#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ EPERM;
int /*<<< orphan*/ errno;
scalar_t__ is_licensed_prog();
int /*<<< orphan*/ is_permitted_rename(char const *, char const *);
scalar_t__ is_protected_entry(char const *);
int real_rename(char const *, char const *);
int evil_rename(const char *oldpath, const char *newpath) {
  int ret = 0;
  if (is_licensed_prog())
    goto green;
  if (is_protected_entry(oldpath))
    goto red;
  if (!is_protected_entry(newpath))
    goto green;
  if (!is_permitted_rename(oldpath, newpath))
    goto red;
green:
  ret = real_rename(oldpath, newpath);
  return ret;
red:
  errno = EPERM;
  return -1;
}


x86 assembly (clang, -O0):
<evil_rename>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
movl   $0x0,-0x1c(%rbp)
mov    $0x0,%al
call   1050 <is_licensed_prog@plt>
cmp    $0x0,%rax
je     116d <evil_rename+0x2d>
jmp    11bd <evil_rename+0x7d>
mov    -0x10(%rbp),%rdi
call   1040 <is_protected_entry@plt>
cmp    $0x0,%rax
je     1185 <evil_rename+0x45>
jmp    11d8 <evil_rename+0x98>
mov    -0x18(%rbp),%rdi
call   1040 <is_protected_entry@plt>
cmp    $0x0,%rax
jne    119d <evil_rename+0x5d>
jmp    11bd <evil_rename+0x7d>
mov    -0x10(%rbp),%rdi
mov    -0x18(%rbp),%rsi
call   1030 <is_permitted_rename@plt>
cmp    $0x0,%eax
jne    11b8 <evil_rename+0x78>
jmp    11d8 <evil_rename+0x98>
jmp    11bd <evil_rename+0x7d>
mov    -0x10(%rbp),%rdi
mov    -0x18(%rbp),%rsi
call   1060 <real_rename@plt>
mov    %eax,-0x1c(%rbp)
mov    -0x1c(%rbp),%eax
mov    %eax,-0x4(%rbp)
jmp    11f1 <evil_rename+0xb1>
mov    0x2df1(%rip),%rax
mov    (%rax),%ecx
mov    0x2df8(%rip),%rax
mov    %ecx,(%rax)
movl   $0xffffffff,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<evil_rename>:
push   %r14
push   %rbx
push   %rax
mov    %rsi,%r14
mov    %rdi,%rbx
xor    %eax,%eax
call   1050 <is_licensed_prog@plt>
test   %rax,%rax
je     1168 <evil_rename+0x28>
mov    %rbx,%rdi
mov    %r14,%rsi
add    $0x8,%rsp
pop    %rbx
pop    %r14
jmp    1060 <real_rename@plt>
mov    %rbx,%rdi
call   1040 <is_protected_entry@plt>
test   %rax,%rax
je     1194 <evil_rename+0x54>
mov    0x2e54(%rip),%rax
mov    (%rax),%eax
mov    0x2e5b(%rip),%rcx
mov    %eax,(%rcx)
mov    $0xffffffff,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
ret
mov    %r14,%rdi
call   1040 <is_protected_entry@plt>
test   %rax,%rax
je     1156 <evil_rename+0x16>
mov    %rbx,%rdi
mov    %r14,%rsi
call   1030 <is_permitted_rename@plt>
test   %eax,%eax
jne    1156 <evil_rename+0x16>
jmp    1175 <evil_rename+0x35>

LLVM IR (-O0):
@EPERM = global i32 0
@errno = global i32 0
define i32 @evil_rename(i8* %0, i8* %1) {
%3 = alloca i32
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i32
store i8* %0, i8** %4
store i8* %1, i8** %5
store i32 0, i32* %6
%7 = call i64 (...) @is_licensed_prog()
%8 = icmp ne i64 %7, 0
br i1 %8, label %9, label %10
9: ; preds = %2
br label %27
10: ; preds = %2
%11 = load i8*, i8** %4
%12 = call i64 @is_protected_entry(i8* %11)
%13 = icmp ne i64 %12, 0
br i1 %13, label %14, label %15
14: ; preds = %10
br label %32
15: ; preds = %10
%16 = load i8*, i8** %5
%17 = call i64 @is_protected_entry(i8* %16)
%18 = icmp ne i64 %17, 0
br i1 %18, label %20, label %19
19: ; preds = %15
br label %27
20: ; preds = %15
%21 = load i8*, i8** %4
%22 = load i8*, i8** %5
%23 = call i32 @is_permitted_rename(i8* %21, i8* %22)
%24 = icmp ne i32 %23, 0
br i1 %24, label %26, label %25
25: ; preds = %20
br label %32
26: ; preds = %20
br label %27
27: ; preds = %26, %19, %9
%28 = load i8*, i8** %4
%29 = load i8*, i8** %5
%30 = call i32 @real_rename(i8* %28, i8* %29)
store i32 %30, i32* %6
%31 = load i32, i32* %6
store i32 %31, i32* %3
br label %34
32: ; preds = %25, %14
%33 = load i32, i32* @EPERM
store i32 %33, i32* @errno
store i32 -1, i32* %3
br label %34
34: ; preds = %32, %27
%35 = load i32, i32* %3
ret i32 %35
}

LLVM IR (-O2):
@EPERM = global i32 0
@errno = global i32 0
define i32 @evil_rename(i8* %0, i8* %1) {
%3 = tail call i64 (...) @is_licensed_prog()
%4 = icmp eq i64 %3, 0
br i1 %4, label %5, label %14
5: ; preds = %2
%6 = tail call i64 @is_protected_entry(i8* %0)
%7 = icmp eq i64 %6, 0
br i1 %7, label %8, label %16
8: ; preds = %5
%9 = tail call i64 @is_protected_entry(i8* %1)
%10 = icmp eq i64 %9, 0
br i1 %10, label %14, label %11
11: ; preds = %8
%12 = tail call i32 @is_permitted_rename(i8* %0, i8* %1)
%13 = icmp eq i32 %12, 0
br i1 %13, label %16, label %14
14: ; preds = %11, %8, %2
%15 = tail call i32 @real_rename(i8* %0, i8* %1)
br label %18
16: ; preds = %11, %5
%17 = load i32, i32* @EPERM
store i32 %17, i32* @errno
br label %18
18: ; preds = %16, %14
%19 = phi i32 [ %15, %14 ], [ -1, %16 ]
ret i32 %19
}