#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int uint32_t;

/* Variables and functions */
int /*<<< orphan*/ free(char *);
scalar_t__ malloc(int);
char *oat_url_escape(char *);
char *strchr(char *, char);
int /*<<< orphan*/ strcpy(char *, char *);
scalar_t__ strlen(char *);
int /*<<< orphan*/ strncpy(char *, char *, int);
char *strstr(char *, char *);
char **oat_create_query_array(char *query_string, uint32_t *param_size) {
  uint32_t param_num = 0;
  char *pBegin = strchr(query_string, '?') + 1;
  char *pCurr;
  char *pEnd;
  char **out_array;
  if (pBegin == NULL) {
    return NULL;
  }
  if (strlen(pBegin) == 0) {
    return NULL;
  }
  param_num = 1;
  pCurr = pBegin;
  while (strchr(pCurr, '&') != NULL) {
    pCurr = strchr(pCurr, '&') + 1;
    param_num = param_num + 1;
  }
  out_array = (char **)malloc(sizeof(char *) * param_num);
  for (uint32_t i = 0; i < param_num; i++) {
    uint32_t copy_size = 0;
    char *temp;
    pEnd = strchr(pBegin, '&');
    if (pEnd == NULL) {
      pEnd = strchr(pBegin, 0);
    }
    copy_size = pEnd - pBegin;
    temp = (char *)malloc(copy_size + 1);
    strncpy(temp, pBegin, copy_size);
    temp[copy_size] = 0;
    out_array[i] = oat_url_escape(temp);
    free(temp);
    pCurr = strstr(out_array[i], "%3D");
    if (pCurr != NULL) {
      *pCurr = '=';
      strcpy(pCurr + 1, pCurr + 3);
    }
    pBegin = pEnd + 1;
  }
  *param_size = param_num;
  return out_array;
}


x86 assembly (clang, -O0):
<oat_create_query_array>:
push   %rbp
mov    %rsp,%rbp
sub    $0x50,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
movl   $0x0,-0x1c(%rbp)
mov    -0x10(%rbp),%rdi
mov    $0x3f,%esi
call   1070 <strchr@plt>
add    $0x1,%rax
mov    %rax,-0x28(%rbp)
cmpq   $0x0,-0x28(%rbp)
jne    11c5 <oat_create_query_array+0x45>
movq   $0x0,-0x8(%rbp)
jmp    1351 <oat_create_query_array+0x1d1>
mov    -0x28(%rbp),%rdi
call   1060 <strlen@plt>
cmp    $0x0,%rax
jne    11e5 <oat_create_query_array+0x65>
movq   $0x0,-0x8(%rbp)
jmp    1351 <oat_create_query_array+0x1d1>
movl   $0x1,-0x1c(%rbp)
mov    -0x28(%rbp),%rax
mov    %rax,-0x30(%rbp)
mov    -0x30(%rbp),%rdi
mov    $0x26,%esi
call   1070 <strchr@plt>
cmp    $0x0,%rax
je     1230 <oat_create_query_array+0xb0>
mov    -0x30(%rbp),%rdi
mov    $0x26,%esi
call   1070 <strchr@plt>
add    $0x1,%rax
mov    %rax,-0x30(%rbp)
mov    -0x1c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c(%rbp)
jmp    11f4 <oat_create_query_array+0x74>
movslq -0x1c(%rbp),%rax
shl    $0x3,%rax
mov    %eax,%edi
call   1090 <malloc@plt>
mov    %rax,-0x40(%rbp)
movl   $0x0,-0x44(%rbp)
mov    -0x44(%rbp),%eax
cmp    -0x1c(%rbp),%eax
jge    1340 <oat_create_query_array+0x1c0>
movl   $0x0,-0x48(%rbp)
mov    -0x28(%rbp),%rdi
mov    $0x26,%esi
call   1070 <strchr@plt>
mov    %rax,-0x38(%rbp)
cmpq   $0x0,-0x38(%rbp)
jne    1289 <oat_create_query_array+0x109>
mov    -0x28(%rbp),%rdi
xor    %esi,%esi
call   1070 <strchr@plt>
mov    %rax,-0x38(%rbp)
mov    -0x38(%rbp),%rax
mov    -0x28(%rbp),%rcx
sub    %rcx,%rax
mov    %eax,-0x48(%rbp)
mov    -0x48(%rbp),%edi
add    $0x1,%edi
call   1090 <malloc@plt>
mov    %rax,-0x50(%rbp)
mov    -0x50(%rbp),%rdi
mov    -0x28(%rbp),%rsi
mov    -0x48(%rbp),%edx
call   1040 <strncpy@plt>
mov    -0x50(%rbp),%rax
movslq -0x48(%rbp),%rcx
movb   $0x0,(%rax,%rcx,1)
mov    -0x50(%rbp),%rdi
call   1080 <oat_url_escape@plt>
mov    %rax,%rdx
mov    -0x40(%rbp),%rax
movslq -0x44(%rbp),%rcx
mov    %rdx,(%rax,%rcx,8)
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
mov    -0x40(%rbp),%rax
movslq -0x44(%rbp),%rcx
mov    (%rax,%rcx,8),%rdi
lea    0xd0a(%rip),%rsi
call   10a0 <strstr@plt>
mov    %rax,-0x30(%rbp)
cmpq   $0x0,-0x30(%rbp)
je     1326 <oat_create_query_array+0x1a6>
mov    -0x30(%rbp),%rax
movb   $0x3d,(%rax)
mov    -0x30(%rbp),%rdi
add    $0x1,%rdi
mov    -0x30(%rbp),%rsi
add    $0x3,%rsi
call   1050 <strcpy@plt>
mov    -0x38(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x28(%rbp)
mov    -0x44(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x44(%rbp)
jmp    124a <oat_create_query_array+0xca>
mov    -0x1c(%rbp),%ecx
mov    -0x18(%rbp),%rax
mov    %ecx,(%rax)
mov    -0x40(%rbp),%rax
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0x50,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<oat_create_query_array>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %rsi,%rbx
mov    $0x3f,%esi
call   1070 <strchr@plt>
mov    %rax,%r13
add    $0x1,%r13
mov    %r13,%rdi
call   1060 <strlen@plt>
test   %rax,%rax
je     12c1 <oat_create_query_array+0x141>
mov    %r13,%rdi
mov    $0x26,%esi
call   1070 <strchr@plt>
test   %rax,%rax
mov    %rbx,0x8(%rsp)
mov    $0x1,%ebx
je     11e9 <oat_create_query_array+0x69>
nop
add    $0x1,%rax
add    $0x1,%ebx
mov    %rax,%rdi
mov    $0x26,%esi
call   1070 <strchr@plt>
test   %rax,%rax
jne    11d0 <oat_create_query_array+0x50>
lea    0x0(,%rbx,8),%edi
call   1090 <malloc@plt>
mov    %rax,%r12
mov    %rbx,(%rsp)
mov    %ebx,%eax
mov    %rax,0x10(%rsp)
xor    %r15d,%r15d
jmp    1226 <oat_create_query_array+0xa6>
nopl   0x0(%rax,%rax,1)
add    $0x1,%rbx
add    $0x1,%r15
mov    %rbx,%r13
cmp    %r15,0x10(%rsp)
je     12b4 <oat_create_query_array+0x134>
mov    %r13,%rdi
mov    $0x26,%esi
call   1070 <strchr@plt>
mov    %rax,%rbx
test   %rax,%rax
jne    1249 <oat_create_query_array+0xc9>
mov    %r13,%rdi
call   1060 <strlen@plt>
mov    %rax,%rbx
add    %r13,%rbx
mov    %rbx,%rbp
sub    %r13,%rbp
lea    0x1(%rbp),%edi
call   1090 <malloc@plt>
mov    %rax,%r14
mov    %rax,%rdi
mov    %r13,%rsi
mov    %ebp,%edx
call   1040 <strncpy@plt>
movslq %ebp,%rax
movb   $0x0,(%r14,%rax,1)
mov    %r14,%rdi
call   1080 <oat_url_escape@plt>
mov    %rax,(%r12,%r15,8)
mov    %r14,%rdi
call   1030 <free@plt>
mov    (%r12,%r15,8),%rdi
lea    0xd72(%rip),%rsi
call   10a0 <strstr@plt>
test   %rax,%rax
je     1210 <oat_create_query_array+0x90>
movb   $0x3d,(%rax)
lea    0x1(%rax),%rdi
add    $0x3,%rax
mov    %rax,%rsi
call   1050 <strcpy@plt>
jmp    1210 <oat_create_query_array+0x90>
mov    0x8(%rsp),%rax
mov    (%rsp),%rcx
mov    %ecx,(%rax)
jmp    12c4 <oat_create_query_array+0x144>
xor    %r12d,%r12d
mov    %r12,%rax
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [4 x i8] c"%3D\00"
define i8** @oat_create_query_array(i8* %0, i32* %1) {
%3 = alloca i8**
%4 = alloca i8*
%5 = alloca i32*
%6 = alloca i32
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i8*
%10 = alloca i8**
%11 = alloca i32
%12 = alloca i32
%13 = alloca i8*
store i8* %0, i8** %4
store i32* %1, i32** %5
store i32 0, i32* %6
%14 = load i8*, i8** %4
%15 = call i8* @strchr(i8* %14, i8 signext 63)
%16 = getelementptr inbounds i8, i8* %15, i64 1
store i8* %16, i8** %7
%17 = load i8*, i8** %7
%18 = icmp eq i8* %17, null
br i1 %18, label %19, label %20
19: ; preds = %2
store i8** null, i8*** %3
br label %108
20: ; preds = %2
%21 = load i8*, i8** %7
%22 = call i64 @strlen(i8* %21)
%23 = icmp eq i64 %22, 0
br i1 %23, label %24, label %25
24: ; preds = %20
store i8** null, i8*** %3
br label %108
25: ; preds = %20
store i32 1, i32* %6
%26 = load i8*, i8** %7
store i8* %26, i8** %8
br label %27
27: ; preds = %31, %25
%28 = load i8*, i8** %8
%29 = call i8* @strchr(i8* %28, i8 signext 38)
%30 = icmp ne i8* %29, null
br i1 %30, label %31, label %37
31: ; preds = %27
%32 = load i8*, i8** %8
%33 = call i8* @strchr(i8* %32, i8 signext 38)
%34 = getelementptr inbounds i8, i8* %33, i64 1
store i8* %34, i8** %8
%35 = load i32, i32* %6
%36 = add nsw i32 %35, 1
store i32 %36, i32* %6
br label %27
37: ; preds = %27
%38 = load i32, i32* %6
%39 = sext i32 %38 to i64
%40 = mul i64 8, %39
%41 = trunc i64 %40 to i32
%42 = call i64 @malloc(i32 %41)
%43 = inttoptr i64 %42 to i8**
store i8** %43, i8*** %10
store i32 0, i32* %11
br label %44
44: ; preds = %101, %37
%45 = load i32, i32* %11
%46 = load i32, i32* %6
%47 = icmp slt i32 %45, %46
br i1 %47, label %48, label %104
48: ; preds = %44
store i32 0, i32* %12
%49 = load i8*, i8** %7
%50 = call i8* @strchr(i8* %49, i8 signext 38)
store i8* %50, i8** %9
%51 = load i8*, i8** %9
%52 = icmp eq i8* %51, null
br i1 %52, label %53, label %56
53: ; preds = %48
%54 = load i8*, i8** %7
%55 = call i8* @strchr(i8* %54, i8 signext 0)
store i8* %55, i8** %9
br label %56
56: ; preds = %53, %48
%57 = load i8*, i8** %9
%58 = load i8*, i8** %7
%59 = ptrtoint i8* %57 to i64
%60 = ptrtoint i8* %58 to i64
%61 = sub i64 %59, %60
%62 = trunc i64 %61 to i32
store i32 %62, i32* %12
%63 = load i32, i32* %12
%64 = add nsw i32 %63, 1
%65 = call i64 @malloc(i32 %64)
%66 = inttoptr i64 %65 to i8*
store i8* %66, i8** %13
%67 = load i8*, i8** %13
%68 = load i8*, i8** %7
%69 = load i32, i32* %12
%70 = call i32 @strncpy(i8* %67, i8* %68, i32 %69)
%71 = load i8*, i8** %13
%72 = load i32, i32* %12
%73 = sext i32 %72 to i64
%74 = getelementptr inbounds i8, i8* %71, i64 %73
store i8 0, i8* %74
%75 = load i8*, i8** %13
%76 = call i8* @oat_url_escape(i8* %75)
%77 = load i8**, i8*** %10
%78 = load i32, i32* %11
%79 = sext i32 %78 to i64
%80 = getelementptr inbounds i8*, i8** %77, i64 %79
store i8* %76, i8** %80
%81 = load i8*, i8** %13
%82 = call i32 @free(i8* %81)
%83 = load i8**, i8*** %10
%84 = load i32, i32* %11
%85 = sext i32 %84 to i64
%86 = getelementptr inbounds i8*, i8** %83, i64 %85
%87 = load i8*, i8** %86
%88 = call i8* @strstr(i8* %87, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0))
store i8* %88, i8** %8
%89 = load i8*, i8** %8
%90 = icmp ne i8* %89, null
br i1 %90, label %91, label %98
91: ; preds = %56
%92 = load i8*, i8** %8
store i8 61, i8* %92
%93 = load i8*, i8** %8
%94 = getelementptr inbounds i8, i8* %93, i64 1
%95 = load i8*, i8** %8
%96 = getelementptr inbounds i8, i8* %95, i64 3
%97 = call i32 @strcpy(i8* %94, i8* %96)
br label %98
98: ; preds = %91, %56
%99 = load i8*, i8** %9
%100 = getelementptr inbounds i8, i8* %99, i64 1
store i8* %100, i8** %7
br label %101
101: ; preds = %98
%102 = load i32, i32* %11
%103 = add nsw i32 %102, 1
store i32 %103, i32* %11
br label %44
104: ; preds = %44
%105 = load i32, i32* %6
%106 = load i32*, i32** %5
store i32 %105, i32* %106
%107 = load i8**, i8*** %10
store i8** %107, i8*** %3
br label %108
108: ; preds = %104, %24, %19
%109 = load i8**, i8*** %3
ret i8** %109
}

LLVM IR (-O2):
@.str = [4 x i8] c"%3D\00"
define i8** @oat_create_query_array(i8* %0, i32* nocapture writeonly %1) {
%3 = tail call i8* @strchr(i8* dereferenceable(1) %0, i8 signext 63)
%4 = getelementptr inbounds i8, i8* %3, i64 1
%5 = tail call i64 @strlen(i8* %4)
%6 = icmp eq i64 %5, 0
br i1 %6, label %59, label %7
7: ; preds = %2
%8 = tail call i8* @strchr(i8* %4, i8 signext 38)
%9 = icmp eq i8* %8, null
br i1 %9, label %17, label %10
10: ; preds = %7, %10
%11 = phi i8* [ %15, %10 ], [ %8, %7 ]
%12 = phi i32 [ %14, %10 ], [ 1, %7 ]
%13 = getelementptr inbounds i8, i8* %11, i64 1
%14 = add nuw nsw i32 %12, 1
%15 = tail call i8* @strchr(i8* %13, i8 signext 38)
%16 = icmp eq i8* %15, null
br i1 %16, label %17, label %10
17: ; preds = %10, %7
%18 = phi i32 [ 1, %7 ], [ %14, %10 ]
%19 = shl i32 %18, 3
%20 = tail call i64 @malloc(i32 %19)
%21 = inttoptr i64 %20 to i8**
%22 = zext i32 %18 to i64
br label %24
23: ; preds = %55
store i32 %18, i32* %1
br label %59
24: ; preds = %17, %55
%25 = phi i64 [ 0, %17 ], [ %57, %55 ]
%26 = phi i8* [ %4, %17 ], [ %56, %55 ]
%27 = tail call i8* @strchr(i8* %26, i8 signext 38)
%28 = icmp eq i8* %27, null
br i1 %28, label %29, label %32
29: ; preds = %24
%30 = tail call i64 @strlen(i8* %26)
%31 = getelementptr i8, i8* %26, i64 %30
br label %32
32: ; preds = %29, %24
%33 = phi i8* [ %31, %29 ], [ %27, %24 ]
%34 = ptrtoint i8* %33 to i64
%35 = ptrtoint i8* %26 to i64
%36 = sub i64 %34, %35
%37 = trunc i64 %36 to i32
%38 = add nsw i32 %37, 1
%39 = tail call i64 @malloc(i32 %38)
%40 = inttoptr i64 %39 to i8*
%41 = tail call i32 @strncpy(i8* %40, i8* %26, i32 %37)
%42 = shl i64 %36, 32
%43 = ashr exact i64 %42, 32
%44 = getelementptr inbounds i8, i8* %40, i64 %43
store i8 0, i8* %44
%45 = tail call i8* @oat_url_escape(i8* %40)
%46 = getelementptr inbounds i8*, i8** %21, i64 %25
store i8* %45, i8** %46
%47 = tail call i32 @free(i8* %40)
%48 = load i8*, i8** %46
%49 = tail call i8* @strstr(i8* dereferenceable(1) %48, i8* dereferenceable(1) getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0))
%50 = icmp eq i8* %49, null
br i1 %50, label %55, label %51
51: ; preds = %32
store i8 61, i8* %49
%52 = getelementptr inbounds i8, i8* %49, i64 1
%53 = getelementptr inbounds i8, i8* %49, i64 3
%54 = tail call i32 @strcpy(i8* %52, i8* %53)
br label %55
55: ; preds = %51, %32
%56 = getelementptr inbounds i8, i8* %33, i64 1
%57 = add nuw nsw i64 %25, 1
%58 = icmp eq i64 %57, %22
br i1 %58, label %23, label %24
59: ; preds = %2, %23
%60 = phi i8** [ %21, %23 ], [ null, %2 ]
ret i8** %60
}