#vulnerable code 
                                public void testControlFilesPermissions() throws Exception {
        File deb = new File("target/test-classes/test-control.deb");
        if (deb.exists() && !deb.delete()) {
            fail("Couldn't delete " + deb);
        }
        
        Processor processor = new Processor(new NullConsole(), new MapVariableResolver(Collections.<String, String>emptyMap()));
        
        File controlDir = new File("target/test-classes/org/vafer/jdeb/deb/control");
        DataProducer[] producers = {new EmptyDataProducer()};
        
        processor.createDeb(controlDir.listFiles(), producers, deb, Compression.NONE);
        
        // now reopen the package and check the control files
        assertTrue("package not build", deb.exists());
        
        boolean controlFound = false;
        
        ArArchiveInputStream in = new ArArchiveInputStream(new FileInputStream(deb));
        try {
            ArArchiveEntry entry;
            while ((entry = in.getNextArEntry()) != null) {
                if (entry.getName().equals("control.tar.gz")) {
                    TarInputStream tar = new TarInputStream(new GZIPInputStream(new NonClosingInputStream(in)));
                    TarEntry tarentry;
                    while ((tarentry = tar.getNextEntry()) != null) {
                        controlFound = true;
                        
                        assertFalse("directory found in the control archive", tarentry.isDirectory());
                        assertTrue("prefix", tarentry.getName().startsWith("./"));
                        
                        ByteArrayOutputStream bout = new ByteArrayOutputStream();
                        tar.copyEntryContents(bout);
                        
                        InformationInputStream infoStream = new InformationInputStream(new ByteArrayInputStream(bout.toByteArray()));
                        IOUtils.copy(infoStream, NullOutputStream.NULL_OUTPUT_STREAM);
                        
                        if (infoStream.isShell()) {
                            assertTrue("Permissions on " + tarentry.getName() + " should be 755", tarentry.getMode() == 0755);
                        } else {
                            assertTrue("Permissions on " + tarentry.getName() + " should be 644", tarentry.getMode() == 0644);
                        }
                        
                        assertTrue(tarentry.getName() + " doesn't have Unix line endings", infoStream.hasUnixLineEndings());
                        
                        assertEquals("user", "root", tarentry.getUserName());
                        assertEquals("group", "root", tarentry.getGroupName());
                    }
                    tar.close();
                } else {
                    // skip to the next entry
                    long skip = entry.getLength();
                    while (skip > 0) {
                        long skipped = in.skip(skip);
                        if (skipped == -1) {
                            throw new IOException("Failed to skip");
                        }
                        skip -= skipped;
                    }
                }
            }
        } finally {
            in.close();
        }
        
        assertTrue("Control files not found in the package", controlFound);
    } 
                            #location 24 
                            #vulnerability type RESOURCE_LEAK
#fixed code
                                public void testControlFilesPermissions() throws Exception {
        File deb = new File("target/test-classes/test-control.deb");
        if (deb.exists() && !deb.delete()) {
            fail("Couldn't delete " + deb);
        }
        
        Processor processor = new Processor(new NullConsole(), new MapVariableResolver(Collections.<String, String>emptyMap()));
        
        File controlDir = new File("target/test-classes/org/vafer/jdeb/deb/control");
        DataProducer[] producers = {new EmptyDataProducer()};
        
        processor.createDeb(controlDir.listFiles(), producers, deb, Compression.NONE);
        
        // now reopen the package and check the control files
        assertTrue("package not build", deb.exists());
        
        final AtomicBoolean controlFound = new AtomicBoolean(false);
        
        ArchiveWalker.walkControlFiles(deb, new ArchiveVisitor<TarArchiveEntry>() {
            public void visit(TarArchiveEntry entry, byte[] content) throws IOException {
                controlFound.set(true);
                
                assertFalse("directory found in the control archive", entry.isDirectory());
                assertTrue("prefix", entry.getName().startsWith("./"));
                
                InformationInputStream infoStream = new InformationInputStream(new ByteArrayInputStream(content));
                IOUtils.copy(infoStream, NullOutputStream.NULL_OUTPUT_STREAM);
                
                if (infoStream.isShell()) {
                    assertTrue("Permissions on " + entry.getName() + " should be 755", entry.getMode() == 0755);
                } else {
                    assertTrue("Permissions on " + entry.getName() + " should be 644", entry.getMode() == 0644);
                }
                
                assertTrue(entry.getName() + " doesn't have Unix line endings", infoStream.hasUnixLineEndings());
                
                assertEquals("user", "root", entry.getUserName());
                assertEquals("group", "root", entry.getGroupName());
            }
        });
        
        assertTrue("Control files not found in the package", controlFound.get());
    }