#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct stat {
  int /*<<< orphan*/ st_mode;
};
typedef scalar_t__ pid_t;
typedef int /*<<< orphan*/ argv;

/* Variables and functions */
int /*<<< orphan*/ S_ISDIR(int /*<<< orphan*/);
int chdir(char *);
int chroot(char *);
int /*<<< orphan*/ err(int, char *, ...);
int /*<<< orphan*/ errx(int, char *, ...);
int execve(char *, char **, char **);
int /*<<< orphan*/ free(char **);
char **malloc(int);
scalar_t__ nsfork(int /*<<< orphan*/);
int stat(char *, struct stat *);
int /*<<< orphan*/ usage(char *);
int /*<<< orphan*/ waitpid(scalar_t__, int *, int /*<<< orphan*/);
int main(int argc, char *argv[]) {
  struct stat sb;
  pid_t child;
  int i, status;
  char *program, *newroot, *command;
  char *newenv[] = {NULL};
  char **newargv;
  if (argc < 3)
    usage(argv[0]);
  program = argv[0];
  newroot = argv[1];
  command = argv[2];
  if (stat(newroot, &sb) == -1)
    err(1, "'%s'", newroot);
  if (!S_ISDIR(sb.st_mode))
    errx(1, "stat(): '%s' is not a directory\n", newroot);
  newargv = malloc(sizeof(argv));
  for (i = 2; i <= argc; i++) {
    newargv[i - 2] = argv[i];
  }
  newargv[i] = "\0";
  child = nsfork(0);
  if (child > 0) {
    waitpid(child, &status, 0);
  } else if (child == 0) {
    if (chdir(newroot) == -1)
      err(1, "chdir to directory '%s' failed", newroot);
    if (chroot(".") == -1)
      err(1, "chroot failed");
    if (stat(command, &sb) == -1)
      err(1, "'%s'", command);
    if (execve(command, newargv, newenv) == -1)
      err(1, "'%s'", command);
  } else {
    errx(1, "error in nsfork(): probably lacking privileges or running on an "
            "old kernel\n");
  }
  free(newargv);
  return (0);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x50,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
lea    -0x48(%rbp),%rdi
xor    %esi,%esi
mov    $0x8,%edx
call   1080 <memset@plt>
cmpl   $0x3,-0x8(%rbp)
jge    120c <main+0x3c>
mov    -0x10(%rbp),%rax
mov    (%rax),%rdi
call   10d0 <usage@plt>
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x30(%rbp)
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rax
mov    %rax,-0x38(%rbp)
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rax
mov    %rax,-0x40(%rbp)
mov    -0x38(%rbp),%rdi
lea    -0x18(%rbp),%rsi
call   10a0 <stat@plt>
cmp    $0xffffffff,%eax
jne    125c <main+0x8c>
mov    -0x38(%rbp),%rdx
mov    $0x1,%edi
lea    0xdab(%rip),%rsi
mov    $0x0,%al
call   10b0 <err@plt>
mov    -0x18(%rbp),%edi
call   1070 <S_ISDIR@plt>
cmp    $0x0,%eax
jne    1284 <main+0xb4>
mov    -0x38(%rbp),%rdx
mov    $0x1,%edi
lea    0xd88(%rip),%rsi
mov    $0x0,%al
call   1060 <errx@plt>
mov    $0x8,%edi
call   10c0 <malloc@plt>
mov    %rax,-0x50(%rbp)
movl   $0x2,-0x24(%rbp)
mov    -0x24(%rbp),%eax
cmp    -0x8(%rbp),%eax
jg     12d0 <main+0x100>
mov    -0x10(%rbp),%rax
movslq -0x24(%rbp),%rcx
mov    (%rax,%rcx,8),%rdx
mov    -0x50(%rbp),%rax
mov    -0x24(%rbp),%ecx
sub    $0x2,%ecx
movslq %ecx,%rcx
mov    %rdx,(%rax,%rcx,8)
mov    -0x24(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x24(%rbp)
jmp    1299 <main+0xc9>
mov    -0x50(%rbp),%rax
movslq -0x24(%rbp),%rcx
lea    0xdc2(%rip),%rdx
mov    %rdx,(%rax,%rcx,8)
xor    %edi,%edi
call   10e0 <nsfork@plt>
mov    %rax,-0x20(%rbp)
cmpq   $0x0,-0x20(%rbp)
jle    130d <main+0x13d>
mov    -0x20(%rbp),%rdi
lea    -0x28(%rbp),%rsi
xor    %edx,%edx
call   10f0 <waitpid@plt>
jmp    13e4 <main+0x214>
cmpq   $0x0,-0x20(%rbp)
jne    13cc <main+0x1fc>
mov    -0x38(%rbp),%rdi
call   1050 <chdir@plt>
cmp    $0xffffffff,%eax
jne    1341 <main+0x171>
mov    -0x38(%rbp),%rdx
mov    $0x1,%edi
lea    0xcec(%rip),%rsi
mov    $0x0,%al
call   10b0 <err@plt>
lea    0xcfd(%rip),%rdi
call   1040 <chroot@plt>
cmp    $0xffffffff,%eax
jne    1369 <main+0x199>
mov    $0x1,%edi
lea    0xce5(%rip),%rsi
mov    $0x0,%al
call   10b0 <err@plt>
mov    -0x40(%rbp),%rdi
lea    -0x18(%rbp),%rsi
call   10a0 <stat@plt>
cmp    $0xffffffff,%eax
jne    1396 <main+0x1c6>
mov    -0x40(%rbp),%rdx
mov    $0x1,%edi
lea    0xc71(%rip),%rsi
mov    $0x0,%al
call   10b0 <err@plt>
mov    -0x40(%rbp),%rdi
mov    -0x50(%rbp),%rsi
lea    -0x48(%rbp),%rdx
call   1090 <execve@plt>
cmp    $0xffffffff,%eax
jne    13c7 <main+0x1f7>
mov    -0x40(%rbp),%rdx
mov    $0x1,%edi
lea    0xc40(%rip),%rsi
mov    $0x0,%al
call   10b0 <err@plt>
jmp    13df <main+0x20f>
mov    $0x1,%edi
lea    0xc7d(%rip),%rsi
mov    $0x0,%al
call   1060 <errx@plt>
jmp    13e4 <main+0x214>
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
xor    %eax,%eax
add    $0x50,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x20,%rsp
mov    %rsi,%rbx
mov    %edi,%r13d
movq   $0x0,0x10(%rsp)
cmp    $0x2,%edi
jg     11f9 <main+0x29>
mov    (%rbx),%rdi
call   10d0 <usage@plt>
mov    0x8(%rbx),%r12
mov    0x10(%rbx),%r14
lea    0x8(%rsp),%rsi
mov    %r12,%rdi
call   1090 <stat@plt>
cmp    $0xffffffff,%eax
jne    1229 <main+0x59>
lea    0xde6(%rip),%rsi
mov    $0x1,%edi
mov    %r12,%rdx
xor    %eax,%eax
call   10b0 <err@plt>
mov    0x8(%rsp),%edi
call   1070 <S_ISDIR@plt>
test   %eax,%eax
jne    124c <main+0x7c>
lea    0xdc8(%rip),%rsi
mov    $0x1,%edi
mov    %r12,%rdx
xor    %eax,%eax
call   1060 <errx@plt>
mov    $0x8,%edi
call   10c0 <malloc@plt>
mov    %rax,%r15
mov    $0x2,%eax
cmp    $0x2,%r13d
jl     1282 <main+0xb2>
add    $0x10,%rbx
lea    -0x1(%r13),%edx
shl    $0x3,%rdx
mov    %r15,%rdi
mov    %rbx,%rsi
call   10a0 <memcpy@plt>
add    $0x1,%r13d
mov    %r13,%rax
lea    0xe18(%rip),%rcx
mov    %rcx,(%r15,%rax,8)
xor    %edi,%edi
call   10e0 <nsfork@plt>
test   %rax,%rax
jle    12ad <main+0xdd>
lea    0x1c(%rsp),%rsi
mov    %rax,%rdi
xor    %edx,%edx
call   10f0 <waitpid@plt>
jmp    1361 <main+0x191>
je     12c7 <main+0xf7>
lea    0xd9f(%rip),%rsi
mov    $0x1,%edi
xor    %eax,%eax
call   1060 <errx@plt>
jmp    1361 <main+0x191>
mov    %r12,%rdi
call   1050 <chdir@plt>
cmp    $0xffffffff,%eax
jne    12ea <main+0x11a>
lea    0xd4b(%rip),%rsi
mov    $0x1,%edi
mov    %r12,%rdx
xor    %eax,%eax
call   10b0 <err@plt>
lea    0xd54(%rip),%rdi
call   1040 <chroot@plt>
cmp    $0xffffffff,%eax
jne    130e <main+0x13e>
lea    0xd45(%rip),%rsi
mov    $0x1,%edi
xor    %eax,%eax
call   10b0 <err@plt>
lea    0x8(%rsp),%rsi
mov    %r14,%rdi
call   1090 <stat@plt>
cmp    $0xffffffff,%eax
jne    1336 <main+0x166>
lea    0xcd9(%rip),%rsi
mov    $0x1,%edi
mov    %r14,%rdx
xor    %eax,%eax
call   10b0 <err@plt>
lea    0x10(%rsp),%rdx
mov    %r14,%rdi
mov    %r15,%rsi
call   1080 <execve@plt>
cmp    $0xffffffff,%eax
jne    1361 <main+0x191>
lea    0xcae(%rip),%rsi
mov    $0x1,%edi
mov    %r14,%rdx
xor    %eax,%eax
call   10b0 <err@plt>
mov    %r15,%rdi
call   1030 <free@plt>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
%struct.stat = type { i32 }
@.str = [5 x i8] c"'%s'\00"
@.str.1 = [33 x i8] c"stat(): '%s' is not a directory\0A\00"
@.str.2 = [2 x i8] zeroinitializer
@.str.3 = [31 x i8] c"chdir to directory '%s' failed\00"
@.str.4 = [2 x i8] c".\00"
@.str.5 = [14 x i8] c"chroot failed\00"
@.str.6 = [76 x i8] c"error in nsfork(): probably lacking privileges or running on an old kernel\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca %struct.stat
%7 = alloca i64
%8 = alloca i32
%9 = alloca i32
%10 = alloca i8*
%11 = alloca i8*
%12 = alloca i8*
%13 = alloca [1 x i8*]
%14 = alloca i8**
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%15 = bitcast [1 x i8*]* %13 to i8*
%16 = load i32, i32* %4
%17 = icmp slt i32 %16, 3
br i1 %17, label %18, label %23
18: ; preds = %2
%19 = load i8**, i8*** %5
%20 = getelementptr inbounds i8*, i8** %19, i64 0
%21 = load i8*, i8** %20
%22 = call i32 @usage(i8* %21)
br label %23
23: ; preds = %18, %2
%24 = load i8**, i8*** %5
%25 = getelementptr inbounds i8*, i8** %24, i64 0
%26 = load i8*, i8** %25
store i8* %26, i8** %10
%27 = load i8**, i8*** %5
%28 = getelementptr inbounds i8*, i8** %27, i64 1
%29 = load i8*, i8** %28
store i8* %29, i8** %11
%30 = load i8**, i8*** %5
%31 = getelementptr inbounds i8*, i8** %30, i64 2
%32 = load i8*, i8** %31
store i8* %32, i8** %12
%33 = load i8*, i8** %11
%34 = call i32 @stat(i8* %33, %struct.stat* %6)
%35 = icmp eq i32 %34, -1
br i1 %35, label %36, label %39
36: ; preds = %23
%37 = load i8*, i8** %11
%38 = call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i8* %37)
br label %39
39: ; preds = %36, %23
%40 = getelementptr inbounds %struct.stat, %struct.stat* %6, i32 0, i32 0
%41 = load i32, i32* %40
%42 = call i32 @S_ISDIR(i32 %41)
%43 = icmp ne i32 %42, 0
br i1 %43, label %47, label %44
44: ; preds = %39
%45 = load i8*, i8** %11
%46 = call i32 (i32, i8*, ...) @errx(i32 1, i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.1, i64 0, i64 0), i8* %45)
br label %47
47: ; preds = %44, %39
%48 = call i8** @malloc(i32 8)
store i8** %48, i8*** %14
store i32 2, i32* %8
br label %49
49: ; preds = %64, %47
%50 = load i32, i32* %8
%51 = load i32, i32* %4
%52 = icmp sle i32 %50, %51
br i1 %52, label %53, label %67
53: ; preds = %49
%54 = load i8**, i8*** %5
%55 = load i32, i32* %8
%56 = sext i32 %55 to i64
%57 = getelementptr inbounds i8*, i8** %54, i64 %56
%58 = load i8*, i8** %57
%59 = load i8**, i8*** %14
%60 = load i32, i32* %8
%61 = sub nsw i32 %60, 2
%62 = sext i32 %61 to i64
%63 = getelementptr inbounds i8*, i8** %59, i64 %62
store i8* %58, i8** %63
br label %64
64: ; preds = %53
%65 = load i32, i32* %8
%66 = add nsw i32 %65, 1
store i32 %66, i32* %8
br label %49
67: ; preds = %49
%68 = load i8**, i8*** %14
%69 = load i32, i32* %8
%70 = sext i32 %69 to i64
%71 = getelementptr inbounds i8*, i8** %68, i64 %70
store i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.2, i64 0, i64 0), i8** %71
%72 = call i64 @nsfork(i32 0)
store i64 %72, i64* %7
%73 = load i64, i64* %7
%74 = icmp sgt i64 %73, 0
br i1 %74, label %75, label %78
75: ; preds = %67
%76 = load i64, i64* %7
%77 = call i32 @waitpid(i64 %76, i32* %9, i32 0)
br label %113
78: ; preds = %67
%79 = load i64, i64* %7
%80 = icmp eq i64 %79, 0
br i1 %80, label %81, label %110
81: ; preds = %78
%82 = load i8*, i8** %11
%83 = call i32 @chdir(i8* %82)
%84 = icmp eq i32 %83, -1
br i1 %84, label %85, label %88
85: ; preds = %81
%86 = load i8*, i8** %11
%87 = call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.3, i64 0, i64 0), i8* %86)
br label %88
88: ; preds = %85, %81
%89 = call i32 @chroot(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.4, i64 0, i64 0))
%90 = icmp eq i32 %89, -1
br i1 %90, label %91, label %93
91: ; preds = %88
%92 = call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.5, i64 0, i64 0))
br label %93
93: ; preds = %91, %88
%94 = load i8*, i8** %12
%95 = call i32 @stat(i8* %94, %struct.stat* %6)
%96 = icmp eq i32 %95, -1
br i1 %96, label %97, label %100
97: ; preds = %93
%98 = load i8*, i8** %12
%99 = call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i8* %98)
br label %100
100: ; preds = %97, %93
%101 = load i8*, i8** %12
%102 = load i8**, i8*** %14
%103 = getelementptr inbounds [1 x i8*], [1 x i8*]* %13, i64 0, i64 0
%104 = call i32 @execve(i8* %101, i8** %102, i8** %103)
%105 = icmp eq i32 %104, -1
br i1 %105, label %106, label %109
106: ; preds = %100
%107 = load i8*, i8** %12
%108 = call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i8* %107)
br label %109
109: ; preds = %106, %100
br label %112
110: ; preds = %78
%111 = call i32 (i32, i8*, ...) @errx(i32 1, i8* getelementptr inbounds ([76 x i8], [76 x i8]* @.str.6, i64 0, i64 0))
br label %112
112: ; preds = %110, %109
br label %113
113: ; preds = %112, %75
%114 = load i8**, i8*** %14
%115 = call i32 @free(i8** %114)
ret i32 0
}

LLVM IR (-O2):
%struct.stat = type { i32 }
@.str = [5 x i8] c"'%s'\00"
@.str.1 = [33 x i8] c"stat(): '%s' is not a directory\0A\00"
@.str.2 = [2 x i8] zeroinitializer
@.str.3 = [31 x i8] c"chdir to directory '%s' failed\00"
@.str.4 = [2 x i8] c".\00"
@.str.5 = [14 x i8] c"chroot failed\00"
@.str.6 = [76 x i8] c"error in nsfork(): probably lacking privileges or running on an old kernel\0A\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca %struct.stat
%4 = alloca i32
%5 = alloca [1 x i8*]
%6 = bitcast %struct.stat* %3 to i8*
%7 = bitcast i32* %4 to i8*
%8 = bitcast [1 x i8*]* %5 to i8*
%9 = bitcast [1 x i8*]* %5 to i64*
store i64 0, i64* %9
%10 = icmp slt i32 %0, 3
br i1 %10, label %11, label %14
11: ; preds = %2
%12 = load i8*, i8** %1
%13 = tail call i32 @usage(i8* %12)
br label %14
14: ; preds = %11, %2
%15 = getelementptr inbounds i8*, i8** %1, i64 1
%16 = load i8*, i8** %15
%17 = getelementptr i8*, i8** %1, i64 2
%18 = load i8*, i8** %17
%19 = call i32 @stat(i8* %16, %struct.stat* %3)
%20 = icmp eq i32 %19, -1
br i1 %20, label %21, label %23
21: ; preds = %14
%22 = tail call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i8* %16)
br label %23
23: ; preds = %21, %14
%24 = getelementptr inbounds %struct.stat, %struct.stat* %3, i64 0, i32 0
%25 = load i32, i32* %24
%26 = tail call i32 @S_ISDIR(i32 %25)
%27 = icmp eq i32 %26, 0
br i1 %27, label %28, label %30
28: ; preds = %23
%29 = tail call i32 (i32, i8*, ...) @errx(i32 1, i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.1, i64 0, i64 0), i8* %16)
br label %30
30: ; preds = %28, %23
%31 = tail call i8** @malloc(i32 8)
%32 = icmp slt i32 %0, 2
br i1 %32, label %41, label %33
33: ; preds = %30
%34 = bitcast i8** %31 to i8*
%35 = bitcast i8** %17 to i8*
%36 = add nsw i32 %0, -1
%37 = zext i32 %36 to i64
%38 = shl nuw nsw i64 %37, 3
%39 = add nuw i32 %0, 1
%40 = zext i32 %39 to i64
br label %41
41: ; preds = %33, %30
%42 = phi i64 [ 2, %30 ], [ %40, %33 ]
%43 = getelementptr inbounds i8*, i8** %31, i64 %42
store i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.2, i64 0, i64 0), i8** %43
%44 = tail call i64 @nsfork(i32 0)
%45 = icmp sgt i64 %44, 0
br i1 %45, label %46, label %48
46: ; preds = %41
%47 = call i32 @waitpid(i64 %44, i32* %4, i32 0)
br label %73
48: ; preds = %41
%49 = icmp eq i64 %44, 0
br i1 %49, label %50, label %71
50: ; preds = %48
%51 = tail call i32 @chdir(i8* %16)
%52 = icmp eq i32 %51, -1
br i1 %52, label %53, label %55
53: ; preds = %50
%54 = tail call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.3, i64 0, i64 0), i8* %16)
br label %55
55: ; preds = %53, %50
%56 = tail call i32 @chroot(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.4, i64 0, i64 0))
%57 = icmp eq i32 %56, -1
br i1 %57, label %58, label %60
58: ; preds = %55
%59 = tail call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.5, i64 0, i64 0))
br label %60
60: ; preds = %58, %55
%61 = call i32 @stat(i8* %18, %struct.stat* %3)
%62 = icmp eq i32 %61, -1
br i1 %62, label %63, label %65
63: ; preds = %60
%64 = tail call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i8* %18)
br label %65
65: ; preds = %63, %60
%66 = getelementptr inbounds [1 x i8*], [1 x i8*]* %5, i64 0, i64 0
%67 = call i32 @execve(i8* %18, i8** %31, i8** %66)
%68 = icmp eq i32 %67, -1
br i1 %68, label %69, label %73
69: ; preds = %65
%70 = call i32 (i32, i8*, ...) @err(i32 1, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i8* %18)
br label %73
71: ; preds = %48
%72 = tail call i32 (i32, i8*, ...) @errx(i32 1, i8* getelementptr inbounds ([76 x i8], [76 x i8]* @.str.6, i64 0, i64 0))
br label %73
73: ; preds = %71, %69, %65, %46
%74 = call i32 @free(i8** %31)
ret i32 0
}