Program: 26246
Project: 26246
Buggy source:
private void onTunnelMessage(final ChannelHandlerContext ctx,Object msg) throws Exception {
  Object outboundMsg=msg;
  ensureBuf(ctx);
  if (msg instanceof HttpRequest) {
    boolean authcRequired=false;
    String decodedPath=requestUri.getPath();
    for (    String pattern : stormpathConfig.getAuthenticate()) {
      if (pathMatcher.match(pattern,decodedPath)) {
        authcRequired=true;
        break;
      }
    }
    buf.writeBytes(ascii(request.getMethod()));
    buf.writeByte(SP);
    buf.writeBytes(utf8(request.getUri()));
    buf.writeByte(SP);
    buf.writeBytes(ascii(request.getProtocolVersion()));
    appendCrlf(buf);
    String authzHeaderValue=null;
    boolean xForwardedForSet=false;
    boolean xForwardedHostSet=false;
    writeHeader(buf,HOST.toString(),toHttpHostString(destinationHost));
    HttpHeaders headers=request.headers();
    if (!headers.isEmpty()) {
      for (      Map.Entry<String,String> header : headers) {
        String headerName=header.getKey();
        String headerValue=header.getValue();
        if (headerName.equalsIgnoreCase("String_Node_Str")) {
          xForwardedHostSet=true;
        }
        if (headerName.equalsIgnoreCase("String_Node_Str")) {
          headerValue+="String_Node_Str" + getHost(ctx.channel().remoteAddress()).getName();
          xForwardedForSet=true;
        }
        if (headerName.equalsIgnoreCase(HOST.toString())) {
          continue;
        }
        if (headerName.equalsIgnoreCase(AUTHORIZATION.toString())) {
          authzHeaderValue=headerValue;
          continue;
        }
        writeHeader(buf,headerName,headerValue);
      }
    }
    if (!xForwardedHostSet) {
      String headerValue=toHttpHostString(requestedHost);
      writeHeader(buf,"String_Node_Str",headerValue);
    }
    if (!xForwardedForSet) {
      writeHeader(buf,"String_Node_Str",getHost(ctx.channel().remoteAddress()).getName());
    }
    boolean writeAuthzHeader=authzHeaderValue != null;
    if (authcRequired) {
      if (authzHeaderValue != null && authzHeaderValue.toLowerCase().trim().startsWith("String_Node_Str")) {
        int lastSpaceIndex=authzHeaderValue.lastIndexOf(' ');
        String schemeValue=authzHeaderValue.substring(lastSpaceIndex + 1);
        String decoded=Base64.decodeToString(schemeValue);
        String username;
        String password=null;
        int colonIndex=decoded.lastIndexOf(':');
        if (colonIndex > 0) {
          username=decoded.substring(0,colonIndex);
          if (colonIndex < (decoded.length() - 1)) {
            password=decoded.substring(colonIndex + 1);
          }
        }
 else {
          username=decoded;
        }
        String clientHost=getHost(ctx.channel().remoteAddress()).getName();
        UsernamePasswordRequest request=new UsernamePasswordRequest(username,password,clientHost);
        try {
          AuthenticationResult result=this.application.authenticateAccount(request);
          writeHeader(buf,"String_Node_Str",result.getAccount().getHref());
          writeAuthzHeader=false;
        }
 catch (        ResourceException e) {
          sendBasicAuthcChallenge(ctx);
          return;
        }
      }
 else {
        sendBasicAuthcChallenge(ctx);
        return;
      }
    }
    if (writeAuthzHeader) {
      writeHeader(buf,AUTHORIZATION,authzHeaderValue);
    }
    appendCrlf(buf);
    outboundMsg=buf;
    RequestEvent event=new RequestEvent(-1,buf.readableBytes());
    this.eventBus.post(event);
  }
  if (msg instanceof HttpContent) {
    HttpContent content=(HttpContent)msg;
    outboundMsg=content.content();
  }
  if (outboundChannel.isActive()) {
    outboundChannel.writeAndFlush(outboundMsg).addListener(new ChannelFutureListener(){
      @Override public void operationComplete(      ChannelFuture future) throws Exception {
        if (future.isSuccess()) {
          ctx.channel().read();
        }
 else {
          future.channel().close();
        }
      }
    }
);
  }
}

Fixed version (ground truth):
private void onTunnelMessage(final ChannelHandlerContext ctx,Object msg) throws Exception {
  Object outboundMsg=msg;
  ensureBuf(ctx);
  if (msg instanceof HttpRequest) {
    request=(HttpRequest)msg;
    boolean authcRequired=false;
    String decodedPath=requestUri.getPath();
    for (    String pattern : stormpathConfig.getAuthenticate()) {
      if (pathMatcher.match(pattern,decodedPath)) {
        authcRequired=true;
        break;
      }
    }
    buf.writeBytes(ascii(request.getMethod()));
    buf.writeByte(SP);
    buf.writeBytes(utf8(request.getUri()));
    buf.writeByte(SP);
    buf.writeBytes(ascii(request.getProtocolVersion()));
    appendCrlf(buf);
    String authzHeaderValue=null;
    boolean xForwardedForSet=false;
    boolean xForwardedHostSet=false;
    writeHeader(buf,HOST.toString(),toHttpHostString(destinationHost));
    HttpHeaders headers=request.headers();
    if (!headers.isEmpty()) {
      for (      Map.Entry<String,String> header : headers) {
        String headerName=header.getKey();
        String headerValue=header.getValue();
        if (headerName.equalsIgnoreCase("String_Node_Str")) {
          xForwardedHostSet=true;
        }
        if (headerName.equalsIgnoreCase("String_Node_Str")) {
          headerValue+="String_Node_Str" + getHost(ctx.channel().remoteAddress()).getName();
          xForwardedForSet=true;
        }
        if (headerName.equalsIgnoreCase(HOST.toString())) {
          continue;
        }
        if (headerName.equalsIgnoreCase(AUTHORIZATION.toString())) {
          authzHeaderValue=headerValue;
          continue;
        }
        writeHeader(buf,headerName,headerValue);
      }
    }
    if (!xForwardedHostSet) {
      String headerValue=toHttpHostString(requestedHost);
      writeHeader(buf,"String_Node_Str",headerValue);
    }
    if (!xForwardedForSet) {
      writeHeader(buf,"String_Node_Str",getHost(ctx.channel().remoteAddress()).getName());
    }
    boolean writeAuthzHeader=authzHeaderValue != null;
    if (authcRequired) {
      if (authzHeaderValue != null && authzHeaderValue.toLowerCase().trim().startsWith("String_Node_Str")) {
        int lastSpaceIndex=authzHeaderValue.lastIndexOf(' ');
        String schemeValue=authzHeaderValue.substring(lastSpaceIndex + 1);
        String decoded=Base64.decodeToString(schemeValue);
        String username;
        String password=null;
        int colonIndex=decoded.lastIndexOf(':');
        if (colonIndex > 0) {
          username=decoded.substring(0,colonIndex);
          if (colonIndex < (decoded.length() - 1)) {
            password=decoded.substring(colonIndex + 1);
          }
        }
 else {
          username=decoded;
        }
        String clientHost=getHost(ctx.channel().remoteAddress()).getName();
        UsernamePasswordRequest request=new UsernamePasswordRequest(username,password,clientHost);
        try {
          AuthenticationResult result=this.application.authenticateAccount(request);
          writeHeader(buf,"String_Node_Str",result.getAccount().getHref());
          writeAuthzHeader=false;
        }
 catch (        ResourceException e) {
          sendBasicAuthcChallenge(ctx);
          return;
        }
      }
 else {
        sendBasicAuthcChallenge(ctx);
        return;
      }
    }
    if (writeAuthzHeader) {
      writeHeader(buf,AUTHORIZATION,authzHeaderValue);
    }
    appendCrlf(buf);
    outboundMsg=buf;
    RequestEvent event=new RequestEvent(-1,buf.readableBytes());
    this.eventBus.post(event);
  }
  if (msg instanceof HttpContent) {
    HttpContent content=(HttpContent)msg;
    outboundMsg=content.content();
  }
  if (outboundChannel.isActive()) {
    outboundChannel.writeAndFlush(outboundMsg).addListener(new ChannelFutureListener(){
      @Override public void operationComplete(      ChannelFuture future) throws Exception {
        if (future.isSuccess()) {
          ctx.channel().read();
        }
 else {
          future.channel().close();
        }
      }
    }
);
  }
}