#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ free(char *);
scalar_t__ malloc(int);
void overflow(void) {
  char *ptr;
  int i;
  ptr = (char *)malloc(3);
  for (i = 0; i < 8; i++) {
    ptr[i] = 'a';
  }
  free(ptr);
  ptr = (char *)malloc(3);
  for (i = 0; i < 9; i++) {
    ptr[i] = 'b';
  }
  free(ptr);
  ptr = (char *)malloc(24);
  for (i = 0; i < 40; i++) {
    ptr[i] = 'a';
  }
  free(ptr);
  ptr = (char *)malloc(24);
  for (i = 0; i > -8; i--) {
    ptr[i] = 'd';
  }
  free(ptr);
  return;
}


x86 assembly (clang, -O0):
<overflow>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
mov    $0x3,%edi
call   1040 <malloc@plt>
mov    %rax,-0x8(%rbp)
movl   $0x0,-0xc(%rbp)
cmpl   $0x8,-0xc(%rbp)
jge    1161 <overflow+0x41>
mov    -0x8(%rbp),%rax
movslq -0xc(%rbp),%rcx
movb   $0x61,(%rax,%rcx,1)
mov    -0xc(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0xc(%rbp)
jmp    113d <overflow+0x1d>
mov    -0x8(%rbp),%rdi
call   1030 <free@plt>
mov    $0x3,%edi
call   1040 <malloc@plt>
mov    %rax,-0x8(%rbp)
movl   $0x0,-0xc(%rbp)
cmpl   $0x9,-0xc(%rbp)
jge    11a3 <overflow+0x83>
mov    -0x8(%rbp),%rax
movslq -0xc(%rbp),%rcx
movb   $0x62,(%rax,%rcx,1)
mov    -0xc(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0xc(%rbp)
jmp    117f <overflow+0x5f>
mov    -0x8(%rbp),%rdi
call   1030 <free@plt>
mov    $0x18,%edi
call   1040 <malloc@plt>
mov    %rax,-0x8(%rbp)
movl   $0x0,-0xc(%rbp)
cmpl   $0x28,-0xc(%rbp)
jge    11e5 <overflow+0xc5>
mov    -0x8(%rbp),%rax
movslq -0xc(%rbp),%rcx
movb   $0x61,(%rax,%rcx,1)
mov    -0xc(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0xc(%rbp)
jmp    11c1 <overflow+0xa1>
mov    -0x8(%rbp),%rdi
call   1030 <free@plt>
mov    $0x18,%edi
call   1040 <malloc@plt>
mov    %rax,-0x8(%rbp)
movl   $0x0,-0xc(%rbp)
cmpl   $0xfffffff8,-0xc(%rbp)
jle    1227 <overflow+0x107>
mov    -0x8(%rbp),%rax
movslq -0xc(%rbp),%rcx
movb   $0x64,(%rax,%rcx,1)
mov    -0xc(%rbp),%eax
add    $0xffffffff,%eax
mov    %eax,-0xc(%rbp)
jmp    1203 <overflow+0xe3>
mov    -0x8(%rbp),%rdi
call   1030 <free@plt>
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<overflow>:
push   %rbx
mov    $0x3,%edi
call   1040 <malloc@plt>
movabs $0x6161616161616161,%rbx
61 61 61
mov    %rbx,(%rax)
mov    %rax,%rdi
call   1030 <free@plt>
mov    $0x3,%edi
call   1040 <malloc@plt>
movabs $0x6262626262626262,%rcx
62 62 62
mov    %rcx,(%rax)
movb   $0x62,0x8(%rax)
mov    %rax,%rdi
call   1030 <free@plt>
mov    $0x18,%edi
call   1040 <malloc@plt>
movaps 0xe8c(%rip),%xmm0
movups %xmm0,(%rax)
movups %xmm0,0x10(%rax)
mov    %rbx,0x20(%rax)
mov    %rax,%rdi
call   1030 <free@plt>
mov    $0x18,%edi
call   1040 <malloc@plt>
movabs $0x6464646464646464,%rcx
64 64 64
mov    %rcx,-0x7(%rax)
mov    %rax,%rdi
pop    %rbx
jmp    1030 <free@plt>

LLVM IR (-O0):
define void @overflow() {
%1 = alloca i8*
%2 = alloca i32
%3 = call i64 @malloc(i32 3)
%4 = inttoptr i64 %3 to i8*
store i8* %4, i8** %1
store i32 0, i32* %2
br label %5
5: ; preds = %13, %0
%6 = load i32, i32* %2
%7 = icmp slt i32 %6, 8
br i1 %7, label %8, label %16
8: ; preds = %5
%9 = load i8*, i8** %1
%10 = load i32, i32* %2
%11 = sext i32 %10 to i64
%12 = getelementptr inbounds i8, i8* %9, i64 %11
store i8 97, i8* %12
br label %13
13: ; preds = %8
%14 = load i32, i32* %2
%15 = add nsw i32 %14, 1
store i32 %15, i32* %2
br label %5
16: ; preds = %5
%17 = load i8*, i8** %1
%18 = call i32 @free(i8* %17)
%19 = call i64 @malloc(i32 3)
%20 = inttoptr i64 %19 to i8*
store i8* %20, i8** %1
store i32 0, i32* %2
br label %21
21: ; preds = %29, %16
%22 = load i32, i32* %2
%23 = icmp slt i32 %22, 9
br i1 %23, label %24, label %32
24: ; preds = %21
%25 = load i8*, i8** %1
%26 = load i32, i32* %2
%27 = sext i32 %26 to i64
%28 = getelementptr inbounds i8, i8* %25, i64 %27
store i8 98, i8* %28
br label %29
29: ; preds = %24
%30 = load i32, i32* %2
%31 = add nsw i32 %30, 1
store i32 %31, i32* %2
br label %21
32: ; preds = %21
%33 = load i8*, i8** %1
%34 = call i32 @free(i8* %33)
%35 = call i64 @malloc(i32 24)
%36 = inttoptr i64 %35 to i8*
store i8* %36, i8** %1
store i32 0, i32* %2
br label %37
37: ; preds = %45, %32
%38 = load i32, i32* %2
%39 = icmp slt i32 %38, 40
br i1 %39, label %40, label %48
40: ; preds = %37
%41 = load i8*, i8** %1
%42 = load i32, i32* %2
%43 = sext i32 %42 to i64
%44 = getelementptr inbounds i8, i8* %41, i64 %43
store i8 97, i8* %44
br label %45
45: ; preds = %40
%46 = load i32, i32* %2
%47 = add nsw i32 %46, 1
store i32 %47, i32* %2
br label %37
48: ; preds = %37
%49 = load i8*, i8** %1
%50 = call i32 @free(i8* %49)
%51 = call i64 @malloc(i32 24)
%52 = inttoptr i64 %51 to i8*
store i8* %52, i8** %1
store i32 0, i32* %2
br label %53
53: ; preds = %61, %48
%54 = load i32, i32* %2
%55 = icmp sgt i32 %54, -8
br i1 %55, label %56, label %64
56: ; preds = %53
%57 = load i8*, i8** %1
%58 = load i32, i32* %2
%59 = sext i32 %58 to i64
%60 = getelementptr inbounds i8, i8* %57, i64 %59
store i8 100, i8* %60
br label %61
61: ; preds = %56
%62 = load i32, i32* %2
%63 = add nsw i32 %62, -1
store i32 %63, i32* %2
br label %53
64: ; preds = %53
%65 = load i8*, i8** %1
%66 = call i32 @free(i8* %65)
ret void
}

LLVM IR (-O2):
define void @overflow() {
%1 = tail call i64 @malloc(i32 3)
%2 = inttoptr i64 %1 to i8*
%3 = inttoptr i64 %1 to i64*
store i64 7016996765293437281, i64* %3
%4 = tail call i32 @free(i8* %2)
%5 = tail call i64 @malloc(i32 3)
%6 = inttoptr i64 %5 to i8*
%7 = tail call i32 @free(i8* %6)
%8 = tail call i64 @malloc(i32 24)
%9 = inttoptr i64 %8 to i8*
%10 = tail call i32 @free(i8* %9)
%11 = tail call i64 @malloc(i32 24)
%12 = inttoptr i64 %11 to i8*
%13 = getelementptr i8, i8* %12, i64 -7
%14 = bitcast i8* %13 to i64*
store i64 7234017283807667300, i64* %14
%15 = tail call i32 @free(i8* %12)
ret void
}