Close HPKERecipientContext when OHttpCryptoReceiver.Builder.build() t…

…hrows (#34)

Motivation:

It was possible to leak the HPKERecipientContext when the OHttpCryptoReceiver.Builder.build() method did throw.

Modifications:

Catch Throwable and only rethrow after HPKERecipientContext.close() was called.

Result:

Fix possible leak in case of error

codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpCryptoReceiver.java

@@ -101,15 +101,21 @@ private OHttpCryptoReceiver(Builder builder) {
         if (keyPair == null) {
             throw new DecoderException("ciphersuite not supported");
         }
-        this.context = provider.setupHPKEBaseR(HPKEMode.Base, ciphersuite.kem(), ciphersuite.kdf(),
-                ciphersuite.aead(), encapsulatedKey, keyPair, ciphersuite.createInfo(configuration));
         if (builder.forcedResponseNonce == null) {
             this.responseNonce = ciphersuite.createResponseNonce();
         } else {
             this.responseNonce = builder.forcedResponseNonce;
         }
-        this.aead = ciphersuite.createResponseAEAD(provider, this.context, encapsulatedKey,
-                this.responseNonce, configuration.responseExportContext());
+        this.context = provider.setupHPKEBaseR(HPKEMode.Base, ciphersuite.kem(), ciphersuite.kdf(),
+                ciphersuite.aead(), encapsulatedKey, keyPair, ciphersuite.createInfo(configuration));
+        try {
+            this.aead = ciphersuite.createResponseAEAD(provider, context, encapsulatedKey,
+                    this.responseNonce, configuration.responseExportContext());
+        } catch (Throwable cause) {
+            // Close context before rethrowing as otherwise we might leak resources.
+            context.close();
+            throw cause;
+        }
     }
 
     /**