Memory Leak Detection
Detection Workflow
- Identify allocation points: Find all malloc/calloc/realloc calls, new/delete pairs (C++), map allocation locations
- Trace allocation lifecycle: Use
xrefs_to to trace allocations, follow pointers through code, identify all free() calls
- Check cleanup paths: Verify every allocation has a corresponding free, check all error handling paths, review exception handling, assess callback cleanup
- Assess impact: How much memory is leaked? How often does it leak? What's the cumulative impact? Can it cause DoS?
Key Patterns
- Missing free: malloc() without corresponding free(), calloc() without free(), new without delete (C++)
- Exception path leaks: allocations before exception-prone operations, missing cleanup in error handling, leaks in early returns
- Reference cycles: circular references in data structures, reference counting bugs, shared pointer cycles
- Long-lived allocations: allocations that never get freed, caches without size limits, accumulating data structures
Output Format
Report with: id, type, subtype, severity, confidence, location, allocation (function, address, size), leak path, leak scenario, leak size per call, frequency, exploitability, impact, mitigation.
Severity Guidelines
- HIGH: Large leaks in frequently called functions
- MEDIUM: Small leaks or infrequent allocations
- LOW: Minor leaks with limited impact
See Also
patterns.md - Detailed detection patterns and exploitation scenariosexamples.md - Example analysis cases and code samplesreferences.md - CWE references and mitigation strategies
1---2name: detecting-memory-leaks3description: Detects memory leak vulnerabilities by identifying unfreed memory allocations and missing cleanup in error paths. Use when analyzing long-running processes, resource management, or investigating memory exhaustion issues.4---5
6# Memory Leak Detection
7
8## Detection Workflow
9
101. **Identify allocation points**: Find all malloc/calloc/realloc calls, new/delete pairs (C++), map allocation locations
112. **Trace allocation lifecycle**: Use `xrefs_to` to trace allocations, follow pointers through code, identify all free() calls
123. **Check cleanup paths**: Verify every allocation has a corresponding free, check all error handling paths, review exception handling, assess callback cleanup
134. **Assess impact**: How much memory is leaked? How often does it leak? What's the cumulative impact? Can it cause DoS?
14
15## Key Patterns
16
17- Missing free: malloc() without corresponding free(), calloc() without free(), new without delete (C++)
18- Exception path leaks: allocations before exception-prone operations, missing cleanup in error handling, leaks in early returns
19- Reference cycles: circular references in data structures, reference counting bugs, shared pointer cycles
20- Long-lived allocations: allocations that never get freed, caches without size limits, accumulating data structures
21
22## Output Format
23
24Report with: id, type, subtype, severity, confidence, location, allocation (function, address, size), leak path, leak scenario, leak size per call, frequency, exploitability, impact, mitigation.
25
26## Severity Guidelines
27
28- **HIGH**: Large leaks in frequently called functions
29- **MEDIUM**: Small leaks or infrequent allocations
30- **LOW**: Minor leaks with limited impact
31
32## See Also
33
34- `patterns.md` - Detailed detection patterns and exploitation scenarios
35- `examples.md` - Example analysis cases and code samples
36- `references.md` - CWE references and mitigation strategies
majiayu000