commit db11331cd62ad8bc4f5454c33a42280f419909d2
Author: Andrew John Hughes <andrew@openjdk.org>
Date:   Wed Nov 9 15:49:09 2022 +0000

    Backport d53072236c503295b893efa6372c869ac84fa688

diff --git a/jdk/src/share/classes/org/jcp/xml/dsig/internal/dom/DOMReference.java b/jdk/src/share/classes/org/jcp/xml/dsig/internal/dom/DOMReference.java
index c4cac5351cc..53de0490c5b 100644
--- a/jdk/src/share/classes/org/jcp/xml/dsig/internal/dom/DOMReference.java
+++ b/jdk/src/share/classes/org/jcp/xml/dsig/internal/dom/DOMReference.java
@@ -500,38 +500,44 @@ public final class DOMReference extends DOMStructure
                 }
 
                 boolean secVal = Utils.secureValidation(context);
-                xi.setSecureValidation(secVal);
-                if (context instanceof XMLSignContext && c14n11
-                    && !xi.isOctetStream() && !xi.isOutputStreamSet()) {
-                    TransformService spi = null;
-                    if (provider == null) {
-                        spi = TransformService.getInstance(c14nalg, "DOM");
-                    } else {
-                        try {
-                            spi = TransformService.getInstance(c14nalg, "DOM", provider);
-                        } catch (NoSuchAlgorithmException nsae) {
+                try {
+                    xi.setSecureValidation(secVal);
+                    if (context instanceof XMLSignContext && c14n11
+                            && !xi.isOctetStream() && !xi.isOutputStreamSet()) {
+                        TransformService spi = null;
+                        if (provider == null) {
                             spi = TransformService.getInstance(c14nalg, "DOM");
+                        } else {
+                            try {
+                                spi = TransformService.getInstance(c14nalg, "DOM", provider);
+                            } catch (NoSuchAlgorithmException nsae) {
+                                spi = TransformService.getInstance(c14nalg, "DOM");
+                            }
                         }
-                    }
 
-                    DOMTransform t = new DOMTransform(spi);
-                    Element transformsElem = null;
-                    String dsPrefix = DOMUtils.getSignaturePrefix(context);
-                    if (allTransforms.isEmpty()) {
-                        transformsElem = DOMUtils.createElement(
-                            refElem.getOwnerDocument(),
-                            "Transforms", XMLSignature.XMLNS, dsPrefix);
-                        refElem.insertBefore(transformsElem,
-                            DOMUtils.getFirstChildElement(refElem));
+                        DOMTransform t = new DOMTransform(spi);
+                        Element transformsElem = null;
+                        String dsPrefix = DOMUtils.getSignaturePrefix(context);
+                        if (allTransforms.isEmpty()) {
+                            transformsElem = DOMUtils.createElement(
+                                    refElem.getOwnerDocument(),
+                                    "Transforms", XMLSignature.XMLNS, dsPrefix);
+                            refElem.insertBefore(transformsElem,
+                                    DOMUtils.getFirstChildElement(refElem));
+                        } else {
+                            transformsElem = DOMUtils.getFirstChildElement(refElem);
+                        }
+                        t.marshal(transformsElem, dsPrefix,
+                                (DOMCryptoContext) context);
+                        allTransforms.add(t);
+                        xi.updateOutputStream(os, true);
                     } else {
-                        transformsElem = DOMUtils.getFirstChildElement(refElem);
+                        xi.updateOutputStream(os);
+                    }
+                } finally {
+                    if(xi.getOctetStreamReal() != null) {
+                        xi.getOctetStreamReal().close();
                     }
-                    t.marshal(transformsElem, dsPrefix,
-                              (DOMCryptoContext)context);
-                    allTransforms.add(t);
-                    xi.updateOutputStream(os, true);
-                } else {
-                    xi.updateOutputStream(os);
                 }
             }
             os.flush();