#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ malloc(int);
int /*<<< orphan*/ memset(char *, char, unsigned long);
int /*<<< orphan*/ printf(char *, char *, ...);
int main() {
  unsigned long diff;
  char *buff1 = (char *)malloc(16);
  char *buff2 = (char *)malloc(16);
  diff = (unsigned long)buff2 - (unsigned long)buff1;
  printf(">buff1 =%p,buff2 =%p,diff =%d bytes\n", buff1, buff2, (int)diff);
  memset(buff2, 'A', 16 - 1);
  buff2[16 - 1] = '\0';
  printf(">before overflow buff2 is :%s\n", buff2);
  memset(buff1, 'B', diff + 8);
  printf(">after overflow buff2 is :%s\n", buff2);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rax
mov    -0x18(%rbp),%rcx
sub    %rcx,%rax
mov    %rax,-0x10(%rbp)
mov    -0x18(%rbp),%rsi
mov    -0x20(%rbp),%rdx
mov    -0x10(%rbp),%rax
mov    %eax,%ecx
lea    0xe81(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x20(%rbp),%rdi
mov    $0x41,%esi
mov    $0xf,%edx
call   1040 <memset@plt>
mov    -0x20(%rbp),%rax
movb   $0x0,0xf(%rax)
mov    -0x20(%rbp),%rsi
lea    0xe79(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x18(%rbp),%rdi
mov    -0x10(%rbp),%rdx
add    $0x8,%rdx
mov    $0x42,%esi
call   1040 <memset@plt>
mov    -0x20(%rbp),%rsi
lea    0xe70(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %rbx
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,%r14
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,%r15
mov    %rax,%rbx
sub    %r14,%rbx
lea    0xea4(%rip),%rdi
mov    %r14,%rsi
mov    %rax,%rdx
mov    %ebx,%ecx
xor    %eax,%eax
call   1030 <printf@plt>
mov    $0xf,%edx
mov    %r15,%rdi
mov    $0x41,%esi
call   1040 <memset@plt>
movb   $0x0,0xf(%r15)
lea    0xe9c(%rip),%rdi
mov    %r15,%rsi
xor    %eax,%eax
call   1030 <printf@plt>
add    $0x8,%rbx
mov    %r14,%rdi
mov    $0x42,%esi
mov    %rbx,%rdx
call   1040 <memset@plt>
lea    0xe96(%rip),%rdi
mov    %r15,%rsi
xor    %eax,%eax
call   1030 <printf@plt>
xor    %eax,%eax
pop    %rbx
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@.str = [37 x i8] c">buff1 =%p,buff2 =%p,diff =%d bytes\0A\00"
@.str.1 = [31 x i8] c">before overflow buff2 is :%s\0A\00"
@.str.2 = [30 x i8] c">after overflow buff2 is :%s\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i64
%3 = alloca i8*
%4 = alloca i8*
store i32 0, i32* %1
%5 = call i64 @malloc(i32 16)
%6 = inttoptr i64 %5 to i8*
store i8* %6, i8** %3
%7 = call i64 @malloc(i32 16)
%8 = inttoptr i64 %7 to i8*
store i8* %8, i8** %4
%9 = load i8*, i8** %4
%10 = ptrtoint i8* %9 to i64
%11 = load i8*, i8** %3
%12 = ptrtoint i8* %11 to i64
%13 = sub i64 %10, %12
store i64 %13, i64* %2
%14 = load i8*, i8** %3
%15 = load i8*, i8** %4
%16 = load i64, i64* %2
%17 = trunc i64 %16 to i32
%18 = call i32 (i8*, i8*, ...) @printf(i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str, i64 0, i64 0), i8* %14, i8* %15, i32 %17)
%19 = load i8*, i8** %4
%20 = call i32 @memset(i8* %19, i8 signext 65, i64 15)
%21 = load i8*, i8** %4
%22 = getelementptr inbounds i8, i8* %21, i64 15
store i8 0, i8* %22
%23 = load i8*, i8** %4
%24 = call i32 (i8*, i8*, ...) @printf(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.1, i64 0, i64 0), i8* %23)
%25 = load i8*, i8** %3
%26 = load i64, i64* %2
%27 = add i64 %26, 8
%28 = call i32 @memset(i8* %25, i8 signext 66, i64 %27)
%29 = load i8*, i8** %4
%30 = call i32 (i8*, i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.2, i64 0, i64 0), i8* %29)
ret i32 0
}

LLVM IR (-O2):
@.str = [37 x i8] c">buff1 =%p,buff2 =%p,diff =%d bytes\0A\00"
@.str.1 = [31 x i8] c">before overflow buff2 is :%s\0A\00"
@.str.2 = [30 x i8] c">after overflow buff2 is :%s\0A\00"
define i32 @main() {
%1 = tail call i64 @malloc(i32 16)
%2 = inttoptr i64 %1 to i8*
%3 = tail call i64 @malloc(i32 16)
%4 = inttoptr i64 %3 to i8*
%5 = sub i64 %3, %1
%6 = trunc i64 %5 to i32
%7 = tail call i32 (i8*, i8*, ...) @printf(i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str, i64 0, i64 0), i8* %2, i8* %4, i32 %6)
%8 = tail call i32 @memset(i8* %4, i8 signext 65, i64 15)
%9 = getelementptr inbounds i8, i8* %4, i64 15
store i8 0, i8* %9
%10 = tail call i32 (i8*, i8*, ...) @printf(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.1, i64 0, i64 0), i8* %4)
%11 = add i64 %5, 8
%12 = tail call i32 @memset(i8* %2, i8 signext 66, i64 %11)
%13 = tail call i32 (i8*, i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.2, i64 0, i64 0), i8* %4)
ret i32 0
}