FULL PRODUCT VERSION :
java version "1.6.0_11"
Java(TM) SE Runtime Environment (build 1.6.0_11-b03)
Java HotSpot(TM) Client VM (build 11.0-b16, mixed mode, sharing)

Also verified against -server in both SDK 6u7 and SDK 6u11.


ADDITIONAL OS VERSION INFORMATION :
Windows XP Pro SP3
Windows 2003 Server

EXTRA RELEVANT SYSTEM CONFIGURATION :
Does not appear to be relevant.

A DESCRIPTION OF THE PROBLEM :
Using JarURLConnection (gotten from a URL using getConnection) for a "jar:file:/..." URL entry when setUseCaches(true) (which is the default setting) results in a "Private Byte" memory leak. The leak is not visible in Java heap or non-heap managed memory. I've included an example that can crash a JVM in a matter of minutes.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Run the attached source test. The leak occurs when setUseCaches(true). It does not occur when setUseCaches(false).

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Using Windows Task Manager, you can watch "Mem Usage" climb until the JVM crashes with an OutOfMemoryError. I've verified that it is eating "Private Bytes" using the Microsoft Process Explorer, so this isn't just a case of Windows over-allocating memory space.
ACTUAL -
The "Mem Usage" topped 1.6GB before I had to leave for a meeting. It had crashed by the time I returned. See crash log below.

ERROR MESSAGES/STACK TRACES THAT OCCUR :
Attached seperatly

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
package com.infotrustgroup.bug;

import java.io.BufferedOutputStream;
import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.Reader;
import java.net.JarURLConnection;
import java.net.MalformedURLException;
import java.net.URL;
import java.security.SecureRandom;
import java.util.zip.ZipEntry;
import java.util.zip.ZipOutputStream;

/**
 * <p>This example demonstrates how to produce a "Private Bytes" memory leak in Java associated with
 * the use of {@link java.net.JarURLConnection}.</p>
 *
 * <p>This memory leak does not show up at all in the JMX interfaces (either the heap/non-heap
 * summaries or the various memory pools). It has been verified on <i>Windows XP</i> and <i>Windows 2003
 * Server</i>, against <i>Java 6u7</i> and <i>Java 6u11</i>.</p>
 *
 * <p>Running this program will result in an out-of-memory error being thrown within just a few
 * minutes. You can watch the "Memory Usage" (a.k.a. - "Working Set") increase linearly
 * using <i>Windows Task Manager</i>, and you can verify that "Private Bytes" are being consumed
 * in the same fashion using <i>Microsoft Process Explorer</i> (may be downloaded for free from
 * <i>Microsoft</i>). There is no corresponding increase in Java heap or non-heap memory. From
 * the JMX interfaces, the application appears to be behaving correctly.</p>
 *
 * <p>To stop the leak from occurring, simply find this line:
 * <pre>connection.setUseCaches(true);</pre>
 * and set the value to <code>false</code>.</p>
 *
 * <p>Most of the code in this example is needed just to set the scenario. The leak appears to be
 * occurring entirely because of {@link #getZipData(File, int)}.</p>
 *
 * <p>All this sample is doing is creating a small, random ZIP file with a few entries, reading
 * the entries using a connection from a URL, and then deleting the ZIP file.</p>
 *
 * @author Jason Smith
 */
public class ZipLeakDemo
{
/**
* Endlessly creates small random ZIP files and reads the contents.
*/
public static void main(String...args) throws Exception
{
long count = 0;
while(true)
{
File randomZipFile = createRandomZip();
try
{
for(int i=0; i<10; i++)
{
System.out.print("\t" + i + ".\t");
Reader reader = getZipData(randomZipFile, i);
try
{
while(true)
{
int c = reader.read();
if(c == -1)
{
break;
}
System.out.print((char)c);
}
System.out.println();
}
finally
{
reader.close();
}
}
}
finally
{
System.out.println((count++) + ": " + randomZipFile);
randomZipFile.delete();
}
}
}

/**
* This method causes the leak. To stop the leak, set 'useCaches' to <code>false</code>.
* @param zipFile The file to read.
* @param index The "index" of the entry (written as '2.txt').
* @return A {@link Reader}.
*/
private static Reader getZipData(File zipFile, int index) throws MalformedURLException, IOException
{
        URL url = new URL("jar:file:/" + zipFile.getCanonicalPath().replace('\\', '/') + "!/" + index + ".txt");
        JarURLConnection connection = (JarURLConnection)url.openConnection();
        connection.setUseCaches(true);
        return new InputStreamReader(connection.getInputStream(), "UTF-8");
}

/**
* Creates a small zip with 10 entries, each in the form '1.txt', '2.txt', etc. The entries contain
* a few bytes of random data. The ZIP file is uncompressed, though that has nothing to do with the
* leak.
* @return A random ZIP file.
*/
private static File createRandomZip() throws IOException
{
File zipFile = File.createTempFile("~zip-bug-", ".zip").getCanonicalFile();
ZipOutputStream zipOut = new ZipOutputStream(new BufferedOutputStream(new FileOutputStream(zipFile)));
try
{
zipOut.setLevel(0);
for(int i=0; i<10; i++)
{
ZipEntry entry = new ZipEntry(i + ".txt");
entry.setTime(System.currentTimeMillis());
zipOut.putNextEntry(entry);
zipOut.write(randomText(50).getBytes("US-ASCII"));
zipOut.closeEntry();
}
}
finally
{
zipOut.close();
}
return zipFile;
}

private static final SecureRandom random = new SecureRandom();
private static final String CHARS =
" _-.,[]{}:;'+=()" +
"*&^%$#@!~`?<>123" +
"45678890abcdefgh" +
"ijklmnopqrstuvwx" +
"yzABCDEFGHIJKLMN" +
"OPQRSTUVWXYZ";

/**
* Random text generator.
* @param length Length of the random text.
* @return A random string.
*/
private static String randomText(int length)
{
StringBuilder s = new StringBuilder();
for(int i=0; i<length; i++)
{
s.append(CHARS.charAt(random.nextInt(CHARS.length())));
}
return s.toString();
}
}

---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
When using JarURLConnection in this manner, setUseCaches(false).