#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
char *malloc(int);
char *mempcpy(char *, void const *, int /*<<< orphan*/);
int /*<<< orphan*/ sink(char *);
int /*<<< orphan*/ unsigned_range(int, int);
void warn_mempcpy_chain_3(const void *s) {
  char *p = malloc(5);
  p = mempcpy(p, s, unsigned_range((1), (2)));
  p = mempcpy(p, s, unsigned_range((2), (3)));
  p = mempcpy(p, s, unsigned_range((3), (4)));
  sink(p);
}


x86 assembly (clang, -O0):
<warn_mempcpy_chain_3>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x8(%rbp)
mov    $0x5,%edi
call   1040 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0x40(%rbp)
mov    -0x8(%rbp),%rax
mov    %rax,-0x38(%rbp)
mov    $0x1,%edi
mov    $0x2,%esi
call   1060 <unsigned_range@plt>
mov    -0x40(%rbp),%rdi
mov    -0x38(%rbp),%rsi
mov    %eax,%edx
call   1050 <mempcpy@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0x30(%rbp)
mov    -0x8(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    $0x2,%edi
mov    $0x3,%esi
call   1060 <unsigned_range@plt>
mov    -0x30(%rbp),%rdi
mov    -0x28(%rbp),%rsi
mov    %eax,%edx
call   1050 <mempcpy@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    -0x8(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    $0x3,%edi
mov    $0x4,%esi
call   1060 <unsigned_range@plt>
mov    -0x20(%rbp),%rdi
mov    -0x18(%rbp),%rsi
mov    %eax,%edx
call   1050 <mempcpy@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rdi
call   1030 <sink@plt>
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<warn_mempcpy_chain_3>:
push   %r15
push   %r14
push   %rbx
mov    %rdi,%r15
mov    $0x5,%edi
call   1040 <malloc@plt>
mov    %rax,%r14
mov    $0x1,%edi
mov    $0x2,%esi
call   1060 <unsigned_range@plt>
mov    %r14,%rdi
mov    %r15,%rsi
mov    %eax,%edx
call   1050 <mempcpy@plt>
mov    %rax,%rbx
mov    $0x2,%edi
mov    $0x3,%esi
call   1060 <unsigned_range@plt>
mov    %rbx,%rdi
mov    %r15,%rsi
mov    %eax,%edx
call   1050 <mempcpy@plt>
mov    %rax,%rbx
mov    $0x3,%edi
mov    $0x4,%esi
call   1060 <unsigned_range@plt>
mov    %rbx,%rdi
mov    %r15,%rsi
mov    %eax,%edx
call   1050 <mempcpy@plt>
mov    %rax,%rdi
pop    %rbx
pop    %r14
pop    %r15
jmp    1030 <sink@plt>

LLVM IR (-O0):
define void @warn_mempcpy_chain_3(i8* %0) {
%2 = alloca i8*
%3 = alloca i8*
store i8* %0, i8** %2
%4 = call i8* @malloc(i32 5)
store i8* %4, i8** %3
%5 = load i8*, i8** %3
%6 = load i8*, i8** %2
%7 = call i32 @unsigned_range(i32 1, i32 2)
%8 = call i8* @mempcpy(i8* %5, i8* %6, i32 %7)
store i8* %8, i8** %3
%9 = load i8*, i8** %3
%10 = load i8*, i8** %2
%11 = call i32 @unsigned_range(i32 2, i32 3)
%12 = call i8* @mempcpy(i8* %9, i8* %10, i32 %11)
store i8* %12, i8** %3
%13 = load i8*, i8** %3
%14 = load i8*, i8** %2
%15 = call i32 @unsigned_range(i32 3, i32 4)
%16 = call i8* @mempcpy(i8* %13, i8* %14, i32 %15)
store i8* %16, i8** %3
%17 = load i8*, i8** %3
%18 = call i32 @sink(i8* %17)
ret void
}

LLVM IR (-O2):
define void @warn_mempcpy_chain_3(i8* %0) {
%2 = tail call dereferenceable_or_null(5) i8* @malloc(i32 5)
%3 = tail call i32 @unsigned_range(i32 1, i32 2)
%4 = tail call i8* @mempcpy(i8* %2, i8* %0, i32 %3)
%5 = tail call i32 @unsigned_range(i32 2, i32 3)
%6 = tail call i8* @mempcpy(i8* %4, i8* %0, i32 %5)
%7 = tail call i32 @unsigned_range(i32 3, i32 4)
%8 = tail call i8* @mempcpy(i8* %6, i8* %0, i32 %7)
%9 = tail call i32 @sink(i8* %8)
ret void
}