int main(void) {
  char *dest = (char *)malloc(sizeof(char) * 12);
  sprintf(dest, "hello");
  printf("dest capacity is %d\n", 12);
  printf("strlen(dest) = %lu\n", strlen(dest));
  printf("bytes used in dest (including null byte) = %lu\n", strlen(dest) + 1);
  printf("bytes unused in dest = %lu\n", 12 - strlen(dest) - 1);
  int n = 12 - strlen(dest) - 1;
  printf("we are using n = %zu\n", 12 - strlen(dest) - 1);
  strncat(dest, " world", n);
  printf("%s\n", dest);
  sprintf(dest, "hello");
  strncat(dest, " world", 12 - strlen(dest) - 2);
  printf("%s (destination not large enough)\n", dest);
  sprintf(dest, "hello");
  strncat(dest, " worldX", 12 - strlen(dest));
  printf("%s (WRONG - malloc)\n", dest);
  char destStack[12];
  sprintf(destStack, "hello");
  strncat(destStack, " worldX", 12 - strlen(destStack));
  printf("%s (WRONG - stack)\n", destStack);
  free(dest);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0xc,%edi
call   1070 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rdi
lea    0xe78(%rip),%rsi
mov    $0x0,%al
call   1080 <sprintf@plt>
lea    0xe70(%rip),%rdi
mov    $0xc,%esi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x10(%rbp),%rdi
call   1040 <strlen@plt>
mov    %rax,%rsi
lea    0xe66(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x10(%rbp),%rdi
call   1040 <strlen@plt>
mov    %rax,%rsi
add    $0x1,%rsi
lea    0xe5c(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x10(%rbp),%rdi
call   1040 <strlen@plt>
mov    $0xc,%esi
sub    %rax,%rsi
sub    $0x1,%rsi
lea    0xe69(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x10(%rbp),%rdi
call   1040 <strlen@plt>
mov    %rax,%rcx
mov    $0xc,%eax
sub    %rcx,%rax
sub    $0x1,%rax
mov    %eax,-0x14(%rbp)
mov    -0x10(%rbp),%rdi
call   1040 <strlen@plt>
mov    $0xc,%esi
sub    %rax,%rsi
sub    $0x1,%rsi
lea    0xe47(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x10(%rbp),%rdi
movslq -0x14(%rbp),%rdx
lea    0xe47(%rip),%rsi
call   1060 <strncat@plt>
mov    -0x10(%rbp),%rsi
lea    0xe3e(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x10(%rbp),%rdi
lea    0xd94(%rip),%rsi
mov    $0x0,%al
call   1080 <sprintf@plt>
mov    -0x10(%rbp),%rax
mov    %rax,-0x38(%rbp)
mov    -0x10(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x38(%rbp),%rdi
mov    $0xc,%edx
sub    %rax,%rdx
sub    $0x2,%rdx
lea    0xdf6(%rip),%rsi
call   1060 <strncat@plt>
mov    -0x10(%rbp),%rsi
lea    0xdf1(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x10(%rbp),%rdi
lea    0xd43(%rip),%rsi
mov    $0x0,%al
call   1080 <sprintf@plt>
mov    -0x10(%rbp),%rax
mov    %rax,-0x30(%rbp)
mov    -0x10(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x30(%rbp),%rdi
mov    $0xc,%edx
sub    %rax,%rdx
lea    0xdd7(%rip),%rsi
call   1060 <strncat@plt>
mov    -0x10(%rbp),%rsi
lea    0xdcf(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    -0x20(%rbp),%rdi
lea    0xcf6(%rip),%rsi
mov    $0x0,%al
call   1080 <sprintf@plt>
lea    -0x20(%rbp),%rax
mov    %rax,-0x28(%rbp)
lea    -0x20(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x28(%rbp),%rdi
mov    $0xc,%edx
sub    %rax,%rdx
lea    0xd8a(%rip),%rsi
call   1060 <strncat@plt>
lea    -0x20(%rbp),%rsi
lea    0xd97(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x10(%rbp),%rdi
call   1030 <free@plt>
xor    %eax,%eax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    $0xc,%r14d
mov    $0xc,%edi
call   1080 <malloc@plt>
mov    %rax,%rbx
movl   $0x6c6c6568,(%rax)
movw   $0x6f,0x4(%rax)
lea    0xe75(%rip),%rdi
mov    $0xc,%esi
xor    %eax,%eax
call   1060 <printf@plt>
mov    %rbx,%rdi
call   1050 <strlen@plt>
lea    0xe6f(%rip),%rdi
mov    %rax,%rsi
xor    %eax,%eax
call   1060 <printf@plt>
mov    %rbx,%rdi
call   1050 <strlen@plt>
lea    0x1(%rax),%rsi
lea    0xe66(%rip),%rdi
xor    %eax,%eax
call   1060 <printf@plt>
mov    %rbx,%rdi
call   1050 <strlen@plt>
mov    $0xb,%r15d
mov    $0xb,%esi
sub    %rax,%rsi
lea    0xe72(%rip),%rdi
xor    %eax,%eax
call   1060 <printf@plt>
mov    %rbx,%rdi
call   1050 <strlen@plt>
sub    %rax,%r15
lea    0xe75(%rip),%rdi
mov    %r15,%rsi
xor    %eax,%eax
call   1060 <printf@plt>
movslq %r15d,%rdx
lea    0xe77(%rip),%r15
mov    %rbx,%rdi
mov    %r15,%rsi
call   1070 <strncat@plt>
mov    %rbx,%rdi
call   1040 <puts@plt>
movl   $0x6c6c6568,(%rbx)
movw   $0x6f,0x4(%rbx)
mov    %rbx,%rdi
call   1050 <strlen@plt>
mov    $0xa,%edx
sub    %rax,%rdx
mov    %rbx,%rdi
mov    %r15,%rsi
call   1070 <strncat@plt>
lea    0xe3d(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1060 <printf@plt>
movl   $0x6c6c6568,(%rbx)
movw   $0x6f,0x4(%rbx)
mov    %rbx,%rdi
call   1050 <strlen@plt>
mov    $0xc,%edx
sub    %rax,%rdx
lea    0xe33(%rip),%r15
mov    %rbx,%rdi
mov    %r15,%rsi
call   1070 <strncat@plt>
lea    0xe29(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1060 <printf@plt>
movw   $0x6f,0x10(%rsp)
movl   $0x6c6c6568,0xc(%rsp)
6c
lea    0xc(%rsp),%r12
mov    %r12,%rdi
call   1050 <strlen@plt>
sub    %rax,%r14
mov    %r12,%rdi
mov    %r15,%rsi
mov    %r14,%rdx
call   1070 <strncat@plt>
lea    0xe00(%rip),%rdi
mov    %r12,%rsi
xor    %eax,%eax
call   1060 <printf@plt>
mov    %rbx,%rdi
call   1030 <free@plt>
xor    %eax,%eax
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@.str = [6 x i8] c"hello\00"
@.str.1 = [21 x i8] c"dest capacity is %d\0A\00"
@.str.2 = [20 x i8] c"strlen(dest) = %lu\0A\00"
@.str.3 = [48 x i8] c"bytes used in dest (including null byte) = %lu\0A\00"
@.str.4 = [28 x i8] c"bytes unused in dest = %lu\0A\00"
@.str.5 = [22 x i8] c"we are using n = %zu\0A\00"
@.str.6 = [7 x i8] c" world\00"
@.str.7 = [4 x i8] c"%s\0A\00"
@.str.8 = [35 x i8] c"%s (destination not large enough)\0A\00"
@.str.9 = [8 x i8] c" worldX\00"
@.str.10 = [21 x i8] c"%s (WRONG - malloc)\0A\00"
@.str.11 = [20 x i8] c"%s (WRONG - stack)\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i8*
%3 = alloca i32
%4 = alloca [12 x i8]
store i32 0, i32* %1
%5 = call i8* @malloc(i64 12)
store i8* %5, i8** %2
%6 = load i8*, i8** %2
%7 = call i32 (i8*, i8*, ...) @sprintf(i8* %6, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0))
%8 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.1, i64 0, i64 0), i32 12)
%9 = load i8*, i8** %2
%10 = call i64 @strlen(i8* %9)
%11 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0), i64 %10)
%12 = load i8*, i8** %2
%13 = call i64 @strlen(i8* %12)
%14 = add i64 %13, 1
%15 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([48 x i8], [48 x i8]* @.str.3, i64 0, i64 0), i64 %14)
%16 = load i8*, i8** %2
%17 = call i64 @strlen(i8* %16)
%18 = sub i64 12, %17
%19 = sub i64 %18, 1
%20 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.4, i64 0, i64 0), i64 %19)
%21 = load i8*, i8** %2
%22 = call i64 @strlen(i8* %21)
%23 = sub i64 12, %22
%24 = sub i64 %23, 1
%25 = trunc i64 %24 to i32
store i32 %25, i32* %3
%26 = load i8*, i8** %2
%27 = call i64 @strlen(i8* %26)
%28 = sub i64 12, %27
%29 = sub i64 %28, 1
%30 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.5, i64 0, i64 0), i64 %29)
%31 = load i8*, i8** %2
%32 = load i32, i32* %3
%33 = sext i32 %32 to i64
%34 = call i8* @strncat(i8* %31, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.6, i64 0, i64 0), i64 %33)
%35 = load i8*, i8** %2
%36 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.7, i64 0, i64 0), i8* %35)
%37 = load i8*, i8** %2
%38 = call i32 (i8*, i8*, ...) @sprintf(i8* %37, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0))
%39 = load i8*, i8** %2
%40 = load i8*, i8** %2
%41 = call i64 @strlen(i8* %40)
%42 = sub i64 12, %41
%43 = sub i64 %42, 2
%44 = call i8* @strncat(i8* %39, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.6, i64 0, i64 0), i64 %43)
%45 = load i8*, i8** %2
%46 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([35 x i8], [35 x i8]* @.str.8, i64 0, i64 0), i8* %45)
%47 = load i8*, i8** %2
%48 = call i32 (i8*, i8*, ...) @sprintf(i8* %47, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0))
%49 = load i8*, i8** %2
%50 = load i8*, i8** %2
%51 = call i64 @strlen(i8* %50)
%52 = sub i64 12, %51
%53 = call i8* @strncat(i8* %49, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.9, i64 0, i64 0), i64 %52)
%54 = load i8*, i8** %2
%55 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.10, i64 0, i64 0), i8* %54)
%56 = getelementptr inbounds [12 x i8], [12 x i8]* %4, i64 0, i64 0
%57 = call i32 (i8*, i8*, ...) @sprintf(i8* %56, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0))
%58 = getelementptr inbounds [12 x i8], [12 x i8]* %4, i64 0, i64 0
%59 = getelementptr inbounds [12 x i8], [12 x i8]* %4, i64 0, i64 0
%60 = call i64 @strlen(i8* %59)
%61 = sub i64 12, %60
%62 = call i8* @strncat(i8* %58, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.9, i64 0, i64 0), i64 %61)
%63 = getelementptr inbounds [12 x i8], [12 x i8]* %4, i64 0, i64 0
%64 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.11, i64 0, i64 0), i8* %63)
%65 = load i8*, i8** %2
ret i32 0
}

LLVM IR (-O2):
@.str = [6 x i8] c"hello\00"
@.str.1 = [21 x i8] c"dest capacity is %d\0A\00"
@.str.2 = [20 x i8] c"strlen(dest) = %lu\0A\00"
@.str.3 = [48 x i8] c"bytes used in dest (including null byte) = %lu\0A\00"
@.str.4 = [28 x i8] c"bytes unused in dest = %lu\0A\00"
@.str.5 = [22 x i8] c"we are using n = %zu\0A\00"
@.str.6 = [7 x i8] c" world\00"
@.str.8 = [35 x i8] c"%s (destination not large enough)\0A\00"
@.str.9 = [8 x i8] c" worldX\00"
@.str.10 = [21 x i8] c"%s (WRONG - malloc)\0A\00"
@.str.11 = [20 x i8] c"%s (WRONG - stack)\0A\00"
define i32 @main() {
%1 = alloca [12 x i8]
%2 = tail call dereferenceable_or_null(12) i8* @malloc(i64 12)
tail call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 1 dereferenceable(6) %2, i8* align 1 dereferenceable(6) getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i64 6, i1 false)
%3 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([21 x i8], [21 x i8]* @.str.1, i64 0, i64 0), i32 12)
%4 = tail call i64 @strlen(i8* dereferenceable(1) %2)
%5 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0), i64 %4)
%6 = tail call i64 @strlen(i8* dereferenceable(1) %2)
%7 = add i64 %6, 1
%8 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([48 x i8], [48 x i8]* @.str.3, i64 0, i64 0), i64 %7)
%9 = tail call i64 @strlen(i8* dereferenceable(1) %2)
%10 = sub i64 11, %9
%11 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([28 x i8], [28 x i8]* @.str.4, i64 0, i64 0), i64 %10)
%12 = tail call i64 @strlen(i8* dereferenceable(1) %2)
%13 = sub i64 11, %12
%14 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([22 x i8], [22 x i8]* @.str.5, i64 0, i64 0), i64 %13)
%15 = shl i64 %13, 32
%16 = ashr exact i64 %15, 32
%17 = tail call i8* @strncat(i8* dereferenceable(1) %2, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.6, i64 0, i64 0), i64 %16)
%18 = tail call i32 @puts(i8* dereferenceable(1) %2)
tail call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 1 dereferenceable(6) %2, i8* align 1 dereferenceable(6) getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i64 6, i1 false)
%19 = tail call i64 @strlen(i8* dereferenceable(1) %2)
%20 = sub i64 10, %19
%21 = tail call i8* @strncat(i8* dereferenceable(1) %2, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.6, i64 0, i64 0), i64 %20)
%22 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([35 x i8], [35 x i8]* @.str.8, i64 0, i64 0), i8* %2)
tail call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 1 dereferenceable(6) %2, i8* align 1 dereferenceable(6) getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i64 6, i1 false)
%23 = tail call i64 @strlen(i8* dereferenceable(1) %2)
%24 = sub i64 12, %23
%25 = tail call i8* @strncat(i8* dereferenceable(1) %2, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.9, i64 0, i64 0), i64 %24)
%26 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([21 x i8], [21 x i8]* @.str.10, i64 0, i64 0), i8* %2)
%27 = getelementptr inbounds [12 x i8], [12 x i8]* %1, i64 0, i64 0
%28 = call i64 @strlen(i8* %27)
%29 = sub i64 12, %28
%30 = call i8* @strncat(i8* %27, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.9, i64 0, i64 0), i64 %29)
%31 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str.11, i64 0, i64 0), i8* %27)
ret i32 0
}