DoS caused by manipulated DWARF5 directory table entry counts

[Toasterbirb]

Environment

Fri Nov  1 04:21:38 PM EET 2024
radare2 5.9.7 12 @ linux-x86-64
birth: git.5.9.7 2024-11-01__16:00:10
commit: 92494039b837acf157898b8d03947144d5d2cb6f
options: gpl -O? cs:5 cl:2 make
Linux x86_64

Description

It is possible to make radare2 to hang on startup by opening a modified binary that has had its DWARF5 directory table entry counts in the .debug_line section set to really high values. This seems to affect radare2 versions from 5.8.2 onwards (my guess is this commit f237ee0).

Also the rabin2 utility is affected by this (with the -g flag for example)

This could be alleviated by checking for impossibly high entry counts. The objdump utility for example seems to catch it and prints out the following error:

objdump: Warning: Directory Table: Corrupt entry count 0x1ffffffffffff

Also the file name table might be affected, but I mainly focused on the directory table entry counts.

Test

Patched binary for reproduction

f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAYBAAAAAAAABAAAAAAAAAACg/AAAAAAAAAAAAAEAAOAANAEAAJQAkAAYAAAAEAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAA2AIAAAAAAADYAgAAAAAAAAgAAAAAAAAAAwAAAAQAAAAYAwAAAAAAABgDAAAAAAAAGAMAAAAAAAAcAAAAAAAAABwAAAAAAAAAAQAAAAAAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAGAAAAAAAAIAYAAAAAAAAAEAAAAAAAAAEAAAAFAAAAABAAAAAAAAAAEAAAAAAAAAAQAAAAAAAApQEAAAAAAAClAQAAAAAAAAAQAAAAAAAAAQAAAAQAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAD0AAAAAAAAAPQAAAAAAAAAABAAAAAAAAABAAAABgAAALgtAAAAAAAAuD0AAAAAAAC4PQAAAAAAAFgCAAAAAAAAYAIAAAAAAAAAEAAAAAAAAAIAAAAGAAAAyC0AAAAAAADIPQAAAAAAAMg9AAAAAAAA8AEAAAAAAADwAQAAAAAAAAgAAAAAAAAABAAAAAQAAAA4AwAAAAAAADgDAAAAAAAAOAMAAAAAAABQAAAAAAAAAFAAAAAAAAAACAAAAAAAAAAEAAAABAAAAIgDAAAAAAAAiAMAAAAAAACIAwAAAAAAACAAAAAAAAAAIAAAAAAAAAAEAAAAAAAAAFPldGQEAAAAOAMAAAAAAAA4AwAAAAAAADgDAAAAAAAAUAAAAAAAAABQAAAAAAAAAAgAAAAAAAAAUOV0ZAQAAAAQIAAAAAAAABAgAAAAAAAAECAAAAAAAAA0AAAAAAAAADQAAAAAAAAABAAAAAAAAABR5XRkBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAFLldGQEAAAAuC0AAAAAAAC4PQAAAAAAALg9AAAAAAAASAIAAAAAAABIAgAAAAAAAAEAAAAAAAAAL2xpYjY0L2xkLWxpbnV4LXg4Ni02NC5zby4yAAAAAAAEAAAAQAAAAAUAAABHTlUAAgAAwAQAAAADAAAAAAAAAAKAAMAEAAAAAQAAAAAAAAABAAHABAAAAAEAAAAAAAAAAgABwAQAAAAAAAAAAAAAAAQAAAAQAAAAAQAAAEdOVQAAAAAAAwAAAAIAAAAAAAAAAgAAAAYAAAABAAAABgAAAAAAgQAAAAAABgAAAAAAAADRZc5tAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYAAAASAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAASAAAAAAAAAAAAAAAAAAAAAAAAAGQAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAHMAAAAgAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAiAAAAAAAAAAAAAAAAAAAAAAAAAABwdXRzAF9fbGliY19zdGFydF9tYWluAF9fY3hhX2ZpbmFsaXplAGxpYmMuc28uNgBHTElCQ18yLjIuNQBHTElCQ18yLjM0AF9JVE1fZGVyZWdpc3RlclRNQ2xvbmVUYWJsZQBfX2dtb25fc3RhcnRfXwBfSVRNX3JlZ2lzdGVyVE1DbG9uZVRhYmxlAAAAAAIAAQADAAEAAQADAAAAAAABAAIAJwAAABAAAAAAAAAAdRppCQAAAwAxAAAAEAAAALSRlgYAAAIAPQAAAAAAAAC4PQAAAAAAAAgAAAAAAAAAcBEAAAAAAADAPQAAAAAAAAgAAAAAAAAAIBEAAAAAAAAIQAAAAAAAAAgAAAAAAAAACEAAAAAAAADYPwAAAAAAAAYAAAABAAAAAAAAAAAAAADgPwAAAAAAAAYAAAACAAAAAAAAAAAAAADoPwAAAAAAAAYAAAAEAAAAAAAAAAAAAADwPwAAAAAAAAYAAAAFAAAAAAAAAAAAAAD4PwAAAAAAAAYAAAAGAAAAAAAAAAAAAADQPwAAAAAAAAcAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPMPHvpIg+wISIsF2S8AAEiFwHQC/9BIg8QIwwAAAAAA/zWaLwAA/yWcLwAADx9AAPMPHvpoAAAAAOni////ZpDzDx76/yWuLwAAZg8fRAAA8w8e+v8ldi8AAGYPH0QAAPMPHvox7UmJ0V5IieJIg+TwUFRFMcAxyUiNPfoAAAD/FVMvAAD0Zi4PH4QAAAAAAEiNPXkvAABIjQVyLwAASDn4dB1IiwU2LwAASIXAdBH/4GZmLg8fhAAAAAAADx9AAMNmZi4PH4QAAAAAAA8fQABIjT05LwAASI01Mi8AAEgp/kiJ8EjB7j9IwfgDSAHGSNH+dBxIiwX1LgAASIXAdBD/4GZmLg8fhAAAAAAADx8Aw2ZmLg8fhAAAAAAADx9AAPMPHvqAPeUuAAAAdTNIgz3DLgAAAFVIieV0DEiLPcYuAADo+f7//+hE////XcYFvC4AAAHDZmYuDx+EAAAAAADDZmYuDx+EAAAAAAAPH0AA8w8e+ulX////8w8e+lVIieVIjQV8DgAASInH6MD+//+4AAAAAF3DAPMPHvpIg+wISIPECMMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAIASGVsbG8gd29ybGQAARsDOzQAAAAFAAAAEPD//2gAAAAw8P//kAAAAEDw//+oAAAAUPD//1AAAABp8f//wAAAAAAAAAAUAAAAAAAAAAF6UgABeBABGwwHCJABAAAUAAAAHAAAAPjv//8mAAAAAEQHEAAAAAAkAAAANAAAAKDv//8gAAAAAA4QRg4YSg8LdwiAAD8aOSozJCIAAAAAFAAAAFwAAACY7///EAAAAAAAAAAAAAAAFAAAAHQAAACQ7///EAAAAAAAAAAAAAAAHAAAAIwAAACh8P//HgAAAABFDhCGAkMNBlUMBwgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHARAAAAAAAAIBEAAAAAAAABAAAAAAAAACcAAAAAAAAADAAAAAAAAAAAEAAAAAAAAA0AAAAAAAAAmBEAAAAAAAAZAAAAAAAAALg9AAAAAAAAGwAAAAAAAAAIAAAAAAAAABoAAAAAAAAAwD0AAAAAAAAcAAAAAAAAAAgAAAAAAAAA9f7/bwAAAACoAwAAAAAAAAUAAAAAAAAAeAQAAAAAAAAGAAAAAAAAANADAAAAAAAACgAAAAAAAACNAAAAAAAAAAsAAAAAAAAAGAAAAAAAAAAVAAAAAAAAAAAAAAAAAAAAAwAAAAAAAAC4PwAAAAAAAAIAAAAAAAAAGAAAAAAAAAAUAAAAAAAAAAcAAAAAAAAAFwAAAAAAAAAIBgAAAAAAAAcAAAAAAAAASAUAAAAAAAAIAAAAAAAAAMAAAAAAAAAACQAAAAAAAAAYAAAAAAAAAB4AAAAAAAAACAAAAAAAAAD7//9vAAAAAAEAAAgAAAAA/v//bwAAAAAYBQAAAAAAAP///28AAAAAAQAAAAAAAADw//9vAAAAAAYFAAAAAAAA+f//bwAAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyD0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIQAAAAAAAAEdDQzogKEdlbnRvbyAxNC4yLjFfcDIwMjQwOTIxIHA1KSAxNC4yLjEgMjAyNDA5MjEAAAAAAAAAAAAAAAAAAAAsAAAAAgAAAAAACAAAAAAAYBAAAAAAAAAmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcAAAAAgA5AAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAABwAAAACAKgBAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAPAAAAAIA6QEAAAgAAAAAAAAQAAAAAAAAFgAAAAAAAACYEQAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwAAAACAAwCAAAIAAAAAAAWEAAAAAAAAAUAAAAAAAAAoBEAAAAAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1AAAABQABCAAAAAABAAAAAGAQAAAAAAAAJgAAAAAaAAAAVgAAAAGAAmQAAAA3YBAAAAAAAAAmAwBrAQAABQABCCgAAAAHhwAAAB1WAAAAAAAAAF0AAAABAQinAQAAAQIH2QEAAAEEB5oBAAABCAeVAQAAAQEGqQEAAAECBQYCAAAC8QEAAAEpFFQAAAAIBAVpbnQAAnUBAAABKhYsAAAAAQgFFQIAAAEBBrABAAAC8wEAAAIaE0gAAAACdwEAAAMaFFsAAAACgAEAAAQhEoEAAAAJDAQDBQnIAAAAA8QBAAAFBY0AAAAAA7UBAAAGBY0AAAAEA3UAAAAHBY0AAAAIAAp8AAAABAgFA5kAAAABCAeQAQAABW4AAADrAAAABjMAAAAAAQgFEAIAAAEEBAACAAABCATSAQAAARAFbAEAAAEQBM0BAAABAQK+AQAACyAFQg5DAQAABOwBAABEDsgAAAAABIsBAABFCNwAAAAMBPsBAABGC0gBAAAQAAwVAQAABXUAAABXAQAABjMAAAAADWsAAAAFRwNDAQAABAkDiAMAAAAAAAAAPQAAAAUAAQjdAAAAAYcAAAAdzgAAAAAAAAC7AAAAAh4CAAABFws7AAAACQMAIAAAAAAAAAMEBWludAAENAAAAAAfAAAABQABCBIBAAAB8QAAAAwAAAAtAgAAGgAAAFYAAAABgB8AAAAFAAEIJAEAAAFYAQAALQAAAEYCAAAaAAAAVgAAAAGAAREBEBcRARIPAw4bDiUOEwUAAAIuAAMOPxlJFREBEg8AAAM7AAAAAAEkAAsLPgsDDgAAAhYAAw46CzsLOQtJEwAAAw0AAw46IQQ7BTkhDkkTOAsAAAQNAAMOOiEFOws5C0kTOAsAAAUBAUkTARMAAAYhAEkTLyEDAAAHEQElDhMLAx8bHxAXAAAIJAALCz4LAwgAAAkTAQsLOgs7BTkLARMAAAoWAAMOOgs7BTkLSRMAAAsTAQsLOgs7CzkLARMAAAwmAEkTAAANNAADDjoLOws5C0kTiAELAhgAAAABEQElDhMLAx8bHxAXAAACNAADDjoLOws5C0kTPxkCGAAAAyQACws+CwMIAAAEJgBJEwAAAAERABAXVRcDDhsOJQ4TBQAAAAERABAXVRcDDhsOJQ4TBQAAAFkAAAAFAAgALgAAAAEBAfsODQABAQEBAAAAAQAAAQEBD/////////8AAAIBHwIPAk4AAAABTgAAAAEACQJgEAAAAAAAAAM4AU8DEC5CIz5NJCM9MQMMdGgCAQABAVoAAAAFAAgAUgAAAAEBAfsODQABAQEBAAAAAQAAAQEBD/////////8AAH8AAACNAAAAlQAAAJwAAAACAR8CDwZlAAAAAaMAAAACqwAAAAO5AAAAA8gAAAAEZQAAAAUyAAAABQAIACoAAAABAQH7Dg0AAQEBAQAAAAEAAAEBAQ//////////HwIPAs4AAAAAzgAAAABjAAAABQAIAC4AAAABAQH7Dg0AAQEBAQAAAAEAAAEBAQ//////////AAACAR8CDwLVAAAAAdUAAAABAAkCABAAAAAAAAADPwFMTHU9LwICAAEBAAkCmBEAAAAAAAAD0gABSwIEAAEBXgAAAAUACAAuAAAAAQEB+w4NAAEBAQEAAAABAAABAQEP/////////wAAAgEfAg8C3AAAAAHcAAAAAQAJAhYQAAAAAAAAAycBSwIBAAEBAAkCoBEAAAAAAAADKwFLAgEAAQEuLi9zeXNkZXBzL3g4Nl82NC9zdGFydC5TAC92YXIvdG1wL3BvcnRhZ2Uvc3lzLWxpYnMvZ2xpYmMtMi40MC1yNS93b3JrL2dsaWJjLTIuNDAvY3N1AEdOVSBBUyAyLjQzLjEAX3N0YXJ0AF9fYWJpX3RhZwBuX3R5cGUARWxmNjRfTmhkcgBHTlUgQzExIDE0LjIuMSAyMDI0MDkyMSAtbTY0IC1tYXJjaD16bnZlcjMgLWdnZGIgLWdnZGIgLU8yIC1PMiAtc3RkPWdudTExIC1mZ251ODktaW5saW5lIC1mbWVyZ2UtYWxsLWNvbnN0YW50cyAtZnJvdW5kaW5nLW1hdGggLWZzdGFjay1wcm90ZWN0b3Itc3Ryb25nIC1mbm8tY29tbW9uIC1mbWF0aC1lcnJubyAtZlBJRSAtZmNmLXByb3RlY3Rpb249ZnVsbCAtZnRscy1tb2RlbD1pbml0aWFsLWV4ZWMAX19pbnQxMjgAX191aW50MzJfdABFbGY2NF9Xb3JkAG5hbWUAbG9uZyBsb25nIHVuc2lnbmVkIGludAB1bnNpZ25lZCBjaGFyAG5fZGVzY3N6AF9Cb29sAG5fbmFtZXN6AGxvbmcgZG91YmxlAHNob3J0IHVuc2lnbmVkIGludABuaGRyAF9faW50MzJfdABkZXNjAGZsb2F0AHNob3J0IGludABsb25nIGxvbmcgaW50AF9JT19zdGRpbl91c2VkAC4uL3N5c2RlcHMveDg2XzY0L2NydGkuUwAuLi9zeXNkZXBzL3g4Nl82NC9jcnRuLlMAL3Zhci90bXAvcG9ydGFnZS9zeXMtbGlicy9nbGliYy0yLjQwLXI1L3dvcmsvZ2xpYmMtMi40MC9jc3UALi4vc3lzZGVwcy94ODZfNjQAc3RhcnQuUwAuLi9zeXNkZXBzL3g4Ni9hYmktbm90ZS5jAC4uL3N5c2RlcHMveDg2AC4uL3Bvc2l4L2JpdHMALi4vYml0cwAuLi9lbGYALi4vY3N1AHR5cGVzLmgAc3RkaW50LWludG4uaABzdGRpbnQtdWludG4uaABlbGYuaABpbml0LmMAY3J0aS5TAGNydG4uUwAdAAAABQAIAAAAAAAHABAAAAAAAAAWB5gRAAAAAAAACAAdAAAABQAIAAAAAAAHFhAAAAAAAAAFB6ARAAAAAAAABQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAAwAAAABAAMAiAMAAAAAAAAgAAAAAAAAABYAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAB0AAAAEAPH/AAAAAAAAAAAAAAAAAAAAAAAAAAAEAPH/AAAAAAAAAAAAAAAAAAAAACwAAAABABYAyD0AAAAAAAAAAAAAAAAAADUAAAAAABIAECAAAAAAAAAAAAAAAAAAAEgAAAABABcAuD8AAAAAAAAAAAAAAAAAAF4AAAASAAAAAAAAAAAAAAAAAAAAAAAAAHsAAAAgAAAAAAAAAAAAAAAAAAAAAAAAALcAAAAgABgAAEAAAAAAAAAAAAAAAAAAAJcAAAASAAAAAAAAAAAAAAAAAAAAAAAAAKgAAAAQABgAEEAAAAAAAAAAAAAAAAAAAK8AAAASAhAAmBEAAAAAAAAAAAAAAAAAALUAAAAQABgAAEAAAAAAAAAAAAAAAAAAAMIAAAAgAAAAAAAAAAAAAAAAAAAAAAAAANEAAAARAhgACEAAAAAAAAAAAAAAAAAAAN4AAAARABEAACAAAAAAAAAEAAAAAAAAAO0AAAAQABkAGEAAAAAAAAAAAAAAAAAAALsAAAASAA8AYBAAAAAAAAAmAAAAAAAAAPIAAAAQABkAEEAAAAAAAAAAAAAAAAAAAP4AAAASAA8AeREAAAAAAAAeAAAAAAAAAAMBAAARAhgAEEAAAAAAAAAAAAAAAAAAAA8BAAAgAAAAAAAAAAAAAAAAAAAAAAAAACkBAAAiAAAAAAAAAAAAAAAAAAAAAAAAAEQBAAASAgsAABAAAAAAAAAAAAAAAAAAAABhYmktbm90ZS5jAF9fYWJpX3RhZwBpbml0LmMAdGVzdF9wcm9ncmFtLmMAX0RZTkFNSUMAX19HTlVfRUhfRlJBTUVfSERSAF9HTE9CQUxfT0ZGU0VUX1RBQkxFXwBfX2xpYmNfc3RhcnRfbWFpbkBHTElCQ18yLjM0AF9JVE1fZGVyZWdpc3RlclRNQ2xvbmVUYWJsZQBwdXRzQEdMSUJDXzIuMi41AF9lZGF0YQBfZmluaQBfX2RhdGFfc3RhcnQAX19nbW9uX3N0YXJ0X18AX19kc29faGFuZGxlAF9JT19zdGRpbl91c2VkAF9lbmQAX19ic3Nfc3RhcnQAbWFpbgBfX1RNQ19FTkRfXwBfSVRNX3JlZ2lzdGVyVE1DbG9uZVRhYmxlAF9fY3hhX2ZpbmFsaXplQEdMSUJDXzIuMi41AF9pbml0AAAuc3ltdGFiAC5zdHJ0YWIALnNoc3RydGFiAC5pbnRlcnAALm5vdGUuZ251LnByb3BlcnR5AC5ub3RlLkFCSS10YWcALmdudS5oYXNoAC5keW5zeW0ALmR5bnN0cgAuZ251LnZlcnNpb24ALmdudS52ZXJzaW9uX3IALnJlbGEuZHluAC5yZWxhLnBsdAAuaW5pdAAucGx0LmdvdAAucGx0LnNlYwAudGV4dAAuZmluaQAucm9kYXRhAC5laF9mcmFtZV9oZHIALmVoX2ZyYW1lAC5pbml0X2FycmF5AC5maW5pX2FycmF5AC5keW5hbWljAC5kYXRhAC5ic3MALmNvbW1lbnQALmRlYnVnX2FyYW5nZXMALmRlYnVnX2luZm8ALmRlYnVnX2FiYnJldgAuZGVidWdfbGluZQAuZGVidWdfc3RyAC5kZWJ1Z19saW5lX3N0cgAuZGVidWdfcm5nbGlzdHMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbAAAAAQAAAAIAAAAAAAAAGAMAAAAAAAAYAwAAAAAAABwAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAIwAAAAcAAAACAAAAAAAAADgDAAAAAAAAOAMAAAAAAABQAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAADYAAAAHAAAAAgAAAAAAAACIAwAAAAAAAIgDAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAABEAAAA9v//bwIAAAAAAAAAqAMAAAAAAACoAwAAAAAAACQAAAAAAAAABQAAAAAAAAAIAAAAAAAAAAAAAAAAAAAATgAAAAsAAAACAAAAAAAAANADAAAAAAAA0AMAAAAAAACoAAAAAAAAAAYAAAABAAAACAAAAAAAAAAYAAAAAAAAAFYAAAADAAAAAgAAAAAAAAB4BAAAAAAAAHgEAAAAAAAAjQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAABeAAAA////bwIAAAAAAAAABgUAAAAAAAAGBQAAAAAAAA4AAAAAAAAABQAAAAAAAAACAAAAAAAAAAIAAAAAAAAAawAAAP7//28CAAAAAAAAABgFAAAAAAAAGAUAAAAAAAAwAAAAAAAAAAYAAAABAAAACAAAAAAAAAAAAAAAAAAAAHoAAAAEAAAAAgAAAAAAAABIBQAAAAAAAEgFAAAAAAAAwAAAAAAAAAAFAAAAAAAAAAgAAAAAAAAAGAAAAAAAAACEAAAABAAAAEIAAAAAAAAACAYAAAAAAAAIBgAAAAAAABgAAAAAAAAABQAAABcAAAAIAAAAAAAAABgAAAAAAAAAjgAAAAEAAAAGAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAbAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAIkAAAABAAAABgAAAAAAAAAgEAAAAAAAACAQAAAAAAAAIAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAACUAAAAAQAAAAYAAAAAAAAAQBAAAAAAAABAEAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAnQAAAAEAAAAGAAAAAAAAAFAQAAAAAAAAUBAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAKYAAAABAAAABgAAAAAAAABgEAAAAAAAAGAQAAAAAAAANwEAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAACsAAAAAQAAAAYAAAAAAAAAmBEAAAAAAACYEQAAAAAAAA0AAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAsgAAAAEAAAACAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAQAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAALoAAAABAAAAAgAAAAAAAAAQIAAAAAAAABAgAAAAAAAANAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAADIAAAAAQAAAAIAAAAAAAAASCAAAAAAAABIIAAAAAAAAKwAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAA0gAAAA4AAAADAAAAAAAAALg9AAAAAAAAuC0AAAAAAAAIAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAN4AAAAPAAAAAwAAAAAAAADAPQAAAAAAAMAtAAAAAAAACAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAADqAAAABgAAAAMAAAAAAAAAyD0AAAAAAADILQAAAAAAAPABAAAAAAAABgAAAAAAAAAIAAAAAAAAABAAAAAAAAAAmAAAAAEAAAADAAAAAAAAALg/AAAAAAAAuC8AAAAAAABIAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAPMAAAABAAAAAwAAAAAAAAAAQAAAAAAAAAAwAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAD5AAAACAAAAAMAAAAAAAAAEEAAAAAAAAAQMAAAAAAAAAgAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAA/gAAAAEAAAAwAAAAAAAAAAAAAAAAAAAAEDAAAAAAAAAyAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAcBAAABAAAAAAAAAAAAAAAAAAAAAAAAAFAwAAAAAAAA8AAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAWAQAAAQAAAAAAAAAAAAAAAAAAAAAAAABAMQAAAAAAAC8CAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAIgEAAAEAAAAAAAAAAAAAAAAAAAAAAAAAbzMAAAAAAAA2AQAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAADABAAABAAAAAAAAAAAAAAAAAAAAAAAAAKU0AAAAAAAAugEAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAA8AQAAAQAAADAAAAAAAAAAAAAAAAAAAABfNgAAAAAAAF8CAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAARwEAAAEAAAAwAAAAAAAAAAAAAAAAAAAAvjgAAAAAAADjAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAFcBAAABAAAAAAAAAAAAAAAAAAAAAAAAAKE5AAAAAAAAQgAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAgAAAAAAAAAAAAAAAAAAAAAAAADoOQAAAAAAAIgCAAAAAAAAIwAAAAkAAAAIAAAAAAAAABgAAAAAAAAACQAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAcDwAAAAAAABKAQAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAABEAAAADAAAAAAAAAAAAAAAAAAAAAAAAALo9AAAAAAAAZwEAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAA=

sha256 checksum

46fd18ff6bdb405a37314e951760f17aa961be4efa6f3865e44a455e84fc60ff

A diff against the original binary:

0x000034c5 1f02000000003c00 => 0fffffffffffffff 0x000034c5
0x00003522 1f06000000007000 => 0fffffffffffffff 0x00003522
0x00003580 1f01000000000201 => 0fffffffffffffff 0x00003580
0x000035b6 1f02000000003c00 => 0fffffffffffffff 0x000035b6
0x0000361d 1f02000000003c00 => 0fffffffffffffff 0x0000361d

[trufae]

Fixed in master now, but the way dwarf is handling uleb128 should be reviewed further as the problem is not completely gone. thanks for raising the issue. me and @W0nda will check this further before the next release

[Toasterbirb]

It seems to be still possible to cause a similar very long loop by screwing with the .debug_line section. Through fuzzing I managed to find a combination that gets through the checks that fixed the previous test case. This time around tools like objdump etc. don't seem to be reporting any errors when parsing the binary, so I guess there's something different about it. I don't know enough about dwarf5 to investigate this any further unfortunately.

Binary for reproduction: bin.zip

sha256 checksum

e3884f89e9e81c276b8bea2515a1f85e39e077c5e47e10d3222142e52577614d

A diff against the original binary

0x0000374e 1f01e3000000 => 02c7f5d2dede 0x0000374e

[Toasterbirb]

I have a fear that this is going to turn into a long game of whack-a-mole, but here's another binary that causes a loop after the new fix.

bin2.zip

sha256sum

60f2bcb13271aba067ac1b6c15a2341294630b183c82062c783857880d6403b8

A diff against the original binary

0x00003670 020f0665000000 => a9140d80e2a863 0x00003670

[trufae]

guess i'll use those samples for fuzzing before pushing more fixes xD damn dwarf