#vulnerable code 
                                private PackageDescriptor buildControl( final File[] pControlFiles, final BigInteger pDataSize, final StringBuilder pChecksums, final File pOutput ) throws IOException, ParseException {

        if (!pOutput.canWrite()) {
            throw new IOException("Cannot write control file at '" + pOutput + "'");
        }

        final TarOutputStream outputStream = new TarOutputStream(new GZIPOutputStream(new FileOutputStream(pOutput)));
        outputStream.setLongFileMode(TarOutputStream.LONGFILE_GNU);

        // create a descriptor out of the "control" file, copy all other files, ignore directories
        PackageDescriptor packageDescriptor = null;
        for (int i = 0; i < pControlFiles.length; i++) {
            final File file = pControlFiles[i];

            if (file.isDirectory()) {
                console.println("Found directory '" + file + "' in the control directory. Maybe you are pointing to wrong dir?");
                continue;
            }

            final TarEntry entry = new TarEntry(file);
            final String name = file.getName();

            entry.setName("./" + name);
            entry.setNames("root", "root");
            entry.setMode(PermMapper.toMode("755"));

            if ("control".equals(name)) {

                packageDescriptor = new PackageDescriptor(new FileInputStream(file), resolver);

                if (packageDescriptor.get("Date") == null) {
                    // Mon, 26 Mar 2007 11:44:04 +0200 (RFC 2822)
                    SimpleDateFormat fmt = new SimpleDateFormat("EEE, d MMM yyyy HH:mm:ss Z", Locale.ENGLISH);
                    packageDescriptor.set("Date", fmt.format(new Date()));
                }

                if (packageDescriptor.get("Distribution") == null) {
                    packageDescriptor.set("Distribution", "unknown");
                }

                if (packageDescriptor.get("Urgency") == null) {
                    packageDescriptor.set("Urgency", "low");
                }

                packageDescriptor.set("Installed-Size", pDataSize.divide(BigInteger.valueOf(1024)).toString());

                final String debFullName = System.getenv("DEBFULLNAME");
                final String debEmail = System.getenv("DEBEMAIL");

                if (debFullName != null && debEmail != null) {
                    final String maintainer = debFullName + " <" + debEmail + ">";
                    packageDescriptor.set("Maintainer", maintainer);
                    console.println("Using maintainer '" + maintainer + "' from the environment variables.");
                }

            } else {

                // FIXME: usually the control directory should only have text files/shell scripts
                // we convert all of them to unix line endings here. This could screw up binaries.
                // better to have binary/text detection here.

                final byte[] data = Utils.toUnixLineEndings(new FileInputStream(file)); 
                
                entry.setSize(data.length);
                outputStream.putNextEntry(entry);
                outputStream.write(data);
                outputStream.closeEntry();
            }
        }

        if (packageDescriptor == null) {
            throw new FileNotFoundException("No 'control' found in " + Arrays.toString(pControlFiles));
        }

        addEntry("control", packageDescriptor.toString(), outputStream);
        addEntry("md5sums", pChecksums.toString(), outputStream);

        outputStream.close();

        return packageDescriptor;
    } 
                            #location 62 
                            #vulnerability type RESOURCE_LEAK
#fixed code
                                private PackageDescriptor buildControl( final File[] pControlFiles, final BigInteger pDataSize, final StringBuilder pChecksums, final File pOutput ) throws IOException, ParseException {

        if (!pOutput.canWrite()) {
            throw new IOException("Cannot write control file at '" + pOutput + "'");
        }

        final TarOutputStream outputStream = new TarOutputStream(new GZIPOutputStream(new FileOutputStream(pOutput)));
        outputStream.setLongFileMode(TarOutputStream.LONGFILE_GNU);

        // create a descriptor out of the "control" file, copy all other files, ignore directories
        PackageDescriptor packageDescriptor = null;
        for (int i = 0; i < pControlFiles.length; i++) {
            final File file = pControlFiles[i];

            if (file.isDirectory()) {
                console.println("Found directory '" + file + "' in the control directory. Maybe you are pointing to wrong dir?");
                continue;
            }

            final TarEntry entry = new TarEntry(file);
            final String name = file.getName();

            entry.setName("./" + name);
            entry.setNames("root", "root");
            entry.setMode(PermMapper.toMode("755"));

            if ("control".equals(name)) {

                packageDescriptor = new PackageDescriptor(new FileInputStream(file), resolver);

                if (packageDescriptor.get("Date") == null) {
                    // Mon, 26 Mar 2007 11:44:04 +0200 (RFC 2822)
                    SimpleDateFormat fmt = new SimpleDateFormat("EEE, d MMM yyyy HH:mm:ss Z", Locale.ENGLISH);
                    packageDescriptor.set("Date", fmt.format(new Date()));
                }

                if (packageDescriptor.get("Distribution") == null) {
                    packageDescriptor.set("Distribution", "unknown");
                }

                if (packageDescriptor.get("Urgency") == null) {
                    packageDescriptor.set("Urgency", "low");
                }

                packageDescriptor.set("Installed-Size", pDataSize.divide(BigInteger.valueOf(1024)).toString());

                final String debFullName = System.getenv("DEBFULLNAME");
                final String debEmail = System.getenv("DEBEMAIL");

                if (debFullName != null && debEmail != null) {
                    final String maintainer = debFullName + " <" + debEmail + ">";
                    packageDescriptor.set("Maintainer", maintainer);
                    console.println("Using maintainer '" + maintainer + "' from the environment variables.");
                }

            } else {

                final InformationInputStream infoStream = new InformationInputStream(new FileInputStream(file));
                
                outputStream.putNextEntry(entry);
                Utils.copy(infoStream, outputStream);
                outputStream.closeEntry();

                if (infoStream.isShell() && !infoStream.hasUnixLineEndings()) {
                    console.println("WARNING: The file '" + file + "' does not use Unix line endings. Please convert and check your VCS settings.");
                }
            }
        }

        if (packageDescriptor == null) {
            throw new FileNotFoundException("No 'control' found in " + Arrays.toString(pControlFiles));
        }

        addEntry("control", packageDescriptor.toString(), outputStream);
        addEntry("md5sums", pChecksums.toString(), outputStream);

        outputStream.close();

        return packageDescriptor;
    }