#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ TIOCGPTN;
scalar_t__ ioctl(uintptr_t, int /*<<< orphan*/, int *);
uintptr_t open(char *, uintptr_t, int /*<<< orphan*/);
int /*<<< orphan*/ sprintf(char *, char *, int);
uintptr_t syz_open_pts(uintptr_t a0, uintptr_t a1) {
  int ptyno = 0;
  if (ioctl(a0, TIOCGPTN, &ptyno))
    return -1;
  char buf[128];
  sprintf(buf, "/dev/pts/%d", ptyno);
  return open(buf, a1, 0);
}


x86 assembly (clang, -O0):
<syz_open_pts>:
push   %rbp
mov    %rsp,%rbp
sub    $0xa0,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
movl   $0x0,-0x1c(%rbp)
mov    -0x10(%rbp),%rdi
mov    0x2e93(%rip),%rax
mov    (%rax),%esi
lea    -0x1c(%rbp),%rdx
call   1030 <ioctl@plt>
cmp    $0x0,%rax
je     1177 <syz_open_pts+0x47>
movq   $0xffffffffffffffff,-0x8(%rbp)
ff
jmp    11a3 <syz_open_pts+0x73>
lea    -0xa0(%rbp),%rdi
mov    -0x1c(%rbp),%edx
lea    0xe78(%rip),%rsi
call   1050 <sprintf@plt>
lea    -0xa0(%rbp),%rdi
mov    -0x18(%rbp),%rsi
xor    %edx,%edx
call   1040 <open@plt>
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0xa0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<syz_open_pts>:
push   %r14
push   %rbx
sub    $0x98,%rsp
mov    %rsi,%rbx
movl   $0x0,0xc(%rsp)
mov    0x2e9c(%rip),%rax
mov    (%rax),%esi
lea    0xc(%rsp),%rdx
call   1030 <ioctl@plt>
mov    %rax,%rcx
mov    $0xffffffffffffffff,%rax
test   %rcx,%rcx
jne    118c <syz_open_pts+0x5c>
mov    0xc(%rsp),%edx
lea    0xe8e(%rip),%rsi
lea    0x10(%rsp),%r14
mov    %r14,%rdi
call   1050 <sprintf@plt>
mov    %r14,%rdi
mov    %rbx,%rsi
xor    %edx,%edx
call   1040 <open@plt>
add    $0x98,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
@TIOCGPTN = global i32 0
@.str = [12 x i8] c"/dev/pts/%d\00"
define i64 @syz_open_pts(i64 %0, i64 %1) {
%3 = alloca i64
%4 = alloca i64
%5 = alloca i64
%6 = alloca i32
%7 = alloca [128 x i8]
store i64 %0, i64* %4
store i64 %1, i64* %5
store i32 0, i32* %6
%8 = load i64, i64* %4
%9 = load i32, i32* @TIOCGPTN
%10 = call i64 @ioctl(i64 %8, i32 %9, i32* %6)
%11 = icmp ne i64 %10, 0
br i1 %11, label %12, label %13
12: ; preds = %2
store i64 -1, i64* %3
br label %20
13: ; preds = %2
%14 = getelementptr inbounds [128 x i8], [128 x i8]* %7, i64 0, i64 0
%15 = load i32, i32* %6
%16 = call i32 @sprintf(i8* %14, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str, i64 0, i64 0), i32 %15)
%17 = getelementptr inbounds [128 x i8], [128 x i8]* %7, i64 0, i64 0
%18 = load i64, i64* %5
%19 = call i64 @open(i8* %17, i64 %18, i32 0)
store i64 %19, i64* %3
br label %20
20: ; preds = %13, %12
%21 = load i64, i64* %3
ret i64 %21
}

LLVM IR (-O2):
@TIOCGPTN = global i32 0
@.str = [12 x i8] c"/dev/pts/%d\00"
define i64 @syz_open_pts(i64 %0, i64 %1) {
%3 = alloca i32
%4 = alloca [128 x i8]
%5 = bitcast i32* %3 to i8*
store i32 0, i32* %3
%6 = load i32, i32* @TIOCGPTN
%7 = call i64 @ioctl(i64 %0, i32 %6, i32* %3)
%8 = icmp eq i64 %7, 0
br i1 %8, label %9, label %14
9: ; preds = %2
%10 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 0
%11 = load i32, i32* %3
%12 = call i32 @sprintf(i8* %10, i8* dereferenceable(1) getelementptr inbounds ([12 x i8], [12 x i8]* @.str, i64 0, i64 0), i32 %11)
%13 = call i64 @open(i8* %10, i64 %1, i32 0)
br label %14
14: ; preds = %2, %9
%15 = phi i64 [ %13, %9 ], [ -1, %2 ]
ret i64 %15
}