Program: 142422
Project: 142422
Buggy source:
/** 
 * Try to initiate a Pace Bypass <p>
 */
private void processInitPaceBypass(ProcessingData processingData){
  TlvDataObjectContainer commandData=processingData.getCommandApdu().getCommandDataObjectContainer();
  PasswordAuthObject passwordObject;
  TlvDataObject tlvObject=commandData.getTlvDataObject(TAG_83);
  CardObject pwdCandidate=cardState.getObject(new AuthObjectIdentifier(tlvObject.getValueField()),Scope.FROM_MF);
  if (pwdCandidate instanceof PasswordAuthObject) {
    passwordObject=(PasswordAuthObject)pwdCandidate;
    log(this,"String_Node_Str" + AbstractPaceProtocol.getPasswordName(passwordObject.getPasswordIdentifier()),DEBUG);
  }
 else {
    ResponseApdu resp=new ResponseApdu(Iso7816.SW_6A88_REFERENCE_DATA_NOT_FOUND);
    processingData.updateResponseAPDU(this,"String_Node_Str",resp);
    return;
  }
  tlvObject=commandData.getTlvDataObject(TAG_92);
  if (tlvObject == null) {
    ResponseApdu resp=new ResponseApdu(Iso7816.SW_6A80_WRONG_DATA);
    processingData.updateResponseAPDU(this,"String_Node_Str",resp);
    return;
  }
  byte[] providedPassword=tlvObject.getValueField();
  CertificateHolderAuthorizationTemplate usedChat=null;
  TrustPointCardObject trustPoint=null;
  tlvObject=commandData.getTlvDataObject(TAG_7F4C);
  if (tlvObject != null) {
    ConstructedTlvDataObject chatData=(ConstructedTlvDataObject)tlvObject;
    TlvDataObject oidData=chatData.getTlvDataObject(TAG_06);
    byte[] roleData=chatData.getTlvDataObject(TAG_53).getValueField();
    TaOid chatOid=new TaOid(oidData.getValueField());
    RelativeAuthorization authorization=new RelativeAuthorization(CertificateRole.getFromMostSignificantBits(roleData[0]),BitField.buildFromBigEndian((roleData.length * 8) - 2,roleData));
    usedChat=new CertificateHolderAuthorizationTemplate(chatOid,authorization);
    TerminalType terminalType=usedChat.getTerminalType();
    trustPoint=(TrustPointCardObject)cardState.getObject(new TrustPointIdentifier(terminalType),Scope.FROM_MF);
    if (!AbstractPaceProtocol.checkPasswordAndAccessRights(usedChat,passwordObject)) {
      ResponseApdu resp=new ResponseApdu(Iso7816.SW_6A80_WRONG_DATA);
      processingData.updateResponseAPDU(this,"String_Node_Str",resp);
      return;
    }
  }
  boolean paceSuccessful;
  short sw;
  String note;
  if (Arrays.equals(providedPassword,passwordObject.getPassword())) {
    log(this,"String_Node_Str",DEBUG);
    if (passwordObject instanceof PasswordAuthObjectWithRetryCounter) {
      ResponseData pinResponse=AbstractPaceProtocol.getMutualAuthenticatePinManagementResponsePaceSuccessful(passwordObject,cardState);
      sw=pinResponse.getStatusWord();
      note=pinResponse.getResponse();
      paceSuccessful=!Iso7816Lib.isReportingError(sw);
    }
 else {
      sw=Iso7816.SW_9000_NO_ERROR;
      note="String_Node_Str";
      paceSuccessful=true;
    }
  }
 else {
    log(this,"String_Node_Str",DEBUG);
    paceSuccessful=false;
    if (passwordObject.getPasswordIdentifier() == Pace.PWD_PIN) {
      ResponseData pinResponse=AbstractPaceProtocol.getMutualAuthenticatePinManagementResponsePaceFailed((PasswordAuthObjectWithRetryCounter)passwordObject);
      sw=pinResponse.getStatusWord();
      note=pinResponse.getResponse();
    }
 else {
      sw=Iso7816.SW_6A80_WRONG_DATA;
      note="String_Node_Str";
    }
  }
  ResponseApdu responseApdu;
  if (paceSuccessful) {
    TlvDataObjectContainer responseObjects=new TlvDataObjectContainer();
    byte[] compEphermeralPublicKey=HexString.toByteArray("String_Node_Str");
    TlvDataObject primitive86=new PrimitiveTlvDataObject(TAG_86,compEphermeralPublicKey);
    responseObjects.addTlvDataObject(primitive86);
    if (trustPoint != null) {
      if (trustPoint.getCurrentCertificate() != null && trustPoint.getCurrentCertificate().getCertificateHolderReference() instanceof PublicKeyReference) {
        responseObjects.addTlvDataObject(new PrimitiveTlvDataObject(TAG_87,trustPoint.getCurrentCertificate().getCertificateHolderReference().getBytes()));
        if (trustPoint.getPreviousCertificate() != null && trustPoint.getPreviousCertificate().getCertificateHolderReference() instanceof PublicKeyReference) {
          responseObjects.addTlvDataObject(new PrimitiveTlvDataObject(TAG_88,trustPoint.getPreviousCertificate().getCertificateHolderReference().getBytes()));
        }
      }
    }
    TlvValue responseData=new TlvDataObjectContainer(responseObjects);
    PaceMechanism paceMechanism=new PaceMechanism(passwordObject,compEphermeralPublicKey,usedChat);
    processingData.addUpdatePropagation(this,"String_Node_Str",new SecStatusMechanismUpdatePropagation(SecContext.APPLICATION,paceMechanism));
    responseApdu=new ResponseApdu(responseData,sw);
    processingData.updateResponseAPDU(this,"String_Node_Str",responseApdu);
  }
 else {
    responseApdu=new ResponseApdu(sw);
  }
  processingData.updateResponseAPDU(this,note,responseApdu);
}

Fixed version (ground truth):
/** 
 * Try to initiate a Pace Bypass <p>
 */
private void processInitPaceBypass(ProcessingData processingData){
  TlvDataObjectContainer commandData=processingData.getCommandApdu().getCommandDataObjectContainer();
  PasswordAuthObject passwordObject;
  TlvDataObject tlvObject=commandData.getTlvDataObject(TAG_83);
  CardObject pwdCandidate=cardState.getObject(new AuthObjectIdentifier(tlvObject.getValueField()),Scope.FROM_MF);
  if (pwdCandidate instanceof PasswordAuthObject) {
    passwordObject=(PasswordAuthObject)pwdCandidate;
    log(this,"String_Node_Str" + AbstractPaceProtocol.getPasswordName(passwordObject.getPasswordIdentifier()),DEBUG);
  }
 else {
    ResponseApdu resp=new ResponseApdu(Iso7816.SW_6A88_REFERENCE_DATA_NOT_FOUND);
    processingData.updateResponseAPDU(this,"String_Node_Str",resp);
    return;
  }
  tlvObject=commandData.getTlvDataObject(TAG_92);
  if (tlvObject == null) {
    ResponseApdu resp=new ResponseApdu(Iso7816.SW_6A80_WRONG_DATA);
    processingData.updateResponseAPDU(this,"String_Node_Str",resp);
    return;
  }
  byte[] providedPassword=tlvObject.getValueField();
  CertificateHolderAuthorizationTemplate usedChat=null;
  TrustPointCardObject trustPoint=null;
  tlvObject=commandData.getTlvDataObject(TAG_7F4C);
  if (tlvObject != null) {
    ConstructedTlvDataObject chatData=(ConstructedTlvDataObject)tlvObject;
    TlvDataObject oidData=chatData.getTlvDataObject(TAG_06);
    byte[] roleData=chatData.getTlvDataObject(TAG_53).getValueField();
    TaOid chatOid=new TaOid(oidData.getValueField());
    RelativeAuthorization authorization=new RelativeAuthorization(CertificateRole.getFromMostSignificantBits(roleData[0]),BitField.buildFromBigEndian((roleData.length * 8) - 2,roleData));
    usedChat=new CertificateHolderAuthorizationTemplate(chatOid,authorization);
    TerminalType terminalType=usedChat.getTerminalType();
    trustPoint=(TrustPointCardObject)cardState.getObject(new TrustPointIdentifier(terminalType),Scope.FROM_MF);
    if (!AbstractPaceProtocol.checkPasswordAndAccessRights(usedChat,passwordObject)) {
      ResponseApdu resp=new ResponseApdu(Iso7816.SW_6A80_WRONG_DATA);
      processingData.updateResponseAPDU(this,"String_Node_Str",resp);
      return;
    }
  }
  boolean paceSuccessful;
  short sw;
  String note;
  if (Arrays.equals(providedPassword,passwordObject.getPassword())) {
    log(this,"String_Node_Str",DEBUG);
    if (passwordObject instanceof PasswordAuthObjectWithRetryCounter) {
      ResponseData pinResponse=AbstractPaceProtocol.getMutualAuthenticatePinManagementResponsePaceSuccessful(passwordObject,cardState);
      sw=pinResponse.getStatusWord();
      note=pinResponse.getResponse();
      paceSuccessful=!Iso7816Lib.isReportingError(sw);
    }
 else {
      sw=Iso7816.SW_9000_NO_ERROR;
      note="String_Node_Str";
      paceSuccessful=true;
    }
  }
 else {
    log(this,"String_Node_Str",DEBUG);
    paceSuccessful=false;
    if (passwordObject.getPasswordIdentifier() == Pace.PWD_PIN) {
      ResponseData pinResponse=AbstractPaceProtocol.getMutualAuthenticatePinManagementResponsePaceFailed((PasswordAuthObjectWithRetryCounter)passwordObject);
      sw=pinResponse.getStatusWord();
      note=pinResponse.getResponse();
    }
 else {
      sw=Iso7816.SW_6A80_WRONG_DATA;
      note="String_Node_Str";
    }
  }
  ResponseApdu responseApdu;
  if (paceSuccessful) {
    TlvDataObjectContainer responseObjects=new TlvDataObjectContainer();
    byte[] compEphermeralPublicKey=HexString.toByteArray("String_Node_Str");
    TlvDataObject primitive86=new PrimitiveTlvDataObject(TAG_86,compEphermeralPublicKey);
    responseObjects.addTlvDataObject(primitive86);
    if (trustPoint != null) {
      if (trustPoint.getCurrentCertificate() != null && trustPoint.getCurrentCertificate().getCertificateHolderReference() instanceof PublicKeyReference) {
        responseObjects.addTlvDataObject(new PrimitiveTlvDataObject(TAG_87,trustPoint.getCurrentCertificate().getCertificateHolderReference().getBytes()));
        if (trustPoint.getPreviousCertificate() != null && trustPoint.getPreviousCertificate().getCertificateHolderReference() instanceof PublicKeyReference) {
          responseObjects.addTlvDataObject(new PrimitiveTlvDataObject(TAG_88,trustPoint.getPreviousCertificate().getCertificateHolderReference().getBytes()));
        }
      }
    }
    TlvValue responseData=new TlvDataObjectContainer(responseObjects);
    pseudoSmIsActive=true;
    PaceMechanism paceMechanism=new PaceMechanism(passwordObject,compEphermeralPublicKey,usedChat);
    processingData.addUpdatePropagation(this,"String_Node_Str",new SecStatusMechanismUpdatePropagation(SecContext.APPLICATION,paceMechanism));
    responseApdu=new ResponseApdu(responseData,sw);
    processingData.updateResponseAPDU(this,"String_Node_Str",responseApdu);
  }
 else {
    responseApdu=new ResponseApdu(sw);
  }
  processingData.updateResponseAPDU(this,note,responseApdu);
}