#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ uid_t;
typedef int pid_t;
typedef int /*<<< orphan*/ gid_t;

/* Variables and functions */
scalar_t__ FD_CLOEXEC;
int /*<<< orphan*/ F_SETFD;
int /*<<< orphan*/ O_RDONLY;
int WEXITSTATUS(int);
int /*<<< orphan*/ WIFEXITED(int);
char **argv_build(char const *);
int /*<<< orphan*/ close(int);
char **env_build(char const **, char const *);
int /*<<< orphan*/ execve(char *, char **, char **);
int /*<<< orphan*/ exit(int);
int /*<<< orphan*/ fcntl(int, int /*<<< orphan*/, long);
int fork();
int /*<<< orphan*/ open(char *, int /*<<< orphan*/);
int /*<<< orphan*/ pipe(int *);
int read(int, char *, int);
scalar_t__ setresgid(int /*<<< orphan*/, int /*<<< orphan*/,
                     int /*<<< orphan*/);
scalar_t__ setresuid(int /*<<< orphan*/, int /*<<< orphan*/,
                     int /*<<< orphan*/);
int /*<<< orphan*/ waitpid(int, int *, int /*<<< orphan*/);
int /*<<< orphan*/ write(int, char *, int);
int exec_cmd(const char *cmd, const char **envp, const char *envadd, uid_t uid,
             gid_t gid) {
  int pfd[2], n, status;
  pid_t pid;
  char **argv, **env;
  char buf[2];
  pipe(pfd);
  fcntl(pfd[1], F_SETFD, (long)FD_CLOEXEC);
  pid = fork();
  if (pid == -1)
    return -1;
  if (pid == 0) {
    argv = argv_build(cmd);
    env = env_build(envp, envadd);
    close(0);
    open("/dev/null", O_RDONLY);
    close(pfd[0]);
    if (setresuid(uid, uid, uid))
      goto errout;
    if (setresgid(gid, gid, gid))
      goto errout;
    execve(argv[0], argv, env);
  errout:
    write(pfd[1], "E", 1);
    exit(99);
  }
  close(pfd[1]);
  n = read(pfd[0], buf, 1);
  close(pfd[0]);
  if (n == 1) {
    waitpid(pid, &status, 0);
    return -1;
  }
  waitpid(pid, &status, 0);
  if (!WIFEXITED(status))
    return -2;
  return WEXITSTATUS(status);
}


x86 assembly (clang, -O0):
<exec_cmd>:
push   %rbp
mov    %rsp,%rbp
sub    $0x60,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %ecx,-0x24(%rbp)
mov    %r8d,-0x28(%rbp)
lea    -0x30(%rbp),%rdi
call   1080 <pipe@plt>
mov    -0x2c(%rbp),%edi
mov    0x2daa(%rip),%rax
mov    (%rax),%esi
mov    0x2d99(%rip),%rax
mov    (%rax),%rdx
call   1030 <fcntl@plt>
mov    $0x0,%al
call   1120 <fork@plt>
mov    %eax,-0x3c(%rbp)
cmpl   $0xffffffff,-0x3c(%rbp)
jne    125f <exec_cmd+0x5f>
movl   $0xffffffff,-0x4(%rbp)
jmp    1395 <exec_cmd+0x195>
cmpl   $0x0,-0x3c(%rbp)
jne    1317 <exec_cmd+0x117>
mov    -0x10(%rbp),%rdi
call   1110 <argv_build@plt>
mov    %rax,-0x48(%rbp)
mov    -0x18(%rbp),%rdi
mov    -0x20(%rbp),%rsi
call   1100 <env_build@plt>
mov    %rax,-0x50(%rbp)
xor    %edi,%edi
call   1070 <close@plt>
mov    0x2d53(%rip),%rax
mov    (%rax),%esi
lea    0xd62(%rip),%rdi
call   10d0 <open@plt>
mov    -0x30(%rbp),%edi
call   1070 <close@plt>
mov    -0x24(%rbp),%edi
mov    -0x24(%rbp),%esi
mov    -0x24(%rbp),%edx
call   1050 <setresuid@plt>
cmp    $0x0,%rax
je     12c8 <exec_cmd+0xc8>
jmp    12f9 <exec_cmd+0xf9>
mov    -0x28(%rbp),%edi
mov    -0x28(%rbp),%esi
mov    -0x28(%rbp),%edx
call   1060 <setresgid@plt>
cmp    $0x0,%rax
je     12e5 <exec_cmd+0xe5>
jmp    12f9 <exec_cmd+0xf9>
mov    -0x48(%rbp),%rax
mov    (%rax),%rdi
mov    -0x48(%rbp),%rsi
mov    -0x50(%rbp),%rdx
call   10a0 <execve@plt>
mov    -0x2c(%rbp),%edi
lea    0xd07(%rip),%rsi
mov    $0x1,%edx
call   1040 <write@plt>
mov    $0x63,%edi
call   10f0 <exit@plt>
mov    -0x2c(%rbp),%edi
call   1070 <close@plt>
mov    -0x30(%rbp),%edi
lea    -0x52(%rbp),%rsi
mov    $0x1,%edx
call   1090 <read@plt>
mov    %eax,-0x34(%rbp)
mov    -0x30(%rbp),%edi
call   1070 <close@plt>
cmpl   $0x1,-0x34(%rbp)
jne    135f <exec_cmd+0x15f>
mov    -0x3c(%rbp),%edi
lea    -0x38(%rbp),%rsi
xor    %edx,%edx
call   10c0 <waitpid@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    1395 <exec_cmd+0x195>
mov    -0x3c(%rbp),%edi
lea    -0x38(%rbp),%rsi
xor    %edx,%edx
call   10c0 <waitpid@plt>
mov    -0x38(%rbp),%edi
call   10e0 <WIFEXITED@plt>
cmp    $0x0,%eax
jne    138a <exec_cmd+0x18a>
movl   $0xfffffffe,-0x4(%rbp)
jmp    1395 <exec_cmd+0x195>
mov    -0x38(%rbp),%edi
call   10b0 <WEXITSTATUS@plt>
mov    %eax,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x60,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<exec_cmd>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %r8d,%r12d
mov    %ecx,%r13d
mov    %rdx,%r15
mov    %rsi,%r14
mov    %rdi,%rbp
lea    0x8(%rsp),%rdi
call   1080 <pipe@plt>
mov    0xc(%rsp),%edi
mov    0x2da6(%rip),%rax
mov    (%rax),%esi
mov    0x2d95(%rip),%rax
mov    (%rax),%rdx
call   1030 <fcntl@plt>
xor    %eax,%eax
call   1120 <fork@plt>
mov    %eax,%ebx
cmp    $0xffffffff,%eax
je     12b3 <exec_cmd+0xb3>
test   %ebx,%ebx
je     12c4 <exec_cmd+0xc4>
mov    0xc(%rsp),%edi
call   1070 <close@plt>
mov    0x8(%rsp),%edi
lea    0x16(%rsp),%rsi
mov    $0x1,%edx
call   1090 <read@plt>
mov    %eax,%ebp
mov    0x8(%rsp),%edi
call   1070 <close@plt>
lea    0x10(%rsp),%rsi
mov    %ebx,%edi
xor    %edx,%edx
call   10c0 <waitpid@plt>
mov    $0xffffffff,%ebx
cmp    $0x1,%ebp
je     12b3 <exec_cmd+0xb3>
mov    0x10(%rsp),%edi
call   10e0 <WIFEXITED@plt>
test   %eax,%eax
je     12ae <exec_cmd+0xae>
mov    0x10(%rsp),%edi
call   10b0 <WEXITSTATUS@plt>
mov    %eax,%ebx
jmp    12b3 <exec_cmd+0xb3>
mov    $0xfffffffe,%ebx
mov    %ebx,%eax
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    %rbp,%rdi
call   1110 <argv_build@plt>
mov    %rax,%rbx
mov    %r14,%rdi
mov    %r15,%rsi
call   1100 <env_build@plt>
mov    %rax,%r15
xor    %edi,%edi
call   1070 <close@plt>
mov    0x2cfd(%rip),%rax
mov    (%rax),%esi
lea    0xd0c(%rip),%rdi
call   10d0 <open@plt>
mov    0x8(%rsp),%edi
call   1070 <close@plt>
mov    %r13d,%edi
mov    %r13d,%esi
mov    %r13d,%edx
call   1050 <setresuid@plt>
test   %rax,%rax
jne    1336 <exec_cmd+0x136>
mov    %r12d,%edi
mov    %r12d,%esi
mov    %r12d,%edx
call   1060 <setresgid@plt>
test   %rax,%rax
jne    1336 <exec_cmd+0x136>
mov    (%rbx),%rdi
mov    %rbx,%rsi
mov    %r15,%rdx
call   10a0 <execve@plt>
mov    0xc(%rsp),%edi
lea    0xcc9(%rip),%rsi
mov    $0x1,%edx
call   1040 <write@plt>
mov    $0x63,%edi
call   10f0 <exit@plt>

LLVM IR (-O0):
@F_SETFD = global i32 0
@FD_CLOEXEC = global i64 0
@.str = [10 x i8] c"/dev/null\00"
@O_RDONLY = global i32 0
@.str.1 = [2 x i8] c"E\00"
define i32 @exec_cmd(i8* %0, i8** %1, i8* %2, i32 %3, i32 %4) {
%6 = alloca i32
%7 = alloca i8*
%8 = alloca i8**
%9 = alloca i8*
%10 = alloca i32
%11 = alloca i32
%12 = alloca [2 x i32]
%13 = alloca i32
%14 = alloca i32
%15 = alloca i32
%16 = alloca i8**
%17 = alloca i8**
%18 = alloca [2 x i8]
store i8* %0, i8** %7
store i8** %1, i8*** %8
store i8* %2, i8** %9
store i32 %3, i32* %10
store i32 %4, i32* %11
%19 = getelementptr inbounds [2 x i32], [2 x i32]* %12, i64 0, i64 0
%20 = call i32 @pipe(i32* %19)
%21 = getelementptr inbounds [2 x i32], [2 x i32]* %12, i64 0, i64 1
%22 = load i32, i32* %21
%23 = load i32, i32* @F_SETFD
%24 = load i64, i64* @FD_CLOEXEC
%25 = call i32 @fcntl(i32 %22, i32 %23, i64 %24)
%26 = call i32 (...) @fork()
store i32 %26, i32* %15
%27 = load i32, i32* %15
%28 = icmp eq i32 %27, -1
br i1 %28, label %29, label %30
29: ; preds = %5
store i32 -1, i32* %6
br label %96
30: ; preds = %5
%31 = load i32, i32* %15
%32 = icmp eq i32 %31, 0
br i1 %32, label %33, label %70
33: ; preds = %30
%34 = load i8*, i8** %7
%35 = call i8** @argv_build(i8* %34)
store i8** %35, i8*** %16
%36 = load i8**, i8*** %8
%37 = load i8*, i8** %9
%38 = call i8** @env_build(i8** %36, i8* %37)
store i8** %38, i8*** %17
%39 = call i32 @close(i32 0)
%40 = load i32, i32* @O_RDONLY
%41 = call i32 @open(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i32 %40)
%42 = getelementptr inbounds [2 x i32], [2 x i32]* %12, i64 0, i64 0
%43 = load i32, i32* %42
%44 = call i32 @close(i32 %43)
%45 = load i32, i32* %10
%46 = load i32, i32* %10
%47 = load i32, i32* %10
%48 = call i64 @setresuid(i32 %45, i32 %46, i32 %47)
%49 = icmp ne i64 %48, 0
br i1 %49, label %50, label %51
50: ; preds = %33
br label %65
51: ; preds = %33
%52 = load i32, i32* %11
%53 = load i32, i32* %11
%54 = load i32, i32* %11
%55 = call i64 @setresgid(i32 %52, i32 %53, i32 %54)
%56 = icmp ne i64 %55, 0
br i1 %56, label %57, label %58
57: ; preds = %51
br label %65
58: ; preds = %51
%59 = load i8**, i8*** %16
%60 = getelementptr inbounds i8*, i8** %59, i64 0
%61 = load i8*, i8** %60
%62 = load i8**, i8*** %16
%63 = load i8**, i8*** %17
%64 = call i32 @execve(i8* %61, i8** %62, i8** %63)
br label %65
65: ; preds = %58, %57, %50
%66 = getelementptr inbounds [2 x i32], [2 x i32]* %12, i64 0, i64 1
%67 = load i32, i32* %66
%68 = call i32 @write(i32 %67, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0), i32 1)
%69 = call i32 @exit(i32 99)
unreachable
70: ; preds = %30
%71 = getelementptr inbounds [2 x i32], [2 x i32]* %12, i64 0, i64 1
%72 = load i32, i32* %71
%73 = call i32 @close(i32 %72)
%74 = getelementptr inbounds [2 x i32], [2 x i32]* %12, i64 0, i64 0
%75 = load i32, i32* %74
%76 = getelementptr inbounds [2 x i8], [2 x i8]* %18, i64 0, i64 0
%77 = call i32 @read(i32 %75, i8* %76, i32 1)
store i32 %77, i32* %13
%78 = getelementptr inbounds [2 x i32], [2 x i32]* %12, i64 0, i64 0
%79 = load i32, i32* %78
%80 = call i32 @close(i32 %79)
%81 = load i32, i32* %13
%82 = icmp eq i32 %81, 1
br i1 %82, label %83, label %86
83: ; preds = %70
%84 = load i32, i32* %15
%85 = call i32 @waitpid(i32 %84, i32* %14, i32 0)
store i32 -1, i32* %6
br label %96
86: ; preds = %70
%87 = load i32, i32* %15
%88 = call i32 @waitpid(i32 %87, i32* %14, i32 0)
%89 = load i32, i32* %14
%90 = call i32 @WIFEXITED(i32 %89)
%91 = icmp ne i32 %90, 0
br i1 %91, label %93, label %92
92: ; preds = %86
store i32 -2, i32* %6
br label %96
93: ; preds = %86
%94 = load i32, i32* %14
%95 = call i32 @WEXITSTATUS(i32 %94)
store i32 %95, i32* %6
br label %96
96: ; preds = %93, %92, %83, %29
%97 = load i32, i32* %6
ret i32 %97
}

LLVM IR (-O2):
@F_SETFD = global i32 0
@FD_CLOEXEC = global i64 0
@.str = [10 x i8] c"/dev/null\00"
@O_RDONLY = global i32 0
@.str.1 = [2 x i8] c"E\00"
define i32 @exec_cmd(i8* %0, i8** %1, i8* %2, i32 %3, i32 %4) {
%6 = alloca [2 x i32]
%7 = alloca i32
%8 = alloca [2 x i8]
%9 = bitcast [2 x i32]* %6 to i8*
%10 = bitcast i32* %7 to i8*
%11 = getelementptr inbounds [2 x i8], [2 x i8]* %8, i64 0, i64 0
%12 = getelementptr inbounds [2 x i32], [2 x i32]* %6, i64 0, i64 0
%13 = call i32 @pipe(i32* %12)
%14 = getelementptr inbounds [2 x i32], [2 x i32]* %6, i64 0, i64 1
%15 = load i32, i32* %14
%16 = load i32, i32* @F_SETFD
%17 = load i64, i64* @FD_CLOEXEC
%18 = call i32 @fcntl(i32 %15, i32 %16, i64 %17)
%19 = call i32 (...) @fork()
switch i32 %19, label %40 [
i32 -1, label %56
i32 0, label %20
]
20: ; preds = %5
%21 = call i8** @argv_build(i8* %0)
%22 = call i8** @env_build(i8** %1, i8* %2)
%23 = call i32 @close(i32 0)
%24 = load i32, i32* @O_RDONLY
%25 = call i32 @open(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i32 %24)
%26 = load i32, i32* %12
%27 = call i32 @close(i32 %26)
%28 = call i64 @setresuid(i32 %3, i32 %3, i32 %3)
%29 = icmp eq i64 %28, 0
br i1 %29, label %30, label %36
30: ; preds = %20
%31 = call i64 @setresgid(i32 %4, i32 %4, i32 %4)
%32 = icmp eq i64 %31, 0
br i1 %32, label %33, label %36
33: ; preds = %30
%34 = load i8*, i8** %21
%35 = call i32 @execve(i8* %34, i8** %21, i8** %22)
br label %36
36: ; preds = %30, %20, %33
%37 = load i32, i32* %14
%38 = call i32 @write(i32 %37, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0), i32 1)
%39 = call i32 @exit(i32 99)
unreachable
40: ; preds = %5
%41 = load i32, i32* %14
%42 = call i32 @close(i32 %41)
%43 = load i32, i32* %12
%44 = call i32 @read(i32 %43, i8* %11, i32 1)
%45 = load i32, i32* %12
%46 = call i32 @close(i32 %45)
%47 = icmp eq i32 %44, 1
%48 = call i32 @waitpid(i32 %19, i32* %7, i32 0)
br i1 %47, label %56, label %49
49: ; preds = %40
%50 = load i32, i32* %7
%51 = call i32 @WIFEXITED(i32 %50)
%52 = icmp eq i32 %51, 0
br i1 %52, label %56, label %53
53: ; preds = %49
%54 = load i32, i32* %7
%55 = call i32 @WEXITSTATUS(i32 %54)
br label %56
56: ; preds = %40, %49, %5, %53
%57 = phi i32 [ %55, %53 ], [ %19, %5 ], [ -2, %49 ], [ -1, %40 ]
ret i32 %57
}