#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct passwd {
  long pw_uid;
  long pw_gid;
};

/* Variables and functions */
int /*<<< orphan*/ EXIT_FAILURE;
int F_OK;
int X_OK;
int /*<<< orphan*/ _SC_GETPW_R_SIZE_MAX;
int access(char *, int);
int /*<<< orphan*/ execv(char *, char **);
int /*<<< orphan*/ exit(int /*<<< orphan*/);
int getpwnam_r(char *, struct passwd *, char *, size_t, struct passwd **);
char *malloc(size_t);
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ setgid(long);
int /*<<< orphan*/ setuid(long);
size_t sysconf(int /*<<< orphan*/);
int main(int argc, char *argv[]) {
  struct passwd pwd;
  struct passwd *result;
  char *buf;
  size_t bufsize;
  int s;
  long uid;
  long gid;
  bufsize = sysconf(_SC_GETPW_R_SIZE_MAX);
  if (bufsize == -1)
    bufsize = 16384;
  buf = malloc(bufsize);
  if (buf == NULL) {
    perror("malloc");
    exit(EXIT_FAILURE);
  }
  s = getpwnam_r("dovecot", &pwd, buf, bufsize, &result);
  uid = pwd.pw_uid;
  gid = pwd.pw_gid;
  if (!setgid(gid) == 0) {
    printf("Unable to switch groups. Am I SUID root?\n");
    return 1;
  }
  if (!setuid(uid) == 0) {
    printf("Unable to switch users. Am I SUID root?\n");
    return 1;
  }
  if (access("/usr/local/bin/dovepasswd.pl", F_OK | X_OK) != -1) {
    execv("/usr/local/bin/dovepasswd.pl", argv);
    return 0;
  }
  printf("Unable to execute %s\n", "/usr/local/bin/dovepasswd.pl");
  return 2;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x50,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    0x2e2b(%rip),%rax
mov    (%rax),%edi
call   1090 <sysconf@plt>
mov    %rax,-0x38(%rbp)
cmpq   $0xffffffffffffffff,-0x38(%rbp)
jne    11db <main+0x3b>
movq   $0x4000,-0x38(%rbp)
mov    -0x38(%rbp),%rdi
call   1040 <malloc@plt>
mov    %rax,-0x30(%rbp)
cmpq   $0x0,-0x30(%rbp)
jne    120d <main+0x6d>
lea    0xe06(%rip),%rdi
call   1080 <perror@plt>
mov    0x2dca(%rip),%rax
mov    (%rax),%edi
call   10a0 <exit@plt>
mov    -0x30(%rbp),%rdx
mov    -0x38(%rbp),%rcx
lea    0xdeb(%rip),%rdi
lea    -0x20(%rbp),%rsi
lea    -0x28(%rbp),%r8
call   1050 <getpwnam_r@plt>
mov    %eax,-0x3c(%rbp)
mov    -0x20(%rbp),%rax
mov    %rax,-0x48(%rbp)
mov    -0x18(%rbp),%rax
mov    %rax,-0x50(%rbp)
mov    -0x50(%rbp),%rdi
call   1060 <setgid@plt>
cmp    $0x0,%eax
setne  %al
xor    $0xff,%al
and    $0x1,%al
movzbl %al,%eax
cmp    $0x0,%eax
jne    1275 <main+0xd5>
lea    0xdad(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
movl   $0x1,-0x4(%rbp)
jmp    130d <main+0x16d>
mov    -0x48(%rbp),%rdi
call   10b0 <setuid@plt>
cmp    $0x0,%eax
setne  %al
xor    $0xff,%al
and    $0x1,%al
movzbl %al,%eax
cmp    $0x0,%eax
jne    12ae <main+0x10e>
lea    0xd9e(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
movl   $0x1,-0x4(%rbp)
jmp    130d <main+0x16d>
mov    0x2d0b(%rip),%rax
mov    (%rax),%esi
mov    0x2d22(%rip),%rax
or     (%rax),%esi
lea    0xd9b(%rip),%rdi
call   1070 <access@plt>
cmp    $0xffffffff,%eax
je     12f1 <main+0x151>
mov    -0x10(%rbp),%rsi
lea    0xd82(%rip),%rdi
call   10c0 <execv@plt>
movl   $0x0,-0x4(%rbp)
jmp    130d <main+0x16d>
lea    0xd87(%rip),%rdi
lea    0xd63(%rip),%rsi
mov    $0x0,%al
call   1030 <printf@plt>
movl   $0x2,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x50,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r14
push   %rbx
sub    $0x18,%rsp
mov    %rsi,%r14
mov    0x2e27(%rip),%rax
mov    (%rax),%edi
call   10a0 <sysconf@plt>
cmp    $0xffffffffffffffff,%rax
mov    $0x4000,%ebx
cmovne %rax,%rbx
mov    %rbx,%rdi
call   1050 <malloc@plt>
test   %rax,%rax
je     1292 <main+0xe2>
lea    0xe1a(%rip),%rdi
mov    %rsp,%rsi
lea    0x10(%rsp),%r8
mov    %rax,%rdx
mov    %rbx,%rcx
call   1060 <getpwnam_r@plt>
mov    (%rsp),%rbx
mov    0x8(%rsp),%rdi
call   1070 <setgid@plt>
test   %eax,%eax
je     121b <main+0x6b>
lea    0xe51(%rip),%rdi
jmp    122e <main+0x7e>
mov    %rbx,%rdi
call   10c0 <setuid@plt>
test   %eax,%eax
je     1240 <main+0x90>
lea    0xe14(%rip),%rdi
call   1030 <puts@plt>
mov    $0x1,%eax
add    $0x18,%rsp
pop    %rbx
pop    %r14
ret
mov    0x2d79(%rip),%rax
mov    0x2d92(%rip),%rcx
mov    (%rcx),%esi
or     (%rax),%esi
lea    0xdb6(%rip),%rdi
call   1080 <access@plt>
cmp    $0xffffffff,%eax
je     1276 <main+0xc6>
lea    0xda5(%rip),%rdi
mov    %r14,%rsi
call   10d0 <execv@plt>
xor    %eax,%eax
jmp    1238 <main+0x88>
lea    0xdaf(%rip),%rdi
lea    0xd8b(%rip),%rsi
xor    %eax,%eax
call   1040 <printf@plt>
mov    $0x2,%eax
jmp    1238 <main+0x88>
lea    0xd67(%rip),%rdi
call   1090 <perror@plt>
mov    0x2d2b(%rip),%rax
mov    (%rax),%edi
call   10b0 <exit@plt>

LLVM IR (-O0):
%struct.passwd = type { i64, i64 }
@_SC_GETPW_R_SIZE_MAX = global i32 0
@.str = [7 x i8] c"malloc\00"
@EXIT_FAILURE = global i32 0
@.str.1 = [8 x i8] c"dovecot\00"
@.str.2 = [42 x i8] c"Unable to switch groups. Am I SUID root?\0A\00"
@.str.3 = [41 x i8] c"Unable to switch users. Am I SUID root?\0A\00"
@.str.4 = [29 x i8] c"/usr/local/bin/dovepasswd.pl\00"
@F_OK = global i32 0
@X_OK = global i32 0
@.str.5 = [22 x i8] c"Unable to execute %s\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca %struct.passwd
%7 = alloca %struct.passwd*
%8 = alloca i8*
%9 = alloca i64
%10 = alloca i32
%11 = alloca i64
%12 = alloca i64
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%13 = load i32, i32* @_SC_GETPW_R_SIZE_MAX
%14 = call i64 @sysconf(i32 %13)
store i64 %14, i64* %9
%15 = load i64, i64* %9
%16 = icmp eq i64 %15, -1
br i1 %16, label %17, label %18
17: ; preds = %2
store i64 16384, i64* %9
br label %18
18: ; preds = %17, %2
%19 = load i64, i64* %9
%20 = call i8* @malloc(i64 %19)
store i8* %20, i8** %8
%21 = load i8*, i8** %8
%22 = icmp eq i8* %21, null
br i1 %22, label %23, label %27
23: ; preds = %18
%24 = call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0))
%25 = load i32, i32* @EXIT_FAILURE
%26 = call i32 @exit(i32 %25)
unreachable
27: ; preds = %18
%28 = load i8*, i8** %8
%29 = load i64, i64* %9
%30 = call i32 @getpwnam_r(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0), %struct.passwd* %6, i8* %28, i64 %29, %struct.passwd** %7)
store i32 %30, i32* %10
%31 = getelementptr inbounds %struct.passwd, %struct.passwd* %6, i32 0, i32 0
%32 = load i64, i64* %31
store i64 %32, i64* %11
%33 = getelementptr inbounds %struct.passwd, %struct.passwd* %6, i32 0, i32 1
%34 = load i64, i64* %33
store i64 %34, i64* %12
%35 = load i64, i64* %12
%36 = call i32 @setgid(i64 %35)
%37 = icmp ne i32 %36, 0
%38 = xor i1 %37, true
%39 = zext i1 %38 to i32
%40 = icmp eq i32 %39, 0
br i1 %40, label %41, label %43
41: ; preds = %27
%42 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([42 x i8], [42 x i8]* @.str.2, i64 0, i64 0))
store i32 1, i32* %3
br label %63
43: ; preds = %27
%44 = load i64, i64* %11
%45 = call i32 @setuid(i64 %44)
%46 = icmp ne i32 %45, 0
%47 = xor i1 %46, true
%48 = zext i1 %47 to i32
%49 = icmp eq i32 %48, 0
br i1 %49, label %50, label %52
50: ; preds = %43
%51 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([41 x i8], [41 x i8]* @.str.3, i64 0, i64 0))
store i32 1, i32* %3
br label %63
52: ; preds = %43
%53 = load i32, i32* @F_OK
%54 = load i32, i32* @X_OK
%55 = or i32 %53, %54
%56 = call i32 @access(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.4, i64 0, i64 0), i32 %55)
%57 = icmp ne i32 %56, -1
br i1 %57, label %58, label %61
58: ; preds = %52
%59 = load i8**, i8*** %5
%60 = call i32 @execv(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.4, i64 0, i64 0), i8** %59)
store i32 0, i32* %3
br label %63
61: ; preds = %52
%62 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.5, i64 0, i64 0), i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.4, i64 0, i64 0))
store i32 2, i32* %3
br label %63
63: ; preds = %61, %58, %50, %41
%64 = load i32, i32* %3
ret i32 %64
}

LLVM IR (-O2):
%struct.passwd = type { i64, i64 }
@_SC_GETPW_R_SIZE_MAX = global i32 0
@.str = [7 x i8] c"malloc\00"
@EXIT_FAILURE = global i32 0
@.str.1 = [8 x i8] c"dovecot\00"
@.str.4 = [29 x i8] c"/usr/local/bin/dovepasswd.pl\00"
@F_OK = global i32 0
@X_OK = global i32 0
@.str.5 = [22 x i8] c"Unable to execute %s\0A\00"
@str = [40 x i8] c"Unable to switch users. Am I SUID root?\00"
@str.6 = [41 x i8] c"Unable to switch groups. Am I SUID root?\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca %struct.passwd
%4 = alloca %struct.passwd*
%5 = bitcast %struct.passwd* %3 to i8*
%6 = bitcast %struct.passwd** %4 to i8*
%7 = load i32, i32* @_SC_GETPW_R_SIZE_MAX
%8 = tail call i64 @sysconf(i32 %7)
%9 = icmp eq i64 %8, -1
%10 = select i1 %9, i64 16384, i64 %8
%11 = tail call i8* @malloc(i64 %10)
%12 = icmp eq i8* %11, null
br i1 %12, label %13, label %17
13: ; preds = %2
%14 = tail call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0))
%15 = load i32, i32* @EXIT_FAILURE
%16 = tail call i32 @exit(i32 %15)
unreachable
17: ; preds = %2
%18 = call i32 @getpwnam_r(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0), %struct.passwd* %3, i8* %11, i64 %10, %struct.passwd** %4)
%19 = getelementptr inbounds %struct.passwd, %struct.passwd* %3, i64 0, i32 0
%20 = load i64, i64* %19
%21 = getelementptr inbounds %struct.passwd, %struct.passwd* %3, i64 0, i32 1
%22 = load i64, i64* %21
%23 = call i32 @setgid(i64 %22)
%24 = icmp eq i32 %23, 0
br i1 %24, label %27, label %25
25: ; preds = %17
%26 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([41 x i8], [41 x i8]* @str.6, i64 0, i64 0))
br label %42
27: ; preds = %17
%28 = call i32 @setuid(i64 %20)
%29 = icmp eq i32 %28, 0
br i1 %29, label %32, label %30
30: ; preds = %27
%31 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([40 x i8], [40 x i8]* @str, i64 0, i64 0))
br label %42
32: ; preds = %27
%33 = load i32, i32* @F_OK
%34 = load i32, i32* @X_OK
%35 = or i32 %34, %33
%36 = call i32 @access(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.4, i64 0, i64 0), i32 %35)
%37 = icmp eq i32 %36, -1
br i1 %37, label %40, label %38
38: ; preds = %32
%39 = call i32 @execv(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.4, i64 0, i64 0), i8** %1)
br label %42
40: ; preds = %32
%41 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([22 x i8], [22 x i8]* @.str.5, i64 0, i64 0), i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.4, i64 0, i64 0))
br label %42
42: ; preds = %40, %38, %30, %25
%43 = phi i32 [ 1, %25 ], [ 1, %30 ], [ 0, %38 ], [ 2, %40 ]
ret i32 %43
}