#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct in_addr {
  int dummy;
};
struct sockaddr_in {
  int /*<<< orphan*/ sin_zero;
  struct in_addr sin_addr;
  int /*<<< orphan*/ sin_port;
  int /*<<< orphan*/ sin_family;
};
struct sockaddr {
  int dummy;
};
struct hostent {
  scalar_t__ h_addr;
};

/* Variables and functions */
int /*<<< orphan*/ AF_INET;
int /*<<< orphan*/ SOCK_STREAM;
int atoi(char *);
int /*<<< orphan*/ bzero(int /*<<< orphan*/ *, int);
int connect(int, struct sockaddr *, int);
int /*<<< orphan*/ exit(int);
struct hostent *gethostbyname(char *);
int /*<<< orphan*/ htons(int);
int /*<<< orphan*/ printf(char *);
int /*<<< orphan*/ read_vuln(int, char *);
int socket(int /*<<< orphan*/, int /*<<< orphan*/, int /*<<< orphan*/);
int main(int argc, char *argv[]) {
  int sock, bytes_recieved, port;
  char send_data[1024], recv_data[1024], buf[10];
  struct hostent *host;
  struct sockaddr_in server_addr;
  host = gethostbyname("127.0.0.1");
  if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
    printf("ERROR: socket().\n");
    exit(1);
  }
  port = atoi(argv[1]);
  server_addr.sin_family = AF_INET;
  server_addr.sin_port = htons(port);
  server_addr.sin_addr = *((struct in_addr *)host->h_addr);
  bzero(&(server_addr.sin_zero), 8);
  if (connect(sock, (struct sockaddr *)&server_addr, sizeof(struct sockaddr)) ==
      -1) {
    printf("ERROR: connect().\n");
    exit(1);
  }
  for (;;) {
    read_vuln(sock, buf);
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x850,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
lea    0xe50(%rip),%rdi
call   1060 <gethostbyname@plt>
mov    %rax,-0x838(%rbp)
mov    0x2e25(%rip),%rax
mov    (%rax),%edi
mov    0x2e0c(%rip),%rax
mov    (%rax),%esi
xor    %edx,%edx
call   10b0 <socket@plt>
mov    %eax,-0x14(%rbp)
cmp    $0xffffffff,%eax
jne    11f7 <main+0x67>
lea    0xe22(%rip),%rdi
call   1050 <printf@plt>
mov    $0x1,%edi
call   1090 <exit@plt>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   1080 <atoi@plt>
mov    %eax,-0x1c(%rbp)
mov    0x2dda(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x83c(%rbp)
mov    -0x1c(%rbp),%edi
call   1040 <htons@plt>
mov    %eax,-0x840(%rbp)
mov    -0x838(%rbp),%rax
mov    (%rax),%rax
mov    (%rax),%eax
mov    %eax,-0x844(%rbp)
lea    -0x848(%rbp),%rdi
mov    $0x8,%esi
call   1070 <bzero@plt>
mov    -0x14(%rbp),%edi
lea    -0x848(%rbp),%rsi
mov    $0x4,%edx
call   10a0 <connect@plt>
cmp    $0xffffffff,%eax
jne    127a <main+0xea>
lea    0xdb1(%rip),%rdi
call   1050 <printf@plt>
mov    $0x1,%edi
call   1090 <exit@plt>
jmp    127f <main+0xef>
mov    -0x14(%rbp),%edi
lea    -0x82a(%rbp),%rsi
call   1030 <read_vuln@plt>
jmp    127f <main+0xef>

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %rbx
sub    $0x28,%rsp
mov    %rsi,%r15
lea    0xe5c(%rip),%rdi
call   1060 <gethostbyname@plt>
mov    %rax,%r14
mov    0x2e35(%rip),%rbx
mov    (%rbx),%edi
mov    0x2e1c(%rip),%rax
mov    (%rax),%esi
xor    %edx,%edx
call   10b0 <socket@plt>
cmp    $0xffffffff,%eax
je     122c <main+0x9c>
mov    %eax,%ebp
mov    0x8(%r15),%rdi
call   1080 <atoi@plt>
mov    (%rbx),%ecx
mov    %ecx,0x14(%rsp)
mov    %eax,%edi
call   1050 <htons@plt>
mov    %eax,0x10(%rsp)
mov    (%r14),%rax
mov    (%rax),%eax
mov    %eax,0xc(%rsp)
lea    0x8(%rsp),%rbx
mov    %rbx,%rdi
mov    $0x8,%esi
call   1070 <bzero@plt>
mov    %ebp,%edi
mov    %rbx,%rsi
mov    $0x4,%edx
call   10a0 <connect@plt>
cmp    $0xffffffff,%eax
je     1235 <main+0xa5>
lea    0x1e(%rsp),%rbx
nopw   0x0(%rax,%rax,1)
mov    %ebp,%edi
mov    %rbx,%rsi
call   1040 <read_vuln@plt>
jmp    1220 <main+0x90>
lea    0xde9(%rip),%rdi
jmp    123c <main+0xac>
lea    0xdce(%rip),%rdi
call   1030 <puts@plt>
mov    $0x1,%edi
call   1090 <exit@plt>

LLVM IR (-O0):
%struct.hostent = type { i64 }
%struct.sockaddr_in = type { i32, %struct.in_addr, i32, i32 }
%struct.in_addr = type { i32 }
%struct.sockaddr = type { i32 }
@.str = [10 x i8] c"127.0.0.1\00"
@AF_INET = global i32 0
@SOCK_STREAM = global i32 0
@.str.1 = [18 x i8] c"ERROR: socket().\0A\00"
@.str.2 = [19 x i8] c"ERROR: connect().\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = alloca [1024 x i8]
%10 = alloca [1024 x i8]
%11 = alloca [10 x i8]
%12 = alloca %struct.hostent*
%13 = alloca %struct.sockaddr_in
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%14 = call %struct.hostent* @gethostbyname(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0))
store %struct.hostent* %14, %struct.hostent** %12
%15 = load i32, i32* @AF_INET
%16 = load i32, i32* @SOCK_STREAM
%17 = call i32 @socket(i32 %15, i32 %16, i32 0)
store i32 %17, i32* %6
%18 = icmp eq i32 %17, -1
br i1 %18, label %19, label %22
19: ; preds = %2
%20 = call i32 @printf(i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.1, i64 0, i64 0))
%21 = call i32 @exit(i32 1)
unreachable
22: ; preds = %2
%23 = load i8**, i8*** %5
%24 = getelementptr inbounds i8*, i8** %23, i64 1
%25 = load i8*, i8** %24
%26 = call i32 @atoi(i8* %25)
store i32 %26, i32* %8
%27 = load i32, i32* @AF_INET
%28 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %13, i32 0, i32 3
store i32 %27, i32* %28
%29 = load i32, i32* %8
%30 = call i32 @htons(i32 %29)
%31 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %13, i32 0, i32 2
store i32 %30, i32* %31
%32 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %13, i32 0, i32 1
%33 = load %struct.hostent*, %struct.hostent** %12
%34 = getelementptr inbounds %struct.hostent, %struct.hostent* %33, i32 0, i32 0
%35 = load i64, i64* %34
%36 = inttoptr i64 %35 to %struct.in_addr*
%37 = bitcast %struct.in_addr* %32 to i8*
%38 = bitcast %struct.in_addr* %36 to i8*
%39 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %13, i32 0, i32 0
%40 = call i32 @bzero(i32* %39, i32 8)
%41 = load i32, i32* %6
%42 = bitcast %struct.sockaddr_in* %13 to %struct.sockaddr*
%43 = call i32 @connect(i32 %41, %struct.sockaddr* %42, i32 4)
%44 = icmp eq i32 %43, -1
br i1 %44, label %45, label %48
45: ; preds = %22
%46 = call i32 @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.2, i64 0, i64 0))
%47 = call i32 @exit(i32 1)
unreachable
48: ; preds = %22
br label %49
49: ; preds = %49, %48
%50 = load i32, i32* %6
%51 = getelementptr inbounds [10 x i8], [10 x i8]* %11, i64 0, i64 0
%52 = call i32 @read_vuln(i32 %50, i8* %51)
br label %49
}

LLVM IR (-O2):
%struct.sockaddr_in = type { i32, %struct.in_addr, i32, i32 }
%struct.in_addr = type { i32 }
%struct.hostent = type { i64 }
%struct.sockaddr = type { i32 }
@.str = [10 x i8] c"127.0.0.1\00"
@AF_INET = global i32 0
@SOCK_STREAM = global i32 0
@str = [18 x i8] c"ERROR: connect().\00"
@str.3 = [17 x i8] c"ERROR: socket().\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca [10 x i8]
%4 = alloca %struct.sockaddr_in
%5 = getelementptr inbounds [10 x i8], [10 x i8]* %3, i64 0, i64 0
%6 = bitcast %struct.sockaddr_in* %4 to i8*
%7 = tail call %struct.hostent* @gethostbyname(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0))
%8 = load i32, i32* @AF_INET
%9 = load i32, i32* @SOCK_STREAM
%10 = tail call i32 @socket(i32 %8, i32 %9, i32 0)
%11 = icmp eq i32 %10, -1
br i1 %11, label %12, label %15
12: ; preds = %2
%13 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([17 x i8], [17 x i8]* @str.3, i64 0, i64 0))
%14 = tail call i32 @exit(i32 1)
unreachable
15: ; preds = %2
%16 = getelementptr inbounds i8*, i8** %1, i64 1
%17 = load i8*, i8** %16
%18 = tail call i32 @atoi(i8* %17)
%19 = load i32, i32* @AF_INET
%20 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %4, i64 0, i32 3
store i32 %19, i32* %20
%21 = tail call i32 @htons(i32 %18)
%22 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %4, i64 0, i32 2
store i32 %21, i32* %22
%23 = getelementptr inbounds %struct.hostent, %struct.hostent* %7, i64 0, i32 0
%24 = load i64, i64* %23
%25 = inttoptr i64 %24 to i32*
%26 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %4, i64 0, i32 1, i32 0
%27 = load i32, i32* %25
store i32 %27, i32* %26
%28 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %4, i64 0, i32 0
%29 = call i32 @bzero(i32* %28, i32 8)
%30 = bitcast %struct.sockaddr_in* %4 to %struct.sockaddr*
%31 = call i32 @connect(i32 %10, %struct.sockaddr* %30, i32 4)
%32 = icmp eq i32 %31, -1
br i1 %32, label %33, label %36
33: ; preds = %15
%34 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([18 x i8], [18 x i8]* @str, i64 0, i64 0))
%35 = call i32 @exit(i32 1)
unreachable
36: ; preds = %15, %36
%37 = call i32 @read_vuln(i32 %10, i8* %5)
br label %36
}