Program: 192367
Project: 192367
Buggy source:
private ServiceLookupResult retrieveServiceLocked(Intent service,String resolvedType,String callingPackage,int callingPid,int callingUid,int userId,boolean createIfNeeded,boolean callingFromFg,boolean isBindExternal){
  ServiceRecord r=null;
  if (DEBUG_SERVICE)   Slog.v(TAG_SERVICE,"String_Node_Str" + service + "String_Node_Str"+ resolvedType+ "String_Node_Str"+ callingUid);
  userId=mAm.mUserController.handleIncomingUser(callingPid,callingUid,userId,false,ActivityManagerService.ALLOW_NON_FULL_IN_PROFILE,"String_Node_Str",null);
  ServiceMap smap=getServiceMap(userId);
  final ComponentName comp=service.getComponent();
  if (comp != null) {
    r=smap.mServicesByName.get(comp);
  }
  if (r == null && !isBindExternal) {
    Intent.FilterComparison filter=new Intent.FilterComparison(service);
    r=smap.mServicesByIntent.get(filter);
  }
  if (r != null && (r.serviceInfo.flags & ServiceInfo.FLAG_EXTERNAL_SERVICE) != 0 && !callingPackage.equals(r.packageName)) {
    r=null;
  }
  if (r == null) {
    try {
      ResolveInfo rInfo=AppGlobals.getPackageManager().resolveService(service,resolvedType,ActivityManagerService.STOCK_PM_FLAGS | PackageManager.MATCH_DEBUG_TRIAGED_MISSING,userId);
      ServiceInfo sInfo=rInfo != null ? rInfo.serviceInfo : null;
      if (sInfo == null) {
        Slog.w(TAG_SERVICE,"String_Node_Str" + service + "String_Node_Str"+ userId+ "String_Node_Str");
        return null;
      }
      ComponentName name=new ComponentName(sInfo.applicationInfo.packageName,sInfo.name);
      if ((sInfo.flags & ServiceInfo.FLAG_EXTERNAL_SERVICE) != 0) {
        if (isBindExternal) {
          if (!sInfo.exported) {
            throw new SecurityException("String_Node_Str" + name + "String_Node_Str");
          }
          if ((sInfo.flags & ServiceInfo.FLAG_ISOLATED_PROCESS) == 0) {
            throw new SecurityException("String_Node_Str" + name + "String_Node_Str");
          }
          ApplicationInfo aInfo=AppGlobals.getPackageManager().getApplicationInfo(callingPackage,ActivityManagerService.STOCK_PM_FLAGS,userId);
          if (aInfo == null) {
            throw new SecurityException("String_Node_Str" + "String_Node_Str" + callingPackage);
          }
          sInfo=new ServiceInfo(sInfo);
          sInfo.applicationInfo=new ApplicationInfo(sInfo.applicationInfo);
          sInfo.applicationInfo.packageName=aInfo.packageName;
          sInfo.applicationInfo.uid=aInfo.uid;
          name=new ComponentName(aInfo.packageName,name.getClassName());
          service.setComponent(name);
        }
 else {
          throw new SecurityException("String_Node_Str" + name);
        }
      }
 else       if (isBindExternal) {
        throw new SecurityException("String_Node_Str" + name + "String_Node_Str");
      }
      if (userId > 0) {
        if (mAm.isSingleton(sInfo.processName,sInfo.applicationInfo,sInfo.name,sInfo.flags) && mAm.isValidSingletonCall(callingUid,sInfo.applicationInfo.uid)) {
          userId=0;
          smap=getServiceMap(0);
        }
        sInfo=new ServiceInfo(sInfo);
        sInfo.applicationInfo=mAm.getAppInfoForUser(sInfo.applicationInfo,userId);
      }
      r=smap.mServicesByName.get(name);
      if (r == null && createIfNeeded) {
        final long token=Binder.clearCallingIdentity();
        try {
          final int allowed=mAm.checkAllowBackgroundLocked(sInfo.applicationInfo.uid,sInfo.packageName,callingPid);
          if (allowed != ActivityManager.APP_START_MODE_NORMAL) {
            Slog.w(TAG,"String_Node_Str" + service + "String_Node_Str"+ name.flattenToShortString()+ "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ callingPackage);
            return null;
          }
        }
  finally {
          Binder.restoreCallingIdentity(token);
        }
        Intent.FilterComparison filter=new Intent.FilterComparison(service.cloneFilter());
        ServiceRestarter res=new ServiceRestarter();
        BatteryStatsImpl.Uid.Pkg.Serv ss=null;
        BatteryStatsImpl stats=mAm.mBatteryStatsService.getActiveStatistics();
synchronized (stats) {
          ss=stats.getServiceStatsLocked(sInfo.applicationInfo.uid,sInfo.packageName,sInfo.name);
        }
        r=new ServiceRecord(mAm,ss,name,filter,sInfo,callingFromFg,res);
        res.setService(r);
        smap.mServicesByName.put(name,r);
        smap.mServicesByIntent.put(filter,r);
        for (int i=mPendingServices.size() - 1; i >= 0; i--) {
          ServiceRecord pr=mPendingServices.get(i);
          if (pr.serviceInfo.applicationInfo.uid == sInfo.applicationInfo.uid && pr.name.equals(name)) {
            mPendingServices.remove(i);
          }
        }
      }
    }
 catch (    RemoteException ex) {
    }
  }
  if (r != null) {
    if (mAm.checkComponentPermission(r.permission,callingPid,callingUid,r.appInfo.uid,r.exported) != PackageManager.PERMISSION_GRANTED) {
      if (!r.exported) {
        Slog.w(TAG,"String_Node_Str" + r.name + "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ r.appInfo.uid);
        return new ServiceLookupResult(null,"String_Node_Str" + r.appInfo.uid);
      }
      Slog.w(TAG,"String_Node_Str" + r.name + "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ r.permission);
      return new ServiceLookupResult(null,r.permission);
    }
 else     if (r.permission != null && callingPackage != null) {
      final int opCode=AppOpsManager.permissionToOpCode(r.permission);
      if (opCode != AppOpsManager.OP_NONE && mAm.mAppOpsService.noteOperation(opCode,callingUid,callingPackage) != AppOpsManager.MODE_ALLOWED) {
        Slog.w(TAG,"String_Node_Str" + r.name + "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ AppOpsManager.opToName(opCode));
        return null;
      }
    }
    if (!mAm.mIntentFirewall.checkService(r.name,service,callingUid,callingPid,resolvedType,r.appInfo)) {
      return null;
    }
    return new ServiceLookupResult(r,null);
  }
  return null;
}

Fixed version (ground truth):
private ServiceLookupResult retrieveServiceLocked(Intent service,String resolvedType,String callingPackage,int callingPid,int callingUid,int userId,boolean createIfNeeded,boolean callingFromFg,boolean isBindExternal){
  ServiceRecord r=null;
  if (DEBUG_SERVICE)   Slog.v(TAG_SERVICE,"String_Node_Str" + service + "String_Node_Str"+ resolvedType+ "String_Node_Str"+ callingUid);
  userId=mAm.mUserController.handleIncomingUser(callingPid,callingUid,userId,false,ActivityManagerService.ALLOW_NON_FULL_IN_PROFILE,"String_Node_Str",null);
  ServiceMap smap=getServiceMap(userId);
  final ComponentName comp=service.getComponent();
  if (comp != null) {
    r=smap.mServicesByName.get(comp);
  }
  if (r == null && !isBindExternal) {
    Intent.FilterComparison filter=new Intent.FilterComparison(service);
    r=smap.mServicesByIntent.get(filter);
  }
  if (r != null && (r.serviceInfo.flags & ServiceInfo.FLAG_EXTERNAL_SERVICE) != 0 && !callingPackage.equals(r.packageName)) {
    r=null;
  }
  if (r == null) {
    try {
      ResolveInfo rInfo=AppGlobals.getPackageManager().resolveService(service,resolvedType,ActivityManagerService.STOCK_PM_FLAGS | PackageManager.MATCH_DEBUG_TRIAGED_MISSING,userId);
      ServiceInfo sInfo=rInfo != null ? rInfo.serviceInfo : null;
      if (sInfo == null) {
        Slog.w(TAG_SERVICE,"String_Node_Str" + service + "String_Node_Str"+ userId+ "String_Node_Str");
        return null;
      }
      ComponentName name=new ComponentName(sInfo.applicationInfo.packageName,sInfo.name);
      if ((sInfo.flags & ServiceInfo.FLAG_EXTERNAL_SERVICE) != 0) {
        if (isBindExternal) {
          if (!sInfo.exported) {
            throw new SecurityException("String_Node_Str" + name + "String_Node_Str");
          }
          if ((sInfo.flags & ServiceInfo.FLAG_ISOLATED_PROCESS) == 0) {
            throw new SecurityException("String_Node_Str" + name + "String_Node_Str");
          }
          ApplicationInfo aInfo=AppGlobals.getPackageManager().getApplicationInfo(callingPackage,ActivityManagerService.STOCK_PM_FLAGS,userId);
          if (aInfo == null) {
            throw new SecurityException("String_Node_Str" + "String_Node_Str" + callingPackage);
          }
          sInfo=new ServiceInfo(sInfo);
          sInfo.applicationInfo=new ApplicationInfo(sInfo.applicationInfo);
          sInfo.applicationInfo.packageName=aInfo.packageName;
          sInfo.applicationInfo.uid=aInfo.uid;
          name=new ComponentName(aInfo.packageName,name.getClassName());
          service.setComponent(name);
        }
 else {
          throw new SecurityException("String_Node_Str" + name);
        }
      }
 else       if (isBindExternal) {
        throw new SecurityException("String_Node_Str" + name + "String_Node_Str");
      }
      if (userId > 0) {
        if (mAm.isSingleton(sInfo.processName,sInfo.applicationInfo,sInfo.name,sInfo.flags) && mAm.isValidSingletonCall(callingUid,sInfo.applicationInfo.uid)) {
          userId=0;
          smap=getServiceMap(0);
        }
        sInfo=new ServiceInfo(sInfo);
        sInfo.applicationInfo=mAm.getAppInfoForUser(sInfo.applicationInfo,userId);
      }
      r=smap.mServicesByName.get(name);
      if (r == null && createIfNeeded) {
        final long token=Binder.clearCallingIdentity();
        try {
          final int allowed=mAm.checkAllowBackgroundLocked(sInfo.applicationInfo.uid,sInfo.packageName,callingPid,true);
          if (allowed != ActivityManager.APP_START_MODE_NORMAL) {
            Slog.w(TAG,"String_Node_Str" + service + "String_Node_Str"+ name.flattenToShortString()+ "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ callingPackage);
            return null;
          }
        }
  finally {
          Binder.restoreCallingIdentity(token);
        }
        Intent.FilterComparison filter=new Intent.FilterComparison(service.cloneFilter());
        ServiceRestarter res=new ServiceRestarter();
        BatteryStatsImpl.Uid.Pkg.Serv ss=null;
        BatteryStatsImpl stats=mAm.mBatteryStatsService.getActiveStatistics();
synchronized (stats) {
          ss=stats.getServiceStatsLocked(sInfo.applicationInfo.uid,sInfo.packageName,sInfo.name);
        }
        r=new ServiceRecord(mAm,ss,name,filter,sInfo,callingFromFg,res);
        res.setService(r);
        smap.mServicesByName.put(name,r);
        smap.mServicesByIntent.put(filter,r);
        for (int i=mPendingServices.size() - 1; i >= 0; i--) {
          ServiceRecord pr=mPendingServices.get(i);
          if (pr.serviceInfo.applicationInfo.uid == sInfo.applicationInfo.uid && pr.name.equals(name)) {
            mPendingServices.remove(i);
          }
        }
      }
    }
 catch (    RemoteException ex) {
    }
  }
  if (r != null) {
    if (mAm.checkComponentPermission(r.permission,callingPid,callingUid,r.appInfo.uid,r.exported) != PackageManager.PERMISSION_GRANTED) {
      if (!r.exported) {
        Slog.w(TAG,"String_Node_Str" + r.name + "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ r.appInfo.uid);
        return new ServiceLookupResult(null,"String_Node_Str" + r.appInfo.uid);
      }
      Slog.w(TAG,"String_Node_Str" + r.name + "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ r.permission);
      return new ServiceLookupResult(null,r.permission);
    }
 else     if (r.permission != null && callingPackage != null) {
      final int opCode=AppOpsManager.permissionToOpCode(r.permission);
      if (opCode != AppOpsManager.OP_NONE && mAm.mAppOpsService.noteOperation(opCode,callingUid,callingPackage) != AppOpsManager.MODE_ALLOWED) {
        Slog.w(TAG,"String_Node_Str" + r.name + "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ AppOpsManager.opToName(opCode));
        return null;
      }
    }
    if (!mAm.mIntentFirewall.checkService(r.name,service,callingUid,callingPid,resolvedType,r.appInfo)) {
      return null;
    }
    return new ServiceLookupResult(r,null);
  }
  return null;
}