8038431: Close InputStream when finished retrieving XML Signature HTTP References

Reviewed-by: xuelei
Contributed-by: ebaron@redhat.com

src/share/classes/com/sun/org/apache/xml/internal/security/utils/resolver/implementations/ResolverDirectHTTP.java

@@ -108,6 +108,7 @@ public class ResolverDirectHTTP extends ResourceResolverSpi {
     @Override
     public XMLSignatureInput engineResolveURI(ResourceResolverContext context)
         throws ResourceResolverException {
+        InputStream inputStream = null;
         try {
 
             // calculate new URI
@@ -139,7 +140,7 @@ public class ResolverDirectHTTP extends ResourceResolverSpi {
             }
 
             String mimeType = urlConnection.getHeaderField("Content-Type");
-            InputStream inputStream = urlConnection.getInputStream();
+            inputStream = urlConnection.getInputStream();
             ByteArrayOutputStream baos = new ByteArrayOutputStream();
             byte buf[] = new byte[4096];
             int read = 0;
@@ -168,6 +169,16 @@ public class ResolverDirectHTTP extends ResourceResolverSpi {
             throw new ResourceResolverException("generic.EmptyMessage", ex, context.attr, context.baseUri);
         } catch (IllegalArgumentException e) {
             throw new ResourceResolverException("generic.EmptyMessage", e, context.attr, context.baseUri);
+        } finally {
+            if (inputStream != null) {
+                try {
+                    inputStream.close();
+                } catch (IOException e) {
+                    if (log.isLoggable(java.util.logging.Level.FINE)) {
+                        log.log(java.util.logging.Level.FINE, e.getMessage(), e);
+                    }
+                }
+            }
         }
     }