#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
char *malloc(int);
int /*<<< orphan*/ printf(char *);
int /*<<< orphan*/ setuid(int /*<<< orphan*/);
int /*<<< orphan*/ strcat(char *, char *);
int /*<<< orphan*/ strcpy(char *, char *);
int strlen(char *);
int /*<<< orphan*/ system(char *);
int main(int argc, char *argv[]) {
  char *str;
  int size = 0;
  int index;
  setuid(0);
  size = strlen("/bin/sh ") + 1;
  for (index = 1; index < argc; index++)
    size += strlen(argv[index]);
  size += argc - 1;
  if (!(str = malloc(sizeof(char) * size))) {
    printf("Not enough memory\n");
    return 1;
  }
  str[0] = 0;
  strcpy(str, "/bin/sh ");
  for (index = 1; index < argc; index++) {
    strcat(str, " ");
    strcat(str, argv[index]);
  }
  system(str);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movl   $0x0,-0x1c(%rbp)
xor    %edi,%edi
call   1090 <setuid@plt>
lea    0xe65(%rip),%rdi
call   1040 <strlen@plt>
add    $0x1,%eax
mov    %eax,-0x1c(%rbp)
movl   $0x1,-0x20(%rbp)
mov    -0x20(%rbp),%eax
cmp    -0x8(%rbp),%eax
jge    11de <main+0x6e>
mov    -0x10(%rbp),%rax
movslq -0x20(%rbp),%rcx
mov    (%rax,%rcx,8),%rdi
call   1040 <strlen@plt>
add    -0x1c(%rbp),%eax
mov    %eax,-0x1c(%rbp)
mov    -0x20(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x20(%rbp)
jmp    11ad <main+0x3d>
mov    -0x8(%rbp),%eax
sub    $0x1,%eax
add    -0x1c(%rbp),%eax
mov    %eax,-0x1c(%rbp)
movslq -0x1c(%rbp),%rax
shl    $0x0,%rax
mov    %eax,%edi
call   1070 <malloc@plt>
mov    %rax,-0x18(%rbp)
cmp    $0x0,%rax
jne    121f <main+0xaf>
lea    0xdfb(%rip),%rdi
call   1060 <printf@plt>
movl   $0x1,-0x4(%rbp)
jmp    128c <main+0x11c>
mov    -0x18(%rbp),%rax
movb   $0x0,(%rax)
mov    -0x18(%rbp),%rdi
lea    0xdcf(%rip),%rsi
call   1030 <strcpy@plt>
movl   $0x1,-0x20(%rbp)
mov    -0x20(%rbp),%eax
cmp    -0x8(%rbp),%eax
jge    127c <main+0x10c>
mov    -0x18(%rbp),%rdi
lea    0xdb3(%rip),%rsi
call   1080 <strcat@plt>
mov    -0x18(%rbp),%rdi
mov    -0x10(%rbp),%rax
movslq -0x20(%rbp),%rcx
mov    (%rax,%rcx,8),%rsi
call   1080 <strcat@plt>
mov    -0x20(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x20(%rbp)
jmp    123d <main+0xcd>
mov    -0x18(%rbp),%rdi
call   1050 <system@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
mov    %rsi,%r15
mov    %edi,%r14d
xor    %edi,%edi
call   1090 <setuid@plt>
lea    0xe73(%rip),%rdi
call   1050 <strlen@plt>
mov    %eax,%r13d
add    $0x1,%r13d
cmp    $0x2,%r14d
jl     11c5 <main+0x55>
mov    %r14d,%r12d
mov    $0x1,%ebx
nopw   0x0(%rax,%rax,1)
mov    (%r15,%rbx,8),%rdi
call   1050 <strlen@plt>
add    %eax,%r13d
add    $0x1,%rbx
cmp    %rbx,%r12
jne    11b0 <main+0x40>
lea    (%r14,%r13,1),%edi
add    $0xffffffff,%edi
call   1070 <malloc@plt>
test   %rax,%rax
je     122c <main+0xbc>
mov    %rax,%r13
movb   $0x0,(%rax)
lea    0xe1d(%rip),%rsi
mov    %rax,%rdi
call   1030 <strcpy@plt>
cmp    $0x2,%r14d
jl     1220 <main+0xb0>
mov    %r14d,%r12d
mov    $0x1,%ebx
lea    0xe07(%rip),%r14
mov    %r13,%rdi
mov    %r14,%rsi
call   1080 <strcat@plt>
mov    (%r15,%rbx,8),%rsi
mov    %r13,%rdi
call   1080 <strcat@plt>
add    $0x1,%rbx
cmp    %rbx,%r12
jne    1200 <main+0x90>
mov    %r13,%rdi
call   1060 <system@plt>
xor    %eax,%eax
jmp    123d <main+0xcd>
lea    0xdd6(%rip),%rdi
call   1040 <puts@plt>
mov    $0x1,%eax
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@.str = [9 x i8] c"/bin/sh \00"
@.str.1 = [19 x i8] c"Not enough memory\0A\00"
@.str.2 = [2 x i8] c" \00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i8*
%7 = alloca i32
%8 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 0, i32* %7
%9 = call i32 @setuid(i32 0)
%10 = call i32 @strlen(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str, i64 0, i64 0))
%11 = add nsw i32 %10, 1
store i32 %11, i32* %7
store i32 1, i32* %8
br label %12
12: ; preds = %25, %2
%13 = load i32, i32* %8
%14 = load i32, i32* %4
%15 = icmp slt i32 %13, %14
br i1 %15, label %16, label %28
16: ; preds = %12
%17 = load i8**, i8*** %5
%18 = load i32, i32* %8
%19 = sext i32 %18 to i64
%20 = getelementptr inbounds i8*, i8** %17, i64 %19
%21 = load i8*, i8** %20
%22 = call i32 @strlen(i8* %21)
%23 = load i32, i32* %7
%24 = add nsw i32 %23, %22
store i32 %24, i32* %7
br label %25
25: ; preds = %16
%26 = load i32, i32* %8
%27 = add nsw i32 %26, 1
store i32 %27, i32* %8
br label %12
28: ; preds = %12
%29 = load i32, i32* %4
%30 = sub nsw i32 %29, 1
%31 = load i32, i32* %7
%32 = add nsw i32 %31, %30
store i32 %32, i32* %7
%33 = load i32, i32* %7
%34 = sext i32 %33 to i64
%35 = mul i64 1, %34
%36 = trunc i64 %35 to i32
%37 = call i8* @malloc(i32 %36)
store i8* %37, i8** %6
%38 = icmp ne i8* %37, null
br i1 %38, label %41, label %39
39: ; preds = %28
%40 = call i32 @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.1, i64 0, i64 0))
store i32 1, i32* %3
br label %66
41: ; preds = %28
%42 = load i8*, i8** %6
%43 = getelementptr inbounds i8, i8* %42, i64 0
store i8 0, i8* %43
%44 = load i8*, i8** %6
%45 = call i32 @strcpy(i8* %44, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str, i64 0, i64 0))
store i32 1, i32* %8
br label %46
46: ; preds = %60, %41
%47 = load i32, i32* %8
%48 = load i32, i32* %4
%49 = icmp slt i32 %47, %48
br i1 %49, label %50, label %63
50: ; preds = %46
%51 = load i8*, i8** %6
%52 = call i32 @strcat(i8* %51, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.2, i64 0, i64 0))
%53 = load i8*, i8** %6
%54 = load i8**, i8*** %5
%55 = load i32, i32* %8
%56 = sext i32 %55 to i64
%57 = getelementptr inbounds i8*, i8** %54, i64 %56
%58 = load i8*, i8** %57
%59 = call i32 @strcat(i8* %53, i8* %58)
br label %60
60: ; preds = %50
%61 = load i32, i32* %8
%62 = add nsw i32 %61, 1
store i32 %62, i32* %8
br label %46
63: ; preds = %46
%64 = load i8*, i8** %6
%65 = call i32 @system(i8* %64)
store i32 0, i32* %3
br label %66
66: ; preds = %63, %39
%67 = load i32, i32* %3
ret i32 %67
}

LLVM IR (-O2):
@.str = [9 x i8] c"/bin/sh \00"
@.str.2 = [2 x i8] c" \00"
@str = [18 x i8] c"Not enough memory\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = tail call i32 @setuid(i32 0)
%4 = tail call i32 @strlen(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str, i64 0, i64 0))
%5 = add nsw i32 %4, 1
%6 = icmp sgt i32 %0, 1
br i1 %6, label %7, label %18
7: ; preds = %2
%8 = zext i32 %0 to i64
br label %9
9: ; preds = %7, %9
%10 = phi i64 [ 1, %7 ], [ %16, %9 ]
%11 = phi i32 [ %5, %7 ], [ %15, %9 ]
%12 = getelementptr inbounds i8*, i8** %1, i64 %10
%13 = load i8*, i8** %12
%14 = tail call i32 @strlen(i8* %13)
%15 = add nsw i32 %14, %11
%16 = add nuw nsw i64 %10, 1
%17 = icmp eq i64 %16, %8
br i1 %17, label %18, label %9
18: ; preds = %9, %2
%19 = phi i32 [ %5, %2 ], [ %15, %9 ]
%20 = add nsw i32 %0, -1
%21 = add nsw i32 %20, %19
%22 = tail call i8* @malloc(i32 %21)
%23 = icmp eq i8* %22, null
br i1 %23, label %24, label %26
24: ; preds = %18
%25 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([18 x i8], [18 x i8]* @str, i64 0, i64 0))
br label %40
26: ; preds = %18
store i8 0, i8* %22
%27 = tail call i32 @strcpy(i8* %22, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str, i64 0, i64 0))
br i1 %6, label %28, label %38
28: ; preds = %26
%29 = zext i32 %0 to i64
br label %30
30: ; preds = %28, %30
%31 = phi i64 [ 1, %28 ], [ %36, %30 ]
%32 = tail call i32 @strcat(i8* %22, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.2, i64 0, i64 0))
%33 = getelementptr inbounds i8*, i8** %1, i64 %31
%34 = load i8*, i8** %33
%35 = tail call i32 @strcat(i8* %22, i8* %34)
%36 = add nuw nsw i64 %31, 1
%37 = icmp eq i64 %36, %29
br i1 %37, label %38, label %30
38: ; preds = %30, %26
%39 = tail call i32 @system(i8* %22)
br label %40
40: ; preds = %38, %24
%41 = phi i32 [ 0, %38 ], [ 1, %24 ]
ret i32 %41
}