#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int ssize_t;

/* Variables and functions */
int /*<<< orphan*/ assert(void *);
int /*<<< orphan*/ free(void *);
void *malloc(unsigned int);
int /*<<< orphan*/ strcmp(char *, char *);
int main(int argc, char **argv) {
  ssize_t offset = sizeof(void *) == 8 ? 8 : 0;
  assert(argc == 2);
  if (!strcmp(argv[1], "malloc")) {
    void *p = malloc(1U << 4);
    assert(p);
    ((char *)p)[-(offset + 1)] ^= 1;
    free(p);
  }
  if (!strcmp(argv[1], "quarantine")) {
    void *p = malloc(1U << 4);
    assert(p);
    free(p);
    ((char *)p)[-(offset + 2)] ^= 1;
    for (int i = 0; i < 0x100; i++) {
      p = malloc(1U << 8);
      free(p);
    }
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movl   $0x8,-0x14(%rbp)
cmpl   $0x2,-0x8(%rbp)
sete   %al
and    $0x1,%al
movzbl %al,%eax
movslq %eax,%rdi
call   1050 <assert@plt>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
lea    0xe80(%rip),%rsi
call   1040 <strcmp@plt>
cmp    $0x0,%eax
jne    11c9 <main+0x89>
mov    $0x10,%edi
call   1060 <malloc@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rdi
call   1050 <assert@plt>
mov    -0x20(%rbp),%rax
mov    -0x14(%rbp),%edx
add    $0x1,%edx
xor    %ecx,%ecx
sub    %edx,%ecx
movslq %ecx,%rcx
movsbl (%rax,%rcx,1),%edx
xor    $0x1,%edx
mov    %dl,(%rax,%rcx,1)
mov    -0x20(%rbp),%rdi
call   1030 <free@plt>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
lea    0xe2f(%rip),%rsi
call   1040 <strcmp@plt>
cmp    $0x0,%eax
jne    125f <main+0x11f>
mov    $0x10,%edi
call   1060 <malloc@plt>
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rdi
call   1050 <assert@plt>
mov    -0x28(%rbp),%rdi
call   1030 <free@plt>
mov    -0x28(%rbp),%rax
mov    -0x14(%rbp),%edx
add    $0x2,%edx
xor    %ecx,%ecx
sub    %edx,%ecx
movslq %ecx,%rcx
movsbl (%rax,%rcx,1),%edx
xor    $0x1,%edx
mov    %dl,(%rax,%rcx,1)
movl   $0x0,-0x2c(%rbp)
cmpl   $0x100,-0x2c(%rbp)
jge    125a <main+0x11a>
mov    $0x100,%edi
call   1060 <malloc@plt>
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rdi
call   1030 <free@plt>
mov    -0x2c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x2c(%rbp)
jmp    1228 <main+0xe8>
jmp    125f <main+0x11f>
xor    %eax,%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r14
push   %rbx
push   %rax
mov    %rsi,%r14
xor    %eax,%eax
cmp    $0x2,%edi
sete   %al
mov    %rax,%rdi
call   1050 <assert@plt>
mov    0x8(%r14),%rbx
lea    0xe9e(%rip),%rsi
mov    %rbx,%rdi
call   1040 <strcmp@plt>
test   %eax,%eax
jne    1193 <main+0x53>
mov    $0x10,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    %rax,%rdi
call   1050 <assert@plt>
xorb   $0x1,-0x9(%rbx)
mov    %rbx,%rdi
call   1030 <free@plt>
mov    0x8(%r14),%rbx
lea    0xe6d(%rip),%rsi
mov    %rbx,%rdi
call   1040 <strcmp@plt>
test   %eax,%eax
jne    11e7 <main+0xa7>
mov    $0x10,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    %rax,%rdi
call   1050 <assert@plt>
mov    %rbx,%rdi
call   1030 <free@plt>
xorb   $0x1,-0xa(%rbx)
mov    $0x100,%ebx
nopl   0x0(%rax)
mov    $0x100,%edi
call   1060 <malloc@plt>
mov    %rax,%rdi
call   1030 <free@plt>
add    $0xffffffff,%ebx
jne    11d0 <main+0x90>
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
@.str = [7 x i8] c"malloc\00"
@.str.1 = [11 x i8] c"quarantine\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 8, i32* %6
%10 = load i32, i32* %4
%11 = icmp eq i32 %10, 2
%12 = zext i1 %11 to i32
%13 = sext i32 %12 to i64
%14 = inttoptr i64 %13 to i8*
%15 = call i32 @assert(i8* %14)
%16 = load i8**, i8*** %5
%17 = getelementptr inbounds i8*, i8** %16, i64 1
%18 = load i8*, i8** %17
%19 = call i32 @strcmp(i8* %18, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0))
%20 = icmp ne i32 %19, 0
br i1 %20, label %37, label %21
21: ; preds = %2
%22 = call i8* @malloc(i32 16)
store i8* %22, i8** %7
%23 = load i8*, i8** %7
%24 = call i32 @assert(i8* %23)
%25 = load i8*, i8** %7
%26 = load i32, i32* %6
%27 = add nsw i32 %26, 1
%28 = sub nsw i32 0, %27
%29 = sext i32 %28 to i64
%30 = getelementptr inbounds i8, i8* %25, i64 %29
%31 = load i8, i8* %30
%32 = sext i8 %31 to i32
%33 = xor i32 %32, 1
%34 = trunc i32 %33 to i8
store i8 %34, i8* %30
%35 = load i8*, i8** %7
%36 = call i32 @free(i8* %35)
br label %37
37: ; preds = %21, %2
%38 = load i8**, i8*** %5
%39 = getelementptr inbounds i8*, i8** %38, i64 1
%40 = load i8*, i8** %39
%41 = call i32 @strcmp(i8* %40, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.1, i64 0, i64 0))
%42 = icmp ne i32 %41, 0
br i1 %42, label %70, label %43
43: ; preds = %37
%44 = call i8* @malloc(i32 16)
store i8* %44, i8** %8
%45 = load i8*, i8** %8
%46 = call i32 @assert(i8* %45)
%47 = load i8*, i8** %8
%48 = call i32 @free(i8* %47)
%49 = load i8*, i8** %8
%50 = load i32, i32* %6
%51 = add nsw i32 %50, 2
%52 = sub nsw i32 0, %51
%53 = sext i32 %52 to i64
%54 = getelementptr inbounds i8, i8* %49, i64 %53
%55 = load i8, i8* %54
%56 = sext i8 %55 to i32
%57 = xor i32 %56, 1
%58 = trunc i32 %57 to i8
store i8 %58, i8* %54
store i32 0, i32* %9
br label %59
59: ; preds = %66, %43
%60 = load i32, i32* %9
%61 = icmp slt i32 %60, 256
br i1 %61, label %62, label %69
62: ; preds = %59
%63 = call i8* @malloc(i32 256)
store i8* %63, i8** %8
%64 = load i8*, i8** %8
%65 = call i32 @free(i8* %64)
br label %66
66: ; preds = %62
%67 = load i32, i32* %9
%68 = add nsw i32 %67, 1
store i32 %68, i32* %9
br label %59
69: ; preds = %59
br label %70
70: ; preds = %69, %37
ret i32 0
}

LLVM IR (-O2):
@.str = [7 x i8] c"malloc\00"
@.str.1 = [11 x i8] c"quarantine\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = icmp eq i32 %0, 2
%4 = zext i1 %3 to i64
%5 = inttoptr i64 %4 to i8*
%6 = tail call i32 @assert(i8* %5)
%7 = getelementptr inbounds i8*, i8** %1, i64 1
%8 = load i8*, i8** %7
%9 = tail call i32 @strcmp(i8* dereferenceable(1) %8, i8* dereferenceable(7) getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0))
%10 = icmp eq i32 %9, 0
br i1 %10, label %11, label %19
11: ; preds = %2
%12 = tail call dereferenceable_or_null(16) i8* @malloc(i32 16)
%13 = tail call i32 @assert(i8* %12)
%14 = getelementptr inbounds i8, i8* %12, i64 -9
%15 = load i8, i8* %14
%16 = xor i8 %15, 1
store i8 %16, i8* %14
%17 = tail call i32 @free(i8* %12)
%18 = load i8*, i8** %7
br label %19
19: ; preds = %11, %2
%20 = phi i8* [ %18, %11 ], [ %8, %2 ]
%21 = tail call i32 @strcmp(i8* dereferenceable(1) %20, i8* dereferenceable(11) getelementptr inbounds ([11 x i8], [11 x i8]* @.str.1, i64 0, i64 0))
%22 = icmp eq i32 %21, 0
br i1 %22, label %23, label %36
23: ; preds = %19
%24 = tail call dereferenceable_or_null(16) i8* @malloc(i32 16)
%25 = tail call i32 @assert(i8* %24)
%26 = tail call i32 @free(i8* %24)
%27 = getelementptr inbounds i8, i8* %24, i64 -10
%28 = load i8, i8* %27
%29 = xor i8 %28, 1
store i8 %29, i8* %27
br label %30
30: ; preds = %23, %30
%31 = phi i32 [ 0, %23 ], [ %34, %30 ]
%32 = tail call dereferenceable_or_null(256) i8* @malloc(i32 256)
%33 = tail call i32 @free(i8* %32)
%34 = add nuw nsw i32 %31, 1
%35 = icmp eq i32 %34, 256
br i1 %35, label %36, label %30
36: ; preds = %30, %19
ret i32 0
}