#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
char *malloc(int /*<<< orphan*/);
char *memchr(char *, char, unsigned int);
int /*<<< orphan*/ memset(char *, int /*<<< orphan*/, int /*<<< orphan*/);
int /*<<< orphan*/ sink(char *);
int /*<<< orphan*/ unsigned_range(int, int);
void warn_memchr_var_memset_range(const void *s, unsigned n) {
  char *p0 = malloc(unsigned_range((5), (7)));
  sink(p0);
  char *p1 = memchr(p0, '1', n);
  memset(p1, 0, unsigned_range((8), (9)));
  sink(p0);
  p1 = memchr(p0 + 1, '2', n);
  memset(p1, 0, unsigned_range((7), (9)));
  sink(p0);
  char *p2 = memchr(p1 + 1, '3', n);
  memset(p2, 0, unsigned_range((6), (9)));
}


x86 assembly (clang, -O0):
<warn_memchr_var_memset_range>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x8(%rbp)
mov    %esi,-0xc(%rbp)
mov    $0x5,%edi
mov    $0x7,%esi
call   1070 <unsigned_range@plt>
mov    %eax,%edi
call   1060 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rdi
call   1050 <sink@plt>
mov    -0x18(%rbp),%rdi
mov    -0xc(%rbp),%edx
mov    $0x31,%esi
call   1040 <memchr@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rax
mov    %rax,-0x40(%rbp)
mov    $0x8,%edi
mov    $0x9,%esi
call   1070 <unsigned_range@plt>
mov    -0x40(%rbp),%rdi
mov    %eax,%edx
xor    %esi,%esi
call   1030 <memset@plt>
mov    -0x18(%rbp),%rdi
call   1050 <sink@plt>
mov    -0x18(%rbp),%rdi
add    $0x1,%rdi
mov    -0xc(%rbp),%edx
mov    $0x32,%esi
call   1040 <memchr@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rax
mov    %rax,-0x38(%rbp)
mov    $0x7,%edi
mov    $0x9,%esi
call   1070 <unsigned_range@plt>
mov    -0x38(%rbp),%rdi
mov    %eax,%edx
xor    %esi,%esi
call   1030 <memset@plt>
mov    -0x18(%rbp),%rdi
call   1050 <sink@plt>
mov    -0x20(%rbp),%rdi
add    $0x1,%rdi
mov    -0xc(%rbp),%edx
mov    $0x33,%esi
call   1040 <memchr@plt>
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
mov    %rax,-0x30(%rbp)
mov    $0x6,%edi
mov    $0x9,%esi
call   1070 <unsigned_range@plt>
mov    -0x30(%rbp),%rdi
mov    %eax,%edx
xor    %esi,%esi
call   1030 <memset@plt>
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<warn_memchr_var_memset_range>:
push   %rbp
push   %r14
push   %rbx
mov    %esi,%r14d
mov    $0x5,%edi
mov    $0x7,%esi
call   1070 <unsigned_range@plt>
mov    %eax,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    %rax,%rdi
call   1050 <sink@plt>
mov    %rbx,%rdi
mov    $0x31,%esi
mov    %r14d,%edx
call   1040 <memchr@plt>
mov    %rax,%rbp
mov    $0x8,%edi
mov    $0x9,%esi
call   1070 <unsigned_range@plt>
mov    %rbp,%rdi
xor    %esi,%esi
mov    %eax,%edx
call   1030 <memset@plt>
mov    %rbx,%rdi
call   1050 <sink@plt>
lea    0x1(%rbx),%rdi
mov    $0x32,%esi
mov    %r14d,%edx
call   1040 <memchr@plt>
mov    %rax,%rbp
mov    $0x7,%edi
mov    $0x9,%esi
call   1070 <unsigned_range@plt>
mov    %rbp,%rdi
xor    %esi,%esi
mov    %eax,%edx
call   1030 <memset@plt>
mov    %rbx,%rdi
call   1050 <sink@plt>
add    $0x1,%rbp
mov    %rbp,%rdi
mov    $0x33,%esi
mov    %r14d,%edx
call   1040 <memchr@plt>
mov    %rax,%rbx
mov    $0x6,%edi
mov    $0x9,%esi
call   1070 <unsigned_range@plt>
mov    %rbx,%rdi
xor    %esi,%esi
mov    %eax,%edx
pop    %rbx
pop    %r14
pop    %rbp
jmp    1030 <memset@plt>

LLVM IR (-O0):
define void @warn_memchr_var_memset_range(i8* %0, i32 %1) {
%3 = alloca i8*
%4 = alloca i32
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca i8*
store i8* %0, i8** %3
store i32 %1, i32* %4
%8 = call i32 @unsigned_range(i32 5, i32 7)
%9 = call i8* @malloc(i32 %8)
store i8* %9, i8** %5
%10 = load i8*, i8** %5
%11 = call i32 @sink(i8* %10)
%12 = load i8*, i8** %5
%13 = load i32, i32* %4
%14 = call i8* @memchr(i8* %12, i8 signext 49, i32 %13)
store i8* %14, i8** %6
%15 = load i8*, i8** %6
%16 = call i32 @unsigned_range(i32 8, i32 9)
%17 = call i32 @memset(i8* %15, i32 0, i32 %16)
%18 = load i8*, i8** %5
%19 = call i32 @sink(i8* %18)
%20 = load i8*, i8** %5
%21 = getelementptr inbounds i8, i8* %20, i64 1
%22 = load i32, i32* %4
%23 = call i8* @memchr(i8* %21, i8 signext 50, i32 %22)
store i8* %23, i8** %6
%24 = load i8*, i8** %6
%25 = call i32 @unsigned_range(i32 7, i32 9)
%26 = call i32 @memset(i8* %24, i32 0, i32 %25)
%27 = load i8*, i8** %5
%28 = call i32 @sink(i8* %27)
%29 = load i8*, i8** %6
%30 = getelementptr inbounds i8, i8* %29, i64 1
%31 = load i32, i32* %4
%32 = call i8* @memchr(i8* %30, i8 signext 51, i32 %31)
store i8* %32, i8** %7
%33 = load i8*, i8** %7
%34 = call i32 @unsigned_range(i32 6, i32 9)
%35 = call i32 @memset(i8* %33, i32 0, i32 %34)
ret void
}

LLVM IR (-O2):
define void @warn_memchr_var_memset_range(i8* nocapture readnone %0, i32 %1) {
%3 = tail call i32 @unsigned_range(i32 5, i32 7)
%4 = tail call i8* @malloc(i32 %3)
%5 = tail call i32 @sink(i8* %4)
%6 = tail call i8* @memchr(i8* %4, i8 signext 49, i32 %1)
%7 = tail call i32 @unsigned_range(i32 8, i32 9)
%8 = tail call i32 @memset(i8* %6, i32 0, i32 %7)
%9 = tail call i32 @sink(i8* %4)
%10 = getelementptr inbounds i8, i8* %4, i64 1
%11 = tail call i8* @memchr(i8* %10, i8 signext 50, i32 %1)
%12 = tail call i32 @unsigned_range(i32 7, i32 9)
%13 = tail call i32 @memset(i8* %11, i32 0, i32 %12)
%14 = tail call i32 @sink(i8* %4)
%15 = getelementptr inbounds i8, i8* %11, i64 1
%16 = tail call i8* @memchr(i8* %15, i8 signext 51, i32 %1)
%17 = tail call i32 @unsigned_range(i32 6, i32 9)
%18 = tail call i32 @memset(i8* %16, i32 0, i32 %17)
ret void
}