Program: 39074
Project: 39074
Buggy source:
/** 
 * Called by   {@link OpenIdLoginServlet} doGet, doPost 
 */
void doAuth(final HttpServletRequest req,final HttpServletResponse rsp) throws Exception {
  if (false) {
    System.err.println(req.getMethod() + "String_Node_Str");
    for (    final String n : new TreeMap<String,Object>(req.getParameterMap()).keySet()) {
      for (      final String v : req.getParameterValues(n)) {
        System.err.println("String_Node_Str" + n + "String_Node_Str"+ v);
      }
    }
    System.err.println();
  }
  final String openidMode=req.getParameter(OPENID_MODE);
  if (OMODE_CANCEL.equals(openidMode)) {
    cancel(req,rsp);
  }
 else {
    final SignInDialog.Mode mode=signInMode(req);
    final String openidIdentifier=req.getParameter("String_Node_Str");
    final String returnToken=req.getParameter(P_TOKEN);
    final boolean remember="String_Node_Str".equals(req.getParameter(P_REMEMBER));
    final State state;
    state=init(req,openidIdentifier,mode,remember,returnToken);
    if (state == null) {
      cancel(req,rsp);
      return;
    }
    final String returnTo=req.getParameter("String_Node_Str");
    if (returnTo != null && returnTo.contains("String_Node_Str")) {
      state.retTo.put("String_Node_Str",req.getParameter("String_Node_Str"));
      state.retTo.put("String_Node_Str",req.getParameter("String_Node_Str"));
    }
    final VerificationResult result=manager.verify(state.retTo.toString(),new ParameterList(req.getParameterMap()),state.discovered);
    final Identifier user=result.getVerifiedId();
    if (user == null) {
      cancel(req,rsp);
    }
 else {
      final Message authRsp=result.getAuthResponse();
      SRegResponse sregRsp=null;
      FetchResponse fetchRsp=null;
      if (authRsp.hasExtension(SRegMessage.OPENID_NS_SREG)) {
        final MessageExtension ext=authRsp.getExtension(SRegMessage.OPENID_NS_SREG);
        if (ext instanceof SRegResponse) {
          sregRsp=(SRegResponse)ext;
        }
      }
      if (authRsp.hasExtension(AxMessage.OPENID_NS_AX)) {
        final MessageExtension ext=authRsp.getExtension(AxMessage.OPENID_NS_AX);
        if (ext instanceof FetchResponse) {
          fetchRsp=(FetchResponse)ext;
        }
      }
      String fullname=null;
      String email=null;
      if (sregRsp != null) {
        fullname=sregRsp.getAttributeValue("String_Node_Str");
        email=sregRsp.getAttributeValue("String_Node_Str");
      }
 else       if (fetchRsp != null) {
        final String firstName=fetchRsp.getAttributeValue("String_Node_Str");
        final String lastName=fetchRsp.getAttributeValue("String_Node_Str");
        final StringBuilder n=new StringBuilder();
        if (firstName != null && firstName.length() > 0) {
          n.append(firstName);
        }
        if (lastName != null && lastName.length() > 0) {
          if (n.length() > 0) {
            n.append(' ');
          }
          n.append(lastName);
        }
        fullname=n.length() > 0 ? n.toString() : null;
        email=fetchRsp.getAttributeValue("String_Node_Str");
      }
      initializeAccount(req,rsp,user,fullname,email);
    }
  }
}

Fixed version (ground truth):
/** 
 * Called by   {@link OpenIdLoginServlet} doGet, doPost 
 */
void doAuth(final HttpServletRequest req,final HttpServletResponse rsp) throws Exception {
  if (false) {
    debugRequest(req);
  }
  final String openidMode=req.getParameter(OPENID_MODE);
  if (OMODE_CANCEL.equals(openidMode)) {
    cancel(req,rsp);
  }
 else {
    final SignInDialog.Mode mode=signInMode(req);
    final String openidIdentifier=req.getParameter("String_Node_Str");
    final String returnToken=req.getParameter(P_TOKEN);
    final boolean remember="String_Node_Str".equals(req.getParameter(P_REMEMBER));
    final State state;
    state=init(req,openidIdentifier,mode,remember,returnToken);
    if (state == null) {
      cancel(req,rsp);
      return;
    }
    final String returnTo=req.getParameter("String_Node_Str");
    if (returnTo != null && returnTo.contains("String_Node_Str")) {
      state.retTo.put("String_Node_Str",req.getParameter("String_Node_Str"));
      state.retTo.put("String_Node_Str",req.getParameter("String_Node_Str"));
    }
    final VerificationResult result=manager.verify(state.retTo.toString(),new ParameterList(req.getParameterMap()),state.discovered);
    final Identifier user=result.getVerifiedId();
    if (user == null) {
      cancel(req,rsp);
    }
 else {
      final Message authRsp=result.getAuthResponse();
      SRegResponse sregRsp=null;
      FetchResponse fetchRsp=null;
      if (authRsp.hasExtension(SRegMessage.OPENID_NS_SREG)) {
        final MessageExtension ext=authRsp.getExtension(SRegMessage.OPENID_NS_SREG);
        if (ext instanceof SRegResponse) {
          sregRsp=(SRegResponse)ext;
        }
      }
      if (authRsp.hasExtension(AxMessage.OPENID_NS_AX)) {
        final MessageExtension ext=authRsp.getExtension(AxMessage.OPENID_NS_AX);
        if (ext instanceof FetchResponse) {
          fetchRsp=(FetchResponse)ext;
        }
      }
      String fullname=null;
      String email=null;
      if (sregRsp != null) {
        fullname=sregRsp.getAttributeValue("String_Node_Str");
        email=sregRsp.getAttributeValue("String_Node_Str");
      }
 else       if (fetchRsp != null) {
        final String firstName=fetchRsp.getAttributeValue("String_Node_Str");
        final String lastName=fetchRsp.getAttributeValue("String_Node_Str");
        final StringBuilder n=new StringBuilder();
        if (firstName != null && firstName.length() > 0) {
          n.append(firstName);
        }
        if (lastName != null && lastName.length() > 0) {
          if (n.length() > 0) {
            n.append(' ');
          }
          n.append(lastName);
        }
        fullname=n.length() > 0 ? n.toString() : null;
        email=fetchRsp.getAttributeValue("String_Node_Str");
      }
      initializeAccount(req,rsp,user,fullname,email);
    }
  }
}