An Alarm Classification Using Shovel

'_prologue_' is an imaginary function that initialize argc, argv

Solid arrow means call edge

Dotted arrow means return edge

Green arrow means branch (pair of call & return)
(For details, see II-A.'Backbone-Branch Decomposition' section of our paper)

Alarm #1

+ Taint Source : error.c:142 (prepare_error_win)
+ Sink (Allocation) : error.c:165 (show_error_win)

path 1

(User Feedback)

Path should NOT include a return edge from 'prepare_error_win' to 'show_error_win' in backbone, because tainted data cannot flow along the edge

UNSAT (False Alarm)

Alarm #2

+ Taint Source : helpwin.c:35 (prepare_help_win)
+ Sink (Allocation) : error.c:165 (show_error_win)

path 1

(User Feedback)

Path should NOT include a call edge from 'live_mode' to 'show_error_win' in backbone, because tainted data cannot flow along the edge

UNSAT (False Alarm)