#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef scalar_t__ fbuf;

/* Variables and functions */
int __VERIFIER_nondet_int();
int /*<<< orphan*/ __assert_fail(char *, char *, unsigned int, char *);
int isascii(int);
int isspace(int);
int main(void) {
  char fbuf[3];
  int fb;
  int c1;
  int tmp;
  int tmp___0;
  unsigned long __cil_tmp6;
  unsigned long __cil_tmp7;
  unsigned long __cil_tmp8;
  unsigned long __cil_tmp9;
  char __cil_tmp10;
  int __cil_tmp11;
  unsigned long __cil_tmp12;
  unsigned long __cil_tmp13;
  char __cil_tmp14;
  int __cil_tmp15;
  unsigned long __cil_tmp16;
  unsigned long __cil_tmp17;
  unsigned long __cil_tmp18;
  unsigned long __cil_tmp19;
  {
    fb = 0;
    {
      while (1) {
      while_0_continue:;
        { c1 = __VERIFIER_nondet_int(); }
        if (c1 != -1) {
        } else {
          goto while_0_break;
        }
        { tmp = isascii(c1); }
        if (tmp) {
          { tmp___0 = isspace(c1); }
          if (tmp___0) {
            goto while_0_continue;
          } else {
          }
        } else {
        }
        if (c1 == 61) {
          goto while_0_continue;
        } else {
        }
        if (fb < 2) {
        } else {
          {
            __assert_fail("fb < 2",
                          "../versisec/sendmail/progs/"
                          "sendmailCVE-1999-0047mime7to8_mime7to8_arr_one_char_"
                          "heavy_test_bad.c",
                          22U, "main");
          }
        }
        __cil_tmp6 = fb * 1UL;
        __cil_tmp7 = (unsigned long)(fbuf) + __cil_tmp6;
        *((char *)__cil_tmp7) = (char)c1;
        {
          __cil_tmp8 = fb * 1UL;
          __cil_tmp9 = (unsigned long)(fbuf) + __cil_tmp8;
          __cil_tmp10 = *((char *)__cil_tmp9);
          __cil_tmp11 = (int)__cil_tmp10;
          if (__cil_tmp11 == 10) {
            fb = fb - 1;
            if (fb < 0) {
              fb = 0;
            } else {
              {
                __cil_tmp12 = fb * 1UL;
                __cil_tmp13 = (unsigned long)(fbuf) + __cil_tmp12;
                __cil_tmp14 = *((char *)__cil_tmp13);
                __cil_tmp15 = (int)__cil_tmp14;
                if (__cil_tmp15 != 13) {
                  fb = fb + 1;
                } else {
                }
              }
            }
            if (fb <= 2) {
            } else {
              {
                __assert_fail("fb <= 2",
                              "../versisec/sendmail/progs/"
                              "sendmailCVE-1999-0047mime7to8_mime7to8_arr_one_"
                              "char_heavy_test_bad.c",
                              36U, "main");
              }
            }
            __cil_tmp16 = fb * 1UL;
            __cil_tmp17 = (unsigned long)(fbuf) + __cil_tmp16;
            *((char *)__cil_tmp17) = (char)0;
            fb = 0;
          } else {
            fb = fb + 1;
          }
        }
      }
    while_0_break:;
    }
    if (fb > 0) {
      __cil_tmp18 = fb * 1UL;
      __cil_tmp19 = (unsigned long)(fbuf) + __cil_tmp18;
      *((char *)__cil_tmp19) = (char)0;
    } else {
    }
    return (0);
  }
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x80,%rsp
movl   $0x0,-0x4(%rbp)
movl   $0x0,-0xc(%rbp)
jmp    115e <main+0x1e>
mov    $0x0,%al
call   1050 <__VERIFIER_nondet_int@plt>
mov    %eax,-0x10(%rbp)
cmpl   $0xffffffff,-0x10(%rbp)
je     1177 <main+0x37>
jmp    117c <main+0x3c>
jmp    1321 <main+0x1e1>
mov    -0x10(%rbp),%edi
call   1060 <isascii@plt>
mov    %eax,-0x14(%rbp)
cmpl   $0x0,-0x14(%rbp)
je     11b5 <main+0x75>
mov    -0x10(%rbp),%edi
call   1040 <isspace@plt>
mov    %eax,-0x18(%rbp)
cmpl   $0x0,-0x18(%rbp)
je     11ab <main+0x6b>
jmp    115e <main+0x1e>
jmp    11b0 <main+0x70>
jmp    11ba <main+0x7a>
jmp    11ba <main+0x7a>
cmpl   $0x3d,-0x10(%rbp)
jne    11c9 <main+0x89>
jmp    115e <main+0x1e>
jmp    11ce <main+0x8e>
cmpl   $0x2,-0xc(%rbp)
jge    11dd <main+0x9d>
jmp    11fc <main+0xbc>
lea    0xe1c(%rip),%rdi
lea    0xe1c(%rip),%rsi
mov    $0x16,%edx
lea    0xe70(%rip),%rcx
call   1030 <__assert_fail@plt>
movslq -0xc(%rbp),%rax
shl    $0x0,%rax
mov    %rax,-0x20(%rbp)
lea    -0x7(%rbp),%rax
add    -0x20(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    -0x10(%rbp),%eax
mov    %al,%cl
mov    -0x28(%rbp),%rax
mov    %cl,(%rax)
movslq -0xc(%rbp),%rax
shl    $0x0,%rax
mov    %rax,-0x30(%rbp)
lea    -0x7(%rbp),%rax
add    -0x30(%rbp),%rax
mov    %rax,-0x38(%rbp)
mov    -0x38(%rbp),%rax
mov    (%rax),%al
mov    %al,-0x39(%rbp)
movsbl -0x39(%rbp),%eax
mov    %eax,-0x40(%rbp)
cmpl   $0xa,-0x40(%rbp)
jne    1313 <main+0x1d3>
mov    -0xc(%rbp),%eax
sub    $0x1,%eax
mov    %eax,-0xc(%rbp)
cmpl   $0x0,-0xc(%rbp)
jge    1270 <main+0x130>
movl   $0x0,-0xc(%rbp)
jmp    12ba <main+0x17a>
movslq -0xc(%rbp),%rax
shl    $0x0,%rax
mov    %rax,-0x48(%rbp)
lea    -0x7(%rbp),%rax
add    -0x48(%rbp),%rax
mov    %rax,-0x50(%rbp)
mov    -0x50(%rbp),%rax
mov    (%rax),%al
mov    %al,-0x51(%rbp)
movsbl -0x51(%rbp),%eax
mov    %eax,-0x58(%rbp)
cmpl   $0xd,-0x58(%rbp)
je     12b0 <main+0x170>
mov    -0xc(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0xc(%rbp)
jmp    12b5 <main+0x175>
jmp    12b5 <main+0x175>
jmp    12ba <main+0x17a>
cmpl   $0x2,-0xc(%rbp)
jg     12c9 <main+0x189>
jmp    12e8 <main+0x1a8>
lea    0xd9c(%rip),%rdi
lea    0xd30(%rip),%rsi
mov    $0x24,%edx
lea    0xd84(%rip),%rcx
call   1030 <__assert_fail@plt>
movslq -0xc(%rbp),%rax
shl    $0x0,%rax
mov    %rax,-0x60(%rbp)
lea    -0x7(%rbp),%rax
add    -0x60(%rbp),%rax
mov    %rax,-0x68(%rbp)
mov    -0x68(%rbp),%rax
movb   $0x0,(%rax)
movl   $0x0,-0xc(%rbp)
jmp    131c <main+0x1dc>
mov    -0xc(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0xc(%rbp)
jmp    1159 <main+0x19>
cmpl   $0x0,-0xc(%rbp)
jle    134f <main+0x20f>
movslq -0xc(%rbp),%rax
shl    $0x0,%rax
mov    %rax,-0x70(%rbp)
lea    -0x7(%rbp),%rax
add    -0x70(%rbp),%rax
mov    %rax,-0x78(%rbp)
mov    -0x78(%rbp),%rax
movb   $0x0,(%rax)
jmp    1354 <main+0x214>
jmp    1354 <main+0x214>
xor    %eax,%eax
add    $0x80,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
lea    0x5(%rsp),%rbx
lea    0xec0(%rip),%r15
lea    0xf19(%rip),%r13
lea    0xeab(%rip),%r12
xor    %r14d,%r14d
nopl   0x0(%rax,%rax,1)
xor    %eax,%eax
call   1050 <__VERIFIER_nondet_int@plt>
cmp    $0xffffffff,%eax
je     1200 <main+0xd0>
mov    %eax,%ebp
cmp    $0x7f,%eax
ja     1187 <main+0x57>
mov    %ebp,%edi
call   1040 <isspace@plt>
test   %eax,%eax
jne    1160 <main+0x30>
cmp    $0x3d,%ebp
je     1160 <main+0x30>
cmp    $0x2,%r14d
jl     11a0 <main+0x70>
mov    %r12,%rdi
mov    %r15,%rsi
mov    $0x16,%edx
mov    %r13,%rcx
call   1030 <__assert_fail@plt>
movslq %r14d,%rax
mov    %bpl,(%rax,%rbx,1)
cmp    $0xa,%bpl
je     11c0 <main+0x90>
add    $0x1,%r14d
jmp    1160 <main+0x30>
cs nopw 0x0(%rax,%rax,1)
nopl   (%rax)
xor    %eax,%eax
test   %r14d,%r14d
jle    11f5 <main+0xc5>
lea    -0x1(%r14),%eax
mov    %eax,%ecx
cmpb   $0xd,(%rcx,%rbx,1)
cmove  %eax,%r14d
cmp    $0x3,%r14d
jb     11f2 <main+0xc2>
lea    0xe8a(%rip),%rdi
mov    %r15,%rsi
mov    $0x24,%edx
mov    %r13,%rcx
call   1030 <__assert_fail@plt>
mov    %r14d,%eax
mov    %eax,%eax
movb   $0x0,(%rax,%rbx,1)
jmp    1155 <main+0x25>
test   %r14d,%r14d
jle    120c <main+0xdc>
mov    %r14d,%eax
movb   $0x0,(%rax,%rbx,1)
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [7 x i8] c"fb < 2\00"
@.str.1 = [96 x i8] c"../versisec/sendmail/progs/sendmailCVE-1999-0047mime7to8_mime7to8_arr_one_char_heavy_test_bad.c\00"
@.str.2 = [5 x i8] c"main\00"
@.str.3 = [8 x i8] c"fb <= 2\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca [3 x i8]
%3 = alloca i32
%4 = alloca i32
%5 = alloca i32
%6 = alloca i32
%7 = alloca i64
%8 = alloca i64
%9 = alloca i64
%10 = alloca i64
%11 = alloca i8
%12 = alloca i32
%13 = alloca i64
%14 = alloca i64
%15 = alloca i8
%16 = alloca i32
%17 = alloca i64
%18 = alloca i64
%19 = alloca i64
%20 = alloca i64
store i32 0, i32* %1
store i32 0, i32* %3
br label %21
21: ; preds = %0, %124
br label %22
22: ; preds = %45, %38, %21
%23 = call i32 (...) @__VERIFIER_nondet_int()
store i32 %23, i32* %4
%24 = load i32, i32* %4
%25 = icmp ne i32 %24, -1
br i1 %25, label %26, label %27
26: ; preds = %22
br label %28
27: ; preds = %22
br label %125
28: ; preds = %26
%29 = load i32, i32* %4
%30 = call i32 @isascii(i32 %29)
store i32 %30, i32* %5
%31 = load i32, i32* %5
%32 = icmp ne i32 %31, 0
br i1 %32, label %33, label %41
33: ; preds = %28
%34 = load i32, i32* %4
%35 = call i32 @isspace(i32 %34)
store i32 %35, i32* %6
%36 = load i32, i32* %6
%37 = icmp ne i32 %36, 0
br i1 %37, label %38, label %39
38: ; preds = %33
br label %22
39: ; preds = %33
br label %40
40: ; preds = %39
br label %42
41: ; preds = %28
br label %42
42: ; preds = %41, %40
%43 = load i32, i32* %4
%44 = icmp eq i32 %43, 61
br i1 %44, label %45, label %46
45: ; preds = %42
br label %22
46: ; preds = %42
br label %47
47: ; preds = %46
%48 = load i32, i32* %3
%49 = icmp slt i32 %48, 2
br i1 %49, label %50, label %51
50: ; preds = %47
br label %53
51: ; preds = %47
%52 = call i32 @__assert_fail(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([96 x i8], [96 x i8]* @.str.1, i64 0, i64 0), i32 22, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.2, i64 0, i64 0))
br label %53
53: ; preds = %51, %50
%54 = load i32, i32* %3
%55 = sext i32 %54 to i64
%56 = mul i64 %55, 1
store i64 %56, i64* %7
%57 = getelementptr inbounds [3 x i8], [3 x i8]* %2, i64 0, i64 0
%58 = ptrtoint i8* %57 to i64
%59 = load i64, i64* %7
%60 = add i64 %58, %59
store i64 %60, i64* %8
%61 = load i32, i32* %4
%62 = trunc i32 %61 to i8
%63 = load i64, i64* %8
%64 = inttoptr i64 %63 to i8*
store i8 %62, i8* %64
%65 = load i32, i32* %3
%66 = sext i32 %65 to i64
%67 = mul i64 %66, 1
store i64 %67, i64* %9
%68 = getelementptr inbounds [3 x i8], [3 x i8]* %2, i64 0, i64 0
%69 = ptrtoint i8* %68 to i64
%70 = load i64, i64* %9
%71 = add i64 %69, %70
store i64 %71, i64* %10
%72 = load i64, i64* %10
%73 = inttoptr i64 %72 to i8*
%74 = load i8, i8* %73
store i8 %74, i8* %11
%75 = load i8, i8* %11
%76 = sext i8 %75 to i32
store i32 %76, i32* %12
%77 = load i32, i32* %12
%78 = icmp eq i32 %77, 10
br i1 %78, label %79, label %121
79: ; preds = %53
%80 = load i32, i32* %3
%81 = sub nsw i32 %80, 1
store i32 %81, i32* %3
%82 = load i32, i32* %3
%83 = icmp slt i32 %82, 0
br i1 %83, label %84, label %85
84: ; preds = %79
store i32 0, i32* %3
br label %105
85: ; preds = %79
%86 = load i32, i32* %3
%87 = sext i32 %86 to i64
%88 = mul i64 %87, 1
store i64 %88, i64* %13
%89 = getelementptr inbounds [3 x i8], [3 x i8]* %2, i64 0, i64 0
%90 = ptrtoint i8* %89 to i64
%91 = load i64, i64* %13
%92 = add i64 %90, %91
store i64 %92, i64* %14
%93 = load i64, i64* %14
%94 = inttoptr i64 %93 to i8*
%95 = load i8, i8* %94
store i8 %95, i8* %15
%96 = load i8, i8* %15
%97 = sext i8 %96 to i32
store i32 %97, i32* %16
%98 = load i32, i32* %16
%99 = icmp ne i32 %98, 13
br i1 %99, label %100, label %103
100: ; preds = %85
%101 = load i32, i32* %3
%102 = add nsw i32 %101, 1
store i32 %102, i32* %3
br label %104
103: ; preds = %85
br label %104
104: ; preds = %103, %100
br label %105
105: ; preds = %104, %84
%106 = load i32, i32* %3
%107 = icmp sle i32 %106, 2
br i1 %107, label %108, label %109
108: ; preds = %105
br label %111
109: ; preds = %105
%110 = call i32 @__assert_fail(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.3, i64 0, i64 0), i8* getelementptr inbounds ([96 x i8], [96 x i8]* @.str.1, i64 0, i64 0), i32 36, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.2, i64 0, i64 0))
br label %111
111: ; preds = %109, %108
%112 = load i32, i32* %3
%113 = sext i32 %112 to i64
%114 = mul i64 %113, 1
store i64 %114, i64* %17
%115 = getelementptr inbounds [3 x i8], [3 x i8]* %2, i64 0, i64 0
%116 = ptrtoint i8* %115 to i64
%117 = load i64, i64* %17
%118 = add i64 %116, %117
store i64 %118, i64* %18
%119 = load i64, i64* %18
%120 = inttoptr i64 %119 to i8*
store i8 0, i8* %120
store i32 0, i32* %3
br label %124
121: ; preds = %53
%122 = load i32, i32* %3
%123 = add nsw i32 %122, 1
store i32 %123, i32* %3
br label %124
124: ; preds = %121, %111
br label %21
125: ; preds = %27
%126 = load i32, i32* %3
%127 = icmp sgt i32 %126, 0
br i1 %127, label %128, label %138
128: ; preds = %125
%129 = load i32, i32* %3
%130 = sext i32 %129 to i64
%131 = mul i64 %130, 1
store i64 %131, i64* %19
%132 = getelementptr inbounds [3 x i8], [3 x i8]* %2, i64 0, i64 0
%133 = ptrtoint i8* %132 to i64
%134 = load i64, i64* %19
%135 = add i64 %133, %134
store i64 %135, i64* %20
%136 = load i64, i64* %20
%137 = inttoptr i64 %136 to i8*
store i8 0, i8* %137
br label %139
138: ; preds = %125
br label %139
139: ; preds = %138, %128
ret i32 0
}

LLVM IR (-O2):
@.str = [7 x i8] c"fb < 2\00"
@.str.1 = [96 x i8] c"../versisec/sendmail/progs/sendmailCVE-1999-0047mime7to8_mime7to8_arr_one_char_heavy_test_bad.c\00"
@.str.2 = [5 x i8] c"main\00"
@.str.3 = [8 x i8] c"fb <= 2\00"
define i32 @main() {
%1 = alloca [3 x i8]
%2 = getelementptr inbounds [3 x i8], [3 x i8]* %1, i64 0, i64 0
%3 = ptrtoint [3 x i8]* %1 to i64
br label %4
4: ; preds = %47, %0
%5 = phi i32 [ 0, %0 ], [ %48, %47 ]
br label %6
6: ; preds = %11, %4
%7 = call i32 (...) @__VERIFIER_nondet_int()
%8 = icmp eq i32 %7, -1
br i1 %8, label %49, label %9
9: ; preds = %6
%10 = icmp ult i32 %7, 128
br i1 %10, label %11, label %16
11: ; preds = %9
%12 = call i32 @isspace(i32 %7)
%13 = icmp ne i32 %12, 0
%14 = icmp eq i32 %7, 61
%15 = select i1 %13, i1 true, i1 %14
br i1 %15, label %6, label %16
16: ; preds = %9, %11
%17 = icmp slt i32 %5, 2
br i1 %17, label %20, label %18
18: ; preds = %16
%19 = call i32 @__assert_fail(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([96 x i8], [96 x i8]* @.str.1, i64 0, i64 0), i32 22, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.2, i64 0, i64 0))
br label %20
20: ; preds = %16, %18
%21 = sext i32 %5 to i64
%22 = add i64 %21, %3
%23 = trunc i32 %7 to i8
%24 = inttoptr i64 %22 to i8*
store i8 %23, i8* %24
%25 = and i32 %7, 255
%26 = icmp eq i32 %25, 10
br i1 %26, label %27, label %45
27: ; preds = %20
%28 = add nsw i32 %5, -1
%29 = icmp slt i32 %5, 1
br i1 %29, label %40, label %30
30: ; preds = %27
%31 = zext i32 %28 to i64
%32 = add i64 %31, %3
%33 = inttoptr i64 %32 to i8*
%34 = load i8, i8* %33
%35 = icmp eq i8 %34, 13
%36 = select i1 %35, i32 %28, i32 %5
%37 = icmp ult i32 %36, 3
br i1 %37, label %40, label %38
38: ; preds = %30
%39 = call i32 @__assert_fail(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.3, i64 0, i64 0), i8* getelementptr inbounds ([96 x i8], [96 x i8]* @.str.1, i64 0, i64 0), i32 36, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.2, i64 0, i64 0))
br label %40
40: ; preds = %27, %30, %38
%41 = phi i32 [ %36, %30 ], [ %36, %38 ], [ 0, %27 ]
%42 = zext i32 %41 to i64
%43 = add i64 %42, %3
%44 = inttoptr i64 %43 to i8*
store i8 0, i8* %44
br label %47
45: ; preds = %20
%46 = add nsw i32 %5, 1
br label %47
47: ; preds = %45, %40
%48 = phi i32 [ 0, %40 ], [ %46, %45 ]
br label %4
49: ; preds = %6
%50 = icmp sgt i32 %5, 0
br i1 %50, label %51, label %55
51: ; preds = %49
%52 = zext i32 %5 to i64
%53 = add i64 %52, %3
%54 = inttoptr i64 %53 to i8*
store i8 0, i8* %54
br label %55
55: ; preds = %49, %51
ret i32 0
}