AIDL CSharpCodeGenerator: generated Proxy void methods leak __reply Parcel
- Dominant language
- C#
- Stars
- 2.1k
- Forks
- 579
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 257
Description
### Summary
In `Xamarin.Android.Tools.Aidl.CSharpCodeGenerator`-generated Proxy code for non-`oneway` `void` methods, the `__reply` `Parcel` is obtained and used (for `ReadException ()`) but is **never recycled**:
```csharp
var __reply = Parcel.Obtain ();
try {
// ... write args, Transact (), __reply.ReadException ()
} finally {
__data.Recycle ();
// __reply.Recycle () is missing
}
```
This leaks `Parcel` instances on every cross-process call.
### Fix direction
For non-`oneway` void methods the generator should either:
- Recycle `__reply` in the `finally` block alongside `__data`, **or**
- Skip allocating `__reply` entirely if no return value / out-parameter requires it (but still call `Transact` with a reply parcel so `ReadException ()` can surface remote exceptions, then recycle it).
### Where
`src/Xamarin.Android.Tools.Aidl/CSharpCodeGenerator.cs` — Proxy method emission.
### Repro / evidence
See the golden output in `tests/Xamarin.Android.Tools.Aidl-Tests/TestData/IBinderTypes.txt` (added in #11460); the void Proxy method allocates `__reply` but the `finally` only recycles `__data`.
### Notes
- Does not affect methods that already need `__reply` recycling for typed return values (those should also be audited).
- Related: #5011 (needs unit tests — addressed by #11460).
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.