Program: 172284
Project: 172284
Buggy source:
/** 
 * Process the CIFS session setup request packet and build the session setup response
 * @param sess SMBSrvSession
 * @param reqPkt SMBSrvPacket
 * @param respPkt SMBSrvPacket
 * @exception SMBSrvException
 */
public void processSessionSetup(SMBSrvSession sess,SMBSrvPacket reqPkt,SMBSrvPacket respPkt) throws SMBSrvException {
  if (reqPkt.checkPacketIsValid(13,0) == false) {
    throw new SMBSrvException(SMBStatus.NTInvalidParameter,SMBStatus.SRVNonSpecificError,SMBStatus.ErrSrv);
  }
  int maxBufSize=reqPkt.getParameter(2);
  int maxMpx=reqPkt.getParameter(3);
  int vcNum=reqPkt.getParameter(4);
  int ascPwdLen=reqPkt.getParameter(7);
  int uniPwdLen=reqPkt.getParameter(8);
  int capabs=reqPkt.getParameterLong(11);
  byte[] buf=reqPkt.getBuffer();
  boolean isUni=reqPkt.isUnicode();
  byte[] ascPwd=reqPkt.unpackBytes(ascPwdLen);
  byte[] uniPwd=reqPkt.unpackBytes(uniPwdLen);
  String user=reqPkt.unpackString(isUni);
  if (user == null) {
    throw new SMBSrvException(SMBStatus.NTInvalidParameter,SMBStatus.SRVNonSpecificError,SMBStatus.ErrSrv);
  }
  String domain="String_Node_Str";
  if (reqPkt.hasMoreData()) {
    domain=reqPkt.unpackString(isUni);
    if (domain == null) {
      throw new SMBSrvException(SMBStatus.NTInvalidParameter,SMBStatus.SRVNonSpecificError,SMBStatus.ErrSrv);
    }
  }
  String clientOS="String_Node_Str";
  if (reqPkt.hasMoreData()) {
    clientOS=reqPkt.unpackString(isUni);
    if (clientOS == null) {
      throw new SMBSrvException(SMBStatus.NTInvalidParameter,SMBStatus.SRVNonSpecificError,SMBStatus.ErrSrv);
    }
  }
  if (logger.isDebugEnabled() && sess.hasDebug(SMBSrvSession.DBG_NEGOTIATE)) {
    logger.debug("String_Node_Str" + user + "String_Node_Str"+ (uniPwd != null ? HexDump.hexString(uniPwd) : "String_Node_Str")+ "String_Node_Str"+ (ascPwd != null ? HexDump.hexString(ascPwd) : "String_Node_Str")+ "String_Node_Str"+ domain+ "String_Node_Str"+ clientOS+ "String_Node_Str"+ vcNum+ "String_Node_Str"+ maxBufSize+ "String_Node_Str"+ maxMpx+ "String_Node_Str"+ sess.getAuthenticationContext());
    logger.debug("String_Node_Str" + reqPkt.getMultiplexId() + "String_Node_Str"+ reqPkt.getUserId()+ "String_Node_Str"+ reqPkt.getProcessId());
  }
  sess.setClientMaximumBufferSize(maxBufSize != 0 ? maxBufSize : SMBSrvSession.DefaultBufferSize);
  sess.setClientMaximumMultiplex(maxMpx);
  sess.setClientCapabilities(capabs);
  ClientInfo client=new ClientInfo(user,uniPwd);
  client.setANSIPassword(ascPwd);
  client.setDomain(domain);
  client.setOperatingSystem(clientOS);
  if (sess.hasRemoteAddress())   client.setClientAddress(sess.getRemoteAddress().getHostAddress());
  if (user.length() == 0 && domain.length() == 0 && uniPwdLen == 0 && ascPwdLen == 1)   client.setLogonType(ClientInfo.LogonNull);
  int sts=authenticateUser(client,sess,CifsAuthenticator.NTLM1);
  if (sts > 0 && (sts & CifsAuthenticator.AUTH_GUEST) != 0) {
    client.setGuest(true);
    if (logger.isDebugEnabled() && sess.hasDebug(SMBSrvSession.DBG_NEGOTIATE))     logger.debug("String_Node_Str" + user + "String_Node_Str");
  }
 else   if (sts != CifsAuthenticator.AUTH_ALLOW) {
    if (logger.isDebugEnabled() && sess.hasDebug(SMBSrvSession.DBG_NEGOTIATE))     logger.debug("String_Node_Str" + user + "String_Node_Str");
    throw new SMBSrvException(SMBStatus.NTLogonFailure,SMBStatus.DOSAccessDenied,SMBStatus.ErrDos);
  }
 else   if (logger.isDebugEnabled() && sess.hasDebug(SMBSrvSession.DBG_NEGOTIATE)) {
    if (client.isNullSession() == false)     client.setAuthenticationToken(m_authComponent.getCurrentAuthentication());
 else     client.setAuthenticationToken(null);
    logger.debug("String_Node_Str" + user + "String_Node_Str"+ (client != null ? "String_Node_Str" + client.getLogonTypeString() + "String_Node_Str" : "String_Node_Str"));
  }
  VirtualCircuit vc=new VirtualCircuit(vcNum,client);
  int uid=sess.addVirtualCircuit(vc);
  if (uid == VirtualCircuit.InvalidUID) {
    if (logger.isDebugEnabled() && sess.hasDebug(SMBSrvSession.DBG_NEGOTIATE))     logger.debug("String_Node_Str" + vc);
    throw new SMBSrvException(SMBStatus.NTLogonFailure,SMBStatus.DOSAccessDenied,SMBStatus.ErrDos);
  }
 else   if (logger.isDebugEnabled() && sess.hasDebug(SMBSrvSession.DBG_NEGOTIATE)) {
    logger.debug("String_Node_Str" + uid + "String_Node_Str"+ vc);
  }
  sess.setLoggedOn(true);
  respPkt.setParameterCount(3);
  respPkt.setParameter(0,0);
  respPkt.setParameter(1,0);
  respPkt.setParameter(2,client.isGuest() ? 1 : 0);
  respPkt.setByteCount(0);
  respPkt.setTreeId(0);
  respPkt.setUserId(uid);
  int flags=respPkt.getFlags();
  flags&=~SMBSrvPacket.FLG_CASELESS;
  respPkt.setFlags(flags);
  int flags2=SMBSrvPacket.FLG2_LONGFILENAMES;
  if (isUni)   flags2+=SMBSrvPacket.FLG2_UNICODE;
  respPkt.setFlags2(flags2);
  int pos=respPkt.getByteOffset();
  buf=respPkt.getBuffer();
  if (isUni)   pos=DataPacker.wordAlign(pos);
  pos=DataPacker.putString("String_Node_Str",buf,pos,true,isUni);
  pos=DataPacker.putString("String_Node_Str" + sess.getServer().isVersion(),buf,pos,true,isUni);
  pos=DataPacker.putString(sess.getServer().getConfiguration().getDomainName(),buf,pos,true,isUni);
  respPkt.setByteCount(pos - respPkt.getByteOffset());
}

Fixed version (ground truth):
/** 
 * Process the CIFS session setup request packet and build the session setup response
 * @param sess SMBSrvSession
 * @param reqPkt SMBSrvPacket
 * @param respPkt SMBSrvPacket
 * @exception SMBSrvException
 */
public void processSessionSetup(SMBSrvSession sess,SMBSrvPacket reqPkt,SMBSrvPacket respPkt) throws SMBSrvException {
  if (reqPkt.checkPacketIsValid(13,0) == false) {
    throw new SMBSrvException(SMBStatus.NTInvalidParameter,SMBStatus.SRVNonSpecificError,SMBStatus.ErrSrv);
  }
  int maxBufSize=reqPkt.getParameter(2);
  int maxMpx=reqPkt.getParameter(3);
  int vcNum=reqPkt.getParameter(4);
  int ascPwdLen=reqPkt.getParameter(7);
  int uniPwdLen=reqPkt.getParameter(8);
  int capabs=reqPkt.getParameterLong(11);
  byte[] buf=reqPkt.getBuffer();
  boolean isUni=reqPkt.isUnicode();
  byte[] ascPwd=reqPkt.unpackBytes(ascPwdLen);
  byte[] uniPwd=reqPkt.unpackBytes(uniPwdLen);
  String user=reqPkt.unpackString(isUni);
  if (user == null) {
    throw new SMBSrvException(SMBStatus.NTInvalidParameter,SMBStatus.SRVNonSpecificError,SMBStatus.ErrSrv);
  }
  String domain="String_Node_Str";
  if (reqPkt.hasMoreData()) {
    domain=reqPkt.unpackString(isUni);
    if (domain == null) {
      throw new SMBSrvException(SMBStatus.NTInvalidParameter,SMBStatus.SRVNonSpecificError,SMBStatus.ErrSrv);
    }
  }
  String clientOS="String_Node_Str";
  if (reqPkt.hasMoreData()) {
    clientOS=reqPkt.unpackString(isUni);
    if (clientOS == null) {
      throw new SMBSrvException(SMBStatus.NTInvalidParameter,SMBStatus.SRVNonSpecificError,SMBStatus.ErrSrv);
    }
  }
  if (logger.isDebugEnabled() && sess.hasDebug(SMBSrvSession.DBG_NEGOTIATE)) {
    logger.debug("String_Node_Str" + user + "String_Node_Str"+ (uniPwd != null ? HexDump.hexString(uniPwd) : "String_Node_Str")+ "String_Node_Str"+ (ascPwd != null ? HexDump.hexString(ascPwd) : "String_Node_Str")+ "String_Node_Str"+ domain+ "String_Node_Str"+ clientOS+ "String_Node_Str"+ vcNum+ "String_Node_Str"+ maxBufSize+ "String_Node_Str"+ maxMpx+ "String_Node_Str"+ sess.getAuthenticationContext());
    logger.debug("String_Node_Str" + reqPkt.getMultiplexId() + "String_Node_Str"+ reqPkt.getUserId()+ "String_Node_Str"+ reqPkt.getProcessId());
  }
  sess.setClientMaximumBufferSize(maxBufSize != 0 ? maxBufSize : SMBSrvSession.DefaultBufferSize);
  sess.setClientMaximumMultiplex(maxMpx);
  sess.setClientCapabilities(capabs);
  ClientInfo client=new ClientInfo(user,uniPwd);
  client.setANSIPassword(ascPwd);
  client.setDomain(domain);
  client.setOperatingSystem(clientOS);
  if (sess.hasRemoteAddress())   client.setClientAddress(sess.getRemoteAddress().getHostAddress());
  if (user.length() == 0 && domain.length() == 0 && uniPwdLen == 0 && ascPwdLen == 1)   client.setLogonType(ClientInfo.LogonNull);
  int sts=authenticateUser(client,sess,CifsAuthenticator.NTLM1);
  if (sts > 0 && (sts & CifsAuthenticator.AUTH_GUEST) != 0) {
    client.setGuest(true);
    if (logger.isDebugEnabled() && sess.hasDebug(SMBSrvSession.DBG_NEGOTIATE))     logger.debug("String_Node_Str" + user + "String_Node_Str");
  }
 else   if (sts != CifsAuthenticator.AUTH_ALLOW) {
    if (logger.isDebugEnabled() && sess.hasDebug(SMBSrvSession.DBG_NEGOTIATE))     logger.debug("String_Node_Str" + user + "String_Node_Str");
    throw new SMBSrvException(SMBStatus.NTLogonFailure,SMBStatus.DOSAccessDenied,SMBStatus.ErrDos);
  }
 else {
    if (client.isNullSession() == false)     client.setAuthenticationToken(m_authComponent.getCurrentAuthentication());
 else     client.setAuthenticationToken(null);
    if (logger.isDebugEnabled() && sess.hasDebug(SMBSrvSession.DBG_NEGOTIATE))     logger.debug("String_Node_Str" + user + "String_Node_Str"+ (client != null ? "String_Node_Str" + client.getLogonTypeString() + "String_Node_Str" : "String_Node_Str"));
  }
  VirtualCircuit vc=new VirtualCircuit(vcNum,client);
  int uid=sess.addVirtualCircuit(vc);
  if (uid == VirtualCircuit.InvalidUID) {
    if (logger.isDebugEnabled() && sess.hasDebug(SMBSrvSession.DBG_NEGOTIATE))     logger.debug("String_Node_Str" + vc);
    throw new SMBSrvException(SMBStatus.NTLogonFailure,SMBStatus.DOSAccessDenied,SMBStatus.ErrDos);
  }
 else   if (logger.isDebugEnabled() && sess.hasDebug(SMBSrvSession.DBG_NEGOTIATE)) {
    logger.debug("String_Node_Str" + uid + "String_Node_Str"+ vc);
  }
  sess.setLoggedOn(true);
  respPkt.setParameterCount(3);
  respPkt.setParameter(0,0);
  respPkt.setParameter(1,0);
  respPkt.setParameter(2,client.isGuest() ? 1 : 0);
  respPkt.setByteCount(0);
  respPkt.setTreeId(0);
  respPkt.setUserId(uid);
  int flags=respPkt.getFlags();
  flags&=~SMBSrvPacket.FLG_CASELESS;
  respPkt.setFlags(flags);
  int flags2=SMBSrvPacket.FLG2_LONGFILENAMES;
  if (isUni)   flags2+=SMBSrvPacket.FLG2_UNICODE;
  respPkt.setFlags2(flags2);
  int pos=respPkt.getByteOffset();
  buf=respPkt.getBuffer();
  if (isUni)   pos=DataPacker.wordAlign(pos);
  pos=DataPacker.putString("String_Node_Str",buf,pos,true,isUni);
  pos=DataPacker.putString("String_Node_Str" + sess.getServer().isVersion(),buf,pos,true,isUni);
  pos=DataPacker.putString(sess.getServer().getConfiguration().getDomainName(),buf,pos,true,isUni);
  respPkt.setByteCount(pos - respPkt.getByteOffset());
}