From cca153368ad99492c4bff6dc1ca5d48b5daad1e9 Mon Sep 17 00:00:00 2001 From: "Liu.andrew.x@gmail.com" Date: Thu, 25 Jun 2015 23:05:16 +0000 Subject: [PATCH] Checking location of the instruction pointer to see if it is in valid code for Linux exploitability rating. This CL adds to the Linux exploitability checker by verifying that the instruction pointer is in valid code. Verification is done by obtaining a memory mapping of the crash and checking if the instruction pointer lies in an executable region. If there is no memory mapping, the instruction pointer is checked to determine if it lies within a known module. R=ivanpe@chromium.org Review URL: https://codereview.chromium.org/1210493003 git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@1464 4c0a9323-5329-0410-9bdc-e9ce6186880e --- src/processor/exploitability_linux.cc | 59 ++++++++++++++++++ src/processor/exploitability_linux.h | 5 ++ src/processor/exploitability_unittest.cc | 7 +++ .../testdata/linux_divide_by_zero.dmp | Bin 0 -> 38760 bytes src/processor/testdata/linux_jmp_to_0.dmp | Bin 0 -> 38544 bytes .../testdata/linux_null_dereference.dmp | Bin 0 -> 38760 bytes 6 files changed, 71 insertions(+) create mode 100644 src/processor/testdata/linux_divide_by_zero.dmp create mode 100644 src/processor/testdata/linux_jmp_to_0.dmp create mode 100644 src/processor/testdata/linux_null_dereference.dmp diff --git a/src/processor/exploitability_linux.cc b/src/processor/exploitability_linux.cc index 13ebad12..c11aed4c 100644 --- a/src/processor/exploitability_linux.cc +++ b/src/processor/exploitability_linux.cc @@ -39,6 +39,7 @@ #include "google_breakpad/processor/process_state.h" #include "google_breakpad/processor/call_stack.h" #include "google_breakpad/processor/stack_frame.h" +#include "processor/logging.h" namespace { @@ -80,7 +81,65 @@ ExploitabilityRating ExploitabilityLinux::CheckPlatformExploitability() { } } + // Check if the instruction pointer is in a valid instruction region + // by finding if it maps to an executable part of memory. + uint64_t instruction_ptr = 0; + + // Getting exception data. (It should exist for all minidumps.) + MinidumpException *exception = dump_->GetException(); + if (exception == NULL) { + BPLOG(INFO) << "No exception record."; + return EXPLOITABILITY_ERR_PROCESSING; + } + const MinidumpContext *context = exception->GetContext(); + if (context == NULL) { + BPLOG(INFO) << "No exception context."; + return EXPLOITABILITY_ERR_PROCESSING; + } + + // Getting instruction pointer based off architecture. + uint32_t architecture = context->GetContextCPU(); + switch (architecture) { + case MD_CONTEXT_X86: + instruction_ptr = context->GetContextX86()->eip; + break; + case MD_CONTEXT_AMD64: + instruction_ptr = context->GetContextAMD64()->rip; + break; + default: + // TODO(liuandrew): Add support ARM and arm64 architectures. + BPLOG(INFO) << "Unsupported architecture."; + return EXPLOITABILITY_ERR_PROCESSING; + } + + if (!this->InstructionPointerInCode(instruction_ptr)) { + return EXPLOITABILITY_HIGH; + } + return EXPLOITABILITY_NONE; } +bool ExploitabilityLinux::InstructionPointerInCode(uint64_t instruction_ptr) { + // Here we get memory mapping. Most minidumps will not contain a memory + // mapping, so we will commonly resort to checking modules. + MinidumpMemoryInfoList *mem_info_list = dump_->GetMemoryInfoList(); + const MinidumpMemoryInfo *mem_info = + mem_info_list ? + mem_info_list->GetMemoryInfoForAddress(instruction_ptr) : NULL; + + // Checking if the memory mapping at the instruction pointer is executable. + // If there is no memory mapping, we will use the modules as reference. + if (mem_info != NULL) { + return mem_info->IsExecutable(); + } + + // If the memory mapping retrieval fails, we will check the modules + // to see if the instruction pointer is inside a module. + // TODO(liuandrew): Check if the instruction pointer lies in an executable + // region within the module. + MinidumpModuleList *minidump_module_list = dump_->GetModuleList(); + return !minidump_module_list || + minidump_module_list->GetModuleForAddress(instruction_ptr); +} + } // namespace google_breakpad diff --git a/src/processor/exploitability_linux.h b/src/processor/exploitability_linux.h index c63c0457..95607602 100644 --- a/src/processor/exploitability_linux.h +++ b/src/processor/exploitability_linux.h @@ -48,6 +48,11 @@ class ExploitabilityLinux : public Exploitability { ProcessState *process_state); virtual ExploitabilityRating CheckPlatformExploitability(); + + private: + // This method takes the address of the instruction pointer and returns + // whether the instruction pointer lies in a valid instruction region. + bool InstructionPointerInCode(uint64_t instruction_ptr); }; } // namespace google_breakpad diff --git a/src/processor/exploitability_unittest.cc b/src/processor/exploitability_unittest.cc index 72994d5a..509ae230 100644 --- a/src/processor/exploitability_unittest.cc +++ b/src/processor/exploitability_unittest.cc @@ -113,5 +113,12 @@ TEST(ExploitabilityTest, TestLinuxEngine) { ExploitabilityFor("linux_overflow.dmp")); ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH, ExploitabilityFor("linux_stacksmash.dmp")); + ASSERT_EQ(google_breakpad::EXPLOITABILITY_NONE, + ExploitabilityFor("linux_divide_by_zero.dmp")); + ASSERT_EQ(google_breakpad::EXPLOITABILITY_NONE, + ExploitabilityFor("linux_null_dereference.dmp")); + ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH, + ExploitabilityFor("linux_jmp_to_0.dmp")); + } } diff --git a/src/processor/testdata/linux_divide_by_zero.dmp b/src/processor/testdata/linux_divide_by_zero.dmp new file mode 100644 index 0000000000000000000000000000000000000000..e7b37cf2a13338ac1feda99b235dd4f71df37bef GIT binary patch literal 38760 zcmeG_4UimFnJ*zgb|4ZdKtO>ekrO2|)APGKlN;F0&SYoF{!C_OlMO#N+tb}M+sXVi z-95Xr5zh#6M^wB3r>AvSNAA=E^{%u;C03oXhyosUMNmQNPARSw4^HYx)#;g2G55Xq zzSlGRGaG(_TFG=W^S$@I@9%x@eci9$bbmXV9L?N)FCps)ArgG(@vQIG30@-PG$@4O zGY_9N@X-MASd@^{q5MwxtiPI&GXUNPpFSv`Ng;fmgYs#lJoL1mkVDr{-ty2t0`Gx3 z6N9K7)qvemxgF(x{%DD_p z1QdMRfsgv*)gJ4SFpK&QjB?C@Q7{?~0Zp`5K-zD5P`&5DhmO5c=U0F$rtk0KVD?@SH9QJ z0zk~~PVz*%=;xKMoW}SMuHk+;bln^Xq=d4voJU-M|^3*YDV*4Fj2rsltL z{`n{S@Xcg`$1(bgoZEDEcG(`nk{j;C+IZ!cP66^mIN=p?&Kgyp!2)qTKYq z^ZMuh6D1pXQ9ho}oWQ5X7zA4I=}Uq%0p!6A4k6#f!^ z5N$Om%!&%Y2T{MUW2&LB)|=s*j)$=KJ;-xtLq97W@Nq~iPS23=WuCb(E=7M1A%5p= z++PAO_yiPoXOLd-J%;u3f3eWtf=|$k`aZNPZPF`ID?UYkcvKK_Pj5eKe;MTqIZNzY z%lq~7OE~>=SZB=i3+qo@#@p$5&}*TP^8&Wh{!<+NP?{^zzN4Sw^AphQpl$RJbpaRm z|3{bhi>3u|vHWLHkAPhIQu#s%ggLv`3I7Wy#z8Z zNB@cTr|$Z*ADr>@gX!bRed?}%c(iml`M^_m-MnYrzdZC+!M_-;KYxIsgkGw1xucW5 zOVHoX;CQ|RnS~s$v~d1Mv0g{`_XrOmd=lY*Bm5P@=;d6Ffp8zf4yJKG2Yz7NX%LWL-qp16>bv zJ<#<)*8^P-bUo1ZK-U9Z4|F}y^+4AHT@Q3U(Dgvq16>ciN)Pz_nq|!B78#hxj~6o8 z@yT6@X~!|`xZiJD_2!&fua%6lPpw;~uUxN}D>{^`yv=7SD%p}v4Q$H{BoqFIZTTy8 zRjK$np?|tw)%_Ktq0}@>pY<0lUD;zQ8W|j!$mdhp!tiKebUZmRl1emxa&@h@AzOFDhKDKpuh}yVy7+4y`M$KuE!5z6mHkVG=_B2UunaCA# zsa$S&e5^pr1Ic6-s)Ya*^lQb2?H%17(0cbM>ST;0Q(FfnM)J8r zW+0#DeX*w%OZS(l2mD-{Pt!|EqvAlv9Z;9bZOe~mghpXeayXY68Q7JG%OsT?&W~pk zGtj%C(r1;BbIWEToWGKI_Z2%2$CqwZ8%_ZtEsVd5x*H*21rBYO^I1GX_=Pf&X zyw$qasOTgO9X{@?AuvhA$fpN#sYHMbkLB_MV}q&01eHjx9p8d8#@21ysMpB0?3T#j z;Mf2aKciU8FRH4j)4G3;Rg9==fjg*BQ*&E$Nzxhx-$Z_^w~rwvz$biY;$&p7Fqq$! z!MY%#Gs~MLBLD|S#=$fe0Y#(cuYe(@Vd~NqHvDH4kJ=>Yobupc++M%5LesEb&KHx6mK^Yq2A45D3lW+d2=`vR~1$W#GP4I z2*&GB2yYGtC&{Y*SR>Yg=|ybCag_Xac|J&E4KKYh2<8F)1uMzqRVQTRkysmt^c!a zWxcIzx0S87vZCs)oV|5EY}7BRX|yW6EgP&>akp7!tPvpJZR)K`*(kXU#VU6lB{GZL zW>zk@m9Z}r@09s)&~melzS&OGCf_kiEoEk{WrRJmpv=vtQmbu5rpjj#!`EkAtE+8Y ztG0Ko8f+ul(<;yEZMN3i`c^f=Evexa1K?YgnK~a>YQ{~DOJ8fWNM@_8vSPQoY_;5I zRcBgaN)^?Wqs;KYrQ%DK_Hs*Rx#E&*tzuJcX==`DF3DV*Wolb*^=gY=X||**wU(dj z z2hmEig|E|@hv5S7GU*ICX1|U-8FBl9`>b(t!m8$%Of3Dd982e31mG(Nq?$8e;upTdKcgz{S8n ztt%Q>W7ZwNUMu@e-73{BRrgnQtE`)0pQBbt1}-?+1if@X5iab*`Gl1(mT$^RTN1u& z3Ihd2+MX!bSKl0mcCkiTX}#sEPkXC#-o5s;Uv1b9UA0vjWus>Mts*QVY(HG8;%%$8 zMb+gOaj##fQAEFZ%k_!^URb2B*f1)ZQ?FNS|88YQ@$c65EGDrRvxp9~8W;tyLXoiH zI^M!GSyvlXz2<;NaEV#~_c$c8E1w=8TkPyMJJp6|0iWMC9G$z^*sGK6`Ec9Hh%Rln z!`jMS>$0U1V76xl3b0VjZynE$=F=%ytSF`lW;DDvIT4c0?HU_&SGKv-$ne<2B&^V2 zR_sdU2(BgBqJ%G(#o{NIPL06Sr+o$o_+j)(EECJzcMP zgOR9OuhcC-PUe&25R799qw2*lX(5xt+4iM2o6NeOolg48nITmAFDC6B$?(X7h#A4p_x0J^_zq3K3X=_}Nav2lZEWIDVn-N@RQ|WNd96;H0f}tFCC)O^R&B*ps3ny$R zVTy*bsT92t6k_>uy#i;7icy|+v?`2*qqJ@z8B=y*EI&+dmFVPIbj!mCa;brQ!qyc> zcB^=nuUln*31+CK+k2e4=}#KA2{$RDN)0Bm<o^u&_(FQmHxb&?rN$LIXJDT3#II{on z?Wvd2A5KB#(H9QDGuP?;k36{Pf&s#0y>RfC!1~qHOW%2zGCrF64b^anzB=*AU%u}* z`%_16WDU9W2VPnW5A5y#`q`i(z5grpNzC*esh6qLfBqFMPrMBE=f1HSL{sFu{*NJ_ zOW$$ZddBiJ#ri=8C8Oorj#(n6jSBDAN_AepSm*tFg?JZ=j`XknXU6u zCjR>DrO#)|EAdY8_l?LDe@}~P+5Gx+T>)&*tfXt6ze_{NAG->gZ$MXOCEoS@{CW7P z%UxYZR-$*QmKOd9P>-#|Yw~xF$Pu5*Y__`S;$BT*6A<;U#QQ~jpW$GuUnKErBrm18 z3Q&hv(uL0$6IooP2-){Kb!`M)lPmG!^V39X*?D9o`WD%e5*x4M@Md$#++oG6I@G42TxF#SF@Rnn zHKGBJ4sQeb;cZOH*I*Pi;(#>(ylYoq{p9abyt^6&$x(Rc)yuFou%Zd>7H}DXV}95+4bW7<}7c ztvIM&`8%VJ?7r;9?fV{n`i`siKR-j;K(G47^{OlCy~A_wd2gM3%TMQT?=fzOeNgBv z!&bfx-SyE|U$?^NwfDCSqoIOdZ0s%VIX`HBFM9b$pMUH958iOoPSX7LJ$F7qTcE$T zqp4S2MHNSVGI*RZTnFFn^W(MoosPB!mRtq@xZiy+Rz7&amyZR39f4%-?h9Y|!dbum zNz#7%7q_0f`sJNykLgUq#)Z~C3WQ{sJ+F2AO|WAc=cBglm{2?JA(I#1|LE26|B8I_ zy0bIi9c6Yb(%=7@^>^0ypQT%lXj5N*|EjMWZ~I%%4|g$rMh!Lx%CM8gC;Y{Lq`hs; zYlX#;n8o~z#otj7?@ix(DYX&~xU3$<%bj@VdhvS{VtvgSet+NMUGE-vlVtTZV0hcH z>K1tK`5KNGf~_Q@rVrN~z0yWP{t_x9uAd~h@1Zk{e#$HW+WkM-}wnaUPX{e&bfZsL^kbyW#TrwM!YfiUmv7k3q-E`phPQ-yj3{9%& zGvEhmjc3+$$twz|2Q2VOGgV#Ebjh@J$+1#^#mNIQo zB(++f0WycOg`$#LDODQww4^zVa}mvVd1LrAk$TZ9&+kt2qT~j$*0P1-d^D8*q}T7j3BsIxO8Rz<#tQ)#_$N zYQo+PY%iAQpbD&YlXEgI`X%XfJBRkwtQnH2R;rE4P1;Rht!_ud5=b^+PhZmPf(p`R zz;qivu;UBnQp2H(QmG1^ZU&;D%mg=RDs%(}N7BF!w-* zIksBR;EW98t`{5ww)rJRx22}7%;=Ib1HKAGRd9g?zc0Xs%yg*$eo%^4m>3GU0Q{_* zMNVEf!RZz71-LADrfC^$6A&03X~qOgOLo~VDtwd+ zinbem0+5PTBS7^-FRL)bPz_2T(Uy$b4DFt$STEPBhRNn*tS{^fggs)cahgW~Lw`yy zD6mIYqub^%uK=lN@Q?=#Iwhm*;iyzJz-AE*o1}0b$IKX((@-iNvpx%cfuC4lw5Xi8 z$I~ABfs;D+107>O=vfl`!EWq#WB*i&{oqL*`@xQ}A6^>!;co1AWB*i&{m@Ar`=O4p zA6**z(QfQ_WB*i&{qRX0`*7z3_oU0+@AoZ@{l0GOcVquliv7q*9s7}vu^*6^20!4s zyM5i=zEfzoFM3i(f9IY4z%s$#js5PG|5Up2_ny?T-+8A$v^4fZ-PrHO{;3rEeJ6G7 zci!obERFq0H}<=+e=5a(?4*wU&O80ROJl#c8~feZKb2x1cDVi!AMFc;PRyfyowxd9 zOM^ew4gPNMpHjhpazER*!e0M!+kJs<_;z zvcc2wkg1_=zT1;88(O>vp05vwJY%dZdonFlhLu?ch+a<~ICaZy4SOaiAhr|f+p0E^@r67Dqq;Qx%%^Z;76O2l+SWJq@azLVj zq)1E-Nla8UB>sAeGlUA#w6TZ~FV0tMs@1%jy45%L4@EI%_N z)r8)2@iC+tF^U`&hI|`nMLs2{;9+iV|EyvP9Jegb-bDfr20S^Vygl9{`yn4lurEZb znHr1$ygISq@Z_eo4h=?mO9hNwKpxinsHovGxMV>CRA|Fs*>M{Jkn9I06L1VF=5TG= zZEzWBL&mBu-;gSmmT%b7>PMg?4o^;3At?y>L-q`s4I3VjufQ|z&|^xmNsz5jSin}O z7&h&RHvqvfs#n|O3F|juA+VrbFnVU{6-bh(SaSu{X*vaa)^Om-eHfac2i~0M*c$NA zcX2jK?;O_Rk{|OH@pM2T%;CfGa?qrZezRekx%;8SRoOmIu$V;9Z3|7Y}Jj2D8JNJk6N0 zVS;Ia2=d8c3Gy{=aLFK72XAyS+0;mir3|FRo}uyap^?-QEr`!{S)8Dwn`yI~X|tPYQzX%Z1gPCio83&C zEJJ8F(`JZfg6wA6>}J~RX4>p#+I-#VJG+@Sc~<#urcF2fW;fGjH`8V})8>kQp5nNf zHtD7a9G7zdiL$zX-C28i7hOtq{itMYN#&~g$ycu z4|3V>wp7)8Givc480j>ExaTa((LfZ`f+101h?g0{(7#(ls3Vvmbc0f|X3-GlpWmTJ zN_}WZNm*bB8yy&;sgR^sEN2mr*j%K zuH!kFJ3Sa)HrzV~WGe-qP{vNJsEnU*#R$u-^Xv&yh9`7(s?o(sU7Sl7h5sAw8J915 zR??W?mpiXT`eMD2$g*+5{uDunbKByqg6PmF(}ZgKN^EN3DNfc|0O8a+v1+*{R2yU0 zaJX>u%aq>k+7qjmYjV}H{)x%0Gnc<9y^TTUeK&q%0e)`Bi9|zcNlbAXVJ9T=r$M;f zWMCJ$zGWvvr;FU8bdER=VoV8YEYb(n+*796cd79gqJxwM)C3*xe`|+_7PVq zY`JjaHBu$6MmEjF=)YNgq)J?k%#T7NG%OwXVu;cRh6q2?cNq9Utaq7FkU9*5n?Dl= zTnkYjqb4oHt|BX%rbXKNqD78Bi8+nXAo{`wI0z46v`?uw*cT?;)x^)87+?FRs7K4L-wNKcm_88$IHQfD&5> zff4NpeqCQMvpUMXeg-ov-pGG*rnjhv?&deDFH{v?IQ-D9^nPs~@zdYu_pb!=M?Z%6 zOyYi?CmVBEUq};%!tqS_0LNncR8s@sjT;B7DKlsJmFvfxM%45hC*HnxFjgg83ol zDW#*wV)zJ0yZ9LXoeM#?1M6oaUFL#*R$7Pk51v23N*7^$E&L%Adb}O$>k-mC!t}Th z+uy;fuHC=*?J<@V`xC4CS&R6)AI%$2|1!y0*nT0x^AR3=lE;Pn z=Q~VppPOkN1)qoXXCizX!p!=9RucI8&f#_8@B5Ih2cgja+he>x&%A}x!(X*v{S$vk N@$~kOv825+~GWScLwXKd-5d+xdCoO|v)Gk30L&Q4?|^7niKp>q&I0(|gsdG1})6hr7$fW+W) z2tMoKqXOa4I6|)m{6hF_NF($bfDgcD6X0h69E8tdz+Z)GqhAk0-3_>HZS+BCyRVMh z)<#GA5E5-i{A~xft&RTjJcJGaekR}|@a%gRLj8a@z`%#zjZgsaBS3%T{m=*w zK+*Jj2)g*odc5+RcLG^N=y?E#p##qYj*oTd(9WIunePGNUB`R!8~V-!WBWdLVV`i| zD)fbq%^VE8=Di3MtVcuOp$%aCtIs*(j0=WAGjI+;`wiZ@OS;eP1AZw=lHt z>g93wxKSkSd{j2e>-^1+Tj7WI)kuN^~A}@0N_x%Bt%k4eq zy;tn#JQ#9E9QZwIXZw#S{|}z~8`3Y{e&=IU-__0icq)Rs>4E1HK87|>zi@tDzUZ0O zZ*l!{{1+Xd`jA8Ai_FiPCdP^WAx3}xd$jz(w||YNJQ5jw!!>`k!2j)ws2xvTP2s`6 zdyv$(-!MVoU2p2}pH9Ft8KX^ZRncKb7mPr+FS9;?RDZeiJ0?}{XM)g{c-b~8Rzm1lk zxby(+&w2_2TmdT=juuEgm;aHzhe?_1x$#P>2m2F`7w_jI%rDq}Ov4|{vuR(Ausr{Z zZ&JNXAFjg(D|&$2&k1Q^h@%T&ulyrS4~JCxV)t_q7KTYx5 z_kiyK-vhn}d=H$c2SQ=h)?1p5hNnwY<$PgkW=DF~buA|q4qJAkJ+CzCRlOEc8nzXx zH5xTT1Kgx_Axl=!=0bLOYkoMB4mTY;Y%~3J(^|beT|}dkQxn;8 zkIZr|lXhoyCkX#l&9XH`b~TmpZq4o}mJ(AE8ZB+@8bBS~Nl0`+ zi|GbTDnp(RI*Q#ejEZchU=ZB-V9nhfG#hHu(9jrkc-2{hV3P2W9~&-a(-O)}7E8mE zBiZycmWbXuwVBNrM{^v#QAb+~o8u!RlfzhiOSXw$6h&5MweW7c5?7Qmbx^sk6t@&J zs51(o>C%?qAR$bHPw3F3(D+Dsq_iW?%A5($tY86+0~{Hj0@FwYRP=h-07ER@(u8Xq z_)j>d^4ZDs?ZQ$lXnbmv80&=!8ZVM)D5kURE$z+iOnaoQ)ihPE$TeAk2pTVfQy^T5 zY1>JQDOFF4()H0;%BT}0kuqn~qL{MubWFTH8cjJ3LXW3Zj#N}yb-gI1lrFqs6S{=y zPBR@HxIP9*EgcoFk4008Ob{vM&JiS%Y5)?uJ{CziE@6(Pv^LQdNxdcH$~M6zjMw&h zxNPt8a98fojlEztbOiGodrjFZxJHM`ZFlg!y5;e7s5g5wwL|Pu-zBU|R%LI*Ygg&C za~I+r9=F4zY89`kZJ8dvtE>NWUAWeTJ6*Wlh0BWO$=TbW!-oB$SbC>0(6Pbppu4OZ zX&MLiU6$4<)by%XQ8B6OFq2iGHWR$og|oh3x?7{ef$?@1f4iHfOTMdDJIbtj#|Wpj z0HE{H2cOfrY;AP)&9q`2sj*H2pmz$b1|3*z z#va$>uQxj^b7lvZolckSjvH;W)e%!Q6i<%aqJfLWSB-AGBeQ0B>}m&XD;-VkIn`sC z@3Ktk>aAvW_~mv-x?J!0xl!xT8?_Eymce2;jU>QIx#^)*ql<3pU<2a;9J;~_yJ6aJ z+=_PL9ifdH%m~I~ci87-u!oW5c8A`;Gm+693+!Zg+p(aNq<|)db8taawN|*^Gz?N4 z8Ox4rO((?IpeO=iGBXU<<{c|v?@d^`$Zo@)r&s)`@l1aE39NK74W(&nb=UFMJY`pN z+^{2?7F-)pK1MHT>5vtp3oIZ_WD9V`;cF+yR>D;sn8UN0tU^z$h8x!EwXmhx)rPHT zVN2yHu&|DF~a>p&QG?Wm(vkE;~2eo`QP5zFBFl z7HZ4}&H3P7XEv-f9T%_ojAl)*J7K#5OAzRoUQczc_~(gRol4WTVTyzu z-PNdz^}QO}R*H44s_?RS8?4K`buw9I0cBf$xD1QT(w3>hL}@Gw3mw_AV8%6rd)zoG z6n9LHc&p-Kc04yZJp-#dm=!y+Ma0&jWI;oh+I-qr$8IMuYbZM+yoPwAm3vO7T2NT-fLUwMTII|~K z3(Ga=ekh)d4Ir}Whn1qH)q|0ELTMNc8;CQd%oGIjWLh_aEKEAYOs>$qOed3B3!~D+ z^bA$#n$32Qt%TXS{kmu*8Hrsd5-y1R$!z)>5l!b|Jy|G~vp2yaxR@rL(o}&!SU!98 z-n!GH;H4*B);gN&0xzu6WzB>oD3|H2`4`@S;9DqqOA%&X46-rcYj;?h$Ix^UM>W5J zLN}GN<(skve0u|nE-{I==O!~#+hHM}NJhkj7#Tz}a341|Rmhcgth%xehi2raJKM1F zB6=o6?j!IG7C5$;4r{IwZmTu?2~taGxYL^=W;Cu%aaJm0x=_Hk66`*PEzz-bINc62 z*?4|2Ipij;TQZrD-Deic*v&!|jTW+5d=JUR(v`jeCkjKa&AO@yBjL)OyHC=nFg;ny z;kzt6cY5xY2tzSDTuM8d?22BIT_75EEnI~Os%p+|w_$}dx?{op&4gTsd2EM^U2W+7 zCya^`VNxiCo(xtMMDAgz{+mjZh4cWLft#w_mK=-bZNUBp#T{#+}6F1DBbA@&?EhrQ3s?)&j&nDuc}}?OE`K~k-%mn2#STxZgPsg_4KN>BN!JGYZV5ua?}=@{ z1YP-++U{iUC+zf|=taj?;`c0CjJyd*kFM1A&?o7$`o}_EW9xbkJt^cm;2v7B?YF3| zgPneLx$~rST?^cYSJK6vNk-y2Pwu|X(0Q~IK{f)@%t~$9^VUe{NISL?e}`=mM#gKE zwuNG*c(icm`|kPR@b`amU+!GBm>R%>*l!Ey4*(CNCUTGs&_E5OAQ@m7)c|k6w}CV$ z%>r%`%s@Ku%czc2XrrMysLhaeO~O$}E=UWb3aORRZe#(sipoIOpvHwd+)_s^D8nn2 z2iw|!*TBA}$7up3f3WqF_1+oy#D(Y2ocrXV1O57~$#-+THP{7rpt~Un?AQXIlkaa0Mo|I3IIOq0=k&n+ zz4YjJ9z6fy&)&LcJ8FON{=5Gj*Fb+AS5>aP7AsDKMDRFia5H>&&ySPyJ05KnEV&l` zQNM>^tU~aDD;*02H^iCZJ(oQ7w`U#yVaB=ap)D7zJBnYS!}eJ2Ec`5`c8>x=d1BAW zj=u$V%(D5YE;%OHj{DKf>mUB|4XJ11AG-PM{8uN49X`4jcc%xLnr*}frxwCnb$IjBR-4CmD8f{H1PL^u^j%6F@KK&(_Tpj zf48|G-ZWWvBk6@_Uf+IrpBmo5#>Xh^oal8eS9djoQs_5+oqF8!i-4kJM&WM}#y1XS zd=AjSZ}=Re!yFXQMmSp}fj$lAjwaN&@GYPsnt)j)pzXk^0-S)e)jYrmND?4!M3e$) zG4h=R$}}pW5mqmOCSk!@h}#Ii&?>O!*RcCjf*5FNb+uuabrnk8JqjpRQ>e##`a*jzpJMZZ5 zi?KkA76Xo6G4M7DX&HbYoi$v8=x&%v`maxYfMoV6?2Y z70q(tr$I&ohv=$cXf5yqwk9xVdF+M^>VXRFgqEoZswP;DCb*6wn2s%2vL={{CMfMe zqEK)&OE6skm1K0!8F@KwGE;i5DT9OdP@CCR*b!XxE0Rb#3!w!<#m=jucQx~d+*0yY&Ycv5(Gm1|3wJM2Y1A5~Zjt$z9E^peSb&c; zo8}3i;9s4~GVDp!@ecwpuYf44@H_+zI%dPoV+o<6gUvh|t`lN|l+w~|w<#L|t1$#}>za%#VFP_D`qS zkDk)8A6+)~6N_U%;m5uo`=?Xv$4=?khdU>@Ctd1(e{gZ^5Bjn1$NuRQ`|(pc_T$UO zz9cRVexUigeg1CWX|&syIHjY1`JH}giQxBR-@o#oPFMbcS7z+T*5+5f<#+m{i(^0P z$G#u?r&H_?z9M5k3cv2J#V`EJ@AStP$9~+8eLwb3r`S)vGGjk3N^24O%kT6LEROvF zKlc6DKb>M9cDPRENBfrF>Q62X{-huLe(;}G!GCH$+qc4A|5Dq1k{|wl_@CUV`rIDHvB9S@la8rGWwrJAm$`lIof6b(!gTnywpq&&qT;Xyo5 zf`*#yRmK9-gpXti>!&Fa7J|SiW{3|YB0XP$Etw)bwVdjQ$CyX$2IK)q^~Z#WC`8~p zF2rK^VP;8$Pb48ElSv^iijsf@3Gt*D5h9SKASMim$;1Hu9uS3r0WqEs1|w23Dhx)& zSVRciWac4LT&iCX1Syt`Mugp)fkyQ%q>U?-4XA=h+47Lr1GmHnBaLmJpd?9>n6N^z z*h|Vlz5v!T3Jc8+uR0Cz-Huy+TPb5uTYR4fCZe=YnUssjNBK;xuYm ziM)CQ9+Uz_y|yjYFNPueMPx9Fi}^Z?0PL+SI0D64b(spiw%Gt<7qG{)K`bg)1D7nQ zfC8=4#M1N1&)FkOKq!AqGaQ zrUOsN8}Nub^cZto$Jtgu7Bnjxx`TTXlw#4qgl2ZhPIuwKeHfZZ0A8F}wswI2rLK*_)j2gKgjt#%n*AoqQr3_>6gYok*lJpq=3+8Q zdl3c?zzY^(nhpcATaVON6`K_tVD;Z%aQW@tbSX?A6!BwQVU+=8V-ZZjl*%VbH) zIM;@E73MuUq}>=P^uQq6I=IB*p|tZFrT(2DvF{rAH}b$Fn569%c@VPEC!D zXBTNLz(@m`2zu~dWm4*Ekk$@;Bqy(r1LlWGO zATflHUtUA7BZwh*XH&4}m?6YJFP}%G!~oVG6s1Hm*=-2mU>5w92K>F`Xe=P!0(ro# z+X4gCYE%`aN(CARX(6HzNsEVEg1x_3Bq}Bs2x0|Djav!RzbhSt+$%UARK1CbUM4iA zi;8EuVwEbkIv6C*ltkFx7s;rujV>yl>*D=ly6_xdOI<{~r%S@p*(6!}ekoWy)0G&& znwJPs>O*NDa#G{vWsqazMa45+g9CV?c;iK;O_vW}sxB(t(?#Zn&E`f$#+q@UtxdlM z2e5dqYjDAMRkStMMZ|l$@F|VY4M1^;$1QXE;2=5e(SRIGt~kIE_$g_LW7&Z0r0V0! zhp`tP)d{huc|U?&)3E@C(o2l9OS%iO`ewk<9~@C}A3_6|!#N^FSi{JAoAy z*Fqyz;%Qtk1;{V5U7@^I8oNfnN>9>!^#8B=hzHy2BRN%bjd&I;I+<3<>6|yv=$U@e zf|gxXk^?6(@LrxxI^dF2!SkJJk|YJc%dp~kUXs*~_aq5-Wwi!`hil+{p-a&SIlpzL zl=Ra2LWFyo=(&@fs9_NZhOV6^EZozyir17xM3u=B7_N@Eppb>Z@-u+&@Npppwyx+7 zeSZC2YVZl|mX_)?ZVT{73940m9tW$t2}{hZW#!(|Vwo9lqrX+-+tVlBhrbbe%9JT` z*ii8O+Ea`^`yVW4Dx!I&k1=}w&f_%iG|P28bPsKQ z=m($u6UxtWON%&RDIC_hSCGGlfLK0qi_sr=VJqdQY~J@<0XzBpzYFu-^31z9^Eu6* z+sXI57WsU!v1^^D7^i>Han)e>&!PCE4FhBS_#eDeagXaBe>p9Bc0c#q7fJH$d)Ez-npd;>C;DmmHLQGO z9WC>S3^GQZkN6VC_c{g-UPSdm2G3dt3cRLd<@|;7)Y65Nu%$sQeb!oVw%KKmz1al{mQ^NA8joR|yH^$k|tyTpV(V z?{)Xnq|c=gelJ1#EK(YH!A;1a_tLthfxm*f z`)jmrX`p`vAyJdoEe&)5{a%aKEe(9-0zy6t>D7>yfoA+ZLb@Pb0|ocqPlyB3F9Lr5 zqfiMBNRo9)mRxw!&wuLp-GG(}IR@Y`G~k$LAz260u|UTH+ycM(_&&Eredf&`$!^AB zeQZ7yZ0Y>Ljwm=MJ$7(-#TE`H5RxdbPv@ck4~K+G!nDVZkNsl4JztvnEVHkKiP!2`#5er_Yr zlLPN$cwyg(E#G(1{(s5h@`S#JP`=Rjz^*57oSen35u(4Y!20x>K#y^g^I7pfJb(7e zOIYH-9UQ+O;SJFrF}WY;>0{+pgg;-!@$zb3|8G~^%dSmd{6Oqo6!YER|02Un`1v1> z7g%}sH0Qr+;{)@?^BlHA)Or2yxV`2EpI}{f>^MJYIURX>esyfYfBRK7iCmU z(PskJ3fF$}ai$N7Io`lR+W+iAg?ZB8`U^V<^mUjJb`tor$W2Uc_g0RHVnH;;{fB0w zaAod-^HtYcmxDLvxXC8e&*GopI&%p&74gs%VIYI;!(kVN8 zOd?GySU68eteDoLV`={|=d^#AYC-cHK8OSNMKOSh#L8E~nXOB(-a(`nu$vOVAs`Mf zw#K1-(TnBnFve;TA|R!uNAhK>K+_MRJ=$UULPkae6!o@1J>e^yV)?VMXA0#lWfvXw z7ZAIXweKPjLCrNVGDfbP`tnu#Z#z`_{GCUxz2KYD(aSxJUs2tt99oCc&_mdB4a*U7 zB`~0#9EIO`@VlPuAmo5+?QU|(J|e}}t|W6ic4(^~fC1NXJdo^O0hV61;^~W4NPE|k zul@P>0mnHXA`j37Vw4c68wSbQ=bwA-g?%6$D5FrndsS@Bs@=-E3!|%6IN}dW(cR}= zD4Ii7QN^NU_sZ_?k`=30ef6Vv@$q>Sp%6YN{B)MjzaQEBSvKFSJZJv=@Jlz(+w{7a z=QyYR$agQo-3Sk#&FcyILhe%Zg;}nrpo1CrcbDIF{J6*q`Jea}pPz)j=YQy`dj$=J z!Vr6>xt@&|IK7ysC2aSOd)BbEu;7=xm*=hUkDj4?s2S-&*YEU*?%;O1ZdSnDHP>|AMy0M)4JZ06yA>KV;q02BTB`R{de*Dhgb7F z#Zg91I5CD40mnFwM;W2uCupQP=leWfzaRcS?_XY78(g+=MiSj*jD?c3|UwP$3eD}=V`)Su*n=aimckF$8ZlC0fWWl5b zc3<4bazZYZx!AFkyerY(tFb@DI!*9#?w>y{f|#!%{4~Nt2)~2yKM=l-F!(U%qaoal z@Pi0Hg76^1FC+Xh!plC)>&pmB2xk#~7U8!M{u{!h2vw6LQBTOTlK&T`9Fv8Cx z{2IcaAUykHoZm$VuSa+*!VMVi#p{nF z{0zb$Ap9M|^B&`LQG_Xk4mWK7=vbg*fsO?_7U)=@V}XtZIu__y04?Bh7YuDmHAvrBW;B~jjgD`ROjwp~ zhTU%6s5NHtwQ5l-x$-qbca>_jQdxy`g_pT>B~Lb{;(eQweX)qUZW``#Ew7Z_oX|Z{ ztEld>R#&P8L!EZ#3{{!bl>+G>8p~wjsqElzc6c;4HWZIEv>*Gkyw0F-`G$lolW*-61*+u zgkq@f619MvOLG;}qEatg&~OXH#nYQJqe&rAXcQYvCx`mBN5V3R#|AT_smK(xZXh;{ znh83eX7gXI)^NOVwkalx?duniGfEp%~ z8Xbzbjd~S2K{ebyPoT#WbWf@?hE^>(Z%OxiCw*AU=}G4vuUZ zJrNgoNiT)vu!js}Hn()32Igca-l6G84F*+NnQ@wVqgF2G6eA3sV9hv7)}*siE7Z#> zNkD^7IBEzC64CRCzH~g|A%i37Oy5Xplmgt-jt4!W-qwLGMk*e3^4{a;aw9ZL;czQ%=RSa1rZ%t z&J-B}*grH1sxc49X;pU_6wx(Zm9978Kcg5;#z!J|N{f+@q0s@RtnDgfD9yYf9f>zK zH8wV4jsAvOQVU8>DJgmIprJGv1>7YaG0cb@E@%$U6Un)R&t=_ZZUq$#L5yQ-mA?DWo-_D{E@)t0o` zk~Uh>N?x`3%+`3fQM=@It(oa*>R>dJJM|K)8UXU0y4uW?w4z;*t8mj%B0a}-X6aH( z8rwqgR*829O*dNT8?7`g{4K566sA|3N|;mg(p+uIwbDYQ=lLjN_}Y}Mb)}_gmDZ+J zye&kN&GfX|qHC?CZ57?$nr`wem2L7uGug;DB{ilCHpxtjX8D%Zs+A_a(r9v5s!coBN=Lv#<D%`SaYs)Ua zhTwN;{tXi#Xx_2s5ihE~avYo_iuOb@IEMOEo3rWJd>qHCF zSS??#s8tIrf=kpan8zZ??U}^rNV~CH^vu@{1M0a=%~H9EwON&H$@p7VMs#Vr1=d#f zT9+-A0JA08mxYC5X47bDIFpFOVnxw)P^0eLWd%qoy?vzLUfHJOLxUq@BP|1p@^5H(+OPZ4fTzUfIp-nb=`!EwAE6? z)`g*fpQFYyiEMfl{Dv)>VUg_&sECJyoqby@6o9 zR<0R<9M8l?!5K#)TE&TO(nQ7vQ>{yFHkeg6$qbK;bAeW+-f-e-7T4bEJw7?;53ZLP z8MyCAJaWBE#*(loOl7k1t+0|!M_8-Wg2W)Kf$eg8@n~b{`jM|qP1Ul17M9wIT7h+> z;At=1=if%q`yhT_;6^h#u@l4s9M;!OuN;)Uy<{A2#uB5c!OZp(E|1-=aiwle)C{^39*?n`0eY7NmQ6?8s+D&)3MKk; za!t9v^E(?lZQr=t39+YE+xs`&ck}0+ z0t)u+bmDy&@xImExfAR?D)BtF{rwif=Uw=I2775*AY0&Wc+k4=t(6vnKTr}nY2I;t z+i@Z_=2eEwiRj;o^5g6cAu9a;M*dsTrVh_PP7Cn&GooBMy*V!>!*5Jq`o4v{Y+e5T zu=s9;NfDn~oTSL>f&RtiWbNSZ!isM=DEr2nkd<7n?&mJ%@1yRx#%{&Y<>+myg^70o z>iOmBcJp_L$x)YGS$~h6JgLNbppGtAH;L~j9%#0UL{3VCO?)Gy4lgGQ-x(sZxJnVS z`whyv7G#YtR~O%hB9g5hIl3HulWakX_16jNrqZ$Wop+3`_|T#H)YA_HZ~Ui&A7QU1 z;R6zK7jSixIx&d>uuN(sPZWS|Qi601&Sj!PZUWL3mMRks=oL~W1*oIK+r4i1x`NiL zGm0v)fSa4-SgArLi4N2Sk_Eg9B^H#?ni`pcyn(HvdbWStK#O46Tyc6`o{-C|(R>Vk zR8I}~yGaASkO>0kAbj)cWY{Wb(SURb^sC#H6~K6ji+D%~&L(Ip4k}mv#_+Q{uYPsQ z?q^AGE!f9r@uC@A$$~x9!?S8ef0x;cwFtXs>A%@;BZ{1qWR+Se#Y3 z1(fU*E^7-p{-fL`Dv0Z*BPft#P5Lx3408PbpC9*`u>o0Wu)@Yp#Io1itL zD=f*5DYaUt8Ck6Wxz-jr@_Jn=Diy6f10_KRJX2K5T{P+AX{oAIRLHaTuS?w^jjOdP zh5gAfDIRcof&p2Y@<~z2=L*OJiCKqfsk#pPKTyf*sA%xuG7n54CpWw~CT}<~OGS9R zvh0#&*}rZ9s0zKslj7#i772ROf6TY+e)ma1D>R-w1o0yOeunv z1s#g6u4B?X>HNtH@NDmH+X32fo#g_AU4NmfPDbAXvK!60R++K}{uu6jy2$$+|f zT`E^3*cOCsx~i3>>L^BjB1`wjVFOOm)to8iK!%~}S=f&*NY$ENmKv~k1KW$G8OTD_ zn$ByoTJ$8TbUTN(Rj+E2o-bGG0=pmU@G7y}6WSq}$Zso|x41YD<}p?XcvSAmb2&lX@thJIJG zmImAWlA@YY!&IhJNtps$d4hQ`fdS7KU_WM}m<2m1xe5#n1xx^TR`nbwujyd)GS~vl zP_QQ8r3eW$%EFFXp*Af|RV$iQEUOLO(AXv*RJ5ci9W*VPB{Qe+Ud}3oo$v@i%2hNE zl@G0~Ko>*SD*;DS(yCLmd5&DIRI6w@8;_x0zsuuyh`z>Q9s~@1l%7>!kFH9$&0$;t zQYpYo9?HA*C0^j#`e81!SXOi!GPix=zF6sOJg}(3a_@%@hP zpGm&&KdpTq?wsJBbg}#W-i5y3+wuL5@1IG&A2_XjKd_|ld*p@A54g^5UuU=P4BG7r zp4Q&K^iIEL5$Este&@=6CSCb^PHW#^dZ*vF(D!{E-|zVTndJMur?u}dz0)69==*_= z?{|FvO!EEEY3=(<@AUU9^!=WW?{|FvO!9r$;X0jP?OS@QKeW*KLmlVuIR6>t{C}M9 z_IXdyd%er-^)I&F=jphA$Nf)t_a|fo-p3Dj@vo^IX$!vF2zOc1IvSG=-j0Vz4K@7+ zN2a6|!d+fD;FTRCEG;{dO;nPlSp5qr*AWRWcYc5QYaLX0gkaKL8;g43HhX6pX~Qaj;)m>#J>x7Ns{F8hk$-^BjC8)`M9AxCj+b` zbFw5vI-xb`fvCi`VUF^69O;R| z5(QdmV;Pj4NA6d9DXYN}m}Fi7WN1Nu$+8PP5bQ^mX^nnGAFNK;1$ISRkTfcb7sQLj z#S1nz+uAJx}SaM_B zA|4LNhcSFuTn-u((yiBZU9~8hg#mGc0pJ4*H;?fL5q01T1h=JDAkGF2IaD@tPD3rL zfOV-x?plv@odW_UW>SM2A);L@&f?%%27Ie9W8)zVNq=fEnV}I=){ZeL;6X0gFG0M< zwKf^V>fnVoCKVrwvyg$5*fB6VIxrMpAO+D-djOjtC`I+PT$oq(1ms{Q=3Q$Oj6xhr zj3pv)nN%M{%YpA%a%Gj7k+cWs=tSD=MB3~`+7v-FApmM8(q<>pCW{c-iL~jXksv#f zHan3vJCQa!kv89O_|8tGO&(Rg6KT^9zuAej*@?8-iL|-wpQkusq)iM^a*YU7()oLR z?C&n0=14+qnHgrjBVM)b&m~Nr^dILd-pu+bc7d^Lxs^*(f?SEio zsUE~VXITz6yZsamHt;_OjYAw)--vbSZ;>#v-8s%16%3mVC+CMFP&1U3|Y%Z-jSLb;x0JJ{=A)ZLeK$YuyW zA&l`yVLm#k*gY&a=UMKNZ(11VZwuos6LV>s`=0_~ls^jd2l#xs;8F%H3-pG10)a*S zg#9UkCFZvFsDfxvE(yg318iua%g8Frq05|Fv0RcZmW^Tb9$9TQ?Wq<^B?+;#dG^F7 zs|A{SYg)@B39&t_eare(kkN<=y=b2Hb&a_2^e#FWmb%Ebg>%Gl5M)A7Vs9_Ag%}4O zddU@*VVBiYA(0EQCC(cH?7`|=AhD(QdwYwmz5iCVkqQxQ4Eb6mLK>{vHktM^8c`v~ z9B|=+mUp}-)N>LYZ^zHX4p-psLD;G(p?M3%MO9OjmbNIl6AxlegKbenTli9xz6{km zq~2s(7;{_FytO7Q0#B(V%G{Q;yw!@uTv5(Z=Ya|=Q(y~&C0(D=czP*Qtl;V873N(B z#E@C6^BL~ese)O%-67rxC>GiDBRg9Wi(ICc$5x6rR|9 zklnA%A%5aM{`cky#*cm;@yQ?V<#DnxhV>d6Fcgj#zo&9M#?jUhzhf1~y2e=EbBI5% z0po3pzcc?R=cB*x3C@S`IO7S#9~>63z&V{b-wcV9kLx=>j;)BOOGCW!xVX(Y&Zi(Z3+D9X;CNvm9;XLuYY>pxcW1^N=oiNtC6|$NYU4_p#Jv zm|qQl2ZbK*#C$hG8b_EOYq0zZp0)M<)$fn9px7T>8D%ABV|k;C=g-0X;gviuJo20P zmq|oi;WbEiF~S48xL;s1z(8C-JJLEbz6j~hMR+N~WOtOM1peR!JTL5h5b3%Q3i-c3 c&fD|i+c`b_RSVWW@rP87Vm^lDSltHy3&jACUjP6A literal 0 HcmV?d00001