Program: 89554
Project: 89554
Buggy source:
@Override @ActionEvent(eventType=EventTypes.EVENT_USER_UPDATE,eventDescription="String_Node_Str") public UserAccount updateUser(UpdateUserCmd cmd){
  Long id=cmd.getId();
  String apiKey=cmd.getApiKey();
  String firstName=cmd.getFirstname();
  String email=cmd.getEmail();
  String lastName=cmd.getLastname();
  String password=cmd.getPassword();
  String secretKey=cmd.getSecretKey();
  String timeZone=cmd.getTimezone();
  String userName=cmd.getUsername();
  UserVO user=_userDao.getUser(id);
  if (user == null) {
    throw new InvalidParameterValueException("String_Node_Str");
  }
  if ((apiKey == null && secretKey != null) || (apiKey != null && secretKey == null)) {
    throw new InvalidParameterValueException("String_Node_Str");
  }
  Account account=_accountDao.findById(user.getAccountId());
  if (account != null && (account.getId() == Account.ACCOUNT_ID_SYSTEM)) {
    throw new PermissionDeniedException("String_Node_Str" + id + "String_Node_Str");
  }
  checkAccess(UserContext.current().getCaller(),account);
  if (firstName == null) {
    firstName=user.getFirstname();
  }
  if (lastName == null) {
    lastName=user.getLastname();
  }
  if (userName == null) {
    userName=user.getUsername();
  }
  if (password == null) {
    password=user.getPassword();
  }
  if (email == null) {
    email=user.getEmail();
  }
  if (timeZone == null) {
    timeZone=user.getTimezone();
  }
  if (apiKey == null) {
    apiKey=user.getApiKey();
  }
  if (secretKey == null) {
    secretKey=user.getSecretKey();
  }
  Long accountId=user.getAccountId();
  if (s_logger.isDebugEnabled()) {
    s_logger.debug("String_Node_Str" + id);
  }
  try {
    if (apiKey != null && secretKey != null) {
      Pair<User,Account> apiKeyOwner=_accountDao.findUserAccountByApiKey(apiKey);
      if (apiKeyOwner != null) {
        User usr=apiKeyOwner.first();
        if (usr.getId() != id) {
          throw new InvalidParameterValueException("String_Node_Str" + apiKey + "String_Node_Str"+ id+ "String_Node_Str");
        }
 else {
        }
      }
    }
    _userDao.update(id,userName,password,firstName,lastName,email,accountId,timeZone,apiKey,secretKey);
  }
 catch (  Throwable th) {
    s_logger.error("String_Node_Str",th);
    throw new CloudRuntimeException("String_Node_Str" + id);
  }
  return _userAccountDao.findById(id);
}

Fixed version (ground truth):
@Override @ActionEvent(eventType=EventTypes.EVENT_USER_UPDATE,eventDescription="String_Node_Str") public UserAccount updateUser(UpdateUserCmd cmd){
  Long id=cmd.getId();
  String apiKey=cmd.getApiKey();
  String firstName=cmd.getFirstname();
  String email=cmd.getEmail();
  String lastName=cmd.getLastname();
  String password=cmd.getPassword();
  String secretKey=cmd.getSecretKey();
  String timeZone=cmd.getTimezone();
  String userName=cmd.getUsername();
  long callerUserId=UserContext.current().getCallerUserId();
  UserVO user=_userDao.getUser(id);
  if (user == null) {
    throw new InvalidParameterValueException("String_Node_Str");
  }
  if (apiKey != null) {
    Long apiKeyOwnerId=null;
    Pair<User,Account> apiKeyOwner=_accountDao.findUserAccountByApiKey(apiKey);
    if (apiKeyOwner != null) {
      apiKeyOwnerId=apiKeyOwner.first().getId();
    }
    if ((apiKeyOwnerId == null || callerUserId != apiKeyOwnerId) && secretKey == null) {
      throw new InvalidParameterValueException("String_Node_Str");
    }
 else     if (apiKeyOwnerId != null && callerUserId == apiKeyOwnerId && id != callerUserId) {
      apiKey=null;
    }
  }
  if (apiKey == null && secretKey != null) {
    throw new InvalidParameterValueException("String_Node_Str");
  }
  Account account=_accountDao.findById(user.getAccountId());
  if (account != null && (account.getId() == Account.ACCOUNT_ID_SYSTEM)) {
    throw new PermissionDeniedException("String_Node_Str" + id + "String_Node_Str");
  }
  checkAccess(UserContext.current().getCaller(),account);
  if (firstName == null) {
    firstName=user.getFirstname();
  }
  if (lastName == null) {
    lastName=user.getLastname();
  }
  if (userName == null) {
    userName=user.getUsername();
  }
  if (password == null) {
    password=user.getPassword();
  }
  if (email == null) {
    email=user.getEmail();
  }
  if (timeZone == null) {
    timeZone=user.getTimezone();
  }
  if (apiKey == null) {
    apiKey=user.getApiKey();
  }
  if (secretKey == null) {
    secretKey=user.getSecretKey();
  }
  Long accountId=user.getAccountId();
  if (s_logger.isDebugEnabled()) {
    s_logger.debug("String_Node_Str" + id);
  }
  try {
    if (apiKey != null && secretKey != null) {
      Pair<User,Account> apiKeyOwner=_accountDao.findUserAccountByApiKey(apiKey);
      if (apiKeyOwner != null) {
        User usr=apiKeyOwner.first();
        if (usr.getId() != id) {
          throw new InvalidParameterValueException("String_Node_Str" + apiKey + "String_Node_Str"+ id+ "String_Node_Str");
        }
 else {
        }
      }
    }
    _userDao.update(id,userName,password,firstName,lastName,email,accountId,timeZone,apiKey,secretKey);
  }
 catch (  Throwable th) {
    s_logger.error("String_Node_Str",th);
    throw new CloudRuntimeException("String_Node_Str" + id);
  }
  return _userAccountDao.findById(id);
}