Security: ftpd vulnerability in GNU inetutils

--000000000000d7c75e064f40b0e9
Content-Type: multipart/alternative; boundary="000000000000d7c75d064f40b0e7"

--000000000000d7c75d064f40b0e7
Content-Type: text/plain; charset="UTF-8"

Hi,

I'm writing to report a security vulnerability in GNU inetutils ftpd,
affecting all versions through 2.7.

The myoob() SIGURG handler in ftpd/ftpd.c calls multiple functions that are
not async-signal-safe, including stdio operations, syslog(), free(), and
longjmp(). When a remote attacker sends TCP urgent data (the standard FTP
ABOR sequence per RFC 959) during an active file transfer, the longjmp()
can abandon glibc's _int_free() while the arena mutex is held, permanently
deadlocking the child process.

On systems with glibc < 2.26 (no tcache), the same primitive corrupts
freelist metadata, potentially enabling arbitrary code execution. Combined
with the seteuid() privilege model (saved set-UID remains 0), this could
yield remote root.

I've attached a full writeup with root cause analysis, affected code
locations.

I'd like to propose a 30-day disclosure window from today's date. I'm happy
to work with you on a fix - the writeup includes suggested remediation
approaches (replacing signal/longjmp with a flag-based or self-pipe
approach).

I also plan to request a CVE ID from MITRE and coordinate with the distros
list once a patch is ready. Please let me know if you'd prefer a different
timeline or process.

Please confirm receipt when you can.

Best regards,
Oculytic team

--000000000000d7c75d064f40b0e7
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi,<br><br>I&#39;m writing to report a security vulnerabil=
ity in GNU inetutils ftpd, affecting all versions through 2.7.<br><br>The m=
yoob() SIGURG handler in ftpd/ftpd.c calls multiple functions that are not =
async-signal-safe, including stdio operations, syslog(), free(), and longjm=
p(). When a remote attacker sends TCP urgent data (the standard FTP ABOR se=
quence per RFC 959) during an active file transfer, the longjmp() can aband=
on glibc&#39;s _int_free() while the arena mutex is held, permanently deadl=
ocking the child process.<br><br>On systems with glibc &lt; 2.26 (no tcache=
), the same primitive corrupts freelist metadata, potentially enabling arbi=
trary code execution. Combined with the seteuid() privilege model (saved se=
t-UID remains 0), this could yield remote root.<br><br>I&#39;ve attached a =
full writeup with root cause analysis, affected code locations.<br><br>I&#3=
9;d like to propose a 30-day disclosure window from today&#39;s date. I&#39=
;m happy to work with you on a fix - the writeup includes suggested remedia=
tion approaches (replacing signal/longjmp with a flag-based or self-pipe ap=
proach).<br><br>I also plan to request a CVE ID from MITRE and coordinate w=
ith the distros list once a patch is ready. Please let me know if you&#39;d=
 prefer a different timeline or process.<br><br>Please confirm receipt when=
 you can.<br><br><div>Best regards,</div><div>Oculytic team</div></div>

--000000000000d7c75d064f40b0e7--

--000000000000d7c75e064f40b0e9
Content-Type: text/markdown; charset="UTF-8"; name="ftpd_bug.md"
Content-Disposition: attachment; filename="ftpd_bug.md"
Content-Transfer-Encoding: base64
Content-ID: <f_mnvm0ioe0>
X-Attachment-Id: f_mnvm0ioe0

IyBIZWFwIENvcnJ1cHRpb24gdmlhIEFzeW5jLVNpZ25hbC1VbnNhZmUgU0lHVVJHIEhhbmRsZXIg
aW4gR05VIGluZXR1dGlscyBmdHBkCgojIyBTdW1tYXJ5CgpHTlUgaW5ldHV0aWxzIGZ0cGQgdGhy
b3VnaCB2ZXJzaW9uIDIuNyBjb250YWlucyBhIHNpZ25hbCBoYW5kbGVyIHJhY2UgY29uZGl0aW9u
CmluIHRoZSBgbXlvb2IoKWAgZnVuY3Rpb24gKGBmdHBkL2Z0cGQuY2ApIHRoYXQgbGVhZHMgdG8g
aGVhcCBjb3JydXB0aW9uIGFuZApkZW5pYWwgb2Ygc2VydmljZS4gQSByZW1vdGUsIHVuYXV0aGVu
dGljYXRlZCBhdHRhY2tlciBjYW4gc2VuZCBUQ1AgdXJnZW50IChPT0IpCmRhdGEgb24gdGhlIEZU
UCBjb250cm9sIGNvbm5lY3Rpb24gdG8gdHJpZ2dlciBgU0lHVVJHYCBkdXJpbmcgaGVhcCBvcGVy
YXRpb25zIGluCnRoZSB0cmFuc2ZlciBwYXRoLiBUaGUgc2lnbmFsIGhhbmRsZXIgY2FsbHMgYGxv
bmdqbXAoKWAsIHdoaWNoIGNhbiBhYmFuZG9uCmdsaWJjJ3MgYF9pbnRfZnJlZSgpYCB3aGlsZSB0
aGUgYXJlbmEgbXV0ZXggaXMgaGVsZCwgcGVybWFuZW50bHkgZGVhZGxvY2tpbmcgdGhlCmNoaWxk
IHByb2Nlc3MuIE9uIG9sZGVyIGdsaWJjIHZlcnNpb25zICg8IDIuMjYpLCB0aGUgc2FtZSBwcmlt
aXRpdmUgY29ycnVwdHMKZnJlZWxpc3QgbWV0YWRhdGEsIHBvdGVudGlhbGx5IGVuYWJsaW5nIGFy
Yml0cmFyeSBjb2RlIGV4ZWN1dGlvbiBhcyByb290LgoKLSAqKkFmZmVjdGVkIHNvZnR3YXJlOioq
IEdOVSBpbmV0dXRpbHMgZnRwZCA8PSAyLjcKLSAqKkF0dGFjayB2ZWN0b3I6KiogUmVtb3RlLCB1
bmF1dGhlbnRpY2F0ZWQgKGFub255bW91cyBGVFAgb3IgYW55IHZhbGlkIGFjY291bnQpCi0gKipJ
bXBhY3Q6KiogRGVuaWFsIG9mIHNlcnZpY2UgKHBlcm1hbmVudCBjaGlsZCBkZWFkbG9jayk7IHBv
dGVudGlhbCByZW1vdGUgY29kZQogIGV4ZWN1dGlvbiBvbiBzeXN0ZW1zIHdpdGggZ2xpYmMgPCAy
LjI2Ci0gKipSb290IGNhdXNlOioqIENXRS0zNjQgKFNpZ25hbCBIYW5kbGVyIFJhY2UgQ29uZGl0
aW9uKSwgQ1dFLTQ3OSAoU2lnbmFsCiAgSGFuZGxlciBVc2Ugb2YgYSBOb24tUmVlbnRyYW50IEZ1
bmN0aW9uKQoKIyMgQmFja2dyb3VuZAoKVGhlIEZUUCBwcm90b2NvbCAoUkZDIDk1OSkgdXNlcyBU
Q1AgdXJnZW50IGRhdGEgdG8gZGVsaXZlciBvdXQtb2YtYmFuZCBjb21tYW5kcwooYEFCT1JgLCBg
U1RBVGApIGR1cmluZyBhY3RpdmUgZmlsZSB0cmFuc2ZlcnMuIFRoZSBmdHBkIHNlcnZlciByZWdp
c3RlcnMKYG15b29iKClgIGFzIHRoZSBoYW5kbGVyIGZvciBgU0lHVVJHYCwgd2hpY2ggdGhlIGtl
cm5lbCBkZWxpdmVycyB3aGVuIHVyZ2VudApkYXRhIGFycml2ZXMgb24gdGhlIGNvbnRyb2wgc29j
a2V0LiBUaGUgY29udHJvbCBzb2NrZXQgaGFzIGBTT19PT0JJTkxJTkVgCmVuYWJsZWQsIHNvIHRo
ZSB1cmdlbnQgYnl0ZSBpcyBwbGFjZWQgaW4gdGhlIG5vcm1hbCBkYXRhIHN0cmVhbSBhbmQgcmVh
ZCBieQpgdGVsbmV0X2ZnZXRzKClgIGluc2lkZSB0aGUgaGFuZGxlci4KCiMjIFZ1bG5lcmFiaWxp
dHkgRGV0YWlscwoKIyMjIFRoZSBTaWduYWwgSGFuZGxlcgoKVGhlIGBteW9vYigpYCBoYW5kbGVy
IChgZnRwZC5jOjE5MTVgKSBjYWxscyBtdWx0aXBsZSBmdW5jdGlvbnMgdGhhdCBhcmUgbm90CmFz
eW5jLXNpZ25hbC1zYWZlOgoKYGBgYwpzdGF0aWMgdm9pZApteW9vYiAoaW50IHNpZ25vIE1BWUJF
X1VOVVNFRCkKewogIGNoYXIgKmNwOwoKICBpZiAoIXRyYW5zZmxhZykKICAgIHJldHVybjsKICBj
cCA9IHRtcGxpbmU7CiAgaWYgKHRlbG5ldF9mZ2V0cyAoY3AsIDcsIHN0ZGluKSA9PSBOVUxMKSAg
ICAgICAvKiBzdGRpbzogbm90IHNhZmUgKi8KICAgIHsKICAgICAgcmVwbHkgKDIyMSwgIllvdSBj
b3VsZCBhdCBsZWFzdCBzYXkgZ29vZGJ5ZS4iKTsKICAgICAgZG9sb2dvdXQgKDApOyAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAvKiBmcmVlKCk6IG5vdCBzYWZlICovCiAgICB9CiAgdXBw
ZXIgKGNwKTsKICBpZiAoc3RyY21wIChjcCwgIkFCT1JcclxuIikgPT0gMCkKICAgIHsKICAgICAg
dG1wbGluZVswXSA9ICdcMCc7CiAgICAgIHJlcGx5ICg0MjYsICJUcmFuc2ZlciBhYm9ydGVkLiAu
Li4iKTsgICAgICAgLyogcHJpbnRmL3N5c2xvZzogbm90IHNhZmUgKi8KICAgICAgcmVwbHkgKDIy
NiwgIkFib3J0IHN1Y2Nlc3NmdWwiKTsKICAgICAgbG9uZ2ptcCAodXJnY2F0Y2gsIDEpOyAgICAg
ICAgICAgICAgICAgICAgICAvKiBhYmFuZG9ucyBjYWxsZXIgc3RhdGUgKi8KICAgIH0KICBpZiAo
c3RyY21wIChjcCwgIlNUQVRcclxuIikgPT0gMCkKICAgIHsKICAgICAgcmVwbHkgKDIxMywgIlN0
YXR1czogJXMgYnl0ZXMgdHJhbnNmZXJyZWQiLAogICAgICAgICAgICAgb2ZmX3RvX3N0ciAoYnl0
ZV9jb3VudCkpOyAgICAgICAgICAgICAvKiBwcmludGYvc3lzbG9nOiBub3Qgc2FmZSAqLwogICAg
fQp9CmBgYAoKVGhlIHVuc2FmZSBvcGVyYXRpb25zIGluY2x1ZGU6Cgp8IENhbGwgfCBVbnNhZmUg
YmVjYXVzZSB8CnwtLS0tLS18LS0tLS0tLS0tLS0tLS0tLXwKfCBgdGVsbmV0X2ZnZXRzKClgIOKG
kiBgZ2V0YyhzdGRpbilgIHwgc3RkaW8gcmUtZW50cmFuY3k7IG1heSBjb3JydXB0IGBGSUxFYCBp
bnRlcm5hbCBzdGF0ZSB8CnwgYHJlcGx5KClgIOKGkiBgcHJpbnRmKClgL2BmZmx1c2goKWAgfCBz
dGRpbyByZS1lbnRyYW5jeSBvbiBgc3Rkb3V0YCB8CnwgYHJlcGx5KClgIOKGkiBgc3lzbG9nKClg
IHwgbWF5IGNhbGwgYG1hbGxvYygpYCBpbnRlcm5hbGx5IHwKfCBgZG9sb2dvdXQoKWAg4oaSIGBl
bmRfbG9naW4oKWAg4oaSIGBmcmVlKClgIHwgaGVhcCByZS1lbnRyYW5jeSB8CnwgYGxvbmdqbXAo
dXJnY2F0Y2gsIDEpYCB8IGFiYW5kb25zIGNhbGxlcidzIHN0YWNrIGZyYW1lIGFuZCBhbnkgaGVs
ZCBsb2NrcyB8CgojIyMgVGhlIEhlYXAgQ29ycnVwdGlvbiBQcmltaXRpdmUKCkR1cmluZyBhIGBT
VE9SYCAoZmlsZSB1cGxvYWQpIGluIGJpbmFyeSBtb2RlLCBgcmVjZWl2ZV9kYXRhKClgIGFsbG9j
YXRlcyBhCmJ1ZmZlciB2aWEgYG1hbGxvYygpYCBhbmQgZnJlZXMgaXQgYWZ0ZXIgdGhlIHRyYW5z
ZmVyIGxvb3A6CgpgYGBjCnN0YXRpYyBpbnQKcmVjZWl2ZV9kYXRhIChGSUxFICppbnN0ciwgRklM
RSAqb3V0c3RyLCBvZmZfdCBibGtzaXplKQp7CiAgY2hhciAqYnVmOwoKICB0cmFuc2ZsYWcrKzsK
ICBpZiAoc2V0am1wICh1cmdjYXRjaCkpCiAgICB7CiAgICAgIHRyYW5zZmxhZyA9IDA7CiAgICAg
IHJldHVybiAtMTsgICAgICAgICAgICAgIC8qIGxvbmdqbXAgbGFuZHMgaGVyZSAqLwogICAgfQoK
ICAvKiBUWVBFIEkgLyBUWVBFIEwgKi8KICBidWYgPSBtYWxsb2MgKCh1bnNpZ25lZCBpbnQpIGJs
a3NpemUpOyAgLyogdHlwaWNhbGx5IDQwOTYgYnl0ZXMgKi8KCiAgd2hpbGUgKChjbnQgPSByZWFk
IChmaWxlbm8gKGluc3RyKSwgYnVmLCBibGtzaXplKSkgPiAwKQogICAgewogICAgICBpZiAod3Jp
dGUgKGZpbGVubyAob3V0c3RyKSwgYnVmLCBjbnQpICE9IGNudCkKICAgICAgICB7CiAgICAgICAg
ICBmcmVlIChidWYpOwogICAgICAgICAgZ290byBmaWxlX2VycjsKICAgICAgICB9CiAgICAgIGJ5
dGVfY291bnQgKz0gY250OwogICAgfQogIGZyZWUgKGJ1Zik7ICAgICAgICAgICAgICAvKiA8LS0g
U0lHVVJHIGNhbiBmaXJlIGhlcmUgKi8KICBpZiAoY250IDwgMCkKICAgIGdvdG8gZGF0YV9lcnI7
CiAgdHJhbnNmbGFnID0gMDsgICAgICAgICAgIC8qIDwtLSBzdGlsbCAxIGR1cmluZyBmcmVlKCkg
YWJvdmUgKi8KICByZXR1cm4gMDsKfQpgYGAKClRoZSBjcml0aWNhbCB3aW5kb3cgaXMgYXQgYGZy
ZWUoYnVmKWAgKGxpbmUgMTUxNCkuIEF0IHRoaXMgcG9pbnQ6CgoxLiBgdHJhbnNmbGFnYCBpcyBz
dGlsbCBub256ZXJvIChzZXQgdG8gMCB0d28gbGluZXMgbGF0ZXIpCjIuIGdsaWJjJ3MgYF9pbnRf
ZnJlZSgpYCBoYXMgYWNxdWlyZWQgdGhlIGFyZW5hIG11dGV4IGFuZCBpcyBtYW5pcHVsYXRpbmcg
YmluCiAgIG1ldGFkYXRhCgpJZiBgU0lHVVJHYCBpcyBkZWxpdmVyZWQgZHVyaW5nIGBfaW50X2Zy
ZWUoKWAg4oCUIHZpYSBhIHRpbWVyIGludGVycnVwdCBvcgppbnRlci1wcm9jZXNzb3IgaW50ZXJy
dXB0IOKAlCB0aGUgaGFuZGxlciBydW5zLiBCZWNhdXNlIGB0cmFuc2ZsYWdgIGlzIHN0aWxsIHNl
dCwKdGhlIGhhbmRsZXIgcHJvY2Vzc2VzIHRoZSBjb21tYW5kLiBJZiB0aGUgY29tbWFuZCBpcyBg
QUJPUmAsIHRoZSBoYW5kbGVyIGNhbGxzCmBsb25nam1wKHVyZ2NhdGNoLCAxKWAsIHdoaWNoOgoK
LSBBYmFuZG9ucyBgX2ludF9mcmVlKClgIG1pZC1vcGVyYXRpb24KLSBMZWF2ZXMgdGhlIGFyZW5h
IG11dGV4IHBlcm1hbmVudGx5IGhlbGQKLSBMZWF2ZXMgYmluIHBvaW50ZXJzIGluIGEgcGFydGlh
bGx5LXVwZGF0ZWQgc3RhdGUKCkNvbnRyb2wgcmV0dXJucyB0byB0aGUgYHNldGptcGAgaW4gYHJl
Y2VpdmVfZGF0YSgpYCwgd2hpY2ggcmV0dXJucyBgLTFgIHRvCmBzdG9yZSgpYC4gVGhlIGNhbGxl
ciB0aGVuIGV4ZWN1dGVzIGBmY2xvc2UoZGluKWAgKGxpbmUgMTEzNyksIHdoaWNoIGludGVybmFs
bHkKY2FsbHMgYGZyZWUoKWAgb24gdGhlIGBGSUxFYCBvYmplY3QncyA4MTkyLWJ5dGUgSS9PIGJ1
ZmZlci4gVGhpcyBzZWNvbmQgYGZyZWUoKWAKYXR0ZW1wdHMgdG8gYWNxdWlyZSB0aGUgYXJlbmEg
bXV0ZXg6CgotICoqZ2xpYmMgPj0gMi4zIChOUFRMKToqKiBgbGxsX2xvY2tgIG9uIHRoZSBhbHJl
YWR5LWhlbGQgbXV0ZXgg4oaSCiAgYGZ1dGV4X3dhaXRgIOKGkiAqKnBlcm1hbmVudCBkZWFkbG9j
ayoqCi0gKipnbGliYyA8IDIuMjYgKG5vIHRjYWNoZSk6KiogbXV0ZXggbWF5IG5vdCBkZWFkbG9j
ayBmb3Igc2luZ2xlLXRocmVhZGVkCiAgcHJvY2Vzc2VzLCBidXQgdGhlIGNvcnJ1cHRlZCBiaW4g
bWV0YWRhdGEgaXMgYWNjZXNzZWQg4oaSICoqY3Jhc2ggb3IKICB3cml0ZS13aGF0LXdoZXJlKioK
CiMjIyBUaGUgTWVtb3J5IExlYWsgUHJpbWl0aXZlIChtbWFwIHBhdGgpCgpgc2VuZF9kYXRhKClg
IHVzZXMgYG1tYXAoKWAgZm9yIGZpbGVzIHVuZGVyIDggTUIuIFRoZSBtYXBwaW5nIGlzIG9ubHkg
cmVsZWFzZWQKYnkgYG11bm1hcCgpYCBhdCB0aGUgZW5kIG9mIHRoZSB0cmFuc2Zlci4gQSBgbG9u
Z2ptcGAgZnJvbSB0aGUgaGFuZGxlciBza2lwcwpgbXVubWFwKClgLCBsZWFraW5nIHRoZSBtYXBw
aW5nLiBPbiAzMi1iaXQgc3lzdGVtcywgcmVwZWF0ZWQgZXhwbG9pdGF0aW9uCmV4aGF1c3RzIHRo
ZSAzIEdCIHZpcnR1YWwgYWRkcmVzcyBzcGFjZSBpbiBodW5kcmVkcyBvZiBpdGVyYXRpb25zLCBj
cmFzaGluZyB0aGUKY2hpbGQuCgojIyMgUHJpdmlsZWdlIEVzY2FsYXRpb24gQ29udGV4dAoKVGhl
IGZ0cGQgY2hpbGQgZHJvcHMgcHJpdmlsZWdlcyB3aXRoIGBzZXRldWlkKClgLCBub3QgYHNldHVp
ZCgpYC4gVGhlIHNhdmVkCnNldC11c2VyLUlEIHJlbWFpbnMgMC4gQW55IGNvZGUgZXhlY3V0aW9u
IGluIHRoZSBjaGlsZCBjYW4gcmVjbGFpbSByb290OgoKYGBgYwpzZXRldWlkKDApOyAgICAgICAg
ICAgLyogc2F2ZWQgc2V0LVVJRCBpcyByb290ICovCmV4ZWN2ZSgiL2Jpbi9zaCIsIC4uLik7CmBg
YAoKIyMgVHJpZ2dlcmluZyB0aGUgQnVnCgpUaGUgYXR0YWNrZXIgc2VuZHMgVENQIHVyZ2VudCBk
YXRhICh0aGUgc3RhbmRhcmQgRlRQIGBBQk9SYCBzZXF1ZW5jZSBwZXIgUkZDCjk1OSkgb24gdGhl
IGNvbnRyb2wgY29ubmVjdGlvbiB3aGlsZSBhIGZpbGUgdHJhbnNmZXIgaXMgYWN0aXZlOgoKMS4g
QXV0aGVudGljYXRlIChhbm9ueW1vdXMgb3IgYW55IHZhbGlkIGFjY291bnQpCjIuIFNldCBgVFlQ
RSBJYCAoYmluYXJ5IG1vZGUpCjMuIElzc3VlIGBQQVNWYCwgY29ubmVjdCBkYXRhIHNvY2tldAo0
LiBJc3N1ZSBgU1RPUiA8ZmlsZW5hbWU+YCwgcmVjZWl2ZSBgMTUwYAo1LiBDbG9zZSBkYXRhIHNv
Y2tldCAoemVyby1ieXRlIHVwbG9hZCkg4oaSIHNlcnZlciBjYWxscyBgcmVhZCgpYCDihpIgcmV0
dXJucyAwIOKGkgogICBgZnJlZShidWYpYAo2LiBTZW5kIGBJQUMgSVBgICsgYElBQyBETWAgKHdp
dGggYE1TR19PT0JgKSArIGBBQk9SXHJcbmAgb24gdGhlIGNvbnRyb2wKICAgY29ubmVjdGlvbiDi
hpIga2VybmVsIGdlbmVyYXRlcyBgU0lHVVJHYAoKSWYgdGhlIGBTSUdVUkdgIGlzIGRlbGl2ZXJl
ZCBkdXJpbmcgYGZyZWUoYnVmKWAg4oCUIHdoaWNoIHJlcXVpcmVzIGEgdGltZXIKaW50ZXJydXB0
IG9yIElQSSB0byBpbnRlcnJ1cHQgdGhlIHVzZXJzcGFjZSBgX2ludF9mcmVlKClgIGNhbGwg4oCU
IHRoZSBgbG9uZ2ptcGAKYWJhbmRvbnMgdGhlIGhlYXAgb3BlcmF0aW9uLgoKVGhlIHByb2JhYmls
aXR5IHBlciBhdHRlbXB0IGlzIGFwcHJveGltYXRlbHk6Cgp8IENvbmZpZ3VyYXRpb24gfCBgZnJl
ZSgpYCBkdXJhdGlvbiB8IFAoaGl0IHBlciBjeWNsZSkgfAp8LS0tLS0tLS0tLS0tLS0tfC0tLS0t
LS0tLS0tLS0tLS0tLS18LS0tLS0tLS0tLS0tLS0tLS0tfAp8IERlZmF1bHQgYnVpbGQsIDEwMDAg
SHoga2VybmVsIHwgfjEgzrxzIHwgfjAuMSUgfAp8IERlZmF1bHQgYnVpbGQsIDI1MCBIeiBrZXJu
ZWwgfCB+MSDOvHMgfCB+MC4wMjUlIHwKfCBgTUFMTE9DX0NIRUNLXz0zYCB8IH4z4oCTNSDOvHMg
fCB+MC4x4oCTMC41JSB8CnwgQVNhbiBidWlsZCAoYC1mc2FuaXRpemU9YWRkcmVzc2ApIHwgfjEw
IM68cyB8IH4xJSB8CnwgTG9jYWwgYGtpbGwoKWAgYm9tYmFyZG1lbnQgKG11bHRpLWNvcmUpIHwg
fjEgzrxzIHwgfjIwJSB8CgojIyBJbXBhY3QKCiMjIyBEZW5pYWwgb2YgU2VydmljZSAoYWxsIGds
aWJjIHZlcnNpb25zKQoKRWFjaCBzdWNjZXNzZnVsIHRyaWdnZXIgcGVybWFuZW50bHkgZGVhZGxv
Y2tzIChvciBjcmFzaGVzKSBvbmUgZnRwZCBjaGlsZApwcm9jZXNzLiBUaGUgY2hpbGQgZW50ZXJz
IGFuIHVucmVjb3ZlcmFibGUgYGZ1dGV4X3dhaXRgIG9uIHRoZSBhcmVuYSBtdXRleC4gT24KYGlu
ZXRkYC1iYXNlZCBkZXBsb3ltZW50cywgcmVwZWF0ZWQgZXhwbG9pdGF0aW9uIGV4aGF1c3RzIHRo
ZSBwcm9jZXNzIHRhYmxlIG9yCmNvbm5lY3Rpb24gbGltaXRzLgoKQ29uZmlybWVkIGJ5IGF0dGFj
aGluZyB0byB0aGUgY2hpbGQgcHJvY2VzcyBhZnRlciB0cmlnZ2VyaW5nOgoKYGBgCmZ1dGV4X3dh
aXQKICBfX2xsbF9sb2NrX3dhaXQKICAgIG1hbGxvYyAgICAgICAgICAgIOKGkCBibG9ja2VkIGFj
cXVpcmluZyBhYmFuZG9uZWQgYXJlbmEgbXV0ZXgKICAgICAgcmVjZWl2ZV9kYXRhCiAgICAgICAg
c3RvcmUKYGBgCgojIyMgSGVhcCBNZXRhZGF0YSBDb3JydXB0aW9uIChnbGliYyA8IDIuMjYpCgpP
biBzeXN0ZW1zIHdpdGhvdXQgdGNhY2hlIChnbGliYyA8IDIuMjYsIGNvbW1vbiBvbiAzMi1iaXQg
YW5kIG9sZGVyCmRpc3RyaWJ1dGlvbnMpLCB0aGUgYXJlbmEgbXV0ZXggaGFuZGxpbmcgZGlmZmVy
cyBmb3Igc2luZ2xlLXRocmVhZGVkIHByb2Nlc3Nlcy4KVGhlIGBmY2xvc2UoKWAg4oaSIGBmcmVl
KClgIGFmdGVyIHRoZSBgbG9uZ2ptcGAgYWNjZXNzZXMgdGhlIGNvcnJ1cHRlZCB1bnNvcnRlZApi
aW4sIGZvbGxvd2luZyBwYXJ0aWFsbHktdXBkYXRlZCBgZmRgL2Bia2AgcG9pbnRlcnMuIFRoaXMg
Z2l2ZXMgYW4gYXR0YWNrZXIgYQp3cml0ZSBwcmltaXRpdmUgZXhwbG9pdGFibGUgdmlhIHN0YW5k
YXJkIHRlY2huaXF1ZXMgKHVuc29ydGVkIGJpbiBhdHRhY2ssCmBfX2ZyZWVfaG9va2Agb3Zlcndy
aXRlKS4KCkNvbWJpbmVkIHdpdGggdGhlIGBzZXRldWlkKDApYCBwcml2aWxlZ2UgbW9kZWwsIHN1
Y2Nlc3NmdWwgZXhwbG9pdGF0aW9uIHlpZWxkcwoqKnJlbW90ZSByb290KiouCgojIyMgVmlydHVh
bCBBZGRyZXNzIFNwYWNlIEV4aGF1c3Rpb24gKDMyLWJpdCwgbW1hcCBwYXRoKQoKUmVwZWF0ZWQg
YFJFVFJgICsgYEFCT1JgIGFnYWluc3QgYG1tYXBgLWVkIGZpbGVzIGxlYWtzIH404oCTOCBNQiBv
ZiB2aXJ0dWFsCmFkZHJlc3Mgc3BhY2UgcGVyIGN5Y2xlLiBPbiAzMi1iaXQgc3lzdGVtcyAoMyBH
QiB1c2VyIFZBUyksIH40MDDigJM3NjggY3ljbGVzCmV4aGF1c3QgdGhlIGFkZHJlc3Mgc3BhY2Us
IGNyYXNoaW5nIHRoZSBjaGlsZC4KCiMjIEFmZmVjdGVkIENvZGUKCnwgRmlsZSB8IEZ1bmN0aW9u
IHwgTGluZSB8IElzc3VlIHwKfC0tLS0tLXwtLS0tLS0tLS0tfC0tLS0tLXwtLS0tLS0tfAp8IGBm
dHBkL2Z0cGQuY2AgfCBgbXlvb2IoKWAgfCAxOTE14oCTMTk0NSB8IFNpZ25hbCBoYW5kbGVyIGNh
bGxzIG5vbi1hc3luYy1zaWduYWwtc2FmZSBmdW5jdGlvbnMgfAp8IGBmdHBkL2Z0cGQuY2AgfCBg
bXlvb2IoKWAgfCAxOTM1IHwgYGxvbmdqbXAoKWAgZnJvbSBzaWduYWwgY29udGV4dCBhYmFuZG9u
cyBoZWxkIGxvY2tzIHwKfCBgZnRwZC9mdHBkLmNgIHwgYHJlY2VpdmVfZGF0YSgpYCB8IDE1MTQg
fCBgZnJlZShidWYpYCB3aGlsZSBgdHJhbnNmbGFnYCBpcyBzdGlsbCBzZXQgfAp8IGBmdHBkL2Z0
cGQuY2AgfCBgcmVjZWl2ZV9kYXRhKClgIHwgMTQ4N+KAkzE0OTEgfCBgc2V0am1wYC9gbG9uZ2pt
cGAgdXNlZCBmb3IgdHJhbnNmZXIgYWJvcnQgfAp8IGBmdHBkL2Z0cGQuY2AgfCBgc2VuZF9kYXRh
KClgIHwgMTMxNuKAkzE0NzQgfCBgbG9uZ2ptcGAgc2tpcHMgYG11bm1hcCgpYCBjbGVhbnVwIHwK
fCBgZnRwZC9mdHBkLmNgIHwgYHN0b3JlKClgIHwgMTEzNyB8IGBmY2xvc2UoZGluKWAgYWZ0ZXIg
YHJlY2VpdmVfZGF0YWAgZXJyb3IgZGVhZGxvY2tzIG9uIGFyZW5hIG11dGV4IHwKCiMjIFN1Z2dl
c3RlZCBGaXgKClJlcGxhY2UgdGhlIGBzaWduYWwoKWAtYmFzZWQgYFNJR1VSR2AgaGFuZGxlciB3
aXRoIGEgc2VsZi1waXBlIG9yCmBzaWduYWxmZCgpYC1iYXNlZCBhcHByb2FjaCB0aGF0IGRlZmVy
cyBPT0IgY29tbWFuZCBwcm9jZXNzaW5nIHRvIHRoZSBtYWluIGV2ZW50Cmxvb3AuIEF0IG1pbmlt
dW06CgoxLiBSZW1vdmUgYGxvbmdqbXAoKWAgZnJvbSB0aGUgc2lnbmFsIGhhbmRsZXIuIFVzZSBh
IGB2b2xhdGlsZSBzaWdfYXRvbWljX3RgCiAgIGZsYWcgaW5zdGVhZCwgY2hlY2tlZCBpbiB0aGUg
dHJhbnNmZXIgbG9vcC4KMi4gRG8gbm90IGNhbGwgYHRlbG5ldF9mZ2V0cygpYCwgYHJlcGx5KClg
LCBgc3lzbG9nKClgLCBvciBhbnkgc3RkaW8vaGVhcAogICBmdW5jdGlvbiBmcm9tIHNpZ25hbCBj
b250ZXh0LgozLiBDb25zaWRlciB1c2luZyBgc2lnYWN0aW9uKClgIHdpdGggYFNBX1JFU1RBUlRg
IGFuZCBtYXNraW5nIGBTSUdVUkdgIGR1cmluZwogICBgbWFsbG9jYC9gZnJlZWAgY3JpdGljYWwg
c2VjdGlvbnMuCgo=
--000000000000d7c75e064f40b0e9--