#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ alloca(int);
char *crypt(char *, char *);
int /*<<< orphan*/ exit(int);
int /*<<< orphan*/ *fgets(char *, int, int /*<<< orphan*/);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, char *);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ stderr;
int /*<<< orphan*/ stdin;
size_t strlen(char *);
void CWE535_Info_Exposure_Shell_Error__w32_char_01_bad() {
  {
    char password[100] = "";
    char *epasswd = (char *)alloca(100 * sizeof(char));
    size_t passwordLen = 0;
    if (fgets(password, 100, stdin) == NULL) {
      printf("fgets() failed\n");
      password[0] = '\0';
    }
    passwordLen = strlen(password);
    if (passwordLen > 0) {
      password[passwordLen - 1] = '\0';
    }
    epasswd = crypt(password, "ab");
    if (epasswd == NULL) {
      printf("crypt error\n");
      exit(1);
    }
    printf("passwd=%s, epasswd=%s\n", password, epasswd);
    fprintf(stderr, "User attempted access with password: %s\n", password);
  }
}


x86 assembly (clang, -O0):
<CWE535_Info_Exposure_Shell_Error__w32_char_01_bad>:
push   %rbp
mov    %rsp,%rbp
sub    $0x80,%rsp
lea    -0x70(%rbp),%rdi
xor    %esi,%esi
mov    $0x64,%edx
call   1060 <memset@plt>
mov    $0x64,%edi
call   1090 <alloca@plt>
mov    %rax,-0x78(%rbp)
movq   $0x0,-0x80(%rbp)
lea    -0x70(%rbp),%rdi
mov    0x2e2c(%rip),%rax
mov    (%rax),%edx
mov    $0x64,%esi
call   1070 <fgets@plt>
cmp    $0x0,%rax
jne    11e4 <CWE535_Info_Exposure_Shell_Error__w32_char_01_bad+0x64>
lea    0xe27(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
movb   $0x0,-0x70(%rbp)
lea    -0x70(%rbp),%rdi
call   1040 <strlen@plt>
mov    %rax,-0x80(%rbp)
cmpq   $0x0,-0x80(%rbp)
jbe    1209 <CWE535_Info_Exposure_Shell_Error__w32_char_01_bad+0x89>
mov    -0x80(%rbp),%rax
sub    $0x1,%rax
movb   $0x0,-0x70(%rbp,%rax,1)
lea    -0x70(%rbp),%rdi
lea    0xdfc(%rip),%rsi
call   1030 <crypt@plt>
mov    %rax,-0x78(%rbp)
cmpq   $0x0,-0x78(%rbp)
jne    1240 <CWE535_Info_Exposure_Shell_Error__w32_char_01_bad+0xc0>
lea    0xde4(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    $0x1,%edi
call   10a0 <exit@plt>
lea    -0x70(%rbp),%rsi
mov    -0x78(%rbp),%rdx
lea    0xdd1(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    0x2d7b(%rip),%rax
mov    (%rax),%edi
lea    -0x70(%rbp),%rdx
lea    0xdcd(%rip),%rsi
call   1080 <fprintf@plt>
add    $0x80,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<CWE535_Info_Exposure_Shell_Error__w32_char_01_bad>:
push   %rbx
sub    $0x70,%rsp
xorps  %xmm0,%xmm0
movaps %xmm0,0x50(%rsp)
movaps %xmm0,0x40(%rsp)
movaps %xmm0,0x30(%rsp)
movaps %xmm0,0x20(%rsp)
movaps %xmm0,0x10(%rsp)
movaps %xmm0,(%rsp)
movl   $0x0,0x60(%rsp)
mov    $0x64,%edi
call   1090 <alloca@plt>
mov    0x2e2a(%rip),%rax
mov    (%rax),%edx
mov    %rsp,%rdi
mov    $0x64,%esi
call   1070 <fgets@plt>
test   %rax,%rax
jne    11e2 <CWE535_Info_Exposure_Shell_Error__w32_char_01_bad+0x62>
lea    0xe76(%rip),%rdi
call   1030 <puts@plt>
movb   $0x0,(%rsp)
mov    %rsp,%rbx
mov    %rbx,%rdi
call   1050 <strlen@plt>
test   %rax,%rax
je     11f7 <CWE535_Info_Exposure_Shell_Error__w32_char_01_bad+0x77>
movb   $0x0,-0x1(%rax,%rbx,1)
lea    0xe02(%rip),%rsi
mov    %rsp,%rdi
call   1040 <crypt@plt>
test   %rax,%rax
je     1240 <CWE535_Info_Exposure_Shell_Error__w32_char_01_bad+0xc0>
lea    0xdf1(%rip),%rdi
mov    %rsp,%rbx
mov    %rbx,%rsi
mov    %rax,%rdx
xor    %eax,%eax
call   1060 <printf@plt>
mov    0x2daf(%rip),%rax
mov    (%rax),%edi
lea    0xde8(%rip),%rsi
mov    %rbx,%rdx
call   1080 <fprintf@plt>
add    $0x70,%rsp
pop    %rbx
ret
lea    0xdfc(%rip),%rdi
call   1030 <puts@plt>
mov    $0x1,%edi
call   10a0 <exit@plt>

LLVM IR (-O0):
@stdin = global i32 0
@.str = [16 x i8] c"fgets() failed\0A\00"
@.str.1 = [3 x i8] c"ab\00"
@.str.2 = [13 x i8] c"crypt error\0A\00"
@.str.3 = [23 x i8] c"passwd=%s, epasswd=%s\0A\00"
@stderr = global i32 0
@.str.4 = [41 x i8] c"User attempted access with password: %s\0A\00"
define void @CWE535_Info_Exposure_Shell_Error__w32_char_01_bad() {
%1 = alloca [100 x i8]
%2 = alloca i8*
%3 = alloca i64
%4 = bitcast [100 x i8]* %1 to i8*
%5 = call i64 @alloca(i32 100)
%6 = inttoptr i64 %5 to i8*
store i8* %6, i8** %2
store i64 0, i64* %3
%7 = getelementptr inbounds [100 x i8], [100 x i8]* %1, i64 0, i64 0
%8 = load i32, i32* @stdin
%9 = call i32* @fgets(i8* %7, i32 100, i32 %8)
%10 = icmp eq i32* %9, null
br i1 %10, label %11, label %14
11: ; preds = %0
%12 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str, i64 0, i64 0))
%13 = getelementptr inbounds [100 x i8], [100 x i8]* %1, i64 0, i64 0
store i8 0, i8* %13
br label %14
14: ; preds = %11, %0
%15 = getelementptr inbounds [100 x i8], [100 x i8]* %1, i64 0, i64 0
%16 = call i64 @strlen(i8* %15)
store i64 %16, i64* %3
%17 = load i64, i64* %3
%18 = icmp ugt i64 %17, 0
br i1 %18, label %19, label %23
19: ; preds = %14
%20 = load i64, i64* %3
%21 = sub i64 %20, 1
%22 = getelementptr inbounds [100 x i8], [100 x i8]* %1, i64 0, i64 %21
store i8 0, i8* %22
br label %23
23: ; preds = %19, %14
%24 = getelementptr inbounds [100 x i8], [100 x i8]* %1, i64 0, i64 0
%25 = call i8* @crypt(i8* %24, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0))
store i8* %25, i8** %2
%26 = load i8*, i8** %2
%27 = icmp eq i8* %26, null
br i1 %27, label %28, label %31
28: ; preds = %23
%29 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.2, i64 0, i64 0))
%30 = call i32 @exit(i32 1)
unreachable
31: ; preds = %23
%32 = getelementptr inbounds [100 x i8], [100 x i8]* %1, i64 0, i64 0
%33 = load i8*, i8** %2
%34 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.3, i64 0, i64 0), i8* %32, i8* %33)
%35 = load i32, i32* @stderr
%36 = getelementptr inbounds [100 x i8], [100 x i8]* %1, i64 0, i64 0
%37 = call i32 @fprintf(i32 %35, i8* getelementptr inbounds ([41 x i8], [41 x i8]* @.str.4, i64 0, i64 0), i8* %36)
ret void
}

LLVM IR (-O2):
@stdin = global i32 0
@.str.1 = [3 x i8] c"ab\00"
@.str.3 = [23 x i8] c"passwd=%s, epasswd=%s\0A\00"
@stderr = global i32 0
@.str.4 = [41 x i8] c"User attempted access with password: %s\0A\00"
@str = [12 x i8] c"crypt error\00"
@str.5 = [15 x i8] c"fgets() failed\00"
define void @CWE535_Info_Exposure_Shell_Error__w32_char_01_bad() {
%1 = alloca [100 x i8]
%2 = getelementptr inbounds [100 x i8], [100 x i8]* %1, i64 0, i64 0
%3 = tail call i64 @alloca(i32 100)
%4 = load i32, i32* @stdin
%5 = call i32* @fgets(i8* %2, i32 100, i32 %4)
%6 = icmp eq i32* %5, null
br i1 %6, label %7, label %9
7: ; preds = %0
%8 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([15 x i8], [15 x i8]* @str.5, i64 0, i64 0))
store i8 0, i8* %2
br label %9
9: ; preds = %7, %0
%10 = call i64 @strlen(i8* %2)
%11 = icmp eq i64 %10, 0
br i1 %11, label %15, label %12
12: ; preds = %9
%13 = add i64 %10, -1
%14 = getelementptr inbounds [100 x i8], [100 x i8]* %1, i64 0, i64 %13
store i8 0, i8* %14
br label %15
15: ; preds = %12, %9
%16 = call i8* @crypt(i8* %2, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0))
%17 = icmp eq i8* %16, null
br i1 %17, label %18, label %21
18: ; preds = %15
%19 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([12 x i8], [12 x i8]* @str, i64 0, i64 0))
%20 = call i32 @exit(i32 1)
unreachable
21: ; preds = %15
%22 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @.str.3, i64 0, i64 0), i8* %2, i8* %16)
%23 = load i32, i32* @stderr
%24 = call i32 @fprintf(i32 %23, i8* getelementptr inbounds ([41 x i8], [41 x i8]* @.str.4, i64 0, i64 0), i8* %2)
ret void
}