Program: 104227
Project: 104227
Buggy source:
/** 
 * Transform a SRTP packet into a RTP packet. This method is called when a SRTP packet is received. Operations done by the this operation include: Authentication check, Packet replay check and decryption. Both encryption and authentication functionality can be turned off as long as the SRTPPolicy used in this SRTPCryptoContext is requires no encryption and no authentication. Then the packet will be sent out untouched. However this is not encouraged. If no SRTP feature is enabled, then we shall not use SRTP TransformConnector. We should use the original method (RTPManager managed transportation) instead.  
 * @param pkt the RTP packet that is just received
 * @return true if the packet can be acceptedfalse if the packet failed authentication or failed replay check 
 */
public boolean reverseTransformPacket(RawPacket pkt){
  if (this.policy.getAuthType() == SRTPPolicy.HMACSHA1_AUTHENTICATION) {
    int tagLength=this.policy.getAuthTagLength();
    byte[] originalTag=pkt.readRegion(pkt.getLength() - tagLength,tagLength);
    pkt.shrink(tagLength);
    byte[] calculatedTag=authenticatePacketHMCSHA1(pkt);
    for (int i=0; i < tagLength; i++) {
      if ((originalTag[i] & 0xff) == (calculatedTag[i] & 0xff))       continue;
 else       return false;
    }
  }
  int seqNum=PacketManipulator.GetRTPSequenceNumber(pkt);
  if (!checkReplay(seqNum)) {
    return false;
  }
  if (this.policy.getEncType() == SRTPPolicy.AESCM_ENCRYPTION) {
    processPacketAESCM(pkt);
  }
 else   if (this.policy.getEncType() == SRTPPolicy.AESF8_ENCRYPTION) {
    processPacketAESF8(pkt);
  }
  update(seqNum);
  return true;
}

Fixed version (ground truth):
/** 
 * Transform a SRTP packet into a RTP packet. This method is called when a SRTP packet is received. Operations done by the this operation include: Authentication check, Packet replay check and decryption. Both encryption and authentication functionality can be turned off as long as the SRTPPolicy used in this SRTPCryptoContext is requires no encryption and no authentication. Then the packet will be sent out untouched. However this is not encouraged. If no SRTP feature is enabled, then we shall not use SRTP TransformConnector. We should use the original method (RTPManager managed transportation) instead.  
 * @param pkt the RTP packet that is just received
 * @return true if the packet can be acceptedfalse if the packet failed authentication or failed replay check 
 */
public boolean reverseTransformPacket(RawPacket pkt){
  int seqNum=PacketManipulator.GetRTPSequenceNumber(pkt);
  if (!checkReplay(seqNum)) {
    return false;
  }
  if (this.policy.getAuthType() == SRTPPolicy.HMACSHA1_AUTHENTICATION) {
    int tagLength=this.policy.getAuthTagLength();
    byte[] originalTag=pkt.readRegion(pkt.getLength() - tagLength,tagLength);
    pkt.shrink(tagLength);
    long guessedIndex=guessIndex(seqNum);
    int guessedRoc=(int)(guessedIndex >> 16);
    byte[] calculatedTag=authenticatePacketHMCSHA1(pkt,guessedRoc);
    for (int i=0; i < tagLength; i++) {
      if ((originalTag[i] & 0xff) == (calculatedTag[i] & 0xff))       continue;
 else       return false;
    }
  }
  if (this.policy.getEncType() == SRTPPolicy.AESCM_ENCRYPTION) {
    processPacketAESCM(pkt);
  }
 else   if (this.policy.getEncType() == SRTPPolicy.AESF8_ENCRYPTION) {
    processPacketAESF8(pkt);
  }
  update(seqNum);
  return true;
}