#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
char *dynamic_replace(char *, char *, char *);
int /*<<< orphan*/ free(char *);
char *safe_strdup(char const *);
int /*<<< orphan*/ sprintf(char *, char *, char);
int /*<<< orphan*/ sscanf(char *, char *, unsigned int *);
int /*<<< orphan*/ strncpy(char *, char *, int);
char *http_unescape(const char *escaped) {
  char *unescaped = safe_strdup(escaped);
  char *s = (char *)escaped;
  char old[4];
  char new[2];
  char *new_unescaped;
  while (*s != '\0') {
    if (*s == '%') {
      unsigned int new_char_num;
      strncpy(old, s, 3);
      old[3] = '\0';
      sscanf(old + 1, "%2X", &new_char_num);
      if ('%' != (char)new_char_num) {
        sprintf(new, "%c", (char)new_char_num);
        new_unescaped = dynamic_replace(unescaped, old, new);
        free(unescaped);
        unescaped = new_unescaped;
      }
    }
    s = *s == '%' ? s + 3 : s + 1;
  }
  sprintf(old, "%%%.2X", (int)'%');
  sprintf(new, "%c", '%');
  new_unescaped = dynamic_replace(unescaped, old, new);
  free(unescaped);
  unescaped = new_unescaped;
  return unescaped;
}


x86 assembly (clang, -O0):
<http_unescape>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x8(%rbp)
mov    -0x8(%rbp),%rdi
call   1070 <safe_strdup@plt>
mov    %rax,-0x10(%rbp)
mov    -0x8(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rax
movsbl (%rax),%eax
cmp    $0x0,%eax
je     125d <http_unescape+0xfd>
mov    -0x18(%rbp),%rax
movsbl (%rax),%eax
cmp    $0x25,%eax
jne    1223 <http_unescape+0xc3>
lea    -0x1c(%rbp),%rdi
mov    -0x18(%rbp),%rsi
mov    $0x3,%edx
call   1040 <strncpy@plt>
movb   $0x0,-0x19(%rbp)
lea    -0x1c(%rbp),%rdi
add    $0x1,%rdi
lea    0xe3a(%rip),%rsi
lea    -0x2c(%rbp),%rdx
call   1050 <sscanf@plt>
mov    -0x2c(%rbp),%eax
movsbl %al,%ecx
mov    $0x25,%eax
cmp    %ecx,%eax
je     121e <http_unescape+0xbe>
lea    -0x1e(%rbp),%rdi
mov    -0x2c(%rbp),%eax
lea    0xe14(%rip),%rsi
movsbl %al,%edx
call   1080 <sprintf@plt>
mov    -0x10(%rbp),%rdi
lea    -0x1c(%rbp),%rsi
lea    -0x1e(%rbp),%rdx
call   1060 <dynamic_replace@plt>
mov    %rax,-0x28(%rbp)
mov    -0x10(%rbp),%rdi
call   1030 <free@plt>
mov    -0x28(%rbp),%rax
mov    %rax,-0x10(%rbp)
jmp    1223 <http_unescape+0xc3>
mov    -0x18(%rbp),%rax
movsbl (%rax),%eax
cmp    $0x25,%eax
jne    1244 <http_unescape+0xe4>
mov    -0x18(%rbp),%rax
add    $0x3,%rax
mov    %rax,-0x38(%rbp)
jmp    1250 <http_unescape+0xf0>
mov    -0x18(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x38(%rbp)
mov    -0x38(%rbp),%rax
mov    %rax,-0x18(%rbp)
jmp    1181 <http_unescape+0x21>
lea    -0x1c(%rbp),%rdi
lea    0xd9f(%rip),%rsi
mov    $0x25,%edx
call   1080 <sprintf@plt>
lea    -0x1e(%rbp),%rdi
lea    0xd87(%rip),%rsi
mov    $0x25,%edx
call   1080 <sprintf@plt>
mov    -0x10(%rbp),%rdi
lea    -0x1c(%rbp),%rsi
lea    -0x1e(%rbp),%rdx
call   1060 <dynamic_replace@plt>
mov    %rax,-0x28(%rbp)
mov    -0x10(%rbp),%rdi
call   1030 <free@plt>
mov    -0x28(%rbp),%rax
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<http_unescape>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %rdi,%rbx
call   1070 <safe_strdup@plt>
mov    %rax,0x8(%rsp)
lea    0x5(%rsp),%rbp
lea    0x4(%rsp),%r12
lea    0xe74(%rip),%r14
lea    0x14(%rsp),%r13
jmp    11b7 <http_unescape+0x57>
cs nopw 0x0(%rax,%rax,1)
nopl   (%rax)
test   %al,%al
je     1232 <http_unescape+0xd2>
xor    %ecx,%ecx
cmp    $0x25,%al
sete   %cl
lea    (%rbx,%rcx,2),%rbx
add    $0x1,%rbx
movzbl (%rbx),%eax
cmp    $0x25,%al
jne    11a0 <http_unescape+0x40>
mov    %r12,%rdi
mov    %rbx,%rsi
mov    $0x3,%edx
call   1040 <strncpy@plt>
movb   $0x0,0x7(%rsp)
mov    %rbp,%rdi
mov    %r14,%rsi
mov    %r13,%rdx
call   1050 <sscanf@plt>
movzbl 0x14(%rsp),%eax
cmp    $0x25,%eax
je     122a <http_unescape+0xca>
mov    %al,0x2(%rsp)
movb   $0x0,0x3(%rsp)
mov    0x8(%rsp),%r15
mov    %r15,%rdi
mov    %r12,%rsi
lea    0x2(%rsp),%rdx
call   1060 <dynamic_replace@plt>
mov    %r13,%r12
mov    %r14,%r13
mov    %rax,%r14
mov    %r15,%rdi
call   1030 <free@plt>
mov    %r14,0x8(%rsp)
mov    %r13,%r14
mov    %r12,%r13
lea    0x4(%rsp),%r12
movzbl (%rbx),%eax
jmp    11a8 <http_unescape+0x48>
lea    0xdcb(%rip),%rsi
lea    0x4(%rsp),%rbx
mov    %rbx,%rdi
mov    $0x25,%edx
call   1080 <sprintf@plt>
movw   $0x25,0x2(%rsp)
lea    0x2(%rsp),%rdx
mov    0x8(%rsp),%rbp
mov    %rbp,%rdi
mov    %rbx,%rsi
call   1060 <dynamic_replace@plt>
mov    %rax,%rbx
mov    %rbp,%rdi
call   1030 <free@plt>
mov    %rbx,%rax
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [4 x i8] c"%2X\00"
@.str.1 = [3 x i8] c"%c\00"
@.str.2 = [7 x i8] c"%%%.2X\00"
define i8* @http_unescape(i8* %0) {
%2 = alloca i8*
%3 = alloca i8*
%4 = alloca i8*
%5 = alloca [4 x i8]
%6 = alloca [2 x i8]
%7 = alloca i8*
%8 = alloca i32
store i8* %0, i8** %2
%9 = load i8*, i8** %2
%10 = call i8* @safe_strdup(i8* %9)
store i8* %10, i8** %3
%11 = load i8*, i8** %2
store i8* %11, i8** %4
br label %12
12: ; preds = %58, %1
%13 = load i8*, i8** %4
%14 = load i8, i8* %13
%15 = sext i8 %14 to i32
%16 = icmp ne i32 %15, 0
br i1 %16, label %17, label %60
17: ; preds = %12
%18 = load i8*, i8** %4
%19 = load i8, i8* %18
%20 = sext i8 %19 to i32
%21 = icmp eq i32 %20, 37
br i1 %21, label %22, label %47
22: ; preds = %17
%23 = getelementptr inbounds [4 x i8], [4 x i8]* %5, i64 0, i64 0
%24 = load i8*, i8** %4
%25 = call i32 @strncpy(i8* %23, i8* %24, i32 3)
%26 = getelementptr inbounds [4 x i8], [4 x i8]* %5, i64 0, i64 3
store i8 0, i8* %26
%27 = getelementptr inbounds [4 x i8], [4 x i8]* %5, i64 0, i64 0
%28 = getelementptr inbounds i8, i8* %27, i64 1
%29 = call i32 @sscanf(i8* %28, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32* %8)
%30 = load i32, i32* %8
%31 = trunc i32 %30 to i8
%32 = sext i8 %31 to i32
%33 = icmp ne i32 37, %32
br i1 %33, label %34, label %46
34: ; preds = %22
%35 = getelementptr inbounds [2 x i8], [2 x i8]* %6, i64 0, i64 0
%36 = load i32, i32* %8
%37 = trunc i32 %36 to i8
%38 = call i32 @sprintf(i8* %35, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i8 signext %37)
%39 = load i8*, i8** %3
%40 = getelementptr inbounds [4 x i8], [4 x i8]* %5, i64 0, i64 0
%41 = getelementptr inbounds [2 x i8], [2 x i8]* %6, i64 0, i64 0
%42 = call i8* @dynamic_replace(i8* %39, i8* %40, i8* %41)
store i8* %42, i8** %7
%43 = load i8*, i8** %3
%44 = call i32 @free(i8* %43)
%45 = load i8*, i8** %7
store i8* %45, i8** %3
br label %46
46: ; preds = %34, %22
br label %47
47: ; preds = %46, %17
%48 = load i8*, i8** %4
%49 = load i8, i8* %48
%50 = sext i8 %49 to i32
%51 = icmp eq i32 %50, 37
br i1 %51, label %52, label %55
52: ; preds = %47
%53 = load i8*, i8** %4
%54 = getelementptr inbounds i8, i8* %53, i64 3
br label %58
55: ; preds = %47
%56 = load i8*, i8** %4
%57 = getelementptr inbounds i8, i8* %56, i64 1
br label %58
58: ; preds = %55, %52
%59 = phi i8* [ %54, %52 ], [ %57, %55 ]
store i8* %59, i8** %4
br label %12
60: ; preds = %12
%61 = getelementptr inbounds [4 x i8], [4 x i8]* %5, i64 0, i64 0
%62 = call i32 @sprintf(i8* %61, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0), i8 signext 37)
%63 = getelementptr inbounds [2 x i8], [2 x i8]* %6, i64 0, i64 0
%64 = call i32 @sprintf(i8* %63, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i8 signext 37)
%65 = load i8*, i8** %3
%66 = getelementptr inbounds [4 x i8], [4 x i8]* %5, i64 0, i64 0
%67 = getelementptr inbounds [2 x i8], [2 x i8]* %6, i64 0, i64 0
%68 = call i8* @dynamic_replace(i8* %65, i8* %66, i8* %67)
store i8* %68, i8** %7
%69 = load i8*, i8** %3
%70 = call i32 @free(i8* %69)
%71 = load i8*, i8** %7
store i8* %71, i8** %3
%72 = load i8*, i8** %3
ret i8* %72
}

LLVM IR (-O2):
@.str = [4 x i8] c"%2X\00"
@.str.2 = [7 x i8] c"%%%.2X\00"
define i8* @http_unescape(i8* %0) {
%2 = alloca [4 x i8]
%3 = alloca [2 x i8]
%4 = alloca i32
%5 = tail call i8* @safe_strdup(i8* %0)
%6 = getelementptr inbounds [4 x i8], [4 x i8]* %2, i64 0, i64 0
%7 = getelementptr inbounds [2 x i8], [2 x i8]* %3, i64 0, i64 0
%8 = bitcast i32* %4 to i8*
%9 = getelementptr inbounds [4 x i8], [4 x i8]* %2, i64 0, i64 3
%10 = getelementptr inbounds [4 x i8], [4 x i8]* %2, i64 0, i64 1
%11 = getelementptr inbounds [2 x i8], [2 x i8]* %3, i64 0, i64 1
br label %12
12: ; preds = %29, %1
%13 = phi i8* [ %5, %1 ], [ %31, %29 ]
%14 = phi i8* [ %0, %1 ], [ %34, %29 ]
%15 = load i8, i8* %14
switch i8 %15, label %29 [
i8 0, label %35
i8 37, label %16
]
16: ; preds = %12
%17 = call i32 @strncpy(i8* %6, i8* %14, i32 3)
store i8 0, i8* %9
%18 = call i32 @sscanf(i8* %10, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32* %4)
%19 = load i32, i32* %4
%20 = and i32 %19, 255
%21 = icmp eq i32 %20, 37
br i1 %21, label %26, label %22
22: ; preds = %16
%23 = trunc i32 %19 to i8
store i8 %23, i8* %7
store i8 0, i8* %11
%24 = call i8* @dynamic_replace(i8* %13, i8* %6, i8* %7)
%25 = call i32 @free(i8* %13)
br label %26
26: ; preds = %22, %16
%27 = phi i8* [ %24, %22 ], [ %13, %16 ]
%28 = load i8, i8* %14
br label %29
29: ; preds = %12, %26
%30 = phi i8 [ %28, %26 ], [ %15, %12 ]
%31 = phi i8* [ %27, %26 ], [ %13, %12 ]
%32 = icmp eq i8 %30, 37
%33 = select i1 %32, i64 3, i64 1
%34 = getelementptr inbounds i8, i8* %14, i64 %33
br label %12
35: ; preds = %12
%36 = call i32 @sprintf(i8* %6, i8* dereferenceable(1) getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0), i8 signext 37)
store i8 37, i8* %7
store i8 0, i8* %11
%37 = call i8* @dynamic_replace(i8* %13, i8* %6, i8* %7)
%38 = call i32 @free(i8* %13)
ret i8* %37
}