#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ free(char *);
char *malloc(int);
int /*<<< orphan*/ snprintf(char *, int, char *, char *, char *, char *);
int strlen(char *);
int /*<<< orphan*/ strncpy(char *, char *, int);
char *strstr(char *, char *);
int searchreplace(char *buf, int len, char *findstring, char *replacewith) {
  int changed = 0;
  char *tmp;
  char *here;
  if (!buf || !findstring || !replacewith)
    return -1;
  here = strstr(buf, findstring);
  if (here) {
    tmp = malloc(len);
    changed = 1;
    *here = '\0';
    snprintf(tmp, len, "%s%s%s", buf, replacewith, here + strlen(findstring));
    here += strlen(replacewith);
    strncpy(buf, tmp, len);
    buf[len - 1] = '\0';
    free(tmp);
  }
  if (changed)
    searchreplace(here, (len - (here - buf)), findstring, replacewith);
  return 0;
}


x86 assembly (clang, -O0):
<searchreplace>:
push   %rbp
mov    %rsp,%rbp
sub    $0x70,%rsp
mov    %rdi,-0x10(%rbp)
mov    %esi,-0x14(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
movl   $0x0,-0x2c(%rbp)
cmpq   $0x0,-0x10(%rbp)
je     11af <searchreplace+0x3f>
cmpq   $0x0,-0x20(%rbp)
je     11af <searchreplace+0x3f>
cmpq   $0x0,-0x28(%rbp)
jne    11bb <searchreplace+0x4b>
movl   $0xffffffff,-0x4(%rbp)
jmp    12bd <searchreplace+0x14d>
mov    -0x10(%rbp),%rdi
mov    -0x20(%rbp),%rsi
call   1090 <strstr@plt>
mov    %rax,-0x40(%rbp)
cmpq   $0x0,-0x40(%rbp)
je     1287 <searchreplace+0x117>
mov    -0x14(%rbp),%edi
call   1080 <malloc@plt>
mov    %rax,-0x38(%rbp)
movl   $0x1,-0x2c(%rbp)
mov    -0x40(%rbp),%rax
movb   $0x0,(%rax)
mov    -0x38(%rbp),%rax
mov    %rax,-0x60(%rbp)
mov    -0x14(%rbp),%eax
mov    %eax,-0x54(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0x50(%rbp)
mov    -0x28(%rbp),%rax
mov    %rax,-0x48(%rbp)
mov    -0x40(%rbp),%rax
mov    %rax,-0x68(%rbp)
mov    -0x20(%rbp),%rdi
call   1050 <strlen@plt>
mov    -0x68(%rbp),%r9
mov    -0x60(%rbp),%rdi
mov    -0x54(%rbp),%esi
mov    -0x50(%rbp),%rcx
mov    -0x48(%rbp),%r8
cltq
add    %rax,%r9
lea    0xdc1(%rip),%rdx
call   1060 <snprintf@plt>
mov    -0x28(%rbp),%rdi
call   1050 <strlen@plt>
mov    %eax,%ecx
mov    -0x40(%rbp),%rax
movslq %ecx,%rcx
add    %rcx,%rax
mov    %rax,-0x40(%rbp)
mov    -0x10(%rbp),%rdi
mov    -0x38(%rbp),%rsi
mov    -0x14(%rbp),%edx
call   1040 <strncpy@plt>
mov    -0x10(%rbp),%rax
mov    -0x14(%rbp),%ecx
sub    $0x1,%ecx
movslq %ecx,%rcx
movb   $0x0,(%rax,%rcx,1)
mov    -0x38(%rbp),%rdi
call   1030 <free@plt>
cmpl   $0x0,-0x2c(%rbp)
je     12b6 <searchreplace+0x146>
mov    -0x40(%rbp),%rdi
movslq -0x14(%rbp),%rax
mov    -0x40(%rbp),%rcx
mov    -0x10(%rbp),%rdx
sub    %rdx,%rcx
sub    %rcx,%rax
mov    %eax,%esi
mov    -0x20(%rbp),%rdx
mov    -0x28(%rbp),%rcx
call   1070 <searchreplace@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x70,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<searchreplace>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    $0xffffffff,%eax
test   %rcx,%rcx
je     1250 <searchreplace+0xf0>
test   %rdx,%rdx
je     1250 <searchreplace+0xf0>
mov    %rdi,%rbp
test   %rdi,%rdi
je     1250 <searchreplace+0xf0>
mov    %rcx,%r15
mov    %esi,%ebx
mov    %rbp,%rdi
mov    %rdx,%r12
mov    %rdx,%rsi
call   1080 <strstr@plt>
mov    %rax,%r14
xor    %eax,%eax
test   %r14,%r14
je     1250 <searchreplace+0xf0>
mov    %r12,0x8(%rsp)
mov    %r15,0x10(%rsp)
mov    0x8(%rsp),%r12
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax,%rax,1)
mov    %ebx,%edi
call   1070 <malloc@plt>
mov    %rax,%r13
movb   $0x0,(%r14)
mov    %r12,%rdi
call   1050 <strlen@plt>
movslq %eax,%r9
add    %r14,%r9
mov    %r13,%rdi
mov    %ebx,%esi
lea    0xe08(%rip),%rdx
mov    %rbp,%rcx
mov    %r15,%r8
call   1060 <snprintf@plt>
mov    %r15,%rdi
call   1050 <strlen@plt>
movslq %eax,%r15
add    %r14,%r15
mov    %rbp,%rdi
mov    %r13,%rsi
mov    %ebx,%edx
call   1040 <strncpy@plt>
movslq %ebx,%rbx
movb   $0x0,-0x1(%rbx,%rbp,1)
mov    %r13,%rdi
call   1030 <free@plt>
sub    %r15d,%ebp
add    %ebp,%ebx
mov    %r15,%rdi
mov    %r12,%rsi
call   1080 <strstr@plt>
mov    %rax,%r14
mov    %r15,%rbp
mov    0x10(%rsp),%r15
test   %rax,%rax
jne    11d0 <searchreplace+0x70>
xor    %eax,%eax
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [7 x i8] c"%s%s%s\00"
define i32 @searchreplace(i8* %0, i32 %1, i8* %2, i8* %3) {
%5 = alloca i32
%6 = alloca i8*
%7 = alloca i32
%8 = alloca i8*
%9 = alloca i8*
%10 = alloca i32
%11 = alloca i8*
%12 = alloca i8*
store i8* %0, i8** %6
store i32 %1, i32* %7
store i8* %2, i8** %8
store i8* %3, i8** %9
store i32 0, i32* %10
%13 = load i8*, i8** %6
%14 = icmp ne i8* %13, null
br i1 %14, label %15, label %21
15: ; preds = %4
%16 = load i8*, i8** %8
%17 = icmp ne i8* %16, null
br i1 %17, label %18, label %21
18: ; preds = %15
%19 = load i8*, i8** %9
%20 = icmp ne i8* %19, null
br i1 %20, label %22, label %21
21: ; preds = %18, %15, %4
store i32 -1, i32* %5
br label %76
22: ; preds = %18
%23 = load i8*, i8** %6
%24 = load i8*, i8** %8
%25 = call i8* @strstr(i8* %23, i8* %24)
store i8* %25, i8** %12
%26 = load i8*, i8** %12
%27 = icmp ne i8* %26, null
br i1 %27, label %28, label %58
28: ; preds = %22
%29 = load i32, i32* %7
%30 = call i8* @malloc(i32 %29)
store i8* %30, i8** %11
store i32 1, i32* %10
%31 = load i8*, i8** %12
store i8 0, i8* %31
%32 = load i8*, i8** %11
%33 = load i32, i32* %7
%34 = load i8*, i8** %6
%35 = load i8*, i8** %9
%36 = load i8*, i8** %12
%37 = load i8*, i8** %8
%38 = call i32 @strlen(i8* %37)
%39 = sext i32 %38 to i64
%40 = getelementptr inbounds i8, i8* %36, i64 %39
%41 = call i32 @snprintf(i8* %32, i32 %33, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0), i8* %34, i8* %35, i8* %40)
%42 = load i8*, i8** %9
%43 = call i32 @strlen(i8* %42)
%44 = load i8*, i8** %12
%45 = sext i32 %43 to i64
%46 = getelementptr inbounds i8, i8* %44, i64 %45
store i8* %46, i8** %12
%47 = load i8*, i8** %6
%48 = load i8*, i8** %11
%49 = load i32, i32* %7
%50 = call i32 @strncpy(i8* %47, i8* %48, i32 %49)
%51 = load i8*, i8** %6
%52 = load i32, i32* %7
%53 = sub nsw i32 %52, 1
%54 = sext i32 %53 to i64
%55 = getelementptr inbounds i8, i8* %51, i64 %54
store i8 0, i8* %55
%56 = load i8*, i8** %11
%57 = call i32 @free(i8* %56)
br label %58
58: ; preds = %28, %22
%59 = load i32, i32* %10
%60 = icmp ne i32 %59, 0
br i1 %60, label %61, label %75
61: ; preds = %58
%62 = load i8*, i8** %12
%63 = load i32, i32* %7
%64 = sext i32 %63 to i64
%65 = load i8*, i8** %12
%66 = load i8*, i8** %6
%67 = ptrtoint i8* %65 to i64
%68 = ptrtoint i8* %66 to i64
%69 = sub i64 %67, %68
%70 = sub nsw i64 %64, %69
%71 = trunc i64 %70 to i32
%72 = load i8*, i8** %8
%73 = load i8*, i8** %9
%74 = call i32 @searchreplace(i8* %62, i32 %71, i8* %72, i8* %73)
br label %75
75: ; preds = %61, %58
store i32 0, i32* %5
br label %76
76: ; preds = %75, %21
%77 = load i32, i32* %5
ret i32 %77
}

LLVM IR (-O2):
@.str = [7 x i8] c"%s%s%s\00"
define i32 @searchreplace(i8* %0, i32 %1, i8* %2, i8* %3) {
%5 = icmp ne i8* %2, null
%6 = icmp ne i8* %3, null
%7 = icmp ne i8* %0, null
%8 = and i1 %5, %7
%9 = and i1 %6, %8
br i1 %9, label %10, label %37
10: ; preds = %4
%11 = tail call i8* @strstr(i8* %0, i8* %2)
%12 = icmp eq i8* %11, null
br i1 %12, label %37, label %13
13: ; preds = %10, %13
%14 = phi i8* [ %35, %13 ], [ %11, %10 ]
%15 = phi i8* [ %24, %13 ], [ %0, %10 ]
%16 = phi i32 [ %34, %13 ], [ %1, %10 ]
%17 = tail call i8* @malloc(i32 %16)
store i8 0, i8* %14
%18 = tail call i32 @strlen(i8* %2)
%19 = sext i32 %18 to i64
%20 = getelementptr inbounds i8, i8* %14, i64 %19
%21 = tail call i32 @snprintf(i8* %17, i32 %16, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0), i8* %15, i8* %3, i8* %20)
%22 = tail call i32 @strlen(i8* %3)
%23 = sext i32 %22 to i64
%24 = getelementptr inbounds i8, i8* %14, i64 %23
%25 = tail call i32 @strncpy(i8* %15, i8* %17, i32 %16)
%26 = add nsw i32 %16, -1
%27 = sext i32 %26 to i64
%28 = getelementptr inbounds i8, i8* %15, i64 %27
store i8 0, i8* %28
%29 = tail call i32 @free(i8* %17)
%30 = ptrtoint i8* %24 to i64
%31 = ptrtoint i8* %15 to i64
%32 = sub i64 %31, %30
%33 = trunc i64 %32 to i32
%34 = add i32 %16, %33
%35 = tail call i8* @strstr(i8* %24, i8* %2)
%36 = icmp eq i8* %35, null
br i1 %36, label %37, label %13
37: ; preds = %13, %10, %4
%38 = phi i32 [ -1, %4 ], [ 0, %10 ], [ 0, %13 ]
ret i32 %38
}