Program: 143907
Project: 143907
Buggy source:
/** 
 * Handle telnet protocol negotiation. The buffer will be parsed and necessary actions are taken according to the telnet protocol. See <A HREF="RFC-Telnet-URL">RFC-Telnet</A>
 * @param nbuf the byte buffer put out after negotiation
 * @return number of bytes processed, 0 for none, and -1 for end of buffer.
 */
public int negotiate(byte nbuf[]) throws IOException {
  byte sbbuf[]=new byte[tempbuf.length];
  int count=tempbuf.length;
  byte[] buf=tempbuf;
  byte sendbuf[]=new byte[3];
  byte b, reply;
  int sbcount=0;
  int boffset=0, noffset=0;
  boolean dobreak=false;
  if (count == 0)   return -1;
  while (!dobreak && (boffset < count) && (noffset < nbuf.length)) {
    b=buf[boffset++];
    if (b >= 128)     b=(byte)((int)b - 256);
    if (debug > 2) {
      Byte B=new Byte(b);
      System.err.print("String_Node_Str" + B.intValue() + "String_Node_Str");
    }
switch (neg_state) {
case STATE_DATA:
      if (b == IAC) {
        neg_state=STATE_IAC;
        dobreak=true;
      }
 else       nbuf[noffset++]=b;
    break;
case STATE_IAC:
switch (b) {
case IAC:
    if (debug > 2)     System.err.print("String_Node_Str");
  neg_state=STATE_DATA;
nbuf[noffset++]=IAC;
break;
case WILL:
if (debug > 2) System.err.print("String_Node_Str");
neg_state=STATE_IACWILL;
break;
case WONT:
if (debug > 2) System.err.print("String_Node_Str");
neg_state=STATE_IACWONT;
break;
case DONT:
if (debug > 2) System.err.print("String_Node_Str");
neg_state=STATE_IACDONT;
break;
case DO:
if (debug > 2) System.err.print("String_Node_Str");
neg_state=STATE_IACDO;
break;
case EOR:
if (debug > 1) System.err.print("String_Node_Str");
notifyEndOfRecord();
dobreak=true;
neg_state=STATE_DATA;
break;
case SB:
if (debug > 2) System.err.print("String_Node_Str");
neg_state=STATE_IACSB;
sbcount=0;
break;
default :
if (debug > 2) System.err.print("String_Node_Str" + b + "String_Node_Str");
neg_state=STATE_DATA;
break;
}
break;
case STATE_IACWILL:
switch (b) {
case TELOPT_ECHO:
if (debug > 2) System.err.println("String_Node_Str");
reply=DO;
setLocalEcho(false);
break;
case TELOPT_SGA:
if (debug > 2) System.err.println("String_Node_Str");
reply=DO;
break;
case TELOPT_EOR:
if (debug > 2) System.err.println("String_Node_Str");
reply=DO;
break;
case TELOPT_BINARY:
if (debug > 2) System.err.println("String_Node_Str");
reply=DO;
break;
default :
if (debug > 2) System.err.println("String_Node_Str" + b + "String_Node_Str");
reply=DONT;
break;
}
if (debug > 1) System.err.println("String_Node_Str" + b + "String_Node_Str"+ WILL+ "String_Node_Str");
if (reply != sentDX[b + 128] || WILL != receivedWX[b + 128]) {
sendbuf[0]=IAC;
sendbuf[1]=reply;
sendbuf[2]=b;
write(sendbuf);
sentDX[b + 128]=reply;
receivedWX[b + 128]=WILL;
}
neg_state=STATE_DATA;
break;
case STATE_IACWONT:
switch (b) {
case TELOPT_ECHO:
if (debug > 2) System.err.println("String_Node_Str");
setLocalEcho(true);
reply=DONT;
break;
case TELOPT_SGA:
if (debug > 2) System.err.println("String_Node_Str");
reply=DONT;
break;
case TELOPT_EOR:
if (debug > 2) System.err.println("String_Node_Str");
reply=DONT;
break;
case TELOPT_BINARY:
if (debug > 2) System.err.println("String_Node_Str");
reply=DONT;
break;
default :
if (debug > 2) System.err.println("String_Node_Str" + b + "String_Node_Str");
reply=DONT;
break;
}
if (reply != sentDX[b + 128] || WONT != receivedWX[b + 128]) {
sendbuf[0]=IAC;
sendbuf[1]=reply;
sendbuf[2]=b;
write(sendbuf);
sentDX[b + 128]=reply;
receivedWX[b + 128]=WILL;
}
neg_state=STATE_DATA;
break;
case STATE_IACDO:
switch (b) {
case TELOPT_ECHO:
if (debug > 2) System.err.println("String_Node_Str");
reply=WILL;
setLocalEcho(true);
break;
case TELOPT_SGA:
if (debug > 2) System.err.println("String_Node_Str");
reply=WILL;
break;
case TELOPT_TTYPE:
if (debug > 2) System.err.println("String_Node_Str");
reply=WILL;
break;
case TELOPT_BINARY:
if (debug > 2) System.err.println("String_Node_Str");
reply=WILL;
break;
case TELOPT_NAWS:
if (debug > 2) System.err.println("String_Node_Str");
Dimension size=getWindowSize();
receivedDX[b]=DO;
if (size == null) {
write(IAC);
write(WONT);
write(TELOPT_NAWS);
reply=WONT;
sentWX[b]=WONT;
break;
}
reply=WILL;
sentWX[b]=WILL;
sendbuf[0]=IAC;
sendbuf[1]=WILL;
sendbuf[2]=TELOPT_NAWS;
write(sendbuf);
write(IAC);
write(SB);
write(TELOPT_NAWS);
write((byte)(size.width >> 8));
write((byte)(size.width & 0xff));
write((byte)(size.height >> 8));
write((byte)(size.height & 0xff));
write(IAC);
write(SE);
break;
default :
if (debug > 2) System.err.println("String_Node_Str" + b + "String_Node_Str");
reply=WONT;
break;
}
if (reply != sentWX[128 + b] || DO != receivedDX[128 + b]) {
sendbuf[0]=IAC;
sendbuf[1]=reply;
sendbuf[2]=b;
write(sendbuf);
sentWX[b + 128]=reply;
receivedDX[b + 128]=DO;
}
neg_state=STATE_DATA;
break;
case STATE_IACDONT:
switch (b) {
case TELOPT_ECHO:
if (debug > 2) System.err.println("String_Node_Str");
reply=WONT;
setLocalEcho(false);
break;
case TELOPT_SGA:
if (debug > 2) System.err.println("String_Node_Str");
reply=WONT;
break;
case TELOPT_NAWS:
if (debug > 2) System.err.println("String_Node_Str");
reply=WONT;
break;
case TELOPT_BINARY:
if (debug > 2) System.err.println("String_Node_Str");
reply=WONT;
break;
default :
if (debug > 2) System.err.println("String_Node_Str" + b + "String_Node_Str");
reply=WONT;
break;
}
if (reply != sentWX[b + 128] || DONT != receivedDX[b + 128]) {
write(IAC);
write(reply);
write(b);
sentWX[b + 128]=reply;
receivedDX[b + 128]=DONT;
}
neg_state=STATE_DATA;
break;
case STATE_IACSBIAC:
if (debug > 2) System.err.println("String_Node_Str" + b + "String_Node_Str");
if (b == IAC) {
sbcount=0;
current_sb=b;
neg_state=STATE_IACSBDATA;
}
 else {
System.err.println("String_Node_Str" + b + "String_Node_Str");
neg_state=STATE_DATA;
}
break;
case STATE_IACSB:
if (debug > 2) System.err.println("String_Node_Str" + b + "String_Node_Str");
switch (b) {
case IAC:
neg_state=STATE_IACSBIAC;
break;
default :
current_sb=b;
sbcount=0;
neg_state=STATE_IACSBDATA;
break;
}
break;
case STATE_IACSBDATA:
if (debug > 2) System.err.println("String_Node_Str" + b + "String_Node_Str");
switch (b) {
case IAC:
neg_state=STATE_IACSBDATAIAC;
break;
default :
sbbuf[sbcount++]=b;
break;
}
break;
case STATE_IACSBDATAIAC:
if (debug > 2) System.err.println("String_Node_Str" + b + "String_Node_Str");
switch (b) {
case IAC:
neg_state=STATE_IACSBDATA;
sbbuf[sbcount++]=IAC;
break;
case SE:
handle_sb(current_sb,sbbuf,sbcount);
current_sb=0;
neg_state=STATE_DATA;
break;
case SB:
handle_sb(current_sb,sbbuf,sbcount);
neg_state=STATE_IACSB;
break;
default :
neg_state=STATE_DATA;
break;
}
break;
default :
if (debug > 1) System.err.println("String_Node_Str" + neg_state + "String_Node_Str");
neg_state=STATE_DATA;
break;
}
}
byte[] xb=new byte[count - boffset];
System.arraycopy(tempbuf,boffset,xb,0,count - boffset);
tempbuf=xb;
return noffset;
}

Fixed version (ground truth):
/** 
 * Handle telnet protocol negotiation. The buffer will be parsed and necessary actions are taken according to the telnet protocol. See <A HREF="RFC-Telnet-URL">RFC-Telnet</A>
 * @param nbuf the byte buffer put out after negotiation
 * @return number of bytes processed, 0 for none, and -1 for end of buffer.
 */
public int negotiate(byte nbuf[]) throws IOException {
  int count=tempbuf.length;
  byte[] buf=tempbuf;
  byte sendbuf[]=new byte[3];
  byte b, reply;
  int boffset=0, noffset=0;
  boolean dobreak=false;
  if (count == 0)   return -1;
  while (!dobreak && (boffset < count) && (noffset < nbuf.length)) {
    b=buf[boffset++];
    if (b >= 128)     b=(byte)((int)b - 256);
    if (debug > 2) {
      Byte B=new Byte(b);
      System.err.print("String_Node_Str" + B.intValue() + "String_Node_Str");
    }
switch (neg_state) {
case STATE_DATA:
      if (b == IAC) {
        neg_state=STATE_IAC;
        dobreak=true;
      }
 else       nbuf[noffset++]=b;
    break;
case STATE_IAC:
switch (b) {
case IAC:
    if (debug > 2)     System.err.print("String_Node_Str");
  neg_state=STATE_DATA;
nbuf[noffset++]=IAC;
break;
case WILL:
if (debug > 2) System.err.print("String_Node_Str");
neg_state=STATE_IACWILL;
break;
case WONT:
if (debug > 2) System.err.print("String_Node_Str");
neg_state=STATE_IACWONT;
break;
case DONT:
if (debug > 2) System.err.print("String_Node_Str");
neg_state=STATE_IACDONT;
break;
case DO:
if (debug > 2) System.err.print("String_Node_Str");
neg_state=STATE_IACDO;
break;
case EOR:
if (debug > 1) System.err.print("String_Node_Str");
notifyEndOfRecord();
dobreak=true;
neg_state=STATE_DATA;
break;
case SB:
if (debug > 2) System.err.print("String_Node_Str");
neg_state=STATE_IACSB;
break;
default :
if (debug > 2) System.err.print("String_Node_Str" + b + "String_Node_Str");
neg_state=STATE_DATA;
break;
}
break;
case STATE_IACWILL:
switch (b) {
case TELOPT_ECHO:
if (debug > 2) System.err.println("String_Node_Str");
reply=DO;
setLocalEcho(false);
break;
case TELOPT_SGA:
if (debug > 2) System.err.println("String_Node_Str");
reply=DO;
break;
case TELOPT_EOR:
if (debug > 2) System.err.println("String_Node_Str");
reply=DO;
break;
case TELOPT_BINARY:
if (debug > 2) System.err.println("String_Node_Str");
reply=DO;
break;
default :
if (debug > 2) System.err.println("String_Node_Str" + b + "String_Node_Str");
reply=DONT;
break;
}
if (debug > 1) System.err.println("String_Node_Str" + b + "String_Node_Str"+ WILL+ "String_Node_Str");
if (reply != sentDX[b + 128] || WILL != receivedWX[b + 128]) {
sendbuf[0]=IAC;
sendbuf[1]=reply;
sendbuf[2]=b;
write(sendbuf);
sentDX[b + 128]=reply;
receivedWX[b + 128]=WILL;
}
neg_state=STATE_DATA;
break;
case STATE_IACWONT:
switch (b) {
case TELOPT_ECHO:
if (debug > 2) System.err.println("String_Node_Str");
setLocalEcho(true);
reply=DONT;
break;
case TELOPT_SGA:
if (debug > 2) System.err.println("String_Node_Str");
reply=DONT;
break;
case TELOPT_EOR:
if (debug > 2) System.err.println("String_Node_Str");
reply=DONT;
break;
case TELOPT_BINARY:
if (debug > 2) System.err.println("String_Node_Str");
reply=DONT;
break;
default :
if (debug > 2) System.err.println("String_Node_Str" + b + "String_Node_Str");
reply=DONT;
break;
}
if (reply != sentDX[b + 128] || WONT != receivedWX[b + 128]) {
sendbuf[0]=IAC;
sendbuf[1]=reply;
sendbuf[2]=b;
write(sendbuf);
sentDX[b + 128]=reply;
receivedWX[b + 128]=WILL;
}
neg_state=STATE_DATA;
break;
case STATE_IACDO:
switch (b) {
case TELOPT_ECHO:
if (debug > 2) System.err.println("String_Node_Str");
reply=WILL;
setLocalEcho(true);
break;
case TELOPT_SGA:
if (debug > 2) System.err.println("String_Node_Str");
reply=WILL;
break;
case TELOPT_TTYPE:
if (debug > 2) System.err.println("String_Node_Str");
reply=WILL;
break;
case TELOPT_BINARY:
if (debug > 2) System.err.println("String_Node_Str");
reply=WILL;
break;
case TELOPT_NAWS:
if (debug > 2) System.err.println("String_Node_Str");
Dimension size=getWindowSize();
receivedDX[b]=DO;
if (size == null) {
write(IAC);
write(WONT);
write(TELOPT_NAWS);
reply=WONT;
sentWX[b]=WONT;
break;
}
reply=WILL;
sentWX[b]=WILL;
sendbuf[0]=IAC;
sendbuf[1]=WILL;
sendbuf[2]=TELOPT_NAWS;
write(sendbuf);
write(IAC);
write(SB);
write(TELOPT_NAWS);
write((byte)(size.width >> 8));
write((byte)(size.width & 0xff));
write((byte)(size.height >> 8));
write((byte)(size.height & 0xff));
write(IAC);
write(SE);
break;
default :
if (debug > 2) System.err.println("String_Node_Str" + b + "String_Node_Str");
reply=WONT;
break;
}
if (reply != sentWX[128 + b] || DO != receivedDX[128 + b]) {
sendbuf[0]=IAC;
sendbuf[1]=reply;
sendbuf[2]=b;
write(sendbuf);
sentWX[b + 128]=reply;
receivedDX[b + 128]=DO;
}
neg_state=STATE_DATA;
break;
case STATE_IACDONT:
switch (b) {
case TELOPT_ECHO:
if (debug > 2) System.err.println("String_Node_Str");
reply=WONT;
setLocalEcho(false);
break;
case TELOPT_SGA:
if (debug > 2) System.err.println("String_Node_Str");
reply=WONT;
break;
case TELOPT_NAWS:
if (debug > 2) System.err.println("String_Node_Str");
reply=WONT;
break;
case TELOPT_BINARY:
if (debug > 2) System.err.println("String_Node_Str");
reply=WONT;
break;
default :
if (debug > 2) System.err.println("String_Node_Str" + b + "String_Node_Str");
reply=WONT;
break;
}
if (reply != sentWX[b + 128] || DONT != receivedDX[b + 128]) {
write(IAC);
write(reply);
write(b);
sentWX[b + 128]=reply;
receivedDX[b + 128]=DONT;
}
neg_state=STATE_DATA;
break;
case STATE_IACSBIAC:
if (debug > 2) System.err.println("String_Node_Str" + b + "String_Node_Str");
if (b == IAC) {
sbbuf=new byte[0];
current_sb=b;
neg_state=STATE_IACSBDATA;
}
 else {
System.err.println("String_Node_Str" + b + "String_Node_Str");
neg_state=STATE_DATA;
}
break;
case STATE_IACSB:
if (debug > 2) System.err.println("String_Node_Str" + b + "String_Node_Str");
switch (b) {
case IAC:
neg_state=STATE_IACSBIAC;
break;
default :
current_sb=b;
sbbuf=new byte[0];
neg_state=STATE_IACSBDATA;
break;
}
break;
case STATE_IACSBDATA:
if (debug > 2) System.err.println("String_Node_Str" + b + "String_Node_Str");
switch (b) {
case IAC:
neg_state=STATE_IACSBDATAIAC;
break;
default :
byte[] xsb=new byte[sbbuf.length + 1];
System.arraycopy(sbbuf,0,xsb,0,sbbuf.length);
sbbuf=xsb;
sbbuf[sbbuf.length - 1]=b;
break;
}
break;
case STATE_IACSBDATAIAC:
if (debug > 2) System.err.println("String_Node_Str" + b + "String_Node_Str");
switch (b) {
case IAC:
neg_state=STATE_IACSBDATA;
byte[] xsb=new byte[sbbuf.length + 1];
System.arraycopy(sbbuf,0,xsb,0,sbbuf.length);
sbbuf=xsb;
sbbuf[sbbuf.length - 1]=IAC;
break;
case SE:
handle_sb(current_sb,sbbuf);
current_sb=0;
neg_state=STATE_DATA;
break;
case SB:
handle_sb(current_sb,sbbuf);
neg_state=STATE_IACSB;
break;
default :
neg_state=STATE_DATA;
break;
}
break;
default :
if (debug > 1) System.err.println("String_Node_Str" + neg_state + "String_Node_Str");
neg_state=STATE_DATA;
break;
}
}
byte[] xb=new byte[count - boffset];
System.arraycopy(tempbuf,boffset,xb,0,count - boffset);
tempbuf=xb;
return noffset;
}