Program: 8329
Project: 8329
Buggy source:
/** 
 * This method does the actual modifications in a keyring just like internal, except it supports only the subset of operations which require no passphrase, and will error otherwise.
 */
private PgpEditKeyResult internalRestricted(PGPSecretKeyRing sKR,SaveKeyringParcel saveParcel,OperationLog log){
  int indent=1;
  progress(R.string.progress_modify,0);
  if (!saveParcel.isRestrictedOnly()) {
    log.add(LogType.MSG_MF_ERROR_RESTRICTED,indent);
    return new PgpEditKeyResult(PgpEditKeyResult.RESULT_ERROR,log,null);
  }
  if (checkCancelled()) {
    log.add(LogType.MSG_OPERATION_CANCELLED,indent);
    return new PgpEditKeyResult(PgpEditKeyResult.RESULT_CANCELLED,log,null);
  }
  subProgressPush(50,60);
  for (int i=0; i < saveParcel.mChangeSubKeys.size(); i++) {
    progress(R.string.progress_modify_subkeychange,(i - 1) * (100 / saveParcel.mChangeSubKeys.size()));
    SaveKeyringParcel.SubkeyChange change=saveParcel.mChangeSubKeys.get(i);
    log.add(LogType.MSG_MF_SUBKEY_CHANGE,indent,KeyFormattingUtils.convertKeyIdToHex(change.mKeyId));
    PGPSecretKey sKey=sKR.getSecretKey(change.mKeyId);
    if (sKey == null) {
      log.add(LogType.MSG_MF_ERROR_SUBKEY_MISSING,indent + 1,KeyFormattingUtils.convertKeyIdToHex(change.mKeyId));
      return new PgpEditKeyResult(PgpEditKeyResult.RESULT_ERROR,log,null);
    }
    if (change.mDummyStrip || change.mDummyDivert != null) {
      if (change.mDummyStrip) {
        sKey=PGPSecretKey.constructGnuDummyKey(sKey.getPublicKey());
      }
 else {
        if (change.mDummyDivert.length != 16) {
          log.add(LogType.MSG_MF_ERROR_DIVERT_SERIAL,indent + 1,KeyFormattingUtils.convertKeyIdToHex(change.mKeyId));
          return new PgpEditKeyResult(PgpEditKeyResult.RESULT_ERROR,log,null);
        }
        log.add(LogType.MSG_MF_KEYTOCARD_FINISH,indent + 1,KeyFormattingUtils.convertKeyIdToHex(change.mKeyId),Hex.toHexString(change.mDummyDivert,8,6));
        sKey=PGPSecretKey.constructGnuDummyKey(sKey.getPublicKey(),change.mDummyDivert);
      }
      sKR=PGPSecretKeyRing.insertSecretKey(sKR,sKey);
    }
  }
  progress(R.string.progress_done,100);
  log.add(LogType.MSG_MF_SUCCESS,indent);
  return new PgpEditKeyResult(OperationResult.RESULT_OK,log,new UncachedKeyRing(sKR));
}

Fixed version (ground truth):
/** 
 * This method does the actual modifications in a keyring just like internal, except it supports only the subset of operations which require no passphrase, and will error otherwise.
 */
private PgpEditKeyResult internalRestricted(PGPSecretKeyRing sKR,SaveKeyringParcel saveParcel,OperationLog log,int indent){
  progress(R.string.progress_modify,0);
  if (!saveParcel.isRestrictedOnly()) {
    log.add(LogType.MSG_MF_ERROR_RESTRICTED,indent);
    return new PgpEditKeyResult(PgpEditKeyResult.RESULT_ERROR,log,null);
  }
  if (checkCancelled()) {
    log.add(LogType.MSG_OPERATION_CANCELLED,indent);
    return new PgpEditKeyResult(PgpEditKeyResult.RESULT_CANCELLED,log,null);
  }
  subProgressPush(50,60);
  for (int i=0; i < saveParcel.mChangeSubKeys.size(); i++) {
    progress(R.string.progress_modify_subkeychange,(i - 1) * (100 / saveParcel.mChangeSubKeys.size()));
    SaveKeyringParcel.SubkeyChange change=saveParcel.mChangeSubKeys.get(i);
    log.add(LogType.MSG_MF_SUBKEY_CHANGE,indent,KeyFormattingUtils.convertKeyIdToHex(change.mKeyId));
    PGPSecretKey sKey=sKR.getSecretKey(change.mKeyId);
    if (sKey == null) {
      log.add(LogType.MSG_MF_ERROR_SUBKEY_MISSING,indent + 1,KeyFormattingUtils.convertKeyIdToHex(change.mKeyId));
      return new PgpEditKeyResult(PgpEditKeyResult.RESULT_ERROR,log,null);
    }
    if (change.mDummyStrip || change.mDummyDivert != null) {
      if (change.mDummyStrip) {
        sKey=PGPSecretKey.constructGnuDummyKey(sKey.getPublicKey());
      }
 else {
        if (change.mDummyDivert.length != 16) {
          log.add(LogType.MSG_MF_ERROR_DIVERT_SERIAL,indent + 1,KeyFormattingUtils.convertKeyIdToHex(change.mKeyId));
          return new PgpEditKeyResult(PgpEditKeyResult.RESULT_ERROR,log,null);
        }
        log.add(LogType.MSG_MF_KEYTOCARD_FINISH,indent + 1,KeyFormattingUtils.convertKeyIdToHex(change.mKeyId),Hex.toHexString(change.mDummyDivert,8,6));
        sKey=PGPSecretKey.constructGnuDummyKey(sKey.getPublicKey(),change.mDummyDivert);
      }
      sKR=PGPSecretKeyRing.insertSecretKey(sKR,sKey);
    }
  }
  progress(R.string.progress_done,100);
  log.add(LogType.MSG_MF_SUCCESS,indent);
  return new PgpEditKeyResult(OperationResult.RESULT_OK,log,new UncachedKeyRing(sKR));
}