• '_prologue_' is an imaginary function that initialize argc, argv
  
• Solid arrow means call edge
  
• Dotted arrow means return edge
  
• Green arrow means branch (pair of call & return)
  
For details, see II-A.'Backbone-Branch Decomposition' section of our paper

Path should include a return edge from 'pin_change_olformat' to 'write_page' either in backbone or branch, for the correct taint propagation toward the sink

Path should include a return edge from 'check_pin_list' to 'pin_change_olformat' either in backbone or branch, for the correct taint propagation toward the sink

Path should include a return edge from 'read_string' to 'read_file2' either in backbone or branch, for the correct taint propagation toward the sink

Path should include a return edge from 'pin_change_olformat' to 'write_page' either in backbone or branch, for the correct taint propagation toward the sink

Path should include a return edge from 'check_pin_list' to 'pin_change_olformat' either in backbone or branch, for the correct taint propagation toward the sink

Path should include a return edge from 'pin_change_olformat' to 'write_page' either in backbone or branch, for the correct taint propagation toward the sink

Path should include a return edge from 'check_pin_list' to 'pin_change_olformat' either in backbone or branch, for the correct taint propagation toward the sink

Path should NOT have an outgoing edge from 'imageobject_depth', because tainted data cannot flow through the node

Path should include a return edge from 'pin_change_olformat' to 'write_page' either in backbone or branch, for the correct taint propagation toward the sink

Path should include a return edge from 'check_pin_list' to 'pin_change_olformat' either in backbone or branch, for the correct taint propagation toward the sink

Path should NOT have an outgoing edge from 'font_loadtables', because tainted data cannot flow through the node

Path should include a return edge from 'pin_change_olformat' to 'write_page' either in backbone or branch, for the correct taint propagation toward the sink

Path should include a return edge from 'check_pin_list' to 'pin_change_olformat' either in backbone or branch, for the correct taint propagation toward the sink

Path should NOT have an outgoing edge from 'Hyphen_Next', because tainted data cannot flow through the node

Path should include a return edge from 'pin_figtab_format_changes' to 'number_titles' either in backbone or branch, for the correct taint propagation toward the sink

Path should include a return edge from 'check_pin_list' to 'pin_figtab_format_changes' either in backbone or branch, for the correct taint propagation toward the sink

Path should include a return edge from 'read_string' to 'read_file2' either in backbone or branch, for the correct taint propagation toward the sink

Path should include a return edge from 'pin_figtab_format_changes' to 'number_titles' either in backbone or branch, for the correct taint propagation toward the sink

Path should include a return edge from 'check_pin_list' to 'pin_figtab_format_changes' either in backbone or branch, for the correct taint propagation toward the sink

Path should include a return edge from 'pin_figtab_format_changes' to 'number_titles' either in backbone or branch, for the correct taint propagation toward the sink

Path should include a return edge from 'check_pin_list' to 'pin_figtab_format_changes' either in backbone or branch, for the correct taint propagation toward the sink

Path should NOT have an outgoing edge from 'imageobject_depth', because tainted data cannot flow through the node

Path should include a return edge from 'pin_figtab_format_changes' to 'number_titles' either in backbone or branch, for the correct taint propagation toward the sink

Path should include a return edge from 'check_pin_list' to 'pin_figtab_format_changes' either in backbone or branch, for the correct taint propagation toward the sink

Path should NOT have an outgoing edge from 'font_loadtables', because tainted data cannot flow through the node

Path should include a return edge from 'pin_figtab_format_changes' to 'number_titles' either in backbone or branch, for the correct taint propagation toward the sink

Path should include a return edge from 'check_pin_list' to 'pin_figtab_format_changes' either in backbone or branch, for the correct taint propagation toward the sink

Path should NOT have an outgoing edge from 'Hyphen_Next', because tainted data cannot flow through the node