An Alarm Classification Using Shovel

'_prologue_' is an imaginary function that initialize argc, argv

Solid arrow means call edge

Dotted arrow means return edge

Green arrow means branch (pair of call & return)
(For details, see II-A.'Backbone-Branch Decomposition' section of our paper)

Alarm #1

+ Taint Source : iputil.c:50 (get_ipaddr)
+ Sink (Allocation) : xmalloc.c:47 (hostcmp)

path 1

(User Feedback)

Path should NOT have an incoming edge to 'hostcmp', because tainted data cannot flow through the node

UNSAT (False Alarm)

Alarm #2

+ Taint Source : autologin.c:33 (hostcmp)
+ Sink (Allocation) : xmalloc.c:47 (hostcmp)

path 1

(User Feedback)

Confirmed False Alarm (trivial reasoning inside the function)

UNSAT (False Alarm)

Alarm #3

+ Taint Source : autologin.c:58 (hostcmp)
+ Sink (Allocation) : xmalloc.c:47 (hostcmp)

path 1

(User Feedback)

Confirmed False Alarm (trivial reasoning inside the function)

UNSAT (False Alarm)