Program: 170415
Project: 170415
Buggy source:
private void onOpenSecureChannel(ChannelHandlerContext ctx,ByteBuf buffer) throws UaException {
  buffer.skipBytes(3);
  char chunkType=(char)buffer.readByte();
  if (chunkType == 'A') {
    chunkBuffers.forEach(ByteBuf::release);
    chunkBuffers.clear();
  }
 else {
    buffer.skipBytes(4);
    long secureChannelId=buffer.readUnsignedInt();
    secureChannel.setChannelId(secureChannelId);
    AsymmetricSecurityHeader securityHeader=AsymmetricSecurityHeader.decode(buffer);
    if (!headerRef.compareAndSet(null,securityHeader)) {
      if (!securityHeader.equals(headerRef.get())) {
        throw new UaRuntimeException(StatusCodes.Bad_SecurityChecksFailed,"String_Node_Str");
      }
    }
    chunkBuffers.add(buffer.readerIndex(0).retain());
    if (chunkBuffers.size() > maxChunkCount) {
      throw new UaException(StatusCodes.Bad_TcpMessageTooLarge,String.format("String_Node_Str",maxChunkCount));
    }
    if (chunkType == 'F') {
      final List<ByteBuf> buffersToDecode=chunkBuffers;
      chunkBuffers=Lists.newArrayListWithCapacity(maxChunkCount);
      serializationQueue.decode((binaryDecoder,chunkDecoder) -> {
        ByteBuf messageBuffer=chunkDecoder.decodeAsymmetric(secureChannel,MessageType.OpenSecureChannel,buffersToDecode);
        binaryDecoder.setBuffer(messageBuffer);
        OpenSecureChannelResponse response=binaryDecoder.decodeMessage(null);
        logger.debug("String_Node_Str");
        secureChannel.setPreviousTokenId(secureChannel.getCurrentTokenId());
        secureChannel.setCurrentTokenId(response.getSecurityToken().getTokenId());
        secureChannel.setChannelId(response.getSecurityToken().getChannelId());
        logger.debug("String_Node_Str",secureChannel.getChannelId());
        if (secureChannel.isSymmetricSigningEnabled()) {
          secureChannel.setRemoteNonce(response.getServerNonce());
          ChannelSecrets channelSecrets=ChannelSecrets.forChannel(secureChannel,secureChannel.getLocalNonce(),secureChannel.getRemoteNonce());
          secureChannel.setChannelSecrets(channelSecrets);
        }
        if (response.getServerProtocolVersion() < PROTOCOL_VERSION) {
          throw new UaRuntimeException(StatusCodes.Bad_ProtocolVersionUnsupported,"String_Node_Str" + response.getServerProtocolVersion());
        }
        DateTime createdAt=response.getSecurityToken().getCreatedAt();
        long revisedLifetime=response.getSecurityToken().getRevisedLifetime();
        long renewAt=(long)(revisedLifetime * 0.75);
        renewFuture=ctx.executor().schedule(() -> renewSecureChannel(ctx),renewAt,TimeUnit.MILLISECONDS);
        messageBuffer.release();
        buffersToDecode.clear();
        ctx.executor().execute(() -> {
          ctx.pipeline().remove(UaTcpClientAcknowledgeHandler.class);
          ctx.pipeline().addFirst(new UaTcpClientSymmetricHandler(client,serializationQueue,handshakeFuture));
        }
);
      }
);
    }
  }
}

Fixed version (ground truth):
private void onOpenSecureChannel(ChannelHandlerContext ctx,ByteBuf buffer) throws UaException {
  buffer.skipBytes(3);
  char chunkType=(char)buffer.readByte();
  if (chunkType == 'A') {
    chunkBuffers.forEach(ByteBuf::release);
    chunkBuffers.clear();
  }
 else {
    buffer.skipBytes(4);
    long secureChannelId=buffer.readUnsignedInt();
    secureChannel.setChannelId(secureChannelId);
    AsymmetricSecurityHeader securityHeader=AsymmetricSecurityHeader.decode(buffer);
    if (!headerRef.compareAndSet(null,securityHeader)) {
      if (!securityHeader.equals(headerRef.get())) {
        throw new UaRuntimeException(StatusCodes.Bad_SecurityChecksFailed,"String_Node_Str");
      }
    }
    chunkBuffers.add(buffer.readerIndex(0).retain());
    if (chunkBuffers.size() > maxChunkCount) {
      throw new UaException(StatusCodes.Bad_TcpMessageTooLarge,String.format("String_Node_Str",maxChunkCount));
    }
    if (chunkType == 'F') {
      final List<ByteBuf> buffersToDecode=chunkBuffers;
      chunkBuffers=Lists.newArrayListWithCapacity(maxChunkCount);
      serializationQueue.decode((binaryDecoder,chunkDecoder) -> {
        ByteBuf messageBuffer=chunkDecoder.decodeAsymmetric(secureChannel,MessageType.OpenSecureChannel,buffersToDecode);
        binaryDecoder.setBuffer(messageBuffer);
        OpenSecureChannelResponse response=binaryDecoder.decodeMessage(null);
        logger.debug("String_Node_Str");
        secureChannel.setPreviousTokenId(secureChannel.getCurrentTokenId());
        secureChannel.setCurrentTokenId(response.getSecurityToken().getTokenId());
        secureChannel.setChannelId(response.getSecurityToken().getChannelId());
        logger.debug("String_Node_Str",secureChannel.getChannelId());
        if (secureChannel.isSymmetricSigningEnabled()) {
          secureChannel.setRemoteNonce(response.getServerNonce());
          ChannelSecrets channelSecrets=ChannelSecrets.forChannel(secureChannel,secureChannel.getLocalNonce(),secureChannel.getRemoteNonce());
          secureChannel.setChannelSecrets(channelSecrets);
        }
        if (response.getServerProtocolVersion() < PROTOCOL_VERSION) {
          throw new UaRuntimeException(StatusCodes.Bad_ProtocolVersionUnsupported,"String_Node_Str" + response.getServerProtocolVersion());
        }
        DateTime createdAt=response.getSecurityToken().getCreatedAt();
        long revisedLifetime=response.getSecurityToken().getRevisedLifetime();
        long renewAt=(long)(revisedLifetime * 0.75);
        renewFuture=ctx.executor().schedule(() -> renewSecureChannel(ctx),renewAt,TimeUnit.MILLISECONDS);
        messageBuffer.release();
        buffersToDecode.clear();
        ctx.executor().execute(() -> {
          if (ctx.pipeline().get(UaTcpClientAcknowledgeHandler.class) != null) {
            ctx.pipeline().remove(UaTcpClientAcknowledgeHandler.class);
          }
          ctx.pipeline().addFirst(new UaTcpClientSymmetricHandler(client,serializationQueue,handshakeFuture));
        }
);
      }
);
    }
  }
}