MainClassFinder.findSingleMainClass(JarFile, ...) does not close the
JarFile; the caller owns the resource. FindMainClass passed a newly
opened JarFile without closing it, unlike sibling call sites that use
try-with-resources.
See gh-50949
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
ExportedLayers left the intermediate create-builder-scratch-source
temp file behind after rebased layer files were written, and opened
layer InputStreams without closing them when StreamUtils.copy does
not close either stream. Delete the source temp in a finally block
and use try-with-resources for the apply path so layer files can be
deleted reliably.
See gh-50919
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
InspectingOutputStream extends OutputStream but does not override
close(). When content exceeds MEMORY_LIMIT (approximately 4 KB),
convertToTempFile() replaces the ByteArrayOutputStream delegate with a
FileOutputStream. The try-with-resources in InspectedContent.of() calls
close(), which inherits the no-op OutputStream.close(), leaving the
FileOutputStream open and leaking a file descriptor.
Override close() to delegate to the underlying stream.
See gh-50639
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
ProcessRunner.waitForProcess and ReaderThread.toString catch
InterruptedException without restoring the thread interrupt flag.
This prevents callers higher up the stack from detecting the
interruption. Every other InterruptedException handler in the
codebase restores the flag; these two were the only omissions.
Add Thread.currentThread().interrupt() before re-throwing or
returning in both catch blocks. Also chain the original exception
as the cause in waitForProcess for debuggability.
See gh-50451
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
Add explicit size checks before casting long values to int in
Content.of(File) and LogUpdateEvent.read() to prevent silent data
corruption or NegativeArraySizeException when processing large files
or malformed Docker stream data.
See gh-50382
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
Sebastien Tardif