#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef scalar_t__ uint64_t;

/* Variables and functions */
int /*<<< orphan*/ O_RDWR;
int /*<<< orphan*/ SYS_mount;
int open(char *, int /*<<< orphan*/);
int /*<<< orphan*/ sprintf(char *, char *, long, ...);
int /*<<< orphan*/ strcat(char *, char *);
int strlen(char *);
int /*<<< orphan*/ syscall(int /*<<< orphan*/, char *, scalar_t__, char *,
                           scalar_t__, char *);
uintptr_t syz_fuse_mount(uintptr_t a0, uintptr_t a1, uintptr_t a2, uintptr_t a3,
                         uintptr_t a4, uintptr_t a5) {
  uint64_t target = a0;
  uint64_t mode = a1;
  uint64_t uid = a2;
  uint64_t gid = a3;
  uint64_t maxread = a4;
  uint64_t flags = a5;
  int fd = open("/dev/fuse", O_RDWR);
  if (fd == -1)
    return fd;
  char buf[1024];
  sprintf(buf, "fd=%d,user_id=%ld,group_id=%ld,rootmode=0%o", fd, (long)uid,
          (long)gid, (unsigned)mode & ~3u);
  if (maxread != 0)
    sprintf(buf + strlen(buf), ",max_read=%ld", (long)maxread);
  if (mode & 1)
    strcat(buf, ",default_permissions");
  if (mode & 2)
    strcat(buf, ",allow_other");
  syscall(SYS_mount, "", target, "fuse", flags, buf);
  return fd;
}


x86 assembly (clang, -O0):
<syz_fuse_mount>:
push   %rbp
mov    %rsp,%rbp
sub    $0x480,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
mov    %r8,-0x30(%rbp)
mov    %r9,-0x38(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0x40(%rbp)
mov    -0x18(%rbp),%rax
mov    %rax,-0x48(%rbp)
mov    -0x20(%rbp),%rax
mov    %rax,-0x50(%rbp)
mov    -0x28(%rbp),%rax
mov    %rax,-0x58(%rbp)
mov    -0x30(%rbp),%rax
mov    %rax,-0x60(%rbp)
mov    -0x38(%rbp),%rax
mov    %rax,-0x68(%rbp)
mov    0x2e3e(%rip),%rax
mov    (%rax),%esi
lea    0xe4d(%rip),%rdi
call   1050 <open@plt>
mov    %eax,-0x6c(%rbp)
cmpl   $0xffffffff,-0x6c(%rbp)
jne    11d2 <syz_fuse_mount+0x82>
movslq -0x6c(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    12be <syz_fuse_mount+0x16e>
lea    -0x470(%rbp),%rdi
movslq -0x6c(%rbp),%rdx
mov    -0x50(%rbp),%rcx
mov    -0x58(%rbp),%r8
mov    -0x48(%rbp),%rax
mov    %eax,%r9d
and    $0xfffffffc,%r9d
lea    0xe13(%rip),%rsi
mov    $0x0,%al
call   1070 <sprintf@plt>
cmpq   $0x0,-0x60(%rbp)
je     1241 <syz_fuse_mount+0xf1>
lea    -0x470(%rbp),%rax
mov    %rax,-0x478(%rbp)
lea    -0x470(%rbp),%rdi
call   1030 <strlen@plt>
mov    -0x478(%rbp),%rdi
cltq
add    %rax,%rdi
mov    -0x60(%rbp),%rdx
lea    0xdfc(%rip),%rsi
mov    $0x0,%al
call   1070 <sprintf@plt>
mov    -0x48(%rbp),%rax
and    $0x1,%rax
cmp    $0x0,%rax
je     1266 <syz_fuse_mount+0x116>
lea    -0x470(%rbp),%rdi
lea    0xde3(%rip),%rsi
call   1060 <strcat@plt>
mov    -0x48(%rbp),%rax
and    $0x2,%rax
cmp    $0x0,%rax
je     128b <syz_fuse_mount+0x13b>
lea    -0x470(%rbp),%rdi
lea    0xdd3(%rip),%rsi
call   1060 <strcat@plt>
mov    0x2d4e(%rip),%rax
mov    (%rax),%edi
mov    -0x40(%rbp),%rdx
mov    -0x68(%rbp),%r8
lea    -0x470(%rbp),%r9
lea    0xd99(%rip),%rsi
lea    0xd54(%rip),%rcx
call   1040 <syscall@plt>
movslq -0x6c(%rbp),%rax
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0x480,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<syz_fuse_mount>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x418,%rsp
mov    %r9,%rbp
mov    %r8,%r13
mov    %rcx,%r15
mov    %rdx,%r14
mov    %rsi,%r12
mov    %rdi,%rbx
mov    0x2e6e(%rip),%rax
mov    (%rax),%esi
lea    0xe7d(%rip),%rdi
call   1050 <open@plt>
cmp    $0xffffffff,%eax
je     1244 <syz_fuse_mount+0xf4>
mov    %rbx,(%rsp)
mov    %rbp,0x8(%rsp)
movslq %eax,%rbx
mov    %r12d,%r9d
and    $0xfffffffc,%r9d
lea    0xe5f(%rip),%rsi
lea    0x10(%rsp),%rdi
mov    %rbx,%rdx
mov    %r14,%rcx
mov    %r15,%r8
xor    %eax,%eax
call   1070 <sprintf@plt>
test   %r13,%r13
je     11ea <syz_fuse_mount+0x9a>
lea    0x10(%rsp),%rdi
call   1030 <strlen@plt>
cltq
lea    (%rsp,%rax,1),%rdi
add    $0x10,%rdi
lea    0xe56(%rip),%rsi
mov    %r13,%rdx
xor    %eax,%eax
call   1070 <sprintf@plt>
test   $0x1,%r12b
je     1201 <syz_fuse_mount+0xb1>
lea    0xe4d(%rip),%rsi
lea    0x10(%rsp),%rdi
call   1060 <strcat@plt>
test   $0x2,%r12b
je     1218 <syz_fuse_mount+0xc8>
lea    0xe4b(%rip),%rsi
lea    0x10(%rsp),%rdi
call   1060 <strcat@plt>
mov    0x2dc1(%rip),%rax
mov    (%rax),%edi
lea    0xe1b(%rip),%rsi
lea    0xdd6(%rip),%rcx
lea    0x10(%rsp),%r9
mov    (%rsp),%rdx
mov    0x8(%rsp),%r8
call   1040 <syscall@plt>
jmp    124b <syz_fuse_mount+0xfb>
mov    $0xffffffffffffffff,%rbx
mov    %rbx,%rax
add    $0x418,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [10 x i8] c"/dev/fuse\00"
@O_RDWR = global i32 0
@.str.1 = [44 x i8] c"fd=%d,user_id=%ld,group_id=%ld,rootmode=0%o\00"
@.str.2 = [14 x i8] c",max_read=%ld\00"
@.str.3 = [21 x i8] c",default_permissions\00"
@.str.4 = [13 x i8] c",allow_other\00"
@SYS_mount = global i32 0
@.str.5 = [1 x i8] zeroinitializer
@.str.6 = [5 x i8] c"fuse\00"
define i64 @syz_fuse_mount(i64 %0, i64 %1, i64 %2, i64 %3, i64 %4, i64 %5) {
%7 = alloca i64
%8 = alloca i64
%9 = alloca i64
%10 = alloca i64
%11 = alloca i64
%12 = alloca i64
%13 = alloca i64
%14 = alloca i64
%15 = alloca i64
%16 = alloca i64
%17 = alloca i64
%18 = alloca i64
%19 = alloca i64
%20 = alloca i32
%21 = alloca [1024 x i8]
store i64 %0, i64* %8
store i64 %1, i64* %9
store i64 %2, i64* %10
store i64 %3, i64* %11
store i64 %4, i64* %12
store i64 %5, i64* %13
%22 = load i64, i64* %8
store i64 %22, i64* %14
%23 = load i64, i64* %9
store i64 %23, i64* %15
%24 = load i64, i64* %10
store i64 %24, i64* %16
%25 = load i64, i64* %11
store i64 %25, i64* %17
%26 = load i64, i64* %12
store i64 %26, i64* %18
%27 = load i64, i64* %13
store i64 %27, i64* %19
%28 = load i32, i32* @O_RDWR
%29 = call i32 @open(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i32 %28)
store i32 %29, i32* %20
%30 = load i32, i32* %20
%31 = icmp eq i32 %30, -1
br i1 %31, label %32, label %35
32: ; preds = %6
%33 = load i32, i32* %20
%34 = sext i32 %33 to i64
store i64 %34, i64* %7
br label %77
35: ; preds = %6
%36 = getelementptr inbounds [1024 x i8], [1024 x i8]* %21, i64 0, i64 0
%37 = load i32, i32* %20
%38 = sext i32 %37 to i64
%39 = load i64, i64* %16
%40 = load i64, i64* %17
%41 = load i64, i64* %15
%42 = trunc i64 %41 to i32
%43 = and i32 %42, -4
%44 = call i32 (i8*, i8*, i64, ...) @sprintf(i8* %36, i8* getelementptr inbounds ([44 x i8], [44 x i8]* @.str.1, i64 0, i64 0), i64 %38, i64 %39, i64 %40, i32 %43)
%45 = load i64, i64* %18
%46 = icmp ne i64 %45, 0
br i1 %46, label %47, label %55
47: ; preds = %35
%48 = getelementptr inbounds [1024 x i8], [1024 x i8]* %21, i64 0, i64 0
%49 = getelementptr inbounds [1024 x i8], [1024 x i8]* %21, i64 0, i64 0
%50 = call i32 @strlen(i8* %49)
%51 = sext i32 %50 to i64
%52 = getelementptr inbounds i8, i8* %48, i64 %51
%53 = load i64, i64* %18
%54 = call i32 (i8*, i8*, i64, ...) @sprintf(i8* %52, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.2, i64 0, i64 0), i64 %53)
br label %55
55: ; preds = %47, %35
%56 = load i64, i64* %15
%57 = and i64 %56, 1
%58 = icmp ne i64 %57, 0
br i1 %58, label %59, label %62
59: ; preds = %55
%60 = getelementptr inbounds [1024 x i8], [1024 x i8]* %21, i64 0, i64 0
%61 = call i32 @strcat(i8* %60, i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.3, i64 0, i64 0))
br label %62
62: ; preds = %59, %55
%63 = load i64, i64* %15
%64 = and i64 %63, 2
%65 = icmp ne i64 %64, 0
br i1 %65, label %66, label %69
66: ; preds = %62
%67 = getelementptr inbounds [1024 x i8], [1024 x i8]* %21, i64 0, i64 0
%68 = call i32 @strcat(i8* %67, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.4, i64 0, i64 0))
br label %69
69: ; preds = %66, %62
%70 = load i32, i32* @SYS_mount
%71 = load i64, i64* %14
%72 = load i64, i64* %19
%73 = getelementptr inbounds [1024 x i8], [1024 x i8]* %21, i64 0, i64 0
%74 = call i32 @syscall(i32 %70, i8* getelementptr inbounds ([1 x i8], [1 x i8]* @.str.5, i64 0, i64 0), i64 %71, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.6, i64 0, i64 0), i64 %72, i8* %73)
%75 = load i32, i32* %20
%76 = sext i32 %75 to i64
store i64 %76, i64* %7
br label %77
77: ; preds = %69, %32
%78 = load i64, i64* %7
ret i64 %78
}

LLVM IR (-O2):
@.str = [10 x i8] c"/dev/fuse\00"
@O_RDWR = global i32 0
@.str.1 = [44 x i8] c"fd=%d,user_id=%ld,group_id=%ld,rootmode=0%o\00"
@.str.2 = [14 x i8] c",max_read=%ld\00"
@.str.3 = [21 x i8] c",default_permissions\00"
@.str.4 = [13 x i8] c",allow_other\00"
@SYS_mount = global i32 0
@.str.5 = [1 x i8] zeroinitializer
@.str.6 = [5 x i8] c"fuse\00"
define i64 @syz_fuse_mount(i64 %0, i64 %1, i64 %2, i64 %3, i64 %4, i64 %5) {
%7 = alloca [1024 x i8]
%8 = load i32, i32* @O_RDWR
%9 = tail call i32 @open(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i32 %8)
%10 = icmp eq i32 %9, -1
br i1 %10, label %36, label %11
11: ; preds = %6
%12 = getelementptr inbounds [1024 x i8], [1024 x i8]* %7, i64 0, i64 0
%13 = sext i32 %9 to i64
%14 = trunc i64 %1 to i32
%15 = and i32 %14, -4
%16 = call i32 (i8*, i8*, i64, ...) @sprintf(i8* %12, i8* dereferenceable(1) getelementptr inbounds ([44 x i8], [44 x i8]* @.str.1, i64 0, i64 0), i64 %13, i64 %2, i64 %3, i32 %15)
%17 = icmp eq i64 %4, 0
br i1 %17, label %23, label %18
18: ; preds = %11
%19 = call i32 @strlen(i8* %12)
%20 = sext i32 %19 to i64
%21 = getelementptr inbounds [1024 x i8], [1024 x i8]* %7, i64 0, i64 %20
%22 = call i32 (i8*, i8*, i64, ...) @sprintf(i8* %21, i8* dereferenceable(1) getelementptr inbounds ([14 x i8], [14 x i8]* @.str.2, i64 0, i64 0), i64 %4)
br label %23
23: ; preds = %18, %11
%24 = and i64 %1, 1
%25 = icmp eq i64 %24, 0
br i1 %25, label %28, label %26
26: ; preds = %23
%27 = call i32 @strcat(i8* %12, i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.3, i64 0, i64 0))
br label %28
28: ; preds = %26, %23
%29 = and i64 %1, 2
%30 = icmp eq i64 %29, 0
br i1 %30, label %33, label %31
31: ; preds = %28
%32 = call i32 @strcat(i8* %12, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.4, i64 0, i64 0))
br label %33
33: ; preds = %31, %28
%34 = load i32, i32* @SYS_mount
%35 = call i32 @syscall(i32 %34, i8* getelementptr inbounds ([1 x i8], [1 x i8]* @.str.5, i64 0, i64 0), i64 %0, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.6, i64 0, i64 0), i64 %5, i8* %12)
br label %36
36: ; preds = %6, %33
%37 = phi i64 [ %13, %33 ], [ -1, %6 ]
ret i64 %37
}