An Alarm Classification Using Shovel

'_prologue_' is an imaginary function that initialize argc, argv

Solid arrow means call edge

Dotted arrow means return edge

Green arrow means branch (pair of call & return)
For details, see II-A.'Backbone-Branch Decomposition' section of our paper

less_alarm1_1

path 1

(User Feedback)

Path should not visit 'close_altfile', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm1_2

path 1

(User Feedback)

Path should not visit 'close_altfile', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm1_3

path 1

(User Feedback)

Path should not visit 'close_altfile', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm1_4

path 1

(User Feedback)

Path should not visit 'close_altfile', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm1_5

path 1

(User Feedback)

Path should not visit 'close_altfile', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm1_6

path 1

(User Feedback)

Path should not visit 'close_altfile', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm1_7

path 1

(User Feedback)

Path should not visit 'close_altfile', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm1_8

path 1

(User Feedback)

Path should not visit 'close_altfile', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm1_9

path 1

(User Feedback)

Path should not visit 'close_altfile', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm2_1

path 1

(User Feedback)

Path should not visit 'open_altfile', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm2_2

path 1

(User Feedback)

Path should not visit 'open_altfile', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm2_3

path 1

(User Feedback)

Path should not visit 'open_altfile', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm2_4

path 1

(User Feedback)

Path should not visit 'open_altfile', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm2_5

path 1

(User Feedback)

Path should not visit 'open_altfile', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm2_6

path 1

(User Feedback)

Path should not visit 'open_altfile', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm2_7

path 1

(User Feedback)

Path should not visit 'open_altfile', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm2_8

path 1

(User Feedback)

Path should not visit 'open_altfile', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm2_9

path 1

(User Feedback)

Path should not visit 'open_altfile', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm3_1

path 1

(User Feedback)

Path should not visit 'prutfchar', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm3_2

path 1

(User Feedback)

Path should not visit 'prutfchar', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm3_3

path 1

(User Feedback)

Path should not visit 'prutfchar', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm3_4

path 1

(User Feedback)

Path should have an incoming call edge to 'setbinfmt', to define a necessary variable used in the sink

path 2

(User Feedback)

Path should include a return edge from 'lgetenv' to 'init_charset' either in backbone or branch, for the correct taint propagation toward the sink

path 3

Found Bug (true alarm)

less_alarm3_5

path 1

(User Feedback)

Path should not visit 'prutfchar', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm3_6

path 1

(User Feedback)

Path should not visit 'prutfchar', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm3_7

path 1

(User Feedback)

Path should not visit 'prutfchar', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm3_8

path 1

(User Feedback)

Path should not visit 'prutfchar', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm3_9

path 1

(User Feedback)

Path should not visit 'prutfchar', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm4_1

path 1

(User Feedback)

Path should not visit 'prchar', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm4_2

path 1

(User Feedback)

Path should not visit 'prchar', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm4_3

path 1

(User Feedback)

Path should not visit 'prchar', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm4_4

path 1

(User Feedback)

Path should have an incoming call edge to 'setbinfmt', to define a necessary variable used in the sink

path 2

(User Feedback)

Path should have an incoming call edge to 'do_append', to define a necessary variable used in the sink

path 3

(User Feedback)

Path should have an incoming call edge to 'forw_line', to define a necessary variable used in the sink

path 4

(User Feedback)

Path should include a return edge from 'lgetenv' to 'init_charset' either in backbone or branch, for the correct taint propagation toward the sink

path 5

Found Bug (true alarm)

less_alarm4_5

path 1

(User Feedback)

Path should not visit 'prchar', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm4_6

path 1

(User Feedback)

Path should not visit 'prchar', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm4_7

path 1

(User Feedback)

Path should not visit 'prchar', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm4_8

path 1

(User Feedback)

Path should not visit 'prchar', because tainted data cannot flow through the node

UNSAT (false alarm)

less_alarm4_9

path 1

(User Feedback)

Path should not visit 'prchar', because tainted data cannot flow through the node

UNSAT (false alarm)