#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ PROT_NONE;
int errno;
unsigned int getpagesize();
scalar_t__ malloc(int);
scalar_t__ mprotect(unsigned short *, unsigned int, int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *, ...);
int main() {
  unsigned int pagesize = getpagesize();
  unsigned short int *p, *p1, *p3, *eop2;
  p = (unsigned short int *)malloc(4 * pagesize);
  if (!p) {
    printf("malloc returned null pointer\n");
    return 0;
  }
  p1 = (unsigned short int *)(((int)p + pagesize - 1) & ~(pagesize - 1));
  p3 = (unsigned short int *)((int)p1 + 2 * pagesize);
  if (mprotect(p1, pagesize, PROT_NONE) < 0 ||
      mprotect(p3, pagesize, PROT_NONE) < 0) {
    printf("mprotect failed. errno = %d\n", errno);
    return 0;
  }
  eop2 = p3 - 1;
  *eop2 = 0x1234;
  printf("%X\n", *eop2);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0x0,%al
call   1060 <getpagesize@plt>
mov    %eax,-0x8(%rbp)
mov    -0x8(%rbp),%edi
shl    $0x2,%edi
call   1040 <malloc@plt>
mov    %rax,-0x10(%rbp)
cmpq   $0x0,-0x10(%rbp)
jne    118d <main+0x4d>
lea    0xe86(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
movl   $0x0,-0x4(%rbp)
jmp    124c <main+0x10c>
mov    -0x10(%rbp),%rax
add    -0x8(%rbp),%eax
sub    $0x1,%eax
mov    -0x8(%rbp),%ecx
sub    $0x1,%ecx
xor    $0xffffffff,%ecx
and    %ecx,%eax
mov    %eax,%eax
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rax
mov    -0x8(%rbp),%ecx
shl    $0x1,%ecx
add    %ecx,%eax
mov    %eax,%eax
mov    %rax,-0x20(%rbp)
mov    -0x18(%rbp),%rdi
mov    -0x8(%rbp),%esi
mov    0x2e28(%rip),%rax
mov    (%rax),%edx
call   1050 <mprotect@plt>
cmp    $0x0,%rax
jl     11f8 <main+0xb8>
mov    -0x20(%rbp),%rdi
mov    -0x8(%rbp),%esi
mov    0x2e09(%rip),%rax
mov    (%rax),%edx
call   1050 <mprotect@plt>
cmp    $0x0,%rax
jge    121b <main+0xdb>
mov    0x2dd9(%rip),%rax
mov    (%rax),%esi
lea    0xe16(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
movl   $0x0,-0x4(%rbp)
jmp    124c <main+0x10c>
mov    -0x20(%rbp),%rax
add    $0xfffffffffffffffe,%rax
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
movw   $0x1234,(%rax)
mov    -0x28(%rbp),%rax
movzwl (%rax),%esi
lea    0xdfd(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %rbx
xor    %eax,%eax
call   1070 <getpagesize@plt>
mov    %eax,%r14d
lea    0x0(,%r14,4),%edi
call   1050 <malloc@plt>
test   %rax,%rax
je     11c3 <main+0x73>
add    %r14d,%eax
add    $0xffffffff,%eax
mov    %r14d,%ebx
neg    %ebx
and    %eax,%ebx
mov    0x2e6b(%rip),%r15
mov    (%r15),%edx
mov    %rbx,%rdi
mov    %r14d,%esi
call   1060 <mprotect@plt>
test   %rax,%rax
js     11d1 <main+0x81>
lea    (%rbx,%r14,2),%ebx
mov    (%r15),%edx
mov    %rbx,%rdi
mov    %r14d,%esi
call   1060 <mprotect@plt>
test   %rax,%rax
js     11d1 <main+0x81>
movw   $0x1234,-0x2(%rbx)
lea    0xe61(%rip),%rdi
mov    $0x1234,%esi
jmp    11e1 <main+0x91>
lea    0xe57(%rip),%rdi
call   1030 <puts@plt>
jmp    11e8 <main+0x98>
mov    0x2e00(%rip),%rax
mov    (%rax),%esi
lea    0xe1f(%rip),%rdi
xor    %eax,%eax
call   1040 <printf@plt>
xor    %eax,%eax
pop    %rbx
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@.str = [30 x i8] c"malloc returned null pointer\0A\00"
@PROT_NONE = global i32 0
@.str.1 = [29 x i8] c"mprotect failed. errno = %d\0A\00"
@errno = global i32 0
@.str.2 = [4 x i8] c"%X\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i32
%3 = alloca i16*
%4 = alloca i16*
%5 = alloca i16*
%6 = alloca i16*
store i32 0, i32* %1
%7 = call i32 (...) @getpagesize()
store i32 %7, i32* %2
%8 = load i32, i32* %2
%9 = mul i32 4, %8
%10 = call i64 @malloc(i32 %9)
%11 = inttoptr i64 %10 to i16*
store i16* %11, i16** %3
%12 = load i16*, i16** %3
%13 = icmp ne i16* %12, null
br i1 %13, label %16, label %14
14: ; preds = %0
%15 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str, i64 0, i64 0))
store i32 0, i32* %1
br label %57
16: ; preds = %0
%17 = load i16*, i16** %3
%18 = ptrtoint i16* %17 to i32
%19 = load i32, i32* %2
%20 = add i32 %18, %19
%21 = sub i32 %20, 1
%22 = load i32, i32* %2
%23 = sub i32 %22, 1
%24 = xor i32 %23, -1
%25 = and i32 %21, %24
%26 = zext i32 %25 to i64
%27 = inttoptr i64 %26 to i16*
store i16* %27, i16** %4
%28 = load i16*, i16** %4
%29 = ptrtoint i16* %28 to i32
%30 = load i32, i32* %2
%31 = mul i32 2, %30
%32 = add i32 %29, %31
%33 = zext i32 %32 to i64
%34 = inttoptr i64 %33 to i16*
store i16* %34, i16** %5
%35 = load i16*, i16** %4
%36 = load i32, i32* %2
%37 = load i32, i32* @PROT_NONE
%38 = call i64 @mprotect(i16* %35, i32 %36, i32 %37)
%39 = icmp slt i64 %38, 0
br i1 %39, label %46, label %40
40: ; preds = %16
%41 = load i16*, i16** %5
%42 = load i32, i32* %2
%43 = load i32, i32* @PROT_NONE
%44 = call i64 @mprotect(i16* %41, i32 %42, i32 %43)
%45 = icmp slt i64 %44, 0
br i1 %45, label %46, label %49
46: ; preds = %40, %16
%47 = load i32, i32* @errno
%48 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.1, i64 0, i64 0), i32 %47)
store i32 0, i32* %1
br label %57
49: ; preds = %40
%50 = load i16*, i16** %5
%51 = getelementptr inbounds i16, i16* %50, i64 -1
store i16* %51, i16** %6
%52 = load i16*, i16** %6
store i16 4660, i16* %52
%53 = load i16*, i16** %6
%54 = load i16, i16* %53
%55 = zext i16 %54 to i32
%56 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.2, i64 0, i64 0), i32 %55)
store i32 0, i32* %1
br label %57
57: ; preds = %49, %46, %14
%58 = load i32, i32* %1
ret i32 %58
}

LLVM IR (-O2):
@PROT_NONE = global i32 0
@.str.1 = [29 x i8] c"mprotect failed. errno = %d\0A\00"
@errno = global i32 0
@.str.2 = [4 x i8] c"%X\0A\00"
@str = [29 x i8] c"malloc returned null pointer\00"
define i32 @main() {
%1 = tail call i32 (...) @getpagesize()
%2 = shl i32 %1, 2
%3 = tail call i64 @malloc(i32 %2)
%4 = icmp eq i64 %3, 0
br i1 %4, label %5, label %7
5: ; preds = %0
%6 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([29 x i8], [29 x i8]* @str, i64 0, i64 0))
br label %32
7: ; preds = %0
%8 = trunc i64 %3 to i32
%9 = add i32 %1, -1
%10 = add i32 %9, %8
%11 = sub i32 0, %1
%12 = and i32 %10, %11
%13 = zext i32 %12 to i64
%14 = inttoptr i64 %13 to i16*
%15 = shl i32 %1, 1
%16 = add i32 %12, %15
%17 = zext i32 %16 to i64
%18 = inttoptr i64 %17 to i16*
%19 = load i32, i32* @PROT_NONE
%20 = tail call i64 @mprotect(i16* %14, i32 %1, i32 %19)
%21 = icmp slt i64 %20, 0
br i1 %21, label %26, label %22
22: ; preds = %7
%23 = load i32, i32* @PROT_NONE
%24 = tail call i64 @mprotect(i16* %18, i32 %1, i32 %23)
%25 = icmp slt i64 %24, 0
br i1 %25, label %26, label %29
26: ; preds = %22, %7
%27 = load i32, i32* @errno
%28 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([29 x i8], [29 x i8]* @.str.1, i64 0, i64 0), i32 %27)
br label %32
29: ; preds = %22
%30 = getelementptr inbounds i16, i16* %18, i64 -1
store i16 4660, i16* %30
%31 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([4 x i8], [4 x i8]* @.str.2, i64 0, i64 0), i32 4660)
br label %32
32: ; preds = %29, %26, %5
ret i32 0
}