From nobody Sat Jul 25 12:05:38 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=proton.me ARC-Seal: i=1; a=rsa-sha256; t=1784525843; cv=none; d=zohomail.com; s=zohoarc; b=buVHq1vnvvQfOeZiBFrnrGa7+qzwir970n2Z67OdyjbbSgRcIs/PZh4ZHVjO0Saiv9FQpKM468UA/EJq0W13pxsq8KfueIs0+p3iP7XJ5faL9ASE4nolLV6BFoH/8Ys2UWa2MBagjCRANXwDVs5y5lJ04Ga2AvChNRUnbGGFRR4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784525843; h=Content-Type:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=1CVJh1VpO1q+MjKfhop+zMQKbmDMsrr2llgR+aHSdDY=; b=BkmrwABuY7CUJ97mJKV/2D90/kweZ0Yuiv5MlP14eHsve2VP+x2449+KDa2kp8E0/RPfltjg4csuNZtz46A7hRZVEGy9kznRxVSnPOxG4TCtbiTcxMDdBm76t3+Zv2N5bcBDeLCfMgfWcsITBqSxRaV38y7bYiqhtUyMqR2J3FE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784525843001147.03473991023532; Sun, 19 Jul 2026 22:37:23 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wlggj-0002x4-6B; Mon, 20 Jul 2026 01:37:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wlggX-0002wd-DU for qemu-devel@nongnu.org; Mon, 20 Jul 2026 01:37:01 -0400 Received: from mail-06.mail-europe.com ([85.9.210.45]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wlggS-0000Ku-UL for qemu-devel@nongnu.org; Mon, 20 Jul 2026 01:37:01 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=proton.me; s=protonmail; t=1784525801; x=1784785001; bh=1CVJh1VpO1q+MjKfhop+zMQKbmDMsrr2llgR+aHSdDY=; h=Date:To:From:Cc:Subject:Message-ID:Feedback-ID:From:To:Cc:Date: Subject:Reply-To:Feedback-ID:Message-ID:BIMI-Selector; b=el6gBi/hawc+EENgkoiZZnVOk1aRmQw5w+ZRzpEbdzeBan3C1qGsBKKHeLZUyxYwF Nxoq2/Fnj8C9Y2OQZTt7R8bFhGkC4qM0y0wL8ZTMl1UCxjUB/Iq6uZER6Miea9vF1Z eCPTNlkfL/TvOvkp2pCKy2yXvlIl5NRtPGhhmWxEFD+a0Q1LCu3P21A5kjBySQIlk1 hggzug/INe/SV2SYYXKPGxBS4VF9yTldGcGVzeBMhlT0G9qISap5QY4wEVGJaCx7I2 vl6jIVLXQbaC7sDrEHibfjQxCZC3BpQoZtDyw60GiTDcHUjFIIiYnoYEWxhaMQgMS0 XshLRUPr802AA== Date: Mon, 20 Jul 2026 05:36:37 +0000 To: "qemu-devel@nongnu.org" From: Feifan Qian Cc: "sgarzare@redhat.com" , "aesteve@redhat.com" Subject: [PATCH] vhost-user: check memory slot availability for SHMEM_MAP Message-ID: Feedback-ID: 93226294:user:proton X-Pm-Message-ID: 41234652a30ea369145ff2a195c3a53cf730df16 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="b1=_XrikHZjrrzXiIk0oNUQgiHpzYjQ2ZeiBUytQkVmybI" Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=85.9.210.45; envelope-from=bea1e@proton.me; helo=mail-06.mail-europe.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @proton.me) X-ZM-MESSAGEID: 1784525845372158500 --b1=_XrikHZjrrzXiIk0oNUQgiHpzYjQ2ZeiBUytQkVmybI Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" SHMEM_MAP creates a separate RAM MemoryRegion for every mapping. It can therefore make a vhost-user memory table exceed the number of slots negotiated with the backend. The region reconciliation code then indexes fixed-size bookkeeping arrays past their end. Reject a mapping before changing the memory topology if KVM or a vhost backend has no unreserved slot left. Also validate each memory table against the negotiated vhost-user limit as a final defense for mappings that become visible in a later memory transaction. Fixes: b52e1896e764 ("vhost-user: Add VirtIO Shared Memory map request") Signed-off-by: Feifan Qian --- Tested with an ASan/UBSan x86_64 build and a vhost-user backend that mapped one-page SHMEM regions up to the 512-slot limit. The next SHMEM_MAP request was rejected and QEMU remained alive. Before this patch, the same reproducer reported an out-of-bounds write at found[512] in scrub_shadow_regions(). qtest-x86_64/qos-test also passed all 140 subtests. hw/virtio/vhost-user.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c index 517cc4ca71..7f141c116b 100644 --- a/hw/virtio/vhost-user.c +++ b/hw/virtio/vhost-user.c @@ -10,6 +10,7 @@ #include "qemu/osdep.h" #include "qapi/error.h" +#include "hw/mem/memory-device.h" #include "hw/virtio/virtio-dmabuf.h" #include "hw/virtio/virtio-qmp.h" #include "hw/virtio/vhost.h" @@ -1123,6 +1124,13 @@ static int vhost_user_set_mem_table(struct vhost_dev= *dev, dev, VHOST_USER_PROTOCOL_F_CONFIGURE_MEM_SLOTS); int ret; + if (mem->nregions > u->user->memory_slots) { + error_report("vhost-user memory table has %u regions, " + "but the backend supports only %d", + mem->nregions, u->user->memory_slots); + return -ENOSPC; + } + if (do_postcopy) { /* * Postcopy has enough differences that it's best done in it's own @@ -1937,6 +1945,7 @@ vhost_user_backend_handle_shmem_map(struct vhost_dev = *dev, VhostUserMMap *vu_mmap =3D &payload->mmap; VirtioSharedMemoryMapping *existing; Error *local_err =3D NULL; + unsigned int reserved_memslots; int ret =3D 0; if (fd < 0) { @@ -1977,6 +1986,15 @@ vhost_user_backend_handle_shmem_map(struct vhost_dev= *dev, } } + reserved_memslots =3D memory_devices_get_reserved_memslots(); + if ((kvm_enabled() && + kvm_get_free_memslots() <=3D reserved_memslots) || + vhost_get_free_memslots() <=3D reserved_memslots) { + error_report("No free memory slots for shared memory mapping"); + ret =3D -ENOSPC; + goto send_reply; + } + memory_region_transaction_begin(); /* Create VirtioSharedMemoryMapping object */ --2.43.0 --b1=_XrikHZjrrzXiIk0oNUQgiHpzYjQ2ZeiBUytQkVmybI Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 PGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6IEFyaWFsLCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDE0 cHg7Ij48L2Rpdj48c3Bhbj5TSE1FTV9NQVAgY3JlYXRlcyBhIHNlcGFyYXRlIFJBTSBNZW1vcnlS ZWdpb24gZm9yIGV2ZXJ5IG1hcHBpbmcuIEl0IGNhbjwvc3Bhbj48ZGl2PjxzcGFuPnRoZXJlZm9y ZSBtYWtlIGEgdmhvc3QtdXNlciBtZW1vcnkgdGFibGUgZXhjZWVkIHRoZSBudW1iZXIgb2Ygc2xv dHM8L3NwYW4+PC9kaXY+PGRpdj48c3Bhbj5uZWdvdGlhdGVkIHdpdGggdGhlIGJhY2tlbmQuIFRo ZSByZWdpb24gcmVjb25jaWxpYXRpb24gY29kZSB0aGVuIGluZGV4ZXM8L3NwYW4+PC9kaXY+PGRp dj48c3Bhbj5maXhlZC1zaXplIGJvb2trZWVwaW5nIGFycmF5cyBwYXN0IHRoZWlyIGVuZC48L3Nw YW4+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj48c3Bhbj5SZWplY3QgYSBtYXBwaW5nIGJlZm9y ZSBjaGFuZ2luZyB0aGUgbWVtb3J5IHRvcG9sb2d5IGlmIEtWTSBvciBhIHZob3N0PC9zcGFuPjwv ZGl2PjxkaXY+PHNwYW4+YmFja2VuZCBoYXMgbm8gdW5yZXNlcnZlZCBzbG90IGxlZnQuIEFsc28g dmFsaWRhdGUgZWFjaCBtZW1vcnkgdGFibGU8L3NwYW4+PC9kaXY+PGRpdj48c3Bhbj5hZ2FpbnN0 IHRoZSBuZWdvdGlhdGVkIHZob3N0LXVzZXIgbGltaXQgYXMgYSBmaW5hbCBkZWZlbnNlIGZvciBt YXBwaW5nczwvc3Bhbj48L2Rpdj48ZGl2PjxzcGFuPnRoYXQgYmVjb21lIHZpc2libGUgaW4gYSBs YXRlciBtZW1vcnkgdHJhbnNhY3Rpb24uPC9zcGFuPjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+ PHNwYW4+Rml4ZXM6IGI1MmUxODk2ZTc2NCAoInZob3N0LXVzZXI6IEFkZCBWaXJ0SU8gU2hhcmVk IE1lbW9yeSBtYXAgcmVxdWVzdCIpPC9zcGFuPjwvZGl2PjxkaXY+PHNwYW4+U2lnbmVkLW9mZi1i eTogRmVpZmFuIFFpYW4gJmx0OzxhIHRhcmdldD0iX2JsYW5rIiByZWw9Im5vcmVmZXJyZXIgbm9m b2xsb3cgbm9vcGVuZXIiIGhyZWY9Im1haWx0bzpiZWExZUBwcm90b24ubWUiPmJlYTFlQHByb3Rv bi5tZTwvYT4mZ3Q7PC9zcGFuPjwvZGl2PjxkaXY+PHNwYW4+LS0tPC9zcGFuPjwvZGl2PjxkaXY+ PHNwYW4+VGVzdGVkIHdpdGggYW4gQVNhbi9VQlNhbiB4ODZfNjQgYnVpbGQgYW5kIGEgdmhvc3Qt dXNlciBiYWNrZW5kIHRoYXQ8L3NwYW4+PC9kaXY+PGRpdj48c3Bhbj5tYXBwZWQgb25lLXBhZ2Ug U0hNRU0gcmVnaW9ucyB1cCB0byB0aGUgNTEyLXNsb3QgbGltaXQuICZuYnNwO1RoZSBuZXh0PC9z cGFuPjwvZGl2PjxkaXY+PHNwYW4+U0hNRU1fTUFQIHJlcXVlc3Qgd2FzIHJlamVjdGVkIGFuZCBR RU1VIHJlbWFpbmVkIGFsaXZlLiAmbmJzcDtCZWZvcmUgdGhpczwvc3Bhbj48L2Rpdj48ZGl2Pjxz cGFuPnBhdGNoLCB0aGUgc2FtZSByZXByb2R1Y2VyIHJlcG9ydGVkIGFuIG91dC1vZi1ib3VuZHMg d3JpdGUgYXQgZm91bmRbNTEyXTwvc3Bhbj48L2Rpdj48ZGl2PjxzcGFuPmluIHNjcnViX3NoYWRv d19yZWdpb25zKCkuICZuYnNwO3F0ZXN0LXg4Nl82NC9xb3MtdGVzdCBhbHNvIHBhc3NlZCBhbGwg MTQwPC9zcGFuPjwvZGl2PjxkaXY+PHNwYW4+c3VidGVzdHMuPC9zcGFuPjwvZGl2PjxkaXY+PGJy PjwvZGl2PjxkaXY+PHNwYW4+Jm5ic3A7aHcvdmlydGlvL3Zob3N0LXVzZXIuYyB8IDE4ICsrKysr KysrKysrKysrKysrKzwvc3Bhbj48L2Rpdj48ZGl2PjxzcGFuPiZuYnNwOzEgZmlsZSBjaGFuZ2Vk LCAxOCBpbnNlcnRpb25zKCspPC9zcGFuPjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+PHNwYW4+ ZGlmZiAtLWdpdCBhL2h3L3ZpcnRpby92aG9zdC11c2VyLmMgYi9ody92aXJ0aW8vdmhvc3QtdXNl ci5jPC9zcGFuPjwvZGl2PjxkaXY+PHNwYW4+aW5kZXggNTE3Y2M0Y2E3MS4uN2YxNDFjMTE2YiAx MDA2NDQ8L3NwYW4+PC9kaXY+PGRpdj48c3Bhbj4tLS0gYS9ody92aXJ0aW8vdmhvc3QtdXNlci5j PC9zcGFuPjwvZGl2PjxkaXY+PHNwYW4+KysrIGIvaHcvdmlydGlvL3Zob3N0LXVzZXIuYzwvc3Bh bj48L2Rpdj48ZGl2PjxzcGFuPkBAIC0xMCw2ICsxMCw3IEBAPC9zcGFuPjwvZGl2PjxkaXY+PGJy PjwvZGl2PjxkaXY+PHNwYW4+Jm5ic3A7I2luY2x1ZGUgInFlbXUvb3NkZXAuaCI8L3NwYW4+PC9k aXY+PGRpdj48c3Bhbj4mbmJzcDsjaW5jbHVkZSAicWFwaS9lcnJvci5oIjwvc3Bhbj48L2Rpdj48 ZGl2PjxzcGFuPisjaW5jbHVkZSAiaHcvbWVtL21lbW9yeS1kZXZpY2UuaCI8L3NwYW4+PC9kaXY+ PGRpdj48c3Bhbj4mbmJzcDsjaW5jbHVkZSAiaHcvdmlydGlvL3ZpcnRpby1kbWFidWYuaCI8L3Nw YW4+PC9kaXY+PGRpdj48c3Bhbj4mbmJzcDsjaW5jbHVkZSAiaHcvdmlydGlvL3ZpcnRpby1xbXAu aCI8L3NwYW4+PC9kaXY+PGRpdj48c3Bhbj4mbmJzcDsjaW5jbHVkZSAiaHcvdmlydGlvL3Zob3N0 LmgiPC9zcGFuPjwvZGl2PjxkaXY+PHNwYW4+QEAgLTExMjMsNiArMTEyNCwxMyBAQCBzdGF0aWMg aW50IHZob3N0X3VzZXJfc2V0X21lbV90YWJsZShzdHJ1Y3Qgdmhvc3RfZGV2ICpkZXYsPC9zcGFu PjwvZGl2PjxkaXY+PHNwYW4+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ZGV2LCBWSE9TVF9VU0VSX1BST1RPQ09MX0ZfQ09ORklHVVJFX01FTV9TTE9UUyk7 PC9zcGFuPjwvZGl2PjxkaXY+PHNwYW4+Jm5ic3A7ICZuYnNwOyAmbmJzcDtpbnQgcmV0Ozwvc3Bh bj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PjxzcGFuPisgJm5ic3A7ICZuYnNwO2lmIChtZW0t Jmd0O25yZWdpb25zICZndDsgdS0mZ3Q7dXNlci0mZ3Q7bWVtb3J5X3Nsb3RzKSB7PC9zcGFuPjwv ZGl2PjxkaXY+PHNwYW4+KyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDtlcnJvcl9yZXBvcnQo InZob3N0LXVzZXIgbWVtb3J5IHRhYmxlIGhhcyAldSByZWdpb25zLCAiPC9zcGFuPjwvZGl2Pjxk aXY+PHNwYW4+KyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgImJ1dCB0aGUgYmFja2VuZCBzdXBwb3J0cyBvbmx5ICVk Iiw8L3NwYW4+PC9kaXY+PGRpdj48c3Bhbj4rICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBtZW0tJmd0O25yZWdpb25z LCB1LSZndDt1c2VyLSZndDttZW1vcnlfc2xvdHMpOzwvc3Bhbj48L2Rpdj48ZGl2PjxzcGFuPisg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7cmV0dXJuIC1FTk9TUEM7PC9zcGFuPjwvZGl2Pjxk aXY+PHNwYW4+KyAmbmJzcDsgJm5ic3A7fTwvc3Bhbj48L2Rpdj48ZGl2PjxzcGFuPis8L3NwYW4+ PC9kaXY+PGRpdj48c3Bhbj4mbmJzcDsgJm5ic3A7ICZuYnNwO2lmIChkb19wb3N0Y29weSkgezwv c3Bhbj48L2Rpdj48ZGl2PjxzcGFuPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsv Kjwvc3Bhbj48L2Rpdj48ZGl2PjxzcGFuPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgKiBQb3N0Y29weSBoYXMgZW5vdWdoIGRpZmZlcmVuY2VzIHRoYXQgaXQncyBiZXN0IGRvbmUg aW4gaXQncyBvd248L3NwYW4+PC9kaXY+PGRpdj48c3Bhbj5AQCAtMTkzNyw2ICsxOTQ1LDcgQEAg dmhvc3RfdXNlcl9iYWNrZW5kX2hhbmRsZV9zaG1lbV9tYXAoc3RydWN0IHZob3N0X2RldiAqZGV2 LDwvc3Bhbj48L2Rpdj48ZGl2PjxzcGFuPiZuYnNwOyAmbmJzcDsgJm5ic3A7Vmhvc3RVc2VyTU1h cCAqdnVfbW1hcCA9ICZhbXA7cGF5bG9hZC0mZ3Q7bW1hcDs8L3NwYW4+PC9kaXY+PGRpdj48c3Bh bj4mbmJzcDsgJm5ic3A7ICZuYnNwO1ZpcnRpb1NoYXJlZE1lbW9yeU1hcHBpbmcgKmV4aXN0aW5n Ozwvc3Bhbj48L2Rpdj48ZGl2PjxzcGFuPiZuYnNwOyAmbmJzcDsgJm5ic3A7RXJyb3IgKmxvY2Fs X2VyciA9IE5VTEw7PC9zcGFuPjwvZGl2PjxkaXY+PHNwYW4+KyAmbmJzcDsgJm5ic3A7dW5zaWdu ZWQgaW50IHJlc2VydmVkX21lbXNsb3RzOzwvc3Bhbj48L2Rpdj48ZGl2PjxzcGFuPiZuYnNwOyAm bmJzcDsgJm5ic3A7aW50IHJldCA9IDA7PC9zcGFuPjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+ PHNwYW4+Jm5ic3A7ICZuYnNwOyAmbmJzcDtpZiAoZmQgJmx0OyAwKSB7PC9zcGFuPjwvZGl2Pjxk aXY+PHNwYW4+QEAgLTE5NzcsNiArMTk4NiwxNSBAQCB2aG9zdF91c2VyX2JhY2tlbmRfaGFuZGxl X3NobWVtX21hcChzdHJ1Y3Qgdmhvc3RfZGV2ICpkZXYsPC9zcGFuPjwvZGl2PjxkaXY+PHNwYW4+ Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwO308L3NwYW4+PC9kaXY+PGRpdj48c3Bh bj4mbmJzcDsgJm5ic3A7ICZuYnNwO308L3NwYW4+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj48 c3Bhbj4rICZuYnNwOyAmbmJzcDtyZXNlcnZlZF9tZW1zbG90cyA9IG1lbW9yeV9kZXZpY2VzX2dl dF9yZXNlcnZlZF9tZW1zbG90cygpOzwvc3Bhbj48L2Rpdj48ZGl2PjxzcGFuPisgJm5ic3A7ICZu YnNwO2lmICgoa3ZtX2VuYWJsZWQoKSAmYW1wOyZhbXA7PC9zcGFuPjwvZGl2PjxkaXY+PHNwYW4+ KyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsga3ZtX2dldF9mcmVlX21lbXNsb3RzKCkgJmx0 Oz0gcmVzZXJ2ZWRfbWVtc2xvdHMpIHx8PC9zcGFuPjwvZGl2PjxkaXY+PHNwYW4+KyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDt2aG9zdF9nZXRfZnJlZV9tZW1zbG90cygpICZsdDs9IHJlc2Vy dmVkX21lbXNsb3RzKSB7PC9zcGFuPjwvZGl2PjxkaXY+PHNwYW4+KyAmbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDtlcnJvcl9yZXBvcnQoIk5vIGZyZWUgbWVtb3J5IHNsb3RzIGZvciBzaGFyZWQg bWVtb3J5IG1hcHBpbmciKTs8L3NwYW4+PC9kaXY+PGRpdj48c3Bhbj4rICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwO3JldCA9IC1FTk9TUEM7PC9zcGFuPjwvZGl2PjxkaXY+PHNwYW4+KyAmbmJz cDsgJm5ic3A7ICZuYnNwOyAmbmJzcDtnb3RvIHNlbmRfcmVwbHk7PC9zcGFuPjwvZGl2PjxkaXY+ PHNwYW4+KyAmbmJzcDsgJm5ic3A7fTwvc3Bhbj48L2Rpdj48ZGl2PjxzcGFuPis8L3NwYW4+PC9k aXY+PGRpdj48c3Bhbj4mbmJzcDsgJm5ic3A7ICZuYnNwO21lbW9yeV9yZWdpb25fdHJhbnNhY3Rp b25fYmVnaW4oKTs8L3NwYW4+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj48c3Bhbj4mbmJzcDsg Jm5ic3A7ICZuYnNwOy8qIENyZWF0ZSBWaXJ0aW9TaGFyZWRNZW1vcnlNYXBwaW5nIG9iamVjdCAq Lzwvc3Bhbj48L2Rpdj48ZGl2PjxzcGFuPi0tPC9zcGFuPjwvZGl2PjxzcGFuPjIuNDMuMDwvc3Bh bj48ZGl2IHN0eWxlPSJmb250LWZhbWlseTogQXJpYWwsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTog MTRweDsiIGNsYXNzPSJwcm90b25tYWlsX3NpZ25hdHVyZV9ibG9jayI+PGRpdiBjbGFzcz0icHJv dG9ubWFpbF9zaWduYXR1cmVfYmxvY2stcHJvdG9uIj4NCiAgICA8L2Rpdj4NCjwvZGl2Pg0K --b1=_XrikHZjrrzXiIk0oNUQgiHpzYjQ2ZeiBUytQkVmybI--