174692 2017-07-20 15:03:29 -0700 [CG] An image should not invoke many system calls before confirming its format is supported 2017-07-21 13:38:26 -0700 1 1 1 Unclassified WebKit Images WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 sabouhallawa sabouhallawa buildbot cdumez commit-queue dbates japhet jeremyj-wk simon.fraser thorton webkit-bug-importer oldest_to_newest 1330785 0 sabouhallawa 2017-07-20 15:03:29 -0700 WebKit has its whitelist of image formats. Loading images with any format out of this whitelist will be cancelled. To know the image type, WebKit creates an ImageSource and sends it the encoded data when it's received. It calls CGImageSourceGetStatus() to know the status of the encoded data to know whether the type is available or not. When the image is available, WebKit calls CGImageSourceGetType() to decide whether to continue loading this image or cancel loading it and marking it a broken image. We should be careful when invoking system calls before confirming the image type is available and it is one of the whitelist formats. Otherwise we will be invoking the parsers of the unsupported formats. The fix should be the following: After setting new data to the ImageSource: -- Call CGImageSourceGetType() — if that returns nil, return Unknown. -- if CGImageSourceGetType() returns non-nil, then use can call CGImageSourceGetStatus() -- If CGImageSourceGetStatus() returns kCGImageStatusIncomplete or kCGImageStatusComplete, we check isAllowedImageUTI(CGImageSourceGetType()) - if it returns false we return Error. -- If isAllowedImageUTI(CGImageSourceGetType()) returns true, we can call CGImageSourceCopyPropertiesAtIndex() and other system functions. 1330788 1 316029 sabouhallawa 2017-07-20 15:04:22 -0700 Created attachment 316029 Patch 1330789 2 sabouhallawa 2017-07-20 15:05:11 -0700 <rdar://problem/33388544> 1330844 3 316029 jeremyj-wk 2017-07-20 17:13:39 -0700 Comment on attachment 316029 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=316029&action=review Is there any chance this UTI check is too strict and will prevent loading of images that we don't have a (correct) UTI for but are otherwise displayable? I.e. mime-type is incorrect and it is actually a valid image type? Is it possible to test this? > Source/WebCore/ChangeLog:26 > + before knowing the uti of the image. When knowing it, we call CGImageSourceGetStatus() nit: UIT > Source/WebCore/ChangeLog:29 > + false, return Error which will make the CachedImage cancels loading the nit: cancel loading 1330849 4 316046 sabouhallawa 2017-07-20 17:26:12 -0700 Created attachment 316046 Patch 1330852 5 sabouhallawa 2017-07-20 17:37:36 -0700 (In reply to Jeremy Jones from comment #3) > Comment on attachment 316029 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=316029&action=review > > Is there any chance this UTI check is too strict and will prevent loading of > images that we don't have a (correct) UTI for but are otherwise displayable? > I.e. mime-type is incorrect and it is actually a valid image type? > Actually the requirement is to load and display only the images whose formats are in the WebKit whitelist image formats. The system can display more formats than this whitelist. But these formats are not standard and they may cause security vulnerabilities. So yes we need our check for the image UTI be strict. > Is it possible to test this? > This work is covered by LayoutTests/fast/images/image-formats-support.html. This patch is about making less system calls in case the image format is not supported. I do not think I can make a test for that. 1330859 6 jeremyj-wk 2017-07-20 17:47:25 -0700 (In reply to Said Abou-Hallawa from comment #5) > (In reply to Jeremy Jones from comment #3) > > Comment on attachment 316029 [details] > > Patch > > > > View in context: > > https://bugs.webkit.org/attachment.cgi?id=316029&action=review > > > > Is there any chance this UTI check is too strict and will prevent loading of > > images that we don't have a (correct) UTI for but are otherwise displayable? > > I.e. mime-type is incorrect and it is actually a valid image type? > > > > Actually the requirement is to load and display only the images whose > formats are in the WebKit whitelist image formats. The system can display > more formats than this whitelist. But these formats are not standard and > they may cause security vulnerabilities. So yes we need our check for the > image UTI be strict. > > > Is it possible to test this? > > > > This work is covered by LayoutTests/fast/images/image-formats-support.html. > This patch is about making less system calls in case the image format is not > supported. I do not think I can make a test for that. provisional r+ 1331091 7 316046 commit-queue 2017-07-21 13:38:24 -0700 Comment on attachment 316046 Patch Clearing flags on attachment: 316046 Committed r219738: <http://trac.webkit.org/changeset/219738> 1331092 8 commit-queue 2017-07-21 13:38:26 -0700 All reviewed patches have been landed. Closing bug. 316029 2017-07-20 15:04:22 -0700 2017-07-20 17:26:10 -0700 Patch bug-174692-20170720150421.patch text/plain 5309 sabouhallawa SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDIxOTcwNSkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDM0IEBACisyMDE3LTA3LTIwICBTYWlkIEFi b3UtSGFsbGF3YSAgPHNhYm91aGFsbGF3YUBhcHBsZS5jb20+CisKKyAgICAgICAgW0NHXSBBbiBp bWFnZSBzaG91bGQgbm90IGludm9rZSBtYW55IHN5c3RlbSBjYWxscyBiZWZvcmUgY29uZmlybWlu ZyBpdHMgZm9ybWF0IGlzIHN1cHBvcnRlZAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9y Zy9zaG93X2J1Zy5jZ2k/aWQ9MTc0NjkyCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisKKyAgICAgICAgV2Ugc2hvdWxkIGJlIGNhcmVmdWwgd2hlbiBpbnZva2luZyBzeXN0 ZW0gY2FsbHMgYmVmb3JlIGNvbmZpcm1pbmcgdGhlIGltYWdlCisgICAgICAgIHR5cGUgaXMgYXZh aWxhYmxlIGFuZCBpdCBpcyBvbmUgb2YgdGhlIHdoaXRlbGlzdCBmb3JtYXRzLiBPdGhlcndpc2Ug d2Ugd2lsbAorICAgICAgICBiZSBpbnZva2luZyB0aGUgcGFyc2VycyBvZiB0aGUgdW5zdXBwb3J0 ZWQgZm9ybWF0cy4KKworICAgICAgICAqIGxvYWRlci9jYWNoZS9DYWNoZWRJbWFnZS5jcHA6Cisg ICAgICAgIChXZWJDb3JlOjpDYWNoZWRJbWFnZTo6c2V0SW1hZ2VEYXRhQnVmZmVyKTogVGhlIGNo ZWNrIGlzQWxsb3dlZEltYWdlVVRJKCkKKyAgICAgICAgaXMgbm93IGRvbmUgaW4gSW1hZ2VEZWNv ZGVyOjplbmNvZGVkRGF0YVN0YXR1cygpIHdoaWNoIHdpbGwgcmV0dXJuIEVycm9yCisgICAgICAg IGlmIHRoZXJlIGlzIGFuIGVycm9yIGluIHRoZSBkYXRhIG9yICJpc0FsbG93ZWRJbWFnZVVUSSgp IHJldHVybnMgZmFsc2UuIgorCisgICAgICAgICogcGxhdGZvcm0vZ3JhcGhpY3MvQml0bWFwSW1h Z2UuY3BwOgorICAgICAgICAoV2ViQ29yZTo6Qml0bWFwSW1hZ2U6OmRhdGFDaGFuZ2VkKTogQXZv aWQgY2FsbGluZyBjYW5Vc2VBc3luY0RlY29kaW5nRm9yTGFyZ2VJbWFnZXMoKQorICAgICAgICBi ZWZvcmUgY29uZmlybWluZyB0aGUgaW1hZ2UgdHlwZSBpcyBhdmFpbGFibGUgYW5kIGl0J3Mgc3Vw cG9ydGVkIGJ5IFdlYktpdC4KKyAgICAgICAgY2FuVXNlQXN5bmNEZWNvZGluZ0ZvckxhcmdlSW1h Z2VzKCkgdHJpZXMgdG8gY2FjaGUgdGhlIGZpcnN0IGZyYW1lIG9mIHRoZQorICAgICAgICBpbWFn ZSB0byBrbm93IGl0cyBzaXplLiBBc2tpbmcgdGhlIEltYWdlRnJhbWVDYWNoZSB0byBkZXN0cm95 IGl0cyBkZWNvZGVkCisgICAgICAgIGZyYW1lcyBpcyBub3QgbmVlZGVkIHVubGVzcyBJbWFnZUZy YW1lQ2FjaGU6OmRlY29kZWRTaXplKCkgaXMgbm90IHplcm8uCisKKyAgICAgICAgKiBwbGF0Zm9y bS9ncmFwaGljcy9jZy9JbWFnZURlY29kZXJDRy5jcHA6CisgICAgICAgIChXZWJDb3JlOjpJbWFn ZURlY29kZXI6OmVuY29kZWREYXRhU3RhdHVzKTogQXZvaWQgY2FsbGluZyBDR0ltYWdlU291cmNl R2V0U3RhdHVzKCkKKyAgICAgICAgYmVmb3JlIGtub3dpbmcgdGhlIHV0aSBvZiB0aGUgaW1hZ2Uu IFdoZW4ga25vd2luZyBpdCwgd2UgY2FsbCBDR0ltYWdlU291cmNlR2V0U3RhdHVzKCkKKyAgICAg ICAgYW5kIGlmIGl0IHJldHVybnMga0NHSW1hZ2VTdGF0dXNJbmNvbXBsZXRlIG9yIGtDR0ltYWdl U3RhdHVzQ29tcGxldGUsIHdlCisgICAgICAgIGNoZWNrIHdoZXRoZXIgaXNBbGxvd2VkSW1hZ2VV VEkoKSBvciBub3QuIElmIGlzQWxsb3dlZEltYWdlVVRJKCkgcmV0dXJucworICAgICAgICBmYWxz ZSwgcmV0dXJuIEVycm9yIHdoaWNoIHdpbGwgbWFrZSB0aGUgQ2FjaGVkSW1hZ2UgY2FuY2VscyBs b2FkaW5nIHRoZSAKKyAgICAgICAgcmVzdCBvZiB0aGUgaW1hZ2UuCisKIDIwMTctMDctMjAgIENo cmlzIER1bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KIAogICAgICAgICBSZWdyZXNzaW9uKElUUCk6 IE1heSBnZXQgZnJlcXVlbnRseSBsb2dnZWQgb3V0IG9mIHdzai5jb20KSW5kZXg6IFNvdXJjZS9X ZWJDb3JlL2xvYWRlci9jYWNoZS9DYWNoZWRJbWFnZS5jcHAKPT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNl L1dlYkNvcmUvbG9hZGVyL2NhY2hlL0NhY2hlZEltYWdlLmNwcAkocmV2aXNpb24gMjE5NjE3KQor KysgU291cmNlL1dlYkNvcmUvbG9hZGVyL2NhY2hlL0NhY2hlZEltYWdlLmNwcAkod29ya2luZyBj b3B5KQpAQCAtNTEsNyArNTEsNiBAQAogCiAjaWYgVVNFKENHKQogI2luY2x1ZGUgIlBERkRvY3Vt ZW50SW1hZ2UuaCIKLSNpbmNsdWRlICJVVElSZWdpc3RyeS5oIgogI2VuZGlmCiAKIG5hbWVzcGFj ZSBXZWJDb3JlIHsKQEAgLTQ0MCwxMiArNDM5LDcgQEAgdm9pZCBDYWNoZWRJbWFnZTo6YWRkSW5j cmVtZW50YWxEYXRhQnVmZgogCiBFbmNvZGVkRGF0YVN0YXR1cyBDYWNoZWRJbWFnZTo6c2V0SW1h Z2VEYXRhQnVmZmVyKFNoYXJlZEJ1ZmZlciogZGF0YSwgYm9vbCBhbGxEYXRhUmVjZWl2ZWQpCiB7 Ci0gICAgRW5jb2RlZERhdGFTdGF0dXMgZW5jb2RlZERhdGFTdGF0dXMgPSBtX2ltYWdlID8gbV9p bWFnZS0+c2V0RGF0YShkYXRhLCBhbGxEYXRhUmVjZWl2ZWQpIDogRW5jb2RlZERhdGFTdGF0dXM6 OkVycm9yOwotI2lmIFVTRShDRykKLSAgICBpZiAoZW5jb2RlZERhdGFTdGF0dXMgPj0gRW5jb2Rl ZERhdGFTdGF0dXM6OlR5cGVBdmFpbGFibGUgJiYgbV9pbWFnZS0+aXNCaXRtYXBJbWFnZSgpICYm ICFpc0FsbG93ZWRJbWFnZVVUSShtX2ltYWdlLT51dGkoKSkpCi0gICAgICAgIHJldHVybiBFbmNv ZGVkRGF0YVN0YXR1czo6RXJyb3I7Ci0jZW5kaWYKLSAgICByZXR1cm4gZW5jb2RlZERhdGFTdGF0 dXM7CisgICAgcmV0dXJuIG1faW1hZ2UgPyBtX2ltYWdlLT5zZXREYXRhKGRhdGEsIGFsbERhdGFS ZWNlaXZlZCkgOiBFbmNvZGVkRGF0YVN0YXR1czo6RXJyb3I7CiB9CiAKIHZvaWQgQ2FjaGVkSW1h Z2U6OmFkZERhdGFCdWZmZXIoU2hhcmVkQnVmZmVyJiBkYXRhKQpJbmRleDogU291cmNlL1dlYkNv cmUvcGxhdGZvcm0vZ3JhcGhpY3MvQml0bWFwSW1hZ2UuY3BwCj09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJj ZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL0JpdG1hcEltYWdlLmNwcAkocmV2aXNpb24gMjE5 NjE3KQorKysgU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvQml0bWFwSW1hZ2UuY3Bw CSh3b3JraW5nIGNvcHkpCkBAIC0xMDcsNyArMTA3LDcgQEAgdm9pZCBCaXRtYXBJbWFnZTo6ZGVz dHJveURlY29kZWREYXRhSWZOZQogCiBFbmNvZGVkRGF0YVN0YXR1cyBCaXRtYXBJbWFnZTo6ZGF0 YUNoYW5nZWQoYm9vbCBhbGxEYXRhUmVjZWl2ZWQpCiB7Ci0gICAgaWYgKCFjYW5Vc2VBc3luY0Rl Y29kaW5nRm9yTGFyZ2VJbWFnZXMoKSkKKyAgICBpZiAobV9zb3VyY2UuZGVjb2RlZFNpemUoKSAm JiAhY2FuVXNlQXN5bmNEZWNvZGluZ0ZvckxhcmdlSW1hZ2VzKCkpCiAgICAgICAgIG1fc291cmNl LmRlc3Ryb3lJbmNvbXBsZXRlRGVjb2RlZERhdGEoKTsKIAogICAgIG1fY3VycmVudEZyYW1lRGVj b2RpbmdTdGF0dXMgPSBJbWFnZUZyYW1lOjpEZWNvZGluZ1N0YXR1czo6SW52YWxpZDsKSW5kZXg6 IFNvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL2NnL0ltYWdlRGVjb2RlckNHLmNwcAo9 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9jZy9JbWFnZURl Y29kZXJDRy5jcHAJKHJldmlzaW9uIDIxOTYxNykKKysrIFNvdXJjZS9XZWJDb3JlL3BsYXRmb3Jt L2dyYXBoaWNzL2NnL0ltYWdlRGVjb2RlckNHLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMzUsNiAr MzUsNyBAQAogI2luY2x1ZGUgIkludFNpemUuaCIKICNpbmNsdWRlICJMb2dnaW5nLmgiCiAjaW5j bHVkZSAiU2hhcmVkQnVmZmVyLmgiCisjaW5jbHVkZSAiVVRJUmVnaXN0cnkuaCIKIAogI2lmICFQ TEFURk9STShJT1MpCiAjaW5jbHVkZSA8QXBwbGljYXRpb25TZXJ2aWNlcy9BcHBsaWNhdGlvblNl cnZpY2VzLmg+CkBAIC0xODQsNiArMTg1LDEwIEBAIFN0cmluZyBJbWFnZURlY29kZXI6OmZpbGVu YW1lRXh0ZW5zaW9uKCkKIAogRW5jb2RlZERhdGFTdGF0dXMgSW1hZ2VEZWNvZGVyOjplbmNvZGVk RGF0YVN0YXR1cygpIGNvbnN0CiB7CisgICAgU3RyaW5nIHV0aSA9IHRoaXMtPnV0aSgpOworICAg IGlmICh1dGkuaXNFbXB0eSgpKQorICAgICAgICByZXR1cm4gRW5jb2RlZERhdGFTdGF0dXM6OlVu a25vd247CisKICAgICBzd2l0Y2ggKENHSW1hZ2VTb3VyY2VHZXRTdGF0dXMobV9uYXRpdmVEZWNv ZGVyLmdldCgpKSkgewogICAgIGNhc2Uga0NHSW1hZ2VTdGF0dXNVbmtub3duVHlwZToKICAgICAg ICAgcmV0dXJuIEVuY29kZWREYXRhU3RhdHVzOjpFcnJvcjsKQEAgLTE5OCw2ICsyMDMsOSBAQCBF bmNvZGVkRGF0YVN0YXR1cyBJbWFnZURlY29kZXI6OmVuY29kZWRECiAgICAgICAgIHJldHVybiBF bmNvZGVkRGF0YVN0YXR1czo6RXJyb3I7CiAKICAgICBjYXNlIGtDR0ltYWdlU3RhdHVzSW5jb21w bGV0ZTogeworICAgICAgICBpZiAoIWlzQWxsb3dlZEltYWdlVVRJKHV0aSkpCisgICAgICAgICAg ICByZXR1cm4gRW5jb2RlZERhdGFTdGF0dXM6OkVycm9yOworCiAgICAgICAgIFJldGFpblB0cjxD RkRpY3Rpb25hcnlSZWY+IGltYWdlMFByb3BlcnRpZXMgPSBhZG9wdENGKENHSW1hZ2VTb3VyY2VD b3B5UHJvcGVydGllc0F0SW5kZXgobV9uYXRpdmVEZWNvZGVyLmdldCgpLCAwLCBpbWFnZVNvdXJj ZU9wdGlvbnMoKS5nZXQoKSkpOwogICAgICAgICBpZiAoIWltYWdlMFByb3BlcnRpZXMpCiAgICAg ICAgICAgICByZXR1cm4gRW5jb2RlZERhdGFTdGF0dXM6OlR5cGVBdmFpbGFibGU7CkBAIC0yMDks NiArMjE3LDkgQEAgRW5jb2RlZERhdGFTdGF0dXMgSW1hZ2VEZWNvZGVyOjplbmNvZGVkRAogICAg IH0KIAogICAgIGNhc2Uga0NHSW1hZ2VTdGF0dXNDb21wbGV0ZToKKyAgICAgICAgaWYgKCFpc0Fs bG93ZWRJbWFnZVVUSSh1dGkpKQorICAgICAgICAgICAgcmV0dXJuIEVuY29kZWREYXRhU3RhdHVz OjpFcnJvcjsKKwogICAgICAgICByZXR1cm4gRW5jb2RlZERhdGFTdGF0dXM6OkNvbXBsZXRlOwog ICAgIH0KIAo= 316046 2017-07-20 17:26:12 -0700 2017-07-21 13:38:24 -0700 Patch bug-174692-20170720172611.patch text/plain 5312 sabouhallawa SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDIxOTcwNSkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDM0IEBACisyMDE3LTA3LTIwICBTYWlkIEFi b3UtSGFsbGF3YSAgPHNhYm91aGFsbGF3YUBhcHBsZS5jb20+CisKKyAgICAgICAgW0NHXSBBbiBp bWFnZSBzaG91bGQgbm90IGludm9rZSBtYW55IHN5c3RlbSBjYWxscyBiZWZvcmUgY29uZmlybWlu ZyBpdHMgZm9ybWF0IGlzIHN1cHBvcnRlZAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9y Zy9zaG93X2J1Zy5jZ2k/aWQ9MTc0NjkyCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisKKyAgICAgICAgV2Ugc2hvdWxkIGJlIGNhcmVmdWwgd2hlbiBpbnZva2luZyBzeXN0 ZW0gY2FsbHMgYmVmb3JlIGNvbmZpcm1pbmcgdGhhdCB0aGUKKyAgICAgICAgaW1hZ2UgdHlwZSBp cyBhdmFpbGFibGUgYW5kIGl0IGlzIG9uZSBvZiB0aGUgd2hpdGVsaXN0IGZvcm1hdHMuIE90aGVy d2lzZQorICAgICAgICB3ZSB3aWxsIGJlIGNhbGxpbmcgdGhlIHBhcnNlcnMgb2YgdGhlIHVuc3Vw cG9ydGVkIGZvcm1hdHMuCisKKyAgICAgICAgKiBsb2FkZXIvY2FjaGUvQ2FjaGVkSW1hZ2UuY3Bw OgorICAgICAgICAoV2ViQ29yZTo6Q2FjaGVkSW1hZ2U6OnNldEltYWdlRGF0YUJ1ZmZlcik6IFRo ZSBjaGVjayBpc0FsbG93ZWRJbWFnZVVUSSgpCisgICAgICAgIGlzIG5vdyBkb25lIGluIEltYWdl RGVjb2Rlcjo6ZW5jb2RlZERhdGFTdGF0dXMoKSB3aGljaCB3aWxsIHJldHVybiBFcnJvcgorICAg ICAgICBpZiB0aGVyZSBpcyBhbiBlcnJvciBpbiB0aGUgZGF0YSBvciAiaXNBbGxvd2VkSW1hZ2VV VEkoKSByZXR1cm5zIGZhbHNlLiIKKworICAgICAgICAqIHBsYXRmb3JtL2dyYXBoaWNzL0JpdG1h cEltYWdlLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkJpdG1hcEltYWdlOjpkYXRhQ2hhbmdlZCk6 IEF2b2lkIGNhbGxpbmcgY2FuVXNlQXN5bmNEZWNvZGluZ0ZvckxhcmdlSW1hZ2VzKCkKKyAgICAg ICAgYmVmb3JlIGNvbmZpcm1pbmcgdGhlIGltYWdlIHR5cGUgaXMgYXZhaWxhYmxlIGFuZCBpdCdz IHN1cHBvcnRlZCBieSBXZWJLaXQuCisgICAgICAgIGNhblVzZUFzeW5jRGVjb2RpbmdGb3JMYXJn ZUltYWdlcygpIHRyaWVzIHRvIGNhY2hlIHRoZSBmaXJzdCBmcmFtZSBvZiB0aGUKKyAgICAgICAg aW1hZ2UgdG8ga25vdyBpdHMgc2l6ZS4gQXNraW5nIHRoZSBJbWFnZUZyYW1lQ2FjaGUgdG8gZGVz dHJveSBpdHMgZGVjb2RlZAorICAgICAgICBmcmFtZXMgaXMgbm90IG5lZWRlZCB1bmxlc3MgSW1h Z2VGcmFtZUNhY2hlOjpkZWNvZGVkU2l6ZSgpIGlzIG5vdCB6ZXJvLgorCisgICAgICAgICogcGxh dGZvcm0vZ3JhcGhpY3MvY2cvSW1hZ2VEZWNvZGVyQ0cuY3BwOgorICAgICAgICAoV2ViQ29yZTo6 SW1hZ2VEZWNvZGVyOjplbmNvZGVkRGF0YVN0YXR1cyk6IEF2b2lkIGNhbGxpbmcgQ0dJbWFnZVNv dXJjZUdldFN0YXR1cygpCisgICAgICAgIGJlZm9yZSBrbm93aW5nIHRoZSBVVEkgb2YgdGhlIGlt YWdlLiBXaGVuIGtub3dpbmcgaXQsIHdlIGNhbGwgQ0dJbWFnZVNvdXJjZUdldFN0YXR1cygpCisg ICAgICAgIGFuZCBpZiBpdCByZXR1cm5zIGtDR0ltYWdlU3RhdHVzSW5jb21wbGV0ZSBvciBrQ0dJ bWFnZVN0YXR1c0NvbXBsZXRlLCB3ZQorICAgICAgICBjaGVjayB3aGV0aGVyIGlzQWxsb3dlZElt YWdlVVRJKCkgb3Igbm90LiBJZiBpc0FsbG93ZWRJbWFnZVVUSSgpIHJldHVybnMKKyAgICAgICAg ZmFsc2UsIHJldHVybiBFcnJvciB3aGljaCB3aWxsIG1ha2UgdGhlIENhY2hlZEltYWdlIGNhbmNl bCBsb2FkaW5nIHRoZSAKKyAgICAgICAgcmVzdCBvZiB0aGUgaW1hZ2UuCisKIDIwMTctMDctMjAg IENocmlzIER1bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KIAogICAgICAgICBSZWdyZXNzaW9uKElU UCk6IE1heSBnZXQgZnJlcXVlbnRseSBsb2dnZWQgb3V0IG9mIHdzai5jb20KSW5kZXg6IFNvdXJj ZS9XZWJDb3JlL2xvYWRlci9jYWNoZS9DYWNoZWRJbWFnZS5jcHAKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL1dlYkNvcmUvbG9hZGVyL2NhY2hlL0NhY2hlZEltYWdlLmNwcAkocmV2aXNpb24gMjE5NjE3 KQorKysgU291cmNlL1dlYkNvcmUvbG9hZGVyL2NhY2hlL0NhY2hlZEltYWdlLmNwcAkod29ya2lu ZyBjb3B5KQpAQCAtNTEsNyArNTEsNiBAQAogCiAjaWYgVVNFKENHKQogI2luY2x1ZGUgIlBERkRv Y3VtZW50SW1hZ2UuaCIKLSNpbmNsdWRlICJVVElSZWdpc3RyeS5oIgogI2VuZGlmCiAKIG5hbWVz cGFjZSBXZWJDb3JlIHsKQEAgLTQ0MCwxMiArNDM5LDcgQEAgdm9pZCBDYWNoZWRJbWFnZTo6YWRk SW5jcmVtZW50YWxEYXRhQnVmZgogCiBFbmNvZGVkRGF0YVN0YXR1cyBDYWNoZWRJbWFnZTo6c2V0 SW1hZ2VEYXRhQnVmZmVyKFNoYXJlZEJ1ZmZlciogZGF0YSwgYm9vbCBhbGxEYXRhUmVjZWl2ZWQp CiB7Ci0gICAgRW5jb2RlZERhdGFTdGF0dXMgZW5jb2RlZERhdGFTdGF0dXMgPSBtX2ltYWdlID8g bV9pbWFnZS0+c2V0RGF0YShkYXRhLCBhbGxEYXRhUmVjZWl2ZWQpIDogRW5jb2RlZERhdGFTdGF0 dXM6OkVycm9yOwotI2lmIFVTRShDRykKLSAgICBpZiAoZW5jb2RlZERhdGFTdGF0dXMgPj0gRW5j b2RlZERhdGFTdGF0dXM6OlR5cGVBdmFpbGFibGUgJiYgbV9pbWFnZS0+aXNCaXRtYXBJbWFnZSgp ICYmICFpc0FsbG93ZWRJbWFnZVVUSShtX2ltYWdlLT51dGkoKSkpCi0gICAgICAgIHJldHVybiBF bmNvZGVkRGF0YVN0YXR1czo6RXJyb3I7Ci0jZW5kaWYKLSAgICByZXR1cm4gZW5jb2RlZERhdGFT dGF0dXM7CisgICAgcmV0dXJuIG1faW1hZ2UgPyBtX2ltYWdlLT5zZXREYXRhKGRhdGEsIGFsbERh dGFSZWNlaXZlZCkgOiBFbmNvZGVkRGF0YVN0YXR1czo6RXJyb3I7CiB9CiAKIHZvaWQgQ2FjaGVk SW1hZ2U6OmFkZERhdGFCdWZmZXIoU2hhcmVkQnVmZmVyJiBkYXRhKQpJbmRleDogU291cmNlL1dl YkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvQml0bWFwSW1hZ2UuY3BwCj09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNv dXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL0JpdG1hcEltYWdlLmNwcAkocmV2aXNpb24g MjE5NjE3KQorKysgU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvQml0bWFwSW1hZ2Uu Y3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xMDcsNyArMTA3LDcgQEAgdm9pZCBCaXRtYXBJbWFnZTo6 ZGVzdHJveURlY29kZWREYXRhSWZOZQogCiBFbmNvZGVkRGF0YVN0YXR1cyBCaXRtYXBJbWFnZTo6 ZGF0YUNoYW5nZWQoYm9vbCBhbGxEYXRhUmVjZWl2ZWQpCiB7Ci0gICAgaWYgKCFjYW5Vc2VBc3lu Y0RlY29kaW5nRm9yTGFyZ2VJbWFnZXMoKSkKKyAgICBpZiAobV9zb3VyY2UuZGVjb2RlZFNpemUo KSAmJiAhY2FuVXNlQXN5bmNEZWNvZGluZ0ZvckxhcmdlSW1hZ2VzKCkpCiAgICAgICAgIG1fc291 cmNlLmRlc3Ryb3lJbmNvbXBsZXRlRGVjb2RlZERhdGEoKTsKIAogICAgIG1fY3VycmVudEZyYW1l RGVjb2RpbmdTdGF0dXMgPSBJbWFnZUZyYW1lOjpEZWNvZGluZ1N0YXR1czo6SW52YWxpZDsKSW5k ZXg6IFNvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL2NnL0ltYWdlRGVjb2RlckNHLmNw cAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9jZy9JbWFn ZURlY29kZXJDRy5jcHAJKHJldmlzaW9uIDIxOTYxNykKKysrIFNvdXJjZS9XZWJDb3JlL3BsYXRm b3JtL2dyYXBoaWNzL2NnL0ltYWdlRGVjb2RlckNHLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMzUs NiArMzUsNyBAQAogI2luY2x1ZGUgIkludFNpemUuaCIKICNpbmNsdWRlICJMb2dnaW5nLmgiCiAj aW5jbHVkZSAiU2hhcmVkQnVmZmVyLmgiCisjaW5jbHVkZSAiVVRJUmVnaXN0cnkuaCIKIAogI2lm ICFQTEFURk9STShJT1MpCiAjaW5jbHVkZSA8QXBwbGljYXRpb25TZXJ2aWNlcy9BcHBsaWNhdGlv blNlcnZpY2VzLmg+CkBAIC0xODQsNiArMTg1LDEwIEBAIFN0cmluZyBJbWFnZURlY29kZXI6OmZp bGVuYW1lRXh0ZW5zaW9uKCkKIAogRW5jb2RlZERhdGFTdGF0dXMgSW1hZ2VEZWNvZGVyOjplbmNv ZGVkRGF0YVN0YXR1cygpIGNvbnN0CiB7CisgICAgU3RyaW5nIHV0aSA9IHRoaXMtPnV0aSgpOwor ICAgIGlmICh1dGkuaXNFbXB0eSgpKQorICAgICAgICByZXR1cm4gRW5jb2RlZERhdGFTdGF0dXM6 OlVua25vd247CisKICAgICBzd2l0Y2ggKENHSW1hZ2VTb3VyY2VHZXRTdGF0dXMobV9uYXRpdmVE ZWNvZGVyLmdldCgpKSkgewogICAgIGNhc2Uga0NHSW1hZ2VTdGF0dXNVbmtub3duVHlwZToKICAg ICAgICAgcmV0dXJuIEVuY29kZWREYXRhU3RhdHVzOjpFcnJvcjsKQEAgLTE5OCw2ICsyMDMsOSBA QCBFbmNvZGVkRGF0YVN0YXR1cyBJbWFnZURlY29kZXI6OmVuY29kZWRECiAgICAgICAgIHJldHVy biBFbmNvZGVkRGF0YVN0YXR1czo6RXJyb3I7CiAKICAgICBjYXNlIGtDR0ltYWdlU3RhdHVzSW5j b21wbGV0ZTogeworICAgICAgICBpZiAoIWlzQWxsb3dlZEltYWdlVVRJKHV0aSkpCisgICAgICAg ICAgICByZXR1cm4gRW5jb2RlZERhdGFTdGF0dXM6OkVycm9yOworCiAgICAgICAgIFJldGFpblB0 cjxDRkRpY3Rpb25hcnlSZWY+IGltYWdlMFByb3BlcnRpZXMgPSBhZG9wdENGKENHSW1hZ2VTb3Vy Y2VDb3B5UHJvcGVydGllc0F0SW5kZXgobV9uYXRpdmVEZWNvZGVyLmdldCgpLCAwLCBpbWFnZVNv dXJjZU9wdGlvbnMoKS5nZXQoKSkpOwogICAgICAgICBpZiAoIWltYWdlMFByb3BlcnRpZXMpCiAg ICAgICAgICAgICByZXR1cm4gRW5jb2RlZERhdGFTdGF0dXM6OlR5cGVBdmFpbGFibGU7CkBAIC0y MDksNiArMjE3LDkgQEAgRW5jb2RlZERhdGFTdGF0dXMgSW1hZ2VEZWNvZGVyOjplbmNvZGVkRAog ICAgIH0KIAogICAgIGNhc2Uga0NHSW1hZ2VTdGF0dXNDb21wbGV0ZToKKyAgICAgICAgaWYgKCFp c0FsbG93ZWRJbWFnZVVUSSh1dGkpKQorICAgICAgICAgICAgcmV0dXJuIEVuY29kZWREYXRhU3Rh dHVzOjpFcnJvcjsKKwogICAgICAgICByZXR1cm4gRW5jb2RlZERhdGFTdGF0dXM6OkNvbXBsZXRl OwogICAgIH0KIAo=