#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef scalar_t__ str2;

/* Variables and functions */
int /*<<< orphan*/ __assert_fail(char *, char *, unsigned int, char *);
int /*<<< orphan*/ r_strncpy(char *, char const *, int);
int parse_expression_list(char *str) {
  int start;
  int i;
  int j;
  int apost;
  char str2[2];
  char *__cil_tmp7;
  char __cil_tmp8;
  char *__cil_tmp9;
  char __cil_tmp10;
  int __cil_tmp11;
  char *__cil_tmp12;
  char __cil_tmp13;
  int __cil_tmp14;
  char *__cil_tmp15;
  char __cil_tmp16;
  int __cil_tmp17;
  char *__cil_tmp18;
  char __cil_tmp19;
  int __cil_tmp20;
  char *__cil_tmp21;
  char __cil_tmp22;
  int __cil_tmp23;
  char *__cil_tmp24;
  char __cil_tmp25;
  int __cil_tmp26;
  int __cil_tmp27;
  int __cil_tmp28;
  unsigned long __cil_tmp29;
  unsigned long __cil_tmp30;
  char *__cil_tmp31;
  char *__cil_tmp32;
  char const *__cil_tmp33;
  int __cil_tmp34;
  int __cil_tmp35;
  int __cil_tmp36;
  int __cil_tmp37;
  unsigned long __cil_tmp38;
  unsigned long __cil_tmp39;
  char *__cil_tmp40;
  char __cil_tmp41;
  int __cil_tmp42;
  {
    start = 0;
    i = -1;
    j = -1;
    apost = 0;
    if (!str) {
      return (-1);
    } else {
    }
    {
      while (1) {
      while_0_continue:;
        i = i + 1;
        {
          __cil_tmp7 = str + i;
          __cil_tmp8 = *__cil_tmp7;
          if ((int)__cil_tmp8 == 34) {
            goto switch_1_34;
          } else {
            if ((int)__cil_tmp8 == 44) {
              goto switch_1_44;
            } else {
              if ((int)__cil_tmp8 == 0) {
                goto switch_1_0;
              } else {
                if (0) {
                switch_1_34:
                  apost = !apost;
                  goto switch_1_break;
                switch_1_44:
                  if (apost) {
                    goto switch_1_break;
                  } else {
                  }
                switch_1_0 : {
                  while (1) {
                  while_2_continue:;
                    {
                      __cil_tmp9 = str + start;
                      __cil_tmp10 = *__cil_tmp9;
                      __cil_tmp11 = (int)__cil_tmp10;
                      if (__cil_tmp11 == 32) {
                      } else {
                        {
                          __cil_tmp12 = str + start;
                          __cil_tmp13 = *__cil_tmp12;
                          __cil_tmp14 = (int)__cil_tmp13;
                          if (__cil_tmp14 == 9) {
                          } else {
                            goto while_2_break;
                          }
                        }
                      }
                    }
                    start = start + 1;
                  }
                while_2_break:;
                }
                  {
                    __cil_tmp15 = str + start;
                    __cil_tmp16 = *__cil_tmp15;
                    __cil_tmp17 = (int)__cil_tmp16;
                    if (__cil_tmp17 == 34) {
                      start = start + 1;
                    } else {
                    }
                  }
                  j = i - 1;
                  {
                    while (1) {
                    while_3_continue:;
                      if (0 < j) {
                        {
                          __cil_tmp18 = str + j;
                          __cil_tmp19 = *__cil_tmp18;
                          __cil_tmp20 = (int)__cil_tmp19;
                          if (__cil_tmp20 == 32) {
                          } else {
                            {
                              __cil_tmp21 = str + j;
                              __cil_tmp22 = *__cil_tmp21;
                              __cil_tmp23 = (int)__cil_tmp22;
                              if (__cil_tmp23 == 9) {
                              } else {
                                goto while_3_break;
                              }
                            }
                          }
                        }
                      } else {
                        goto while_3_break;
                      }
                      j = j - 1;
                    }
                  while_3_break:;
                  }
                  if (0 < j) {
                    {
                      __cil_tmp24 = str + j;
                      __cil_tmp25 = *__cil_tmp24;
                      __cil_tmp26 = (int)__cil_tmp25;
                      if (__cil_tmp26 == 34) {
                        j = j - 1;
                      } else {
                      }
                    }
                  } else {
                  }
                  if (start <= j) {
                    {
                      __cil_tmp27 = j - start;
                      __cil_tmp28 = __cil_tmp27 + 1;
                      if (__cil_tmp28 < 2) {
                      } else {
                        {
                          __assert_fail(
                              "j-start+1 < 2",
                              "../versisec/OpenSer/progs/"
                              "OpenSERCVE-200606749complete_parse_config_bad.c",
                              41U, "parse_expression_list");
                        }
                      }
                    }
                    {
                      __cil_tmp29 = 0 * 1UL;
                      __cil_tmp30 = (unsigned long)(str2) + __cil_tmp29;
                      __cil_tmp31 = (char *)__cil_tmp30;
                      __cil_tmp32 = str + start;
                      __cil_tmp33 = (char const *)__cil_tmp32;
                      __cil_tmp34 = j - start;
                      __cil_tmp35 = __cil_tmp34 + 1;
                      r_strncpy(__cil_tmp31, __cil_tmp33, __cil_tmp35);
                      __cil_tmp36 = j - start;
                      __cil_tmp37 = __cil_tmp36 + 1;
                      __cil_tmp38 = __cil_tmp37 * 1UL;
                      __cil_tmp39 = (unsigned long)(str2) + __cil_tmp38;
                      *((char *)__cil_tmp39) = (char)0;
                    }
                  } else {
                    return (-1);
                  }
                  start = i + 1;
                } else {
                switch_1_break:;
                }
              }
            }
          }
        }
        {
          __cil_tmp40 = str + i;
          __cil_tmp41 = *__cil_tmp40;
          __cil_tmp42 = (int)__cil_tmp41;
          if (__cil_tmp42 != 0) {
          } else {
            goto while_0_break;
          }
        }
      }
    while_0_break:;
    }
    return (0);
  }
}


x86 assembly (clang, -O0):
<parse_expression_list>:
push   %rbp
mov    %rsp,%rbp
sub    $0x100,%rsp
mov    %rdi,-0x10(%rbp)
movl   $0x0,-0x14(%rbp)
movl   $0xffffffff,-0x18(%rbp)
movl   $0xffffffff,-0x1c(%rbp)
movl   $0x0,-0x20(%rbp)
cmpq   $0x0,-0x10(%rbp)
jne    1162 <parse_expression_list+0x42>
movl   $0xffffffff,-0x4(%rbp)
jmp    1574 <parse_expression_list+0x454>
jmp    1167 <parse_expression_list+0x47>
jmp    116c <parse_expression_list+0x4c>
jmp    1171 <parse_expression_list+0x51>
mov    -0x18(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x18(%rbp)
mov    -0x10(%rbp),%rax
movslq -0x18(%rbp),%rcx
add    %rcx,%rax
mov    %rax,-0x30(%rbp)
mov    -0x30(%rbp),%rax
mov    (%rax),%al
mov    %al,-0x31(%rbp)
movsbl -0x31(%rbp),%eax
cmp    $0x22,%eax
jne    11a4 <parse_expression_list+0x84>
jmp    11dc <parse_expression_list+0xbc>
movsbl -0x31(%rbp),%eax
cmp    $0x2c,%eax
jne    11b6 <parse_expression_list+0x96>
jmp    11f2 <parse_expression_list+0xd2>
movsbl -0x31(%rbp),%eax
cmp    $0x0,%eax
jne    11c8 <parse_expression_list+0xa8>
jmp    120b <parse_expression_list+0xeb>
xor    %eax,%eax
test   $0x1,%al
jne    11d7 <parse_expression_list+0xb7>
jmp    150a <parse_expression_list+0x3ea>
jmp    11dc <parse_expression_list+0xbc>
cmpl   $0x0,-0x20(%rbp)
setne  %al
xor    $0xff,%al
and    $0x1,%al
movzbl %al,%eax
mov    %eax,-0x20(%rbp)
jmp    150f <parse_expression_list+0x3ef>
cmpl   $0x0,-0x20(%rbp)
je     1201 <parse_expression_list+0xe1>
jmp    150f <parse_expression_list+0x3ef>
jmp    1206 <parse_expression_list+0xe6>
jmp    120b <parse_expression_list+0xeb>
jmp    1210 <parse_expression_list+0xf0>
jmp    1215 <parse_expression_list+0xf5>
mov    -0x10(%rbp),%rax
movslq -0x14(%rbp),%rcx
add    %rcx,%rax
mov    %rax,-0x40(%rbp)
mov    -0x40(%rbp),%rax
mov    (%rax),%al
mov    %al,-0x41(%rbp)
movsbl -0x41(%rbp),%eax
mov    %eax,-0x48(%rbp)
cmpl   $0x20,-0x48(%rbp)
jne    1243 <parse_expression_list+0x123>
jmp    127b <parse_expression_list+0x15b>
mov    -0x10(%rbp),%rax
movslq -0x14(%rbp),%rcx
add    %rcx,%rax
mov    %rax,-0x50(%rbp)
mov    -0x50(%rbp),%rax
mov    (%rax),%al
mov    %al,-0x51(%rbp)
movsbl -0x51(%rbp),%eax
mov    %eax,-0x58(%rbp)
cmpl   $0x9,-0x58(%rbp)
jne    1271 <parse_expression_list+0x151>
jmp    1276 <parse_expression_list+0x156>
jmp    1289 <parse_expression_list+0x169>
jmp    127b <parse_expression_list+0x15b>
mov    -0x14(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x14(%rbp)
jmp    1210 <parse_expression_list+0xf0>
mov    -0x10(%rbp),%rax
movslq -0x14(%rbp),%rcx
add    %rcx,%rax
mov    %rax,-0x60(%rbp)
mov    -0x60(%rbp),%rax
mov    (%rax),%al
mov    %al,-0x61(%rbp)
movsbl -0x61(%rbp),%eax
mov    %eax,-0x68(%rbp)
cmpl   $0x22,-0x68(%rbp)
jne    12c0 <parse_expression_list+0x1a0>
mov    -0x14(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x14(%rbp)
jmp    12c5 <parse_expression_list+0x1a5>
jmp    12c5 <parse_expression_list+0x1a5>
mov    -0x18(%rbp),%eax
sub    $0x1,%eax
mov    %eax,-0x1c(%rbp)
jmp    12d3 <parse_expression_list+0x1b3>
xor    %eax,%eax
cmp    -0x1c(%rbp),%eax
jge    1355 <parse_expression_list+0x235>
mov    -0x10(%rbp),%rax
movslq -0x1c(%rbp),%rcx
add    %rcx,%rax
mov    %rax,-0x70(%rbp)
mov    -0x70(%rbp),%rax
mov    (%rax),%al
mov    %al,-0x71(%rbp)
movsbl -0x71(%rbp),%eax
mov    %eax,-0x78(%rbp)
cmpl   $0x20,-0x78(%rbp)
jne    130c <parse_expression_list+0x1ec>
jmp    1350 <parse_expression_list+0x230>
mov    -0x10(%rbp),%rax
movslq -0x1c(%rbp),%rcx
add    %rcx,%rax
mov    %rax,-0x80(%rbp)
mov    -0x80(%rbp),%rax
mov    (%rax),%al
mov    %al,-0x81(%rbp)
movsbl -0x81(%rbp),%eax
mov    %eax,-0x88(%rbp)
cmpl   $0x9,-0x88(%rbp)
jne    1346 <parse_expression_list+0x226>
jmp    134b <parse_expression_list+0x22b>
jmp    1368 <parse_expression_list+0x248>
jmp    1350 <parse_expression_list+0x230>
jmp    135a <parse_expression_list+0x23a>
jmp    1368 <parse_expression_list+0x248>
mov    -0x1c(%rbp),%eax
sub    $0x1,%eax
mov    %eax,-0x1c(%rbp)
jmp    12ce <parse_expression_list+0x1ae>
xor    %eax,%eax
cmp    -0x1c(%rbp),%eax
jge    13c6 <parse_expression_list+0x2a6>
mov    -0x10(%rbp),%rax
movslq -0x1c(%rbp),%rcx
add    %rcx,%rax
mov    %rax,-0x90(%rbp)
mov    -0x90(%rbp),%rax
mov    (%rax),%al
mov    %al,-0x91(%rbp)
movsbl -0x91(%rbp),%eax
mov    %eax,-0x98(%rbp)
cmpl   $0x22,-0x98(%rbp)
jne    13bc <parse_expression_list+0x29c>
mov    -0x1c(%rbp),%eax
sub    $0x1,%eax
mov    %eax,-0x1c(%rbp)
jmp    13c1 <parse_expression_list+0x2a1>
jmp    13c1 <parse_expression_list+0x2a1>
jmp    13cb <parse_expression_list+0x2ab>
jmp    13cb <parse_expression_list+0x2ab>
mov    -0x14(%rbp),%eax
cmp    -0x1c(%rbp),%eax
jg     14f0 <parse_expression_list+0x3d0>
mov    -0x1c(%rbp),%eax
sub    -0x14(%rbp),%eax
mov    %eax,-0x9c(%rbp)
mov    -0x9c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0xa0(%rbp)
cmpl   $0x2,-0xa0(%rbp)
jge    1404 <parse_expression_list+0x2e4>
jmp    1423 <parse_expression_list+0x303>
lea    0xbf5(%rip),%rdi
lea    0xbfc(%rip),%rsi
mov    $0x29,%edx
lea    0xc3a(%rip),%rcx
call   1030 <__assert_fail@plt>
movq   $0x0,-0xa8(%rbp)
lea    -0x22(%rbp),%rax
add    -0xa8(%rbp),%rax
mov    %rax,-0xb0(%rbp)
mov    -0xb0(%rbp),%rax
mov    %rax,-0xb8(%rbp)
mov    -0x10(%rbp),%rax
movslq -0x14(%rbp),%rcx
add    %rcx,%rax
mov    %rax,-0xc0(%rbp)
mov    -0xc0(%rbp),%rax
mov    %rax,-0xc8(%rbp)
mov    -0x1c(%rbp),%eax
sub    -0x14(%rbp),%eax
mov    %eax,-0xcc(%rbp)
mov    -0xcc(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0xd0(%rbp)
mov    -0xb8(%rbp),%rdi
mov    -0xc8(%rbp),%rsi
mov    -0xd0(%rbp),%edx
call   1040 <r_strncpy@plt>
mov    -0x1c(%rbp),%eax
sub    -0x14(%rbp),%eax
mov    %eax,-0xd4(%rbp)
mov    -0xd4(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0xd8(%rbp)
movslq -0xd8(%rbp),%rax
shl    $0x0,%rax
mov    %rax,-0xe0(%rbp)
lea    -0x22(%rbp),%rax
add    -0xe0(%rbp),%rax
mov    %rax,-0xe8(%rbp)
mov    -0xe8(%rbp),%rax
movb   $0x0,(%rax)
jmp    14fc <parse_expression_list+0x3dc>
movl   $0xffffffff,-0x4(%rbp)
jmp    1574 <parse_expression_list+0x454>
mov    -0x18(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x14(%rbp)
jmp    1514 <parse_expression_list+0x3f4>
jmp    150f <parse_expression_list+0x3ef>
jmp    1514 <parse_expression_list+0x3f4>
jmp    1519 <parse_expression_list+0x3f9>
jmp    151e <parse_expression_list+0x3fe>
jmp    1523 <parse_expression_list+0x403>
mov    -0x10(%rbp),%rax
movslq -0x18(%rbp),%rcx
add    %rcx,%rax
mov    %rax,-0xf0(%rbp)
mov    -0xf0(%rbp),%rax
mov    (%rax),%al
mov    %al,-0xf1(%rbp)
movsbl -0xf1(%rbp),%eax
mov    %eax,-0xf8(%rbp)
cmpl   $0x0,-0xf8(%rbp)
je     1563 <parse_expression_list+0x443>
jmp    1568 <parse_expression_list+0x448>
jmp    156d <parse_expression_list+0x44d>
jmp    116c <parse_expression_list+0x4c>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x100,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<parse_expression_list>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    $0xffffffff,%eax
test   %rdi,%rdi
je     126e <parse_expression_list+0x14e>
mov    %rdi,%r14
mov    $0xffffffffffffffff,%r12
xor    %r13d,%r13d
xor    %esi,%esi
xor    %ebp,%ebp
jmp    1188 <parse_expression_list+0x68>
nopl   0x0(%rax)
movslq %ebp,%rsi
add    %r14,%rsi
lea    0x6(%rsp),%rbx
mov    %rbx,%rdi
mov    %r15d,%edx
call   1040 <r_strncpy@plt>
movb   $0x0,(%r15,%rbx,1)
mov    0x1(%r14,%r12,1),%al
lea    0x2(%r12),%ebp
mov    (%rsp),%esi
add    $0x1,%r12
add    $0x1,%r13d
test   %al,%al
je     1265 <parse_expression_list+0x145>
mov    0x1(%r14,%r12,1),%al
test   %al,%al
je     11c0 <parse_expression_list+0xa0>
cmp    $0x2c,%al
je     11b0 <parse_expression_list+0x90>
cmp    $0x22,%al
jne    1178 <parse_expression_list+0x58>
xor    %ecx,%ecx
test   %esi,%esi
sete   %cl
mov    $0x2c,%al
mov    %ecx,%esi
jmp    1178 <parse_expression_list+0x58>
cs nopw 0x0(%rax,%rax,1)
test   %esi,%esi
je     11c0 <parse_expression_list+0xa0>
mov    $0x1,%esi
mov    $0x2c,%al
jmp    1178 <parse_expression_list+0x58>
nopl   (%rax)
mov    %r12d,%ecx
mov    %r12d,%eax
movslq %ebp,%rdx
add    %r14,%rdx
jmp    11d7 <parse_expression_list+0xb7>
xchg   %ax,%ax
add    $0x1,%ebp
add    $0x1,%rdx
movzbl (%rdx),%ebx
cmp    $0x9,%bl
je     11d0 <parse_expression_list+0xb0>
cmp    $0x20,%bl
je     11d0 <parse_expression_list+0xb0>
cmp    $0x22,%bl
jne    11ec <parse_expression_list+0xcc>
add    $0x1,%ebp
test   %r12,%r12
jle    122b <parse_expression_list+0x10b>
mov    %r13d,%ecx
jmp    120c <parse_expression_list+0xec>
cs nopw 0x0(%rax,%rax,1)
add    $0xffffffffffffffff,%rax
add    $0xffffffff,%ecx
cmp    $0x1,%ecx
jle    1229 <parse_expression_list+0x109>
movzbl (%r14,%rax,1),%edx
cmp    $0x20,%dl
je     1200 <parse_expression_list+0xe0>
cmp    $0x9,%dl
je     1200 <parse_expression_list+0xe0>
xor    %ecx,%ecx
cmp    $0x22,%dl
sete   %cl
sub    %ecx,%eax
mov    %eax,%ecx
jmp    122b <parse_expression_list+0x10b>
xor    %ecx,%ecx
sub    %ebp,%ecx
jl     1269 <parse_expression_list+0x149>
mov    %esi,(%rsp)
movslq %ecx,%rax
lea    0x1(%rax),%r15
test   %eax,%eax
jle    1150 <parse_expression_list+0x30>
lea    0xdb8(%rip),%rdi
lea    0xdbf(%rip),%rsi
mov    $0x29,%edx
lea    0xdfd(%rip),%rcx
call   1030 <__assert_fail@plt>
jmp    1150 <parse_expression_list+0x30>
xor    %eax,%eax
jmp    126e <parse_expression_list+0x14e>
mov    $0xffffffff,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [14 x i8] c"j-start+1 < 2\00"
@.str.1 = [74 x i8] c"../versisec/OpenSer/progs/OpenSERCVE-200606749complete_parse_config_bad.c\00"
@.str.2 = [22 x i8] c"parse_expression_list\00"
define i32 @parse_expression_list(i8* %0) {
%2 = alloca i32
%3 = alloca i8*
%4 = alloca i32
%5 = alloca i32
%6 = alloca i32
%7 = alloca i32
%8 = alloca [2 x i8]
%9 = alloca i8*
%10 = alloca i8
%11 = alloca i8*
%12 = alloca i8
%13 = alloca i32
%14 = alloca i8*
%15 = alloca i8
%16 = alloca i32
%17 = alloca i8*
%18 = alloca i8
%19 = alloca i32
%20 = alloca i8*
%21 = alloca i8
%22 = alloca i32
%23 = alloca i8*
%24 = alloca i8
%25 = alloca i32
%26 = alloca i8*
%27 = alloca i8
%28 = alloca i32
%29 = alloca i32
%30 = alloca i32
%31 = alloca i64
%32 = alloca i64
%33 = alloca i8*
%34 = alloca i8*
%35 = alloca i8*
%36 = alloca i32
%37 = alloca i32
%38 = alloca i32
%39 = alloca i32
%40 = alloca i64
%41 = alloca i64
%42 = alloca i8*
%43 = alloca i8
%44 = alloca i32
store i8* %0, i8** %3
store i32 0, i32* %4
store i32 -1, i32* %5
store i32 -1, i32* %6
store i32 0, i32* %7
%45 = load i8*, i8** %3
%46 = icmp ne i8* %45, null
br i1 %46, label %48, label %47
47: ; preds = %1
store i32 -1, i32* %2
br label %265
48: ; preds = %1
br label %49
49: ; preds = %48
br label %50
50: ; preds = %49, %263
br label %51
51: ; preds = %50
%52 = load i32, i32* %5
%53 = add nsw i32 %52, 1
store i32 %53, i32* %5
%54 = load i8*, i8** %3
%55 = load i32, i32* %5
%56 = sext i32 %55 to i64
%57 = getelementptr inbounds i8, i8* %54, i64 %56
store i8* %57, i8** %9
%58 = load i8*, i8** %9
%59 = load i8, i8* %58
store i8 %59, i8* %10
%60 = load i8, i8* %10
%61 = sext i8 %60 to i32
%62 = icmp eq i32 %61, 34
br i1 %62, label %63, label %64
63: ; preds = %51
br label %76
64: ; preds = %51
%65 = load i8, i8* %10
%66 = sext i8 %65 to i32
%67 = icmp eq i32 %66, 44
br i1 %67, label %68, label %69
68: ; preds = %64
br label %81
69: ; preds = %64
%70 = load i8, i8* %10
%71 = sext i8 %70 to i32
%72 = icmp eq i32 %71, 0
br i1 %72, label %73, label %74
73: ; preds = %69
br label %87
74: ; preds = %69
br i1 false, label %75, label %245
75: ; preds = %74
br label %76
76: ; preds = %75, %63
%77 = load i32, i32* %7
%78 = icmp ne i32 %77, 0
%79 = xor i1 %78, true
%80 = zext i1 %79 to i32
store i32 %80, i32* %7
br label %246
81: ; preds = %68
%82 = load i32, i32* %7
%83 = icmp ne i32 %82, 0
br i1 %83, label %84, label %85
84: ; preds = %81
br label %246
85: ; preds = %81
br label %86
86: ; preds = %85
br label %87
87: ; preds = %86, %73
br label %88
88: ; preds = %87, %115
br label %89
89: ; preds = %88
%90 = load i8*, i8** %3
%91 = load i32, i32* %4
%92 = sext i32 %91 to i64
%93 = getelementptr inbounds i8, i8* %90, i64 %92
store i8* %93, i8** %11
%94 = load i8*, i8** %11
%95 = load i8, i8* %94
store i8 %95, i8* %12
%96 = load i8, i8* %12
%97 = sext i8 %96 to i32
store i32 %97, i32* %13
%98 = load i32, i32* %13
%99 = icmp eq i32 %98, 32
br i1 %99, label %100, label %101
100: ; preds = %89
br label %115
101: ; preds = %89
%102 = load i8*, i8** %3
%103 = load i32, i32* %4
%104 = sext i32 %103 to i64
%105 = getelementptr inbounds i8, i8* %102, i64 %104
store i8* %105, i8** %14
%106 = load i8*, i8** %14
%107 = load i8, i8* %106
store i8 %107, i8* %15
%108 = load i8, i8* %15
%109 = sext i8 %108 to i32
store i32 %109, i32* %16
%110 = load i32, i32* %16
%111 = icmp eq i32 %110, 9
br i1 %111, label %112, label %113
112: ; preds = %101
br label %114
113: ; preds = %101
br label %118
114: ; preds = %112
br label %115
115: ; preds = %114, %100
%116 = load i32, i32* %4
%117 = add nsw i32 %116, 1
store i32 %117, i32* %4
br label %88
118: ; preds = %113
%119 = load i8*, i8** %3
%120 = load i32, i32* %4
%121 = sext i32 %120 to i64
%122 = getelementptr inbounds i8, i8* %119, i64 %121
store i8* %122, i8** %17
%123 = load i8*, i8** %17
%124 = load i8, i8* %123
store i8 %124, i8* %18
%125 = load i8, i8* %18
%126 = sext i8 %125 to i32
store i32 %126, i32* %19
%127 = load i32, i32* %19
%128 = icmp eq i32 %127, 34
br i1 %128, label %129, label %132
129: ; preds = %118
%130 = load i32, i32* %4
%131 = add nsw i32 %130, 1
store i32 %131, i32* %4
br label %133
132: ; preds = %118
br label %133
133: ; preds = %132, %129
%134 = load i32, i32* %5
%135 = sub nsw i32 %134, 1
store i32 %135, i32* %6
br label %136
136: ; preds = %133, %168
br label %137
137: ; preds = %136
%138 = load i32, i32* %6
%139 = icmp slt i32 0, %138
br i1 %139, label %140, label %167
140: ; preds = %137
%141 = load i8*, i8** %3
%142 = load i32, i32* %6
%143 = sext i32 %142 to i64
%144 = getelementptr inbounds i8, i8* %141, i64 %143
store i8* %144, i8** %20
%145 = load i8*, i8** %20
%146 = load i8, i8* %145
store i8 %146, i8* %21
%147 = load i8, i8* %21
%148 = sext i8 %147 to i32
store i32 %148, i32* %22
%149 = load i32, i32* %22
%150 = icmp eq i32 %149, 32
br i1 %150, label %151, label %152
151: ; preds = %140
br label %166
152: ; preds = %140
%153 = load i8*, i8** %3
%154 = load i32, i32* %6
%155 = sext i32 %154 to i64
%156 = getelementptr inbounds i8, i8* %153, i64 %155
store i8* %156, i8** %23
%157 = load i8*, i8** %23
%158 = load i8, i8* %157
store i8 %158, i8* %24
%159 = load i8, i8* %24
%160 = sext i8 %159 to i32
store i32 %160, i32* %25
%161 = load i32, i32* %25
%162 = icmp eq i32 %161, 9
br i1 %162, label %163, label %164
163: ; preds = %152
br label %165
164: ; preds = %152
br label %171
165: ; preds = %163
br label %166
166: ; preds = %165, %151
br label %168
167: ; preds = %137
br label %171
168: ; preds = %166
%169 = load i32, i32* %6
%170 = sub nsw i32 %169, 1
store i32 %170, i32* %6
br label %136
171: ; preds = %167, %164
%172 = load i32, i32* %6
%173 = icmp slt i32 0, %172
br i1 %173, label %174, label %190
174: ; preds = %171
%175 = load i8*, i8** %3
%176 = load i32, i32* %6
%177 = sext i32 %176 to i64
%178 = getelementptr inbounds i8, i8* %175, i64 %177
store i8* %178, i8** %26
%179 = load i8*, i8** %26
%180 = load i8, i8* %179
store i8 %180, i8* %27
%181 = load i8, i8* %27
%182 = sext i8 %181 to i32
store i32 %182, i32* %28
%183 = load i32, i32* %28
%184 = icmp eq i32 %183, 34
br i1 %184, label %185, label %188
185: ; preds = %174
%186 = load i32, i32* %6
%187 = sub nsw i32 %186, 1
store i32 %187, i32* %6
br label %189
188: ; preds = %174
br label %189
189: ; preds = %188, %185
br label %191
190: ; preds = %171
br label %191
191: ; preds = %190, %189
%192 = load i32, i32* %4
%193 = load i32, i32* %6
%194 = icmp sle i32 %192, %193
br i1 %194, label %195, label %241
195: ; preds = %191
%196 = load i32, i32* %6
%197 = load i32, i32* %4
%198 = sub nsw i32 %196, %197
store i32 %198, i32* %29
%199 = load i32, i32* %29
%200 = add nsw i32 %199, 1
store i32 %200, i32* %30
%201 = load i32, i32* %30
%202 = icmp slt i32 %201, 2
br i1 %202, label %203, label %204
203: ; preds = %195
br label %206
204: ; preds = %195
%205 = call i32 @__assert_fail(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([74 x i8], [74 x i8]* @.str.1, i64 0, i64 0), i32 41, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.2, i64 0, i64 0))
br label %206
206: ; preds = %204, %203
store i64 0, i64* %31
%207 = getelementptr inbounds [2 x i8], [2 x i8]* %8, i64 0, i64 0
%208 = ptrtoint i8* %207 to i64
%209 = load i64, i64* %31
%210 = add i64 %208, %209
store i64 %210, i64* %32
%211 = load i64, i64* %32
%212 = inttoptr i64 %211 to i8*
store i8* %212, i8** %33
%213 = load i8*, i8** %3
%214 = load i32, i32* %4
%215 = sext i32 %214 to i64
%216 = getelementptr inbounds i8, i8* %213, i64 %215
store i8* %216, i8** %34
%217 = load i8*, i8** %34
store i8* %217, i8** %35
%218 = load i32, i32* %6
%219 = load i32, i32* %4
%220 = sub nsw i32 %218, %219
store i32 %220, i32* %36
%221 = load i32, i32* %36
%222 = add nsw i32 %221, 1
store i32 %222, i32* %37
%223 = load i8*, i8** %33
%224 = load i8*, i8** %35
%225 = load i32, i32* %37
%226 = call i32 @r_strncpy(i8* %223, i8* %224, i32 %225)
%227 = load i32, i32* %6
%228 = load i32, i32* %4
%229 = sub nsw i32 %227, %228
store i32 %229, i32* %38
%230 = load i32, i32* %38
%231 = add nsw i32 %230, 1
store i32 %231, i32* %39
%232 = load i32, i32* %39
%233 = sext i32 %232 to i64
%234 = mul i64 %233, 1
store i64 %234, i64* %40
%235 = getelementptr inbounds [2 x i8], [2 x i8]* %8, i64 0, i64 0
%236 = ptrtoint i8* %235 to i64
%237 = load i64, i64* %40
%238 = add i64 %236, %237
store i64 %238, i64* %41
%239 = load i64, i64* %41
%240 = inttoptr i64 %239 to i8*
store i8 0, i8* %240
br label %242
241: ; preds = %191
store i32 -1, i32* %2
br label %265
242: ; preds = %206
%243 = load i32, i32* %5
%244 = add nsw i32 %243, 1
store i32 %244, i32* %4
br label %247
245: ; preds = %74
br label %246
246: ; preds = %245, %84, %76
br label %247
247: ; preds = %246, %242
br label %248
248: ; preds = %247
br label %249
249: ; preds = %248
br label %250
250: ; preds = %249
%251 = load i8*, i8** %3
%252 = load i32, i32* %5
%253 = sext i32 %252 to i64
%254 = getelementptr inbounds i8, i8* %251, i64 %253
store i8* %254, i8** %42
%255 = load i8*, i8** %42
%256 = load i8, i8* %255
store i8 %256, i8* %43
%257 = load i8, i8* %43
%258 = sext i8 %257 to i32
store i32 %258, i32* %44
%259 = load i32, i32* %44
%260 = icmp ne i32 %259, 0
br i1 %260, label %261, label %262
261: ; preds = %250
br label %263
262: ; preds = %250
br label %264
263: ; preds = %261
br label %50
264: ; preds = %262
store i32 0, i32* %2
br label %265
265: ; preds = %264, %241, %47
%266 = load i32, i32* %2
ret i32 %266
}

LLVM IR (-O2):
@.str = [14 x i8] c"j-start+1 < 2\00"
@.str.1 = [74 x i8] c"../versisec/OpenSer/progs/OpenSERCVE-200606749complete_parse_config_bad.c\00"
@.str.2 = [22 x i8] c"parse_expression_list\00"
define i32 @parse_expression_list(i8* %0) {
%2 = alloca [2 x i8]
%3 = getelementptr inbounds [2 x i8], [2 x i8]* %2, i64 0, i64 0
%4 = icmp eq i8* %0, null
br i1 %4, label %74, label %5
5: ; preds = %1
%6 = ptrtoint [2 x i8]* %2 to i64
br label %7
7: ; preds = %5, %69
%8 = phi i64 [ -1, %5 ], [ %13, %69 ]
%9 = phi i32 [ 0, %5 ], [ %71, %69 ]
%10 = phi i32 [ 0, %5 ], [ %72, %69 ]
%11 = trunc i64 %8 to i32
%12 = and i64 %8, 4294967295
%13 = add nsw i64 %8, 1
%14 = getelementptr inbounds i8, i8* %0, i64 %13
%15 = load i8, i8* %14
switch i8 %15, label %69 [
i8 34, label %16
i8 44, label %19
i8 0, label %21
]
16: ; preds = %7
%17 = icmp eq i32 %9, 0
%18 = zext i1 %17 to i32
br label %69
19: ; preds = %7
%20 = icmp eq i32 %9, 0
br i1 %20, label %21, label %69
21: ; preds = %7, %19
%22 = sext i32 %10 to i64
br label %23
23: ; preds = %27, %21
%24 = phi i64 [ %28, %27 ], [ %22, %21 ]
%25 = getelementptr inbounds i8, i8* %0, i64 %24
%26 = load i8, i8* %25
switch i8 %26, label %32 [
i8 32, label %27
i8 9, label %27
i8 34, label %29
]
27: ; preds = %23, %23
%28 = add i64 %24, 1
br label %23
29: ; preds = %23
%30 = trunc i64 %24 to i32
%31 = add nsw i32 %30, 1
br label %34
32: ; preds = %23
%33 = trunc i64 %24 to i32
br label %34
34: ; preds = %32, %29
%35 = phi i32 [ %31, %29 ], [ %33, %32 ]
%36 = icmp sgt i64 %8, 0
br i1 %36, label %37, label %50
37: ; preds = %34, %41
%38 = phi i64 [ %42, %41 ], [ %12, %34 ]
%39 = getelementptr inbounds i8, i8* %0, i64 %38
%40 = load i8, i8* %39
switch i8 %40, label %45 [
i8 32, label %41
i8 9, label %41
]
41: ; preds = %37, %37
%42 = add nsw i64 %38, -1
%43 = trunc i64 %38 to i32
%44 = icmp sgt i32 %43, 1
br i1 %44, label %37, label %50
45: ; preds = %37
%46 = trunc i64 %38 to i32
%47 = icmp eq i8 %40, 34
%48 = sext i1 %47 to i32
%49 = add nsw i32 %46, %48
br label %50
50: ; preds = %41, %34, %45
%51 = phi i32 [ %49, %45 ], [ %11, %34 ], [ 0, %41 ]
%52 = icmp slt i32 %51, %35
br i1 %52, label %74, label %53
53: ; preds = %50
%54 = sub nsw i32 %51, %35
%55 = add nsw i32 %54, 1
%56 = icmp slt i32 %54, 1
br i1 %56, label %59, label %57
57: ; preds = %53
%58 = call i32 @__assert_fail(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([74 x i8], [74 x i8]* @.str.1, i64 0, i64 0), i32 41, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.2, i64 0, i64 0))
br label %59
59: ; preds = %53, %57
%60 = sext i32 %35 to i64
%61 = getelementptr inbounds i8, i8* %0, i64 %60
%62 = call i32 @r_strncpy(i8* %3, i8* %61, i32 %55)
%63 = sext i32 %55 to i64
%64 = add i64 %63, %6
%65 = inttoptr i64 %64 to i8*
store i8 0, i8* %65
%66 = load i8, i8* %14
%67 = trunc i64 %8 to i32
%68 = add i32 %67, 2
br label %69
69: ; preds = %7, %59, %19, %16
%70 = phi i8 [ %15, %7 ], [ %66, %59 ], [ 44, %19 ], [ 44, %16 ]
%71 = phi i32 [ %9, %7 ], [ %9, %59 ], [ 1, %19 ], [ %18, %16 ]
%72 = phi i32 [ %10, %7 ], [ %68, %59 ], [ %10, %19 ], [ %10, %16 ]
%73 = icmp eq i8 %70, 0
br i1 %73, label %74, label %7
74: ; preds = %69, %50, %1
%75 = phi i32 [ -1, %1 ], [ 0, %69 ], [ -1, %50 ]
ret i32 %75
}