JDK-8276305 : Infinite loop in ZipOutputStream.close()
  • Type: CSR
  • Component: core-libs
  • Sub-Component: java.util.jar
  • Priority: P4
  • Status: Closed
  • Resolution: Approved
  • Fix Versions: 18
  • Submitted: 2021-11-02
  • Updated: 2022-03-15
  • Resolved: 2021-11-29
Related Reports
CSR :  
Description
Summary
-------
If the underlying `OutputStream` associated with `ZipOutputStream` or `GZIPOutputStream` throws an `IOException` while the zip stream is being closed,  the associated compressor is left in an inconsistent state and may cause infinite looping.

Problem
-------

If  a call to  `GZIPOutputStream.close()`, `GZIPOutputStream.finish()` or `ZipOutputStream.closeEntry()`  results in an `IOException`, an call to `GZIPOutputStream.write()` or `ZipOutputStream.write()`  may result in an infinite loop.

Solution
--------

If an `IOException` is encountered while using the default JDK compressor in `GZIPOutputStream.finish()` or  `ZipOutputStream.closeEntry()`, then close the compressor before propagating that Exception up the stack. `DeflaterOutputStream.close()` is hardened to ensure that the default JDK compressor is closed in case where `Throwable` is propagated up the stack.   This will ensure that subsequent write operations using the same deflater will fail. An exception is made for the `ZipOutputStream.closeEntry()` call. For that method, IOExceptions of type `ZipException` will not cause the associated compressor to be closed.

Harden `DeflaterOutputStream.close()` to close out the associated default JDK compressor before propagating a `Throwable` (if any) up the stack

Harden `ZIPOutputStream.closeEntry()` to close out the associated default JDK compressor before propagating an `IOException`, not of type `ZipException`, (if any) up the stack 

Harden `GZIPOutputStream.finish()` to close out the associated default JDK compressor before propagating an `IOException` (if any) up the stack

The behavioral change will be documented in a release note. 


Specification
-------------

A future CSR may propose spec clarifications. 
Comments
[~goetz], there were some anomalies in the JBS handling of the CSRs for the backports. There is a non-public CSR covering the backports.
15-03-2022

Hi [~joe.darcy] The corresponding change was backported. There is not backport CSR. Was this forgotten? Or was the change adapted to not require a CSR in the backport? Thanks!
14-03-2022

Moving to Approved.
29-11-2021

alanb
23-11-2021

Pending the request until it has one or more reviewers.
09-11-2021

Moving to Provisional for JDK 18.
03-11-2021