#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct jpeg_parser {
  int dummy;
};

/* Variables and functions */
scalar_t__ jpeg_parser_get_APP4_marker(struct jpeg_parser *, unsigned char **,
                                       int *);
int /*<<< orphan*/ memmove(unsigned char *, unsigned char *, int);
int /*<<< orphan*/ printf(char *, ...);
int vp8_paylod_parser_ex(struct jpeg_parser *handle, unsigned char **out_buffer,
                         unsigned char **header) {
  unsigned char *marker;
  int marker_length;
  if (jpeg_parser_get_APP4_marker(handle, &marker, &marker_length) == 0) {
    printf("ERROR: jpeg_parser_get_APP4_marker");
    return -1;
  }
  if (marker_length < 26) {
    printf("ERROR: APP4 marker size shall > 26");
    return -1;
  }
  *header = marker;
  int version = (marker[0] << 8) | marker[1];
  int header_size = (marker[2] << 8) | marker[3];
  int payload_size =
      (marker[header_size] << 24) | (marker[header_size + 1] << 16) |
      (marker[header_size + 2] << 8) | (marker[header_size + 3] << 0);
  if (version != 0x0100) {
    return -1;
  }
  if (payload_size > (512 * 1024)) {
    printf("ERROR: frame too large");
    return -1;
  }
  *out_buffer = &marker[header_size + 4];
  int received_size = marker_length - header_size - 4;
  while (received_size < payload_size) {
    if (jpeg_parser_get_APP4_marker(handle, &marker, &marker_length) == 0) {
      printf("ERROR: received data size(%d) < expected size(%d)", received_size,
             payload_size);
      return -1;
    }
    memmove(*out_buffer + received_size, marker, marker_length);
    received_size += marker_length;
  }
  if (received_size != payload_size) {
    printf("ERROR: received data size(%d) != expected size(%d)", received_size,
           payload_size);
    return -1;
  }
  return payload_size;
}


x86 assembly (clang, -O0):
<vp8_paylod_parser_ex>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    -0x10(%rbp),%rdi
lea    -0x28(%rbp),%rsi
lea    -0x2c(%rbp),%rdx
call   1030 <jpeg_parser_get_APP4_marker@plt>
cmp    $0x0,%rax
jne    1179 <vp8_paylod_parser_ex+0x49>
lea    0xe9a(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    132e <vp8_paylod_parser_ex+0x1fe>
cmpl   $0x1a,-0x2c(%rbp)
jge    119d <vp8_paylod_parser_ex+0x6d>
lea    0xe99(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    132e <vp8_paylod_parser_ex+0x1fe>
mov    -0x28(%rbp),%rcx
mov    -0x20(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x28(%rbp),%rax
movzbl (%rax),%eax
shl    $0x8,%eax
mov    -0x28(%rbp),%rcx
movzbl 0x1(%rcx),%ecx
or     %ecx,%eax
mov    %eax,-0x30(%rbp)
mov    -0x28(%rbp),%rax
movzbl 0x2(%rax),%eax
shl    $0x8,%eax
mov    -0x28(%rbp),%rcx
movzbl 0x3(%rcx),%ecx
or     %ecx,%eax
mov    %eax,-0x34(%rbp)
mov    -0x28(%rbp),%rax
movslq -0x34(%rbp),%rcx
movzbl (%rax,%rcx,1),%eax
shl    $0x18,%eax
mov    -0x28(%rbp),%rcx
mov    -0x34(%rbp),%edx
add    $0x1,%edx
movslq %edx,%rdx
movzbl (%rcx,%rdx,1),%ecx
shl    $0x10,%ecx
or     %ecx,%eax
mov    -0x28(%rbp),%rcx
mov    -0x34(%rbp),%edx
add    $0x2,%edx
movslq %edx,%rdx
movzbl (%rcx,%rdx,1),%ecx
shl    $0x8,%ecx
or     %ecx,%eax
mov    -0x28(%rbp),%rcx
mov    -0x34(%rbp),%edx
add    $0x3,%edx
movslq %edx,%rdx
movzbl (%rcx,%rdx,1),%ecx
shl    $0x0,%ecx
or     %ecx,%eax
mov    %eax,-0x38(%rbp)
cmpl   $0x100,-0x30(%rbp)
je     1244 <vp8_paylod_parser_ex+0x114>
movl   $0xffffffff,-0x4(%rbp)
jmp    132e <vp8_paylod_parser_ex+0x1fe>
cmpl   $0x80000,-0x38(%rbp)
jle    126b <vp8_paylod_parser_ex+0x13b>
lea    0xdee(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    132e <vp8_paylod_parser_ex+0x1fe>
mov    -0x28(%rbp),%rcx
mov    -0x34(%rbp),%eax
add    $0x4,%eax
cltq
add    %rax,%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x2c(%rbp),%eax
sub    -0x34(%rbp),%eax
sub    $0x4,%eax
mov    %eax,-0x3c(%rbp)
mov    -0x3c(%rbp),%eax
cmp    -0x38(%rbp),%eax
jge    12fc <vp8_paylod_parser_ex+0x1cc>
mov    -0x10(%rbp),%rdi
lea    -0x28(%rbp),%rsi
lea    -0x2c(%rbp),%rdx
call   1030 <jpeg_parser_get_APP4_marker@plt>
cmp    $0x0,%rax
jne    12d4 <vp8_paylod_parser_ex+0x1a4>
mov    -0x3c(%rbp),%esi
mov    -0x38(%rbp),%edx
lea    0xd9c(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    132e <vp8_paylod_parser_ex+0x1fe>
mov    -0x18(%rbp),%rax
mov    (%rax),%rdi
movslq -0x3c(%rbp),%rax
add    %rax,%rdi
mov    -0x28(%rbp),%rsi
mov    -0x2c(%rbp),%edx
call   1050 <memmove@plt>
mov    -0x2c(%rbp),%eax
add    -0x3c(%rbp),%eax
mov    %eax,-0x3c(%rbp)
jmp    128d <vp8_paylod_parser_ex+0x15d>
mov    -0x3c(%rbp),%eax
cmp    -0x38(%rbp),%eax
je     1328 <vp8_paylod_parser_ex+0x1f8>
mov    -0x3c(%rbp),%esi
mov    -0x38(%rbp),%edx
lea    0xd7a(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    132e <vp8_paylod_parser_ex+0x1fe>
mov    -0x38(%rbp),%eax
mov    %eax,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<vp8_paylod_parser_ex>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %rdx,%rbp
mov    %rsi,%r15
mov    %rdi,%r13
lea    0x10(%rsp),%rsi
lea    0xc(%rsp),%rdx
call   1030 <jpeg_parser_get_APP4_marker@plt>
test   %rax,%rax
je     116d <vp8_paylod_parser_ex+0x3d>
mov    0xc(%rsp),%ebx
cmp    $0x19,%ebx
jg     1193 <vp8_paylod_parser_ex+0x63>
lea    0xeb8(%rip),%rdi
jmp    1174 <vp8_paylod_parser_ex+0x44>
lea    0xe8c(%rip),%rdi
xor    %eax,%eax
call   1040 <printf@plt>
mov    $0xffffffff,%r14d
mov    %r14d,%eax
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    0x10(%rsp),%rax
mov    %rax,0x0(%rbp)
movzwl (%rax),%ecx
shl    $0x10,%ecx
bswap  %ecx
mov    $0xffffffff,%r14d
cmp    $0x100,%ecx
jne    1181 <vp8_paylod_parser_ex+0x51>
movzwl 0x2(%rax),%ecx
shl    $0x30,%rcx
bswap  %rcx
mov    (%rax,%rcx,1),%r12d
bswap  %r12d
cmp    $0x80001,%r12d
jl     11dd <vp8_paylod_parser_ex+0xad>
lea    0xe72(%rip),%rdi
xor    %eax,%eax
call   1040 <printf@plt>
jmp    1181 <vp8_paylod_parser_ex+0x51>
mov    %ecx,%edx
add    %rdx,%rax
add    $0x4,%rax
mov    %rax,(%r15)
sub    %ecx,%ebx
add    $0xfffffffc,%ebx
cmp    %r12d,%ebx
jge    1235 <vp8_paylod_parser_ex+0x105>
lea    0xc(%rsp),%rbp
nopl   0x0(%rax,%rax,1)
mov    %r13,%rdi
lea    0x10(%rsp),%rsi
mov    %rbp,%rdx
call   1030 <jpeg_parser_get_APP4_marker@plt>
test   %rax,%rax
je     124b <vp8_paylod_parser_ex+0x11b>
movslq %ebx,%rbx
mov    (%r15),%rdi
add    %rbx,%rdi
mov    0x10(%rsp),%rsi
mov    0xc(%rsp),%edx
call   1050 <memmove@plt>
add    0xc(%rsp),%ebx
cmp    %r12d,%ebx
jl     1200 <vp8_paylod_parser_ex+0xd0>
cmp    %r12d,%ebx
jne    1242 <vp8_paylod_parser_ex+0x112>
mov    %r12d,%r14d
jmp    1181 <vp8_paylod_parser_ex+0x51>
lea    0xe46(%rip),%rdi
jmp    1252 <vp8_paylod_parser_ex+0x122>
lea    0xe0b(%rip),%rdi
mov    %ebx,%esi
mov    %r12d,%edx
xor    %eax,%eax
call   1040 <printf@plt>
jmp    1181 <vp8_paylod_parser_ex+0x51>

LLVM IR (-O0):
%struct.jpeg_parser = type { i32 }
@.str = [35 x i8] c"ERROR: jpeg_parser_get_APP4_marker\00"
@.str.1 = [35 x i8] c"ERROR: APP4 marker size shall > 26\00"
@.str.2 = [23 x i8] c"ERROR: frame too large\00"
@.str.3 = [50 x i8] c"ERROR: received data size(%d) < expected size(%d)\00"
@.str.4 = [51 x i8] c"ERROR: received data size(%d) != expected size(%d)\00"
define i32 @vp8_paylod_parser_ex(%struct.jpeg_parser* %0, i8** %1, i8** %2) {
%4 = alloca i32
%5 = alloca %struct.jpeg_parser*
%6 = alloca i8**
%7 = alloca i8**
%8 = alloca i8*
%9 = alloca i32
%10 = alloca i32
%11 = alloca i32
%12 = alloca i32
%13 = alloca i32
store %struct.jpeg_parser* %0, %struct.jpeg_parser** %5
store i8** %1, i8*** %6
store i8** %2, i8*** %7
%14 = load %struct.jpeg_parser*, %struct.jpeg_parser** %5
%15 = call i64 @jpeg_parser_get_APP4_marker(%struct.jpeg_parser* %14, i8** %8, i32* %9)
%16 = icmp eq i64 %15, 0
br i1 %16, label %17, label %19
17: ; preds = %3
%18 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([35 x i8], [35 x i8]* @.str, i64 0, i64 0))
store i32 -1, i32* %4
br label %134
19: ; preds = %3
%20 = load i32, i32* %9
%21 = icmp slt i32 %20, 26
br i1 %21, label %22, label %24
22: ; preds = %19
%23 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([35 x i8], [35 x i8]* @.str.1, i64 0, i64 0))
store i32 -1, i32* %4
br label %134
24: ; preds = %19
%25 = load i8*, i8** %8
%26 = load i8**, i8*** %7
store i8* %25, i8** %26
%27 = load i8*, i8** %8
%28 = getelementptr inbounds i8, i8* %27, i64 0
%29 = load i8, i8* %28
%30 = zext i8 %29 to i32
%31 = shl i32 %30, 8
%32 = load i8*, i8** %8
%33 = getelementptr inbounds i8, i8* %32, i64 1
%34 = load i8, i8* %33
%35 = zext i8 %34 to i32
%36 = or i32 %31, %35
store i32 %36, i32* %10
%37 = load i8*, i8** %8
%38 = getelementptr inbounds i8, i8* %37, i64 2
%39 = load i8, i8* %38
%40 = zext i8 %39 to i32
%41 = shl i32 %40, 8
%42 = load i8*, i8** %8
%43 = getelementptr inbounds i8, i8* %42, i64 3
%44 = load i8, i8* %43
%45 = zext i8 %44 to i32
%46 = or i32 %41, %45
store i32 %46, i32* %11
%47 = load i8*, i8** %8
%48 = load i32, i32* %11
%49 = sext i32 %48 to i64
%50 = getelementptr inbounds i8, i8* %47, i64 %49
%51 = load i8, i8* %50
%52 = zext i8 %51 to i32
%53 = shl i32 %52, 24
%54 = load i8*, i8** %8
%55 = load i32, i32* %11
%56 = add nsw i32 %55, 1
%57 = sext i32 %56 to i64
%58 = getelementptr inbounds i8, i8* %54, i64 %57
%59 = load i8, i8* %58
%60 = zext i8 %59 to i32
%61 = shl i32 %60, 16
%62 = or i32 %53, %61
%63 = load i8*, i8** %8
%64 = load i32, i32* %11
%65 = add nsw i32 %64, 2
%66 = sext i32 %65 to i64
%67 = getelementptr inbounds i8, i8* %63, i64 %66
%68 = load i8, i8* %67
%69 = zext i8 %68 to i32
%70 = shl i32 %69, 8
%71 = or i32 %62, %70
%72 = load i8*, i8** %8
%73 = load i32, i32* %11
%74 = add nsw i32 %73, 3
%75 = sext i32 %74 to i64
%76 = getelementptr inbounds i8, i8* %72, i64 %75
%77 = load i8, i8* %76
%78 = zext i8 %77 to i32
%79 = shl i32 %78, 0
%80 = or i32 %71, %79
store i32 %80, i32* %12
%81 = load i32, i32* %10
%82 = icmp ne i32 %81, 256
br i1 %82, label %83, label %84
83: ; preds = %24
store i32 -1, i32* %4
br label %134
84: ; preds = %24
%85 = load i32, i32* %12
%86 = icmp sgt i32 %85, 524288
br i1 %86, label %87, label %89
87: ; preds = %84
%88 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.2, i64 0, i64 0))
store i32 -1, i32* %4
br label %134
89: ; preds = %84
%90 = load i8*, i8** %8
%91 = load i32, i32* %11
%92 = add nsw i32 %91, 4
%93 = sext i32 %92 to i64
%94 = getelementptr inbounds i8, i8* %90, i64 %93
%95 = load i8**, i8*** %6
store i8* %94, i8** %95
%96 = load i32, i32* %9
%97 = load i32, i32* %11
%98 = sub nsw i32 %96, %97
%99 = sub nsw i32 %98, 4
store i32 %99, i32* %13
br label %100
100: ; preds = %112, %89
%101 = load i32, i32* %13
%102 = load i32, i32* %12
%103 = icmp slt i32 %101, %102
br i1 %103, label %104, label %124
104: ; preds = %100
%105 = load %struct.jpeg_parser*, %struct.jpeg_parser** %5
%106 = call i64 @jpeg_parser_get_APP4_marker(%struct.jpeg_parser* %105, i8** %8, i32* %9)
%107 = icmp eq i64 %106, 0
br i1 %107, label %108, label %112
108: ; preds = %104
%109 = load i32, i32* %13
%110 = load i32, i32* %12
%111 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([50 x i8], [50 x i8]* @.str.3, i64 0, i64 0), i32 %109, i32 %110)
store i32 -1, i32* %4
br label %134
112: ; preds = %104
%113 = load i8**, i8*** %6
%114 = load i8*, i8** %113
%115 = load i32, i32* %13
%116 = sext i32 %115 to i64
%117 = getelementptr inbounds i8, i8* %114, i64 %116
%118 = load i8*, i8** %8
%119 = load i32, i32* %9
%120 = call i32 @memmove(i8* %117, i8* %118, i32 %119)
%121 = load i32, i32* %9
%122 = load i32, i32* %13
%123 = add nsw i32 %122, %121
store i32 %123, i32* %13
br label %100
124: ; preds = %100
%125 = load i32, i32* %13
%126 = load i32, i32* %12
%127 = icmp ne i32 %125, %126
br i1 %127, label %128, label %132
128: ; preds = %124
%129 = load i32, i32* %13
%130 = load i32, i32* %12
%131 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([51 x i8], [51 x i8]* @.str.4, i64 0, i64 0), i32 %129, i32 %130)
store i32 -1, i32* %4
br label %134
132: ; preds = %124
%133 = load i32, i32* %12
store i32 %133, i32* %4
br label %134
134: ; preds = %132, %128, %108, %87, %83, %22, %17
%135 = load i32, i32* %4
ret i32 %135
}

LLVM IR (-O2):
%struct.jpeg_parser = type { i32 }
@.str = [35 x i8] c"ERROR: jpeg_parser_get_APP4_marker\00"
@.str.1 = [35 x i8] c"ERROR: APP4 marker size shall > 26\00"
@.str.2 = [23 x i8] c"ERROR: frame too large\00"
@.str.3 = [50 x i8] c"ERROR: received data size(%d) < expected size(%d)\00"
@.str.4 = [51 x i8] c"ERROR: received data size(%d) != expected size(%d)\00"
define i32 @vp8_paylod_parser_ex(%struct.jpeg_parser* %0, i8** nocapture %1, i8** nocapture writeonly %2) {
%4 = alloca i8*
%5 = alloca i32
%6 = bitcast i8** %4 to i8*
%7 = bitcast i32* %5 to i8*
%8 = call i64 @jpeg_parser_get_APP4_marker(%struct.jpeg_parser* %0, i8** %4, i32* %5)
%9 = icmp eq i64 %8, 0
br i1 %9, label %10, label %12
10: ; preds = %3
%11 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([35 x i8], [35 x i8]* @.str, i64 0, i64 0))
br label %92
12: ; preds = %3
%13 = load i32, i32* %5
%14 = icmp slt i32 %13, 26
br i1 %14, label %15, label %17
15: ; preds = %12
%16 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([35 x i8], [35 x i8]* @.str.1, i64 0, i64 0))
br label %92
17: ; preds = %12
%18 = load i8*, i8** %4
store i8* %18, i8** %2
%19 = load i8, i8* %18
%20 = zext i8 %19 to i32
%21 = shl nuw nsw i32 %20, 8
%22 = getelementptr inbounds i8, i8* %18, i64 1
%23 = load i8, i8* %22
%24 = zext i8 %23 to i32
%25 = or i32 %21, %24
%26 = getelementptr inbounds i8, i8* %18, i64 2
%27 = load i8, i8* %26
%28 = zext i8 %27 to i32
%29 = shl nuw nsw i32 %28, 8
%30 = getelementptr inbounds i8, i8* %18, i64 3
%31 = load i8, i8* %30
%32 = zext i8 %31 to i32
%33 = or i32 %29, %32
%34 = zext i32 %33 to i64
%35 = getelementptr inbounds i8, i8* %18, i64 %34
%36 = load i8, i8* %35
%37 = zext i8 %36 to i32
%38 = shl nuw i32 %37, 24
%39 = add nuw nsw i32 %33, 1
%40 = zext i32 %39 to i64
%41 = getelementptr inbounds i8, i8* %18, i64 %40
%42 = load i8, i8* %41
%43 = zext i8 %42 to i32
%44 = shl nuw nsw i32 %43, 16
%45 = or i32 %44, %38
%46 = add nuw nsw i32 %33, 2
%47 = zext i32 %46 to i64
%48 = getelementptr inbounds i8, i8* %18, i64 %47
%49 = load i8, i8* %48
%50 = zext i8 %49 to i32
%51 = shl nuw nsw i32 %50, 8
%52 = or i32 %45, %51
%53 = add nuw nsw i32 %33, 3
%54 = zext i32 %53 to i64
%55 = getelementptr inbounds i8, i8* %18, i64 %54
%56 = load i8, i8* %55
%57 = zext i8 %56 to i32
%58 = or i32 %52, %57
%59 = icmp eq i32 %25, 256
br i1 %59, label %60, label %92
60: ; preds = %17
%61 = icmp sgt i32 %58, 524288
br i1 %61, label %62, label %64
62: ; preds = %60
%63 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @.str.2, i64 0, i64 0))
br label %92
64: ; preds = %60
%65 = add nuw nsw i32 %33, 4
%66 = zext i32 %65 to i64
%67 = getelementptr inbounds i8, i8* %18, i64 %66
store i8* %67, i8** %1
%68 = add nsw i32 %13, -4
%69 = sub i32 %68, %33
%70 = icmp slt i32 %69, %58
br i1 %70, label %71, label %87
71: ; preds = %64, %77
%72 = phi i32 [ %85, %77 ], [ %69, %64 ]
%73 = call i64 @jpeg_parser_get_APP4_marker(%struct.jpeg_parser* %0, i8** %4, i32* %5)
%74 = icmp eq i64 %73, 0
br i1 %74, label %75, label %77
75: ; preds = %71
%76 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([50 x i8], [50 x i8]* @.str.3, i64 0, i64 0), i32 %72, i32 %58)
br label %92
77: ; preds = %71
%78 = load i8*, i8** %1
%79 = sext i32 %72 to i64
%80 = getelementptr inbounds i8, i8* %78, i64 %79
%81 = load i8*, i8** %4
%82 = load i32, i32* %5
%83 = call i32 @memmove(i8* %80, i8* %81, i32 %82)
%84 = load i32, i32* %5
%85 = add nsw i32 %84, %72
%86 = icmp slt i32 %85, %58
br i1 %86, label %71, label %87
87: ; preds = %77, %64
%88 = phi i32 [ %69, %64 ], [ %85, %77 ]
%89 = icmp eq i32 %88, %58
br i1 %89, label %92, label %90
90: ; preds = %87
%91 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([51 x i8], [51 x i8]* @.str.4, i64 0, i64 0), i32 %88, i32 %58)
br label %92
92: ; preds = %62, %17, %87, %90, %75, %15, %10
%93 = phi i32 [ -1, %10 ], [ -1, %15 ], [ -1, %62 ], [ -1, %17 ], [ -1, %75 ], [ -1, %90 ], [ %58, %87 ]
ret i32 %93
}