Program: 87341
Project: 87341
Buggy source:
/** 
 * Reads a new structured field from the input stream. This method is not thread-safe!
 * @return structured field or null if end of input.
 * @throws IOException
 */
public SF readStructuredField() throws IOException {
  int buf=0;
  long thisOffset=offset;
  if (leadingLengthBytes == -1) {
    int leadingLength=0;
    do {
      buf=read();
      offset++;
      leadingLength++;
    }
 while ((buf & 0xff) != 0x5a && buf != -1 && leadingLength < 5);
    if ((buf & 0xff) != 0x5a) {
      has5a=false;
      leadingLength=1;
      offset=2;
      buf=read();
      if ((buf & 0xff) != 0xd3) {
        throw new IOException("String_Node_Str");
      }
      offset=0;
    }
    leadingLengthBytes=leadingLength - 1;
  }
 else {
    if (leadingLengthBytes > 0)     read(data,0,leadingLengthBytes);
    if (has5a) {
      buf=read();
      offset++;
    }
  }
  if (buf == -1) {
    return null;
  }
  if (has5a && (buf & 0xff) != 0x5a) {
    throw new IOException("String_Node_Str");
  }
  data[0]=0x5a;
  buf=read();
  offset++;
  if (buf == -1 && !has5a) {
    return null;
  }
  if (buf == -1) {
    throw new IOException("String_Node_Str");
  }
  data[1]=(byte)(buf & 0xff);
  length=(byte)buf << 8;
  buf=read();
  offset++;
  if (buf == -1)   throw new IOException("String_Node_Str");
  data[2]=(byte)(buf & 0xff);
  length|=(byte)buf & 0xff;
  length-=2;
  if (length > data.length)   throw new IOException("String_Node_Str" + length);
  int read=read(data,3,length);
  offset+=read;
  if (read < length)   throw new IOException("String_Node_Str");
  SF sf=factory.sf(data,0,getLength() + 2);
  sf.setLength(length + 3);
  sf.setOffset(thisOffset);
  sf.setNumber(number++);
  return sf;
}

Fixed version (ground truth):
/** 
 * Reads a new structured field from the input stream. This method is not thread-safe!
 * @return structured field or null if end of input.
 * @throws IOException
 */
public SF readStructuredField() throws IOException {
  int buf=0;
  long thisOffset=offset;
  if (leadingLengthBytes == -1) {
    int leadingLength=0;
    do {
      buf=read();
      offset++;
      leadingLength++;
    }
 while ((buf & 0xff) != 0x5a && buf != -1 && leadingLength < 5);
    if ((buf & 0xff) != 0x5a) {
      has5a=false;
      leadingLength=1;
      offset=2;
      buf=read();
      if (buf == -1)       return null;
      if ((buf & 0xff) != 0xd3) {
        throw new IOException("String_Node_Str");
      }
      offset=0;
    }
    leadingLengthBytes=leadingLength - 1;
  }
 else {
    if (leadingLengthBytes > 0)     read(data,0,leadingLengthBytes);
    if (has5a) {
      buf=read();
      offset++;
    }
  }
  if (buf == -1) {
    return null;
  }
  if (has5a && (buf & 0xff) != 0x5a) {
    throw new IOException("String_Node_Str");
  }
  data[0]=0x5a;
  buf=read();
  offset++;
  if (buf == -1 && !has5a) {
    return null;
  }
  if (buf == -1) {
    throw new IOException("String_Node_Str");
  }
  data[1]=(byte)(buf & 0xff);
  length=(byte)buf << 8;
  buf=read();
  offset++;
  if (buf == -1)   throw new IOException("String_Node_Str");
  data[2]=(byte)(buf & 0xff);
  length|=(byte)buf & 0xff;
  length-=2;
  if (length > data.length)   throw new IOException("String_Node_Str" + length);
  int read=read(data,3,length);
  offset+=read;
  if (read < length)   throw new IOException("String_Node_Str");
  SF sf=factory.sf(data,0,getLength() + 2);
  sf.setLength(length + 3);
  sf.setOffset(thisOffset);
  sf.setNumber(number++);
  return sf;
}