Program: 21995
Project: 21995
Buggy source:
void grantUriPermissionLocked(int callingUid,String targetPkg,Uri uri,int modeFlags,ActivityRecord activity){
  modeFlags&=(Intent.FLAG_GRANT_READ_URI_PERMISSION | Intent.FLAG_GRANT_WRITE_URI_PERMISSION);
  if (modeFlags == 0) {
    return;
  }
  if (DEBUG_URI_PERMISSION)   Slog.v(TAG,"String_Node_Str" + targetPkg + "String_Node_Str"+ uri);
  final IPackageManager pm=AppGlobals.getPackageManager();
  if (!ContentResolver.SCHEME_CONTENT.equals(uri.getScheme())) {
    if (DEBUG_URI_PERMISSION)     Slog.v(TAG,"String_Node_Str" + uri);
    return;
  }
  String name=uri.getAuthority();
  ProviderInfo pi=null;
  ContentProviderRecord cpr=mProvidersByName.get(name);
  if (cpr != null) {
    pi=cpr.info;
  }
 else {
    try {
      pi=pm.resolveContentProvider(name,PackageManager.GET_URI_PERMISSION_PATTERNS);
    }
 catch (    RemoteException ex) {
    }
  }
  if (pi == null) {
    Slog.w(TAG,"String_Node_Str" + name);
    return;
  }
  int targetUid;
  try {
    targetUid=pm.getPackageUid(targetPkg);
    if (targetUid < 0) {
      if (DEBUG_URI_PERMISSION)       Slog.v(TAG,"String_Node_Str" + targetPkg);
      return;
    }
  }
 catch (  RemoteException ex) {
    return;
  }
  if (checkHoldingPermissionsLocked(pm,pi,targetUid,modeFlags)) {
    if (DEBUG_URI_PERMISSION)     Slog.v(TAG,"String_Node_Str" + targetPkg + "String_Node_Str"+ uri);
    return;
  }
  if (!pi.grantUriPermissions) {
    throw new SecurityException("String_Node_Str" + pi.packageName + "String_Node_Str"+ pi.name+ "String_Node_Str"+ uri+ "String_Node_Str");
  }
  if (pi.uriPermissionPatterns != null) {
    final int N=pi.uriPermissionPatterns.length;
    boolean allowed=false;
    for (int i=0; i < N; i++) {
      if (pi.uriPermissionPatterns[i] != null && pi.uriPermissionPatterns[i].match(uri.getPath())) {
        allowed=true;
        break;
      }
    }
    if (!allowed) {
      throw new SecurityException("String_Node_Str" + pi.packageName + "String_Node_Str"+ pi.name+ "String_Node_Str"+ uri);
    }
  }
  if (!checkHoldingPermissionsLocked(pm,pi,callingUid,modeFlags)) {
    if (!checkUriPermissionLocked(uri,callingUid,modeFlags)) {
      throw new SecurityException("String_Node_Str" + callingUid + "String_Node_Str"+ uri);
    }
  }
  if (DEBUG_URI_PERMISSION)   Slog.v(TAG,"String_Node_Str" + targetPkg + "String_Node_Str"+ uri);
  HashMap<Uri,UriPermission> targetUris=mGrantedUriPermissions.get(targetUid);
  if (targetUris == null) {
    targetUris=new HashMap<Uri,UriPermission>();
    mGrantedUriPermissions.put(targetUid,targetUris);
  }
  UriPermission perm=targetUris.get(uri);
  if (perm == null) {
    perm=new UriPermission(targetUid,uri);
    targetUris.put(uri,perm);
  }
  perm.modeFlags|=modeFlags;
  if (activity == null) {
    perm.globalModeFlags|=modeFlags;
  }
 else   if ((modeFlags & Intent.FLAG_GRANT_READ_URI_PERMISSION) != 0) {
    perm.readActivities.add(activity);
    if (activity.readUriPermissions == null) {
      activity.readUriPermissions=new HashSet<UriPermission>();
    }
    activity.readUriPermissions.add(perm);
  }
 else   if ((modeFlags & Intent.FLAG_GRANT_WRITE_URI_PERMISSION) != 0) {
    perm.writeActivities.add(activity);
    if (activity.writeUriPermissions == null) {
      activity.writeUriPermissions=new HashSet<UriPermission>();
    }
    activity.writeUriPermissions.add(perm);
  }
}

Fixed version (ground truth):
void grantUriPermissionLocked(int callingUid,String targetPkg,Uri uri,int modeFlags,UriPermissionOwner owner){
  int targetUid=checkGrantUriPermissionLocked(callingUid,targetPkg,uri,modeFlags);
  if (targetUid < 0) {
    return;
  }
  grantUriPermissionUncheckedLocked(targetUid,targetPkg,uri,modeFlags,owner);
}