pjfanning opened a new pull request, #107:
URL: https://github.com/apache/poi-xmlbeans/pull/107
`XsbReader(SchemaTypeSystemImpl, String handle, int filetype)` opens the
resource stream (`typeSystem.getLoaderStream(...)`) and only then validates the
header. Every rejection path — wrong magic cookie, wrong major version,
incompatible minor version, wrong file type — throws
`SchemaTypeLoaderException` from inside the constructor, and
`StringPool.readFrom` can throw on a truncated file too.
Because the constructor never returns, no caller ever holds a reference to
call `readEnd()`, so the stream is leaked.
`SchemaTypeSystemImpl.initFromHeader()` even has
```java
} finally {
if (reader != null) {
reader.readEnd();
}
}
```
but `reader` is still `null` in exactly this case. Each corrupt or
version-mismatched `.xsb` on the classpath leaks a file handle (or a `ZipFile`
entry stream).
The header parsing moves into a private `readHeader()` and the constructor
releases the stream if it does not complete.
Added `XsbReaderHeaderStreamTest`, which feeds a tracking stream through a
stub `ResourceLoader` and asserts it is closed. All four cases fail on trunk
and pass with this change.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
