#vulnerable code 
                                public void testTarFileSet() throws Exception {
        project.executeTarget("tarfileset");

        File deb = new File("target/test-classes/test.deb");
        assertTrue("package not build", deb.exists());

        ArArchiveInputStream in = new ArArchiveInputStream(new FileInputStream(deb));
        ArArchiveEntry entry;
        while ((entry = in.getNextArEntry()) != null) {
            if (entry.getName().equals("data.tar.gz")) {
                TarInputStream tar = new TarInputStream(new GZIPInputStream(new NonClosingInputStream(in)));
                TarEntry tarentry;
                while ((tarentry = tar.getNextEntry()) != null) {
                    assertTrue("prefix", tarentry.getName().startsWith("./foo/"));
                    if (tarentry.isDirectory()) {
                        assertEquals("directory mode (" + tarentry.getName() + ")", 040700, tarentry.getMode());
                    } else {
                        assertEquals("file mode (" + tarentry.getName() + ")", 0100600, tarentry.getMode());
                    }
                    assertEquals("user", "ebourg", tarentry.getUserName());
                    assertEquals("group", "ebourg", tarentry.getGroupName());
                }
                tar.close();
            } else {
                // skip to the next entry
                long skip = entry.getLength();
                while (skip > 0) {
                    long skipped = in.skip(skip);
                    if (skipped == -1) {
                        throw new IOException("Failed to skip");
                    }
                    skip -= skipped;
                }
            }
        }
        in.close();
    } 
                            #location 30 
                            #vulnerability type RESOURCE_LEAK
#fixed code
                                public void testTarFileSet() throws Exception {
        project.executeTarget("tarfileset");

        File deb = new File("target/test-classes/test.deb");
        assertTrue("package not build", deb.exists());

        ArchiveWalker.walkData(deb, new ArchiveVisitor<TarArchiveEntry>() {
            public void visit(TarArchiveEntry entry, byte[] content) throws IOException {
                assertTrue("prefix", entry.getName().startsWith("./foo/"));
                if (entry.isDirectory()) {
                    assertEquals("directory mode (" + entry.getName() + ")", 040700, entry.getMode());
                } else {
                    assertEquals("file mode (" + entry.getName() + ")", 0100600, entry.getMode());
                }
                assertEquals("user", "ebourg", entry.getUserName());
                assertEquals("group", "ebourg", entry.getGroupName());
            }
        }, Compression.GZIP);
    }