glaurung

Fixture 163

wire header parser

C · 5 functions · 4 lanes · 20 of 20 function-lanes behave identically

All 4 lanes recompile and return the same results as the original.

A real-shaped framing header: 10 fixed bytes, all multi-byte fields big-endian, followed by a variable payload whose length the header declares.

off 0..1 magic u16 be, must be 0x5A47 off 2 version u8, must be 2 off 3 flags u8, the top nibble is reserved and must be zero off 4..7 stream_id u32 be off 8..9 payload_len u16 be, must be <= 6 AND <= (len - 10) off 10.. payload payload_len bytes

Why this stresses a decompiler: the whole security property of this parser is one relationship -- the DECLARED length must be bounded by the RECEIVED length minus the header size -- and after lowering it is a single compare between two registers whose provenance the decompiler has to reconstruct. The two checks on payload_len are not redundant (one bounds the field against the format's own maximum, one against the bytes actually present), and a decompiler that merges them, drops either, flips the direction, or loses the - 10 produces C that still parses every valid frame identically and reads out of bounds on a crafted one. Every rejection path returns a DISTINCT negative code so a mis-recovered check shows up as the wrong code rather than as a coin flip.

The big-endian assembly is done with explicit shifts over individual bytes, so no unaligned access and no host-endianness dependence exists anywhere.

UB notes: every length is clamped into [0, 16] before it participates in arithmetic; the declared length is compared as an unsigned before any cast to int32_t; the payload loop is bounded by the validated declared length.

tests/decompiler_fixtures/src/163_wire_header_parser.c source 
/* 163_wire_header_parser.c
 *
 * A real-shaped framing header: 10 fixed bytes, all multi-byte fields
 * big-endian, followed by a variable payload whose length the header declares.
 *
 *   off 0..1  magic      u16 be, must be 0x5A47
 *   off 2     version    u8,      must be 2
 *   off 3     flags      u8,      the top nibble is reserved and must be zero
 *   off 4..7  stream_id  u32 be
 *   off 8..9  payload_len u16 be, must be <= 6 AND <= (len - 10)
 *   off 10..  payload    payload_len bytes
 *
 * Why this stresses a decompiler: the whole security property of this parser is
 * one relationship -- the DECLARED length must be bounded by the RECEIVED
 * length minus the header size -- and after lowering it is a single compare
 * between two registers whose provenance the decompiler has to reconstruct. The
 * two checks on `payload_len` are not redundant (one bounds the field against
 * the format's own maximum, one against the bytes actually present), and a
 * decompiler that merges them, drops either, flips the direction, or loses the
 * `- 10` produces C that still parses every valid frame identically and reads
 * out of bounds on a crafted one. Every rejection path returns a DISTINCT
 * negative code so a mis-recovered check shows up as the wrong code rather than
 * as a coin flip.
 *
 * The big-endian assembly is done with explicit shifts over individual bytes,
 * so no unaligned access and no host-endianness dependence exists anywhere.
 *
 * UB notes: every length is clamped into [0, 16] before it participates in
 * arithmetic; the declared length is compared as an unsigned before any cast to
 * int32_t; the payload loop is bounded by the validated declared length.
 */
#include <stddef.h>
#include <stdint.h>

#define HDR163_MAGIC        0x5A47u
#define HDR163_VERSION      2u
#define HDR163_HEADER_BYTES 10
#define HDR163_MAX_TOTAL    16
#define HDR163_MAX_PAYLOAD  6
#define HDR163_BAD_ID       0xFFFFFFFFu

_Static_assert(HDR163_HEADER_BYTES + HDR163_MAX_PAYLOAD <= HDR163_MAX_TOTAL,
               "a maximal frame must fit inside the clamped buffer bound");

/* Clamp a caller length into [0, HDR163_MAX_TOTAL] before any arithmetic. */
static int32_t hdr163_clamp(int32_t n) {
    if (n < 0) {
        return 0;
    }
    if (n > HDR163_MAX_TOTAL) {
        return HDR163_MAX_TOTAL;
    }
    return n;
}

/* Big-endian 16-bit assembly from two individual byte loads. */
static uint32_t hdr163_be16(const uint8_t *p) {
    return ((uint32_t)p[0] << 8) | (uint32_t)p[1];
}

/* Big-endian 32-bit assembly from four individual byte loads. */
static uint32_t hdr163_be32(const uint8_t *p) {
    return ((uint32_t)p[0] << 24) | ((uint32_t)p[1] << 16) |
           ((uint32_t)p[2] << 8) | (uint32_t)p[3];
}

/* The whole validation policy in one place. `limit` must already be clamped.
 * On success returns 0 and writes the declared payload length to *payload_len;
 * otherwise returns a distinct negative code and writes 0. */
static int32_t hdr163_check(const uint8_t *buf, int32_t limit,
                            int32_t *payload_len) {
    uint32_t declared;

    *payload_len = 0;
    if (limit < HDR163_HEADER_BYTES) {
        return -2; /* truncated before the fixed header ends */
    }
    if (hdr163_be16(buf + 0) != HDR163_MAGIC) {
        return -3; /* not our framing */
    }
    if ((uint32_t)buf[2] != HDR163_VERSION) {
        return -4; /* unsupported version */
    }
    if (((uint32_t)buf[3] & 0xF0u) != 0u) {
        return -5; /* reserved flag bits set */
    }
    declared = hdr163_be16(buf + 8);
    if (declared > (uint32_t)HDR163_MAX_PAYLOAD) {
        return -6; /* larger than the format allows */
    }
    if ((int32_t)declared > limit - HDR163_HEADER_BYTES) {
        return -7; /* larger than the bytes we actually received */
    }
    *payload_len = (int32_t)declared;
    return 0;
}

/* Validate a frame. Returns the declared payload length (0..6) when the frame
 * is well formed, or a distinct negative code. */
__attribute__((noinline)) int32_t
hdr163_validate(const uint8_t *buf, int32_t len) {
    int32_t payload_len = 0;
    int32_t rc;

    if (buf == NULL) {
        return -1;
    }
    rc = hdr163_check(buf, hdr163_clamp(len), &payload_len);
    return (rc != 0) ? rc : payload_len;
}

/* The big-endian 32-bit stream id, or 0xFFFFFFFF when the frame is rejected. */
__attribute__((noinline)) uint32_t
hdr163_stream_id(const uint8_t *buf, int32_t len) {
    int32_t payload_len = 0;

    if (buf == NULL) {
        return HDR163_BAD_ID;
    }
    if (hdr163_check(buf, hdr163_clamp(len), &payload_len) != 0) {
        return HDR163_BAD_ID;
    }
    return hdr163_be32(buf + 4);
}

/* Fold exactly `payload_len` payload bytes -- never one more, never one fewer.
 * Returns a positive summary, or the validation code. */
__attribute__((noinline)) int32_t
hdr163_payload_digest(const uint8_t *buf, int32_t len) {
    int32_t payload_len = 0;
    int32_t rc;
    int32_t i;
    uint32_t acc = 0x9E37u;

    if (buf == NULL) {
        return -1;
    }
    rc = hdr163_check(buf, hdr163_clamp(len), &payload_len);
    if (rc != 0) {
        return rc;
    }
    for (i = 0; i < payload_len; i++) {
        acc += (uint32_t)buf[HDR163_HEADER_BYTES + i];
        acc = (acc << 3) ^ (acc >> 29);
    }
    acc += (uint32_t)buf[3]; /* flags participate, so a dropped byte shows up */
    return 1000 + payload_len * 100 + (int32_t)(acc & 0x3FFu);
}

/* Copy the validated payload out to a caller buffer. Returns the number of
 * bytes copied (0..6), or a distinct negative code. */
__attribute__((noinline)) int32_t
hdr163_copy_payload(const uint8_t *buf, int32_t len, uint8_t *out,
                    int32_t out_len) {
    int32_t payload_len = 0;
    int32_t room = hdr163_clamp(out_len);
    int32_t rc;
    int32_t i;

    if (buf == NULL || out == NULL) {
        return -1;
    }
    rc = hdr163_check(buf, hdr163_clamp(len), &payload_len);
    if (rc != 0) {
        return rc;
    }
    if (payload_len > room) {
        return -8; /* the caller's sink is smaller than the declared payload */
    }
    for (i = 0; i < payload_len; i++) {
        out[i] = buf[HDR163_HEADER_BYTES + i];
    }
    return payload_len;
}

/* Emit a well-formed frame, so the accepting path is reachable without a
 * hand-built vector. Returns the total frame size, or a negative code. */
__attribute__((noinline)) int32_t
hdr163_build(uint8_t *out, int32_t out_len, uint32_t stream_id,
             int32_t payload_len) {
    int32_t room = hdr163_clamp(out_len);
    int32_t want = payload_len;
    int32_t total;
    int32_t i;

    if (out == NULL) {
        return -1;
    }
    if (want < 0) {
        want = 0;
    }
    if (want > HDR163_MAX_PAYLOAD) {
        want = HDR163_MAX_PAYLOAD;
    }
    total = HDR163_HEADER_BYTES + want;
    if (room < total) {
        return -2;
    }

    out[0] = (uint8_t)((HDR163_MAGIC >> 8) & 0xFFu);
    out[1] = (uint8_t)(HDR163_MAGIC & 0xFFu);
    out[2] = (uint8_t)HDR163_VERSION;
    out[3] = 0x03u;
    out[4] = (uint8_t)((stream_id >> 24) & 0xFFu);
    out[5] = (uint8_t)((stream_id >> 16) & 0xFFu);
    out[6] = (uint8_t)((stream_id >> 8) & 0xFFu);
    out[7] = (uint8_t)(stream_id & 0xFFu);
    out[8] = (uint8_t)(((uint32_t)want >> 8) & 0xFFu);
    out[9] = (uint8_t)((uint32_t)want & 0xFFu);
    for (i = 0; i < want; i++) {
        out[HDR163_HEADER_BYTES + i] = (uint8_t)(0x40u + (uint32_t)i);
    }
    return total;
}

Recovered C

Generated by glaurung decompile --style decbench at b47f6b43. baseline.json records the result after recompiling the C and calling it beside the original with seeded inputs.

clang -O0

5/5
hdr163_build pass 42 lines 
// glaurung: hdr163_build @ 0x1550
int32_t hdr163_build(uint8_t * arg0, int32_t arg1, uint32_t arg2, int32_t arg3) {
    extern int hdr163_clamp(int);
    int room;
    int want;
    int total;
    int i;
    int var0;
    // x86-64 prologue: save rbp, frame 48 bytes
    var0 = hdr163_clamp((unsigned long)((unsigned int)(arg1)));
    room = var0;
    want = arg3;
    if ((arg0 != 0)) {
        if (((long)(want) < 0)) {
            want = 0;
        }
        if (((((unsigned long)((unsigned int)(want)) == 6) | ((long)(want) < 6)) == 0)) {
            want = 6;
        }
        total = ((unsigned int)(want) + 10);
        if ((total <= room)) {
            *(signed char *)((long)arg0) = 90;
            *(signed char *)(((long)arg0 + 0x1)) = 71;
            *(signed char *)(((long)arg0 + 0x2)) = 2;
            *(signed char *)(((long)arg0 + 0x3)) = 3;
            *(signed char *)(((long)arg0 + 0x4)) = ((unsigned int)(arg2) >> 24);
            *(signed char *)(((long)arg0 + 0x5)) = ((unsigned int)(arg2) >> 16);
            *(signed char *)(((long)arg0 + 0x6)) = ((unsigned int)(arg2) >> 8);
            *(signed char *)(((long)arg0 + 0x7)) = arg2;
            *(signed char *)(((long)arg0 + 0x8)) = ((unsigned long)((unsigned int)(want)) >> 8);
            *(signed char *)(((long)arg0 + 0x9)) = want;
            for (i = 0; (i < want); i++) {
                arg0[(long)((int)(((unsigned long)((unsigned int)(i)) + 10)))] = ((unsigned long)((unsigned int)(i)) + 64);
            }
            return (unsigned int)(total);
        } else {
            return (unsigned int)(-2);
        }
    } else {
        return (unsigned int)(-1);
    }
}
hdr163_copy_payload pass 44 lines 
// glaurung: hdr163_copy_payload @ 0x1460
__attribute__((no_stack_protector)) int32_t hdr163_copy_payload(const uint8_t * arg0, int32_t arg1, uint8_t * arg2, int32_t arg3) {
    extern int hdr163_check(char *, int, int *);
    extern int hdr163_clamp(int);
    unsigned char payload_len[4];
    int room;
    int rc;
    int i;
    int local_4;
    int var0;
    int var3;
    int var5;
    long var7;
    // x86-64 prologue: save rbp, frame 64 bytes
    *(int *)(&payload_len[0]) = 0;
    var0 = hdr163_clamp((unsigned long)((unsigned int)(arg3)));
    room = var0;
    if ((arg0 == 0)) {
        local_4 = -1;
        // x86-64 epilogue: restore rbp
        return (unsigned int)(local_4);
    }
    if ((arg2 == 0)) {
        local_4 = -1;
        // x86-64 epilogue: restore rbp
        return (unsigned int)(local_4);
    }
    var3 = hdr163_clamp((unsigned long)((unsigned int)(arg1)));
    var5 = hdr163_check((char *)(arg0), (unsigned long)((unsigned int)(var3)), (int *)(&payload_len[0]));
    rc = var5;
    if (((unsigned long)((unsigned int)(rc)) == 0)) {
        var7 = (unsigned long)((unsigned int)(*(int *)(&payload_len[0])));
        if ((((unsigned int)(var7) == (unsigned int)(room)) | ((long)((int)(var7)) < (long)(room)))) {
            for (i = 0; ((long)(i) < (long)((int)(*(int *)(&payload_len[0])))); i++) {
                arg2[i] = arg0[(long)((int)(((unsigned long)((unsigned int)(i)) + 10)))];
            }
            return (unsigned int)(*(int *)(&payload_len[0]));
        } else {
            return (unsigned int)(-8);
        }
    } else {
        return (unsigned int)(rc);
    }
}
hdr163_payload_digest pass 31 lines 
// glaurung: hdr163_payload_digest @ 0x1370
__attribute__((no_stack_protector)) int32_t hdr163_payload_digest(const uint8_t * arg0, int32_t arg1) {
    extern int hdr163_check(char *, int, int *);
    extern int hdr163_clamp(int);
    unsigned char payload_len[4];
    unsigned int acc;
    int rc;
    int i;
    int var1;
    int var3;
    // x86-64 prologue: save rbp, frame 48 bytes
    *(int *)(&payload_len[0]) = 0;
    acc = 0x9e37;
    if ((arg0 != 0)) {
        var1 = hdr163_clamp((unsigned long)((unsigned int)(arg1)));
        var3 = hdr163_check((char *)(arg0), (unsigned long)((unsigned int)(var1)), (int *)(&payload_len[0]));
        rc = var3;
        if (((unsigned long)((unsigned int)(rc)) == 0)) {
            for (i = 0; ((long)(i) < (long)((int)(*(int *)(&payload_len[0])))); i++) {
                acc = ((unsigned int)((unsigned char)(arg0[(long)((int)(((unsigned long)((unsigned int)(i)) + 10)))])) + acc);
                acc = ((unsigned int)((acc << 3)) ^ (unsigned int)(((unsigned int)(acc) >> 29)));
            }
            acc = ((unsigned int)((unsigned char)(*(char *)(((long)arg0 + 0x3)))) + acc);
            return (unsigned int)(((unsigned long)((unsigned int)(((*(int *)(&payload_len[0]) * 100) + 1000))) + (unsigned long)((unsigned int)(((unsigned long)(acc) & 1023)))));
        } else {
            return (unsigned int)(rc);
        }
    } else {
        return (unsigned int)(-1);
    }
}
hdr163_stream_id pass 24 lines 
// glaurung: hdr163_stream_id @ 0x12b0
__attribute__((no_stack_protector)) uint32_t hdr163_stream_id(const uint8_t * arg0, int32_t arg1) {
    extern unsigned int hdr163_be32(char *);
    extern int hdr163_check(char *, int, int *);
    extern int hdr163_clamp(int);
    unsigned char payload_len[4];
    int var1;
    int var3;
    unsigned int var6;
    // x86-64 prologue: save rbp, frame 32 bytes
    *(int *)(&payload_len[0]) = 0;
    if ((arg0 != 0)) {
        var1 = hdr163_clamp((unsigned long)((unsigned int)(arg1)));
        var3 = hdr163_check((char *)(arg0), (unsigned long)((unsigned int)(var1)), (int *)(&payload_len[0]));
        if (((unsigned long)((unsigned int)(var3)) == 0)) {
            var6 = hdr163_be32((char *)((arg0 + 4)));
            return (unsigned int)(var6);
        } else {
            return (unsigned int)(-1);
        }
    } else {
        return (unsigned int)(-1);
    }
}
hdr163_validate pass 21 lines 
// glaurung: hdr163_validate @ 0x1100
__attribute__((no_stack_protector)) int32_t hdr163_validate(const uint8_t * arg0, int32_t arg1) {
    extern int hdr163_check(char *, int, int *);
    extern int hdr163_clamp(int);
    unsigned char payload_len[4];
    int rc;
    int local_2c;
    int var1;
    int var3;
    // x86-64 prologue: save rbp, frame 48 bytes
    *(int *)(&payload_len[0]) = 0;
    if ((arg0 != 0)) {
        var1 = hdr163_clamp((unsigned long)((unsigned int)(arg1)));
        var3 = hdr163_check((char *)(arg0), (unsigned long)((unsigned int)(var1)), (int *)(&payload_len[0]));
        rc = var3;
        local_2c = (((unsigned long)((unsigned int)(rc)) == 0) ? *(int *)(&payload_len[0]) : rc);
        return (unsigned int)(local_2c);
    } else {
        return (unsigned int)(-1);
    }
}

clang -O2

5/5
hdr163_build pass 56 lines 
// glaurung: hdr163_build @ 0x13f0
int32_t hdr163_build(uint8_t * arg0, int32_t arg1, uint32_t arg2, int32_t arg3) {
    int want;
    int total;
    int i;
    int room;
    long ret;
    long var1;
    int var18;
    int var7;
    var1 = (((long)(arg1) < 16) ? arg1 : 16);
    if ((arg0 == 0)) {
        return 0xffffffff;
    }
    want = ((0 <= (long)(arg3)) ? arg3 : 0);
    var7 = (((unsigned long)((unsigned long)((unsigned int)(want))) < (unsigned long)(6)) ? want : 6);
    total = (unsigned long)((unsigned int)((var7 + 10)));
    ret = 0xfffffffe;
    if (((unsigned long)((unsigned long)((unsigned int)((((long)((int)(var1)) < 0) ? 0 : var1)))) < (unsigned long)((unsigned long)((unsigned int)(total))))) {
        return ret;
    }
    *(int *)(((long)arg0)) = 0x302475a;
    *(signed char *)(((long)arg0 + 0x4)) = ((unsigned int)(arg2) >> 24);
    *(signed char *)(((long)arg0 + 0x5)) = ((unsigned int)(arg2) >> 16);
    *(signed char *)(((long)arg0 + 0x6)) = ((unsigned int)(arg2) >> 8);
    *(signed char *)(((long)arg0 + 0x7)) = arg2;
    *(signed char *)(((long)arg0 + 0x8)) = 0;
    *(signed char *)(((long)arg0 + 0x9)) = var7;
    if (((((unsigned long)((unsigned int)(arg3)) == 0) | ((long)(arg3) < 0)) != 0)) {
        if (((unsigned long)((unsigned long)((unsigned int)(want))) < (unsigned long)(6))) {
            return (unsigned int)(total);
        }
    }
    *(signed char *)(((long)arg0 + 0xa)) = 64;
    var18 = ((2 <= (long)((int)(var7))) ? var7 : 1);
    if ((2 <= (long)((int)(var7)))) {
        *(signed char *)(((long)arg0 + 0xb)) = 65;
        if (((unsigned long)((unsigned int)(var18)) == 2)) {
            return (unsigned int)(total);
        }
        *(signed char *)(((long)arg0 + 0xc)) = 66;
        if (((unsigned long)((unsigned int)(var18)) == 3)) {
            return (unsigned int)(total);
        }
        *(signed char *)(((long)arg0 + 0xd)) = 67;
        if (((unsigned long)((unsigned int)(var18)) == 4)) {
            return (unsigned int)(total);
        }
        *(signed char *)(((long)arg0 + 0xe)) = 68;
        if (((unsigned long)((unsigned int)(var18)) == 5)) {
            return (unsigned int)(total);
        }
        *(signed char *)(((long)arg0 + 0xf)) = 69;
    }
    return (unsigned int)(total);
}
hdr163_copy_payload pass 74 lines 
// glaurung: hdr163_copy_payload @ 0x12f0
int32_t hdr163_copy_payload(const uint8_t * arg0, int32_t arg1, uint8_t * arg2, int32_t arg3) {
    unsigned int declared;
    int i;
    int rc;
    int room;
    long ret;
    long var1;
    long var12;
    long var16;
    long var6;
    int var9;
    var1 = (((long)(arg3) < 16) ? arg3 : 16);
    ret = 0xffffffff;
    if ((arg0 == 0)) {
        return ret;
    }
    if ((arg2 == 0)) {
        return ret;
    }
    var6 = (((long)(arg1) < 16) ? arg1 : 16);
    var9 = ((0 <= (long)((int)(var6))) ? var6 : 0);
    ret = 0xfffffffe;
    if (((unsigned long)((unsigned long)((unsigned int)(var9))) < (unsigned long)(10))) {
        return ret;
    }
    var12 = (unsigned long)((unsigned int)(((unsigned int)((unsigned short)(*(short *)(((long)arg0)))) << 16)));
    ret = 0xfffffffd;
    if (((unsigned long)((unsigned int)(((((((unsigned int)(var12) & 255) << 24) | ((((unsigned int)(var12) >> 8) & 255) << 16)) | ((((unsigned int)(var12) >> 16) & 255) << 8)) | (((unsigned int)(var12) >> 24) & 255)))) != 0x5a47)) {
        return ret;
    }
    ret = 0xfffffffc;
    if (((unsigned long)((unsigned char)(*(char *)(((long)arg0 + 0x2)))) != 2)) {
        return ret;
    }
    ret = 0xfffffffb;
    if (((unsigned long)(15) < (unsigned long)((unsigned long)((unsigned char)(*(char *)(((long)arg0 + 0x3))))))) {
        return ret;
    }
    var16 = (unsigned long)((unsigned int)(((unsigned int)((unsigned short)(*(short *)(((long)arg0 + 0x8)))) << 16)));
    declared = (unsigned int)(((((((unsigned int)(var16) & 255) << 24) | ((((unsigned int)(var16) >> 8) & 255) << 16)) | ((((unsigned int)(var16) >> 16) & 255) << 8)) | (((unsigned int)(var16) >> 24) & 255)));
    ret = 0xfffffffa;
    if (((unsigned long)(6) < (unsigned long)(declared))) {
        return ret;
    }
    ret = 0xfffffff9;
    if (((unsigned long)((unsigned long)((unsigned int)((var9 - 10)))) < (unsigned long)(declared))) {
        return ret;
    }
    ret = 0xfffffff8;
    if (((unsigned long)((unsigned long)((unsigned int)(((0 <= (long)((int)(var1))) ? var1 : 0)))) < (unsigned long)(declared))) {
        return ret;
    }
    if ((declared == 0)) {
        return 0;
    }
    *(signed char *)(((long)arg2)) = *(char *)(((long)arg0 + 0xa));
    if ((declared != 1)) {
        *(signed char *)(((long)arg2 + 0x1)) = *(char *)(((long)arg0 + 0xb));
        if ((declared != 2)) {
            *(signed char *)(((long)arg2 + 0x2)) = *(char *)(((long)arg0 + 0xc));
            if ((declared != 3)) {
                *(signed char *)(((long)arg2 + 0x3)) = *(char *)(((long)arg0 + 0xd));
                if ((declared != 4)) {
                    *(signed char *)(((long)arg2 + 0x4)) = *(char *)(((long)arg0 + 0xe));
                    if ((declared != 5)) {
                        *(signed char *)(((long)arg2 + 0x5)) = *(char *)(((long)arg0 + 0xf));
                    }
                }
            }
        }
    }
    return declared;
}
hdr163_payload_digest pass 81 lines 
// glaurung: hdr163_payload_digest @ 0x11e0
int32_t hdr163_payload_digest(const uint8_t * arg0, int32_t arg1) {
    unsigned int declared;
    unsigned int acc;
    int i;
    long ret;
    long var1;
    long var12;
    int var17;
    int var30;
    long var32;
    int var34;
    long var36;
    int var38;
    int var4;
    long var40;
    int var42;
    long var7;
    int var9;
    if ((arg0 == 0)) {
        return 0xffffffff;
    }
    var1 = (((long)(arg1) < 16) ? arg1 : 16);
    var4 = ((0 <= (long)((int)(var1))) ? var1 : 0);
    ret = 0xfffffffe;
    if (((unsigned long)((unsigned long)((unsigned int)(var4))) < (unsigned long)(10))) {
        return ret;
    }
    var7 = (unsigned long)((unsigned int)(((unsigned int)((unsigned short)(*(short *)(((long)arg0)))) << 16)));
    ret = 0xfffffffd;
    if (((unsigned long)((unsigned int)(((((((unsigned int)(var7) & 255) << 24) | ((((unsigned int)(var7) >> 8) & 255) << 16)) | ((((unsigned int)(var7) >> 16) & 255) << 8)) | (((unsigned int)(var7) >> 24) & 255)))) != 0x5a47)) {
        return ret;
    }
    ret = 0xfffffffc;
    if (((unsigned long)((unsigned char)(*(char *)(((long)arg0 + 0x2)))) != 2)) {
        return ret;
    }
    var9 = (unsigned int)((unsigned char)(*(char *)(((long)arg0 + 0x3))));
    ret = 0xfffffffb;
    if (((unsigned long)(15) < (unsigned long)((unsigned long)((unsigned int)(var9))))) {
        return ret;
    }
    var12 = (unsigned long)((unsigned int)(((unsigned int)((unsigned short)(*(short *)(((long)arg0 + 0x8)))) << 16)));
    declared = (unsigned int)(((((((unsigned int)(var12) & 255) << 24) | ((((unsigned int)(var12) >> 8) & 255) << 16)) | ((((unsigned int)(var12) >> 16) & 255) << 8)) | (((unsigned int)(var12) >> 24) & 255)));
    ret = 0xfffffffa;
    if (((unsigned long)(6) < (unsigned long)(declared))) {
        return ret;
    }
    ret = 0xfffffff9;
    if (((unsigned long)((unsigned long)((unsigned int)((var4 - 10)))) < (unsigned long)(declared))) {
        return ret;
    }
    if ((declared == 0)) {
        var17 = 0x9e37;
    } else {
        var17 = ((((unsigned long)(0x9e00) >> 29) | ((unsigned long)((unsigned int)(((unsigned int)((unsigned char)(*(char *)(((long)arg0 + 0xa)))) + 0x9e37))) << 3)) & 0xffffffff);
        if ((declared != 1)) {
            var17 = ((((unsigned long)(0x40000) >> 29) | ((unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var17)) + (unsigned int)((unsigned char)(*(char *)(((long)arg0 + 0xb))))))) << 3)) & 0xffffffff);
            if ((declared != 2)) {
                var30 = (var17 + (unsigned int)((unsigned char)(*(char *)(((long)arg0 + 0xc)))));
                var32 = (((unsigned long)((unsigned int)(var30)) << 3) | ((unsigned long)((unsigned int)(var30)) >> 29));
                var17 = var32;
                if ((declared != 3)) {
                    var34 = (var32 + (unsigned int)((unsigned char)(*(char *)(((long)arg0 + 0xd)))));
                    var36 = (((unsigned long)((unsigned int)(var34)) << 3) | ((unsigned long)((unsigned int)(var34)) >> 29));
                    var17 = var36;
                    if ((declared != 4)) {
                        var38 = (var36 + (unsigned int)((unsigned char)(*(char *)(((long)arg0 + 0xe)))));
                        var40 = (((unsigned long)((unsigned int)(var38)) << 3) | ((unsigned long)((unsigned int)(var38)) >> 29));
                        var17 = var40;
                        if ((declared != 5)) {
                            var42 = (var40 + (unsigned int)((unsigned char)(*(char *)(((long)arg0 + 0xf)))));
                            var17 = (((unsigned long)((unsigned int)(var42)) << 3) | ((unsigned long)((unsigned int)(var42)) >> 29));
                        }
                    }
                }
            }
        }
    }
    return (unsigned int)(((unsigned long)((unsigned int)(((unsigned long)((unsigned int)(((unsigned long)((unsigned int)((var17 + var9))) & 1023))) + (declared * 100)))) + 1000));
}
hdr163_stream_id pass 38 lines 
// glaurung: hdr163_stream_id @ 0x1180
uint32_t hdr163_stream_id(const uint8_t * arg0, int32_t arg1) {
    unsigned int declared;
    long ret;
    long var1;
    long var11;
    long var15;
    int var4;
    long var7;
    ret = 0xffffffff;
    if ((arg0 != 0)) {
        var1 = (((long)(arg1) < 16) ? arg1 : 16);
        var4 = ((0 <= (long)((int)(var1))) ? var1 : 0);
        if (((unsigned long)((unsigned long)((unsigned int)(var4))) < (unsigned long)(10))) {
            return ret;
        }
        var7 = (unsigned long)((unsigned int)(((unsigned int)((unsigned short)(*(short *)(((long)arg0)))) << 16)));
        if (((unsigned long)((unsigned int)(((((((unsigned int)(var7) & 255) << 24) | ((((unsigned int)(var7) >> 8) & 255) << 16)) | ((((unsigned int)(var7) >> 16) & 255) << 8)) | (((unsigned int)(var7) >> 24) & 255)))) != 0x5a47)) {
            return ret;
        }
        if (((unsigned long)((unsigned char)(*(char *)(((long)arg0 + 0x2)))) != 2)) {
            return ret;
        }
        if (((unsigned long)(15) < (unsigned long)((unsigned long)((unsigned char)(*(char *)(((long)arg0 + 0x3))))))) {
            return ret;
        }
        var11 = (unsigned long)((unsigned int)(((unsigned int)((unsigned short)(*(short *)(((long)arg0 + 0x8)))) << 16)));
        declared = (unsigned int)(((((((unsigned int)(var11) & 255) << 24) | ((((unsigned int)(var11) >> 8) & 255) << 16)) | ((((unsigned int)(var11) >> 16) & 255) << 8)) | (((unsigned int)(var11) >> 24) & 255)));
        if (((unsigned long)(6) < (unsigned long)(declared))) {
            return ret;
        }
        if (((unsigned long)(declared) <= (unsigned long)((unsigned long)((unsigned int)((var4 - 10)))))) {
            var15 = (unsigned long)((unsigned int)(*(int *)(((long)arg0 + 0x4))));
            ret = (unsigned int)(((((((unsigned int)(var15) & 255) << 24) | ((((unsigned int)(var15) >> 8) & 255) << 16)) | ((((unsigned int)(var15) >> 16) & 255) << 8)) | (((unsigned int)(var15) >> 24) & 255)));
        }
    }
    return ret;
}
hdr163_validate pass 44 lines 
// glaurung: hdr163_validate @ 0x1100
int32_t hdr163_validate(const uint8_t * arg0, int32_t arg1) {
    unsigned int declared;
    int rc;
    long ret;
    long var1;
    long var12;
    int var4;
    int var5;
    long var8;
    if ((arg0 == 0)) {
        return 0xffffffff;
    }
    var1 = (((long)(arg1) < 16) ? arg1 : 16);
    var4 = ((0 <= (long)((int)(var1))) ? var1 : 0);
    var5 = 0xfffffffe;
    if (((unsigned long)(10) <= (unsigned long)((unsigned long)((unsigned int)(var4))))) {
        var8 = (unsigned long)((unsigned int)(((unsigned int)((unsigned short)(*(short *)(((long)arg0)))) << 16)));
        var5 = 0xfffffffd;
        if (((unsigned long)((unsigned int)(((((((unsigned int)(var8) & 255) << 24) | ((((unsigned int)(var8) >> 8) & 255) << 16)) | ((((unsigned int)(var8) >> 16) & 255) << 8)) | (((unsigned int)(var8) >> 24) & 255)))) != 0x5a47)) {
            return (unsigned int)(var5);
        }
        var5 = 0xfffffffc;
        if (((unsigned long)((unsigned char)(*(char *)(((long)arg0 + 0x2)))) != 2)) {
            return (unsigned int)(var5);
        }
        var5 = 0xfffffffb;
        if (((unsigned long)(15) < (unsigned long)((unsigned long)((unsigned char)(*(char *)(((long)arg0 + 0x3))))))) {
            return (unsigned int)(var5);
        }
        var12 = (unsigned long)((unsigned int)(((unsigned int)((unsigned short)(*(short *)(((long)arg0 + 0x8)))) << 16)));
        declared = (unsigned int)(((((((unsigned int)(var12) & 255) << 24) | ((((unsigned int)(var12) >> 8) & 255) << 16)) | ((((unsigned int)(var12) >> 16) & 255) << 8)) | (((unsigned int)(var12) >> 24) & 255)));
        var5 = 0xfffffffa;
        if (((unsigned long)(6) < (unsigned long)(declared))) {
            return (unsigned int)(var5);
        }
        var5 = 0xfffffff9;
        ret = (unsigned long)(declared);
        if (((unsigned long)(declared) <= (unsigned long)((unsigned long)((unsigned int)((var4 - 10)))))) {
            return ret;
        }
    }
    return (unsigned int)(var5);
}

gcc -O0

5/5
hdr163_build pass 42 lines 
// glaurung: hdr163_build @ 0x1541
int32_t hdr163_build(uint8_t * arg0, int32_t arg1, uint32_t arg2, int32_t arg3) {
    extern int hdr163_clamp(int);
    int room;
    int want;
    int total;
    int i;
    int var1;
    // x86-64 prologue: save rbp, frame 40 bytes
    var1 = hdr163_clamp((unsigned long)((unsigned int)(arg1)));
    room = var1;
    want = arg3;
    if ((arg0 != 0)) {
        if (((long)(want) < 0)) {
            want = 0;
        }
        if (((((unsigned long)((unsigned int)(want)) == 6) | ((long)(want) < 6)) == 0)) {
            want = 6;
        }
        total = ((unsigned int)(want) + 10);
        if ((total <= room)) {
            *(signed char *)((long)arg0) = 90;
            arg0[1] = 71;
            arg0[2] = 2;
            arg0[3] = 3;
            arg0[4] = ((unsigned int)(arg2) >> 24);
            arg0[5] = ((unsigned int)(arg2) >> 16);
            arg0[6] = ((unsigned int)(arg2) >> 8);
            arg0[7] = arg2;
            arg0[8] = ((unsigned long)((unsigned int)(want)) >> 8);
            arg0[9] = want;
            for (i = 0; (i < want); i++) {
                arg0[(long)((int)(((unsigned long)((unsigned int)(i)) + 10)))] = ((unsigned long)((unsigned int)(i)) + 64);
            }
            return (unsigned int)(total);
        } else {
            return 0xfffffffe;
        }
    } else {
        return 0xffffffff;
    }
}
hdr163_copy_payload pass 44 lines 
// glaurung: hdr163_copy_payload @ 0x1464
int32_t hdr163_copy_payload(const uint8_t * arg0, int32_t arg1, uint8_t * arg2, int32_t arg3) {
    extern __attribute__((noreturn)) void __stack_chk_fail(void);
    extern int hdr163_check(char *, int, int *);
    extern int hdr163_clamp(int);
    unsigned char payload_len[4];
    int room;
    int rc;
    int i;
    long local_8;
    long ret;
    int var11;
    int var4;
    int var7;
    // x86-64 prologue: save rbp, frame 64 bytes
    local_8 = (long)(0x28);
    *(int *)(&payload_len[0]) = 0;
    var4 = hdr163_clamp((unsigned long)((unsigned int)(arg3)));
    room = var4;
    if (((arg0 == 0) || (arg2 == 0))) {
        ret = 0xffffffff;
    } else {
        var7 = hdr163_clamp((unsigned long)((unsigned int)(arg1)));
        var11 = hdr163_check((char *)(arg0), (unsigned long)((unsigned int)(var7)), (int *)(&payload_len[0]));
        rc = var11;
        if (((unsigned long)((unsigned int)(rc)) == 0)) {
            if (((long)((int)(*(int *)(&payload_len[0]))) <= (long)(room))) {
                for (i = 0; ((long)(i) < (long)((int)(*(int *)(&payload_len[0])))); i++) {
                    arg2[i] = arg0[(long)((int)(((unsigned long)((unsigned int)(i)) + 10)))];
                }
                ret = (unsigned long)((unsigned int)(*(int *)(&payload_len[0])));
            } else {
                ret = 0xfffffff8;
            }
        } else {
            ret = (unsigned long)((unsigned int)(rc));
        }
    }
    if ((local_8 != 0x28)) {
        __stack_chk_fail();
    }
    // x86-64 epilogue: restore rbp
    return ret;
}
hdr163_payload_digest pass 40 lines 
// glaurung: hdr163_payload_digest @ 0x1388
int32_t hdr163_payload_digest(const uint8_t * arg0, int32_t arg1) {
    extern __attribute__((noreturn)) void __stack_chk_fail(void);
    extern int hdr163_check(char *, int, int *);
    extern int hdr163_clamp(int);
    unsigned char payload_len[4];
    unsigned int acc;
    int rc;
    int i;
    long local_8;
    long ret;
    int var4;
    int var8;
    // x86-64 prologue: save rbp, frame 48 bytes
    local_8 = (long)(0x28);
    *(int *)(&payload_len[0]) = 0;
    acc = 0x9e37;
    if ((arg0 != 0)) {
        var4 = hdr163_clamp((unsigned long)((unsigned int)(arg1)));
        var8 = hdr163_check((char *)(arg0), (unsigned long)((unsigned int)(var4)), (int *)(&payload_len[0]));
        rc = var8;
        if (((unsigned long)((unsigned int)(rc)) == 0)) {
            for (i = 0; ((long)(i) < (long)((int)(*(int *)(&payload_len[0])))); i++) {
                acc = (acc + (unsigned int)((unsigned char)(((unsigned int)((unsigned char)(arg0[(long)((int)(((unsigned long)((unsigned int)(i)) + 10)))])) & 255))));
                acc = ((acc << 3) | ((unsigned int)(acc) >> 29));
            }
            acc = (acc + (unsigned int)((unsigned char)(((unsigned int)((unsigned char)(arg0[3])) & 255))));
            ret = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)((acc & 1023))) + (unsigned long)((unsigned int)((((unsigned long)((unsigned int)(*(int *)(&payload_len[0]))) * 100) + 1000))))));
        } else {
            ret = (unsigned long)((unsigned int)(rc));
        }
    } else {
        ret = 0xffffffff;
    }
    if ((local_8 != 0x28)) {
        __stack_chk_fail();
    }
    // x86-64 epilogue: restore rbp
    return ret;
}
hdr163_stream_id pass 33 lines 
// glaurung: hdr163_stream_id @ 0x1302
uint32_t hdr163_stream_id(const uint8_t * arg0, int32_t arg1) {
    extern __attribute__((noreturn)) void __stack_chk_fail(void);
    extern unsigned int hdr163_be32(char *);
    extern int hdr163_check(char *, int, int *);
    extern int hdr163_clamp(int);
    unsigned char payload_len[4];
    long local_8;
    long ret;
    unsigned int var12;
    int var4;
    int var8;
    // x86-64 prologue: save rbp, frame 32 bytes
    local_8 = (long)(0x28);
    *(int *)(&payload_len[0]) = 0;
    if ((arg0 != 0)) {
        var4 = hdr163_clamp((unsigned long)((unsigned int)(arg1)));
        var8 = hdr163_check((char *)(arg0), (unsigned long)((unsigned int)(var4)), (int *)(&payload_len[0]));
        if (((unsigned long)((unsigned int)(var8)) == 0)) {
            var12 = hdr163_be32((char *)((arg0 + 4)));
            ret = (unsigned long)(var12);
        } else {
            ret = 0xffffffff;
        }
    } else {
        ret = 0xffffffff;
    }
    if ((local_8 != 0x28)) {
        __stack_chk_fail();
    }
    // x86-64 epilogue: restore rbp
    return ret;
}
hdr163_validate pass 28 lines 
// glaurung: hdr163_validate @ 0x1286
int32_t hdr163_validate(const uint8_t * arg0, int32_t arg1) {
    extern __attribute__((noreturn)) void __stack_chk_fail(void);
    extern int hdr163_check(char *, int, int *);
    extern int hdr163_clamp(int);
    unsigned char payload_len[4];
    int rc;
    long local_8;
    long ret;
    int var4;
    int var8;
    // x86-64 prologue: save rbp, frame 32 bytes
    local_8 = (long)(0x28);
    *(int *)(&payload_len[0]) = 0;
    if ((arg0 != 0)) {
        var4 = hdr163_clamp((unsigned long)((unsigned int)(arg1)));
        var8 = hdr163_check((char *)(arg0), (unsigned long)((unsigned int)(var4)), (int *)(&payload_len[0]));
        rc = var8;
        ret = (((unsigned long)((unsigned int)(rc)) == 0) ? (unsigned long)((unsigned int)(*(int *)(&payload_len[0]))) : (unsigned long)((unsigned int)(rc)));
    } else {
        ret = 0xffffffff;
    }
    if ((local_8 != 0x28)) {
        __stack_chk_fail();
    }
    // x86-64 epilogue: restore rbp
    return ret;
}

gcc -O2

5/5
hdr163_build pass 35 lines 
// glaurung: hdr163_build @ 0x1410
int32_t hdr163_build(uint8_t * arg0, int32_t arg1, uint32_t arg2, int32_t arg3) {
    int want;
    int total;
    int i;
    int room;
    long var1;
    long var15;
    long var2;
    long var9;
    var1 = (long)arg0;
    var2 = (((((unsigned long)((unsigned int)(arg1)) == 16) | ((long)(arg1) < 16)) == 0) ? 16 : arg1);
    if ((arg0 == 0)) {
        return 0xffffffff;
    }
    var9 = ((((unsigned long)((unsigned int)(arg3)) == 6) | ((long)(arg3) < 6)) ? arg3 : 6);
    want = (((long)((int)(var9)) < 0) ? 0 : var9);
    total = (unsigned long)((unsigned int)((want + 10)));
    if (((((long)((int)(var2)) < 0) ? 0 : var2) < total)) {
        return 0xfffffffe;
    }
    *(int *)((long)arg0) = 0x302475a;
    *(int *)((var1 + 0x4)) = (((((arg2 & 255) << 24) | (((arg2 >> 8) & 255) << 16)) | (((arg2 >> 16) & 255) << 8)) | ((arg2 >> 24) & 255));
    *(signed char *)((var1 + 0x8)) = 0;
    *(signed char *)((var1 + 0x9)) = want;
    if ((((unsigned long)((unsigned int)(arg3)) != 0) && (0 <= (long)(arg3)))) {
        i = 0;
        do {
            *(signed char *)((var1 + i + 0xa)) = (i + 64);
            var15 = ((unsigned long)((unsigned int)(i)) + 1);
            i = var15;
        } while (((((unsigned int)(want) == (unsigned int)(var15)) | ((long)(want) < (long)((int)(var15)))) == 0));
    }
    return (unsigned int)(total);
}
hdr163_copy_payload pass 53 lines 
// glaurung: hdr163_copy_payload @ 0x1350
int32_t hdr163_copy_payload(const uint8_t * arg0, int32_t arg1, uint8_t * arg2, int32_t arg3) {
    extern __attribute__((noreturn)) void __stack_chk_fail(void);
    extern int hdr163_check_constprop_0(char *, int, int *);
    unsigned char payload_len[4];
    int rc;
    int i;
    long local_10;
    int var10;
    long var12;
    int var15;
    long var17;
    long var21;
    long var4;
    long var6;
    local_10 = (long)(0x28);
    *(int *)(&payload_len[0]) = 0;
    if ((arg0 == 0)) {
        L_13ef: ;
        rc = 0xffffffff;
    } else {
        var4 = (long)arg2;
        if ((arg2 == 0)) {
            goto L_13ef;
        } else {
            var6 = (unsigned long)((unsigned int)(arg3));
            var10 = hdr163_check_constprop_0((char *)(arg0), (((long)((int)((((((unsigned long)((unsigned int)(arg1)) == 16) | ((long)(arg1) < 16)) == 0) ? 16 : arg1))) < 0) ? 0 : (((((unsigned long)((unsigned int)(arg1)) == 16) | ((long)(arg1) < 16)) == 0) ? 16 : arg1)), (int *)(&payload_len[0]));
            rc = (unsigned long)((unsigned int)(var10));
            if (((unsigned long)((unsigned int)(var10)) == 0)) {
                rc = (unsigned long)((unsigned int)(*(int *)(&payload_len[0])));
                var12 = ((((unsigned long)((unsigned int)(var6)) == 16) | ((long)((int)(var6)) < 16)) ? var6 : 16);
                var15 = (((long)((int)(var12)) < 0) ? 0 : var12);
                if (((((unsigned int)(rc) == (unsigned int)(var15)) | ((long)(rc) < (long)((int)(var15)))) == 0)) {
                    rc = 0xfffffff8;
                } else {
                    if (((((unsigned long)((unsigned int)(rc)) == 0) | ((long)(rc) < 0)) == 0)) {
                        var17 = (long)(rc);
                        i = 0;
                        do {
                            *(signed char *)((var4 + i)) = *(char *)(((long)arg0 + i + 0xa));
                            var21 = ((unsigned long)((unsigned int)(i)) + 1);
                            i = var21;
                        } while ((var21 != var17));
                    }
                }
            }
        }
    }
    if ((local_10 != 0x28)) {
        __stack_chk_fail();
    }
    return rc;
}
hdr163_payload_digest pass 48 lines 
// glaurung: hdr163_payload_digest @ 0x1290
int32_t hdr163_payload_digest(const uint8_t * arg0, int32_t arg1) {
    extern __attribute__((noreturn)) void __stack_chk_fail(void);
    extern int hdr163_check_constprop_0(char *, int, int *);
    unsigned char payload_len[4];
    int rc;
    unsigned int acc;
    int i;
    long local_10;
    long var11;
    long var13;
    long var15;
    long var16;
    int var17;
    int var18;
    int var8;
    long var9;
    local_10 = (long)(0x28);
    *(int *)(&payload_len[0]) = 0;
    if ((arg0 == 0)) {
        rc = 0xffffffff;
    } else {
        var8 = hdr163_check_constprop_0((char *)(arg0), (((long)((int)((((((unsigned long)((unsigned int)(arg1)) == 16) | ((long)(arg1) < 16)) == 0) ? 16 : arg1))) < 0) ? 0 : (((((unsigned long)((unsigned int)(arg1)) == 16) | ((long)(arg1) < 16)) == 0) ? 16 : arg1)), (int *)(&payload_len[0]));
        rc = (unsigned long)((unsigned int)(var8));
        if (((unsigned long)((unsigned int)(var8)) == 0)) {
            var9 = (unsigned long)((unsigned int)(*(int *)(&payload_len[0])));
            if ((((unsigned long)((unsigned int)(var9)) == 0) | ((long)((int)(var9)) < 0))) {
                var11 = 0x9e37;
            } else {
                var13 = (long)((arg0 + 10));
                var15 = (long)(((unsigned long)((unsigned int)((var9 + 10))) + (long)arg0));
                var16 = 0x9e37;
                do {
                    var17 = (unsigned int)((unsigned char)(*(char *)((var13))));
                    var13 = (var13 + 1);
                    var18 = (var16 + var17);
                    var16 = (((unsigned long)((unsigned int)(var18)) << 3) | ((unsigned long)((unsigned int)(var18)) >> 29));
                    var11 = var16;
                } while ((var15 != var13));
            }
            rc = (unsigned long)((unsigned int)((((unsigned long)((unsigned int)(((unsigned long)((unsigned int)((var11 + (unsigned int)((unsigned char)(*(char *)(((long)arg0 + 0x3))))))) & 1023))) + (var9 * 100)) + 1000)));
        }
    }
    if ((local_10 != 0x28)) {
        __stack_chk_fail();
    }
    return rc;
}
hdr163_stream_id pass 37 lines 
// glaurung: hdr163_stream_id @ 0x1230
uint32_t hdr163_stream_id(const uint8_t * arg0, int32_t arg1) {
    int payload_len;
    long t40;
    long var1;
    long var10;
    long var11;
    long var7;
    int var8;
    if ((arg0 != 0)) {
        var1 = ((((unsigned long)((unsigned int)(arg1)) == 16) | ((long)(arg1) < 16)) ? arg1 : 16);
        if ((((unsigned long)((unsigned int)(arg1)) == 9) | ((long)(arg1) < 9))) {
            return 0xffffffff;
        }
        if (((unsigned long)((unsigned short)(*(short *)(((long)arg0)))) != 0x475a)) {
            return 0xffffffff;
        }
        if (((unsigned long)((unsigned char)(*(char *)(((long)arg0 + 0x2)))) != 2)) {
            return 0xffffffff;
        }
        if (((unsigned long)((unsigned char)((*(char *)(((long)arg0 + 0x3)) & -16))) != 0)) {
            return 0xffffffff;
        }
        t40 = ((unsigned int)((unsigned short)(*(short *)(((long)arg0 + 0x8)))) & 0xffff);
        var7 = (((t40 << 8) | ((unsigned long)(t40) >> 8)) & 0xffff);
        var8 = (unsigned int)((unsigned short)((var7 & 0xffff)));
        if (((unsigned long)(6) < (unsigned long)((unsigned long)((unsigned short)((var7 & 0xffff)))))) {
            return 0xffffffff;
        }
        var10 = (unsigned long)((unsigned int)(((((long)((int)(var1)) < 0) ? 0 : var1) - 9)));
        if (((((unsigned int)(var10) == (unsigned int)(var8)) | ((long)((int)(var10)) < (long)((int)(var8)))) == 0)) {
            var11 = (unsigned long)((unsigned int)(*(int *)(((long)arg0 + 0x4))));
            return (unsigned int)(((((((unsigned int)(var11) & 255) << 24) | ((((unsigned int)(var11) >> 8) & 255) << 16)) | ((((unsigned int)(var11) >> 16) & 255) << 8)) | (((unsigned int)(var11) >> 24) & 255)));
        }
    }
    return 0xffffffff;
}
hdr163_validate pass 33 lines 
// glaurung: hdr163_validate @ 0x11a0
int32_t hdr163_validate(const uint8_t * arg0, int32_t arg1) {
    int payload_len;
    long t40;
    long var1;
    long var10;
    long var7;
    int var8;
    if ((arg0 == 0)) {
        return 0xffffffff;
    }
    var1 = ((((unsigned long)((unsigned int)(arg1)) == 16) | ((long)(arg1) < 16)) ? arg1 : 16);
    if ((((unsigned long)((unsigned int)(arg1)) == 9) | ((long)(arg1) < 9))) {
        return 0xfffffffe;
    }
    if (((unsigned long)((unsigned short)(*(short *)(((long)arg0)))) != 0x475a)) {
        return 0xfffffffd;
    }
    if (((unsigned long)((unsigned char)(*(char *)(((long)arg0 + 0x2)))) != 2)) {
        return 0xfffffffc;
    }
    if (((unsigned long)((unsigned char)((*(char *)(((long)arg0 + 0x3)) & -16))) != 0)) {
        return 0xfffffffb;
    }
    t40 = ((unsigned int)((unsigned short)(*(short *)(((long)arg0 + 0x8)))) & 0xffff);
    var7 = (((t40 << 8) | ((unsigned long)(t40) >> 8)) & 0xffff);
    var8 = (unsigned int)((unsigned short)((var7 & 0xffff)));
    if (((unsigned long)(6) < (unsigned long)((unsigned long)((unsigned short)((var7 & 0xffff)))))) {
        return 0xfffffffa;
    }
    var10 = (unsigned long)((unsigned int)(((((long)((int)(var1)) < 0) ? 0 : var1) - 9)));
    return ((((unsigned int)(var10) == (unsigned int)(var8)) | ((long)((int)(var10)) < (long)((int)(var8)))) ? 0xfffffff9 : var8);
}

← 213 fixtures