#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ rpath;

/* Variables and functions */
int EFAULT;
int ENOENT;
scalar_t__ ENOEXEC;
int PATH_MAX;
scalar_t__ errno;
int execve(char *, char *const *, char *const *);
int /*<<< orphan*/ resolve_path(char *, int, char const *);
int execvpe(const char *path, char *const argv[], char *const envv[]) {
  int retval;
  ;
  char rpath[PATH_MAX];
  if (!resolve_path(rpath, sizeof(rpath), path)) {
    return ENOENT;
  }
  retval = execve(rpath, argv, envv);
  if (retval != 0 && errno == ENOEXEC) {
    char *new_argv[4096];
    char **dp = (char **)new_argv;
    char **sp = (char **)argv;
    if (*sp == NULL) {
      return EFAULT;
    }
    *dp++ = *sp++;
    *dp++ = (char *)rpath;
    while (*sp != NULL) {
      if ((dp - new_argv) >= 4096)
        break;
      *dp++ = *sp++;
    }
    *dp++ = NULL;
    retval = execve("/bin/sh", new_argv, envv);
  }
  return retval;
}


x86 assembly (clang, -O0):
<execvpe>:
push   %rbp
mov    %rsp,%rbp
sub    $0x8060,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    0x2eaa(%rip),%rax
mov    (%rax),%eax
mov    %rsp,%rcx
mov    %rcx,-0x30(%rbp)
mov    %rax,%rcx
add    $0xf,%rcx
and    $0xfffffffffffffff0,%rcx
mov    %rsp,%rdi
sub    %rcx,%rdi
mov    %rdi,-0x8058(%rbp)
mov    %rdi,%rsp
mov    %rax,-0x38(%rbp)
mov    %eax,%esi
mov    -0x10(%rbp),%rdx
call   1040 <resolve_path@plt>
cmp    $0x0,%eax
jne    1192 <execvpe+0x72>
mov    0x2e37(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
movl   $0x1,-0x3c(%rbp)
jmp    130d <execvpe+0x1ed>
mov    -0x8058(%rbp),%rdi
mov    -0x18(%rbp),%rsi
mov    -0x20(%rbp),%rdx
call   1030 <execve@plt>
mov    %eax,-0x24(%rbp)
cmpl   $0x0,-0x24(%rbp)
je     1300 <execvpe+0x1e0>
mov    0x2e0e(%rip),%rax
mov    (%rax),%rax
mov    0x2e14(%rip),%rcx
cmp    (%rcx),%rax
jne    1300 <execvpe+0x1e0>
lea    -0x8040(%rbp),%rax
mov    %rax,-0x8048(%rbp)
mov    -0x18(%rbp),%rax
mov    %rax,-0x8050(%rbp)
mov    -0x8050(%rbp),%rax
cmpq   $0x0,(%rax)
jne    120f <execvpe+0xef>
mov    0x2dfa(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
movl   $0x1,-0x3c(%rbp)
jmp    130d <execvpe+0x1ed>
mov    -0x8058(%rbp),%rcx
mov    -0x8050(%rbp),%rax
mov    %rax,%rdx
add    $0x8,%rdx
mov    %rdx,-0x8050(%rbp)
mov    (%rax),%rdx
mov    -0x8048(%rbp),%rax
mov    %rax,%rsi
add    $0x8,%rsi
mov    %rsi,-0x8048(%rbp)
mov    %rdx,(%rax)
mov    -0x8048(%rbp),%rax
mov    %rax,%rdx
add    $0x8,%rdx
mov    %rdx,-0x8048(%rbp)
mov    %rcx,(%rax)
mov    -0x8050(%rbp),%rax
cmpq   $0x0,(%rax)
je     12ca <execvpe+0x1aa>
mov    -0x8048(%rbp),%rax
lea    -0x8040(%rbp),%rcx
sub    %rcx,%rax
sar    $0x3,%rax
cmp    $0x1000,%rax
jl     1295 <execvpe+0x175>
jmp    12ca <execvpe+0x1aa>
mov    -0x8050(%rbp),%rax
mov    %rax,%rcx
add    $0x8,%rcx
mov    %rcx,-0x8050(%rbp)
mov    (%rax),%rcx
mov    -0x8048(%rbp),%rax
mov    %rax,%rdx
add    $0x8,%rdx
mov    %rdx,-0x8048(%rbp)
mov    %rcx,(%rax)
jmp    125e <execvpe+0x13e>
mov    -0x8048(%rbp),%rax
mov    %rax,%rcx
add    $0x8,%rcx
mov    %rcx,-0x8048(%rbp)
movq   $0x0,(%rax)
lea    -0x8040(%rbp),%rsi
mov    -0x20(%rbp),%rdx
lea    0xd08(%rip),%rdi
call   1030 <execve@plt>
mov    %eax,-0x24(%rbp)
mov    -0x24(%rbp),%eax
mov    %eax,-0x4(%rbp)
movl   $0x1,-0x3c(%rbp)
mov    -0x30(%rbp),%rax
mov    %rax,%rsp
mov    -0x4(%rbp),%eax
mov    %rbp,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<execvpe>:
push   %rbp
mov    %rsp,%rbp
push   %r15
push   %r14
push   %rbx
sub    $0x8008,%rsp
mov    %rdx,%r14
mov    %rsi,%r15
mov    %rdi,%rdx
mov    0x2ea8(%rip),%rax
mov    (%rax),%esi
mov    %rsp,%rbx
mov    %rsi,%rax
add    $0xf,%rax
and    $0xfffffffffffffff0,%rax
sub    %rax,%rbx
mov    %rbx,%rsp
mov    %rbx,%rdi
call   1040 <resolve_path@plt>
test   %eax,%eax
je     11ea <execvpe+0xca>
mov    %rbx,%rdi
mov    %r15,%rsi
mov    %r14,%rdx
call   1030 <execve@plt>
test   %eax,%eax
je     11f5 <execvpe+0xd5>
mov    0x2e45(%rip),%rcx
mov    (%rcx),%rcx
mov    0x2e4b(%rip),%rdx
cmp    (%rdx),%rcx
jne    1228 <execvpe+0x108>
mov    (%r15),%rax
test   %rax,%rax
je     11f9 <execvpe+0xd9>
mov    %rax,-0x8020(%rbp)
mov    %rbx,-0x8018(%rbp)
mov    0x8(%r15),%rax
test   %rax,%rax
je     1204 <execvpe+0xe4>
mov    $0x10,%ecx
nopw   0x0(%rax,%rax,1)
mov    %rax,-0x8020(%rbp,%rcx,1)
ff
mov    (%r15,%rcx,1),%rax
add    $0x8,%rcx
test   %rax,%rax
je     11de <execvpe+0xbe>
cmp    $0x7ff9,%rcx
jl     11c0 <execvpe+0xa0>
lea    (%rcx,%rbp,1),%rax
add    $0xffffffffffff7fe0,%rax
jmp    120b <execvpe+0xeb>
mov    0x2dc7(%rip),%rax
mov    (%rax),%eax
jmp    1228 <execvpe+0x108>
xor    %eax,%eax
jmp    1228 <execvpe+0x108>
mov    0x2df8(%rip),%rax
mov    (%rax),%eax
jmp    1228 <execvpe+0x108>
lea    -0x8010(%rbp),%rax
movq   $0x0,(%rax)
lea    0xde7(%rip),%rdi
lea    -0x8020(%rbp),%rsi
mov    %r14,%rdx
call   1030 <execve@plt>
lea    -0x18(%rbp),%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@PATH_MAX = global i32 0
@ENOENT = global i32 0
@errno = global i64 0
@ENOEXEC = global i64 0
@EFAULT = global i32 0
@.str = [8 x i8] c"/bin/sh\00"
define i32 @execvpe(i8* %0, i8** %1, i8** %2) {
%4 = alloca i32
%5 = alloca i8*
%6 = alloca i8**
%7 = alloca i8**
%8 = alloca i32
%9 = alloca i8*
%10 = alloca i64
%11 = alloca i32
%12 = alloca [4096 x i8*]
%13 = alloca i8**
%14 = alloca i8**
store i8* %0, i8** %5
store i8** %1, i8*** %6
store i8** %2, i8*** %7
%15 = load i32, i32* @PATH_MAX
%16 = zext i32 %15 to i64
%17 = call i8* @llvm.stacksave()
store i8* %17, i8** %9
%18 = alloca i8, i64 %16
store i64 %16, i64* %10
%19 = trunc i64 %16 to i32
%20 = load i8*, i8** %5
%21 = call i32 @resolve_path(i8* %18, i32 %19, i8* %20)
%22 = icmp ne i32 %21, 0
br i1 %22, label %25, label %23
23: ; preds = %3
%24 = load i32, i32* @ENOENT
store i32 %24, i32* %4
store i32 1, i32* %11
br label %78
25: ; preds = %3
%26 = load i8**, i8*** %6
%27 = load i8**, i8*** %7
%28 = call i32 @execve(i8* %18, i8** %26, i8** %27)
store i32 %28, i32* %8
%29 = load i32, i32* %8
%30 = icmp ne i32 %29, 0
br i1 %30, label %31, label %76
31: ; preds = %25
%32 = load i64, i64* @errno
%33 = load i64, i64* @ENOEXEC
%34 = icmp eq i64 %32, %33
br i1 %34, label %35, label %76
35: ; preds = %31
%36 = getelementptr inbounds [4096 x i8*], [4096 x i8*]* %12, i64 0, i64 0
store i8** %36, i8*** %13
%37 = load i8**, i8*** %6
store i8** %37, i8*** %14
%38 = load i8**, i8*** %14
%39 = load i8*, i8** %38
%40 = icmp eq i8* %39, null
br i1 %40, label %41, label %43
41: ; preds = %35
%42 = load i32, i32* @EFAULT
store i32 %42, i32* %4
store i32 1, i32* %11
br label %78
43: ; preds = %35
%44 = load i8**, i8*** %14
%45 = getelementptr inbounds i8*, i8** %44, i32 1
store i8** %45, i8*** %14
%46 = load i8*, i8** %44
%47 = load i8**, i8*** %13
%48 = getelementptr inbounds i8*, i8** %47, i32 1
store i8** %48, i8*** %13
store i8* %46, i8** %47
%49 = load i8**, i8*** %13
%50 = getelementptr inbounds i8*, i8** %49, i32 1
store i8** %50, i8*** %13
store i8* %18, i8** %49
br label %51
51: ; preds = %64, %43
%52 = load i8**, i8*** %14
%53 = load i8*, i8** %52
%54 = icmp ne i8* %53, null
br i1 %54, label %55, label %70
55: ; preds = %51
%56 = load i8**, i8*** %13
%57 = getelementptr inbounds [4096 x i8*], [4096 x i8*]* %12, i64 0, i64 0
%58 = ptrtoint i8** %56 to i64
%59 = ptrtoint i8** %57 to i64
%60 = sub i64 %58, %59
%61 = sdiv exact i64 %60, 8
%62 = icmp sge i64 %61, 4096
br i1 %62, label %63, label %64
63: ; preds = %55
br label %70
64: ; preds = %55
%65 = load i8**, i8*** %14
%66 = getelementptr inbounds i8*, i8** %65, i32 1
store i8** %66, i8*** %14
%67 = load i8*, i8** %65
%68 = load i8**, i8*** %13
%69 = getelementptr inbounds i8*, i8** %68, i32 1
store i8** %69, i8*** %13
store i8* %67, i8** %68
br label %51
70: ; preds = %63, %51
%71 = load i8**, i8*** %13
%72 = getelementptr inbounds i8*, i8** %71, i32 1
store i8** %72, i8*** %13
store i8* null, i8** %71
%73 = getelementptr inbounds [4096 x i8*], [4096 x i8*]* %12, i64 0, i64 0
%74 = load i8**, i8*** %7
%75 = call i32 @execve(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8** %73, i8** %74)
store i32 %75, i32* %8
br label %76
76: ; preds = %70, %31, %25
%77 = load i32, i32* %8
store i32 %77, i32* %4
store i32 1, i32* %11
br label %78
78: ; preds = %76, %41, %23
%79 = load i8*, i8** %9
%80 = load i32, i32* %4
ret i32 %80
}

LLVM IR (-O2):
@PATH_MAX = global i32 0
@ENOENT = global i32 0
@errno = global i64 0
@ENOEXEC = global i64 0
@EFAULT = global i32 0
@.str = [8 x i8] c"/bin/sh\00"
define i32 @execvpe(i8* %0, i8** %1, i8** %2) {
%4 = alloca [4096 x i8*]
%5 = load i32, i32* @PATH_MAX
%6 = zext i32 %5 to i64
%7 = alloca i8, i64 %6
%8 = call i32 @resolve_path(i8* %7, i32 %5, i8* %0)
%9 = icmp eq i32 %8, 0
br i1 %9, label %10, label %12
10: ; preds = %3
%11 = load i32, i32* @ENOENT
br label %48
12: ; preds = %3
%13 = call i32 @execve(i8* %7, i8** %1, i8** %2)
%14 = icmp eq i32 %13, 0
br i1 %14, label %48, label %15
15: ; preds = %12
%16 = load i64, i64* @errno
%17 = load i64, i64* @ENOEXEC
%18 = icmp eq i64 %16, %17
br i1 %18, label %19, label %48
19: ; preds = %15
%20 = bitcast [4096 x i8*]* %4 to i8*
%21 = getelementptr inbounds [4096 x i8*], [4096 x i8*]* %4, i64 0, i64 0
%22 = load i8*, i8** %1
%23 = icmp eq i8* %22, null
br i1 %23, label %24, label %26
24: ; preds = %19
%25 = load i32, i32* @EFAULT
br label %48
26: ; preds = %19
%27 = getelementptr inbounds [4096 x i8*], [4096 x i8*]* %4, i64 0, i64 1
store i8* %22, i8** %21
%28 = getelementptr inbounds [4096 x i8*], [4096 x i8*]* %4, i64 0, i64 2
store i8* %7, i8** %27
%29 = ptrtoint [4096 x i8*]* %4 to i64
%30 = getelementptr inbounds i8*, i8** %1, i64 1
%31 = load i8*, i8** %30
%32 = icmp eq i8* %31, null
br i1 %32, label %45, label %33
33: ; preds = %26, %33
%34 = phi i8* [ %39, %33 ], [ %31, %26 ]
%35 = phi i8** [ %38, %33 ], [ %30, %26 ]
%36 = phi i8** [ %37, %33 ], [ %28, %26 ]
%37 = getelementptr inbounds i8*, i8** %36, i64 1
store i8* %34, i8** %36
%38 = getelementptr inbounds i8*, i8** %35, i64 1
%39 = load i8*, i8** %38
%40 = icmp eq i8* %39, null
%41 = ptrtoint i8** %37 to i64
%42 = sub i64 %41, %29
%43 = icmp sgt i64 %42, 32760
%44 = select i1 %40, i1 true, i1 %43
br i1 %44, label %45, label %33
45: ; preds = %33, %26
%46 = phi i8** [ %28, %26 ], [ %37, %33 ]
store i8* null, i8** %46
%47 = call i32 @execve(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8** %21, i8** %2)
br label %48
48: ; preds = %45, %12, %15, %24, %10
%49 = phi i32 [ %11, %10 ], [ %25, %24 ], [ %47, %45 ], [ %13, %15 ], [ 0, %12 ]
ret i32 %49
}