dotnet / dotnet/android

AIDL CSharpCodeGenerator: generated Proxy void methods leak __reply Parcel

Closed
#11,508 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
2.1k
Forks
579
Avg merge
1d 21h
Merged PRs (30d)
257

Description

### Summary

In `Xamarin.Android.Tools.Aidl.CSharpCodeGenerator`-generated Proxy code for non-`oneway` `void` methods, the `__reply` `Parcel` is obtained and used (for `ReadException ()`) but is **never recycled**:

```csharp
var __reply = Parcel.Obtain ();
try {
// ... write args, Transact (), __reply.ReadException ()
} finally {
__data.Recycle ();
// __reply.Recycle () is missing
}
```

This leaks `Parcel` instances on every cross-process call.

### Fix direction

For non-`oneway` void methods the generator should either:

- Recycle `__reply` in the `finally` block alongside `__data`, **or**
- Skip allocating `__reply` entirely if no return value / out-parameter requires it (but still call `Transact` with a reply parcel so `ReadException ()` can surface remote exceptions, then recycle it).

### Where

`src/Xamarin.Android.Tools.Aidl/CSharpCodeGenerator.cs` — Proxy method emission.

### Repro / evidence

See the golden output in `tests/Xamarin.Android.Tools.Aidl-Tests/TestData/IBinderTypes.txt` (added in #11460); the void Proxy method allocates `__reply` but the `finally` only recycles `__data`.

### Notes

- Does not affect methods that already need `__reply` recycling for typed return values (those should also be audited).
- Related: #5011 (needs unit tests — addressed by #11460).

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.