#vulnerable code 
                                public void setFactory(KeyedPoolableObjectFactory factory) throws IllegalStateException {
        Map toDestroy = new HashMap();
        synchronized (this) {
            assertOpen();
            if (0 < getNumActive()) {
                throw new IllegalStateException("Objects are already active");
            } else {
                for (Iterator it = _poolMap.keySet().iterator(); it.hasNext();) {
                    Object key = it.next();
                    ObjectQueue pool = (ObjectQueue)_poolMap.get(key);
                    if (pool != null) {
                        // Copy objects to new list so pool.queue can be cleared
                        // inside the sync
                        List objects = new ArrayList();
                        objects.addAll(pool.queue);
                        toDestroy.put(key, objects);
                        it.remove();
                        _poolList.remove(key);
                        _totalIdle = _totalIdle - pool.queue.size();
                        _totalInternalProcessing =
                            _totalInternalProcessing + pool.queue.size();
                        pool.queue.clear();
                    }
                }
                _factory = factory;
            }
        }
        destroy(toDestroy);
    } 
                            #location 28 
                            #vulnerability type THREAD_SAFETY_VIOLATION
#fixed code
                                public void setFactory(KeyedPoolableObjectFactory factory) throws IllegalStateException {
        Map toDestroy = new HashMap();
        final KeyedPoolableObjectFactory oldFactory = _factory;
        synchronized (this) {
            assertOpen();
            if (0 < getNumActive()) {
                throw new IllegalStateException("Objects are already active");
            } else {
                for (Iterator it = _poolMap.keySet().iterator(); it.hasNext();) {
                    Object key = it.next();
                    ObjectQueue pool = (ObjectQueue)_poolMap.get(key);
                    if (pool != null) {
                        // Copy objects to new list so pool.queue can be cleared
                        // inside the sync
                        List objects = new ArrayList();
                        objects.addAll(pool.queue);
                        toDestroy.put(key, objects);
                        it.remove();
                        _poolList.remove(key);
                        _totalIdle = _totalIdle - pool.queue.size();
                        _totalInternalProcessing =
                            _totalInternalProcessing + pool.queue.size();
                        pool.queue.clear();
                    }
                }
                _factory = factory;
            }
        }
        destroy(toDestroy, oldFactory);
    }