output: #fixed code
                                  public byte[] toByteArray(final LogEvent event) {
          ByteArrayOutputStream baos = new ByteArrayOutputStream();
          try {
              ObjectOutputStream oos = new PrivateObjectOutputStream(baos);
              try {
                  oos.writeObject(event);
              } finally {
                  oos.close();
              }
          } catch (IOException ioe) {
              LOGGER.error("Serialization of LogEvent failed.", ioe);
          }
          return baos.toByteArray();
      }
input: #vulnerable code 
                                  public byte[] toByteArray(final LogEvent event) {
          ByteArrayOutputStream baos = new ByteArrayOutputStream();
          try {
              ObjectOutputStream oos = new PrivateObjectOutputStream(baos);
              oos.writeObject(event);
          } catch (IOException ioe) {
              LOGGER.error("Serialization of LogEvent failed.", ioe);
          }
          return baos.toByteArray();
      } 
                              #location 5 
                              #vulnerability type RESOURCE_LEAK