#vulnerable code 
                                @Test
    public void testCallableStatement() {
        Database db = DatabaseCreator.createDerby(1);
        db.apply(con -> {
            try (Statement stmt = con.createStatement()) {
                stmt.execute(
                        "create table app.person (name varchar(50) primary key, score int not null)");
                stmt.execute(
                        "call sqlj.install_jar('target/rxjava2-jdbc-stored-procedure.jar', 'APP.examples',0)");

                String sql = "CREATE PROCEDURE APP.GETPERSONCOUNT" //
                        + " (IN MIN_SCORE INTEGER," //
                        + " OUT COUNT INTEGER)" //
                        + " PARAMETER STYLE JAVA" //
                        + " LANGUAGE JAVA" //
                        + " EXTERNAL NAME" //
                        + " 'org.davidmoten.rx.jdbc.StoredProcExample.getPersonCount'";
                stmt.execute(sql);
                stmt.execute("CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY("
                        + "'derby.database.classpath', 'APP.examples')");
                CallableStatement st = con.prepareCall("call getPersonCount(?, ?)");
                st.setInt(1, 0);
                st.registerOutParameter(2, Types.INTEGER);
                st.execute();
                assertEquals(0, st.getInt(2));
            }
        }).blockingAwait(TIMEOUT_SECONDS, TimeUnit.SECONDS);
    } 
                            #location 4 
                            #vulnerability type RESOURCE_LEAK
#fixed code
                                @Test
    public void testCallableStatement() {
        Database db = DatabaseCreator.createDerbyWithStoredProcs(1);
        db.apply(con -> {
            try (Statement stmt = con.createStatement()) {
                CallableStatement st = con.prepareCall("call getPersonCount(?, ?)");
                st.setInt(1, 0);
                st.registerOutParameter(2, Types.INTEGER);
                st.execute();
                assertEquals(2, st.getInt(2));
            }
        }).blockingAwait(TIMEOUT_SECONDS, TimeUnit.SECONDS);
    }