#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int MAP_ANONYMOUS;
char *MAP_FAILED;
int MAP_PRIVATE;
int PROT_EXEC;
int PROT_READ;
int PROT_WRITE;
scalar_t__ calloc(int, int);
char *mmap(int /*<<< orphan*/ *, int, int, int, int, int /*<<< orphan*/);
int /*<<< orphan*/ munmap(char *, int);
int /*<<< orphan*/ printf(char *, char *);
int main(void) {
  char *addr;
  int can_map_above_stack = 0;
  char **maps;
  unsigned int num_maps = 0;
  if (sizeof(unsigned long) == 8) {
    addr = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE,
                MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
    goto out;
  }
  maps = (char **)calloc(1024 * 1024, sizeof(char *));
  while (1) {
    addr = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE,
                MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
    if (addr == MAP_FAILED)
      break;
    if (addr > (char *)&addr)
      can_map_above_stack = 1;
    maps[num_maps++] = addr;
  }
  if (!can_map_above_stack) {
    unsigned int map_size = 0x1000;
    while (1) {
      munmap(maps[--num_maps], 0x1000);
      addr = mmap(NULL, map_size, PROT_READ | PROT_WRITE,
                  MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
      if (addr == MAP_FAILED)
        break;
      munmap(addr, map_size);
      map_size += 0x1000;
    }
  }
  munmap(maps[num_maps - 1], 0x1000);
  addr = mmap(NULL, 0x1000, PROT_READ | PROT_EXEC, MAP_ANONYMOUS | MAP_PRIVATE,
              -1, 0);
out:
  printf("%p\n", addr);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
movl   $0x0,-0x14(%rbp)
movl   $0x0,-0x24(%rbp)
mov    0x2eb4(%rip),%rax
mov    (%rax),%edx
mov    0x2e83(%rip),%rax
or     (%rax),%edx
mov    0x2e8a(%rip),%rax
mov    (%rax),%ecx
mov    0x2e69(%rip),%rax
or     (%rax),%ecx
xor    %eax,%eax
mov    %eax,%edi
mov    $0x1000,%esi
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1030 <mmap@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rsi
lea    0xe79(%rip),%rdi
call   1040 <printf@plt>
xor    %eax,%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rax
mov    0x2ed0(%rip),%rax
mov    0x2ea1(%rip),%rcx
mov    (%rcx),%edx
or     (%rax),%edx
mov    0x2ea6(%rip),%rax
mov    0x2e87(%rip),%rcx
mov    (%rcx),%ecx
or     (%rax),%ecx
xor    %edi,%edi
mov    $0x1000,%esi
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1030 <mmap@plt>
lea    0xe9f(%rip),%rdi
mov    %rax,%rsi
call   1040 <printf@plt>
xor    %eax,%eax
pop    %rcx
ret

LLVM IR (-O0):
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_ANONYMOUS = global i32 0
@MAP_PRIVATE = global i32 0
@.str = [4 x i8] c"%p\0A\00"
@MAP_FAILED = global i8* null
@PROT_EXEC = global i32 0
define i32 @main() {
%1 = alloca i32
%2 = alloca i8*
%3 = alloca i32
%4 = alloca i8**
%5 = alloca i32
store i32 0, i32* %1
store i32 0, i32* %3
store i32 0, i32* %5
%6 = load i32, i32* @PROT_READ
%7 = load i32, i32* @PROT_WRITE
%8 = or i32 %6, %7
%9 = load i32, i32* @MAP_ANONYMOUS
%10 = load i32, i32* @MAP_PRIVATE
%11 = or i32 %9, %10
%12 = call i8* @mmap(i32* null, i32 4096, i32 %8, i32 %11, i32 -1, i32 0)
store i8* %12, i8** %2
br label %13
13: ; preds = %0
%14 = load i8*, i8** %2
%15 = call i32 @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i8* %14)
ret i32 0
}

LLVM IR (-O2):
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_ANONYMOUS = global i32 0
@MAP_PRIVATE = global i32 0
@.str = [4 x i8] c"%p\0A\00"
@MAP_FAILED = global i8* null
@PROT_EXEC = global i32 0
define i32 @main() {
%1 = load i32, i32* @PROT_READ
%2 = load i32, i32* @PROT_WRITE
%3 = or i32 %2, %1
%4 = load i32, i32* @MAP_ANONYMOUS
%5 = load i32, i32* @MAP_PRIVATE
%6 = or i32 %5, %4
%7 = tail call i8* @mmap(i32* null, i32 4096, i32 %3, i32 %6, i32 -1, i32 0)
%8 = tail call i32 @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i8* %7)
ret i32 0
}