#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ uint8_t;
typedef scalar_t__ ssize_t;

/* Variables and functions */
scalar_t__ brcm_marshall_get_len(int /*<<< orphan*/ *, int);
uint8_t *brcm_marshall_func_next_arg(uint8_t *rawdata, size_t n,
                                     uint8_t *arg_index, size_t *arg_len) {
  uint8_t *enddata;
  uint8_t *nextarg;
  ssize_t len;
  if (arg_index < rawdata)
    return NULL;
  if ((len = brcm_marshall_get_len(rawdata, n)) < 0)
    return NULL;
  enddata = rawdata + len;
  if (arg_index > enddata)
    return NULL;
  if ((len = brcm_marshall_get_len(arg_index, enddata - arg_index)) < 0)
    return NULL;
  nextarg = arg_index + len;
  if ((len = brcm_marshall_get_len(nextarg, enddata - nextarg)) < 0)
    return NULL;
  if (arg_len) {
    *arg_len = len;
  }
  return nextarg;
}


x86 assembly (clang, -O0):
<brcm_marshall_func_next_arg>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
mov    -0x20(%rbp),%rax
cmp    -0x10(%rbp),%rax
jae    1143 <brcm_marshall_func_next_arg+0x33>
movq   $0x0,-0x8(%rbp)
jmp    1236 <brcm_marshall_func_next_arg+0x126>
mov    -0x10(%rbp),%rdi
mov    -0x18(%rbp),%rax
mov    %eax,%esi
call   1030 <brcm_marshall_get_len@plt>
mov    %rax,-0x40(%rbp)
cmp    $0x0,%rax
jge    116d <brcm_marshall_func_next_arg+0x5d>
movq   $0x0,-0x8(%rbp)
jmp    1236 <brcm_marshall_func_next_arg+0x126>
mov    -0x10(%rbp),%rax
mov    -0x40(%rbp),%rcx
shl    $0x2,%rcx
add    %rcx,%rax
mov    %rax,-0x30(%rbp)
mov    -0x20(%rbp),%rax
cmp    -0x30(%rbp),%rax
jbe    119b <brcm_marshall_func_next_arg+0x8b>
movq   $0x0,-0x8(%rbp)
jmp    1236 <brcm_marshall_func_next_arg+0x126>
mov    -0x20(%rbp),%rdi
mov    -0x30(%rbp),%rax
mov    -0x20(%rbp),%rcx
sub    %rcx,%rax
sar    $0x2,%rax
mov    %eax,%esi
call   1030 <brcm_marshall_get_len@plt>
mov    %rax,-0x40(%rbp)
cmp    $0x0,%rax
jge    11d0 <brcm_marshall_func_next_arg+0xc0>
movq   $0x0,-0x8(%rbp)
jmp    1236 <brcm_marshall_func_next_arg+0x126>
mov    -0x20(%rbp),%rax
mov    -0x40(%rbp),%rcx
shl    $0x2,%rcx
add    %rcx,%rax
mov    %rax,-0x38(%rbp)
mov    -0x38(%rbp),%rdi
mov    -0x30(%rbp),%rax
mov    -0x38(%rbp),%rcx
sub    %rcx,%rax
sar    $0x2,%rax
mov    %eax,%esi
call   1030 <brcm_marshall_get_len@plt>
mov    %rax,-0x40(%rbp)
cmp    $0x0,%rax
jge    1218 <brcm_marshall_func_next_arg+0x108>
movq   $0x0,-0x8(%rbp)
jmp    1236 <brcm_marshall_func_next_arg+0x126>
cmpq   $0x0,-0x28(%rbp)
je     122e <brcm_marshall_func_next_arg+0x11e>
mov    -0x40(%rbp),%rcx
mov    -0x28(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x38(%rbp),%rax
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<brcm_marshall_func_next_arg>:
push   %r15
push   %r14
push   %r12
push   %rbx
push   %rax
cmp    %rdi,%rdx
jb     1172 <brcm_marshall_func_next_arg+0x62>
mov    %rcx,%r14
mov    %rdx,%r12
mov    %rdi,%rbx
call   1030 <brcm_marshall_get_len@plt>
test   %rax,%rax
js     1172 <brcm_marshall_func_next_arg+0x62>
lea    (%rbx,%rax,4),%r15
mov    %r15,%rsi
sub    %r12,%rsi
jb     1172 <brcm_marshall_func_next_arg+0x62>
shr    $0x2,%rsi
mov    %r12,%rdi
call   1030 <brcm_marshall_get_len@plt>
test   %rax,%rax
js     1172 <brcm_marshall_func_next_arg+0x62>
lea    (%r12,%rax,4),%rbx
sub    %rbx,%r15
shr    $0x2,%r15
mov    %rbx,%rdi
mov    %r15d,%esi
call   1030 <brcm_marshall_get_len@plt>
test   %rax,%rax
js     1172 <brcm_marshall_func_next_arg+0x62>
test   %r14,%r14
je     1174 <brcm_marshall_func_next_arg+0x64>
mov    %rax,(%r14)
jmp    1174 <brcm_marshall_func_next_arg+0x64>
xor    %ebx,%ebx
mov    %rbx,%rax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
define i32* @brcm_marshall_func_next_arg(i32* %0, i64 %1, i32* %2, i64* %3) {
%5 = alloca i32*
%6 = alloca i32*
%7 = alloca i64
%8 = alloca i32*
%9 = alloca i64*
%10 = alloca i32*
%11 = alloca i32*
%12 = alloca i64
store i32* %0, i32** %6
store i64 %1, i64* %7
store i32* %2, i32** %8
store i64* %3, i64** %9
%13 = load i32*, i32** %8
%14 = load i32*, i32** %6
%15 = icmp ult i32* %13, %14
br i1 %15, label %16, label %17
16: ; preds = %4
store i32* null, i32** %5
br label %67
17: ; preds = %4
%18 = load i32*, i32** %6
%19 = load i64, i64* %7
%20 = trunc i64 %19 to i32
%21 = call i64 @brcm_marshall_get_len(i32* %18, i32 %20)
store i64 %21, i64* %12
%22 = icmp slt i64 %21, 0
br i1 %22, label %23, label %24
23: ; preds = %17
store i32* null, i32** %5
br label %67
24: ; preds = %17
%25 = load i32*, i32** %6
%26 = load i64, i64* %12
%27 = getelementptr inbounds i32, i32* %25, i64 %26
store i32* %27, i32** %10
%28 = load i32*, i32** %8
%29 = load i32*, i32** %10
%30 = icmp ugt i32* %28, %29
br i1 %30, label %31, label %32
31: ; preds = %24
store i32* null, i32** %5
br label %67
32: ; preds = %24
%33 = load i32*, i32** %8
%34 = load i32*, i32** %10
%35 = load i32*, i32** %8
%36 = ptrtoint i32* %34 to i64
%37 = ptrtoint i32* %35 to i64
%38 = sub i64 %36, %37
%39 = sdiv exact i64 %38, 4
%40 = trunc i64 %39 to i32
%41 = call i64 @brcm_marshall_get_len(i32* %33, i32 %40)
store i64 %41, i64* %12
%42 = icmp slt i64 %41, 0
br i1 %42, label %43, label %44
43: ; preds = %32
store i32* null, i32** %5
br label %67
44: ; preds = %32
%45 = load i32*, i32** %8
%46 = load i64, i64* %12
%47 = getelementptr inbounds i32, i32* %45, i64 %46
store i32* %47, i32** %11
%48 = load i32*, i32** %11
%49 = load i32*, i32** %10
%50 = load i32*, i32** %11
%51 = ptrtoint i32* %49 to i64
%52 = ptrtoint i32* %50 to i64
%53 = sub i64 %51, %52
%54 = sdiv exact i64 %53, 4
%55 = trunc i64 %54 to i32
%56 = call i64 @brcm_marshall_get_len(i32* %48, i32 %55)
store i64 %56, i64* %12
%57 = icmp slt i64 %56, 0
br i1 %57, label %58, label %59
58: ; preds = %44
store i32* null, i32** %5
br label %67
59: ; preds = %44
%60 = load i64*, i64** %9
%61 = icmp ne i64* %60, null
br i1 %61, label %62, label %65
62: ; preds = %59
%63 = load i64, i64* %12
%64 = load i64*, i64** %9
store i64 %63, i64* %64
br label %65
65: ; preds = %62, %59
%66 = load i32*, i32** %11
store i32* %66, i32** %5
br label %67
67: ; preds = %65, %58, %43, %31, %23, %16
%68 = load i32*, i32** %5
ret i32* %68
}

LLVM IR (-O2):
define i32* @brcm_marshall_func_next_arg(i32* %0, i64 %1, i32* %2, i64* writeonly %3) {
%5 = icmp ult i32* %2, %0
br i1 %5, label %32, label %6
6: ; preds = %4
%7 = trunc i64 %1 to i32
%8 = tail call i64 @brcm_marshall_get_len(i32* %0, i32 %7)
%9 = icmp slt i64 %8, 0
br i1 %9, label %32, label %10
10: ; preds = %6
%11 = getelementptr inbounds i32, i32* %0, i64 %8
%12 = icmp ult i32* %11, %2
br i1 %12, label %32, label %13
13: ; preds = %10
%14 = ptrtoint i32* %11 to i64
%15 = ptrtoint i32* %2 to i64
%16 = sub i64 %14, %15
%17 = lshr exact i64 %16, 2
%18 = trunc i64 %17 to i32
%19 = tail call i64 @brcm_marshall_get_len(i32* %2, i32 %18)
%20 = icmp slt i64 %19, 0
br i1 %20, label %32, label %21
21: ; preds = %13
%22 = getelementptr inbounds i32, i32* %2, i64 %19
%23 = ptrtoint i32* %22 to i64
%24 = sub i64 %14, %23
%25 = lshr exact i64 %24, 2
%26 = trunc i64 %25 to i32
%27 = tail call i64 @brcm_marshall_get_len(i32* %22, i32 %26)
%28 = icmp slt i64 %27, 0
br i1 %28, label %32, label %29
29: ; preds = %21
%30 = icmp eq i64* %3, null
br i1 %30, label %32, label %31
31: ; preds = %29
store i64 %27, i64* %3
br label %32
32: ; preds = %29, %31, %21, %13, %10, %6, %4
%33 = phi i32* [ null, %4 ], [ null, %6 ], [ null, %10 ], [ null, %13 ], [ null, %21 ], [ %22, %31 ], [ %22, %29 ]
ret i32* %33
}