Program: 4517
Project: 4517
Buggy source:
/** 
 * Internal constructor.  Only creates QHD if includeQHD==true.  
 */
private QueryReply(byte[] guid,byte ttl,int port,byte[] ip,long speed,Response[] responses,byte[] clientGUID,byte[] xmlBytes,boolean includeQHD,boolean needsPush,boolean isBusy,boolean finishedUpload,boolean measuredSpeed,boolean supportsChat,boolean supportsBH,boolean isMulticastReply,Set proxies){
  super(guid,Message.F_QUERY_REPLY,ttl,(byte)0,0,16);
  if (xmlBytes.length > XML_MAX_SIZE)   return;
  final int n=responses.length;
  if (!NetworkUtils.isValidPort(port)) {
    throw new IllegalArgumentException("String_Node_Str" + port);
  }
 else   if (ip.length != 4) {
    throw new IllegalArgumentException("String_Node_Str" + ip.length);
  }
 else   if (!NetworkUtils.isValidAddress(ip)) {
    throw new IllegalArgumentException("String_Node_Str" + NetworkUtils.ip2string(ip));
  }
 else   if ((speed & 0xFFFFFFFF00000000l) != 0) {
    throw new IllegalArgumentException("String_Node_Str" + speed);
  }
 else   if (n >= 256) {
    throw new IllegalArgumentException("String_Node_Str" + n);
  }
  _proxies=proxies;
  ByteArrayOutputStream baos=new ByteArrayOutputStream();
  try {
    baos.write(n);
    ByteOrder.short2leb((short)port,baos);
    baos.write(ip,0,ip.length);
    ByteOrder.int2leb((int)speed,baos);
    for (int left=n; left > 0; left--) {
      Response r=responses[n - left];
      r.writeToStream(baos);
    }
    if (includeQHD) {
      baos.write(76);
      baos.write(73);
      baos.write(77);
      baos.write(69);
      baos.write(COMMON_PAYLOAD_LEN);
      int ggepLen=_ggepUtil.getQRGGEP(false,false,DataUtils.EMPTY_SET).length;
      byte flags=(byte)((needsPush && !isMulticastReply ? PUSH_MASK : 0) | BUSY_MASK | UPLOADED_MASK| SPEED_MASK| GGEP_MASK);
      byte controls=(byte)(PUSH_MASK | (isBusy && !isMulticastReply ? BUSY_MASK : 0) | (finishedUpload ? UPLOADED_MASK : 0)| (measuredSpeed || isMulticastReply ? SPEED_MASK : 0)| (supportsBH || isMulticastReply ? GGEP_MASK : (ggepLen > 0 ? GGEP_MASK : 0)));
      baos.write(flags);
      baos.write(controls);
      int xmlSize=xmlBytes.length + 1;
      if (xmlSize > XML_MAX_SIZE)       xmlSize=XML_MAX_SIZE;
      ByteOrder.short2leb(((short)xmlSize),baos);
      byte chatSupport=(byte)(supportsChat ? CHAT_MASK : 0);
      baos.write(chatSupport);
      byte[] ggepBytes=_ggepUtil.getQRGGEP(supportsBH,isMulticastReply,_proxies);
      baos.write(ggepBytes,0,ggepBytes.length);
      baos.write(xmlBytes,0,xmlBytes.length);
      baos.write(0);
    }
    baos.write(clientGUID,0,16);
    _payload=baos.toByteArray();
    updateLength(_payload.length);
  }
 catch (  IOException reallyBad) {
    ErrorService.error(reallyBad);
  }
  setAddress();
}

Fixed version (ground truth):
/** 
 * Internal constructor.  Only creates QHD if includeQHD==true.  
 */
private QueryReply(byte[] guid,byte ttl,int port,byte[] ip,long speed,Response[] responses,byte[] clientGUID,byte[] xmlBytes,boolean includeQHD,boolean needsPush,boolean isBusy,boolean finishedUpload,boolean measuredSpeed,boolean supportsChat,boolean supportsBH,boolean isMulticastReply,Set proxies){
  super(guid,Message.F_QUERY_REPLY,ttl,(byte)0,0,16);
  if (xmlBytes.length > XML_MAX_SIZE)   return;
  final int n=responses.length;
  if (!NetworkUtils.isValidPort(port)) {
    throw new IllegalArgumentException("String_Node_Str" + port);
  }
 else   if (ip.length != 4) {
    throw new IllegalArgumentException("String_Node_Str" + ip.length);
  }
 else   if (!NetworkUtils.isValidAddress(ip)) {
    throw new IllegalArgumentException("String_Node_Str" + NetworkUtils.ip2string(ip));
  }
 else   if ((speed & 0xFFFFFFFF00000000l) != 0) {
    throw new IllegalArgumentException("String_Node_Str" + speed);
  }
 else   if (n >= 256) {
    throw new IllegalArgumentException("String_Node_Str" + n);
  }
  _proxies=proxies;
  ByteArrayOutputStream baos=new ByteArrayOutputStream();
  try {
    baos.write(n);
    ByteOrder.short2leb((short)port,baos);
    baos.write(ip,0,ip.length);
    ByteOrder.int2leb((int)speed,baos);
    for (int left=n; left > 0; left--) {
      Response r=responses[n - left];
      r.writeToStream(baos);
    }
    if (includeQHD) {
      baos.write(76);
      baos.write(73);
      baos.write(77);
      baos.write(69);
      baos.write(COMMON_PAYLOAD_LEN);
      int ggepLen=_ggepUtil.getQRGGEP(false,false,DataUtils.EMPTY_SET).length;
      boolean hasProxies=(_proxies != null) && (_proxies.size() > 0);
      byte flags=(byte)((needsPush && !isMulticastReply ? PUSH_MASK : 0) | BUSY_MASK | UPLOADED_MASK| SPEED_MASK| GGEP_MASK);
      byte controls=(byte)(PUSH_MASK | (isBusy && !isMulticastReply ? BUSY_MASK : 0) | (finishedUpload ? UPLOADED_MASK : 0)| (measuredSpeed || isMulticastReply ? SPEED_MASK : 0)| (supportsBH || isMulticastReply || hasProxies ? GGEP_MASK : (ggepLen > 0 ? GGEP_MASK : 0)));
      baos.write(flags);
      baos.write(controls);
      int xmlSize=xmlBytes.length + 1;
      if (xmlSize > XML_MAX_SIZE)       xmlSize=XML_MAX_SIZE;
      ByteOrder.short2leb(((short)xmlSize),baos);
      byte chatSupport=(byte)(supportsChat ? CHAT_MASK : 0);
      baos.write(chatSupport);
      byte[] ggepBytes=_ggepUtil.getQRGGEP(supportsBH,isMulticastReply,_proxies);
      baos.write(ggepBytes,0,ggepBytes.length);
      baos.write(xmlBytes,0,xmlBytes.length);
      baos.write(0);
    }
    baos.write(clientGUID,0,16);
    _payload=baos.toByteArray();
    updateLength(_payload.length);
  }
 catch (  IOException reallyBad) {
    ErrorService.error(reallyBad);
  }
  setAddress();
}