#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int pid_t;
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
int /*<<< orphan*/ EXIT_FAILURE;
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ exit(int /*<<< orphan*/);
int /*<<< orphan*/ *fgets(char *, int, int /*<<< orphan*/ *);
int /*<<< orphan*/ *fopen(char *, char *);
int getpid();
int getppid();
int mkstemp(char *);
int /*<<< orphan*/ printf(char *, int);
int sprintf(char *, char *, int, ...);
int /*<<< orphan*/ strcpy(char *, char *);
int /*<<< orphan*/ strlen(char *);
int write(int, char *, int /*<<< orphan*/);
int main(void) {
  FILE *fout;
  char tmp[32], buffer[128], status[128], buf[128];
  int fin = -1, bytes = 0;
  pid_t ppid = 0, pid = 0;
  strcpy(tmp, "/tmp/RCE_XXXXXX");
  fin = mkstemp(tmp);
  pid = getpid();
  ppid = getppid();
  sprintf(status, "/proc/%d/status", (int)ppid);
  fout = fopen(status, "ro");
  bytes = sprintf(buffer,
                  "ARGGHHH I've been executed! my pid is :%d Parent id %d\n",
                  pid, ppid);
  bytes = write(fin, buffer, strlen(buffer));
  if (bytes <= 0) {
    printf("ERROR something went wrong with write(): %d\n", bytes);
    exit(EXIT_FAILURE);
  }
  while (fgets(buf, 127, fout) != NULL) {
    bytes += write(fin, buf, strlen(buf));
  }
  if (bytes > 0)
    printf("Bytes written to file: %d\n", bytes);
  else
    printf("ERROR something went wrong with write(): %d\n", bytes);
  close(fin);
  close(fout);
  return (0);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x1e0,%rsp
movl   $0x0,-0x4(%rbp)
movl   $0xffffffff,-0x1b4(%rbp)
ff ff ff
movl   $0x0,-0x1b8(%rbp)
movl   $0x0,-0x1bc(%rbp)
movl   $0x0,-0x1c0(%rbp)
lea    -0x30(%rbp),%rdi
lea    0xdfb(%rip),%rsi
call   1030 <strcpy@plt>
lea    -0x30(%rbp),%rdi
call   10a0 <mkstemp@plt>
mov    %eax,-0x1b4(%rbp)
mov    $0x0,%al
call   1050 <getpid@plt>
mov    %eax,-0x1c0(%rbp)
mov    $0x0,%al
call   10d0 <getppid@plt>
mov    %eax,-0x1bc(%rbp)
lea    -0x130(%rbp),%rdi
mov    -0x1bc(%rbp),%edx
lea    0xdc9(%rip),%rsi
mov    $0x0,%al
call   10c0 <sprintf@plt>
lea    -0x130(%rbp),%rdi
lea    0xdc4(%rip),%rsi
call   10b0 <fopen@plt>
mov    %rax,-0x10(%rbp)
lea    -0xb0(%rbp),%rdi
mov    -0x1c0(%rbp),%edx
mov    -0x1bc(%rbp),%ecx
lea    0xda4(%rip),%rsi
mov    $0x0,%al
call   10c0 <sprintf@plt>
mov    %eax,-0x1b8(%rbp)
mov    -0x1b4(%rbp),%eax
mov    %eax,-0x1cc(%rbp)
lea    -0xb0(%rbp),%rax
mov    %rax,-0x1c8(%rbp)
lea    -0xb0(%rbp),%rdi
call   1060 <strlen@plt>
mov    -0x1cc(%rbp),%edi
mov    -0x1c8(%rbp),%rsi
mov    %eax,%edx
call   1040 <write@plt>
mov    %eax,-0x1b8(%rbp)
cmpl   $0x0,-0x1b8(%rbp)
jg     12f9 <main+0x139>
mov    -0x1b8(%rbp),%esi
lea    0xd75(%rip),%rdi
call   1070 <printf@plt>
mov    0x2cee(%rip),%rax
mov    (%rax),%edi
call   10e0 <exit@plt>
jmp    12fe <main+0x13e>
lea    -0x1b0(%rbp),%rdi
mov    -0x10(%rbp),%rdx
mov    $0x7f,%esi
call   1090 <fgets@plt>
cmp    $0x0,%rax
je     1368 <main+0x1a8>
mov    -0x1b4(%rbp),%eax
mov    %eax,-0x1dc(%rbp)
lea    -0x1b0(%rbp),%rax
mov    %rax,-0x1d8(%rbp)
lea    -0x1b0(%rbp),%rdi
call   1060 <strlen@plt>
mov    -0x1dc(%rbp),%edi
mov    -0x1d8(%rbp),%rsi
mov    %eax,%edx
call   1040 <write@plt>
add    -0x1b8(%rbp),%eax
mov    %eax,-0x1b8(%rbp)
jmp    12fe <main+0x13e>
cmpl   $0x0,-0x1b8(%rbp)
jle    138c <main+0x1cc>
mov    -0x1b8(%rbp),%esi
lea    0xd06(%rip),%rdi
call   1070 <printf@plt>
jmp    139e <main+0x1de>
mov    -0x1b8(%rbp),%esi
lea    0xcc2(%rip),%rdi
call   1070 <printf@plt>
mov    -0x1b4(%rbp),%edi
call   1080 <close@plt>
mov    -0x10(%rbp),%rax
mov    %eax,%edi
call   1080 <close@plt>
xor    %eax,%eax
add    $0x1e0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r12
push   %rbx
sub    $0x1a0,%rsp
lea    0xe2a(%rip),%rsi
mov    %rsp,%rbx
mov    %rbx,%rdi
call   1030 <strcpy@plt>
mov    %rbx,%rdi
call   10a0 <mkstemp@plt>
mov    %eax,%r14d
xor    %eax,%eax
call   1050 <getpid@plt>
mov    %eax,%r12d
xor    %eax,%eax
call   10d0 <getppid@plt>
mov    %eax,%ebp
lea    0xe0a(%rip),%rsi
lea    0xa0(%rsp),%rbx
mov    %rbx,%rdi
mov    %eax,%edx
xor    %eax,%eax
call   10c0 <sprintf@plt>
lea    0xdff(%rip),%rsi
mov    %rbx,%rdi
call   10b0 <fopen@plt>
mov    %rax,%r15
lea    0xdf0(%rip),%rsi
lea    0x120(%rsp),%rbx
mov    %rbx,%rdi
mov    %r12d,%edx
mov    %ebp,%ecx
xor    %eax,%eax
call   10c0 <sprintf@plt>
mov    %rbx,%rdi
call   1060 <strlen@plt>
mov    %r14d,%edi
mov    %rbx,%rsi
mov    %eax,%edx
call   1040 <write@plt>
mov    %eax,%ebp
test   %eax,%eax
jle    12f9 <main+0x139>
lea    0x20(%rsp),%rdi
mov    $0x7f,%esi
mov    %r15,%rdx
call   1090 <fgets@plt>
test   %rax,%rax
je     12c0 <main+0x100>
lea    0x20(%rsp),%rbx
cs nopw 0x0(%rax,%rax,1)
nop
mov    %rbx,%rdi
call   1060 <strlen@plt>
mov    %r14d,%edi
mov    %rbx,%rsi
mov    %eax,%edx
call   1040 <write@plt>
add    %eax,%ebp
mov    %rbx,%rdi
mov    $0x7f,%esi
mov    %r15,%rdx
call   1090 <fgets@plt>
test   %rax,%rax
jne    1290 <main+0xd0>
test   %ebp,%ebp
jle    12c9 <main+0x109>
lea    0xdc1(%rip),%rdi
jmp    12d0 <main+0x110>
lea    0xd8b(%rip),%rdi
mov    %ebp,%esi
call   1070 <printf@plt>
mov    %r14d,%edi
call   1080 <close@plt>
mov    %r15d,%edi
call   1080 <close@plt>
xor    %eax,%eax
add    $0x1a0,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0xd5b(%rip),%rdi
mov    %ebp,%esi
call   1070 <printf@plt>
mov    0x2cd2(%rip),%rax
mov    (%rax),%edi
call   10e0 <exit@plt>

LLVM IR (-O0):
@.str = [16 x i8] c"/tmp/RCE_XXXXXX\00"
@.str.1 = [16 x i8] c"/proc/%d/status\00"
@.str.2 = [3 x i8] c"ro\00"
@.str.3 = [56 x i8] c"ARGGHHH I've been executed! my pid is :%d Parent id %d\0A\00"
@.str.4 = [45 x i8] c"ERROR something went wrong with write(): %d\0A\00"
@EXIT_FAILURE = global i32 0
@.str.5 = [27 x i8] c"Bytes written to file: %d\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i32*
%3 = alloca [32 x i8]
%4 = alloca [128 x i8]
%5 = alloca [128 x i8]
%6 = alloca [128 x i8]
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
store i32 0, i32* %1
store i32 -1, i32* %7
store i32 0, i32* %8
store i32 0, i32* %9
store i32 0, i32* %10
%11 = getelementptr inbounds [32 x i8], [32 x i8]* %3, i64 0, i64 0
%12 = call i32 @strcpy(i8* %11, i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str, i64 0, i64 0))
%13 = getelementptr inbounds [32 x i8], [32 x i8]* %3, i64 0, i64 0
%14 = call i32 @mkstemp(i8* %13)
store i32 %14, i32* %7
%15 = call i32 (...) @getpid()
store i32 %15, i32* %10
%16 = call i32 (...) @getppid()
store i32 %16, i32* %9
%17 = getelementptr inbounds [128 x i8], [128 x i8]* %5, i64 0, i64 0
%18 = load i32, i32* %9
%19 = call i32 (i8*, i8*, i32, ...) @sprintf(i8* %17, i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.1, i64 0, i64 0), i32 %18)
%20 = getelementptr inbounds [128 x i8], [128 x i8]* %5, i64 0, i64 0
%21 = call i32* @fopen(i8* %20, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0))
store i32* %21, i32** %2
%22 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 0
%23 = load i32, i32* %10
%24 = load i32, i32* %9
%25 = call i32 (i8*, i8*, i32, ...) @sprintf(i8* %22, i8* getelementptr inbounds ([56 x i8], [56 x i8]* @.str.3, i64 0, i64 0), i32 %23, i32 %24)
store i32 %25, i32* %8
%26 = load i32, i32* %7
%27 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 0
%28 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 0
%29 = call i32 @strlen(i8* %28)
%30 = call i32 @write(i32 %26, i8* %27, i32 %29)
store i32 %30, i32* %8
%31 = load i32, i32* %8
%32 = icmp sle i32 %31, 0
br i1 %32, label %33, label %38
33: ; preds = %0
%34 = load i32, i32* %8
%35 = call i32 @printf(i8* getelementptr inbounds ([45 x i8], [45 x i8]* @.str.4, i64 0, i64 0), i32 %34)
%36 = load i32, i32* @EXIT_FAILURE
%37 = call i32 @exit(i32 %36)
unreachable
38: ; preds = %0
br label %39
39: ; preds = %44, %38
%40 = getelementptr inbounds [128 x i8], [128 x i8]* %6, i64 0, i64 0
%41 = load i32*, i32** %2
%42 = call i32* @fgets(i8* %40, i32 127, i32* %41)
%43 = icmp ne i32* %42, null
br i1 %43, label %44, label %52
44: ; preds = %39
%45 = load i32, i32* %7
%46 = getelementptr inbounds [128 x i8], [128 x i8]* %6, i64 0, i64 0
%47 = getelementptr inbounds [128 x i8], [128 x i8]* %6, i64 0, i64 0
%48 = call i32 @strlen(i8* %47)
%49 = call i32 @write(i32 %45, i8* %46, i32 %48)
%50 = load i32, i32* %8
%51 = add nsw i32 %50, %49
store i32 %51, i32* %8
br label %39
52: ; preds = %39
%53 = load i32, i32* %8
%54 = icmp sgt i32 %53, 0
br i1 %54, label %55, label %58
55: ; preds = %52
%56 = load i32, i32* %8
%57 = call i32 @printf(i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.5, i64 0, i64 0), i32 %56)
br label %61
58: ; preds = %52
%59 = load i32, i32* %8
%60 = call i32 @printf(i8* getelementptr inbounds ([45 x i8], [45 x i8]* @.str.4, i64 0, i64 0), i32 %59)
br label %61
61: ; preds = %58, %55
%62 = load i32, i32* %7
%63 = call i32 @close(i32 %62)
%64 = load i32*, i32** %2
%65 = ptrtoint i32* %64 to i32
%66 = call i32 @close(i32 %65)
ret i32 0
}

LLVM IR (-O2):
@.str = [16 x i8] c"/tmp/RCE_XXXXXX\00"
@.str.1 = [16 x i8] c"/proc/%d/status\00"
@.str.2 = [3 x i8] c"ro\00"
@.str.3 = [56 x i8] c"ARGGHHH I've been executed! my pid is :%d Parent id %d\0A\00"
@.str.4 = [45 x i8] c"ERROR something went wrong with write(): %d\0A\00"
@EXIT_FAILURE = global i32 0
@.str.5 = [27 x i8] c"Bytes written to file: %d\0A\00"
define i32 @main() {
%1 = alloca [32 x i8]
%2 = alloca [128 x i8]
%3 = alloca [128 x i8]
%4 = alloca [128 x i8]
%5 = getelementptr inbounds [32 x i8], [32 x i8]* %1, i64 0, i64 0
%6 = getelementptr inbounds [128 x i8], [128 x i8]* %2, i64 0, i64 0
%7 = getelementptr inbounds [128 x i8], [128 x i8]* %3, i64 0, i64 0
%8 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 0
%9 = call i32 @strcpy(i8* %5, i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str, i64 0, i64 0))
%10 = call i32 @mkstemp(i8* %5)
%11 = call i32 (...) @getpid()
%12 = call i32 (...) @getppid()
%13 = call i32 (i8*, i8*, i32, ...) @sprintf(i8* %7, i8* dereferenceable(1) getelementptr inbounds ([16 x i8], [16 x i8]* @.str.1, i64 0, i64 0), i32 %12)
%14 = call i32* @fopen(i8* %7, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0))
%15 = call i32 (i8*, i8*, i32, ...) @sprintf(i8* %6, i8* dereferenceable(1) getelementptr inbounds ([56 x i8], [56 x i8]* @.str.3, i64 0, i64 0), i32 %11, i32 %12)
%16 = call i32 @strlen(i8* %6)
%17 = call i32 @write(i32 %10, i8* %6, i32 %16)
%18 = icmp slt i32 %17, 1
br i1 %18, label %22, label %19
19: ; preds = %0
%20 = call i32* @fgets(i8* %8, i32 127, i32* %14)
%21 = icmp eq i32* %20, null
br i1 %21, label %35, label %26
22: ; preds = %0
%23 = call i32 @printf(i8* getelementptr inbounds ([45 x i8], [45 x i8]* @.str.4, i64 0, i64 0), i32 %17)
%24 = load i32, i32* @EXIT_FAILURE
%25 = call i32 @exit(i32 %24)
unreachable
26: ; preds = %19, %26
%27 = phi i32 [ %30, %26 ], [ %17, %19 ]
%28 = call i32 @strlen(i8* %8)
%29 = call i32 @write(i32 %10, i8* %8, i32 %28)
%30 = add nsw i32 %29, %27
%31 = call i32* @fgets(i8* %8, i32 127, i32* %14)
%32 = icmp eq i32* %31, null
br i1 %32, label %33, label %26
33: ; preds = %26
%34 = icmp sgt i32 %30, 0
br i1 %34, label %35, label %38
35: ; preds = %19, %33
%36 = phi i32 [ %30, %33 ], [ %17, %19 ]
%37 = call i32 @printf(i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.5, i64 0, i64 0), i32 %36)
br label %40
38: ; preds = %33
%39 = call i32 @printf(i8* getelementptr inbounds ([45 x i8], [45 x i8]* @.str.4, i64 0, i64 0), i32 %30)
br label %40
40: ; preds = %38, %35
%41 = call i32 @close(i32 %10)
%42 = ptrtoint i32* %14 to i64
%43 = trunc i64 %42 to i32
%44 = call i32 @close(i32 %43)
ret i32 0
}