LeakGuard: Detecting Memory Leaks Accurately and Scalably

TL;DR

LeakGuard tackles memory-leak detection by coupling precise, path-sensitive modeling of memory-allocation/deallocation functions with scalable analysis via bottom-up MAD-function summaries and under-constrained symbolic execution. It introduces ownership-aware memory models and a pointer escape analysis to accurately track dynamic memory, while pruning exploration through MAD-caller filtering. Empirically, LeakGuard outperforms multiple state-of-the-art tools and discovers 129 previously unknown leaks across 18 real-world projects, all confirmed by developers, demonstrating strong practical impact. The work provides a public benchmark and a scalable framework for evaluating memory-leak detectors in large-scale software ecosystems.

Abstract

Memory leaks are prevalent in various real-world software projects, thereby leading to serious attacks like denial-of-service. Though prior methods for detecting memory leaks made significant advance, they often suffer from low accuracy and weak scalability for testing large and complex programs. In this paper we present LeakGuard, a memory leak detection tool which provides satisfactory balance of accuracy and scalability. For accuracy, LeakGuard analyzes the behaviors of library and developer-defined memory allocation and deallocation functions in a path-sensitive manner and generates function summaries for them in a bottom-up approach. Additionally, we develop a pointer escape analysis technique to model the transfer of pointer ownership. For scalability, LeakGuard examines each function of interest independently by using its function summary and under-constrained symbolic execution technique, which effectively mitigates path explosion problem. Our extensive evaluation on 18 real-world software projects and standard benchmark datasets demonstrates that LeakGuard achieves significant advancements in multiple aspects: it exhibits superior MAD function identification capability compared to Goshawk, outperforms five state-of-the-art methods in defect detection accuracy, and successfully identifies 129 previously undetected memory leak bugs, all of which have been independently verified and confirmed by the respective development teams.

Figures (5)

• Figure 1: A memory leak in OpenSSL found by LeakGuard
• Figure 2: Overview of LeakGuard
• Figure 3: Code snippet from FFmpeg project
• Figure 4: Code snippet from OpenSSL project
• Figure 5: Code snippet from redis project