That will probably already solve your problem. When read(byte) returns 0 that doesn't mean all data is read. It means there's currently no data available. -1 is the only value that indicates that you're done reading.
Also, you can remove this line:
reader.read(buffer) will re-fill the existing array. It's possible (likely even) that one or more reads do not overwrite all old data, but you know that all values from 0 to bytesRead (exclusive) are filled with new data, and this is exactly the portion you then write. In other words, all you're doing is create another array where no new array is necessary.
If this is a JSP, make sure that absolutely no output is sent to the response before you use your code. That includes line breaks outside of JSP directives / tags. Even enters between your import directives will already be sent to the response.