• '_prologue_' is an imaginary function that initialize argc, argv
  
• Solid arrow means call edge
  
• Dotted arrow means return edge
  
• Green arrow means branch (pair of call & return)
  
For details, see II-A.'Backbone-Branch Decomposition' section of our paper

Path should include a call edge from 'prog_opt_process' to 'prog_usage_msg' either in backbone or branch, for the correct taint propagation toward the sink

Path should NOT include a return edge from 'safety_check' to 'init' either in backbone or branch, because tainted data cannot flow along the edge

Path should include a call edge from 'prog_opt_process' to 'prog_usage_msg' either in backbone or branch, for the correct taint propagation toward the sink

Path should NOT have an outgoing edge from 'init', because tainted data cannot flow through the node

Path should include a call edge from 'prog_opt_process' to 'prog_usage_msg' either in backbone or branch, for the correct taint propagation toward the sink

Path should NOT have an outgoing edge from 'config', because tainted data cannot flow through the node

Path should include a call edge from 'prog_opt_process' to 'prog_usage_msg' either in backbone or branch, for the correct taint propagation toward the sink

Path should NOT have an outgoing edge from 'opt_process', because tainted data cannot flow through the node

Path should include a call edge from 'prog_opt_process' to 'prog_usage_msg' either in backbone or branch, for the correct taint propagation toward the sink

Path should NOT have an outgoing edge from 'safety_check', because tainted data cannot flow through the node

Path should include a call edge from 'prog_opt_process' to 'prog_usage_msg' either in backbone or branch, for the correct taint propagation toward the sink

Path should NOT have an outgoing edge from 'do_exec', because tainted data cannot flow through the node

Path should include a call edge from 'prog_opt_process' to 'prog_usage_msg' either in backbone or branch, for the correct taint propagation toward the sink

Path should NOT have an outgoing edge from 'daemon_parse_config', because tainted data cannot flow through the node

Path should include a call edge from 'prog_opt_process' to 'prog_usage_msg' either in backbone or branch, for the correct taint propagation toward the sink