// File: /workspace/github_c_makefile_star2_O3/mabdi[P]bunney/bunny-main.c
// Function: chunk_walk
static _u8 chunk_walk(struct bunny_traceitem* t, _u32 oper, _u32 csize) {
  _s32 shift, pos, rev;

  if (reg_execs > cycle_branch_limit && (zero_range || reg_params > cycle_value_limit)) return 1;

  if (oper == FLOW_INSERT && t->fuzzable >= size_limit) {
    outf("      >>> Fuzzable input limit of %u exceeded (use -F to adjust).\n",size_limit);
    return 1;
  }

  /* FLOW_SWAP is symmetrical; the rest should be tested for +/- shifts */

  for (rev=0;rev < 1 + (oper != FLOW_SWAP);rev++) 
    for (shift = 1; shift < chunk_off_max; shift++) {

      _s32 max = t->fuzzable - csize - shift;

      for (pos=0;pos <= max;pos++) {
        struct bunny_traceitem* n;
        _u8 rne = 0;
        _u32 src, dst;
  
        flow_command(FLOW_RESET,0,0,0);

        if (!rev) { src = pos; dst = pos + shift; }
          else { src = pos + shift; dst = pos; }

        flow_command(oper,dst,csize,src);

        n = run_program();

        if (check_crash(n)) {
          outf("%s %u bytes from offset #%u to #%u.\n\n",
            (oper == FLOW_INSERT) ? "cloning" : 
            (oper == FLOW_SWAP) ? "swapping" : "pasting over",
            csize, src, dst);
          if (keep_fault) continue;
          return 1;
        }

        if (reg_execs > cycle_branch_limit) epath_ign++;
          else if ((rne=register_new_exec(n,1))) {
            outf("      Triggered by %s %u bytes from offset #%u to #%u.\n",
              (oper == FLOW_INSERT) ? "cloning" : 
              (oper == FLOW_SWAP) ? "swapping" : "pasting over",
              csize, src, dst);
  
            reg_execs++;
            if (reg_execs > cycle_branch_limit) 
              outf("      >>> Per-cycle call path limit of %u exceeded (use -N to adjust).\n",cycle_branch_limit);
          }

        if (reg_params > cycle_value_limit) ppath_ign++;
          else if (register_new_param(n,0,0,1,rne)) {
            outf("      Triggered by %s %u bytes from offset #%u to #%u.\n",
              (oper == FLOW_INSERT) ? "cloning" : 
              (oper == FLOW_SWAP) ? "swapping" : "pasting over",
              csize, src, dst);
            reg_params++;
            if (reg_params > cycle_value_limit) 
              outf("      >>> Per-cycle function parameter limit of %u exceeded (use -P to adjust).\n",cycle_value_limit);
          }
      
        /* Context not saved */
        if (!rne) discard_context(n,1);
      
      }
  
    }


  return 0;
  
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x38, %rsp
movl %edx, %ebx
movl %esi, 0x8(%rsp)
movl 0x67ff(%rip), %eax      # 0x10358
cmpl 0x66c9(%rip), %eax      # 0x10228
jbe 0x9b83
movb $0x1, %r14b
cmpb $0x0, 0x672a(%rip)      # 0x10295
jne 0x9eca
movl 0x67e5(%rip), %eax      # 0x1035c
cmpl 0x66af(%rip), %eax      # 0x1022c
ja 0x9eca
cmpl $0x6a, 0x8(%rsp)
jne 0x9b99
movl 0x6708(%rip), %esi      # 0x10298
cmpl %esi, 0x4(%rdi)
jae 0x9edc
movl 0x8(%rsp), %edx
cmpl $0x6b, %edx
leaq 0x3a7a(%rip), %rax      # 0xd621
leaq 0x3a6a(%rip), %rcx      # 0xd618
cmovneq %rax, %rcx
cmpl $0x6a, %edx
leaq 0x3a54(%rip), %rax      # 0xd610
cmovneq %rcx, %rax
movq %rax, 0x10(%rsp)
movl %ebx, %eax
negl %eax
movl %eax, 0x24(%rsp)
movb $0x1, %al
movl %eax, 0xc(%rsp)
movl 0x6637(%rip), %eax      # 0x10210
movq %rdi, 0x30(%rsp)
cmpl $0x2, %eax
jb 0x9ea8
movl $0x1, %ebp
movl 0x24(%rsp), %edx
movl 0x4(%rdi), %esi
leal (%rbx,%rbp), %ecx
cmpl %ecx, %esi
js 0x9e9c
movl %edx, 0x28(%rsp)
addl %edx, %esi
xorl %r15d, %r15d
movq %rbp, 0x18(%rsp)
movl %esi, 0x2c(%rsp)
movl $0x2, %edi
xorl %esi, %esi
xorl %edx, %edx
xorl %ecx, %ecx
callq 0x7b27
leal (%r15,%rbp), %r12d
testb $0x1, 0xc(%rsp)
movl %r12d, %r13d
cmovnel %r15d, %r13d
cmovel %r15d, %r12d
movl 0x8(%rsp), %edi
movl %r12d, %esi
movl %ebx, %edx
movl %r13d, %ecx
callq 0x7b27
callq 0x7e6c
movq %rax, %r14
movq %rax, %rdi
callq 0xa5aa
testb %al, %al
je 0x9cb2
leaq 0x398a(%rip), %rbp      # 0xd5ea
movq %rbp, %rdi
movq 0x10(%rsp), %r14
movq %r14, %rsi
movl %ebx, %edx
movl %r13d, %ecx
movl %r12d, %r8d
xorl %eax, %eax
callq 0x2030
movq 0x65e7(%rip), %rdi      # 0x10268
testq %rdi, %rdi
je 0x9c9b
movq %rbp, %rsi
movq %r14, %rdx
movl %ebx, %ecx
movl %r13d, %r8d
movl %r12d, %r9d
xorl %eax, %eax
callq 0x22d0
cmpb $0x0, 0x65f0(%rip)      # 0x10292
movq 0x18(%rsp), %rbp
jne 0x9e66
jmp 0x9ec7
movl 0x66a0(%rip), %eax      # 0x10358
cmpl 0x656a(%rip), %eax      # 0x10228
jbe 0x9ccb
incl 0x662a(%rip)            # 0x102f0
jmp 0x9d88
movq %r14, %rdi
movl $0x1, %esi
callq 0x8b9a
testb %al, %al
je 0x9d88
movq %rbx, %rbp
leaq 0x3944(%rip), %rbx      # 0xd62e
movq %rbx, %rdi
movq 0x10(%rsp), %rsi
movl %ebp, %edx
movl %r13d, %ecx
movl %r12d, %r8d
xorl %eax, %eax
callq 0x2030
movq 0x6560(%rip), %rdi      # 0x10268
testq %rdi, %rdi
je 0x9d24
movq %rbx, %rsi
movq 0x10(%rsp), %rdx
movl %ebp, %ecx
movl %r13d, %r8d
movl %r12d, %r9d
xorl %eax, %eax
callq 0x22d0
movl 0x662e(%rip), %eax      # 0x10358
incl %eax
movl %eax, 0x6626(%rip)      # 0x10358
movl 0x64f0(%rip), %esi      # 0x10228
cmpl %esi, %eax
jbe 0x9e78
movl $0x0, 0x4(%rsp)
leaq 0x35af(%rip), %rdi      # 0xd2fe
xorl %eax, %eax
callq 0x2030
movq 0x650b(%rip), %rdi      # 0x10268
testq %rdi, %rdi
movq %rbp, %rbx
movq 0x18(%rsp), %rbp
je 0x9d8e
movl 0x64b8(%rip), %edx      # 0x10228
movl $0x0, 0x4(%rsp)
leaq 0x357f(%rip), %rsi      # 0xd2fe
xorl %eax, %eax
callq 0x22d0
jmp 0x9d8e
movb $0x1, %al
movl %eax, 0x4(%rsp)
movl 0x65c8(%rip), %eax      # 0x1035c
cmpl 0x6492(%rip), %eax      # 0x1022c
jbe 0x9da7
incl 0x6556(%rip)            # 0x102f8
jmp 0x9e52
movq %r14, %rdi
xorl %esi, %esi
xorl %edx, %edx
movl $0x1, %ecx
callq 0x8e74
testb %al, %al
je 0x9e52
movq %rbx, %rbp
leaq 0x3864(%rip), %rbx      # 0xd62e
movq %rbx, %rdi
movq 0x10(%rsp), %rsi
movl %ebp, %edx
movl %r13d, %ecx
movl %r12d, %r8d
xorl %eax, %eax
callq 0x2030
movq 0x6480(%rip), %rdi      # 0x10268
testq %rdi, %rdi
je 0x9e04
movq %rbx, %rsi
movq 0x10(%rsp), %rdx
movl %ebp, %ecx
movl %r13d, %r8d
movl %r12d, %r9d
xorl %eax, %eax
callq 0x22d0
movl 0x6552(%rip), %eax      # 0x1035c
incl %eax
movl %eax, 0x654a(%rip)      # 0x1035c
movl 0x6414(%rip), %esi      # 0x1022c
cmpl %esi, %eax
movq %rbp, %rbx
movq 0x18(%rsp), %rbp
jbe 0x9e52
leaq 0x351b(%rip), %rdi      # 0xd346
xorl %eax, %eax
callq 0x2030
movq 0x642f(%rip), %rdi      # 0x10268
testq %rdi, %rdi
je 0x9e52
movl 0x63e8(%rip), %edx      # 0x1022c
leaq 0x34fb(%rip), %rsi      # 0xd346
xorl %eax, %eax
callq 0x22d0
cmpb $0x0, 0x4(%rsp)
je 0x9e66
movq %r14, %rdi
movl $0x1, %esi
callq 0x8a2c
incl %r15d
movl 0x2c(%rsp), %esi
cmpl %r15d, %esi
jne 0x9c10
jmp 0x9e8d
movl $0x0, 0x4(%rsp)
movq %rbp, %rbx
movq 0x18(%rsp), %rbp
jmp 0x9d8e
movl 0x637d(%rip), %eax      # 0x10210
movq 0x30(%rsp), %rdi
movl 0x28(%rsp), %edx
incl %ebp
decl %edx
cmpl %eax, %ebp
jb 0x9bf0
cmpl $0x6b, 0x8(%rsp)
setne %cl
xorl %r14d, %r14d
testb %cl, 0xc(%rsp)
movl $0x0, 0xc(%rsp)
jne 0x9bde
jmp 0x9eca
movb $0x1, %r14b
movl %r14d, %eax
addq $0x38, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
leaq 0x36c4(%rip), %rdi      # 0xd5a7
xorl %eax, %eax
callq 0x2030
movq 0x6377(%rip), %rdi      # 0x10268
movb $0x1, %r14b
testq %rdi, %rdi
je 0x9eca
movl 0x6399(%rip), %edx      # 0x10298
leaq 0x36a1(%rip), %rsi      # 0xd5a7
xorl %eax, %eax
callq 0x22d0
jmp 0x9eca