Program: 93786
Project: 93786
Buggy source:
/** 
 * Creates a   {@link SecureDexClassLoader} that finds interpreted and native code in a set ofprovided locations (either local or remote via HTTP or HTTPS) in dexPath. Interpreted classes are found in a set of DEX files contained in Jar or Apk files and  stored into an application-private, writable directory. Before executing one of these classes the signature of the target class is  verified against the certificate associated with its package name. Certificates location are provided by filling appropriately  {@link packageNameToCertificateMap}}; each package name must be linked with the remote location of the certificate that should be used to validate all the classes of that package. It's important  that each one of these locations uses HTTPS as its protocol; otherwise this  choice will be enforced! If a class package name do not match any of the provided entries in the map,  certificate location will be constructed by simply reverting package name and  transforming it into a web-based URL using HTTPS. Note that this method returns null if no matching Jar or Apk file is found at the provided dexPath parameter; otherwise a   {@link SecureDexClassLoader} instance is returned.Dynamic class loading with the returned  {@link SecureDexClassLoader} will fail whetherat least one of these conditions is not accomplished: target class is not found in dexPath or is in a missing remote container (i.e. Internet connectivity is not present), missing or invalid (i.e. expired) certificate is associated with the package name of the target class, target class signature check fails against the associated certificate.
 * @param dexPath the list of jar/apk files containing classes and resources; these paths could be either local URLs pointing to a location in the device or URLs that links to a resource stored in the web via HTTP/HTTPS. In the latter case, if Internet connectivity is available, the resource will be imported in a private-application  directory before being used.
 * @param libraryPath the list of directories containing native libraries; it may be null
 * @param packageNameToCertificateMap a map that couples each package name to a URL which contains the certificate that must be used to validate all the classes that belong to that package before launching them at run time.
 * @param parent the parent class loader
 * @return secureDexClassLoader
 */
public SecureDexClassLoader createDexClassLoader(String dexPath,String libraryPath,Map<String,String> packageNameToCertificateMap,ClassLoader parent){
  StringBuilder finalDexPath=new StringBuilder();
  String[] strings=dexPath.split(Pattern.quote(File.pathSeparator));
  File resDownloadDir=null;
  boolean isResourceFolderInitialized=false;
  for (  String path : strings) {
    if (path.startsWith("String_Node_Str") || path.startsWith("String_Node_Str")) {
      if (!isResourceFolderInitialized) {
        resDownloadDir=mContextWrapper.getDir("String_Node_Str",ContextWrapper.MODE_PRIVATE);
        Log.i(TAG_SECURE_FACTORY,"String_Node_Str" + resDownloadDir.getAbsolutePath());
        isResourceFolderInitialized=true;
      }
      String downloadedContainerPath=downloadContainerIntoFolder(path,resDownloadDir);
      if (downloadedContainerPath != null) {
        finalDexPath.append(downloadedContainerPath + Pattern.quote(File.pathSeparator));
        Log.i(TAG_SECURE_FACTORY,"String_Node_Str" + finalDexPath);
      }
    }
 else {
      finalDexPath.append(path + Pattern.quote(File.pathSeparator));
    }
  }
  finalDexPath.deleteCharAt(finalDexPath.lastIndexOf(Pattern.quote(File.pathSeparator)));
  File dexOutputDir=mContextWrapper.getDir("String_Node_Str",ContextWrapper.MODE_PRIVATE);
  Log.i(TAG_SECURE_FACTORY,"String_Node_Str" + dexOutputDir.getAbsolutePath());
  Map<String,String> santiziedPackageNameToCertificateMap=sanitizePackageNameToCertificateMap(packageNameToCertificateMap);
  SecureDexClassLoader mSecureDexClassLoader=new SecureDexClassLoader(finalDexPath.toString(),dexOutputDir.getAbsolutePath(),libraryPath,parent,mContextWrapper);
  if (mSecureDexClassLoader != null)   mSecureDexClassLoader.setCertificateLocationMap(santiziedPackageNameToCertificateMap);
  return mSecureDexClassLoader;
}

Fixed version (ground truth):
/** 
 * Creates a   {@link SecureDexClassLoader} that finds interpreted and native code in a set ofprovided locations (either local or remote via HTTP or HTTPS) in dexPath. Interpreted classes are found in a set of DEX files contained in Jar or Apk files and  stored into an application-private, writable directory. Before executing one of these classes the signature of the target class is  verified against the certificate associated with its package name. Certificates location are provided by filling appropriately  {@link packageNameToCertificateMap}}; each package name must be linked with the remote location of the certificate that should be used to validate all the classes of that package. It's important  that each one of these locations uses HTTPS as its protocol; otherwise this  choice will be enforced! If a class package name do not match any of the provided entries in the map,  certificate location will be constructed by simply reverting package name and  transforming it into a web-based URL using HTTPS. Note that this method returns null if no matching Jar or Apk file is found at the provided dexPath parameter; otherwise a   {@link SecureDexClassLoader} instance is returned.Dynamic class loading with the returned  {@link SecureDexClassLoader} will fail whetherat least one of these conditions is not accomplished: target class is not found in dexPath or is in a missing remote container (i.e. Internet connectivity is not present), missing or invalid (i.e. expired) certificate is associated with the package name of the target class, target class signature check fails against the associated certificate.
 * @param dexPath the list of jar/apk files containing classes and resources; these paths could be either local URLs pointing to a location in the device or URLs that links to a resource stored in the web via HTTP/HTTPS. In the latter case, if Internet connectivity is available, the resource will be imported in a private-application  directory before being used.
 * @param libraryPath the list of directories containing native libraries; it may be null
 * @param packageNameToCertificateMap a map that couples each package name to a URL which contains the certificate that must be used to validate all the classes that belong to that package before launching them at run time.
 * @param parent the parent class loader
 * @return secureDexClassLoader
 */
public SecureDexClassLoader createDexClassLoader(String dexPath,String libraryPath,Map<String,String> packageNameToCertificateMap,ClassLoader parent){
  StringBuilder finalDexPath=new StringBuilder();
  String tempPath=dexPath.replaceAll("String_Node_Str","String_Node_Str");
  tempPath=tempPath.replaceAll("String_Node_Str","String_Node_Str");
  String[] strings=tempPath.split(Pattern.quote(File.pathSeparator));
  File resDownloadDir=null;
  boolean isResourceFolderInitialized=false;
  for (  String path : strings) {
    if (path.startsWith("String_Node_Str") || path.startsWith("String_Node_Str")) {
      String fixedPath=path.replaceAll("String_Node_Str","String_Node_Str");
      fixedPath=fixedPath.replaceAll("String_Node_Str","String_Node_Str");
      if (!isResourceFolderInitialized) {
        resDownloadDir=mContextWrapper.getDir("String_Node_Str",ContextWrapper.MODE_PRIVATE);
        Log.i(TAG_SECURE_FACTORY,"String_Node_Str" + resDownloadDir.getAbsolutePath());
        isResourceFolderInitialized=true;
      }
      String downloadedContainerPath=downloadContainerIntoFolder(fixedPath,resDownloadDir);
      if (downloadedContainerPath != null) {
        finalDexPath.append(downloadedContainerPath + File.pathSeparator);
        Log.i(TAG_SECURE_FACTORY,"String_Node_Str" + finalDexPath);
      }
    }
 else {
      finalDexPath.append(path + File.pathSeparator);
    }
  }
  finalDexPath.deleteCharAt(finalDexPath.lastIndexOf(File.pathSeparator));
  File dexOutputDir=mContextWrapper.getDir("String_Node_Str",ContextWrapper.MODE_PRIVATE);
  Log.i(TAG_SECURE_FACTORY,"String_Node_Str" + dexOutputDir.getAbsolutePath());
  Map<String,String> santiziedPackageNameToCertificateMap=sanitizePackageNameToCertificateMap(packageNameToCertificateMap);
  SecureDexClassLoader mSecureDexClassLoader=new SecureDexClassLoader(finalDexPath.toString(),dexOutputDir.getAbsolutePath(),libraryPath,parent,mContextWrapper);
  if (mSecureDexClassLoader != null)   mSecureDexClassLoader.setCertificateLocationMap(santiziedPackageNameToCertificateMap);
  return mSecureDexClassLoader;
}