Finding Memory Leaks in C/C++ Programs via Neuro-Symbolic Augmented Static Analysis

• URL: http://arxiv.org/abs/2603.27224v2
• Date: Thu, 02 Apr 2026 16:04:03 GMT
• Title: Finding Memory Leaks in C/C++ Programs via Neuro-Symbolic Augmented Static Analysis
• Abstract summary: MemHint is a neuro-symbolic pipeline that combines semantic understanding of code with symbolic reasoning.<n>MemHint detects 52 unique memory leaks at approximately $1.7 per detected bug, compared to 19 by vanilla CodeQL and 3 by vanilla Infer.<n>On seven real-world C/C++ projects totaling over 3.4M lines of code, MemHint detects 52 unique memory leaks at approximately $1.7 per detected bug, compared to 19 by vanilla CodeQL and 3 by vanilla Infer.
• Score: 10.008985618291723
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Memory leaks remain prevalent in real-world C/C++ software. Static analyzers such as CodeQL provide scalable program analysis but frequently miss such bugs because they cannot recognize project-specific custom memory-management functions and lack path-sensitive control-flow modeling. We present MemHint, a neuro-symbolic pipeline that addresses both limitations by combining LLMs' semantic understanding of code with Z3-based symbolic reasoning. MemHint parses the target codebase and applies an LLM to classify each function as a memory allocator, deallocator, or neither, producing function summaries that record which argument or return value carries memory ownership, extending the analyzer's built-in knowledge beyond standard primitives such as malloc and free. A Z3-based validation step checks each summary against the function's control-flow graph, discarding those whose claimed memory operation is unreachable on any feasible path. The validated summaries are injected into CodeQL and Infer via their respective extension mechanisms. Z3 path feasibility filtering then eliminates warnings on infeasible paths, and a final LLM-based validation step confirms whether each remaining warning is a genuine bug. On seven real-world C/C++ projects totaling over 3.4M lines of code, MemHint detects 52 unique memory leaks (49 confirmed/fixed, 4 CVEs submitted) at approximately $1.7 per detected bug, compared to 19 by vanilla CodeQL and 3 by vanilla Infer.

Related papers

• PTSan: A Practical Memory Safety Sanitizer for C/C++ with Pointer-Object Authority [0.0]
  PTSan makes pointer-based checking practical by an object identifier in each pointer's high bits and its bounds in a fixed-size runtime table.<n> PTSan runs at parity with the fastest published location-based sanitizer.
  arXiv  Detail & Related papers  (2026-07-21T16:16:27Z)
• Memory as a Controlled Process: Learned Adaptive Memory Management for LLM Agents [72.3752981234916]
  Large Language Model (LLM) agents increasingly rely on external memory systems to accumulate experience across tasks.<n>We present Memory as a Controlled Process (MemCon), a framework that models memory operations as a Markov Decision Process.<n>MemCon consistently outperforms multiple memory baselines by up to 15.2 points in task success while reducing token consumption by 5-20%.
  arXiv  Detail & Related papers  (2026-07-15T08:32:40Z)
• MemGym: a Long-Horizon Memory Environment for LLM Agents [69.79226770543049]
  We present MemGym, a benchmark for agentic memory that unifies existing agent gyms and in-house memory-grounded pipelines.<n>MemGym reports memory-isolated scores that decouple memory performance from reasoning, retrieval, and tool-use ability.<n>Our synthetic pipelines for MEMGYM-CODEQA and MEMGYM-DR are length-controllable, ablation-verified at every stage, and tightly aligned with downstream scenarios.
  arXiv  Detail & Related papers  (2026-05-20T07:25:33Z)
• Memory Transfer Learning: How Memories are Transferred Across Domains in Coding Agents [56.078070829341534]
  Memory-based self-evolution has emerged as a promising paradigm for coding agents.<n>We investigate textbfMemory Transfer Learning (MTL) by harnessing a unified memory pool from heterogeneous domains.
  arXiv  Detail & Related papers  (2026-04-15T15:50:29Z)
• SuperLocalMemory V3.3: The Living Brain -- Biologically-Inspired Forgetting, Cognitive Quantization, and Multi-Channel Retrieval for Zero-LLM Agent Memory Systems [0.0]
  We present SuperLocalMemory V3.3 ("The Living Brain"), a local-first agent memory system.<n>It implements the full cognitive memory taxonomy with mathematical lifecycle dynamics.<n>It is open source under the Elastic License 2.0, runs entirely on CPU, and has over 5,000 monthly downloads.
  arXiv  Detail & Related papers  (2026-04-06T08:27:26Z)
• Bridging Code Property Graphs and Language Models for Program Analysis [1.7158296436650338]
  Large Language Models (LLMs) face critical challenges when analyzing security vulnerabilities in real worlds.<n> token limits prevent loading entire repositories, code embeddings fail to capture inter procedural data flows, and LLMs struggle to generate complex static analysis queries.<n>We introduce codebadger, an open source Model Context Protocol (MCP) server that integrates Joern's Code Property Graph engine with LLMs.
  arXiv  Detail & Related papers  (2026-03-25T22:08:04Z)
• SPARC: Scenario Planning and Reasoning for Automated C Unit Test Generation [1.0010193170880752]
  We introduce a neuro-symbolic, scenario-based framework that bridges the gap between high-level program intent and the rigid syntactic constraints of pointer arithmetic and manual memory management.<n>We evaluate it on 59 real-world and algorithmic subjects, where it outperforms the vanilla prompt generation baseline by 31.36% in line coverage, 26.01% in branch coverage, and 20.78% in mutation score, matching or exceeding the symbolic execution tool KLEE.
  arXiv  Detail & Related papers  (2026-02-18T18:09:03Z)
• PlugMem: A Task-Agnostic Plugin Memory Module for LLM Agents [74.4491017652226]
  We propose PlugMem, a task-agnostic memory module that can be attached to arbitrary LLM agents without task-specific redesign.<n>Motivated by the fact that decision-relevant information is concentrated as abstract knowledge rather than raw experience, we draw on cognitive science to structure episodic memories into a compact, knowledge-centric memory graph.<n>We evaluate PlugMem unchanged across three benchmarks (long-horizon conversational question answering, multi-hop knowledge retrieval, and web agent tasks)
  arXiv  Detail & Related papers  (2026-02-06T18:55:38Z)
• Sparse-dLLM: Accelerating Diffusion LLMs with Dynamic Cache Eviction [72.27673320976933]
  Diffusion Large Language Models (dLLMs) enable breakthroughs in reasoning and parallel decoding.<n>Current caching techniques accelerate decoding by storing full-layer states, yet impose substantial memory usage.<n>We propose Sparse-dLLM, the first training-free framework integrating dynamic cache eviction with sparse attention.
  arXiv  Detail & Related papers  (2025-08-04T16:14:03Z)
• LAMeD: LLM-generated Annotations for Memory Leak Detection [5.529919602615033]
  We present LAMeD, a novel approach to automatically generate function-specific annotations.<n>When integrated with analyzers such as Cooddy, LAMeD significantly improves memory leak detection and reduces path explosion.
  arXiv  Detail & Related papers  (2025-05-05T05:34:33Z)
• LeakGuard: Detecting Memory Leaks Accurately and Scalably [3.256598917442277]
  LeakGuard is a memory leak detection tool which provides satisfactory balance of accuracy and scalability.<n>For accuracy, LeakGuard analyzes the behaviors of library and developer-defined memory allocation and deallocation functions.<n>For scalability, LeakGuard examines each function of interest independently by using its function summary and under-constrained symbolic execution technique.
  arXiv  Detail & Related papers  (2025-04-06T09:11:37Z)
• MemLLM: Finetuning LLMs to Use An Explicit Read-Write Memory [49.96019697955383]
  We introduce MemLLM, a novel method of enhancing large language models (LLMs) by integrating a structured and explicit read-and-write memory module.<n>Our experiments indicate that MemLLM enhances the LLM's performance and interpretability, in language modeling in general and knowledge-intensive tasks in particular.
  arXiv  Detail & Related papers  (2024-04-17T18:13:16Z)
• FoC: Figure out the Cryptographic Functions in Stripped Binaries with LLMs [51.898805184427545]
  We propose a novel framework called FoC to Figure out the Cryptographic functions in stripped binaries.<n>We first build a binary large language model (FoC-BinLLM) to summarize the semantics of cryptographic functions in natural language.<n>We then build a binary code similarity model (FoC-Sim) upon the FoC-BinLLM to create change-sensitive representations and use it to retrieve similar implementations of unknown cryptographic functions in a database.
  arXiv  Detail & Related papers  (2024-03-27T09:45:33Z)
• rCanary: Detecting Memory Leaks Across Semi-automated Memory Management Boundary in Rust [4.616001680122352]
  Rust is a system programming language that guarantees memory safety via compile-time verifications. We present rCanary, a static, non-automated, and fully automated model checker to detect leaks across semiautomated boundary.
  arXiv  Detail & Related papers  (2023-08-09T08:26:04Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.