#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ chdir(char *);
int chroot(char *);
int /*<<< orphan*/ errno;
int execl(char *, char *, int /*<<< orphan*/ *);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, char *);
int /*<<< orphan*/ mkdir(char *, int);
int /*<<< orphan*/ print_pwd();
int /*<<< orphan*/ printf(char *);
int /*<<< orphan*/ stderr;
char *strerror(int /*<<< orphan*/);
void test1() {
  printf("test1\n");
  print_pwd();
  mkdir("dummy_dir", 0755);
  if (chroot("dummy_dir") == -1) {
    fprintf(stderr, "Can't chroot into dummy_dir (%s)\n", strerror(errno));
  } else {
    int i;
    for (i = 0; i < 1000; i++)
      chdir("..");
    print_pwd();
    if (execl("/bin/sh", "/bin/sh", NULL) == -1) {
      fprintf(stderr, "execl /bin/sh failed (%s)\n", strerror(errno));
    }
  }
}


x86 assembly (clang, -O0):
<test1>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
lea    0xe71(%rip),%rdi
call   1060 <printf@plt>
mov    $0x0,%al
call   1080 <print_pwd@plt>
lea    0xe65(%rip),%rdi
mov    $0x1ed,%esi
call   1040 <mkdir@plt>
lea    0xe54(%rip),%rdi
call   1030 <chroot@plt>
cmp    $0xffffffff,%eax
jne    11f2 <test1+0x72>
mov    0x2e18(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x8(%rbp)
mov    0x2e04(%rip),%rax
mov    (%rax),%edi
call   1090 <strerror@plt>
mov    -0x8(%rbp),%edi
mov    %rax,%rdx
lea    0xe29(%rip),%rsi
call   1070 <fprintf@plt>
jmp    1274 <test1+0xf4>
movl   $0x0,-0x4(%rbp)
cmpl   $0x3e8,-0x4(%rbp)
jge    1220 <test1+0xa0>
lea    0xe26(%rip),%rdi
call   1050 <chdir@plt>
mov    -0x4(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x4(%rbp)
jmp    11f9 <test1+0x79>
mov    $0x0,%al
call   1080 <print_pwd@plt>
lea    0xe08(%rip),%rsi
xor    %eax,%eax
mov    %eax,%edx
mov    %rsi,%rdi
call   10a0 <execl@plt>
cmp    $0xffffffff,%eax
jne    126f <test1+0xef>
mov    0x2d96(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0xc(%rbp)
mov    0x2d82(%rip),%rax
mov    (%rax),%edi
call   1090 <strerror@plt>
mov    -0xc(%rbp),%edi
mov    %rax,%rdx
lea    0xdd4(%rip),%rsi
call   1070 <fprintf@plt>
jmp    1274 <test1+0xf4>
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<test1>:
push   %rbp
push   %rbx
push   %rax
lea    0xec8(%rip),%rdi
call   1050 <puts@plt>
xor    %eax,%eax
call   1080 <print_pwd@plt>
lea    0xe63(%rip),%rbx
mov    %rbx,%rdi
mov    $0x1ed,%esi
call   1040 <mkdir@plt>
mov    %rbx,%rdi
call   1030 <chroot@plt>
cmp    $0xffffffff,%eax
je     1201 <test1+0x81>
mov    $0x3e8,%ebp
lea    0xe69(%rip),%rbx
cs nopw 0x0(%rax,%rax,1)
nopl   (%rax)
mov    %rbx,%rdi
call   1060 <chdir@plt>
add    $0xffffffff,%ebp
jne    11d0 <test1+0x50>
xor    %eax,%eax
call   1080 <print_pwd@plt>
lea    0xe44(%rip),%rdi
mov    %rdi,%rsi
xor    %edx,%edx
call   10a0 <execl@plt>
cmp    $0xffffffff,%eax
je     120a <test1+0x8a>
add    $0x8,%rsp
pop    %rbx
pop    %rbp
ret
lea    0xe02(%rip),%rbx
jmp    1211 <test1+0x91>
lea    0xe26(%rip),%rbx
mov    0x2dc8(%rip),%rax
mov    (%rax),%ebp
mov    0x2db7(%rip),%rax
mov    (%rax),%edi
call   1090 <strerror@plt>
mov    %ebp,%edi
mov    %rbx,%rsi
mov    %rax,%rdx
add    $0x8,%rsp
pop    %rbx
pop    %rbp
jmp    1070 <fprintf@plt>

LLVM IR (-O0):
@.str = [7 x i8] c"test1\0A\00"
@.str.1 = [10 x i8] c"dummy_dir\00"
@stderr = global i32 0
@.str.2 = [34 x i8] c"Can't chroot into dummy_dir (%s)\0A\00"
@errno = global i32 0
@.str.3 = [3 x i8] c"..\00"
@.str.4 = [8 x i8] c"/bin/sh\00"
@.str.5 = [27 x i8] c"execl /bin/sh failed (%s)\0A\00"
define void @test1() {
%1 = alloca i32
%2 = call i32 @printf(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0))
%3 = call i32 (...) @print_pwd()
%4 = call i32 @mkdir(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0), i32 493)
%5 = call i32 @chroot(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0))
%6 = icmp eq i32 %5, -1
br i1 %6, label %7, label %12
7: ; preds = %0
%8 = load i32, i32* @stderr
%9 = load i32, i32* @errno
%10 = call i8* @strerror(i32 %9)
%11 = call i32 @fprintf(i32 %8, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.2, i64 0, i64 0), i8* %10)
br label %31
12: ; preds = %0
store i32 0, i32* %1
br label %13
13: ; preds = %18, %12
%14 = load i32, i32* %1
%15 = icmp slt i32 %14, 1000
br i1 %15, label %16, label %21
16: ; preds = %13
%17 = call i32 @chdir(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.3, i64 0, i64 0))
br label %18
18: ; preds = %16
%19 = load i32, i32* %1
%20 = add nsw i32 %19, 1
store i32 %20, i32* %1
br label %13
21: ; preds = %13
%22 = call i32 (...) @print_pwd()
%23 = call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.4, i64 0, i64 0), i32* null)
%24 = icmp eq i32 %23, -1
br i1 %24, label %25, label %30
25: ; preds = %21
%26 = load i32, i32* @stderr
%27 = load i32, i32* @errno
%28 = call i8* @strerror(i32 %27)
%29 = call i32 @fprintf(i32 %26, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.5, i64 0, i64 0), i8* %28)
br label %30
30: ; preds = %25, %21
br label %31
31: ; preds = %30, %7
ret void
}

LLVM IR (-O2):
@.str.1 = [10 x i8] c"dummy_dir\00"
@stderr = global i32 0
@.str.2 = [34 x i8] c"Can't chroot into dummy_dir (%s)\0A\00"
@errno = global i32 0
@.str.3 = [3 x i8] c"..\00"
@.str.4 = [8 x i8] c"/bin/sh\00"
@.str.5 = [27 x i8] c"execl /bin/sh failed (%s)\0A\00"
@str = [6 x i8] c"test1\00"
define void @test1() {
%1 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([6 x i8], [6 x i8]* @str, i64 0, i64 0))
%2 = tail call i32 (...) @print_pwd()
%3 = tail call i32 @mkdir(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0), i32 493)
%4 = tail call i32 @chroot(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0))
%5 = icmp eq i32 %4, -1
br i1 %5, label %15, label %6
6: ; preds = %0, %6
%7 = phi i32 [ %9, %6 ], [ 0, %0 ]
%8 = tail call i32 @chdir(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.3, i64 0, i64 0))
%9 = add nuw nsw i32 %7, 1
%10 = icmp eq i32 %9, 1000
br i1 %10, label %11, label %6
11: ; preds = %6
%12 = tail call i32 (...) @print_pwd()
%13 = tail call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.4, i64 0, i64 0), i32* null)
%14 = icmp eq i32 %13, -1
br i1 %14, label %15, label %21
15: ; preds = %11, %0
%16 = phi i8* [ getelementptr inbounds ([34 x i8], [34 x i8]* @.str.2, i64 0, i64 0), %0 ], [ getelementptr inbounds ([27 x i8], [27 x i8]* @.str.5, i64 0, i64 0), %11 ]
%17 = load i32, i32* @stderr
%18 = load i32, i32* @errno
%19 = tail call i8* @strerror(i32 %18)
%20 = tail call i32 @fprintf(i32 %17, i8* %16, i8* %19)
br label %21
21: ; preds = %15, %11
ret void
}