Program: 63064
Project: 63064
Buggy source:
/** 
 * 对xml消息加密
 * @param appId 应用ID
 * @param encodingAesKey 加密密钥
 * @param xmlContent 原始消息体
 * @return aes加密后的消息体
 * @throws WeixinException
 */
public static String aesEncrypt(String appId,String encodingAesKey,String xmlContent) throws WeixinException {
  byte[] randomBytes=StringUtil.getBytesUtf8(RandomUtil.generateString(16));
  byte[] xmlBytes=StringUtil.getBytesUtf8(xmlContent);
  int xmlLength=xmlBytes.length;
  byte[] orderBytes=new byte[4];
  orderBytes[3]=(byte)(xmlLength & 0xFF);
  orderBytes[2]=(byte)(xmlLength >> 8 & 0xFF);
  orderBytes[1]=(byte)(xmlLength >> 16 & 0xFF);
  orderBytes[0]=(byte)(xmlLength >> 24 & 0xFF);
  byte[] appidBytes=StringUtil.getBytesUtf8(appId);
  int byteLength=randomBytes.length + xmlLength + orderBytes.length+ appidBytes.length;
  byte[] padBytes=PKCS7Encoder.encode(byteLength);
  byte[] unencrypted=new byte[byteLength + padBytes.length];
  byteLength=0;
  System.arraycopy(randomBytes,0,unencrypted,byteLength,randomBytes.length);
  byteLength+=randomBytes.length;
  System.arraycopy(orderBytes,0,unencrypted,byteLength,orderBytes.length);
  byteLength+=orderBytes.length;
  System.arraycopy(xmlBytes,0,unencrypted,byteLength,xmlBytes.length);
  byteLength+=xmlBytes.length;
  System.arraycopy(appidBytes,0,unencrypted,byteLength,appidBytes.length);
  byteLength+=appidBytes.length;
  System.arraycopy(padBytes,0,unencrypted,byteLength,padBytes.length);
  try {
    byte[] aesKey=Base64.decodeBase64(encodingAesKey + "String_Node_Str");
    Cipher cipher=Cipher.getInstance("String_Node_Str");
    SecretKeySpec keySpec=new SecretKeySpec(aesKey,Consts.AES);
    IvParameterSpec iv=new IvParameterSpec(aesKey,0,16);
    cipher.init(Cipher.ENCRYPT_MODE,keySpec,iv);
    byte[] encrypted=cipher.doFinal(unencrypted);
    return Base64.encodeBase64String(encrypted);
  }
 catch (  Exception e) {
    throw new WeixinException("String_Node_Str","String_Node_Str" + e.getMessage());
  }
}

Fixed version (ground truth):
/** 
 * 对xml消息加密
 * @param appId 应用ID
 * @param encodingAesKey 加密密钥
 * @param xmlContent 原始消息体
 * @return aes加密后的消息体
 * @throws WeixinException
 */
public static String aesEncrypt(String appId,String encodingAesKey,String xmlContent) throws WeixinException {
  byte[] randomBytes=StringUtil.getBytesUtf8(RandomUtil.generateString(32));
  byte[] xmlBytes=StringUtil.getBytesUtf8(xmlContent);
  int xmlLength=xmlBytes.length;
  byte[] orderBytes=new byte[4];
  orderBytes[3]=(byte)(xmlLength & 0xFF);
  orderBytes[2]=(byte)(xmlLength >> 8 & 0xFF);
  orderBytes[1]=(byte)(xmlLength >> 16 & 0xFF);
  orderBytes[0]=(byte)(xmlLength >> 24 & 0xFF);
  byte[] appidBytes=StringUtil.getBytesUtf8(appId);
  int byteLength=randomBytes.length + xmlLength + orderBytes.length+ appidBytes.length;
  byte[] padBytes=PKCS7Encoder.encode(byteLength);
  byte[] unencrypted=new byte[byteLength + padBytes.length];
  byteLength=0;
  System.arraycopy(randomBytes,0,unencrypted,byteLength,randomBytes.length);
  byteLength+=randomBytes.length;
  System.arraycopy(orderBytes,0,unencrypted,byteLength,orderBytes.length);
  byteLength+=orderBytes.length;
  System.arraycopy(xmlBytes,0,unencrypted,byteLength,xmlBytes.length);
  byteLength+=xmlBytes.length;
  System.arraycopy(appidBytes,0,unencrypted,byteLength,appidBytes.length);
  byteLength+=appidBytes.length;
  System.arraycopy(padBytes,0,unencrypted,byteLength,padBytes.length);
  try {
    byte[] aesKey=Base64.decodeBase64(encodingAesKey + "String_Node_Str");
    Cipher cipher=Cipher.getInstance("String_Node_Str");
    SecretKeySpec keySpec=new SecretKeySpec(aesKey,Consts.AES);
    IvParameterSpec iv=new IvParameterSpec(aesKey,0,16);
    cipher.init(Cipher.ENCRYPT_MODE,keySpec,iv);
    byte[] encrypted=cipher.doFinal(unencrypted);
    return Base64.encodeBase64String(encrypted);
  }
 catch (  Exception e) {
    throw new WeixinException("String_Node_Str","String_Node_Str" + e.getMessage());
  }
}