• '_prologue_' is an imaginary function that initialize argc, argv
  
• Solid arrow means call edge
  
• Dotted arrow means return edge
  
• Green arrow means branch (pair of call & return)
  
For details, see II-A.'Backbone-Branch Decomposition' section of our paper

Path should include one of the following edges :
(1) Call edge from split_file to st_snprintf
(2) Call edge from cue_sprintf to st_snprintf,
for the correct taint propagation to the sink

Path should have an incoming edge to 'parse', to define a necessary variable used in the sink

Path should NOT have an incoming edge to 'parse', because tainted data cannot flow through the node

Path should include one of the following edges :
(1) Call edge from split_file to st_snprintf
(2) Call edge from cue_sprintf to st_snprintf,
for the correct taint propagation to the sink

Path should have an incoming edge to 'parse', to define a necessary variable used in the sink

Path should NOT have an incoming edge to 'parse', because tainted data cannot flow through the node

Path should include one of the following edges :
(1) Call edge from split_file to st_snprintf
(2) Call edge from cue_sprintf to st_snprintf,
for the correct taint propagation to the sink

Path should have an incoming edge to 'parse', to define a necessary variable used in the sink

Path should NOT have an incoming edge to 'parse', because tainted data cannot flow through the node

Path should include one of the following edges :
(1) Call edge from split_file to st_snprintf
(2) Call edge from cue_sprintf to st_snprintf,
for the correct taint propagation to the sink

Path should have an incoming edge to 'parse', to define a necessary variable used in the sink

Path should NOT have an incoming edge to 'parse', because tainted data cannot flow through the node

Path should include one of the following edges :
(1) Call edge from split_file to st_snprintf
(2) Call edge from cue_sprintf to st_snprintf,
for the correct taint propagation to the sink

Path should have an incoming edge to 'parse', to define a necessary variable used in the sink

Path should NOT have an incoming edge to 'parse', because tainted data cannot flow through the node

Path should include one of the following edges :
(1) Call edge from split_file to st_snprintf
(2) Call edge from cue_sprintf to st_snprintf,
for the correct taint propagation to the sink

Path should have an incoming edge to 'parse', to define a necessary variable used in the sink

Path should NOT have an incoming edge to 'parse', because tainted data cannot flow through the node

Path should include one of the following edges :
(1) Call edge from split_file to st_snprintf
(2) Call edge from cue_sprintf to st_snprintf,
for the correct taint propagation to the sink

Path should have an incoming edge to 'parse', to define a necessary variable used in the sink