#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ printf(char *, ...);
int sscanf(char *, char *, char *, char *);
int strlen(char *);
void test_sscanf_OOB_write() {
  char param[50], value[50];
  char length49[128] =
      "1234567890123456789012345678901234567890123456789 aaaaa";
  char length50[128] =
      "12345678901234567890123456789012345678901234567890 aaaaa";
  char length51[128] =
      "123456789012345678901234567890123456789012345678901 aaaaa";
  int tokens;
  tokens = sscanf(length49, "%50s %50s", param, value);
  printf("len:%d, param:[%s]\n", strlen(param), param);
  printf("len:%d, value:[%s]\n", strlen(value), value);
  tokens = sscanf(length50, "%50s %50s", param, value);
  printf("len:%d, param:[%s]\n", strlen(param), param);
  printf("len:%d, value:[%s]\n", strlen(value), value);
  tokens = sscanf(length51, "%50s %50s", param, value);
  printf("len:%d, param:[%s]\n", strlen(param), param);
  printf("len:%d, value:[%s]\n", strlen(value), value);
  printf("\n");
  tokens = sscanf(length51, "%51s %51s", param, value);
  printf("len:%d, param:[%s]\n", strlen(param), param);
  printf("len:%d, value:[%s]\n", strlen(value), value);
  printf("\n");
  tokens = sscanf(length49, "%49s %49s", param, value);
  printf("len:%d, param:[%s]\n", strlen(param), param);
  printf("len:%d, value:[%s]\n", strlen(value), value);
  tokens = sscanf(length50, "%49s %49s", param, value);
  printf("len:%d, param:[%s]\n", strlen(param), param);
  printf("len:%d, value:[%s]\n", strlen(value), value);
  tokens = sscanf(length51, "%49s %49s", param, value);
  printf("len:%d, param:[%s]\n", strlen(param), param);
  printf("len:%d, value:[%s]\n", strlen(value), value);
}


x86 assembly (clang, -O0):
<test_sscanf_OOB_write>:
push   %rbp
mov    %rsp,%rbp
sub    $0x210,%rsp
lea    -0x100(%rbp),%rdi
lea    0xea7(%rip),%rsi
mov    $0x80,%edx
call   1050 <memcpy@plt>
lea    -0x180(%rbp),%rdi
lea    0xf0f(%rip),%rsi
mov    $0x80,%edx
call   1050 <memcpy@plt>
lea    -0x200(%rbp),%rdi
lea    0xf77(%rip),%rsi
mov    $0x80,%edx
call   1050 <memcpy@plt>
lea    -0x100(%rbp),%rdi
lea    -0x40(%rbp),%rdx
lea    -0x80(%rbp),%rcx
lea    0xfd7(%rip),%rsi
call   1060 <sscanf@plt>
mov    %eax,-0x204(%rbp)
lea    -0x40(%rbp),%rdi
call   1030 <strlen@plt>
mov    %eax,%esi
lea    -0x40(%rbp),%rdx
lea    0xfc0(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x80(%rbp),%rdi
call   1030 <strlen@plt>
mov    %eax,%esi
lea    -0x80(%rbp),%rdx
lea    0xfb7(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x180(%rbp),%rdi
lea    -0x40(%rbp),%rdx
lea    -0x80(%rbp),%rcx
lea    0xf7c(%rip),%rsi
call   1060 <sscanf@plt>
mov    %eax,-0x204(%rbp)
lea    -0x40(%rbp),%rdi
call   1030 <strlen@plt>
mov    %eax,%esi
lea    -0x40(%rbp),%rdx
lea    0xf65(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x80(%rbp),%rdi
call   1030 <strlen@plt>
mov    %eax,%esi
lea    -0x80(%rbp),%rdx
lea    0xf5c(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x200(%rbp),%rdi
lea    -0x40(%rbp),%rdx
lea    -0x80(%rbp),%rcx
lea    0xf21(%rip),%rsi
call   1060 <sscanf@plt>
mov    %eax,-0x204(%rbp)
lea    -0x40(%rbp),%rdi
call   1030 <strlen@plt>
mov    %eax,%esi
lea    -0x40(%rbp),%rdx
lea    0xf0a(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x80(%rbp),%rdi
call   1030 <strlen@plt>
mov    %eax,%esi
lea    -0x80(%rbp),%rdx
lea    0xf01(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    0xf05(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x200(%rbp),%rdi
lea    -0x40(%rbp),%rdx
lea    -0x80(%rbp),%rcx
lea    0xeea(%rip),%rsi
call   1060 <sscanf@plt>
mov    %eax,-0x204(%rbp)
lea    -0x40(%rbp),%rdi
call   1030 <strlen@plt>
mov    %eax,%esi
lea    -0x40(%rbp),%rdx
lea    0xea1(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x80(%rbp),%rdi
call   1030 <strlen@plt>
mov    %eax,%esi
lea    -0x80(%rbp),%rdx
lea    0xe98(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    0xe9c(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x100(%rbp),%rdi
lea    -0x40(%rbp),%rdx
lea    -0x80(%rbp),%rcx
lea    0xe8b(%rip),%rsi
call   1060 <sscanf@plt>
mov    %eax,-0x204(%rbp)
lea    -0x40(%rbp),%rdi
call   1030 <strlen@plt>
mov    %eax,%esi
lea    -0x40(%rbp),%rdx
lea    0xe38(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x80(%rbp),%rdi
call   1030 <strlen@plt>
mov    %eax,%esi
lea    -0x80(%rbp),%rdx
lea    0xe2f(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x180(%rbp),%rdi
lea    -0x40(%rbp),%rdx
lea    -0x80(%rbp),%rcx
lea    0xe30(%rip),%rsi
call   1060 <sscanf@plt>
mov    %eax,-0x204(%rbp)
lea    -0x40(%rbp),%rdi
call   1030 <strlen@plt>
mov    %eax,%esi
lea    -0x40(%rbp),%rdx
lea    0xddd(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x80(%rbp),%rdi
call   1030 <strlen@plt>
mov    %eax,%esi
lea    -0x80(%rbp),%rdx
lea    0xdd4(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x200(%rbp),%rdi
lea    -0x40(%rbp),%rdx
lea    -0x80(%rbp),%rcx
lea    0xdd5(%rip),%rsi
call   1060 <sscanf@plt>
mov    %eax,-0x204(%rbp)
lea    -0x40(%rbp),%rdi
call   1030 <strlen@plt>
mov    %eax,%esi
lea    -0x40(%rbp),%rdx
lea    0xd82(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x80(%rbp),%rdi
call   1030 <strlen@plt>
mov    %eax,%esi
lea    -0x80(%rbp),%rdx
lea    0xd79(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
add    $0x210,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<test_sscanf_OOB_write>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x1f8,%rsp
movaps 0xf18(%rip),%xmm0
movaps %xmm0,0xf0(%rsp)
movaps 0xef9(%rip),%xmm0
movaps %xmm0,0xe0(%rsp)
movaps 0xeda(%rip),%xmm0
movaps %xmm0,0xd0(%rsp)
movaps 0xebb(%rip),%xmm0
movaps %xmm0,0xc0(%rsp)
movaps 0xe9c(%rip),%xmm0
movaps %xmm0,0xb0(%rsp)
movaps 0xe7d(%rip),%xmm0
movaps %xmm0,0xa0(%rsp)
movaps 0xe5e(%rip),%xmm0
movaps %xmm0,0x90(%rsp)
movaps 0xe3f(%rip),%xmm0
movaps %xmm0,0x80(%rsp)
movaps 0xf20(%rip),%xmm0
movaps %xmm0,0x70(%rsp)
movaps 0xf04(%rip),%xmm0
movaps %xmm0,0x60(%rsp)
movaps 0xee8(%rip),%xmm0
movaps %xmm0,0x50(%rsp)
movaps 0xecc(%rip),%xmm0
movaps %xmm0,0x40(%rsp)
movaps 0xeb0(%rip),%xmm0
movaps %xmm0,0x30(%rsp)
movaps 0xe94(%rip),%xmm0
movaps %xmm0,0x20(%rsp)
movaps 0xe78(%rip),%xmm0
movaps %xmm0,0x10(%rsp)
movaps 0xe5c(%rip),%xmm0
movaps %xmm0,(%rsp)
movaps 0xf41(%rip),%xmm0
movaps %xmm0,0x170(%rsp)
movaps 0xf22(%rip),%xmm0
movaps %xmm0,0x160(%rsp)
movaps 0xf03(%rip),%xmm0
movaps %xmm0,0x150(%rsp)
movaps 0xee4(%rip),%xmm0
movaps %xmm0,0x140(%rsp)
movaps 0xec5(%rip),%xmm0
movaps %xmm0,0x130(%rsp)
movaps 0xea6(%rip),%xmm0
movaps %xmm0,0x120(%rsp)
movaps 0xe87(%rip),%xmm0
movaps %xmm0,0x110(%rsp)
movaps 0xe68(%rip),%xmm0
movaps %xmm0,0x100(%rsp)
lea    0xed9(%rip),%rbp
lea    0x80(%rsp),%rdi
lea    0x1c0(%rsp),%rbx
lea    0x180(%rsp),%r14
mov    %rbp,%rsi
mov    %rbx,%rdx
mov    %r14,%rcx
call   1060 <sscanf@plt>
mov    %rbx,%rdi
call   1040 <strlen@plt>
lea    0xeae(%rip),%r15
mov    %r15,%rdi
mov    %eax,%esi
mov    %rbx,%rdx
xor    %eax,%eax
call   1050 <printf@plt>
mov    %r14,%rdi
call   1040 <strlen@plt>
lea    0xea4(%rip),%r12
mov    %r12,%rdi
mov    %eax,%esi
mov    %r14,%rdx
xor    %eax,%eax
call   1050 <printf@plt>
mov    %rsp,%rdi
mov    %rbp,%rsi
mov    %rbx,%rdx
mov    %r14,%rcx
call   1060 <sscanf@plt>
mov    %rbx,%rdi
call   1040 <strlen@plt>
mov    %r15,%rdi
mov    %eax,%esi
mov    %rbx,%rdx
xor    %eax,%eax
call   1050 <printf@plt>
mov    %r14,%rdi
call   1040 <strlen@plt>
mov    %r12,%rdi
mov    %eax,%esi
mov    %r14,%rdx
xor    %eax,%eax
call   1050 <printf@plt>
lea    0x100(%rsp),%r13
mov    %r13,%rdi
mov    %rbp,%rsi
mov    %rbx,%rdx
mov    %r14,%rcx
call   1060 <sscanf@plt>
mov    %rbx,%rdi
call   1040 <strlen@plt>
mov    %r15,%rdi
mov    %eax,%esi
mov    %rbx,%rdx
xor    %eax,%eax
call   1050 <printf@plt>
mov    %r14,%rdi
call   1040 <strlen@plt>
mov    %r12,%rdi
mov    %eax,%esi
mov    %r14,%rdx
xor    %eax,%eax
call   1050 <printf@plt>
mov    $0xa,%edi
call   1030 <putchar@plt>
lea    0xe12(%rip),%rsi
mov    %r13,%rdi
mov    %rbx,%rdx
mov    %r14,%rcx
call   1060 <sscanf@plt>
mov    %rbx,%rdi
call   1040 <strlen@plt>
mov    %r15,%rdi
mov    %eax,%esi
mov    %rbx,%rdx
xor    %eax,%eax
call   1050 <printf@plt>
mov    %r14,%rdi
call   1040 <strlen@plt>
mov    %r12,%rdi
mov    %eax,%esi
mov    %r14,%rdx
xor    %eax,%eax
call   1050 <printf@plt>
mov    $0xa,%edi
call   1030 <putchar@plt>
lea    0xdcf(%rip),%rbp
lea    0x80(%rsp),%rdi
mov    %rbp,%rsi
mov    %rbx,%rdx
mov    %r14,%rcx
call   1060 <sscanf@plt>
mov    %rbx,%rdi
call   1040 <strlen@plt>
mov    %r15,%rdi
mov    %eax,%esi
mov    %rbx,%rdx
xor    %eax,%eax
call   1050 <printf@plt>
mov    %r14,%rdi
call   1040 <strlen@plt>
mov    %r12,%rdi
mov    %eax,%esi
mov    %r14,%rdx
xor    %eax,%eax
call   1050 <printf@plt>
mov    %rsp,%rdi
mov    %rbp,%rsi
mov    %rbx,%rdx
mov    %r14,%rcx
call   1060 <sscanf@plt>
mov    %rbx,%rdi
call   1040 <strlen@plt>
mov    %r15,%rdi
mov    %eax,%esi
mov    %rbx,%rdx
xor    %eax,%eax
call   1050 <printf@plt>
mov    %r14,%rdi
call   1040 <strlen@plt>
mov    %r12,%rdi
mov    %eax,%esi
mov    %r14,%rdx
xor    %eax,%eax
call   1050 <printf@plt>
mov    %r13,%rdi
mov    %rbp,%rsi
mov    %rbx,%rdx
mov    %r14,%rcx
call   1060 <sscanf@plt>
mov    %rbx,%rdi
call   1040 <strlen@plt>
mov    %r15,%rdi
mov    %eax,%esi
mov    %rbx,%rdx
xor    %eax,%eax
call   1050 <printf@plt>
mov    %r14,%rdi
call   1040 <strlen@plt>
mov    %r12,%rdi
mov    %eax,%esi
mov    %r14,%rdx
xor    %eax,%eax
call   1050 <printf@plt>
add    $0x1f8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@__const.test_sscanf_OOB_write.length49 = [128 x i8] c"1234567890123456789012345678901234567890123456789 aaaaa\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00"
@__const.test_sscanf_OOB_write.length50 = [128 x i8] c"12345678901234567890123456789012345678901234567890 aaaaa\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00"
@__const.test_sscanf_OOB_write.length51 = [128 x i8] c"123456789012345678901234567890123456789012345678901 aaaaa\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00"
@.str = [10 x i8] c"%50s %50s\00"
@.str.1 = [20 x i8] c"len:%d, param:[%s]\0A\00"
@.str.2 = [20 x i8] c"len:%d, value:[%s]\0A\00"
@.str.3 = [2 x i8] c"\0A\00"
@.str.4 = [10 x i8] c"%51s %51s\00"
@.str.5 = [10 x i8] c"%49s %49s\00"
define void @test_sscanf_OOB_write() {
%1 = alloca [50 x i8]
%2 = alloca [50 x i8]
%3 = alloca [128 x i8]
%4 = alloca [128 x i8]
%5 = alloca [128 x i8]
%6 = alloca i32
%7 = bitcast [128 x i8]* %3 to i8*
%8 = bitcast [128 x i8]* %4 to i8*
%9 = bitcast [128 x i8]* %5 to i8*
%10 = getelementptr inbounds [128 x i8], [128 x i8]* %3, i64 0, i64 0
%11 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%12 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%13 = call i32 @sscanf(i8* %10, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i8* %11, i8* %12)
store i32 %13, i32* %6
%14 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%15 = call i32 @strlen(i8* %14)
%16 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%17 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.1, i64 0, i64 0), i32 %15, i8* %16)
%18 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%19 = call i32 @strlen(i8* %18)
%20 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%21 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0), i32 %19, i8* %20)
%22 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 0
%23 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%24 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%25 = call i32 @sscanf(i8* %22, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i8* %23, i8* %24)
store i32 %25, i32* %6
%26 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%27 = call i32 @strlen(i8* %26)
%28 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%29 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.1, i64 0, i64 0), i32 %27, i8* %28)
%30 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%31 = call i32 @strlen(i8* %30)
%32 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%33 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0), i32 %31, i8* %32)
%34 = getelementptr inbounds [128 x i8], [128 x i8]* %5, i64 0, i64 0
%35 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%36 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%37 = call i32 @sscanf(i8* %34, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i8* %35, i8* %36)
store i32 %37, i32* %6
%38 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%39 = call i32 @strlen(i8* %38)
%40 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%41 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.1, i64 0, i64 0), i32 %39, i8* %40)
%42 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%43 = call i32 @strlen(i8* %42)
%44 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%45 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0), i32 %43, i8* %44)
%46 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.3, i64 0, i64 0))
%47 = getelementptr inbounds [128 x i8], [128 x i8]* %5, i64 0, i64 0
%48 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%49 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%50 = call i32 @sscanf(i8* %47, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.4, i64 0, i64 0), i8* %48, i8* %49)
store i32 %50, i32* %6
%51 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%52 = call i32 @strlen(i8* %51)
%53 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%54 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.1, i64 0, i64 0), i32 %52, i8* %53)
%55 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%56 = call i32 @strlen(i8* %55)
%57 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%58 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0), i32 %56, i8* %57)
%59 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.3, i64 0, i64 0))
%60 = getelementptr inbounds [128 x i8], [128 x i8]* %3, i64 0, i64 0
%61 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%62 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%63 = call i32 @sscanf(i8* %60, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.5, i64 0, i64 0), i8* %61, i8* %62)
store i32 %63, i32* %6
%64 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%65 = call i32 @strlen(i8* %64)
%66 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%67 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.1, i64 0, i64 0), i32 %65, i8* %66)
%68 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%69 = call i32 @strlen(i8* %68)
%70 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%71 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0), i32 %69, i8* %70)
%72 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 0
%73 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%74 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%75 = call i32 @sscanf(i8* %72, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.5, i64 0, i64 0), i8* %73, i8* %74)
store i32 %75, i32* %6
%76 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%77 = call i32 @strlen(i8* %76)
%78 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%79 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.1, i64 0, i64 0), i32 %77, i8* %78)
%80 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%81 = call i32 @strlen(i8* %80)
%82 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%83 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0), i32 %81, i8* %82)
%84 = getelementptr inbounds [128 x i8], [128 x i8]* %5, i64 0, i64 0
%85 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%86 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%87 = call i32 @sscanf(i8* %84, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.5, i64 0, i64 0), i8* %85, i8* %86)
store i32 %87, i32* %6
%88 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%89 = call i32 @strlen(i8* %88)
%90 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%91 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.1, i64 0, i64 0), i32 %89, i8* %90)
%92 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%93 = call i32 @strlen(i8* %92)
%94 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%95 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0), i32 %93, i8* %94)
ret void
}

LLVM IR (-O2):
@__const.test_sscanf_OOB_write.length49 = [128 x i8] c"1234567890123456789012345678901234567890123456789 aaaaa\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00"
@__const.test_sscanf_OOB_write.length50 = [128 x i8] c"12345678901234567890123456789012345678901234567890 aaaaa\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00"
@__const.test_sscanf_OOB_write.length51 = [128 x i8] c"123456789012345678901234567890123456789012345678901 aaaaa\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00"
@.str = [10 x i8] c"%50s %50s\00"
@.str.1 = [20 x i8] c"len:%d, param:[%s]\0A\00"
@.str.2 = [20 x i8] c"len:%d, value:[%s]\0A\00"
@.str.4 = [10 x i8] c"%51s %51s\00"
@.str.5 = [10 x i8] c"%49s %49s\00"
define void @test_sscanf_OOB_write() {
%1 = alloca [50 x i8]
%2 = alloca [50 x i8]
%3 = alloca [128 x i8]
%4 = alloca [128 x i8]
%5 = alloca [128 x i8]
%6 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%7 = getelementptr inbounds [50 x i8], [50 x i8]* %2, i64 0, i64 0
%8 = getelementptr inbounds [128 x i8], [128 x i8]* %3, i64 0, i64 0
%9 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 0
%10 = getelementptr inbounds [128 x i8], [128 x i8]* %5, i64 0, i64 0
%11 = call i32 @sscanf(i8* %8, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i8* %6, i8* %7)
%12 = call i32 @strlen(i8* %6)
%13 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str.1, i64 0, i64 0), i32 %12, i8* %6)
%14 = call i32 @strlen(i8* %7)
%15 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0), i32 %14, i8* %7)
%16 = call i32 @sscanf(i8* %9, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i8* %6, i8* %7)
%17 = call i32 @strlen(i8* %6)
%18 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str.1, i64 0, i64 0), i32 %17, i8* %6)
%19 = call i32 @strlen(i8* %7)
%20 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0), i32 %19, i8* %7)
%21 = call i32 @sscanf(i8* %10, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i8* %6, i8* %7)
%22 = call i32 @strlen(i8* %6)
%23 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str.1, i64 0, i64 0), i32 %22, i8* %6)
%24 = call i32 @strlen(i8* %7)
%25 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0), i32 %24, i8* %7)
%26 = call i32 @putchar(i32 10)
%27 = call i32 @sscanf(i8* %10, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.4, i64 0, i64 0), i8* %6, i8* %7)
%28 = call i32 @strlen(i8* %6)
%29 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str.1, i64 0, i64 0), i32 %28, i8* %6)
%30 = call i32 @strlen(i8* %7)
%31 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0), i32 %30, i8* %7)
%32 = call i32 @putchar(i32 10)
%33 = call i32 @sscanf(i8* %8, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.5, i64 0, i64 0), i8* %6, i8* %7)
%34 = call i32 @strlen(i8* %6)
%35 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str.1, i64 0, i64 0), i32 %34, i8* %6)
%36 = call i32 @strlen(i8* %7)
%37 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0), i32 %36, i8* %7)
%38 = call i32 @sscanf(i8* %9, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.5, i64 0, i64 0), i8* %6, i8* %7)
%39 = call i32 @strlen(i8* %6)
%40 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str.1, i64 0, i64 0), i32 %39, i8* %6)
%41 = call i32 @strlen(i8* %7)
%42 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0), i32 %41, i8* %7)
%43 = call i32 @sscanf(i8* %10, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.5, i64 0, i64 0), i8* %6, i8* %7)
%44 = call i32 @strlen(i8* %6)
%45 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str.1, i64 0, i64 0), i32 %44, i8* %6)
%46 = call i32 @strlen(i8* %7)
%47 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0), i32 %46, i8* %7)
ret void
}