#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct stat {
  int st_mode;
  scalar_t__ st_uid;
};
struct passwd {
  char *pw_dir;
  scalar_t__ pw_uid;
};
struct group {
  int /*<<< orphan*/ gr_mem;
};

/* Variables and functions */
int S_IRUSR;
int /*<<< orphan*/ S_ISREG(int);
int S_IWGRP;
int S_IWOTH;
int error(int, char *);
int /*<<< orphan*/ execv(char *, char **);
char *getenv(char *);
struct group *getgrnam(char *);
struct passwd *getpwnam(char *);
int /*<<< orphan*/ isUserInGroup(char *, int /*<<< orphan*/);
scalar_t__ setuid(scalar_t__);
scalar_t__ stat(char *, struct stat *);
char *strchr(char *, char);
int strlen(char *);
scalar_t__ strncmp(char *, char *, int);
int /*<<< orphan*/ strncpy(char *, char *, int);
int main(void) {
  char username[(1024) + 1];
  char *sn, *sfn, *userstart, *userend, *args[2];
  int sn_len, sfn_len, userlen;
  struct passwd *userpw;
  struct group *grp;
  struct stat sst;
  sn = getenv("SCRIPT_NAME");
  if (!sn)
    return error(50, "SCRIPT_NAME undefined.");
  sn_len = strlen(sn);
  sfn = getenv("SCRIPT_FILENAME");
  if (!sfn)
    return error(54, "SCRIPT_FILENAME undefined.");
  sfn_len = strlen(sfn);
  if (sn_len < 5)
    return error(58, "SCRIPT_NAME malformed.");
  if (sn[0] != '/')
    return error(59, "SCRIPT_NAME malformed.");
  if (sn[1] != '~')
    return error(60, "SCRIPT_NAME malformed.");
  if (stat(sfn, &sst))
    return error(63, "Script not found.");
  if (!S_ISREG(sst.st_mode))
    return error(67, "Script is not a regular file.");
  userstart = sn + 2;
  userend = strchr(sn + 2, '/');
  if (!userend)
    return error(72, "Bad user name or URL.");
  userlen = userend - userstart;
  if (userlen > (1024))
    return error(76, "Bad user name.");
  strncpy(username, userstart, userlen);
  username[userlen] = 0;
  userpw = getpwnam(username);
  if (!userpw)
    return error(83, "User not found.");
  grp = getgrnam("suphp");
  if (!grp)
    return error(87, "Missing "
                     "suphp"
                     " group.");
  if (!isUserInGroup(username, grp->gr_mem))
    return error(91, "User not allowed to use scripts.");
  if (strncmp(sfn, userpw->pw_dir, strlen(userpw->pw_dir)))
    return error(95, "Invalid script directory.");
  if (userpw->pw_uid != sst.st_uid)
    return error(99, "Unsafe script.");
  if (!(sst.st_mode & S_IRUSR))
    return error(103, "Can not read script.");
  if (sst.st_mode & (S_IWGRP | S_IWOTH))
    return error(107, "Unsafe script.");
  if (setuid(userpw->pw_uid))
    return error(111, "User switching failed.");
  args[0] = sfn;
  args[1] = 0;
  execv("/usr/bin/php-cgi", args);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x480,%rsp
movl   $0x0,-0x4(%rbp)
lea    0xe17(%rip),%rdi
call   1030 <getenv@plt>
mov    %rax,-0x418(%rbp)
cmpq   $0x0,-0x418(%rbp)
jne    121c <main+0x4c>
mov    $0x32,%edi
lea    0xdfd(%rip),%rsi
call   10d0 <error@plt>
mov    %eax,-0x4(%rbp)
jmp    162e <main+0x45e>
mov    -0x418(%rbp),%rdi
call   1070 <strlen@plt>
mov    %eax,-0x444(%rbp)
lea    0xdee(%rip),%rdi
call   1030 <getenv@plt>
mov    %rax,-0x420(%rbp)
cmpq   $0x0,-0x420(%rbp)
jne    1268 <main+0x98>
mov    $0x36,%edi
lea    0xdd8(%rip),%rsi
call   10d0 <error@plt>
mov    %eax,-0x4(%rbp)
jmp    162e <main+0x45e>
mov    -0x420(%rbp),%rdi
call   1070 <strlen@plt>
mov    %eax,-0x448(%rbp)
cmpl   $0x5,-0x444(%rbp)
jge    12a0 <main+0xd0>
mov    $0x3a,%edi
lea    0xdbb(%rip),%rsi
call   10d0 <error@plt>
mov    %eax,-0x4(%rbp)
jmp    162e <main+0x45e>
mov    -0x418(%rbp),%rax
movsbl (%rax),%eax
cmp    $0x2f,%eax
je     12cc <main+0xfc>
mov    $0x3b,%edi
lea    0xd8f(%rip),%rsi
call   10d0 <error@plt>
mov    %eax,-0x4(%rbp)
jmp    162e <main+0x45e>
mov    -0x418(%rbp),%rax
movsbl 0x1(%rax),%eax
cmp    $0x7e,%eax
je     12f9 <main+0x129>
mov    $0x3c,%edi
lea    0xd62(%rip),%rsi
call   10d0 <error@plt>
mov    %eax,-0x4(%rbp)
jmp    162e <main+0x45e>
mov    -0x420(%rbp),%rdi
lea    -0x470(%rbp),%rsi
call   10a0 <stat@plt>
cmp    $0x0,%rax
je     132f <main+0x15f>
mov    $0x3f,%edi
lea    0xd43(%rip),%rsi
call   10d0 <error@plt>
mov    %eax,-0x4(%rbp)
jmp    162e <main+0x45e>
mov    -0x470(%rbp),%edi
call   10c0 <S_ISREG@plt>
cmp    $0x0,%eax
jne    135c <main+0x18c>
mov    $0x43,%edi
lea    0xd28(%rip),%rsi
call   10d0 <error@plt>
mov    %eax,-0x4(%rbp)
jmp    162e <main+0x45e>
mov    -0x418(%rbp),%rax
add    $0x2,%rax
mov    %rax,-0x428(%rbp)
mov    -0x418(%rbp),%rdi
add    $0x2,%rdi
mov    $0x2f,%esi
call   1080 <strchr@plt>
mov    %rax,-0x430(%rbp)
cmpq   $0x0,-0x430(%rbp)
jne    13b1 <main+0x1e1>
mov    $0x48,%edi
lea    0xcf1(%rip),%rsi
call   10d0 <error@plt>
mov    %eax,-0x4(%rbp)
jmp    162e <main+0x45e>
mov    -0x430(%rbp),%rax
mov    -0x428(%rbp),%rcx
sub    %rcx,%rax
mov    %eax,-0x44c(%rbp)
cmpl   $0x400,-0x44c(%rbp)
jle    13f1 <main+0x221>
mov    $0x4c,%edi
lea    0xcc7(%rip),%rsi
call   10d0 <error@plt>
mov    %eax,-0x4(%rbp)
jmp    162e <main+0x45e>
lea    -0x410(%rbp),%rdi
mov    -0x428(%rbp),%rsi
mov    -0x44c(%rbp),%edx
call   1040 <strncpy@plt>
movslq -0x44c(%rbp),%rax
movb   $0x0,-0x410(%rbp,%rax,1)
lea    -0x410(%rbp),%rdi
call   1090 <getpwnam@plt>
mov    %rax,-0x458(%rbp)
cmpq   $0x0,-0x458(%rbp)
jne    1453 <main+0x283>
mov    $0x53,%edi
lea    0xc74(%rip),%rsi
call   10d0 <error@plt>
mov    %eax,-0x4(%rbp)
jmp    162e <main+0x45e>
lea    0xc70(%rip),%rdi
call   10b0 <getgrnam@plt>
mov    %rax,-0x460(%rbp)
cmpq   $0x0,-0x460(%rbp)
jne    148d <main+0x2bd>
mov    $0x57,%edi
lea    0xc50(%rip),%rsi
call   10d0 <error@plt>
mov    %eax,-0x4(%rbp)
jmp    162e <main+0x45e>
lea    -0x410(%rbp),%rdi
mov    -0x460(%rbp),%rax
mov    (%rax),%esi
call   1060 <isUserInGroup@plt>
cmp    $0x0,%eax
jne    14c4 <main+0x2f4>
mov    $0x5b,%edi
lea    0xc2e(%rip),%rsi
call   10d0 <error@plt>
mov    %eax,-0x4(%rbp)
jmp    162e <main+0x45e>
mov    -0x420(%rbp),%rax
mov    %rax,-0x480(%rbp)
mov    -0x458(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x478(%rbp)
mov    -0x458(%rbp),%rax
mov    (%rax),%rdi
call   1070 <strlen@plt>
mov    -0x480(%rbp),%rdi
mov    -0x478(%rbp),%rsi
mov    %eax,%edx
call   1050 <strncmp@plt>
cmp    $0x0,%rax
je     152a <main+0x35a>
mov    $0x5f,%edi
lea    0xbe9(%rip),%rsi
call   10d0 <error@plt>
mov    %eax,-0x4(%rbp)
jmp    162e <main+0x45e>
mov    -0x458(%rbp),%rax
mov    0x8(%rax),%rax
cmp    -0x468(%rbp),%rax
je     155b <main+0x38b>
mov    $0x63,%edi
lea    0xbd2(%rip),%rsi
call   10d0 <error@plt>
mov    %eax,-0x4(%rbp)
jmp    162e <main+0x45e>
mov    -0x470(%rbp),%eax
mov    0x2a70(%rip),%rcx
and    (%rcx),%eax
cmp    $0x0,%eax
jne    158c <main+0x3bc>
mov    $0x67,%edi
lea    0xbb0(%rip),%rsi
call   10d0 <error@plt>
mov    %eax,-0x4(%rbp)
jmp    162e <main+0x45e>
mov    -0x470(%rbp),%eax
mov    0x2a4f(%rip),%rcx
mov    (%rcx),%ecx
mov    0x2a26(%rip),%rdx
or     (%rdx),%ecx
and    %ecx,%eax
cmp    $0x0,%eax
je     15c8 <main+0x3f8>
mov    $0x6b,%edi
lea    0xb65(%rip),%rsi
call   10d0 <error@plt>
mov    %eax,-0x4(%rbp)
jmp    162e <main+0x45e>
mov    -0x458(%rbp),%rax
mov    0x8(%rax),%rdi
call   10e0 <setuid@plt>
cmp    $0x0,%rax
je     15fb <main+0x42b>
mov    $0x6f,%edi
lea    0xb56(%rip),%rsi
call   10d0 <error@plt>
mov    %eax,-0x4(%rbp)
jmp    162e <main+0x45e>
mov    -0x420(%rbp),%rax
mov    %rax,-0x440(%rbp)
movq   $0x0,-0x438(%rbp)
lea    -0x440(%rbp),%rsi
lea    0xb39(%rip),%rdi
call   10f0 <execv@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x480,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %rbx
sub    $0x428,%rsp
lea    0xe1c(%rip),%rdi
call   1030 <getenv@plt>
test   %rax,%rax
je     122a <main+0x5a>
mov    %rax,%rbx
mov    %rax,%rdi
call   1070 <strlen@plt>
mov    %eax,%ebp
lea    0xe21(%rip),%rdi
call   1030 <getenv@plt>
test   %rax,%rax
je     1238 <main+0x68>
mov    %rax,%r14
mov    %rax,%rdi
call   1070 <strlen@plt>
cmp    $0x4,%ebp
jg     1246 <main+0x76>
lea    0xe2b(%rip),%rsi
mov    $0x3a,%edi
jmp    129a <main+0xca>
lea    0xddb(%rip),%rsi
mov    $0x32,%edi
jmp    129a <main+0xca>
lea    0xdf4(%rip),%rsi
mov    $0x36,%edi
jmp    129a <main+0xca>
cmpb   $0x2f,(%rbx)
jne    1280 <main+0xb0>
cmpb   $0x7e,0x1(%rbx)
jne    128e <main+0xbe>
mov    %rsp,%rsi
mov    %r14,%rdi
call   10a0 <stat@plt>
test   %rax,%rax
je     12ac <main+0xdc>
lea    0xdfd(%rip),%rsi
mov    $0x3f,%edi
call   10d0 <error@plt>
add    $0x428,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0xdc7(%rip),%rsi
mov    $0x3b,%edi
jmp    129a <main+0xca>
lea    0xdb9(%rip),%rsi
mov    $0x3c,%edi
add    $0x428,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
jmp    10d0 <error@plt>
mov    (%rsp),%edi
call   10c0 <S_ISREG@plt>
test   %eax,%eax
je     12eb <main+0x11b>
add    $0x2,%rbx
mov    %rbx,%rdi
mov    $0x2f,%esi
call   1080 <strchr@plt>
test   %rax,%rax
je     12fc <main+0x12c>
mov    %rax,%r15
sub    %rbx,%r15
cmp    $0x401,%r15d
jl     130d <main+0x13d>
lea    0xdc7(%rip),%rsi
mov    $0x4c,%edi
jmp    126d <main+0x9d>
lea    0xd85(%rip),%rsi
mov    $0x43,%edi
jmp    126d <main+0x9d>
lea    0xd92(%rip),%rsi
mov    $0x48,%edi
jmp    126d <main+0x9d>
lea    0x20(%rsp),%rbp
mov    %rbp,%rdi
mov    %rbx,%rsi
mov    %r15d,%edx
call   1040 <strncpy@plt>
movslq %r15d,%rax
movb   $0x0,0x20(%rsp,%rax,1)
mov    %rbp,%rdi
call   1090 <getpwnam@plt>
test   %rax,%rax
je     1387 <main+0x1b7>
mov    %rax,%rbx
lea    0xd8b(%rip),%rdi
call   10b0 <getgrnam@plt>
test   %rax,%rax
je     1398 <main+0x1c8>
mov    (%rax),%esi
lea    0x20(%rsp),%rdi
call   1060 <isUserInGroup@plt>
test   %eax,%eax
je     13a9 <main+0x1d9>
mov    (%rbx),%rbp
mov    %rbp,%rdi
call   1070 <strlen@plt>
mov    %r14,%rdi
mov    %rbp,%rsi
mov    %eax,%edx
call   1050 <strncmp@plt>
test   %rax,%rax
je     13ba <main+0x1ea>
lea    0xd89(%rip),%rsi
mov    $0x5f,%edi
jmp    126d <main+0x9d>
lea    0xd2c(%rip),%rsi
mov    $0x53,%edi
jmp    126d <main+0x9d>
lea    0xd31(%rip),%rsi
mov    $0x57,%edi
jmp    126d <main+0x9d>
lea    0xd35(%rip),%rsi
mov    $0x5b,%edi
jmp    126d <main+0x9d>
mov    0x8(%rbx),%rdi
cmp    0x8(%rsp),%rdi
jne    13fa <main+0x22a>
mov    (%rsp),%eax
mov    0x2c09(%rip),%rcx
test   %eax,(%rcx)
je     140b <main+0x23b>
mov    0x2c0e(%rip),%rcx
mov    0x2be7(%rip),%rdx
mov    (%rdx),%edx
or     (%rcx),%edx
test   %eax,%edx
je     141c <main+0x24c>
lea    0xd30(%rip),%rsi
mov    $0x6b,%edi
jmp    126d <main+0x9d>
lea    0xd1f(%rip),%rsi
mov    $0x63,%edi
jmp    126d <main+0x9d>
lea    0xd1d(%rip),%rsi
mov    $0x67,%edi
jmp    126d <main+0x9d>
call   10e0 <setuid@plt>
test   %rax,%rax
je     1437 <main+0x267>
lea    0xd17(%rip),%rsi
mov    $0x6f,%edi
jmp    126d <main+0x9d>
mov    %r14,0x10(%rsp)
movq   $0x0,0x18(%rsp)
lea    0xd0f(%rip),%rdi
lea    0x10(%rsp),%rsi
call   10f0 <execv@plt>
xor    %eax,%eax
jmp    1272 <main+0xa2>

LLVM IR (-O0):
%struct.passwd = type { i8*, i64 }
%struct.group = type { i32 }
%struct.stat = type { i32, i64 }
@.str = [12 x i8] c"SCRIPT_NAME\00"
@.str.1 = [23 x i8] c"SCRIPT_NAME undefined.\00"
@.str.2 = [16 x i8] c"SCRIPT_FILENAME\00"
@.str.3 = [27 x i8] c"SCRIPT_FILENAME undefined.\00"
@.str.4 = [23 x i8] c"SCRIPT_NAME malformed.\00"
@.str.5 = [18 x i8] c"Script not found.\00"
@.str.6 = [30 x i8] c"Script is not a regular file.\00"
@.str.7 = [22 x i8] c"Bad user name or URL.\00"
@.str.8 = [15 x i8] c"Bad user name.\00"
@.str.9 = [16 x i8] c"User not found.\00"
@.str.10 = [6 x i8] c"suphp\00"
@.str.11 = [21 x i8] c"Missing suphp group.\00"
@.str.12 = [33 x i8] c"User not allowed to use scripts.\00"
@.str.13 = [26 x i8] c"Invalid script directory.\00"
@.str.14 = [15 x i8] c"Unsafe script.\00"
@S_IRUSR = global i32 0
@.str.15 = [21 x i8] c"Can not read script.\00"
@S_IWGRP = global i32 0
@S_IWOTH = global i32 0
@.str.16 = [23 x i8] c"User switching failed.\00"
@.str.17 = [17 x i8] c"/usr/bin/php-cgi\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca [1025 x i8]
%3 = alloca i8*
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca [2 x i8*]
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca %struct.passwd*
%12 = alloca %struct.group*
%13 = alloca %struct.stat
store i32 0, i32* %1
%14 = call i8* @getenv(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str, i64 0, i64 0))
store i8* %14, i8** %3
%15 = load i8*, i8** %3
%16 = icmp ne i8* %15, null
br i1 %16, label %19, label %17
17: ; preds = %0
%18 = call i32 @error(i32 50, i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.1, i64 0, i64 0))
store i32 %18, i32* %1
br label %167
19: ; preds = %0
%20 = load i8*, i8** %3
%21 = call i32 @strlen(i8* %20)
store i32 %21, i32* %8
%22 = call i8* @getenv(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.2, i64 0, i64 0))
store i8* %22, i8** %4
%23 = load i8*, i8** %4
%24 = icmp ne i8* %23, null
br i1 %24, label %27, label %25
25: ; preds = %19
%26 = call i32 @error(i32 54, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.3, i64 0, i64 0))
store i32 %26, i32* %1
br label %167
27: ; preds = %19
%28 = load i8*, i8** %4
%29 = call i32 @strlen(i8* %28)
store i32 %29, i32* %9
%30 = load i32, i32* %8
%31 = icmp slt i32 %30, 5
br i1 %31, label %32, label %34
32: ; preds = %27
%33 = call i32 @error(i32 58, i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.4, i64 0, i64 0))
store i32 %33, i32* %1
br label %167
34: ; preds = %27
%35 = load i8*, i8** %3
%36 = getelementptr inbounds i8, i8* %35, i64 0
%37 = load i8, i8* %36
%38 = sext i8 %37 to i32
%39 = icmp ne i32 %38, 47
br i1 %39, label %40, label %42
40: ; preds = %34
%41 = call i32 @error(i32 59, i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.4, i64 0, i64 0))
store i32 %41, i32* %1
br label %167
42: ; preds = %34
%43 = load i8*, i8** %3
%44 = getelementptr inbounds i8, i8* %43, i64 1
%45 = load i8, i8* %44
%46 = sext i8 %45 to i32
%47 = icmp ne i32 %46, 126
br i1 %47, label %48, label %50
48: ; preds = %42
%49 = call i32 @error(i32 60, i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.4, i64 0, i64 0))
store i32 %49, i32* %1
br label %167
50: ; preds = %42
%51 = load i8*, i8** %4
%52 = call i64 @stat(i8* %51, %struct.stat* %13)
%53 = icmp ne i64 %52, 0
br i1 %53, label %54, label %56
54: ; preds = %50
%55 = call i32 @error(i32 63, i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.5, i64 0, i64 0))
store i32 %55, i32* %1
br label %167
56: ; preds = %50
%57 = getelementptr inbounds %struct.stat, %struct.stat* %13, i32 0, i32 0
%58 = load i32, i32* %57
%59 = call i32 @S_ISREG(i32 %58)
%60 = icmp ne i32 %59, 0
br i1 %60, label %63, label %61
61: ; preds = %56
%62 = call i32 @error(i32 67, i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.6, i64 0, i64 0))
store i32 %62, i32* %1
br label %167
63: ; preds = %56
%64 = load i8*, i8** %3
%65 = getelementptr inbounds i8, i8* %64, i64 2
store i8* %65, i8** %5
%66 = load i8*, i8** %3
%67 = getelementptr inbounds i8, i8* %66, i64 2
%68 = call i8* @strchr(i8* %67, i8 signext 47)
store i8* %68, i8** %6
%69 = load i8*, i8** %6
%70 = icmp ne i8* %69, null
br i1 %70, label %73, label %71
71: ; preds = %63
%72 = call i32 @error(i32 72, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.7, i64 0, i64 0))
store i32 %72, i32* %1
br label %167
73: ; preds = %63
%74 = load i8*, i8** %6
%75 = load i8*, i8** %5
%76 = ptrtoint i8* %74 to i64
%77 = ptrtoint i8* %75 to i64
%78 = sub i64 %76, %77
%79 = trunc i64 %78 to i32
store i32 %79, i32* %10
%80 = load i32, i32* %10
%81 = icmp sgt i32 %80, 1024
br i1 %81, label %82, label %84
82: ; preds = %73
%83 = call i32 @error(i32 76, i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.8, i64 0, i64 0))
store i32 %83, i32* %1
br label %167
84: ; preds = %73
%85 = getelementptr inbounds [1025 x i8], [1025 x i8]* %2, i64 0, i64 0
%86 = load i8*, i8** %5
%87 = load i32, i32* %10
%88 = call i32 @strncpy(i8* %85, i8* %86, i32 %87)
%89 = load i32, i32* %10
%90 = sext i32 %89 to i64
%91 = getelementptr inbounds [1025 x i8], [1025 x i8]* %2, i64 0, i64 %90
store i8 0, i8* %91
%92 = getelementptr inbounds [1025 x i8], [1025 x i8]* %2, i64 0, i64 0
%93 = call %struct.passwd* @getpwnam(i8* %92)
store %struct.passwd* %93, %struct.passwd** %11
%94 = load %struct.passwd*, %struct.passwd** %11
%95 = icmp ne %struct.passwd* %94, null
br i1 %95, label %98, label %96
96: ; preds = %84
%97 = call i32 @error(i32 83, i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.9, i64 0, i64 0))
store i32 %97, i32* %1
br label %167
98: ; preds = %84
%99 = call %struct.group* @getgrnam(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.10, i64 0, i64 0))
store %struct.group* %99, %struct.group** %12
%100 = load %struct.group*, %struct.group** %12
%101 = icmp ne %struct.group* %100, null
br i1 %101, label %104, label %102
102: ; preds = %98
%103 = call i32 @error(i32 87, i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.11, i64 0, i64 0))
store i32 %103, i32* %1
br label %167
104: ; preds = %98
%105 = getelementptr inbounds [1025 x i8], [1025 x i8]* %2, i64 0, i64 0
%106 = load %struct.group*, %struct.group** %12
%107 = getelementptr inbounds %struct.group, %struct.group* %106, i32 0, i32 0
%108 = load i32, i32* %107
%109 = call i32 @isUserInGroup(i8* %105, i32 %108)
%110 = icmp ne i32 %109, 0
br i1 %110, label %113, label %111
111: ; preds = %104
%112 = call i32 @error(i32 91, i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.12, i64 0, i64 0))
store i32 %112, i32* %1
br label %167
113: ; preds = %104
%114 = load i8*, i8** %4
%115 = load %struct.passwd*, %struct.passwd** %11
%116 = getelementptr inbounds %struct.passwd, %struct.passwd* %115, i32 0, i32 0
%117 = load i8*, i8** %116
%118 = load %struct.passwd*, %struct.passwd** %11
%119 = getelementptr inbounds %struct.passwd, %struct.passwd* %118, i32 0, i32 0
%120 = load i8*, i8** %119
%121 = call i32 @strlen(i8* %120)
%122 = call i64 @strncmp(i8* %114, i8* %117, i32 %121)
%123 = icmp ne i64 %122, 0
br i1 %123, label %124, label %126
124: ; preds = %113
%125 = call i32 @error(i32 95, i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.13, i64 0, i64 0))
store i32 %125, i32* %1
br label %167
126: ; preds = %113
%127 = load %struct.passwd*, %struct.passwd** %11
%128 = getelementptr inbounds %struct.passwd, %struct.passwd* %127, i32 0, i32 1
%129 = load i64, i64* %128
%130 = getelementptr inbounds %struct.stat, %struct.stat* %13, i32 0, i32 1
%131 = load i64, i64* %130
%132 = icmp ne i64 %129, %131
br i1 %132, label %133, label %135
133: ; preds = %126
%134 = call i32 @error(i32 99, i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.14, i64 0, i64 0))
store i32 %134, i32* %1
br label %167
135: ; preds = %126
%136 = getelementptr inbounds %struct.stat, %struct.stat* %13, i32 0, i32 0
%137 = load i32, i32* %136
%138 = load i32, i32* @S_IRUSR
%139 = and i32 %137, %138
%140 = icmp ne i32 %139, 0
br i1 %140, label %143, label %141
141: ; preds = %135
%142 = call i32 @error(i32 103, i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.15, i64 0, i64 0))
store i32 %142, i32* %1
br label %167
143: ; preds = %135
%144 = getelementptr inbounds %struct.stat, %struct.stat* %13, i32 0, i32 0
%145 = load i32, i32* %144
%146 = load i32, i32* @S_IWGRP
%147 = load i32, i32* @S_IWOTH
%148 = or i32 %146, %147
%149 = and i32 %145, %148
%150 = icmp ne i32 %149, 0
br i1 %150, label %151, label %153
151: ; preds = %143
%152 = call i32 @error(i32 107, i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.14, i64 0, i64 0))
store i32 %152, i32* %1
br label %167
153: ; preds = %143
%154 = load %struct.passwd*, %struct.passwd** %11
%155 = getelementptr inbounds %struct.passwd, %struct.passwd* %154, i32 0, i32 1
%156 = load i64, i64* %155
%157 = call i64 @setuid(i64 %156)
%158 = icmp ne i64 %157, 0
br i1 %158, label %159, label %161
159: ; preds = %153
%160 = call i32 @error(i32 111, i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.16, i64 0, i64 0))
store i32 %160, i32* %1
br label %167
161: ; preds = %153
%162 = load i8*, i8** %4
%163 = getelementptr inbounds [2 x i8*], [2 x i8*]* %7, i64 0, i64 0
store i8* %162, i8** %163
%164 = getelementptr inbounds [2 x i8*], [2 x i8*]* %7, i64 0, i64 1
store i8* null, i8** %164
%165 = getelementptr inbounds [2 x i8*], [2 x i8*]* %7, i64 0, i64 0
%166 = call i32 @execv(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.17, i64 0, i64 0), i8** %165)
store i32 0, i32* %1
br label %167
167: ; preds = %161, %159, %151, %141, %133, %124, %111, %102, %96, %82, %71, %61, %54, %48, %40, %32, %25, %17
%168 = load i32, i32* %1
ret i32 %168
}

LLVM IR (-O2):
%struct.stat = type { i32, i64 }
%struct.passwd = type { i8*, i64 }
%struct.group = type { i32 }
@.str = [12 x i8] c"SCRIPT_NAME\00"
@.str.1 = [23 x i8] c"SCRIPT_NAME undefined.\00"
@.str.2 = [16 x i8] c"SCRIPT_FILENAME\00"
@.str.3 = [27 x i8] c"SCRIPT_FILENAME undefined.\00"
@.str.4 = [23 x i8] c"SCRIPT_NAME malformed.\00"
@.str.5 = [18 x i8] c"Script not found.\00"
@.str.6 = [30 x i8] c"Script is not a regular file.\00"
@.str.7 = [22 x i8] c"Bad user name or URL.\00"
@.str.8 = [15 x i8] c"Bad user name.\00"
@.str.9 = [16 x i8] c"User not found.\00"
@.str.10 = [6 x i8] c"suphp\00"
@.str.11 = [21 x i8] c"Missing suphp group.\00"
@.str.12 = [33 x i8] c"User not allowed to use scripts.\00"
@.str.13 = [26 x i8] c"Invalid script directory.\00"
@.str.14 = [15 x i8] c"Unsafe script.\00"
@S_IRUSR = global i32 0
@.str.15 = [21 x i8] c"Can not read script.\00"
@S_IWGRP = global i32 0
@S_IWOTH = global i32 0
@.str.16 = [23 x i8] c"User switching failed.\00"
@.str.17 = [17 x i8] c"/usr/bin/php-cgi\00"
define i32 @main() {
%1 = alloca [1025 x i8]
%2 = alloca [2 x i8*]
%3 = alloca %struct.stat
%4 = getelementptr inbounds [1025 x i8], [1025 x i8]* %1, i64 0, i64 0
%5 = bitcast [2 x i8*]* %2 to i8*
%6 = bitcast %struct.stat* %3 to i8*
%7 = tail call i8* @getenv(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str, i64 0, i64 0))
%8 = icmp eq i8* %7, null
br i1 %8, label %9, label %11
9: ; preds = %0
%10 = tail call i32 @error(i32 50, i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.1, i64 0, i64 0))
br label %120
11: ; preds = %0
%12 = tail call i32 @strlen(i8* %7)
%13 = tail call i8* @getenv(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.2, i64 0, i64 0))
%14 = icmp eq i8* %13, null
br i1 %14, label %15, label %17
15: ; preds = %11
%16 = tail call i32 @error(i32 54, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.3, i64 0, i64 0))
br label %120
17: ; preds = %11
%18 = tail call i32 @strlen(i8* %13)
%19 = icmp slt i32 %12, 5
br i1 %19, label %20, label %22
20: ; preds = %17
%21 = tail call i32 @error(i32 58, i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.4, i64 0, i64 0))
br label %120
22: ; preds = %17
%23 = load i8, i8* %7
%24 = icmp eq i8 %23, 47
br i1 %24, label %27, label %25
25: ; preds = %22
%26 = tail call i32 @error(i32 59, i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.4, i64 0, i64 0))
br label %120
27: ; preds = %22
%28 = getelementptr inbounds i8, i8* %7, i64 1
%29 = load i8, i8* %28
%30 = icmp eq i8 %29, 126
br i1 %30, label %33, label %31
31: ; preds = %27
%32 = tail call i32 @error(i32 60, i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.4, i64 0, i64 0))
br label %120
33: ; preds = %27
%34 = call i64 @stat(i8* %13, %struct.stat* %3)
%35 = icmp eq i64 %34, 0
br i1 %35, label %38, label %36
36: ; preds = %33
%37 = call i32 @error(i32 63, i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.5, i64 0, i64 0))
br label %120
38: ; preds = %33
%39 = getelementptr inbounds %struct.stat, %struct.stat* %3, i64 0, i32 0
%40 = load i32, i32* %39
%41 = call i32 @S_ISREG(i32 %40)
%42 = icmp eq i32 %41, 0
br i1 %42, label %43, label %45
43: ; preds = %38
%44 = call i32 @error(i32 67, i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.6, i64 0, i64 0))
br label %120
45: ; preds = %38
%46 = getelementptr inbounds i8, i8* %7, i64 2
%47 = call i8* @strchr(i8* %46, i8 signext 47)
%48 = icmp eq i8* %47, null
br i1 %48, label %49, label %51
49: ; preds = %45
%50 = call i32 @error(i32 72, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.7, i64 0, i64 0))
br label %120
51: ; preds = %45
%52 = ptrtoint i8* %47 to i64
%53 = ptrtoint i8* %46 to i64
%54 = sub i64 %52, %53
%55 = trunc i64 %54 to i32
%56 = icmp sgt i32 %55, 1024
br i1 %56, label %57, label %59
57: ; preds = %51
%58 = call i32 @error(i32 76, i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.8, i64 0, i64 0))
br label %120
59: ; preds = %51
%60 = call i32 @strncpy(i8* %4, i8* %46, i32 %55)
%61 = shl i64 %54, 32
%62 = ashr exact i64 %61, 32
%63 = getelementptr inbounds [1025 x i8], [1025 x i8]* %1, i64 0, i64 %62
store i8 0, i8* %63
%64 = call %struct.passwd* @getpwnam(i8* %4)
%65 = icmp eq %struct.passwd* %64, null
br i1 %65, label %66, label %68
66: ; preds = %59
%67 = call i32 @error(i32 83, i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.9, i64 0, i64 0))
br label %120
68: ; preds = %59
%69 = call %struct.group* @getgrnam(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.10, i64 0, i64 0))
%70 = icmp eq %struct.group* %69, null
br i1 %70, label %71, label %73
71: ; preds = %68
%72 = call i32 @error(i32 87, i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.11, i64 0, i64 0))
br label %120
73: ; preds = %68
%74 = getelementptr inbounds %struct.group, %struct.group* %69, i64 0, i32 0
%75 = load i32, i32* %74
%76 = call i32 @isUserInGroup(i8* %4, i32 %75)
%77 = icmp eq i32 %76, 0
br i1 %77, label %78, label %80
78: ; preds = %73
%79 = call i32 @error(i32 91, i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.12, i64 0, i64 0))
br label %120
80: ; preds = %73
%81 = getelementptr inbounds %struct.passwd, %struct.passwd* %64, i64 0, i32 0
%82 = load i8*, i8** %81
%83 = call i32 @strlen(i8* %82)
%84 = call i64 @strncmp(i8* %13, i8* %82, i32 %83)
%85 = icmp eq i64 %84, 0
br i1 %85, label %88, label %86
86: ; preds = %80
%87 = call i32 @error(i32 95, i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.13, i64 0, i64 0))
br label %120
88: ; preds = %80
%89 = getelementptr inbounds %struct.passwd, %struct.passwd* %64, i64 0, i32 1
%90 = load i64, i64* %89
%91 = getelementptr inbounds %struct.stat, %struct.stat* %3, i64 0, i32 1
%92 = load i64, i64* %91
%93 = icmp eq i64 %90, %92
br i1 %93, label %96, label %94
94: ; preds = %88
%95 = call i32 @error(i32 99, i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.14, i64 0, i64 0))
br label %120
96: ; preds = %88
%97 = load i32, i32* %39
%98 = load i32, i32* @S_IRUSR
%99 = and i32 %98, %97
%100 = icmp eq i32 %99, 0
br i1 %100, label %101, label %103
101: ; preds = %96
%102 = call i32 @error(i32 103, i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.15, i64 0, i64 0))
br label %120
103: ; preds = %96
%104 = load i32, i32* @S_IWGRP
%105 = load i32, i32* @S_IWOTH
%106 = or i32 %105, %104
%107 = and i32 %106, %97
%108 = icmp eq i32 %107, 0
br i1 %108, label %111, label %109
109: ; preds = %103
%110 = call i32 @error(i32 107, i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.14, i64 0, i64 0))
br label %120
111: ; preds = %103
%112 = call i64 @setuid(i64 %90)
%113 = icmp eq i64 %112, 0
br i1 %113, label %116, label %114
114: ; preds = %111
%115 = call i32 @error(i32 111, i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.16, i64 0, i64 0))
br label %120
116: ; preds = %111
%117 = getelementptr inbounds [2 x i8*], [2 x i8*]* %2, i64 0, i64 0
store i8* %13, i8** %117
%118 = getelementptr inbounds [2 x i8*], [2 x i8*]* %2, i64 0, i64 1
store i8* null, i8** %118
%119 = call i32 @execv(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.17, i64 0, i64 0), i8** %117)
br label %120
120: ; preds = %116, %114, %109, %101, %94, %86, %78, %71, %66, %57, %49, %43, %36, %31, %25, %20, %15, %9
%121 = phi i32 [ %21, %20 ], [ %26, %25 ], [ %32, %31 ], [ %37, %36 ], [ %58, %57 ], [ %87, %86 ], [ %95, %94 ], [ %110, %109 ], [ %115, %114 ], [ 0, %116 ], [ %102, %101 ], [ %79, %78 ], [ %72, %71 ], [ %67, %66 ], [ %50, %49 ], [ %44, %43 ], [ %16, %15 ], [ %10, %9 ]
ret i32 %121
}