XSS issue when asp.net C# code is scanned thru fortify tool

Question

my asp.net c# code when scanned thru fortify tool gave following error:
---The method GetDocument() in RendDoc.ashx.cs sends unvalidated data to a web browser on line 160, which can result in the browser executing malicious code.---
Please let me know how to resolve this issue.
My code is as follows. Fortify is showing issues in 3 lines of code prefixed with ** in below code.

public void GetDocument()

    {

        ServiceClient dm = null;

        SomeService.SomeServiceSoapClient InternalService = null;


        //Use service based on if using Windows Authentication

        if (HttpContext.Current.Request.IsAuthenticated && HttpContext.Current.User.Identity is WindowsIdentity)

            InternalService = new SomeService.SomeServiceSoapClient("ServiceNetTcpEndpoint");

       else

            dm = new ServiceClient("SomeServicewsHttpEndpoint");             

        try
        {
            byte[] DocArray;

            if (dm == null)
            {
                //Wrapper for impersonation

                using (WindowsImpersonationContext cxt = (Thread.CurrentPrincipal.Identity as WindowsIdentity).Impersonate())

                    **DocArray = InternalService.GetFile(DocId);
            }
            else
              **  DocArray = dm.GetFile(DocId); 

            string fileExt2;

            string strConttenType = null;

            fileExt2 = fileExt; 

            strConttenType = GetService.GetContenttype(fileExt2); 

            HttpContext.Current.Response.ClearHeaders();

            HttpContext.Current.Response.ClearContent();

            HttpContext.Current.Response.BufferOutput = true; 

            HttpContext.Current.Response.ContentType = strConttenType; // "application/msword"; // for PDF type 

            HttpContext.Current.Response.AddHeader("Content-Disposition", "inline");

     **       HttpContext.Current.Response.BinaryWrite(DocArray); 

            HttpContext.Current.ApplicationInstance.CompleteRequest(); 

        }

        catch (FaultException ex)
        {
            ExMgr.Publish(ex);

            dm.Abort();
        }
        catch (Exception ex)
        {
            ExMgr.Publish(ex);
        }

THANKS.