Program: 143918
Project: 143918
Buggy source:
private byte[] Send_SSH_CMSG_SESSION_KEY(byte[] anti_spoofing_cookie,byte[] server_key_public_modulus,byte[] host_key_public_modulus,byte[] supported_ciphers_mask,byte[] server_key_public_exponent,byte[] host_key_public_exponent) throws IOException {
  String str;
  int boffset;
  byte cipher_type;
  byte[] session_key;
  byte[] session_id_byte=new byte[host_key_public_modulus.length + server_key_public_modulus.length + anti_spoofing_cookie.length];
  System.arraycopy(host_key_public_modulus,0,session_id_byte,0,host_key_public_modulus.length);
  System.arraycopy(server_key_public_modulus,0,session_id_byte,host_key_public_modulus.length,server_key_public_modulus.length);
  System.arraycopy(anti_spoofing_cookie,0,session_id_byte,host_key_public_modulus.length + server_key_public_modulus.length,anti_spoofing_cookie.length);
  byte[] hash_md5=MD5.hash(session_id_byte);
  cipher_type=(byte)SSH_CIPHER_IDEA;
  if ((((1 << cipher_type) & 0xff) & supported_ciphers_mask[3]) == 0) {
    System.err.println("String_Node_Str");
    disconnect();
    return "String_Node_Str".getBytes();
  }
  byte[] random_bits1=new byte[16], random_bits2=new byte[16];
  random_bits2=random_bits1=MD5.hash("String_Node_Str" + Math.random() * (new java.util.Date()).getTime());
  random_bits1=MD5.hash(SshMisc.addArrayOfBytes(MD5.hash(password + login),random_bits1));
  random_bits2=MD5.hash(SshMisc.addArrayOfBytes(MD5.hash(password + login),random_bits2));
  session_key=SshMisc.addArrayOfBytes(random_bits1,random_bits2);
  byte[] session_keyXored=SshMisc.XORArrayOfBytes(random_bits1,hash_md5);
  session_keyXored=SshMisc.addArrayOfBytes(session_keyXored,session_keyXored);
  byte[] encrypted_session_key=SshCrypto.encrypteRSAPkcs1Twice(session_keyXored,server_key_public_exponent,server_key_public_modulus,host_key_public_exponent,host_key_public_modulus);
  byte[] protocol_flags=new byte[4];
  protocol_flags[0]=protocol_flags[1]=protocol_flags[2]=protocol_flags[3]=0;
  int length=1 + anti_spoofing_cookie.length + encrypted_session_key.length+ protocol_flags.length;
  byte[] data=new byte[length];
  boffset=0;
  data[boffset++]=(byte)cipher_type;
  for (int i=0; i < 8; i++)   data[boffset++]=anti_spoofing_cookie[i];
  for (int i=0; i < encrypted_session_key.length; i++)   data[boffset++]=encrypted_session_key[i];
  for (int i=0; i < 4; i++)   data[boffset++]=protocol_flags[i];
  byte packet_type=SSH_CMSG_SESSION_KEY;
  SshPacket packet=createPacket(packet_type,data);
  sendPacket(packet);
  if (cipher_type == (byte)SSH_CIPHER_IDEA) {
    byte[] IDEAKey=new byte[16];
    for (int i=0; i < 16; i++)     IDEAKey[i]=session_key[i];
    crypto=new SshCrypto(IDEAKey);
    encryption=true;
  }
  return null;
}

Fixed version (ground truth):
private byte[] Send_SSH_CMSG_SESSION_KEY(byte[] anti_spoofing_cookie,byte[] server_key_public_modulus,byte[] host_key_public_modulus,byte[] supported_ciphers_mask,byte[] server_key_public_exponent,byte[] host_key_public_exponent) throws IOException {
  String str;
  int boffset;
  byte cipher_type;
  byte[] session_key;
  byte[] session_id_byte=new byte[host_key_public_modulus.length + server_key_public_modulus.length + anti_spoofing_cookie.length];
  System.arraycopy(host_key_public_modulus,0,session_id_byte,0,host_key_public_modulus.length);
  System.arraycopy(server_key_public_modulus,0,session_id_byte,host_key_public_modulus.length,server_key_public_modulus.length);
  System.arraycopy(anti_spoofing_cookie,0,session_id_byte,host_key_public_modulus.length + server_key_public_modulus.length,anti_spoofing_cookie.length);
  byte[] hash_md5=MD5.hash(session_id_byte);
  cipher_type=(byte)SSH_CIPHER_IDEA;
  if ((((1 << cipher_type) & 0xff) & supported_ciphers_mask[3]) == 0) {
    System.err.println("String_Node_Str" + supported_ciphers_mask[3] + "String_Node_Str");
    disconnect();
    return "String_Node_Str".getBytes();
  }
  byte[] random_bits1=new byte[16], random_bits2=new byte[16];
  random_bits2=random_bits1=MD5.hash("String_Node_Str" + Math.random() * (new java.util.Date()).getTime());
  random_bits1=MD5.hash(SshMisc.addArrayOfBytes(MD5.hash(password + login),random_bits1));
  random_bits2=MD5.hash(SshMisc.addArrayOfBytes(MD5.hash(password + login),random_bits2));
  session_key=SshMisc.addArrayOfBytes(random_bits1,random_bits2);
  byte[] session_keyXored=SshMisc.XORArrayOfBytes(random_bits1,hash_md5);
  session_keyXored=SshMisc.addArrayOfBytes(session_keyXored,session_keyXored);
  byte[] encrypted_session_key=SshCrypto.encrypteRSAPkcs1Twice(session_keyXored,server_key_public_exponent,server_key_public_modulus,host_key_public_exponent,host_key_public_modulus);
  byte[] protocol_flags=new byte[4];
  protocol_flags[0]=protocol_flags[1]=protocol_flags[2]=protocol_flags[3]=0;
  int length=1 + anti_spoofing_cookie.length + encrypted_session_key.length+ protocol_flags.length;
  byte[] data=new byte[length];
  boffset=0;
  data[boffset++]=(byte)cipher_type;
  for (int i=0; i < 8; i++)   data[boffset++]=anti_spoofing_cookie[i];
  for (int i=0; i < encrypted_session_key.length; i++)   data[boffset++]=encrypted_session_key[i];
  for (int i=0; i < 4; i++)   data[boffset++]=protocol_flags[i];
  byte packet_type=SSH_CMSG_SESSION_KEY;
  SshPacket packet=createPacket(packet_type,data);
  sendPacket(packet);
  if (cipher_type == (byte)SSH_CIPHER_IDEA) {
    byte[] IDEAKey=new byte[16];
    for (int i=0; i < 16; i++)     IDEAKey[i]=session_key[i];
    crypto=new SshCrypto(IDEAKey);
    encryption=true;
  }
  return null;
}