Program: 52453
Project: 52453
Buggy source:
static int horst_verify(HashFunctions hs,byte[] pk,byte[] sig,int sigOff,byte[] masks,byte[] m_hash){
  byte[] buffer=new byte[32 * Sphincs256Config.HASH_BYTES];
  int idx;
  int i, j, k;
  int sigOffset=sigOff + 64 * Sphincs256Config.HASH_BYTES;
  for (i=0; i < HORST_K; i++) {
    idx=(m_hash[2 * i] & 0xff) + ((m_hash[2 * i + 1] & 0xff) << 8);
    if ((idx & 1) == 0) {
      hs.hash_n_n(buffer,0,sig,sigOffset);
      for (k=0; k < Sphincs256Config.HASH_BYTES; k++)       buffer[Sphincs256Config.HASH_BYTES + k]=sig[sigOffset + HORST_SKBYTES + k];
    }
 else {
      hs.hash_n_n(buffer,Sphincs256Config.HASH_BYTES,sig,sigOffset);
      for (k=0; k < Sphincs256Config.HASH_BYTES; k++)       buffer[k]=sig[sigOffset + HORST_SKBYTES + k];
    }
    sigOffset+=HORST_SKBYTES + Sphincs256Config.HASH_BYTES;
    for (j=1; j < HORST_LOGT - 6; j++) {
      idx=idx >>> 1;
      if ((idx & 1) == 0) {
        hs.hash_2n_n_mask(buffer,0,buffer,0,masks,2 * (j - 1) * Sphincs256Config.HASH_BYTES);
        for (k=0; k < Sphincs256Config.HASH_BYTES; k++)         buffer[Sphincs256Config.HASH_BYTES + k]=sig[sigOffset + k];
      }
 else {
        hs.hash_2n_n_mask(buffer,Sphincs256Config.HASH_BYTES,buffer,0,masks,2 * (j - 1) * Sphincs256Config.HASH_BYTES);
        for (k=0; k < Sphincs256Config.HASH_BYTES; k++)         buffer[k]=sig[sigOffset + k];
      }
      sigOffset+=Sphincs256Config.HASH_BYTES;
    }
    idx=idx >>> 1;
    hs.hash_2n_n_mask(buffer,0,buffer,0,masks,2 * (HORST_LOGT - 7) * Sphincs256Config.HASH_BYTES);
    for (k=0; k < Sphincs256Config.HASH_BYTES; k++)     if (sig[sigOff + idx * Sphincs256Config.HASH_BYTES + k] != buffer[k]) {
      for (k=0; k < Sphincs256Config.HASH_BYTES; k++)       pk[k]=0;
      return -1;
    }
  }
  for (j=0; j < 32; j++)   hs.hash_2n_n_mask(buffer,j * Sphincs256Config.HASH_BYTES,sig,sigOff + 2 * j * Sphincs256Config.HASH_BYTES,masks,2 * (HORST_LOGT - 6) * Sphincs256Config.HASH_BYTES);
  for (j=0; j < 16; j++)   hs.hash_2n_n_mask(buffer,j * Sphincs256Config.HASH_BYTES,buffer,2 * j * Sphincs256Config.HASH_BYTES,masks,2 * (HORST_LOGT - 5) * Sphincs256Config.HASH_BYTES);
  for (j=0; j < 8; j++)   hs.hash_2n_n_mask(buffer,j * Sphincs256Config.HASH_BYTES,buffer,2 * j * Sphincs256Config.HASH_BYTES,masks,2 * (HORST_LOGT - 4) * Sphincs256Config.HASH_BYTES);
  for (j=0; j < 4; j++)   hs.hash_2n_n_mask(buffer,j * Sphincs256Config.HASH_BYTES,buffer,2 * j * Sphincs256Config.HASH_BYTES,masks,2 * (HORST_LOGT - 3) * Sphincs256Config.HASH_BYTES);
  for (j=0; j < 2; j++)   hs.hash_2n_n_mask(buffer,j * Sphincs256Config.HASH_BYTES,buffer,2 * j * Sphincs256Config.HASH_BYTES,masks,2 * (HORST_LOGT - 2) * Sphincs256Config.HASH_BYTES);
  hs.hash_2n_n_mask(pk,0,buffer,0,masks,2 * (HORST_LOGT - 1) * Sphincs256Config.HASH_BYTES);
  return 0;
}

Fixed version (ground truth):
static int horst_verify(HashFunctions hs,byte[] pk,byte[] sig,int sigOff,byte[] masks,byte[] m_hash){
  byte[] buffer=new byte[32 * SPHINCS256Config.HASH_BYTES];
  int idx;
  int i, j, k;
  int sigOffset=sigOff + 64 * SPHINCS256Config.HASH_BYTES;
  for (i=0; i < HORST_K; i++) {
    idx=(m_hash[2 * i] & 0xff) + ((m_hash[2 * i + 1] & 0xff) << 8);
    if ((idx & 1) == 0) {
      hs.hash_n_n(buffer,0,sig,sigOffset);
      for (k=0; k < SPHINCS256Config.HASH_BYTES; k++)       buffer[SPHINCS256Config.HASH_BYTES + k]=sig[sigOffset + HORST_SKBYTES + k];
    }
 else {
      hs.hash_n_n(buffer,SPHINCS256Config.HASH_BYTES,sig,sigOffset);
      for (k=0; k < SPHINCS256Config.HASH_BYTES; k++)       buffer[k]=sig[sigOffset + HORST_SKBYTES + k];
    }
    sigOffset+=HORST_SKBYTES + SPHINCS256Config.HASH_BYTES;
    for (j=1; j < HORST_LOGT - 6; j++) {
      idx=idx >>> 1;
      if ((idx & 1) == 0) {
        hs.hash_2n_n_mask(buffer,0,buffer,0,masks,2 * (j - 1) * SPHINCS256Config.HASH_BYTES);
        for (k=0; k < SPHINCS256Config.HASH_BYTES; k++)         buffer[SPHINCS256Config.HASH_BYTES + k]=sig[sigOffset + k];
      }
 else {
        hs.hash_2n_n_mask(buffer,SPHINCS256Config.HASH_BYTES,buffer,0,masks,2 * (j - 1) * SPHINCS256Config.HASH_BYTES);
        for (k=0; k < SPHINCS256Config.HASH_BYTES; k++)         buffer[k]=sig[sigOffset + k];
      }
      sigOffset+=SPHINCS256Config.HASH_BYTES;
    }
    idx=idx >>> 1;
    hs.hash_2n_n_mask(buffer,0,buffer,0,masks,2 * (HORST_LOGT - 7) * SPHINCS256Config.HASH_BYTES);
    for (k=0; k < SPHINCS256Config.HASH_BYTES; k++)     if (sig[sigOff + idx * SPHINCS256Config.HASH_BYTES + k] != buffer[k]) {
      for (k=0; k < SPHINCS256Config.HASH_BYTES; k++)       pk[k]=0;
      return -1;
    }
  }
  for (j=0; j < 32; j++)   hs.hash_2n_n_mask(buffer,j * SPHINCS256Config.HASH_BYTES,sig,sigOff + 2 * j * SPHINCS256Config.HASH_BYTES,masks,2 * (HORST_LOGT - 6) * SPHINCS256Config.HASH_BYTES);
  for (j=0; j < 16; j++)   hs.hash_2n_n_mask(buffer,j * SPHINCS256Config.HASH_BYTES,buffer,2 * j * SPHINCS256Config.HASH_BYTES,masks,2 * (HORST_LOGT - 5) * SPHINCS256Config.HASH_BYTES);
  for (j=0; j < 8; j++)   hs.hash_2n_n_mask(buffer,j * SPHINCS256Config.HASH_BYTES,buffer,2 * j * SPHINCS256Config.HASH_BYTES,masks,2 * (HORST_LOGT - 4) * SPHINCS256Config.HASH_BYTES);
  for (j=0; j < 4; j++)   hs.hash_2n_n_mask(buffer,j * SPHINCS256Config.HASH_BYTES,buffer,2 * j * SPHINCS256Config.HASH_BYTES,masks,2 * (HORST_LOGT - 3) * SPHINCS256Config.HASH_BYTES);
  for (j=0; j < 2; j++)   hs.hash_2n_n_mask(buffer,j * SPHINCS256Config.HASH_BYTES,buffer,2 * j * SPHINCS256Config.HASH_BYTES,masks,2 * (HORST_LOGT - 2) * SPHINCS256Config.HASH_BYTES);
  hs.hash_2n_n_mask(pk,0,buffer,0,masks,2 * (HORST_LOGT - 1) * SPHINCS256Config.HASH_BYTES);
  return 0;
}