#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef void *uint32_t;
struct rtmsg {
  int dummy;
};
struct rtattr {
  int dummy;
};
struct nlmsghdr {
  int nlmsg_len;
};
struct in_addr {
  void *s_addr;
};

/* Variables and functions */
struct rtmsg *NLMSG_DATA(struct nlmsghdr *);
scalar_t__ NLMSG_LENGTH(int);
scalar_t__ RTA_DATA(struct rtattr *);
size_t RTA_GATEWAY;
int /*<<< orphan*/ RTA_MAX;
size_t RTA_OIF;
size_t RTA_PREFSRC;
int /*<<< orphan*/ RTM_RTA(struct rtmsg *);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, int);
int /*<<< orphan*/ parse_rtattr(struct rtattr **, int /*<<< orphan*/,
                                int /*<<< orphan*/, int);
int /*<<< orphan*/ stderr;
int find_dst(struct nlmsghdr *n, struct in_addr *src, struct in_addr *gw) {
  struct rtmsg *r = NLMSG_DATA(n);
  int len = n->nlmsg_len;
  struct rtattr *tb[RTA_MAX + 1];
  len -= NLMSG_LENGTH(sizeof(*r));
  if (len < 0) {
    fprintf(stderr, "BUG: wrong nlmsg len %d\n", len);
    return -1;
  }
  parse_rtattr(tb, RTA_MAX, RTM_RTA(r), len);
  if (tb[RTA_PREFSRC])
    src->s_addr = *(uint32_t *)RTA_DATA(tb[RTA_PREFSRC]);
  if (tb[RTA_GATEWAY])
    gw->s_addr = *(uint32_t *)RTA_DATA(tb[RTA_GATEWAY]);
  if (tb[RTA_OIF])
    return *(int *)RTA_DATA(tb[RTA_OIF]);
  return 0;
}


x86 assembly (clang, -O0):
<find_dst>:
push   %rbp
mov    %rsp,%rbp
sub    $0x60,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    -0x10(%rbp),%rdi
call   1060 <NLMSG_DATA@plt>
mov    %rax,-0x28(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%eax
mov    %eax,-0x2c(%rbp)
mov    0x2e3f(%rip),%rax
mov    (%rax),%eax
add    $0x1,%eax
mov    %rsp,%rcx
mov    %rcx,-0x38(%rbp)
lea    0xf(,%rax,8),%rdx
and    $0xfffffffffffffff0,%rdx
mov    %rsp,%rcx
sub    %rdx,%rcx
mov    %rcx,-0x50(%rbp)
mov    %rcx,%rsp
mov    %rax,-0x40(%rbp)
mov    $0x4,%edi
call   1040 <NLMSG_LENGTH@plt>
mov    %rax,%rcx
movslq -0x2c(%rbp),%rax
sub    %rcx,%rax
mov    %eax,-0x2c(%rbp)
cmpl   $0x0,-0x2c(%rbp)
jge    1206 <find_dst+0xa6>
mov    0x2df6(%rip),%rax
mov    (%rax),%edi
mov    -0x2c(%rbp),%edx
lea    0xe12(%rip),%rsi
call   1050 <fprintf@plt>
movl   $0xffffffff,-0x4(%rbp)
movl   $0x1,-0x44(%rbp)
jmp    12ef <find_dst+0x18f>
mov    0x2dc3(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x54(%rbp)
mov    -0x28(%rbp),%rdi
call   1030 <RTM_RTA@plt>
mov    -0x54(%rbp),%esi
mov    -0x50(%rbp),%rdi
mov    %eax,%edx
mov    -0x2c(%rbp),%ecx
call   1080 <parse_rtattr@plt>
mov    -0x50(%rbp),%rax
mov    0x2d91(%rip),%rcx
mov    (%rcx),%rcx
cmpq   $0x0,(%rax,%rcx,8)
je     1266 <find_dst+0x106>
mov    -0x50(%rbp),%rax
mov    0x2d78(%rip),%rcx
mov    (%rcx),%rcx
mov    (%rax,%rcx,8),%rdi
call   1070 <RTA_DATA@plt>
mov    (%rax),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x50(%rbp),%rax
mov    0x2d7f(%rip),%rcx
mov    (%rcx),%rcx
cmpq   $0x0,(%rax,%rcx,8)
je     12a0 <find_dst+0x140>
mov    -0x50(%rbp),%rax
mov    0x2d66(%rip),%rcx
mov    (%rcx),%rcx
mov    (%rax,%rcx,8),%rdi
call   1070 <RTA_DATA@plt>
mov    (%rax),%rcx
mov    -0x20(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x50(%rbp),%rax
mov    0x2d0d(%rip),%rcx
mov    (%rcx),%rcx
cmpq   $0x0,(%rax,%rcx,8)
je     12e1 <find_dst+0x181>
mov    -0x50(%rbp),%rax
mov    0x2cf4(%rip),%rcx
mov    (%rcx),%rcx
mov    (%rax,%rcx,8),%rdi
call   1070 <RTA_DATA@plt>
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
movl   $0x1,-0x44(%rbp)
jmp    12ef <find_dst+0x18f>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x44(%rbp)
mov    -0x38(%rbp),%rax
mov    %rax,%rsp
mov    -0x4(%rbp),%eax
mov    %rbp,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<find_dst>:
push   %rbp
mov    %rsp,%rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    %rdx,-0x30(%rbp)
mov    %rsi,%r15
mov    %rdi,%rbx
call   1060 <NLMSG_DATA@plt>
mov    %rax,%r13
mov    (%rbx),%r12d
mov    0x2e46(%rip),%r14
mov    (%r14),%eax
add    $0x1,%eax
mov    %rsp,%rbx
lea    0xf(,%rax,8),%rax
and    $0xfffffffffffffff0,%rax
sub    %rax,%rbx
mov    %rbx,%rsp
mov    $0x4,%edi
call   1040 <NLMSG_LENGTH@plt>
sub    %eax,%r12d
js     122b <find_dst+0xcb>
mov    (%r14),%r14d
mov    %r13,%rdi
call   1030 <RTM_RTA@plt>
mov    %rbx,%rdi
mov    %r14d,%esi
mov    %eax,%edx
mov    %r12d,%ecx
call   1080 <parse_rtattr@plt>
mov    0x2df2(%rip),%rax
mov    (%rax),%rax
mov    (%rbx,%rax,8),%rdi
test   %rdi,%rdi
je     11ed <find_dst+0x8d>
call   1070 <RTA_DATA@plt>
mov    (%rax),%rax
mov    %rax,(%r15)
mov    0x2dfc(%rip),%rax
mov    (%rax),%rax
mov    (%rbx,%rax,8),%rdi
test   %rdi,%rdi
je     120f <find_dst+0xaf>
call   1070 <RTA_DATA@plt>
mov    (%rax),%rax
mov    -0x30(%rbp),%rcx
mov    %rax,(%rcx)
mov    0x2da2(%rip),%rax
mov    (%rax),%rax
mov    (%rbx,%rax,8),%rdi
test   %rdi,%rdi
je     124a <find_dst+0xea>
call   1070 <RTA_DATA@plt>
mov    (%rax),%eax
jmp    124c <find_dst+0xec>
mov    0x2da6(%rip),%rax
mov    (%rax),%edi
lea    0xdc5(%rip),%rsi
mov    %r12d,%edx
call   1050 <fprintf@plt>
mov    $0xffffffff,%eax
jmp    124c <find_dst+0xec>
xor    %eax,%eax
lea    -0x28(%rbp),%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
%struct.nlmsghdr = type { i32 }
%struct.in_addr = type { i8* }
%struct.rtmsg = type { i32 }
%struct.rtattr = type { i32 }
@RTA_MAX = global i32 0
@stderr = global i32 0
@.str = [25 x i8] c"BUG: wrong nlmsg len %d\0A\00"
@RTA_PREFSRC = global i64 0
@RTA_GATEWAY = global i64 0
@RTA_OIF = global i64 0
define i32 @find_dst(%struct.nlmsghdr* %0, %struct.in_addr* %1, %struct.in_addr* %2) {
%4 = alloca i32
%5 = alloca %struct.nlmsghdr*
%6 = alloca %struct.in_addr*
%7 = alloca %struct.in_addr*
%8 = alloca %struct.rtmsg*
%9 = alloca i32
%10 = alloca i8*
%11 = alloca i64
%12 = alloca i32
store %struct.nlmsghdr* %0, %struct.nlmsghdr** %5
store %struct.in_addr* %1, %struct.in_addr** %6
store %struct.in_addr* %2, %struct.in_addr** %7
%13 = load %struct.nlmsghdr*, %struct.nlmsghdr** %5
%14 = call %struct.rtmsg* @NLMSG_DATA(%struct.nlmsghdr* %13)
store %struct.rtmsg* %14, %struct.rtmsg** %8
%15 = load %struct.nlmsghdr*, %struct.nlmsghdr** %5
%16 = getelementptr inbounds %struct.nlmsghdr, %struct.nlmsghdr* %15, i32 0, i32 0
%17 = load i32, i32* %16
store i32 %17, i32* %9
%18 = load i32, i32* @RTA_MAX
%19 = add nsw i32 %18, 1
%20 = zext i32 %19 to i64
%21 = call i8* @llvm.stacksave()
store i8* %21, i8** %10
%22 = alloca %struct.rtattr*, i64 %20
store i64 %20, i64* %11
%23 = call i64 @NLMSG_LENGTH(i32 4)
%24 = load i32, i32* %9
%25 = sext i32 %24 to i64
%26 = sub nsw i64 %25, %23
%27 = trunc i64 %26 to i32
store i32 %27, i32* %9
%28 = load i32, i32* %9
%29 = icmp slt i32 %28, 0
br i1 %29, label %30, label %34
30: ; preds = %3
%31 = load i32, i32* @stderr
%32 = load i32, i32* %9
%33 = call i32 @fprintf(i32 %31, i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str, i64 0, i64 0), i32 %32)
store i32 -1, i32* %4
store i32 1, i32* %12
br label %80
34: ; preds = %3
%35 = load i32, i32* @RTA_MAX
%36 = load %struct.rtmsg*, %struct.rtmsg** %8
%37 = call i32 @RTM_RTA(%struct.rtmsg* %36)
%38 = load i32, i32* %9
%39 = call i32 @parse_rtattr(%struct.rtattr** %22, i32 %35, i32 %37, i32 %38)
%40 = load i64, i64* @RTA_PREFSRC
%41 = getelementptr inbounds %struct.rtattr*, %struct.rtattr** %22, i64 %40
%42 = load %struct.rtattr*, %struct.rtattr** %41
%43 = icmp ne %struct.rtattr* %42, null
br i1 %43, label %44, label %53
44: ; preds = %34
%45 = load i64, i64* @RTA_PREFSRC
%46 = getelementptr inbounds %struct.rtattr*, %struct.rtattr** %22, i64 %45
%47 = load %struct.rtattr*, %struct.rtattr** %46
%48 = call i64 @RTA_DATA(%struct.rtattr* %47)
%49 = inttoptr i64 %48 to i8**
%50 = load i8*, i8** %49
%51 = load %struct.in_addr*, %struct.in_addr** %6
%52 = getelementptr inbounds %struct.in_addr, %struct.in_addr* %51, i32 0, i32 0
store i8* %50, i8** %52
br label %53
53: ; preds = %44, %34
%54 = load i64, i64* @RTA_GATEWAY
%55 = getelementptr inbounds %struct.rtattr*, %struct.rtattr** %22, i64 %54
%56 = load %struct.rtattr*, %struct.rtattr** %55
%57 = icmp ne %struct.rtattr* %56, null
br i1 %57, label %58, label %67
58: ; preds = %53
%59 = load i64, i64* @RTA_GATEWAY
%60 = getelementptr inbounds %struct.rtattr*, %struct.rtattr** %22, i64 %59
%61 = load %struct.rtattr*, %struct.rtattr** %60
%62 = call i64 @RTA_DATA(%struct.rtattr* %61)
%63 = inttoptr i64 %62 to i8**
%64 = load i8*, i8** %63
%65 = load %struct.in_addr*, %struct.in_addr** %7
%66 = getelementptr inbounds %struct.in_addr, %struct.in_addr* %65, i32 0, i32 0
store i8* %64, i8** %66
br label %67
67: ; preds = %58, %53
%68 = load i64, i64* @RTA_OIF
%69 = getelementptr inbounds %struct.rtattr*, %struct.rtattr** %22, i64 %68
%70 = load %struct.rtattr*, %struct.rtattr** %69
%71 = icmp ne %struct.rtattr* %70, null
br i1 %71, label %72, label %79
72: ; preds = %67
%73 = load i64, i64* @RTA_OIF
%74 = getelementptr inbounds %struct.rtattr*, %struct.rtattr** %22, i64 %73
%75 = load %struct.rtattr*, %struct.rtattr** %74
%76 = call i64 @RTA_DATA(%struct.rtattr* %75)
%77 = inttoptr i64 %76 to i32*
%78 = load i32, i32* %77
store i32 %78, i32* %4
store i32 1, i32* %12
br label %80
79: ; preds = %67
store i32 0, i32* %4
store i32 1, i32* %12
br label %80
80: ; preds = %79, %72, %30
%81 = load i8*, i8** %10
%82 = load i32, i32* %4
ret i32 %82
}

LLVM IR (-O2):
%struct.nlmsghdr = type { i32 }
%struct.in_addr = type { i8* }
%struct.rtmsg = type { i32 }
%struct.rtattr = type { i32 }
@RTA_MAX = global i32 0
@stderr = global i32 0
@.str = [25 x i8] c"BUG: wrong nlmsg len %d\0A\00"
@RTA_PREFSRC = global i64 0
@RTA_GATEWAY = global i64 0
@RTA_OIF = global i64 0
define i32 @find_dst(%struct.nlmsghdr* %0, %struct.in_addr* nocapture writeonly %1, %struct.in_addr* nocapture writeonly %2) {
%4 = tail call %struct.rtmsg* @NLMSG_DATA(%struct.nlmsghdr* %0)
%5 = getelementptr inbounds %struct.nlmsghdr, %struct.nlmsghdr* %0, i64 0, i32 0
%6 = load i32, i32* %5
%7 = load i32, i32* @RTA_MAX
%8 = add nsw i32 %7, 1
%9 = zext i32 %8 to i64
%10 = alloca %struct.rtattr*, i64 %9
%11 = tail call i64 @NLMSG_LENGTH(i32 4)
%12 = trunc i64 %11 to i32
%13 = sub i32 %6, %12
%14 = icmp slt i32 %13, 0
br i1 %14, label %15, label %18
15: ; preds = %3
%16 = load i32, i32* @stderr
%17 = tail call i32 @fprintf(i32 %16, i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str, i64 0, i64 0), i32 %13)
br label %50
18: ; preds = %3
%19 = load i32, i32* @RTA_MAX
%20 = tail call i32 @RTM_RTA(%struct.rtmsg* %4)
%21 = call i32 @parse_rtattr(%struct.rtattr** %10, i32 %19, i32 %20, i32 %13)
%22 = load i64, i64* @RTA_PREFSRC
%23 = getelementptr inbounds %struct.rtattr*, %struct.rtattr** %10, i64 %22
%24 = load %struct.rtattr*, %struct.rtattr** %23
%25 = icmp eq %struct.rtattr* %24, null
br i1 %25, label %31, label %26
26: ; preds = %18
%27 = call i64 @RTA_DATA(%struct.rtattr* %24)
%28 = inttoptr i64 %27 to i8**
%29 = load i8*, i8** %28
%30 = getelementptr inbounds %struct.in_addr, %struct.in_addr* %1, i64 0, i32 0
store i8* %29, i8** %30
br label %31
31: ; preds = %26, %18
%32 = load i64, i64* @RTA_GATEWAY
%33 = getelementptr inbounds %struct.rtattr*, %struct.rtattr** %10, i64 %32
%34 = load %struct.rtattr*, %struct.rtattr** %33
%35 = icmp eq %struct.rtattr* %34, null
br i1 %35, label %41, label %36
36: ; preds = %31
%37 = call i64 @RTA_DATA(%struct.rtattr* %34)
%38 = inttoptr i64 %37 to i8**
%39 = load i8*, i8** %38
%40 = getelementptr inbounds %struct.in_addr, %struct.in_addr* %2, i64 0, i32 0
store i8* %39, i8** %40
br label %41
41: ; preds = %36, %31
%42 = load i64, i64* @RTA_OIF
%43 = getelementptr inbounds %struct.rtattr*, %struct.rtattr** %10, i64 %42
%44 = load %struct.rtattr*, %struct.rtattr** %43
%45 = icmp eq %struct.rtattr* %44, null
br i1 %45, label %50, label %46
46: ; preds = %41
%47 = call i64 @RTA_DATA(%struct.rtattr* %44)
%48 = inttoptr i64 %47 to i32*
%49 = load i32, i32* %48
br label %50
50: ; preds = %41, %46, %15
%51 = phi i32 [ -1, %15 ], [ %49, %46 ], [ 0, %41 ]
ret i32 %51
}