Program: 4582
Project: 4582
Buggy source:
/** 
 * @param network the network this was received from.
 * @requires buf.length==23
 * @effects exactly like Message.read(in), but buf is used as scratch forreading the header.  This is an optimization that lets you avoid repeatedly allocating 23-byte arrays.  buf may be used when this returns, but the contents are not guaranteed to contain any useful data.  
 */
public static Message read(InputStream in,byte[] buf,int network,byte softMax) throws BadPacketException, IOException {
  for (int i=0; i < 23; ) {
    int got;
    try {
      got=in.read(buf,i,23 - i);
    }
 catch (    InterruptedIOException e) {
      if (i == 0)       return null;
 else       throw e;
    }
    if (got == -1) {
      if (RECORD_STATS)       ReceivedErrorStat.CONNECTION_CLOSED.incrementStat();
      throw new IOException("String_Node_Str");
    }
    i+=got;
  }
  byte func=buf[16];
  byte ttl=buf[17];
  byte hops=buf[18];
  int length=ByteOrder.leb2int(buf,19);
  if (length < 0 || length > MessageSettings.MAX_LENGTH.getValue()) {
    if (RECORD_STATS)     ReceivedErrorStat.INVALID_LENGTH.incrementStat();
    throw new IOException("String_Node_Str" + length);
  }
  byte[] payload=null;
  if (length != 0) {
    payload=new byte[length];
    for (int i=0; i < length; ) {
      int got=in.read(payload,i,length - i);
      if (got == -1) {
        if (RECORD_STATS)         ReceivedErrorStat.CONNECTION_CLOSED.incrementStat();
        throw new IOException("String_Node_Str");
      }
      i+=got;
    }
  }
 else   payload=new byte[0];
  byte hardMax=(byte)14;
  if (hops < 0) {
    if (RECORD_STATS)     ReceivedErrorStat.INVALID_HOPS.incrementStat();
    throw new BadPacketException("String_Node_Str");
  }
 else   if (ttl < 0) {
    if (RECORD_STATS)     ReceivedErrorStat.INVALID_TTL.incrementStat();
    throw new BadPacketException("String_Node_Str");
  }
 else   if ((hops >= softMax) && (func != F_QUERY_REPLY) && (func != F_PING_REPLY)) {
    if (RECORD_STATS)     ReceivedErrorStat.HOPS_EXCEED_SOFT_MAX.incrementStat();
    throw BadPacketException.HOPS_EXCEED_SOFT_MAX;
  }
 else   if (ttl + hops > hardMax) {
    if (RECORD_STATS)     ReceivedErrorStat.HOPS_AND_TTL_OVER_HARD_MAX.incrementStat();
    throw new BadPacketException("String_Node_Str");
  }
 else   if ((ttl + hops > softMax) && (func != F_QUERY_REPLY) && (func != F_PING_REPLY)) {
    ttl=(byte)(softMax - hops);
    Assert.that(ttl >= 0);
  }
  byte[] guid=new byte[16];
  for (int i=0; i < 16; i++)   guid[i]=buf[i];
switch (func) {
case F_PING:
    if (length > 0)     return new PingRequest(guid,ttl,hops,payload);
  return new PingRequest(guid,ttl,hops);
case F_PING_REPLY:
return PingReply.createFromNetwork(guid,ttl,hops,payload);
case F_QUERY:
if (length < 3) break;
return QueryRequest.createNetworkQuery(guid,ttl,hops,payload,network);
case F_QUERY_REPLY:
if (length < 26) break;
return new QueryReply(guid,ttl,hops,payload);
case F_PUSH:
return new PushRequest(guid,ttl,hops,payload,network);
case F_ROUTE_TABLE_UPDATE:
return RouteTableMessage.read(guid,ttl,hops,payload);
case F_VENDOR_MESSAGE:
if ((ttl != 1) || (hops != 0)) throw new BadPacketException("String_Node_Str" + ttl + "String_Node_Str"+ hops);
return VendorMessage.deriveVendorMessage(guid,ttl,hops,payload);
case F_VENDOR_MESSAGE_STABLE:
if ((ttl != 1) || (hops != 0)) throw new BadPacketException("String_Node_Str" + ttl + "String_Node_Str"+ hops);
return VendorMessage.deriveVendorMessage(guid,ttl,hops,payload);
}
if (RECORD_STATS) ReceivedErrorStat.INVALID_CODE.incrementStat();
throw new BadPacketException("String_Node_Str" + func);
}

Fixed version (ground truth):
/** 
 * @param network the network this was received from.
 * @requires buf.length==23
 * @effects exactly like Message.read(in), but buf is used as scratch forreading the header.  This is an optimization that lets you avoid repeatedly allocating 23-byte arrays.  buf may be used when this returns, but the contents are not guaranteed to contain any useful data.  
 */
public static Message read(InputStream in,byte[] buf,int network,byte softMax) throws BadPacketException, IOException {
  for (int i=0; i < 23; ) {
    int got;
    try {
      got=in.read(buf,i,23 - i);
    }
 catch (    InterruptedIOException e) {
      if (i == 0)       return null;
 else       throw e;
    }
    if (got == -1) {
      if (RECORD_STATS)       ReceivedErrorStat.CONNECTION_CLOSED.incrementStat();
      throw new IOException("String_Node_Str");
    }
    i+=got;
  }
  byte func=buf[16];
  byte ttl=buf[17];
  byte hops=buf[18];
  int length=ByteOrder.leb2int(buf,19);
  if (length < 0 || length > MessageSettings.MAX_LENGTH.getValue()) {
    if (RECORD_STATS)     ReceivedErrorStat.INVALID_LENGTH.incrementStat();
    throw new IOException("String_Node_Str" + length);
  }
  byte[] payload=null;
  if (length != 0) {
    payload=new byte[length];
    for (int i=0; i < length; ) {
      int got=in.read(payload,i,length - i);
      if (got == -1) {
        if (RECORD_STATS)         ReceivedErrorStat.CONNECTION_CLOSED.incrementStat();
        throw new IOException("String_Node_Str");
      }
      i+=got;
    }
  }
 else   payload=new byte[0];
  byte hardMax=(byte)14;
  if (hops < 0) {
    if (RECORD_STATS)     ReceivedErrorStat.INVALID_HOPS.incrementStat();
    throw new BadPacketException("String_Node_Str");
  }
 else   if (ttl < 0) {
    if (RECORD_STATS)     ReceivedErrorStat.INVALID_TTL.incrementStat();
    throw new BadPacketException("String_Node_Str");
  }
 else   if ((hops > softMax) && (func != F_QUERY_REPLY) && (func != F_PING_REPLY)) {
    if (RECORD_STATS)     ReceivedErrorStat.HOPS_EXCEED_SOFT_MAX.incrementStat();
    throw BadPacketException.HOPS_EXCEED_SOFT_MAX;
  }
 else   if (ttl + hops > hardMax) {
    if (RECORD_STATS)     ReceivedErrorStat.HOPS_AND_TTL_OVER_HARD_MAX.incrementStat();
    throw new BadPacketException("String_Node_Str");
  }
 else   if ((ttl + hops > softMax) && (func != F_QUERY_REPLY) && (func != F_PING_REPLY)) {
    ttl=(byte)(softMax - hops);
    Assert.that(ttl >= 0);
  }
  byte[] guid=new byte[16];
  for (int i=0; i < 16; i++)   guid[i]=buf[i];
switch (func) {
case F_PING:
    if (length > 0)     return new PingRequest(guid,ttl,hops,payload);
  return new PingRequest(guid,ttl,hops);
case F_PING_REPLY:
return PingReply.createFromNetwork(guid,ttl,hops,payload);
case F_QUERY:
if (length < 3) break;
return QueryRequest.createNetworkQuery(guid,ttl,hops,payload,network);
case F_QUERY_REPLY:
if (length < 26) break;
return new QueryReply(guid,ttl,hops,payload);
case F_PUSH:
return new PushRequest(guid,ttl,hops,payload,network);
case F_ROUTE_TABLE_UPDATE:
return RouteTableMessage.read(guid,ttl,hops,payload);
case F_VENDOR_MESSAGE:
if ((ttl != 1) || (hops != 0)) throw new BadPacketException("String_Node_Str" + ttl + "String_Node_Str"+ hops);
return VendorMessage.deriveVendorMessage(guid,ttl,hops,payload);
case F_VENDOR_MESSAGE_STABLE:
if ((ttl != 1) || (hops != 0)) throw new BadPacketException("String_Node_Str" + ttl + "String_Node_Str"+ hops);
return VendorMessage.deriveVendorMessage(guid,ttl,hops,payload);
}
if (RECORD_STATS) ReceivedErrorStat.INVALID_CODE.incrementStat();
throw new BadPacketException("String_Node_Str" + func);
}