#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ memcpy(char *, char *, int);
int /*<<< orphan*/ printf(char *, ...);
void vuln(char *s, int count) {
  int *ptr;
  int newdata = 0xaaaa;
  char buff[16];
  int olddata = 0xffff;
  ptr = &olddata;
  printf("vuln() has received %d bytes\n", count);
  memcpy(buff, s, count);
  *ptr = newdata;
  printf("Input message: %s\n", s);
  printf("newdata=%x, olddata=%x\n", newdata, olddata);
}


x86 assembly (clang, -O0):
<vuln>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x8(%rbp)
mov    %esi,-0xc(%rbp)
movl   $0xaaaa,-0x1c(%rbp)
movl   $0xffff,-0x34(%rbp)
lea    -0x34(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    -0xc(%rbp),%esi
lea    0xeb1(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    -0x30(%rbp),%rdi
mov    -0x8(%rbp),%rsi
mov    -0xc(%rbp),%edx
call   1040 <memcpy@plt>
mov    -0x1c(%rbp),%ecx
mov    -0x18(%rbp),%rax
mov    %ecx,(%rax)
mov    -0x8(%rbp),%rsi
lea    0xea4(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x1c(%rbp),%esi
mov    -0x34(%rbp),%edx
lea    0xea3(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<vuln>:
push   %r14
push   %rbx
sub    $0x18,%rsp
mov    %esi,%ebx
mov    %rdi,%r14
lea    0xecd(%rip),%rdi
xor    %eax,%eax
call   1030 <printf@plt>
mov    %rsp,%rdi
mov    %r14,%rsi
mov    %ebx,%edx
call   1040 <memcpy@plt>
lea    0xed0(%rip),%rdi
mov    %r14,%rsi
xor    %eax,%eax
call   1030 <printf@plt>
lea    0xed2(%rip),%rdi
mov    $0xaaaa,%esi
mov    $0xaaaa,%edx
xor    %eax,%eax
call   1030 <printf@plt>
add    $0x18,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
@.str = [30 x i8] c"vuln() has received %d bytes\0A\00"
@.str.1 = [19 x i8] c"Input message: %s\0A\00"
@.str.2 = [24 x i8] c"newdata=%x, olddata=%x\0A\00"
define void @vuln(i8* %0, i32 %1) {
%3 = alloca i8*
%4 = alloca i32
%5 = alloca i32*
%6 = alloca i32
%7 = alloca [16 x i8]
%8 = alloca i32
store i8* %0, i8** %3
store i32 %1, i32* %4
store i32 43690, i32* %6
store i32 65535, i32* %8
store i32* %8, i32** %5
%9 = load i32, i32* %4
%10 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str, i64 0, i64 0), i32 %9)
%11 = getelementptr inbounds [16 x i8], [16 x i8]* %7, i64 0, i64 0
%12 = load i8*, i8** %3
%13 = load i32, i32* %4
%14 = call i32 @memcpy(i8* %11, i8* %12, i32 %13)
%15 = load i32, i32* %6
%16 = load i32*, i32** %5
store i32 %15, i32* %16
%17 = load i8*, i8** %3
%18 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.1, i64 0, i64 0), i8* %17)
%19 = load i32, i32* %6
%20 = load i32, i32* %8
%21 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.2, i64 0, i64 0), i32 %19, i32 %20)
ret void
}

LLVM IR (-O2):
@.str = [30 x i8] c"vuln() has received %d bytes\0A\00"
@.str.1 = [19 x i8] c"Input message: %s\0A\00"
@.str.2 = [24 x i8] c"newdata=%x, olddata=%x\0A\00"
define void @vuln(i8* %0, i32 %1) {
%3 = alloca [16 x i8]
%4 = getelementptr inbounds [16 x i8], [16 x i8]* %3, i64 0, i64 0
%5 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([30 x i8], [30 x i8]* @.str, i64 0, i64 0), i32 %1)
%6 = call i32 @memcpy(i8* %4, i8* %0, i32 %1)
%7 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([19 x i8], [19 x i8]* @.str.1, i64 0, i64 0), i8* %0)
%8 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([24 x i8], [24 x i8]* @.str.2, i64 0, i64 0), i32 43690, i32 43690)
ret void
}