Find a path starting from malloc-like API and not containing any free-like API.
Find a path starting from null value and ending at the dereference.
Find a path starting from free-like API and ending at free-like API or other usages (e.g, dereference).