Program: 34603
Project: 34603
Buggy source:
/** 
 * Log the user out by clearing the LTPA cookie if LTPA and SSO are enabled. Must also invalidate the http session since it contains user id and password. Finally, if the user specified an exit page with a form parameter of logoutExitPage, redirect to the specified page. This is a special hidden servlet which is always loaded by the servlet engine. Logout is achieved by having a html, jsp, or other servlet which specifies ibm_security_logout HTTP post action.
 * @param req The http request object
 * @param res The http response object.
 * @exception ServletException
 * @exception IOException
 */
private void formLogout(HttpServletRequest req,HttpServletResponse res) throws ServletException, IOException {
  try {
    String exitPage=getValidLogoutExitPage(req);
    if (exitPage != null) {
      req.setAttribute("String_Node_Str",exitPage);
    }
    authenticateApi.logout(req,res,webAppSecurityConfig);
    String str=null;
    if (req.getAttribute("String_Node_Str") != null) {
      AuthenticationResult authResult=new AuthenticationResult(AuthResult.SUCCESS,str);
      authResult.setAuditLogoutSubject(authenticateApi.returnSubjectOnLogout());
      authResult.setAuditCredType("String_Node_Str");
      authResult.setAuditOutcome(AuditEvent.OUTCOME_SUCCESS);
      authResult.setTargetRealm(authResult.realm);
      Audit.audit(Audit.EventID.SECURITY_AUTHN_TERMINATE_01,req,authResult,Integer.valueOf(res.getStatus()));
      redirectLogoutExitPage(req,res);
    }
  }
 catch (  ServletException se) {
    String str="String_Node_Str" + se.getMessage();
    AuthenticationResult authResult=new AuthenticationResult(AuthResult.FAILURE,str);
    authResult.setAuditCredType("String_Node_Str");
    authResult.setAuditOutcome(AuditEvent.OUTCOME_FAILURE);
    authResult.setTargetRealm(authResult.realm);
    Audit.audit(Audit.EventID.SECURITY_AUTHN_TERMINATE_01,req,authResult,Integer.valueOf(res.getStatus()));
    throw se;
  }
catch (  IOException ie) {
    String str="String_Node_Str" + ie.getMessage();
    AuthenticationResult authResult=new AuthenticationResult(AuthResult.FAILURE,str);
    authResult.setAuditCredType("String_Node_Str");
    authResult.setAuditOutcome(AuditEvent.OUTCOME_FAILURE);
    authResult.setTargetRealm(authResult.realm);
    Audit.audit(Audit.EventID.SECURITY_AUTHN_TERMINATE_01,req,authResult,Integer.valueOf(res.getStatus()));
    throw ie;
  }
}

Fixed version (ground truth):
/** 
 * Log the user out by clearing the LTPA cookie if LTPA and SSO are enabled. Must also invalidate the http session since it contains user id and password. Finally, if the user specified an exit page with a form parameter of logoutExitPage, redirect to the specified page. This is a special hidden servlet which is always loaded by the servlet engine. Logout is achieved by having a html, jsp, or other servlet which specifies ibm_security_logout HTTP post action.
 * @param req The http request object
 * @param res The http response object.
 * @exception ServletException
 * @exception IOException
 */
private void formLogout(HttpServletRequest req,HttpServletResponse res) throws ServletException, IOException {
  try {
    String exitPage=getValidLogoutExitPage(req);
    if (exitPage != null) {
      req.setAttribute("String_Node_Str",exitPage);
    }
    authenticateApi.logout(req,res,webAppSecurityConfig);
    String str=null;
    if (req.getAttribute("String_Node_Str") == null) {
      AuthenticationResult authResult=new AuthenticationResult(AuthResult.SUCCESS,str);
      authResult.setAuditLogoutSubject(authenticateApi.returnSubjectOnLogout());
      authResult.setAuditCredType("String_Node_Str");
      authResult.setAuditOutcome(AuditEvent.OUTCOME_SUCCESS);
      authResult.setTargetRealm(authResult.realm);
      Audit.audit(Audit.EventID.SECURITY_AUTHN_TERMINATE_01,req,authResult,Integer.valueOf(res.getStatus()));
      redirectLogoutExitPage(req,res);
    }
  }
 catch (  ServletException se) {
    String str="String_Node_Str" + se.getMessage();
    AuthenticationResult authResult=new AuthenticationResult(AuthResult.FAILURE,str);
    authResult.setAuditCredType("String_Node_Str");
    authResult.setAuditOutcome(AuditEvent.OUTCOME_FAILURE);
    authResult.setTargetRealm(authResult.realm);
    Audit.audit(Audit.EventID.SECURITY_AUTHN_TERMINATE_01,req,authResult,Integer.valueOf(res.getStatus()));
    throw se;
  }
catch (  IOException ie) {
    String str="String_Node_Str" + ie.getMessage();
    AuthenticationResult authResult=new AuthenticationResult(AuthResult.FAILURE,str);
    authResult.setAuditCredType("String_Node_Str");
    authResult.setAuditOutcome(AuditEvent.OUTCOME_FAILURE);
    authResult.setTargetRealm(authResult.realm);
    Audit.audit(Audit.EventID.SECURITY_AUTHN_TERMINATE_01,req,authResult,Integer.valueOf(res.getStatus()));
    throw ie;
  }
}