#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int MAP_ANONYMOUS;
char *MAP_FAILED;
int MAP_PRIVATE;
int PROT_EXEC;
int PROT_READ;
int PROT_WRITE;
int /*<<< orphan*/ STDIN_FILENO;
int /*<<< orphan*/ exit(int /*<<< orphan*/);
int /*<<< orphan*/ fflush(int /*<<< orphan*/);
scalar_t__ mmap(int /*<<< orphan*/ *, int, int, int, int /*<<< orphan*/,
                int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *, ...);
int read(int /*<<< orphan*/, char *, int);
int /*<<< orphan*/ stdout;
void vuln() {
  char *stuff = (char *)mmap(NULL, 10, PROT_EXEC | PROT_READ | PROT_WRITE,
                             MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
  if (stuff == MAP_FAILED) {
    printf("Failed to get space. Please talk to admin\n");
    exit(0);
  }
  printf("Give me %d bytes:\n", 10);
  fflush(stdout);
  int len = read(STDIN_FILENO, stuff, 10);
  if (len == 0) {
    printf("You didn't give me anything :(");
    exit(0);
  }
  void (*func)() = (void (*)())stuff;
  func();
}


x86 assembly (clang, -O0):
<vuln>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    0x2e79(%rip),%rax
mov    (%rax),%edx
mov    0x2e90(%rip),%rax
or     (%rax),%edx
mov    0x2e57(%rip),%rax
or     (%rax),%edx
mov    0x2e3e(%rip),%rax
mov    (%rax),%ecx
mov    0x2e5d(%rip),%rax
or     (%rax),%ecx
xor    %eax,%eax
mov    %eax,%edi
mov    $0xa,%esi
xor    %r9d,%r9d
mov    %r9d,%r8d
call   1030 <mmap@plt>
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
mov    0x2e08(%rip),%rcx
cmp    (%rcx),%rax
jne    11c6 <vuln+0x76>
lea    0xe48(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
xor    %edi,%edi
call   1070 <exit@plt>
lea    0xe5e(%rip),%rdi
mov    $0xa,%esi
mov    $0x0,%al
call   1040 <printf@plt>
mov    0x2de0(%rip),%rax
mov    (%rax),%edi
call   1060 <fflush@plt>
mov    0x2dba(%rip),%rax
mov    (%rax),%edi
mov    -0x8(%rbp),%rsi
mov    $0xa,%edx
call   1050 <read@plt>
mov    %eax,-0xc(%rbp)
cmpl   $0x0,-0xc(%rbp)
jne    1220 <vuln+0xd0>
lea    0xe2c(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
xor    %edi,%edi
call   1070 <exit@plt>
mov    -0x8(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    $0x0,%al
call   *-0x18(%rbp)
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<vuln>:
push   %rbx
mov    0x2e70(%rip),%rax
mov    0x2e89(%rip),%rcx
mov    (%rcx),%edx
or     (%rax),%edx
mov    0x2e4e(%rip),%rax
or     (%rax),%edx
mov    0x2e35(%rip),%rax
mov    0x2e56(%rip),%rcx
mov    (%rcx),%ecx
or     (%rax),%ecx
xor    %edi,%edi
mov    $0xa,%esi
xor    %r8d,%r8d
xor    %r9d,%r9d
call   1040 <mmap@plt>
mov    0x2e09(%rip),%rcx
cmp    %rax,(%rcx)
je     11f2 <vuln+0x92>
mov    %rax,%rbx
lea    0xe4a(%rip),%rdi
mov    $0xa,%esi
xor    %eax,%eax
call   1050 <printf@plt>
mov    0x2df7(%rip),%rax
mov    (%rax),%edi
call   1070 <fflush@plt>
mov    0x2dd1(%rip),%rax
mov    (%rax),%edi
mov    %rbx,%rsi
mov    $0xa,%edx
call   1060 <read@plt>
test   %eax,%eax
je     1205 <vuln+0xa5>
xor    %eax,%eax
mov    %rbx,%rcx
pop    %rbx
jmp    *%rcx
lea    0xe39(%rip),%rdi
call   1030 <puts@plt>
xor    %edi,%edi
call   1080 <exit@plt>
lea    0xe07(%rip),%rdi
xor    %eax,%eax
call   1050 <printf@plt>
xor    %edi,%edi
call   1080 <exit@plt>

LLVM IR (-O0):
@PROT_EXEC = global i32 0
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_ANONYMOUS = global i32 0
@MAP_FAILED = global i8* null
@.str = [43 x i8] c"Failed to get space. Please talk to admin\0A\00"
@.str.1 = [19 x i8] c"Give me %d bytes:\0A\00"
@stdout = global i32 0
@STDIN_FILENO = global i32 0
@.str.2 = [31 x i8] c"You didn't give me anything :(\00"
define void @vuln() {
%1 = alloca i8*
%2 = alloca i32
%3 = alloca void (...)*
%4 = load i32, i32* @PROT_EXEC
%5 = load i32, i32* @PROT_READ
%6 = or i32 %4, %5
%7 = load i32, i32* @PROT_WRITE
%8 = or i32 %6, %7
%9 = load i32, i32* @MAP_PRIVATE
%10 = load i32, i32* @MAP_ANONYMOUS
%11 = or i32 %9, %10
%12 = call i64 @mmap(i32* null, i32 10, i32 %8, i32 %11, i32 0, i32 0)
%13 = inttoptr i64 %12 to i8*
store i8* %13, i8** %1
%14 = load i8*, i8** %1
%15 = load i8*, i8** @MAP_FAILED
%16 = icmp eq i8* %14, %15
br i1 %16, label %17, label %20
17: ; preds = %0
%18 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([43 x i8], [43 x i8]* @.str, i64 0, i64 0))
%19 = call i32 @exit(i32 0)
unreachable
20: ; preds = %0
%21 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.1, i64 0, i64 0), i32 10)
%22 = load i32, i32* @stdout
%23 = call i32 @fflush(i32 %22)
%24 = load i32, i32* @STDIN_FILENO
%25 = load i8*, i8** %1
%26 = call i32 @read(i32 %24, i8* %25, i32 10)
store i32 %26, i32* %2
%27 = load i32, i32* %2
%28 = icmp eq i32 %27, 0
br i1 %28, label %29, label %32
29: ; preds = %20
%30 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.2, i64 0, i64 0))
%31 = call i32 @exit(i32 0)
unreachable
32: ; preds = %20
%33 = load i8*, i8** %1
%34 = bitcast i8* %33 to void (...)*
store void (...)* %34, void (...)** %3
%35 = load void (...)*, void (...)** %3
ret void
}

LLVM IR (-O2):
@PROT_EXEC = global i32 0
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_ANONYMOUS = global i32 0
@MAP_FAILED = global i8* null
@.str.1 = [19 x i8] c"Give me %d bytes:\0A\00"
@stdout = global i32 0
@STDIN_FILENO = global i32 0
@.str.2 = [31 x i8] c"You didn't give me anything :(\00"
@str = [42 x i8] c"Failed to get space. Please talk to admin\00"
define void @vuln() {
%1 = load i32, i32* @PROT_EXEC
%2 = load i32, i32* @PROT_READ
%3 = or i32 %2, %1
%4 = load i32, i32* @PROT_WRITE
%5 = or i32 %3, %4
%6 = load i32, i32* @MAP_PRIVATE
%7 = load i32, i32* @MAP_ANONYMOUS
%8 = or i32 %7, %6
%9 = tail call i64 @mmap(i32* null, i32 10, i32 %5, i32 %8, i32 0, i32 0)
%10 = inttoptr i64 %9 to i8*
%11 = load i8*, i8** @MAP_FAILED
%12 = icmp eq i8* %11, %10
br i1 %12, label %13, label %16
13: ; preds = %0
%14 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([42 x i8], [42 x i8]* @str, i64 0, i64 0))
%15 = tail call i32 @exit(i32 0)
unreachable
16: ; preds = %0
%17 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([19 x i8], [19 x i8]* @.str.1, i64 0, i64 0), i32 10)
%18 = load i32, i32* @stdout
%19 = tail call i32 @fflush(i32 %18)
%20 = load i32, i32* @STDIN_FILENO
%21 = tail call i32 @read(i32 %20, i8* %10, i32 10)
%22 = icmp eq i32 %21, 0
br i1 %22, label %23, label %26
23: ; preds = %16
%24 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([31 x i8], [31 x i8]* @.str.2, i64 0, i64 0))
%25 = tail call i32 @exit(i32 0)
unreachable
26: ; preds = %16
%27 = inttoptr i64 %9 to void (...)*
tail call void (...) %27()
ret void
}