Program: 191224
Project: 191224
Buggy source:
int bindServiceLocked(IApplicationThread caller,IBinder token,Intent service,String resolvedType,final IServiceConnection connection,int flags,String callingPackage,final int userId) throws TransactionTooLargeException {
  if (DEBUG_SERVICE)   Slog.v(TAG_SERVICE,"String_Node_Str" + service + "String_Node_Str"+ resolvedType+ "String_Node_Str"+ connection.asBinder()+ "String_Node_Str"+ Integer.toHexString(flags));
  final ProcessRecord callerApp=mAm.getRecordForAppLocked(caller);
  if (callerApp == null) {
    throw new SecurityException("String_Node_Str" + caller + "String_Node_Str"+ Binder.getCallingPid()+ "String_Node_Str"+ service);
  }
  ActivityRecord activity=null;
  if (token != null) {
    activity=ActivityRecord.isInStackLocked(token);
    if (activity == null) {
      Slog.w(TAG,"String_Node_Str" + token);
      return 0;
    }
  }
  int clientLabel=0;
  PendingIntent clientIntent=null;
  final boolean isCallerSystem=callerApp.info.uid == Process.SYSTEM_UID;
  if (isCallerSystem) {
    service.setDefusable(true);
    clientIntent=service.getParcelableExtra(Intent.EXTRA_CLIENT_INTENT);
    if (clientIntent != null) {
      clientLabel=service.getIntExtra(Intent.EXTRA_CLIENT_LABEL,0);
      if (clientLabel != 0) {
        service=service.cloneFilter();
      }
    }
  }
  if ((flags & Context.BIND_TREAT_LIKE_ACTIVITY) != 0) {
    mAm.enforceCallingPermission(android.Manifest.permission.MANAGE_ACTIVITY_STACKS,"String_Node_Str");
  }
  if ((flags & Context.BIND_ALLOW_WHITELIST_MANAGEMENT) != 0 && !isCallerSystem) {
    throw new SecurityException("String_Node_Str" + caller + "String_Node_Str"+ Binder.getCallingPid()+ "String_Node_Str"+ service);
  }
  final boolean callerFg=callerApp.setSchedGroup != ProcessList.SCHED_GROUP_BACKGROUND;
  final boolean isBindExternal=(flags & Context.BIND_EXTERNAL_SERVICE) != 0;
  ServiceLookupResult res=retrieveServiceLocked(service,resolvedType,callingPackage,Binder.getCallingPid(),Binder.getCallingUid(),userId,true,callerFg,isBindExternal);
  if (res == null) {
    return 0;
  }
  if (res.record == null) {
    return -1;
  }
  ServiceRecord s=res.record;
  boolean permissionsReviewRequired=false;
  if (Build.PERMISSIONS_REVIEW_REQUIRED) {
    if (mAm.getPackageManagerInternalLocked().isPermissionsReviewRequired(s.packageName,s.userId)) {
      permissionsReviewRequired=true;
      if (!callerFg) {
        Slog.w(TAG,"String_Node_Str" + s.userId + "String_Node_Str"+ s.packageName+ "String_Node_Str");
        return 0;
      }
      final ServiceRecord serviceRecord=s;
      final Intent serviceIntent=service;
      RemoteCallback callback=new RemoteCallback(new RemoteCallback.OnResultListener(){
        @Override public void onResult(        Bundle result){
synchronized (mAm) {
            final long identity=Binder.clearCallingIdentity();
            try {
              if (!mPendingServices.contains(serviceRecord)) {
                return;
              }
              if (!mAm.getPackageManagerInternalLocked().isPermissionsReviewRequired(serviceRecord.packageName,serviceRecord.userId)) {
                try {
                  bringUpServiceLocked(serviceRecord,serviceIntent.getFlags(),callerFg,false,false);
                }
 catch (                RemoteException e) {
                }
              }
 else {
                unbindServiceLocked(connection);
              }
            }
  finally {
              Binder.restoreCallingIdentity(identity);
            }
          }
        }
      }
);
      final Intent intent=new Intent(Intent.ACTION_REVIEW_PERMISSIONS);
      intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK | Intent.FLAG_ACTIVITY_EXCLUDE_FROM_RECENTS);
      intent.putExtra(Intent.EXTRA_PACKAGE_NAME,s.packageName);
      intent.putExtra(Intent.EXTRA_REMOTE_CALLBACK,callback);
      if (DEBUG_PERMISSIONS_REVIEW) {
        Slog.i(TAG,"String_Node_Str" + s.userId + "String_Node_Str"+ s.packageName);
      }
      mAm.mHandler.post(new Runnable(){
        @Override public void run(){
          mAm.mContext.startActivityAsUser(intent,new UserHandle(userId));
        }
      }
);
    }
  }
  final long origId=Binder.clearCallingIdentity();
  try {
    if (unscheduleServiceRestartLocked(s,callerApp.info.uid,false)) {
      if (DEBUG_SERVICE)       Slog.v(TAG_SERVICE,"String_Node_Str" + s);
    }
    if ((flags & Context.BIND_AUTO_CREATE) != 0) {
      s.lastActivity=SystemClock.uptimeMillis();
      if (!s.hasAutoCreateConnections()) {
        ServiceState stracker=s.getTracker();
        if (stracker != null) {
          stracker.setBound(true,mAm.mProcessStats.getMemFactorLocked(),s.lastActivity);
        }
      }
    }
    mAm.startAssociationLocked(callerApp.uid,callerApp.processName,callerApp.curProcState,s.appInfo.uid,s.name,s.processName);
    AppBindRecord b=s.retrieveAppBindingLocked(service,callerApp);
    ConnectionRecord c=new ConnectionRecord(b,activity,connection,flags,clientLabel,clientIntent);
    IBinder binder=connection.asBinder();
    ArrayList<ConnectionRecord> clist=s.connections.get(binder);
    if (clist == null) {
      clist=new ArrayList<ConnectionRecord>();
      s.connections.put(binder,clist);
    }
    clist.add(c);
    b.connections.add(c);
    if (activity != null) {
      if (activity.connections == null) {
        activity.connections=new HashSet<ConnectionRecord>();
      }
      activity.connections.add(c);
    }
    b.client.connections.add(c);
    if ((c.flags & Context.BIND_ABOVE_CLIENT) != 0) {
      b.client.hasAboveClient=true;
    }
    if (s.app != null) {
      updateServiceClientActivitiesLocked(s.app,c,true);
    }
    clist=mServiceConnections.get(binder);
    if (clist == null) {
      clist=new ArrayList<ConnectionRecord>();
      mServiceConnections.put(binder,clist);
    }
    clist.add(c);
    if ((flags & Context.BIND_AUTO_CREATE) != 0) {
      s.lastActivity=SystemClock.uptimeMillis();
      if (bringUpServiceLocked(s,service.getFlags(),callerFg,false,permissionsReviewRequired) != null) {
        return 0;
      }
    }
    if (s.app != null) {
      if ((flags & Context.BIND_TREAT_LIKE_ACTIVITY) != 0) {
        s.app.treatLikeActivity=true;
      }
      mAm.updateLruProcessLocked(s.app,s.app.hasClientActivities || s.app.treatLikeActivity,b.client);
      mAm.updateOomAdjLocked(s.app);
    }
    if (DEBUG_SERVICE)     Slog.v(TAG_SERVICE,"String_Node_Str" + s + "String_Node_Str"+ b+ "String_Node_Str"+ b.intent.received+ "String_Node_Str"+ b.intent.apps.size()+ "String_Node_Str"+ b.intent.doRebind);
    if (s.app != null && b.intent.received) {
      try {
        c.conn.connected(s.name,b.intent.binder);
      }
 catch (      Exception e) {
        Slog.w(TAG,"String_Node_Str" + s.shortName + "String_Node_Str"+ c.conn.asBinder()+ "String_Node_Str"+ c.binding.client.processName+ "String_Node_Str",e);
      }
      if (b.intent.apps.size() == 1 && b.intent.doRebind) {
        requestServiceBindingLocked(s,b.intent,callerFg,true);
      }
    }
 else     if (!b.intent.requested) {
      requestServiceBindingLocked(s,b.intent,callerFg,false);
    }
    getServiceMap(s.userId).ensureNotStartingBackground(s);
  }
  finally {
    Binder.restoreCallingIdentity(origId);
  }
  return 1;
}

Fixed version (ground truth):
int bindServiceLocked(IApplicationThread caller,IBinder token,Intent service,String resolvedType,final IServiceConnection connection,int flags,String callingPackage,final int userId) throws TransactionTooLargeException {
  if (DEBUG_SERVICE)   Slog.v(TAG_SERVICE,"String_Node_Str" + service + "String_Node_Str"+ resolvedType+ "String_Node_Str"+ connection.asBinder()+ "String_Node_Str"+ Integer.toHexString(flags));
  final ProcessRecord callerApp=mAm.getRecordForAppLocked(caller);
  if (callerApp == null) {
    throw new SecurityException("String_Node_Str" + caller + "String_Node_Str"+ Binder.getCallingPid()+ "String_Node_Str"+ service);
  }
  ActivityRecord activity=null;
  if (token != null) {
    activity=ActivityRecord.isInStackLocked(token);
    if (activity == null) {
      Slog.w(TAG,"String_Node_Str" + token);
      return 0;
    }
  }
  int clientLabel=0;
  PendingIntent clientIntent=null;
  final boolean isCallerSystem=callerApp.info.uid == Process.SYSTEM_UID;
  if (isCallerSystem) {
    service.setDefusable(true);
    clientIntent=service.getParcelableExtra(Intent.EXTRA_CLIENT_INTENT);
    if (clientIntent != null) {
      clientLabel=service.getIntExtra(Intent.EXTRA_CLIENT_LABEL,0);
      if (clientLabel != 0) {
        service=service.cloneFilter();
      }
    }
  }
  if ((flags & Context.BIND_TREAT_LIKE_ACTIVITY) != 0) {
    mAm.enforceCallingPermission(android.Manifest.permission.MANAGE_ACTIVITY_STACKS,"String_Node_Str");
  }
  if ((flags & Context.BIND_ALLOW_WHITELIST_MANAGEMENT) != 0 && !isCallerSystem) {
    throw new SecurityException("String_Node_Str" + caller + "String_Node_Str"+ Binder.getCallingPid()+ "String_Node_Str"+ service);
  }
  final boolean callerFg=callerApp.setSchedGroup != ProcessList.SCHED_GROUP_BACKGROUND;
  final boolean isBindExternal=(flags & Context.BIND_EXTERNAL_SERVICE) != 0;
  ServiceLookupResult res=retrieveServiceLocked(service,resolvedType,callingPackage,Binder.getCallingPid(),Binder.getCallingUid(),userId,true,callerFg,isBindExternal);
  if (res == null) {
    return 0;
  }
  if (res.record == null) {
    return -1;
  }
  ServiceRecord s=res.record;
  boolean permissionsReviewRequired=false;
  if (Build.PERMISSIONS_REVIEW_REQUIRED) {
    if (mAm.getPackageManagerInternalLocked().isPermissionsReviewRequired(s.packageName,s.userId)) {
      permissionsReviewRequired=true;
      if (!callerFg) {
        Slog.w(TAG,"String_Node_Str" + s.userId + "String_Node_Str"+ s.packageName+ "String_Node_Str");
        return 0;
      }
      final ServiceRecord serviceRecord=s;
      final Intent serviceIntent=service;
      RemoteCallback callback=new RemoteCallback(new RemoteCallback.OnResultListener(){
        @Override public void onResult(        Bundle result){
synchronized (mAm) {
            final long identity=Binder.clearCallingIdentity();
            try {
              if (!mPendingServices.contains(serviceRecord)) {
                return;
              }
              if (!mAm.getPackageManagerInternalLocked().isPermissionsReviewRequired(serviceRecord.packageName,serviceRecord.userId)) {
                try {
                  bringUpServiceLocked(serviceRecord,serviceIntent.getFlags(),callerFg,false,false);
                }
 catch (                RemoteException e) {
                }
              }
 else {
                unbindServiceLocked(connection);
              }
            }
  finally {
              Binder.restoreCallingIdentity(identity);
            }
          }
        }
      }
);
      final Intent intent=new Intent(Intent.ACTION_REVIEW_PERMISSIONS);
      intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK | Intent.FLAG_ACTIVITY_EXCLUDE_FROM_RECENTS);
      intent.putExtra(Intent.EXTRA_PACKAGE_NAME,s.packageName);
      intent.putExtra(Intent.EXTRA_REMOTE_CALLBACK,callback);
      if (DEBUG_PERMISSIONS_REVIEW) {
        Slog.i(TAG,"String_Node_Str" + s.userId + "String_Node_Str"+ s.packageName);
      }
      mAm.mHandler.post(new Runnable(){
        @Override public void run(){
          mAm.mContext.startActivityAsUser(intent,new UserHandle(userId));
        }
      }
);
    }
  }
  final long origId=Binder.clearCallingIdentity();
  try {
    if (unscheduleServiceRestartLocked(s,callerApp.info.uid,false)) {
      if (DEBUG_SERVICE)       Slog.v(TAG_SERVICE,"String_Node_Str" + s);
    }
    if ((flags & Context.BIND_AUTO_CREATE) != 0) {
      s.lastActivity=SystemClock.uptimeMillis();
      if (!s.hasAutoCreateConnections()) {
        ServiceState stracker=s.getTracker();
        if (stracker != null) {
          stracker.setBound(true,mAm.mProcessStats.getMemFactorLocked(),s.lastActivity);
        }
      }
    }
    mAm.startAssociationLocked(callerApp.uid,callerApp.processName,callerApp.curProcState,s.appInfo.uid,s.name,s.processName);
    AppBindRecord b=s.retrieveAppBindingLocked(service,callerApp);
    ConnectionRecord c=new ConnectionRecord(b,activity,connection,flags,clientLabel,clientIntent);
    IBinder binder=connection.asBinder();
    ArrayList<ConnectionRecord> clist=s.connections.get(binder);
    if (clist == null) {
      clist=new ArrayList<ConnectionRecord>();
      s.connections.put(binder,clist);
    }
    clist.add(c);
    b.connections.add(c);
    if (activity != null) {
      if (activity.connections == null) {
        activity.connections=new HashSet<ConnectionRecord>();
      }
      activity.connections.add(c);
    }
    b.client.connections.add(c);
    if ((c.flags & Context.BIND_ABOVE_CLIENT) != 0) {
      b.client.hasAboveClient=true;
    }
    if ((c.flags & Context.BIND_ALLOW_WHITELIST_MANAGEMENT) != 0) {
      s.whitelistManager=true;
    }
    if (s.app != null) {
      updateServiceClientActivitiesLocked(s.app,c,true);
    }
    clist=mServiceConnections.get(binder);
    if (clist == null) {
      clist=new ArrayList<ConnectionRecord>();
      mServiceConnections.put(binder,clist);
    }
    clist.add(c);
    if ((flags & Context.BIND_AUTO_CREATE) != 0) {
      s.lastActivity=SystemClock.uptimeMillis();
      if (bringUpServiceLocked(s,service.getFlags(),callerFg,false,permissionsReviewRequired) != null) {
        return 0;
      }
    }
    if (s.app != null) {
      if ((flags & Context.BIND_TREAT_LIKE_ACTIVITY) != 0) {
        s.app.treatLikeActivity=true;
      }
      if (s.whitelistManager) {
        s.app.whitelistManager=true;
      }
      mAm.updateLruProcessLocked(s.app,s.app.hasClientActivities || s.app.treatLikeActivity,b.client);
      mAm.updateOomAdjLocked(s.app);
    }
    if (DEBUG_SERVICE)     Slog.v(TAG_SERVICE,"String_Node_Str" + s + "String_Node_Str"+ b+ "String_Node_Str"+ b.intent.received+ "String_Node_Str"+ b.intent.apps.size()+ "String_Node_Str"+ b.intent.doRebind);
    if (s.app != null && b.intent.received) {
      try {
        c.conn.connected(s.name,b.intent.binder);
      }
 catch (      Exception e) {
        Slog.w(TAG,"String_Node_Str" + s.shortName + "String_Node_Str"+ c.conn.asBinder()+ "String_Node_Str"+ c.binding.client.processName+ "String_Node_Str",e);
      }
      if (b.intent.apps.size() == 1 && b.intent.doRebind) {
        requestServiceBindingLocked(s,b.intent,callerFg,true);
      }
    }
 else     if (!b.intent.requested) {
      requestServiceBindingLocked(s,b.intent,callerFg,false);
    }
    getServiceMap(s.userId).ensureNotStartingBackground(s);
  }
  finally {
    Binder.restoreCallingIdentity(origId);
  }
  return 1;
}