#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int execve(char *, char **, char **);
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ setuid(int /*<<< orphan*/);
int main(int argc, char **argv, char **envp) {
  char *cpprog[] = {"/bin/cp", "/var/log/squid/access.log",
                    "/scsi/scsi/logs/access.log", NULL};
  setuid(0);
  int ret = execve(cpprog[0], cpprog, envp);
  if (ret == -1) {
    perror("No se pudo copiar el archivo");
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x50,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
mov    0x2caf(%rip),%rax
mov    %rax,-0x40(%rbp)
mov    0x2cac(%rip),%rax
mov    %rax,-0x38(%rbp)
mov    0x2ca9(%rip),%rax
mov    %rax,-0x30(%rbp)
mov    0x2ca6(%rip),%rax
mov    %rax,-0x28(%rbp)
xor    %edi,%edi
call   1050 <setuid@plt>
mov    -0x40(%rbp),%rdi
lea    -0x40(%rbp),%rsi
mov    -0x18(%rbp),%rdx
call   1030 <execve@plt>
mov    %eax,-0x44(%rbp)
cmpl   $0xffffffff,-0x44(%rbp)
jne    11a7 <main+0x77>
lea    0xe9b(%rip),%rdi
call   1040 <perror@plt>
xor    %eax,%eax
add    $0x50,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbx
sub    $0x20,%rsp
mov    %rdx,%rbx
movaps 0x2cd1(%rip),%xmm0
movaps %xmm0,0x10(%rsp)
movaps 0x2cb5(%rip),%xmm0
movaps %xmm0,(%rsp)
xor    %edi,%edi
call   1050 <setuid@plt>
lea    0xea3(%rip),%rdi
mov    %rsp,%rsi
mov    %rbx,%rdx
call   1030 <execve@plt>
cmp    $0xffffffff,%eax
je     1175 <main+0x45>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbx
ret
lea    0xec1(%rip),%rdi
call   1040 <perror@plt>
jmp    116d <main+0x3d>

LLVM IR (-O0):
@.str = [8 x i8] c"/bin/cp\00"
@.str.1 = [26 x i8] c"/var/log/squid/access.log\00"
@.str.2 = [27 x i8] c"/scsi/scsi/logs/access.log\00"
@__const.main.cpprog = [4 x i8*] [i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i32 0, i32 0), i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.1, i32 0, i32 0), i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.2, i32 0, i32 0), i8* null]
@.str.3 = [29 x i8] c"No se pudo copiar el archivo\00"
define i32 @main(i32 %0, i8** %1, i8** %2) {
%4 = alloca i32
%5 = alloca i32
%6 = alloca i8**
%7 = alloca i8**
%8 = alloca [4 x i8*]
%9 = alloca i32
store i32 0, i32* %4
store i32 %0, i32* %5
store i8** %1, i8*** %6
store i8** %2, i8*** %7
%10 = bitcast [4 x i8*]* %8 to i8*
%11 = call i32 @setuid(i32 0)
%12 = getelementptr inbounds [4 x i8*], [4 x i8*]* %8, i64 0, i64 0
%13 = load i8*, i8** %12
%14 = getelementptr inbounds [4 x i8*], [4 x i8*]* %8, i64 0, i64 0
%15 = load i8**, i8*** %7
%16 = call i32 @execve(i8* %13, i8** %14, i8** %15)
store i32 %16, i32* %9
%17 = load i32, i32* %9
%18 = icmp eq i32 %17, -1
br i1 %18, label %19, label %21
19: ; preds = %3
%20 = call i32 @perror(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.3, i64 0, i64 0))
br label %21
21: ; preds = %19, %3
ret i32 0
}

LLVM IR (-O2):
@.str = [8 x i8] c"/bin/cp\00"
@.str.1 = [26 x i8] c"/var/log/squid/access.log\00"
@.str.2 = [27 x i8] c"/scsi/scsi/logs/access.log\00"
@__const.main.cpprog = [4 x i8*] [i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i32 0, i32 0), i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.1, i32 0, i32 0), i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.2, i32 0, i32 0), i8* null]
@.str.3 = [29 x i8] c"No se pudo copiar el archivo\00"
define i32 @main(i32 %0, i8** nocapture readnone %1, i8** %2) {
%4 = alloca [4 x i8*]
%5 = bitcast [4 x i8*]* %4 to i8*
%6 = tail call i32 @setuid(i32 0)
%7 = getelementptr inbounds [4 x i8*], [4 x i8*]* %4, i64 0, i64 0
%8 = call i32 @execve(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8** %7, i8** %2)
%9 = icmp eq i32 %8, -1
br i1 %9, label %10, label %12
10: ; preds = %3
%11 = call i32 @perror(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.3, i64 0, i64 0))
br label %12
12: ; preds = %10, %3
ret i32 0
}