Program: 195522
Project: 195522
Buggy source:
/** 
 * Parses the commandline arguments intended for the Zygote spawner (such as "--setuid=" and "--setgid=") and creates an array containing the remaining args. Per security review bug #1112214, duplicate args are disallowed in critical cases to make injection harder.
 */
private void parseArgs(String args[]) throws IllegalArgumentException {
  int curArg=0;
  boolean seenRuntimeArgs=true;
  for (; curArg < args.length; curArg++) {
    String arg=args[curArg];
    if (arg.equals("String_Node_Str")) {
      curArg++;
      break;
    }
 else     if (arg.startsWith("String_Node_Str")) {
      if (uidSpecified) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      uidSpecified=true;
      uid=Integer.parseInt(arg.substring(arg.indexOf('=') + 1));
    }
 else     if (arg.startsWith("String_Node_Str")) {
      if (gidSpecified) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      gidSpecified=true;
      gid=Integer.parseInt(arg.substring(arg.indexOf('=') + 1));
    }
 else     if (arg.startsWith("String_Node_Str")) {
      if (targetSdkVersionSpecified) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      targetSdkVersionSpecified=true;
      targetSdkVersion=Integer.parseInt(arg.substring(arg.indexOf('=') + 1));
    }
 else     if (arg.equals("String_Node_Str")) {
      debugFlags|=Zygote.DEBUG_ENABLE_DEBUGGER;
    }
 else     if (arg.equals("String_Node_Str")) {
      debugFlags|=Zygote.DEBUG_ENABLE_SAFEMODE;
    }
 else     if (arg.equals("String_Node_Str")) {
      debugFlags|=Zygote.DEBUG_ENABLE_CHECKJNI;
    }
 else     if (arg.equals("String_Node_Str")) {
      debugFlags|=Zygote.DEBUG_ENABLE_JNI_LOGGING;
    }
 else     if (arg.equals("String_Node_Str")) {
      debugFlags|=Zygote.DEBUG_ENABLE_ASSERT;
    }
 else     if (arg.equals("String_Node_Str")) {
      seenRuntimeArgs=true;
    }
 else     if (arg.startsWith("String_Node_Str")) {
      if (seInfoSpecified) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      seInfoSpecified=true;
      seInfo=arg.substring(arg.indexOf('=') + 1);
    }
 else     if (arg.startsWith("String_Node_Str")) {
      if (capabilitiesSpecified) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      capabilitiesSpecified=true;
      String capString=arg.substring(arg.indexOf('=') + 1);
      String[] capStrings=capString.split("String_Node_Str",2);
      if (capStrings.length == 1) {
        effectiveCapabilities=Long.decode(capStrings[0]);
        permittedCapabilities=effectiveCapabilities;
      }
 else {
        permittedCapabilities=Long.decode(capStrings[0]);
        effectiveCapabilities=Long.decode(capStrings[1]);
      }
    }
 else     if (arg.startsWith("String_Node_Str")) {
      String[] limitStrings=arg.substring(arg.indexOf('=') + 1).split("String_Node_Str");
      if (limitStrings.length != 3) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      int[] rlimitTuple=new int[limitStrings.length];
      for (int i=0; i < limitStrings.length; i++) {
        rlimitTuple[i]=Integer.parseInt(limitStrings[i]);
      }
      if (rlimits == null) {
        rlimits=new ArrayList();
      }
      rlimits.add(rlimitTuple);
    }
 else     if (arg.startsWith("String_Node_Str")) {
      if (gids != null) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      String[] params=arg.substring(arg.indexOf('=') + 1).split("String_Node_Str");
      gids=new int[params.length];
      for (int i=params.length - 1; i >= 0; i--) {
        gids[i]=Integer.parseInt(params[i]);
      }
    }
 else     if (arg.equals("String_Node_Str")) {
      if (invokeWith != null) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      try {
        invokeWith=args[++curArg];
      }
 catch (      IndexOutOfBoundsException ex) {
        throw new IllegalArgumentException("String_Node_Str");
      }
    }
 else     if (arg.startsWith("String_Node_Str")) {
      if (niceName != null) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      niceName=arg.substring(arg.indexOf('=') + 1);
    }
 else     if (arg.equals("String_Node_Str")) {
      mountExternal=Zygote.MOUNT_EXTERNAL_MULTIUSER;
    }
 else     if (arg.equals("String_Node_Str")) {
      mountExternal=Zygote.MOUNT_EXTERNAL_MULTIUSER_ALL;
    }
 else     if (arg.equals("String_Node_Str")) {
      abiListQuery=true;
    }
 else     if (arg.startsWith("String_Node_Str")) {
      instructionSet=arg.substring(arg.indexOf('=') + 1);
    }
 else     if (arg.startsWith("String_Node_Str")) {
      appDataDir=arg.substring(arg.indexOf('=') + 1);
    }
 else {
      break;
    }
  }
  if (!seenRuntimeArgs) {
    throw new IllegalArgumentException("String_Node_Str" + args[curArg]);
  }
  remainingArgs=new String[args.length - curArg];
  System.arraycopy(args,curArg,remainingArgs,0,remainingArgs.length);
}

Fixed version (ground truth):
/** 
 * Parses the commandline arguments intended for the Zygote spawner (such as "--setuid=" and "--setgid=") and creates an array containing the remaining args. Per security review bug #1112214, duplicate args are disallowed in critical cases to make injection harder.
 */
private void parseArgs(String args[]) throws IllegalArgumentException {
  int curArg=0;
  boolean seenRuntimeArgs=false;
  for (; curArg < args.length; curArg++) {
    String arg=args[curArg];
    if (arg.equals("String_Node_Str")) {
      curArg++;
      break;
    }
 else     if (arg.startsWith("String_Node_Str")) {
      if (uidSpecified) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      uidSpecified=true;
      uid=Integer.parseInt(arg.substring(arg.indexOf('=') + 1));
    }
 else     if (arg.startsWith("String_Node_Str")) {
      if (gidSpecified) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      gidSpecified=true;
      gid=Integer.parseInt(arg.substring(arg.indexOf('=') + 1));
    }
 else     if (arg.startsWith("String_Node_Str")) {
      if (targetSdkVersionSpecified) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      targetSdkVersionSpecified=true;
      targetSdkVersion=Integer.parseInt(arg.substring(arg.indexOf('=') + 1));
    }
 else     if (arg.equals("String_Node_Str")) {
      debugFlags|=Zygote.DEBUG_ENABLE_DEBUGGER;
    }
 else     if (arg.equals("String_Node_Str")) {
      debugFlags|=Zygote.DEBUG_ENABLE_SAFEMODE;
    }
 else     if (arg.equals("String_Node_Str")) {
      debugFlags|=Zygote.DEBUG_ENABLE_CHECKJNI;
    }
 else     if (arg.equals("String_Node_Str")) {
      debugFlags|=Zygote.DEBUG_ENABLE_JNI_LOGGING;
    }
 else     if (arg.equals("String_Node_Str")) {
      debugFlags|=Zygote.DEBUG_ENABLE_ASSERT;
    }
 else     if (arg.equals("String_Node_Str")) {
      seenRuntimeArgs=true;
    }
 else     if (arg.startsWith("String_Node_Str")) {
      if (seInfoSpecified) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      seInfoSpecified=true;
      seInfo=arg.substring(arg.indexOf('=') + 1);
    }
 else     if (arg.startsWith("String_Node_Str")) {
      if (capabilitiesSpecified) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      capabilitiesSpecified=true;
      String capString=arg.substring(arg.indexOf('=') + 1);
      String[] capStrings=capString.split("String_Node_Str",2);
      if (capStrings.length == 1) {
        effectiveCapabilities=Long.decode(capStrings[0]);
        permittedCapabilities=effectiveCapabilities;
      }
 else {
        permittedCapabilities=Long.decode(capStrings[0]);
        effectiveCapabilities=Long.decode(capStrings[1]);
      }
    }
 else     if (arg.startsWith("String_Node_Str")) {
      String[] limitStrings=arg.substring(arg.indexOf('=') + 1).split("String_Node_Str");
      if (limitStrings.length != 3) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      int[] rlimitTuple=new int[limitStrings.length];
      for (int i=0; i < limitStrings.length; i++) {
        rlimitTuple[i]=Integer.parseInt(limitStrings[i]);
      }
      if (rlimits == null) {
        rlimits=new ArrayList();
      }
      rlimits.add(rlimitTuple);
    }
 else     if (arg.startsWith("String_Node_Str")) {
      if (gids != null) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      String[] params=arg.substring(arg.indexOf('=') + 1).split("String_Node_Str");
      gids=new int[params.length];
      for (int i=params.length - 1; i >= 0; i--) {
        gids[i]=Integer.parseInt(params[i]);
      }
    }
 else     if (arg.equals("String_Node_Str")) {
      if (invokeWith != null) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      try {
        invokeWith=args[++curArg];
      }
 catch (      IndexOutOfBoundsException ex) {
        throw new IllegalArgumentException("String_Node_Str");
      }
    }
 else     if (arg.startsWith("String_Node_Str")) {
      if (niceName != null) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      niceName=arg.substring(arg.indexOf('=') + 1);
    }
 else     if (arg.equals("String_Node_Str")) {
      mountExternal=Zygote.MOUNT_EXTERNAL_MULTIUSER;
    }
 else     if (arg.equals("String_Node_Str")) {
      mountExternal=Zygote.MOUNT_EXTERNAL_MULTIUSER_ALL;
    }
 else     if (arg.equals("String_Node_Str")) {
      abiListQuery=true;
    }
 else     if (arg.startsWith("String_Node_Str")) {
      instructionSet=arg.substring(arg.indexOf('=') + 1);
    }
 else     if (arg.startsWith("String_Node_Str")) {
      appDataDir=arg.substring(arg.indexOf('=') + 1);
    }
 else {
      break;
    }
  }
  if (abiListQuery) {
    if (args.length - curArg > 0) {
      throw new IllegalArgumentException("String_Node_Str");
    }
  }
 else {
    if (!seenRuntimeArgs) {
      throw new IllegalArgumentException("String_Node_Str" + args[curArg]);
    }
    remainingArgs=new String[args.length - curArg];
    System.arraycopy(args,curArg,remainingArgs,0,remainingArgs.length);
  }
}