#fixed code
                             @Override
	public String deviceHandler(CallItem anItem, MultiCommandUtil aMultiUtil, String lightId, int intensity,
			Integer targetBri,Integer targetBriInc, DeviceDescriptor device, String body) {
		Socket dataSendSocket = null;
		log.debug("executing HUE api request to TCP: " + anItem.getItem().getAsString());
		String theUrl = anItem.getItem().getAsString();
		if(theUrl != null && !theUrl.isEmpty () && theUrl.startsWith("tcp://")) {
			String intermediate = theUrl.substring(theUrl.indexOf("://") + 3);
			String hostPortion = intermediate.substring(0, intermediate.indexOf('/'));
			String theUrlBody = intermediate.substring(intermediate.indexOf('/') + 1);
			String hostAddr = null;
			String port = null;
			InetAddress IPAddress = null;
			dataSendSocket = theSockets.get(hostPortion);
			if(dataSendSocket == null) {
				if (hostPortion.contains(":")) {
					hostAddr = hostPortion.substring(0, intermediate.indexOf(':'));
					port = hostPortion.substring(intermediate.indexOf(':') + 1);
				} else
					hostAddr = hostPortion;
				try {
					IPAddress = InetAddress.getByName(hostAddr);
				} catch (UnknownHostException e) {
					// noop
				}
		
				try {
					dataSendSocket = new Socket(IPAddress, Integer.parseInt(port));
					theSockets.put(hostPortion, dataSendSocket);
				} catch (Exception e) {
					// noop
				}
			}
	
			theUrlBody = TimeDecode.replaceTimeValue(theUrlBody);
			if (theUrlBody.startsWith("0x")) {
				theUrlBody = BrightnessDecode.calculateReplaceIntensityValue(theUrlBody, intensity, targetBri, targetBriInc, true);
				sendData = DatatypeConverter.parseHexBinary(theUrlBody.substring(2));
			} else {
				theUrlBody = BrightnessDecode.calculateReplaceIntensityValue(theUrlBody, intensity, targetBri, targetBriInc, false);
				sendData = theUrlBody.getBytes();
			}
			try {
				DataOutputStream outToClient = new DataOutputStream(dataSendSocket.getOutputStream());
				outToClient.write(sendData);
				outToClient.flush();
			} catch (Exception e) {
				// noop
			}
		} else
			log.warn("Tcp Call to be presented as tcp://<ip_address>:<port>/payload, format of request unknown: " + theUrl);
		return null;
	}
#vulnerable code 
                             @Override
	public String deviceHandler(CallItem anItem, MultiCommandUtil aMultiUtil, String lightId, int intensity,
			Integer targetBri,Integer targetBriInc, DeviceDescriptor device, String body) {
		log.debug("executing HUE api request to TCP: " + anItem.getItem().getAsString());
		String theUrl = anItem.getItem().getAsString();
		if(theUrl != null && !theUrl.isEmpty () && theUrl.startsWith("tcp://")) {
			String intermediate = theUrl.substring(theUrl.indexOf("://") + 3);
			String hostPortion = intermediate.substring(0, intermediate.indexOf('/'));
			String theUrlBody = intermediate.substring(intermediate.indexOf('/') + 1);
			String hostAddr = null;
			String port = null;
			InetAddress IPAddress = null;
			if (hostPortion.contains(":")) {
				hostAddr = hostPortion.substring(0, intermediate.indexOf(':'));
				port = hostPortion.substring(intermediate.indexOf(':') + 1);
			} else
				hostAddr = hostPortion;
			try {
				IPAddress = InetAddress.getByName(hostAddr);
			} catch (UnknownHostException e) {
				// noop
			}
	
			theUrlBody = TimeDecode.replaceTimeValue(theUrlBody);
			if (theUrlBody.startsWith("0x")) {
				theUrlBody = BrightnessDecode.calculateReplaceIntensityValue(theUrlBody, intensity, targetBri, targetBriInc, true);
				sendData = DatatypeConverter.parseHexBinary(theUrlBody.substring(2));
			} else {
				theUrlBody = BrightnessDecode.calculateReplaceIntensityValue(theUrlBody, intensity, targetBri, targetBriInc, false);
				sendData = theUrlBody.getBytes();
			}
	
			try {
				Socket dataSendSocket = new Socket(IPAddress, Integer.parseInt(port));
				DataOutputStream outToClient = new DataOutputStream(dataSendSocket.getOutputStream());
				outToClient.write(sendData);
				outToClient.flush();
				dataSendSocket.close();
			} catch (Exception e) {
				// noop
			}
		} else
			log.warn("Tcp Call to be presented as tcp://<ip_address>:<port>/payload, format of request unknown: " + theUrl);
		return null;
	} 
                            #location 39 
                            #vulnerability type RESOURCE_LEAK