From 3772cfde036dc7707cb300c62bc39cabe16e7c20 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 27 Feb 2019 13:34:51 +0100 Subject: [PATCH 1/3] network: wrap some long lines --- src/network/networkd-network.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/network/networkd-network.c b/src/network/networkd-network.c index 75dd8b9e4e..b413abacff 100644 --- a/src/network/networkd-network.c +++ b/src/network/networkd-network.c @@ -187,7 +187,8 @@ static int network_verify(Network *network) { network->match_kernel_version, network->match_arch, NULL, NULL, NULL, NULL, NULL)) return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), - "%s: Conditions in the file do not match the system environment, skipping.", network->filename); + "%s: Conditions in the file do not match the system environment, skipping.", + network->filename); (void) network_resolve_netdev_one(network, network->bond_name, NETDEV_KIND_BOND, &network->bond); (void) network_resolve_netdev_one(network, network->bridge_name, NETDEV_KIND_BRIDGE, &network->bridge); @@ -713,7 +714,8 @@ int config_parse_stacked_netdev(const char *unit, } if (!ifname_valid(rvalue)) { - log_syntax(unit, LOG_ERR, filename, line, 0, "Invalid netdev name in %s=, ignoring assignment: %s", lvalue, rvalue); + log_syntax(unit, LOG_ERR, filename, line, 0, + "Invalid netdev name in %s=, ignoring assignment: %s", lvalue, rvalue); return 0; } @@ -727,7 +729,8 @@ int config_parse_stacked_netdev(const char *unit, r = hashmap_put(*h, name, INT_TO_PTR(kind)); if (r < 0) { - log_syntax(unit, LOG_ERR, filename, line, r, "Cannot add NetDev '%s' to network, ignoring assignment: %m", rvalue); + log_syntax(unit, LOG_ERR, filename, line, r, + "Cannot add NetDev '%s' to network, ignoring assignment: %m", rvalue); return 0; } From 83ec4592760db3dc35f0843b9f1e03624a792e9e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 27 Feb 2019 14:15:29 +0100 Subject: [PATCH 2/3] networkd: fix memleak when the same NetDev is specified twice hashmap_put() returns 0 if the (key, value) pair is already present in the hashmap, and -EEXIST if the key exists, but the value is different. https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13433 --- src/network/networkd-network.c | 13 +++++++------ test/fuzz/fuzz-network-parser/oss-fuzz-13433 | Bin 0 -> 29 bytes 2 files changed, 7 insertions(+), 6 deletions(-) create mode 100644 test/fuzz/fuzz-network-parser/oss-fuzz-13433 diff --git a/src/network/networkd-network.c b/src/network/networkd-network.c index b413abacff..2d42f0d742 100644 --- a/src/network/networkd-network.c +++ b/src/network/networkd-network.c @@ -728,13 +728,14 @@ int config_parse_stacked_netdev(const char *unit, return log_oom(); r = hashmap_put(*h, name, INT_TO_PTR(kind)); - if (r < 0) { + if (r < 0) log_syntax(unit, LOG_ERR, filename, line, r, - "Cannot add NetDev '%s' to network, ignoring assignment: %m", rvalue); - return 0; - } - - name = NULL; + "Cannot add NetDev '%s' to network, ignoring assignment: %m", name); + else if (r == 0) + log_syntax(unit, LOG_DEBUG, filename, line, r, + "NetDev '%s' specified twice, ignoring.", name); + else + name = NULL; return 0; } diff --git a/test/fuzz/fuzz-network-parser/oss-fuzz-13433 b/test/fuzz/fuzz-network-parser/oss-fuzz-13433 new file mode 100644 index 0000000000000000000000000000000000000000..1aef8b7d83bd93df5dcc191efabeee598eb8ec7a GIT binary patch literal 29 ccma#{OD!qSFUpSP3XAY@^s_Ci$YFr90GG1~?EnA( literal 0 HcmV?d00001 From c448459d5635e8ce7b7c0017df8d3bdc8e20c62e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 27 Feb 2019 14:45:29 +0100 Subject: [PATCH 3/3] networkd: refuse more than 128 NTP servers This test case is a bit silly, but it shows that our code is unprepared to handle so many network servers, with quadratic complexity in various places. I don't think there are any valid reasons to have hundres of NTP servers configured, so let's just emit a warning and cut the list short. https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13354 --- src/network/networkd-network.c | 14 +++++++++++--- test/fuzz/fuzz-network-parser/oss-fuzz-13354 | Bin 0 -> 918848 bytes 2 files changed, 11 insertions(+), 3 deletions(-) create mode 100644 test/fuzz/fuzz-network-parser/oss-fuzz-13354 diff --git a/src/network/networkd-network.c b/src/network/networkd-network.c index 2d42f0d742..98cc8a263a 100644 --- a/src/network/networkd-network.c +++ b/src/network/networkd-network.c @@ -23,6 +23,9 @@ #include "strv.h" #include "util.h" +/* Let's assume that anything above this number is a user misconfiguration. */ +#define MAX_NTP_SERVERS 128 + static void network_config_hash_func(const NetworkConfigSection *c, struct siphash *state) { siphash24_compress(c->filename, strlen(c->filename), state); siphash24_compress(&c->line, sizeof(c->line), state); @@ -1462,11 +1465,16 @@ int config_parse_ntp( continue; } - r = strv_push(l, w); + if (strv_length(*l) > MAX_NTP_SERVERS) { + log_syntax(unit, LOG_WARNING, filename, line, 0, + "More than %u NTP servers specified, ignoring \"%s\" and any subsequent entries.", + MAX_NTP_SERVERS, w); + break; + } + + r = strv_consume(l, TAKE_PTR(w)); if (r < 0) return log_oom(); - - w = NULL; } return 0; diff --git a/test/fuzz/fuzz-network-parser/oss-fuzz-13354 b/test/fuzz/fuzz-network-parser/oss-fuzz-13354 new file mode 100644 index 0000000000000000000000000000000000000000..2274fa5bd978b27ae12c2be04794f0d52155aa1b GIT binary patch literal 918848 zcmeI5UvJyUmhFXun}^N^=-1&x-wR9t^^g+v??Fg1nR|c%I!4m*^g&=Xa5FxhwBe3@ zuIwatzWptds$z*Mip4)gk>alrc$_n_EmN!ZUVH7ecX?j)-}dIeZvS5x+>FG3-ygPj zzdwKd_rL$g&Ew;Gx*2Uo|1GA)5z43k?d1LSD>5t!^Kfk)Tc}l)$ z`G3~Y*NXr1{NEnFe7e1VT>tF-tbhK;!}jsk3)e5i7e9->!&^^$O#b{${FDzL{`Z@U zo6nz~Zoj>_`S^4jc)`zK{yO$v%6}yOY4N}N+pQOWk@&~rpWk}pzuiVZ>}LIsoAuYn zr`Pw_(d$^hn2G<_{_FVX=nLfQ_+)$?>Z>OQUmg7->Z`?XA^vLkE##{+{r2kD-+sF^ zKLh#I;(IsuyDj~2Ih!uS*=#zSg^Sh14<^1JPJ)HMSO$~HDqQ(N{bx9l?`8T7gK!Zp zr}J=G;$hAflQ0NYlUWdip?KMg<$M_|mhzh?&t-?2Lx3fZ_&=X+Yd>P~0_3ZHC4Wv1 zfaGgSe{uPh*&`4gLGfP=T#kdOFW$H?oaX%ubH$D~uL10-I8yu;7#>d(kP|^o zgWNa>eF6Nb7c9eYz6e8qF%HmVI^KJ#j$CuZCydHbo_5H((+&GpX zaa03}v&DS2T1~^*Y7vS@D1J?UG6|+Df9{J9xj)$O1_YCZ;i0$k zumVxtXAS#E183kYs*znsG;jvaz}ax*pswZ3DgqCAGb5hLAnvwiE+wggvy2W+#VJuL z60V)xrSwy?HWRlHz!^BpiH6`TI%jdm%R!M&JnK_D0|32fhY1acghoOuN@%yK-rnEEZY=?- z9@t38n<{iDm8R=BleJ0W3Iu0IO_S;4A#aj5b$jg*ZA`kVRBR~YGy!Me44f&;ciJJe zKUG-6G@tuky{RISVk-CH%no~UfcBW%k$l|v5dbN% z7f}T1o*?C5?5R&Zgv_u&zDXJC2z7)yLLEhLYh*l=yh%%}s3q3K7%(_h_7L$$rKi39R6uY55X1m?*mf59Wqqq{NW=+>hh$4!i=W4V=S{#r3cAOF_LN<6(=|=g)^4SR@@5>&Pw5orHl>W zOwes_>?%Pc2@gOLZmF*v1C{1+5+Pk3STYb92u59cyIs4T1v&{VdlK1Dsw+{%>b0k; zc>K;v>g66J5r*uW4S2DX=BOSTIBUMC)jgbvVClkW(WBc|86kB(Lb~58qh2#j$0-Wq z>hYjI4M2aA31)l3+qD7OfPedV%^t;l#wqf6VHfe#53aAH3FKRl%f{gZX#HGdUTjZH5+WyFN9if2F_wS((b^0 z^STB*B@Y&%W!DfvE+LmXxn!rLscY7JXrfmsdq_z8W@(?Dk`cepn~#Um%Q4O>brA84 z((!;A(n9J*3#p~qA9hMAv1ljFqxx$rZBWTj$$G1ju~SlRzY{CVvx*SDI(&7yB7{+R zm-b}ARqTds3WZdS_f?;3UCI_YT)c@ztyrU<_*MmfH-?51oo>*-Yy~t z&wbW&r8J=_uA>JCM>9mA3_( z#(_JkkZ9kdNaR9r z5H|Lr0*X*as3X+j7T4Y4ECw0p1A=ZF-8Q;yblYsml@e2qSUw8WX>qsop(0}{MaDts zFQ@aV7c9eYz6e8qFKH%rcXO;i1?*Y+=tce09+yJ$!v;T7xN zHMso^N|{;;kgafSehBdjZuyXl1wF%COr|DNpF^e|{iSq?N>yL_k=cZ!u0^zPIbQ~g zrHqnVc5f*SfU`m1Yyr-^N)!Z!7O~eTE^S6IG%s((ls@JG&UQ%IpN5h-uF~V75}*<| zhf1I{*?^yweq?>D1K?+R`$}}ZQP5u8d_+N8yVRl&)!cldJIp%3)TXGWoGaa#ghoQc zu5yw<)A*<~JIA~+@r-yzJoCIS>>QID7|ZZVge`xi z)waMu9ifhvA(6~yF32c_S&G6^l-upMOAQAySZL;Y@u}T%1sfU;KXbn3Jz9vtK*Uie zHoD}|$1^x`8GFYFP0mBpzERQDBrK=9zo+{rL$NG5i4y*DTToDXjmiE0M0}i=x$btcWeM77A^IaW1yxo{>|r4;(ysKtpjHRz!{7hMxEJFSwh29 zMTiT9peA94$TUD?nhl4{6&W3<90UsAr z4tha?l7o`d#%=*{2F`|svwul+^VG$uI=b6>w#HhWNCYSZs5Z_aIO{&n*w#m7raBW4 zGzeN7i2Z{9)dBPN63VONf>KN9<8Hna%PpcyLrO(Idd5#RXL{v8hK5hI?xcqVXm zH5uomUKy&2>0KjllwjmKAK;CuIHp&V@Fd6LsljWuP=RHpw-(NAsxKC6;l9wTaE(!d zv*=;a6~EYP`wp{UqmrVMvg4Hyr|v6~jgNc0zt5UDZMc_xX=GSD2hO^WGkW9$%$r{# z&iLo;{oNag6AENw3M9hTx83GIRe=;siWYe@(=|ba)b5=?96}r_5{KZ@1LQbT7o+?2 z0=H5O1~+*VF5L*n>F5&4bRm$v659fHZ zy?6NNVEHJQ8;yx)(fQve@$_@)=jz2AX8&}7Lpmu&-Xw40^-cCz%nOGi@`Ku3Nz@}~2=$*RSDy~p5Oa3oFG zyI45g+jEjAeoCf<_v&qXFd(^NHNk4q;HnTPz33nB)`AJT6#r#h)DOYZRQiz>;*2fZ zQCSBB-E9#mgdin?5~P$3icr^lsB?ugwrnGLq)ITwH(R!&{fTh9&QZ~Vyd(cB;C6T3JaZ78QHoHC+KA5J>;PwtPx`WD8|AwK*F0fDYfJea z9&!4@mTh_G07|zA3Ju-!XMJFYNzkny4}~DNQ|L34u8bSt44i>8#!p1?S?F*-NgdFH z_Rx4CtxOWi5^M8pq$H`n8sZ7@WW`Lu1TMnhfiPG!iewXv3ZA;nw;-OG%Q-A#SjKu| z88bte`TDb(uiwqjF<&2*y7@=bCh3tk*%zX(>(cxsI4h%vu^G9(%3){bDK4WSVi2+X zXis5DVcCSbSX7OJv*vNeVh|RCjMG(y4t%fF0)or211ScXOImv}oUs^03m}RAPrT1B zn8V0+q-x3h*u2=e+lIfS-#8QZXkA&ABI6+Rm(%&w3zlIxUxcB*m@fR)Y!=Lexjd** zx^j}aA75Vo@p|lS*Y^+k*S6OeU1p2<|#7qbmQlnXO}sAeP-{T?M|0|BU|Cx{1D<5-103d7W52lDGZDl7~4oNu5mW{ zi<_8jbwy+Sn0*-a(&{`*u8C-+IAOS)FN4KWMoBHZyG>-u+xSXylbjeXUs-Yd24^&6 zXvnasop@Gd_K>_;DsL{xn_h8BHk4H044k!5Qh_sY2F|#F?ixpFj~%5BycY-#rL{mC zogM2sfu<_(&ni5$uIJ4!>>R72`?+pCmL?lr$C)@f@e~q`$9$WP zLH7e^SSi}jW55|W17|8lefs=q=L*0`A?cCwo}8o(u(IM7xI-H+q*W`g)U&aN6okMV z=NO!H(L}ustvKHH?tMJ+>X7!3_H>kLCcz@VdZ};%&cGQsi`w>5G{J*=)Wm?twsZL&q6=4%u_4ttoThwLeLN^>K|cDI%O)x~aSmQ3>Lt6lKq$7C^F&$iYb- z6h)6u%EC~p^;@fE1ZVU)+Tijvakkm`ql?RT>t8pUAAa;Un)J?s45YCTQe z5}(FWSKj`@QbEB<#=aFVaL@P@i*rUtfA;;Bo2qtS!M-W>O|fsPMEGjlwaWM>Vd*2deobgXC!Rp2(SbHkyk=9k$WLQEiq1GzYVg!-Rd0G{;Dri-dXjK$lyN$7} zg6`g4ds?*C)5SN39K2*=Kyn$ns|a0bqLfU|QN|D?b6qSPd-eR*n_EN~IuWDQtw&qPied@>89 zRaO@o(~Ggv=Bxd0UcWFO2U9;-_+dDeuTB*pQEx^GB{!cxiNC%`e287{TltQ*mXvrr z&4X_og#L0mpL)SE4Cjk5^cT~Gznaa0c`%o7iQcYTFQ(Vx)A%oi0_pjP8+?^Q&y*W|S}iTY~dS?pQo!|Cqt>1L-SJ0<%=wf5(fk4(iH7S`Ww%h zq4eOarP-g+)y2)z_lND>@6RtT->rY$Y`h=6&E}){2w@ga;A&S|5$a4!*quL~!4+oU ztT~*qQxeI82p*XL=yTBLIE;n@7-u_)Qnqi)PD$DF$!g;i<5WUz7|FmHIIDrPt9{8R zdX~!kx3|$`fH-@0>y57_BS;`IZ}=y32{22NH#v{`~LnqLs#itCPN!_oY(s`cTRnITX$r7fE7Cv z<*|I@MsWBNDMNqW-rv2s7`ie9&K%+l1(FRJ`-Q5Tcm~eE8938UK}u;O?uk&JseBMn z`yrt2pXq8_EE+GQRj5^c9|~y->B1`|Z9qbxCQ$2QQQ}T4cXcT^6FkVteXmw~U?^~K zh~&3+AfBahzXZ^w1 zq4Bh(e2AKZn$t!w0%zc?CpZ&rCAnkmxP~$gLVr1(PrYCnhVw-j`itqpU(II0JebQu zqDp0FmAM~ZUjOlW>}}Wg4=)^wF0;jawpvZY*=iAr-Dl$0^e2;Gy7K3~_>lX9P1i3> z7KVpn`>-|3eu+nV`1;Hv0sCVE>D$igk$h|!-eQ*Ham81SjTs^q=wF?G3|-@F^q115 zgH_DNv7oPKP-)g2lRJ4MK)9SQgT=D-M5fd@a8~+g_7P{?Jh4AaZ=D(#&5Y7!M3Lhi z{#gR+I&+pjoW!%zkBoSRmeLa~#RjU9OBJ_VsW`p7m3g`gs?vibZ<06l;`>NVR_nlm zGjImZT#W!bwR-AB1&*njR~TSj$GWbQHd9lp@lk1Zj(KAQ2Ly*Us^_lb>%_a$#PYrI+r**(6kfps))3oH7D4}Ic zX2Gra=aGS|OPCu6Q$JYvVK|kqPQ`?LH%6C}tACDnE3;;nHM8xt(^UjGLYj~ukRbFT ztwbg)#Xi9qI2$6)STc+2!r(#BkAf=a&&G9;E-X!bCbHBj{%ud^x)8|^tLW!Xy8^in z@0b)lS~92>GU}H4$}v#WQ+D(DllWg=+p8*- zD!M`AjBR}mMvI7NvaS8Uo=_~2~Up>>b~h-bvJ zHjXAZ183k2W6hh3w2ak7EY&tD)ABcwg{~O5=me^_)S<4yPRWCyn%y8!`jB{~ixuj- z(vPf=54B_f9bH}AJbi!I-u?c3H&^XNbJZWkM^Sb~qR3`sur%TgJ@v&Cu|?N(wymq> zLI{$=+DKt|kX_-7#X>~zv>d?QPZPgu%Qh%><&0QuEubbNWwB5m)i-g>G^(a00?mmq zoK2T($7fDk)yxfQoi*dz*_+|6_UouLF4fk$&elrpjkT)pu^`p^<RD3d_XYo z!@Q5)smvLE&;|73aujlT5El^_dm}Eg806cF zWbe50gDbwqVi4>_A{iuqk`ea`9#h)!@gP}~H^6xoGf3Fju(9b?c*N?kOYVZ1qPWDf zHsir&SYN zz41a?QAc&%tMmB60pb8vIzW*L_*Re~(@GXY9s_6K44kn7U#Ns*3TYZ@G}QEHNFnW< z=u${iNb5%qVUW9wxyv|CJUHHVp|O3(TQM1aRbXSaSC<(%VdSJYBPZ6v61=VquM+}9 z2gATGA3iv!h;2#=1^}uI0F3Wnzw~x1@pDDs4&qGc(rx1GTPpd2vnn`yX>+eLID^(e zYi_sSE;Ss;sz7rmiBIF{CggV)Nq{nK(Ejh2Z@nuq1T0Qi^5=wuz`u#reh%~I*Q&B1 z6bK5$tZft@WTX@tM-w)*qINo|Nj`A#?4dv>Oij_&S%;~~=35)AX zl2wZ4Ju$RnFle*mQzOg`6rbsdv_Flc)9&KTQJVVvNs#jF4$h>Q-`zyeij<-RnB+jD5$;t&1 zCxw7M#}+q~Ww+u+uaipV&4`=E4i*Snyo+8u4hl|_MS%ukRK>|7m(o5xcU6*?TrSo9Z_4jCj^hLuz6yY^4Rn zA>okp^N{SXYJ7^y6(mt^Hq=xsJ1#Ye#aA`&2_?mFG2 zls;f6~WsZAl_{J(T)KB5E0&!0GR{tD3DB~dXm(%&w3zlIxUxcB*m@fR)Y!=Lec?B?* zvr9d`y#C|$*xRn}AM)=PtFL*_7W3I^H4SI0MJRl-;@9*ilVG~?=f3!mE4G`G@?>Fn zC~nJ)!`EjnGxj@v{XAp+Cl(M1jMO4yOGP067?w2bi|?8IIYuN*>9dGFl#AGG^b#9t z)FV@GvpFJn(sdDHJoJhi?WWw{dgkvn&M>$(u%R#x`A33_gk&W^lY!DJ8)`jBQ`$9A zfK#*{TIwt7+=P)a@ibH)oslu|H1_TdC!XyDKl`9lUjsQ*5%NouF2}P93IRJMrLzYZ zX;M2Kd8>{*J0(v++bV=Pc1rFHK*hxnaj?5_P!MMqZ;!q!<;?gE2cLt#yPp%qP}WpY z310T9^DfyZ&aGZ!r=-?50%)brW*=K^v_KkYfk>n@B&f4f(m^>(Jd-FDv;(gz78Q0% zmf^27q6g53?v^D*{r8H&k@xaG>Bk1rNQYrss&DH167&ai`(c1 zlRTvyrJTO%=SWBdXBl7Y&XDQC{V*7>Cte7=5O^W-Hrs`O4I?= z0X6CXBvdxW>hQ_0UkEha4>XN?uHN5Q;rIv+2o6yo@y16~sjdn25cC3q{w3|t1JQUPtvnv328ZoKmm!ZK*qmChv0cVRN++drWlbzSw|k!yz4wF6hc}Xz z7%eecVo5EW>0=y`^J`I6B$uRJk}k6y+NH36ZEr4)q)*asLL(?*O0IF%$xAQjq84;f zp<6`?_CFW-$#D0sDL4!$#~Y%l`x~Li<_tK58J!n zpYLv3_M)4XKZ=jB32(SnWjoiQK;6KZE*PScJw7$n@7@jBMwzAE*3e0;3y=s%gki8A ze*pdf`~h)!aV!aJHvVWwfPaVxFgJvAL%1LghszeT+N%qvoU8$>Il?Ei;5K^cf>ye2 zBa~sQ<6!Cs3qK5}^3_>9-7c3$z89Qda%IgdYi8SPr>h8XB#@ln8LJl7mHE3%LA}f{ zW0zyOcuT+;h0+iUC6>(Mx-fVU^rN5z*)rkYMPX!0A)?fY1>W(gJyl0IjJ=`5FpH)C z(&AS=x)`I@58@p=_0U)Dg(lV@FJ#m$^_63w(mYO@n{7k}T3ox?8-ctR$!b;N*#P2M zh02XiDV|u)NozTFObB)43jX{l zC5n254UdLLQ?E5=!n_s7Y;Tv%F60`7F6y-b)oa^&WC$i>K2{9SbeGAnR<(m`RoT|Z z&LX84QwSst3mP{xZs2Dxu-ql9l|%_AWfAeIo!bIMv%*8e+6m6y?ox1c&Nd?kc zsB1pdxiU?$SV$U3>EgQ^$0^OPw%;zb2rCO9#5>U`KOnP+Du^nrh$<`=k~(JX`jPk+ zES83_PJBD6R*^@KJ|0|`$6c3Kw)WKl;_R7l_g+oLIeuvws*2YKAdP6my<_tixE4F; zS}fXip(>u7qZw`Y0B0;b(zm=I6hNepGQ|NB9I@~Sr3j^{6{U!k({gc(!$8ycxX1hZ z>kN&s;a>Ko5gisfEbFh#<92PGxoH*Rm&mdE=k5L7n~S|Wm>tG53PJc8{0x4UD5#m4 z@FU_+EdoM3J6b2xQ90gG$)GfPmTCbpc~d+M_NCAea@i1S!VT4UA+5TEYU-9kIw}6y zoXFOP zcC9#cru4)X5@vd#WLeLA0QY?F+RUwK}C9%x6C-DO&l#I#zMB806dTqIIQesrQVswlLpXq$Yv0SlummI6IbjtOo>CTuvnIojN7GpJ^N4!3Z5V17~fh<0r(K zgHuDGp{LZwsR3sPIBR^KiNzq^7@Qs841zwuy!nO2AaYGo8MhQ2V+QH<)gC$1ih8S3 zDUjeSZm(h2#;%QB8@o1k?J5LhXaZ^z+C$@ov`Xo!5o{y+*{?9bs>p^-Hf$zMB?KD; zn!+ufS zyrYe&FgO=IjCd!BgCt<4-RbzTJ&7Zpb(hxkByU<>uMW<@SsfqSZ(_Bd&DP$EIIDa? zClm+@1OT(xzfjfvF-aYtUdcDV1^Tt3|_s9h$|O zE4}2Ysz|jfCWbS^888AyaeF8g?J!JP8>TQAI1rUp-F9S57r6tuV}NppBZI-`Poh4_ z?%<3{mUg8S4u1N`#nX@f!u2uDulodN;H(X4*cxZs{En2(_o$_tAV48Nu^T6G$cR*v zmcjO?>TCokRxUUwXJ5%SWKKCdK%5m#b=xGpo+$tkofrQJ;)NIQf?Ik75U%vBn<9e- zp*kdc=~!2L)Fz)Yvyo@kxG{+K_L;=cKcxF)38{t2oD z)f)AMY7x%@FCcGX?$dRqND$sR(Zr{Awy46=v8CCc(bdJx)Axt%-S5vYF5j(x-E6!c zz0KyM_?Yl5m7eyRB7-B$P`5{e>%0)fB3h#Qn|oF1xL5;P7%e>t5`y zrlm6_5~lPiGU-wJP%dJ-TsFxD97T%Ku`gXSP{r+GO2`lQS?NAp&bc(1OOun#=MZNL zaOPDyuzC;|q1#=8&PE2_u`|p-E%lXSpym|y;EWLqMl1~6PD%;IX`;RcQid|>8Ayt_ zZZ!^7gcPc96)HD&O3DcjV5CXybmXl%^2K9OUFtdvILtADy=xbdPMxMx$2b!_$wiuC zr)1J1Rs_plF+>+QLtUT(k9K_Uxz^39xngKp_Mu*5r{wyDO3N^2DJxiaCsp1un;#f( zHqC2*vjd#5Q__KV4xAm}tg}-xCES=aZfM-lxS??)f*ZTB`mq~p-voSwE8F)Tds=XE zhXM8G;Y2X?rg#ELMxzekk|~|t4Z0z~PRX~?`=9(#jCXGbOdnKcl74$hAITNT_1lqK z8lhTkQ7v{#Mhn@HD3B<`i8~UJdhB5yuJL~QscqN6;Z0FeE6`X-HaK=3@yJX22O499*2vm<&W8>FB+}ERcegQzm-u;Tb z@j0aTa;KpR?_F0U6CIA7`(hMZR;XG^GIhNiqyQU`uqnrCQ%aM!9hQA;LKzdwMo79nZz)rMIF%nI)FKG2c-6u zG>qj09{W>8L&)XE%!8Se3Rq~okXEFfLOOT%JO`+f+Cm}SvqBn+g^Gq{HtRw>A)am2 zf8Y$9fivX-?2Z6U-Xw4C7k3oWE(>X{IEi;xh)4*|z*+tl5VJ5?JUVXvI`XZT|EO)c z8|WeEA$qe}v%iQ>V|(T~ZguEpn)>B~i~SLVff&Z|CPHgWTcw-v{p*+B&eEML&OwKu zL-{${3TIZgl7KUC2F`A`-!3&A$S&zXXbl%QS%pf2Q47E1x%nl38+%q@sF*juR`nB7 zaZ_;*u;L~)Sw$mK)0R#Oos{gd&56hE0Coq&`_3upk6lRaq(#zV zHZ5|6xH5UEQ4w>v!eCHgu!qSw2M^7RPmC<*Wn^(=F!=mQa1icSFfrfkPH83+m`q?Y zfysnM?ytdZ+o{3qup z!5KJng0l!_QqdM{51gGH&KAr0GFU7n>5oFnZrQm>zW@Md2LP2sxTeXi8PnzlC__b! z>31&$p`bcCutUSy+a0Xbt8n;??-R5`6xaLei>2B z&B)LT!d;2GQule}+*_s7NHnzlPz-f*P2F}ZTC0;=a*|MGr{*2;^zB+lkX6X)euRXq z_JyqWf3kkF@kcuX{6j>56L-&3g9|c=Z^Sp^TYgD7G}{*&YNWo~*8zpKm-l&gz%h`&bJQ7^))y}mwCK3-)uO5+d!X!9LVB+fW z&{CkKP~#Zl|7RdjhfjV1K%nVHU3nA+$}C#=bOyphM8tm2Wu#XJ%Evjo|Pl zGPV49dw=)l;)V{3`NS;m~l_M9gWtkXF4a zb%g|lbV8QX)dBY9oSOnC&$U0a1BAt*QHzCjr3lU-1P}u5V9ZMH6w(yZO^{j^x5dhJ zlkRjI63=1~7K7+6C~dILdddr&F&fuK3IJz~;f%{b9eB&YXJhz8cjGcpd&SjYY_O86 zesOZ?2w}ig7#QEbe(CK52=ByraB}Z4Rf}`xsT!a^DuT=DcVP_Y82) zfa!GWAy=6zav6((zV>jQrr%jTorJEo?Awacp z4#8RXamLC82jwgcLPkg53b9z|j42xiXYBmdvu=uvq|+kMvgA75NPOAG zjbo(=&nKQwJfBevwy&;TNVEBg0RasGO{Wk?Oab-~##pn(5s`I7B%MR)b4?=>MT}zU z1Y?4+9*pBl@}TsYjyqBqQrO#Fpor{~@xZ9#Eb3;<`FjX&BE z;2$Ca%s{a;_`pzGXQ-OiASD`y56$t)0pTD(Z4OF4BMO#NWthv8JdIu%y(>&z~L z&o4jC-hETlI0*gabUyWhWf;yEVdyWW3x7461@mBD0gQ^mTS4*h<@F!0$KG~*|L`Jr ziA#Mga<-VyR;y_^TP;H2UlhNlKbZv6l|T2zhuj}*G9OG9hKJ&I-@@VRGZ&4vtAx6I z#u%kOEQYO4l9fBK{z*E-Vn1U!I0I+-`*VsImr8Pq(U>E0CtVlea=r`}%huDFdT7Km zgr7E4jB~)5h(zA_NN|y-SVi+P37S!!0gUpr)K`vyntD#yDQU2I)!y<%<<`11XL{t; z^za-qkmM?EH4a4%T`+1UD5SFo0YH=5vBO*0;fuYxggF@`tuup*FxUNNgHYXM!6Kei z>4yf+NC@lRhpri=&p^7fS1fqi-9f4X zwkoloiSqwylD8=V4s?H=8L6;gE9E(m$gHV(q4u~tH61k_H61k_+U`hr`p@B4;~}0k^dQNbbcowX3`4`&!OTeojjQoOT7_CQ4sIj*QAnF< zHm)))o6}Lvw4o6O4}?JmMk^$NqK5{~z*!Sy1DwT*Vw1ZmY{(UPlf0>`ZdH1a;4JRd zeu*|6(74@o031*aa0brWpc>$;F`N~Tj=#bvb?cQ&9pJMue5RgydzBI0t-HFLa36H= z?fJ!t$CxnSDh!P8U%&Krb3M6T;SS==jh7vqxx$&%5`S>k-E_k}6jl&67@UXJkLRY; z@y;DeJR_dvuYoI;1AY@K>)2uwV?~^OeSE5BQ=yYWCxuQ*9OQR`R!f7U#UUeEL9LE8 zB^@OlC0!>vDHAUsZ<063o8(Qi$@%=H1C#-jfp`T?+KY_BA!*SnEn+ahXcdODDN4MR zD0cqo)DTMTtsREPlbQ5&WH9*rNf<}7lgXMFwxF66S@EdNU4=-Ru-Mp-K5nv zzawQ66PwI1Fd3LkxgnfxEHLrrP-g+)y2)z_lND>@6RtT->rY$Y`h=6&E}){ z7{pEB%^@3#>&KF_mFQyBBHJb(V zU|s=?<>qr9Uta(5dhBi2_YW?wdYvuiv(;)E&Q^<1|*+6}g0|+t^aIZIi#4);cn+#ZJj+Se~AE+|Lr$d)8P8@mzAi_SHk;nf>yLVks zs+g+;%T1KqlM0xijLAH-S2DF{-haVijpB`_%-`qbH{li=FBlL8# z_m_hzVVAP>+_Kp`Y=fU~|0;f|&yRoqtk$?QnpJL0{-mg3GpO<+L9X#!E#-t|Rt7J&0S8tGf(M7$uh8UZpF~9hcOIc*E zazB4zBaVv>@J%!!I-gJW*-1G?SyApIBNN~LuQ;Z}^y73)qix<~N*5}zlOx|;G~8#j zQB+aS+^A!sfQEt<6e=3|k6LrYdB%-HM@yw^H2dV~=Mr)GBrJ;(~ zP%1u6YP+Hopx)*q5-ahn+wp8){7G2QKx<3OK8)%V@0H#|k7qP9(*n9dtID~;ie~0M zNJx{UNxi8u7&=BXGwQ4qSU=2^!zACBN-xa_L^D%=l!h{hW@c3UMSlt&lqo>P)qd?} zEzL|Zb!O3zvaQlzNiim;O1Ce27+BUKMgxrPZFFExeA=*L$aB<8^x}Co{XA)AYI>X& zfMnc0%*2CiX13it?ds3_&-m(aQ*96@n`nsi>>`~!3YE&JbCuWxf$s-lOV&hLq0_J| zP&2*e_+6TTJ7o!FNxTk31{*E!7N{;g>$g&t7~W#5@KhX&%2K&AOx7jBeV3mnWl32q zQ25#`m!yj#K28%m=GT`Z-cXrmXF0KxYMuC| zYC^hu2Q$Oq44e&l45Q2{G#J*Y8CG$-hIrPCc*c75ecsA?^_sUtpa0#8tXJ0*?&3AE zJM)Kqq1=!DFQsE6{&T^S<{NGI z3G&;i(2qTy=1JT*2>s=BKJ|iS7|s`A=r5)Ve>Iy0^I$G@oaFe%^jdsscb2W7`1tbr zkJn>wyS{&Tk!z-?-&>h2=Cjpm8qQXWP&`8MYxOn6PLW{KwuOn+&eZ6B*|!{wma{bgLh1d9;VQ2uKrCt z$(kIh1YoWSo^D&}E5|@hy#Q?NHYm-tL#zoYUBMZQTE$@erHMmd!~_`)n~P@^a5mt1 z@JxAt0H8_j2mn@_;B)&9gt=~ox%iG^3Obt|@5I6G#z9Bh6hD6w9E1*tsa!~;{ zR%J`GKkSrL4CW|dKB6Sq3%!Om9icAiJfvY`FB8zkq>HH+wWW?BJ0+u@9w#e_Fr}b# zE1sK4O(BAFU5kK5a;oUto=@MFosxNp0)`4htxUnlqgsfpRVY#k9j}D0;A`1_juPsg ziDP&*$=gL_4@(G-cA7B|VIaal6qiD~JM3F((a>$csCHm@a?lC{XMMsM0ANLiUZ(Ce zI)h+KC3U=#>Vop!_@wXq^0zuN8OMqYWezyfJ)#ioSt0l(YKi`Ndw=%^+gS;Lmb}^h zyjgVnGx4mZT|0GCU~jBrZ^TBc)Ol>Q`5S+TXXqM()is(BIU6se55txXr?BraBG?>V z!&2)(V&%cgqidu`L=AA}?if-?Q%JXQ48a*V180WIyzG-3jyD`{tY*92e!J9gAdgQp z1+%k$iBIFdj1g>{3O1#8W9_@5A^fJbKL{9!=t4(>j>hLtPYp)#?_8-#@%?SftDr z^Vw=O4QH!GDB3sT*YqcoV7l_>zW9*)gAHLkm@Etr#r9!qvkxU6>EY`$*M0kb|(BTV27oPje%l&J*99+kkpT8{%ubKWp&-m_72VTy_`cR|_6 zSItm1=s~Q%V$6#6&7*6SmVy*}JR-9?%A2M(1%;q81-GQpoDcxwH`E2#{QAYUgj)L4 z5NHk_S>vP9>>MMZF(RSDa~d57m^Z($b4+evJah@9$jH{oS1`@nw?`0TlsN zlikvxrf6Beqe756V6)TdN0~?A>cCP@LNF#6>%lmlzNB^Wr5p;pjU=tCB*>?71waHqbKGD8lRhq_6hW2t7fla$Jy zLoI-0+dy>qPu=1FxVHjJTkax0jUyAc2~@G)6s0{P_`&E;(IXoGQ`l_$(Z%Jv^{<=F z4?lXFO%g6y25+9{H2Dl*s9`vpE*A~#?9wzX$tO#shsi9s75}_z^VH*D>IVxy45#wd zsjw2Mw@L=R`TR-z^~FtYdh81L{B!ivvu2hxv*Lbl}weRkb^&jgWrgif&|mC!e_ zir@^KfwQF34nKpR!Ot4uXY7wpA9YOehN?%AR+P2fM5RyX_SxntFyg_1+b53+{?mHA{i zW3dnsJY_nr{Gdc|m_i%X95{1{GZqWwQGIad5_c@H>cb8p+`Y=cr^?5Ui9T2RcR1ur z7XyrE&xCp8YBJ7Y!1f+Z7Y2XcsET_n=pxZYYNPG|XW$H+8MJ@$W_NbT-+B&&>y9y8 zA!X|45aI-JQmvI87|w>EH$Lw1zEZ5R5Ahqh17EbvcT15WP7o(OVCR(IwJikTtR&99 zM5dNMZ}0EkT}P^x zF-WxZ$662~)Dh|kb^Q!=uEs7|3^L9K1a`ubcEZ>}X7K+~Wk(>3`Zk-9;qiboaMp%v zq$bW-43c+%iEqTWHV!a217|gG#$u3fyMZ)ykW~AC#UNf>3tFp5o`shhdlB{`>_u_m zhrKA>Kbl_&tGFE1%I!Wf;#vC0t&;#P1&LDYM|MJ-F%ZZ=pk6-Y$Kjev5vx4q<_m`j zt?_v#7K3Iz35jGTbT#xFmD!(Oq`IQ z6VEm~xArLWC|nIxgEKlRdPxM%9-maeRtxTJLZbboKY5e9x&GP=&YJMEHeN_`fGDIZ zi0L*_mX0bNRlT^<`ec3RKx9}w0<_JUuf?n=a42vna02osd6T>u=i7E|HLnV6g7(Rc zJr3+~V2{J?_S>a~19^O?14L=jgcwxR9Wuu=uW%cq`RhJ?{j>AkZ`px7ob?V;Gmp+ zB?lmKlyCc>gGWkh7WB;U5Yc(@pCDdw8wi|HaO%k-MMhHY2%zlharhbhOh-yi7SX*w zmHMaP44i>8WzwL7=+zS?ddANpdKUkIpS`)bp&?-HqZ~lqjIOiq(txB@uaRQ8zr}L@ zgYi?u$4P@6RtT->rY$Y`h=6&E}){n6O-xp7x6F0aTUVRU2|6t_*Mn&fJuu z@y+y!Xo^vozHL;|${E+ReWDk@l^T;oa3VMn+)V@*!oWTai=d_sag&U6v++ke0{lZn zfSY&qQzSKCB%P^L#h<3hU)g5*`Gx(Lp^jm1)c;g>Ja%T2-rv4bJ+Gvydgt9>UKkAvcOV#34~q zn@W#|7LfzPz90$iR@Cv1Ie5op)$XOT=H%?1sf_3f&Zyi})>MZR zMlGYEb+PNBay!pme<^jdr)>-&Xi_^i7bqRBw2y^l6KxtH{ZFHbK7(jW@ zJ=!MP{VviJBcyFvE2!6~*96}$ZuXO429#jfDXH}*VazaQ2DMIN17oKoyZ+QNI|TLU z42nNaJk}Hf6ao|iv6zvmy^q+^?8SVOJym{nbflSqO9GI17VIt+kD@_on7m2eWCpJ9 zGjQ-TnHY#?Lyu?dlswR*vh0aNGW0{TKVilc4O2AVj@;5H>aL@6%gQFHT7^f-V$51c z%v$V}jMR?2`FL<Gv3eU1cY8$P&Pg|xjaPXO7GVQngKh@hjO!yMb{dn@HmZFzZ)Bk1 zYF~cKPZR@;XU|0We>EBBq~4a_s0>r*jT%>5xWatEfaU}0-R@|A!VRt|a0brW;D6u@ zoYlY?zI|on93aDOQ7OU~)`Bmr@j0aT_u2Zj>xv{eYXN6}Yrr|tz_);)n^l2El%a!f z{UwsC{=B`vx(S{EWPr7|Ur6gXy-Lp)hIo8Q~Zb^Y!hn*FH)XW$H+-EO~KYB-R`r#miLQM;xFDpnM` zy!Eh*@pDOCZS1*>XJ1XLClxo%8G~nk68n?b*BKv7jrl==j<%%e z*d2X5%ybW6rhDSiv7=+x(Y=F%?AWCqGAYt3*EUk9i#p(Ooo`h$_+ zBBW2b?2MUb<6U9pf`f7vf>xT-+9bW6c|IdLFaDDYV!#;%ry-NT&){c8{A{tDcikkH zT)JK?tey>VLeeIok6P3Am~6eQ9Ko?T;L3xwTrVaD9xG8FK5^~h49O+adJVF zcpi9lO_t>B<6&4SCBa`E)zzcBEV^&e+f#t}C1=vGwR&u+c( z)g*7%g}sDE$?Cdf6>pR+j!}UJpaQe9O4Um0c5{d{M7j-D2+sP1GY2v*0O%6{AWoYd zKObctMGptH8lPu+Uuj#GeQ9JUG$H5^blt)4>KKBvk~sSkIXV8ky}x^NAuf*;6*sms zQ)3*@kAMcApX@~nHexw>Geg048?Zf}bDIrFSlEymdV>%^2%1O&3^>P157uj}*NVR6Ub_eJj4Wei9uER^Nda1u z6%n9uya|mNVGv<3zj&e!pbj`)9l&Lv4!mXPA^jgYG57eWA8OVQ-K0ame2DMb6?`2T zp${^``2O`vZ|7aeEoPzJ-_p_*`5pOPzxO(FKb5_;7g|%{p;6v}v(uG#w5@4dH%n@Z zpg^$$uicG##UX=@*qNgV)rM-f!5Ry3*3zb8QI6{K zID3tA90;k5Q)~8SXclXnF7i}Wq}nzt{`@;4zz7({?V(gmiOLAd$qZ*T(|imD7!1O2 zHeD{3edsK@RIW&;E(Y#1<$)uE0jnge4KbNFgoAGtQ_i198#q+0au%EoNEg`V8>kC4 zEJ4-*nmK$U3^1CIf3nOKU0Md)pQ^LL87mhYl(XOrkJMYy{}DQ4+6Dq=>@L(dY^KOy zccI=ZP1CV%ZYj23QE=8AWkJ|L*l@B!6k%gP!bX1eg|3mLs5HS1u-+`%?qmZJI@MO4 z>N+?}46IjgBa)i@Nm^YLF%&TrF^T$@QJ|kN(LAXtjr-4%2pSc(jHR}mMSe2aGN4+O z?i7M*Ij36tSE#zWcSm)MwTL7VSQ`XS{gflW8#n`Jy4)}S# zExF5=3=eXMDfP=iSp$hsiVzW;2u=i7?52+XOi|STiM-9mAMFV64-o-QY%WbMqOby`IMZy=5*0~V88aI3>CqZZpE;xK(~^Fk zu`>EnSj~R_YOufd-I)TIwsSvtkIG;A{XmqjFO*n9A*-5i7#OQ4Lc)GNln7NqS}d zSnQNMJ&}<{W4BV7Qy2|&r4l42h3>%sCPkVW_hXW;A~H|wt^ zmaigGdJGN!lhB1zcXDkpw5Hm}#;d$DO~@nU>B2^Orkg#$;0&DAz}XcGp0a9_Dp#M0 z^8ad*M~ch01NI*^0l|_3H5)H$5}u?h&q`0BYRLo8epzqBip$P(Gw8VU1FG%6Mg=IW*+(b$RuT-;;c|$>mKtn>S(BXY01^gT)JwTi_K8N(a(j9vC zPoBkIG+nI4a0 zTcY3$oPo0d0hJ4i^;oLO{NmHNUhk$k_U$fwMXxcoTUF4w8ZV?3X;(U_bG}5Ui$T6N z@)$S+XW&dZdueo>*Xr0M8zgNsM}v}2Ax$COMq&VG;0&B0*jyvn^ir@n&#QEbN5?U+ zu+^anv9f4eCpa4d&V&HbL1XqWA7Ue_FpM-gGhw5h)4!@hhsO7>UwS(tg)bMJ;md6! zLxVGL2F{W#NwgDbC$^#H^$=&jx%GeBE~Po};X}2nQ0)_1`K2=|nPwM8sq7Af#NV}> z2$pkJQJ0~zqpC=xfC52*pg>TdMz@=FxidWR=-AP*W6$+CrWL#O-lnar73|wZWaE{j zG&wUw_H$|-l-z|A%fTaa!OzaK@rwZz18B4DE_1lTV9=8=XSs@piSkZ%u=|rv9plWA z!Qk^J^e0wHz@vA!%ta1P^mO#})||Xs?tQx!|CjH7f@wRKrrJ zqIE6eKZo6Wa5jVy14iMkJUfiSZ|UqLZA}!-s1x!{+RG3&5H?y9HqbTDHPAKsu4^Q> zsz|>MMGWK;av7ELaWQZ1n#G<%s1{TUs&!&-=}&Bh6uMY9*F+;x9M2*-)@VJZsHN7q zn<8K zcw{EbLxdnUGldp)B?Dc|{&X=9l|7Sx#et>5lUme~s6p{f@vRf(NUhlkvEtMCFBC;C zrWA?b;Oy;=+(zdtx&LXi@kcuX{6j>56IWxC3n{@JxI4t15oekmLXMf2NDq@)a4Y_K zG%(a9%#DMoA1wSZoXS_HXwt4#VW=~^yq&{8$0?j~5c-&cnxq@N+0)4ia&sM8xI9n}3p=5|()1OR&>B^t`;zRBa zHsN!!Fgz5uWyay_GnW~*w@-KZj3GfFK_m;WOehsujzY=Vy1g!uhr^iHPtMT6cor__ z%V4o=J&l!P23D^6`pf{F>0WG!36+D&JRVv^sj0ozgVZyh$amh@O!xNI#PN>pm)b-I zsVTJ7SB`dnp7|?R}()CQHV%Edr+^tBJvfcD^u&gzut?8gUJ0_NXY6@xT^K~;3YvqMnXnHK5Gei>?u99 z%n)*6^tx)!Yct7Ad)b6$M&vRNt)X&x>@nM;5XlPt4XZmVE zr_b1N`OzD(-^5YwJcQcM$u9YyKRn#5pTE8QkAMB|r<=$1^Y>qGukT)8->sj2c=)=# zj{bi)Putt;_49Q5{J+2ZHhs8XKmY#ezt_+I{r>i8{ruhb=D%*X+nc}3uljKP@Q<6r z>hC~ali2@ua~Z!3@e=;+A{9f#|GfRGX|>_a=${^MzTezG75zgYD(yA8_x>W)an&l( zW=myTce8oe20!2aRs2$)AOHT#L)28r?n8{f&)$fH;Tt7qHYUC50LM`yVu72@MlAA= zzxh+VJ!|jR9r(}7yoU~+_Sh2xLcM>3Y|}zRjEzjXKLFGKV|yEc&;h=QCPe4MW%VlJ z^(^~bCzU}_R#cqgNIzj9nfQOD+3j@ib=$nDR_R2J!~_s$<0Kt7r#W_8)wnudABl%? zB$yu7c^}deZu{-hvMBmn14OEUZy^gnrD8u5b;#8uN}4n?N2C3++S!InQxG@30S^2* z>TN#KsC9v}GTo8^_H2Fn*(Di!Fqo~e8Jy9~Oo6el zde}c`rLqc??O4RQhA*0#`ye4rcANHR$XtFNAWfD_lQc7<&Wb9b95XVSnL2wjl-o2j zPu^Y;B7$DgIB53J%zSf^(hqxnYE=m67A^a4ZJ@sApGjl+)B(O}W~Q~6*ivi=^HCX} zy_q`ZbXZM_nue`EPnwz9W?3sN53-rrcJs8WKkq+3?%kR-h)7q9XPm3V)*JVkaCZtu VE`XYNwvXju!@a4R=`|;H{eO`lLx2DP literal 0 HcmV?d00001