#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ strcat(char *, char const *const);
void bufferAccessOutOfBounds_strcat(char *dest, const char *const source) {
  char buf4[4] = {0};
  const char *const srcstr3 = "123";
  const char *const srcstr4 = "1234";
  (void)strcat(buf4, srcstr4);
  (void)strcat(dest, source);
  (void)strcat(buf4, srcstr3);
  (void)strcat(dest, srcstr4);
}


x86 assembly (clang, -O0):
<bufferAccessOutOfBounds_strcat>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
lea    -0x14(%rbp),%rdi
xor    %esi,%esi
mov    $0x4,%edx
call   1030 <memset@plt>
lea    0xeb9(%rip),%rax
mov    %rax,-0x20(%rbp)
lea    0xeb2(%rip),%rax
mov    %rax,-0x28(%rbp)
lea    -0x14(%rbp),%rdi
lea    0xea3(%rip),%rsi
call   1040 <strcat@plt>
mov    -0x8(%rbp),%rdi
mov    -0x10(%rbp),%rsi
call   1040 <strcat@plt>
lea    -0x14(%rbp),%rdi
lea    0xe82(%rip),%rsi
call   1040 <strcat@plt>
mov    -0x8(%rbp),%rdi
lea    0xe76(%rip),%rsi
call   1040 <strcat@plt>
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<bufferAccessOutOfBounds_strcat>:
push   %r15
push   %r14
push   %r12
push   %rbx
push   %rax
mov    %rsi,%r14
mov    %rdi,%rbx
movl   $0x0,0x4(%rsp)
lea    0xed7(%rip),%r15
lea    0x4(%rsp),%r12
mov    %r12,%rdi
mov    %r15,%rsi
call   1030 <strcat@plt>
mov    %rbx,%rdi
mov    %r14,%rsi
call   1030 <strcat@plt>
lea    0xeb1(%rip),%rsi
mov    %r12,%rdi
call   1030 <strcat@plt>
mov    %rbx,%rdi
mov    %r15,%rsi
call   1030 <strcat@plt>
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@.str = [4 x i8] c"123\00"
@.str.1 = [5 x i8] c"1234\00"
define void @bufferAccessOutOfBounds_strcat(i8* %0, i8* %1) {
%3 = alloca i8*
%4 = alloca i8*
%5 = alloca [4 x i8]
%6 = alloca i8*
%7 = alloca i8*
store i8* %0, i8** %3
store i8* %1, i8** %4
%8 = bitcast [4 x i8]* %5 to i8*
store i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i8** %6
store i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.1, i64 0, i64 0), i8** %7
%9 = getelementptr inbounds [4 x i8], [4 x i8]* %5, i64 0, i64 0
%10 = call i32 @strcat(i8* %9, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.1, i32 0, i32 0))
%11 = load i8*, i8** %3
%12 = load i8*, i8** %4
%13 = call i32 @strcat(i8* %11, i8* %12)
%14 = getelementptr inbounds [4 x i8], [4 x i8]* %5, i64 0, i64 0
%15 = call i32 @strcat(i8* %14, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i32 0, i32 0))
%16 = load i8*, i8** %3
%17 = call i32 @strcat(i8* %16, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.1, i32 0, i32 0))
ret void
}

LLVM IR (-O2):
@.str = [4 x i8] c"123\00"
@.str.1 = [5 x i8] c"1234\00"
define void @bufferAccessOutOfBounds_strcat(i8* %0, i8* %1) {
%3 = alloca i32
%4 = bitcast i32* %3 to i8*
store i32 0, i32* %3
%5 = call i32 @strcat(i8* %4, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.1, i64 0, i64 0))
%6 = call i32 @strcat(i8* %0, i8* %1)
%7 = call i32 @strcat(i8* %4, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0))
%8 = call i32 @strcat(i8* %0, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.1, i64 0, i64 0))
ret void
}