#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
int /*<<< orphan*/ close(int /*<<< orphan*/);
int /*<<< orphan*/ dup(scalar_t__);
int /*<<< orphan*/ execve(char *, char **, char **);
int /*<<< orphan*/ fatal(char *);
scalar_t__ fileno(int /*<<< orphan*/ *);
int /*<<< orphan*/ *fopen(char *, char *);
int fork();
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, int, int);
int geteuid();
int getuid();
int /*<<< orphan*/ seteuid(int);
int /*<<< orphan*/ setuid(int);
int /*<<< orphan*/ stderr;
int wait(int *);
int main() {
  FILE *root_data;
  int pid;
  int wait_stat;
  const char *args[2];
  char *env[2];
  fprintf(stderr, "roottest: UID(%d), EUID(%d)\n", getuid(), geteuid());
  args[0] = "./tester";
  args[1] = 0;
  env[0] = "HOME=/home";
  env[1] = 0;
  root_data = fopen("root.data", "r");
  if (!root_data) {
    fatal("Can't open 'root.data'\n");
  }
  if ((pid = fork()) < 0) {
    fatal("Can't fork()\n");
  }
  if (pid) {
    if (fileno(root_data) != 0) {
      close(0);
      dup(fileno(root_data));
    }
    setuid(201);
    seteuid(201);
    execve("/home/egustafs/exper/courier-dup/tester", (char **)args, env);
    fatal("child failed to exec.\n");
  }
  while (wait(&wait_stat) != pid)
    ;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x50,%rsp
movl   $0x0,-0x4(%rbp)
mov    0x2dfa(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x48(%rbp)
mov    $0x0,%al
call   1030 <getuid@plt>
mov    %eax,-0x44(%rbp)
mov    $0x0,%al
call   1050 <geteuid@plt>
mov    -0x48(%rbp),%edi
mov    -0x44(%rbp),%edx
mov    %eax,%ecx
lea    0xdf5(%rip),%rsi
call   1080 <fprintf@plt>
lea    0xe06(%rip),%rax
mov    %rax,-0x30(%rbp)
movq   $0x0,-0x28(%rbp)
lea    0xdfc(%rip),%rax
mov    %rax,-0x40(%rbp)
movq   $0x0,-0x38(%rbp)
lea    0xdf4(%rip),%rdi
lea    0xde0(%rip),%rsi
call   10a0 <fopen@plt>
mov    %rax,-0x10(%rbp)
cmpq   $0x0,-0x10(%rbp)
jne    1264 <main+0x94>
lea    0xddc(%rip),%rdi
call   10c0 <fatal@plt>
mov    $0x0,%al
call   10e0 <fork@plt>
mov    %eax,-0x14(%rbp)
cmp    $0x0,%eax
jge    1283 <main+0xb3>
lea    0xdd5(%rip),%rdi
call   10c0 <fatal@plt>
cmpl   $0x0,-0x14(%rbp)
je     12ec <main+0x11c>
mov    -0x10(%rbp),%rdi
call   1090 <fileno@plt>
cmp    $0x0,%rax
je     12b8 <main+0xe8>
xor    %edi,%edi
call   1060 <close@plt>
mov    -0x10(%rbp),%rdi
call   1090 <fileno@plt>
mov    %rax,%rdi
call   1040 <dup@plt>
mov    $0xc9,%edi
call   10b0 <setuid@plt>
mov    $0xc9,%edi
call   10f0 <seteuid@plt>
lea    -0x30(%rbp),%rsi
lea    -0x40(%rbp),%rdx
lea    0xd86(%rip),%rdi
call   1070 <execve@plt>
lea    0xda2(%rip),%rdi
call   10c0 <fatal@plt>
jmp    12f1 <main+0x121>
lea    -0x18(%rbp),%rdi
call   10d0 <wait@plt>
cmp    -0x14(%rbp),%eax
je     1308 <main+0x138>
jmp    12f1 <main+0x121>
mov    -0x4(%rbp),%eax
add    $0x50,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r14
push   %rbx
sub    $0x30,%rsp
mov    0x2e01(%rip),%rax
mov    (%rax),%ebx
xor    %eax,%eax
call   1030 <getuid@plt>
mov    %eax,%ebp
xor    %eax,%eax
call   1050 <geteuid@plt>
lea    0xe08(%rip),%rsi
mov    %ebx,%edi
mov    %ebp,%edx
mov    %eax,%ecx
call   1080 <fprintf@plt>
lea    0xe13(%rip),%rax
mov    %rax,0x20(%rsp)
movq   $0x0,0x28(%rsp)
lea    0xe07(%rip),%rax
mov    %rax,0x10(%rsp)
movq   $0x0,0x18(%rsp)
lea    0xdfd(%rip),%rdi
lea    0xde9(%rip),%rsi
call   10a0 <fopen@plt>
mov    %rax,%r14
test   %rax,%rax
jne    1254 <main+0x84>
lea    0xdec(%rip),%rdi
call   10c0 <fatal@plt>
xor    %eax,%eax
call   10e0 <fork@plt>
mov    %eax,%ebp
test   %eax,%eax
js     1265 <main+0x95>
jne    1271 <main+0xa1>
jmp    12cb <main+0xfb>
lea    0xde7(%rip),%rdi
call   10c0 <fatal@plt>
mov    %r14,%rdi
call   1090 <fileno@plt>
test   %rax,%rax
je     1295 <main+0xc5>
xor    %edi,%edi
call   1060 <close@plt>
mov    %r14,%rdi
call   1090 <fileno@plt>
mov    %rax,%rdi
call   1040 <dup@plt>
mov    $0xc9,%edi
call   10b0 <setuid@plt>
mov    $0xc9,%edi
call   10f0 <seteuid@plt>
lea    0xdb1(%rip),%rdi
lea    0x20(%rsp),%rsi
lea    0x10(%rsp),%rdx
call   1070 <execve@plt>
lea    0xdc3(%rip),%rdi
call   10c0 <fatal@plt>
lea    0xc(%rsp),%rbx
mov    %rbx,%rdi
call   10d0 <wait@plt>
cmp    %ebp,%eax
jne    12d0 <main+0x100>
xor    %eax,%eax
add    $0x30,%rsp
pop    %rbx
pop    %r14
pop    %rbp
ret

LLVM IR (-O0):
@stderr = global i32 0
@.str = [29 x i8] c"roottest: UID(%d), EUID(%d)\0A\00"
@.str.1 = [9 x i8] c"./tester\00"
@.str.2 = [11 x i8] c"HOME=/home\00"
@.str.3 = [10 x i8] c"root.data\00"
@.str.4 = [2 x i8] c"r\00"
@.str.5 = [24 x i8] c"Can't open 'root.data'\0A\00"
@.str.6 = [14 x i8] c"Can't fork()\0A\00"
@.str.7 = [40 x i8] c"/home/egustafs/exper/courier-dup/tester\00"
@.str.8 = [23 x i8] c"child failed to exec.\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i32*
%3 = alloca i32
%4 = alloca i32
%5 = alloca [2 x i8*]
%6 = alloca [2 x i8*]
store i32 0, i32* %1
%7 = load i32, i32* @stderr
%8 = call i32 (...) @getuid()
%9 = call i32 (...) @geteuid()
%10 = call i32 @fprintf(i32 %7, i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str, i64 0, i64 0), i32 %8, i32 %9)
%11 = getelementptr inbounds [2 x i8*], [2 x i8*]* %5, i64 0, i64 0
store i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0), i8** %11
%12 = getelementptr inbounds [2 x i8*], [2 x i8*]* %5, i64 0, i64 1
store i8* null, i8** %12
%13 = getelementptr inbounds [2 x i8*], [2 x i8*]* %6, i64 0, i64 0
store i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.2, i64 0, i64 0), i8** %13
%14 = getelementptr inbounds [2 x i8*], [2 x i8*]* %6, i64 0, i64 1
store i8* null, i8** %14
%15 = call i32* @fopen(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.3, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.4, i64 0, i64 0))
store i32* %15, i32** %2
%16 = load i32*, i32** %2
%17 = icmp ne i32* %16, null
br i1 %17, label %20, label %18
18: ; preds = %0
%19 = call i32 @fatal(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.5, i64 0, i64 0))
br label %20
20: ; preds = %18, %0
%21 = call i32 (...) @fork()
store i32 %21, i32* %3
%22 = icmp slt i32 %21, 0
br i1 %22, label %23, label %25
23: ; preds = %20
%24 = call i32 @fatal(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.6, i64 0, i64 0))
br label %25
25: ; preds = %23, %20
%26 = load i32, i32* %3
%27 = icmp ne i32 %26, 0
br i1 %27, label %28, label %44
28: ; preds = %25
%29 = load i32*, i32** %2
%30 = call i64 @fileno(i32* %29)
%31 = icmp ne i64 %30, 0
br i1 %31, label %32, label %37
32: ; preds = %28
%33 = call i32 @close(i32 0)
%34 = load i32*, i32** %2
%35 = call i64 @fileno(i32* %34)
%36 = call i32 @dup(i64 %35)
br label %37
37: ; preds = %32, %28
%38 = call i32 @setuid(i32 201)
%39 = call i32 @seteuid(i32 201)
%40 = getelementptr inbounds [2 x i8*], [2 x i8*]* %5, i64 0, i64 0
%41 = getelementptr inbounds [2 x i8*], [2 x i8*]* %6, i64 0, i64 0
%42 = call i32 @execve(i8* getelementptr inbounds ([40 x i8], [40 x i8]* @.str.7, i64 0, i64 0), i8** %40, i8** %41)
%43 = call i32 @fatal(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.8, i64 0, i64 0))
br label %44
44: ; preds = %37, %25
br label %45
45: ; preds = %49, %44
%46 = call i32 @wait(i32* %4)
%47 = load i32, i32* %3
%48 = icmp ne i32 %46, %47
br i1 %48, label %49, label %50
49: ; preds = %45
br label %45
50: ; preds = %45
%51 = load i32, i32* %1
ret i32 %51
}

LLVM IR (-O2):
@stderr = global i32 0
@.str = [29 x i8] c"roottest: UID(%d), EUID(%d)\0A\00"
@.str.1 = [9 x i8] c"./tester\00"
@.str.2 = [11 x i8] c"HOME=/home\00"
@.str.3 = [10 x i8] c"root.data\00"
@.str.4 = [2 x i8] c"r\00"
@.str.5 = [24 x i8] c"Can't open 'root.data'\0A\00"
@.str.6 = [14 x i8] c"Can't fork()\0A\00"
@.str.7 = [40 x i8] c"/home/egustafs/exper/courier-dup/tester\00"
@.str.8 = [23 x i8] c"child failed to exec.\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca [2 x i8*]
%3 = alloca [2 x i8*]
%4 = bitcast i32* %1 to i8*
%5 = bitcast [2 x i8*]* %2 to i8*
%6 = bitcast [2 x i8*]* %3 to i8*
%7 = load i32, i32* @stderr
%8 = tail call i32 (...) @getuid()
%9 = tail call i32 (...) @geteuid()
%10 = tail call i32 @fprintf(i32 %7, i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str, i64 0, i64 0), i32 %8, i32 %9)
%11 = getelementptr inbounds [2 x i8*], [2 x i8*]* %2, i64 0, i64 0
store i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0), i8** %11
%12 = getelementptr inbounds [2 x i8*], [2 x i8*]* %2, i64 0, i64 1
store i8* null, i8** %12
%13 = getelementptr inbounds [2 x i8*], [2 x i8*]* %3, i64 0, i64 0
store i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.2, i64 0, i64 0), i8** %13
%14 = getelementptr inbounds [2 x i8*], [2 x i8*]* %3, i64 0, i64 1
store i8* null, i8** %14
%15 = tail call i32* @fopen(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.3, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.4, i64 0, i64 0))
%16 = icmp eq i32* %15, null
br i1 %16, label %17, label %19
17: ; preds = %0
%18 = tail call i32 @fatal(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.5, i64 0, i64 0))
br label %19
19: ; preds = %17, %0
%20 = tail call i32 (...) @fork()
%21 = icmp slt i32 %20, 0
br i1 %21, label %22, label %24
22: ; preds = %19
%23 = tail call i32 @fatal(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.6, i64 0, i64 0))
br label %26
24: ; preds = %19
%25 = icmp eq i32 %20, 0
br i1 %25, label %38, label %26
26: ; preds = %22, %24
%27 = tail call i64 @fileno(i32* %15)
%28 = icmp eq i64 %27, 0
br i1 %28, label %33, label %29
29: ; preds = %26
%30 = tail call i32 @close(i32 0)
%31 = tail call i64 @fileno(i32* %15)
%32 = tail call i32 @dup(i64 %31)
br label %33
33: ; preds = %29, %26
%34 = tail call i32 @setuid(i32 201)
%35 = tail call i32 @seteuid(i32 201)
%36 = call i32 @execve(i8* getelementptr inbounds ([40 x i8], [40 x i8]* @.str.7, i64 0, i64 0), i8** %11, i8** %13)
%37 = call i32 @fatal(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.8, i64 0, i64 0))
br label %38
38: ; preds = %33, %24
br label %39
39: ; preds = %38, %39
%40 = call i32 @wait(i32* %1)
%41 = icmp eq i32 %40, %20
br i1 %41, label %42, label %39
42: ; preds = %39
ret i32 0
}