call Dispose() function after FlushFinalBlock()?

Question

I have the following code:

Public Shared Function Crypt(text As String) As String
    If text <> "" Then
        Dim cryptoProvider As New DESCryptoServiceProvider()
        Dim ms As New MemoryStream()
        Dim cs As New CryptoStream(ms, cryptoProvider.CreateEncryptor(KEY_64, IV_64), CryptoStreamMode.Write)
        Dim sw As New StreamWriter(cs)

           sw.Write(text)
           sw.Flush()
           cs.FlushFinalBlock()
           ms.Flush()

        'convert back to a string
        Return Convert.ToBase64String(ms.GetBuffer(), 0, CInt(ms.Length))
    End If

    Return ""

End Function

after a Fortify scan, they report that i need to release the cs CryptoStream object.

As far as i know, FlushFinalBlock() method do it this job.

Do I need call the disponse() function too? Or may be is a false-positive issue?

You need to dispose of the CryptoStream (and the other objects, too). See the same procedure [here](https://stackoverflow.com/a/51888378/7444103) (look for the `CreateEncryptor` / `CreateDecryptor` sections). You can call `Dispose()` on those objects or declare them with `using` statements. The (hidden) `Finally` section of the `Using` block will take care of them all. — Jimi, Feb 07 '20 at 23:38
When you flush a Stream (any Stream), you don't dispose of it. — Jimi, Feb 07 '20 at 23:48

jmcilhinney · Answer 1 · 2020-02-08T02:06:54.213

Any object that implements the IDisposable interface and is only used within the scope of a single block should be created with a Using statement. That way, it is guaranteed to be implicitly disposed at the end of the Using block. That applies even if a Return statement is hit or an exception is thrown. In your case, you are creating four disposable objects. There's no code required between the creation of each object or the destruction of each object so you don't need multiple nested Using blocks. You should use a single Using statement for them all:

Using cryptoProvider As New DESCryptoServiceProvider(),
      ms As New MemoryStream(),
      cs As New CryptoStream(ms, cryptoProvider.CreateEncryptor(KEY_64, IV_64), CryptoStreamMode.Write),
      sw As New StreamWriter(cs)
    '...
End Using

call Dispose() function after FlushFinalBlock()?

1 Answers1