#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct stat {
  int st_mode;
};
struct passwd {
  scalar_t__ pw_uid;
  scalar_t__ pw_gid;
};

/* Variables and functions */
int PATH_MAX;
int /*<<< orphan*/ errno;
int /*<<< orphan*/ execve(char *, char **, char **);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, ...);
scalar_t__ geteuid();
int getpid();
struct passwd *getpwnam(char const *);
int /*<<< orphan*/ memset(char *, int /*<<< orphan*/, int);
size_t readlink(char *, char *, int);
int setgid(scalar_t__);
int setuid(scalar_t__);
int /*<<< orphan*/ sprintf(char *, char *, int);
scalar_t__ stat(char *, struct stat *);
int /*<<< orphan*/ stderr;
char *strerror(int /*<<< orphan*/);
scalar_t__ strncmp(char *, char *, int);
int main(int argc, char **argv, char **envp) {
  const char *user;
  struct passwd *pw;
  struct stat st;
  char procPath[PATH_MAX + 1], ourPath[PATH_MAX + 1];
  size_t ourPathLength;
  if ((argc == 2) && (strncmp(argv[1], "-v", 2) == 0)) {
    fprintf(stderr, "setuid: %s@%s ", "(unknown)", "(unknown)");
    if (-1 == -1) {
      fprintf(stderr, "unknown state\n");
    } else if (-1 == 0) {
      fprintf(stderr, "clean\n");
    } else {
      fprintf(stderr, "%i file%s unclean\n", -1, (-1 == 1 ? "" : "s"));
    }
    return (0);
  } else if (argc < 3) {
    fprintf(stderr, "Usage:\n  %s [-v] [<USER> <COMMAND> [ARGS]]\n", argv[0]);
    return (1);
  }
  user = *++argv;
  argv++;
  pw = getpwnam(user);
  if (!pw) {
    fprintf(stderr, "Error: Unknown user: %s\n", user);
    return (1);
  }
  memset(procPath, 0, PATH_MAX + 1);
  sprintf(procPath, "/proc/%u/exe", getpid());
  memset(ourPath, 0, PATH_MAX + 1);
  ourPathLength = readlink(procPath, ourPath, PATH_MAX);
  if (ourPathLength < 0) {
    fprintf(stderr, "Security: Not running! Failed to read our own path\n");
    return (1);
  }
  if (stat(ourPath, &st)) {
    fprintf(stderr, "Security: Not running! Failed to stat ourself\n");
    return (1);
  } else if (st.st_mode & 04000) {
    fprintf(stderr, "Security: Not running! Our setuid bit is set\n");
    return (1);
  }
  if ((geteuid() != 0) && (geteuid() != pw->pw_uid)) {
    fprintf(stderr,
            "Security: Not running! You are not root or the target user\n");
    return (1);
  }
  if (geteuid() == 0) {
    if (setgid(pw->pw_gid) == -1) {
      fprintf(stderr, "Error: Failed to set GID to %i: %s\n", (int)pw->pw_gid,
              strerror(errno));
      return (1);
    }
    if (setuid(pw->pw_uid) == -1) {
      fprintf(stderr, "Error: Failed to set UID to %i: %s\n", (int)pw->pw_uid,
              strerror(errno));
      return (1);
    }
  }
  execve(*argv, argv, envp);
  fprintf(stderr, "Error: Failed to run %s: %s\n", *argv, strerror(errno));
  return (1);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x90,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
mov    0x2dfc(%rip),%rax
mov    (%rax),%ecx
add    $0x1,%ecx
mov    %rsp,%rdx
mov    %rdx,-0x38(%rbp)
mov    %rcx,%rsi
add    $0xf,%rsi
and    $0xfffffffffffffff0,%rsi
mov    %rsp,%rdx
sub    %rsi,%rdx
mov    %rdx,-0x68(%rbp)
mov    %rdx,%rsp
mov    %rcx,-0x40(%rbp)
mov    (%rax),%eax
add    $0x1,%eax
mov    %rax,%rdx
add    $0xf,%rdx
and    $0xfffffffffffffff0,%rdx
mov    %rsp,%rcx
sub    %rdx,%rcx
mov    %rcx,-0x60(%rbp)
mov    %rcx,%rsp
mov    %rax,-0x48(%rbp)
cmpl   $0x2,-0x8(%rbp)
jne    12b5 <main+0xe5>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
lea    0xdaa(%rip),%rsi
mov    $0x2,%edx
call   1030 <strncmp@plt>
cmp    $0x0,%rax
jne    12b5 <main+0xe5>
mov    0x2d67(%rip),%rax
mov    (%rax),%edi
lea    0xd89(%rip),%rsi
lea    0xd91(%rip),%rcx
mov    %rcx,%rdx
mov    $0x0,%al
call   10a0 <fprintf@plt>
mov    0x2d46(%rip),%rax
mov    (%rax),%edi
lea    0xd81(%rip),%rsi
mov    $0x0,%al
call   10a0 <fprintf@plt>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x54(%rbp)
jmp    1607 <main+0x437>
cmpl   $0x3,-0x8(%rbp)
jge    12f0 <main+0x120>
mov    0x2d12(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
mov    (%rax),%rdx
lea    0xd55(%rip),%rsi
mov    $0x0,%al
call   10a0 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
movl   $0x1,-0x54(%rbp)
jmp    1607 <main+0x437>
jmp    12f5 <main+0x125>
mov    -0x10(%rbp),%rax
mov    %rax,%rcx
add    $0x8,%rcx
mov    %rcx,-0x10(%rbp)
mov    0x8(%rax),%rax
mov    %rax,-0x20(%rbp)
mov    -0x10(%rbp),%rax
add    $0x8,%rax
mov    %rax,-0x10(%rbp)
mov    -0x20(%rbp),%rdi
call   1090 <getpwnam@plt>
mov    %rax,-0x28(%rbp)
cmpq   $0x0,-0x28(%rbp)
jne    135e <main+0x18e>
mov    0x2ca1(%rip),%rax
mov    (%rax),%edi
mov    -0x20(%rbp),%rdx
lea    0xd13(%rip),%rsi
mov    $0x0,%al
call   10a0 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
movl   $0x1,-0x54(%rbp)
jmp    1607 <main+0x437>
mov    -0x68(%rbp),%rdi
mov    0x2c87(%rip),%rax
mov    (%rax),%edx
add    $0x1,%edx
xor    %esi,%esi
call   1060 <memset@plt>
mov    $0x0,%al
call   1050 <getpid@plt>
mov    -0x68(%rbp),%rdi
mov    %eax,%edx
lea    0xce7(%rip),%rsi
call   10d0 <sprintf@plt>
mov    -0x60(%rbp),%rdi
mov    0x2c57(%rip),%rax
mov    (%rax),%edx
add    $0x1,%edx
xor    %esi,%esi
call   1060 <memset@plt>
mov    -0x68(%rbp),%rdi
mov    -0x60(%rbp),%rsi
mov    0x2c3c(%rip),%rax
mov    (%rax),%edx
call   1040 <readlink@plt>
mov    %rax,-0x50(%rbp)
cmpq   $0x0,-0x50(%rbp)
jae    13f4 <main+0x224>
mov    0x2c07(%rip),%rax
mov    (%rax),%edi
lea    0xca3(%rip),%rsi
mov    $0x0,%al
call   10a0 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
movl   $0x1,-0x54(%rbp)
jmp    1607 <main+0x437>
mov    -0x60(%rbp),%rdi
lea    -0x30(%rbp),%rsi
call   10b0 <stat@plt>
cmp    $0x0,%rax
je     1435 <main+0x265>
mov    0x2bc6(%rip),%rax
mov    (%rax),%edi
lea    0xc96(%rip),%rsi
mov    $0x0,%al
call   10a0 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
movl   $0x1,-0x54(%rbp)
jmp    1607 <main+0x437>
mov    -0x30(%rbp),%eax
and    $0x800,%eax
cmp    $0x0,%eax
je     1470 <main+0x2a0>
mov    0x2b8b(%rip),%rax
mov    (%rax),%edi
lea    0xc8a(%rip),%rsi
mov    $0x0,%al
call   10a0 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
movl   $0x1,-0x54(%rbp)
jmp    1607 <main+0x437>
jmp    1475 <main+0x2a5>
mov    $0x0,%al
call   1070 <geteuid@plt>
cmp    $0x0,%rax
je     14c4 <main+0x2f4>
mov    $0x0,%al
call   1070 <geteuid@plt>
mov    -0x28(%rbp),%rcx
cmp    (%rcx),%rax
je     14c4 <main+0x2f4>
mov    0x2b37(%rip),%rax
mov    (%rax),%edi
lea    0xc64(%rip),%rsi
mov    $0x0,%al
call   10a0 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
movl   $0x1,-0x54(%rbp)
jmp    1607 <main+0x437>
mov    $0x0,%al
call   1070 <geteuid@plt>
cmp    $0x0,%rax
jne    15a2 <main+0x3d2>
mov    -0x28(%rbp),%rax
mov    0x8(%rax),%rdi
call   10c0 <setgid@plt>
cmp    $0xffffffff,%eax
jne    153a <main+0x36a>
mov    0x2ae6(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x70(%rbp)
mov    -0x28(%rbp),%rax
mov    0x8(%rax),%rax
mov    %eax,-0x6c(%rbp)
mov    0x2ac7(%rip),%rax
mov    (%rax),%edi
call   10f0 <strerror@plt>
mov    -0x70(%rbp),%edi
mov    -0x6c(%rbp),%edx
mov    %rax,%rcx
lea    0xc2a(%rip),%rsi
mov    $0x0,%al
call   10a0 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
movl   $0x1,-0x54(%rbp)
jmp    1607 <main+0x437>
mov    -0x28(%rbp),%rax
mov    (%rax),%rdi
call   10e0 <setuid@plt>
cmp    $0xffffffff,%eax
jne    159d <main+0x3cd>
mov    0x2a82(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x78(%rbp)
mov    -0x28(%rbp),%rax
mov    (%rax),%rax
mov    %eax,-0x74(%rbp)
mov    0x2a64(%rip),%rax
mov    (%rax),%edi
call   10f0 <strerror@plt>
mov    -0x78(%rbp),%edi
mov    -0x74(%rbp),%edx
mov    %rax,%rcx
lea    0xbeb(%rip),%rsi
mov    $0x0,%al
call   10a0 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
movl   $0x1,-0x54(%rbp)
jmp    1607 <main+0x437>
jmp    15a2 <main+0x3d2>
mov    -0x10(%rbp),%rax
mov    (%rax),%rdi
mov    -0x10(%rbp),%rsi
mov    -0x18(%rbp),%rdx
call   1080 <execve@plt>
mov    0x2a1b(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x84(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x80(%rbp)
mov    0x29f9(%rip),%rax
mov    (%rax),%edi
call   10f0 <strerror@plt>
mov    -0x84(%rbp),%edi
mov    -0x80(%rbp),%rdx
mov    %rax,%rcx
lea    0xba0(%rip),%rsi
mov    $0x0,%al
call   10a0 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
movl   $0x1,-0x54(%rbp)
mov    -0x38(%rbp),%rax
mov    %rax,%rsp
mov    -0x4(%rbp),%eax
mov    %rbp,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
mov    %rsp,%rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x28,%rsp
mov    %rsi,%r12
mov    %rsp,%r15
mov    0x2e02(%rip),%r14
mov    (%r14),%eax
add    $0x1,%eax
mov    %rsp,%r13
add    $0xf,%rax
and    $0xfffffffffffffff0,%rax
sub    %rax,%r13
mov    %r13,%rsp
mov    (%r14),%eax
add    $0x1,%eax
mov    %rsp,%rbx
add    $0xf,%rax
and    $0xfffffffffffffff0,%rax
sub    %rax,%rbx
mov    %rbx,%rsp
cmp    $0x2,%edi
jne    1276 <main+0xa6>
mov    0x8(%r12),%rdi
lea    0xdd3(%rip),%rsi
mov    $0x2,%edx
call   1030 <strncmp@plt>
test   %rax,%rax
jne    1278 <main+0xa8>
mov    0x2d95(%rip),%r14
mov    (%r14),%edi
lea    0xdb6(%rip),%rsi
lea    0xdbe(%rip),%rcx
xor    %ebx,%ebx
mov    %rcx,%rdx
xor    %eax,%eax
call   10a0 <fprintf@plt>
mov    (%r14),%edi
lea    0xdb2(%rip),%rsi
xor    %eax,%eax
call   10a0 <fprintf@plt>
jmp    13ea <main+0x21a>
jg     129d <main+0xcd>
mov    0x2d59(%rip),%rax
mov    (%rax),%edi
mov    (%r12),%rdx
lea    0xd9f(%rip),%rsi
xor    %eax,%eax
call   10a0 <fprintf@plt>
mov    $0x1,%ebx
jmp    13ea <main+0x21a>
mov    %rdx,-0x48(%rbp)
mov    %r15,-0x30(%rbp)
mov    0x8(%r12),%r15
mov    %r15,%rdi
call   1090 <getpwnam@plt>
test   %rax,%rax
je     1327 <main+0x157>
mov    %rax,-0x38(%rbp)
mov    (%r14),%edx
add    $0x1,%edx
mov    %r13,%rdi
xor    %esi,%esi
call   1060 <memset@plt>
xor    %eax,%eax
call   1050 <getpid@plt>
lea    0xd97(%rip),%rsi
mov    %r13,%rdi
mov    %eax,%edx
call   10d0 <sprintf@plt>
mov    (%r14),%edx
add    $0x1,%edx
mov    %rbx,%rdi
xor    %esi,%esi
call   1060 <memset@plt>
mov    (%r14),%edx
mov    %r13,%rdi
mov    %rbx,%rsi
call   1040 <readlink@plt>
lea    -0x40(%rbp),%rsi
mov    %rbx,%rdi
call   10b0 <stat@plt>
test   %rax,%rax
je     1346 <main+0x176>
mov    0x2cbf(%rip),%rax
mov    (%rax),%edi
lea    0xd5b(%rip),%rsi
jmp    13da <main+0x20a>
mov    0x2caa(%rip),%rax
mov    (%rax),%edi
lea    0xd20(%rip),%rsi
mov    %r15,%rdx
xor    %eax,%eax
call   10a0 <fprintf@plt>
jmp    13e1 <main+0x211>
testb  $0x8,-0x3f(%rbp)
jne    13ca <main+0x1fa>
xor    %eax,%eax
call   1070 <geteuid@plt>
test   %rax,%rax
mov    -0x30(%rbp),%r15
je     1370 <main+0x1a0>
xor    %eax,%eax
call   1070 <geteuid@plt>
mov    -0x38(%rbp),%rcx
cmp    (%rcx),%rax
jne    13fe <main+0x22e>
xor    %eax,%eax
call   1070 <geteuid@plt>
test   %rax,%rax
je     141a <main+0x24a>
add    $0x10,%r12
mov    (%r12),%rdi
mov    %r12,%rsi
mov    -0x48(%rbp),%rdx
call   1080 <execve@plt>
mov    0x2c3d(%rip),%rax
mov    (%rax),%ebx
mov    (%r12),%r14
mov    0x2c28(%rip),%rax
mov    (%rax),%edi
call   10f0 <strerror@plt>
lea    0xda8(%rip),%rsi
mov    %ebx,%edi
mov    %r14,%rdx
mov    %rax,%rcx
xor    %eax,%eax
call   10a0 <fprintf@plt>
jmp    1293 <main+0xc3>
mov    0x2c07(%rip),%rax
mov    (%rax),%edi
lea    0xcd2(%rip),%rsi
xor    %eax,%eax
call   10a0 <fprintf@plt>
mov    $0x1,%ebx
mov    -0x30(%rbp),%r15
mov    %r15,%rsp
mov    %ebx,%eax
lea    -0x28(%rbp),%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    0x2bd3(%rip),%rax
mov    (%rax),%edi
lea    0xccc(%rip),%rsi
xor    %eax,%eax
call   10a0 <fprintf@plt>
jmp    1293 <main+0xc3>
mov    -0x38(%rbp),%rbx
mov    0x8(%rbx),%rdi
call   10c0 <setgid@plt>
cmp    $0xffffffff,%eax
je     1466 <main+0x296>
mov    (%rbx),%rdi
call   10e0 <setuid@plt>
cmp    $0xffffffff,%eax
jne    1380 <main+0x1b0>
mov    0x2b94(%rip),%rax
mov    (%rax),%ebx
mov    -0x38(%rbp),%rax
mov    (%rax),%r14d
mov    0x2b7c(%rip),%rax
mov    (%rax),%edi
call   10f0 <strerror@plt>
lea    0xcd8(%rip),%rsi
mov    %ebx,%edi
jmp    148c <main+0x2bc>
mov    0x2b6b(%rip),%rax
mov    (%rax),%r12d
mov    0x8(%rbx),%r14d
mov    0x2b55(%rip),%rax
mov    (%rax),%edi
call   10f0 <strerror@plt>
lea    0xc8d(%rip),%rsi
mov    %r12d,%edi
mov    %r14d,%edx
mov    %rax,%rcx
xor    %eax,%eax
call   10a0 <fprintf@plt>
jmp    1293 <main+0xc3>

LLVM IR (-O0):
%struct.passwd = type { i64, i64 }
%struct.stat = type { i32 }
@PATH_MAX = global i32 0
@.str = [3 x i8] c"-v\00"
@stderr = global i32 0
@.str.1 = [15 x i8] c"setuid: %s@%s \00"
@.str.2 = [10 x i8] c"(unknown)\00"
@.str.3 = [15 x i8] c"unknown state\0A\00"
@.str.4 = [44 x i8] c"Usage:\0A %s [-v] [<USER> <COMMAND> [ARGS]]\0A\00"
@.str.5 = [25 x i8] c"Error: Unknown user: %s\0A\00"
@.str.6 = [13 x i8] c"/proc/%u/exe\00"
@.str.7 = [52 x i8] c"Security: Not running! Failed to read our own path\0A\00"
@.str.8 = [47 x i8] c"Security: Not running! Failed to stat ourself\0A\00"
@.str.9 = [46 x i8] c"Security: Not running! Our setuid bit is set\0A\00"
@.str.10 = [60 x i8] c"Security: Not running! You are not root or the target user\0A\00"
@.str.11 = [36 x i8] c"Error: Failed to set GID to %i: %s\0A\00"
@errno = global i32 0
@.str.12 = [36 x i8] c"Error: Failed to set UID to %i: %s\0A\00"
@.str.13 = [29 x i8] c"Error: Failed to run %s: %s\0A\00"
define i32 @main(i32 %0, i8** %1, i8** %2) {
%4 = alloca i32
%5 = alloca i32
%6 = alloca i8**
%7 = alloca i8**
%8 = alloca i8*
%9 = alloca %struct.passwd*
%10 = alloca %struct.stat
%11 = alloca i8*
%12 = alloca i64
%13 = alloca i64
%14 = alloca i64
%15 = alloca i32
store i32 0, i32* %4
store i32 %0, i32* %5
store i8** %1, i8*** %6
store i8** %2, i8*** %7
%16 = load i32, i32* @PATH_MAX
%17 = add nsw i32 %16, 1
%18 = zext i32 %17 to i64
%19 = call i8* @llvm.stacksave()
store i8* %19, i8** %11
%20 = alloca i8, i64 %18
store i64 %18, i64* %12
%21 = load i32, i32* @PATH_MAX
%22 = add nsw i32 %21, 1
%23 = zext i32 %22 to i64
%24 = alloca i8, i64 %23
store i64 %23, i64* %13
%25 = load i32, i32* %5
%26 = icmp eq i32 %25, 2
br i1 %26, label %27, label %38
27: ; preds = %3
%28 = load i8**, i8*** %6
%29 = getelementptr inbounds i8*, i8** %28, i64 1
%30 = load i8*, i8** %29
%31 = call i64 @strncmp(i8* %30, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str, i64 0, i64 0), i32 2)
%32 = icmp eq i64 %31, 0
br i1 %32, label %33, label %38
33: ; preds = %27
%34 = load i32, i32* @stderr
%35 = call i32 (i32, i8*, ...) @fprintf(i32 %34, i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.2, i64 0, i64 0), i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.2, i64 0, i64 0))
%36 = load i32, i32* @stderr
%37 = call i32 (i32, i8*, ...) @fprintf(i32 %36, i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.3, i64 0, i64 0))
store i32 0, i32* %4
store i32 1, i32* %15
br label %151
38: ; preds = %27, %3
%39 = load i32, i32* %5
%40 = icmp slt i32 %39, 3
br i1 %40, label %41, label %47
41: ; preds = %38
%42 = load i32, i32* @stderr
%43 = load i8**, i8*** %6
%44 = getelementptr inbounds i8*, i8** %43, i64 0
%45 = load i8*, i8** %44
%46 = call i32 (i32, i8*, ...) @fprintf(i32 %42, i8* getelementptr inbounds ([44 x i8], [44 x i8]* @.str.4, i64 0, i64 0), i8* %45)
store i32 1, i32* %4
store i32 1, i32* %15
br label %151
47: ; preds = %38
br label %48
48: ; preds = %47
%49 = load i8**, i8*** %6
%50 = getelementptr inbounds i8*, i8** %49, i32 1
store i8** %50, i8*** %6
%51 = load i8*, i8** %50
store i8* %51, i8** %8
%52 = load i8**, i8*** %6
%53 = getelementptr inbounds i8*, i8** %52, i32 1
store i8** %53, i8*** %6
%54 = load i8*, i8** %8
%55 = call %struct.passwd* @getpwnam(i8* %54)
store %struct.passwd* %55, %struct.passwd** %9
%56 = load %struct.passwd*, %struct.passwd** %9
%57 = icmp ne %struct.passwd* %56, null
br i1 %57, label %62, label %58
58: ; preds = %48
%59 = load i32, i32* @stderr
%60 = load i8*, i8** %8
%61 = call i32 (i32, i8*, ...) @fprintf(i32 %59, i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.5, i64 0, i64 0), i8* %60)
store i32 1, i32* %4
store i32 1, i32* %15
br label %151
62: ; preds = %48
%63 = load i32, i32* @PATH_MAX
%64 = add nsw i32 %63, 1
%65 = call i32 @memset(i8* %20, i32 0, i32 %64)
%66 = call i32 (...) @getpid()
%67 = call i32 @sprintf(i8* %20, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.6, i64 0, i64 0), i32 %66)
%68 = load i32, i32* @PATH_MAX
%69 = add nsw i32 %68, 1
%70 = call i32 @memset(i8* %24, i32 0, i32 %69)
%71 = load i32, i32* @PATH_MAX
%72 = call i64 @readlink(i8* %20, i8* %24, i32 %71)
store i64 %72, i64* %14
%73 = load i64, i64* %14
%74 = icmp ult i64 %73, 0
br i1 %74, label %75, label %78
75: ; preds = %62
%76 = load i32, i32* @stderr
%77 = call i32 (i32, i8*, ...) @fprintf(i32 %76, i8* getelementptr inbounds ([52 x i8], [52 x i8]* @.str.7, i64 0, i64 0))
store i32 1, i32* %4
store i32 1, i32* %15
br label %151
78: ; preds = %62
%79 = call i64 @stat(i8* %24, %struct.stat* %10)
%80 = icmp ne i64 %79, 0
br i1 %80, label %81, label %84
81: ; preds = %78
%82 = load i32, i32* @stderr
%83 = call i32 (i32, i8*, ...) @fprintf(i32 %82, i8* getelementptr inbounds ([47 x i8], [47 x i8]* @.str.8, i64 0, i64 0))
store i32 1, i32* %4
store i32 1, i32* %15
br label %151
84: ; preds = %78
%85 = getelementptr inbounds %struct.stat, %struct.stat* %10, i32 0, i32 0
%86 = load i32, i32* %85
%87 = and i32 %86, 2048
%88 = icmp ne i32 %87, 0
br i1 %88, label %89, label %92
89: ; preds = %84
%90 = load i32, i32* @stderr
%91 = call i32 (i32, i8*, ...) @fprintf(i32 %90, i8* getelementptr inbounds ([46 x i8], [46 x i8]* @.str.9, i64 0, i64 0))
store i32 1, i32* %4
store i32 1, i32* %15
br label %151
92: ; preds = %84
br label %93
93: ; preds = %92
%94 = call i64 (...) @geteuid()
%95 = icmp ne i64 %94, 0
br i1 %95, label %96, label %105
96: ; preds = %93
%97 = call i64 (...) @geteuid()
%98 = load %struct.passwd*, %struct.passwd** %9
%99 = getelementptr inbounds %struct.passwd, %struct.passwd* %98, i32 0, i32 0
%100 = load i64, i64* %99
%101 = icmp ne i64 %97, %100
br i1 %101, label %102, label %105
102: ; preds = %96
%103 = load i32, i32* @stderr
%104 = call i32 (i32, i8*, ...) @fprintf(i32 %103, i8* getelementptr inbounds ([60 x i8], [60 x i8]* @.str.10, i64 0, i64 0))
store i32 1, i32* %4
store i32 1, i32* %15
br label %151
105: ; preds = %96, %93
%106 = call i64 (...) @geteuid()
%107 = icmp eq i64 %106, 0
br i1 %107, label %108, label %139
108: ; preds = %105
%109 = load %struct.passwd*, %struct.passwd** %9
%110 = getelementptr inbounds %struct.passwd, %struct.passwd* %109, i32 0, i32 1
%111 = load i64, i64* %110
%112 = call i32 @setgid(i64 %111)
%113 = icmp eq i32 %112, -1
br i1 %113, label %114, label %123
114: ; preds = %108
%115 = load i32, i32* @stderr
%116 = load %struct.passwd*, %struct.passwd** %9
%117 = getelementptr inbounds %struct.passwd, %struct.passwd* %116, i32 0, i32 1
%118 = load i64, i64* %117
%119 = trunc i64 %118 to i32
%120 = load i32, i32* @errno
%121 = call i8* @strerror(i32 %120)
%122 = call i32 (i32, i8*, ...) @fprintf(i32 %115, i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str.11, i64 0, i64 0), i32 %119, i8* %121)
store i32 1, i32* %4
store i32 1, i32* %15
br label %151
123: ; preds = %108
%124 = load %struct.passwd*, %struct.passwd** %9
%125 = getelementptr inbounds %struct.passwd, %struct.passwd* %124, i32 0, i32 0
%126 = load i64, i64* %125
%127 = call i32 @setuid(i64 %126)
%128 = icmp eq i32 %127, -1
br i1 %128, label %129, label %138
129: ; preds = %123
%130 = load i32, i32* @stderr
%131 = load %struct.passwd*, %struct.passwd** %9
%132 = getelementptr inbounds %struct.passwd, %struct.passwd* %131, i32 0, i32 0
%133 = load i64, i64* %132
%134 = trunc i64 %133 to i32
%135 = load i32, i32* @errno
%136 = call i8* @strerror(i32 %135)
%137 = call i32 (i32, i8*, ...) @fprintf(i32 %130, i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str.12, i64 0, i64 0), i32 %134, i8* %136)
store i32 1, i32* %4
store i32 1, i32* %15
br label %151
138: ; preds = %123
br label %139
139: ; preds = %138, %105
%140 = load i8**, i8*** %6
%141 = load i8*, i8** %140
%142 = load i8**, i8*** %6
%143 = load i8**, i8*** %7
%144 = call i32 @execve(i8* %141, i8** %142, i8** %143)
%145 = load i32, i32* @stderr
%146 = load i8**, i8*** %6
%147 = load i8*, i8** %146
%148 = load i32, i32* @errno
%149 = call i8* @strerror(i32 %148)
%150 = call i32 (i32, i8*, ...) @fprintf(i32 %145, i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.13, i64 0, i64 0), i8* %147, i8* %149)
store i32 1, i32* %4
store i32 1, i32* %15
br label %151
151: ; preds = %139, %129, %114, %102, %89, %81, %75, %58, %41, %33
%152 = load i8*, i8** %11
%153 = load i32, i32* %4
ret i32 %153
}

LLVM IR (-O2):
%struct.stat = type { i32 }
%struct.passwd = type { i64, i64 }
@PATH_MAX = global i32 0
@.str = [3 x i8] c"-v\00"
@stderr = global i32 0
@.str.1 = [15 x i8] c"setuid: %s@%s \00"
@.str.2 = [10 x i8] c"(unknown)\00"
@.str.3 = [15 x i8] c"unknown state\0A\00"
@.str.4 = [44 x i8] c"Usage:\0A %s [-v] [<USER> <COMMAND> [ARGS]]\0A\00"
@.str.5 = [25 x i8] c"Error: Unknown user: %s\0A\00"
@.str.6 = [13 x i8] c"/proc/%u/exe\00"
@.str.8 = [47 x i8] c"Security: Not running! Failed to stat ourself\0A\00"
@.str.9 = [46 x i8] c"Security: Not running! Our setuid bit is set\0A\00"
@.str.10 = [60 x i8] c"Security: Not running! You are not root or the target user\0A\00"
@.str.11 = [36 x i8] c"Error: Failed to set GID to %i: %s\0A\00"
@errno = global i32 0
@.str.12 = [36 x i8] c"Error: Failed to set UID to %i: %s\0A\00"
@.str.13 = [29 x i8] c"Error: Failed to run %s: %s\0A\00"
define i32 @main(i32 %0, i8** %1, i8** %2) {
%4 = alloca %struct.stat
%5 = bitcast %struct.stat* %4 to i8*
%6 = load i32, i32* @PATH_MAX
%7 = add nsw i32 %6, 1
%8 = zext i32 %7 to i64
%9 = tail call i8* @llvm.stacksave()
%10 = alloca i8, i64 %8
%11 = load i32, i32* @PATH_MAX
%12 = add nsw i32 %11, 1
%13 = zext i32 %12 to i64
%14 = alloca i8, i64 %13
%15 = icmp eq i32 %0, 2
br i1 %15, label %16, label %26
16: ; preds = %3
%17 = getelementptr inbounds i8*, i8** %1, i64 1
%18 = load i8*, i8** %17
%19 = tail call i64 @strncmp(i8* %18, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str, i64 0, i64 0), i32 2)
%20 = icmp eq i64 %19, 0
br i1 %20, label %21, label %28
21: ; preds = %16
%22 = load i32, i32* @stderr
%23 = tail call i32 (i32, i8*, ...) @fprintf(i32 %22, i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.2, i64 0, i64 0), i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.2, i64 0, i64 0))
%24 = load i32, i32* @stderr
%25 = tail call i32 (i32, i8*, ...) @fprintf(i32 %24, i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.3, i64 0, i64 0))
br label %111
26: ; preds = %3
%27 = icmp slt i32 %0, 3
br i1 %27, label %28, label %32
28: ; preds = %16, %26
%29 = load i32, i32* @stderr
%30 = load i8*, i8** %1
%31 = tail call i32 (i32, i8*, ...) @fprintf(i32 %29, i8* getelementptr inbounds ([44 x i8], [44 x i8]* @.str.4, i64 0, i64 0), i8* %30)
br label %111
32: ; preds = %26
%33 = getelementptr inbounds i8*, i8** %1, i64 1
%34 = load i8*, i8** %33
%35 = getelementptr inbounds i8*, i8** %1, i64 2
%36 = tail call %struct.passwd* @getpwnam(i8* %34)
%37 = icmp eq %struct.passwd* %36, null
br i1 %37, label %38, label %41
38: ; preds = %32
%39 = load i32, i32* @stderr
%40 = tail call i32 (i32, i8*, ...) @fprintf(i32 %39, i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.5, i64 0, i64 0), i8* %34)
br label %111
41: ; preds = %32
%42 = load i32, i32* @PATH_MAX
%43 = add nsw i32 %42, 1
%44 = call i32 @memset(i8* %10, i32 0, i32 %43)
%45 = call i32 (...) @getpid()
%46 = call i32 @sprintf(i8* %10, i8* dereferenceable(1) getelementptr inbounds ([13 x i8], [13 x i8]* @.str.6, i64 0, i64 0), i32 %45)
%47 = load i32, i32* @PATH_MAX
%48 = add nsw i32 %47, 1
%49 = call i32 @memset(i8* %14, i32 0, i32 %48)
%50 = load i32, i32* @PATH_MAX
%51 = call i64 @readlink(i8* %10, i8* %14, i32 %50)
%52 = call i64 @stat(i8* %14, %struct.stat* %4)
%53 = icmp eq i64 %52, 0
br i1 %53, label %57, label %54
54: ; preds = %41
%55 = load i32, i32* @stderr
%56 = call i32 (i32, i8*, ...) @fprintf(i32 %55, i8* getelementptr inbounds ([47 x i8], [47 x i8]* @.str.8, i64 0, i64 0))
br label %111
57: ; preds = %41
%58 = getelementptr inbounds %struct.stat, %struct.stat* %4, i64 0, i32 0
%59 = load i32, i32* %58
%60 = and i32 %59, 2048
%61 = icmp eq i32 %60, 0
br i1 %61, label %65, label %62
62: ; preds = %57
%63 = load i32, i32* @stderr
%64 = call i32 (i32, i8*, ...) @fprintf(i32 %63, i8* getelementptr inbounds ([46 x i8], [46 x i8]* @.str.9, i64 0, i64 0))
br label %111
65: ; preds = %57
%66 = call i64 (...) @geteuid()
%67 = icmp eq i64 %66, 0
br i1 %67, label %76, label %68
68: ; preds = %65
%69 = call i64 (...) @geteuid()
%70 = getelementptr inbounds %struct.passwd, %struct.passwd* %36, i64 0, i32 0
%71 = load i64, i64* %70
%72 = icmp eq i64 %69, %71
br i1 %72, label %76, label %73
73: ; preds = %68
%74 = load i32, i32* @stderr
%75 = call i32 (i32, i8*, ...) @fprintf(i32 %74, i8* getelementptr inbounds ([60 x i8], [60 x i8]* @.str.10, i64 0, i64 0))
br label %111
76: ; preds = %68, %65
%77 = call i64 (...) @geteuid()
%78 = icmp eq i64 %77, 0
br i1 %78, label %79, label %103
79: ; preds = %76
%80 = getelementptr inbounds %struct.passwd, %struct.passwd* %36, i64 0, i32 1
%81 = load i64, i64* %80
%82 = call i32 @setgid(i64 %81)
%83 = icmp eq i32 %82, -1
br i1 %83, label %84, label %91
84: ; preds = %79
%85 = load i32, i32* @stderr
%86 = load i64, i64* %80
%87 = trunc i64 %86 to i32
%88 = load i32, i32* @errno
%89 = call i8* @strerror(i32 %88)
%90 = call i32 (i32, i8*, ...) @fprintf(i32 %85, i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str.11, i64 0, i64 0), i32 %87, i8* %89)
br label %111
91: ; preds = %79
%92 = getelementptr inbounds %struct.passwd, %struct.passwd* %36, i64 0, i32 0
%93 = load i64, i64* %92
%94 = call i32 @setuid(i64 %93)
%95 = icmp eq i32 %94, -1
br i1 %95, label %96, label %103
96: ; preds = %91
%97 = load i32, i32* @stderr
%98 = load i64, i64* %92
%99 = trunc i64 %98 to i32
%100 = load i32, i32* @errno
%101 = call i8* @strerror(i32 %100)
%102 = call i32 (i32, i8*, ...) @fprintf(i32 %97, i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str.12, i64 0, i64 0), i32 %99, i8* %101)
br label %111
103: ; preds = %91, %76
%104 = load i8*, i8** %35
%105 = call i32 @execve(i8* %104, i8** %35, i8** %2)
%106 = load i32, i32* @stderr
%107 = load i8*, i8** %35
%108 = load i32, i32* @errno
%109 = call i8* @strerror(i32 %108)
%110 = call i32 (i32, i8*, ...) @fprintf(i32 %106, i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.13, i64 0, i64 0), i8* %107, i8* %109)
br label %111
111: ; preds = %103, %96, %84, %73, %62, %54, %38, %28, %21
%112 = phi i32 [ 0, %21 ], [ 1, %28 ], [ 1, %54 ], [ 1, %62 ], [ 1, %73 ], [ 1, %84 ], [ 1, %96 ], [ 1, %103 ], [ 1, %38 ]
ret i32 %112
}