Two problems need to be fixed: 1. Ask xuepeng about the stackoverflow problem; 2. the current infection analysis is flawed when a composite argument is passed, see the str_copy() example in vsftpd (this needs to be fixed)