File: src/java/org/apache/commons/lang/BooleanUtils.java
Issue: BooleanUtils.toBoolean() - invalid drop-thru in case statement causes StringIndexOutOfBoundsException
The method BooleanUtils.toBoolean() has a case statement; case 3 drops through to case 4; this can cause StringIndexOutOfBoundsException, for example with the test:
assertEquals(false, BooleanUtils.toBoolean("tru"));
The end of case 3 should return false.
Patch to follow for source and unit test.

Buggy code:
public static boolean toBoolean(String str) {
    // Previously used equalsIgnoreCase, which was fast for interned 'true'.
    // Non interned 'true' matched 15 times slower.
    // 
    // Optimisation provides same performance as before for interned 'true'.
    // Similar performance for null, 'false', and other strings not length 2/3/4.
    // 'true'/'TRUE' match 4 times slower, 'tRUE'/'True' 7 times slower.
    if (str == "true") {
        return true;
    }
    if (str == null) {
        return false;
    }
    switch (str.length()) {
        case 2: {
            char ch0 = str.charAt(0);
            char ch1 = str.charAt(1);
            return 
                (ch0 == 'o' || ch0 == 'O') &&
                (ch1 == 'n' || ch1 == 'N');
        }
        case 3: {
            char ch = str.charAt(0);
            if (ch == 'y') {
                return 
                    (str.charAt(1) == 'e' || str.charAt(1) == 'E') &&
                    (str.charAt(2) == 's' || str.charAt(2) == 'S');
            }
            if (ch == 'Y') {
                return 
                    (str.charAt(1) == 'E' || str.charAt(1) == 'e') &&
                    (str.charAt(2) == 'S' || str.charAt(2) == 's');
            }
        }
        case 4: {
            char ch = str.charAt(0);
            if (ch == 't') {
                return 
                    (str.charAt(1) == 'r' || str.charAt(1) == 'R') &&
                    (str.charAt(2) == 'u' || str.charAt(2) == 'U') &&
                    (str.charAt(3) == 'e' || str.charAt(3) == 'E');
            }
            if (ch == 'T') {
                return 
                    (str.charAt(1) == 'R' || str.charAt(1) == 'r') &&
                    (str.charAt(2) == 'U' || str.charAt(2) == 'u') &&
                    (str.charAt(3) == 'E' || str.charAt(3) == 'e');
            }
        }
    }
    return false;
}

Fixed code:
public static boolean toBoolean(String str) {
    // Previously used equalsIgnoreCase, which was fast for interned 'true'.
    // Non interned 'true' matched 15 times slower.
    // 
    // Optimisation provides same performance as before for interned 'true'.
    // Similar performance for null, 'false', and other strings not length 2/3/4.
    // 'true'/'TRUE' match 4 times slower, 'tRUE'/'True' 7 times slower.
    if (str == "true") {
        return true;
    }
    if (str == null) {
        return false;
    }
    switch (str.length()) {
        case 2: {
            char ch0 = str.charAt(0);
            char ch1 = str.charAt(1);
            return 
                (ch0 == 'o' || ch0 == 'O') &&
                (ch1 == 'n' || ch1 == 'N');
        }
        case 3: {
            char ch = str.charAt(0);
            if (ch == 'y') {
                return 
                    (str.charAt(1) == 'e' || str.charAt(1) == 'E') &&
                    (str.charAt(2) == 's' || str.charAt(2) == 'S');
            }
            if (ch == 'Y') {
                return 
                    (str.charAt(1) == 'E' || str.charAt(1) == 'e') &&
                    (str.charAt(2) == 'S' || str.charAt(2) == 's');
            }
            return false;
        }
        case 4: {
            char ch = str.charAt(0);
            if (ch == 't') {
                return 
                    (str.charAt(1) == 'r' || str.charAt(1) == 'R') &&
                    (str.charAt(2) == 'u' || str.charAt(2) == 'U') &&
                    (str.charAt(3) == 'e' || str.charAt(3) == 'E');
            }
            if (ch == 'T') {
                return 
                    (str.charAt(1) == 'R' || str.charAt(1) == 'r') &&
                    (str.charAt(2) == 'U' || str.charAt(2) == 'u') &&
                    (str.charAt(3) == 'E' || str.charAt(3) == 'e');
            }
        }
    }
    return false;
}