MKnafve (Community Member) asked a question.

December 16, 2020 at 7:29 AM
404 - Improper Resource Shutdown or Release despite using "using".

I am scanning my application using Veracode, and it reports the following error:

 

The program fails to release or incorrectly releases the variable stream, which was previously allocated by a call to mscorlib_dll.System.IO.MemoryStream.!newinit_0_0().

 

The code where the issue is identified looks as follows:

 

using (var stream = new MemoryStream())

   {

    Serialize(stream, dataToStore);

    var buffer = stream.GetBuffer();

      blob.UploadFromByteArray(buffer, 0, buffer.Length);

}

 

I don't understand where the issue is. The Serialize method serializes an object into the memory stream and the call blob.Upload... uploads the data to Azure Blob Storage.

 

Since I'm wrapping the creation of the memory stream in a using-statement, I'm confident that the resource is released. Anyone have some idea what could cause the above flaw being reported for this code?

  • 3 answers
  • 4.35K views
VCode likes this.

  • Anthony Fielding (Veracode)

    Hi @MKnafve (Community Member)​,

    Thanks for your question. As you are correctly releasing the the stream variable via the using statement it is reasonable to propose a Mitigation By Design for this flaw if this code is within an asynchronous method. The issue with asynchronous methods is that objects may be disposed of in different threads than they were created, which is likely why the flaw was raised. However the use of using is the correct means by which to safely dispose of these resources. If the code is not in an asynchronous block then you may wish to instead propose a False Positive mitigation. You can learn how to propose mitigations if you're not familiar with the process here: https://help.veracode.com/r/improve_mitigation?section=mitigate__propose.

     

    A colleague has answered a similar question here: https://community.veracode.com/s/question/0D52T00004lokokSAA/improper-resource-shutdown-or-release-net-core-22.

     

    I hope that answers your question.

     

    Thanks,

    Anthony Fielding

    Expand Post

    • MKnafve (Community Member)

      Thanks @Anthony Fielding (Veracode)​ ,

       

      I have two follow up questions:

       

      1. In C#, using a using-statement to ensure disposal of objects are as you probably know the recommended method of doing so and extermely common. Why would Veracode have issues detecting such a common C#-pattern?
      2. You are right that if an asynchronous method is used, then the dispose of the MemoryStream may run on a different thread. With MemoryStream that is safe. In other words, 100% safe code has been incorrectly detected as a flaw by Veracode. Why should I mark such a case as "Mitigate by Design" rather than "False positive"? The instructions you linked to stated that "Mitigate by Design to state that custom business logic within the body of the application, which may not be fully identifiable by an automated process, addressed the vulnerability.". In this case, the safety of the code should be possible to identify by an automated process, it's just that Veracode is incapable of it due to limitations in the software (?) . Wouldn't that then be a false positive?

       

      Thanks!

      Expand Post

      • Anthony Fielding (Veracode)

        Hello @MKnafve (Community Member)​,

        Whilst the using statement appears correct and I recommend you propose a mitigation, we would like to look into this further. Please could you open a support case for this. Here's how you can log a case:

        1. Navigate to the upper right corner of any page in the Community, click on your user avatar.
        2. Select Contact Support from the drop-down menu.

         

        Many thanks,

        Anthony Fielding

        Expand Post

Topics (2)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.