cfg_accurate: problem with __isoc99_scanf analysis

Found some strange behavior:

This is the analysis:

    start_state = b.factory.blank_state(addr=addr)
    start_state.stack_push(0x0)
    cfg = b.analyses.CFG(fail_fast=True, starts=[addr], initial_state=start_state, context_sensitivity_level=3, keep_state=True, call_depth=100)

For this input:

#include <stdio.h>

int global;
int cmp() {
    return global >= 0 && global <= 100;
}

int main(int argc, char *argv[])
{
    int x;
    cmp();
    scanf("%d", &x);
    return 0;
}

It creates this graph: (but only with scanf. If I replace scanf with printf, it doesn’t produce pathterminator nodes)

If I replace global with a stack variable:

#include <stdio.h>

int global;
int cmp() {
      int a;return a >=0 && a < 100;
}

int main(int argc, char *argv[])
{
    int x;
    cmp();
    scanf("%d", &x);
    return 0;
}

It also works fine:

[ltfish]

@ViktorMKa : axt answered it in another issue. Check this out: https://github.com/axt/angr-utils

[ViktorMKa]

Unrelated to the issue, but i’d like to know how you output these neat-looking graphs. What i get, using nx.write_dot(cfg.graph, name) and viewing with xdot is much less informative.