Program: 23520
Project: 23520
Buggy source:
/** 
 * Sends a reply to the client. If the reply is a OBEX_HTTP_CONTINUE, it will wait for a response from the client before ending.
 * @param type the response code to send back to the client
 * @return <code>true</code> if the final bit was not set on the reply;<code>false</code> if no reply was received because the operation ended, an abort was received, or the final bit was set in the reply
 * @throws IOException if an IO error occurs
 */
public synchronized boolean sendReply(int type) throws IOException {
  ByteArrayOutputStream out=new ByteArrayOutputStream();
  int bytesReceived;
  long id=mListener.getConnectionId();
  if (id == -1) {
    replyHeader.mConnectionID=null;
  }
 else {
    replyHeader.mConnectionID=ObexHelper.convertToByteArray(id);
  }
  byte[] headerArray=ObexHelper.createHeader(replyHeader,true);
  int bodyLength=-1;
  int orginalBodyLength=-1;
  if (mPrivateOutput != null) {
    bodyLength=mPrivateOutput.size();
    orginalBodyLength=bodyLength;
  }
  if ((ObexHelper.BASE_PACKET_LENGTH + headerArray.length) > mMaxPacketLength) {
    int end=0;
    int start=0;
    while (end != headerArray.length) {
      end=ObexHelper.findHeaderEnd(headerArray,start,mMaxPacketLength - ObexHelper.BASE_PACKET_LENGTH);
      if (end == -1) {
        mClosed=true;
        if (mPrivateInput != null) {
          mPrivateInput.close();
        }
        if (mPrivateOutput != null) {
          mPrivateOutput.close();
        }
        mParent.sendResponse(ResponseCodes.OBEX_HTTP_INTERNAL_ERROR,null);
        throw new IOException("String_Node_Str");
      }
      byte[] sendHeader=new byte[end - start];
      System.arraycopy(headerArray,start,sendHeader,0,sendHeader.length);
      mParent.sendResponse(type,sendHeader);
      start=end;
    }
    if (bodyLength > 0) {
      return true;
    }
 else {
      return false;
    }
  }
 else {
    out.write(headerArray);
  }
  if ((finalBitSet) || (headerArray.length < (mMaxPacketLength - 20))) {
    if (bodyLength > 0) {
      if (bodyLength > (mMaxPacketLength - headerArray.length - 6)) {
        bodyLength=mMaxPacketLength - headerArray.length - 6;
      }
      byte[] body=mPrivateOutput.readBytes(bodyLength);
      if ((finalBitSet) || (mPrivateOutput.isClosed())) {
        out.write(0x49);
      }
 else {
        out.write(0x48);
      }
      bodyLength+=3;
      out.write((byte)(bodyLength >> 8));
      out.write((byte)bodyLength);
      out.write(body);
    }
  }
  if ((finalBitSet) && (type == ResponseCodes.OBEX_HTTP_OK) && (orginalBodyLength <= 0)) {
    out.write(0x49);
    orginalBodyLength=3;
    out.write((byte)(orginalBodyLength >> 8));
    out.write((byte)orginalBodyLength);
  }
  mResponseSize=3;
  mParent.sendResponse(type,out.toByteArray());
  if (type == ResponseCodes.OBEX_HTTP_CONTINUE) {
    int headerID=mInput.read();
    int length=mInput.read();
    length=(length << 8) + mInput.read();
    if ((headerID != ObexHelper.OBEX_OPCODE_PUT) && (headerID != ObexHelper.OBEX_OPCODE_PUT_FINAL) && (headerID != ObexHelper.OBEX_OPCODE_GET)&& (headerID != ObexHelper.OBEX_OPCODE_GET_FINAL)) {
      if (length > 3) {
        byte[] temp=new byte[length];
        bytesReceived=mInput.read(temp);
        while (bytesReceived != length) {
          bytesReceived+=mInput.read(temp,bytesReceived,length - bytesReceived);
        }
      }
      if (headerID == ObexHelper.OBEX_OPCODE_ABORT) {
        mParent.sendResponse(ResponseCodes.OBEX_HTTP_OK,null);
        mClosed=true;
        isAborted=true;
        mExceptionString="String_Node_Str";
        throw new IOException("String_Node_Str");
      }
 else {
        mParent.sendResponse(ResponseCodes.OBEX_HTTP_BAD_REQUEST,null);
        mClosed=true;
        mExceptionString="String_Node_Str";
        throw new IOException("String_Node_Str");
      }
    }
 else {
      if ((headerID == ObexHelper.OBEX_OPCODE_PUT_FINAL) || (headerID == ObexHelper.OBEX_OPCODE_GET_FINAL)) {
        finalBitSet=true;
      }
      if (length > ObexHelper.MAX_PACKET_SIZE_INT) {
        mParent.sendResponse(ResponseCodes.OBEX_HTTP_REQ_TOO_LARGE,null);
        throw new IOException("String_Node_Str");
      }
      if (length > 3) {
        byte[] data=new byte[length - 3];
        bytesReceived=mInput.read(data);
        while (bytesReceived != data.length) {
          bytesReceived+=mInput.read(data,bytesReceived,data.length - bytesReceived);
        }
        byte[] body=ObexHelper.updateHeaderSet(requestHeader,data);
        if (body != null) {
          mHasBody=true;
        }
        if (mListener.getConnectionId() != -1 && requestHeader.mConnectionID != null) {
          mListener.setConnectionId(ObexHelper.convertToLong(requestHeader.mConnectionID));
        }
 else {
          mListener.setConnectionId(1);
        }
        if (requestHeader.mAuthResp != null) {
          if (!mParent.handleAuthResp(requestHeader.mAuthResp)) {
            mExceptionString="String_Node_Str";
            mParent.sendResponse(ResponseCodes.OBEX_HTTP_UNAUTHORIZED,null);
            mClosed=true;
            requestHeader.mAuthResp=null;
            return false;
          }
          requestHeader.mAuthResp=null;
        }
        if (requestHeader.mAuthChall != null) {
          mParent.handleAuthChall(requestHeader);
          replyHeader.mAuthResp=new byte[requestHeader.mAuthResp.length];
          System.arraycopy(requestHeader.mAuthResp,0,replyHeader.mAuthResp,0,replyHeader.mAuthResp.length);
          requestHeader.mAuthResp=null;
          requestHeader.mAuthChall=null;
        }
        if (body != null) {
          mPrivateInput.writeBytes(body,1);
        }
      }
    }
    return true;
  }
 else {
    return false;
  }
}

Fixed version (ground truth):
/** 
 * Sends a reply to the client. If the reply is a OBEX_HTTP_CONTINUE, it will wait for a response from the client before ending.
 * @param type the response code to send back to the client
 * @return <code>true</code> if the final bit was not set on the reply;<code>false</code> if no reply was received because the operation ended, an abort was received, or the final bit was set in the reply
 * @throws IOException if an IO error occurs
 */
public synchronized boolean sendReply(int type) throws IOException {
  ByteArrayOutputStream out=new ByteArrayOutputStream();
  int bytesReceived;
  long id=mListener.getConnectionId();
  if (id == -1) {
    replyHeader.mConnectionID=null;
  }
 else {
    replyHeader.mConnectionID=ObexHelper.convertToByteArray(id);
  }
  byte[] headerArray=ObexHelper.createHeader(replyHeader,true);
  int bodyLength=-1;
  int orginalBodyLength=-1;
  if (mPrivateOutput != null) {
    bodyLength=mPrivateOutput.size();
    orginalBodyLength=bodyLength;
  }
  if ((ObexHelper.BASE_PACKET_LENGTH + headerArray.length) > mMaxPacketLength) {
    int end=0;
    int start=0;
    while (end != headerArray.length) {
      end=ObexHelper.findHeaderEnd(headerArray,start,mMaxPacketLength - ObexHelper.BASE_PACKET_LENGTH);
      if (end == -1) {
        mClosed=true;
        if (mPrivateInput != null) {
          mPrivateInput.close();
        }
        if (mPrivateOutput != null) {
          mPrivateOutput.close();
        }
        mParent.sendResponse(ResponseCodes.OBEX_HTTP_INTERNAL_ERROR,null);
        throw new IOException("String_Node_Str");
      }
      byte[] sendHeader=new byte[end - start];
      System.arraycopy(headerArray,start,sendHeader,0,sendHeader.length);
      mParent.sendResponse(type,sendHeader);
      start=end;
    }
    if (bodyLength > 0) {
      return true;
    }
 else {
      return false;
    }
  }
 else {
    out.write(headerArray);
  }
  if (mGetOperation && type == ResponseCodes.OBEX_HTTP_OK) {
    finalBitSet=true;
  }
  if ((finalBitSet) || (headerArray.length < (mMaxPacketLength - 20))) {
    if (bodyLength > 0) {
      if (bodyLength > (mMaxPacketLength - headerArray.length - 6)) {
        bodyLength=mMaxPacketLength - headerArray.length - 6;
      }
      byte[] body=mPrivateOutput.readBytes(bodyLength);
      if ((finalBitSet) || (mPrivateOutput.isClosed())) {
        out.write(0x49);
      }
 else {
        out.write(0x48);
      }
      bodyLength+=3;
      out.write((byte)(bodyLength >> 8));
      out.write((byte)bodyLength);
      out.write(body);
    }
  }
  if ((finalBitSet) && (type == ResponseCodes.OBEX_HTTP_OK) && (orginalBodyLength <= 0)) {
    out.write(0x49);
    orginalBodyLength=3;
    out.write((byte)(orginalBodyLength >> 8));
    out.write((byte)orginalBodyLength);
  }
  mResponseSize=3;
  mParent.sendResponse(type,out.toByteArray());
  if (type == ResponseCodes.OBEX_HTTP_CONTINUE) {
    int headerID=mInput.read();
    int length=mInput.read();
    length=(length << 8) + mInput.read();
    if ((headerID != ObexHelper.OBEX_OPCODE_PUT) && (headerID != ObexHelper.OBEX_OPCODE_PUT_FINAL) && (headerID != ObexHelper.OBEX_OPCODE_GET)&& (headerID != ObexHelper.OBEX_OPCODE_GET_FINAL)) {
      if (length > 3) {
        byte[] temp=new byte[length];
        bytesReceived=mInput.read(temp);
        while (bytesReceived != length) {
          bytesReceived+=mInput.read(temp,bytesReceived,length - bytesReceived);
        }
      }
      if (headerID == ObexHelper.OBEX_OPCODE_ABORT) {
        mParent.sendResponse(ResponseCodes.OBEX_HTTP_OK,null);
        mClosed=true;
        isAborted=true;
        mExceptionString="String_Node_Str";
        throw new IOException("String_Node_Str");
      }
 else {
        mParent.sendResponse(ResponseCodes.OBEX_HTTP_BAD_REQUEST,null);
        mClosed=true;
        mExceptionString="String_Node_Str";
        throw new IOException("String_Node_Str");
      }
    }
 else {
      if ((headerID == ObexHelper.OBEX_OPCODE_PUT_FINAL)) {
        finalBitSet=true;
      }
 else       if (headerID == ObexHelper.OBEX_OPCODE_GET_FINAL) {
        mRequestFinished=true;
      }
      if (length > ObexHelper.MAX_PACKET_SIZE_INT) {
        mParent.sendResponse(ResponseCodes.OBEX_HTTP_REQ_TOO_LARGE,null);
        throw new IOException("String_Node_Str");
      }
      if (length > 3) {
        byte[] data=new byte[length - 3];
        bytesReceived=mInput.read(data);
        while (bytesReceived != data.length) {
          bytesReceived+=mInput.read(data,bytesReceived,data.length - bytesReceived);
        }
        byte[] body=ObexHelper.updateHeaderSet(requestHeader,data);
        if (body != null) {
          mHasBody=true;
        }
        if (mListener.getConnectionId() != -1 && requestHeader.mConnectionID != null) {
          mListener.setConnectionId(ObexHelper.convertToLong(requestHeader.mConnectionID));
        }
 else {
          mListener.setConnectionId(1);
        }
        if (requestHeader.mAuthResp != null) {
          if (!mParent.handleAuthResp(requestHeader.mAuthResp)) {
            mExceptionString="String_Node_Str";
            mParent.sendResponse(ResponseCodes.OBEX_HTTP_UNAUTHORIZED,null);
            mClosed=true;
            requestHeader.mAuthResp=null;
            return false;
          }
          requestHeader.mAuthResp=null;
        }
        if (requestHeader.mAuthChall != null) {
          mParent.handleAuthChall(requestHeader);
          replyHeader.mAuthResp=new byte[requestHeader.mAuthResp.length];
          System.arraycopy(requestHeader.mAuthResp,0,replyHeader.mAuthResp,0,replyHeader.mAuthResp.length);
          requestHeader.mAuthResp=null;
          requestHeader.mAuthChall=null;
        }
        if (body != null) {
          mPrivateInput.writeBytes(body,1);
        }
      }
    }
    return true;
  }
 else {
    return false;
  }
}