• '_prologue_' is an imaginary function that initialize argc, argv
  
• Solid arrow means call edge
  
• Dotted arrow means return edge
  
• Green arrow means branch (pair of call & return)
  
For details, see II-A.'Backbone-Branch Decomposition' section of our paper

Path should include a call edge from 'dico_vlog' to 'syslog_log_printer' either in backbone or branch, for the correct taint propagation toward the sink

Path should have an incoming edge to 'assign_locus', to define a necessary variable used in the sink

Path should NOT include a return edge from 'socket_io' to 'query_ident_name' in backbone, because tainted data cannot flow along the edge

Path should include a call edge from 'dico_vlog' to 'syslog_log_printer' either in backbone or branch, for the correct taint propagation toward the sink

Path should have an incoming edge to 'assign_locus', to define a necessary variable used in the sink

'dicod_inetd' cannot return from 'main' and then call 'config_parse', since 'main' always calls 'config_parse' before calling 'dicod_inetd'

'dicod_server' cannot return from 'main' and then call 'config_parse', since 'main' always calls 'config_parse' before calling 'dicod_server'

Path should include a call edge from 'dico_vlog' to 'syslog_log_printer' either in backbone or branch, for the correct taint propagation toward the sink

Path should have an incoming edge to 'assign_locus', to define a necessary variable used in the sink

Path should NOT have an incoming edge to 'parse_line', because tainted data cannot flow through the node

Path should NOT have an incoming edge to 'parse_line_cpp', because tainted data cannot flow through the node

Path should include a call edge from 'dico_vlog' to 'syslog_log_printer' either in backbone or branch, for the correct taint propagation toward the sink

Path should have an incoming edge to 'assign_locus', to define a necessary variable used in the sink

Path should include a call edge from 'main' to 'dicod_log_pre_setup' either in backbone or branch, for the correct taint propagation toward the sink

Path should include a call edge from 'dicod_log_pre_setup' to 'dicod_log_setup' either in backbone or branch, for the correct taint propagation toward the sink

Path should include a call edge from 'dico_vlog' to '_dico_stderr_log_printer' either in backbone or branch, for the correct taint propagation toward the sink

Path should have an incoming edge to 'assign_locus', to define a necessary variable used in the sink

Path should NOT include a return edge from 'socket_io' to 'query_ident_name' in backbone, because tainted data cannot flow along the edge

Path should include a call edge from 'dico_vlog' to '_dico_stderr_log_printer' either in backbone or branch, for the correct taint propagation toward the sink

Path should have an incoming edge to 'assign_locus', to define a necessary variable used in the sink

'dicod_inetd' cannot return from 'main' and then call 'config_parse', since 'main' always calls 'config_parse' before calling 'dicod_inetd'

'dicod_server' cannot return from 'main' and then call 'config_parse', since 'main' always calls 'config_parse' before calling 'dicod_server'

Path should include a call edge from 'dico_vlog' to '_dico_stderr_log_printer' either in backbone or branch, for the correct taint propagation toward the sink

Path should have an incoming edge to 'assign_locus', to define a necessary variable used in the sink

Path should NOT have an incoming edge to 'parse_line', because tainted data cannot flow through the node

Path should NOT have an incoming edge to 'parse_line_cpp', because tainted data cannot flow through the node

Path should include a call edge from 'dico_vlog' to '_dico_stderr_log_printer' either in backbone or branch, for the correct taint propagation toward the sink

Path should have an incoming edge to 'assign_locus', to define a necessary variable used in the sink