Program: 11628
Project: 11628
Buggy source:
@Override protected void decode(ChannelHandlerContext ctx,ByteBuf buf,List<Object> list) throws Exception {
  ByteBuf decrypt=buf;
  NetCrypto crypto=this.client.getCryptoModule();
  if (crypto != null && crypto.isCryptoEnabled()) {
    decrypt=ctx.alloc().buffer();
    crypto.decrypt(buf,decrypt);
  }
  int fullLen=rvint(decrypt);
  ByteBuf decompressed;
  if (this.client.doCompression()) {
    int uncompressed=rvint(decrypt);
    if (uncompressed != 0) {
      if (uncompressed < TridentServer.cfg().compressionThresh()) {
        this.client.disconnect("String_Node_Str");
        return;
      }
      decompressed=ctx.alloc().buffer();
      byte[] in=arr(decrypt,fullLen - BigInteger.valueOf(uncompressed).toByteArray().length);
      Inflater inflater=INFLATER.get();
      inflater.setInput(in);
      byte[] buffer=new byte[NetClient.BUFFER_SIZE];
      while (!inflater.finished()) {
        int bytes=inflater.inflate(buffer);
        decompressed.writeBytes(buffer,0,bytes);
      }
      inflater.reset();
    }
 else {
      decompressed=decrypt.readBytes(fullLen - OutEncoder.VINT_LEN);
    }
  }
 else {
    decompressed=decrypt.readBytes(fullLen);
  }
  try {
    int id=rvint(decompressed);
    Class<? extends Packet> cls=PacketRegistry.byId(this.client.getState(),Packet.Bound.SERVER,id);
    PacketIn packet=PacketRegistry.make(cls);
    LOGGER.debug("String_Node_Str" + packet.getClass().getSimpleName());
    packet.read(decompressed,this.client);
  }
  finally {
    decompressed.release();
    if (decrypt != buf) {
      decrypt.release();
    }
  }
}

Fixed version (ground truth):
@Override protected void decode(ChannelHandlerContext ctx,ByteBuf buf,List<Object> list) throws Exception {
  ByteBuf decrypt=buf;
  NetCrypto crypto=this.client.getCryptoModule();
  if (crypto != null) {
    decrypt=ctx.alloc().buffer();
    crypto.decrypt(buf,decrypt,this.actualReadableBytes());
  }
  int fullLen=rvint(decrypt);
  ByteBuf decompressed;
  if (this.client.doCompression()) {
    int uncompressed=rvint(decrypt);
    if (uncompressed != 0) {
      if (uncompressed < TridentServer.cfg().compressionThresh()) {
        this.client.disconnect("String_Node_Str");
        return;
      }
      decompressed=ctx.alloc().buffer();
      byte[] in=arr(decrypt,fullLen - BigInteger.valueOf(uncompressed).toByteArray().length);
      Inflater inflater=INFLATER.get();
      inflater.setInput(in);
      byte[] buffer=new byte[NetClient.BUFFER_SIZE];
      while (!inflater.finished()) {
        int bytes=inflater.inflate(buffer);
        decompressed.writeBytes(buffer,0,bytes);
      }
      inflater.reset();
    }
 else {
      decompressed=decrypt.readBytes(fullLen - OutEncoder.VINT_LEN);
    }
  }
 else {
    decompressed=decrypt.readBytes(fullLen);
  }
  try {
    int id=rvint(decompressed);
    Class<? extends Packet> cls=PacketRegistry.byId(this.client.getState(),Packet.Bound.SERVER,id);
    PacketIn packet=PacketRegistry.make(cls);
    LOGGER.debug("String_Node_Str" + packet.getClass().getSimpleName());
    packet.read(decompressed,this.client);
  }
  finally {
    decompressed.release();
    if (decrypt != buf) {
      decrypt.release();
    }
  }
}