#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int random_unsigned_value();
int /*<<< orphan*/ sink(char *);
int /*<<< orphan*/ strcat(char *, char *);
void test_strcat_range(void) {
  char buf[5] = "";
  (strcat((buf), ((0 == random_unsigned_value() ? "0123456789" + 10 - 0
                                                : "0123456789"))),
   sink((buf)));
  (strcat((buf), ((1 == random_unsigned_value() ? "0123456789" + 10 - 1
                                                : "0123456789"))),
   sink((buf)));
  (strcat((buf), ((2 == random_unsigned_value() ? "0123456789" + 10 - 2
                                                : "0123456789"))),
   sink((buf)));
  (strcat((buf), ((3 == random_unsigned_value() ? "0123456789" + 10 - 3
                                                : "0123456789"))),
   sink((buf)));
  (strcat((buf), ((4 == random_unsigned_value() ? "0123456789" + 10 - 4
                                                : "0123456789"))),
   sink((buf)));
  (strcat((buf), ((5 == random_unsigned_value() ? "0123456789" + 10 - 5
                                                : "0123456789"))),
   sink((buf)));
  {
    char buf2[5] = "12";
    (strcat((buf2), ((4 == random_unsigned_value() ? "0123456789" + 10 - 4
                                                   : "0123456789"))),
     sink((buf2)));
  }
}


x86 assembly (clang, -O0):
<test_strcat_range>:
push   %rbp
mov    %rsp,%rbp
sub    $0x50,%rsp
lea    -0x5(%rbp),%rdi
xor    %esi,%esi
mov    $0x5,%edx
call   1030 <memset@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0x48(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x48(%rbp),%rdi
mov    %eax,%edx
xor    %ecx,%ecx
lea    0xe8a(%rip),%rsi
mov    %rsi,%rax
add    $0xa,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
call   1050 <strcat@plt>
lea    -0x5(%rbp),%rdi
call   1040 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0x40(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x40(%rbp),%rdi
mov    %eax,%edx
mov    $0x1,%ecx
lea    0xe4e(%rip),%rsi
mov    %rsi,%rax
add    $0x9,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
call   1050 <strcat@plt>
lea    -0x5(%rbp),%rdi
call   1040 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0x38(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x38(%rbp),%rdi
mov    %eax,%edx
mov    $0x2,%ecx
lea    0xe12(%rip),%rsi
mov    %rsi,%rax
add    $0x8,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
call   1050 <strcat@plt>
lea    -0x5(%rbp),%rdi
call   1040 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0x30(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x30(%rbp),%rdi
mov    %eax,%edx
mov    $0x3,%ecx
lea    0xdd6(%rip),%rsi
mov    %rsi,%rax
add    $0x7,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
call   1050 <strcat@plt>
lea    -0x5(%rbp),%rdi
call   1040 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x28(%rbp),%rdi
mov    %eax,%edx
mov    $0x4,%ecx
lea    0xd9a(%rip),%rsi
mov    %rsi,%rax
add    $0x6,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
call   1050 <strcat@plt>
lea    -0x5(%rbp),%rdi
call   1040 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x20(%rbp),%rdi
mov    %eax,%edx
mov    $0x5,%ecx
lea    0xd5e(%rip),%rsi
mov    %rsi,%rax
add    $0x5,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
call   1050 <strcat@plt>
lea    -0x5(%rbp),%rdi
call   1040 <sink@plt>
mov    0xd48(%rip),%eax
mov    %eax,-0xa(%rbp)
mov    0xd43(%rip),%al
mov    %al,-0x6(%rbp)
lea    -0xa(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x18(%rbp),%rdi
mov    %eax,%edx
mov    $0x4,%ecx
lea    0xd10(%rip),%rsi
mov    %rsi,%rax
add    $0x6,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
call   1050 <strcat@plt>
lea    -0xa(%rbp),%rdi
call   1040 <sink@plt>
add    $0x50,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<test_strcat_range>:
push   %r15
push   %r14
push   %rbx
sub    $0x10,%rsp
movb   $0x0,0xc(%rsp)
movl   $0x0,0x8(%rsp)
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
test   %eax,%eax
lea    0xeb4(%rip),%rsi
lea    0xea3(%rip),%rbx
cmovne %rbx,%rsi
lea    0x8(%rsp),%r14
mov    %r14,%rdi
call   1040 <strcat@plt>
mov    %r14,%rdi
call   1030 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
cmp    $0x1,%eax
lea    0xe82(%rip),%rsi
cmovne %rbx,%rsi
mov    %r14,%rdi
call   1040 <strcat@plt>
mov    %r14,%rdi
call   1030 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
cmp    $0x2,%eax
lea    0xe5c(%rip),%rsi
cmovne %rbx,%rsi
mov    %r14,%rdi
call   1040 <strcat@plt>
mov    %r14,%rdi
call   1030 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
cmp    $0x3,%eax
lea    0xe36(%rip),%rsi
cmovne %rbx,%rsi
mov    %r14,%rdi
call   1040 <strcat@plt>
mov    %r14,%rdi
call   1030 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
cmp    $0x4,%eax
lea    0xe10(%rip),%r15
mov    %rbx,%rsi
cmove  %r15,%rsi
mov    %r14,%rdi
call   1040 <strcat@plt>
mov    %r14,%rdi
call   1030 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
cmp    $0x5,%eax
lea    0xde7(%rip),%rsi
cmovne %rbx,%rsi
mov    %r14,%rdi
call   1040 <strcat@plt>
mov    %r14,%rdi
call   1030 <sink@plt>
movb   $0x0,0x4(%rsp)
movl   $0x3231,(%rsp)
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
cmp    $0x4,%eax
cmove  %r15,%rbx
mov    %rsp,%r14
mov    %r14,%rdi
mov    %rbx,%rsi
call   1040 <strcat@plt>
mov    %r14,%rdi
call   1030 <sink@plt>
add    $0x10,%rsp
pop    %rbx
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@.str = [11 x i8] c"0123456789\00"
@__const.test_strcat_range.buf2 = [5 x i8] c"12\00\00\00"
define void @test_strcat_range() {
%1 = alloca [5 x i8]
%2 = alloca [5 x i8]
%3 = bitcast [5 x i8]* %1 to i8*
%4 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%5 = call i32 (...) @random_unsigned_value()
%6 = icmp eq i32 0, %5
%7 = zext i1 %6 to i64
%8 = select i1 %6, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%9 = call i32 @strcat(i8* %4, i8* %8)
%10 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%11 = call i32 @sink(i8* %10)
%12 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%13 = call i32 (...) @random_unsigned_value()
%14 = icmp eq i32 1, %13
%15 = zext i1 %14 to i64
%16 = select i1 %14, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 9), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%17 = call i32 @strcat(i8* %12, i8* %16)
%18 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%19 = call i32 @sink(i8* %18)
%20 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%21 = call i32 (...) @random_unsigned_value()
%22 = icmp eq i32 2, %21
%23 = zext i1 %22 to i64
%24 = select i1 %22, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 8), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%25 = call i32 @strcat(i8* %20, i8* %24)
%26 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%27 = call i32 @sink(i8* %26)
%28 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%29 = call i32 (...) @random_unsigned_value()
%30 = icmp eq i32 3, %29
%31 = zext i1 %30 to i64
%32 = select i1 %30, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 7), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%33 = call i32 @strcat(i8* %28, i8* %32)
%34 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%35 = call i32 @sink(i8* %34)
%36 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%37 = call i32 (...) @random_unsigned_value()
%38 = icmp eq i32 4, %37
%39 = zext i1 %38 to i64
%40 = select i1 %38, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 6), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%41 = call i32 @strcat(i8* %36, i8* %40)
%42 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%43 = call i32 @sink(i8* %42)
%44 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%45 = call i32 (...) @random_unsigned_value()
%46 = icmp eq i32 5, %45
%47 = zext i1 %46 to i64
%48 = select i1 %46, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 5), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%49 = call i32 @strcat(i8* %44, i8* %48)
%50 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%51 = call i32 @sink(i8* %50)
%52 = bitcast [5 x i8]* %2 to i8*
%53 = getelementptr inbounds [5 x i8], [5 x i8]* %2, i64 0, i64 0
%54 = call i32 (...) @random_unsigned_value()
%55 = icmp eq i32 4, %54
%56 = zext i1 %55 to i64
%57 = select i1 %55, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 6), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%58 = call i32 @strcat(i8* %53, i8* %57)
%59 = getelementptr inbounds [5 x i8], [5 x i8]* %2, i64 0, i64 0
%60 = call i32 @sink(i8* %59)
ret void
}

LLVM IR (-O2):
@.str = [11 x i8] c"0123456789\00"
@__const.test_strcat_range.buf2 = [5 x i8] c"12\00\00\00"
define void @test_strcat_range() {
%1 = alloca [5 x i8]
%2 = alloca [5 x i8]
%3 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%4 = tail call i32 (...) @random_unsigned_value()
%5 = icmp eq i32 %4, 0
%6 = select i1 %5, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%7 = call i32 @strcat(i8* %3, i8* %6)
%8 = call i32 @sink(i8* %3)
%9 = call i32 (...) @random_unsigned_value()
%10 = icmp eq i32 %9, 1
%11 = select i1 %10, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 9), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%12 = call i32 @strcat(i8* %3, i8* %11)
%13 = call i32 @sink(i8* %3)
%14 = call i32 (...) @random_unsigned_value()
%15 = icmp eq i32 %14, 2
%16 = select i1 %15, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 8), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%17 = call i32 @strcat(i8* %3, i8* %16)
%18 = call i32 @sink(i8* %3)
%19 = call i32 (...) @random_unsigned_value()
%20 = icmp eq i32 %19, 3
%21 = select i1 %20, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 7), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%22 = call i32 @strcat(i8* %3, i8* %21)
%23 = call i32 @sink(i8* %3)
%24 = call i32 (...) @random_unsigned_value()
%25 = icmp eq i32 %24, 4
%26 = select i1 %25, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 6), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%27 = call i32 @strcat(i8* %3, i8* %26)
%28 = call i32 @sink(i8* %3)
%29 = call i32 (...) @random_unsigned_value()
%30 = icmp eq i32 %29, 5
%31 = select i1 %30, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 5), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%32 = call i32 @strcat(i8* %3, i8* %31)
%33 = call i32 @sink(i8* %3)
%34 = getelementptr inbounds [5 x i8], [5 x i8]* %2, i64 0, i64 0
%35 = call i32 (...) @random_unsigned_value()
%36 = icmp eq i32 %35, 4
%37 = select i1 %36, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 6), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%38 = call i32 @strcat(i8* %34, i8* %37)
%39 = call i32 @sink(i8* %34)
ret void
}