cpio TOCTOU file-permissions vulnerability

[Imran Ghory]

[Another compression utility with the same race condition issue as bzip2
(CAN-2005-0953) & gzip (CAN-2005-0988) - the file is extracted and
file descriptor closed before the file is chmod'ed]

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D
cpio TOCTOU file-permissions vulnerability
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D

Software: cpio
Version: cpio 2.6
Software URL: <http://www.gnu.org/software/cpio/>
Platform: Unix, Linux.
Vulnerability type: Time-of-Check-Time-Of-Use
Severity: Low, local user, badly set permissions.

Vulnerable software
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D

cpio 2.6 and previous versions running on unix.

Vulnerability
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

If a malicious local user has write access to a directory in which a
target user is using cpio to extract or compress a file to then a
TOCTOU bug can be exploited to change the permission of any file
belonging to that user.

On decompressing cpio copies the permissions from the compressed
cpio file to the uncompressed file. However there is a gap between the
uncompressed file being written (and it's file handler being close)
and the permissions of the file being changed.

During this gap a malicious user can remove the decompressed file and
replace it with a hard-link to another file belonging to the user.
cpio will then change the permissions on the hard-linked file to be
the same as that of the cpio file.

The vulnerable line of code can be found on line 581 of the file
copyin.c. cpio also use's chmod in a number of other places which may
also be vulnerable to exploitation.

Workaround
=3D=3D=3D=3D=3D=3D=3D=3D

Ensure that any directory which is being used by cpio to
compress/decompress files is only writeable by the user or
alternatively set the sticky bit on the directory's permissions.

[Steve G]

--0-720694802-1113914095=:98221
Content-Type: text/plain; charset=us-ascii
Content-Id:
Content-Disposition: inline

Hello,

Since no fix has been posted, I've taken a stab at patching this. I think this
patch solves all issues with chmod & chown. I would recommend people review this
patch and apply since cpio can create suid files, devices, and directories with
special permissions. I have a patch for coreutils mostly done and will post that
soon.

-Steve Grubb



__________________________________
Do you Yahoo!?
Make Yahoo! your home page
http://www.yahoo.com/r/hs
--0-720694802-1113914095=:98221
Content-Type: application/octet-stream; name="cpio-2.6-chmod.patch"
Content-Transfer-Encoding: base64
Content-Description: cpio-2.6-chmod.patch
Content-Disposition: attachment; filename="cpio-2.6-chmod.patch"

ZGlmZiAtdXJiIGNwaW8tMi42Lm9yaWcvbGliL21rZGlyLmMgY3 Bpby0yLjYv
bGliL21rZGlyLmMKLS0tIGNwaW8tMi42Lm9yaWcvbGliL21rZG lyLmMJMjAw
NS0wNC0xNyAwOTozNjoyNS4xODU2MTc1NjAgLTA0MDAKKysrIG NwaW8tMi42
L2xpYi9ta2Rpci5jCTIwMDUtMDQtMTcgMDk6MzY6NDYuNDI3Mz g4MzIwIC0w
NDAwCkBAIC03NSwxNSArNzUsMTYgQEAKICAgICAgIHJldHVybi AtMTsJCS8q
IGVycm5vIGlzIGFscmVhZHkgc2V0LiAgKi8KIAogICAgIGNhc2 UgMDoJCQkv
KiBDaGlsZCBwcm9jZXNzLiAgKi8KKyAgICB7CiAgICAgICAvKi BDaGVhcCBo
YWNrIHRvIHNldCBtb2RlIG9mIG5ldyBkaXJlY3RvcnkuICBTaW 5jZSB0aGlz
IGNoaWxkCi0JIHByb2Nlc3MgaXMgZ29pbmcgYXdheSBhbnl3YX ksIHdlIHph
cCBpdHMgdW1hc2suCi0JIFRoaXMgd29uJ3Qgc3VmZmljZSB0by BzZXQgU1VJ
RCwgU0dJRCwgZXRjLiBvbiB0aGlzCi0JIGRpcmVjdG9yeSwgc2 8gdGhlIHBh
cmVudCBwcm9jZXNzIGNhbGxzIGNobW9kIGFmdGVyd2FyZC4gIC ovCisJIHBy
b2Nlc3MgaXMgZ29pbmcgYXdheSBhbnl3YXksIHdlIHphcCBpdH MgdW1hc2su
ICovCisgICAgICBjaGFyIG1vZGVbMTZdOwogICAgICAgc3RhdH VzID0gdW1h
c2sgKDApOwkvKiBHZXQgY3VycmVudCB1bWFzay4gICovCiAgIC AgICB1bWFz
ayAoc3RhdHVzIHwgKDA3NzcgJiB+ZG1vZGUpKTsJLyogU2V0IG ZvciBta2Rp
ci4gICovCi0gICAgICBleGVjbCAoIi9iaW4vbWtkaXIiLCAibW tkaXIiLCBk
cGF0aCwgKGNoYXIgKikgMCk7CisgICAgICBzbnByaW50Zihtb2 RlLCBzaXpl
b2YobW9kZSksICItbT0lbyIsIG1vZGUpOworICAgICAgZXhlY2 wgKCIvYmlu
L21rZGlyIiwgIm1rZGlyIiwgZHBhdGgsIG1vZGUsIChjaGFyIC opIDApOwog
ICAgICAgX2V4aXQgKDEpOwotCisgICAgfQogICAgIGRlZmF1bH Q6CQkJLyog
UGFyZW50IHByb2Nlc3MuICAqLwogICAgICAgLyogV2FpdCBmb3 Iga2lkIHRv
IGZpbmlzaC4gICovCiAgICAgICB3aGlsZSAod2FpdCAoJnN0YX R1cykgIT0g
Y3BpZCkKQEAgLTk1LDYgKzk2LDYgQEAKIAkgIGVycm5vID0gRU lPOwogCSAg
cmV0dXJuIC0xOwogCX0KLSAgICAgIHJldHVybiBjaG1vZCAoZH BhdGgsIGRt
b2RlKTsKKyAgICAgIHJldHVybiAwOwogICAgIH0KIH0KZGlmZi AtdXJiIGNw
aW8tMi42Lm9yaWcvc3JjL2NvcHlpbi5jIGNwaW8tMi42L3NyYy 9jb3B5aW4u
YwotLS0gY3Bpby0yLjYub3JpZy9zcmMvY29weWluLmMJMjAwNS 0wNC0xNyAw
OTozNjoyNS4yMTk2MTIzOTIgLTA0MDAKKysrIGNwaW8tMi42L3 NyYy9jb3B5
aW4uYwkyMDA1LTA0LTE3IDA5OjM2OjQ2LjQzMDM4Nzg2NCAtMD QwMApAQCAt
Mzg5LDE5ICszODksMjAgQEAKIAkgIGNvbnRpbnVlOwogCX0KIA otICAgICAg
aWYgKGNsb3NlIChvdXRfZmlsZV9kZXMpIDwgMCkKLQllcnJvci AoMCwgZXJy
bm8sICIlcyIsIGQtPmhlYWRlci5jX25hbWUpOwotCiAgICAgIC AvKiBGaWxl
IGlzIG5vdyBjb3BpZWQ7IHNldCBhdHRyaWJ1dGVzLiAgKi8KIC AgICAgIGlm
ICghbm9fY2hvd25fZmxhZykKLQlpZiAoKGNob3duIChkLT5oZW FkZXIuY19u
YW1lLAorCWlmICgoZmNob3duIChvdXRfZmlsZV9kZXMsCiAJCS AgICBzZXRf
b3duZXJfZmxhZyA/IHNldF9vd25lciA6IGQtPmhlYWRlci5jX3VpZCwKIAkg
ICAgICAgc2V0X2dyb3VwX2ZsYWcgPyBzZXRfZ3JvdXAgOiBkLT 5oZWFkZXIu
Y19naWQpIDwgMCkKIAkgICAgJiYgZXJybm8gIT0gRVBFUk0pCi AJICBlcnJv
ciAoMCwgZXJybm8sICIlcyIsIGQtPmhlYWRlci5jX25hbWUpOw otICAgICAg
LyogY2hvd24gbWF5IGhhdmUgdHVybmVkIG9mZiBzb21lIHBlcm 1pc3Npb25z
IHdlIHdhbnRlZC4gKi8KLSAgICAgIGlmIChjaG1vZCAoZC0+aG VhZGVyLmNf
bmFtZSwgKGludCkgZC0+aGVhZGVyLmNfbW9kZSkgPCAwKQorIC AgICAgLyog
ZmNob3duIG1heSBoYXZlIHR1cm5lZCBvZmYgc29tZSBwZXJtaX NzaW9ucyB3
ZSB3YW50ZWQuICovCisgICAgICBpZiAoZmNobW9kIChvdXRfZm lsZV9kZXMs
IChpbnQpIGQtPmhlYWRlci5jX21vZGUpIDwgMCkKIAllcnJvci AoMCwgZXJy
bm8sICIlcyIsIGQtPmhlYWRlci5jX25hbWUpOworCisgICAgIC BpZiAoY2xv
c2UgKG91dF9maWxlX2RlcykgPCAwKQorCWVycm9yICgwLCBlcn JubywgIiVz
IiwgZC0+aGVhZGVyLmNfbmFtZSk7CisKICAgICAgIGlmIChyZX RhaW5fdGlt
ZV9mbGFnKQogCXsKIAkgIHRpbWVzLmFjdGltZSA9IHRpbWVzLm 1vZHRpbWUg
PSBkLT5oZWFkZXIuY19tdGltZTsKQEAgLTU1Nyw5ICs1NTgsNi BAQAogICAg
ICAgd3JpdGUgKG91dF9maWxlX2RlcywgIiIsIDEpOwogICAgIC AgZGVsYXll
ZF9zZWVrX2NvdW50ID0gMDsKICAgICB9Ci0gIGlmIChjbG9zZS Aob3V0X2Zp
bGVfZGVzKSA8IDApCi0gICAgZXJyb3IgKDAsIGVycm5vLCAiJX MiLCBmaWxl
X2hkci0+Y19uYW1lKTsKLQogICBpZiAoYXJjaGl2ZV9mb3JtYX QgPT0gYXJm
X2NyY2FzY2lpKQogICAgIHsKICAgICAgIGlmIChjcmMgIT0gZm lsZV9oZHIt
PmNfY2hrc3VtKQpAQCAtNTY5LDE0ICs1NjcsMTcgQEAKIAogIC AvKiBGaWxl
IGlzIG5vdyBjb3BpZWQ7IHNldCBhdHRyaWJ1dGVzLiAgKi8KIC AgaWYgKCFu
b19jaG93bl9mbGFnKQotICAgIGlmICgoY2hvd24gKGZpbGVfaG RyLT5jX25h
bWUsCisgICAgaWYgKChmY2hvd24gKG91dF9maWxlX2RlcywKIA kJc2V0X293
bmVyX2ZsYWcgPyBzZXRfb3duZXIgOiBmaWxlX2hkci0+Y191aW QsCiAJICAg
c2V0X2dyb3VwX2ZsYWcgPyBzZXRfZ3JvdXAgOiBmaWxlX2hkci 0+Y19naWQp
IDwgMCkKIAkmJiBlcnJubyAhPSBFUEVSTSkKICAgICAgIGVycm 9yICgwLCBl
cnJubywgIiVzIiwgZmlsZV9oZHItPmNfbmFtZSk7CiAgIAogIC AvKiBjaG93
biBtYXkgaGF2ZSB0dXJuZWQgb2ZmIHNvbWUgcGVybWlzc2lvbn Mgd2Ugd2Fu
dGVkLiAqLwotICBpZiAoY2htb2QgKGZpbGVfaGRyLT5jX25hbW UsIChpbnQp
IGZpbGVfaGRyLT5jX21vZGUpIDwgMCkKKyAgaWYgKGZjaG1vZC Aob3V0X2Zp
bGVfZGVzLCAoaW50KSBmaWxlX2hkci0+Y19tb2RlKSA8IDApCi sgICAgZXJy
b3IgKDAsIGVycm5vLCAiJXMiLCBmaWxlX2hkci0+Y19uYW1lKT sKKyAgCisg
IGlmIChjbG9zZSAob3V0X2ZpbGVfZGVzKSA8IDApCiAgICAgZX Jyb3IgKDAs
IGVycm5vLCAiJXMiLCBmaWxlX2hkci0+Y19uYW1lKTsKICAgCi AgIGlmIChy
ZXRhaW5fdGltZV9mbGFnKQpAQCAtNjEwLDYgKzYxMSw4IEBACi AgIGludCBj
ZGZfZmxhZzsgICAgICAgICAgICAgICAgIC8qIFRydWUgaWYgZm lsZSBpcyBh
IENERi4gICovCiAgIGludCBjZGZfY2hhcjsgICAgICAgICAgIC AgICAgIC8q
IEluZGV4IG9mIGArJyBjaGFyIGluZGljYXRpbmcgYSBDREYuIC AqLwogI2Vu
ZGlmCisgIGludCBmZDsJCQkvKiBGaWxlIGRlc2NyaXB0b3IgZm 9yIGZjaG1v
ZCAqLworICBzdHJ1Y3Qgc3RhdCBmaWxlX3N0YXQ7CiAKICAgaW YgKHRvX3N0
ZG91dF9vcHRpb24pCiAgICAgcmV0dXJuOwpAQCAtNjYyLDcgKz Y2NSw2IEBA
CiAJIGNyZWF0ZV9hbGxfZGlyZWN0b3JpZXMoKSwgc28gdGhlIG 1rZGlyIHdp
bGwgZmFpbAogCSBiZWNhdXNlIHRoZSBkaXJlY3RvcnkgZXhpc3 RzLiAgSWYg
dGhhdCdzIHRoZSBjYXNlLAogCSBkb24ndCBjb21wbGFpbiBhYm 91dCBpdC4g
ICovCi0gICAgICBzdHJ1Y3Qgc3RhdCBmaWxlX3N0YXQ7CiAgIC AgICBpZiAo
IChlcnJubyAhPSBFRVhJU1QpIHx8CiAJICAgKGxzdGF0IChmaW xlX2hkci0+
Y19uYW1lLCAmZmlsZV9zdGF0KSAhPSAwKSB8fAogCSAgICEoU1 9JU0RJUiAo
ZmlsZV9zdGF0LnN0X21vZGUpICkgKQpAQCAtNjcxLDE4ICs2Nz MsMzAgQEAK
IAkgIHJldHVybjsKIAl9CiAgICAgfQorICBmZCA9IG9wZW4oZm lsZV9oZHIt
PmNfbmFtZSwgT19OT0NUVFl8T19SRFdSKTsKKyAgaWYgKGZkID wgMCkgewor
ICAgIGVycm9yICgwLCBlcnJubywgIiVzIiwgZmlsZV9oZHItPm NfbmFtZSk7
CisgICAgcmV0dXJuOworICB9CisgIGlmICgoZnN0YXQoZmQsIC ZmaWxlX3N0
YXQpICE9IDApIHx8ICEoU19JU0RJUihmaWxlX3N0YXQuc3RfbW 9kZSkpKSB7
CisgICAgZXJyb3IgKDAsIGVycm5vLCAiJXMiLCBmaWxlX2hkci 0+Y19uYW1l
KTsKKyAgICBjbG9zZShmZCk7CisgICAgcmV0dXJuOworICB9Ci sgIAogICBp
ZiAoIW5vX2Nob3duX2ZsYWcpCi0gICAgaWYgKChjaG93biAoZm lsZV9oZHIt
PmNfbmFtZSwKKyAgICBpZiAoKGZjaG93biAoZmQsCiAJCXNldF 9vd25lcl9m
bGFnID8gc2V0X293bmVyIDogZmlsZV9oZHItPmNfdWlkLAogCQ lzZXRfZ3Jv
dXBfZmxhZyA/IHNldF9ncm91cCA6IGZpbGVfaGRyLT5jX2dpZCkgPCAwKQog
CSYmIGVycm5vICE9IEVQRVJNKQogICAgICAgZXJyb3IgKDAsIG Vycm5vLCAi
JXMiLCBmaWxlX2hkci0+Y19uYW1lKTsKICAgLyogY2hvd24gbW F5IGhhdmUg
dHVybmVkIG9mZiBzb21lIHBlcm1pc3Npb25zIHdlIHdhbnRlZC 4gKi8KLSAg
aWYgKGNobW9kIChmaWxlX2hkci0+Y19uYW1lLCAoaW50KSBmaW xlX2hkci0+
Y19tb2RlKSA8IDApCisgIGlmIChmY2htb2QgKGZkLCAoaW50KS BmaWxlX2hk
ci0+Y19tb2RlKSA8IDApCiAgICAgZXJyb3IgKDAsIGVycm5vLC AiJXMiLCBm
aWxlX2hkci0+Y19uYW1lKTsKKyAgY2xvc2UoZmQpOwogI2lmZG VmIEhQVVhf
Q0RGCiAgIGlmIChjZGZfZmxhZykKLSAgICAvKiBPbmNlIHdlIC JoaWRlIiB0
aGUgZGlyZWN0b3J5IHdpdGggdGhlIGNobW9kKCksCisgICAgLy ogT25jZSB3
ZSAiaGlkZSIgdGhlIGRpcmVjdG9yeSB3aXRoIHRoZSBmY2htb2 QoKSwKICAg
ICAgICB3ZSBoYXZlIHRvIHJlZmVyIHRvIGl0IHVzaW5nIG5hbW UrIGluc3Rl
YWQgb2YgbmFtZS4gICovCiAgICAgZmlsZV9oZHItPmNfbmFtZS BbY2RmX2No
YXJdID0gJysnOwogI2VuZGlmCkBAIC03MDIsNiArNzE2LDggQE AKIGNvcHlp
bl9kZXZpY2Uoc3RydWN0IG5ld19jcGlvX2hlYWRlciogZmlsZV 9oZHIpCiB7
CiAgIGludCByZXM7CQkJLyogUmVzdWx0IG9mIHZhcmlvdXMgZn VuY3Rpb24g
Y2FsbHMuICAqLworICBpbnQgZmQ7ICAgICAgICAgICAgICAgIC AgICAgICAv
KiBGaWxlIGRlc2NyaXB0b3IgZm9yIGZjaG1vZCAqLworICBzdH J1Y3Qgc3Rh
dCBmaWxlX3N0YXQ7CiAKICAgaWYgKHRvX3N0ZG91dF9vcHRpb2 4pCiAgICAg
cmV0dXJuOwpAQCAtNzU1LDE1ICs3NzEsMjggQEAKICAgICAgIG Vycm9yICgw
LCBlcnJubywgIiVzIiwgZmlsZV9oZHItPmNfbmFtZSk7CiAgIC AgICByZXR1
cm47CiAgICAgfQorICBmZCA9IG9wZW4oZmlsZV9oZHItPmNfbm FtZSwgT19O
T0NUVFl8T19SRFdSKTsKKyAgaWYgKGZkIDwgMCkgeworICAgIG Vycm9yICgw
LCBlcnJubywgIiVzIiwgZmlsZV9oZHItPmNfbmFtZSk7CisgIC AgcmV0dXJu
OworICB9CisgIGlmICgoZnN0YXQoZmQsICZmaWxlX3N0YXQpIC E9IDApIHx8
ICEoU19JU0NIUihmaWxlX3N0YXQuc3RfbW9kZSkgfHwKKwkJU1 9JU0JMSyhm
aWxlX3N0YXQuc3RfbW9kZSkgfHwgU19JU0ZJRk8oZmlsZV9zdG F0LnN0X21v
ZGUpIHx8CisJCVNfSVNTT0NLKGZpbGVfc3RhdC5zdF9tb2RlKS kgKSB7Cisg
ICAgZXJyb3IgKDAsIGVycm5vLCAiJXMiLCBmaWxlX2hkci0+Y1 9uYW1lKTsK
KyAgICBjbG9zZShmZCk7CisgICAgcmV0dXJuOworICB9CiAgIG lmICghbm9f
Y2hvd25fZmxhZykKLSAgICBpZiAoKGNob3duIChmaWxlX2hkci 0+Y19uYW1l
LAorICAgIGlmICgoZmNob3duIChmZCwKIAkJc2V0X293bmVyX2 ZsYWcgPyBz
ZXRfb3duZXIgOiBmaWxlX2hkci0+Y191aWQsCiAJCXNldF9ncm 91cF9mbGFn
ID8gc2V0X2dyb3VwIDogZmlsZV9oZHItPmNfZ2lkKSA8IDApCi AJJiYgZXJy
bm8gIT0gRVBFUk0pCiAgICAgICBlcnJvciAoMCwgZXJybm8sIC IlcyIsIGZp
bGVfaGRyLT5jX25hbWUpOwogICAvKiBjaG93biBtYXkgaGF2ZS B0dXJuZWQg
b2ZmIHNvbWUgcGVybWlzc2lvbnMgd2Ugd2FudGVkLiAqLwotIC BpZiAoY2ht
b2QgKGZpbGVfaGRyLT5jX25hbWUsIGZpbGVfaGRyLT5jX21vZG UpIDwgMCkK
KyAgaWYgKGZjaG1vZCAoZmQsIGZpbGVfaGRyLT5jX21vZGUpID wgMCkKICAg
ICBlcnJvciAoMCwgZXJybm8sICIlcyIsIGZpbGVfaGRyLT5jX2 5hbWUpOwor
ICBjbG9zZShmZCk7CiAgIGlmIChyZXRhaW5fdGltZV9mbGFnKQ ogICAgIHsK
ICAgICAgIHN0cnVjdCB1dGltYnVmIHRpbWVzOwkJLyogRm9yIH NldHRpbmcg
ZmlsZSB0aW1lcy4gICovCmRpZmYgLXVyYiBjcGlvLTIuNi5vcm lnL3NyYy9j
b3B5cGFzcy5jIGNwaW8tMi42L3NyYy9jb3B5cGFzcy5jCi0tLS BjcGlvLTIu
Ni5vcmlnL3NyYy9jb3B5cGFzcy5jCTIwMDUtMDQtMTcgMDk6Mz Y6MjUuMjE5
NjEyMzkyIC0wNDAwCisrKyBjcGlvLTIuNi9zcmMvY29weXBhc3 MuYwkyMDA1
LTA0LTE3IDA5OjM2OjQ2LjQzMTM4NzcxMiAtMDQwMApAQCAtMT gxLDE4ICsx
ODEsMTkgQEAKIAkJfQogCSAgICAgIGlmIChjbG9zZSAoaW5fZm lsZV9kZXMp
IDwgMCkKIAkJZXJyb3IgKDAsIGVycm5vLCAiJXMiLCBpbnB1dF 9uYW1lLmRz
X3N0cmluZyk7Ci0JICAgICAgaWYgKGNsb3NlIChvdXRfZmlsZV 9kZXMpIDwg
MCkKLQkJZXJyb3IgKDAsIGVycm5vLCAiJXMiLCBvdXRwdXRfbm FtZS5kc19z
dHJpbmcpOwogCiAJICAgICAgLyogU2V0IHRoZSBhdHRyaWJ1dG VzIG9mIHRo
ZSBuZXcgZmlsZS4gICovCiAJICAgICAgaWYgKCFub19jaG93bl 9mbGFnKQot
CQlpZiAoKGNob3duIChvdXRwdXRfbmFtZS5kc19zdHJpbmcsCi sJCWlmICgo
ZmNob3duIChvdXRfZmlsZV9kZXMsCiAJCQkgICAgc2V0X293bm VyX2ZsYWcg
PyBzZXRfb3duZXIgOiBpbl9maWxlX3N0YXQuc3RfdWlkLAogCQ kgICAgICBz
ZXRfZ3JvdXBfZmxhZyA/IHNldF9ncm91cCA6IGluX2ZpbGVfc3RhdC5zdF9n
aWQpIDwgMCkKIAkJICAgICYmIGVycm5vICE9IEVQRVJNKQogCQ kgIGVycm9y
ICgwLCBlcnJubywgIiVzIiwgb3V0cHV0X25hbWUuZHNfc3RyaW 5nKTsKLQkg
ICAgICAvKiBjaG93biBtYXkgaGF2ZSB0dXJuZWQgb2ZmIHNvbW UgcGVybWlz
c2lvbnMgd2Ugd2FudGVkLiAqLwotCSAgICAgIGlmIChjaG1vZC Aob3V0cHV0
X25hbWUuZHNfc3RyaW5nLCBpbl9maWxlX3N0YXQuc3RfbW9kZS kgPCAwKQor
CSAgICAgIC8qIGZjaG93biBtYXkgaGF2ZSB0dXJuZWQgb2ZmIH NvbWUgcGVy
bWlzc2lvbnMgd2Ugd2FudGVkLiAqLworCSAgICAgIGlmIChmY2 htb2QgKG91
dF9maWxlX2RlcywgaW5fZmlsZV9zdGF0LnN0X21vZGUpIDwgMC kKKwkJZXJy
b3IgKDAsIGVycm5vLCAiJXMiLCBvdXRwdXRfbmFtZS5kc19zdH JpbmcpOwor
CSAgICAgIC8qIG5vdyB0aGF0IHdlIHNldCBwZXJtaXNzaW9ucy wgY2xvc2Ug
b3V0IGZpbGUgKi8KKwkgICAgICBpZiAoY2xvc2UgKG91dF9maW xlX2Rlcykg
PCAwKQogCQllcnJvciAoMCwgZXJybm8sICIlcyIsIG91dHB1dF 9uYW1lLmRz
X3N0cmluZyk7CiAJICAgICAgaWYgKHJlc2V0X3RpbWVfZmxhZy kKIAkJewpA
QCAtMjIyLDYgKzIyMyw3IEBACiAJfQogICAgICAgZWxzZSBpZi AoU19JU0RJ
UiAoaW5fZmlsZV9zdGF0LnN0X21vZGUpKQogCXsKKwkgIGludC BmZDsgICAg
ICAgICAgICAgICAgICAgICAgIC8qIEZpbGUgZGVzY3JpcHRvci Bmb3IgZmNo
bW9kICovCiAjaWZkZWYgSFBVWF9DREYKIAkgIGNkZl9mbGFnID 0gMDsKICNl
bmRpZgpAQCAtMjY1LDE4ICsyNjcsMzEgQEAKIAkJICBjb250aW 51ZTsKIAkJ
fQogCSAgICB9CisJICBmZCA9IG9wZW4ob3V0cHV0X25hbWUuZH Nfc3RyaW5n
LCBPX05PQ1RUWXxPX1JEV1IpOworCSAgaWYgKGZkIDwgMCkgew orCSAgICBl
cnJvciAoMCwgZXJybm8sICIlcyIsIG91dHB1dF9uYW1lLmRzX3 N0cmluZyk7
CisJICAgIGNvbnRpbnVlOworCSAgfQorCSAgaWYgKChmc3RhdC hmZCwgJm91
dF9maWxlX3N0YXQpICE9IDApIHx8IAorCQkhKFNfSVNESVIob3 V0X2ZpbGVf
c3RhdC5zdF9tb2RlKSkpIHsKKwkgICAgZXJyb3IgKDAsIGVycm 5vLCAiJXMi
LCBvdXRwdXRfbmFtZS5kc19zdHJpbmcpOworCSAgICBjbG9zZS hmZCk7CisJ
ICAgIGNvbnRpbnVlOworCSAgfQorCiAJICBpZiAoIW5vX2Nob3 duX2ZsYWcp
Ci0JICAgIGlmICgoY2hvd24gKG91dHB1dF9uYW1lLmRzX3N0cm luZywKKwkg
ICAgaWYgKChmY2hvd24gKGZkLAogCQkJc2V0X293bmVyX2ZsYW cgPyBzZXRf
b3duZXIgOiBpbl9maWxlX3N0YXQuc3RfdWlkLAogCQkgICAgIC BzZXRfZ3Jv
dXBfZmxhZyA/IHNldF9ncm91cCA6IGluX2ZpbGVfc3RhdC5zdF9naWQpIDwg
MCkKIAkJJiYgZXJybm8gIT0gRVBFUk0pCiAJICAgICAgZXJyb3 IgKDAsIGVy
cm5vLCAiJXMiLCBvdXRwdXRfbmFtZS5kc19zdHJpbmcpOwogCS AgLyogY2hv
d24gbWF5IGhhdmUgdHVybmVkIG9mZiBzb21lIHBlcm1pc3Npb2 5zIHdlIHdh
bnRlZC4gKi8KLQkgIGlmIChjaG1vZCAob3V0cHV0X25hbWUuZH Nfc3RyaW5n
LCBpbl9maWxlX3N0YXQuc3RfbW9kZSkgPCAwKQorCSAgaWYgKG ZjaG1vZCAo
ZmQsIGluX2ZpbGVfc3RhdC5zdF9tb2RlKSA8IDApCiAJICAgIG Vycm9yICgw
LCBlcnJubywgIiVzIiwgb3V0cHV0X25hbWUuZHNfc3RyaW5nKT sKKwkgIGNs
b3NlKGZkKTsKICNpZmRlZiBIUFVYX0NERgogCSAgaWYgKGNkZl 9mbGFnKQot
CSAgICAvKiBPbmNlIHdlICJoaWRlIiB0aGUgZGlyZWN0b3J5IH dpdGggdGhl
IGNobW9kKCksCisJICAgIC8qIE9uY2Ugd2UgImhpZGUiIHRoZS BkaXJlY3Rv
cnkgd2l0aCB0aGUgZmNobW9kKCksCiAJICAgICAgIHdlIGhhdm UgdG8gcmVm
ZXIgdG8gaXQgdXNpbmcgbmFtZSsgaXNudGVhZCBvZiBuYW1lLi AgKi8KIAkg
ICAgb3V0cHV0X25hbWUuZHNfc3RyaW5nIFtjZGZfY2hhcl0gPS AnKyc7CiAj
ZW5kaWYKQEAgLTI5Nyw2ICszMTIsNyBAQAogI2VuZGlmCiAJIC AgICAgIDAp
CiAJeworCSAgaW50IGZkOwkvKiBGaWxlIGRlc2NyaXB0b3IgZm 9yIGZjaG1v
ZCAqLwogCSAgLyogQ2FuIHRoZSBjdXJyZW50IGZpbGUgYmUgbG lua2VkIHRv
IGEgYW5vdGhlciBmaWxlPwogCSAgICAgU2V0IGxpbmtfbmFtZS B0byB0aGUg
b3JpZ2luYWwgZmlsZSBuYW1lLiAgKi8KIAkgIGlmIChsaW5rX2 ZsYWcpCkBA
IC0zMjQsMTUgKzM0MCwzMCBAQAogCQkgIGVycm9yICgwLCBlcn JubywgIiVz
Iiwgb3V0cHV0X25hbWUuZHNfc3RyaW5nKTsKIAkJICBjb250aW 51ZTsKIAkJ
fQorCSAgICAgICAgZmQgPSBvcGVuKG91dHB1dF9uYW1lLmRzX3 N0cmluZywg
T19OT0NUVFl8T19SRFdSKTsKKwkgICAgICAgIGlmIChmZCA8ID ApIHsKKwkg
ICAgICAgICAgZXJyb3IgKDAsIGVycm5vLCAiJXMiLCBvdXRwdX RfbmFtZS5k
c19zdHJpbmcpOworCSAgICAgICAgICBjb250aW51ZTsKKwkgIC AgICAgIH0K
KwkgICAgICAgIGlmICgoZnN0YXQoZmQsICZvdXRfZmlsZV9zdG F0KSAhPSAw
KSB8fCAKKwkJCSEoKFNfSVNDSFIob3V0X2ZpbGVfc3RhdC5zdF 9tb2RlKSB8
fCAKKwkJCSAgIFNfSVNCTEsob3V0X2ZpbGVfc3RhdC5zdF9tb2 RlKSB8fAor
CQkJICAgU19JU0ZJRk8ob3V0X2ZpbGVfc3RhdC5zdF9tb2RlKS B8fAorCQkJ
ICAgU19JU1NPQ0sob3V0X2ZpbGVfc3RhdC5zdF9tb2RlKSkpKS B7CisJICAg
ICAgICAgICBlcnJvciAoMCwgZXJybm8sICIlcyIsIG91dHB1dF 9uYW1lLmRz
X3N0cmluZyk7CisJICAgICAgICAgICBjbG9zZShmZCk7CisJIC AgICAgICAg
ICBjb250aW51ZTsKKwkgICAgICAgIH0KIAkgICAgICBpZiAoIW 5vX2Nob3du
X2ZsYWcpCi0JCWlmICgoY2hvd24gKG91dHB1dF9uYW1lLmRzX3 N0cmluZywK
KwkJaWYgKChmY2hvd24gKGZkLAogCQkJICAgIHNldF9vd25lcl 9mbGFnID8g
c2V0X293bmVyIDogaW5fZmlsZV9zdGF0LnN0X3VpZCwKIAkJCS Agc2V0X2dy
b3VwX2ZsYWcgPyBzZXRfZ3JvdXAgOiBpbl9maWxlX3N0YXQuc3 RfZ2lkKSA8
IDApCiAJCSAgICAmJiBlcnJubyAhPSBFUEVSTSkKIAkJICBlcn JvciAoMCwg
ZXJybm8sICIlcyIsIG91dHB1dF9uYW1lLmRzX3N0cmluZyk7Ci 0JICAgICAg
LyogY2hvd24gbWF5IGhhdmUgdHVybmVkIG9mZiBzb21lIHBlcm 1pc3Npb25z
IHdlIHdhbnRlZC4gKi8KLQkgICAgICBpZiAoY2htb2QgKG91dH B1dF9uYW1l
LmRzX3N0cmluZywgaW5fZmlsZV9zdGF0LnN0X21vZGUpIDwgMC kKKwkgICAg
ICAvKiBmY2hvd24gbWF5IGhhdmUgdHVybmVkIG9mZiBzb21lIH Blcm1pc3Np
b25zIHdlIHdhbnRlZC4gKi8KKwkgICAgICBpZiAoZmNobW9kIC hmZCwgaW5f
ZmlsZV9zdGF0LnN0X21vZGUpIDwgMCkKIAkJZXJyb3IgKDAsIG Vycm5vLCAi
JXMiLCBvdXRwdXRfbmFtZS5kc19zdHJpbmcpOworCSAgICAgIG Nsb3NlKGZk
KTsKIAkgICAgICBpZiAocmV0YWluX3RpbWVfZmxhZykKIAkJew ogCQkgIHRp
bWVzLmFjdGltZSA9IHRpbWVzLm1vZHRpbWUgPSBpbl9maWxlX3 N0YXQuc3Rf
bXRpbWU7CmRpZmYgLXVyYiBjcGlvLTIuNi5vcmlnL3NyYy9tYW tlcGF0aC5j
IGNwaW8tMi42L3NyYy9tYWtlcGF0aC5jCi0tLSBjcGlvLTIuNi 5vcmlnL3Ny
Yy9tYWtlcGF0aC5jCTIwMDUtMDQtMTcgMDk6MzY6MjUuMjIxNj EyMDg4IC0w
NDAwCisrKyBjcGlvLTIuNi9zcmMvbWFrZXBhdGguYwkyMDA1LT A0LTE3IDA5
OjM3OjQ1LjM3MDQyNzYxNiAtMDQwMApAQCAtMTAwLDEyICsxMD AsMTQgQEAK
ICAgICAgIGNoYXIgKnNsYXNoOwogICAgICAgaW50IHRtcF9tb2 RlOwkJLyog
SW5pdGlhbCBwZXJtcyBmb3IgbGVhZGluZyBkaXJzLiAgKi8KIC AgICAgIGlu
dCByZV9wcm90ZWN0OwkJLyogU2hvdWxkIGxlYWRpbmcgZGlycy BiZSB1bndy
aXRhYmxlPyAqLworICAgICAgaW50IGZkOyAgICAgICAgICAgIC AgICAgICAv
KiBGaWxlIGRlc2NyaXB0b3IgZm9yIGZjaG1vZCAqLwogICAgIC Agc3RydWN0
IHB0cl9saXN0CiAgICAgICB7CiAJY2hhciAqZGlybmFtZV9lbm Q7CiAJc3Ry
dWN0IHB0cl9saXN0ICpuZXh0OwogICAgICAgfTsKICAgICAgIH N0cnVjdCBw
dHJfbGlzdCAqcCwgKmxlYWRpbmdfZGlycyA9IE5VTEw7CisgIC AgICBzdHJ1
Y3Qgc3RhdCB0c3RhdHM7ICAgICAgIC8qIHRlbXBvcmFyeSBzdG F0cyBmb3Ig
ZmNobW9kICovCiAKICAgICAgIC8qIElmIGxlYWRpbmcgZGlyZW N0b3JpZXMg
c2hvdWxkbid0IGJlIHdyaXRhYmxlIG9yIGV4ZWN1dGFibGUsCi AJIG9yIHNo
b3VsZCBoYXZlIHNldFt1Z11pZCBvciBzdGlja3kgYml0cyBzZX QgYW5kIHdl
IGFyZSBzZXR0aW5nCkBAIC0xNTcsOCArMTU5LDIwIEBACiAJCS AgaWYgKHZl
cmJvc2VfZm10X3N0cmluZyAhPSBOVUxMKQogCQkgICAgZXJyb3 IgKDAsIDAs
IHZlcmJvc2VfZm10X3N0cmluZywgZGlycGF0aCk7CiAKKwkJIC BmZCA9IG9w
ZW4oZGlycGF0aCwgT19OT0NUVFl8T19SRFdSKTsKKwkJICBpZi AoZmQgPCAw
KSB7CisJCSAgICBlcnJvciAoMCwgZXJybm8sICIlcyIsIGRpcn BhdGgpOwor
CQkgICAgdW1hc2sgKG9sZG1hc2spOworCQkgICAgcmV0dXJuID E7CisJCSAg
fQorCQkgIGlmICgoZnN0YXQoZmQsICZ0c3RhdHMpICE9IDApIH x8ICEoU19J
U0RJUih0c3RhdHMuc3RfbW9kZSkpKSB7CisJCSAgICBlcnJvci AoMCwgZXJy
bm8sICIlcyIsIGRpcnBhdGgpOworCQkgICAgdW1hc2sgKG9sZG 1hc2spOwor
CQkgICAgY2xvc2UoZmQpOworCQkgICAgcmV0dXJuIDE7CisJCS AgfQogCQkg
IGlmIChvd25lciAhPSAodWlkX3QpIC0xICYmIGdyb3VwICE9IC hnaWRfdCkg
LTEKLQkJICAgICAgJiYgY2hvd24gKGRpcnBhdGgsIG93bmVyLC Bncm91cCkK
KwkJICAgICAgJiYgZmNob3duIChmZCwgb3duZXIsIGdyb3VwKQ ogI2lmZGVm
IEFGUwogCQkgICAgICAmJiBlcnJubyAhPSBFUEVSTQogI2VuZG lmCkBAIC0x
ODIsMTAgKzE5NiwxMSBAQAogCQkJICBpdHMgaGlkZGVuL3NldH VpZCBiaXQu
ICBBbHNvIGFkZCB0aGUgYCsnIGJhY2sgdG8KIAkJCSAgaXRzIG 5hbWUgKHNp
bmNlIG9uY2UgaXQncyAiaGlkZGVuIiB3ZSBtdXN0IHJlZmVyCi AJCQkgIHRv
IGFzIGBuYW1lKycgaW5zdGVhZCBvZiBgbmFtZScpLiAgKi8KLQ kJICAgICAg
Y2htb2QgKGRpcnBhdGgsIDA0NzAwKTsKKwkJICAgICAgZmNobW 9kIChmZCwg
MDQ3MDApOwogCQkgICAgICAqKHNsYXNoIC0gMSkgPSAnKyc7Ci AJCSAgICB9
CiAjZW5kaWYKKwkJICBjbG9zZShmZCk7CiAJCX0KIAkgICAgfQ ogCSAgZWxz
ZSBpZiAoIVNfSVNESVIgKHN0YXRzLnN0X21vZGUpKQpAQCAtMj IyLDEwICsy
MzcsMTkgQEAKIAl9CiAgICAgICBpZiAodmVyYm9zZV9mbXRfc3 RyaW5nICE9
IE5VTEwpCiAJZXJyb3IgKDAsIDAsIHZlcmJvc2VfZm10X3N0cm luZywgZGly
cGF0aCk7Ci0KKyAgICAgIGZkID0gb3BlbihkaXJwYXRoLCBPX0 5PQ1RUWXxP
X1JEV1IpOworICAgICAgaWYgKGZkIDwgMCkgeworICAgICAgIC BlcnJvciAo
MCwgZXJybm8sICIlcyIsIGRpcnBhdGgpOworICAgICAgICByZX R1cm4gMTsK
KyAgICAgIH0KKyAgICAgIGlmICgoZnN0YXQoZmQsICZ0c3RhdH MpICE9IDAp
IHx8ICEoU19JU0RJUih0c3RhdHMuc3RfbW9kZSkpKSB7CisgIC AgICAgIGVy
cm9yICgwLCBlcnJubywgIiVzIiwgZGlycGF0aCk7CisgICAgIC AgIGNsb3Nl
KGZkKTsKKyAgICAgICAgcmV0dXJuIDE7CisgICAgICB9CiAgIC AgICBpZiAo
b3duZXIgIT0gKHVpZF90KSAtMSAmJiBncm91cCAhPSAoZ2lkX3 QpIC0xKQog
CXsKLQkgIGlmIChjaG93biAoZGlycGF0aCwgb3duZXIsIGdyb3 VwKQorCSAg
aWYgKGZjaG93biAoZmQsIG93bmVyLCBncm91cCkKICNpZmRlZi BBRlMKIAkg
ICAgICAmJiBlcnJubyAhPSBFUEVSTQogI2VuZGlmCkBAIC0yMz YsMTIgKzI2
MCwxMiBAQAogCSAgICB9CiAJfQogCSAgLyogY2hvd24gbWF5IG hhdmUgdHVy
bmVkIG9mZiBzb21lIHBlcm1pc3Npb24gYml0cyB3ZSB3YW50ZW QuICAqLwot
CSAgaWYgKChtb2RlICYgMDcwMDApICE9IDAgJiYgY2htb2QgKG RpcnBhdGgs
IG1vZGUpKQorCSAgaWYgKChtb2RlICYgMDcwMDApICE9IDAgJi YgZmNobW9k
IChmZCwgbW9kZSkpCiAJICAgIHsKIAkgICAgICBlcnJvciAoMC wgZXJybm8s
ICIlcyIsIGRpcnBhdGgpOwogCSAgICAgIHJldHZhbCA9IDE7Ci AJICAgIH0K
LQorICAgICAgICBjbG9zZShmZCk7CiAgICAgICAvKiBJZiB0aG UgbW9kZSBm
b3IgbGVhZGluZyBkaXJlY3RvcmllcyBkaWRuJ3QgaW5jbHVkZS Bvd25lciAi
d3giCiAJIHByaXZpbGVnZXMsIHdlIGhhdmUgdG8gcmVzZXQgdG hlaXIgcHJv
dGVjdGlvbnMgdG8gdGhlIGNvcnJlY3QKIAkgdmFsdWUuICAqLw pAQCAtMjY1
LDcgKzI4OSw3IEBACiAgIGVsc2UKICAgICB7CiAgICAgICAvKi BXZSBnZXQg
aGVyZSBpZiB0aGUgZW50aXJlIHBhdGggYWxyZWFkeSBleGlzdH MuICAqLwot
CisgICAgICBpbnQgZmQ7CS8qIEZpbGUgZGVzY3JpcHRvciBmb3 IgZmNobW9k
ICovCiAgICAgICBpZiAoIVNfSVNESVIgKHN0YXRzLnN0X21vZG UpKQogCXsK
IAkgIGVycm9yICgwLCAwLCBfKCJgJXMnIGV4aXN0cyBidXQgaX Mgbm90IGEg
ZGlyZWN0b3J5IiksIGRpcnBhdGgpOwpAQCAtMjczLDE0ICsyOT csMjYgQEAK
IAkgIHJldHVybiAxOwogCX0KIAotICAgICAgLyogY2hvd24gbX VzdCBwcmVj
ZWRlIGNobW9kIGJlY2F1c2Ugb24gc29tZSBzeXN0ZW1zLAorIC AgICAgZmQg
PSBvcGVuKGRpcnBhdGgsIE9fTk9DVFRZfE9fUkRXUik7CisgIC AgICBpZiAo
ZmQgPCAwKSB7CisgICAgICAgIGVycm9yICgwLCBlcnJubywgIi VzIiwgZGly
cGF0aCk7CisJdW1hc2sgKG9sZG1hc2spOworICAgICAgICByZX R1cm4gMTsK
KyAgICAgIH0KKyAgICAgIGlmICgoZnN0YXQoZmQsICZ0c3RhdH MpICE9IDAp
IHx8ICEoU19JU0RJUih0c3RhdHMuc3RfbW9kZSkpKSB7CisgIC AgICAgIGVy
cm9yICgwLCBlcnJubywgIiVzIiwgZGlycGF0aCk7CisJdW1hc2 sgKG9sZG1h
c2spOworICAgICAgICBjbG9zZShmZCk7CisgICAgICAgIHJldH VybiAxOwor
ICAgICAgfQorICAgICAgLyogY2hvd24gbXVzdCBwcmVjZWRlIG ZjaG1vZCBi
ZWNhdXNlIG9uIHNvbWUgc3lzdGVtcywKIAkgY2hvd24gY2xlYX JzIHRoZSBz
ZXRbdWddaWQgYml0cyBmb3Igbm9uLXN1cGVydXNlcnMsCiAJIH Jlc3VsdGlu
ZyBpbiBpbmNvcnJlY3QgcGVybWlzc2lvbnMuCiAJIE9uIFN5c3 RlbSBWLCB1
c2VycyBjYW4gZ2l2ZSBhd2F5IGZpbGVzIHdpdGggY2hvd24gYW 5kIHRoZW4g
bm90Ci0JIGJlIGFibGUgdG8gY2htb2QgdGhlbS4gIFNvIGRvbi d0IGdpdmUg
ZmlsZXMgYXdheS4gICovCisJIGJlIGFibGUgdG8gZmNobW9kIH RoZW0uICBT
byBkb24ndCBnaXZlIGZpbGVzIGF3YXkuICAqLwogCiAgICAgIC BpZiAob3du
ZXIgIT0gKHVpZF90KSAtMSAmJiBncm91cCAhPSAoZ2lkX3QpIC 0xCi0JICAm
JiBjaG93biAoZGlycGF0aCwgb3duZXIsIGdyb3VwKQorCSAgJi YgZmNob3du
IChmZCwgb3duZXIsIGdyb3VwKQogI2lmZGVmIEFGUwogCSAgJi YgZXJybm8g
IT0gRVBFUk0KICNlbmRpZgpAQCAtMjg5LDExICszMjUsMTIgQE AKIAkgIGVy
cm9yICgwLCBlcnJubywgIiVzIiwgZGlycGF0aCk7CiAJICByZX R2YWwgPSAx
OwogCX0KLSAgICAgIGlmIChjaG1vZCAoZGlycGF0aCwgbW9kZS kpCisgICAg
ICBpZiAoZmNobW9kIChmZCwgbW9kZSkpCiAJewogCSAgZXJyb3 IgKDAsIGVy
cm5vLCAiJXMiLCBkaXJwYXRoKTsKIAkgIHJldHZhbCA9IDE7Ci AJfQorICAg
ICAgY2xvc2UoZmQpOwogICAgIH0KIAogICB1bWFzayAob2xkbW Fzayk7Cg==


--0-720694802-1113914095=:98221--