#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ clang_analyzer_eval(int);
int strlen(char *);
int /*<<< orphan*/ strncat(char *, char *, int);
void strncat_unknown_src_length(char *src, int offset) {
  char dst[8] = "1234";
  strncat(dst, &src[offset], 3);
  clang_analyzer_eval(strlen(dst) >= 4);
  char dst2[8] = "1234";
  strncat(dst2, &src[offset], 4);
}


x86 assembly (clang, -O0):
<strncat_unknown_src_length>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %rdi,-0x8(%rbp)
mov    %esi,-0xc(%rbp)
mov    0xeba(%rip),%rax
mov    %rax,-0x14(%rbp)
lea    -0x14(%rbp),%rdi
mov    -0x8(%rbp),%rsi
movslq -0xc(%rbp),%rax
add    %rax,%rsi
mov    $0x3,%edx
call   1040 <strncat@plt>
lea    -0x14(%rbp),%rdi
call   1030 <strlen@plt>
cmp    $0x4,%eax
setge  %al
and    $0x1,%al
movzbl %al,%edi
call   1050 <clang_analyzer_eval@plt>
mov    0xe7d(%rip),%rax
mov    %rax,-0x1c(%rbp)
lea    -0x1c(%rbp),%rdi
mov    -0x8(%rbp),%rsi
movslq -0xc(%rbp),%rax
add    %rax,%rsi
mov    $0x4,%edx
call   1040 <strncat@plt>
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<strncat_unknown_src_length>:
push   %r14
push   %rbx
sub    $0x18,%rsp
movq   $0x34333231,0x10(%rsp)
33 34
movslq %esi,%rbx
add    %rdi,%rbx
lea    0x10(%rsp),%r14
mov    %r14,%rdi
mov    %rbx,%rsi
mov    $0x3,%edx
call   1040 <strncat@plt>
mov    %r14,%rdi
call   1030 <strlen@plt>
xor    %edi,%edi
cmp    $0x4,%eax
setge  %dil
call   1050 <clang_analyzer_eval@plt>
movq   $0x34333231,0x8(%rsp)
33 34
lea    0x8(%rsp),%rdi
mov    %rbx,%rsi
mov    $0x4,%edx
call   1040 <strncat@plt>
add    $0x18,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
@__const.strncat_unknown_src_length.dst = [8 x i8] c"1234\00\00\00\00"
@__const.strncat_unknown_src_length.dst2 = [8 x i8] c"1234\00\00\00\00"
define void @strncat_unknown_src_length(i8* %0, i32 %1) {
%3 = alloca i8*
%4 = alloca i32
%5 = alloca [8 x i8]
%6 = alloca [8 x i8]
store i8* %0, i8** %3
store i32 %1, i32* %4
%7 = bitcast [8 x i8]* %5 to i8*
%8 = getelementptr inbounds [8 x i8], [8 x i8]* %5, i64 0, i64 0
%9 = load i8*, i8** %3
%10 = load i32, i32* %4
%11 = sext i32 %10 to i64
%12 = getelementptr inbounds i8, i8* %9, i64 %11
%13 = call i32 @strncat(i8* %8, i8* %12, i32 3)
%14 = getelementptr inbounds [8 x i8], [8 x i8]* %5, i64 0, i64 0
%15 = call i32 @strlen(i8* %14)
%16 = icmp sge i32 %15, 4
%17 = zext i1 %16 to i32
%18 = call i32 @clang_analyzer_eval(i32 %17)
%19 = bitcast [8 x i8]* %6 to i8*
%20 = getelementptr inbounds [8 x i8], [8 x i8]* %6, i64 0, i64 0
%21 = load i8*, i8** %3
%22 = load i32, i32* %4
%23 = sext i32 %22 to i64
%24 = getelementptr inbounds i8, i8* %21, i64 %23
%25 = call i32 @strncat(i8* %20, i8* %24, i32 4)
ret void
}

LLVM IR (-O2):
define void @strncat_unknown_src_length(i8* %0, i32 %1) {
%3 = alloca i64
%4 = alloca i64
%5 = bitcast i64* %3 to i8*
store i64 875770417, i64* %3
%6 = sext i32 %1 to i64
%7 = getelementptr inbounds i8, i8* %0, i64 %6
%8 = call i32 @strncat(i8* %5, i8* %7, i32 3)
%9 = call i32 @strlen(i8* %5)
%10 = icmp sgt i32 %9, 3
%11 = zext i1 %10 to i32
%12 = call i32 @clang_analyzer_eval(i32 %11)
%13 = bitcast i64* %4 to i8*
store i64 875770417, i64* %4
%14 = call i32 @strncat(i8* %13, i8* %7, i32 4)
ret void
}