#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *);
int /*<<< orphan*/ free(char *);
char *malloc(size_t);
int /*<<< orphan*/ memmove(char *, char const *, size_t);
char *realloc(char *, size_t);
int /*<<< orphan*/ stderr;
int /*<<< orphan*/ strcpy(char *, char const *);
size_t strlen(char const *);
void *strstr(char const *, char const *);
char *replace_after(const char *src, const char *from, const char *until,
                    const char *to, int or_end) {
  size_t size = strlen(src) + 1;
  size_t tolen = strlen(to);
  char *dst;
  char *value = malloc(size);
  if (value == NULL) {
    fprintf(stderr, "Cannot allocate memory\n");
    return NULL;
  }
  dst = value;
  if (value != NULL) {
    for (;;) {
      const char *match1 = strstr(src, from);
      if (match1 != NULL) {
        char *match2 = strstr(match1 + strlen(from), until);
        if (match2 == NULL) {
          if (or_end == 1)
            match2 = (char *)src + strlen(src) - 1;
          else {
            strcpy(dst, src);
            break;
          }
        }
        size_t count = match1 - src;
        size_t diff = match2 - match1;
        char *temp;
        size += (tolen - diff);
        temp = realloc(value, size);
        if (temp == NULL) {
          fprintf(stderr, "Cannot re-allocate memory\n");
          free(value);
          return NULL;
        }
        dst = temp + (dst - value);
        value = temp;
        memmove(dst, src, count);
        src += count;
        dst += count;
        memmove(dst, to, tolen);
        src += diff;
        dst += tolen;
      } else {
        strcpy(dst, src);
        break;
      }
    }
  }
  return value;
}


x86 assembly (clang, -O0):
<replace_after>:
push   %rbp
mov    %rsp,%rbp
sub    $0x90,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
mov    %r8d,-0x2c(%rbp)
mov    -0x10(%rbp),%rdi
call   1050 <strlen@plt>
add    $0x1,%rax
mov    %rax,-0x38(%rbp)
mov    -0x28(%rbp),%rdi
call   1050 <strlen@plt>
mov    %rax,-0x40(%rbp)
mov    -0x38(%rbp),%rdi
call   1070 <malloc@plt>
mov    %rax,-0x50(%rbp)
cmpq   $0x0,-0x50(%rbp)
jne    11f7 <replace_after+0x77>
mov    0x2e04(%rip),%rax
mov    (%rax),%edi
lea    0xe1b(%rip),%rsi
call   1060 <fprintf@plt>
movq   $0x0,-0x8(%rbp)
jmp    13b8 <replace_after+0x238>
mov    -0x50(%rbp),%rax
mov    %rax,-0x48(%rbp)
cmpq   $0x0,-0x50(%rbp)
je     13b0 <replace_after+0x230>
jmp    120f <replace_after+0x8f>
mov    -0x10(%rbp),%rdi
mov    -0x18(%rbp),%rsi
call   10a0 <strstr@plt>
mov    %rax,-0x58(%rbp)
cmpq   $0x0,-0x58(%rbp)
je     1394 <replace_after+0x214>
mov    -0x58(%rbp),%rax
mov    %rax,-0x80(%rbp)
mov    -0x18(%rbp),%rdi
call   1050 <strlen@plt>
mov    -0x80(%rbp),%rdi
add    %rax,%rdi
mov    -0x20(%rbp),%rsi
call   10a0 <strstr@plt>
mov    %rax,-0x60(%rbp)
cmpq   $0x0,-0x60(%rbp)
jne    12aa <replace_after+0x12a>
cmpl   $0x1,-0x2c(%rbp)
jne    1293 <replace_after+0x113>
mov    -0x10(%rbp),%rax
mov    %rax,-0x88(%rbp)
mov    -0x10(%rbp),%rdi
call   1050 <strlen@plt>
mov    %rax,%rcx
mov    -0x88(%rbp),%rax
add    %rcx,%rax
add    $0xffffffffffffffff,%rax
mov    %rax,-0x60(%rbp)
jmp    12a5 <replace_after+0x125>
mov    -0x48(%rbp),%rdi
mov    -0x10(%rbp),%rsi
call   1040 <strcpy@plt>
jmp    13ab <replace_after+0x22b>
jmp    12aa <replace_after+0x12a>
mov    -0x58(%rbp),%rax
mov    -0x10(%rbp),%rcx
sub    %rcx,%rax
mov    %rax,-0x68(%rbp)
mov    -0x60(%rbp),%rax
mov    -0x58(%rbp),%rcx
sub    %rcx,%rax
mov    %rax,-0x70(%rbp)
mov    -0x40(%rbp),%rax
sub    -0x70(%rbp),%rax
add    -0x38(%rbp),%rax
mov    %rax,-0x38(%rbp)
mov    -0x50(%rbp),%rdi
mov    -0x38(%rbp),%rsi
call   1080 <realloc@plt>
mov    %rax,-0x78(%rbp)
cmpq   $0x0,-0x78(%rbp)
jne    131f <replace_after+0x19f>
mov    0x2ce5(%rip),%rax
mov    (%rax),%edi
lea    0xd14(%rip),%rsi
call   1060 <fprintf@plt>
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
movq   $0x0,-0x8(%rbp)
jmp    13b8 <replace_after+0x238>
mov    -0x78(%rbp),%rax
mov    -0x48(%rbp),%rcx
mov    -0x50(%rbp),%rdx
sub    %rdx,%rcx
add    %rcx,%rax
mov    %rax,-0x48(%rbp)
mov    -0x78(%rbp),%rax
mov    %rax,-0x50(%rbp)
mov    -0x48(%rbp),%rdi
mov    -0x10(%rbp),%rsi
mov    -0x68(%rbp),%rdx
call   1090 <memmove@plt>
mov    -0x68(%rbp),%rax
add    -0x10(%rbp),%rax
mov    %rax,-0x10(%rbp)
mov    -0x68(%rbp),%rax
add    -0x48(%rbp),%rax
mov    %rax,-0x48(%rbp)
mov    -0x48(%rbp),%rdi
mov    -0x28(%rbp),%rsi
mov    -0x40(%rbp),%rdx
call   1090 <memmove@plt>
mov    -0x70(%rbp),%rax
add    -0x10(%rbp),%rax
mov    %rax,-0x10(%rbp)
mov    -0x40(%rbp),%rax
add    -0x48(%rbp),%rax
mov    %rax,-0x48(%rbp)
jmp    13a6 <replace_after+0x226>
mov    -0x48(%rbp),%rdi
mov    -0x10(%rbp),%rsi
call   1040 <strcpy@plt>
jmp    13ab <replace_after+0x22b>
jmp    120f <replace_after+0x8f>
jmp    13b0 <replace_after+0x230>
mov    -0x50(%rbp),%rax
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0x90,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<replace_after>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x38,%rsp
mov    %r8d,0x14(%rsp)
mov    %rcx,%rbp
mov    %rdx,0x30(%rsp)
mov    %rsi,%r15
mov    %rdi,%r12
call   1050 <strlen@plt>
mov    %rax,%rbx
add    $0x1,%rbx
mov    %rbp,0x28(%rsp)
mov    %rbp,%rdi
call   1050 <strlen@plt>
mov    %rax,%r14
mov    %rbx,%rdi
call   1070 <malloc@plt>
test   %rax,%rax
je     12cc <replace_after+0x14c>
mov    %rax,%rbp
mov    %r12,%rdi
mov    %r15,%rsi
call   10a0 <strstr@plt>
test   %rax,%rax
je     12e3 <replace_after+0x163>
mov    %rax,%r13
mov    %rbx,0x18(%rsp)
mov    %r14,0x8(%rsp)
mov    %rbp,%rax
mov    %r15,0x20(%rsp)
nopw   0x0(%rax,%rax,1)
mov    %rax,%r14
mov    %r15,%rdi
call   1050 <strlen@plt>
lea    (%rax,%r13,1),%rdi
mov    0x30(%rsp),%rsi
call   10a0 <strstr@plt>
mov    %rax,%r15
test   %rax,%rax
mov    0x8(%rsp),%rax
mov    0x18(%rsp),%rbx
jne    124b <replace_after+0xcb>
cmpl   $0x1,0x14(%rsp)
jne    12e6 <replace_after+0x166>
mov    %r12,%rdi
call   1050 <strlen@plt>
lea    (%r12,%rax,1),%r15
add    $0xffffffffffffffff,%r15
mov    0x8(%rsp),%rax
sub    %r13,%r15
sub    %r15,%rax
add    %rax,%rbx
mov    %r14,%rdi
mov    %rbx,0x18(%rsp)
mov    %rbx,%rsi
call   1080 <realloc@plt>
mov    0x8(%rsp),%rbx
test   %rax,%rax
je     12f6 <replace_after+0x176>
mov    %rax,%rcx
sub    %r12,%r13
sub    %r14,%rbp
mov    %rax,%r14
add    %rcx,%rbp
mov    %rbp,%rdi
mov    %r12,%rsi
mov    %r13,%rdx
call   1090 <memmove@plt>
add    %r13,%r12
add    %r13,%rbp
mov    %rbp,%rdi
mov    0x28(%rsp),%rsi
mov    %rbx,%rdx
call   1090 <memmove@plt>
add    %r15,%r12
add    %rbx,%rbp
mov    %r12,%rdi
mov    0x20(%rsp),%r15
mov    %r15,%rsi
call   10a0 <strstr@plt>
mov    %rax,%r13
mov    %r14,%rax
test   %r13,%r13
jne    1200 <replace_after+0x80>
jmp    12e6 <replace_after+0x166>
mov    0x2d0d(%rip),%rax
mov    (%rax),%edi
lea    0xd24(%rip),%rsi
call   1060 <fprintf@plt>
jmp    1313 <replace_after+0x193>
mov    %rbp,%r14
mov    %rbp,%rdi
mov    %r12,%rsi
call   1040 <strcpy@plt>
mov    %r14,%rax
jmp    1315 <replace_after+0x195>
mov    0x2ce3(%rip),%rax
mov    (%rax),%edi
lea    0xd12(%rip),%rsi
call   1060 <fprintf@plt>
mov    %r14,%rdi
call   1030 <free@plt>
xor    %eax,%eax
add    $0x38,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@stderr = global i32 0
@.str = [24 x i8] c"Cannot allocate memory\0A\00"
@.str.1 = [27 x i8] c"Cannot re-allocate memory\0A\00"
define i8* @replace_after(i8* %0, i8* %1, i8* %2, i8* %3, i32 %4) {
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i8*
%10 = alloca i8*
%11 = alloca i32
%12 = alloca i64
%13 = alloca i64
%14 = alloca i8*
%15 = alloca i8*
%16 = alloca i8*
%17 = alloca i8*
%18 = alloca i64
%19 = alloca i64
%20 = alloca i8*
store i8* %0, i8** %7
store i8* %1, i8** %8
store i8* %2, i8** %9
store i8* %3, i8** %10
store i32 %4, i32* %11
%21 = load i8*, i8** %7
%22 = call i64 @strlen(i8* %21)
%23 = add i64 %22, 1
store i64 %23, i64* %12
%24 = load i8*, i8** %10
%25 = call i64 @strlen(i8* %24)
store i64 %25, i64* %13
%26 = load i64, i64* %12
%27 = call i8* @malloc(i64 %26)
store i8* %27, i8** %15
%28 = load i8*, i8** %15
%29 = icmp eq i8* %28, null
br i1 %29, label %30, label %33
30: ; preds = %5
%31 = load i32, i32* @stderr
%32 = call i32 @fprintf(i32 %31, i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str, i64 0, i64 0))
store i8* null, i8** %6
br label %130
33: ; preds = %5
%34 = load i8*, i8** %15
store i8* %34, i8** %14
%35 = load i8*, i8** %15
%36 = icmp ne i8* %35, null
br i1 %36, label %37, label %128
37: ; preds = %33
br label %38
38: ; preds = %126, %37
%39 = load i8*, i8** %7
%40 = load i8*, i8** %8
%41 = call i8* @strstr(i8* %39, i8* %40)
store i8* %41, i8** %16
%42 = load i8*, i8** %16
%43 = icmp ne i8* %42, null
br i1 %43, label %44, label %122
44: ; preds = %38
%45 = load i8*, i8** %16
%46 = load i8*, i8** %8
%47 = call i64 @strlen(i8* %46)
%48 = getelementptr inbounds i8, i8* %45, i64 %47
%49 = load i8*, i8** %9
%50 = call i8* @strstr(i8* %48, i8* %49)
store i8* %50, i8** %17
%51 = load i8*, i8** %17
%52 = icmp eq i8* %51, null
br i1 %52, label %53, label %67
53: ; preds = %44
%54 = load i32, i32* %11
%55 = icmp eq i32 %54, 1
br i1 %55, label %56, label %62
56: ; preds = %53
%57 = load i8*, i8** %7
%58 = load i8*, i8** %7
%59 = call i64 @strlen(i8* %58)
%60 = getelementptr inbounds i8, i8* %57, i64 %59
%61 = getelementptr inbounds i8, i8* %60, i64 -1
store i8* %61, i8** %17
br label %66
62: ; preds = %53
%63 = load i8*, i8** %14
%64 = load i8*, i8** %7
%65 = call i32 @strcpy(i8* %63, i8* %64)
br label %127
66: ; preds = %56
br label %67
67: ; preds = %66, %44
%68 = load i8*, i8** %16
%69 = load i8*, i8** %7
%70 = ptrtoint i8* %68 to i64
%71 = ptrtoint i8* %69 to i64
%72 = sub i64 %70, %71
store i64 %72, i64* %18
%73 = load i8*, i8** %17
%74 = load i8*, i8** %16
%75 = ptrtoint i8* %73 to i64
%76 = ptrtoint i8* %74 to i64
%77 = sub i64 %75, %76
store i64 %77, i64* %19
%78 = load i64, i64* %13
%79 = load i64, i64* %19
%80 = sub i64 %78, %79
%81 = load i64, i64* %12
%82 = add i64 %81, %80
store i64 %82, i64* %12
%83 = load i8*, i8** %15
%84 = load i64, i64* %12
%85 = call i8* @realloc(i8* %83, i64 %84)
store i8* %85, i8** %20
%86 = load i8*, i8** %20
%87 = icmp eq i8* %86, null
br i1 %87, label %88, label %93
88: ; preds = %67
%89 = load i32, i32* @stderr
%90 = call i32 @fprintf(i32 %89, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.1, i64 0, i64 0))
%91 = load i8*, i8** %15
%92 = call i32 @free(i8* %91)
store i8* null, i8** %6
br label %130
93: ; preds = %67
%94 = load i8*, i8** %20
%95 = load i8*, i8** %14
%96 = load i8*, i8** %15
%97 = ptrtoint i8* %95 to i64
%98 = ptrtoint i8* %96 to i64
%99 = sub i64 %97, %98
%100 = getelementptr inbounds i8, i8* %94, i64 %99
store i8* %100, i8** %14
%101 = load i8*, i8** %20
store i8* %101, i8** %15
%102 = load i8*, i8** %14
%103 = load i8*, i8** %7
%104 = load i64, i64* %18
%105 = call i32 @memmove(i8* %102, i8* %103, i64 %104)
%106 = load i64, i64* %18
%107 = load i8*, i8** %7
%108 = getelementptr inbounds i8, i8* %107, i64 %106
store i8* %108, i8** %7
%109 = load i64, i64* %18
%110 = load i8*, i8** %14
%111 = getelementptr inbounds i8, i8* %110, i64 %109
store i8* %111, i8** %14
%112 = load i8*, i8** %14
%113 = load i8*, i8** %10
%114 = load i64, i64* %13
%115 = call i32 @memmove(i8* %112, i8* %113, i64 %114)
%116 = load i64, i64* %19
%117 = load i8*, i8** %7
%118 = getelementptr inbounds i8, i8* %117, i64 %116
store i8* %118, i8** %7
%119 = load i64, i64* %13
%120 = load i8*, i8** %14
%121 = getelementptr inbounds i8, i8* %120, i64 %119
store i8* %121, i8** %14
br label %126
122: ; preds = %38
%123 = load i8*, i8** %14
%124 = load i8*, i8** %7
%125 = call i32 @strcpy(i8* %123, i8* %124)
br label %127
126: ; preds = %93
br label %38
127: ; preds = %122, %62
br label %128
128: ; preds = %127, %33
%129 = load i8*, i8** %15
store i8* %129, i8** %6
br label %130
130: ; preds = %128, %88, %30
%131 = load i8*, i8** %6
ret i8* %131
}

LLVM IR (-O2):
@stderr = global i32 0
@.str = [24 x i8] c"Cannot allocate memory\0A\00"
@.str.1 = [27 x i8] c"Cannot re-allocate memory\0A\00"
define i8* @replace_after(i8* %0, i8* nocapture %1, i8* nocapture %2, i8* %3, i32 %4) {
%6 = tail call i64 @strlen(i8* dereferenceable(1) %0)
%7 = add i64 %6, 1
%8 = tail call i64 @strlen(i8* dereferenceable(1) %3)
%9 = tail call i8* @malloc(i64 %7)
%10 = icmp eq i8* %9, null
br i1 %10, label %16, label %11
11: ; preds = %5
%12 = tail call i8* @strstr(i8* dereferenceable(1) %0, i8* dereferenceable(1) %1)
%13 = icmp eq i8* %12, null
br i1 %13, label %51, label %14
14: ; preds = %11
%15 = icmp eq i32 %4, 1
br label %19
16: ; preds = %5
%17 = load i32, i32* @stderr
%18 = tail call i32 @fprintf(i32 %17, i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str, i64 0, i64 0))
br label %69
19: ; preds = %14, %56
%20 = phi i8* [ %12, %14 ], [ %67, %56 ]
%21 = phi i8* [ %0, %14 ], [ %65, %56 ]
%22 = phi i64 [ %7, %14 ], [ %44, %56 ]
%23 = phi i8* [ %9, %14 ], [ %66, %56 ]
%24 = phi i8* [ %9, %14 ], [ %45, %56 ]
%25 = tail call i64 @strlen(i8* dereferenceable(1) %1)
%26 = getelementptr inbounds i8, i8* %20, i64 %25
%27 = tail call i8* @strstr(i8* %26, i8* dereferenceable(1) %2)
%28 = icmp eq i8* %27, null
br i1 %28, label %29, label %36
29: ; preds = %19
br i1 %15, label %30, label %34
30: ; preds = %29
%31 = tail call i64 @strlen(i8* dereferenceable(1) %21)
%32 = getelementptr inbounds i8, i8* %21, i64 -1
%33 = getelementptr inbounds i8, i8* %32, i64 %31
br label %36
34: ; preds = %29
%35 = tail call i32 @strcpy(i8* %23, i8* %21)
br label %69
36: ; preds = %30, %19
%37 = phi i8* [ %33, %30 ], [ %27, %19 ]
%38 = ptrtoint i8* %20 to i64
%39 = ptrtoint i8* %21 to i64
%40 = sub i64 %38, %39
%41 = ptrtoint i8* %37 to i64
%42 = sub i64 %41, %38
%43 = sub i64 %8, %42
%44 = add i64 %43, %22
%45 = tail call i8* @realloc(i8* %24, i64 %44)
%46 = icmp eq i8* %45, null
br i1 %46, label %47, label %56
47: ; preds = %36
%48 = load i32, i32* @stderr
%49 = tail call i32 @fprintf(i32 %48, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.1, i64 0, i64 0))
%50 = tail call i32 @free(i8* %24)
br label %69
51: ; preds = %56, %11
%52 = phi i8* [ %9, %11 ], [ %45, %56 ]
%53 = phi i8* [ %9, %11 ], [ %66, %56 ]
%54 = phi i8* [ %0, %11 ], [ %65, %56 ]
%55 = tail call i32 @strcpy(i8* %53, i8* %54)
br label %69
56: ; preds = %36
%57 = ptrtoint i8* %23 to i64
%58 = ptrtoint i8* %24 to i64
%59 = sub i64 %57, %58
%60 = getelementptr inbounds i8, i8* %45, i64 %59
%61 = tail call i32 @memmove(i8* %60, i8* %21, i64 %40)
%62 = getelementptr inbounds i8, i8* %21, i64 %40
%63 = getelementptr inbounds i8, i8* %60, i64 %40
%64 = tail call i32 @memmove(i8* %63, i8* %3, i64 %8)
%65 = getelementptr inbounds i8, i8* %62, i64 %42
%66 = getelementptr inbounds i8, i8* %63, i64 %8
%67 = tail call i8* @strstr(i8* dereferenceable(1) %65, i8* dereferenceable(1) %1)
%68 = icmp eq i8* %67, null
br i1 %68, label %51, label %19
69: ; preds = %34, %51, %47, %16
%70 = phi i8* [ null, %16 ], [ null, %47 ], [ %52, %51 ], [ %24, %34 ]
ret i8* %70
}