#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ free(char *);
char *malloc(int);
int /*<<< orphan*/ test4_heap_overflow(char *);
int /*<<< orphan*/ test5_stack_overflow();
int main(int ac, const char *av[]) {
  char *buff1 = NULL, *buff2 = NULL;
  int i = 0;
  buff1 = malloc(32);
  buff2 = malloc(32);
  if (!buff1 || !buff2)
    return -1;
  for (i = 0; i <= 32; i++)
    buff1[i] = 'A';
  for (i = 0; i <= 32; i++)
    buff2[i] = 'B';
  free(buff1);
  buff1[16] = 'C';
  buff1 = malloc(32);
  buff1[16] = 'C';
  test4_heap_overflow(buff1);
  test5_stack_overflow();
  free(buff2);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movq   $0x0,-0x18(%rbp)
movq   $0x0,-0x20(%rbp)
movl   $0x0,-0x24(%rbp)
mov    $0x20,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    $0x20,%edi
call   1050 <malloc@plt>
mov    %rax,-0x20(%rbp)
cmpq   $0x0,-0x18(%rbp)
je     119f <main+0x5f>
cmpq   $0x0,-0x20(%rbp)
jne    11ab <main+0x6b>
movl   $0xffffffff,-0x4(%rbp)
jmp    1248 <main+0x108>
movl   $0x0,-0x24(%rbp)
cmpl   $0x20,-0x24(%rbp)
jg     11d6 <main+0x96>
mov    -0x18(%rbp),%rax
movslq -0x24(%rbp),%rcx
movb   $0x41,(%rax,%rcx,1)
mov    -0x24(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x24(%rbp)
jmp    11b2 <main+0x72>
movl   $0x0,-0x24(%rbp)
cmpl   $0x20,-0x24(%rbp)
jg     1201 <main+0xc1>
mov    -0x20(%rbp),%rax
movslq -0x24(%rbp),%rcx
movb   $0x42,(%rax,%rcx,1)
mov    -0x24(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x24(%rbp)
jmp    11dd <main+0x9d>
mov    -0x18(%rbp),%rdi
call   1030 <free@plt>
mov    -0x18(%rbp),%rax
movb   $0x43,0x10(%rax)
mov    $0x20,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rax
movb   $0x43,0x10(%rax)
mov    -0x18(%rbp),%rdi
call   1060 <test4_heap_overflow@plt>
mov    $0x0,%al
call   1040 <test5_stack_overflow@plt>
mov    -0x20(%rbp),%rdi
call   1030 <free@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r14
push   %rbx
mov    $0x20,%edi
call   1050 <malloc@plt>
mov    %rax,%rbx
mov    $0x20,%edi
call   1050 <malloc@plt>
mov    $0xffffffff,%ebp
test   %rbx,%rbx
je     11c7 <main+0x87>
mov    %rax,%r14
test   %rax,%rax
je     11c7 <main+0x87>
movaps 0xe8c(%rip),%xmm0
movups %xmm0,0x10(%rbx)
movups %xmm0,(%rbx)
movb   $0x41,0x20(%rbx)
movaps 0xe8a(%rip),%xmm0
movups %xmm0,0x10(%r14)
movups %xmm0,(%r14)
movb   $0x42,0x20(%r14)
mov    %rbx,%rdi
call   1030 <free@plt>
movb   $0x43,0x10(%rbx)
mov    $0x20,%edi
call   1050 <malloc@plt>
movb   $0x43,0x10(%rax)
mov    %rax,%rdi
call   1060 <test4_heap_overflow@plt>
xor    %ebp,%ebp
xor    %eax,%eax
call   1040 <test5_stack_overflow@plt>
mov    %r14,%rdi
call   1030 <free@plt>
mov    %ebp,%eax
pop    %rbx
pop    %r14
pop    %rbp
ret

LLVM IR (-O0):
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i8* null, i8** %6
store i8* null, i8** %7
store i32 0, i32* %8
%9 = call i8* @malloc(i32 32)
store i8* %9, i8** %6
%10 = call i8* @malloc(i32 32)
store i8* %10, i8** %7
%11 = load i8*, i8** %6
%12 = icmp ne i8* %11, null
br i1 %12, label %13, label %16
13: ; preds = %2
%14 = load i8*, i8** %7
%15 = icmp ne i8* %14, null
br i1 %15, label %17, label %16
16: ; preds = %13, %2
store i32 -1, i32* %3
br label %54
17: ; preds = %13
store i32 0, i32* %8
br label %18
18: ; preds = %26, %17
%19 = load i32, i32* %8
%20 = icmp sle i32 %19, 32
br i1 %20, label %21, label %29
21: ; preds = %18
%22 = load i8*, i8** %6
%23 = load i32, i32* %8
%24 = sext i32 %23 to i64
%25 = getelementptr inbounds i8, i8* %22, i64 %24
store i8 65, i8* %25
br label %26
26: ; preds = %21
%27 = load i32, i32* %8
%28 = add nsw i32 %27, 1
store i32 %28, i32* %8
br label %18
29: ; preds = %18
store i32 0, i32* %8
br label %30
30: ; preds = %38, %29
%31 = load i32, i32* %8
%32 = icmp sle i32 %31, 32
br i1 %32, label %33, label %41
33: ; preds = %30
%34 = load i8*, i8** %7
%35 = load i32, i32* %8
%36 = sext i32 %35 to i64
%37 = getelementptr inbounds i8, i8* %34, i64 %36
store i8 66, i8* %37
br label %38
38: ; preds = %33
%39 = load i32, i32* %8
%40 = add nsw i32 %39, 1
store i32 %40, i32* %8
br label %30
41: ; preds = %30
%42 = load i8*, i8** %6
%43 = call i32 @free(i8* %42)
%44 = load i8*, i8** %6
%45 = getelementptr inbounds i8, i8* %44, i64 16
store i8 67, i8* %45
%46 = call i8* @malloc(i32 32)
store i8* %46, i8** %6
%47 = load i8*, i8** %6
%48 = getelementptr inbounds i8, i8* %47, i64 16
store i8 67, i8* %48
%49 = load i8*, i8** %6
%50 = call i32 @test4_heap_overflow(i8* %49)
%51 = call i32 (...) @test5_stack_overflow()
%52 = load i8*, i8** %7
%53 = call i32 @free(i8* %52)
store i32 0, i32* %3
br label %54
54: ; preds = %41, %16
%55 = load i32, i32* %3
ret i32 %55
}

LLVM IR (-O2):
define i32 @main(i32 %0, i8** nocapture readnone %1) {
%3 = tail call dereferenceable_or_null(32) i8* @malloc(i32 32)
%4 = tail call dereferenceable_or_null(32) i8* @malloc(i32 32)
%5 = icmp ne i8* %3, null
%6 = icmp ne i8* %4, null
%7 = and i1 %5, %6
br i1 %7, label %8, label %16
8: ; preds = %2
%9 = tail call i32 @free(i8* %3)
%10 = getelementptr inbounds i8, i8* %3, i64 16
store i8 67, i8* %10
%11 = tail call dereferenceable_or_null(32) i8* @malloc(i32 32)
%12 = getelementptr inbounds i8, i8* %11, i64 16
store i8 67, i8* %12
%13 = tail call i32 @test4_heap_overflow(i8* %11)
%14 = tail call i32 (...) @test5_stack_overflow()
%15 = tail call i32 @free(i8* %4)
br label %16
16: ; preds = %2, %8
%17 = phi i32 [ 0, %8 ], [ -1, %2 ]
ret i32 %17
}