Abstract:ABSTRACTSoftware systems commonly use resources such as network connections or external file handles. Once finish using the resources, the software systems must release these resources by explicitly calling specific resource-releasing API methods. Failing to release resources properly could result in resource leaks or even outright system failures. Existing verification techniques could analyze software systems to detect defects related to failing to release resources. However, these techniques require resource-releasing specifications for specifying which API method acquires/releases certain resources, and such specifications are not well documented in practice, due to the large amount of manual effort required to document them. To address this issue, we propose an iterative mining approach, called RRFinder, to automatically mining resource-releasing specifications for API libraries in the form of (resource-acquiring, resource-releasing) API method pairs. RRFinder first identifies resource-releasing API methods, for which RRFinder then identifies the corresponding resource-acquiring API methods. To identify resource-releasing API methods, RRFinder performs an iterative process including three steps: model-based prediction, call-graph-based propagation, and class-hierarchy-based propagation. From heterogeneous information (e.g., source code, natural language), the model-based prediction employs a classification model to predict the likelihood that an API method is a resource-releasing method. The call-graph-based and class-hierarchy-based propagation propagates the likelihood information across methods. We evaluated RRFinder on eight open source libraries, and the results show that RRFinder achieved an average recall of 94.0% with precision of 86.6% in mining resource-releasing specifications, and the mined specifications are useful in detecting resource leak defects.

Inferring Resource-Oriented Intentions Using LLMs for Static Resource Leak Detection

Boosting Static Resource Leak Detection via LLM-based Resource-Oriented Intention Inference

Inference of Resource Management Specifications

Mining Resource-Operation Knowledge to Support Resource Leak Detection

Leveraging Static Analysis for Bug Repair

Resource Leak Checker (RLC#) for C# Code using CodeQL

Memory and resource leak defects and their repairs in Java projects

An Effective Defect Detection and Warning Prioritization Approach for Resource Leaks

Automatically Inspecting Thousands of Static Bug Warnings with Large Language Model: How Far Are We?

Iterative mining of resource-releasing specifications.

Intention Analysis Makes LLMs A Good Jailbreak Defender

DroidLeaks: a Comprehensive Database of Resource Leaks in Android Apps

DroidLeaks: Benchmarking Resource Leak Bugs for Android Applications

LLM-Assisted Static Analysis for Detecting Security Vulnerabilities

Automated repair of resource leaks in Android applications

Integrating Various Software Artifacts for Better LLM-based Bug Localization and Program Repair

The Midas Touch: Triggering the Capability of LLMs for RM-API Misuse Detection

Analyzing the Inherent Response Tendency of LLMs: Real-World Instructions-Driven Jailbreak

SkipAnalyzer: A Tool for Static Code Analysis with Large Language Models

Attention Is All You Need for LLM-based Code Vulnerability Localization

Leveraging Large Language Model to Assist Detecting Rust Code Comment Inconsistency