#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
char *malloc(int);
char *mempcpy(char *, void const *, int /*<<< orphan*/);
int /*<<< orphan*/ sink(char *);
int /*<<< orphan*/ unsigned_range(int, int);
void warn_mempcpy_chain_4(const void *s) {
  char *p = malloc(9);
  p = mempcpy(p, s, unsigned_range((1), (2)));
  p = mempcpy(p, s, unsigned_range((2), (3)));
  p = mempcpy(p, s, unsigned_range((3), (4)));
  p = mempcpy(p, s, unsigned_range((4), (5)));
  sink(p);
}


x86 assembly (clang, -O0):
<warn_mempcpy_chain_4>:
push   %rbp
mov    %rsp,%rbp
sub    $0x50,%rsp
mov    %rdi,-0x8(%rbp)
mov    $0x9,%edi
call   1040 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0x50(%rbp)
mov    -0x8(%rbp),%rax
mov    %rax,-0x48(%rbp)
mov    $0x1,%edi
mov    $0x2,%esi
call   1060 <unsigned_range@plt>
mov    -0x50(%rbp),%rdi
mov    -0x48(%rbp),%rsi
mov    %eax,%edx
call   1050 <mempcpy@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0x40(%rbp)
mov    -0x8(%rbp),%rax
mov    %rax,-0x38(%rbp)
mov    $0x2,%edi
mov    $0x3,%esi
call   1060 <unsigned_range@plt>
mov    -0x40(%rbp),%rdi
mov    -0x38(%rbp),%rsi
mov    %eax,%edx
call   1050 <mempcpy@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0x30(%rbp)
mov    -0x8(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    $0x3,%edi
mov    $0x4,%esi
call   1060 <unsigned_range@plt>
mov    -0x30(%rbp),%rdi
mov    -0x28(%rbp),%rsi
mov    %eax,%edx
call   1050 <mempcpy@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    -0x8(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    $0x4,%edi
mov    $0x5,%esi
call   1060 <unsigned_range@plt>
mov    -0x20(%rbp),%rdi
mov    -0x18(%rbp),%rsi
mov    %eax,%edx
call   1050 <mempcpy@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rdi
call   1030 <sink@plt>
add    $0x50,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<warn_mempcpy_chain_4>:
push   %r14
push   %rbx
push   %rax
mov    %rdi,%rbx
mov    $0x9,%edi
call   1040 <malloc@plt>
mov    %rax,%r14
mov    $0x1,%edi
mov    $0x2,%esi
call   1060 <unsigned_range@plt>
mov    %r14,%rdi
mov    %rbx,%rsi
mov    %eax,%edx
call   1050 <mempcpy@plt>
mov    %rax,%r14
mov    $0x2,%edi
mov    $0x3,%esi
call   1060 <unsigned_range@plt>
mov    %r14,%rdi
mov    %rbx,%rsi
mov    %eax,%edx
call   1050 <mempcpy@plt>
mov    %rax,%r14
mov    $0x3,%edi
mov    $0x4,%esi
call   1060 <unsigned_range@plt>
mov    %r14,%rdi
mov    %rbx,%rsi
mov    %eax,%edx
call   1050 <mempcpy@plt>
mov    %rax,%r14
mov    $0x4,%edi
mov    $0x5,%esi
call   1060 <unsigned_range@plt>
mov    %r14,%rdi
mov    %rbx,%rsi
mov    %eax,%edx
call   1050 <mempcpy@plt>
mov    %rax,%rdi
add    $0x8,%rsp
pop    %rbx
pop    %r14
jmp    1030 <sink@plt>

LLVM IR (-O0):
define void @warn_mempcpy_chain_4(i8* %0) {
%2 = alloca i8*
%3 = alloca i8*
store i8* %0, i8** %2
%4 = call i8* @malloc(i32 9)
store i8* %4, i8** %3
%5 = load i8*, i8** %3
%6 = load i8*, i8** %2
%7 = call i32 @unsigned_range(i32 1, i32 2)
%8 = call i8* @mempcpy(i8* %5, i8* %6, i32 %7)
store i8* %8, i8** %3
%9 = load i8*, i8** %3
%10 = load i8*, i8** %2
%11 = call i32 @unsigned_range(i32 2, i32 3)
%12 = call i8* @mempcpy(i8* %9, i8* %10, i32 %11)
store i8* %12, i8** %3
%13 = load i8*, i8** %3
%14 = load i8*, i8** %2
%15 = call i32 @unsigned_range(i32 3, i32 4)
%16 = call i8* @mempcpy(i8* %13, i8* %14, i32 %15)
store i8* %16, i8** %3
%17 = load i8*, i8** %3
%18 = load i8*, i8** %2
%19 = call i32 @unsigned_range(i32 4, i32 5)
%20 = call i8* @mempcpy(i8* %17, i8* %18, i32 %19)
store i8* %20, i8** %3
%21 = load i8*, i8** %3
%22 = call i32 @sink(i8* %21)
ret void
}

LLVM IR (-O2):
define void @warn_mempcpy_chain_4(i8* %0) {
%2 = tail call dereferenceable_or_null(9) i8* @malloc(i32 9)
%3 = tail call i32 @unsigned_range(i32 1, i32 2)
%4 = tail call i8* @mempcpy(i8* %2, i8* %0, i32 %3)
%5 = tail call i32 @unsigned_range(i32 2, i32 3)
%6 = tail call i8* @mempcpy(i8* %4, i8* %0, i32 %5)
%7 = tail call i32 @unsigned_range(i32 3, i32 4)
%8 = tail call i8* @mempcpy(i8* %6, i8* %0, i32 %7)
%9 = tail call i32 @unsigned_range(i32 4, i32 5)
%10 = tail call i8* @mempcpy(i8* %8, i8* %0, i32 %9)
%11 = tail call i32 @sink(i8* %10)
ret void
}