#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int MAP_ANONYMOUS;
void *MAP_FAILED;
int MAP_PRIVATE;
int /*<<< orphan*/ PROT_NONE;
int PROT_READ;
int PROT_WRITE;
int /*<<< orphan*/ _SC_PAGESIZE;
int /*<<< orphan*/ execve(char *, char **, char **);
int /*<<< orphan*/ memset(char *, int /*<<< orphan*/, size_t const);
void *mmap(int /*<<< orphan*/ *, size_t const, int, int, int,
           int /*<<< orphan*/);
scalar_t__ mprotect(void *, size_t const, int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *, int, int /*<<< orphan*/);
int /*<<< orphan*/ puts(char *);
size_t sysconf(int /*<<< orphan*/);
int main(void) {
  const size_t page_len = sysconf(_SC_PAGESIZE);
  const size_t work_len = page_len * 2;
  const size_t tail_len = work_len - 1;
  void *p = mmap(NULL, page_len * 3, PROT_READ | PROT_WRITE,
                 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  if (p == MAP_FAILED || mprotect(p + work_len, page_len, PROT_NONE))
    return 77;
  memset(p, 0, work_len);
  char *addr = p + work_len - tail_len;
  memset(addr, '0', tail_len - 1);
  char *argv[] = {NULL};
  char *envp[] = {addr, NULL};
  execve("", argv, envp);
  printf(
      "execve(\"\", [], [\"%0*u\"]) = -1 ENOENT (No such file or directory)\n",
      (int)tail_len - 1, 0);
  puts("+++ exited with 0 +++");
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x50,%rsp
movl   $0x0,-0x4(%rbp)
mov    0x2e52(%rip),%rax
mov    (%rax),%edi
call   1090 <sysconf@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
shl    $0x1,%rax
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rax
sub    $0x1,%rax
mov    %rax,-0x20(%rbp)
imul   $0x3,-0x10(%rbp),%rsi
mov    0x2e43(%rip),%rax
mov    (%rax),%edx
mov    0x2e02(%rip),%rax
or     (%rax),%edx
mov    0x2df1(%rip),%rax
mov    (%rax),%ecx
mov    0x2e00(%rip),%rax
or     (%rax),%ecx
xor    %eax,%eax
mov    %eax,%edi
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1040 <mmap@plt>
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
mov    0x2dbd(%rip),%rcx
cmp    (%rcx),%rax
je     1220 <main+0xb0>
mov    -0x28(%rbp),%rdi
add    -0x18(%rbp),%rdi
mov    -0x10(%rbp),%rsi
mov    0x2dd9(%rip),%rax
mov    (%rax),%edx
call   1080 <mprotect@plt>
cmp    $0x0,%rax
je     122c <main+0xbc>
movl   $0x4d,-0x4(%rbp)
jmp    12c4 <main+0x154>
mov    -0x28(%rbp),%rdi
mov    -0x18(%rbp),%rdx
xor    %esi,%esi
call   1060 <memset@plt>
mov    -0x28(%rbp),%rax
add    -0x18(%rbp),%rax
xor    %ecx,%ecx
sub    -0x20(%rbp),%rcx
add    %rcx,%rax
mov    %rax,-0x30(%rbp)
mov    -0x30(%rbp),%rdi
mov    -0x20(%rbp),%rdx
sub    $0x1,%rdx
mov    $0x30,%esi
call   1060 <memset@plt>
lea    -0x38(%rbp),%rdi
xor    %esi,%esi
mov    $0x8,%edx
call   1060 <memset@plt>
mov    -0x30(%rbp),%rax
mov    %rax,-0x50(%rbp)
movq   $0x0,-0x48(%rbp)
lea    -0x38(%rbp),%rsi
lea    -0x50(%rbp),%rdx
lea    0xdac(%rip),%rdi
call   1070 <execve@plt>
mov    -0x20(%rbp),%rax
mov    %eax,%esi
sub    $0x1,%esi
lea    0xd56(%rip),%rdi
xor    %edx,%edx
call   1050 <printf@plt>
lea    0xd8a(%rip),%rdi
call   1030 <puts@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x50,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r14
push   %rbx
sub    $0x20,%rsp
mov    0x2e59(%rip),%rax
mov    (%rax),%edi
call   1090 <sysconf@plt>
mov    %rax,%rbx
lea    (%rax,%rax,2),%rsi
mov    0x2e64(%rip),%rax
mov    0x2e25(%rip),%rcx
mov    (%rcx),%edx
or     (%rax),%edx
mov    0x2e12(%rip),%rax
mov    0x2e23(%rip),%rcx
mov    (%rcx),%ecx
or     (%rax),%ecx
xor    %edi,%edi
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1040 <mmap@plt>
mov    %rax,%rbp
mov    0x2de5(%rip),%rax
mov    $0x4d,%r14d
cmp    (%rax),%rbp
je     1268 <main+0xf8>
mov    %rbx,%rsi
add    %rbx,%rbx
lea    (%rbx,%rbp,1),%rdi
mov    0x2dfd(%rip),%rax
mov    (%rax),%edx
call   1080 <mprotect@plt>
test   %rax,%rax
jne    1268 <main+0xf8>
xor    %r14d,%r14d
mov    %rbp,%rdi
xor    %esi,%esi
mov    %rbx,%rdx
call   1060 <memset@plt>
add    $0x1,%rbp
lea    -0x2(%rbx),%rdx
mov    %rbp,%rdi
mov    $0x30,%esi
call   1060 <memset@plt>
movq   $0x0,0x8(%rsp)
mov    %rbp,0x10(%rsp)
movq   $0x0,0x18(%rsp)
lea    0xe07(%rip),%rdi
lea    0x8(%rsp),%rsi
lea    0x10(%rsp),%rdx
call   1070 <execve@plt>
add    $0xfffffffe,%ebx
lea    0xdad(%rip),%rdi
mov    %ebx,%esi
xor    %edx,%edx
call   1050 <printf@plt>
lea    0xddf(%rip),%rdi
call   1030 <puts@plt>
mov    %r14d,%eax
add    $0x20,%rsp
pop    %rbx
pop    %r14
pop    %rbp
ret

LLVM IR (-O0):
@_SC_PAGESIZE = global i32 0
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_ANONYMOUS = global i32 0
@MAP_FAILED = global i8* null
@PROT_NONE = global i32 0
@.str = [1 x i8] zeroinitializer
@.str.1 = [66 x i8] c"execve(\22\22, [], [\22%0*u\22]) = -1 ENOENT (No such file or directory)\0A\00"
@.str.2 = [22 x i8] c"+++ exited with 0 +++\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i64
%3 = alloca i64
%4 = alloca i64
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca [1 x i8*]
%8 = alloca [2 x i8*]
store i32 0, i32* %1
%9 = load i32, i32* @_SC_PAGESIZE
%10 = call i64 @sysconf(i32 %9)
store i64 %10, i64* %2
%11 = load i64, i64* %2
%12 = mul i64 %11, 2
store i64 %12, i64* %3
%13 = load i64, i64* %3
%14 = sub i64 %13, 1
store i64 %14, i64* %4
%15 = load i64, i64* %2
%16 = mul i64 %15, 3
%17 = load i32, i32* @PROT_READ
%18 = load i32, i32* @PROT_WRITE
%19 = or i32 %17, %18
%20 = load i32, i32* @MAP_PRIVATE
%21 = load i32, i32* @MAP_ANONYMOUS
%22 = or i32 %20, %21
%23 = call i8* @mmap(i32* null, i64 %16, i32 %19, i32 %22, i32 -1, i32 0)
store i8* %23, i8** %5
%24 = load i8*, i8** %5
%25 = load i8*, i8** @MAP_FAILED
%26 = icmp eq i8* %24, %25
br i1 %26, label %35, label %27
27: ; preds = %0
%28 = load i8*, i8** %5
%29 = load i64, i64* %3
%30 = getelementptr i8, i8* %28, i64 %29
%31 = load i64, i64* %2
%32 = load i32, i32* @PROT_NONE
%33 = call i64 @mprotect(i8* %30, i64 %31, i32 %32)
%34 = icmp ne i64 %33, 0
br i1 %34, label %35, label %36
35: ; preds = %27, %0
store i32 77, i32* %1
br label %62
36: ; preds = %27
%37 = load i8*, i8** %5
%38 = load i64, i64* %3
%39 = call i32 @memset(i8* %37, i32 0, i64 %38)
%40 = load i8*, i8** %5
%41 = load i64, i64* %3
%42 = getelementptr i8, i8* %40, i64 %41
%43 = load i64, i64* %4
%44 = sub i64 0, %43
%45 = getelementptr i8, i8* %42, i64 %44
store i8* %45, i8** %6
%46 = load i8*, i8** %6
%47 = load i64, i64* %4
%48 = sub i64 %47, 1
%49 = call i32 @memset(i8* %46, i32 48, i64 %48)
%50 = bitcast [1 x i8*]* %7 to i8*
%51 = getelementptr inbounds [2 x i8*], [2 x i8*]* %8, i64 0, i64 0
%52 = load i8*, i8** %6
store i8* %52, i8** %51
%53 = getelementptr inbounds i8*, i8** %51, i64 1
store i8* null, i8** %53
%54 = getelementptr inbounds [1 x i8*], [1 x i8*]* %7, i64 0, i64 0
%55 = getelementptr inbounds [2 x i8*], [2 x i8*]* %8, i64 0, i64 0
%56 = call i32 @execve(i8* getelementptr inbounds ([1 x i8], [1 x i8]* @.str, i64 0, i64 0), i8** %54, i8** %55)
%57 = load i64, i64* %4
%58 = trunc i64 %57 to i32
%59 = sub nsw i32 %58, 1
%60 = call i32 @printf(i8* getelementptr inbounds ([66 x i8], [66 x i8]* @.str.1, i64 0, i64 0), i32 %59, i32 0)
%61 = call i32 @puts(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.2, i64 0, i64 0))
store i32 0, i32* %1
br label %62
62: ; preds = %36, %35
%63 = load i32, i32* %1
ret i32 %63
}

LLVM IR (-O2):
@_SC_PAGESIZE = global i32 0
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_ANONYMOUS = global i32 0
@MAP_FAILED = global i8* null
@PROT_NONE = global i32 0
@.str = [1 x i8] zeroinitializer
@.str.1 = [66 x i8] c"execve(\22\22, [], [\22%0*u\22]) = -1 ENOENT (No such file or directory)\0A\00"
@.str.2 = [22 x i8] c"+++ exited with 0 +++\00"
define i32 @main() {
%1 = alloca [1 x i8*]
%2 = alloca [2 x i8*]
%3 = load i32, i32* @_SC_PAGESIZE
%4 = tail call i64 @sysconf(i32 %3)
%5 = shl i64 %4, 1
%6 = mul i64 %4, 3
%7 = load i32, i32* @PROT_READ
%8 = load i32, i32* @PROT_WRITE
%9 = or i32 %8, %7
%10 = load i32, i32* @MAP_PRIVATE
%11 = load i32, i32* @MAP_ANONYMOUS
%12 = or i32 %11, %10
%13 = tail call i8* @mmap(i32* null, i64 %6, i32 %9, i32 %12, i32 -1, i32 0)
%14 = load i8*, i8** @MAP_FAILED
%15 = icmp eq i8* %13, %14
br i1 %15, label %37, label %16
16: ; preds = %0
%17 = getelementptr i8, i8* %13, i64 %5
%18 = load i32, i32* @PROT_NONE
%19 = tail call i64 @mprotect(i8* %17, i64 %4, i32 %18)
%20 = icmp eq i64 %19, 0
br i1 %20, label %21, label %37
21: ; preds = %16
%22 = tail call i32 @memset(i8* %13, i32 0, i64 %5)
%23 = getelementptr i8, i8* %13, i64 1
%24 = add i64 %5, -2
%25 = tail call i32 @memset(i8* %23, i32 48, i64 %24)
%26 = bitcast [1 x i8*]* %1 to i8*
%27 = bitcast [1 x i8*]* %1 to i64*
store i64 0, i64* %27
%28 = bitcast [2 x i8*]* %2 to i8*
%29 = getelementptr inbounds [2 x i8*], [2 x i8*]* %2, i64 0, i64 0
store i8* %23, i8** %29
%30 = getelementptr inbounds [2 x i8*], [2 x i8*]* %2, i64 0, i64 1
store i8* null, i8** %30
%31 = getelementptr inbounds [1 x i8*], [1 x i8*]* %1, i64 0, i64 0
%32 = call i32 @execve(i8* getelementptr inbounds ([1 x i8], [1 x i8]* @.str, i64 0, i64 0), i8** %31, i8** %29)
%33 = trunc i64 %5 to i32
%34 = add i32 %33, -2
%35 = call i32 @printf(i8* getelementptr inbounds ([66 x i8], [66 x i8]* @.str.1, i64 0, i64 0), i32 %34, i32 0)
%36 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([22 x i8], [22 x i8]* @.str.2, i64 0, i64 0))
br label %37
37: ; preds = %0, %16, %21
%38 = phi i32 [ 0, %21 ], [ 77, %16 ], [ 77, %0 ]
ret i32 %38
}