• '_prologue_' is an imaginary function that initialize argc, argv
  
• Solid arrow means call edge
  
• Dotted arrow means return edge
  
• Green arrow means branch (pair of call & return)
  
For details, see II-A.'Backbone-Branch Decomposition' section of our paper

Path should include one of the following edges :
(1) Call edge from print_calc to sprintf_alloc
(2) Call edge from rrd_graph_v to sprintf_alloc,
for the correct taint propagation to the sink

If path includes a call edge from 'rrd_graph_v' to 'sprintf_alloc' either in backbone or branch, then path should include a return edge from 'rrd_graph_options' to 'rrd_graph_v' either in backbone or branch, for the correct taint propagation to the sink

Path should NOT include a call edge from 'rrd_graph_v' to 'sprintf_alloc' in backbone, because tainted data cannot flow along the edge

Path should NOT include a call edge from 'print_calc' to 'sprintf_alloc' in backbone, because there is a string sanitization in the latter node

Path should NOT have an incoming edge to 'sprintf_alloc', because there is a string sanitization in the node

Path should include one of the following edges :
(1) Call edge from print_calc to sprintf_alloc
(2) Call edge from rrd_graph_v to sprintf_alloc,
for the correct taint propagation to the sink

If path includes a call edge from 'rrd_graph_v' to 'sprintf_alloc' either in backbone or branch, then path should include a return edge from 'rrd_graph_options' to 'rrd_graph_v' either in backbone or branch, for the correct taint propagation to the sink

Path should NOT include a call edge from 'rrd_graph_v' to 'sprintf_alloc' in backbone, because tainted data cannot flow along the edge

Path should NOT include a call edge from 'print_calc' to 'sprintf_alloc' in backbone, because there is a string sanitization in the latter node

Path should NOT have an incoming edge to 'sprintf_alloc', because there is a string sanitization in the node

Path should include one of the following edges :
(1) Call edge from print_calc to sprintf_alloc
(2) Call edge from rrd_graph_v to sprintf_alloc,
for the correct taint propagation to the sink

If path includes a call edge from 'rrd_graph_v' to 'sprintf_alloc' either in backbone or branch, then path should include a return edge from 'rrd_graph_options' to 'rrd_graph_v' either in backbone or branch, for the correct taint propagation to the sink

Path should NOT include a call edge from 'rrd_graph_v' to 'sprintf_alloc' in backbone, because tainted data cannot flow along the edge

Path should NOT include a call edge from 'print_calc' to 'sprintf_alloc' in backbone, because there is a string sanitization in the latter node

Path should NOT have an incoming edge to 'sprintf_alloc', because there is a string sanitization in the node

Path should include one of the following edges :
(1) Call edge from print_calc to sprintf_alloc
(2) Call edge from rrd_graph_v to sprintf_alloc,
for the correct taint propagation to the sink

If path includes a call edge from 'rrd_graph_v' to 'sprintf_alloc' either in backbone or branch, then path should include a return edge from 'rrd_graph_options' to 'rrd_graph_v' either in backbone or branch, for the correct taint propagation to the sink