Program: 48095
Project: 48095
Buggy source:
/** 
 * The method performs the SignatureCreation if no standard commands are possible. This method creates a signature with APDUs which are not covered by the methods defined in TR-03112 part 7.
 * @param cryptoMarker A {@link CryptoMarkerType} object containing the information about the creation of a signaturein a legacy way.
 * @param slotHandle A slotHandle identifying the current card.
 * @param templateCTX A Map containing the context data for the evaluation of the template variables. This objectcontains per default the message to sign and the  {@link TLVFunction}.
 * @return A {@link SignResponse} object containing the signature of the <b>message</b>.
 * @throws APDUTemplateException Thrown if the evaluation of the {@link CardCommandTemplate} failed.
 * @throws APDUException Thrown if one of the commands to execute failed.
 * @throws org.openecard.common.WSHelper.WSException Thrown if the checkResult method of WSHelper failed.
 */
private SignResponse performLegacySignature(CryptoMarkerType cryptoMarker,byte[] slotHandle,BaseTemplateContext templateCTX) throws APDUTemplateException, APDUException, WSHelper.WSException {
  SignResponse response=WSHelper.makeResponse(SignResponse.class,WSHelper.makeResultOK());
  List<CardCallTemplateType> legacyCommands=cryptoMarker.getLegacySignatureGenerationInfo();
  CardCommandAPDU cmdAPDU=null;
  CardResponseAPDU responseAPDU=null;
  byte[] signedMessage;
  for (  CardCallTemplateType cctt : legacyCommands) {
    CardCommandTemplate template=new CardCommandTemplate(cctt);
    cmdAPDU=template.evaluate(templateCTX);
    responseAPDU=cmdAPDU.transmit(dispatcher,slotHandle,Collections.<byte[]>emptyList());
  }
  signedMessage=responseAPDU.getData();
  while (responseAPDU.getTrailer()[0] == (byte)0x61) {
    CardCommandAPDU getResponseData=new CardCommandAPDU((byte)0x00,(byte)0xC0,(byte)0x00,(byte)0x00,responseAPDU.getTrailer()[1]);
    responseAPDU=getResponseData.transmit(dispatcher,slotHandle,Collections.<byte[]>emptyList());
    signedMessage=Arrays.concatenate(signedMessage,responseAPDU.getData());
  }
  if (!Arrays.areEqual(responseAPDU.getTrailer(),new byte[]{(byte)0x90,(byte)0x00})) {
    TransmitResponse tr=new TransmitResponse();
    tr.getOutputAPDU().add(responseAPDU.toByteArray());
    WSHelper.checkResult(response);
  }
  response.setSignature(signedMessage);
  return response;
}

Fixed version (ground truth):
/** 
 * The method performs the SignatureCreation if no standard commands are possible. This method creates a signature with APDUs which are not covered by the methods defined in TR-03112 part 7.
 * @param cryptoMarker A {@link CryptoMarkerType} object containing the information about the creation of a signaturein a legacy way.
 * @param slotHandle A slotHandle identifying the current card.
 * @param templateCTX A Map containing the context data for the evaluation of the template variables. This objectcontains per default the message to sign and the  {@link TLVFunction}.
 * @return A {@link SignResponse} object containing the signature of the <b>message</b>.
 * @throws APDUTemplateException Thrown if the evaluation of the {@link CardCommandTemplate} failed.
 * @throws APDUException Thrown if one of the commands to execute failed.
 * @throws org.openecard.common.WSHelper.WSException Thrown if the checkResult method of WSHelper failed.
 */
private SignResponse performLegacySignature(CryptoMarkerType cryptoMarker,byte[] slotHandle,BaseTemplateContext templateCTX) throws APDUTemplateException, APDUException, WSHelper.WSException {
  SignResponse response=WSHelper.makeResponse(SignResponse.class,WSHelper.makeResultOK());
  List<CardCallTemplateType> legacyCommands=cryptoMarker.getLegacySignatureGenerationInfo();
  CardCommandAPDU cmdAPDU;
  CardResponseAPDU responseAPDU=null;
  byte[] signedMessage;
  for (  CardCallTemplateType cctt : legacyCommands) {
    CardCommandTemplate template=new CardCommandTemplate(cctt);
    cmdAPDU=template.evaluate(templateCTX);
    responseAPDU=cmdAPDU.transmit(dispatcher,slotHandle,Collections.<byte[]>emptyList());
  }
  signedMessage=responseAPDU.getData();
  while (responseAPDU.getTrailer()[0] == (byte)0x61) {
    CardCommandAPDU getResponseData=new CardCommandAPDU((byte)0x00,(byte)0xC0,(byte)0x00,(byte)0x00,responseAPDU.getTrailer()[1]);
    responseAPDU=getResponseData.transmit(dispatcher,slotHandle,Collections.<byte[]>emptyList());
    signedMessage=Arrays.concatenate(signedMessage,responseAPDU.getData());
  }
  if (!Arrays.areEqual(responseAPDU.getTrailer(),new byte[]{(byte)0x90,(byte)0x00})) {
    response.setResult(WSHelper.makeResultError(ECardConstants.Minor.Disp.COMM_ERROR,responseAPDU.getStatusMessage()));
    return response;
  }
  response.setSignature(signedMessage);
  return response;
}