#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
char *malloc(int);
int /*<<< orphan*/ memcpy(char *, char *, int);
int /*<<< orphan*/ memset(char *, int /*<<< orphan*/, int);
int /*<<< orphan*/ printf(char *, double);
int /*<<< orphan*/ puts(char *);
double strtod(char *, int /*<<< orphan*/ *);
int do_test(void) {
  char *p = malloc(1 + 214748364 + sizeof("e-2147483649"));
  if (p == NULL) {
    puts("malloc failed, cannot test for overflow");
    return 0;
  }
  p[0] = '1';
  memset(p + 1, '0', 214748364);
  memcpy(p + 1 + 214748364, "e-2147483649", sizeof("e-2147483649"));
  double d = strtod(p, NULL);
  if (d != 0) {
    printf("strtod returned wrong value: %a\n", d);
    return 1;
  }
  return 0;
}


x86 assembly (clang, -O0):
<do_test>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    $0xcccccda,%edi
call   1080 <malloc@plt>
mov    %rax,-0x10(%rbp)
cmpq   $0x0,-0x10(%rbp)
jne    1199 <do_test+0x39>
lea    0xe78(%rip),%rdi
call   1030 <puts@plt>
movl   $0x0,-0x4(%rbp)
jmp    122a <do_test+0xca>
mov    -0x10(%rbp),%rax
movb   $0x31,(%rax)
mov    -0x10(%rbp),%rdi
add    $0x1,%rdi
mov    $0x30,%esi
mov    $0xccccccc,%edx
call   1060 <memset@plt>
mov    -0x10(%rbp),%rdi
add    $0x1,%rdi
add    $0xccccccc,%rdi
lea    0xe5b(%rip),%rsi
mov    $0xd,%edx
call   1070 <memcpy@plt>
mov    -0x10(%rbp),%rdi
xor    %eax,%eax
mov    %eax,%esi
call   1040 <strtod@plt>
movsd  %xmm0,-0x18(%rbp)
movsd  -0x18(%rbp),%xmm0
xorps  %xmm1,%xmm1
ucomisd %xmm1,%xmm0
jne    1206 <do_test+0xa6>
jp     1206 <do_test+0xa6>
jmp    1223 <do_test+0xc3>
movsd  -0x18(%rbp),%xmm0
lea    0xe23(%rip),%rdi
call   1050 <printf@plt>
movl   $0x1,-0x4(%rbp)
jmp    122a <do_test+0xca>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<do_test>:
push   %r14
push   %rbx
push   %rax
mov    $0xcccccda,%edi
call   1080 <malloc@plt>
test   %rax,%rax
je     11d4 <do_test+0x74>
mov    %rax,%rbx
movb   $0x31,(%rax)
lea    0x1(%rax),%rdi
mov    $0x30,%esi
mov    $0xccccccc,%edx
call   1060 <memset@plt>
mov    %rbx,%rdi
add    $0xccccccd,%rdi
lea    0xe8b(%rip),%rsi
mov    $0xd,%edx
call   1070 <memcpy@plt>
xor    %r14d,%r14d
mov    %rbx,%rdi
xor    %esi,%esi
call   1040 <strtod@plt>
xorpd  %xmm1,%xmm1
ucomisd %xmm1,%xmm0
jne    11c0 <do_test+0x60>
jnp    11e3 <do_test+0x83>
lea    0xe6e(%rip),%rdi
call   1050 <printf@plt>
mov    $0x1,%r14d
jmp    11e3 <do_test+0x83>
lea    0xe25(%rip),%rdi
call   1030 <puts@plt>
xor    %r14d,%r14d
mov    %r14d,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
@.str = [40 x i8] c"malloc failed, cannot test for overflow\00"
@.str.1 = [13 x i8] c"e-2147483649\00"
@.str.2 = [33 x i8] c"strtod returned wrong value: %a\0A\00"
define i32 @do_test() {
%1 = alloca i32
%2 = alloca i8*
%3 = alloca double
%4 = call i8* @malloc(i32 214748378)
store i8* %4, i8** %2
%5 = load i8*, i8** %2
%6 = icmp eq i8* %5, null
br i1 %6, label %7, label %9
7: ; preds = %0
%8 = call i32 @puts(i8* getelementptr inbounds ([40 x i8], [40 x i8]* @.str, i64 0, i64 0))
store i32 0, i32* %1
br label %27
9: ; preds = %0
%10 = load i8*, i8** %2
%11 = getelementptr inbounds i8, i8* %10, i64 0
store i8 49, i8* %11
%12 = load i8*, i8** %2
%13 = getelementptr inbounds i8, i8* %12, i64 1
%14 = call i32 @memset(i8* %13, i32 48, i32 214748364)
%15 = load i8*, i8** %2
%16 = getelementptr inbounds i8, i8* %15, i64 1
%17 = getelementptr inbounds i8, i8* %16, i64 214748364
%18 = call i32 @memcpy(i8* %17, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.1, i64 0, i64 0), i32 13)
%19 = load i8*, i8** %2
%20 = call double @strtod(i8* %19, i32* null)
store double %20, double* %3
%21 = load double, double* %3
%22 = fcmp une double %21, 0.000000e+00
br i1 %22, label %23, label %26
23: ; preds = %9
%24 = load double, double* %3
%25 = call i32 @printf(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.2, i64 0, i64 0), double %24)
store i32 1, i32* %1
br label %27
26: ; preds = %9
store i32 0, i32* %1
br label %27
27: ; preds = %26, %23, %7
%28 = load i32, i32* %1
ret i32 %28
}

LLVM IR (-O2):
@.str = [40 x i8] c"malloc failed, cannot test for overflow\00"
@.str.1 = [13 x i8] c"e-2147483649\00"
@.str.2 = [33 x i8] c"strtod returned wrong value: %a\0A\00"
define i32 @do_test() {
%1 = tail call dereferenceable_or_null(214748378) i8* @malloc(i32 214748378)
%2 = icmp eq i8* %1, null
br i1 %2, label %3, label %5
3: ; preds = %0
%4 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([40 x i8], [40 x i8]* @.str, i64 0, i64 0))
br label %14
5: ; preds = %0
store i8 49, i8* %1
%6 = getelementptr inbounds i8, i8* %1, i64 1
%7 = tail call i32 @memset(i8* %6, i32 48, i32 214748364)
%8 = getelementptr inbounds i8, i8* %1, i64 214748365
%9 = tail call i32 @memcpy(i8* %8, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.1, i64 0, i64 0), i32 13)
%10 = tail call double @strtod(i8* nocapture %1, i32* null)
%11 = fcmp une double %10, 0.000000e+00
br i1 %11, label %12, label %14
12: ; preds = %5
%13 = tail call i32 @printf(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.2, i64 0, i64 0), double %10)
br label %14
14: ; preds = %12, %5, %3
%15 = phi i32 [ 0, %3 ], [ 1, %12 ], [ 0, %5 ]
ret i32 %15
}