Program: 23056
Project: 23056
Buggy source:
private void revokeUriPermissionLocked(int callingUid,Uri uri,int modeFlags){
  modeFlags&=(Intent.FLAG_GRANT_READ_URI_PERMISSION | Intent.FLAG_GRANT_WRITE_URI_PERMISSION);
  if (modeFlags == 0) {
    return;
  }
  final IPackageManager pm=ActivityThread.getPackageManager();
  final String authority=uri.getAuthority();
  ProviderInfo pi=null;
  ContentProviderRecord cpr=(ContentProviderRecord)mProvidersByName.get(authority);
  if (cpr != null) {
    pi=cpr.info;
  }
 else {
    try {
      pi=pm.resolveContentProvider(authority,PackageManager.GET_URI_PERMISSION_PATTERNS);
    }
 catch (    RemoteException ex) {
    }
  }
  if (pi == null) {
    Log.w(TAG,"String_Node_Str" + authority);
    return;
  }
  if (!checkHoldingPermissionsLocked(pm,pi,callingUid,modeFlags)) {
    throw new SecurityException("String_Node_Str" + callingUid + "String_Node_Str"+ uri);
  }
  final List<String> SEGMENTS=uri.getPathSegments();
  if (SEGMENTS != null) {
    final int NS=SEGMENTS.size();
    int N=mGrantedUriPermissions.size();
    for (int i=0; i < N; i++) {
      HashMap<Uri,UriPermission> perms=mGrantedUriPermissions.valueAt(i);
      Iterator<UriPermission> it=perms.values().iterator();
      toploop:       while (it.hasNext()) {
        UriPermission perm=it.next();
        Uri targetUri=perm.uri;
        if (!authority.equals(targetUri.getAuthority())) {
          continue;
        }
        List<String> targetSegments=targetUri.getPathSegments();
        if (targetSegments == null) {
          continue;
        }
        if (targetSegments.size() < NS) {
          continue;
        }
        for (int j=0; j < NS; j++) {
          if (!SEGMENTS.get(j).equals(targetSegments.get(j))) {
            continue toploop;
          }
        }
        perm.clearModes(modeFlags);
        if (perm.modeFlags == 0) {
          it.remove();
        }
      }
      if (perms.size() == 0) {
        mGrantedUriPermissions.remove(mGrantedUriPermissions.keyAt(i));
        N--;
        i--;
      }
    }
  }
}

Fixed version (ground truth):
private void revokeUriPermissionLocked(int callingUid,Uri uri,int modeFlags){
  modeFlags&=(Intent.FLAG_GRANT_READ_URI_PERMISSION | Intent.FLAG_GRANT_WRITE_URI_PERMISSION);
  if (modeFlags == 0) {
    return;
  }
  if (DEBUG_URI_PERMISSION)   Log.v(TAG,"String_Node_Str" + uri);
  final IPackageManager pm=ActivityThread.getPackageManager();
  final String authority=uri.getAuthority();
  ProviderInfo pi=null;
  ContentProviderRecord cpr=(ContentProviderRecord)mProvidersByName.get(authority);
  if (cpr != null) {
    pi=cpr.info;
  }
 else {
    try {
      pi=pm.resolveContentProvider(authority,PackageManager.GET_URI_PERMISSION_PATTERNS);
    }
 catch (    RemoteException ex) {
    }
  }
  if (pi == null) {
    Log.w(TAG,"String_Node_Str" + authority);
    return;
  }
  if (!checkHoldingPermissionsLocked(pm,pi,callingUid,modeFlags)) {
    throw new SecurityException("String_Node_Str" + callingUid + "String_Node_Str"+ uri);
  }
  final List<String> SEGMENTS=uri.getPathSegments();
  if (SEGMENTS != null) {
    final int NS=SEGMENTS.size();
    int N=mGrantedUriPermissions.size();
    for (int i=0; i < N; i++) {
      HashMap<Uri,UriPermission> perms=mGrantedUriPermissions.valueAt(i);
      Iterator<UriPermission> it=perms.values().iterator();
      toploop:       while (it.hasNext()) {
        UriPermission perm=it.next();
        Uri targetUri=perm.uri;
        if (!authority.equals(targetUri.getAuthority())) {
          continue;
        }
        List<String> targetSegments=targetUri.getPathSegments();
        if (targetSegments == null) {
          continue;
        }
        if (targetSegments.size() < NS) {
          continue;
        }
        for (int j=0; j < NS; j++) {
          if (!SEGMENTS.get(j).equals(targetSegments.get(j))) {
            continue toploop;
          }
        }
        if (DEBUG_URI_PERMISSION)         Log.v(TAG,"String_Node_Str" + perm.uid + "String_Node_Str"+ perm.uri);
        perm.clearModes(modeFlags);
        if (perm.modeFlags == 0) {
          it.remove();
        }
      }
      if (perms.size() == 0) {
        mGrantedUriPermissions.remove(mGrantedUriPermissions.keyAt(i));
        N--;
        i--;
      }
    }
  }
}