Page History

...

Resources other than raw memory must be explicitly freed in non-finalizer methods, due to the unsuitability of using finalizers.

Noncompliant Code Example (File Handle)

This noncompliant code example opens a file and uses it, but fails to explicitly close the file handle.

public int processFile(String fileName) throws IOException, FileNotFoundException {
  FileInputStream stream = new FileInputStream(fileName);
  BufferedReader bufRead = new BufferedReader(new InputStreamReader(stream));
  String line;
  while ((line = bufRead.readLine()) != null) {
    sendLine(line);
  }
  return 1;
}

Compliant Solution

This compliant solution releases all acquired resources, regardless of any exceptions that might occur. Even though dereferencing bufRead might result in an exception, the FileInputStream object is closed as required (if it was created in the first place).

FileInputStream stream = null;
BufferedReader bufRead = null;
try {
  stream = new FileInputStream(fileName);
  bufRead = new BufferedReader(new InputStreamReader(stream));

  String line;
  while ((line = bufRead.readLine()) != null) {
    sendLine(line);
  }
} catch (IOException e) { 
  // forward to handler 
} finally {
  if (stream != null) { 
    try {
      stream.close();
    } catch (IOException e) { 
      // forward to handler 
    }
  } 
}

Compliant Solution (Java 1.7, try-with-resources)

This compliant solution uses the try-with-resources statement, introduced in Java 1.7, to release all acquired resources, regardless of any exceptions that might occur.

try (FileInputStream stream = new FileInputStream(fileName);
     BufferedReader bufRead = new BufferedReader(new InputStreamReader(stream))) {

  String line;
  while ((line = bufRead.readLine()) != null) {
    sendLine(line);
  }
} catch (IOException e) { 
  // forward to handler 
}

The try-with-resource construct will send any IOException to the catch clause, where it gets forwarded to an exception handler. This includes exceptions generated during the allocation of resources (that is, the creation of the FileInputStream or BufferedReader. It also includes any IOException thrown during the while loop. Finally, it includes any IOException generated by closing bufRead or stream.

Noncompliant Code Example (SQL Connection)

The problem of resource pool exhaustion is aggravated in the case of database connections. Many database servers allow only a fixed number of connections, depending on configuration and licensing. Consequently, failure to release database connections can result in rapid exhaustion of available connections. This noncompliant code example fails to close the connection when an error occurs during execution of the SQL statement or during processing of the results.

...

In this noncompliant code example, the call to rs.close() could throw an SQLException; consequently, stmt.close() would never be called. This is a violation of ERR05-J. Do not let checked exceptions escape from a finally block.

Statement stmt = null;
ResultSet rs = null;
Connection conn = getConnection();
try {
  stmt = conn.createStatement();
  rs = stmt.executeQuery(sqlQuery);
  processResults(rs);
} catch (SQLException e) { 
  // forward to handler 
} finally {
  if (rs != null) {
    rs.close();
  }
 
  if (stmt != null) {
    stmt.close();
  }
}

Compliant Solution

This compliant solution ensures that resources are released as required.

Statement stmt = null;
ResultSet rs = null;
Connection conn = getConnection();
try {
    stmt = conn.createStatement();
    rs = stmt.executeQuery(sqlQuery);
    processResults(rs);
} catch (SQLException e) { 
  // forward to handler 
} finally {
  if (rs != null) {
    try {
      rs.close();
    } catch (SQLException e) {
      // forward to handler 
    } finally {
      if (stmt != null) {
        try {
          stmt.close();
      } catch (SQLException e) {
        // forward to handler 
      } finally {
        if (conn != null) {
          try {
            conn.close();
          } catch (SQLException e) {
            // forward to handler 
          }
        }
      }
    }
  }
}

Compliant Solution (Java 1.7, try-with-resources)

This compliant solution uses the try-with-resource construct, introduced in Java 1.7, to ensure that resources are released as required.

...

The try-with-resource construct will send any SQLException to the catch clause, where it gets forwarded to an exception handler. This includes exceptions generated during the allocation of resources (that is, the creation of the Connection, Statement, or ResultSet. It also includes any SQLException thrown by processResults(). Finally, it includes any SQLException generated by closing rs, stmt, or conn.

Noncompliant Code Example (File Handle)

This noncompliant code example opens a file and uses it, but fails to explicitly close the file handle.

public int processFile(String fileName) throws IOException, FileNotFoundException {
  FileInputStream stream = new FileInputStream(fileName);
  BufferedReader bufRead = new BufferedReader(new InputStreamReader(stream));
  String line;
  while ((line = bufRead.readLine()) != null) {
    sendLine(line);
  }
  return 1;
}

Compliant Solution

This compliant solution releases all acquired resources, regardless of any exceptions that might occur. Even though dereferencing bufRead might result in an exception, the FileInputStream object is closed as required (if it was created in the first place).

FileInputStream stream = null;
BufferedReader bufRead = null;
try {
  stream = new FileInputStream(fileName);
  bufRead = new BufferedReader(new InputStreamReader(stream));

  String line;
  while ((line = bufRead.readLine()) != null) {
    sendLine(line);
  }
} catch (IOException e) { 
  // forward to handler 
} finally {
  if (stream != null) { 
    try {
      stream.close();
    } catch (IOException e) { 
      // forward to handler 
    }
  } 
}

Compliant Solution (Java 1.7, try-with-resources)

This compliant solution uses the try-with-resources statement, introduced in Java 1.7, to release all acquired resources, regardless of any exceptions that might occur.

try (FileInputStream stream = new FileInputStream(fileName);
     BufferedReader bufRead = new BufferedReader(new InputStreamReader(stream))) {

  String line;
  while ((line = bufRead.readLine()) != null) {
    sendLine(line);
  }
} catch (IOException e) { 
  // forward to handler 
}

The try-with-resource construct will send any IOException to the catch clause, where it gets forwarded to an exception handler. This includes exceptions generated during the allocation of resources (that is, the creation of the FileInputStream or BufferedReader. It also includes any IOException thrown during the while loop. Finally, it includes any IOException generated by closing bufRead or stream.

Risk Assessment

Failure to explicitly release non-memory system resources when they are no longer needed can result in resource exhaustion.

...

...

...