#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ O_RDONLY;
int /*<<< orphan*/ exit(int);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *);
scalar_t__ getuid();
int /*<<< orphan*/ open(char *, int /*<<< orphan*/);
int /*<<< orphan*/ stderr;
int /*<<< orphan*/ system(char *);
void trigger() {
  open("/proc/sys/net/core/somaxconn", O_RDONLY);
  if (getuid() != 0) {
    fprintf(stderr, "not root, ya blew it!\n");
    exit(-1);
  }
  fprintf(stderr, "w00p w00p!\n");
  system("/bin/sh -i");
}


x86 assembly (clang, -O0):
<trigger>:
push   %rbp
mov    %rsp,%rbp
mov    0x2e8d(%rip),%rax
mov    (%rax),%esi
lea    0xe9c(%rip),%rdi
call   1060 <open@plt>
mov    $0x0,%al
call   1030 <getuid@plt>
cmp    $0x0,%rax
je     1199 <trigger+0x49>
mov    0x2e57(%rip),%rax
mov    (%rax),%edi
lea    0xe93(%rip),%rsi
call   1050 <fprintf@plt>
mov    $0xffffffff,%edi
call   1070 <exit@plt>
mov    0x2e38(%rip),%rax
mov    (%rax),%edi
lea    0xe8b(%rip),%rsi
call   1050 <fprintf@plt>
lea    0xe8b(%rip),%rdi
call   1040 <system@plt>
pop    %rbp
ret

x86 assembly (clang, -O2):
<trigger>:
push   %rax
mov    0x2e90(%rip),%rax
mov    (%rax),%esi
lea    0xe9f(%rip),%rdi
call   1060 <open@plt>
xor    %eax,%eax
call   1030 <getuid@plt>
mov    0x2e64(%rip),%rcx
mov    (%rcx),%edi
test   %rax,%rax
jne    1194 <trigger+0x44>
lea    0xeb2(%rip),%rsi
call   1050 <fprintf@plt>
lea    0xeb2(%rip),%rdi
pop    %rax
jmp    1040 <system@plt>
lea    0xe82(%rip),%rsi
call   1050 <fprintf@plt>
mov    $0xffffffff,%edi
call   1070 <exit@plt>

LLVM IR (-O0):
@.str = [29 x i8] c"/proc/sys/net/core/somaxconn\00"
@O_RDONLY = global i32 0
@stderr = global i32 0
@.str.1 = [23 x i8] c"not root, ya blew it!\0A\00"
@.str.2 = [12 x i8] c"w00p w00p!\0A\00"
@.str.3 = [11 x i8] c"/bin/sh -i\00"
define void @trigger() {
%1 = load i32, i32* @O_RDONLY
%2 = call i32 @open(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str, i64 0, i64 0), i32 %1)
%3 = call i64 (...) @getuid()
%4 = icmp ne i64 %3, 0
br i1 %4, label %5, label %9
5: ; preds = %0
%6 = load i32, i32* @stderr
%7 = call i32 @fprintf(i32 %6, i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.1, i64 0, i64 0))
%8 = call i32 @exit(i32 -1)
unreachable
9: ; preds = %0
%10 = load i32, i32* @stderr
%11 = call i32 @fprintf(i32 %10, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.2, i64 0, i64 0))
%12 = call i32 @system(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.3, i64 0, i64 0))
ret void
}

LLVM IR (-O2):
@.str = [29 x i8] c"/proc/sys/net/core/somaxconn\00"
@O_RDONLY = global i32 0
@stderr = global i32 0
@.str.1 = [23 x i8] c"not root, ya blew it!\0A\00"
@.str.2 = [12 x i8] c"w00p w00p!\0A\00"
@.str.3 = [11 x i8] c"/bin/sh -i\00"
define void @trigger() {
%1 = load i32, i32* @O_RDONLY
%2 = tail call i32 @open(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str, i64 0, i64 0), i32 %1)
%3 = tail call i64 (...) @getuid()
%4 = icmp eq i64 %3, 0
%5 = load i32, i32* @stderr
br i1 %4, label %9, label %6
6: ; preds = %0
%7 = tail call i32 @fprintf(i32 %5, i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.1, i64 0, i64 0))
%8 = tail call i32 @exit(i32 -1)
unreachable
9: ; preds = %0
%10 = tail call i32 @fprintf(i32 %5, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.2, i64 0, i64 0))
%11 = tail call i32 @system(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.3, i64 0, i64 0))
ret void
}