From 44b37afa94f2aa6dc575835ac508ed214f6b983a Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Fri, 31 Jul 2026 17:03:13 +0000
Subject: [PATCH] Fix CodeQL warning-severity alerts: process stream ownership and two leaks (#799)
---
opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/ID2Entry.java | 36 ++++++++++++++++++++++++++----------
1 files changed, 26 insertions(+), 10 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/ID2Entry.java b/opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/ID2Entry.java
index 73cb4d4..be1fd64 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/ID2Entry.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/backends/pluggable/ID2Entry.java
@@ -260,16 +260,7 @@
{
return Entry.decode(reader, compressedSchema);
}
- InputStream is = reader.asInputStream();
- if ((format & ENCRYPT_ENTRY) == ENCRYPT_ENTRY)
- {
- is = getCryptoManager().getCipherInputStream(is);
- }
- if ((format & COMPRESS_ENTRY) == COMPRESS_ENTRY)
- {
- is = new InflaterInputStream(is);
- }
- try (InputStream entryStream = is)
+ try (InputStream entryStream = newEntryInputStream(reader, format))
{
byte[] data = new byte[encodedEntryLen];
int readBytes;
@@ -295,6 +286,31 @@
}
}
+ /**
+ * Returns the stream to read the encoded entry from, decorated as mandated by the format.
+ * <p>
+ * The returned stream owns the streams it wraps, so closing it closes the whole chain.
+ *
+ * @param reader the reader positioned at the start of the encoded entry.
+ * @param format the format byte of the encoded entry.
+ * @return the stream to read the encoded entry from.
+ * @throws CryptoManagerException If the cipher input stream cannot be created.
+ */
+ private static InputStream newEntryInputStream(ByteSequenceReader reader, int format)
+ throws CryptoManagerException
+ {
+ InputStream is = reader.asInputStream();
+ if ((format & ENCRYPT_ENTRY) == ENCRYPT_ENTRY)
+ {
+ is = getCryptoManager().getCipherInputStream(is);
+ }
+ if ((format & COMPRESS_ENTRY) == COMPRESS_ENTRY)
+ {
+ is = new InflaterInputStream(is);
+ }
+ return is;
+ }
+
private ByteString encode(Entry entry, DataConfig dataConfig) throws DirectoryException
{
encodeVolatile(entry, dataConfig);
--
Gitblit v1.10.0