Program: 23786
Project: 23786
Buggy source:
/** 
 * Handles a disconnect request from a client. This method will read the rest of the request from the client. Assuming the request is valid, it will create a <code>HeaderSet</code> object to pass to the <code>ServerRequestHandler</code> object. After the handler processes the request, this method will create a reply message to send to the server.
 * @throws IOException if an error occurred at the transport layer
 */
private void handleDisconnectRequest() throws IOException {
  int length;
  int code=ResponseCodes.OBEX_HTTP_OK;
  int totalLength=3;
  byte[] head=null;
  int bytesReceived;
  HeaderSet request=new HeaderSet();
  HeaderSet reply=new HeaderSet();
  length=mInput.read();
  length=(length << 8) + mInput.read();
  if (length > ObexHelper.MAX_PACKET_SIZE_INT) {
    code=ResponseCodes.OBEX_HTTP_REQ_TOO_LARGE;
    totalLength=3;
  }
 else {
    if (length > 3) {
      byte[] headers=new byte[length - 3];
      bytesReceived=mInput.read(headers);
      while (bytesReceived != headers.length) {
        bytesReceived+=mInput.read(headers,bytesReceived,headers.length - bytesReceived);
      }
      ObexHelper.updateHeaderSet(request,headers);
    }
    if (request.mConnectionID != null) {
      mListener.setConnectionId(ObexHelper.convertToLong(request.mConnectionID));
    }
 else {
      mListener.setConnectionId(1);
    }
    if (request.mAuthResp != null) {
      if (!handleAuthResp(request.mAuthResp)) {
        code=ResponseCodes.OBEX_HTTP_UNAUTHORIZED;
        mListener.onAuthenticationFailure(ObexHelper.getTagValue((byte)0x01,request.mAuthResp));
      }
      request.mAuthResp=null;
    }
    if (code != ResponseCodes.OBEX_HTTP_UNAUTHORIZED) {
      if (request.mAuthChall != null) {
        handleAuthChall(request);
        request.mAuthChall=null;
      }
      try {
        mListener.onDisconnect(request,reply);
      }
 catch (      Exception e) {
        sendResponse(ResponseCodes.OBEX_HTTP_INTERNAL_ERROR,null);
        return;
      }
      long id=mListener.getConnectionId();
      if (id == -1) {
        reply.mConnectionID=null;
      }
 else {
        reply.mConnectionID=ObexHelper.convertToByteArray(id);
      }
      head=ObexHelper.createHeader(reply,false);
      totalLength+=head.length;
      if (totalLength > mMaxPacketLength) {
        totalLength=3;
        head=null;
        code=ResponseCodes.OBEX_HTTP_INTERNAL_ERROR;
      }
    }
  }
  byte[] replyData;
  if (head != null) {
    replyData=new byte[3 + head.length];
  }
 else {
    replyData=new byte[3];
  }
  replyData[0]=(byte)code;
  replyData[1]=(byte)(totalLength >> 8);
  replyData[2]=(byte)totalLength;
  if (head != null) {
    System.arraycopy(head,0,replyData,3,head.length);
  }
  mOutput.write(replyData);
  mOutput.flush();
}

Fixed version (ground truth):
/** 
 * Handles a disconnect request from a client. This method will read the rest of the request from the client. Assuming the request is valid, it will create a <code>HeaderSet</code> object to pass to the <code>ServerRequestHandler</code> object. After the handler processes the request, this method will create a reply message to send to the server.
 * @throws IOException if an error occurred at the transport layer
 */
private void handleDisconnectRequest() throws IOException {
  int length;
  int code=ResponseCodes.OBEX_HTTP_OK;
  int totalLength=3;
  byte[] head=null;
  int bytesReceived;
  HeaderSet request=new HeaderSet();
  HeaderSet reply=new HeaderSet();
  length=mInput.read();
  length=(length << 8) + mInput.read();
  if (length > ObexHelper.MAX_PACKET_SIZE_INT) {
    code=ResponseCodes.OBEX_HTTP_REQ_TOO_LARGE;
    totalLength=3;
  }
 else {
    if (length > 3) {
      byte[] headers=new byte[length - 3];
      bytesReceived=mInput.read(headers);
      while (bytesReceived != headers.length) {
        bytesReceived+=mInput.read(headers,bytesReceived,headers.length - bytesReceived);
      }
      ObexHelper.updateHeaderSet(request,headers);
    }
    if (mListener.getConnectionId() != -1 && request.mConnectionID != null) {
      mListener.setConnectionId(ObexHelper.convertToLong(request.mConnectionID));
    }
 else {
      mListener.setConnectionId(1);
    }
    if (request.mAuthResp != null) {
      if (!handleAuthResp(request.mAuthResp)) {
        code=ResponseCodes.OBEX_HTTP_UNAUTHORIZED;
        mListener.onAuthenticationFailure(ObexHelper.getTagValue((byte)0x01,request.mAuthResp));
      }
      request.mAuthResp=null;
    }
    if (code != ResponseCodes.OBEX_HTTP_UNAUTHORIZED) {
      if (request.mAuthChall != null) {
        handleAuthChall(request);
        request.mAuthChall=null;
      }
      try {
        mListener.onDisconnect(request,reply);
      }
 catch (      Exception e) {
        sendResponse(ResponseCodes.OBEX_HTTP_INTERNAL_ERROR,null);
        return;
      }
      long id=mListener.getConnectionId();
      if (id == -1) {
        reply.mConnectionID=null;
      }
 else {
        reply.mConnectionID=ObexHelper.convertToByteArray(id);
      }
      head=ObexHelper.createHeader(reply,false);
      totalLength+=head.length;
      if (totalLength > mMaxPacketLength) {
        totalLength=3;
        head=null;
        code=ResponseCodes.OBEX_HTTP_INTERNAL_ERROR;
      }
    }
  }
  byte[] replyData;
  if (head != null) {
    replyData=new byte[3 + head.length];
  }
 else {
    replyData=new byte[3];
  }
  replyData[0]=(byte)code;
  replyData[1]=(byte)(totalLength >> 8);
  replyData[2]=(byte)totalLength;
  if (head != null) {
    System.arraycopy(head,0,replyData,3,head.length);
  }
  mOutput.write(replyData);
  mOutput.flush();
}