Program: 194140
Project: 194140
Buggy source:
private UserInfo createUserInternal(String name,int flags,int parentId){
  if (getUserRestrictions(UserHandle.getCallingUserId()).getBoolean(UserManager.DISALLOW_ADD_USER,false)) {
    Log.w(LOG_TAG,"String_Node_Str");
    return null;
  }
  if (ActivityManager.isLowRamDeviceStatic()) {
    return null;
  }
  final boolean isGuest=(flags & UserInfo.FLAG_GUEST) != 0;
  final boolean isManagedProfile=(flags & UserInfo.FLAG_MANAGED_PROFILE) != 0;
  final long ident=Binder.clearCallingIdentity();
  UserInfo userInfo=null;
  final int userId;
  try {
synchronized (mInstallLock) {
synchronized (mPackagesLock) {
        UserInfo parent=null;
        if (parentId != UserHandle.USER_NULL) {
          parent=getUserInfoLocked(parentId);
          if (parent == null)           return null;
        }
        if (isManagedProfile && !canAddMoreManagedProfiles()) {
          return null;
        }
        if (!isGuest && !isManagedProfile && isUserLimitReachedLocked()) {
          return null;
        }
        if (isGuest && findCurrentGuestUserLocked() != null) {
          return null;
        }
        if (UserManager.isSplitSystemUser() && !isGuest && !isManagedProfile&& mUsers.size() == 1) {
          flags|=UserInfo.FLAG_PRIMARY;
          if (!mUsers.get(UserHandle.USER_SYSTEM).isAdmin()) {
            flags|=UserInfo.FLAG_ADMIN;
          }
        }
        userId=getNextAvailableIdLocked();
        userInfo=new UserInfo(userId,name,null,flags);
        userInfo.serialNumber=mNextSerialNumber++;
        long now=System.currentTimeMillis();
        userInfo.creationTime=(now > EPOCH_PLUS_30_YEARS) ? now : 0;
        userInfo.partial=true;
        Environment.getUserSystemDirectory(userInfo.id).mkdirs();
        mUsers.put(userId,userInfo);
        writeUserListLocked();
        if (parent != null) {
          if (parent.profileGroupId == UserInfo.NO_PROFILE_GROUP_ID) {
            parent.profileGroupId=parent.id;
            scheduleWriteUserLocked(parent);
          }
          userInfo.profileGroupId=parent.profileGroupId;
        }
        final StorageManager storage=mContext.getSystemService(StorageManager.class);
        for (        VolumeInfo vol : storage.getWritablePrivateVolumes()) {
          final String volumeUuid=vol.getFsUuid();
          try {
            final File userDir=Environment.getDataUserDirectory(volumeUuid,userId);
            prepareUserDirectory(mContext,volumeUuid,userId);
            enforceSerialNumber(userDir,userInfo.serialNumber);
          }
 catch (          IOException e) {
            Log.wtf(LOG_TAG,"String_Node_Str" + volumeUuid,e);
          }
        }
        mPm.createNewUserLILPw(userId);
        userInfo.partial=false;
        scheduleWriteUserLocked(userInfo);
        updateUserIdsLocked();
        Bundle restrictions=new Bundle();
        mUserRestrictions.append(userId,restrictions);
      }
    }
    mPm.newUserCreated(userId);
    if (userInfo != null) {
      Intent addedIntent=new Intent(Intent.ACTION_USER_ADDED);
      addedIntent.putExtra(Intent.EXTRA_USER_HANDLE,userInfo.id);
      mContext.sendBroadcastAsUser(addedIntent,UserHandle.ALL,android.Manifest.permission.MANAGE_USERS);
    }
  }
  finally {
    Binder.restoreCallingIdentity(ident);
  }
  return userInfo;
}

Fixed version (ground truth):
private UserInfo createUserInternal(String name,int flags,int parentId){
  if (getUserRestrictions(UserHandle.getCallingUserId()).getBoolean(UserManager.DISALLOW_ADD_USER,false)) {
    Log.w(LOG_TAG,"String_Node_Str");
    return null;
  }
  if (ActivityManager.isLowRamDeviceStatic()) {
    return null;
  }
  final boolean isGuest=(flags & UserInfo.FLAG_GUEST) != 0;
  final boolean isManagedProfile=(flags & UserInfo.FLAG_MANAGED_PROFILE) != 0;
  final long ident=Binder.clearCallingIdentity();
  UserInfo userInfo=null;
  final int userId;
  try {
synchronized (mInstallLock) {
synchronized (mPackagesLock) {
        UserInfo parent=null;
        if (parentId != UserHandle.USER_NULL) {
          parent=getUserInfoLocked(parentId);
          if (parent == null)           return null;
        }
        if (isManagedProfile && !canAddMoreManagedProfiles()) {
          return null;
        }
        if (!isGuest && !isManagedProfile && isUserLimitReachedLocked()) {
          return null;
        }
        if (isGuest && findCurrentGuestUserLocked() != null) {
          return null;
        }
        if (UserManager.isSplitSystemUser() && !isGuest && !isManagedProfile&& getPrimaryUser() == null) {
          flags|=UserInfo.FLAG_PRIMARY;
          DevicePolicyManager devicePolicyManager=(DevicePolicyManager)mContext.getSystemService(Context.DEVICE_POLICY_SERVICE);
          if (devicePolicyManager == null || devicePolicyManager.getDeviceOwner() == null) {
            flags|=UserInfo.FLAG_ADMIN;
          }
        }
        userId=getNextAvailableIdLocked();
        userInfo=new UserInfo(userId,name,null,flags);
        userInfo.serialNumber=mNextSerialNumber++;
        long now=System.currentTimeMillis();
        userInfo.creationTime=(now > EPOCH_PLUS_30_YEARS) ? now : 0;
        userInfo.partial=true;
        Environment.getUserSystemDirectory(userInfo.id).mkdirs();
        mUsers.put(userId,userInfo);
        writeUserListLocked();
        if (parent != null) {
          if (parent.profileGroupId == UserInfo.NO_PROFILE_GROUP_ID) {
            parent.profileGroupId=parent.id;
            scheduleWriteUserLocked(parent);
          }
          userInfo.profileGroupId=parent.profileGroupId;
        }
        final StorageManager storage=mContext.getSystemService(StorageManager.class);
        for (        VolumeInfo vol : storage.getWritablePrivateVolumes()) {
          final String volumeUuid=vol.getFsUuid();
          try {
            final File userDir=Environment.getDataUserDirectory(volumeUuid,userId);
            prepareUserDirectory(mContext,volumeUuid,userId);
            enforceSerialNumber(userDir,userInfo.serialNumber);
          }
 catch (          IOException e) {
            Log.wtf(LOG_TAG,"String_Node_Str" + volumeUuid,e);
          }
        }
        mPm.createNewUserLILPw(userId);
        userInfo.partial=false;
        scheduleWriteUserLocked(userInfo);
        updateUserIdsLocked();
        Bundle restrictions=new Bundle();
        mUserRestrictions.append(userId,restrictions);
      }
    }
    mPm.newUserCreated(userId);
    if (userInfo != null) {
      Intent addedIntent=new Intent(Intent.ACTION_USER_ADDED);
      addedIntent.putExtra(Intent.EXTRA_USER_HANDLE,userInfo.id);
      mContext.sendBroadcastAsUser(addedIntent,UserHandle.ALL,android.Manifest.permission.MANAGE_USERS);
    }
  }
  finally {
    Binder.restoreCallingIdentity(ident);
  }
  return userInfo;
}