#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct sockaddr_in {
  int dummy;
};
typedef int /*<<< orphan*/ passwd;
typedef int /*<<< orphan*/ login;

/* Variables and functions */
int /*<<< orphan*/ LOG_ERR;
int /*<<< orphan*/ LOG_INFO;
int /*<<< orphan*/ LOG_LOCAL0;
int LOG_NDELAY;
int LOG_PID;
int /*<<< orphan*/ exit(int);
int /*<<< orphan*/ memset(char *, int /*<<< orphan*/, int);
int /*<<< orphan*/ openlog(char *, int, int /*<<< orphan*/);
int read(int /*<<< orphan*/, char *, int);
int /*<<< orphan*/ respond(char *);
int /*<<< orphan*/ syslog(int /*<<< orphan*/, char *, char *, int);
int /*<<< orphan*/ vul();
int main() {
  struct sockaddr_in sin;
  int i, len = sizeof(struct sockaddr_in);
  char login[16];
  char passwd[1024];
  openlog("fmtd", LOG_NDELAY | LOG_PID, LOG_LOCAL0);
  memset(login, 0, sizeof(login));
  respond("login: ");
  if ((len = read(0, login, sizeof(login))) <= 0) {
    syslog(LOG_ERR, "login -> error while reading login [%s] (%d)", login, len);
    exit(-1);
  } else
    syslog(LOG_INFO, "login -> read login [%s] (%d) bytes", login, len);
  memset(passwd, 0, sizeof(passwd));
  respond("password: ");
  if ((len = read(0, passwd, sizeof(passwd))) <= 0) {
    syslog(LOG_ERR, "passwd -> error while reading passwd [%s] (%d)", passwd,
           len);
    exit(-1);
  } else
    syslog(LOG_INFO, "passwd -> read passwd [%x] (%d) bytes", passwd, len);
  vul();
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x420,%rsp
movl   $0x0,-0x4(%rbp)
movl   $0x4,-0x10(%rbp)
mov    0x2e30(%rip),%rax
mov    (%rax),%esi
mov    0x2e3f(%rip),%rax
or     (%rax),%esi
mov    0x2e46(%rip),%rax
mov    (%rax),%edx
lea    0xe55(%rip),%rdi
call   1070 <openlog@plt>
lea    -0x20(%rbp),%rdi
xor    %esi,%esi
mov    $0x10,%edx
call   1040 <memset@plt>
lea    0xe3e(%rip),%rdi
call   1030 <respond@plt>
lea    -0x20(%rbp),%rsi
xor    %edi,%edi
mov    $0x10,%edx
call   1050 <read@plt>
mov    %eax,-0x10(%rbp)
cmp    $0x0,%eax
jg     120e <main+0x9e>
mov    0x2dc9(%rip),%rax
mov    (%rax),%edi
lea    -0x20(%rbp),%rdx
mov    -0x10(%rbp),%ecx
lea    0xe0e(%rip),%rsi
call   1060 <syslog@plt>
mov    $0xffffffff,%edi
call   1090 <exit@plt>
mov    0x2dbb(%rip),%rax
mov    (%rax),%edi
lea    -0x20(%rbp),%rdx
mov    -0x10(%rbp),%ecx
lea    0xe15(%rip),%rsi
call   1060 <syslog@plt>
lea    -0x420(%rbp),%rdi
xor    %esi,%esi
mov    $0x400,%edx
call   1040 <memset@plt>
lea    0xe1a(%rip),%rdi
call   1030 <respond@plt>
lea    -0x420(%rbp),%rsi
xor    %edi,%edi
mov    $0x400,%edx
call   1050 <read@plt>
mov    %eax,-0x10(%rbp)
cmp    $0x0,%eax
jg     1291 <main+0x121>
mov    0x2d49(%rip),%rax
mov    (%rax),%edi
lea    -0x420(%rbp),%rdx
mov    -0x10(%rbp),%ecx
lea    0xde7(%rip),%rsi
call   1060 <syslog@plt>
mov    $0xffffffff,%edi
call   1090 <exit@plt>
mov    0x2d38(%rip),%rax
mov    (%rax),%edi
lea    -0x420(%rbp),%rdx
mov    -0x10(%rbp),%ecx
lea    0xded(%rip),%rsi
call   1060 <syslog@plt>
mov    $0x0,%al
call   1080 <vul@plt>
xor    %eax,%eax
add    $0x420,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r14
push   %rbx
sub    $0x418,%rsp
mov    0x2e3f(%rip),%rax
mov    0x2e50(%rip),%rcx
mov    (%rcx),%esi
or     (%rax),%esi
mov    0x2e55(%rip),%rax
mov    (%rax),%edx
lea    0xe64(%rip),%rdi
call   1070 <openlog@plt>
mov    %rsp,%rbx
mov    %rbx,%rdi
xor    %esi,%esi
mov    $0x10,%edx
call   1040 <memset@plt>
lea    0xe4b(%rip),%rdi
call   1030 <respond@plt>
xor    %edi,%edi
mov    %rbx,%rsi
mov    $0x10,%edx
call   1050 <read@plt>
test   %eax,%eax
jle    124a <main+0xda>
mov    0x2df7(%rip),%r14
mov    (%r14),%edi
lea    0xe57(%rip),%rsi
mov    %rsp,%rdx
mov    %eax,%ecx
call   1060 <syslog@plt>
lea    0x10(%rsp),%rbx
mov    %rbx,%rdi
xor    %esi,%esi
mov    $0x400,%edx
call   1040 <memset@plt>
lea    0xe56(%rip),%rdi
call   1030 <respond@plt>
xor    %edi,%edi
mov    %rbx,%rsi
mov    $0x400,%edx
call   1050 <read@plt>
test   %eax,%eax
jle    125f <main+0xef>
mov    (%r14),%edi
lea    0xe6e(%rip),%rsi
lea    0x10(%rsp),%rdx
mov    %eax,%ecx
call   1060 <syslog@plt>
xor    %eax,%eax
call   1080 <vul@plt>
xor    %eax,%eax
add    $0x418,%rsp
pop    %rbx
pop    %r14
ret
mov    0x2d67(%rip),%rcx
mov    (%rcx),%edi
lea    0xdb3(%rip),%rsi
mov    %rsp,%rdx
jmp    1274 <main+0x104>
mov    0x2d52(%rip),%rcx
mov    (%rcx),%edi
lea    0xdfa(%rip),%rsi
lea    0x10(%rsp),%rdx
mov    %eax,%ecx
call   1060 <syslog@plt>
mov    $0xffffffff,%edi
call   1090 <exit@plt>

LLVM IR (-O0):
%struct.sockaddr_in = type { i32 }
@.str = [5 x i8] c"fmtd\00"
@LOG_NDELAY = global i32 0
@LOG_PID = global i32 0
@LOG_LOCAL0 = global i32 0
@.str.1 = [8 x i8] c"login: \00"
@LOG_ERR = global i32 0
@.str.2 = [45 x i8] c"login -> error while reading login [%s] (%d)\00"
@LOG_INFO = global i32 0
@.str.3 = [36 x i8] c"login -> read login [%s] (%d) bytes\00"
@.str.4 = [11 x i8] c"password: \00"
@.str.5 = [47 x i8] c"passwd -> error while reading passwd [%s] (%d)\00"
@.str.6 = [38 x i8] c"passwd -> read passwd [%x] (%d) bytes\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca %struct.sockaddr_in
%3 = alloca i32
%4 = alloca i32
%5 = alloca [16 x i8]
%6 = alloca [1024 x i8]
store i32 0, i32* %1
store i32 4, i32* %4
%7 = load i32, i32* @LOG_NDELAY
%8 = load i32, i32* @LOG_PID
%9 = or i32 %7, %8
%10 = load i32, i32* @LOG_LOCAL0
%11 = call i32 @openlog(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %9, i32 %10)
%12 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 0
%13 = call i32 @memset(i8* %12, i32 0, i32 16)
%14 = call i32 @respond(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0))
%15 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 0
%16 = call i32 @read(i32 0, i8* %15, i32 16)
store i32 %16, i32* %4
%17 = icmp sle i32 %16, 0
br i1 %17, label %18, label %24
18: ; preds = %0
%19 = load i32, i32* @LOG_ERR
%20 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 0
%21 = load i32, i32* %4
%22 = call i32 @syslog(i32 %19, i8* getelementptr inbounds ([45 x i8], [45 x i8]* @.str.2, i64 0, i64 0), i8* %20, i32 %21)
%23 = call i32 @exit(i32 -1)
unreachable
24: ; preds = %0
%25 = load i32, i32* @LOG_INFO
%26 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 0
%27 = load i32, i32* %4
%28 = call i32 @syslog(i32 %25, i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str.3, i64 0, i64 0), i8* %26, i32 %27)
br label %29
29: ; preds = %24
%30 = getelementptr inbounds [1024 x i8], [1024 x i8]* %6, i64 0, i64 0
%31 = call i32 @memset(i8* %30, i32 0, i32 1024)
%32 = call i32 @respond(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.4, i64 0, i64 0))
%33 = getelementptr inbounds [1024 x i8], [1024 x i8]* %6, i64 0, i64 0
%34 = call i32 @read(i32 0, i8* %33, i32 1024)
store i32 %34, i32* %4
%35 = icmp sle i32 %34, 0
br i1 %35, label %36, label %42
36: ; preds = %29
%37 = load i32, i32* @LOG_ERR
%38 = getelementptr inbounds [1024 x i8], [1024 x i8]* %6, i64 0, i64 0
%39 = load i32, i32* %4
%40 = call i32 @syslog(i32 %37, i8* getelementptr inbounds ([47 x i8], [47 x i8]* @.str.5, i64 0, i64 0), i8* %38, i32 %39)
%41 = call i32 @exit(i32 -1)
unreachable
42: ; preds = %29
%43 = load i32, i32* @LOG_INFO
%44 = getelementptr inbounds [1024 x i8], [1024 x i8]* %6, i64 0, i64 0
%45 = load i32, i32* %4
%46 = call i32 @syslog(i32 %43, i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.6, i64 0, i64 0), i8* %44, i32 %45)
br label %47
47: ; preds = %42
%48 = call i32 (...) @vul()
ret i32 0
}

LLVM IR (-O2):
@.str = [5 x i8] c"fmtd\00"
@LOG_NDELAY = global i32 0
@LOG_PID = global i32 0
@LOG_LOCAL0 = global i32 0
@.str.1 = [8 x i8] c"login: \00"
@LOG_ERR = global i32 0
@.str.2 = [45 x i8] c"login -> error while reading login [%s] (%d)\00"
@LOG_INFO = global i32 0
@.str.3 = [36 x i8] c"login -> read login [%s] (%d) bytes\00"
@.str.4 = [11 x i8] c"password: \00"
@.str.5 = [47 x i8] c"passwd -> error while reading passwd [%s] (%d)\00"
@.str.6 = [38 x i8] c"passwd -> read passwd [%x] (%d) bytes\00"
define i32 @main() {
%1 = alloca [16 x i8]
%2 = alloca [1024 x i8]
%3 = getelementptr inbounds [16 x i8], [16 x i8]* %1, i64 0, i64 0
%4 = getelementptr inbounds [1024 x i8], [1024 x i8]* %2, i64 0, i64 0
%5 = load i32, i32* @LOG_NDELAY
%6 = load i32, i32* @LOG_PID
%7 = or i32 %6, %5
%8 = load i32, i32* @LOG_LOCAL0
%9 = tail call i32 @openlog(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %7, i32 %8)
%10 = call i32 @memset(i8* %3, i32 0, i32 16)
%11 = call i32 @respond(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0))
%12 = call i32 @read(i32 0, i8* %3, i32 16)
%13 = icmp slt i32 %12, 1
br i1 %13, label %14, label %18
14: ; preds = %0
%15 = load i32, i32* @LOG_ERR
%16 = call i32 @syslog(i32 %15, i8* getelementptr inbounds ([45 x i8], [45 x i8]* @.str.2, i64 0, i64 0), i8* %3, i32 %12)
%17 = call i32 @exit(i32 -1)
unreachable
18: ; preds = %0
%19 = load i32, i32* @LOG_INFO
%20 = call i32 @syslog(i32 %19, i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str.3, i64 0, i64 0), i8* %3, i32 %12)
%21 = call i32 @memset(i8* %4, i32 0, i32 1024)
%22 = call i32 @respond(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.4, i64 0, i64 0))
%23 = call i32 @read(i32 0, i8* %4, i32 1024)
%24 = icmp slt i32 %23, 1
br i1 %24, label %25, label %29
25: ; preds = %18
%26 = load i32, i32* @LOG_ERR
%27 = call i32 @syslog(i32 %26, i8* getelementptr inbounds ([47 x i8], [47 x i8]* @.str.5, i64 0, i64 0), i8* %4, i32 %23)
%28 = call i32 @exit(i32 -1)
unreachable
29: ; preds = %18
%30 = load i32, i32* @LOG_INFO
%31 = call i32 @syslog(i32 %30, i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.6, i64 0, i64 0), i8* %4, i32 %23)
%32 = call i32 (...) @vul()
ret i32 0
}