1. LEAKPOINT: Pinpointing the
Causes of Memory Leaks
Georgia Institute of Technology
James Clause and Alessandro Orso
Supported in part by NSF and IBM Research

2. Memory leak classification
void *p = malloc(100);

3. Memory leak classification
void *p = malloc(100); M

4. Memory leak classification
Lost memory Forgotten memory
M becomes unreachable
before being deallocated
M is reachable, but is never
accessed or deallocated
void *p = malloc(100); M

5. Memory leak classification
Lost memory Forgotten memory
M becomes unreachable
before being deallocated
M is reachable, but is never
accessed or deallocated
void *p = malloc(100); M

6. Memory leak classification
Lost memory Forgotten memory
M becomes unreachable
before being deallocated
M is reachable, but is never
accessed or deallocated
void *p = malloc(100); M
• common
• difficult to manually detect
• high impact

7. Existing techniques
mtrace
M. Bond and K. McKinley ‘06
R. Hastings and B. Joyce ‘92
M. Hauswirth and T. Chilimbi. ‘04
D.Heine and M.Lam ‘03
D. Heine and M. Lam ‘06
M. Jump and K. McKinley ‘07
leaks
J. Maebe, M. Ronsse, and K. D. Bosschere ‘04
N. Mitchell and G. Sevitsky ‘03
G. Novark, E. D. Berger, and B. G. Zorn ‘09
M. Orlovich and R. Rugina ‘06
F. Qin, S. Lu, and Y. Zhou ‘05
MemCheck
Y. Xie and A. Aiken ‘05
G. Xu and A. Rountev ‘08
S. Cherem, L. Princehouse, and R. Rugina ‘06
W. DePauw and G. Sevitsky ’99
purify
Publications Tools

8. addhash(char hname[]) {
35. int i;
36. HASHPTR hptr;
37. unsigned int hsum = 0;
38. for(i = 0 ; i < strlen(hname) ; i++) {
39. sum += (unsigned int) hname[i];
40. }
41. hsum %= 3001;
42. if((hptr = hashtab[hsum]) == (HASHPTR) NULL) {
43. hptr = hashtab[hsum] = (HASHPTR) malloc(sizeof(HASHBOX));
44. hptr->hnext = (HASHPTR) NULL;
45. hptr->hnum = ++netctr;
46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
47. sprintf(hptr->hname , "%s" , hname);
48. return(1);
49. } else {
! ...
67. }
}
Detecting leaks is easy

9. addhash(char hname[]) {
35. int i;
36. HASHPTR hptr;
37. unsigned int hsum = 0;
38. for(i = 0 ; i < strlen(hname) ; i++) {
39. sum += (unsigned int) hname[i];
40. }
41. hsum %= 3001;
42. if((hptr = hashtab[hsum]) == (HASHPTR) NULL) {
43. hptr = hashtab[hsum] = (HASHPTR) malloc(sizeof(HASHBOX));
44. hptr->hnext = (HASHPTR) NULL;
45. hptr->hnum = ++netctr;
46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
47. sprintf(hptr->hname , "%s" , hname);
48. return(1);
49. } else {
! ...
67. }
}
Detecting leaks is easy

10. addhash(char hname[]) {
35. int i;
36. HASHPTR hptr;
37. unsigned int hsum = 0;
38. for(i = 0 ; i < strlen(hname) ; i++) {
39. sum += (unsigned int) hname[i];
40. }
41. hsum %= 3001;
42. if((hptr = hashtab[hsum]) == (HASHPTR) NULL) {
43. hptr = hashtab[hsum] = (HASHPTR) malloc(sizeof(HASHBOX));
44. hptr->hnext = (HASHPTR) NULL;
45. hptr->hnum = ++netctr;
46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
47. sprintf(hptr->hname , "%s" , hname);
48. return(1);
49. } else {
! ...
67. }
}
Detecting leaks is easy; fixing them is not

11. Overview

12. Overview

13. Overview

14. Overview
Leak locations are close to where
leaks should be fixed.

15. Overview
1 Tainting
pointers
Leak locations are close to where
leaks should be fixed.

16. Overview
1 Tainting
pointers
Leak locations are close to where
leaks should be fixed.

17. Overview
1 Tainting
pointers
2 Propagating
taint marks
Leak locations are close to where
leaks should be fixed.

18. Overview
1 Tainting
pointers
2 Propagating
taint marks
Leak locations are close to where
leaks should be fixed.

19. Overview
1 Tainting
pointers
2 Propagating
taint marks
3 Identifying
when leaks
occur
Leak locations are close to where
leaks should be fixed.

20. Overview
1 Tainting
pointers
2 Propagating
taint marks
3 Identifying
when leaks
occur
Leak locations are close to where
leaks should be fixed.

21. addhash(char hname[]) {
35. int i;
36. HASHPTR hptr;
37. unsigned int hsum = 0;
38. for(i = 0 ; i < strlen(hname) ; i++) {
39. sum += (unsigned int) hname[i];
40. }
41. hsum %= 3001;
42. if((hptr = hashtab[hsum]) == (HASHPTR) NULL) {
43. hptr = hashtab[hsum] = (HASHPTR) malloc(sizeof(HASHBOX));
44. hptr->hnext = (HASHPTR) NULL;
45. hptr->hnum = ++netctr;
46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
47. sprintf(hptr->hname , "%s" , hname);
48. return(1);
49. } else {
! ...
67. }
}
Detecting leaks is easy

22. 46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
delHtab() {
15. int i;
16. HASHPTR hptr , zapptr;
17. for(i = 0; i < 3001; i++) {
18. hptr = hashtab[i];
19. if(hptr != (HASHPTR) NULL) {
20. zapptr = hptr ;
21. while(hptr->hnext != (HASHPTR) NULL) {
22.! ! hptr = hptr->hnext;
23.! ! free(zapptr);
24.! ! zapptr = hptr ;
25.! ! }
26.! ! free(hptr);
27.! }
28. }!
29. free(hashtab);
30. return;
}
Detecting leaks is easy

23. 46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
Detecting leaks is easy; fixing them is too
delHtab() {
15. int i;
16. HASHPTR hptr , zapptr;
17. for(i = 0; i < 3001; i++) {
18. hptr = hashtab[i];
19. if(hptr != (HASHPTR) NULL) {
20. zapptr = hptr ;
21. while(hptr->hnext != (HASHPTR) NULL) {
22.! ! hptr = hptr->hnext;
23.! ! free(zapptr);
24.! ! zapptr = hptr ;
25.! ! }
26.! ! free(hptr);
27.! }
28. }!
29. free(hashtab);
30. return;
}

24. 46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
Detecting leaks is easy; fixing them is too
delHtab() {
15. int i;
16. HASHPTR hptr , zapptr;
17. for(i = 0; i < 3001; i++) {
18. hptr = hashtab[i];
19. if(hptr != (HASHPTR) NULL) {
20. zapptr = hptr ;
21. while(hptr->hnext != (HASHPTR) NULL) {
22.! ! hptr = hptr->hnext;
23.! ! free(zapptr);
24.! ! zapptr = hptr ;
25.! ! }
26.! ! free(hptr);
27.! }
28. }!
29. free(hashtab);
30. return;
}
free(hptr->hname);

25. Outline
• Our technique
• Tainting pointers
• Tracking pointers
• Checking for leaks
• Implementation
• Evaluation
• Conclusions and future work

26. 1.Tainting pointers
Assign a taint mark to pointers returned from
allocation functions (e.g., malloc)

27. 1.Tainting pointers
Assign a taint mark to pointers returned from
allocation functions (e.g., malloc)

28. 1.Tainting pointers
Last use location
Allocation location
Allocation size
Deallocated indicator
Pointer count
Assign a taint mark to pointers returned from
allocation functions (e.g., malloc)
Metadata

29. 1.Tainting pointers
Last use location
Allocation location
Allocation size
Deallocated indicator
Pointer count
Assign a taint mark to pointers returned from
allocation functions (e.g., malloc)
current location
current location
false
size of the memory area
1
Metadata Initialized to

30. 2. Propagating taint marks

31. 2. Propagating taint marks
1.Track the flow of pointers throughout the execution

32. 2. Propagating taint marks
1.Track the flow of pointers throughout the execution

33. 2. Propagating taint marks
1.Track the flow of pointers throughout the execution

34. 2. Propagating taint marks
1.Track the flow of pointers throughout the execution
2. Update taint marks’ mutable metadata

35. Tracking pointers
assignment
addition
subtraction
and
multiplication
division
modulus
or, xor,
shift, not
comparison

36. p2 = p1 ➔ p2
p2 = p1 ➔ p2
p2 = p2 ± 1 ➔ p2
p3 = p2 ± p1 ➔ p3
p2 = p2 & 0xffff ➔ p2
not tainted
Tracking pointers
assignment
addition
subtraction
and
multiplication
division
modulus
or, xor,
shift, not
comparison

37. p2 = p1 ➔ p2
p2 = p1 ➔ p2
p2 = p2 ± 1 ➔ p2
p3 = p2 ± p1 ➔ p3
p2 = p2 & 0xffff ➔ p2
not tainted
Tracking pointers
assignment
addition
subtraction
and
multiplication
division
modulus
or, xor,
shift, not
comparison

38. p2 = p1 ➔ p2
p2 = p1 ➔ p2
p2 = p2 ± 1 ➔ p2
p3 = p2 ± p1 ➔ p3
p2 = p2 & 0xffff ➔ p2
not tainted
Tracking pointers
assignment
addition
subtraction
and
multiplication
division
modulus
or, xor,
shift, not
comparison

39. p2 = p1 ➔ p2
p2 = p1 ➔ p2
p2 = p2 ± 1 ➔ p2
p3 = p2 ± p1 ➔ p3
p2 = p2 & 0xffff ➔ p2
not tainted
Tracking pointers
assignment
addition
subtraction
and
multiplication
division
modulus
or, xor,
shift, not
comparison

40. p2 = p1 ➔ p2
p2 = p1 ➔ p2
p2 = p2 ± 1 ➔ p2
p3 = p2 ± p1 ➔ p3
p2 = p2 & 0xffff ➔ p2
not tainted
Tracking pointers
assignment
addition
subtraction
and
multiplication
division
modulus
or, xor,
shift, not
comparison

41. p2 = p1 ➔ p2
p2 = p1 ➔ p2
p2 = p2 ± 1 ➔ p2
p3 = p2 ± p1 ➔ p3
p2 = p2 & 0xffff ➔ p2
not tainted
Tracking pointers
assignment
addition
subtraction
and
multiplication
division
modulus
or, xor,
shift, not
comparison

42. p2 = p1 ➔ p2
p2 = p1 ➔ p2
p2 = p2 ± 1 ➔ p2
p3 = p2 ± p1 ➔ p3
p2 = p2 & 0xffff ➔ p2
not tainted
Tracking pointers
Based on domain knowledge and expertise
assignment
addition
subtraction
and
multiplication
division
modulus
or, xor,
shift, not
comparison

43. Update metadata (1)

44. Pointer Counts
Update metadata (1)

45. Pointer Counts
• Assignment: increment the count of the pointer that
is copied, decrement the count of the pointer that is
overwritten
Update metadata (1)

46. Pointer Counts
• Assignment: increment the count of the pointer that
is copied, decrement the count of the pointer that is
overwritten
Update metadata (1)
ptr3 = ptr1 ➔ ptr3 , ptr11 2 2
ptr1 = NULL ➔ ptr1 , ptr32 1

47. Pointer Counts
• Assignment: increment the count of the pointer that
is copied, decrement the count of the pointer that is
overwritten
• Function return: decrement the count of pointers
stored in local variables
Update metadata (1)
ptr3 = ptr1 ➔ ptr3 , ptr11 2 2
ptr1 = NULL ➔ ptr1 , ptr32 1

48. Pointer Counts
• Assignment: increment the count of the pointer that
is copied, decrement the count of the pointer that is
overwritten
• Function return: decrement the count of pointers
stored in local variables
• Memory deallocation: decrement the count of
pointers reachable from the deallocated memory
Update metadata (1)
ptr3 = ptr1 ➔ ptr3 , ptr11 2 2
ptr1 = NULL ➔ ptr1 , ptr32 1

49. Update metadata (2)

50. Deallocation indicator
Update metadata (2)

51. Deallocation indicator
• Set to true when a pointer is passed to a deallocation
function (e.g., free)
Update metadata (2)

52. Deallocation indicator
• Set to true when a pointer is passed to a deallocation
function (e.g., free)
Last use location
Update metadata (2)

53. Deallocation indicator
• Set to true when a pointer is passed to a deallocation
function (e.g., free)
Last use location
• Set to the current location whenever a pointer is
- propagated
- passed as a function argument
- returned from a function
- used to access memory
Update metadata (2)

54. 3. Identifying when leaks occur

55. 3. Identifying when leaks occur
Lost memory Forgotten memory
If a taint mark’s pointer count
is zero and it’s deallocated
indicator is false
If, at the end of execution, a
taint mark’s deallocated
indicator is false

56. 3. Identifying when leaks occur
Lost memory Forgotten memory
If a taint mark’s pointer count
is zero and it’s deallocated
indicator is false
If, at the end of execution, a
taint mark’s deallocated
indicator is false

57. 3. Identifying when leaks occur
Lost memory Forgotten memory
If a taint mark’s pointer count
is zero and it’s deallocated
indicator is false
If, at the end of execution, a
taint mark’s deallocated
indicator is false
(Checks are recursive)

58. 3. Identifying when leaks occur
Lost memory Forgotten memory
If a taint mark’s pointer count
is zero and it’s deallocated
indicator is false
If, at the end of execution, a
taint mark’s deallocated
indicator is false
Generate a leak report:
• allocation location, allocation size, and last use location
(Checks are recursive)

59. 3. Identifying when leaks occur
Lost memory Forgotten memory
If a taint mark’s pointer count
is zero and it’s deallocated
indicator is false
If, at the end of execution, a
taint mark’s deallocated
indicator is false
Generate a leak report:
• allocation location, allocation size, and last use location
Merge leak reports:
• combine reports with identical allocation and last use
locations, add allocation sizes
(Checks are recursive)

60. Prototype tool
Implemented usingValgrind

61. Prototype tool
Implemented usingValgrind
30–100x overheads

62. Prototype tool
16 bytes of memory
allocated:
at malloc
by addhash (hash.c:50)
by parser (parser.c:210)
by readcell (parser.c:34)
by main (main.c:98)
was leaked:
at free
by delHtab (hash.c:28)
by grdcell(grdcell.c:354)
by main (main.c:227)
Implemented usingValgrind

63. Prototype tool
16 bytes of memory
allocated:
at malloc
by addhash (hash.c:50)
by parser (parser.c:210)
by readcell (parser.c:34)
by main (main.c:98)
was leaked:
at free
by delHtab (hash.c:28)
by grdcell(grdcell.c:354)
by main (main.c:227)
Implemented usingValgrind

64. Prototype tool
16 bytes of memory
allocated:
at malloc
by addhash (hash.c:50)
by parser (parser.c:210)
by readcell (parser.c:34)
by main (main.c:98)
was leaked:
at free
by delHtab (hash.c:28)
by grdcell(grdcell.c:354)
by main (main.c:227)
Implemented usingValgrind

65. Prototype tool
16 bytes of memory
allocated:
at malloc
by addhash (hash.c:50)
by parser (parser.c:210)
by readcell (parser.c:34)
by main (main.c:98)
was leaked:
at free
by delHtab (hash.c:28)
by grdcell(grdcell.c:354)
by main (main.c:227)
Implemented usingValgrind
Can be used to prioritize
debugging effort

66. Evaluation
How does Leakpoint’s ability to
detect memory leaks compare
to existing tools?
How effective is Leakpoint at
guiding developers to the
locations where memory leaks
may be fixed?

67. RQ1: Comparison with existing tools

68. Subjects
164.gzip 4 1 4 4
175.vpr 47 0 47 47
176.gcc 1121 406 (1415) 1121 1121
181.mcf 0 0 0 0
186.crafty 37 0 37 37
197.parser 2 0 2 2
252.eon 380 380 380 380
253.perlbmk 3481 0 (2) 3481 536
254.gap 2 0 (2) 2 2
255.vortex 15 1 15 15
256.bzip2 10 1 10 10
300.twolf 1403 68 (3) 1403 1403
RQ1: Comparison with existing tools

69. Subjects
164.gzip 4 1 4 4
175.vpr 47 0 47 47
176.gcc 1121 406 (1415) 1121 1121
181.mcf 0 0 0 0
186.crafty 37 0 37 37
197.parser 2 0 2 2
252.eon 380 380 380 380
253.perlbmk 3481 0 (2) 3481 536
254.gap 2 0 (2) 2 2
255.vortex 15 1 15 15
256.bzip2 10 1 10 10
300.twolf 1403 68 (3) 1403 1403
RQ1: Comparison with existing tools
Leakpoint

70. Subjects
164.gzip 4 1 4 4
175.vpr 47 0 47 47
176.gcc 1121 406 (1415) 1121 1121
181.mcf 0 0 0 0
186.crafty 37 0 37 37
197.parser 2 0 2 2
252.eon 380 380 380 380
253.perlbmk 3481 0 (2) 3481 536
254.gap 2 0 (2) 2 2
255.vortex 15 1 15 15
256.bzip2 10 1 10 10
300.twolf 1403 68 (3) 1403 1403
RQ1: Comparison with existing tools
omegaLeakpoint

71. Subjects
164.gzip 4 1 4 4
175.vpr 47 0 47 47
176.gcc 1121 406 (1415) 1121 1121
181.mcf 0 0 0 0
186.crafty 37 0 37 37
197.parser 2 0 2 2
252.eon 380 380 380 380
253.perlbmk 3481 0 (2) 3481 536
254.gap 2 0 (2) 2 2
255.vortex 15 1 15 15
256.bzip2 10 1 10 10
300.twolf 1403 68 (3) 1403 1403
RQ1: Comparison with existing tools
omega MemCheckLeakpoint

72. Subjects
164.gzip 4 1 4 4
175.vpr 47 0 47 47
176.gcc 1121 406 (1415) 1121 1121
181.mcf 0 0 0 0
186.crafty 37 0 37 37
197.parser 2 0 2 2
252.eon 380 380 380 380
253.perlbmk 3481 0 (2) 3481 536
254.gap 2 0 (2) 2 2
255.vortex 15 1 15 15
256.bzip2 10 1 10 10
300.twolf 1403 68 (3) 1403 1403
RQ1: Comparison with existing tools
mtraceomega MemCheckLeakpoint

73. Leak detectionLeak identificationSubjects
164.gzip 4 1 4 4
175.vpr 47 0 47 47
176.gcc 1121 406 (1415) 1121 1121
181.mcf 0 0 0 0
186.crafty 37 0 37 37
197.parser 2 0 2 2
252.eon 380 380 380 380
253.perlbmk 3481 0 (2) 3481 536
254.gap 2 0 (2) 2 2
255.vortex 15 1 15 15
256.bzip2 10 1 10 10
300.twolf 1403 68 (3) 1403 1403
RQ1: Comparison with existing tools
mtraceomega MemCheckLeakpoint

74. Subjects
164.gzip 4 1 4 4
175.vpr 47 0 47 47
176.gcc 1121 406 (1415) 1121 1121
181.mcf 0 0 0 0
186.crafty 37 0 37 37
197.parser 2 0 2 2
252.eon 380 380 380 380
253.perlbmk 3481 0 (2) 3481 536
254.gap 2 0 (2) 2 2
255.vortex 15 1 15 15
256.bzip2 10 1 10 10
300.twolf 1403 68 (3) 1403 1403
RQ1: Comparison with existing tools
mtraceomega MemCheckLeakpoint

75. # Detected memory leaks (# false positives)Subjects
164.gzip 4 1 4 4
175.vpr 47 0 47 47
176.gcc 1121 406 (1415) 1121 1121
181.mcf 0 0 0 0
186.crafty 37 0 37 37
197.parser 2 0 2 2
252.eon 380 380 380 380
253.perlbmk 3481 0 (2) 3481 536
254.gap 2 0 (2) 2 2
255.vortex 15 1 15 15
256.bzip2 10 1 10 10
300.twolf 1403 68 (3) 1403 1403
RQ1: Comparison with existing tools
mtraceomega MemCheckLeakpoint

76. # Detected memory leaks (# false positives)Subjects
164.gzip 4 1 4 4
175.vpr 47 0 47 47
176.gcc 1121 406 (1415) 1121 1121
181.mcf 0 0 0 0
186.crafty 37 0 37 37
197.parser 2 0 2 2
252.eon 380 380 380 380
253.perlbmk 3481 0 (2) 3481 536
254.gap 2 0 (2) 2 2
255.vortex 15 1 15 15
256.bzip2 10 1 10 10
300.twolf 1403 68 (3) 1403 1403
RQ1: Comparison with existing tools
mtraceomega MemCheckLeakpoint

77. # Detected memory leaks (# false positives)Subjects
164.gzip 4 1 4 4
175.vpr 47 0 47 47
176.gcc 1121 406 (1415) 1121 1121
181.mcf 0 0 0 0
186.crafty 37 0 37 37
197.parser 2 0 2 2
252.eon 380 380 380 380
253.perlbmk 3481 0 (2) 3481 536
254.gap 2 0 (2) 2 2
255.vortex 15 1 15 15
256.bzip2 10 1 10 10
300.twolf 1403 68 (3) 1403 1403
RQ1: Comparison with existing tools
mtraceomega MemCheckLeakpoint

78. # Detected memory leaks (# false positives)Subjects
164.gzip 4 1 4 4
175.vpr 47 0 47 47
176.gcc 1121 406 (1415) 1121 1121
181.mcf 0 0 0 0
186.crafty 37 0 37 37
197.parser 2 0 2 2
252.eon 380 380 380 380
253.perlbmk 3481 0 (2) 3481 536
254.gap 2 0 (2) 2 2
255.vortex 15 1 15 15
256.bzip2 10 1 10 10
300.twolf 1403 68 (3) 1403 1403
RQ1: Comparison with existing tools
mtraceomega MemCheckLeakpoint

79. # Detected memory leaks (# false positives)Subjects
164.gzip 4 1 4 4
175.vpr 47 0 47 47
176.gcc 1121 406 (1415) 1121 1121
181.mcf 0 0 0 0
186.crafty 37 0 37 37
197.parser 2 0 2 2
252.eon 380 380 380 380
253.perlbmk 3481 0 (2) 3481 536
254.gap 2 0 (2) 2 2
255.vortex 15 1 15 15
256.bzip2 10 1 10 10
300.twolf 1403 68 (3) 1403 1403
RQ1: Comparison with existing tools
mtraceomega MemCheckLeakpoint
Leakpoint is at least as effective as existing tools
at detecting memory leaks

80. RQ2: Effectiveness at guiding developers
Compare the leak locations identified by Leakpoint
with the locations where the leaks were fixed by
the original application developers.

81. RQ2: Effectiveness at guiding developers
Compare the leak locations identified by Leakpoint
with the locations where the leaks were fixed by
the original application developers.
Transmission

82. RQ2: Effectiveness at guiding developers
Compare the leak locations identified by Leakpoint
with the locations where the leaks were fixed by
the original application developers.
Transmission

83. RQ2: Effectiveness at guiding developers
Compare the leak locations identified by Leakpoint
with the locations where the leaks were fixed by
the original application developers.
Transmission

84. RQ2: Effectiveness at guiding developers
Compare the leak locations identified by Leakpoint
with the locations where the leaks were fixed by
the original application developers.
Transmission
4 memory leaks total

85. static void processCompletedTasks(tr_web *web) {
...
task->done_func(web->session, ..., task->done_func_user_data);
...
evbuffer_free(task->response);
tr_free(task->url);
tr_free(task);
...
}
Transmission
static void invokeRequest(void * vreq) {
...
hash = tr_new0(uint8_t, SHA_DIGEST_LENGTH);
memcpy(hash, req->torrent_hash, SHA_DIGEST_LENGTH);
tr_webRun(req->session, req->url, req->done_func, hash);
...
}

86. static void processCompletedTasks(tr_web *web) {
...
task->done_func(web->session, ..., task->done_func_user_data);
...
evbuffer_free(task->response);
tr_free(task->url);
tr_free(task);
...
}
Transmission
static void invokeRequest(void * vreq) {
...
hash = tr_new0(uint8_t, SHA_DIGEST_LENGTH);
memcpy(hash, req->torrent_hash, SHA_DIGEST_LENGTH);
tr_webRun(req->session, req->url, req->done_func, hash);
...
}
static void onStoppedResponse(tr_session *session, ..., void *torrent_hash) {
dbgmsg(NULL, "got a response ... message");
onReqDone(session);
}
// tr_free(torrent_hash);

87. static void processCompletedTasks(tr_web *web) {
...
task->done_func(web->session, ..., task->done_func_user_data);
...
evbuffer_free(task->response);
tr_free(task->url);
tr_free(task);
...
}
Transmission
static void invokeRequest(void * vreq) {
...
hash = tr_new0(uint8_t, SHA_DIGEST_LENGTH);
memcpy(hash, req->torrent_hash, SHA_DIGEST_LENGTH);
tr_webRun(req->session, req->url, req->done_func, hash);
...
}
static void onStoppedResponse(tr_session *session, ..., void *torrent_hash) {
dbgmsg(NULL, "got a response ... message");
onReqDone(session);
}
// tr_free(torrent_hash);
Distance: 6 statements

88. URIHANDLER_FUNC(mod_rewrite_uri_handler) {
...
hctx = handler_ctx_init();
con->plugin_ctx[p->id] = hctx;
...
}
Lighttpd 1

89. URIHANDLER_FUNC(mod_rewrite_uri_handler) {
...
hctx = handler_ctx_init();
con->plugin_ctx[p->id] = hctx;
...
}
Lighttpd 1
// if(con->plugin_ctx[p->id] == NULL) {
// }
// else {
// hctx = con->plugin_ctx[p->id];
// }

90. URIHANDLER_FUNC(mod_rewrite_uri_handler) {
...
hctx = handler_ctx_init();
con->plugin_ctx[p->id] = hctx;
...
}
Lighttpd 1
// if(con->plugin_ctx[p->id] == NULL) {
// }
// else {
// hctx = con->plugin_ctx[p->id];
// }
Distance: overlapping

91. int http_request_parse(server *srv, connection *con) {
...
if(NULL == (ds = (data_string *)array_get_unused_element(
con->request.headers, TYPE_STRING))) {
ds = data_string_init();
}
...
else if (cmp > 0 &&
0 == (cmp = buffer_caseless_compare(CONST_BUF_LEN(ds->key),
CONST_STR_LEN("Content-Length")))) {
char *err
unsigned long int r;
size_t j
if (con_length_set) {
con->http_status = 400;
con->keep_alive = 0;
if(srv->srvconf.log_request_header_on_error) {
log_error_write(srv, __FILE__, __LINE__, "s", "duplicate ...");
log_error_write(srv, __FILE__, __LINE__, "Sb", "request-header:n",
con->request.request);
}
return 0;
}
...
}
Lighttpd 2

92. int http_request_parse(server *srv, connection *con) {
...
if(NULL == (ds = (data_string *)array_get_unused_element(
con->request.headers, TYPE_STRING))) {
ds = data_string_init();
}
...
else if (cmp > 0 &&
0 == (cmp = buffer_caseless_compare(CONST_BUF_LEN(ds->key),
CONST_STR_LEN("Content-Length")))) {
char *err
unsigned long int r;
size_t j
if (con_length_set) {
con->http_status = 400;
con->keep_alive = 0;
if(srv->srvconf.log_request_header_on_error) {
log_error_write(srv, __FILE__, __LINE__, "s", "duplicate ...");
log_error_write(srv, __FILE__, __LINE__, "Sb", "request-header:n",
con->request.request);
}
return 0;
}
...
}
Lighttpd 2
// array_insert_unique(con->request.headers, (data_unset *)ds);

93. int http_request_parse(server *srv, connection *con) {
...
if(NULL == (ds = (data_string *)array_get_unused_element(
con->request.headers, TYPE_STRING))) {
ds = data_string_init();
}
...
else if (cmp > 0 &&
0 == (cmp = buffer_caseless_compare(CONST_BUF_LEN(ds->key),
CONST_STR_LEN("Content-Length")))) {
char *err
unsigned long int r;
size_t j
if (con_length_set) {
con->http_status = 400;
con->keep_alive = 0;
if(srv->srvconf.log_request_header_on_error) {
log_error_write(srv, __FILE__, __LINE__, "s", "duplicate ...");
log_error_write(srv, __FILE__, __LINE__, "Sb", "request-header:n",
con->request.request);
}
return 0;
}
...
}
Lighttpd 2
// array_insert_unique(con->request.headers, (data_unset *)ds);
Distance: 1 statement

94. static struct spelling *spelling_base;
static void push_string(char *string) {
...
spelling_base = xmalloc(spelling_size * sizeof(struct spelling));
...
}
void finish_init() {
...
constructor_decl = p->decl;
...
spelling_base = p->spelling_base;
...
}
GCC

95. static struct spelling *spelling_base;
static void push_string(char *string) {
...
spelling_base = xmalloc(spelling_size * sizeof(struct spelling));
...
}
void finish_init() {
...
constructor_decl = p->decl;
...
spelling_base = p->spelling_base;
...
}
GCC
// free(spelling_base);

96. static struct spelling *spelling_base;
static void push_string(char *string) {
...
spelling_base = xmalloc(spelling_size * sizeof(struct spelling));
...
}
void finish_init() {
...
constructor_decl = p->decl;
...
spelling_base = p->spelling_base;
...
}
GCC
// free(spelling_base);
Distance: 10 statements*

97. Summary
• A new technique for identifying where memory
leaks occur
• at least as effective as existing techniques at
detecting memory leaks
• helpful in guiding developers to the locations
where memory leaks should be fixed

98. Future work

99. Future work
Improved
implementation

100. Future work
Additional
experimentation
Improved
implementation

101. Future work
Additional
experimentation
User
Studies
Improved
implementation

102. Questions?
1 Tainting
pointers
2 Propagating
taint marks
3 Identifying
when leaks
occur