int main(int argc, char *argv[]) {
  char text[1024];
  static int test_val = -72, next_val = 0x11111111;
  if (argc < 2) {
    printf("Usage: %s <text to print>\n", argv[0]);
    exit(0);
  }
  strcpy(text, argv[1]);
  printf("The right way to print user-controlled input:\n");
  printf("%s", text);
  printf("\nThe wrong way to print user-controlled input:\n");
  printf(text);
  printf("\n");
  printf("[*] test_val @ 0x%08x = %d 0x%08x\n", &test_val, test_val, test_val);
  printf("[*] next_val @ 0x%08x = %d 0x%08x\n", &next_val, next_val, next_val);
  exit(0);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x410,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
cmpl   $0x2,-0x8(%rbp)
jge    116f <main+0x3f>
mov    -0x10(%rbp),%rax
mov    (%rax),%rsi
lea    0xe9f(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
xor    %edi,%edi
call   1050 <exit@plt>
lea    -0x410(%rbp),%rdi
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rsi
call   1030 <strcpy@plt>
lea    0xe91(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x410(%rbp),%rsi
lea    0xeab(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    0xea0(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x410(%rbp),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    0xeb2(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    0x2e62(%rip),%edx
mov    0x2e5c(%rip),%ecx
lea    0xe9a(%rip),%rdi
lea    0x2e4e(%rip),%rsi
mov    $0x0,%al
call   1040 <printf@plt>
mov    0x2e45(%rip),%edx
mov    0x2e3f(%rip),%ecx
lea    0xe9c(%rip),%rdi
lea    0x2e31(%rip),%rsi
mov    $0x0,%al
call   1040 <printf@plt>
xor    %edi,%edi
call   1050 <exit@plt>

x86 assembly (clang, -O2):
<main>:
push   %rbx
sub    $0x400,%rsp
cmp    $0x1,%edi
jg     1175 <main+0x25>
mov    (%rsi),%rsi
lea    0xe99(%rip),%rdi
xor    %eax,%eax
call   1060 <printf@plt>
xor    %edi,%edi
call   1070 <exit@plt>
mov    0x8(%rsi),%rsi
mov    %rsp,%rbx
mov    %rbx,%rdi
call   1040 <strcpy@plt>
lea    0xed9(%rip),%rdi
call   1050 <puts@plt>
lea    0xe84(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1060 <printf@plt>
lea    0xeea(%rip),%rdi
call   1050 <puts@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1060 <printf@plt>
mov    $0xa,%edi
call   1030 <putchar@plt>
mov    0x2e81(%rip),%ecx
lea    0x2e7a(%rip),%rsi
lea    0xe49(%rip),%rdi
mov    %ecx,%edx
xor    %eax,%eax
call   1060 <printf@plt>
mov    0x2e68(%rip),%ecx
lea    0x2e61(%rip),%rsi
lea    0xe4f(%rip),%rdi
mov    %ecx,%edx
xor    %eax,%eax
call   1060 <printf@plt>
xor    %edi,%edi
call   1070 <exit@plt>

LLVM IR (-O0):
@main.test_val = internal global i32 -72
@main.next_val = internal global i32 286331153
@.str = [27 x i8] c"Usage: %s <text to print>\0A\00"
@.str.1 = [47 x i8] c"The right way to print user-controlled input:\0A\00"
@.str.2 = [3 x i8] c"%s\00"
@.str.3 = [48 x i8] c"\0AThe wrong way to print user-controlled input:\0A\00"
@.str.4 = [2 x i8] c"\0A\00"
@.str.5 = [35 x i8] c"[*] test_val @ 0x%08x = %d 0x%08x\0A\00"
@.str.6 = [35 x i8] c"[*] next_val @ 0x%08x = %d 0x%08x\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca [1024 x i8]
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%7 = load i32, i32* %4
%8 = icmp slt i32 %7, 2
br i1 %8, label %9, label %14
9: ; preds = %2
%10 = load i8**, i8*** %5
%11 = getelementptr inbounds i8*, i8** %10, i64 0
%12 = load i8*, i8** %11
%13 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str, i64 0, i64 0), i8* %12)
unreachable
14: ; preds = %2
%15 = getelementptr inbounds [1024 x i8], [1024 x i8]* %6, i64 0, i64 0
%16 = load i8**, i8*** %5
%17 = getelementptr inbounds i8*, i8** %16, i64 1
%18 = load i8*, i8** %17
%19 = call i8* @strcpy(i8* %15, i8* %18)
%20 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([47 x i8], [47 x i8]* @.str.1, i64 0, i64 0))
%21 = getelementptr inbounds [1024 x i8], [1024 x i8]* %6, i64 0, i64 0
%22 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i8* %21)
%23 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([48 x i8], [48 x i8]* @.str.3, i64 0, i64 0))
%24 = getelementptr inbounds [1024 x i8], [1024 x i8]* %6, i64 0, i64 0
%25 = call i32 (i8*, ...) @printf(i8* %24)
%26 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.4, i64 0, i64 0))
%27 = load i32, i32* @main.test_val
%28 = load i32, i32* @main.test_val
%29 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([35 x i8], [35 x i8]* @.str.5, i64 0, i64 0), i32* @main.test_val, i32 %27, i32 %28)
%30 = load i32, i32* @main.next_val
%31 = load i32, i32* @main.next_val
%32 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([35 x i8], [35 x i8]* @.str.6, i64 0, i64 0), i32* @main.next_val, i32 %30, i32 %31)
unreachable
}

LLVM IR (-O2):
@main.test_val = internal global i32 -72
@main.next_val = internal global i32 286331153
@.str = [27 x i8] c"Usage: %s <text to print>\0A\00"
@.str.2 = [3 x i8] c"%s\00"
@.str.5 = [35 x i8] c"[*] test_val @ 0x%08x = %d 0x%08x\0A\00"
@.str.6 = [35 x i8] c"[*] next_val @ 0x%08x = %d 0x%08x\0A\00"
@str = [46 x i8] c"The right way to print user-controlled input:\00"
@str.7 = [47 x i8] c"\0AThe wrong way to print user-controlled input:\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca [1024 x i8]
%4 = getelementptr inbounds [1024 x i8], [1024 x i8]* %3, i64 0, i64 0
%5 = icmp slt i32 %0, 2
br i1 %5, label %6, label %9
6: ; preds = %2
%7 = load i8*, i8** %1
%8 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([27 x i8], [27 x i8]* @.str, i64 0, i64 0), i8* %7)
tail call void @exit(i32 0)
unreachable
9: ; preds = %2
%10 = getelementptr inbounds i8*, i8** %1, i64 1
%11 = load i8*, i8** %10
%12 = call i8* @strcpy(i8* %4, i8* dereferenceable(1) %11)
%13 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([46 x i8], [46 x i8]* @str, i64 0, i64 0))
%14 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i8* %4)
%15 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([47 x i8], [47 x i8]* @str.7, i64 0, i64 0))
%16 = call i32 (i8*, ...) @printf(i8* %4)
%17 = call i32 @putchar(i32 10)
%18 = load i32, i32* @main.test_val
%19 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([35 x i8], [35 x i8]* @.str.5, i64 0, i64 0), i32* @main.test_val, i32 %18, i32 %18)
%20 = load i32, i32* @main.next_val
%21 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([35 x i8], [35 x i8]* @.str.6, i64 0, i64 0), i32* @main.next_val, i32 %20, i32 %20)
unreachable
}