#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
char *getenv(char *);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ sprintf(char *, char *, char *);
int strlen(char *);
char *strsep(char **, char *);
int /*<<< orphan*/ system(char *);
int /*<<< orphan*/ urldecode(char *);
int main(int argc, char *argv[]) {
  char *data = NULL;
  int len, nel;
  char *q, *value, *name;
  char cmd[80];
  char username[80][80];
  printf("%s%c%c\n", "Content-Type:text/html;charset=utf-8", 13, 10);
  printf("<TITLE>Uploading</TITLE>\n");
  data = getenv("QUERY_STRING");
  printf("%s", data);
  urldecode(data);
  printf("%s", data);
  q = data;
  nel = 0;
  len = strlen(data);
  int i = 0;
  if (data == NULL)
    printf("<p>Error!Error in passing data from form to script.");
  else {
    while (strsep(&q, "&"))
      nel++;
    for (q = data; q < (data + len);) {
      value = name = q;
      for (q += strlen(q); q < (data + len) && !*q; q++)
        ;
      name = strsep(&value, "=");
      printf("%s\n", name);
      printf("%s\n", value);
      printf("<br/>");
      sprintf(cmd, "sh upload.sh %s", value);
      printf("%s", cmd);
      system(cmd);
    }
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x19a0,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movq   $0x0,-0x18(%rbp)
lea    0xe68(%rip),%rdi
lea    0xe69(%rip),%rsi
mov    $0xd,%edx
mov    $0xa,%ecx
mov    $0x0,%al
call   1060 <printf@plt>
lea    0xe76(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    0xe82(%rip),%rdi
call   1030 <getenv@plt>
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rsi
lea    0xeca(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    -0x18(%rbp),%rdi
call   1080 <urldecode@plt>
mov    -0x18(%rbp),%rsi
lea    0xeaf(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    -0x18(%rbp),%rax
mov    %rax,-0x28(%rbp)
movl   $0x0,-0x20(%rbp)
mov    -0x18(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,-0x1c(%rbp)
movl   $0x0,-0x1994(%rbp)
cmpq   $0x0,-0x18(%rbp)
jne    123e <main+0xce>
lea    0xe22(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
jmp    1393 <main+0x223>
jmp    1243 <main+0xd3>
lea    -0x28(%rbp),%rdi
lea    0xe3a(%rip),%rsi
call   1070 <strsep@plt>
cmp    $0x0,%rax
je     126b <main+0xfb>
mov    -0x20(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x20(%rbp)
jmp    1243 <main+0xd3>
mov    -0x18(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
mov    -0x18(%rbp),%rcx
movslq -0x1c(%rbp),%rdx
add    %rdx,%rcx
cmp    %rcx,%rax
jae    138e <main+0x21e>
mov    -0x28(%rbp),%rax
mov    %rax,-0x38(%rbp)
mov    %rax,-0x30(%rbp)
mov    -0x28(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,%ecx
mov    -0x28(%rbp),%rax
movslq %ecx,%rcx
add    %rcx,%rax
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rcx
mov    -0x18(%rbp),%rdx
movslq -0x1c(%rbp),%rax
add    %rax,%rdx
xor    %eax,%eax
cmp    %rdx,%rcx
mov    %al,-0x1995(%rbp)
jae    12e2 <main+0x172>
mov    -0x28(%rbp),%rax
cmpb   $0x0,(%rax)
setne  %al
xor    $0xff,%al
mov    %al,-0x1995(%rbp)
mov    -0x1995(%rbp),%al
test   $0x1,%al
jne    12f5 <main+0x185>
jmp    130b <main+0x19b>
jmp    12fa <main+0x18a>
mov    -0x28(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x28(%rbp)
jmp    12b0 <main+0x140>
lea    -0x30(%rbp),%rdi
lea    0xd74(%rip),%rsi
call   1070 <strsep@plt>
mov    %rax,-0x38(%rbp)
mov    -0x38(%rbp),%rsi
lea    0xd62(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    -0x30(%rbp),%rsi
lea    0xd50(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    0xd46(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    -0x90(%rbp),%rdi
mov    -0x30(%rbp),%rdx
lea    0xd33(%rip),%rsi
call   1090 <sprintf@plt>
lea    -0x90(%rbp),%rsi
lea    0xd2d(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    -0x90(%rbp),%rdi
call   1050 <system@plt>
jmp    1273 <main+0x103>
jmp    1393 <main+0x223>
xor    %eax,%eax
add    $0x19a0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x68,%rsp
lea    0xe6b(%rip),%rdi
lea    0xe6c(%rip),%rsi
mov    $0xd,%edx
mov    $0xa,%ecx
xor    %eax,%eax
call   1070 <printf@plt>
lea    0xed4(%rip),%rdi
call   1040 <puts@plt>
lea    0xe6d(%rip),%rdi
call   1030 <getenv@plt>
mov    %rax,%r15
lea    0xeb6(%rip),%rbx
mov    %rbx,%rdi
mov    %rax,%rsi
xor    %eax,%eax
call   1070 <printf@plt>
mov    %r15,%rdi
call   1090 <urldecode@plt>
mov    %rbx,%rdi
mov    %r15,%rsi
xor    %eax,%eax
call   1070 <printf@plt>
mov    %r15,(%rsp)
mov    %r15,%rdi
call   1050 <strlen@plt>
test   %r15,%r15
je     12f4 <main+0x174>
mov    %eax,%r14d
lea    0xe5e(%rip),%rbp
mov    %rsp,%rbx
cs nopw 0x0(%rax,%rax,1)
nopl   (%rax)
mov    %rbx,%rdi
mov    %rbp,%rsi
call   1080 <strsep@plt>
test   %rax,%rax
jne    1220 <main+0xa0>
mov    %r15,(%rsp)
test   %r14d,%r14d
jle    1302 <main+0x182>
movslq %r14d,%rax
mov    %r15,%r14
add    %rax,%r14
lea    0xe25(%rip),%r12
lea    0xe24(%rip),%r13
lea    0x10(%rsp),%rbx
lea    0xe25(%rip),%rbp
jmp    12cb <main+0x14b>
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax)
lea    0x8(%rsp),%rdi
lea    0xdf4(%rip),%rsi
call   1080 <strsep@plt>
mov    %rax,%rdi
call   1040 <puts@plt>
mov    0x8(%rsp),%rdi
call   1040 <puts@plt>
mov    %r12,%rdi
xor    %eax,%eax
call   1070 <printf@plt>
mov    0x8(%rsp),%rdx
mov    %rbx,%rdi
mov    %r13,%rsi
call   10a0 <sprintf@plt>
mov    %rbp,%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1070 <printf@plt>
mov    %rbx,%rdi
call   1060 <system@plt>
mov    (%rsp),%r15
cmp    %r14,%r15
jae    1302 <main+0x182>
mov    %r15,0x8(%rsp)
mov    %r15,%rdi
call   1050 <strlen@plt>
cltq
add    (%rsp),%rax
xchg   %ax,%ax
mov    %rax,(%rsp)
cmp    %r14,%rax
jae    1270 <main+0xf0>
cmpb   $0x0,(%rax)
jne    1270 <main+0xf0>
add    $0x1,%rax
jmp    12e0 <main+0x160>
lea    0xd3f(%rip),%rdi
xor    %eax,%eax
call   1070 <printf@plt>
xor    %eax,%eax
add    $0x68,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [8 x i8] c"%s%c%c\0A\00"
@.str.1 = [37 x i8] c"Content-Type:text/html;charset=utf-8\00"
@.str.2 = [26 x i8] c"<TITLE>Uploading</TITLE>\0A\00"
@.str.3 = [13 x i8] c"QUERY_STRING\00"
@.str.4 = [3 x i8] c"%s\00"
@.str.5 = [52 x i8] c"<p>Error!Error in passing data from form to script.\00"
@.str.6 = [2 x i8] c"&\00"
@.str.7 = [2 x i8] c"=\00"
@.str.8 = [4 x i8] c"%s\0A\00"
@.str.9 = [6 x i8] c"<br/>\00"
@.str.10 = [16 x i8] c"sh upload.sh %s\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i8*
%7 = alloca i32
%8 = alloca i32
%9 = alloca i8*
%10 = alloca i8*
%11 = alloca i8*
%12 = alloca [80 x i8]
%13 = alloca [80 x [80 x i8]]
%14 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i8* null, i8** %6
%15 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str.1, i64 0, i64 0), i32 13, i32 10)
%16 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.2, i64 0, i64 0))
%17 = call i8* @getenv(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.3, i64 0, i64 0))
store i8* %17, i8** %6
%18 = load i8*, i8** %6
%19 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.4, i64 0, i64 0), i8* %18)
%20 = load i8*, i8** %6
%21 = call i32 @urldecode(i8* %20)
%22 = load i8*, i8** %6
%23 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.4, i64 0, i64 0), i8* %22)
%24 = load i8*, i8** %6
store i8* %24, i8** %9
store i32 0, i32* %8
%25 = load i8*, i8** %6
%26 = call i32 @strlen(i8* %25)
store i32 %26, i32* %7
store i32 0, i32* %14
%27 = load i8*, i8** %6
%28 = icmp eq i8* %27, null
br i1 %28, label %29, label %31
29: ; preds = %2
%30 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([52 x i8], [52 x i8]* @.str.5, i64 0, i64 0))
br label %87
31: ; preds = %2
br label %32
32: ; preds = %35, %31
%33 = call i8* @strsep(i8** %9, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.6, i64 0, i64 0))
%34 = icmp ne i8* %33, null
br i1 %34, label %35, label %38
35: ; preds = %32
%36 = load i32, i32* %8
%37 = add nsw i32 %36, 1
store i32 %37, i32* %8
br label %32
38: ; preds = %32
%39 = load i8*, i8** %6
store i8* %39, i8** %9
br label %40
40: ; preds = %72, %38
%41 = load i8*, i8** %9
%42 = load i8*, i8** %6
%43 = load i32, i32* %7
%44 = sext i32 %43 to i64
%45 = getelementptr inbounds i8, i8* %42, i64 %44
%46 = icmp ult i8* %41, %45
br i1 %46, label %47, label %86
47: ; preds = %40
%48 = load i8*, i8** %9
store i8* %48, i8** %11
store i8* %48, i8** %10
%49 = load i8*, i8** %9
%50 = call i32 @strlen(i8* %49)
%51 = load i8*, i8** %9
%52 = sext i32 %50 to i64
%53 = getelementptr inbounds i8, i8* %51, i64 %52
store i8* %53, i8** %9
br label %54
54: ; preds = %69, %47
%55 = load i8*, i8** %9
%56 = load i8*, i8** %6
%57 = load i32, i32* %7
%58 = sext i32 %57 to i64
%59 = getelementptr inbounds i8, i8* %56, i64 %58
%60 = icmp ult i8* %55, %59
br i1 %60, label %61, label %66
61: ; preds = %54
%62 = load i8*, i8** %9
%63 = load i8, i8* %62
%64 = icmp ne i8 %63, 0
%65 = xor i1 %64, true
br label %66
66: ; preds = %61, %54
%67 = phi i1 [ false, %54 ], [ %65, %61 ]
br i1 %67, label %68, label %72
68: ; preds = %66
br label %69
69: ; preds = %68
%70 = load i8*, i8** %9
%71 = getelementptr inbounds i8, i8* %70, i32 1
store i8* %71, i8** %9
br label %54
72: ; preds = %66
%73 = call i8* @strsep(i8** %10, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0))
store i8* %73, i8** %11
%74 = load i8*, i8** %11
%75 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.8, i64 0, i64 0), i8* %74)
%76 = load i8*, i8** %10
%77 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.8, i64 0, i64 0), i8* %76)
%78 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%79 = getelementptr inbounds [80 x i8], [80 x i8]* %12, i64 0, i64 0
%80 = load i8*, i8** %10
%81 = call i32 @sprintf(i8* %79, i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.10, i64 0, i64 0), i8* %80)
%82 = getelementptr inbounds [80 x i8], [80 x i8]* %12, i64 0, i64 0
%83 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.4, i64 0, i64 0), i8* %82)
%84 = getelementptr inbounds [80 x i8], [80 x i8]* %12, i64 0, i64 0
%85 = call i32 @system(i8* %84)
br label %40
86: ; preds = %40
br label %87
87: ; preds = %86, %29
ret i32 0
}

LLVM IR (-O2):
@.str = [8 x i8] c"%s%c%c\0A\00"
@.str.1 = [37 x i8] c"Content-Type:text/html;charset=utf-8\00"
@.str.3 = [13 x i8] c"QUERY_STRING\00"
@.str.4 = [3 x i8] c"%s\00"
@.str.5 = [52 x i8] c"<p>Error!Error in passing data from form to script.\00"
@.str.6 = [2 x i8] c"&\00"
@.str.7 = [2 x i8] c"=\00"
@.str.9 = [6 x i8] c"<br/>\00"
@.str.10 = [16 x i8] c"sh upload.sh %s\00"
@str = [25 x i8] c"<TITLE>Uploading</TITLE>\00"
define i32 @main(i32 %0, i8** nocapture readnone %1) {
%3 = alloca i8*
%4 = alloca i8*
%5 = alloca [80 x i8]
%6 = bitcast i8** %3 to i8*
%7 = bitcast i8** %4 to i8*
%8 = getelementptr inbounds [80 x i8], [80 x i8]* %5, i64 0, i64 0
%9 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str.1, i64 0, i64 0), i32 13, i32 10)
%10 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([25 x i8], [25 x i8]* @str, i64 0, i64 0))
%11 = tail call i8* @getenv(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.3, i64 0, i64 0))
%12 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([3 x i8], [3 x i8]* @.str.4, i64 0, i64 0), i8* %11)
%13 = tail call i32 @urldecode(i8* %11)
%14 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([3 x i8], [3 x i8]* @.str.4, i64 0, i64 0), i8* %11)
store i8* %11, i8** %3
%15 = tail call i32 @strlen(i8* %11)
%16 = icmp eq i8* %11, null
br i1 %16, label %17, label %19
17: ; preds = %2
%18 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([52 x i8], [52 x i8]* @.str.5, i64 0, i64 0))
br label %52
19: ; preds = %2, %19
%20 = call i8* @strsep(i8** %3, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.6, i64 0, i64 0))
%21 = icmp eq i8* %20, null
br i1 %21, label %22, label %19
22: ; preds = %19
store i8* %11, i8** %3
%23 = sext i32 %15 to i64
%24 = getelementptr inbounds i8, i8* %11, i64 %23
%25 = icmp sgt i32 %15, 0
br i1 %25, label %26, label %52
26: ; preds = %22, %40
%27 = phi i8* [ %50, %40 ], [ %11, %22 ]
store i8* %27, i8** %4
%28 = call i32 @strlen(i8* %27)
%29 = load i8*, i8** %3
%30 = sext i32 %28 to i64
%31 = getelementptr inbounds i8, i8* %29, i64 %30
store i8* %31, i8** %3
%32 = icmp ult i8* %31, %24
br i1 %32, label %35, label %40
33: ; preds = %35
store i8* %39, i8** %3
%34 = icmp ult i8* %39, %24
br i1 %34, label %35, label %40
35: ; preds = %26, %33
%36 = phi i8* [ %39, %33 ], [ %31, %26 ]
%37 = load i8, i8* %36
%38 = icmp eq i8 %37, 0
%39 = getelementptr inbounds i8, i8* %36, i64 1
br i1 %38, label %33, label %40
40: ; preds = %35, %33, %26
%41 = call i8* @strsep(i8** %4, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0))
%42 = call i32 @puts(i8* dereferenceable(1) %41)
%43 = load i8*, i8** %4
%44 = call i32 @puts(i8* dereferenceable(1) %43)
%45 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0))
%46 = load i8*, i8** %4
%47 = call i32 @sprintf(i8* %8, i8* dereferenceable(1) getelementptr inbounds ([16 x i8], [16 x i8]* @.str.10, i64 0, i64 0), i8* %46)
%48 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([3 x i8], [3 x i8]* @.str.4, i64 0, i64 0), i8* %8)
%49 = call i32 @system(i8* %8)
%50 = load i8*, i8** %3
%51 = icmp ult i8* %50, %24
br i1 %51, label %26, label %52
52: ; preds = %40, %22, %17
ret i32 0
}