#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int uid_t;
struct passwd {
  int /*<<< orphan*/ pw_name;
};
typedef int pid_t;
typedef int gid_t;

/* Variables and functions */
int EX_NOPERM;
int errno;
int /*<<< orphan*/ execve(char *, char **, char **);
int /*<<< orphan*/ execvp(char *, char **);
int /*<<< orphan*/ exit(int);
int fork();
struct passwd *getpwuid(int);
scalar_t__ initgroups(int /*<<< orphan*/, int);
char *malloc(int);
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ printf(char *, ...);
scalar_t__ setgid(int);
scalar_t__ setuid(int);
int /*<<< orphan*/ strcat(char *, char *);
int main(int argc, char *argv[], char *envp[]) {
  int i;
  char *cmdline;
  char *cmd[8];
  pid_t pid;
  uid_t uid = 29999;
  gid_t gid = 29999;
  cmdline = malloc(sizeof(char) * 256);
  for (i = 1; i < argc; i++) {
    strcat(cmdline, argv[i]);
    strcat(cmdline, " ");
    cmd[i - 1] = argv[i];
  }
  cmd[i] = NULL;
  printf("prepare for fork!\n");
  pid = fork();
  if (pid == -1) {
    printf("Forking failed! Exiting\n");
    exit(1);
  } else if (pid == 0) {
    struct passwd *pass;
    printf("Child process sucessfully spawned\n");
    pass = getpwuid(uid);
    if (pass == NULL)
      exit(EX_NOPERM);
    if (setgid(gid))
      exit(EX_NOPERM);
    if (initgroups(pass->pw_name, gid))
      exit(EX_NOPERM);
    if (setuid(uid))
      exit(EX_NOPERM);
    if (envp != NULL) {
      execve(argv[1], &argv[1], envp);
      perror("env? error");
      printf("errno = %d\n", errno);
    } else
      execvp(argv[1], cmd);
    printf("execution failed!\n");
    exit(0);
  } else {
    printf("program %s should be forked. Exiting!\n", cmdline);
    exit(0);
  }
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x90,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
movl   $0x752f,-0x78(%rbp)
movl   $0x752f,-0x7c(%rbp)
mov    $0x100,%edi
call   1060 <malloc@plt>
mov    %rax,-0x28(%rbp)
movl   $0x1,-0x1c(%rbp)
mov    -0x1c(%rbp),%eax
cmp    -0x8(%rbp),%eax
jge    1258 <main+0x98>
mov    -0x28(%rbp),%rdi
mov    -0x10(%rbp),%rax
movslq -0x1c(%rbp),%rcx
mov    (%rax,%rcx,8),%rsi
call   10a0 <strcat@plt>
mov    -0x28(%rbp),%rdi
lea    0xdd4(%rip),%rsi
call   10a0 <strcat@plt>
mov    -0x10(%rbp),%rax
movslq -0x1c(%rbp),%rcx
mov    (%rax,%rcx,8),%rcx
mov    -0x1c(%rbp),%eax
sub    $0x1,%eax
cltq
mov    %rcx,-0x70(%rbp,%rax,8)
mov    -0x1c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c(%rbp)
jmp    1200 <main+0x40>
movslq -0x1c(%rbp),%rax
movq   $0x0,-0x70(%rbp,%rax,8)
lea    0xd96(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    $0x0,%al
call   10e0 <fork@plt>
mov    %eax,-0x74(%rbp)
cmpl   $0xffffffff,-0x74(%rbp)
jne    129f <main+0xdf>
lea    0xd87(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    $0x1,%edi
call   10b0 <exit@plt>
cmpl   $0x0,-0x74(%rbp)
jne    13bd <main+0x1fd>
lea    0xd7e(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x78(%rbp),%edi
call   1030 <getpwuid@plt>
mov    %rax,-0x88(%rbp)
cmpq   $0x0,-0x88(%rbp)
jne    12e2 <main+0x122>
mov    0x2d0d(%rip),%rax
mov    (%rax),%edi
call   10b0 <exit@plt>
mov    -0x7c(%rbp),%edi
call   1070 <setgid@plt>
cmp    $0x0,%rax
je     1302 <main+0x142>
mov    0x2ced(%rip),%rax
mov    (%rax),%edi
call   10b0 <exit@plt>
mov    -0x88(%rbp),%rax
mov    (%rax),%edi
mov    -0x7c(%rbp),%esi
call   10d0 <initgroups@plt>
cmp    $0x0,%rax
je     132b <main+0x16b>
mov    0x2cc4(%rip),%rax
mov    (%rax),%edi
call   10b0 <exit@plt>
mov    -0x78(%rbp),%edi
call   10c0 <setuid@plt>
cmp    $0x0,%rax
je     134b <main+0x18b>
mov    0x2ca4(%rip),%rax
mov    (%rax),%edi
call   10b0 <exit@plt>
cmpq   $0x0,-0x18(%rbp)
je     1397 <main+0x1d7>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
mov    -0x10(%rbp),%rsi
add    $0x8,%rsi
mov    -0x18(%rbp),%rdx
call   1050 <execve@plt>
lea    0xcdb(%rip),%rdi
call   1080 <perror@plt>
mov    0x2c56(%rip),%rax
mov    (%rax),%esi
lea    0xcd1(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
jmp    13a8 <main+0x1e8>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
lea    -0x70(%rbp),%rsi
call   1090 <execvp@plt>
lea    0xcb9(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
xor    %edi,%edi
call   10b0 <exit@plt>
mov    -0x28(%rbp),%rsi
lea    0xcb3(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
xor    %edi,%edi
call   10b0 <exit@plt>

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x58,%rsp
mov    %rdx,%r14
mov    %rsi,%r15
mov    %edi,%ebp
mov    $0x100,%edi
call   1070 <malloc@plt>
mov    %rax,%rbx
mov    $0x1,%r13d
cmp    $0x2,%ebp
jl     1250 <main+0x80>
mov    %r14,0x8(%rsp)
mov    %ebp,%r13d
lea    -0x1(%r13),%rbp
xor    %r14d,%r14d
lea    0xdec(%rip),%r12
cs nopw 0x0(%rax,%rax,1)
xchg   %ax,%ax
mov    0x8(%r15,%r14,8),%rsi
mov    %rbx,%rdi
call   10b0 <strcat@plt>
mov    %rbx,%rdi
mov    %r12,%rsi
call   10b0 <strcat@plt>
mov    0x8(%r15,%r14,8),%rax
mov    %rax,0x10(%rsp,%r14,8)
add    $0x1,%r14
cmp    %r14,%rbp
jne    1220 <main+0x50>
mov    0x8(%rsp),%r14
movq   $0x0,0x10(%rsp,%r13,8)
lea    0xde0(%rip),%rdi
call   1030 <puts@plt>
xor    %eax,%eax
call   10f0 <fork@plt>
test   %eax,%eax
je     128f <main+0xbf>
cmp    $0xffffffff,%eax
jne    1332 <main+0x162>
lea    0xe06(%rip),%rdi
call   1030 <puts@plt>
mov    $0x1,%edi
call   10c0 <exit@plt>
lea    0xdbc(%rip),%rdi
call   1030 <puts@plt>
mov    $0x752f,%edi
call   1040 <getpwuid@plt>
test   %rax,%rax
je     134a <main+0x17a>
mov    %rax,%rbx
mov    $0x752f,%edi
call   1080 <setgid@plt>
test   %rax,%rax
jne    134a <main+0x17a>
mov    (%rbx),%edi
mov    $0x752f,%esi
call   10e0 <initgroups@plt>
test   %rax,%rax
jne    134a <main+0x17a>
mov    $0x752f,%edi
call   10d0 <setuid@plt>
test   %rax,%rax
jne    134a <main+0x17a>
mov    0x8(%r15),%rdi
test   %r14,%r14
je     1358 <main+0x188>
add    $0x8,%r15
mov    %r15,%rsi
mov    %r14,%rdx
call   1060 <execve@plt>
lea    0xcff(%rip),%rdi
call   1090 <perror@plt>
mov    0x2cc9(%rip),%rax
mov    (%rax),%esi
lea    0xcf5(%rip),%rdi
xor    %eax,%eax
call   1050 <printf@plt>
lea    0xd4e(%rip),%rdi
call   1030 <puts@plt>
xor    %edi,%edi
call   10c0 <exit@plt>
lea    0xce0(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1050 <printf@plt>
xor    %edi,%edi
call   10c0 <exit@plt>
mov    0x2c97(%rip),%rax
mov    (%rax),%edi
call   10c0 <exit@plt>
lea    0x10(%rsp),%rsi
call   10a0 <execvp@plt>
jmp    131f <main+0x14f>

LLVM IR (-O0):
%struct.passwd = type { i32 }
@.str = [2 x i8] c" \00"
@.str.1 = [19 x i8] c"prepare for fork!\0A\00"
@.str.2 = [25 x i8] c"Forking failed! Exiting\0A\00"
@.str.3 = [35 x i8] c"Child process sucessfully spawned\0A\00"
@EX_NOPERM = global i32 0
@.str.4 = [11 x i8] c"env? error\00"
@.str.5 = [12 x i8] c"errno = %d\0A\00"
@errno = global i32 0
@.str.6 = [19 x i8] c"execution failed!\0A\00"
@.str.7 = [39 x i8] c"program %s should be forked. Exiting!\0A\00"
define i32 @main(i32 %0, i8** %1, i8** %2) {
%4 = alloca i32
%5 = alloca i32
%6 = alloca i8**
%7 = alloca i8**
%8 = alloca i32
%9 = alloca i8*
%10 = alloca [8 x i8*]
%11 = alloca i32
%12 = alloca i32
%13 = alloca i32
%14 = alloca %struct.passwd*
store i32 0, i32* %4
store i32 %0, i32* %5
store i8** %1, i8*** %6
store i8** %2, i8*** %7
store i32 29999, i32* %12
store i32 29999, i32* %13
%15 = call i8* @malloc(i32 256)
store i8* %15, i8** %9
store i32 1, i32* %8
br label %16
16: ; preds = %39, %3
%17 = load i32, i32* %8
%18 = load i32, i32* %5
%19 = icmp slt i32 %17, %18
br i1 %19, label %20, label %42
20: ; preds = %16
%21 = load i8*, i8** %9
%22 = load i8**, i8*** %6
%23 = load i32, i32* %8
%24 = sext i32 %23 to i64
%25 = getelementptr inbounds i8*, i8** %22, i64 %24
%26 = load i8*, i8** %25
%27 = call i32 @strcat(i8* %21, i8* %26)
%28 = load i8*, i8** %9
%29 = call i32 @strcat(i8* %28, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
%30 = load i8**, i8*** %6
%31 = load i32, i32* %8
%32 = sext i32 %31 to i64
%33 = getelementptr inbounds i8*, i8** %30, i64 %32
%34 = load i8*, i8** %33
%35 = load i32, i32* %8
%36 = sub nsw i32 %35, 1
%37 = sext i32 %36 to i64
%38 = getelementptr inbounds [8 x i8*], [8 x i8*]* %10, i64 0, i64 %37
store i8* %34, i8** %38
br label %39
39: ; preds = %20
%40 = load i32, i32* %8
%41 = add nsw i32 %40, 1
store i32 %41, i32* %8
br label %16
42: ; preds = %16
%43 = load i32, i32* %8
%44 = sext i32 %43 to i64
%45 = getelementptr inbounds [8 x i8*], [8 x i8*]* %10, i64 0, i64 %44
store i8* null, i8** %45
%46 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.1, i64 0, i64 0))
%47 = call i32 (...) @fork()
store i32 %47, i32* %11
%48 = load i32, i32* %11
%49 = icmp eq i32 %48, -1
br i1 %49, label %50, label %53
50: ; preds = %42
%51 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.2, i64 0, i64 0))
%52 = call i32 @exit(i32 1)
unreachable
53: ; preds = %42
%54 = load i32, i32* %11
%55 = icmp eq i32 %54, 0
br i1 %55, label %56, label %112
56: ; preds = %53
%57 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([35 x i8], [35 x i8]* @.str.3, i64 0, i64 0))
%58 = load i32, i32* %12
%59 = call %struct.passwd* @getpwuid(i32 %58)
store %struct.passwd* %59, %struct.passwd** %14
%60 = load %struct.passwd*, %struct.passwd** %14
%61 = icmp eq %struct.passwd* %60, null
br i1 %61, label %62, label %65
62: ; preds = %56
%63 = load i32, i32* @EX_NOPERM
%64 = call i32 @exit(i32 %63)
unreachable
65: ; preds = %56
%66 = load i32, i32* %13
%67 = call i64 @setgid(i32 %66)
%68 = icmp ne i64 %67, 0
br i1 %68, label %69, label %72
69: ; preds = %65
%70 = load i32, i32* @EX_NOPERM
%71 = call i32 @exit(i32 %70)
unreachable
72: ; preds = %65
%73 = load %struct.passwd*, %struct.passwd** %14
%74 = getelementptr inbounds %struct.passwd, %struct.passwd* %73, i32 0, i32 0
%75 = load i32, i32* %74
%76 = load i32, i32* %13
%77 = call i64 @initgroups(i32 %75, i32 %76)
%78 = icmp ne i64 %77, 0
br i1 %78, label %79, label %82
79: ; preds = %72
%80 = load i32, i32* @EX_NOPERM
%81 = call i32 @exit(i32 %80)
unreachable
82: ; preds = %72
%83 = load i32, i32* %12
%84 = call i64 @setuid(i32 %83)
%85 = icmp ne i64 %84, 0
br i1 %85, label %86, label %89
86: ; preds = %82
%87 = load i32, i32* @EX_NOPERM
%88 = call i32 @exit(i32 %87)
unreachable
89: ; preds = %82
%90 = load i8**, i8*** %7
%91 = icmp ne i8** %90, null
br i1 %91, label %92, label %103
92: ; preds = %89
%93 = load i8**, i8*** %6
%94 = getelementptr inbounds i8*, i8** %93, i64 1
%95 = load i8*, i8** %94
%96 = load i8**, i8*** %6
%97 = getelementptr inbounds i8*, i8** %96, i64 1
%98 = load i8**, i8*** %7
%99 = call i32 @execve(i8* %95, i8** %97, i8** %98)
%100 = call i32 @perror(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.4, i64 0, i64 0))
%101 = load i32, i32* @errno
%102 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.5, i64 0, i64 0), i32 %101)
br label %109
103: ; preds = %89
%104 = load i8**, i8*** %6
%105 = getelementptr inbounds i8*, i8** %104, i64 1
%106 = load i8*, i8** %105
%107 = getelementptr inbounds [8 x i8*], [8 x i8*]* %10, i64 0, i64 0
%108 = call i32 @execvp(i8* %106, i8** %107)
br label %109
109: ; preds = %103, %92
%110 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.6, i64 0, i64 0))
%111 = call i32 @exit(i32 0)
unreachable
112: ; preds = %53
%113 = load i8*, i8** %9
%114 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([39 x i8], [39 x i8]* @.str.7, i64 0, i64 0), i8* %113)
%115 = call i32 @exit(i32 0)
unreachable
}

LLVM IR (-O2):
%struct.passwd = type { i32 }
@.str = [2 x i8] c" \00"
@EX_NOPERM = global i32 0
@.str.4 = [11 x i8] c"env? error\00"
@.str.5 = [12 x i8] c"errno = %d\0A\00"
@errno = global i32 0
@.str.7 = [39 x i8] c"program %s should be forked. Exiting!\0A\00"
@str = [18 x i8] c"prepare for fork!\00"
@str.8 = [34 x i8] c"Child process sucessfully spawned\00"
@str.9 = [18 x i8] c"execution failed!\00"
@str.10 = [24 x i8] c"Forking failed! Exiting\00"
define i32 @main(i32 %0, i8** %1, i8** %2) {
%4 = alloca [8 x i8*]
%5 = bitcast [8 x i8*]* %4 to i8*
%6 = tail call dereferenceable_or_null(256) i8* @malloc(i32 256)
%7 = icmp sgt i32 %0, 1
br i1 %7, label %8, label %23
8: ; preds = %3
%9 = zext i32 %0 to i64
br label %10
10: ; preds = %8, %10
%11 = phi i64 [ 1, %8 ], [ %19, %10 ]
%12 = getelementptr inbounds i8*, i8** %1, i64 %11
%13 = load i8*, i8** %12
%14 = tail call i32 @strcat(i8* %6, i8* %13)
%15 = tail call i32 @strcat(i8* %6, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
%16 = load i8*, i8** %12
%17 = add nsw i64 %11, -1
%18 = getelementptr inbounds [8 x i8*], [8 x i8*]* %4, i64 0, i64 %17
store i8* %16, i8** %18
%19 = add nuw nsw i64 %11, 1
%20 = icmp eq i64 %19, %9
br i1 %20, label %21, label %10
21: ; preds = %10
%22 = zext i32 %0 to i64
br label %23
23: ; preds = %3, %21
%24 = phi i64 [ %22, %21 ], [ 1, %3 ]
%25 = getelementptr inbounds [8 x i8*], [8 x i8*]* %4, i64 0, i64 %24
store i8* null, i8** %25
%26 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([18 x i8], [18 x i8]* @str, i64 0, i64 0))
%27 = tail call i32 (...) @fork()
switch i32 %27, label %73 [
i32 -1, label %28
i32 0, label %31
]
28: ; preds = %23
%29 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([24 x i8], [24 x i8]* @str.10, i64 0, i64 0))
%30 = tail call i32 @exit(i32 1)
unreachable
31: ; preds = %23
%32 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([34 x i8], [34 x i8]* @str.8, i64 0, i64 0))
%33 = tail call %struct.passwd* @getpwuid(i32 29999)
%34 = icmp eq %struct.passwd* %33, null
br i1 %34, label %35, label %38
35: ; preds = %31
%36 = load i32, i32* @EX_NOPERM
%37 = tail call i32 @exit(i32 %36)
unreachable
38: ; preds = %31
%39 = tail call i64 @setgid(i32 29999)
%40 = icmp eq i64 %39, 0
br i1 %40, label %44, label %41
41: ; preds = %38
%42 = load i32, i32* @EX_NOPERM
%43 = tail call i32 @exit(i32 %42)
unreachable
44: ; preds = %38
%45 = getelementptr inbounds %struct.passwd, %struct.passwd* %33, i64 0, i32 0
%46 = load i32, i32* %45
%47 = tail call i64 @initgroups(i32 %46, i32 29999)
%48 = icmp eq i64 %47, 0
br i1 %48, label %52, label %49
49: ; preds = %44
%50 = load i32, i32* @EX_NOPERM
%51 = tail call i32 @exit(i32 %50)
unreachable
52: ; preds = %44
%53 = tail call i64 @setuid(i32 29999)
%54 = icmp eq i64 %53, 0
br i1 %54, label %58, label %55
55: ; preds = %52
%56 = load i32, i32* @EX_NOPERM
%57 = tail call i32 @exit(i32 %56)
unreachable
58: ; preds = %52
%59 = icmp eq i8** %2, null
%60 = getelementptr inbounds i8*, i8** %1, i64 1
%61 = load i8*, i8** %60
br i1 %59, label %67, label %62
62: ; preds = %58
%63 = tail call i32 @execve(i8* %61, i8** %60, i8** %2)
%64 = tail call i32 @perror(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.4, i64 0, i64 0))
%65 = load i32, i32* @errno
%66 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([12 x i8], [12 x i8]* @.str.5, i64 0, i64 0), i32 %65)
br label %70
67: ; preds = %58
%68 = getelementptr inbounds [8 x i8*], [8 x i8*]* %4, i64 0, i64 0
%69 = call i32 @execvp(i8* %61, i8** %68)
br label %70
70: ; preds = %67, %62
%71 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([18 x i8], [18 x i8]* @str.9, i64 0, i64 0))
%72 = call i32 @exit(i32 0)
unreachable
73: ; preds = %23
%74 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([39 x i8], [39 x i8]* @.str.7, i64 0, i64 0), i8* %6)
%75 = tail call i32 @exit(i32 0)
unreachable
}