#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ clang_analyzer_eval(int);
int strlen(char *);
int /*<<< orphan*/ strncat(char *, char *, unsigned int);
void strncat_symbolic_limit(unsigned limit) {
  char dst[6] = "1234";
  char src[] = "567";
  strncat(dst, src, limit);
  clang_analyzer_eval(strlen(dst) >= 4);
  clang_analyzer_eval(strlen(dst) == 4);
}


x86 assembly (clang, -O0):
<strncat_symbolic_limit>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
mov    %edi,-0x4(%rbp)
mov    0xebf(%rip),%eax
mov    %eax,-0xa(%rbp)
mov    0xeb9(%rip),%ax
mov    %ax,-0x6(%rbp)
mov    0xeb1(%rip),%eax
mov    %eax,-0xe(%rbp)
lea    -0xa(%rbp),%rdi
lea    -0xe(%rbp),%rsi
mov    -0x4(%rbp),%edx
call   1040 <strncat@plt>
lea    -0xa(%rbp),%rdi
call   1030 <strlen@plt>
cmp    $0x4,%eax
setge  %al
and    $0x1,%al
movzbl %al,%edi
call   1050 <clang_analyzer_eval@plt>
lea    -0xa(%rbp),%rdi
call   1030 <strlen@plt>
cmp    $0x4,%eax
sete   %al
and    $0x1,%al
movzbl %al,%edi
call   1050 <clang_analyzer_eval@plt>
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<strncat_symbolic_limit>:
push   %rbx
sub    $0x10,%rsp
mov    %edi,%edx
movw   $0x0,0xc(%rsp)
movl   $0x34333231,0x8(%rsp)
34
movl   $0x373635,0x4(%rsp)
lea    0x8(%rsp),%rbx
lea    0x4(%rsp),%rsi
mov    %rbx,%rdi
call   1040 <strncat@plt>
mov    %rbx,%rdi
call   1030 <strlen@plt>
xor    %edi,%edi
cmp    $0x4,%eax
setge  %dil
call   1050 <clang_analyzer_eval@plt>
mov    %rbx,%rdi
call   1030 <strlen@plt>
xor    %edi,%edi
cmp    $0x4,%eax
sete   %dil
call   1050 <clang_analyzer_eval@plt>
add    $0x10,%rsp
pop    %rbx
ret

LLVM IR (-O0):
@__const.strncat_symbolic_limit.dst = [6 x i8] c"1234\00\00"
@__const.strncat_symbolic_limit.src = [4 x i8] c"567\00"
define void @strncat_symbolic_limit(i32 %0) {
%2 = alloca i32
%3 = alloca [6 x i8]
%4 = alloca [4 x i8]
store i32 %0, i32* %2
%5 = bitcast [6 x i8]* %3 to i8*
%6 = bitcast [4 x i8]* %4 to i8*
%7 = getelementptr inbounds [6 x i8], [6 x i8]* %3, i64 0, i64 0
%8 = getelementptr inbounds [4 x i8], [4 x i8]* %4, i64 0, i64 0
%9 = load i32, i32* %2
%10 = call i32 @strncat(i8* %7, i8* %8, i32 %9)
%11 = getelementptr inbounds [6 x i8], [6 x i8]* %3, i64 0, i64 0
%12 = call i32 @strlen(i8* %11)
%13 = icmp sge i32 %12, 4
%14 = zext i1 %13 to i32
%15 = call i32 @clang_analyzer_eval(i32 %14)
%16 = getelementptr inbounds [6 x i8], [6 x i8]* %3, i64 0, i64 0
%17 = call i32 @strlen(i8* %16)
%18 = icmp eq i32 %17, 4
%19 = zext i1 %18 to i32
%20 = call i32 @clang_analyzer_eval(i32 %19)
ret void
}

LLVM IR (-O2):
@__const.strncat_symbolic_limit.dst = [6 x i8] c"1234\00\00"
define void @strncat_symbolic_limit(i32 %0) {
%2 = alloca [6 x i8]
%3 = alloca i32
%4 = getelementptr inbounds [6 x i8], [6 x i8]* %2, i64 0, i64 0
%5 = bitcast i32* %3 to i8*
store i32 3618357, i32* %3
%6 = call i32 @strncat(i8* %4, i8* %5, i32 %0)
%7 = call i32 @strlen(i8* %4)
%8 = icmp sgt i32 %7, 3
%9 = zext i1 %8 to i32
%10 = call i32 @clang_analyzer_eval(i32 %9)
%11 = call i32 @strlen(i8* %4)
%12 = icmp eq i32 %11, 4
%13 = zext i1 %12 to i32
%14 = call i32 @clang_analyzer_eval(i32 %13)
ret void
}