Page History

If a program relies on finalize() to release system resources, or if there is confusion over which part of the program is responsible for releasing system resources, then there exists a possibility of a potential resource leak. In a busy system, there might be a time gap before the finalize() method is called for an object. An attacker might exploit this vulnerability to induce a denial-of-service attack. The recommendation guideline OBJ02-J. Avoid using finalizers has more information on the demerits of using finalizers.

...

Also note that on the Windows platform, attempts to delete open files fail silently. See FIO34-J. Do not create temporary files in shared directories for more information.

Noncompliant Code Example

The problem of resource pool exhaustion is aggravated in the case of database connections. Traditionally, database servers allow a fixed number of connections, which may be dependent depending on configuration or and licensing. Failing to release database connections can result in rapid exhaustion of available connections. In this This noncompliant code example , does not close the connection if an error occurs while executing the statement or while processing the results of the statement, the connection is not closed.

public void getResults(String sqlQuery) {
  try {
    Connection conn = getConnection();
    Statement stmt = conn.createStatement();
    ResultSet rs = stmt.executeQuery(sqlQuery);
    processResults(rs);
    stmt.close();
  } catch (SQLException e) { /* forward to handler */ }
}

...

While being slightly better than the previous noncompliant code example, this code is also noncompliant. Both rs and stmt might be null and the clean-up code in the finally block may result in a NullPointerException.

Statement stmt = null;
ResultSet rs = null
Connection conn = getConnection(0;
try {
  stmt = conn.createStatement();
  rs = stmt.executeQuery(sqlQuery);
  processResults(rs);
} catch(SQLException e) { 
  //* forward to handler */ 
}
 finally {
  rs.close();
  stmt.close();
}

...

Statement stmt = null;
ResultSet rs = null;
Connection conn = getConnection();
try {
  stmt = conn.createStatement();
  rs = stmt.executeQuery(sqlQuery);
  processResults(rs);
} catch(SQLException e) { 
  /*/ forward to handler */
} }
finally {
 
  if(rs != null) {
    rs.close();
  }
 
  if(stmt != null) {
    stmt.close();
  }
}

Compliant Solution

This compliant solution shows how to ensure ensures that resources have been released as required.

Statement stmt = null;
ResultSet rs = null;
Connection conn = getConnection();
try {
    stmt = conn.createStatement();
    rs = stmt.executeQuery(sqlQuery);
    processResults(rs);
} catch(SQLException e) { 
  /*/ forward to handler */
} }
finally {
  try {
    if(rs != null) {
      rs.close();
    }
  } finally {
    try {
      if(stmt != null) {
        stmt.close();
      }
    }
    finally {
      conn.close();
    }
  }
}

...

Compliant Solution

This compliant code example solution releases all acquired resources, regardless of any exceptions that might occur. In this compliant solution, even Even though bufRead might result in an exception, if a FileInputStream object is instantiated, it will be closed as required.

FileInputStream stream = null;
BufferedReader bufRead = null;
String line;
try {
  stream = new FileInputStream(fileName);
  bufRead = new BufferedReader(new InputStreamReader(stream));

  while((line = bufRead.readLine()) != null) {
    sendLine(line);
  }
} catch (IOException e) { 
  //* forward to handler */
} }
finally {
  if(stream != null) { 
    stream.close();
  } 
}

...