#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct passwd {
  char *pw_name;
  int pw_uid;
  int pw_gid;
};

/* Variables and functions */
int BUFSIZ;
int /*<<< orphan*/ exec_command(int, char **);
int /*<<< orphan*/ exit(int);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, char *);
int getgid();
struct passwd *getpwnam(char *);
struct passwd *getpwuid(int);
int getuid();
int /*<<< orphan*/ printf(char *, char *);
int /*<<< orphan*/ setegid(int);
int /*<<< orphan*/ seteuid(int);
int /*<<< orphan*/ setgid(int);
int /*<<< orphan*/ setuid(int);
int /*<<< orphan*/ stderr;
scalar_t__ strcmp(char *, char *);
char *strdup(char *);
int main(int argc, char **argv) {
  int uid, gid, suid, sgid, euid;
  char *username;
  char s[BUFSIZ];
  int debug = 0;
  uid = gid = suid = sgid = euid = 10001;
  struct passwd *pwd;
  uid = getuid();
  gid = getgid();
  pwd = getpwuid(uid);
  suid = sgid = 0;
  if (!pwd ||
      (strcmp(pwd->pw_name, "lxlabs") && strcmp(pwd->pw_name, "root"))) {
    if (debug) {
      printf("%s: Not allowd to execute\n", pwd->pw_name);
    }
    exit(0);
  }
  if (argc < 4) {
    exit(2);
  }
  argc--;
  argv++;
  while (argv[0][0] == '-') {
    struct passwd *pw;
    if (argv[0][1] == 'u') {
      username = strdup(argv[1]);
      pw = getpwnam(username);
      if (pw) {
        suid = pw->pw_uid;
        sgid = pw->pw_gid;
        setgid(sgid);
        setegid(sgid);
        setuid(suid);
        seteuid(suid);
      } else {
        fprintf(stderr, "User %s Doesn't Exist...\n", username);
        exit(192);
      }
      setgid(sgid);
      setegid(sgid);
      setuid(suid);
      seteuid(suid);
    }
    argv += 2;
  }
  exec_command(argc, argv);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x60,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    0x2ddb(%rip),%rax
mov    (%rax),%eax
mov    %rsp,%rcx
mov    %rcx,-0x38(%rbp)
mov    %rax,-0x40(%rbp)
movl   $0x0,-0x44(%rbp)
movl   $0x2711,-0x24(%rbp)
movl   $0x2711,-0x20(%rbp)
movl   $0x2711,-0x1c(%rbp)
movl   $0x2711,-0x18(%rbp)
movl   $0x2711,-0x14(%rbp)
mov    $0x0,%al
call   1040 <getuid@plt>
mov    %eax,-0x14(%rbp)
mov    $0x0,%al
call   10a0 <getgid@plt>
mov    %eax,-0x18(%rbp)
mov    -0x14(%rbp),%edi
call   1030 <getpwuid@plt>
mov    %rax,-0x50(%rbp)
movl   $0x0,-0x20(%rbp)
movl   $0x0,-0x1c(%rbp)
cmpq   $0x0,-0x50(%rbp)
je     12a7 <main+0xc7>
mov    -0x50(%rbp),%rax
mov    (%rax),%rdi
lea    0xd85(%rip),%rsi
call   1070 <strcmp@plt>
cmp    $0x0,%rax
je     12cb <main+0xeb>
mov    -0x50(%rbp),%rax
mov    (%rax),%rdi
lea    0xd6f(%rip),%rsi
call   1070 <strcmp@plt>
cmp    $0x0,%rax
je     12cb <main+0xeb>
cmpl   $0x0,-0x44(%rbp)
je     12c4 <main+0xe4>
mov    -0x50(%rbp),%rax
mov    (%rax),%rsi
lea    0xd4d(%rip),%rdi
call   1050 <printf@plt>
xor    %edi,%edi
call   10c0 <exit@plt>
cmpl   $0x4,-0x8(%rbp)
jge    12df <main+0xff>
mov    $0x2,%edi
call   10c0 <exit@plt>
mov    -0x8(%rbp),%eax
add    $0xffffffff,%eax
mov    %eax,-0x8(%rbp)
mov    -0x10(%rbp),%rax
add    $0x8,%rax
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
movsbl (%rax),%eax
cmp    $0x2d,%eax
jne    13d1 <main+0x1f1>
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
movsbl 0x1(%rax),%eax
cmp    $0x75,%eax
jne    13c0 <main+0x1e0>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   10e0 <strdup@plt>
mov    %rax,-0x30(%rbp)
mov    -0x30(%rbp),%rdi
call   1080 <getpwnam@plt>
mov    %rax,-0x58(%rbp)
cmpq   $0x0,-0x58(%rbp)
je     137d <main+0x19d>
mov    -0x58(%rbp),%rax
mov    0x8(%rax),%eax
mov    %eax,-0x1c(%rbp)
mov    -0x58(%rbp),%rax
mov    0xc(%rax),%eax
mov    %eax,-0x20(%rbp)
mov    -0x20(%rbp),%edi
call   10b0 <setgid@plt>
mov    -0x20(%rbp),%edi
call   10f0 <setegid@plt>
mov    -0x1c(%rbp),%edi
call   10d0 <setuid@plt>
mov    -0x1c(%rbp),%edi
call   1100 <seteuid@plt>
jmp    13a0 <main+0x1c0>
mov    0x2c5c(%rip),%rax
mov    (%rax),%edi
mov    -0x30(%rbp),%rdx
lea    0xc96(%rip),%rsi
call   1090 <fprintf@plt>
mov    $0xc0,%edi
call   10c0 <exit@plt>
mov    -0x20(%rbp),%edi
call   10b0 <setgid@plt>
mov    -0x20(%rbp),%edi
call   10f0 <setegid@plt>
mov    -0x1c(%rbp),%edi
call   10d0 <setuid@plt>
mov    -0x1c(%rbp),%edi
call   1100 <seteuid@plt>
mov    -0x10(%rbp),%rax
add    $0x10,%rax
mov    %rax,-0x10(%rbp)
jmp    12f4 <main+0x114>
mov    -0x8(%rbp),%edi
mov    -0x10(%rbp),%rsi
call   1060 <exec_command@plt>
mov    -0x38(%rbp),%rax
mov    %rax,%rsp
mov    -0x4(%rbp),%eax
mov    %rbp,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %rbx
push   %rax
mov    %rsi,%rbx
mov    %edi,%r14d
xor    %eax,%eax
call   1040 <getuid@plt>
mov    %eax,%ebp
xor    %eax,%eax
call   1090 <getgid@plt>
mov    %ebp,%edi
call   1030 <getpwuid@plt>
test   %rax,%rax
je     1308 <main+0x138>
mov    %rax,%rbp
mov    (%rax),%rdi
lea    0xdf6(%rip),%rsi
call   1060 <strcmp@plt>
test   %rax,%rax
je     122d <main+0x5d>
mov    0x0(%rbp),%rdi
lea    0xde8(%rip),%rsi
call   1060 <strcmp@plt>
test   %rax,%rax
jne    1308 <main+0x138>
cmp    $0x3,%r14d
jle    130f <main+0x13f>
mov    0x8(%rbx),%rax
cmpb   $0x2d,(%rax)
jne    12c0 <main+0xf0>
add    $0x18,%rbx
jmp    125c <main+0x8c>
nopw   0x0(%rax,%rax,1)
mov    (%rbx),%rax
add    $0x10,%rbx
cmpb   $0x2d,(%rax)
jne    12c6 <main+0xf6>
cmpb   $0x75,0x1(%rax)
jne    1250 <main+0x80>
mov    -0x8(%rbx),%rdi
call   10d0 <strdup@plt>
mov    %rax,%rbp
mov    %rax,%rdi
call   1070 <getpwnam@plt>
test   %rax,%rax
je     12e6 <main+0x116>
mov    0x8(%rax),%r15d
mov    0xc(%rax),%ebp
mov    %ebp,%edi
call   10a0 <setgid@plt>
mov    %ebp,%edi
call   10e0 <setegid@plt>
mov    %r15d,%edi
call   10c0 <setuid@plt>
mov    %r15d,%edi
call   10f0 <seteuid@plt>
mov    %ebp,%edi
call   10a0 <setgid@plt>
mov    %ebp,%edi
call   10e0 <setegid@plt>
mov    %r15d,%edi
call   10c0 <setuid@plt>
mov    %r15d,%edi
call   10f0 <seteuid@plt>
jmp    1250 <main+0x80>
add    $0x8,%rbx
jmp    12ca <main+0xfa>
add    $0xfffffffffffffff0,%rbx
add    $0xffffffff,%r14d
mov    %r14d,%edi
mov    %rbx,%rsi
call   1050 <exec_command@plt>
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret
mov    0x2cf3(%rip),%rax
mov    (%rax),%edi
lea    0xd16(%rip),%rsi
mov    %rbp,%rdx
call   1080 <fprintf@plt>
mov    $0xc0,%edi
call   10b0 <exit@plt>
xor    %edi,%edi
call   10b0 <exit@plt>
mov    $0x2,%edi
call   10b0 <exit@plt>

LLVM IR (-O0):
%struct.passwd = type { i8*, i32, i32 }
@BUFSIZ = global i32 0
@.str = [7 x i8] c"lxlabs\00"
@.str.1 = [5 x i8] c"root\00"
@.str.2 = [27 x i8] c"%s: Not allowd to execute\0A\00"
@stderr = global i32 0
@.str.3 = [26 x i8] c"User %s Doesn't Exist...\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca i8*
%12 = alloca i8*
%13 = alloca i64
%14 = alloca i32
%15 = alloca %struct.passwd*
%16 = alloca %struct.passwd*
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%17 = load i32, i32* @BUFSIZ
%18 = zext i32 %17 to i64
%19 = call i8* @llvm.stacksave()
store i8* %19, i8** %12
%20 = alloca i8, i64 %18
store i64 %18, i64* %13
store i32 0, i32* %14
store i32 10001, i32* %10
store i32 10001, i32* %9
store i32 10001, i32* %8
store i32 10001, i32* %7
store i32 10001, i32* %6
%21 = call i32 (...) @getuid()
store i32 %21, i32* %6
%22 = call i32 (...) @getgid()
store i32 %22, i32* %7
%23 = load i32, i32* %6
%24 = call %struct.passwd* @getpwuid(i32 %23)
store %struct.passwd* %24, %struct.passwd** %15
store i32 0, i32* %9
store i32 0, i32* %8
%25 = load %struct.passwd*, %struct.passwd** %15
%26 = icmp ne %struct.passwd* %25, null
br i1 %26, label %27, label %39
27: ; preds = %2
%28 = load %struct.passwd*, %struct.passwd** %15
%29 = getelementptr inbounds %struct.passwd, %struct.passwd* %28, i32 0, i32 0
%30 = load i8*, i8** %29
%31 = call i64 @strcmp(i8* %30, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0))
%32 = icmp ne i64 %31, 0
br i1 %32, label %33, label %49
33: ; preds = %27
%34 = load %struct.passwd*, %struct.passwd** %15
%35 = getelementptr inbounds %struct.passwd, %struct.passwd* %34, i32 0, i32 0
%36 = load i8*, i8** %35
%37 = call i64 @strcmp(i8* %36, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.1, i64 0, i64 0))
%38 = icmp ne i64 %37, 0
br i1 %38, label %39, label %49
39: ; preds = %33, %2
%40 = load i32, i32* %14
%41 = icmp ne i32 %40, 0
br i1 %41, label %42, label %47
42: ; preds = %39
%43 = load %struct.passwd*, %struct.passwd** %15
%44 = getelementptr inbounds %struct.passwd, %struct.passwd* %43, i32 0, i32 0
%45 = load i8*, i8** %44
%46 = call i32 @printf(i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.2, i64 0, i64 0), i8* %45)
br label %47
47: ; preds = %42, %39
%48 = call i32 @exit(i32 0)
unreachable
49: ; preds = %33, %27
%50 = load i32, i32* %4
%51 = icmp slt i32 %50, 4
br i1 %51, label %52, label %54
52: ; preds = %49
%53 = call i32 @exit(i32 2)
unreachable
54: ; preds = %49
%55 = load i32, i32* %4
%56 = add nsw i32 %55, -1
store i32 %56, i32* %4
%57 = load i8**, i8*** %5
%58 = getelementptr inbounds i8*, i8** %57, i32 1
store i8** %58, i8*** %5
br label %59
59: ; preds = %113, %54
%60 = load i8**, i8*** %5
%61 = getelementptr inbounds i8*, i8** %60, i64 0
%62 = load i8*, i8** %61
%63 = getelementptr inbounds i8, i8* %62, i64 0
%64 = load i8, i8* %63
%65 = sext i8 %64 to i32
%66 = icmp eq i32 %65, 45
br i1 %66, label %67, label %116
67: ; preds = %59
%68 = load i8**, i8*** %5
%69 = getelementptr inbounds i8*, i8** %68, i64 0
%70 = load i8*, i8** %69
%71 = getelementptr inbounds i8, i8* %70, i64 1
%72 = load i8, i8* %71
%73 = sext i8 %72 to i32
%74 = icmp eq i32 %73, 117
br i1 %74, label %75, label %113
75: ; preds = %67
%76 = load i8**, i8*** %5
%77 = getelementptr inbounds i8*, i8** %76, i64 1
%78 = load i8*, i8** %77
%79 = call i8* @strdup(i8* %78)
store i8* %79, i8** %11
%80 = load i8*, i8** %11
%81 = call %struct.passwd* @getpwnam(i8* %80)
store %struct.passwd* %81, %struct.passwd** %16
%82 = load %struct.passwd*, %struct.passwd** %16
%83 = icmp ne %struct.passwd* %82, null
br i1 %83, label %84, label %99
84: ; preds = %75
%85 = load %struct.passwd*, %struct.passwd** %16
%86 = getelementptr inbounds %struct.passwd, %struct.passwd* %85, i32 0, i32 1
%87 = load i32, i32* %86
store i32 %87, i32* %8
%88 = load %struct.passwd*, %struct.passwd** %16
%89 = getelementptr inbounds %struct.passwd, %struct.passwd* %88, i32 0, i32 2
%90 = load i32, i32* %89
store i32 %90, i32* %9
%91 = load i32, i32* %9
%92 = call i32 @setgid(i32 %91)
%93 = load i32, i32* %9
%94 = call i32 @setegid(i32 %93)
%95 = load i32, i32* %8
%96 = call i32 @setuid(i32 %95)
%97 = load i32, i32* %8
%98 = call i32 @seteuid(i32 %97)
br label %104
99: ; preds = %75
%100 = load i32, i32* @stderr
%101 = load i8*, i8** %11
%102 = call i32 @fprintf(i32 %100, i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.3, i64 0, i64 0), i8* %101)
%103 = call i32 @exit(i32 192)
unreachable
104: ; preds = %84
%105 = load i32, i32* %9
%106 = call i32 @setgid(i32 %105)
%107 = load i32, i32* %9
%108 = call i32 @setegid(i32 %107)
%109 = load i32, i32* %8
%110 = call i32 @setuid(i32 %109)
%111 = load i32, i32* %8
%112 = call i32 @seteuid(i32 %111)
br label %113
113: ; preds = %104, %67
%114 = load i8**, i8*** %5
%115 = getelementptr inbounds i8*, i8** %114, i64 2
store i8** %115, i8*** %5
br label %59
116: ; preds = %59
%117 = load i32, i32* %4
%118 = load i8**, i8*** %5
%119 = call i32 @exec_command(i32 %117, i8** %118)
%120 = load i8*, i8** %12
%121 = load i32, i32* %3
ret i32 %121
}

LLVM IR (-O2):
%struct.passwd = type { i8*, i32, i32 }
@BUFSIZ = global i32 0
@.str = [7 x i8] c"lxlabs\00"
@.str.1 = [5 x i8] c"root\00"
@stderr = global i32 0
@.str.3 = [26 x i8] c"User %s Doesn't Exist...\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = tail call i32 (...) @getuid()
%4 = tail call i32 (...) @getgid()
%5 = tail call %struct.passwd* @getpwuid(i32 %3)
%6 = icmp eq %struct.passwd* %5, null
br i1 %6, label %16, label %7
7: ; preds = %2
%8 = getelementptr inbounds %struct.passwd, %struct.passwd* %5, i64 0, i32 0
%9 = load i8*, i8** %8
%10 = tail call i64 @strcmp(i8* %9, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0))
%11 = icmp eq i64 %10, 0
br i1 %11, label %18, label %12
12: ; preds = %7
%13 = load i8*, i8** %8
%14 = tail call i64 @strcmp(i8* %13, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.1, i64 0, i64 0))
%15 = icmp eq i64 %14, 0
br i1 %15, label %18, label %16
16: ; preds = %2, %12
%17 = tail call i32 @exit(i32 0)
unreachable
18: ; preds = %12, %7
%19 = icmp slt i32 %0, 4
br i1 %19, label %20, label %22
20: ; preds = %18
%21 = tail call i32 @exit(i32 2)
unreachable
22: ; preds = %18
%23 = getelementptr inbounds i8*, i8** %1, i64 1
%24 = load i8*, i8** %23
%25 = load i8, i8* %24
%26 = icmp eq i8 %25, 45
br i1 %26, label %27, label %61
27: ; preds = %22, %56
%28 = phi i8* [ %58, %56 ], [ %24, %22 ]
%29 = phi i8** [ %57, %56 ], [ %23, %22 ]
%30 = getelementptr inbounds i8, i8* %28, i64 1
%31 = load i8, i8* %30
%32 = icmp eq i8 %31, 117
br i1 %32, label %33, label %56
33: ; preds = %27
%34 = getelementptr inbounds i8*, i8** %29, i64 1
%35 = load i8*, i8** %34
%36 = tail call i8* @strdup(i8* %35)
%37 = tail call %struct.passwd* @getpwnam(i8* %36)
%38 = icmp eq %struct.passwd* %37, null
br i1 %38, label %52, label %39
39: ; preds = %33
%40 = getelementptr inbounds %struct.passwd, %struct.passwd* %37, i64 0, i32 1
%41 = load i32, i32* %40
%42 = getelementptr inbounds %struct.passwd, %struct.passwd* %37, i64 0, i32 2
%43 = load i32, i32* %42
%44 = tail call i32 @setgid(i32 %43)
%45 = tail call i32 @setegid(i32 %43)
%46 = tail call i32 @setuid(i32 %41)
%47 = tail call i32 @seteuid(i32 %41)
%48 = tail call i32 @setgid(i32 %43)
%49 = tail call i32 @setegid(i32 %43)
%50 = tail call i32 @setuid(i32 %41)
%51 = tail call i32 @seteuid(i32 %41)
br label %56
52: ; preds = %33
%53 = load i32, i32* @stderr
%54 = tail call i32 @fprintf(i32 %53, i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.3, i64 0, i64 0), i8* %36)
%55 = tail call i32 @exit(i32 192)
unreachable
56: ; preds = %39, %27
%57 = getelementptr inbounds i8*, i8** %29, i64 2
%58 = load i8*, i8** %57
%59 = load i8, i8* %58
%60 = icmp eq i8 %59, 45
br i1 %60, label %27, label %61
61: ; preds = %56, %22
%62 = phi i8** [ %23, %22 ], [ %57, %56 ]
%63 = add nsw i32 %0, -1
%64 = tail call i32 @exec_command(i32 %63, i8** %62)
ret i32 0
}