#vulnerable code 
                                public void testControlFilesVariables() throws Exception {
        File deb = new File("target/test-classes/test-control.deb");
        if (deb.exists() && !deb.delete()) {
            fail("Couldn't delete " + deb);
        }
        
        Map<String, String> variables = new HashMap<String, String>();
        variables.put("name", "jdeb");
        variables.put("version", "1.0");
        
        Processor processor = new Processor(new NullConsole(), new MapVariableResolver(variables));
        
        File controlDir = new File("target/test-classes/org/vafer/jdeb/deb/control");
        DataProducer[] producers = {new EmptyDataProducer()};
        
        processor.createDeb(controlDir.listFiles(), producers, deb, Compression.NONE);
        
        // now reopen the package and check the control files
        assertTrue("package not build", deb.exists());
        
        boolean controlFound = false;
        
        ArArchiveInputStream in = new ArArchiveInputStream(new FileInputStream(deb));
        try {
            ArArchiveEntry entry;
            while ((entry = in.getNextArEntry()) != null) {
                if (entry.getName().equals("control.tar.gz")) {
                    TarInputStream tar = new TarInputStream(new GZIPInputStream(new NonClosingInputStream(in)));
                    TarEntry tarentry;
                    while ((tarentry = tar.getNextEntry()) != null) {
                        controlFound = true;
                        
                        if (tarentry.getName().contains("postinst") || tarentry.getName().contains("prerm")) {
                            ByteArrayOutputStream bout = new ByteArrayOutputStream();
                            tar.copyEntryContents(bout);
                            
                            String content = bout.toString("ISO-8859-1");
                            
                            assertFalse("Variables not replaced in the control file " + tarentry.getName(), content.contains("[[name]] [[version]]"));
                            assertTrue("Expected variables not found in the control file " + tarentry.getName(), content.contains("jdeb 1.0"));
                        }
                    }
                    tar.close();
                } else {
                    // skip to the next entry
                    long skip = entry.getLength();
                    while (skip > 0) {
                        long skipped = in.skip(skip);
                        if (skipped == -1) {
                            throw new IOException("Failed to skip");
                        }
                        skip -= skipped;
                    }
                }
            }
        } finally {
            in.close();
        }
        
        assertTrue("Control files not found in the package", controlFound);
    } 
                            #location 28 
                            #vulnerability type RESOURCE_LEAK
#fixed code
                                public void testControlFilesVariables() throws Exception {
        File deb = new File("target/test-classes/test-control.deb");
        if (deb.exists() && !deb.delete()) {
            fail("Couldn't delete " + deb);
        }
        
        Map<String, String> variables = new HashMap<String, String>();
        variables.put("name", "jdeb");
        variables.put("version", "1.0");
        
        Processor processor = new Processor(new NullConsole(), new MapVariableResolver(variables));
        
        File controlDir = new File("target/test-classes/org/vafer/jdeb/deb/control");
        DataProducer[] producers = {new EmptyDataProducer()};
        
        processor.createDeb(controlDir.listFiles(), producers, deb, Compression.NONE);
        
        // now reopen the package and check the control files
        assertTrue("package not build", deb.exists());
                
        final AtomicBoolean controlFound = new AtomicBoolean(false);
        
        ArchiveWalker.walkControlFiles(deb, new ArchiveVisitor<TarArchiveEntry>() {
            public void visit(TarArchiveEntry entry, byte[] content) throws IOException {
                controlFound.set(true);
                
                if (entry.getName().contains("postinst") || entry.getName().contains("prerm")) {
                    String body = new String(content, "ISO-8859-1");
                    assertFalse("Variables not replaced in the control file " + entry.getName(), body.contains("[[name]] [[version]]"));
                    assertTrue("Expected variables not found in the control file " + entry.getName(), body.contains("jdeb 1.0"));
                }
            }
        });
        
        assertTrue("Control files not found in the package", controlFound.get());
    }