Program: 40847
Project: 40847
Buggy source:
/** 
 * We assume the following message format: | DF | CA | Payload | PI/AP | 5    3    3/10      3
 * @param raw_message Mode S message in hex representation
 * @throws BadFormatException if message has invalid length or payload doesnot match specification or parity has invalid length
 */
public ModeSReply(String raw_message) throws BadFormatException {
  int length=raw_message.length();
  if (length != 14 && length != 28)   throw new BadFormatException("String_Node_Str",raw_message);
  downlink_format=(byte)(Short.parseShort(raw_message.substring(0,2),16));
  capabilities=(byte)(downlink_format & 0x7);
  downlink_format=(byte)(downlink_format >>> 3 & 0x1F);
  byte[] payload=new byte[(length - 8) / 2];
  byte[] icao24=new byte[3];
  byte[] parity=new byte[3];
switch (downlink_format) {
case 0:
case 4:
case 5:
case 16:
case 20:
case 21:
case 24:
    for (int i=length - 6; i < length; i+=2)     icao24[(i - length + 6) / 2]=(byte)Short.parseShort(raw_message.substring(i,i + 2),16);
  for (int i=2; i < length - 6; i+=2)   payload[(i - 2) / 2]=(byte)Short.parseShort(raw_message.substring(i,i + 2),16);
break;
case 11:
case 17:
case 18:
for (int i=2; i < length - 6; i+=2) payload[(i - 2) / 2]=(byte)Short.parseShort(raw_message.substring(i,i + 2),16);
for (int i=0; i < 3; i++) icao24[i]=payload[i];
for (int i=length - 6; i < length; i+=2) parity[(i - length + 6) / 2]=(byte)Short.parseShort(raw_message.substring(i,i + 2),16);
break;
default :
}
if (icao24.length != 3) throw new BadFormatException("String_Node_Str",raw_message);
if (payload.length != 3 && payload.length != 10) throw new BadFormatException("String_Node_Str",raw_message);
if (parity.length != 3) throw new BadFormatException("String_Node_Str",raw_message);
this.icao24=icao24;
this.payload=payload;
this.parity=parity;
setType(subtype.MODES_REPLY);
}

Fixed version (ground truth):
/** 
 * We assume the following message format: | DF | FF | Payload | PI/AP | 5    3    24/80      24
 * @param raw_message Mode S message in hex representation
 * @throws BadFormatException if message has invalid length or payload doesnot match specification or parity has invalid length
 */
public ModeSReply(String raw_message) throws BadFormatException {
  int length=raw_message.length();
  if (length != 14 && length != 28)   throw new BadFormatException("String_Node_Str",raw_message);
  downlink_format=(byte)(Short.parseShort(raw_message.substring(0,2),16));
  first_field=(byte)(downlink_format & 0x7);
  downlink_format=(byte)(downlink_format >>> 3 & 0x1F);
  byte[] payload=new byte[(length - 8) / 2];
  byte[] icao24=new byte[3];
  byte[] parity=new byte[3];
  for (int i=2; i < length - 6; i+=2)   payload[(i - 2) / 2]=(byte)Short.parseShort(raw_message.substring(i,i + 2),16);
  for (int i=length - 6; i < length; i+=2)   parity[(i - length + 6) / 2]=(byte)Short.parseShort(raw_message.substring(i,i + 2),16);
switch (downlink_format) {
case 0:
case 4:
case 5:
case 16:
case 20:
case 21:
case 24:
    break;
case 11:
case 17:
case 18:
  for (int i=0; i < 3; i++)   icao24[i]=payload[i];
break;
default :
}
if (icao24.length != 3) throw new BadFormatException("String_Node_Str",raw_message);
if (payload.length != 3 && payload.length != 10) throw new BadFormatException("String_Node_Str",raw_message);
if (parity.length != 3) throw new BadFormatException("String_Node_Str",raw_message);
this.icao24=icao24;
this.payload=payload;
this.parity=parity;
setType(subtype.MODES_REPLY);
}