void test_sprintf_chk_range_schar(void) {
  do {
    if (!0 || 189 == 0) {
      char *d;
      (d) = __builtin_malloc(0);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%hhi",
                              range_sint(0, 1));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 192 == 0) {
      char *d;
      (d) = __builtin_malloc(0);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%hhi",
                              range_sint(0, 127));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 195 == 0) {
      char *d;
      (d) = __builtin_malloc(0);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%hhi",
                              range_sint(1024, 1033));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 198 == 0) {
      char *d;
      (d) = __builtin_malloc(0);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%hhi",
                              range_sint(1024, 1034));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 201 == 0) {
      char *d;
      (d) = __builtin_malloc(0);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%hhi",
                              range_sint(1024, 2035));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 204 == 0) {
      char *d;
      (d) = __builtin_malloc(2);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%#hhx",
                              range_sint(1234, 12345));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 205 == 0) {
      char *d;
      (d) = __builtin_malloc(3);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%#hhx",
                              range_sint(1234, 12345));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 206 == 0) {
      char *d;
      (d) = __builtin_malloc(4);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%#hhx",
                              range_sint(1234, 12345));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 211 == 0) {
      char *d;
      (d) = __builtin_malloc(0);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i",
                              range_schar(0, 9));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 212 == 0) {
      char *d;
      (d) = __builtin_malloc(1);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i",
                              range_schar(0, 9));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 213 == 0) {
      char *d;
      (d) = __builtin_malloc(2);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i",
                              range_schar(0, 9));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 214 == 0) {
      char *d;
      (d) = __builtin_malloc(2);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i",
                              range_schar(-1, 0));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 215 == 0) {
      char *d;
      (d) = __builtin_malloc(2);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i",
                              range_schar(9, 10));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 217 == 0) {
      char *d;
      (d) = __builtin_malloc(3);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i",
                              range_schar(-9, 9));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 218 == 0) {
      char *d;
      (d) = __builtin_malloc(3);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i",
                              range_schar(-99, 99));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 219 == 0) {
      char *d;
      (d) = __builtin_malloc(3);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i",
                              range_schar(0, 99));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 220 == 0) {
      char *d;
      (d) = __builtin_malloc(3);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i",
                              range_schar(0, 100));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 225 == 0) {
      char *d;
      (d) = __builtin_malloc(3);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i%i",
                              range_schar(1, 10), range_schar(9, 10));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 227 == 0) {
      char *d;
      (d) = __builtin_malloc(4);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i%i",
                              range_schar(10, 11), range_schar(12, 13));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 229 == 0) {
      char *d;
      (d) = __builtin_malloc(5);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i%i",
                              range_schar(-9, 99), range_schar(-9, 99));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 231 == 0) {
      char *d;
      (d) = __builtin_malloc(6);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i_%i_%i",
                              range_schar(0, 9), range_schar(0, 9),
                              range_schar(0, 9));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 232 == 0) {
      char *d;
      (d) = __builtin_malloc(6);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i_%i_%i",
                              range_schar(0, 9), range_schar(0, 9),
                              range_schar(0, 10));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 233 == 0) {
      char *d;
      (d) = __builtin_malloc(6);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i_%i_%i",
                              range_schar(0, 9), range_schar(0, 10),
                              range_schar(0, 9));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 234 == 0) {
      char *d;
      (d) = __builtin_malloc(6);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i_%i_%i",
                              range_schar(0, 10), range_schar(0, 9),
                              range_schar(0, 9));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 235 == 0) {
      char *d;
      (d) = __builtin_malloc(6);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%hhi_%hi_%i",
                              range_schar(0, 9), range_schar(0, 10),
                              range_schar(0, 10));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 236 == 0) {
      char *d;
      (d) = __builtin_malloc(6);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%3i|%2i/%1i",
                              range_schar(0, 99), range_schar(0, 99),
                              range_schar(0, 99));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 237 == 0) {
      char *d;
      (d) = __builtin_malloc(6);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%.3i|%.2i/%i",
                              range_schar(0, 99), range_schar(0, 99),
                              range_schar(0, 99));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 238 == 0) {
      char *d;
      (d) = __builtin_malloc(6);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%.3i|%.2i/%i",
                              range_schar(0, 119), range_schar(0, 99),
                              range_schar(0, 99));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 239 == 0) {
      char *d;
      (d) = __builtin_malloc(6);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%.3i|%.2i/%i",
                              range_schar(0, 1), range_schar(0, 2),
                              range_schar(0, 3));
      sink(d);
    }
  } while (0);
}


x86 assembly (clang, -O0):
<test_sprintf_chk_range_schar>:
push   %rbp
mov    %rsp,%rbp
sub    $0x240,%rsp
xor    %eax,%eax
mov    %eax,%edi
call   1060 <malloc@plt>
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
mov    %rax,-0xf0(%rbp)
xor    %edi,%edi
mov    $0x1,%esi
mov    $0x0,%al
call   1050 <range_sint@plt>
mov    -0xf0(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xe65(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x8(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    11b2 <test_sprintf_chk_range_schar+0x62>
xor    %eax,%eax
mov    %eax,%edi
call   1060 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0xf8(%rbp)
xor    %edi,%edi
mov    $0x7f,%esi
mov    $0x0,%al
call   1050 <range_sint@plt>
mov    -0xf8(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xe0e(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x10(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1209 <test_sprintf_chk_range_schar+0xb9>
xor    %eax,%eax
mov    %eax,%edi
call   1060 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rax
mov    %rax,-0x100(%rbp)
mov    $0x400,%edi
mov    $0x409,%esi
mov    $0x0,%al
call   1050 <range_sint@plt>
mov    -0x100(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xdb4(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x18(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1263 <test_sprintf_chk_range_schar+0x113>
xor    %eax,%eax
mov    %eax,%edi
call   1060 <malloc@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rax
mov    %rax,-0x108(%rbp)
mov    $0x400,%edi
mov    $0x40a,%esi
mov    $0x0,%al
call   1050 <range_sint@plt>
mov    -0x108(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xd5a(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x20(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    12bd <test_sprintf_chk_range_schar+0x16d>
xor    %eax,%eax
mov    %eax,%edi
call   1060 <malloc@plt>
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
mov    %rax,-0x110(%rbp)
mov    $0x400,%edi
mov    $0x7f3,%esi
mov    $0x0,%al
call   1050 <range_sint@plt>
mov    -0x110(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xd00(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x28(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1317 <test_sprintf_chk_range_schar+0x1c7>
mov    $0x2,%edi
call   1060 <malloc@plt>
mov    %rax,-0x30(%rbp)
mov    -0x30(%rbp),%rax
mov    %rax,-0x118(%rbp)
mov    $0x4d2,%edi
mov    $0x3039,%esi
mov    $0x0,%al
call   1050 <range_sint@plt>
mov    -0x118(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xcaa(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x30(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1372 <test_sprintf_chk_range_schar+0x222>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,-0x38(%rbp)
mov    -0x38(%rbp),%rax
mov    %rax,-0x120(%rbp)
mov    $0x4d2,%edi
mov    $0x3039,%esi
mov    $0x0,%al
call   1050 <range_sint@plt>
mov    -0x120(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xc4f(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x38(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    13cd <test_sprintf_chk_range_schar+0x27d>
mov    $0x4,%edi
call   1060 <malloc@plt>
mov    %rax,-0x40(%rbp)
mov    -0x40(%rbp),%rax
mov    %rax,-0x128(%rbp)
mov    $0x4d2,%edi
mov    $0x3039,%esi
mov    $0x0,%al
call   1050 <range_sint@plt>
mov    -0x128(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xbf4(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x40(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1428 <test_sprintf_chk_range_schar+0x2d8>
xor    %eax,%eax
mov    %eax,%edi
call   1060 <malloc@plt>
mov    %rax,-0x48(%rbp)
mov    -0x48(%rbp),%rax
mov    %rax,-0x130(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x130(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xbd3(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x48(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    147f <test_sprintf_chk_range_schar+0x32f>
mov    $0x1,%edi
call   1060 <malloc@plt>
mov    %rax,-0x50(%rbp)
mov    -0x50(%rbp),%rax
mov    %rax,-0x138(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x138(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xb7b(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x50(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    14d7 <test_sprintf_chk_range_schar+0x387>
mov    $0x2,%edi
call   1060 <malloc@plt>
mov    %rax,-0x58(%rbp)
mov    -0x58(%rbp),%rax
mov    %rax,-0x140(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x140(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xb23(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x58(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    152f <test_sprintf_chk_range_schar+0x3df>
mov    $0x2,%edi
call   1060 <malloc@plt>
mov    %rax,-0x60(%rbp)
mov    -0x60(%rbp),%rax
mov    %rax,-0x148(%rbp)
mov    $0xffffffff,%edi
xor    %esi,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x148(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xacb(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x60(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1587 <test_sprintf_chk_range_schar+0x437>
mov    $0x2,%edi
call   1060 <malloc@plt>
mov    %rax,-0x68(%rbp)
mov    -0x68(%rbp),%rax
mov    %rax,-0x150(%rbp)
mov    $0x9,%edi
mov    $0xa,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x150(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xa70(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    15e2 <test_sprintf_chk_range_schar+0x492>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,-0x70(%rbp)
mov    -0x70(%rbp),%rax
mov    %rax,-0x158(%rbp)
mov    $0xfffffff7,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x158(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xa15(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x70(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    163d <test_sprintf_chk_range_schar+0x4ed>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,-0x78(%rbp)
mov    -0x78(%rbp),%rax
mov    %rax,-0x160(%rbp)
mov    $0xffffff9d,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x160(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x9ba(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x78(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1698 <test_sprintf_chk_range_schar+0x548>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,-0x80(%rbp)
mov    -0x80(%rbp),%rax
mov    %rax,-0x168(%rbp)
xor    %edi,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x168(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x962(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x80(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    16f0 <test_sprintf_chk_range_schar+0x5a0>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,-0x88(%rbp)
mov    -0x88(%rbp),%rax
mov    %rax,-0x170(%rbp)
xor    %edi,%edi
mov    $0x64,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x170(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x904(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x88(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1751 <test_sprintf_chk_range_schar+0x601>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,-0x90(%rbp)
mov    -0x90(%rbp),%rax
mov    %rax,-0x180(%rbp)
mov    $0x1,%edi
mov    $0xa,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x174(%rbp)
mov    $0x9,%edi
mov    $0xa,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x180(%rbp),%rdi
mov    -0x174(%rbp),%r8d
mov    %eax,%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x852(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x90(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    17d3 <test_sprintf_chk_range_schar+0x683>
mov    $0x4,%edi
call   1060 <malloc@plt>
mov    %rax,-0x98(%rbp)
mov    -0x98(%rbp),%rax
mov    %rax,-0x190(%rbp)
mov    $0xa,%edi
mov    $0xb,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x184(%rbp)
mov    $0xc,%edi
mov    $0xd,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x190(%rbp),%rdi
mov    -0x184(%rbp),%r8d
mov    %eax,%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x7d0(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x98(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1855 <test_sprintf_chk_range_schar+0x705>
mov    $0x5,%edi
call   1060 <malloc@plt>
mov    %rax,-0xa0(%rbp)
mov    -0xa0(%rbp),%rax
mov    %rax,-0x1a0(%rbp)
mov    $0xfffffff7,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x194(%rbp)
mov    $0xfffffff7,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x1a0(%rbp),%rdi
mov    -0x194(%rbp),%r8d
mov    %eax,%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x74e(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0xa0(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    18d7 <test_sprintf_chk_range_schar+0x787>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,-0xa8(%rbp)
mov    -0xa8(%rbp),%rax
mov    %rax,-0x1b0(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1a8(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1a4(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x1b0(%rbp),%rdi
mov    -0x1a8(%rbp),%r8d
mov    -0x1a4(%rbp),%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x6bf(%rip),%rcx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0xa8(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    196e <test_sprintf_chk_range_schar+0x81e>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,-0xb0(%rbp)
mov    -0xb0(%rbp),%rax
mov    %rax,-0x1c0(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1b8(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1b4(%rbp)
xor    %edi,%edi
mov    $0xa,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x1c0(%rbp),%rdi
mov    -0x1b8(%rbp),%r8d
mov    -0x1b4(%rbp),%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x628(%rip),%rcx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0xb0(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1a05 <test_sprintf_chk_range_schar+0x8b5>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,-0xb8(%rbp)
mov    -0xb8(%rbp),%rax
mov    %rax,-0x1d0(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1c8(%rbp)
xor    %edi,%edi
mov    $0xa,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1c4(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x1d0(%rbp),%rdi
mov    -0x1c8(%rbp),%r8d
mov    -0x1c4(%rbp),%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x591(%rip),%rcx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0xb8(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1a9c <test_sprintf_chk_range_schar+0x94c>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,-0xc0(%rbp)
mov    -0xc0(%rbp),%rax
mov    %rax,-0x1e0(%rbp)
xor    %edi,%edi
mov    $0xa,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1d8(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1d4(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x1e0(%rbp),%rdi
mov    -0x1d8(%rbp),%r8d
mov    -0x1d4(%rbp),%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x4fa(%rip),%rcx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0xc0(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1b33 <test_sprintf_chk_range_schar+0x9e3>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,-0xc8(%rbp)
mov    -0xc8(%rbp),%rax
mov    %rax,-0x1f0(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1e8(%rbp)
xor    %edi,%edi
mov    $0xa,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1e4(%rbp)
xor    %edi,%edi
mov    $0xa,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x1f0(%rbp),%rdi
mov    -0x1e8(%rbp),%r8d
mov    -0x1e4(%rbp),%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x46c(%rip),%rcx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0xc8(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1bca <test_sprintf_chk_range_schar+0xa7a>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,-0xd0(%rbp)
mov    -0xd0(%rbp),%rax
mov    %rax,-0x200(%rbp)
xor    %edi,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1f8(%rbp)
xor    %edi,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1f4(%rbp)
xor    %edi,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x200(%rbp),%rdi
mov    -0x1f8(%rbp),%r8d
mov    -0x1f4(%rbp),%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x3e1(%rip),%rcx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0xd0(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1c61 <test_sprintf_chk_range_schar+0xb11>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,-0xd8(%rbp)
mov    -0xd8(%rbp),%rax
mov    %rax,-0x210(%rbp)
xor    %edi,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x208(%rbp)
xor    %edi,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x204(%rbp)
xor    %edi,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x210(%rbp),%rdi
mov    -0x208(%rbp),%r8d
mov    -0x204(%rbp),%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x356(%rip),%rcx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0xd8(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1cf8 <test_sprintf_chk_range_schar+0xba8>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,-0xe0(%rbp)
mov    -0xe0(%rbp),%rax
mov    %rax,-0x220(%rbp)
xor    %edi,%edi
mov    $0x77,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x218(%rbp)
xor    %edi,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x214(%rbp)
xor    %edi,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x220(%rbp),%rdi
mov    -0x218(%rbp),%r8d
mov    -0x214(%rbp),%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x2bf(%rip),%rcx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0xe0(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1d8f <test_sprintf_chk_range_schar+0xc3f>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,-0xe8(%rbp)
mov    -0xe8(%rbp),%rax
mov    %rax,-0x230(%rbp)
xor    %edi,%edi
mov    $0x1,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x228(%rbp)
xor    %edi,%edi
mov    $0x2,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x224(%rbp)
xor    %edi,%edi
mov    $0x3,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x230(%rbp),%rdi
mov    -0x228(%rbp),%r8d
mov    -0x224(%rbp),%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x228(%rip),%rcx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0xe8(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
add    $0x240,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<test_sprintf_chk_range_schar>:
push   %rbp
push   %r15
push   %r14
push   %rbx
push   %rax
xor    %edi,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x1,%esi
xor    %eax,%eax
call   1050 <range_sint@plt>
lea    0xe8a(%rip),%r14
mov    %rbx,%rdi
xor    %esi,%esi
xor    %edx,%edx
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
xor    %edi,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x7f,%esi
xor    %eax,%eax
call   1050 <range_sint@plt>
mov    %rbx,%rdi
xor    %esi,%esi
xor    %edx,%edx
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
xor    %edi,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0x400,%edi
mov    $0x409,%esi
xor    %eax,%eax
call   1050 <range_sint@plt>
mov    %rbx,%rdi
xor    %esi,%esi
xor    %edx,%edx
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
xor    %edi,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0x400,%edi
mov    $0x40a,%esi
xor    %eax,%eax
call   1050 <range_sint@plt>
mov    %rbx,%rdi
xor    %esi,%esi
xor    %edx,%edx
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
xor    %edi,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0x400,%edi
mov    $0x7f3,%esi
xor    %eax,%eax
call   1050 <range_sint@plt>
mov    %rbx,%rdi
xor    %esi,%esi
xor    %edx,%edx
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x2,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0x4d2,%edi
mov    $0x3039,%esi
xor    %eax,%eax
call   1050 <range_sint@plt>
lea    0xd6b(%rip),%r14
mov    $0x2,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0x4d2,%edi
mov    $0x3039,%esi
xor    %eax,%eax
call   1050 <range_sint@plt>
mov    $0x3,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x4,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0x4d2,%edi
mov    $0x3039,%esi
xor    %eax,%eax
call   1050 <range_sint@plt>
mov    $0x4,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
xor    %edi,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
lea    0xce3(%rip),%r14
mov    %rbx,%rdi
xor    %esi,%esi
xor    %edx,%edx
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x1,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x1,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x2,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x2,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x2,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0xffffffff,%edi
xor    %esi,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x2,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x2,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0x9,%edi
mov    $0xa,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x2,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0xfffffff7,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x3,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0xffffff9d,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x3,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x3,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x64,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x3,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0x1,%edi
mov    $0xa,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
mov    $0x9,%edi
mov    $0xa,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
lea    0xa74(%rip),%r14
mov    $0x3,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %ebp,%r8d
mov    %eax,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x4,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0xa,%edi
mov    $0xb,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
mov    $0xc,%edi
mov    $0xd,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x4,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %ebp,%r8d
mov    %eax,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x5,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0xfffffff7,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
mov    $0xfffffff7,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x5,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %ebp,%r8d
mov    %eax,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%r15d
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,(%rsp)
lea    0x965(%rip),%r14
mov    $0x6,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %r15d,%r8d
mov    %ebp,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%r15d
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
xor    %edi,%edi
mov    $0xa,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,(%rsp)
mov    $0x6,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %r15d,%r8d
mov    %ebp,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%r15d
xor    %edi,%edi
mov    $0xa,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,(%rsp)
mov    $0x6,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %r15d,%r8d
mov    %ebp,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0xa,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%r15d
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,(%rsp)
mov    $0x6,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %r15d,%r8d
mov    %ebp,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%r14d
xor    %edi,%edi
mov    $0xa,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
xor    %edi,%edi
mov    $0xa,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,(%rsp)
lea    0x7db(%rip),%rcx
mov    $0x6,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14d,%r8d
mov    %ebp,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%r14d
xor    %edi,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
xor    %edi,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,(%rsp)
lea    0x780(%rip),%rcx
mov    $0x6,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14d,%r8d
mov    %ebp,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%r15d
xor    %edi,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
xor    %edi,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,(%rsp)
lea    0x725(%rip),%r14
mov    $0x6,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %r15d,%r8d
mov    %ebp,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x77,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%r15d
xor    %edi,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
xor    %edi,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,(%rsp)
mov    $0x6,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %r15d,%r8d
mov    %ebp,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x1,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%r15d
xor    %edi,%edi
mov    $0x2,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
xor    %edi,%edi
mov    $0x3,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,(%rsp)
mov    $0x6,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %r15d,%r8d
mov    %ebp,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
jmp    1040 <sink@plt>

LLVM IR (-O0):
@.str = [5 x i8] c"%hhi\00"
@.str.1 = [6 x i8] c"%#hhx\00"
@.str.2 = [3 x i8] c"%i\00"
@.str.3 = [5 x i8] c"%i%i\00"
@.str.4 = [9 x i8] c"%i_%i_%i\00"
@.str.5 = [12 x i8] c"%hhi_%hi_%i\00"
@.str.6 = [12 x i8] c"%3i|%2i/%1i\00"
@.str.7 = [13 x i8] c"%.3i|%.2i/%i\00"
define void @test_sprintf_chk_range_schar() {
%1 = alloca i8*
%2 = alloca i8*
%3 = alloca i8*
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i8*
%10 = alloca i8*
%11 = alloca i8*
%12 = alloca i8*
%13 = alloca i8*
%14 = alloca i8*
%15 = alloca i8*
%16 = alloca i8*
%17 = alloca i8*
%18 = alloca i8*
%19 = alloca i8*
%20 = alloca i8*
%21 = alloca i8*
%22 = alloca i8*
%23 = alloca i8*
%24 = alloca i8*
%25 = alloca i8*
%26 = alloca i8*
%27 = alloca i8*
%28 = alloca i8*
%29 = alloca i8*
br label %30
30: ; preds = %0
%31 = call i8* @malloc(i64 0)
store i8* %31, i8** %1
%32 = load i8*, i8** %1
%33 = load i8*, i8** %1
%34 = call i64 @llvm.objectsize.i64.p0i8(i8* %33, i1 false, i1 true, i1 false)
%35 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 0, i32 1)
%36 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %32, i32 0, i64 %34, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %35)
%37 = load i8*, i8** %1
%38 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %37)
br label %39
39: ; preds = %30
br label %40
40: ; preds = %39
%41 = call i8* @malloc(i64 0)
store i8* %41, i8** %2
%42 = load i8*, i8** %2
%43 = load i8*, i8** %2
%44 = call i64 @llvm.objectsize.i64.p0i8(i8* %43, i1 false, i1 true, i1 false)
%45 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 0, i32 127)
%46 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %42, i32 0, i64 %44, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %45)
%47 = load i8*, i8** %2
%48 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %47)
br label %49
49: ; preds = %40
br label %50
50: ; preds = %49
%51 = call i8* @malloc(i64 0)
store i8* %51, i8** %3
%52 = load i8*, i8** %3
%53 = load i8*, i8** %3
%54 = call i64 @llvm.objectsize.i64.p0i8(i8* %53, i1 false, i1 true, i1 false)
%55 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 1024, i32 1033)
%56 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %52, i32 0, i64 %54, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %55)
%57 = load i8*, i8** %3
%58 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %57)
br label %59
59: ; preds = %50
br label %60
60: ; preds = %59
%61 = call i8* @malloc(i64 0)
store i8* %61, i8** %4
%62 = load i8*, i8** %4
%63 = load i8*, i8** %4
%64 = call i64 @llvm.objectsize.i64.p0i8(i8* %63, i1 false, i1 true, i1 false)
%65 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 1024, i32 1034)
%66 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %62, i32 0, i64 %64, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %65)
%67 = load i8*, i8** %4
%68 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %67)
br label %69
69: ; preds = %60
br label %70
70: ; preds = %69
%71 = call i8* @malloc(i64 0)
store i8* %71, i8** %5
%72 = load i8*, i8** %5
%73 = load i8*, i8** %5
%74 = call i64 @llvm.objectsize.i64.p0i8(i8* %73, i1 false, i1 true, i1 false)
%75 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 1024, i32 2035)
%76 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %72, i32 0, i64 %74, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %75)
%77 = load i8*, i8** %5
%78 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %77)
br label %79
79: ; preds = %70
br label %80
80: ; preds = %79
%81 = call i8* @malloc(i64 2)
store i8* %81, i8** %6
%82 = load i8*, i8** %6
%83 = load i8*, i8** %6
%84 = call i64 @llvm.objectsize.i64.p0i8(i8* %83, i1 false, i1 true, i1 false)
%85 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 1234, i32 12345)
%86 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %82, i32 0, i64 %84, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0), i32 %85)
%87 = load i8*, i8** %6
%88 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %87)
br label %89
89: ; preds = %80
br label %90
90: ; preds = %89
%91 = call i8* @malloc(i64 3)
store i8* %91, i8** %7
%92 = load i8*, i8** %7
%93 = load i8*, i8** %7
%94 = call i64 @llvm.objectsize.i64.p0i8(i8* %93, i1 false, i1 true, i1 false)
%95 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 1234, i32 12345)
%96 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %92, i32 0, i64 %94, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0), i32 %95)
%97 = load i8*, i8** %7
%98 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %97)
br label %99
99: ; preds = %90
br label %100
100: ; preds = %99
%101 = call i8* @malloc(i64 4)
store i8* %101, i8** %8
%102 = load i8*, i8** %8
%103 = load i8*, i8** %8
%104 = call i64 @llvm.objectsize.i64.p0i8(i8* %103, i1 false, i1 true, i1 false)
%105 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 1234, i32 12345)
%106 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %102, i32 0, i64 %104, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0), i32 %105)
%107 = load i8*, i8** %8
%108 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %107)
br label %109
109: ; preds = %100
br label %110
110: ; preds = %109
%111 = call i8* @malloc(i64 0)
store i8* %111, i8** %9
%112 = load i8*, i8** %9
%113 = load i8*, i8** %9
%114 = call i64 @llvm.objectsize.i64.p0i8(i8* %113, i1 false, i1 true, i1 false)
%115 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%116 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %112, i32 0, i64 %114, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32 %115)
%117 = load i8*, i8** %9
%118 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %117)
br label %119
119: ; preds = %110
br label %120
120: ; preds = %119
%121 = call i8* @malloc(i64 1)
store i8* %121, i8** %10
%122 = load i8*, i8** %10
%123 = load i8*, i8** %10
%124 = call i64 @llvm.objectsize.i64.p0i8(i8* %123, i1 false, i1 true, i1 false)
%125 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%126 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %122, i32 0, i64 %124, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32 %125)
%127 = load i8*, i8** %10
%128 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %127)
br label %129
129: ; preds = %120
br label %130
130: ; preds = %129
%131 = call i8* @malloc(i64 2)
store i8* %131, i8** %11
%132 = load i8*, i8** %11
%133 = load i8*, i8** %11
%134 = call i64 @llvm.objectsize.i64.p0i8(i8* %133, i1 false, i1 true, i1 false)
%135 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%136 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %132, i32 0, i64 %134, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32 %135)
%137 = load i8*, i8** %11
%138 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %137)
br label %139
139: ; preds = %130
br label %140
140: ; preds = %139
%141 = call i8* @malloc(i64 2)
store i8* %141, i8** %12
%142 = load i8*, i8** %12
%143 = load i8*, i8** %12
%144 = call i64 @llvm.objectsize.i64.p0i8(i8* %143, i1 false, i1 true, i1 false)
%145 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -1, i32 0)
%146 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %142, i32 0, i64 %144, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32 %145)
%147 = load i8*, i8** %12
%148 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %147)
br label %149
149: ; preds = %140
br label %150
150: ; preds = %149
%151 = call i8* @malloc(i64 2)
store i8* %151, i8** %13
%152 = load i8*, i8** %13
%153 = load i8*, i8** %13
%154 = call i64 @llvm.objectsize.i64.p0i8(i8* %153, i1 false, i1 true, i1 false)
%155 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 9, i32 10)
%156 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %152, i32 0, i64 %154, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32 %155)
%157 = load i8*, i8** %13
%158 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %157)
br label %159
159: ; preds = %150
br label %160
160: ; preds = %159
%161 = call i8* @malloc(i64 3)
store i8* %161, i8** %14
%162 = load i8*, i8** %14
%163 = load i8*, i8** %14
%164 = call i64 @llvm.objectsize.i64.p0i8(i8* %163, i1 false, i1 true, i1 false)
%165 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -9, i32 9)
%166 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %162, i32 0, i64 %164, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32 %165)
%167 = load i8*, i8** %14
%168 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %167)
br label %169
169: ; preds = %160
br label %170
170: ; preds = %169
%171 = call i8* @malloc(i64 3)
store i8* %171, i8** %15
%172 = load i8*, i8** %15
%173 = load i8*, i8** %15
%174 = call i64 @llvm.objectsize.i64.p0i8(i8* %173, i1 false, i1 true, i1 false)
%175 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -99, i32 99)
%176 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %172, i32 0, i64 %174, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32 %175)
%177 = load i8*, i8** %15
%178 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %177)
br label %179
179: ; preds = %170
br label %180
180: ; preds = %179
%181 = call i8* @malloc(i64 3)
store i8* %181, i8** %16
%182 = load i8*, i8** %16
%183 = load i8*, i8** %16
%184 = call i64 @llvm.objectsize.i64.p0i8(i8* %183, i1 false, i1 true, i1 false)
%185 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%186 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %182, i32 0, i64 %184, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32 %185)
%187 = load i8*, i8** %16
%188 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %187)
br label %189
189: ; preds = %180
br label %190
190: ; preds = %189
%191 = call i8* @malloc(i64 3)
store i8* %191, i8** %17
%192 = load i8*, i8** %17
%193 = load i8*, i8** %17
%194 = call i64 @llvm.objectsize.i64.p0i8(i8* %193, i1 false, i1 true, i1 false)
%195 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 100)
%196 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %192, i32 0, i64 %194, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32 %195)
%197 = load i8*, i8** %17
%198 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %197)
br label %199
199: ; preds = %190
br label %200
200: ; preds = %199
%201 = call i8* @malloc(i64 3)
store i8* %201, i8** %18
%202 = load i8*, i8** %18
%203 = load i8*, i8** %18
%204 = call i64 @llvm.objectsize.i64.p0i8(i8* %203, i1 false, i1 true, i1 false)
%205 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 1, i32 10)
%206 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 9, i32 10)
%207 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %202, i32 0, i64 %204, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.3, i64 0, i64 0), i32 %205, i32 %206)
%208 = load i8*, i8** %18
%209 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %208)
br label %210
210: ; preds = %200
br label %211
211: ; preds = %210
%212 = call i8* @malloc(i64 4)
store i8* %212, i8** %19
%213 = load i8*, i8** %19
%214 = load i8*, i8** %19
%215 = call i64 @llvm.objectsize.i64.p0i8(i8* %214, i1 false, i1 true, i1 false)
%216 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 10, i32 11)
%217 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 12, i32 13)
%218 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %213, i32 0, i64 %215, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.3, i64 0, i64 0), i32 %216, i32 %217)
%219 = load i8*, i8** %19
%220 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %219)
br label %221
221: ; preds = %211
br label %222
222: ; preds = %221
%223 = call i8* @malloc(i64 5)
store i8* %223, i8** %20
%224 = load i8*, i8** %20
%225 = load i8*, i8** %20
%226 = call i64 @llvm.objectsize.i64.p0i8(i8* %225, i1 false, i1 true, i1 false)
%227 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -9, i32 99)
%228 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -9, i32 99)
%229 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %224, i32 0, i64 %226, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.3, i64 0, i64 0), i32 %227, i32 %228)
%230 = load i8*, i8** %20
%231 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %230)
br label %232
232: ; preds = %222
br label %233
233: ; preds = %232
%234 = call i8* @malloc(i64 6)
store i8* %234, i8** %21
%235 = load i8*, i8** %21
%236 = load i8*, i8** %21
%237 = call i64 @llvm.objectsize.i64.p0i8(i8* %236, i1 false, i1 true, i1 false)
%238 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%239 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%240 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%241 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %235, i32 0, i64 %237, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.4, i64 0, i64 0), i32 %238, i32 %239, i32 %240)
%242 = load i8*, i8** %21
%243 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %242)
br label %244
244: ; preds = %233
br label %245
245: ; preds = %244
%246 = call i8* @malloc(i64 6)
store i8* %246, i8** %22
%247 = load i8*, i8** %22
%248 = load i8*, i8** %22
%249 = call i64 @llvm.objectsize.i64.p0i8(i8* %248, i1 false, i1 true, i1 false)
%250 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%251 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%252 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%253 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %247, i32 0, i64 %249, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.4, i64 0, i64 0), i32 %250, i32 %251, i32 %252)
%254 = load i8*, i8** %22
%255 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %254)
br label %256
256: ; preds = %245
br label %257
257: ; preds = %256
%258 = call i8* @malloc(i64 6)
store i8* %258, i8** %23
%259 = load i8*, i8** %23
%260 = load i8*, i8** %23
%261 = call i64 @llvm.objectsize.i64.p0i8(i8* %260, i1 false, i1 true, i1 false)
%262 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%263 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%264 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%265 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %259, i32 0, i64 %261, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.4, i64 0, i64 0), i32 %262, i32 %263, i32 %264)
%266 = load i8*, i8** %23
%267 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %266)
br label %268
268: ; preds = %257
br label %269
269: ; preds = %268
%270 = call i8* @malloc(i64 6)
store i8* %270, i8** %24
%271 = load i8*, i8** %24
%272 = load i8*, i8** %24
%273 = call i64 @llvm.objectsize.i64.p0i8(i8* %272, i1 false, i1 true, i1 false)
%274 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%275 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%276 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%277 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %271, i32 0, i64 %273, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.4, i64 0, i64 0), i32 %274, i32 %275, i32 %276)
%278 = load i8*, i8** %24
%279 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %278)
br label %280
280: ; preds = %269
br label %281
281: ; preds = %280
%282 = call i8* @malloc(i64 6)
store i8* %282, i8** %25
%283 = load i8*, i8** %25
%284 = load i8*, i8** %25
%285 = call i64 @llvm.objectsize.i64.p0i8(i8* %284, i1 false, i1 true, i1 false)
%286 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%287 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%288 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%289 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %283, i32 0, i64 %285, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.5, i64 0, i64 0), i32 %286, i32 %287, i32 %288)
%290 = load i8*, i8** %25
%291 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %290)
br label %292
292: ; preds = %281
br label %293
293: ; preds = %292
%294 = call i8* @malloc(i64 6)
store i8* %294, i8** %26
%295 = load i8*, i8** %26
%296 = load i8*, i8** %26
%297 = call i64 @llvm.objectsize.i64.p0i8(i8* %296, i1 false, i1 true, i1 false)
%298 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%299 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%300 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%301 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %295, i32 0, i64 %297, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.6, i64 0, i64 0), i32 %298, i32 %299, i32 %300)
%302 = load i8*, i8** %26
%303 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %302)
br label %304
304: ; preds = %293
br label %305
305: ; preds = %304
%306 = call i8* @malloc(i64 6)
store i8* %306, i8** %27
%307 = load i8*, i8** %27
%308 = load i8*, i8** %27
%309 = call i64 @llvm.objectsize.i64.p0i8(i8* %308, i1 false, i1 true, i1 false)
%310 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%311 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%312 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%313 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %307, i32 0, i64 %309, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.7, i64 0, i64 0), i32 %310, i32 %311, i32 %312)
%314 = load i8*, i8** %27
%315 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %314)
br label %316
316: ; preds = %305
br label %317
317: ; preds = %316
%318 = call i8* @malloc(i64 6)
store i8* %318, i8** %28
%319 = load i8*, i8** %28
%320 = load i8*, i8** %28
%321 = call i64 @llvm.objectsize.i64.p0i8(i8* %320, i1 false, i1 true, i1 false)
%322 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 119)
%323 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%324 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%325 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %319, i32 0, i64 %321, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.7, i64 0, i64 0), i32 %322, i32 %323, i32 %324)
%326 = load i8*, i8** %28
%327 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %326)
br label %328
328: ; preds = %317
br label %329
329: ; preds = %328
%330 = call i8* @malloc(i64 6)
store i8* %330, i8** %29
%331 = load i8*, i8** %29
%332 = load i8*, i8** %29
%333 = call i64 @llvm.objectsize.i64.p0i8(i8* %332, i1 false, i1 true, i1 false)
%334 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 1)
%335 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 2)
%336 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 3)
%337 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %331, i32 0, i64 %333, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.7, i64 0, i64 0), i32 %334, i32 %335, i32 %336)
%338 = load i8*, i8** %29
%339 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %338)
br label %340
340: ; preds = %329
ret void
}

LLVM IR (-O2):
@.str = [5 x i8] c"%hhi\00"
@.str.1 = [6 x i8] c"%#hhx\00"
@.str.2 = [3 x i8] c"%i\00"
@.str.3 = [5 x i8] c"%i%i\00"
@.str.4 = [9 x i8] c"%i_%i_%i\00"
@.str.5 = [12 x i8] c"%hhi_%hi_%i\00"
@.str.6 = [12 x i8] c"%3i|%2i/%1i\00"
@.str.7 = [13 x i8] c"%.3i|%.2i/%i\00"
define void @test_sprintf_chk_range_schar() {
%1 = tail call i8* @malloc(i64 0)
%2 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 0, i32 1)
%3 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %1, i32 0, i64 0, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %2)
%4 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %1)
%5 = tail call i8* @malloc(i64 0)
%6 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 0, i32 127)
%7 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %5, i32 0, i64 0, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %6)
%8 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %5)
%9 = tail call i8* @malloc(i64 0)
%10 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 1024, i32 1033)
%11 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %9, i32 0, i64 0, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %10)
%12 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %9)
%13 = tail call i8* @malloc(i64 0)
%14 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 1024, i32 1034)
%15 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %13, i32 0, i64 0, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %14)
%16 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %13)
%17 = tail call i8* @malloc(i64 0)
%18 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 1024, i32 2035)
%19 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %17, i32 0, i64 0, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %18)
%20 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %17)
%21 = tail call dereferenceable_or_null(2) i8* @malloc(i64 2)
%22 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 1234, i32 12345)
%23 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %21, i32 0, i64 2, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0), i32 %22)
%24 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %21)
%25 = tail call dereferenceable_or_null(3) i8* @malloc(i64 3)
%26 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 1234, i32 12345)
%27 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %25, i32 0, i64 3, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0), i32 %26)
%28 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %25)
%29 = tail call dereferenceable_or_null(4) i8* @malloc(i64 4)
%30 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 1234, i32 12345)
%31 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %29, i32 0, i64 4, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0), i32 %30)
%32 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %29)
%33 = tail call i8* @malloc(i64 0)
%34 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%35 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %33, i32 0, i64 0, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32 %34)
%36 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %33)
%37 = tail call dereferenceable_or_null(1) i8* @malloc(i64 1)
%38 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%39 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %37, i32 0, i64 1, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32 %38)
%40 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %37)
%41 = tail call dereferenceable_or_null(2) i8* @malloc(i64 2)
%42 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%43 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %41, i32 0, i64 2, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32 %42)
%44 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %41)
%45 = tail call dereferenceable_or_null(2) i8* @malloc(i64 2)
%46 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -1, i32 0)
%47 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %45, i32 0, i64 2, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32 %46)
%48 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %45)
%49 = tail call dereferenceable_or_null(2) i8* @malloc(i64 2)
%50 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 9, i32 10)
%51 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %49, i32 0, i64 2, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32 %50)
%52 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %49)
%53 = tail call dereferenceable_or_null(3) i8* @malloc(i64 3)
%54 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -9, i32 9)
%55 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %53, i32 0, i64 3, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32 %54)
%56 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %53)
%57 = tail call dereferenceable_or_null(3) i8* @malloc(i64 3)
%58 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -99, i32 99)
%59 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %57, i32 0, i64 3, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32 %58)
%60 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %57)
%61 = tail call dereferenceable_or_null(3) i8* @malloc(i64 3)
%62 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%63 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %61, i32 0, i64 3, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32 %62)
%64 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %61)
%65 = tail call dereferenceable_or_null(3) i8* @malloc(i64 3)
%66 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 100)
%67 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %65, i32 0, i64 3, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32 %66)
%68 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %65)
%69 = tail call dereferenceable_or_null(3) i8* @malloc(i64 3)
%70 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 1, i32 10)
%71 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 9, i32 10)
%72 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %69, i32 0, i64 3, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.3, i64 0, i64 0), i32 %70, i32 %71)
%73 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %69)
%74 = tail call dereferenceable_or_null(4) i8* @malloc(i64 4)
%75 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 10, i32 11)
%76 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 12, i32 13)
%77 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %74, i32 0, i64 4, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.3, i64 0, i64 0), i32 %75, i32 %76)
%78 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %74)
%79 = tail call dereferenceable_or_null(5) i8* @malloc(i64 5)
%80 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -9, i32 99)
%81 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -9, i32 99)
%82 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %79, i32 0, i64 5, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.3, i64 0, i64 0), i32 %80, i32 %81)
%83 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %79)
%84 = tail call dereferenceable_or_null(6) i8* @malloc(i64 6)
%85 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%86 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%87 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%88 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %84, i32 0, i64 6, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.4, i64 0, i64 0), i32 %85, i32 %86, i32 %87)
%89 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %84)
%90 = tail call dereferenceable_or_null(6) i8* @malloc(i64 6)
%91 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%92 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%93 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%94 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %90, i32 0, i64 6, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.4, i64 0, i64 0), i32 %91, i32 %92, i32 %93)
%95 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %90)
%96 = tail call dereferenceable_or_null(6) i8* @malloc(i64 6)
%97 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%98 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%99 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%100 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %96, i32 0, i64 6, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.4, i64 0, i64 0), i32 %97, i32 %98, i32 %99)
%101 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %96)
%102 = tail call dereferenceable_or_null(6) i8* @malloc(i64 6)
%103 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%104 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%105 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%106 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %102, i32 0, i64 6, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.4, i64 0, i64 0), i32 %103, i32 %104, i32 %105)
%107 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %102)
%108 = tail call dereferenceable_or_null(6) i8* @malloc(i64 6)
%109 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%110 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%111 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%112 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %108, i32 0, i64 6, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.5, i64 0, i64 0), i32 %109, i32 %110, i32 %111)
%113 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %108)
%114 = tail call dereferenceable_or_null(6) i8* @malloc(i64 6)
%115 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%116 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%117 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%118 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %114, i32 0, i64 6, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.6, i64 0, i64 0), i32 %115, i32 %116, i32 %117)
%119 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %114)
%120 = tail call dereferenceable_or_null(6) i8* @malloc(i64 6)
%121 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%122 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%123 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%124 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %120, i32 0, i64 6, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.7, i64 0, i64 0), i32 %121, i32 %122, i32 %123)
%125 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %120)
%126 = tail call dereferenceable_or_null(6) i8* @malloc(i64 6)
%127 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 119)
%128 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%129 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%130 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %126, i32 0, i64 6, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.7, i64 0, i64 0), i32 %127, i32 %128, i32 %129)
%131 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %126)
%132 = tail call dereferenceable_or_null(6) i8* @malloc(i64 6)
%133 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 1)
%134 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 2)
%135 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 3)
%136 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %132, i32 0, i64 6, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.7, i64 0, i64 0), i32 %133, i32 %134, i32 %135)
%137 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %132)
ret void
}