[HADOOP-11014] Potential resource leak in JavaKeyStoreProvider due to unclosed stream

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.6.0
• Fix Version/s: 2.7.0
• Component/s: security
• Target Version/s: 2.7.0
• Hadoop Flags: Reviewed
• Assignee: Tsuyoshi Ozawa
• Reporter: Ted Yu
• Created: 28/Aug/14 00:53
• Updated: 10/Apr/15 20:04
• Resolved: 25/Mar/15 08:03

Description

From hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java :

  private void writeToNew(Path newPath) throws IOException {
    FSDataOutputStream out =
        FileSystem.create(fs, newPath, permissions);
    try {
      keyStore.store(out, password);
    } catch (KeyStoreException e) {
      throw new IOException("Can't store keystore " + this, e);
    } catch (NoSuchAlgorithmException e) {
      throw new IOException(
          "No such algorithm storing keystore " + this, e);
    } catch (CertificateException e) {
      throw new IOException(
          "Certificate exception storing keystore " + this, e);
    }
    out.close();

IOException is not among the catch blocks.
According to http://docs.oracle.com/javase/7/docs/api/java/security/KeyStore.html#store(java.io.OutputStream,%20char[]), IOException may be thrown from the store() call. In that case, out would be left unclosed.

In loadFromPath():

    keyStore.load(fs.open(p), password);

The InputStream should be closed upon return from load()