Program: 107519
Project: 107519
Buggy source:
/** 
 * @return the packets represented in the FCI portion of an RTCPtransport-cc feedback packet. Note that the timestamps are represented in the 250µs format used by the on-the-wire format, and don't represent local time.
 * @param fciBuffer the buffer which contains the FCI portion of the RTCPfeedback packet.
 */
public static PacketMap getPacketsFci(ByteArrayBuffer fciBuffer){
  if (fciBuffer == null) {
    return null;
  }
  byte[] buf=fciBuffer.getBuffer();
  int off=fciBuffer.getOffset();
  int len=fciBuffer.getLength();
  if (len < MIN_FCI_LENGTH) {
    logger.warn(PARSE_ERROR + "String_Node_Str" + len);
    return null;
  }
  int baseSeq=RTPUtils.readUint16AsInt(buf,off);
  int packetStatusCount=RTPUtils.readUint16AsInt(buf,off + 2);
  long referenceTime=RTPUtils.readUint24AsInt(buf,off + 4) << 8;
  int pscOff=off + 8;
  int packetsRemaining=packetStatusCount;
  while (packetsRemaining > 0) {
    if (pscOff + 2 > off + len) {
      logger.warn(PARSE_ERROR + "String_Node_Str");
      return null;
    }
    int packetsInChunk=getPacketCount(buf,pscOff);
    packetsRemaining-=packetsInChunk;
    pscOff+=2;
  }
  int deltaStart=pscOff;
  int deltaOff=pscOff;
  pscOff=off + 8;
  packetsRemaining=packetStatusCount;
  PacketMap packets=new PacketMap();
  while (packetsRemaining > 0 && pscOff < deltaStart) {
    int packetsInChunk=Math.min(getPacketCount(buf,pscOff),packetsRemaining);
    for (int i=0; i < packetsInChunk; i++) {
      int symbol=readSymbol(buf,pscOff,i);
      int delta=-1;
switch (symbol) {
case SYMBOL_SMALL_DELTA:
        deltaOff++;
      if (deltaOff > off + len) {
        logger.warn(PARSE_ERROR + "String_Node_Str");
        return null;
      }
    delta=buf[deltaOff] & 0xff;
  break;
case SYMBOL_LARGE_DELTA:
deltaOff+=2;
if (deltaOff > off + len) {
logger.warn(PARSE_ERROR + "String_Node_Str");
return null;
}
delta=RTPUtils.readInt16AsInt(buf,deltaOff);
break;
case SYMBOL_NOT_RECEIVED:
default :
delta=-1;
break;
}
if (delta == -1) {
packets.put(baseSeq,NEGATIVE_ONE);
}
 else {
referenceTime+=delta;
packets.put(baseSeq,referenceTime);
}
baseSeq=(baseSeq + 1) & 0xffff;
}
pscOff+=2;
packetsRemaining-=packetsInChunk;
}
return packets;
}

Fixed version (ground truth):
/** 
 * @return the packets represented in the FCI portion of an RTCPtransport-cc feedback packet. Note that the timestamps are represented in the 250µs format used by the on-the-wire format, and don't represent local time.
 * @param fciBuffer the buffer which contains the FCI portion of the RTCPfeedback packet.
 */
public static PacketMap getPacketsFci(ByteArrayBuffer fciBuffer){
  if (fciBuffer == null) {
    return null;
  }
  byte[] buf=fciBuffer.getBuffer();
  int off=fciBuffer.getOffset();
  int len=fciBuffer.getLength();
  if (len < MIN_FCI_LENGTH) {
    logger.warn(PARSE_ERROR + "String_Node_Str" + len);
    return null;
  }
  int baseSeq=RTPUtils.readUint16AsInt(buf,off);
  int packetStatusCount=RTPUtils.readUint16AsInt(buf,off + 2);
  long referenceTime=RTPUtils.readUint24AsInt(buf,off + 4) << 8;
  int pscOff=off + 8;
  int packetsRemaining=packetStatusCount;
  while (packetsRemaining > 0) {
    if (pscOff + 2 > off + len) {
      logger.warn(PARSE_ERROR + "String_Node_Str");
      return null;
    }
    int packetsInChunk=getPacketCount(buf,pscOff);
    packetsRemaining-=packetsInChunk;
    pscOff+=2;
  }
  int deltaStart=pscOff;
  int deltaOff=pscOff;
  pscOff=off + 8;
  packetsRemaining=packetStatusCount;
  PacketMap packets=new PacketMap();
  while (packetsRemaining > 0 && pscOff < deltaStart) {
    int packetsInChunk=Math.min(getPacketCount(buf,pscOff),packetsRemaining);
    for (int i=0; i < packetsInChunk; i++) {
      int symbol=readSymbol(buf,pscOff,i);
      int delta=-1;
switch (symbol) {
case SYMBOL_SMALL_DELTA:
        if (deltaOff >= off + len) {
          logger.warn(PARSE_ERROR + "String_Node_Str");
          return null;
        }
      delta=buf[deltaOff++] & 0xff;
    break;
case SYMBOL_LARGE_DELTA:
  if (deltaOff + 1 >= off + len) {
    logger.warn(PARSE_ERROR + "String_Node_Str");
    return null;
  }
delta=RTPUtils.readInt16AsInt(buf,deltaOff);
deltaOff+=2;
break;
case SYMBOL_NOT_RECEIVED:
default :
delta=-1;
break;
}
if (delta == -1) {
packets.put(baseSeq,NEGATIVE_ONE);
}
 else {
referenceTime+=delta;
packets.put(baseSeq,referenceTime);
}
baseSeq=(baseSeq + 1) & 0xffff;
}
pscOff+=2;
packetsRemaining-=packetsInChunk;
}
return packets;
}