#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int EXIT_SUCCESS;
int /*<<< orphan*/ FAIL(char *);
int /*<<< orphan*/ PASS(char *);
int /*<<< orphan*/ RTLD_LAZY;
int /*<<< orphan*/ dlclose(void *);
void *dlopen(char *, int /*<<< orphan*/);
int getpid();
int /*<<< orphan*/ sprintf(char *, char *, int);
int system(char *);
int main() {
  for (int i = 0; i < 100; ++i) {
    void *handle = dlopen("libfoo.dylib", RTLD_LAZY);
    if (handle != NULL)
      dlclose(handle);
  }
  char cmd[512];
  sprintf(cmd, "sudo leaks %u > /dev/null\n", getpid());
  int result = system(cmd);
  if (result == EXIT_SUCCESS)
    PASS("dlopen-search-leak");
  else
    FAIL("dlopen-search-leak");
  return EXIT_SUCCESS;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x220,%rsp
movl   $0x0,-0x4(%rbp)
movl   $0x0,-0x8(%rbp)
cmpl   $0x64,-0x8(%rbp)
jge    11d3 <main+0x63>
mov    0x2e3e(%rip),%rax
mov    (%rax),%esi
lea    0xe5d(%rip),%rdi
call   1050 <dlopen@plt>
mov    %rax,-0x10(%rbp)
cmpq   $0x0,-0x10(%rbp)
je     11c0 <main+0x50>
mov    -0x10(%rbp),%rdi
call   1080 <dlclose@plt>
jmp    11c5 <main+0x55>
mov    -0x8(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x8(%rbp)
jmp    1189 <main+0x19>
lea    -0x210(%rbp),%rax
mov    %rax,-0x220(%rbp)
mov    $0x0,%al
call   1030 <getpid@plt>
mov    -0x220(%rbp),%rdi
mov    %eax,%edx
lea    0xe15(%rip),%rsi
call   1070 <sprintf@plt>
lea    -0x210(%rbp),%rdi
call   1040 <system@plt>
mov    %eax,-0x214(%rbp)
mov    -0x214(%rbp),%eax
mov    0x2dc4(%rip),%rcx
cmp    (%rcx),%eax
jne    1235 <main+0xc5>
lea    0xdfd(%rip),%rdi
call   1060 <PASS@plt>
jmp    1241 <main+0xd1>
lea    0xdec(%rip),%rdi
call   1090 <FAIL@plt>
mov    0x2d98(%rip),%rax
mov    (%rax),%eax
add    $0x220,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r14
push   %rbx
sub    $0x200,%rsp
mov    $0x64,%ebp
mov    0x2e51(%rip),%r14
lea    0xe72(%rip),%rbx
jmp    1195 <main+0x25>
add    $0xffffffff,%ebp
je     11af <main+0x3f>
mov    (%r14),%esi
mov    %rbx,%rdi
call   1050 <dlopen@plt>
test   %rax,%rax
je     1190 <main+0x20>
mov    %rax,%rdi
call   1080 <dlclose@plt>
jmp    1190 <main+0x20>
xor    %eax,%eax
call   1030 <getpid@plt>
lea    0xe50(%rip),%rsi
mov    %rsp,%rbx
mov    %rbx,%rdi
mov    %eax,%edx
call   1070 <sprintf@plt>
mov    %rbx,%rdi
call   1040 <system@plt>
mov    0x2e07(%rip),%rbx
cmp    (%rbx),%eax
jne    11eb <main+0x7b>
lea    0xe44(%rip),%rdi
call   1060 <PASS@plt>
jmp    11f7 <main+0x87>
lea    0xe36(%rip),%rdi
call   1090 <FAIL@plt>
mov    (%rbx),%eax
add    $0x200,%rsp
pop    %rbx
pop    %r14
pop    %rbp
ret

LLVM IR (-O0):
@.str = [13 x i8] c"libfoo.dylib\00"
@RTLD_LAZY = global i32 0
@.str.1 = [27 x i8] c"sudo leaks %u > /dev/null\0A\00"
@EXIT_SUCCESS = global i32 0
@.str.2 = [19 x i8] c"dlopen-search-leak\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i32
%3 = alloca i8*
%4 = alloca [512 x i8]
%5 = alloca i32
store i32 0, i32* %1
store i32 0, i32* %2
br label %6
6: ; preds = %18, %0
%7 = load i32, i32* %2
%8 = icmp slt i32 %7, 100
br i1 %8, label %9, label %21
9: ; preds = %6
%10 = load i32, i32* @RTLD_LAZY
%11 = call i8* @dlopen(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str, i64 0, i64 0), i32 %10)
store i8* %11, i8** %3
%12 = load i8*, i8** %3
%13 = icmp ne i8* %12, null
br i1 %13, label %14, label %17
14: ; preds = %9
%15 = load i8*, i8** %3
%16 = call i32 @dlclose(i8* %15)
br label %17
17: ; preds = %14, %9
br label %18
18: ; preds = %17
%19 = load i32, i32* %2
%20 = add nsw i32 %19, 1
store i32 %20, i32* %2
br label %6
21: ; preds = %6
%22 = getelementptr inbounds [512 x i8], [512 x i8]* %4, i64 0, i64 0
%23 = call i32 (...) @getpid()
%24 = call i32 @sprintf(i8* %22, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.1, i64 0, i64 0), i32 %23)
%25 = getelementptr inbounds [512 x i8], [512 x i8]* %4, i64 0, i64 0
%26 = call i32 @system(i8* %25)
store i32 %26, i32* %5
%27 = load i32, i32* %5
%28 = load i32, i32* @EXIT_SUCCESS
%29 = icmp eq i32 %27, %28
br i1 %29, label %30, label %32
30: ; preds = %21
%31 = call i32 @PASS(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.2, i64 0, i64 0))
br label %34
32: ; preds = %21
%33 = call i32 @FAIL(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.2, i64 0, i64 0))
br label %34
34: ; preds = %32, %30
%35 = load i32, i32* @EXIT_SUCCESS
ret i32 %35
}

LLVM IR (-O2):
@.str = [13 x i8] c"libfoo.dylib\00"
@RTLD_LAZY = global i32 0
@.str.1 = [27 x i8] c"sudo leaks %u > /dev/null\0A\00"
@EXIT_SUCCESS = global i32 0
@.str.2 = [19 x i8] c"dlopen-search-leak\00"
define i32 @main() {
%1 = alloca [512 x i8]
br label %9
2: ; preds = %16
%3 = getelementptr inbounds [512 x i8], [512 x i8]* %1, i64 0, i64 0
%4 = tail call i32 (...) @getpid()
%5 = call i32 @sprintf(i8* %3, i8* dereferenceable(1) getelementptr inbounds ([27 x i8], [27 x i8]* @.str.1, i64 0, i64 0), i32 %4)
%6 = call i32 @system(i8* %3)
%7 = load i32, i32* @EXIT_SUCCESS
%8 = icmp eq i32 %6, %7
br i1 %8, label %19, label %21
9: ; preds = %0, %16
%10 = phi i32 [ 0, %0 ], [ %17, %16 ]
%11 = load i32, i32* @RTLD_LAZY
%12 = tail call i8* @dlopen(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str, i64 0, i64 0), i32 %11)
%13 = icmp eq i8* %12, null
br i1 %13, label %16, label %14
14: ; preds = %9
%15 = tail call i32 @dlclose(i8* %12)
br label %16
16: ; preds = %14, %9
%17 = add nuw nsw i32 %10, 1
%18 = icmp eq i32 %17, 100
br i1 %18, label %2, label %9
19: ; preds = %2
%20 = tail call i32 @PASS(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.2, i64 0, i64 0))
br label %23
21: ; preds = %2
%22 = tail call i32 @FAIL(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.2, i64 0, i64 0))
br label %23
23: ; preds = %21, %19
%24 = load i32, i32* @EXIT_SUCCESS
ret i32 %24
}