#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ ERR_R_MALLOC_FAILURE;
int /*<<< orphan*/ EVP_Digest(void *, int, unsigned char *,
                              int /*<<< orphan*/ *, int /*<<< orphan*/,
                              int /*<<< orphan*/ *);
int /*<<< orphan*/ EVP_sha1();
scalar_t__ MGF1(unsigned char *, int, unsigned char *, int);
int /*<<< orphan*/ RSA_F_RSA_PADDING_ADD_PKCS1_OAEP;
int /*<<< orphan*/ RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE;
int /*<<< orphan*/ RSA_R_KEY_SIZE_TOO_SMALL;
int /*<<< orphan*/ RSAerr(int /*<<< orphan*/, int /*<<< orphan*/);
int SHA_DIGEST_LENGTH;
int /*<<< orphan*/ arc4random_buf(unsigned char *, int);
int /*<<< orphan*/ free(unsigned char *);
unsigned char *malloc(int);
int /*<<< orphan*/ memcpy(unsigned char *, unsigned char const *, int);
int /*<<< orphan*/ memset(unsigned char *, int /*<<< orphan*/, int);
int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen,
                               const unsigned char *from, int flen,
                               const unsigned char *param, int plen) {
  int i, emlen = tlen - 1;
  unsigned char *db, *seed;
  unsigned char *dbmask, seedmask[SHA_DIGEST_LENGTH];
  if (flen > emlen - 2 * SHA_DIGEST_LENGTH - 1) {
    RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
    return 0;
  }
  if (emlen < 2 * SHA_DIGEST_LENGTH + 1) {
    RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, RSA_R_KEY_SIZE_TOO_SMALL);
    return 0;
  }
  to[0] = 0;
  seed = to + 1;
  db = to + SHA_DIGEST_LENGTH + 1;
  if (!EVP_Digest((void *)param, plen, db, NULL, EVP_sha1(), NULL))
    return 0;
  memset(db + SHA_DIGEST_LENGTH, 0, emlen - flen - 2 * SHA_DIGEST_LENGTH - 1);
  db[emlen - flen - SHA_DIGEST_LENGTH - 1] = 0x01;
  memcpy(db + emlen - flen - SHA_DIGEST_LENGTH, from, flen);
  arc4random_buf(seed, SHA_DIGEST_LENGTH);
  dbmask = malloc(emlen - SHA_DIGEST_LENGTH);
  if (dbmask == NULL) {
    RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_OAEP, ERR_R_MALLOC_FAILURE);
    return 0;
  }
  if (MGF1(dbmask, emlen - SHA_DIGEST_LENGTH, seed, SHA_DIGEST_LENGTH) < 0)
    return 0;
  for (i = 0; i < emlen - SHA_DIGEST_LENGTH; i++)
    db[i] ^= dbmask[i];
  if (MGF1(seedmask, SHA_DIGEST_LENGTH, db, emlen - SHA_DIGEST_LENGTH) < 0)
    return 0;
  for (i = 0; i < SHA_DIGEST_LENGTH; i++)
    seed[i] ^= seedmask[i];
  free(dbmask);
  return 1;
}


x86 assembly (clang, -O0):
<RSA_padding_add_PKCS1_OAEP>:
push   %rbp
mov    %rsp,%rbp
sub    $0x90,%rsp
mov    %rdi,-0x10(%rbp)
mov    %esi,-0x14(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %ecx,-0x24(%rbp)
mov    %r8,-0x30(%rbp)
mov    %r9d,-0x34(%rbp)
mov    -0x14(%rbp),%eax
add    $0xffffffff,%eax
mov    %eax,-0x3c(%rbp)
mov    0x2e1f(%rip),%rax
mov    (%rax),%eax
mov    %rsp,%rcx
mov    %rcx,-0x60(%rbp)
mov    %rax,%rdx
add    $0xf,%rdx
and    $0xfffffffffffffff0,%rdx
mov    %rsp,%rcx
sub    %rdx,%rcx
mov    %rcx,-0x78(%rbp)
mov    %rcx,%rsp
mov    %rax,-0x68(%rbp)
mov    -0x24(%rbp),%eax
mov    -0x3c(%rbp),%ecx
mov    0x2ded(%rip),%rdx
mov    (%rdx),%edx
shl    $0x1,%edx
sub    %edx,%ecx
sub    $0x1,%ecx
cmp    %ecx,%eax
jle    122f <RSA_padding_add_PKCS1_OAEP+0x9f>
mov    0x2ddc(%rip),%rax
mov    (%rax),%edi
mov    0x2dc3(%rip),%rax
mov    (%rax),%esi
call   10b0 <RSAerr@plt>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    14fe <RSA_padding_add_PKCS1_OAEP+0x36e>
mov    -0x3c(%rbp),%eax
mov    0x2da7(%rip),%rcx
mov    (%rcx),%ecx
shl    $0x1,%ecx
add    $0x1,%ecx
cmp    %ecx,%eax
jge    1273 <RSA_padding_add_PKCS1_OAEP+0xe3>
mov    0x2d98(%rip),%rax
mov    (%rax),%edi
mov    0x2d5f(%rip),%rax
mov    (%rax),%esi
call   10b0 <RSAerr@plt>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    14fe <RSA_padding_add_PKCS1_OAEP+0x36e>
mov    -0x10(%rbp),%rax
movb   $0x0,(%rax)
mov    -0x10(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x50(%rbp)
mov    -0x10(%rbp),%rax
mov    0x2d4f(%rip),%rcx
movslq (%rcx),%rcx
add    %rcx,%rax
add    $0x1,%rax
mov    %rax,-0x48(%rbp)
mov    -0x30(%rbp),%rax
mov    %rax,-0x90(%rbp)
mov    -0x34(%rbp),%eax
mov    %eax,-0x84(%rbp)
mov    -0x48(%rbp),%rax
mov    %rax,-0x80(%rbp)
mov    $0x0,%al
call   1050 <EVP_sha1@plt>
mov    -0x90(%rbp),%rdi
mov    -0x84(%rbp),%esi
mov    -0x80(%rbp),%rdx
mov    %eax,%r8d
xor    %eax,%eax
mov    %eax,%r9d
mov    %r9,%rcx
call   1090 <EVP_Digest@plt>
cmp    $0x0,%eax
jne    12ff <RSA_padding_add_PKCS1_OAEP+0x16f>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    14fe <RSA_padding_add_PKCS1_OAEP+0x36e>
mov    -0x48(%rbp),%rdi
mov    0x2cd6(%rip),%rax
movslq (%rax),%rax
add    %rax,%rdi
mov    -0x3c(%rbp),%edx
sub    -0x24(%rbp),%edx
mov    0x2cc3(%rip),%rax
mov    (%rax),%eax
shl    $0x1,%eax
sub    %eax,%edx
sub    $0x1,%edx
xor    %esi,%esi
call   1060 <memset@plt>
mov    -0x48(%rbp),%rax
mov    -0x3c(%rbp),%ecx
sub    -0x24(%rbp),%ecx
mov    0x2ca1(%rip),%rdx
sub    (%rdx),%ecx
sub    $0x1,%ecx
movslq %ecx,%rcx
movb   $0x1,(%rax,%rcx,1)
mov    -0x48(%rbp),%rdi
movslq -0x3c(%rbp),%rax
add    %rax,%rdi
movslq -0x24(%rbp),%rcx
xor    %eax,%eax
sub    %rcx,%rax
add    %rax,%rdi
mov    0x2c77(%rip),%rax
movslq (%rax),%rcx
xor    %eax,%eax
sub    %rcx,%rax
add    %rax,%rdi
mov    -0x20(%rbp),%rsi
mov    -0x24(%rbp),%edx
call   1070 <memcpy@plt>
mov    -0x50(%rbp),%rdi
mov    0x2c55(%rip),%rax
mov    (%rax),%esi
call   1040 <arc4random_buf@plt>
mov    -0x3c(%rbp),%edi
mov    0x2c44(%rip),%rax
sub    (%rax),%edi
call   1080 <malloc@plt>
mov    %rax,-0x58(%rbp)
cmpq   $0x0,-0x58(%rbp)
jne    13dc <RSA_padding_add_PKCS1_OAEP+0x24c>
mov    0x2c2f(%rip),%rax
mov    (%rax),%edi
mov    0x2c0e(%rip),%rax
mov    (%rax),%esi
call   10b0 <RSAerr@plt>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    14fe <RSA_padding_add_PKCS1_OAEP+0x36e>
mov    -0x58(%rbp),%rdi
mov    -0x3c(%rbp),%esi
mov    0x2bf6(%rip),%rax
sub    (%rax),%esi
mov    -0x50(%rbp),%rdx
mov    0x2be9(%rip),%rax
mov    (%rax),%ecx
call   10a0 <MGF1@plt>
cmp    $0x0,%rax
jge    141b <RSA_padding_add_PKCS1_OAEP+0x28b>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    14fe <RSA_padding_add_PKCS1_OAEP+0x36e>
movl   $0x0,-0x38(%rbp)
mov    -0x38(%rbp),%eax
mov    -0x3c(%rbp),%ecx
mov    0x2bb1(%rip),%rdx
sub    (%rdx),%ecx
cmp    %ecx,%eax
jge    1464 <RSA_padding_add_PKCS1_OAEP+0x2d4>
mov    -0x58(%rbp),%rax
movslq -0x38(%rbp),%rcx
movzbl (%rax,%rcx,1),%esi
mov    -0x48(%rbp),%rax
movslq -0x38(%rbp),%rcx
movzbl (%rax,%rcx,1),%edx
xor    %esi,%edx
mov    %dl,(%rax,%rcx,1)
mov    -0x38(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x38(%rbp)
jmp    1422 <RSA_padding_add_PKCS1_OAEP+0x292>
mov    -0x78(%rbp),%rdi
mov    0x2b71(%rip),%rax
mov    (%rax),%esi
mov    -0x48(%rbp),%rdx
mov    -0x3c(%rbp),%ecx
mov    0x2b61(%rip),%rax
sub    (%rax),%ecx
call   10a0 <MGF1@plt>
cmp    $0x0,%rax
jge    14a3 <RSA_padding_add_PKCS1_OAEP+0x313>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
jmp    14fe <RSA_padding_add_PKCS1_OAEP+0x36e>
movl   $0x0,-0x38(%rbp)
mov    -0x38(%rbp),%eax
mov    0x2b2c(%rip),%rcx
cmp    (%rcx),%eax
jge    14e7 <RSA_padding_add_PKCS1_OAEP+0x357>
mov    -0x78(%rbp),%rax
movslq -0x38(%rbp),%rcx
movzbl (%rax,%rcx,1),%esi
mov    -0x50(%rbp),%rax
movslq -0x38(%rbp),%rcx
movzbl (%rax,%rcx,1),%edx
xor    %esi,%edx
mov    %dl,(%rax,%rcx,1)
mov    -0x38(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x38(%rbp)
jmp    14aa <RSA_padding_add_PKCS1_OAEP+0x31a>
mov    -0x58(%rbp),%rdi
call   1030 <free@plt>
movl   $0x1,-0x4(%rbp)
movl   $0x1,-0x6c(%rbp)
mov    -0x60(%rbp),%rax
mov    %rax,%rsp
mov    -0x4(%rbp),%eax
mov    %rbp,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<RSA_padding_add_PKCS1_OAEP>:
push   %rbp
mov    %rsp,%rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %ecx,%r12d
mov    %esi,%ebx
mov    0x2e33(%rip),%rsi
mov    (%rsi),%eax
mov    %rsp,%r15
mov    %rax,%rcx
add    $0xf,%rcx
and    $0xfffffffffffffff0,%rcx
sub    %rcx,%r15
mov    %r15,%rsp
add    %eax,%eax
mov    %eax,%ecx
not    %ecx
add    %ebx,%ecx
add    $0xffffffff,%ecx
cmp    %r12d,%ecx
jge    11e8 <RSA_padding_add_PKCS1_OAEP+0x58>
mov    0x2e0e(%rip),%rax
mov    (%rax),%edi
mov    0x2df5(%rip),%rax
jmp    1373 <RSA_padding_add_PKCS1_OAEP+0x1e3>
or     $0x1,%eax
cmp    %ebx,%eax
jge    1363 <RSA_padding_add_PKCS1_OAEP+0x1d3>
mov    %r9d,%r14d
mov    %r8,%r13
mov    %rdx,-0x40(%rbp)
movb   $0x0,(%rdi)
movslq (%rsi),%rax
add    %rdi,%rax
add    $0x1,%rax
mov    %rax,-0x38(%rbp)
xor    %eax,%eax
mov    %rdi,-0x30(%rbp)
call   1050 <EVP_sha1@plt>
mov    %r13,%rdi
mov    -0x38(%rbp),%r13
mov    %r14d,%esi
mov    %r13,%rdx
xor    %ecx,%ecx
mov    %eax,%r8d
xor    %r9d,%r9d
call   1090 <EVP_Digest@plt>
test   %eax,%eax
mov    $0x0,%eax
je     137c <RSA_padding_add_PKCS1_OAEP+0x1ec>
add    $0xffffffff,%ebx
addq   $0x1,-0x30(%rbp)
mov    0x2d91(%rip),%rax
movslq (%rax),%rdi
lea    (%rdi,%rdi,1),%edx
add    %r13,%rdi
mov    %ebx,%r14d
sub    %r12d,%r14d
not    %edx
add    %r14d,%edx
xor    %esi,%esi
call   1060 <memset@plt>
mov    0x2d6f(%rip),%rcx
mov    (%rcx),%eax
not    %eax
add    %r14d,%eax
cltq
movb   $0x1,0x0(%r13,%rax,1)
movslq %ebx,%r14
lea    (%r14,%r13,1),%rdi
movslq %r12d,%rax
sub    %rax,%rdi
mov    %rcx,%r13
movslq (%rcx),%rax
sub    %rax,%rdi
mov    -0x40(%rbp),%rsi
mov    %r12d,%edx
call   1070 <memcpy@plt>
mov    0x0(%r13),%esi
mov    -0x30(%rbp),%rdi
call   1040 <arc4random_buf@plt>
mov    0x0(%r13),%r13d
sub    %r13d,%r14d
mov    %r14d,%edi
call   1080 <malloc@plt>
test   %rax,%rax
je     138b <RSA_padding_add_PKCS1_OAEP+0x1fb>
mov    %rax,%r12
mov    %rax,%rdi
mov    %r14d,%esi
mov    -0x30(%rbp),%rdx
mov    %rdx,%r14
mov    %r13d,%ecx
call   10a0 <MGF1@plt>
test   %rax,%rax
js     137a <RSA_padding_add_PKCS1_OAEP+0x1ea>
mov    0x2cf1(%rip),%r8
mov    (%r8),%esi
mov    %ebx,%ecx
sub    %esi,%ecx
mov    -0x38(%rbp),%rdx
jle    131b <RSA_padding_add_PKCS1_OAEP+0x18b>
xor    %eax,%eax
xchg   %ax,%ax
movzbl (%r12,%rax,1),%ecx
xor    %cl,(%rdx,%rax,1)
add    $0x1,%rax
mov    (%r8),%esi
mov    %ebx,%ecx
sub    %esi,%ecx
movslq %ecx,%rdi
cmp    %rdi,%rax
jl     1300 <RSA_padding_add_PKCS1_OAEP+0x170>
mov    %r15,%rdi
mov    %r8,%rbx
call   10a0 <MGF1@plt>
test   %rax,%rax
mov    $0x0,%eax
js     137c <RSA_padding_add_PKCS1_OAEP+0x1ec>
cmpl   $0x0,(%rbx)
jle    1354 <RSA_padding_add_PKCS1_OAEP+0x1c4>
mov    %r14,%rdx
mov    %rbx,%rsi
xor    %eax,%eax
nopl   (%rax)
movzbl (%r15,%rax,1),%ecx
xor    %cl,(%rdx,%rax,1)
add    $0x1,%rax
movslq (%rsi),%rcx
cmp    %rcx,%rax
jl     1340 <RSA_padding_add_PKCS1_OAEP+0x1b0>
mov    %r12,%rdi
call   1030 <free@plt>
mov    $0x1,%eax
jmp    137c <RSA_padding_add_PKCS1_OAEP+0x1ec>
mov    0x2c7e(%rip),%rax
mov    (%rax),%edi
mov    0x2c45(%rip),%rax
mov    (%rax),%esi
call   10b0 <RSAerr@plt>
xor    %eax,%eax
lea    -0x28(%rbp),%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    0x2c56(%rip),%rax
mov    (%rax),%edi
mov    0x2c35(%rip),%rax
jmp    1373 <RSA_padding_add_PKCS1_OAEP+0x1e3>

LLVM IR (-O0):
@SHA_DIGEST_LENGTH = global i32 0
@RSA_F_RSA_PADDING_ADD_PKCS1_OAEP = global i32 0
@RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE = global i32 0
@RSA_R_KEY_SIZE_TOO_SMALL = global i32 0
@ERR_R_MALLOC_FAILURE = global i32 0
define i32 @RSA_padding_add_PKCS1_OAEP(i8* %0, i32 %1, i8* %2, i32 %3, i8* %4, i32 %5) {
%7 = alloca i32
%8 = alloca i8*
%9 = alloca i32
%10 = alloca i8*
%11 = alloca i32
%12 = alloca i8*
%13 = alloca i32
%14 = alloca i32
%15 = alloca i32
%16 = alloca i8*
%17 = alloca i8*
%18 = alloca i8*
%19 = alloca i8*
%20 = alloca i64
%21 = alloca i32
store i8* %0, i8** %8
store i32 %1, i32* %9
store i8* %2, i8** %10
store i32 %3, i32* %11
store i8* %4, i8** %12
store i32 %5, i32* %13
%22 = load i32, i32* %9
%23 = sub nsw i32 %22, 1
store i32 %23, i32* %15
%24 = load i32, i32* @SHA_DIGEST_LENGTH
%25 = zext i32 %24 to i64
%26 = call i8* @llvm.stacksave()
store i8* %26, i8** %19
%27 = alloca i8, i64 %25
store i64 %25, i64* %20
%28 = load i32, i32* %11
%29 = load i32, i32* %15
%30 = load i32, i32* @SHA_DIGEST_LENGTH
%31 = mul nsw i32 2, %30
%32 = sub nsw i32 %29, %31
%33 = sub nsw i32 %32, 1
%34 = icmp sgt i32 %28, %33
br i1 %34, label %35, label %39
35: ; preds = %6
%36 = load i32, i32* @RSA_F_RSA_PADDING_ADD_PKCS1_OAEP
%37 = load i32, i32* @RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE
%38 = call i32 @RSAerr(i32 %36, i32 %37)
store i32 0, i32* %7
store i32 1, i32* %21
br label %185
39: ; preds = %6
%40 = load i32, i32* %15
%41 = load i32, i32* @SHA_DIGEST_LENGTH
%42 = mul nsw i32 2, %41
%43 = add nsw i32 %42, 1
%44 = icmp slt i32 %40, %43
br i1 %44, label %45, label %49
45: ; preds = %39
%46 = load i32, i32* @RSA_F_RSA_PADDING_ADD_PKCS1_OAEP
%47 = load i32, i32* @RSA_R_KEY_SIZE_TOO_SMALL
%48 = call i32 @RSAerr(i32 %46, i32 %47)
store i32 0, i32* %7
store i32 1, i32* %21
br label %185
49: ; preds = %39
%50 = load i8*, i8** %8
%51 = getelementptr inbounds i8, i8* %50, i64 0
store i8 0, i8* %51
%52 = load i8*, i8** %8
%53 = getelementptr inbounds i8, i8* %52, i64 1
store i8* %53, i8** %17
%54 = load i8*, i8** %8
%55 = load i32, i32* @SHA_DIGEST_LENGTH
%56 = sext i32 %55 to i64
%57 = getelementptr inbounds i8, i8* %54, i64 %56
%58 = getelementptr inbounds i8, i8* %57, i64 1
store i8* %58, i8** %16
%59 = load i8*, i8** %12
%60 = load i32, i32* %13
%61 = load i8*, i8** %16
%62 = call i32 (...) @EVP_sha1()
%63 = call i32 @EVP_Digest(i8* %59, i32 %60, i8* %61, i32* null, i32 %62, i32* null)
%64 = icmp ne i32 %63, 0
br i1 %64, label %66, label %65
65: ; preds = %49
store i32 0, i32* %7
store i32 1, i32* %21
br label %185
66: ; preds = %49
%67 = load i8*, i8** %16
%68 = load i32, i32* @SHA_DIGEST_LENGTH
%69 = sext i32 %68 to i64
%70 = getelementptr inbounds i8, i8* %67, i64 %69
%71 = load i32, i32* %15
%72 = load i32, i32* %11
%73 = sub nsw i32 %71, %72
%74 = load i32, i32* @SHA_DIGEST_LENGTH
%75 = mul nsw i32 2, %74
%76 = sub nsw i32 %73, %75
%77 = sub nsw i32 %76, 1
%78 = call i32 @memset(i8* %70, i32 0, i32 %77)
%79 = load i8*, i8** %16
%80 = load i32, i32* %15
%81 = load i32, i32* %11
%82 = sub nsw i32 %80, %81
%83 = load i32, i32* @SHA_DIGEST_LENGTH
%84 = sub nsw i32 %82, %83
%85 = sub nsw i32 %84, 1
%86 = sext i32 %85 to i64
%87 = getelementptr inbounds i8, i8* %79, i64 %86
store i8 1, i8* %87
%88 = load i8*, i8** %16
%89 = load i32, i32* %15
%90 = sext i32 %89 to i64
%91 = getelementptr inbounds i8, i8* %88, i64 %90
%92 = load i32, i32* %11
%93 = sext i32 %92 to i64
%94 = sub i64 0, %93
%95 = getelementptr inbounds i8, i8* %91, i64 %94
%96 = load i32, i32* @SHA_DIGEST_LENGTH
%97 = sext i32 %96 to i64
%98 = sub i64 0, %97
%99 = getelementptr inbounds i8, i8* %95, i64 %98
%100 = load i8*, i8** %10
%101 = load i32, i32* %11
%102 = call i32 @memcpy(i8* %99, i8* %100, i32 %101)
%103 = load i8*, i8** %17
%104 = load i32, i32* @SHA_DIGEST_LENGTH
%105 = call i32 @arc4random_buf(i8* %103, i32 %104)
%106 = load i32, i32* %15
%107 = load i32, i32* @SHA_DIGEST_LENGTH
%108 = sub nsw i32 %106, %107
%109 = call i8* @malloc(i32 %108)
store i8* %109, i8** %18
%110 = load i8*, i8** %18
%111 = icmp eq i8* %110, null
br i1 %111, label %112, label %116
112: ; preds = %66
%113 = load i32, i32* @RSA_F_RSA_PADDING_ADD_PKCS1_OAEP
%114 = load i32, i32* @ERR_R_MALLOC_FAILURE
%115 = call i32 @RSAerr(i32 %113, i32 %114)
store i32 0, i32* %7
store i32 1, i32* %21
br label %185
116: ; preds = %66
%117 = load i8*, i8** %18
%118 = load i32, i32* %15
%119 = load i32, i32* @SHA_DIGEST_LENGTH
%120 = sub nsw i32 %118, %119
%121 = load i8*, i8** %17
%122 = load i32, i32* @SHA_DIGEST_LENGTH
%123 = call i64 @MGF1(i8* %117, i32 %120, i8* %121, i32 %122)
%124 = icmp slt i64 %123, 0
br i1 %124, label %125, label %126
125: ; preds = %116
store i32 0, i32* %7
store i32 1, i32* %21
br label %185
126: ; preds = %116
store i32 0, i32* %14
br label %127
127: ; preds = %148, %126
%128 = load i32, i32* %14
%129 = load i32, i32* %15
%130 = load i32, i32* @SHA_DIGEST_LENGTH
%131 = sub nsw i32 %129, %130
%132 = icmp slt i32 %128, %131
br i1 %132, label %133, label %151
133: ; preds = %127
%134 = load i8*, i8** %18
%135 = load i32, i32* %14
%136 = sext i32 %135 to i64
%137 = getelementptr inbounds i8, i8* %134, i64 %136
%138 = load i8, i8* %137
%139 = zext i8 %138 to i32
%140 = load i8*, i8** %16
%141 = load i32, i32* %14
%142 = sext i32 %141 to i64
%143 = getelementptr inbounds i8, i8* %140, i64 %142
%144 = load i8, i8* %143
%145 = zext i8 %144 to i32
%146 = xor i32 %145, %139
%147 = trunc i32 %146 to i8
store i8 %147, i8* %143
br label %148
148: ; preds = %133
%149 = load i32, i32* %14
%150 = add nsw i32 %149, 1
store i32 %150, i32* %14
br label %127
151: ; preds = %127
%152 = load i32, i32* @SHA_DIGEST_LENGTH
%153 = load i8*, i8** %16
%154 = load i32, i32* %15
%155 = load i32, i32* @SHA_DIGEST_LENGTH
%156 = sub nsw i32 %154, %155
%157 = call i64 @MGF1(i8* %27, i32 %152, i8* %153, i32 %156)
%158 = icmp slt i64 %157, 0
br i1 %158, label %159, label %160
159: ; preds = %151
store i32 0, i32* %7
store i32 1, i32* %21
br label %185
160: ; preds = %151
store i32 0, i32* %14
br label %161
161: ; preds = %179, %160
%162 = load i32, i32* %14
%163 = load i32, i32* @SHA_DIGEST_LENGTH
%164 = icmp slt i32 %162, %163
br i1 %164, label %165, label %182
165: ; preds = %161
%166 = load i32, i32* %14
%167 = sext i32 %166 to i64
%168 = getelementptr inbounds i8, i8* %27, i64 %167
%169 = load i8, i8* %168
%170 = zext i8 %169 to i32
%171 = load i8*, i8** %17
%172 = load i32, i32* %14
%173 = sext i32 %172 to i64
%174 = getelementptr inbounds i8, i8* %171, i64 %173
%175 = load i8, i8* %174
%176 = zext i8 %175 to i32
%177 = xor i32 %176, %170
%178 = trunc i32 %177 to i8
store i8 %178, i8* %174
br label %179
179: ; preds = %165
%180 = load i32, i32* %14
%181 = add nsw i32 %180, 1
store i32 %181, i32* %14
br label %161
182: ; preds = %161
%183 = load i8*, i8** %18
%184 = call i32 @free(i8* %183)
store i32 1, i32* %7
store i32 1, i32* %21
br label %185
185: ; preds = %182, %159, %125, %112, %65, %45, %35
%186 = load i8*, i8** %19
%187 = load i32, i32* %7
ret i32 %187
}

LLVM IR (-O2):
@SHA_DIGEST_LENGTH = global i32 0
@RSA_F_RSA_PADDING_ADD_PKCS1_OAEP = global i32 0
@RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE = global i32 0
@RSA_R_KEY_SIZE_TOO_SMALL = global i32 0
@ERR_R_MALLOC_FAILURE = global i32 0
define i32 @RSA_padding_add_PKCS1_OAEP(i8* %0, i32 %1, i8* %2, i32 %3, i8* %4, i32 %5) {
%7 = add nsw i32 %1, -1
%8 = load i32, i32* @SHA_DIGEST_LENGTH
%9 = zext i32 %8 to i64
%10 = alloca i8, i64 %9
%11 = shl nsw i32 %8, 1
%12 = xor i32 %11, -1
%13 = add i32 %7, %12
%14 = icmp slt i32 %13, %3
br i1 %14, label %15, label %19
15: ; preds = %6
%16 = load i32, i32* @RSA_F_RSA_PADDING_ADD_PKCS1_OAEP
%17 = load i32, i32* @RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE
%18 = tail call i32 @RSAerr(i32 %16, i32 %17)
br label %109
19: ; preds = %6
%20 = or i32 %11, 1
%21 = icmp slt i32 %20, %1
br i1 %21, label %26, label %22
22: ; preds = %19
%23 = load i32, i32* @RSA_F_RSA_PADDING_ADD_PKCS1_OAEP
%24 = load i32, i32* @RSA_R_KEY_SIZE_TOO_SMALL
%25 = tail call i32 @RSAerr(i32 %23, i32 %24)
br label %109
26: ; preds = %19
store i8 0, i8* %0
%27 = getelementptr inbounds i8, i8* %0, i64 1
%28 = load i32, i32* @SHA_DIGEST_LENGTH
%29 = sext i32 %28 to i64
%30 = getelementptr inbounds i8, i8* %0, i64 %29
%31 = getelementptr inbounds i8, i8* %30, i64 1
%32 = tail call i32 (...) @EVP_sha1()
%33 = tail call i32 @EVP_Digest(i8* %4, i32 %5, i8* %31, i32* null, i32 %32, i32* null)
%34 = icmp eq i32 %33, 0
br i1 %34, label %109, label %35
35: ; preds = %26
%36 = load i32, i32* @SHA_DIGEST_LENGTH
%37 = sext i32 %36 to i64
%38 = getelementptr inbounds i8, i8* %31, i64 %37
%39 = sub nsw i32 %7, %3
%40 = mul i32 %36, -2
%41 = add i32 %39, -1
%42 = add i32 %41, %40
%43 = tail call i32 @memset(i8* %38, i32 0, i32 %42)
%44 = load i32, i32* @SHA_DIGEST_LENGTH
%45 = xor i32 %44, -1
%46 = add i32 %39, %45
%47 = sext i32 %46 to i64
%48 = getelementptr inbounds i8, i8* %31, i64 %47
store i8 1, i8* %48
%49 = sext i32 %7 to i64
%50 = getelementptr inbounds i8, i8* %31, i64 %49
%51 = sext i32 %3 to i64
%52 = sub nsw i64 0, %51
%53 = getelementptr inbounds i8, i8* %50, i64 %52
%54 = load i32, i32* @SHA_DIGEST_LENGTH
%55 = sext i32 %54 to i64
%56 = sub nsw i64 0, %55
%57 = getelementptr inbounds i8, i8* %53, i64 %56
%58 = tail call i32 @memcpy(i8* %57, i8* %2, i32 %3)
%59 = load i32, i32* @SHA_DIGEST_LENGTH
%60 = tail call i32 @arc4random_buf(i8* %27, i32 %59)
%61 = load i32, i32* @SHA_DIGEST_LENGTH
%62 = sub nsw i32 %7, %61
%63 = tail call i8* @malloc(i32 %62)
%64 = icmp eq i8* %63, null
br i1 %64, label %65, label %69
65: ; preds = %35
%66 = load i32, i32* @RSA_F_RSA_PADDING_ADD_PKCS1_OAEP
%67 = load i32, i32* @ERR_R_MALLOC_FAILURE
%68 = tail call i32 @RSAerr(i32 %66, i32 %67)
br label %109
69: ; preds = %35
%70 = tail call i64 @MGF1(i8* %63, i32 %62, i8* %27, i32 %61)
%71 = icmp slt i64 %70, 0
br i1 %71, label %109, label %72
72: ; preds = %69
%73 = load i32, i32* @SHA_DIGEST_LENGTH
%74 = sub nsw i32 %7, %73
%75 = icmp sgt i32 %74, 0
br i1 %75, label %76, label %88
76: ; preds = %72, %76
%77 = phi i64 [ %83, %76 ], [ 0, %72 ]
%78 = getelementptr inbounds i8, i8* %63, i64 %77
%79 = load i8, i8* %78
%80 = getelementptr inbounds i8, i8* %31, i64 %77
%81 = load i8, i8* %80
%82 = xor i8 %81, %79
store i8 %82, i8* %80
%83 = add nuw nsw i64 %77, 1
%84 = load i32, i32* @SHA_DIGEST_LENGTH
%85 = sub nsw i32 %7, %84
%86 = sext i32 %85 to i64
%87 = icmp slt i64 %83, %86
br i1 %87, label %76, label %88
88: ; preds = %76, %72
%89 = phi i32 [ %73, %72 ], [ %84, %76 ]
%90 = phi i32 [ %74, %72 ], [ %85, %76 ]
%91 = call i64 @MGF1(i8* %10, i32 %89, i8* %31, i32 %90)
%92 = icmp slt i64 %91, 0
br i1 %92, label %109, label %93
93: ; preds = %88
%94 = load i32, i32* @SHA_DIGEST_LENGTH
%95 = icmp sgt i32 %94, 0
br i1 %95, label %96, label %107
96: ; preds = %93, %96
%97 = phi i64 [ %103, %96 ], [ 0, %93 ]
%98 = getelementptr inbounds i8, i8* %10, i64 %97
%99 = load i8, i8* %98
%100 = getelementptr inbounds i8, i8* %27, i64 %97
%101 = load i8, i8* %100
%102 = xor i8 %101, %99
store i8 %102, i8* %100
%103 = add nuw nsw i64 %97, 1
%104 = load i32, i32* @SHA_DIGEST_LENGTH
%105 = sext i32 %104 to i64
%106 = icmp slt i64 %103, %105
br i1 %106, label %96, label %107
107: ; preds = %96, %93
%108 = call i32 @free(i8* %63)
br label %109
109: ; preds = %88, %69, %26, %107, %65, %22, %15
%110 = phi i32 [ 0, %15 ], [ 0, %22 ], [ 0, %65 ], [ 1, %107 ], [ 0, %26 ], [ 0, %69 ], [ 0, %88 ]
ret i32 %110
}