Program: 199608
Project: 199608
Buggy source:
final int startActivityLocked(IApplicationThread caller,Intent intent,String resolvedType,ActivityInfo aInfo,IBinder resultTo,String resultWho,int requestCode,int callingPid,int callingUid,String callingPackage,int startFlags,Bundle options,boolean componentSpecified,ActivityRecord[] outActivity,ActivityContainer container){
  int err=ActivityManager.START_SUCCESS;
  ProcessRecord callerApp=null;
  if (caller != null) {
    callerApp=mService.getRecordForAppLocked(caller);
    if (callerApp != null) {
      callingPid=callerApp.pid;
      callingUid=callerApp.info.uid;
    }
 else {
      Slog.w(TAG,"String_Node_Str" + caller + "String_Node_Str"+ callingPid+ "String_Node_Str"+ intent.toString());
      err=ActivityManager.START_PERMISSION_DENIED;
    }
  }
  if (err == ActivityManager.START_SUCCESS) {
    final int userId=aInfo != null ? UserHandle.getUserId(aInfo.applicationInfo.uid) : 0;
    Slog.i(TAG,"String_Node_Str" + userId + "String_Node_Str"+ intent.toShortString(true,true,true,false)+ "String_Node_Str"+ (callerApp != null ? callerApp.pid : callingPid)+ "String_Node_Str"+ (container == null ? (mFocusedStack == null ? Display.DEFAULT_DISPLAY : mFocusedStack.mDisplayId) : (container.mActivityDisplay == null ? Display.DEFAULT_DISPLAY : container.mActivityDisplay.mDisplayId)));
  }
  ActivityRecord sourceRecord=null;
  ActivityRecord resultRecord=null;
  if (resultTo != null) {
    sourceRecord=isInAnyStackLocked(resultTo);
    if (DEBUG_RESULTS)     Slog.v(TAG,"String_Node_Str" + resultTo + "String_Node_Str"+ sourceRecord);
    if (sourceRecord != null) {
      if (requestCode >= 0 && !sourceRecord.finishing) {
        resultRecord=sourceRecord;
      }
    }
  }
  ActivityStack resultStack=resultRecord == null ? null : resultRecord.task.stack;
  int launchFlags=intent.getFlags();
  if ((launchFlags & Intent.FLAG_ACTIVITY_FORWARD_RESULT) != 0 && sourceRecord != null) {
    if (requestCode >= 0) {
      ActivityOptions.abort(options);
      return ActivityManager.START_FORWARD_AND_REQUEST_CONFLICT;
    }
    resultRecord=sourceRecord.resultTo;
    resultWho=sourceRecord.resultWho;
    requestCode=sourceRecord.requestCode;
    sourceRecord.resultTo=null;
    if (resultRecord != null) {
      resultRecord.removeResultsLocked(sourceRecord,resultWho,requestCode);
    }
  }
  if (err == ActivityManager.START_SUCCESS && intent.getComponent() == null) {
    err=ActivityManager.START_INTENT_NOT_RESOLVED;
  }
  if (err == ActivityManager.START_SUCCESS && aInfo == null) {
    err=ActivityManager.START_CLASS_NOT_FOUND;
  }
  if (err != ActivityManager.START_SUCCESS) {
    if (resultRecord != null) {
      resultStack.sendActivityResultLocked(-1,resultRecord,resultWho,requestCode,Activity.RESULT_CANCELED,null);
    }
    setDismissKeyguard(false);
    ActivityOptions.abort(options);
    return err;
  }
  final int startAnyPerm=mService.checkPermission(START_ANY_ACTIVITY,callingPid,callingUid);
  final int componentPerm=mService.checkComponentPermission(aInfo.permission,callingPid,callingUid,aInfo.applicationInfo.uid,aInfo.exported);
  if (startAnyPerm != PERMISSION_GRANTED && componentPerm != PERMISSION_GRANTED) {
    if (resultRecord != null) {
      resultStack.sendActivityResultLocked(-1,resultRecord,resultWho,requestCode,Activity.RESULT_CANCELED,null);
    }
    setDismissKeyguard(false);
    String msg;
    if (!aInfo.exported) {
      msg="String_Node_Str" + intent.toString() + "String_Node_Str"+ callerApp+ "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ "String_Node_Str"+ aInfo.applicationInfo.uid;
    }
 else {
      msg="String_Node_Str" + intent.toString() + "String_Node_Str"+ callerApp+ "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ "String_Node_Str"+ aInfo.permission;
    }
    Slog.w(TAG,msg);
    throw new SecurityException(msg);
  }
  boolean abort=!mService.mIntentFirewall.checkStartActivity(intent,callingUid,callingPid,resolvedType,aInfo.applicationInfo);
  if (mService.mController != null) {
    try {
      Intent watchIntent=intent.cloneFilter();
      abort|=!mService.mController.activityStarting(watchIntent,aInfo.applicationInfo.packageName);
    }
 catch (    RemoteException e) {
      mService.mController=null;
    }
  }
  if (abort) {
    if (resultRecord != null) {
      resultStack.sendActivityResultLocked(-1,resultRecord,resultWho,requestCode,Activity.RESULT_CANCELED,null);
    }
    setDismissKeyguard(false);
    ActivityOptions.abort(options);
    return ActivityManager.START_SUCCESS;
  }
  ActivityRecord r=new ActivityRecord(mService,callerApp,callingUid,callingPackage,intent,resolvedType,aInfo,mService.mConfiguration,resultRecord,resultWho,requestCode,componentSpecified,this,container);
  if (outActivity != null) {
    outActivity[0]=r;
  }
  final ActivityStack stack=getFocusedStack();
  if (stack.mResumedActivity == null || stack.mResumedActivity.info.applicationInfo.uid != callingUid) {
    if (!mService.checkAppSwitchAllowedLocked(callingPid,callingUid,"String_Node_Str")) {
      PendingActivityLaunch pal=new PendingActivityLaunch(r,sourceRecord,startFlags,stack);
      mService.mPendingActivityLaunches.add(pal);
      setDismissKeyguard(false);
      ActivityOptions.abort(options);
      return ActivityManager.START_SWITCHES_CANCELED;
    }
  }
  if (mService.mDidAppSwitch) {
    mService.mAppSwitchesAllowedTime=0;
  }
 else {
    mService.mDidAppSwitch=true;
  }
  mService.doPendingActivityLaunchesLocked(false);
  err=startActivityUncheckedLocked(r,sourceRecord,startFlags,true,options);
  if (allPausedActivitiesComplete()) {
    dismissKeyguard();
  }
  return err;
}

Fixed version (ground truth):
final int startActivityLocked(IApplicationThread caller,Intent intent,String resolvedType,ActivityInfo aInfo,IBinder resultTo,String resultWho,int requestCode,int callingPid,int callingUid,String callingPackage,int startFlags,Bundle options,boolean componentSpecified,ActivityRecord[] outActivity,ActivityContainer container){
  int err=ActivityManager.START_SUCCESS;
  ProcessRecord callerApp=null;
  if (caller != null) {
    callerApp=mService.getRecordForAppLocked(caller);
    if (callerApp != null) {
      callingPid=callerApp.pid;
      callingUid=callerApp.info.uid;
    }
 else {
      Slog.w(TAG,"String_Node_Str" + caller + "String_Node_Str"+ callingPid+ "String_Node_Str"+ intent.toString());
      err=ActivityManager.START_PERMISSION_DENIED;
    }
  }
  if (err == ActivityManager.START_SUCCESS) {
    final int userId=aInfo != null ? UserHandle.getUserId(aInfo.applicationInfo.uid) : 0;
    Slog.i(TAG,"String_Node_Str" + userId + "String_Node_Str"+ intent.toShortString(true,true,true,false)+ "String_Node_Str"+ (callerApp != null ? callerApp.pid : callingPid)+ "String_Node_Str"+ (container == null ? (mFocusedStack == null ? Display.DEFAULT_DISPLAY : mFocusedStack.mDisplayId) : (container.mActivityDisplay == null ? Display.DEFAULT_DISPLAY : container.mActivityDisplay.mDisplayId)));
  }
  ActivityRecord sourceRecord=null;
  ActivityRecord resultRecord=null;
  if (resultTo != null) {
    sourceRecord=isInAnyStackLocked(resultTo);
    if (DEBUG_RESULTS)     Slog.v(TAG,"String_Node_Str" + resultTo + "String_Node_Str"+ sourceRecord);
    if (sourceRecord != null) {
      if (requestCode >= 0 && !sourceRecord.finishing) {
        resultRecord=sourceRecord;
      }
    }
  }
  ActivityStack resultStack=resultRecord == null ? null : resultRecord.task.stack;
  int launchFlags=intent.getFlags();
  if ((launchFlags & Intent.FLAG_ACTIVITY_FORWARD_RESULT) != 0 && sourceRecord != null) {
    if (requestCode >= 0) {
      ActivityOptions.abort(options);
      return ActivityManager.START_FORWARD_AND_REQUEST_CONFLICT;
    }
    resultRecord=sourceRecord.resultTo;
    resultWho=sourceRecord.resultWho;
    requestCode=sourceRecord.requestCode;
    sourceRecord.resultTo=null;
    if (resultRecord != null) {
      resultRecord.removeResultsLocked(sourceRecord,resultWho,requestCode);
    }
    if (sourceRecord.launchedFromUid == callingUid) {
      callingPackage=sourceRecord.launchedFromPackage;
    }
  }
  if (err == ActivityManager.START_SUCCESS && intent.getComponent() == null) {
    err=ActivityManager.START_INTENT_NOT_RESOLVED;
  }
  if (err == ActivityManager.START_SUCCESS && aInfo == null) {
    err=ActivityManager.START_CLASS_NOT_FOUND;
  }
  if (err != ActivityManager.START_SUCCESS) {
    if (resultRecord != null) {
      resultStack.sendActivityResultLocked(-1,resultRecord,resultWho,requestCode,Activity.RESULT_CANCELED,null);
    }
    setDismissKeyguard(false);
    ActivityOptions.abort(options);
    return err;
  }
  final int startAnyPerm=mService.checkPermission(START_ANY_ACTIVITY,callingPid,callingUid);
  final int componentPerm=mService.checkComponentPermission(aInfo.permission,callingPid,callingUid,aInfo.applicationInfo.uid,aInfo.exported);
  if (startAnyPerm != PERMISSION_GRANTED && componentPerm != PERMISSION_GRANTED) {
    if (resultRecord != null) {
      resultStack.sendActivityResultLocked(-1,resultRecord,resultWho,requestCode,Activity.RESULT_CANCELED,null);
    }
    setDismissKeyguard(false);
    String msg;
    if (!aInfo.exported) {
      msg="String_Node_Str" + intent.toString() + "String_Node_Str"+ callerApp+ "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ "String_Node_Str"+ aInfo.applicationInfo.uid;
    }
 else {
      msg="String_Node_Str" + intent.toString() + "String_Node_Str"+ callerApp+ "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ "String_Node_Str"+ aInfo.permission;
    }
    Slog.w(TAG,msg);
    throw new SecurityException(msg);
  }
  boolean abort=!mService.mIntentFirewall.checkStartActivity(intent,callingUid,callingPid,resolvedType,aInfo.applicationInfo);
  if (mService.mController != null) {
    try {
      Intent watchIntent=intent.cloneFilter();
      abort|=!mService.mController.activityStarting(watchIntent,aInfo.applicationInfo.packageName);
    }
 catch (    RemoteException e) {
      mService.mController=null;
    }
  }
  if (abort) {
    if (resultRecord != null) {
      resultStack.sendActivityResultLocked(-1,resultRecord,resultWho,requestCode,Activity.RESULT_CANCELED,null);
    }
    setDismissKeyguard(false);
    ActivityOptions.abort(options);
    return ActivityManager.START_SUCCESS;
  }
  ActivityRecord r=new ActivityRecord(mService,callerApp,callingUid,callingPackage,intent,resolvedType,aInfo,mService.mConfiguration,resultRecord,resultWho,requestCode,componentSpecified,this,container);
  if (outActivity != null) {
    outActivity[0]=r;
  }
  final ActivityStack stack=getFocusedStack();
  if (stack.mResumedActivity == null || stack.mResumedActivity.info.applicationInfo.uid != callingUid) {
    if (!mService.checkAppSwitchAllowedLocked(callingPid,callingUid,"String_Node_Str")) {
      PendingActivityLaunch pal=new PendingActivityLaunch(r,sourceRecord,startFlags,stack);
      mService.mPendingActivityLaunches.add(pal);
      setDismissKeyguard(false);
      ActivityOptions.abort(options);
      return ActivityManager.START_SWITCHES_CANCELED;
    }
  }
  if (mService.mDidAppSwitch) {
    mService.mAppSwitchesAllowedTime=0;
  }
 else {
    mService.mDidAppSwitch=true;
  }
  mService.doPendingActivityLaunchesLocked(false);
  err=startActivityUncheckedLocked(r,sourceRecord,startFlags,true,options);
  if (allPausedActivitiesComplete()) {
    dismissKeyguard();
  }
  return err;
}