• '_prologue_' is an imaginary function that initialize argc, argv
  
• Solid arrow means call edge
  
• Dotted arrow means return edge
  
• Green arrow means branch (pair of call & return)
  
For details, see II-A.'Backbone-Branch Decomposition' section of our paper

'rptp_getline' cannot return from 'rptp_command' and then call 'rptp_putline', since 'rptp_command' always calls 'rptp_putline' before calling 'rptp_getline'

'rptp_getline' cannot return from 'command_list' and then call 'rptp_command', since 'command_list' always calls 'rptp_command' before calling 'rptp_getline'

Path should NOT have an outgoing return edge from 'rptp_open', because tainted data cannot flow through the node

Path should NOT have an outgoing return edge from 'command_list', because tainted data cannot flow through the node

Path should NOT include a call edge from 'command_put' to 'rptp_command' in backbone, because tainted data cannot flow along the edge

Path should NOT have an outgoing return edge from 'command_put', because tainted data cannot flow through the node