Program: 66489
Project: 66489
Buggy source:
/** 
 * Purpose: Deserialize from an ObjectInputStream into an SDODataObject This function is mandated by the Externalizable interface. It reads back binary data in the same order as was written in writeExternal(). An object has already been constructed with the no-arg constructor before this function fills in the member fields. The deserialized object will be returned later in a call from the ObjectInputStream to readResolve()
 */
public void readExternal(ObjectInput objectInput) throws IOException, ClassNotFoundException {
  ByteArrayInputStream aByteInputStream=null;
  GZIPInputStream aGZIPInputStream=null;
  int dataObjectIdentifier=objectInput.read();
switch (dataObjectIdentifier) {
case SDO_INTERNAL_OBJECT_IDENTIFIER:
    String xPathString=objectInput.readUTF();
  SDODataObject deserializedDataObject=(SDODataObject)objectInput.readObject();
theSDODataObject=(SDODataObject)deserializedDataObject.get(xPathString);
break;
case SDO_ROOT_OBJECT_IDENTIFIER:
try {
int aStreamLength=objectInput.readInt();
byte[] aGZIPByteArray=new byte[aStreamLength];
objectInput.readFully(aGZIPByteArray);
aByteInputStream=new ByteArrayInputStream(aGZIPByteArray);
aGZIPInputStream=new GZIPInputStream(aByteInputStream);
XMLDocument aDocument=aHelperContext.getXMLHelper().load(aGZIPInputStream);
theSDODataObject=(SDODataObject)aDocument.getRootObject();
}
  finally {
if (aGZIPInputStream != null) {
aGZIPInputStream.close();
}
if (aByteInputStream != null) {
aByteInputStream.close();
}
}
break;
}
}

Fixed version (ground truth):
/** 
 * Purpose: Deserialize from an ObjectInputStream into an SDODataObject This function is mandated by the Externalizable interface. It reads back binary data in the same order as was written in writeExternal(). An object has already been constructed with the no-arg constructor before this function fills in the member fields. The deserialized object will be returned later in a call from the ObjectInputStream to readResolve()
 */
public void readExternal(ObjectInput objectInput) throws IOException, ClassNotFoundException {
  ByteArrayInputStream aByteInputStream=null;
  GZIPInputStream aGZIPInputStream=null;
  int dataObjectIdentifier=objectInput.read();
switch (dataObjectIdentifier) {
case SDO_INTERNAL_OBJECT_IDENTIFIER:
    String xPathString=objectInput.readUTF();
  SDODataObject deserializedDataObject=(SDODataObject)objectInput.readObject();
theSDODataObject=(SDODataObject)deserializedDataObject.get(xPathString);
break;
case SDO_ROOT_OBJECT_IDENTIFIER:
try {
int aStreamLength=objectInput.readInt();
byte[] aGZIPByteArray=new byte[aStreamLength];
objectInput.readFully(aGZIPByteArray);
aByteInputStream=new ByteArrayInputStream(aGZIPByteArray);
aGZIPInputStream=new GZIPInputStream(aByteInputStream);
XMLDocument aDocument=aHelperContext.getXMLHelper().load(aGZIPInputStream);
theSDODataObject=(SDODataObject)aDocument.getRootObject();
}
  finally {
if (aGZIPInputStream != null) {
aGZIPInputStream.close();
}
if (aByteInputStream != null) {
aByteInputStream.close();
}
}
break;
case SDO_HELPER_CONTEXT_ID_IDENTIFIER:
try {
String helperContextIdentifier=objectInput.readUTF();
int aStreamLength=objectInput.readInt();
byte[] aGZIPByteArray=new byte[aStreamLength];
objectInput.readFully(aGZIPByteArray);
aByteInputStream=new ByteArrayInputStream(aGZIPByteArray);
aGZIPInputStream=new GZIPInputStream(aByteInputStream);
HelperContext contextToUse=SDOHelperContext.getHelperContext(helperContextIdentifier);
XMLDocument aDocument=contextToUse.getXMLHelper().load(aGZIPInputStream);
theSDODataObject=(SDODataObject)aDocument.getRootObject();
}
  finally {
if (aGZIPInputStream != null) {
aGZIPInputStream.close();
}
if (aByteInputStream != null) {
aByteInputStream.close();
}
}
break;
}
}