#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ fread(char *, int, int, int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ puts(char *);
int /*<<< orphan*/ scanf(char *, int *);
int /*<<< orphan*/ stdin;
void vulnerable() {
  char buffer[50];
  int i;
  puts("plz don't drop /bin/sh");
  printf("how much data?:");
  scanf("%d", &i);
  puts("ok give me some data: ");
  fread(buffer, 1, i, stdin);
  printf("this is your data: %s\n", buffer);
}


x86 assembly (clang, -O0):
<vulnerable>:
push   %rbp
mov    %rsp,%rbp
sub    $0x50,%rsp
lea    0xeb1(%rip),%rdi
call   1030 <puts@plt>
lea    0xebc(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xebe(%rip),%rdi
lea    -0x44(%rbp),%rsi
call   1060 <scanf@plt>
lea    0xeb1(%rip),%rdi
call   1030 <puts@plt>
lea    -0x40(%rbp),%rdi
mov    -0x44(%rbp),%edx
mov    0x2e5c(%rip),%rax
mov    (%rax),%ecx
mov    $0x1,%esi
call   1040 <fread@plt>
lea    -0x40(%rbp),%rsi
lea    0xe9e(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
add    $0x50,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<vulnerable>:
push   %rbx
sub    $0x50,%rsp
lea    0xeb4(%rip),%rdi
call   1030 <puts@plt>
lea    0xebf(%rip),%rdi
xor    %eax,%eax
call   1050 <printf@plt>
lea    0xec1(%rip),%rdi
lea    0xc(%rsp),%rsi
call   1060 <scanf@plt>
lea    0xeb3(%rip),%rdi
call   1030 <puts@plt>
mov    0xc(%rsp),%edx
mov    0x2e61(%rip),%rax
mov    (%rax),%ecx
lea    0x10(%rsp),%rbx
mov    %rbx,%rdi
mov    $0x1,%esi
call   1040 <fread@plt>
lea    0xe9f(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1050 <printf@plt>
add    $0x50,%rsp
pop    %rbx
ret

LLVM IR (-O0):
@.str = [23 x i8] c"plz don't drop /bin/sh\00"
@.str.1 = [16 x i8] c"how much data?:\00"
@.str.2 = [3 x i8] c"%d\00"
@.str.3 = [23 x i8] c"ok give me some data: \00"
@stdin = global i32 0
@.str.4 = [23 x i8] c"this is your data: %s\0A\00"
define void @vulnerable() {
%1 = alloca [50 x i8]
%2 = alloca i32
%3 = call i32 @puts(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str, i64 0, i64 0))
%4 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.1, i64 0, i64 0))
%5 = call i32 @scanf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32* %2)
%6 = call i32 @puts(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.3, i64 0, i64 0))
%7 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%8 = load i32, i32* %2
%9 = load i32, i32* @stdin
%10 = call i32 @fread(i8* %7, i32 1, i32 %8, i32 %9)
%11 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%12 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.4, i64 0, i64 0), i8* %11)
ret void
}

LLVM IR (-O2):
@.str = [23 x i8] c"plz don't drop /bin/sh\00"
@.str.1 = [16 x i8] c"how much data?:\00"
@.str.2 = [3 x i8] c"%d\00"
@.str.3 = [23 x i8] c"ok give me some data: \00"
@stdin = global i32 0
@.str.4 = [23 x i8] c"this is your data: %s\0A\00"
define void @vulnerable() {
%1 = alloca [50 x i8]
%2 = alloca i32
%3 = getelementptr inbounds [50 x i8], [50 x i8]* %1, i64 0, i64 0
%4 = bitcast i32* %2 to i8*
%5 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @.str, i64 0, i64 0))
%6 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([16 x i8], [16 x i8]* @.str.1, i64 0, i64 0))
%7 = call i32 @scanf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32* %2)
%8 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @.str.3, i64 0, i64 0))
%9 = load i32, i32* %2
%10 = load i32, i32* @stdin
%11 = call i32 @fread(i8* %3, i32 1, i32 %9, i32 %10)
%12 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @.str.4, i64 0, i64 0), i8* %3)
ret void
}