LAMeD: LLM-generated Annotations for Memory Leak Detection

TL;DR

LAMeD introduces the use of LLM-generated, function-level annotations to guide static memory-leak analysis, addressing path explosion and annotation scalability. By prompting an LLM with per-function code and call-graph context, LAMeD produces JSON-formatted annotations that are fed into analyzers like CodeQL and Cooddy, improving leak detection on real-world datasets. The evaluation shows increased bug findings with annotated configurations, though it also highlights raised warning volumes and model-dependent trade-offs in precision and recall. The work demonstrates the feasibility of integrating LLM-driven annotations into static analysis and discusses extensions to external libraries and broader bug classes, with data and prompts released to facilitate replication.

Abstract

Static analysis tools are widely used to detect software bugs and vulnerabilities but often struggle with scalability and efficiency in complex codebases. Traditional approaches rely on manually crafted annotations -- labeling functions as sources or sinks -- to track data flows, e.g., ensuring that allocated memory is eventually freed, and code analysis tools such as CodeQL, Infer, or Cooddy can use function specifications, but manual annotation is laborious and error-prone, especially for large or third-party libraries. We present LAMeD (LLM-generated Annotations for Memory leak Detection), a novel approach that leverages large language models (LLMs) to automatically generate function-specific annotations. When integrated with analyzers such as Cooddy, LAMeD significantly improves memory leak detection and reduces path explosion. We also suggest directions for extending LAMeD to broader code analysis.

Figures (2)

• Figure 1: Annotating an "operator delete[](void*, std:: nothrow_t const&)" function (from Cooddy docs; FreeSink means freeing a variable with a free function of "type 3").
• Figure 2: The proposed LLM-enhanced memory leak detection pipeline.