Detecting Resource-Management API Misuses using QA Language Models

In this paper, we propose TRAIT (Automatic Resource-management API misuse Detector), a novel framework grounded in two key observations: (1) RM-APIs often exhibit unique RM semantics, and (2) RM-APIs typically operate on the same object, and their associated object descriptions share similar semantics. Our method employs a Question-Answering model to identify RM APIs from loosely-organized documentation, locate RM objects using similarity comparison, and match allocation and releasing API pairs. We further integrate RM-API constraints to detect misuse in open-source projects with CodeQL. The evaluation results demonstrate that our tool achieves a precision of 83.5% and a recall of 92.6% in RM-API identification, attaining a precision of 95.9% and a recall of 92.2% in RM-API pairing. Upon evaluating 60 software projects, TRAIT discovered 85 security bugs.