Abstract:Existing tools for the automated detection of memory corruption bugs are not very effective in practice. They typically recognize only standard memory management (MM) APIs (e.g., malloc and free) and assume a naive paired-use model—an allocator is followed by a specific deallocator. However, we observe that programmers very often design their own MM functions and that these functions often manifest two major characteristics: (1) Custom allocator functions perform multi-object or nested allocation which then requires structure-aware deallocation functions. (2) Custom allocators and deallocators follow an unpaired-use model. A more effective detection thus needs to adapt those characteristics and capture memory bugs related to non-standard MM behaviors. In this paper, we present a MM function aware memory bug detection technique by introducing the concept of structure-aware and object-centric Memory Operation Synopsis (MOS). A MOS abstractly describes the memory objects of a given MM function, how they are managed by the function, and their structural relations. By utilizing MOS, a bug detection could explore much less code but is still capable of handling multi-object or nested allocations and does not rely on the paired-use model. In addition, to extensively find MM functions and automatically generate MOS for them, we propose a new identification approach that combines natural language processing (NLP) and data flow analysis, which enables the efficient and comprehensive identification of MM functions, even in very large code bases. We implement a MOS-enhanced memory bug detection system, Goshawk, to discover memory bugs caused by complex and custom MM behaviors. We applied Goshawk to well-tested and widely-used open source projects including OS kernels, server applications, and IoT SDKs. Goshawk outperforms the state-of-the-art data flow analysis driven bug detection tools by an order of magnitude in analysis speed and the number of accurately identified MM functions, reports the discovered bugs with a developer-friendly, MOS based description, and successfully detects 92 new double-free and use-after-free bugs.

Safe Memory-Leak Fixing for C Programs

Automatically Validating Static Memory Leak Warnings for C / C + + Programs

A memory leak auto repair method based on control flow diagram

AddressWatcher: Sanitizer-Based Localization of Memory Leak Fixes

Tools to Make C Programs Safe: a Deeper Study

Summary-based method to improve memory leak analysis

Memory and resource leak defects and their repairs in Java projects

Benchmark of Tools for Memory Leak

Dynamically Validating Static Memory Leak Warnings

SafeMD: Ownership-Based Safe Memory Deallocation for C Programs

Combining Static Analysis With Directed Symbolic Execution for Scalable and Accurate Memory Leak Detection

LeakPair: Proactive Repairing of Memory Leaks in Single Page Web Applications

Detecting Memory-Related Bugs by Tracking Heap Memory Management of C++ Smart Pointers

Towards an understanding of memory leak patterns: an empirical study in Python

Automated repair of resource leaks in Android applications

Patch Space Exploration using Static Analysis Feedback

FREEWILL: Automatically Diagnosing Use-after-free Bugs via Reference Miscounting Detection on Binaries

rCanary: Detecting Memory Leaks Across Semi-automated Memory Management Boundary in Rust

Beyond Memory Safety: an Empirical Study on Bugs and Fixes of Rust Programs

Goshawk: Hunting Memory Corruptions Via Structure-Aware and Object-Centric Memory Operation Synopsis

Detecting Exception Handling Bugs in C++ Programs.