#vulnerable code 
                                private boolean authenticate(UserManager userManager, String value) {
        // authorization-id\0authentication-id\0passwd
        final BASE64DecoderStream stream = new BASE64DecoderStream(
                new ByteArrayInputStream(value.getBytes(StandardCharsets.UTF_8)));
        readTillNullChar(stream); // authorizationId Not used
        String authenticationId = readTillNullChar(stream);
        String passwd = readTillNullChar(stream);
        return userManager.test(authenticationId, passwd);
    } 
                            #location 7 
                            #vulnerability type RESOURCE_LEAK
#fixed code
                                private boolean authenticate(UserManager userManager, String value) {
        // authorization-id\0authentication-id\0passwd
        final SaslMessage saslMessage = SaslMessage.parse(value);
        return userManager.test(saslMessage.getAuthcid(), saslMessage.getPasswd());
    }