output: #fixed code
                               public void testCreation() throws Exception {
  
  		final Processor processor = new Processor(new Console() {
  			public void println(String s) {
  			}
  		}, null);
  		
  		final File control = new File(getClass().getResource("deb/control/control").toURI());
  		final File archive1 = new File(getClass().getResource("deb/data.tgz").toURI());
  		final File archive2 = new File(getClass().getResource("deb/data.tar.bz2").toURI());
  		final File directory = new File(getClass().getResource("deb/data").toURI());
  		
  		final DataProducer[] data = new DataProducer[] {
  				new DataProducerArchive(archive1, null, null, null),
  				new DataProducerArchive(archive2, null, null, null),
  				new DataProducerDirectory(directory, null, new String[] { "**/.svn/**" }, null)
  		};
  		
  		final File deb = File.createTempFile("jdeb", ".deb");
  		
  		final PackageDescriptor packageDescriptor = processor.createDeb(new File[] { control }, data, deb, "gzip");
  		
  		assertTrue(packageDescriptor.isValid());
  		
  		final Set filesInDeb = new HashSet();
  
  		FileInputStream in = new FileInputStream(deb);
  		final ArInputStream ar = new ArInputStream(in);
  		while(true) {
  			final ArEntry arEntry = ar.getNextEntry();
  			if (arEntry == null) {
  				break;
  			}
  			
  			if ("data.tar.gz".equals(arEntry.getName())) {
  				
  				final TarInputStream tar = new TarInputStream(new GZIPInputStream(ar));
  				
  				while(true) {
  					final TarEntry tarEntry = tar.getNextEntry();
  					if (tarEntry == null) {
  						break;
  					}
  					
  					filesInDeb.add(tarEntry.getName());
  				}
  				
  				tar.close();
  				break;
  			}
  			for (int i = 0; i < arEntry.getLength(); i++) {
  				ar.read();
  			}
  		}
  
  		in.close();
  		
  		assertTrue("" + filesInDeb, filesInDeb.contains("/test/testfile"));
  		assertTrue("" + filesInDeb, filesInDeb.contains("/test/testfile2"));
  		assertTrue("" + filesInDeb, filesInDeb.contains("/test/testfile3"));
  
  		assertTrue("Cannot delete the file " + deb, deb.delete());
  	}
input: #vulnerable code 
                               public void testCreation() throws Exception {
  
  		final Processor processor = new Processor(new Console() {
  			public void println(String s) {
  			}
  		}, null);
  		
  		final File control = new File(getClass().getResource("deb/control/control").toURI());
  		final File archive1 = new File(getClass().getResource("deb/data.tgz").toURI());
  		final File archive2 = new File(getClass().getResource("deb/data.tar.bz2").toURI());
  		final File directory = new File(getClass().getResource("deb/data").toURI());
  		
  		final DataProducer[] data = new DataProducer[] {
  				new DataProducerArchive(archive1, null, null, null),
  				new DataProducerArchive(archive2, null, null, null),
  				new DataProducerDirectory(directory, null, new String[] { "**/.svn/**" }, null)
  		};
  		
  		final File deb = File.createTempFile("jdeb", ".deb");
  		
  		final PackageDescriptor packageDescriptor = processor.createDeb(new File[] { control }, data, deb, "gzip");
  		
  		assertTrue(packageDescriptor.isValid());
  		
  		final Set filesInDeb = new HashSet();
  		
  		final ArInputStream ar = new ArInputStream(new FileInputStream(deb));
  		while(true) {
  			final ArEntry arEntry = ar.getNextEntry();
  			if (arEntry == null) {
  				break;
  			}
  			
  			if ("data.tar.gz".equals(arEntry.getName())) {
  				
  				final TarInputStream tar = new TarInputStream(new GZIPInputStream(ar));
  				
  				while(true) {
  					final TarEntry tarEntry = tar.getNextEntry();
  					if (tarEntry == null) {
  						break;
  					}
  					
  					filesInDeb.add(tarEntry.getName());
  				}
  				
  				tar.close();
  				break;
  			}
  			for (int i = 0; i < arEntry.getLength(); i++) {
  				ar.read();
  			}
  		}
  		
  		assertTrue("" + filesInDeb, filesInDeb.contains("/test/testfile"));
  		assertTrue("" + filesInDeb, filesInDeb.contains("/test/testfile2"));
  		assertTrue("" + filesInDeb, filesInDeb.contains("/test/testfile3"));
  
  		assertTrue(deb.delete());
  	} 
                              #location 36 
                              #vulnerability type RESOURCE_LEAK