  Resource leaks, caused by resources not being released after acquisition,
often lead to performance issues and system crashes. Existing static detection
techniques rely on mechanical matching of predefined resource
acquisition/release APIs and null-checking conditions to find unreleased
resources, suffering from both (1) false negatives caused by the incompleteness
of predefined resource acquisition/release APIs and (2) false positives caused
by the incompleteness of resource reachability validation identification.
  To overcome these challenges, we propose InferROI, a novel approach that
leverages the exceptional code comprehension capability of large language
models (LLMs) to directly infer resource-oriented intentions (acquisition,
release, and reachability validation) in code. InferROI first prompts the LLM
to infer involved intentions for a given code snippet, and then incorporates a
two-stage static analysis approach to check control-flow paths for resource
leak detection based on the inferred intentions. We evaluate the effectiveness
of InferROI in both resource-oriented intention inference and resource leak
detection. Experimental results on the DroidLeaks and JLeaks datasets
demonstrate InferROI achieves promising bug detection rate (59.3% and 64.8%)
and false alarm rate (18.6% and 24.0%). Compared to three industrial static
detectors, InferROI detects 14~45 and 167~503 more bugs in DroidLeaks and
JLeaks, respectively. When applied to real-world open-source projects, InferROI
identifies 26 unknown resource leak bugs, with 7 of them being confirmed by
developers. Finally, manual annotation indicated that InferROI achieved a
precision of 74.6% and a recall of 81.8% in intention inference, covering more
than 60% resource types involved in the datasets. The results of an ablation
study underscores the importance of combining LLM-based inference with static
analysis.
