GNU inetutils telnet client: SLC LINEMODE global buffer overflow and address disclosure

--0000000000004840e80656760e38
Content-Type: multipart/alternative; boundary="0000000000004840e60656760e36"

--0000000000004840e60656760e36
Content-Type: text/plain; charset="UTF-8"

Subject: GNU inetutils telnet client: SLC LINEMODE global buffer overflow
and address disclosure

Hello GNU Inetutils maintainers,

We would like to report a client-side memory corruption and information
disclosure issue in GNU inetutils telnet.

The client appends LINEMODE SLC reply triplets to the fixed 128-byte global
buffer `slc_reply` through `slc_replyp`, without checking the remaining
space:

  telnet/telnet.c:1484-1489, slc_add_reply()

A malicious or impersonated Telnet server can negotiate LINEMODE and send an
oversized SLC suboption. For `func > NSLC` with supported SLC level bits,
`slc()` repeatedly calls:

  slc_add_reply (func, SLC_NOSUPPORT, 0);

This overflows `slc_reply[128]`. `slc_end_reply()` also writes its final
`IAC SE` bytes without a bound check and derives the network reply length
from
the potentially corrupted cursor.

We validated two effects on GNU inetutils 2.8 under Ubuntu 24.04.4 LTS on
WSL,
x86-64, GCC 13.3.0:

  1. An ASan build reports a global-buffer-overflow in `slc_add_reply()` at
     telnet.c:1486.
  2. In an otherwise identically configured non-ASan `-O0` PIE build where
     the storage for the global `slc_replyp` variable begins at
     `slc_reply + 0x80`, a partial overwrite of `slc_replyp` causes
     `slc_end_reply()` to copy bytes beyond `slc_reply` into the network
ring.
     The supplied two-stage PoC receives BSS/PIE pointers and derives the
     randomized `slc_reply` address.

The demonstrated disclosure is layout-dependent. We are reporting a
validated
BSS/PIE address disclosure; we are not claiming a heap disclosure,
arbitrary-address read, or arbitrary-width write.

We also reviewed Savannah revision
7c58506a8eadbc4b57ccb330babed31dd5a5558f. `git ls-remote` confirmed on
2026-07-13 that this revision is both HEAD and master. Its latest commit is
dated 2026-05-04 (`whois: don't overflow a buffer when the servers doesn't
send
a newline`), and the vulnerable path remains present.

Although this is the same vulnerability class as CVE-2005-0469 in
BSD-derived
Telnet clients, the corresponding `slc_add_reply()` path remains unpatched
and
exploitable in GNU inetutils `telnet`. We are therefore reporting it for
remediation and appropriate vulnerability tracking.

The attached report contains the source walk-through, identical configure
options for ASan and non-ASan builds (only CFLAGS/LDFLAGS differ), exact
direct
run commands, representative ASan and leak output, and remediation guidance.
The PoC uses `--crash` for ASan validation and defaults to the two-stage
leak
mode for the matching non-ASan build.

A complete fix should bound every escaped SLC triplet append while reserving
space for the final marker, and independently guard the `IAC SE` writes in
`slc_end_reply()`.

Credit
------

We would appreciate it if you could credit this finding to Junhyuk IM(S2W)
and Seungyun Lee(S2W).

Regards,
Junhyuk IM(S2W)
Seungyun Lee(S2W)

--0000000000004840e60656760e36
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div>Subject: GNU inetutils telnet client=
: SLC LINEMODE global buffer overflow and address disclosure<br><br>Hello G=
NU Inetutils maintainers,<br><br>We would like to report a client-side memo=
ry corruption and information<br>disclosure issue in GNU inetutils telnet.<=
br><br>The client appends LINEMODE SLC reply triplets to the fixed 128-byte=
 global<br>buffer `slc_reply` through `slc_replyp`, without checking the re=
maining space:<br><br>=C2=A0 telnet/telnet.c:1484-1489, slc_add_reply()<br>=
<br>A malicious or impersonated Telnet server can negotiate LINEMODE and se=
nd an<br>oversized SLC suboption. For `func &gt; NSLC` with supported SLC l=
evel bits,<br>`slc()` repeatedly calls:<br><br>=C2=A0 slc_add_reply (func, =
SLC_NOSUPPORT, 0);<br><br>This overflows `slc_reply[128]`. `slc_end_reply()=
` also writes its final<br>`IAC SE` bytes without a bound check and derives=
 the network reply length from<br>the potentially corrupted cursor.<br><br>=
We validated two effects on GNU inetutils 2.8 under Ubuntu 24.04.4 LTS on W=
SL,<br>x86-64, GCC 13.3.0:<br><br>=C2=A0 1. An ASan build reports a global-=
buffer-overflow in `slc_add_reply()` at<br>=C2=A0 =C2=A0 =C2=A0telnet.c:148=
6.<br>=C2=A0 2. In an otherwise identically configured non-ASan `-O0` PIE b=
uild where<br>=C2=A0 =C2=A0 =C2=A0the storage for the global `slc_replyp` v=
ariable begins at<br>=C2=A0 =C2=A0 =C2=A0`slc_reply + 0x80`, a partial over=
write of `slc_replyp` causes<br>=C2=A0 =C2=A0 =C2=A0`slc_end_reply()` to co=
py bytes beyond `slc_reply` into the network ring.<br>=C2=A0 =C2=A0 =C2=A0T=
he supplied two-stage PoC receives BSS/PIE pointers and derives the<br>=C2=
=A0 =C2=A0 =C2=A0randomized `slc_reply` address.<br><br>The demonstrated di=
sclosure is layout-dependent. We are reporting a validated<br>BSS/PIE addre=
ss disclosure; we are not claiming a heap disclosure,<br>arbitrary-address =
read, or arbitrary-width write.<br><br>We also reviewed Savannah revision<b=
r>7c58506a8eadbc4b57ccb330babed31dd5a5558f. `git ls-remote` confirmed on<br=
>2026-07-13 that this revision is both HEAD and master. Its latest commit i=
s<br>dated 2026-05-04 (`whois: don&#39;t overflow a buffer when the servers=
 doesn&#39;t send<br>a newline`), and the vulnerable path remains present.<=
br><br>Although this is the same vulnerability class as CVE-2005-0469 in BS=
D-derived<br>Telnet clients, the corresponding `slc_add_reply()` path remai=
ns unpatched and<br>exploitable in GNU inetutils `telnet`. We are therefore=
 reporting it for<br>remediation and appropriate vulnerability tracking.<br=
><br>The attached report contains the source walk-through, identical config=
ure<br>options for ASan and non-ASan builds (only CFLAGS/LDFLAGS differ), e=
xact direct<br>run commands, representative ASan and leak output, and remed=
iation guidance.<br>The PoC uses `--crash` for ASan validation and defaults=
 to the two-stage leak<br>mode for the matching non-ASan build.<br><br>A co=
mplete fix should bound every escaped SLC triplet append while reserving<br=
>space for the final marker, and independently guard the `IAC SE` writes in=
<br>`slc_end_reply()`.<br><br>Credit<br>------<br><br>We would appreciate i=
t if you could credit this finding to Junhyuk IM(S2W)<br>and Seungyun Lee(S=
2W).<br><br>Regards,<br>Junhyuk IM(S2W)<br>Seungyun Lee(S2W)<br></div></div=
>
</div>

--0000000000004840e60656760e36--

--0000000000004840e80656760e38
Content-Type: application/zip; name="inetutils-client-slc-disclosure.zip"
Content-Disposition: attachment; 
	filename="inetutils-client-slc-disclosure.zip"
Content-Transfer-Encoding: base64
Content-ID: <f_mrilzu9p1>
X-Attachment-Id: f_mrilzu9p1

UEsDBBQAAAAIAABa7VwRPzHS3RAAAPMpAABGAAAAaW5ldHV0aWxzLWNsaWVudC1zbGMtZGlzY2xv
c3VyZS9nbnUtaW5ldHV0aWxzLXRlbG5ldC1jbGllbnQtc2xjLW9vYi5tZO1abXMbN5L+jl/RF2+t
JYdDjSjJVqTzVsmMktWVYrlMJ/6QpDTgTJNENAPMAhiRzO3996tuYF5IyZXbvb1v90niDIAB+uXp
7qfxAr5//yMojb7xqnTgsdToIS8Vag+z2ync3ry//uHu22tYlmYuS5g3iwVaMI9oF6VZg9QFyKKw
6BwUyuWlcY1FIV68gOsN5o1Xjwizpqqk3Qqx+7UsfC4DWdeoCwcO7SPaROlF2aDOseg/T3uxWJcK
HXgDfoVioTZYwPHkPJlvPe5tMHNlfk8TthmslV+ZxkO+wvxB6SUo78BiJZWmX66WOY7FlQbpvcwf
0Ca50d6assQCjAVV1Wid0dJjAZ+CiMJWIZcavFXLJVqQcQtiX0ZFY+k7pvbKaNC4NF5J+n8MNxok
eHS0sjY6uZpJDR9urmHeqLIY8Tl7WZfOQC2tV7Ist7z+2ipPElkhyOI3mZPa+qPXGeSNdcZe8ohS
erSCX6MuwpCDwwxK1Eu/glyWeVPyxmi4hlw2Dh2QdB3McWt0sSNXb2COIje1wiIqBTT6tbEPQCce
tRZBp383mx3RwaKxdGqMkhwL8RnhUZaqYDHTG+Vcg6D0npFOxudgNPw4b7RvYHI6Tk/Hp3D7aQaN
LtDC59ntSGzOXyevT0ese/h+OoXjk/HJOB3DDRz8R6NX2+YBbn44ZDl7tmIrNUgNrIHc6IVaNjYK
wwh+YCvelml8YhbJ3DRks6yBUfADDcav0K6VQ1AFaq9y1lS7HBaiU3KW3KVZr2qSxvAjT31qDJ8x
mIDFR4VrLGAmH6XWcsVPnDJaZG/ys/Oz9LU8R1nM89P52Zs8n5+cpHM5x+LkuCjO5NnZ2fkiG8Od
hkk6eZ2kb5LjEzI16buFYC2dmBu/4s1YrI1T3tgtZH+9vvo24+NmlXQebXbJ/kTG5TzkpqqUB+Ug
6DF84SxJTwXN8cqTU2XrlVHuAgqjX/oBmLTeuybz643DQWHQ0VCHJGehcV0qjdkYPq0QHptSo5Xz
EqGWfhVd20Ft0ZFDkE5wLASPVblXFVQN71VrzPn9nolFAIwWWslS5co0DowVSnu0OdZ0uGi6vIlo
rMEXnawQ5s0S8lI6B9LB9KfrZJKyIF5/wzNEbc1v9Hm3Mk1ZQIEebaU00ulpy/R56ZzJlfT7G2Sz
Zo1Nf7qmbUnn1JLAROMa4sqJqzFXC5VHY1wo9rMXL+CdzB+WlgxYiAhoHdK6pq6N9Q5m9NTksoTp
SlqZe1LEwex2eriLYVcLz+gXpCFIRQ6ym6spfHvXLZuNQHmGS1Yhv5696796+8M9Qfx4PAZ+dR1g
W9BDb1VdondB0FE3hXK19PkKHWRhMgMS4dPBYXYhRJZluTh6FWPaUfgzzuHVkcilw/jFCwHgyhwO
XDOvDSt3BLN397fX7+Hg8PBSAMwtyodLWi+YUIR+tqqFsQgxWgTV66aakzh0wc9pq2bRHYFUkxP8
FTDfCt8fZx6WklCapSIhOXZD5QCdl/NSuRUWQQCkoJIg94OZ0gAJrpJlKT5NP3R7M7BeqTx4b/DL
8Jlo8oQrFnNfboM9/BQ9SJXKb+Fb9FKVLpyWsb71Sz4VRxSQtg25rhV2o8kGsYB8JS10geLn48n5
r5d7b1/1QSqKliOL89L6PjLVpcyRTrgwjQ1hfoWSQF4FfAj7GsO1zFfgmrnDvzWovSDcbc3hXhaD
YNfmGn5lEUNsG1GQlw4qqbf016kNSDbq4BuCLBJdLmsOam06ISGXtcxJYpxZtGJ4NKoQO9+Fg+7w
SntYNDofwe6jUi7dCPL83lMQbPBQ/KcAUAs4OBiI6uuv4S1PP4S3b8lRDgUAwP6Im6vp5Rdn05f+
+ekHO2o8jJv94+X+Kyj5O5L0INHqbDk6SAC2jI4If4H37NUcWltYoqh3O4USH7Ecsc2QUi1KRgIy
CQ7IrM+FKUuz7syTzjNYmDZLMo4HzeufZ7fT++9ur76f/Qp/pq/c317/dH377ubT7BD+7S0/eX83
+/HDh7uPn8JRGTuGeg6q3Rk5gpRhBBgPlG6QfkV5fKbjGlsoLe2WM0CyNdP4uvGc/bX2nhvtmgrp
UI2NKRkJhg7eCk90g9i4W2Q+Pe7gZ7SbHBJ4EDwtHHo4nrwJ+KJx40Wnj5BgUoSns3E+xH4oQ9xc
KC3LkLcBJwk0gDbGM8jWeLgYfuc8fIfgixPM83SwwTWWJVtB9PA2327mMX9Wum7IwYPrjcCFIF1L
69AOLEE5cJ4iZxtYlYv52Fg8kwSvJCMp5pTlNtrJBYK3UocjtTb0rG3vP5xdX4oSNbztMbCGpP9x
KSg7vmfb394X0ks4+LNGb0LS3I0bfWH+YUTMG9+hWTYMmju1TsxY68YDZ6xsVVS0NM4Hh6mNc2pe
bkVurG04sYkYz2lYgVY90kpZiTobwxXleKQsUv4mZFK1NZ5SmTZj3DWfEDdYI8FcKmkf2lTkelOX
Rvk29lxpWW6disGHM+WYH7MOKcnsTc86H4zxaXEyoj3xtmk7vA2YN7RTfKRcKEqmP3KwlYU1VbCh
dkRb0DilH6he46C9X7H11RqUSj+gbSPXrrtVFRaUzJXbGF9ob10BK62V22BonlywmwrwFlQllwhf
Q7o5eXOapnDg1O8I6eY8PewH1vsDz1Nhav+FVc7PIwYh52WNw6CjUm7Jgsj/1obkskQ3hu9I2uGI
Fl1tNNU4jjetlyQ/ckPpn/GsIYSw+jMyVD7yQZZuFml2SDEwuHGJ0vmEQgwlrlJ7wQPNYkeUMRMM
VqrNGjh164pUWoiyTEq8VthRBIIlPIanW3TN3FOGG3Gjt4qYEga7GNa+UheilqGODSJpSrYqKmZI
N0VbVlMWsu/vB4fxCDFntpijeuzXCuKNSVcIY5wx9kX+u9mMKiw5AqXzsilaS3+6deUdlosx3HgH
K7VcxeARC0vSOVLtW5iKd00VaSVrSnViyUQ4zehK25M++l1fmI4CRMTd5421uyxE1hazIy4BGfJl
DBmB1onn9c+yG8EszDru2yzEjlMtKKOAUlqiYCJ809zEoiyYYKH5PbFgG3pCefWmNg4LIYuCIV6W
rchcb47sMEfvZrOhnLO+VsgoojZz1EU2EpnXssI6C2xARnE0YxlSNYyV0c5b3kMvOygwALgh0qGq
VYn2KEJI8MMLaKs4EsvoefgJ6QOFsIFsKCnrMYSc/jxtK+ZWHCIYbigj9iia4Tb9yppmuaKcNxxD
UQoYtdXKTfQ6a8sftWy4bu4V8hmhMKANlSRSVSApw6mH5iSknStvpd0m7U5oasjSu1drVfhVwJYQ
SD5YYxbk8lOjqT7vjZfkQlBWmQIpG0wgS5LcSrfKuBrlDKTRuxlmV7FxMuPIbIuQnZLIxyJhQRa4
kCQ/WhpqtAtjq+AHAyprbRJG0U7AA8GG1QUM1g+Ugw8hqNNxgcQncKAZ+CXJXQfrZZ6JnT/suZJb
4EPuF4Fj+NhoqsaNLrcE81JQMW0cMyilnAPqR2WNrmgwyfYFTE1VGU3R0+LfGuUI0TlSuZVwTWFA
1j5ZooempkPvPlPaearHEqojVVkkVABrtpw1vc9lkqMlfiLn+P6LACjVXBO+o0sKfKSfZANE+vDv
eutXRp8Inp/cwZGv6qOOHkkm4/Oxl3a8/J0XW3lfu4ujo4Wvx0vdjI1dHi110094dmqIju8opeFt
U3ghHAqBMpI8zjQ27+w9sHyR6XVEsZVbkU25qMiOsttvw39QKC5bg2wHSQ4t07Fh0YKI1ouSthUk
dvHMYRPppBbVQ6HsF996aSHZ/L74A1kl0y+tAEniyCsSAiqjUXv39ljkxRe/GM799qtkCcldCsnC
Sa28+h3ftn6dLLRJTKV8srCywiQCyVfwi4iyevvV02n0enzUiztJCsXGm7R0IR+ke6oWYezgEYW3
vZ+v92ZRQoDWNH74gdIw1d8/YCJzb+bKOI4Eg0eFdoUhVpKf7w5f+Hr42d2fNt/5hRvM96bbwBgN
HrjVcD1ZPkCSoA6/AqFRyQeE5LdJrCM0fDBrtLMV1V4x0S7heBTSHrL1RtdUsBdMBVsP80YXJYZk
taa5juaKGfqEKEMu1Ma/1CYX9RaSExj/0pGo95E1rbcwOZmcHEPE4m4v3QYmT9Zfu/JL1hYJvviH
q9l0nI6Pw0fC4h8xUsKS21Ih9g0y7uuPH+8+XsBVMLNZNDt7EYmuJCRkSeuh4vPHm0/XFHI4GT/m
Iv9FuscJjMfj3b2N84vj0/PXYfQxs4/Pjjn5ZhLGTAbV73Mjv0mPRboh6pSydxI/FpC2JAEXGrE5
9iitYpR/2SUGL5lz7c4wiUUB59dtnRfrR8X05aMqmLSCjKL/grLmI1JAEqNLaZZZRLb3O/XRsFeY
DELgP4JzHAW/DHTh9f8K6UKc/QegLnzzCdb9MbD9P4z9y2BMV5Bo2PMM+DssLdaQXMPLPhH+098H
rMqfXvbWHmpT6l9x9kS0hluZ9W4JL4eFTZtTcw0SSmeUD+KDmY5hRkT2oIXVETNd6vkvAc9u+3qn
m9VljcEn/6c4yqb8TwDp1ez2YxIqGSr94okDagzg9edXvw56aXH9OLhUziO3440G+l46Ti9CfDjo
E2iSL+fah+Lnr3/da2pgEeLVwctuzy9HcPr69Pg0DA9rHHcF5wVMTiNM8ntanZiMTt8XkG7SNE3P
CsTTdH42P12kPDIUvIOhT0emYWRfKsLX6eY4T5+OzCdw0NWZcadcUjLBzLPOn8w6O02fzArlZzdr
8cwsfDqLytTAZdOsSfp0h2d4vjPraYAYVorEmeZW1aGr3pJsLHKunjvbdNtqbkoR6SbqJ4US+0l0
oRkcYUhBMcfjMMMszHMDw9KujUUxoKOjALiN1wTIaMlPTQ2ouN8azSm0IKbelsk0o+aA8l1L2dSo
L7kGNxoTtzKdAeOGCK4QbelRMGVsjZM6pVymfsRAAnK448ax5qisOb4ywYKPaLeR2g1ARM5mH4nU
4ircGlNF0OmVILhDhUReqyD7dkRk3SJFTAwuseGVLKl8Re3IhWvpPVpqOP5ftbEov7j3h3AwxE96
SLlH92hAc9eH8O9wHhotFn1j9aUQAEev4HpDXL5ehqYc1c1MMY6ptxsbK085Phak0h1MlVt4RKsW
2yB06QP3yExBSJ2C0kVszdI32stDLRltYvN/r5XPtzSIKFFkaE793rJzO83UVj2V3KiqqUDm7bWC
Ltury8ZxPxw3NbUijB6BlWSswq/IhVQZTuJtoyly0P50oR5V0ciyb5wTYi/JBfg6CxLzH7eaUzIL
p8cjOJ0E3uo87RtS7QKXPR2itAitZe48MTmrQv8huxxYG2E2vwxcf8vZ40Zym6DRhbTbS3Zg2UNC
xII1tdZbNpEo3tjJ22n5fhoeI2qS+g/snXLu6AIZ5bV3d+9aCrp1fL7pQ9gkPWi6T0NaiXQtbnJE
7g+jUFQAyJJ50TCIKNfgx92dtlm4tDa4MrZzaY3bVV1bKut0e3AIyV/I2Pkf8bRPPaACuAPOt91i
Hr9jR3Pki1qgI4w903/RJMNB6wVQL4ylBsV+e4gJup1rWLF50lNf4dLa09tqPXvVXhFoyepIpjL9
PhLreI2p/4rsmMQ4sycSd8jvp8y96JjFoM2W1XZfvm9WdRlId/OMYbhtznBXi6DYtFLq+/wRCgJA
t+ATgZpMOb5vobbttRH3xq2xCiu6REXNRb8Nt87oIEm0PcoTlpY+JHNrnGNTtijL3qQGN2/4slMw
xqnFQnkh+pttB7PJ58MRzLDRy22j4RaRH4n/BlBLAwQUAAAACACaWO1cETtENNcDAADACwAAOQAA
AGluZXR1dGlscy1jbGllbnQtc2xjLWRpc2Nsb3N1cmUvYXJ0aWZhY3RzL2FzYW4tY2xpZW50Lmxv
Z6WWbW/bNhDH3+tTHLAXTjBEph6sJ8AD0iLrArRrYWcYhqEzKPJoc5VJgaLTOJ9+oCzbspM6ziII
MKA7/vjXne5P35m1VHMIwtQnPvED3/e991opZBY5WN2LeDcNozUCW1BDmUUDsoHBP18Hvjd+6+WN
x2GQBvF4fDOZfJ4UcM25waaZUiWtfERTwLzSJa2uypUQaK70PRpR6e+gFdBNLpCHhGQkEwLTMiRA
LdRs/zDNeS6grIE8pELwPEVSYkygOXwSEe/Pye3dDWgBjXxECBzoCG0XBimHO+IBAPxEDndBkAqa
is0o5zODdbWGoV3WQ6nQrqysmqvQz65oQ9XQYqXQdj8+K4I4SzbMoM+MSNoxzydFebghhT1SwvK4
Ja1KXVup1dm8nAQbXNTDlZQkDmexMuz+bFZI4q5ycQ/GUswdbMoWyFcVmvN5Yd7xRn1eJtqqbdLO
h0WjaANL9rCEZSJsYS9WjOnlkireOFSadN1MeyhM4pFDLal8EeZyfFZEaScpc98qyzkVGNKAtfWa
zSpZslljqbEzRqtq1pJ9f9isG451M1S1rYbPJfmLYpRtyHmfHGb0Cdnlz+SyrhyZNasWeNXGnMKk
60DQG4YkDkn7uW0QcHFWD34mD0EekvgSLt6tZMVveQEECQtGQUCSMMrKOB+xGEMSZ5TnSVmmUcZL
Gkaj4NLzjkZVNlBpRp2bESjXFhugwpnXxk/gnhpJywph4Ca2ndYBcBRSIXfSB73ZTLIiGA3gorcF
peRybxVhdmL7KOz2L1FogycE1D9WkBdBcqigjHsKMm/6x6dP15O/XuGgr/GmJ87mTReU6+/byhq9
UhzsAqFczefrrTUXHvQtNMtIASLf34S8eB8SckKKc1adIGRvJdBXaNi+6RHh/9Rh/Eu/+Uca/hb5
1z6tD39eQ9nV4bnM8wiMnCLE5xBaDfEbNPCTGs7pJj/1PfyA1v/4ocI5Kg4XWiE0vecGa4MNKttA
BrSuK8loe/K2I3PpRqMbVecCBeyvVuIXaqykVbWbpU0WCYCEQCJXNjICkgBJwQP4DWkNFQoLBvmj
VjugoB7ArwaRw8LlGJxLrXZR7gFMLWXfnlssgl10KfkTcriLGjlfHC0W0S668V2DdmW2G4vRLrpq
sMtomK7b1cKdTR82Nnm0qYvm+6hU0oI23NlcF3Un7xctG+1stFw7/i4IIvUA3mtlqVRoYOuFW1XM
NcUYugam9Td50BWgLnqrrKGgy3+RHb5wWbq1U6pAKotG0aq/WKAH8NFVmFbuXDh8LeZ6NGlr+EyY
lft/ydfvPk/ubn//4P0HUEsDBBQAAAAIAIFY7VynucH6fAEAADsDAABCAAAAaW5ldHV0aWxzLWNs
aWVudC1zbGMtZGlzY2xvc3VyZS9hcnRpZmFjdHMvbm9uLWFzYW4tbGVhay1zZXJ2ZXIubG9njZLB
bptAEIbveYq/p7hN3IwBY+pbI/VQyaqqop4iK1pgsDeGWbS7xM7bV0CxnFCpmT3OfPPNrObh0xa1
qnSuTevguRL2cGyf2aLSzrNo2cEI6HP/1kEYJCFm/mjmzqsdo2J1QG0K/nj1cLNFXmkWj9yIcO65
QGlNjdn1Ilj1HRbXt4hWSRwP5UOPBSy7xojjNYKIkL14dn2+684FXJU/Wm6ql2YNOhERxbSKKQuX
YVRSX1mw1c+XpdNKogtncOFMkjAepJh9TTe/5qp4al03/VNbN30GdArHmc/DALihEyU0ccVJBOha
7fjuPk17zDR+wDBiyYhdBvDj92bzmhhFX+i9BEsxEP9zuDZrjBbPdnAs8ukyUR68Xca1WacYosfO
ojO2jOgt5kXV3G0zYuU/MJ5gwif/F+qxgKZDLjl5hX3Y4j5N735+/zacaG6k1Lbm4hZZ6yEGe1bN
vNIHxvgDR+XQWHbdBSsPv2ccxBwFpiwdewct8HvtYFu5+gNQSwMEFAAAAAgAgVjtXAHK1FNEAAAA
6wAAAD4AAABpbmV0dXRpbHMtY2xpZW50LXNsYy1kaXNjbG9zdXJlL2FydGlmYWN0cy9ub24tYXNh
bi1zeW1ib2xzLmxvZzMwgANjcxMDAwUEHwQsDBScFIpzkuOLUgtyKrmQZIzNTSzQVRtYIKsuQFdu
gU15fkEJVsMtsRoOV41uuCV+w1PzUrgAUEsDBBQAAAAIALuS6lzHntWMpwwAAJohAAA3AAAAaW5l
dHV0aWxzLWNsaWVudC1zbGMtZGlzY2xvc3VyZS9wb2MvbWFsaWNpb3VzX3NlcnZlci5weZ1ZbVPj
OBL+7l/R46nadRbHOAFmOXYyVwyEXWoZYAl82KKolGIriRZH8kkyJMtxv/2qJfktycxwZ6pIIkuP
Wv3erffvdgsldyeM71L+BPlKzwXf83zf/0IyljBRKLilGacaFJVPVMJUSNBzCr9e3gHjVBeaZQqS
jFGuYXRxAuKJymkmniPPu51TSOmUFJmGhUjxx0JwpSXRVAEB/Sy6SpMZBcanQi6IZoJDylSSCVVI
CmRGGFcaN/S44N3jEeGbu04KlqVQKJrCZAV6zhRkZHLkeQC9CM5YloHKkrGkeba67/UPH0AJM0J5
akeDjiH7WTIkDI+XiWeYrDQFMTW7Az4k/YskuGMFl0MuGNdUwjPTc7PSsWs0tOuDeDmNOxEAMkNS
VWSa8ZnFwz0V+5umhnEGsDw9Vc1NmFY0mwLhKW4h6VQgc+DzaLR7fT4siUslVSryAPoR3CkKek50
OQxaAEkSUXBtRHh9PoTj0cVNCDmRmpEsW9UsaG5NLLqiicDd2YKGho4FecQdaCkESXUhORDIiJxR
CSpjieFexbTPo5HRCabASGglCt1VOU3YlCWOQWI6VVQrmFAUwILoxDI1EwnJoFQBb1cv8t1KD7r9
6LCb0kkx29WG+e4DJowTuYoAjmFOSV7xginIJYotBcGzlfc8p4Zy9kTNxG7GHmklWaaAJLowLMol
VXgWxg1ZpbBSkHTGBI88706RGT0yTLPWBIvSksbWhKJ8Bfe5kPoBqud9wxYySh7Dym76e/29N6J1
u4kkao5oQrIZ4yQDYzF2WEs2m1HpeWdXNzAantzdnN/+CTfD0fD45uQ32MWv11eXo/PPF0M4PR+d
XFyN7m6GcHV58WeELsHz2AJ3AiJnOZGKlr+VSB6prn5pWSTVL9QYz/Pel3aRS6FFIjJI0BMQrhUE
RObEySyadyLv/PgkhNHnEI1oAP2DgxD6B3EI/f3YO70yQ3ve7fDi6vp2fHv757WZtV+OXJxfDr9c
neLgnhn84+74YjwaXp7CAHrexZcxWtsA9pCqacET+ASXo4uToHfYMWqtmnpN8pzyFAKcGKKdji+v
RnfX11c3tyHEncg7O7+4GN6Mzy+v725hYIxeBffxcj8OIV7Gffy/33voeKPb41+HvbGdP4IB7Pe8
k5vj0W+NocPY83CPL8c3vw9variKI2tnDMEe56GDh7ly1jOVYlHbcKmsbRtac+D96BCMCVlvGnnX
V+eXt8Ob8dXZ2Wh4i7S9GDX0a9/gH0G8PIxDOy5ybcft8OH6sJ3+j43plKf2TblCFRNnema8d1Iu
UcWknNw7KWdrThbUYvfOykFOl9oM9eM49F49z0vpFCRNnsbkibCMTDIamKmJ4PzIKXBkPyyGFppk
Y9ReUegjmGaCaFSzyFHzr4JRvfk+jvoHdsKCLMdGekfAOL76cHCw9yH0OtD9ZMVqvYTv+zc0oeh7
Cq4ZSgg4tdFHAZES36DLbu0YoT3i8pRo4vSESElWQccOU5JmjFMYGAuMFoILLThLgg7stA9n5mdE
6bHDWl+AgRTgec4ydE48wGkd+Ng4oY0RACDpgjDO+AwGNQndTcRyPps2lnwcQFxD4TORlDxWIyir
SFHt6A4WjActpoQ1WKfeQ8tVGzWZF/wRBhYPlcIg9T7sHe6H9aGgWx+2geao5kJbnDb0JtGljCK6
1JSngVnUhvsm78tJdJnQvHS1Ual362RtyLrbQP80WNPa75DutgxOBOc0wdxsKKWQIVyNzJfONmGZ
IZcMWOdlOOhMEJ1HTvAIgZYsz9A6zKx1q3AIDV+4A24F7LS94vChRJ8yno4r/2Q23oCHf8Ol4C5C
23QDdRUlhMuDekfLezYtZ31saqejD6Ga9CLOvZ1/9OCoKjieeOx8WpOq0EEbD2FIRE/RJFCSZ0dd
ieqI2YHDh5I+VFNJnjvwbgCH3yXRhufIUhX4H//wQ9ymcx+XBCcZUYpNVxXJTyQrqCEyrMPKeEIU
rSlXWtqt2RTMfBi0zNnt7l/eXVxYz8Wma2DQRScex3GMrsCCfFyfs1PO2YRmCzKju59Howp/C1y8
xJHDuH42gTBGGrAqBwxM/pgQnrKUaNqxO9TzNRB8i0ZHMixFZLnUd0zldCY0I5oGW0KO4WAt9fdw
KgnjQDgGb4bpuUtHuoqltMJigocY2jlQjiENbDKE6XmZIESO0FbkQwrCdhAYxNHPB1bjnZvlKcmy
wFlaxSJjcqdXVSJidgy/+rrKU8yMB+dHt5Djgsx7OLfnZX83q4sfFWgqF5jRdjHeg9JE0wjglGJ2
hsFD2CQHpyUkd2BskWd0QbkueWWSBViQFWQE5ZoIrpHTlGFdBcTWCQK/fR6NShlGb+RLI0GzfIFm
9hm6SW9ihk1YCj42ufsbdCYnq0yQFAZNH9vKTX+CVra5RdgOw74xFZJNkvCZ+vc7D2CKn3bZqoqJ
yE3hHry0NngtHXYIfgPmBd1VudOrc89+rULTrFDzwa0sqB1rUuPf//TgShqbnau5KLIUyARLDcbN
2UlaVfV+2ICzQCZCqozSPOhHcZPTWHe9yTh/oyRFn7CPqdR+zxTujCoI9nvwE+x1sMzo/2xPFsFG
p8F1Gc6PTxwe0WWI6fV/dgbtJo2GroGAflYYDZ8yqXTVm2hW6jaTe1+DHZqqmmBxnjJJE20rm2bL
wtUGCo2qf/Cha3DLYhbhTE3a+6ZatQubLXplMUp1V7ngykC+wS3toYzsujxb4aK1IF/hOQ9iMkoz
lSkjNbRmEyHNKOata6XNfbOkecDIWkeENSPAx7/vPmCOXijjcs3Zur26g/MLun/D1KrUsoWVU1m/
jYbO+olKNsXOFcFWF1OucQFz0uoCkUbjaQcrr4bVbLOc2nrqYGWZhKpOG1zMYbCeplh2hd9mVpUi
bQI67q+z0nBPy4InBNsvJffKYLlpr+ukY4RwTDJtv0aZq2y875KMzThNTRy0LZUeJHPCZ66yd5v9
qBxg1evTAtDYQuwPJhklEgOLkYozi8S4PgMyKaZTxDBxotF7g/WEZbCFOT/Af+Ll2VnDszn36qgt
lfoIXhqq65zlFiY1MexuDb3BOvhlg4ajuPdh+fodrJRi9dkAM1hrKeA2IMdZbOmZDh/JMAFjzUYn
U0AXTKMWEAVBD/skh70Q/ioWuanAsGl6bHu/Fg17oN2qSWnn246cfFoXbdNNEgU/1Aff6f3i8Kqd
rMstVYRpVbY78WUE8EU8oSYwjV06p2RmXU5mtNSiqZDPRNrGqNpw+onIV3UrdJaJCclU7dRLgbtM
o5CScm1oQ5cXbGrQp09w2IEfoFKj+jADCNoAO9BvTS0l0mhWxYb9+L/CccZtVLL/P/h/2Ck3+Fok
6LcjQf//iQT9r0eC/lok6H/TF3HhnFC/6cIbDUDbqAZsCZv2PJq9eoOj2p4/GQPvbzXwfmngrXQp
wC59l6R/FQpNBcVjtTpevlSyOor7y9dvJ1HmA7PbcVXFqCPImNL3usgzeq+0DFEhHx5gAPe2uMS2
E6bMZaGKKdZaQIiYpgsVNHoBrvrbGlD6JVKrBWRXbEip5Y3ePcALknLU66tX2ImXL64gjveWr0d1
SPmKZJwmasYLd5kDAI+MY8K8vd5dL3VrrKaH/BZN8fLFVs7GQwK84H7bXK5jgyVn8Kb6s82lNblG
tmkdBFZ2hohObRXrWlBrTSVuJxH+9bnrjMiFUgwTIkMpOix4YsTyZ4MXW3hAM0W/k3e9eyhvvCx+
IviUyQVNQ5gUGi158/Lmmajq0mY98zKxBR65eObVxZPJh5nCguBN2ZUtH7DpGGwUZBLbAIPqtiQ6
lrMCi9Fr86Y+XUpVIpmpoQZ+uy1vL0W6W65Xdw0LMjJxF7P2cC6Emw0iLISI2zPw8TbGD4ETOVMD
/59+CHqV04Fp6rjLpgFeNn0doiLYdzdNDQ4R0x8c+EoLScdaFrTxck6zfOBjDDAcry6nDuOuLRGb
11RlIYsXv5SkWOTgURmfOURLIB4DBiWd5gMpVVW7Gu9jW3Vc4H4dn43PL4e3mOWZ36Ork9/Ho9ub
4fGXDuYKSj7ViqjkE7accarIK4jR1cUYl7VQxjfDu9Hw+PT0JgRX7JQIE+wsBn4cmT8/NNRHKJFO
eyL6Y8qDxnJzbz4A3zIczdestbxCowG/fXXof8uIpqaCru4QnX6Vd/t2d9dNccQevVS0vq5Z0NQP
XpC8V0Nk5232Un61IR4TZ8wt5FNEEuw2NzrezyhBU49/1ek4u8BJNMHwaG6+XhD1a34Wn3YvbqO3
XzN4s0Pebsm0l7ZdWHNF1VpAh8GmMB6jWxyPjbcfj9F9jMfOp1tf4v0XUEsDBBQAAAAIAIFY7VzA
2gr80AMAAN8HAAAtAAAAaW5ldHV0aWxzLWNsaWVudC1zbGMtZGlzY2xvc3VyZS9wb2MvUkVBRE1F
Lm1krVVNb9w2EL3zVwzgAGlRS7teB+1igxxswygMGKnRTU51Ec2KI4koRTKc0W7WyKE/or+wv6Sg
uB+O7UMOPUkURb4382benMCdv4J///4Hfn3/EYwjGcRYBiHrSKC2hpzA8vYK/JpiY/0G0GlArSMx
gzZcW89DJKWqHq2pjR/4E1NcUyzDtgLDgMA9Wgsf8p15ExofYY3WaBTjWpCOdmgFG02qYlt/ihTs
9o+z2fzP6oBfwo1Ahwyy8dB7TbxQqoCqKOqI3FULYHKaYT4daUs0wZLwiHeRaS/RGTEPdCTgXakK
0NTgYGUBgWLjY88jK9n4ggVbgsvlcnJ3c/0oasAWjWMZf+xR6s64VgE474qLJTpYDcZq2HQUCY4h
BXj3Dg4r+AmmX+bTqlTqIxN4Z7dgHGDCCZ5xZekUcJDOR/NAGiyuSrj00uXwwTghl2JAa7dQ+xiH
MDJSQrzXsFTq5AQuEx2lbhxLUmRMuu977yBEivR5MGyEeNRY+42zHvWTypiV84VSVVVxp3jQHjBI
0ZLAEDQKffvN7ICKbc5EQcyJK1rYpP0ai5qimMbUmHDvFYA1K1cPkYkLTeu0jITaGkfjOmyl8+5c
jeeL32AifZgc6BWzcl4KxrJ9GC/rRAIvJpNGQtm6ofSxnbRuOB548WgKT6kPOTupfAhGNVNankib
0oep3jBSUi2lNFLwUcA7Am0i1eLjVuHKrwmkMwyNsbRTcOD0jYCxT2CuMW0qKx+Snvw2FwMf6rWx
2LLSpmkoZkVHKvveSMrCnd9QXHaU9KXYG4cWzrJkIW1x2lJLkuLW12PtQ3kffK3CFopzKO9f6GOY
nc/Oz2DXYzk9N+54/+zZ/Ru2L0hTIKObZHPZPeBs9ks5LaflWQbJl19/CVQLaYjEY0s+a92c5OQu
rfUrtMVqSFkpDj5lXDYR1Dr32Q8/VoAC1TfwZb04ezP/OTXfyQm834v7vNWVukryxH4n8efBxLEZ
t34QaExkOfSF66FwL4WvaTW0T+L/OhZqGylAcQ2vj77w6uvxPbx6nROzFIzZbnY+ujHSJQZHA/w/
pM5gV945qjPcoe6zn3yv4C9F/H2KP4oxRONGqWdvpsVqK5TzvbPlSBy8Yzodj1jCv0g/mh+hyhua
olmTfmTD1X6One6Hmsk2CqbHliaXyyUEn+w1qjXagbjc1yExrDFuYXCaIlwsb38vIfmFpt47logp
kkQlDcBcIwUHqpPTvVWJTpq72hOD85IsnSzgHg0wBdsRBqjR6TSiCAZn08g1Ag1ay+AHGSflKA5h
XG0f0Y7oWirVf1BLAwQUAAAACACBWO1c8HiNy/UBAABYAwAAKgAAAGluZXR1dGlscy1jbGllbnQt
c2xjLWRpc2Nsb3N1cmUvcG9jL3J1bi5zaH2SbWvbMBSFv+tXnKgmbQey88LYyEhGkgYa6NpiZ90g
hKDYSi0my0aW80Kb/z4cp3n5sH0SF3Gfe86596rmFbnxFlJ7Qq+w4HlMrvAreEAsVCZMB6bQsLFA
P+AaoeF5jCSNBPgrlzq34FBpyJXaYlFIZWGF0sIiVFJo65JcWLCCPD/5ky513pod1mq32s0dJcHQ
Hz9P5ndjv0udmzACY6DOTSSN5omoqrdBP7ifB08//eFo2pjt6C1FvY5sHd1SMhk9PI4m88H4sSSf
qg7zbJJ5UgtbWKly1nK/Mp5z7VXaDs+OEiKXmE5RA9uAOicCxWz2rXStCSDCOAWdslkVwcHfQmpu
ttCpxTItdITU7AuxEWFh+UKJDi6IvXrrCAOAQSFVBGmxljbeJxymScJ1lENq+KP+3Y+Rm+y5ZYYn
lHtkbaRFkywlIQeNn2bILTdW6lckXMlQpkX+oTgXZiUMUo0sNRZOuRK4rktJtrVxqtugzmkn3rF/
XjW62ZaC7rsoGKsuoU4C/6Xr1Ig1PMP1H6lUSfFfKFo9LxIrTxdK4f0d1hTiGqPf4wnJlRAZGu7n
c92KFzqMS+HnKVdXBNZDs/XFbbgNt9mpJJDLfR2/PyQSf9h1vlcTzsZccssERVRtICyP2vGHlPzD
BVlzaf/jrsqAVR7/AlBLAQIUABQAAAAIAABa7VwRPzHS3RAAAPMpAABGAAAAAAAAAAAAAAAAAAAA
AABpbmV0dXRpbHMtY2xpZW50LXNsYy1kaXNjbG9zdXJlL2dudS1pbmV0dXRpbHMtdGVsbmV0LWNs
aWVudC1zbGMtb29iLm1kUEsBAhQAFAAAAAgAmljtXBE7RDTXAwAAwAsAADkAAAAAAAAAAAAAAAAA
QREAAGluZXR1dGlscy1jbGllbnQtc2xjLWRpc2Nsb3N1cmUvYXJ0aWZhY3RzL2FzYW4tY2xpZW50
LmxvZ1BLAQIUABQAAAAIAIFY7VynucH6fAEAADsDAABCAAAAAAAAAAAAAAAAAG8VAABpbmV0dXRp
bHMtY2xpZW50LXNsYy1kaXNjbG9zdXJlL2FydGlmYWN0cy9ub24tYXNhbi1sZWFrLXNlcnZlci5s
b2dQSwECFAAUAAAACACBWO1cAcrUU0QAAADrAAAAPgAAAAAAAAAAAAAAAABLFwAAaW5ldHV0aWxz
LWNsaWVudC1zbGMtZGlzY2xvc3VyZS9hcnRpZmFjdHMvbm9uLWFzYW4tc3ltYm9scy5sb2dQSwEC
FAAUAAAACAC7kupcx57VjKcMAACaIQAANwAAAAAAAAAAAAAAAADrFwAAaW5ldHV0aWxzLWNsaWVu
dC1zbGMtZGlzY2xvc3VyZS9wb2MvbWFsaWNpb3VzX3NlcnZlci5weVBLAQIUABQAAAAIAIFY7VzA
2gr80AMAAN8HAAAtAAAAAAAAAAAAAAAAAOckAABpbmV0dXRpbHMtY2xpZW50LXNsYy1kaXNjbG9z
dXJlL3BvYy9SRUFETUUubWRQSwECFAAUAAAACACBWO1c8HiNy/UBAABYAwAAKgAAAAAAAAAAAAAA
AAACKQAAaW5ldHV0aWxzLWNsaWVudC1zbGMtZGlzY2xvc3VyZS9wb2MvcnVuLnNoUEsFBgAAAAAH
AAcAzwIAAD8rAAAAAA==
--0000000000004840e80656760e38--