#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ _exit(int);
int /*<<< orphan*/ fflush(int /*<<< orphan*/);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, char *,
                           unsigned long long, char *);
long long int128max();
int /*<<< orphan*/ numtostr(char *, long long);
int /*<<< orphan*/ stderr;
void test_bufferoverflow(void) {
  char buf[41 + 16];
  long long i, j;
  char ch[2] = {0x00, (char)0xff};
  long long llmaxnum;
  long long llminnum;
  long long numlen = sizeof(long long);
  if (numlen == 16) {
    llmaxnum = int128max();
    llminnum = -llmaxnum - 1LL;
  } else if (numlen == 8) {
    llmaxnum = 9223372036854775807LL;
    llminnum = -llmaxnum - 1LL;
  } else {
    do {
      fprintf(stderr, "%s:%llu: %s\n",
              ("/scratch/repos/new/home/jordi_armengol_estape/c-scraper/"
               "outputs/2022-01-22/02-19-57/repos/janmojzis/tinyssh/refs/heads/"
               "master/tinyssh-tests/numtostrtest.c"),
              (unsigned long long)(44), (("unsupported size for 'num'")));
      fflush(stderr);
      _exit(111);
    } while (0);
    ;
  }
  if ((41) < sizeof("-170141183460469231731687303715884105728"))
    do {
      fprintf(stderr, "%s:%llu: %s\n",
              ("/scratch/repos/new/home/jordi_armengol_estape/c-scraper/"
               "outputs/2022-01-22/02-19-57/repos/janmojzis/tinyssh/refs/heads/"
               "master/tinyssh-tests/numtostrtest.c"),
              (unsigned long long)(47), (("NUMTOSTR_LEN too small")));
      fflush(stderr);
      _exit(111);
    } while (0);
  ;
  for (j = 0; j < 2; ++j) {
    for (i = 0; i < sizeof buf; ++i)
      buf[i] = ch[j];
    numtostr(buf + 8, llminnum);
    for (i = 0; i < 8; ++i)
      if (buf[i] != ch[j])
        do {
          fprintf(stderr, "%s:%llu: %s\n",
                  ("/scratch/repos/new/home/jordi_armengol_estape/c-scraper/"
                   "outputs/2022-01-22/02-19-57/repos/janmojzis/tinyssh/refs/"
                   "heads/master/tinyssh-tests/numtostrtest.c"),
                  (unsigned long long)(52),
                  (("numtostr() writes before output")));
          fflush(stderr);
          _exit(111);
        } while (0);
    ;
    for (i = 0; i < 8; ++i)
      if (buf[i + 41 + 8] != ch[j])
        do {
          fprintf(stderr, "%s:%llu: %s\n",
                  ("/scratch/repos/new/home/jordi_armengol_estape/c-scraper/"
                   "outputs/2022-01-22/02-19-57/repos/janmojzis/tinyssh/refs/"
                   "heads/master/tinyssh-tests/numtostrtest.c"),
                  (unsigned long long)(53),
                  (("numtostr() writes after output")));
          fflush(stderr);
          _exit(111);
        } while (0);
    ;
    for (i = 0; i < sizeof buf; ++i)
      buf[i] = ch[j];
    numtostr(buf + 8, llmaxnum);
    for (i = 0; i < 8; ++i)
      if (buf[i] != ch[j])
        do {
          fprintf(stderr, "%s:%llu: %s\n",
                  ("/scratch/repos/new/home/jordi_armengol_estape/c-scraper/"
                   "outputs/2022-01-22/02-19-57/repos/janmojzis/tinyssh/refs/"
                   "heads/master/tinyssh-tests/numtostrtest.c"),
                  (unsigned long long)(56),
                  (("numtostr() writes before output")));
          fflush(stderr);
          _exit(111);
        } while (0);
    ;
    for (i = 0; i < 8; ++i)
      if (buf[i + 41 + 8] != ch[j])
        do {
          fprintf(stderr, "%s:%llu: %s\n",
                  ("/scratch/repos/new/home/jordi_armengol_estape/c-scraper/"
                   "outputs/2022-01-22/02-19-57/repos/janmojzis/tinyssh/refs/"
                   "heads/master/tinyssh-tests/numtostrtest.c"),
                  (unsigned long long)(57),
                  (("numtostr() writes after output")));
          fflush(stderr);
          _exit(111);
        } while (0);
    ;
  }
}


x86 assembly (clang, -O0):
<test_bufferoverflow>:
push   %rbp
mov    %rsp,%rbp
sub    $0x70,%rsp
mov    0xea1(%rip),%ax
mov    %ax,-0x52(%rbp)
movq   $0x8,-0x70(%rbp)
cmpq   $0x10,-0x70(%rbp)
jne    1194 <test_bufferoverflow+0x44>
mov    $0x0,%al
call   1050 <int128max@plt>
mov    %rax,-0x60(%rbp)
xor    %eax,%eax
sub    -0x60(%rbp),%rax
sub    $0x1,%rax
mov    %rax,-0x68(%rbp)
jmp    120a <test_bufferoverflow+0xba>
cmpq   $0x8,-0x70(%rbp)
jne    11c0 <test_bufferoverflow+0x70>
movabs $0x7fffffffffffffff,%rax
ff ff 7f
mov    %rax,-0x60(%rbp)
xor    %eax,%eax
sub    -0x60(%rbp),%rax
sub    $0x1,%rax
mov    %rax,-0x68(%rbp)
jmp    1205 <test_bufferoverflow+0xb5>
jmp    11c5 <test_bufferoverflow+0x75>
mov    0x2e14(%rip),%rax
mov    (%rax),%edi
lea    0xe2d(%rip),%rsi
lea    0xe33(%rip),%rdx
mov    $0x2c,%ecx
lea    0xec2(%rip),%r8
call   1060 <fprintf@plt>
mov    0x2dec(%rip),%rax
mov    (%rax),%edi
call   1070 <fflush@plt>
mov    $0x6f,%edi
call   1030 <_exit@plt>
jmp    120a <test_bufferoverflow+0xba>
movq   $0x0,-0x50(%rbp)
cmpq   $0x2,-0x50(%rbp)
jge    14dd <test_bufferoverflow+0x38d>
movq   $0x0,-0x48(%rbp)
cmpq   $0x39,-0x48(%rbp)
jae    1251 <test_bufferoverflow+0x101>
mov    -0x50(%rbp),%rax
mov    -0x52(%rbp,%rax,1),%cl
mov    -0x48(%rbp),%rax
mov    %cl,-0x40(%rbp,%rax,1)
mov    -0x48(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x48(%rbp)
jmp    1225 <test_bufferoverflow+0xd5>
lea    -0x40(%rbp),%rdi
add    $0x8,%rdi
mov    -0x68(%rbp),%rsi
call   1040 <numtostr@plt>
movq   $0x0,-0x48(%rbp)
cmpq   $0x8,-0x48(%rbp)
jge    12ea <test_bufferoverflow+0x19a>
mov    -0x48(%rbp),%rax
movsbl -0x40(%rbp,%rax,1),%eax
mov    -0x50(%rbp),%rcx
movsbl -0x52(%rbp,%rcx,1),%ecx
cmp    %ecx,%eax
je     12d4 <test_bufferoverflow+0x184>
jmp    1294 <test_bufferoverflow+0x144>
mov    0x2d45(%rip),%rax
mov    (%rax),%edi
lea    0xd5e(%rip),%rsi
lea    0xd64(%rip),%rdx
mov    $0x34,%ecx
lea    0xe0e(%rip),%r8
call   1060 <fprintf@plt>
mov    0x2d1d(%rip),%rax
mov    (%rax),%edi
call   1070 <fflush@plt>
mov    $0x6f,%edi
call   1030 <_exit@plt>
jmp    12d9 <test_bufferoverflow+0x189>
mov    -0x48(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x48(%rbp)
jmp    126a <test_bufferoverflow+0x11a>
movq   $0x0,-0x48(%rbp)
cmpq   $0x8,-0x48(%rbp)
jge    1372 <test_bufferoverflow+0x222>
mov    -0x48(%rbp),%rax
movsbl -0xf(%rbp,%rax,1),%eax
mov    -0x50(%rbp),%rcx
movsbl -0x52(%rbp,%rcx,1),%ecx
cmp    %ecx,%eax
je     135c <test_bufferoverflow+0x20c>
jmp    131c <test_bufferoverflow+0x1cc>
mov    0x2cbd(%rip),%rax
mov    (%rax),%edi
lea    0xcd6(%rip),%rsi
lea    0xcdc(%rip),%rdx
mov    $0x35,%ecx
lea    0xda6(%rip),%r8
call   1060 <fprintf@plt>
mov    0x2c95(%rip),%rax
mov    (%rax),%edi
call   1070 <fflush@plt>
mov    $0x6f,%edi
call   1030 <_exit@plt>
jmp    1361 <test_bufferoverflow+0x211>
mov    -0x48(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x48(%rbp)
jmp    12f2 <test_bufferoverflow+0x1a2>
movq   $0x0,-0x48(%rbp)
cmpq   $0x39,-0x48(%rbp)
jae    13a6 <test_bufferoverflow+0x256>
mov    -0x50(%rbp),%rax
mov    -0x52(%rbp,%rax,1),%cl
mov    -0x48(%rbp),%rax
mov    %cl,-0x40(%rbp,%rax,1)
mov    -0x48(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x48(%rbp)
jmp    137a <test_bufferoverflow+0x22a>
lea    -0x40(%rbp),%rdi
add    $0x8,%rdi
mov    -0x60(%rbp),%rsi
call   1040 <numtostr@plt>
movq   $0x0,-0x48(%rbp)
cmpq   $0x8,-0x48(%rbp)
jge    143f <test_bufferoverflow+0x2ef>
mov    -0x48(%rbp),%rax
movsbl -0x40(%rbp,%rax,1),%eax
mov    -0x50(%rbp),%rcx
movsbl -0x52(%rbp,%rcx,1),%ecx
cmp    %ecx,%eax
je     1429 <test_bufferoverflow+0x2d9>
jmp    13e9 <test_bufferoverflow+0x299>
mov    0x2bf0(%rip),%rax
mov    (%rax),%edi
lea    0xc09(%rip),%rsi
lea    0xc0f(%rip),%rdx
mov    $0x38,%ecx
lea    0xcb9(%rip),%r8
call   1060 <fprintf@plt>
mov    0x2bc8(%rip),%rax
mov    (%rax),%edi
call   1070 <fflush@plt>
mov    $0x6f,%edi
call   1030 <_exit@plt>
jmp    142e <test_bufferoverflow+0x2de>
mov    -0x48(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x48(%rbp)
jmp    13bf <test_bufferoverflow+0x26f>
movq   $0x0,-0x48(%rbp)
cmpq   $0x8,-0x48(%rbp)
jge    14c7 <test_bufferoverflow+0x377>
mov    -0x48(%rbp),%rax
movsbl -0xf(%rbp,%rax,1),%eax
mov    -0x50(%rbp),%rcx
movsbl -0x52(%rbp,%rcx,1),%ecx
cmp    %ecx,%eax
je     14b1 <test_bufferoverflow+0x361>
jmp    1471 <test_bufferoverflow+0x321>
mov    0x2b68(%rip),%rax
mov    (%rax),%edi
lea    0xb81(%rip),%rsi
lea    0xb87(%rip),%rdx
mov    $0x39,%ecx
lea    0xc51(%rip),%r8
call   1060 <fprintf@plt>
mov    0x2b40(%rip),%rax
mov    (%rax),%edi
call   1070 <fflush@plt>
mov    $0x6f,%edi
call   1030 <_exit@plt>
jmp    14b6 <test_bufferoverflow+0x366>
mov    -0x48(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x48(%rbp)
jmp    1447 <test_bufferoverflow+0x2f7>
jmp    14cc <test_bufferoverflow+0x37c>
mov    -0x50(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x50(%rbp)
jmp    1212 <test_bufferoverflow+0xc2>
add    $0x70,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<test_bufferoverflow>:
push   %r15
push   %r14
push   %rbx
sub    $0x40,%rsp
movabs $0x7fffffffffffffff,%r14
ff ff 7f
lea    0x8(%rsp),%r15
xorps  %xmm0,%xmm0
movups %xmm0,0x29(%rsp)
movaps %xmm0,0x20(%rsp)
movaps %xmm0,0x10(%rsp)
movaps %xmm0,(%rsp)
lea    0x1(%r14),%rbx
mov    %r15,%rdi
mov    %rbx,%rsi
call   1040 <numtostr@plt>
movq   (%rsp),%xmm0
movq   %xmm0,%rax
test   %rax,%rax
jne    1289 <test_bufferoverflow+0x149>
movq   0x31(%rsp),%xmm0
movq   %xmm0,%rax
test   %rax,%rax
jne    12ae <test_bufferoverflow+0x16e>
pxor   %xmm0,%xmm0
movdqu %xmm0,0x29(%rsp)
movdqa %xmm0,0x20(%rsp)
movdqa %xmm0,0x10(%rsp)
movdqa %xmm0,(%rsp)
mov    %r15,%rdi
mov    %r14,%rsi
call   1040 <numtostr@plt>
movq   (%rsp),%xmm0
movq   %xmm0,%rax
test   %rax,%rax
jne    12d3 <test_bufferoverflow+0x193>
movq   0x31(%rsp),%xmm0
movq   %xmm0,%rax
test   %rax,%rax
jne    12f8 <test_bufferoverflow+0x1b8>
pcmpeqd %xmm0,%xmm0
movdqu %xmm0,0x29(%rsp)
movdqa %xmm0,0x20(%rsp)
movdqa %xmm0,0x10(%rsp)
movdqa %xmm0,(%rsp)
mov    %r15,%rdi
mov    %rbx,%rsi
call   1040 <numtostr@plt>
movq   (%rsp),%xmm0
movq   %xmm0,%rax
cmp    $0xffffffffffffffff,%rax
jne    1289 <test_bufferoverflow+0x149>
movq   0x31(%rsp),%xmm0
movq   %xmm0,%rax
cmp    $0xffffffffffffffff,%rax
jne    12ae <test_bufferoverflow+0x16e>
pcmpeqd %xmm0,%xmm0
movdqu %xmm0,0x29(%rsp)
movdqa %xmm0,0x20(%rsp)
movdqa %xmm0,0x10(%rsp)
movdqa %xmm0,(%rsp)
mov    %r15,%rdi
mov    %r14,%rsi
call   1040 <numtostr@plt>
movq   (%rsp),%xmm0
movq   %xmm0,%rax
cmp    $0xffffffffffffffff,%rax
jne    12d3 <test_bufferoverflow+0x193>
movq   0x31(%rsp),%xmm0
movq   %xmm0,%rax
cmp    $0xffffffffffffffff,%rax
jne    12f8 <test_bufferoverflow+0x1b8>
add    $0x40,%rsp
pop    %rbx
pop    %r14
pop    %r15
ret
mov    0x2d50(%rip),%rbx
mov    (%rbx),%edi
lea    0xd67(%rip),%rsi
lea    0xd6d(%rip),%rdx
lea    0xe01(%rip),%r8
mov    $0x34,%ecx
jmp    131b <test_bufferoverflow+0x1db>
mov    0x2d2b(%rip),%rbx
mov    (%rbx),%edi
lea    0xd42(%rip),%rsi
lea    0xd48(%rip),%rdx
lea    0xdfc(%rip),%r8
mov    $0x35,%ecx
jmp    131b <test_bufferoverflow+0x1db>
mov    0x2d06(%rip),%rbx
mov    (%rbx),%edi
lea    0xd1d(%rip),%rsi
lea    0xd23(%rip),%rdx
lea    0xdb7(%rip),%r8
mov    $0x38,%ecx
jmp    131b <test_bufferoverflow+0x1db>
mov    0x2ce1(%rip),%rbx
mov    (%rbx),%edi
lea    0xcf8(%rip),%rsi
lea    0xcfe(%rip),%rdx
lea    0xdb2(%rip),%r8
mov    $0x39,%ecx
call   1050 <fprintf@plt>
mov    (%rbx),%edi
call   1060 <fflush@plt>
mov    $0x6f,%edi
call   1030 <_exit@plt>

LLVM IR (-O0):
@__const.test_bufferoverflow.ch = [2 x i8] c"\00\FF"
@stderr = global i32 0
@.str = [13 x i8] c"%s:%llu: %s\0A\00"
@.str.1 = [155 x i8] c"/scratch/repos/new/home/jordi_armengol_estape/c-scraper/outputs/2022-01-22/02-19-57/repos/janmojzis/tinyssh/refs/heads/master/tinyssh-tests/numtostrtest.c\00"
@.str.2 = [27 x i8] c"unsupported size for 'num'\00"
@.str.3 = [32 x i8] c"numtostr() writes before output\00"
@.str.4 = [31 x i8] c"numtostr() writes after output\00"
define void @test_bufferoverflow() {
%1 = alloca [57 x i8]
%2 = alloca i64
%3 = alloca i64
%4 = alloca [2 x i8]
%5 = alloca i64
%6 = alloca i64
%7 = alloca i64
%8 = bitcast [2 x i8]* %4 to i8*
store i64 8, i64* %7
%9 = load i64, i64* %7
%10 = icmp eq i64 %9, 16
br i1 %10, label %11, label %16
11: ; preds = %0
%12 = call i64 (...) @int128max()
store i64 %12, i64* %5
%13 = load i64, i64* %5
%14 = sub nsw i64 0, %13
%15 = sub nsw i64 %14, 1
store i64 %15, i64* %6
br label %32
16: ; preds = %0
%17 = load i64, i64* %7
%18 = icmp eq i64 %17, 8
br i1 %18, label %19, label %23
19: ; preds = %16
store i64 9223372036854775807, i64* %5
%20 = load i64, i64* %5
%21 = sub nsw i64 0, %20
%22 = sub nsw i64 %21, 1
store i64 %22, i64* %6
br label %31
23: ; preds = %16
br label %24
24: ; preds = %23
%25 = load i32, i32* @stderr
%26 = call i32 @fprintf(i32 %25, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([155 x i8], [155 x i8]* @.str.1, i64 0, i64 0), i64 44, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.2, i64 0, i64 0))
%27 = load i32, i32* @stderr
%28 = call i32 @fflush(i32 %27)
%29 = call i32 @_exit(i32 111)
unreachable
30: ; No predecessors!
br label %31
31: ; preds = %30, %19
br label %32
32: ; preds = %31, %11
store i64 0, i64* %3
br label %33
33: ; preds = %179, %32
%34 = load i64, i64* %3
%35 = icmp slt i64 %34, 2
br i1 %35, label %36, label %182
36: ; preds = %33
store i64 0, i64* %2
br label %37
37: ; preds = %46, %36
%38 = load i64, i64* %2
%39 = icmp ult i64 %38, 57
br i1 %39, label %40, label %49
40: ; preds = %37
%41 = load i64, i64* %3
%42 = getelementptr inbounds [2 x i8], [2 x i8]* %4, i64 0, i64 %41
%43 = load i8, i8* %42
%44 = load i64, i64* %2
%45 = getelementptr inbounds [57 x i8], [57 x i8]* %1, i64 0, i64 %44
store i8 %43, i8* %45
br label %46
46: ; preds = %40
%47 = load i64, i64* %2
%48 = add nsw i64 %47, 1
store i64 %48, i64* %2
br label %37
49: ; preds = %37
%50 = getelementptr inbounds [57 x i8], [57 x i8]* %1, i64 0, i64 0
%51 = getelementptr inbounds i8, i8* %50, i64 8
%52 = load i64, i64* %6
%53 = call i32 @numtostr(i8* %51, i64 %52)
store i64 0, i64* %2
br label %54
54: ; preds = %76, %49
%55 = load i64, i64* %2
%56 = icmp slt i64 %55, 8
br i1 %56, label %57, label %79
57: ; preds = %54
%58 = load i64, i64* %2
%59 = getelementptr inbounds [57 x i8], [57 x i8]* %1, i64 0, i64 %58
%60 = load i8, i8* %59
%61 = sext i8 %60 to i32
%62 = load i64, i64* %3
%63 = getelementptr inbounds [2 x i8], [2 x i8]* %4, i64 0, i64 %62
%64 = load i8, i8* %63
%65 = sext i8 %64 to i32
%66 = icmp ne i32 %61, %65
br i1 %66, label %67, label %75
67: ; preds = %57
br label %68
68: ; preds = %67
%69 = load i32, i32* @stderr
%70 = call i32 @fprintf(i32 %69, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([155 x i8], [155 x i8]* @.str.1, i64 0, i64 0), i64 52, i8* getelementptr inbounds ([32 x i8], [32 x i8]* @.str.3, i64 0, i64 0))
%71 = load i32, i32* @stderr
%72 = call i32 @fflush(i32 %71)
%73 = call i32 @_exit(i32 111)
unreachable
74: ; No predecessors!
br label %75
75: ; preds = %74, %57
br label %76
76: ; preds = %75
%77 = load i64, i64* %2
%78 = add nsw i64 %77, 1
store i64 %78, i64* %2
br label %54
79: ; preds = %54
store i64 0, i64* %2
br label %80
80: ; preds = %104, %79
%81 = load i64, i64* %2
%82 = icmp slt i64 %81, 8
br i1 %82, label %83, label %107
83: ; preds = %80
%84 = load i64, i64* %2
%85 = add nsw i64 %84, 41
%86 = add nsw i64 %85, 8
%87 = getelementptr inbounds [57 x i8], [57 x i8]* %1, i64 0, i64 %86
%88 = load i8, i8* %87
%89 = sext i8 %88 to i32
%90 = load i64, i64* %3
%91 = getelementptr inbounds [2 x i8], [2 x i8]* %4, i64 0, i64 %90
%92 = load i8, i8* %91
%93 = sext i8 %92 to i32
%94 = icmp ne i32 %89, %93
br i1 %94, label %95, label %103
95: ; preds = %83
br label %96
96: ; preds = %95
%97 = load i32, i32* @stderr
%98 = call i32 @fprintf(i32 %97, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([155 x i8], [155 x i8]* @.str.1, i64 0, i64 0), i64 53, i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.4, i64 0, i64 0))
%99 = load i32, i32* @stderr
%100 = call i32 @fflush(i32 %99)
%101 = call i32 @_exit(i32 111)
unreachable
102: ; No predecessors!
br label %103
103: ; preds = %102, %83
br label %104
104: ; preds = %103
%105 = load i64, i64* %2
%106 = add nsw i64 %105, 1
store i64 %106, i64* %2
br label %80
107: ; preds = %80
store i64 0, i64* %2
br label %108
108: ; preds = %117, %107
%109 = load i64, i64* %2
%110 = icmp ult i64 %109, 57
br i1 %110, label %111, label %120
111: ; preds = %108
%112 = load i64, i64* %3
%113 = getelementptr inbounds [2 x i8], [2 x i8]* %4, i64 0, i64 %112
%114 = load i8, i8* %113
%115 = load i64, i64* %2
%116 = getelementptr inbounds [57 x i8], [57 x i8]* %1, i64 0, i64 %115
store i8 %114, i8* %116
br label %117
117: ; preds = %111
%118 = load i64, i64* %2
%119 = add nsw i64 %118, 1
store i64 %119, i64* %2
br label %108
120: ; preds = %108
%121 = getelementptr inbounds [57 x i8], [57 x i8]* %1, i64 0, i64 0
%122 = getelementptr inbounds i8, i8* %121, i64 8
%123 = load i64, i64* %5
%124 = call i32 @numtostr(i8* %122, i64 %123)
store i64 0, i64* %2
br label %125
125: ; preds = %147, %120
%126 = load i64, i64* %2
%127 = icmp slt i64 %126, 8
br i1 %127, label %128, label %150
128: ; preds = %125
%129 = load i64, i64* %2
%130 = getelementptr inbounds [57 x i8], [57 x i8]* %1, i64 0, i64 %129
%131 = load i8, i8* %130
%132 = sext i8 %131 to i32
%133 = load i64, i64* %3
%134 = getelementptr inbounds [2 x i8], [2 x i8]* %4, i64 0, i64 %133
%135 = load i8, i8* %134
%136 = sext i8 %135 to i32
%137 = icmp ne i32 %132, %136
br i1 %137, label %138, label %146
138: ; preds = %128
br label %139
139: ; preds = %138
%140 = load i32, i32* @stderr
%141 = call i32 @fprintf(i32 %140, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([155 x i8], [155 x i8]* @.str.1, i64 0, i64 0), i64 56, i8* getelementptr inbounds ([32 x i8], [32 x i8]* @.str.3, i64 0, i64 0))
%142 = load i32, i32* @stderr
%143 = call i32 @fflush(i32 %142)
%144 = call i32 @_exit(i32 111)
unreachable
145: ; No predecessors!
br label %146
146: ; preds = %145, %128
br label %147
147: ; preds = %146
%148 = load i64, i64* %2
%149 = add nsw i64 %148, 1
store i64 %149, i64* %2
br label %125
150: ; preds = %125
store i64 0, i64* %2
br label %151
151: ; preds = %175, %150
%152 = load i64, i64* %2
%153 = icmp slt i64 %152, 8
br i1 %153, label %154, label %178
154: ; preds = %151
%155 = load i64, i64* %2
%156 = add nsw i64 %155, 41
%157 = add nsw i64 %156, 8
%158 = getelementptr inbounds [57 x i8], [57 x i8]* %1, i64 0, i64 %157
%159 = load i8, i8* %158
%160 = sext i8 %159 to i32
%161 = load i64, i64* %3
%162 = getelementptr inbounds [2 x i8], [2 x i8]* %4, i64 0, i64 %161
%163 = load i8, i8* %162
%164 = sext i8 %163 to i32
%165 = icmp ne i32 %160, %164
br i1 %165, label %166, label %174
166: ; preds = %154
br label %167
167: ; preds = %166
%168 = load i32, i32* @stderr
%169 = call i32 @fprintf(i32 %168, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([155 x i8], [155 x i8]* @.str.1, i64 0, i64 0), i64 57, i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.4, i64 0, i64 0))
%170 = load i32, i32* @stderr
%171 = call i32 @fflush(i32 %170)
%172 = call i32 @_exit(i32 111)
unreachable
173: ; No predecessors!
br label %174
174: ; preds = %173, %154
br label %175
175: ; preds = %174
%176 = load i64, i64* %2
%177 = add nsw i64 %176, 1
store i64 %177, i64* %2
br label %151
178: ; preds = %151
br label %179
179: ; preds = %178
%180 = load i64, i64* %3
%181 = add nsw i64 %180, 1
store i64 %181, i64* %3
br label %33
182: ; preds = %33
ret void
}

LLVM IR (-O2):
@stderr = global i32 0
@.str = [13 x i8] c"%s:%llu: %s\0A\00"
@.str.1 = [155 x i8] c"/scratch/repos/new/home/jordi_armengol_estape/c-scraper/outputs/2022-01-22/02-19-57/repos/janmojzis/tinyssh/refs/heads/master/tinyssh-tests/numtostrtest.c\00"
@.str.3 = [32 x i8] c"numtostr() writes before output\00"
@.str.4 = [31 x i8] c"numtostr() writes after output\00"
define void @test_bufferoverflow() {
%1 = alloca [57 x i8]
%2 = getelementptr inbounds [57 x i8], [57 x i8]* %1, i64 0, i64 0
%3 = getelementptr inbounds [57 x i8], [57 x i8]* %1, i64 0, i64 0
%4 = getelementptr inbounds [57 x i8], [57 x i8]* %1, i64 0, i64 8
%5 = getelementptr inbounds [57 x i8], [57 x i8]* %1, i64 0, i64 49
%6 = call i32 @numtostr(i8* %4, i64 -9223372036854775808)
%7 = bitcast [57 x i8]* %1 to <8 x i8>*
%8 = load <8 x i8>, <8 x i8>* %7
%9 = freeze <8 x i8> %8
%10 = bitcast <8 x i8> %9 to i64
%11 = icmp eq i64 %10, 0
br i1 %11, label %12, label %18
12: ; preds = %0
%13 = bitcast i8* %5 to <8 x i8>*
%14 = load <8 x i8>, <8 x i8>* %13
%15 = freeze <8 x i8> %14
%16 = bitcast <8 x i8> %15 to i64
%17 = icmp eq i64 %16, 0
br i1 %17, label %24, label %31
18: ; preds = %49, %0
%19 = load i32, i32* @stderr
%20 = call i32 @fprintf(i32 %19, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([155 x i8], [155 x i8]* @.str.1, i64 0, i64 0), i64 52, i8* getelementptr inbounds ([32 x i8], [32 x i8]* @.str.3, i64 0, i64 0))
%21 = load i32, i32* @stderr
%22 = call i32 @fflush(i32 %21)
%23 = call i32 @_exit(i32 111)
unreachable
24: ; preds = %12
%25 = call i32 @numtostr(i8* %4, i64 9223372036854775807)
%26 = bitcast [57 x i8]* %1 to <8 x i8>*
%27 = load <8 x i8>, <8 x i8>* %26
%28 = freeze <8 x i8> %27
%29 = bitcast <8 x i8> %28 to i64
%30 = icmp eq i64 %29, 0
br i1 %30, label %37, label %43
31: ; preds = %56, %12
%32 = load i32, i32* @stderr
%33 = call i32 @fprintf(i32 %32, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([155 x i8], [155 x i8]* @.str.1, i64 0, i64 0), i64 53, i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.4, i64 0, i64 0))
%34 = load i32, i32* @stderr
%35 = call i32 @fflush(i32 %34)
%36 = call i32 @_exit(i32 111)
unreachable
37: ; preds = %24
%38 = bitcast i8* %5 to <8 x i8>*
%39 = load <8 x i8>, <8 x i8>* %38
%40 = freeze <8 x i8> %39
%41 = bitcast <8 x i8> %40 to i64
%42 = icmp eq i64 %41, 0
br i1 %42, label %49, label %76
43: ; preds = %62, %24
%44 = load i32, i32* @stderr
%45 = call i32 @fprintf(i32 %44, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([155 x i8], [155 x i8]* @.str.1, i64 0, i64 0), i64 56, i8* getelementptr inbounds ([32 x i8], [32 x i8]* @.str.3, i64 0, i64 0))
%46 = load i32, i32* @stderr
%47 = call i32 @fflush(i32 %46)
%48 = call i32 @_exit(i32 111)
unreachable
49: ; preds = %37
%50 = call i32 @numtostr(i8* %4, i64 -9223372036854775808)
%51 = bitcast [57 x i8]* %1 to <8 x i8>*
%52 = load <8 x i8>, <8 x i8>* %51
%53 = freeze <8 x i8> %52
%54 = bitcast <8 x i8> %53 to i64
%55 = icmp eq i64 %54, -1
br i1 %55, label %56, label %18
56: ; preds = %49
%57 = bitcast i8* %5 to <8 x i8>*
%58 = load <8 x i8>, <8 x i8>* %57
%59 = freeze <8 x i8> %58
%60 = bitcast <8 x i8> %59 to i64
%61 = icmp eq i64 %60, -1
br i1 %61, label %62, label %31
62: ; preds = %56
%63 = call i32 @numtostr(i8* %4, i64 9223372036854775807)
%64 = bitcast [57 x i8]* %1 to <8 x i8>*
%65 = load <8 x i8>, <8 x i8>* %64
%66 = freeze <8 x i8> %65
%67 = bitcast <8 x i8> %66 to i64
%68 = icmp eq i64 %67, -1
br i1 %68, label %69, label %43
69: ; preds = %62
%70 = bitcast i8* %5 to <8 x i8>*
%71 = load <8 x i8>, <8 x i8>* %70
%72 = freeze <8 x i8> %71
%73 = bitcast <8 x i8> %72 to i64
%74 = icmp eq i64 %73, -1
br i1 %74, label %75, label %76
75: ; preds = %69
ret void
76: ; preds = %69, %37
%77 = load i32, i32* @stderr
%78 = call i32 @fprintf(i32 %77, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([155 x i8], [155 x i8]* @.str.1, i64 0, i64 0), i64 57, i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.4, i64 0, i64 0))
%79 = load i32, i32* @stderr
%80 = call i32 @fflush(i32 %79)
%81 = call i32 @_exit(i32 111)
unreachable
}