// https://syzkaller.appspot.com/bug?id=f10328051e281263acf23f4c762e3c54f1e218ad // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef __NR_io_uring_enter #define __NR_io_uring_enter 426 #endif #ifndef __NR_io_uring_setup #define __NR_io_uring_setup 425 #endif static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i = 0; for (; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { int state; } event_t; static void event_init(event_t* ev) { ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { if (ev->state) exit(1); __atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE); syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000); } static void event_wait(event_t* ev) { while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0); } static int event_isset(event_t* ev) { return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE); } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; for (;;) { uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts); if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) return 1; now = current_time_ms(); if (now - start > timeout) return 0; } } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } #define SIZEOF_IO_URING_SQE 64 #define SIZEOF_IO_URING_CQE 16 #define SQ_HEAD_OFFSET 0 #define SQ_TAIL_OFFSET 64 #define SQ_RING_MASK_OFFSET 256 #define SQ_RING_ENTRIES_OFFSET 264 #define SQ_FLAGS_OFFSET 276 #define SQ_DROPPED_OFFSET 272 #define CQ_HEAD_OFFSET 128 #define CQ_TAIL_OFFSET 192 #define CQ_RING_MASK_OFFSET 260 #define CQ_RING_ENTRIES_OFFSET 268 #define CQ_RING_OVERFLOW_OFFSET 284 #define CQ_FLAGS_OFFSET 280 #define CQ_CQES_OFFSET 320 struct io_sqring_offsets { uint32_t head; uint32_t tail; uint32_t ring_mask; uint32_t ring_entries; uint32_t flags; uint32_t dropped; uint32_t array; uint32_t resv1; uint64_t resv2; }; struct io_cqring_offsets { uint32_t head; uint32_t tail; uint32_t ring_mask; uint32_t ring_entries; uint32_t overflow; uint32_t cqes; uint64_t resv[2]; }; struct io_uring_params { uint32_t sq_entries; uint32_t cq_entries; uint32_t flags; uint32_t sq_thread_cpu; uint32_t sq_thread_idle; uint32_t features; uint32_t resv[4]; struct io_sqring_offsets sq_off; struct io_cqring_offsets cq_off; }; #define IORING_OFF_SQ_RING 0 #define IORING_OFF_SQES 0x10000000ULL static long syz_io_uring_setup(volatile long a0, volatile long a1, volatile long a2, volatile long a3, volatile long a4, volatile long a5) { uint32_t entries = (uint32_t)a0; struct io_uring_params* setup_params = (struct io_uring_params*)a1; void* vma1 = (void*)a2; void* vma2 = (void*)a3; void** ring_ptr_out = (void**)a4; void** sqes_ptr_out = (void**)a5; uint32_t fd_io_uring = syscall(__NR_io_uring_setup, entries, setup_params); uint32_t sq_ring_sz = setup_params->sq_off.array + setup_params->sq_entries * sizeof(uint32_t); uint32_t cq_ring_sz = setup_params->cq_off.cqes + setup_params->cq_entries * SIZEOF_IO_URING_CQE; uint32_t ring_sz = sq_ring_sz > cq_ring_sz ? sq_ring_sz : cq_ring_sz; *ring_ptr_out = mmap(vma1, ring_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQ_RING); uint32_t sqes_sz = setup_params->sq_entries * SIZEOF_IO_URING_SQE; *sqes_ptr_out = mmap(vma2, sqes_sz, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQES); return fd_io_uring; } static long syz_io_uring_submit(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { char* ring_ptr = (char*)a0; char* sqes_ptr = (char*)a1; char* sqe = (char*)a2; uint32_t sqes_index = (uint32_t)a3; uint32_t sq_ring_entries = *(uint32_t*)(ring_ptr + SQ_RING_ENTRIES_OFFSET); uint32_t cq_ring_entries = *(uint32_t*)(ring_ptr + CQ_RING_ENTRIES_OFFSET); uint32_t sq_array_off = (CQ_CQES_OFFSET + cq_ring_entries * SIZEOF_IO_URING_CQE + 63) & ~63; if (sq_ring_entries) sqes_index %= sq_ring_entries; char* sqe_dest = sqes_ptr + sqes_index * SIZEOF_IO_URING_SQE; memcpy(sqe_dest, sqe, SIZEOF_IO_URING_SQE); uint32_t sq_ring_mask = *(uint32_t*)(ring_ptr + SQ_RING_MASK_OFFSET); uint32_t* sq_tail_ptr = (uint32_t*)(ring_ptr + SQ_TAIL_OFFSET); uint32_t sq_tail = *sq_tail_ptr & sq_ring_mask; uint32_t sq_tail_next = *sq_tail_ptr + 1; uint32_t* sq_array = (uint32_t*)(ring_ptr + sq_array_off); *(sq_array + sq_tail) = sqes_index; __atomic_store_n(sq_tail_ptr, sq_tail_next, __ATOMIC_RELEASE); return 0; } static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2) { if (a0 == 0xc || a0 == 0xb) { char buf[128]; sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2); return open(buf, O_RDWR, 0); } else { char buf[1024]; char* hash; strncpy(buf, (char*)a0, sizeof(buf) - 1); buf[sizeof(buf) - 1] = 0; while ((hash = strchr(buf, '#'))) { *hash = '0' + (char)(a1 % 10); a1 /= 10; } return open(buf, a2, 0); } } static long syz_open_pts(volatile long a0, volatile long a1) { int ptyno = 0; if (ioctl(a0, TIOCGPTN, &ptyno)) return -1; char buf[128]; sprintf(buf, "/dev/pts/%d", ptyno); return open(buf, a1, 0); } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } #define FUSE_MIN_READ_BUFFER 8192 enum fuse_opcode { FUSE_LOOKUP = 1, FUSE_FORGET = 2, FUSE_GETATTR = 3, FUSE_SETATTR = 4, FUSE_READLINK = 5, FUSE_SYMLINK = 6, FUSE_MKNOD = 8, FUSE_MKDIR = 9, FUSE_UNLINK = 10, FUSE_RMDIR = 11, FUSE_RENAME = 12, FUSE_LINK = 13, FUSE_OPEN = 14, FUSE_READ = 15, FUSE_WRITE = 16, FUSE_STATFS = 17, FUSE_RELEASE = 18, FUSE_FSYNC = 20, FUSE_SETXATTR = 21, FUSE_GETXATTR = 22, FUSE_LISTXATTR = 23, FUSE_REMOVEXATTR = 24, FUSE_FLUSH = 25, FUSE_INIT = 26, FUSE_OPENDIR = 27, FUSE_READDIR = 28, FUSE_RELEASEDIR = 29, FUSE_FSYNCDIR = 30, FUSE_GETLK = 31, FUSE_SETLK = 32, FUSE_SETLKW = 33, FUSE_ACCESS = 34, FUSE_CREATE = 35, FUSE_INTERRUPT = 36, FUSE_BMAP = 37, FUSE_DESTROY = 38, FUSE_IOCTL = 39, FUSE_POLL = 40, FUSE_NOTIFY_REPLY = 41, FUSE_BATCH_FORGET = 42, FUSE_FALLOCATE = 43, FUSE_READDIRPLUS = 44, FUSE_RENAME2 = 45, FUSE_LSEEK = 46, FUSE_COPY_FILE_RANGE = 47, FUSE_SETUPMAPPING = 48, FUSE_REMOVEMAPPING = 49, CUSE_INIT = 4096, CUSE_INIT_BSWAP_RESERVED = 1048576, FUSE_INIT_BSWAP_RESERVED = 436207616, }; struct fuse_in_header { uint32_t len; uint32_t opcode; uint64_t unique; uint64_t nodeid; uint32_t uid; uint32_t gid; uint32_t pid; uint32_t padding; }; struct fuse_out_header { uint32_t len; uint32_t error; uint64_t unique; }; struct syz_fuse_req_out { struct fuse_out_header* init; struct fuse_out_header* lseek; struct fuse_out_header* bmap; struct fuse_out_header* poll; struct fuse_out_header* getxattr; struct fuse_out_header* lk; struct fuse_out_header* statfs; struct fuse_out_header* write; struct fuse_out_header* read; struct fuse_out_header* open; struct fuse_out_header* attr; struct fuse_out_header* entry; struct fuse_out_header* dirent; struct fuse_out_header* direntplus; struct fuse_out_header* create_open; struct fuse_out_header* ioctl; }; static int fuse_send_response(int fd, const struct fuse_in_header* in_hdr, struct fuse_out_header* out_hdr) { if (!out_hdr) { return -1; } out_hdr->unique = in_hdr->unique; if (write(fd, out_hdr, out_hdr->len) == -1) { return -1; } return 0; } static volatile long syz_fuse_handle_req(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { struct syz_fuse_req_out* req_out = (struct syz_fuse_req_out*)a3; struct fuse_out_header* out_hdr = NULL; char* buf = (char*)a1; int buf_len = (int)a2; int fd = (int)a0; if (!req_out) { return -1; } if (buf_len < FUSE_MIN_READ_BUFFER) { return -1; } int ret = read(fd, buf, buf_len); if (ret == -1) { return -1; } if ((size_t)ret < sizeof(struct fuse_in_header)) { return -1; } const struct fuse_in_header* in_hdr = (const struct fuse_in_header*)buf; if (in_hdr->len > (uint32_t)ret) { return -1; } switch (in_hdr->opcode) { case FUSE_GETATTR: case FUSE_SETATTR: out_hdr = req_out->attr; break; case FUSE_LOOKUP: case FUSE_SYMLINK: case FUSE_LINK: case FUSE_MKNOD: case FUSE_MKDIR: out_hdr = req_out->entry; break; case FUSE_OPEN: case FUSE_OPENDIR: out_hdr = req_out->open; break; case FUSE_STATFS: out_hdr = req_out->statfs; break; case FUSE_RMDIR: case FUSE_RENAME: case FUSE_RENAME2: case FUSE_FALLOCATE: case FUSE_SETXATTR: case FUSE_REMOVEXATTR: case FUSE_FSYNCDIR: case FUSE_FSYNC: case FUSE_SETLKW: case FUSE_SETLK: case FUSE_ACCESS: case FUSE_FLUSH: case FUSE_RELEASE: case FUSE_RELEASEDIR: case FUSE_UNLINK: case FUSE_DESTROY: out_hdr = req_out->init; if (!out_hdr) { return -1; } out_hdr->len = sizeof(struct fuse_out_header); break; case FUSE_READ: out_hdr = req_out->read; break; case FUSE_READDIR: out_hdr = req_out->dirent; break; case FUSE_READDIRPLUS: out_hdr = req_out->direntplus; break; case FUSE_INIT: out_hdr = req_out->init; break; case FUSE_LSEEK: out_hdr = req_out->lseek; break; case FUSE_GETLK: out_hdr = req_out->lk; break; case FUSE_BMAP: out_hdr = req_out->bmap; break; case FUSE_POLL: out_hdr = req_out->poll; break; case FUSE_GETXATTR: case FUSE_LISTXATTR: out_hdr = req_out->getxattr; break; case FUSE_WRITE: case FUSE_COPY_FILE_RANGE: out_hdr = req_out->write; break; case FUSE_FORGET: case FUSE_BATCH_FORGET: return 0; case FUSE_CREATE: out_hdr = req_out->create_open; break; case FUSE_IOCTL: out_hdr = req_out->ioctl; break; default: return -1; } return fuse_send_response(fd, in_hdr, out_hdr); } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { int i, call, thread; for (call = 0; call < 15; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 50); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } } } uint64_t r[7] = { 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: syscall(__NR_socket, 0x10ul, 3ul, 0xc); break; case 1: syscall(__NR_prctl, 0x3eul, 0ul, 0, 2ul, 0ul); break; case 2: memcpy((void*)0x20000040, "/dev/snd/midiC#D#\000", 18); res = -1; res = syz_open_dev(0x20000040, 2, 0); if (res != -1) r[0] = res; break; case 3: syscall(__NR_dup, r[0]); break; case 4: *(uint32_t*)0x20000544 = 0; *(uint32_t*)0x20000548 = 0; *(uint32_t*)0x2000054c = 0; *(uint32_t*)0x20000550 = 0; *(uint32_t*)0x20000558 = -1; memset((void*)0x2000055c, 0, 12); res = -1; res = syz_io_uring_setup(0x3ee2, 0x20000540, 0x20002000, 0x20004000, 0x20000100, 0x20000040); if (res != -1) { r[1] = res; r[2] = *(uint64_t*)0x20000100; r[3] = *(uint64_t*)0x20000040; } break; case 5: memcpy((void*)0x200000c0, "/dev/ptmx\000", 10); res = syscall(__NR_openat, 0xffffffffffffff9cul, 0x200000c0ul, 0x121301ul, 0ul); if (res != -1) r[4] = res; break; case 6: syscall(__NR_write, r[4], 0x20000080ul, 0xff2eul); break; case 7: *(uint32_t*)0x20000100 = 0; *(uint32_t*)0x20000104 = 0; *(uint32_t*)0x20000108 = 0; *(uint32_t*)0x2000010c = 0; *(uint8_t*)0x20000110 = 0; memcpy((void*)0x20000111, "\x00\x40\x00\x1e\x1d\x11\x3c\x00\x00\x00\x00\x00\x00\x01\x00\x00" "\x00\x00\x00", 19); syscall(__NR_ioctl, r[4], 0x40045431, 0x20000100ul); break; case 8: res = -1; res = syz_open_pts(r[4], 0); if (res != -1) r[5] = res; break; case 9: res = syscall(__NR_dup3, r[5], r[4], 0ul); if (res != -1) r[6] = res; break; case 10: *(uint32_t*)0x20000000 = 0; *(uint32_t*)0x20000004 = 0; *(uint32_t*)0x20000008 = 0; *(uint32_t*)0x2000000c = 6; *(uint8_t*)0x20000010 = 0; memcpy((void*)0x20000011, "\x4a\xf0\x28\x1e\xac\xd8\xd4\x12\xd0\xf0\x92\x82\x87\xb7\x3f\x1e" "\x1b\x8a\xa0", 19); syscall(__NR_ioctl, r[6], 0x5402, 0x20000000ul); break; case 11: memcpy( (void*)0x20004400, "\xac\x20\x8e\xf6\xcb\x96\x7a\xe9\xeb\x58\x34\x2f\x2b\xb8\x56\xdd\x53" "\xcd\xc4\x47\x6d\x35\x1b\x52\x84\xba\x0d\x63\x35\x36\x91\xf3\xe4\x35" "\x5b\x0d\x56\x22\xb3\x9c\x4f\xd2\xa5\x67\x15\x92\x46\x65\xc5\x63\xba" "\x62\x18\x1c\x3a\x19\x44\x4d\xd5\xd9\xc8\x1e\xe4\x2e\x51\xf6\x31\x11" "\xb5\xee\x01\x46\x19\x3d\x92\x01\x56\x01\xe3\xf3\x5b\xf2\xe4\xe3\x6e" "\xdc\xbe\x4b\x30\x0b\x07\xec\xeb\xd8\x01\x8e\xd6\x5b\x93\xab\x92\xe0" "\x02\xec\xb0\x48\xe0\x7c\xe9\xe0\x49\x4b\xc1\x7e\x74\x15\x6e\x07\x34" "\xf9\xee\x9f\x1a\x0c\xb0\xc0\xba\xca\x5d\x7e\xcf\x99\x07\x68\x6e\xde" "\x2e\xf4\x56\xfd\x18\x94\xf4\x84\xd2\x5d\xf7\x06\xe5\xcd\xea\xa3\xff" "\x55\xb4\xa8\xee\x5d\x42\x52\x5f\x40\x08\x37\x78\x2a\xf4\xe1\xd2\xae" "\x05\x1c\x30\x75\xdd\xf6\x91\x72\xa4\xe0\xc0\xc2\x87\x2f\x54\x25\xee" "\x57\x84\x72\xe9\x7b\x85\xc5\x97\xeb\x68\xc8\x27\x96\x24\x16\xab\xc1" "\x39\x81\x48\xc8\x82\x1d\xb9\xf0\x9f\x89\xf8\xb4\x23\x3f\xeb\xa1\x56" "\x91\x41\x6d\x08\xcc\xf3\x36\xfc\xa8\x73\xec\x18\x11\x4a\x1d\xfb\xd1" "\x93\x1f\x9f\x77\xf0\xe4\x3c\x3c\x76\x34\xac\x41\x42\x80\x59\x15\x3c" "\x78\xc3\xdb\x95\x7c\x33\xe7\x8a\x28\xab\x28\x91\x0a\x36\x58\x77\x35" "\x0f\x3e\xd1\xc6\x59\x89\x8b\x99\xe4\x81\x89\x4c\xff\x7a\x83\x10\xed" "\x67\xf2\x10\xeb\x07\x16\x0f\x89\xbc\x33\x72\x64\xff\x04\xd5\x24\x0c" "\xd7\x4c\x65\x8c\x7c\xc0\x15\xc3\x12\x8c\x54\xe6\xab\x52\x77\x81\xef" "\xa8\xaa\x7b\xab\xdc\x15\xf9\x2a\x88\xb3\x32\xbb\xb4\x11\x02\xc9\xb7" "\xf1\x75\x3a\x31\x88\xb7\xc9\xe8\x20\xff\x69\x95\x40\x25\x12\xc8\x55" "\xc4\x05\x7c\x7f\x2a\x82\x05\x6f\x0e\x79\xe1\x63\xf3\x23\xfd\xc9\x05" "\x62\x12\xea\xbc\x34\x4a\xd9\xf2\x9d\x6c\x81\x4e\x20\x09\x3f\x90\x07" "\x5b\x8a\x5b\x92\x54\xd6\x91\x77\x86\x7a\x0f\x86\x83\xa1\x94\xf9\xb1" "\xd6\x66\x24\x34\x49\x04\xec\xf8\x75\x0e\x33\x33\x1d\x7c\xa1\x26\x48" "\x01\xb1\xb2\xab\x61\xee\x22\xc2\xfe\x61\x26\xc4\x22\x3c\x4f\x41\xaf" "\x0b\x07\x57\xca\x58\x71\x70\xf2\xa7\x10\x4c\xf6\xf0\x17\x1f\x96\x3a" "\x23\x21\xf4\x9d\x7e\xed\xa3\xb2\xe8\x76\xb4\xbf\xb8\x78\x45\x31\xfc" "\xd1\x68\xed\x3d\x63\xcd\xad\xd5\x84\x67\x91\x2f\xd2\xa5\x57\x3a\xd1" "\x80\x1f\x42\xff\xaf\x84\x67\x18\xa8\xe7\x48\x6c\x8b\xe2\x0d\xed\xb2" "\x4b\xa3\xd5\xd5\xa6\xd0\x06\xf2\x8e\x44\x7d\x0c\x77\xb0\x35\x49\xe6" "\xce\x86\x17\xf4\x58\xf7\x48\x10\x02\x09\xd3\xea\xe6\x8c\x2c\x93\x34" "\x96\x76\x7e\xa7\x01\x96\x71\x1b\x18\xe5\x4c\x33\x58\xcb\x1b\xfa\xe8" "\xa6\xb5\xd8\x3d\x9b\x82\x24\x68\xb5\x3c\x7a\x34\x54\x20\x3d\xe2\x45" "\x40\xfd\xb4\x5d\x1f\x6f\x1e\x08\xda\xc5\x84\xcc\x98\xc0\x04\x6a\xe8" "\x89\x4c\xe5\x5d\xcf\xe7\x63\xee\x84\xa0\x68\x05\x68\xd4\x9f\xf9\x94" "\x4d\x6b\x5f\x25\x89\xbd\xe7\xf4\xa0\x76\xdc\xbd\x62\x04\x6c\x7f\xfe" "\x70\x16\x8a\x36\x8c\x8d\xb8\x3c\x00\x02\x5d\x17\xbe\x01\x79\x20\x7c" "\xa1\xb2\xe5\x8f\x23\x49\xdc\x20\x57\x62\xd0\x3b\xb1\x39\x25\x7a\xa9" "\x4b\xa9\x60\x34\x5b\x72\xba\xc0\xc9\x7d\xac\x20\x3c\x71\xa2\xdb\x12" "\xef\x69\x68\x7a\x36\x2c\xf8\x47\xeb\x59\xf2\xa1\x0f\xdb\xc8\xd2\x31" "\x50\xed\x9c\x8b\xad\xef\xc5\x7e\x56\xaa\xf4\x06\xc7\x0f\xec\x98\x22" "\x2b\xf5\xe8\xa1\x15\x19\xf0\xe4\x07\x15\x17\x81\xf0\xdf\xb7\x39\xa2" "\xea\xe3\xdc\xbf\xfb\xfd\xbc\x3c\xb9\x51\xe4\x93\xed\xad\xcf\x43\x4a" "\x90\xc5\xec\xc0\x9a\x5b\xd3\x93\xa2\x6f\x0b\x90\x84\x87\x4e\x45\x97" "\x14\xd2\x7f\x83\x08\xe6\xfc\x91\x0c\x8a\xba\xf6\x71\xa8\x13\x83\xca" "\xa9\xdd\x15\x79\xb6\x66\x93\x8d\x22\xe2\x69\x6c\x64\xfc\x23\x1f\xc4" "\x6c\x93\x1e\x03\x5c\x21\x1e\xdf\x35\x19\xb5\x94\x24\x67\xd5\xf5\x15" "\x52\x50\x67\x1d\x30\xfa\x4b\x95\x5b\x04\x87\xa3\xc5\x9a\x39\x24\xc6" "\xdc\xdd\xb2\x81\xb1\x87\x9a\x36\xb3\xd3\x37\x4c\xc7\x73\xc0\xb4\xd2" "\x2a\x7d\x39\x2b\x92\xcc\xb0\x61\x88\x34\xda\xc1\x45\x5c\x9c\x99\xe7" "\x1b\x70\xd6\x0d\x08\xf7\x79\x6d\x24\xdc\x17\x9e\x15\xa7\xa6\x66\x53" "\x1d\xd9\x04\x43\xa7\x12\x0a\xe7\x6f\x24\x87\xca\x24\x55\x14\x57\x87" "\x14\x80\xa0\x46\x69\xff\xf2\xb7\x40\xd5\x26\x69\xee\x0a\x67\x06\x9d" "\x3d\xb7\x75\xf8\x1b\x77\x30\x87\x73\xcf\xe4\xc0\xe3\x5b\xb4\xd1\x57" "\xbe\x45\xd4\xe8\xe8\x8d\x2e\x6e\xd2\xcc\x46\x63\x12\xb2\xac\xd3\x64" "\xca\xb8\x51\x89\x7a\xa0\xc2\x39\x6c\xfd\x22\x47\x65\x14\x58\x47\xfc" "\xb4\x56\x5d\xab\x04\x8e\x53\xb9\xa1\x54\x73\xf9\x68\xda\xf9\xa9\xcc" "\x6c\x05\xe7\x85\x0e\x97\x68\x10\xee\x47\xa5\x1f\xdd\x7b\x3b\x4a\x8e" "\x78\x7c\x5b\x63\x3a\x0a\x83\x40\xde\x4d\x4a\x96\x69\x54\xd1\x03\x8d" "\x4e\x7c\xbd\x62\xcf\xce\x8e\xf1\x10\x44\x95\x54\x92\x36\x3a\xfa\xa7" "\x86\x37\x95\x7d\xe4\x2e\xab\x1f\xce\x5c\xcc\x69\x02\x79\xff\xde\xdb" "\x3b\x1a\xcf\xbd\x89\x02\x5d\x83\xa5\x42\x78\xa4\x8f\x85\xf0\xc0\x9d" "\xb1\x10\x46\x06\x79\x11\xe1\xd7\x57\x7b\x4a\xb1\x65\x8c\x54\x12\x58" "\xe2\x00\x26\xec\x85\xc1\x29\x1d\x3a\xb2\x3e\x59\x24\xe4\xdd\x38\xd3" "\x4b\x43\xf5\x5b\x68\xfa\xf4\x26\x18\xc0\xc0\xea\x97\x6a\x49\x95\x5b" "\xa3\x31\x70\xc7\x70\x10\xd8\x28\x11\xbe\x7d\xc1\x8f\xcb\x73\x90\xf2" "\xde\x64\x81\xd9\x17\xdc\xe2\x5f\xfa\x51\x6f\x4c\x34\x8b\x25\x4e\x67" "\xea\x8f\xf5\x1d\x29\xf3\x45\x62\xb2\x8b\x1e\x70\x70\xda\x2d\x52\xf2" "\x09\x38\xe8\x55\x82\xe3\x34\x47\xd8\x7e\xb8\x6b\xaa\xeb\xbf\xc4\x25" "\x0c\x5c\xbf\x4f\xbd\xa0\x44\xc8\x48\x78\x3a\xcc\x49\x30\x41\x12\xa0" "\x3f\x21\x33\x59\x88\x51\x92\x96\x43\x72\xc5\xdb\xb1\x7d\x11\xd1\x5d" "\x21\xb1\xad\xf1\x00\x57\x5e\x25\x3d\xd8\x7d\x20\xb8\x7c\x9f\x8e\xd4" "\x8a\x6c\x92\x5e\xad\x62\xa5\x11\xba\x1b\x74\xf0\x9b\x1b\xc0\x89\xcc" "\x16\x48\x26\x3f\xe8\xdf\xd2\x19\x49\x14\xc2\x4f\x6b\x86\xdb\x6f\xa5" "\x00\x32\x3d\x24\xe0\xe6\x2b\xbf\xb2\x81\x28\x5c\x86\xd2\xbd\x4c\x3a" "\xba\x46\xc4\xa9\xbb\xc1\x6f\x9e\xcc\xd8\x16\xc7\xa4\x80\xd3\xc5\xa7" "\x97\x4c\xb5\xeb\x27\xd9\x35\x72\x2e\xba\xf4\xee\x95\xf7\x61\xa1\xf4" "\xf5\x2b\xff\xd7\xd2\xa1\x84\x4e\x63\x5c\x7c\x1b\x8e\x73\x62\xb0\xbb" "\x9a\x6e\x4d\xff\x57\x5e\xa4\xce\x85\x26\xbf\x94\x41\x2b\x79\x15\xad" "\xb3\xb6\x93\xc9\x5c\x90\x52\xae\xa5\x89\xf8\xd6\x6e\xf6\x63\x60\x40" "\xba\x48\xd5\x01\xe6\x22\xf1\x66\xce\x2c\x43\x8a\x94\x74\x80\xc3\x4b" "\xc2\x37\xbf\x92\xa9\xda\x7c\x3c\x24\x34\xdd\x42\x2e\x23\xe9\x77\xec" "\x13\xfd\x44\xb7\xf2\xcc\x70\x07\xc7\xcf\x46\x85\x9e\x85\xf3\x42\x7f" "\x62\x35\x24\x50\x21\xb1\x97\x0a\xfd\xeb\xaf\xe5\x4c\x4d\x8d\xae\x04" "\x7a\xa4\x6e\x9b\x28\xba\x2f\xfc\xba\x98\x33\x8b\x96\x28\x24\xea\x57" "\xf2\xbd\xbd\x48\x84\x98\x61\x89\x24\xe4\x12\x21\xe8\xba\x07\x4e\x1b" "\x98\xb8\x8f\x58\x36\x9f\xef\xa7\x3d\xe9\xd8\x18\xf9\x8b\x82\x55\x78" "\x70\x2b\x99\x1c\x16\x87\x21\x82\x7a\x52\x2f\x04\x35\x38\x1c\xe5\xf8" "\xd4\x7c\x24\xd3\x34\xd3\xcc\x93\x1c\x21\x21\x11\x2d\x53\x90\xb8\xa4" "\x44\x46\xd0\x99\x0e\xcc\x9f\xb6\x75\xfe\xe5\x19\x0d\xb0\x5b\xc4\x58" "\x32\x2f\xa1\x0f\xf0\x27\x4a\x3d\x71\x5e\x54\x8d\x26\x3e\x23\x47\xc6" "\xdb\x7d\x7f\x30\xa7\xdd\x09\xd5\xb3\x24\x1f\x12\x7c\xfb\xde\x7e\xca" "\x36\xea\x05\x57\x40\x9b\xd3\x9e\x4c\x28\x63\xc1\x5a\x9a\xdf\xe7\xb0" "\x8b\x5d\x3c\xed\x1f\x78\xc0\x61\xca\x9e\xa6\x0a\x93\x0b\xcf\xc6\xea" "\xc5\x1d\xae\x2b\x4d\xa2\xf5\x0d\x23\x56\x2a\x4d\xe3\xbe\xe9\xdb\xe4" "\x7b\x42\xa7\xa4\x0d\xf2\xe5\xe5\xe4\xdf\x83\xa0\x5d\xa5\x8c\xe1\x44" "\x6f\x65\x67\xa3\x5e\xb2\x8c\xf3\xdf\xce\x0a\x1f\xc6\xae\x44\x3d\x4d" "\x4e\x20\xbb\x64\xd4\x22\x7e\x0c\xc2\x15\xf4\x7a\xf4\x3e\x69\xf0\xf1" "\xfe\xf5\xd5\x9b\x33\x3d\x7e\xd6\x93\x1c\xe2\x9f\x67\x9e\xab\xe0\xc8" "\x40\x8b\x53\x5f\x03\x60\x0b\xbb\xef\xda\x24\x83\x30\x90\x42\xe9\x17" "\xfe\x6f\xcb\x87\x5c\xe9\xa4\xc7\x67\x04\x2e\x8e\x2e\xc7\x98\xeb\x5a" "\x67\xcb\xe5\xcf\x06\x02\x5a\xf0\x54\x98\x75\x04\x00\x4d\x3c\xe1\x66" "\xf7\x7a\x18\x8a\xa9\xa6\xec\x24\x33\x62\x38\x40\x03\x88\x80\x9f\x7f" "\x6c\xb5\x8e\x4c\xa7\x34\xf7\x92\x5d\xa8\xa5\x22\x0e\x6e\x21\x72\x67" "\xdb\x08\xc3\xfc\x52\xec\x3f\x77\x7f\xdb\xe6\x47\x1d\x8a\x12\xe0\x76" "\x45\x88\x0e\x18\x12\x48\x99\xe9\xe7\xb6\x10\x86\x58\x2e\xe4\xb4\x4c" "\xa9\xc5\xc5\xe4\x81\xb6\x02\xfc\xbb\x83\x2f\xb2\xae\xd8\xeb\x15\x47" "\x1d\x39\xa3\xbd\x09\x25\xfe\xc1\x52\x52\xb3\xf3\x9c\xe9\x8d\x3c\x2c" "\x2c\xdc\xfc\xbf\x72\xb4\x8b\x6e\xb9\x0d\xb1\x30\xd7\xa2\xc0\x1f\xcf" "\x8f\x5e\x77\x86\x01\xe1\xc7\x2b\xe8\xa5\x0e\x4b\x0b\xc6\x48\xf3\xa7" "\xd0\xf1\xdd\x61\xac\x76\xfe\x7b\xe0\xe1\xa2\x65\x08\x2a\x83\x92\x97" "\xa5\xeb\xe0\x73\x7c\x24\xb9\x89\x66\xb8\xa4\x2b\x37\xaa\x5b\x77\x09" "\x1e\xa5\xd8\x96\x5e\x52\xa0\x21\xeb\x41\x70\xfe\x14\xf2\xad\x1b\x0f" "\xee\xd2\x6e\x1e\xc1\x51\x3d\x0c\x80\x25\xc5\xb0\x15\x62\x8b\x68\x48" "\x4f\xa2\xc4\x5a\xc2\xf2\xd2\xc0\x02\x0d\x31\x8f\x52\x1d\x32\x75\x3c" "\x59\x93\x39\xf8\xe9\xfc\x37\x79\xb2\x53\x3a\x65\x3d\x78\x65\x44\xcf" "\x39\xef\xd5\x9a\xb4\xa0\x74\x39\x3b\xe7\xc7\x79\x51\x65\x86\x2a\x95" "\x34\xe3\x08\x0a\x04\xe3\x44\x88\x13\x3e\x0f\x62\x18\xfe\x91\xf3\xd4" "\x33\x68\x81\xe0\x59\xf0\x2b\x8a\xa9\x27\xa5\xb7\xa2\x38\xad\xd0\xc1" "\x30\x03\xc0\x8b\x37\x57\x1a\x44\xe0\xeb\x56\xa9\x9d\xb2\xdc\xbd\x9a" "\x21\x0b\x05\x7e\x95\x85\x77\xd5\x9f\xa3\xc6\x3d\x39\xdb\x47\x5b\x64" "\x0e\xa6\x11\x33\xfd\x24\x6a\x82\xa3\xee\x05\x2c\x1e\x11\xbe\x3c\xea" "\xec\x99\x6d\x03\xce\x5a\xcf\xfb\x87\x3d\xd8\xa8\x22\xda\x72\x08\x2b" "\xce\x3f\xbc\x1e\x10\x39\x2a\x33\xfa\x6e\x37\xab\xc8\x19\x0d\x61\x70" "\x00\xf9\x70\x18\xe1\x94\xc6\xb9\xc2\x4a\xc5\x56\x74\x1d\x73\x5a\x2d" "\x9c\x2f\x15\xed\x84\xe7\xfb\xd4\xdb\x43\x69\x66\x7e\x3a\x68\x58\xe4" "\xce\x1a\x2f\x4f\xbf\x01\x03\x25\xba\x04\x28\x69\x40\x85\xaa\xb4\x3a" "\x75\xaf\xc0\x93\x98\x9c\x37\x36\x84\x44\x37\x6f\x62\x21\xaf\xb2\xb7" "\xa4\xf1\x43\x25\xbf\xc2\x14\xfb\xbb\xcb\x28\x20\x89\x72\x2f\x9a\x3b" "\x88\xae\x33\x39\xbc\x67\x5b\xd1\x18\x4f\xec\xaf\x76\x32\x11\xb6\xb6" "\xea\x45\xb0\xe7\xb1\xed\x40\xb5\x7f\xeb\xe8\x15\x0b\x95\xc4\xd6\x83" "\x2e\x3e\x79\x1e\xd7\x6d\x9c\x95\x1e\x3e\x35\x7f\xd5\xa3\xe0\x09\xa2" "\x81\xc6\xe3\xb4\x68\xbe\xc0\x3a\xe7\x80\x25\x14\xc7\x71\x21\xea\xff" "\xb8\xb2\xef\xcb\x1f\xf9\x5e\x39\xc6\x7c\x2f\x00\x60\x0d\xd3\x2d\x26" "\x11\xb1\x3f\x15\xfc\x3c\x8f\x92\x29\x55\x07\x6d\xf8\x2e\x8b\x0d\xd4" "\x22\x3c\xbf\xb0\x66\x5c\xda\x4a\xd4\x23\xd4\x6d\xa8\x0c\x7d\x64\x19" "\x84\xc6\xd3\x6c\x82\xc3\x14\xa6\x9c\x37\x8f\x21\xa4\x04\xc1\x17\x61" "\x67\x69\x96\x66\xcb\x72\x28\x6b\xcf\xdf\xd0\x6b\x23\x98\x29\x48\xe6" "\x91\xd8\xbd\xa0\x66\x06\x9a\xd2\x84\x07\xdd\x57\x14\xd8\x68\xbe\xb0" "\x60\xc6\xd2\x19\xc6\xb6\x5c\x38\xa2\x1c\xe0\x9f\x87\xd0\xdc\x0a\xb3" "\x5d\x3f\x70\xef\xf4\xc7\xdb\xe4\x43\xd4\x2a\x3c\x9b\xfc\x2c\x8b\x6c" "\x76\x35\x18\xfc\xa3\x95\x6d\x53\x03\xc0\xf8\xb6\x10\x43\x00\x4c\xda" "\x9a\xd1\x17\xeb\xd2\xef\xb3\xb1\xfe\xa5\x1a\x70\x87\x79\x29\x68\xbd" "\x5f\x73\x71\x12\xe6\x4c\x90\xd3\x1f\x12\x80\x63\x9b\x3e\x1d\x6f\x25" "\x6c\x30\x60\xfd\x32\x70\xf2\xeb\x9e\x7c\xea\xf7\xb0\xe8\xea\xb5\x9c" "\x1d\x4f\xd9\x1c\xde\xcb\xb3\x66\x98\x61\x43\x93\x80\x67\x10\x72\x63" "\x2c\xe9\xc0\x90\xc9\x54\x52\x48\xdf\x02\x7e\x7f\xbb\xf6\x76\x38\x53" "\xa7\xe8\xc7\xdf\xd6\x7c\x98\xd4\x3f\x7a\xb6\x3e\x9d\x7a\x7b\x76\x68" "\xf5\x22\xe7\xce\xf6\xd9\xbd\xd4\x2d\x94\x9c\x35\x03\x9a\xe0\x3f\xab" "\x50\xf5\xbf\x6f\xf0\xe4\xa9\x73\x9b\x51\xe5\x77\x50\x02\xd1\x2e\xf0" "\x19\xe3\x71\x41\x23\x2d\xcb\xe2\xb0\x5c\xcb\x44\xc6\x8b\x67\x84\xf6" "\xd0\x5a\xb5\x72\x04\xa0\xc2\x18\xc3\x3a\x67\xa3\xa7\x97\xe2\x17\x18" "\xba\xf8\xff\x0f\x54\x4a\x3d\x66\x0c\x22\x62\x24\x55\x87\x0d\xcb\x1b" "\x45\xab\xf1\xaa\xa5\xdb\xd4\x41\x69\x61\xd3\xa4\x9f\x8c\x1a\x0a\xa2" "\xd7\xbc\x63\x67\xc8\x0c\xbd\x3d\x0a\x32\xd8\x9f\x88\x18\x98\xf4\xf6" "\x07\x7a\x0a\xb2\x05\x1d\x5f\xf9\xeb\x7f\xd9\x7b\xc1\x93\xd5\x5a\xa0" "\x39\xd5\x15\x0f\x92\xbb\x05\x15\xbf\x8b\x30\x8f\x4b\x41\x0e\x5f\x89" "\x91\xe1\xb7\xbc\xeb\xa9\xc2\x8b\x65\xc2\xfd\xe3\xa3\xaa\xb0\x04\x1b" "\x34\x69\xcd\x9e\x29\xaa\x98\xd5\x8c\x70\xae\x46\x3e\xc6\x36\x48\x78" "\xf7\x89\xa7\x6c\x81\x1d\xf8\x58\xed\x2d\x74\xf1\x63\x94\xaf\x36\x51" "\xb9\x32\xea\x22\x47\xf7\xc7\x67\x09\x11\xd7\x18\x93\xdf\xfd\xd7\x3a" "\x84\x18\x24\xb5\x5f\x48\x32\x32\xa0\x00\xb9\x27\x62\x9b\x97\x5f\x32" "\x64\x2f\x0f\x7a\x95\xf2\xbd\x93\xce\x8a\xb6\xb8\xf4\x6b\xb7\x0a\xd1" "\xef\xde\x1e\x4c\x23\x0d\xeb\xfb\xf5\xef\x2c\x6e\xe3\x8f\xbe\xa0\x36" "\x2a\x09\x1d\xa2\x99\x1e\xf9\x47\x47\x5c\x2f\xd7\xbd\xb1\xce\x19\xfc" "\x13\xab\xc7\xd8\xbf\xdc\x94\x1f\xa6\xad\x08\x9b\x61\x95\xb2\xb9\xdf" "\xdd\x59\x99\xf0\x2c\x0c\x43\xd7\x77\x74\x33\x4e\x72\x04\x04\x86\x5b" "\x64\x6d\xef\xd4\xb0\x39\x20\x97\xbb\xa3\x43\x0a\x25\x6d\x7a\x97\x80" "\xd7\x7a\x33\xe7\x8f\x79\x5f\x05\xd7\x2d\x0d\x61\xdd\x08\x77\xd8\xea" "\x15\xa3\xe4\xb7\x26\xd4\xdb\x34\x4f\x3d\x8e\xfa\xb5\x50\xcb\x30\x06" "\xde\x66\x4f\x8d\xbd\xcf\x7a\xb5\x6b\x96\x3f\xac\xc2\xc4\xd8\x49\x5b" "\x52\xe2\xc5\xdf\xd6\xd9\x8b\x07\x06\x69\xe3\xf2\x00\x87\x66\x42\xdd" "\x64\x4e\x7c\xb2\x47\x22\xdc\xa9\x19\x80\xa3\x91\xf6\xb4\xd8\x75\x2b" "\xfb\xba\x4c\x87\x9c\xbb\x15\xe5\x24\x8f\x0a\xe3\x74\x7c\x67\x51\x6a" "\x21\xcf\x3c\x52\xa5\x06\x02\xad\xae\xf5\x2f\x5e\xa6\x05\x98\x4f\x0e" "\x2e\x53\xc1\x49\x88\x62\xbc\x7f\x29\xc9\x38\x28\x4f\xa2\x05\x9e\x2b" "\x18\x95\x16\x2d\xf7\x72\x34\x62\x64\x36\x9d\x44\x8f\xc9\xf8\xf9\x7b" "\xcf\xf1\x6c\x28\x75\x58\xff\x42\x75\xa1\x4d\x94\xc2\x33\xb2\x82\x31" "\x21\x18\xe1\x0d\x20\xaf\x62\x44\x0d\xf7\xf2\x74\x17\x68\xdc\xca\xf0" "\x1d\x7f\xb2\x3e\x5f\xa4\x70\x86\x39\x13\x5f\x52\xda\x13\xef\xbb\xd2" "\xa6\x1d\xf5\xbb\x1f\x84\x16\xaa\x2f\x31\x12\xcc\xf5\x0d\x8b\xea\xf8" "\xc7\xc7\x12\x5f\x39\x02\x70\x15\x87\xb6\x20\x6c\xc7\x4b\x56\x42\x83" "\x33\x30\xa2\x79\xf2\xab\x8b\xff\xcd\xee\xad\x86\xf6\x5b\xcc\xe4\x5c" "\xd8\xfd\x41\x2f\x4e\x67\x77\xbe\x12\x36\x1a\xab\xff\x48\x55\x49\x8d" "\x59\x94\x4e\x60\x7b\x2b\xae\x62\x9f\xb8\x6d\xb8\xb2\xd3\xc8\xe7\xc9" "\xcf\xbe\x16\x80\x09\x0c\x4b\x2c\x36\x21\x6b\x7e\x14\x99\xc1\x0c\x53" "\x34\xaa\x49\xff\xe9\x88\x13\x41\x41\xd3\x1a\x36\x7d\x1c\x7a\x4a\x4d" "\xfb\x15\xfa\x88\x19\x3e\x7d\x33\x9f\xe8\x81\xfc\xac\xf8\x87\x75\x96" "\x28\xa1\xb4\x88\xd4\xa9\x47\x31\x31\x26\x4b\xbf\xd7\xa2\xa5\x82\x1a" "\x06\xd0\xfb\xb5\xe8\x6f\x5f\xb4\x72\x3f\x99\xac\xba\x30\xdf\xcf\x19" "\x77\xdf\x0d\x46\x84\x7e\xa6\x8b\xc5\x47\xe9\x25\x65\x21\x10\x4b\x55" "\x2c\x8e\x4d\xad\xc8\x61\xde\x7d\x12\xfe\x24\xd8\x61\x25\xb8\x14\x31" "\xe6\x1d\xaa\xd5\xb9\x27\x02\x7f\xa4\x72\x96\x26\xd5\x70\x80\xb4\xe5" "\x24\x91\x7d\xd2\xea\x73\x3b\xa2\xec\x26\xa5\x68\xc9\x2c\x01\x50\xab" "\xdc\xb9\xee\x6d\x7e\xce\xf5\xa1\x0b\x43\x40\x6a\x6b\xa0\x10\x48\x4c" "\x0d\x16\xd8\xa0\x6b\xd3\x96\xd4\x1b\xe8\x49\xb0\x0b\x0c\xfd\x12\x03" "\xca\x6e\x84\xff\xcc\xf7\x9c\xa9\x8a\x2c\x08\x4c\x50\x0e\x32\x41\x4a" "\x40\xf9\xf9\xb3\x60\xf2\x29\xd2\xb0\x1f\x15\x52\xd0\xf7\x5a\xd1\xd8" "\x75\xf1\xc3\x70\x03\xa9\x63\x80\x6a\x85\xf8\x7e\x76\xd5\x79\x19\x07" "\x6a\xc3\xf8\x36\x1f\x7a\xd5\x5b\x4d\xd0\xd6\x50\xd6\x09\x65\xf8\xe2" "\xab\x53\xdc\x96\xbd\xab\x03\x6c\x13\x6e\xd1\x69\xcc\x5e\x9a\xa0\xa6" "\xa6\x64\xde\xbd\x2e\x12\xa8\xad\xc2\xe9\xdb\x4b\x5b\x6e\x32\xb1\x39" "\x5f\x78\x81\xc1\x74\x1c\xd6\x86\x45\x46\x59\x76\x9a\xea\x0c\x4e\xfb" "\x86\x1c\xac\xb5\x2c\x5d\x48\xa2\xa1\x19\x7f\x02\xd4\x26\x2b\x6f\x04" "\x10\x87\xa6\x8c\xb6\xe2\x0b\x24\x3a\xa8\xff\x36\xd4\x7b\x87\x5d\xa9" "\xee\xe2\x04\x4b\xf3\x76\x6a\x15\x04\x3d\x70\x9f\x8a\x21\x80\x6c\x8c" "\xe9\xf1\x95\x78\xdd\xc3\x2a\x68\x50\x9e\x90\x44\x78\x47\xe6\xef\x21" "\x2e\xb8\x96\x53\x16\xac\x54\xde\x05\x79\x41\x02\x3c\xb0\xa1\x6a\x5b" "\x53\xc2\xc7\xc3\x56\x5d\xb9\xf8\x33\x7c\xe8\xc1\x22\x8f\xbd\x07\x50" "\xa0\x39\x77\xa1\x61\xf5\x56\xaf\x1e\x54\x78\x10\x8a\x98\x68\x53\xf6" "\xb2\xde\x66\x9c\x62\xae\x2d\x9c\xa6\xa4\x93\x4f\x99\xbf\x62\x5a\xd0" "\xae\xca\x95\x01\x69\xa3\xfb\xe6\x77\x20\x87\x74\xc9\xa0\x23\x2b\x0a" "\x75\xfe\xd1\xe8\x35\x6a\x3b\x2b\x72\x82\x26\x83\x1c\x42\x7b\x5a\xb7" "\xa2\x40\x3c\x6f\x54\xad\x87\xec\x06\x62\xa2\x46\x74\xe9\xd8\x68\xf2" "\x87\xd7\x36\xd0\x68\xf5\x1d\x7a\xe9\x47\x4f\xe8\x9c\xf6\x88\xb7\x78" "\xac\xdb\x4a\x32\x4a\x7e\xcc\xaf\x6e\x3d\x8c\xa9\xf7\xf3\xff\x21\x17" "\x67\xc2\xfe\x0b\xc7\xcf\x77\xf8\x79\x9f\x58\xc9\x31\x93\x70\xfa\xd9" "\xa8\x16\x79\x65\x73\x4f\x7e\x6f\xf8\x19\x2c\x5e\x7f\x8c\x10\xab\xa4" "\xe4\xeb\x78\x4e\xaf\x21\xa3\xcc\xe1\x12\x2a\xb6\x4e\x97\x2c\x3b\x9c" "\x62\xfe\xda\xbf\xec\x46\x09\x48\xea\xf6\x63\x0d\x5b\x69\x75\x8c\xeb" "\x30\xbf\xe9\x46\x44\x23\x9a\xbd\xf7\x03\x8f\xc8\x05\x92\x92\x07\x66" "\xb5\x3a\x0e\x3b\x6c\x5e\xf5\x7e\xaf\xc6\x4a\xc3\xd4\x34\x6a\x7f\x56" "\x14\xfd\x32\xd7\x4c\xf8\xfa\xa8\x84\xca\xe9\xde\x40\x8d\x41\x6f\x08" "\x5f\xab\xeb\x36\x3c\x97\xa9\x01\xd7\x8d\xee\xd8\x2a\xde\x65\x2a\x3f" "\x05\x9a\xf4\xf8\xea\xa1\x1c\x91\x9b\xd8\xff\x02\xc7\xf2\x8b\x72\xef" "\xc0\x00\xed\xea\xe1\xfa\xa1\x11\xe0\xfe\x23\x92\x87\x6a\xa6\xaf\xd7" "\x74\x58\x69\x2c\xe3\x4c\xd3\x92\xbe\xb6\xef\xe8\x7b\x28\x0c\x0f\x22" "\x32\x8d\x47\xa8\x00\x8e\x7c\x5d\x0b\x2f\x35\xb8\x5a\xe7\x4a\xf9\xe5" "\x31\x77\x7d\x75\x5b\xcc\x90\x10\x9c\xf3\x36\x0b\xa8\xad\xbf\x4d\x45" "\x2a\xdd\xe2\x29\x96\xfa\x16\x50\x19\x07\xb3\x4e\x23\x2e\xd7\x46\xe7" "\xc1\x7d\x78\x42\x13\xa8\x60\x89\x1a\xf9\x8f\x9b\xf5\xb2\xce\x28\x23" "\x4c\x42\xaf\x66\x1b\x93\x2f\xd8\xbc\x6c\x50\x8f\x73\x65\x77\xfe\xee" "\x0e\x03\x6b\x88\x38\xd0\x1c\xc8\x06\xab\xe0\xa3\x0a\x2b\x8c\x23\x5a" "\xcc\xd2\xe8\x29\x85\x88\xa2\x4f\x67\x53\xea\x04\xd3\x70\x4f\x81\xae" "\x4e\x48\x6c\xe2\xd3\xa7\xa0\x1a\xa1\x5b\x2c\x32\x20\x12\x8f\x62\x5b" "\x17\x38\x59\x28\x90\xc3\x97\xdf\x52\x50\xee\x45\xb9\xaf\x45\x0c\x4a" "\x96\x33\x2b\xfd\xb4\x16\x8d\x67\x1b\x91\xa3\x35\x6e\x6a\x71\x4f\x36" "\x79\x5d\xe7\xd1\x24\x47\xa9\x51\xec\xe2\x78\x84\x23\x4c\xb6\x2b\xf4" "\x73\xea\x83\x78\x1d\xa5\x6f\x94\x92\x90\x18\xe5\x65\x5d\x3a\xf7\x9b" "\x66\xa8\x4e\x8c\x4f\xbc\x99\x7d\x28\x02\xfc\xf3\xe8\xb2\x84\xf1\xe0" "\x21\x10\xbe\x2e\xa1\xe9\xd8\xf0\x0c\x22\x36\xa8\xf0\xa9\xf7\xd6\x66" "\x66\x2a\x16\xf2\x27\x51\x9a\x2c\x33\x60\x6a\xaf\x7b\x78\x00\x1f\x8d" "\x9b\x9f\xc1\xb9\xcb\x74\x91\x4c\xda\xa5\xa6\x11\x16\x33\xbf\x60\x25" "\xcf\x87\x6b\x4d\x21\x41\x91\xb8\x0d\xad\x99\x91\x0c\x1d\xaf\x0e\x4f" "\x42\xeb\x70\xb1\xf2\x43\x8d\xb3\xa0\x59\xfb\x86\xac\xe1\x25\x60\xae" "\x3b\x81\x8d\x01\x7d\x0e\x0a\xa1\xe9\x81\x5a\xa9\x00\x01\x95\x74\xa9" "\x95\xee\x1a\x1e\xe6\xa7\xf7\xfa\x48\x7d\x53\x60\x4a\xbf\x48\xd0\x92" "\xc6\x47\x28\x27\x87\xa2\x08\xf9\x79\xdf\x98\x5a\x05\x72\x36\x60\x34" "\x58\x4a\x2f\xde\x0a\x5f\x54\x38\x0a\x81\x06\x98\x45\x4a\x68\xfc\x78" "\x08\x53\xbe\xef\x8c\x27\xcf\x16\x38\x3f\xbc\xdd\x8b\xaa\xa7\x20\xea" "\xa4\x6b\xc2\x56\x2a\x23\x8f\x3d\x10\x29\x12\xa4\xde\xfc\x5c\xc1\xad" "\xda\xe4\xe7\xc8\x66\x1c\x6c\x8e\xd2\x51\x72\x05\xac\x7b\xad\x51\xd3" "\x1a\x0e\x2c\xa4\x9d\x0d\xe0\xbf\xfa\x8c\x8b\x7d\xde\x84\xe3\xd7\xc2" "\x85\xf7\xcd\xe0\xea\x50\xa5\x29\xdd\xfd\x8d\x1c\x69\x0f\xc4\x04\xda" "\x16\x17\xb7\x65\x8b\x48\x5b\xbe\x2c\xbe\xcc\xb5\x47\x63\x37\xfa\xe4" "\xe2\x6f\xf0\x38\x82\xb2\xc9\xf5\xe6\x9e\x8f\xe7\x23\xa8\x9c\xcb\x36" "\x04\xbc\xcd\xb6\x31\x31\xb2\xde\x83\x9e\x2a\x9d\x5e\x2a\xb8\x32\x42" "\xc4\x5b\xa9\xc5\xb8\x72\x15\x6e\x61\x9e\xdf\xc1\xc4\x78\xab\xd7\x6b" "\x85\x95\x47\x46\x84\xb4\x52\xd2\xda\x1b\x14\xaf\x70\xc2\x1f\xf5\x9d" "\xbd\x78\x88\x42\xda\x10\x1a\xbc\x97\x72\xd7\xd9\x96\xa6\x11\xa7\xf9" "\xf1\x5e\x7c\x0c\x89\xf1\x46\x54\xa5\x2b\xcc\xeb\x46\xad\xce\x0f\x41" "\xa8\xdd\x93\x6d\xff\xa1\xa0\x92\x0c\x8f\x31\x32\x1e\x59\x6b\xc2\x58" "\xf6\x69\x80\xd8\xd5\xd6\x8f\x73\x22\x55\x8c\x76\x93\xd7\x07\xf1\xd0" "\x20\x43\xa4\x34\x56\xbc\x5b\x63\xe0\xc3\xd8\x7d\x8b\x7d\xef\xac\xbc" "\x00\xe9\x5b\xcb\xd2\x40\x6b\xfc\xe6\xc9\xce\x4c\xc2\x23\x2d\x91\x92" "\x72\x1f\xa4\xd7\xf6\x3f\x75\xf2\x45\x10\x86\xa4\x9e\x08\x22\xe9\x34" "\x92\x04\xf5\xdd\x50\xb9\xbf\x85\xef\xdf\x51\x35\xf0\x20\xac\xc2\xdd" "\x41\x09\xbc\xa3\x35\xb6\xac\xe0\xf4\x4a\x50\x60\x14\xb0\xe7\x36\x89" "\xa4\x36\xd6\x32\x50\x7e\xb0\xeb\xea\x87\xb0\xe6\x4a\xb0\x6d\x0d\x5c" "\x4b\x27\x46\x34\x34\xd5\x54\x79\x99\x2c\x7e\x3c\x6a\xb1\x7c\xa7\xd8" "\x82\xb6\x31\x59\xc0\xb7\x7a\x7c\xd0\xbb\x21\x28\xcc\x7f\xbd\x60\x8a" "\xa7\x79\x4e\x42\x89\x70\xf8\x82\xa5\x2b\xaa\xda\x7e\x57\xd3\x9a\x80" "\x4c\x91\x23\xe9\x47\xd5\x66\x20\x48\xf4\xed\x61\x16\xbb\x12\x89\x57" "\x8a\x6e\xad\x96\xa7\x30\xf6\x38\xbb\x17\xca\xd4\x34\xaf\xfc\x23\xf4" "\x10\xf4\x2a\xda\xd7\x9c\x99\xb7\x2f\x15\x13\xb0\x15\x18\x10\xab\x45" "\x59\x57\xf5\xb1\x45\xd7\x04\x03\x6e\x1b\x64\xb8\xfa\xa6\x65\x40\x49" "\xe3\xc9\x4e\x88\x2f\xc0\x9a\x37\xfe\x9d\x01\x32\x51\x71\xc3\xc0\x37" "\x93\x43\x0a\xc6\xcd\x6a\x51\x1c\x0b\x0c\xae\xbe\xcd\xbd\x1b\x25\x8d" "\xcc\x87\xb5\x5a\x7d\x7c\xe8\xa5\xa7\xe2\xb5\xb2\x46\x1a\x43\x54\x13" "\x12\xb1\xfc\xb2\xe1\xf0\x4d\x67\x80\x90\xd2\x27\xc0\x77\xed\xa0\x9f" "\xff\x8e\x9c\xfb\x25\xcd\xc7\x18\xdd\x0b\x2a\x7d\x87\x43\xb0\x2e\x0f" "\xa0\x7d\xc0\x8d\x59\x51\xe9\x76\xf4\xdb\x84\x2f\x39\x8c\x23\x41\xd0" "\xdb\x8a\xfe\x3d\x5a\xa4\x1a\x0a\x45\x38\xaf\xe3\xfc\x38\x49\xd3\x49" "\x7f\x49\x03\x35\x83\xcd\x10\xb1\x52\x2b\xaa\x84\xb9\x5f\xdf\xc5\x40" "\xe9\xf8\x6e\xe1\xb4\x56\x16\xf6\x36\x53\x83\x28\xee\x9e\x6f\x5c\x99" "\x83\x1a\x3e\x7f\x74\xf0\xb2\xe0\x23\x41\x4d\x68\xe0\xd6\x74\xd2\xd1" "\xfc\x11\xf3\x42\x83\xd3\x5b\x58\x78\x2c\x7d\xce\x02\xb1\x67\x86\xc6" "\xa6\x14\x08\x20\x94\xfb\x76\xa5\xfd\x53\x7c\x7e\xf4\x8c\x83\x77\x37" "\x8d\x2d\x50\x1e\x76\xd3\x53\x45\xa5\x2c\xcb\xaf\xe6\x0e\x89\xf3\x73" "\xa8\x30\x97\x8a\x93\x35\x4d\x60\x48\x7f\x1c\xa4\xea\x4b\x66\x61\xae" "\x3d\x6c\xb3\x56\x98\xa3\x51\xe1\x1b\x67\x0f\xf7\x92\x84\x09\x49\x2e" "\xf8\x23\x4d\xdc\x50\xd5\xbe\x28\xab\x0a\xe7\x9a\xbc\xb6\x74\x1b\x71" "\x7a\x95\xa7\xd2\x27\x59\x5d\xf8\x62\xb6\xd0\x44\xf7\xad\x1a\x89\x79" "\xa9\xa8\xb1\x6b\x64\xad\x2b\x15\x94\xb6\xe3\x19\x44\x63\x04\x61\xa9" "\x42\x1e\x5a\x90\x76\x92\x2b\x59\x68\xc6\xd8\x52\x70\xbe\xa3\x85\x2f" "\x23\x2c\x6e\x93\x25\xb9\xc9\xe4\x0d\x92\x37\xcb\x19\x1e\xf3\xfa\x2a" "\x90\x45\xe3\x42\x27\xf1\xb8\x0e\xc5\xac\x1b\x6c\x26\x64\xd6\x1d\x2e" "\xb0\x41\x10\xcc\x1c\x8b\x83\x07\xd0\x60\x9d\xdc\x25\xa3\x0d\xfb\x17" "\xa7\x6a\xfe\x21\x92\xe6\x1b\xad\xe1\x4d\x29\x7f\x04\x3f\xdd\x7d\x2a" "\x06\xdb\xad\xe4\xf9\x5b\x4b\x9c\x2f\x42\xd8\x66\x85\xa3\xba\xab\x98" "\x81\x54\xf5\x54\xaa\x83\xa2\xd8\x19\x63\xe4\x15\x9b\x0e\x42\x47\x53" "\xd9\xf9\x0d\x83\x8f\xfb\x94\x50\xe9\x46\x2a\x81\xfb\xe5\xcb\x51\x23" "\x8b\xbb\x97\xe3\x21\xd5\x08\x4c\x79\x25\xef\x5a\x10\x0b\x6d\x0b\xbc" "\x7c\x53\xf4\xfc\x6b\xe4\x5c\x8b\x56\xe4\x89\x06\x23\x2a\x63\xb6\xc7" "\xb5\x3e\x18\x3b\xa5\x26\xba\x9d\xf5\x13\x39\x28\xfa\x0e\x54\xbe\x27" "\x49\xfd\xa9\x31\xb7\x12\x72\xb7\x12\xc5\x27\xf5\x27\xa0\x7c\xc0\x21" "\x65\xb7\xe8\x83\x12\xba\xcc\x1e\x61\xd9\xc8\x99\x9e\x0b\xd2\x4c\xd2" "\x9e\xf1\xa6\xf2\x07\xfa\xaf\x3c\x7f\x7e\xa4\x67\xe7\x4e\xda\x5e\x63" "\x47\xe1\xb5\xf0\xc6\x14\xbb\x73\xb4\x74\x40\x27\xcf\x66\x5a\xb0\x31" "\xa9\xa0\xe0\x6c\x83\x2e\x81\x60\xc4\x91\xd9\xd8\x2a\x39\x8d\xdf\x38" "\x46\xdc\xd6\x8a\xa5\x8a\x42\x40\x72\x78\x71\x1d\xac\xc7\xb4\x55\xcb" "\x06\x27\x2f\xdc\xaf\x89\x71\xc4\x8a\x73\xd2\x81\xae\xe2\x6d\x7c\x29" "\xeb\x2b\x7c\xe1\xdf\x28\x23\x0a\x7f\x89\x6d\x53\xff\x69\x6e\x9d\xeb" "\x98\x01\x5d\x1b\xd8\xcb\x49\x51\xc5\xeb\x85\x2b\xa9\xad\x59\x68\x79" "\x94\x8f\x10\xa5\x03\x48\x99\x61\xc7\x25\xa1\x3c\x92\xb6\x3b\x90\x5f" "\x1a\x53\x42\x2e\x74\xcc\x83\x0c\x13\x1d\xe3\x77\x66\x13\x40\xb6\xd0" "\x66\x48\x6c\xd2\x60\xd5\x00\x2a\x1c\xca\x92\xf4\xb6\x19\xce\xcf\xa1" "\xa4\xc3\x70\x01\x5f\x14\x2a\xce\xdd\x0c\x88\xfb\x5c\x86\xe3\x09\xab" "\xc7\xa5\xc6\xdc\x1c\xd1\xb9\x05\x84\xc2\xf8\x38\xda\x5a\x0e\xa3\x8e" "\x8a\x8c\x05\x46\x28\x15\x69\x16\xeb\x36\xaa\xc9\xf0\x1b\x99\x44\x6b" "\x1e\xcc\x35\x4e\x8e\x28\x4e\xa9\x3c\x64\x6f\xd3\xac\x15\x4c\xd4\x33" "\x17\xfb\xdd\xcd\x72\x04\x7b\x53\x8e\x86\x97\xf9\xf2\x38\x94\xbe\x43" "\xf4\xc1\x10\x61\xb0\x8f\x89\xce\xcf\xc8\x5f\x8e\x40\xb2\x14\xf3\xe0" "\xce\x15\x97\xa3\x46\x84\x79\xa3\xc9\x03\xf5\xdc\xf5\x14\x9e\xf8\xd4" "\x37\x9a\x26\x5b\x1c\x92\xc3\xa1\x81\x3d\x67\xb4\xcf\xff\xfd\xe5\x44" "\x67\xf6\x01\x29\xec\xa0\xd3\x6b\xab\x2b\xf3\x88\x15\x97\xec\xe3\x77" "\xdc\x98\xbd\xf1\xf1\xb4\x81\xd4\xc5\x7b\xc1\x9f\x16\xcf\x15\x91\xa5" "\xa0\xc5\x50\xda\xe7\x96\x24\x2d\x7b\xff\x8f\x43\xfb\x44\x8a\x40\xa3" "\x83\x48\x23\xde\x98\xaf\x6d\x1b\xb7\x9a\x12\xe6\xfd\xa7\x1b\xda\x01" "\x98\xc4\x16\xf2\xd2\xbc\xe5\x8e\xb4\xca\x4c\x2f\x6e\xc8\x07\xe9\xde" "\x0b\xbf\xe8\x78\x6b\xdb\x9a\x09\x20\x6b\xab\xd1\x60\xbe\x24\xcf\xb5" "\x18\xe4\x37\x50\xc0\xac\x97\x9d\x2a\x07\x17\x0e\x08\xac\xf6\x82\xdd" "\xc1\x1e\x56\x32\x7f\x7c\x41\x26\x8e\xf3\xe8\xc1\xa4\xf7\x29\x9b\xec" "\x2c\x28\xcb\x40\x62\xfd\xf1\x50\x71\xea\x07\xa0\xa2\xc6\x84\x04\x9c" "\x92\xe2\x53\xa7\x29\x45\x51\xbe\x45\x62\x40\x22\x3e\xb5\x07\xf2\x9d" "\xea\xd5\x28\x34\x89\x00\x7c\xee\xba\xa5\xe1\x43\x4b\x45\x11\xed\xee" "\xef\xc0\xa4\x4f\xb2\x73\x3e\xea\xb7\x7e\xac\xc3\xad\xa5\x22\xd0\x64" "\x2e\xac\x4c\xc6\x14\x9d\x85\x77\x38\x5a\xd7\xbb\x84\xae\xcf\x78\xe0" "\x19\xfd\x0d\x89\x86\x9f\xea\x99\xda\x3d\xd4\x1c\x0a\x93\xa7\x10\x5e" "\xc4\x2b\xa1\xed\x88\xcf\x8b\x9c\xce\x2c\xba\xbd\x92\x34\x2c\xda\x9e" "\xfa\xf1\x38\x1b\x6e\x56\xbb\xbe\xaf\xd6\xfc\x8e\xfd\xcd\xa9\x2f\x9d" "\x57\xd9\xae\x13\xee\x14\x96\xfa\x0c\x28\xeb\x14\xed\xcd\x7f\x6f\xf5" "\x32\xa8\xb6\x1f\xca\xba\x4e\x20\xe0\x97\xc7\x94\x3e\x07\x75\x08\x98" "\x9f\x4f\x02\xcf\x59\x8c\xfe\x0c\x7b\x55\x5d\xf2\x8b\xdc\xf9\x7a\x07" "\xb8\x3e\xbc\xd7\x53\xd8\xd7\x3c\x81\x12\x4b\x44\x90\x9d\x88\x88\x5e" "\x30\x19\x24\xdb\x83\xab\x94\x0f\xc7\x41\xa9\x84\x76\x4a\x9e\x91\x8e" "\x69\x4e\x00\x5a\xf0\xdc\xf9\x46\xd0\xd5\xc0\x76\xd8\x88\xed\x01\x7e" "\x3f\x89\xa8\xc2\xc3\x92\x2d\x46\x7f\x98\x84\x40\xf9\x33\x29\xd8\x62" "\x06\xe5\x29\xd6\xbb\xed\xcf\x41\x90\xfd\x90\xd3\x5a\xa6\x54\x45\x74" "\xb7\x76\x79\x90\x2b\xe7\x28\x9a\xfe\xca\x53\x81\x34\x32\xd6\x29\x08" "\xe4\x2b\x44\x1b\xcc\xcb\x82\xe3\x74\x81\xf2\x9f\x3d\x92\xf7\x35\x67" "\x69\x6e\xe1\x3c\x51\x6c\x77\xe3\x02\xfa\x5c\xb2\xa9\x93\xb1\xe3\x4e" "\xc4\xef\xeb\xc1\x19\x44\x67\xf4\x03\x86\x4e\x4d\x68\x70\x15\x24\x2f" "\x78\x59\x7a\x29\xd3\x9c\x99\xe1\xfd\x1b\x63\x83\x82\x2a\x74\xac\x95" "\xb1\xd2\x03\x92\x4c\x7f\xd7\xc5\xf3\xe9\xe1\x62\xa6\x97\x98\xee\x39" "\x74\x2d\x42\x8c\x24\x33\x99\x7c\xb8\x67\x70\x25\xdb\x5e\x69\x7b\x69" "\xc7\x49\x9b\x74\x80\xdd\x2a\x67\xd3\xfc\xaa\x2f\xa6\xf8\xaa\x76\xa2" "\xa1\xd2\x2c\x3c\x99\x86\x0d\x88\x33\xa0\xe7\x2f\x09\xaf\xdd\xe1\x20" "\x85\xbc\x76\x86\xe8\x2a\x48\x8e\xd3\xf4\x8b\xa8\x63\x54\x9f\x19\x4e" "\x1d\x19\xf3\xcb\xd3\x4e\x68\xf4\x20\x1a\x4e\x31\x2a\x25\x02\x54\x96" "\x99\x7b\xe0\x3d\x15\xbb\x8d\xa7\x3c\x7f\xf8\x90\xab\x86\x9f\xb1\x75" "\xfe\x04\x84\xd0\x06\x76\x34\xaa\xa6\xb3\x25\x21\x60\x0e\x08\x8f\x83" "\x43\xea\x22\xc5\xd6\xb2\x7c\x0f\x16\xe6\x66\x65\x17\x9d\xd8\xc8\xe8" "\x15\x64\xb7\x23\xc1\x53\xd6\x28\x8a\x09\xd8\x28\xc3\x41\x56\x08\x70" "\x12\x73\x00\xe0\x71\xcd\xd4\xcc\xe8\xab\xd7\x92\x6b\x1e\xbd\x46\x17" "\x30\x9c\x04\x2d\x5a\x77\x17\x96\x62\x05\xb4\x31\x8c\xf3\x1b\x4f\x94" "\xe4\x7f\x35\x65\x86\x77\x9c\xe3\xa1\x99\x50\xa7\xb8\x21\xca\x48\xf6" "\x13\x01\x0b\x0c\x43\x68\x7b\x80\x90\xf8\x7d\x39\x74\xc7\xea\xe3\x63" "\xca\x05\x16\x79\xb4\x01\x06\x0c\xeb\x2d\x21\x3a\x79\x90\x3b\x56\x86" "\x2c\x6a\xa9\xec\x14\xda\x3d\x3c\xa8\x81\x20\xff\x15\x65\x7d\x1c\xd5" "\xdb\x02\x90\x48\xf4\x8c\xa2\x16\x7a\xfb\xdc\x7e\x4d\x7c\xc0\xcc\x77" "\x3a\xf1\x1c\xfc\x32\x06\x76\xe4\xc1\xc9\x55\x5f\x14\x9c\x03\xb9\x2d" "\xdd\x05\x33\x52\xf3\x2c\xa1\xd7\x0d\xf6\xcc\x0f\x5d\x53\x44\x71\x8a" "\x40\x27\x49\x65\x96\x70\x41\x91\x36\x03\x19\xc7\x48\x07\xbc\x66\x68" "\xbf\x70\x55\x50\xc3\xbc\x47\x53\x21\x7b\x05\xe9\x6c\x8e\xf6\x8c\xa2" "\x1e\xa9\xb6\xc1\xf7\x8d\x0c\xfa\x28\x4d\xf5\xec\x2c\x1c\x5e\x1e\xc3" "\xec\x55\x3a\x90\x14\x12\x4a\x8a\x74\xe5\xae\x95\xe7\x85\x35\xb2\xa0" "\x89\x94\xfe\x91\xf9\xf1\x8b\x22\x77\x26\x23\x1b\x53\x08\xc5\x27\x5a" "\x3d\x91\x0b\x03\x5c\x9d\x46\xbb\x17\x8b\xee\xff\x05\x67\x9f\xa8\x21" "\x74\x13\x70\x33\x78\x1e\x45\x61\x05\x84\x84\xe0\xe0\x02\xfd\x2e\x5c" "\x49\xea\xb0\x81\xf3\xbc\x11\x64\x6a\x71\x33\x35\xc3\x85\x43\x98\xca" "\xc3\xc5\xac\xcb\x6f\x03\xfc\x8d\xe1\x01\x97\x43\x9b\xda\xf4\x75\x40" "\x71\xdd\xc5\x06\x3a\x47\xee\x75\x6b\x8f\x9a\xce\xe7\x42\xca\x8d\x0c" "\x88\x40\x47\x8b\xa5\xc8\xa9\x74\xb3\xb9\xd1\xe0\x40\x5a\xf0\xc1\x9f" "\x50\x99\x47\xa7\x77\x45\xd5\x60\xb2\x40\x72\x96\xf2\xef\x09\xcc\x81" "\x6e\x55\x04\xa7\xb7\x67\x5b\x71\x6e\x7f\xaa\x29\xe3\x41\xaa\x99\xe8" "\xa0\x5d\xe5\x05\xca\xe6\x2c\xdf\xa9\x72\x31\x43\xe7\xbb\x5e\xfc\x1e" "\xe4\xb2\xd4\x1e\xf6\x8e\xb8\x1f\x78\x72\xad\xa3\x23\x04\x87\xc4\xd2" "\x72\x44\xfa\x37\xd8\x42\x79\x09\x48\x23\x1a\xfc\x87\xb7\xce\x6e\x44" "\x27\xda\x09\x46\x81\xfa\xf4\xc4\xbc\xaa\xaf\xae\x79\x1a\x0b\x4f\xb3" "\xe8\x97\x35\x49\x39\xa4\x1e\xed\xeb\xba\x69\x3e\x5e\x9a\xd1\x82\xb1" "\xd5\xb7\x25\x6e\x28\x68\xb3\xe7\x58\x92\xc8\x5e\xb3\x75\xb7\xd2\x9f" "\xa1\x17\xbc\x0e\x8c\xbf\x41\xf0\x82\x1f\x5b\x51\x37\xb9\xb2\x71\x4c" "\x26\x96\x1d\x32\x31\xe0\x20\x95\xd1\x54\x08\x43\xa1\x0f\x7f\x4b\x0f" "\x85\x86\x1f\xdf\xf7\xe7\x45\xa9\x0f\xb6\xa4\x3c\x1d\x1e\x5a\x6b\x7b" "\x70\xdd\x07\x90\x4d\xc6\x50\x70\x87\x08\xd9\x1a\x7a\x5c\xe2\x3b\x44" "\x17\xd6\x91\xec\x00\xec\x4c\xbd\xeb\x09\x23\xa9\x34\xc7\x0a\x14\x9e" "\x40\xf7\x6f\x53\x7f\x95\x24\x5d\x9c\xe9\x90\x1b\x86\x85\xfd\xb9\x4c" "\xf2\xee\xed\xdc\xec\xa0\xac\x05\x12\x43\x58\x82\xe3\x4b\xf9\xed\x4e" "\x5f\x5f\x69\xd2\x95\x7e\xf0\x6d\xb6\x0a\xc2\x42\xf2\xb4\x5a\xd1\x32" "\x6c\x24\x66\x30\x52\x4f\xd7\x40\x7e\x70\x86\x89\xc7\x8f\xf3\x37\x26" "\xf9\x85\xec\x67\xad\x6b\x99\xe8\x65\x89\xce\x3f\x0e\x62\x77\x0f\x20" "\x60\x3d\x40\x87\x9e\x1a\x8e\xe4\x01\x73\xba\x27\x56\xe9\xc6\x6b\x40" "\x86\x5f\x32\x64\x17\x74\xc8\x2d\xe7\x62\x56\x10\x6e\x29\x1b\x01\x79" "\xd4\x78\x51\xe5\x64\xfa\x7c\xf3\x99\x84\x79\xa0\x29\xf2\x61\xba\x82" "\x1f\x64\x16\xb2\xc8\xa2\xf9\x0a\x2a\x39\xc6\x84\x89\x7b\xab\x53\x43" "\x3f\x8a\xad\xb0\x44\x15\x23\x6b\x69\xab\x87\xe1\x78\x4f\xb7\xcd\xb5" "\xb7\x4c\x9c\xe6\x38\x7e\xc7\xc8\x83\x5b\x4b\xf5\x3b\xb8\xa9\x09\xc6" "\xcc\x42\xee\xca\x04\x59\xce\x9f\x43\xc7\x90\xe6\x92\x5e\x03\x17\x08" "\xbc\x68\x27\x53\x35\x4b\xa8\x69\x9d\x8e\xbb\x70\x03\x11\x65\xd0\x0f" "\xcc\xcc\xd9\x41\x5a\xfd\xd1\xb2\x38\x05\x43\x47\x5a\xc6\xd4\x1c\x63" "\x09\x7c\xd7\x30\xde\x43\xb3\x7c\x8c\xe5\x27\x9c\x07\xcf\x96\x73\x50" "\x56\x61\x61\x06\xd1\xaf\x81\x33\x42\x20\xbc\xc3\x32\xc9\xc6\x9b\x0d" "\x90\xcc\x1a\xe6\x7a\xa2\xb0\x78\x65\x62\x11\xeb\x59\x17\x91\x00\x15" "\xea\x38\xa9\x04\x67\xda\xa0\xb2\x6d\xb2\xec\x79\xf7\xf7\xbb\x2c\x66" "\x6d\xa4\xc1\x6e\x56\x19\x5e\xd0\x6f\xb4\x38\x1e\x8c\xdc\x64\xdc\xc5" "\xee\x7e\x88\xd0\xa1\x86\x85\x9a\xc5\xc2\x08\x50\x4d\x8c\x3b\xbf\xa7" "\x2a\xf5\x13\xcd\x68\x45\xae\x34\xc3\x59\xff\x0e\xb1\xeb\x28\x7d\x49" "\x67\x4f\xb2\xac\x17\x38\xe9\x75\x26\xcb\x01\xc7\xb0\x96\x30\x51\x10" "\x08\x30\xd4\xe5\x1e\xe8\x54\x08\x87\xd8\x24\xf5\x61\x08\x70\xc2\x78" "\xbe\xa9\xd8\x03\x25\xd7\x90\x6f\xe2\xa3\x50\xfb\x0f\x7e\xf7\x08\x72" "\xea\x7b\xd6\x85\x31\x73\xcb\xdd\x4c\xd4\xd3\xaf\x25\xe7\x61\xb0\x1e" "\x2a\x6b\x6a\x56\x22\x75\x59\x0b\x27\xc8\xa8\xa5\xc5\x2a\x24\xd5\xc4" "\x44\x6f\x6c\x15\x59\xe5\x21\xeb\xcd\x0a\x20\x1e\x67\x80\xb2\xe0\xe1" "\x08\x46\x4b\x37\xed\x1e\x55\x56\x56\x11\x36\xd5\x0d\x6c\x68\x4a\x98" "\x03\xb1\x2c\xe4\xfe\xe4\xfa\x21\x83\xa8\xdd\x6e\x58\x9a\x46\xaf\x09" "\xb4\xea\xba\xc4\xfc\xc3\x3b\x2f\x4d\x09\x88\xf4\x1c\x12\xec\x43\x44" "\xcb\xbc\x63\x30\xc2\xa6\xa1\x66\xf1\x43\xb8\xc6\x3d\x1e\x8b\xa4\xff" "\x0f\x98\x52\xe4\x25\x2d\x01\xb9\xed\xf4\x92\x08\xea\xc8\xe6\xf8\xcd" "\xed\xb1\x61\xeb\x3b\x82\xe6\x52\x88\xe5\xae\x21\x71\xdf\x37\x70\xf8" "\xfd\x2f\xe2\xb9\xba\x0c\x17\xbd\xd1\xc7\x1e\x67\xea\xd4\xff\x4c\x7a" "\x2d\xbd\x14\x48\x76\x30\x34\xd8\x2c\x52\xf0\x7d\x36\x62\x6e\x51\xdd" "\xb1\x3b\x3b\x73\xd9\xc5\x2f\xb9\x62\xd0\xd6\xa7\x91\x44\xfc\x8e\x3e" "\x3d\x4f\x52\xb0\xb7\xf9\x60\x35\xba\xc0\x12\x4b\x00\xa0\xd9\x04\x69" "\xea\x14\x55\xc5\xf0\x6f\xbb\xcd\xc0\x20\xb9\x4f\x26\x0f\xff\x03\xe6" "\x8f\xf9\x9d\x8a\xef\xe1\x2b\x47\xbc\xe2\xaa\x56\x62\x85\x6e\xa1\x15" "\xc7\x96\xea\x57\x73\xac\x61\x57\xfe\xd6\xdb\x77\xf4\x95\x6a\x5e\xb6" "\xde\x83\x63\x3b\x0e\x00\xb3\xd9\x40\xc3\xe3\xf3\x10\x62\x28\xe9\x4e" "\x38\xb8\x50\x6b\xca\xdd\x9d\xaf\xf4\xed\x33\xe8\x2c\x25\x5d\x89\xed" "\x38\x0d\x9c\x54\x78\xb0\xf6\x90\x14\xe8\x0b\x99\xf2\xe0\xd1\x98\x45" "\xdc\x85\x39\xe5\xbb\x66\xbf\x7e\x48\xb8\xcc\xb8\xf4\x72\x82\x1a\x12" "\x3a\xfd\xbb\x56\x1e\xc5\x69\x83\x9d\x2f\xfb\x21\xae\xe3\x48\xf7\xf3" "\x1f\xd7\x56\x24\x70\x83\xa5\xb4\x7f\x04\xd6\x3e\xab\x69\xaf\xd2\x7c" "\xc2\x93\x85\xe7\x8c\x0e\x9c\xdd\x1f\x9a\x4c\x7f\x92\x7f\x0d\x55\xa8" "\x58\xde\x38\x96\xab\xb6\x13\x93\x17\xf1\x0b\x9b\xc5\x52\xf0\x39\x2e" "\x18\x96\x1a\xfe\x7a\xf6\xf3\xe9\x63\xee\xb5\xbd\xed\x3d\xb9\x79\xcb" "\xf5\xcf\xe2\x1a\xbf\xfe\x53\x71\x84\xa6\xe4\x81\x70\x66\xac\x2f\x2a" "\xbd\xe0\x3a\xa1\x2e\x9d\xcd\x3c\xa7\xc3\xc5\x40\xd3\x97\xc4\x75\x23" "\x8d\x33\x6f\x7e\x94\x95\x88\x61\x82\x28\x6b\xe4\x37\x5d\x5e\xe2\x08" "\xe1\xee\xc7\xb8\x12\xc9\xe5\xba\x4c\x4b\xc0\x28\x35\x39\x4a\xdd\x6c" "\x44\x8a\xc6\xc2\x78\xdc\xe9\xb3\xc5\x7c\x4c\x1f\xbd\xcb\xd0\x6e\x5a" "\x00\xee\xc9\x0d\x3f\x28\xff\xb7\x24\x21\xbe\x70\x45\xe1\x0e\x3e\x43" "\x9c\x4c\x31\xb0\x1a\x7c\xfd\xae\xe4\x39\x95\x83\xa1\xea\xa9\x38\xc7" "\xfb\x8c\xb8\x27\x95\x0e\x0f\x64\xc5\x69\x40\x2c\x5a\x5f\x15\xd4\x00" "\x87\x22\x2d\x76\x36\xcb\xa4\x4d\x46\x25\x3f\x44\xf1\x5c\xfa\x42\xa8" "\xd6\x8d\x16\x24\x2c\x9c\xa6\x58\x98\x85\xab\x84\x58\x9c\xb8\xd5\xbe" "\x1c\x6c\xf4\x1c\x88\x0c\x61\xcf\xfd\x3f\xc1\x3e\xa2\x70\x48\x07\x4c" "\x86\x06\xda\x07\x2a\xf1\x74\x8e\x6b\xff\xdf\x1a\x4b\x19\x4d\x9f\x19" "\x69\x79\xe3\x7d\xec\x18\x29\x6b\xdf\xa3\xda\x9b\x83\x1b\xd5\xc4\x2c" "\x62\xe4\x7e\x52\xf2\xac\x2c\x04\x5d\xd2\x7b\x2e\x87\xd9\xcb\x44\x43" "\xc7\xae\x35\x8f\xa7\xe1\x8b\x21\xff\x80\x3b\xa4\x9e\x76\x7f\xd4\x38" "\x13\x12\xb7\x9e\xa7\x57\x64\x4c\x84\xaa\x9d\xbf\x72\xd8\xf7\x7e\x75" "\x8f\x31\xff\x30\x23\x48\xf2\x70\x84\x70\xe9\x28\x4c\x2d\xca\xdc\xf2" "\xd1\x5f\x47\x2b\xe4\xe7\x64\x0a\x5b\x33\x67\xc5\x50\x6c\xe9\xa8\x9a" "\x50\x8e\xec\x5d\x72\x26\x9d\x73\x2a\x68\x21\x38\xd2\xe9\xbf\x4a\x1e" "\x8b\xc7\x40\x4f\x9d\xc0\xea\x56\x9a\x84\xbc\xb9\x26\x65\x1b\x03\x98" "\x79\x5b\x48\x97\x8a\x96\x44\xd3\x87\xc4\xc8\xc7\x4d\x7b\xe0\x19\xe5" "\x8a\x34\xc7\xf6\x5f\x2f\xa6\x35\x1a\x92\x72\x9c\x22\x80\x1d\x82\x17" "\x08\xcb\x06\x93\x80\xf0\x23\x8e\xf3\xe1\xc8\xd4\xc0\xf0\x3c\x59\xf0" "\xc0\x5c\xc2\x72\xe7\xa7\x5a\x10\x05\x9e\x6e\xaa\x17\x6e\xb5\xdb\xc4" "\x6f\x43\xf0\xee\x97\xef\x1b\xcb\x5d\x46\x28\x26\xd4\xea\xf9\x85\x32" "\x89\x01\xd4\xd3\x06\xd7\xf2\x09\xde\x06\x26\xc0\x4c\xee\x86\x10\x48" "\x6b\x7e\xc4\xf2\xf3\x64\x83\x56\x64\x68\x9e\x77\x1c\x26\xd4\x83\x16" "\x4c\x39\xe0\x1b\xca\x0e\xe4\x85\xf1\x93\xe9\x2e\x52\x03\x6a\xb8\x69" "\xf7\x07\x28\xd7\x6b\x20\x01\x55\x90\x3c\x2d\xc7\xd4\x90\xb8\x29\x3c" "\xdc\x58\x75\x93\x3b\xfe\x46\x1f\xe4\x2f\x6a\xc0\x0a\x0d\x12\xb0\x00" "\xaa\x87\x2d\x7e\x47\x74\x9a\x80\x93\x81\x9a\x4e\xdf\x9b\x31\xd6\xf2" "\xfd\x7c\x96\x55\xcd\xa3\x79\x12\x2f\xcc\xa1\x91\xdf\x49\x2f\x1c\xee" "\xf9\x34\xe5\x7e\x34\xfa\x87\x9e\xd9\x34\x43\x65\xeb\xe0\xb2\xb2\x68" "\x00\x6d\x3c\x66\xc6\x30\x66\xf7\x8a\x68\x89\x10\x1e\x2e\xa4\x7f\x53" "\x51\x64\x21\x04\x4e\x7e\xc1\x62\xc5\x1a\xa2\x4f\x50\x68\x03", 8192); syz_fuse_handle_req(r[6], 0x20004400, 0x2000, 0); break; case 12: syscall(__NR_read, r[6], 0x20000380ul, 0x2020ul); break; case 13: *(uint8_t*)0x20000400 = 0x16; *(uint8_t*)0x20000401 = 0; *(uint16_t*)0x20000402 = 0; *(uint32_t*)0x20000404 = 8; *(uint64_t*)0x20000408 = 0; *(uint64_t*)0x20000410 = 0; *(uint32_t*)0x20000418 = 0; *(uint32_t*)0x2000041c = 0; *(uint64_t*)0x20000420 = 0; *(uint16_t*)0x20000428 = 0; *(uint16_t*)0x2000042a = 0; memset((void*)0x2000042c, 0, 20); syz_io_uring_submit(r[2], r[3], 0x20000400, 0); break; case 14: syscall(__NR_io_uring_enter, r[1], 0x2ff, 0, 0ul, 0ul, 0ul); break; } } int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); loop(); return 0; }