#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ s_unused;
typedef int pid_t;

/* Variables and functions */
char **calloc(int, int);
scalar_t__ errno;
scalar_t__ execve(char const *, char **, char **);
int /*<<< orphan*/ exit(int);
int fork();
int /*<<< orphan*/ free(char *);
int /*<<< orphan*/ memset(char **, char, int);
int /*<<< orphan*/ perror(char *);
char **realloc(char **, int);
char *safe_env(char const *const);
int /*<<< orphan*/ setenv(char *, char *, int);
scalar_t__ snprintf(char *, int, char *, int);
char *strchr(char const *, char);
void *strndup(char const *, int);
int /*<<< orphan*/ unsetenv(char *);
int /*<<< orphan*/ waitpid(int, int *, int /*<<< orphan*/);
int safe_exec(const char *cmdWithArgs, int total_unused) {
  if (!cmdWithArgs)
    return -2;
  pid_t child;
  if ((child = fork()) == 0) {
    int szCur = 0, szMax = 10;
    char **args = calloc(szMax, sizeof(char *));
    const char *cmd = NULL;
    const char *prv = cmdWithArgs;
    const char *cur = NULL;
    char s_unused[11];
    if (snprintf(&s_unused[0], sizeof(s_unused) / sizeof(s_unused[0]), "%d",
                 total_unused) > 0) {
      setenv("SLEEPD_UNUSED", &s_unused[0], 1);
    } else
      unsetenv("SLEEPD_UNUSED");
    const char *const envnames[] = {"SLEEPD_XUSER", "SLEEPD_UNUSED", "DISPLAY",
                                    "XAUTHORITY", NULL};
    const unsigned maxEnv = (sizeof((envnames)) / sizeof((envnames)[0]));
    char *envp[maxEnv];
    unsigned i = 0, j = 0;
    memset(&envp[0], '\0',
           (sizeof((envp)) / sizeof((envp)[0])) * sizeof(char *));
    do {
      char *tmp = safe_env(envnames[i]);
      if (tmp) {
        envp[j] = strndup(tmp, 1024);
        free(tmp);
        j++;
      }
    } while (++i < maxEnv);
    while ((cur = strchr(prv, ' '))) {
      if (cmd == NULL)
        cmd = strndup(prv, cur - prv);
      if (szCur >= szMax - 2) {
        szMax *= 2;
        args = realloc(args, sizeof(char *) * szMax);
      }
      args[szCur++] = strndup(prv, cur - prv);
      cur++;
      prv = cur;
    }
    if (cmd == NULL) {
      cmd = cmdWithArgs;
      args[0] = strndup(cmd, 1024);
      szCur++;
    } else {
      args[szCur++] = strndup(prv, cur - prv);
    }
    args[szCur] = NULL;
    errno = 0;
    if (execve(cmd, args, envp) != 0)
      perror("execve");
    exit(-3);
  } else if (child != -1) {
    int retval = 0;
    waitpid(child, &retval, 0);
    return retval;
  }
  return -4;
}


x86 assembly (clang, -O0):
<safe_exec>:
push   %rbp
mov    %rsp,%rbp
sub    $0xb0,%rsp
mov    %rdi,-0x10(%rbp)
mov    %esi,-0x14(%rbp)
cmpq   $0x0,-0x10(%rbp)
jne    1219 <safe_exec+0x29>
movl   $0xfffffffe,-0x4(%rbp)
jmp    1569 <safe_exec+0x379>
mov    $0x0,%al
call   1110 <fork@plt>
mov    %eax,-0x18(%rbp)
cmp    $0x0,%eax
jne    152a <safe_exec+0x33a>
movl   $0x0,-0x1c(%rbp)
movl   $0xa,-0x20(%rbp)
mov    -0x20(%rbp),%edi
mov    $0x8,%esi
call   10b0 <calloc@plt>
mov    %rax,-0x28(%rbp)
movq   $0x0,-0x30(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0x38(%rbp)
movq   $0x0,-0x40(%rbp)
lea    -0x4b(%rbp),%rdi
mov    -0x14(%rbp),%ecx
mov    $0xb,%esi
lea    0xd8a(%rip),%rdx
call   1060 <snprintf@plt>
cmp    $0x0,%rax
jle    129f <safe_exec+0xaf>
lea    -0x4b(%rbp),%rsi
lea    0xd73(%rip),%rdi
mov    $0x1,%edx
call   1040 <setenv@plt>
jmp    12ab <safe_exec+0xbb>
lea    0xd5d(%rip),%rdi
call   10f0 <unsetenv@plt>
xorps  %xmm0,%xmm0
movaps %xmm0,-0x70(%rbp)
movaps %xmm0,-0x80(%rbp)
movq   $0x0,-0x60(%rbp)
lea    0xd4c(%rip),%rax
mov    %rax,-0x80(%rbp)
lea    0xd33(%rip),%rax
mov    %rax,-0x78(%rbp)
lea    0xd43(%rip),%rax
mov    %rax,-0x70(%rbp)
lea    0xd40(%rip),%rax
mov    %rax,-0x68(%rbp)
movl   $0x5,-0x84(%rbp)
mov    %rsp,%rax
mov    %rax,-0x90(%rbp)
mov    %rsp,%rdi
add    $0xffffffffffffffd0,%rdi
mov    %rdi,-0xb0(%rbp)
mov    %rdi,%rsp
movl   $0x0,-0x94(%rbp)
movl   $0x0,-0x98(%rbp)
xor    %esi,%esi
mov    $0x28,%edx
call   1080 <memset@plt>
mov    -0x94(%rbp),%eax
mov    -0x80(%rbp,%rax,8),%rdi
call   1070 <safe_env@plt>
mov    %rax,-0xa0(%rbp)
cmpq   $0x0,-0xa0(%rbp)
je     1394 <safe_exec+0x1a4>
mov    -0xa0(%rbp),%rdi
mov    $0x400,%esi
call   1090 <strndup@plt>
mov    %rax,%rdx
mov    -0xb0(%rbp),%rax
mov    -0x98(%rbp),%ecx
mov    %rdx,(%rax,%rcx,8)
mov    -0xa0(%rbp),%rdi
call   1030 <free@plt>
mov    -0x98(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x98(%rbp)
jmp    1399 <safe_exec+0x1a9>
mov    -0x94(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x94(%rbp)
cmp    $0x5,%eax
jb     132f <safe_exec+0x13f>
jmp    13b6 <safe_exec+0x1c6>
mov    -0x38(%rbp),%rdi
mov    $0x20,%esi
call   1050 <strchr@plt>
mov    %rax,-0x40(%rbp)
cmp    $0x0,%rax
je     1470 <safe_exec+0x280>
cmpq   $0x0,-0x30(%rbp)
jne    13f7 <safe_exec+0x207>
mov    -0x38(%rbp),%rdi
mov    -0x40(%rbp),%rax
mov    -0x38(%rbp),%rcx
sub    %rcx,%rax
mov    %eax,%esi
call   1090 <strndup@plt>
mov    %rax,-0x30(%rbp)
mov    -0x1c(%rbp),%eax
mov    -0x20(%rbp),%ecx
sub    $0x2,%ecx
cmp    %ecx,%eax
jl     1428 <safe_exec+0x238>
mov    -0x20(%rbp),%eax
shl    $0x1,%eax
mov    %eax,-0x20(%rbp)
mov    -0x28(%rbp),%rdi
movslq -0x20(%rbp),%rax
shl    $0x3,%rax
mov    %eax,%esi
call   10c0 <realloc@plt>
mov    %rax,-0x28(%rbp)
mov    -0x38(%rbp),%rdi
mov    -0x40(%rbp),%rax
mov    -0x38(%rbp),%rcx
sub    %rcx,%rax
mov    %eax,%esi
call   1090 <strndup@plt>
mov    %rax,%rdx
mov    -0x28(%rbp),%rax
mov    -0x1c(%rbp),%ecx
mov    %ecx,%esi
add    $0x1,%esi
mov    %esi,-0x1c(%rbp)
movslq %ecx,%rcx
mov    %rdx,(%rax,%rcx,8)
mov    -0x40(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x40(%rbp)
mov    -0x40(%rbp),%rax
mov    %rax,-0x38(%rbp)
jmp    13b6 <safe_exec+0x1c6>
cmpq   $0x0,-0x30(%rbp)
jne    14a9 <safe_exec+0x2b9>
mov    -0x10(%rbp),%rax
mov    %rax,-0x30(%rbp)
mov    -0x30(%rbp),%rdi
mov    $0x400,%esi
call   1090 <strndup@plt>
mov    %rax,%rcx
mov    -0x28(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x1c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c(%rbp)
jmp    14d8 <safe_exec+0x2e8>
mov    -0x38(%rbp),%rdi
mov    -0x40(%rbp),%rax
mov    -0x38(%rbp),%rcx
sub    %rcx,%rax
mov    %eax,%esi
call   1090 <strndup@plt>
mov    %rax,%rdx
mov    -0x28(%rbp),%rax
mov    -0x1c(%rbp),%ecx
mov    %ecx,%esi
add    $0x1,%esi
mov    %esi,-0x1c(%rbp)
movslq %ecx,%rcx
mov    %rdx,(%rax,%rcx,8)
mov    -0xb0(%rbp),%rdx
mov    -0x28(%rbp),%rax
movslq -0x1c(%rbp),%rcx
movq   $0x0,(%rax,%rcx,8)
mov    0x2aea(%rip),%rax
movq   $0x0,(%rax)
mov    -0x30(%rbp),%rdi
mov    -0x28(%rbp),%rsi
call   10a0 <execve@plt>
cmp    $0x0,%rax
je     1520 <safe_exec+0x330>
lea    0xb16(%rip),%rdi
call   10e0 <perror@plt>
mov    $0xfffffffd,%edi
call   1100 <exit@plt>
cmpl   $0xffffffff,-0x18(%rbp)
je     155d <safe_exec+0x36d>
movl   $0x0,-0xa4(%rbp)
mov    -0x18(%rbp),%edi
lea    -0xa4(%rbp),%rsi
xor    %edx,%edx
call   10d0 <waitpid@plt>
mov    -0xa4(%rbp),%eax
mov    %eax,-0x4(%rbp)
jmp    1569 <safe_exec+0x379>
jmp    1562 <safe_exec+0x372>
movl   $0xfffffffc,-0x4(%rbp)
mov    -0x4(%rbp),%eax
mov    %rbp,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<safe_exec>:
push   %rbp
mov    %rsp,%rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x38,%rsp
test   %rdi,%rdi
je     1239 <safe_exec+0x49>
mov    %esi,%ebx
mov    %rdi,%r13
xor    %eax,%eax
call   1110 <fork@plt>
mov    $0xfffffffc,%ecx
cmp    $0xffffffff,%eax
je     123e <safe_exec+0x4e>
test   %eax,%eax
je     124f <safe_exec+0x5f>
movl   $0x0,-0x3c(%rbp)
lea    -0x3c(%rbp),%rsi
mov    %eax,%edi
xor    %edx,%edx
call   10d0 <waitpid@plt>
mov    -0x3c(%rbp),%ecx
jmp    123e <safe_exec+0x4e>
mov    $0xfffffffe,%ecx
mov    %ecx,%eax
lea    -0x28(%rbp),%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    $0xa,%edi
mov    $0x8,%esi
call   10b0 <calloc@plt>
mov    %rax,-0x30(%rbp)
lea    0xd97(%rip),%rdx
lea    -0x5b(%rbp),%rdi
mov    $0xb,%esi
mov    %ebx,%ecx
call   1060 <snprintf@plt>
lea    0xd83(%rip),%rdi
test   %rax,%rax
jle    1295 <safe_exec+0xa5>
lea    -0x5b(%rbp),%rsi
mov    $0x1,%edx
call   1040 <setenv@plt>
jmp    129a <safe_exec+0xaa>
call   10f0 <unsetenv@plt>
mov    %rsp,%rdi
add    $0xffffffffffffffd0,%rdi
mov    %rdi,%rsp
xor    %r14d,%r14d
mov    %rdi,-0x38(%rbp)
xor    %esi,%esi
mov    $0x28,%edx
call   1080 <memset@plt>
lea    0xd53(%rip),%rdi
call   1070 <safe_env@plt>
test   %rax,%rax
je     12ed <safe_exec+0xfd>
mov    %rax,%rbx
mov    %rax,%rdi
mov    $0x400,%esi
call   1090 <strndup@plt>
mov    -0x38(%rbp),%rcx
mov    %rax,(%rcx)
mov    %rbx,%rdi
call   1030 <free@plt>
mov    $0x1,%r14d
lea    0xd0f(%rip),%rdi
call   1070 <safe_env@plt>
test   %rax,%rax
je     1325 <safe_exec+0x135>
mov    %rax,%rbx
mov    %rax,%rdi
mov    $0x400,%esi
call   1090 <strndup@plt>
mov    %r14d,%ecx
mov    -0x38(%rbp),%rdx
mov    %rax,(%rdx,%rcx,8)
mov    %rbx,%rdi
call   1030 <free@plt>
add    $0x1,%r14d
lea    0xcf2(%rip),%rdi
call   1070 <safe_env@plt>
test   %rax,%rax
je     135d <safe_exec+0x16d>
mov    %rax,%rbx
mov    %rax,%rdi
mov    $0x400,%esi
call   1090 <strndup@plt>
mov    %r14d,%ecx
mov    -0x38(%rbp),%rdx
mov    %rax,(%rdx,%rcx,8)
mov    %rbx,%rdi
call   1030 <free@plt>
add    $0x1,%r14d
lea    0xcc2(%rip),%rdi
call   1070 <safe_env@plt>
test   %rax,%rax
je     1395 <safe_exec+0x1a5>
mov    %rax,%rbx
mov    %rax,%rdi
mov    $0x400,%esi
call   1090 <strndup@plt>
mov    %r14d,%ecx
mov    -0x38(%rbp),%rdx
mov    %rax,(%rdx,%rcx,8)
mov    %rbx,%rdi
call   1030 <free@plt>
add    $0x1,%r14d
xor    %edi,%edi
call   1070 <safe_env@plt>
test   %rax,%rax
je     13c4 <safe_exec+0x1d4>
mov    %rax,%rbx
mov    %rax,%rdi
mov    $0x400,%esi
call   1090 <strndup@plt>
mov    %r14d,%ecx
mov    -0x38(%rbp),%rdx
mov    %rax,(%rdx,%rcx,8)
mov    %rbx,%rdi
call   1030 <free@plt>
mov    %r13,%rdi
mov    $0x20,%esi
call   1050 <strchr@plt>
test   %rax,%rax
jne    13de <safe_exec+0x1ee>
xor    %r12d,%r12d
jmp    1489 <safe_exec+0x299>
mov    %rax,%r14
mov    $0xa,%eax
mov    %rax,-0x50(%rbp)
xor    %r12d,%r12d
mov    %r13,%rbx
xor    %eax,%eax
mov    %rax,-0x48(%rbp)
jmp    144a <safe_exec+0x25a>
lea    (%r15,%r15,1),%eax
mov    %eax,-0x30(%rbp)
shl    $0x4,%r15d
mov    %r15d,%esi
call   10c0 <realloc@plt>
mov    %rax,%r15
mov    -0x30(%rbp),%eax
mov    %rax,-0x50(%rbp)
mov    %r14d,%esi
sub    %ebx,%esi
mov    %rbx,%rdi
call   1090 <strndup@plt>
mov    %r15,-0x30(%rbp)
mov    %rax,(%r15,%r12,8)
add    $0x1,%r12
mov    %r14,%rbx
add    $0x1,%rbx
mov    %rbx,%rdi
mov    $0x20,%esi
call   1050 <strchr@plt>
mov    %rax,%r14
test   %rax,%rax
je     1482 <safe_exec+0x292>
cmpq   $0x0,-0x48(%rbp)
mov    -0x30(%rbp),%rdi
mov    -0x50(%rbp),%r15
jne    146e <safe_exec+0x27e>
mov    %r14d,%esi
sub    %ebx,%esi
mov    %rbx,%rdi
call   1090 <strndup@plt>
mov    -0x30(%rbp),%rdi
mov    %rax,-0x48(%rbp)
lea    -0x2(%r15),%eax
cltq
cmp    %rax,%r12
jge    13f8 <safe_exec+0x208>
mov    %rdi,%r15
jmp    1415 <safe_exec+0x225>
cmpq   $0x0,-0x48(%rbp)
jne    149f <safe_exec+0x2af>
mov    %r13,%rdi
mov    $0x400,%esi
call   1090 <strndup@plt>
mov    -0x30(%rbp),%rcx
mov    %rax,(%rcx)
jmp    14ba <safe_exec+0x2ca>
mov    %ebx,%esi
neg    %esi
mov    %rbx,%rdi
call   1090 <strndup@plt>
mov    %r12d,%ecx
mov    -0x30(%rbp),%rdx
mov    %rax,(%rdx,%rcx,8)
mov    -0x48(%rbp),%r13
add    $0x1,%r12d
mov    -0x30(%rbp),%rsi
movq   $0x0,(%rsi,%r12,8)
mov    0x2b0f(%rip),%rax
movq   $0x0,(%rax)
mov    %r13,%rdi
mov    -0x38(%rbp),%rdx
call   10a0 <execve@plt>
test   %rax,%rax
je     14f5 <safe_exec+0x305>
lea    0xb41(%rip),%rdi
call   10e0 <perror@plt>
mov    $0xfffffffd,%edi
call   1100 <exit@plt>

LLVM IR (-O0):
@.str = [3 x i8] c"%d\00"
@.str.1 = [14 x i8] c"SLEEPD_UNUSED\00"
@.str.2 = [13 x i8] c"SLEEPD_XUSER\00"
@.str.3 = [8 x i8] c"DISPLAY\00"
@.str.4 = [11 x i8] c"XAUTHORITY\00"
@errno = global i64 0
@.str.5 = [7 x i8] c"execve\00"
define i32 @safe_exec(i8* %0, i32 %1) {
%3 = alloca i32
%4 = alloca i8*
%5 = alloca i32
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = alloca i8**
%10 = alloca i8*
%11 = alloca i8*
%12 = alloca i8*
%13 = alloca [11 x i8]
%14 = alloca [5 x i8*]
%15 = alloca i32
%16 = alloca i8*
%17 = alloca i32
%18 = alloca i32
%19 = alloca i8*
%20 = alloca i32
store i8* %0, i8** %4
store i32 %1, i32* %5
%21 = load i8*, i8** %4
%22 = icmp ne i8* %21, null
br i1 %22, label %24, label %23
23: ; preds = %2
store i32 -2, i32* %3
br label %169
24: ; preds = %2
%25 = call i32 (...) @fork()
store i32 %25, i32* %6
%26 = icmp eq i32 %25, 0
br i1 %26, label %27, label %160
27: ; preds = %24
store i32 0, i32* %7
store i32 10, i32* %8
%28 = load i32, i32* %8
%29 = call i8** @calloc(i32 %28, i32 8)
store i8** %29, i8*** %9
store i8* null, i8** %10
%30 = load i8*, i8** %4
store i8* %30, i8** %11
store i8* null, i8** %12
%31 = getelementptr inbounds [11 x i8], [11 x i8]* %13, i64 0, i64 0
%32 = load i32, i32* %5
%33 = call i64 @snprintf(i8* %31, i32 11, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str, i64 0, i64 0), i32 %32)
%34 = icmp sgt i64 %33, 0
br i1 %34, label %35, label %38
35: ; preds = %27
%36 = getelementptr inbounds [11 x i8], [11 x i8]* %13, i64 0, i64 0
%37 = call i32 @setenv(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0), i8* %36, i32 1)
br label %40
38: ; preds = %27
%39 = call i32 @unsetenv(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0))
br label %40
40: ; preds = %38, %35
%41 = bitcast [5 x i8*]* %14 to i8*
%42 = bitcast i8* %41 to [5 x i8*]*
%43 = getelementptr inbounds [5 x i8*], [5 x i8*]* %42, i32 0, i32 0
store i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.2, i32 0, i32 0), i8** %43
%44 = getelementptr inbounds [5 x i8*], [5 x i8*]* %42, i32 0, i32 1
store i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i32 0, i32 0), i8** %44
%45 = getelementptr inbounds [5 x i8*], [5 x i8*]* %42, i32 0, i32 2
store i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.3, i32 0, i32 0), i8** %45
%46 = getelementptr inbounds [5 x i8*], [5 x i8*]* %42, i32 0, i32 3
store i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.4, i32 0, i32 0), i8** %46
store i32 5, i32* %15
%47 = call i8* @llvm.stacksave()
store i8* %47, i8** %16
%48 = alloca i8*, i64 5
store i32 0, i32* %17
store i32 0, i32* %18
%49 = getelementptr inbounds i8*, i8** %48, i64 0
%50 = call i32 @memset(i8** %49, i8 signext 0, i32 40)
br label %51
51: ; preds = %70, %40
%52 = load i32, i32* %17
%53 = zext i32 %52 to i64
%54 = getelementptr inbounds [5 x i8*], [5 x i8*]* %14, i64 0, i64 %53
%55 = load i8*, i8** %54
%56 = call i8* @safe_env(i8* %55)
store i8* %56, i8** %19
%57 = load i8*, i8** %19
%58 = icmp ne i8* %57, null
br i1 %58, label %59, label %69
59: ; preds = %51
%60 = load i8*, i8** %19
%61 = call i8* @strndup(i8* %60, i32 1024)
%62 = load i32, i32* %18
%63 = zext i32 %62 to i64
%64 = getelementptr inbounds i8*, i8** %48, i64 %63
store i8* %61, i8** %64
%65 = load i8*, i8** %19
%66 = call i32 @free(i8* %65)
%67 = load i32, i32* %18
%68 = add i32 %67, 1
store i32 %68, i32* %18
br label %69
69: ; preds = %59, %51
br label %70
70: ; preds = %69
%71 = load i32, i32* %17
%72 = add i32 %71, 1
store i32 %72, i32* %17
%73 = icmp ult i32 %72, 5
br i1 %73, label %51, label %74
74: ; preds = %70
br label %75
75: ; preds = %105, %74
%76 = load i8*, i8** %11
%77 = call i8* @strchr(i8* %76, i8 signext 32)
store i8* %77, i8** %12
%78 = icmp ne i8* %77, null
br i1 %78, label %79, label %122
79: ; preds = %75
%80 = load i8*, i8** %10
%81 = icmp eq i8* %80, null
br i1 %81, label %82, label %91
82: ; preds = %79
%83 = load i8*, i8** %11
%84 = load i8*, i8** %12
%85 = load i8*, i8** %11
%86 = ptrtoint i8* %84 to i64
%87 = ptrtoint i8* %85 to i64
%88 = sub i64 %86, %87
%89 = trunc i64 %88 to i32
%90 = call i8* @strndup(i8* %83, i32 %89)
store i8* %90, i8** %10
br label %91
91: ; preds = %82, %79
%92 = load i32, i32* %7
%93 = load i32, i32* %8
%94 = sub nsw i32 %93, 2
%95 = icmp sge i32 %92, %94
br i1 %95, label %96, label %105
96: ; preds = %91
%97 = load i32, i32* %8
%98 = mul nsw i32 %97, 2
store i32 %98, i32* %8
%99 = load i8**, i8*** %9
%100 = load i32, i32* %8
%101 = sext i32 %100 to i64
%102 = mul i64 8, %101
%103 = trunc i64 %102 to i32
%104 = call i8** @realloc(i8** %99, i32 %103)
store i8** %104, i8*** %9
br label %105
105: ; preds = %96, %91
%106 = load i8*, i8** %11
%107 = load i8*, i8** %12
%108 = load i8*, i8** %11
%109 = ptrtoint i8* %107 to i64
%110 = ptrtoint i8* %108 to i64
%111 = sub i64 %109, %110
%112 = trunc i64 %111 to i32
%113 = call i8* @strndup(i8* %106, i32 %112)
%114 = load i8**, i8*** %9
%115 = load i32, i32* %7
%116 = add nsw i32 %115, 1
store i32 %116, i32* %7
%117 = sext i32 %115 to i64
%118 = getelementptr inbounds i8*, i8** %114, i64 %117
store i8* %113, i8** %118
%119 = load i8*, i8** %12
%120 = getelementptr inbounds i8, i8* %119, i32 1
store i8* %120, i8** %12
%121 = load i8*, i8** %12
store i8* %121, i8** %11
br label %75
122: ; preds = %75
%123 = load i8*, i8** %10
%124 = icmp eq i8* %123, null
br i1 %124, label %125, label %133
125: ; preds = %122
%126 = load i8*, i8** %4
store i8* %126, i8** %10
%127 = load i8*, i8** %10
%128 = call i8* @strndup(i8* %127, i32 1024)
%129 = load i8**, i8*** %9
%130 = getelementptr inbounds i8*, i8** %129, i64 0
store i8* %128, i8** %130
%131 = load i32, i32* %7
%132 = add nsw i32 %131, 1
store i32 %132, i32* %7
br label %147
133: ; preds = %122
%134 = load i8*, i8** %11
%135 = load i8*, i8** %12
%136 = load i8*, i8** %11
%137 = ptrtoint i8* %135 to i64
%138 = ptrtoint i8* %136 to i64
%139 = sub i64 %137, %138
%140 = trunc i64 %139 to i32
%141 = call i8* @strndup(i8* %134, i32 %140)
%142 = load i8**, i8*** %9
%143 = load i32, i32* %7
%144 = add nsw i32 %143, 1
store i32 %144, i32* %7
%145 = sext i32 %143 to i64
%146 = getelementptr inbounds i8*, i8** %142, i64 %145
store i8* %141, i8** %146
br label %147
147: ; preds = %133, %125
%148 = load i8**, i8*** %9
%149 = load i32, i32* %7
%150 = sext i32 %149 to i64
%151 = getelementptr inbounds i8*, i8** %148, i64 %150
store i8* null, i8** %151
store i64 0, i64* @errno
%152 = load i8*, i8** %10
%153 = load i8**, i8*** %9
%154 = call i64 @execve(i8* %152, i8** %153, i8** %48)
%155 = icmp ne i64 %154, 0
br i1 %155, label %156, label %158
156: ; preds = %147
%157 = call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.5, i64 0, i64 0))
br label %158
158: ; preds = %156, %147
%159 = call i32 @exit(i32 -3)
unreachable
160: ; preds = %24
%161 = load i32, i32* %6
%162 = icmp ne i32 %161, -1
br i1 %162, label %163, label %167
163: ; preds = %160
store i32 0, i32* %20
%164 = load i32, i32* %6
%165 = call i32 @waitpid(i32 %164, i32* %20, i32 0)
%166 = load i32, i32* %20
store i32 %166, i32* %3
br label %169
167: ; preds = %160
br label %168
168: ; preds = %167
store i32 -4, i32* %3
br label %169
169: ; preds = %168, %163, %23
%170 = load i32, i32* %3
ret i32 %170
}

LLVM IR (-O2):
@.str = [3 x i8] c"%d\00"
@.str.1 = [14 x i8] c"SLEEPD_UNUSED\00"
@.str.2 = [13 x i8] c"SLEEPD_XUSER\00"
@.str.3 = [8 x i8] c"DISPLAY\00"
@.str.4 = [11 x i8] c"XAUTHORITY\00"
@errno = global i64 0
@.str.5 = [7 x i8] c"execve\00"
define i32 @safe_exec(i8* %0, i32 %1) {
%3 = alloca [11 x i8]
%4 = alloca i32
%5 = icmp eq i8* %0, null
br i1 %5, label %134, label %6
6: ; preds = %2
%7 = tail call i32 (...) @fork()
switch i32 %7, label %130 [
i32 0, label %8
i32 -1, label %134
]
8: ; preds = %6
%9 = tail call i8** @calloc(i32 10, i32 8)
%10 = getelementptr inbounds [11 x i8], [11 x i8]* %3, i64 0, i64 0
%11 = call i64 @snprintf(i8* %10, i32 11, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str, i64 0, i64 0), i32 %1)
%12 = icmp sgt i64 %11, 0
br i1 %12, label %13, label %15
13: ; preds = %8
%14 = call i32 @setenv(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0), i8* %10, i32 1)
br label %17
15: ; preds = %8
%16 = call i32 @unsetenv(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0))
br label %17
17: ; preds = %15, %13
%18 = alloca [5 x i8*]
%19 = getelementptr inbounds [5 x i8*], [5 x i8*]* %18, i64 0, i64 0
%20 = call i32 @memset(i8** %19, i8 signext 0, i32 40)
%21 = call i8* @safe_env(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.2, i64 0, i64 0))
%22 = icmp eq i8* %21, null
br i1 %22, label %26, label %23
23: ; preds = %17
%24 = call i8* @strndup(i8* %21, i32 1024)
store i8* %24, i8** %19
%25 = call i32 @free(i8* %21)
br label %26
26: ; preds = %23, %17
%27 = phi i32 [ 1, %23 ], [ 0, %17 ]
%28 = call i8* @safe_env(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0))
%29 = icmp eq i8* %28, null
br i1 %29, label %36, label %30
30: ; preds = %26
%31 = call i8* @strndup(i8* %28, i32 1024)
%32 = zext i32 %27 to i64
%33 = getelementptr inbounds [5 x i8*], [5 x i8*]* %18, i64 0, i64 %32
store i8* %31, i8** %33
%34 = call i32 @free(i8* %28)
%35 = add nuw nsw i32 %27, 1
br label %36
36: ; preds = %30, %26
%37 = phi i32 [ %35, %30 ], [ %27, %26 ]
%38 = call i8* @safe_env(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.3, i64 0, i64 0))
%39 = icmp eq i8* %38, null
br i1 %39, label %46, label %40
40: ; preds = %36
%41 = call i8* @strndup(i8* %38, i32 1024)
%42 = zext i32 %37 to i64
%43 = getelementptr inbounds [5 x i8*], [5 x i8*]* %18, i64 0, i64 %42
store i8* %41, i8** %43
%44 = call i32 @free(i8* %38)
%45 = add nuw nsw i32 %37, 1
br label %46
46: ; preds = %40, %36
%47 = phi i32 [ %45, %40 ], [ %37, %36 ]
%48 = call i8* @safe_env(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.4, i64 0, i64 0))
%49 = icmp eq i8* %48, null
br i1 %49, label %56, label %50
50: ; preds = %46
%51 = call i8* @strndup(i8* %48, i32 1024)
%52 = zext i32 %47 to i64
%53 = getelementptr inbounds [5 x i8*], [5 x i8*]* %18, i64 0, i64 %52
store i8* %51, i8** %53
%54 = call i32 @free(i8* %48)
%55 = add nuw nsw i32 %47, 1
br label %56
56: ; preds = %50, %46
%57 = phi i32 [ %55, %50 ], [ %47, %46 ]
%58 = call i8* @safe_env(i8* null)
%59 = icmp eq i8* %58, null
br i1 %59, label %65, label %60
60: ; preds = %56
%61 = call i8* @strndup(i8* %58, i32 1024)
%62 = zext i32 %57 to i64
%63 = getelementptr inbounds [5 x i8*], [5 x i8*]* %18, i64 0, i64 %62
store i8* %61, i8** %63
%64 = call i32 @free(i8* %58)
br label %65
65: ; preds = %60, %56
%66 = call i8* @strchr(i8* %0, i8 signext 32)
%67 = icmp eq i8* %66, null
br i1 %67, label %106, label %68
68: ; preds = %65, %91
%69 = phi i64 [ %99, %91 ], [ 0, %65 ]
%70 = phi i8* [ %102, %91 ], [ %66, %65 ]
%71 = phi i32 [ %93, %91 ], [ 10, %65 ]
%72 = phi i8* [ %101, %91 ], [ %0, %65 ]
%73 = phi i8* [ %83, %91 ], [ null, %65 ]
%74 = phi i8** [ %92, %91 ], [ %9, %65 ]
%75 = icmp eq i8* %73, null
br i1 %75, label %76, label %82
76: ; preds = %68
%77 = ptrtoint i8* %70 to i64
%78 = ptrtoint i8* %72 to i64
%79 = sub i64 %77, %78
%80 = trunc i64 %79 to i32
%81 = call i8* @strndup(i8* %72, i32 %80)
br label %82
82: ; preds = %76, %68
%83 = phi i8* [ %81, %76 ], [ %73, %68 ]
%84 = add nsw i32 %71, -2
%85 = sext i32 %84 to i64
%86 = icmp slt i64 %69, %85
br i1 %86, label %91, label %87
87: ; preds = %82
%88 = shl nsw i32 %71, 1
%89 = shl i32 %71, 4
%90 = call i8** @realloc(i8** %74, i32 %89)
br label %91
91: ; preds = %87, %82
%92 = phi i8** [ %90, %87 ], [ %74, %82 ]
%93 = phi i32 [ %88, %87 ], [ %71, %82 ]
%94 = ptrtoint i8* %70 to i64
%95 = ptrtoint i8* %72 to i64
%96 = sub i64 %94, %95
%97 = trunc i64 %96 to i32
%98 = call i8* @strndup(i8* %72, i32 %97)
%99 = add nuw i64 %69, 1
%100 = getelementptr inbounds i8*, i8** %92, i64 %69
store i8* %98, i8** %100
%101 = getelementptr inbounds i8, i8* %70, i64 1
%102 = call i8* @strchr(i8* %101, i8 signext 32)
%103 = icmp eq i8* %102, null
br i1 %103, label %104, label %68
104: ; preds = %91
%105 = icmp eq i8* %83, null
br i1 %105, label %106, label %110
106: ; preds = %65, %104
%107 = phi i64 [ %99, %104 ], [ 0, %65 ]
%108 = phi i8** [ %92, %104 ], [ %9, %65 ]
%109 = call i8* @strndup(i8* %0, i32 1024)
store i8* %109, i8** %108
br label %117
110: ; preds = %104
%111 = ptrtoint i8* %101 to i64
%112 = trunc i64 %111 to i32
%113 = sub i32 0, %112
%114 = call i8* @strndup(i8* %101, i32 %113)
%115 = and i64 %99, 4294967295
%116 = getelementptr inbounds i8*, i8** %92, i64 %115
store i8* %114, i8** %116
br label %117
117: ; preds = %110, %106
%118 = phi i64 [ %107, %106 ], [ %99, %110 ]
%119 = phi i8** [ %108, %106 ], [ %92, %110 ]
%120 = phi i8* [ %0, %106 ], [ %83, %110 ]
%121 = add i64 %118, 1
%122 = and i64 %121, 4294967295
%123 = getelementptr inbounds i8*, i8** %119, i64 %122
store i8* null, i8** %123
store i64 0, i64* @errno
%124 = call i64 @execve(i8* %120, i8** %119, i8** %19)
%125 = icmp eq i64 %124, 0
br i1 %125, label %128, label %126
126: ; preds = %117
%127 = call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.5, i64 0, i64 0))
br label %128
128: ; preds = %126, %117
%129 = call i32 @exit(i32 -3)
unreachable
130: ; preds = %6
%131 = bitcast i32* %4 to i8*
store i32 0, i32* %4
%132 = call i32 @waitpid(i32 %7, i32* %4, i32 0)
%133 = load i32, i32* %4
br label %134
134: ; preds = %130, %6, %2
%135 = phi i32 [ -2, %2 ], [ %133, %130 ], [ -4, %6 ]
ret i32 %135
}