Program: 111577
Project: 111577
Buggy source:
private void processSecurityTypesMsg(){
  vlog.info("String_Node_Str");
  int secType=Security.secTypeInvalid;
  List<Integer> secTypes=new ArrayList<Integer>();
  secTypes=security.GetEnabledSecTypes();
  if (cp.isVersion(3,3)) {
    secType=is.readU32();
    if (secType == Security.secTypeInvalid) {
      throwConnFailedException();
    }
 else     if (secType == Security.secTypeNone || secType == Security.secTypeVncAuth) {
      Iterator i;
      for (i=secTypes.iterator(); i.hasNext(); ) {
        int refType=(Integer)i.next();
        if (refType == secType) {
          secType=refType;
          break;
        }
      }
      if (!i.hasNext())       secType=Security.secTypeInvalid;
    }
 else {
      vlog.error("String_Node_Str" + secType);
      throw new Exception("String_Node_Str");
    }
  }
 else {
    int nServerSecTypes=is.readU8();
    if (nServerSecTypes == 0)     throwConnFailedException();
    for (int i=0; i < nServerSecTypes; i++) {
      int serverSecType=is.readU8();
      vlog.info("String_Node_Str" + Security.secTypeName(serverSecType) + "String_Node_Str"+ serverSecType+ "String_Node_Str");
      if (secType == Security.secTypeInvalid) {
        for (Iterator j=secTypes.iterator(); j.hasNext(); ) {
          int refType=(Integer)j.next();
          if (refType == serverSecType) {
            secType=refType;
            break;
          }
        }
      }
    }
    if (secType != Security.secTypeInvalid) {
      os.writeU8(secType);
      os.flush();
      vlog.info("String_Node_Str" + Security.secTypeName(secType) + "String_Node_Str"+ secType+ "String_Node_Str");
    }
  }
  if (secType == Security.secTypeInvalid) {
    state_=RFBSTATE_INVALID;
    vlog.error("String_Node_Str");
    throw new Exception("String_Node_Str");
  }
  state_=RFBSTATE_SECURITY;
  csecurity=security.GetCSecurity(secType);
  processSecurityMsg();
}

Fixed version (ground truth):
private void processSecurityTypesMsg(){
  vlog.info("String_Node_Str");
  int secType=Security.secTypeInvalid;
  List<Integer> secTypes=new ArrayList<Integer>();
  secTypes=security.GetEnabledSecTypes();
  if (cp.isVersion(3,3)) {
    secType=is.readU32();
    if (secType == Security.secTypeInvalid) {
      throwConnFailedException();
    }
 else     if (secType == Security.secTypeNone || secType == Security.secTypeVncAuth) {
      Iterator i;
      for (i=secTypes.iterator(); i.hasNext(); ) {
        int refType=(Integer)i.next();
        if (refType == secType) {
          secType=refType;
          break;
        }
        if (!i.hasNext())         secType=Security.secTypeInvalid;
      }
    }
 else {
      vlog.error("String_Node_Str" + secType);
      throw new Exception("String_Node_Str");
    }
  }
 else {
    int nServerSecTypes=is.readU8();
    if (nServerSecTypes == 0)     throwConnFailedException();
    for (int i=0; i < nServerSecTypes; i++) {
      int serverSecType=is.readU8();
      vlog.info("String_Node_Str" + Security.secTypeName(serverSecType) + "String_Node_Str"+ serverSecType+ "String_Node_Str");
      if (secType == Security.secTypeInvalid) {
        for (Iterator j=secTypes.iterator(); j.hasNext(); ) {
          int refType=(Integer)j.next();
          if (refType == serverSecType) {
            secType=refType;
            break;
          }
        }
      }
    }
    if (secType != Security.secTypeInvalid) {
      os.writeU8(secType);
      os.flush();
      vlog.info("String_Node_Str" + Security.secTypeName(secType) + "String_Node_Str"+ secType+ "String_Node_Str");
    }
  }
  if (secType == Security.secTypeInvalid) {
    state_=RFBSTATE_INVALID;
    vlog.error("String_Node_Str");
    throw new Exception("String_Node_Str");
  }
  state_=RFBSTATE_SECURITY;
  csecurity=security.GetCSecurity(secType);
  processSecurityMsg();
}