// https://syzkaller.appspot.com/bug?id=9358b6691200512807e3d29c6b5a27710d3ad2ad // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef __NR_memfd_create #define __NR_memfd_create 319 #endif static unsigned long long procid; static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i = 0; for (; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { int state; } event_t; static void event_init(event_t* ev) { ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { if (ev->state) exit(1); __atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE); syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000); } static void event_wait(event_t* ev) { while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0); } static int event_isset(event_t* ev) { return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE); } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; for (;;) { uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts); if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) return 1; now = current_time_ms(); if (now - start > timeout) return 0; } } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } //% This code is derived from puff.{c,h}, found in the zlib development. The //% original files come with the following copyright notice: //% Copyright (C) 2002-2013 Mark Adler, all rights reserved //% version 2.3, 21 Jan 2013 //% This software is provided 'as-is', without any express or implied //% warranty. In no event will the author be held liable for any damages //% arising from the use of this software. //% Permission is granted to anyone to use this software for any purpose, //% including commercial applications, and to alter it and redistribute it //% freely, subject to the following restrictions: //% 1. The origin of this software must not be misrepresented; you must not //% claim that you wrote the original software. If you use this software //% in a product, an acknowledgment in the product documentation would be //% appreciated but is not required. //% 2. Altered source versions must be plainly marked as such, and must not be //% misrepresented as being the original software. //% 3. This notice may not be removed or altered from any source distribution. //% Mark Adler madler@alumni.caltech.edu //% BEGIN CODE DERIVED FROM puff.{c,h} #define MAXBITS 15 #define MAXLCODES 286 #define MAXDCODES 30 #define MAXCODES (MAXLCODES + MAXDCODES) #define FIXLCODES 288 struct puff_state { unsigned char* out; unsigned long outlen; unsigned long outcnt; const unsigned char* in; unsigned long inlen; unsigned long incnt; int bitbuf; int bitcnt; jmp_buf env; }; static int puff_bits(struct puff_state* s, int need) { long val = s->bitbuf; while (s->bitcnt < need) { if (s->incnt == s->inlen) longjmp(s->env, 1); val |= (long)(s->in[s->incnt++]) << s->bitcnt; s->bitcnt += 8; } s->bitbuf = (int)(val >> need); s->bitcnt -= need; return (int)(val & ((1L << need) - 1)); } static int puff_stored(struct puff_state* s) { s->bitbuf = 0; s->bitcnt = 0; if (s->incnt + 4 > s->inlen) return 2; unsigned len = s->in[s->incnt++]; len |= s->in[s->incnt++] << 8; if (s->in[s->incnt++] != (~len & 0xff) || s->in[s->incnt++] != ((~len >> 8) & 0xff)) return -2; if (s->incnt + len > s->inlen) return 2; if (s->outcnt + len > s->outlen) return 1; for (; len--; s->outcnt++, s->incnt++) { if (s->in[s->incnt]) s->out[s->outcnt] = s->in[s->incnt]; } return 0; } struct puff_huffman { short* count; short* symbol; }; static int puff_decode(struct puff_state* s, const struct puff_huffman* h) { int first = 0; int index = 0; int bitbuf = s->bitbuf; int left = s->bitcnt; int code = first = index = 0; int len = 1; short* next = h->count + 1; while (1) { while (left--) { code |= bitbuf & 1; bitbuf >>= 1; int count = *next++; if (code - count < first) { s->bitbuf = bitbuf; s->bitcnt = (s->bitcnt - len) & 7; return h->symbol[index + (code - first)]; } index += count; first += count; first <<= 1; code <<= 1; len++; } left = (MAXBITS + 1) - len; if (left == 0) break; if (s->incnt == s->inlen) longjmp(s->env, 1); bitbuf = s->in[s->incnt++]; if (left > 8) left = 8; } return -10; } static int puff_construct(struct puff_huffman* h, const short* length, int n) { int len; for (len = 0; len <= MAXBITS; len++) h->count[len] = 0; int symbol; for (symbol = 0; symbol < n; symbol++) (h->count[length[symbol]])++; if (h->count[0] == n) return 0; int left = 1; for (len = 1; len <= MAXBITS; len++) { left <<= 1; left -= h->count[len]; if (left < 0) return left; } short offs[MAXBITS + 1]; offs[1] = 0; for (len = 1; len < MAXBITS; len++) offs[len + 1] = offs[len] + h->count[len]; for (symbol = 0; symbol < n; symbol++) if (length[symbol] != 0) h->symbol[offs[length[symbol]]++] = symbol; return left; } static int puff_codes(struct puff_state* s, const struct puff_huffman* lencode, const struct puff_huffman* distcode) { static const short lens[29] = {3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31, 35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258}; static const short lext[29] = {0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0}; static const short dists[30] = { 1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193, 257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577}; static const short dext[30] = {0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 13, 13}; int symbol; do { symbol = puff_decode(s, lencode); if (symbol < 0) return symbol; if (symbol < 256) { if (s->outcnt == s->outlen) return 1; if (symbol) s->out[s->outcnt] = symbol; s->outcnt++; } else if (symbol > 256) { symbol -= 257; if (symbol >= 29) return -10; int len = lens[symbol] + puff_bits(s, lext[symbol]); symbol = puff_decode(s, distcode); if (symbol < 0) return symbol; unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]); if (dist > s->outcnt) return -11; if (s->outcnt + len > s->outlen) return 1; while (len--) { if (dist <= s->outcnt && s->out[s->outcnt - dist]) s->out[s->outcnt] = s->out[s->outcnt - dist]; s->outcnt++; } } } while (symbol != 256); return 0; } static int puff_fixed(struct puff_state* s) { static int virgin = 1; static short lencnt[MAXBITS + 1], lensym[FIXLCODES]; static short distcnt[MAXBITS + 1], distsym[MAXDCODES]; static struct puff_huffman lencode, distcode; if (virgin) { lencode.count = lencnt; lencode.symbol = lensym; distcode.count = distcnt; distcode.symbol = distsym; short lengths[FIXLCODES]; int symbol; for (symbol = 0; symbol < 144; symbol++) lengths[symbol] = 8; for (; symbol < 256; symbol++) lengths[symbol] = 9; for (; symbol < 280; symbol++) lengths[symbol] = 7; for (; symbol < FIXLCODES; symbol++) lengths[symbol] = 8; puff_construct(&lencode, lengths, FIXLCODES); for (symbol = 0; symbol < MAXDCODES; symbol++) lengths[symbol] = 5; puff_construct(&distcode, lengths, MAXDCODES); virgin = 0; } return puff_codes(s, &lencode, &distcode); } static int puff_dynamic(struct puff_state* s) { static const short order[19] = {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15}; int nlen = puff_bits(s, 5) + 257; int ndist = puff_bits(s, 5) + 1; int ncode = puff_bits(s, 4) + 4; if (nlen > MAXLCODES || ndist > MAXDCODES) return -3; short lengths[MAXCODES]; int index; for (index = 0; index < ncode; index++) lengths[order[index]] = puff_bits(s, 3); for (; index < 19; index++) lengths[order[index]] = 0; short lencnt[MAXBITS + 1], lensym[MAXLCODES]; struct puff_huffman lencode = {lencnt, lensym}; int err = puff_construct(&lencode, lengths, 19); if (err != 0) return -4; index = 0; while (index < nlen + ndist) { int symbol; int len; symbol = puff_decode(s, &lencode); if (symbol < 0) return symbol; if (symbol < 16) lengths[index++] = symbol; else { len = 0; if (symbol == 16) { if (index == 0) return -5; len = lengths[index - 1]; symbol = 3 + puff_bits(s, 2); } else if (symbol == 17) symbol = 3 + puff_bits(s, 3); else symbol = 11 + puff_bits(s, 7); if (index + symbol > nlen + ndist) return -6; while (symbol--) lengths[index++] = len; } } if (lengths[256] == 0) return -9; err = puff_construct(&lencode, lengths, nlen); if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1])) return -7; short distcnt[MAXBITS + 1], distsym[MAXDCODES]; struct puff_huffman distcode = {distcnt, distsym}; err = puff_construct(&distcode, lengths + nlen, ndist); if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1])) return -8; return puff_codes(s, &lencode, &distcode); } static int puff(unsigned char* dest, unsigned long* destlen, const unsigned char* source, unsigned long sourcelen) { struct puff_state s = { .out = dest, .outlen = *destlen, .outcnt = 0, .in = source, .inlen = sourcelen, .incnt = 0, .bitbuf = 0, .bitcnt = 0, }; int err; if (setjmp(s.env) != 0) err = 2; else { int last; do { last = puff_bits(&s, 1); int type = puff_bits(&s, 2); err = type == 0 ? puff_stored(&s) : (type == 1 ? puff_fixed(&s) : (type == 2 ? puff_dynamic(&s) : -1)); if (err != 0) break; } while (!last); } *destlen = s.outcnt; return err; } //% END CODE DERIVED FROM puff.{c,h} #define ZLIB_HEADER_WIDTH 2 static int puff_zlib_to_file(const unsigned char* source, unsigned long sourcelen, int dest_fd) { if (sourcelen < ZLIB_HEADER_WIDTH) return 0; source += ZLIB_HEADER_WIDTH; sourcelen -= ZLIB_HEADER_WIDTH; const unsigned long max_destlen = 132 << 20; void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0); if (ret == MAP_FAILED) return -1; unsigned char* dest = (unsigned char*)ret; unsigned long destlen = max_destlen; int err = puff(dest, &destlen, source, sourcelen); if (err) { munmap(dest, max_destlen); errno = -err; return -1; } if (write(dest_fd, dest, destlen) != (ssize_t)destlen) { munmap(dest, max_destlen); return -1; } return munmap(dest, max_destlen); } static int setup_loop_device(unsigned char* data, unsigned long size, const char* loopname, int* loopfd_p) { int err = 0, loopfd = -1; int memfd = syscall(__NR_memfd_create, "syzkaller", 0); if (memfd == -1) { err = errno; goto error; } if (puff_zlib_to_file(data, size, memfd)) { err = errno; goto error_close_memfd; } loopfd = open(loopname, O_RDWR); if (loopfd == -1) { err = errno; goto error_close_memfd; } if (ioctl(loopfd, LOOP_SET_FD, memfd)) { if (errno != EBUSY) { err = errno; goto error_close_loop; } ioctl(loopfd, LOOP_CLR_FD, 0); usleep(1000); if (ioctl(loopfd, LOOP_SET_FD, memfd)) { err = errno; goto error_close_loop; } } close(memfd); *loopfd_p = loopfd; return 0; error_close_loop: close(loopfd); error_close_memfd: close(memfd); error: errno = err; return -1; } static void reset_loop_device(const char* loopname) { int loopfd = open(loopname, O_RDWR); if (loopfd == -1) { return; } if (ioctl(loopfd, LOOP_CLR_FD, 0)) { } close(loopfd); } static long syz_mount_image(volatile long fsarg, volatile long dir, volatile long flags, volatile long optsarg, volatile long change_dir, volatile unsigned long size, volatile long image) { unsigned char* data = (unsigned char*)image; int res = -1, err = 0, need_loop_device = !!size; char* mount_opts = (char*)optsarg; char* target = (char*)dir; char* fs = (char*)fsarg; char* source = NULL; char loopname[64]; if (need_loop_device) { int loopfd; memset(loopname, 0, sizeof(loopname)); snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid); if (setup_loop_device(data, size, loopname, &loopfd) == -1) return -1; close(loopfd); source = loopname; } mkdir(target, 0777); char opts[256]; memset(opts, 0, sizeof(opts)); if (strlen(mount_opts) > (sizeof(opts) - 32)) { } strncpy(opts, mount_opts, sizeof(opts) - 32); if (strcmp(fs, "iso9660") == 0) { flags |= MS_RDONLY; } else if (strncmp(fs, "ext", 3) == 0) { bool has_remount_ro = false; char* remount_ro_start = strstr(opts, "errors=remount-ro"); if (remount_ro_start != NULL) { char after = *(remount_ro_start + strlen("errors=remount-ro")); char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1); has_remount_ro = ((before == '\0' || before == ',') && (after == '\0' || after == ',')); } if (strstr(opts, "errors=panic") || !has_remount_ro) strcat(opts, ",errors=continue"); } else if (strcmp(fs, "xfs") == 0) { strcat(opts, ",nouuid"); } res = mount(source, target, fs, flags, opts); if (res == -1) { err = errno; goto error_clear_loop; } res = open(target, O_RDONLY | O_DIRECTORY); if (res == -1) { err = errno; goto error_clear_loop; } if (change_dir) { res = chdir(target); if (res == -1) { err = errno; } } error_clear_loop: if (need_loop_device) reset_loop_device(loopname); errno = err; return res; } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void reset_loop() { char buf[64]; snprintf(buf, sizeof(buf), "/dev/loop%llu", procid); int loopfd = open(buf, O_RDWR); if (loopfd != -1) { ioctl(loopfd, LOOP_CLR_FD, 0); close(loopfd); } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } int i, call, thread; for (call = 0; call < 5; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 50 + (call == 0 ? 4000 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { reset_loop(); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { sleep_ms(10); if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } } } uint64_t r[1] = {0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: memcpy((void*)0x400000000040, "exfat\000", 6); memcpy((void*)0x400000000240, "./file1\000", 8); memcpy( (void*)0x4000000017c0, "\x78\x9c\xec\xdc\x0b\xb4\x8f\xd5\xd6\x38\xfe\x39\xd7\x5a\x0f\x9b\xd0" "\x37\xc9\x7d\xcd\x35\x1f\xbe\xc9\x65\x91\x24\xb9\x24\x24\x92\x24\x49" "\x92\xdc\x12\x92\x24\x49\x42\x62\x93\x5b\x12\x92\x90\x7b\x92\x7b\x48" "\x6e\x21\xb9\xdf\x6f\xb9\x87\xe4\x48\x92\x24\x24\x24\x59\xff\xa1\xd3" "\xf9\x7b\xcf\xdb\x79\xdf\xce\xf9\x9d\x7e\xaf\xdf\x78\xf7\xfc\x8c\xb1" "\xc6\x5e\x73\x3f\xdf\x39\x9f\xb5\xf6\xdc\xe3\xfb\x7d\x9e\x67\x8c\xbd" "\xbf\xed\x30\xa8\x4a\xbd\xaa\x95\xea\x30\x33\xfc\x5b\xf0\xaf\x5f\x52" "\x01\x20\x05\x00\xfa\x02\xc0\xb5\x00\x10\x01\x40\xc9\xac\x25\xb3\x02" "\x0e\x85\x0c\x1a\x53\xff\xbd\x93\x88\x3f\xd7\xc3\x53\xaf\xf6\x0a\xc4" "\xd5\x24\xfd\x4f\xdb\xa4\xff\x69\x9b\xf4\x3f\x6d\x93\xfe\xa7\x6d\xd2" "\xff\xb4\x4d\xfa\x9f\xb6\x49\xff\xd3\x36\xe9\xbf\x10\x69\xd9\xd6\x69" "\xb9\xae\x93\x91\x76\xc7\xff\xdc\xf3\x7f\x90\xe7\xff\xff\xcf\x91\xcf" "\xff\xff\x45\x8e\x14\x1d\xfd\xe5\xfa\xa2\x37\x74\xfc\x17\x52\xa4\xff" "\x69\x9b\xf4\x3f\x6d\x93\xfe\xa7\x6d\xd2\xff\xb4\x4d\xfa\x9f\xb6\x49" "\xff\xff\x97\x8b\x00\x2a\xfe\x37\x87\xa5\xff\x69\x9b\xf4\x5f\x88\xb4" "\xec\x6a\x3f\x7f\x96\x71\x75\xc7\xd5\xfe\xfd\x13\x42\x08\x21\x84\x10" "\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08" "\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84" "\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42" "\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21" "\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10" "\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08" "\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84" "\x10\x42\x08\x91\x36\x9c\x0f\x57\x18\x00\xf8\xdb\xfc\x6a\xaf\x4b\x08" "\x21\x84\x10\x42\x08\x21\x84\x10\x7f\x9e\x90\xfe\x6a\xaf\x40\x08\x21" "\x84\x10\x42\x08\x21\x84\x10\xff\xf7\x21\x28\xd0\x60\x20\x82\x74\x90" "\x1e\x52\x20\x03\x64\x84\x6b\x20\x13\x64\x86\x2c\x70\x2d\x24\xe0\x3a" "\xc8\x0a\xd7\x43\x36\xb8\x01\xb2\x43\x0e\xc8\x09\xb9\x20\x37\xe4\x81" "\xbc\x60\x81\xc0\x01\x43\x0c\xf9\x20\x3f\x24\xe1\x46\x28\x00\x37\x41" "\x41\x28\x04\x85\xa1\x08\x78\x28\x0a\xc5\xe0\x66\x28\x0e\xb7\x40\x09" "\xb8\x15\x4a\xc2\x6d\x50\x0a\x6e\x87\xd2\x50\x06\xca\x42\x39\xb8\x03" "\xca\xc3\x9d\x50\x01\x2a\x42\x25\xb8\x0b\x2a\xc3\xdd\x50\x05\xaa\xc2" "\x3d\x50\x0d\xee\x85\xea\x70\x1f\xd4\x80\xfb\xa1\x26\x3c\x00\xb5\xe0" "\x41\xa8\x0d\x0f\x41\x1d\x78\x18\xea\xc2\x23\x50\x0f\x1e\x85\xfa\xf0" "\x18\x34\x80\x86\xd0\x08\x1a\x43\x93\xff\xa3\xfc\x97\xa0\x0b\xbc\x0c" "\x5d\xa1\x1b\xa4\x42\x77\xe8\x01\xaf\x40\x4f\xe8\x05\xbd\xa1\x0f\xf4" "\x85\x57\xa1\x1f\xbc\x06\xfd\xe1\x75\x18\x00\x03\x61\x10\xbc\x01\x83" "\xe1\x4d\x18\x02\x6f\xc1\x50\x18\x06\xc3\xe1\x6d\x18\x01\x23\x61\x14" "\x8c\x86\x31\x30\x16\xc6\xc1\x3b\x30\x1e\xde\x85\x09\xf0\x1e\x4c\x84" "\x49\x30\x19\xa6\xc0\x54\x98\x06\xd3\xe1\x7d\x98\x01\x33\x61\x16\x7c" "\x00\xb3\xe1\x43\x98\x03\x73\x61\x1e\xcc\x87\x05\xf0\x11\x2c\x84\x45" "\xb0\x18\x3e\x86\x25\xf0\x09\x2c\x85\x65\xb0\x1c\x56\xc0\x4a\x58\x05" "\xab\x61\x0d\xac\x85\x75\xb0\x1e\x36\xc0\x46\xd8\x04\x9b\x61\x0b\x6c" "\x85\x4f\x61\x1b\x6c\x87\x1d\xb0\x13\x76\xc1\x6e\xd8\x03\x9f\xc1\x5e" "\xd8\x07\xfb\xe1\x73\x38\x00\x5f\xfc\x8b\xf9\xe7\xfe\x53\x7e\x47\x04" "\x04\x54\xa8\xd0\xa0\xc1\x74\x98\x0e\x53\x30\x05\x33\x62\x46\xcc\x84" "\x99\x30\x0b\x66\xc1\x04\x26\x30\x2b\x66\xc5\x6c\x98\x0d\xb3\x63\x76" "\xcc\x89\x39\x31\x37\xe6\xc6\xbc\x98\x17\x09\x09\x19\x19\xf3\x61\x3e" "\x4c\x62\x12\x0b\x60\x01\x2c\x88\x05\xb1\x30\x16\x46\x8f\x1e\x8b\x61" "\x31\x2c\x8e\xb7\x60\x09\x2c\x81\x25\xb1\x24\x96\xc2\x52\x58\x1a\xcb" "\x60\x19\x2c\x87\xe5\xb0\x3c\x96\xc7\x0a\x58\x01\x2b\x61\x25\xac\x8c" "\x95\xb1\x0a\x56\xc1\x7b\xf0\x1e\xbc\x17\xab\x63\x75\xac\x81\x08\x00" "\x35\xb1\x16\xd6\xc2\xda\x58\x1b\xeb\x60\x1d\xac\x8b\x75\xb1\x1e\xd6" "\xc3\xfa\x58\x1f\x1b\x60\x03\x6c\x84\x8d\xb0\x09\x36\xc1\xa6\xd8\x14" "\x9b\x61\x33\x6c\x81\x2d\xb0\x25\xb6\xc4\x56\xd8\x0a\x5b\x63\x6b\x6c" "\x83\x6d\xb0\x2d\xb6\xc5\x76\xd8\x0e\xdb\x63\x7b\xec\x80\x1d\xb0\x23" "\x76\xc2\x4e\xf8\x12\xbe\x84\x2f\xe3\xcb\xd8\x0d\x2b\xab\xee\xd8\x03" "\x7b\x60\x4f\xec\x89\xbd\xb1\x0f\xf6\xc1\x57\xb1\x1f\xbe\x86\xaf\xe1" "\xeb\x38\x00\x07\xe2\x20\x7c\x03\xdf\xc0\x37\x71\x08\x9e\xc5\xa1\x38" "\x0c\x87\xe3\x70\x2c\xaf\x46\xe2\x28\x1c\x8d\xac\xc6\xe2\x38\x1c\x87" "\xe3\x71\x3c\x4e\xc0\x09\x38\x11\x27\xe1\x24\x9c\x82\x53\x71\x1a\x4e" "\xc7\xe9\x38\x03\x67\xe2\x4c\xfc\x00\x67\xe3\x87\xf8\x21\xce\xc5\xb9" "\x38\x1f\x17\xe0\x02\x5c\x88\x8b\x70\x31\x2e\xc6\x25\x78\x0e\x97\xe2" "\x32\x5c\x8e\x2b\x70\x25\xae\xc2\x95\xb8\x06\xd7\xe2\x1a\x5c\x8f\x1b" "\x70\x3d\x6e\xc2\x4d\xb8\x05\xb7\xe0\xa7\xf8\x29\x6e\xc7\xed\xb8\x13" "\x77\xe2\x6e\xdc\x8d\x9f\xe1\x67\xb8\x0f\xf7\xe1\x00\x3c\x80\x07\xf0" "\x20\x1e\xc4\x43\x78\x08\x0f\xe3\x61\x3c\x82\x47\xf0\x28\x1e\xc5\x63" "\x78\x0c\x8f\xe3\x71\x3c\x81\x27\xf0\x24\x9e\xc2\xd3\x78\x0a\xcf\xe0" "\x19\x3c\x8b\xe7\xf0\x3c\x9e\xc7\x0b\x78\x01\x2f\xe2\x0b\xb9\xbf\xae" "\xbb\xbb\xd0\xba\x01\xa0\x2e\x33\xca\xa8\x74\x2a\x9d\x4a\x51\x29\x2a" "\xa3\xca\xa8\x32\xa9\x4c\x2a\x8b\xca\xa2\x12\x2a\xa1\xb2\xaa\xac\x2a" "\x9b\xca\xa6\xb2\xab\xec\x2a\xa7\xca\xa9\x72\xab\xdc\x2a\xaf\xca\xab" "\x48\x91\x62\x15\xab\x7c\x2a\x9f\x4a\xaa\xa4\x2a\xa0\x0a\xa8\x82\xaa" "\xa0\x2a\xac\x0a\x2b\xaf\xbc\x2a\xa6\x8a\xa9\xe2\xaa\xb8\x2a\xa1\x4a" "\xa8\x92\xea\x36\x55\x4a\xdd\xae\x4a\xab\x32\xaa\xb9\x2f\xa7\xca\xa9" "\xf2\xaa\x85\xaf\xa0\x2a\xaa\x4a\xaa\x92\xaa\xac\xee\x56\x55\x54\x55" "\x55\x55\x55\x53\xd5\x54\x75\x55\x5d\xd5\x50\x35\x54\x4d\x55\x53\xd5" "\x52\x0f\xaa\xda\xaa\x3b\xf6\xc6\x87\xd5\xe5\xce\xd4\x53\x03\xb1\xbe" "\x1a\x84\x0d\x54\x43\xd5\x48\x35\x56\x6f\xe2\xe3\xaa\xa9\x1a\x82\xcd" "\x54\x73\xd5\x42\x3d\xa9\x86\xe1\x50\x6c\xa5\x9a\xfa\xd6\xea\x19\xd5" "\x46\x8d\xc2\xb6\xea\x39\x35\x1a\x9f\x57\xed\xd5\x58\xec\xa0\x5e\x54" "\x1d\x55\x27\xd5\x59\xbd\xa4\xba\xa8\x66\xbe\x6b\xba\xdf\xde\x02\xd5" "\x14\xec\xa9\x7a\xa9\xde\xaa\x8f\xca\x0c\x77\xab\xcb\x1d\xab\xa2\x5e" "\x57\x03\xd4\x40\x35\x48\xbd\xa1\xe6\xe3\x9b\x6a\x88\x7a\x4b\x0d\x55" "\xc3\xd4\x70\xf5\xb6\x1a\xa1\x46\xaa\x51\x6a\xb4\x1a\xa3\xc6\xaa\x71" "\xea\x1d\x35\x5e\xbd\xab\x26\xa8\xf7\xd4\x44\x35\x49\x4d\x56\x53\xd4" "\x54\x35\x4d\x4d\x57\xef\xab\x19\x6a\xa6\x9a\xa5\x3e\x50\xb3\xd5\x87" "\x6a\x8e\x9a\xab\xe6\xa9\xf9\x6a\x81\xfa\x48\x2d\x54\x8b\xd4\x62\xf5" "\xb1\x5a\xa2\x3e\x51\x4b\xd5\x32\xb5\x5c\xad\x50\x2b\xd5\x2a\xb5\x5a" "\xad\x51\x6b\xd5\x3a\xb5\x5e\x6d\x50\x1b\xd5\x26\xb5\x59\x6d\x51\x5b" "\xd5\xa7\x6a\x9b\xda\xae\x76\xa8\x9d\x6a\x97\xda\xad\xf6\xa8\xcf\xd4" "\x5e\xb5\x4f\xed\x57\x9f\xab\x03\xea\x0b\x75\x50\xfd\x45\x1d\x52\x5f" "\xaa\xc3\xea\x2b\x75\x44\x7d\xad\x8e\xaa\x6f\xd4\x31\xf5\xad\x3a\xae" "\xbe\x53\x27\xd4\xf7\xea\xa4\x3a\xa5\x4e\xab\x1f\xd4\x19\xf5\xa3\x3a" "\xab\xce\xa9\xf3\xea\x27\x75\x41\xfd\xac\x2e\xaa\x5f\xd4\x25\x15\x14" "\x68\xd4\x4a\x6b\x6d\x74\xa4\xd3\xe9\xf4\x3a\x45\x67\xd0\x19\xf5\x35" "\x3a\x93\xce\xac\xb3\xe8\x6b\x75\x42\x5f\xa7\xb3\xea\xeb\x75\x36\x7d" "\x83\xce\xae\x73\xe8\x9c\x3a\x97\xce\xad\xf3\xe8\xbc\xda\x6a\xd2\x4e" "\xb3\x8e\x75\x3e\x9d\x5f\x27\xf5\x8d\xba\x80\xbe\x49\x17\xd4\x85\x74" "\x61\x5d\x44\x7b\x5d\x54\x17\xd3\x37\xeb\xe2\xfa\x16\x5d\x42\xdf\xaa" "\x4b\xea\xdb\x74\x29\x7d\xbb\x2e\xad\xcb\xe8\xb2\xba\x9c\xbe\x43\x97" "\xd7\x77\xea\x0a\xba\xa2\xae\xa4\xef\xd2\x95\xf5\xdd\xba\x8a\xae\xaa" "\xef\xd1\xd5\xf4\xbd\xba\xba\xbe\x4f\xd7\xd0\xf7\xeb\x9a\xfa\x01\x5d" "\x4b\x3f\xa8\x6b\xeb\x87\x74\x1d\xfd\xb0\xae\xab\x1f\xd1\xf5\xf4\xa3" "\xba\xbe\x7e\x4c\x37\xd0\x0d\x75\x23\xdd\x58\x37\xd1\x8f\xeb\xa6\xfa" "\x09\xdd\x4c\x37\xd7\x2d\xf4\x93\xba\xa5\x7e\x4a\xb7\xd2\x4f\xeb\xd6" "\xfa\x19\xdd\x46\x3f\xab\xdb\xea\xe7\x74\x3b\xfd\xbc\x6e\xaf\x5f\xd0" "\x1d\xf4\x8b\xba\xa3\xee\xa4\x3b\xeb\x5f\xf4\x25\x1d\x74\x57\xdd\x4d" "\xa7\xea\xee\xba\x87\x7e\x45\xf7\xd4\xbd\x74\x6f\xdd\x47\xf7\xd5\xaf" "\xea\x7e\xfa\x35\xdd\x5f\xbf\xae\x07\xe8\x81\x7a\x90\x7e\x43\x0f\xd6" "\x6f\xea\x21\xfa\x2d\x3d\x54\x0f\xd3\xc3\xf5\xdb\x7a\x84\x1e\xa9\x47" "\xe9\xd1\x7a\x8c\x1e\xab\xc7\xe9\x77\xf4\x78\xfd\xae\x9e\xa0\xdf\xd3" "\x13\xf5\x24\x3d\x59\x4f\xd1\x53\xf5\x34\xdd\xfb\xb7\x4a\xb3\xfe\x89" "\xfc\x77\xff\x41\x7e\xff\x5f\xcf\xbe\x45\x6f\xd5\x9f\xea\x6d\x7a\xbb" "\xde\xa1\x77\xea\x5d\x7a\xb7\xde\xa3\xf7\xe8\xbd\x7a\xaf\xde\xaf\xf7" "\xeb\x03\xfa\x80\x3e\xa8\x0f\xea\x43\xfa\x90\x3e\xac\x0f\xeb\x23\xfa" "\x88\x3e\xaa\x8f\xea\x63\xfa\x98\x3e\xae\x8f\xeb\x13\xfa\x84\x3e\xa9" "\x4f\xe9\x9f\xf4\x0f\xfa\x8c\xfe\x51\x9f\xd5\xe7\xf4\x39\xfd\x93\xbe" "\xa0\x2f\xe8\x8b\xbf\xfd\x0c\xc0\xa0\x51\x46\x1b\x63\x22\x93\xce\xa4" "\x37\x29\x26\x83\xc9\x68\xae\x31\x99\x4c\x66\x93\xc5\x5c\x6b\x12\xe6" "\x3a\x93\xd5\x5c\x6f\xb2\x99\x1b\x4c\x76\x93\xc3\xe4\x34\xb9\x4c\x6e" "\x93\xc7\xe4\x35\xd6\x90\x71\x86\x4d\x6c\xf2\x99\xfc\x26\x69\x6e\x34" "\x05\xcc\x4d\xa6\xa0\x29\x64\x0a\x9b\x22\xc6\x9b\xa2\xa6\x98\xb9\xf9" "\xdf\xce\xff\xa3\xf5\x35\x31\x4d\x4c\x53\xd3\xd4\x34\x33\xcd\x4c\x0b" "\xd3\xc2\xb4\x34\x2d\x4d\x2b\xd3\xca\xb4\x36\xad\x4d\x1b\xd3\xc6\xb4" "\x35\x6d\x4d\x3b\xd3\xce\xb4\x37\xed\x4d\x07\xd3\xc1\x74\x34\x1d\x4d" "\x67\xd3\xd9\x74\x31\x5d\x4c\x57\xd3\xd5\xa4\x9a\x54\xd3\xc3\xbc\x62" "\x7a\x9a\x5e\xa6\xb7\xe9\x63\xfa\x9a\x57\x4d\x3f\xd3\xcf\xf4\x37\xfd" "\xcd\x00\x33\xc0\x0c\x32\x83\xcc\x60\x33\xd8\x0c\x31\x43\xcc\x50\x33" "\xd4\x0c\x37\xc3\xcd\x08\x33\xc2\x8c\x32\xa3\xcc\x18\x33\xc6\x8c\x33" "\xe3\xcc\x78\x33\xde\x4c\x30\x13\xcc\x44\x33\xd1\x4c\x36\x93\xcd\x54" "\x33\xd5\x4c\x37\xd3\xcd\x0c\x33\xc3\xcc\x32\xb3\xcc\x6c\x33\xdb\xcc" "\x31\x73\xcc\x3c\x33\xcf\x2c\x30\x0b\xcc\x42\xb3\xd0\x2c\x36\x8b\xcd" "\x12\xb3\xc4\x2c\x35\xcb\xcc\x32\xb3\xc2\xac\x30\xab\xcc\x2a\xb3\xc6" "\xac\x31\xeb\xcc\x3a\xb3\xc1\x6c\x30\x9b\xcc\x26\xb3\xd4\x6c\x35\x5b" "\xcd\x36\xb3\xcd\xec\x30\x3b\xcc\x2e\xb3\xcb\xec\x31\x7b\xcc\x5e\xb3" "\xd7\xec\x37\xfb\xcd\x01\x73\xc0\x1c\x34\x07\xcd\x21\x73\xc8\x1c\x36" "\x87\xcd\x11\x73\xc4\x1c\x35\x47\xcd\x31\x73\xcc\x1c\x37\xc7\xcd\x09" "\x73\xc2\x9c\x34\x27\xcd\x69\x73\xda\x9c\x31\x67\xcc\x59\x73\xd6\x9c" "\x37\xe7\xcd\x05\x73\xc1\x5c\x34\x17\xcd\x25\x73\xe9\xf2\x65\x5f\xa4" "\x22\x15\x99\xc8\x44\xe9\xa2\x74\x51\x4a\x94\x12\x65\x8c\x32\x46\x99" "\xa2\x4c\x51\x96\x28\x4b\x94\x88\x12\x51\xd6\x28\x6b\x94\x2d\xba\x21" "\xca\x1e\xe5\x88\x72\x46\xb9\xa2\xdc\x51\x9e\x28\x15\x6c\x44\x91\x8b" "\x38\x8a\xa3\x7c\x51\xfe\x28\x19\xdd\x18\x15\x88\x6e\x8a\x0a\x46\x85" "\xa2\xc2\x51\x91\xc8\x47\x45\xa3\x62\xd1\xcd\x51\xf1\xe8\x96\xa8\x44" "\x74\x6b\x54\x32\xba\x2d\x2a\x15\xdd\x1e\x95\x8e\xca\x44\x65\xa3\x72" "\xd1\x1d\x51\xf9\xe8\xce\xa8\x42\x54\x31\xaa\x14\xdd\x15\x55\x8e\xee" "\x8e\xaa\x44\x55\xa3\x7b\xa2\x6a\xd1\xbd\x51\xf5\xe8\xbe\xa8\x46\x74" "\x7f\x54\x33\x7a\x20\xaa\x15\x3d\x18\xd5\x8e\x1e\x8a\xea\x44\x0f\x47" "\x75\xa3\x47\xa2\x7a\xd1\xa3\x51\xfd\xe8\xb1\xa8\x41\xd4\x30\x6a\x14" "\x35\x8e\x9a\xfc\xa9\xf5\x43\x38\x9b\xe3\x09\xdf\xd5\x76\xb3\xa9\xb6" "\xbb\xed\x61\x5f\xb1\x3d\x6d\x2f\xdb\xdb\xf6\xb1\x7d\xed\xab\xb6\x9f" "\x7d\xcd\xf6\xb7\xaf\xdb\x01\x76\xa0\x1d\x64\xdf\xb0\x83\xed\x9b\x76" "\x88\x7d\xcb\x0e\xb5\xc3\xec\x70\xfb\xb6\x1d\x61\x47\xda\x51\x76\xb4" "\x1d\x63\xc7\xda\x71\xf6\x1d\x3b\xde\xbe\x6b\x27\xd8\xf7\xec\x44\x3b" "\xc9\x4e\xb6\x53\xec\x54\x3b\xcd\x4e\xb7\xef\xdb\x19\x76\xa6\x9d\x65" "\x3f\xb0\xb3\xed\x87\x76\x8e\x9d\x6b\xe7\xd9\xf9\x76\x81\xfd\xc8\x2e" "\xb4\x8b\xec\x62\xfb\xb1\x5d\x62\x3f\xb1\x4b\xed\x32\xbb\xdc\xae\xb0" "\x2b\xed\x2a\xbb\xda\xae\xb1\x6b\xed\x3a\xbb\xde\x6e\xb0\x1b\xed\x26" "\xbb\xd9\x6e\xb1\x5b\xed\xa7\x76\x9b\xdd\x6e\x77\xd8\x9d\x76\x97\xdd" "\x6d\xf7\xd8\xcf\xec\x5e\xbb\xcf\xee\xb7\x9f\xdb\x03\xf6\x0b\x7b\xd0" "\xfe\xc5\x1e\xb2\x5f\xda\xc3\xf6\x2b\x7b\xc4\x7e\x6d\x8f\xda\x6f\xec" "\x31\xfb\xad\x3d\x6e\xbf\xb3\x27\xec\xf7\xf6\xa4\x3d\x65\x4f\xdb\x1f" "\xec\x19\xfb\xa3\x3d\x6b\xcf\xd9\xf3\xf6\x27\x7b\xc1\xfe\x6c\x2f\xda" "\x5f\xec\x25\x1b\x2e\x5f\xdc\x5f\xfe\x78\x27\x43\x86\xd2\x51\x3a\x4a" "\xa1\x14\xca\x48\x19\x29\x13\x65\xa2\x2c\x94\x85\x12\x94\xa0\xac\x94" "\x95\xb2\x51\x36\xca\x4e\xd9\x29\x27\xe5\xa4\xdc\x94\x9b\xf2\x52\x5e" "\xba\x8c\x89\x29\x1f\xe5\xa3\x24\x25\xa9\x00\x15\xa0\x82\x54\x90\x0a" "\x53\x61\xf2\xe4\xa9\x18\x15\xa3\xe2\x54\x9c\x4a\x50\x09\x2a\x49\x25" "\xa9\x14\x95\xa2\xd2\x54\x9a\xca\x52\x59\xba\x83\xee\xa0\x3b\xe9\x4e" "\xaa\x48\x15\xe9\x2e\xba\x8b\xee\xa6\xbb\xa9\x2a\x55\xa5\x6a\x54\x8d" "\xaa\x53\x75\xaa\x41\x35\xa8\x26\xd5\xa4\x5a\x54\x8b\x6a\x53\x6d\xaa" "\x43\x75\xa8\x2e\xd5\xa5\x7a\x54\x8f\xea\x53\x7d\x6a\x40\x0d\xa8\x11" "\x35\xa2\x26\xd4\x84\x9a\x52\x53\x6a\x46\xcd\xa8\x05\xb5\xa0\x96\xd4" "\x92\x5a\x51\x2b\x6a\x4d\xad\xa9\x0d\xb5\xa1\xb6\xd4\x96\xda\x51\x3b" "\x6a\x4f\xed\xa9\x03\x75\xa0\x8e\xd4\x91\x3a\x53\x67\xea\x42\x5d\xa8" "\x2b\x75\xa5\x54\x4a\xa5\x1e\xd4\x83\x7a\x52\x4f\xea\x4d\xbd\xa9\x2f" "\xf5\xa5\x7e\xd4\x8f\xfa\x53\x7f\x1a\x40\x03\x68\x10\x0d\xa2\xc1\x34" "\x98\x86\xd0\x10\x1a\x4a\xc3\x68\x38\xbd\x4d\x23\x68\x24\x8d\xa2\xd1" "\x34\x86\xc6\xd2\x38\x1a\x47\xe3\x69\x3c\x4d\xa0\x09\x34\x91\x26\xd2" "\x64\x9a\x4c\x53\x69\x2a\x4d\xa7\xe9\x34\x83\x66\xd0\x2c\x9a\x45\xb3" "\x69\x36\xcd\xa1\x39\x34\x8f\xe6\xd1\x02\x5a\x40\x0b\x69\x21\x2d\xa6" "\xc5\xb4\x84\x96\xd0\x52\x5a\x4a\xcb\x69\x39\xad\xa4\x95\xb4\x9a\x56" "\xd3\x5a\x5a\x4b\xeb\x69\x3d\x6d\xa4\x8d\xb4\x99\x36\xd3\x56\xda\x4a" "\xdb\x68\x1b\xed\xa0\x1d\xb4\x8b\x76\xd1\x1e\xda\x43\x7b\x69\x2f\xed" "\xa7\xfd\x74\x80\x0e\xd0\x41\x3a\x48\x87\xe8\x10\x1d\xa6\xc3\x74\x84" "\x8e\xd0\x51\x3a\x4a\xc7\xe8\x18\x1d\xa7\xe3\x74\x82\x4e\xd0\x49\x3a" "\x49\xa7\xe9\x34\x9d\xa1\x33\x74\x96\xce\xd2\x79\x3a\x4f\x17\xe8\x67" "\xba\x48\xbf\xd0\x25\x0a\x94\xe2\x14\x64\x74\xd7\xb8\x4c\x2e\xb3\xcb" "\xe2\xae\x75\x29\x2e\x83\xcb\xe8\xfe\x7a\xc1\x74\x39\xce\xe9\x72\xb9" "\xdc\x2e\x8f\xcb\xeb\xac\xcb\xee\x72\xfc\x5d\x4c\xce\xb9\x82\xae\x90" "\x2b\xec\x8a\x38\xef\x8a\xba\x62\xee\xe6\xdf\xc5\xa5\x5d\x19\x57\xd6" "\x95\x73\x77\xb8\xf2\xee\x4e\x57\xe1\x77\x71\x35\x77\xaf\xab\xee\xee" "\x73\x35\xdc\xfd\xae\xaa\xbb\xe7\xef\xe2\x9a\xee\x01\x57\xcb\x3d\xea" "\x6a\xbb\xc7\x5c\x1d\xd7\xd0\xd5\x75\x8d\x5d\x3d\xf7\xa8\xab\xef\x1e" "\x73\x0d\x5c\x43\xd7\xc8\x35\x76\x2d\xdd\x53\xae\x95\x7b\xda\xb5\x76" "\xcf\xb8\x36\xee\xd9\xdf\xc5\x0b\xdd\x22\xb7\xd6\xad\x73\xeb\xdd\x06" "\xb7\xd7\xed\x73\xe7\xdd\x4f\xee\x98\xfb\xd6\x5d\x70\x3f\xbb\xae\xae" "\x9b\xeb\xeb\x5e\x75\xfd\xdc\x6b\xae\xbf\x7b\xdd\x0d\x70\x03\x7f\x17" "\x0f\x77\x6f\xbb\x11\x6e\xa4\x1b\xe5\x46\xbb\x31\x6e\xec\xef\xe2\xc9" "\x6e\x8a\x9b\xea\xa6\xb9\xe9\xee\x7d\x37\xc3\xcd\xfc\x5d\xbc\xc0\x7d" "\xe4\x66\xbb\xc5\x6e\x8e\x9b\xeb\xe6\xb9\xf9\xbf\xc6\x97\xd7\xb4\xd8" "\x7d\xec\x96\xb8\x4f\xdc\x52\xb7\xcc\x2d\x77\x2b\xdc\x4a\xb7\xca\xad" "\x76\x6b\xfe\xff\xb5\xae\x70\x9b\xdc\x66\xb7\xc5\xed\x71\x9f\xb9\x6d" "\x6e\xbb\xdb\xe1\x76\xba\x5d\x6e\xf7\xaf\xf1\xe5\x7d\xec\x77\x9f\xbb" "\x03\xee\x0b\x77\xd4\x7d\xe3\x0e\xb9\x2f\xdd\x61\x77\xdc\x1d\x71\x5f" "\xff\x1a\x5f\xde\xdf\x71\xf7\x9d\x3b\xe1\xbe\x77\x27\xdd\x29\x77\xda" "\xfd\xe0\xce\xb8\x1f\xdd\x59\x77\xee\xd7\xfd\x5f\xde\xfb\x0f\xee\x17" "\x77\xc9\x05\x07\x8c\xac\x58\xb3\xe1\x88\xd3\x71\x7a\x4e\xe1\x0c\x9c" "\x91\xaf\xe1\x4c\x9c\x99\xb3\xf0\xb5\x9c\xe0\xeb\x38\x2b\x5f\xcf\xd9" "\xf8\x06\xce\xce\x39\x38\x27\xe7\xe2\xdc\x9c\x87\xf3\xb2\x65\x62\xc7" "\xcc\x31\xe7\xe3\xfc\x9c\xe4\x1b\xb9\x00\xdf\xc4\x05\xb9\x10\x17\xe6" "\x22\xec\xb9\x28\x17\xe3\x9b\xb9\x38\xdf\xc2\x25\xf8\x56\x2e\xc9\xb7" "\x71\x29\xbe\x9d\x4b\x73\x19\x2e\xcb\xe5\xf8\x0e\x2e\xcf\x77\x72\x05" "\xae\xc8\x95\xf8\x2e\xae\x1c\x02\x57\xe1\xaa\x7c\x0f\x57\xe3\x7b\xb9" "\x3a\xdf\xc7\x35\xf8\x7e\xae\xc9\x0f\x70\x2d\x7e\x90\x6b\xf3\x43\x5c" "\x87\x1f\xe6\xba\xfc\x08\xd7\xe3\x47\xb9\x3e\x3f\xc6\x0d\xb8\x21\x37" "\xe2\xc6\xdc\x84\x1f\xe7\xa6\xfc\x04\x37\xe3\xe6\xdc\x82\x9f\xe4\x96" "\xfc\x14\xb7\xe2\xa7\xb9\x35\x3f\xc3\x6d\xf8\x59\x6e\xcb\xcf\x71\x3b" "\x7e\x9e\xdb\xf3\x0b\xdc\x81\x5f\xe4\x8e\xdc\x89\x3b\xf3\x4b\xdc\x85" "\x5f\xe6\xae\xdc\x8d\x53\xb9\x3b\xf7\xe0\x57\xb8\x27\xf7\xe2\xde\xdc" "\x87\xfb\xf2\xab\xdc\x8f\x5f\xe3\xfe\xfc\x3a\x0f\xe0\x81\x3c\x88\xdf" "\xe0\xc1\xfc\x26\x0f\xe1\xb7\x78\x28\x0f\xe3\xe1\xfc\x36\x8f\xe0\x91" "\x3c\x8a\x47\xf3\x18\x1e\xcb\xe3\xf8\x1d\x1e\xcf\xef\xf2\x04\x7e\x8f" "\x27\xf2\x24\x9e\xcc\x53\x78\x2a\x4f\xe3\xe9\xfc\x3e\xcf\xe0\x99\x3c" "\x8b\x3f\xe0\xd9\xfc\x21\xcf\xe1\xb9\x3c\x8f\xe7\xf3\x02\xfe\x88\x17" "\xf2\x22\x5e\xcc\x1f\xf3\x12\xfe\x84\x97\xf2\x32\x5e\xce\x2b\x78\x25" "\xaf\xe2\xd5\xbc\x86\xd7\xf2\x3a\x5e\xcf\x1b\x78\x23\x6f\xe2\xcd\xbc" "\x85\xb7\xf2\xa7\xbc\x8d\xb7\xf3\x0e\xde\xc9\xbb\x78\x37\xef\xe1\xcf" "\x78\x2f\xef\xe3\xfd\xfc\x39\x1f\xe0\x2f\xf8\x20\xff\x85\x0f\xf1\x97" "\x7c\x98\xbf\xe2\x23\xfc\x35\x1f\xe5\x6f\xf8\x18\x7f\xcb\xc7\xf9\x3b" "\x3e\xc1\xdf\xf3\x49\x3e\xc5\xa7\xf9\x07\x3e\xc3\x3f\xf2\x59\x3e\xc7" "\xe7\xf9\x27\xbe\xc0\x3f\xf3\x45\xfe\x85\x2f\x71\x60\x88\x31\x56\xb1" "\x8e\x4d\x1c\xc5\xe9\xe2\xf4\x71\x4a\x9c\x21\xce\x18\x5f\x13\x67\x8a" "\x33\xc7\x59\xe2\x6b\xe3\x44\x7c\x5d\x9c\x35\xbe\x3e\xce\x16\xdf\x10" "\x67\x8f\x73\xc4\x39\xe3\x5c\x71\xee\x38\x4f\x9c\x37\xb6\x31\xc5\x2e" "\xe6\x38\x8e\xf3\xc5\xf9\xe3\x64\x7c\x63\x5c\x20\xbe\x29\x2e\x18\x17" "\x8a\x0b\xc7\x45\x62\x1f\x17\x8d\x8b\xc5\x37\xc7\xc5\xe3\x5b\xe2\x12" "\xf1\xad\x71\xc9\xf8\xb6\xb8\x54\x7c\x7b\x5c\x3a\x2e\x13\x3f\x7a\x7f" "\xb9\xf8\x8e\xb8\x7c\x7c\x67\x5c\x21\xae\x18\x57\x8a\xef\x8a\x2b\xc7" "\x77\xc7\x55\xe2\xaa\xf1\x3d\x71\xb5\xf8\xde\xb8\x7a\x7c\x5f\x5c\x23" "\xbe\x3f\x2e\x11\x3f\x10\xd7\x8a\x1f\x8c\x6b\xc7\x0f\xc5\x75\xe2\x87" "\xe3\xba\xf1\x23\x71\xbd\xf8\xd1\xb8\x7e\xfc\x58\xdc\x20\x6e\x18\x37" "\x8a\x1b\xc7\x4d\xe2\xc7\xe3\xa6\xf1\x13\x71\xb3\xb8\x79\xdc\x22\x7e" "\x32\x6e\x19\x3f\x15\xb7\x8a\x9f\x8e\x5b\xc7\xcf\xc4\x6d\xe2\x67\xff" "\xf0\x78\x6a\xdc\x3d\xee\x11\xbf\x12\xbf\x12\x87\x70\x9f\x9e\x97\x9c" "\x9f\x5c\x90\xfc\x28\xb9\x30\xb9\x28\xb9\x38\xf9\x71\x72\x49\xf2\x93" "\xe4\xd2\xe4\xb2\xe4\xf2\xe4\x8a\xe4\xca\xe4\xaa\xe4\xea\xe4\x9a\xe4" "\xda\xe4\xba\xe4\xfa\xe4\x86\xe4\xc6\xe4\xa6\xe4\xe6\xe4\x96\x64\x08" "\x55\xd3\x83\x47\xaf\xbc\xf6\xc6\x47\x3e\x9d\x4f\xef\x53\x7c\x06\x9f" "\xd1\x5f\xe3\x33\xf9\xcc\x3e\x8b\xbf\xd6\x27\xfc\x75\x3e\xab\xbf\xde" "\x67\xf3\x37\xf8\xec\x3e\x87\xcf\xe9\x73\xf9\xdc\x3e\x8f\xcf\xeb\xad" "\x27\xef\x3c\xfb\xd8\xe7\xf3\xf9\x7d\xd2\xdf\xe8\x0b\xf8\x9b\x7c\x41" "\x5f\xc8\x17\xf6\x45\xbc\xf7\x45\x7d\x31\xdf\xd8\x37\xf1\x4d\x7c\x53" "\xff\x84\x6f\xe6\x9b\xfb\x16\xfe\x49\xff\xa4\x7f\xca\x3f\xe5\x9f\xf6" "\x4f\xfb\x67\x7c\x1b\xff\xac\x6f\xeb\x9f\xf3\xed\xfc\xf3\xbe\xbd\x7f" "\xc1\xbf\xe0\x5f\xf4\x1d\x7d\x27\xdf\xd9\xbf\xe4\xbb\xf8\x97\x7d\x57" "\xdf\xcd\xa7\xfa\x54\xdf\xc3\xf7\xf0\x3d\x7d\x4f\xdf\xdb\xf7\xf6\x7d" "\x7d\x5f\xdf\xcf\xf7\xf3\xfd\x7d\x7f\x3f\xc0\x0f\xf0\x83\xfc\x20\x3f" "\xd8\x0f\xf6\x43\xfc\x10\x3f\xd4\x0f\xf5\xc3\xfd\x70\x3f\xc2\x8f\xf0" "\xa3\xfc\x28\x3f\xc6\x8f\xf1\xe3\xfc\x38\x3f\xde\x8f\xf7\x13\xfc\x04" "\x3f\xd1\x4f\xf4\x93\xfd\x64\x3f\xd5\x4f\xf5\xd3\xfd\x74\x3f\xc3\xcf" "\xf0\xb3\xfc\x2c\x3f\xbb\xe0\x6c\x3f\xc7\xcf\xf1\xf3\xfc\x3c\xbf\xc0" "\x2f\xf0\x0b\xfd\x42\xbf\xd8\x2f\xf6\x4b\xfc\x12\xbf\xd4\x2f\xf5\xcb" "\xfd\x72\xbf\xd2\xaf\xf4\xab\xfd\x6a\xbf\xd6\xaf\xf5\xeb\xfd\x7a\xbf" "\xd1\x6f\xf4\x9b\xfd\x66\xbf\xd5\x6f\xf5\xdb\xfc\x36\xbf\xc3\xef\xf0" "\xbb\xfc\x2e\xbf\xc7\xef\xf1\x7b\xfd\x5e\xbf\xdf\xef\xf7\x07\xfc\x01" "\x7f\xd0\x1f\xf4\x87\xfc\x21\x7f\xd8\x7f\xe5\x8f\xf8\xaf\xfd\x51\xff" "\x8d\x3f\xe6\xbf\xf5\xc7\xfd\x77\xfe\x84\xff\xde\x9f\xf4\xa7\xfc\x69" "\xff\x83\x3f\xe3\x7f\xf4\x67\xfd\x39\x7f\xde\xff\xe4\x2f\xf8\x9f\xfd" "\x45\xff\x8b\xbf\xe4\x83\x1f\x97\x78\x27\x31\x3e\xf1\x6e\x62\x42\xe2" "\xbd\xc4\xc4\xc4\xa4\xc4\xe4\xc4\x94\xc4\xd4\xc4\xb4\xc4\xf4\xc4\xfb" "\x89\x19\x89\x99\x89\x59\x89\x0f\x12\xb3\x13\x1f\x26\xe6\x24\xe6\x26" "\xe6\x25\xe6\x27\x16\x24\x3e\x4a\x2c\x4c\x2c\x4a\x2c\x4e\x7c\x9c\x58" "\x92\xf8\x24\xb1\x34\xb1\x2c\xb1\x3c\xb1\x22\xb1\x32\xb1\x2a\x11\x42" "\x9e\x6d\x71\xc8\x17\xf2\x87\x64\xb8\x31\x14\x08\x37\x85\x82\xa1\x50" "\x28\x1c\x8a\x04\x1f\x8a\x86\x62\xe1\xe6\x50\x3c\xdc\x12\x4a\x84\x5b" "\x43\xc9\x70\x5b\x28\x15\x6e\x0f\xa5\x43\x99\x50\x36\x3c\x16\x1a\x84" "\x86\xa1\x51\x68\x1c\x9a\x84\xc7\x43\xd3\xf0\x44\x68\x16\x9a\x87\x16" "\xe1\xc9\xd0\x32\x3c\x15\x5a\x85\xa7\x43\xeb\xf0\x4c\x68\x13\x9e\x0d" "\x6d\xc3\x73\xa1\x5d\x78\x3e\xb4\x0f\x2f\x84\x0e\xe1\xc5\xd0\x31\x74" "\x0a\x9d\xc3\x4b\xa1\x4b\x78\x39\x74\x0d\xdd\x42\x6a\xe8\x1e\x7a\x84" "\x57\x42\xcf\xd0\x2b\xf4\x0e\x7d\x42\xdf\xf0\x6a\xe8\x17\x5e\x0b\xfd" "\xc3\xeb\x61\x40\x18\x18\x06\x85\x37\xc2\xe0\xf0\x66\x18\x12\xde\x0a" "\x43\xc3\xb0\x30\x3c\xbc\x1d\x46\x84\x91\x61\x54\x18\x1d\xc6\x84\xb1" "\x61\x5c\x78\x27\x8c\x0f\xef\x86\x09\xe1\xbd\x30\x31\x4c\x0a\x93\xc3" "\x94\x30\x35\x4c\x0b\xd3\xc3\xfb\x61\x46\x98\x19\x66\x85\x0f\xc2\xec" "\xf0\x61\x98\x13\xe6\x86\x79\x61\x7e\x58\x10\x3e\x0a\x0b\xc3\xa2\xb0" "\x38\x7c\x1c\x96\x84\x4f\xc2\xd2\xb0\x2c\x2c\x0f\x2b\xc2\xca\xb0\x2a" "\xac\x0e\x6b\xc2\xda\xb0\x2e\xac\x0f\x1b\xc2\xc6\xb0\x29\x6c\x0e\x5b" "\xc2\xd6\xf0\x69\xd8\x16\xb6\x87\x1d\x61\x67\xd8\x15\x76\x87\x3d\xe1" "\xb3\xb0\x37\xec\x0b\xfb\xc3\xe7\xe1\x40\xf8\x22\x1c\x0c\x7f\x09\x87" "\xc2\x97\xe1\x70\xf8\x2a\x1c\x09\x5f\x87\xa3\xe1\x9b\x70\x2c\x7c\x1b" "\x8e\x87\xef\xc2\x89\xf0\x7d\x38\x19\x4e\x85\xd3\xe1\x87\x70\x26\xfc" "\x18\xce\x86\x73\xe1\x7c\xf8\x29\x5c\x08\x3f\x87\x8b\xe1\x97\x70\x49" "\xfe\x66\x4d\x08\x21\x84\x10\xe2\x9f\xa2\xff\xe0\x78\xf7\x7f\xf0\xbd" "\x74\x00\xa0\x7e\x9b\xf7\x00\x80\xcc\xdb\x73\x1d\xf9\xcf\x35\x37\x66" "\xff\xeb\xbc\x97\xca\xdd\x32\x01\x00\xcf\x74\xeb\xf0\xf0\xdf\x46\xe5" "\xca\xa9\xa9\xa9\xbf\xbd\x76\xa9\x86\x28\xff\x5c\x00\x48\xfc\x7d\xfd" "\xbf\xc5\xcb\xa0\x05\x3c\x05\xad\xa1\x39\x14\xff\x87\xeb\xeb\xa5\x3a" "\x5d\xe0\x3f\xa8\x9f\xbc\x0d\x20\xe3\x7f\xc8\x49\x81\x2b\xf1\x95\xfa" "\xb7\xfc\x17\xf5\x1f\x7f\x72\xf8\xc2\x52\xf1\xf9\xac\xff\x4d\xfd\xb9" "\x00\x05\xf3\x5f\xc9\xc9\x00\x57\xe2\x2b\xf5\x4b\xfc\x17\xf5\x73\x34" "\xfd\x83\xf5\x67\xf8\x72\x1c\x40\xb3\xff\x90\x93\x09\xae\xc4\x57\xea" "\x17\x83\x27\xe0\x59\x68\xfd\x77\xaf\x14\x42\x08\x21\x84\x10\x42\x08" "\x21\xfe\xaa\x97\x2a\xdb\xee\x8f\xee\x9f\x2f\xdf\x9f\xe7\x36\x57\x72" "\xd2\xc3\x95\xf8\x8f\xee\xcf\x85\x10\x42\x08\x21\x84\x10\x42\x08\x71" "\xf5\x3d\xdf\xa9\xf3\xd3\x8f\xb7\x6e\xdd\xbc\xdd\x3f\x37\xc1\xdf\x9e" "\x0b\xfc\x6b\x59\x7f\xda\xa4\xf6\xf6\x7d\xcf\x5d\x3e\xfd\xd5\x39\xbb" "\x4c\x64\x92\x76\x26\x57\xf9\x8d\x49\x08\x21\x84\x10\x42\x08\xf1\xa7" "\xbb\x72\xd1\x7f\xb5\x57\x22\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21" "\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10" "\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\xa4\x5d\xff\x13\xff\x4e" "\xec\x6a\xef\x51\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84" "\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42" "\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21" "\x84\xb8\xda\xfe\xbf\x00\x00\x00\xff\xff\x39\x31\x37\x0d", 5386); syz_mount_image(/*fs=*/0x400000000040, /*dir=*/0x400000000240, /*flags=*/0, /*opts=*/0x4000000000c0, /*chdir=*/1, /*size=*/0x150a, /*img=*/0x4000000017c0); break; case 1: memcpy((void*)0x400000000900, "./file1\000", 8); syscall(__NR_truncate, /*file=*/0x400000000900ul, /*len=*/0xbf39ul); break; case 2: memcpy((void*)0x400000000240, "./file1\000", 8); res = syscall( __NR_open, /*file=*/0x400000000240ul, /*flags=O_SYNC|O_NOCTTY|O_NOATIME|O_DIRECT|O_CREAT|0x2*/ 0x145142ul, /*mode=S_IROTH|S_IXUSR*/ 0x44ul); if (res != -1) r[0] = res; break; case 3: memcpy((void*)0x400000000140, "./file1\000", 8); syscall(__NR_truncate, /*file=*/0x400000000140ul, /*len=*/0xe4c8ul); break; case 4: syscall(__NR_sendfile, /*fdout=*/r[0], /*fdin=*/r[0], /*off=*/0ul, /*count=*/0x800000009ul); break; } } int main(void) { syscall(__NR_mmap, /*addr=*/0x3ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x400000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x400001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); const char* reason; (void)reason; loop(); return 0; }