LeakGuard: Detecting Memory Leaks Accurately and Scalably

2025-04-06

AI Summary

To address the challenge of balancing accuracy and scalability in memory leak detection for large, complex programs, this paper proposes a path-sensitive, summary-driven static analysis framework. Methodologically, it introduces a novel synergistic analysis mechanism integrating function summaries with under-constrained symbolic execution; constructs a path-sensitive memory-function behavioral model by combining bottom-up summary generation with fine-grained pointer ownership transfer modeling to enhance memory lifetime reasoning; and mitigates path explosion via pointer escape analysis and summary-based modular function analysis. Evaluated on 18 real-world projects and standard benchmarks, the approach outperforms Goshawk and five state-of-the-art tools, precisely identifying 129 previously unknown memory leaks—all confirmed and fixed by developers.

Technology Category

• Machine Learning: Evaluation and Analysis
• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories

Application Category

• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Security and Privacy: Large-scale security measurements
• Web Mining and Content Analysis: Topic discovery and tracking

Abstract

Memory leaks are prevalent in various real-world software projects, thereby leading to serious attacks like denial-of-service. Though prior methods for detecting memory leaks made significant advance, they often suffer from low accuracy and weak scalability for testing large and complex programs. In this paper we present LeakGuard, a memory leak detection tool which provides satisfactory balance of accuracy and scalability. For accuracy, LeakGuard analyzes the behaviors of library and developer-defined memory allocation and deallocation functions in a path-sensitive manner and generates function summaries for them in a bottom-up approach. Additionally, we develop a pointer escape analysis technique to model the transfer of pointer ownership. For scalability, LeakGuard examines each function of interest independently by using its function summary and under-constrained symbolic execution technique, which effectively mitigates path explosion problem. Our extensive evaluation on 18 real-world software projects and standard benchmark datasets demonstrates that LeakGuard achieves significant advancements in multiple aspects: it exhibits superior MAD function identification capability compared to Goshawk, outperforms five state-of-the-art methods in defect detection accuracy, and successfully identifies 129 previously undetected memory leak bugs, all of which have been independently verified and confirmed by the respective development teams.

Problem

• Detects memory leaks accurately in complex software
• Improves scalability for large program analysis
• Identifies previously undetected memory leak bugs

Innovation

• Path-sensitive analysis for memory functions
• Pointer escape analysis for ownership transfer
• Under-constrained symbolic execution for scalability