#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int strlen(char *);
int /*<<< orphan*/ strncat(char *, char *, int);
void strncat_unknown_src_length(char *src, int offset) {
  char dst[8] = "1234";
  strncat(dst, &src[offset], 3);
  if (strlen(dst) < 4)
    (void)*(char *)0;
  char dst2[8] = "1234";
  strncat(dst2, &src[offset], 4);
}


x86 assembly (clang, -O0):
<strncat_unknown_src_length>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %rdi,-0x8(%rbp)
mov    %esi,-0xc(%rbp)
mov    0xeca(%rip),%rax
mov    %rax,-0x14(%rbp)
lea    -0x14(%rbp),%rdi
mov    -0x8(%rbp),%rsi
movslq -0xc(%rbp),%rax
add    %rax,%rsi
mov    $0x3,%edx
call   1040 <strncat@plt>
lea    -0x14(%rbp),%rdi
call   1030 <strlen@plt>
cmp    $0x4,%eax
jge    1165 <strncat_unknown_src_length+0x45>
mov    0xe94(%rip),%rax
mov    %rax,-0x1c(%rbp)
lea    -0x1c(%rbp),%rdi
mov    -0x8(%rbp),%rsi
movslq -0xc(%rbp),%rax
add    %rax,%rsi
mov    $0x4,%edx
call   1040 <strncat@plt>
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<strncat_unknown_src_length>:
push   %r14
push   %rbx
sub    $0x18,%rsp
movq   $0x34333231,0x10(%rsp)
33 34
movslq %esi,%rbx
add    %rdi,%rbx
lea    0x10(%rsp),%r14
mov    %r14,%rdi
mov    %rbx,%rsi
mov    $0x3,%edx
call   1040 <strncat@plt>
mov    %r14,%rdi
call   1030 <strlen@plt>
movq   $0x34333231,0x8(%rsp)
33 34
lea    0x8(%rsp),%rdi
mov    %rbx,%rsi
mov    $0x4,%edx
call   1040 <strncat@plt>
add    $0x18,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
@__const.strncat_unknown_src_length.dst = [8 x i8] c"1234\00\00\00\00"
@__const.strncat_unknown_src_length.dst2 = [8 x i8] c"1234\00\00\00\00"
define void @strncat_unknown_src_length(i8* %0, i32 %1) {
%3 = alloca i8*
%4 = alloca i32
%5 = alloca [8 x i8]
%6 = alloca [8 x i8]
store i8* %0, i8** %3
store i32 %1, i32* %4
%7 = bitcast [8 x i8]* %5 to i8*
%8 = getelementptr inbounds [8 x i8], [8 x i8]* %5, i64 0, i64 0
%9 = load i8*, i8** %3
%10 = load i32, i32* %4
%11 = sext i32 %10 to i64
%12 = getelementptr inbounds i8, i8* %9, i64 %11
%13 = call i32 @strncat(i8* %8, i8* %12, i32 3)
%14 = getelementptr inbounds [8 x i8], [8 x i8]* %5, i64 0, i64 0
%15 = call i32 @strlen(i8* %14)
%16 = icmp slt i32 %15, 4
br i1 %16, label %17, label %19
17: ; preds = %2
%18 = load i8, i8* null
br label %19
19: ; preds = %17, %2
%20 = bitcast [8 x i8]* %6 to i8*
%21 = getelementptr inbounds [8 x i8], [8 x i8]* %6, i64 0, i64 0
%22 = load i8*, i8** %3
%23 = load i32, i32* %4
%24 = sext i32 %23 to i64
%25 = getelementptr inbounds i8, i8* %22, i64 %24
%26 = call i32 @strncat(i8* %21, i8* %25, i32 4)
ret void
}

LLVM IR (-O2):
define void @strncat_unknown_src_length(i8* %0, i32 %1) {
%3 = alloca i64
%4 = alloca i64
%5 = bitcast i64* %3 to i8*
store i64 875770417, i64* %3
%6 = sext i32 %1 to i64
%7 = getelementptr inbounds i8, i8* %0, i64 %6
%8 = call i32 @strncat(i8* %5, i8* %7, i32 3)
%9 = call i32 @strlen(i8* %5)
%10 = bitcast i64* %4 to i8*
store i64 875770417, i64* %4
%11 = call i32 @strncat(i8* %10, i8* %7, i32 4)
ret void
}