brainfuck interpreter (md5 collision demonstration)

// by petter wahlman, www.twitter.com/badeip
// inspired by smashthestack.org, IO level 11 by bla
//
// save http://pastebin.com/tFVjLun8 as md5_is_broken.b64
// save http://pastebin.com/aUr844Di as md5_is_secure.b64
// compile this program:
// gcc brainfuck.c -o brainfuck
//
// verify that the md5's are identical:
// base64 -d md5_is_broken.b64 | md5sum -
//     06f5044af1ad9ddb61e533e59549b829
//
// base64 -d md5_is_broken.b64 | md5sum -
//     06f5044af1ad9ddb61e533e59549b829
//
// notice the different output when interpreted:
//
// base64 -d md5_is_broken.b64 | ./brainfuck
// decoded: 'md5 is broken'
//
// base64 -d md5_is_secure.b64 | ./brainfuck
// decoded: 'md5_is_secure'


#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/types.h>

#define MAX_NESTING 100
int bf(char *prog, char *result, int maxlen)
{
    int output_len = 0;
    char tape[4001];
    int edi=0, eip=0;
    unsigned long endless_loop_protection = 100000;
    int loopstart[MAX_NESTING + 1], depth = 0, state;

    memset(tape, 0, sizeof(tape));
    while(eip < strlen(prog) && --endless_loop_protection) {
        switch(prog[eip]) {
            case '<':
                if(edi) --edi;
                break;
            case '>':
                if(edi<4000) ++edi;
                break;
            case '+':
                ++tape[edi];
                break;
            case '-':
                --tape[edi];
                break;
            case '.':
                if (output_len < maxlen) result[output_len++] = tape[edi];
                break;
            case ',':
                break;
            case '[':
                state=1;
                if(!tape[edi])
                    while (state && ++eip < strlen(prog))
                        if (prog[eip] ==']') --state;
                        else if (prog[eip] == '[') ++state;
                        else;
                else if (depth < MAX_NESTING)
                    loopstart[++depth] = eip;
                break;
            case ']':
                if(depth)
                    if(tape[edi] == 0)
                        --depth;
                    else
                        eip = loopstart[depth];
                break;
        }
        ++eip;
    }

    result[output_len]=0;
    return output_len;
}


int main(int argc, char **argv, char **env)
{
    char input[4096];
    char output[4096];

    memset(input, 0, sizeof(input));
    fread(input, sizeof(input) -1, 1, stdin);

    bf(input, output, sizeof(output)-1);

    printf("decoded: '%s'\n", output);

    return 0;
}