#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ malloc(int);
char *strndup(char *, int);
int unknown();
void strndup_3_Bad() {
  int size = unknown();
  if (size >= 10) {
    char *s1 = (char *)malloc(sizeof(char) * size);
    s1[5] = '\0';
    char *s2 = strndup(s1, size - 1);
    for (int i = 0; i < size - 1; i++) {
      s2[i] = 'a';
    }
  }
}


x86 assembly (clang, -O0):
<strndup_3_Bad>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    $0x0,%al
call   1040 <unknown@plt>
mov    %eax,-0x4(%rbp)
cmpl   $0xa,-0x4(%rbp)
jl     11b1 <strndup_3_Bad+0x81>
movslq -0x4(%rbp),%rax
shl    $0x0,%rax
mov    %eax,%edi
call   1050 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
movb   $0x0,0x5(%rax)
mov    -0x10(%rbp),%rdi
mov    -0x4(%rbp),%esi
sub    $0x1,%esi
call   1030 <strndup@plt>
mov    %rax,-0x18(%rbp)
movl   $0x0,-0x1c(%rbp)
mov    -0x1c(%rbp),%eax
mov    -0x4(%rbp),%ecx
sub    $0x1,%ecx
cmp    %ecx,%eax
jge    11ac <strndup_3_Bad+0x7c>
mov    -0x18(%rbp),%rax
movslq -0x1c(%rbp),%rcx
movb   $0x61,(%rax,%rcx,1)
mov    -0x1c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c(%rbp)
jmp    1181 <strndup_3_Bad+0x51>
jmp    11b1 <strndup_3_Bad+0x81>
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<strndup_3_Bad>:
push   %rax
xor    %eax,%eax
call   1030 <unknown@plt>
cmp    $0xa,%eax
jl     1138 <strndup_3_Bad+0x18>
mov    %eax,%edi
call   1040 <malloc@plt>
movb   $0x0,0x5(%rax)
pop    %rax
ret

LLVM IR (-O0):
define void @strndup_3_Bad() {
%1 = alloca i32
%2 = alloca i8*
%3 = alloca i8*
%4 = alloca i32
%5 = call i32 (...) @unknown()
store i32 %5, i32* %1
%6 = load i32, i32* %1
%7 = icmp sge i32 %6, 10
br i1 %7, label %8, label %35
8: ; preds = %0
%9 = load i32, i32* %1
%10 = sext i32 %9 to i64
%11 = mul i64 1, %10
%12 = trunc i64 %11 to i32
%13 = call i64 @malloc(i32 %12)
%14 = inttoptr i64 %13 to i8*
store i8* %14, i8** %2
%15 = load i8*, i8** %2
%16 = getelementptr inbounds i8, i8* %15, i64 5
store i8 0, i8* %16
%17 = load i8*, i8** %2
%18 = load i32, i32* %1
%19 = sub nsw i32 %18, 1
%20 = call i8* @strndup(i8* %17, i32 %19)
store i8* %20, i8** %3
store i32 0, i32* %4
br label %21
21: ; preds = %31, %8
%22 = load i32, i32* %4
%23 = load i32, i32* %1
%24 = sub nsw i32 %23, 1
%25 = icmp slt i32 %22, %24
br i1 %25, label %26, label %34
26: ; preds = %21
%27 = load i8*, i8** %3
%28 = load i32, i32* %4
%29 = sext i32 %28 to i64
%30 = getelementptr inbounds i8, i8* %27, i64 %29
store i8 97, i8* %30
br label %31
31: ; preds = %26
%32 = load i32, i32* %4
%33 = add nsw i32 %32, 1
store i32 %33, i32* %4
br label %21
34: ; preds = %21
br label %35
35: ; preds = %34, %0
ret void
}

LLVM IR (-O2):
define void @strndup_3_Bad() {
%1 = tail call i32 (...) @unknown()
%2 = icmp sgt i32 %1, 9
br i1 %2, label %3, label %7
3: ; preds = %0
%4 = tail call i64 @malloc(i32 %1)
%5 = inttoptr i64 %4 to i8*
%6 = getelementptr inbounds i8, i8* %5, i64 5
store i8 0, i8* %6
br label %7
7: ; preds = %3, %0
ret void
}