An Alarm Classification Using Shovel

'_prologue_' is an imaginary function that initialize argc, argv

Solid arrow means call edge

Dotted arrow means return edge

Green arrow means branch (pair of call & return)
(For details, see II-A.'Backbone-Branch Decomposition' section of our paper)

Alarm #1

+ Taint Source : core_shntool.c:357 (_prologue_)
+ Sink (Allocation) : mode_cmp.c:185 (cmp_files)

Found Bug (True Alarm)

Alarm #2

+ Taint Source : core_shntool.c:357 (_prologue_)
+ Sink (Allocation) : mode_cmp.c:316 (shift_comparison)

Found Bug (True Alarm)

Alarm #3

+ Taint Source : mode_split.c:620 (get_length_token)
+ Sink (Allocation) : mode_cmp.c:316 (shift_comparison)

path 1

(User Feedback)

'parse_main' cannot return from 'split_main' and then call 'cmp_main', since 'parse_main' always calls 'cmp_main' before calling 'split_main'

UNSAT (False Alarm)

Alarm #4

+ Taint Source : mode_split.c:656 (get_length_token)
+ Sink (Allocation) : mode_cmp.c:316 (shift_comparison)

path 1

(User Feedback)

'parse_main' cannot return from 'split_main' and then call 'cmp_main', since 'parse_main' always calls 'cmp_main' before calling 'split_main'

UNSAT (False Alarm)

Alarm #5

+ Taint Source : mode_split.c:662 (get_length_token)
+ Sink (Allocation) : mode_cmp.c:316 (shift_comparison)

path 1

(User Feedback)

'parse_main' cannot return from 'split_main' and then call 'cmp_main', since 'parse_main' always calls 'cmp_main' before calling 'split_main'

UNSAT (False Alarm)

Alarm #6

+ Taint Source : mode_split.c:667 (get_length_token)
+ Sink (Allocation) : mode_cmp.c:316 (shift_comparison)

path 1

(User Feedback)

'parse_main' cannot return from 'split_main' and then call 'cmp_main', since 'parse_main' always calls 'cmp_main' before calling 'split_main'

UNSAT (False Alarm)

Alarm #7

+ Taint Source : core_fileio.c:107 (read_value_long)
+ Sink (Allocation) : mode_cat.c:121 (cat_file)

path 1

(User Feedback)

'cat_file' cannot return from 'do_header_kluges' and then call alloc(), since 'cat_file' always calls alloc() before calling 'do_header_kluges'

path 2

(User Feedback)

Path should NOT include a return edge from 'verify_wav_header_internal' to 'new_wave_info' in backbone, because there is a sanitization logic along the nodes

path 3

(User Feedback)

Path should NOT include a return edge from 'is_our_file___3' to 'new_wave_info' in backbone, because tainted data cannot flow along the edge

path 4

(User Feedback)

Path should NOT include a return edge from 'is_our_file___2' to 'new_wave_info' in backbone, because tainted data cannot flow along the edge

path 5

(User Feedback)

'parse_main' cannot return from any function and then call 'cat_main', since 'cat_main' is the last function that 'parse_main' calls

UNSAT (False Alarm)

Alarm #8

+ Taint Source : core_fileio.c:107 (read_value_long)
+ Sink (Allocation) : mode_cmp.c:185 (cmp_files)

Found Bug (True Alarm)

Alarm #9

+ Taint Source : core_fileio.c:107 (read_value_long)
+ Sink (Allocation) : mode_conv.c:109 (conv_file)

path 1

(User Feedback)

'conv_file' cannot return from 'do_header_kluges' and then call alloc(), since 'conv_file' always calls alloc() before calling 'do_header_kluges'

path 2

(User Feedback)

Path should NOT include a return edge from 'verify_wav_header_internal' to 'new_wave_info' in backbone, because there is a sanitization logic along the nodes

path 3

(User Feedback)

Path should NOT include a return edge from 'is_our_file___3' to 'new_wave_info' in backbone, because tainted data cannot flow along the edge

path 4

(User Feedback)

Path should NOT include a return edge from 'is_our_file___2' to 'new_wave_info' in backbone, because tainted data cannot flow along the edge

path 5

(User Feedback)

'parse_main' cannot return from any function and then call 'conv_main', since 'conv_main' is the last function that 'parse_main' calls

UNSAT (False Alarm)

Alarm #10

+ Taint Source : core_fileio.c:107 (read_value_long)
+ Sink (Allocation) : core_mode.c:1304 (discard_header)

path 1

(User Feedback)

'trim_file' cannot return from 'do_header_kluges' and then call 'scan_file', since 'trim_file' always calls 'scan_file' before calling 'do_header_kluges'

path 2

(User Feedback)

Path should NOT include a return edge from 'verify_wav_header_internal' to 'new_wave_info' in backbone, because there is a sanitization logic along the nodes

path 3

(User Feedback)

Path should NOT include a return edge from 'is_our_file___3' to 'new_wave_info' in backbone, because tainted data cannot flow along the edge

path 4

(User Feedback)

Path should NOT include a return edge from 'is_our_file___2' to 'new_wave_info' in backbone, because tainted data cannot flow along the edge

path 5

(User Feedback)

'parse_main' cannot return from any function and then call 'trim_main', since 'trim_main' is the last function that 'parse_main' calls

path 6

(User Feedback)

'parse_main' cannot return from any function and then call 'cmp_main', since 'cmp_main' is the last function that 'parse_main' calls

UNSAT (False Alarm)

Alarm #11

+ Taint Source : core_fileio.c:107 (read_value_long)
+ Sink (Allocation) : mode_hash.c:1168 (generate_audio_hash_composite)

path 1

(User Feedback)

Path should NOT include a return edge from 'verify_wav_header_internal' to 'new_wave_info' in backbone, because there is a sanitization logic along the nodes

path 2

(User Feedback)

Path should NOT include a return edge from 'is_our_file___3' to 'new_wave_info' in backbone, because tainted data cannot flow along the edge

path 3

(User Feedback)

Path should NOT include a return edge from 'is_our_file___2' to 'new_wave_info' in backbone, because tainted data cannot flow along the edge

path 4

(User Feedback)

'parse_main' cannot return from any function and then call 'hash_main', since 'hash_main' is the last function that 'parse_main' calls

UNSAT (False Alarm)

Alarm #12

+ Taint Source : core_fileio.c:107 (read_value_long)
+ Sink (Allocation) : mode_hash.c:1109 (generate_audio_hash_single)

path 1

(User Feedback)

Path should NOT include a return edge from 'verify_wav_header_internal' to 'new_wave_info' in backbone, because there is a sanitization logic along the nodes

path 2

(User Feedback)

Path should NOT include a return edge from 'is_our_file___3' to 'new_wave_info' in backbone, because tainted data cannot flow along the edge

path 3

(User Feedback)

Path should NOT include a return edge from 'is_our_file___2' to 'new_wave_info' in backbone, because tainted data cannot flow along the edge

path 4

(User Feedback)

'parse_main' cannot return from any function and then call 'hash_main', since 'hash_main' is the last function that 'parse_main' calls

UNSAT (False Alarm)

Alarm #13

+ Taint Source : core_fileio.c:107 (read_value_long)
+ Sink (Allocation) : mode_pad.c:122 (pad_file)

path 1

(User Feedback)

'pad_file' cannot return from 'do_header_kluges' and then call alloc(), since 'pad_file' always calls alloc() before calling 'do_header_kluges'

path 2

(User Feedback)

Path should NOT include a return edge from 'verify_wav_header_internal' to 'new_wave_info' in backbone, because there is a sanitization logic along the nodes

path 3

(User Feedback)

Path should NOT include a return edge from 'is_our_file___3' to 'new_wave_info' in backbone, because tainted data cannot flow along the edge

path 4

(User Feedback)

Path should NOT include a return edge from 'is_our_file___2' to 'new_wave_info' in backbone, because tainted data cannot flow along the edge

path 5

(User Feedback)

'parse_main' cannot return from any function and then call 'pad_main', since 'pad_main' is the last function that 'parse_main' calls

UNSAT (False Alarm)

Alarm #14

+ Taint Source : core_fileio.c:107 (read_value_long)
+ Sink (Allocation) : mode_fix.c:215 (reopen_input_file)

path 1

(User Feedback)

Path should NOT include a return edge from 'verify_wav_header_internal' to 'new_wave_info' in backbone, because there is a sanitization logic along the nodes

path 2

(User Feedback)

Path should NOT include a return edge from 'is_our_file___3' to 'new_wave_info' in backbone, because tainted data cannot flow along the edge

path 3

(User Feedback)

Path should NOT include a return edge from 'is_our_file___2' to 'new_wave_info' in backbone, because tainted data cannot flow along the edge

path 4

(User Feedback)

'parse_main' cannot return from any function and then call 'fix_main', since 'fix_main' is the last function that 'parse_main' calls

UNSAT (False Alarm)

Alarm #15

+ Taint Source : core_fileio.c:107 (read_value_long)
+ Sink (Allocation) : mode_cmp.c:316 (shift_comparison)

Found Bug (True Alarm)

Alarm #16

+ Taint Source : core_fileio.c:107 (read_value_long)
+ Sink (Allocation) : mode_strip.c:168 (strip_and_canonicize)

path 1

(User Feedback)

Path should NOT include a return edge from 'verify_wav_header_internal' to 'new_wave_info' in backbone, because there is a sanitization logic along the nodes

path 2

(User Feedback)

Path should NOT include a return edge from 'is_our_file___3' to 'new_wave_info' in backbone, because tainted data cannot flow along the edge

path 3

(User Feedback)

Path should NOT include a return edge from 'is_our_file___2' to 'new_wave_info' in backbone, because tainted data cannot flow along the edge

path 4

(User Feedback)

'parse_main' cannot return from any function and then call 'strip_main', since 'strip_main' is the last function that 'parse_main' calls

UNSAT (False Alarm)

Alarm #17

+ Taint Source : core_fileio.c:107 (read_value_long)
+ Sink (Allocation) : mode_trim.c:262 (trim_file)

path 1

(User Feedback)

'trim_file' cannot return from 'do_header_kluges' and then call alloc(), since 'trim_file' always calls alloc() before calling 'do_header_kluges'

path 2

(User Feedback)

Path should NOT include a return edge from 'verify_wav_header_internal' to 'new_wave_info' in backbone, because there is a sanitization logic along the nodes

path 3

(User Feedback)

Path should NOT include a return edge from 'is_our_file___3' to 'new_wave_info' in backbone, because tainted data cannot flow along the edge

path 4

(User Feedback)

Path should NOT include a return edge from 'is_our_file___2' to 'new_wave_info' in backbone, because tainted data cannot flow along the edge

path 5

(User Feedback)

'parse_main' cannot return from any function and then call 'trim_main', since 'trim_main' is the last function that 'parse_main' calls

UNSAT (False Alarm)

Alarm #18

+ Taint Source : core_fileio.c:135 (read_value_short)
+ Sink (Allocation) : mode_cmp.c:185 (cmp_files)

Found Bug (True Alarm)

Alarm #19

+ Taint Source : core_fileio.c:135 (read_value_short)
+ Sink (Allocation) : mode_cmp.c:316 (shift_comparison)

Found Bug (True Alarm)