#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/
CWE78_OS_Command_Injection__char_console_execl_41_badSink(char *);
int /*<<< orphan*/ *fgets(char *, int, int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *);
int /*<<< orphan*/ stdin;
size_t strlen(char *);
void CWE78_OS_Command_Injection__char_console_execl_41_bad() {
  char *data;
  char dataBuffer[100] = "";
  data = dataBuffer;
  {
    size_t dataLen = strlen(data);
    if (100 - dataLen > 1) {
      if (fgets(data + dataLen, (int)(100 - dataLen), stdin) != NULL) {
        dataLen = strlen(data);
        if (dataLen > 0 && data[dataLen - 1] == '\n') {
          data[dataLen - 1] = '\0';
        }
      } else {
        printf("fgets() failed\n");
        data[dataLen] = '\0';
      }
    }
  }
  CWE78_OS_Command_Injection__char_console_execl_41_badSink(data);
}


x86 assembly (clang, -O0):
<CWE78_OS_Command_Injection__char_console_execl_41_bad>:
push   %rbp
mov    %rsp,%rbp
sub    $0x80,%rsp
lea    -0x70(%rbp),%rdi
xor    %esi,%esi
mov    $0x64,%edx
call   1060 <memset@plt>
lea    -0x70(%rbp),%rax
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rdi
call   1040 <strlen@plt>
mov    %rax,-0x78(%rbp)
mov    $0x64,%eax
sub    -0x78(%rbp),%rax
cmp    $0x1,%rax
jbe    1221 <CWE78_OS_Command_Injection__char_console_execl_41_bad+0xd1>
mov    -0x8(%rbp),%rdi
add    -0x78(%rbp),%rdi
mov    $0x64,%eax
sub    -0x78(%rbp),%rax
mov    %eax,%esi
mov    0x2e3b(%rip),%rax
mov    (%rax),%edx
call   1070 <fgets@plt>
cmp    $0x0,%rax
je     1204 <CWE78_OS_Command_Injection__char_console_execl_41_bad+0xb4>
mov    -0x8(%rbp),%rdi
call   1040 <strlen@plt>
mov    %rax,-0x78(%rbp)
cmpq   $0x0,-0x78(%rbp)
jbe    11ff <CWE78_OS_Command_Injection__char_console_execl_41_bad+0xaf>
mov    -0x8(%rbp),%rax
mov    -0x78(%rbp),%rcx
sub    $0x1,%rcx
movsbl (%rax,%rcx,1),%eax
cmp    $0xa,%eax
jne    11ff <CWE78_OS_Command_Injection__char_console_execl_41_bad+0xaf>
mov    -0x8(%rbp),%rax
mov    -0x78(%rbp),%rcx
sub    $0x1,%rcx
movb   $0x0,(%rax,%rcx,1)
jmp    121c <CWE78_OS_Command_Injection__char_console_execl_41_bad+0xcc>
lea    0xdf5(%rip),%rdi
call   1050 <printf@plt>
mov    -0x8(%rbp),%rax
mov    -0x78(%rbp),%rcx
movb   $0x0,(%rax,%rcx,1)
jmp    1221 <CWE78_OS_Command_Injection__char_console_execl_41_bad+0xd1>
mov    -0x8(%rbp),%rdi
call   1030 <CWE78_OS_Command_Injection__char_console_execl_41_badSink@plt>
add    $0x80,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<CWE78_OS_Command_Injection__char_console_execl_41_bad>:
push   %rbx
sub    $0x70,%rsp
xorps  %xmm0,%xmm0
movaps %xmm0,0x50(%rsp)
movaps %xmm0,0x40(%rsp)
movaps %xmm0,0x30(%rsp)
movaps %xmm0,0x20(%rsp)
movaps %xmm0,0x10(%rsp)
movaps %xmm0,(%rsp)
movl   $0x0,0x60(%rsp)
mov    %rsp,%rdi
call   1050 <strlen@plt>
mov    $0x64,%esi
sub    %rax,%rsi
cmp    $0x2,%rsi
jb     11cc <CWE78_OS_Command_Injection__char_console_execl_41_bad+0x8c>
lea    (%rsp,%rax,1),%rbx
mov    0x2e5a(%rip),%rax
mov    (%rax),%edx
mov    %rbx,%rdi
call   1060 <fgets@plt>
test   %rax,%rax
je     11bd <CWE78_OS_Command_Injection__char_console_execl_41_bad+0x7d>
mov    %rsp,%rbx
mov    %rbx,%rdi
call   1050 <strlen@plt>
test   %rax,%rax
je     11cc <CWE78_OS_Command_Injection__char_console_execl_41_bad+0x8c>
cmpb   $0xa,-0x1(%rax,%rbx,1)
jne    11cc <CWE78_OS_Command_Injection__char_console_execl_41_bad+0x8c>
add    %rax,%rbx
add    $0xffffffffffffffff,%rbx
jmp    11c9 <CWE78_OS_Command_Injection__char_console_execl_41_bad+0x89>
lea    0xe3c(%rip),%rdi
call   1040 <puts@plt>
movb   $0x0,(%rbx)
mov    %rsp,%rdi
call   1030 <CWE78_OS_Command_Injection__char_console_execl_41_badSink@plt>
add    $0x70,%rsp
pop    %rbx
ret

LLVM IR (-O0):
@stdin = global i32 0
@.str = [16 x i8] c"fgets() failed\0A\00"
define void @CWE78_OS_Command_Injection__char_console_execl_41_bad() {
%1 = alloca i8*
%2 = alloca [100 x i8]
%3 = alloca i64
%4 = bitcast [100 x i8]* %2 to i8*
%5 = getelementptr inbounds [100 x i8], [100 x i8]* %2, i64 0, i64 0
store i8* %5, i8** %1
%6 = load i8*, i8** %1
%7 = call i64 @strlen(i8* %6)
store i64 %7, i64* %3
%8 = load i64, i64* %3
%9 = sub i64 100, %8
%10 = icmp ugt i64 %9, 1
br i1 %10, label %11, label %46
11: ; preds = %0
%12 = load i8*, i8** %1
%13 = load i64, i64* %3
%14 = getelementptr inbounds i8, i8* %12, i64 %13
%15 = load i64, i64* %3
%16 = sub i64 100, %15
%17 = trunc i64 %16 to i32
%18 = load i32, i32* @stdin
%19 = call i32* @fgets(i8* %14, i32 %17, i32 %18)
%20 = icmp ne i32* %19, null
br i1 %20, label %21, label %40
21: ; preds = %11
%22 = load i8*, i8** %1
%23 = call i64 @strlen(i8* %22)
store i64 %23, i64* %3
%24 = load i64, i64* %3
%25 = icmp ugt i64 %24, 0
br i1 %25, label %26, label %39
26: ; preds = %21
%27 = load i8*, i8** %1
%28 = load i64, i64* %3
%29 = sub i64 %28, 1
%30 = getelementptr inbounds i8, i8* %27, i64 %29
%31 = load i8, i8* %30
%32 = sext i8 %31 to i32
%33 = icmp eq i32 %32, 10
br i1 %33, label %34, label %39
34: ; preds = %26
%35 = load i8*, i8** %1
%36 = load i64, i64* %3
%37 = sub i64 %36, 1
%38 = getelementptr inbounds i8, i8* %35, i64 %37
store i8 0, i8* %38
br label %39
39: ; preds = %34, %26, %21
br label %45
40: ; preds = %11
%41 = call i32 @printf(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str, i64 0, i64 0))
%42 = load i8*, i8** %1
%43 = load i64, i64* %3
%44 = getelementptr inbounds i8, i8* %42, i64 %43
store i8 0, i8* %44
br label %45
45: ; preds = %40, %39
br label %46
46: ; preds = %45, %0
%47 = load i8*, i8** %1
%48 = call i32 @CWE78_OS_Command_Injection__char_console_execl_41_badSink(i8* %47)
ret void
}

LLVM IR (-O2):
@stdin = global i32 0
@str = [15 x i8] c"fgets() failed\00"
define void @CWE78_OS_Command_Injection__char_console_execl_41_bad() {
%1 = alloca [100 x i8]
%2 = getelementptr inbounds [100 x i8], [100 x i8]* %1, i64 0, i64 0
%3 = call i64 @strlen(i8* %2)
%4 = sub i64 100, %3
%5 = icmp ugt i64 %4, 1
br i1 %5, label %6, label %24
6: ; preds = %0
%7 = getelementptr inbounds [100 x i8], [100 x i8]* %1, i64 0, i64 %3
%8 = trunc i64 %4 to i32
%9 = load i32, i32* @stdin
%10 = call i32* @fgets(i8* %7, i32 %8, i32 %9)
%11 = icmp eq i32* %10, null
br i1 %11, label %20, label %12
12: ; preds = %6
%13 = call i64 @strlen(i8* %2)
%14 = icmp eq i64 %13, 0
br i1 %14, label %24, label %15
15: ; preds = %12
%16 = add i64 %13, -1
%17 = getelementptr inbounds [100 x i8], [100 x i8]* %1, i64 0, i64 %16
%18 = load i8, i8* %17
%19 = icmp eq i8 %18, 10
br i1 %19, label %22, label %24
20: ; preds = %6
%21 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([15 x i8], [15 x i8]* @str, i64 0, i64 0))
br label %22
22: ; preds = %15, %20
%23 = phi i8* [ %7, %20 ], [ %17, %15 ]
store i8 0, i8* %23
br label %24
24: ; preds = %22, %15, %12, %0
%25 = call i32 @CWE78_OS_Command_Injection__char_console_execl_41_badSink(i8* %2)
ret void
}