#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
char *malloc(int);
int /*<<< orphan*/ printf(char *, char *);
int sub_fun(int);
int fun(int x) {
  int ret;
  char *my_data = malloc(1);
  char *my_data2 = malloc(1);
  char *my_data3;
  my_data[0] = 'h';
  my_data[1] = 'e';
  my_data[2] = 'j';
  my_data[3] = '\n';
  my_data[4] = '\0';
  my_data2[0] = 's';
  my_data2[1] = 'o';
  my_data2[2] = 's';
  my_data2[3] = '\n';
  my_data2[4] = '\0';
  ;
  printf("%s", my_data);
  printf("%s", my_data2);
  ret = sub_fun(x);
  ret = sub_fun(x);
  my_data3 = malloc(1);
  printf("BEFORE OVERWRITE %s", my_data3);
  my_data3[0] = 'e';
  my_data3[1] = 'r';
  my_data3[2] = 'l';
  my_data3[3] = '\n';
  my_data3[4] = '\0';
  printf("AFTER OVERWRITE %s", my_data3);
  return ret;
}


x86 assembly (clang, -O0):
<fun>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %edi,-0x4(%rbp)
mov    $0x1,%edi
call   1050 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    $0x1,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rax
movb   $0x68,(%rax)
mov    -0x10(%rbp),%rax
movb   $0x65,0x1(%rax)
mov    -0x10(%rbp),%rax
movb   $0x6a,0x2(%rax)
mov    -0x10(%rbp),%rax
movb   $0xa,0x3(%rax)
mov    -0x10(%rbp),%rax
movb   $0x0,0x4(%rax)
mov    -0x18(%rbp),%rax
movb   $0x73,(%rax)
mov    -0x18(%rbp),%rax
movb   $0x6f,0x1(%rax)
mov    -0x18(%rbp),%rax
movb   $0x73,0x2(%rax)
mov    -0x18(%rbp),%rax
movb   $0xa,0x3(%rax)
mov    -0x18(%rbp),%rax
movb   $0x0,0x4(%rax)
mov    -0x10(%rbp),%rsi
lea    0xe61(%rip),%rdi
call   1040 <printf@plt>
mov    -0x18(%rbp),%rsi
lea    0xe51(%rip),%rdi
call   1040 <printf@plt>
mov    -0x4(%rbp),%edi
call   1030 <sub_fun@plt>
mov    %eax,-0x8(%rbp)
mov    -0x4(%rbp),%edi
call   1030 <sub_fun@plt>
mov    %eax,-0x8(%rbp)
mov    $0x1,%edi
call   1050 <malloc@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rsi
lea    0xe0c(%rip),%rdi
call   1040 <printf@plt>
mov    -0x20(%rbp),%rax
movb   $0x65,(%rax)
mov    -0x20(%rbp),%rax
movb   $0x72,0x1(%rax)
mov    -0x20(%rbp),%rax
movb   $0x6c,0x2(%rax)
mov    -0x20(%rbp),%rax
movb   $0xa,0x3(%rax)
mov    -0x20(%rbp),%rax
movb   $0x0,0x4(%rax)
mov    -0x20(%rbp),%rsi
lea    0xde9(%rip),%rdi
call   1040 <printf@plt>
mov    -0x8(%rbp),%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<fun>:
push   %rbp
push   %r15
push   %r14
push   %rbx
push   %rax
mov    %edi,%r14d
mov    $0x1,%edi
call   1050 <malloc@plt>
mov    %rax,%rbx
mov    $0x1,%edi
call   1050 <malloc@plt>
mov    %rax,%rbp
movb   $0x0,0x4(%rbx)
movb   $0x0,0x4(%rax)
lea    0xeae(%rip),%r15
mov    %r15,%rdi
mov    %rbx,%rsi
call   1040 <printf@plt>
mov    %r15,%rdi
mov    %rbp,%rsi
call   1040 <printf@plt>
mov    %r14d,%edi
call   1030 <sub_fun@plt>
mov    %r14d,%edi
call   1030 <sub_fun@plt>
mov    %eax,%ebx
mov    $0x1,%edi
call   1050 <malloc@plt>
mov    %rax,%rbp
lea    0xe61(%rip),%rdi
mov    %rax,%rsi
call   1040 <printf@plt>
movb   $0x0,0x4(%rbp)
lea    0xe62(%rip),%rdi
mov    %rbp,%rsi
call   1040 <printf@plt>
mov    %ebx,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [3 x i8] c"%s\00"
@.str.1 = [20 x i8] c"BEFORE OVERWRITE %s\00"
@.str.2 = [19 x i8] c"AFTER OVERWRITE %s\00"
define i32 @fun(i32 %0) {
%2 = alloca i32
%3 = alloca i32
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i8*
store i32 %0, i32* %2
%7 = call i8* @malloc(i32 1)
store i8* %7, i8** %4
%8 = call i8* @malloc(i32 1)
store i8* %8, i8** %5
%9 = load i8*, i8** %4
%10 = getelementptr inbounds i8, i8* %9, i64 0
store i8 104, i8* %10
%11 = load i8*, i8** %4
%12 = getelementptr inbounds i8, i8* %11, i64 1
store i8 101, i8* %12
%13 = load i8*, i8** %4
%14 = getelementptr inbounds i8, i8* %13, i64 2
store i8 106, i8* %14
%15 = load i8*, i8** %4
%16 = getelementptr inbounds i8, i8* %15, i64 3
store i8 10, i8* %16
%17 = load i8*, i8** %4
%18 = getelementptr inbounds i8, i8* %17, i64 4
store i8 0, i8* %18
%19 = load i8*, i8** %5
%20 = getelementptr inbounds i8, i8* %19, i64 0
store i8 115, i8* %20
%21 = load i8*, i8** %5
%22 = getelementptr inbounds i8, i8* %21, i64 1
store i8 111, i8* %22
%23 = load i8*, i8** %5
%24 = getelementptr inbounds i8, i8* %23, i64 2
store i8 115, i8* %24
%25 = load i8*, i8** %5
%26 = getelementptr inbounds i8, i8* %25, i64 3
store i8 10, i8* %26
%27 = load i8*, i8** %5
%28 = getelementptr inbounds i8, i8* %27, i64 4
store i8 0, i8* %28
%29 = load i8*, i8** %4
%30 = call i32 @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str, i64 0, i64 0), i8* %29)
%31 = load i8*, i8** %5
%32 = call i32 @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str, i64 0, i64 0), i8* %31)
%33 = load i32, i32* %2
%34 = call i32 @sub_fun(i32 %33)
store i32 %34, i32* %3
%35 = load i32, i32* %2
%36 = call i32 @sub_fun(i32 %35)
store i32 %36, i32* %3
%37 = call i8* @malloc(i32 1)
store i8* %37, i8** %6
%38 = load i8*, i8** %6
%39 = call i32 @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.1, i64 0, i64 0), i8* %38)
%40 = load i8*, i8** %6
%41 = getelementptr inbounds i8, i8* %40, i64 0
store i8 101, i8* %41
%42 = load i8*, i8** %6
%43 = getelementptr inbounds i8, i8* %42, i64 1
store i8 114, i8* %43
%44 = load i8*, i8** %6
%45 = getelementptr inbounds i8, i8* %44, i64 2
store i8 108, i8* %45
%46 = load i8*, i8** %6
%47 = getelementptr inbounds i8, i8* %46, i64 3
store i8 10, i8* %47
%48 = load i8*, i8** %6
%49 = getelementptr inbounds i8, i8* %48, i64 4
store i8 0, i8* %49
%50 = load i8*, i8** %6
%51 = call i32 @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.2, i64 0, i64 0), i8* %50)
%52 = load i32, i32* %3
ret i32 %52
}

LLVM IR (-O2):
@.str = [3 x i8] c"%s\00"
@.str.1 = [20 x i8] c"BEFORE OVERWRITE %s\00"
@.str.2 = [19 x i8] c"AFTER OVERWRITE %s\00"
define i32 @fun(i32 %0) {
%2 = tail call dereferenceable_or_null(1) i8* @malloc(i32 1)
%3 = tail call dereferenceable_or_null(1) i8* @malloc(i32 1)
%4 = getelementptr inbounds i8, i8* %2, i64 4
store i8 0, i8* %4
%5 = getelementptr inbounds i8, i8* %3, i64 4
store i8 0, i8* %5
%6 = tail call i32 @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str, i64 0, i64 0), i8* %2)
%7 = tail call i32 @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str, i64 0, i64 0), i8* %3)
%8 = tail call i32 @sub_fun(i32 %0)
%9 = tail call i32 @sub_fun(i32 %0)
%10 = tail call dereferenceable_or_null(1) i8* @malloc(i32 1)
%11 = tail call i32 @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.1, i64 0, i64 0), i8* %10)
%12 = getelementptr inbounds i8, i8* %10, i64 4
store i8 0, i8* %12
%13 = tail call i32 @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.2, i64 0, i64 0), i8* %10)
ret i32 %9
}