Skip to content

Android: bundle download can hang forever (no connect/read timeouts on HttpURLConnection) #146

Open

Description

@superKalo

On Android, the OTA bundle download has no network timeouts, so a stalled connection can block forever without any event reaching JS.

StallionFileDownloader.setupConnection (and StallionApiManager) opens an HttpURLConnection without calling setConnectTimeout / setReadTimeout. Both default to 0 (infinite). If the connection stalls mid-download (e.g. Wi-Fi stays connected but has no internet), inputStream.read() in downloadFile blocks indefinitely:

  • no DOWNLOAD_ERROR_PROD is emitted, and progress stops
  • isDownloadInProgress in StallionSyncHandler is never released, so calling sync() again returns silently and can't recover the download
    only killing the app recovers it
  • iOS doesn't have this problem, because URLSession's default timeoutIntervalForRequest (60s) turns a stall into a DOWNLOAD_ERROR_PROD.

This matters most for mandatory updates, where the app shows a blocking "downloading" screen. With a stalled download, users are stuck on it with no way to retry.

Suggested fix: set connect/read timeouts on the connections in setupConnection and StallionApiManager. A stall then throws an IOException, goes through the existing onReject path, emits DOWNLOAD_ERROR_PROD, and releases the lock so sync() can retry. The download also resumes from the cache via the Range header.

This observation is with version 2.3.2 (but also present on your main branch).

Activity

  1. self-assigned this
    on Oct 9, 2026
  2. Thor963 commented on Oct 11, 2026

    @Thor963
    Contributor

    Hey @superKalo , Were you able to find a way to reproduce this issue at your level ? Wifi disconnect or internet failures would trigger IOExceptions which in turn would exit stalled downloads.
    Did you find a way to replicate a state where a download remains stuck ?

  3. Thor963 commented on Oct 12, 2026

    @Thor963
    Contributor
  4. superKalo commented on Oct 13, 2026

    @superKalo
    Author

    Hey, hey. Reproduce real-world, no. I just saw it could be a legit failure vector by analyzing the code paths. Thank you for taking a look into this 🙏

  5. Thor963 commented on Oct 18, 2026

    @Thor963
    Contributor

    Changes are live on 2.5.0-alpha.3. Stable 2.5.0 release is planned for this month

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions