From 5c0c823913a1d77e4f72bf3212f0f7a1032cf1e1 Mon Sep 17 00:00:00 2001
From: Nick Couchman <vnick@apache.org>
Date: Sat, 28 Oct 2017 09:15:58 -0400
Subject: [PATCH 1/3] GUACAMOLE-362: Fix resource leak in FileInputStream when
 reading private key.

---
 .../guacamole/auth/cas/conf/PrivateKeyGuacamoleProperty.java     | 1 +
 1 file changed, 1 insertion(+)

diff --git a/extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/conf/PrivateKeyGuacamoleProperty.java b/extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/conf/PrivateKeyGuacamoleProperty.java
index bd0bd6956..78da89eb7 100644
--- a/extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/conf/PrivateKeyGuacamoleProperty.java
+++ b/extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/conf/PrivateKeyGuacamoleProperty.java
@@ -60,6 +60,7 @@ public abstract class PrivateKeyGuacamoleProperty implements GuacamoleProperty<P
             for (int readBytes; (readBytes = keyStreamIn.read(keyBuffer)) != -1;)
                 keyStreamOut.write(keyBuffer, 0, readBytes);
 
+            keyStreamIn.close();
             final byte[] keyBytes = keyStreamOut.toByteArray();
 
             // Set up decryption infrastructure

From 91e570276889bd3b83e8420be7604ee7817a3965 Mon Sep 17 00:00:00 2001
From: Nick Couchman <vnick@apache.org>
Date: Sat, 28 Oct 2017 14:04:13 -0400
Subject: [PATCH 2/3] GUACAMOLE-362: Move close to finally block.

---
 .../cas/conf/PrivateKeyGuacamoleProperty.java | 51 ++++++++++---------
 1 file changed, 28 insertions(+), 23 deletions(-)

diff --git a/extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/conf/PrivateKeyGuacamoleProperty.java b/extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/conf/PrivateKeyGuacamoleProperty.java
index 78da89eb7..d71ae1a8e 100644
--- a/extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/conf/PrivateKeyGuacamoleProperty.java
+++ b/extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/conf/PrivateKeyGuacamoleProperty.java
@@ -49,39 +49,44 @@ public abstract class PrivateKeyGuacamoleProperty implements GuacamoleProperty<P
         if (value == null || value.isEmpty())
             return null;
 
+        FileInputStream keyStreamIn = null;
+
         try {
+            try {
 
-            // Open and read the file specified in the configuration.
-            File keyFile = new File(value);
-            FileInputStream keyStreamIn = new FileInputStream(keyFile);
-            ByteArrayOutputStream keyStreamOut = new ByteArrayOutputStream();
-            byte[] keyBuffer = new byte[1024];
+                // Open and read the file specified in the configuration.
+                File keyFile = new File(value);
+                keyStreamIn = new FileInputStream(keyFile);
+                ByteArrayOutputStream keyStreamOut = new ByteArrayOutputStream();
+                byte[] keyBuffer = new byte[1024];
 
-            for (int readBytes; (readBytes = keyStreamIn.read(keyBuffer)) != -1;)
-                keyStreamOut.write(keyBuffer, 0, readBytes);
+                for (int readBytes; (readBytes = keyStreamIn.read(keyBuffer)) != -1;)
+                    keyStreamOut.write(keyBuffer, 0, readBytes);
 
-            keyStreamIn.close();
-            final byte[] keyBytes = keyStreamOut.toByteArray();
+                final byte[] keyBytes = keyStreamOut.toByteArray();
 
-            // Set up decryption infrastructure
-            KeyFactory keyFactory = KeyFactory.getInstance("RSA");
-            KeySpec keySpec = new PKCS8EncodedKeySpec(keyBytes);
-            return keyFactory.generatePrivate(keySpec);
+                // Set up decryption infrastructure
+                KeyFactory keyFactory = KeyFactory.getInstance("RSA");
+                KeySpec keySpec = new PKCS8EncodedKeySpec(keyBytes);
+                return keyFactory.generatePrivate(keySpec);
 
-        }
-        catch (FileNotFoundException e) {
-            throw new GuacamoleServerException("Could not find the specified key file.", e);
+            }
+            catch (FileNotFoundException e) {
+                throw new GuacamoleServerException("Could not find the specified key file.", e);
+            }
+            catch (NoSuchAlgorithmException e) {
+                throw new GuacamoleServerException("RSA algorithm is not available.", e);
+            }
+            catch (InvalidKeySpecException e) {
+                throw new GuacamoleServerException("Key is not in expected PKCS8 encoding.", e);
+            }
+            finally {
+                keyStreamIn.close();
+            }
         }
         catch (IOException e) {
             throw new GuacamoleServerException("Could not read in the specified key file.", e);
         }
-        catch (NoSuchAlgorithmException e) {
-            throw new GuacamoleServerException("RSA algorithm is not available.", e);
-        }
-        catch (InvalidKeySpecException e) {
-            throw new GuacamoleServerException("Key is not in expected PKCS8 encoding.", e);
-        }
-
     }
 
 }

From 32ccde08d242f4ca3257d6bb800153b36d1e9325 Mon Sep 17 00:00:00 2001
From: Nick Couchman <vnick@apache.org>
Date: Sat, 28 Oct 2017 14:19:37 -0400
Subject: [PATCH 3/3] GUACAMOLE-362: Avoid NullPointerException when closing
 input stream.

---
 .../guacamole/auth/cas/conf/PrivateKeyGuacamoleProperty.java   | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/conf/PrivateKeyGuacamoleProperty.java b/extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/conf/PrivateKeyGuacamoleProperty.java
index d71ae1a8e..455f17729 100644
--- a/extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/conf/PrivateKeyGuacamoleProperty.java
+++ b/extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/conf/PrivateKeyGuacamoleProperty.java
@@ -81,7 +81,8 @@ public abstract class PrivateKeyGuacamoleProperty implements GuacamoleProperty<P
                 throw new GuacamoleServerException("Key is not in expected PKCS8 encoding.", e);
             }
             finally {
-                keyStreamIn.close();
+                if (keyStreamIn != null)
+                    keyStreamIn.close();
             }
         }
         catch (IOException e) {