// autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef __NR_memfd_create #define __NR_memfd_create 319 #endif static unsigned long long procid; //% This code is derived from puff.{c,h}, found in the zlib development. The //% original files come with the following copyright notice: //% Copyright (C) 2002-2013 Mark Adler, all rights reserved //% version 2.3, 21 Jan 2013 //% This software is provided 'as-is', without any express or implied //% warranty. In no event will the author be held liable for any damages //% arising from the use of this software. //% Permission is granted to anyone to use this software for any purpose, //% including commercial applications, and to alter it and redistribute it //% freely, subject to the following restrictions: //% 1. The origin of this software must not be misrepresented; you must not //% claim that you wrote the original software. If you use this software //% in a product, an acknowledgment in the product documentation would be //% appreciated but is not required. //% 2. Altered source versions must be plainly marked as such, and must not be //% misrepresented as being the original software. //% 3. This notice may not be removed or altered from any source distribution. //% Mark Adler madler@alumni.caltech.edu //% BEGIN CODE DERIVED FROM puff.{c,h} #define MAXBITS 15 #define MAXLCODES 286 #define MAXDCODES 30 #define MAXCODES (MAXLCODES + MAXDCODES) #define FIXLCODES 288 struct puff_state { unsigned char* out; unsigned long outlen; unsigned long outcnt; const unsigned char* in; unsigned long inlen; unsigned long incnt; int bitbuf; int bitcnt; jmp_buf env; }; static int puff_bits(struct puff_state* s, int need) { long val = s->bitbuf; while (s->bitcnt < need) { if (s->incnt == s->inlen) longjmp(s->env, 1); val |= (long)(s->in[s->incnt++]) << s->bitcnt; s->bitcnt += 8; } s->bitbuf = (int)(val >> need); s->bitcnt -= need; return (int)(val & ((1L << need) - 1)); } static int puff_stored(struct puff_state* s) { s->bitbuf = 0; s->bitcnt = 0; if (s->incnt + 4 > s->inlen) return 2; unsigned len = s->in[s->incnt++]; len |= s->in[s->incnt++] << 8; if (s->in[s->incnt++] != (~len & 0xff) || s->in[s->incnt++] != ((~len >> 8) & 0xff)) return -2; if (s->incnt + len > s->inlen) return 2; if (s->outcnt + len > s->outlen) return 1; for (; len--; s->outcnt++, s->incnt++) { if (s->in[s->incnt]) s->out[s->outcnt] = s->in[s->incnt]; } return 0; } struct puff_huffman { short* count; short* symbol; }; static int puff_decode(struct puff_state* s, const struct puff_huffman* h) { int first = 0; int index = 0; int bitbuf = s->bitbuf; int left = s->bitcnt; int code = first = index = 0; int len = 1; short* next = h->count + 1; while (1) { while (left--) { code |= bitbuf & 1; bitbuf >>= 1; int count = *next++; if (code - count < first) { s->bitbuf = bitbuf; s->bitcnt = (s->bitcnt - len) & 7; return h->symbol[index + (code - first)]; } index += count; first += count; first <<= 1; code <<= 1; len++; } left = (MAXBITS + 1) - len; if (left == 0) break; if (s->incnt == s->inlen) longjmp(s->env, 1); bitbuf = s->in[s->incnt++]; if (left > 8) left = 8; } return -10; } static int puff_construct(struct puff_huffman* h, const short* length, int n) { int len; for (len = 0; len <= MAXBITS; len++) h->count[len] = 0; int symbol; for (symbol = 0; symbol < n; symbol++) (h->count[length[symbol]])++; if (h->count[0] == n) return 0; int left = 1; for (len = 1; len <= MAXBITS; len++) { left <<= 1; left -= h->count[len]; if (left < 0) return left; } short offs[MAXBITS + 1]; offs[1] = 0; for (len = 1; len < MAXBITS; len++) offs[len + 1] = offs[len] + h->count[len]; for (symbol = 0; symbol < n; symbol++) if (length[symbol] != 0) h->symbol[offs[length[symbol]]++] = symbol; return left; } static int puff_codes(struct puff_state* s, const struct puff_huffman* lencode, const struct puff_huffman* distcode) { static const short lens[29] = { 3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31, 35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258}; static const short lext[29] = { 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0}; static const short dists[30] = { 1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193, 257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577}; static const short dext[30] = { 0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 13, 13}; int symbol; do { symbol = puff_decode(s, lencode); if (symbol < 0) return symbol; if (symbol < 256) { if (s->outcnt == s->outlen) return 1; if (symbol) s->out[s->outcnt] = symbol; s->outcnt++; } else if (symbol > 256) { symbol -= 257; if (symbol >= 29) return -10; int len = lens[symbol] + puff_bits(s, lext[symbol]); symbol = puff_decode(s, distcode); if (symbol < 0) return symbol; unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]); if (dist > s->outcnt) return -11; if (s->outcnt + len > s->outlen) return 1; while (len--) { if (dist <= s->outcnt && s->out[s->outcnt - dist]) s->out[s->outcnt] = s->out[s->outcnt - dist]; s->outcnt++; } } } while (symbol != 256); return 0; } static int puff_fixed(struct puff_state* s) { static int virgin = 1; static short lencnt[MAXBITS + 1], lensym[FIXLCODES]; static short distcnt[MAXBITS + 1], distsym[MAXDCODES]; static struct puff_huffman lencode, distcode; if (virgin) { lencode.count = lencnt; lencode.symbol = lensym; distcode.count = distcnt; distcode.symbol = distsym; short lengths[FIXLCODES]; int symbol; for (symbol = 0; symbol < 144; symbol++) lengths[symbol] = 8; for (; symbol < 256; symbol++) lengths[symbol] = 9; for (; symbol < 280; symbol++) lengths[symbol] = 7; for (; symbol < FIXLCODES; symbol++) lengths[symbol] = 8; puff_construct(&lencode, lengths, FIXLCODES); for (symbol = 0; symbol < MAXDCODES; symbol++) lengths[symbol] = 5; puff_construct(&distcode, lengths, MAXDCODES); virgin = 0; } return puff_codes(s, &lencode, &distcode); } static int puff_dynamic(struct puff_state* s) { static const short order[19] = {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15}; int nlen = puff_bits(s, 5) + 257; int ndist = puff_bits(s, 5) + 1; int ncode = puff_bits(s, 4) + 4; if (nlen > MAXLCODES || ndist > MAXDCODES) return -3; short lengths[MAXCODES]; int index; for (index = 0; index < ncode; index++) lengths[order[index]] = puff_bits(s, 3); for (; index < 19; index++) lengths[order[index]] = 0; short lencnt[MAXBITS + 1], lensym[MAXLCODES]; struct puff_huffman lencode = {lencnt, lensym}; int err = puff_construct(&lencode, lengths, 19); if (err != 0) return -4; index = 0; while (index < nlen + ndist) { int symbol; int len; symbol = puff_decode(s, &lencode); if (symbol < 0) return symbol; if (symbol < 16) lengths[index++] = symbol; else { len = 0; if (symbol == 16) { if (index == 0) return -5; len = lengths[index - 1]; symbol = 3 + puff_bits(s, 2); } else if (symbol == 17) symbol = 3 + puff_bits(s, 3); else symbol = 11 + puff_bits(s, 7); if (index + symbol > nlen + ndist) return -6; while (symbol--) lengths[index++] = len; } } if (lengths[256] == 0) return -9; err = puff_construct(&lencode, lengths, nlen); if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1])) return -7; short distcnt[MAXBITS + 1], distsym[MAXDCODES]; struct puff_huffman distcode = {distcnt, distsym}; err = puff_construct(&distcode, lengths + nlen, ndist); if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1])) return -8; return puff_codes(s, &lencode, &distcode); } static int puff( unsigned char* dest, unsigned long* destlen, const unsigned char* source, unsigned long sourcelen) { struct puff_state s = { .out = dest, .outlen = *destlen, .outcnt = 0, .in = source, .inlen = sourcelen, .incnt = 0, .bitbuf = 0, .bitcnt = 0, }; int err; if (setjmp(s.env) != 0) err = 2; else { int last; do { last = puff_bits(&s, 1); int type = puff_bits(&s, 2); err = type == 0 ? puff_stored(&s) : (type == 1 ? puff_fixed(&s) : (type == 2 ? puff_dynamic(&s) : -1)); if (err != 0) break; } while (!last); } *destlen = s.outcnt; return err; } //% END CODE DERIVED FROM puff.{c,h} #define ZLIB_HEADER_WIDTH 2 static int puff_zlib_to_file(const unsigned char* source, unsigned long sourcelen, int dest_fd) { if (sourcelen < ZLIB_HEADER_WIDTH) return 0; source += ZLIB_HEADER_WIDTH; sourcelen -= ZLIB_HEADER_WIDTH; const unsigned long max_destlen = 132 << 20; void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0); if (ret == MAP_FAILED) return -1; unsigned char* dest = (unsigned char*)ret; unsigned long destlen = max_destlen; int err = puff(dest, &destlen, source, sourcelen); if (err) { munmap(dest, max_destlen); errno = -err; return -1; } if (write(dest_fd, dest, destlen) != (ssize_t)destlen) { munmap(dest, max_destlen); return -1; } return munmap(dest, max_destlen); } static int setup_loop_device(unsigned char* data, unsigned long size, const char* loopname, int* loopfd_p) { int err = 0, loopfd = -1; int memfd = syscall(__NR_memfd_create, "syzkaller", 0); if (memfd == -1) { err = errno; goto error; } if (puff_zlib_to_file(data, size, memfd)) { err = errno; goto error_close_memfd; } loopfd = open(loopname, O_RDWR); if (loopfd == -1) { err = errno; goto error_close_memfd; } if (ioctl(loopfd, LOOP_SET_FD, memfd)) { if (errno != EBUSY) { err = errno; goto error_close_loop; } ioctl(loopfd, LOOP_CLR_FD, 0); usleep(1000); if (ioctl(loopfd, LOOP_SET_FD, memfd)) { err = errno; goto error_close_loop; } } close(memfd); *loopfd_p = loopfd; return 0; error_close_loop: close(loopfd); error_close_memfd: close(memfd); error: errno = err; return -1; } static void reset_loop_device(const char* loopname) { int loopfd = open(loopname, O_RDWR); if (loopfd == -1) { return; } if (ioctl(loopfd, LOOP_CLR_FD, 0)) { } close(loopfd); } static long syz_mount_image( volatile long fsarg, volatile long dir, volatile long flags, volatile long optsarg, volatile long change_dir, volatile unsigned long size, volatile long image) { unsigned char* data = (unsigned char*)image; int res = -1, err = 0, need_loop_device = !!size; char* mount_opts = (char*)optsarg; char* target = (char*)dir; char* fs = (char*)fsarg; char* source = NULL; char loopname[64]; if (need_loop_device) { int loopfd; memset(loopname, 0, sizeof(loopname)); snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid); if (setup_loop_device(data, size, loopname, &loopfd) == -1) return -1; close(loopfd); source = loopname; } mkdir(target, 0777); char opts[256]; memset(opts, 0, sizeof(opts)); if (strlen(mount_opts) > (sizeof(opts) - 32)) { } strncpy(opts, mount_opts, sizeof(opts) - 32); if (strcmp(fs, "iso9660") == 0) { flags |= MS_RDONLY; } else if (strncmp(fs, "ext", 3) == 0) { bool has_remount_ro = false; char* remount_ro_start = strstr(opts, "errors=remount-ro"); if (remount_ro_start != NULL) { char after = *(remount_ro_start + strlen("errors=remount-ro")); char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1); has_remount_ro = ((before == '\0' || before == ',') && (after == '\0' || after == ',')); } if (strstr(opts, "errors=panic") || !has_remount_ro) strcat(opts, ",errors=continue"); } else if (strcmp(fs, "xfs") == 0) { strcat(opts, ",nouuid"); } res = mount(source, target, fs, flags, opts); if (res == -1) { err = errno; goto error_clear_loop; } res = open(target, O_RDONLY | O_DIRECTORY); if (res == -1) { err = errno; goto error_clear_loop; } if (change_dir) { res = chdir(target); if (res == -1) { err = errno; } } error_clear_loop: if (need_loop_device) reset_loop_device(loopname); errno = err; return res; } int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/-1, /*offset=*/0ul); const char* reason; (void)reason; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {} memcpy((void*)0x20001500, "exfat\000", 6); memcpy((void*)0x20000c00, "./file0\000", 8); memcpy((void*)0x20002ac0, "\x78\x9c\xec\xdc\x7b\x98\x8f\xd5\xda\x38\xf0\x75\xaf\xb5\x1e\xc6\x34\xe9\xdb\x24\xe7\x75\xaf\xfb\xe1\x9b\x06\xcb\x24\x49\x0e\x49\x72\x48\x92\x24\x24\xe7\x24\x49\x93\x24\x49\x12\x43\x4e\x49\x48\x42\x8e\x93\xe4\x30\x26\x24\x87\xc1\xc4\x38\x9f\xcf\xc7\xd0\x64\x4b\x92\x24\xa7\x9c\xc2\xfa\x5d\xda\xed\xd7\xbb\x77\xbd\x97\xfd\xdb\xef\xde\xaf\x3f\xe6\xfe\x5c\xd7\xba\x66\xdd\xf3\x7c\xef\xfb\xbb\xd6\xdc\xd7\xcc\xf7\x79\x9e\xeb\x9a\xe7\xc7\x2e\x43\x6b\x34\xae\x59\xb5\x01\x11\x89\x7f\x85\xfa\xdb\x04\xfe\xfa\x25\x59\x08\x11\x23\x84\x18\x20\x84\xb8\x45\x08\x11\x08\x21\xca\xc6\x97\x8d\xbf\x7a\x3c\x97\x82\xe4\x7f\xe9\x4d\xd8\x7f\x48\xc3\xd4\x1b\xbd\x02\x76\x23\x71\xff\xb3\x37\xee\x7f\xf6\xc6\xfd\xcf\xde\xb8\xff\xd9\x1b\xf7\x3f\x7b\xe3\xfe\x67\x6f\xdc\xff\xec\x8d\xfb\xcf\x58\xb6\x96\x56\xe0\x56\x1e\xd9\x77\xf0\xfd\xff\xec\x8c\x3f\xff\xb3\x37\xee\x7f\xf6\xc6\xfd\xcf\xde\xb8\xff\xd9\x1b\xf7\x3f\x7b\xe3\xfe\x67\x6f\xdc\xff\xec\x8d\xfb\x9f\xbd\x71\xff\x19\xcb\xd6\xfe\x77\xf7\x8f\xe5\x8d\xbe\x7f\xcd\xe3\x7f\x39\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\xb1\xff\x03\xe7\xfd\x35\x5a\x08\xf1\xb7\xf9\x8d\x5e\x17\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\xfe\x7d\x7c\xce\x1b\xbd\x02\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\xfd\xe7\x81\x90\x42\x09\x2d\x02\x91\x43\xe4\x14\x31\x22\x97\x88\x15\x37\x89\x38\x71\xb3\xc8\x2d\x6e\x11\x11\x71\xab\x88\x17\xb7\x89\x3c\xe2\x76\x91\x57\xe4\x13\xf9\x45\x01\x51\x50\x14\x12\x85\x85\x11\x28\xac\x20\x11\x8a\x22\xa2\xa8\x88\x8a\x3b\x44\x31\x71\xa7\x48\x10\xc5\x45\x09\x51\x52\x38\x51\x4a\x24\x8a\xbb\x44\x69\x71\xb7\x28\x23\xee\x11\x65\xc5\xbd\xa2\x9c\xb8\x4f\x94\x17\x15\x44\x45\x51\x49\xdc\x2f\x2a\x8b\x07\x44\x15\xf1\xa0\xa8\x2a\x1e\x12\xd5\x44\x75\x51\x43\xd4\x14\x0f\x8b\x5a\xe2\x11\x51\x5b\x3c\x2a\xea\x88\xc7\x44\x5d\xf1\xb8\xa8\x27\x9e\x10\xf5\xc5\x93\xa2\x81\x68\x28\x1a\x89\xa7\x44\x63\xf1\xb4\x68\x22\x9a\x8a\x66\xa2\xb9\x68\x21\x5a\x8a\x56\xff\x52\xfe\x9b\xa2\xbb\x78\x4b\xf4\x10\x3d\x45\xb2\xe8\x25\x7a\x8b\xb7\x45\x1f\xd1\x57\xf4\x13\xfd\xc5\x00\xf1\x8e\x18\x28\xde\x15\x83\xc4\x7b\x62\xb0\x18\x22\x86\x8a\xf7\xc5\x30\xf1\x81\x18\x2e\x3e\x14\x23\xc4\x48\x31\x4a\x7c\x24\x46\x8b\x31\x62\xac\x18\x27\xc6\x8b\x09\x22\x45\x7c\x2c\x26\x8a\x4f\xc4\x24\xf1\xa9\x98\x2c\xa6\x88\xa9\x62\x9a\x48\x15\xd3\x45\x9a\xf8\x4c\xcc\x10\x33\xc5\x2c\xf1\xb9\x98\x2d\xbe\x10\x73\xc4\x5c\x31\x4f\xcc\x17\xe9\x62\x81\x58\x28\x16\x89\x0c\xf1\xa5\x58\x2c\x96\x88\x4c\xb1\x54\x2c\x13\xcb\xc5\x0a\xb1\x52\xac\x12\xab\xc5\x1a\xb1\x56\xac\x13\xeb\xc5\x06\xb1\x51\x6c\x12\x9b\xc5\x16\xb1\x55\x6c\x13\xdb\xc5\x0e\xb1\x53\xec\x12\xbb\xc5\x1e\xf1\x95\xd8\x2b\xf6\x89\xfd\xe2\x6b\x91\x25\xbe\xf9\xff\xcc\x3f\xf7\x0f\xf9\x5d\x41\x80\x00\x09\x12\x34\x68\xc8\x01\x39\x20\x06\x62\x20\x16\x62\x21\x0e\xe2\x20\x37\xe4\x86\x08\x44\x20\x1e\xe2\x21\x0f\xe4\x81\xbc\x90\x17\xf2\x43\x7e\x28\x08\x05\xa1\x30\x14\x06\x04\x04\x02\x82\x22\x50\x04\xa2\x10\x85\x62\x50\x0c\x12\x20\x01\x4a\x40\x09\x70\xe0\x20\x11\x12\xa1\x34\xdc\x0d\x65\xa0\x0c\x94\x85\xb2\x50\x0e\xca\x41\x79\xa8\x00\x15\xa0\x12\x54\x82\xca\x50\x19\xaa\x40\x15\xa8\x0a\x55\xa1\x1a\x54\x83\x1a\x50\x03\x1e\x86\x87\xe1\x11\xa8\x0d\xb5\xa1\x0e\xd4\x81\xba\x50\x17\xea\x41\x3d\xa8\x0f\xf5\xa1\x01\x34\x80\x46\xd0\x08\x1a\x43\x63\x68\x02\x4d\xa0\x19\x34\x83\x16\xd0\x02\x5a\x41\x2b\x68\x0d\xad\xa1\x0d\xb4\x81\xb6\xd0\x16\xda\x41\x3b\x68\x0f\xed\x21\x09\x92\xa0\x03\x74\x80\x8e\xd0\x11\x3a\x41\x27\xe8\x0c\x9d\xa1\x0b\x74\x81\xae\xf0\x06\xbc\x01\x6f\xc2\x9b\xf0\x16\xbc\x05\x3d\xa1\x9a\xec\x05\xbd\xa1\x37\xf4\x81\x3e\xd0\x0f\xfa\x43\x7f\x78\x07\x06\xc2\xbb\xf0\x2e\xbc\x07\x83\x61\x08\x0c\x85\xf7\xe1\x7d\xf8\x00\x86\xc3\x59\x18\x01\x23\x61\x14\x8c\x82\xca\x72\x0c\x8c\x85\x71\x40\x72\x02\xa4\x40\x0a\x4c\x84\x89\x30\x09\x26\xc1\x64\x98\x02\x53\x60\x1a\xa4\xc2\x74\x48\x83\x34\x98\x01\x33\x61\x26\x7c\x0e\xb3\xe1\x0b\xf8\x02\xe6\xc2\x5c\x98\x0f\xe9\x90\x0e\x0b\x61\x11\x64\x40\x06\x2c\x86\x73\x90\x09\x4b\x61\x19\x2c\x87\x15\xb0\x12\x56\xc0\x6a\x58\x03\xab\x61\x1d\xac\x87\x75\xb0\x11\x36\xc2\x66\xd8\x0c\x5b\x61\x2b\x6c\x87\xed\xb0\x13\x76\xc2\x6e\xd8\x0d\x5f\xc1\x57\xb0\x0f\xf6\xc1\x60\xc8\x82\x2c\x38\x00\x07\xe0\x20\x1c\x84\x43\x70\x08\x0e\xc3\x61\x38\x02\x47\xe0\x28\x1c\x85\x63\x70\x0c\x8e\xc3\x71\x38\x01\x27\xe1\x14\x9c\x84\x33\x70\x06\xce\xc2\x39\x38\x0f\xe7\xe1\x22\x5c\x84\x4b\x70\x09\xae\xc0\x95\xab\xbf\xfc\xf2\x2a\x2d\xb5\xcc\x21\x73\xc8\x18\x19\x23\x63\x65\xac\x8c\x93\x71\x32\xb7\xcc\x2d\x23\x32\x22\xe3\x65\xbc\xcc\x23\xf3\xc8\xbc\x32\xaf\xcc\x2f\xf3\xcb\x82\xb2\xa0\x2c\x2c\x0b\x4b\x94\x28\x49\x86\xb2\x88\x2c\x22\xa3\x32\x2a\x8b\xc9\x62\x32\x41\x26\xc8\x12\xb2\x84\x74\xd2\xc9\x44\x99\x28\x4b\xcb\xd2\xb2\x8c\x2c\x23\xcb\xca\x7b\x65\x39\x79\x9f\x2c\x2f\x2b\xc8\xe7\x5c\x25\x59\x49\x56\x96\x6d\x5d\x15\xf9\xa0\xac\x2a\xab\xca\x6a\xb2\xba\xac\x21\x6b\xca\x9a\xb2\x96\xac\x25\x6b\xcb\xda\xb2\x8e\xac\x23\xeb\xca\xba\xb2\x9e\x7c\x42\xd6\x97\xbd\xa0\x1f\x34\x94\x57\x3b\xd3\x58\x0e\x81\x26\x72\x28\x34\x93\xcd\x65\x0b\xd9\x52\x7e\x00\xcf\xc8\xd6\x72\x38\xb4\x11\x42\xb6\x95\xcf\xcb\x91\x30\x02\xda\xcb\xd6\x2e\x49\xbe\x24\x3b\xc8\xb1\xd0\x51\xbe\x22\xc7\xc1\xab\xb2\xb3\x9c\x00\x5d\xe4\xeb\xb2\xab\x7c\x43\x76\x93\x6f\xca\xee\xb2\x8d\xeb\x21\x7b\xca\xc9\xd0\x4b\xf6\x96\xd3\xa0\x8f\xec\x2b\xfb\xc9\xfe\x72\x06\x54\x97\x57\x3b\x56\x43\xbe\x27\x07\xcb\x21\x72\xa8\x7c\x5f\xce\x87\x0f\xe4\x70\xf9\xa1\x1c\x21\x47\xca\x51\xf2\x23\x39\x5a\x8e\x91\x63\xe5\x38\x39\x5e\x4e\x90\x29\xf2\x63\x39\x51\x7e\x22\x27\xc9\x4f\xe5\x64\x39\x45\x4e\x95\xd3\x64\xaa\x9c\x2e\xd3\xe4\x67\x72\x86\x9c\x29\x67\xc9\xcf\xe5\x6c\xf9\x85\x9c\x23\xe7\xca\x79\x72\xbe\x4c\x97\x0b\xe4\x42\xb9\x48\x66\xc8\x2f\xe5\x62\xb9\x44\x66\xca\xa5\x72\x99\x5c\x2e\x57\xc8\x95\x72\x95\x5c\x2d\xd7\xc8\xb5\x72\x9d\x5c\x2f\x37\xc8\x8d\x72\x93\xdc\x2c\xb7\xc8\xad\x72\x9b\xdc\x2e\x77\xc8\x9d\x72\x97\xdc\x2d\xf7\xc8\xaf\xe4\x5e\xb9\x4f\xee\x97\x5f\xcb\x2c\xf9\x8d\x3c\x20\xff\x22\x0f\xca\x6f\xe5\x21\xf9\x9d\x3c\x2c\xbf\x97\x47\xe4\x0f\xf2\xa8\xfc\x51\x1e\x93\x3f\xc9\xe3\xf2\x67\x79\x42\x9e\x94\xa7\xe4\x69\x79\x46\xfe\x22\xcf\xca\x73\xf2\xbc\xbc\x20\x2f\xca\x5f\xe5\x25\x79\x59\x5e\x91\x5e\x0a\x05\x4a\x2a\xa5\xb4\x0a\x54\x0e\x95\x53\xc5\xa8\x5c\x2a\x56\xdd\xa4\xe2\xd4\xcd\x2a\xb7\xba\x45\x45\xd4\xad\x2a\x5e\xdd\xa6\xf2\xa8\xdb\x55\x5e\x95\x4f\xe5\x57\x05\x54\x41\x55\x48\x15\x56\x46\xa1\xb2\x8a\x54\xa8\x8a\xa8\xa2\x2a\xaa\xee\x50\xc5\xd4\x9d\x2a\x41\x15\x57\x25\x54\x49\xe5\x54\x29\x95\xa8\xee\x52\xa5\xd5\xdd\xaa\x8c\xba\x47\x95\x55\xf7\xaa\x72\xea\x3e\x55\x5e\x55\x50\x15\x55\x25\x75\xbf\xaa\xac\x1e\x50\x55\xd4\x83\xaa\xaa\x7a\x48\x55\x53\xd5\x55\x0d\x55\x53\x3d\xac\x6a\xa9\x47\x54\x6d\xf5\xa8\xaa\xa3\x1e\x53\x75\xd5\xe3\xaa\x9e\x7a\x42\xd5\x57\x4f\xaa\x06\xaa\xa1\x6a\xa4\x9e\x52\x8d\xd5\xd3\xaa\x89\x6a\xaa\x9a\xa9\xe6\xaa\x85\x6a\xa9\x5a\xa9\x67\x54\x6b\xf5\xac\x6a\xa3\x9e\x53\x6d\xd5\xf3\xaa\x9d\x7a\x41\xb5\x57\x2f\xaa\x24\xf5\x92\xea\xa0\x5e\x56\x1d\xd5\x2b\xaa\x93\x7a\x55\x75\x56\xaf\xa9\x2e\xea\x75\xd5\x55\xbd\xa1\xba\xa9\xcb\xea\x8a\xf2\xaa\x87\xea\xa9\x92\x55\x2f\xd5\x5b\xbd\xad\xfa\xa8\xbe\xaa\x9f\xea\xaf\x06\xa8\x77\xd4\x40\xf5\xae\x1a\xa4\xde\x53\x83\xd5\x10\x35\x54\xbd\xaf\x86\xa9\x0f\xd4\x70\xf5\xa1\x1a\xa1\x46\xaa\x51\xea\x23\x35\x5a\x8d\x51\x63\xd5\x38\x35\x5e\x4d\x50\x29\xea\x63\x35\x51\x7d\xa2\x26\xa9\x4f\xd5\x64\x35\x45\x4d\x55\xd3\x54\xaa\x9a\xae\xfa\xfd\x5e\x69\xd6\x3f\x91\xff\xc9\x9f\xe4\x0f\xfa\xed\xdd\x37\xab\x2d\x6a\xab\xda\xa6\xb6\xab\x1d\x6a\xa7\xda\xa5\x76\xab\x3d\x6a\x8f\xda\xab\xf6\xaa\xfd\x6a\xbf\xca\x52\x59\xea\x80\x3a\xa0\x0e\xaa\x83\xea\x90\x3a\xa4\x0e\xab\xc3\xea\x88\x3a\xa2\x8e\xaa\xa3\xea\x98\x3a\xa6\x8e\xab\xe3\xea\x84\x3a\xa9\x2e\xa8\xd3\xea\x8c\xfa\x45\x9d\x55\xe7\xd4\x39\x75\x41\x5d\x54\x17\xd5\xa5\xdf\x7f\x06\x42\x83\x96\x5a\x69\xad\x03\x9d\x43\xe7\xd4\x31\x3a\x97\x8e\xd5\x37\xe9\x38\x7d\xb3\xce\xad\x6f\xd1\x11\x7d\xab\x8e\xd7\xb7\xe9\x3c\xfa\x76\x9d\x57\xe7\xd3\xf9\x75\x01\x5d\x50\x17\xd2\x85\xb5\xd1\xa8\xad\x26\x1d\xea\x22\xba\xa8\x8e\xea\x3b\x74\x31\x7d\xa7\x4e\xd0\xc5\x75\x09\x5d\x52\x3b\x5d\x4a\x27\xea\xbb\xfe\xf9\xfc\x9c\xe2\x4f\xf3\xaf\xb7\xbe\x56\xba\x95\x6e\xad\x5b\xeb\x36\xba\x8d\x6e\xab\xdb\xea\x76\xba\x9d\x6e\xaf\xdb\xeb\x24\x9d\xa4\x3b\xe8\x0e\xba\xa3\xee\xa8\x3b\xe9\x4e\xba\xb3\xee\xac\xbb\xe8\x2e\xba\xab\xee\xaa\xbb\xe9\x6e\xba\xbb\xee\xae\x7b\xe8\x1e\x3a\x59\x27\xeb\xde\xfa\x6d\xdd\x47\xf7\xd5\xfd\x74\x7f\x3d\x40\xbf\xa3\x07\xea\x81\x7a\x90\x1e\xa4\x07\xeb\xc1\x7a\xa8\x1e\xaa\x87\xe9\x61\x7a\xb8\x1e\xae\x47\xe8\x11\x7a\x94\x1e\xa5\x47\xeb\xd1\x7a\xac\x1e\xab\xc7\xeb\xf1\x3a\x45\xa7\xe8\x89\x7a\xa2\x9e\xa4\x27\xe9\xc9\x7a\xb2\x9e\xaa\xa7\xea\x54\x9d\xaa\xd3\x74\x9a\x9e\xa1\x67\xe8\x59\x7a\x96\x9e\xad\x67\xeb\x39\x7a\x8e\x9e\xa7\xe7\xe9\x74\x9d\xae\x17\xea\x85\x3a\x43\x67\xe8\xc5\x7a\xb1\xce\xd4\x4b\xf5\x52\xbd\x5c\x2f\xd7\x2b\xf5\x4a\xbd\x5a\xaf\xd6\x6b\xf5\x5a\xbd\x5e\xaf\xd7\x1b\xf5\x46\x9d\xa9\xb7\xe8\x2d\x7a\x9b\xde\xa6\x77\xe8\x1d\x7a\x97\xde\xa5\xf7\xe8\x3d\x7a\xaf\xde\xab\xf7\xeb\xfd\x3a\x4b\x67\xe9\x03\xfa\x80\x3e\xa8\x0f\xea\x43\xfa\x90\x3e\xac\x0f\xeb\x23\xfa\x88\x3e\xaa\x8f\xea\x63\xfa\x98\x3e\xae\x8f\xeb\x13\xfa\x84\x3e\xa5\x4f\xe9\x33\xfa\x8c\x3e\xab\xcf\xea\xf3\xfa\xbc\xbe\xa8\x2f\xea\x4b\xfa\x92\xbe\xa2\xaf\x5c\x3d\xed\x0b\x64\x20\x03\x1d\xe8\x20\x47\x90\x23\x88\x09\x62\x82\xd8\x20\x36\x88\x0b\xe2\x82\xdc\x41\xee\x20\x12\x44\x82\xf8\x20\x3e\xc8\x13\xdc\x1e\xe4\x0d\xf2\x05\xf9\x83\x02\x41\xc1\xa0\x50\x50\x38\x30\x01\x06\x36\xa0\x20\x0c\x8a\x04\x45\x83\x68\x70\x47\x50\x2c\xb8\x33\x48\x08\x8a\x07\x25\x82\x92\x81\x0b\x4a\x05\x89\xc1\x5d\x41\xe9\xe0\xee\xa0\x4c\x70\x4f\x50\x36\xb8\x37\x28\x17\xdc\x17\x94\x0f\x2a\x04\x15\x83\x4a\xc1\xfd\x41\xe5\xe0\x81\xa0\x4a\xf0\x60\x50\x35\x78\x28\xa8\x16\x54\x0f\x6a\x04\x35\x83\x87\x83\x5a\xc1\x23\x41\xed\xe0\xd1\xa0\x4e\xf0\x58\x50\x37\x78\x3c\xa8\x17\x3c\x11\xd4\x0f\x9e\x0c\x1a\x04\x0d\x83\x46\xc1\x53\x41\xe3\xe0\xe9\xa0\x49\xd0\x34\x68\x16\x34\x0f\x5a\x04\x2d\x83\x56\xff\xd6\xfa\xde\x9f\xcd\xf7\xac\xeb\x61\x7a\x9a\x64\xd3\xcb\xf4\x36\x6f\x9b\x3e\xa6\xaf\xe9\x67\xfa\x9b\x01\xe6\x1d\x33\xd0\xbc\x6b\x06\x99\xf7\xcc\x60\x33\xc4\x0c\x35\xef\x9b\x61\xe6\x03\x33\xdc\x7c\x68\x46\x98\x91\x66\x94\xf9\xc8\x8c\x36\x63\xcc\x58\x33\xce\x8c\x37\x13\x4c\x8a\xf9\xd8\x4c\x34\x9f\x98\x49\xe6\x53\x33\xd9\x4c\x31\x53\xcd\x34\x93\x6a\xa6\x9b\x34\xf3\x99\x99\x61\x66\x9a\x59\xe6\x73\x33\xdb\x7c\x61\xe6\x98\xb9\x66\x9e\x99\x6f\xd2\xcd\x02\xb3\xd0\x2c\x32\x19\xe6\x4b\xb3\xd8\x2c\x31\x99\x66\xa9\x59\x66\x96\x9b\x15\x66\xa5\x59\x65\x56\x9b\x35\x66\xad\x59\x67\xd6\x9b\x0d\x66\xa3\xd9\x64\x36\x9b\x2d\x66\xab\xd9\x66\xb6\x9b\x1d\x66\xa7\xd9\x65\x76\x9b\x3d\xe6\x2b\xb3\xd7\xec\x33\xfb\xcd\xd7\x26\xcb\x7c\x63\x0e\x98\xbf\x98\x83\xe6\x5b\x73\xc8\x7c\x67\x0e\x9b\xef\xcd\x11\xf3\x83\x39\x6a\x7e\x34\xc7\xcc\x4f\xe6\xb8\xf9\xd9\x9c\x30\x27\xcd\x29\x73\xda\x9c\x31\xbf\x98\xb3\xe6\x9c\x39\x6f\x2e\x98\x8b\xe6\x57\x73\xc9\x5c\x36\x57\x8c\xbf\x7a\x72\x7f\xf5\xe3\x1d\x35\x6a\xcc\x81\x39\x30\x06\x63\x30\x16\x63\x31\x0e\xe3\x30\x37\xe6\xc6\x08\x46\x30\x1e\xe3\x31\x0f\xe6\xc1\xbc\x98\x17\xf3\x63\x7e\x2c\x88\x05\xb1\x30\x16\xc6\xab\x08\x09\x8b\x60\x11\x8c\x62\x14\x8b\x61\x31\x4c\xc0\x04\x2c\x81\x25\xd0\xa1\xc3\x44\x4c\xc4\xd2\x58\x1a\xcb\x60\x19\x2c\x8b\x65\xb1\x1c\x96\xc3\xf2\x58\x1e\x2b\x62\x45\xbc\x1f\xef\xc7\x07\xf0\x01\x7c\x10\x1f\xc4\x87\xf0\x21\xac\x8e\xd5\xb1\x26\xd6\xc4\x5a\x58\x0b\x6b\x63\x6d\xac\x83\x75\xb0\x2e\xd6\xc5\x7a\x58\x0f\xeb\x63\x7d\x6c\x80\x0d\xb0\x11\x36\xc2\xc6\xd8\x18\x9b\x60\x13\x6c\x86\xcd\xb0\x05\xb6\xc0\x56\xd8\x0a\x5b\x63\x6b\x6c\x83\x6d\xb0\x2d\xb6\xc5\x76\xd8\x0e\xdb\x63\x7b\x4c\xc2\x24\xec\x80\x1d\xb0\x23\x76\xc4\x4e\xd8\x09\x3b\x63\x67\xec\x82\x5d\xb0\x2b\x76\xc5\x6e\xd8\x0d\xbb\x63\x77\xec\x81\x3d\x30\x19\x93\xb1\x37\xf6\xc6\x3e\xd8\x07\xfb\x61\x3f\x1c\x80\x03\x70\x20\x0e\xc4\x41\x38\x08\x07\xe3\x60\x1c\x8a\x43\x71\x18\x0e\xc3\xe1\x38\x1c\x47\xe0\x48\x1c\x85\x1f\xe1\x68\x1c\x83\x63\x71\x1c\x8e\xc7\x09\x98\x82\x29\x38\x11\x27\xe2\x24\x9c\x84\x93\x71\x32\x4e\xc5\xa9\x98\x8a\xa9\x98\x86\x69\x38\x03\x67\xe0\x2c\x9c\x85\xb3\x71\x36\xce\xc1\x39\x38\x0f\xe7\x61\x3a\xa6\xe3\x42\x5c\x88\x19\x98\x81\x8b\x71\x31\x66\x62\x26\x2e\xc3\x65\xb8\x02\x57\xe0\x2a\x5c\x85\x6b\x70\x0d\xae\xc3\x75\xb8\x01\x37\xe0\x26\xdc\x84\x5b\x70\x0b\x6e\xc3\x6d\xb8\x03\x77\xe0\x2e\xdc\x85\x7b\x70\x0f\xee\xc5\xbd\xb8\x1f\xf7\x63\x16\x66\xe1\x01\x3c\x80\x07\xf1\x20\x1e\xc2\x43\x78\x18\x0f\xe3\x11\x3c\x82\x47\xf1\x28\x1e\xc3\x63\x78\x1c\x8f\xe3\x09\x3c\x81\xa7\xf0\x14\x9e\xc1\x33\x78\x16\xcf\xe2\x79\x3c\x8f\x17\xf1\x57\xbc\x84\x97\xf1\x0a\x7a\x8c\xb1\xb9\x6c\xac\xbd\xc9\xc6\xd9\x9b\x6d\x6e\x7b\x8b\xfd\xc7\x38\xbf\x2d\x60\x0b\xda\x42\xb6\xb0\x35\x36\xaf\xcd\xf7\x77\x31\x5a\x6b\x13\x6c\x71\x5b\xc2\x96\xb4\xce\x96\xb2\x89\xf6\xae\x3f\xc4\xe5\x6d\x05\x5b\xd1\x56\xb2\xf7\xdb\xca\xf6\x01\x5b\xe5\x0f\x71\x2d\xfb\x88\xad\x6d\x1f\xb5\x75\xec\x63\xb6\xa6\x7d\xf8\xef\xe2\xba\xf6\x71\x5b\xcf\x3e\x6d\xeb\xdb\xa6\xb6\x81\x6d\x6e\x1b\xd9\x96\xb6\xb1\x7d\xda\x36\xb1\x4d\x6d\x33\xdb\xdc\xb6\xb0\x2d\x6d\x3b\xfb\x82\x6d\x6f\x5f\xb4\x49\xf6\x25\xdb\xc1\xbe\xfc\x87\x78\xa1\x5d\x64\xd7\xd8\xb5\x76\x9d\x5d\x6f\xf7\xda\x7d\xf6\xbc\xbd\x60\x8f\xda\x1f\xed\x45\xfb\xab\xed\x61\x7b\xda\x01\xf6\x1d\x3b\xd0\xbe\x6b\x07\xd9\xf7\xec\x60\x3b\xe4\x0f\xf1\x28\xfb\x91\x1d\x6d\xc7\xd8\xb1\x76\x9c\x1d\x6f\x27\xfc\x21\x9e\x6a\xa7\xd9\x54\x3b\xdd\xa6\xd9\xcf\xec\x0c\x3b\xf3\x0f\x71\xba\x5d\x60\x67\xdb\x0c\x3b\xc7\xce\xb5\xf3\xec\xfc\xdf\xe2\xab\x6b\xca\xb0\x5f\xda\xc5\x76\x89\xcd\xb4\x4b\xed\x32\xbb\xdc\xae\xb0\x2b\xed\x2a\xbb\xfa\xbf\xd6\xba\xdc\x6e\xb4\x9b\xec\x66\xbb\xc7\x7e\x65\xb7\xd9\xed\x76\x87\xdd\x69\x77\xd9\xdd\xbf\xc5\x57\xf7\xb1\xdf\x7e\x6d\xb3\xec\x37\xf6\x88\xfd\xc1\x1e\xb4\xdf\xda\x43\xf6\x98\x3d\x6c\xbf\xff\x2d\xbe\xba\xbf\x63\xf6\x27\x7b\xdc\xfe\x6c\x4f\xd8\x93\xf6\x94\x3d\x6d\xcf\xd8\x5f\xec\x59\x7b\xee\xb7\xfd\x5f\xdd\xfb\x69\x7b\xd9\x5e\xb1\xde\x0a\x02\x92\xa4\x48\x53\x40\x39\x28\x27\xc5\x50\x2e\x8a\xa5\x9b\x28\x8e\x6e\xa6\xdc\x74\x0b\x45\xe8\x56\x8a\xa7\xdb\x28\x0f\xdd\x4e\x79\x29\x1f\xe5\xa7\x02\x54\x90\x0a\x51\x61\x32\x84\x64\x89\x28\xa4\x22\x54\x94\xa2\x74\x07\x15\xa3\x3b\x29\x81\x8a\x53\x09\x2a\x49\x8e\x4a\x51\x22\xdd\x45\xa5\xe9\x6e\x2a\x43\xf7\x50\x59\xba\x97\xca\xd1\x7d\x54\x9e\x2a\x50\x45\xaa\x44\xf7\x53\x65\x7a\x80\xaa\xd0\x83\x54\x95\x1e\xa2\x6a\x54\x9d\x6a\x50\x4d\x7a\x98\x6a\xd1\x23\x54\x9b\x1e\xa5\x3a\xf4\x18\xd5\xa5\xc7\xa9\x1e\x3d\x41\xf5\xe9\x49\x6a\x40\x0d\xa9\x11\x3d\x45\x8d\xe9\x69\x6a\x42\x4d\xa9\x19\x35\xa7\x16\xd4\x92\x5a\xd1\x33\xd4\x9a\x9e\xa5\x36\xf4\x1c\xb5\xa5\xe7\xa9\x1d\xbd\x40\xed\xe9\x45\x4a\xa2\x97\xa8\x03\xbd\x4c\x1d\xe9\x15\xea\x44\xaf\x52\x67\x7a\x8d\xba\xd0\xeb\xd4\x95\xde\xa0\x6e\xf4\x26\x75\xa7\xb7\xa8\x07\xf5\xa4\x64\xea\x45\xbd\xe9\x6d\xea\x43\x7d\xa9\x1f\xf5\xa7\x01\xf4\x0e\x0d\xa4\x77\x69\x10\xbd\x47\x83\x69\x08\x0d\xa5\xf7\x69\x18\x7d\x40\xc3\xe9\x43\x1a\x41\x23\x69\x14\x7d\x44\xa3\x69\x0c\x8d\xa5\x71\x34\x9e\x26\x50\x0a\x7d\x4c\x13\xe9\x13\x9a\x44\x9f\xd2\x64\x9a\x42\x53\x69\x1a\xa5\xd2\x74\x4a\xa3\xcf\x68\x06\xcd\xa4\x59\xf4\x39\xcd\xa6\x2f\x68\x0e\xcd\xa5\x79\x34\x9f\xd2\x69\x01\x2d\xa4\x45\x94\x41\x5f\xd2\x62\x5a\x42\x99\xb4\x94\x96\xd1\x72\x5a\x41\x2b\x69\x15\xad\xa6\x35\xb4\x96\xd6\xd1\x7a\xda\x40\x1b\x69\x13\x6d\xa6\x2d\xb4\x95\xb6\xd1\x76\xda\x41\x3b\x69\x17\xed\xa6\x3d\xf4\x15\xed\xa5\x7d\xb4\x9f\xbe\xa6\x2c\xfa\x86\x0e\xd0\x5f\xe8\x20\x7d\x4b\x87\xe8\x3b\x3a\x4c\xdf\xd3\x11\xfa\x81\x8e\xd2\x8f\x74\x8c\x7e\xa2\xe3\xf4\x33\x9d\xa0\x93\x74\x8a\x4e\xd3\x19\xfa\x85\xce\xd2\x39\x3a\x4f\x17\xe8\x22\xfd\x4a\x97\xe8\x32\x5d\x21\x4f\x22\x84\x50\x86\x2a\xd4\x61\x10\xe6\x08\x73\x86\x31\x61\xae\x30\x36\xbc\x29\x8c\x0b\x6f\x0e\x73\x87\xb7\x84\x91\xf0\xd6\x30\x3e\xbc\x2d\xcc\x13\xde\x1e\xe6\x0d\xf3\x85\xf9\xc3\x02\x61\xc1\xb0\x50\x58\x38\x34\x21\x86\x36\xa4\x30\x0c\x8b\x84\x45\xc3\x68\x78\x47\x58\x2c\xbc\x33\x4c\x08\x8b\x87\x25\xc2\x92\xa1\x0b\x4b\x85\x89\xe1\x5d\x61\xe9\xf0\xee\xb0\x4c\x78\x4f\x58\x36\xbc\x37\x2c\x17\xde\x17\x96\x0f\x2b\x84\x15\xc3\x4a\xe1\xfd\x61\xe5\xf0\x81\xb0\x4a\xf8\x60\x58\x35\x7c\x28\xac\x16\x56\x0f\x6b\x84\x35\xc3\x87\xc3\x5a\xe1\x23\x61\xed\xf0\xd1\xb0\x4e\xf8\x58\x58\x26\x7c\x3c\xac\x17\x3e\x11\xd6\x0f\x9f\x0c\x1b\x84\x0d\xc3\x46\xe1\x53\x61\xe3\xf0\xe9\xb0\x49\xd8\x34\x6c\x16\x36\x0f\x5b\x84\x2d\xc3\x56\xe1\x33\x61\xeb\xf0\xd9\xb0\x4d\xf8\x5c\xd8\x36\x7c\x3e\x6c\x17\xbe\x10\xb6\x0f\x5f\x0c\x93\xc2\x97\xc2\x0e\xe1\xcb\xd7\x3d\x9e\x1c\xf6\x0a\x7b\x87\x6f\x87\x6f\x87\xde\x3f\xaa\xe6\x45\xe7\x47\xd3\xa3\x0b\xa2\x0b\xa3\x8b\xa2\x19\xd1\x2f\xa3\x8b\xa3\x4b\xa2\x99\xd1\xa5\xd1\x65\xd1\xe5\xd1\x15\xd1\x95\xd1\x55\xd1\xd5\xd1\x35\xd1\xb5\xd1\x75\xd1\xf5\xd1\x0d\xd1\x8d\xd1\x4d\xd1\xcd\x51\xef\x6b\xe6\x14\x0e\x9c\x74\xca\x69\x17\xb8\x1c\x2e\xa7\x8b\x71\xb9\x5c\xac\xbb\xc9\xc5\xb9\x9b\x5d\x6e\x77\x8b\x8b\xb8\x5b\x5d\xbc\xbb\xcd\xe5\x71\xb7\xbb\xbc\x2e\x9f\xcb\xef\x0a\xb8\x82\xae\x90\x2b\xec\x8c\x43\x67\x1d\xb9\xd0\x15\x71\x45\x5d\xd4\xdd\xe1\x8a\xb9\x3b\x5d\x82\x2b\xee\x4a\xb8\x92\xce\xb9\x52\x2e\xd1\xb5\x74\xad\x5c\x2b\xd7\xda\x3d\xeb\xda\xb8\xe7\x5c\x5b\xf7\xbc\x7b\xde\xbd\xe0\x5e\x70\x2f\xba\x17\xdd\x4b\xae\x83\x7b\xd9\x75\x74\xaf\xb8\x4e\xee\x55\xd7\xd9\xbd\xe6\x5e\x73\xaf\xbb\xae\xee\x0d\xd7\xcd\xbd\xe9\xba\xbb\xb7\x5c\x0f\xd7\xd3\x25\xbb\x64\xd7\xdb\xf5\x76\x7d\x5c\x1f\xd7\xcf\xf5\x73\x03\xdc\x00\x37\xd0\x0d\x74\x83\xdc\x20\x37\xd8\x0d\x76\x43\xdd\x50\x37\xcc\x0d\x73\xc3\xdd\x70\x37\xc2\x8d\x70\xa3\xdc\x28\x37\xda\x8d\x76\x63\xdd\x58\x37\xde\x8d\x77\x29\x2e\xc5\x4d\x74\x13\xdd\x24\x37\xc9\x4d\x76\x93\xdd\x54\x37\xd5\xa5\xba\x54\x97\xe6\xd2\xdc\x0c\x37\xc3\xcd\x72\xb3\xdc\x6c\x37\xdb\xcd\x71\x73\xdc\x3c\x37\xcf\xa5\xbb\x74\xb7\xd0\x2d\x74\x19\x2e\xc3\x2d\x76\x8b\x5d\xa6\xcb\x74\xcb\xdc\x32\xb7\xc2\xad\x70\xab\xdc\x2a\xb7\xc6\xad\x71\xeb\xdc\x3a\xb7\xc1\x6d\x70\x9b\xdc\x26\xb7\xc5\x6d\x71\xdb\xdc\x36\xb7\xc3\xed\x70\xbb\xdc\x2e\xb7\xc7\xed\x71\x7b\xdd\x5e\xb7\xdf\xed\x77\x59\x2e\xcb\x1d\x70\x07\xdc\x41\x77\xd0\x1d\x72\xdf\xb9\xc3\xee\x7b\x77\xc4\xfd\xe0\x8e\xba\x1f\xdd\x31\xf7\x93\x3b\xee\x7e\x76\x27\xdc\x49\x77\xca\x9d\x76\x67\xdc\x2f\xee\xac\x3b\xe7\xce\xbb\x0b\xee\xa2\xfb\xd5\x5d\x72\x97\xdd\x15\xe7\x5d\x4a\xe4\xe3\xc8\xc4\xc8\x27\x91\x49\x91\x4f\x23\x93\x23\x53\x22\x53\x23\xd3\x22\xa9\x91\xe9\x91\xb4\xc8\x67\x91\x19\x91\x99\x91\x59\x91\xcf\x23\xb3\x23\x5f\x44\xe6\x44\xe6\x46\xe6\x45\xe6\x47\xd2\x23\x0b\x22\x0b\x23\x8b\x22\x19\x91\x2f\x23\x8b\x23\x4b\x22\x99\x91\xa5\x91\x65\x91\xe5\x91\x15\x91\x95\x11\xef\x0b\x6d\x0b\x7d\x11\x5f\xd4\x47\xfd\x1d\xbe\x98\xbf\xd3\x27\xf8\xe2\xbe\x84\x2f\xe9\x9d\x2f\xe5\x13\xfd\x5d\xbe\xb4\xbf\xdb\x97\xf1\xf7\xf8\xb2\xfe\x5e\x5f\xce\xdf\xe7\xcb\xfb\x0a\xbe\xa2\x6f\xea\x9b\xf9\xe6\xbe\x85\x6f\xe9\x5b\xf9\x67\x7c\x6b\xff\xac\x6f\xe3\x9f\xf3\x6d\xfd\xf3\xbe\x9d\x7f\xc1\xb7\xf7\x2f\xfa\x24\xff\x92\xef\xe0\x5f\xf6\x1d\xfd\x2b\xbe\x93\x7f\xd5\x77\xf6\xaf\xf9\x2e\xfe\x75\xdf\xd5\xbf\xe1\xbb\xf9\x37\x7d\x77\xff\x96\xef\xe1\x7b\xfa\x64\xdf\xcb\xf7\xf6\x6f\xfb\x3e\xbe\xaf\xef\xe7\xfb\xfb\x01\xfe\x1d\x3f\xd0\xbf\xeb\x07\xf9\xf7\xfc\x60\x3f\xc4\x0f\xf5\xef\xfb\x61\xfe\x03\x3f\xdc\x7f\xe8\x47\xf8\x91\x7e\x94\xff\xc8\x8f\xf6\x63\xfc\x58\x3f\xce\x8f\xf7\x13\x7c\x8a\xff\xd8\x4f\xf4\x9f\xf8\x49\xfe\x53\x3f\xd9\x4f\xf1\x53\xfd\x34\x9f\xea\xa7\xfb\x34\xff\x99\x9f\xe1\x67\xfa\x59\xfe\x73\x3f\xdb\x7f\xe1\xe7\xf8\xb9\x7e\x9e\x9f\xef\xd3\xfd\x02\xbf\xd0\x2f\xf2\x19\xfe\x4b\xbf\xd8\x2f\xf1\x99\x7e\xa9\x5f\xe6\x97\xfb\x15\x7e\xa5\x5f\xe5\x57\xfb\x35\x7e\xad\x5f\xe7\xd7\xfb\x0d\x7e\xa3\xdf\xe4\x37\xfb\x2d\x7e\xab\xdf\xe6\xb7\xfb\x1d\x7e\xa7\xdf\xe5\x77\xfb\x3d\x5e\xc8\xbd\x7e\x9f\xdf\xef\xbf\xf6\x59\xfe\x1b\x7f\xc0\xff\xc5\x1f\xf4\xdf\xfa\x43\xfe\x3b\x7f\xd8\x7f\xef\x8f\xf8\x1f\xfc\x51\xff\xa3\x3f\xe6\x7f\xf2\xc7\xfd\xcf\xfe\x84\x3f\xe9\x4f\xf9\xd3\xfe\x8c\xff\xc5\x9f\xf5\xe7\xfc\x79\x7f\xc1\x5f\xf4\xbf\xfa\x4b\xfe\xb2\xbf\xc2\xff\xb3\xc6\x18\x63\x8c\x31\xf6\x4f\x51\xd7\x39\xde\xeb\x4f\xbe\x27\x7f\x1f\x57\xf5\x16\x42\xdc\xbc\xbd\xc0\xe1\x7f\xac\xb9\x21\xef\x5f\xe7\x7d\xe5\xde\x0e\x11\x21\xc4\x4b\x3d\xbb\x34\xfc\xdb\x68\xd8\x30\x39\x39\xf9\xf7\xd7\x66\x2a\x11\x14\x9d\x2b\x84\x88\x5c\xcb\xcf\x21\xae\xc5\x4b\x45\x5b\xf1\x82\x48\x12\xcf\x89\xd2\x7f\xba\xbe\xbe\xb2\x22\xd0\x75\xea\x47\xef\x15\x22\xf6\xbf\xe5\xc4\x88\x6b\xf1\xb5\xfa\x77\xff\x0f\xf5\x9b\x2e\xb8\x6e\xfd\xb9\x42\x24\x14\xbd\x96\x93\x4b\x5c\x8b\xaf\xd5\x2f\xf3\x3f\xd4\xdf\xdd\xee\x3a\xf5\x73\x7d\x9b\x22\x44\x9b\xff\x96\x13\x27\xae\xc5\xd7\xea\x27\x8a\x67\xc5\xcb\x22\xe9\xef\x5e\xc9\x18\x63\x8c\x31\xc6\x18\x63\x8c\xfd\x55\x5f\x79\xb1\xeb\xf5\xae\x6f\xaf\x5e\x9f\x17\xd4\xd7\x72\x72\x8a\xdf\x63\x7d\xfd\xeb\x73\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\xdd\x78\xaf\xbe\xd1\xed\xc5\x67\x92\x92\x9e\xeb\xc4\x13\x9e\xf0\x84\x27\xff\x35\xb9\xd1\x7f\x99\x18\x63\x8c\x31\xc6\x18\x63\xff\x6e\xd7\x4e\xfa\x6f\xf4\x4a\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\xb1\xec\xeb\xcf\x9e\xfe\x15\xfc\x9b\x1f\x27\x76\xa3\xf7\xc8\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\x31\xc6\x18\x63\x8c\xdd\x68\xff\x2f\x00\x00\xff\xff\x86\x79\x65\x20", 5342); syz_mount_image(/*fs=*/0x20001500, /*dir=*/0x20000c00, /*flags=MS_STRICTATIME*/0x1000000, /*opts=*/0x20000bc0, /*chdir=*/5, /*size=*/0x14de, /*img=*/0x20002ac0); memcpy((void*)0x200000c0, "./file0/file0\000", 14); syscall(__NR_unlink, /*path=*/0x200000c0ul); return 0; }