#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef scalar_t__ u_long;
typedef int u_int;

/* Variables and functions */
int /*<<< orphan*/ free(char *);
scalar_t__ malloc(int);
int /*<<< orphan*/ memset(char *, char, int);
int /*<<< orphan*/ printf(char *, char *, ...);
int main() {
  u_long diff;
  char *buf1 = (char *)malloc(16), *buf2 = (char *)malloc(16);
  diff = (u_long)buf2 - (u_long)buf1;
  printf("buf1 = %p, buf2 = %p, diff = 0x%lx bytes\n", buf1, buf2, diff);
  memset(buf2, 'A', 16 - 1);
  buf2[16 - 1] = '\0';
  printf("before overflow: buf2 = %s\n", buf2);
  memset(buf1, 'B', (u_int)(diff + 8));
  printf("after overflow: buf2 = %s\n", buf2);
  free(buf2);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0x10,%edi
call   1060 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    $0x10,%edi
call   1060 <malloc@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rax
mov    -0x18(%rbp),%rcx
sub    %rcx,%rax
mov    %rax,-0x10(%rbp)
mov    -0x18(%rbp),%rsi
mov    -0x20(%rbp),%rdx
mov    -0x10(%rbp),%rcx
lea    0xe73(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x20(%rbp),%rdi
mov    $0x41,%esi
mov    $0xf,%edx
call   1050 <memset@plt>
mov    -0x20(%rbp),%rax
movb   $0x0,0xf(%rax)
mov    -0x20(%rbp),%rsi
lea    0xe70(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x18(%rbp),%rdi
mov    -0x10(%rbp),%rax
add    $0x8,%rax
mov    %eax,%edx
mov    $0x42,%esi
call   1050 <memset@plt>
mov    -0x20(%rbp),%rsi
lea    0xe62(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x20(%rbp),%rdi
call   1030 <free@plt>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %rbx
mov    $0x10,%edi
call   1060 <malloc@plt>
mov    %rax,%r14
mov    $0x10,%edi
call   1060 <malloc@plt>
mov    %rax,%r15
mov    %rax,%rbx
sub    %r14,%rbx
lea    0xe94(%rip),%rdi
mov    %r14,%rsi
mov    %rax,%rdx
mov    %rbx,%rcx
xor    %eax,%eax
call   1040 <printf@plt>
mov    %r15,%rdi
mov    $0x41,%esi
mov    $0xf,%edx
call   1050 <memset@plt>
movb   $0x0,0xf(%r15)
lea    0xe90(%rip),%rdi
mov    %r15,%rsi
xor    %eax,%eax
call   1040 <printf@plt>
add    $0x8,%ebx
mov    %r14,%rdi
mov    $0x42,%esi
mov    %ebx,%edx
call   1050 <memset@plt>
lea    0xe89(%rip),%rdi
mov    %r15,%rsi
xor    %eax,%eax
call   1040 <printf@plt>
mov    %r15,%rdi
call   1030 <free@plt>
xor    %eax,%eax
pop    %rbx
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@.str = [42 x i8] c"buf1 = %p, buf2 = %p, diff = 0x%lx bytes\0A\00"
@.str.1 = [28 x i8] c"before overflow: buf2 = %s\0A\00"
@.str.2 = [27 x i8] c"after overflow: buf2 = %s\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i64
%3 = alloca i8*
%4 = alloca i8*
store i32 0, i32* %1
%5 = call i64 @malloc(i32 16)
%6 = inttoptr i64 %5 to i8*
store i8* %6, i8** %3
%7 = call i64 @malloc(i32 16)
%8 = inttoptr i64 %7 to i8*
store i8* %8, i8** %4
%9 = load i8*, i8** %4
%10 = ptrtoint i8* %9 to i64
%11 = load i8*, i8** %3
%12 = ptrtoint i8* %11 to i64
%13 = sub nsw i64 %10, %12
store i64 %13, i64* %2
%14 = load i8*, i8** %3
%15 = load i8*, i8** %4
%16 = load i64, i64* %2
%17 = call i32 (i8*, i8*, ...) @printf(i8* getelementptr inbounds ([42 x i8], [42 x i8]* @.str, i64 0, i64 0), i8* %14, i8* %15, i64 %16)
%18 = load i8*, i8** %4
%19 = call i32 @memset(i8* %18, i8 signext 65, i32 15)
%20 = load i8*, i8** %4
%21 = getelementptr inbounds i8, i8* %20, i64 15
store i8 0, i8* %21
%22 = load i8*, i8** %4
%23 = call i32 (i8*, i8*, ...) @printf(i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.1, i64 0, i64 0), i8* %22)
%24 = load i8*, i8** %3
%25 = load i64, i64* %2
%26 = add nsw i64 %25, 8
%27 = trunc i64 %26 to i32
%28 = call i32 @memset(i8* %24, i8 signext 66, i32 %27)
%29 = load i8*, i8** %4
%30 = call i32 (i8*, i8*, ...) @printf(i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.2, i64 0, i64 0), i8* %29)
%31 = load i8*, i8** %4
%32 = call i32 @free(i8* %31)
ret i32 0
}

LLVM IR (-O2):
@.str = [42 x i8] c"buf1 = %p, buf2 = %p, diff = 0x%lx bytes\0A\00"
@.str.1 = [28 x i8] c"before overflow: buf2 = %s\0A\00"
@.str.2 = [27 x i8] c"after overflow: buf2 = %s\0A\00"
define i32 @main() {
%1 = tail call i64 @malloc(i32 16)
%2 = inttoptr i64 %1 to i8*
%3 = tail call i64 @malloc(i32 16)
%4 = inttoptr i64 %3 to i8*
%5 = sub nsw i64 %3, %1
%6 = tail call i32 (i8*, i8*, ...) @printf(i8* getelementptr inbounds ([42 x i8], [42 x i8]* @.str, i64 0, i64 0), i8* %2, i8* %4, i64 %5)
%7 = tail call i32 @memset(i8* %4, i8 signext 65, i32 15)
%8 = getelementptr inbounds i8, i8* %4, i64 15
store i8 0, i8* %8
%9 = tail call i32 (i8*, i8*, ...) @printf(i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.1, i64 0, i64 0), i8* %4)
%10 = trunc i64 %5 to i32
%11 = add i32 %10, 8
%12 = tail call i32 @memset(i8* %2, i8 signext 66, i32 %11)
%13 = tail call i32 (i8*, i8*, ...) @printf(i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.2, i64 0, i64 0), i8* %4)
%14 = tail call i32 @free(i8* %4)
ret i32 0
}