Program: 22217
Project: 22217
Buggy source:
private final int broadcastIntentLocked(ProcessRecord callerApp,String callerPackage,Intent intent,String resolvedType,IIntentReceiver resultTo,int resultCode,String resultData,Bundle map,String requiredPermission,boolean ordered,boolean sticky,int callingPid,int callingUid){
  intent=new Intent(intent);
  if (DEBUG_BROADCAST_LIGHT)   Slog.v(TAG,(sticky ? "String_Node_Str" : "String_Node_Str") + intent + "String_Node_Str"+ ordered);
  if ((resultTo != null) && !ordered) {
    Slog.w(TAG,"String_Node_Str" + intent + "String_Node_Str");
  }
  final boolean uidRemoved=intent.ACTION_UID_REMOVED.equals(intent.getAction());
  if (intent.ACTION_PACKAGE_REMOVED.equals(intent.getAction()) || intent.ACTION_PACKAGE_CHANGED.equals(intent.getAction()) || Intent.ACTION_EXTERNAL_APPLICATIONS_UNAVAILABLE.equals(intent.getAction())|| uidRemoved) {
    if (checkComponentPermission(android.Manifest.permission.BROADCAST_PACKAGE_REMOVED,callingPid,callingUid,-1) == PackageManager.PERMISSION_GRANTED) {
      if (uidRemoved) {
        final Bundle intentExtras=intent.getExtras();
        final int uid=intentExtras != null ? intentExtras.getInt(Intent.EXTRA_UID) : -1;
        if (uid >= 0) {
          BatteryStatsImpl bs=mBatteryStatsService.getActiveStatistics();
synchronized (bs) {
            bs.removeUidStatsLocked(uid);
          }
        }
      }
 else {
        if (Intent.ACTION_EXTERNAL_APPLICATIONS_UNAVAILABLE.equals(intent.getAction())) {
          String list[]=intent.getStringArrayExtra(Intent.EXTRA_CHANGED_PACKAGE_LIST);
          if (list != null && (list.length > 0)) {
            for (            String pkg : list) {
              forceStopPackageLocked(pkg,-1,false,true,true);
            }
          }
        }
 else {
          Uri data=intent.getData();
          String ssp;
          if (data != null && (ssp=data.getSchemeSpecificPart()) != null) {
            if (!intent.getBooleanExtra(Intent.EXTRA_DONT_KILL_APP,false)) {
              forceStopPackageLocked(ssp,intent.getIntExtra(Intent.EXTRA_UID,-1),false,true,true);
            }
          }
        }
      }
    }
 else {
      String msg="String_Node_Str" + intent.getAction() + "String_Node_Str"+ callerPackage+ "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ "String_Node_Str"+ android.Manifest.permission.BROADCAST_PACKAGE_REMOVED;
      Slog.w(TAG,msg);
      throw new SecurityException(msg);
    }
  }
  if (intent.ACTION_TIMEZONE_CHANGED.equals(intent.getAction())) {
    mHandler.sendEmptyMessage(UPDATE_TIME_ZONE);
  }
  if (callingUid == Process.SYSTEM_UID || callingUid == Process.PHONE_UID || callingUid == Process.SHELL_UID || callingUid == 0) {
  }
 else   if (callerApp == null || !callerApp.persistent) {
    try {
      if (ActivityThread.getPackageManager().isProtectedBroadcast(intent.getAction())) {
        String msg="String_Node_Str" + intent.getAction() + "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid;
        Slog.w(TAG,msg);
        throw new SecurityException(msg);
      }
    }
 catch (    RemoteException e) {
      Slog.w(TAG,"String_Node_Str",e);
      return BROADCAST_SUCCESS;
    }
  }
  if (sticky) {
    if (checkPermission(android.Manifest.permission.BROADCAST_STICKY,callingPid,callingUid) != PackageManager.PERMISSION_GRANTED) {
      String msg="String_Node_Str" + callingPid + "String_Node_Str"+ callingUid+ "String_Node_Str"+ android.Manifest.permission.BROADCAST_STICKY;
      Slog.w(TAG,msg);
      throw new SecurityException(msg);
    }
    if (requiredPermission != null) {
      Slog.w(TAG,"String_Node_Str" + intent + "String_Node_Str"+ requiredPermission);
      return BROADCAST_STICKY_CANT_HAVE_PERMISSION;
    }
    if (intent.getComponent() != null) {
      throw new SecurityException("String_Node_Str");
    }
    ArrayList<Intent> list=mStickyBroadcasts.get(intent.getAction());
    if (list == null) {
      list=new ArrayList<Intent>();
      mStickyBroadcasts.put(intent.getAction(),list);
    }
    int N=list.size();
    int i;
    for (i=0; i < N; i++) {
      if (intent.filterEquals(list.get(i))) {
        list.set(i,new Intent(intent));
        break;
      }
    }
    if (i >= N) {
      list.add(new Intent(intent));
    }
  }
  List receivers=null;
  List<BroadcastFilter> registeredReceivers=null;
  try {
    if (intent.getComponent() != null) {
      ActivityInfo ai=ActivityThread.getPackageManager().getReceiverInfo(intent.getComponent(),STOCK_PM_FLAGS);
      if (ai != null) {
        receivers=new ArrayList();
        ResolveInfo ri=new ResolveInfo();
        ri.activityInfo=ai;
        receivers.add(ri);
      }
    }
 else {
      if ((intent.getFlags() & Intent.FLAG_RECEIVER_REGISTERED_ONLY) == 0) {
        receivers=ActivityThread.getPackageManager().queryIntentReceivers(intent,resolvedType,STOCK_PM_FLAGS);
      }
      registeredReceivers=mReceiverResolver.queryIntent(intent,resolvedType,false);
    }
  }
 catch (  RemoteException ex) {
  }
  final boolean replacePending=(intent.getFlags() & Intent.FLAG_RECEIVER_REPLACE_PENDING) != 0;
  if (DEBUG_BROADCAST)   Slog.v(TAG,"String_Node_Str" + intent.getAction() + "String_Node_Str"+ replacePending);
  int NR=registeredReceivers != null ? registeredReceivers.size() : 0;
  if (!ordered && NR > 0) {
    BroadcastRecord r=new BroadcastRecord(intent,callerApp,callerPackage,callingPid,callingUid,requiredPermission,registeredReceivers,resultTo,resultCode,resultData,map,ordered,sticky,false);
    if (DEBUG_BROADCAST)     Slog.v(TAG,"String_Node_Str" + r + "String_Node_Str"+ mParallelBroadcasts.size());
    boolean replaced=false;
    if (replacePending) {
      for (int i=mParallelBroadcasts.size() - 1; i >= 0; i--) {
        if (intent.filterEquals(mParallelBroadcasts.get(i).intent)) {
          if (DEBUG_BROADCAST)           Slog.v(TAG,"String_Node_Str" + intent);
          mParallelBroadcasts.set(i,r);
          replaced=true;
          break;
        }
      }
    }
    if (!replaced) {
      mParallelBroadcasts.add(r);
      scheduleBroadcastsLocked();
    }
    registeredReceivers=null;
    NR=0;
  }
  int ir=0;
  if (receivers != null) {
    String skipPackages[]=null;
    if (intent.ACTION_PACKAGE_ADDED.equals(intent.getAction()) || intent.ACTION_PACKAGE_RESTARTED.equals(intent.getAction()) || intent.ACTION_PACKAGE_DATA_CLEARED.equals(intent.getAction())) {
      Uri data=intent.getData();
      if (data != null) {
        String pkgName=data.getSchemeSpecificPart();
        if (pkgName != null) {
          skipPackages=new String[]{pkgName};
        }
      }
    }
 else     if (intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE.equals(intent.getAction())) {
      skipPackages=intent.getStringArrayExtra(Intent.EXTRA_CHANGED_PACKAGE_LIST);
    }
    if (skipPackages != null && (skipPackages.length > 0)) {
      for (      String skipPackage : skipPackages) {
        if (skipPackage != null) {
          int NT=receivers.size();
          for (int it=0; it < NT; it++) {
            ResolveInfo curt=(ResolveInfo)receivers.get(it);
            if (curt.activityInfo.packageName.equals(skipPackage)) {
              receivers.remove(it);
              it--;
              NT--;
            }
          }
        }
      }
    }
    int NT=receivers != null ? receivers.size() : 0;
    int it=0;
    ResolveInfo curt=null;
    BroadcastFilter curr=null;
    while (it < NT && ir < NR) {
      if (curt == null) {
        curt=(ResolveInfo)receivers.get(it);
      }
      if (curr == null) {
        curr=registeredReceivers.get(ir);
      }
      if (curr.getPriority() >= curt.priority) {
        receivers.add(it,curr);
        ir++;
        curr=null;
        it++;
        NT++;
      }
 else {
        it++;
        curt=null;
      }
    }
  }
  while (ir < NR) {
    if (receivers == null) {
      receivers=new ArrayList();
    }
    receivers.add(registeredReceivers.get(ir));
    ir++;
  }
  if ((receivers != null && receivers.size() > 0) || resultTo != null) {
    BroadcastRecord r=new BroadcastRecord(intent,callerApp,callerPackage,callingPid,callingUid,requiredPermission,receivers,resultTo,resultCode,resultData,map,ordered,sticky,false);
    if (DEBUG_BROADCAST)     Slog.v(TAG,"String_Node_Str" + r + "String_Node_Str"+ mOrderedBroadcasts.size());
    if (DEBUG_BROADCAST) {
      int seq=r.intent.getIntExtra("String_Node_Str",-1);
      Slog.i(TAG,"String_Node_Str" + r.intent.getAction() + "String_Node_Str"+ seq);
    }
    boolean replaced=false;
    if (replacePending) {
      for (int i=mOrderedBroadcasts.size() - 1; i >= 0; i--) {
        if (intent.filterEquals(mOrderedBroadcasts.get(i).intent)) {
          if (DEBUG_BROADCAST)           Slog.v(TAG,"String_Node_Str" + intent);
          mOrderedBroadcasts.set(i,r);
          replaced=true;
          break;
        }
      }
    }
    if (!replaced) {
      mOrderedBroadcasts.add(r);
      scheduleBroadcastsLocked();
    }
  }
  return BROADCAST_SUCCESS;
}

Fixed version (ground truth):
private final int broadcastIntentLocked(ProcessRecord callerApp,String callerPackage,Intent intent,String resolvedType,IIntentReceiver resultTo,int resultCode,String resultData,Bundle map,String requiredPermission,boolean ordered,boolean sticky,int callingPid,int callingUid){
  intent=new Intent(intent);
  if (DEBUG_BROADCAST_LIGHT)   Slog.v(TAG,(sticky ? "String_Node_Str" : "String_Node_Str") + intent + "String_Node_Str"+ ordered);
  if ((resultTo != null) && !ordered) {
    Slog.w(TAG,"String_Node_Str" + intent + "String_Node_Str");
  }
  final boolean uidRemoved=intent.ACTION_UID_REMOVED.equals(intent.getAction());
  if (intent.ACTION_PACKAGE_REMOVED.equals(intent.getAction()) || intent.ACTION_PACKAGE_CHANGED.equals(intent.getAction()) || Intent.ACTION_EXTERNAL_APPLICATIONS_UNAVAILABLE.equals(intent.getAction())|| uidRemoved) {
    if (checkComponentPermission(android.Manifest.permission.BROADCAST_PACKAGE_REMOVED,callingPid,callingUid,-1) == PackageManager.PERMISSION_GRANTED) {
      if (uidRemoved) {
        final Bundle intentExtras=intent.getExtras();
        final int uid=intentExtras != null ? intentExtras.getInt(Intent.EXTRA_UID) : -1;
        if (uid >= 0) {
          BatteryStatsImpl bs=mBatteryStatsService.getActiveStatistics();
synchronized (bs) {
            bs.removeUidStatsLocked(uid);
          }
        }
      }
 else {
        if (Intent.ACTION_EXTERNAL_APPLICATIONS_UNAVAILABLE.equals(intent.getAction())) {
          String list[]=intent.getStringArrayExtra(Intent.EXTRA_CHANGED_PACKAGE_LIST);
          if (list != null && (list.length > 0)) {
            for (            String pkg : list) {
              forceStopPackageLocked(pkg,-1,false,true,true);
            }
            sendPackageBroadcastLocked(IApplicationThread.EXTERNAL_STORAGE_UNAVAILABLE,list);
          }
        }
 else {
          Uri data=intent.getData();
          String ssp;
          if (data != null && (ssp=data.getSchemeSpecificPart()) != null) {
            if (!intent.getBooleanExtra(Intent.EXTRA_DONT_KILL_APP,false)) {
              forceStopPackageLocked(ssp,intent.getIntExtra(Intent.EXTRA_UID,-1),false,true,true);
            }
            if (intent.ACTION_PACKAGE_REMOVED.equals(intent.getAction())) {
              sendPackageBroadcastLocked(IApplicationThread.PACKAGE_REMOVED,new String[]{ssp});
            }
          }
        }
      }
    }
 else {
      String msg="String_Node_Str" + intent.getAction() + "String_Node_Str"+ callerPackage+ "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ "String_Node_Str"+ android.Manifest.permission.BROADCAST_PACKAGE_REMOVED;
      Slog.w(TAG,msg);
      throw new SecurityException(msg);
    }
  }
  if (intent.ACTION_TIMEZONE_CHANGED.equals(intent.getAction())) {
    mHandler.sendEmptyMessage(UPDATE_TIME_ZONE);
  }
  if (callingUid == Process.SYSTEM_UID || callingUid == Process.PHONE_UID || callingUid == Process.SHELL_UID || callingUid == 0) {
  }
 else   if (callerApp == null || !callerApp.persistent) {
    try {
      if (ActivityThread.getPackageManager().isProtectedBroadcast(intent.getAction())) {
        String msg="String_Node_Str" + intent.getAction() + "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid;
        Slog.w(TAG,msg);
        throw new SecurityException(msg);
      }
    }
 catch (    RemoteException e) {
      Slog.w(TAG,"String_Node_Str",e);
      return BROADCAST_SUCCESS;
    }
  }
  if (sticky) {
    if (checkPermission(android.Manifest.permission.BROADCAST_STICKY,callingPid,callingUid) != PackageManager.PERMISSION_GRANTED) {
      String msg="String_Node_Str" + callingPid + "String_Node_Str"+ callingUid+ "String_Node_Str"+ android.Manifest.permission.BROADCAST_STICKY;
      Slog.w(TAG,msg);
      throw new SecurityException(msg);
    }
    if (requiredPermission != null) {
      Slog.w(TAG,"String_Node_Str" + intent + "String_Node_Str"+ requiredPermission);
      return BROADCAST_STICKY_CANT_HAVE_PERMISSION;
    }
    if (intent.getComponent() != null) {
      throw new SecurityException("String_Node_Str");
    }
    ArrayList<Intent> list=mStickyBroadcasts.get(intent.getAction());
    if (list == null) {
      list=new ArrayList<Intent>();
      mStickyBroadcasts.put(intent.getAction(),list);
    }
    int N=list.size();
    int i;
    for (i=0; i < N; i++) {
      if (intent.filterEquals(list.get(i))) {
        list.set(i,new Intent(intent));
        break;
      }
    }
    if (i >= N) {
      list.add(new Intent(intent));
    }
  }
  List receivers=null;
  List<BroadcastFilter> registeredReceivers=null;
  try {
    if (intent.getComponent() != null) {
      ActivityInfo ai=ActivityThread.getPackageManager().getReceiverInfo(intent.getComponent(),STOCK_PM_FLAGS);
      if (ai != null) {
        receivers=new ArrayList();
        ResolveInfo ri=new ResolveInfo();
        ri.activityInfo=ai;
        receivers.add(ri);
      }
    }
 else {
      if ((intent.getFlags() & Intent.FLAG_RECEIVER_REGISTERED_ONLY) == 0) {
        receivers=ActivityThread.getPackageManager().queryIntentReceivers(intent,resolvedType,STOCK_PM_FLAGS);
      }
      registeredReceivers=mReceiverResolver.queryIntent(intent,resolvedType,false);
    }
  }
 catch (  RemoteException ex) {
  }
  final boolean replacePending=(intent.getFlags() & Intent.FLAG_RECEIVER_REPLACE_PENDING) != 0;
  if (DEBUG_BROADCAST)   Slog.v(TAG,"String_Node_Str" + intent.getAction() + "String_Node_Str"+ replacePending);
  int NR=registeredReceivers != null ? registeredReceivers.size() : 0;
  if (!ordered && NR > 0) {
    BroadcastRecord r=new BroadcastRecord(intent,callerApp,callerPackage,callingPid,callingUid,requiredPermission,registeredReceivers,resultTo,resultCode,resultData,map,ordered,sticky,false);
    if (DEBUG_BROADCAST)     Slog.v(TAG,"String_Node_Str" + r + "String_Node_Str"+ mParallelBroadcasts.size());
    boolean replaced=false;
    if (replacePending) {
      for (int i=mParallelBroadcasts.size() - 1; i >= 0; i--) {
        if (intent.filterEquals(mParallelBroadcasts.get(i).intent)) {
          if (DEBUG_BROADCAST)           Slog.v(TAG,"String_Node_Str" + intent);
          mParallelBroadcasts.set(i,r);
          replaced=true;
          break;
        }
      }
    }
    if (!replaced) {
      mParallelBroadcasts.add(r);
      scheduleBroadcastsLocked();
    }
    registeredReceivers=null;
    NR=0;
  }
  int ir=0;
  if (receivers != null) {
    String skipPackages[]=null;
    if (intent.ACTION_PACKAGE_ADDED.equals(intent.getAction()) || intent.ACTION_PACKAGE_RESTARTED.equals(intent.getAction()) || intent.ACTION_PACKAGE_DATA_CLEARED.equals(intent.getAction())) {
      Uri data=intent.getData();
      if (data != null) {
        String pkgName=data.getSchemeSpecificPart();
        if (pkgName != null) {
          skipPackages=new String[]{pkgName};
        }
      }
    }
 else     if (intent.ACTION_EXTERNAL_APPLICATIONS_AVAILABLE.equals(intent.getAction())) {
      skipPackages=intent.getStringArrayExtra(Intent.EXTRA_CHANGED_PACKAGE_LIST);
    }
    if (skipPackages != null && (skipPackages.length > 0)) {
      for (      String skipPackage : skipPackages) {
        if (skipPackage != null) {
          int NT=receivers.size();
          for (int it=0; it < NT; it++) {
            ResolveInfo curt=(ResolveInfo)receivers.get(it);
            if (curt.activityInfo.packageName.equals(skipPackage)) {
              receivers.remove(it);
              it--;
              NT--;
            }
          }
        }
      }
    }
    int NT=receivers != null ? receivers.size() : 0;
    int it=0;
    ResolveInfo curt=null;
    BroadcastFilter curr=null;
    while (it < NT && ir < NR) {
      if (curt == null) {
        curt=(ResolveInfo)receivers.get(it);
      }
      if (curr == null) {
        curr=registeredReceivers.get(ir);
      }
      if (curr.getPriority() >= curt.priority) {
        receivers.add(it,curr);
        ir++;
        curr=null;
        it++;
        NT++;
      }
 else {
        it++;
        curt=null;
      }
    }
  }
  while (ir < NR) {
    if (receivers == null) {
      receivers=new ArrayList();
    }
    receivers.add(registeredReceivers.get(ir));
    ir++;
  }
  if ((receivers != null && receivers.size() > 0) || resultTo != null) {
    BroadcastRecord r=new BroadcastRecord(intent,callerApp,callerPackage,callingPid,callingUid,requiredPermission,receivers,resultTo,resultCode,resultData,map,ordered,sticky,false);
    if (DEBUG_BROADCAST)     Slog.v(TAG,"String_Node_Str" + r + "String_Node_Str"+ mOrderedBroadcasts.size());
    if (DEBUG_BROADCAST) {
      int seq=r.intent.getIntExtra("String_Node_Str",-1);
      Slog.i(TAG,"String_Node_Str" + r.intent.getAction() + "String_Node_Str"+ seq);
    }
    boolean replaced=false;
    if (replacePending) {
      for (int i=mOrderedBroadcasts.size() - 1; i >= 0; i--) {
        if (intent.filterEquals(mOrderedBroadcasts.get(i).intent)) {
          if (DEBUG_BROADCAST)           Slog.v(TAG,"String_Node_Str" + intent);
          mOrderedBroadcasts.set(i,r);
          replaced=true;
          break;
        }
      }
    }
    if (!replaced) {
      mOrderedBroadcasts.add(r);
      scheduleBroadcastsLocked();
    }
  }
  return BROADCAST_SUCCESS;
}