Program: 43768
Project: 43768
Buggy source:
public void parse(HttpServletRequest request,String charset,FilePool tmpFiles) throws UploadFailException {
  info=new UploadInfo();
  request.getSession().setAttribute(UploadInfo.class.getName(),info);
  info.setSum(request.getContentLength());
  try {
    params=new HashMap<String,Object>();
    InputStream ins=request.getInputStream();
    if (!(ins instanceof BufferedInputStream))     ins=new BufferedInputStream(ins);
    String contentType=request.getContentType();
    String s="String_Node_Str" + Http.multipart.getBoundary(contentType);
    char[] endValue=s.toCharArray();
    int[] right=new int[endValue.length];
    int cursor;
    int c=0;
    for (int i=0; i < s.length(); i++)     c=info.read(ins);
    while (c != -1) {
      cursor=0;
      right[cursor++]=info.read(ins);
      right[cursor++]=right[0] == -1 ? -1 : info.read(ins);
      if (right[1] == -1 || (right[0] == '-' && right[1] == '-'))       break;
      StreamBuffer sb=new StreamBuffer();
      while (cursor < endName.length && (c=info.read(ins)) != -1) {
        if (c == endName[cursor]) {
          right[cursor++]=c;
        }
 else {
          if (cursor > 0) {
            for (int i=0; i < cursor; i++)             sb.write(right[i]);
          }
          sb.write(c);
          cursor=0;
        }
      }
      FieldMeta meta=new FieldMeta(sb.toString(charset));
      cursor=0;
      if (meta.isFile()) {
        File tmp=tmpFiles.createFile(meta.getFileExtension());
        OutputStream ots=new BufferedOutputStream(new FileOutputStream(tmp));
        while (c != -1 && cursor < endValue.length) {
          c=info.read(ins);
          if (c == endValue[cursor]) {
            right[cursor++]=c;
          }
 else {
            if (cursor > 0) {
              for (int i=0; i < cursor; i++)               ots.write(right[i]);
            }
            ots.write(c);
            cursor=0;
          }
        }
        ots.close();
        params.put(meta.getName(),new TempFile(meta,tmp));
      }
 else {
        sb=new StreamBuffer();
        while (c != -1 && cursor < endValue.length) {
          c=info.read(ins);
          if (c == endValue[cursor]) {
            right[cursor++]=c;
          }
 else {
            if (cursor > 0) {
              for (int i=0; i < cursor; i++)               sb.write(right[i]);
            }
            sb.write(c);
            cursor=0;
          }
        }
        params.put(meta.getName(),sb.toString(charset));
      }
      s=request.getQueryString();
      if (null != s) {
        String[] pairs=Strings.splitIgnoreBlank(s,"String_Node_Str");
        for (        String pair : pairs) {
          String[] pp=pair.split("String_Node_Str");
          if (pp.length > 1)           params.put(pp[0],pp[1]);
 else           params.put(pp[0],null);
        }
      }
    }
  }
 catch (  IOException e) {
    throw new UploadFailException(e);
  }
 finally {
    request.getSession().removeAttribute(UploadInfo.class.getName());
  }
}

Fixed version (ground truth):
public void parse(HttpServletRequest request,String charset,FilePool tmpFiles) throws UploadFailException {
  info=new UploadInfo();
  request.getSession().setAttribute(UploadInfo.class.getName(),info);
  info.setSum(request.getContentLength());
  try {
    params=new HashMap<String,Object>();
    InputStream ins=request.getInputStream();
    ins=new BufferedInputStream(ins);
    String contentType=request.getContentType();
    String s="String_Node_Str" + Http.multipart.getBoundary(contentType);
    char[] endValue=s.toCharArray();
    int[] right=new int[endValue.length];
    int cursor;
    int c=0;
    for (int i=0; i < s.length(); i++)     c=info.read(ins);
    while (c != -1) {
      cursor=0;
      right[cursor++]=info.read(ins);
      right[cursor++]=right[0] == -1 ? -1 : info.read(ins);
      if (right[1] == -1 || (right[0] == '-' && right[1] == '-'))       break;
      StreamBuffer sb=new StreamBuffer();
      while (cursor < endName.length && (c=info.read(ins)) != -1) {
        if (c == endName[cursor]) {
          right[cursor++]=c;
        }
 else {
          if (cursor > 0) {
            for (int i=0; i < cursor; i++)             sb.write(right[i]);
          }
          sb.write(c);
          cursor=0;
        }
      }
      FieldMeta meta=new FieldMeta(sb.toString(charset));
      cursor=0;
      if (meta.isFile()) {
        File tmp=tmpFiles.createFile(meta.getFileExtension());
        OutputStream ots=new BufferedOutputStream(new FileOutputStream(tmp));
        while (c != -1 && cursor < endValue.length) {
          c=info.read(ins);
          if (c == endValue[cursor]) {
            right[cursor++]=c;
          }
 else {
            if (cursor > 0) {
              for (int i=0; i < cursor; i++)               ots.write(right[i]);
            }
            ots.write(c);
            cursor=0;
          }
        }
        ots.close();
        params.put(meta.getName(),new TempFile(meta,tmp));
      }
 else {
        sb=new StreamBuffer();
        while (c != -1 && cursor < endValue.length) {
          c=info.read(ins);
          if (c == endValue[cursor]) {
            right[cursor++]=c;
          }
 else {
            if (cursor > 0) {
              for (int i=0; i < cursor; i++)               sb.write(right[i]);
            }
            sb.write(c);
            cursor=0;
          }
        }
        params.put(meta.getName(),sb.toString(charset));
      }
      s=request.getQueryString();
      if (null != s) {
        String[] pairs=Strings.splitIgnoreBlank(s,"String_Node_Str");
        for (        String pair : pairs) {
          String[] pp=pair.split("String_Node_Str");
          if (pp.length > 1)           params.put(pp[0],pp[1]);
 else           params.put(pp[0],null);
        }
      }
    }
  }
 catch (  IOException e) {
    throw new UploadFailException(e);
  }
 finally {
    request.getSession().removeAttribute(UploadInfo.class.getName());
  }
}