#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct passwd {
  int /*<<< orphan*/ *pw_gecos;
  int /*<<< orphan*/ *pw_name;
};
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
int /*<<< orphan*/ exit(int);
int /*<<< orphan*/ *fopen(char *, char *);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, char *, int);
int /*<<< orphan*/ getline(int /*<<< orphan*/ **, int *, int /*<<< orphan*/ *);
int /*<<< orphan*/ printf(char *);
int /*<<< orphan*/ stderr;
void taint_data(char *fname, struct passwd *pwd) {
  FILE *fp = fopen(fname, "r");
  int dummy = 0;
  printf("TAINTED HERE !!\n");
  if (!pwd)
    return;
  if (!fp) {
    fprintf(stderr,
            "Can't find testcase file (%s) with %d lines of tainted input. You "
            "should manually 'cp testcase.exploit testcase' or 'cp "
            "testcase.init testcase'\n",
            fname, 2);
    exit(1);
  }
  pwd->pw_name = NULL;
  pwd->pw_gecos = NULL;
  getline(&(pwd->pw_name), &dummy, fp);
  getline(&(pwd->pw_gecos), &dummy, fp);
}


x86 assembly (clang, -O0):
<taint_data>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    -0x8(%rbp),%rdi
lea    0xe95(%rip),%rsi
call   1050 <fopen@plt>
mov    %rax,-0x18(%rbp)
movl   $0x0,-0x1c(%rbp)
lea    0xe80(%rip),%rdi
call   1030 <printf@plt>
cmpq   $0x0,-0x10(%rbp)
jne    1197 <taint_data+0x47>
jmp    1207 <taint_data+0xb7>
cmpq   $0x0,-0x18(%rbp)
jne    11ca <taint_data+0x7a>
mov    0x2e37(%rip),%rax
mov    (%rax),%edi
mov    -0x8(%rbp),%rdx
lea    0xe5d(%rip),%rsi
mov    $0x2,%ecx
call   1040 <fprintf@plt>
mov    $0x1,%edi
call   1070 <exit@plt>
mov    -0x10(%rbp),%rax
movq   $0x0,0x8(%rax)
mov    -0x10(%rbp),%rax
movq   $0x0,(%rax)
mov    -0x10(%rbp),%rdi
add    $0x8,%rdi
mov    -0x18(%rbp),%rdx
lea    -0x1c(%rbp),%rsi
call   1060 <getline@plt>
mov    -0x10(%rbp),%rdi
mov    -0x18(%rbp),%rdx
lea    -0x1c(%rbp),%rsi
call   1060 <getline@plt>
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<taint_data>:
push   %r15
push   %r14
push   %rbx
sub    $0x10,%rsp
mov    %rsi,%rbx
mov    %rdi,%r14
lea    0xe9a(%rip),%rsi
call   1050 <fopen@plt>
mov    %rax,%r15
movl   $0x0,0xc(%rsp)
lea    0xf16(%rip),%rdi
call   1030 <puts@plt>
test   %rbx,%rbx
je     11b4 <taint_data+0x64>
test   %r15,%r15
je     11be <taint_data+0x6e>
lea    0x8(%rbx),%rdi
xorps  %xmm0,%xmm0
movups %xmm0,(%rbx)
lea    0xc(%rsp),%r14
mov    %r14,%rsi
mov    %r15,%rdx
call   1060 <getline@plt>
mov    %rbx,%rdi
mov    %r14,%rsi
mov    %r15,%rdx
call   1060 <getline@plt>
add    $0x10,%rsp
pop    %rbx
pop    %r14
pop    %r15
ret
mov    0x2e1b(%rip),%rax
mov    (%rax),%edi
lea    0xe34(%rip),%rsi
mov    %r14,%rdx
mov    $0x2,%ecx
call   1040 <fprintf@plt>
mov    $0x1,%edi
call   1070 <exit@plt>

LLVM IR (-O0):
%struct.passwd = type { i32*, i32* }
@.str = [2 x i8] c"r\00"
@.str.1 = [17 x i8] c"TAINTED HERE !!\0A\00"
@stderr = global i32 0
@.str.2 = [145 x i8] c"Can't find testcase file (%s) with %d lines of tainted input. You should manually 'cp testcase.exploit testcase' or 'cp testcase.init testcase'\0A\00"
define void @taint_data(i8* %0, %struct.passwd* %1) {
%3 = alloca i8*
%4 = alloca %struct.passwd*
%5 = alloca i32*
%6 = alloca i32
store i8* %0, i8** %3
store %struct.passwd* %1, %struct.passwd** %4
%7 = load i8*, i8** %3
%8 = call i32* @fopen(i8* %7, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
store i32* %8, i32** %5
store i32 0, i32* %6
%9 = call i32 @printf(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.1, i64 0, i64 0))
%10 = load %struct.passwd*, %struct.passwd** %4
%11 = icmp ne %struct.passwd* %10, null
br i1 %11, label %13, label %12
12: ; preds = %2
br label %34
13: ; preds = %2
%14 = load i32*, i32** %5
%15 = icmp ne i32* %14, null
br i1 %15, label %21, label %16
16: ; preds = %13
%17 = load i32, i32* @stderr
%18 = load i8*, i8** %3
%19 = call i32 @fprintf(i32 %17, i8* getelementptr inbounds ([145 x i8], [145 x i8]* @.str.2, i64 0, i64 0), i8* %18, i32 2)
%20 = call i32 @exit(i32 1)
unreachable
21: ; preds = %13
%22 = load %struct.passwd*, %struct.passwd** %4
%23 = getelementptr inbounds %struct.passwd, %struct.passwd* %22, i32 0, i32 1
store i32* null, i32** %23
%24 = load %struct.passwd*, %struct.passwd** %4
%25 = getelementptr inbounds %struct.passwd, %struct.passwd* %24, i32 0, i32 0
store i32* null, i32** %25
%26 = load %struct.passwd*, %struct.passwd** %4
%27 = getelementptr inbounds %struct.passwd, %struct.passwd* %26, i32 0, i32 1
%28 = load i32*, i32** %5
%29 = call i32 @getline(i32** %27, i32* %6, i32* %28)
%30 = load %struct.passwd*, %struct.passwd** %4
%31 = getelementptr inbounds %struct.passwd, %struct.passwd* %30, i32 0, i32 0
%32 = load i32*, i32** %5
%33 = call i32 @getline(i32** %31, i32* %6, i32* %32)
br label %34
34: ; preds = %21, %12
ret void
}

LLVM IR (-O2):
%struct.passwd = type { i32*, i32* }
@.str = [2 x i8] c"r\00"
@stderr = global i32 0
@.str.2 = [145 x i8] c"Can't find testcase file (%s) with %d lines of tainted input. You should manually 'cp testcase.exploit testcase' or 'cp testcase.init testcase'\0A\00"
@str = [16 x i8] c"TAINTED HERE !!\00"
define void @taint_data(i8* %0, %struct.passwd* %1) {
%3 = alloca i32
%4 = tail call i32* @fopen(i8* %0, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
%5 = bitcast i32* %3 to i8*
store i32 0, i32* %3
%6 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([16 x i8], [16 x i8]* @str, i64 0, i64 0))
%7 = icmp eq %struct.passwd* %1, null
br i1 %7, label %20, label %8
8: ; preds = %2
%9 = icmp eq i32* %4, null
br i1 %9, label %10, label %14
10: ; preds = %8
%11 = load i32, i32* @stderr
%12 = tail call i32 @fprintf(i32 %11, i8* getelementptr inbounds ([145 x i8], [145 x i8]* @.str.2, i64 0, i64 0), i8* %0, i32 2)
%13 = tail call i32 @exit(i32 1)
unreachable
14: ; preds = %8
%15 = getelementptr inbounds %struct.passwd, %struct.passwd* %1, i64 0, i32 1
%16 = getelementptr inbounds %struct.passwd, %struct.passwd* %1, i64 0, i32 0
%17 = bitcast %struct.passwd* %1 to i8*
%18 = call i32 @getline(i32** %15, i32* %3, i32* %4)
%19 = call i32 @getline(i32** %16, i32* %3, i32* %4)
br label %20
20: ; preds = %2, %14
ret void
}