[Bug] Resource leak in IOTinyUtils.copyFile - FileInputStream/FileOutputStream not closed on exception

[daguimu]

Before Creating the Bug Report

• I found a bug, not just asking a question, which should be created in GitHub Discussions.
• I have searched the GitHub Issues and GitHub Discussions of this repository and believe that this is not a duplicate.
• I have confirmed that this bug belongs to the current repository, not other repositories of RocketMQ.

Runtime platform environment

All platforms

RocketMQ version

develop branch (latest)

JDK Version

All

Describe the Bug

In IOTinyUtils.copyFile(), FileOutputStream and FileInputStream are created inline as arguments to getChannel():

tc = new FileOutputStream(tf).getChannel();
sc = new FileInputStream(sf).getChannel();

The underlying stream references are lost. While closing the FileChannel typically closes the underlying stream, if an exception occurs between the two lines (e.g., FileInputStream constructor throws because the source file is locked), the already-created FileOutputStream will never be closed, leaking a file descriptor.

Additionally, this pattern makes the resource ownership unclear and is flagged by static analysis tools (SpotBugs, SonarQube).

Steps to Reproduce

1. Call IOTinyUtils.copyFile() with a valid target file and a source file that throws on FileInputStream construction
2. The FileOutputStream (and its channel) created on the previous line is leaked

What Did You Expect to See?

All resources should be properly closed using try-with-resources pattern.

What Did You See Instead?

Potential file descriptor leak.

Additional Context

• File: common/src/main/java/org/apache/rocketmq/common/utils/IOTinyUtils.java:92-93
• Fix: Convert to try-with-resources pattern

[daguimu]

Thanks for your interest @Wubabalala! I've already submitted a PR for this: #10210. Feel free to review it if you'd like.

[salmaloel657-dotcom]

Thanks for the update. I’ve taken a look at #10210 and the approach with try-with-resources makes sense to ensure proper cleanup in all cases. I’ll review it in more detail and leave any feedback there if needed.

…

On Fri, Mar 27, 2026, 12:38 AM Guimu ***@***.***> wrote: *daguimu* left a comment (apache/rocketmq#10208) <#10208 (comment)> Thanks for your interest @Wubabalala <https://github.com/Wubabalala>! I've already submitted a PR for this: #10210 <#10210>. Feel free to review it if you'd like. — Reply to this email directly, view it on GitHub <#10208?email_source=notifications&email_token=CABFFMN6QNTPTD3VAMZORXL4SYHWNA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIMJUGAZTEOJSGI2KM4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSWGM33PORSXEX3DNRUWG2Y#issuecomment-4140329224>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/CABFFML7BKIXWERII4LL2D34SYHWNAVCNFSM6AAAAACW6XI3EGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DCNBQGMZDSMRSGQ> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>