Program: 29158
Project: 29158
Buggy source:
/** 
 * Signs a jar.
 * @param input input jar file
 * @param output output jar file
 * @param alias signing alias in the keystore
 */
public void signJar(File input,File output,String alias) throws IOException, KeyStoreException, NoSuchAlgorithmException, InvalidKeyException, UnrecoverableKeyException, SignatureException {
  JarFile jf=new JarFile(input);
  ZipOutputStream zout=null;
  try {
    Enumeration<JarEntry> jes;
    StringBuilder manifestEntries=new StringBuilder();
    byte[] manifestContent=null;
    byte[] sigFileContent=getExistingSignatureFile(jf);
    boolean signed=(sigFileContent != null);
    if (!signed) {
      jes=jf.entries();
      Manifest manifest=retrieveManifest(jf);
      StringBuilder manifestHeader=new StringBuilder();
      appendAttributes(manifestHeader,manifest,null);
      StringBuilder sigFileEntries=new StringBuilder();
      while (jes.hasMoreElements()) {
        JarEntry je=jes.nextElement();
        String name=je.getName();
        if ((je.isDirectory() && manifest.getAttributes(name) == null) || name.equals(JarFile.MANIFEST_NAME)) {
          continue;
        }
        StringBuilder me=new StringBuilder();
        StringBuilder currentLine=new StringBuilder();
        currentLine.append("String_Node_Str").append(name);
        appendLine(me,currentLine);
        currentLine.setLength(0);
        me.append(digestAlgorithm).append("String_Node_Str").append(hash(jf,je)).append("String_Node_Str");
        appendAttributes(me,manifest,name);
        currentLine.append("String_Node_Str").append(name);
        appendLine(sigFileEntries,currentLine);
        currentLine.setLength(0);
        sigFileEntries.append(digestAlgorithm).append("String_Node_Str").append(hash(me.toString())).append("String_Node_Str");
        manifestEntries.append(me);
      }
      StringBuilder sigFile=new StringBuilder("String_Node_Str").append(digestAlgorithm).append("String_Node_Str").append(hash(manifestHeader.toString())).append("String_Node_Str").append("String_Node_Str").append(System.getProperty("String_Node_Str")).append("String_Node_Str").append(System.getProperty("String_Node_Str")).append("String_Node_Str");
      manifestHeader.append(manifestEntries);
      sigFile.append(digestAlgorithm).append("String_Node_Str").append(hash(manifestHeader.toString())).append("String_Node_Str");
      sigFile.append(sigFileEntries);
      manifestContent=manifestHeader.toString().getBytes();
      sigFileContent=sigFile.toString().getBytes();
    }
 else {
      manifestContent=readJarEntry(jf,jf.getJarEntry(JarFile.MANIFEST_NAME));
    }
    X509Certificate[] certChain=null;
    PrivateKey privKey=null;
    KeyStore[] ks=secSupp.getKeyStores();
    for (int i=0; i < ks.length; i++) {
      privKey=secSupp.getPrivateKeyForAlias(alias,i);
      if (privKey != null) {
        Certificate[] cs=ks[i].getCertificateChain(alias);
        certChain=new X509Certificate[cs.length];
        for (int j=0; j < cs.length; j++) {
          certChain[j]=(X509Certificate)cs[j];
        }
      }
    }
    Signature sig=Signature.getInstance(digestAlgorithm + "String_Node_Str" + keyAlgorithm);
    sig.initSign(privKey);
    sig.update(sigFileContent);
    PKCS7 pkcs7=new PKCS7(new AlgorithmId[]{AlgorithmId.get(digestAlgorithm)},new ContentInfo(sigFileContent),certChain,new SignerInfo[]{new SignerInfo((X500Name)certChain[0].getIssuerDN(),certChain[0].getSerialNumber(),AlgorithmId.get(digestAlgorithm),AlgorithmId.get(keyAlgorithm),sig.sign())});
    ByteArrayOutputStream bout=new ByteArrayOutputStream();
    pkcs7.encodeSignedData(bout);
    zout=new ZipOutputStream(new FileOutputStream(output));
    zout.putNextEntry((signed) ? getZipEntry(jf.getJarEntry(JarFile.MANIFEST_NAME)) : new ZipEntry(JarFile.MANIFEST_NAME));
    zout.write(manifestContent);
    zout.putNextEntry(new ZipEntry("String_Node_Str" + alias.toUpperCase(Locale.US) + "String_Node_Str"));
    zout.write(sigFileContent);
    zout.putNextEntry(new ZipEntry("String_Node_Str" + alias.toUpperCase(Locale.US) + "String_Node_Str"+ keyAlgorithm));
    zout.write(bout.toByteArray());
    jes=jf.entries();
    while (jes.hasMoreElements()) {
      JarEntry je=jes.nextElement();
      String name=je.getName();
      if (!name.equals(JarFile.MANIFEST_NAME)) {
        zout.putNextEntry(getZipEntry(je));
        byte[] data=readJarEntry(jf,je);
        zout.write(data);
      }
    }
  }
  finally {
    jf.close();
    zout.close();
  }
}

Fixed version (ground truth):
/** 
 * Signs a jar.
 * @param input input jar file
 * @param output output jar file
 * @param alias signing alias in the keystore
 */
public void signJar(File input,File output,String alias) throws IOException, KeyStoreException, NoSuchAlgorithmException, InvalidKeyException, UnrecoverableKeyException, SignatureException {
  JarFile jf=new JarFile(input);
  ZipOutputStream zout=null;
  try {
    Enumeration<JarEntry> jes;
    StringBuilder manifestEntries=new StringBuilder();
    byte[] manifestContent=null;
    byte[] sigFileContent=getExistingSignatureFile(jf);
    boolean signed=(sigFileContent != null);
    if (!signed) {
      jes=jf.entries();
      Manifest manifest=retrieveManifest(jf);
      StringBuilder manifestHeader=new StringBuilder();
      appendAttributes(manifestHeader,manifest,null);
      StringBuilder sigFileEntries=new StringBuilder();
      while (jes.hasMoreElements()) {
        JarEntry je=jes.nextElement();
        String name=je.getName();
        if ((je.isDirectory() && manifest.getAttributes(name) == null) || name.equals(JarFile.MANIFEST_NAME)) {
          continue;
        }
        StringBuilder me=new StringBuilder();
        StringBuilder currentLine=new StringBuilder();
        currentLine.append("String_Node_Str").append(name);
        appendLine(me,currentLine);
        currentLine.setLength(0);
        me.append(digestAlgorithm).append("String_Node_Str").append(hash(jf,je)).append("String_Node_Str");
        appendAttributes(me,manifest,name);
        currentLine.append("String_Node_Str").append(name);
        appendLine(sigFileEntries,currentLine);
        currentLine.setLength(0);
        sigFileEntries.append(digestAlgorithm).append("String_Node_Str").append(hash(me.toString())).append("String_Node_Str");
        manifestEntries.append(me);
      }
      StringBuilder sigFile=new StringBuilder("String_Node_Str").append(digestAlgorithm).append("String_Node_Str").append(hash(manifestHeader.toString())).append("String_Node_Str").append("String_Node_Str").append(System.getProperty("String_Node_Str")).append("String_Node_Str").append(System.getProperty("String_Node_Str")).append("String_Node_Str");
      manifestHeader.append(manifestEntries);
      sigFile.append(digestAlgorithm).append("String_Node_Str").append(hash(manifestHeader.toString())).append("String_Node_Str");
      sigFile.append(sigFileEntries);
      manifestContent=manifestHeader.toString().getBytes();
      sigFileContent=sigFile.toString().getBytes();
    }
 else {
      manifestContent=readJarEntry(jf,jf.getJarEntry(JarFile.MANIFEST_NAME));
    }
    X509Certificate[] certChain=null;
    PrivateKey privKey=null;
    KeyStore[] ks=secSupp.getKeyStores();
    for (int i=0; i < ks.length; i++) {
      privKey=secSupp.getPrivateKeyForAlias(alias,i);
      if (privKey != null) {
        Certificate[] cs=ks[i].getCertificateChain(alias);
        certChain=new X509Certificate[cs.length];
        for (int j=0; j < cs.length; j++) {
          certChain[j]=(X509Certificate)cs[j];
        }
      }
    }
    Signature sig=Signature.getInstance(digestAlgorithm + "String_Node_Str" + keyAlgorithm);
    sig.initSign(privKey);
    sig.update(sigFileContent);
    PKCS7 pkcs7=new PKCS7(new AlgorithmId[]{AlgorithmId.get(digestAlgorithm)},new ContentInfo(sigFileContent),certChain,new SignerInfo[]{new SignerInfo((X500Name)certChain[0].getIssuerDN(),certChain[0].getSerialNumber(),AlgorithmId.get(digestAlgorithm),AlgorithmId.get(keyAlgorithm),sig.sign())});
    ByteArrayOutputStream bout=new ByteArrayOutputStream();
    pkcs7.encodeSignedData(bout);
    zout=new ZipOutputStream(new FileOutputStream(output));
    zout.putNextEntry((signed) ? getZipEntry(jf.getJarEntry(JarFile.MANIFEST_NAME)) : new ZipEntry(JarFile.MANIFEST_NAME));
    zout.write(manifestContent);
    zout.putNextEntry(new ZipEntry("String_Node_Str" + alias.toUpperCase(Locale.US) + "String_Node_Str"));
    zout.write(sigFileContent);
    zout.putNextEntry(new ZipEntry("String_Node_Str" + alias.toUpperCase(Locale.US) + "String_Node_Str"+ keyAlgorithm));
    zout.write(bout.toByteArray());
    jes=jf.entries();
    while (jes.hasMoreElements()) {
      JarEntry je=jes.nextElement();
      String name=je.getName();
      if (!name.equals(JarFile.MANIFEST_NAME)) {
        zout.putNextEntry(getZipEntry(je));
        byte[] data=readJarEntry(jf,je);
        zout.write(data);
      }
    }
  }
  finally {
    jf.close();
    if (zout != null) {
      zout.close();
    }
  }
}