#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int MAP_ANONYMOUS;
void *MAP_FAILED;
int MAP_PRIVATE;
int /*<<< orphan*/ PROT_NONE;
int PROT_READ;
int PROT_WRITE;
size_t getpagesize();
void *mmap(int /*<<< orphan*/ *, size_t, int, int, int, int /*<<< orphan*/);
scalar_t__ mprotect(void *, size_t, int /*<<< orphan*/);
int /*<<< orphan*/ munmap(void *, size_t);
int /*<<< orphan*/ perror(char *);
void *tst_malloc_canary_right(size_t size) {
  size_t pagesize = getpagesize();
  size_t pages = size / pagesize + !!(size % pagesize) + 1;
  void *ret;
  if (size == 0)
    return NULL;
  ret = mmap(NULL, pages * pagesize, PROT_READ | PROT_WRITE,
             MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
  if (ret == MAP_FAILED)
    return NULL;
  if (mprotect(ret + (pages - 1) * pagesize, pagesize, PROT_NONE)) {
    perror("mprotect");
    munmap(ret, pages * pagesize);
    return NULL;
  }
  if (size % pagesize)
    return ret + (pagesize - size % pagesize);
  return ret;
}


x86 assembly (clang, -O0):
<tst_malloc_canary_right>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x10(%rbp)
mov    $0x0,%al
call   1070 <getpagesize@plt>
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rax
xor    %ecx,%ecx
mov    %ecx,%edx
divq   -0x18(%rbp)
mov    %rax,-0x30(%rbp)
mov    -0x10(%rbp),%rax
xor    %ecx,%ecx
mov    %ecx,%edx
divq   -0x18(%rbp)
mov    -0x30(%rbp),%rax
cmp    $0x0,%rdx
setne  %cl
xor    $0xff,%cl
xor    $0xff,%cl
and    $0x1,%cl
movzbl %cl,%ecx
movslq %ecx,%rcx
add    %rcx,%rax
add    $0x1,%rax
mov    %rax,-0x20(%rbp)
cmpq   $0x0,-0x10(%rbp)
jne    11c0 <tst_malloc_canary_right+0x70>
movq   $0x0,-0x8(%rbp)
jmp    12c6 <tst_malloc_canary_right+0x176>
mov    -0x20(%rbp),%rsi
imul   -0x18(%rbp),%rsi
mov    0x2e28(%rip),%rax
mov    (%rax),%edx
mov    0x2def(%rip),%rax
or     (%rax),%edx
mov    0x2df6(%rip),%rax
mov    (%rax),%ecx
mov    0x2dd5(%rip),%rax
or     (%rax),%ecx
xor    %eax,%eax
mov    %eax,%edi
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1030 <mmap@plt>
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
mov    0x2daa(%rip),%rcx
cmp    (%rcx),%rax
jne    1224 <tst_malloc_canary_right+0xd4>
movq   $0x0,-0x8(%rbp)
jmp    12c6 <tst_malloc_canary_right+0x176>
mov    -0x28(%rbp),%rdi
mov    -0x20(%rbp),%rax
sub    $0x1,%rax
imul   -0x18(%rbp),%rax
add    %rax,%rdi
mov    -0x18(%rbp),%rsi
mov    0x2da5(%rip),%rax
mov    (%rax),%edx
call   1050 <mprotect@plt>
cmp    $0x0,%rax
je     127f <tst_malloc_canary_right+0x12f>
lea    0xda5(%rip),%rdi
call   1060 <perror@plt>
mov    -0x28(%rbp),%rdi
mov    -0x20(%rbp),%rsi
imul   -0x18(%rbp),%rsi
call   1040 <munmap@plt>
movq   $0x0,-0x8(%rbp)
jmp    12c6 <tst_malloc_canary_right+0x176>
mov    -0x10(%rbp),%rax
xor    %ecx,%ecx
mov    %ecx,%edx
divq   -0x18(%rbp)
cmp    $0x0,%rdx
je     12be <tst_malloc_canary_right+0x16e>
mov    -0x28(%rbp),%rax
mov    %rax,-0x38(%rbp)
mov    -0x18(%rbp),%rcx
mov    -0x10(%rbp),%rax
xor    %edx,%edx
divq   -0x18(%rbp)
mov    -0x38(%rbp),%rax
sub    %rdx,%rcx
add    %rcx,%rax
mov    %rax,-0x8(%rbp)
jmp    12c6 <tst_malloc_canary_right+0x176>
mov    -0x28(%rbp),%rax
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<tst_malloc_canary_right>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    %rdi,%r12
xor    %eax,%eax
call   1070 <getpagesize@plt>
mov    %rax,%r15
mov    %r12,%rax
or     %r15,%rax
shr    $0x20,%rax
je     1184 <tst_malloc_canary_right+0x34>
mov    %r12,%rax
xor    %edx,%edx
div    %r15
mov    %rdx,%r14
mov    %rax,%rbx
jmp    1191 <tst_malloc_canary_right+0x41>
mov    %r12d,%eax
xor    %edx,%edx
div    %r15d
mov    %edx,%r14d
mov    %eax,%ebx
cmp    $0x1,%r14
sbb    $0xffffffffffffffff,%rbx
test   %r12,%r12
je     123c <tst_malloc_canary_right+0xec>
lea    0x1(%rbx),%r12
imul   %r15,%r12
mov    0x2e47(%rip),%rax
mov    0x2e10(%rip),%rcx
mov    (%rcx),%edx
or     (%rax),%edx
mov    0x2e15(%rip),%rax
mov    0x2df6(%rip),%rcx
mov    (%rcx),%ecx
or     (%rax),%ecx
xor    %ebp,%ebp
xor    %edi,%edi
mov    %r12,%rsi
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1030 <mmap@plt>
mov    %rax,%r13
mov    0x2dcb(%rip),%rax
cmp    (%rax),%r13
je     123e <tst_malloc_canary_right+0xee>
imul   %r15,%rbx
add    %r13,%rbx
mov    0x2de8(%rip),%rax
mov    (%rax),%edx
mov    %rbx,%rdi
mov    %r15,%rsi
call   1050 <mprotect@plt>
test   %rax,%rax
jne    1225 <tst_malloc_canary_right+0xd5>
mov    %r13,%rbp
test   %r14,%r14
je     123e <tst_malloc_canary_right+0xee>
sub    %r14,%r15
add    %r15,%r13
mov    %r13,%rbp
jmp    123e <tst_malloc_canary_right+0xee>
lea    0xdd4(%rip),%rdi
call   1060 <perror@plt>
mov    %r13,%rdi
mov    %r12,%rsi
call   1040 <munmap@plt>
xor    %ebp,%ebp
mov    %rbp,%rax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_ANONYMOUS = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_FAILED = global i8* null
@PROT_NONE = global i32 0
@.str = [9 x i8] c"mprotect\00"
define i8* @tst_malloc_canary_right(i64 %0) {
%2 = alloca i8*
%3 = alloca i64
%4 = alloca i64
%5 = alloca i64
%6 = alloca i8*
store i64 %0, i64* %3
%7 = call i64 (...) @getpagesize()
store i64 %7, i64* %4
%8 = load i64, i64* %3
%9 = load i64, i64* %4
%10 = udiv i64 %8, %9
%11 = load i64, i64* %3
%12 = load i64, i64* %4
%13 = urem i64 %11, %12
%14 = icmp ne i64 %13, 0
%15 = xor i1 %14, true
%16 = xor i1 %15, true
%17 = zext i1 %16 to i32
%18 = sext i32 %17 to i64
%19 = add i64 %10, %18
%20 = add i64 %19, 1
store i64 %20, i64* %5
%21 = load i64, i64* %3
%22 = icmp eq i64 %21, 0
br i1 %22, label %23, label %24
23: ; preds = %1
store i8* null, i8** %2
br label %72
24: ; preds = %1
%25 = load i64, i64* %5
%26 = load i64, i64* %4
%27 = mul i64 %25, %26
%28 = load i32, i32* @PROT_READ
%29 = load i32, i32* @PROT_WRITE
%30 = or i32 %28, %29
%31 = load i32, i32* @MAP_ANONYMOUS
%32 = load i32, i32* @MAP_PRIVATE
%33 = or i32 %31, %32
%34 = call i8* @mmap(i32* null, i64 %27, i32 %30, i32 %33, i32 -1, i32 0)
store i8* %34, i8** %6
%35 = load i8*, i8** %6
%36 = load i8*, i8** @MAP_FAILED
%37 = icmp eq i8* %35, %36
br i1 %37, label %38, label %39
38: ; preds = %24
store i8* null, i8** %2
br label %72
39: ; preds = %24
%40 = load i8*, i8** %6
%41 = load i64, i64* %5
%42 = sub i64 %41, 1
%43 = load i64, i64* %4
%44 = mul i64 %42, %43
%45 = getelementptr i8, i8* %40, i64 %44
%46 = load i64, i64* %4
%47 = load i32, i32* @PROT_NONE
%48 = call i64 @mprotect(i8* %45, i64 %46, i32 %47)
%49 = icmp ne i64 %48, 0
br i1 %49, label %50, label %57
50: ; preds = %39
%51 = call i32 @perror(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str, i64 0, i64 0))
%52 = load i8*, i8** %6
%53 = load i64, i64* %5
%54 = load i64, i64* %4
%55 = mul i64 %53, %54
%56 = call i32 @munmap(i8* %52, i64 %55)
store i8* null, i8** %2
br label %72
57: ; preds = %39
%58 = load i64, i64* %3
%59 = load i64, i64* %4
%60 = urem i64 %58, %59
%61 = icmp ne i64 %60, 0
br i1 %61, label %62, label %70
62: ; preds = %57
%63 = load i8*, i8** %6
%64 = load i64, i64* %4
%65 = load i64, i64* %3
%66 = load i64, i64* %4
%67 = urem i64 %65, %66
%68 = sub i64 %64, %67
%69 = getelementptr i8, i8* %63, i64 %68
store i8* %69, i8** %2
br label %72
70: ; preds = %57
%71 = load i8*, i8** %6
store i8* %71, i8** %2
br label %72
72: ; preds = %70, %62, %50, %38, %23
%73 = load i8*, i8** %2
ret i8* %73
}

LLVM IR (-O2):
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_ANONYMOUS = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_FAILED = global i8* null
@PROT_NONE = global i32 0
@.str = [9 x i8] c"mprotect\00"
define i8* @tst_malloc_canary_right(i64 %0) {
%2 = tail call i64 (...) @getpagesize()
%3 = udiv i64 %0, %2
%4 = urem i64 %0, %2
%5 = icmp ne i64 %4, 0
%6 = zext i1 %5 to i64
%7 = add i64 %3, %6
%8 = icmp eq i64 %0, 0
br i1 %8, label %34, label %9
9: ; preds = %1
%10 = add i64 %7, 1
%11 = mul i64 %10, %2
%12 = load i32, i32* @PROT_READ
%13 = load i32, i32* @PROT_WRITE
%14 = or i32 %13, %12
%15 = load i32, i32* @MAP_ANONYMOUS
%16 = load i32, i32* @MAP_PRIVATE
%17 = or i32 %16, %15
%18 = tail call i8* @mmap(i32* null, i64 %11, i32 %14, i32 %17, i32 -1, i32 0)
%19 = load i8*, i8** @MAP_FAILED
%20 = icmp eq i8* %18, %19
br i1 %20, label %34, label %21
21: ; preds = %9
%22 = mul i64 %7, %2
%23 = getelementptr i8, i8* %18, i64 %22
%24 = load i32, i32* @PROT_NONE
%25 = tail call i64 @mprotect(i8* %23, i64 %2, i32 %24)
%26 = icmp eq i64 %25, 0
br i1 %26, label %30, label %27
27: ; preds = %21
%28 = tail call i32 @perror(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str, i64 0, i64 0))
%29 = tail call i32 @munmap(i8* %18, i64 %11)
br label %34
30: ; preds = %21
br i1 %5, label %31, label %34
31: ; preds = %30
%32 = sub i64 %2, %4
%33 = getelementptr i8, i8* %18, i64 %32
br label %34
34: ; preds = %30, %9, %1, %31, %27
%35 = phi i8* [ null, %27 ], [ %33, %31 ], [ null, %1 ], [ null, %9 ], [ %18, %30 ]
ret i8* %35
}