Program: 4649
Project: 4649
Buggy source:
/** 
 * Internal constructor.  Only creates QHD if includeQHD==true.  
 */
private QueryReply(byte[] guid,byte ttl,int port,byte[] ip,long speed,Response[] responses,byte[] clientGUID,byte[] xmlBytes,boolean includeQHD,boolean needsPush,boolean isBusy,boolean finishedUpload,boolean measuredSpeed,boolean supportsChat,boolean supportsBH,boolean isMulticastReply){
  super(guid,Message.F_QUERY_REPLY,ttl,(byte)0,11 + rLength(responses) + qhdLength(includeQHD,xmlBytes,supportsBH,isMulticastReply)+ 16);
  if (xmlBytes.length > XML_MAX_SIZE)   return;
  final int n=responses.length;
  if ((port & 0xFFFF0000) != 0) {
    throw new IllegalArgumentException("String_Node_Str" + port);
  }
 else   if (ip.length != 4) {
    throw new IllegalArgumentException("String_Node_Str" + ip.length);
  }
 else   if ((speed & 0xFFFFFFFF00000000l) != 0) {
    throw new IllegalArgumentException("String_Node_Str" + speed);
  }
 else   if (n >= 256) {
    throw new IllegalArgumentException("String_Node_Str" + n);
  }
  payload=new byte[getLength()];
  payload[0]=(byte)n;
  ByteOrder.short2leb((short)port,payload,1);
  payload[3]=ip[0];
  payload[4]=ip[1];
  payload[5]=ip[2];
  payload[6]=ip[3];
  ByteOrder.int2leb((int)speed,payload,7);
  int i=11;
  for (int left=n; left > 0; left--) {
    Response r=responses[n - left];
    i=r.writeToArray(payload,i);
  }
  if (includeQHD) {
    payload[i++]=(byte)76;
    payload[i++]=(byte)73;
    payload[i++]=(byte)77;
    payload[i++]=(byte)69;
    payload[i++]=(byte)COMMON_PAYLOAD_LEN;
    int ggepLen=_ggepUtil.getQRGGEP(false,false).length;
    payload[i++]=(byte)((needsPush ? PUSH_MASK : 0) | BUSY_MASK | UPLOADED_MASK| SPEED_MASK| GGEP_MASK);
    payload[i++]=(byte)(PUSH_MASK | (isBusy ? BUSY_MASK : 0) | (finishedUpload ? UPLOADED_MASK : 0)| (measuredSpeed ? SPEED_MASK : 0)| (supportsBH || isMulticastReply ? GGEP_MASK : (ggepLen > 0 ? GGEP_MASK : 0)));
    int xmlSize=xmlBytes.length + 1;
    if (xmlSize > XML_MAX_SIZE)     xmlSize=XML_MAX_SIZE;
    ByteOrder.short2leb(((short)xmlSize),payload,i);
    i+=2;
    payload[i++]=(byte)(supportsChat ? CHAT_MASK : 0);
    byte[] ggepBytes=_ggepUtil.getQRGGEP(supportsBH,isMulticastReply);
    System.arraycopy(ggepBytes,0,payload,i,ggepBytes.length);
    i+=ggepBytes.length;
    System.arraycopy(xmlBytes,0,payload,i,xmlSize - 1);
    i+=xmlSize - 1;
    payload[i++]=(byte)0;
  }
  for (int j=0; j < 16; j++) {
    payload[i + j]=clientGUID[j];
  }
  setAddress();
}

Fixed version (ground truth):
/** 
 * Internal constructor.  Only creates QHD if includeQHD==true.  
 */
private QueryReply(byte[] guid,byte ttl,int port,byte[] ip,long speed,Response[] responses,byte[] clientGUID,byte[] xmlBytes,boolean includeQHD,boolean needsPush,boolean isBusy,boolean finishedUpload,boolean measuredSpeed,boolean supportsChat,boolean supportsBH,boolean isMulticastReply){
  super(guid,Message.F_QUERY_REPLY,ttl,(byte)0,11 + rLength(responses) + qhdLength(includeQHD,xmlBytes,supportsBH,isMulticastReply)+ 16);
  if (xmlBytes.length > XML_MAX_SIZE)   return;
  final int n=responses.length;
  if ((port & 0xFFFF0000) != 0) {
    throw new IllegalArgumentException("String_Node_Str" + port);
  }
 else   if (ip.length != 4) {
    throw new IllegalArgumentException("String_Node_Str" + ip.length);
  }
 else   if ((speed & 0xFFFFFFFF00000000l) != 0) {
    throw new IllegalArgumentException("String_Node_Str" + speed);
  }
 else   if (n >= 256) {
    throw new IllegalArgumentException("String_Node_Str" + n);
  }
  payload=new byte[getLength()];
  payload[0]=(byte)n;
  ByteOrder.short2leb((short)port,payload,1);
  payload[3]=ip[0];
  payload[4]=ip[1];
  payload[5]=ip[2];
  payload[6]=ip[3];
  ByteOrder.int2leb((int)speed,payload,7);
  int i=11;
  for (int left=n; left > 0; left--) {
    Response r=responses[n - left];
    i=r.writeToArray(payload,i);
  }
  if (includeQHD) {
    payload[i++]=(byte)76;
    payload[i++]=(byte)73;
    payload[i++]=(byte)77;
    payload[i++]=(byte)69;
    payload[i++]=(byte)COMMON_PAYLOAD_LEN;
    int ggepLen=_ggepUtil.getQRGGEP(false,false).length;
    payload[i++]=(byte)((needsPush && !isMulticastReply ? PUSH_MASK : 0) | BUSY_MASK | UPLOADED_MASK| SPEED_MASK| GGEP_MASK);
    payload[i++]=(byte)(PUSH_MASK | (isBusy && !isMulticastReply ? BUSY_MASK : 0) | (finishedUpload ? UPLOADED_MASK : 0)| (measuredSpeed || isMulticastReply ? SPEED_MASK : 0)| (supportsBH || isMulticastReply ? GGEP_MASK : (ggepLen > 0 ? GGEP_MASK : 0)));
    int xmlSize=xmlBytes.length + 1;
    if (xmlSize > XML_MAX_SIZE)     xmlSize=XML_MAX_SIZE;
    ByteOrder.short2leb(((short)xmlSize),payload,i);
    i+=2;
    payload[i++]=(byte)(supportsChat ? CHAT_MASK : 0);
    byte[] ggepBytes=_ggepUtil.getQRGGEP(supportsBH,isMulticastReply);
    System.arraycopy(ggepBytes,0,payload,i,ggepBytes.length);
    i+=ggepBytes.length;
    System.arraycopy(xmlBytes,0,payload,i,xmlSize - 1);
    i+=xmlSize - 1;
    payload[i++]=(byte)0;
  }
  for (int j=0; j < 16; j++) {
    payload[i + j]=clientGUID[j];
  }
  setAddress();
}