Program: 43663
Project: 43663
Buggy source:
private final int broadcastIntentLocked(ProcessRecord callerApp,String callerPackage,Intent intent,String resolvedType,IIntentReceiver resultTo,int resultCode,String resultData,Bundle map,String requiredPermission,boolean ordered,boolean sticky,int callingPid,int callingUid){
  intent=new Intent(intent);
  if (DEBUG_BROADCAST)   Log.v(TAG,(sticky ? "String_Node_Str" : "String_Node_Str") + intent + "String_Node_Str"+ ordered);
  if ((resultTo != null) && !ordered) {
    Log.w(TAG,"String_Node_Str" + intent + "String_Node_Str");
  }
  final boolean uidRemoved=intent.ACTION_UID_REMOVED.equals(intent.getAction());
  if (intent.ACTION_PACKAGE_REMOVED.equals(intent.getAction()) || intent.ACTION_PACKAGE_CHANGED.equals(intent.getAction()) || uidRemoved) {
    if (checkComponentPermission(android.Manifest.permission.BROADCAST_PACKAGE_REMOVED,callingPid,callingUid,-1) == PackageManager.PERMISSION_GRANTED) {
      if (uidRemoved) {
        final Bundle intentExtras=intent.getExtras();
        final int uid=intentExtras != null ? intentExtras.getInt(Intent.EXTRA_UID) : -1;
        if (uid >= 0) {
          BatteryStatsImpl bs=mBatteryStatsService.getActiveStatistics();
synchronized (bs) {
            bs.removeUidStatsLocked(uid);
          }
        }
      }
 else {
        Uri data=intent.getData();
        String ssp;
        if (data != null && (ssp=data.getSchemeSpecificPart()) != null) {
          if (!intent.getBooleanExtra(Intent.EXTRA_DONT_KILL_APP,false)) {
            uninstallPackageLocked(ssp,intent.getIntExtra(Intent.EXTRA_UID,-1),false);
          }
        }
      }
    }
 else {
      String msg="String_Node_Str" + intent.getAction() + "String_Node_Str"+ callerPackage+ "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ "String_Node_Str"+ android.Manifest.permission.BROADCAST_PACKAGE_REMOVED;
      Log.w(TAG,msg);
      throw new SecurityException(msg);
    }
  }
  if (intent.ACTION_TIMEZONE_CHANGED.equals(intent.getAction())) {
    mHandler.sendEmptyMessage(UPDATE_TIME_ZONE);
  }
  if (sticky) {
    if (checkPermission(android.Manifest.permission.BROADCAST_STICKY,callingPid,callingUid) != PackageManager.PERMISSION_GRANTED) {
      String msg="String_Node_Str" + callingPid + "String_Node_Str"+ callingUid+ "String_Node_Str"+ android.Manifest.permission.BROADCAST_STICKY;
      Log.w(TAG,msg);
      throw new SecurityException(msg);
    }
    if (requiredPermission != null) {
      Log.w(TAG,"String_Node_Str" + intent + "String_Node_Str"+ requiredPermission);
      return BROADCAST_STICKY_CANT_HAVE_PERMISSION;
    }
    if (intent.getComponent() != null) {
      throw new SecurityException("String_Node_Str");
    }
    ArrayList<Intent> list=mStickyBroadcasts.get(intent.getAction());
    if (list == null) {
      list=new ArrayList<Intent>();
      mStickyBroadcasts.put(intent.getAction(),list);
    }
    int N=list.size();
    int i;
    for (i=0; i < N; i++) {
      if (intent.filterEquals(list.get(i))) {
        list.set(i,new Intent(intent));
        break;
      }
    }
    if (i >= N) {
      list.add(new Intent(intent));
    }
  }
  final ContentResolver resolver=mContext.getContentResolver();
  List receivers=null;
  List<BroadcastFilter> registeredReceivers=null;
  try {
    if (intent.getComponent() != null) {
      ActivityInfo ai=ActivityThread.getPackageManager().getReceiverInfo(intent.getComponent(),0);
      if (ai != null) {
        receivers=new ArrayList();
        ResolveInfo ri=new ResolveInfo();
        ri.activityInfo=ai;
        receivers.add(ri);
      }
    }
 else {
      if ((intent.getFlags() & Intent.FLAG_RECEIVER_REGISTERED_ONLY) == 0) {
        receivers=ActivityThread.getPackageManager().queryIntentReceivers(intent,resolvedType,PackageManager.GET_SHARED_LIBRARY_FILES);
      }
      registeredReceivers=mReceiverResolver.queryIntent(resolver,intent,resolvedType,false);
    }
  }
 catch (  RemoteException ex) {
  }
  int NR=registeredReceivers != null ? registeredReceivers.size() : 0;
  if (!ordered && NR > 0) {
    BroadcastRecord r=new BroadcastRecord(intent,callerApp,callerPackage,callingPid,callingUid,requiredPermission,registeredReceivers,resultTo,resultCode,resultData,map,ordered);
    if (DEBUG_BROADCAST)     Log.v(TAG,"String_Node_Str" + r + "String_Node_Str"+ mParallelBroadcasts.size());
    mParallelBroadcasts.add(r);
    scheduleBroadcastsLocked();
    registeredReceivers=null;
    NR=0;
  }
  int ir=0;
  if (receivers != null) {
    boolean skip=false;
    if (intent.ACTION_PACKAGE_ADDED.equals(intent.getAction())) {
      skip=true;
    }
 else     if (intent.ACTION_PACKAGE_RESTARTED.equals(intent.getAction())) {
      skip=true;
    }
 else     if (intent.ACTION_PACKAGE_DATA_CLEARED.equals(intent.getAction())) {
      skip=true;
    }
    String skipPackage=(skip && intent.getData() != null) ? intent.getData().getSchemeSpecificPart() : null;
    if (skipPackage != null && receivers != null) {
      int NT=receivers.size();
      for (int it=0; it < NT; it++) {
        ResolveInfo curt=(ResolveInfo)receivers.get(it);
        if (curt.activityInfo.packageName.equals(skipPackage)) {
          receivers.remove(it);
          it--;
          NT--;
        }
      }
    }
    int NT=receivers != null ? receivers.size() : 0;
    int it=0;
    ResolveInfo curt=null;
    BroadcastFilter curr=null;
    while (it < NT && ir < NR) {
      if (curt == null) {
        curt=(ResolveInfo)receivers.get(it);
      }
      if (curr == null) {
        curr=registeredReceivers.get(ir);
      }
      if (curr.getPriority() >= curt.priority) {
        receivers.add(it,curr);
        ir++;
        curr=null;
        it++;
        NT++;
      }
 else {
        it++;
        curt=null;
      }
    }
  }
  while (ir < NR) {
    if (receivers == null) {
      receivers=new ArrayList();
    }
    receivers.add(registeredReceivers.get(ir));
    ir++;
  }
  if ((receivers != null && receivers.size() > 0) || resultTo != null) {
    BroadcastRecord r=new BroadcastRecord(intent,callerApp,callerPackage,callingPid,callingUid,requiredPermission,receivers,resultTo,resultCode,resultData,map,ordered);
    if (DEBUG_BROADCAST)     Log.v(TAG,"String_Node_Str" + r + "String_Node_Str"+ mOrderedBroadcasts.size());
    if (DEBUG_BROADCAST) {
      int seq=r.intent.getIntExtra("String_Node_Str",-1);
      Log.i(TAG,"String_Node_Str" + r.intent.getAction() + "String_Node_Str"+ seq);
    }
    mOrderedBroadcasts.add(r);
    scheduleBroadcastsLocked();
  }
  return BROADCAST_SUCCESS;
}

Fixed version (ground truth):
private final int broadcastIntentLocked(ProcessRecord callerApp,String callerPackage,Intent intent,String resolvedType,IIntentReceiver resultTo,int resultCode,String resultData,Bundle map,String requiredPermission,boolean ordered,boolean sticky,int callingPid,int callingUid){
  intent=new Intent(intent);
  if (DEBUG_BROADCAST)   Log.v(TAG,(sticky ? "String_Node_Str" : "String_Node_Str") + intent + "String_Node_Str"+ ordered);
  if ((resultTo != null) && !ordered) {
    Log.w(TAG,"String_Node_Str" + intent + "String_Node_Str");
  }
  final boolean uidRemoved=intent.ACTION_UID_REMOVED.equals(intent.getAction());
  if (intent.ACTION_PACKAGE_REMOVED.equals(intent.getAction()) || intent.ACTION_PACKAGE_CHANGED.equals(intent.getAction()) || uidRemoved) {
    if (checkComponentPermission(android.Manifest.permission.BROADCAST_PACKAGE_REMOVED,callingPid,callingUid,-1) == PackageManager.PERMISSION_GRANTED) {
      if (uidRemoved) {
        final Bundle intentExtras=intent.getExtras();
        final int uid=intentExtras != null ? intentExtras.getInt(Intent.EXTRA_UID) : -1;
        if (uid >= 0) {
          BatteryStatsImpl bs=mBatteryStatsService.getActiveStatistics();
synchronized (bs) {
            bs.removeUidStatsLocked(uid);
          }
        }
      }
 else {
        Uri data=intent.getData();
        String ssp;
        if (data != null && (ssp=data.getSchemeSpecificPart()) != null) {
          if (!intent.getBooleanExtra(Intent.EXTRA_DONT_KILL_APP,false)) {
            uninstallPackageLocked(ssp,intent.getIntExtra(Intent.EXTRA_UID,-1),false);
          }
        }
      }
    }
 else {
      String msg="String_Node_Str" + intent.getAction() + "String_Node_Str"+ callerPackage+ "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ "String_Node_Str"+ android.Manifest.permission.BROADCAST_PACKAGE_REMOVED;
      Log.w(TAG,msg);
      throw new SecurityException(msg);
    }
  }
  if (intent.ACTION_TIMEZONE_CHANGED.equals(intent.getAction())) {
    mHandler.sendEmptyMessage(UPDATE_TIME_ZONE);
  }
  if (sticky) {
    if (checkPermission(android.Manifest.permission.BROADCAST_STICKY,callingPid,callingUid) != PackageManager.PERMISSION_GRANTED) {
      String msg="String_Node_Str" + callingPid + "String_Node_Str"+ callingUid+ "String_Node_Str"+ android.Manifest.permission.BROADCAST_STICKY;
      Log.w(TAG,msg);
      throw new SecurityException(msg);
    }
    if (requiredPermission != null) {
      Log.w(TAG,"String_Node_Str" + intent + "String_Node_Str"+ requiredPermission);
      return BROADCAST_STICKY_CANT_HAVE_PERMISSION;
    }
    if (intent.getComponent() != null) {
      throw new SecurityException("String_Node_Str");
    }
    ArrayList<Intent> list=mStickyBroadcasts.get(intent.getAction());
    if (list == null) {
      list=new ArrayList<Intent>();
      mStickyBroadcasts.put(intent.getAction(),list);
    }
    int N=list.size();
    int i;
    for (i=0; i < N; i++) {
      if (intent.filterEquals(list.get(i))) {
        list.set(i,new Intent(intent));
        break;
      }
    }
    if (i >= N) {
      list.add(new Intent(intent));
    }
  }
  final ContentResolver resolver=mContext.getContentResolver();
  List receivers=null;
  List<BroadcastFilter> registeredReceivers=null;
  try {
    if (intent.getComponent() != null) {
      ActivityInfo ai=ActivityThread.getPackageManager().getReceiverInfo(intent.getComponent(),STOCK_PM_FLAGS);
      if (ai != null) {
        receivers=new ArrayList();
        ResolveInfo ri=new ResolveInfo();
        ri.activityInfo=ai;
        receivers.add(ri);
      }
    }
 else {
      if ((intent.getFlags() & Intent.FLAG_RECEIVER_REGISTERED_ONLY) == 0) {
        receivers=ActivityThread.getPackageManager().queryIntentReceivers(intent,resolvedType,STOCK_PM_FLAGS);
      }
      registeredReceivers=mReceiverResolver.queryIntent(resolver,intent,resolvedType,false);
    }
  }
 catch (  RemoteException ex) {
  }
  int NR=registeredReceivers != null ? registeredReceivers.size() : 0;
  if (!ordered && NR > 0) {
    BroadcastRecord r=new BroadcastRecord(intent,callerApp,callerPackage,callingPid,callingUid,requiredPermission,registeredReceivers,resultTo,resultCode,resultData,map,ordered);
    if (DEBUG_BROADCAST)     Log.v(TAG,"String_Node_Str" + r + "String_Node_Str"+ mParallelBroadcasts.size());
    mParallelBroadcasts.add(r);
    scheduleBroadcastsLocked();
    registeredReceivers=null;
    NR=0;
  }
  int ir=0;
  if (receivers != null) {
    boolean skip=false;
    if (intent.ACTION_PACKAGE_ADDED.equals(intent.getAction())) {
      skip=true;
    }
 else     if (intent.ACTION_PACKAGE_RESTARTED.equals(intent.getAction())) {
      skip=true;
    }
 else     if (intent.ACTION_PACKAGE_DATA_CLEARED.equals(intent.getAction())) {
      skip=true;
    }
    String skipPackage=(skip && intent.getData() != null) ? intent.getData().getSchemeSpecificPart() : null;
    if (skipPackage != null && receivers != null) {
      int NT=receivers.size();
      for (int it=0; it < NT; it++) {
        ResolveInfo curt=(ResolveInfo)receivers.get(it);
        if (curt.activityInfo.packageName.equals(skipPackage)) {
          receivers.remove(it);
          it--;
          NT--;
        }
      }
    }
    int NT=receivers != null ? receivers.size() : 0;
    int it=0;
    ResolveInfo curt=null;
    BroadcastFilter curr=null;
    while (it < NT && ir < NR) {
      if (curt == null) {
        curt=(ResolveInfo)receivers.get(it);
      }
      if (curr == null) {
        curr=registeredReceivers.get(ir);
      }
      if (curr.getPriority() >= curt.priority) {
        receivers.add(it,curr);
        ir++;
        curr=null;
        it++;
        NT++;
      }
 else {
        it++;
        curt=null;
      }
    }
  }
  while (ir < NR) {
    if (receivers == null) {
      receivers=new ArrayList();
    }
    receivers.add(registeredReceivers.get(ir));
    ir++;
  }
  if ((receivers != null && receivers.size() > 0) || resultTo != null) {
    BroadcastRecord r=new BroadcastRecord(intent,callerApp,callerPackage,callingPid,callingUid,requiredPermission,receivers,resultTo,resultCode,resultData,map,ordered);
    if (DEBUG_BROADCAST)     Log.v(TAG,"String_Node_Str" + r + "String_Node_Str"+ mOrderedBroadcasts.size());
    if (DEBUG_BROADCAST) {
      int seq=r.intent.getIntExtra("String_Node_Str",-1);
      Log.i(TAG,"String_Node_Str" + r.intent.getAction() + "String_Node_Str"+ seq);
    }
    mOrderedBroadcasts.add(r);
    scheduleBroadcastsLocked();
  }
  return BROADCAST_SUCCESS;
}