// https://syzkaller.appspot.com/bug?id=8e166be60b73666a3209315d8ea009fe7575fef5 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef __NR_memfd_create #define __NR_memfd_create 319 #endif #ifndef __NR_move_mount #define __NR_move_mount 429 #endif static unsigned long long procid; static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } //% This code is derived from puff.{c,h}, found in the zlib development. The //% original files come with the following copyright notice: //% Copyright (C) 2002-2013 Mark Adler, all rights reserved //% version 2.3, 21 Jan 2013 //% This software is provided 'as-is', without any express or implied //% warranty. In no event will the author be held liable for any damages //% arising from the use of this software. //% Permission is granted to anyone to use this software for any purpose, //% including commercial applications, and to alter it and redistribute it //% freely, subject to the following restrictions: //% 1. The origin of this software must not be misrepresented; you must not //% claim that you wrote the original software. If you use this software //% in a product, an acknowledgment in the product documentation would be //% appreciated but is not required. //% 2. Altered source versions must be plainly marked as such, and must not be //% misrepresented as being the original software. //% 3. This notice may not be removed or altered from any source distribution. //% Mark Adler madler@alumni.caltech.edu //% BEGIN CODE DERIVED FROM puff.{c,h} #define MAXBITS 15 #define MAXLCODES 286 #define MAXDCODES 30 #define MAXCODES (MAXLCODES + MAXDCODES) #define FIXLCODES 288 struct puff_state { unsigned char* out; unsigned long outlen; unsigned long outcnt; const unsigned char* in; unsigned long inlen; unsigned long incnt; int bitbuf; int bitcnt; jmp_buf env; }; static int puff_bits(struct puff_state* s, int need) { long val = s->bitbuf; while (s->bitcnt < need) { if (s->incnt == s->inlen) longjmp(s->env, 1); val |= (long)(s->in[s->incnt++]) << s->bitcnt; s->bitcnt += 8; } s->bitbuf = (int)(val >> need); s->bitcnt -= need; return (int)(val & ((1L << need) - 1)); } static int puff_stored(struct puff_state* s) { s->bitbuf = 0; s->bitcnt = 0; if (s->incnt + 4 > s->inlen) return 2; unsigned len = s->in[s->incnt++]; len |= s->in[s->incnt++] << 8; if (s->in[s->incnt++] != (~len & 0xff) || s->in[s->incnt++] != ((~len >> 8) & 0xff)) return -2; if (s->incnt + len > s->inlen) return 2; if (s->outcnt + len > s->outlen) return 1; for (; len--; s->outcnt++, s->incnt++) { if (s->in[s->incnt]) s->out[s->outcnt] = s->in[s->incnt]; } return 0; } struct puff_huffman { short* count; short* symbol; }; static int puff_decode(struct puff_state* s, const struct puff_huffman* h) { int first = 0; int index = 0; int bitbuf = s->bitbuf; int left = s->bitcnt; int code = first = index = 0; int len = 1; short* next = h->count + 1; while (1) { while (left--) { code |= bitbuf & 1; bitbuf >>= 1; int count = *next++; if (code - count < first) { s->bitbuf = bitbuf; s->bitcnt = (s->bitcnt - len) & 7; return h->symbol[index + (code - first)]; } index += count; first += count; first <<= 1; code <<= 1; len++; } left = (MAXBITS + 1) - len; if (left == 0) break; if (s->incnt == s->inlen) longjmp(s->env, 1); bitbuf = s->in[s->incnt++]; if (left > 8) left = 8; } return -10; } static int puff_construct(struct puff_huffman* h, const short* length, int n) { int len; for (len = 0; len <= MAXBITS; len++) h->count[len] = 0; int symbol; for (symbol = 0; symbol < n; symbol++) (h->count[length[symbol]])++; if (h->count[0] == n) return 0; int left = 1; for (len = 1; len <= MAXBITS; len++) { left <<= 1; left -= h->count[len]; if (left < 0) return left; } short offs[MAXBITS + 1]; offs[1] = 0; for (len = 1; len < MAXBITS; len++) offs[len + 1] = offs[len] + h->count[len]; for (symbol = 0; symbol < n; symbol++) if (length[symbol] != 0) h->symbol[offs[length[symbol]]++] = symbol; return left; } static int puff_codes(struct puff_state* s, const struct puff_huffman* lencode, const struct puff_huffman* distcode) { static const short lens[29] = {3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31, 35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258}; static const short lext[29] = {0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0}; static const short dists[30] = { 1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193, 257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577}; static const short dext[30] = {0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 13, 13}; int symbol; do { symbol = puff_decode(s, lencode); if (symbol < 0) return symbol; if (symbol < 256) { if (s->outcnt == s->outlen) return 1; if (symbol) s->out[s->outcnt] = symbol; s->outcnt++; } else if (symbol > 256) { symbol -= 257; if (symbol >= 29) return -10; int len = lens[symbol] + puff_bits(s, lext[symbol]); symbol = puff_decode(s, distcode); if (symbol < 0) return symbol; unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]); if (dist > s->outcnt) return -11; if (s->outcnt + len > s->outlen) return 1; while (len--) { if (dist <= s->outcnt && s->out[s->outcnt - dist]) s->out[s->outcnt] = s->out[s->outcnt - dist]; s->outcnt++; } } } while (symbol != 256); return 0; } static int puff_fixed(struct puff_state* s) { static int virgin = 1; static short lencnt[MAXBITS + 1], lensym[FIXLCODES]; static short distcnt[MAXBITS + 1], distsym[MAXDCODES]; static struct puff_huffman lencode, distcode; if (virgin) { lencode.count = lencnt; lencode.symbol = lensym; distcode.count = distcnt; distcode.symbol = distsym; short lengths[FIXLCODES]; int symbol; for (symbol = 0; symbol < 144; symbol++) lengths[symbol] = 8; for (; symbol < 256; symbol++) lengths[symbol] = 9; for (; symbol < 280; symbol++) lengths[symbol] = 7; for (; symbol < FIXLCODES; symbol++) lengths[symbol] = 8; puff_construct(&lencode, lengths, FIXLCODES); for (symbol = 0; symbol < MAXDCODES; symbol++) lengths[symbol] = 5; puff_construct(&distcode, lengths, MAXDCODES); virgin = 0; } return puff_codes(s, &lencode, &distcode); } static int puff_dynamic(struct puff_state* s) { static const short order[19] = {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15}; int nlen = puff_bits(s, 5) + 257; int ndist = puff_bits(s, 5) + 1; int ncode = puff_bits(s, 4) + 4; if (nlen > MAXLCODES || ndist > MAXDCODES) return -3; short lengths[MAXCODES]; int index; for (index = 0; index < ncode; index++) lengths[order[index]] = puff_bits(s, 3); for (; index < 19; index++) lengths[order[index]] = 0; short lencnt[MAXBITS + 1], lensym[MAXLCODES]; struct puff_huffman lencode = {lencnt, lensym}; int err = puff_construct(&lencode, lengths, 19); if (err != 0) return -4; index = 0; while (index < nlen + ndist) { int symbol; int len; symbol = puff_decode(s, &lencode); if (symbol < 0) return symbol; if (symbol < 16) lengths[index++] = symbol; else { len = 0; if (symbol == 16) { if (index == 0) return -5; len = lengths[index - 1]; symbol = 3 + puff_bits(s, 2); } else if (symbol == 17) symbol = 3 + puff_bits(s, 3); else symbol = 11 + puff_bits(s, 7); if (index + symbol > nlen + ndist) return -6; while (symbol--) lengths[index++] = len; } } if (lengths[256] == 0) return -9; err = puff_construct(&lencode, lengths, nlen); if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1])) return -7; short distcnt[MAXBITS + 1], distsym[MAXDCODES]; struct puff_huffman distcode = {distcnt, distsym}; err = puff_construct(&distcode, lengths + nlen, ndist); if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1])) return -8; return puff_codes(s, &lencode, &distcode); } static int puff(unsigned char* dest, unsigned long* destlen, const unsigned char* source, unsigned long sourcelen) { struct puff_state s = { .out = dest, .outlen = *destlen, .outcnt = 0, .in = source, .inlen = sourcelen, .incnt = 0, .bitbuf = 0, .bitcnt = 0, }; int err; if (setjmp(s.env) != 0) err = 2; else { int last; do { last = puff_bits(&s, 1); int type = puff_bits(&s, 2); err = type == 0 ? puff_stored(&s) : (type == 1 ? puff_fixed(&s) : (type == 2 ? puff_dynamic(&s) : -1)); if (err != 0) break; } while (!last); } *destlen = s.outcnt; return err; } //% END CODE DERIVED FROM puff.{c,h} #define ZLIB_HEADER_WIDTH 2 static int puff_zlib_to_file(const unsigned char* source, unsigned long sourcelen, int dest_fd) { if (sourcelen < ZLIB_HEADER_WIDTH) return 0; source += ZLIB_HEADER_WIDTH; sourcelen -= ZLIB_HEADER_WIDTH; const unsigned long max_destlen = 132 << 20; void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0); if (ret == MAP_FAILED) return -1; unsigned char* dest = (unsigned char*)ret; unsigned long destlen = max_destlen; int err = puff(dest, &destlen, source, sourcelen); if (err) { munmap(dest, max_destlen); errno = -err; return -1; } if (write(dest_fd, dest, destlen) != (ssize_t)destlen) { munmap(dest, max_destlen); return -1; } return munmap(dest, max_destlen); } static int setup_loop_device(unsigned char* data, unsigned long size, const char* loopname, int* loopfd_p) { int err = 0, loopfd = -1; int memfd = syscall(__NR_memfd_create, "syzkaller", 0); if (memfd == -1) { err = errno; goto error; } if (puff_zlib_to_file(data, size, memfd)) { err = errno; goto error_close_memfd; } loopfd = open(loopname, O_RDWR); if (loopfd == -1) { err = errno; goto error_close_memfd; } if (ioctl(loopfd, LOOP_SET_FD, memfd)) { if (errno != EBUSY) { err = errno; goto error_close_loop; } ioctl(loopfd, LOOP_CLR_FD, 0); usleep(1000); if (ioctl(loopfd, LOOP_SET_FD, memfd)) { err = errno; goto error_close_loop; } } close(memfd); *loopfd_p = loopfd; return 0; error_close_loop: close(loopfd); error_close_memfd: close(memfd); error: errno = err; return -1; } static void reset_loop_device(const char* loopname) { int loopfd = open(loopname, O_RDWR); if (loopfd == -1) { return; } if (ioctl(loopfd, LOOP_CLR_FD, 0)) { } close(loopfd); } static long syz_mount_image(volatile long fsarg, volatile long dir, volatile long flags, volatile long optsarg, volatile long change_dir, volatile unsigned long size, volatile long image) { unsigned char* data = (unsigned char*)image; int res = -1, err = 0, need_loop_device = !!size; char* mount_opts = (char*)optsarg; char* target = (char*)dir; char* fs = (char*)fsarg; char* source = NULL; char loopname[64]; if (need_loop_device) { int loopfd; memset(loopname, 0, sizeof(loopname)); snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid); if (setup_loop_device(data, size, loopname, &loopfd) == -1) return -1; close(loopfd); source = loopname; } mkdir(target, 0777); char opts[256]; memset(opts, 0, sizeof(opts)); if (strlen(mount_opts) > (sizeof(opts) - 32)) { } strncpy(opts, mount_opts, sizeof(opts) - 32); if (strcmp(fs, "iso9660") == 0) { flags |= MS_RDONLY; } else if (strncmp(fs, "ext", 3) == 0) { bool has_remount_ro = false; char* remount_ro_start = strstr(opts, "errors=remount-ro"); if (remount_ro_start != NULL) { char after = *(remount_ro_start + strlen("errors=remount-ro")); char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1); has_remount_ro = ((before == '\0' || before == ',') && (after == '\0' || after == ',')); } if (strstr(opts, "errors=panic") || !has_remount_ro) strcat(opts, ",errors=continue"); } else if (strcmp(fs, "xfs") == 0) { strcat(opts, ",nouuid"); } res = mount(source, target, fs, flags, opts); if (res == -1) { err = errno; goto error_clear_loop; } res = open(target, O_RDONLY | O_DIRECTORY); if (res == -1) { err = errno; goto error_clear_loop; } if (change_dir) { res = chdir(target); if (res == -1) { err = errno; } } error_clear_loop: if (need_loop_device) reset_loop_device(loopname); errno = err; return res; } #define FS_IOC_SETFLAGS _IOW('f', 2, long) static void remove_dir(const char* dir) { int iter = 0; DIR* dp = 0; const int umount_flags = MNT_FORCE | UMOUNT_NOFOLLOW; retry: while (umount2(dir, umount_flags) == 0) { } dp = opendir(dir); if (dp == NULL) { if (errno == EMFILE) { exit(1); } exit(1); } struct dirent* ep = 0; while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); while (umount2(filename, umount_flags) == 0) { } struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } int i; for (i = 0;; i++) { if (unlink(filename) == 0) break; if (errno == EPERM) { int fd = open(filename, O_RDONLY); if (fd != -1) { long flags = 0; if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) { } close(fd); continue; } } if (errno == EROFS) { break; } if (errno != EBUSY || i > 100) exit(1); if (umount2(filename, umount_flags)) exit(1); } } closedir(dp); for (int i = 0;; i++) { if (rmdir(dir) == 0) break; if (i < 100) { if (errno == EPERM) { int fd = open(dir, O_RDONLY); if (fd != -1) { long flags = 0; if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) { } close(fd); continue; } } if (errno == EROFS) { break; } if (errno == EBUSY) { if (umount2(dir, umount_flags)) exit(1); continue; } if (errno == ENOTEMPTY) { if (iter < 100) { iter++; goto retry; } } } exit(1); } } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void reset_loop() { char buf[64]; snprintf(buf, sizeof(buf), "/dev/loop%llu", procid); int loopfd = open(buf, O_RDWR); if (loopfd != -1) { ioctl(loopfd, LOOP_CLR_FD, 0); close(loopfd); } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); if (symlink("/dev/binderfs", "./binderfs")) { } } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); reset_loop(); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { sleep_ms(10); if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } void execute_one(void) { if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } memcpy((void*)0x20001500, "exfat\000", 6); memcpy((void*)0x20001540, "./file1\000", 8); memcpy((void*)0x20000100, "\x65\x72\x72\x6f\x72\x73\x3d\x63\x6f\x6e\x74\x69\x6e\x75\x65\x2c\x00" "\xa3\xa2\xa4\xe7\x41\x7e\x94\x19\x10\xc2\x7d\x13\x0b\x55\xac\x2d\x5f" "\x7a\x61\xe5\x9e\xc6\xd5\xde\x07\x23\x90\x91\x92\x4c\x32\xee\xb3\x67" "\xd1\x64\x09\xd6\xd3\xec\x1f\xb7\x55\xf9\xa7\x98\x9e\xbc\x4e\x96\x91" "\x8e\x26\x8f\x0b\x7a\xce\xbf\x67\xc0\x7b\xc4\x73\x12\x00\xf8\x7d\x27" "\xb5\xe9\xe6\x10\x00\xe7\x0f\x0c\x6a\x4e\x24\x32\x07\x3d\x0d\x3e\x18" "\xf8\x64\xe9\xef\x64\x63\x7d\x14\xe5\x48\x5f\x36\xe5\x3c\x82\x1c\xb5" "\x89\x86\x85\xc0\x55\xa3\x67\xea\x51\xb6\x53\xef\xf6\x58\x17\x10\xf6" "\xc3\x82\x4b\xc6\x67\xbd\x24\x21\x91\x63\xc6\x08\x03\x09\x9f\x98\x55" "\x67\xbe\x0d\x97\x8e\x30\x1b\x4f\x66\x03\x62\x86\x06\xaf\xad\xb0\x4e" "\xee\x58\xf4\x2f\x18\x53\xf2\xe8\x59\x8a\x5e\x25\x0e\x0f\x4c\x9a", 186); memcpy( (void*)0x20002ac0, "\x78\x9c\xec\xdd\x09\xd8\x8f\xd5\xd6\x30\xf0\xb5\xf6\xde\x37\x0f\x49\xff" "\x24\xf3\x5e\x7b\xdd\xfc\x93\x61\x93\x24\x19\x92\x64\x48\x92\x24\x49\x32" "\x25\x24\x49\x8e\x24\x24\x1e\x32\x25\x21\x09\x99\x93\xcc\x21\x99\x42\x32" "\xcf\x53\xe6\x24\x39\x92\x24\x09\x09\x49\xf6\x77\x3d\x75\xce\x71\xce\xdb" "\xf9\xde\xde\xf3\x9d\xf3\x7e\xde\xf7\x3c\xeb\x77\x5d\xf7\x75\xef\x75\xed" "\x7b\xed\x7b\xef\xff\xe2\x7f\x0f\xd7\x73\x3d\xcf\x37\x1d\x07\x57\xad\x5f" "\xad\x52\x5d\x66\x86\x7f\x0a\xfe\xba\x4b\x05\x80\x14\x00\xe8\x07\x00\xd7" "\x00\x40\x04\x00\xa5\xb2\x95\xca\x96\xd6\x9f\x49\x63\xea\x3f\x77\x12\xf1" "\xaf\xf5\xd0\xb4\x2b\x3d\x03\x71\x25\x49\xfd\xd3\x37\xa9\x7f\xfa\x26\xf5" "\x4f\xdf\xa4\xfe\xe9\x9b\xd4\x3f\x7d\x93\xfa\xa7\x6f\x52\xff\xf4\x4d\xea" "\x2f\x44\x7a\xb6\x6d\x7a\xee\x6b\x65\x4b\xbf\xdb\x3f\xff\xfe\x3f\xe5\xd7" "\x9d\xbc\xff\xff\x5f\x48\xae\xff\xe9\x9b\xd4\xff\xdf\xcd\x99\x4c\xff\xc8" "\xd1\x52\xff\x7f\x27\x97\x42\x08\xff\x58\x86\xd4\x3f\x7d\x93\xfa\xa7\x6f" "\x52\xff\xf4\x4d\xea\x9f\xbe\x49\xfd\xd3\x37\xa9\xbf\x10\xe9\xd9\x95\x7e" "\xff\x2c\xdb\x95\xdd\xae\xf4\xbf\x3f\x21\x84\x10\x42\x08\x21\x84\x10\x42" "\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84" "\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08" "\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10" "\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21" "\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42" "\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84" "\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\xe9\xc3\xf9\x70\x99\x01\x80" "\xb4\x7d\x74\xa5\x27\x25\x84\x10\x42\x08\x21\x84\x10\x42\x88\x7f\xa9\x90" "\xf1\x4a\xcf\x40\x08\x21\x84\x10\x42\x08\x21\x84\x10\xff\xfd\x10\x14\x68" "\x30\x10\x41\x06\xc8\x08\x29\x90\x09\x32\xc3\x55\x90\x05\xae\x86\xac\x70" "\x0d\x24\xe0\x5a\xc8\x06\xd7\x41\x76\xb8\x1e\x72\x40\x4e\xc8\x05\xb9\x21" "\x0f\xe4\x85\x7c\x60\x81\xc0\x01\x43\x0c\xf9\xa1\x00\x24\xe1\x06\x28\x08" "\x37\x42\x21\x28\x0c\x45\xa0\x28\x78\x28\x06\xc5\xe1\x26\x28\x01\x37\x43" "\x49\xb8\x05\x4a\xc1\xad\x50\x1a\x6e\x83\x32\x50\x16\xca\x41\x79\xb8\x1d" "\x2a\xc0\x1d\x50\x11\xee\x84\x4a\x70\x17\x54\x86\x2a\x50\x15\xaa\xc1\xdd" "\x50\x1d\xee\x81\x1a\x70\x2f\xd4\x84\xfb\xa0\x16\xdc\x0f\xb5\xe1\x01\xa8" "\x03\x0f\x42\x5d\x78\x08\xea\xc1\xc3\x50\x1f\x1e\x81\x06\xf0\x28\x34\x84" "\x46\xd0\x18\x9a\x40\xd3\xff\xa7\xfc\x17\xa0\x2b\xbc\x08\xdd\xa0\x3b\xa4" "\x42\x0f\xe8\x09\x2f\x41\x2f\xe8\x0d\x7d\xa0\x2f\xf4\x83\x97\xa1\x3f\xbc" "\x02\x03\xe0\x55\x18\x08\x83\x60\x30\xbc\x06\x43\xe0\x75\x18\x0a\x6f\xc0" "\x30\x18\x0e\x23\xe0\x4d\x18\x09\xa3\x60\x34\x8c\x81\xb1\x30\x0e\xc6\xc3" "\x5b\x30\x01\xde\x86\x89\xf0\x0e\x4c\x82\xc9\x30\x05\xa6\xc2\x34\x98\x0e" "\x33\xe0\x5d\x98\x09\xb3\x60\x36\xbc\x07\x73\xe0\x7d\x98\x0b\xf3\x60\x3e" "\x2c\x80\x85\xf0\x01\x2c\x82\xc5\xb0\x04\x3e\x84\xa5\xf0\x11\x2c\x83\xe5" "\xb0\x02\x56\xc2\x2a\x58\x0d\x6b\x60\x2d\xac\x83\xf5\xb0\x01\x36\xc2\x26" "\xd8\x0c\x5b\x60\x2b\x6c\x83\x8f\x61\x3b\xec\x80\x9d\xb0\x0b\x76\xc3\x1e" "\xd8\x0b\x9f\xc0\x3e\xf8\x14\xf6\xc3\x67\x70\x00\x3e\xff\x07\xf3\xcf\xfd" "\x87\xfc\x4e\x08\x08\xa8\x50\xa1\x41\x83\x19\x30\x03\xa6\x60\x0a\x66\xc6" "\xcc\x98\x05\xb3\x60\x56\xcc\x8a\x09\x4c\x60\x36\xcc\x86\xd9\x31\x3b\xe6" "\xc0\x1c\x98\x0b\x73\x61\x1e\xcc\x83\xf9\x30\x1f\x12\x12\x32\x32\xe6\xc7" "\xfc\x98\xc4\x24\x16\xc4\x82\x58\x08\x0b\x61\x11\x2c\x82\x1e\x3d\x16\xc7" "\xe2\x58\x02\x6f\xc6\x92\x58\x12\x4b\x61\x29\x2c\x8d\xa5\xb1\x0c\x96\xc5" "\xb2\x58\x1e\xcb\x63\x05\xac\x80\x15\xb1\x22\x56\xc2\x4a\x58\x19\x2b\x63" "\x55\xac\x8a\x77\xe3\xdd\x78\x0f\xd6\xc0\x1a\x58\x13\x6b\x62\x2d\xac\x85" "\xb5\xb1\x36\xd6\xc1\x3a\x58\x17\xeb\x62\x3d\xac\x87\xf5\xb1\x3e\x36\xc0" "\x06\xd8\x10\x1b\x62\x63\x6c\x8c\x4d\xb1\x29\x36\xc3\x66\xd8\x1c\x9b\x63" "\x4b\x6c\x89\xad\xb0\x15\xb6\xc6\xd6\xd8\x06\xdb\x60\x5b\x6c\x8b\xed\xb0" "\x1d\xb6\xc7\xf6\xd8\x01\x3b\x60\x47\xec\x88\x9d\xb0\x33\x76\xc6\x17\xf0" "\x05\x7c\x11\x5f\xc4\xee\x58\x59\xf5\xc0\x9e\xd8\x13\x7b\x61\x2f\xec\x83" "\x7d\xb1\x2f\xbe\x8c\xfd\xf1\x15\x7c\x05\x5f\xc5\x81\x38\x08\x07\xe3\x6b" "\xf8\x1a\xbe\x8e\x43\xf1\x2c\x0e\xc3\xe1\x38\x02\x47\x60\x05\x35\x0a\x47" "\xe3\x18\x64\x35\x0e\xc7\xe3\x78\x9c\x80\x13\x70\x22\x4e\xc4\x49\x38\x19" "\x27\xe3\x54\x9c\x86\xd3\x71\x06\xce\xc0\x99\x38\x0b\x67\xe1\x7b\x38\x07" "\xdf\xc7\xf7\x71\x1e\xce\xc3\x05\xb8\x10\x17\xe2\x22\x5c\x8c\x4b\x70\x09" "\x2e\xc5\x73\xb8\x0c\x97\xe3\x0a\x5c\x89\xab\x70\x35\xae\xc2\xb5\xb8\x0e" "\xd7\xe2\x06\xdc\x88\x1b\x70\x33\x6e\xc6\xad\xb8\x15\x3f\xc6\x8f\x71\x07" "\xee\xc0\x5d\xb8\x0b\xf7\xe0\x1e\xfc\x04\x3f\xc1\x4f\xf1\x53\x1c\x88\x07" "\xf0\x00\x1e\xc4\x83\x78\x08\x0f\xe1\x61\x3c\x8c\x47\xf0\x08\x1e\xc5\xa3" "\x78\x0c\x8f\xe1\x71\x3c\x8e\x27\xf0\x04\x9e\xc4\x53\x78\x1a\x4f\xe1\x19" "\x3c\x83\x67\xf1\x1c\x9e\xc7\xf3\x78\x01\x2f\xe0\x45\xbc\x88\x97\xf0\x52" "\xda\x7f\x7e\x95\xc6\x28\xa3\x32\xa8\x0c\x2a\x45\xa5\xa8\xcc\x2a\xb3\xca" "\xa2\xb2\xa8\xac\x2a\xab\x4a\xa8\x84\xca\xa6\xb2\xa9\xec\x2a\xbb\xca\xa1" "\x72\xa8\x5c\x2a\x97\xca\xa3\xf2\xa8\x7c\x2a\x9f\x22\x45\x8a\x55\xac\xf2" "\xab\xfc\x2a\xa9\x92\xaa\xa0\x2a\xa8\x0a\xa9\x42\xaa\x88\x2a\xa2\xbc\xf2" "\xaa\xb8\x2a\xae\x4a\xa8\x12\xaa\xa4\x2a\xa9\x4a\xa9\x5b\x55\x69\x75\x9b" "\x2a\xa3\xca\xaa\x16\xbe\xbc\x2a\xaf\x2a\xa8\x96\xbe\xa2\xba\x53\x55\x52" "\x95\x54\x65\x55\x45\x55\x55\xd5\x54\x35\x55\x5d\x55\x57\x35\x54\x0d\x55" "\x53\xd5\x54\xb5\x54\x2d\x55\x5b\x3d\xa0\xea\xa8\x1e\xd8\x07\x1f\x52\x69" "\x95\xa9\xaf\x06\x61\x03\x35\x18\x1b\xaa\x46\xaa\xb1\x6a\xa2\x5e\xc7\xc7" "\x54\x33\x35\x14\x9b\xab\x16\xaa\xa5\x7a\x42\x0d\xc7\x61\xd8\x5a\x35\xf3" "\x6d\xd4\xd3\xaa\xad\x1a\x8d\xed\xd4\x1f\xd4\x18\x7c\x56\x75\x50\xe3\xb0" "\xa3\x7a\x5e\x75\x52\x9d\x55\x17\xf5\x82\xea\xaa\x9a\xfb\x6e\xaa\xbb\x9a" "\x84\x3d\x54\x4f\x35\x15\x7b\xa9\xde\xaa\x8f\xea\xab\x66\x62\x15\x95\x56" "\xb1\xaa\xea\x55\x35\x50\x0d\x52\x83\xd5\x6b\x6a\x01\xbe\xae\x86\xaa\x37" "\xd4\x30\x35\x5c\x8d\x50\x6f\xaa\x91\x6a\x94\x1a\xad\xc6\xa8\xb1\x6a\x9c" "\x1a\xaf\xde\x52\x13\xd4\xdb\x6a\xa2\x7a\x47\x4d\x52\x93\xd5\x14\x35\x55" "\x4d\x53\xd3\xd5\x8c\xb4\xaf\x56\x35\x4b\xcd\x56\xef\xa9\x39\xea\x7d\x35" "\x57\xcd\x53\xf3\xd5\x02\xb5\x50\x7d\xa0\x16\xa9\xc5\x6a\x89\xfa\x50\x2d" "\x55\x1f\xa9\x65\x6a\xb9\x5a\xa1\x56\xaa\x55\x6a\xb5\x5a\xa3\xd6\xaa\x75" "\x6a\xbd\xda\xa0\x36\xaa\x4d\x11\xa8\x2d\x6a\xab\xda\xa6\x3e\x56\xdb\xd5" "\x0e\xb5\x53\xed\x52\xbb\xd5\x1e\xb5\x57\x7d\xa2\xf6\xa9\x4f\xd5\x7e\xf5" "\x99\x3a\xa0\x3e\x57\x07\xd5\x1f\xd5\x21\xf5\x85\x3a\xac\xbe\x54\x47\xd4" "\x57\xea\xa8\xfa\x5a\x1d\x53\xdf\xa8\xe3\xea\x5b\x75\x42\x7d\xa7\x4e\xaa" "\x53\xea\xb4\xfa\x5e\x9d\x51\x3f\xa8\xb3\xea\x9c\x3a\xaf\x7e\x54\x17\xd4" "\x4f\xea\xa2\xfa\x59\x5d\x52\x41\x81\x46\xad\xb4\xd6\x46\x47\x3a\x83\xce" "\xa8\x53\x74\x26\x9d\x59\x5f\xa5\xb3\xe8\xab\x75\x56\x7d\x8d\x4e\xe8\x6b" "\x75\x36\x7d\x9d\xce\xae\xaf\xd7\x39\x74\x4e\x9d\x4b\xe7\xd6\x79\x74\x5e" "\x9d\x4f\x5b\x4d\xda\x69\xd6\xb1\xce\xaf\x0b\xe8\xa4\xbe\x41\x17\xd4\x37" "\xea\x42\xba\xb0\x2e\xa2\x8b\x6a\xaf\x8b\xe9\xe2\xfa\x26\x5d\x42\xdf\xac" "\x4b\xea\x5b\x74\x29\x7d\xab\x2e\xad\x6f\xd3\x65\x74\x59\x5d\x4e\x97\xd7" "\xb7\xeb\x0a\xfa\x0e\x5d\x51\xdf\xa9\x2b\xe9\xbb\x74\x65\x5d\x45\x57\xd5" "\xd5\xf4\xdd\xba\xba\xbe\x47\xd7\xd0\xf7\xea\x9a\xfa\x3e\x5d\x4b\xdf\xaf" "\x6b\xeb\x07\x74\x1d\xfd\xa0\xae\xab\x1f\xd2\xf5\xf4\xc3\xba\xbe\x7e\x44" "\x37\xd0\x8f\xea\x86\xba\x91\x6e\xac\x9b\xe8\xa6\xfa\x31\xdd\x4c\x3f\xae" "\x9b\xeb\x16\xba\xa5\x7e\x42\xb7\xd2\x4f\xea\xd6\xfa\x29\xdd\x46\x3f\xad" "\xdb\xea\x67\x74\x3b\xfd\x07\xdd\x5e\x3f\xab\x3b\xe8\xe7\x74\x47\xfd\xbc" "\xee\xa4\x3b\xeb\x2e\xfa\x67\x7d\x49\x07\xdd\x4d\x77\xd7\xa9\xba\x87\xee" "\xa9\x5f\xd2\xbd\x74\x6f\xdd\x47\xf7\xd5\xfd\xf4\xcb\xba\xbf\x7e\x45\x0f" "\xd0\xaf\xea\x81\x7a\x90\x1e\xac\x5f\xd3\x43\xf4\xeb\x7a\xa8\x7e\x43\x0f" "\xd3\xc3\xf5\x08\xfd\xa6\x1e\xa9\x47\xe9\xd1\x7a\x8c\x1e\xab\xc7\xe9\xf1" "\xfa\x2d\x3d\x41\xbf\xad\x27\xea\x77\xf4\x24\x3d\x59\x4f\xd1\x53\xf5\x34" "\x3d\x5d\xf7\xf9\xd3\x48\xb3\xff\x0b\xf9\x6f\xff\x9d\xfc\x01\xbf\x9c\x7d" "\xab\xde\xa6\x3f\xd6\xdb\xf5\x0e\xbd\x53\xef\xd2\xbb\xf5\x1e\xbd\x57\xef" "\xd5\xfb\xf4\x3e\xbd\x5f\xef\xd7\x07\xf4\x01\x7d\x50\x1f\xd4\x87\xf4\x21" "\x7d\x58\x1f\xd6\x47\xf4\x11\x7d\x54\x1f\xd5\xc7\xf4\x31\x7d\x5c\x1f\xd7" "\x27\xf4\x09\x7d\x52\x9f\xd2\x3f\xea\xef\xf5\x19\xfd\x83\x3e\xab\xcf\xe9" "\x73\xfa\x47\x7d\x41\x5f\xd0\x17\xff\xf4\x19\x80\x41\xa3\x8c\x36\xc6\x44" "\x26\x83\xc9\x68\x52\x4c\x26\x93\xd9\x5c\x65\xb2\x98\xab\x4d\x56\x73\x8d" "\x49\x98\x6b\x4d\x36\x73\x9d\xc9\x6e\xae\x37\x39\x4c\x4e\x93\xcb\xe4\x36" "\x79\x4c\x5e\x93\xcf\x58\x43\xc6\x19\x36\xb1\xc9\x6f\x0a\x98\xa4\xb9\xc1" "\x14\x34\x37\x9a\x42\xa6\xb0\x29\x62\x8a\x1a\x6f\x8a\x99\xe2\xe6\xa6\x7f" "\x3a\xff\xf7\xe6\xd7\xd4\x34\x35\xcd\x4c\x33\xd3\xdc\x34\x37\x2d\x4d\x4b" "\xd3\xca\xb4\x32\xad\x4d\x6b\xd3\xc6\xb4\x31\x6d\x4d\x5b\xd3\xce\xb4\x33" "\xed\x4d\x7b\xd3\xc1\x74\x30\x1d\x4d\x47\xd3\xc9\x74\x32\x5d\x4c\x17\xd3" "\xd5\x74\x35\x01\x00\x52\x4d\xaa\xe9\x69\x5e\x32\xbd\x4c\x6f\xd3\xc7\xf4" "\x35\xfd\xcc\xcb\xa6\xbf\xe9\x6f\x06\x98\x01\x66\xa0\x19\x68\x06\x9b\xc1" "\x66\x88\x19\x62\x86\x9a\xa1\x66\x98\x19\x66\x46\x98\x11\x66\xa4\x19\x69" "\x46\x9b\xd1\x66\xac\x19\x6b\xc6\x9b\xf1\x66\x82\x99\x60\x26\x9a\x89\x66" "\x92\x99\x64\xa6\x98\x29\x66\x9a\x99\x66\x66\x98\x19\x66\xa6\x99\x69\x66" "\x9b\xd9\x66\x8e\x99\x63\xe6\x9a\xb9\x66\xbe\x99\x6f\x16\x9a\x85\x66\x91" "\x59\x64\x96\x98\x25\x66\xa9\x59\x6a\x96\x99\xe5\x66\xb9\x59\x69\x56\x9a" "\xd5\x66\xb5\x59\x6b\xd6\x9a\xf5\x66\xbd\xd9\x68\x36\x9a\xcd\x66\xb3\x59" "\x66\xfe\xfc\x03\x9a\x3b\xcd\x4e\xb3\xdb\xec\x36\x7b\xcd\x5e\xb3\xcf\xec" "\x33\xfb\xcd\x7e\x73\xc0\x1c\x30\x07\xcd\x41\x73\xc8\x1c\x32\x87\xcd\x61" "\x73\xc4\x1c\x31\x47\xcd\x51\x73\xcc\x1c\x33\xc7\xcd\x71\x73\xc2\x9c\x30" "\x27\xcd\x49\x73\xda\x9c\x36\x67\xcc\x19\x73\xd6\x9c\x35\xe7\xcd\x79\x73" "\xc1\x5c\x30\x17\xcd\x45\x73\xc9\x5c\x4a\xbb\xed\x8b\x54\xa4\x22\x13\x99" "\x28\x43\x94\x21\x4a\x89\x52\xa2\xcc\x51\xe6\x28\x4b\x94\x25\xca\x1a\x65" "\x8d\x12\x51\x22\xca\x16\x65\x8b\xb2\x47\xd7\x47\x39\xa2\x9c\x51\xae\x28" "\x77\x94\x27\xca\x1b\xe5\x8b\x6c\x44\x91\x8b\x38\x8a\xa3\xfc\x51\x81\x28" "\x19\xdd\x10\x15\x8c\x6e\x8c\x0a\x45\x85\xa3\x22\x51\xd1\xc8\x47\xc5\xa2" "\xe2\xd1\x4d\x51\x89\xe8\xe6\xa8\x64\x74\x4b\x54\x2a\xba\x35\x2a\x1d\xdd" "\x16\x95\x89\xca\x46\xe5\xa2\xf2\xd1\xed\x51\x85\xe8\x8e\xa8\x62\x74\x67" "\x54\x29\xba\x2b\xaa\x1c\x55\x89\xaa\x46\xd5\xa2\xbb\xa3\xea\xd1\x3d\x51" "\x8d\xe8\xde\xa8\x66\x74\x5f\x54\x2b\xba\x3f\xaa\x1d\x3d\x10\xd5\x89\x1e" "\x8c\xea\x46\x0f\x45\xf5\xa2\x87\xa3\xfa\xd1\x23\x51\x83\xe8\xd1\xa8\x61" "\xd4\x28\x6a\x1c\x35\x89\x9a\xfe\x4b\xc7\x0f\xe1\x6c\xce\xc7\x7d\x37\xdb" "\xdd\xa6\xda\x1e\xb6\xa7\x7d\xc9\xf6\xb2\xbd\x6d\x1f\xdb\xd7\xf6\xb3\x2f" "\xdb\xfe\xf6\x15\x3b\xc0\xbe\x6a\x07\xda\x41\x76\xb0\x7d\xcd\x0e\xb1\xaf" "\xdb\xa1\xf6\x0d\x3b\xcc\x0e\xb7\x23\xec\x9b\x76\xa4\x1d\x65\x47\xdb\x31" "\x76\xac\x1d\x67\xc7\xdb\xb7\xec\x04\xfb\xb6\x9d\x68\xdf\xb1\x93\xec\x64" "\x3b\xc5\x4e\xb5\xd3\xec\x74\x3b\xc3\xbe\x6b\x67\xda\x59\x76\xb6\x7d\xcf" "\xce\xb1\xef\xdb\xb9\x76\x9e\x9d\x6f\x17\xd8\x85\xf6\x03\xbb\xc8\x2e\xb6" "\x4b\xec\x87\x76\xa9\xfd\xc8\x2e\xb3\xcb\xed\x0a\xbb\xd2\xae\xb2\xab\xed" "\x1a\xbb\xd6\xae\xb3\xeb\xed\x06\xbb\xd1\x6e\xb2\x9b\xed\x16\xbb\xd5\x6e" "\xb3\x1f\xdb\xed\x76\x87\xdd\x69\x77\xd9\xdd\x76\x8f\xdd\x6b\x3f\xb1\xfb" "\xec\xa7\x76\xbf\xfd\xcc\x1e\xb0\x9f\xdb\x83\xf6\x8f\xf6\x90\xfd\xc2\x1e" "\xb6\x5f\xda\x23\xf6\x2b\x7b\xd4\x7e\x6d\x8f\xd9\x6f\xec\x71\xfb\xad\x3d" "\x61\xbf\xb3\x27\xed\x29\x7b\xda\x7e\x6f\xcf\xd8\x1f\xec\x59\x7b\xce\x9e" "\xb7\x3f\xda\x0b\xf6\x27\x7b\xd1\xfe\x6c\x2f\xd9\x90\x76\x73\x9f\x76\x79" "\x27\x43\x86\x32\x50\x06\x4a\xa1\x14\xca\x4c\x99\x29\x0b\x65\xa1\xac\x94" "\x95\x12\x94\xa0\x6c\x94\x8d\xb2\x53\x76\xca\x41\x39\x28\x17\xe5\xa2\x3c" "\x94\x87\xf2\x51\x3e\x4a\xc3\xc4\x94\x9f\xf2\x53\x92\x92\x54\x90\x0a\x52" "\x21\x2a\x44\x45\xa8\x08\x79\xf2\x54\x9c\x8a\x53\x09\x2a\x41\x25\xa9\x24" "\x95\xa2\x52\x54\x9a\x4a\x53\x19\x2a\x43\xe5\x28\xed\xa2\x79\x3b\xdd\x41" "\x77\xd0\x9d\x74\x27\xdd\x45\x77\x51\x15\xaa\x42\xd5\xa8\x1a\x55\xa7\xea" "\x54\x83\x6a\x50\x4d\xaa\x49\xb5\xa8\x16\xd5\xa6\xda\x54\x87\xea\x50\x5d" "\xaa\x4b\xf5\xa8\x1e\xd5\xa7\xfa\xd4\x80\x1a\x50\x43\x6a\x48\x8d\xa9\x31" "\x35\xa5\xa6\xd4\x8c\x9a\x51\x73\x6a\x4e\x2d\xa9\x25\xb5\xa2\x56\xd4\x9a" "\x5a\x53\x1b\x6a\x43\x6d\xa9\x2d\xb5\xa3\x76\xd4\x9e\xda\x53\x07\xea\x40" "\x1d\xa9\x23\x75\xa2\x4e\xd4\x85\xba\x50\x57\xea\x4a\xdd\xa8\x1b\xa5\x52" "\x2a\xf5\xa4\x9e\xd4\x8b\x7a\x51\x1f\xea\x43\xfd\xa8\x1f\xf5\xa7\xfe\x34" "\x80\x06\xd0\x40\x1a\x48\x83\x69\x30\x0d\xa1\x21\x34\x94\x86\xd2\x30\x1a" "\x4e\x23\xe8\x4d\x1a\x49\xa3\x68\x34\x8d\xa1\xb1\x34\x8e\xc6\xd3\x78\x9a" "\x40\x13\x68\x22\x4d\xa4\x49\x34\x89\xa6\xd0\x14\x9a\x46\xd3\x68\x06\xcd" "\xa0\x99\x34\x93\x66\xd3\x6c\x9a\x43\x73\x68\x2e\xcd\xa5\xf9\x34\x9f\x16" "\xd2\x42\x5a\x44\x8b\x68\x09\x2d\xa1\xa5\xb4\x94\x96\xd1\x32\x5a\x41\x2b" "\x68\x15\xad\xa2\x35\xb4\x86\xd6\xd1\x3a\xda\x40\x1b\x68\x13\x6d\xa2\x2d" "\xb4\x85\xb6\xd1\x36\xda\x4e\xdb\x69\x27\xed\xa4\xdd\xb4\x9b\xf6\xd2\x5e" "\xda\x47\xfb\x68\x3f\xed\xa7\x03\x74\x80\x0e\xd2\x41\x3a\x44\x87\xe8\x30" "\x1d\xa6\x23\x74\x84\x8e\xd2\x51\x3a\x46\xc7\xe8\x38\x1d\xa7\x13\x74\x82" "\x4e\xd2\x49\x3c\x4d\xa7\xe9\x0c\x9d\xa1\xb3\x74\x96\xce\xd3\x79\xba\x40" "\x3f\xd1\x45\xfa\x99\x2e\x51\xa0\x14\x97\xc9\x65\x76\x57\xb9\x2c\xee\x6a" "\x97\xd5\x5d\xe3\x52\x5c\xa6\xee\x00\xf0\x97\x38\x97\xcb\xed\xf2\xb8\xbc" "\x2e\x9f\xb3\x2e\x87\xcb\xf9\x37\x31\x39\xe7\x0a\xb9\xc2\xae\x88\x2b\xea" "\xbc\x2b\xe6\x8a\xbb\x9b\x7e\x13\x97\xe9\x51\xd6\x95\x73\xe5\xdd\xed\xae" "\x82\xbb\xc3\x55\x74\x65\xdc\xdf\xc6\xd5\xdd\x3d\xae\x86\xbb\xd7\xd5\x74" "\xf7\xb9\x6a\xee\xee\xbf\x89\x6b\xb9\xfb\x5d\x6d\xf7\x88\xab\xe3\x1e\x75" "\x75\x5d\x23\x57\xcf\x35\x71\xf5\xdd\x23\xae\x81\x7b\xd4\x35\x74\x8d\x5c" "\x63\xd7\xc4\xb5\x72\x4f\xba\xd6\xee\x29\xd7\xc6\x3d\xed\xda\xba\x67\x7e" "\x13\x2f\x72\x8b\xdd\x3a\xb7\xde\x6d\x70\x1b\xdd\x3e\xf7\xa9\x3b\xef\x7e" "\x74\xc7\xdc\x37\xee\x82\xfb\xc9\x75\x73\xdd\x5d\x3f\xf7\xb2\xeb\xef\x5e" "\x71\x03\xdc\xab\x6e\xa0\x1b\xf4\x9b\x78\x84\x7b\xd3\x8d\x74\xa3\xdc\x68" "\x37\xc6\x8d\x75\xe3\x7e\x13\x4f\x71\x53\xdd\x34\x37\xdd\xcd\x70\xef\xba" "\x99\x6e\xd6\x6f\xe2\x85\xee\x03\x37\xc7\x2d\x71\x73\xdd\x3c\x37\xdf\x2d" "\xf8\x25\x4e\x9b\xd3\x12\xf7\xa1\x5b\xea\x3e\x72\xcb\xdc\x72\xb7\xc2\xad" "\x74\xab\xdc\x6a\xb7\xc6\xad\xfd\xcb\x5c\x57\xba\xcd\x6e\x8b\xdb\xea\xf6" "\xba\x4f\xdc\x76\xb7\xc3\xed\x74\xbb\xdc\x6e\xb7\xe7\x97\x38\x6d\x1d\xfb" "\xdd\x67\xee\x80\xfb\xdc\x1d\x75\x5f\xbb\x43\xee\x0b\x77\xd8\x1d\x77\x47" "\xdc\x57\xbf\xc4\x69\xeb\x3b\xee\xbe\x75\x27\xdc\x77\xee\xa4\x3b\xe5\x4e" "\xbb\xef\xdd\x19\xf7\x83\x3b\xeb\xce\xfd\xb2\xfe\xb4\xb5\x7f\xef\x7e\x76" "\x97\x5c\x70\xc0\xc8\x8a\x35\x1b\x8e\x38\x03\x67\xe4\x14\xce\xc4\x99\xf9" "\x2a\xce\xc2\x57\x73\x56\xbe\x86\x13\x7c\x2d\x67\xe3\xeb\x38\x3b\x5f\xcf" "\x39\x38\x27\xe7\xe2\xdc\x9c\x87\xf3\x72\x3e\xb6\x4c\xec\x98\x39\xe6\xfc" "\x5c\x80\x93\x7c\x03\x17\xe4\x1b\xb9\x10\x17\xe6\x22\x5c\x94\x3d\x17\xe3" "\xe2\x7c\x13\x97\xe0\x9b\xb9\x24\xdf\xc2\xa5\xf8\x56\x2e\xcd\xb7\x71\x19" "\x2e\xcb\xe5\xb8\x3c\xdf\xce\x15\xf8\x0e\xae\xc8\x77\x72\x25\xbe\x8b\x2b" "\x73\x15\xae\xca\xd5\xf8\x6e\xae\xce\xf7\x70\x0d\xbe\x97\x6b\xf2\x7d\x5c" "\x8b\xef\xe7\xda\xfc\x00\xd7\xe1\x07\xb9\x2e\x3f\xc4\xf5\xf8\x61\xae\xcf" "\x8f\x70\x03\x7e\x94\x1b\x72\x23\x6e\xcc\x4d\xb8\x29\x3f\xc6\xcd\xf8\x71" "\x6e\xce\x2d\xb8\x25\x3f\xc1\xad\xf8\x49\x6e\xcd\x4f\x71\x1b\x7e\x9a\xdb" "\xf2\x33\xdc\x8e\xff\xc0\xed\xf9\x59\xee\xc0\xcf\x71\x47\x7e\x9e\x3b\x71" "\x67\xee\xc2\x2f\x70\x57\x7e\x91\xbb\x71\x77\x4e\xe5\x1e\xdc\x93\x5f\xe2" "\x5e\xdc\x9b\xfb\x70\x5f\xee\xc7\x2f\x73\x7f\x7e\x85\x07\xf0\xab\x3c\x90" "\x07\xf1\x60\x7e\x8d\x87\xf0\xeb\x3c\x94\xdf\xe0\x61\x3c\x9c\x47\xf0\x9b" "\x3c\x92\x47\xf1\x68\x1e\xc3\x63\x79\x1c\x8f\xe7\xb7\x78\x02\xbf\xcd\x13" "\xf9\x1d\x9e\xc4\x93\x79\x0a\x4f\xe5\x69\x3c\x9d\x67\xf0\xbb\x3c\x93\x67" "\xf1\x6c\x7e\x8f\xe7\xf0\xfb\x3c\x97\xe7\xf1\x7c\x5e\xc0\x0b\xf9\x03\x5e" "\xc4\x8b\x79\x09\x7f\xc8\x4b\xf9\x23\x5e\xc6\xcb\x79\x05\xaf\xe4\x55\xbc" "\x9a\xd7\xf0\x5a\x5e\xc7\xeb\x79\x03\x6f\xe4\x4d\xbc\x99\xb7\xf0\x56\xde" "\xc6\x1f\xf3\x76\xde\xc1\x3b\x79\x17\xef\xe6\x3d\xbc\x97\x3f\xe1\x7d\xfc" "\x29\xef\xe7\xcf\xf8\x00\x7f\xce\x07\xf9\x8f\x7c\x88\xbf\xe0\xc3\xfc\x25" "\x1f\xe1\xaf\xf8\x28\x7f\xcd\xc7\xf8\x1b\x3e\xce\xdf\xf2\x09\xfe\x8e\x4f" "\xf2\x29\x3e\xcd\xdf\xf3\x19\xfe\x81\xcf\xf2\x39\x3e\xcf\x3f\xf2\x05\xfe" "\x89\x2f\xf2\xcf\x7c\x89\x03\x43\x8c\xb1\x8a\x75\x6c\xe2\x28\xce\x10\x67" "\x8c\x53\xe2\x4c\x71\xe6\xf8\xaa\x38\x4b\x7c\x75\x9c\x35\xbe\x26\x4e\xc4" "\xd7\xc6\xd9\xe2\xeb\xe2\xec\xf1\xf5\x71\x8e\x38\x67\x9c\x2b\xce\x1d\xe7" "\x89\xf3\xc6\xf9\x62\x1b\x53\xec\x62\x8e\xe3\x38\x7f\x5c\x20\x4e\xc6\x37" "\xc4\x05\xe3\x1b\xe3\x42\x71\xe1\xb8\x48\x5c\x34\xf6\x71\xb1\xb8\x78\x7c" "\x53\x5c\x22\xbe\x39\x2e\x19\xdf\x12\x97\x8a\x6f\x8d\x4b\xc7\xb7\xc5\x65" "\xe2\xb2\x71\xb9\xb8\x7c\x7c\x7b\x5c\x21\xbe\x23\xae\x18\xdf\x19\x57\x8a" "\xef\x8a\x2b\xc7\x55\xe2\xaa\x71\xb5\xf8\xee\xb8\x7a\x7c\x4f\x5c\x23\xbe" "\x37\xae\x19\xdf\x17\x97\x8c\xef\x8f\x6b\xc7\x0f\xc4\x75\xe2\x07\xe3\xba" "\xf1\x43\x71\xbd\xf8\xe1\xb8\x7e\xfc\x48\xdc\x20\x7e\x34\x6e\x18\x37\x8a" "\x1b\xc7\x4d\xe2\xa6\xf1\x63\x71\xb3\xf8\xf1\xb8\x79\xdc\x22\x6e\x19\x3f" "\x11\xb7\x8a\x9f\x8c\x5b\xc7\x4f\xc5\x6d\xe2\xa7\xe3\xb6\xf1\x33\xbf\xdb" "\x9f\x1a\xf7\x88\x7b\xc6\x2f\xc5\x2f\xc5\x21\xdc\xab\xe7\x27\x17\x24\x17" "\x26\x3f\x48\x2e\x4a\x2e\x4e\x2e\x49\x7e\x98\x5c\x9a\xfc\x28\xb9\x2c\xb9" "\x3c\xb9\x22\xb9\x32\xb9\x2a\xb9\x3a\xb9\x26\xb9\x36\xb9\x2e\xb9\x3e\xb9" "\x21\xb9\x31\xb9\x29\xb9\x39\xb9\x25\xb9\x35\x19\x42\xb5\x8c\xe0\xd1\x2b" "\xaf\xbd\xf1\x91\xcf\xe0\x33\xfa\x14\x9f\xc9\x67\xf6\x57\xf9\x2c\xfe\x6a" "\x9f\xd5\x5f\xe3\x13\xfe\x5a\x9f\xcd\x5f\xe7\xb3\xfb\xeb\x7d\x0e\x9f\xd3" "\xe7\xf2\xb9\x7d\x1e\x9f\xd7\xe7\xf3\xd6\x93\x77\x9e\x7d\xec\xf3\xfb\x02" "\x3e\xe9\x6f\xf0\x05\xfd\x8d\xbe\x90\x2f\xec\x8b\xf8\xa2\xde\xfb\x62\xbe" "\xb8\x6f\xe2\x9b\xfa\xa6\xbe\x99\x7f\xdc\x37\xf7\x2d\x7c\x4b\xff\x84\x7f" "\xc2\x3f\xe9\x9f\xf4\x4f\xf9\xa7\xfc\xd3\xbe\xad\x7f\xc6\xb7\xf3\x90\x68" "\xef\x9f\xf5\x1d\xfc\x73\xfe\x39\xff\xbc\xef\xe4\x3b\xfb\x2e\xfe\x05\xdf" "\xd5\xbf\xe8\xbb\xf9\xee\x3e\xd5\xa7\xfa\x9e\xbe\xa7\xef\xe5\x7b\xf9\x3e" "\xbe\x8f\xef\xe7\xfb\xf9\xfe\xbe\xbf\x1f\xe0\x07\xf8\x81\x7e\xa0\x1f\xec" "\x07\xfb\x21\x7e\x88\x1f\xea\x87\xfa\x61\x7e\x98\x1f\xe1\x47\xf8\x91\x7e" "\xa4\x1f\xed\x47\xfb\xb1\x7e\xac\x1f\xef\xc7\xfb\x09\x7e\x82\x9f\xe8\x27" "\xfa\x49\x7e\x92\x9f\xe2\xa7\xf8\x69\x7e\x9a\x9f\xe1\x67\xf8\x99\x7e\xa6" "\x9f\xed\x67\xfb\x39\x7e\x8e\x9f\xeb\xe7\xfa\xf9\x7e\xbe\x5f\xe8\x17\xfa" "\x45\x7e\x91\x5f\xe2\x97\xf8\xa5\x7e\xa9\x5f\xe6\x97\xf9\x15\x7e\x85\x5f" "\xe5\x57\xf9\x35\x7e\x8d\x5f\xe7\xd7\xf9\x0d\x7e\x83\xdf\xe4\x37\xf9\x2d" "\x7e\x8b\xdf\xe6\xb7\xf9\xed\x7e\xbb\xdf\xe9\x77\xfa\xdd\x7e\xb7\xdf\xeb" "\xf7\xfa\x7d\x7e\x9f\xdf\xef\xf7\xfb\x03\xfe\x80\x3f\xe8\x0f\xfa\x43\xfe" "\x90\x3f\xec\xbf\xf4\x47\xfc\x57\xfe\xa8\xff\xda\x1f\xf3\xdf\xf8\xe3\xfe" "\x5b\x7f\xc2\x7f\xe7\x4f\xfa\x53\xfe\xb4\xff\xde\x9f\xf1\x3f\xf8\xb3\xfe" "\x9c\x3f\xef\x7f\xf4\x17\xfc\x4f\xfe\xa2\xff\xd9\x5f\xf2\xc1\x8f\x4f\xbc" "\x95\x98\x90\x78\x3b\x31\x31\xf1\x4e\x62\x52\x62\x72\x62\x4a\x62\x6a\x62" "\x5a\x62\x7a\x62\x46\xe2\xdd\xc4\xcc\xc4\xac\xc4\xec\xc4\x7b\x89\x39\x89" "\xf7\x13\x73\x13\xf3\x12\xf3\x13\x0b\x12\x0b\x13\x1f\x24\x16\x25\x16\x27" "\x96\x24\x3e\x4c\x2c\x4d\x7c\x94\x58\x96\x58\x9e\x58\x91\x58\x99\x58\x95" "\x58\x9d\x08\x21\xef\xf6\x38\xe4\x0f\x05\x42\x32\xdc\x10\x0a\x86\x1b\x43" "\xa1\x50\x38\x14\x09\x45\x83\x0f\xc5\x42\xf1\x70\x53\x28\x11\x6e\x0e\x25" "\xc3\x2d\xa1\x54\xb8\x35\x94\x0e\xb7\x85\x32\xa1\x6c\x28\x17\x1e\x0d\x0d" "\x43\xa3\xd0\x38\x34\x09\x4d\xc3\x63\xa1\x59\x78\x3c\x34\x0f\x2d\x42\xcb" "\xf0\x44\x68\x15\x9e\x0c\xad\xc3\x53\xa1\x4d\x78\x3a\xb4\x0d\xcf\x84\x76" "\xe1\x0f\xa1\x7d\x78\x36\x74\x08\xcf\x85\x8e\xe1\xf9\xd0\x29\x74\x0e\x5d" "\xc2\x0b\xa1\x6b\x78\x31\x74\x0b\xdd\x43\x6a\xe8\x11\x7a\x86\x97\x42\xaf" "\xd0\x3b\xf4\x09\x7d\x43\xbf\xf0\x72\xe8\x1f\x5e\x09\x03\xc2\xab\x61\x60" "\x18\x14\x06\x87\xd7\xc2\x90\xf0\x7a\x18\x1a\xde\x08\xc3\xc2\xf0\x30\x22" "\xbc\x19\x46\x86\x51\x61\x74\x18\x13\xc6\x86\x71\x61\x7c\x78\x2b\x4c\x08" "\x6f\x87\x89\xe1\x9d\x30\x29\x4c\x0e\x53\xc2\xd4\x30\x2d\x4c\x0f\x33\xc2" "\xbb\x61\x66\x98\x15\x66\x87\xf7\xc2\x9c\xf0\x7e\x98\x1b\xe6\x85\xf9\x61" "\x41\x58\x18\x3e\x08\x8b\xc2\xe2\xb0\x24\x7c\x18\x96\x86\x8f\xc2\xb2\xb0" "\x3c\xac\x08\x2b\xc3\xaa\xb0\x3a\xac\x09\x6b\xc3\xba\xb0\x3e\x6c\x08\x1b" "\xc3\xa6\xb0\x39\x6c\x09\x5b\xc3\xb6\xf0\x71\xd8\x1e\x76\x84\x9d\x61\x57" "\xd8\x1d\xf6\x84\xbd\xe1\x93\xb0\x2f\x7c\x1a\xf6\x87\xcf\xc2\x81\xf0\x79" "\x38\x18\xfe\x18\x0e\x85\x2f\xc2\xe1\xf0\x65\x38\x12\xbe\x0a\x47\xc3\xd7" "\xe1\x58\xf8\x26\x1c\x0f\xdf\x86\x13\xe1\xbb\x70\x32\x9c\x0a\xa7\xc3\xf7" "\xe1\x4c\xf8\x21\x9c\x0d\xe7\xc2\xf9\xf0\x63\xb8\x10\x7e\x0a\x17\xc3\xcf" "\xe1\x52\x08\xe1\x4a\xbf\x49\x17\x42\x08\x21\x84\xf8\xdf\x40\xff\x4e\x7f" "\x8f\xff\x4b\x8e\xfa\x53\xbb\x27\x00\x5c\xbd\x23\xf7\x91\xff\xd8\xbf\x29" "\xc7\xaf\xed\xde\x19\xf3\xb4\x4a\x00\xc0\xd3\xdd\x3b\x3e\xf4\xe7\xad\x72" "\xe5\xd4\xd4\xd4\x3f\x1d\xbb\x4c\x43\x54\x60\x1e\x00\x24\x2e\xe7\x67\x80" "\xcb\xf1\x72\x68\x09\x4f\x42\x1b\x68\x01\x25\xfe\xd2\x9f\xf2\x57\xe7\xea" "\xad\x3a\x5f\xe0\xff\x6c\x7c\x80\x28\x79\x2b\x40\xe6\xbf\xca\x49\xcb\xff" "\x73\x7c\x79\xfc\x9b\xff\xee\xfa\x7b\xab\x51\x73\xfe\xd3\xf1\x35\x44\xc9" "\x79\x00\x85\x0a\x5c\xce\xc9\x04\x97\xe3\xcb\xe3\x97\xfc\xbb\xe3\xa7\xaa" "\x9c\xcd\x7e\x67\xfc\x4c\x5f\x8c\x07\x68\xfe\x57\x39\x59\xe0\x72\x7c\x79" "\xfc\xe2\xf0\x38\x3c\x03\x6d\xfe\xe6\x48\x21\x84\x10\x42\x08\x21\x84\x10" "\xe2\x57\xbd\x55\xb9\xf6\xbf\xf7\x7c\x9b\xf6\x7c\x9e\xc7\x5c\xce\xc9\x08" "\x97\xe3\xbf\xf7\x7c\x2e\x84\x10\x42\x08\x21\x84\x10\x42\x88\xff\x59\x9e" "\xed\xdc\xe5\xa9\xc7\xda\xb4\x69\xd1\x5e\x1a\xff\x1d\x8d\x14\x00\x08\xd7" "\xfc\xfa\x51\xff\x4f\x98\x8f\x34\xa4\xf1\x5f\x6c\x5c\xe9\x6f\x26\x21\x84" "\x10\x42\x08\x21\xc4\xbf\xda\xe5\x9b\xfe\x2b\x3d\x13\x21\x84\x10\x42\x08" "\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10" "\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x22\xfd\xfa" "\xff\xf1\xeb\xc4\xfe\x7c\xae\xdf\xfb\x5b\x83\x42\x08\x21\x84\x10\x42\x08" "\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10" "\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21\x84\x10\x42\x08\x21" "\x84\x10\x42\x08\x21\xc4\xbf\xab\xff\x13\x00\x00\xff\xff\x28\x62\x32" "\xf6", 5382); syz_mount_image(/*fs=*/0x20001500, /*dir=*/0x20001540, /*flags=*/0, /*opts=*/0x20000100, /*chdir=*/1, /*size=*/0x1506, /*img=*/0x20002ac0); memcpy((void*)0x20002040, "./file0\000", 8); syscall(__NR_mkdirat, /*fd=*/0xffffff9c, /*path=*/0x20002040ul, /*mode=*/0ul); memcpy((void*)0x20000180, "./file0\000", 8); syscall(__NR_move_mount, /*from_dfd=*/-1, /*from_pathname=*/0ul, /*to_dfd=*/-1, /*to_pathname=*/0x20000180ul, /*flags=*/0ul); memcpy((void*)0x20000140, "./file0\000", 8); syscall(__NR_mount, /*src=*/0x20000180ul, /*dst=*/0x20000140ul, /*type=*/0ul, /*flags=MS_RELATIME|MS_BIND*/ 0x201000ul, /*data=*/0ul); } int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1, /*offset=*/0ul); const char* reason; (void)reason; use_temporary_dir(); loop(); return 0; }