Program: 142435
Project: 142435
Buggy source:
@Override public Collection<TlvDataObject> getSecInfos(SecInfoPublicity publicity,MasterFile mf){
  OidIdentifier caOidIdentifier=new OidIdentifier(OID_id_CA);
  Collection<CardObject> caKeyCardObjects=mf.findChildren(new KeyIdentifier(),caOidIdentifier);
  ArrayList<TlvDataObject> secInfos=new ArrayList<>();
  ArrayList<TlvDataObject> privKeysPublicKeyInfos=new ArrayList<>();
  ArrayList<TlvDataObject> unprivKeysPublicKeyInfos=new ArrayList<>();
  for (  CardObject curKey : caKeyCardObjects) {
    if (!(curKey instanceof KeyObject)) {
      continue;
    }
    Collection<CardObjectIdentifier> identifiers=curKey.getAllIdentifiers();
    int keyId=-1;
    for (    CardObjectIdentifier curIdentifier : identifiers) {
      if (curIdentifier instanceof KeyIdentifier) {
        keyId=((KeyIdentifier)curIdentifier).getKeyReference();
        break;
      }
    }
    if (keyId == -1)     continue;
    byte[] genericCaOidBytes=null;
    for (    CardObjectIdentifier curIdentifier : identifiers) {
      if (caOidIdentifier.matches(curIdentifier)) {
        byte[] oidBytes=((OidIdentifier)curIdentifier).getOid().toByteArray();
        genericCaOidBytes=Arrays.copyOfRange(oidBytes,0,9);
        ConstructedTlvDataObject caInfo=new ConstructedTlvDataObject(TAG_SEQUENCE);
        caInfo.addTlvDataObject(new PrimitiveTlvDataObject(TAG_OID,oidBytes));
        caInfo.addTlvDataObject(new PrimitiveTlvDataObject(TAG_INTEGER,new byte[]{2}));
        caInfo.addTlvDataObject(new PrimitiveTlvDataObject(TAG_INTEGER,new byte[]{(byte)keyId}));
        secInfos.add(caInfo);
      }
    }
    ConstructedTlvDataObject encKey=new ConstructedTlvDataObject(((KeyObject)curKey).getKeyPair().getPublic().getEncoded());
    ConstructedTlvDataObject algIdentifier=(ConstructedTlvDataObject)encKey.getTlvDataObject(TAG_SEQUENCE);
    TlvDataObject subjPubKey=encKey.getTlvDataObject(TAG_BIT_STRING);
    algIdentifier=StandardizedDomainParameters.simplifyAlgorithmIdentifier(algIdentifier);
    ConstructedTlvDataObject caDomainInfo=new ConstructedTlvDataObject(TAG_SEQUENCE);
    caDomainInfo.addTlvDataObject(new PrimitiveTlvDataObject(TAG_OID,genericCaOidBytes));
    caDomainInfo.addTlvDataObject(algIdentifier);
    caDomainInfo.addTlvDataObject(new PrimitiveTlvDataObject(TAG_INTEGER,new byte[]{(byte)keyId}));
    secInfos.add(caDomainInfo);
    ConstructedTlvDataObject subjPubKeyInfo=new ConstructedTlvDataObject(TAG_SEQUENCE);
    subjPubKeyInfo.addTlvDataObject(algIdentifier);
    subjPubKeyInfo.addTlvDataObject(subjPubKey);
    if ((publicity == SecInfoPublicity.AUTHENTICATED) || (publicity == SecInfoPublicity.PRIVILEGED)) {
      ConstructedTlvDataObject caPublicKeyInfo=new ConstructedTlvDataObject(TAG_SEQUENCE);
      caPublicKeyInfo.addTlvDataObject(new PrimitiveTlvDataObject(TAG_OID,Utils.concatByteArrays(Tr03110.id_PK,new byte[]{genericCaOidBytes[8]})));
      caPublicKeyInfo.addTlvDataObject(subjPubKeyInfo);
      caPublicKeyInfo.addTlvDataObject(new PrimitiveTlvDataObject(TAG_INTEGER,new byte[]{(byte)keyId}));
      secInfos.add(caPublicKeyInfo);
      if (((KeyObject)curKey).isPrivilegedOnly()) {
        privKeysPublicKeyInfos.add(caPublicKeyInfo);
      }
 else {
        unprivKeysPublicKeyInfos.add(caPublicKeyInfo);
      }
    }
  }
  if ((publicity == SecInfoPublicity.AUTHENTICATED) || (publicity == SecInfoPublicity.PRIVILEGED)) {
    secInfos.addAll(unprivKeysPublicKeyInfos);
  }
  if ((publicity == SecInfoPublicity.PRIVILEGED)) {
    ConstructedTlvDataObject privilegedTerminalInfo=new ConstructedTlvDataObject(TAG_SEQUENCE);
    privilegedTerminalInfo.addTlvDataObject(new PrimitiveTlvDataObject(TAG_OID,Tr03110.id_PT));
    ConstructedTlvDataObject privKeys=new ConstructedTlvDataObject(TAG_SET);
    privKeys.addAll(privKeysPublicKeyInfos);
    privilegedTerminalInfo.addTlvDataObject(privKeys);
    secInfos.add(privilegedTerminalInfo);
  }
  return secInfos;
}

Fixed version (ground truth):
@Override public Collection<TlvDataObject> getSecInfos(SecInfoPublicity publicity,MasterFile mf){
  OidIdentifier caOidIdentifier=new OidIdentifier(OID_id_CA);
  Collection<CardObject> caKeyCardObjects=mf.findChildren(new KeyIdentifier(),caOidIdentifier);
  ArrayList<TlvDataObject> secInfos=new ArrayList<>();
  ArrayList<TlvDataObject> privilegedSecInfos=new ArrayList<>();
  ArrayList<TlvDataObject> unprivilegedPublicKeyInfos=new ArrayList<>();
  ArrayList<TlvDataObject> privilegedPublicKeyInfos=new ArrayList<>();
  for (  CardObject curObject : caKeyCardObjects) {
    if (!(curObject instanceof KeyObject)) {
      continue;
    }
    KeyObject curKey=(KeyObject)curObject;
    Collection<CardObjectIdentifier> identifiers=curKey.getAllIdentifiers();
    int keyId=-1;
    for (    CardObjectIdentifier curIdentifier : identifiers) {
      if (curIdentifier instanceof KeyIdentifier) {
        keyId=((KeyIdentifier)curIdentifier).getKeyReference();
        break;
      }
    }
    if (keyId == -1)     continue;
    byte[] genericCaOidBytes=null;
    for (    CardObjectIdentifier curIdentifier : identifiers) {
      if (caOidIdentifier.matches(curIdentifier)) {
        byte[] oidBytes=((OidIdentifier)curIdentifier).getOid().toByteArray();
        genericCaOidBytes=Arrays.copyOfRange(oidBytes,0,9);
        ConstructedTlvDataObject caInfo=new ConstructedTlvDataObject(TAG_SEQUENCE);
        caInfo.addTlvDataObject(new PrimitiveTlvDataObject(TAG_OID,oidBytes));
        caInfo.addTlvDataObject(new PrimitiveTlvDataObject(TAG_INTEGER,new byte[]{2}));
        caInfo.addTlvDataObject(new PrimitiveTlvDataObject(TAG_INTEGER,new byte[]{(byte)keyId}));
        if (curKey.isPrivilegedOnly()) {
          privilegedSecInfos.add(caInfo);
        }
 else {
          secInfos.add(caInfo);
        }
      }
    }
    ConstructedTlvDataObject encKey=new ConstructedTlvDataObject(curKey.getKeyPair().getPublic().getEncoded());
    ConstructedTlvDataObject algIdentifier=(ConstructedTlvDataObject)encKey.getTlvDataObject(TAG_SEQUENCE);
    TlvDataObject subjPubKey=encKey.getTlvDataObject(TAG_BIT_STRING);
    algIdentifier=StandardizedDomainParameters.simplifyAlgorithmIdentifier(algIdentifier);
    ConstructedTlvDataObject caDomainInfo=new ConstructedTlvDataObject(TAG_SEQUENCE);
    caDomainInfo.addTlvDataObject(new PrimitiveTlvDataObject(TAG_OID,genericCaOidBytes));
    caDomainInfo.addTlvDataObject(algIdentifier);
    caDomainInfo.addTlvDataObject(new PrimitiveTlvDataObject(TAG_INTEGER,new byte[]{(byte)keyId}));
    if (curKey.isPrivilegedOnly()) {
      privilegedSecInfos.add(caDomainInfo);
    }
 else {
      secInfos.add(caDomainInfo);
    }
    ConstructedTlvDataObject subjPubKeyInfo=new ConstructedTlvDataObject(TAG_SEQUENCE);
    subjPubKeyInfo.addTlvDataObject(algIdentifier);
    subjPubKeyInfo.addTlvDataObject(subjPubKey);
    if ((publicity == SecInfoPublicity.AUTHENTICATED) || (publicity == SecInfoPublicity.PRIVILEGED)) {
      ConstructedTlvDataObject caPublicKeyInfo=new ConstructedTlvDataObject(TAG_SEQUENCE);
      caPublicKeyInfo.addTlvDataObject(new PrimitiveTlvDataObject(TAG_OID,Utils.concatByteArrays(Tr03110.id_PK,new byte[]{genericCaOidBytes[8]})));
      caPublicKeyInfo.addTlvDataObject(subjPubKeyInfo);
      caPublicKeyInfo.addTlvDataObject(new PrimitiveTlvDataObject(TAG_INTEGER,new byte[]{(byte)keyId}));
      if (curKey.isPrivilegedOnly()) {
        privilegedPublicKeyInfos.add(caPublicKeyInfo);
      }
 else {
        unprivilegedPublicKeyInfos.add(caPublicKeyInfo);
      }
    }
  }
  if ((publicity == SecInfoPublicity.AUTHENTICATED) || (publicity == SecInfoPublicity.PRIVILEGED)) {
    secInfos.addAll(unprivilegedPublicKeyInfos);
  }
  if (privilegedSecInfos.size() + privilegedPublicKeyInfos.size() > 0) {
    ConstructedTlvDataObject privilegedTerminalInfo=new ConstructedTlvDataObject(TAG_SEQUENCE);
    privilegedTerminalInfo.addTlvDataObject(new PrimitiveTlvDataObject(TAG_OID,Tr03110.id_PT));
    ConstructedTlvDataObject privilegedTerminaInfoSet=new ConstructedTlvDataObject(TAG_SET);
    privilegedTerminalInfo.addTlvDataObject(privilegedTerminaInfoSet);
    privilegedTerminaInfoSet.addAll(privilegedSecInfos);
    if ((publicity == SecInfoPublicity.PRIVILEGED)) {
      privilegedTerminaInfoSet.addAll(privilegedPublicKeyInfos);
    }
    secInfos.add(privilegedTerminalInfo);
  }
  return secInfos;
}