info;\n \n Error *err = NULL;\n+\n+\n+\n+ info = g_malloc(sizeof(*info));\n+\n info->base = g_malloc(sizeof(*info->base));\n \n vnc_init_basic_info_from_server_addr(vd->lsock, info->base, &err);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static VncServerInfo *vnc_server_info_get(VncDisplay *vd)\n\n{\n\n VncServerInfo *info;\n\n Error *err = NULL;\n\n\n\n info = g_malloc(sizeof(*info));\n\n info->base = g_malloc(sizeof(*info->base));\n\n vnc_init_basic_info_from_server_addr(vd->lsock, info->base, &err);\n\n info->has_auth = true;\n\n info->auth = g_strdup(vnc_auth_name(vd));\n\n if (err) {\n\n qapi_free_VncServerInfo(info);\n\n info = NULL;\n\n error_free(err);\n\n }\n\n return info;\n\n}\n"}} {"sample_id": "9b2fadda3e0196ffd485adde4fe9cdd6fae35300_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,14 +1,14 @@\n static void gen_mfsr_64b(DisasContext *ctx)\n+\n+{\n+\n+#if defined(CONFIG_USER_ONLY)\n \n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_REG);\n \n #else\n \n+ TCGv t0;\n \n if (unlikely(ctx->pr)) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_mfsr_64b(DisasContext *ctx)\n\n{\n\n#if defined(CONFIG_USER_ONLY)\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_REG);\n\n#else\n\n TCGv t0;\n\n if (unlikely(ctx->pr)) {\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_REG);\n\n return;\n\n }\n\n t0 = tcg_const_tl(SR(ctx->opcode));\n\n gen_helper_load_sr(cpu_gpr[rD(ctx->opcode)], cpu_env, t0);\n\n tcg_temp_free(t0);\n\n#endif\n\n}\n"}} {"sample_id": "145614a112a8e67d6c84b26faaf2b2002e17d9be", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n }\n \n+\n+\n+ nb_fds++;\n+\n+ nbd_update_server_watch();\n \n nbd_client_new(newproto ? NULL : exp, cioc,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static gboolean nbd_accept(QIOChannel *ioc, GIOCondition cond, gpointer opaque)\n\n{\n\n QIOChannelSocket *cioc;\n\n\n\n cioc = qio_channel_socket_accept(QIO_CHANNEL_SOCKET(ioc),\n\n NULL);\n\n if (!cioc) {\n\n return TRUE;\n\n }\n\n\n\n if (state >= TERMINATE) {\n\n object_unref(OBJECT(cioc));\n\n return TRUE;\n\n }\n\n\n\n nb_fds++;\n\n nbd_update_server_watch();\n\n nbd_client_new(newproto ? NULL : exp, cioc,\n\n NULL, NULL, nbd_client_closed);\n\n object_unref(OBJECT(cioc));\n\n\n\n return TRUE;\n\n}\n"}} {"sample_id": "910b63682ea72f34307b8797c4cc81a1f2a0c47f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,6 +8,6 @@\n \n g_source_unref(iwp->src);\n \n+ iwp->src = NULL;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void io_watch_poll_finalize(GSource *source)\n\n{\n\n IOWatchPoll *iwp = io_watch_poll_from_source(source);\n\n g_source_destroy(iwp->src);\n\n g_source_unref(iwp->src);\n\n iwp->src = NULL;\n\n}\n"}} {"sample_id": "5c3234c6c037943bd4c2d643a1b8cc35f563dbdb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n {\n \n pdu_handler_t *handler;\n+\n+\n+\n if (debug_9p_pdu) {\n \n pprint_pdu(pdu);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void submit_pdu(V9fsState *s, V9fsPDU *pdu)\n\n{\n\n pdu_handler_t *handler;\n\n\n\n if (debug_9p_pdu) {\n\n pprint_pdu(pdu);\n\n }\n\n\n\n BUG_ON(pdu->id >= ARRAY_SIZE(pdu_handlers));\n\n\n\n handler = pdu_handlers[pdu->id];\n\n BUG_ON(handler == NULL);\n\n\n\n handler(s, pdu);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_167", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n qemu_irq irq,\n \n DeviceState *ccm)\n+\n+{\n+\n+ IMXTimerGState *pp;\n+\n DeviceState *dev;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void imx_timerg_create(const target_phys_addr_t addr,\n\n qemu_irq irq,\n\n DeviceState *ccm)\n\n{\n\n IMXTimerGState *pp;\n\n DeviceState *dev;\n\n\n\n dev = sysbus_create_simple(\"imx_timerg\", addr, irq);\n\n pp = container_of(dev, IMXTimerGState, busdev.qdev);\n\n pp->ccm = ccm;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_25", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,8 +14,8 @@\n \n }\n \n+ g_free(r);\n+\n+ return 0;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int qemu_rdma_close(void *opaque)\n\n{\n\n DPRINTF(\"Shutting down connection.\\n\");\n\n QEMUFileRDMA *r = opaque;\n\n if (r->rdma) {\n\n qemu_rdma_cleanup(r->rdma);\n\n g_free(r->rdma);\n\n }\n\n g_free(r);\n\n return 0;\n\n}\n"}} {"sample_id": "a99c273a3f91c3fd616b718c34a5848411ce0258", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int dnxhd_init_vlc(DNXHDContext *ctx, int cid)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int dnxhd_init_vlc(DNXHDContext *ctx, int cid)\n\n{\n\n if (cid != ctx->cid) {\n\n int index;\n\n\n\n if ((index = ff_dnxhd_get_cid_table(cid)) < 0) {\n\n av_log(ctx->avctx, AV_LOG_ERROR, \"unsupported cid %d\\n\", cid);\n\n return -1;\n\n }\n\n if (ff_dnxhd_cid_table[index].bit_depth != ctx->bit_depth) {\n\n av_log(ctx->avctx, AV_LOG_ERROR, \"bit depth mismatches %d %d\\n\", ff_dnxhd_cid_table[index].bit_depth, ctx->bit_depth);\n\n return AVERROR_INVALIDDATA;\n\n }\n\n ctx->cid_table = &ff_dnxhd_cid_table[index];\n\n\n\n ff_free_vlc(&ctx->ac_vlc);\n\n ff_free_vlc(&ctx->dc_vlc);\n\n ff_free_vlc(&ctx->run_vlc);\n\n\n\n init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,\n\n ctx->cid_table->ac_bits, 1, 1,\n\n ctx->cid_table->ac_codes, 2, 2, 0);\n\n init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, ctx->bit_depth + 4,\n\n ctx->cid_table->dc_bits, 1, 1,\n\n ctx->cid_table->dc_codes, 1, 1, 0);\n\n init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,\n\n ctx->cid_table->run_bits, 1, 1,\n\n ctx->cid_table->run_codes, 2, 2, 0);\n\n\n\n ff_init_scantable(ctx->dsp.idct_permutation, &ctx->scantable, ff_zigzag_direct);\n\n ctx->cid = cid;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "d2767edec582558f1e6c52e1dd9370d62e2b30fc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,26 +1,26 @@\n+static int local_rename(FsContext *ctx, const char *oldpath,\n+\n+ const char *newpath)\n+\n+{\n+\n+ int err;\n \n+ char *buffer, *buffer1;\n+\n+\n+\n+ if (ctx->export_flags & V9FS_SM_MAPPED_FILE) {\n+\n err = local_create_mapped_attr_dir(ctx, newpath);\n \n if (err < 0) {\n+\n+ return err;\n+\n+ }\n+\n+ /* rename the .virtfs_metadata files */\n \n buffer = local_mapped_attr_path(ctx, oldpath);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static int local_rename(FsContext *ctx, const char *oldpath,\n\n const char *newpath)\n\n{\n\n int err;\n\n char *buffer, *buffer1;\n\n\n\n if (ctx->export_flags & V9FS_SM_MAPPED_FILE) {\n\n err = local_create_mapped_attr_dir(ctx, newpath);\n\n if (err < 0) {\n\n return err;\n\n }\n\n /* rename the .virtfs_metadata files */\n\n buffer = local_mapped_attr_path(ctx, oldpath);\n\n buffer1 = local_mapped_attr_path(ctx, newpath);\n\n err = rename(buffer, buffer1);\n\n g_free(buffer);\n\n g_free(buffer1);\n\n if (err < 0 && errno != ENOENT) {\n\n return err;\n\n }\n\n }\n\n\n\n buffer = rpath(ctx, oldpath);\n\n buffer1 = rpath(ctx, newpath);\n\n err = rename(buffer, buffer1);\n\n g_free(buffer);\n\n g_free(buffer1);\n\n return err;\n\n}\n"}} {"sample_id": "9888ffb1ce5e0a17f711b01933d504c72ea29d3b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n MOVStreamContext *sc;\n \n+ unsigned i, entries;\n+\n+\n+\n+ if (c->fc->nb_streams < 1)\n \n return 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mov_read_stps(MOVContext *c, AVIOContext *pb, MOVAtom atom)\n\n{\n\n AVStream *st;\n\n MOVStreamContext *sc;\n\n unsigned i, entries;\n\n\n\n if (c->fc->nb_streams < 1)\n\n return 0;\n\n st = c->fc->streams[c->fc->nb_streams-1];\n\n sc = st->priv_data;\n\n\n\n avio_rb32(pb); // version + flags\n\n\n\n entries = avio_rb32(pb);\n\n if (entries >= UINT_MAX / sizeof(*sc->stps_data))\n\n return AVERROR_INVALIDDATA;\n\n sc->stps_data = av_malloc(entries * sizeof(*sc->stps_data));\n\n if (!sc->stps_data)\n\n return AVERROR(ENOMEM);\n\n sc->stps_count = entries;\n\n\n\n for (i = 0; i < entries; i++) {\n\n sc->stps_data[i] = avio_rb32(pb);\n\n //av_dlog(c->fc, \"stps %d\\n\", sc->stps_data[i]);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "75822a12c046646684bc8cad6296842b60e7b6bb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+int nbd_client_init(BlockDriverState *bs, QIOChannelSocket *sioc,\n+\n+ const char *export, Error **errp)\n+\n+{\n \n NbdClientSession *client = nbd_get_client_session(bs);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int nbd_client_init(BlockDriverState *bs, QIOChannelSocket *sioc,\n\n const char *export, Error **errp)\n\n{\n\n NbdClientSession *client = nbd_get_client_session(bs);\n\n int ret;\n\n\n\n /* NBD handshake */\n\n logout(\"session init %s\\n\", export);\n\n qio_channel_set_blocking(QIO_CHANNEL(sioc), true, NULL);\n\n\n\n ret = nbd_receive_negotiate(QIO_CHANNEL(sioc), export,\n\n &client->nbdflags,\n\n NULL, NULL,\n\n &client->ioc,\n\n &client->size, errp);\n\n if (ret < 0) {\n\n logout(\"Failed to negotiate with the NBD server\\n\");\n\n return ret;\n\n }\n\n\n\n qemu_co_mutex_init(&client->send_mutex);\n\n qemu_co_mutex_init(&client->free_sema);\n\n client->sioc = sioc;\n\n object_ref(OBJECT(client->sioc));\n\n\n\n if (!client->ioc) {\n\n client->ioc = QIO_CHANNEL(sioc);\n\n object_ref(OBJECT(client->ioc));\n\n }\n\n\n\n /* Now that we're connected, set the socket to be non-blocking and\n\n * kick the reply mechanism. */\n\n qio_channel_set_blocking(QIO_CHANNEL(sioc), false, NULL);\n\n\n\n nbd_client_attach_aio_context(bs, bdrv_get_aio_context(bs));\n\n\n\n logout(\"Established connection with NBD server\\n\");\n\n return 0;\n\n}\n"}} {"sample_id": "9be385980d37e8f4fd33f605f5fb1c3d144170a8_13", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,10 +5,10 @@\n {\n \n BDRVRBDState *s = bs->opaque;\n+\n+ int r;\n+\n+\n \n r = rbd_snap_rollback(s->image, snapshot_name);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int qemu_rbd_snap_rollback(BlockDriverState *bs,\n\n const char *snapshot_name)\n\n{\n\n BDRVRBDState *s = bs->opaque;\n\n int r;\n\n\n\n r = rbd_snap_rollback(s->image, snapshot_name);\n\n return r;\n\n}\n"}} {"sample_id": "aeaf268e52fc11c1f64914a319e0edddf1346d6a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n dest[0] = av_clip_uint8(dest[0] + dc);\n \n dest[1] = av_clip_uint8(dest[1] + dc);\n+\n+ dest[2] = av_clip_uint8(dest[2] + dc);\n+\n+ dest[3] = av_clip_uint8(dest[3] + dc);\n+\n dest[4] = av_clip_uint8(dest[4] + dc);\n \n dest[5] = av_clip_uint8(dest[5] + dc);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vp3_idct_dc_add_c(uint8_t *dest/*align 8*/, int line_size,\n\n const DCTELEM *block/*align 16*/){\n\n int i, dc = (block[0] + 15) >> 5;\n\n\n\n for(i = 0; i < 8; i++){\n\n dest[0] = av_clip_uint8(dest[0] + dc);\n\n dest[1] = av_clip_uint8(dest[1] + dc);\n\n dest[2] = av_clip_uint8(dest[2] + dc);\n\n dest[3] = av_clip_uint8(dest[3] + dc);\n\n dest[4] = av_clip_uint8(dest[4] + dc);\n\n dest[5] = av_clip_uint8(dest[5] + dc);\n\n dest[6] = av_clip_uint8(dest[6] + dc);\n\n dest[7] = av_clip_uint8(dest[7] + dc);\n\n dest += line_size;\n\n }\n\n}\n"}} {"sample_id": "86dfcfd0e30d6645eea2c63c1c60a0550e7c97ea", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+int ff_mov_read_esds(AVFormatContext *fc, AVIOContext *pb, MOVAtom atom)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int ff_mov_read_esds(AVFormatContext *fc, AVIOContext *pb, MOVAtom atom)\n\n{\n\n AVStream *st;\n\n int tag;\n\n\n\n if (fc->nb_streams < 1)\n\n return 0;\n\n st = fc->streams[fc->nb_streams-1];\n\n\n\n avio_rb32(pb); /* version + flags */\n\n ff_mp4_read_descr(fc, pb, &tag);\n\n if (tag == MP4ESDescrTag) {\n\n ff_mp4_parse_es_descr(pb, NULL);\n\n } else\n\n avio_rb16(pb); /* ID */\n\n\n\n ff_mp4_read_descr(fc, pb, &tag);\n\n if (tag == MP4DecConfigDescrTag)\n\n ff_mp4_read_dec_config_descr(fc, st, pb);\n\n return 0;\n\n}\n"}} {"sample_id": "3c529d935923a70519557d420db1d5a09a65086a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static void raw_close_fd_pool(BDRVRawState *s)\n+\n+{\n+\n+ int i;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void raw_close_fd_pool(BDRVRawState *s)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < RAW_FD_POOL_SIZE; i++) {\n\n if (s->fd_pool[i] != -1) {\n\n close(s->fd_pool[i]);\n\n s->fd_pool[i] = -1;\n\n }\n\n }\n\n}\n"}} {"sample_id": "7f526efd17973ec6d2204f7a47b6923e2be31363_22", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static inline void RENAME(yuy2ToY)(uint8_t *dst, uint8_t *src, int width)\n+\n {\n \n #ifdef HAVE_MMX", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline void RENAME(yuy2ToY)(uint8_t *dst, uint8_t *src, int width)\n\n{\n\n#ifdef HAVE_MMX\n\n\tasm volatile(\n\n\t\t\"movq \"MANGLE(bm01010101)\", %%mm2\\n\\t\"\n\n\t\t\"mov %0, %%\"REG_a\"\t\t\\n\\t\"\n\n\t\t\"1:\t\t\t\t\\n\\t\"\n\n\t\t\"movq (%1, %%\"REG_a\",2), %%mm0\t\\n\\t\"\n\n\t\t\"movq 8(%1, %%\"REG_a\",2), %%mm1\t\\n\\t\"\n\n\t\t\"pand %%mm2, %%mm0\t\t\\n\\t\"\n\n\t\t\"pand %%mm2, %%mm1\t\t\\n\\t\"\n\n\t\t\"packuswb %%mm1, %%mm0\t\t\\n\\t\"\n\n\t\t\"movq %%mm0, (%2, %%\"REG_a\")\t\\n\\t\"\n\n\t\t\"add $8, %%\"REG_a\"\t\t\\n\\t\"\n\n\t\t\" js 1b\t\t\t\t\\n\\t\"\n\n\t\t: : \"g\" ((long)-width), \"r\" (src+width*2), \"r\" (dst+width)\n\n\t\t: \"%\"REG_a\n\n\t);\n\n#else\n\n\tint i;\n\n\tfor(i=0; iclient_channel);\n+\n+ g_io_channel_shutdown(c->client_channel, true, NULL);\n+\n+ g_io_channel_unref(c->client_channel);\n \n c->client_channel = NULL;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ga_channel_client_close(GAChannel *c)\n\n{\n\n g_assert(c->client_channel);\n\n g_io_channel_shutdown(c->client_channel, true, NULL);\n\n g_io_channel_unref(c->client_channel);\n\n c->client_channel = NULL;\n\n if (c->method == GA_CHANNEL_UNIX_LISTEN && c->listen_channel) {\n\n ga_channel_listen_add(c, 0, false);\n\n }\n\n}\n"}} {"sample_id": "386aee6864c5cfc438785d2421b2f056450da014", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n if (!opaque) {\n \n+ av_log(ctx, AV_LOG_ERROR,\n+\n+ \"No opaque field provided\\n\");\n+\n+ return AVERROR(EINVAL);\n \n } else {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int vsink_init(AVFilterContext *ctx, const char *args, void *opaque)\n\n{\n\n BufferSinkContext *buf = ctx->priv;\n\n av_unused AVBufferSinkParams *params;\n\n\n\n if (!opaque) {\n\n av_log(ctx, AV_LOG_ERROR,\n\n \"No opaque field provided\\n\");\n\n return AVERROR(EINVAL);\n\n } else {\n\n#if FF_API_OLD_VSINK_API\n\n buf->pixel_fmts = (const enum PixelFormat *)opaque;\n\n#else\n\n params = (AVBufferSinkParams *)opaque;\n\n buf->pixel_fmts = params->pixel_fmts;\n\n#endif\n\n }\n\n\n\n return common_init(ctx);\n\n}\n"}} {"sample_id": "55188278169c3a1838334d7aa47a1f7a40741690", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n XanContext *s = avctx->priv_data;\n \n+ int ftype;\n \n+ int ret;\n \n+\n \n s->pic.reference = 1;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int xan_decode_frame(AVCodecContext *avctx,\n\n void *data, int *data_size,\n\n AVPacket *avpkt)\n\n{\n\n XanContext *s = avctx->priv_data;\n\n int ftype;\n\n int ret;\n\n\n\n s->pic.reference = 1;\n\n s->pic.buffer_hints = FF_BUFFER_HINTS_VALID |\n\n FF_BUFFER_HINTS_PRESERVE |\n\n FF_BUFFER_HINTS_REUSABLE;\n\n if ((ret = avctx->reget_buffer(avctx, &s->pic))) {\n\n av_log(s->avctx, AV_LOG_ERROR, \"reget_buffer() failed\\n\");\n\n return ret;\n\n }\n\n\n\n ftype = AV_RL32(avpkt->data);\n\n switch (ftype) {\n\n case 0:\n\n ret = xan_decode_frame_type0(avctx, avpkt);\n\n break;\n\n case 1:\n\n ret = xan_decode_frame_type1(avctx, avpkt);\n\n break;\n\n default:\n\n av_log(avctx, AV_LOG_ERROR, \"Unknown frame type %d\\n\", ftype);\n\n return -1;\n\n }\n\n if (ret)\n\n return ret;\n\n\n\n *data_size = sizeof(AVFrame);\n\n *(AVFrame*)data = s->pic;\n\n\n\n return avpkt->size;\n\n}\n"}} {"sample_id": "97f3ad35517e0d02c0149637d1bb10713c52b057_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n MigrationIncomingState *migration_incoming_state_new(QEMUFile* f)\n+\n {\n \n mis_current = g_malloc0(sizeof(MigrationIncomingState));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "MigrationIncomingState *migration_incoming_state_new(QEMUFile* f)\n\n{\n\n mis_current = g_malloc0(sizeof(MigrationIncomingState));\n\n mis_current->file = f;\n\n QLIST_INIT(&mis_current->loadvm_handlers);\n\n\n\n return mis_current;\n\n}\n"}} {"sample_id": "de08c606f9ddafe647b6843e2b10a6d6030b0fc0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n return -EINVAL;\n \n }\n+\n+ if (drv->bdrv_snapshot_load_tmp) {\n+\n+ return drv->bdrv_snapshot_load_tmp(bs, snapshot_name);\n+\n }\n \n return -ENOTSUP;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int bdrv_snapshot_load_tmp(BlockDriverState *bs,\n\n const char *snapshot_name)\n\n{\n\n BlockDriver *drv = bs->drv;\n\n if (!drv) {\n\n return -ENOMEDIUM;\n\n }\n\n if (!bs->read_only) {\n\n return -EINVAL;\n\n }\n\n if (drv->bdrv_snapshot_load_tmp) {\n\n return drv->bdrv_snapshot_load_tmp(bs, snapshot_name);\n\n }\n\n return -ENOTSUP;\n\n}\n"}} {"sample_id": "927d811b282ffdf5386bd63f435c1507634ba49a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n error_report(\"failed to retrieve user name\");\n snprintf(s->smb_dir, sizeof(s->smb_dir), \"/tmp/qemu-smb.%ld-%d\",\n (long)getpid(), instance++);\n+ if (mkdir(s->smb_dir, 0700) < 0) {\n+ error_report(\"could not create samba server dir '%s'\", s->smb_dir);\n+ snprintf(smb_conf, sizeof(smb_conf), \"%s/%s\", s->smb_dir, \"smb.conf\");\n+ f = fopen(smb_conf, \"w\");\n+ if (!f) {\n slirp_smb_cleanup(s);\n error_report(\"could not create samba server configuration file '%s'\",\n smb_conf);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static int slirp_smb(SlirpState* s, const char *exported_dir,\n struct in_addr vserver_addr)\n{\n static int instance;\n char smb_conf[128];\n char smb_cmdline[128];\n struct passwd *passwd;\n FILE *f;\n passwd = getpwuid(geteuid());\n if (!passwd) {\n error_report(\"failed to retrieve user name\");\n snprintf(s->smb_dir, sizeof(s->smb_dir), \"/tmp/qemu-smb.%ld-%d\",\n (long)getpid(), instance++);\n if (mkdir(s->smb_dir, 0700) < 0) {\n error_report(\"could not create samba server dir '%s'\", s->smb_dir);\n snprintf(smb_conf, sizeof(smb_conf), \"%s/%s\", s->smb_dir, \"smb.conf\");\n f = fopen(smb_conf, \"w\");\n if (!f) {\n slirp_smb_cleanup(s);\n error_report(\"could not create samba server configuration file '%s'\",\n smb_conf);\n fprintf(f,\n \"[global]\\n\"\n \"private dir=%s\\n\"\n \"socket address=127.0.0.1\\n\"\n \"pid directory=%s\\n\"\n \"lock directory=%s\\n\"\n \"state directory=%s\\n\"\n \"log file=%s/log.smbd\\n\"\n \"smb passwd file=%s/smbpasswd\\n\"\n \"security = share\\n\"\n \"[qemu]\\n\"\n \"path=%s\\n\"\n \"read only=no\\n\"\n \"guest ok=yes\\n\"\n \"force user=%s\\n\",\n s->smb_dir,\n s->smb_dir,\n s->smb_dir,\n s->smb_dir,\n s->smb_dir,\n s->smb_dir,\n exported_dir,\n passwd->pw_name\n );\n fclose(f);\n snprintf(smb_cmdline, sizeof(smb_cmdline), \"%s -s %s\",\n CONFIG_SMBD_COMMAND, smb_conf);\n if (slirp_add_exec(s->slirp, 0, smb_cmdline, &vserver_addr, 139) < 0) {\n slirp_smb_cleanup(s);\n error_report(\"conflicting/invalid smbserver address\");\n return 0;"}} {"sample_id": "50a3c4c5d2634b5d4076a5b7c099729cbd59ac45", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int rsd_probe(AVProbeData *p)\n+\n+{\n \n if (!memcmp(p->buf, \"RSD\", 3) &&\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int rsd_probe(AVProbeData *p)\n\n{\n\n if (!memcmp(p->buf, \"RSD\", 3) &&\n\n p->buf[3] - '0' >= 2 && p->buf[3] - '0' <= 6)\n\n return AVPROBE_SCORE_EXTENSION;\n\n return 0;\n\n}\n"}} {"sample_id": "cb365646a942ed58aae053064b2048a415337ba2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+int64_t cpu_get_clock(void)\n \n {\n+\n int64_t ti;\n \n+ if (!timers_state.cpu_ticks_enabled) {\n \n return timers_state.cpu_clock_offset;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int64_t cpu_get_clock(void)\n\n{\n\n int64_t ti;\n\n if (!timers_state.cpu_ticks_enabled) {\n\n return timers_state.cpu_clock_offset;\n\n } else {\n\n ti = get_clock();\n\n return ti + timers_state.cpu_clock_offset;\n\n }\n\n}\n"}} {"sample_id": "b172c56a6d849554f7e43adc95983a9d6c042689_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n CPUState *env = opaque;\n \n ppc_tb_t *tb_env = env->tb_env;\n+\n+\n+\n+ tb_env->tb_freq = freq;\n+\n tb_env->decr_freq = freq;\n \n /* There is a bug in Linux 2.4 kernels:", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void cpu_ppc_set_tb_clk (void *opaque, uint32_t freq)\n\n{\n\n CPUState *env = opaque;\n\n ppc_tb_t *tb_env = env->tb_env;\n\n\n\n tb_env->tb_freq = freq;\n\n tb_env->decr_freq = freq;\n\n /* There is a bug in Linux 2.4 kernels:\n\n * if a decrementer exception is pending when it enables msr_ee at startup,\n\n * it's not ready to handle it...\n\n */\n\n _cpu_ppc_store_decr(env, 0xFFFFFFFF, 0xFFFFFFFF, 0);\n\n#if defined(TARGET_PPC64H)\n\n _cpu_ppc_store_hdecr(env, 0xFFFFFFFF, 0xFFFFFFFF, 0);\n\n cpu_ppc_store_purr(env, 0x0000000000000000ULL);\n\n#endif /* defined(TARGET_PPC64H) */\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_310", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,11 +16,11 @@\n \n \n \n+#ifdef DEBUG_IDE\n+\n+ printf(\"bmdma: writeb 0x%02x : 0x%02x\\n\", addr, val);\n+\n+#endif\n \n switch (addr & 3) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bmdma_write(void *opaque, target_phys_addr_t addr,\n\n uint64_t val, unsigned size)\n\n{\n\n BMDMAState *bm = opaque;\n\n\n\n if (size != 1) {\n\n return;\n\n }\n\n\n\n#ifdef DEBUG_IDE\n\n printf(\"bmdma: writeb 0x%02x : 0x%02x\\n\", addr, val);\n\n#endif\n\n switch (addr & 3) {\n\n case 0:\n\n bmdma_cmd_writeb(bm, val);\n\n break;\n\n case 2:\n\n bm->status = (val & 0x60) | (bm->status & 1) | (bm->status & ~val & 0x06);\n\n break;\n\n default:;\n\n }\n\n}\n"}} {"sample_id": "21c6438f2c353b4e0a5bb16bb5861fb8a799e121", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int ffm_is_avail_data(AVFormatContext *s, int size)\n \n+{\n+\n+ FFMContext *ffm = s->priv_data;\n+\n+ int64_t pos, avail_size;\n \n int len;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ffm_is_avail_data(AVFormatContext *s, int size)\n\n{\n\n FFMContext *ffm = s->priv_data;\n\n int64_t pos, avail_size;\n\n int len;\n\n\n\n len = ffm->packet_end - ffm->packet_ptr;\n\n if (size <= len)\n\n return 1;\n\n pos = url_ftell(s->pb);\n\n if (!ffm->write_index) {\n\n if (pos == ffm->file_size);\n\n return AVERROR_EOF;\n\n avail_size = ffm->file_size - pos;\n\n } else {\n\n if (pos == ffm->write_index) {\n\n /* exactly at the end of stream */\n\n return AVERROR(EAGAIN);\n\n } else if (pos < ffm->write_index) {\n\n avail_size = ffm->write_index - pos;\n\n } else {\n\n avail_size = (ffm->file_size - pos) + (ffm->write_index - FFM_PACKET_SIZE);\n\n }\n\n }\n\n avail_size = (avail_size / ffm->packet_size) * (ffm->packet_size - FFM_HEADER_SIZE) + len;\n\n if (size <= avail_size)\n\n return 1;\n\n else\n\n return AVERROR(EAGAIN);\n\n}\n"}} {"sample_id": "550830f9351291c585c963204ad9127998b1c1ce_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void bdrv_cow_init(void)\n+\n {\n \n bdrv_register(&bdrv_cow);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bdrv_cow_init(void)\n\n{\n\n bdrv_register(&bdrv_cow);\n\n}\n"}} {"sample_id": "8f6e699ddbcad32480fa64796ccf44cbaf5b4b91_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void lsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid)\n \n+{\n+\n+ LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);\n+\n+ int out;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void lsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid)\n\n{\n\n LSIState *s = DO_UPCAST(LSIState, dev.qdev, req->bus->qbus.parent);\n\n int out;\n\n\n\n out = (s->sstat1 & PHASE_MASK) == PHASE_DO;\n\n DPRINTF(\"Command complete status=%d\\n\", (int)status);\n\n s->status = status;\n\n s->command_complete = 2;\n\n if (s->waiting && s->dbc != 0) {\n\n /* Raise phase mismatch for short transfers. */\n\n lsi_bad_phase(s, out, PHASE_ST);\n\n } else {\n\n lsi_set_phase(s, PHASE_ST);\n\n }\n\n\n\n if (s->current && req == s->current->req) {\n\n req->hba_private = NULL;\n\n lsi_request_free(s, s->current);\n\n scsi_req_unref(req);\n\n }\n\n lsi_resume_script(s);\n\n}\n"}} {"sample_id": "5cb9b56acfc0b50acf7ccd2d044ab4991c47fdde_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static int print_int32(DeviceState *dev, Property *prop, char *dest, size_t len)\n+\n+{\n \n int32_t *ptr = qdev_get_prop_ptr(dev, prop);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int print_int32(DeviceState *dev, Property *prop, char *dest, size_t len)\n\n{\n\n int32_t *ptr = qdev_get_prop_ptr(dev, prop);\n\n return snprintf(dest, len, \"%\" PRId32, *ptr);\n\n}\n"}} {"sample_id": "1dc42050185d63c1de5d16146fbaee92640af187", "diff": "--- a/source.c\n+++ b/source.c\n@@ -24,10 +24,10 @@\n \n avfilter_copy_buffer_ref_props(outlink->out_buf, picref);\n \n+ return ff_start_frame(outlink, avfilter_ref_buffer(outlink->out_buf, ~0));\n+\n+ }\n+\n+ return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int default_start_frame(AVFilterLink *inlink, AVFilterBufferRef *picref)\n\n{\n\n AVFilterLink *outlink = NULL;\n\n\n\n if (inlink->dst->nb_outputs)\n\n outlink = inlink->dst->outputs[0];\n\n\n\n if (outlink) {\n\n outlink->out_buf = ff_get_video_buffer(outlink, AV_PERM_WRITE, outlink->w, outlink->h);\n\n if (!outlink->out_buf)\n\n return AVERROR(ENOMEM);\n\n\n\n avfilter_copy_buffer_ref_props(outlink->out_buf, picref);\n\n return ff_start_frame(outlink, avfilter_ref_buffer(outlink->out_buf, ~0));\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "e1833e1f96456fd8fc17463246fe0b2050e68efb_12", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,10 +3,10 @@\n {\n \n DisasContext *ctx = opaque;\n+\n+\n+\n+ gen_op_store_40x_sler();\n \n /* We must stop the translation as we may have changed\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void spr_write_40x_sler (void *opaque, int sprn)\n\n{\n\n DisasContext *ctx = opaque;\n\n\n\n gen_op_store_40x_sler();\n\n /* We must stop the translation as we may have changed\n\n * some regions endianness\n\n */\n\n RET_STOP(ctx);\n\n}\n"}} {"sample_id": "1fd5d4fea4ba686705fd377c7cffc0f0c9f83f93_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -55,11 +55,11 @@\n info->dimm = di;\n \n elem->value = info;\n+\n+ elem->next = NULL;\n+\n+ **prev = elem;\n+\n *prev = &elem->next;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int qmp_pc_dimm_device_list(Object *obj, void *opaque)\n\n{\n\n MemoryDeviceInfoList ***prev = opaque;\n\n\n\n if (object_dynamic_cast(obj, TYPE_PC_DIMM)) {\n\n DeviceState *dev = DEVICE(obj);\n\n\n\n if (dev->realized) {\n\n MemoryDeviceInfoList *elem = g_new0(MemoryDeviceInfoList, 1);\n\n MemoryDeviceInfo *info = g_new0(MemoryDeviceInfo, 1);\n\n PCDIMMDeviceInfo *di = g_new0(PCDIMMDeviceInfo, 1);\n\n DeviceClass *dc = DEVICE_GET_CLASS(obj);\n\n PCDIMMDevice *dimm = PC_DIMM(obj);\n\n\n\n if (dev->id) {\n\n di->has_id = true;\n\n di->id = g_strdup(dev->id);\n\n }\n\n di->hotplugged = dev->hotplugged;\n\n di->hotpluggable = dc->hotpluggable;\n\n di->addr = dimm->addr;\n\n di->slot = dimm->slot;\n\n di->node = dimm->node;\n\n di->size = object_property_get_int(OBJECT(dimm), PC_DIMM_SIZE_PROP,\n\n NULL);\n\n di->memdev = object_get_canonical_path(OBJECT(dimm->hostmem));\n\n\n\n info->dimm = di;\n\n elem->value = info;\n\n elem->next = NULL;\n\n **prev = elem;\n\n *prev = &elem->next;\n\n }\n\n }\n\n\n\n object_child_foreach(obj, qmp_pc_dimm_device_list, opaque);\n\n return 0;\n\n}\n"}} {"sample_id": "bdb5ee3064d5ae786b0bcb6cf6ff4e3554a72990_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n Rom *rom;\n \n+\n+\n+ QTAILQ_FOREACH(rom, &roms, next) {\n+\n+ if (rom->fw_file) {\n \n continue;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int rom_copy(uint8_t *dest, target_phys_addr_t addr, size_t size)\n\n{\n\n target_phys_addr_t end = addr + size;\n\n uint8_t *s, *d = dest;\n\n size_t l = 0;\n\n Rom *rom;\n\n\n\n QTAILQ_FOREACH(rom, &roms, next) {\n\n if (rom->fw_file) {\n\n continue;\n\n }\n\n if (rom->addr + rom->romsize < addr)\n\n continue;\n\n if (rom->addr > end)\n\n break;\n\n if (!rom->data)\n\n continue;\n\n\n\n d = dest + (rom->addr - addr);\n\n s = rom->data;\n\n l = rom->romsize;\n\n\n\n if (rom->addr < addr) {\n\n d = dest;\n\n s += (addr - rom->addr);\n\n l -= (addr - rom->addr);\n\n }\n\n if ((d + l) > (dest + size)) {\n\n l = dest - d;\n\n }\n\n\n\n memcpy(d, s, l);\n\n }\n\n\n\n return (d + l) - dest;\n\n}\n"}} {"sample_id": "7d1b0095bff7157e856d1d0e6c4295641ced2752_34", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,7 +10,7 @@\n \n \n \n+ rd = (insn >> 16) & 0xf;\n \n tmp = load_reg(s, rd);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline int gen_iwmmxt_address(DisasContext *s, uint32_t insn, TCGv dest)\n\n{\n\n int rd;\n\n uint32_t offset;\n\n TCGv tmp;\n\n\n\n rd = (insn >> 16) & 0xf;\n\n tmp = load_reg(s, rd);\n\n\n\n offset = (insn & 0xff) << ((insn >> 7) & 2);\n\n if (insn & (1 << 24)) {\n\n /* Pre indexed */\n\n if (insn & (1 << 23))\n\n tcg_gen_addi_i32(tmp, tmp, offset);\n\n else\n\n tcg_gen_addi_i32(tmp, tmp, -offset);\n\n tcg_gen_mov_i32(dest, tmp);\n\n if (insn & (1 << 21))\n\n store_reg(s, rd, tmp);\n\n else\n\n dead_tmp(tmp);\n\n } else if (insn & (1 << 21)) {\n\n /* Post indexed */\n\n tcg_gen_mov_i32(dest, tmp);\n\n if (insn & (1 << 23))\n\n tcg_gen_addi_i32(tmp, tmp, offset);\n\n else\n\n tcg_gen_addi_i32(tmp, tmp, -offset);\n\n store_reg(s, rd, tmp);\n\n } else if (!(insn & (1 << 23)))\n\n return 1;\n\n return 0;\n\n}\n"}} {"sample_id": "f65ed4c1529f29a7d62d6733eaa50bed24a4b2ed_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n {\n \n+ int s_ioport_ctrl, vga_io_memory;\n+\n+\n+\n+ s->it_shift = it_shift;\n \n s_ioport_ctrl = cpu_register_io_memory(0, vga_mm_read_ctrl, vga_mm_write_ctrl, s);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void vga_mm_init(VGAState *s, target_phys_addr_t vram_base,\n\n target_phys_addr_t ctrl_base, int it_shift)\n\n{\n\n int s_ioport_ctrl, vga_io_memory;\n\n\n\n s->it_shift = it_shift;\n\n s_ioport_ctrl = cpu_register_io_memory(0, vga_mm_read_ctrl, vga_mm_write_ctrl, s);\n\n vga_io_memory = cpu_register_io_memory(0, vga_mem_read, vga_mem_write, s);\n\n\n\n register_savevm(\"vga\", 0, 2, vga_save, vga_load, s);\n\n\n\n cpu_register_physical_memory(ctrl_base, 0x100000, s_ioport_ctrl);\n\n s->bank_offset = 0;\n\n cpu_register_physical_memory(vram_base + 0x000a0000, 0x20000, vga_io_memory);\n\n\n}"}} {"sample_id": "53ea595eec984e3109310e8bb7ff4b5786d91057_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static inline int mov_stsc_index_valid(int index, int count)\n+\n {\n \n return index + 1 < count;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static inline int mov_stsc_index_valid(int index, int count)\n\n{\n\n return index + 1 < count;\n\n}\n"}} {"sample_id": "5c720657c23afd798ae0db7c7362eb859a89ab3d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,7 +3,7 @@\n AVStream *st, MOVStreamContext *sc,\n \n int size)\n+\n {\n \n if (st->codec->codec_tag == MKTAG('t','m','c','d')) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int mov_parse_stsd_data(MOVContext *c, AVIOContext *pb,\n\n AVStream *st, MOVStreamContext *sc,\n\n int size)\n\n{\n\n if (st->codec->codec_tag == MKTAG('t','m','c','d')) {\n\n st->codec->extradata_size = size;\n\n st->codec->extradata = av_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE);\n\n if (!st->codec->extradata)\n\n return AVERROR(ENOMEM);\n\n avio_read(pb, st->codec->extradata, size);\n\n } else {\n\n /* other codec type, just skip (rtp, mp4s ...) */\n\n avio_skip(pb, size);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "bcd7bf7eeb09a395cc01698842d1b8be9af483fc_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,10 +7,10 @@\n int weight_src, int offset)\n \n {\n+\n+ avc_biwgt_4width_msa(src, stride,\n+\n+ dst, stride,\n \n height, log2_denom,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_biweight_h264_pixels4_8_msa(uint8_t *dst, uint8_t *src,\n\n int stride, int height,\n\n int log2_denom, int weight_dst,\n\n int weight_src, int offset)\n\n{\n\n avc_biwgt_4width_msa(src, stride,\n\n dst, stride,\n\n height, log2_denom,\n\n weight_src, weight_dst, offset);\n\n}\n"}} {"sample_id": "1ad9f0a464fe78d30ee60b3629f7a825cf2fab13_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n if (cpu->env.external_htab == MMU_HASH64_KVM_MANAGED_HPT) {\n \n kvmppc_hash64_free_pteg(token);\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ppc_hash64_stop_access(PowerPCCPU *cpu, uint64_t token)\n\n{\n\n if (cpu->env.external_htab == MMU_HASH64_KVM_MANAGED_HPT) {\n\n kvmppc_hash64_free_pteg(token);\n\n }\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n int64_t pos)\n \n {\n+\n+ QEMUFileSocket *s = opaque;\n+\n+ ssize_t len;\n+\n ssize_t size = iov_size(iov, iovcnt);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static ssize_t socket_writev_buffer(void *opaque, struct iovec *iov, int iovcnt,\n\n int64_t pos)\n\n{\n\n QEMUFileSocket *s = opaque;\n\n ssize_t len;\n\n ssize_t size = iov_size(iov, iovcnt);\n\n\n\n len = iov_send(s->fd, iov, iovcnt, 0, size);\n\n if (len < size) {\n\n len = -socket_error();\n\n }\n\n return len;\n\n}\n"}} {"sample_id": "658ae5a7b90139a6a296cd4cd83643d843964796_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,18 +4,18 @@\n \n {\n \n+ HostMemoryBackend *backend = MEMORY_BACKEND(obj);\n \n+ uint16List *host_nodes = NULL;\n \n uint16List **node = &host_nodes;\n \n unsigned long value;\n \n \n+\n value = find_first_bit(backend->host_nodes, MAX_NODES);\n+\n \n \n node = host_memory_append_node(node, value);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "host_memory_backend_get_host_nodes(Object *obj, Visitor *v, const char *name,\n\n void *opaque, Error **errp)\n\n{\n\n HostMemoryBackend *backend = MEMORY_BACKEND(obj);\n\n uint16List *host_nodes = NULL;\n\n uint16List **node = &host_nodes;\n\n unsigned long value;\n\n\n\n value = find_first_bit(backend->host_nodes, MAX_NODES);\n\n\n\n node = host_memory_append_node(node, value);\n\n\n\n if (value == MAX_NODES) {\n\n goto out;\n\n }\n\n\n\n do {\n\n value = find_next_bit(backend->host_nodes, MAX_NODES, value + 1);\n\n if (value == MAX_NODES) {\n\n break;\n\n }\n\n\n\n node = host_memory_append_node(node, value);\n\n } while (true);\n\n\n\nout:\n\n visit_type_uint16List(v, name, &host_nodes, errp);\n\n}\n"}} {"sample_id": "ef9f8dd7305e39f5579b33abeec425c11f4f1b6d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -42,11 +42,11 @@\n \n }\n \n+ }\n+\n+ }\n+\n+\n \n /* alpha plane */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void start_frame(AVFilterLink *link, AVFilterPicRef *picref)\n\n{\n\n CropContext *crop = link->dst->priv;\n\n AVFilterPicRef *ref2 = avfilter_ref_pic(picref, ~0);\n\n int i;\n\n\n\n ref2->w = crop->w;\n\n ref2->h = crop->h;\n\n\n\n ref2->data[0] += crop->y * ref2->linesize[0];\n\n ref2->data[0] += (crop->x * crop->bpp) >> 3;\n\n\n\n if (link->format != PIX_FMT_PAL8 &&\n\n link->format != PIX_FMT_BGR4_BYTE &&\n\n link->format != PIX_FMT_RGB4_BYTE &&\n\n link->format != PIX_FMT_BGR8 &&\n\n link->format != PIX_FMT_RGB8) {\n\n for (i = 1; i < 3; i ++) {\n\n if (ref2->data[i]) {\n\n ref2->data[i] += (crop->y >> crop->vsub) * ref2->linesize[i];\n\n ref2->data[i] += ((crop->x * crop->bpp) >> 3) >> crop->hsub;\n\n }\n\n }\n\n }\n\n\n\n /* alpha plane */\n\n if (ref2->data[3]) {\n\n ref2->data[3] += crop->y * ref2->linesize[3];\n\n ref2->data[3] += (crop->x * crop->bpp) >> 3;\n\n }\n\n\n\n avfilter_start_frame(link->dst->outputs[0], ref2);\n\n}\n"}} {"sample_id": "6f2d8978728c48ca46f5c01835438508aace5c64_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void OPPROTO op_divd (void)\n+\n+{\n \n if (unlikely(((int64_t)T0 == INT64_MIN && (int64_t)T1 == -1) ||\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void OPPROTO op_divd (void)\n\n{\n\n if (unlikely(((int64_t)T0 == INT64_MIN && (int64_t)T1 == -1) ||\n\n (int64_t)T1 == 0)) {\n\n T0 = (int64_t)((-1ULL) * ((uint64_t)T0 >> 63));\n\n } else {\n\n T0 = (int64_t)T0 / (int64_t)T1;\n\n }\n\n RETURN();\n\n}\n"}} {"sample_id": "74475455442398a64355428b37422d14ccc293cb_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,6 +4,6 @@\n \n memset (rate, 0, sizeof (*rate));\n \n+ rate->start_ticks = qemu_get_clock (vm_clock);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void rate_start (SpiceRateCtl *rate)\n\n{\n\n memset (rate, 0, sizeof (*rate));\n\n rate->start_ticks = qemu_get_clock (vm_clock);\n\n}\n"}} {"sample_id": "6abc56e892c2c2500d1fc2698fa6d580b72f721b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+static int shall_we_drop(AVFormatContext *s)\n \n {\n \n+ struct dshow_ctx *ctx = s->priv_data;\n \n+ static const uint8_t dropscore[] = {62, 75, 87, 100};\n \n const int ndropscores = FF_ARRAY_ELEMS(dropscore);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int shall_we_drop(AVFormatContext *s)\n\n{\n\n struct dshow_ctx *ctx = s->priv_data;\n\n static const uint8_t dropscore[] = {62, 75, 87, 100};\n\n const int ndropscores = FF_ARRAY_ELEMS(dropscore);\n\n unsigned int buffer_fullness = (ctx->curbufsize*100)/s->max_picture_buffer;\n\n\n\n if(dropscore[++ctx->video_frame_num%ndropscores] <= buffer_fullness) {\n\n av_log(s, AV_LOG_ERROR,\n\n \"real-time buffer %d%% full! frame dropped!\\n\", buffer_fullness);\n\n return 1;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "4ae4b609ee2d5bcc9df6c03c21dc1fed527aada1_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n \n \n TCGv addr = tcg_temp_new();\n+\n TCGv data;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_ldx(DisasContext *dc, uint32_t code, uint32_t flags)\n\n{\n\n I_TYPE(instr, code);\n\n\n\n TCGv addr = tcg_temp_new();\n\n TCGv data;\n\n\n\n /*\n\n * WARNING: Loads into R_ZERO are ignored, but we must generate the\n\n * memory access itself to emulate the CPU precisely. Load\n\n * from a protected page to R_ZERO will cause SIGSEGV on\n\n * the Nios2 CPU.\n\n */\n\n if (likely(instr.b != R_ZERO)) {\n\n data = dc->cpu_R[instr.b];\n\n } else {\n\n data = tcg_temp_new();\n\n }\n\n\n\n tcg_gen_addi_tl(addr, load_gpr(dc, instr.a), instr.imm16s);\n\n tcg_gen_qemu_ld_tl(data, addr, dc->mem_idx, flags);\n\n\n\n if (unlikely(instr.b == R_ZERO)) {\n\n tcg_temp_free(data);\n\n }\n\n\n\n tcg_temp_free(addr);\n\n}\n"}} {"sample_id": "5d6c599fe1d69a1bf8c5c4d3c58be2b31cd625ad", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void qmp_xen_save_devices_state(const char *filename, Error **errp)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "void qmp_xen_save_devices_state(const char *filename, Error **errp)\n\n{\n\n QEMUFile *f;\n\n QIOChannelFile *ioc;\n\n int saved_vm_running;\n\n int ret;\n\n\n\n saved_vm_running = runstate_is_running();\n\n vm_stop(RUN_STATE_SAVE_VM);\n\n global_state_store_running();\n\n\n\n ioc = qio_channel_file_new_path(filename, O_WRONLY | O_CREAT, 0660, errp);\n\n if (!ioc) {\n\n goto the_end;\n\n }\n\n qio_channel_set_name(QIO_CHANNEL(ioc), \"migration-xen-save-state\");\n\n f = qemu_fopen_channel_output(QIO_CHANNEL(ioc));\n\n ret = qemu_save_device_state(f);\n\n qemu_fclose(f);\n\n if (ret < 0) {\n\n error_setg(errp, QERR_IO_ERROR);\n\n }\n\n\n\n the_end:\n\n if (saved_vm_running) {\n\n vm_start();\n\n }\n\n}\n"}} {"sample_id": "ab28108a361196134704071b7b34c42fc7d747c7_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n return -1;\n \n assert(ctx_pic);\n+\n+\n+\n+ fill_picture_parameters(avctx, ctx, s, &ctx_pic->pp);\n+\n fill_quantization_matrices(avctx, ctx, s, &ctx_pic->qm);\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int dxva2_mpeg2_start_frame(AVCodecContext *avctx,\n\n av_unused const uint8_t *buffer,\n\n av_unused uint32_t size)\n\n{\n\n const struct MpegEncContext *s = avctx->priv_data;\n\n AVDXVAContext *ctx = avctx->hwaccel_context;\n\n struct dxva2_picture_context *ctx_pic =\n\n s->current_picture_ptr->hwaccel_picture_private;\n\n\n\n if (!DXVA_CONTEXT_VALID(avctx, ctx))\n\n return -1;\n\n assert(ctx_pic);\n\n\n\n fill_picture_parameters(avctx, ctx, s, &ctx_pic->pp);\n\n fill_quantization_matrices(avctx, ctx, s, &ctx_pic->qm);\n\n\n\n ctx_pic->slice_count = 0;\n\n ctx_pic->bitstream_size = 0;\n\n ctx_pic->bitstream = NULL;\n\n return 0;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_135", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,6 +10,6 @@\n \n \n \n+ return s->enabled_capabilities[MIGRATION_CAPABILITY_AUTO_CONVERGE];\n+\n+}", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "bool migrate_auto_converge(void)\n\n{\n\n MigrationState *s;\n\n\n\n s = migrate_get_current();\n\n\n\n return s->enabled_capabilities[MIGRATION_CAPABILITY_AUTO_CONVERGE];\n\n}\n"}} {"sample_id": "e95ead32efc48157de12e0a257ea1c52541a6ce1_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,6 +6,6 @@\n \n (void)local_set_xattr(NULL, NULL);\n \n+ return fsync(fd);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int local_fsync(FsContext *ctx, int fd)\n\n{\n\n if (0) /* Just to supress the warning. Will be removed in next patch. */\n\n (void)local_set_xattr(NULL, NULL);\n\n return fsync(fd);\n\n}\n"}} {"sample_id": "606ee8f5eadd79627216bbdde4da0337cb7d4360", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n {\n \n+ const char *protocol = qdict_get_str(qdict, \"protocol\");\n \n const char *hostname = qdict_get_str(qdict, \"hostname\");\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int client_migrate_info(Monitor *mon, const QDict *qdict,\n\n MonitorCompletion cb, void *opaque)\n\n{\n\n const char *protocol = qdict_get_str(qdict, \"protocol\");\n\n const char *hostname = qdict_get_str(qdict, \"hostname\");\n\n const char *subject = qdict_get_try_str(qdict, \"cert-subject\");\n\n int port = qdict_get_try_int(qdict, \"port\", -1);\n\n int tls_port = qdict_get_try_int(qdict, \"tls-port\", -1);\n\n Error *err;\n\n int ret;\n\n\n\n if (strcmp(protocol, \"spice\") == 0) {\n\n if (!qemu_using_spice(&err)) {\n\n qerror_report_err(err);\n\n return -1;\n\n }\n\n\n\n if (port == -1 && tls_port == -1) {\n\n qerror_report(QERR_MISSING_PARAMETER, \"port/tls-port\");\n\n return -1;\n\n }\n\n\n\n ret = qemu_spice_migrate_info(hostname, port, tls_port, subject,\n\n cb, opaque);\n\n if (ret != 0) {\n\n qerror_report(QERR_UNDEFINED_ERROR);\n\n return -1;\n\n }\n\n return 0;\n\n }\n\n\n\n qerror_report(QERR_INVALID_PARAMETER, \"protocol\");\n\n return -1;\n\n}\n"}} {"sample_id": "28f9ab7029bd1a02f659995919f899f84ee7361b_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,10 +20,10 @@\n \n dest[6] = av_clip_uint8(dest[6] + dc);\n \n+ dest[7] = av_clip_uint8(dest[7] + dc);\n+\n+ dest += line_size;\n+\n+ }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_vp3_idct_dc_add_c(uint8_t *dest/*align 8*/, int line_size, const DCTELEM *block/*align 16*/){\n\n int i, dc = (block[0] + 15) >> 5;\n\n\n\n for(i = 0; i < 8; i++){\n\n dest[0] = av_clip_uint8(dest[0] + dc);\n\n dest[1] = av_clip_uint8(dest[1] + dc);\n\n dest[2] = av_clip_uint8(dest[2] + dc);\n\n dest[3] = av_clip_uint8(dest[3] + dc);\n\n dest[4] = av_clip_uint8(dest[4] + dc);\n\n dest[5] = av_clip_uint8(dest[5] + dc);\n\n dest[6] = av_clip_uint8(dest[6] + dc);\n\n dest[7] = av_clip_uint8(dest[7] + dc);\n\n dest += line_size;\n\n }\n\n}\n"}} {"sample_id": "becf8217deb2afc347d5172d9f30c8a8964b8b27_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n \n \n+ DPRINTF(\"%s: trans_exc_code=%016\" PRIx64 \"\\n\", __func__, tec);\n+\n+\n+\n+ if (!exc) {\n \n return;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void trigger_page_fault(CPUS390XState *env, target_ulong vaddr,\n\n uint32_t type, uint64_t asc, int rw, bool exc)\n\n{\n\n int ilen = ILEN_LATER;\n\n uint64_t tec;\n\n\n\n tec = vaddr | (rw == MMU_DATA_STORE ? FS_WRITE : FS_READ) | asc >> 46;\n\n\n\n DPRINTF(\"%s: trans_exc_code=%016\" PRIx64 \"\\n\", __func__, tec);\n\n\n\n if (!exc) {\n\n return;\n\n }\n\n\n\n /* Code accesses have an undefined ilc. */\n\n if (rw == MMU_INST_FETCH) {\n\n ilen = 2;\n\n }\n\n\n\n trigger_access_exception(env, type, ilen, tec);\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_110", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n RDMALocalBlock *block = &(rdma->local_ram_blocks.block[index]);\n \n+\n+\n+ if (!test_and_set_bit(chunk, block->unregister_bitmap)) {\n+\n+ DDPRINTF(\"Appending unregister chunk %\" PRIu64\n \n \" at position %d\\n\", chunk, rdma->unregister_next);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void qemu_rdma_signal_unregister(RDMAContext *rdma, uint64_t index,\n\n uint64_t chunk, uint64_t wr_id)\n\n{\n\n if (rdma->unregistrations[rdma->unregister_next] != 0) {\n\n fprintf(stderr, \"rdma migration: queue is full!\\n\");\n\n } else {\n\n RDMALocalBlock *block = &(rdma->local_ram_blocks.block[index]);\n\n\n\n if (!test_and_set_bit(chunk, block->unregister_bitmap)) {\n\n DDPRINTF(\"Appending unregister chunk %\" PRIu64\n\n \" at position %d\\n\", chunk, rdma->unregister_next);\n\n\n\n rdma->unregistrations[rdma->unregister_next++] =\n\n qemu_rdma_make_wrid(wr_id, index, chunk);\n\n\n\n if (rdma->unregister_next == RDMA_SIGNALED_SEND_MAX) {\n\n rdma->unregister_next = 0;\n\n }\n\n } else {\n\n DDPRINTF(\"Unregister chunk %\" PRIu64 \" already in queue.\\n\",\n\n chunk);\n\n }\n\n }\n\n}\n"}} {"sample_id": "5cb9b56acfc0b50acf7ccd2d044ab4991c47fdde_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+static int parse_bit(DeviceState *dev, Property *prop, const char *str)\n+\n+{\n+\n+ if (!strcasecmp(str, \"on\"))\n \n bit_prop_set(dev, prop, true);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int parse_bit(DeviceState *dev, Property *prop, const char *str)\n\n{\n\n if (!strcasecmp(str, \"on\"))\n\n bit_prop_set(dev, prop, true);\n\n else if (!strcasecmp(str, \"off\"))\n\n bit_prop_set(dev, prop, false);\n\n else\n\n return -EINVAL;\n\n return 0;\n\n}\n"}} {"sample_id": "6886867e9880830d735d8ae6f6cc63ed9eb2be0c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n MemoryRegion *mr;\n \n+ hwaddr l = 4;\n+\n+ hwaddr addr1;\n+\n+\n \n mr = address_space_translate(as, addr, &addr1, &l,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void stl_phys_notdirty(AddressSpace *as, hwaddr addr, uint32_t val)\n\n{\n\n uint8_t *ptr;\n\n MemoryRegion *mr;\n\n hwaddr l = 4;\n\n hwaddr addr1;\n\n\n\n mr = address_space_translate(as, addr, &addr1, &l,\n\n true);\n\n if (l < 4 || !memory_access_is_direct(mr, true)) {\n\n io_mem_write(mr, addr1, val, 4);\n\n } else {\n\n addr1 += memory_region_get_ram_addr(mr) & TARGET_PAGE_MASK;\n\n ptr = qemu_get_ram_ptr(addr1);\n\n stl_p(ptr, val);\n\n\n\n if (unlikely(in_migration)) {\n\n if (cpu_physical_memory_is_clean(addr1)) {\n\n /* invalidate code */\n\n tb_invalidate_phys_page_range(addr1, addr1 + 4, 0);\n\n /* set dirty bit */\n\n cpu_physical_memory_set_dirty_flag(addr1,\n\n DIRTY_MEMORY_MIGRATION);\n\n cpu_physical_memory_set_dirty_flag(addr1, DIRTY_MEMORY_VGA);\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "b18a0cc781b791912549504ca8a257f35a151c5e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n void ff_ivi_output_plane(IVIPlaneDesc *plane, uint8_t *dst, int dst_pitch)\n+{\n+ int x, y;\n+ const int16_t *src = plane->bands[0].buf;\n uint32_t pitch = plane->bands[0].pitch;\n for (y = 0; y < plane->height; y++) {\n for (x = 0; x < plane->width; x++)", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void ff_ivi_output_plane(IVIPlaneDesc *plane, uint8_t *dst, int dst_pitch)\n{\n int x, y;\n const int16_t *src = plane->bands[0].buf;\n uint32_t pitch = plane->bands[0].pitch;\n for (y = 0; y < plane->height; y++) {\n for (x = 0; x < plane->width; x++)\n dst[x] = av_clip_uint8(src[x] + 128);\n src += pitch;\n dst += dst_pitch;\n }\n}"}} {"sample_id": "fedf0d35aafc4f1f1e5f6dbc80cb23ae1ae49f0b_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n if (!isatty(1)) {\n \n fprintf(stderr, \"We need a terminal output\\n\");\n+\n exit(1);\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void curses_display_init(DisplayState *ds, int full_screen)\n\n{\n\n#ifndef _WIN32\n\n if (!isatty(1)) {\n\n fprintf(stderr, \"We need a terminal output\\n\");\n\n exit(1);\n\n }\n\n#endif\n\n\n\n curses_setup();\n\n curses_keyboard_setup();\n\n atexit(curses_atexit);\n\n\n\n curses_winch_init();\n\n\n\n dcl = (DisplayChangeListener *) g_malloc0(sizeof(DisplayChangeListener));\n\n dcl->ops = &dcl_ops;\n\n register_displaychangelistener(dcl);\n\n\n\n invalidate = 1;\n\n}\n"}} {"sample_id": "f2917853f715b0ef55df29eb2ffea29dc69ce814", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void parse_header_digest(struct iscsi_context *iscsi, const char *target)\n \n {\n \n@@ -26,7 +26,7 @@\n \n opts = QTAILQ_FIRST(&list->head);\n \n+ if (!opts) {\n \n return;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void parse_header_digest(struct iscsi_context *iscsi, const char *target)\n\n{\n\n QemuOptsList *list;\n\n QemuOpts *opts;\n\n const char *digest = NULL;\n\n\n\n list = qemu_find_opts(\"iscsi\");\n\n if (!list) {\n\n return;\n\n }\n\n\n\n opts = qemu_opts_find(list, target);\n\n if (opts == NULL) {\n\n opts = QTAILQ_FIRST(&list->head);\n\n if (!opts) {\n\n return;\n\n }\n\n }\n\n\n\n digest = qemu_opt_get(opts, \"header-digest\");\n\n if (!digest) {\n\n return;\n\n }\n\n\n\n if (!strcmp(digest, \"CRC32C\")) {\n\n iscsi_set_header_digest(iscsi, ISCSI_HEADER_DIGEST_CRC32C);\n\n } else if (!strcmp(digest, \"NONE\")) {\n\n iscsi_set_header_digest(iscsi, ISCSI_HEADER_DIGEST_NONE);\n\n } else if (!strcmp(digest, \"CRC32C-NONE\")) {\n\n iscsi_set_header_digest(iscsi, ISCSI_HEADER_DIGEST_CRC32C_NONE);\n\n } else if (!strcmp(digest, \"NONE-CRC32C\")) {\n\n iscsi_set_header_digest(iscsi, ISCSI_HEADER_DIGEST_NONE_CRC32C);\n\n } else {\n\n error_report(\"Invalid header-digest setting : %s\", digest);\n\n }\n\n}\n"}} {"sample_id": "10bbf6cf622f8a954c6cc694ca07c24f989c99af", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n int16_t quant_table[MAX_CONTEXT_INPUTS][256])\n \n+{\n \n int i;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int read_quant_tables(RangeCoder *c,\n\n int16_t quant_table[MAX_CONTEXT_INPUTS][256])\n\n{\n\n int i;\n\n int context_count = 1;\n\n\n\n for (i = 0; i < 5; i++) {\n\n context_count *= read_quant_table(c, quant_table[i], context_count);\n\n if (context_count > 32768U) {\n\n return AVERROR_INVALIDDATA;\n\n }\n\n }\n\n return (context_count + 1) / 2;\n\n}\n"}} {"sample_id": "ca32f7f2083f9ededd1d9964ed065e0ad07a01e0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;\n \n \n+\n+ block[0] += 1<<(shift-1);\n+\n+\n+\n for(i=0; i<4; i++){\n \n const int z0= block[0 + block_stride*i] + block[2 + block_stride*i];", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_always_inline void idct_internal(uint8_t *dst, DCTELEM *block, int stride, int block_stride, int shift, int add){\n\n int i;\n\n uint8_t *cm = ff_cropTbl + MAX_NEG_CROP;\n\n\n\n block[0] += 1<<(shift-1);\n\n\n\n for(i=0; i<4; i++){\n\n const int z0= block[0 + block_stride*i] + block[2 + block_stride*i];\n\n const int z1= block[0 + block_stride*i] - block[2 + block_stride*i];\n\n const int z2= (block[1 + block_stride*i]>>1) - block[3 + block_stride*i];\n\n const int z3= block[1 + block_stride*i] + (block[3 + block_stride*i]>>1);\n\n\n\n block[0 + block_stride*i]= z0 + z3;\n\n block[1 + block_stride*i]= z1 + z2;\n\n block[2 + block_stride*i]= z1 - z2;\n\n block[3 + block_stride*i]= z0 - z3;\n\n }\n\n\n\n for(i=0; i<4; i++){\n\n const int z0= block[i + block_stride*0] + block[i + block_stride*2];\n\n const int z1= block[i + block_stride*0] - block[i + block_stride*2];\n\n const int z2= (block[i + block_stride*1]>>1) - block[i + block_stride*3];\n\n const int z3= block[i + block_stride*1] + (block[i + block_stride*3]>>1);\n\n\n\n dst[i + 0*stride]= cm[ add*dst[i + 0*stride] + ((z0 + z3) >> shift) ];\n\n dst[i + 1*stride]= cm[ add*dst[i + 1*stride] + ((z1 + z2) >> shift) ];\n\n dst[i + 2*stride]= cm[ add*dst[i + 2*stride] + ((z1 - z2) >> shift) ];\n\n dst[i + 3*stride]= cm[ add*dst[i + 3*stride] + ((z0 - z3) >> shift) ];\n\n }\n\n}\n"}} {"sample_id": "1acd7d594c15aa491729c837ad3519d3469e620a_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n pix -= stride;\n \n+ for(i=0; i<4; i++){\n+\n+ pixel v = pix[0];\n+\n+ pix[1*stride]= v += block[0];\n \n pix[2*stride]= v += block[4];\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void FUNCC(pred4x4_vertical_add)(uint8_t *_pix, const int16_t *_block,\n\n ptrdiff_t stride)\n\n{\n\n int i;\n\n pixel *pix = (pixel*)_pix;\n\n const dctcoef *block = (const dctcoef*)_block;\n\n stride >>= sizeof(pixel)-1;\n\n pix -= stride;\n\n for(i=0; i<4; i++){\n\n pixel v = pix[0];\n\n pix[1*stride]= v += block[0];\n\n pix[2*stride]= v += block[4];\n\n pix[3*stride]= v += block[8];\n\n pix[4*stride]= v + block[12];\n\n pix++;\n\n block++;\n\n }\n\n}\n"}} {"sample_id": "0b8b8753e4d94901627b3e86431230f2319215c4_45", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n+void qemu_coroutine_enter(Coroutine *co, void *opaque)\n \n {\n+\n Coroutine *self = qemu_coroutine_self();\n \n CoroutineAction ret;\n \n \n+\n trace_qemu_coroutine_enter(self, co, opaque);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void qemu_coroutine_enter(Coroutine *co, void *opaque)\n\n{\n\n Coroutine *self = qemu_coroutine_self();\n\n CoroutineAction ret;\n\n\n\n trace_qemu_coroutine_enter(self, co, opaque);\n\n\n\n if (co->caller) {\n\n fprintf(stderr, \"Co-routine re-entered recursively\\n\");\n\n abort();\n\n }\n\n\n\n co->caller = self;\n\n co->entry_arg = opaque;\n\n ret = qemu_coroutine_switch(self, co, COROUTINE_ENTER);\n\n\n\n qemu_co_queue_run_restart(co);\n\n\n\n switch (ret) {\n\n case COROUTINE_YIELD:\n\n return;\n\n case COROUTINE_TERMINATE:\n\n trace_qemu_coroutine_terminate(co);\n\n coroutine_delete(co);\n\n return;\n\n default:\n\n abort();\n\n }\n\n}\n"}} {"sample_id": "fdda170e50b8af062cf5741e12c4fb5e57a2eacf", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void vmxnet3_complete_packet(VMXNET3State *s, int qidx, uint32_t tx_ridx)\n \n {\n+\n+ struct Vmxnet3_TxCompDesc txcq_descr;\n+\n+ PCIDevice *d = PCI_DEVICE(s);\n+\n \n \n VMXNET3_RING_DUMP(VMW_RIPRN, \"TXC\", qidx, &s->txq_descr[qidx].comp_ring);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void vmxnet3_complete_packet(VMXNET3State *s, int qidx, uint32_t tx_ridx)\n\n{\n\n struct Vmxnet3_TxCompDesc txcq_descr;\n\n PCIDevice *d = PCI_DEVICE(s);\n\n\n\n VMXNET3_RING_DUMP(VMW_RIPRN, \"TXC\", qidx, &s->txq_descr[qidx].comp_ring);\n\n\n\n\n txcq_descr.txdIdx = tx_ridx;\n\n txcq_descr.gen = vmxnet3_ring_curr_gen(&s->txq_descr[qidx].comp_ring);\n\n\n\n vmxnet3_ring_write_curr_cell(d, &s->txq_descr[qidx].comp_ring, &txcq_descr);\n\n\n\n /* Flush changes in TX descriptor before changing the counter value */\n\n smp_wmb();\n\n\n\n vmxnet3_inc_tx_completion_counter(s, qidx);\n\n vmxnet3_trigger_interrupt(s, s->txq_descr[qidx].intr_idx);\n\n}"}} {"sample_id": "d1adad3cca407f493c3637e20ecd4f7124e69212_17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n YSCALEYUV2YV12X_ACCURATE( \"0\", CHR_MMX_FILTER_OFFSET, uDest, chrDstW)\n \n YSCALEYUV2YV12X_ACCURATE(AV_STRINGIFY(VOF), CHR_MMX_FILTER_OFFSET, vDest, chrDstW)\n+\n+ }\n+\n+ if (CONFIG_SWSCALE_ALPHA && aDest) {\n+\n YSCALEYUV2YV12X_ACCURATE( \"0\", ALP_MMX_FILTER_OFFSET, aDest, dstW)\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void RENAME(yuv2yuvX)(SwsContext *c, const int16_t *lumFilter, const int16_t **lumSrc, int lumFilterSize,\n\n const int16_t *chrFilter, const int16_t **chrSrc, int chrFilterSize, const int16_t **alpSrc,\n\n uint8_t *dest, uint8_t *uDest, uint8_t *vDest, uint8_t *aDest, long dstW, long chrDstW)\n\n{\n\n#if COMPILE_TEMPLATE_MMX\n\n if(!(c->flags & SWS_BITEXACT)) {\n\n if (c->flags & SWS_ACCURATE_RND) {\n\n if (uDest) {\n\n YSCALEYUV2YV12X_ACCURATE( \"0\", CHR_MMX_FILTER_OFFSET, uDest, chrDstW)\n\n YSCALEYUV2YV12X_ACCURATE(AV_STRINGIFY(VOF), CHR_MMX_FILTER_OFFSET, vDest, chrDstW)\n\n }\n\n if (CONFIG_SWSCALE_ALPHA && aDest) {\n\n YSCALEYUV2YV12X_ACCURATE( \"0\", ALP_MMX_FILTER_OFFSET, aDest, dstW)\n\n }\n\n\n\n YSCALEYUV2YV12X_ACCURATE(\"0\", LUM_MMX_FILTER_OFFSET, dest, dstW)\n\n } else {\n\n if (uDest) {\n\n YSCALEYUV2YV12X( \"0\", CHR_MMX_FILTER_OFFSET, uDest, chrDstW)\n\n YSCALEYUV2YV12X(AV_STRINGIFY(VOF), CHR_MMX_FILTER_OFFSET, vDest, chrDstW)\n\n }\n\n if (CONFIG_SWSCALE_ALPHA && aDest) {\n\n YSCALEYUV2YV12X( \"0\", ALP_MMX_FILTER_OFFSET, aDest, dstW)\n\n }\n\n\n\n YSCALEYUV2YV12X(\"0\", LUM_MMX_FILTER_OFFSET, dest, dstW)\n\n }\n\n return;\n\n }\n\n#endif\n\n#if COMPILE_TEMPLATE_ALTIVEC\n\n yuv2yuvX_altivec_real(lumFilter, lumSrc, lumFilterSize,\n\n chrFilter, chrSrc, chrFilterSize,\n\n dest, uDest, vDest, dstW, chrDstW);\n\n#else //COMPILE_TEMPLATE_ALTIVEC\n\n yuv2yuvXinC(lumFilter, lumSrc, lumFilterSize,\n\n chrFilter, chrSrc, chrFilterSize,\n\n alpSrc, dest, uDest, vDest, aDest, dstW, chrDstW);\n\n#endif //!COMPILE_TEMPLATE_ALTIVEC\n\n}\n"}} {"sample_id": "42a268c241183877192c376d03bd9b6d527407c7_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n if (cond == TCG_COND_ALWAYS) {\n \n tcg_gen_br(label);\n+\n+ } else if (cond != TCG_COND_NEVER) {\n+\n tcg_gen_op4ii_i32(INDEX_op_brcond_i32, arg1, arg2, cond, label);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void tcg_gen_brcond_i32(TCGCond cond, TCGv_i32 arg1, TCGv_i32 arg2, int label)\n\n{\n\n if (cond == TCG_COND_ALWAYS) {\n\n tcg_gen_br(label);\n\n } else if (cond != TCG_COND_NEVER) {\n\n tcg_gen_op4ii_i32(INDEX_op_brcond_i32, arg1, arg2, cond, label);\n\n }\n\n}\n"}} {"sample_id": "b7e7ee6231bc1f3608ed4005c3e7550ec4815296", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void copy_video_props(AVFilterBufferRefVideoProps *dst, AVFilterBufferRefVideoProps *src) {\n \n *dst = *src;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void copy_video_props(AVFilterBufferRefVideoProps *dst, AVFilterBufferRefVideoProps *src) {\n\n *dst = *src;\n\n if (src->qp_table) {\n\n int qsize = src->qp_table_size;\n\n dst->qp_table = av_malloc(qsize);\n\n memcpy(dst->qp_table, src->qp_table, qsize);\n\n }\n\n}\n"}} {"sample_id": "068abdc8a57023eeafe1025b964a50f8a39929b4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n int ppc_find_by_name (const unsigned char *name, ppc_def_t **def)\n+\n {\n \n+ int i, ret;\n \n \n \n+ ret = -1;\n \n *def = NULL;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int ppc_find_by_name (const unsigned char *name, ppc_def_t **def)\n\n{\n\n int i, ret;\n\n\n\n ret = -1;\n\n *def = NULL;\n\n for (i = 0; strcmp(ppc_defs[i].name, \"default\") != 0; i++) {\n\n if (strcasecmp(name, ppc_defs[i].name) == 0) {\n\n *def = &ppc_defs[i];\n\n ret = 0;\n\n break;\n\n }\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "fb0c43f34eed8b18678c6e1f481d8564b35c99ed", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n static coroutine_fn void test_multi_co_schedule_entry(void *opaque)\n \n+{\n \n g_assert(to_schedule[id] == NULL);\n \n atomic_mb_set(&to_schedule[id], qemu_coroutine_self());\n+\n+\n \n while (!atomic_mb_read(&now_stopping)) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static coroutine_fn void test_multi_co_schedule_entry(void *opaque)\n\n{\n\n g_assert(to_schedule[id] == NULL);\n\n atomic_mb_set(&to_schedule[id], qemu_coroutine_self());\n\n\n\n while (!atomic_mb_read(&now_stopping)) {\n\n int n;\n\n\n\n n = g_test_rand_int_range(0, NUM_CONTEXTS);\n\n schedule_next(n);\n\n qemu_coroutine_yield();\n\n\n\n g_assert(to_schedule[id] == NULL);\n\n atomic_mb_set(&to_schedule[id], qemu_coroutine_self());\n\n }\n\n}\n"}} {"sample_id": "a2db2a1edd06a50b8a862c654cf993368cf9f1d9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n \n \n if (evtchn_fd != -1) {\n+\n+ CPUState *cpu_state;\n+\n+\n+\n DPRINTF(\"%s: Init cpu_by_vcpu_id\\n\", __func__);\n \n CPU_FOREACH(cpu_state) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void xen_main_loop_prepare(XenIOState *state)\n\n{\n\n int evtchn_fd = -1;\n\n\n\n if (state->xce_handle != XC_HANDLER_INITIAL_VALUE) {\n\n evtchn_fd = xc_evtchn_fd(state->xce_handle);\n\n }\n\n\n\n state->buffered_io_timer = timer_new_ms(QEMU_CLOCK_REALTIME, handle_buffered_io,\n\n state);\n\n\n\n if (evtchn_fd != -1) {\n\n CPUState *cpu_state;\n\n\n\n DPRINTF(\"%s: Init cpu_by_vcpu_id\\n\", __func__);\n\n CPU_FOREACH(cpu_state) {\n\n DPRINTF(\"%s: cpu_by_vcpu_id[%d]=%p\\n\",\n\n __func__, cpu_state->cpu_index, cpu_state);\n\n state->cpu_by_vcpu_id[cpu_state->cpu_index] = cpu_state;\n\n }\n\n qemu_set_fd_handler(evtchn_fd, cpu_handle_ioreq, NULL, state);\n\n }\n\n}\n"}} {"sample_id": "6ab3fc32ea640026726bc5f9f4db622d0954fb8a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n ssize_t slirp_send(struct socket *so, const void *buf, size_t len, int flags)\n \n+{\n \n if (so->s == -1 && so->extra) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "ssize_t slirp_send(struct socket *so, const void *buf, size_t len, int flags)\n\n{\n\n if (so->s == -1 && so->extra) {\n\n qemu_chr_fe_write(so->extra, buf, len);\n\n return len;\n\n }\n\n\n\n return send(so->s, buf, len, flags);\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n return memset(qemu_blockalign(bs, size), 0, size);\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void *qemu_blockalign0(BlockDriverState *bs, size_t size)\n\n{\n\n return memset(qemu_blockalign(bs, size), 0, size);\n\n}\n"}} {"sample_id": "cc6b8c4b612d239bef31a8115402b03453c2b4bc", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n AVFilterContext *ctx = inlink->dst;\n \n+ ShowInfoContext *showinfo = ctx->priv;\n+\n+ uint32_t plane_checksum[8] = {0}, checksum = 0;\n+\n+ char chlayout_str[128];\n \n int plane;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void filter_samples(AVFilterLink *inlink, AVFilterBufferRef *samplesref)\n\n{\n\n AVFilterContext *ctx = inlink->dst;\n\n ShowInfoContext *showinfo = ctx->priv;\n\n uint32_t plane_checksum[8] = {0}, checksum = 0;\n\n char chlayout_str[128];\n\n int plane;\n\n\n\n for (plane = 0; samplesref->data[plane] && plane < 8; plane++) {\n\n uint8_t *data = samplesref->data[plane];\n\n int linesize = samplesref->linesize[plane];\n\n\n\n plane_checksum[plane] = av_adler32_update(plane_checksum[plane],\n\n data, linesize);\n\n checksum = av_adler32_update(checksum, data, linesize);\n\n }\n\n\n\n av_get_channel_layout_string(chlayout_str, sizeof(chlayout_str), -1,\n\n samplesref->audio->channel_layout);\n\n\n\n av_log(ctx, AV_LOG_INFO,\n\n \"n:%d pts:%\"PRId64\" pts_time:%f pos:%\"PRId64\" \"\n\n \"fmt:%s chlayout:%s nb_samples:%d rate:%d planar:%d \"\n\n \"checksum:%u plane_checksum[%u %u %u %u %u %u %u %u]\\n\",\n\n showinfo->frame,\n\n samplesref->pts, samplesref->pts * av_q2d(inlink->time_base),\n\n samplesref->pos,\n\n av_get_sample_fmt_name(samplesref->format),\n\n chlayout_str,\n\n samplesref->audio->nb_samples,\n\n samplesref->audio->sample_rate,\n\n samplesref->audio->planar,\n\n checksum,\n\n plane_checksum[0], plane_checksum[1], plane_checksum[2], plane_checksum[3],\n\n plane_checksum[4], plane_checksum[5], plane_checksum[6], plane_checksum[7]);\n\n\n\n showinfo->frame++;\n\n\n\n avfilter_filter_samples(inlink->dst->outputs[0], samplesref);\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_42", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n QEMUFileSocket *s;\n \n+\n+\n+ if (qemu_file_mode_is_not_valid(mode)) {\n+\n+ return NULL;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "QEMUFile *qemu_fopen_socket(int fd, const char *mode)\n\n{\n\n QEMUFileSocket *s;\n\n\n\n if (qemu_file_mode_is_not_valid(mode)) {\n\n return NULL;\n\n }\n\n\n\n s = g_malloc0(sizeof(QEMUFileSocket));\n\n s->fd = fd;\n\n if (mode[0] == 'w') {\n\n qemu_set_block(s->fd);\n\n s->file = qemu_fopen_ops(s, &socket_write_ops);\n\n } else {\n\n s->file = qemu_fopen_ops(s, &socket_read_ops);\n\n }\n\n return s->file;\n\n}\n"}} {"sample_id": "47d4be12c3997343e436c6cca89aefbbbeb70863_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,8 +5,8 @@\n const char *str = \" xxxx \\t abc\";\n \n char f = 'X';\n+\n+ const char *endptr = &f;\n \n uint64_t res = 999;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_qemu_strtoull_invalid(void)\n\n{\n\n const char *str = \" xxxx \\t abc\";\n\n char f = 'X';\n\n const char *endptr = &f;\n\n uint64_t res = 999;\n\n int err;\n\n\n\n err = qemu_strtoull(str, &endptr, 0, &res);\n\n\n\n g_assert_cmpint(err, ==, 0);\n\n g_assert(endptr == str);\n\n}\n"}} {"sample_id": "4ce87ecf2a8a8a9348f9bdbb420f3bee92e6513f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+static int select_voice(cst_voice **voice, const char *voice_name, void *log_ctx)\n \n {\n \n int i;\n+\n+\n \n for (i = 0; i < FF_ARRAY_ELEMS(voice_entries); i++) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int select_voice(cst_voice **voice, const char *voice_name, void *log_ctx)\n\n{\n\n int i;\n\n\n\n for (i = 0; i < FF_ARRAY_ELEMS(voice_entries); i++) {\n\n struct voice_entry *entry = &voice_entries[i];\n\n if (!strcmp(entry->name, voice_name)) {\n\n *voice = entry->register_fn(NULL);\n\n if (!*voice) {\n\n av_log(log_ctx, AV_LOG_ERROR,\n\n \"Could not register voice '%s'\\n\", voice_name);\n\n return AVERROR_UNKNOWN;\n\n }\n\n return 0;\n\n }\n\n }\n\n\n\n av_log(log_ctx, AV_LOG_ERROR, \"Could not find voice '%s'\\n\", voice_name);\n\n av_log(log_ctx, AV_LOG_INFO, \"Choose between the voices: \");\n\n list_voices(log_ctx, \", \");\n\n\n\n return AVERROR(EINVAL);\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_27", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n static void test_bmdma_one_sector_short_prdt(void)\n \n+{\n \n QPCIDevice *dev;\n \n void *bmdma_base, *ide_base;\n \n+ uint8_t status;\n \n \n+\n /* Read 2 sectors but only give 1 sector in PRDT */\n \n PrdtEntry prdt[] = {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_bmdma_one_sector_short_prdt(void)\n\n{\n\n QPCIDevice *dev;\n\n void *bmdma_base, *ide_base;\n\n uint8_t status;\n\n\n\n /* Read 2 sectors but only give 1 sector in PRDT */\n\n PrdtEntry prdt[] = {\n\n {\n\n .addr = 0,\n\n .size = cpu_to_le32(0x200 | PRDT_EOT),\n\n },\n\n };\n\n\n\n dev = get_pci_device(&bmdma_base, &ide_base);\n\n\n\n /* Normal request */\n\n status = send_dma_request(CMD_READ_DMA, 0, 2,\n\n prdt, ARRAY_SIZE(prdt), NULL);\n\n g_assert_cmphex(status, ==, 0);\n\n assert_bit_clear(qpci_io_readb(dev, ide_base + reg_status), DF | ERR);\n\n\n\n /* Abort the request before it completes */\n\n status = send_dma_request(CMD_READ_DMA | CMDF_ABORT, 0, 2,\n\n prdt, ARRAY_SIZE(prdt), NULL);\n\n g_assert_cmphex(status, ==, 0);\n\n assert_bit_clear(qpci_io_readb(dev, ide_base + reg_status), DF | ERR);\n\n}\n"}} {"sample_id": "973945804d95878375b487c0c5c9b2556c5e4543_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n TCXState *s = opaque;\n \n uint32_t adsr, len;\n+\n+ int i;\n+\n+\n+\n if (!(addr & 4)) {\n \n s->tmpblit = val;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void tcx_rblit_writel(void *opaque, hwaddr addr,\n\n uint64_t val, unsigned size)\n\n{\n\n TCXState *s = opaque;\n\n uint32_t adsr, len;\n\n int i;\n\n\n\n if (!(addr & 4)) {\n\n s->tmpblit = val;\n\n } else {\n\n addr = (addr >> 3) & 0xfffff;\n\n adsr = val & 0xffffff;\n\n len = ((val >> 24) & 0x1f) + 1;\n\n if (adsr == 0xffffff) {\n\n memset(&s->vram[addr], s->tmpblit, len);\n\n if (s->depth == 24) {\n\n val = s->tmpblit & 0xffffff;\n\n val = cpu_to_be32(val);\n\n for (i = 0; i < len; i++) {\n\n s->vram24[addr + i] = val;\n\n s->cplane[addr + i] = val;\n\n }\n\n }\n\n } else {\n\n memcpy(&s->vram[addr], &s->vram[adsr], len);\n\n if (s->depth == 24) {\n\n memcpy(&s->vram24[addr], &s->vram24[adsr], len * 4);\n\n memcpy(&s->cplane[addr], &s->cplane[adsr], len * 4);\n\n }\n\n }\n\n memory_region_set_dirty(&s->vram_mem, addr, len);\n\n }\n\n}\n"}} {"sample_id": "6c2d1c32d084320081b0cd047f8cacd6e722d03a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n k->vendor_id = PCI_VENDOR_ID_NEC;\n \n k->device_id = PCI_DEVICE_ID_NEC_UPD720200;\n+\n+ k->class_id = PCI_CLASS_SERIAL_USB;\n+\n+ k->revision = 0x03;\n+\n k->is_express = 1;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void xhci_class_init(ObjectClass *klass, void *data)\n\n{\n\n PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);\n\n DeviceClass *dc = DEVICE_CLASS(klass);\n\n\n\n dc->vmsd = &vmstate_xhci;\n\n dc->props = xhci_properties;\n\n dc->reset = xhci_reset;\n\n k->init = usb_xhci_initfn;\n\n k->vendor_id = PCI_VENDOR_ID_NEC;\n\n k->device_id = PCI_DEVICE_ID_NEC_UPD720200;\n\n k->class_id = PCI_CLASS_SERIAL_USB;\n\n k->revision = 0x03;\n\n k->is_express = 1;\n\n\n}"}} {"sample_id": "7f526efd17973ec6d2204f7a47b6923e2be31363_23", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+void palette8tobgr15(const uint8_t *src, uint8_t *dst, unsigned num_pixels, const uint8_t *palette)\n+\n {\n \n \tunsigned i;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void palette8tobgr15(const uint8_t *src, uint8_t *dst, unsigned num_pixels, const uint8_t *palette)\n\n{\n\n\tunsigned i;\n\n\tfor(i=0; ivdev);\n+\n+ Error *err = NULL;\n+\n+\n \n virtio_net_set_netclient_name(&dev->vdev, qdev->id,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_ccw_net_realize(VirtioCcwDevice *ccw_dev, Error **errp)\n\n{\n\n DeviceState *qdev = DEVICE(ccw_dev);\n\n VirtIONetCcw *dev = VIRTIO_NET_CCW(ccw_dev);\n\n DeviceState *vdev = DEVICE(&dev->vdev);\n\n Error *err = NULL;\n\n\n\n virtio_net_set_netclient_name(&dev->vdev, qdev->id,\n\n object_get_typename(OBJECT(qdev)));\n\n qdev_set_parent_bus(vdev, BUS(&ccw_dev->bus));\n\n object_property_set_bool(OBJECT(vdev), true, \"realized\", &err);\n\n if (err) {\n\n error_propagate(errp, err);\n\n }\n\n}\n"}} {"sample_id": "a9fc37f6bc3f2ab90585cb16493da9f6dcfbfbcf_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,7 +16,7 @@\n \n if (!qobj) {\n \n+ return;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void qobject_input_type_number(Visitor *v, const char *name, double *obj,\n\n Error **errp)\n\n{\n\n QObjectInputVisitor *qiv = to_qiv(v);\n\n QObject *qobj = qobject_input_get_object(qiv, name, true, errp);\n\n QInt *qint;\n\n QFloat *qfloat;\n\n\n\n if (!qobj) {\n\n return;\n\n }\n\n qint = qobject_to_qint(qobj);\n\n if (qint) {\n\n *obj = qint_get_int(qobject_to_qint(qobj));\n\n return;\n\n }\n\n\n\n qfloat = qobject_to_qfloat(qobj);\n\n if (qfloat) {\n\n *obj = qfloat_get_double(qobject_to_qfloat(qobj));\n\n return;\n\n }\n\n\n\n error_setg(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : \"null\",\n\n \"number\");\n\n}\n"}} {"sample_id": "ad674e53b5cce265fadafbde2c6a4f190345cd00_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void kill_channel(DBDMA_channel *ch)\n+\n+{\n+\n+ DBDMA_DPRINTF(\"kill_channel\\n\");\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void kill_channel(DBDMA_channel *ch)\n\n{\n\n DBDMA_DPRINTF(\"kill_channel\\n\");\n\n\n\n ch->regs[DBDMA_STATUS] |= cpu_to_be32(DEAD);\n\n ch->regs[DBDMA_STATUS] &= cpu_to_be32(~ACTIVE);\n\n\n\n qemu_irq_raise(ch->irq);\n\n}\n"}} {"sample_id": "ac531cb6e542b1e61d668604adf9dc5306a948c0_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n obj = qdict_get(tests_dict, key);\n \n+ fail_unless(obj != NULL);\n+\n+\n+\n+ qi = qobject_to_qint(obj);\n \n fail_unless(qint_get_int(qi) == value);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "START_TEST(qdict_get_test)\n\n{\n\n QInt *qi;\n\n QObject *obj;\n\n const int value = -42;\n\n const char *key = \"test\";\n\n\n\n qdict_put(tests_dict, key, qint_from_int(value));\n\n\n\n obj = qdict_get(tests_dict, key);\n\n fail_unless(obj != NULL);\n\n\n\n qi = qobject_to_qint(obj);\n\n fail_unless(qint_get_int(qi) == value);\n\n}\n"}} {"sample_id": "f6774f905fb3cfdc319523ac640be30b14c1bc55", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n static void vc1_decode_skip_blocks(VC1Context *v)\n \n+{\n \n MpegEncContext *s = &v->s;\n \n \n \n if (!v->s.last_picture.f.data[0])\n+\n+ return;\n+\n \n \n ff_er_add_slice(&s->er, 0, s->start_mb_y, s->mb_width - 1, s->end_mb_y - 1, ER_MB_END);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void vc1_decode_skip_blocks(VC1Context *v)\n\n{\n\n MpegEncContext *s = &v->s;\n\n\n\n if (!v->s.last_picture.f.data[0])\n\n return;\n\n\n\n ff_er_add_slice(&s->er, 0, s->start_mb_y, s->mb_width - 1, s->end_mb_y - 1, ER_MB_END);\n\n s->first_slice_line = 1;\n\n for (s->mb_y = s->start_mb_y; s->mb_y < s->end_mb_y; s->mb_y++) {\n\n s->mb_x = 0;\n\n init_block_index(v);\n\n ff_update_block_index(s);\n\n memcpy(s->dest[0], s->last_picture.f.data[0] + s->mb_y * 16 * s->linesize, s->linesize * 16);\n\n memcpy(s->dest[1], s->last_picture.f.data[1] + s->mb_y * 8 * s->uvlinesize, s->uvlinesize * 8);\n\n memcpy(s->dest[2], s->last_picture.f.data[2] + s->mb_y * 8 * s->uvlinesize, s->uvlinesize * 8);\n\n ff_mpeg_draw_horiz_band(s, s->mb_y * 16, 16);\n\n s->first_slice_line = 0;\n\n }\n\n s->pict_type = AV_PICTURE_TYPE_P;\n\n}\n"}} {"sample_id": "d1b4259f1ab18af24e6a297edb6a8f71691f3256", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n k->query_guest_notifiers = virtio_ccw_query_guest_notifiers;\n \n k->set_guest_notifiers = virtio_ccw_set_guest_notifiers;\n+\n+ k->save_queue = virtio_ccw_save_queue;\n+\n+ k->load_queue = virtio_ccw_load_queue;\n+\n k->save_config = virtio_ccw_save_config;\n \n k->load_config = virtio_ccw_load_config;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_ccw_bus_class_init(ObjectClass *klass, void *data)\n\n{\n\n VirtioBusClass *k = VIRTIO_BUS_CLASS(klass);\n\n BusClass *bus_class = BUS_CLASS(klass);\n\n\n\n bus_class->max_dev = 1;\n\n k->notify = virtio_ccw_notify;\n\n k->vmstate_change = virtio_ccw_vmstate_change;\n\n k->query_guest_notifiers = virtio_ccw_query_guest_notifiers;\n\n k->set_guest_notifiers = virtio_ccw_set_guest_notifiers;\n\n k->save_queue = virtio_ccw_save_queue;\n\n k->load_queue = virtio_ccw_load_queue;\n\n k->save_config = virtio_ccw_save_config;\n\n k->load_config = virtio_ccw_load_config;\n\n k->device_plugged = virtio_ccw_device_plugged;\n\n k->post_plugged = virtio_ccw_post_plugged;\n\n k->device_unplugged = virtio_ccw_device_unplugged;\n\n k->ioeventfd_started = virtio_ccw_ioeventfd_started;\n\n k->ioeventfd_set_started = virtio_ccw_ioeventfd_set_started;\n\n k->ioeventfd_disabled = virtio_ccw_ioeventfd_disabled;\n\n k->ioeventfd_set_disabled = virtio_ccw_ioeventfd_set_disabled;\n\n k->ioeventfd_assign = virtio_ccw_ioeventfd_assign;\n\n}\n"}} {"sample_id": "2d1a35bef0ed96b3f23535e459c552414ccdbafd_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n bool memory_region_is_logging(MemoryRegion *mr)\n \n+{\n \n return mr->dirty_log_mask;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool memory_region_is_logging(MemoryRegion *mr)\n\n{\n\n return mr->dirty_log_mask;\n\n}\n"}} {"sample_id": "e01b444523e2b0c663b42b3e8f44ef48a6153051_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n if (prot & PAGE_EXEC) {\n \n+ ret = 0;\n+\n+ } else {\n+\n+ ret = -2;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ppc_hash32_check_prot(int prot, int rwx)\n\n{\n\n int ret;\n\n\n\n if (rwx == 2) {\n\n if (prot & PAGE_EXEC) {\n\n ret = 0;\n\n } else {\n\n ret = -2;\n\n }\n\n } else if (rwx) {\n\n if (prot & PAGE_WRITE) {\n\n ret = 0;\n\n } else {\n\n ret = -2;\n\n }\n\n } else {\n\n if (prot & PAGE_READ) {\n\n ret = 0;\n\n } else {\n\n ret = -2;\n\n }\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "27a69bb088bee6d4efea254659422fb9c751b3c7_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -28,10 +28,10 @@\n \n #else\n \n+ tcg_gen_mov_i32(cpu_gpr[rD(ctx->opcode)], cpu_gprh[rB(ctx->opcode)]);\n+\n+ tcg_gen_mov_i32(cpu_gprh[rD(ctx->opcode)], cpu_gprh[rA(ctx->opcode)]);\n+\n+#endif\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_evmergehi(DisasContext *ctx)\n\n{\n\n if (unlikely(!ctx->spe_enabled)) {\n\n gen_exception(ctx, POWERPC_EXCP_APU);\n\n return;\n\n }\n\n#if defined(TARGET_PPC64)\n\n TCGv t0 = tcg_temp_new();\n\n TCGv t1 = tcg_temp_new();\n\n tcg_gen_shri_tl(t0, cpu_gpr[rB(ctx->opcode)], 32);\n\n tcg_gen_andi_tl(t1, cpu_gpr[rA(ctx->opcode)], 0xFFFFFFFF0000000ULL);\n\n tcg_gen_or_tl(cpu_gpr[rD(ctx->opcode)], t0, t1);\n\n tcg_temp_free(t0);\n\n tcg_temp_free(t1);\n\n#else\n\n tcg_gen_mov_i32(cpu_gpr[rD(ctx->opcode)], cpu_gprh[rB(ctx->opcode)]);\n\n tcg_gen_mov_i32(cpu_gprh[rD(ctx->opcode)], cpu_gprh[rA(ctx->opcode)]);\n\n#endif\n\n}\n"}} {"sample_id": "d36c231f4b7386bd8230aa17d362b925aa419b2f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static inline uint16_t mipsdsp_trunc16_sat16_round(int32_t a,\n+\n+ CPUMIPSState *env)\n+\n+{\n \n int64_t temp;\n+\n \n \n temp = (int32_t)a + 0x00008000;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline uint16_t mipsdsp_trunc16_sat16_round(int32_t a,\n\n CPUMIPSState *env)\n\n{\n\n int64_t temp;\n\n\n\n temp = (int32_t)a + 0x00008000;\n\n\n\n if (a > (int)0x7fff8000) {\n\n temp = 0x7FFFFFFF;\n\n set_DSPControl_overflow_flag(1, 22, env);\n\n }\n\n\n\n return (temp >> 16) & 0xFFFF;\n\n}\n"}} {"sample_id": "5d7fd045cafeac1831c1999cb9e1251b7906c6b2_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+uint32_t HELPER(lcdbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)\n+\n {\n \n env->fregs[f1].d = float64_chs(env->fregs[f2].d);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint32_t HELPER(lcdbr)(CPUS390XState *env, uint32_t f1, uint32_t f2)\n\n{\n\n env->fregs[f1].d = float64_chs(env->fregs[f2].d);\n\n\n\n return set_cc_nz_f64(env->fregs[f1].d);\n\n}\n"}} {"sample_id": "0b8b8753e4d94901627b3e86431230f2319215c4_27", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n int i, ret = -ENOENT;\n \n \n+\n for (i = 0; i < BLKDBG__MAX; i++) {\n \n QLIST_FOREACH_SAFE(rule, &s->rules[i], next, next) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int blkdebug_debug_remove_breakpoint(BlockDriverState *bs,\n\n const char *tag)\n\n{\n\n BDRVBlkdebugState *s = bs->opaque;\n\n BlkdebugSuspendedReq *r, *r_next;\n\n BlkdebugRule *rule, *next;\n\n int i, ret = -ENOENT;\n\n\n\n for (i = 0; i < BLKDBG__MAX; i++) {\n\n QLIST_FOREACH_SAFE(rule, &s->rules[i], next, next) {\n\n if (rule->action == ACTION_SUSPEND &&\n\n !strcmp(rule->options.suspend.tag, tag)) {\n\n remove_rule(rule);\n\n ret = 0;\n\n }\n\n }\n\n }\n\n QLIST_FOREACH_SAFE(r, &s->suspended_reqs, next, r_next) {\n\n if (!strcmp(r->tag, tag)) {\n\n qemu_coroutine_enter(r->co, NULL);\n\n ret = 0;\n\n }\n\n }\n\n return ret;\n\n}\n"}} {"sample_id": "12a419dacb479d663f04e316f9997568ef326965_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n \n \n avpriv_set_pts_info(st, 64, s->framerate.den, s->framerate.num);\n+\n+\n+\n+ st->codec->width = s->width;\n+\n st->codec->height = s->height;\n \n st->codec->pix_fmt = ctx->iformat->raw_codec_id == AV_CODEC_ID_V210 ?", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int v210_read_header(AVFormatContext *ctx)\n\n{\n\n V210DemuxerContext *s = ctx->priv_data;\n\n AVStream *st;\n\n\n\n st = avformat_new_stream(ctx, NULL);\n\n if (!st)\n\n return AVERROR(ENOMEM);\n\n\n\n st->codec->codec_type = AVMEDIA_TYPE_VIDEO;\n\n\n\n st->codec->codec_id = ctx->iformat->raw_codec_id;\n\n\n\n avpriv_set_pts_info(st, 64, s->framerate.den, s->framerate.num);\n\n\n\n st->codec->width = s->width;\n\n st->codec->height = s->height;\n\n st->codec->pix_fmt = ctx->iformat->raw_codec_id == AV_CODEC_ID_V210 ?\n\n AV_PIX_FMT_YUV422P10 : AV_PIX_FMT_YUV422P16;\n\n st->codec->bit_rate = av_rescale_q(GET_PACKET_SIZE(s->width, s->height),\n\n (AVRational){8,1}, st->time_base);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "66dc50f7057b9a0191f54e55764412202306858d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,26 +1,26 @@\n+int css_do_rsch(SubchDev *sch)\n \n {\n+\n SCSW *s = &sch->curr_status.scsw;\n+\n+ PMCW *p = &sch->curr_status.pmcw;\n \n int ret;\n+\n \n \n if (~(p->flags) & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA)) {\n+\n ret = -ENODEV;\n \n goto out;\n \n }\n \n+\n+\n+ if (s->ctrl & SCSW_STCTL_STATUS_PEND) {\n \n ret = -EINPROGRESS;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int css_do_rsch(SubchDev *sch)\n\n{\n\n SCSW *s = &sch->curr_status.scsw;\n\n PMCW *p = &sch->curr_status.pmcw;\n\n int ret;\n\n\n\n if (~(p->flags) & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA)) {\n\n ret = -ENODEV;\n\n goto out;\n\n }\n\n\n\n if (s->ctrl & SCSW_STCTL_STATUS_PEND) {\n\n ret = -EINPROGRESS;\n\n goto out;\n\n }\n\n\n\n if (((s->ctrl & SCSW_CTRL_MASK_FCTL) != SCSW_FCTL_START_FUNC) ||\n\n (s->ctrl & SCSW_ACTL_RESUME_PEND) ||\n\n (!(s->ctrl & SCSW_ACTL_SUSP))) {\n\n ret = -EINVAL;\n\n goto out;\n\n }\n\n\n\n /* If monitoring is active, update counter. */\n\n if (channel_subsys.chnmon_active) {\n\n css_update_chnmon(sch);\n\n }\n\n\n\n s->ctrl |= SCSW_ACTL_RESUME_PEND;\n\n do_subchannel_work(sch);\n\n ret = 0;\n\n\n\nout:\n\n return ret;\n\n}\n"}} {"sample_id": "eae63e3c156f784ee0612422f0c95131ea913c14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int get_qcc(Jpeg2000DecoderContext *s, int n, Jpeg2000QuantStyle *q,\n \n uint8_t *properties)\n+\n {\n \n int compno;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int get_qcc(Jpeg2000DecoderContext *s, int n, Jpeg2000QuantStyle *q,\n\n uint8_t *properties)\n\n{\n\n int compno;\n\n\n\n if (bytestream2_get_bytes_left(&s->g) < 1)\n\n return AVERROR_INVALIDDATA;\n\n\n\n compno = bytestream2_get_byteu(&s->g);\n\n properties[compno] |= HAD_QCC;\n\n return get_qcx(s, n - 1, q + compno);\n\n}\n"}} {"sample_id": "4083733db5e4120939acee57019ff52db1f45b9d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,11 +10,11 @@\n \n if (s->text_x[0] <= s->text_x[1]) {\n \n+ src = (s->y_base + s->text_y[0]) * s->width;\n+\n+ chardata += s->text_y[0] * s->width;\n+\n+ for (i = s->text_y[0]; i <= s->text_y[1]; i ++)\n \n for (j = 0; j < s->width; j ++, src ++)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void text_console_update(void *opaque, console_ch_t *chardata)\n\n{\n\n QemuConsole *s = (QemuConsole *) opaque;\n\n int i, j, src;\n\n\n\n if (s->text_x[0] <= s->text_x[1]) {\n\n src = (s->y_base + s->text_y[0]) * s->width;\n\n chardata += s->text_y[0] * s->width;\n\n for (i = s->text_y[0]; i <= s->text_y[1]; i ++)\n\n for (j = 0; j < s->width; j ++, src ++)\n\n console_write_ch(chardata ++, s->cells[src].ch |\n\n (s->cells[src].t_attrib.fgcol << 12) |\n\n (s->cells[src].t_attrib.bgcol << 8) |\n\n (s->cells[src].t_attrib.bold << 21));\n\n dpy_text_update(s, s->text_x[0], s->text_y[0],\n\n s->text_x[1] - s->text_x[0], i - s->text_y[0]);\n\n s->text_x[0] = s->width;\n\n s->text_y[0] = s->height;\n\n s->text_x[1] = 0;\n\n s->text_y[1] = 0;\n\n }\n\n if (s->cursor_invalidate) {\n\n dpy_text_cursor(s, s->x, s->y);\n\n s->cursor_invalidate = 0;\n\n }\n\n}\n"}} {"sample_id": "aab99135b63522267c6fdae04712cb2f02c8c7de", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n * detach immediately. Note that there is a small race window\n * just before, or during, configuration, which is this context\n * refers mainly to fetching the device tree via RTAS.\n+ * During this window the device access will be arbitrated by\n+ * associated DRC, which will simply fail the RTAS calls as invalid.\n+ * This is recoverable within guest and current implementations of\n+ * drmgr should be able to cope.\n+ */\n if (!drc->signalled && !drc->configured) {\n /* if the guest hasn't seen the device we can't rely on it to\n * set it back to an isolated state via RTAS, so do it here manually", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void detach(sPAPRDRConnector *drc, DeviceState *d,\n spapr_drc_detach_cb *detach_cb,\n void *detach_cb_opaque, Error **errp)\n{\n DPRINTFN(\"drc: %x, detach\", get_index(drc));\n drc->detach_cb = detach_cb;\n drc->detach_cb_opaque = detach_cb_opaque;\n /* if we've signalled device presence to the guest, or if the guest\n * has gone ahead and configured the device (via manually-executed\n * device add via drmgr in guest, namely), we need to wait\n * for the guest to quiesce the device before completing detach.\n * Otherwise, we can assume the guest hasn't seen it and complete the\n * detach immediately. Note that there is a small race window\n * just before, or during, configuration, which is this context\n * refers mainly to fetching the device tree via RTAS.\n * During this window the device access will be arbitrated by\n * associated DRC, which will simply fail the RTAS calls as invalid.\n * This is recoverable within guest and current implementations of\n * drmgr should be able to cope.\n */\n if (!drc->signalled && !drc->configured) {\n /* if the guest hasn't seen the device we can't rely on it to\n * set it back to an isolated state via RTAS, so do it here manually\n */\n drc->isolation_state = SPAPR_DR_ISOLATION_STATE_ISOLATED;\n if (drc->isolation_state != SPAPR_DR_ISOLATION_STATE_ISOLATED) {\n DPRINTFN(\"awaiting transition to isolated state before removal\");\n if (drc->type != SPAPR_DR_CONNECTOR_TYPE_PCI &&\n drc->allocation_state != SPAPR_DR_ALLOCATION_STATE_UNUSABLE) {\n DPRINTFN(\"awaiting transition to unusable state before removal\");\n drc->indicator_state = SPAPR_DR_INDICATOR_STATE_INACTIVE;\n if (drc->detach_cb) {\n drc->detach_cb(drc->dev, drc->detach_cb_opaque);\n drc->awaiting_release = false;\n g_free(drc->fdt);\n drc->fdt = NULL;\n drc->fdt_start_offset = 0;\n object_property_del(OBJECT(drc), \"device\", NULL);\n drc->dev = NULL;\n drc->detach_cb = NULL;\n drc->detach_cb_opaque = NULL;"}} {"sample_id": "6a9c4ef452c98060e919aa49db49c09ed8c37745", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n \n \n \n+ /* Tell KVM that we're in PAPR mode */\n+\n+ if (kvm_enabled()) {\n+\n+ kvmppc_set_papr(cpu);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void cpu_ppc_set_papr(PowerPCCPU *cpu)\n\n{\n\n CPUPPCState *env = &cpu->env;\n\n\n\n\n /* PAPR always has exception vectors in RAM not ROM. To ensure this,\n\n * MSR[IP] should never be set.\n\n *\n\n * We also disallow setting of MSR_HV\n\n */\n\n env->msr_mask &= ~((1ull << MSR_EP) | MSR_HVB);\n\n\n\n /* Set a full AMOR so guest can use the AMR as it sees fit */\n\n env->spr[SPR_AMOR] = amor->default_value = 0xffffffffffffffffull;\n\n\n\n /* Tell KVM that we're in PAPR mode */\n\n if (kvm_enabled()) {\n\n kvmppc_set_papr(cpu);\n\n }\n\n}"}} {"sample_id": "82613564cfae459796642b22fc0163927d7f49e0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -31,11 +31,11 @@\n ret = ff_rtmp_packet_write(rt->stream, &pkt, rt->chunk_size,\n \n rt->prev_pkt[1]);\n+\n+ ff_rtmp_packet_destroy(&pkt);\n+\n+\n+\n return ret;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int gen_check_bw(URLContext *s, RTMPContext *rt)\n\n{\n\n RTMPPacket pkt;\n\n uint8_t *p;\n\n int ret;\n\n\n\n if ((ret = ff_rtmp_packet_create(&pkt, RTMP_SYSTEM_CHANNEL, RTMP_PT_INVOKE,\n\n 0, 21)) < 0)\n\n return ret;\n\n\n\n p = pkt.data;\n\n ff_amf_write_string(&p, \"_checkbw\");\n\n ff_amf_write_number(&p, ++rt->nb_invokes);\n\n ff_amf_write_null(&p);\n\n\n\n ret = ff_rtmp_packet_write(rt->stream, &pkt, rt->chunk_size,\n\n rt->prev_pkt[1]);\n\n ff_rtmp_packet_destroy(&pkt);\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "ed8b5847e46c24d6e9c286892a00a34bee9b0835", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+Aml *aml_buffer(void)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "Aml *aml_buffer(void)\n\n{\n\n Aml *var = aml_bundle(0x11 /* BufferOp */, AML_BUFFER);\n\n return var;\n\n}\n"}} {"sample_id": "6502a14734e71b2f6dd079b0a1e546e6aa2d2f8d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n error_set(errp, QERR_KVM_MISSING_CAP, \"synchronous MMU\", \"balloon\");\n \n+ return;\n+\n+ }\n+\n+\n \n if (value <= 0) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void qmp_balloon(int64_t value, Error **errp)\n\n{\n\n if (kvm_enabled() && !kvm_has_sync_mmu()) {\n\n error_set(errp, QERR_KVM_MISSING_CAP, \"synchronous MMU\", \"balloon\");\n\n return;\n\n }\n\n\n\n if (value <= 0) {\n\n error_set(errp, QERR_INVALID_PARAMETER_VALUE, \"target\", \"a size\");\n\n return;\n\n }\n\n \n\n if (qemu_balloon(value) == 0) {\n\n error_set(errp, QERR_DEVICE_NOT_ACTIVE, \"balloon\");\n\n }\n\n}\n"}} {"sample_id": "5fb6c7a8b26eab1a22207d24b4784bd2b39ab54b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void vnc_client_error(VncState *vs)\n \n {\n+\n vnc_client_io_error(vs, -1, EINVAL);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vnc_client_error(VncState *vs)\n\n{\n\n vnc_client_io_error(vs, -1, EINVAL);\n\n}\n"}} {"sample_id": "891fb2cd4592b6fe76106a69e0ca40efbf82726a_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n USBDevice *dev = s->ports[port].dev;\n \n uint32_t *portsc = &s->portsc[port];\n+\n+ uint32_t orig;\n+\n+\n+\n if (s->companion_ports[port] == NULL)\n \n return;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void handle_port_owner_write(EHCIState *s, int port, uint32_t owner)\n\n{\n\n USBDevice *dev = s->ports[port].dev;\n\n uint32_t *portsc = &s->portsc[port];\n\n uint32_t orig;\n\n\n\n if (s->companion_ports[port] == NULL)\n\n return;\n\n\n\n owner = owner & PORTSC_POWNER;\n\n orig = *portsc & PORTSC_POWNER;\n\n\n\n if (!(owner ^ orig)) {\n\n return;\n\n }\n\n\n\n if (dev) {\n\n usb_attach(&s->ports[port], NULL);\n\n }\n\n\n\n *portsc &= ~PORTSC_POWNER;\n\n *portsc |= owner;\n\n\n\n if (dev) {\n\n usb_attach(&s->ports[port], dev);\n\n }\n\n}\n"}} {"sample_id": "6f600ab35424823fb682b5669241edcc66590a8d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,9 +23,9 @@\n av_freep(&avccontext->coded_frame);\n \n av_freep(&avccontext->extradata);\n+\n+\n+\n+ return 0;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int oggvorbis_encode_close(AVCodecContext *avccontext)\n\n{\n\n OggVorbisContext *context = avccontext->priv_data;\n\n/* ogg_packet op ; */\n\n\n\n vorbis_analysis_wrote(&context->vd, 0); /* notify vorbisenc this is EOF */\n\n\n\n vorbis_block_clear(&context->vb);\n\n vorbis_dsp_clear(&context->vd);\n\n vorbis_info_clear(&context->vi);\n\n\n\n av_freep(&avccontext->coded_frame);\n\n av_freep(&avccontext->extradata);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "f35e44e7645edbb08e35b111c10c2fc57e2905c7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n CPUAddressSpace *cpuas;\n \n+ AddressSpaceDispatch *d;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void tcg_commit(MemoryListener *listener)\n\n{\n\n CPUAddressSpace *cpuas;\n\n AddressSpaceDispatch *d;\n\n\n\n /* since each CPU stores ram addresses in its TLB cache, we must\n\n reset the modified entries */\n\n cpuas = container_of(listener, CPUAddressSpace, tcg_as_listener);\n\n cpu_reloading_memory_map();\n\n /* The CPU and TLB are protected by the iothread lock.\n\n * We reload the dispatch pointer now because cpu_reloading_memory_map()\n\n * may have split the RCU critical section.\n\n */\n\n d = atomic_rcu_read(&cpuas->as->dispatch);\n\n cpuas->memory_dispatch = d;\n\n tlb_flush(cpuas->cpu, 1);\n\n}\n"}} {"sample_id": "187337f8b0ec0813dd3876d1efe37d415fb81c2e_15", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n qemu_irq *qi;\n \n \n+\n s = (sp804_state *)qemu_mallocz(sizeof(sp804_state));\n \n qi = qemu_allocate_irqs(sp804_set_irq, s, 2);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void sp804_init(uint32_t base, qemu_irq irq)\n\n{\n\n int iomemtype;\n\n sp804_state *s;\n\n qemu_irq *qi;\n\n\n\n s = (sp804_state *)qemu_mallocz(sizeof(sp804_state));\n\n qi = qemu_allocate_irqs(sp804_set_irq, s, 2);\n\n s->base = base;\n\n s->irq = irq;\n\n /* ??? The timers are actually configurable between 32kHz and 1MHz, but\n\n we don't implement that. */\n\n s->timer[0] = arm_timer_init(1000000, qi[0]);\n\n s->timer[1] = arm_timer_init(1000000, qi[1]);\n\n iomemtype = cpu_register_io_memory(0, sp804_readfn,\n\n sp804_writefn, s);\n\n cpu_register_physical_memory(base, 0x00000fff, iomemtype);\n\n /* ??? Save/restore. */\n\n}\n"}} {"sample_id": "348295838384941d1e5420d10e57366c4e303d45_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,9 +2,9 @@\n \n {\n \n+ VirtIOBlockDataPlane *s = container_of(n, VirtIOBlockDataPlane,\n+\n+ insert_notifier);\n \n assert(s->conf->conf.blk == data);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void data_plane_blk_insert_notifier(Notifier *n, void *data)\n\n{\n\n VirtIOBlockDataPlane *s = container_of(n, VirtIOBlockDataPlane,\n\n insert_notifier);\n\n assert(s->conf->conf.blk == data);\n\n data_plane_set_up_op_blockers(s);\n\n}\n"}} {"sample_id": "fc85646ad495f3418042468da415af73a7a07334", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n avc->sample_rate = 48000;\n avc->sample_fmt = avc->request_sample_fmt == AV_SAMPLE_FMT_FLT ?\n AV_SAMPLE_FMT_FLT : AV_SAMPLE_FMT_S16;\n+ avc->channel_layout = avc->channels > 8 ? 0 :\n+ ff_vorbis_channel_layouts[avc->channels - 1];\n+ if (avc->extradata_size >= OPUS_HEAD_SIZE) {\n+ gain_db = sign_extend(AV_RL16(avc->extradata + 16), 16);\n+ channel_map = AV_RL8 (avc->extradata + 18);\n if (avc->extradata_size >= OPUS_HEAD_SIZE + 2 + avc->channels) {\n nb_streams = avc->extradata[OPUS_HEAD_SIZE + 0];\n nb_coupled = avc->extradata[OPUS_HEAD_SIZE + 1];", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static av_cold int libopus_decode_init(AVCodecContext *avc)\n{\n struct libopus_context *opus = avc->priv_data;\n int ret, channel_map = 0, gain_db = 0, nb_streams, nb_coupled;\n uint8_t mapping_arr[8] = { 0, 1 }, *mapping;\n avc->sample_rate = 48000;\n avc->sample_fmt = avc->request_sample_fmt == AV_SAMPLE_FMT_FLT ?\n AV_SAMPLE_FMT_FLT : AV_SAMPLE_FMT_S16;\n avc->channel_layout = avc->channels > 8 ? 0 :\n ff_vorbis_channel_layouts[avc->channels - 1];\n if (avc->extradata_size >= OPUS_HEAD_SIZE) {\n gain_db = sign_extend(AV_RL16(avc->extradata + 16), 16);\n channel_map = AV_RL8 (avc->extradata + 18);\n if (avc->extradata_size >= OPUS_HEAD_SIZE + 2 + avc->channels) {\n nb_streams = avc->extradata[OPUS_HEAD_SIZE + 0];\n nb_coupled = avc->extradata[OPUS_HEAD_SIZE + 1];\n if (nb_streams + nb_coupled != avc->channels)\n av_log(avc, AV_LOG_WARNING, \"Inconsistent channel mapping.\\n\");\n mapping = avc->extradata + OPUS_HEAD_SIZE + 2;\n } else {\n if (avc->channels > 2 || channel_map) {\n av_log(avc, AV_LOG_ERROR,\n \"No channel mapping for %d channels.\\n\", avc->channels);\n return AVERROR(EINVAL);\n nb_streams = 1;\n nb_coupled = avc->channels > 1;\n mapping = mapping_arr;\n if (avc->channels > 2 && avc->channels <= 8) {\n const uint8_t *vorbis_offset = ff_vorbis_channel_layout_offsets[avc->channels - 1];\n int ch;\n /* Remap channels from Vorbis order to libav order */\n for (ch = 0; ch < avc->channels; ch++)\n mapping_arr[ch] = mapping[vorbis_offset[ch]];\n mapping = mapping_arr;\n opus->dec = opus_multistream_decoder_create(avc->sample_rate, avc->channels,\n nb_streams, nb_coupled,\n mapping, &ret);\n if (!opus->dec) {\n av_log(avc, AV_LOG_ERROR, \"Unable to create decoder: %s\\n\",\n opus_strerror(ret));\n return ff_opus_error_to_averror(ret);\n ret = opus_multistream_decoder_ctl(opus->dec, OPUS_SET_GAIN(gain_db));\n if (ret != OPUS_OK)\n av_log(avc, AV_LOG_WARNING, \"Failed to set gain: %s\\n\",\n opus_strerror(ret));\n avc->delay = 3840; /* Decoder delay (in samples) at 48kHz */\n return 0;"}} {"sample_id": "b45c03f585ea9bb1af76c73e82195418c294919d_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static struct omap_mpuio_s *omap_mpuio_init(MemoryRegion *memory,\n+\n hwaddr base,\n \n qemu_irq kbd_int, qemu_irq gpio_int, qemu_irq wakeup,", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static struct omap_mpuio_s *omap_mpuio_init(MemoryRegion *memory,\n\n hwaddr base,\n\n qemu_irq kbd_int, qemu_irq gpio_int, qemu_irq wakeup,\n\n omap_clk clk)\n\n{\n\n struct omap_mpuio_s *s = (struct omap_mpuio_s *)\n\n g_malloc0(sizeof(struct omap_mpuio_s));\n\n\n\n s->irq = gpio_int;\n\n s->kbd_irq = kbd_int;\n\n s->wakeup = wakeup;\n\n s->in = qemu_allocate_irqs(omap_mpuio_set, s, 16);\n\n omap_mpuio_reset(s);\n\n\n\n memory_region_init_io(&s->iomem, NULL, &omap_mpuio_ops, s,\n\n \"omap-mpuio\", 0x800);\n\n memory_region_add_subregion(memory, base, &s->iomem);\n\n\n\n omap_clk_adduser(clk, qemu_allocate_irq(omap_mpuio_onoff, s, 0));\n\n\n\n return s;\n\n}\n"}} {"sample_id": "6e0d8677cb443e7408c0b7a25a93c6596d7fa380_20", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n } else\n \n+#endif\n+\n+ if (s->aflag) {\n+\n+ gen_op_addl_ESI_T0();\n \n } else {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_outs(DisasContext *s, int ot)\n\n{\n\n gen_string_movl_A0_ESI(s);\n\n gen_op_ld_T0_A0(ot + s->mem_index);\n\n\n\n gen_op_mov_TN_reg(OT_WORD, 1, R_EDX);\n\n tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[1]);\n\n tcg_gen_andi_i32(cpu_tmp2_i32, cpu_tmp2_i32, 0xffff);\n\n tcg_gen_trunc_tl_i32(cpu_tmp3_i32, cpu_T[0]);\n\n tcg_gen_helper_0_2(helper_out_func[ot], cpu_tmp2_i32, cpu_tmp3_i32);\n\n\n\n gen_op_movl_T0_Dshift[ot]();\n\n#ifdef TARGET_X86_64\n\n if (s->aflag == 2) {\n\n gen_op_addq_ESI_T0();\n\n } else\n\n#endif\n\n if (s->aflag) {\n\n gen_op_addl_ESI_T0();\n\n } else {\n\n gen_op_addw_ESI_T0();\n\n }\n\n}\n"}} {"sample_id": "6f2d8978728c48ca46f5c01835438508aace5c64_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void OPPROTO op_POWER_slq (void)\n+\n {\n \n uint32_t msk = -1, tmp;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void OPPROTO op_POWER_slq (void)\n\n{\n\n uint32_t msk = -1, tmp;\n\n\n\n msk = msk << (T1 & 0x1FUL);\n\n if (T1 & 0x20UL)\n\n msk = ~msk;\n\n T1 &= 0x1FUL;\n\n tmp = rotl32(T0, T1);\n\n T0 = tmp & msk;\n\n env->spr[SPR_MQ] = tmp;\n\n RETURN();\n\n}\n"}} {"sample_id": "ac4b32df71bd932838043a4838b86d11e169707f_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int vp8_decode_mb_row_sliced(AVCodecContext *avctx, void *tdata,\n \n int jobnr, int threadnr)\n \n@@ -6,10 +6,10 @@\n \n VP8Context *s = avctx->priv_data;\n \n+ VP8ThreadData *td = &s->thread_data[jobnr];\n \n+ VP8ThreadData *next_td = NULL, *prev_td = NULL;\n+\n VP8Frame *curframe = s->curframe;\n \n int mb_y, num_jobs = s->num_jobs;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int vp8_decode_mb_row_sliced(AVCodecContext *avctx, void *tdata,\n\n int jobnr, int threadnr)\n\n{\n\n VP8Context *s = avctx->priv_data;\n\n VP8ThreadData *td = &s->thread_data[jobnr];\n\n VP8ThreadData *next_td = NULL, *prev_td = NULL;\n\n VP8Frame *curframe = s->curframe;\n\n int mb_y, num_jobs = s->num_jobs;\n\n\n\n td->thread_nr = threadnr;\n\n for (mb_y = jobnr; mb_y < s->mb_height; mb_y += num_jobs) {\n\n if (mb_y >= s->mb_height)\n\n break;\n\n td->thread_mb_pos = mb_y << 16;\n\n vp8_decode_mb_row_no_filter(avctx, tdata, jobnr, threadnr);\n\n if (s->deblock_filter)\n\n vp8_filter_mb_row(avctx, tdata, jobnr, threadnr);\n\n update_pos(td, mb_y, INT_MAX & 0xFFFF);\n\n\n\n s->mv_min.y -= 64;\n\n s->mv_max.y -= 64;\n\n\n\n if (avctx->active_thread_type == FF_THREAD_FRAME)\n\n ff_thread_report_progress(&curframe->tf, mb_y, 0);\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "47d4be12c3997343e436c6cca89aefbbbeb70863_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n const char *str = \" \\t \";\n \n char f = 'X';\n+\n+ const char *endptr = &f;\n+\n unsigned long res = 999;\n \n int err;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_qemu_strtoul_whitespace(void)\n\n{\n\n const char *str = \" \\t \";\n\n char f = 'X';\n\n const char *endptr = &f;\n\n unsigned long res = 999;\n\n int err;\n\n\n\n err = qemu_strtoul(str, &endptr, 0, &res);\n\n\n\n g_assert_cmpint(err, ==, 0);\n\n g_assert_cmpint(res, ==, 0);\n\n g_assert(endptr == str);\n\n}\n"}} {"sample_id": "a5b8dd2ce83208cd7d6eb4562339ecf5aae13574_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void bochs_refresh_limits(BlockDriverState *bs, Error **errp)\n+\n {\n \n bs->request_alignment = BDRV_SECTOR_SIZE; /* No sub-sector I/O supported */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bochs_refresh_limits(BlockDriverState *bs, Error **errp)\n\n{\n\n bs->request_alignment = BDRV_SECTOR_SIZE; /* No sub-sector I/O supported */\n\n}\n"}} {"sample_id": "cf864569cd9134ee503ad9eb6be2881001c0ed80", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n if (vs->password) {\n \n g_free(vs->password);\n+\n+ vs->password = NULL;\n+\n+ }\n+\n vs->password = g_strdup(password);\n \n if (vs->auth == VNC_AUTH_NONE) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int vnc_display_password(DisplayState *ds, const char *password)\n\n{\n\n VncDisplay *vs = vnc_display;\n\n\n\n if (!vs) {\n\n return -EINVAL;\n\n }\n\n\n\n if (!password) {\n\n /* This is not the intention of this interface but err on the side\n\n of being safe */\n\n return vnc_display_disable_login(ds);\n\n }\n\n\n\n if (vs->password) {\n\n g_free(vs->password);\n\n vs->password = NULL;\n\n }\n\n vs->password = g_strdup(password);\n\n if (vs->auth == VNC_AUTH_NONE) {\n\n vs->auth = VNC_AUTH_VNC;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "bc7c08a2c375acb7ae4d433054415588b176d34c_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,11 +15,11 @@\n \n \n err = qemu_strtoull(str, &endptr, 0, &res);\n+\n+\n+\n+ g_assert_cmpint(err, ==, 0);\n+\n g_assert_cmpint(res, ==, 123);\n \n g_assert(endptr == str + 3);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_qemu_strtoull_trailing(void)\n\n{\n\n const char *str = \"123xxx\";\n\n char f = 'X';\n\n const char *endptr = &f;\n\n uint64_t res = 999;\n\n int err;\n\n\n\n err = qemu_strtoull(str, &endptr, 0, &res);\n\n\n\n g_assert_cmpint(err, ==, 0);\n\n g_assert_cmpint(res, ==, 123);\n\n g_assert(endptr == str + 3);\n\n}\n"}} {"sample_id": "2caf19e90f270abe1e80a3e85acaf0eb5c9d0aac_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -15,12 +15,12 @@\n dc0=dc1=dc2=0;\n \n for(i=0;i<4; i++){\n+\n+ dc0+= src[-1+i*stride] + src[i-stride];\n \n dc1+= src[4+i-stride];\n+\n+ dc2+= src[-1+(i+4)*stride];\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void FUNCC(pred8x8_dc)(uint8_t *_src, int stride){\n\n int i;\n\n int dc0, dc1, dc2;\n\n pixel4 dc0splat, dc1splat, dc2splat, dc3splat;\n\n pixel *src = (pixel*)_src;\n\n stride /= sizeof(pixel);\n\n\n\n dc0=dc1=dc2=0;\n\n for(i=0;i<4; i++){\n\n dc0+= src[-1+i*stride] + src[i-stride];\n\n dc1+= src[4+i-stride];\n\n dc2+= src[-1+(i+4)*stride];\n\n }\n\n dc0splat = PIXEL_SPLAT_X4((dc0 + 4)>>3);\n\n dc1splat = PIXEL_SPLAT_X4((dc1 + 2)>>2);\n\n dc2splat = PIXEL_SPLAT_X4((dc2 + 2)>>2);\n\n dc3splat = PIXEL_SPLAT_X4((dc1 + dc2 + 4)>>3);\n\n\n\n for(i=0; i<4; i++){\n\n ((pixel4*)(src+i*stride))[0]= dc0splat;\n\n ((pixel4*)(src+i*stride))[1]= dc1splat;\n\n }\n\n for(i=4; i<8; i++){\n\n ((pixel4*)(src+i*stride))[0]= dc2splat;\n\n ((pixel4*)(src+i*stride))[1]= dc3splat;\n\n }\n\n}\n"}} {"sample_id": "e3f5ec2b5e92706e3b807059f79b1fb5d936e567_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -43,9 +43,9 @@\n qemu_log(\"-net dump write error - stop dump\\n\");\n \n close(s->fd);\n+\n+ s->fd = -1;\n+\n+ }\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void dump_receive(void *opaque, const uint8_t *buf, size_t size)\n\n{\n\n DumpState *s = opaque;\n\n struct pcap_sf_pkthdr hdr;\n\n int64_t ts;\n\n int caplen;\n\n\n\n /* Early return in case of previous error. */\n\n if (s->fd < 0) {\n\n return;\n\n }\n\n\n\n ts = muldiv64(qemu_get_clock(vm_clock), 1000000, ticks_per_sec);\n\n caplen = size > s->pcap_caplen ? s->pcap_caplen : size;\n\n\n\n hdr.ts.tv_sec = ts / 1000000;\n\n hdr.ts.tv_usec = ts % 1000000;\n\n hdr.caplen = caplen;\n\n hdr.len = size;\n\n if (write(s->fd, &hdr, sizeof(hdr)) != sizeof(hdr) ||\n\n write(s->fd, buf, caplen) != caplen) {\n\n qemu_log(\"-net dump write error - stop dump\\n\");\n\n close(s->fd);\n\n s->fd = -1;\n\n }\n\n}\n"}} {"sample_id": "bdd81addf4033ce26e6cd180b060f63095f3ded9_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void vfio_msix_enable(VFIOPCIDevice *vdev)\n \n+{\n \n vfio_disable_interrupts(vdev);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void vfio_msix_enable(VFIOPCIDevice *vdev)\n\n{\n\n vfio_disable_interrupts(vdev);\n\n\n\n vdev->msi_vectors = g_malloc0(vdev->msix->entries * sizeof(VFIOMSIVector));\n\n\n\n vdev->interrupt = VFIO_INT_MSIX;\n\n\n\n /*\n\n * Some communication channels between VF & PF or PF & fw rely on the\n\n * physical state of the device and expect that enabling MSI-X from the\n\n * guest enables the same on the host. When our guest is Linux, the\n\n * guest driver call to pci_enable_msix() sets the enabling bit in the\n\n * MSI-X capability, but leaves the vector table masked. We therefore\n\n * can't rely on a vector_use callback (from request_irq() in the guest)\n\n * to switch the physical device into MSI-X mode because that may come a\n\n * long time after pci_enable_msix(). This code enables vector 0 with\n\n * triggering to userspace, then immediately release the vector, leaving\n\n * the physical device with no vectors enabled, but MSI-X enabled, just\n\n * like the guest view.\n\n */\n\n vfio_msix_vector_do_use(&vdev->pdev, 0, NULL, NULL);\n\n vfio_msix_vector_release(&vdev->pdev, 0);\n\n\n\n if (msix_set_vector_notifiers(&vdev->pdev, vfio_msix_vector_use,\n\n vfio_msix_vector_release, NULL)) {\n\n error_report(\"vfio: msix_set_vector_notifiers failed\");\n\n }\n\n\n\n trace_vfio_msix_enable(vdev->vbasedev.name);\n\n}\n"}} {"sample_id": "daa1ea049a9445b7bed03963cb789497065dd1eb_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n \"movq %%mm4, %1 \\n\\t\"\n \n \"movq %%mm3, %2 \\n\\t\"\n+\n+\n+\n+ : \"+m\" (*(uint64_t*)(src - 2*stride)),\n+\n \"+m\" (*(uint64_t*)(src - 1*stride)),\n \n \"+m\" (*(uint64_t*)(src + 0*stride)),", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_vp3_v_loop_filter_mmx(uint8_t *src, int stride, int *bounding_values)\n\n{\n\n __asm__ volatile(\n\n \"movq %0, %%mm6 \\n\\t\"\n\n \"movq %1, %%mm4 \\n\\t\"\n\n \"movq %2, %%mm2 \\n\\t\"\n\n \"movq %3, %%mm1 \\n\\t\"\n\n\n\n VP3_LOOP_FILTER(%4)\n\n\n\n \"movq %%mm4, %1 \\n\\t\"\n\n \"movq %%mm3, %2 \\n\\t\"\n\n\n\n : \"+m\" (*(uint64_t*)(src - 2*stride)),\n\n \"+m\" (*(uint64_t*)(src - 1*stride)),\n\n \"+m\" (*(uint64_t*)(src + 0*stride)),\n\n \"+m\" (*(uint64_t*)(src + 1*stride))\n\n : \"m\"(*(uint64_t*)(bounding_values+129))\n\n );\n\n}\n"}} {"sample_id": "9a321e92343891e30f6fe8bfaad40454ae358bfb_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n unsigned i;\n \n+ MSIMessage msg = { .address = addr, .data = first_irq };\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void spapr_msi_setmsg(PCIDevice *pdev, hwaddr addr, bool msix,\n\n unsigned first_irq, unsigned req_num)\n\n{\n\n unsigned i;\n\n MSIMessage msg = { .address = addr, .data = first_irq };\n\n\n\n if (!msix) {\n\n msi_set_message(pdev, msg);\n\n trace_spapr_pci_msi_setup(pdev->name, 0, msg.address);\n\n return;\n\n }\n\n\n\n for (i = 0; i < req_num; ++i, ++msg.data) {\n\n msix_set_message(pdev, i, msg);\n\n trace_spapr_pci_msi_setup(pdev->name, i, msg.address);\n\n }\n\n}\n"}} {"sample_id": "1851e1d05d06f6ef3436c667e4354da0f407b226", "diff": "--- a/source.c\n+++ b/source.c\n@@ -10,6 +10,6 @@\n /* RTP payload type */\n hd = s->rtp_hd;\n }\n+ ret = ffurl_write(hd, buf, size);\n+ return ret;\n+}", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int rtp_write(URLContext *h, const uint8_t *buf, int size)\n{\n RTPContext *s = h->priv_data;\n int ret;\n URLContext *hd;\n if (RTP_PT_IS_RTCP(buf[1])) {\n /* RTCP payload type */\n hd = s->rtcp_hd;\n } else {\n /* RTP payload type */\n hd = s->rtp_hd;\n }\n ret = ffurl_write(hd, buf, size);\n return ret;\n}"}} {"sample_id": "aec4b054ea36c53c8b887da99f20010133b84378_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n QObject *embedded_obj;\n \n QObject *obj;\n+\n LiteralQObject decoded = QLIT_QLIST(((LiteralQObject[]){\n \n QLIT_QINT(1),", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void simple_varargs(void)\n\n{\n\n QObject *embedded_obj;\n\n QObject *obj;\n\n LiteralQObject decoded = QLIT_QLIST(((LiteralQObject[]){\n\n QLIT_QINT(1),\n\n QLIT_QINT(2),\n\n QLIT_QLIST(((LiteralQObject[]){\n\n QLIT_QINT(32),\n\n QLIT_QINT(42),\n\n {}})),\n\n {}}));\n\n\n\n embedded_obj = qobject_from_json(\"[32, 42]\", NULL);\n\n g_assert(embedded_obj != NULL);\n\n\n\n obj = qobject_from_jsonf(\"[%d, 2, %p]\", 1, embedded_obj);\n\n g_assert(compare_litqobj_to_qobj(&decoded, obj) == 1);\n\n\n\n qobject_decref(obj);\n\n}\n"}} {"sample_id": "d9b789745b88df367674e45c55df29e9c7de8d8a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n eof = glfs_lseek(fd, 0, SEEK_END);\n \n+ if (eof < 0) {\n+\n+ /* this should never occur */\n+\n+ return false;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static bool qemu_gluster_test_seek(struct glfs_fd *fd)\n\n{\n\n off_t ret, eof;\n\n\n\n eof = glfs_lseek(fd, 0, SEEK_END);\n\n if (eof < 0) {\n\n /* this should never occur */\n\n return false;\n\n }\n\n\n\n /* this should always fail with ENXIO if SEEK_DATA is supported */\n\n ret = glfs_lseek(fd, eof, SEEK_DATA);\n\n return (ret < 0) && (errno == ENXIO);\n\n}\n"}} {"sample_id": "e95ead32efc48157de12e0a257ea1c52541a6ce1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n return chmod(rpath(ctx, path), mode);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int local_chmod(FsContext *ctx, const char *path, mode_t mode)\n\n{\n\n return chmod(rpath(ctx, path), mode);\n\n}\n"}} {"sample_id": "9dfd24ed848228643293e37c36848b5ac520ab98", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static void tpm_tis_initfn(Object *obj)\n+\n {\n \n+ ISADevice *dev = ISA_DEVICE(obj);\n \n TPMState *s = TPM(obj);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void tpm_tis_initfn(Object *obj)\n\n{\n\n ISADevice *dev = ISA_DEVICE(obj);\n\n TPMState *s = TPM(obj);\n\n\n\n memory_region_init_io(&s->mmio, OBJECT(s), &tpm_tis_memory_ops,\n\n s, \"tpm-tis-mmio\",\n\n TPM_TIS_NUM_LOCALITIES << TPM_TIS_LOCALITY_SHIFT);\n\n memory_region_add_subregion(isa_address_space(dev), TPM_TIS_ADDR_BASE,\n\n &s->mmio);\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_221", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static uint64_t mips_qemu_read (void *opaque, target_phys_addr_t addr,\n \n unsigned size)\n+\n+{\n \n return 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t mips_qemu_read (void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n return 0;\n\n}\n"}} {"sample_id": "621ff94d5074d88253a5818c6b9c4db718fbfc65_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,11 +12,11 @@\n \n qdev_set_parent_bus(vdev, BUS(&ccw_dev->bus));\n \n+ object_property_set_bool(OBJECT(vdev), true, \"realized\", &err);\n+\n+ if (err) {\n+\n+ error_propagate(errp, err);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virtio_ccw_9p_realize(VirtioCcwDevice *ccw_dev, Error **errp)\n\n{\n\n V9fsCCWState *dev = VIRTIO_9P_CCW(ccw_dev);\n\n DeviceState *vdev = DEVICE(&dev->vdev);\n\n Error *err = NULL;\n\n\n\n qdev_set_parent_bus(vdev, BUS(&ccw_dev->bus));\n\n object_property_set_bool(OBJECT(vdev), true, \"realized\", &err);\n\n if (err) {\n\n error_propagate(errp, err);\n\n }\n\n}\n"}} {"sample_id": "91479dd0b5bd3b087b92ddd7bc3f2c54982cfe17_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,11 +8,11 @@\n \n \n \n+ qlist = qlist_new();\n+\n+\n+\n+ for (i = 0; i < iter_max; i++)\n \n qlist_append(qlist, qint_from_int(i));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "START_TEST(qlist_iter_test)\n\n{\n\n int i;\n\n QList *qlist;\n\n\n\n qlist = qlist_new();\n\n\n\n for (i = 0; i < iter_max; i++)\n\n qlist_append(qlist, qint_from_int(i));\n\n\n\n iter_called = 0;\n\n qlist_iter(qlist, iter_func, NULL);\n\n\n\n fail_unless(iter_called == iter_max);\n\n\n\n QDECREF(qlist);\n\n}\n"}} {"sample_id": "539de1246d355d3b8aa33fb7cde732352d8827c7_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void migrate_fd_put_ready(void *opaque)\n+\n+{\n+\n+ MigrationState *s = opaque;\n+\n int ret;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void migrate_fd_put_ready(void *opaque)\n\n{\n\n MigrationState *s = opaque;\n\n int ret;\n\n\n\n if (s->state != MIG_STATE_ACTIVE) {\n\n DPRINTF(\"put_ready returning because of non-active state\\n\");\n\n return;\n\n }\n\n\n\n DPRINTF(\"iterate\\n\");\n\n ret = qemu_savevm_state_iterate(s->mon, s->file);\n\n if (ret < 0) {\n\n migrate_fd_error(s);\n\n } else if (ret == 1) {\n\n int old_vm_running = runstate_is_running();\n\n\n\n DPRINTF(\"done iterating\\n\");\n\n vm_stop_force_state(RUN_STATE_FINISH_MIGRATE);\n\n\n\n if (qemu_savevm_state_complete(s->mon, s->file) < 0) {\n\n migrate_fd_error(s);\n\n } else {\n\n migrate_fd_completed(s);\n\n }\n\n if (s->state != MIG_STATE_COMPLETED) {\n\n if (old_vm_running) {\n\n vm_start();\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_29", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n TCGv tmp1 = tcg_temp_new(TCG_TYPE_I64);\n \n+ TCGv tmp2 = tcg_temp_new(TCG_TYPE_I64);\n+\n+\n+\n+ tcg_gen_ext_i32_i64(tmp1, a);\n \n tcg_gen_ext_i32_i64(tmp2, b);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void gen_imull(TCGv a, TCGv b)\n\n{\n\n TCGv tmp1 = tcg_temp_new(TCG_TYPE_I64);\n\n TCGv tmp2 = tcg_temp_new(TCG_TYPE_I64);\n\n\n\n tcg_gen_ext_i32_i64(tmp1, a);\n\n tcg_gen_ext_i32_i64(tmp2, b);\n\n tcg_gen_mul_i64(tmp1, tmp1, tmp2);\n\n tcg_gen_trunc_i64_i32(a, tmp1);\n\n tcg_gen_shri_i64(tmp1, tmp1, 32);\n\n tcg_gen_trunc_i64_i32(b, tmp1);\n\n}\n"}} {"sample_id": "79997def65fd2313b48a5f3c3a884c6149ae9b5d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -8,10 +8,10 @@\n \n av_freep(&mdct->sintab);\n \n+ av_freep(&mdct->xcos1);\n+\n+ av_freep(&mdct->xsin1);\n+\n av_freep(&mdct->rot_tmp);\n \n av_freep(&mdct->cplx_tmp);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold void mdct_end(AC3MDCTContext *mdct)\n\n{\n\n mdct->nbits = 0;\n\n av_freep(&mdct->costab);\n\n av_freep(&mdct->sintab);\n\n av_freep(&mdct->xcos1);\n\n av_freep(&mdct->xsin1);\n\n av_freep(&mdct->rot_tmp);\n\n av_freep(&mdct->cplx_tmp);\n\n}\n"}} {"sample_id": "9d7a4c6690ef9962a3b20034f65008f1ea15c1d6_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+void *g_try_malloc0(size_t n_bytes)\n+\n+{\n \n __coverity_negative_sink__(n_bytes);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void *g_try_malloc0(size_t n_bytes)\n\n{\n\n __coverity_negative_sink__(n_bytes);\n\n return calloc(1, n_bytes == 0 ? 1 : n_bytes);\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_56", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n PPC_OP(update_nip)\n+\n+{\n \n env->nip = PARAM(1);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "PPC_OP(update_nip)\n\n{\n\n env->nip = PARAM(1);\n\n RETURN();\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_29", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n pool->cur_threads -= pool->new_threads;\n \n pool->new_threads = 0;\n+\n+\n+\n+ /* Wait for worker threads to terminate */\n+\n pool->stopping = true;\n \n while (pool->cur_threads > 0) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void thread_pool_free(ThreadPool *pool)\n\n{\n\n if (!pool) {\n\n return;\n\n }\n\n\n\n assert(QLIST_EMPTY(&pool->head));\n\n\n\n qemu_mutex_lock(&pool->lock);\n\n\n\n /* Stop new threads from spawning */\n\n qemu_bh_delete(pool->new_thread_bh);\n\n pool->cur_threads -= pool->new_threads;\n\n pool->new_threads = 0;\n\n\n\n /* Wait for worker threads to terminate */\n\n pool->stopping = true;\n\n while (pool->cur_threads > 0) {\n\n qemu_sem_post(&pool->sem);\n\n qemu_cond_wait(&pool->worker_stopped, &pool->lock);\n\n }\n\n\n\n qemu_mutex_unlock(&pool->lock);\n\n\n\n qemu_bh_delete(pool->completion_bh);\n\n qemu_sem_destroy(&pool->sem);\n\n qemu_cond_destroy(&pool->worker_stopped);\n\n qemu_mutex_destroy(&pool->lock);\n\n g_free(pool);\n\n}\n"}} {"sample_id": "2bb62455c899cdccbdc2a6ad33f9582008ed9f05", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n {\n \n+ int ret;\n+\n+\n+\n+ if (n == 0)\n \n return 0;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int avpriv_vsnprintf(char *restrict s, size_t n, const char *restrict fmt,\n\n va_list ap)\n\n{\n\n int ret;\n\n\n\n if (n == 0)\n\n return 0;\n\n else if (n > INT_MAX)\n\n return AVERROR(EINVAL);\n\n\n\n /* we use n - 1 here because if the buffer is not big enough, the MS\n\n * runtime libraries don't add a terminating zero at the end. MSDN\n\n * recommends to provide _snprintf/_vsnprintf() a buffer size that\n\n * is one less than the actual buffer, and zero it before calling\n\n * _snprintf/_vsnprintf() to workaround this problem.\n\n * See http://msdn.microsoft.com/en-us/library/1kt27hek(v=vs.80).aspx */\n\n memset(s, 0, n);\n\n ret = vsnprintf(s, n - 1, fmt, ap);\n\n if (ret == -1)\n\n ret = n;\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "d6604b29ef544793479d7fb4e05ef6622bb3e534_27", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static av_cold int XAVS_close(AVCodecContext *avctx)\n \n {\n+\n+ XavsContext *x4 = avctx->priv_data;\n+\n+\n+\n av_freep(&avctx->extradata);\n \n av_free(x4->sei);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int XAVS_close(AVCodecContext *avctx)\n\n{\n\n XavsContext *x4 = avctx->priv_data;\n\n\n\n av_freep(&avctx->extradata);\n\n av_free(x4->sei);\n\n av_freep(&x4->pts_buffer);\n\n\n\n if (x4->enc)\n\n xavs_encoder_close(x4->enc);\n\n\n\n av_frame_free(&avctx->coded_frame);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_18", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static uint16_t qvirtio_pci_config_readw(QVirtioDevice *d, uint64_t off)\n \n {\n+\n QVirtioPCIDevice *dev = (QVirtioPCIDevice *)d;\n \n uint16_t value;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static uint16_t qvirtio_pci_config_readw(QVirtioDevice *d, uint64_t off)\n\n{\n\n QVirtioPCIDevice *dev = (QVirtioPCIDevice *)d;\n\n uint16_t value;\n\n\n\n value = qpci_io_readw(dev->pdev, CONFIG_BASE(dev) + off);\n\n if (qvirtio_is_big_endian(d)) {\n\n value = bswap16(value);\n\n }\n\n return value;\n\n}\n"}} {"sample_id": "ec05ec26f940564b1e07bf88857035ec27e21dd8_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n {\n \n assert(mr->terminates);\n+\n+ return cpu_physical_memory_get_dirty(mr->ram_addr + addr, size, client);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool memory_region_get_dirty(MemoryRegion *mr, hwaddr addr,\n\n hwaddr size, unsigned client)\n\n{\n\n assert(mr->terminates);\n\n return cpu_physical_memory_get_dirty(mr->ram_addr + addr, size, client);\n\n}\n"}} {"sample_id": "164a101f28a53cd3db60ed874e7c3630e7988ed8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ EventNotifierTestData data = { .n = 0, .active = 1 };\n \n event_notifier_init(&data.e, false);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_wait_event_notifier(void)\n\n{\n\n EventNotifierTestData data = { .n = 0, .active = 1 };\n\n event_notifier_init(&data.e, false);\n\n aio_set_event_notifier(ctx, &data.e, event_ready_cb, event_active_cb);\n\n g_assert(aio_poll(ctx, false));\n\n g_assert_cmpint(data.n, ==, 0);\n\n g_assert_cmpint(data.active, ==, 1);\n\n\n\n event_notifier_set(&data.e);\n\n g_assert(aio_poll(ctx, false));\n\n g_assert_cmpint(data.n, ==, 1);\n\n g_assert_cmpint(data.active, ==, 0);\n\n\n\n g_assert(!aio_poll(ctx, false));\n\n g_assert_cmpint(data.n, ==, 1);\n\n g_assert_cmpint(data.active, ==, 0);\n\n\n\n aio_set_event_notifier(ctx, &data.e, NULL, NULL);\n\n g_assert(!aio_poll(ctx, false));\n\n g_assert_cmpint(data.n, ==, 1);\n\n\n\n event_notifier_cleanup(&data.e);\n\n}\n"}} {"sample_id": "46f70ff148ae01e2dc96e64c393e295a0092555d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n return virtio_is_big_endian(vdev);\n \n+#endif\n+\n+#else\n+\n+ return false;\n \n #endif\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline bool vhost_needs_vring_endian(VirtIODevice *vdev)\n\n{\n\n if (virtio_vdev_has_feature(vdev, VIRTIO_F_VERSION_1)) {\n\n return false;\n\n }\n\n#ifdef TARGET_IS_BIENDIAN\n\n#ifdef HOST_WORDS_BIGENDIAN\n\n return !virtio_is_big_endian(vdev);\n\n#else\n\n return virtio_is_big_endian(vdev);\n\n#endif\n\n#else\n\n return false;\n\n#endif\n\n}\n"}} {"sample_id": "f689d2811a36894618087e1e2cc3ade78e758e94", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n {\n \n void * ptr;\n+\n \n \n ptr = mmap(0, s->ivshmem_size, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int create_shared_memory_BAR(IVShmemState *s, int fd, uint8_t attr,\n\n Error **errp)\n\n{\n\n void * ptr;\n\n\n\n ptr = mmap(0, s->ivshmem_size, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);\n\n if (ptr == MAP_FAILED) {\n\n error_setg_errno(errp, errno, \"Failed to mmap shared memory\");\n\n return -1;\n\n }\n\n\n\n s->shm_fd = fd;\n\n\n\n memory_region_init_ram_ptr(&s->ivshmem, OBJECT(s), \"ivshmem.bar2\",\n\n s->ivshmem_size, ptr);\n\n vmstate_register_ram(&s->ivshmem, DEVICE(s));\n\n memory_region_add_subregion(&s->bar, 0, &s->ivshmem);\n\n\n\n /* region for shared memory */\n\n pci_register_bar(PCI_DEVICE(s), 2, attr, &s->bar);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_60", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ BlockDriverState *bs;\n+\n+ DriveInfo *dinfo;\n+\n+\n \n if (bs_snapshots)\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static BlockDriverState *get_bs_snapshots(void)\n\n{\n\n BlockDriverState *bs;\n\n DriveInfo *dinfo;\n\n\n\n if (bs_snapshots)\n\n return bs_snapshots;\n\n TAILQ_FOREACH(dinfo, &drives, next) {\n\n bs = dinfo->bdrv;\n\n if (bdrv_can_snapshot(bs))\n\n goto ok;\n\n }\n\n return NULL;\n\n ok:\n\n bs_snapshots = bs;\n\n return bs;\n\n}\n"}} {"sample_id": "15fa08f8451babc88d733bd411d4c94976f9d0f8_4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n tcg_pool_reset(s);\n \n s->nb_temps = s->nb_globals;\n+\n+\n+\n /* No temps have been previously allocated for size or locality. */\n \n memset(s->free_temps, 0, sizeof(s->free_temps));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void tcg_func_start(TCGContext *s)\n\n{\n\n tcg_pool_reset(s);\n\n s->nb_temps = s->nb_globals;\n\n\n\n /* No temps have been previously allocated for size or locality. */\n\n memset(s->free_temps, 0, sizeof(s->free_temps));\n\n\n\n s->nb_labels = 0;\n\n s->current_frame_offset = s->frame_start;\n\n\n\n#ifdef CONFIG_DEBUG_TCG\n\n s->goto_tb_issue_mask = 0;\n\n#endif\n\n\n\n s->gen_op_buf[0].next = 1;\n\n s->gen_op_buf[0].prev = 0;\n\n s->gen_next_op_idx = 1;\n\n}\n"}} {"sample_id": "a0efbf16604770b9d805bcf210ec29942321134f_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,10 +4,10 @@\n \n Error **errp)\n \n+{\n+\n+ Q35PCIHost *s = Q35_HOST_DEVICE(obj);\n+\n uint32_t value = s->mch.pci_hole.end;\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void q35_host_get_pci_hole_end(Object *obj, Visitor *v,\n\n const char *name, void *opaque,\n\n Error **errp)\n\n{\n\n Q35PCIHost *s = Q35_HOST_DEVICE(obj);\n\n uint32_t value = s->mch.pci_hole.end;\n\n\n\n visit_type_uint32(v, name, &value, errp);\n\n}\n"}} {"sample_id": "27a69bb088bee6d4efea254659422fb9c751b3c7_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n \n \n if (unlikely(!ctx->spe_enabled)) {\n+\n+ gen_exception(ctx, POWERPC_EXCP_APU);\n+\n+ return;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_evmwumiaa(DisasContext *ctx)\n\n{\n\n TCGv_i64 acc;\n\n TCGv_i64 tmp;\n\n\n\n if (unlikely(!ctx->spe_enabled)) {\n\n gen_exception(ctx, POWERPC_EXCP_APU);\n\n return;\n\n }\n\n\n\n gen_evmwumi(ctx); /* rD := rA * rB */\n\n\n\n acc = tcg_temp_new_i64();\n\n tmp = tcg_temp_new_i64();\n\n\n\n /* tmp := rD */\n\n gen_load_gpr64(tmp, rD(ctx->opcode));\n\n\n\n /* Load acc */\n\n tcg_gen_ld_i64(acc, cpu_env, offsetof(CPUState, spe_acc));\n\n\n\n /* acc := tmp + acc */\n\n tcg_gen_add_i64(acc, acc, tmp);\n\n\n\n /* Store acc */\n\n tcg_gen_st_i64(acc, cpu_env, offsetof(CPUState, spe_acc));\n\n\n\n /* rD := acc */\n\n gen_store_gpr64(rD(ctx->opcode), acc);\n\n\n\n tcg_temp_free_i64(acc);\n\n tcg_temp_free_i64(tmp);\n\n}\n"}} {"sample_id": "29ba091136a5e04574f7bfc1b17536c923958f6f_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+const char * avdevice_configuration(void)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "const char * avdevice_configuration(void)\n\n{\n\n return FFMPEG_CONFIGURATION;\n\n}\n"}} {"sample_id": "e37e6ee6e100ebc355b4a48ae9a7802b38b8dac0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -25,11 +25,11 @@\n env->tlb_table[0][i].addr_read = -1;\n \n env->tlb_table[0][i].addr_write = -1;\n+\n+ env->tlb_table[0][i].addr_code = -1;\n+\n+ env->tlb_table[1][i].addr_read = -1;\n+\n env->tlb_table[1][i].addr_write = -1;\n \n env->tlb_table[1][i].addr_code = -1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void tlb_flush(CPUState *env, int flush_global)\n\n{\n\n int i;\n\n\n\n#if defined(DEBUG_TLB)\n\n printf(\"tlb_flush:\\n\");\n\n#endif\n\n /* must reset current TB so that interrupts cannot modify the\n\n links while we are modifying them */\n\n env->current_tb = NULL;\n\n\n\n for(i = 0; i < CPU_TLB_SIZE; i++) {\n\n env->tlb_table[0][i].addr_read = -1;\n\n env->tlb_table[0][i].addr_write = -1;\n\n env->tlb_table[0][i].addr_code = -1;\n\n env->tlb_table[1][i].addr_read = -1;\n\n env->tlb_table[1][i].addr_write = -1;\n\n env->tlb_table[1][i].addr_code = -1;\n\n#if (NB_MMU_MODES >= 3)\n\n env->tlb_table[2][i].addr_read = -1;\n\n env->tlb_table[2][i].addr_write = -1;\n\n env->tlb_table[2][i].addr_code = -1;\n\n#if (NB_MMU_MODES == 4)\n\n env->tlb_table[3][i].addr_read = -1;\n\n env->tlb_table[3][i].addr_write = -1;\n\n env->tlb_table[3][i].addr_code = -1;\n\n#endif\n\n#endif\n\n }\n\n\n\n memset (env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));\n\n\n\n#ifdef USE_KQEMU\n\n if (env->kqemu_enabled) {\n\n kqemu_flush(env, flush_global);\n\n }\n\n#endif\n\n tlb_flush_count++;\n\n}\n"}} {"sample_id": "7faa8075d898ae56d2c533c530569bb25ab86eaf_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n {\n \n+ int slot = PCI_SLOT(dev->devfn);\n+\n PIIX4PMState *s = DO_UPCAST(PIIX4PMState, dev,\n \n PCI_DEVICE(qdev));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int piix4_device_hotplug(DeviceState *qdev, PCIDevice *dev,\n\n\t\t\t\tPCIHotplugState state)\n\n{\n\n int slot = PCI_SLOT(dev->devfn);\n\n PIIX4PMState *s = DO_UPCAST(PIIX4PMState, dev,\n\n PCI_DEVICE(qdev));\n\n\n\n /* Don't send event when device is enabled during qemu machine creation:\n\n * it is present on boot, no hotplug event is necessary. We do send an\n\n * event when the device is disabled later. */\n\n if (state == PCI_COLDPLUG_ENABLED) {\n\n return 0;\n\n }\n\n\n\n s->pci0_status.up = 0;\n\n s->pci0_status.down = 0;\n\n if (state == PCI_HOTPLUG_ENABLED) {\n\n enable_device(s, slot);\n\n } else {\n\n disable_device(s, slot);\n\n }\n\n\n\n pm_update_sci(s);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -22,11 +22,11 @@\n \n size << it_shift);\n \n+ vmstate_register(NULL, -1, &vmstate_macio_nvram, s);\n+\n+ qemu_register_reset(macio_nvram_reset, s);\n+\n+\n \n return s;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "MacIONVRAMState *macio_nvram_init (target_phys_addr_t size,\n\n unsigned int it_shift)\n\n{\n\n MacIONVRAMState *s;\n\n\n\n s = g_malloc0(sizeof(MacIONVRAMState));\n\n s->data = g_malloc0(size);\n\n s->size = size;\n\n s->it_shift = it_shift;\n\n\n\n memory_region_init_io(&s->mem, &macio_nvram_ops, s, \"macio-nvram\",\n\n size << it_shift);\n\n vmstate_register(NULL, -1, &vmstate_macio_nvram, s);\n\n qemu_register_reset(macio_nvram_reset, s);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "e92f0e1910f0655a0edd8d87c5a7262d36517a89", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n FlushCo flush_co = {\n \n+ .bs = bs,\n \n .ret = NOT_DONE,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "int bdrv_flush(BlockDriverState *bs)\n\n{\n\n Coroutine *co;\n\n FlushCo flush_co = {\n\n .bs = bs,\n\n .ret = NOT_DONE,\n\n };\n\n\n\n if (qemu_in_coroutine()) {\n\n /* Fast-path if already in coroutine context */\n\n bdrv_flush_co_entry(&flush_co);\n\n } else {\n\n co = qemu_coroutine_create(bdrv_flush_co_entry, &flush_co);\n\n qemu_coroutine_enter(co);\n\n BDRV_POLL_WHILE(bs, flush_co.ret == NOT_DONE);\n\n }\n\n\n\n return flush_co.ret;\n\n}\n"}} {"sample_id": "b47d8efa9f430c332bf96ce6eede169eb48422ad_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n vdev->vbasedev.group = NULL;\n \n trace_vfio_put_device(vdev->vbasedev.fd);\n+\n+ close(vdev->vbasedev.fd);\n+\n+ g_free(vdev->vbasedev.name);\n+\n if (vdev->msix) {\n \n g_free(vdev->msix);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vfio_put_device(VFIOPCIDevice *vdev)\n\n{\n\n QLIST_REMOVE(vdev, next);\n\n vdev->vbasedev.group = NULL;\n\n trace_vfio_put_device(vdev->vbasedev.fd);\n\n close(vdev->vbasedev.fd);\n\n g_free(vdev->vbasedev.name);\n\n if (vdev->msix) {\n\n g_free(vdev->msix);\n\n vdev->msix = NULL;\n\n }\n\n}\n"}} {"sample_id": "39bb30f6640fe1faf4bbc779a79786028febc95d_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static int mxf_read_material_package(MXFPackage *package, ByteIOContext *pb, int tag)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int mxf_read_material_package(MXFPackage *package, ByteIOContext *pb, int tag)\n\n{\n\n switch(tag) {\n\n case 0x4403:\n\n package->tracks_count = get_be32(pb);\n\n if (package->tracks_count >= UINT_MAX / sizeof(UID))\n\n return -1;\n\n package->tracks_refs = av_malloc(package->tracks_count * sizeof(UID));\n\n if (!package->tracks_refs)\n\n return -1;\n\n url_fskip(pb, 4); /* useless size of objects, always 16 according to specs */\n\n get_buffer(pb, (uint8_t *)package->tracks_refs, package->tracks_count * sizeof(UID));\n\n break;\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "03289958938e91dc9bc398fdf1489677c6030063", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n dst[0]= 0;\n \n if(taglen < 1)\n+\n return;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void id3v2_read_ttag(AVFormatContext *s, int taglen, char *dst, int dstlen)\n\n{\n\n char *q;\n\n int len;\n\n\n\n if(dstlen > 0)\n\n dst[0]= 0;\n\n if(taglen < 1)\n\n return;\n\n\n\n taglen--; /* account for encoding type byte */\n\n dstlen--; /* Leave space for zero terminator */\n\n\n\n switch(get_byte(s->pb)) { /* encoding type */\n\n\n\n case 0: /* ISO-8859-1 (0 - 255 maps directly into unicode) */\n\n q = dst;\n\n while(taglen--) {\n\n uint8_t tmp;\n\n PUT_UTF8(get_byte(s->pb), tmp, if (q - dst < dstlen - 1) *q++ = tmp;)\n\n }\n\n *q = '\\0';\n\n break;\n\n\n\n case 3: /* UTF-8 */\n\n len = FFMIN(taglen, dstlen);\n\n get_buffer(s->pb, dst, len);\n\n dst[len] = 0;\n\n break;\n\n }\n\n}\n"}} {"sample_id": "c5c7d3f0a79a977955e9df436cf9ca17269b8783", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void do_log(int loglevel, const char *format, ...)\n+\n+{\n+\n+ va_list ap;\n+\n \n \n va_start(ap, format);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void do_log(int loglevel, const char *format, ...)\n\n{\n\n va_list ap;\n\n\n\n va_start(ap, format);\n\n if (is_daemon) {\n\n vsyslog(LOG_CRIT, format, ap);\n\n } else {\n\n vfprintf(stderr, format, ap);\n\n }\n\n va_end(ap);\n\n}\n"}} {"sample_id": "1dfb1b2d34840dce27e672f147bc4ef122abab74", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n }\n \n \n+\n+ uint64_t now = qemu_clock_get_ns(rtc_clock);\n+\n+ if (now < s->next_periodic_time ||\n+\n now > (s->next_periodic_time + get_max_clock_jump())) {\n \n periodic_timer_update(s, qemu_clock_get_ns(rtc_clock));", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int rtc_post_load(void *opaque, int version_id)\n\n{\n\n RTCState *s = opaque;\n\n\n\n if (version_id <= 2 || rtc_clock == QEMU_CLOCK_REALTIME) {\n\n rtc_set_time(s);\n\n s->offset = 0;\n\n check_update_timer(s);\n\n }\n\n\n\n uint64_t now = qemu_clock_get_ns(rtc_clock);\n\n if (now < s->next_periodic_time ||\n\n now > (s->next_periodic_time + get_max_clock_jump())) {\n\n periodic_timer_update(s, qemu_clock_get_ns(rtc_clock));\n\n }\n\n\n\n#ifdef TARGET_I386\n\n if (version_id >= 2) {\n\n if (s->lost_tick_policy == LOST_TICK_POLICY_SLEW) {\n\n rtc_coalesced_timer_update(s);\n\n }\n\n }\n\n#endif\n\n return 0;\n\n}\n"}} {"sample_id": "2725aec70114cf1bee00443aeb47a305f9b0c665", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,19 +1,19 @@\n+static void update_pam(PCII440FXState *d, uint32_t start, uint32_t end, int r,\n+\n+ PAMMemoryRegion *mem)\n+\n {\n+\n+ if (mem->initialized) {\n+\n+ memory_region_del_subregion(d->system_memory, &mem->mem);\n+\n memory_region_destroy(&mem->mem);\n+\n }\n \n+\n+\n // printf(\"ISA mapping %08x-0x%08x: %d\\n\", start, end, r);\n \n switch(r) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void update_pam(PCII440FXState *d, uint32_t start, uint32_t end, int r,\n\n PAMMemoryRegion *mem)\n\n{\n\n if (mem->initialized) {\n\n memory_region_del_subregion(d->system_memory, &mem->mem);\n\n memory_region_destroy(&mem->mem);\n\n }\n\n\n\n // printf(\"ISA mapping %08x-0x%08x: %d\\n\", start, end, r);\n\n switch(r) {\n\n case 3:\n\n /* RAM */\n\n memory_region_init_alias(&mem->mem, \"pam-ram\", d->ram_memory,\n\n start, end - start);\n\n break;\n\n case 1:\n\n /* ROM (XXX: not quite correct) */\n\n memory_region_init_alias(&mem->mem, \"pam-rom\", d->ram_memory,\n\n start, end - start);\n\n memory_region_set_readonly(&mem->mem, true);\n\n break;\n\n case 2:\n\n case 0:\n\n /* XXX: should distinguish read/write cases */\n\n memory_region_init_alias(&mem->mem, \"pam-pci\", d->pci_address_space,\n\n start, end - start);\n\n break;\n\n }\n\n memory_region_add_subregion_overlap(d->system_memory,\n\n start, &mem->mem, 1);\n\n mem->initialized = true;\n\n}\n"}} {"sample_id": "d6604b29ef544793479d7fb4e05ef6622bb3e534_37", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n }\n \n \n+\n+ av_frame_free(&avctx->coded_frame);\n+\n+\n+\n return 0;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int X264_close(AVCodecContext *avctx)\n\n{\n\n X264Context *x4 = avctx->priv_data;\n\n\n\n av_freep(&avctx->extradata);\n\n av_freep(&x4->sei);\n\n\n\n if (x4->enc) {\n\n x264_encoder_close(x4->enc);\n\n x4->enc = NULL;\n\n }\n\n\n\n av_frame_free(&avctx->coded_frame);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "c508277335e3b6b20cf18e6ea3a35c1fa835c64a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ int i;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void vmxnet3_fill_stats(VMXNET3State *s)\n\n{\n\n int i;\n\n\n\n if (!s->device_active)\n\n return;\n\n\n\n for (i = 0; i < s->txq_num; i++) {\n\n pci_dma_write(PCI_DEVICE(s),\n\n s->txq_descr[i].tx_stats_pa,\n\n &s->txq_descr[i].txq_stats,\n\n sizeof(s->txq_descr[i].txq_stats));\n\n }\n\n\n\n for (i = 0; i < s->rxq_num; i++) {\n\n pci_dma_write(PCI_DEVICE(s),\n\n s->rxq_descr[i].rx_stats_pa,\n\n &s->rxq_descr[i].rxq_stats,\n\n sizeof(s->rxq_descr[i].rxq_stats));\n\n }\n\n}\n"}} {"sample_id": "cc276c85d15272df6e44fb3252657a43cbd49555", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,10 +6,10 @@\n \n \n \n+ for (i = 0; i < 13; i++)\n+\n+ layout |= thd_layout[i] * ((chanmap >> i) & 1);\n+\n \n \n return layout;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int64_t truehd_layout(int chanmap)\n\n{\n\n int layout = 0, i;\n\n\n\n for (i = 0; i < 13; i++)\n\n layout |= thd_layout[i] * ((chanmap >> i) & 1);\n\n\n\n return layout;\n\n}\n"}} {"sample_id": "7d8abfcb50a33aed369bbd267852cf04009c49e9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,11 +21,11 @@\n \t}\n \n \n+\n+\tif (ctx->Pflag) {\n+\n+\t\tvoid *cmp_buf = malloc(ctx->qiov.size);\n+\n \n \n \t\tmemset(cmp_buf, ctx->pattern, ctx->qiov.size);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "aio_read_done(void *opaque, int ret)\n\n{\n\n\tstruct aio_ctx *ctx = opaque;\n\n\tstruct timeval t2;\n\n\n\n\tgettimeofday(&t2, NULL);\n\n\n\n\tif (ret < 0) {\n\n\t\tprintf(\"readv failed: %s\\n\", strerror(-ret));\n\n\t\treturn;\n\n\t}\n\n\n\n\tif (ctx->Pflag) {\n\n\t\tvoid *cmp_buf = malloc(ctx->qiov.size);\n\n\n\n\t\tmemset(cmp_buf, ctx->pattern, ctx->qiov.size);\n\n\t\tif (memcmp(ctx->buf, cmp_buf, ctx->qiov.size)) {\n\n\t\t\tprintf(\"Pattern verification failed at offset %lld, \"\n\n\t\t\t\t\"%zd bytes\\n\",\n\n\t\t\t\t(long long) ctx->offset, ctx->qiov.size);\n\n\t\t}\n\n\t\tfree(cmp_buf);\n\n\t}\n\n\n\n\tif (ctx->qflag) {\n\n\t\treturn;\n\n\t}\n\n\n\n\tif (ctx->vflag) {\n\n\t\tdump_buffer(ctx->buf, ctx->offset, ctx->qiov.size);\n\n\t}\n\n\n\n\t/* Finally, report back -- -C gives a parsable format */\n\n\tt2 = tsub(t2, ctx->t1);\n\n\tprint_report(\"read\", &t2, ctx->offset, ctx->qiov.size,\n\n\t\t ctx->qiov.size, 1, ctx->Cflag);\n\n\n\n\tqemu_io_free(ctx->buf);\n\n\tfree(ctx);\n\n}\n"}} {"sample_id": "9005c3b3efb7eb1b140d2ad0385efff6a3af59c4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n ssize_t len = sizeof(ACL_DEFAULT);\n \n \n+\n if (!value) {\n \n return len;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static ssize_t mp_dacl_listxattr(FsContext *ctx, const char *path,\n\n char *name, void *value, size_t osize)\n\n{\n\n ssize_t len = sizeof(ACL_DEFAULT);\n\n\n\n if (!value) {\n\n return len;\n\n }\n\n\n\n if (osize < len) {\n\n errno = ERANGE;\n\n return -1;\n\n }\n\n\n\n /* len includes the trailing NUL */\n\n memcpy(value, ACL_ACCESS, len);\n\n return 0;\n\n}\n"}} {"sample_id": "285f7a62e464eac97e472ba6803ddede1e6c459e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n \tip_id = tt.tv_sec & 0xffff;\n \n \tudp_init();\n+\n+\ttcp_init();\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "ip_init(void)\n\n{\n\n\tipq.ip_link.next = ipq.ip_link.prev = &ipq.ip_link;\n\n\tip_id = tt.tv_sec & 0xffff;\n\n\tudp_init();\n\n\ttcp_init();\n\n}\n"}} {"sample_id": "d6604b29ef544793479d7fb4e05ef6622bb3e534_34", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,6 +6,6 @@\n \n \n \n+ return 0;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static av_cold int pcm_encode_close(AVCodecContext *avctx)\n\n{\n\n av_freep(&avctx->coded_frame);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "ccce2248bf56692fc7bd436ca2c9acca772d486a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n static void vp7_luma_dc_wht_c(int16_t block[4][4][16], int16_t dc[16])\n+\n {\n \n int i, a1, b1, c1, d1;\n \n int16_t tmp[16];\n \n+\n+\n+ for (i = 0; i < 4; i++) {\n+\n a1 = (dc[i * 4 + 0] + dc[i * 4 + 2]) * 23170;\n \n b1 = (dc[i * 4 + 0] - dc[i * 4 + 2]) * 23170;\n@@ -17,10 +17,10 @@\n c1 = dc[i * 4 + 1] * 12540 - dc[i * 4 + 3] * 30274;\n \n d1 = dc[i * 4 + 1] * 30274 + dc[i * 4 + 3] * 12540;\n+\n+ tmp[i * 4 + 0] = (a1 + d1) >> 14;\n+\n+ tmp[i * 4 + 3] = (a1 - d1) >> 14;\n \n tmp[i * 4 + 1] = (b1 + c1) >> 14;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void vp7_luma_dc_wht_c(int16_t block[4][4][16], int16_t dc[16])\n\n{\n\n int i, a1, b1, c1, d1;\n\n int16_t tmp[16];\n\n\n\n for (i = 0; i < 4; i++) {\n\n a1 = (dc[i * 4 + 0] + dc[i * 4 + 2]) * 23170;\n\n b1 = (dc[i * 4 + 0] - dc[i * 4 + 2]) * 23170;\n\n c1 = dc[i * 4 + 1] * 12540 - dc[i * 4 + 3] * 30274;\n\n d1 = dc[i * 4 + 1] * 30274 + dc[i * 4 + 3] * 12540;\n\n tmp[i * 4 + 0] = (a1 + d1) >> 14;\n\n tmp[i * 4 + 3] = (a1 - d1) >> 14;\n\n tmp[i * 4 + 1] = (b1 + c1) >> 14;\n\n tmp[i * 4 + 2] = (b1 - c1) >> 14;\n\n }\n\n\n\n for (i = 0; i < 4; i++) {\n\n a1 = (tmp[i + 0] + tmp[i + 8]) * 23170;\n\n b1 = (tmp[i + 0] - tmp[i + 8]) * 23170;\n\n c1 = tmp[i + 4] * 12540 - tmp[i + 12] * 30274;\n\n d1 = tmp[i + 4] * 30274 + tmp[i + 12] * 12540;\n\n AV_ZERO64(dc + i * 4);\n\n block[0][i][0] = (a1 + d1 + 0x20000) >> 18;\n\n block[3][i][0] = (a1 - d1 + 0x20000) >> 18;\n\n block[1][i][0] = (b1 + c1 + 0x20000) >> 18;\n\n block[2][i][0] = (b1 - c1 + 0x20000) >> 18;\n\n }\n\n}\n"}} {"sample_id": "4a1418e07bdcfaa3177739e04707ecaec75d89e1_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n RAMBlock *prev;\n \n+ RAMBlock **prevp;\n+\n+ RAMBlock *block;\n+\n+ uint8_t *host = ptr;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "ram_addr_t qemu_ram_addr_from_host(void *ptr)\n\n{\n\n RAMBlock *prev;\n\n RAMBlock **prevp;\n\n RAMBlock *block;\n\n uint8_t *host = ptr;\n\n\n\n#ifdef CONFIG_KQEMU\n\n if (kqemu_phys_ram_base) {\n\n return host - kqemu_phys_ram_base;\n\n }\n\n#endif\n\n\n\n prev = NULL;\n\n prevp = &ram_blocks;\n\n block = ram_blocks;\n\n while (block && (block->host > host\n\n || block->host + block->length <= host)) {\n\n if (prev)\n\n prevp = &prev->next;\n\n prev = block;\n\n block = block->next;\n\n }\n\n if (!block) {\n\n fprintf(stderr, \"Bad ram pointer %p\\n\", ptr);\n\n abort();\n\n }\n\n return block->offset + (host - block->host);\n\n}\n"}} {"sample_id": "cc0c4185e54867ef93c4b4dc0a8f3ecbc20ece42", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,8 +3,8 @@\n {\n \n int index = qdict_get_int(qdict, \"index\");\n+\n+ if (mon_set_cpu(index) < 0)\n \n qemu_error_new(QERR_INVALID_CPU_INDEX);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void do_cpu_set(Monitor *mon, const QDict *qdict, QObject **ret_data)\n\n{\n\n int index = qdict_get_int(qdict, \"index\");\n\n if (mon_set_cpu(index) < 0)\n\n qemu_error_new(QERR_INVALID_CPU_INDEX);\n\n}\n"}} {"sample_id": "369f7de9d57e4dd2f312255fc12271d5749c0a4e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n index = sector_num / s->tracks;\n \n offset = sector_num % s->tracks;\n+\n+\n+\n+ /* not allocated */\n+\n if ((index >= s->catalog_size) || (s->catalog_bitmap[index] == 0))\n \n return -1;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int64_t seek_to_sector(BDRVParallelsState *s, int64_t sector_num)\n\n{\n\n uint32_t index, offset;\n\n\n\n index = sector_num / s->tracks;\n\n offset = sector_num % s->tracks;\n\n\n\n /* not allocated */\n\n if ((index >= s->catalog_size) || (s->catalog_bitmap[index] == 0))\n\n return -1;\n\n return (uint64_t)s->catalog_bitmap[index] * s->off_multiplier + offset;\n\n}\n"}} {"sample_id": "bec1631100323fac0900aea71043d5c4e22fc2fa_16", "diff": "--- a/source.c\n+++ b/source.c\n@@ -18,11 +18,11 @@\n \n } else {\n \n+ need_cmp = true;\n+\n+ tcg_out_cmp(s, ext, a, b, b_const);\n+\n+ }\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void tcg_out_brcond(TCGContext *s, TCGMemOp ext, TCGCond c, TCGArg a,\n\n TCGArg b, bool b_const, int label)\n\n{\n\n TCGLabel *l = &s->labels[label];\n\n intptr_t offset;\n\n bool need_cmp;\n\n\n\n if (b_const && b == 0 && (c == TCG_COND_EQ || c == TCG_COND_NE)) {\n\n need_cmp = false;\n\n } else {\n\n need_cmp = true;\n\n tcg_out_cmp(s, ext, a, b, b_const);\n\n }\n\n\n\n if (!l->has_value) {\n\n tcg_out_reloc(s, s->code_ptr, R_AARCH64_CONDBR19, label, 0);\n\n offset = tcg_in32(s) >> 5;\n\n } else {\n\n offset = l->u.value_ptr - s->code_ptr;\n\n assert(offset == sextract64(offset, 0, 19));\n\n }\n\n\n\n if (need_cmp) {\n\n tcg_out_insn(s, 3202, B_C, c, offset);\n\n } else if (c == TCG_COND_EQ) {\n\n tcg_out_insn(s, 3201, CBZ, ext, a, offset);\n\n } else {\n\n tcg_out_insn(s, 3201, CBNZ, ext, a, offset);\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_287", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n IntelHDAState *d = opaque;\n \n const IntelHDAReg *reg = intel_hda_reg_find(d, addr);\n+\n+\n+\n return intel_hda_reg_read(d, reg, 0xffffffff);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t intel_hda_mmio_readl(void *opaque, target_phys_addr_t addr)\n\n{\n\n IntelHDAState *d = opaque;\n\n const IntelHDAReg *reg = intel_hda_reg_find(d, addr);\n\n\n\n return intel_hda_reg_read(d, reg, 0xffffffff);\n\n}\n"}} {"sample_id": "10ee2aaa417d8d8978cdb2bbed55ebb152df5f6b_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,9 +5,9 @@\n PCIAC97LinkState *d = opaque;\n \n AC97LinkState *s = &d->ac97;\n+\n+ dolog (\"U nam readl %#x\\n\", addr);\n+\n s->cas = 0;\n \n return ~0U;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint32_t nam_readl (void *opaque, uint32_t addr)\n\n{\n\n PCIAC97LinkState *d = opaque;\n\n AC97LinkState *s = &d->ac97;\n\n dolog (\"U nam readl %#x\\n\", addr);\n\n s->cas = 0;\n\n return ~0U;\n\n}\n"}} {"sample_id": "970311646a701eecb103eb28093e8924d2fa6861", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n+void block_job_completed(BlockJob *job, int ret)\n+\n+{\n+\n BlockDriverState *bs = job->bs;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "void block_job_completed(BlockJob *job, int ret)\n\n{\n\n BlockDriverState *bs = job->bs;\n\n\n\n assert(bs->job == job);\n\n job->cb(job->opaque, ret);\n\n bs->job = NULL;\n\n bdrv_op_unblock_all(bs, job->blocker);\n\n error_free(job->blocker);\n\n g_free(job);\n\n}\n"}} {"sample_id": "5fa5469c08f6e51eed26d6d54e0be8682723d3df", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n unsupported_encoding(s, insn);\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void disas_simd_zip_trn(DisasContext *s, uint32_t insn)\n\n{\n\n unsupported_encoding(s, insn);\n\n}\n"}} {"sample_id": "1108b2f8a939fb5778d384149e2f1b99062a72da_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n e1000e_init_msi(E1000EState *s)\n+\n+{\n+\n int res;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "e1000e_init_msi(E1000EState *s)\n\n{\n\n int res;\n\n\n\n res = msi_init(PCI_DEVICE(s),\n\n 0xD0, /* MSI capability offset */\n\n 1, /* MAC MSI interrupts */\n\n true, /* 64-bit message addresses supported */\n\n false); /* Per vector mask supported */\n\n\n\n if (res > 0) {\n\n s->intr_state |= E1000E_USE_MSI;\n\n } else {\n\n trace_e1000e_msi_init_fail(res);\n\n }\n\n}\n"}} {"sample_id": "8ba2aae32c40f544def6be7ae82be9bcb781e01d", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,4 +4,4 @@\n \n memset(out, 0, sizeof(uuid_t));\n \n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void uuid_generate(uuid_t out)\n\n{\n\n memset(out, 0, sizeof(uuid_t));\n\n}\n"}} {"sample_id": "e5f34cdd2da54f28d90889a3afd15fad2d6105ff", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,7 +9,7 @@\n \n \n vs->last_x = -1;\n+\n vs->last_y = -1;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void vnc_init_state(VncState *vs)\n\n{\n\n vs->initialized = true;\n\n VncDisplay *vd = vs->vd;\n\n\n\n vs->last_x = -1;\n\n vs->last_y = -1;\n\n\n\n vs->as.freq = 44100;\n\n vs->as.nchannels = 2;\n\n vs->as.fmt = AUD_FMT_S16;\n\n vs->as.endianness = 0;\n\n\n\n qemu_mutex_init(&vs->output_mutex);\n\n vs->bh = qemu_bh_new(vnc_jobs_bh, vs);\n\n\n\n QTAILQ_INSERT_HEAD(&vd->clients, vs, next);\n\n\n\n graphic_hw_update(vd->dcl.con);\n\n\n\n vnc_write(vs, \"RFB 003.008\\n\", 12);\n\n vnc_flush(vs);\n\n vnc_read_when(vs, protocol_version, 12);\n\n reset_keys(vs);\n\n if (vs->vd->lock_key_sync)\n\n vs->led = qemu_add_led_event_handler(kbd_leds, vs);\n\n\n\n vs->mouse_mode_notifier.notify = check_pointer_type_change;\n\n qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);\n\n\n\n /* vs might be free()ed here */\n\n}\n"}} {"sample_id": "e5a869ed569a97fa676e9827952629086ec41f4e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static int target_pread(int fd, abi_ulong ptr, abi_ulong len,\n \n abi_ulong offset)\n+\n+{\n+\n+ void *buf;\n+\n int ret;\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int target_pread(int fd, abi_ulong ptr, abi_ulong len,\n\n abi_ulong offset)\n\n{\n\n void *buf;\n\n int ret;\n\n\n\n buf = lock_user(VERIFY_WRITE, ptr, len, 0);\n\n\n\n\n ret = pread(fd, buf, len, offset);\n\n\n\n\n unlock_user(buf, ptr, len);\n\n return ret;\n"}} {"sample_id": "26f027fba1c5ab482fa2488fbe0fa36c8bb33b69", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n int i;\n \n AVStream *st;\n+\n \n \n /* if bit_rate is already set, we believe it */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void estimate_timings_from_bit_rate(AVFormatContext *ic)\n\n{\n\n int64_t filesize, duration;\n\n int i;\n\n AVStream *st;\n\n\n\n /* if bit_rate is already set, we believe it */\n\n if (ic->bit_rate <= 0) {\n\n int bit_rate = 0;\n\n for(i=0;inb_streams;i++) {\n\n st = ic->streams[i];\n\n if (st->codec->bit_rate > 0) {\n\n if (INT_MAX - st->codec->bit_rate > bit_rate) {\n\n bit_rate = 0;\n\n break;\n\n }\n\n bit_rate += st->codec->bit_rate;\n\n }\n\n }\n\n ic->bit_rate = bit_rate;\n\n }\n\n\n\n /* if duration is already set, we believe it */\n\n if (ic->duration == AV_NOPTS_VALUE &&\n\n ic->bit_rate != 0) {\n\n filesize = ic->pb ? avio_size(ic->pb) : 0;\n\n if (filesize > 0) {\n\n for(i = 0; i < ic->nb_streams; i++) {\n\n st = ic->streams[i];\n\n duration= av_rescale(8*filesize, st->time_base.den, ic->bit_rate*(int64_t)st->time_base.num);\n\n if (st->duration == AV_NOPTS_VALUE)\n\n st->duration = duration;\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "e45a2872fafe631c14aee9f79d0963d68c4fc1fd_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -27,11 +27,11 @@\n else\n \n for ( ; i < sizeof(DCTELEM)*6*64 ; i += 128) {\n+\n+\tasm volatile(\"dcbzl %0,%1\" : : \"b\" (blocks), \"r\" (i) : \"memory\");\n+\n+ }\n+\n #else\n \n memset(blocks, 0, sizeof(DCTELEM)*6*64);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void clear_blocks_dcbz128_ppc(DCTELEM *blocks)\n\n{\n\nPOWERPC_TBL_DECLARE(powerpc_clear_blocks_dcbz128, 1);\n\n register int misal = ((unsigned long)blocks & 0x0000007f);\n\n register int i = 0;\n\nPOWERPC_TBL_START_COUNT(powerpc_clear_blocks_dcbz128, 1);\n\n#if 1\n\n if (misal) {\n\n // we could probably also optimize this case,\n\n // but there's not much point as the machines\n\n // aren't available yet (2003-06-26)\n\n memset(blocks, 0, sizeof(DCTELEM)*6*64);\n\n }\n\n else\n\n for ( ; i < sizeof(DCTELEM)*6*64 ; i += 128) {\n\n\tasm volatile(\"dcbzl %0,%1\" : : \"b\" (blocks), \"r\" (i) : \"memory\");\n\n }\n\n#else\n\n memset(blocks, 0, sizeof(DCTELEM)*6*64);\n\n#endif\n\nPOWERPC_TBL_STOP_COUNT(powerpc_clear_blocks_dcbz128, 1);\n\n}\n"}} {"sample_id": "9b2fadda3e0196ffd485adde4fe9cdd6fae35300_17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,15 +1,15 @@\n static void gen_mfdcr(DisasContext *ctx)\n+\n+{\n+\n+#if defined(CONFIG_USER_ONLY)\n \n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_REG);\n \n #else\n \n TCGv dcrn;\n+\n if (unlikely(ctx->pr)) {\n \n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_REG);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_mfdcr(DisasContext *ctx)\n\n{\n\n#if defined(CONFIG_USER_ONLY)\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_REG);\n\n#else\n\n TCGv dcrn;\n\n if (unlikely(ctx->pr)) {\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_REG);\n\n return;\n\n }\n\n /* NIP cannot be restored if the memory exception comes from an helper */\n\n gen_update_nip(ctx, ctx->nip - 4);\n\n dcrn = tcg_const_tl(SPR(ctx->opcode));\n\n gen_helper_load_dcr(cpu_gpr[rD(ctx->opcode)], cpu_env, dcrn);\n\n tcg_temp_free(dcrn);\n\n#endif\n\n}\n"}} {"sample_id": "91cda45b69e45a089f9989979a65db3f710c9925_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n /* Try to find a BAT */\n \n if (env->nb_BATs != 0) {\n+\n+ ret = ppc_hash32_get_bat(env, ctx, eaddr, rw, access_type);\n+\n+ }\n+\n if (ret < 0) {\n \n /* We didn't match any BAT entry or don't have BATs */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ppc_hash32_get_physical_address(CPUPPCState *env, struct mmu_ctx_hash32 *ctx,\n\n target_ulong eaddr, int rw,\n\n int access_type)\n\n{\n\n bool real_mode = (access_type == ACCESS_CODE && msr_ir == 0)\n\n || (access_type != ACCESS_CODE && msr_dr == 0);\n\n\n\n if (real_mode) {\n\n ctx->raddr = eaddr;\n\n ctx->prot = PAGE_READ | PAGE_EXEC | PAGE_WRITE;\n\n return 0;\n\n } else {\n\n int ret = -1;\n\n\n\n /* Try to find a BAT */\n\n if (env->nb_BATs != 0) {\n\n ret = ppc_hash32_get_bat(env, ctx, eaddr, rw, access_type);\n\n }\n\n if (ret < 0) {\n\n /* We didn't match any BAT entry or don't have BATs */\n\n ret = get_segment32(env, ctx, eaddr, rw, access_type);\n\n }\n\n return ret;\n\n }\n\n}\n"}} {"sample_id": "57835fc1aeaf0b3bbc0816b123a931ea39de758b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,11 +4,11 @@\n \n int start, size, i;\n \n+\n+\n+ start = bytestream_get_byte(&c->stream);\n+\n+ size = (bytestream_get_byte(&c->stream) - 1) & 0xFF;\n \n if(start + size > 255){\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void vb_decode_palette(VBDecContext *c)\n\n{\n\n int start, size, i;\n\n\n\n start = bytestream_get_byte(&c->stream);\n\n size = (bytestream_get_byte(&c->stream) - 1) & 0xFF;\n\n if(start + size > 255){\n\n av_log(c->avctx, AV_LOG_ERROR, \"Palette change runs beyond entry 256\\n\");\n\n return;\n\n }\n\n for(i = start; i <= start + size; i++)\n\n c->pal[i] = bytestream_get_be24(&c->stream);\n\n}\n"}} {"sample_id": "c4c3a3d580fa2f9d65af3fb6027ffbf9a28e9d55", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static int filter_packet(void *log_ctx, AVPacket *pkt,\n \n+ AVFormatContext *fmt_ctx, AVBitStreamFilterContext *bsf_ctx)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int filter_packet(void *log_ctx, AVPacket *pkt,\n\n AVFormatContext *fmt_ctx, AVBitStreamFilterContext *bsf_ctx)\n\n{\n\n AVCodecContext *enc_ctx = fmt_ctx->streams[pkt->stream_index]->codec;\n\n int ret;\n\n\n\n while (bsf_ctx) {\n\n AVPacket new_pkt = *pkt;\n\n ret = av_bitstream_filter_filter(bsf_ctx, enc_ctx, NULL,\n\n &new_pkt.data, &new_pkt.size,\n\n pkt->data, pkt->size,\n\n pkt->flags & AV_PKT_FLAG_KEY);\n\n if (ret == 0 && new_pkt.data != pkt->data && new_pkt.destruct) {\n\n if ((ret = av_copy_packet(&new_pkt, pkt)) < 0)\n\n break;\n\n ret = 1;\n\n }\n\n\n\n if (ret > 0) {\n\n av_free_packet(pkt);\n\n new_pkt.buf = av_buffer_create(new_pkt.data, new_pkt.size,\n\n av_buffer_default_free, NULL, 0);\n\n if (!new_pkt.buf)\n\n break;\n\n }\n\n *pkt = new_pkt;\n\n\n\n bsf_ctx = bsf_ctx->next;\n\n }\n\n\n\n if (ret < 0) {\n\n av_log(log_ctx, AV_LOG_ERROR,\n\n \"Failed to filter bitstream with filter %s for stream %d in file '%s' with codec %s\\n\",\n\n bsf_ctx->filter->name, pkt->stream_index, fmt_ctx->filename,\n\n avcodec_get_name(enc_ctx->codec_id));\n\n }\n\n\n\n return ret;\n\n}\n"}} {"sample_id": "68d553587c0aa271c3eb2902921b503740d775b6_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,11 +7,11 @@\n EHCIitd itd;\n \n \n+\n+ assert(!async);\n+\n+ entry = ehci_get_fetch_addr(ehci, async);\n+\n \n \n get_dwords(NLPTR_GET(entry),(uint32_t *) &itd,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ehci_state_fetchitd(EHCIState *ehci, int async)\n\n{\n\n uint32_t entry;\n\n EHCIitd itd;\n\n\n\n assert(!async);\n\n entry = ehci_get_fetch_addr(ehci, async);\n\n\n\n get_dwords(NLPTR_GET(entry),(uint32_t *) &itd,\n\n sizeof(EHCIitd) >> 2);\n\n ehci_trace_itd(ehci, entry, &itd);\n\n\n\n if (ehci_process_itd(ehci, &itd) != 0) {\n\n return -1;\n\n }\n\n\n\n put_dwords(NLPTR_GET(entry), (uint32_t *) &itd,\n\n sizeof(EHCIitd) >> 2);\n\n ehci_set_fetch_addr(ehci, async, itd.next);\n\n ehci_set_state(ehci, async, EST_FETCHENTRY);\n\n\n\n return 1;\n\n}\n"}} {"sample_id": "b21d677ee9efe431a4acc653a8cfb12650e44cec", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n delay_ns = limit->next_slice_time - now;\n \n+ } else {\n+\n+ limit->dispatched += n;\n+\n+ }\n \n return delay_ns;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int64_t ratelimit_calculate_delay(RateLimit *limit, uint64_t n)\n\n{\n\n int64_t delay_ns = 0;\n\n int64_t now = qemu_get_clock_ns(rt_clock);\n\n\n\n if (limit->next_slice_time < now) {\n\n limit->next_slice_time = now + SLICE_TIME;\n\n limit->dispatched = 0;\n\n }\n\n if (limit->dispatched + n > limit->slice_quota) {\n\n delay_ns = limit->next_slice_time - now;\n\n } else {\n\n limit->dispatched += n;\n\n }\n\n return delay_ns;\n\n}\n"}} {"sample_id": "c23acbaed40101c677dfcfbbfe0d2c230a8e8f44_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,12 +1,12 @@\n void FUNCC(ff_h264_idct_dc_add)(uint8_t *_dst, DCTELEM *block, int stride){\n \n int i, j;\n+\n int dc = (((dctcoef*)block)[0] + 32) >> 6;\n \n INIT_CLIP\n \n+ pixel *dst = (pixel*)_dst;\n \n stride /= sizeof(pixel);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void FUNCC(ff_h264_idct_dc_add)(uint8_t *_dst, DCTELEM *block, int stride){\n\n int i, j;\n\n int dc = (((dctcoef*)block)[0] + 32) >> 6;\n\n INIT_CLIP\n\n pixel *dst = (pixel*)_dst;\n\n stride /= sizeof(pixel);\n\n for( j = 0; j < 4; j++ )\n\n {\n\n for( i = 0; i < 4; i++ )\n\n dst[i] = CLIP( dst[i] + dc );\n\n dst += stride;\n\n }\n\n}\n"}} {"sample_id": "9154b02c53bb6685797c973fcdbec51c4714777d_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n bool vring_setup(Vring *vring, VirtIODevice *vdev, int n)\n \n+{\n+\n+ hwaddr vring_addr = virtio_queue_get_ring_addr(vdev, n);\n+\n+ hwaddr vring_size = virtio_queue_get_ring_size(vdev, n);\n \n void *vring_ptr;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "bool vring_setup(Vring *vring, VirtIODevice *vdev, int n)\n\n{\n\n hwaddr vring_addr = virtio_queue_get_ring_addr(vdev, n);\n\n hwaddr vring_size = virtio_queue_get_ring_size(vdev, n);\n\n void *vring_ptr;\n\n\n\n vring->broken = false;\n\n\n\n hostmem_init(&vring->hostmem);\n\n vring_ptr = hostmem_lookup(&vring->hostmem, vring_addr, vring_size, true);\n\n if (!vring_ptr) {\n\n error_report(\"Failed to map vring \"\n\n \"addr %#\" HWADDR_PRIx \" size %\" HWADDR_PRIu,\n\n vring_addr, vring_size);\n\n vring->broken = true;\n\n return false;\n\n }\n\n\n\n vring_init(&vring->vr, virtio_queue_get_num(vdev, n), vring_ptr, 4096);\n\n\n\n vring->last_avail_idx = 0;\n\n vring->last_used_idx = 0;\n\n vring->signalled_used = 0;\n\n vring->signalled_used_valid = false;\n\n\n\n trace_vring_setup(virtio_queue_get_ring_addr(vdev, n),\n\n vring->vr.desc, vring->vr.avail, vring->vr.used);\n\n return true;\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_316", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,8 +30,8 @@\n \n memory_region_add_subregion(system_memory, base, &s->iomem);\n \n+\n+\n+ return s;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static struct omap_uwire_s *omap_uwire_init(MemoryRegion *system_memory,\n\n target_phys_addr_t base,\n\n qemu_irq txirq, qemu_irq rxirq,\n\n qemu_irq dma,\n\n omap_clk clk)\n\n{\n\n struct omap_uwire_s *s = (struct omap_uwire_s *)\n\n g_malloc0(sizeof(struct omap_uwire_s));\n\n\n\n s->txirq = txirq;\n\n s->rxirq = rxirq;\n\n s->txdrq = dma;\n\n omap_uwire_reset(s);\n\n\n\n memory_region_init_io(&s->iomem, &omap_uwire_ops, s, \"omap-uwire\", 0x800);\n\n memory_region_add_subregion(system_memory, base, &s->iomem);\n\n\n\n return s;\n\n}\n"}} {"sample_id": "61007b316cd71ee7333ff7a0a749a8949527575f_31", "diff": "--- a/source.c\n+++ b/source.c\n@@ -46,8 +46,8 @@\n \n \n \n+ bdrv_co_maybe_schedule_bh(acb);\n+\n+ return &acb->common;\n+\n+}", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static BlockAIOCB *bdrv_co_aio_rw_vector(BlockDriverState *bs,\n\n int64_t sector_num,\n\n QEMUIOVector *qiov,\n\n int nb_sectors,\n\n BdrvRequestFlags flags,\n\n BlockCompletionFunc *cb,\n\n void *opaque,\n\n bool is_write)\n\n{\n\n Coroutine *co;\n\n BlockAIOCBCoroutine *acb;\n\n\n\n acb = qemu_aio_get(&bdrv_em_co_aiocb_info, bs, cb, opaque);\n\n acb->need_bh = true;\n\n acb->req.error = -EINPROGRESS;\n\n acb->req.sector = sector_num;\n\n acb->req.nb_sectors = nb_sectors;\n\n acb->req.qiov = qiov;\n\n acb->req.flags = flags;\n\n acb->is_write = is_write;\n\n\n\n co = qemu_coroutine_create(bdrv_co_do_rw);\n\n qemu_coroutine_enter(co, acb);\n\n\n\n bdrv_co_maybe_schedule_bh(acb);\n\n return &acb->common;\n\n}\n"}} {"sample_id": "0058584580b87feb47898e60e4b80c7f425882ad_17", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,11 +6,11 @@\n \n ac3_audio_block *ab = &ctx->audio_block;\n \n+ float *samples = ctx->samples;\n+\n+ int got_cplchan = 0;\n+\n+ int dithflag = 0;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int get_transform_coeffs(AC3DecodeContext * ctx)\n\n{\n\n int i;\n\n ac3_audio_block *ab = &ctx->audio_block;\n\n float *samples = ctx->samples;\n\n int got_cplchan = 0;\n\n int dithflag = 0;\n\n\n\n samples += (ctx->bsi.flags & AC3_BSI_LFEON) ? 256 : 0;\n\n for (i = 0; i < ctx->bsi.nfchans; i++) {\n\n if ((ab->flags & AC3_AB_CPLINU) && (ab->chincpl & (1 << i)))\n\n dithflag = 0; /* don't generate dither until channels are decoupled */\n\n else\n\n dithflag = ab->dithflag & (1 << i);\n\n /* transform coefficients for individual channel */\n\n if (_get_transform_coeffs(ab->dexps[i], ab->bap[i], ab->chcoeffs[i], samples + (i * 256),\n\n 0, ab->endmant[i], dithflag, &ctx->gb, &ctx->state))\n\n return -1;\n\n /* tranform coefficients for coupling channels */\n\n if ((ab->flags & AC3_AB_CPLINU) && (ab->chincpl & (1 << i)) && !got_cplchan) {\n\n if (_get_transform_coeffs(ab->dcplexps, ab->cplbap, 1.0f, ab->cplcoeffs,\n\n ab->cplstrtmant, ab->cplendmant, 0, &ctx->gb, &ctx->state))\n\n return -1;\n\n got_cplchan = 1;\n\n }\n\n }\n\n if (ctx->bsi.flags & AC3_BSI_LFEON)\n\n if (_get_transform_coeffs(ab->lfeexps, ab->lfebap, 1.0f, samples - 256, 0, 7, 0, &ctx->gb, &ctx->state))\n\n return -1;\n\n\n\n /* uncouple the channels from the coupling channel */\n\n if (ab->flags & AC3_AB_CPLINU)\n\n if (uncouple_channels(ctx))\n\n return -1;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "72cf2d4f0e181d0d3a3122e04129c58a95da713e_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n sep, dev->info->name);\n \n+ if (dev->id)\n+\n+ pos += snprintf(dest+pos, len-pos, \"/\\\"%s\\\"\", dev->id);\n+\n+ sep = \", \";\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qbus_list_dev(BusState *bus, char *dest, int len)\n\n{\n\n DeviceState *dev;\n\n const char *sep = \" \";\n\n int pos = 0;\n\n\n\n pos += snprintf(dest+pos, len-pos, \"devices at \\\"%s\\\":\",\n\n bus->name);\n\n LIST_FOREACH(dev, &bus->children, sibling) {\n\n pos += snprintf(dest+pos, len-pos, \"%s\\\"%s\\\"\",\n\n sep, dev->info->name);\n\n if (dev->id)\n\n pos += snprintf(dest+pos, len-pos, \"/\\\"%s\\\"\", dev->id);\n\n sep = \", \";\n\n }\n\n}\n"}} {"sample_id": "3e4f910c8d490a1490409a7e381dbbb229f9d272_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n+static void ehci_mem_writeb(void *ptr, target_phys_addr_t addr, uint32_t val)\n+\n+{\n \n fprintf(stderr, \"EHCI doesn't handle byte writes to MMIO\\n\");\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void ehci_mem_writeb(void *ptr, target_phys_addr_t addr, uint32_t val)\n\n{\n\n fprintf(stderr, \"EHCI doesn't handle byte writes to MMIO\\n\");\n\n exit(1);\n\n}\n"}} {"sample_id": "27c7ca9c12bb42d5c44d46f24cd970469d0ef55a_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -19,11 +19,11 @@\n /* for each stream, reset read state */\n \n for(i = 0; i < s->nb_streams; i++) {\n+\n+ st = s->streams[i];\n+\n+\n+\n if (st->parser) {\n \n av_parser_close(st->parser);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_read_frame_flush(AVFormatContext *s)\n\n{\n\n AVStream *st;\n\n int i, j;\n\n\n\n flush_packet_queue(s);\n\n\n\n s->cur_st = NULL;\n\n\n\n /* for each stream, reset read state */\n\n for(i = 0; i < s->nb_streams; i++) {\n\n st = s->streams[i];\n\n\n\n if (st->parser) {\n\n av_parser_close(st->parser);\n\n st->parser = NULL;\n\n av_free_packet(&st->cur_pkt);\n\n }\n\n st->last_IP_pts = AV_NOPTS_VALUE;\n\n st->cur_dts = AV_NOPTS_VALUE; /* we set the current DTS to an unspecified origin */\n\n st->reference_dts = AV_NOPTS_VALUE;\n\n /* fail safe */\n\n st->cur_ptr = NULL;\n\n st->cur_len = 0;\n\n\n\n st->probe_packets = MAX_PROBE_PACKETS;\n\n\n\n for(j=0; jpts_buffer[j]= AV_NOPTS_VALUE;\n\n }\n\n}\n"}} {"sample_id": "60b433d905c582ed3656c120b3ffffd0119d5377", "diff": "--- a/source.c\n+++ b/source.c\n@@ -33,11 +33,11 @@\n ffio_wfourcc(pb, \"mp4a\");\n \n avio_wb32(pb, 0);\n+\n+ mov_write_esds_tag(pb, track);\n+\n+ } else if (mov_pcm_le_gt16(track->enc->codec_id)) {\n+\n mov_write_enda_tag(pb);\n \n } else if (track->enc->codec_id == AV_CODEC_ID_AMR_NB) {", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int mov_write_wave_tag(AVIOContext *pb, MOVTrack *track)\n\n{\n\n int64_t pos = avio_tell(pb);\n\n\n\n avio_wb32(pb, 0); /* size */\n\n ffio_wfourcc(pb, \"wave\");\n\n\n\n if (track->enc->codec_id != AV_CODEC_ID_QDM2) {\n\n avio_wb32(pb, 12); /* size */\n\n ffio_wfourcc(pb, \"frma\");\n\n avio_wl32(pb, track->tag);\n\n }\n\n\n\n if (track->enc->codec_id == AV_CODEC_ID_AAC) {\n\n /* useless atom needed by mplayer, ipod, not needed by quicktime */\n\n avio_wb32(pb, 12); /* size */\n\n ffio_wfourcc(pb, \"mp4a\");\n\n avio_wb32(pb, 0);\n\n mov_write_esds_tag(pb, track);\n\n } else if (mov_pcm_le_gt16(track->enc->codec_id)) {\n\n mov_write_enda_tag(pb);\n\n } else if (track->enc->codec_id == AV_CODEC_ID_AMR_NB) {\n\n mov_write_amr_tag(pb, track);\n\n } else if (track->enc->codec_id == AV_CODEC_ID_AC3) {\n\n mov_write_ac3_tag(pb, track);\n\n } else if (track->enc->codec_id == AV_CODEC_ID_ALAC ||\n\n track->enc->codec_id == AV_CODEC_ID_QDM2) {\n\n mov_write_extradata_tag(pb, track);\n\n } else if (track->enc->codec_id == AV_CODEC_ID_ADPCM_MS ||\n\n track->enc->codec_id == AV_CODEC_ID_ADPCM_IMA_WAV) {\n\n mov_write_ms_tag(pb, track);\n\n }\n\n\n\n avio_wb32(pb, 8); /* size */\n\n avio_wb32(pb, 0); /* null tag */\n\n\n\n return update_size(pb, pos);\n\n}\n"}} {"sample_id": "9aebf3b89281a173d2dfeee379b800be5e3f363e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,11 +5,11 @@\n Error **errp)\n \n {\n+\n+ if (!node_name) {\n+\n+ return;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void bdrv_assign_node_name(BlockDriverState *bs,\n\n const char *node_name,\n\n Error **errp)\n\n{\n\n if (!node_name) {\n\n return;\n\n }\n\n\n\n /* empty string node name is invalid */\n\n if (node_name[0] == '\\0') {\n\n error_setg(errp, \"Empty node name\");\n\n return;\n\n }\n\n\n\n /* takes care of avoiding namespaces collisions */\n\n if (bdrv_find(node_name)) {\n\n error_setg(errp, \"node-name=%s is conflicting with a device id\",\n\n node_name);\n\n return;\n\n }\n\n\n\n /* takes care of avoiding duplicates node names */\n\n if (bdrv_find_node(node_name)) {\n\n error_setg(errp, \"Duplicate node name\");\n\n return;\n\n }\n\n\n\n /* copy node name into the bs and insert it into the graph list */\n\n pstrcpy(bs->node_name, sizeof(bs->node_name), node_name);\n\n QTAILQ_INSERT_TAIL(&graph_bdrv_states, bs, node_list);\n\n}\n"}} {"sample_id": "f57119b8e58cb5437c3ab40d797293ecb9b4a894", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,7 +12,7 @@\n \n Jpeg2000Component *comp = tile->comp + compno;\n \n+\n \n for (reslevelno = 0, lev = codsty->nreslevels-1; reslevelno < codsty->nreslevels; reslevelno++, lev--){\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void truncpasses(Jpeg2000EncoderContext *s, Jpeg2000Tile *tile)\n\n{\n\n int precno, compno, reslevelno, bandno, cblkno, lev;\n\n Jpeg2000CodingStyle *codsty = &s->codsty;\n\n\n\n for (compno = 0; compno < s->ncomponents; compno++){\n\n Jpeg2000Component *comp = tile->comp + compno;\n\n\n\n for (reslevelno = 0, lev = codsty->nreslevels-1; reslevelno < codsty->nreslevels; reslevelno++, lev--){\n\n Jpeg2000ResLevel *reslevel = comp->reslevel + reslevelno;\n\n\n\n for (precno = 0; precno < reslevel->num_precincts_x * reslevel->num_precincts_y; precno++){\n\n for (bandno = 0; bandno < reslevel->nbands ; bandno++){\n\n int bandpos = bandno + (reslevelno > 0);\n\n Jpeg2000Band *band = reslevel->band + bandno;\n\n Jpeg2000Prec *prec = band->prec + precno;\n\n\n\n for (cblkno = 0; cblkno < prec->nb_codeblocks_height * prec->nb_codeblocks_width; cblkno++){\n\n Jpeg2000Cblk *cblk = prec->cblk + cblkno;\n\n\n\n cblk->ninclpasses = getcut(cblk, s->lambda,\n\n (int64_t)dwt_norms[codsty->transform == FF_DWT53][bandpos][lev] * (int64_t)band->i_stepsize >> 16);\n\n }\n\n }\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "35f9d8c20a26a7d383d3d36796e64a4b8987d743", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int tta_get_unary(GetBitContext *gb)\n \n+{\n+\n+ int ret = 0;\n+\n \n \n // count ones", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int tta_get_unary(GetBitContext *gb)\n\n{\n\n int ret = 0;\n\n\n\n // count ones\n\n while(get_bits1(gb))\n\n ret++;\n\n return ret;\n\n}\n"}} {"sample_id": "e9db8ff38e539260a2cb5a7918d1155b7d92a264", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,14 +4,14 @@\n \n QDict *options, Error **errp)\n \n+{\n \n int ret;\n \n if (filename) {\n \n ret = qemu_gluster_parse_uri(gconf, filename);\n+\n if (ret < 0) {\n \n error_setg(errp, \"invalid URI\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static struct glfs *qemu_gluster_init(BlockdevOptionsGluster *gconf,\n\n const char *filename,\n\n QDict *options, Error **errp)\n\n{\n\n int ret;\n\n if (filename) {\n\n ret = qemu_gluster_parse_uri(gconf, filename);\n\n if (ret < 0) {\n\n error_setg(errp, \"invalid URI\");\n\n error_append_hint(errp, \"Usage: file=gluster[+transport]://\"\n\n \"[host[:port]]/volume/path[?socket=...]\\n\");\n\n errno = -ret;\n\n return NULL;\n\n }\n\n } else {\n\n ret = qemu_gluster_parse_json(gconf, options, errp);\n\n if (ret < 0) {\n\n error_append_hint(errp, \"Usage: \"\n\n \"-drive driver=qcow2,file.driver=gluster,\"\n\n \"file.volume=testvol,file.path=/path/a.qcow2\"\n\n \"[,file.debug=9],file.server.0.type=tcp,\"\n\n \"file.server.0.host=1.2.3.4,\"\n\n \"file.server.0.port=24007,\"\n\n \"file.server.1.transport=unix,\"\n\n \"file.server.1.socket=/var/run/glusterd.socket ...\"\n\n \"\\n\");\n\n errno = -ret;\n\n return NULL;\n\n }\n\n\n\n }\n\n\n\n return qemu_gluster_glfs_init(gconf, errp);\n\n}\n"}} {"sample_id": "d8fb170da2e7edbfd250c1d8e1de6b1a0e965170", "diff": "--- a/source.c\n+++ b/source.c\n@@ -39,11 +39,11 @@\n \n \n \n+\n+ left = buffer_size - rcc->buffer_index - 1;\n+\n+ rcc->buffer_index += av_clip(left, min_rate, max_rate);\n+\n \n \n if (rcc->buffer_index > buffer_size) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "int ff_vbv_update(MpegEncContext *s, int frame_size)\n\n{\n\n RateControlContext *rcc = &s->rc_context;\n\n const double fps = get_fps(s->avctx);\n\n const int buffer_size = s->avctx->rc_buffer_size;\n\n const double min_rate = s->avctx->rc_min_rate / fps;\n\n const double max_rate = s->avctx->rc_max_rate / fps;\n\n\n\n av_dlog(s, \"%d %f %d %f %f\\n\",\n\n buffer_size, rcc->buffer_index, frame_size, min_rate, max_rate);\n\n\n\n if (buffer_size) {\n\n int left;\n\n\n\n rcc->buffer_index -= frame_size;\n\n if (rcc->buffer_index < 0) {\n\n av_log(s->avctx, AV_LOG_ERROR, \"rc buffer underflow\\n\");\n\n\n\n\n rcc->buffer_index = 0;\n\n\n\n\n left = buffer_size - rcc->buffer_index - 1;\n\n rcc->buffer_index += av_clip(left, min_rate, max_rate);\n\n\n\n if (rcc->buffer_index > buffer_size) {\n\n int stuffing = ceil((rcc->buffer_index - buffer_size) / 8);\n\n\n\n if (stuffing < 4 && s->codec_id == AV_CODEC_ID_MPEG4)\n\n stuffing = 4;\n\n rcc->buffer_index -= 8 * stuffing;\n\n\n\n if (s->avctx->debug & FF_DEBUG_RC)\n\n av_log(s->avctx, AV_LOG_DEBUG, \"stuffing %d bytes\\n\", stuffing);\n\n\n\n return stuffing;\n\n\n\n return 0;\n"}} {"sample_id": "6df5718bd3ec56225c44cf96440c723c1b611b87", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n static void megasas_reset_frames(MegasasState *s)\n+\n {\n \n PCIDevice *pcid = PCI_DEVICE(s);\n \n int i;\n+\n+ MegasasCmd *cmd;\n+\n \n \n for (i = 0; i < s->fw_cmds; i++) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void megasas_reset_frames(MegasasState *s)\n\n{\n\n PCIDevice *pcid = PCI_DEVICE(s);\n\n int i;\n\n MegasasCmd *cmd;\n\n\n\n for (i = 0; i < s->fw_cmds; i++) {\n\n cmd = &s->frames[i];\n\n if (cmd->pa) {\n\n pci_dma_unmap(pcid, cmd->frame, cmd->pa_size, 0, 0);\n\n cmd->frame = NULL;\n\n cmd->pa = 0;\n\n }\n\n }\n\n}\n"}} {"sample_id": "c2b38b277a7882a592f4f2ec955084b2b756daaa_66", "diff": "--- a/source.c\n+++ b/source.c\n@@ -43,11 +43,11 @@\n */\n \n qemu_bh_schedule(pool->completion_bh);\n+\n+\n+\n+ elem->common.cb(elem->common.opaque, elem->ret);\n+\n qemu_aio_unref(elem);\n \n goto restart;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void thread_pool_completion_bh(void *opaque)\n\n{\n\n ThreadPool *pool = opaque;\n\n ThreadPoolElement *elem, *next;\n\n\n\nrestart:\n\n QLIST_FOREACH_SAFE(elem, &pool->head, all, next) {\n\n if (elem->state != THREAD_DONE) {\n\n continue;\n\n }\n\n\n\n trace_thread_pool_complete(pool, elem, elem->common.opaque,\n\n elem->ret);\n\n QLIST_REMOVE(elem, all);\n\n\n\n if (elem->common.cb) {\n\n /* Read state before ret. */\n\n smp_rmb();\n\n\n\n /* Schedule ourselves in case elem->common.cb() calls aio_poll() to\n\n * wait for another request that completed at the same time.\n\n */\n\n qemu_bh_schedule(pool->completion_bh);\n\n\n\n elem->common.cb(elem->common.opaque, elem->ret);\n\n qemu_aio_unref(elem);\n\n goto restart;\n\n } else {\n\n qemu_aio_unref(elem);\n\n }\n\n }\n\n}\n"}} {"sample_id": "9745807191a81c45970f780166f44a7f93b18653_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,20 +1,20 @@\n static void gen_sub(DisasContext *dc, TCGv dest, TCGv srca, TCGv srcb)\n \n+{\n+\n TCGv res = tcg_temp_new();\n+\n+ TCGv sr_cy = tcg_temp_new();\n+\n+ TCGv sr_ov = tcg_temp_new();\n \n \n+\n+ tcg_gen_sub_tl(res, srca, srcb);\n+\n+ tcg_gen_xor_tl(sr_cy, srca, srcb);\n+\n+ tcg_gen_xor_tl(sr_ov, res, srcb);\n \n tcg_gen_and_tl(sr_ov, sr_ov, sr_cy);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void gen_sub(DisasContext *dc, TCGv dest, TCGv srca, TCGv srcb)\n\n{\n\n TCGv res = tcg_temp_new();\n\n TCGv sr_cy = tcg_temp_new();\n\n TCGv sr_ov = tcg_temp_new();\n\n\n\n tcg_gen_sub_tl(res, srca, srcb);\n\n tcg_gen_xor_tl(sr_cy, srca, srcb);\n\n tcg_gen_xor_tl(sr_ov, res, srcb);\n\n tcg_gen_and_tl(sr_ov, sr_ov, sr_cy);\n\n tcg_gen_setcond_tl(TCG_COND_LTU, sr_cy, srca, srcb);\n\n\n\n tcg_gen_mov_tl(dest, res);\n\n tcg_temp_free(res);\n\n\n\n tcg_gen_shri_tl(sr_ov, sr_ov, TARGET_LONG_BITS - 1);\n\n tcg_gen_deposit_tl(cpu_sr, cpu_sr, sr_cy, ctz32(SR_CY), 1);\n\n tcg_gen_deposit_tl(cpu_sr, cpu_sr, sr_ov, ctz32(SR_OV), 1);\n\n\n\n gen_ove_cyov(dc, sr_ov, sr_cy);\n\n tcg_temp_free(sr_ov);\n\n tcg_temp_free(sr_cy);\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_23", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+\tint size = memsize_zz(dc);\n+\n+\n+\n+\tDIS(fprintf (logfile, \"move.%c $r%u, $r%u\\n\",\n \n \t\t memsize_char(size), dc->op1, dc->op2));\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static unsigned int dec_move_r(DisasContext *dc)\n\n{\n\n\tint size = memsize_zz(dc);\n\n\n\n\tDIS(fprintf (logfile, \"move.%c $r%u, $r%u\\n\",\n\n\t\t memsize_char(size), dc->op1, dc->op2));\n\n\n\n\tcris_cc_mask(dc, CC_MASK_NZ);\n\n\tif (size == 4) {\n\n\t\tdec_prep_move_r(dc, dc->op1, dc->op2, size, 0, cpu_R[dc->op2]);\n\n\t\tcris_cc_mask(dc, CC_MASK_NZ);\n\n\t\tcris_update_cc_op(dc, CC_OP_MOVE, 4);\n\n\t\tcris_update_cc_x(dc);\n\n\t\tcris_update_result(dc, cpu_R[dc->op2]);\n\n\t}\n\n\telse {\n\n\t\tTCGv t0;\n\n\n\n\t\tt0 = tcg_temp_new(TCG_TYPE_TL);\n\n\t\tdec_prep_move_r(dc, dc->op1, dc->op2, size, 0, t0);\n\n\t\tcris_alu(dc, CC_OP_MOVE,\n\n\t\t\t cpu_R[dc->op2],\n\n\t\t\t cpu_R[dc->op2], t0, size);\n\n\t\ttcg_temp_free(t0);\n\n\t}\n\n\treturn 2;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n static uint64_t qemu_rdma_make_wrid(uint64_t wr_id, uint64_t index,\n+\n+ uint64_t chunk)\n+\n+{\n \n uint64_t result = wr_id & RDMA_WRID_TYPE_MASK;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static uint64_t qemu_rdma_make_wrid(uint64_t wr_id, uint64_t index,\n\n uint64_t chunk)\n\n{\n\n uint64_t result = wr_id & RDMA_WRID_TYPE_MASK;\n\n\n\n result |= (index << RDMA_WRID_BLOCK_SHIFT);\n\n result |= (chunk << RDMA_WRID_CHUNK_SHIFT);\n\n\n\n return result;\n\n}\n"}} {"sample_id": "548f52ea06951c20f0b91cae6cde0512ec073c83_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static void qemu_fill_buffer(QEMUFile *f)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void qemu_fill_buffer(QEMUFile *f)\n\n{\n\n int len;\n\n int pending;\n\n\n\n assert(!qemu_file_is_writable(f));\n\n\n\n pending = f->buf_size - f->buf_index;\n\n if (pending > 0) {\n\n memmove(f->buf, f->buf + f->buf_index, pending);\n\n }\n\n f->buf_index = 0;\n\n f->buf_size = pending;\n\n\n\n len = f->ops->get_buffer(f->opaque, f->buf + pending, f->pos,\n\n IO_BUF_SIZE - pending);\n\n if (len > 0) {\n\n f->buf_size += len;\n\n f->pos += len;\n\n } else if (len == 0) {\n\n qemu_file_set_error(f, -EIO);\n\n } else if (len != -EAGAIN) {\n\n qemu_file_set_error(f, len);\n\n }\n\n}\n"}} {"sample_id": "6e0d8677cb443e7408c0b7a25a93c6596d7fa380_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,5 +3,5 @@\n {\n \n EDI = (EDI & ~0xffff) | ((EDI + T0) & 0xffff);\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void OPPROTO op_addw_EDI_T0(void)\n\n{\n\n EDI = (EDI & ~0xffff) | ((EDI + T0) & 0xffff);\n\n}\n"}} {"sample_id": "ab443475c9235822e329e1bfde89be6c71e2c21e_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,6 +4,6 @@\n if (env->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI)) {\n if (env->interrupt_request & CPU_INTERRUPT_INIT) {\n do_cpu_init(env);\n+ if (env->interrupt_request & CPU_INTERRUPT_SIPI) {\n+ do_cpu_sipi(env);\n return env->halted;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "int kvm_arch_process_async_events(CPUState *env)\n{\n if (kvm_irqchip_in_kernel()) {\n if (env->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI)) {\n if (env->interrupt_request & CPU_INTERRUPT_INIT) {\n do_cpu_init(env);\n if (env->interrupt_request & CPU_INTERRUPT_SIPI) {\n do_cpu_sipi(env);\n return env->halted;"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_83", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,9 +3,9 @@\n {\n \n QEMUFile *f = opaque;\n+\n+\n+\n qemu_set_fd_handler2(qemu_get_fd(f), NULL, NULL, NULL, NULL);\n \n process_incoming_migration(f);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void exec_accept_incoming_migration(void *opaque)\n\n{\n\n QEMUFile *f = opaque;\n\n\n\n qemu_set_fd_handler2(qemu_get_fd(f), NULL, NULL, NULL, NULL);\n\n process_incoming_migration(f);\n\n}\n"}} {"sample_id": "439e2a6e10ed7f5da819bf7dcaa54b8cfdbeab0d_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n Aml *aml_or(Aml *arg1, Aml *arg2)\n+\n+{\n+\n Aml *var = aml_opcode(0x7D /* OrOp */);\n \n aml_append(var, arg1);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "Aml *aml_or(Aml *arg1, Aml *arg2)\n\n{\n\n Aml *var = aml_opcode(0x7D /* OrOp */);\n\n aml_append(var, arg1);\n\n aml_append(var, arg2);\n\n build_append_byte(var->buf, 0x00 /* NullNameOp */);\n\n return var;\n\n}\n"}} {"sample_id": "dfd100f242370886bb6732f70f1f7cbd8eb9fedc_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n if (qio_channel_socket_listen_sync(listen_ioc, saddr, errp) < 0) {\n \n object_unref(OBJECT(listen_ioc));\n+\n+ qapi_free_SocketAddress(saddr);\n+\n+ return;\n+\n }\n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void socket_start_incoming_migration(SocketAddress *saddr,\n\n Error **errp)\n\n{\n\n QIOChannelSocket *listen_ioc = qio_channel_socket_new();\n\n\n\n qio_channel_set_name(QIO_CHANNEL(listen_ioc),\n\n \"migration-socket-listener\");\n\n\n\n if (qio_channel_socket_listen_sync(listen_ioc, saddr, errp) < 0) {\n\n object_unref(OBJECT(listen_ioc));\n\n qapi_free_SocketAddress(saddr);\n\n return;\n\n }\n\n\n\n qio_channel_add_watch(QIO_CHANNEL(listen_ioc),\n\n G_IO_IN,\n\n socket_accept_incoming_migration,\n\n listen_ioc,\n\n (GDestroyNotify)object_unref);\n\n qapi_free_SocketAddress(saddr);\n\n}\n"}} {"sample_id": "d96391c1ffeb30a0afa695c86579517c69d9a889_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n target_ulong helper_rdhwr_synci_step(CPUMIPSState *env)\n+\n {\n \n check_hwrena(env, 1);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "target_ulong helper_rdhwr_synci_step(CPUMIPSState *env)\n\n{\n\n check_hwrena(env, 1);\n\n return env->SYNCI_Step;\n\n}\n"}} {"sample_id": "eff235eb2bcd7092901f4698a7907e742f3b7f2f", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static ExitStatus trans_fop_dew_0c(DisasContext *ctx, uint32_t insn,\n \n const DisasInsn *di)\n+\n {\n \n unsigned rt = extract32(insn, 0, 5);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static ExitStatus trans_fop_dew_0c(DisasContext *ctx, uint32_t insn,\n\n const DisasInsn *di)\n\n{\n\n unsigned rt = extract32(insn, 0, 5);\n\n unsigned ra = extract32(insn, 21, 5);\n\n return do_fop_dew(ctx, rt, ra, di->f_dew);\n\n}\n"}} {"sample_id": "bc7c08a2c375acb7ae4d433054415588b176d34c_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n const char *str = \"0123\";\n+\n+ char f = 'X';\n+\n+ const char *endptr = &f;\n+\n uint64_t res = 999;\n \n int err;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_qemu_strtoull_octal(void)\n\n{\n\n const char *str = \"0123\";\n\n char f = 'X';\n\n const char *endptr = &f;\n\n uint64_t res = 999;\n\n int err;\n\n\n\n err = qemu_strtoull(str, &endptr, 8, &res);\n\n\n\n g_assert_cmpint(err, ==, 0);\n\n g_assert_cmpint(res, ==, 0123);\n\n g_assert(endptr == str + strlen(str));\n\n\n\n endptr = &f;\n\n res = 999;\n\n err = qemu_strtoull(str, &endptr, 0, &res);\n\n\n\n g_assert_cmpint(err, ==, 0);\n\n g_assert_cmpint(res, ==, 0123);\n\n g_assert(endptr == str + strlen(str));\n\n}\n"}} {"sample_id": "0c46e958d1fd3817b8e9fa048d0450d509c80378", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,12 +3,12 @@\n {\n \n const uint8_t *buf_ptr, *end_ptr;\n+\n+ uint8_t *data_ptr;\n \n int i;\n \n+\n \n if (length > 61444) /* worst case PAL 1920 samples 8 channels */\n \n@@ -16,7 +16,7 @@\n \n av_new_packet(pkt, length);\n \n+ avio_read(pb, pkt->data, length);\n \n data_ptr = pkt->data;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static int mxf_get_d10_aes3_packet(AVIOContext *pb, AVStream *st, AVPacket *pkt, int64_t length)\n\n{\n\n const uint8_t *buf_ptr, *end_ptr;\n\n uint8_t *data_ptr;\n\n int i;\n\n\n\n if (length > 61444) /* worst case PAL 1920 samples 8 channels */\n\n return -1;\n\n av_new_packet(pkt, length);\n\n avio_read(pb, pkt->data, length);\n\n data_ptr = pkt->data;\n\n end_ptr = pkt->data + length;\n\n buf_ptr = pkt->data + 4; /* skip SMPTE 331M header */\n\n for (; buf_ptr < end_ptr; ) {\n\n for (i = 0; i < st->codec->channels; i++) {\n\n uint32_t sample = bytestream_get_le32(&buf_ptr);\n\n if (st->codec->bits_per_coded_sample == 24)\n\n bytestream_put_le24(&data_ptr, (sample >> 4) & 0xffffff);\n\n else\n\n bytestream_put_le16(&data_ptr, (sample >> 12) & 0xffff);\n\n }\n\n buf_ptr += 32 - st->codec->channels*4; // always 8 channels stored SMPTE 331M\n\n }\n\n pkt->size = data_ptr - pkt->data;\n\n return 0;\n\n}\n"}} {"sample_id": "ee5b34d56e7fa9c1eb1a2aeb2bf7b55516c99c8a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static uint16_t mlp_checksum16(const uint8_t *buf, unsigned int buf_size)\n \n+{\n+\n+ uint16_t crc;\n+\n+\n \n if (!crc_init) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint16_t mlp_checksum16(const uint8_t *buf, unsigned int buf_size)\n\n{\n\n uint16_t crc;\n\n\n\n if (!crc_init) {\n\n av_crc_init(crc_2D, 0, 16, 0x002D, sizeof(crc_2D));\n\n crc_init = 1;\n\n }\n\n\n\n crc = av_crc(crc_2D, 0, buf, buf_size - 2);\n\n crc ^= AV_RL16(buf + buf_size - 2);\n\n return crc;\n\n}\n"}} {"sample_id": "0fbc20740342713f282b118b4a446c4c43df3f4a", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,11 +13,11 @@\n if (s->irq_routes->nr == s->nr_allocated_irq_routes) {\n \n n = s->nr_allocated_irq_routes * 2;\n+\n+ if (n < 64) {\n+\n+ n = 64;\n+\n }\n \n size = sizeof(struct kvm_irq_routing);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void kvm_add_routing_entry(KVMState *s,\n\n struct kvm_irq_routing_entry *entry)\n\n{\n\n struct kvm_irq_routing_entry *new;\n\n int n, size;\n\n\n\n if (s->irq_routes->nr == s->nr_allocated_irq_routes) {\n\n n = s->nr_allocated_irq_routes * 2;\n\n if (n < 64) {\n\n n = 64;\n\n }\n\n size = sizeof(struct kvm_irq_routing);\n\n size += n * sizeof(*new);\n\n s->irq_routes = g_realloc(s->irq_routes, size);\n\n s->nr_allocated_irq_routes = n;\n\n }\n\n n = s->irq_routes->nr++;\n\n new = &s->irq_routes->entries[n];\n\n memset(new, 0, sizeof(*new));\n\n new->gsi = entry->gsi;\n\n new->type = entry->type;\n\n new->flags = entry->flags;\n\n new->u = entry->u;\n\n\n\n set_gsi(s, entry->gsi);\n\n}\n"}} {"sample_id": "0479097859372a760843ad1b9c6ed3705c6423ca_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static MemoryRegion *pc_dimm_get_memory_region(PCDIMMDevice *dimm)\n+\n {\n \n return host_memory_backend_get_memory(dimm->hostmem, &error_abort);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static MemoryRegion *pc_dimm_get_memory_region(PCDIMMDevice *dimm)\n\n{\n\n return host_memory_backend_get_memory(dimm->hostmem, &error_abort);\n\n}\n"}} {"sample_id": "0d3a51e5d279dd2a56c81ba7a81a70128c5a7545", "diff": "--- a/source.c\n+++ b/source.c\n@@ -38,11 +38,11 @@\n \n \n break;\n+\n+ case 1: ea->audio_codec = CODEC_ID_PCM_MULAW; ea->bytes = 1; break;\n+\n+ case 2: ea->audio_codec = CODEC_ID_ADPCM_IMA_EA_EACS; break;\n+\n default:\n \n av_log (s, AV_LOG_ERROR, \"unsupported stream type; audio compression_type=%i\\n\", compression_type);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int process_audio_header_eacs(AVFormatContext *s)\n\n{\n\n EaDemuxContext *ea = s->priv_data;\n\n AVIOContext *pb = s->pb;\n\n int compression_type;\n\n\n\n ea->sample_rate = ea->big_endian ? avio_rb32(pb) : avio_rl32(pb);\n\n ea->bytes = avio_r8(pb); /* 1=8-bit, 2=16-bit */\n\n\n\n\n\n ea->num_channels = avio_r8(pb);\n\n compression_type = avio_r8(pb);\n\n avio_skip(pb, 13);\n\n\n\n switch (compression_type) {\n\n case 0:\n\n switch (ea->bytes) {\n\n case 1: ea->audio_codec = CODEC_ID_PCM_S8; break;\n\n case 2: ea->audio_codec = CODEC_ID_PCM_S16LE; break;\n\n\n break;\n\n case 1: ea->audio_codec = CODEC_ID_PCM_MULAW; ea->bytes = 1; break;\n\n case 2: ea->audio_codec = CODEC_ID_ADPCM_IMA_EA_EACS; break;\n\n default:\n\n av_log (s, AV_LOG_ERROR, \"unsupported stream type; audio compression_type=%i\\n\", compression_type);\n\n\n\n\n return 1;\n"}} {"sample_id": "91be2ad756d658acc24fec5bc46c1775158d28b0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n \n \n+ state->window = 0;\n \n state->readahead = 32;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void hdcd_reset(hdcd_state *state, unsigned rate, unsigned cdt_ms)\n\n{\n\n int i;\n\n\n\n state->window = 0;\n\n state->readahead = 32;\n\n state->arg = 0;\n\n state->control = 0;\n\n\n\n state->running_gain = 0;\n\n\n\n state->sustain = 0;\n\n state->sustain_reset = cdt_ms*rate/1000;\n\n\n\n state->code_counterA = 0;\n\n state->code_counterA_almost = 0;\n\n state->code_counterB = 0;\n\n state->code_counterB_checkfails = 0;\n\n state->code_counterC = 0;\n\n state->code_counterC_unmatched = 0;\n\n state->count_peak_extend = 0;\n\n state->count_transient_filter = 0;\n\n for(i = 0; i < 16; i++) state->gain_counts[i] = 0;\n\n state->max_gain = 0;\n\n state->count_sustain_expired = -1;\n\n\n\n state->_ana_snb = 0;\n\n}\n"}} {"sample_id": "94fb0909645de18481cc726ee0ec9b5afa861394_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,25 +1,25 @@\n+static int ram_load_dead(QEMUFile *f, void *opaque)\n+\n+{\n+\n+ RamDecompressState s1, *s = &s1;\n+\n+ uint8_t buf[10];\n+\n+ ram_addr_t i;\n \n+\n+\n+ if (ram_decompress_open(s, f) < 0)\n+\n return -EINVAL;\n \n+ for(i = 0; i < last_ram_offset; i+= BDRV_HASH_BLOCK_SIZE) {\n+\n if (ram_decompress_buf(s, buf, 1) < 0) {\n \n+ fprintf(stderr, \"Error while reading ram block header\\n\");\n+\n goto error;\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int ram_load_dead(QEMUFile *f, void *opaque)\n\n{\n\n RamDecompressState s1, *s = &s1;\n\n uint8_t buf[10];\n\n ram_addr_t i;\n\n\n\n if (ram_decompress_open(s, f) < 0)\n\n return -EINVAL;\n\n for(i = 0; i < last_ram_offset; i+= BDRV_HASH_BLOCK_SIZE) {\n\n if (ram_decompress_buf(s, buf, 1) < 0) {\n\n fprintf(stderr, \"Error while reading ram block header\\n\");\n\n goto error;\n\n }\n\n if (buf[0] == 0) {\n\n if (ram_decompress_buf(s, qemu_get_ram_ptr(i),\n\n BDRV_HASH_BLOCK_SIZE) < 0) {\n\n fprintf(stderr, \"Error while reading ram block address=0x%08\" PRIx64, (uint64_t)i);\n\n goto error;\n\n }\n\n } else {\n\n error:\n\n printf(\"Error block header\\n\");\n\n return -EINVAL;\n\n }\n\n }\n\n ram_decompress_close(s);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "b7b5233ad7fdd9985bb6d05b7919f3a20723ff2c_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,13 +1,13 @@\n+static void *bsd_vmalloc(size_t size)\n+\n+{\n+\n+ void *p;\n+\n+ mmap_lock();\n \n+ /* Use map and mark the pages as used. */\n+\n p = mmap(NULL, size, PROT_READ | PROT_WRITE,\n \n MAP_PRIVATE | MAP_ANON, -1, 0);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void *bsd_vmalloc(size_t size)\n\n{\n\n void *p;\n\n mmap_lock();\n\n /* Use map and mark the pages as used. */\n\n p = mmap(NULL, size, PROT_READ | PROT_WRITE,\n\n MAP_PRIVATE | MAP_ANON, -1, 0);\n\n\n\n if (h2g_valid(p)) {\n\n /* Allocated region overlaps guest address space.\n\n This may recurse. */\n\n abi_ulong addr = h2g(p);\n\n page_set_flags(addr & TARGET_PAGE_MASK, TARGET_PAGE_ALIGN(addr + size),\n\n PAGE_RESERVED);\n\n }\n\n\n\n mmap_unlock();\n\n return p;\n\n}\n"}} {"sample_id": "8d2f850a5ab7579a852f23b28273940a47dfd7ff", "diff": "--- a/source.c\n+++ b/source.c\n@@ -30,11 +30,11 @@\n \n \n \n+ /* Lest we fail to service interrupts in a timely manner, limit the\n+\n+ amount of work we're willing to do. For now, let's cap at 8k. */\n+\n+ for (len = 0; len < 0x2000; ++len) {\n \n if (str + len == end) {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void HELPER(srst)(CPUS390XState *env, uint32_t r1, uint32_t r2)\n\n{\n\n uintptr_t ra = GETPC();\n\n uint64_t end, str;\n\n uint32_t len;\n\n uint8_t v, c = env->regs[0];\n\n\n\n /* Bits 32-55 must contain all 0. */\n\n if (env->regs[0] & 0xffffff00u) {\n\n cpu_restore_state(ENV_GET_CPU(env), ra);\n\n program_interrupt(env, PGM_SPECIFICATION, 6);\n\n }\n\n\n\n str = get_address(env, r2);\n\n end = get_address(env, r1);\n\n\n\n /* Lest we fail to service interrupts in a timely manner, limit the\n\n amount of work we're willing to do. For now, let's cap at 8k. */\n\n for (len = 0; len < 0x2000; ++len) {\n\n if (str + len == end) {\n\n /* Character not found. R1 & R2 are unmodified. */\n\n env->cc_op = 2;\n\n return;\n\n }\n\n v = cpu_ldub_data_ra(env, str + len, ra);\n\n if (v == c) {\n\n /* Character found. Set R1 to the location; R2 is unmodified. */\n\n env->cc_op = 1;\n\n set_address(env, r1, str + len);\n\n return;\n\n }\n\n }\n\n\n\n /* CPU-determined bytes processed. Advance R2 to next byte to process. */\n\n env->cc_op = 3;\n\n set_address(env, r2, str + len);\n\n}\n"}} {"sample_id": "2df0c32ea12ddfa72ba88309812bfb13b674130f_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -37,11 +37,11 @@\n bytestream_put_byte(&p, coupled_stream_count);\n \n bytestream_put_buffer(&p, channel_mapping, channels);\n+\n+ } else {\n+\n+ bytestream_put_byte(&p, 0);\n+\n }\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void libopus_write_header(AVCodecContext *avctx, int stream_count,\n\n int coupled_stream_count,\n\n const uint8_t *channel_mapping)\n\n{\n\n uint8_t *p = avctx->extradata;\n\n int channels = avctx->channels;\n\n\n\n bytestream_put_buffer(&p, \"OpusHead\", 8);\n\n bytestream_put_byte(&p, 1); /* Version */\n\n bytestream_put_byte(&p, channels);\n\n bytestream_put_le16(&p, avctx->delay); /* Lookahead samples at 48kHz */\n\n bytestream_put_le32(&p, avctx->sample_rate); /* Original sample rate */\n\n bytestream_put_le16(&p, 0); /* Gain of 0dB is recommended. */\n\n\n\n /* Channel mapping */\n\n if (channels > 2) {\n\n bytestream_put_byte(&p, channels <= 8 ? 1 : 255);\n\n bytestream_put_byte(&p, stream_count);\n\n bytestream_put_byte(&p, coupled_stream_count);\n\n bytestream_put_buffer(&p, channel_mapping, channels);\n\n } else {\n\n bytestream_put_byte(&p, 0);\n\n }\n\n}\n"}} {"sample_id": "bbbc8c618884a838c00faaaa91898017dd431117", "diff": "--- a/source.c\n+++ b/source.c\n@@ -39,11 +39,11 @@\n ((msc->pb != s->pb && dts < best_dts) || (msc->pb == s->pb &&\n \n ((FFABS(best_dts - dts) <= AV_TIME_BASE && current_sample->pos < sample->pos) ||\n+\n+ (FFABS(best_dts - dts) > AV_TIME_BASE && dts < best_dts)))))) {\n+\n+ sample = current_sample;\n+\n best_dts = dts;\n \n *st = avst;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static AVIndexEntry *mov_find_next_sample(AVFormatContext *s, AVStream **st)\n\n{\n\n AVIndexEntry *sample = NULL;\n\n int64_t best_dts = INT64_MAX;\n\n int i;\n\n for (i = 0; i < s->nb_streams; i++) {\n\n AVStream *avst = s->streams[i];\n\n MOVStreamContext *msc = avst->priv_data;\n\n if (msc->pb && msc->current_sample < avst->nb_index_entries) {\n\n AVIndexEntry *current_sample = &avst->index_entries[msc->current_sample];\n\n int64_t dts;\n\n if (msc->ctts_data)\n\n dts = av_rescale(current_sample->timestamp - msc->dts_shift - msc->ctts_data[msc->ctts_index].duration,\n\n AV_TIME_BASE, msc->time_scale);\n\n else\n\n dts = av_rescale(current_sample->timestamp, AV_TIME_BASE, msc->time_scale);\n\n av_dlog(s, \"stream %d, sample %d, dts %\"PRId64\"\\n\", i, msc->current_sample, dts);\n\n if (!sample || (!s->pb->seekable && current_sample->pos < sample->pos) ||\n\n (s->pb->seekable &&\n\n ((msc->pb != s->pb && dts < best_dts) || (msc->pb == s->pb &&\n\n ((FFABS(best_dts - dts) <= AV_TIME_BASE && current_sample->pos < sample->pos) ||\n\n (FFABS(best_dts - dts) > AV_TIME_BASE && dts < best_dts)))))) {\n\n sample = current_sample;\n\n best_dts = dts;\n\n *st = avst;\n\n }\n\n }\n\n }\n\n return sample;\n\n}\n"}} {"sample_id": "220b24c7c97dc033ceab1510549f66d0e7b52ef1_9", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n+static void libschroedinger_decode_buffer_free(SchroBuffer *schro_buf,\n+\n void *priv)\n \n {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void libschroedinger_decode_buffer_free(SchroBuffer *schro_buf,\n\n void *priv)\n\n{\n\n av_freep(&priv);\n\n}\n"}} {"sample_id": "a7812ae412311d7d47f8aa85656faadac9d64b56_54", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n \ttcg_gen_movi_tl(tmp, 4);\n \n+\ttcg_gen_mov_tl(addr, cpu_R[dc->op1]);\n+\n+\tfor (i = 0; i <= dc->op2; i++) {\n+\n+\t\t/* Displace addr. */\n \n \t\t/* Perform the store. */\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static unsigned int dec_movem_rm(DisasContext *dc)\n\n{\n\n\tTCGv tmp;\n\n\tTCGv addr;\n\n\tint i;\n\n\n\n\tDIS(fprintf (logfile, \"movem $r%u, [$r%u%s\\n\", dc->op2, dc->op1,\n\n\t\t dc->postinc ? \"+]\" : \"]\"));\n\n\n\n\tcris_flush_cc_state(dc);\n\n\n\n\ttmp = tcg_temp_new(TCG_TYPE_TL);\n\n\taddr = tcg_temp_new(TCG_TYPE_TL);\n\n\ttcg_gen_movi_tl(tmp, 4);\n\n\ttcg_gen_mov_tl(addr, cpu_R[dc->op1]);\n\n\tfor (i = 0; i <= dc->op2; i++) {\n\n\t\t/* Displace addr. */\n\n\t\t/* Perform the store. */\n\n\t\tgen_store(dc, addr, cpu_R[i], 4);\n\n\t\ttcg_gen_add_tl(addr, addr, tmp);\n\n\t}\n\n\tif (dc->postinc)\n\n\t\ttcg_gen_mov_tl(cpu_R[dc->op1], addr);\n\n\tcris_cc_mask(dc, 0);\n\n\ttcg_temp_free(tmp);\n\n\ttcg_temp_free(addr);\n\n\treturn 2;\n\n}\n"}} {"sample_id": "60fe637bf0e4d7989e21e50f52526444765c63b4_77", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,8 +16,8 @@\n \n \n \n+ qemu_set_fd_handler2(s, NULL, unix_accept_incoming_migration, NULL,\n+\n+ (void *)(intptr_t)s);\n+\n+}", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "void unix_start_incoming_migration(const char *path, Error **errp)\n\n{\n\n int s;\n\n\n\n s = unix_listen(path, NULL, 0, errp);\n\n if (s < 0) {\n\n return;\n\n }\n\n\n\n qemu_set_fd_handler2(s, NULL, unix_accept_incoming_migration, NULL,\n\n (void *)(intptr_t)s);\n\n}\n"}} {"sample_id": "9054f6b66b3883d615177c738cb69c6337c4375c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n if(st->request_probe>0){\n \n AVProbeData *pd = &st->probe_data;\n+\n int end;\n \n av_log(s, AV_LOG_DEBUG, \"probing stream %d pp:%d\\n\", st->index, st->probe_packets);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void probe_codec(AVFormatContext *s, AVStream *st, const AVPacket *pkt)\n\n{\n\n if(st->request_probe>0){\n\n AVProbeData *pd = &st->probe_data;\n\n int end;\n\n av_log(s, AV_LOG_DEBUG, \"probing stream %d pp:%d\\n\", st->index, st->probe_packets);\n\n --st->probe_packets;\n\n\n\n if (pkt) {\n\n pd->buf = av_realloc(pd->buf, pd->buf_size+pkt->size+AVPROBE_PADDING_SIZE);\n\n memcpy(pd->buf+pd->buf_size, pkt->data, pkt->size);\n\n pd->buf_size += pkt->size;\n\n memset(pd->buf+pd->buf_size, 0, AVPROBE_PADDING_SIZE);\n\n } else {\n\n st->probe_packets = 0;\n\n }\n\n\n\n end= s->raw_packet_buffer_remaining_size <= 0\n\n || st->probe_packets<=0;\n\n\n\n if(end || av_log2(pd->buf_size) != av_log2(pd->buf_size - pkt->size)){\n\n int score= set_codec_from_probe_data(s, st, pd);\n\n if( (st->codec->codec_id != CODEC_ID_NONE && score > AVPROBE_SCORE_MAX/4)\n\n || end){\n\n pd->buf_size=0;\n\n av_freep(&pd->buf);\n\n st->request_probe= -1;\n\n if(st->codec->codec_id != CODEC_ID_NONE){\n\n av_log(s, AV_LOG_DEBUG, \"probed stream %d\\n\", st->index);\n\n }else\n\n av_log(s, AV_LOG_WARNING, \"probed stream %d failed\\n\", st->index);\n\n }\n\n }\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_273", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static void musicpal_misc_write(void *opaque, target_phys_addr_t offset,\n \n uint64_t value, unsigned size)\n+\n {\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void musicpal_misc_write(void *opaque, target_phys_addr_t offset,\n\n uint64_t value, unsigned size)\n\n{\n\n}\n"}} {"sample_id": "16617e36b02ebdc83f215d89db9ac00f7d6d6d83", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,7 +2,7 @@\n \n {\n \n+ BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));\n \n VirtioBusState *vbus = VIRTIO_BUS(qbus);\n \n@@ -10,19 +10,19 @@\n \n int i, r;\n \n+ if (!k->set_host_notifier) {\n \n fprintf(stderr, \"binding does not support host notifiers\\n\");\n \n r = -ENOSYS;\n \n goto fail;\n+\n }\n \n \n \n+ for (i = 0; i < hdev->nvqs; ++i) {\n \n r = k->set_host_notifier(qbus->parent, hdev->vq_index + i, true);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "int vhost_dev_enable_notifiers(struct vhost_dev *hdev, VirtIODevice *vdev)\n\n{\n\n BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));\n\n VirtioBusState *vbus = VIRTIO_BUS(qbus);\n\n VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(vbus);\n\n int i, r;\n\n if (!k->set_host_notifier) {\n\n fprintf(stderr, \"binding does not support host notifiers\\n\");\n\n r = -ENOSYS;\n\n goto fail;\n\n }\n\n\n\n for (i = 0; i < hdev->nvqs; ++i) {\n\n r = k->set_host_notifier(qbus->parent, hdev->vq_index + i, true);\n\n if (r < 0) {\n\n fprintf(stderr, \"vhost VQ %d notifier binding failed: %d\\n\", i, -r);\n\n goto fail_vq;\n\n }\n\n }\n\n\n\n return 0;\n\nfail_vq:\n\n while (--i >= 0) {\n\n r = k->set_host_notifier(qbus->parent, hdev->vq_index + i, false);\n\n if (r < 0) {\n\n fprintf(stderr, \"vhost VQ %d notifier cleanup error: %d\\n\", i, -r);\n\n fflush(stderr);\n\n }\n\n assert (r >= 0);\n\n }\n\nfail:\n\n return r;\n\n}\n"}} {"sample_id": "ebfe154bd52204a4da19d26d8d5ae0f8003558ac", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n \n \n if (overflow == (MODEL_ELEMENTS - 1)) {\n+\n tmpk = range_decode_bits(ctx, 5);\n \n overflow = 0;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static inline int ape_decode_value_3900(APEContext *ctx, APERice *rice)\n\n{\n\n unsigned int x, overflow;\n\n int tmpk;\n\n\n\n overflow = range_get_symbol(ctx, counts_3970, counts_diff_3970);\n\n\n\n if (overflow == (MODEL_ELEMENTS - 1)) {\n\n tmpk = range_decode_bits(ctx, 5);\n\n overflow = 0;\n\n } else\n\n tmpk = (rice->k < 1) ? 0 : rice->k - 1;\n\n\n\n if (tmpk <= 16 || ctx->fileversion < 3910) {\n\n if (tmpk > 23) {\n\n av_log(ctx->avctx, AV_LOG_ERROR, \"Too many bits: %d\\n\", tmpk);\n\n return AVERROR_INVALIDDATA;\n\n }\n\n x = range_decode_bits(ctx, tmpk);\n\n } else if (tmpk <= 32) {\n\n x = range_decode_bits(ctx, 16);\n\n x |= (range_decode_bits(ctx, tmpk - 16) << 16);\n\n } else {\n\n av_log(ctx->avctx, AV_LOG_ERROR, \"Too many bits: %d\\n\", tmpk);\n\n return AVERROR_INVALIDDATA;\n\n }\n\n x += overflow << tmpk;\n\n\n\n update_rice(rice, x);\n\n\n\n /* Convert to signed */\n\n if (x & 1)\n\n return (x >> 1) + 1;\n\n else\n\n return -(x >> 1);\n\n}\n"}} {"sample_id": "c2e50e3d11a0bf4c973cc30478c1af0f2d5f8e81", "diff": "--- a/source.c\n+++ b/source.c\n@@ -43,11 +43,11 @@\n qemu_cond_wait(&pool->check_cancel, &pool->lock);\n \n }\n+\n+ pool->pending_cancellations--;\n+\n+ }\n+\n qemu_mutex_unlock(&pool->lock);\n \n event_notifier_ready(&pool->notifier);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void thread_pool_cancel(BlockDriverAIOCB *acb)\n\n{\n\n ThreadPoolElement *elem = (ThreadPoolElement *)acb;\n\n ThreadPool *pool = elem->pool;\n\n\n\n trace_thread_pool_cancel(elem, elem->common.opaque);\n\n\n\n qemu_mutex_lock(&pool->lock);\n\n if (elem->state == THREAD_QUEUED &&\n\n /* No thread has yet started working on elem. we can try to \"steal\"\n\n * the item from the worker if we can get a signal from the\n\n * semaphore. Because this is non-blocking, we can do it with\n\n * the lock taken and ensure that elem will remain THREAD_QUEUED.\n\n */\n\n qemu_sem_timedwait(&pool->sem, 0) == 0) {\n\n QTAILQ_REMOVE(&pool->request_list, elem, reqs);\n\n elem->state = THREAD_CANCELED;\n\n event_notifier_set(&pool->notifier);\n\n } else {\n\n pool->pending_cancellations++;\n\n while (elem->state != THREAD_CANCELED && elem->state != THREAD_DONE) {\n\n qemu_cond_wait(&pool->check_cancel, &pool->lock);\n\n }\n\n pool->pending_cancellations--;\n\n }\n\n qemu_mutex_unlock(&pool->lock);\n\n event_notifier_ready(&pool->notifier);\n\n}\n"}} {"sample_id": "fd728f2f949273563f799640b863b4b94dc4c6da", "diff": "--- a/source.c\n+++ b/source.c\n@@ -20,11 +20,11 @@\n \n res = 0xffffffff;\n \n+ float_raise( float_flag_invalid STATUS_VAR);\n+\n+ } else {\n+\n+ res = v;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "uint32 float64_to_uint32_round_to_zero( float64 a STATUS_PARAM )\n\n{\n\n int64_t v;\n\n uint32 res;\n\n\n\n v = float64_to_int64_round_to_zero(a STATUS_VAR);\n\n if (v < 0) {\n\n res = 0;\n\n float_raise( float_flag_invalid STATUS_VAR);\n\n } else if (v > 0xffffffff) {\n\n res = 0xffffffff;\n\n float_raise( float_flag_invalid STATUS_VAR);\n\n } else {\n\n res = v;\n\n }\n\n return res;\n\n}\n"}} {"sample_id": "c3e10c7b4377c1cbc0a4fbc12312c2cf41c0cda7_11", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static always_inline void gen_op_subfeo_64 (void)\n+\n {\n+\n gen_op_move_T2_T0();\n \n gen_op_subfe_64();", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static always_inline void gen_op_subfeo_64 (void)\n\n{\n\n gen_op_move_T2_T0();\n\n gen_op_subfe_64();\n\n gen_op_check_subfo_64();\n\n}\n"}} {"sample_id": "ff2c222c379645cb7825b8ddc222142dcaea1677", "diff": "--- a/source.c\n+++ b/source.c\n@@ -39,11 +39,11 @@\n if (get_buffer(pb, (uint8_t *) *str, size) != size) {\n \n offset_t pos = url_ftell(pb);\n+\n+ av_log(matroska->ctx, AV_LOG_ERROR,\n+\n+ \"Read error at pos. %\"PRIu64\" (0x%\"PRIx64\")\\n\", pos, pos);\n+\n \n return AVERROR(EIO);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "ebml_read_ascii (MatroskaDemuxContext *matroska,\n\n uint32_t *id,\n\n char **str)\n\n{\n\n ByteIOContext *pb = matroska->ctx->pb;\n\n int size, res;\n\n uint64_t rlength;\n\n\n\n if ((res = ebml_read_element_id(matroska, id, NULL)) < 0 ||\n\n (res = ebml_read_element_length(matroska, &rlength)) < 0)\n\n return res;\n\n size = rlength;\n\n\n\n /* ebml strings are usually not 0-terminated, so we allocate one\n\n * byte more, read the string and NULL-terminate it ourselves. */\n\n if (size < 0 || !(*str = av_malloc(size + 1))) {\n\n av_log(matroska->ctx, AV_LOG_ERROR, \"Memory allocation failed\\n\");\n\n return AVERROR(ENOMEM);\n\n }\n\n if (get_buffer(pb, (uint8_t *) *str, size) != size) {\n\n offset_t pos = url_ftell(pb);\n\n av_log(matroska->ctx, AV_LOG_ERROR,\n\n \"Read error at pos. %\"PRIu64\" (0x%\"PRIx64\")\\n\", pos, pos);\n\n\n return AVERROR(EIO);\n\n }\n\n (*str)[size] = '\\0';\n\n\n\n return 0;\n\n}"}} {"sample_id": "51b19ebe4320f3dcd93cea71235c1219318ddfd2_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,10 +2,10 @@\n \n {\n \n+ VirtIOBlockReq *req = g_new(VirtIOBlockReq, 1);\n+\n+ req->dev = s;\n+\n req->qiov.size = 0;\n \n req->in_len = 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "VirtIOBlockReq *virtio_blk_alloc_request(VirtIOBlock *s)\n\n{\n\n VirtIOBlockReq *req = g_new(VirtIOBlockReq, 1);\n\n req->dev = s;\n\n req->qiov.size = 0;\n\n req->in_len = 0;\n\n req->next = NULL;\n\n req->mr_next = NULL;\n\n return req;\n\n}\n"}} {"sample_id": "c86f106b857dd8922e29ec746a8dd47e8a15ebbd", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void rtas_ibm_os_term(PowerPCCPU *cpu,\n \n+ sPAPRMachineState *spapr,\n \n uint32_t token, uint32_t nargs,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void rtas_ibm_os_term(PowerPCCPU *cpu,\n\n sPAPRMachineState *spapr,\n\n uint32_t token, uint32_t nargs,\n\n target_ulong args,\n\n uint32_t nret, target_ulong rets)\n\n{\n\n target_ulong ret = 0;\n\n\n\n qapi_event_send_guest_panicked(GUEST_PANIC_ACTION_PAUSE, &error_abort);\n\n\n\n rtas_st(rets, 0, ret);\n\n}\n"}} {"sample_id": "7385aed20db5d83979f683b9d0048674411e963c_8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ switch (fccno) {\n+\n+ case 0:\n+\n+ gen_helper_fcmpeq(cpu_env);\n \n break;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void gen_op_fcmpeq(int fccno)\n\n{\n\n switch (fccno) {\n\n case 0:\n\n gen_helper_fcmpeq(cpu_env);\n\n break;\n\n case 1:\n\n gen_helper_fcmpeq_fcc1(cpu_env);\n\n break;\n\n case 2:\n\n gen_helper_fcmpeq_fcc2(cpu_env);\n\n break;\n\n case 3:\n\n gen_helper_fcmpeq_fcc3(cpu_env);\n\n break;\n\n }\n\n}\n"}} {"sample_id": "86ab6b6e08e2982fb5785e0691c0a7e289339ffb", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static int decode_value(SCPRContext *s, unsigned *cnt, unsigned maxc, unsigned step, unsigned *rval)\n \n+{\n+\n+ GetByteContext *gb = &s->gb;\n+\n+ RangeCoder *rc = &s->rc;\n \n unsigned totfr = cnt[maxc];\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int decode_value(SCPRContext *s, unsigned *cnt, unsigned maxc, unsigned step, unsigned *rval)\n\n{\n\n GetByteContext *gb = &s->gb;\n\n RangeCoder *rc = &s->rc;\n\n unsigned totfr = cnt[maxc];\n\n unsigned value;\n\n unsigned c = 0, cumfr = 0, cnt_c = 0;\n\n int i, ret;\n\n\n\n if ((ret = s->get_freq(rc, totfr, &value)) < 0)\n\n return ret;\n\n\n\n while (c < maxc) {\n\n cnt_c = cnt[c];\n\n if (value >= cumfr + cnt_c)\n\n cumfr += cnt_c;\n\n else\n\n break;\n\n c++;\n\n }\n\n s->decode(gb, rc, cumfr, cnt_c, totfr);\n\n\n\n cnt[c] = cnt_c + step;\n\n totfr += step;\n\n if (totfr > BOT) {\n\n totfr = 0;\n\n for (i = 0; i < maxc; i++) {\n\n unsigned nc = (cnt[i] >> 1) + 1;\n\n cnt[i] = nc;\n\n totfr += nc;\n\n }\n\n }\n\n\n\n cnt[maxc] = totfr;\n\n *rval = c;\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "3cffbe090a5168dcfe580de8d662a32e7ad1d911", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n \n \n s->av_class= &av_codec_context_class;\n+\n \n \n s->codec_type = codec_type;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void avcodec_get_context_defaults2(AVCodecContext *s, enum CodecType codec_type){\n\n int flags=0;\n\n memset(s, 0, sizeof(AVCodecContext));\n\n\n\n s->av_class= &av_codec_context_class;\n\n\n\n s->codec_type = codec_type;\n\n if(codec_type == CODEC_TYPE_AUDIO)\n\n flags= AV_OPT_FLAG_AUDIO_PARAM;\n\n else if(codec_type == CODEC_TYPE_VIDEO)\n\n flags= AV_OPT_FLAG_VIDEO_PARAM;\n\n else if(codec_type == CODEC_TYPE_SUBTITLE)\n\n flags= AV_OPT_FLAG_SUBTITLE_PARAM;\n\n av_opt_set_defaults2(s, flags, flags);\n\n\n\n s->rc_eq= av_strdup(\"tex^qComp\");\n\n s->time_base= (AVRational){0,1};\n\n s->get_buffer= avcodec_default_get_buffer;\n\n s->release_buffer= avcodec_default_release_buffer;\n\n s->get_format= avcodec_default_get_format;\n\n s->execute= avcodec_default_execute;\n\n s->sample_aspect_ratio= (AVRational){0,1};\n\n s->pix_fmt= PIX_FMT_NONE;\n\n s->sample_fmt= SAMPLE_FMT_S16; // FIXME: set to NONE\n\n\n\n s->palctrl = NULL;\n\n s->reget_buffer= avcodec_default_reget_buffer;\n\n}\n"}} {"sample_id": "42a268c241183877192c376d03bd9b6d527407c7_37", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void disas_comp_b_imm(DisasContext *s, uint32_t insn)\n \n+{\n+\n+ unsigned int sf, op, rt;\n+\n+ uint64_t addr;\n \n int label_match;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void disas_comp_b_imm(DisasContext *s, uint32_t insn)\n\n{\n\n unsigned int sf, op, rt;\n\n uint64_t addr;\n\n int label_match;\n\n TCGv_i64 tcg_cmp;\n\n\n\n sf = extract32(insn, 31, 1);\n\n op = extract32(insn, 24, 1); /* 0: CBZ; 1: CBNZ */\n\n rt = extract32(insn, 0, 5);\n\n addr = s->pc + sextract32(insn, 5, 19) * 4 - 4;\n\n\n\n tcg_cmp = read_cpu_reg(s, rt, sf);\n\n label_match = gen_new_label();\n\n\n\n tcg_gen_brcondi_i64(op ? TCG_COND_NE : TCG_COND_EQ,\n\n tcg_cmp, 0, label_match);\n\n\n\n gen_goto_tb(s, 0, s->pc);\n\n gen_set_label(label_match);\n\n gen_goto_tb(s, 1, addr);\n\n}\n"}} {"sample_id": "7620d48f2eab67812d8c535d12a98eaa754a1177", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+void ff_tls_init(void)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "void ff_tls_init(void)\n\n{\n\n avpriv_lock_avformat();\n\n#if CONFIG_OPENSSL\n\n if (!openssl_init) {\n\n SSL_library_init();\n\n SSL_load_error_strings();\n\n#if HAVE_THREADS\n\n if (!CRYPTO_get_locking_callback()) {\n\n int i;\n\n openssl_mutexes = av_malloc_array(sizeof(pthread_mutex_t), CRYPTO_num_locks());\n\n for (i = 0; i < CRYPTO_num_locks(); i++)\n\n pthread_mutex_init(&openssl_mutexes[i], NULL);\n\n CRYPTO_set_locking_callback(openssl_lock);\n\n#if !defined(WIN32) && OPENSSL_VERSION_NUMBER < 0x10000000\n\n CRYPTO_set_id_callback(openssl_thread_id);\n\n#endif\n\n }\n\n#endif\n\n }\n\n openssl_init++;\n\n#endif\n\n#if CONFIG_GNUTLS\n\n#if HAVE_THREADS && GNUTLS_VERSION_NUMBER < 0x020b00\n\n if (gcry_control(GCRYCTL_ANY_INITIALIZATION_P) == 0)\n\n gcry_control(GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread);\n\n#endif\n\n gnutls_global_init();\n\n#endif\n\n avpriv_unlock_avformat();\n\n}\n"}} {"sample_id": "f81e551229070f01bf747eda3f05960182db9d2a_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n {\n \n PnvChip *chip = opaque;\n+\n uint32_t pcba = pnv_xscom_pcba(chip, addr);\n \n MemTxResult result;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static void xscom_write(void *opaque, hwaddr addr, uint64_t val,\n\n unsigned width)\n\n{\n\n PnvChip *chip = opaque;\n\n uint32_t pcba = pnv_xscom_pcba(chip, addr);\n\n MemTxResult result;\n\n\n\n /* Handle some SCOMs here before dispatch */\n\n if (xscom_write_default(chip, pcba, val)) {\n\n goto complete;\n\n }\n\n\n\n address_space_stq(&chip->xscom_as, pcba << 3, val, MEMTXATTRS_UNSPECIFIED,\n\n &result);\n\n if (result != MEMTX_OK) {\n\n qemu_log_mask(LOG_GUEST_ERROR, \"XSCOM write failed at @0x%\"\n\n HWADDR_PRIx \" pcba=0x%08x data=0x%\" PRIx64 \"\\n\",\n\n addr, pcba, val);\n\n xscom_complete(current_cpu, HMER_XSCOM_FAIL | HMER_XSCOM_DONE);\n\n return;\n\n }\n\n\n\ncomplete:\n\n xscom_complete(current_cpu, HMER_XSCOM_DONE);\n\n}\n"}} {"sample_id": "ddfa3751c092feaf1e080f66587024689dfe603c_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int get_cox(J2kDecoderContext *s, J2kCodingStyle *c)\n+\n {\n \n if (s->buf_end - s->buf < 5)\n+\n return AVERROR(EINVAL);\n \n c->nreslevels = bytestream_get_byte(&s->buf) + 1; // num of resolution levels - 1\n@@ -11,7 +11,7 @@\n c->log2_cblk_width = bytestream_get_byte(&s->buf) + 2; // cblk width\n \n c->log2_cblk_height = bytestream_get_byte(&s->buf) + 2; // cblk height\n+\n \n \n c->cblk_style = bytestream_get_byte(&s->buf);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static int get_cox(J2kDecoderContext *s, J2kCodingStyle *c)\n\n{\n\n if (s->buf_end - s->buf < 5)\n\n return AVERROR(EINVAL);\n\n c->nreslevels = bytestream_get_byte(&s->buf) + 1; // num of resolution levels - 1\n\n c->log2_cblk_width = bytestream_get_byte(&s->buf) + 2; // cblk width\n\n c->log2_cblk_height = bytestream_get_byte(&s->buf) + 2; // cblk height\n\n\n\n c->cblk_style = bytestream_get_byte(&s->buf);\n\n if (c->cblk_style != 0){ // cblk style\n\n av_log(s->avctx, AV_LOG_WARNING, \"extra cblk styles %X\\n\", c->cblk_style);\n\n }\n\n c->transform = bytestream_get_byte(&s->buf); // transformation\n\n if (c->csty & J2K_CSTY_PREC) {\n\n int i;\n\n for (i = 0; i < c->nreslevels; i++)\n\n bytestream_get_byte(&s->buf);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "788cf9f8c8cbda53843e060540f3e91a060eb744_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,24 +1,24 @@\n+int monitor_read_block_device_key(Monitor *mon, const char *device,\n+\n+ BlockCompletionFunc *completion_cb,\n+\n+ void *opaque)\n+\n+{\n \n+ Error *err = NULL;\n+\n BlockBackend *blk;\n \n+\n+\n+ blk = blk_by_name(device);\n+\n if (!blk) {\n+\n+ monitor_printf(mon, \"Device not found %s\\n\", device);\n \n+ return -1;\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "int monitor_read_block_device_key(Monitor *mon, const char *device,\n\n BlockCompletionFunc *completion_cb,\n\n void *opaque)\n\n{\n\n Error *err = NULL;\n\n BlockBackend *blk;\n\n\n\n blk = blk_by_name(device);\n\n if (!blk) {\n\n monitor_printf(mon, \"Device not found %s\\n\", device);\n\n return -1;\n\n }\n\n if (!blk_bs(blk)) {\n\n monitor_printf(mon, \"Device '%s' has no medium\\n\", device);\n\n return -1;\n\n }\n\n\n\n bdrv_add_key(blk_bs(blk), NULL, &err);\n\n if (err) {\n\n error_free(err);\n\n return monitor_read_bdrv_key_start(mon, blk_bs(blk), completion_cb, opaque);\n\n }\n\n\n\n if (completion_cb) {\n\n completion_cb(opaque, 0);\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "8a805c222caa0e20bf11d2267f726d0bb5917d94_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,11 +1,11 @@\n static void test_submit_aio(void)\n \n {\n+\n+ WorkerTestData data = { .n = 0, .ret = -EINPROGRESS };\n+\n+ data.aiocb = thread_pool_submit_aio(worker_cb, &data, done_cb, &data);\n+\n \n \n /* The callbacks are not called until after the first wait. */", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_submit_aio(void)\n\n{\n\n WorkerTestData data = { .n = 0, .ret = -EINPROGRESS };\n\n data.aiocb = thread_pool_submit_aio(worker_cb, &data, done_cb, &data);\n\n\n\n /* The callbacks are not called until after the first wait. */\n\n active = 1;\n\n g_assert_cmpint(data.ret, ==, -EINPROGRESS);\n\n qemu_aio_flush();\n\n g_assert_cmpint(active, ==, 0);\n\n g_assert_cmpint(data.n, ==, 1);\n\n g_assert_cmpint(data.ret, ==, 0);\n\n}\n"}} {"sample_id": "977ec47de06bdcb24f01c93bc125b7c6c221a1c5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n static void run_test(void)\n \n+{\n+\n+ unsigned int remaining;\n+\n+ int i;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void run_test(void)\n\n{\n\n unsigned int remaining;\n\n int i;\n\n\n\n while (atomic_read(&n_ready_threads) != n_rw_threads + n_rz_threads) {\n\n cpu_relax();\n\n }\n\n atomic_mb_set(&test_start, true);\n\n do {\n\n remaining = sleep(duration);\n\n } while (remaining);\n\n atomic_mb_set(&test_stop, true);\n\n\n\n for (i = 0; i < n_rw_threads; i++) {\n\n qemu_thread_join(&rw_threads[i]);\n\n }\n\n for (i = 0; i < n_rz_threads; i++) {\n\n qemu_thread_join(&rz_threads[i]);\n\n }\n\n}\n"}} {"sample_id": "7d5e199ade76c53ec316ab6779800581bb47c50a_7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n static void qmp_output_end_struct(Visitor *v, void **obj)\n+\n+{\n \n QmpOutputVisitor *qov = to_qov(v);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qmp_output_end_struct(Visitor *v, void **obj)\n\n{\n\n QmpOutputVisitor *qov = to_qov(v);\n\n QObject *value = qmp_output_pop(qov, obj);\n\n assert(qobject_type(value) == QTYPE_QDICT);\n\n}\n"}} {"sample_id": "a9416dc62c36079b93b4951c894a0b15e53bb38c", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void test_visitor_in_fail_list(TestInputVisitorData *data,\n const void *unused)\n {\n+ int64_t i64 = -1;\n+ Error *err = NULL;\n+ Visitor *v;\n /* Unvisited list tail */\n v = visitor_input_test_init(data, \"[ 1, 2, 3 ]\");\n visit_type_int(v, NULL, &i64, &error_abort);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static void test_visitor_in_fail_list(TestInputVisitorData *data,\n const void *unused)\n{\n int64_t i64 = -1;\n Error *err = NULL;\n Visitor *v;\n /* Unvisited list tail */\n v = visitor_input_test_init(data, \"[ 1, 2, 3 ]\");\n visit_type_int(v, NULL, &i64, &error_abort);\n g_assert_cmpint(i64, ==, 1);\n visit_type_int(v, NULL, &i64, &error_abort);\n g_assert_cmpint(i64, ==, 2);\n visit_check_list(v, &err);\n}"}} {"sample_id": "771b64daf9c73be98d223d3ab101a61f02cac277", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,14 +2,14 @@\n \n {\n \n+ struct qemu_laiocb *laiocb = (struct qemu_laiocb *)blockacb;\n \n+ struct io_event event;\n+\n int ret;\n \n+\n+\n if (laiocb->ret != -EINPROGRESS)\n \n return;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void laio_cancel(BlockDriverAIOCB *blockacb)\n\n{\n\n struct qemu_laiocb *laiocb = (struct qemu_laiocb *)blockacb;\n\n struct io_event event;\n\n int ret;\n\n\n\n if (laiocb->ret != -EINPROGRESS)\n\n return;\n\n\n\n /*\n\n * Note that as of Linux 2.6.31 neither the block device code nor any\n\n * filesystem implements cancellation of AIO request.\n\n * Thus the polling loop below is the normal code path.\n\n */\n\n ret = io_cancel(laiocb->ctx->ctx, &laiocb->iocb, &event);\n\n if (ret == 0) {\n\n laiocb->ret = -ECANCELED;\n\n return;\n\n }\n\n\n\n /*\n\n * We have to wait for the iocb to finish.\n\n *\n\n * The only way to get the iocb status update is by polling the io context.\n\n * We might be able to do this slightly more optimal by removing the\n\n * O_NONBLOCK flag.\n\n */\n\n while (laiocb->ret == -EINPROGRESS) {\n\n qemu_laio_completion_cb(&laiocb->ctx->e);\n\n }\n\n}\n"}} {"sample_id": "a8170e5e97ad17ca169c64ba87ae2f53850dab4c_319", "diff": "--- a/source.c\n+++ b/source.c\n@@ -12,10 +12,10 @@\n \n ret = pci_data_read(s->bus, addr, size);\n \n+ ret = qemu_bswap_len(ret, size);\n+\n+ APB_DPRINTF(\"%s: addr \" TARGET_FMT_lx \" -> %x\\n\", __func__, addr, ret);\n+\n+ return ret;\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t apb_pci_config_read(void *opaque, target_phys_addr_t addr,\n\n unsigned size)\n\n{\n\n uint32_t ret;\n\n APBState *s = opaque;\n\n\n\n ret = pci_data_read(s->bus, addr, size);\n\n ret = qemu_bswap_len(ret, size);\n\n APB_DPRINTF(\"%s: addr \" TARGET_FMT_lx \" -> %x\\n\", __func__, addr, ret);\n\n return ret;\n\n}\n"}} {"sample_id": "6796a1dd8c14843b77925cb83a3ef88706ae1dd0_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,6 +1,6 @@\n void ff_put_h264_qpel16_mc20_msa(uint8_t *dst, const uint8_t *src,\n+\n+ ptrdiff_t stride)\n \n {\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void ff_put_h264_qpel16_mc20_msa(uint8_t *dst, const uint8_t *src,\n\n ptrdiff_t stride)\n\n{\n\n avc_luma_hz_16w_msa(src - 2, stride, dst, stride, 16);\n\n}\n"}} {"sample_id": "e87190f5d20d380608f792ceb14d0def1d80e24b_3", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,11 +9,11 @@\n if (!tags)\n \n return;\n+\n+ writer_print_section_header(wctx, section_id);\n+\n+ while ((tag = av_dict_get(tags, \"\", tag, AV_DICT_IGNORE_SUFFIX)))\n+\n writer_print_string(wctx, tag->key, tag->value, 0);\n \n writer_print_section_footer(wctx);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline void show_tags(WriterContext *wctx, AVDictionary *tags, int section_id)\n\n{\n\n AVDictionaryEntry *tag = NULL;\n\n\n\n if (!tags)\n\n return;\n\n writer_print_section_header(wctx, section_id);\n\n while ((tag = av_dict_get(tags, \"\", tag, AV_DICT_IGNORE_SUFFIX)))\n\n writer_print_string(wctx, tag->key, tag->value, 0);\n\n writer_print_section_footer(wctx);\n\n}\n"}} {"sample_id": "3ad493fc5ea38c005670adc5933058a28ccabdd4", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n *page_size = TARGET_PAGE_SIZE;\n \n+\treturn get_phys_addr_mpu(env, address, access_type, is_user, phys_ptr,\n+\n+\t\t\t\t prot);\n+\n+ } else if (env->cp15.c1_sys & (1 << 23)) {\n \n return get_phys_addr_v6(env, address, access_type, is_user, phys_ptr,\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static inline int get_phys_addr(CPUState *env, uint32_t address,\n\n int access_type, int is_user,\n\n uint32_t *phys_ptr, int *prot,\n\n target_ulong *page_size)\n\n{\n\n /* Fast Context Switch Extension. */\n\n if (address < 0x02000000)\n\n address += env->cp15.c13_fcse;\n\n\n\n if ((env->cp15.c1_sys & 1) == 0) {\n\n /* MMU/MPU disabled. */\n\n *phys_ptr = address;\n\n *prot = PAGE_READ | PAGE_WRITE;\n\n *page_size = TARGET_PAGE_SIZE;\n\n return 0;\n\n } else if (arm_feature(env, ARM_FEATURE_MPU)) {\n\n *page_size = TARGET_PAGE_SIZE;\n\n\treturn get_phys_addr_mpu(env, address, access_type, is_user, phys_ptr,\n\n\t\t\t\t prot);\n\n } else if (env->cp15.c1_sys & (1 << 23)) {\n\n return get_phys_addr_v6(env, address, access_type, is_user, phys_ptr,\n\n prot, page_size);\n\n } else {\n\n return get_phys_addr_v5(env, address, access_type, is_user, phys_ptr,\n\n prot, page_size);\n\n }\n\n}\n"}} {"sample_id": "c7c35916692fe010fef25ac338443d3fe40be225", "diff": "--- a/source.c\n+++ b/source.c\n@@ -17,11 +17,11 @@\n \n \n /* Mark transfer completed */\n+\n+ if (!txcount)\n+\n+ {\n+\n DPRINTF(\"C+ mode : transmitter queue stalled, current TxDesc = %d\\n\",\n \n s->currCPlusTxDesc);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void rtl8139_cplus_transmit(RTL8139State *s)\n\n{\n\n int txcount = 0;\n\n\n\n while (rtl8139_cplus_transmit_one(s))\n\n {\n\n ++txcount;\n\n }\n\n\n\n /* Mark transfer completed */\n\n if (!txcount)\n\n {\n\n DPRINTF(\"C+ mode : transmitter queue stalled, current TxDesc = %d\\n\",\n\n s->currCPlusTxDesc);\n\n }\n\n else\n\n {\n\n /* update interrupt status */\n\n s->IntrStatus |= TxOK;\n\n rtl8139_update_irq(s);\n\n }\n\n}\n"}} {"sample_id": "2aece63c8a9d2c3a8ff41d2febc4cdeff2633331", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n Object *val, Error **errp)\n \n {\n+\n+ MemoryRegion *mr;\n+\n+ Error *local_err = NULL;\n+\n \n \n mr = host_memory_backend_get_memory(MEMORY_BACKEND(val), &local_err);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pc_dimm_check_memdev_is_busy(Object *obj, const char *name,\n\n Object *val, Error **errp)\n\n{\n\n MemoryRegion *mr;\n\n Error *local_err = NULL;\n\n\n\n mr = host_memory_backend_get_memory(MEMORY_BACKEND(val), &local_err);\n\n if (local_err) {\n\n goto out;\n\n }\n\n if (memory_region_is_mapped(mr)) {\n\n char *path = object_get_canonical_path_component(val);\n\n error_setg(&local_err, \"can't use already busy memdev: %s\", path);\n\n g_free(path);\n\n } else {\n\n qdev_prop_allow_set_link_before_realize(obj, name, val, &local_err);\n\n }\n\n\n\nout:\n\n error_propagate(errp, local_err);\n\n}\n"}} {"sample_id": "e1833e1f96456fd8fc17463246fe0b2050e68efb_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static void spr_write_40x_dbcr0 (void *opaque, int sprn)\n \n {\n+\n+ DisasContext *ctx = opaque;\n+\n \n \n gen_op_store_40x_dbcr0();", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void spr_write_40x_dbcr0 (void *opaque, int sprn)\n\n{\n\n DisasContext *ctx = opaque;\n\n\n\n gen_op_store_40x_dbcr0();\n\n /* We must stop translation as we may have rebooted */\n\n RET_STOP(ctx);\n\n}\n"}} {"sample_id": "2e6fc7eb1a4af1b127df5f07b8bb28af891946fa_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,7 +7,7 @@\n * other block driver works\n \n */\n+\n+ return 1;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int raw_probe(const uint8_t *buf, int buf_size, const char *filename)\n\n{\n\n /* smallest possible positive score so that raw is used if and only if no\n\n * other block driver works\n\n */\n\n return 1;\n\n}\n"}} {"sample_id": "95129d6fc9ead97155627a4ca0cfd37282883658_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -32,11 +32,11 @@\n \n virtio_add_feature(&features, VIRTIO_BLK_F_SCSI);\n \n+ }\n+\n+\n+\n+ if (s->conf.config_wce) {\n \n virtio_add_feature(&features, VIRTIO_BLK_F_CONFIG_WCE);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t virtio_blk_get_features(VirtIODevice *vdev, uint64_t features,\n\n Error **errp)\n\n{\n\n VirtIOBlock *s = VIRTIO_BLK(vdev);\n\n\n\n virtio_add_feature(&features, VIRTIO_BLK_F_SEG_MAX);\n\n virtio_add_feature(&features, VIRTIO_BLK_F_GEOMETRY);\n\n virtio_add_feature(&features, VIRTIO_BLK_F_TOPOLOGY);\n\n virtio_add_feature(&features, VIRTIO_BLK_F_BLK_SIZE);\n\n if (__virtio_has_feature(features, VIRTIO_F_VERSION_1)) {\n\n if (s->conf.scsi) {\n\n error_setg(errp, \"Please set scsi=off for virtio-blk devices in order to use virtio 1.0\");\n\n return 0;\n\n }\n\n } else {\n\n virtio_clear_feature(&features, VIRTIO_F_ANY_LAYOUT);\n\n virtio_add_feature(&features, VIRTIO_BLK_F_SCSI);\n\n }\n\n\n\n if (s->conf.config_wce) {\n\n virtio_add_feature(&features, VIRTIO_BLK_F_CONFIG_WCE);\n\n }\n\n if (blk_enable_write_cache(s->blk)) {\n\n virtio_add_feature(&features, VIRTIO_BLK_F_WCE);\n\n }\n\n if (blk_is_read_only(s->blk)) {\n\n virtio_add_feature(&features, VIRTIO_BLK_F_RO);\n\n }\n\n\n\n return features;\n\n}\n"}} {"sample_id": "e23a1b33b53d25510320b26d9f154e19c6c99725_14", "diff": "--- a/source.c\n+++ b/source.c\n@@ -6,7 +6,7 @@\n \n {\n \n+ DeviceState *dev;\n \n SysBusDevice *s;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "m48t59_t *m48t59_init (qemu_irq IRQ, target_phys_addr_t mem_base,\n\n uint32_t io_base, uint16_t size,\n\n int type)\n\n{\n\n DeviceState *dev;\n\n SysBusDevice *s;\n\n M48t59SysBusState *d;\n\n\n\n dev = qdev_create(NULL, \"m48t59\");\n\n qdev_prop_set_uint32(dev, \"type\", type);\n\n qdev_prop_set_uint32(dev, \"size\", size);\n\n qdev_prop_set_uint32(dev, \"io_base\", io_base);\n\n qdev_init(dev);\n\n s = sysbus_from_qdev(dev);\n\n sysbus_connect_irq(s, 0, IRQ);\n\n if (io_base != 0) {\n\n register_ioport_read(io_base, 0x04, 1, NVRAM_readb, s);\n\n register_ioport_write(io_base, 0x04, 1, NVRAM_writeb, s);\n\n }\n\n if (mem_base != 0) {\n\n sysbus_mmio_map(s, 0, mem_base);\n\n }\n\n\n\n d = FROM_SYSBUS(M48t59SysBusState, s);\n\n\n\n return &d->state;\n\n}\n"}} {"sample_id": "aca7aaf6287b6a9f688c1b115a76fdc056565a7e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,7 +13,7 @@\n case 16:\n \n return PIXMAN_r5g6b5;\n+\n case 24:\n \n return PIXMAN_r8g8b8;", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "pixman_format_code_t qemu_default_pixman_format(int bpp, bool native_endian)\n\n{\n\n if (native_endian) {\n\n switch (bpp) {\n\n case 15:\n\n return PIXMAN_x1r5g5b5;\n\n case 16:\n\n return PIXMAN_r5g6b5;\n\n case 24:\n\n return PIXMAN_r8g8b8;\n\n case 32:\n\n return PIXMAN_x8r8g8b8;\n\n }\n\n } else {\n\n switch (bpp) {\n\n case 24:\n\n return PIXMAN_b8g8r8;\n\n case 32:\n\n return PIXMAN_b8g8r8x8;\n\n break;\n\n }\n\n }\n\n g_assert_not_reached();\n\n}\n"}} {"sample_id": "16905d717507d3daffa714c7f0fd5403873807b2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -11,11 +11,11 @@\n if (drv == NULL) {\n \n drv = bdrv_find_format(\"file\");\n+\n+ }\n+\n+\n+\n return bdrv_create(drv, filename, options);\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int bdrv_create_file(const char* filename, QEMUOptionParameter *options)\n\n{\n\n BlockDriver *drv;\n\n\n\n drv = bdrv_find_protocol(filename);\n\n if (drv == NULL) {\n\n drv = bdrv_find_format(\"file\");\n\n }\n\n\n\n return bdrv_create(drv, filename, options);\n\n}\n"}} {"sample_id": "4ae3c0e27fff7e41fd75fc63a35703bc64785863", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,9 +7,9 @@\n QIOChannel *ioc;\n \n lseek(fd, 0, SEEK_SET);\n+\n if (write) {\n+\n g_assert_cmpint(ftruncate(fd, 0), ==, 0);\n \n }", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-20", "target_file": "source.c", "files": {"source.c": "static QEMUFile *open_test_file(bool write)\n\n{\n\n int fd = dup(temp_fd);\n\n QIOChannel *ioc;\n\n lseek(fd, 0, SEEK_SET);\n\n if (write) {\n\n g_assert_cmpint(ftruncate(fd, 0), ==, 0);\n\n }\n\n ioc = QIO_CHANNEL(qio_channel_file_new_fd(fd));\n\n if (write) {\n\n return qemu_fopen_channel_output(ioc);\n\n } else {\n\n return qemu_fopen_channel_input(ioc);\n\n }\n\n}\n"}} {"sample_id": "506590836144af7d0de3fc4c691bb5ed49d41645", "diff": "--- a/source.c\n+++ b/source.c\n@@ -26,11 +26,11 @@\n \n env->spr[SPR_HDSISR] = dsisr;\n \n+ } else {\n+\n+ cs->exception_index = POWERPC_EXCP_DSI;\n+\n+ env->spr[SPR_DAR] = dar;\n \n env->spr[SPR_DSISR] = dsisr;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void ppc_hash64_set_dsi(CPUState *cs, CPUPPCState *env, uint64_t dar,\n\n uint64_t dsisr)\n\n{\n\n bool vpm;\n\n\n\n if (msr_dr) {\n\n vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM1);\n\n } else {\n\n vpm = !!(env->spr[SPR_LPCR] & LPCR_VPM0);\n\n }\n\n if (vpm && !msr_hv) {\n\n cs->exception_index = POWERPC_EXCP_HDSI;\n\n env->spr[SPR_HDAR] = dar;\n\n env->spr[SPR_HDSISR] = dsisr;\n\n } else {\n\n cs->exception_index = POWERPC_EXCP_DSI;\n\n env->spr[SPR_DAR] = dar;\n\n env->spr[SPR_DSISR] = dsisr;\n\n }\n\n env->error_code = 0;\n\n}\n"}} {"sample_id": "b3c0bfb6f949d8f1c97f390f951c0bab3e703810_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -21,7 +21,7 @@\n return ret;\n \n }\n+\n buf[2047] = '\\0';\n \n if (vmdk_parse_description(buf, \"createType\", ct, sizeof(ct))) {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int vmdk_open_desc_file(BlockDriverState *bs, int flags,\n\n int64_t desc_offset)\n\n{\n\n int ret;\n\n char buf[2048];\n\n char ct[128];\n\n BDRVVmdkState *s = bs->opaque;\n\n\n\n ret = bdrv_pread(bs->file, desc_offset, buf, sizeof(buf));\n\n if (ret < 0) {\n\n return ret;\n\n }\n\n buf[2047] = '\\0';\n\n if (vmdk_parse_description(buf, \"createType\", ct, sizeof(ct))) {\n\n return -EINVAL;\n\n }\n\n if (strcmp(ct, \"monolithicFlat\") &&\n\n strcmp(ct, \"twoGbMaxExtentSparse\") &&\n\n strcmp(ct, \"twoGbMaxExtentFlat\")) {\n\n fprintf(stderr,\n\n \"VMDK: Not supported image type \\\"%s\\\"\"\".\\n\", ct);\n\n return -ENOTSUP;\n\n }\n\n s->desc_offset = 0;\n\n ret = vmdk_parse_extents(buf, bs, bs->file->filename);\n\n if (ret) {\n\n return ret;\n\n }\n\n\n\n /* try to open parent images, if exist */\n\n if (vmdk_parent_open(bs)) {\n\n g_free(s->extents);\n\n return -EINVAL;\n\n }\n\n s->parent_cid = vmdk_read_cid(bs, 1);\n\n return 0;\n\n}\n"}} {"sample_id": "6d152ebaf4db6567cefbbd3b2b102c4a50172109", "diff": "--- a/source.c\n+++ b/source.c\n@@ -7,10 +7,10 @@\n \n \n memset(cpuinfo->found_cpus, 0, sizeof cpuinfo->found_cpus);\n+\n+ CPU_FOREACH(cpu) {\n+\n+ set_bit(cpu->cpu_index, cpuinfo->found_cpus);\n \n }\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void virt_acpi_get_cpu_info(VirtAcpiCpuInfo *cpuinfo)\n\n{\n\n CPUState *cpu;\n\n\n\n memset(cpuinfo->found_cpus, 0, sizeof cpuinfo->found_cpus);\n\n CPU_FOREACH(cpu) {\n\n set_bit(cpu->cpu_index, cpuinfo->found_cpus);\n\n }\n\n}\n"}} {"sample_id": "68d553587c0aa271c3eb2902921b503740d775b6_5", "diff": "--- a/source.c\n+++ b/source.c\n@@ -43,9 +43,9 @@\n ehci_set_state(q->ehci, async, EST_ADVANCEQUEUE);\n \n again = 1;\n+\n+ }\n+\n+ return again;\n+\n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int ehci_state_writeback(EHCIQueue *q, int async)\n\n{\n\n int again = 0;\n\n\n\n /* Write back the QTD from the QH area */\n\n ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), (EHCIqtd*) &q->qh.next_qtd);\n\n put_dwords(NLPTR_GET(q->qtdaddr),(uint32_t *) &q->qh.next_qtd,\n\n sizeof(EHCIqtd) >> 2);\n\n\n\n /*\n\n * EHCI specs say go horizontal here.\n\n *\n\n * We can also advance the queue here for performance reasons. We\n\n * need to take care to only take that shortcut in case we've\n\n * processed the qtd just written back without errors, i.e. halt\n\n * bit is clear.\n\n */\n\n if (q->qh.token & QTD_TOKEN_HALT) {\n\n ehci_set_state(q->ehci, async, EST_HORIZONTALQH);\n\n again = 1;\n\n } else {\n\n ehci_set_state(q->ehci, async, EST_ADVANCEQUEUE);\n\n again = 1;\n\n }\n\n return again;\n\n}\n"}} {"sample_id": "a35faa94c8e8d851a1d07e17c98f4ab2202b8a38", "diff": "--- a/source.c\n+++ b/source.c\n@@ -2,11 +2,11 @@\n \n {\n \n+ pl061_state *s = (pl061_state *)opaque;\n+\n+\n+\n+ qemu_put_be32(f, s->locked);\n \n qemu_put_be32(f, s->data);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void pl061_save(QEMUFile *f, void *opaque)\n\n{\n\n pl061_state *s = (pl061_state *)opaque;\n\n\n\n qemu_put_be32(f, s->locked);\n\n qemu_put_be32(f, s->data);\n\n qemu_put_be32(f, s->old_data);\n\n qemu_put_be32(f, s->dir);\n\n qemu_put_be32(f, s->isense);\n\n qemu_put_be32(f, s->ibe);\n\n qemu_put_be32(f, s->iev);\n\n qemu_put_be32(f, s->im);\n\n qemu_put_be32(f, s->istate);\n\n qemu_put_be32(f, s->afsel);\n\n qemu_put_be32(f, s->dr2r);\n\n qemu_put_be32(f, s->dr4r);\n\n qemu_put_be32(f, s->dr8r);\n\n qemu_put_be32(f, s->odr);\n\n qemu_put_be32(f, s->pur);\n\n qemu_put_be32(f, s->pdr);\n\n qemu_put_be32(f, s->slr);\n\n qemu_put_be32(f, s->den);\n\n qemu_put_be32(f, s->cr);\n\n qemu_put_be32(f, s->float_high);\n\n}\n"}} {"sample_id": "88571882516a7cb4291a329c537eb79fd126e1f2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -23,11 +23,11 @@\n fprintf(stderr, \"rdma migration: complete polling error!\\n\");\n \n return -EIO;\n+\n+ }\n+\n+ }\n+\n \n \n qemu_rdma_unregister_waiting(rdma);", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int qemu_rdma_drain_cq(QEMUFile *f, RDMAContext *rdma)\n\n{\n\n int ret;\n\n\n\n if (qemu_rdma_write_flush(f, rdma) < 0) {\n\n return -EIO;\n\n }\n\n\n\n while (rdma->nb_sent) {\n\n ret = qemu_rdma_block_for_wrid(rdma, RDMA_WRID_RDMA_WRITE);\n\n if (ret < 0) {\n\n fprintf(stderr, \"rdma migration: complete polling error!\\n\");\n\n return -EIO;\n\n }\n\n }\n\n\n\n qemu_rdma_unregister_waiting(rdma);\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "d9bce9d99f4656ae0b0127f7472db9067b8f84ab_69", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n void do_store_601_batu (int nr)\n+\n {\n \n do_store_ibatu(env, nr, T0);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "void do_store_601_batu (int nr)\n\n{\n\n do_store_ibatu(env, nr, T0);\n\n env->DBAT[0][nr] = env->IBAT[0][nr];\n\n env->DBAT[1][nr] = env->IBAT[1][nr];\n\n}\n"}} {"sample_id": "33876dfad64bc481f59c5e9ccf60db78624c4b93_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n char path[50];\n \n+\n \n if (xs == NULL) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-22", "target_file": "source.c", "files": {"source.c": "static void xenstore_record_dm_state(struct xs_handle *xs, const char *state)\n\n{\n\n char path[50];\n\n\n\n if (xs == NULL) {\n\n fprintf(stderr, \"xenstore connection not initialized\\n\");\n\n exit(1);\n\n }\n\n\n\n snprintf(path, sizeof (path), \"/local/domain/0/device-model/%u/state\", xen_domid);\n\n if (!xs_write(xs, XBT_NULL, path, state, strlen(state))) {\n\n fprintf(stderr, \"error recording dm state\\n\");\n\n exit(1);\n\n }\n\n}\n"}} {"sample_id": "8f90b5e91df59fde0dfecc6738ff39f3edf14be5_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,8 +1,8 @@\n+void bdrv_io_unplugged_begin(BlockDriverState *bs)\n+\n+{\n+\n+ BdrvChild *child;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "void bdrv_io_unplugged_begin(BlockDriverState *bs)\n\n{\n\n BdrvChild *child;\n\n\n\n if (bs->io_plug_disabled++ == 0 && bs->io_plugged > 0) {\n\n BlockDriver *drv = bs->drv;\n\n if (drv && drv->bdrv_io_unplug) {\n\n drv->bdrv_io_unplug(bs);\n\n }\n\n }\n\n\n\n QLIST_FOREACH(child, &bs->children, next) {\n\n bdrv_io_unplugged_begin(child->bs);\n\n }\n\n}\n"}} {"sample_id": "64263dd526ec25ede1591fc1144715a20cc7bc4e", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static const unsigned char *seq_decode_op1(SeqVideoContext *seq, const unsigned char *src, unsigned char *dst)\n \n {\n \n@@ -6,7 +6,7 @@\n \n int b, i, len, bits;\n \n+ GetBitContext gb;\n \n unsigned char block[8 * 8];\n \n@@ -23,7 +23,7 @@\n src = seq_unpack_rle_block(src, block, sizeof(block));\n \n for (b = 0; b < 8; b++) {\n+\n memcpy(dst, &block[b * 8], 8);\n \n dst += seq->frame.linesize[0];", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static const unsigned char *seq_decode_op1(SeqVideoContext *seq, const unsigned char *src, unsigned char *dst)\n\n{\n\n const unsigned char *color_table;\n\n int b, i, len, bits;\n\n GetBitContext gb;\n\n unsigned char block[8 * 8];\n\n\n\n len = *src++;\n\n if (len & 0x80) {\n\n switch (len & 3) {\n\n case 1:\n\n src = seq_unpack_rle_block(src, block, sizeof(block));\n\n for (b = 0; b < 8; b++) {\n\n memcpy(dst, &block[b * 8], 8);\n\n dst += seq->frame.linesize[0];\n\n }\n\n break;\n\n case 2:\n\n src = seq_unpack_rle_block(src, block, sizeof(block));\n\n for (i = 0; i < 8; i++) {\n\n for (b = 0; b < 8; b++)\n\n dst[b * seq->frame.linesize[0]] = block[i * 8 + b];\n\n ++dst;\n\n }\n\n break;\n\n }\n\n } else {\n\n color_table = src;\n\n src += len;\n\n bits = ff_log2_tab[len - 1] + 1;\n\n init_get_bits(&gb, src, bits * 8 * 8); src += bits * 8;\n\n for (b = 0; b < 8; b++) {\n\n for (i = 0; i < 8; i++)\n\n dst[i] = color_table[get_bits(&gb, bits)];\n\n dst += seq->frame.linesize[0];\n\n }\n\n }\n\n\n\n return src;\n\n}\n"}} {"sample_id": "4ed1c57a64992d84376b446b0c60edff2486681b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,7 +4,7 @@\n \n EHCIPacket *p = QTAILQ_FIRST(&q->packets);\n \n+ int again = 0;\n \n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "static int ehci_state_writeback(EHCIQueue *q)\n\n{\n\n EHCIPacket *p = QTAILQ_FIRST(&q->packets);\n\n int again = 0;\n\n\n\n /* Write back the QTD from the QH area */\n\n assert(p != NULL);\n\n assert(p->qtdaddr == q->qtdaddr);\n\n\n\n ehci_trace_qtd(q, NLPTR_GET(p->qtdaddr), (EHCIqtd *) &q->qh.next_qtd);\n\n put_dwords(q->ehci, NLPTR_GET(p->qtdaddr), (uint32_t *) &q->qh.next_qtd,\n\n sizeof(EHCIqtd) >> 2);\n\n ehci_free_packet(p);\n\n\n\n /*\n\n * EHCI specs say go horizontal here.\n\n *\n\n * We can also advance the queue here for performance reasons. We\n\n * need to take care to only take that shortcut in case we've\n\n * processed the qtd just written back without errors, i.e. halt\n\n * bit is clear.\n\n */\n\n if (q->qh.token & QTD_TOKEN_HALT) {\n\n ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);\n\n again = 1;\n\n } else {\n\n ehci_set_state(q->ehci, q->async, EST_ADVANCEQUEUE);\n\n again = 1;\n\n }\n\n return again;\n\n}\n"}} {"sample_id": "d92fa2dc6e42e8bd8470e69d85141176f98feaea", "diff": "--- a/source.c\n+++ b/source.c\n@@ -39,11 +39,11 @@\n break;\n \n \n+\n+ default:\n+\n+ VTD_DPRINTF(GENERAL,\n+\n \"error: wrong context-cache invalidation granularity\");\n \n caig = 0;", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static uint64_t vtd_context_cache_invalidate(IntelIOMMUState *s, uint64_t val)\n\n{\n\n uint64_t caig;\n\n uint64_t type = val & VTD_CCMD_CIRG_MASK;\n\n\n\n switch (type) {\n\n case VTD_CCMD_GLOBAL_INVL:\n\n VTD_DPRINTF(INV, \"Global invalidation request\");\n\n caig = VTD_CCMD_GLOBAL_INVL_A;\n\n break;\n\n\n\n case VTD_CCMD_DOMAIN_INVL:\n\n VTD_DPRINTF(INV, \"Domain-selective invalidation request\");\n\n caig = VTD_CCMD_DOMAIN_INVL_A;\n\n break;\n\n\n\n case VTD_CCMD_DEVICE_INVL:\n\n VTD_DPRINTF(INV, \"Domain-selective invalidation request\");\n\n caig = VTD_CCMD_DEVICE_INVL_A;\n\n break;\n\n\n\n default:\n\n VTD_DPRINTF(GENERAL,\n\n \"error: wrong context-cache invalidation granularity\");\n\n caig = 0;\n\n }\n\n return caig;\n\n}\n"}} {"sample_id": "c627e7526a902dd5bb1907dbbd5cf961679dfa68_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,17 +1,17 @@\n static void rc4030_realize(DeviceState *dev, Error **errp)\n \n {\n+\n rc4030State *s = RC4030(dev);\n \n Object *o = OBJECT(dev);\n+\n+ int i;\n+\n+\n+\n+ s->periodic_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,\n+\n rc4030_periodic_timer, s);\n \n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void rc4030_realize(DeviceState *dev, Error **errp)\n\n{\n\n rc4030State *s = RC4030(dev);\n\n Object *o = OBJECT(dev);\n\n int i;\n\n\n\n s->periodic_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,\n\n rc4030_periodic_timer, s);\n\n\n\n memory_region_init_io(&s->iomem_chipset, NULL, &rc4030_ops, s,\n\n \"rc4030.chipset\", 0x300);\n\n memory_region_init_io(&s->iomem_jazzio, NULL, &jazzio_ops, s,\n\n \"rc4030.jazzio\", 0x00001000);\n\n\n\n memory_region_init_rom_device(&s->dma_tt, o,\n\n &rc4030_dma_tt_ops, s, \"dma-table\",\n\n MAX_TL_ENTRIES * sizeof(dma_pagetable_entry),\n\n NULL);\n\n memory_region_init(&s->dma_tt_alias, o, \"dma-table-alias\", 0);\n\n memory_region_init(&s->dma_mr, o, \"dma\", INT32_MAX);\n\n for (i = 0; i < MAX_TL_ENTRIES; ++i) {\n\n memory_region_init_alias(&s->dma_mrs[i], o, \"dma-alias\",\n\n get_system_memory(), 0, DMA_PAGESIZE);\n\n memory_region_set_enabled(&s->dma_mrs[i], false);\n\n memory_region_add_subregion(&s->dma_mr, i * DMA_PAGESIZE,\n\n &s->dma_mrs[i]);\n\n }\n\n address_space_init(&s->dma_as, &s->dma_mr, \"rc4030-dma\");\n\n}\n"}} {"sample_id": "01ecb7172b684f1c4b3e748f95c5a9a494ca36ec_6", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static float get_band_cost_NONE_mips(struct AACEncContext *s,\n \n PutBitContext *pb, const float *in,\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static float get_band_cost_NONE_mips(struct AACEncContext *s,\n\n PutBitContext *pb, const float *in,\n\n const float *scaled, int size, int scale_idx,\n\n int cb, const float lambda, const float uplim,\n\n int *bits)\n\n{\n\n av_assert0(0);\n\n return 0;\n\n}\n"}} {"sample_id": "67020711b7d45afa073ef671f755765035a64373", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,9 +1,9 @@\n static int vp8_lossy_decode_frame(AVCodecContext *avctx, AVFrame *p,\n+ int *got_frame, uint8_t *data_start,\n+ unsigned int data_size)\n+{\n+ WebPContext *s = avctx->priv_data;\n+ AVPacket pkt;\n int ret;\n if (!s->initialized) {\n ff_vp8_decode_init(avctx);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static int vp8_lossy_decode_frame(AVCodecContext *avctx, AVFrame *p,\n int *got_frame, uint8_t *data_start,\n unsigned int data_size)\n{\n WebPContext *s = avctx->priv_data;\n AVPacket pkt;\n int ret;\n if (!s->initialized) {\n ff_vp8_decode_init(avctx);\n s->initialized = 1;\n }\n avctx->pix_fmt = s->has_alpha ? AV_PIX_FMT_YUVA420P : AV_PIX_FMT_YUV420P;\n s->lossless = 0;\n if (data_size > INT_MAX) {\n av_log(avctx, AV_LOG_ERROR, \"unsupported chunk size\\n\");\n return AVERROR_PATCHWELCOME;\n }\n av_init_packet(&pkt);\n pkt.data = data_start;\n pkt.size = data_size;\n ret = ff_vp8_decode_frame(avctx, p, got_frame, &pkt);\n if (ret < 0)\n return ret;\n update_canvas_size(avctx, avctx->width, avctx->height);\n if (s->has_alpha) {\n ret = vp8_lossy_decode_alpha(avctx, p, s->alpha_data,\n s->alpha_data_size);\n if (ret < 0)\n return ret;\n }\n return ret;\n}"}} {"sample_id": "98f343395e937fa1db3a28dfb4f303f97cfddd6c_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void emulated_push_type(EmulatedState *card, uint32_t type)\n+\n {\n \n EmulEvent *event = (EmulEvent *)g_malloc(sizeof(EmulEvent));", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-119", "target_file": "source.c", "files": {"source.c": "static void emulated_push_type(EmulatedState *card, uint32_t type)\n\n{\n\n EmulEvent *event = (EmulEvent *)g_malloc(sizeof(EmulEvent));\n\n\n\n assert(event);\n\n event->p.gen.type = type;\n\n emulated_push_event(card, event);\n\n}\n"}} {"sample_id": "b1ade3d1821a29174963b28cd0caa5f7ed394998_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -42,11 +42,11 @@\n \n if (stop_on_overflow)\n \n+ return 1;\n+\n+ sum = (sum >> 31) ^ 32767;\n+\n+ }\n \n out[n] = sum;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int ff_celp_lp_synthesis_filter(int16_t *out,\n\n const int16_t* filter_coeffs,\n\n const int16_t* in,\n\n int buffer_length,\n\n int filter_length,\n\n int stop_on_overflow,\n\n int rounder)\n\n{\n\n int i,n;\n\n\n\n // Avoids a +1 in the inner loop.\n\n filter_length++;\n\n\n\n for (n = 0; n < buffer_length; n++) {\n\n int sum = rounder;\n\n for (i = 1; i < filter_length; i++)\n\n sum -= filter_coeffs[i-1] * out[n-i];\n\n\n\n sum = (sum >> 12) + in[n];\n\n\n\n if (sum + 0x8000 > 0xFFFFU) {\n\n if (stop_on_overflow)\n\n return 1;\n\n sum = (sum >> 31) ^ 32767;\n\n }\n\n out[n] = sum;\n\n }\n\n\n\n return 0;\n\n}\n"}} {"sample_id": "ddf21908961073199f3d186204da4810f2ea150b", "diff": "--- a/source.c\n+++ b/source.c\n@@ -14,11 +14,11 @@\n \n int i;\n \n+\n+\n+ for (i = 0; i < ARRAY_SIZE(bad_values) ; i++) {\n+\n+ err = NULL;\n \n u.has_enum1 = true;\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void test_visitor_out_struct_errors(TestOutputVisitorData *data,\n\n const void *unused)\n\n{\n\n EnumOne bad_values[] = { ENUM_ONE_MAX, -1 };\n\n UserDefZero b;\n\n UserDefOne u = { .base = &b }, *pu = &u;\n\n Error *err;\n\n int i;\n\n\n\n for (i = 0; i < ARRAY_SIZE(bad_values) ; i++) {\n\n err = NULL;\n\n u.has_enum1 = true;\n\n u.enum1 = bad_values[i];\n\n visit_type_UserDefOne(data->ov, &pu, \"unused\", &err);\n\n g_assert(err);\n\n error_free(err);\n\n }\n\n}\n"}} {"sample_id": "f2917853f715b0ef55df29eb2ffea29dc69ce814_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,4 +1,4 @@\n+static struct scsi_task *iscsi_do_inquiry(struct iscsi_context *iscsi, int lun,\n \n int evpd, int pc)\n \n@@ -14,7 +14,7 @@\n \n goto fail;\n \n+ }\n \n full_size = scsi_datain_getfullsize(task);\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-78", "target_file": "source.c", "files": {"source.c": "static struct scsi_task *iscsi_do_inquiry(struct iscsi_context *iscsi, int lun,\n\n int evpd, int pc)\n\n{\n\n int full_size;\n\n struct scsi_task *task = NULL;\n\n task = iscsi_inquiry_sync(iscsi, lun, evpd, pc, 64);\n\n if (task == NULL || task->status != SCSI_STATUS_GOOD) {\n\n goto fail;\n\n }\n\n full_size = scsi_datain_getfullsize(task);\n\n if (full_size > task->datain.size) {\n\n scsi_free_scsi_task(task);\n\n\n\n /* we need more data for the full list */\n\n task = iscsi_inquiry_sync(iscsi, lun, evpd, pc, full_size);\n\n if (task == NULL || task->status != SCSI_STATUS_GOOD) {\n\n goto fail;\n\n }\n\n }\n\n\n\n return task;\n\n\n\nfail:\n\n error_report(\"iSCSI: Inquiry command failed : %s\",\n\n iscsi_get_error(iscsi));\n\n if (task) {\n\n scsi_free_scsi_task(task);\n\n return NULL;\n\n }\n\n return NULL;\n\n}\n"}} {"sample_id": "87ecefdab0097537c5c30014e57b19113ab05eee", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,7 +1,7 @@\n static int get_high_utility_cell(elbg_data *elbg)\n \n+{\n+\n int i=0;\n \n /* Using linear search, do binary if it ever turns to be speed critical */", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static int get_high_utility_cell(elbg_data *elbg)\n\n{\n\n int i=0;\n\n /* Using linear search, do binary if it ever turns to be speed critical */\n\n int r = av_lfg_get(elbg->rand_state)%elbg->utility_inc[elbg->numCB-1] + 1;\n\n while (elbg->utility_inc[i] < r)\n\n i++;\n\n\n\n av_assert2(elbg->cells[i]);\n\n\n\n return i;\n\n}\n"}} {"sample_id": "3e831b40e015ba34dfb55ff11f767001839425ff", "diff": "--- a/source.c\n+++ b/source.c\n@@ -5,7 +5,7 @@\n PVSCSICmdDescSetupMsgRing *rc =\n \n (PVSCSICmdDescSetupMsgRing *) s->curr_cmd_data;\n+\n \n \n trace_pvscsi_on_cmd_arrived(\"PVSCSI_CMD_SETUP_MSG_RING\");", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "pvscsi_on_cmd_setup_msg_ring(PVSCSIState *s)\n\n{\n\n PVSCSICmdDescSetupMsgRing *rc =\n\n (PVSCSICmdDescSetupMsgRing *) s->curr_cmd_data;\n\n\n\n trace_pvscsi_on_cmd_arrived(\"PVSCSI_CMD_SETUP_MSG_RING\");\n\n\n\n if (!s->use_msg) {\n\n return PVSCSI_COMMAND_PROCESSING_FAILED;\n\n }\n\n\n\n if (s->rings_info_valid) {\n\n pvscsi_ring_init_msg(&s->rings, rc);\n\n s->msg_ring_info_valid = TRUE;\n\n }\n\n return sizeof(PVSCSICmdDescSetupMsgRing) / sizeof(uint32_t);\n\n}\n"}} {"sample_id": "6e20554a6d33e92b81dc3cfed6082e03bff2a7f8", "diff": "--- a/source.c\n+++ b/source.c\n@@ -16,7 +16,7 @@\n \n int v = decode210(&s->gb);\n \n+ if (v < 2) {\n \n mv_map = v ? get_bits(&s->gb, 6) : 63;\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void decode_mb(MadContext *t, int inter)\n\n{\n\n MpegEncContext *s = &t->s;\n\n int mv_map = 0;\n\n int mv_x, mv_y;\n\n int j;\n\n\n\n if (inter) {\n\n int v = decode210(&s->gb);\n\n if (v < 2) {\n\n mv_map = v ? get_bits(&s->gb, 6) : 63;\n\n mv_x = decode_motion(&s->gb);\n\n mv_y = decode_motion(&s->gb);\n\n } else {\n\n mv_map = 0;\n\n }\n\n }\n\n\n\n for (j=0; j<6; j++) {\n\n if (mv_map & (1<gb);\n\n comp_block(t, s->mb_x, s->mb_y, j, mv_x, mv_y, add);\n\n } else {\n\n s->dsp.clear_block(t->block);\n\n decode_block_intra(t, t->block);\n\n idct_put(t, t->block, s->mb_x, s->mb_y, j);\n\n }\n\n }\n\n}\n"}} {"sample_id": "b4ba67d9a702507793c2724e56f98e9b0f7be02b_30", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,10 +1,10 @@\n+void qpci_io_writeq(QPCIDevice *dev, void *data, uint64_t value)\n+\n+{\n+\n uintptr_t addr = (uintptr_t)data;\n \n+\n \n if (addr < QPCI_PIO_LIMIT) {\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-189", "target_file": "source.c", "files": {"source.c": "void qpci_io_writeq(QPCIDevice *dev, void *data, uint64_t value)\n\n{\n\n uintptr_t addr = (uintptr_t)data;\n\n\n\n if (addr < QPCI_PIO_LIMIT) {\n\n dev->bus->pio_writeq(dev->bus, addr, value);\n\n } else {\n\n value = cpu_to_le64(value);\n\n dev->bus->memwrite(dev->bus, addr, &value, sizeof(value));\n\n }\n\n}\n"}} {"sample_id": "7faa8075d898ae56d2c533c530569bb25ab86eaf_2", "diff": "--- a/source.c\n+++ b/source.c\n@@ -4,8 +4,8 @@\n \n \n \n+ register_ioport_write(GPE_BASE, GPE_LEN, 1, gpe_writeb, s);\n+\n register_ioport_read(GPE_BASE, GPE_LEN, 1, gpe_readb, s);\n \n acpi_gpe_blk(&s->ar, GPE_BASE);", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-OTHER", "target_file": "source.c", "files": {"source.c": "static void piix4_acpi_system_hot_add_init(PCIBus *bus, PIIX4PMState *s)\n\n{\n\n\n\n register_ioport_write(GPE_BASE, GPE_LEN, 1, gpe_writeb, s);\n\n register_ioport_read(GPE_BASE, GPE_LEN, 1, gpe_readb, s);\n\n acpi_gpe_blk(&s->ar, GPE_BASE);\n\n\n\n register_ioport_read(PCI_UP_BASE, 4, 4, pci_up_read, s);\n\n register_ioport_read(PCI_DOWN_BASE, 4, 4, pci_down_read, s);\n\n\n\n register_ioport_write(PCI_EJ_BASE, 4, 4, pciej_write, bus);\n\n register_ioport_read(PCI_EJ_BASE, 4, 4, pciej_read, bus);\n\n\n\n register_ioport_write(PCI_RMV_BASE, 4, 4, pcirmv_write, s);\n\n register_ioport_read(PCI_RMV_BASE, 4, 4, pcirmv_read, s);\n\n\n\n pci_bus_hotplug(bus, piix4_device_hotplug, &s->dev.qdev);\n\n}\n"}} {"sample_id": "4a1418e07bdcfaa3177739e04707ecaec75d89e1_10", "diff": "--- a/source.c\n+++ b/source.c\n@@ -1,5 +1,5 @@\n static void qpi_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)\n \n+{\n \n }", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static void qpi_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)\n\n{\n\n}\n"}} {"sample_id": "30ca440eec9fe1d7eec5a48addac656438778278_1", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,10 +9,10 @@\n \n \n test_share = g_strdup(\"/tmp/qtest.XXXXXX\");\n+\n+ g_assert_nonnull(mkdtemp(test_share));\n+\n+\n \n return qtest_pc_boot(cmd, test_share, mount_tag);\n ", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static QOSState *qvirtio_9p_start(void)\n\n{\n\n const char *cmd = \"-fsdev local,id=fsdev0,security_model=none,path=%s \"\n\n \"-device virtio-9p-pci,fsdev=fsdev0,mount_tag=%s\";\n\n\n\n test_share = g_strdup(\"/tmp/qtest.XXXXXX\");\n\n g_assert_nonnull(mkdtemp(test_share));\n\n\n\n return qtest_pc_boot(cmd, test_share, mount_tag);\n\n}\n"}} {"sample_id": "6460440f34c709461b84375cfd8a86b27d433225", "diff": "--- a/source.c\n+++ b/source.c\n@@ -13,9 +13,9 @@\n if (!bs->serialising_in_flight) {\n \n return;\n+\n+ }\n+\n \n \n do {", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static void coroutine_fn wait_serialising_requests(BdrvTrackedRequest *self)\n\n{\n\n BlockDriverState *bs = self->bs;\n\n BdrvTrackedRequest *req;\n\n bool retry;\n\n\n\n if (!bs->serialising_in_flight) {\n\n return;\n\n }\n\n\n\n do {\n\n retry = false;\n\n QLIST_FOREACH(req, &bs->tracked_requests, list) {\n\n if (req == self || (!req->serialising && !self->serialising)) {\n\n continue;\n\n }\n\n if (tracked_request_overlaps(req, self->overlap_offset,\n\n self->overlap_bytes))\n\n {\n\n /* Hitting this means there was a reentrant request, for\n\n * example, a block driver issuing nested requests. This must\n\n * never happen since it means deadlock.\n\n */\n\n assert(qemu_coroutine_self() != req->co);\n\n\n\n qemu_co_queue_wait(&req->wait_queue);\n\n retry = true;\n\n break;\n\n }\n\n }\n\n } while (retry);\n\n}\n"}} {"sample_id": "6ba5cbc699e77cae66bb719354fa142114b64eab", "diff": "--- a/source.c\n+++ b/source.c\n@@ -3,11 +3,11 @@\n {\n \n RTPContext *s = h->priv_data;\n+\n+ char hostname[256];\n+\n+ int port;\n+\n \n \n char buf[1024];", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "int rtp_set_remote_url(URLContext *h, const char *uri)\n\n{\n\n RTPContext *s = h->priv_data;\n\n char hostname[256];\n\n int port;\n\n\n\n char buf[1024];\n\n char path[1024];\n\n \n\n url_split(NULL, 0, hostname, sizeof(hostname), &port, \n\n path, sizeof(path), uri);\n\n\n\n snprintf(buf, sizeof(buf), \"udp://%s:%d%s\", hostname, port, path);\n\n udp_set_remote_url(s->rtp_hd, buf);\n\n\n\n snprintf(buf, sizeof(buf), \"udp://%s:%d%s\", hostname, port + 1, path);\n\n udp_set_remote_url(s->rtcp_hd, buf);\n\n return 0;\n\n}\n"}} {"sample_id": "ae261c86aaed62e7acddafab8262a2bf286d40b7", "diff": "--- a/source.c\n+++ b/source.c\n@@ -29,11 +29,11 @@\n if (!vmdk_is_cid_valid(bs))\n \n return -1;\n+\n+\n+\n+ /* floor offset to cluster */\n+\n offset -= offset % (extent->cluster_sectors * 512);\n \n ret = bdrv_read(bs->backing_hd, offset >> 9, whole_grain,", "available_files": ["source.c"], "is_vulnerable": false, "cwe": null, "target_file": "source.c", "files": {"source.c": "static int get_whole_cluster(BlockDriverState *bs,\n\n VmdkExtent *extent,\n\n uint64_t cluster_offset,\n\n uint64_t offset,\n\n bool allocate)\n\n{\n\n /* 128 sectors * 512 bytes each = grain size 64KB */\n\n uint8_t whole_grain[extent->cluster_sectors * 512];\n\n\n\n /* we will be here if it's first write on non-exist grain(cluster).\n\n * try to read from parent image, if exist */\n\n if (bs->backing_hd) {\n\n int ret;\n\n\n\n if (!vmdk_is_cid_valid(bs))\n\n return -1;\n\n\n\n /* floor offset to cluster */\n\n offset -= offset % (extent->cluster_sectors * 512);\n\n ret = bdrv_read(bs->backing_hd, offset >> 9, whole_grain,\n\n extent->cluster_sectors);\n\n if (ret < 0) {\n\n return -1;\n\n }\n\n\n\n /* Write grain only into the active image */\n\n ret = bdrv_write(extent->file, cluster_offset, whole_grain,\n\n extent->cluster_sectors);\n\n if (ret < 0) {\n\n return -1;\n\n }\n\n }\n\n return 0;\n\n}\n"}} {"sample_id": "c05541ee191107eb35093fb693e4ec038e60d2c0", "diff": "--- a/source.c\n+++ b/source.c\n@@ -9,14 +9,14 @@\n \n \n #if !defined(CONFIG_USER_ONLY)\n+\n+ if (ctx->mem_idx == 2)\n \n read_cb = ctx->spr_cb[sprn].hea_read;\n \n else if (ctx->mem_idx)\n+\n+ read_cb = ctx->spr_cb[sprn].oea_read;\n \n else\n ", "available_files": ["source.c"], "is_vulnerable": true, "cwe": "CWE-476", "target_file": "source.c", "files": {"source.c": "static inline void gen_op_mfspr(DisasContext *ctx)\n\n{\n\n void (*read_cb)(void *opaque, int gprn, int sprn);\n\n uint32_t sprn = SPR(ctx->opcode);\n\n\n\n#if !defined(CONFIG_USER_ONLY)\n\n if (ctx->mem_idx == 2)\n\n read_cb = ctx->spr_cb[sprn].hea_read;\n\n else if (ctx->mem_idx)\n\n read_cb = ctx->spr_cb[sprn].oea_read;\n\n else\n\n#endif\n\n read_cb = ctx->spr_cb[sprn].uea_read;\n\n if (likely(read_cb != NULL)) {\n\n if (likely(read_cb != SPR_NOACCESS)) {\n\n (*read_cb)(ctx, rD(ctx->opcode), sprn);\n\n } else {\n\n /* Privilege exception */\n\n /* This is a hack to avoid warnings when running Linux:\n\n * this OS breaks the PowerPC virtualisation model,\n\n * allowing userland application to read the PVR\n\n */\n\n if (sprn != SPR_PVR) {\n\n qemu_log(\"Trying to read privileged spr %d %03x at \"\n\n TARGET_FMT_lx \"\\n\", sprn, sprn, ctx->nip);\n\n printf(\"Trying to read privileged spr %d %03x at \"\n\n TARGET_FMT_lx \"\\n\", sprn, sprn, ctx->nip);\n\n }\n\n gen_inval_exception(ctx, POWERPC_EXCP_PRIV_REG);\n\n }\n\n } else {\n\n /* Not defined */\n\n qemu_log(\"Trying to read invalid spr %d %03x at \"\n\n TARGET_FMT_lx \"\\n\", sprn, sprn, ctx->nip);\n\n printf(\"Trying to read invalid spr %d %03x at \" TARGET_FMT_lx \"\\n\",\n\n sprn, sprn, ctx->nip);\n\n gen_inval_exception(ctx, POWERPC_EXCP_INVAL_SPR);\n\n }\n\n}\n"}}