ghoul: resource-leak - close gzip.Reader after decompressing descriptors

[fereidani]

Hi,

I have built a static analyzer for Go called Ghoul, and I ran it against the protobuf codebase. It flagged two resource leaks where a gzip.Reader used to decompress registered file descriptors is allocated but never closed.

Ghoul related reports:

proto/registry.go:36: [resource-leak] gzip.Reader from compress/gzip.NewReader never closed (confidence: 6.4/10, CWE-404)
descriptor/descriptor.go:128: [resource-leak] gzip.Reader from compress/gzip.NewReader never closed (confidence: 6.4/10, CWE-404)

This change adds defer zr.Close() right after the error check in proto.RegisterFile and descriptor.deriveFileDescriptor, so the reader is released once the descriptor bytes have been read. The decompression logic and its error handling are unchanged; the patch only adds the close.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[puellanivis]

The github.com/golang/protobuf module is frozen except for essential bug fixes and regressions from one of the more recent versions.