#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int MAP_ANONYMOUS;
void *MAP_FAILED;
int MAP_PRIVATE;
int /*<<< orphan*/ PROT_NONE;
int PROT_READ;
int PROT_WRITE;
int /*<<< orphan*/ _SC_PAGESIZE;
scalar_t__ chdir(char *);
int /*<<< orphan*/ memset(char *, char, size_t const);
void *mmap(int /*<<< orphan*/ *, size_t const, int, int, int,
           int /*<<< orphan*/);
scalar_t__ mprotect(void *, size_t const, int /*<<< orphan*/);
size_t sysconf(int /*<<< orphan*/);
int main(void) {
  const size_t page_len = sysconf(_SC_PAGESIZE);
  const size_t tail_len = 257;
  if (tail_len >= page_len)
    return 77;
  void *p = mmap(NULL, page_len * 2, PROT_READ | PROT_WRITE,
                 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  if (p == MAP_FAILED || mprotect(p + page_len, page_len, PROT_NONE))
    return 77;
  memset(p, 0, page_len);
  char *addr = p + page_len - tail_len;
  memset(addr, '/', tail_len - 1);
  if (chdir(addr))
    return 77;
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
mov    0x2e72(%rip),%rax
mov    (%rax),%edi
call   1070 <sysconf@plt>
mov    %rax,-0x10(%rbp)
movq   $0x101,-0x18(%rbp)
mov    $0x101,%eax
cmp    -0x10(%rbp),%rax
jb     1194 <main+0x44>
movl   $0x4d,-0x4(%rbp)
jmp    1274 <main+0x124>
mov    -0x10(%rbp),%rsi
shl    $0x1,%rsi
mov    0x2e55(%rip),%rax
mov    (%rax),%edx
mov    0x2e14(%rip),%rax
or     (%rax),%edx
mov    0x2e03(%rip),%rax
mov    (%rax),%ecx
mov    0x2e12(%rip),%rax
or     (%rax),%ecx
xor    %eax,%eax
mov    %eax,%edi
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1040 <mmap@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rax
mov    0x2dcf(%rip),%rcx
cmp    (%rcx),%rax
je     120e <main+0xbe>
mov    -0x20(%rbp),%rdi
add    -0x10(%rbp),%rdi
mov    -0x10(%rbp),%rsi
mov    0x2deb(%rip),%rax
mov    (%rax),%edx
call   1060 <mprotect@plt>
cmp    $0x0,%rax
je     121a <main+0xca>
movl   $0x4d,-0x4(%rbp)
jmp    1274 <main+0x124>
mov    -0x20(%rbp),%rdi
mov    -0x10(%rbp),%rdx
xor    %esi,%esi
call   1050 <memset@plt>
mov    -0x20(%rbp),%rax
add    -0x10(%rbp),%rax
add    $0xfffffffffffffeff,%rax
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rdi
mov    $0x2f,%esi
mov    $0x100,%edx
call   1050 <memset@plt>
mov    -0x28(%rbp),%rdi
call   1030 <chdir@plt>
cmp    $0x0,%rax
je     126d <main+0x11d>
movl   $0x4d,-0x4(%rbp)
jmp    1274 <main+0x124>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r12
push   %rbx
mov    0x2e79(%rip),%rax
mov    (%rax),%edi
call   1070 <sysconf@plt>
mov    $0x4d,%r14d
cmp    $0x102,%rax
jb     121f <main+0xcf>
mov    %rax,%rbx
lea    (%rax,%rax,1),%rsi
mov    0x2e72(%rip),%rax
mov    0x2e33(%rip),%rcx
mov    (%rcx),%edx
or     (%rax),%edx
mov    0x2e20(%rip),%rax
mov    0x2e31(%rip),%rcx
mov    (%rcx),%ecx
or     (%rax),%ecx
xor    %edi,%edi
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1040 <mmap@plt>
mov    %rax,%rbp
mov    0x2df3(%rip),%rax
cmp    (%rax),%rbp
je     121f <main+0xcf>
mov    %rbx,%r15
add    %rbp,%r15
mov    0x2e19(%rip),%rax
mov    (%rax),%edx
mov    %r15,%rdi
mov    %rbx,%rsi
call   1060 <mprotect@plt>
test   %rax,%rax
jne    121f <main+0xcf>
xor    %r12d,%r12d
mov    %rbp,%rdi
xor    %esi,%esi
mov    %rbx,%rdx
call   1050 <memset@plt>
add    $0xfffffffffffffeff,%r15
mov    $0x100,%edx
mov    %r15,%rdi
mov    $0x2f,%esi
call   1050 <memset@plt>
mov    %r15,%rdi
call   1030 <chdir@plt>
test   %rax,%rax
mov    $0x4d,%r14d
cmove  %r12d,%r14d
mov    %r14d,%eax
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@_SC_PAGESIZE = global i32 0
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_ANONYMOUS = global i32 0
@MAP_FAILED = global i8* null
@PROT_NONE = global i32 0
define i32 @main() {
%1 = alloca i32
%2 = alloca i64
%3 = alloca i64
%4 = alloca i8*
%5 = alloca i8*
store i32 0, i32* %1
%6 = load i32, i32* @_SC_PAGESIZE
%7 = call i64 @sysconf(i32 %6)
store i64 %7, i64* %2
store i64 257, i64* %3
%8 = load i64, i64* %2
%9 = icmp uge i64 257, %8
br i1 %9, label %10, label %11
10: ; preds = %0
store i32 77, i32* %1
br label %48
11: ; preds = %0
%12 = load i64, i64* %2
%13 = mul i64 %12, 2
%14 = load i32, i32* @PROT_READ
%15 = load i32, i32* @PROT_WRITE
%16 = or i32 %14, %15
%17 = load i32, i32* @MAP_PRIVATE
%18 = load i32, i32* @MAP_ANONYMOUS
%19 = or i32 %17, %18
%20 = call i8* @mmap(i32* null, i64 %13, i32 %16, i32 %19, i32 -1, i32 0)
store i8* %20, i8** %4
%21 = load i8*, i8** %4
%22 = load i8*, i8** @MAP_FAILED
%23 = icmp eq i8* %21, %22
br i1 %23, label %32, label %24
24: ; preds = %11
%25 = load i8*, i8** %4
%26 = load i64, i64* %2
%27 = getelementptr i8, i8* %25, i64 %26
%28 = load i64, i64* %2
%29 = load i32, i32* @PROT_NONE
%30 = call i64 @mprotect(i8* %27, i64 %28, i32 %29)
%31 = icmp ne i64 %30, 0
br i1 %31, label %32, label %33
32: ; preds = %24, %11
store i32 77, i32* %1
br label %48
33: ; preds = %24
%34 = load i8*, i8** %4
%35 = load i64, i64* %2
%36 = call i32 @memset(i8* %34, i8 signext 0, i64 %35)
%37 = load i8*, i8** %4
%38 = load i64, i64* %2
%39 = getelementptr i8, i8* %37, i64 %38
%40 = getelementptr i8, i8* %39, i64 -257
store i8* %40, i8** %5
%41 = load i8*, i8** %5
%42 = call i32 @memset(i8* %41, i8 signext 47, i64 256)
%43 = load i8*, i8** %5
%44 = call i64 @chdir(i8* %43)
%45 = icmp ne i64 %44, 0
br i1 %45, label %46, label %47
46: ; preds = %33
store i32 77, i32* %1
br label %48
47: ; preds = %33
store i32 0, i32* %1
br label %48
48: ; preds = %47, %46, %32, %10
%49 = load i32, i32* %1
ret i32 %49
}

LLVM IR (-O2):
@_SC_PAGESIZE = global i32 0
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_ANONYMOUS = global i32 0
@MAP_FAILED = global i8* null
@PROT_NONE = global i32 0
define i32 @main() {
%1 = load i32, i32* @_SC_PAGESIZE
%2 = tail call i64 @sysconf(i32 %1)
%3 = icmp ult i64 %2, 258
br i1 %3, label %27, label %4
4: ; preds = %0
%5 = shl i64 %2, 1
%6 = load i32, i32* @PROT_READ
%7 = load i32, i32* @PROT_WRITE
%8 = or i32 %7, %6
%9 = load i32, i32* @MAP_PRIVATE
%10 = load i32, i32* @MAP_ANONYMOUS
%11 = or i32 %10, %9
%12 = tail call i8* @mmap(i32* null, i64 %5, i32 %8, i32 %11, i32 -1, i32 0)
%13 = load i8*, i8** @MAP_FAILED
%14 = icmp eq i8* %12, %13
br i1 %14, label %27, label %15
15: ; preds = %4
%16 = getelementptr i8, i8* %12, i64 %2
%17 = load i32, i32* @PROT_NONE
%18 = tail call i64 @mprotect(i8* %16, i64 %2, i32 %17)
%19 = icmp eq i64 %18, 0
br i1 %19, label %20, label %27
20: ; preds = %15
%21 = tail call i32 @memset(i8* %12, i8 signext 0, i64 %2)
%22 = getelementptr i8, i8* %16, i64 -257
%23 = tail call i32 @memset(i8* %22, i8 signext 47, i64 256)
%24 = tail call i64 @chdir(i8* %22)
%25 = icmp eq i64 %24, 0
%26 = select i1 %25, i32 0, i32 77
br label %27
27: ; preds = %20, %15, %4, %0
%28 = phi i32 [ 77, %0 ], [ %26, %20 ], [ 77, %15 ], [ 77, %4 ]
ret i32 %28
}