From 79ca99f9d5ae0d2d19ef25f4cc5d8bdb2491696f Mon Sep 17 00:00:00 2001
From: Mia ZHOU <meinaz@vmware.com>
Date: Mon, 7 Jan 2019 16:17:41 +0800
Subject: [PATCH] fix fortify issues (#645)

Signed-off-by: Meina Zhou <meinaz@vmware.com>
---
 .../main/java/com/vmware/vic/PropFetcher.java | 18 ++++++++++--------
 .../com/vmware/vic/utils/ConfigLoader.java    | 19 +++++++++++++------
 2 files changed, 23 insertions(+), 14 deletions(-)

diff --git a/h5c/vic-service/src/main/java/com/vmware/vic/PropFetcher.java b/h5c/vic-service/src/main/java/com/vmware/vic/PropFetcher.java
index 23072df81..ede56575b 100644
--- a/h5c/vic-service/src/main/java/com/vmware/vic/PropFetcher.java
+++ b/h5c/vic-service/src/main/java/com/vmware/vic/PropFetcher.java
@@ -115,15 +115,17 @@ private static VimPortType initializeVimPort() {
             _logger.error(e);
         }
 
-        javax.net.ssl.SSLSessionContext sslsc = sc.getServerSessionContext();
-        sslsc.setSessionTimeout(0);
-        try {
-            sc.init(null, tms, null);
-        } catch (KeyManagementException e) {
-            _logger.error(e);
+        if (null != sc) {
+            javax.net.ssl.SSLSessionContext sslsc = sc.getServerSessionContext();
+            sslsc.setSessionTimeout(0);
+            try {
+                sc.init(null, tms, null);
+            } catch (KeyManagementException e) {
+                _logger.error(e);
+            } 
+            javax.net.ssl.HttpsURLConnection.setDefaultSSLSocketFactory(
+                    sc.getSocketFactory());
         }
-        javax.net.ssl.HttpsURLConnection.setDefaultSSLSocketFactory(
-                sc.getSocketFactory());
     }
 
     public PropFetcher(
diff --git a/h5c/vic-service/src/main/java/com/vmware/vic/utils/ConfigLoader.java b/h5c/vic-service/src/main/java/com/vmware/vic/utils/ConfigLoader.java
index fcea008ea..cea484735 100644
--- a/h5c/vic-service/src/main/java/com/vmware/vic/utils/ConfigLoader.java
+++ b/h5c/vic-service/src/main/java/com/vmware/vic/utils/ConfigLoader.java
@@ -26,12 +26,19 @@ public class ConfigLoader {
 	private final Properties prop;
 
 	public ConfigLoader(String configFile) throws IOException {
-		prop = new Properties();
-		InputStream is = getClass().getClassLoader().getResourceAsStream(configFile);
-		if (is != null) {
-			prop.load(is);
-		} else {
-			throw new FileNotFoundException("'" + configFile + "' was not found");
+		InputStream is = null;
+		try {
+			prop = new Properties();
+			is = getClass().getClassLoader().getResourceAsStream(configFile);
+			if (is != null) {
+				prop.load(is);
+			} else {
+				throw new FileNotFoundException("'" + configFile + "' was not found");
+			}
+		} finally {
+			if(is != null) {
+				is.close();
+			}
 		}
 	}