#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef scalar_t__ pid_t;
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
char *MAP_FAILED;
int /*<<< orphan*/ MAP_SHARED;
int PROT_READ;
int PROT_WRITE;
int /*<<< orphan*/ _SC_PAGESIZE;
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ errno;
int /*<<< orphan*/ error(int, int /*<<< orphan*/, char *);
int /*<<< orphan*/ fclose(int /*<<< orphan*/ *);
int fileno(int /*<<< orphan*/ *);
scalar_t__ fork();
scalar_t__ ftruncate(int, size_t);
char *mmap(int /*<<< orphan*/ *, size_t, int, int /*<<< orphan*/, int,
           int /*<<< orphan*/);
scalar_t__ open(char *, int /*<<< orphan*/);
int /*<<< orphan*/ strcpy(char *, char *);
size_t sysconf(int /*<<< orphan*/);
int /*<<< orphan*/ *tmpfile();
int main(void) {
  FILE *fp = tmpfile();
  if (!fp)
    error(1, errno, "tmpfile");
  int fd = fileno(fp);
  size_t size = sysconf(_SC_PAGESIZE);
  if (ftruncate(fd, size))
    error(1, errno, "ftruncate");
  char *p = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
  if (p == MAP_FAILED)
    error(1, errno, "mmap");
  fclose(fp);
  fp = NULL;
  fd = -1;
  strcpy(p, "/etc/shadow");
  if (open(p, 0) >= 0)
    error(1, 0, p);
  pid_t pid = fork();
  if (pid < 0)
    error(1, errno, "fork");
  if (!pid) {
    for (;;) {
      strcpy(p, "/etc/passwd");
      strcpy(p, "/etc/shadow");
    }
  } else {
    for (;;) {
      if ((fd = open(p, 0)) >= 0)
        close(fd);
    }
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0x0,%al
call   1080 <tmpfile@plt>
mov    %rax,-0x10(%rbp)
cmpq   $0x0,-0x10(%rbp)
jne    11ef <main+0x3f>
mov    0x2dec(%rip),%rax
mov    (%rax),%esi
mov    $0x1,%edi
lea    0xe16(%rip),%rdx
call   10a0 <error@plt>
mov    -0x10(%rbp),%rdi
call   1090 <fileno@plt>
mov    %eax,-0x14(%rbp)
mov    0x2dd6(%rip),%rax
mov    (%rax),%edi
call   10c0 <sysconf@plt>
mov    %rax,-0x20(%rbp)
mov    -0x14(%rbp),%edi
mov    -0x20(%rbp),%rsi
call   1060 <ftruncate@plt>
cmp    $0x0,%rax
je     123d <main+0x8d>
mov    0x2d9e(%rip),%rax
mov    (%rax),%esi
mov    $0x1,%edi
lea    0xdd0(%rip),%rdx
call   10a0 <error@plt>
mov    -0x20(%rbp),%rsi
mov    0x2db0(%rip),%rax
mov    (%rax),%edx
mov    0x2d6f(%rip),%rax
or     (%rax),%edx
mov    0x2d8e(%rip),%rax
mov    (%rax),%ecx
mov    -0x14(%rbp),%r8d
xor    %eax,%eax
mov    %eax,%edi
xor    %r9d,%r9d
call   1050 <mmap@plt>
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
mov    0x2d3d(%rip),%rcx
cmp    (%rcx),%rax
jne    129e <main+0xee>
mov    0x2d3d(%rip),%rax
mov    (%rax),%esi
mov    $0x1,%edi
lea    0xd79(%rip),%rdx
call   10a0 <error@plt>
mov    -0x10(%rbp),%rdi
call   1040 <fclose@plt>
movq   $0x0,-0x10(%rbp)
movl   $0xffffffff,-0x14(%rbp)
mov    -0x28(%rbp),%rdi
lea    0xd56(%rip),%rsi
call   1030 <strcpy@plt>
mov    -0x28(%rbp),%rdi
xor    %esi,%esi
call   10b0 <open@plt>
cmp    $0x0,%rax
jl     12eb <main+0x13b>
mov    -0x28(%rbp),%rdx
mov    $0x1,%edi
xor    %esi,%esi
call   10a0 <error@plt>
mov    $0x0,%al
call   10d0 <fork@plt>
mov    %rax,-0x30(%rbp)
cmpq   $0x0,-0x30(%rbp)
jge    131b <main+0x16b>
mov    0x2cc0(%rip),%rax
mov    (%rax),%esi
mov    $0x1,%edi
lea    0xd0d(%rip),%rdx
call   10a0 <error@plt>
cmpq   $0x0,-0x30(%rbp)
jne    1350 <main+0x1a0>
jmp    132b <main+0x17b>
mov    -0x28(%rbp),%rdi
lea    0xcf2(%rip),%rsi
call   1030 <strcpy@plt>
mov    -0x28(%rbp),%rdi
lea    0xcd1(%rip),%rsi
call   1030 <strcpy@plt>
jmp    132b <main+0x17b>
jmp    1355 <main+0x1a5>
mov    -0x28(%rbp),%rdi
xor    %esi,%esi
call   10b0 <open@plt>
mov    %eax,-0x14(%rbp)
cmp    $0x0,%eax
jl     1374 <main+0x1c4>
mov    -0x14(%rbp),%edi
call   1070 <close@plt>
jmp    1355 <main+0x1a5>

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r14
push   %rbx
xor    %eax,%eax
call   1080 <tmpfile@plt>
mov    %rax,%r14
test   %rax,%rax
jne    11dd <main+0x2d>
mov    0x2dfe(%rip),%rax
mov    (%rax),%esi
lea    0xe2d(%rip),%rdx
mov    $0x1,%edi
call   10a0 <error@plt>
mov    %r14,%rdi
call   1090 <fileno@plt>
mov    %eax,%ebp
mov    0x2dea(%rip),%rax
mov    (%rax),%edi
call   10c0 <sysconf@plt>
mov    %rax,%rbx
mov    %ebp,%edi
mov    %rax,%rsi
call   1060 <ftruncate@plt>
test   %rax,%rax
je     1221 <main+0x71>
mov    0x2dba(%rip),%rax
mov    (%rax),%esi
lea    0xdf1(%rip),%rdx
mov    $0x1,%edi
call   10a0 <error@plt>
mov    0x2dd0(%rip),%rax
mov    0x2d91(%rip),%rcx
mov    (%rcx),%edx
or     (%rax),%edx
mov    0x2dae(%rip),%rax
mov    (%rax),%ecx
xor    %edi,%edi
mov    %rbx,%rsi
mov    %ebp,%r8d
xor    %r9d,%r9d
call   1050 <mmap@plt>
mov    %rax,%rbx
mov    0x2d62(%rip),%rax
cmp    (%rax),%rbx
jne    1275 <main+0xc5>
mov    0x2d66(%rip),%rax
mov    (%rax),%esi
lea    0xda7(%rip),%rdx
mov    $0x1,%edi
call   10a0 <error@plt>
mov    %r14,%rdi
call   1040 <fclose@plt>
lea    0xd93(%rip),%rsi
mov    %rbx,%rdi
call   1030 <strcpy@plt>
mov    %rbx,%rdi
xor    %esi,%esi
call   10b0 <open@plt>
test   %rax,%rax
js     12aa <main+0xfa>
mov    $0x1,%edi
xor    %esi,%esi
mov    %rbx,%rdx
call   10a0 <error@plt>
xor    %eax,%eax
call   10d0 <fork@plt>
test   %rax,%rax
js     12e8 <main+0x138>
jne    1310 <main+0x160>
lea    0xd69(%rip),%r14
lea    0xd51(%rip),%rbp
cs nopw 0x0(%rax,%rax,1)
mov    %rbx,%rdi
mov    %r14,%rsi
call   1030 <strcpy@plt>
mov    %rbx,%rdi
mov    %rbp,%rsi
call   1030 <strcpy@plt>
jmp    12d0 <main+0x120>
mov    0x2cd9(%rip),%rax
mov    (%rax),%esi
lea    0xd2b(%rip),%rdx
mov    $0x1,%edi
call   10a0 <error@plt>
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax)
mov    %rbx,%rdi
xor    %esi,%esi
call   10b0 <open@plt>
test   %eax,%eax
js     1310 <main+0x160>
mov    %eax,%edi
call   1070 <close@plt>
jmp    1310 <main+0x160>

LLVM IR (-O0):
@errno = global i32 0
@.str = [8 x i8] c"tmpfile\00"
@_SC_PAGESIZE = global i32 0
@.str.1 = [10 x i8] c"ftruncate\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_SHARED = global i32 0
@MAP_FAILED = global i8* null
@.str.2 = [5 x i8] c"mmap\00"
@.str.3 = [12 x i8] c"/etc/shadow\00"
@.str.4 = [5 x i8] c"fork\00"
@.str.5 = [12 x i8] c"/etc/passwd\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i32*
%3 = alloca i32
%4 = alloca i64
%5 = alloca i8*
%6 = alloca i64
store i32 0, i32* %1
%7 = call i32* (...) @tmpfile()
store i32* %7, i32** %2
%8 = load i32*, i32** %2
%9 = icmp ne i32* %8, null
br i1 %9, label %13, label %10
10: ; preds = %0
%11 = load i32, i32* @errno
%12 = call i32 @error(i32 1, i32 %11, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0))
br label %13
13: ; preds = %10, %0
%14 = load i32*, i32** %2
%15 = call i32 @fileno(i32* %14)
store i32 %15, i32* %3
%16 = load i32, i32* @_SC_PAGESIZE
%17 = call i64 @sysconf(i32 %16)
store i64 %17, i64* %4
%18 = load i32, i32* %3
%19 = load i64, i64* %4
%20 = call i64 @ftruncate(i32 %18, i64 %19)
%21 = icmp ne i64 %20, 0
br i1 %21, label %22, label %25
22: ; preds = %13
%23 = load i32, i32* @errno
%24 = call i32 @error(i32 1, i32 %23, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0))
br label %25
25: ; preds = %22, %13
%26 = load i64, i64* %4
%27 = load i32, i32* @PROT_READ
%28 = load i32, i32* @PROT_WRITE
%29 = or i32 %27, %28
%30 = load i32, i32* @MAP_SHARED
%31 = load i32, i32* %3
%32 = call i8* @mmap(i32* null, i64 %26, i32 %29, i32 %30, i32 %31, i32 0)
store i8* %32, i8** %5
%33 = load i8*, i8** %5
%34 = load i8*, i8** @MAP_FAILED
%35 = icmp eq i8* %33, %34
br i1 %35, label %36, label %39
36: ; preds = %25
%37 = load i32, i32* @errno
%38 = call i32 @error(i32 1, i32 %37, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.2, i64 0, i64 0))
br label %39
39: ; preds = %36, %25
%40 = load i32*, i32** %2
%41 = call i32 @fclose(i32* %40)
store i32* null, i32** %2
store i32 -1, i32* %3
%42 = load i8*, i8** %5
%43 = call i32 @strcpy(i8* %42, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.3, i64 0, i64 0))
%44 = load i8*, i8** %5
%45 = call i64 @open(i8* %44, i32 0)
%46 = icmp sge i64 %45, 0
br i1 %46, label %47, label %50
47: ; preds = %39
%48 = load i8*, i8** %5
%49 = call i32 @error(i32 1, i32 0, i8* %48)
br label %50
50: ; preds = %47, %39
%51 = call i64 (...) @fork()
store i64 %51, i64* %6
%52 = load i64, i64* %6
%53 = icmp slt i64 %52, 0
br i1 %53, label %54, label %57
54: ; preds = %50
%55 = load i32, i32* @errno
%56 = call i32 @error(i32 1, i32 %55, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.4, i64 0, i64 0))
br label %57
57: ; preds = %54, %50
%58 = load i64, i64* %6
%59 = icmp ne i64 %58, 0
br i1 %59, label %66, label %60
60: ; preds = %57
br label %61
61: ; preds = %61, %60
%62 = load i8*, i8** %5
%63 = call i32 @strcpy(i8* %62, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.5, i64 0, i64 0))
%64 = load i8*, i8** %5
%65 = call i32 @strcpy(i8* %64, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.3, i64 0, i64 0))
br label %61
66: ; preds = %57
br label %67
67: ; preds = %75, %66
%68 = load i8*, i8** %5
%69 = call i64 @open(i8* %68, i32 0)
%70 = trunc i64 %69 to i32
store i32 %70, i32* %3
%71 = icmp sge i32 %70, 0
br i1 %71, label %72, label %75
72: ; preds = %67
%73 = load i32, i32* %3
%74 = call i32 @close(i32 %73)
br label %75
75: ; preds = %72, %67
br label %67
}

LLVM IR (-O2):
@errno = global i32 0
@.str = [8 x i8] c"tmpfile\00"
@_SC_PAGESIZE = global i32 0
@.str.1 = [10 x i8] c"ftruncate\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_SHARED = global i32 0
@MAP_FAILED = global i8* null
@.str.2 = [5 x i8] c"mmap\00"
@.str.3 = [12 x i8] c"/etc/shadow\00"
@.str.4 = [5 x i8] c"fork\00"
@.str.5 = [12 x i8] c"/etc/passwd\00"
define i32 @main() {
%1 = tail call i32* (...) @tmpfile()
%2 = icmp eq i32* %1, null
br i1 %2, label %3, label %6
3: ; preds = %0
%4 = load i32, i32* @errno
%5 = tail call i32 @error(i32 1, i32 %4, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0))
br label %6
6: ; preds = %3, %0
%7 = tail call i32 @fileno(i32* %1)
%8 = load i32, i32* @_SC_PAGESIZE
%9 = tail call i64 @sysconf(i32 %8)
%10 = tail call i64 @ftruncate(i32 %7, i64 %9)
%11 = icmp eq i64 %10, 0
br i1 %11, label %15, label %12
12: ; preds = %6
%13 = load i32, i32* @errno
%14 = tail call i32 @error(i32 1, i32 %13, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0))
br label %15
15: ; preds = %12, %6
%16 = load i32, i32* @PROT_READ
%17 = load i32, i32* @PROT_WRITE
%18 = or i32 %17, %16
%19 = load i32, i32* @MAP_SHARED
%20 = tail call i8* @mmap(i32* null, i64 %9, i32 %18, i32 %19, i32 %7, i32 0)
%21 = load i8*, i8** @MAP_FAILED
%22 = icmp eq i8* %20, %21
br i1 %22, label %23, label %26
23: ; preds = %15
%24 = load i32, i32* @errno
%25 = tail call i32 @error(i32 1, i32 %24, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.2, i64 0, i64 0))
br label %26
26: ; preds = %23, %15
%27 = tail call i32 @fclose(i32* %1)
%28 = tail call i32 @strcpy(i8* %20, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.3, i64 0, i64 0))
%29 = tail call i64 @open(i8* %20, i32 0)
%30 = icmp sgt i64 %29, -1
br i1 %30, label %31, label %33
31: ; preds = %26
%32 = tail call i32 @error(i32 1, i32 0, i8* %20)
br label %33
33: ; preds = %31, %26
%34 = tail call i64 (...) @fork()
%35 = icmp slt i64 %34, 0
br i1 %35, label %36, label %39
36: ; preds = %33
%37 = load i32, i32* @errno
%38 = tail call i32 @error(i32 1, i32 %37, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.4, i64 0, i64 0))
br label %41
39: ; preds = %33
%40 = icmp eq i64 %34, 0
br i1 %40, label %42, label %41
41: ; preds = %36, %39
br label %45
42: ; preds = %39, %42
%43 = tail call i32 @strcpy(i8* %20, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.5, i64 0, i64 0))
%44 = tail call i32 @strcpy(i8* %20, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.3, i64 0, i64 0))
br label %42
45: ; preds = %51, %41
%46 = tail call i64 @open(i8* %20, i32 0)
%47 = trunc i64 %46 to i32
%48 = icmp sgt i32 %47, -1
br i1 %48, label %49, label %51
49: ; preds = %45
%50 = tail call i32 @close(i32 %47)
br label %51
51: ; preds = %49, %45
br label %45
}