#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
int /*<<< orphan*/ EINVAL;
int /*<<< orphan*/ __set_errno(int /*<<< orphan*/);
int /*<<< orphan*/ _exit(int);
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ dup2(int, int);
int /*<<< orphan*/ execl(char *, char *, char *, char const *, char *);
int /*<<< orphan*/ fclose(int /*<<< orphan*/ *);
int /*<<< orphan*/ *fdopen(int, char const *);
int fork();
scalar_t__ pipe(int *);
FILE *popen(const char *command, const char *mode) {
  FILE *fp;
  int pipe_fd[2];
  int pid, reading;
  int pr, pnr;
  reading = (mode[0] == 'r');
  if ((!reading && (mode[0] != 'w')) || mode[1]) {
    __set_errno(EINVAL);
  } else if (pipe(pipe_fd) == 0) {
    pr = pipe_fd[reading];
    pnr = pipe_fd[1 - reading];
    if ((fp = fdopen(pnr, mode)) != NULL) {
      if ((pid = fork()) == 0) {
        close(pnr);
        if (pr != reading) {
          close(reading);
          dup2(pr, reading);
          close(pr);
        }
        execl("/bin/sh", "sh", "-c", command, (char *)0);
        _exit(255);
      } else {
        close(pr);
        if (pid > 0) {
          return fp;
        } else {
          fclose(fp);
        }
      }
    } else {
      close(pr);
      close(pnr);
    }
  }
  return NULL;
}


x86 assembly (clang, -O0):
<popen>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    -0x18(%rbp),%rax
movsbl (%rax),%eax
cmp    $0x72,%eax
sete   %al
and    $0x1,%al
movzbl %al,%eax
mov    %eax,-0x30(%rbp)
cmpl   $0x0,-0x30(%rbp)
jne    11cf <popen+0x3f>
mov    -0x18(%rbp),%rax
movsbl (%rax),%eax
cmp    $0x77,%eax
jne    11e0 <popen+0x50>
mov    -0x18(%rbp),%rax
movsbl 0x1(%rax),%eax
cmp    $0x0,%eax
je     11f3 <popen+0x63>
mov    0x2df9(%rip),%rax
mov    (%rax),%edi
call   1030 <__set_errno@plt>
jmp    12f7 <popen+0x167>
lea    -0x28(%rbp),%rdi
call   1080 <pipe@plt>
cmp    $0x0,%rax
jne    12f2 <popen+0x162>
movslq -0x30(%rbp),%rax
mov    -0x28(%rbp,%rax,4),%eax
mov    %eax,-0x34(%rbp)
mov    $0x1,%eax
sub    -0x30(%rbp),%eax
cltq
mov    -0x28(%rbp,%rax,4),%eax
mov    %eax,-0x38(%rbp)
mov    -0x38(%rbp),%edi
mov    -0x18(%rbp),%rsi
call   1090 <fdopen@plt>
mov    %rax,-0x20(%rbp)
cmp    $0x0,%rax
je     12dd <popen+0x14d>
mov    $0x0,%al
call   10b0 <fork@plt>
mov    %eax,-0x2c(%rbp)
cmp    $0x0,%eax
jne    12ab <popen+0x11b>
mov    -0x38(%rbp),%edi
call   1070 <close@plt>
mov    -0x34(%rbp),%eax
cmp    -0x30(%rbp),%eax
je     127e <popen+0xee>
mov    -0x30(%rbp),%edi
call   1070 <close@plt>
mov    -0x34(%rbp),%edi
mov    -0x30(%rbp),%esi
call   1060 <dup2@plt>
mov    -0x34(%rbp),%edi
call   1070 <close@plt>
mov    -0x10(%rbp),%rcx
lea    0xd77(%rip),%rdi
lea    0xd75(%rip),%rsi
lea    0xd71(%rip),%rdx
xor    %eax,%eax
mov    %eax,%r8d
call   10a0 <execl@plt>
mov    $0xff,%edi
call   1040 <_exit@plt>
mov    -0x34(%rbp),%edi
call   1070 <close@plt>
cmpl   $0x0,-0x2c(%rbp)
jle    12ca <popen+0x13a>
mov    -0x20(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    12ff <popen+0x16f>
mov    -0x20(%rbp),%rdi
call   1050 <fclose@plt>
jmp    12d8 <popen+0x148>
jmp    12ed <popen+0x15d>
mov    -0x34(%rbp),%edi
call   1070 <close@plt>
mov    -0x38(%rbp),%edi
call   1070 <close@plt>
jmp    12f2 <popen+0x162>
jmp    12f7 <popen+0x167>
movq   $0x0,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<popen>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %rsi,%rbp
mov    %rdi,%r15
mov    (%rsi),%bl
xor    %r12d,%r12d
cmp    $0x72,%bl
sete   %r14b
cmp    $0x77,%bl
je     11ba <popen+0x2a>
cmp    $0x72,%bl
jne    11c0 <popen+0x30>
cmpb   $0x0,0x1(%rbp)
je     11e2 <popen+0x52>
mov    0x2e19(%rip),%rax
mov    (%rax),%edi
call   1030 <__set_errno@plt>
xor    %ebx,%ebx
mov    %rbx,%rax
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0x10(%rsp),%rdi
call   1080 <pipe@plt>
test   %rax,%rax
jne    11ce <popen+0x3e>
xor    %eax,%eax
xor    %ecx,%ecx
cmp    $0x72,%bl
setne  %al
sete   %cl
mov    0x10(%rsp,%rcx,4),%ecx
mov    %ecx,0x8(%rsp)
mov    0x10(%rsp,%rax,4),%r13d
mov    %r13d,%edi
mov    %rbp,%rsi
call   1090 <fdopen@plt>
test   %rax,%rax
je     124b <popen+0xbb>
mov    %rax,%rbx
mov    %r13d,0xc(%rsp)
mov    0x8(%rsp),%ebp
xor    %eax,%eax
call   10b0 <fork@plt>
test   %eax,%eax
je     1261 <popen+0xd1>
mov    %eax,%r13d
mov    %ebp,%edi
call   1070 <close@plt>
test   %r13d,%r13d
jg     11d0 <popen+0x40>
mov    %rbx,%rdi
call   1050 <fclose@plt>
jmp    11ce <popen+0x3e>
mov    0x8(%rsp),%edi
call   1070 <close@plt>
mov    %r13d,%edi
call   1070 <close@plt>
jmp    11ce <popen+0x3e>
mov    %r14b,%r12b
mov    0xc(%rsp),%edi
call   1070 <close@plt>
cmp    %r12d,%ebp
je     128b <popen+0xfb>
mov    %r12d,%edi
call   1070 <close@plt>
mov    %ebp,%edi
mov    %r12d,%esi
call   1060 <dup2@plt>
mov    %ebp,%edi
call   1070 <close@plt>
lea    0xd6e(%rip),%rdi
lea    0xd6c(%rip),%rsi
lea    0xd68(%rip),%rdx
mov    %r15,%rcx
xor    %r8d,%r8d
call   10a0 <execl@plt>
mov    $0xff,%edi
call   1040 <_exit@plt>

LLVM IR (-O0):
@EINVAL = global i32 0
@.str = [8 x i8] c"/bin/sh\00"
@.str.1 = [3 x i8] c"sh\00"
@.str.2 = [3 x i8] c"-c\00"
define i32* @popen(i8* %0, i8* %1) {
%3 = alloca i32*
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i32*
%7 = alloca [2 x i32]
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca i32
store i8* %0, i8** %4
store i8* %1, i8** %5
%12 = load i8*, i8** %5
%13 = getelementptr inbounds i8, i8* %12, i64 0
%14 = load i8, i8* %13
%15 = sext i8 %14 to i32
%16 = icmp eq i32 %15, 114
%17 = zext i1 %16 to i32
store i32 %17, i32* %9
%18 = load i32, i32* %9
%19 = icmp ne i32 %18, 0
br i1 %19, label %26, label %20
20: ; preds = %2
%21 = load i8*, i8** %5
%22 = getelementptr inbounds i8, i8* %21, i64 0
%23 = load i8, i8* %22
%24 = sext i8 %23 to i32
%25 = icmp ne i32 %24, 119
br i1 %25, label %32, label %26
26: ; preds = %20, %2
%27 = load i8*, i8** %5
%28 = getelementptr inbounds i8, i8* %27, i64 1
%29 = load i8, i8* %28
%30 = sext i8 %29 to i32
%31 = icmp ne i32 %30, 0
br i1 %31, label %32, label %35
32: ; preds = %26, %20
%33 = load i32, i32* @EINVAL
%34 = call i32 @__set_errno(i32 %33)
br label %93
35: ; preds = %26
%36 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 0
%37 = call i64 @pipe(i32* %36)
%38 = icmp eq i64 %37, 0
br i1 %38, label %39, label %92
39: ; preds = %35
%40 = load i32, i32* %9
%41 = sext i32 %40 to i64
%42 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 %41
%43 = load i32, i32* %42
store i32 %43, i32* %10
%44 = load i32, i32* %9
%45 = sub nsw i32 1, %44
%46 = sext i32 %45 to i64
%47 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 %46
%48 = load i32, i32* %47
store i32 %48, i32* %11
%49 = load i32, i32* %11
%50 = load i8*, i8** %5
%51 = call i32* @fdopen(i32 %49, i8* %50)
store i32* %51, i32** %6
%52 = icmp ne i32* %51, null
br i1 %52, label %53, label %86
53: ; preds = %39
%54 = call i32 (...) @fork()
store i32 %54, i32* %8
%55 = icmp eq i32 %54, 0
br i1 %55, label %56, label %74
56: ; preds = %53
%57 = load i32, i32* %11
%58 = call i32 @close(i32 %57)
%59 = load i32, i32* %10
%60 = load i32, i32* %9
%61 = icmp ne i32 %59, %60
br i1 %61, label %62, label %70
62: ; preds = %56
%63 = load i32, i32* %9
%64 = call i32 @close(i32 %63)
%65 = load i32, i32* %10
%66 = load i32, i32* %9
%67 = call i32 @dup2(i32 %65, i32 %66)
%68 = load i32, i32* %10
%69 = call i32 @close(i32 %68)
br label %70
70: ; preds = %62, %56
%71 = load i8*, i8** %4
%72 = call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i8* %71, i8* null)
%73 = call i32 @_exit(i32 255)
unreachable
74: ; preds = %53
%75 = load i32, i32* %10
%76 = call i32 @close(i32 %75)
%77 = load i32, i32* %8
%78 = icmp sgt i32 %77, 0
br i1 %78, label %79, label %81
79: ; preds = %74
%80 = load i32*, i32** %6
store i32* %80, i32** %3
br label %94
81: ; preds = %74
%82 = load i32*, i32** %6
%83 = call i32 @fclose(i32* %82)
br label %84
84: ; preds = %81
br label %85
85: ; preds = %84
br label %91
86: ; preds = %39
%87 = load i32, i32* %10
%88 = call i32 @close(i32 %87)
%89 = load i32, i32* %11
%90 = call i32 @close(i32 %89)
br label %91
91: ; preds = %86, %85
br label %92
92: ; preds = %91, %35
br label %93
93: ; preds = %92, %32
store i32* null, i32** %3
br label %94
94: ; preds = %93, %79
%95 = load i32*, i32** %3
ret i32* %95
}

LLVM IR (-O2):
@EINVAL = global i32 0
@.str = [8 x i8] c"/bin/sh\00"
@.str.1 = [3 x i8] c"sh\00"
@.str.2 = [3 x i8] c"-c\00"
define noalias i32* @popen(i8* %0, i8* nocapture %1) {
%3 = alloca [2 x i32]
%4 = bitcast [2 x i32]* %3 to i8*
%5 = load i8, i8* %1
%6 = icmp eq i8 %5, 114
%7 = zext i1 %6 to i32
switch i8 %5, label %12 [
i8 119, label %8
i8 114, label %8
]
8: ; preds = %2, %2
%9 = getelementptr inbounds i8, i8* %1, i64 1
%10 = load i8, i8* %9
%11 = icmp eq i8 %10, 0
br i1 %11, label %15, label %12
12: ; preds = %2, %8
%13 = load i32, i32* @EINVAL
%14 = tail call i32 @__set_errno(i32 %13)
br label %50
15: ; preds = %8
%16 = getelementptr inbounds [2 x i32], [2 x i32]* %3, i64 0, i64 0
%17 = call i64 @pipe(i32* %16)
%18 = icmp eq i64 %17, 0
br i1 %18, label %19, label %50
19: ; preds = %15
%20 = zext i1 %6 to i64
%21 = getelementptr inbounds [2 x i32], [2 x i32]* %3, i64 0, i64 %20
%22 = load i32, i32* %21
%23 = xor i1 %6, true
%24 = zext i1 %23 to i64
%25 = getelementptr inbounds [2 x i32], [2 x i32]* %3, i64 0, i64 %24
%26 = load i32, i32* %25
%27 = call i32* @fdopen(i32 %26, i8* %1)
%28 = icmp eq i32* %27, null
br i1 %28, label %47, label %29
29: ; preds = %19
%30 = call i32 (...) @fork()
%31 = icmp eq i32 %30, 0
br i1 %31, label %32, label %42
32: ; preds = %29
%33 = call i32 @close(i32 %26)
%34 = icmp eq i32 %22, %7
br i1 %34, label %39, label %35
35: ; preds = %32
%36 = call i32 @close(i32 %7)
%37 = call i32 @dup2(i32 %22, i32 %7)
%38 = call i32 @close(i32 %22)
br label %39
39: ; preds = %35, %32
%40 = call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i8* %0, i8* null)
%41 = call i32 @_exit(i32 255)
unreachable
42: ; preds = %29
%43 = call i32 @close(i32 %22)
%44 = icmp sgt i32 %30, 0
br i1 %44, label %50, label %45
45: ; preds = %42
%46 = call i32 @fclose(i32* %27)
br label %50
47: ; preds = %19
%48 = call i32 @close(i32 %22)
%49 = call i32 @close(i32 %26)
br label %50
50: ; preds = %12, %45, %47, %15, %42
%51 = phi i32* [ %27, %42 ], [ null, %15 ], [ null, %47 ], [ null, %45 ], [ null, %12 ]
ret i32* %51
}