#fixed code
                             @Override
	public void run() {
		try {
			// Abort exit branch
			if ( abortCode != null ) {
				result.setError( new ServiceResultException( abortCode ) );
				return;
			}
			
			// Http Post
			InetSocketAddress inetAddress = UriUtil.getSocketAddress( httpsClient.connectUrl ); 
			String host = inetAddress.getHostName();
			int port = inetAddress.getPort();
			String scheme = UriUtil.getTransportProtocol( httpsClient.connectUrl );
			HttpHost httpHost = new HttpHost(host, port, scheme);
			String url = httpsClient.transportChannelSettings.getDescription().getEndpointUrl();
			String endpointId = url == null ? "" : url; //UriUtil.getEndpointName(url);
	    	httpPost = new HttpPost( endpointId );
	    	httpPost.addHeader("OPCUA-SecurityPolicy", httpsClient.securityPolicyUri);
	    	httpPost.addHeader("Content-Type", "application/octet-stream");
	    	
			// Calculate message length
	    	SizeCalculationOutputStream calcBuf = new SizeCalculationOutputStream();
	    	BinaryEncoder calc = new BinaryEncoder(calcBuf);
       		calc.setEncoderContext( httpsClient.encoderCtx );
			calc.putMessage( requestMessage );
    		int len = calcBuf.getLength();

    		// Assert max size is not exceeded
    		int maxLen = httpsClient.encoderCtx.getMaxMessageSize();
    		if ( maxLen != 0 && len > maxLen ) {
    			final EncodingException encodingException = new EncodingException(StatusCodes.Bad_EncodingLimitsExceeded, "MaxStringLength "+maxLen+" < "+len);
    			logger.warn("run: failed", encodingException);
    			throw encodingException;
    		}
			    		
	    	// Encode message
    		byte[] data = new byte[ len ];
    		BinaryEncoder enc = new BinaryEncoder( data );
    		enc.setEncoderContext( httpsClient.encoderCtx );
    		enc.putMessage( requestMessage );
    		httpPost.setEntity( new NByteArrayEntity(data) );
    		
			// Abort exit branch
			if ( abortCode != null ) {
				result.setError( new ServiceResultException( abortCode ) );
				return;
			}
			
    		// Execute Post
			
	        HttpResponse httpResponse;
			try {
				httpResponse = httpsClient.httpclient.execute( httpHost, httpPost );
			} catch (SSLPeerUnverifiedException e) {
				// Currently, TLS_1_2 is not supported by JSSE implementations, for some odd reason
				// and it will give this exception when used.
				// Also, if the server certificate is rejected, we will get this error
				result.setError( new ServiceResultException(StatusCodes.Bad_SecurityPolicyRejected, e, 
						"Could not negotiate a TLS security cipher or the server did not provide a valid certificate."));
				return;
			}
        	HttpEntity entity = httpResponse.getEntity();        	
			
	        // Error response
	        int statusCode = httpResponse.getStatusLine().getStatusCode(); 
	        if ( statusCode != 200 ) {
	        	UnsignedInteger uacode = StatusCodes.Bad_UnknownResponse;
	        	if ( statusCode == 501 ) uacode = StatusCodes.Bad_ServiceUnsupported;	        	
	        	String msg = EntityUtils.toString( entity );
	        	result.setError( new ServiceResultException( uacode, statusCode+": "+msg ) );
	        	return;
	        }
	        
			// Abort exit branch
			if ( abortCode != null ) {
				result.setError( new ServiceResultException( abortCode ) );
				return;
			}

	        // Decode Message
	        data = EntityUtils.toByteArray(entity);	        
						
			BinaryDecoder dec = new BinaryDecoder( data );			
			dec.setEncoderContext( httpsClient.encoderCtx );
			IEncodeable response = dec.getMessage();
			
			// Client sent an error
			if ( response instanceof ErrorMessage ) {
				ErrorMessage error = (ErrorMessage) response;
				ServiceResultException errorResult = new ServiceResultException(new StatusCode(error.getError()), error.getReason());
				result.setError(errorResult);
				return;
			}
		
			try {
				// Client sent a valid message
				result.setResult((ServiceResponse) response);
			} catch (ClassCastException e) {
				result.setError(new ServiceResultException(e));
				logger.error(
						"Cannot cast response to ServiceResponse, response="
								+ response.getClass(), e);
			}
		} catch (EncodingException e) {
			// Internal Error
			result.setError( new ServiceResultException( StatusCodes.Bad_EncodingError, e ) );
		} catch (ClientProtocolException e) {
			result.setError( new ServiceResultException( StatusCodes.Bad_CommunicationError, e) );
		} catch (IOException e) {
			if ( abortCode != null ) {
				result.setError( new ServiceResultException( abortCode, e ) );
			} else {
				result.setError( new ServiceResultException( StatusCodes.Bad_CommunicationError, e ) );
			}
		} catch (DecodingException e) {
			result.setError( new ServiceResultException( StatusCodes.Bad_DecodingError, e ) );
		} catch (ServiceResultException e) {
			result.setError( e );
		} catch (RuntimeException rte) {
			// http-client seems to be throwing these, IllegalArgumentException for one
			result.setError( new ServiceResultException( rte ) );
		} catch(StackOverflowError e){
			// Payloads of high nesting levels may cause stack overflow. Structure, VariantArray and DiagnosticInfo at least may cause this.
			// JVM setting -Xss influences possible level of nesting. At least 100 levels of nesting must be supported, this should not be a problem with normal thread stack sizes. 
			// Inform receiving side that error has happened.
			result.setError(new ServiceResultException(StatusCodes.Bad_DecodingError, "Stack overflow: " + Arrays.toString(Arrays.copyOf(e.getStackTrace(), 30)) + "..."));
		} finally {
			httpsClient.requests.remove( requestId );
		}
	}
#vulnerable code 
                             @Override
	public void run() {
		try {
			// Abort exit branch
			if ( abortCode != null ) {
				result.setError( new ServiceResultException( abortCode ) );
				return;
			}
			
			// Http Post
			InetSocketAddress inetAddress = UriUtil.getSocketAddress( httpsClient.connectUrl ); 
			String host = inetAddress.getHostName();
			int port = inetAddress.getPort();
			String scheme = UriUtil.getTransportProtocol( httpsClient.connectUrl );
			HttpHost httpHost = new HttpHost(host, port, scheme);
			String url = httpsClient.transportChannelSettings.getDescription().getEndpointUrl();
			String endpointId = url == null ? "" : url; //UriUtil.getEndpointName(url);
	    	httpPost = new HttpPost( endpointId );
	    	httpPost.addHeader("OPCUA-SecurityPolicy", httpsClient.securityPolicyUri);
	    	httpPost.addHeader("Content-Type", "application/octet-stream");
	    	
			// Calculate message length
	    	SizeCalculationOutputStream tmp = new SizeCalculationOutputStream();
	    	BinaryEncoder calc = new BinaryEncoder(tmp);
       		calc.setEncoderContext( httpsClient.encoderCtx );
			calc.putMessage( requestMessage );
    		int len = tmp.getLength();

    		// Assert max size is not exceeded
    		int maxLen = httpsClient.encoderCtx.getMaxMessageSize();
    		if ( maxLen != 0 && len > maxLen ) {
    			final EncodingException encodingException = new EncodingException(StatusCodes.Bad_EncodingLimitsExceeded, "MaxStringLength "+maxLen+" < "+len);
    			logger.warn("run: failed", encodingException);
    			throw encodingException;
    		}
			    		
	    	// Encode message
    		byte[] data = new byte[ len ];
    		BinaryEncoder enc = new BinaryEncoder( data );
    		enc.setEncoderContext( httpsClient.encoderCtx );
    		enc.putMessage( requestMessage );
    		httpPost.setEntity( new NByteArrayEntity(data) );
    		
			// Abort exit branch
			if ( abortCode != null ) {
				result.setError( new ServiceResultException( abortCode ) );
				return;
			}
			
    		// Execute Post
			
	        HttpResponse httpResponse;
			try {
				httpResponse = httpsClient.httpclient.execute( httpHost, httpPost );
			} catch (SSLPeerUnverifiedException e) {
				// Currently, TLS_1_2 is not supported by JSSE implementations, for some odd reason
				// and it will give this exception when used.
				// Also, if the server certificate is rejected, we will get this error
				result.setError( new ServiceResultException(StatusCodes.Bad_SecurityPolicyRejected, e, 
						"Could not negotiate a TLS security cipher or the server did not provide a valid certificate."));
				return;
			}
        	HttpEntity entity = httpResponse.getEntity();        	
			
	        // Error response
	        int statusCode = httpResponse.getStatusLine().getStatusCode(); 
	        if ( statusCode != 200 ) {
	        	UnsignedInteger uacode = StatusCodes.Bad_UnknownResponse;
	        	if ( statusCode == 501 ) uacode = StatusCodes.Bad_ServiceUnsupported;	        	
	        	String msg = EntityUtils.toString( entity );
	        	result.setError( new ServiceResultException( uacode, statusCode+": "+msg ) );
	        	return;
	        }
	        
			// Abort exit branch
			if ( abortCode != null ) {
				result.setError( new ServiceResultException( abortCode ) );
				return;
			}

	        // Decode Message
	        data = EntityUtils.toByteArray(entity);	        
						
			BinaryDecoder dec = new BinaryDecoder( data );			
			dec.setEncoderContext( httpsClient.encoderCtx );
			IEncodeable response = dec.getMessage();
			
			// Client sent an error
			if ( response instanceof ErrorMessage ) {
				ErrorMessage error = (ErrorMessage) response;
				ServiceResultException errorResult = new ServiceResultException(new StatusCode(error.getError()), error.getReason());
				result.setError(errorResult);
				return;
			}
		
			try {
				// Client sent a valid message
				result.setResult((ServiceResponse) response);
			} catch (ClassCastException e) {
				result.setError(new ServiceResultException(e));
				logger.error(
						"Cannot cast response to ServiceResponse, response="
								+ response.getClass(), e);
			}
		} catch (EncodingException e) {
			// Internal Error
			result.setError( new ServiceResultException( StatusCodes.Bad_EncodingError, e ) );
		} catch (ClientProtocolException e) {
			result.setError( new ServiceResultException( StatusCodes.Bad_CommunicationError, e) );
		} catch (IOException e) {
			if ( abortCode != null ) {
				result.setError( new ServiceResultException( abortCode, e ) );
			} else {
				result.setError( new ServiceResultException( StatusCodes.Bad_CommunicationError, e ) );
			}
		} catch (DecodingException e) {
			result.setError( new ServiceResultException( StatusCodes.Bad_DecodingError, e ) );
		} catch (ServiceResultException e) {
			result.setError( e );
		} catch (RuntimeException rte) {
			// http-client seems to be throwing these, IllegalArgumentException for one
			result.setError( new ServiceResultException( rte ) );
		} catch(StackOverflowError e){
			// Payloads of high nesting levels may cause stack overflow. Structure, VariantArray and DiagnosticInfo at least may cause this.
			// JVM setting -Xss influences possible level of nesting. At least 100 levels of nesting must be supported, this should not be a problem with normal thread stack sizes. 
			// Inform receiving side that error has happened.
			result.setError(new ServiceResultException(StatusCodes.Bad_DecodingError, "Stack overflow: " + Arrays.toString(Arrays.copyOf(e.getStackTrace(), 30)) + "..."));
		} finally {
			httpsClient.requests.remove( requestId );
		}
	} 
                            #location 27 
                            #vulnerability type RESOURCE_LEAK