#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ outdir;
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
scalar_t__ WEXITSTATUS(int);
scalar_t__ getpid();
int /*<<< orphan*/ printf(char *, char *);
int /*<<< orphan*/ puts(char *);
int readlink(char *, char *, int);
int /*<<< orphan*/ sprintf(char *, char *, ...);
int strlen(char *);
int symlink(char *, char *);
int system(char *);
int main(void) {
  char fdpath[256], outdir[256], cmdline[256];
  char *p;
  FILE *fp;
  int status;
  int len;
  sprintf(fdpath, "/proc/%d/fd/1", (int)getpid());
  len = readlink(fdpath, outdir, sizeof(outdir) - 1);
  if (len == -1) {
    puts("failed in readlink(2)");
    return 1;
  }
  outdir[len] = '\0';
  printf("stdout: %s\n", outdir);
  p = outdir + strlen(outdir);
  while (*p != '/')
    p--;
  *p = '\0';
  sprintf(cmdline, "rm -r \"%s\"", outdir);
  printf("executing %s\n", cmdline);
  status = system(cmdline);
  if (WEXITSTATUS(status) != 0) {
    printf("cannot delete %s.\n", outdir);
    return 1;
  }
  if (symlink("/etc", outdir) == -1) {
    puts("failed in symlink(2)");
    return 1;
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x340,%rsp
movl   $0x0,-0x4(%rbp)
lea    -0x110(%rbp),%rax
mov    %rax,-0x330(%rbp)
mov    $0x0,%al
call   1050 <getpid@plt>
mov    -0x330(%rbp),%rdi
mov    %eax,%edx
lea    0xe39(%rip),%rsi
mov    $0x0,%al
call   10b0 <sprintf@plt>
lea    -0x110(%rbp),%rdi
lea    -0x210(%rbp),%rsi
mov    $0xff,%edx
call   1040 <readlink@plt>
mov    %eax,-0x328(%rbp)
cmpl   $0xffffffff,-0x328(%rbp)
jne    1211 <main+0x81>
lea    0xe0e(%rip),%rdi
call   1030 <puts@plt>
movl   $0x1,-0x4(%rbp)
jmp    1347 <main+0x1b7>
movslq -0x328(%rbp),%rax
movb   $0x0,-0x210(%rbp,%rax,1)
lea    -0x210(%rbp),%rsi
lea    0xdf6(%rip),%rdi
call   1080 <printf@plt>
lea    -0x210(%rbp),%rax
mov    %rax,-0x338(%rbp)
lea    -0x210(%rbp),%rdi
call   1060 <strlen@plt>
mov    %eax,%ecx
mov    -0x338(%rbp),%rax
movslq %ecx,%rcx
add    %rcx,%rax
mov    %rax,-0x318(%rbp)
mov    -0x318(%rbp),%rax
movsbl (%rax),%eax
cmp    $0x2f,%eax
je     128d <main+0xfd>
mov    -0x318(%rbp),%rax
add    $0xffffffffffffffff,%rax
mov    %rax,-0x318(%rbp)
jmp    1263 <main+0xd3>
mov    -0x318(%rbp),%rax
movb   $0x0,(%rax)
lea    -0x310(%rbp),%rdi
lea    -0x210(%rbp),%rdx
lea    0xd84(%rip),%rsi
mov    $0x0,%al
call   10b0 <sprintf@plt>
lea    -0x310(%rbp),%rsi
lea    0xd7a(%rip),%rdi
call   1080 <printf@plt>
lea    -0x310(%rbp),%rdi
call   1070 <system@plt>
mov    %eax,-0x324(%rbp)
mov    -0x324(%rbp),%edi
call   10a0 <WEXITSTATUS@plt>
cmp    $0x0,%rax
je     130c <main+0x17c>
lea    -0x210(%rbp),%rsi
lea    0xd4e(%rip),%rdi
call   1080 <printf@plt>
movl   $0x1,-0x4(%rbp)
jmp    1347 <main+0x1b7>
lea    -0x210(%rbp),%rsi
lea    0xd42(%rip),%rdi
call   1090 <symlink@plt>
cmp    $0xffffffff,%eax
jne    1340 <main+0x1b0>
lea    0xd32(%rip),%rdi
call   1030 <puts@plt>
movl   $0x1,-0x4(%rbp)
jmp    1347 <main+0x1b7>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x340,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r14
push   %rbx
sub    $0x308,%rsp
xor    %eax,%eax
call   1050 <getpid@plt>
lea    0xe58(%rip),%rsi
lea    0x200(%rsp),%rbx
mov    %rbx,%rdi
mov    %eax,%edx
xor    %eax,%eax
call   10b0 <sprintf@plt>
mov    %rsp,%r14
mov    %rbx,%rdi
mov    %r14,%rsi
mov    $0xff,%edx
call   1040 <readlink@plt>
cmp    $0xffffffff,%eax
je     125f <main+0xcf>
cltq
movb   $0x0,(%rsp,%rax,1)
lea    0xe3f(%rip),%rdi
mov    %r14,%rsi
call   1080 <printf@plt>
mov    %r14,%rdi
call   1060 <strlen@plt>
cltq
add    %r14,%rax
add    $0x1,%rax
xchg   %ax,%ax
cmpb   $0x2f,-0x1(%rax)
lea    -0x1(%rax),%rax
jne    1200 <main+0x70>
movb   $0x0,(%rax)
lea    0xe1c(%rip),%rsi
xor    %ebx,%ebx
lea    0x100(%rsp),%r14
mov    %rsp,%rdx
mov    %r14,%rdi
xor    %eax,%eax
call   10b0 <sprintf@plt>
lea    0xe09(%rip),%rdi
mov    %r14,%rsi
call   1080 <printf@plt>
mov    %r14,%rdi
call   1070 <system@plt>
mov    %eax,%edi
call   10a0 <WEXITSTATUS@plt>
test   %rax,%rax
je     1268 <main+0xd8>
lea    0xdf4(%rip),%rdi
mov    %rsp,%rsi
call   1080 <printf@plt>
jmp    1288 <main+0xf8>
lea    0xda8(%rip),%rdi
jmp    1283 <main+0xf3>
lea    0xded(%rip),%rdi
mov    %rsp,%rsi
call   1090 <symlink@plt>
cmp    $0xffffffff,%eax
jne    128d <main+0xfd>
lea    0xdde(%rip),%rdi
call   1030 <puts@plt>
mov    $0x1,%ebx
mov    %ebx,%eax
add    $0x308,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
@.str = [14 x i8] c"/proc/%d/fd/1\00"
@.str.1 = [22 x i8] c"failed in readlink(2)\00"
@.str.2 = [12 x i8] c"stdout: %s\0A\00"
@.str.3 = [11 x i8] c"rm -r \22%s\22\00"
@.str.4 = [14 x i8] c"executing %s\0A\00"
@.str.5 = [19 x i8] c"cannot delete %s.\0A\00"
@.str.6 = [5 x i8] c"/etc\00"
@.str.7 = [21 x i8] c"failed in symlink(2)\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca [256 x i8]
%3 = alloca [256 x i8]
%4 = alloca [256 x i8]
%5 = alloca i8*
%6 = alloca i32*
%7 = alloca i32
%8 = alloca i32
store i32 0, i32* %1
%9 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 0
%10 = call i64 (...) @getpid()
%11 = trunc i64 %10 to i32
%12 = call i32 (i8*, i8*, ...) @sprintf(i8* %9, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str, i64 0, i64 0), i32 %11)
%13 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 0
%14 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%15 = call i32 @readlink(i8* %13, i8* %14, i32 255)
store i32 %15, i32* %8
%16 = load i32, i32* %8
%17 = icmp eq i32 %16, -1
br i1 %17, label %18, label %20
18: ; preds = %0
%19 = call i32 @puts(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.1, i64 0, i64 0))
store i32 1, i32* %1
br label %61
20: ; preds = %0
%21 = load i32, i32* %8
%22 = sext i32 %21 to i64
%23 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 %22
store i8 0, i8* %23
%24 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%25 = call i32 @printf(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.2, i64 0, i64 0), i8* %24)
%26 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%27 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%28 = call i32 @strlen(i8* %27)
%29 = sext i32 %28 to i64
%30 = getelementptr inbounds i8, i8* %26, i64 %29
store i8* %30, i8** %5
br label %31
31: ; preds = %36, %20
%32 = load i8*, i8** %5
%33 = load i8, i8* %32
%34 = sext i8 %33 to i32
%35 = icmp ne i32 %34, 47
br i1 %35, label %36, label %39
36: ; preds = %31
%37 = load i8*, i8** %5
%38 = getelementptr inbounds i8, i8* %37, i32 -1
store i8* %38, i8** %5
br label %31
39: ; preds = %31
%40 = load i8*, i8** %5
store i8 0, i8* %40
%41 = getelementptr inbounds [256 x i8], [256 x i8]* %4, i64 0, i64 0
%42 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%43 = call i32 (i8*, i8*, ...) @sprintf(i8* %41, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.3, i64 0, i64 0), i8* %42)
%44 = getelementptr inbounds [256 x i8], [256 x i8]* %4, i64 0, i64 0
%45 = call i32 @printf(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.4, i64 0, i64 0), i8* %44)
%46 = getelementptr inbounds [256 x i8], [256 x i8]* %4, i64 0, i64 0
%47 = call i32 @system(i8* %46)
store i32 %47, i32* %7
%48 = load i32, i32* %7
%49 = call i64 @WEXITSTATUS(i32 %48)
%50 = icmp ne i64 %49, 0
br i1 %50, label %51, label %54
51: ; preds = %39
%52 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%53 = call i32 @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.5, i64 0, i64 0), i8* %52)
store i32 1, i32* %1
br label %61
54: ; preds = %39
%55 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%56 = call i32 @symlink(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.6, i64 0, i64 0), i8* %55)
%57 = icmp eq i32 %56, -1
br i1 %57, label %58, label %60
58: ; preds = %54
%59 = call i32 @puts(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.7, i64 0, i64 0))
store i32 1, i32* %1
br label %61
60: ; preds = %54
store i32 0, i32* %1
br label %61
61: ; preds = %60, %58, %51, %18
%62 = load i32, i32* %1
ret i32 %62
}

LLVM IR (-O2):
@.str = [14 x i8] c"/proc/%d/fd/1\00"
@.str.1 = [22 x i8] c"failed in readlink(2)\00"
@.str.2 = [12 x i8] c"stdout: %s\0A\00"
@.str.3 = [11 x i8] c"rm -r \22%s\22\00"
@.str.4 = [14 x i8] c"executing %s\0A\00"
@.str.5 = [19 x i8] c"cannot delete %s.\0A\00"
@.str.6 = [5 x i8] c"/etc\00"
@.str.7 = [21 x i8] c"failed in symlink(2)\00"
define i32 @main() {
%1 = alloca [256 x i8]
%2 = alloca [256 x i8]
%3 = alloca [256 x i8]
%4 = getelementptr inbounds [256 x i8], [256 x i8]* %1, i64 0, i64 0
%5 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 0
%6 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%7 = tail call i64 (...) @getpid()
%8 = trunc i64 %7 to i32
%9 = call i32 (i8*, i8*, ...) @sprintf(i8* %4, i8* dereferenceable(1) getelementptr inbounds ([14 x i8], [14 x i8]* @.str, i64 0, i64 0), i32 %8)
%10 = call i32 @readlink(i8* %4, i8* %5, i32 255)
%11 = icmp eq i32 %10, -1
br i1 %11, label %12, label %14
12: ; preds = %0
%13 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([22 x i8], [22 x i8]* @.str.1, i64 0, i64 0))
br label %39
14: ; preds = %0
%15 = sext i32 %10 to i64
%16 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 %15
store i8 0, i8* %16
%17 = call i32 @printf(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.2, i64 0, i64 0), i8* %5)
%18 = call i32 @strlen(i8* %5)
%19 = sext i32 %18 to i64
%20 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 %19
br label %21
21: ; preds = %21, %14
%22 = phi i8* [ %20, %14 ], [ %25, %21 ]
%23 = load i8, i8* %22
%24 = icmp eq i8 %23, 47
%25 = getelementptr inbounds i8, i8* %22, i64 -1
br i1 %24, label %26, label %21
26: ; preds = %21
store i8 0, i8* %22
%27 = call i32 (i8*, i8*, ...) @sprintf(i8* %6, i8* dereferenceable(1) getelementptr inbounds ([11 x i8], [11 x i8]* @.str.3, i64 0, i64 0), i8* %5)
%28 = call i32 @printf(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.4, i64 0, i64 0), i8* %6)
%29 = call i32 @system(i8* %6)
%30 = call i64 @WEXITSTATUS(i32 %29)
%31 = icmp eq i64 %30, 0
br i1 %31, label %34, label %32
32: ; preds = %26
%33 = call i32 @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.5, i64 0, i64 0), i8* %5)
br label %39
34: ; preds = %26
%35 = call i32 @symlink(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.6, i64 0, i64 0), i8* %5)
%36 = icmp eq i32 %35, -1
br i1 %36, label %37, label %39
37: ; preds = %34
%38 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([21 x i8], [21 x i8]* @.str.7, i64 0, i64 0))
br label %39
39: ; preds = %34, %37, %32, %12
%40 = phi i32 [ 1, %12 ], [ 1, %32 ], [ 1, %37 ], [ 0, %34 ]
ret i32 %40
}