An Alarm Classification Using Shovel

'_prologue_' is an imaginary function that initialize argc, argv

Solid arrow means call edge

Dotted arrow means return edge

Green arrow means branch (pair of call & return)
For details, see II-A.'Backbone-Branch Decomposition' section of our paper

tiptop_alarm1_1

path 1

(User Feedback)

Path should have an incoming edge to 'add_column', to define a necessary variable used in the sink

path 2

(User Feedback)

Path should NOT have an incoming edge to 'parse_columns', because tainted data cannot flow through the node

path 3

(User Feedback)

Path should include a call edge from 'parse_columns' to 'add_column' either in backbone or branch, for the correct taint propagation toward the sink

UNSAT (false alarm)

tiptop_alarm1_2

path 1

(User Feedback)

Path should have an incoming edge to 'add_column', to define a necessary variable used in the sink

path 2

(User Feedback)

Path should include a call edge from 'parse_columns' to 'add_column' either in backbone or branch, for the correct taint propagation toward the sink

path 3

(User Feedback)

Path should NOT have an incoming edge to 'parse_columns', because tainted data cannot flow through the node

UNSAT (false alarm)

tiptop_alarm1_3

path 1

(User Feedback)

Path should have an incoming edge to 'add_column', to define a necessary variable used in the sink

path 2

(User Feedback)

Path should NOT have an incoming edge to 'parse_columns', because tainted data cannot flow through the node

path 3

(User Feedback)

Path should include a call edge from 'parse_columns' to 'add_column' either in backbone or branch, for the correct taint propagation toward the sink

UNSAT (false alarm)

tiptop_alarm1_4

path 1

Found Bug (true alarm)