80465 2012-03-06 18:04:11 -0800 Integer overflow check code in arithmetic operation in classic interpreter 2012-03-12 10:31:47 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P2 Minor --- 0 sg5.lee webkit-unassigned barraclough fpizlo webkit.review.bot oldest_to_newest 572382 0 sg5.lee 2012-03-06 18:04:11 -0800 Classic Interpreter checks whether integer arithmetic operation will cause overflow in privateExecute(). Currently the check code is like followings: DEFINE_OPCODE(op_add) { /* add dst(r) src1(r) src2(r) Adds register src1 and register src2, and puts the result in register dst. (JS add may be string concatenation or numeric add, depending on the types of the operands.) */ int dst = vPC[1].u.operand; JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue(); JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue(); if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | (src2.asInt32() & 0xc0000000))) // no overflow callFrame->uncheckedR(dst) = jsNumber(src1.asInt32() + src2.asInt32()); else { JSValue result = jsAdd(callFrame, src1, src2); CHECK_FOR_EXCEPTION(); callFrame->uncheckedR(dst) = result; } I can't understand the test condition ... && !(src1.asInt32() | (src2.asInt32() & 0xc0000000))) // no overflow If src1 is not zero, it would falling to else condition (jsAdd). For simple example, both src1 and src2 is 1, it fails the condition: ... && !((src1.asInt32() | src2.asInt32()) & 0xc0000000)) I wonder if is a mistake, and the original intention is ... && !((src1.asInt32() | src2.asInt32()) & 0xc0000000)) Please see the change in parenthesis. If both of src1 and src2 have most two significant bits as zero, no overflow can occurs. Although, it is conservative, but is fast and simple check. op_sub has same condition. I have same question about op_mul. if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() >> 15)) // no overflow the test expression should be like followings: ... && !( (src1.asInt32() | src2.asInt32()) >> 15)) // no overflow Please see added parenthesis. Since bit-shift operator's precedence is high than bit OR, parenthesis is necessary. If both src1 and src2 have most 16 significant bits as zero, no overflow can occurs. 572638 1 barraclough 2012-03-07 00:24:43 -0800 (In reply to comment #0) > I wonder if is a mistake, and the original intention is Ouch, yes, I think you're right. > Although, it is conservative, but is fast and simple check. Yes, that is the intention. > If both src1 and src2 have most 16 significant bits as zero, no overflow can occurs. Yes, again I think you're right. One detail, actually you need the top 17 bits to be zero. Multiplying two 16 bit values requires nearly the full 32-bit range (2^16 - 1)^2 == 2^32 - 2^17 + 1, so cannot be represented with a signed integer. 575873 2 131266 sg5.lee 2012-03-11 18:20:24 -0700 Created attachment 131266 Patch 575895 3 131266 barraclough 2012-03-11 19:28:11 -0700 Comment on attachment 131266 Patch See my last comment, changing the value '15' to '16' is incorrect, you will fail to detect overflow in the case of values such as 0xFFFF * 0xFFFF. 575901 4 sg5.lee 2012-03-11 19:49:48 -0700 I am sorry for my mistake. I incorrectly assumed the operand is a unsigned number. As your kind and concise comment, 16 bit is not enough for the cases like 0xFFFF x 0xFFFF. 575902 5 131274 sg5.lee 2012-03-11 19:52:36 -0700 Created attachment 131274 Patch 575938 6 131274 barraclough 2012-03-11 22:17:15 -0700 Comment on attachment 131274 Patch Sorry, still not quite there! - we need to check the top 17 bits are all zero - we can ignore the bottom 15 bits. So the shift count needs to be 15, not 17! 576016 7 sg5.lee 2012-03-12 02:15:46 -0700 I am sorry, and thank you for fixing my stupid mistake. 576019 8 131299 sg5.lee 2012-03-12 02:20:47 -0700 Created attachment 131299 Patch 576209 9 131299 barraclough 2012-03-12 10:04:10 -0700 Comment on attachment 131299 Patch Looks good, great catch - thanks for fixing this. 576246 10 131299 webkit.review.bot 2012-03-12 10:31:42 -0700 Comment on attachment 131299 Patch Clearing flags on attachment: 131299 Committed r110443: <http://trac.webkit.org/changeset/110443> 576247 11 webkit.review.bot 2012-03-12 10:31:47 -0700 All reviewed patches have been landed. Closing bug. 131266 2012-03-11 18:20:24 -0700 2012-03-11 19:52:24 -0700 Patch bug-80465-20120312102022.patch text/plain 3068 sg5.lee U3VidmVyc2lvbiBSZXZpc2lvbjogMTEwMjQxCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCA4 MjAwMDg5MTIwNzRjYmVhYWE3M2JlYjFmNmZmNTJiZDRjMGRmNGZjLi4yMzViOGU1MGJhNmQ0YzEy MDZmOGMxMTUxYzdiOTgzMDYzMmRiNTQxIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxMyBAQAorMjAxMi0wMy0xMSAgU2FuZ0d5dSBMZWUgIDxzZzUubGVlQHNhbXN1bmcuY29t PgorCisgICAgICAgIEludGVnZXIgb3ZlcmZsb3cgY2hlY2sgY29kZSBpbiBhcml0aG1ldGljIG9w ZXJhdGlvbiBpbiBjbGFzc2ljIGludGVycHJldGVyCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD04MDQ2NQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgICogaW50ZXJwcmV0ZXIvSW50ZXJwcmV0ZXIuY3BwOgorICAg ICAgICAoSlNDOjpJbnRlcnByZXRlcjo6cHJpdmF0ZUV4ZWN1dGUpOgorCiAyMDEyLTAzLTA4ICBS eW9zdWtlIE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgogCiAgICAgICAgIE1hYyBidWlsZCBmaXgg Zm9yIG1pY3JvIGRhdGEgQVBJLgpkaWZmIC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2lu dGVycHJldGVyL0ludGVycHJldGVyLmNwcCBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9pbnRlcnBy ZXRlci9JbnRlcnByZXRlci5jcHAKaW5kZXggYTc0ZDNkZTg5MTE2OGFhMzY1Nzc5ZTAyMDBhZTY3 ZWQyOGZmYjcyMS4uZjY0Y2ZlYzJjZWIwZDg4ZmY0NDBhNWRhNWM2MjgxYWViNTk3NTlkNCAxMDA2 NDQKLS0tIGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2ludGVycHJldGVyL0ludGVycHJldGVyLmNw cAorKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvaW50ZXJwcmV0ZXIvSW50ZXJwcmV0ZXIuY3Bw CkBAIC0yMzUyLDcgKzIzNTIsNyBAQCBKU1ZhbHVlIEludGVycHJldGVyOjpwcml2YXRlRXhlY3V0 ZShFeGVjdXRpb25GbGFnIGZsYWcsIFJlZ2lzdGVyRmlsZSogcmVnaXN0ZXJGaQogICAgICAgICBp bnQgZHN0ID0gdlBDWzFdLnUub3BlcmFuZDsKICAgICAgICAgSlNWYWx1ZSBzcmMxID0gY2FsbEZy YW1lLT5yKHZQQ1syXS51Lm9wZXJhbmQpLmpzVmFsdWUoKTsKICAgICAgICAgSlNWYWx1ZSBzcmMy ID0gY2FsbEZyYW1lLT5yKHZQQ1szXS51Lm9wZXJhbmQpLmpzVmFsdWUoKTsKLSAgICAgICAgaWYg KHNyYzEuaXNJbnQzMigpICYmIHNyYzIuaXNJbnQzMigpICYmICEoc3JjMS5hc0ludDMyKCkgfCAo c3JjMi5hc0ludDMyKCkgJiAweGMwMDAwMDAwKSkpIC8vIG5vIG92ZXJmbG93CisgICAgICAgIGlm IChzcmMxLmlzSW50MzIoKSAmJiBzcmMyLmlzSW50MzIoKSAmJiAhKChzcmMxLmFzSW50MzIoKSB8 IHNyYzIuYXNJbnQzMigpKSAmIDB4YzAwMDAwMDApKSAvLyBubyBvdmVyZmxvdwogICAgICAgICAg ICAgY2FsbEZyYW1lLT51bmNoZWNrZWRSKGRzdCkgPSBqc051bWJlcihzcmMxLmFzSW50MzIoKSAr IHNyYzIuYXNJbnQzMigpKTsKICAgICAgICAgZWxzZSB7CiAgICAgICAgICAgICBKU1ZhbHVlIHJl c3VsdCA9IGpzQWRkKGNhbGxGcmFtZSwgc3JjMSwgc3JjMik7CkBAIC0yMzcxLDcgKzIzNzEsNyBA QCBKU1ZhbHVlIEludGVycHJldGVyOjpwcml2YXRlRXhlY3V0ZShFeGVjdXRpb25GbGFnIGZsYWcs IFJlZ2lzdGVyRmlsZSogcmVnaXN0ZXJGaQogICAgICAgICBpbnQgZHN0ID0gdlBDWzFdLnUub3Bl cmFuZDsKICAgICAgICAgSlNWYWx1ZSBzcmMxID0gY2FsbEZyYW1lLT5yKHZQQ1syXS51Lm9wZXJh bmQpLmpzVmFsdWUoKTsKICAgICAgICAgSlNWYWx1ZSBzcmMyID0gY2FsbEZyYW1lLT5yKHZQQ1sz XS51Lm9wZXJhbmQpLmpzVmFsdWUoKTsKLSAgICAgICAgaWYgKHNyYzEuaXNJbnQzMigpICYmIHNy YzIuaXNJbnQzMigpICYmICEoc3JjMS5hc0ludDMyKCkgfCBzcmMyLmFzSW50MzIoKSA+PiAxNSkp IC8vIG5vIG92ZXJmbG93CisgICAgICAgIGlmIChzcmMxLmlzSW50MzIoKSAmJiBzcmMyLmlzSW50 MzIoKSAmJiAhKHNyYzEuYXNJbnQzMigpIHwgc3JjMi5hc0ludDMyKCkpID4+IDE2KSAvLyBubyBv dmVyZmxvdwogICAgICAgICAgICAgICAgIGNhbGxGcmFtZS0+dW5jaGVja2VkUihkc3QpID0ganNO dW1iZXIoc3JjMS5hc0ludDMyKCkgKiBzcmMyLmFzSW50MzIoKSk7CiAgICAgICAgIGVsc2Ugewog ICAgICAgICAgICAgSlNWYWx1ZSByZXN1bHQgPSBqc051bWJlcihzcmMxLnRvTnVtYmVyKGNhbGxG cmFtZSkgKiBzcmMyLnRvTnVtYmVyKGNhbGxGcmFtZSkpOwpAQCAtMjQzOSw3ICsyNDM5LDcgQEAg SlNWYWx1ZSBJbnRlcnByZXRlcjo6cHJpdmF0ZUV4ZWN1dGUoRXhlY3V0aW9uRmxhZyBmbGFnLCBS ZWdpc3RlckZpbGUqIHJlZ2lzdGVyRmkKICAgICAgICAgaW50IGRzdCA9IHZQQ1sxXS51Lm9wZXJh bmQ7CiAgICAgICAgIEpTVmFsdWUgc3JjMSA9IGNhbGxGcmFtZS0+cih2UENbMl0udS5vcGVyYW5k KS5qc1ZhbHVlKCk7CiAgICAgICAgIEpTVmFsdWUgc3JjMiA9IGNhbGxGcmFtZS0+cih2UENbM10u dS5vcGVyYW5kKS5qc1ZhbHVlKCk7Ci0gICAgICAgIGlmIChzcmMxLmlzSW50MzIoKSAmJiBzcmMy LmlzSW50MzIoKSAmJiAhKHNyYzEuYXNJbnQzMigpIHwgKHNyYzIuYXNJbnQzMigpICYgMHhjMDAw MDAwMCkpKSAvLyBubyBvdmVyZmxvdworICAgICAgICBpZiAoc3JjMS5pc0ludDMyKCkgJiYgc3Jj Mi5pc0ludDMyKCkgJiYgISgoc3JjMS5hc0ludDMyKCkgfCBzcmMyLmFzSW50MzIoKSkgJiAweGMw MDAwMDAwKSkgLy8gbm8gb3ZlcmZsb3cKICAgICAgICAgICAgIGNhbGxGcmFtZS0+dW5jaGVja2Vk Uihkc3QpID0ganNOdW1iZXIoc3JjMS5hc0ludDMyKCkgLSBzcmMyLmFzSW50MzIoKSk7CiAgICAg ICAgIGVsc2UgewogICAgICAgICAgICAgSlNWYWx1ZSByZXN1bHQgPSBqc051bWJlcihzcmMxLnRv TnVtYmVyKGNhbGxGcmFtZSkgLSBzcmMyLnRvTnVtYmVyKGNhbGxGcmFtZSkpOwo= 131274 2012-03-11 19:52:36 -0700 2012-03-12 02:20:36 -0700 Patch bug-80465-20120312115234.patch text/plain 3068 sg5.lee U3VidmVyc2lvbiBSZXZpc2lvbjogMTEwMjQxCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCA4 MjAwMDg5MTIwNzRjYmVhYWE3M2JlYjFmNmZmNTJiZDRjMGRmNGZjLi4yMzViOGU1MGJhNmQ0YzEy MDZmOGMxMTUxYzdiOTgzMDYzMmRiNTQxIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxMyBAQAorMjAxMi0wMy0xMSAgU2FuZ0d5dSBMZWUgIDxzZzUubGVlQHNhbXN1bmcuY29t PgorCisgICAgICAgIEludGVnZXIgb3ZlcmZsb3cgY2hlY2sgY29kZSBpbiBhcml0aG1ldGljIG9w ZXJhdGlvbiBpbiBjbGFzc2ljIGludGVycHJldGVyCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD04MDQ2NQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgICogaW50ZXJwcmV0ZXIvSW50ZXJwcmV0ZXIuY3BwOgorICAg ICAgICAoSlNDOjpJbnRlcnByZXRlcjo6cHJpdmF0ZUV4ZWN1dGUpOgorCiAyMDEyLTAzLTA4ICBS eW9zdWtlIE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgogCiAgICAgICAgIE1hYyBidWlsZCBmaXgg Zm9yIG1pY3JvIGRhdGEgQVBJLgpkaWZmIC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2lu dGVycHJldGVyL0ludGVycHJldGVyLmNwcCBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9pbnRlcnBy ZXRlci9JbnRlcnByZXRlci5jcHAKaW5kZXggYTc0ZDNkZTg5MTE2OGFhMzY1Nzc5ZTAyMDBhZTY3 ZWQyOGZmYjcyMS4uYmNjNmRkMGRhMTM0ZTg2ZmIyNDU3YTkxYmUxMDg0ZTYwNWE4NjBlNiAxMDA2 NDQKLS0tIGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2ludGVycHJldGVyL0ludGVycHJldGVyLmNw cAorKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvaW50ZXJwcmV0ZXIvSW50ZXJwcmV0ZXIuY3Bw CkBAIC0yMzUyLDcgKzIzNTIsNyBAQCBKU1ZhbHVlIEludGVycHJldGVyOjpwcml2YXRlRXhlY3V0 ZShFeGVjdXRpb25GbGFnIGZsYWcsIFJlZ2lzdGVyRmlsZSogcmVnaXN0ZXJGaQogICAgICAgICBp bnQgZHN0ID0gdlBDWzFdLnUub3BlcmFuZDsKICAgICAgICAgSlNWYWx1ZSBzcmMxID0gY2FsbEZy YW1lLT5yKHZQQ1syXS51Lm9wZXJhbmQpLmpzVmFsdWUoKTsKICAgICAgICAgSlNWYWx1ZSBzcmMy ID0gY2FsbEZyYW1lLT5yKHZQQ1szXS51Lm9wZXJhbmQpLmpzVmFsdWUoKTsKLSAgICAgICAgaWYg KHNyYzEuaXNJbnQzMigpICYmIHNyYzIuaXNJbnQzMigpICYmICEoc3JjMS5hc0ludDMyKCkgfCAo c3JjMi5hc0ludDMyKCkgJiAweGMwMDAwMDAwKSkpIC8vIG5vIG92ZXJmbG93CisgICAgICAgIGlm IChzcmMxLmlzSW50MzIoKSAmJiBzcmMyLmlzSW50MzIoKSAmJiAhKChzcmMxLmFzSW50MzIoKSB8 IHNyYzIuYXNJbnQzMigpKSAmIDB4YzAwMDAwMDApKSAvLyBubyBvdmVyZmxvdwogICAgICAgICAg ICAgY2FsbEZyYW1lLT51bmNoZWNrZWRSKGRzdCkgPSBqc051bWJlcihzcmMxLmFzSW50MzIoKSAr IHNyYzIuYXNJbnQzMigpKTsKICAgICAgICAgZWxzZSB7CiAgICAgICAgICAgICBKU1ZhbHVlIHJl c3VsdCA9IGpzQWRkKGNhbGxGcmFtZSwgc3JjMSwgc3JjMik7CkBAIC0yMzcxLDcgKzIzNzEsNyBA QCBKU1ZhbHVlIEludGVycHJldGVyOjpwcml2YXRlRXhlY3V0ZShFeGVjdXRpb25GbGFnIGZsYWcs IFJlZ2lzdGVyRmlsZSogcmVnaXN0ZXJGaQogICAgICAgICBpbnQgZHN0ID0gdlBDWzFdLnUub3Bl cmFuZDsKICAgICAgICAgSlNWYWx1ZSBzcmMxID0gY2FsbEZyYW1lLT5yKHZQQ1syXS51Lm9wZXJh bmQpLmpzVmFsdWUoKTsKICAgICAgICAgSlNWYWx1ZSBzcmMyID0gY2FsbEZyYW1lLT5yKHZQQ1sz XS51Lm9wZXJhbmQpLmpzVmFsdWUoKTsKLSAgICAgICAgaWYgKHNyYzEuaXNJbnQzMigpICYmIHNy YzIuaXNJbnQzMigpICYmICEoc3JjMS5hc0ludDMyKCkgfCBzcmMyLmFzSW50MzIoKSA+PiAxNSkp IC8vIG5vIG92ZXJmbG93CisgICAgICAgIGlmIChzcmMxLmlzSW50MzIoKSAmJiBzcmMyLmlzSW50 MzIoKSAmJiAhKHNyYzEuYXNJbnQzMigpIHwgc3JjMi5hc0ludDMyKCkpID4+IDE3KSAvLyBubyBv dmVyZmxvdwogICAgICAgICAgICAgICAgIGNhbGxGcmFtZS0+dW5jaGVja2VkUihkc3QpID0ganNO dW1iZXIoc3JjMS5hc0ludDMyKCkgKiBzcmMyLmFzSW50MzIoKSk7CiAgICAgICAgIGVsc2Ugewog ICAgICAgICAgICAgSlNWYWx1ZSByZXN1bHQgPSBqc051bWJlcihzcmMxLnRvTnVtYmVyKGNhbGxG cmFtZSkgKiBzcmMyLnRvTnVtYmVyKGNhbGxGcmFtZSkpOwpAQCAtMjQzOSw3ICsyNDM5LDcgQEAg SlNWYWx1ZSBJbnRlcnByZXRlcjo6cHJpdmF0ZUV4ZWN1dGUoRXhlY3V0aW9uRmxhZyBmbGFnLCBS ZWdpc3RlckZpbGUqIHJlZ2lzdGVyRmkKICAgICAgICAgaW50IGRzdCA9IHZQQ1sxXS51Lm9wZXJh bmQ7CiAgICAgICAgIEpTVmFsdWUgc3JjMSA9IGNhbGxGcmFtZS0+cih2UENbMl0udS5vcGVyYW5k KS5qc1ZhbHVlKCk7CiAgICAgICAgIEpTVmFsdWUgc3JjMiA9IGNhbGxGcmFtZS0+cih2UENbM10u dS5vcGVyYW5kKS5qc1ZhbHVlKCk7Ci0gICAgICAgIGlmIChzcmMxLmlzSW50MzIoKSAmJiBzcmMy LmlzSW50MzIoKSAmJiAhKHNyYzEuYXNJbnQzMigpIHwgKHNyYzIuYXNJbnQzMigpICYgMHhjMDAw MDAwMCkpKSAvLyBubyBvdmVyZmxvdworICAgICAgICBpZiAoc3JjMS5pc0ludDMyKCkgJiYgc3Jj Mi5pc0ludDMyKCkgJiYgISgoc3JjMS5hc0ludDMyKCkgfCBzcmMyLmFzSW50MzIoKSkgJiAweGMw MDAwMDAwKSkgLy8gbm8gb3ZlcmZsb3cKICAgICAgICAgICAgIGNhbGxGcmFtZS0+dW5jaGVja2Vk Uihkc3QpID0ganNOdW1iZXIoc3JjMS5hc0ludDMyKCkgLSBzcmMyLmFzSW50MzIoKSk7CiAgICAg ICAgIGVsc2UgewogICAgICAgICAgICAgSlNWYWx1ZSByZXN1bHQgPSBqc051bWJlcihzcmMxLnRv TnVtYmVyKGNhbGxGcmFtZSkgLSBzcmMyLnRvTnVtYmVyKGNhbGxGcmFtZSkpOwo= 131299 2012-03-12 02:20:47 -0700 2012-03-12 10:31:42 -0700 Patch bug-80465-20120312182043.patch text/plain 3068 sg5.lee U3VidmVyc2lvbiBSZXZpc2lvbjogMTEwMjQxCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCA4 MjAwMDg5MTIwNzRjYmVhYWE3M2JlYjFmNmZmNTJiZDRjMGRmNGZjLi4yMzViOGU1MGJhNmQ0YzEy MDZmOGMxMTUxYzdiOTgzMDYzMmRiNTQxIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxMyBAQAorMjAxMi0wMy0xMSAgU2FuZ0d5dSBMZWUgIDxzZzUubGVlQHNhbXN1bmcuY29t PgorCisgICAgICAgIEludGVnZXIgb3ZlcmZsb3cgY2hlY2sgY29kZSBpbiBhcml0aG1ldGljIG9w ZXJhdGlvbiBpbiBjbGFzc2ljIGludGVycHJldGVyCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD04MDQ2NQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgICogaW50ZXJwcmV0ZXIvSW50ZXJwcmV0ZXIuY3BwOgorICAg ICAgICAoSlNDOjpJbnRlcnByZXRlcjo6cHJpdmF0ZUV4ZWN1dGUpOgorCiAyMDEyLTAzLTA4ICBS eW9zdWtlIE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgogCiAgICAgICAgIE1hYyBidWlsZCBmaXgg Zm9yIG1pY3JvIGRhdGEgQVBJLgpkaWZmIC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2lu dGVycHJldGVyL0ludGVycHJldGVyLmNwcCBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9pbnRlcnBy ZXRlci9JbnRlcnByZXRlci5jcHAKaW5kZXggYTc0ZDNkZTg5MTE2OGFhMzY1Nzc5ZTAyMDBhZTY3 ZWQyOGZmYjcyMS4uY2M1YmIwMzkzYWQwOWVlZTk1YWFhYTRiOTFkZDkxZTdmMWJlOWEzZCAxMDA2 NDQKLS0tIGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2ludGVycHJldGVyL0ludGVycHJldGVyLmNw cAorKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvaW50ZXJwcmV0ZXIvSW50ZXJwcmV0ZXIuY3Bw CkBAIC0yMzUyLDcgKzIzNTIsNyBAQCBKU1ZhbHVlIEludGVycHJldGVyOjpwcml2YXRlRXhlY3V0 ZShFeGVjdXRpb25GbGFnIGZsYWcsIFJlZ2lzdGVyRmlsZSogcmVnaXN0ZXJGaQogICAgICAgICBp bnQgZHN0ID0gdlBDWzFdLnUub3BlcmFuZDsKICAgICAgICAgSlNWYWx1ZSBzcmMxID0gY2FsbEZy YW1lLT5yKHZQQ1syXS51Lm9wZXJhbmQpLmpzVmFsdWUoKTsKICAgICAgICAgSlNWYWx1ZSBzcmMy ID0gY2FsbEZyYW1lLT5yKHZQQ1szXS51Lm9wZXJhbmQpLmpzVmFsdWUoKTsKLSAgICAgICAgaWYg KHNyYzEuaXNJbnQzMigpICYmIHNyYzIuaXNJbnQzMigpICYmICEoc3JjMS5hc0ludDMyKCkgfCAo c3JjMi5hc0ludDMyKCkgJiAweGMwMDAwMDAwKSkpIC8vIG5vIG92ZXJmbG93CisgICAgICAgIGlm IChzcmMxLmlzSW50MzIoKSAmJiBzcmMyLmlzSW50MzIoKSAmJiAhKChzcmMxLmFzSW50MzIoKSB8 IHNyYzIuYXNJbnQzMigpKSAmIDB4YzAwMDAwMDApKSAvLyBubyBvdmVyZmxvdwogICAgICAgICAg ICAgY2FsbEZyYW1lLT51bmNoZWNrZWRSKGRzdCkgPSBqc051bWJlcihzcmMxLmFzSW50MzIoKSAr IHNyYzIuYXNJbnQzMigpKTsKICAgICAgICAgZWxzZSB7CiAgICAgICAgICAgICBKU1ZhbHVlIHJl c3VsdCA9IGpzQWRkKGNhbGxGcmFtZSwgc3JjMSwgc3JjMik7CkBAIC0yMzcxLDcgKzIzNzEsNyBA QCBKU1ZhbHVlIEludGVycHJldGVyOjpwcml2YXRlRXhlY3V0ZShFeGVjdXRpb25GbGFnIGZsYWcs IFJlZ2lzdGVyRmlsZSogcmVnaXN0ZXJGaQogICAgICAgICBpbnQgZHN0ID0gdlBDWzFdLnUub3Bl cmFuZDsKICAgICAgICAgSlNWYWx1ZSBzcmMxID0gY2FsbEZyYW1lLT5yKHZQQ1syXS51Lm9wZXJh bmQpLmpzVmFsdWUoKTsKICAgICAgICAgSlNWYWx1ZSBzcmMyID0gY2FsbEZyYW1lLT5yKHZQQ1sz XS51Lm9wZXJhbmQpLmpzVmFsdWUoKTsKLSAgICAgICAgaWYgKHNyYzEuaXNJbnQzMigpICYmIHNy YzIuaXNJbnQzMigpICYmICEoc3JjMS5hc0ludDMyKCkgfCBzcmMyLmFzSW50MzIoKSA+PiAxNSkp IC8vIG5vIG92ZXJmbG93CisgICAgICAgIGlmIChzcmMxLmlzSW50MzIoKSAmJiBzcmMyLmlzSW50 MzIoKSAmJiAhKHNyYzEuYXNJbnQzMigpIHwgc3JjMi5hc0ludDMyKCkpID4+IDE1KSAvLyBubyBv dmVyZmxvdwogICAgICAgICAgICAgICAgIGNhbGxGcmFtZS0+dW5jaGVja2VkUihkc3QpID0ganNO dW1iZXIoc3JjMS5hc0ludDMyKCkgKiBzcmMyLmFzSW50MzIoKSk7CiAgICAgICAgIGVsc2Ugewog ICAgICAgICAgICAgSlNWYWx1ZSByZXN1bHQgPSBqc051bWJlcihzcmMxLnRvTnVtYmVyKGNhbGxG cmFtZSkgKiBzcmMyLnRvTnVtYmVyKGNhbGxGcmFtZSkpOwpAQCAtMjQzOSw3ICsyNDM5LDcgQEAg SlNWYWx1ZSBJbnRlcnByZXRlcjo6cHJpdmF0ZUV4ZWN1dGUoRXhlY3V0aW9uRmxhZyBmbGFnLCBS ZWdpc3RlckZpbGUqIHJlZ2lzdGVyRmkKICAgICAgICAgaW50IGRzdCA9IHZQQ1sxXS51Lm9wZXJh bmQ7CiAgICAgICAgIEpTVmFsdWUgc3JjMSA9IGNhbGxGcmFtZS0+cih2UENbMl0udS5vcGVyYW5k KS5qc1ZhbHVlKCk7CiAgICAgICAgIEpTVmFsdWUgc3JjMiA9IGNhbGxGcmFtZS0+cih2UENbM10u dS5vcGVyYW5kKS5qc1ZhbHVlKCk7Ci0gICAgICAgIGlmIChzcmMxLmlzSW50MzIoKSAmJiBzcmMy LmlzSW50MzIoKSAmJiAhKHNyYzEuYXNJbnQzMigpIHwgKHNyYzIuYXNJbnQzMigpICYgMHhjMDAw MDAwMCkpKSAvLyBubyBvdmVyZmxvdworICAgICAgICBpZiAoc3JjMS5pc0ludDMyKCkgJiYgc3Jj Mi5pc0ludDMyKCkgJiYgISgoc3JjMS5hc0ludDMyKCkgfCBzcmMyLmFzSW50MzIoKSkgJiAweGMw MDAwMDAwKSkgLy8gbm8gb3ZlcmZsb3cKICAgICAgICAgICAgIGNhbGxGcmFtZS0+dW5jaGVja2Vk Uihkc3QpID0ganNOdW1iZXIoc3JjMS5hc0ludDMyKCkgLSBzcmMyLmFzSW50MzIoKSk7CiAgICAg ICAgIGVsc2UgewogICAgICAgICAgICAgSlNWYWx1ZSByZXN1bHQgPSBqc051bWJlcihzcmMxLnRv TnVtYmVyKGNhbGxGcmFtZSkgLSBzcmMyLnRvTnVtYmVyKGNhbGxGcmFtZSkpOwo=