void testStructArray() {
  struct {
    int length;
  } tainted[4];
  char dstbuf[16], srcbuf[16];
  int sock;
  sock = socket(2, 1, 0);
  __builtin_memset(srcbuf, 0, sizeof(srcbuf));
  read(sock, &tainted[0], sizeof(tainted));
  __builtin_memcpy(dstbuf, srcbuf, tainted[0].length);
  __builtin_memset(&tainted, 0, sizeof(tainted));
  read(sock, &tainted, sizeof(tainted));
  __builtin_memcpy(dstbuf, srcbuf, tainted[0].length);
  __builtin_memset(&tainted, 0, sizeof(tainted));
  read(sock, &tainted[1], sizeof(tainted));
  __builtin_memcpy(dstbuf, srcbuf, tainted[0].length);
  __builtin_memcpy(dstbuf, srcbuf, tainted[2].length);
}


x86 assembly (clang, -O0):
<testStructArray>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    $0x2,%edi
mov    $0x1,%esi
xor    %edx,%edx
mov    $0x0,%al
call   1060 <socket@plt>
mov    %eax,-0x34(%rbp)
lea    -0x30(%rbp),%rdi
xor    %esi,%esi
mov    $0x10,%edx
call   1030 <memset@plt>
mov    -0x34(%rbp),%edi
lea    -0x10(%rbp),%rsi
mov    $0x10,%edx
mov    $0x0,%al
call   1040 <read@plt>
lea    -0x20(%rbp),%rdi
lea    -0x30(%rbp),%rsi
movslq -0x10(%rbp),%rdx
call   1050 <memcpy@plt>
lea    -0x10(%rbp),%rdi
xor    %esi,%esi
mov    $0x10,%edx
call   1030 <memset@plt>
mov    -0x34(%rbp),%edi
lea    -0x10(%rbp),%rsi
mov    $0x10,%edx
mov    $0x0,%al
call   1040 <read@plt>
lea    -0x20(%rbp),%rdi
lea    -0x30(%rbp),%rsi
movslq -0x10(%rbp),%rdx
call   1050 <memcpy@plt>
lea    -0x10(%rbp),%rdi
xor    %esi,%esi
mov    $0x10,%edx
call   1030 <memset@plt>
mov    -0x34(%rbp),%edi
lea    -0x10(%rbp),%rsi
add    $0x4,%rsi
mov    $0x10,%edx
mov    $0x0,%al
call   1040 <read@plt>
lea    -0x20(%rbp),%rdi
lea    -0x30(%rbp),%rsi
movslq -0x10(%rbp),%rdx
call   1050 <memcpy@plt>
lea    -0x20(%rbp),%rdi
lea    -0x30(%rbp),%rsi
movslq -0x8(%rbp),%rdx
call   1050 <memcpy@plt>
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<testStructArray>:
push   %r14
push   %rbx
sub    $0x18,%rsp
mov    $0x2,%edi
mov    $0x1,%esi
xor    %edx,%edx
xor    %eax,%eax
call   1040 <socket@plt>
mov    %eax,%ebx
mov    %rsp,%r14
mov    $0x10,%edx
mov    %eax,%edi
mov    %r14,%rsi
xor    %eax,%eax
call   1030 <read@plt>
xorps  %xmm0,%xmm0
movaps %xmm0,(%rsp)
mov    $0x10,%edx
mov    %ebx,%edi
mov    %r14,%rsi
xor    %eax,%eax
call   1030 <read@plt>
xorps  %xmm0,%xmm0
movaps %xmm0,(%rsp)
lea    0x4(%rsp),%rsi
mov    $0x10,%edx
mov    %ebx,%edi
xor    %eax,%eax
call   1030 <read@plt>
add    $0x18,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
%struct.anon = type { i32 }
define void @testStructArray() {
%1 = alloca [4 x %struct.anon]
%2 = alloca [16 x i8]
%3 = alloca [16 x i8]
%4 = alloca i32
%5 = call i32 (i32, i32, i32, ...) bitcast (i32 (...)* @socket to i32 (i32, i32, i32, ...)*)(i32 2, i32 1, i32 0)
store i32 %5, i32* %4
%6 = getelementptr inbounds [16 x i8], [16 x i8]* %3, i64 0, i64 0
%7 = load i32, i32* %4
%8 = getelementptr inbounds [4 x %struct.anon], [4 x %struct.anon]* %1, i64 0, i64 0
%9 = call i32 (i32, %struct.anon*, i64, ...) bitcast (i32 (...)* @read to i32 (i32, %struct.anon*, i64, ...)*)(i32 %7, %struct.anon* %8, i64 16)
%10 = getelementptr inbounds [16 x i8], [16 x i8]* %2, i64 0, i64 0
%11 = getelementptr inbounds [16 x i8], [16 x i8]* %3, i64 0, i64 0
%12 = getelementptr inbounds [4 x %struct.anon], [4 x %struct.anon]* %1, i64 0, i64 0
%13 = getelementptr inbounds %struct.anon, %struct.anon* %12, i32 0, i32 0
%14 = load i32, i32* %13
%15 = sext i32 %14 to i64
%16 = bitcast [4 x %struct.anon]* %1 to i8*
%17 = load i32, i32* %4
%18 = call i32 (i32, [4 x %struct.anon]*, i64, ...) bitcast (i32 (...)* @read to i32 (i32, [4 x %struct.anon]*, i64, ...)*)(i32 %17, [4 x %struct.anon]* %1, i64 16)
%19 = getelementptr inbounds [16 x i8], [16 x i8]* %2, i64 0, i64 0
%20 = getelementptr inbounds [16 x i8], [16 x i8]* %3, i64 0, i64 0
%21 = getelementptr inbounds [4 x %struct.anon], [4 x %struct.anon]* %1, i64 0, i64 0
%22 = getelementptr inbounds %struct.anon, %struct.anon* %21, i32 0, i32 0
%23 = load i32, i32* %22
%24 = sext i32 %23 to i64
%25 = bitcast [4 x %struct.anon]* %1 to i8*
%26 = load i32, i32* %4
%27 = getelementptr inbounds [4 x %struct.anon], [4 x %struct.anon]* %1, i64 0, i64 1
%28 = call i32 (i32, %struct.anon*, i64, ...) bitcast (i32 (...)* @read to i32 (i32, %struct.anon*, i64, ...)*)(i32 %26, %struct.anon* %27, i64 16)
%29 = getelementptr inbounds [16 x i8], [16 x i8]* %2, i64 0, i64 0
%30 = getelementptr inbounds [16 x i8], [16 x i8]* %3, i64 0, i64 0
%31 = getelementptr inbounds [4 x %struct.anon], [4 x %struct.anon]* %1, i64 0, i64 0
%32 = getelementptr inbounds %struct.anon, %struct.anon* %31, i32 0, i32 0
%33 = load i32, i32* %32
%34 = sext i32 %33 to i64
%35 = getelementptr inbounds [16 x i8], [16 x i8]* %2, i64 0, i64 0
%36 = getelementptr inbounds [16 x i8], [16 x i8]* %3, i64 0, i64 0
%37 = getelementptr inbounds [4 x %struct.anon], [4 x %struct.anon]* %1, i64 0, i64 2
%38 = getelementptr inbounds %struct.anon, %struct.anon* %37, i32 0, i32 0
%39 = load i32, i32* %38
%40 = sext i32 %39 to i64
ret void
}

LLVM IR (-O2):
%struct.anon = type { i32 }
define void @testStructArray() {
%1 = alloca [4 x %struct.anon]
%2 = bitcast [4 x %struct.anon]* %1 to i8*
%3 = tail call i32 (i32, i32, i32, ...) bitcast (i32 (...)* @socket to i32 (i32, i32, i32, ...)*)(i32 2, i32 1, i32 0)
%4 = getelementptr inbounds [4 x %struct.anon], [4 x %struct.anon]* %1, i64 0, i64 0
%5 = call i32 (i32, %struct.anon*, i64, ...) bitcast (i32 (...)* @read to i32 (i32, %struct.anon*, i64, ...)*)(i32 %3, %struct.anon* %4, i64 16)
%6 = call i32 (i32, [4 x %struct.anon]*, i64, ...) bitcast (i32 (...)* @read to i32 (i32, [4 x %struct.anon]*, i64, ...)*)(i32 %3, [4 x %struct.anon]* %1, i64 16)
%7 = getelementptr inbounds [4 x %struct.anon], [4 x %struct.anon]* %1, i64 0, i64 1
%8 = call i32 (i32, %struct.anon*, i64, ...) bitcast (i32 (...)* @read to i32 (i32, %struct.anon*, i64, ...)*)(i32 %3, %struct.anon* %7, i64 16)
ret void
}