call-graph-analysis

Call Graph Reachability Analysis

Provides highest-confidence vulnerability assessment by proving whether vulnerable functions can actually be reached during program execution.

When to Use This Skill

Use this skill when:

• You need definitive proof that a vulnerable function is or isn't reachable
• Medium/high confidence analysis shows possible vulnerability but needs confirmation
• Generating evidence for security compliance or audit requirements
• govulncheck is unavailable or didn't find the CVE
• You need visual proof of execution paths for stakeholders

Prerequisites

Required Tools

• callgraph: go install golang.org/x/tools/cmd/callgraph@latest
• digraph: go install golang.org/x/tools/cmd/digraph@latest
• Go workspace with go.mod file

Optional Tools

• graphviz (for visualization): brew install graphviz (macOS) or sudo apt-get install graphviz (Linux)
• sfdp or dot command (part of graphviz)

Input Requirements

• CVE vulnerable function signature (e.g., <package-path>.<function-name>)
• Package path from CVE analysis
• Workspace path to analyze
• Algorithm preference (optional, default: vta) — passed via --algo from parent command
• CVE_ID — used to construct the output directory
• OUT_DIR (optional, default: .work/compliance/analyze-cve/${CVE_ID}) — where artifacts are written

Timeout and Algorithm Convention

• Use the algorithm specified by the user via --algo (default: vta).
• All callgraph invocations use timeout 300 (5 minutes) to prevent hanging on large codebases.
• If the chosen algorithm times out: fall back to the next faster algorithm (vta → rta → cha), then narrow scope to specific packages (e.g., ./cmd/..., ./pkg/...).

Implementation Steps

Step 1: Verify Tools Are Available

# Check for callgraph
which callgraph || echo "callgraph not found - install with: go install golang.org/x/tools/cmd/callgraph@latest"

# Check for digraph
which digraph || echo "digraph not found - install with: go install golang.org/x/tools/cmd/digraph@latest"

# Optional: Check for graphviz
which sfdp || echo "graphviz not found - visual graphs won't be generated (optional)"