Program: 22701
Project: 22701
Buggy source:
private void grantPermissionsLP(PackageParser.Package pkg,boolean replace){
  final PackageSetting ps=(PackageSetting)pkg.mExtras;
  if (ps == null) {
    return;
  }
  final GrantedPermissions gp=ps.sharedUser != null ? ps.sharedUser : ps;
  boolean changedPermission=false;
  if (replace) {
    ps.permissionsFixed=false;
    if (gp == ps) {
      gp.grantedPermissions.clear();
      gp.gids=mGlobalGids;
    }
  }
  if (gp.gids == null) {
    gp.gids=mGlobalGids;
  }
  final int N=pkg.requestedPermissions.size();
  for (int i=0; i < N; i++) {
    String name=pkg.requestedPermissions.get(i);
    BasePermission bp=mSettings.mPermissions.get(name);
    if (false) {
      if (gp != ps) {
        Log.i(TAG,"String_Node_Str" + pkg.packageName + "String_Node_Str"+ name+ "String_Node_Str"+ bp);
      }
    }
    if (bp != null && bp.packageSetting != null) {
      final String perm=bp.name;
      boolean allowed;
      boolean allowedSig=false;
      if (bp.protectionLevel == PermissionInfo.PROTECTION_NORMAL || bp.protectionLevel == PermissionInfo.PROTECTION_DANGEROUS) {
        allowed=true;
      }
 else       if (bp.protectionLevel == PermissionInfo.PROTECTION_SIGNATURE || bp.protectionLevel == PermissionInfo.PROTECTION_SIGNATURE_OR_SYSTEM) {
        allowed=(checkSignaturesLP(bp.packageSetting.signatures.mSignatures,pkg.mSignatures) == PackageManager.SIGNATURE_MATCH) || (checkSignaturesLP(mPlatformPackage.mSignatures,pkg.mSignatures) == PackageManager.SIGNATURE_MATCH);
        if (bp.protectionLevel == PermissionInfo.PROTECTION_SIGNATURE_OR_SYSTEM) {
          if ((pkg.applicationInfo.flags & ApplicationInfo.FLAG_SYSTEM) != 0) {
            if ((pkg.applicationInfo.flags & ApplicationInfo.FLAG_UPDATED_SYSTEM_APP) != 0) {
              PackageSetting sysPs=mSettings.getDisabledSystemPkg(pkg.packageName);
              if (sysPs.grantedPermissions.contains(perm)) {
                allowed=true;
              }
 else {
                allowed=false;
              }
            }
 else {
              allowed=true;
            }
          }
        }
        if (allowed) {
          allowedSig=true;
        }
      }
 else {
        allowed=false;
      }
      if (false) {
        if (gp != ps) {
          Log.i(TAG,"String_Node_Str" + pkg.packageName + "String_Node_Str"+ perm);
        }
      }
      if (allowed) {
        if ((ps.pkgFlags & ApplicationInfo.FLAG_SYSTEM) == 0 && ps.permissionsFixed) {
          if (!allowedSig && !gp.grantedPermissions.contains(perm)) {
            allowed=false;
            final int NP=PackageParser.NEW_PERMISSIONS.length;
            for (int ip=0; ip < NP; ip++) {
              final PackageParser.NewPermissionInfo npi=PackageParser.NEW_PERMISSIONS[ip];
              if (npi.name.equals(perm) && pkg.applicationInfo.targetSdkVersion < npi.sdkVersion) {
                allowed=true;
                Log.i(TAG,"String_Node_Str" + perm + "String_Node_Str"+ pkg.packageName);
                break;
              }
            }
          }
        }
        if (allowed) {
          if (!gp.grantedPermissions.contains(perm)) {
            changedPermission=true;
            gp.grantedPermissions.add(perm);
            gp.gids=appendInts(gp.gids,bp.gids);
          }
        }
 else {
          Slog.w(TAG,"String_Node_Str" + perm + "String_Node_Str"+ pkg.packageName+ "String_Node_Str");
        }
      }
 else {
        if (gp.grantedPermissions.remove(perm)) {
          changedPermission=true;
          gp.gids=removeInts(gp.gids,bp.gids);
          Slog.i(TAG,"String_Node_Str" + perm + "String_Node_Str"+ pkg.packageName+ "String_Node_Str"+ bp.protectionLevel+ "String_Node_Str"+ Integer.toHexString(pkg.applicationInfo.flags)+ "String_Node_Str");
        }
 else {
          Slog.w(TAG,"String_Node_Str" + perm + "String_Node_Str"+ pkg.packageName+ "String_Node_Str"+ bp.protectionLevel+ "String_Node_Str"+ Integer.toHexString(pkg.applicationInfo.flags)+ "String_Node_Str");
        }
      }
    }
 else {
      Slog.w(TAG,"String_Node_Str" + name + "String_Node_Str"+ pkg.packageName);
    }
  }
  if ((changedPermission || replace) && !ps.permissionsFixed && ((ps.pkgFlags & ApplicationInfo.FLAG_SYSTEM) == 0) || ((ps.pkgFlags & ApplicationInfo.FLAG_UPDATED_SYSTEM_APP) != 0)) {
    ps.permissionsFixed=true;
  }
}

Fixed version (ground truth):
private void grantPermissionsLP(PackageParser.Package pkg,boolean replace){
  final PackageSetting ps=(PackageSetting)pkg.mExtras;
  if (ps == null) {
    return;
  }
  final GrantedPermissions gp=ps.sharedUser != null ? ps.sharedUser : ps;
  boolean changedPermission=false;
  if (replace) {
    ps.permissionsFixed=false;
    if (gp == ps) {
      gp.grantedPermissions.clear();
      gp.gids=mGlobalGids;
    }
  }
  if (gp.gids == null) {
    gp.gids=mGlobalGids;
  }
  final int N=pkg.requestedPermissions.size();
  for (int i=0; i < N; i++) {
    String name=pkg.requestedPermissions.get(i);
    BasePermission bp=mSettings.mPermissions.get(name);
    if (false) {
      if (gp != ps) {
        Log.i(TAG,"String_Node_Str" + pkg.packageName + "String_Node_Str"+ name+ "String_Node_Str"+ bp);
      }
    }
    if (bp != null && bp.packageSetting != null) {
      final String perm=bp.name;
      boolean allowed;
      boolean allowedSig=false;
      if (bp.protectionLevel == PermissionInfo.PROTECTION_NORMAL || bp.protectionLevel == PermissionInfo.PROTECTION_DANGEROUS) {
        allowed=true;
      }
 else       if (bp.protectionLevel == PermissionInfo.PROTECTION_SIGNATURE || bp.protectionLevel == PermissionInfo.PROTECTION_SIGNATURE_OR_SYSTEM) {
        allowed=(checkSignaturesLP(bp.packageSetting.signatures.mSignatures,pkg.mSignatures) == PackageManager.SIGNATURE_MATCH) || (checkSignaturesLP(mPlatformPackage.mSignatures,pkg.mSignatures) == PackageManager.SIGNATURE_MATCH);
        if (bp.protectionLevel == PermissionInfo.PROTECTION_SIGNATURE_OR_SYSTEM) {
          if ((pkg.applicationInfo.flags & ApplicationInfo.FLAG_SYSTEM) != 0) {
            if ((pkg.applicationInfo.flags & ApplicationInfo.FLAG_UPDATED_SYSTEM_APP) != 0) {
              PackageSetting sysPs=mSettings.getDisabledSystemPkg(pkg.packageName);
              if (sysPs.grantedPermissions.contains(perm)) {
                allowed=true;
              }
 else {
                allowed=false;
              }
            }
 else {
              allowed=true;
            }
          }
        }
        if (allowed) {
          allowedSig=true;
        }
      }
 else {
        allowed=false;
      }
      if (false) {
        if (gp != ps) {
          Log.i(TAG,"String_Node_Str" + pkg.packageName + "String_Node_Str"+ perm);
        }
      }
      if (allowed) {
        if ((ps.pkgFlags & ApplicationInfo.FLAG_SYSTEM) == 0 && ps.permissionsFixed) {
          if (!allowedSig && !gp.grantedPermissions.contains(perm)) {
            allowed=false;
            final int NP=PackageParser.NEW_PERMISSIONS.length;
            for (int ip=0; ip < NP; ip++) {
              final PackageParser.NewPermissionInfo npi=PackageParser.NEW_PERMISSIONS[ip];
              if (npi.name.equals(perm) && pkg.applicationInfo.targetSdkVersion < npi.sdkVersion) {
                allowed=true;
                Log.i(TAG,"String_Node_Str" + perm + "String_Node_Str"+ pkg.packageName);
                break;
              }
            }
          }
        }
        if (allowed) {
          if (!gp.grantedPermissions.contains(perm)) {
            changedPermission=true;
            gp.grantedPermissions.add(perm);
            gp.gids=appendInts(gp.gids,bp.gids);
          }
 else           if (!ps.haveGids) {
            gp.gids=appendInts(gp.gids,bp.gids);
          }
        }
 else {
          Slog.w(TAG,"String_Node_Str" + perm + "String_Node_Str"+ pkg.packageName+ "String_Node_Str");
        }
      }
 else {
        if (gp.grantedPermissions.remove(perm)) {
          changedPermission=true;
          gp.gids=removeInts(gp.gids,bp.gids);
          Slog.i(TAG,"String_Node_Str" + perm + "String_Node_Str"+ pkg.packageName+ "String_Node_Str"+ bp.protectionLevel+ "String_Node_Str"+ Integer.toHexString(pkg.applicationInfo.flags)+ "String_Node_Str");
        }
 else {
          Slog.w(TAG,"String_Node_Str" + perm + "String_Node_Str"+ pkg.packageName+ "String_Node_Str"+ bp.protectionLevel+ "String_Node_Str"+ Integer.toHexString(pkg.applicationInfo.flags)+ "String_Node_Str");
        }
      }
    }
 else {
      Slog.w(TAG,"String_Node_Str" + name + "String_Node_Str"+ pkg.packageName);
    }
  }
  if ((changedPermission || replace) && !ps.permissionsFixed && ((ps.pkgFlags & ApplicationInfo.FLAG_SYSTEM) == 0) || ((ps.pkgFlags & ApplicationInfo.FLAG_UPDATED_SYSTEM_APP) != 0)) {
    ps.permissionsFixed=true;
  }
  ps.haveGids=true;
}