Program: 143910
Project: 143910
Buggy source:
static public byte[] encrypteRSAPkcs1Twice(byte[] clearData,byte[] server_key_public_exponent,byte[] server_key_public_modulus,byte[] host_key_public_exponent,byte[] host_key_public_modulus){
  byte[] EncryptionBlock;
  int offset=0;
  EncryptionBlock=new byte[server_key_public_modulus.length];
  EncryptionBlock[0]=0;
  EncryptionBlock[1]=2;
  offset=2;
  for (int i=2; i < (EncryptionBlock.length - clearData.length - 1); i++)   EncryptionBlock[offset++]=SshMisc.getNotZeroRandomByte();
  EncryptionBlock[offset++]=0;
  for (int i=0; i < clearData.length; i++)   EncryptionBlock[offset++]=clearData[i];
  BigInteger m, e, message;
  byte[] messageByte;
  m=new BigInteger(1,server_key_public_modulus);
  e=new BigInteger(1,server_key_public_exponent);
  message=new BigInteger(1,EncryptionBlock);
  message=message.modPow(e,m);
  byte[] messageByteTemp=message.toByteArray();
  messageByte=new byte[server_key_public_modulus.length];
  int tempOffset=0;
  while (messageByteTemp[tempOffset] == 0)   tempOffset++;
  for (int i=messageByte.length - messageByteTemp.length + tempOffset; i < messageByte.length; i++)   messageByte[i]=messageByteTemp[tempOffset++];
  clearData=messageByte;
  offset=0;
  EncryptionBlock=new byte[host_key_public_modulus.length];
  EncryptionBlock[0]=0;
  EncryptionBlock[1]=2;
  offset=2;
  for (int i=2; i < (EncryptionBlock.length - clearData.length - 1); i++)   EncryptionBlock[offset++]=SshMisc.getNotZeroRandomByte();
  EncryptionBlock[offset++]=0;
  for (int i=0; i < clearData.length; i++)   EncryptionBlock[offset++]=clearData[i];
  m=new BigInteger(1,host_key_public_modulus);
  e=new BigInteger(1,host_key_public_exponent);
  message=new BigInteger(1,EncryptionBlock);
  message=message.modPow(e,m);
  messageByteTemp=message.toByteArray();
  messageByte=new byte[host_key_public_modulus.length];
  tempOffset=0;
  while (messageByteTemp[tempOffset] == 0)   tempOffset++;
  for (int i=messageByte.length - messageByteTemp.length + tempOffset; i < messageByte.length; i++)   messageByte[i]=messageByteTemp[tempOffset++];
  byte[] encrypted_session_key=new byte[host_key_public_modulus.length + 2];
  encrypted_session_key[1]=(byte)((8 * host_key_public_modulus.length) & 0xff);
  encrypted_session_key[0]=(byte)(((8 * host_key_public_modulus.length) >> 8) & 0xff);
  for (int i=0; i < host_key_public_modulus.length; i++)   encrypted_session_key[i + 2]=messageByte[i];
  return encrypted_session_key;
}

Fixed version (ground truth):
static public byte[] encrypteRSAPkcs1Twice(byte[] clearData,byte[] server_key_public_exponent,byte[] server_key_public_modulus,byte[] host_key_public_exponent,byte[] host_key_public_modulus){
  byte[] key1exp, key1mod, key2exp, key2mod;
  if (server_key_public_modulus.length < host_key_public_modulus.length) {
    key1exp=server_key_public_exponent;
    key1mod=server_key_public_modulus;
    key2exp=host_key_public_exponent;
    key2mod=host_key_public_modulus;
  }
 else {
    key1exp=host_key_public_exponent;
    key1mod=host_key_public_modulus;
    key2exp=server_key_public_exponent;
    key2mod=server_key_public_modulus;
  }
  byte[] EncryptionBlock;
  int offset=0;
  EncryptionBlock=new byte[key1mod.length];
  EncryptionBlock[0]=0;
  EncryptionBlock[1]=2;
  offset=2;
  for (int i=2; i < (EncryptionBlock.length - clearData.length - 1); i++)   EncryptionBlock[offset++]=SshMisc.getNotZeroRandomByte();
  EncryptionBlock[offset++]=0;
  for (int i=0; i < clearData.length; i++)   EncryptionBlock[offset++]=clearData[i];
  BigInteger m, e, message;
  byte[] messageByte;
  m=new BigInteger(1,key1mod);
  e=new BigInteger(1,key1exp);
  message=new BigInteger(1,EncryptionBlock);
  message=message.modPow(e,m);
  byte[] messageByteTemp=message.toByteArray();
  messageByte=new byte[key1mod.length];
  int tempOffset=0;
  while (messageByteTemp[tempOffset] == 0)   tempOffset++;
  for (int i=messageByte.length - messageByteTemp.length + tempOffset; i < messageByte.length; i++)   messageByte[i]=messageByteTemp[tempOffset++];
  clearData=messageByte;
  offset=0;
  EncryptionBlock=new byte[key2mod.length];
  EncryptionBlock[0]=0;
  EncryptionBlock[1]=2;
  offset=2;
  for (int i=2; i < (EncryptionBlock.length - clearData.length - 1); i++)   EncryptionBlock[offset++]=SshMisc.getNotZeroRandomByte();
  EncryptionBlock[offset++]=0;
  for (int i=0; (i < clearData.length); i++)   EncryptionBlock[offset++]=clearData[i];
  m=new BigInteger(1,key2mod);
  e=new BigInteger(1,key2exp);
  message=new BigInteger(1,EncryptionBlock);
  message=message.modPow(e,m);
  messageByteTemp=message.toByteArray();
  messageByte=new byte[key2mod.length];
  tempOffset=0;
  while (messageByteTemp[tempOffset] == 0)   tempOffset++;
  for (int i=messageByte.length - messageByteTemp.length + tempOffset; i < messageByte.length; i++)   messageByte[i]=messageByteTemp[tempOffset++];
  byte[] encrypted_session_key=new byte[key2mod.length + 2];
  encrypted_session_key[1]=(byte)((8 * key2mod.length) & 0xff);
  encrypted_session_key[0]=(byte)(((8 * key2mod.length) >> 8) & 0xff);
  for (int i=0; i < key2mod.length; i++)   encrypted_session_key[i + 2]=messageByte[i];
  return encrypted_session_key;
}