#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ uid_t;

/* Variables and functions */
int MAXPATHLEN;
int /*<<< orphan*/ atoi(char *);
int /*<<< orphan*/ exit(int);
scalar_t__ initgroups(char *, int /*<<< orphan*/);
scalar_t__ setgid(int /*<<< orphan*/);
scalar_t__ setuid(int /*<<< orphan*/);
int /*<<< orphan*/ strcat(char *, char *);
int /*<<< orphan*/ strcpy(char *, char *);
int system(char *);
int main(int argc, char **argv) {
  uid_t my_gid;
  uid_t my_uid;
  char username[MAXPATHLEN];
  char cmd[MAXPATHLEN];
  char xcmd[MAXPATHLEN];
  char xlog[MAXPATHLEN];
  char *xauth;
  if (argc != 6) {
    exit(1);
  }
  char output[MAXPATHLEN];
  strcpy(username, argv[1]);
  my_uid = atoi(argv[2]);
  my_gid = atoi(argv[3]);
  strcpy(xcmd, argv[4]);
  strcpy(xlog, argv[5]);
  if (setgid(my_gid) < 0) {
    exit(1);
  }
  if (initgroups(username, my_gid) < 0) {
    exit(1);
  }
  if (setuid(my_uid) < 0) {
    exit(1);
  }
  strcpy(cmd, "sh ");
  strcat(cmd, xcmd);
  strcat(cmd, " >");
  strcat(cmd, xlog);
  strcat(cmd, " 2>");
  strcat(cmd, xlog);
  int ret = system(cmd);
  exit(ret);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x80,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    0x2e48(%rip),%rax
mov    (%rax),%ecx
mov    %rsp,%rdx
mov    %rdx,-0x20(%rbp)
mov    %rcx,%rsi
add    $0xf,%rsi
and    $0xfffffffffffffff0,%rsi
mov    %rsp,%rdx
sub    %rsi,%rdx
mov    %rdx,-0x78(%rbp)
mov    %rdx,%rsp
mov    %rcx,-0x28(%rbp)
mov    (%rax),%ecx
mov    %rcx,%rsi
add    $0xf,%rsi
and    $0xfffffffffffffff0,%rsi
mov    %rsp,%rdx
sub    %rsi,%rdx
mov    %rdx,-0x70(%rbp)
mov    %rdx,%rsp
mov    %rcx,-0x30(%rbp)
mov    (%rax),%ecx
mov    %rcx,%rsi
add    $0xf,%rsi
and    $0xfffffffffffffff0,%rsi
mov    %rsp,%rdx
sub    %rsi,%rdx
mov    %rdx,-0x68(%rbp)
mov    %rdx,%rsp
mov    %rcx,-0x38(%rbp)
mov    (%rax),%eax
mov    %rax,%rdx
add    $0xf,%rdx
and    $0xfffffffffffffff0,%rdx
mov    %rsp,%rcx
sub    %rdx,%rcx
mov    %rcx,-0x60(%rbp)
mov    %rcx,%rsp
mov    %rax,-0x40(%rbp)
cmpl   $0x6,-0x8(%rbp)
je     1233 <main+0xb3>
mov    $0x1,%edi
call   1080 <exit@plt>
mov    -0x78(%rbp),%rdi
mov    0x2daa(%rip),%rax
mov    (%rax),%eax
mov    %rax,-0x50(%rbp)
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rsi
call   1030 <strcpy@plt>
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdi
call   1060 <atoi@plt>
mov    %eax,-0x18(%rbp)
mov    -0x10(%rbp),%rax
mov    0x18(%rax),%rdi
call   1060 <atoi@plt>
mov    -0x68(%rbp),%rdi
mov    %eax,-0x14(%rbp)
mov    -0x10(%rbp),%rax
mov    0x20(%rax),%rsi
call   1030 <strcpy@plt>
mov    -0x60(%rbp),%rdi
mov    -0x10(%rbp),%rax
mov    0x28(%rax),%rsi
call   1030 <strcpy@plt>
mov    -0x14(%rbp),%edi
call   1050 <setgid@plt>
cmp    $0x0,%rax
jge    12af <main+0x12f>
mov    $0x1,%edi
call   1080 <exit@plt>
mov    -0x78(%rbp),%rdi
mov    -0x14(%rbp),%esi
call   10a0 <initgroups@plt>
cmp    $0x0,%rax
jge    12cf <main+0x14f>
mov    $0x1,%edi
call   1080 <exit@plt>
mov    -0x18(%rbp),%edi
call   1090 <setuid@plt>
cmp    $0x0,%rax
jge    12eb <main+0x16b>
mov    $0x1,%edi
call   1080 <exit@plt>
mov    -0x70(%rbp),%rdi
lea    0xd0a(%rip),%rsi
call   1030 <strcpy@plt>
mov    -0x68(%rbp),%rsi
mov    -0x70(%rbp),%rdi
call   1070 <strcat@plt>
mov    -0x70(%rbp),%rdi
lea    0xcf1(%rip),%rsi
call   1070 <strcat@plt>
mov    -0x60(%rbp),%rsi
mov    -0x70(%rbp),%rdi
call   1070 <strcat@plt>
mov    -0x70(%rbp),%rdi
lea    0xcd7(%rip),%rsi
call   1070 <strcat@plt>
mov    -0x60(%rbp),%rsi
mov    -0x70(%rbp),%rdi
call   1070 <strcat@plt>
mov    -0x70(%rbp),%rdi
call   1040 <system@plt>
mov    %eax,-0x54(%rbp)
mov    -0x54(%rbp),%edi
call   1080 <exit@plt>

x86 assembly (clang, -O2):
<main>:
push   %rbp
mov    %rsp,%rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    0x2e50(%rip),%rax
mov    (%rax),%eax
mov    %rsp,%rbx
add    $0xf,%rax
and    $0xfffffffffffffff0,%rax
sub    %rax,%rbx
mov    %rbx,%rsp
mov    %rsp,%rcx
sub    %rax,%rcx
mov    %rcx,%rsp
mov    %rsp,%r12
sub    %rax,%r12
mov    %r12,%rsp
mov    %rsp,%r15
sub    %rax,%r15
mov    %r15,%rsp
cmp    $0x6,%edi
jne    123b <main+0xbb>
mov    %rsi,%r13
mov    %rcx,-0x38(%rbp)
mov    0x8(%rsi),%rsi
mov    %rbx,%rdi
call   1030 <strcpy@plt>
mov    0x10(%r13),%rdi
call   1060 <atoi@plt>
mov    %eax,-0x2c(%rbp)
mov    0x18(%r13),%rdi
call   1060 <atoi@plt>
mov    %eax,%r14d
mov    0x20(%r13),%rsi
mov    %r12,%rdi
call   1030 <strcpy@plt>
mov    0x28(%r13),%rsi
mov    %r15,%rdi
call   1030 <strcpy@plt>
mov    %r14d,%r13d
mov    %r14d,%edi
call   1050 <setgid@plt>
test   %rax,%rax
js     123b <main+0xbb>
mov    %rbx,%rdi
mov    %r13d,%esi
call   10a0 <initgroups@plt>
test   %rax,%rax
js     123b <main+0xbb>
mov    -0x2c(%rbp),%edi
call   1090 <setuid@plt>
test   %rax,%rax
jns    1245 <main+0xc5>
mov    $0x1,%edi
call   1080 <exit@plt>
lea    0xdb4(%rip),%rsi
mov    -0x38(%rbp),%rbx
mov    %rbx,%rdi
call   1030 <strcpy@plt>
mov    %rbx,%rdi
mov    %r12,%rsi
call   1070 <strcat@plt>
lea    0xd9a(%rip),%rsi
mov    %rbx,%rdi
call   1070 <strcat@plt>
mov    %rbx,%rdi
mov    %r15,%rsi
call   1070 <strcat@plt>
lea    0xd83(%rip),%rsi
mov    %rbx,%rdi
call   1070 <strcat@plt>
mov    %rbx,%rdi
mov    %r15,%rsi
call   1070 <strcat@plt>
mov    %rbx,%rdi
call   1040 <system@plt>
mov    %eax,%edi
call   1080 <exit@plt>

LLVM IR (-O0):
@MAXPATHLEN = global i32 0
@.str = [4 x i8] c"sh \00"
@.str.1 = [3 x i8] c" >\00"
@.str.2 = [4 x i8] c" 2>\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca i8*
%9 = alloca i64
%10 = alloca i64
%11 = alloca i64
%12 = alloca i64
%13 = alloca i8*
%14 = alloca i64
%15 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%16 = load i32, i32* @MAXPATHLEN
%17 = zext i32 %16 to i64
%18 = call i8* @llvm.stacksave()
store i8* %18, i8** %8
%19 = alloca i8, i64 %17
store i64 %17, i64* %9
%20 = load i32, i32* @MAXPATHLEN
%21 = zext i32 %20 to i64
%22 = alloca i8, i64 %21
store i64 %21, i64* %10
%23 = load i32, i32* @MAXPATHLEN
%24 = zext i32 %23 to i64
%25 = alloca i8, i64 %24
store i64 %24, i64* %11
%26 = load i32, i32* @MAXPATHLEN
%27 = zext i32 %26 to i64
%28 = alloca i8, i64 %27
store i64 %27, i64* %12
%29 = load i32, i32* %4
%30 = icmp ne i32 %29, 6
br i1 %30, label %31, label %33
31: ; preds = %2
%32 = call i32 @exit(i32 1)
unreachable
33: ; preds = %2
%34 = load i32, i32* @MAXPATHLEN
%35 = zext i32 %34 to i64
%36 = alloca i8, i64 %35
store i64 %35, i64* %14
%37 = load i8**, i8*** %5
%38 = getelementptr inbounds i8*, i8** %37, i64 1
%39 = load i8*, i8** %38
%40 = call i32 @strcpy(i8* %19, i8* %39)
%41 = load i8**, i8*** %5
%42 = getelementptr inbounds i8*, i8** %41, i64 2
%43 = load i8*, i8** %42
%44 = call i32 @atoi(i8* %43)
store i32 %44, i32* %7
%45 = load i8**, i8*** %5
%46 = getelementptr inbounds i8*, i8** %45, i64 3
%47 = load i8*, i8** %46
%48 = call i32 @atoi(i8* %47)
store i32 %48, i32* %6
%49 = load i8**, i8*** %5
%50 = getelementptr inbounds i8*, i8** %49, i64 4
%51 = load i8*, i8** %50
%52 = call i32 @strcpy(i8* %25, i8* %51)
%53 = load i8**, i8*** %5
%54 = getelementptr inbounds i8*, i8** %53, i64 5
%55 = load i8*, i8** %54
%56 = call i32 @strcpy(i8* %28, i8* %55)
%57 = load i32, i32* %6
%58 = call i64 @setgid(i32 %57)
%59 = icmp slt i64 %58, 0
br i1 %59, label %60, label %62
60: ; preds = %33
%61 = call i32 @exit(i32 1)
unreachable
62: ; preds = %33
%63 = load i32, i32* %6
%64 = call i64 @initgroups(i8* %19, i32 %63)
%65 = icmp slt i64 %64, 0
br i1 %65, label %66, label %68
66: ; preds = %62
%67 = call i32 @exit(i32 1)
unreachable
68: ; preds = %62
%69 = load i32, i32* %7
%70 = call i64 @setuid(i32 %69)
%71 = icmp slt i64 %70, 0
br i1 %71, label %72, label %74
72: ; preds = %68
%73 = call i32 @exit(i32 1)
unreachable
74: ; preds = %68
%75 = call i32 @strcpy(i8* %22, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0))
%76 = call i32 @strcat(i8* %22, i8* %25)
%77 = call i32 @strcat(i8* %22, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0))
%78 = call i32 @strcat(i8* %22, i8* %28)
%79 = call i32 @strcat(i8* %22, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.2, i64 0, i64 0))
%80 = call i32 @strcat(i8* %22, i8* %28)
%81 = call i32 @system(i8* %22)
store i32 %81, i32* %15
%82 = load i32, i32* %15
%83 = call i32 @exit(i32 %82)
unreachable
}

LLVM IR (-O2):
@MAXPATHLEN = global i32 0
@.str = [4 x i8] c"sh \00"
@.str.1 = [3 x i8] c" >\00"
@.str.2 = [4 x i8] c" 2>\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = load i32, i32* @MAXPATHLEN
%4 = zext i32 %3 to i64
%5 = alloca i8, i64 %4
%6 = alloca i8, i64 %4
%7 = alloca i8, i64 %4
%8 = alloca i8, i64 %4
%9 = icmp eq i32 %0, 6
br i1 %9, label %12, label %10
10: ; preds = %2
%11 = tail call i32 @exit(i32 1)
unreachable
12: ; preds = %2
%13 = getelementptr inbounds i8*, i8** %1, i64 1
%14 = load i8*, i8** %13
%15 = call i32 @strcpy(i8* %5, i8* %14)
%16 = getelementptr inbounds i8*, i8** %1, i64 2
%17 = load i8*, i8** %16
%18 = call i32 @atoi(i8* %17)
%19 = getelementptr inbounds i8*, i8** %1, i64 3
%20 = load i8*, i8** %19
%21 = call i32 @atoi(i8* %20)
%22 = getelementptr inbounds i8*, i8** %1, i64 4
%23 = load i8*, i8** %22
%24 = call i32 @strcpy(i8* %7, i8* %23)
%25 = getelementptr inbounds i8*, i8** %1, i64 5
%26 = load i8*, i8** %25
%27 = call i32 @strcpy(i8* %8, i8* %26)
%28 = call i64 @setgid(i32 %21)
%29 = icmp slt i64 %28, 0
br i1 %29, label %30, label %32
30: ; preds = %12
%31 = call i32 @exit(i32 1)
unreachable
32: ; preds = %12
%33 = call i64 @initgroups(i8* %5, i32 %21)
%34 = icmp slt i64 %33, 0
br i1 %34, label %35, label %37
35: ; preds = %32
%36 = call i32 @exit(i32 1)
unreachable
37: ; preds = %32
%38 = call i64 @setuid(i32 %18)
%39 = icmp slt i64 %38, 0
br i1 %39, label %40, label %42
40: ; preds = %37
%41 = call i32 @exit(i32 1)
unreachable
42: ; preds = %37
%43 = call i32 @strcpy(i8* %6, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0))
%44 = call i32 @strcat(i8* %6, i8* %7)
%45 = call i32 @strcat(i8* %6, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0))
%46 = call i32 @strcat(i8* %6, i8* %8)
%47 = call i32 @strcat(i8* %6, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.2, i64 0, i64 0))
%48 = call i32 @strcat(i8* %6, i8* %8)
%49 = call i32 @system(i8* %6)
%50 = call i32 @exit(i32 %49)
unreachable
}