This bug was found by St.Petersburg Java SQE team (by Stanislav Avzan).

The Java Language specification (Version 1.0 - August 1, 1996) describes String
buffer of java.io.StringBufferInputStream in manner of array of bytes.

Chapter 22.7 of this Specification (java.io.StringBufferInputStream) is
slightly modified chapter 22.8 (java.io.ByteArrayInputStream).
So all referenses to elements of buffer appear as "buffer[i]".
"buffer.charAt(i)" would be more correct.

Because of all mentioned above another error appears:
Specification says (see item 22.7.6):
"22.7.6 public int read(byte[] b, int off, int len)
        throws NullPointerException, IndexOutOfBoundsException

If pos equals count, then -1 is returned to indicate end of file. Otherwise,
the number k of bytes read is equal to the smaller of len and count-pos. If
k is positive, then bytes buffer[pos] through buffer[pos+k-1] are
copied into b[off] through b[off+k-1] in the manner performed by
System.arraycopy (20.18.16). The value k is added into pos and k is
returned."

System.arraycopy, however, works with arrays of the same type.
And String is array of characters, not bytes.
What was right for ByteArrayInputStream, is wrong for StringBufferInputStream.