Skip to content

Resource leak in JarAnalyzer constructor if entries.sort() throws #139

Description

@elharo

In JarAnalyzer.java, the constructor opens a JarFile and then sorts entries:

List<JarEntry> entries = Collections.list(jarFile.entries());
entries.sort(Comparator.comparing(ZipEntry::getName));  // NPE if entry has null name

If any JarEntry has a null name (possible in malformed ZIPs), Comparator.comparing throws NPE before the getManifest() try/catch block is reached. The JarFile handle is never closed, causing a resource leak.

Fix: Either validate entry names before sorting, or use a null-safe comparator:

entries.sort(Comparator.comparing(ZipEntry::getName, Comparator.nullsLast(Comparator.naturalOrder())));

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingpriority:minorMinor loss of function, or other problem where easy workaround is present

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions