#vulnerable code 
                                private PackageDescriptor buildControl( final File[] pControlFiles, final BigInteger pDataSize, final StringBuilder pChecksums, final File pOutput ) throws IOException, ParseException {

        final File dir = pOutput.getParentFile();
        if (dir != null && (!dir.exists() || !dir.isDirectory())) {
            throw new IOException("Cannot write control file at '" + pOutput.getAbsolutePath() + "'");
        }

        final TarOutputStream outputStream = new TarOutputStream(new GZIPOutputStream(new FileOutputStream(pOutput)));
        outputStream.setLongFileMode(TarOutputStream.LONGFILE_GNU);


        // create a descriptor out of the "control" file, copy all other files, ignore directories
        PackageDescriptor packageDescriptor = null;
        for (File file : pControlFiles) {
            if (file.isDirectory()) {
                // warn about the misplaced directory, except for directories ignored by default (.svn, cvs, etc)
                boolean isDefaultExcludes = false;
                for (String pattern : DirectoryScanner.getDefaultExcludes()) {
                    isDefaultExcludes = DirectoryScanner.match(pattern, file.getAbsolutePath().replace("\\", "/"));
                    if (isDefaultExcludes) {
                        break;
                    }
                }

                if (!isDefaultExcludes) {
                    console.info("Found directory '" + file + "' in the control directory. Maybe you are pointing to wrong dir?");
                }
                continue;
            }

            final TarEntry entry = new TarEntry(file);
            final String name = file.getName();

            entry.setName("./" + name);
            entry.setNames("root", "root");
            entry.setMode(PermMapper.toMode("755"));

            if (CONFIGURATION_FILENAMES.contains(name)) {

                FilteredConfigurationFile configurationFile = new FilteredConfigurationFile(file.getName(), new FileInputStream(file), resolver);
                configurationFiles.add(configurationFile);

            } else if ("control".equals(name)) {

                packageDescriptor = new PackageDescriptor(new FileInputStream(file), resolver);

                if (packageDescriptor.get("Date") == null) {
                    // Mon, 26 Mar 2007 11:44:04 +0200 (RFC 2822)
                    SimpleDateFormat fmt = new SimpleDateFormat("EEE, d MMM yyyy HH:mm:ss Z", Locale.ENGLISH);
                    packageDescriptor.set("Date", fmt.format(new Date()));
                }

                if (packageDescriptor.get("Distribution") == null) {
                    packageDescriptor.set("Distribution", "unknown");
                }

                if (packageDescriptor.get("Urgency") == null) {
                    packageDescriptor.set("Urgency", "low");
                }

                packageDescriptor.set("Installed-Size", pDataSize.divide(BigInteger.valueOf(1024)).toString());

                final String debFullName = System.getenv("DEBFULLNAME");
                final String debEmail = System.getenv("DEBEMAIL");

                if (debFullName != null && debEmail != null) {
                    final String maintainer = debFullName + " <" + debEmail + ">";
                    packageDescriptor.set("Maintainer", maintainer);
                    console.info("Using maintainer '" + maintainer + "' from the environment variables.");
                }

            } else {

                InformationInputStream infoStream = new InformationInputStream(new FileInputStream(file));
                Utils.copy(infoStream, NullOutputStream.NULL_OUTPUT_STREAM);
                infoStream.close();

                InputStream in = new FileInputStream(file);
                if (infoStream.isShell() && !infoStream.hasUnixLineEndings()) {
                    // fix the line endings automatically
                    byte[] buf = Utils.toUnixLineEndings(in);
                    entry.setSize(buf.length);
                    in = new ByteArrayInputStream(buf);
                }

                outputStream.putNextEntry(entry);
                Utils.copy(in, outputStream);
                outputStream.closeEntry();
                in.close();
            }
        }

        if (packageDescriptor == null) {
            throw new FileNotFoundException("No 'control' found in " + Arrays.toString(pControlFiles));
        }

        for (FilteredConfigurationFile configurationFile : configurationFiles) {
            addControlEntry(configurationFile.getName(), configurationFile.toString(), outputStream);
        }
        addEntry("control", packageDescriptor.toString(), outputStream);
        addEntry("md5sums", pChecksums.toString(), outputStream);

        outputStream.close();

        return packageDescriptor;
    } 
                            #location 94 
                            #vulnerability type RESOURCE_LEAK
#fixed code
                                private PackageDescriptor buildControl( final File[] pControlFiles, final BigInteger pDataSize, final StringBuilder pChecksums, final File pOutput ) throws IOException, ParseException {

        final File dir = pOutput.getParentFile();
        if (dir != null && (!dir.exists() || !dir.isDirectory())) {
            throw new IOException("Cannot write control file at '" + pOutput.getAbsolutePath() + "'");
        }

        final TarArchiveOutputStream outputStream = new TarArchiveOutputStream(new GZIPOutputStream(new FileOutputStream(pOutput)));
        outputStream.setLongFileMode(TarArchiveOutputStream.LONGFILE_GNU);


        // create a descriptor out of the "control" file, copy all other files, ignore directories
        PackageDescriptor packageDescriptor = null;
        for (File file : pControlFiles) {
            if (file.isDirectory()) {
                // warn about the misplaced directory, except for directories ignored by default (.svn, cvs, etc)
                boolean isDefaultExcludes = false;
                for (String pattern : DirectoryScanner.getDefaultExcludes()) {
                    isDefaultExcludes = DirectoryScanner.match(pattern, file.getAbsolutePath().replace("\\", "/"));
                    if (isDefaultExcludes) {
                        break;
                    }
                }

                if (!isDefaultExcludes) {
                    console.info("Found directory '" + file + "' in the control directory. Maybe you are pointing to wrong dir?");
                }
                continue;
            }

            final TarArchiveEntry entry = new TarArchiveEntry(file);
            final String name = file.getName();

            entry.setName("./" + name);
            entry.setNames("root", "root");
            entry.setMode(PermMapper.toMode("755"));

            if (CONFIGURATION_FILENAMES.contains(name)) {

                FilteredConfigurationFile configurationFile = new FilteredConfigurationFile(file.getName(), new FileInputStream(file), resolver);
                configurationFiles.add(configurationFile);

            } else if ("control".equals(name)) {

                packageDescriptor = new PackageDescriptor(new FileInputStream(file), resolver);

                if (packageDescriptor.get("Date") == null) {
                    // Mon, 26 Mar 2007 11:44:04 +0200 (RFC 2822)
                    SimpleDateFormat fmt = new SimpleDateFormat("EEE, d MMM yyyy HH:mm:ss Z", Locale.ENGLISH);
                    packageDescriptor.set("Date", fmt.format(new Date()));
                }

                if (packageDescriptor.get("Distribution") == null) {
                    packageDescriptor.set("Distribution", "unknown");
                }

                if (packageDescriptor.get("Urgency") == null) {
                    packageDescriptor.set("Urgency", "low");
                }

                packageDescriptor.set("Installed-Size", pDataSize.divide(BigInteger.valueOf(1024)).toString());

                final String debFullName = System.getenv("DEBFULLNAME");
                final String debEmail = System.getenv("DEBEMAIL");

                if (debFullName != null && debEmail != null) {
                    final String maintainer = debFullName + " <" + debEmail + ">";
                    packageDescriptor.set("Maintainer", maintainer);
                    console.info("Using maintainer '" + maintainer + "' from the environment variables.");
                }

            } else {

                InformationInputStream infoStream = new InformationInputStream(new FileInputStream(file));
                Utils.copy(infoStream, NullOutputStream.NULL_OUTPUT_STREAM);
                infoStream.close();

                InputStream in = new FileInputStream(file);
                if (infoStream.isShell() && !infoStream.hasUnixLineEndings()) {
                    // fix the line endings automatically
                    byte[] buf = Utils.toUnixLineEndings(in);
                    entry.setSize(buf.length);
                    in = new ByteArrayInputStream(buf);
                }

                outputStream.putArchiveEntry(entry);
                Utils.copy(in, outputStream);
                outputStream.closeArchiveEntry();
                in.close();
            }
        }

        if (packageDescriptor == null) {
            throw new FileNotFoundException("No 'control' found in " + Arrays.toString(pControlFiles));
        }

        for (FilteredConfigurationFile configurationFile : configurationFiles) {
            addControlEntry(configurationFile.getName(), configurationFile.toString(), outputStream);
        }
        addEntry("control", packageDescriptor.toString(), outputStream);
        addEntry("md5sums", pChecksums.toString(), outputStream);

        outputStream.close();

        return packageDescriptor;
    }