An Alarm Classification Using Shovel

'_prologue_' is an imaginary function that initialize argc, argv

Solid arrow means call edge

Dotted arrow means return edge

Green arrow means branch (pair of call & return)
(For details, see II-A.'Backbone-Branch Decomposition' section of our paper)

Alarm #1

+ Taint Source : main.c:85 (_prologue_)
+ Sink (Allocation) : parsing.c:462 (make_default_format_string)

path 1

(User Feedback)

Path should NOT have an incoming edge to 'make_default_format_string', because tainted data cannot flow through the node

UNSAT (False Alarm)

Alarm #2

+ Taint Source : main.c:85 (_prologue_)
+ Sink (Allocation) : parsing.c:472 (make_default_format_string)

path 1

(User Feedback)

Path should NOT have an incoming edge to 'make_default_format_string', because tainted data cannot flow through the node

UNSAT (False Alarm)