#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
char *calloc(int, int);
char *realloc(char *, int);
int /*<<< orphan*/ strcat(char *, char const *);
int /*<<< orphan*/ strcpy(char *, char *);
int strlen(char const *);
int /*<<< orphan*/ strncat(char *, char const *, int);
char *strstr(char const *, char *);
char *substitute(const char *in, const char *var, const char *val) {
  int inlen = strlen(in), outmax = inlen * 2, varlen = strlen(var),
      vallen = strlen(val), outlen = 0;
  char *out = calloc(1, outmax), *var1 = calloc(1, varlen + 2),
       *var2 = calloc(1, varlen + 4), *offset1 = NULL, *offset2 = NULL;
  strcpy(var1, "$");
  strcat(var1, var);
  strcpy(var2, "${");
  strcat(var2, var);
  strcat(var2, "}");
  while ((offset1 = strstr(in, var1)) || (offset2 = strstr(in, var2))) {
    char *offset = offset1;
    int vlen = varlen + 1;
    if (!offset || (offset2 && offset2 < offset1))
      offset = offset2;
    if (offset[1] == '{')
      vlen += 2;
    if (outlen + vlen > outmax) {
      outmax *= 2;
      out = realloc(out, outmax);
    }
    out[outlen] = 0;
    strncat(out, in, offset - in);
    outlen += offset - in;
    in = offset;
    out[outlen] = 0;
    strcat(out, val);
    outlen += vallen;
    in += vlen;
    offset1 = offset2 = NULL;
  }
  strcat(out, in);
  return out;
}


x86 assembly (clang, -O0):
<substitute>:
push   %rbp
mov    %rsp,%rbp
sub    $0x70,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
mov    -0x8(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,-0x1c(%rbp)
mov    -0x1c(%rbp),%eax
shl    $0x1,%eax
mov    %eax,-0x20(%rbp)
mov    -0x10(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,-0x24(%rbp)
mov    -0x18(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,-0x28(%rbp)
movl   $0x0,-0x2c(%rbp)
mov    -0x20(%rbp),%esi
mov    $0x1,%edi
call   1060 <calloc@plt>
mov    %rax,-0x38(%rbp)
mov    -0x24(%rbp),%esi
add    $0x2,%esi
mov    $0x1,%edi
call   1060 <calloc@plt>
mov    %rax,-0x40(%rbp)
mov    -0x24(%rbp),%esi
add    $0x4,%esi
mov    $0x1,%edi
call   1060 <calloc@plt>
mov    %rax,-0x48(%rbp)
movq   $0x0,-0x50(%rbp)
movq   $0x0,-0x58(%rbp)
mov    -0x40(%rbp),%rdi
lea    0xdf4(%rip),%rsi
call   1030 <strcpy@plt>
mov    -0x40(%rbp),%rdi
mov    -0x10(%rbp),%rsi
call   1080 <strcat@plt>
mov    -0x48(%rbp),%rdi
lea    0xdd9(%rip),%rsi
call   1030 <strcpy@plt>
mov    -0x48(%rbp),%rdi
mov    -0x10(%rbp),%rsi
call   1080 <strcat@plt>
mov    -0x48(%rbp),%rdi
lea    0xdbf(%rip),%rsi
call   1080 <strcat@plt>
mov    -0x8(%rbp),%rdi
mov    -0x40(%rbp),%rsi
call   1090 <strstr@plt>
mov    %rax,%rcx
mov    %rcx,-0x50(%rbp)
mov    $0x1,%al
cmp    $0x0,%rcx
mov    %al,-0x65(%rbp)
jne    1289 <substitute+0x119>
mov    -0x8(%rbp),%rdi
mov    -0x48(%rbp),%rsi
call   1090 <strstr@plt>
mov    %rax,-0x58(%rbp)
cmp    $0x0,%rax
setne  %al
mov    %al,-0x65(%rbp)
mov    -0x65(%rbp),%al
test   $0x1,%al
jne    1299 <substitute+0x129>
jmp    13a3 <substitute+0x233>
mov    -0x50(%rbp),%rax
mov    %rax,-0x60(%rbp)
mov    -0x24(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x64(%rbp)
cmpq   $0x0,-0x60(%rbp)
je     12ce <substitute+0x15e>
cmpq   $0x0,-0x58(%rbp)
je     12d6 <substitute+0x166>
mov    -0x58(%rbp),%rax
cmp    -0x50(%rbp),%rax
jae    12d6 <substitute+0x166>
mov    -0x58(%rbp),%rax
mov    %rax,-0x60(%rbp)
mov    -0x60(%rbp),%rax
movsbl 0x1(%rax),%eax
cmp    $0x7b,%eax
jne    12f0 <substitute+0x180>
mov    -0x64(%rbp),%eax
add    $0x2,%eax
mov    %eax,-0x64(%rbp)
mov    -0x2c(%rbp),%eax
add    -0x64(%rbp),%eax
cmp    -0x20(%rbp),%eax
jle    1318 <substitute+0x1a8>
mov    -0x20(%rbp),%eax
shl    $0x1,%eax
mov    %eax,-0x20(%rbp)
mov    -0x38(%rbp),%rdi
mov    -0x20(%rbp),%esi
call   1070 <realloc@plt>
mov    %rax,-0x38(%rbp)
mov    -0x38(%rbp),%rax
movslq -0x2c(%rbp),%rcx
movb   $0x0,(%rax,%rcx,1)
mov    -0x38(%rbp),%rdi
mov    -0x8(%rbp),%rsi
mov    -0x60(%rbp),%rax
mov    -0x8(%rbp),%rcx
sub    %rcx,%rax
mov    %eax,%edx
call   1050 <strncat@plt>
mov    -0x60(%rbp),%rcx
mov    -0x8(%rbp),%rax
sub    %rax,%rcx
movslq -0x2c(%rbp),%rax
add    %rcx,%rax
mov    %eax,-0x2c(%rbp)
mov    -0x60(%rbp),%rax
mov    %rax,-0x8(%rbp)
mov    -0x38(%rbp),%rax
movslq -0x2c(%rbp),%rcx
movb   $0x0,(%rax,%rcx,1)
mov    -0x38(%rbp),%rdi
mov    -0x18(%rbp),%rsi
call   1080 <strcat@plt>
mov    -0x28(%rbp),%eax
add    -0x2c(%rbp),%eax
mov    %eax,-0x2c(%rbp)
mov    -0x64(%rbp),%ecx
mov    -0x8(%rbp),%rax
movslq %ecx,%rcx
add    %rcx,%rax
mov    %rax,-0x8(%rbp)
movq   $0x0,-0x58(%rbp)
movq   $0x0,-0x50(%rbp)
jmp    124b <substitute+0xdb>
mov    -0x38(%rbp),%rdi
mov    -0x8(%rbp),%rsi
call   1080 <strcat@plt>
mov    -0x38(%rbp),%rax
add    $0x70,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<substitute>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x38,%rsp
mov    %rdx,%r15
mov    %rsi,%rbp
mov    %rsi,0x8(%rsp)
mov    %rdi,%rbx
call   1040 <strlen@plt>
mov    %eax,%r14d
add    %eax,%r14d
mov    %rbp,%rdi
call   1040 <strlen@plt>
mov    %eax,%r12d
mov    %r15,0x28(%rsp)
mov    %r15,%rdi
call   1040 <strlen@plt>
mov    %eax,0x14(%rsp)
mov    $0x1,%edi
mov    %r14d,%esi
call   1060 <calloc@plt>
mov    %rax,%r13
lea    0x2(%r12),%esi
mov    $0x1,%edi
call   1060 <calloc@plt>
mov    %rax,%r15
mov    %r12,0x18(%rsp)
lea    0x4(%r12),%esi
mov    $0x1,%edi
call   1060 <calloc@plt>
mov    %rax,%rbp
lea    0xe0d(%rip),%rsi
mov    %r15,%rdi
call   1030 <strcpy@plt>
mov    %r15,0x30(%rsp)
mov    %r15,%rdi
mov    0x8(%rsp),%r15
mov    %r15,%rsi
call   1080 <strcat@plt>
lea    0xdeb(%rip),%rsi
mov    %rbp,%rdi
call   1030 <strcpy@plt>
mov    %rbp,%rdi
mov    %r15,%rsi
call   1080 <strcat@plt>
lea    0xdd4(%rip),%rsi
mov    %rbp,0x20(%rsp)
mov    %rbp,%rdi
call   1080 <strcat@plt>
xor    %r15d,%r15d
jmp    12b7 <substitute+0x147>
cs nopw 0x0(%rax,%rax,1)
nopl   (%rax)
add    %r14d,%r14d
mov    %r13,%rdi
mov    %r14d,0x8(%rsp)
mov    %r14d,%esi
call   1070 <realloc@plt>
mov    %rax,%r13
mov    0x18(%rsp),%rax
lea    (%rax,%rbp,2),%ebp
add    $0x1,%ebp
movslq %r15d,%rax
movb   $0x0,0x0(%r13,%rax,1)
mov    %r12d,%r14d
sub    %ebx,%r14d
mov    %r13,%rdi
mov    %rbx,%rsi
mov    %r14d,%edx
call   1050 <strncat@plt>
add    %r15d,%r14d
movslq %r14d,%r15
movb   $0x0,0x0(%r13,%r15,1)
mov    %r13,%rdi
mov    0x28(%rsp),%rsi
call   1080 <strcat@plt>
add    0x14(%rsp),%r15d
movslq %ebp,%rbx
add    %r12,%rbx
mov    0x8(%rsp),%r14d
mov    %rbx,%rdi
mov    0x30(%rsp),%rsi
call   1090 <strstr@plt>
mov    %rax,%r12
test   %rax,%rax
jne    12e1 <substitute+0x171>
mov    %rbx,%rdi
mov    0x20(%rsp),%rsi
call   1090 <strstr@plt>
mov    %rax,%r12
test   %rax,%rax
je     130e <substitute+0x19e>
xor    %ebp,%ebp
cmpb   $0x7b,0x1(%r12)
sete   %bpl
mov    0x18(%rsp),%rax
lea    (%rax,%rbp,2),%eax
add    %r15d,%eax
add    $0x1,%eax
cmp    %r14d,%eax
jg     1250 <substitute+0xe0>
mov    %r14d,0x8(%rsp)
jmp    1266 <substitute+0xf6>
mov    %r13,%rdi
mov    %rbx,%rsi
call   1080 <strcat@plt>
mov    %r13,%rax
add    $0x38,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [2 x i8] c"$\00"
@.str.1 = [3 x i8] c"${\00"
@.str.2 = [2 x i8] c"}\00"
define i8* @substitute(i8* %0, i8* %1, i8* %2) {
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca i32
%12 = alloca i8*
%13 = alloca i8*
%14 = alloca i8*
%15 = alloca i8*
%16 = alloca i8*
%17 = alloca i8*
%18 = alloca i32
store i8* %0, i8** %4
store i8* %1, i8** %5
store i8* %2, i8** %6
%19 = load i8*, i8** %4
%20 = call i32 @strlen(i8* %19)
store i32 %20, i32* %7
%21 = load i32, i32* %7
%22 = mul nsw i32 %21, 2
store i32 %22, i32* %8
%23 = load i8*, i8** %5
%24 = call i32 @strlen(i8* %23)
store i32 %24, i32* %9
%25 = load i8*, i8** %6
%26 = call i32 @strlen(i8* %25)
store i32 %26, i32* %10
store i32 0, i32* %11
%27 = load i32, i32* %8
%28 = call i8* @calloc(i32 1, i32 %27)
store i8* %28, i8** %12
%29 = load i32, i32* %9
%30 = add nsw i32 %29, 2
%31 = call i8* @calloc(i32 1, i32 %30)
store i8* %31, i8** %13
%32 = load i32, i32* %9
%33 = add nsw i32 %32, 4
%34 = call i8* @calloc(i32 1, i32 %33)
store i8* %34, i8** %14
store i8* null, i8** %15
store i8* null, i8** %16
%35 = load i8*, i8** %13
%36 = call i32 @strcpy(i8* %35, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
%37 = load i8*, i8** %13
%38 = load i8*, i8** %5
%39 = call i32 @strcat(i8* %37, i8* %38)
%40 = load i8*, i8** %14
%41 = call i32 @strcpy(i8* %40, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0))
%42 = load i8*, i8** %14
%43 = load i8*, i8** %5
%44 = call i32 @strcat(i8* %42, i8* %43)
%45 = load i8*, i8** %14
%46 = call i32 @strcat(i8* %45, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.2, i64 0, i64 0))
br label %47
47: ; preds = %95, %3
%48 = load i8*, i8** %4
%49 = load i8*, i8** %13
%50 = call i8* @strstr(i8* %48, i8* %49)
store i8* %50, i8** %15
%51 = icmp ne i8* %50, null
br i1 %51, label %57, label %52
52: ; preds = %47
%53 = load i8*, i8** %4
%54 = load i8*, i8** %14
%55 = call i8* @strstr(i8* %53, i8* %54)
store i8* %55, i8** %16
%56 = icmp ne i8* %55, null
br label %57
57: ; preds = %52, %47
%58 = phi i1 [ true, %47 ], [ %56, %52 ]
br i1 %58, label %59, label %133
59: ; preds = %57
%60 = load i8*, i8** %15
store i8* %60, i8** %17
%61 = load i32, i32* %9
%62 = add nsw i32 %61, 1
store i32 %62, i32* %18
%63 = load i8*, i8** %17
%64 = icmp ne i8* %63, null
br i1 %64, label %65, label %72
65: ; preds = %59
%66 = load i8*, i8** %16
%67 = icmp ne i8* %66, null
br i1 %67, label %68, label %74
68: ; preds = %65
%69 = load i8*, i8** %16
%70 = load i8*, i8** %15
%71 = icmp ult i8* %69, %70
br i1 %71, label %72, label %74
72: ; preds = %68, %59
%73 = load i8*, i8** %16
store i8* %73, i8** %17
br label %74
74: ; preds = %72, %68, %65
%75 = load i8*, i8** %17
%76 = getelementptr inbounds i8, i8* %75, i64 1
%77 = load i8, i8* %76
%78 = sext i8 %77 to i32
%79 = icmp eq i32 %78, 123
br i1 %79, label %80, label %83
80: ; preds = %74
%81 = load i32, i32* %18
%82 = add nsw i32 %81, 2
store i32 %82, i32* %18
br label %83
83: ; preds = %80, %74
%84 = load i32, i32* %11
%85 = load i32, i32* %18
%86 = add nsw i32 %84, %85
%87 = load i32, i32* %8
%88 = icmp sgt i32 %86, %87
br i1 %88, label %89, label %95
89: ; preds = %83
%90 = load i32, i32* %8
%91 = mul nsw i32 %90, 2
store i32 %91, i32* %8
%92 = load i8*, i8** %12
%93 = load i32, i32* %8
%94 = call i8* @realloc(i8* %92, i32 %93)
store i8* %94, i8** %12
br label %95
95: ; preds = %89, %83
%96 = load i8*, i8** %12
%97 = load i32, i32* %11
%98 = sext i32 %97 to i64
%99 = getelementptr inbounds i8, i8* %96, i64 %98
store i8 0, i8* %99
%100 = load i8*, i8** %12
%101 = load i8*, i8** %4
%102 = load i8*, i8** %17
%103 = load i8*, i8** %4
%104 = ptrtoint i8* %102 to i64
%105 = ptrtoint i8* %103 to i64
%106 = sub i64 %104, %105
%107 = trunc i64 %106 to i32
%108 = call i32 @strncat(i8* %100, i8* %101, i32 %107)
%109 = load i8*, i8** %17
%110 = load i8*, i8** %4
%111 = ptrtoint i8* %109 to i64
%112 = ptrtoint i8* %110 to i64
%113 = sub i64 %111, %112
%114 = load i32, i32* %11
%115 = sext i32 %114 to i64
%116 = add nsw i64 %115, %113
%117 = trunc i64 %116 to i32
store i32 %117, i32* %11
%118 = load i8*, i8** %17
store i8* %118, i8** %4
%119 = load i8*, i8** %12
%120 = load i32, i32* %11
%121 = sext i32 %120 to i64
%122 = getelementptr inbounds i8, i8* %119, i64 %121
store i8 0, i8* %122
%123 = load i8*, i8** %12
%124 = load i8*, i8** %6
%125 = call i32 @strcat(i8* %123, i8* %124)
%126 = load i32, i32* %10
%127 = load i32, i32* %11
%128 = add nsw i32 %127, %126
store i32 %128, i32* %11
%129 = load i32, i32* %18
%130 = load i8*, i8** %4
%131 = sext i32 %129 to i64
%132 = getelementptr inbounds i8, i8* %130, i64 %131
store i8* %132, i8** %4
store i8* null, i8** %16
store i8* null, i8** %15
br label %47
133: ; preds = %57
%134 = load i8*, i8** %12
%135 = load i8*, i8** %4
%136 = call i32 @strcat(i8* %134, i8* %135)
%137 = load i8*, i8** %12
ret i8* %137
}

LLVM IR (-O2):
@.str = [2 x i8] c"$\00"
@.str.1 = [3 x i8] c"${\00"
@.str.2 = [2 x i8] c"}\00"
define i8* @substitute(i8* %0, i8* %1, i8* %2) {
%4 = tail call i32 @strlen(i8* %0)
%5 = shl nsw i32 %4, 1
%6 = tail call i32 @strlen(i8* %1)
%7 = tail call i32 @strlen(i8* %2)
%8 = tail call i8* @calloc(i32 1, i32 %5)
%9 = add nsw i32 %6, 2
%10 = tail call i8* @calloc(i32 1, i32 %9)
%11 = add nsw i32 %6, 4
%12 = tail call i8* @calloc(i32 1, i32 %11)
%13 = tail call i32 @strcpy(i8* %10, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
%14 = tail call i32 @strcat(i8* %10, i8* %1)
%15 = tail call i32 @strcpy(i8* %12, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0))
%16 = tail call i32 @strcat(i8* %12, i8* %1)
%17 = tail call i32 @strcat(i8* %12, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.2, i64 0, i64 0))
br label %18
18: ; preds = %40, %3
%19 = phi i32 [ 0, %3 ], [ %54, %40 ]
%20 = phi i8* [ %8, %3 ], [ %41, %40 ]
%21 = phi i32 [ %5, %3 ], [ %42, %40 ]
%22 = phi i8* [ %0, %3 ], [ %56, %40 ]
%23 = tail call i8* @strstr(i8* dereferenceable(1) %22, i8* dereferenceable(1) %10)
%24 = icmp eq i8* %23, null
br i1 %24, label %25, label %28
25: ; preds = %18
%26 = tail call i8* @strstr(i8* dereferenceable(1) %22, i8* dereferenceable(1) %12)
%27 = icmp eq i8* %26, null
br i1 %27, label %57, label %28
28: ; preds = %25, %18
%29 = phi i8* [ %23, %18 ], [ %26, %25 ]
%30 = getelementptr inbounds i8, i8* %29, i64 1
%31 = load i8, i8* %30
%32 = icmp eq i8 %31, 123
%33 = select i1 %32, i32 3, i32 1
%34 = add nsw i32 %33, %6
%35 = add nsw i32 %34, %19
%36 = icmp sgt i32 %35, %21
br i1 %36, label %37, label %40
37: ; preds = %28
%38 = shl nsw i32 %21, 1
%39 = tail call i8* @realloc(i8* %20, i32 %38)
br label %40
40: ; preds = %37, %28
%41 = phi i8* [ %39, %37 ], [ %20, %28 ]
%42 = phi i32 [ %38, %37 ], [ %21, %28 ]
%43 = sext i32 %19 to i64
%44 = getelementptr inbounds i8, i8* %41, i64 %43
store i8 0, i8* %44
%45 = ptrtoint i8* %29 to i64
%46 = ptrtoint i8* %22 to i64
%47 = sub i64 %45, %46
%48 = trunc i64 %47 to i32
%49 = tail call i32 @strncat(i8* %41, i8* %22, i32 %48)
%50 = add i32 %19, %48
%51 = sext i32 %50 to i64
%52 = getelementptr inbounds i8, i8* %41, i64 %51
store i8 0, i8* %52
%53 = tail call i32 @strcat(i8* %41, i8* %2)
%54 = add nsw i32 %50, %7
%55 = sext i32 %34 to i64
%56 = getelementptr inbounds i8, i8* %29, i64 %55
br label %18
57: ; preds = %25
%58 = tail call i32 @strcat(i8* %20, i8* %22)
ret i8* %20
}