#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
int /*<<< orphan*/ exit(int);
int fread(char *, int, int, int /*<<< orphan*/ *);
int /*<<< orphan*/ puts(char *);
int /*<<< orphan*/ sprintf(char *, char *, char *, char *);
void vuln(char *str, FILE *fd) {
  char buf[32];
  char buf2[32];
  int amt;
  if ((amt = fread(buf2, 1, 16, fd)) < 1)
    exit(2);
  buf2[amt] = '\0';
  sprintf(buf, "thing: %s: %s", buf2, str);
  puts(buf);
}


x86 assembly (clang, -O0):
<vuln>:
push   %rbp
mov    %rsp,%rbp
sub    $0x60,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
lea    -0x50(%rbp),%rdi
mov    -0x10(%rbp),%rcx
mov    $0x1,%esi
mov    $0x10,%edx
call   1040 <fread@plt>
mov    %eax,-0x54(%rbp)
cmp    $0x1,%eax
jge    117d <vuln+0x3d>
mov    $0x2,%edi
call   1060 <exit@plt>
movslq -0x54(%rbp),%rax
movb   $0x0,-0x50(%rbp,%rax,1)
lea    -0x30(%rbp),%rdi
lea    -0x50(%rbp),%rdx
mov    -0x8(%rbp),%rcx
lea    0xe67(%rip),%rsi
call   1050 <sprintf@plt>
lea    -0x30(%rbp),%rdi
call   1030 <puts@plt>
add    $0x60,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<vuln>:
push   %r14
push   %rbx
sub    $0x48,%rsp
mov    %rsi,%rcx
mov    %rdi,%r14
mov    %rsp,%rdi
mov    $0x1,%esi
mov    $0x10,%edx
call   1040 <fread@plt>
test   %eax,%eax
jle    1193 <vuln+0x53>
mov    %eax,%eax
movb   $0x0,(%rsp,%rax,1)
lea    0xe90(%rip),%rsi
lea    0x20(%rsp),%rbx
mov    %rsp,%rdx
mov    %rbx,%rdi
mov    %r14,%rcx
call   1050 <sprintf@plt>
mov    %rbx,%rdi
call   1030 <puts@plt>
add    $0x48,%rsp
pop    %rbx
pop    %r14
ret
mov    $0x2,%edi
call   1060 <exit@plt>

LLVM IR (-O0):
@.str = [14 x i8] c"thing: %s: %s\00"
define void @vuln(i8* %0, i32* %1) {
%3 = alloca i8*
%4 = alloca i32*
%5 = alloca [32 x i8]
%6 = alloca [32 x i8]
%7 = alloca i32
store i8* %0, i8** %3
store i32* %1, i32** %4
%8 = getelementptr inbounds [32 x i8], [32 x i8]* %6, i64 0, i64 0
%9 = load i32*, i32** %4
%10 = call i32 @fread(i8* %8, i32 1, i32 16, i32* %9)
store i32 %10, i32* %7
%11 = icmp slt i32 %10, 1
br i1 %11, label %12, label %14
12: ; preds = %2
%13 = call i32 @exit(i32 2)
unreachable
14: ; preds = %2
%15 = load i32, i32* %7
%16 = sext i32 %15 to i64
%17 = getelementptr inbounds [32 x i8], [32 x i8]* %6, i64 0, i64 %16
store i8 0, i8* %17
%18 = getelementptr inbounds [32 x i8], [32 x i8]* %5, i64 0, i64 0
%19 = getelementptr inbounds [32 x i8], [32 x i8]* %6, i64 0, i64 0
%20 = load i8*, i8** %3
%21 = call i32 @sprintf(i8* %18, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str, i64 0, i64 0), i8* %19, i8* %20)
%22 = getelementptr inbounds [32 x i8], [32 x i8]* %5, i64 0, i64 0
%23 = call i32 @puts(i8* %22)
ret void
}

LLVM IR (-O2):
@.str = [14 x i8] c"thing: %s: %s\00"
define void @vuln(i8* %0, i32* nocapture %1) {
%3 = alloca [32 x i8]
%4 = alloca [32 x i8]
%5 = getelementptr inbounds [32 x i8], [32 x i8]* %3, i64 0, i64 0
%6 = getelementptr inbounds [32 x i8], [32 x i8]* %4, i64 0, i64 0
%7 = call i32 @fread(i8* %6, i32 1, i32 16, i32* %1)
%8 = icmp slt i32 %7, 1
br i1 %8, label %9, label %11
9: ; preds = %2
%10 = tail call i32 @exit(i32 2)
unreachable
11: ; preds = %2
%12 = zext i32 %7 to i64
%13 = getelementptr inbounds [32 x i8], [32 x i8]* %4, i64 0, i64 %12
store i8 0, i8* %13
%14 = call i32 @sprintf(i8* %5, i8* dereferenceable(1) getelementptr inbounds ([14 x i8], [14 x i8]* @.str, i64 0, i64 0), i8* %6, i8* %0)
%15 = call i32 @puts(i8* %5)
ret void
}