#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ free(char *);
int /*<<< orphan*/ memset(char *, int /*<<< orphan*/, int);
int /*<<< orphan*/ sethostname(char *, int);
char *xcalloc(int, int);
char *xmalloc(int);
char *xrealloc(char *, int);
void bufferAccessOutOfBounds() {
  char buf[2] = "a";
  sethostname(buf, 2);
  sethostname(buf, 4);
  char *pAlloc1 = xcalloc(2, 4);
  memset(pAlloc1, 0, 8);
  memset(pAlloc1, 0, 9);
  free(pAlloc1);
  char *pAlloc2 = xmalloc(4);
  memset(pAlloc2, 0, 4);
  memset(pAlloc2, 0, 5);
  pAlloc2 = xrealloc(pAlloc2, 10);
  memset(pAlloc2, 0, 10);
  memset(pAlloc2, 0, 11);
  free(pAlloc2);
}


x86 assembly (clang, -O0):
<bufferAccessOutOfBounds>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    0xe91(%rip),%ax
mov    %ax,-0x2(%rbp)
lea    -0x2(%rbp),%rdi
mov    $0x2,%esi
call   1070 <sethostname@plt>
lea    -0x2(%rbp),%rdi
mov    $0x4,%esi
call   1070 <sethostname@plt>
mov    $0x2,%edi
mov    $0x4,%esi
call   1080 <xcalloc@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rdi
xor    %esi,%esi
mov    $0x8,%edx
call   1050 <memset@plt>
mov    -0x10(%rbp),%rdi
xor    %esi,%esi
mov    $0x9,%edx
call   1050 <memset@plt>
mov    -0x10(%rbp),%rdi
call   1030 <free@plt>
mov    $0x4,%edi
call   1060 <xmalloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rdi
xor    %esi,%esi
mov    $0x4,%edx
call   1050 <memset@plt>
mov    -0x18(%rbp),%rdi
xor    %esi,%esi
mov    $0x5,%edx
call   1050 <memset@plt>
mov    -0x18(%rbp),%rdi
mov    $0xa,%esi
call   1040 <xrealloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rdi
xor    %esi,%esi
mov    $0xa,%edx
call   1050 <memset@plt>
mov    -0x18(%rbp),%rdi
xor    %esi,%esi
mov    $0xb,%edx
call   1050 <memset@plt>
mov    -0x18(%rbp),%rdi
call   1030 <free@plt>
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<bufferAccessOutOfBounds>:
push   %rbx
sub    $0x10,%rsp
movw   $0x61,0xe(%rsp)
lea    0xe(%rsp),%rbx
mov    %rbx,%rdi
mov    $0x2,%esi
call   1070 <sethostname@plt>
mov    %rbx,%rdi
mov    $0x4,%esi
call   1070 <sethostname@plt>
mov    $0x2,%edi
mov    $0x4,%esi
call   1080 <xcalloc@plt>
mov    %rax,%rbx
mov    %rax,%rdi
xor    %esi,%esi
mov    $0x8,%edx
call   1050 <memset@plt>
mov    %rbx,%rdi
xor    %esi,%esi
mov    $0x9,%edx
call   1050 <memset@plt>
mov    %rbx,%rdi
call   1030 <free@plt>
mov    $0x4,%edi
call   1060 <xmalloc@plt>
mov    %rax,%rbx
mov    %rax,%rdi
xor    %esi,%esi
mov    $0x4,%edx
call   1050 <memset@plt>
mov    %rbx,%rdi
xor    %esi,%esi
mov    $0x5,%edx
call   1050 <memset@plt>
mov    %rbx,%rdi
mov    $0xa,%esi
call   1040 <xrealloc@plt>
mov    %rax,%rbx
mov    %rax,%rdi
xor    %esi,%esi
mov    $0xa,%edx
call   1050 <memset@plt>
mov    %rbx,%rdi
xor    %esi,%esi
mov    $0xb,%edx
call   1050 <memset@plt>
mov    %rbx,%rdi
call   1030 <free@plt>
add    $0x10,%rsp
pop    %rbx
ret

LLVM IR (-O0):
@__const.bufferAccessOutOfBounds.buf = [2 x i8] c"a\00"
define void @bufferAccessOutOfBounds() {
%1 = alloca [2 x i8]
%2 = alloca i8*
%3 = alloca i8*
%4 = bitcast [2 x i8]* %1 to i8*
%5 = getelementptr inbounds [2 x i8], [2 x i8]* %1, i64 0, i64 0
%6 = call i32 @sethostname(i8* %5, i32 2)
%7 = getelementptr inbounds [2 x i8], [2 x i8]* %1, i64 0, i64 0
%8 = call i32 @sethostname(i8* %7, i32 4)
%9 = call i8* @xcalloc(i32 2, i32 4)
store i8* %9, i8** %2
%10 = load i8*, i8** %2
%11 = call i32 @memset(i8* %10, i32 0, i32 8)
%12 = load i8*, i8** %2
%13 = call i32 @memset(i8* %12, i32 0, i32 9)
%14 = load i8*, i8** %2
%15 = call i32 @free(i8* %14)
%16 = call i8* @xmalloc(i32 4)
store i8* %16, i8** %3
%17 = load i8*, i8** %3
%18 = call i32 @memset(i8* %17, i32 0, i32 4)
%19 = load i8*, i8** %3
%20 = call i32 @memset(i8* %19, i32 0, i32 5)
%21 = load i8*, i8** %3
%22 = call i8* @xrealloc(i8* %21, i32 10)
store i8* %22, i8** %3
%23 = load i8*, i8** %3
%24 = call i32 @memset(i8* %23, i32 0, i32 10)
%25 = load i8*, i8** %3
%26 = call i32 @memset(i8* %25, i32 0, i32 11)
%27 = load i8*, i8** %3
%28 = call i32 @free(i8* %27)
ret void
}

LLVM IR (-O2):
define void @bufferAccessOutOfBounds() {
%1 = alloca i16
%2 = bitcast i16* %1 to i8*
store i16 97, i16* %1
%3 = call i32 @sethostname(i8* %2, i32 2)
%4 = call i32 @sethostname(i8* %2, i32 4)
%5 = call i8* @xcalloc(i32 2, i32 4)
%6 = call i32 @memset(i8* %5, i32 0, i32 8)
%7 = call i32 @memset(i8* %5, i32 0, i32 9)
%8 = call i32 @free(i8* %5)
%9 = call i8* @xmalloc(i32 4)
%10 = call i32 @memset(i8* %9, i32 0, i32 4)
%11 = call i32 @memset(i8* %9, i32 0, i32 5)
%12 = call i8* @xrealloc(i8* %9, i32 10)
%13 = call i32 @memset(i8* %12, i32 0, i32 10)
%14 = call i32 @memset(i8* %12, i32 0, i32 11)
%15 = call i32 @free(i8* %12)
ret void
}