Rewriting the infection analysis. The current analysis follows the same recursive logic.
The current usage tracking needs to be taken care.
The test case, ftp_data_port, has not been passed.
The reason is that when its value is stored in a composite-type varaible (i.e., p_sockptr), we track every usage of p_sockptr (only one field is interesting). This is correct. But we need to filter the tracking that does not end up with the interesting field.
See the logs that records its usage (many false positives).