QuicStream leaks its native QUIC_BUFFER array for every stream that sends data #135583

using System.Net;
using System.Net.Quic;
using System.Net.Security;
using System.Reflection;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;

#pragma warning disable CA1416 // Windows only: the heap walk below.
var alpn = new SslApplicationProtocol("repro");
using var key = RSA.Create(2048);
var request = new CertificateRequest("CN=localhost", key, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
using var ephemeral = request.CreateSelfSigned(DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(1));
using var certificate = X509CertificateLoader.LoadPkcs12(ephemeral.Export(X509ContentType.Pkcs12), null);

await using var listener = await QuicListener.ListenAsync(new QuicListenerOptions
{
    ListenEndPoint = new IPEndPoint(IPAddress.Loopback, 0),
    ApplicationProtocols = [alpn],
    ConnectionOptionsCallback = (_, _, _) => ValueTask.FromResult(new QuicServerConnectionOptions
    {
        DefaultStreamErrorCode = 1,
        DefaultCloseErrorCode = 1,
        ServerAuthenticationOptions = new SslServerAuthenticationOptions { ApplicationProtocols = [alpn], ServerCertificate = certificate },
    }),
});
var accept = listener.AcceptConnectionAsync();
await using var client = await QuicConnection.ConnectAsync(new QuicClientConnectionOptions
{
    RemoteEndPoint = listener.LocalEndPoint,
    DefaultStreamErrorCode = 1,
    DefaultCloseErrorCode = 1,
    ClientAuthenticationOptions = new SslClientAuthenticationOptions
    {
        ApplicationProtocols = [alpn],
        TargetHost = "localhost",
        RemoteCertificateValidationCallback = (_, _, _, _) => true,
    },
});
await using var server = await accept;

var sendBuffers = typeof(QuicStream).GetField("_sendBuffers", BindingFlags.Instance | BindingFlags.NonPublic)!;
var buffer = new byte[1];
foreach (var write in new[] { true, false })
{
    var before = Busy16();
    var unfreed = 0;
    for (var i = 0; i < 2000; i++)
    {
        await using var outbound = await client.OpenOutboundStreamAsync(QuicStreamType.Bidirectional);
        outbound.CompleteWrites();
        var inbound = await server.AcceptInboundStreamAsync();
        while (await inbound.ReadAsync(buffer) > 0) { }
        if (write) await inbound.WriteAsync(new byte[] { 42 }, completeWrites: true);
        else inbound.CompleteWrites();
        while (await outbound.ReadAsync(buffer) > 0) { }
        await inbound.DisposeAsync();

        // MsQuicBuffers.FreeNativeMemory resets _count together with _buffers.
        var copy = sendBuffers.GetValue(inbound)!;
        if ((int)copy.GetType().GetField("_count", BindingFlags.Instance | BindingFlags.NonPublic)!.GetValue(copy)! != 0) unfreed++;
    }

    Console.WriteLine($"{(write ? "1-byte write" : "empty write ")}: 2000 disposed streams, {unfreed} still own a QUIC_BUFFER array, live 16-byte heap blocks {Busy16() - before:+#;-#;0}");
}

static long Busy16()
{
    for (var i = 0; i < 3; i++) { GC.Collect(); GC.WaitForPendingFinalizers(); }
    var heap = GetProcessHeap();
    long count = 0;
    HeapLock(heap);
    try
    {
        var entry = default(HeapEntry);
        while (HeapWalk(heap, ref entry)) if ((entry.Flags & 4) != 0 && entry.Size == 16) count++;
    }
    finally { HeapUnlock(heap); }
    return count;
}

[DllImport("kernel32.dll")] static extern IntPtr GetProcessHeap();
[DllImport("kernel32.dll")] static extern bool HeapLock(IntPtr heap);
[DllImport("kernel32.dll")] static extern bool HeapUnlock(IntPtr heap);
[DllImport("kernel32.dll")] static extern bool HeapWalk(IntPtr heap, ref HeapEntry entry);

[StructLayout(LayoutKind.Sequential)]
struct HeapEntry { public IntPtr Data; public uint Size; public byte Overhead; public byte Region; public ushort Flags; public IntPtr U0, U1, U2; }