#fixed code
                                @Override
    public void messageReceived(ChannelHandlerContext ctx, MessageEvent me) throws Exception {
        super.messageReceived(ctx, me);
    }
#vulnerable code 
                                @Override
    public void messageReceived(ChannelHandlerContext ctx, MessageEvent me){
        if(!(me.getMessage() instanceof CoapMessage)){
            ctx.sendUpstream(me);
            return;
        }

        CoapMessage coapMessage = (CoapMessage) me.getMessage();
        if(coapMessage.getCode().isError() || coapMessage.getMessageType().equals(MsgType.RST)){
            errorMessageReceived(ctx, me);
            return;
        }

        if(me.getMessage() instanceof CoapResponse){
            CoapResponse response = (CoapResponse) me.getMessage();

            final byte[] token = response.getToken();

            BlockwiseTransfer transfer;
            //Add latest received payload to already received payload
            synchronized (incompleteResponseMonitor){
                transfer = incompleteResponsePayload.get(new ByteArrayWrapper(token));
                if(transfer != null){
                    try {
                        if(response.getBlockNumber(BLOCK_2) == transfer.getNextBlockNumber()){
                            log.debug("Received response (Token: " + (new ByteArrayWrapper(token).toHexString()) +
                                      " , Block: " + response.getBlockNumber(BLOCK_2) + "), ");

                            if (log.isDebugEnabled()){
                                //Copy Payload
                                ChannelBuffer payloadCopy = ChannelBuffers.copiedBuffer(response.getPayload());
                                byte[] bytes = new byte[payloadCopy.readableBytes()];
                                payloadCopy.getBytes(0, bytes);
                                log.debug("Payload Hex: " + new ByteArrayWrapper(bytes).toHexString());
                            }

                            transfer.getPartialPayload()
                                    .writeBytes(response.getPayload(), 0, response.getPayload().readableBytes());
                            transfer.setNextBlockNumber(transfer.getNextBlockNumber() + 1);
                        }
                        else{
                            log.debug("Received unexpected response (Token: " + (new ByteArrayWrapper(token).toHexString()) +
                                   " , Block: " + response.getBlockNumber(BLOCK_2) + "). IGNORE!");
                            me.getFuture().setSuccess();
                            return;
                        }
                    }
                    catch (InvalidOptionException e) {
                        log.error("This should never happen!", e);
                    }
                }
            }

            //Check whether payload of the response is complete
            if(transfer != null){
                try {
                    if(response.isLastBlock(BLOCK_2)){

                        //Send response with complete payload to application
                        log.debug("Block " + response.getBlockNumber(BLOCK_2) + " for response with token " +
                                new ByteArrayWrapper(token).toHexString() +
                                "  received. Payload complete. Forward to client application.");

                        response.getOptionList().removeAllOptions(BLOCK_2);

                        response.setPayload(transfer.getPartialPayload());
                        MessageEvent event = new UpstreamMessageEvent(me.getChannel(), response, me.getRemoteAddress());
                        ctx.sendUpstream(event);

                        synchronized (incompleteResponseMonitor){
                            if(incompleteResponsePayload.remove(new ByteArrayWrapper(token)) == null){
                                log.error("This should never happen! No incomplete payload found for token " +
                                    new ByteArrayWrapper(token).toHexString());
                            }
                            else{
                                log.debug("Deleted not anymore incomplete payload for token " +
                                        new ByteArrayWrapper(token).toHexString() + " from list");
                            }
                        }
                        return;

                    }
                    else{
                        final long receivedBlockNumber = response.getBlockNumber(BLOCK_2);

                        log.debug("Block " + receivedBlockNumber + " for response with token " +
                                new ByteArrayWrapper(token).toHexString() +
                                "  received. Payload (still) incomplete.");

                        CoapRequest nextCoapRequest = (CoapRequest) transfer.getCoapMessage();
                        nextCoapRequest.setMessageID(-1);
                        nextCoapRequest.setBlockOption(BLOCK_2, receivedBlockNumber + 1,
                                                       false, response.getMaxBlocksizeForResponse());


                        ChannelFuture future = Channels.future(me.getChannel());

                        future.addListener(new ChannelFutureListener() {
                            @Override
                            public void operationComplete(ChannelFuture future) throws Exception {
                                log.debug("Request for block " + (receivedBlockNumber + 1) + " for token " +
                                    new ByteArrayWrapper(token).toHexString() + " sent succesfully.");

                            }
                        });
                        MessageEvent event = new DownstreamMessageEvent(me.getChannel(),
                                future, nextCoapRequest, me.getRemoteAddress());

                        log.debug("Send request for block " + (receivedBlockNumber + 1) + " for token " +
                                new ByteArrayWrapper(token).toHexString() + ".");

                        ctx.sendDownstream(event);
                        return;
                    }
                }
                catch (InvalidOptionException e) {
                    log.error("This should never happen!", e);
                }
                catch (MessageDoesNotAllowPayloadException e) {
                    log.error("This should never happen!", e);
                }
                catch (ToManyOptionsException e){
                    log.error("This should never happen!", e);
                }
                catch (InvalidHeaderException e) {
                    log.error("This should never happen!", e);
                }
            }
        }

        ctx.sendUpstream(me);
    } 
                            #location 38 
                            #vulnerability type THREAD_SAFETY_VIOLATION