#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
char *calloc(int, size_t);
int /*<<< orphan*/ free(char *);
int /*<<< orphan*/ log_error(char *);
int /*<<< orphan*/ log_print(char *);
size_t strlcat(char *, char const *, size_t);
int /*<<< orphan*/ strlcpy(char *, char *, size_t);
int /*<<< orphan*/ strlen(char const *);
char *strstr(char *, char const *);
int expand_string(char *label, size_t len, const char *srch, const char *repl) {
  char *tmp;
  char *p, *q;
  if ((tmp = calloc(1, len)) == NULL) {
    log_error("expand_string: calloc");
    return (-1);
  }
  p = q = label;
  while ((q = strstr(p, srch)) != NULL) {
    *q = '\0';
    if ((strlcat(tmp, p, len) >= len) || (strlcat(tmp, repl, len) >= len)) {
      log_print("expand_string: string too long");
      return (-1);
    }
    q += strlen(srch);
    p = q;
  }
  if (strlcat(tmp, p, len) >= len) {
    log_print("expand_string: string too long");
    return (-1);
  }
  strlcpy(label, tmp, len);
  free(tmp);
  return (0);
}


x86 assembly (clang, -O0):
<expand_string>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
mov    -0x18(%rbp),%rsi
mov    $0x1,%edi
call   1080 <calloc@plt>
mov    %rax,-0x30(%rbp)
cmp    $0x0,%rax
jne    11cc <expand_string+0x4c>
lea    0xe45(%rip),%rdi
call   1050 <log_error@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    12c2 <expand_string+0x142>
mov    -0x10(%rbp),%rax
mov    %rax,-0x40(%rbp)
mov    %rax,-0x38(%rbp)
mov    -0x38(%rbp),%rdi
mov    -0x20(%rbp),%rsi
call   10a0 <strstr@plt>
mov    %rax,-0x40(%rbp)
cmp    $0x0,%rax
je     126e <expand_string+0xee>
mov    -0x40(%rbp),%rax
movb   $0x0,(%rax)
mov    -0x30(%rbp),%rdi
mov    -0x38(%rbp),%rsi
mov    -0x18(%rbp),%rdx
call   1040 <strlcat@plt>
cmp    -0x18(%rbp),%rax
jae    1230 <expand_string+0xb0>
mov    -0x30(%rbp),%rdi
mov    -0x28(%rbp),%rsi
mov    -0x18(%rbp),%rdx
call   1040 <strlcat@plt>
cmp    -0x18(%rbp),%rax
jb     1248 <expand_string+0xc8>
lea    0xddf(%rip),%rdi
call   1070 <log_print@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    12c2 <expand_string+0x142>
mov    -0x20(%rbp),%rdi
call   1060 <strlen@plt>
mov    %eax,%ecx
mov    -0x40(%rbp),%rax
movslq %ecx,%rcx
add    %rcx,%rax
mov    %rax,-0x40(%rbp)
mov    -0x40(%rbp),%rax
mov    %rax,-0x38(%rbp)
jmp    11d8 <expand_string+0x58>
mov    -0x30(%rbp),%rdi
mov    -0x38(%rbp),%rsi
mov    -0x18(%rbp),%rdx
call   1040 <strlcat@plt>
cmp    -0x18(%rbp),%rax
jb     12a1 <expand_string+0x121>
lea    0xd86(%rip),%rdi
call   1070 <log_print@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    12c2 <expand_string+0x142>
mov    -0x10(%rbp),%rdi
mov    -0x30(%rbp),%rsi
mov    -0x18(%rbp),%rdx
call   1090 <strlcpy@plt>
mov    -0x30(%rbp),%rdi
call   1030 <free@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<expand_string>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    %rcx,%r12
mov    %rdx,%r13
mov    %rsi,%rbx
mov    %rdi,%rbp
mov    $0x1,%edi
call   1080 <calloc@plt>
test   %rax,%rax
je     1259 <expand_string+0xd9>
mov    %rax,%r15
mov    %rbp,%rdi
mov    %r13,%rsi
call   10a0 <strstr@plt>
mov    %rbp,(%rsp)
test   %rax,%rax
je     121d <expand_string+0x9d>
mov    %rax,%r14
mov    (%rsp),%rbp
nopl   0x0(%rax,%rax,1)
movb   $0x0,(%r14)
mov    %r15,%rdi
mov    %rbp,%rsi
mov    %rbx,%rdx
call   1040 <strlcat@plt>
cmp    %rbx,%rax
jae    124b <expand_string+0xcb>
mov    %r15,%rdi
mov    %r12,%rsi
mov    %rbx,%rdx
call   1040 <strlcat@plt>
cmp    %rbx,%rax
jae    124b <expand_string+0xcb>
mov    %r13,%rdi
call   1060 <strlen@plt>
cltq
mov    %r14,%rbp
add    %rax,%rbp
mov    %rbp,%rdi
mov    %r13,%rsi
call   10a0 <strstr@plt>
mov    %rax,%r14
test   %rax,%rax
jne    11d0 <expand_string+0x50>
mov    %r15,%rdi
mov    %rbp,%rsi
mov    %rbx,%rdx
call   1040 <strlcat@plt>
cmp    %rbx,%rax
jae    124b <expand_string+0xcb>
mov    (%rsp),%rdi
mov    %r15,%rsi
mov    %rbx,%rdx
call   1090 <strlcpy@plt>
mov    %r15,%rdi
call   1030 <free@plt>
xor    %eax,%eax
jmp    126a <expand_string+0xea>
lea    0xdc4(%rip),%rdi
call   1070 <log_print@plt>
jmp    1265 <expand_string+0xe5>
lea    0xda0(%rip),%rdi
call   1050 <log_error@plt>
mov    $0xffffffff,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [22 x i8] c"expand_string: calloc\00"
@.str.1 = [31 x i8] c"expand_string: string too long\00"
define i32 @expand_string(i8* %0, i64 %1, i8* %2, i8* %3) {
%5 = alloca i32
%6 = alloca i8*
%7 = alloca i64
%8 = alloca i8*
%9 = alloca i8*
%10 = alloca i8*
%11 = alloca i8*
%12 = alloca i8*
store i8* %0, i8** %6
store i64 %1, i64* %7
store i8* %2, i8** %8
store i8* %3, i8** %9
%13 = load i64, i64* %7
%14 = call i8* @calloc(i32 1, i64 %13)
store i8* %14, i8** %10
%15 = icmp eq i8* %14, null
br i1 %15, label %16, label %18
16: ; preds = %4
%17 = call i32 @log_error(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
store i32 -1, i32* %5
br label %65
18: ; preds = %4
%19 = load i8*, i8** %6
store i8* %19, i8** %12
store i8* %19, i8** %11
br label %20
20: ; preds = %42, %18
%21 = load i8*, i8** %11
%22 = load i8*, i8** %8
%23 = call i8* @strstr(i8* %21, i8* %22)
store i8* %23, i8** %12
%24 = icmp ne i8* %23, null
br i1 %24, label %25, label %49
25: ; preds = %20
%26 = load i8*, i8** %12
store i8 0, i8* %26
%27 = load i8*, i8** %10
%28 = load i8*, i8** %11
%29 = load i64, i64* %7
%30 = call i64 @strlcat(i8* %27, i8* %28, i64 %29)
%31 = load i64, i64* %7
%32 = icmp uge i64 %30, %31
br i1 %32, label %40, label %33
33: ; preds = %25
%34 = load i8*, i8** %10
%35 = load i8*, i8** %9
%36 = load i64, i64* %7
%37 = call i64 @strlcat(i8* %34, i8* %35, i64 %36)
%38 = load i64, i64* %7
%39 = icmp uge i64 %37, %38
br i1 %39, label %40, label %42
40: ; preds = %33, %25
%41 = call i32 @log_print(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.1, i64 0, i64 0))
store i32 -1, i32* %5
br label %65
42: ; preds = %33
%43 = load i8*, i8** %8
%44 = call i32 @strlen(i8* %43)
%45 = load i8*, i8** %12
%46 = sext i32 %44 to i64
%47 = getelementptr inbounds i8, i8* %45, i64 %46
store i8* %47, i8** %12
%48 = load i8*, i8** %12
store i8* %48, i8** %11
br label %20
49: ; preds = %20
%50 = load i8*, i8** %10
%51 = load i8*, i8** %11
%52 = load i64, i64* %7
%53 = call i64 @strlcat(i8* %50, i8* %51, i64 %52)
%54 = load i64, i64* %7
%55 = icmp uge i64 %53, %54
br i1 %55, label %56, label %58
56: ; preds = %49
%57 = call i32 @log_print(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.1, i64 0, i64 0))
store i32 -1, i32* %5
br label %65
58: ; preds = %49
%59 = load i8*, i8** %6
%60 = load i8*, i8** %10
%61 = load i64, i64* %7
%62 = call i32 @strlcpy(i8* %59, i8* %60, i64 %61)
%63 = load i8*, i8** %10
%64 = call i32 @free(i8* %63)
store i32 0, i32* %5
br label %65
65: ; preds = %58, %56, %40, %16
%66 = load i32, i32* %5
ret i32 %66
}

LLVM IR (-O2):
@.str = [22 x i8] c"expand_string: calloc\00"
@.str.1 = [31 x i8] c"expand_string: string too long\00"
define i32 @expand_string(i8* %0, i64 %1, i8* %2, i8* %3) {
%5 = tail call i8* @calloc(i32 1, i64 %1)
%6 = icmp eq i8* %5, null
br i1 %6, label %10, label %7
7: ; preds = %4
%8 = tail call i8* @strstr(i8* dereferenceable(1) %0, i8* dereferenceable(1) %2)
%9 = icmp eq i8* %8, null
br i1 %9, label %28, label %12
10: ; preds = %4
%11 = tail call i32 @log_error(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
br label %37
12: ; preds = %7, %22
%13 = phi i8* [ %26, %22 ], [ %8, %7 ]
%14 = phi i8* [ %25, %22 ], [ %0, %7 ]
store i8 0, i8* %13
%15 = tail call i64 @strlcat(i8* %5, i8* %14, i64 %1)
%16 = icmp ult i64 %15, %1
br i1 %16, label %17, label %20
17: ; preds = %12
%18 = tail call i64 @strlcat(i8* %5, i8* %3, i64 %1)
%19 = icmp ult i64 %18, %1
br i1 %19, label %22, label %20
20: ; preds = %17, %12
%21 = tail call i32 @log_print(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.1, i64 0, i64 0))
br label %37
22: ; preds = %17
%23 = tail call i32 @strlen(i8* %2)
%24 = sext i32 %23 to i64
%25 = getelementptr inbounds i8, i8* %13, i64 %24
%26 = tail call i8* @strstr(i8* dereferenceable(1) %25, i8* dereferenceable(1) %2)
%27 = icmp eq i8* %26, null
br i1 %27, label %28, label %12
28: ; preds = %22, %7
%29 = phi i8* [ %0, %7 ], [ %25, %22 ]
%30 = tail call i64 @strlcat(i8* %5, i8* %29, i64 %1)
%31 = icmp ult i64 %30, %1
br i1 %31, label %34, label %32
32: ; preds = %28
%33 = tail call i32 @log_print(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.1, i64 0, i64 0))
br label %37
34: ; preds = %28
%35 = tail call i32 @strlcpy(i8* %0, i8* %5, i64 %1)
%36 = tail call i32 @free(i8* %5)
br label %37
37: ; preds = %34, %32, %20, %10
%38 = phi i32 [ -1, %10 ], [ -1, %20 ], [ -1, %32 ], [ 0, %34 ]
ret i32 %38
}