From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Paul Eggert Newsgroups: gmane.emacs.bugs Subject: bug#9196: integer and memory overflow issues (e.g., cut-and-paste crashes Emacs) Date: Thu, 04 Aug 2011 19:33:21 -0700 Organization: UCLA Computer Science Department Message-ID: <4E3B5671.1040704@cs.ucla.edu> References: <4E3256E9.3020208@cs.ucla.edu> <4E3284EB.1010308@swipnet.se> <4E32DE0E.5050208@cs.ucla.edu> <4E32E490.3050002@swipnet.se> <4E332009.3090909@cs.ucla.edu> <4E339C30.9090708@swipnet.se> <4E345892.8010200@cs.ucla.edu> <4E3518F0.4040002@swipnet.se> NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Trace: dough.gmane.org 1312511711 26755 80.91.229.12 (5 Aug 2011 02:35:11 GMT) X-Complaints-To: usenet@dough.gmane.org NNTP-Posting-Date: Fri, 5 Aug 2011 02:35:11 +0000 (UTC) Cc: 9196@debbugs.gnu.org To: Jan =?UTF-8?Q?Dj=C3=A4rv?= Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Fri Aug 05 04:35:01 2011 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([140.186.70.17]) by lo.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1QpAFS-00038x-Ad for geb-bug-gnu-emacs@m.gmane.org; Fri, 05 Aug 2011 04:34:59 +0200 Original-Received: from localhost ([::1]:54407 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QpAFR-0008Ja-Ke for geb-bug-gnu-emacs@m.gmane.org; Thu, 04 Aug 2011 22:34:53 -0400 Original-Received: from eggs.gnu.org ([140.186.70.92]:36555) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QpAF9-0008JH-Ez for bug-gnu-emacs@gnu.org; Thu, 04 Aug 2011 22:34:49 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QpAEu-0001rb-PI for bug-gnu-emacs@gnu.org; Thu, 04 Aug 2011 22:34:35 -0400 Original-Received: from debbugs.gnu.org ([140.186.70.43]:42865) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QpAEu-0001rU-EI for bug-gnu-emacs@gnu.org; Thu, 04 Aug 2011 22:34:20 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.69) (envelope-from ) id 1QpAFa-0006zF-1A; Thu, 04 Aug 2011 22:35:02 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Paul Eggert Original-Sender: debbugs-submit-bounces@debbugs.gnu.org Resent-To: owner@debbugs.gnu.org Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Fri, 05 Aug 2011 02:35:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 9196 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: patch Original-Received: via spool by 9196-submit@debbugs.gnu.org id=B9196.131251167526823 (code B ref 9196); Fri, 05 Aug 2011 02:35:01 +0000 Original-Received: (at 9196) by debbugs.gnu.org; 5 Aug 2011 02:34:35 +0000 Original-Received: from localhost ([127.0.0.1] helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.69) (envelope-from ) id 1QpAF2-0006yT-E3 for submit@debbugs.gnu.org; Thu, 04 Aug 2011 22:34:35 -0400 Original-Received: from smtp.cs.ucla.edu ([131.179.128.62]) by debbugs.gnu.org with esmtp (Exim 4.69) (envelope-from ) id 1QpAEr-0006yD-R1 for 9196@debbugs.gnu.org; Thu, 04 Aug 2011 22:34:25 -0400 Original-Received: from localhost (localhost.localdomain [127.0.0.1]) by smtp.cs.ucla.edu (Postfix) with ESMTP id 8CE3639E810F; Thu, 4 Aug 2011 19:33:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at smtp.cs.ucla.edu Original-Received: from smtp.cs.ucla.edu ([127.0.0.1]) by localhost (smtp.cs.ucla.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eAainuRsfUcK; Thu, 4 Aug 2011 19:33:27 -0700 (PDT) Original-Received: from [192.168.1.10] (pool-71-189-109-235.lsanca.fios.verizon.net [71.189.109.235]) by smtp.cs.ucla.edu (Postfix) with ESMTPSA id 8A5C039E8105; Thu, 4 Aug 2011 19:33:26 -0700 (PDT) User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.18) Gecko/20110617 Thunderbird/3.1.11 In-Reply-To: <4E3518F0.4040002@swipnet.se> X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.11 Precedence: list Resent-Date: Thu, 04 Aug 2011 22:35:02 -0400 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 1) X-Received-From: 140.186.70.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.bugs:49912 Archived-At: On 07/31/11 01:57, Jan Dj=C3=A4rv wrote: > That is a good approach, very nice. Thanks. Here's a revised patch for review, which takes that approach. It's relative to the current trunk. # Bazaar merge directive format 2 (Bazaar 0.90) # revision_id: eggert@cs.ucla.edu-20110805021934-x5nrdodqe23kjdg5 # target_branch: bzr+ssh://eggert@bzr.savannah.gnu.org/emacs/trunk # testament_sha1: 08476c1e7d5fc0bcd509fb3f909cd41ff6c7946f # timestamp: 2011-08-04 19:27:11 -0700 # source_branch: ../trunk # base_revision_id: yamaoka@jpl.org-20110804221404-ydk98tl1x07d17z8 #=20 # Begin patch =3D=3D=3D modified file 'src/ChangeLog' --- src/ChangeLog 2011-08-04 17:04:39 +0000 +++ src/ChangeLog 2011-08-05 02:19:34 +0000 @@ -1,3 +1,413 @@ +2011-08-05 Paul Eggert + + Integer and memory overflow issues. + + * charset.c (charset_table_size) + (struct charset_sort_data.priority): Now ptrdiff_t. + (charset_compare): Don't overflow if priorities differ greatly. + (Fsort_charsets): Don't assume list length fits in int. + Check for size-calculation overflow when allocating sort data. + (syms_of_charset): Allocate an initial charset table that is + just under 64 KiB, to avoid problems with glibc malloc and mmap. + + * cmds.c (internal_self_insert): Check for size-calculation overflow. + + * composite.h (struct composition.glyph_len): Now int, not unsigned. + The actual value is always <=3D INT_MAX, and leaving it unsigned made + overflow checking harder. + + * dispextern.h (struct glyph_matrix.rows_allocated) + (struct face_cache.size): Now ptrdiff_t, for convenience in use + with xpalloc. The values are still always <=3D INT_MAX. + + * indent.c (compute_motion): Adjust to region_cache_forward sig change. + + * lisp.h (xnmalloc, xnrealloc, xpalloc): New decls. + (SAFE_NALLOCA): New macro. + + * region-cache.c (struct boundary.pos, find_cache_boundary) + (move_cache_gap, insert_cache_boundary, delete_cache_boundaries) + (set_cache_region, invalidate_region_cache) + (revalidate_region_cache, know_region_cache, region_cache_forward) + (region_cache_backward, pp_cache): + Use ptrdiff_t, not EMACS_INT, since either will do. This is needed + so that ptrdiff_t * can be passed to xpalloc. + (struct region_cache): Similarly, for gap_start, gap_len, cache_len, + beg_unchanged, end_unchanged, buffer_beg, buffer_end members. + (pp_cache): Don't assume cache_len fits in int. + * region-cache.h: Adjust extern decls to match. + + * search.c (scan_buffer, Freplace_match): Use ptrdiff_t, not + EMACS_INT, since either will do, for xpalloc. + + * alloc.c: Include verify.h, and check that int fits in ptrdiff_t. + (xnmalloc, xnrealloc, xpalloc): New functions. + + * bidi.c (bidi_shelve_header_size): New constant. + (bidi_cache_ensure_space, bidi_shelve_cache): Use it. + (bidi_cache_ensure_space): Avoid integer overflow when allocating. + + * buffer.c (overlays_at, overlays_in, record_overlay_string) + (overlay_strings): + Don't update size of array until after memory allocation succeeds, + because xmalloc/xrealloc may not return. + (struct sortstrlist.bytes): Now ptrdiff_t, as EMACS_INT doesn't help + now that we have proper integer overflow checking. + (record_overlay_string, overlay_strings): Catch overflows when + calculating size of overlay_str_buf. + + * callproc.c (Fcall_process): Check for size overflow when + calculating size of args2. + (child_setup): Avoid overflow by using size_t rather than ptrdiff_t. + Normally we prefer signed values, but sticking with ptrdiff_t would + require adding more-complicated checks. + + * ccl.c (Fccl_execute_on_string): Check for memory overflow. + Use ptrdiff_t rather than EMACS_INT where ptrdiff_t will do. + Redo buffer-overflow calculations to avoid integer overflow. + Add a FIXME comment where memory seems to be over-allocated. + + * character.c (Fstring): Check for size-calculation overflow. + + * coding.c (produce_chars): Redo buffer-overflow calculations to avoid + unnecessary integer overflow. Check for size overflow. + (encode_coding_object): Don't update size until xmalloc succeeds. + + * composite.c (get_composition_id): Check for overflow in glyph + length calculations. + + Integer and memory overflow fixes for display code. + * dispextern.h (struct glyph_pool.nglyphs): Now ptrdiff_t, not int. + * dispnew.c (adjust_glyph_matrix, realloc_glyph_pool) + (scrolling_window): Check for overflow in size calculations. + (line_draw_cost, realloc_glyph_pool, add_row_entry): + Don't assume glyph table len fits in int. + (struct row_entry.bucket, row_entry_pool_size, row_entry_idx) + (row_table_size): Now ptrdiff_t, not int. + (scrolling_window): Avoid overflow in size calculations. + Don't update size until allocation succeeds. + * fns.c (concat): Check for overflow in size calculations. + (next_almost_prime): Verify NEXT_ALMOST_PRIME_LIMIT. + * lisp.h (RANGED_INTEGERP, TYPE_RANGED_INTEGERP): New macros. + (NEXT_ALMOST_PRIME_LIMIT): New constant. + + * doc.c (get_doc_string_buffer_size): Now ptrdiff_t, not int. + (get_doc_string): Check for size calculation overflow. + Don't update size until allocation succeeds. + (get_doc_string, Fsubstitute_command_keys): Use ptrdiff_t, not + EMACS_INT, where ptrdiff_t will do. + (Fsubstitute_command_keys): Check for string overflow. + + * editfns.c (set_time_zone_rule): Don't assume environment length + fits in int. + (message_length): Now ptrdiff_t, not int. + (Fmessage_box): Don't update size until allocation succeeds. + Don't assume message length fits in int. + (Fformat): Use ptrdiff_t, not EMACS_INT, where ptrdiff_t will do. + + * emacs.c (main): Do not reallocate argv, since there is a null at + the end that can be overwritten, and this way there's no need to + worry about size-calculation overflow. + (sort_args): Check for size-calculation overflow. + + * eval.c (init_eval_once, grow_specpdl): Don't update size until + alloc succeeds. + (call_debugger, grow_specpdl): Redo calculations to avoid overflow. + + * frame.c (set_menu_bar_lines, x_set_frame_parameters) + (x_set_scroll_bar_width, x_figure_window_size): + Check for integer overflow. + (x_set_alpha): Do not assume XINT fits in int. + + * frame.h (struct frame): Use int, not EMACS_INT, where int works. + This is for the members text_lines, text_cols, total_lines, total_cols, + where the system imposes an 'int' limit. + + * fringe.c (Fdefine_fringe_bitmap): + Don't update size until alloc works. + + * ftfont.c (ftfont_get_open_type_spec, setup_otf_gstring) + (ftfont_shape_by_flt): Check for integer overflow in size calculations. + + * gtkutil.c (get_utf8_string, xg_store_widget_in_map): + Check for size-calculation overflow. + (get_utf8_string): Use ptrdiff_t, not size_t, where either will + do, as we prefer signed integers. + (id_to_widget.max_size, id_to_widget.used) + (xg_store_widget_in_map, xg_remove_widget_from_map) + (xg_get_widget_from_map, xg_get_scroll_id_for_window) + (xg_remove_scroll_bar, xg_update_scrollbar_pos): + Use and return ptrdiff_t, not int. + (xg_gtk_scroll_destroy): Don't assume ptrdiff_t fits in int. + * gtkutil.h: Change prototypes to match the above. + + * image.c (RANGED_INTEGERP, TYPE_RANGED_INTEGERP): Remove; these + are duplicate now that they've been promoted to lisp.h. + (x_allocate_bitmap_record, x_alloc_image_color) + (make_image_cache, cache_image, xpm_load): + Don't update size until alloc is done. + (xpm_load, lookup_rgb_color, lookup_pixel_color, x_to_xcolors) + (x_detect_edges): + Check for size calculation overflow. + (ct_colors_allocated_max): New constant. + (x_to_xcolors, x_detect_edges): Reorder multiplicands to avoid + overflow. + + * keyboard.c (read_char, menu_bar_items, tool_bar_items) + (read_char_x_menu_prompt, read_char_minibuf_menu_width) + (read_char_minibuf_menu_prompt, follow_key, read_key_sequence): + Use ptrdiff_t, not int, to count maps. + (read_char_minibuf_menu_prompt): Check for overflow in size + calculations. Don't update size until allocation succeeds. Redo + calculations to avoid overflow. + * keyboard.h: Change prototypes to match the above. + + * keymap.c (cmm_size, current_minor_maps): Use ptrdiff_t, not int, + to count maps. + (current_minor_maps): Check for size calculation overflow. + * keymap.h: Change prototypes to match the above. + + * lread.c (read1, init_obarray): Don't update size until alloc done. + + * macros.c (Fstart_kbd_macro): Don't update size until alloc done. + (store_kbd_macro_char): Reorder multiplicands to avoid overflow. + + * nsterm.h (struct ns_color_table.size, struct ns_color_table.avail): + Now ptrdiff_t, not int. + * nsterm.m (ns_index_color): Use ptrdiff_t, not int, for table indexes. + (ns_draw_fringe_bitmap): Rewrite to avoid overflow. + + * process.c (Fnetwork_interface_list): Check for overflow + in size calculation. + + * region-cache.c (move_cache_gap): Check for size calculation overflow. + + * scroll.c (do_line_insertion_deletion_costs): Check for size calc + overflow. Don't bother calling xmalloc when xrealloc will do. + + * search.c (Freplace_match): Check for size calculation overflow. + (Fset_match_data): Don't assume list lengths fit in 'int'. + + * sysdep.c (system_process_attributes): Use ptrdiff_t, not int, + for command line length. Do not attempt to address one before the + beginning of an array, as that's not portable. + + * term.c (max_frame_lines): Remove; unused. + (encode_terminal_src_size, encode_terminal_dst_size): Now ptrdiff_t, + not int. + (encode_terminal_code, calculate_costs): Check for size + calculation overflow. + (encode_terminal_code): Use ptrdiff_t, not int, to record glyph + table lengths and related sizes. Don't update size until alloc + done. Redo calculations to avoid overflow. + (calculate_costs): Don't bother calling xmalloc when xrealloc will do. + + * termcap.c (tgetent): Use ptrdiff_t, not int, to record results of + subtracting pointers. + (gobble_line): Check for overflow more carefully. Don't update size + until alloc done. + + * tparam.c (tparam1): Use ptrdiff_t, not int, for sizes. + Don't update size until alloc done. + Redo size calculations to avoid overflow. + Check for size calculation overflow. + (main) [DEBUG]: Fix typo in invoking tparam1. + + * xdisp.c (store_mode_line_noprop_char, x_consider_frame_title): + Use ptrdiff_t, not int, for sizes. + (store_mode_line_noprop_char): Don't update size until alloc done. + + * xfaces.c (lface_id_to_name_size, Finternal_make_lisp_face): + Use ptrdiff_t, not int, for sizes. + (Finternal_make_lisp_face, cache_face): + Check for size calculation overflow. + (cache_face): Treat size calculation overflows as if they were + memory exhaustion (the usual treatment), rather than aborting. + + * xfns.c (x_encode_text, x_set_name_internal) + (Fx_change_window_property): Use ptrdiff_t, not int, to count + sizes, since they can exceed INT_MAX in size. Check for size + calculation overflow. + + * xgselect.c (gfds_size): Now ptrdiff_t, for convenience with xpalloc. + (xg_select): Check for size calculation overflow. + Don't update size until alloc done. + + * xrdb.c (get_environ_db): Don't assume path length fits in int, + as sprintf is limited to int lengths. + + * xselect.c (X_LONG_SIZE, X_USHRT_MAX, X_ULONG_MAX): New macros. + Use them to make the following changes clearer. + (MAX_SELECTION_QUANTUM): Make the other bounds on this value clearer. + This change doesn't affect the value now, but it may help remind + future maintainers not to raise the value too much later. + (SELECTION_QUANTUM): Remove, replacing with ... + (selection_quantum): ... new function, which avoids overflow. + All uses changed. + (struct selection_data.size): Now ptrdiff_t, not int, to avoid + assumption that selection length fits in 'int'. + (x_reply_selection_request, x_handle_selection_request) + (x_get_window_property, receive_incremental_selection) + (x_get_window_property_as_lisp_data, selection_data_to_lisp_data) + (lisp_data_to_selection_data, clean_local_selection_data): + Use ptrdiff_t, not int, to record length of selection. + (x_reply_selection_request, x_get_window_property) + (receive_incremental_selection, x_property_data_to_lisp): + Redo calculations to avoid overflow. + (x_reply_selection_request): When sending hint, ceiling it at + X_ULONG_MAX rather than relying on wraparound overflow to send + something. + (x_get_window_property, receive_incremental_selection) + (lisp_data_to_selection_data, x_property_data_to_lisp): + Check for size-calculation overflow. + (x_get_window_property, receive_incremental_selection) + (lisp_data_to_selection_data, Fx_register_dnd_atom): + Don't store size until memory allocation succeeds. + (x_get_window_property): Plug memory leak on memory exhaustion. + Don't double-block input; malloc is safe here. Don't assume 2**34 + - 4 fits in unsigned long. Add an xassert to check + XGetWindowProperty overflow. Be more careful about overflow + calculations, and distinguish size from memory overflow better. + (receive_incremental_selection): When tracing, don't assume + unsigned int is less than INT_MAX. + (x_selection_data_to_lisp_data): Remove unnecessary (and in theory + harmful) conversions of unsigned short to int. + (lisp_data_to_selection_data): Don't assume that integers + in the range -65535 through -1 fit in an X unsigned short. + Don't assume that ULONG_MAX =3D=3D X_ULONG_MAX. Don't store into + result parameters unless successful. Rely on cons_to_unsigned + to report problems with elements; the old code wasn't right anyway. + (x_check_property_data): Check for int overflow; we cannot use + a wider type due to X limits. + (x_handle_dnd_message): Use unsigned int, to avoid int overflow. + + * xsmfns.c (smc_save_yourself_CB): Check for size calc overflow. + + * xterm.c (x_color_cells, x_send_scrollbar_event, handle_one_xevent) + (x_term_init): Check for size calculation overflow. + (x_color_cells): Don't store size until memory allocation succeeds. + (handle_one_xevent): Use ptrdiff_t, not int, for byte counts. + Don't assume alloca size is less than MAX_ALLOCA. + (x_term_init): Don't assume length fits in int (sprintf is limited + to int size). + + Use ptrdiff_t for composition IDs. + * character.c (lisp_string_width): + * composite.c (composition_table_size, n_compositions) + (get_composition_id, composition_gstring_from_id): + * dispextern.h (struct glyph_string.cmp_id, struct composition_it.id): + * xdisp.c (BUILD_COMPOSITE_GLYPH_STRING): + * window.c (Frecenter): + Use ptrdiff_t, not int, for composition IDs. + * composite.c (get_composition_id): Check for integer overflow. + * composite.h: Adjust prototypes to match the above changes. + + Use ptrdiff_t for hash table indexes. + * category.c (hash_get_category_set): + * ccl.c (ccl_driver): + * charset.h (struct charset.hash_index, CHECK_CHARSET_GET_ID): + * coding.c (coding_system_charset_list, detect_coding_system): + * coding.h (struct coding_system.id): + * composite.c (get_composition_id, gstring_lookup_cache): + * fns.c (hash_lookup, hash_put, Fgethash, Fputhash): + * image.c (xpm_get_color_table_h): + * lisp.h (hash_lookup, hash_put): + * minibuf.c (Ftest_completion): + Use ptrdiff_t for hash table indexes, not int (which is too + narrow, on 64-bit hosts) or EMACS_INT (which is too wide, on + 32-bit --with-wide-int hosts). + + * charset.c (Fdefine_charset_internal): Check for integer overflow. + Add a FIXME comment about memory leaks. + (syms_of_charset): Don't assume xmalloc returns. + + Don't assume that stated character widths fit in int. + * character.c (Fchar_width, c_string_width, lisp_string_width): + * character.h (CHAR_WIDTH): + * indent.c (MULTIBYTE_BYTES_WIDTH): + Use sanitize_char_width to avoid undefined and/or bad behavior + with outlandish widths. + * character.h (sanitize_tab_width): Renamed from sanitize_width, + now that we have two such functions. All uses changed. + (sanitize_char_width): New inline function. + + Don't assume that tab-width fits in int. + * character.h (sanitize_width): New inline function. + (SANE_TAB_WIDTH): New macro. + (ASCII_CHAR_WIDTH): Use it. + * indent.c (sane_tab_width): Remove. All uses replaced by + SANE_TAB_WIDTH (current_buffer). + * xdisp.c (init_iterator): Use SANE_TAB_WIDTH. + + * fileio.c: Integer overflow issues with file modes. + (Fset_file_modes, auto_save_1): Don't assume EMACS_INT fits in int. + + * charset.c (read_hex): New arg OVERFLOW. All uses changed. + Remove unreachable code. + (read_hex, load_charset_map_from_file): Check for integer overflow. + + * xterm.c: don't go over XClientMessageEvent limit + (scroll_bar_windows_size): Now ptrdiff_t, as we prefer signed. + (x_send_scroll_bar_event): Likewise. Check that the size does not + exceed limits imposed by XClientMessageEvent, as well as the usual + ptrdiff_t and size_t limits. + + * keyboard.c: Overflow, signedness and related fixes. + (make_lispy_movement): Use same integer type in forward decl + that is used in the definition. + (read_key_sequence, keyremap_step): + Change bufsize argument back to int, undoing my 2011-03-30 change. + We prefer signed types, and int is wide enough here. + (parse_tool_bar_item): Don't assume tool_bar_max_label_size is less + than TYPE_MAXIMUM (EMACS_INT) / 2. Don't let the label size grow + larger than STRING_BYTES_BOUND. Use ptrdiff_t for Emacs string + length, not size_t. Use ptrdiff_t for index, not int. + (keyremap_step, read_key_sequence): Redo bufsize check to avoid + possibility of integer overflow. + + Overflow, signedness and related fixes for images. + + * dispextern.h (struct it.stack[0].u.image.image_id) + (struct_it.image_id, struct image.id, struct image_cache.size) + (struct image_cache.used, struct image_cache.ref_count): + * gtkutil.c (update_frame_tool_bar): + * image.c (x_reference_bitmap, Fimage_size, Fimage_mask_p) + (Fimage_metadata, free_image_cache, clear_image_cache, lookup_image) + (cache_image, mark_image_cache, x_kill_gs_process, Flookup_image): + * nsmenu.m (update_frame_tool_bar): + * xdisp.c (calc_pixel_width_or_height): + * xfns.c (image_cache_refcount): + Image IDs are now ptrdiff_t, not int, to avoid arbitrary limits + on typical 64-bit hosts. + + * image.c (RANGED_INTEGERP, TYPE_RANGED_INTEGERP): New macros. + (x_bitmap_pixmap, x_create_x_image_and_pixmap): + Omit unnecessary casts to int. + (parse_image_spec): Check that integers fall into 'int' range + when the callers expect that. + (image_ascent): Redo ascent calculation to avoid int overflow. + (clear_image_cache): Avoid overflow when sqrt (INT_MAX) < nimages. + (lookup_image): Remove unnecessary tests. + (xbm_image_p): Locals are now of int, not EMACS_INT, + since parse_image_check makes sure they fit into int. + (png_load, gif_load, svg_load_image): + Prefer int to unsigned where either will do. + (tiff_handler): New function, combining the cores of the + old tiff_error_handler and tiff_warning_handler. This + function is rewritten to use vsnprintf and thereby avoid + stack buffer overflows. It uses only the features of vsnprintf + that are common to both POSIX and native Microsoft. + (tiff_error_handler, tiff_warning_handler): Use it. + (tiff_load, gif_load, imagemagick_load_image): + Don't assume :index value fits in 'int'. + (gif_load): Omit unnecessary cast to double, and avoid double-rounding. + (imagemagick_load_image): Check that crop parameters fit into + the integer types that MagickCropImage accepts. Don't assume + Vimagemagick_render_type has a nonnegative value. Don't assume + size_t fits in 'long'. + (gs_load): Use printmax_t to print the widest integers possible. + Check for integer overflow when computing image height and width. + 2011-08-04 Jan Dj=C3=A4rv =20 * Makefile.in (LIB_PTHREAD): New variable. =3D=3D=3D modified file 'src/alloc.c' --- src/alloc.c 2011-08-04 17:04:39 +0000 +++ src/alloc.c 2011-08-05 02:19:34 +0000 @@ -46,6 +46,7 @@ #include "syssignal.h" #include "termhooks.h" /* For struct terminal. */ #include +#include =20 /* GC_MALLOC_CHECK defined means perform validity checks of malloc'd memory. Can do this only if using gmalloc.c. */ @@ -733,6 +734,93 @@ } =20 =20 +/* Other parts of Emacs pass large int values to allocator functions + expecting ptrdiff_t. This is portable in practice, but check it to + be safe. */ +verify (INT_MAX <=3D PTRDIFF_MAX); + + +/* Allocate an array of NITEMS items, each of size ITEM_SIZE. + Signal an error on memory exhaustion, and block interrupt input. */ + +void * +xnmalloc (ptrdiff_t nitems, ptrdiff_t item_size) +{ + xassert (0 <=3D nitems && 0 < item_size); + if (min (PTRDIFF_MAX, SIZE_MAX) / item_size < nitems) + memory_full (SIZE_MAX); + return xmalloc (nitems * item_size); +} + + +/* Reallocate an array PA to make it of NITEMS items, each of size ITEM_= SIZE. + Signal an error on memory exhaustion, and block interrupt input. */ + +void * +xnrealloc (void *pa, ptrdiff_t nitems, ptrdiff_t item_size) +{ + xassert (0 <=3D nitems && 0 < item_size); + if (min (PTRDIFF_MAX, SIZE_MAX) / item_size < nitems) + memory_full (SIZE_MAX); + return xrealloc (pa, nitems * item_size); +} + + +/* Grow PA, which points to an array of *NITEMS items, and return the + location of the reallocated array, updating *NITEMS to reflect its + new size. The new array will contain at least NITEMS_INCR_MIN more + items, but will not contain more than NITEMS_MAX items total. + ITEM_SIZE is the size of each item, in bytes. + + ITEM_SIZE and NITEMS_INCR_MIN must be positive. *NITEMS must be + nonnegative. If NITEMS_MAX is -1, it is treated as if it were + infinity. + + If PA is null, then allocate a new array instead of reallocating + the old one. Thus, to grow an array A without saving its old + contents, invoke xfree (A) immediately followed by xgrowalloc (0, + &NITEMS, ...). + + Block interrupt input as needed. If memory exhaustion occurs, set + *NITEMS to zero if PA is null, and signal an error (i.e., do not + return). */ + +void * +xpalloc (void *pa, ptrdiff_t *nitems, ptrdiff_t nitems_incr_min, + ptrdiff_t nitems_max, ptrdiff_t item_size) +{ + /* The approximate size to use for initial small allocation + requests. This is the largest "small" request for the GNU C + library malloc. */ + enum { DEFAULT_MXFAST =3D 64 * sizeof (size_t) / 4 }; + + /* If the array is tiny, grow it to about (but no greater than) + DEFAULT_MXFAST bytes. Otherwise, grow it by about 50%. */ + ptrdiff_t n =3D *nitems; + ptrdiff_t tiny_max =3D DEFAULT_MXFAST / item_size - n; + ptrdiff_t half_again =3D n >> 1; + ptrdiff_t incr_estimate =3D max (tiny_max, half_again); + + /* Adjust the increment according to three constraints: NITEMS_INCR_MI= N, + NITEMS_MAX, and what the C language can represent safely. */ + ptrdiff_t C_language_max =3D min (PTRDIFF_MAX, SIZE_MAX) / item_size; + ptrdiff_t n_max =3D (0 <=3D nitems_max && nitems_max < C_language_max + ? nitems_max : C_language_max); + ptrdiff_t nitems_incr_max =3D n_max - n; + ptrdiff_t incr =3D max (nitems_incr_min, min (incr_estimate, nitems_in= cr_max)); + + xassert (0 < item_size && 0 < nitems_incr_min && 0 <=3D n && -1 <=3D n= items_max); + if (! pa) + *nitems =3D 0; + if (nitems_incr_max < incr) + memory_full (SIZE_MAX); + n +=3D incr; + pa =3D xrealloc (pa, n * item_size); + *nitems =3D n; + return pa; +} + + /* Like strdup, but uses xmalloc. */ =20 char * =3D=3D=3D modified file 'src/bidi.c' --- src/bidi.c 2011-08-02 19:16:32 +0000 +++ src/bidi.c 2011-08-05 02:19:34 +0000 @@ -306,6 +306,21 @@ static ptrdiff_t bidi_cache_start =3D 0; /* start of cache for this "stack" level */ =20 +/* 5-slot stack for saving the start of the previous level of the + cache. xdisp.c maintains a 5-slot stack for its iterator state, + and we need the same size of our stack. */ +static ptrdiff_t bidi_cache_start_stack[IT_STACK_SIZE]; +static int bidi_cache_sp; + +/* Size of header used by bidi_shelve_cache. */ +enum + { + bidi_shelve_header_size =3D + (sizeof (bidi_cache_idx) + sizeof (bidi_cache_start_stack) + + sizeof (bidi_cache_sp) + sizeof (bidi_cache_start) + + sizeof (bidi_cache_last_idx)) + }; + /* Reset the cache state to the empty state. We only reset the part of the cache relevant to iteration of the current object. Previous objects, which are pushed on the display iterator's stack, are left @@ -463,21 +478,19 @@ /* Enlarge the cache as needed. */ if (idx >=3D bidi_cache_size) { - ptrdiff_t new_size; - /* The bidi cache cannot be larger than the largest Lisp string or buffer. */ ptrdiff_t string_or_buffer_bound =3D max (BUF_BYTES_MAX, STRING_BYTES_BOUND); =20 /* Also, it cannot be larger than what C can represent. */ - ptrdiff_t c_bound =3D min (PTRDIFF_MAX, SIZE_MAX) / elsz; + ptrdiff_t c_bound =3D + (min (PTRDIFF_MAX, SIZE_MAX) - bidi_shelve_header_size) / elsz; =20 - if (min (string_or_buffer_bound, c_bound) <=3D idx) - memory_full (SIZE_MAX); - new_size =3D idx - idx % BIDI_CACHE_CHUNK + BIDI_CACHE_CHUNK; - bidi_cache =3D (struct bidi_it *) xrealloc (bidi_cache, new_size *= elsz); - bidi_cache_size =3D new_size; + bidi_cache =3D + xpalloc (bidi_cache, &bidi_cache_size, + max (BIDI_CACHE_CHUNK, idx - bidi_cache_size + 1), + min (string_or_buffer_bound, c_bound), elsz); } } =20 @@ -568,11 +581,6 @@ /*********************************************************************** Pushing and popping the bidi iterator state ***********************************************************************= / -/* 5-slot stack for saving the start of the previous level of the - cache. xdisp.c maintains a 5-slot stack for its iterator state, - and we need the same size of our stack. */ -static ptrdiff_t bidi_cache_start_stack[IT_STACK_SIZE]; -static int bidi_cache_sp; =20 /* Push the bidi iterator state in preparation for reordering a different object, e.g. display string found at certain buffer @@ -629,11 +637,8 @@ if (bidi_cache_idx =3D=3D 0) return NULL; =20 - databuf =3D xmalloc (sizeof (bidi_cache_idx) - + bidi_cache_idx * sizeof (struct bidi_it) - + sizeof (bidi_cache_start_stack) - + sizeof (bidi_cache_sp) + sizeof (bidi_cache_start) - + sizeof (bidi_cache_last_idx)); + databuf =3D xmalloc (bidi_shelve_header_size + + bidi_cache_idx * sizeof (struct bidi_it)); memcpy (databuf, &bidi_cache_idx, sizeof (bidi_cache_idx)); memcpy (databuf + sizeof (bidi_cache_idx), bidi_cache, bidi_cache_idx * sizeof (struct bidi_it)); =3D=3D=3D modified file 'src/buffer.c' --- src/buffer.c 2011-07-28 17:46:21 +0000 +++ src/buffer.c 2011-08-05 02:15:35 +0000 @@ -2568,13 +2568,10 @@ Either make it bigger, or don't store any more in it. */ if (extend) { - if ((OVERLAY_COUNT_MAX - 4) / 2 < len) - memory_full (SIZE_MAX); - /* Make it work with an initial len =3D=3D 0. */ - len =3D len * 2 + 4; - *len_ptr =3D len; - vec =3D (Lisp_Object *) xrealloc (vec, len * sizeof (Lisp_Object)); + vec =3D xpalloc (vec, len_ptr, 1, OVERLAY_COUNT_MAX, + sizeof *vec); *vec_ptr =3D vec; + len =3D *len_ptr; } else inhibit_storing =3D 1; @@ -2611,13 +2608,10 @@ { if (extend) { - if ((OVERLAY_COUNT_MAX - 4) / 2 < len) - memory_full (SIZE_MAX); - /* Make it work with an initial len =3D=3D 0. */ - len =3D len * 2 + 4; - *len_ptr =3D len; - vec =3D (Lisp_Object *) xrealloc (vec, len * sizeof (Lisp_Object)); + vec =3D xpalloc (vec, len_ptr, 1, OVERLAY_COUNT_MAX, + sizeof *vec); *vec_ptr =3D vec; + len =3D *len_ptr; } else inhibit_storing =3D 1; @@ -2708,13 +2702,10 @@ Either make it bigger, or don't store any more in it. */ if (extend) { - if ((OVERLAY_COUNT_MAX - 4) / 2 < len) - memory_full (SIZE_MAX); - /* Make it work with an initial len =3D=3D 0. */ - len =3D len * 2 + 4; - *len_ptr =3D len; - vec =3D (Lisp_Object *) xrealloc (vec, len * sizeof (Lisp_Object)); + vec =3D xpalloc (vec, len_ptr, 1, OVERLAY_COUNT_MAX, + sizeof *vec); *vec_ptr =3D vec; + len =3D *len_ptr; } else inhibit_storing =3D 1; @@ -2756,13 +2747,10 @@ { if (extend) { - if ((OVERLAY_COUNT_MAX - 4) / 2 < len) - memory_full (SIZE_MAX); - /* Make it work with an initial len =3D=3D 0. */ - len =3D len * 2 + 4; - *len_ptr =3D len; - vec =3D (Lisp_Object *) xrealloc (vec, len * sizeof (Lisp_Object)); + vec =3D xpalloc (vec, len_ptr, 1, OVERLAY_COUNT_MAX, + sizeof *vec); *vec_ptr =3D vec; + len =3D *len_ptr; } else inhibit_storing =3D 1; @@ -2944,7 +2932,7 @@ struct sortstr *buf; /* An array that expands as needed; never freed. = */ ptrdiff_t size; /* Allocated length of that array. */ ptrdiff_t used; /* How much of the array is currently in use. */ - EMACS_INT bytes; /* Total length of the strings in buf. */ + ptrdiff_t bytes; /* Total length of the strings in buf. */ }; =20 /* Buffers for storing information about the overlays touching a given @@ -2977,17 +2965,7 @@ EMACS_INT nbytes; =20 if (ssl->used =3D=3D ssl->size) - { - if (min (PTRDIFF_MAX, SIZE_MAX) / (sizeof (struct sortstr) * 2) - < ssl->size) - memory_full (SIZE_MAX); - else if (0 < ssl->size) - ssl->size *=3D 2; - else - ssl->size =3D 5; - ssl->buf =3D ((struct sortstr *) - xrealloc (ssl->buf, ssl->size * sizeof (struct sortstr))); - } + ssl->buf =3D xpalloc (ssl->buf, &ssl->size, 5, -1, sizeof *ssl->buf)= ; ssl->buf[ssl->used].string =3D str; ssl->buf[ssl->used].string2 =3D str2; ssl->buf[ssl->used].size =3D size; @@ -3002,6 +2980,8 @@ else nbytes =3D SBYTES (str); =20 + if (INT_ADD_OVERFLOW (ssl->bytes, nbytes)) + memory_full (SIZE_MAX); ssl->bytes +=3D nbytes; =20 if (STRINGP (str2)) @@ -3014,6 +2994,8 @@ else nbytes =3D SBYTES (str2); =20 + if (INT_ADD_OVERFLOW (ssl->bytes, nbytes)) + memory_full (SIZE_MAX); ssl->bytes +=3D nbytes; } } @@ -3107,14 +3089,15 @@ Lisp_Object tem; EMACS_INT i; unsigned char *p; - EMACS_INT total =3D overlay_heads.bytes + overlay_tails.bytes; + ptrdiff_t total; =20 + if (INT_ADD_OVERFLOW (overlay_heads.bytes, overlay_tails.bytes)) + memory_full (SIZE_MAX); + total =3D overlay_heads.bytes + overlay_tails.bytes; if (total > overlay_str_len) - { - overlay_str_len =3D total; - overlay_str_buf =3D (unsigned char *)xrealloc (overlay_str_buf, - total); - } + overlay_str_buf =3D xpalloc (overlay_str_buf, &overlay_str_len, + total - overlay_str_len, -1, 1); + p =3D overlay_str_buf; for (i =3D overlay_tails.used; --i >=3D 0;) { =3D=3D=3D modified file 'src/callproc.c' --- src/callproc.c 2011-08-04 03:08:01 +0000 +++ src/callproc.c 2011-08-05 02:19:34 +0000 @@ -252,7 +252,7 @@ val =3D Qraw_text; else { - SAFE_ALLOCA (args2, Lisp_Object *, (nargs + 1) * sizeof *args2); + SAFE_NALLOCA (args2, 1, nargs + 1); args2[0] =3D Qcall_process; for (i =3D 0; i < nargs; i++) args2[i + 1] =3D args[i]; coding_systems =3D Ffind_operation_coding_system (nargs + 1, args2)= ; @@ -726,7 +726,7 @@ { ptrdiff_t i; =20 - SAFE_ALLOCA (args2, Lisp_Object *, (nargs + 1) * sizeof *args2); + SAFE_NALLOCA (args2, 1, nargs + 1); args2[0] =3D Qcall_process; for (i =3D 0; i < nargs; i++) args2[i + 1] =3D args[i]; coding_systems @@ -1024,7 +1024,7 @@ else { USE_SAFE_ALLOCA; - SAFE_ALLOCA (args2, Lisp_Object *, (nargs + 1) * sizeof *args2); + SAFE_NALLOCA (args2, 1, nargs + 1); args2[0] =3D Qcall_process_region; for (i =3D 0; i < nargs; i++) args2[i + 1] =3D args[i]; coding_systems =3D Ffind_operation_coding_system (nargs + 1, args2= ); @@ -1153,7 +1153,7 @@ cleaned up in the usual way. */ { register char *temp; - register int i; + size_t i; /* size_t, because ptrdiff_t might overflow here! */ =20 i =3D SBYTES (current_dir); #ifdef MSDOS =3D=3D=3D modified file 'src/category.c' --- src/category.c 2011-06-24 21:25:22 +0000 +++ src/category.c 2011-07-19 06:07:07 +0000 @@ -67,7 +67,7 @@ hash_get_category_set (Lisp_Object table, Lisp_Object category_set) { struct Lisp_Hash_Table *h; - EMACS_INT i; + ptrdiff_t i; EMACS_UINT hash; =20 if (NILP (XCHAR_TABLE (table)->extras[1])) =3D=3D=3D modified file 'src/ccl.c' --- src/ccl.c 2011-06-24 21:25:22 +0000 +++ src/ccl.c 2011-08-05 02:15:35 +0000 @@ -1303,7 +1303,7 @@ =20 case CCL_LookupIntConstTbl: { - EMACS_INT eop; + ptrdiff_t eop; struct Lisp_Hash_Table *h; GET_CCL_RANGE (eop, ccl_prog, ic++, 0, (VECTORP (Vtranslation_hash_table_vector) @@ -1329,7 +1329,7 @@ =20 case CCL_LookupCharConstTbl: { - EMACS_INT eop; + ptrdiff_t eop; struct Lisp_Hash_Table *h; GET_CCL_RANGE (eop, ccl_prog, ic++, 0, (VECTORP (Vtranslation_hash_table_vector) @@ -2061,12 +2061,13 @@ Lisp_Object val; struct ccl_program ccl; int i; - EMACS_INT outbufsize; + ptrdiff_t outbufsize; unsigned char *outbuf, *outp; - EMACS_INT str_chars, str_bytes; + ptrdiff_t str_chars, str_bytes; #define CCL_EXECUTE_BUF_SIZE 1024 int source[CCL_EXECUTE_BUF_SIZE], destination[CCL_EXECUTE_BUF_SIZE]; - EMACS_INT consumed_chars, consumed_bytes, produced_chars; + ptrdiff_t consumed_chars, consumed_bytes, produced_chars; + int buf_magnification; =20 if (setup_ccl_program (&ccl, ccl_prog) < 0) error ("Invalid CCL program"); @@ -2093,6 +2094,10 @@ ccl.ic =3D i; } =20 + buf_magnification =3D ccl.buf_magnification ? ccl.buf_magnification : = 1; + + if ((min (PTRDIFF_MAX, SIZE_MAX) - 256) / buf_magnification < str_byte= s) + memory_full (SIZE_MAX); outbufsize =3D (ccl.buf_magnification ? str_bytes * ccl.buf_magnification + 256 : str_bytes + 256); @@ -2127,12 +2132,18 @@ produced_chars +=3D ccl.produced; if (NILP (unibyte_p)) { - if (outp - outbuf + MAX_MULTIBYTE_LENGTH * ccl.produced - > outbufsize) + /* FIXME: Surely this should be buf_magnification instead. + MAX_MULTIBYTE_LENGTH overestimates the storage needed. */ + int magnification =3D MAX_MULTIBYTE_LENGTH; + + ptrdiff_t offset =3D outp - outbuf; + ptrdiff_t shortfall; + if (INT_MULTIPLY_OVERFLOW (ccl.produced, magnification)) + memory_full (SIZE_MAX); + shortfall =3D ccl.produced * magnification - (outbufsize - offset= ); + if (0 < shortfall) { - EMACS_INT offset =3D outp - outbuf; - outbufsize +=3D MAX_MULTIBYTE_LENGTH * ccl.produced; - outbuf =3D (unsigned char *) xrealloc (outbuf, outbufsize); + outbuf =3D xpalloc (outbuf, &outbufsize, shortfall, -1, 1); outp =3D outbuf + offset; } for (j =3D 0; j < ccl.produced; j++) @@ -2140,11 +2151,11 @@ } else { - if (outp - outbuf + ccl.produced > outbufsize) + ptrdiff_t offset =3D outp - outbuf; + ptrdiff_t shortfall =3D ccl.produced - (outbufsize - offset); + if (0 < shortfall) { - EMACS_INT offset =3D outp - outbuf; - outbufsize +=3D ccl.produced; - outbuf =3D (unsigned char *) xrealloc (outbuf, outbufsize); + outbuf =3D xpalloc (outbuf, &outbufsize, shortfall, -1, 1); outp =3D outbuf + offset; } for (j =3D 0; j < ccl.produced; j++) =3D=3D=3D modified file 'src/character.c' --- src/character.c 2011-07-12 21:17:39 +0000 +++ src/character.c 2011-08-05 02:15:35 +0000 @@ -326,7 +326,7 @@ disp =3D dp ? DISP_CHAR_VECTOR (dp, c) : Qnil; =20 if (VECTORP (disp)) - width =3D ASIZE (disp); + width =3D sanitize_char_width (ASIZE (disp)); else width =3D CHAR_WIDTH (c); =20 @@ -358,7 +358,7 @@ { val =3D DISP_CHAR_VECTOR (dp, c); if (VECTORP (val)) - thiswidth =3D ASIZE (val); + thiswidth =3D sanitize_char_width (ASIZE (val)); else thiswidth =3D CHAR_WIDTH (c); } @@ -423,7 +423,7 @@ { EMACS_INT chars, bytes, thiswidth; Lisp_Object val; - int cmp_id; + ptrdiff_t cmp_id; EMACS_INT ignore, end; =20 if (find_composition (i, -1, &ignore, &end, &val, string) @@ -451,7 +451,7 @@ { val =3D DISP_CHAR_VECTOR (dp, c); if (VECTORP (val)) - thiswidth =3D ASIZE (val); + thiswidth =3D sanitize_char_width (ASIZE (val)); else thiswidth =3D CHAR_WIDTH (c); } @@ -902,7 +902,7 @@ Lisp_Object str; USE_SAFE_ALLOCA; =20 - SAFE_ALLOCA (buf, unsigned char *, MAX_MULTIBYTE_LENGTH * n); + SAFE_NALLOCA (buf, MAX_MULTIBYTE_LENGTH, n); p =3D buf; =20 for (i =3D 0; i < n; i++) =3D=3D=3D modified file 'src/character.h' --- src/character.h 2011-07-06 23:28:00 +0000 +++ src/character.h 2011-07-19 00:42:24 +0000 @@ -556,6 +556,16 @@ } while (0) =20 =20 +/* Return a non-outlandish value for the tab width. */ + +#define SANE_TAB_WIDTH(buf) \ + sanitize_tab_width (XFASTINT (BVAR (buf, tab_width))) +static inline int +sanitize_tab_width (EMACS_INT width) +{ + return 0 < width && width <=3D 1000 ? width : 8; +} + /* Return the width of ASCII character C. The width is measured by how many columns C will occupy on the screen when displayed in the current buffer. */ @@ -563,12 +573,20 @@ #define ASCII_CHAR_WIDTH(c) \ (c < 0x20 \ ? (c =3D=3D '\t' \ - ? XFASTINT (BVAR (current_buffer, tab_width)) \ + ? SANE_TAB_WIDTH (current_buffer) \ : (c =3D=3D '\n' ? 0 : (NILP (BVAR (current_buffer, ctl_arrow)) ? = 4 : 2))) \ : (c < 0x7f \ ? 1 \ : ((NILP (BVAR (current_buffer, ctl_arrow)) ? 4 : 2)))) =20 +/* Return a non-outlandish value for a character width. */ + +static inline int +sanitize_char_width (EMACS_INT width) +{ + return 0 <=3D width && width <=3D 1000 ? width : 1000; +} + /* Return the width of character C. The width is measured by how many columns C will occupy on the screen when displayed in the current buffer. */ @@ -576,7 +594,7 @@ #define CHAR_WIDTH(c) \ (ASCII_CHAR_P (c) \ ? ASCII_CHAR_WIDTH (c) \ - : XINT (CHAR_TABLE_REF (Vchar_width_table, c))) + : sanitize_char_width (XINT (CHAR_TABLE_REF (Vchar_width_table, c)))) =20 /* If C is a variation selector, return the index numnber of the variation selector (1..256). Otherwise, return 0. */ =3D=3D=3D modified file 'src/charset.c' --- src/charset.c 2011-06-14 18:57:19 +0000 +++ src/charset.c 2011-08-05 02:15:35 +0000 @@ -61,7 +61,7 @@ /* Table of struct charset. */ struct charset *charset_table; =20 -static int charset_table_size; +static ptrdiff_t charset_table_size; static int charset_table_used; =20 Lisp_Object Qcharsetp; @@ -419,7 +419,7 @@ paying attention to comment character '#'. */ =20 static inline unsigned -read_hex (FILE *fp, int *eof) +read_hex (FILE *fp, int *eof, int *overflow) { int c; unsigned n; @@ -441,15 +441,16 @@ *eof =3D 1; return 0; } - *eof =3D 0; n =3D 0; - if (c =3D=3D 'x') - while ((c =3D getc (fp)) !=3D EOF && isxdigit (c)) + while (isxdigit (c =3D getc (fp))) + { + if (UINT_MAX >> 4 < n) + *overflow =3D 1; n =3D ((n << 4) - | (c <=3D '9' ? c - '0' : c <=3D 'F' ? c - 'A' + 10 : c - 'a' + 10))= ; - else - while ((c =3D getc (fp)) !=3D EOF && isdigit (c)) - n =3D (n * 10) + c - '0'; + | (c - ('0' <=3D c && c <=3D '9' ? '0' + : 'A' <=3D c && c <=3D 'F' ? 'A' - 10 + : 'a' - 10))); + } if (c !=3D EOF) ungetc (c, fp); return n; @@ -479,7 +480,6 @@ unsigned max_code =3D CHARSET_MAX_CODE (charset); int fd; FILE *fp; - int eof; Lisp_Object suffixes; struct charset_map_entries *head, *entries; int n_entries, count; @@ -504,22 +504,27 @@ memset (entries, 0, sizeof (struct charset_map_entries)); =20 n_entries =3D 0; - eof =3D 0; while (1) { - unsigned from, to; - int c; + unsigned from, to, c; int idx; + int eof =3D 0, overflow =3D 0; =20 - from =3D read_hex (fp, &eof); + from =3D read_hex (fp, &eof, &overflow); if (eof) break; if (getc (fp) =3D=3D '-') - to =3D read_hex (fp, &eof); + to =3D read_hex (fp, &eof, &overflow); else to =3D from; - c =3D (int) read_hex (fp, &eof); + if (eof) + break; + c =3D read_hex (fp, &eof, &overflow); + if (eof) + break; =20 + if (overflow) + continue; if (from < min_code || to > max_code || from > to || c > MAX_CHAR) continue; =20 @@ -1145,13 +1150,25 @@ hash_code); if (charset_table_used =3D=3D charset_table_size) { - struct charset *new_table - =3D (struct charset *) xmalloc (sizeof (struct charset) - * (charset_table_size + 16)); - memcpy (new_table, charset_table, - sizeof (struct charset) * charset_table_size); - charset_table_size +=3D 16; + /* Ensure that charset IDs fit into 'int' as well as into the + restriction imposed by fixnums. Although the 'int' restriction + could be removed, too much other code would need altering; for + example, the IDs are stuffed into struct + coding_system.charbuf[i] entries, which are 'int'. */ + int old_size =3D charset_table_size; + struct charset *new_table =3D + xpalloc (0, &charset_table_size, 1, + min (INT_MAX, MOST_POSITIVE_FIXNUM), + sizeof *charset_table); + memcpy (new_table, charset_table, old_size * sizeof *new_table); charset_table =3D new_table; + /* FIXME: Doesn't this leak memory? The old charset_table becomes + unreachable. It could be that this is intentional, because the + old charset table may be in a dumped emacs, and reallocating such + a table may not work. If the memory leak is intentional, a + comment should be added to explain this. If not, the old + charset_table should be freed, by passing it as the 1st argument + to xpalloc and removing the memcpy. */ } id =3D charset_table_used++; new_definition_p =3D 1; @@ -2210,14 +2227,16 @@ { Lisp_Object charset; int id; - int priority; + ptrdiff_t priority; }; =20 static int charset_compare (const void *d1, const void *d2) { const struct charset_sort_data *data1 =3D d1, *data2 =3D d2; - return (data1->priority - data2->priority); + if (data1->priority !=3D data2->priority) + return data1->priority < data2->priority ? -1 : 1; + return 0; } =20 DEFUN ("sort-charsets", Fsort_charsets, Ssort_charsets, 1, 1, 0, @@ -2227,7 +2246,8 @@ (Lisp_Object charsets) { Lisp_Object len =3D Flength (charsets); - int n =3D XFASTINT (len), i, j, done; + ptrdiff_t n =3D XFASTINT (len), i, j; + int done; Lisp_Object tail, elt, attrs; struct charset_sort_data *sort_data; int id, min_id =3D INT_MAX, max_id =3D INT_MIN; @@ -2235,7 +2255,7 @@ =20 if (n =3D=3D 0) return Qnil; - SAFE_ALLOCA (sort_data, struct charset_sort_data *, sizeof (*sort_data= ) * n); + SAFE_NALLOCA (sort_data, 1, n); for (tail =3D charsets, i =3D 0; CONSP (tail); tail =3D XCDR (tail), i= ++) { elt =3D XCAR (tail); @@ -2310,6 +2330,17 @@ void syms_of_charset (void) { + /* Allocate an initial charset table that is just under 64 KiB in size= . + This should be large enough so that the charset table need not be + reallocated during an initial bootstrap. Allocating anything large= r than + 64 KiB in an initial run may not work, because glibc malloc might u= se + mmap for larger allocations, and these don't work well across dumpe= d + systems. */ + enum { + initial_malloc_max =3D (1 << 16) - 1, + charset_table_size_init =3D initial_malloc_max / sizeof (struct char= set) + }; + DEFSYM (Qcharsetp, "charsetp"); =20 DEFSYM (Qascii, "ascii"); @@ -2342,9 +2373,9 @@ Vcharset_hash_table =3D Fmake_hash_table (2, args); } =20 - charset_table_size =3D 128; - charset_table =3D ((struct charset *) - xmalloc (sizeof (struct charset) * charset_table_size)); + charset_table =3D (struct charset *) xmalloc (sizeof (struct charset) + * charset_table_size_init); + charset_table_size =3D charset_table_size_init; charset_table_used =3D 0; =20 defsubr (&Scharsetp); =3D=3D=3D modified file 'src/charset.h' --- src/charset.h 2011-06-15 18:57:45 +0000 +++ src/charset.h 2011-07-19 06:07:07 +0000 @@ -148,7 +148,7 @@ int id; =20 /* Index to Vcharset_hash_table. */ - EMACS_INT hash_index; + ptrdiff_t hash_index; =20 /* Dimension of the charset: 1, 2, 3, or 4. */ int dimension; @@ -341,7 +341,7 @@ number of the charset. Otherwise, signal an error. */ #define CHECK_CHARSET_GET_ID(x, id) \ do { \ - int idx; \ + ptrdiff_t idx; \ \ if (! SYMBOLP (x) || (idx =3D CHARSET_SYMBOL_HASH_INDEX (x)) < 0) \ wrong_type_argument (Qcharsetp, (x)); \ =3D=3D=3D modified file 'src/cmds.c' --- src/cmds.c 2011-06-24 21:25:22 +0000 +++ src/cmds.c 2011-08-05 02:15:35 +0000 @@ -471,7 +471,7 @@ { USE_SAFE_ALLOCA; char *strn, *p; - SAFE_ALLOCA (strn, char *, n * len); + SAFE_NALLOCA (strn, len, n); for (p =3D strn; n > 0; n--, p +=3D len) memcpy (p, str, len); insert_and_inherit (strn, p - strn); =3D=3D=3D modified file 'src/coding.c' --- src/coding.c 2011-07-01 11:03:55 +0000 +++ src/coding.c 2011-07-28 20:31:29 +0000 @@ -5838,7 +5838,7 @@ Lisp_Object coding_system_charset_list (Lisp_Object coding_system) { - int id; + ptrdiff_t id; Lisp_Object attrs, charset_list; =20 CHECK_CODING_SYSTEM_GET_ID (coding_system, id); @@ -6683,8 +6683,12 @@ break; } =20 - if (dst + MAX_MULTIBYTE_LENGTH * to_nchars > dst_end) + if ((dst_end - dst) / MAX_MULTIBYTE_LENGTH < to_nchars) { + if (((min (PTRDIFF_MAX, SIZE_MAX) - (buf_end - buf)) + / MAX_MULTIBYTE_LENGTH) + < to_nchars) + memory_full (SIZE_MAX); dst =3D alloc_destination (coding, buf_end - buf + MAX_MULTIBYTE_LENGTH * to_nchars, @@ -7888,11 +7892,10 @@ } else if (EQ (dst_object, Qt)) { + ptrdiff_t dst_bytes =3D max (1, coding->src_chars); coding->dst_object =3D Qnil; - coding->dst_bytes =3D coding->src_chars; - if (coding->dst_bytes =3D=3D 0) - coding->dst_bytes =3D 1; - coding->destination =3D (unsigned char *) xmalloc (coding->dst_byt= es); + coding->destination =3D (unsigned char *) xmalloc (dst_bytes); + coding->dst_bytes =3D dst_bytes; coding->dst_multibyte =3D 0; } else @@ -8076,7 +8079,7 @@ Lisp_Object attrs, eol_type; Lisp_Object val =3D Qnil; struct coding_system coding; - int id; + ptrdiff_t id; struct coding_detection_info detect_info; enum coding_category base_category; int null_byte_found =3D 0, eight_bit_found =3D 0; =3D=3D=3D modified file 'src/coding.h' --- src/coding.h 2011-04-11 06:58:57 +0000 +++ src/coding.h 2011-07-19 06:07:07 +0000 @@ -415,7 +415,7 @@ setup_coding_system. At the early stage of building time, this value is -1 in the array coding_categories to indicate that no coding-system of that category is yet defined. */ - int id; + ptrdiff_t id; =20 /* Flag bits of the coding system. The meaning of each bit is common to all types of coding systems. */ =3D=3D=3D modified file 'src/composite.c' --- src/composite.c 2011-07-09 06:28:40 +0000 +++ src/composite.c 2011-08-05 02:15:35 +0000 @@ -142,10 +142,10 @@ struct composition **composition_table; =20 /* The current size of `composition_table'. */ -static int composition_table_size; +static ptrdiff_t composition_table_size; =20 /* Number of compositions currently made. */ -int n_compositions; +ptrdiff_t n_compositions; =20 /* Hash table for compositions. The key is COMPONENTS-VEC of `composition' property. The value is the corresponding @@ -172,19 +172,30 @@ =20 If the composition is invalid, return -1. */ =20 -int +ptrdiff_t get_composition_id (EMACS_INT charpos, EMACS_INT bytepos, EMACS_INT ncha= rs, Lisp_Object prop, Lisp_Object string) { Lisp_Object id, length, components, key, *key_contents; - int glyph_len; + ptrdiff_t glyph_len; struct Lisp_Hash_Table *hash_table =3D XHASH_TABLE (composition_hash_t= able); - EMACS_INT hash_index; + ptrdiff_t hash_index; EMACS_UINT hash_code; + enum composition_method method; struct composition *cmp; EMACS_INT i; int ch; =20 + /* Maximum length of a string of glyphs. XftGlyphExtents limits + this to INT_MAX, and Emacs limits it further. Divide INT_MAX - 1 + by 2 because x_produce_glyphs computes glyph_len * 2 + 1. Divide + the size by MAX_MULTIBYTE_LENGTH because encode_terminal_code + multiplies glyph_len by MAX_MULTIBYTE_LENGTH. */ + enum { + GLYPH_LEN_MAX =3D min ((INT_MAX - 1) / 2, + min (PTRDIFF_MAX, SIZE_MAX) / MAX_MULTIBYTE_LENGTH) + }; + /* PROP should be Form-A: ((LENGTH . COMPONENTS) . MODIFICATION-FUNC) or @@ -258,21 +269,9 @@ /* This composition is a new one. We must register it. */ =20 /* Check if we have sufficient memory to store this information. */ - if (composition_table_size =3D=3D 0) - { - composition_table_size =3D 256; - composition_table - =3D (struct composition **) xmalloc (sizeof (composition_table[0]) - * composition_table_size); - } - else if (composition_table_size <=3D n_compositions) - { - composition_table_size +=3D 256; - composition_table - =3D (struct composition **) xrealloc (composition_table, - sizeof (composition_table[0]) - * composition_table_size); - } + if (composition_table_size <=3D n_compositions) + composition_table =3D xpalloc (composition_table, &composition_table= _size, + 1, -1, sizeof *composition_table); =20 key_contents =3D XVECTOR (key)->contents; =20 @@ -316,20 +315,26 @@ /* Register the composition in composition_hash_table. */ hash_index =3D hash_put (hash_table, key, id, hash_code); =20 + method =3D (NILP (components) + ? COMPOSITION_RELATIVE + : ((INTEGERP (components) || STRINGP (components)) + ? COMPOSITION_WITH_ALTCHARS + : COMPOSITION_WITH_RULE_ALTCHARS)); + + glyph_len =3D (method =3D=3D COMPOSITION_WITH_RULE_ALTCHARS + ? (ASIZE (key) + 1) / 2 + : ASIZE (key)); + + if (GLYPH_LEN_MAX < glyph_len) + memory_full (SIZE_MAX); + /* Register the composition in composition_table. */ cmp =3D (struct composition *) xmalloc (sizeof (struct composition)); =20 - cmp->method =3D (NILP (components) - ? COMPOSITION_RELATIVE - : ((INTEGERP (components) || STRINGP (components)) - ? COMPOSITION_WITH_ALTCHARS - : COMPOSITION_WITH_RULE_ALTCHARS)); + cmp->method =3D method; cmp->hash_index =3D hash_index; - glyph_len =3D (cmp->method =3D=3D COMPOSITION_WITH_RULE_ALTCHARS - ? (ASIZE (key) + 1) / 2 - : ASIZE (key)); cmp->glyph_len =3D glyph_len; - cmp->offsets =3D (short *) xmalloc (sizeof (short) * glyph_len * 2); + cmp->offsets =3D xnmalloc (glyph_len, 2 * sizeof *cmp->offsets); cmp->font =3D NULL; =20 if (cmp->method !=3D COMPOSITION_WITH_RULE_ALTCHARS) @@ -656,7 +661,7 @@ gstring_lookup_cache (Lisp_Object header) { struct Lisp_Hash_Table *h =3D XHASH_TABLE (gstring_hash_table); - EMACS_INT i =3D hash_lookup (h, header, NULL); + ptrdiff_t i =3D hash_lookup (h, header, NULL); =20 return (i >=3D 0 ? HASH_VALUE (h, i) : Qnil); } @@ -691,7 +696,7 @@ } =20 Lisp_Object -composition_gstring_from_id (int id) +composition_gstring_from_id (ptrdiff_t id) { struct Lisp_Hash_Table *h =3D XHASH_TABLE (gstring_hash_table); =20 =3D=3D=3D modified file 'src/composite.h' --- src/composite.h 2011-06-12 23:25:12 +0000 +++ src/composite.h 2011-08-05 02:15:35 +0000 @@ -170,7 +170,7 @@ =20 struct composition { /* Number of glyphs of the composition components. */ - unsigned glyph_len; + int glyph_len; =20 /* Width, ascent, and descent pixels of the composition. */ short pixel_width, ascent, descent; @@ -193,7 +193,7 @@ void *font; =20 /* Pointer to an array of x-offset and y-offset (by pixels) of - glyphs. This points to a sufficient memory space (sizeof (int) * + glyphs. This points to a sufficient memory space (sizeof (short) * glyph_len * 2) that is allocated when the composition is registered in composition_table. X-offset and Y-offset of Nth glyph are (2N)th and (2N+1)th elements respectively. */ @@ -204,7 +204,7 @@ COMPOSITION-ID. */ extern struct composition **composition_table; /* Number of the currently registered compositions. */ -extern int n_compositions; +extern ptrdiff_t n_compositions; =20 /* Mask bits for CHECK_MASK arg to update_compositions. For a change in the region FROM and TO, check compositions ... */ @@ -216,8 +216,8 @@ =20 extern Lisp_Object Qcomposition; extern Lisp_Object composition_hash_table; -extern int get_composition_id (EMACS_INT, EMACS_INT, EMACS_INT, - Lisp_Object, Lisp_Object); +extern ptrdiff_t get_composition_id (EMACS_INT, EMACS_INT, EMACS_INT, + Lisp_Object, Lisp_Object); extern int find_composition (EMACS_INT, EMACS_INT, EMACS_INT *, EMACS_IN= T *, Lisp_Object *, Lisp_Object); extern void update_compositions (EMACS_INT, EMACS_INT, int); @@ -299,7 +299,7 @@ struct font_metrics; =20 extern Lisp_Object composition_gstring_put_cache (Lisp_Object, EMACS_INT= ); -extern Lisp_Object composition_gstring_from_id (int); +extern Lisp_Object composition_gstring_from_id (ptrdiff_t); extern int composition_gstring_p (Lisp_Object); extern int composition_gstring_width (Lisp_Object, EMACS_INT, EMACS_INT, struct font_metrics *); =3D=3D=3D modified file 'src/dispextern.h' --- src/dispextern.h 2011-08-02 19:16:32 +0000 +++ src/dispextern.h 2011-08-05 02:19:34 +0000 @@ -575,7 +575,7 @@ struct glyph *glyphs; =20 /* Allocated size of `glyphs'. */ - int nglyphs; + ptrdiff_t nglyphs; =20 /* Number of rows and columns in a matrix. */ int nrows, ncolumns; @@ -625,7 +625,7 @@ struct glyph_row *rows; =20 /* Number of elements allocated for the vector rows above. */ - int rows_allocated; + ptrdiff_t rows_allocated; =20 /* The number of rows used by the window if all lines were displayed with the smallest possible character height. */ @@ -1240,7 +1240,7 @@ struct composition *cmp; =20 /* If not negative, this string describes a compos. */ - int cmp_id; + ptrdiff_t cmp_id; =20 /* Start and end glyph indices in a glyph-string. */ int cmp_from, cmp_to; @@ -1708,7 +1708,8 @@ struct face **faces_by_id; =20 /* The allocated size, and number of used slots of faces_by_id. */ - int size, used; + ptrdiff_t size; + int used; =20 /* Flag indicating that attributes of the `menu' face have been changed. */ @@ -2058,7 +2059,7 @@ EMACS_INT stop_pos; /* ID number of the composition or glyph-string. If negative, we are not iterating over a composition now. */ - int id; + ptrdiff_t id; /* If non-negative, character that triggers the automatic composition at `stop_pos', and this is an automatic composition. If negative, this is a static composition. This is set to -2 @@ -2248,7 +2249,7 @@ struct { Lisp_Object object; struct it_slice slice; - int image_id; + ptrdiff_t image_id; } image; /* method =3D=3D GET_FROM_COMPOSITION */ struct { @@ -2378,7 +2379,7 @@ enum glyphless_display_method glyphless_method; =20 /* If what =3D=3D IT_IMAGE, the id of the image to display. */ - int image_id; + ptrdiff_t image_id; =20 /* Values from `slice' property. */ struct it_slice slice; @@ -2828,7 +2829,7 @@ EMACS_UINT hash; =20 /* Image id of this image. */ - int id; + ptrdiff_t id; =20 /* Hash collision chain. */ struct image *next, *prev; @@ -2847,13 +2848,13 @@ struct image **images; =20 /* Allocated size of `images'. */ - unsigned size; + ptrdiff_t size; =20 /* Number of images in the cache. */ - unsigned used; + ptrdiff_t used; =20 /* Reference count (number of frames sharing this cache). */ - int refcount; + ptrdiff_t refcount; }; =20 =20 @@ -3120,7 +3121,7 @@ extern int x_bitmap_height (struct frame *, ptrdiff_t); extern int x_bitmap_width (struct frame *, ptrdiff_t); extern int x_bitmap_pixmap (struct frame *, ptrdiff_t); -extern void x_reference_bitmap (struct frame *, int); +extern void x_reference_bitmap (struct frame *, ptrdiff_t); extern ptrdiff_t x_create_bitmap_from_data (struct frame *, char *, unsigned int, unsigned int); extern ptrdiff_t x_create_bitmap_from_file (struct frame *, Lisp_Object)= ; @@ -3141,7 +3142,7 @@ void mark_image_cache (struct image_cache *); int valid_image_p (Lisp_Object); void prepare_image_for_display (struct frame *, struct image *); -int lookup_image (struct frame *, Lisp_Object); +ptrdiff_t lookup_image (struct frame *, Lisp_Object); =20 unsigned long image_background (struct image *, struct frame *, XImagePtr_or_DC ximg); =3D=3D=3D modified file 'src/dispnew.c' --- src/dispnew.c 2011-07-14 20:40:35 +0000 +++ src/dispnew.c 2011-08-05 02:15:35 +0000 @@ -499,12 +499,12 @@ /* Enlarge MATRIX->rows if necessary. New rows are cleared. */ if (matrix->rows_allocated < dim.height) { - ptrdiff_t size =3D dim.height * sizeof (struct glyph_row); + int old_alloc =3D matrix->rows_allocated; new_rows =3D dim.height - matrix->rows_allocated; - matrix->rows =3D (struct glyph_row *) xrealloc (matrix->rows, size= ); - memset (matrix->rows + matrix->rows_allocated, 0, - new_rows * sizeof *matrix->rows); - matrix->rows_allocated =3D dim.height; + matrix->rows =3D xpalloc (matrix->rows, &matrix->rows_allocated, + new_rows, INT_MAX, sizeof *matrix->rows); + memset (matrix->rows + old_alloc, 0, + (matrix->rows_allocated - old_alloc) * sizeof *matrix->rows); } else new_rows =3D 0; @@ -576,9 +576,8 @@ while (row < end) { row->glyphs[LEFT_MARGIN_AREA] - =3D (struct glyph *) xrealloc (row->glyphs[LEFT_MARGIN_AREA], - (dim.width - * sizeof (struct glyph))); + =3D xnrealloc (row->glyphs[LEFT_MARGIN_AREA], + dim.width, sizeof (struct glyph)); =20 /* The mode line never has marginal areas. */ if (row =3D=3D matrix->rows + dim.height - 1 @@ -1217,7 +1216,7 @@ struct glyph *end =3D beg + row->used[TEXT_AREA]; int len; Lisp_Object *glyph_table_base =3D GLYPH_TABLE_BASE; - int glyph_table_len =3D GLYPH_TABLE_LENGTH; + ptrdiff_t glyph_table_len =3D GLYPH_TABLE_LENGTH; =20 /* Ignore trailing and leading spaces if we can. */ if (!FRAME_MUST_WRITE_SPACES (SELECTED_FRAME ())) /* XXX Is SELECTED_F= RAME OK here? */ @@ -1391,7 +1390,7 @@ static int realloc_glyph_pool (struct glyph_pool *pool, struct dim matrix_dim) { - int needed; + ptrdiff_t needed; int changed_p; =20 changed_p =3D (pool->glyphs =3D=3D 0 @@ -1399,24 +1398,17 @@ || matrix_dim.width !=3D pool->ncolumns); =20 /* Enlarge the glyph pool. */ - needed =3D matrix_dim.width * matrix_dim.height; + needed =3D matrix_dim.width; + if (INT_MULTIPLY_OVERFLOW (needed, matrix_dim.height)) + memory_full (SIZE_MAX); + needed *=3D matrix_dim.height; if (needed > pool->nglyphs) { - ptrdiff_t size =3D needed * sizeof (struct glyph); - - if (pool->glyphs) - { - pool->glyphs =3D (struct glyph *) xrealloc (pool->glyphs, size); - memset (pool->glyphs + pool->nglyphs, 0, - size - pool->nglyphs * sizeof (struct glyph)); - } - else - { - pool->glyphs =3D (struct glyph *) xmalloc (size); - memset (pool->glyphs, 0, size); - } - - pool->nglyphs =3D needed; + ptrdiff_t old_nglyphs =3D pool->nglyphs; + pool->glyphs =3D xpalloc (pool->glyphs, &pool->nglyphs, + needed - old_nglyphs, -1, sizeof *pool->glyphs); + memset (pool->glyphs + old_nglyphs, 0, + (pool->nglyphs - old_nglyphs) * sizeof *pool->glyphs); } =20 /* Remember the number of rows and columns because (a) we use them @@ -4166,7 +4158,7 @@ int new_line_number; =20 /* Bucket index of this row_entry in the hash table row_table. */ - int bucket; + ptrdiff_t bucket; =20 /* The row described by this entry. */ struct glyph_row *row; @@ -4180,29 +4172,29 @@ that we need a larger one. */ =20 static struct row_entry *row_entry_pool; -static int row_entry_pool_size; +static ptrdiff_t row_entry_pool_size; =20 /* Index of next free entry in row_entry_pool. */ =20 -static int row_entry_idx; +static ptrdiff_t row_entry_idx; =20 /* The hash table used during scrolling, and the table's size. This table is used to quickly identify equal rows in the desired and current matrix. */ =20 static struct row_entry **row_table; -static int row_table_size; +static ptrdiff_t row_table_size; =20 /* Vectors of pointers to row_entry structures belonging to the current and desired matrix, and the size of the vectors. */ =20 static struct row_entry **old_lines, **new_lines; -static int old_lines_size, new_lines_size; +static ptrdiff_t old_lines_size, new_lines_size; =20 /* A pool to allocate run structures from, and its size. */ =20 static struct run *run_pool; -static int runs_size; +static ptrdiff_t runs_size; =20 /* A vector of runs of lines found during scrolling. */ =20 @@ -4214,7 +4206,7 @@ add_row_entry (struct glyph_row *row) { struct row_entry *entry; - int i =3D row->hash % row_table_size; + ptrdiff_t i =3D row->hash % row_table_size; =20 entry =3D row_table[i]; while (entry && !row_equal_p (entry->row, row, 1)) @@ -4267,9 +4259,10 @@ struct glyph_matrix *desired_matrix =3D w->desired_matrix; struct glyph_matrix *current_matrix =3D w->current_matrix; int yb =3D window_text_bottom_y (w); - int i, j, first_old, first_new, last_old, last_new; - int nruns, n, run_idx; - ptrdiff_t nbytes; + ptrdiff_t i; + int j, first_old, first_new, last_old, last_new; + int nruns, run_idx; + ptrdiff_t n; struct row_entry *entry; struct redisplay_interface *rif =3D FRAME_RIF (XFRAME (WINDOW_FRAME (w= ))); =20 @@ -4354,45 +4347,59 @@ if (last_new =3D=3D first_new) return 0; =20 + /* Check for integer overflow in size calculation. + + If next_almost_prime checks (N) for divisibility by 2..10, then + it can return at most N + 10, e.g., next_almost_prime (1) =3D=3D 11= . + So, set next_almost_prime_increment_max to 10. + + It's just a coincidence that next_almost_prime_increment_max =3D=3D + NEXT_ALMOST_PRIME_LIMIT - 1. If NEXT_ALMOST_PRIME_LIMIT were + 13, then next_almost_prime_increment_max would be 14, e.g., + because next_almost_prime (113) would be 127. */ + { + verify (NEXT_ALMOST_PRIME_LIMIT =3D=3D 11); + enum { next_almost_prime_increment_max =3D 10 }; + ptrdiff_t row_table_max =3D + (min (PTRDIFF_MAX, SIZE_MAX) / (3 * sizeof *row_table) + - next_almost_prime_increment_max); + ptrdiff_t current_nrows_max =3D row_table_max - desired_matrix->nrow= s; + if (current_nrows_max < current_matrix->nrows) + memory_full (SIZE_MAX); + } + /* Reallocate vectors, tables etc. if necessary. */ =20 if (current_matrix->nrows > old_lines_size) - { - old_lines_size =3D current_matrix->nrows; - nbytes =3D old_lines_size * sizeof *old_lines; - old_lines =3D (struct row_entry **) xrealloc (old_lines, nbytes); - } + old_lines =3D xpalloc (old_lines, &old_lines_size, + current_matrix->nrows - old_lines_size, + INT_MAX, sizeof *old_lines); =20 if (desired_matrix->nrows > new_lines_size) - { - new_lines_size =3D desired_matrix->nrows; - nbytes =3D new_lines_size * sizeof *new_lines; - new_lines =3D (struct row_entry **) xrealloc (new_lines, nbytes); - } + new_lines =3D xpalloc (new_lines, &new_lines_size, + desired_matrix->nrows - new_lines_size, + INT_MAX, sizeof *new_lines); =20 - n =3D desired_matrix->nrows + current_matrix->nrows; - if (3 * n > row_table_size) + n =3D desired_matrix->nrows; + n +=3D current_matrix->nrows; + if (row_table_size < 3 * n) { - row_table_size =3D next_almost_prime (3 * n); - nbytes =3D row_table_size * sizeof *row_table; - row_table =3D (struct row_entry **) xrealloc (row_table, nbytes); - memset (row_table, 0, nbytes); + ptrdiff_t size =3D next_almost_prime (3 * n); + row_table =3D xnrealloc (row_table, size, sizeof *row_table); + row_table_size =3D size; + memset (row_table, 0, size * sizeof *row_table); } =20 if (n > row_entry_pool_size) - { - row_entry_pool_size =3D n; - nbytes =3D row_entry_pool_size * sizeof *row_entry_pool; - row_entry_pool =3D (struct row_entry *) xrealloc (row_entry_pool, = nbytes); - } + row_entry_pool =3D xpalloc (row_entry_pool, &row_entry_pool_size, + n - row_entry_pool_size, + -1, sizeof *row_entry_pool); =20 if (desired_matrix->nrows > runs_size) { + runs =3D xnrealloc (runs, desired_matrix->nrows, sizeof *runs); + run_pool =3D xnrealloc (run_pool, desired_matrix->nrows, sizeof *r= un_pool); runs_size =3D desired_matrix->nrows; - nbytes =3D runs_size * sizeof *runs; - runs =3D (struct run **) xrealloc (runs, nbytes); - nbytes =3D runs_size * sizeof *run_pool; - run_pool =3D (struct run *) xrealloc (run_pool, nbytes); } =20 nruns =3D run_idx =3D 0; =3D=3D=3D modified file 'src/doc.c' --- src/doc.c 2011-07-15 15:31:36 +0000 +++ src/doc.c 2011-08-05 02:15:35 +0000 @@ -39,7 +39,7 @@ extern Lisp_Object Qclosure; /* Buffer used for reading from documentation file. */ static char *get_doc_string_buffer; -static int get_doc_string_buffer_size; +static ptrdiff_t get_doc_string_buffer_size; =20 static unsigned char *read_bytecode_pointer; static Lisp_Object Fdocumentation_property (Lisp_Object, Lisp_Object, @@ -166,18 +166,17 @@ p =3D get_doc_string_buffer; while (1) { - EMACS_INT space_left =3D (get_doc_string_buffer_size + ptrdiff_t space_left =3D (get_doc_string_buffer_size - (p - get_doc_string_buffer)); int nread; =20 /* Allocate or grow the buffer if we need to. */ if (space_left =3D=3D 0) { - EMACS_INT in_buffer =3D p - get_doc_string_buffer; - get_doc_string_buffer_size +=3D 16 * 1024; - get_doc_string_buffer - =3D (char *) xrealloc (get_doc_string_buffer, - get_doc_string_buffer_size + 1); + ptrdiff_t in_buffer =3D p - get_doc_string_buffer; + get_doc_string_buffer =3D + xpalloc (get_doc_string_buffer, &get_doc_string_buffer_size, + 16 * 1024, -1, 1); p =3D get_doc_string_buffer + in_buffer; space_left =3D (get_doc_string_buffer_size - (p - get_doc_string_buffer)); @@ -713,16 +712,16 @@ int changed =3D 0; register unsigned char *strp; register char *bufp; - EMACS_INT idx; - EMACS_INT bsize; + ptrdiff_t idx; + ptrdiff_t bsize; Lisp_Object tem; Lisp_Object keymap; unsigned char *start; - EMACS_INT length, length_byte; + ptrdiff_t length, length_byte; Lisp_Object name; struct gcpro gcpro1, gcpro2, gcpro3, gcpro4; int multibyte; - EMACS_INT nchars; + ptrdiff_t nchars; =20 if (NILP (string)) return Qnil; @@ -774,7 +773,7 @@ } else if (strp[0] =3D=3D '\\' && strp[1] =3D=3D '[') { - EMACS_INT start_idx; + ptrdiff_t start_idx; int follow_remap =3D 1; =20 changed =3D 1; @@ -813,7 +812,9 @@ =20 if (NILP (tem)) /* but not on any keys */ { - EMACS_INT offset =3D bufp - buf; + ptrdiff_t offset =3D bufp - buf; + if (STRING_BYTES_BOUND - 4 < bsize) + string_overflow (); buf =3D (char *) xrealloc (buf, bsize +=3D 4); bufp =3D buf + offset; memcpy (bufp, "M-x ", 4); @@ -836,7 +837,7 @@ else if (strp[0] =3D=3D '\\' && (strp[1] =3D=3D '{' || strp[1] =3D= =3D '<')) { struct buffer *oldbuf; - EMACS_INT start_idx; + ptrdiff_t start_idx; /* This is for computing the SHADOWS arg for describe_map_tree. */ Lisp_Object active_maps =3D Fcurrent_active_maps (Qnil, Qnil); Lisp_Object earlier_maps; @@ -907,7 +908,9 @@ length_byte =3D SBYTES (tem); subst: { - EMACS_INT offset =3D bufp - buf; + ptrdiff_t offset =3D bufp - buf; + if (STRING_BYTES_BOUND - length_byte < bsize) + string_overflow (); buf =3D (char *) xrealloc (buf, bsize +=3D length_byte); bufp =3D buf + offset; memcpy (bufp, start, length_byte); =3D=3D=3D modified file 'src/editfns.c' --- src/editfns.c 2011-07-28 00:15:43 +0000 +++ src/editfns.c 2011-07-29 05:31:12 +0000 @@ -2100,7 +2100,7 @@ void set_time_zone_rule (const char *tzstring) { - int envptrs; + ptrdiff_t envptrs; char **from, **to, **newenv; =20 /* Make the ENVIRON vector longer with room for TZSTRING. */ @@ -3350,7 +3350,7 @@ static char *message_text; =20 /* Allocated length of that buffer. */ -static int message_length; +static ptrdiff_t message_length; =20 DEFUN ("message", Fmessage, Smessage, 1, MANY, 0, doc: /* Display a message at the bottom of the screen. @@ -3432,8 +3432,8 @@ } if (SBYTES (val) > message_length) { + message_text =3D (char *) xrealloc (message_text, SBYTES (val)); message_length =3D SBYTES (val); - message_text =3D (char *)xrealloc (message_text, message_length); } memcpy (message_text, SDATA (val), SBYTES (val)); message2 (message_text, SBYTES (val), @@ -4158,7 +4158,7 @@ character. CONVBYTES says how much room is needed. Allocate enough room (and then some) and do it again. */ { - EMACS_INT used =3D p - buf; + ptrdiff_t used =3D p - buf; =20 if (max_bufsize - used < convbytes) string_overflow (); =3D=3D=3D modified file 'src/emacs.c' --- src/emacs.c 2011-08-04 17:04:39 +0000 +++ src/emacs.c 2011-08-05 02:19:34 +0000 @@ -1358,24 +1358,17 @@ /* If we have the form --display=3DNAME, convert it into -d name. This requires inserting a new element into argv. */ - if (displayname !=3D 0 && skip_args - count_before =3D=3D 1) + if (displayname && count_before < skip_args) { - char **new =3D (char **) xmalloc (sizeof (char *) * (argc + 2)); - int j; - - for (j =3D 0; j < count_before + 1; j++) - new[j] =3D argv[j]; - new[count_before + 1] =3D (char *) "-d"; - new[count_before + 2] =3D displayname; - for (j =3D count_before + 2; j count_before - && argv[count_before + 1][1] =3D=3D '-') - argv[count_before + 1] =3D (char *) "-d"; =20 if (! no_site_lisp) { @@ -1838,8 +1831,8 @@ 0 for an option that takes no arguments, 1 for an option that takes one argument, etc. -1 for an ordinary non-option argument. */ - int *options =3D (int *) xmalloc (sizeof (int) * argc); - int *priority =3D (int *) xmalloc (sizeof (int) * argc); + int *options =3D xnmalloc (argc, sizeof *options); + int *priority =3D xnmalloc (argc, sizeof *priority); int to =3D 1; int incoming_used =3D 1; int from; =3D=3D=3D modified file 'src/eval.c' --- src/eval.c 2011-07-07 02:14:52 +0000 +++ src/eval.c 2011-08-05 02:15:35 +0000 @@ -133,8 +133,9 @@ void init_eval_once (void) { - specpdl_size =3D 50; - specpdl =3D (struct specbinding *) xmalloc (specpdl_size * sizeof (str= uct specbinding)); + enum { size =3D 50 }; + specpdl =3D (struct specbinding *) xmalloc (size * sizeof (struct spec= binding)); + specpdl_size =3D size; specpdl_ptr =3D specpdl; /* Don't forget to update docs (lispref node "Local Variables"). */ max_specpdl_size =3D 1300; /* 1000 is not enough for CEDET's c-by.el. = */ @@ -192,7 +193,7 @@ if (lisp_eval_depth + 40 > max_lisp_eval_depth) max_lisp_eval_depth =3D lisp_eval_depth + 40; =20 - if (SPECPDL_INDEX () + 100 > max_specpdl_size) + if (max_specpdl_size - 100 < SPECPDL_INDEX ()) max_specpdl_size =3D SPECPDL_INDEX () + 100; =20 #ifdef HAVE_WINDOW_SYSTEM @@ -3274,17 +3275,21 @@ grow_specpdl (void) { register int count =3D SPECPDL_INDEX (); - if (specpdl_size >=3D max_specpdl_size) + int max_size =3D + min (max_specpdl_size, + min (max (PTRDIFF_MAX, SIZE_MAX) / sizeof (struct specbinding), + INT_MAX)); + int size; + if (max_size <=3D specpdl_size) { if (max_specpdl_size < 400) - max_specpdl_size =3D 400; - if (specpdl_size >=3D max_specpdl_size) + max_size =3D max_specpdl_size =3D 400; + if (max_size <=3D specpdl_size) signal_error ("Variable binding depth exceeds max-specpdl-size", Qnil); } - specpdl_size *=3D 2; - if (specpdl_size > max_specpdl_size) - specpdl_size =3D max_specpdl_size; - specpdl =3D (struct specbinding *) xrealloc (specpdl, specpdl_size * s= izeof (struct specbinding)); + size =3D specpdl_size < max_size / 2 ? 2 * specpdl_size : max_size; + specpdl =3D xnrealloc (specpdl, size, sizeof *specpdl); + specpdl_size =3D size; specpdl_ptr =3D specpdl + count; } =20 =3D=3D=3D modified file 'src/fileio.c' --- src/fileio.c 2011-07-19 20:33:28 +0000 +++ src/fileio.c 2011-07-19 20:37:27 +0000 @@ -2912,7 +2912,7 @@ =20 encoded_absname =3D ENCODE_FILE (absname); =20 - if (chmod (SSDATA (encoded_absname), XINT (mode)) < 0) + if (chmod (SSDATA (encoded_absname), XINT (mode) & 07777) < 0) report_file_error ("Doing chmod", Fcons (absname, Qnil)); =20 return Qnil; @@ -5114,11 +5114,11 @@ { if (stat (SSDATA (BVAR (current_buffer, filename)), &st) >=3D 0) /* But make sure we can overwrite it later! */ - auto_save_mode_bits =3D st.st_mode | 0600; + auto_save_mode_bits =3D (st.st_mode | 0600) & 0777; else if ((modes =3D Ffile_modes (BVAR (current_buffer, filename)), INTEGERP (modes))) /* Remote files don't cooperate with stat. */ - auto_save_mode_bits =3D XINT (modes) | 0600; + auto_save_mode_bits =3D (XINT (modes) | 0600) & 0777; } =20 return =3D=3D=3D modified file 'src/fns.c' --- src/fns.c 2011-07-08 00:51:25 +0000 +++ src/fns.c 2011-08-05 02:15:35 +0000 @@ -602,7 +602,7 @@ =20 prev =3D Qnil; if (STRINGP (val)) - SAFE_ALLOCA (textprops, struct textprop_rec *, sizeof (struct textpr= op_rec) * nargs); + SAFE_NALLOCA (textprops, 1, nargs); =20 for (argnum =3D 0; argnum < nargs; argnum++) { @@ -3395,11 +3395,13 @@ =20 =20 /* Value is the next integer I >=3D N, N >=3D 0 which is "almost" a prim= e - number. */ + number. A number is "almost" a prime number if it is not divisible + by any integer in the range 2 .. (NEXT_ALMOST_PRIME_LIMIT - 1). */ =20 EMACS_INT next_almost_prime (EMACS_INT n) { + verify (NEXT_ALMOST_PRIME_LIMIT =3D=3D 11); for (n |=3D 1; ; n +=3D 2) if (n % 3 !=3D 0 && n % 5 !=3D 0 && n % 7 !=3D 0) return n; @@ -3787,11 +3789,11 @@ the hash code of KEY. Value is the index of the entry in H matching KEY, or -1 if not found. */ =20 -EMACS_INT +ptrdiff_t hash_lookup (struct Lisp_Hash_Table *h, Lisp_Object key, EMACS_UINT *has= h) { EMACS_UINT hash_code; - EMACS_INT start_of_bucket; + ptrdiff_t start_of_bucket; Lisp_Object idx; =20 hash_code =3D h->hashfn (h, key); @@ -3821,11 +3823,11 @@ HASH is a previously computed hash code of KEY. Value is the index of the entry in H matching KEY. */ =20 -EMACS_INT +ptrdiff_t hash_put (struct Lisp_Hash_Table *h, Lisp_Object key, Lisp_Object value, EMACS_UINT hash) { - EMACS_INT start_of_bucket, i; + ptrdiff_t start_of_bucket, i; =20 xassert ((hash & ~INTMASK) =3D=3D 0); =20 @@ -4482,7 +4484,7 @@ (Lisp_Object key, Lisp_Object table, Lisp_Object dflt) { struct Lisp_Hash_Table *h =3D check_hash_table (table); - EMACS_INT i =3D hash_lookup (h, key, NULL); + ptrdiff_t i =3D hash_lookup (h, key, NULL); return i >=3D 0 ? HASH_VALUE (h, i) : dflt; } =20 @@ -4494,7 +4496,7 @@ (Lisp_Object key, Lisp_Object value, Lisp_Object table) { struct Lisp_Hash_Table *h =3D check_hash_table (table); - EMACS_INT i; + ptrdiff_t i; EMACS_UINT hash; =20 i =3D hash_lookup (h, key, &hash); =3D=3D=3D modified file 'src/frame.c' --- src/frame.c 2011-07-22 05:02:24 +0000 +++ src/frame.c 2011-07-29 05:31:12 +0000 @@ -160,7 +160,7 @@ if (FRAME_MINIBUF_ONLY_P (f)) return; =20 - if (INTEGERP (value)) + if (TYPE_RANGED_INTEGERP (int, value)) nlines =3D XINT (value); else nlines =3D 0; @@ -2992,7 +2992,7 @@ f->size_hint_flags &=3D ~ (XNegative | YNegative); if (EQ (left, Qminus)) f->size_hint_flags |=3D XNegative; - else if (INTEGERP (left)) + else if (TYPE_RANGED_INTEGERP (int, left)) { leftpos =3D XINT (left); if (leftpos < 0) @@ -3000,21 +3000,21 @@ } else if (CONSP (left) && EQ (XCAR (left), Qminus) && CONSP (XCDR (left)) - && INTEGERP (XCAR (XCDR (left)))) + && RANGED_INTEGERP (-INT_MAX, XCAR (XCDR (left)), INT_MAX)) { leftpos =3D - XINT (XCAR (XCDR (left))); f->size_hint_flags |=3D XNegative; } else if (CONSP (left) && EQ (XCAR (left), Qplus) && CONSP (XCDR (left)) - && INTEGERP (XCAR (XCDR (left)))) + && TYPE_RANGED_INTEGERP (int, XCAR (XCDR (left)))) { leftpos =3D XINT (XCAR (XCDR (left))); } =20 if (EQ (top, Qminus)) f->size_hint_flags |=3D YNegative; - else if (INTEGERP (top)) + else if (TYPE_RANGED_INTEGERP (int, top)) { toppos =3D XINT (top); if (toppos < 0) @@ -3022,14 +3022,14 @@ } else if (CONSP (top) && EQ (XCAR (top), Qminus) && CONSP (XCDR (top)) - && INTEGERP (XCAR (XCDR (top)))) + && RANGED_INTEGERP (-INT_MAX, XCAR (XCDR (top)), INT_MAX)) { toppos =3D - XINT (XCAR (XCDR (top))); f->size_hint_flags |=3D YNegative; } else if (CONSP (top) && EQ (XCAR (top), Qplus) && CONSP (XCDR (top)) - && INTEGERP (XCAR (XCDR (top)))) + && TYPE_RANGED_INTEGERP (int, XCAR (XCDR (top)))) { toppos =3D XINT (XCAR (XCDR (top))); } @@ -3481,7 +3481,7 @@ x_set_window_size (f, 0, FRAME_COLS (f), FRAME_LINES (f)); do_pending_window_change (0); } - else if (INTEGERP (arg) && XINT (arg) > 0 + else if (RANGED_INTEGERP (1, arg, INT_MAX) && XFASTINT (arg) !=3D FRAME_CONFIG_SCROLL_BAR_WIDTH (f)) { if (XFASTINT (arg) <=3D 2 * VERTICAL_SCROLL_BAR_WIDTH_TRIM) @@ -3520,7 +3520,7 @@ { double alpha =3D 1.0; double newval[2]; - int i, ialpha; + int i; Lisp_Object item; =20 for (i =3D 0; i < 2; i++) @@ -3544,7 +3544,7 @@ } else if (INTEGERP (item)) { - ialpha =3D XINT (item); + EMACS_INT ialpha =3D XINT (item); if (ialpha < 0 || 100 < ialpha) args_out_of_range (make_number (0), make_number (100)); else @@ -4031,11 +4031,15 @@ if (!EQ (tem0, Qunbound)) { CHECK_NUMBER (tem0); + if (! (0 <=3D XINT (tem0) && XINT (tem0) <=3D INT_MAX)) + xsignal1 (Qargs_out_of_range, tem0); FRAME_LINES (f) =3D XINT (tem0); } if (!EQ (tem1, Qunbound)) { CHECK_NUMBER (tem1); + if (! (0 <=3D XINT (tem1) && XINT (tem1) <=3D INT_MAX)) + xsignal1 (Qargs_out_of_range, tem1); SET_FRAME_COLS (f, XINT (tem1)); } if (!NILP (tem2) && !EQ (tem2, Qunbound)) @@ -4066,12 +4070,10 @@ ? tool_bar_button_relief : DEFAULT_TOOL_BAR_BUTTON_RELIEF); =20 - if (INTEGERP (Vtool_bar_button_margin) - && XINT (Vtool_bar_button_margin) > 0) + if (RANGED_INTEGERP (1, Vtool_bar_button_margin, INT_MAX)) margin =3D XFASTINT (Vtool_bar_button_margin); else if (CONSP (Vtool_bar_button_margin) - && INTEGERP (XCDR (Vtool_bar_button_margin)) - && XINT (XCDR (Vtool_bar_button_margin)) > 0) + && RANGED_INTEGERP (1, XCDR (Vtool_bar_button_margin), INT_MAX)) margin =3D XFASTINT (XCDR (Vtool_bar_button_margin)); else margin =3D 0; @@ -4097,14 +4099,14 @@ } else if (CONSP (tem0) && EQ (XCAR (tem0), Qminus) && CONSP (XCDR (tem0)) - && INTEGERP (XCAR (XCDR (tem0)))) + && RANGED_INTEGERP (-INT_MAX, XCAR (XCDR (tem0)), INT_MAX)) { f->top_pos =3D - XINT (XCAR (XCDR (tem0))); window_prompting |=3D YNegative; } else if (CONSP (tem0) && EQ (XCAR (tem0), Qplus) && CONSP (XCDR (tem0)) - && INTEGERP (XCAR (XCDR (tem0)))) + && TYPE_RANGED_INTEGERP (int, XCAR (XCDR (tem0)))) { f->top_pos =3D XINT (XCAR (XCDR (tem0))); } @@ -4125,14 +4127,14 @@ } else if (CONSP (tem1) && EQ (XCAR (tem1), Qminus) && CONSP (XCDR (tem1)) - && INTEGERP (XCAR (XCDR (tem1)))) + && RANGED_INTEGERP (-INT_MAX, XCAR (XCDR (tem1)), INT_MAX)) { f->left_pos =3D - XINT (XCAR (XCDR (tem1))); window_prompting |=3D XNegative; } else if (CONSP (tem1) && EQ (XCAR (tem1), Qplus) && CONSP (XCDR (tem1)) - && INTEGERP (XCAR (XCDR (tem1)))) + && TYPE_RANGED_INTEGERP (int, XCAR (XCDR (tem1)))) { f->left_pos =3D XINT (XCAR (XCDR (tem1))); } =3D=3D=3D modified file 'src/frame.h' --- src/frame.h 2011-06-11 21:31:32 +0000 +++ src/frame.h 2011-07-28 21:51:29 +0000 @@ -258,11 +258,11 @@ =20 /* Size of this frame, excluding fringes, scroll bars etc., in units of canonical characters. */ - EMACS_INT text_lines, text_cols; + int text_lines, text_cols; =20 /* Total size of this frame (i.e. its native window), in units of canonical characters. */ - EMACS_INT total_lines, total_cols; + int total_lines, total_cols; =20 /* New text height and width for pending size change. 0 if no change pending. */ =3D=3D=3D modified file 'src/fringe.c' --- src/fringe.c 2011-06-24 21:25:22 +0000 +++ src/fringe.c 2011-07-28 23:47:01 +0000 @@ -1610,22 +1610,25 @@ =20 if (n =3D=3D max_fringe_bitmaps) { - if ((max_fringe_bitmaps + 20) > MAX_FRINGE_BITMAPS) + int bitmaps =3D max_fringe_bitmaps + 20; + if (MAX_FRINGE_BITMAPS < bitmaps) error ("No free fringe bitmap slots"); =20 i =3D max_fringe_bitmaps; - max_fringe_bitmaps +=3D 20; fringe_bitmaps =3D ((struct fringe_bitmap **) - xrealloc (fringe_bitmaps, max_fringe_bitmaps * sizeof (struct fring= e_bitmap *))); + xrealloc (fringe_bitmaps, bitmaps * sizeof *fringe_bitmaps)); fringe_faces - =3D (Lisp_Object *) xrealloc (fringe_faces, max_fringe_bitmaps * sizeo= f (Lisp_Object)); + =3D (Lisp_Object *) xrealloc (fringe_faces, + bitmaps * sizeof *fringe_faces); =20 - for (; i < max_fringe_bitmaps; i++) + for (i =3D max_fringe_bitmaps; i < bitmaps; i++) { fringe_bitmaps[i] =3D NULL; fringe_faces[i] =3D Qnil; } + + max_fringe_bitmaps =3D bitmaps; } } =20 =3D=3D=3D modified file 'src/ftfont.c' --- src/ftfont.c 2011-06-18 18:09:17 +0000 +++ src/ftfont.c 2011-08-05 02:15:35 +0000 @@ -682,7 +682,10 @@ if (NILP (val)) continue; len =3D Flength (val); - spec->features[i] =3D malloc (sizeof (int) * XINT (len)); + spec->features[i] =3D + (min (PTRDIFF_MAX, SIZE_MAX) / sizeof (int) < XINT (len) + ? 0 + : malloc (sizeof (int) * XINT (len))); if (! spec->features[i]) { if (i > 0 && spec->features[0]) @@ -1761,15 +1764,10 @@ static void setup_otf_gstring (int size) { - if (otf_gstring.size =3D=3D 0) - { - otf_gstring.glyphs =3D (OTF_Glyph *) xmalloc (sizeof (OTF_Glyph) *= size); - otf_gstring.size =3D size; - } - else if (otf_gstring.size < size) - { - otf_gstring.glyphs =3D xrealloc (otf_gstring.glyphs, - sizeof (OTF_Glyph) * size); + if (otf_gstring.size < size) + { + otf_gstring.glyphs =3D xnrealloc (otf_gstring.glyphs, + size, sizeof (OTF_Glyph)); otf_gstring.size =3D size; } otf_gstring.used =3D size; @@ -2445,17 +2443,19 @@ } } =20 + if (INT_MAX / 2 < len) + memory_full (SIZE_MAX); + if (gstring.allocated =3D=3D 0) { - gstring.allocated =3D len * 2; gstring.glyph_size =3D sizeof (MFLTGlyph); - gstring.glyphs =3D xmalloc (sizeof (MFLTGlyph) * gstring.allocated= ); + gstring.glyphs =3D xnmalloc (len * 2, sizeof (MFLTGlyph)); + gstring.allocated =3D len * 2; } else if (gstring.allocated < len * 2) { + gstring.glyphs =3D xnrealloc (gstring.glyphs, len * 2, sizeof (MFL= TGlyph)); gstring.allocated =3D len * 2; - gstring.glyphs =3D xrealloc (gstring.glyphs, - sizeof (MFLTGlyph) * gstring.allocated); } memset (gstring.glyphs, 0, sizeof (MFLTGlyph) * len); for (i =3D 0; i < len; i++) @@ -2504,9 +2504,11 @@ int result =3D mflt_run (&gstring, 0, len, &flt_font_ft.flt_font, = flt); if (result !=3D -2) break; - gstring.allocated +=3D gstring.allocated; - gstring.glyphs =3D xrealloc (gstring.glyphs, - sizeof (MFLTGlyph) * gstring.allocated); + if (INT_MAX / 2 < gstring.allocated) + memory_full (SIZE_MAX); + gstring.glyphs =3D xnrealloc (gstring.glyphs, + gstring.allocated, 2 * sizeof (MFLTGlyph)); + gstring.allocated *=3D 2; } if (gstring.used > LGSTRING_GLYPH_LEN (lgstring)) return Qnil; =3D=3D=3D modified file 'src/gtkutil.c' --- src/gtkutil.c 2011-08-04 17:04:39 +0000 +++ src/gtkutil.c 2011-08-05 02:19:34 +0000 @@ -487,7 +487,8 @@ if (!utf8_str) { /* Probably some control characters in str. Escape them. */ - size_t nr_bad =3D 0; + ptrdiff_t len; + ptrdiff_t nr_bad =3D 0; gsize bytes_read; gsize bytes_written; unsigned char *p =3D (unsigned char *)str; @@ -511,7 +512,10 @@ } if (cp) g_free (cp); =20 - up =3D utf8_str =3D xmalloc (strlen (str) + nr_bad * 4 + 1); + len =3D strlen (str); + if ((min (PTRDIFF_MAX, SIZE_MAX) - len - 1) / 4 < nr_bad) + memory_full (SIZE_MAX); + up =3D utf8_str =3D xmalloc (len + nr_bad * 4 + 1); p =3D (unsigned char *)str; =20 while (! (cp =3D g_locale_to_utf8 ((char *)p, -1, &bytes_read, @@ -3296,8 +3300,8 @@ static struct { GtkWidget **widgets; - int max_size; - int used; + ptrdiff_t max_size; + ptrdiff_t used; } id_to_widget; =20 /* Grow this much every time we need to allocate more */ @@ -3306,17 +3310,20 @@ =20 /* Store the widget pointer W in id_to_widget and return the integer ind= ex. */ =20 -static int +static ptrdiff_t xg_store_widget_in_map (GtkWidget *w) { - int i; + ptrdiff_t i; =20 if (id_to_widget.max_size =3D=3D id_to_widget.used) { - int new_size =3D id_to_widget.max_size + ID_TO_WIDGET_INCR; + ptrdiff_t new_size; + if (TYPE_MAXIMUM (Window) - ID_TO_WIDGET_INCR < id_to_widget.max_s= ize) + memory_full (SIZE_MAX); =20 - id_to_widget.widgets =3D xrealloc (id_to_widget.widgets, - sizeof (GtkWidget *)*new_size); + new_size =3D id_to_widget.max_size + ID_TO_WIDGET_INCR; + id_to_widget.widgets =3D xnrealloc (id_to_widget.widgets, + new_size, sizeof (GtkWidget *)); =20 for (i =3D id_to_widget.max_size; i < new_size; ++i) id_to_widget.widgets[i] =3D 0; @@ -3345,7 +3352,7 @@ Called when scroll bar is destroyed. */ =20 static void -xg_remove_widget_from_map (int idx) +xg_remove_widget_from_map (ptrdiff_t idx) { if (idx < id_to_widget.max_size && id_to_widget.widgets[idx] !=3D 0) { @@ -3357,7 +3364,7 @@ /* Get the widget pointer at IDX from id_to_widget. */ =20 static GtkWidget * -xg_get_widget_from_map (int idx) +xg_get_widget_from_map (ptrdiff_t idx) { if (idx < id_to_widget.max_size && id_to_widget.widgets[idx] !=3D 0) return id_to_widget.widgets[idx]; @@ -3396,10 +3403,10 @@ /* Return the scrollbar id for X Window WID on display DPY. Return -1 if WID not in id_to_widget. */ =20 -int +ptrdiff_t xg_get_scroll_id_for_window (Display *dpy, Window wid) { - int idx; + ptrdiff_t idx; GtkWidget *w; =20 w =3D xg_win_to_widget (dpy, wid); @@ -3421,7 +3428,7 @@ static void xg_gtk_scroll_destroy (GtkWidget *widget, gpointer data) { - int id =3D (intptr_t) data; + intptr_t id =3D (intptr_t) data; xg_remove_widget_from_map (id); } =20 @@ -3496,7 +3503,7 @@ /* Remove the scroll bar represented by SCROLLBAR_ID from the frame F. = */ =20 void -xg_remove_scroll_bar (FRAME_PTR f, int scrollbar_id) +xg_remove_scroll_bar (FRAME_PTR f, ptrdiff_t scrollbar_id) { GtkWidget *w =3D xg_get_widget_from_map (scrollbar_id); if (w) @@ -3515,7 +3522,7 @@ =20 void xg_update_scrollbar_pos (FRAME_PTR f, - int scrollbar_id, + ptrdiff_t scrollbar_id, int top, int left, int width, @@ -4429,7 +4436,7 @@ int enabled_p =3D !NILP (PROP (TOOL_BAR_ITEM_ENABLED_P)); int selected_p =3D !NILP (PROP (TOOL_BAR_ITEM_SELECTED_P)); int idx; - int img_id; + ptrdiff_t img_id; int icon_size =3D 0; struct image *img =3D NULL; Lisp_Object image; =3D=3D=3D modified file 'src/gtkutil.h' --- src/gtkutil.h 2011-06-14 21:08:20 +0000 +++ src/gtkutil.h 2011-07-28 23:58:05 +0000 @@ -114,17 +114,17 @@ =20 extern int xg_have_tear_offs (void); =20 -extern int xg_get_scroll_id_for_window (Display *dpy, Window wid); +extern ptrdiff_t xg_get_scroll_id_for_window (Display *dpy, Window wid); =20 extern void xg_create_scroll_bar (FRAME_PTR f, struct scroll_bar *bar, GCallback scroll_callback, GCallback end_callback, const char *scroll_bar_name); -extern void xg_remove_scroll_bar (FRAME_PTR f, int scrollbar_id); +extern void xg_remove_scroll_bar (FRAME_PTR f, ptrdiff_t scrollbar_id); =20 extern void xg_update_scrollbar_pos (FRAME_PTR f, - int scrollbar_id, + ptrdiff_t scrollbar_id, int top, int left, int width, @@ -185,4 +185,3 @@ =20 #endif /* USE_GTK */ #endif /* GTKUTIL_H */ - =3D=3D=3D modified file 'src/image.c' --- src/image.c 2011-07-29 07:05:17 +0000 +++ src/image.c 2011-08-05 02:19:34 +0000 @@ -196,7 +196,7 @@ int x_bitmap_pixmap (FRAME_PTR f, ptrdiff_t id) { - return (int) FRAME_X_DISPLAY_INFO (f)->bitmaps[id - 1].pixmap; + return FRAME_X_DISPLAY_INFO (f)->bitmaps[id - 1].pixmap; } #endif =20 @@ -218,9 +218,9 @@ =20 if (dpyinfo->bitmaps =3D=3D NULL) { + dpyinfo->bitmaps + =3D (Bitmap_Record *) xmalloc (10 * sizeof (Bitmap_Record)); dpyinfo->bitmaps_size =3D 10; - dpyinfo->bitmaps - =3D (Bitmap_Record *) xmalloc (dpyinfo->bitmaps_size * sizeof (Bitmap_R= ecord)); dpyinfo->bitmaps_last =3D 1; return 1; } @@ -235,17 +235,18 @@ if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof (Bitmap_Record) / 2 < dpyinfo->bitmaps_size) memory_full (SIZE_MAX); - dpyinfo->bitmaps_size *=3D 2; dpyinfo->bitmaps =3D (Bitmap_Record *) xrealloc (dpyinfo->bitmaps, - dpyinfo->bitmaps_size * sizeof (Bitmap_Record)); + (dpyinfo->bitmaps_size + * (2 * sizeof (Bitmap_Record)))); + dpyinfo->bitmaps_size *=3D 2; return ++dpyinfo->bitmaps_last; } =20 /* Add one reference to the reference count of the bitmap with id ID. *= / =20 void -x_reference_bitmap (FRAME_PTR f, int id) +x_reference_bitmap (FRAME_PTR f, ptrdiff_t id) { ++FRAME_X_DISPLAY_INFO (f)->bitmaps[id - 1].refcount; } @@ -807,29 +808,30 @@ break; =20 case IMAGE_POSITIVE_INTEGER_VALUE: - if (!INTEGERP (value) || XINT (value) <=3D 0) + if (! RANGED_INTEGERP (1, value, INT_MAX)) return 0; break; =20 case IMAGE_POSITIVE_INTEGER_VALUE_OR_PAIR: - if (INTEGERP (value) && XINT (value) >=3D 0) + if (RANGED_INTEGERP (1, value, INT_MAX)) break; if (CONSP (value) - && INTEGERP (XCAR (value)) && INTEGERP (XCDR (value)) - && XINT (XCAR (value)) >=3D 0 && XINT (XCDR (value)) >=3D 0) + && RANGED_INTEGERP (1, XCAR (value), INT_MAX) + && RANGED_INTEGERP (1, XCDR (value), INT_MAX)) break; return 0; =20 case IMAGE_ASCENT_VALUE: if (SYMBOLP (value) && EQ (value, Qcenter)) break; - else if (INTEGERP (value) - && XINT (value) >=3D 0 - && XINT (value) <=3D 100) + else if (RANGED_INTEGERP (0, value, 100)) break; return 0; =20 case IMAGE_NON_NEGATIVE_INTEGER_VALUE: + /* Unlike the other integer-related cases, this one does not + verify that VALUE fits in 'int'. This is because callers + want EMACS_INT. */ if (!INTEGERP (value) || XINT (value) < 0) return 0; break; @@ -849,7 +851,7 @@ break; =20 case IMAGE_INTEGER_VALUE: - if (!INTEGERP (value)) + if (! TYPE_RANGED_INTEGERP (int, value)) return 0; break; =20 @@ -919,7 +921,7 @@ if (valid_image_p (spec)) { struct frame *f =3D check_x_frame (frame); - int id =3D lookup_image (f, spec); + ptrdiff_t id =3D lookup_image (f, spec); struct image *img =3D IMAGE_FROM_ID (f, id); int width =3D img->width + 2 * img->hmargin; int height =3D img->height + 2 * img->vmargin; @@ -949,7 +951,7 @@ if (valid_image_p (spec)) { struct frame *f =3D check_x_frame (frame); - int id =3D lookup_image (f, spec); + ptrdiff_t id =3D lookup_image (f, spec); struct image *img =3D IMAGE_FROM_ID (f, id); if (img->mask) mask =3D Qt; @@ -972,7 +974,7 @@ if (valid_image_p (spec)) { struct frame *f =3D check_x_frame (frame); - int id =3D lookup_image (f, spec); + ptrdiff_t id =3D lookup_image (f, spec); struct image *img =3D IMAGE_FROM_ID (f, id); ext =3D img->lisp_data; } @@ -1125,7 +1127,7 @@ ascent =3D height / 2; } else - ascent =3D (int) (height * img->ascent / 100.0); + ascent =3D height * (img->ascent / 100.0); =20 return ascent; } @@ -1371,11 +1373,12 @@ { /* This isn't called frequently so we get away with simply reallocating the color vector to the needed size, here. */ - ++img->ncolors; + ptrdiff_t ncolors =3D img->ncolors + 1; img->colors =3D (unsigned long *) xrealloc (img->colors, - img->ncolors * sizeof *img->colors); - img->colors[img->ncolors - 1] =3D color.pixel; + ncolors * sizeof *img->colors); + img->colors[ncolors - 1] =3D color.pixel; + img->ncolors =3D ncolors; result =3D color.pixel; } else @@ -1403,8 +1406,9 @@ int size; =20 memset (c, 0, sizeof *c); - c->size =3D 50; - c->images =3D (struct image **) xmalloc (c->size * sizeof *c->images); + size =3D 50; + c->images =3D (struct image **) xmalloc (size * sizeof *c->images); + c->size =3D size; size =3D IMAGE_CACHE_BUCKETS_SIZE * sizeof *c->buckets; c->buckets =3D (struct image **) xmalloc (size); memset (c->buckets, 0, size); @@ -1470,7 +1474,7 @@ struct image_cache *c =3D FRAME_IMAGE_CACHE (f); if (c) { - int i; + ptrdiff_t i; =20 /* Cache should not be referenced by any frame when freed. */ xassert (c->refcount =3D=3D 0); @@ -1500,7 +1504,7 @@ =20 if (c) { - int i, nfreed =3D 0; + ptrdiff_t i, nfreed =3D 0; =20 /* Block input so that we won't be interrupted by a SIGIO while being in an inconsistent state. */ @@ -1524,8 +1528,8 @@ { /* Free cache based on timestamp. */ EMACS_TIME t; - time_t old; - int delay, nimages =3D 0; + double old, delay; + ptrdiff_t nimages =3D 0; =20 for (i =3D 0; i < c->used; ++i) if (c->images[i]) @@ -1533,9 +1537,10 @@ =20 /* If the number of cached images has grown unusually large, decrease the cache eviction delay (Bug#6230). */ - delay =3D XFASTINT (Vimage_cache_eviction_delay); + delay =3D XINT (Vimage_cache_eviction_delay); if (nimages > 40) - delay =3D max (1, 1600 * delay / (nimages*nimages)); + delay =3D 1600 * delay / nimages / nimages; + delay =3D max (delay, 1); =20 EMACS_GET_TIME (t); old =3D EMACS_SECS (t) - delay; @@ -1711,7 +1716,7 @@ /* Return the id of image with Lisp specification SPEC on frame F. SPEC must be a valid Lisp image specification (see valid_image_p). *= / =20 -int +ptrdiff_t lookup_image (struct frame *f, Lisp_Object spec) { struct image *img; @@ -1770,15 +1775,12 @@ img->ascent =3D CENTERED_IMAGE_ASCENT; =20 margin =3D image_spec_value (spec, QCmargin, NULL); - if (INTEGERP (margin) && XINT (margin) >=3D 0) + if (INTEGERP (margin)) img->vmargin =3D img->hmargin =3D XFASTINT (margin); - else if (CONSP (margin) && INTEGERP (XCAR (margin)) - && INTEGERP (XCDR (margin))) + else if (CONSP (margin)) { - if (XINT (XCAR (margin)) > 0) - img->hmargin =3D XFASTINT (XCAR (margin)); - if (XINT (XCDR (margin)) > 0) - img->vmargin =3D XFASTINT (XCDR (margin)); + img->hmargin =3D XFASTINT (XCAR (margin)); + img->vmargin =3D XFASTINT (XCDR (margin)); } =20 relief =3D image_spec_value (spec, QCrelief, NULL); @@ -1825,7 +1827,7 @@ cache_image (struct frame *f, struct image *img) { struct image_cache *c =3D FRAME_IMAGE_CACHE (f); - int i; + ptrdiff_t i; =20 /* Find a free slot in c->images. */ for (i =3D 0; i < c->used; ++i) @@ -1837,9 +1839,10 @@ { if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof *c->images / 2 < c->size) memory_full (SIZE_MAX); + c->images =3D + (struct image **) xrealloc (c->images, + c->size * (2 * sizeof *c->images)); c->size *=3D 2; - c->images =3D (struct image **) xrealloc (c->images, - c->size * sizeof *c->images); } =20 /* Add IMG to c->images, and assign IMG an id. */ @@ -1879,7 +1882,7 @@ { if (c) { - int i; + ptrdiff_t i; for (i =3D 0; i < c->used; ++i) if (c->images[i]) mark_image (c->images[i]); @@ -2076,7 +2079,7 @@ DWORD err =3D GetLastError (); Lisp_Object errcode; /* All system errors are < 10000, so the following is safe. */ - XSETINT (errcode, (int) err); + XSETINT (errcode, err); image_error ("Unable to create bitmap, error code %d", errcode, Qn= il); x_destroy_x_image (*ximg); return 0; @@ -2355,7 +2358,7 @@ else { Lisp_Object data; - EMACS_INT width, height; + int width, height; =20 /* Entries for `:width', `:height' and `:data' must be present. *= / if (!kw[XBM_WIDTH].count @@ -3587,9 +3590,8 @@ #endif /* HAVE_NTGUI */ =20 /* Remember allocated colors. */ + img->colors =3D xnmalloc (attrs.nalloc_pixels, sizeof *img->colors= ); img->ncolors =3D attrs.nalloc_pixels; - img->colors =3D (unsigned long *) xmalloc (img->ncolors - * sizeof *img->colors); for (i =3D 0; i < attrs.nalloc_pixels; ++i) { img->colors[i] =3D attrs.alloc_pixels[i]; @@ -3813,8 +3815,8 @@ int chars_len) { struct Lisp_Hash_Table *table =3D XHASH_TABLE (color_table); - int i =3D hash_lookup (table, make_unibyte_string (chars_start, chars_= len), - NULL); + ptrdiff_t i =3D + hash_lookup (table, make_unibyte_string (chars_start, chars_len), NU= LL); =20 return i >=3D 0 ? HASH_VALUE (table, i) : Qnil; } @@ -4163,6 +4165,12 @@ /* Number of entries in the color table. */ =20 static int ct_colors_allocated; +enum +{ + ct_colors_allocated_max =3D + min (INT_MAX, + min (PTRDIFF_MAX, SIZE_MAX) / sizeof (unsigned long)) +}; =20 /* Initialize the color table. */ =20 @@ -4249,7 +4257,14 @@ XColor color; Colormap cmap; int rc; - +#else + COLORREF color; +#endif + + if (ct_colors_allocated_max <=3D ct_colors_allocated) + return FRAME_FOREGROUND_PIXEL (f); + +#ifdef HAVE_X_WINDOWS color.red =3D r; color.green =3D g; color.blue =3D b; @@ -4271,7 +4286,6 @@ return FRAME_FOREGROUND_PIXEL (f); =20 #else - COLORREF color; #ifdef HAVE_NTGUI color =3D PALETTERGB (r, g, b); #else @@ -4312,6 +4326,9 @@ Colormap cmap; int rc; =20 + if (ct_colors_allocated_max <=3D ct_colors_allocated) + return FRAME_FOREGROUND_PIXEL (f); + #ifdef HAVE_X_WINDOWS cmap =3D FRAME_X_COLORMAP (f); color.pixel =3D pixel; @@ -4450,7 +4467,9 @@ HGDIOBJ prev; #endif /* HAVE_NTGUI */ =20 - colors =3D (XColor *) xmalloc (img->width * img->height * sizeof *colo= rs); + if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof *colors / img->width < img->h= eight) + memory_full (SIZE_MAX); + colors =3D (XColor *) xmalloc (sizeof *colors * img->width * img->heig= ht); =20 #ifndef HAVE_NTGUI /* Get the X image IMG->pixmap. */ @@ -4602,7 +4621,9 @@ =20 #define COLOR(A, X, Y) ((A) + (Y) * img->width + (X)) =20 - new =3D (XColor *) xmalloc (img->width * img->height * sizeof *new); + if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof *new / img->width < img->heig= ht) + memory_full (SIZE_MAX); + new =3D (XColor *) xmalloc (sizeof *new * img->width * img->height); =20 for (y =3D 0; y < img->height; ++y) { @@ -5880,7 +5901,7 @@ =20 for (x =3D 0; x < width; ++x) { - unsigned r, g, b; + int r, g, b; =20 r =3D *p++ << 8; g =3D *p++ << 8; @@ -6745,17 +6766,29 @@ } =20 =20 +static void tiff_handler (const char *, const char *, const char *, va_l= ist) + ATTRIBUTE_FORMAT_PRINTF (3, 0); +static void +tiff_handler (const char *log_format, const char *title, + const char *format, va_list ap) +{ + /* doprnt is not suitable here, as TIFF handlers are called from + libtiff and are passed arbitrary printf directives. Instead, use + vsnprintf, taking care to be portable to nonstandard environments + where vsnprintf returns -1 on buffer overflow. Since it's just a + log entry, it's OK to truncate it. */ + char buf[4000]; + int len =3D vsnprintf (buf, sizeof buf, format, ap); + add_to_log (log_format, build_string (title), + make_string (buf, max (0, min (len, sizeof buf - 1)))); +} + static void tiff_error_handler (const char *, const char *, va_list) ATTRIBUTE_FORMAT_PRINTF (2, 0); static void tiff_error_handler (const char *title, const char *format, va_list ap) { - char buf[512]; - int len; - - len =3D sprintf (buf, "TIFF error: %s ", title); - vsprintf (buf + len, format, ap); - add_to_log (buf, Qnil, Qnil); + tiff_handler ("TIFF error: %s %s", title, format, ap); } =20 =20 @@ -6764,12 +6797,7 @@ static void tiff_warning_handler (const char *title, const char *format, va_list ap) { - char buf[512]; - int len; - - len =3D sprintf (buf, "TIFF warning: %s ", title); - vsprintf (buf + len, format, ap); - add_to_log (buf, Qnil, Qnil); + tiff_handler ("TIFF warning: %s %s", title, format, ap); } =20 =20 @@ -6845,8 +6873,9 @@ image =3D image_spec_value (img->spec, QCindex, NULL); if (INTEGERP (image)) { - int ino =3D XFASTINT (image); - if (!fn_TIFFSetDirectory (tiff, ino)) + EMACS_INT ino =3D XFASTINT (image); + if (! (TYPE_MINIMUM (tdir_t) <=3D ino && ino <=3D TYPE_MAXIMUM (td= ir_t) + && fn_TIFFSetDirectory (tiff, ino))) { image_error ("Invalid image number `%s' in image `%s'", image, img->spec); @@ -7145,7 +7174,7 @@ Lisp_Object specified_file =3D image_spec_value (img->spec, QCfile, NU= LL); Lisp_Object specified_data =3D image_spec_value (img->spec, QCdata, NU= LL); unsigned long bgcolor =3D 0; - int idx; + EMACS_INT idx; =20 if (NILP (specified_data)) { @@ -7375,7 +7404,7 @@ img->lisp_data =3D Qnil; if (gif->SavedImages[idx].ExtensionBlockCount > 0) { - unsigned int delay =3D 0; + int delay =3D 0; ExtensionBlock *ext =3D gif->SavedImages[idx].ExtensionBlocks; for (i =3D 0; i < gif->SavedImages[idx].ExtensionBlockCount; i++, = ext++) /* Append (... FUNCTION "BYTES") */ @@ -7396,7 +7425,7 @@ if (delay) img->lisp_data =3D Fcons (Qdelay, - Fcons (make_float (((double) delay) * 0.01), + Fcons (make_float (delay / 100.0), img->lisp_data)); } =20 @@ -7572,10 +7601,10 @@ Lisp_Object image; Lisp_Object value; Lisp_Object crop; - long ino; + EMACS_INT ino; int desired_width, desired_height; double rotation; - int imagemagick_rendermethod; + EMACS_INT imagemagick_rendermethod; int pixelwidth; ImageInfo *image_info; ExceptionInfo *exception; @@ -7602,7 +7631,7 @@ status =3D MagickPingImageBlob (ping_wand, contents, size); } =20 - if (ino >=3D MagickGetNumberImages (ping_wand)) + if (! (0 <=3D ino && ino < MagickGetNumberImages (ping_wand))) { image_error ("Invalid image number `%s' in image `%s'", image, img->spec); @@ -7677,28 +7706,28 @@ efficient. */ crop =3D image_spec_value (img->spec, QCcrop, NULL); =20 - if (CONSP (crop) && INTEGERP (XCAR (crop))) + if (CONSP (crop) && TYPE_RANGED_INTEGERP (size_t, XCAR (crop))) { /* After some testing, it seems MagickCropImage is the fastest cro= p function in ImageMagick. This crop function seems to do less c= opying than the alternatives, but it still reads the entire image into= memory - before croping, which is aparently difficult to avoid when usin= g + before cropping, which is apparently difficult to avoid when us= ing imagemagick. */ - int w, h; - w =3D XFASTINT (XCAR (crop)); + size_t crop_width =3D XINT (XCAR (crop)); crop =3D XCDR (crop); - if (CONSP (crop) && INTEGERP (XCAR (crop))) + if (CONSP (crop) && TYPE_RANGED_INTEGERP (size_t, XCAR (crop))) { - h =3D XFASTINT (XCAR (crop)); + size_t crop_height =3D XINT (XCAR (crop)); crop =3D XCDR (crop); - if (CONSP (crop) && INTEGERP (XCAR (crop))) + if (CONSP (crop) && TYPE_RANGED_INTEGERP (ssize_t, XCAR (crop))) { - x =3D XFASTINT (XCAR (crop)); + ssize_t crop_x =3D XINT (XCAR (crop)); crop =3D XCDR (crop); - if (CONSP (crop) && INTEGERP (XCAR (crop))) + if (CONSP (crop) && TYPE_RANGED_INTEGERP (ssize_t, XCAR (crop))) { - y =3D XFASTINT (XCAR (crop)); - MagickCropImage (image_wand, w, h, x, y); + ssize_t crop_y =3D XINT (XCAR (crop)); + MagickCropImage (image_wand, crop_width, crop_height, + crop_x, crop_y); } } } @@ -7744,9 +7773,11 @@ =20 init_color_table (); imagemagick_rendermethod =3D (INTEGERP (Vimagemagick_render_type) - ? XFASTINT (Vimagemagick_render_type) : 0)= ; + ? XINT (Vimagemagick_render_type) : 0); if (imagemagick_rendermethod =3D=3D 0) { + size_t image_height; + /* Try to create a x pixmap to hold the imagemagick pixmap. */ if (!x_create_x_image_and_pixmap (f, width, height, 0, &ximg, &img->pixmap)) @@ -7775,7 +7806,8 @@ goto imagemagick_error; } =20 - for (y =3D 0; y < (long) MagickGetImageHeight (image_wand); y++) + image_height =3D MagickGetImageHeight (image_wand); + for (y =3D 0; y < image_height; y++) { pixels =3D PixelGetNextIteratorRow (iterator, &width); if (pixels =3D=3D (PixelWand **) NULL) @@ -8281,10 +8313,10 @@ { for (x =3D 0; x < width; ++x) { - unsigned red; - unsigned green; - unsigned blue; - unsigned opacity; + int red; + int green; + int blue; + int opacity; =20 red =3D *pixels++; green =3D *pixels++; @@ -8465,7 +8497,8 @@ static int gs_load (struct frame *f, struct image *img) { - char buffer[100]; + uprintmax_t printnum1, printnum2; + char buffer[sizeof " " + INT_STRLEN_BOUND (printmax_t)]; Lisp_Object window_and_pixmap_id =3D Qnil, loader, pt_height, pt_width= ; Lisp_Object frame; double in_width, in_height; @@ -8477,16 +8510,19 @@ info. */ pt_width =3D image_spec_value (img->spec, QCpt_width, NULL); in_width =3D INTEGERP (pt_width) ? XFASTINT (pt_width) / 72.0 : 0; - img->width =3D in_width * FRAME_X_DISPLAY_INFO (f)->resx; + in_width *=3D FRAME_X_DISPLAY_INFO (f)->resx; pt_height =3D image_spec_value (img->spec, QCpt_height, NULL); in_height =3D INTEGERP (pt_height) ? XFASTINT (pt_height) / 72.0 : 0; - img->height =3D in_height * FRAME_X_DISPLAY_INFO (f)->resy; + in_height *=3D FRAME_X_DISPLAY_INFO (f)->resy; =20 - if (!check_image_size (f, img->width, img->height)) + if (! (in_width <=3D INT_MAX && in_height <=3D INT_MAX + && check_image_size (f, in_width, in_height))) { image_error ("Invalid image size (see `max-image-size')", Qnil, Qn= il); return 0; } + img->width =3D in_width; + img->height =3D in_height; =20 /* Create the pixmap. */ xassert (img->pixmap =3D=3D NO_PIXMAP); @@ -8511,14 +8547,14 @@ if successful. We do not record_unwind_protect here because other places in redisplay like calling window scroll functions don't either. Let the Lisp loader use `unwind-protect' instead. *= / - sprintf (buffer, "%lu %lu", - (unsigned long) FRAME_X_WINDOW (f), - (unsigned long) img->pixmap); + printnum1 =3D FRAME_X_WINDOW (f); + printnum2 =3D img->pixmap; + sprintf (buffer, "%"pMu" %"pMu, printnum1, printnum2); window_and_pixmap_id =3D build_string (buffer); =20 - sprintf (buffer, "%lu %lu", - FRAME_FOREGROUND_PIXEL (f), - FRAME_BACKGROUND_PIXEL (f)); + printnum1 =3D FRAME_FOREGROUND_PIXEL (f); + printnum2 =3D FRAME_BACKGROUND_PIXEL (f); + sprintf (buffer, "%"pMu" %"pMu, printnum1, printnum2); pixel_colors =3D build_string (buffer); =20 XSETFRAME (frame, f); @@ -8543,7 +8579,8 @@ x_kill_gs_process (Pixmap pixmap, struct frame *f) { struct image_cache *c =3D FRAME_IMAGE_CACHE (f); - int class, i; + int class; + ptrdiff_t i; struct image *img; =20 /* Find the image containing PIXMAP. */ @@ -8647,7 +8684,7 @@ DEFUN ("lookup-image", Flookup_image, Slookup_image, 1, 1, 0, "") (Lisp_Object spec) { - int id =3D -1; + ptrdiff_t id =3D -1; =20 if (valid_image_p (spec)) id =3D lookup_image (SELECTED_FRAME (), spec); =3D=3D=3D modified file 'src/indent.c' --- src/indent.c 2011-07-14 21:35:23 +0000 +++ src/indent.c 2011-08-05 02:15:35 +0000 @@ -284,7 +284,7 @@ else \ { \ if (dp !=3D 0 && VECTORP (DISP_CHAR_VECTOR (dp, ch))) \ - width =3D ASIZE (DISP_CHAR_VECTOR (dp, ch)); \ + width =3D sanitize_char_width (ASIZE (DISP_CHAR_VECTOR (dp, ch))); \ else \ width =3D CHAR_WIDTH (ch); \ } \ @@ -318,15 +318,6 @@ last_known_column_point =3D 0; } =20 -/* Return a non-outlandish value for the tab width. */ - -static int -sane_tab_width (void) -{ - EMACS_INT n =3D XFASTINT (BVAR (current_buffer, tab_width)); - return 0 < n && n <=3D 1000 ? n : 8; -} - EMACS_INT current_column (void) { @@ -335,7 +326,7 @@ register int tab_seen; EMACS_INT post_tab; register int c; - int tab_width =3D sane_tab_width (); + int tab_width =3D SANE_TAB_WIDTH (current_buffer); int ctl_arrow =3D !NILP (BVAR (current_buffer, ctl_arrow)); register struct Lisp_Char_Table *dp =3D buffer_display_table (); =20 @@ -515,7 +506,7 @@ static void scan_for_column (EMACS_INT *endpos, EMACS_INT *goalcol, EMACS_INT *prevc= ol) { - int tab_width =3D sane_tab_width (); + int tab_width =3D SANE_TAB_WIDTH (current_buffer); register int ctl_arrow =3D !NILP (BVAR (current_buffer, ctl_arrow)); register struct Lisp_Char_Table *dp =3D buffer_display_table (); int multibyte =3D !NILP (BVAR (current_buffer, enable_multibyte_charac= ters)); @@ -732,7 +723,7 @@ register int tab_seen; int post_tab; register int c; - int tab_width =3D sane_tab_width (); + int tab_width =3D SANE_TAB_WIDTH (current_buffer); int ctl_arrow =3D !NILP (current_buffer->ctl_arrow); register struct Lisp_Char_Table *dp =3D buffer_display_table (); int b, e; @@ -808,7 +799,7 @@ { EMACS_INT mincol; register EMACS_INT fromcol; - int tab_width =3D sane_tab_width (); + int tab_width =3D SANE_TAB_WIDTH (current_buffer); =20 CHECK_NUMBER (column); if (NILP (minimum)) @@ -867,7 +858,7 @@ position_indentation (register int pos_byte) { register EMACS_INT column =3D 0; - int tab_width =3D sane_tab_width (); + int tab_width =3D SANE_TAB_WIDTH (current_buffer); register unsigned char *p; register unsigned char *stop; unsigned char *start; @@ -1116,7 +1107,7 @@ register EMACS_INT pos; EMACS_INT pos_byte; register int c =3D 0; - int tab_width =3D sane_tab_width (); + int tab_width =3D SANE_TAB_WIDTH (current_buffer); register int ctl_arrow =3D !NILP (BVAR (current_buffer, ctl_arrow)); register struct Lisp_Char_Table *dp =3D window_display_table (win); EMACS_INT selective @@ -1432,7 +1423,7 @@ the text character-by-character. */ if (current_buffer->width_run_cache && pos >=3D next_width_run) { - EMACS_INT run_end; + ptrdiff_t run_end; int common_width =3D region_cache_forward (current_buffer, current_buffer->width_run_cache, =3D=3D=3D modified file 'src/keyboard.c' --- src/keyboard.c 2011-08-04 17:04:39 +0000 +++ src/keyboard.c 2011-08-05 02:19:34 +0000 @@ -435,16 +435,16 @@ static int read_avail_input (int); static void get_input_pending (int *, int); static int readable_events (int); -static Lisp_Object read_char_x_menu_prompt (int, Lisp_Object *, +static Lisp_Object read_char_x_menu_prompt (ptrdiff_t, Lisp_Object *, Lisp_Object, int *); -static Lisp_Object read_char_minibuf_menu_prompt (int, int, +static Lisp_Object read_char_minibuf_menu_prompt (int, ptrdiff_t, Lisp_Object *); static Lisp_Object make_lispy_event (struct input_event *); #if defined (HAVE_MOUSE) || defined (HAVE_GPM) static Lisp_Object make_lispy_movement (struct frame *, Lisp_Object, enum scroll_bar_part, Lisp_Object, Lisp_Object, - unsigned long); + Time); #endif static Lisp_Object modify_event_symbol (EMACS_INT, unsigned, Lisp_Object= , Lisp_Object, const char *const *= , @@ -1300,7 +1300,7 @@ /* This is the actual command reading loop, sans error-handling encapsulation. */ =20 -static int read_key_sequence (Lisp_Object *, size_t, Lisp_Object, +static int read_key_sequence (Lisp_Object *, int, Lisp_Object, int, int, int); void safe_run_hooks (Lisp_Object); static void adjust_point_for_property (EMACS_INT, int); @@ -2267,7 +2267,8 @@ Value is t if we showed a menu and the user rejected it. */ =20 Lisp_Object -read_char (int commandflag, int nmaps, Lisp_Object *maps, Lisp_Object pr= ev_event, +read_char (int commandflag, ptrdiff_t nmaps, Lisp_Object *maps, + Lisp_Object prev_event, int *used_mouse_menu, struct timeval *end_time) { volatile Lisp_Object c; @@ -7405,7 +7406,7 @@ { /* The number of keymaps we're scanning right now, and the number of keymaps we have allocated space for. */ - int nmaps; + ptrdiff_t nmaps; =20 /* maps[0..nmaps-1] are the prefix definitions of KEYBUF[0..t-1] in the current keymaps, or nil where it is not a prefix. */ @@ -7413,7 +7414,7 @@ =20 Lisp_Object def, tail; =20 - int mapno; + ptrdiff_t mapno; Lisp_Object oquit; =20 /* In order to build the menus, we need to call the keymap @@ -7458,7 +7459,7 @@ recognized when the menu-bar (or mode-line) is updated, which does not normally happen after every command. */ Lisp_Object tem; - int nminor; + ptrdiff_t nminor; nminor =3D current_minor_maps (NULL, &tmaps); maps =3D (Lisp_Object *) alloca ((nminor + 3) * sizeof (maps[0])); nmaps =3D 0; @@ -7962,7 +7963,7 @@ tool_bar_items (Lisp_Object reuse, int *nitems) { Lisp_Object *maps; - int nmaps, i; + ptrdiff_t nmaps, i; Lisp_Object oquit; Lisp_Object *tmaps; =20 @@ -8002,7 +8003,7 @@ recognized when the tool-bar (or mode-line) is updated, which does not normally happen after every command. */ Lisp_Object tem; - int nminor; + ptrdiff_t nminor; nminor =3D current_minor_maps (NULL, &tmaps); maps =3D (Lisp_Object *) alloca ((nminor + 3) * sizeof (maps[0])); nmaps =3D 0; @@ -8274,10 +8275,11 @@ Lisp_Object tcapt =3D PROP (TOOL_BAR_ITEM_CAPTION); const char *label =3D SYMBOLP (tkey) ? SSDATA (SYMBOL_NAME (tkey))= : ""; const char *capt =3D STRINGP (tcapt) ? SSDATA (tcapt) : ""; - EMACS_INT max_lbl =3D 2 * tool_bar_max_label_size; + ptrdiff_t max_lbl =3D + 2 * max (0, min (tool_bar_max_label_size, STRING_BYTES_BOUND / 2)); char *buf =3D (char *) xmalloc (max_lbl + 1); Lisp_Object new_lbl; - size_t caption_len =3D strlen (capt); + ptrdiff_t caption_len =3D strlen (capt); =20 if (caption_len <=3D max_lbl && capt[0] !=3D '\0') { @@ -8290,7 +8292,7 @@ =20 if (strlen (label) <=3D max_lbl && label[0] !=3D '\0') { - int j; + ptrdiff_t j; if (label !=3D buf) strcpy (buf, label); =20 @@ -8399,10 +8401,10 @@ and do auto-saving in the inner call of read_char. */ =20 static Lisp_Object -read_char_x_menu_prompt (int nmaps, Lisp_Object *maps, Lisp_Object prev_= event, - int *used_mouse_menu) +read_char_x_menu_prompt (ptrdiff_t nmaps, Lisp_Object *maps, + Lisp_Object prev_event, int *used_mouse_menu) { - int mapno; + ptrdiff_t mapno; =20 if (used_mouse_menu) *used_mouse_menu =3D 0; @@ -8430,7 +8432,7 @@ Lisp_Object *realmaps =3D (Lisp_Object *) alloca (nmaps * sizeof (Lisp_Object)); Lisp_Object value; - int nmaps1 =3D 0; + ptrdiff_t nmaps1 =3D 0; =20 /* Use the maps that are not nil. */ for (mapno =3D 0; mapno < nmaps; mapno++) @@ -8481,17 +8483,18 @@ We make this bigger when necessary, and never free it. */ static char *read_char_minibuf_menu_text; /* Size of that buffer. */ -static int read_char_minibuf_menu_width; +static ptrdiff_t read_char_minibuf_menu_width; =20 static Lisp_Object -read_char_minibuf_menu_prompt (int commandflag, int nmaps, Lisp_Object *= maps) +read_char_minibuf_menu_prompt (int commandflag, + ptrdiff_t nmaps, Lisp_Object *maps) { - int mapno; + ptrdiff_t mapno; register Lisp_Object name; - int nlength; + ptrdiff_t nlength; /* FIXME: Use the minibuffer's frame width. */ - int width =3D FRAME_COLS (SELECTED_FRAME ()) - 4; - int idx =3D -1; + ptrdiff_t width =3D FRAME_COLS (SELECTED_FRAME ()) - 4; + ptrdiff_t idx =3D -1; int nobindings =3D 1; Lisp_Object rest, vector; char *menu; @@ -8516,16 +8519,13 @@ =20 /* Make sure we have a big enough buffer for the menu text. */ width =3D max (width, SBYTES (name)); - if (read_char_minibuf_menu_text =3D=3D 0) - { - read_char_minibuf_menu_width =3D width + 4; - read_char_minibuf_menu_text =3D (char *) xmalloc (width + 4); - } - else if (width + 4 > read_char_minibuf_menu_width) - { - read_char_minibuf_menu_width =3D width + 4; + if (STRING_BYTES_BOUND - 4 < width) + memory_full (SIZE_MAX); + if (width + 4 > read_char_minibuf_menu_width) + { read_char_minibuf_menu_text =3D (char *) xrealloc (read_char_minibuf_menu_text, width + 4); + read_char_minibuf_menu_width =3D width + 4; } menu =3D read_char_minibuf_menu_text; =20 @@ -8544,7 +8544,7 @@ while (1) { int notfirst =3D 0; - int i =3D nlength; + ptrdiff_t i =3D nlength; Lisp_Object obj; Lisp_Object orig_defn_macro; =20 @@ -8643,7 +8643,7 @@ < width || !notfirst) { - int thiswidth; + ptrdiff_t thiswidth; =20 /* Punctuate between strings. */ if (notfirst) @@ -8659,9 +8659,7 @@ if (! char_matches) { /* Add as much of string as fits. */ - thiswidth =3D SCHARS (desc); - if (thiswidth + i > width) - thiswidth =3D width - i; + thiswidth =3D min (SCHARS (desc), width - i); memcpy (menu + i, SDATA (desc), thiswidth); i +=3D thiswidth; strcpy (menu + i, " =3D "); @@ -8669,9 +8667,7 @@ } =20 /* Add as much of string as fits. */ - thiswidth =3D SCHARS (s); - if (thiswidth + i > width) - thiswidth =3D width - i; + thiswidth =3D min (SCHARS (s), width - i); memcpy (menu + i, SDATA (s), thiswidth); i +=3D thiswidth; menu[i] =3D 0; @@ -8746,10 +8742,10 @@ NEXT may be the same array as CURRENT. */ =20 static int -follow_key (Lisp_Object key, int nmaps, Lisp_Object *current, Lisp_Objec= t *defs, - Lisp_Object *next) +follow_key (Lisp_Object key, ptrdiff_t nmaps, Lisp_Object *current, + Lisp_Object *defs, Lisp_Object *next) { - int i, first_binding; + ptrdiff_t i, first_binding; =20 first_binding =3D nmaps; for (i =3D nmaps - 1; i >=3D 0; i--) @@ -8849,7 +8845,7 @@ The return value is non-zero if the remapping actually took place. *= / =20 static int -keyremap_step (Lisp_Object *keybuf, size_t bufsize, volatile keyremap *f= key, +keyremap_step (Lisp_Object *keybuf, int bufsize, volatile keyremap *fkey= , int input, int doit, int *diff, Lisp_Object prompt) { Lisp_Object next, key; @@ -8871,7 +8867,7 @@ =20 *diff =3D len - (fkey->end - fkey->start); =20 - if (input + *diff >=3D bufsize) + if (bufsize - input <=3D *diff) error ("Key sequence too long"); =20 /* Shift the keys that follow fkey->end. */ @@ -8942,7 +8938,7 @@ from the selected window's buffer. */ =20 static int -read_key_sequence (Lisp_Object *keybuf, size_t bufsize, Lisp_Object prom= pt, +read_key_sequence (Lisp_Object *keybuf, int bufsize, Lisp_Object prompt, int dont_downcase_last, int can_return_switch_frame, int fix_current_buffer) { @@ -8959,8 +8955,8 @@ =20 /* The number of keymaps we're scanning right now, and the number of keymaps we have allocated space for. */ - int nmaps; - int nmaps_allocated =3D 0; + ptrdiff_t nmaps; + ptrdiff_t nmaps_allocated =3D 0; =20 /* defs[0..nmaps-1] are the definitions of KEYBUF[0..t-1] in the current keymaps. */ @@ -8984,7 +8980,7 @@ /* The index in submaps[] of the first keymap that has a binding for this key sequence. In other words, the lowest i such that submaps[i] is non-nil. */ - int first_binding; + ptrdiff_t first_binding; /* Index of the first key that has no binding. It is useless to try fkey.start larger than that. */ int first_unbound; @@ -9145,8 +9141,8 @@ } else { - int nminor; - int total; + ptrdiff_t nminor; + ptrdiff_t total; Lisp_Object *maps; =20 nminor =3D current_minor_maps (0, &maps); @@ -9212,7 +9208,8 @@ echo_local_start and keys_local_start allow us to throw away just one key. */ int echo_local_start IF_LINT (=3D 0); - int keys_local_start, local_first_binding; + int keys_local_start; + ptrdiff_t local_first_binding; =20 eassert (indec.end =3D=3D t || (indec.end > t && indec.end <=3D mo= ck_input)); eassert (indec.start <=3D indec.end); @@ -9549,7 +9546,7 @@ && (NILP (fake_prefixed_keys) || NILP (Fmemq (key, fake_prefixed_keys)))) { - if (t + 1 >=3D bufsize) + if (bufsize - t <=3D 1) error ("Key sequence too long"); =20 keybuf[t] =3D posn; @@ -9630,7 +9627,7 @@ insert the dummy prefix event `menu-bar'. */ if (EQ (posn, Qmenu_bar) || EQ (posn, Qtool_bar)) { - if (t + 1 >=3D bufsize) + if (bufsize - t <=3D 1) error ("Key sequence too long"); keybuf[t] =3D posn; keybuf[t+1] =3D key; =3D=3D=3D modified file 'src/keyboard.h' --- src/keyboard.h 2011-07-07 17:55:38 +0000 +++ src/keyboard.h 2011-07-29 00:30:00 +0000 @@ -440,7 +440,7 @@ =20 extern Lisp_Object parse_modifiers (Lisp_Object); extern Lisp_Object reorder_modifiers (Lisp_Object); -extern Lisp_Object read_char (int, int, Lisp_Object *, Lisp_Object, +extern Lisp_Object read_char (int, ptrdiff_t, Lisp_Object *, Lisp_Object= , int *, EMACS_TIME *); extern int parse_solitary_modifier (Lisp_Object symbol); =20 =3D=3D=3D modified file 'src/keymap.c' --- src/keymap.c 2011-08-03 21:40:06 +0000 +++ src/keymap.c 2011-08-05 02:19:34 +0000 @@ -1399,7 +1399,7 @@ some systems, static gets macro-defined to be the empty string. Ickypoo. */ static Lisp_Object *cmm_modes =3D NULL, *cmm_maps =3D NULL; -static int cmm_size =3D 0; +static ptrdiff_t cmm_size =3D 0; =20 /* Store a pointer to an array of the currently active minor modes in *modeptr, a pointer to an array of the keymaps of the currently @@ -1419,10 +1419,10 @@ loop. Instead, we'll use realloc/malloc and silently truncate the list, let the key sequence be read, and hope some other piece of code signals the error. */ -int +ptrdiff_t current_minor_maps (Lisp_Object **modeptr, Lisp_Object **mapptr) { - int i =3D 0; + ptrdiff_t i =3D 0; int list_number =3D 0; Lisp_Object alist, assoc, var, val; Lisp_Object emulation_alists; @@ -1465,9 +1465,16 @@ =20 if (i >=3D cmm_size) { - int newsize, allocsize; + ptrdiff_t newsize, allocsize; Lisp_Object *newmodes, *newmaps; =20 + /* Check for size calculation overflow. Other code + (e.g., read_key_sequence) adds 3 to the count + later, so subtract 3 from the limit here. */ + if (min (PTRDIFF_MAX, SIZE_MAX) / (2 * sizeof *newmodes) - 3 + < cmm_size) + break; + newsize =3D cmm_size =3D=3D 0 ? 30 : cmm_size * 2; allocsize =3D newsize * sizeof *newmodes; =20 =3D=3D=3D modified file 'src/keymap.h' --- src/keymap.h 2011-07-07 17:19:10 +0000 +++ src/keymap.h 2011-07-29 00:32:09 +0000 @@ -38,7 +38,7 @@ EXFUN (Fset_keymap_parent, 2); extern int describe_map_tree (Lisp_Object, int, Lisp_Object, Lisp_Object= , const char *, int, int, int, int); -extern int current_minor_maps (Lisp_Object **, Lisp_Object **); +extern ptrdiff_t current_minor_maps (Lisp_Object **, Lisp_Object **); extern void initial_define_key (Lisp_Object, int, const char *); extern void initial_define_lispy_key (Lisp_Object, const char *, const c= har *); extern void syms_of_keymap (void); =3D=3D=3D modified file 'src/lisp.h' --- src/lisp.h 2011-08-02 03:49:09 +0000 +++ src/lisp.h 2011-08-05 02:19:34 +0000 @@ -1704,6 +1704,11 @@ #define NUMBERP(x) (INTEGERP (x) || FLOATP (x)) #define NATNUMP(x) (INTEGERP (x) && XINT (x) >=3D 0) =20 +#define RANGED_INTEGERP(lo, x, hi) \ + (INTEGERP (x) && (lo) <=3D XINT (x) && XINT (x) <=3D (hi)) +#define TYPE_RANGED_INTEGERP(type, x) \ + RANGED_INTEGERP (TYPE_MINIMUM (type), x, TYPE_MAXIMUM (type)) + #define INTEGERP(x) (LISP_INT_TAG_P (XTYPE ((x)))) #define SYMBOLP(x) (XTYPE ((x)) =3D=3D Lisp_Symbol) #define MISCP(x) (XTYPE ((x)) =3D=3D Lisp_Misc) @@ -2551,6 +2556,7 @@ =20 /* Defined in fns.c */ extern Lisp_Object QCrehash_size, QCrehash_threshold; +enum { NEXT_ALMOST_PRIME_LIMIT =3D 11 }; extern EMACS_INT next_almost_prime (EMACS_INT); extern Lisp_Object larger_vector (Lisp_Object, EMACS_INT, Lisp_Object); extern void sweep_weak_hash_tables (void); @@ -2562,8 +2568,8 @@ Lisp_Object make_hash_table (Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object); -EMACS_INT hash_lookup (struct Lisp_Hash_Table *, Lisp_Object, EMACS_UINT= *); -EMACS_INT hash_put (struct Lisp_Hash_Table *, Lisp_Object, Lisp_Object, +ptrdiff_t hash_lookup (struct Lisp_Hash_Table *, Lisp_Object, EMACS_UINT= *); +ptrdiff_t hash_put (struct Lisp_Hash_Table *, Lisp_Object, Lisp_Object, EMACS_UINT); void init_weak_hash_tables (void); extern void init_fns (void); @@ -3569,6 +3575,9 @@ extern POINTER_TYPE *xmalloc (size_t); extern POINTER_TYPE *xrealloc (POINTER_TYPE *, size_t); extern void xfree (POINTER_TYPE *); +extern void *xnmalloc (ptrdiff_t, ptrdiff_t); +extern void *xnrealloc (void *, ptrdiff_t, ptrdiff_t); +extern void *xpalloc (void *, ptrdiff_t *, ptrdiff_t, ptrdiff_t, ptrdiff= _t); =20 extern char *xstrdup (const char *); =20 @@ -3686,6 +3695,23 @@ } \ } while (0) =20 +/* SAFE_NALLOCA sets BUF to a newly allocated array of MULTIPLIER * + NITEMS items, each of the same type as *BUF. MULTIPLIER must + positive. The code is tuned for MULTIPLIER being a constant. */ + +#define SAFE_NALLOCA(buf, multiplier, nitems) \ + do { \ + if ((nitems) <=3D MAX_ALLOCA / sizeof *(buf) / (multiplier)) \ + (buf) =3D alloca (sizeof *(buf) * (multiplier) * (nitems)); \ + else \ + { \ + (buf) =3D xnmalloc (nitems, sizeof *(buf) * (multiplier)); \ + sa_must_free =3D 1; \ + record_unwind_protect (safe_alloca_unwind, \ + make_save_value (buf, 0)); \ + } \ + } while (0) + /* SAFE_FREE frees xmalloced memory and enables GC as needed. */ =20 #define SAFE_FREE() \ =3D=3D=3D modified file 'src/lread.c' --- src/lread.c 2011-07-28 20:23:19 +0000 +++ src/lread.c 2011-07-29 05:31:12 +0000 @@ -2613,14 +2613,14 @@ =20 if (saved_doc_string_size =3D=3D 0) { + saved_doc_string =3D (char *) xmalloc (nskip + extra); saved_doc_string_size =3D nskip + extra; - saved_doc_string =3D (char *) xmalloc (saved_doc_string_size); } if (nskip > saved_doc_string_size) { - saved_doc_string_size =3D nskip + extra; saved_doc_string =3D (char *) xrealloc (saved_doc_string, - saved_doc_string_size); + nskip + extra); + saved_doc_string_size =3D nskip + extra; } =20 saved_doc_string_position =3D file_tell (instream); @@ -2883,7 +2883,8 @@ if (min (PTRDIFF_MAX, SIZE_MAX) / 2 < read_buffer_size) memory_full (SIZE_MAX); read_buffer =3D (char *) xrealloc (read_buffer, - read_buffer_size *=3D 2); + read_buffer_size * 2); + read_buffer_size *=3D 2; p =3D read_buffer + offset; end =3D read_buffer + read_buffer_size; } @@ -3026,7 +3027,8 @@ if (min (PTRDIFF_MAX, SIZE_MAX) / 2 < read_buffer_size) memory_full (SIZE_MAX); read_buffer =3D (char *) xrealloc (read_buffer, - read_buffer_size *=3D 2); + read_buffer_size * 2); + read_buffer_size *=3D 2; p =3D read_buffer + offset; end =3D read_buffer + read_buffer_size; } @@ -3056,7 +3058,8 @@ if (min (PTRDIFF_MAX, SIZE_MAX) / 2 < read_buffer_size) memory_full (SIZE_MAX); read_buffer =3D (char *) xrealloc (read_buffer, - read_buffer_size *=3D 2); + read_buffer_size * 2); + read_buffer_size *=3D 2; p =3D read_buffer + offset; end =3D read_buffer + read_buffer_size; } @@ -3938,6 +3941,7 @@ init_obarray (void) { Lisp_Object oblength; + ptrdiff_t size =3D 100 + MAX_MULTIBYTE_LENGTH; =20 XSETFASTINT (oblength, OBARRAY_SIZE); =20 @@ -3970,8 +3974,8 @@ =20 DEFSYM (Qvariable_documentation, "variable-documentation"); =20 - read_buffer_size =3D 100 + MAX_MULTIBYTE_LENGTH; - read_buffer =3D (char *) xmalloc (read_buffer_size); + read_buffer =3D (char *) xmalloc (size); + read_buffer_size =3D size; } =0C void =3D=3D=3D modified file 'src/macros.c' --- src/macros.c 2011-06-24 21:25:22 +0000 +++ src/macros.c 2011-07-29 01:00:29 +0000 @@ -62,9 +62,9 @@ =20 if (!current_kboard->kbd_macro_buffer) { - current_kboard->kbd_macro_bufsize =3D 30; current_kboard->kbd_macro_buffer =3D (Lisp_Object *)xmalloc (30 * sizeof (Lisp_Object)); + current_kboard->kbd_macro_bufsize =3D 30; } update_mode_lines++; if (NILP (append)) @@ -202,7 +202,7 @@ if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof *kb->kbd_macro_buffer / 2 < kb->kbd_macro_bufsize) memory_full (SIZE_MAX); - nbytes =3D kb->kbd_macro_bufsize * 2 * sizeof *kb->kbd_macro_buffer; + nbytes =3D kb->kbd_macro_bufsize * (2 * sizeof *kb->kbd_macro_buffer)= ; kb->kbd_macro_buffer =3D (Lisp_Object *) xrealloc (kb->kbd_macro_buffer, nbytes); kb->kbd_macro_bufsize *=3D 2; =3D=3D=3D modified file 'src/minibuf.c' --- src/minibuf.c 2011-07-19 17:33:06 +0000 +++ src/minibuf.c 2011-08-05 02:15:35 +0000 @@ -1723,7 +1723,7 @@ (Lisp_Object string, Lisp_Object collection, Lisp_Object predicate) { Lisp_Object regexps, tail, tem =3D Qnil; - EMACS_INT i =3D 0; + ptrdiff_t i =3D 0; =20 CHECK_STRING (string); =20 =3D=3D=3D modified file 'src/nsmenu.m' --- src/nsmenu.m 2011-07-28 18:30:59 +0000 +++ src/nsmenu.m 2011-07-29 05:31:12 +0000 @@ -1014,7 +1014,7 @@ BOOL enabled_p =3D !NILP (TOOLPROP (TOOL_BAR_ITEM_ENABLED_P)); BOOL selected_p =3D !NILP (TOOLPROP (TOOL_BAR_ITEM_SELECTED_P)); int idx; - int img_id; + ptrdiff_t img_id; struct image *img; Lisp_Object image; Lisp_Object helpObj; =3D=3D=3D modified file 'src/nsterm.h' --- src/nsterm.h 2011-07-28 18:50:05 +0000 +++ src/nsterm.h 2011-07-29 05:31:12 +0000 @@ -416,8 +416,8 @@ /* this to map between emacs color indices and NSColor objects */ struct ns_color_table { - unsigned int size; - unsigned int avail; + ptrdiff_t size; + ptrdiff_t avail; #ifdef __OBJC__ NSColor **colors; NSMutableSet *empty_indices; =3D=3D=3D modified file 'src/nsterm.m' --- src/nsterm.m 2011-07-28 18:41:21 +0000 +++ src/nsterm.m 2011-08-05 02:15:35 +0000 @@ -1341,7 +1341,7 @@ ns_index_color (NSColor *color, struct frame *f) { struct ns_color_table *color_table =3D FRAME_NS_DISPLAY_INFO (f)->colo= r_table; - int idx; + ptrdiff_t idx; NSNumber *index; =20 if (!color_table->colors) @@ -1356,7 +1356,7 @@ =20 /* do we already have this color ? */ { - int i; + ptrdiff_t i; for (i =3D 1; i < color_table->avail; i++) { if (color_table->colors[i] && [color_table->colors[i] isEqual: c= olor]) @@ -1371,17 +1371,14 @@ { index =3D [color_table->empty_indices anyObject]; [color_table->empty_indices removeObject: index]; - idx =3D [index unsignedIntValue]; + idx =3D [index unsignedLongValue]; } else { if (color_table->avail =3D=3D color_table->size) - { - color_table->size +=3D NS_COLOR_CAPACITY; - color_table->colors - =3D (NSColor **)xrealloc (color_table->colors, - color_table->size * sizeof (NSColor *)); - } + color_table->colors =3D + xpalloc (color_table->colors, &color_table->size, 1, + min (ULONG_MAX, PTRDIFF_MAX), sizeof *color_table->colors); idx =3D color_table->avail++; } =20 @@ -2321,7 +2318,7 @@ if (!img) { unsigned short *bits =3D p->bits + p->dh; - int len =3D 8 * p->h/8; + int len =3D p->h; int i; unsigned char *cbits =3D xmalloc (len); =20 @@ -4857,7 +4854,7 @@ } } =20 - =20 + #if !defined (NS_IMPL_COCOA) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_= VERSION_10_6 /* if we get here we should send the key for input manager processing = */ if (firstTime && [[NSInputManager currentInputManager] =3D=3D=3D modified file 'src/process.c' --- src/process.c 2011-07-16 18:27:08 +0000 +++ src/process.c 2011-08-05 02:15:35 +0000 @@ -3558,7 +3558,7 @@ { struct ifconf ifconf; struct ifreq *ifreqs =3D NULL; - int ifaces =3D 0; + ptrdiff_t ifaces =3D 0; int buf_size, s; Lisp_Object res; =20 @@ -3567,15 +3567,9 @@ return Qnil; =20 again: - ifaces +=3D 25; + ifreqs =3D xpalloc (ifreqs, &ifaces, 25, + INT_MAX / sizeof *ifreqs, sizeof *ifreqs); buf_size =3D ifaces * sizeof (ifreqs[0]); - ifreqs =3D (struct ifreq *)xrealloc(ifreqs, buf_size); - if (!ifreqs) - { - close (s); - return Qnil; - } - ifconf.ifc_len =3D buf_size; ifconf.ifc_req =3D ifreqs; if (ioctl (s, SIOCGIFCONF, &ifconf)) =3D=3D=3D modified file 'src/region-cache.c' --- src/region-cache.c 2011-04-19 00:34:42 +0000 +++ src/region-cache.c 2011-08-05 02:15:35 +0000 @@ -63,7 +63,7 @@ revalidate_region_cache to see how this helps. */ =20 struct boundary { - EMACS_INT pos; + ptrdiff_t pos; int value; }; =20 @@ -73,16 +73,16 @@ struct boundary *boundaries; =20 /* boundaries[gap_start ... gap_start + gap_len - 1] is the gap. */ - EMACS_INT gap_start, gap_len; + ptrdiff_t gap_start, gap_len; =20 /* The number of elements allocated to boundaries, not including the gap. */ - EMACS_INT cache_len; + ptrdiff_t cache_len; =20 /* The areas that haven't changed since the last time we cleaned out invalid entries from the cache. These overlap when the buffer is entirely unchanged. */ - EMACS_INT beg_unchanged, end_unchanged; + ptrdiff_t beg_unchanged, end_unchanged; =20 /* The first and last positions in the buffer. Because boundaries store their positions relative to the start (BEG) and end (Z) of @@ -92,7 +92,7 @@ =20 Yes, buffer_beg is always 1. It's there for symmetry with buffer_end and the BEG and BUF_BEG macros. */ - EMACS_INT buffer_beg, buffer_end; + ptrdiff_t buffer_beg, buffer_end; }; =20 /* Return the position of boundary i in cache c. */ @@ -173,17 +173,17 @@ This operation should be logarithmic in the number of cache entries. It would be nice if it took advantage of locality of reference, too, by searching entries near the last entry found. */ -static EMACS_INT -find_cache_boundary (struct region_cache *c, EMACS_INT pos) +static ptrdiff_t +find_cache_boundary (struct region_cache *c, ptrdiff_t pos) { - EMACS_INT low =3D 0, high =3D c->cache_len; + ptrdiff_t low =3D 0, high =3D c->cache_len; =20 while (low + 1 < high) { /* mid is always a valid index, because low < high and ">> 1" rounds down. */ - EMACS_INT mid =3D (low + high) >> 1; - EMACS_INT boundary =3D BOUNDARY_POS (c, mid); + ptrdiff_t mid =3D (low >> 1) + (high >> 1) + (low & high & 1); + ptrdiff_t boundary =3D BOUNDARY_POS (c, mid); =20 if (pos < boundary) high =3D mid; @@ -208,13 +208,13 @@ /* Move the gap of cache C to index POS, and make sure it has space for at least MIN_SIZE boundaries. */ static void -move_cache_gap (struct region_cache *c, EMACS_INT pos, EMACS_INT min_siz= e) +move_cache_gap (struct region_cache *c, ptrdiff_t pos, ptrdiff_t min_siz= e) { /* Copy these out of the cache and into registers. */ - EMACS_INT gap_start =3D c->gap_start; - EMACS_INT gap_len =3D c->gap_len; - EMACS_INT buffer_beg =3D c->buffer_beg; - EMACS_INT buffer_end =3D c->buffer_end; + ptrdiff_t gap_start =3D c->gap_start; + ptrdiff_t gap_len =3D c->gap_len; + ptrdiff_t buffer_beg =3D c->buffer_beg; + ptrdiff_t buffer_end =3D c->buffer_end; =20 if (pos < 0 || pos > c->cache_len) @@ -246,17 +246,11 @@ when the portion after the gap is smallest. */ if (gap_len < min_size) { - EMACS_INT i; - - /* Always make at least NEW_CACHE_GAP elements, as long as we're - expanding anyway. */ - if (min_size < NEW_CACHE_GAP) - min_size =3D NEW_CACHE_GAP; + ptrdiff_t i; =20 c->boundaries =3D - (struct boundary *) xrealloc (c->boundaries, - ((min_size + c->cache_len) - * sizeof (*c->boundaries))); + xpalloc (c->boundaries, &c->cache_len, min_size, -1, + sizeof *c->boundaries); =20 /* Some systems don't provide a version of the copy routine that can be trusted to shift memory upward into an overlapping @@ -293,7 +287,7 @@ /* Insert a new boundary in cache C; it will have cache index I, and have the specified POS and VALUE. */ static void -insert_cache_boundary (struct region_cache *c, EMACS_INT i, EMACS_INT po= s, +insert_cache_boundary (struct region_cache *c, ptrdiff_t i, ptrdiff_t po= s, int value) { /* i must be a valid cache index. */ @@ -331,9 +325,9 @@ =20 static void delete_cache_boundaries (struct region_cache *c, - EMACS_INT start, EMACS_INT end) + ptrdiff_t start, ptrdiff_t end) { - EMACS_INT len =3D end - start; + ptrdiff_t len =3D end - start; =20 /* Gotta be in range. */ if (start < 0 @@ -384,7 +378,7 @@ /* Set the value in cache C for the region START..END to VALUE. */ static void set_cache_region (struct region_cache *c, - EMACS_INT start, EMACS_INT end, int value) + ptrdiff_t start, ptrdiff_t end, int value) { if (start > end) abort (); @@ -407,8 +401,8 @@ index of the earliest boundary after the last character in start..end. (This tortured terminology is intended to answer all the "< or <=3D?" sort of questions.) */ - EMACS_INT start_ix =3D find_cache_boundary (c, start); - EMACS_INT end_ix =3D find_cache_boundary (c, end - 1) + 1; + ptrdiff_t start_ix =3D find_cache_boundary (c, start); + ptrdiff_t end_ix =3D find_cache_boundary (c, end - 1) + 1; =20 /* We must remember the value established by the last boundary before end; if that boundary's domain stretches beyond end, @@ -486,7 +480,7 @@ args to pass are the same before and after such an operation.) */ void invalidate_region_cache (struct buffer *buf, struct region_cache *c, - EMACS_INT head, EMACS_INT tail) + ptrdiff_t head, ptrdiff_t tail) { /* Let chead =3D c->beg_unchanged, and ctail =3D c->end_unchanged. @@ -624,7 +618,7 @@ corresponds to the modified region of the buffer. */ else { - EMACS_INT modified_ix; + ptrdiff_t modified_ix; =20 /* These positions are correct, relative to both the cache basis and the buffer basis. */ @@ -693,7 +687,7 @@ no newlines", in the case of the line cache). */ void know_region_cache (struct buffer *buf, struct region_cache *c, - EMACS_INT start, EMACS_INT end) + ptrdiff_t start, ptrdiff_t end) { revalidate_region_cache (buf, c); =20 @@ -708,14 +702,14 @@ position after POS where the knownness changes. */ int region_cache_forward (struct buffer *buf, struct region_cache *c, - EMACS_INT pos, EMACS_INT *next) + ptrdiff_t pos, ptrdiff_t *next) { revalidate_region_cache (buf, c); =20 { - EMACS_INT i =3D find_cache_boundary (c, pos); + ptrdiff_t i =3D find_cache_boundary (c, pos); int i_value =3D BOUNDARY_VALUE (c, i); - EMACS_INT j; + ptrdiff_t j; =20 /* Beyond the end of the buffer is unknown, by definition. */ if (pos >=3D BUF_Z (buf)) @@ -744,7 +738,7 @@ the purposes of CACHE. If NEXT is non-zero, set *NEXT to the nearest position before POS where the knownness changes. */ int region_cache_backward (struct buffer *buf, struct region_cache *c, - EMACS_INT pos, EMACS_INT *next) + ptrdiff_t pos, ptrdiff_t *next) { revalidate_region_cache (buf, c); =20 @@ -757,9 +751,9 @@ } =20 { - EMACS_INT i =3D find_cache_boundary (c, pos - 1); + ptrdiff_t i =3D find_cache_boundary (c, pos - 1); int i_value =3D BOUNDARY_VALUE (c, i); - EMACS_INT j; + ptrdiff_t j; =20 if (next) { @@ -785,18 +779,18 @@ void pp_cache (struct region_cache *c) { - int i; - EMACS_INT beg_u =3D c->buffer_beg + c->beg_unchanged; - EMACS_INT end_u =3D c->buffer_end - c->end_unchanged; + ptrdiff_t i; + ptrdiff_t beg_u =3D c->buffer_beg + c->beg_unchanged; + ptrdiff_t end_u =3D c->buffer_end - c->end_unchanged; =20 fprintf (stderr, - "basis: %"pI"d..%"pI"d modified: %"pI"d..%"pI"d\n", + "basis: %"pD"d..%"pD"d modified: %"pD"d..%"pD"d\n", c->buffer_beg, c->buffer_end, beg_u, end_u); =20 for (i =3D 0; i < c->cache_len; i++) { - EMACS_INT pos =3D BOUNDARY_POS (c, i); + ptrdiff_t pos =3D BOUNDARY_POS (c, i); =20 putc (((pos < beg_u) ? 'v' : (pos =3D=3D beg_u) ? '-' @@ -806,6 +800,6 @@ : (pos =3D=3D end_u) ? '-' : ' '), stderr); - fprintf (stderr, "%"pI"d : %d\n", pos, BOUNDARY_VALUE (c, i)); + fprintf (stderr, "%"pD"d : %d\n", pos, BOUNDARY_VALUE (c, i)); } } =3D=3D=3D modified file 'src/region-cache.h' --- src/region-cache.h 2011-04-14 06:48:41 +0000 +++ src/region-cache.h 2011-08-05 02:15:35 +0000 @@ -72,7 +72,7 @@ no newlines", in the case of the line cache). */ extern void know_region_cache (struct buffer *BUF, struct region_cache *CACHE, - EMACS_INT START, EMACS_INT END); + ptrdiff_t START, ptrdiff_t END); =20 /* Indicate that a section of BUF has changed, to invalidate CACHE. HEAD is the number of chars unchanged at the beginning of the buffer. @@ -84,7 +84,7 @@ args to pass are the same before and after such an operation.) */ extern void invalidate_region_cache (struct buffer *BUF, struct region_cache *CACHE, - EMACS_INT HEAD, EMACS_INT TAIL); + ptrdiff_t HEAD, ptrdiff_t TAIL); =20 /* The scanning functions. =20 @@ -100,13 +100,13 @@ position after POS where the knownness changes. */ extern int region_cache_forward (struct buffer *BUF, struct region_cache *CACHE, - EMACS_INT POS, - EMACS_INT *NEXT); + ptrdiff_t POS, + ptrdiff_t *NEXT); =20 /* Return true if the text immediately before POS in BUF is known, for the purposes of CACHE. If NEXT is non-zero, set *NEXT to the nearest position before POS where the knownness changes. */ extern int region_cache_backward (struct buffer *BUF, struct region_cache *CACHE, - EMACS_INT POS, - EMACS_INT *NEXT); + ptrdiff_t POS, + ptrdiff_t *NEXT); =3D=3D=3D modified file 'src/scroll.c' --- src/scroll.c 2011-06-22 18:15:23 +0000 +++ src/scroll.c 2011-08-05 02:15:35 +0000 @@ -969,32 +969,14 @@ const char *cleanup_string, int coefficient) { - if (FRAME_INSERT_COST (frame) !=3D 0) - { - FRAME_INSERT_COST (frame) =3D - (int *) xrealloc (FRAME_INSERT_COST (frame), - FRAME_LINES (frame) * sizeof (int)); - FRAME_DELETEN_COST (frame) =3D - (int *) xrealloc (FRAME_DELETEN_COST (frame), - FRAME_LINES (frame) * sizeof (int)); - FRAME_INSERTN_COST (frame) =3D - (int *) xrealloc (FRAME_INSERTN_COST (frame), - FRAME_LINES (frame) * sizeof (int)); - FRAME_DELETE_COST (frame) =3D - (int *) xrealloc (FRAME_DELETE_COST (frame), - FRAME_LINES (frame) * sizeof (int)); - } - else - { - FRAME_INSERT_COST (frame) =3D - (int *) xmalloc (FRAME_LINES (frame) * sizeof (int)); - FRAME_DELETEN_COST (frame) =3D - (int *) xmalloc (FRAME_LINES (frame) * sizeof (int)); - FRAME_INSERTN_COST (frame) =3D - (int *) xmalloc (FRAME_LINES (frame) * sizeof (int)); - FRAME_DELETE_COST (frame) =3D - (int *) xmalloc (FRAME_LINES (frame) * sizeof (int)); - } + FRAME_INSERT_COST (frame) =3D + xnrealloc (FRAME_INSERT_COST (frame), FRAME_LINES (frame), sizeof (i= nt)); + FRAME_DELETEN_COST (frame) =3D + xnrealloc (FRAME_DELETEN_COST (frame), FRAME_LINES (frame), sizeof (= int)); + FRAME_INSERTN_COST (frame) =3D + xnrealloc (FRAME_INSERTN_COST (frame), FRAME_LINES (frame), sizeof (= int)); + FRAME_DELETE_COST (frame) =3D + xnrealloc (FRAME_DELETE_COST (frame), FRAME_LINES (frame), sizeof (i= nt)); =20 ins_del_costs (frame, ins_line_string, multi_ins_string, =3D=3D=3D modified file 'src/search.c' --- src/search.c 2011-07-14 18:45:36 +0000 +++ src/search.c 2011-08-05 02:15:35 +0000 @@ -683,7 +683,7 @@ to see where we can avoid some scanning. */ if (target =3D=3D '\n' && newline_cache) { - EMACS_INT next_change; + ptrdiff_t next_change; immediate_quit =3D 0; while (region_cache_forward (current_buffer, newline_cache, start_byte, &next_cha= nge)) @@ -755,7 +755,7 @@ /* Consult the newline cache, if appropriate. */ if (target =3D=3D '\n' && newline_cache) { - EMACS_INT next_change; + ptrdiff_t next_change; immediate_quit =3D 0; while (region_cache_backward (current_buffer, newline_cache, start_byte, &next_cha= nge)) @@ -2640,15 +2640,17 @@ perform substitution on the replacement string. */ if (NILP (literal)) { - EMACS_INT length =3D SBYTES (newtext); + ptrdiff_t length =3D SBYTES (newtext); unsigned char *substed; - EMACS_INT substed_alloc_size, substed_len; + ptrdiff_t substed_alloc_size, substed_len; int buf_multibyte =3D !NILP (BVAR (current_buffer, enable_multibyt= e_characters)); int str_multibyte =3D STRING_MULTIBYTE (newtext); int really_changed =3D 0; =20 - substed_alloc_size =3D length * 2 + 100; - substed =3D (unsigned char *) xmalloc (substed_alloc_size + 1); + substed_alloc_size =3D ((STRING_BYTES_BOUND - 100) / 2 < length + ? STRING_BYTES_BOUND + : length * 2 + 100); + substed =3D (unsigned char *) xmalloc (substed_alloc_size); substed_len =3D 0; =20 /* Go thru NEWTEXT, producing the actual text to insert in @@ -2659,7 +2661,7 @@ { unsigned char str[MAX_MULTIBYTE_LENGTH]; const unsigned char *add_stuff =3D NULL; - EMACS_INT add_len =3D 0; + ptrdiff_t add_len =3D 0; int idx =3D -1; =20 if (str_multibyte) @@ -2723,7 +2725,7 @@ set up ADD_STUFF and ADD_LEN to point to it. */ if (idx >=3D 0) { - EMACS_INT begbyte =3D CHAR_TO_BYTE (search_regs.start[idx]); + ptrdiff_t begbyte =3D CHAR_TO_BYTE (search_regs.start[idx]); add_len =3D CHAR_TO_BYTE (search_regs.end[idx]) - begbyte; if (search_regs.start[idx] < GPT && GPT < search_regs.end[idx]) move_gap (search_regs.start[idx]); @@ -2734,12 +2736,11 @@ is invariably ADD_LEN bytes starting at ADD_STUFF. */ =20 /* Make sure SUBSTED is big enough. */ - if (substed_len + add_len >=3D substed_alloc_size) - { - substed_alloc_size =3D substed_len + add_len + 500; - substed =3D (unsigned char *) xrealloc (substed, - substed_alloc_size + 1); - } + if (substed_alloc_size - substed_len < add_len) + substed =3D + xpalloc (substed, &substed_alloc_size, + add_len - (substed_alloc_size - substed_len), + STRING_BYTES_BOUND, 1); =20 /* Now add to the end of SUBSTED. */ if (add_stuff) @@ -2973,7 +2974,7 @@ If optional arg RESEAT is non-nil, make markers on LIST point nowhere. = */) (register Lisp_Object list, Lisp_Object reseat) { - register int i; + ptrdiff_t i; register Lisp_Object marker; =20 if (running_asynch_code) @@ -2987,31 +2988,21 @@ =20 /* Allocate registers if they don't already exist. */ { - int length =3D XFASTINT (Flength (list)) / 2; + ptrdiff_t length =3D XFASTINT (Flength (list)) / 2; =20 if (length > search_regs.num_regs) { - if (search_regs.num_regs =3D=3D 0) - { - search_regs.start - =3D (regoff_t *) xmalloc (length * sizeof (regoff_t)); - search_regs.end - =3D (regoff_t *) xmalloc (length * sizeof (regoff_t)); - } - else - { - search_regs.start - =3D (regoff_t *) xrealloc (search_regs.start, - length * sizeof (regoff_t)); - search_regs.end - =3D (regoff_t *) xrealloc (search_regs.end, - length * sizeof (regoff_t)); - } + ptrdiff_t num_regs =3D search_regs.num_regs; + search_regs.start =3D + xpalloc (search_regs.start, &num_regs, length - num_regs, + min (PTRDIFF_MAX, UINT_MAX), sizeof (regoff_t)); + search_regs.end =3D + xrealloc (search_regs.end, num_regs * sizeof (regoff_t)); =20 - for (i =3D search_regs.num_regs; i < length; i++) + for (i =3D search_regs.num_regs; i < num_regs; i++) search_regs.start[i] =3D -1; =20 - search_regs.num_regs =3D length; + search_regs.num_regs =3D num_regs; } =20 for (i =3D 0; CONSP (list); i++) =3D=3D=3D modified file 'src/sysdep.c' --- src/sysdep.c 2011-07-11 06:05:57 +0000 +++ src/sysdep.c 2011-07-29 01:16:54 +0000 @@ -2640,7 +2640,7 @@ ssize_t nread; const char *cmd =3D NULL; char *cmdline =3D NULL; - size_t cmdsize =3D 0, cmdline_size; + ptrdiff_t cmdsize =3D 0, cmdline_size; unsigned char c; int proc_id, ppid, uid, gid, pgrp, sess, tty, tpgid, thcount; unsigned long long u_time, s_time, cutime, cstime, start; @@ -2822,8 +2822,10 @@ if (fd >=3D 0) { char ch; - for (cmdline_size =3D 0; emacs_read (fd, &ch, 1) =3D=3D 1; cmdline= _size++) + for (cmdline_size =3D 0; cmdline_size < STRING_BYTES_BOUND; cmdlin= e_size++) { + if (emacs_read (fd, &ch, 1) !=3D 1) + break; c =3D ch; if (isspace (c) || c =3D=3D '\\') cmdline_size++; /* for later quoting, see below */ @@ -2844,7 +2846,7 @@ nread =3D 0; } /* We don't want trailing null characters. */ - for (p =3D cmdline + nread - 1; p > cmdline && !*p; p--) + for (p =3D cmdline + nread; p > cmdline + 1 && !p[-1]; p--) nread--; for (p =3D cmdline; p < cmdline + nread; p++) { =3D=3D=3D modified file 'src/term.c' --- src/term.c 2011-07-14 17:28:42 +0000 +++ src/term.c 2011-08-05 02:15:35 +0000 @@ -136,10 +136,6 @@ =20 static int max_frame_cols; =20 -/* The largest frame height in any call to calculate_costs. */ - -static int max_frame_lines; - /* Non-zero if we have dropped our controlling tty and therefore should not open a frame on stdout. */ static int no_controlling_tty; @@ -497,8 +493,8 @@ static unsigned char *encode_terminal_src; static unsigned char *encode_terminal_dst; /* Allocated sizes of the above buffers. */ -static int encode_terminal_src_size; -static int encode_terminal_dst_size; +static ptrdiff_t encode_terminal_src_size; +static ptrdiff_t encode_terminal_dst_size; =20 /* Encode SRC_LEN glyphs starting at SRC to terminal output codes. Set CODING->produced to the byte-length of the resulting byte @@ -509,8 +505,8 @@ { struct glyph *src_end =3D src + src_len; unsigned char *buf; - int nchars, nbytes, required; - register int tlen =3D GLYPH_TABLE_LENGTH; + ptrdiff_t nchars, nbytes, required; + ptrdiff_t tlen =3D GLYPH_TABLE_LENGTH; register Lisp_Object *tbase =3D GLYPH_TABLE_BASE; Lisp_Object charset_list; =20 @@ -518,13 +514,13 @@ multibyte-form. But, it may be enlarged on demand if Vglyph_table contains a string or a composite glyph is encountered. */ - required =3D MAX_MULTIBYTE_LENGTH * src_len; + if (min (PTRDIFF_MAX, SIZE_MAX) / MAX_MULTIBYTE_LENGTH < src_len) + memory_full (SIZE_MAX); + required =3D src_len; + required *=3D MAX_MULTIBYTE_LENGTH; if (encode_terminal_src_size < required) { - if (encode_terminal_src) - encode_terminal_src =3D xrealloc (encode_terminal_src, required); - else - encode_terminal_src =3D xmalloc (required); + encode_terminal_src =3D xrealloc (encode_terminal_src, required); encode_terminal_src_size =3D required; } =20 @@ -544,19 +540,21 @@ if (src->u.cmp.automatic) { gstring =3D composition_gstring_from_id (src->u.cmp.id); - required =3D src->slice.cmp.to + 1 - src->slice.cmp.from; + required =3D src->slice.cmp.to - src->slice.cmp.from + 1; } else { cmp =3D composition_table[src->u.cmp.id]; - required =3D MAX_MULTIBYTE_LENGTH * cmp->glyph_len; + required =3D cmp->glyph_len; + required *=3D MAX_MULTIBYTE_LENGTH; } =20 - if (encode_terminal_src_size < nbytes + required) + if (encode_terminal_src_size - nbytes < required) { - encode_terminal_src_size =3D nbytes + required; - encode_terminal_src =3D xrealloc (encode_terminal_src, - encode_terminal_src_size); + encode_terminal_src =3D + xpalloc (encode_terminal_src, &encode_terminal_src_size, + required - (encode_terminal_src_size - nbytes), + -1, 1); buf =3D encode_terminal_src + nbytes; } =20 @@ -627,11 +625,11 @@ if (NILP (string)) { nbytes =3D buf - encode_terminal_src; - if (encode_terminal_src_size < nbytes + MAX_MULTIBYTE_LENGTH) + if (encode_terminal_src_size - nbytes < MAX_MULTIBYTE_LENGTH) { - encode_terminal_src_size =3D nbytes + MAX_MULTIBYTE_LENGTH; - encode_terminal_src =3D xrealloc (encode_terminal_src, - encode_terminal_src_size); + encode_terminal_src =3D + xpalloc (encode_terminal_src, &encode_terminal_src_size, + MAX_MULTIBYTE_LENGTH, -1, 1); buf =3D encode_terminal_src + nbytes; } if (CHAR_BYTE8_P (c) @@ -659,11 +657,13 @@ if (! STRING_MULTIBYTE (string)) string =3D string_to_multibyte (string); nbytes =3D buf - encode_terminal_src; - if (encode_terminal_src_size < nbytes + SBYTES (string)) + if (encode_terminal_src_size - nbytes < SBYTES (string)) { - encode_terminal_src_size =3D nbytes + SBYTES (string); - encode_terminal_src =3D xrealloc (encode_terminal_src, - encode_terminal_src_size); + encode_terminal_src =3D + xpalloc (encode_terminal_src, &encode_terminal_src_size, + (SBYTES (string) + - (encode_terminal_src_size - nbytes)), + -1, 1); buf =3D encode_terminal_src + nbytes; } memcpy (buf, SDATA (string), SBYTES (string)); @@ -684,12 +684,9 @@ coding->source =3D encode_terminal_src; if (encode_terminal_dst_size =3D=3D 0) { + encode_terminal_dst =3D xrealloc (encode_terminal_dst, + encode_terminal_src_size); encode_terminal_dst_size =3D encode_terminal_src_size; - if (encode_terminal_dst) - encode_terminal_dst =3D xrealloc (encode_terminal_dst, - encode_terminal_dst_size); - else - encode_terminal_dst =3D xmalloc (encode_terminal_dst_size); } coding->destination =3D encode_terminal_dst; coding->dst_bytes =3D encode_terminal_dst_size; @@ -1156,21 +1153,17 @@ char_ins_del_vector (i.e., char_ins_del_cost) isn't used becaus= e X turns off char_ins_del_ok. */ =20 - max_frame_lines =3D max (max_frame_lines, FRAME_LINES (frame)); max_frame_cols =3D max (max_frame_cols, FRAME_COLS (frame)); + if ((min (PTRDIFF_MAX, SIZE_MAX) / sizeof (int) - 1) / 2 + < max_frame_cols) + memory_full (SIZE_MAX); =20 - if (char_ins_del_vector !=3D 0) - char_ins_del_vector - =3D (int *) xrealloc (char_ins_del_vector, - (sizeof (int) - + 2 * max_frame_cols * sizeof (int))); - else - char_ins_del_vector - =3D (int *) xmalloc (sizeof (int) - + 2 * max_frame_cols * sizeof (int)); + char_ins_del_vector =3D + xrealloc (char_ins_del_vector, + (sizeof (int) + 2 * sizeof (int) * max_frame_cols)); =20 memset (char_ins_del_vector, 0, - (sizeof (int) + 2 * max_frame_cols * sizeof (int))); + (sizeof (int) + 2 * sizeof (int) * max_frame_cols)); =20 =20 if (f && (!tty->TS_ins_line && !tty->TS_del_line)) =3D=3D=3D modified file 'src/termcap.c' --- src/termcap.c 2011-07-10 08:20:10 +0000 +++ src/termcap.c 2011-08-05 02:15:35 +0000 @@ -480,7 +480,7 @@ /* If BP is malloc'd by us, make sure it is big enough. */ if (malloc_size) { - int offset1 =3D bp1 - bp, offset2 =3D tc_search_point - bp; + ptrdiff_t offset1 =3D bp1 - bp, offset2 =3D tc_search_point - bp; malloc_size =3D offset1 + buf.size; bp =3D termcap_name =3D (char *) xrealloc (bp, malloc_size); bp1 =3D termcap_name + offset1; @@ -619,7 +619,6 @@ register char *end; register int nread; register char *buf =3D bufp->beg; - register char *tem; =20 if (!append_end) append_end =3D bufp->ptr; @@ -636,14 +635,14 @@ { if (bufp->full =3D=3D bufp->size) { - if ((PTRDIFF_MAX - 1) / 2 < bufp->size) - memory_full (SIZE_MAX); - bufp->size *=3D 2; + ptrdiff_t ptr_offset =3D bufp->ptr - buf; + ptrdiff_t append_end_offset =3D append_end - buf; /* Add 1 to size to ensure room for terminating null. */ - tem =3D (char *) xrealloc (buf, bufp->size + 1); - bufp->ptr =3D (bufp->ptr - buf) + tem; - append_end =3D (append_end - buf) + tem; - bufp->beg =3D buf =3D tem; + ptrdiff_t size =3D bufp->size + 1; + bufp->beg =3D buf =3D xpalloc (buf, &size, 1, -1, 1); + bufp->size =3D size - 1; + bufp->ptr =3D buf + ptr_offset; + append_end =3D buf + append_end_offset; } } else =3D=3D=3D modified file 'src/termhooks.h' --- src/termhooks.h 2011-06-06 19:43:39 +0000 +++ src/termhooks.h 2011-07-20 00:09:31 +0000 @@ -288,12 +288,12 @@ /* The next four modifier bits are used also in keyboard events at the Lisp level. =20 - It's probably not the greatest idea to use the 2^23 bit for any + It's probably not the greatest idea to use the 2^28 bit for any modifier. It may or may not be the sign bit, depending on - VALBITS, so using it to represent a modifier key means that + FIXNUM_BITS, so using it to represent a modifier key means that characters thus modified have different integer equivalents depending on the architecture they're running on. Oh, and - applying XINT to a character whose 2^23 bit is set sign-extends + applying XINT to a character whose 2^28 bit is set might sign-exten= d it, so you get a bunch of bits in the mask you didn't want. =20 The CHAR_ macros are defined in lisp.h. */ =3D=3D=3D modified file 'src/tparam.c' --- src/tparam.c 2011-07-10 08:20:10 +0000 +++ src/tparam.c 2011-08-05 02:15:35 +0000 @@ -79,24 +79,25 @@ register const char *p =3D string; register char *op =3D outstring; char *outend; - int outlen =3D 0; + char *new =3D 0; + ptrdiff_t outlen =3D 0; =20 register int tem; int *old_argp =3D argp; /* can move */ int *fixed_argp =3D argp; /* never moves */ int explicit_param_p =3D 0; /* set by %p */ - int doleft =3D 0; - int doup =3D 0; + ptrdiff_t doleft =3D 0; + ptrdiff_t doup =3D 0; + ptrdiff_t append_len =3D 0; =20 outend =3D outstring + len; =20 while (1) { /* If the buffer might be too short, make it bigger. */ - if (op + 5 >=3D outend) + while (outend - op - append_len <=3D 5) { - register char *new; - int offset =3D op - outstring; + ptrdiff_t offset =3D op - outstring; =20 if (outlen =3D=3D 0) { @@ -106,8 +107,7 @@ } else { - outlen *=3D 2; - new =3D (char *) xrealloc (outstring, outlen); + new =3D xpalloc (outstring, &outlen, 1, -1, 1); } =20 op =3D new + offset; @@ -167,11 +167,15 @@ and this is one of them, increment it. */ while (tem =3D=3D 0 || tem =3D=3D '\n' || tem =3D=3D '\t') { + ptrdiff_t append_len_incr; tem++; if (argp =3D=3D old_argp) - doup++, outend -=3D strlen (up); + doup++, append_len_incr =3D strlen (up); else - doleft++, outend -=3D strlen (left); + doleft++, append_len_incr =3D strlen (left); + if (INT_ADD_OVERFLOW (append_len, append_len_incr)) + memory_full (SIZE_MAX); + append_len +=3D append_len_incr; } } *op++ =3D tem ? tem : 0200; @@ -273,7 +277,7 @@ args[0] =3D atoi (argv[2]); args[1] =3D atoi (argv[3]); args[2] =3D atoi (argv[4]); - tparam1 (argv[1], buf, "LEFT", "UP", args); + tparam1 (argv[1], buf, 50, "LEFT", "UP", args); printf ("%s\n", buf); return 0; } =3D=3D=3D modified file 'src/window.c' --- src/window.c 2011-07-14 17:28:42 +0000 +++ src/window.c 2011-07-19 21:39:36 +0000 @@ -5069,7 +5069,7 @@ && (!EQ (Vrecenter_redisplay, Qtty) || !NILP (Ftty_type (selected_frame)))) { - int i; + ptrdiff_t i; =20 /* Invalidate pixel data calculated for all compositions. */ for (i =3D 0; i < n_compositions; i++) =3D=3D=3D modified file 'src/xdisp.c' --- src/xdisp.c 2011-08-03 05:24:30 +0000 +++ src/xdisp.c 2011-08-05 02:19:34 +0000 @@ -2478,10 +2478,7 @@ else if (INTEGERP (w->redisplay_end_trigger)) it->redisplay_end_trigger_charpos =3D XINT (w->redisplay_end_trigger= ); =20 - /* Correct bogus values of tab_width. */ - it->tab_width =3D XINT (BVAR (current_buffer, tab_width)); - if (it->tab_width <=3D 0 || it->tab_width > 1000) - it->tab_width =3D 8; + it->tab_width =3D SANE_TAB_WIDTH (current_buffer); =20 /* Are lines in the display truncated? */ if (base_face_id !=3D DEFAULT_FACE_ID @@ -10379,13 +10376,14 @@ store_mode_line_noprop_char (char c) { /* If output position has reached the end of the allocated buffer, - double the buffer's size. */ + increase the buffer's size. */ if (mode_line_noprop_ptr =3D=3D mode_line_noprop_buf_end) { - int len =3D MODE_LINE_NOPROP_LEN (0); - int new_size =3D 2 * len * sizeof *mode_line_noprop_buf; - mode_line_noprop_buf =3D (char *) xrealloc (mode_line_noprop_buf, = new_size); - mode_line_noprop_buf_end =3D mode_line_noprop_buf + new_size; + ptrdiff_t len =3D MODE_LINE_NOPROP_LEN (0); + ptrdiff_t size =3D len; + mode_line_noprop_buf =3D + xpalloc (mode_line_noprop_buf, &size, 1, STRING_BYTES_BOUND, 1); + mode_line_noprop_buf_end =3D mode_line_noprop_buf + size; mode_line_noprop_ptr =3D mode_line_noprop_buf + len; } =20 @@ -10447,9 +10445,9 @@ /* Do we have more than one visible frame on this X display? */ Lisp_Object tail; Lisp_Object fmt; - int title_start; + ptrdiff_t title_start; char *title; - int len; + ptrdiff_t len; struct it it; int count =3D SPECPDL_INDEX (); =20 @@ -21260,7 +21258,7 @@ if (FRAME_WINDOW_P (it->f) && valid_image_p (prop)) { - int id =3D lookup_image (it->f, prop); + ptrdiff_t id =3D lookup_image (it->f, prop); struct image *img =3D IMAGE_FROM_ID (it->f, id); =20 return OK_PIXELS (width_p ? img->width : img->height); @@ -22132,7 +22130,7 @@ do { \ int face_id =3D (row)->glyphs[area][START].face_id; \ struct face *base_face =3D FACE_FROM_ID (f, face_id); \ - int cmp_id =3D (row)->glyphs[area][START].u.cmp.id; \ + ptrdiff_t cmp_id =3D (row)->glyphs[area][START].u.cmp.id; \ struct composition *cmp =3D composition_table[cmp_id]; \ XChar2b *char2b; \ struct glyph_string *first_s IF_LINT (=3D NULL); \ =3D=3D=3D modified file 'src/xfaces.c' --- src/xfaces.c 2011-07-28 00:15:43 +0000 +++ src/xfaces.c 2011-08-05 02:15:35 +0000 @@ -403,7 +403,7 @@ /* A vector mapping Lisp face Id's to face names. */ =20 static Lisp_Object *lface_id_to_name; -static int lface_id_to_name_size; +static ptrdiff_t lface_id_to_name_size; =20 /* TTY color-related functions (defined in tty-colors.el). */ =20 @@ -2667,12 +2667,10 @@ The mapping from Lisp face to Lisp face id is given by the property `face' of the Lisp face name. */ if (next_lface_id =3D=3D lface_id_to_name_size) - { - int new_size =3D max (50, 2 * lface_id_to_name_size); - int sz =3D new_size * sizeof *lface_id_to_name; - lface_id_to_name =3D (Lisp_Object *) xrealloc (lface_id_to_name, sz); - lface_id_to_name_size =3D new_size; - } + lface_id_to_name =3D + xpalloc (lface_id_to_name, &lface_id_to_name_size, 1, + min (INT_MAX, MOST_POSITIVE_FIXNUM), + sizeof *lface_id_to_name); =20 lface_id_to_name[next_lface_id] =3D face; Fput (face, Qface, make_number (next_lface_id)); @@ -4410,15 +4408,8 @@ if (i =3D=3D c->used) { if (c->used =3D=3D c->size) - { - int new_size, sz; - new_size =3D min (2 * c->size, MAX_FACE_ID); - if (new_size =3D=3D c->size) - abort (); /* Alternatives? ++kfs */ - sz =3D new_size * sizeof *c->faces_by_id; - c->faces_by_id =3D (struct face **) xrealloc (c->faces_by_id, sz); - c->size =3D new_size; - } + c->faces_by_id =3D xpalloc (c->faces_by_id, &c->size, 1, MAX_FACE_ID, + sizeof *c->faces_by_id); c->used++; } =20 =3D=3D=3D modified file 'src/xfns.c' --- src/xfns.c 2011-07-23 12:15:53 +0000 +++ src/xfns.c 2011-08-05 02:15:35 +0000 @@ -145,7 +145,8 @@ Lisp_Object Qfont_param; =20 #if GLYPH_DEBUG -static int image_cache_refcount, dpyinfo_refcount; +static ptrdiff_t image_cache_refcount; +static int dpyinfo_refcount; #endif =20 #if defined (USE_GTK) && defined (HAVE_FREETYPE) @@ -1470,7 +1471,8 @@ the result should be `COMPOUND_TEXT'. */ =20 static unsigned char * -x_encode_text (Lisp_Object string, Lisp_Object coding_system, int select= ionp, int *text_bytes, int *stringp, int *freep) +x_encode_text (Lisp_Object string, Lisp_Object coding_system, int select= ionp, + ptrdiff_t *text_bytes, int *stringp, int *freep) { int result =3D string_xstring_p (string); struct coding_system coding; @@ -1488,8 +1490,8 @@ coding.mode |=3D (CODING_MODE_SAFE_ENCODING | CODING_MODE_LAST_BLOCK); /* We suppress producing escape sequences for composition. */ coding.common_flags &=3D ~CODING_ANNOTATION_MASK; + coding.destination =3D xnmalloc (SCHARS (string), 2); coding.dst_bytes =3D SCHARS (string) * 2; - coding.destination =3D (unsigned char *) xmalloc (coding.dst_bytes); encode_coding_object (&coding, string, 0, 0, SCHARS (string), SBYTES (string), Qnil); *text_bytes =3D coding.produced; @@ -1511,7 +1513,8 @@ BLOCK_INPUT; { XTextProperty text, icon; - int bytes, stringp; + ptrdiff_t bytes; + int stringp; int do_free_icon_value =3D 0, do_free_text_value =3D 0; Lisp_Object coding_system; Lisp_Object encoded_name; @@ -1550,6 +1553,8 @@ : FRAME_X_DISPLAY_INFO (f)->Xatom_COMPOUND_TEXT); text.format =3D 8; text.nitems =3D bytes; + if (text.nitems !=3D bytes) + error ("Window name too large"); =20 if (!STRINGP (f->icon_name)) { @@ -1565,6 +1570,8 @@ : FRAME_X_DISPLAY_INFO (f)->Xatom_COMPOUND_TEXT); icon.format =3D 8; icon.nitems =3D bytes; + if (icon.nitems !=3D bytes) + error ("Icon name too large"); =20 encoded_icon_name =3D ENCODE_UTF_8 (f->icon_name); } @@ -4193,21 +4200,19 @@ =20 if (CONSP (value)) { + ptrdiff_t elsize; + nelements =3D x_check_property_data (value); if (nelements =3D=3D -1) error ("Bad data in VALUE, must be number, string or cons"); =20 - if (element_format =3D=3D 8) - data =3D (unsigned char *) xmalloc (nelements); - else if (element_format =3D=3D 16) - data =3D (unsigned char *) xmalloc (nelements*2); - else /* format =3D=3D 32 */ - /* The man page for XChangeProperty: - "If the specified format is 32, the property data must be= a - long array." - This applies even if long is more than 64 bits. The X librar= y - converts to 32 bits before sending to the X server. */ - data =3D (unsigned char *) xmalloc (nelements * sizeof(long)); + /* The man page for XChangeProperty: + "If the specified format is 32, the property data must be a + long array." + This applies even if long is more than 32 bits. The X library + converts to 32 bits before sending to the X server. */ + elsize =3D element_format =3D=3D 32 ? sizeof (long) : element_form= at >> 3; + data =3D xnmalloc (nelements, elsize); =20 x_fill_property_data (FRAME_X_DISPLAY (f), value, data, element_fo= rmat); } @@ -4215,7 +4220,9 @@ { CHECK_STRING (value); data =3D SDATA (value); - nelements =3D SCHARS (value); + if (INT_MAX < SBYTES (value)) + error ("VALUE too long"); + nelements =3D SBYTES (value); } =20 BLOCK_INPUT; =3D=3D=3D modified file 'src/xgselect.c' --- src/xgselect.c 2011-07-01 09:18:46 +0000 +++ src/xgselect.c 2011-08-05 02:15:35 +0000 @@ -29,7 +29,7 @@ #include =20 static GPollFD *gfds; -static int gfds_size; +static ptrdiff_t gfds_size; =20 int xg_select (int max_fds, SELECT_TYPE *rfds, SELECT_TYPE *wfds, SELECT_TYP= E *efds, @@ -54,10 +54,9 @@ do { if (n_gfds > gfds_size) { - while (n_gfds > gfds_size) - gfds_size *=3D 2; xfree (gfds); - gfds =3D xmalloc (sizeof (*gfds) * gfds_size); + gfds =3D xpalloc (0, &gfds_size, n_gfds - gfds_size, INT_MAX, + sizeof *gfds); } =20 n_gfds =3D g_main_context_query (context, =3D=3D=3D modified file 'src/xrdb.c' --- src/xrdb.c 2011-07-10 08:20:10 +0000 +++ src/xrdb.c 2011-08-05 02:15:35 +0000 @@ -426,24 +426,22 @@ { XrmDatabase db; char *p; - char *path =3D 0, *home =3D 0; - const char *host; + char *path =3D 0; =20 if ((p =3D getenv ("XENVIRONMENT")) =3D=3D NULL) { - home =3D gethomedir (); - host =3D get_system_name (); - path =3D (char *) xmalloc (strlen (home) - + sizeof (".Xdefaults-") - + strlen (host)); - sprintf (path, "%s%s%s", home, ".Xdefaults-", host); + static char const xdefaults[] =3D ".Xdefaults-"; + char *home =3D gethomedir (); + char const *host =3D get_system_name (); + ptrdiff_t pathsize =3D strlen (home) + sizeof xdefaults + strlen (= host); + path =3D (char *) xrealloc (home, pathsize); + strcat (strcat (path, xdefaults), host); p =3D path; } =20 db =3D XrmGetFileDatabase (p); =20 xfree (path); - xfree (home); =20 return db; } =3D=3D=3D modified file 'src/xselect.c' --- src/xselect.c 2011-07-13 03:45:56 +0000 +++ src/xselect.c 2011-08-05 02:15:35 +0000 @@ -66,22 +66,15 @@ static void wait_for_property_change (struct prop_location *); static Lisp_Object x_get_foreign_selection (Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object); -static void x_get_window_property (Display *, Window, Atom, - unsigned char **, int *, - Atom *, int *, unsigned long *, int); -static void receive_incremental_selection (Display *, Window, Atom, - Lisp_Object, unsigned, - unsigned char **, int *, - Atom *, int *, unsigned long = *); static Lisp_Object x_get_window_property_as_lisp_data (Display *, Window, Atom, Lisp_Object, Atom= ); static Lisp_Object selection_data_to_lisp_data (Display *, const unsigned char *, - int, Atom, int); + ptrdiff_t, Atom, int); static void lisp_data_to_selection_data (Display *, Lisp_Object, unsigned char **, Atom *, - unsigned *, int *, int *); + ptrdiff_t *, int *, int *); static Lisp_Object clean_local_selection_data (Lisp_Object); =20 /* Printing traces to stderr. */ @@ -114,15 +107,37 @@ static Lisp_Object Qforeign_selection; static Lisp_Object Qx_lost_selection_functions, Qx_sent_selection_functi= ons; =20 +/* Bytes needed to represent 'long' data. This is as per libX11; it + is not necessarily sizeof (long). */ +#define X_LONG_SIZE 4 + +/* Maximum unsigned 'short' and 'long' values suitable for libX11. */ +#define X_USHRT_MAX 0xffff +#define X_ULONG_MAX 0xffffffff + /* If this is a smaller number than the max-request-size of the display, emacs will use INCR selection transfer when the selection is larger than this. The max-request-size is usually around 64k, so if you wan= t emacs to use incremental selection transfers when the selection is smaller than that, set this. I added this mostly for debugging the - incremental transfer stuff, but it might improve server performance. = */ -#define MAX_SELECTION_QUANTUM 0xFFFFFF - -#define SELECTION_QUANTUM(dpy) ((XMaxRequestSize(dpy) << 2) - 100) + incremental transfer stuff, but it might improve server performance. + + This value cannot exceed INT_MAX / max (X_LONG_SIZE, sizeof (long)) + because it is multiplied by X_LONG_SIZE and by sizeof (long) in + subscript calculations. Similarly for PTRDIFF_MAX - 1 or SIZE_MAX + - 1 in place of INT_MAX. */ +#define MAX_SELECTION_QUANTUM \ + ((int) min (0xFFFFFF, (min (INT_MAX, min (PTRDIFF_MAX, SIZE_MAX) - 1) = \ + / max (X_LONG_SIZE, sizeof (long))))) + +static int +selection_quantum (Display *display) +{ + long mrs =3D XMaxRequestSize (display); + return (mrs < MAX_SELECTION_QUANTUM / X_LONG_SIZE + 25 + ? (mrs - 25) * X_LONG_SIZE + : MAX_SELECTION_QUANTUM); +} =20 #define LOCAL_SELECTION(selection_symbol,dpyinfo) \ assq_no_quit (selection_symbol, dpyinfo->terminal->Vselection_alist) @@ -477,7 +492,7 @@ struct selection_data { unsigned char *data; - unsigned int size; + ptrdiff_t size; int format; Atom type; int nofree; @@ -581,14 +596,11 @@ XSelectionEvent *reply =3D &(reply_base.xselection); Display *display =3D SELECTION_EVENT_DISPLAY (event); Window window =3D SELECTION_EVENT_REQUESTOR (event); - int bytes_remaining; - int max_bytes =3D SELECTION_QUANTUM (display); + ptrdiff_t bytes_remaining; + int max_bytes =3D selection_quantum (display); int count =3D SPECPDL_INDEX (); struct selection_data *cs; =20 - if (max_bytes > MAX_SELECTION_QUANTUM) - max_bytes =3D MAX_SELECTION_QUANTUM; - reply->type =3D SelectionNotify; reply->display =3D display; reply->requestor =3D window; @@ -616,11 +628,12 @@ if (cs->property =3D=3D None) continue; =20 - bytes_remaining =3D cs->size * (cs->format / 8); + bytes_remaining =3D cs->size; + bytes_remaining *=3D cs->format >> 3; if (bytes_remaining <=3D max_bytes) { /* Send all the data at once, with minimal handshaking. */ - TRACE1 ("Sending all %d bytes", bytes_remaining); + TRACE1 ("Sending all %"pD"d bytes", bytes_remaining); XChangeProperty (display, window, cs->property, cs->type, cs->format, PropModeReplace, cs->data, cs->size); @@ -628,9 +641,9 @@ else { /* Send an INCR tag to initiate incremental transfer. */ - long value[1]; + unsigned long value[1]; =20 - TRACE2 ("Start sending %d bytes incrementally (%s)", + TRACE2 ("Start sending %"pD"d bytes incrementally (%s)", bytes_remaining, XGetAtomName (display, cs->property)); cs->wait_object =3D expect_property_change (display, window, cs->property, @@ -638,7 +651,7 @@ =20 /* XChangeProperty expects an array of long even if long is more than 32 bits. */ - value[0] =3D bytes_remaining; + value[0] =3D min (bytes_remaining, X_ULONG_MAX); XChangeProperty (display, window, cs->property, dpyinfo->Xatom_INCR, 32, PropModeReplace, (unsigned char *) value, 1); @@ -672,7 +685,8 @@ int had_errors =3D x_had_errors_p (display); UNBLOCK_INPUT; =20 - bytes_remaining =3D cs->size * format_bytes; + bytes_remaining =3D cs->size; + bytes_remaining *=3D format_bytes; =20 /* Wait for the requester to ack by deleting the property. This can run Lisp code (process handlers) or signal. */ @@ -810,7 +824,7 @@ non-None property. */ Window requestor =3D SELECTION_EVENT_REQUESTOR (event); Lisp_Object multprop; - int j, nselections; + ptrdiff_t j, nselections; =20 if (property =3D=3D None) goto DONE; multprop @@ -1269,19 +1283,28 @@ =20 static void x_get_window_property (Display *display, Window window, Atom property, - unsigned char **data_ret, int *bytes_ret, + unsigned char **data_ret, ptrdiff_t *bytes_ret, Atom *actual_type_ret, int *actual_format_ret, unsigned long *actual_size_ret, int delete_p) { - int total_size; + ptrdiff_t total_size; unsigned long bytes_remaining; - int offset =3D 0; + ptrdiff_t offset =3D 0; + unsigned char *data =3D 0; unsigned char *tmp_data =3D 0; int result; - int buffer_size =3D SELECTION_QUANTUM (display); - - if (buffer_size > MAX_SELECTION_QUANTUM) - buffer_size =3D MAX_SELECTION_QUANTUM; + int buffer_size =3D selection_quantum (display); + + /* Wide enough to avoid overflow in expressions using it. */ + ptrdiff_t x_long_size =3D X_LONG_SIZE; + + /* Maximum value for TOTAL_SIZE. It cannot exceed PTRDIFF_MAX - 1 + and SIZE_MAX - 1, for an extra byte at the end. And it cannot + exceed LONG_MAX * X_LONG_SIZE, for XGetWindowProperty. */ + ptrdiff_t total_size_max =3D + ((min (PTRDIFF_MAX, SIZE_MAX) - 1) / x_long_size < LONG_MAX + ? min (PTRDIFF_MAX, SIZE_MAX) - 1 + : LONG_MAX * x_long_size); =20 BLOCK_INPUT; =20 @@ -1292,49 +1315,44 @@ actual_size_ret, &bytes_remaining, &tmp_data); if (result !=3D Success) - { - UNBLOCK_INPUT; - *data_ret =3D 0; - *bytes_ret =3D 0; - return; - } + goto done; =20 /* This was allocated by Xlib, so use XFree. */ XFree ((char *) tmp_data); =20 if (*actual_type_ret =3D=3D None || *actual_format_ret =3D=3D 0) - { - UNBLOCK_INPUT; - return; - } + goto done; =20 - total_size =3D bytes_remaining + 1; - *data_ret =3D (unsigned char *) xmalloc (total_size); + if (total_size_max < bytes_remaining) + goto size_overflow; + total_size =3D bytes_remaining; + data =3D malloc (total_size + 1); + if (! data) + goto memory_exhausted; =20 /* Now read, until we've gotten it all. */ while (bytes_remaining) { -#ifdef TRACE_SELECTION - unsigned long last =3D bytes_remaining; -#endif + ptrdiff_t bytes_gotten; + int bytes_per_item; result =3D XGetWindowProperty (display, window, property, - (long)offset/4, (long)buffer_size/4, + offset / X_LONG_SIZE, + buffer_size / X_LONG_SIZE, False, AnyPropertyType, actual_type_ret, actual_format_ret, actual_size_ret, &bytes_remaining, &tmp_data); =20 - TRACE2 ("Read %lu bytes from property %s", - last - bytes_remaining, - XGetAtomName (display, property)); - /* If this doesn't return Success at this point, it means that some clod deleted the selection while we were in the midst of reading it. Deal with that, I guess.... */ if (result !=3D Success) break; =20 + bytes_per_item =3D *actual_format_ret >> 3; + xassert (*actual_size_ret <=3D buffer_size / bytes_per_item); + /* The man page for XGetWindowProperty says: "If the returned format is 32, the returned data is represented as a long array and should be cast to that type to obtain the @@ -1348,32 +1366,61 @@ The bytes and offsets passed to XGetWindowProperty refers to th= e property and those are indeed in 32 bit quantities if format is= 32. */ =20 + bytes_gotten =3D *actual_size_ret; + bytes_gotten *=3D bytes_per_item; + + TRACE2 ("Read %"pD"d bytes from property %s", + bytes_gotten, XGetAtomName (display, property)); + + if (total_size - offset < bytes_gotten) + { + unsigned char *data1; + ptrdiff_t remaining_lim =3D total_size_max - offset - bytes_gotten; + if (remaining_lim < 0 || remaining_lim < bytes_remaining) + goto size_overflow; + total_size =3D offset + bytes_gotten + bytes_remaining; + data1 =3D realloc (data, total_size + 1); + if (! data1) + goto memory_exhausted; + data =3D data1; + } + if (32 < BITS_PER_LONG && *actual_format_ret =3D=3D 32) { unsigned long i; - int *idata =3D (int *) ((*data_ret) + offset); + int *idata =3D (int *) (data + offset); long *ldata =3D (long *) tmp_data; =20 for (i =3D 0; i < *actual_size_ret; ++i) - { - idata[i]=3D (int) ldata[i]; - offset +=3D 4; - } + idata[i] =3D ldata[i]; } else - { - *actual_size_ret *=3D *actual_format_ret / 8; - memcpy ((*data_ret) + offset, tmp_data, *actual_size_ret); - offset +=3D *actual_size_ret; - } + memcpy (data + offset, tmp_data, bytes_gotten); + + offset +=3D bytes_gotten; =20 /* This was allocated by Xlib, so use XFree. */ XFree ((char *) tmp_data); } =20 XFlush (display); + data[offset] =3D '\0'; + + done: UNBLOCK_INPUT; + *data_ret =3D data; *bytes_ret =3D offset; + return; + + size_overflow: + free (data); + UNBLOCK_INPUT; + memory_full (SIZE_MAX); + + memory_exhausted: + free (data); + UNBLOCK_INPUT; + memory_full (total_size + 1); } =0C /* Use xfree, not XFree, to free the data obtained with this function. = */ @@ -1382,16 +1429,19 @@ receive_incremental_selection (Display *display, Window window, Atom pro= perty, Lisp_Object target_type, unsigned int min_size_bytes, - unsigned char **data_ret, int *size_bytes_ret, + unsigned char **data_ret, + ptrdiff_t *size_bytes_ret, Atom *type_ret, int *format_ret, unsigned long *size_ret) { - int offset =3D 0; + ptrdiff_t offset =3D 0; struct prop_location *wait_object; + if (min (PTRDIFF_MAX, SIZE_MAX) < min_size_bytes) + memory_full (SIZE_MAX); + *data_ret =3D (unsigned char *) xmalloc (min_size_bytes); *size_bytes_ret =3D min_size_bytes; - *data_ret =3D (unsigned char *) xmalloc (*size_bytes_ret); =20 - TRACE1 ("Read %d bytes incrementally", min_size_bytes); + TRACE1 ("Read %u bytes incrementally", min_size_bytes); =20 /* At this point, we have read an INCR property. Delete the property to ack it. @@ -1416,7 +1466,7 @@ while (1) { unsigned char *tmp_data; - int tmp_size_bytes; + ptrdiff_t tmp_size_bytes; =20 TRACE0 (" Wait for property change"); wait_for_property_change (wait_object); @@ -1429,7 +1479,7 @@ &tmp_data, &tmp_size_bytes, type_ret, format_ret, size_ret, 1); =20 - TRACE1 (" Read increment of %d bytes", tmp_size_bytes); + TRACE1 (" Read increment of %"pD"d bytes", tmp_size_bytes); =20 if (tmp_size_bytes =3D=3D 0) /* we're done */ { @@ -1452,11 +1502,10 @@ XFlush (display); UNBLOCK_INPUT; =20 - if (*size_bytes_ret < offset + tmp_size_bytes) - { - *size_bytes_ret =3D offset + tmp_size_bytes; - *data_ret =3D (unsigned char *) xrealloc (*data_ret, *size_bytes_ret)= ; - } + if (*size_bytes_ret - offset < tmp_size_bytes) + *data_ret =3D xpalloc (*data_ret, size_bytes_ret, + tmp_size_bytes - (*size_bytes_ret - offset), + -1, 1); =20 memcpy ((*data_ret) + offset, tmp_data, tmp_size_bytes); offset +=3D tmp_size_bytes; @@ -1482,7 +1531,7 @@ int actual_format; unsigned long actual_size; unsigned char *data =3D 0; - int bytes =3D 0; + ptrdiff_t bytes =3D 0; Lisp_Object val; struct x_display_info *dpyinfo =3D x_display_info_for_display (display= ); =20 @@ -1574,7 +1623,7 @@ =20 static Lisp_Object selection_data_to_lisp_data (Display *display, const unsigned char *data= , - int size, Atom type, int format) + ptrdiff_t size, Atom type, int format) { struct x_display_info *dpyinfo =3D x_display_info_for_display (display= ); =20 @@ -1607,7 +1656,7 @@ /* Treat ATOM_PAIR type similar to list of atoms. */ || type =3D=3D dpyinfo->Xatom_ATOM_PAIR) { - int i; + ptrdiff_t i; /* On a 64 bit machine sizeof(Atom) =3D=3D sizeof(long) =3D=3D 8. But the callers of these function has made sure the data for format =3D=3D 32 is an array of int. Thus, use int instead @@ -1634,28 +1683,29 @@ else if (format =3D=3D 32 && size =3D=3D sizeof (int)) return INTEGER_TO_CONS (((unsigned int *) data) [0]); else if (format =3D=3D 16 && size =3D=3D sizeof (short)) - return make_number ((int) (((unsigned short *) data) [0])); + return make_number (((unsigned short *) data) [0]); =20 /* Convert any other kind of data to a vector of numbers, represented as above (as an integer, or a cons of two 16 bit integers.) */ else if (format =3D=3D 16) { - int i; + ptrdiff_t i; Lisp_Object v; v =3D Fmake_vector (make_number (size / 2), make_number (0)); for (i =3D 0; i < size / 2; i++) { - int j =3D (int) ((unsigned short *) data) [i]; + EMACS_INT j =3D ((unsigned short *) data) [i]; Faset (v, make_number (i), make_number (j)); } return v; } else { - int i; - Lisp_Object v =3D Fmake_vector (make_number (size / 4), make_numbe= r (0)); - for (i =3D 0; i < size / 4; i++) + ptrdiff_t i; + Lisp_Object v =3D Fmake_vector (make_number (size / X_LONG_SIZE), + make_number (0)); + for (i =3D 0; i < size / X_LONG_SIZE; i++) { unsigned int j =3D ((unsigned int *) data) [i]; Faset (v, make_number (i), INTEGER_TO_CONS (j)); @@ -1670,7 +1720,7 @@ static void lisp_data_to_selection_data (Display *display, Lisp_Object obj, unsigned char **data_ret, Atom *type_ret, - unsigned int *size_ret, + ptrdiff_t *size_ret, int *format_ret, int *nofree_ret) { Lisp_Object type =3D Qnil; @@ -1707,22 +1757,20 @@ } else if (SYMBOLP (obj)) { - *format_ret =3D 32; - *size_ret =3D 1; *data_ret =3D (unsigned char *) xmalloc (sizeof (Atom) + 1); + *format_ret =3D 32; + *size_ret =3D 1; (*data_ret) [sizeof (Atom)] =3D 0; (*(Atom **) data_ret) [0] =3D symbol_to_x_atom (dpyinfo, obj); if (NILP (type)) type =3D QATOM; } - else if (INTEGERP (obj) - && XINT (obj) < 0xFFFF - && XINT (obj) > -0xFFFF) + else if (RANGED_INTEGERP (0, obj, X_USHRT_MAX)) { + *data_ret =3D (unsigned char *) xmalloc (sizeof (short) + 1); *format_ret =3D 16; *size_ret =3D 1; - *data_ret =3D (unsigned char *) xmalloc (sizeof (short) + 1); (*data_ret) [sizeof (short)] =3D 0; - (*(short **) data_ret) [0] =3D (short) XINT (obj); + (*(unsigned short **) data_ret) [0] =3D XINT (obj); if (NILP (type)) type =3D QINTEGER; } else if (INTEGERP (obj) @@ -1731,11 +1779,11 @@ || (CONSP (XCDR (obj)) && INTEGERP (XCAR (XCDR (obj))))))) { - *format_ret =3D 32; - *size_ret =3D 1; *data_ret =3D (unsigned char *) xmalloc (sizeof (long) + 1); + *format_ret =3D 32; + *size_ret =3D 1; (*data_ret) [sizeof (long)] =3D 0; - (*(unsigned long **) data_ret) [0] =3D cons_to_unsigned (obj, ULON= G_MAX); + (*(unsigned long **) data_ret) [0] =3D cons_to_unsigned (obj, X_UL= ONG_MAX); if (NILP (type)) type =3D QINTEGER; } else if (VECTORP (obj)) @@ -1744,50 +1792,50 @@ a set of 16 or 32 bit INTEGERs; or a set of ATOM_PAIRs (represented as [[A1 A2] [A3 A4] ...] */ - int i; + ptrdiff_t i; + ptrdiff_t size =3D ASIZE (obj); =20 if (SYMBOLP (XVECTOR (obj)->contents [0])) /* This vector is an ATOM set */ { if (NILP (type)) type =3D QATOM; - *size_ret =3D ASIZE (obj); - *format_ret =3D 32; - for (i =3D 0; i < *size_ret; i++) + for (i =3D 0; i < size; i++) if (!SYMBOLP (XVECTOR (obj)->contents [i])) signal_error ("All elements of selection vector must have same ty= pe", obj); =20 - *data_ret =3D (unsigned char *) xmalloc ((*size_ret) * sizeof (Atom))= ; - for (i =3D 0; i < *size_ret; i++) + *data_ret =3D xnmalloc (size, sizeof (Atom)); + *format_ret =3D 32; + *size_ret =3D size; + for (i =3D 0; i < size; i++) (*(Atom **) data_ret) [i] =3D symbol_to_x_atom (dpyinfo, XVECTOR (obj)->contents [i]); } else /* This vector is an INTEGER set, or something like it */ { - int data_size =3D 2; - *size_ret =3D ASIZE (obj); + int format =3D 16; + int data_size =3D sizeof (short); if (NILP (type)) type =3D QINTEGER; - *format_ret =3D 16; - for (i =3D 0; i < *size_ret; i++) - if (CONSP (XVECTOR (obj)->contents [i])) - *format_ret =3D 32; - else if (!INTEGERP (XVECTOR (obj)->contents [i])) - signal_error (/* Qselection_error */ - "Elements of selection vector must be integers or conses of integers= ", - obj); - - /* Use sizeof(long) even if it is more than 32 bits. See comm= ent - in x_get_window_property and x_fill_property_data. */ - - if (*format_ret =3D=3D 32) data_size =3D sizeof(long); - *data_ret =3D (unsigned char *) xmalloc (*size_ret * data_size); - for (i =3D 0; i < *size_ret; i++) - if (*format_ret =3D=3D 32) + for (i =3D 0; i < size; i++) + if (X_USHRT_MAX + < cons_to_unsigned (XVECTOR (obj)->contents[i], X_ULONG_MAX)) + { + /* Use sizeof (long) even if it is more than 32 bits. + See comment in x_get_window_property and + x_fill_property_data. */ + data_size =3D sizeof (long); + format =3D 32; + } + *data_ret =3D xnmalloc (size, data_size); + *format_ret =3D format; + *size_ret =3D size; + for (i =3D 0; i < size; i++) + if (format =3D=3D 32) (*((unsigned long **) data_ret)) [i] =3D - cons_to_unsigned (XVECTOR (obj)->contents [i], ULONG_MAX); + cons_to_unsigned (XVECTOR (obj)->contents[i], X_ULONG_MAX); else (*((unsigned short **) data_ret)) [i] =3D - cons_to_unsigned (XVECTOR (obj)->contents [i], USHRT_MAX); + cons_to_unsigned (XVECTOR (obj)->contents[i], X_USHRT_MAX); } } else @@ -1817,8 +1865,8 @@ } if (VECTORP (obj)) { - int i; - int size =3D ASIZE (obj); + ptrdiff_t i; + ptrdiff_t size =3D ASIZE (obj); Lisp_Object copy; if (size =3D=3D 1) return clean_local_selection_data (XVECTOR (obj)->contents [0]); @@ -2213,6 +2261,8 @@ else if (CONSP (o) && (! NUMBERP (XCAR (o)) || ! NUMBERP (XCDR (o)))) return -1; + if (size =3D=3D INT_MAX) + return -1; size++; } =20 @@ -2294,8 +2344,11 @@ x_property_data_to_lisp (struct frame *f, const unsigned char *data, Atom type, int format, long unsigned int size) { + ptrdiff_t format_bytes =3D format >> 3; + if (PTRDIFF_MAX / format_bytes < size) + memory_full (SIZE_MAX); return selection_data_to_lisp_data (FRAME_X_DISPLAY (f), - data, size*format/8, type, format)= ; + data, size * format_bytes, type, format); } =20 /* Get the mouse position in frame relative coordinates. */ @@ -2405,10 +2458,10 @@ if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof *dpyinfo->x_dnd_atoms / 2 < dpyinfo->x_dnd_atoms_size) memory_full (SIZE_MAX); + dpyinfo->x_dnd_atoms =3D xrealloc (dpyinfo->x_dnd_atoms, + (2 * sizeof *dpyinfo->x_dnd_atoms + * dpyinfo->x_dnd_atoms_size)); dpyinfo->x_dnd_atoms_size *=3D 2; - dpyinfo->x_dnd_atoms =3D xrealloc (dpyinfo->x_dnd_atoms, - sizeof (*dpyinfo->x_dnd_atoms) - * dpyinfo->x_dnd_atoms_size); } =20 dpyinfo->x_dnd_atoms[dpyinfo->x_dnd_atoms_length++] =3D x_atom; @@ -2426,7 +2479,7 @@ unsigned long size =3D 160/event->format; int x, y; unsigned char *data =3D (unsigned char *) event->data.b; - int idata[5]; + unsigned int idata[5]; ptrdiff_t i; =20 for (i =3D 0; i < dpyinfo->x_dnd_atoms_length; ++i) @@ -2444,7 +2497,7 @@ if (32 < BITS_PER_LONG && event->format =3D=3D 32) { for (i =3D 0; i < 5; ++i) /* There are only 5 longs in a ClientMes= sage. */ - idata[i] =3D (int) event->data.l[i]; + idata[i] =3D event->data.l[i]; data =3D (unsigned char *) idata; } =20 =3D=3D=3D modified file 'src/xsmfns.c' --- src/xsmfns.c 2011-06-21 20:32:19 +0000 +++ src/xsmfns.c 2011-08-05 02:15:35 +0000 @@ -223,9 +223,11 @@ props[props_idx]->name =3D xstrdup (SmRestartCommand); props[props_idx]->type =3D xstrdup (SmLISTofARRAY8); /* /path/to/emacs, --smid=3Dxxx --no-splash --chdir=3Ddir ... */ + if (INT_MAX - 3 < initial_argc) + memory_full (SIZE_MAX); i =3D 3 + initial_argc; props[props_idx]->num_vals =3D i; - vp =3D (SmPropValue *) xmalloc (i * sizeof(*vp)); + vp =3D xnmalloc (i, sizeof *vp); props[props_idx]->vals =3D vp; props[props_idx]->vals[vp_idx].length =3D strlen (emacs_program); props[props_idx]->vals[vp_idx++].value =3D emacs_program; =3D=3D=3D modified file 'src/xterm.c' --- src/xterm.c 2011-08-04 11:06:22 +0000 +++ src/xterm.c 2011-08-05 02:19:34 +0000 @@ -1659,19 +1659,18 @@ if (dpyinfo->color_cells =3D=3D NULL) { Screen *screen =3D dpyinfo->screen; + int ncolor_cells =3D XDisplayCells (dpy, XScreenNumberOfScreen (sc= reen)); int i; =20 - dpyinfo->ncolor_cells - =3D XDisplayCells (dpy, XScreenNumberOfScreen (screen)); - dpyinfo->color_cells - =3D (XColor *) xmalloc (dpyinfo->ncolor_cells - * sizeof *dpyinfo->color_cells); + dpyinfo->color_cells =3D xnmalloc (ncolor_cells, + sizeof *dpyinfo->color_cells); + dpyinfo->ncolor_cells =3D ncolor_cells; =20 - for (i =3D 0; i < dpyinfo->ncolor_cells; ++i) + for (i =3D 0; i < ncolor_cells; ++i) dpyinfo->color_cells[i].pixel =3D i; =20 XQueryColors (dpy, dpyinfo->cmap, - dpyinfo->color_cells, dpyinfo->ncolor_cells); + dpyinfo->color_cells, ncolor_cells); } =20 *ncells =3D dpyinfo->ncolor_cells; @@ -4224,7 +4223,7 @@ x_send_scroll_bar_event and x_scroll_bar_to_input_event. */ =20 static struct window **scroll_bar_windows; -static size_t scroll_bar_windows_size; +static ptrdiff_t scroll_bar_windows_size; =20 =20 /* Send a client message with message type Xatom_Scrollbar for a @@ -4239,7 +4238,7 @@ XClientMessageEvent *ev =3D (XClientMessageEvent *) &event; struct window *w =3D XWINDOW (window); struct frame *f =3D XFRAME (w->frame); - size_t i; + ptrdiff_t i; =20 BLOCK_INPUT; =20 @@ -4260,16 +4259,15 @@ =20 if (i =3D=3D scroll_bar_windows_size) { - size_t new_size =3D max (10, 2 * scroll_bar_windows_size); - size_t nbytes =3D new_size * sizeof *scroll_bar_windows; - size_t old_nbytes =3D scroll_bar_windows_size * sizeof *scroll_bar= _windows; - - if ((size_t) -1 / sizeof *scroll_bar_windows < new_size) - memory_full (SIZE_MAX); - scroll_bar_windows =3D (struct window **) xrealloc (scroll_bar_win= dows, - nbytes); + ptrdiff_t old_nbytes =3D + scroll_bar_windows_size * sizeof *scroll_bar_windows; + ptrdiff_t nbytes; + enum { XClientMessageEvent_MAX =3D 0x7fffffff }; + scroll_bar_windows =3D + xpalloc (scroll_bar_windows, &scroll_bar_windows_size, 1, + XClientMessageEvent_MAX, sizeof *scroll_bar_windows); + nbytes =3D scroll_bar_windows_size * sizeof *scroll_bar_windows; memset (&scroll_bar_windows[i], 0, nbytes - old_nbytes); - scroll_bar_windows_size =3D new_size; } =20 scroll_bar_windows[i] =3D w; @@ -5847,11 +5845,12 @@ } inev; int count =3D 0; int do_help =3D 0; - int nbytes =3D 0; + ptrdiff_t nbytes =3D 0; struct frame *f =3D NULL; struct coding_system coding; XEvent event =3D *eventptr; Mouse_HLInfo *hlinfo =3D &dpyinfo->mouse_highlight; + USE_SAFE_ALLOCA; =20 *finish =3D X_EVENT_NORMAL; =20 @@ -6547,7 +6546,7 @@ } =20 { /* Raw bytes, not keysym. */ - register int i; + ptrdiff_t i; int nchars, len; =20 for (i =3D 0, nchars =3D 0; i < nbytes; i++) @@ -6560,7 +6559,6 @@ if (nchars < nbytes) { /* Decode the input data. */ - int require; =20 /* The input should be decoded with `coding_system' which depends on which X*LookupString function @@ -6573,9 +6571,9 @@ gives us composition information. */ coding.common_flags &=3D ~CODING_ANNOTATION_MASK; =20 - require =3D MAX_MULTIBYTE_LENGTH * nbytes; - coding.destination =3D alloca (require); - coding.dst_bytes =3D require; + SAFE_NALLOCA (coding.destination, MAX_MULTIBYTE_LENGTH, + nbytes); + coding.dst_bytes =3D MAX_MULTIBYTE_LENGTH * nbytes; coding.mode |=3D CODING_MODE_LAST_BLOCK; decode_coding_c_string (&coding, copy_bufptr, nbytes, Qnil); nbytes =3D coding.produced; @@ -7034,6 +7032,7 @@ count++; } =20 + SAFE_FREE (); *eventptr =3D event; return count; } @@ -9858,6 +9857,7 @@ struct x_display_info *dpyinfo; XrmDatabase xrdb; Mouse_HLInfo *hlinfo; + ptrdiff_t lim; =20 BLOCK_INPUT; =20 @@ -10076,12 +10076,15 @@ XSetAfterFunction (x_current_display, x_trace_wire); #endif /* ! 0 */ =20 + lim =3D min (PTRDIFF_MAX, SIZE_MAX) - sizeof "@"; + if (lim - SBYTES (Vinvocation_name) < SBYTES (Vsystem_name)) + memory_full (SIZE_MAX); dpyinfo->x_id_name =3D (char *) xmalloc (SBYTES (Vinvocation_name) + SBYTES (Vsystem_name) + 2); - sprintf (dpyinfo->x_id_name, "%s@%s", - SSDATA (Vinvocation_name), SSDATA (Vsystem_name)); + strcat (strcat (strcpy (dpyinfo->x_id_name, SSDATA (Vinvocation_name))= , "@"), + SSDATA (Vsystem_name)); =20 /* Figure out which modifier bits mean what. */ x_find_modifier_meanings (dpyinfo); # Begin bundle IyBCYXphYXIgcmV2aXNpb24gYnVuZGxlIHY0CiMKQlpoOTFBWSZTWXkU8k0BAh7/gH/wAht7/= /// /+///7////5hFD48ADuDOnnt4vePcAEPTl7vdN5lA7DegLe57gAB333wAUDtFUqrse9e3dHcA= Bbm 7n3qIi+0hkbPdtgMhJSgK9ooH3r5zWin2x57fRpdMSMQej609HnvO482rVO+u87zDq9Pg3ePY= PiZ 0gAGfQ6oeb6rnI+A5g6DQg5C2Bau+XUCPij3y8gj3x3oAO+16HvW19dHTtgX3u9dej3mVFWbf= fVs Pt9bfdm7u7F2awg77Du9uNt67vd1fZqu9h1RLm3j77Hvu98PKhRJEpdfcu3BaZrVVBL68ehtP= Qq9 g1Qus+7rmkbWYqhePgPep7bfXczYDNaNm1r20RKPfffAe2zvC+6fJttBWmtpZSUDnfAI8vWml= qrR Y1pazRQvXeBd7wR2y0Zpo0tpKDWnH3wPj76jfY5UjsxrKqkqnLvA97pg9UusK0YlBRx6Dvr5K= oN0 UACAopIEigFAVQPobYGpCJYW192bOB8eOSvqeVT0ypF2lkWHhUFHQDW5JCKFo1Rg4pSM4ClQ0= uqw Vyx0JBKDS5QEgrdcycpZQB948Hbe73nvt74HlQAkVuI59edE7rnHYbwARvr3HkA+gZABJ71AS= Jqh lDAAHQUIgUAUSCgdGQBQpoAYSQdmFAKCVVJQEBAiJAVCooUAAAKlFQBSCEEBUgFBJXfPernHd= 92+ dA+7IRAqhBQDb57BpPj3D5EFKKPZgFKAKAUEgoSFUAiABCUEAIAhNAhpNMgJpNMNJqntIR5T0= YSa PQIG0aRkDTQBEEIU01U/U2JT2TU9UZtU8poyDQAAAAAAaNA0xASqI0hpkaNU/VHqeUeoB6R6n= qeo DQAA0AAAAAk0kQiCGhNA0TTRppPU9T0U8pPMUh+kjJiZPSDQDQeoB6giSIIAjQAJiaaAE0aaE= yE0 aGpPCHopqNojQ0HqfqCSIACZJEimKemmSeUfqSDNTEZADQAAAAAB0D/tqRPHgPrj7PShRkRA4= ovl EFbZjQSDaAFEAZBSEEPtFWogqyAppgEglEZFqmgIorig/COUf2lv9q/8f4NIQ4ZORF4awFVER= RYg LBgkEGAiLCRYAsFIwT9VKLGMigjIsWCxRRRiIigsiogKAjERRRAVAVREVSCKiRiJAUWSIiCiL= BSK QYkEQYqgjFFCKyIMkWKAkSRGIgisAQWMUjFZFRBRiIixQQWIKIKIgplsiIsSASDWirFgAKQms= cyE ioqKLIpEYjICMUUgqhFARUVSRYLAUgLGIqOj8PZfNDummTTzd/3usK3+P/fThDY1Jv/bSprxP= 7zQ QjA/C1261x/VeYT98ESH7P/wh6Kge3VI2AbJDj1/Du8P5P8mR1P+DMoWr+3Zw/asRSDAxFhtL= +79 0YqqV2DYWAaZIlI/65E6UPzbIb0Yh2uyazi8dngL/nu1JxHgo7sPkyJCiLh2cYqszybW3n4df= 8vD /f/i8U7/85eyrjlcG+1oQhtFQcZiEBgVQUkyqqr4Zz8IkvFmOtCy93j5KQk1WZcdzu0IIS/1k= Joq l5KshJfHw+j067vn2O6d4u6Xfa4va7MKxtp8c1k63fSlrfG9pnm60Wdy0T+eXBPC3wT15Og7a= 7ui 36f+OJ6/QGEBkR9UaiJJJIgxhqooPAtBYDGKg/SlVATGh6WyRFYiAjBERRnzh7x9mX7NZmrpO= O29 K8Upr60yQ0gf0H6tXFZYydNGyjN2GGCSj9csPEBTGHGrSuwpNlmyCaPj+UnYt0ZUtaW6VzO5Y= q08 a5+36t/Z7dsewSCUBQgKQqdcqMiDEPSfZm/Z6uNTTRZ8iFOzxhYD3f/fvn9769zKwyQ5PTsck= E+J /2YpxTB/yID5/X0z8NdDU62bI7R1Kekhnx/j54pbjZETz6Y2I/9Wu+5o2DphuufJyvvjpsj7b= SXV cu3rZPyOpu2ss73ohYGLNHGqppjPusfQ/rUFYAsCK5r41NQ/rzE6ZqEgyW0z1auJMsCnjjQQH= 2Ep E44rpOyXtJ4R88PI9R17rE/lYqR+Zfoz6emXl5LN1NdhqUXzydOzXO6Q0TzL7AZG3nNZc3M2t= cvK mzdyNEocsuxU5qs8KXUL3r4KQ8ZWGyyFXSJclqsnLmHVsdTBOUwg28LMnIuprlB5ACJ0APBRF= +W6 z3MM9dnu+coKC8K8JPagaYcG7J7kOGOUkqoo6vwTEHjvnHHOThArTVoqatlQ4QNMXvs/z5qEg= geD pFctMtZ9aBeaHXFKwrpiimJpCcMkWGkWcMv2d+/1b2zva9v8eYqNukU9ckIsICyBUkDSKYoxO= mq5 SpLWhKwKzrWg096dYHgk64ou0xlF7LYGMDBP6UMPKmk6awrUlSdJ4cUrNuIQtpTvmctSdnlDh= OmV kFWbZWKooGIVix/Raqpq2GmFYqxTxSsFFI/hYFdW1IWIH0/H6Jfn+PxTM+k+L7IOin541R+sb= vTL stP1ilu0riluspgwtme8u7e7/AO3/oO14Vrf6mMj9Yb/yTP12XTk1+6pXGJ5+8ry3LWvIbxyv= myP 4+JWGt/4nZmfUE5ivocW58fqYn9APodr+A2v8QPsSeR0VNKD8lZfBDdoSMWdqewtldRndllb/= uQb 8Bm7svTV12ZdLu1pUIOsW3fDd3XX/uGX+Wp+4LW1+F2x+mPyDr0pf0G+Ca/j8l3J6nguLI/cB= 4PB 3HHHzmoat7F08nKxm6hwRa0KkLjw9t07gpmd4i5zZ5aLF8nlVsw5rJ07inVtjhW/S+kjH06n1= zZq +DJo96zk41l73UQZqmyMNZTPFPx+H3/1FT9aBuNj8fxf93+U8BxUQHqWSQiYmotjCLHGsJeGM= Sxs hi9P1w+2FfAmrZ8yxU96lP9v2fTCQ+jfIVcsVOfN36G6ee/l2/XemUKDpNbvWLWWpq5i7Wjnz= Zmk REusrng4Yatr0/Nqu8SRUqSIqXBNQSCFKWNuSjcjGEhwVCXt1h2cTZ8eJWTvSk+drso1cvjhr= Pq1 dJxtyoYqNtG5nCV0r29h5w1/vYHz9lpfHzfU81/lYaX5W7Hj48vhR1yc8vnsnGq5sdm7eTdVX= WST idDAYJ/GR8z+xy0YOl1bqLiv5o2csfZMiSDMuyRUhv8li6E/M1DRuwrJYIQKISBhkoCm/DCou= 2UZ 3ZtVU0hrClvOSppCXNYTE0lGS7cxaysttayUYgWU2UBYMmD8LyRJAtBElEP2D7uzv1/OMm/Iv= g6N bfk634/PXm1FYootZUULRpUWRZY2pYsRrEaiI2i0YoNWxEgqN9aNtCra0o2ygxYvn4a6T9Dfb= ma7 enmb1r3pJA0h+5hWtW1SjRJCpUKytbbWSUpQttalayHuEoiMxrUrCSdeWzffx7Hjt64zjco7c= H4b m7tjJi8t5t1E48KsTJDzby1xLh2E8jT2mb7ezhQaq70692nr3ML251z1q7cus0jOHVZ7snBTd= YJt 8k3t3m2qNU22becKSE7dNmame5CqpLFtdNccd69pPZ6+0ul8PXWcxjHEdIN2+yMN+SFCxuGun= Wtc c5r1deo8lRQQR8rT4fPmk0t/S1wrCdU/DK3dnMhAA0R448cd5voOOWxpHCC4wpnsST0SKRTpn= SGM IoTaFQhy8odJwkNpJjAqGmQMYQOmThmJpkhtgLOOLj6IKVxIYwxxnTAxxhpk4SG2VA2ysDswN= ptC SClZCdcu8rJJyhWcbuMXSbYThMQD2oVkBYHZqHLiAFSGIsi6vOEqAL3YGJwnHVOU7odkA2wOm= coH PehicRS8KyoxghpiGUcYOUUQtFC8QdA5QEnuoXPYr6/KzgwYvdvh5hZ3s2sfqLqrScy9fm2Lg= CCH 0/byICeWsuVTJTbyGNoKDAzhh62YhgmMLkz0pNQ2yQrJtiyGxlSVgs06VgLIno6VQtcA2xERm= IJA kEZX5/o+cPl6fTaE8RMwfoMoLaQhuRImtoIa6u6Ss46ufqIu8sTN6Xpo4dPZ23k3t0wiSxWzN= rGl V7Yqrc7xdkGhebtGoGPamLGVZMojjPS+sJO3hkizXbWXXVlCZem1RO1WWcDgzPOya5U55OppO= qo3 tzdTrWijrd8thbj7MXHMmtjlQzLvtCa13ObivS8c3dokFsJpEX2TT2wzU7ieZcn8BgSY9I1jD= 3cB FGIEAxonPBULUuLuQsu6asLlNVuT2byuXGg5lVWISr5Aq6tZs4w7y90T3U96cumJ8BERl1WeH= Ed7 ZmWKvERuX5dQW4KHX267QyaFSh4jiHUr13fidRtbXeNRhE26l7gNVdzYiTt9Y2pOSgRRPQqSn= Gne cgSULGPLTxcpR18uLvneuZXGrxKqE63qDvUUcVJUNd4RbizOvOu4HWmbNOlk9Y6UMuzkE6KBk= dMn cOVUum2kneHiIq2UbSwM6hcTXnko+SIgUSOyqFDx8JzasdKzl2ZTynxCIxezweJLKcaqKAooI= hFR unw0oCIkO3h4LJo4oUF+evuA6Yu2hgGGBI4x9sxrNyJlXHNPNTa1EiFaPr691bt2oNZq1tbPp= t2h 6n0HlE4ln8SQkCTvD/i/G0BYsS37sKMFUVGIwtgUFBVikFV9WZAxBQKlEiQYIMQFYjC2gjFZG= RRB EGKxVjBVdWFFREVVjBigikRYRZiSqW1iyCrFRRBisUESMZFIoiCgiwYCxQEVUFIgwgpIMQQRR= EFB WMjFtlYopGCqS2FhMymQDY0ylj+TWIrFJjCrBBP7bRMs3MmUx+0D/Wwku9RQ+dCswoWMFKVQw= C3W mExIBmRQyYKQRy0dx4HfPDuzP2yAp0aGxaxT/uRC8uwZQXqoKQrRqoiqqkQVrCiPlSiKqoqwW= MYi RgxRYsUUVZMLYKKqqRBkKpQtbIqtqFlZbEtBrCqkIKALICqAiVKqMEGsoS2yFSiwXMMkxSq0r= UVW DG2awmMwtsPT6z7v9vB9nh8ZP9LQUpx8e/y+qf3FxUzqTwlfn8HPwkfJuQgB9w0Py+w9tRzcq= gdf POOiZbGGkpYTn46Jyicfs9lEoOb/bBHvTENFAY3/oPAppp1KY/UEHPrRi86f/FU8CpoTm6EFI= s8f vT8HU/pi/keKmiQqf8jEBojIcfo5gn9R52sB/RyMIXUEuHcUDy7HQEc19uC85znhQaxT6ZGnE= cRR yivoLJxGiQuT+7zUA48Uw7ewsDnjyU/3qv/LwIIMKomqUzRsJnqRGRTY/6OXTtw5JI2v7rX1n= jSd HD/itfo5CnQmPhusceki0bJaM7q3Kngiw9lYSJrENgIn+kQU+7TkrDjrxz8SZKd/f7PdWiwCp= obs ef+Kf4p4LgPSVdk2CoKoCg4h3UMJIeRD0ELn/r3WnWBUyrXNMOi3Z6c8HSGOjQqeiDuyRj8LF= /M8 i8yCMxckxp+R74om2JIemmhkax2TQ1WdrfKjtglog8+NW4rSPttzemVc7IcsO/rrFbX+CPsmX= c9I JO4w3wHd8mOqkOnZRz+5a+4aDqwhoDoptOS5RwvR2hMI7oYhA2VTDqJQdO6n/YYPwSdfwYyqj= nw8 nDU14J69jOdBw4DtqbqEAYFFGVDuQdICqkZN0Yj8zseAopLBLK+3uxCh9k6i3DMB5Q8lXfwFq= LAD g1KdBggByp4fXXxTx3LxT9wutoh97kFox+MGPyKz/j8GsNOzEyylR+6FP8gJcvFEOwCv3ftfz= XF2 iJgptNP4eFCQhvz+SfH3d0T1WTHBRBBRns+qmT4O+/lu8Cg4+tSSGFHMp/VAgCZMepjeC+eR8= do/ lDnmga0mC1hrMC3fjidl8EvV7LRQZBZvdoaZVWadZKp4G8MVCG6jREy0mp7SwqhhWbor8fyKz= x9X YUfJk3F/ZDu7Yy55/0nKTgv1mgaT8w+sv39XBrIurX0yS/sBj60pMKV77NdP/GPh9nq07UYuw= VmM fkvgpVmjvB462iebM8nUV7+BPKuGoo6pJ5K5CrKpWQpUiL847w/dKB3Uqfj+nIx+SJ+asqY+J= U+E z8yWifLJkOO3RWcVbZRcHUD8Gmo8jlj7e24X4tOrLBG0X5RMZvlyJ2q+HqVEef84AE+aT6krK= igp KkrFgLIEUUBYRZAWQWFtFgDaSsCsiQkWKKLBGCixYKQVRYCgIiiIKQRJFWAsFBVIsYkFFiwUg= sUi xYpBRZBYLICqxBkkGARBFgIxRZBQVGEUiyIwERYoKjBVgIigoKKpIsiMFFFAlaoyLJJBSACyC= gCy EltVSLFFFkUWK2gUYsBSCyCMIKCMWCiiiiIqxViIiCkBViMUWRQWKxgqxGCqRZBQFRiiMAWSR= QWE IjIIodT09VT/2OnqgYMv+Zi3AtBHiP80UD74SRQERBL4/D9D9P4n8YflD+j/NOtJNF7IDzKNJ= o2t F4xrL17N1u2L876pHVQ3uF92zt1qo6m06ppdl2ZsXOm+nM6qkM4wZqk82tLmaU3t32+BD93p2= HMg 6DIgEgiSSNCFSCjGRWSKCkMD18J7v8xrST5GurFVFiqorN0dgdT/OojKg7GA03Xhhd9+EzpX7= X6Q MR/gRNeTK1WZzIU5/gMkVXsMknZJaqzq6sLCbSaUfCwKLL59ATNwVEHOQHU3xrCIgxjo5Y2Qm= GjG JDTBBEkpWlVqLIlv0VNfBH1+qJ8uNwsFiJInS27zMX+3jI0ctm7J3wlY4lGp2Cj4EV8UOME0C= FLd mHnwdkJIBmD5DiMu5U5lJiCYq9yRhAdKONkVqrUZfSPjiepnjG9TiiKIuULBgg2eONDLNujbX= Yos pTTTi4lrdQ5l1G0DY8Lm8Fpp5oPZ0ZNSoVWl6xWpVSKm+fX7WmxFPFMwFnhVAghyONbZzBojg= gOZ MWoojH1yJ1oWr5AxwRmQwFqo+BZESRxfwRIJsHVLQO2pMVpUWRm2x2LgQzaTvmC1hTCeeIqYn= EBn pPCfHxskjCM5ac8tPe3piij48RhdoGV0oYQ2fQXTW9zlqC51jyHV9KyM6uGkSpqK368lQzN5+= UYQ O8BL4MAJcvlmw2vCZ14uzePWM6wjSub+gj70jFF149pU7IRgPEAHUgi87MgZWVZwklSjgmZRZ= FwO n1x3HGP7H2d7UMMJXYEpR9ZI/stdohexCMRyVLeP1+dmR+b+Tq7IYycMB/gUInzuvWGvmvvLr= 3eJ I42bSjStbhlorT7U+p1tMWEczN68vWwDljpE5r0xpgIxPZ0xpJg4a1XqKtEzrG8hDoOX1S+zs= vCj KQwc3utiia1ySR3ItB8m9sgZYCsgoqYGvExst43cRvjiHQtxOnAs3pN9vo+iFpQeFANuC2+N1= ULw vRelmFSVWCGLkDT3IG1Egxeq2okxJBI4jNR1TzWKc1lgKZuQLxqpxIIjXmZQNVl5Y6VRw9y0h= GpK ohcgNL6tM2dqk3VudVGNqS614wlaKHYjN74Y4xrp8OMkhmEBy98YJc35RqHipF0YyGQeAQz1F= Rhp 5uJqoj6OPH1ff58X2ddKpXgjgjtVDEDuVrt6cQQQ3j0Xh11ajS2yJjTsSEQkSgQWSWQlluXGF= usm kIwjRFkLFGEGUJsIDwwKK5RhBwLsCFFDStcCYqdfP6wvfvHRGgRZB0GG35PQKIWGs8xjunn2L= DhN o7LtOd8nU1By8vIg8gKwb1RXISQcU3gY5rQQCRuoOk+VgwcUWTSiSVLZ48CwbCQWlAVwUHHal= Uvi Apr1CzhEui7J62KMegxPpdnCMMXSEkZy0kxkrjEEQdMaCBpNIM6btaMSI4ahIMWtYmkLt9JlD= iCZ O0uaEmm2KxYRJiiHmVIDBDIWq25mTRNpSqstgE3NDZJl0xlapxXYzlRf2AfQIgfsMQBVUPcFu= COH YS8s8TwYitqzvPyyUT6OfoX4IXeVUeW2UgEQV7XrpQIPkpopTKC6yR4MstOo8G2u3cxRRw+Is= 8R2 qTxfBQyODUTxkbMmCcMURxFECyLOmSOpSYJZm0FaHHpSlCrx6d4qyjREniBixhDFxfjtzwPFG= iL6 2Fr6XMw48Y0LmjMtiSCSQ/LGriymQ1PDgN1zsAI771jngrwwOjHFcOg5+n971sUSRH0z4dIN8= 8Mz FUJ77gto0CJkqOixEso7Z2TArc31Dd2HeafkYQxDCY5DCHEi3xOLCNhpHSLLPVLDI1qEbI5hD= jJO 2x19tfl8oiY6zveYZVafJ3Yln2GVcOInM050qKVNNe+dO2/Y2MetBhsabLj3I8ZFJRPFRNoSV= S6y y9sS9Mm9wMkH5s2f3B+MfqFZfxweaiA/DtwwXhzCiFFGIWBZgo72yWTyFgUoF2q5CSNCKRnlE= yht TD6bccSRlmQamzFKcG9fyEC169T0c2fEK4gMQzUgFkkZ6cI0EEsiUis13kg3HjJG23vJ8tNWy= emD qCxEyXiEBGSH1TSe2M5DLEycU1DzGGQ/RAm7qsPuCzvRSyDNPjxHGBhgURj7FIswSiu1o5qBO= lHe QwgWeaDOlWEjHcpOnDVYqlEkYSfW5UhGuQqs6UdPDAsuj42Bk0uTj4wG1VXhiU3Kh9qFxUUGO= pDu XEUeui+5BSpI/V/DH6fo/UffO/4t3/H+5kfy5aLN8D2dvstnKM8iL2/m7dqS9c7Q/OHP/W8j6= Lka tcn/MS6EfV7AUBh11L+K7r3gerUEat5kagPNCFYBluG57cEY3h+BMkmhRmcuLx2sOS/abkILm= qYY bUCYIiOZE1Zhfh5PlCUD/tD2k0vzakMg6NJVUoNT/VAtX9qz/hfHTOa/d51seCtoKaKLCc1SS= ++A mkKFsUpDa9FcXl8l+Z+gy/9LVm9BM/kdP/Q9RTkWoCgFII1Cz9dND+GpRS0QHFc9FsPGu/amI= J3l Axzt4EUof2uscZyu3cjQ7Nm62MtLMkarJ2d/PwMSnNfNojtDq+ivXLYJsGVmlA5WSvdo98jyU= yGw 8aaq9EY/vVrKymic0yrK/hr2vloE0fJhTIVFVEMC3XDLw2XVrecrQXlSSnTvkOGOGV2tnFwc8= 1aT cA82Cu/mXiXv4FcvfnvtUJ+88uPn2mLl8CUvv/AdGT8lYRmVk/IdAuVx3cP/5oxxPyKz/LipT= 1Q0 SRF0xZEJAJbRFkiXj/ZhqMSJGEikRRjFiARj3mzWXTidmokAk7wQOo79Bs9DHaaTSO5zARiow= S2x BhDGqX1/nH9+QQuFCGy0GYYR/Ed/5icGvbRYYWWNMwITB+1eaitmkGKad/iMiSM4P+zaAweNG= TEi GslU1jZ8TTblzQjOZuClSJXtbCKWjvSG22lkiIgnbwHBy2asVMe/I7zbw08NIGlP3L/OxyE2x= wWE JIQUojTVu2aIwcdXZubtBcZQQQB1tp/C8DqSkGa5tTreKTM2Oh1g6QAnhmYX8zAPmOSKiREnB= kkD KOqQUHaXmLcdETCT6ne+YkpNsqG2IuaKqimE7vCPjHDI8WhFEcZkNj5IQy/2f2f0DxQhOm/bu= nXm G3Vpxcmn9HuIQXmZ8RqII7s3YXJOYJNNYk0yVBE/FPsk1c5i4UgmGTIYZHMZ6dkyofuvRuqat= 5En Uv88H8bMDKJUEQ+P2D6Ij3RzUWgpM3aBghjOAqxS27+3xGidlaMsrp9Q8SAwQVOpPtUUbWmhn= 8Ix LjcSofz1YfvqfNQ2QoF/Uo+sUAIijWwzrXlCFA9ZDMsjABwlI+DEhmRNp3Gg5yun66wU+3MIq= k0U mft4Oidu00smj/wHhzyuaYIdNxgOS1F3qRIHgpG79HQp7V5rL+0fAnCUldRTDKGUZkyJJE0N4= 3dI 4ZJLyv3ZJJz9imZX8onbW/E9+23ZvjWk/Ua1gcqnqPbvlmIexzbgZEIFED2E9sogrJ9IgukPQ= nYM fdNYKk7qThcMD2GukhxBNj2nz0yho0mkTUwhvIp8O5AwglpIPPzHCKIqQoKSbLKMmbcWdTryM= z6A 7cn+tn4iN0OI5DJ8ZsKvwhzEFEUB5z/AY2aLJM+stVn9NYmASEwUoKfy/DD0qD5Uoi8IGWIV6= rpM +h90zEm8EDHuO8EimFVbqzyQho1maUkUidf0ZEPsjDOlVJxU9qdrx8SvTQlORMsmmPaBBl/Kc= Dw3 wyOnUBzt6d5bRo2dChi7k8scT7i/gbiKSJ/n2E63ccyFeDcLpYt6MlMjZUqkESef1mA7ynhXt= AKw SMhFasHRVHGD8z5EhHSkglDyT42T02x4EisnUOvE08pjjPB+DbEyOBFRHYaw3GMMX8yJ5HPS/= p5K Q8Rpa/SpZcyt/efnh7xkFkCQDQercm22s9duRNJoxxMJLxJJHc81Zy4XIYfBQ+1UiJghGN8G9= r35 NNXC2kFey+y/GOg4mZMsOlWS7H8HQaCRNggHi3QsRVRYKW+GTfKDpBiQTrnhIsOjBnZbDoh8B= T0l k7D3AkUY0AkyHr7qFQiaikggjXeEBocm8NiDETpmklx6AIhuschdb2iMiSL1xHXiXbEg3nErp= ixh CCpx8nFyVvrLTlRtORChLwwYsTiSMhTsQoeNzI+1IQgMKKqeGzn+MNN95CpBBJKIKoEPdF4RR= An+ pKm6kic5rn2xu7N+fh+6fX6pPfK2R2Q0IokMk6hC5bUPsGNjvRdtE+BD1xmW88nJwGCiOmUQu= XGe yCfLGFD1l4d7lA0JnQPR0JaEPrNT14HcQDsclktEpRERESCFqWorPDuTcSL1ajKzpQHkJBOEy= Row VT7RR45eeZiVu7WPfU2RUyFjEUXQRvcsFyX/yHwVIP9e+AhdQ5RE9sI3EK5zXeCPrOhKUdVAh= Mv4 +yOnm4o/P+aqpnPrbydDLxknpOEcCJo46sf61nQnaEjGpfqXSwyIx0mR9KBEKpwEtITQVwg33= Oxg 8iiMCjir6GD1rCKZVZHF4hhpah0/HIBTr/3U1hQZtDlIs0LC+lksDEbShTvCE1TkJ0AWqeKIK= kVe Fj1aidG8zteXoLtWyBQsCT5dvRWyZPygjIqzhIUcd1MPVzjCaQyVNd22Tqngh0oETyQweJYEQ= oSF WUan6OphA6xcWx33nRj6H+k2D9f68bMhfnImJkwSgyij9fJlbwQvLBD8v63PRPE57TXgOokcv= y+W MUMpLuXFbY2WSeR+8lFmgNKUYnOf4kkIVFRqfCqsFr0VCIyE1iEGkzsszg43sK6xnDWP9w+L3= HKA s2hOPp90TWoxNfZcDUIDkEZmfx8WcVUE0yDPV6orMyoUPF33uABLsZ4NktUKo4jjX36t1UuOz= lAz sQjvKlfu1nzVK5tNh/oeMEFF8SIxzEJT5VqwHDM0QiiKG42VpKI8YtF2GVh3dQ/HB7j6kKmoo= aKW xbb2L6aCr2v4EywqlZi9bkJFf5paou/oezUoCqoLAVVBQ0ZhKKhRBQyEZTj3ZDCwTdNCMSZqJ= S+m GQLEofIyJKj89UXD27FGhrQh0pJMOQVqcnFPVokWdUrEmotEfyBvvebD7ZeTP7Q0/8GLt/WaP= 4JI QrEvjnGCWYyr8UO855G91dhmZgfyJC0AIi+nUzcoTJMMnDPVTp6pB2ldHan2KzjID5/Av/DuH= ZGG mAqr0lMlnMIhrRYfrZN++yFSGkLEqR4zA4QKvFogbSis3MoxTCyGmSsmoHuvGg/MKjDAVgQAg= 2Is hTZqxzd+vkPiZtnOfE0n/OFi7+lFHU1Q1BrLo57jqAjgVzpQVa67j9I+pUj4kygU9aZ9V9ifk= s+S 6SQdWBUoi69y6IEA8jZ6JO8R+tlxP/V+V1xU9KhwH7aeP3fmKS93dKHRoIXGCB8IG4pEgN4C9= DI9 Jar9FTsiTyMLN8jvHzA2QZ2OC25PBHrn+n12Iop5mWhUL6A6I7mA4Hicx5eN0mgMSEsAOxNM9= Qe9 qcSshx6M+3R6IiH1WFYoIdg6v03nDlN23FtDt+N9EJRKkoqawmq5SS4QPjx9eh9XGcGJgOWrE= rfz 088msbKVGmZTO+XI21ZbKiK20E1n+oHI78j3wPVPP4U/NvWVF5+p4Jkd2vOuMMfmvzPuO2l9w= vd5 OdxKCqUDlHBRJELeh8xSOKwexRU+VjAEpw2r2k1yv1DIGTIZlo9ibhVihxZWYYITAgfDYwzNt= EC+ 6GgeBQanDxFRGaNJG7VLTRjzV8UUUVNNhgZzzR1SaVHvKD9ii6kIVpipWaIUmlSfBJx8iIwX9= 73S lS/3HSSQhdG1W5dqs00s5AYEEWlheMG0LIMpLKXViiNxz/fEBwaBF8YI/KPzZt/r4PI/4P4Zs= E6T 3pWtPNWz3sDpFI5hxrWzDYCdys5M4XjU/R8hoJrYcgfraa+B4fvX/KBT1zKVtyYJn71IDiowv= V7e 5YIirAZ19yPng+NF8uEHunuDEGNSh4jGRIoUHBQamEcWhH1PsMD3n7kUREPekABMWayutAXPI= ZNB FFJRhadj5rxWBJMjX0MUCc0GM+G/CPMUIfLZJDO/KbsXvhv5TU6rPCPfArwww78IBW4drRHCE= hUV UT/DTvSp3PcaG3qtj5n7TPGc1H0P8NE8hU4WJI8AhUKKrvOs4JOL1YJkST5d+B2nIIcdUPvpm= cQ6 ySoqH7YUolJkijrUZKrIOUDP5MzLDI1HSd7pGm6JmQNUJEJE6rE5OSWdQaQMRyoa1UWKW4Pca= C54 EgzVkf2Wf4xn7rf9pf/UQLiP6aX9gH97+1+r4f4vj/M+NLCGJCmv7lKzs4NbpWv3rx5COiR2X= +2d 3Ao5trqXESaUNzR6ukekichPCrNgXkyhJTTx9tVglUGF2GTi57uVYXZcDLOzjek5bs6ewk3Vq= 22+ K3ZW8XOouuysQ2u+6RAiHAsCoYC2NAY9FpxIosmSuTKqRBVROViQUiKiZUYjQLA0wqOOjkicg= o5U rUlBBGCZQoTIB8TyU+PyWiiKmUrWqhURCoKLUVaKiIrS1tqiq1qJbWtLairczBEVVVVRURVRG= 5kr AtEtBkGS0UqFoFRke7UqI6kV9PePDtH+x0xpB6a/XD9CwivP87vszfohD5/3bEzL+232Wv9/6= d5R 5xvll93pa9/THXpWONOz5diO0rdfWxpVumTdF7rvH/dlr11s+Xtsr86Zf30v48W628JaWgs1F= 6eV MorbY7Xffl5Y0tP3bR2yMd/GPkvlbWel+LpCatrq3bxaaz62deLW4n5d+1auyT4rOHkvFGJ7T= 86f DiK9n9zu/PSPmvHel44HF+D5M637xPPRbbbggYx522+edrvJE9avqT1OXUdaZ81Hdad1EVwLW= e5f lX4rqO+OO9ajiOX75F7qF6rh+Z4547g87Yxw/T8X3XG4s7D61zfVw0R1rleHwwt63Pa2LjrdX= aGl yEtIvoY0Va5vppP4p/z0PH3/T7/0/+0PCDJU/QgggJl/Rjz9OI9Plz5en1U9fp9dtvn6mh5Ea= Qqv y+X11tb29+XT6fD4c6/XXLb1yurDp88MLezxw8DwEX3/0tQyFkGogf+sAEP/MCASAqj/ijBC8= UBD j/vVt9P76GqKfYk7v8gEECLIwP3j/qraMJ5sxkgY/rwqun+PedsWSQJEy1zKKPdf1wqB53+ag= B1N Iu2OiflVEiSAWIKnFAP5c1KpVslKttalpLVRa2ylpWbZFkkuWQpaQkLUfbgZlCAaSBMcZMYaY= GjS Nkt/lOc/1mw9yBMOEaUqNIFRQbS2kApaQpaQLaTpMMRRsJS2AW2ElrY1aUqNC1LaNtpbSlWhS= 2SF LQtoW0LbDuDANMhNapJSqqrYfvEDMstbBKtk6TMoUtk2qIIZbF0klHGEFAE1cQwyhDGTFyy1b= LaG so5QlqKLRq2WqlBYCWktslqLY1rbbYBicIVkmkkTSNtoEqCyAloFYlWl3QuWFLbbJLaWqtkLa= HAg dnZbJJs2qotrS21VYxVpaqqqKCiqKKNllZlFGb9iBp9/6H3OrRinQ1OkVh0HjB/9EbFf6iSH8= FnU njW3+EJyP9nt+Mf51xpl+z8b6bUl8V6Hvjec4dK/iXi8FVieea+I/WLFftD+ntFoMuL2a+oiX= +c3 HsX45/YkQWvVfJ8X1Ve2Tlf5s52SCsnBKerQiGzRwuJS4zm81ibDIYUP1rFYc9/0rDxkved9C= QS6 QeEI6eLTjE8ZTpCM4d4P++XbznEVPOLzroucMrT6UzlS3hL9dIWoOZce9/MzKA0XI5djVvcvg= oWC /bi5pJlM8qegkFVeujFZteckU36iicUqfsY1qvISaoa48IA4wcb9XsztDFGnLox/NHaG5pjf+= JfI NyLnl5L6FiU/gZFFNv7/vaG0z/syRCzzocZhu5XDZCNWPfpt1xNGuDTy1nISjWHL78DfPFL0Q= O3b 20CUGZdMvdCT4fbwnzG2/FMTssXt49Zqp7v617XrwuS2Gs+zyX8MstySxzvJPDwghDO7e/epi= E08 Oj9V/ri3v4+7IOrHe0P16VhBBiajMvWr3gGZ5Rc9f4JoxtCP7Wd21vnjmf7/R9SspQ/FXh/0l= KHo sdVzGDo32jcCxE/YFowO20QM/Dq86rvluRqZeyz9zL9HvtWFdbi5mS/ePffOhOSmbRRqxDb7U= lT4 R2zHKN3IP9neU3MjSU3uXvVXqoSBicxqaWfg4UU5L/VDquoHCZNUBlz+yV+Mzu8Cx/Qqoo7ix= oIe 8qq35k4w5vbPN7iE5dLxQciBRVD8/mGPFwipHV9DnpYyppxlxWUxxkNt3fJji6mGNNFcxJk7L= 3kD B52FJDceg6uNv3F8sky+XFC8oOf51NCly1daTSEhZijOClmdVXyU8FJLmpHU2d0WHdnk/Hs8T= HE0 VttJaJObDQhhfiSksr+o/TP3QTIIK6XepnjoKMcXb+S0flCVC17fQf2+9V0SY8Wrz8SKTX1sv= GLX yNSr/7vlX48JKWQorY94fIvz/m9arfRrP2rL1aGpiLP4Ec/wlHH2NJL8S+/ekqq/PqSNJ6c18= Esh mv1mGJi5NNndeVN79HkELK2PdW8t8TjWsXRnT0OsqyrpQeNGTyNpSh1UkSap1ymfKZH9gH7WQ= P9A AM/gxP7kaWW3+KLjUrVVWot/lSpjVVFqXRZVVFM3/kwzdlRVNrlMRRRTGpVRVuBcRspipiVLh= Sqz EchcTMhcTEqXKVBtlu2ATDEUUXWWqqYxalYsUUWK5PgMnmMBVIoCwRIoT6xhWQIjCGIE7IcaN= GEN CIloJpiGERcCGBAU0wQkBP3kH9kPAeKcu/q6MsmDO/q5ffnZnor07OsLHjLZk9mdfafPHXH50= ssy SnksP3u/1SQzVx5q/po8SsR/hj7fiR+dGfz8bZLFZdbERmT9Hg0Dox2VB33czuvm+/7/3fmca= ywu mj9UynlSOhBn9ycpSMYqXX7DzUG8FZLfGfHZf6qHuevu6X/m3iX60Duqe5UWCGa8gv4fBKv1O= dqd 5S1Xs/4HkPIFIniLI3NPFPA2KupkqUFWnrcZCUHgoqcz096a269UBGFAgA0GofzwA7VLEkkkB= k1k fdKfzl6Vf0JuGUhSpxuEFI5NGDp9Y+ft6xtTRP3JBBzX+D5TSOvnMlH+Q8JkvHOWIcDhsqWPJ= WoK evEih5k8Wh5VBueJTPr4PlnEPOyfG40Puf1uevDIE9GBOrp4dTU98i4SoqQRzmOaeAdSBxxwL= Odk /usfstrui5dxRq2YtSqz8Z127YqlfPFK6g003KHCVBgXR0n8ArzN2fty5+K/lm2DaHdMIX7uG= e2/ GjiQVOKCSLxk7eNvCdA6EPJIUSPU6V/nOUn18O9oHHy+cExTmaTWukuqzM8WQorHr1HgeF+op= nFF GE7p0TKjJGSP4mw3umkzuHQ/fJJ08efOyYnebsfQXkPYXpNvJj3pZ1WcEgz+PTPP7HRwrXyAq= jKw sEUcNGF022+csHvJqon/goF4B5ayzaLzSjsuV6Ia+Q3WepDM4Hf+3SZEO41vG95oezWGZxa5M= Auw jk45DrbPSGh+gfKIp9fyoVPvirr/jqscp2H76A/x+oYJAgflEkdk+KAKYf2gyhSQaRo/jd/8W= R+I cgvOQIRUR5wRYBQwVgkAgQABEkEghCIkkRAQQ+0KCShO8nwQwC7xVljQYiRBgIyEBUeuCCN7U= EhK YlIKIRlpcbNCivuBWADo45QviI8PZynGlVQNkMUQxEMOOI0JMEc0b4/VHEOBijogOhHTgGWaX= iOK MuCHMKYI6NTs5zj8PGFPtCAjLN+1UXc+ym6w+KddAfNzl5JuH9p+jfhuUQ/IAgPoZjlyIFpwz= UV3 Gd2V8oK5XNRLp+wb+JX1ciPRviscAwR2mCcSPmBZW85wXpR6RMxD4UA5iuoTsAwR1qpq0GvFH= Gkc C5dHAFeIFdZZHXI7Mba7GYt7RHmBtWHeCuwHaJndBVCkcEYDrN46UbIwk1I5ZKhhuA2G5L294= K4m 0C6OautG1slGXDSoX2nWeo1I7xXJI0Sr3QQEsJAuIh4efPZ2FFFPQ2aBwwdGaQfJzDDPdmIxD= DsX MGUH+5FDPntRQRUF7KyDWtGkj9UytBk84kvjBHzVvEXWoyLdmyz/T4aNnYU8XyMqLrDDBmB+J= Z+f De6ao3vgUAhuhAweYEgvpecyfzmDau2iFDJnLqAUu0fo+VMyaSxFqz8P2L5Zmy5+AYqVDa6W5= Sv1 uatkSpDVufs1/fxRH1EaYgDiZQY++h+4R/A+UQfy3y059/80eORK/HOLAgOQSF4LMPSkhuipJ= It1 ZqUpHxjJ4M1l6PxhluzXx1tCNVW7DuyjHdt2iFLrjKeY7d26t3N/LHHSvAcKuiFDDGKFIWOcG= V1g zRYr4wzoVxA1y611lMfVpq2XjD+pY+7mnhn+9S/Ux/wFgerc9SDqMilabJGCqkfcZGqREpKrj= ZN5 Ox/TZgdPQZ1c6Znj4+faZP8xxx/VNlTs6jH4Kbish09j4/WL8vB5x+Z7orSE3IOr0WBSEIfOj= EFJ /R6SIvJ2rScqTaKupH7s0NE1TxDc4U954w8SJNJB5HvaKfIkSRZJ+NipCyPgmQskmdCX3whkS= B6D HAlQPyxH1+0BodIR3NgaUjNgh3EoREF2W5n6y+1E1e98xm+ty7M8L448Gdrup4kiXHKrrRjgv= Hc9 kmBfgq/XW9QL4Zlvin0dTbMyg0J4wNu6wlqbljVaXjJ56ucJCwLwJgQDYRFYXBMFQwGygRCII= YXA LBMDQkTAkFA4LYEAKCViAoBwMg4rhIJhQCQHgAEb3eGmc97jW1g2bazdxdrnbOCzKwOwt7M7O= 3ho uUJFnJ/5jZJAf1B4Cgs/vECSA/5/4n21Mjnp3KldKPCSGChEmEwPFN5jznGdGeT75CxGTQdsW= LEh SESHLFiAFiJcLhqchNTjjTa29+5yRXg16ymHnuaiogksOp0Om1gqbAkxaqSmJajBmv9+vTgBq= Pnq U3WcCNnW7dDQgqBwLuBDcH5oh6j7EABGQP8rIQ/sVU/h/ZY5YqRuNrP+Rkggm39PPP2Qd3+t3= 9Oj vH7jd/D2/j449vf9vwj8sT38m431v68/YbH3EaQqv8fjzW1vu/DLr9f1d+mvjXLb/UreXpL07= 9n8 /RX9IZqvVSfw1eb/n+XX0a8bR15frfkktpbbaW0tpbS2hbQtpbZC2wtpLbJbbaW0tpbS2ltLa= W22 wtpbS2ltLaW0tpbS2y2ltltltLaW0tstpbS2ltLaW0tpbS2ltLaW0tpbS2ltLazMiIzMAgzMg= jxl 6Ntx7tLxlbftGN6tdnrGkpc7PT1ivqy1rKEs+1+lIdaRzVVZtTu/qp6r6q3r4OeuzZ+WNu3G8= fDe tlZdmay2Wv3p7ndd4tXsgeSfDbrEh+Moiw0WHVFiXd/H5fZlvIqUoElLGxBFBaigQ16hW1QFE= t9f uM8LNJXNqJq+nBkjZBEm66unstbSpmXbExeh4dc7olysIlZKt9Y3q23pVOe7ElmbN7zI+AiBA= EZY mPcd0GXXaCAcMNocIGmVUDp7oVM4sXaQ0jpiuMF0xcoOemkMZogNoIFRA0wNs4SFZKhDTJ0M6= 3Zj DhA1zYdmFYdPPXWSVhCHNsk0yQ5cTE6QOWbawNMNdr3Qh0hOz0ky07ICwnZgaZNIHZgGmHSQ7= 04t cAnKLCSbEU6RYcMJtCcJDlFIcoQ7pIs6SHLFgHCE7pNs09mSVgaQixeGbZA7IoHdztnN0GmQ5= QDE kGtkDpmnhgSp04wDpnS9u+d2BWVJN65wk0wO6Q1jYcIj0h3TbDTJyMr0nZxjaHCE7oTXJznSQ= FgC hyk6Yd8oVJymJ2Qr2QnKcpCpjCaZ0i8p1qzlgpAGv4VFlQQUJQsNhbzK3I1etvQgOXaxiMnLC= LKI JKWWs7js5Df8L4af9DQrlzGiWCc/6z/y9ns6PlVfW5r9xmZuhekeMXIlvthNQmEWieBJklAGC= UYQ IUhxo72Vcdmd4IKWn8vEJzlBzSM/RUTgY+3BMOYiOAYtwAhkRGwD9xCVyUa3YghSGpQyhTJwB= YDn 2fWapJbSSGKGzEmiIIp8pmxqbkJFaCUZx0VNRMokgKlyaEAIsRngvsmRWoh9mj+ZiZUYElQqq= Fv7 yEFhI1GfnKELeDuyjiCq0nrOEXQ2uDuRlwoUcbYXEujEQUC1I1vUIEwImCWARGuCN3WvFzvMv= TzO QiJSBxIjVLC6TcZmN8hSKOggjoIjnfGijYQIf1/pqNINipdC2eGZYDwr/DJEse4VW4wSOFMeB= woU eRA+9hHAzOhUizEQeWdnBYK0GT09jbNVxkKlLaNuWLqxQQCoMAEfT0hkxWyEdBqQLMVgSITni= GZq GxS5OznIsiUh9BZuUyVIERJmQtRMAoCFwk/OfC+Spi50gWOJ1QtUfJVPUjw4snVCpNEz4scOS= Myx x24P8C+sAmhRQrbLXPKsTBfVRiNkkxaT/ZofH29aGCoF9oUPhzwe4x5k0eISamKq7pI2rlyRB= miA snhcUbfno3ApJLCbUqpJ3gXIkTQcMOWFWw6DNV2p61rQV5UiO1DhaeaaoqQI5jE8HtbjwRDJD= fNT TAhpzJmi5qUGntFBfvBTogSSCkfCNgC0NkTEYEvJDGCVj0nK8lOsjs3BuaHJVjmmxZy5KhHET= Wwz 668YpGIuh5ZWhuZN+qKP1T1EG4EQ66REUMFAAAGYEKuDReKFKpy/hDSMv77q4i6ZJIo2PTxnQ= smz 6ZUInRoX1RCwhcIlqEfh7U0SbuvPCywVQpYvg90VOHkzhb330K7PYDO84td05J5exbHrxh2cW= m8T Pk6frMq6EHzGoOwkRLWdZaejEdSTxHArUaZbPBy3bCXisR9MGZWGMRyawTfJYsSYgZo4quW+R= wRN lvdGTZ8jWezRTYUFB16H4IEfdLhDLzcERAKuwhj5nsORDR8SWEDfRzk5wyEBgcjzxYaERmeFg= A5R GQRBtjMrIaDG1kAA1lqERSjbq7K8ThU9pNxliLrhA+ipGDXTF+koEWMrg6JoPbIk5fJqkIvUW= JE0 PnCYuxAWhoalBRo6iQHIjxOH8E5YvSkbmTvDHKvetHgxGrzjXVs3xbd+25CeqE8bg8gEBs4O5= eth yDIVGcmFkLzHSRoyUqUGeI/yJkaGj7JHDBHLNI7jkdj0JoRseJC84tKXWd9wRbMHLsrySUEJ0= KFK +T4hACN4xGty8D+KFGKFK53uTeKFYF7E/DtKLnXpyA9pklMYgb6OihAYY0UOsSKkTOz8f0Ty0= 8zE CFBkhCsCQJghFNiitucAyiY4UlQD+IFa7kOI2zzLjnik96D4tYYIFihIpuVIG9SY8iMBh4isR= JFY FQcY900NiZGhInGTiyNoFRzHMA3hsHCRUeBIkWcYieFCo8Kkhk5qmcHhoibQqwu/0kGDdDdCC= e39 lC8MbwaiTNN4QFIamDft20DgU2KmDLGjEy4bm4ThkRkLX76oKh7HjGrmBiS6xBazmdyXhLvem= y5U qQPdjavvOhtqOUHHctAUIEDUgXRTTU2FoeoFZG41PjOza1HMyZvkZVHzL72jgxh3UVFb2bguE= yg1 SMTLMcmRMzBzpocFlKDG1aGDchpHA5GhAEl33xtGgSWS9CcyhepgkzWq97ThIuTeZEhqZnLDD= kpG 6QYYZ3LllSpvvaZWxoaDRIhsMmW8sbGqSDbemfS0TCvSIjX9f9SHoR7kYjxIhzgYAen3I4+Ha= j4m 1Xn0A+aPQr3I3RDQr4+shgjzI4Cnu7eYxVB82YFUE7dyOlFh18awnWknhTxjAIxnDoou7r6Dj= 5yY oZMRi2NCBKTISEzIQknzbTwhRpwi/krU3s52+m8kyb7fDLWmAOBgcYJ5HaMwO3aLAQZJXVk5T= lOG aeur3TvqyCzCzGgwL1CsawSzAREURQNVLE1THsxxymkA4SaGGPLpJ0yVDE7ghEkJJwF/nr95/= GB/ SyESxfd43k2SVBAG2lPVIkow3gtoO5l9i6/Lw8y8VZaEmjj2ZNeQ7dF+9vVNZa7jdy+XewvvJ= t7u 3AiI8YtEKPGB6DhBI21AZLTI2zfsWa7Gux3dnMXmCcF9jdykhIsOeCvbpyV203sPzHyf4V+X5= D5/ c4knMHhRx148BmXt+1tqVvEOHZtgaxKSbtEQhff2Nn8z99s7lasr/vpeXDrB8YQ327szH/8On= AN9 UNReECCQcBnW2pMGguYCbNqHK3ULBFCghcAIwEQQnQKVqFz7jPlSPr98k2mWcAYFJUBig6+NQ= IO2 d6RynStYpV6rm2b6gV121z243RzC+g/tq8EhcHkNRcMUdwdfhAmgi/OuiGwiEKAp1qeJmTiLx= yQg VzYdQd3DtncZYkdtFH6hqsTHci01c4APCk3CYYI2wI8xsMTHAEhN+ZzceOjOTHJHpIiKLBygH= Aga bVlMMs9ewxbyacVUC24lxc4g9+Or1tLU4b1AREx+JfPkyOhBKleo5E6H2AiJ3g9kjWwE8jfnb= BsM S6ARDYGyYUj5qrs9LOMNFpH4SQhRMCG/x/kPejl7UQokmdMojgaohIIAreKoF9YliXyMMMYbB= FUH QTjYlvgsPRERC7lQxJ0l4KurHhTTta9+edo0lKPMxfmrt+tqIXy20CSQeno6FgpY1SXskTpCB= LpL 9EKKFllba81Faq5kZGVYEzs1RhQQqOEgazuaOkTBb9eUgoxatYxElQXyX2CIniCInaHUzOVU5= UN6 HHROmmVVGDV+kIAqzKHz8YD2vd5MzcFVqRiIiB1pJUOU+oqNZywG5P+dvvPSx9lNMNI8QtdCJ= DV4 GJummBTZk4YyWtBlbKE61XM42Qu8OH7VOdqKmSoE9XrVhWbdRNiA0M2yIjCW+ffBiKquYJIEc= 7xt XfQo/v36/5TrHNuX9hi/4p+OxdvNmWq8LNfdtRznOsNrEt8HbLx1vmN0OMXjT8weObF6i42uC= eq7 nrriO77u17677ccxz1fXVc8WrtyzzQvtc1fPPWiOTT66rWVy4545btcKv228423V4x13yXmoX= Bpb 0Y5fOGzeb1Orrl+uNwq3viDgfOpyeBmUudzx3zEVnZ56zngxClM6fbYvTzV5xlO+3ihJVrOBU= 5Mg LTlCuxix+1Y9PtDHPnsEDVxLuMaZ41NS+Wl/ruhVQsaJQvdW24fYMx5L6qhNH4CgwkibG9VSR= eSm +MpuxQJJBIuUJGCU4sAph1FBz4XuKYkKNGqw6FuwiCIsRHpAsRdUPszcCAgXQmCnEQwJwIcew= pkL 7EaNSMNxF2S5b5l2YeRIQFJCWmnzGZCes74GCeZMxCQwdU0hOX9eYxOk/uxgwelp8HLN0uOSK= 3/Q ORNJdd2q3zciBeT5KZpGE4Q2RB2BkwUJOsmkkgRDIFFJGcv8xjCItB1QZmgQYTnGaSE4qDutj= Xap +0EJaHPCMgoYhghG5KbYByw4KjjkS2LHXwIRMGyLFOCQSTJJcxzveTXgVq0o0UjA5J6gV7gVw= N5i VUyGFYp1yR+vE+hyRtoS5ODlI1QTc1VOCEHSvmGSTGNBJCywYCZQ9iZE8BEBQJE5iOqDmqF25= RWQ qXIIwCrCO5DtUi712fRo0Mam2kLc7cPXqNRjZwQCe1vyplSGkdJHpOZWaF6ECViSsFIHpVJUK= 1/p QrJIia8l+zt6ZzbY3BVSsZHOiCSeq77kMGxCcjUyLFZnFCEeYcmfmQSAs3Dvj9jjtRB+Z+rw+= r8H jHhQo4gGHyfIfSQmhUH/Bi3ow7Ro72sOZYk2ZtUsdkZu4UQO9qwxOwyKJ6gmtOj3ieXYutied= R/z YF+Gr91IU4qkTjEth+U+ysovoosvf78GPhKZdTDFHcrTlSkyowpbUojGxvYUecy+CxXRblVIU= p7T 0/tSZi+wKuDoPJOkXIGYvS8WFzho01WlVLxWRGk0cZd26Q5zkvummaJpiUs5ILDhFpeGIFmih= NVg ZtcAwmFT6cllTRHM7xi9rbQOFJRfklniZMUkKZLKBZBNCAFfocF9Z+98JB1OOSZDDINN43WPW= KJg 0psOWZEocmxQjoQhXXlV1pkUqq8kjnsOkENdRvTMBL8C+mgQhaFG/k4H1MUYLVAZ8mj+EFwJz= v0f XT7PFUKunLXHxYcjx9H4l5FRBvMOyEG8EYhdlZnagdpGhKDVyUCjEUSYfbqPOK6RK15qhCwqi= kID XKYHMP1OS0pBYMuReEoUJm6GII6NQmSg7koBYaohmRMnUh1hW9NghmYroCjbG50QTzAxwZmu7= Zuj rMaVmlzk8PHIMdviUYFrQKshMhSQntBAkkEUUwZWqXwELgaY0jiaLDZRctkw0nGq4XNEaGwQ5= Ifm AvABdECJPhsGVRLk+5oIiWO5GmqlVqT1oDZQJUCDBqg34rRSZgo+Ns1j8GAksjVK4cnUGqTIG= 3VI WNh264sFobOQIw/BHizdC2RCJcpj7macgQIxd2nFogJLwoMHxgYYhBJCE5/cZo2KHKXBjRaZu= Tnm SQu/e/Z3kLwbCyCBQcKG+HzNKEQ5z9USZDY++hOBEqEr2Nrve4JGQ2eFTOCDVL3odJ7H2GHNy= JE3 ByBY0cgMnuzNuCd+DBIXI00z358PQgelzUxzNR5XvGRdiMbkTp4sPbhvwrE+EW0dJHDODBdkg= z2O YcmF9RK2mSqFTBEgbyT3c5yRkhDEho1CD+HClN9oFzmDx5oxA0HJETBQ+rGMJtqm+ZYweULrd= 9V+ MYFIlTYwpsOoZHJgY4DM5S5nmSFz4BiZ0g+9yerrjbUaEDah/d/EbaK0OZGGMRL0sR+cIhqsj= Bic yxchnq4yFzUQwMzoR8Qfn8AHj6xfXu+XLvRyR14+N0eUF1KOKPBHm39PH38nm/Paj8mhTT0In= SPS qIBkogX255doiw8lnGLS83m3uWdCCqLQwORc/XIbdJORacGvKOJwaTZEhZZAMwgfIczm4Jr41= Xtc sUjKfpZoSKPDDZEXNbzpQYAeIDeQs7WNkUQ0oZi6t7oQwgcuY4HSPDEyGYhkSRAtIUe9tyB7F= AEk agdk0hDTA/EfwT9zKgrGHbv3668fB8fHmseX0hrTuLcjREuNRUae9HKsOr3EtIVhNWD4ZROVo= d6+ fivVSc+z2TRONGUu6xwqxQcK5tjFl6gor0Q5fDC6N7u0QuqYHvZqv2xbkWsiJVzbmTqVxAVPp= g5d RPsmRMCfYfc01VMXa9KYaMLxaLIOI5qbRVVI9+ZV8B7anZmTTtmo3bovEQPkwtnprSjxBvNN3= BVI YQIhAENdpsUmwPFivbGfT4mMqOF4mnl6uYCl4XHXOtZxu6O8JX+judHeB+vlRPdCAEOj4YBJS= oGP kwuf3wLIQJARuqyqFP4jCv8dC2ySDjGFU7YIKKBQ/AHsEkOAsluVGtRzBFAkkG+mKFozNeoU5= q5+ koK+BnFUm6Py9IjDQUmsyvQeZE9Nr+Xk7ZYGy0FBJPJhwbAfeTrCO6ZE8jAwQzHJ1NtodJE64= 25t sKe/SUuIrscwaCkJEaybmNCMMiSsz9OqWIqVB1JEDwYoxeKFbhEjwQ+GRtizlgb58hOc/aw0e= nJB 0iBqQLz2k9Xzhhn03r00J7iIVHGQRjboVyDoTmEhTxU+U8Qz7gy7dCkOze+QNNJC+ykKyg6JA= piA WZqYRSB+NNbxBm2QIS+W3QvZoRlOuiSKlHQ+uGoYJDuE1AmhQ2XYSWHucOotQqGtkIDjAxX+3= CbR NJPM5jFd+Yu8Y7SvNXQSMgNi1FmK4qESjY3FkOU9GhiGV7O9ELJs9Kg9KWKw8k8izbGHCGVbI= gls t4QVWKMMM2HLj6IHT0nRosxYwTOSkzL7GIW9malWsKIV5ZPB5l5XgU0tmYOR88c3lEsxvMrsV= K90 E+4QPogmVdFZjUDfQitZWnIhvJIQgcxm+8EeK0QS1BVtbMugkjt4dMHbtiytmDAc55P8G0Tj+= KHa L3A7Qd0aa0CxCLNGMQqP0Exk73kbXdqIX4IGTg8Ulg+FiNbMJ+Zsdl0U24GM6IyoK5TccSz5P= UkF j0rFS1dIEDQzIlDKcYDkhehCRnsG5sc84IkhuDUK5vIUsWPkBkIidSsBr622ddyLshEdYDSbN= aMp VyHsyZS+5WSD6EYnB3ICGcZvsgnTKztWs7oUTB+KhGsw1EO7AY0TkSHpR2HaBeRmck0a8geKw= Zwb KQR4U07y8+MiQkK56QiZNmpr8RIWLlnC0bA+zhH8hrB8kaPQxaiuog6I5HwelZxm1auzsiMUK= OPy +iM2HMrfh6FD320jrYmTIFt5m5NPppkum1GfJRiAzdpUlWz1cqi1TBviGBnIWY0GHv7htwSwY= KId IcU4UPDj2gbclKoQKMgANUCC6EYgUUXncuX4JBekEfQwOlhCfkSCok5IsUKKH0Cw5Kyy4FFRb= g3W QQZSKZLEYUIEyoyiN6eURJCiekD6scwcNWMfZKgz8JfLQyROkpF9EGRjHKjuknbfgqoiu+h9P= 0r3 vfeZhhj5TWoWTrmZBglA1u3BCQRZVT7sj6G4YEDpO/ZN3ZQhklGQ2xnGLG7EVtgvNxjQzWCDB= wiQ GUxyVjNyFbOTVCZqNoQjp9xGrI2owSxyPbeKTiNlThuTtBP+upmdBmobECRmlU54JBr5+B4oJ= Xrs hflVVaKaYjCI76miu7xYTIBGlKkBTg7NXO4pi2Qlte9RLrKs3sNu5pmNImNGBwdwhJVYN0EvC= y2E LE3Cpc0IwSahTIlGKaOP3mzsRUzYwQdrUPkTJYsYGCx+aYKjSNmj0/vJK/euCRXg9L36aWEnv= h/G 6eOoWjBo//gzBM4YIOJVIVHeLH2SioIlfcBISVBPGShpC7jE92XTB93cZcP6lvaiSGKF5QksM= WIc IOTYdm/E4ZOfPwarEqpwdRzctYwTFCkBw1tsS1q2gxQhrQyYVziP2yLkXNNyox4Q1aRDndasm= Nts 95KMKlOF95qlhgVDEMKuMwoK7qgAngBHCJe9QosBEEQkglB0iknpDmBZ5XUHYOpC6xgxTzxSN= ZGU KL38uZI0NuvBnHBa8jRSHifgtCOB0DSGwKiPrE26HPOxYgahsdYXswewJ2+/OUuvZ+fjG4JKg= AhD HxJj+DrKO1PDwb8i2UKXRoQ8OsHHmHhyiJoWOwzF8it+ClCJlM7oJg4NTJpFw1gdxhiBcrfq0= SOQ IlS9N5MFjBch4Sm54eFipU03I7cCzMETUruZ7SMyTFZ2JSUhRzTmo2MVIMqqhOvC5ipzdCZaX= kzy p4TLWqUPC0iBSp00bIkrn8hFdkTOixQ2vCFdBgdzoxsYqUGHgOdJRO3k5Yqe+2ltb9/nNkqbO= nh4 XLHnWCHqjA2cJaHKSGHPK7KMUhY0OdNn86FLK0bM/vgl3gtHmfTGD6P7MzRwj7QjQqKbEzk2I= 1sE mSqkzl9tY2sZE6UkUcVJURi+D8BBEoVhAW60j8L7GehM4m5EyHMy+Qo73I3Ph6ZkZ9PwbN6c5= nPw cc2WHNkDIlI3hqLgHRuVTP8BPaB2I6cjw0I8+OPz+eSPR60fV+1FwF9wtVC/p+YQvUL94lQYP= yZG ojblifv19dYlOBInCNppMJNgrQL/HrrpXoER4wAZz3g9ZlVvgaldwulGVObRIkmlDNcuzPSGY= 2kL Ssge2AoCpWeQnjeWgYqysOkKCmq0yyoSD+4m3L7VbpnCrayolYGRQ3F1sddnJy4a7L2evZ60Z= 7uw S+czLScwguugWhePe46ZvXIy8uxLPWKgIaDOQsY3bpdTLe72zeSgJyt6+sdydVQYomXbm9ulV= d8A Jk75BY+nLpcc70wYsWAwED32D7V8Ke8P1zMcj548TRrcULIkpA6FF0KKQG4+U1Tj9Pob0SRo+= OCz 2q2pheHEmfcTXGhwXVAih7ySWGQmR3DqjMZc4S76GbzGLoTxGCQy3D+WixIds2OwfD/tJzKvM= lzT sNPByhTTDt6cDkTUqZyQSN4VOxCVIvZLTgsKjtdyosL/V7+h9nhs2fZFo3HB8XyexGD3hj0p9= xxq CeTdB2i70j67xbk7ytKkHn8QTmhOhNeglfY44wqRtFmiImkkSgEEhFgGvBQYgc8BV3FtNRt6l= Xpm xAczLKYSGEhdGQCW9DhVl9mDaen3TmiFlCxG4OHKsiiDmshy4oExQVhHxj5+J9siQlwuOl8Nl= CxA dypAwfjzpnkIYjBtEU3tB8JmJnBIYaEEgM7EYcRCij/h+DuQRxtnxUgWQVQm+DZW7QURJBOcg= P3s 4Uk7FB3QmInmiRJkySXGOF76nfGqr7HcQsv9a9kaLeQuyht2GkZjN4/kQdNMw3n2uzF2RmCdi= Whz DTcB1jDOJZYD32lIgzICBrJg/QElIMnvdFA0XIjYPSJic7Xg02PDbEWs05OlKRH5CpVCkJFVV= Ffw OqxHBj5MdAftaDrRo3FUVAyAUuRZNDQ6OiZk6umg6E6wjI9Yv4MS+nqNMjshGDs/39xLDCRhn= ZAT 7MMVUSyg5Y5MzoVSwoV4JWNRzQ2Bds2+GNYGqZJjH+LzL8jbeUJKNMkni1mjsaEKVLmEkvxUw= oDJ yj3piE60QsdJn4tUiXgTjQbo0ULh2ZFTk64hKsBEh8QJanM5bJmqnhEUxRCe7w8A/BkIwprJJ= t/C ZQch3NXPI1ZNrUgZ2G+tDD8NOkNh10dsou+TYF1esZVGgwgCQCbfKVQfCwgSeRc6QJJDDSsYS= Gcp ob+Xy4HJXmdLZohk46vkRp0bWSqRH5c5VasmqiZ7xKKMkmiqtuI5cb136/2ZKgxZqmD+SS9H8= K62 fD01MrEohfjBPT82Ay8hBIZ3OsiDAgEN2VkUuWaVh5JM3mNsPSQnycZOe11wqDBfxlJUhVgWC= HBH Y2KGoFyRSwI79UOGMHYoTJWJTJMTJmVhy+oK8JzlXBbm5oOcGg9CsHVBk0P1IgTXGISV5TEYE= Njr 2TEdswJCo95TxOdhkOPCSE6QNLRGV5aiUjFCqfR5Avk0rCFSfyRMoSPlcjmiU/hQcqVaTIUOG= AND R+FJhKbK0aGxGxqNNJqMQFLvDKhsWoQ3IzItNyBQ3TJ5gqTIHwutbogZkAqabTCQgZ2TpIUIv= HON u1ZUaE3pPdJXqISmdWlJjE5nZMcQi9pjq5apuPa5gXQLls1QSYWGLphdnccq04m5UmRmquTwO= Qtk YMyVVjnlWqyUZcI5DXipxvJ1oGFiQIGpXcygcDHApEXegvYWBvcmGFL4Ry06LxVLswaqsVYe2= EhB 8QqWc3jE6UqAWMEyxd2ZsHw81LGtQ8GOIHLdAogSsFixy7QKV3wQnIgHrlw+yKlhBA7UnO1Bi= 5gz hxmZGhaPNX2gZkSEjhTUFMi44HDkMrHzQTcC9dHVgDYODWhUkMac7kw8wVkfRk1w6w80KBEid= r+n N/GPw+vSRb0ixeRC5PdN7Qv6kJ/kZHE1TM5Tli18nh6GSBQyZL2YYg5aUyOT4UqVyMxJHNEDR= QrU kSMoQvbvGbhjLbO/IUsXNrFxliXLyLkR4FMi7kfDxWI4DdywwULEjo2sWLESxWQgF5mlDTLMl= KEo aTwaD4NCQPkFKPYuUiUyuXLDjWLTUyO5GRi554SkPUxc0VPnuDtyuxzeSJMiZP6DhUsambOeT= 4Ms aKlK+WPTiiYh4XqXPaAx3hScuGGrnJOdd2jKVLlSVMGPgjZIqRIGzBzoXJy8Yxs4eEs4/ejBk= pk2 Q3g2H6To5MkZLCZEuMYOnLQ1AT08EE7Bqgm2iCB6IO0Hh70dwoX9yN9PWA0DziHw6MVU4/gKY= obA enpR3J7wetHuDWA96PQD7kfNH7kehHSjgDyiWfSid8N3Tj4brX46329GOE0VhnVysbaQaS/g9= FPK 9EALw9wLvqe+oZdCnM1s7VyguDOiiARGDaGG1wdAz6n522avGOEQII7yILL9j0XbizG8t8hh1= KZC Ve9I5AYy2J9gpKktrfZ66bFzyrqaQOG+JW6Ja6ZvGkCtm3peblvL5FDc7aZXZ2SKEh9IsPrVz= jY5 31zwuVeUOqfV6/bmyYKna9Kn0+D1DzUe2cGu0s8HaqZewJgjCraNDHOqnRxS7OWMqCmmDjAFA= 5b6 9uXca/OGI2dCd7g4gqhRBVElhTManKghwpvqVsSoaW0qgXJ0+U1W9ogya+/UAiP1/d9zP0N+n= NF5 Yiz7dCjvXV7atOjvbppxslKSopRZv1EjUpTeMLmPJESbpimdQjA/nJmxjWd2OGz2+ClDkdAEE= ME0 d9yRh7hCDDiQKNXDwzopI1rcrDWC14mjLIE0EGqrFYKPJ69l9uZvhc9CuoalpvRzdCEbmTd8n= sbx zd2gr95HSjK6F47aK5HNylSOZSuV9MaqOKWwphCT2k5qNAupMmcQ11a+BOZlNds0giV3hnshM= gSS BxjsqllBoRNBxjMuZMe1Q37HQylMuVsUUVY4NF6HUR3KsIdPIZSJdb5IUCqRop1HJRgQJtSUX= nIC BBgaDBbrzaqEWHpBVICktn8Z6lg/H1B2sVOFfJD4bhrhBCofeyCqNB2g+yb2PV5HuKQuVPqQn= GpM kKZYlozJwsDQoUJOZmB5kztYlKhYzXFBy+LadMQVcjbVIWINB21XVyDgpUuS47lRAeAERRYZ1= cto afQeKGfFCqlU1iA7Y2aLnnkSprm6UAeholk+XHx5OFpjmjQ56eOMwMM54/GOEhCTjCEmNHHR0= 1cx F5IghQKjBFjw6Figp0P4IXN6PGLE1EjA4e9ISqVIlBkIMAvON8ZNfcLHd5zBkPFho4w5SDPcp= AcY OUQo5CdybF0Jg+/aTizubYvXmI+NFhm8QJJBPRC13U6DzGDZ25YiqglV0VXh+5CDEYMx3H0Rq= 1W6 eO8aij0VFxe8JPdzFKn3AEknJkkITNOPCRscH4I2Qx16nUiMLmc4FKZkiRjjLpLotIDL0q7Ms= FxB 1eIOvV+28VtjneKABoW0MPbqI1fWdaSRHW2rodCBZjUo8WNCsjFitLrjZlmclTM0WJVS0yFyg= 5f4 ESONnCoxstKozH4x03jsY6sajdTZnhNopnUjF6joNkZYfXE4rjLBMuLyPHOcBmz55wPcxvYzh= Ufc iShuxtTKl7aliWs8MDzNlMGDwpoRY0IjnVE6jGvHEJEc7cUpToZkCRxxyWLhdIC9pl+A8KyQz= llb Qf0rgp2y6Yh5RyEFVZvcE1vxMn96PuczyZrdjXDiqE/mz8F7dgXHgRDBU7Ygb9ec6FXOkDsoz= n6Z 8BomuntTbFs5aHRMSrIuUInTo45maVMFTkmWJmhVhhSshIFjE9iBpg3p3VVUKWZIN+pZ1Rp9F= J5a 7egeYEnmoqq5GxOJNsHFHVFl0MxSCUNDdsnLx+jOG45vtS42JnBvkKWwS8OEiJ6e1p2JwvyBu= MQ4 LJAyNQ051IETcocwG3QTABvKTATj6Epf4H+ATQUqj+D7y4iiA6SwYZzYtAwIcRS9JMzUJGicI= tIi zoXDZ+IRX3RS8lCzoTkmwo984uuoReZmTFHk5HjM6RYWcaGpfE7FiJKAxc6VuRhM14UInJNoE= lvA DgkqJAgPCM/KjL0zGRfhc0DWMchYuVHNuTPo+ipuIxY6embEdmT3RZUNauNBweJQ4VMg9QzH2= Iim Z10YgQ1hQiTcGqb4go4xobjmmpIcsGCZQiOpK4XIo0wkbmZU20fGCBEuw8jZTQtvrYiV2c2gO= KQF LGhobZGcjQYmwXOHB4Dk7DZBNKpAeDZY6bPPHMFrnJxKGylo0kSsVr0MnDvNnbmjxxp4xwoeG= zSq RLlUsQMhzsyCP3F1WxAUbUM7EqKY3huxQYqfPPKmhqGvlQyRoTDnScfnbFSVtsaLxkR+GScYa= 5F7 8LjM53JA4cxgiRLkCx082S8MYytDh4TO9yGhm0eZOHdUONAveptCav8D7wYqqiKK+FIBPkrCf= ZCd w9sKfSDpePcu82I/IQGw+ry9KPaGyI5Gejo3w3cJtyePpqbu5UKFVeAqkhAduoltoNkHR1Wmd= 4pt 1K0l8KC13eI287bDVvvQHIcyZHJF7j23or2q1PJPrGOx7KxIkoXNbSmcXqM0495+y64sbapzd= I9e 34xWTfOpNY6sYzypnJmatvOg6J03TVB6OlOqOkNvk1wMic1gjL3TbrL4YM2JC2hVXsRMjHVOb= x4K pdVlVMKnsEDKCw74ah5xXu08Yh83g8pQeJ9O3SbBVmZ0e6ZrZI2U3nWzIuNIuRWEJ47adZ2jN= 4Uz Qb+QEhIwkmQtPIa0jQQAJBEnDiIFI+wdGzoxbKYZqfrTHnYVzWXQIkqTWKHNBh0mxdj7ZH8m4= EfB 0Hy+cStViYIjyAAJDfqqSc3IcchS04MMb0xBC7HzNZMXqRL0ow7Mw5io7YbKFSaihYIoWs68D= Eo8 UUxnuSJXO1IFRJEkSe3iMoahpkUiwWQUBv0gYBjAWLzn0ePzbhwwWCwWCgsFBQFgsFgsFgoKC= wWC wWCwWCgsFIsFgsFgoLBYLBYLBYLBUkSRJEkCRGRAhBPHZwDjMg1ljmQU2Gj8C3Ql1++aIlu9V= v2q 1GyZSXgubKsmUXEOkKtuwBZfwKPYeofvkanJrW/URjV9ngB4CpsjWBL456rV6PKRchV6kKWSr= jlL Cl6oJwPdhjQnY+VpwvlCyl6hg4KpgsFWGvM0uSzKGYxwMNJ5HXIsdToLIWaE+igms9eYFKY8r= okV MOD3ey2mqkFtbrpYAREfQ8eeaFznHkakgDBHdIJxWUxoS3LjvFpPU2M9yJmXUmO+ZUlpiNNhR= s8W CV8yc4oZCGwzwZe1GvwppsFDI2iTOSA5gg7DkRiZ4MPV3IQNmdyRmnht4D61OEnoOA7OyBsia= WJD r4GntAk2iIgvgOO+w7j3CMCtaROeR9baKNtkxggIAkntsUlorBsTMjhEKkXDpNix6RDLuXuVq= MhN PR19EjUPFPASNw8+DUcvY4OcbkKG8OeN3Wa7O2B051JwvBAThYz6F62EKFR1HaUg6GR2+JZSZ= YkU 3OE04mS1OeOC1Tpngr6yg2IlyRHmcOnRoKaGU4nSNDUboMXLQIQHqbGoYFmdYin2+HQyLVnqM= 7dd m3zoD0jlA3NYYo51OJlisakJTqcsOStUrzV9Xg4lMzMLbzAjI0XJNylgY58Nk5NEmbmRUFeLI= 2Y6 kGOvWhE30NjY40G3NqHxQJPqGs2OyWjBy67UeCDkVHSoIQJaBXr6UvSp7hxEUOCblo2QRzWET= FHO XMoky9SyNsKgjilJk8EuToKZFJWn3hgWy/P7X5oLtuZClxYHUY01JGTEj2P5/no/LqF9/ZFtt= 93b UXchGPNIX4ifBWu2AoUKG0b3TGIixjqdjkpRjCIHJnWKpYzozckiIngjwF2W2qfsn0KGqqnlJ= 9Cm HNhmvU+NHB7y1nD9qFc6E7l+qDwu5s/ahBKlT7g868Zqt4Sd+vNjJyYNm9TExjhYB9prdoiSP= gcK IQ2c25hYBGjc4oZIDhmG6Hl7MXS7DtuYcEYPge/uTJhAzkurEmIFvktlFA4SLEylthMlE0RYq= bGs U+VsiU9bIJQ+1JfQvUquw3K02diUtZbPIms6pBBLPGBxptqPmk0Equ/Pj20lopSZmYHht1Nj1= CaM oqBWZ9hTp0rT2+9lDMz59MsmXPrcrS7Rr5/c1ZbvY0N8c8w3KaGhwOPYyFJnQoUHJDG1By0yZ= wZy xqxaOgpKIpc5wPIseSCbZ3JBo7sgNo9PCREjQkORIG9VLFCJQ9UjOfCZ4TNFyJcnoie+d2cco= Vie mShUmf1JCsq2Qiu5Nxqijj3LsQcyIDGBQyc0MzBMyuzEmCcCI54XxQrX0mQhUwZJk5pKRqJti= tpn hkfZYxoqFyoZHIE6jVPziXuV8OZKnsFk5E+kJuVLE/Tw0Y5tq0ZyRv2pQ2enTpCxw+t8JeaRj= Tjb HLkpN/N3Vp056/Rxj1z0pEgRH/UCyT4RKl9jeGyBNo6InCZ+iBJIPCZMoiZ5omFTJc4SD68PL= BOB Ac/ehWQv6Uezejxo+w3m74Zo2uK9gPiC6uQNXq+HKh6jkR37hNyCqET1g9/u7PMPUnXObsnX2= 9hR tL4fbH0MWc/WCmvAM4dZOn1tAHUh/eQq5D8ZinWNrxVK2RmyN4+9WDJFgDaYJgeNJW0Ufezas= 4ta nUjRGahRCzGJPpV5NxZus3nviuwXbkVlRxrq4y7Q484lS9iuO3nTR6lp7Ok3UTuucQ5OsW3Jr= Lxp VQw8clCsloiRY1bgZlNHBXdlu4udkiBEMUJiRVAXQkPWDBVreyed6txO+3A96ZMqI1c6lYgr4= +JZ iVChou2ueaqseyZFyfZVRgvwYkjTJeJ+T6lbYXvev1NjV66AY+PxJMAe0cbrejP5so5bbDPxA= cpm HhA6BFcIA7IEYAAO44NpZAB/TqlEJz3xC7WiZYliNPTBw0rEosPwKHQvUjgdiAQo0IcHPu+6B= zs5 I3twunsTKTQzKjO+71tBBA3JmmMFRpikvplK18oCmNipM4PYhEmyDldRRTFbVeRkW8IPGeVGa= vQI 1elDvMM2pcXjHBARBnQgQ8rwoe99ThvTNKUTG/Cu/SLwv6eOXUaTQmmYIz02TO1Bvr6gVegb8= 356 FsyvwPGg6QvK9hnC64LwcC/ALJUMpn787ZGZkwpwZprwPmbE/SJM6Evc6CdkEvxzYXlVe+h7v= EQv hWPcRE3B9/jS0Pbd62CIO6hGLlqlmoGdjYlhNzMBRyFIUAbalF4MI9pDEZzWMRnYtF7QKVNyk= 0mf I9fztfiFTRX8zZwgV6AoAjyKEJ0HGpfkVmmfoqowqDzoGCpenDZMStS3HFyB7gwLcMxWGnIYQ= FTS ha6VjyXGsckSaJcaf1GHo35tLezhQktOU0VlsueQo0pstEZJuUoQ+QEZGyim5XXPYcmQ1FLyH= zJl P0AX9QKIK0Q2lVsND15xiQjGG2NtOMZyx+kCUeKJAKWqOQmyEuIXg/mx0KS2FvFOxE6kYKikt= 4eE asfnAi0kKgw9CbuOP67wNnIL0YiihBh4ExpyOow48vB72WnGSlDQtE0SZE7EzQah6FB5sbf9I= 68v 2miOWNr1BBheqfwa5iLgFhKGDZCLTuXVbed58RV8nZetGkSMEISOHHUVNEEYEbA5F4kc7nArx= 8iR EoRjoWLJPBnCTTgLtJJ7Exp9tNsdArkQGJzjsakmFJnb7quW65BxGZ5r09v5uYsWz3h+Dj5u1= eF1 jYBqL6BdIH0khP7PteWls05dvvhc2SINM4cIgyqbm2E/D7+jMyOiZKgMOWzGhNMVPzQtlfLmn= Px6 SOBpP5gz7nDM3hxq2b0hGsTLKsafGjX08zG93X74PkUm26uLApk25pF10jQYdxSFHHGOw2RK5= oYK ek6+HDRIuipkuux8DPv37c+ipVMfDR7LG/REn2QR587eHV1LulFfNhw/pUgZ7MBQUauBgmo00= xeK R8kstEIkSCl8le3kibkDBZErcO0JFSdLPDoORMy8OOXMGSpUadtETisHkwwUQCfDj7/gBPOBK= 81V t5L9cRRUdUjGJ6eSZrGRaiiRpe98xyNFgvGzrwNTglMW2aUHDtrS4U0K7GxUX4odB5HIZpcLo= 50L nyDD8t80CTIgf0YgPw9LyaBUgWMj77yX8QSWTjIiOkCAi9GqpFyJkkSb8ZPz/PYYJTzwnLJGi= WTz I4jk6DLU6wmOaGB6GirExRi0BrcMYKJGebDSGPTrED4XIqxs6XKmjvDR25gcjYkFajXIk313M= xwz /KZckWqOVzg5RwiOhd8NGOMRKlCyc7RW70kVfwLETHhcqRqVHKx2xnoRMOQlnZxzQWzkyFhzI= jmM 5FgmKmRoORJMZ1MvvyJCFcEjFCRWx2RoPHOaMHhM8KcoSNEDRVMjRGRIoMwYOFCUSURix4RMh= I1Y y2RzQ/JBozQu983pjLtwyaNlDzdCYxqsswNHg3zvTRQkWow54TkS2XNxCMCA4+YZCkTTFyGtI= sQH v7/qESZyIdASvx+R1+iIHKjwR7uVA1JBOpQ0+j1mlHQDyI2R2ImaCe/fsgkxDqfJBNPcHmqDb= d4b acy8n3ZVkQm1JBcor/yQ6sVfEH25LaOb3DRInGuDFMVwuNanJy6FCR3OYnvOSN8rqgWO9OG63= p2x wqvZYywcLpzvHz3NWSRV9nJe8PYs3NZuZu+muC18R01xlEjGqZudc1YwOZkKaZFO6LGmjg2cT= osV hItpHJurFWpvQMEi3V4HUNU0pplbSyMW6t7rsrLylyQ9xhEAUztvw49Xh1ZjwmL9tyu0XMrL6= RLm xNtbybxQQKBFAZZRxsdzTqR1XFXSDSBCihmjjcTSA4WFha6hQ3NWdsLadBn4eoyy8FZiE3w68= bLa emZ0doFqvW6I/ucWAikke/uM3tQEXMq8ERNz2f4DyVU5JaqgnJOBqecUKmcjK1wlyKfFouykW= XZj kYixiIiBwKaj0U1HnXCzCSyOG4OOhkSyLZBAvQ2NJm5KI/Sool+Bi49zd9Bz4Iie4RDh4Wyet= MQb Zp8kIRVpkpPWARo1ZSpVnCAo2xqbjpaJe9HIldHS095U7UfePl4SJVaKpGvhmhxW3YAzdjwKX= J0I 5Qr2g0w+pDn3p1Ser3UpSEJG2h/BxKTCQb2SvEQkO2RkhKBXwzSoUYgqk6e/GGOanyt+eePal= 4eP PU29ipqFUxLFkAKBGUQLCsVB8ihwZ5sZWokqXIcNdNITIlTtBIcbjPQqzlEbnBYoOAvo9ByRq= gXL +PAPEjAwISTpjJSCtH6gnEISPCNJHw4ciEWoROYKJrxP5xWXMza1Tv19dcb3o6ityKzcO13nF= Kos 8MQ5jzZZpIcEaOgbkrQKiGpXcYId/kjeSz/EU7rAXy4bVbogLUaL50iVGYecihPApKF+2DM69= Shm MKdTWxmqmeZUgxduJ3BRxdkMnMMM8Iq7RiMq8b4vAMqlS3UU3doSQSMiBO856FLmGFKilD5nh= Z/n lEb22+G1JQ26YQ9D40CZE2TlntpKaFzpYgYCRj4SOc4T0VM66e/Krh29zT/MfPTF1Be5cvAyw= xdE IozjhMZpN1NgYJb15HbBCzY9K9tzfSejwu94FyxXHg3hQd/JZsN6QNlxSGIHGPDJGHVY2cIdH= MUu Nwr8KHSRgPoIJYw9rKPPHCzqEZNDXR3SzD0fONq34uVlVdtBjU+F2LsS4bxYsvLEr2OwLlFbe= zyZ wnolP5pykrLI23C7qLxDY1xlo8K0PJDbfQMtV6bMV2RLF4nzFRyGyR0IlP5z4j2cdDlPBPTCH= CyS qLwRMBkcpUul3MCxPN24zB6fzOlecv429lOed4VuRuYJfkZYkQhhVhOI/RyaYY2dJbMH1KlJb= LnD LScsWoeZN0J0Po5+iFIeh69e59o8+0O0s8cy5U27A3MsDYkEOI5Dhwpr2jryazndhYl58nTpL= U0z LHJchaF6EIbvUhKZjzs52W4DtjBXdz7+YOnhew5LJQ5IqSLHpVOiHLTxthQ4s75zZNnZlfkf8= 4xF KWMzQIz6Hkzx7dsylzVuCcCVK7ToZG5PMqDFjG2uZHni1jpoYc6dsVHkZMkCKpU210K4xZCeL= Ip+ sElFJIEXVyp7QjE4Ez+XCpcWyBTqs9jciZ37ubCjZETQ0KQJnJdhToMUL2fATUbFyZeQ+rjDs= bYs eGjASJzPBl8ODzGNDK5XJAic5g0MSNY/bErskdOL1C3OcS3hglGbvOciPCZwxjBQyTIkzZqVC= 8yx 657gj4bJliBYtU2MRLm1oloMQIbLtgyKbrtdVNHHmb8LwJkcjRxZz3PTBsabm/DpHo5Qcv0NB= 56c PJFztxAsUNeaT7XXkYFaYwSOhQUSGwEYp+jM7VZoM8TJQJT0FVgY9apPJ2xUtvzp55EgitUwZ= E7E 4HJPMntpM+1BHhPHFoaVyyHfXAxY+/fgZuTHmQiYsdwOdU9kTRgYvM8Kj3lgwKhE+yxn4YcgQ= PHJ GgllAkkGyRY1+Zv6VcROZH15IhbP3o6fV7Q3eSOxHWqm0iOxHZy+ykckdqOhHzR9PZznoR69H= Yri jzow5kO9HaAcbtRoDX4r01p16t+4thIYEOHv8eeeHjRtD9QybTLZthXN2STpU3pu1mnFwPtMP= 7sz yye7oZN66mcsrB7xu7uT5WRECAN9lnBIPb4ZfdiYpsoFu8uqVN+cTwQ2Z0FzoYiBBuVxZzbG8= ldm ru1eeHWMeqxr2pqpRZvgcoy+UybqqL6QRuFTNULtqdQCE0trDlbhWdfVqmlmU66xTyTxEsdx5= r1O qkdl03fTKfit5e6iZwy6C1yxT0aKilMLRCBEcAhnApBQWL2PjWV+bZjy4q975REIAjgAbcInF= 2fu WurJHZ2xY6ILxLjYMTLssPMOe+HbvzOumglMsHxIHA6matS0pw93qQNSGLJOZiED4fCUKREHy= XVE RwABnG8GkSHQsc5tRo1z1/WPom9snTqdbKkz3szQZzQyLlS5x9t81CYuXG0YJm6QvGS8CuKSb= MOp qwmWFCxIe9pOyeWtNd4uV99xs5c0xQdiu3goalYmV7Iv8e2H13Tv45HkcNBsnC8ePyCkXKmDw= l5B SGDZrJclcuOWhyYWPzQv7Evi13x6Hpz331wZlSVdRrS6MhtORrI1AIFKgJAQcCAD52yzoQuoD= FDL HJHdfcWoz0o7CwCIy+GoTKQJnT2cM3MxKtQybivhsYvqrS6xojIaESQ5K5KXCw45Qx5VcPCpK= hov rYcg0PDdBoS2+IJ4DjSae6VdV80hNs3oz3D22HcaZoIlzYU5ycrsa2cqWTa1e3aljfeZubaE3= dzg mQyz5SWleIjFyhEnk5OR9qCcwSmfCvLmk52kGODvW1oNKRapNdGiSLPPpbnS5MmuphrGTS5ME= iAS VbM8hrnRtpsSw4Otihc1JhJdYePLRHeUAZk0NjdMRIHFwuMfDpqRT7+7zJn7UK4X/gN1Iohjj= brI fM+9lAuOPNk8awrJXciW2V18ClWOwyYsqcHlsTlmZ4hXKx2duuw48xjqsSxSUFFmXLAMKFw69= ako hMvXJzIkGUTd9EXMcpTc7GQxGVgg/UxuXOToaKaDhwMW/ca+jmJZePD1FhpEgoodQoVrKrKCq= qLq hLhwo9o0+0rD3j50rXstB+e52JbNhc1nzZQ8wbMnmJDcKyhStoSbJkqfVDG3LFzfh7fTl6HXT= VoV FkUJGDSIXM57edckM99YMQq77RdRV5IjupCcprrFoCnBEjSSVibGpaMZ2W/YTCgKzsWNiDZKh= Ops Ta8BSJ2zIFTRzBwMwQjQI4HYoCRsUs6dNrYfa7biiYBhQpAdW54wW8JFJwJLihBH1GLjlzQ6c= GCc lCo7u4uppmc7MvLbOtYqcNhYpkpzJtqsSGYbTa2SMGj7IFTRkoQiV+zhdUHJjYLGjR7z6EidO= dIv Pg0jwzRjBsg2VGIKKKNPWdau0dTYbEMBg8JzkbJW6dJcJW+jhfxmOlhyNjZMtUlqQqSlejyHa= Nxc Co+DjcvAobmg5WQ9DGhZUzlGwJL9whKAGv6ASXMpaKkj4fjXV8werY1gpKwRiKalMKxSI8ypx= zYW JmblwkUOCswsUyZsbLuUkWYYbR9Lxy9rPcKzpMiZLQNylEWyRUYYhskaMyLyKXHHNioUTxmQN= XJE SaOXMrmlzQsWctYctAoWHMFBzMqZEjFWPm5MiRRxhRmyKlCBpqQcjeZoQnKIwUo2jyRM28HhV= a4O VmZNGjd7GCmFGbjFHmMVHPbzjUUgRUxuUKUtIZWTI1NCpQuahwxaRqHCJag5EseNEf0+IUc0J= FCg fpGBIYuYRzxQSO28DoTIUM4cK/TnXWPRx7aEOCJMnyRGODr12MzGDg2FMxzaxoTGqplHYzqVi= VFp sZ2NhxGYa69wGxHnBy4vGs0bA5o5KPioaUdPXs1I+BScQVtTeKciO16AOvxpGKpq+vFzMDYA9= RdP HGcFhJ4wd9Iy6QjPurnWDOOyqqgq1j8wcVmDV5D70di7yXpatS22I1EtNQ5pnaO0a5rhOA+0U= Q1k grKaG7bmc0LKB8imfaUcb8Do09ugj3H16uOkrOnsmj1Vs3dcHc6WcHHrNi+TSGjh0Pdp0e2cr= EK7 iZLFzlSWDoDm4m94ORIojOaC6VmraDx9l7U5znYYRqrB9nt1itpGlk17malObltH19PLmbJSF= vpr JAsQ4YPw8Tn5PxW9njVrfrh+Kl8f4bAqoWkOCqhQQnBbAICZI4I4I1FFUMEcEbo3pGi6S/Ybn= sU9 ibuNE/nx3MZqyD5GgzXUv5VmhpduGby+7izyUTPIghvsjgZI0ipeIMiMyvkWujsgjUVCBoJph= 6Nd I2hpNjTUBygAL9vyEUIMMJHNZJ5OFc5MrRIsYwxiaFjnkDA5NcIHho/ehZl+xC1itSpkY+cNT= 33x ITMExIU4tQ4zQdmYrRpQv57Wl8emicSniEkkDQ8M2sEwJGzFq51nEYZp2MH3+JPG5CBSvlxse= GB+ WQmQri2ZIl+bP4PQ0zPK89Qv/dMxU0tmO5oZkNM845GxPZoymOe3bHQ0zwvEclND8pMaSdO5F= 4Uh D5z7oAG+lI3KZhRIT3I1ewb8Fx3ODjIoaXyYy0GMpsRNMyxShPV8xShwhQbJcklFhOU7Vrag9= XB9 LyGZPErPWhpxKf3EE0LWYuhcMFMlj0eIkvR2ibO08SFahoG/XglQlElMow69OmxI4oq7Gerbk= MOu wZijsDogi2yTibHd7j4UAFlPJB9ipGg7NOhBGtJ0fN0eZuFytUBbvckqqgkMhTvghQ0y0waNd= naJ 2+70HGNlyF6BThEmFqeESmC5QhHhM+8cq3j0H3ElvMFJiMUUtL2rSuR6WcoeFi5968UTHc64Q= wZN nDFeGSNz0yff3g+GziFw1eR7TkJseDfR2hvPDpB8FBi5aFCS1dmkai2Frhmal4A6jUk9KMOLL= k5p UkcO5e5W44w3D6Ms0ZkMkEVIHinW5g3QiSAgwuDzNkZRQvphBgSDyRwgWh27YsLlsKiAWd4Uc= jez R6b0sTtTRmoWPpyNt5ei2Y9iaaRwlxUtDszZU3w9Y54SJfVaExxhzJ4YDBAzA0b+FD3kv4ftQ= rzr s7FrfcLahVvlo0zamhykaPcuMS4YYe8BsS5F3IUKzdZuXCBZ8i5mLYzIk8jOUifPNNBSxIcYx= lUZ iRkcim6CfJOxLdd7PWC8bLy95UXhtYLKFZPWb2KOTKSY5iakrnUar1LHPMqjxKOULml8JjTOe= RiX 7P68elC9HkcgaHImRqwMbIn86F/Rkh78f8AJLyTaNrJ9tEydNn2zFzIJlMjCCVKPZ5dCA5Yxw= WuM ds8oE+HFN+NUdaJmDg7nCv0eC4XqqF6lSZMMUJmDAVoRcqSLGCdrwKLI+B2NHSexhw5yczJsO= ULD 2KxLlP7WksHRgeR6ORv4Gi5kiMRNlj1qGLaLFWwc8hono4DFzw9ui93JKiqWFlJZvQYYb9eiQ= bPh A7AnWpI3uju9/31H+jZajGRtoQMjTrjk5JEzodCpwPaM8xShIqZwPo3Ie5ErPvCMIVm1iuc0n= 9z5 NkLdeXZ4bmYueDlSZIkXLhmxw0Z4UHIly2YjFIGShAyCcqMTOF3Nihc/cC0hfyyhfSP5Aah/b= QA/ CcYB7keHsRy0d2nD3BsA2PUjzI22bw9nUjqP5Ar2fDRZROOvV36KPbiUv7fJspVqshEF6CCn5= EUX 99kR+lgxhY10AtEQTGMREITxj9H5PzfYv0S5/F+iL/NMyqc/i/MMNKjmbentxYE911S8DEFYq= KYa Znhes8Eq4K42wFS4KwBwBXSFICrgBBDSCukFY6ihFuCt1LpYDMFaRECwK0qgkBXMFcgaxUEDQ= AIm WgFYCtzJy7OjfxxD+cbdZRUQqecPLO9jCVhR9Lv8YtFFFdTRbqlnk9fSXrEiintV1nB0+Gf+E= ICr 7f6c8NVqLxlD8k59rRTSet/Vnlk39lnZP3O38ymurQutngp9qgZLOPZ2qsM37xp8uXxX7/x2n= Lp/ 8z0gaL6Z2EmHVxyYmIB67ZiBRSSSi6+euKlO2WCP0KqOTyvB0cI9yA3KvPIt1IJcgnd8O4ogf= j2y wY0PQZFU7rrlpnBIQ5cw8XMlgqSi26jv45SXPKZhYuyXY9zK5AUmSb/iuynS2rkl1VLqRWHjd= wn1 8fbXU8FOyNYpGxJ9cuIBD0VAEkbNlPsr6cg6zl8HX7JbQBetHvBnxI/rvE/KTfRYefEYCi351= fCh heCGIYuaZT+xYMr+X5nXivk9lBhudTkORBGl9y1q145wll5yXS9T7dIxWAfTArJ5M1FD5KOqa= ix9 WA+BC759PH6oBJQMvCX3wx3YFVCaqKqxs48Fud5vmollAuuamn4MR0zcnk3Ct45+N/nKv9ZR6= qbK l5W8+Lx8OkL+LeNLXlVawhNSbMP1Y9l2q2ipvnR/kp98/B9OGIf08kXVUKjfew2+DjOBETUpL= 9B/ tUET+lQ9afzSYyLBYCJBcQArFkkJ/OREZAVggftExIOJJFxgWI2iyAFYSH/jSiO4kP3/2wuDD= SBU MEMMYXToTGAsIgmhhpkxDZm80MgbymDp2kDSEx0JJiBKxYCDAGERkBMYq8SuoFZtUkQJJEkUW= EZB gIxYxIiLJIsJFAYDBYjGCiJFkGRIMixFjEQURUUUFSCQUZEQEhIyRh7IWQKFBjLAoUFtllEhJ= QQR GMVURUEGMpCwsEREskpS/TJUVRRRRQUFFkFgpFkVRRRRRRRVgoooooooosUWLFFFFiiiiiiii= iii iiiiiirJFAgsI5GImQlljGIiqiIIKkSMYxioioIIIKggiIjGIjGIiMCQioiIqIqQSDGIIQhCE= IQh AgcmKn7l9Ko/4qqleNksA/0AwPtAP2QTIFYCL8yx+0Dmror/4ufvIHjsOQQVA1AfmBdPM836g= w5V fgf+ySJ/0NdVX8C3+EvDBQ/gn+ZZuf3Yf1RD4/5h/0Fv/UCxGIH//bahAwAIqn/uv/Y1mmAZE= Ezt /NDQfi0u9ONhxCXf+18ruNAApdd/w++ZP+USo2g2nfDUz0RDtN7PgiGaiEiAgiRCDBFFZJFIJ= AkF IEFggcWUP8HoKRzD6bcT/xDDqEgthHMAwyMWB/+VcU/3EIxTFeg0BLmWVUQowawKczMr24JiG= SUA Y6xxRCgcA9/LvsJ7BF20NatrYQUrJKRAUULEFAoI0QGwmwn+LpA/ihxFQhrg4tB/XM6Nw48eb= 4go XeO3lidKlhTsOUAe8MAu9mZw2gnv99KglslLSFtL8Vsly20hWspaSiKpUaNKiCUZOYH2f4fm8= r+h h9SeuBg3qQHiSzR48vDwscugDWGryVTNzcC6g2eATsAwHiA8InMkCctBCHLHQIaaijTDldgOx= QdQ 4HQhBTEbN0ua4Lx+RicmOZwtTB0pGsblHKXGkTKSFImnQIgcgmamrBsKZa7gFw1bREOVfqaNf= QUd E9ddh1CYPeLjzM/upFDq2Dmnf2gcQcbdMHEUQRT4hYWIYd/E9ZQkDZNoCCMQ+otYkRgskYiKd= HIy SHMgSnS21Y/dgZOGT/6UI8IKnD1EcjaHiaNRYAe4AsROtZbtIQMjr33EbB/9X3wU0A+hwDkBQ= 0nZ xnPw1g5g8aWhDpdq7DASnEAu0B4nKkQYslEO1qqkUCHogKEICY0G1gTnoxt5eVNyKdeFrQfqF= NJF hPVrAOQNoPELgHQcbEOY5j16BudIc4NKgmrvPbqDwiV7ebmo7vuxMD00IFQUzPdycY3fIO921= 3Bw bNgN/L6FHGFx7Toc24pZ8FHSrgam4BgrtegDZWbYMBAp7B0nRbQHbJCTvooZBnfQ8sfFRflqF= ONE PRxckFVDJ0kV0VSEJr9IxA4AwAuGI2BwS3KDyDqFsYgODDESOvALrog9Y9q0dwbvR2e0h2KRA= 2gW IMDZ+Jx55RYzW0AiRVIZCMB2CBhTlix/70mejTiZEHNMShFdKxEMQgr0Xdw21nGQkM1P9MRXv= ihC B4zj/bteZA88PESwgRNinp6twZhi96BkDoQMOU8ADMMA5x1joPCDMwugHlgcfHTXdR1aldM6f= UFI SD1wMIAYhRtw/qKGwKeZKMTgNJREerOmxyEIKBzmeNwNwKxN/F/c+nSuk5tYhpoqUwanbxD8I= 2w+ cgHkHUYqnYIiQoGgkDrd+TS1oAwx6gYZRGrhWNucLqDbESmR+jOjJo8ZZPvPI3ED0PShWVpaS= 2kD 8WG493ZsNZehJGEDd0ra5XF7NmmvbK2yrUcsvupCxEkGEnEdZ1ttAQlh8tp6ANyOGYEBNAoGY= gyI GaV3BC2IOLjf3WWxYwSfpAtigcgOg4PSCEZY/ruz4urtsnnPZetSPKDFDgVJCUjUHKFOgpOWK= WZy nI8ahno46Ot8uGhQdIhwbiMdViwDfMyDvPASAMMDAMDDATUBC7ltaRljSVAojbi3Nw0Zh3PbY= koF Du0gGejetGJ1kYwIxXVcOQGnavLV0JEZFJACMQNzpQNOm+009sEnTRRVB0QkMP+F0vrTPfjsM= m9i IXIdqrseOhJiESGJ0gnpgdFs15jXYOI9lJL9zjcKZQrINZZWSsbZbQLXd3JtSZ8j+SuCgjz/U= 7ZN jDihRBYSTfmTnJH3GyszvdSZwB1kTBhGKCB+hQOKQiEQgS4crYsOrVWS3oSRHEZB7K0C3cDax= utm QhSLM86QvBwP+1HOIHSPIoOhaOl2Kgn3ZHuZyH/0t5/rhh/T/lDImBiU1j/1t02q/0tzR+U+P= nf/ 4lr9kC0P3fmfx+/b/h/lJ/XAqEfy7bOB6MD8L9c/2mP+uPrt0azM0hh8SUD91H0h7/wtFPnvB= wPP 9D7z9E/mfv2cdh/sPCvnWil/gCT1wYG2psT8z4lixHN+WbrMBuCGhVNdhHgQU1K6J7MtPGrjU= WY+ T9VwwO5TjIkAEKkKnGTCBWSVcsJWEKSpHCQCkLwDGBcwXiY5gN0oHVsI7kAgUXELupYqTWYts= k0P JJEIb6N+jMkNeYB+1bH+Rv1qG7DmfoDWElFEMDidKennI+LF6qfiLzgFj5HQWD+ZcwchjXzch= D/A YqZLZI6IdhIf7jVCeB4GCv8vD4dg/3JNYnDsiKTZh1PIPgXqHjTYhh00ylh2n3vhMG2YwqKQX= gNo 6JmhhYzLInBATmcHLpaaYLkJEjsrKbG5/aWNFjQblpsRs/s3aXcOAmCXaCUNI7Uwf7W7ZjpLm= wuc D2SmTqlRE1lKCGAIdp3ChZzIeYwXNWSBnVFMCIpBidIu8GqxAqLIJTCYSHTH+FmlZZT5YGBjC= 8Kn FCkqLITPhKRMCKwoA7LSisFAkBYEBNHDJFSAoheKC0KnEGjgphVSKhENjERxiIskx9XZcx9QF= 8jX G+G6Nw1iNDZs5tG0khLArFANiojBQ1BqpTJl6hhkBpIwMSRMsOhj/QHNrJCBtXFcTigAeA6fF= YZh upzZmQ5NBYxBhskjgziCwBsLgBAgGP60JH5pgEhfLuqaCHyXydUVOSmiSm3jCY6bUPSM98SHj= tbG xHyD2h3mtMUkmIGoyX3kczg8DAhqIWYcLSQ3mGjidwGJsQzA3LpTQxjqNy0bBs6GZyMIMlP4k= UCf oVAoCRLULHQaglFSaz6Z9eYsrT0F55mtPB1bxPCXcp5CqgpOTR34gGTgDUhej1+Xq6q2beYws= SlD tOiGGCWK8TGUyI4GcktJknU/D1VIElQOjgRCS6iQ5TnjO7szp3dDuIysIWbHi7+SF8APCcQ1g= FlD I6X2HD1qgyw5pFgGCiR6g0EhYAiV+IY4nZyEFBh2Yg6bKhdbWZLQN8TIiWWUwPBR0HAVANkj4= KME 4JgVAqISF9iNfR7Z1bdZjsRUpJrQeFNIdiUYDryVkeWkYauqyqfDp4hPWqrRJNasjYgbgSclc= aUW 6Sl0ipyjIosE6O12ItBAYaDgLRd9qIKFpSE2kyJG6QyXLKC6qq2oXZjMGeCojxuljkGnRL2ta= xDC 6Ogc24rcywyoq9URNY/9d43N2u2tpwY2aeBYXMIXDNDVyKrpCIEIis30iVAGMFQ2wawJKIQzL= Rkx kwEFhICCCKTXh6ijbKLUXwceYRNFNZMEdVLZKhJRQ6DNckBsx4gNqkA3jSmA3HS6HXgQhL8Bz= vd0 DhxSNqNoZKVhGMHQHy223uZJ7Pk0KuHYOMXApTfGzg053Mhcc3IhIBGyBkUUmgaWxB+p8TSay= 3Jo GVOVSjpZU/NUgoElR7fs/jjAYp/67/2c2h+yEP90a1t+/XjgHBi8JIJYIO4jzCCoEDLQ6JrN8= zGG IuGX+j/x2kTJj/7T8zlTQMjzw4ZE3/fQpYuWIDFXKnXI9jBcIm4T/3EiI2uGIhkVIBWzU1nw3= RrP XRcYr+SSQImT3a5G1jAb1YmhVMlNDLw0khCypmDZZzW36UO8Hc/64ZPPDcsbDKGlS5Xnmxsa8= FuT IYhmcGm7QLaETLLWRNaGeaiYwO58GNjEiFKETY55Iu/TP86FYnUuXJmu5IU3NxzIrJI5OWNSD= kaO OFi35oX7l7rwoY+EoNnYZMzMjw0YgcLmQ5PhNrBcwFTJaITrY6CYhE3c0GsGHueV0XKuewsEC= w4v xoYK4uBcCxqUqAbHY3gIaqKbEzBclUObJDETQbNxHW0lkKXdfPpoeEn8MaxYyYJxOVNk2OOOV= 3vp g8tc8IFTwpqhDLUNixUnwgnvfBjAqLsMWK6aakCZ3JVIjZawMBE5gSwO5YmOYw3Bc24IGLYLm= OCY 58kE1r2WRtX8JT9jgoTO/ZYhAxamyx+sRbSFlCmEXNZ2MiZM32KWMyJIiTLnCkio5qUOC1SkD= Zot 6aHN1GJjbLnvvLMkq3JkYHhIvPAZbsjRUOmySuY4VIEyBRYMuYu5WnQmSMu/mvj80kOhf7D5O= CBW /BMudjY0nsP06cn9kydS5Wz69BjOR0KUOtBxzIUsZJqZGR0/v+3lImXNDXmORLeGhEbupsUNh= b1F iOX5InIxwKPJzjnwmFC5+gL1JcUMDKucFX/X2Zs+BrZ2Jz9iP4cpy8H7EG5ABhFEx9qh/S3Ed= Bzm 07Fb6idiRpc1IczInB23Ox1oktDqGCqpMUwlxS2ZA4OgMezn4FMWMkUkaDGFClzpOIotvAoRH= A7z PmCaCkngI64CYKJX+jocAhq31ADqKgDmwyNsbbclDw6n3iAJ0JHUgOfcIw1+Zof8qkiJHZkgU= PEA cGAYTIUOfZowSubMETZYl/k+l/vMixexBL8uF5FyiC7EDhZNxEIJHMrUpGOs/nAG+Hp0Mry4K= V6t 87kPWBUxjuYOq0MhrDnjFTg3iuxxOlChNg03Tux1N5Vxtsw8Y9IU29EE1kRNh5jmwuhLMU44J= 8zF KGgaJjVK97wsSsWicC/DHPh0t9FjAeHalCZ/E4ScNRjfYa720nUnoLo+B2A9HJRm99A0REIoB= EjF AoARKCi7EKII/wSKHrR4uz2NwJR7obC5aNiCyOl6UeJWAHYjcNRBD3w688TcV2E9772r0VRbc= xbU hwYZNlkoJOOMDIaOJhDZqkNlJJkCSfrNnHw+s8EWHBJk7/J+CcYAhVqMRK2JFrFtEtqDbLRBF= o1B WkClWjCr8uZuEKajH+rMFkwlm9jcuWankn9UiY3cBxfZe8JNzdaJMCn/KEthmIr+NORm2bqkJ= 4j5 AHt7vhzCfp9lnBycYL/zgUdYuP4PEfa5XiwlBUSMAkWBFYgoxIwYkWEXYCvxfmD1aWIwkXYRj= E4r NixXaDbkMNAK40QPrEOYjaCIczCh5DSbLHV6QuI6x4jWlkYQBBuFgS6bMNWgTuTWPEj7+/a8c= Dyi YwajCxKwO74qMEjJMBggww9Us2f6YSPCLyS4CZnqVyFDtoKBgPGFBQsFjAIQJIgQBOVEyb2Io= cD2 R6ES+9XFfTANWj/lSUoChpC4bp1Ef8rHWhsB5pJVQkxFG/tFBv1s2Vdw9bFzY4Q0LIhyxNpgj= cYg BincC29nVqNaxaCFOhzIO0/OkDgf14rFjWjy82hD+4ihrR4+Q5Dj4Q8BmxUeLi2GwyYYGuiuu= g1A XQJG7Axg1ELsb0xDeyxYoUDgiD+tKFiQCw1BE46sukboaCwy2BYpYC+d7ONbQOZYWBXJVwyzl= EE6 ISBSowEhKoCmCkihR4Og2DhpdCAbW7OqYv4/0BA7A0KcaGJynxas9QmiFFhB2D8Udv4kVAYki= fso QP04TA9wHBuxKJGfFDGRIyUzcBYU/AQuUP8c0bnuNMqT7fbi+35mZ1WdPQP3lxhCEBYzIoorf= XrI /JCh+ZofmUPUXMgTIc4bGGNHd3JXIZjYhgG/xYMlslP6Qky2ni4yjCUYa096bPCN+kCo2CGDJ= 1zA 2TwySPGuwsyhU0GJoSzS4shZGPoCJjSetvz4bC2KUY2qHJqbC56ijGRkXGaxSlTBNFHODmJi/= Coe QN4nYzg6ESJ2fTGTyeIud7KYTkxoY6bGT5oTIkjR0iw5k0RIyckGHPrp545K+TVF8LXMarQhu= OoT P2yKkDfVeIm/IxqTMjnYiTNKEWPC0CZckYic8wJiyIQ3HKa/uyJQM704NRTMoZHJRsk3LDm6T= OCT C/CYSHOGJGRYkaEC2RdZ1MFjMccsRJkLsaFdCA46b6EhpAZKGCreDDEGNTkQMnz3RSOuuOV0Y= NkR jXSw1yMCpQsWG2XH2UMwPC+BjowywX3CXRihyNgY2WMYKXIkTtvC4xe9zyfkjtLzJO+2o5LYc= iZm hLUiaEzQ0Ry4sxirEhaEFLAUJF/AnY8GMTLXMt1ojc72sctWr8I7N6OENROGZGnnDnSxQyWCR= 5ox ix0qZOeRJGjJOhwicN+EihO53e9DvUgdHPMm/3ZBfof2k6S01iZYzmfnh4djVj4dLWoelNDrR= 0+G jZQkSLmhYy5EvAYsXNF8oGCRWpAhyfRFFkazWZY8C2u2BoNZvy7FehHWj2JBYwE3vNyZFjMzO= DhP bhyhqg5qS60FIi1PEgc2Ki0RonI07tmxNygYM6GBSZcgLqnT+XyNqFyZYczMEE74NtSpHQqiJ= tE2 bfCzFRbEchbk6wsbHPirR4cLjmokeFukSm8HSIoFzw6duTiTkTHIDwB0iXGPRAiTHMxMGVtiW= Wg4 8TMU8kEeKef3eZqYLFTBonEpXLOzSY6Ei0yReZCYyX5mwxgMw/WqfQ/HUeF7rA3K7cZkN2smx= 0PN E/ygDfqFBtldUZUqVr2xaKeoIszsbmvgTDtG3jI6Eu+dcyIpkS5IqZXYqWlhyBYuOde5C+JyM= jvD RxdgfqECj8/mtQn/WqhBn2qnxehO16j8fW5QJdX0VosUQkln5Nizgj6wOJH+aDTAPbzu2Iv6w= WEB gVRIAdDBXFzNDbaW8Nnb7fiCfZHsUdOmAcYcGDUI2EKe/TfVDV6gV4i3N6z1ct3XSJj50GlGj= lEN v1ZmySZv7DPZ9UmtGJrTl0vvKGJrXjAHhUPQ3vsaETiAZKDIaGWT7J+eMpj2Y1otA/PSgJRVE= vfl BG4FUX+/1zt8dw5Twcz/v8U+8UAT4afejZHM+cAuRftoX4I/MQJ+kPTX7uQvq/sPlcQXTUEVB= bBl ohcYtjE+BcyuoqZhRPhpRYsfzDZyxwD9Zs59Xs9B7pmQdhAIoyBEkSBCMRIqQ9aUiIMQQSMQF= YxA FBRgJGMRIDEERFiAkPd7Nk+qCAh6oiqZne4Z8WYXDYXJBCDE07Sg2NwSkIRW4AB6fn2HbVuq7= xBl u+W0sXpYbW29uEedvZjgXwDYIXVEYKiJScVYPyVO7kKwOFgQ6OTqWQBPs2P0n8nP3nH2kA+8c= idg 8f1ESB8y95H4nlgl2+/W5f9GA0MEKapoPWBUjEhkcmOcGSX8kKrzKdIDxe2pcyZPTk+HtH7xm= esC B5F8RM4gGjvhYiWJkzzd1sqekkTyFTR0YbBxIK90VpY1Y3s3a30heToXsRi4xSkzZTpDBkeRf= 03M cyW6TOkmu5UnKy3qw8jujZksOU6UJMbkQ9yVnqBGnCkag5yZuhUpsOF9miFSmilSBsi5pijbg= 40S DKccWDJ4RP7qNlLbIOZPNIWhrmxsnh3oalLjGpMmYFJDmLwKZPYsVTbUnIco5UY+CF4VKhW3P= HOW Lmz5GpM9xZmXposUGfL+Fq1PSdBzuyRMoe6KYLlzt0J4bHmxzmypgMmJlTBqFjEaikyg64HHM= 4E5 lDbLBAciQ0tIX+EFERemTHmLUnhjGuEDpciQMFTGKhew0RjYuOykqkS5kPEqbGQfKU9qGo5ma= kBT 6fUgXcXIsZBQsQtKUDUoXmdKj1N3KmZI2hgxFRzCjvdJFmWRkylhjAxUwEC+2UDoWsMERnJBg= jgO HiSKFRyRcXA5EUy7K+KK9r1cr2IUResj9X13SzGECRkiISFL0NTB4bCxM+xwMDHQ7CRJ9zkoC= qVg UKTcmdzsTMTNHzjgUWpA7mkih9gIm/uE8wWEsA28QpCFNQ9zGlNGZmchxFzX1nEGgPAYz7jyy= Sll FkYlpSLP12rEQJhBtCqpWiqu/50L6Q+4IGZZffpGk70M6Ew+sGe+IckthYChB0ddn3GtgMCIk= IHO pxdZ2lc52FdodxgZFzo7bddirnUZdx75nuU3+rBUmfUVFIaGeZo5pIiVYZmNYIaupW4THg0yx= sSG KMakSJVrERyWDUqZFz3jFAgZEiI5MsLpBVbQkW/UIIsxixqeB5KHKd0VGAdVPVKeE9DgsMK/Q= Y1O gw7EeBQU1ikxxehyWKkiJOZKfUoZEBTpIkR6kiORncr1kgSAamUSDCBCPVKSSjYdO435HFOnE= Uy1 nr+ngmbhEiVI/tiRUKBzIkTLGCIMTgcDv6wZIKWufCx9SOjFVUYXBgZfyAuIWvyPFI/UbET33= Ta/ aIP6BUKHgkZSUAUDlZDNz6d4nJ1iOcFTUaCHc5rAitCQ9DdKWzMrmWvA2GjSaO7z6OwIRMaIw= 77R Toge7sBWvESMQwyDFOpMWhjpEXeItgueLTISMSHqg/GDJcGi5QD5H9lJgpkGYQKGFE9Z3NwUd= 9MJ kYbnEZRrTWiWH+J/KN+Kj5wtMdwiNNECEDkC6eIOvj7M0+OCeq5cghIiSCATySkaDFACNUEIB= 0jV RtDrVbiCoGt1EHp9uJsbuEeTllfj7KMGPN0NQhxKHs+NueB1UO+ybVB7Sg8z1CWeX1UzT1DDs= nB+ +6CJ2n5OS0srTt6+eJ9XAHO+Y3eS+kQZbuEPQJs9wzCJPFDyBWFnj1tl3BvCBTGmNAfOOIkeP= v35 3heVxUVilU/6dtn03eUmLLwzqhDg4Um4F41DtscugGuSKV7pAr+zVVRPNfmTSiRPwF+/uh9fm= DtR Nh/T2yyJXsBiC7DcDELC9BFpiP/4EFQJyo+78/r8DkVxpWoyEYAIkSIQVgQ6O4spMNSQL3DxK= QQR UVAKklByMiHiE+8JPxIC4/genSJ36xpjCHdqdCM2/kj8xAeAnuD6ZSBuE9PX168GZmZYl/Yeh= /Ub 4eOBFKP4e81rXy2achb9eFBgm6hROLTjUxeHQzAdZZmYZFe8oiaHGJ1IcFMAXkGSaDLTow4NG= JBj MOLKaCiRhTRSpGEh0zgzi8Q0MkGBxENyWhYqoQIMOgjCsMwwxUqWP5P1/pv+zhfhiat2iW4W/= j+3 qex9TPJCvrta26MrNDFghqg4Nn30MwfTB2GhNZZozjNhoSlFwLSTS8jpAUVRVAUAve6s0zI4/= ZvJ RXu+x+wHJfkfZsfJ9n4YpmX7jRgyT0QwaKyDeh7FipY1SxGxMsbNYwRPuJAnSwefP1fsQura8= P73 v2CSwZOcSXA+/EbtOERo67Nu5vxyXOec6HBI0M8iQYUjByFSB+xC1ixLB5KTH9+4SCxoPR5np= jYe HlrEN889KmjdG5AtIyXJmZXsMeYKjm/dzIkzxJbgR3XZvZE8HIkOOHwgsljhEa5+iF/YAWj4Z= +G+ rwwOM0zfbGzyBs4QNWKFAqUofb11JNIiZtKuhALP19UIFPKwEGDwscwFSp9RLDnTNlENly5w2= QIT qcJmjMSxnQwOeH0VIky0TVS5w2WXtTJ4UwVP6kLpo8wREz1Ibk6nPLHBQ4TnVKAsTQjNRzMiD= qyV pVSqhIcyHMixEaO2xA+ReJE5JPQ2OiOUY3XRAjQoqnJGihLC7+wEICGplChDpogdJsSkemypG= RIl 92NjDawSsYlss5o8KECxApccrQ0aOFiJmrGYH6kL9aSQI0dPsvX8fdzAfJeErFSEjZscKSOFB= uFb 7se+ebhs1IsYyWwRMkwj6TIt8Ikzh9gkpEKGp56YKSukSQSM4Ou46OU3iZmhKJBaEciY5ag5U= waO F7GtGR3PfbSLZKJZ0MRIIyYHJDnDZ5n8YT2nysET3P2ZcsuNita4nWEISTtDwUvyf+9eLFzHM= CqG gGiEKDMLC1akLJ82UqlqJKbCe6BoIaNy8bkpo9gVJoqQRGigg4QfanVeAgQXrfnESJ1GoUO9L= FfA 8fBMhnwWPAoRTxwbFCJc0o/iVMiIjpo46TiK70davqOXz9frKnvkhAcCDzkL2ovJ9KaLTGJk9= dWQ hAn0jiATxBHEgWDtEueZ5HmbnY9BevkeBE8hTxPLBNhvInNXKkhyTHu9aEC9BUkV9Lcmb7DGq= Xg6 nroQrlMmRMi+RNxyUytA6XJlB5L0uZKyLjsWJEo6IrJiZ7I1fwP5j/mQxtlq1qcJ5OmIjkTei= /z2 h8CwpgODBwSvLKb8GWohaIrjmYaF8EKKX2BhsjaII/gzfX8mB3ZCcGRE9PdGyJxjkv48JH3oZ= eli QleZwqdv/m5j/jiQwfdqsW5jLmvOUGGJimwiIm+Rl+7zTk9Q7hwKEjhrdzxc7TxxyOfof+U5z= /7q fmnsOI9WevX1nKHnkfrC1qKenSLmMPUNjrKlMGwfToHRoRxPb8TU3IOahznX6Id3dDwInvPMd= RiR 9Pc3tIInf4+QxOJ2zL0MFihIVQ8Nx2Gg2JcvicR7RT7hXP2ZD0ou2K1EWZd/ciqOhQQOk7X00= dYT 9KzXpmccmEUIwHT3mdw79ICWA7U9aRKduCUFi5CjND8CjvR+A9aD9Hk2I8iJ8UaEfiPr5gNiD= rjP kffShxs4jjIUZInOK0OomcEYZ0nbALXEXRtR8QOa33TKre+ql7ydYr4D57h7nWjRt+gB9EfYY= wxO og084j2HUFkNAViCunbPh8bcUlwwUB0iCoHEgfHEDxR61cEFUMVPNGCbeVHiPp+AHhzHN4/iB= +qg 6gfP+l5YoftzX+UdOfqKF9QNdWj1SH4pjC9M9P6j3fjh1t7THloV5ymiQpvY4HaezvkjFGVhD= gSe RvOC+TvBnkydM7edu+MmCTwYHKQ2wrITQm9D2E50eHmMPATZROs3ikWGgZnIKKTFiEP6f8ENZ= WVM w2S2GSSWcyJc9JIuSoVmQwcoNBaUHNVMGfCYusNCh0m2lOJlJCFocabUi/COBkZCdlWRk4qF/= sqK 8yO7OlgrpVWSZBa0tz9w6XM2Ns6wsrSgoxBtDQGE8FA/1hu0negX8LZ8AoK7LVkJczrEIan+p= HLU clbEMm4uaEQG4ZtKJnHgeU3GPNAhuDONGJqUoMopsw4VnJmG4aZQUAmDmy6eNqWJjGBmFIiiI= hdE cXaBRhyzEL0GR5dCXsvzVv0nn4cE+a6iF91KcUTjvQbd6V0Um7KxCwXyoJAsRLkxurEGsBThu= GJZ P4ooVFTH0x8MEAULFrossPCaNTZ2Z2RZlp4UzNpIVMff2zWqycMETEw79wrxO8ym5M+by2e/m= cTV OY78TaMtCximySJMIoOPYkRV0iSCSSzYgO+wCGUTgJViiggqo4iqVxBqkVikTzrzSOmz1HJrs= dpe L19u54E9cmp63IYplMtrigYFC2CFrSbjuPG92ExpaKaMQpMmHJSogi+87H6jk7mR+rq8hylCB= 8D1 /TfxCYiwKDEvQxgoeo5GYp7CjH4/y3pAUlQuGVxSxkUKETDD1GKU5cppIhFdSYtns0zDmTa7Q= XKR X9X1+H27d/4/L2rnPL4+HT665w+X6pddeNssvLD+M4dfHt64+vX5/Dafh6MvZfD5wf3HQoe/k= XxF L+3s5yWX291AfsYGsYK9oTPAZC4xQewsQ0wOP3RiffYkXcpUzDA4UsVF9DUyZqOqOPIZRaDZZ= aP6 BJYIMSKPw4S64/CZEsw05ntTEjw8M+jjjnnsx3JF9zYqVhqREzNJjzLTG2Jz342huVJzY1FCA= z7m DW+7E/RC5w886fLE7ZIHhAiOYPhrg2kKrMpHyFDtiFTjgmKUMzQiVkVMs8rFSMzQuOKYT24+D= e7v r47a+7vL3R+HfX7X0tBtO3SGjd249epZvXboUve0fZolPOnh47fVn4y09MsQvDv6R5277dlz2= x1X 4Rv21jvaE8obEpTy4+r6vP38c7eHu89vWt9p8Tt0V6Ubifm/1e+989MoeLa1xWVqP5+Wnujni= /Pk 9vf5aDqvSXectntOW2dl9Ok4Vlo3G/u7d+M8RtXTg19dOace2uj+nwPTq2XCv5rjHh23yvOdu= 1/O fj08ujda+Pb2ljK/pjwb2+jU62pzzJ8Q58NYQ9fQ8xsdxT3HQkOYOnWRAl8T16l6goepcuUD5= fL4 1MiEKGkRqmgOMepXI1taRal7lz3+qCZhEwQTM7ckMGIkgsUoQInI5qX4LnuQSygnJgoWqKpad= NQ5 mKq7wNZ6TmQNIqX2bIZIcL7cyXGKUIGelq3yLpgeTkSJk/UhS6RMhsjcsEzRtiR3dzJ0o3Xua= ql5 EsRMEyuBrnTpmcmpW1gqcmLWVYSHfQyMgq+kA0O2MrtvY5IwbSWxOMixc2N00zKhcI0CZE0pE= 4cW xLShUkRJBbQ0IEYjjfhjPO8s5KMrnkjN3IlCw0qHz52KweDjkM/Wzp6c5srMmUKETUcsSIMOe= 74H kqfUoeih8lCIoCrGI4Rwg9M7aoXwGKiOKojyBhEZBDuisGBCoAskiMFiqxQERkVGCwjEVGKxV= IsV iyKLCQWKsIoojBSwhEKkG8AgZZkMzG4efKUMM2k4i6FPk6xaM2ISBlDKWSNxLuwsZsdiZA6zB= 0g4 HpowC7SZ4mkckKVEbCXXJ2nqDSOYmt0tlxYAEItfDgQB1oRNZSmpDA1ibAMzjPiBguKJrIiyd= QSq qDq6yEiSVFSyIrBuICySNIgpMuQUBKQAkcIofPDkjt8IVhjQJFRldLJTLSHDIqCgnViyUlVV8= +u2 ruq8+MToRIJ7oeB4EinqWcfwJ1FPE86ceeRnlYul/oFA/tFXr5KOAgS0IIFBTcwGmxrQ03Uj2= A6w hEANsSjmgePaoUF4QDe12pyWHTt11M+xM2GK+B1OgpcoROjFahgTQtYdlJlzoZE8yq+miCWT5= 8J5 B7hQVFBQ2vY41ODI9vZkOnSQxNaDHDkeBi+xgxjlELHTppsgu7QYmRy7EucgPoB4zT2qq7w0H= bkB CAYInd0q2nXALnMVYIpFDAC9Iph1JPJ2/R8dHy6WxH2LRZbZFFyp+1ihFh1FhD9Bj7poCYLMD= y1+ 4hWo4HC44mZKqcyOJpRR7Kg+bLBhgtpGPzURW2PvCkKHEnGg7H3fYPu+1CTLyW6eJIj1mmhkI= HwI FzBIcqeZlg+ARNu2Ry6rppBRzhI8SgidSfQrAJogqBVi/qdA6nJ8Ph0nPnXLyoZmjlPiO3gen= YfU hRzh4gOoR+AgqBEFUOQH9pJR3buLtlWKOHITG9c9d87TQcvOaCE0ZmnOZ9uWZmQ6t/4yRiySL= IgE N5iWPCxkshbgUYPgwy1AbJsigkIV0CSQPgaRN8hSguUMwREgvyj9kZeXp1+72y6fXUy+f14l1= h8p PXz731+znm7LHn7e0e7afM0f7/tv9uf06enr2T17fD3wBET0EERjv4+KKGqCfeIc3PQUwTFID= seB cfUczygfT7vDQUknvoZGMhOQ5FPeOZZluhIyQuOuppvU325i2NRxGk0GvYCZbwa9K2SynkztU= B3K B/QfIAyWAJYlkEo2CWJSJYlIliUIliUiWCFASwQsiWJSJQjIUIlIwpASyJLASgMlIJRpBLEpE= sSk SxKRLEpEsSkSxLBLEpEo2CUjCwEsSkSxKRLEpEsSkSxKRLEsEsSwSxKRKDKRLEpEoMpEoMpEs= SkS xLBLEpEoMsiWJSJYlIliUiWJSJYlgliUiWJSJYlIliUiWJSJYlIliUiWJSJYlIliUiWJSJRsE= oAi tIEKQSAJSsKFiNf+gIGDkq4rEDJGxAV7kf6fJB4jDWp8VsJ0qYMk6cAOwDzR9mg9nr6dt+bo8= sPR 35ez1em3j5dev1ezX6Tc7EqwsvPr0te31+Ofbw+v59tfOuW32K3n9ku9wREU+ytpq30P5aDJ/= HpX ajctPzFVhLhxV0GqEOMrpTY2XYERPXydOX8otRvaDTq0DSEHsVxazwfGdJM1GhQrvNtw8rKBa= xc/ rBJSASX0Hi6Dn7AHQfrBAeR5v98ouFw9oHoTb/SIHcCL7HW/n+/UH7ifpExE9X1OPshYLkRTB= Po/ Rj+W0DIE+Kw+B6ylCLCwCf4wWRUHYAWB1KdkxWAGw8pgaSaEBYBkFGTouok0MDRKkxCsEYfsB= Lll SChUCflOx8j59soDWG544PJKGiEoGUT+bZt+YV6NsvcLV9rBQVKdgVFKMGx5TSHXf848Qo8pi= GY8 2HoJSUQMHjq8bSFyO1sarIQFeAtjJblxLERUYMUiOJi2uCKaDQMjIoYuB6ahCoxxVQShA/MxC= cld 80aApPsj9hASoHMc7+1zqHtN3ZA5B4gTgXR8vrcecSIaILo6D3EJpPU8h6UUwMRL43o9F79lt= 7oH IBMnLRhZC92EC2BYJQWW4yCLkngGBF5FuqFsRXqBwoGt8dFRGkSSRYBCA5ctAr8Ub6jMpbkTF= 1hK EkCBEjYfa6UAuGq7FAAx9Q77P97HAgDAANEBU2c1unt9t07QyeHKRhR4FHBstFVWsgG0ICsYI= KgQ 3grG1CtHHbwwxSRJJmVXZQBYyfODgc52JiVH9XrDEMvYbTG1Ka6LAZwNfMUGuRmxppb4WaHRr= NJe jg55mx8hnwmB4oZ2LNm3lOUne1ZNDRUsuHOptNJFUiKmh3KgbsdSMLwDOENG3ALoXIiQdOAK7= wxb I70rjMQpoc1d6AHSsQoHxVSGGvfs1FIUZArymODAjcwsvGuRBoiQYRIEIxYuogUQSJySMKFLj= sUi YI2LTAmH9fOJZMgkQCJBYrGMCSCkVNZMc9QFm6wiEsnPjaMopdAHeQQ1MOn3HvIUcTfTY6rkY= xqr goDkB/kQgMIAQRNxDS3KOgN7CEIdCMTQfygSd3u1uCxuOW2l6DSwYjIQQVerMvEPQqXSwbs0k= CAJ 9kYC+wTpR74Cv6o+YcDT49pa0bIMSDCAwCACgwssoiwBkgjIkkGMQRS0AoKkCH5iKR7J/zI6b= Dng sigQbhcLFS0AsxktEyPt7v1/U8+K+q35Wyz0GO0D3sISMLMW0tVrB+HM0YMd8UMj9PYdgo2R/= Mfz ZJxp+cyR/DwP5afwGJFewdhzwJpA+/GRsRO/1nSNKTMkl6oGSHhbe9O2rvGHsceRz73fOTv0q= wKu mUCJkSB/SJvTcib8EeDgYUWeuxgqbbZGxWwjR8IFxifbmtFDYw5I5DNMkcWHZFi5GNHMRLHhQ= qTC hwjpsYkXPdZrUrQpWURtjMSCB3tdmQ8MkFg5A4RqXHPCemczOuTe8+Avwj++hfOeLrHhGMKnw= 4Rh H0iRIGyxMepkkaPSOQwWCa+EMnCheIYKkisjJoybOlnNETwoMfPlY/sSVjJYx0yaLL06UIHDw= jUa caG6myJ0uMDmiblr7sYHM8rQ/nQt/NnA5usGNSbmHOyCfagmTnap0tEqQLFxHwLuRJmz8EJBQ= Zzo XGtDpEiQKCkugxcoXFIFjEDMjQ0V46sVuSIkSpAciRIGr0M4JJ8FAkR9KF8IEkg/yslqjeFCZ= cY4 rGlaYxS05EjRAWiRdigYHLfsSrA6UNHWRqxMkWn5kqjk1yFJTJFIFTM0JaB8ymDiP7sFC5mc3= 2ge PjZmnU3NShM30CxkxRSRTWNhxc2HHLFyijIMTnX/lH3J2prLGsOgYOHkUQLgYoqAKOCAIndC5= 2Km jBoa8RN+DqQODg8SkIaYZ4hrNeOoeU94nlyidzzFydyPqD0cfrFO2qmhm7m5vqRJbB5G4qE4h= +sC Nux3kw5A7WOxUKUiSDxNpG5WZ4laWJFxyRQefi5E2MhyhEoUHKljcufcgk2HMiJqnx+qxuV3H= Klj Tcsb09vapteJQ3QqYJFxaClyhQokDYqHBrWS5o8NG0emsDmGVeFiBGxVH9qvOD/c5kNO5kpbF= CRX RI9LPEY1XYKJckYCJQkelYlosKp6bEiZ4gH8+gb7mZgpGekn1GKGxtE1JFittMXpwsGTJYZF7= sXm epAgLZ0excufrP7FDHSgYLvbIfDaBJIPbGiA5uOeWfXXyGhkwH9bpADgwfcm/pb79N0PuJEKe= HDJ EmdVSgqGyxYqekZvAcykgSP6UwkCsVIGfV1YKCBfabzbG8FA4g8NBLX8tarw9fMA4KaDRQeT/= YqI 9pR81RGlRGk436sbFoF5xgnxovBX6RBDX+7tMtvgjn71AA0071fHUPOe71tHEWq0qrW42mwXC= 4Ek nmjpF9XJo9ZHJWH6MCc1VFaiIhuDgDxWL3y9lXf5sCjnpACBXiCtijvMgwpDVEcC6JA4HIQpJ= UyE OFyAVKOOGjsGnHKZAYZ1VehHH+GukcRePgh1qu5E7S5GJoKP7z2I0PqdO43kKNzCe9VNfH6Ud= h3G BxAgc4K3ers1C1XtR0oeqgfl1vxIPPF0yMe8iGcLkF6UgCUIuJUgoc0DGGzMpbwMQRcBXiGxB= JBi nYwQLZnHXmKdIfj1xHUjxYIvHN4EO+4D+HsR6twHCGcF4EDNSBwIn0IBZGBBiGIU0jrR+QO07= E53 zjM3lZFNGgyAjAhIWpIihYFLAKMSMBQRJD4JCCwWiAQFYEUiLCKopFaICLQFsERIwPawSCiiF= kuT kGBUJMLI6Q096shJGP8KoLi3W1hpAr1PsKwNy7D3ie3P0kolGnPVKmY+HQ/8wQOAgqB8i9yEH= voA PocgBpNIcgGhVx9n0R8cYQ+7r6cL/j90xIgfRsV4C6wKYWst/hs0WP6AeSOxUXepYDOJkYHoN= bve wPpS7g6yG9Dd3ozxNXs0o+/DaHXFPJ2dTCYQgRaDCDQQN5RsMRI/QzY0YESxdHMUbNn5h9wQK= JUp uHfDQ9LF+IvwR+oHL4z7Mn7Ppwn1DGMRQIzSTBJBQFNggRGlAwwCxREdmkNSmpB0aBNgRIbib= slN eulupkgscN5PRFIUAbgrRRVVBoSgdKIe5HSj8/AHvE7P3W6l6YOkH07FriN5Y3NDYGAQLFqQs= lIU FolhQQJYOguofgcC3BjQBP7TEiESArFQDNiitvL62FQsa4GkNBrLJ6rBSXRfrFd6FnedWzBTU= xkD /WAwiyAkgyQiASFCpzfGgFzeHACx7YEIxFgwNevQezDCjkolyn8As8RNRvIQZ/gUEItKsAkFv= UGL iB7aQ9Hj9cTmMxNoWLUFnJucKiEjGSSQTJH3ETYj5I/bj05L+Osr8nNQ2YbMYPhkYjIj5A/BG= z4q RkSKxIsOCj+yRMUcfNH8P19fP2cAecXduBc+pGB5qoK8anAYEhLD/3tkEVv6gV7Va4ZB+fx5w= V++ fgJ7Pij+QDrRuD9yOzRw/JH7+JB39yf7P+amhF+vEhqz9OGkNAx6xAxZWSr96GtzLjZYwJDjU= wsd Imd8wVzRuGPT/eZB7s/JH4sE4+L3XqDoAjVT8lFYfg7QmH2hJGm0REiCqx1sfzr4W+325T7jo= DiN p98DP3UdbC5FH3gpy8hwBW6gPHoOOiiMZIScvtP4z7QNiIcetsHcb7reBY7KOsaBXv2O2IRkf= ghV WMRUUYotpY1KsEpVopfly5RViWlTG2yoNqlFVFIRkKkqkPQMP3/455xGIqjAiIgalNlPZlO0n= u2o ce/xfcJc8QoA04or/gQBeV7UfA80Q+vZtR2/7nKiP1CIEAgzccQfCOxURwiijpgKjUU4jyfS3= iJr MNJybF5EJ6U6AgPREpf2H94waD3FzAimE/0YXIfnpsE/yhqImzBOJfzfyFjRPT8k3AfpBpRXP= x2Q maSQki+JxCNIfNENIV2wSAIz1nNQSKJIvskh+kUKqmxEl0hhU4Nm6UNlK2QpRNr5myD5+zEM2= Rjn Q/ysUMgkNB6PQAInoGrp2vcx+X8TQYESL4gZfQjCKRgIdJpUiMIxiBDkKBDHm/gj2+jm6LW8q= YUW tRh6sL4VybCMOUuL+pV+kfIxYwMyVEoo5QmW/EWVxKTUVUxYLUSYlJ8o3DLXpbVV0spCMWJMi= mqI oRYUwIhjQ5jBHA/VHrEDgHMQTnE7U5lPp0ND4MXMSDlknTamKZgMh8E/SwUw73LSs+1P3jJn/= 1Qq btWSbVk9gkxn/WQOgJQEPgUIVIiSDCEVHYwVOd2AfFMLu10qtI2LGVvARebnBt/EFbgrwBX5F= zF8 VP1BoFXogQDvBWlCArIqI0JSIUCsBChgUQEkQD3ieJvUng/jDAH1KYd+fcj6X8Cf+dKXR/maw= PJN /dwhBkIRCISEBIQYRkAgQhj0m10GoNCKAzpCAJET7KBFSlTYQCRSjSrEeVsak7PUY4cZ3ywfK= VDC g4wbNS0WBA8MQLZ3SiMIXCHLghvOZ5EA4GY5ho0URHMBahYMosQlp6oHBJ9EjuB27QoxQgJ0A= bBP 9WKms1SmG5BJYloEzaBXaDkNk4MdEPdtO1HtyEvvExLc5kdSPWjyHpclHjJaJ7kLIpxo0NG5N= 4HK L9IICyKbYCI/wgIIUJEBgkGBDSAfZ9wSehTuf2nzZcuq5mXPIDZd73ctb+SPUj4I9WpHb/ej9= wgO kNX7D2o71D+3m40b34w9Nq96mztV1fxhuR6KFdunSHN+GHR+l6twwtB1fsqwvEkrV3BAjSVJt= CDI Jz8UPrREiewFolq9KOxMcN4B8G6Pu/sOpNHsR/j1dhsGfWnlA9KOkA28qH81YnqhwV5tCPURD= p9K HkjPUJxo5dJARfEjBID7LJVSexMAbhcy8BccEd5jpLo9aO4R0CLtdYUnpI4kjA1kGz2PP+/q5= Pc/ xYGw1qHDRv4ju4FW47WkgZKG62E3hcg+jSa93zPdRZGfs/vY0EqU8hKLEKJUoPtDIxGub0I7O= 3cj 5UjkIIl9/NDqT8fIDkfaK0nSj4gfDq8sfLk8lH3HmbuL1JVVxuwDSj6/Lm94GKjvVPSj5NlHs= R2c /r3nmG5HzyOPP5ngXvekQKfj2bJcva00igX0ABIEdxgxJBsL3wRlAcl7SAdxguudG+TNTInUm= Fdl lltDDPrJkIhrg8JN86ZhbmZcMJQwMAzMtuCJJxPlmwO0O6EiyfUfZEVVVYxV6PIAknunHwg7X= Mki RiKBaAqNMUIkHm5BdwK9ahXNpBXYr0qpdGwK8Pdkj8EbgSTrt6z3++u3+eGzAYiICELJqIUnv= KRi UjIaGUYT1s+ClaJwZTY5ZrVoELDiIKgekTvPJ6kPeQ6gvdg/H21vPuTTjc5h1gU7bAo6i4xJC= ST1 CEIPGhlvDxRh2wQXRokUgwgLsCE1ciPIj4BdhsgFKiMEkAhEOAUZtktBhG5AG6oj6NEwlrhmQ= pUR iwpWTDpCjYS6IZffoIDtbdxT9E8kj6An7ZB5T3E79+60qCD5o2o/xao7KusN4VSooYhmWUYii= Ikn 9QUEE/ch80VLsrppt7ilOUXhIUWYnwR3c5G3vp6yathtmJ/K1dXxPbpueon5Hu2ieBuK/vWDb= j2H KaCRR5S41x82DiERxCAh6DnB+oNgzH7w/AIFNhzAiVUlNBKidub1AcXR9EfwRwb+sIAnDlDKE= MH+ 4Cww/VA9AkmWQjI4ECq+tgLCQYIK4sVZFWlgBkoe3MFei7TZGhfijvDAd4hxEHHlAFbWaUSoA= +s/ SFaOTHu2Ai6vLSeyJ+8LhUYZIxfYWKHjRE7zel4XhUFFdqwNTtDkuAX/FHJ7A7QgYGqOZ22tp= poY wKpq3UVYvUV6XU2yICusuoZlxG/NS/1T3I92kTr4sT4foIDtV+v5Cmz4fPV376OX2lZGGNrO5= aPg D/rIyBAAOM6OdPxStYZQqXs2ohKJKQ1DYGTSuikpoghPD3IKKLBg3IhklFA0GS2T24ZlgplNW= bp7 i4fKdfzAftAc/yB6PqbQPyUeoDo3nFx0Q5iB0ma2GwFx3oQPmQCMiPtfNgxD1eco/5JirWt/z= gQI oMgKyA+1uBfNkCTuAulxbrQXSFf21/v87/KHyPHmCEYyRVGCOJBgyFLZ2Pfj6SH0z7tj56yGc= 1si UmfRJMNTQw3DqXEn7Gkp3DHRGoRkO/t4gyMSGwRSlKCR5AsCtKGvZ3Kfw52wRkxJ7nAgCTI8O= R+5 0P9eQotJsCkNvYBvDtOZ3IWf29SmI9BwY0EzqTEmCQrJWQRFEMYEyKysk+8wh8IFhVHAYiR10= ZHV niYBxQ5IpUBA9sSe40UpoyGDFK1zKKoILMpmEsC4h10edL7JlnpSjCGMKnb0A6lCmspo/UFex= 5W5 OIFcDiXIw/hjhY5u1HMFckfZrQwLgMcRoyrOcJwK+1rkhCM5aKkigKCsZFUG7zE/M3VpOGCWk= yMa bSSSaFE4yyeQeoIGSBzMXYH+gQU5wV9KPcJ3fNH481k7UehTn36rKgcX089/LDLmtLD9LUXOi= Hio ch4HiXE1iqE5BdroMsAD92oKUuTgviCvIUkHPWoIGswbDwWKISBkwS5A1o6TZ+vtR9yOOYEik= gGc WfZVKB9Teg1Ih9wH3alNbOvAKDh2/bjBzwNHdrNZjK0zGrsVBuyQfVCh22GzKFLT47m3g2GxR= YcM K7MuW4wzE1NyhSiBul3DJZHKXWqJZo0TTqSwTRgOEAQ17LJjtgSa3o1MkuAuFJDUQpSQ1TJME= QoJ ZchhmjC6J/7H6zgkkUiMiMAmQZ1QRF5ycKYqqc5Myjdhag5UYzWYasrNBPckANoKApoMuSQ4C= X3C Ek29mIi3R/DY+Nkezh+SsR7lDxDcm6DticUGElKiNfLj47iYJFHbTQXCCgWxGnAuNFuvGkhZx= SwN I4KRApoLO9HidLjCFGCNhgr83t7DSQOeBaWVEYBqKH4enNshhOsJCoUsjUTbsQmZiSMgRbMN8= CAr ccTExPv1ZKDxYfOFQ9dv6Sy9SEO5J4V6LaoGMsA/ilZJDBgFSCNdW5EwAhCz7iUlhhGQwSmWS= zQB hImBZAwpRrLMGYH0QiI2LCL3I0WHoLo8QRGIPnApEjAuUur5KdS4EBzigXXlhxxxfUjmCt8MK= s5i huD7KeX4P4hn2VpsmnrzQwrDpsYEx/GYMYn4IaNtW2ULED9pIef3pJiE9aRSIgLAWQikGDBUR= iCw iisICkgDrIBRJBTlVIMFWIxUA7DaeLVEymBnE7BRyCiwvUlI+cEDq94K5HUdampKMQhB9UYEd= zBD cYPHwKaIVUlBIl1NwJP3psSXP+9iXHQbuUAxQ2XCnJSkxa/lpSyYE5pCjmYEEsJSZxEhBU6yA= +uK NiByBEveEo+ev2rmPvQVQ6AcXaK7gregXE6wDcTXc+VOe9PRAmIMYGmCgfhAImJwOIc43Lre4= 5Wb iJ+eOL+R+ZDFQz+UwbmBCxljNz+HwJ3XkKwInghUQEYQU8kljGOiJWKEVGFEArJBZINBCVYKR= EkE QgIACGhJEYRVkWApFbOEFUiRNkNywFYDZgqLEwaR9yOoFLEEiQioaDRQIbhCZgYQiEJBKUrIA= kWx JVJFFiqCZJEO9D+1KQb7GlPvErxh66qTkY85oTU6AdE1kBFI0BQT6CGrA6Qe9HcZPQjQY/A00= 3lr UeBBjCTBAIgDAK+/osk2MWAIau/+UhRtICWY+j0EKUmRTf7Gels3n88DWDhcZEkXapRo6ANIf= qB7 N/ko8aPlIgqhxn3o7h0dCOCOB08qO8HEOUOIeN5UTkigbdgjyA/REroBc+x3PkvbZu/vEMgAG= g2U ttrRgULIIwkYQZP8wgAfaJzDBWD+n71+K0QGEYJABiEEDMVwQOs+3JnjMR8T70dT2kggkiqEA= +fz oLMUYvarwE5W59ZINoSKQ/T6GlHrNpzqLBRfDsR6UEMUeHA8h/cC9Sh0d6d7oPEV1KMAWuB9o= SPV 1VzEef8vt6SF37oYRe3kPFBfBf5p0MiClleRZQNULR5BDuPajQgl2CCQWBgHt1SRhEYwCBwOG= F0F uwUhDqMMLnqNsJBRhEVmIintIoZxAUNIRATSQA5mKl2nMMgGQP72ywFfQ+Ip6Y6nI1BTuNRqg= iwc 4peI8isXAibFPMPd+gczsUdIgYiwDX4bShvAhE9pBS3G0Cpw3iUHODh2vp5BOTVKMmkJajalZ= Fgk H8iCFoIGBFFKgOAURhFnyAOUFw1uG2CFgostlcgyQETFQ3DOa6xJckSmmUrY+qrz+7cp3g/9d= Coh lbUAHQ9/SUhKWJS9NWcg3bmbqFgKxACArtSArQKFH7ZI8BZpgIlMCsCGxpGgpCHVwAF2kUtpP= 84K ejToeZ8vM4HWwYe7HjAzUtSH5I6lPio8S4m93k6Gh4NGzAgBCFlHE2aXq24heGieuxxkOIIwI= e0l ekoLQtPqjozNtAUhBG6GZPKOgdNKBO2u8wAmmRYBP1sJU5jJxjTboMsIwM+p1Qkd8CiACd8Vo= jbk LiQgAkyQyImlSNmFKCMhJMgwZQkoUAxmBJ6tT9QYBocEKqFKUSIxDeFBgVfkPPv/IokJOZ7PE= 3nY Wx458sM8DUeE92jxtNh+jqw8WYzjZiNtXvYxOYMu+cme3qYemgufX7PA0B57PkrLJh5As3bI1= oqo IQpQpas1gFRGQZTzOSgr4A8nejrR+yOT5+o8Q6eJHp3cxbfvn7kLsD/fxIBqdGw8/BaTYegyT= gwy G5DASJkabDSFwuPKdZ4nsRt54oY26keMK4KJwFoO12fyBWyojvpVBNxY3BE9m+gsQ9aPsR4AL= tFN SggdKJ1o2AK8J+XlVtrg8wIcjoMbozmeCs3cgShFMFc1TejQI+SQQOiHEFzRw9+oGfb8UcjPw= Pk7 vMDgb0eCd46GqTdJ5jjkNqAupkhvOZ80dpjx7E1udlczuO4oxnvowF2tJtjZjywNIgkPh8aOB= NPE Adc7JhPIDFDY8dOwJEIe94HvotYaNFjXFOwnJRx0W3QPQAamn2nzIWe0ejbBWFkFHkh99+8JI= 6UU IYDVOfo/PmM4yIyDIvejEKB5ehHwzDv5WhMokyDlNgOw2nW1GB/x/xQfx/SUfO+H/Fzy/d5ab= XWK smWqjNNZUowqYJCaEME0ilsqMKljEH6EiZYbdCRw/6LjMpV4oVFEQrKiqm//4w5SeNptm7GnO= VGt ERFgpMcVOkPH/Dgxh50owWIw4ZVVYnLJOkDLZJAWPz9Z+AP8EfgffgDze0gQOs/vIZo5CeP3w= +89 L8yfI+1kd6Ns1w/MT8OP3gb0FUPYcEdf3evZ+2zcKwxvX7oZ6EfzxyH+nUAc37vnsOhOcDBHe= JRz nERgQ+SMTn5QeVHtTEQNH67fv5l0QfzhOfPxZ8RMEflfUZRgUStgpESIyT9mTHjINS5AwRUkg= xNF lAZKJCoKLBiAIqIMSMGQSKCIgxgSsqAgQP8SFYyDBIDyFOMFrxctDgRFiM0UYnyJNYZkwIemN= 3Bp I0xoQCsnxRrFQ6EdmP9rgAc5ZFeRHRcFy14I4I9fBVOGWG92BZqWToYN228poQllwLtNxoGoR= g3Y 2W7TGC2I3Qa4EwVs3AKCClligd9N26AiVwMBeVRYvOCtk6DA/YvRJdc3cPEoZhxw5FQXgjFDM= LKH 7Y223YBCEjESJ9hINWRVGuArZXU5Rk9LYIsyH+xmD9A6gwMJYzGZKZTJaJ0ONkMBgxwyDh2q+= 1tw fp8K+E/CYtU0GUo4y2yg1JYfKHsPQ7KqobYFFYsViKiQSgfknx/404+ePvPXwTwD8igWY23dH= MDe C9wPzg9Ow2S37jU5z/Q8QKC3UlUH7MCpDdR+8uSfXAwYgbPTkvohdTCj6DuRKLoR5goOTYCsE= ioj ECACJzBgFxhwjwGWA6eex3SEHMPA3PK39TW2xoNHfZ/Y1oBV4whzEVzOSfvBXMFboiBqR1KgB= tdq r7NbYG4xFLlehvAuwlkMitItx3wUcCIvGoRbgpzaXTGCajBAKaxR0FkMwHATRcsAPQAybAkBI= YJJ DQCIKIIMGbZSpIpZKdPgJfUPeQbiJlEKQXSK0gXA23Ft/cwSiQYAB6CCwiFQOtSkCgfA2G4t1= n+k dPPNBXKFmL2dP9mBC7/KBmONwwJcptGi7yp2wkI6KWvKGFh2czPx6wDpPlyKFdnYC0pYjaSED= 75I SBQBlLaxFE02ZA7T9+axsBA3EkA2cfGFCfxOJQkmyqNLKytAYhSBFAlBRGhIDiWBX12pvKCCu= agn 38HiebnOefZyHDC+HLRa/W/in21n23dBvDoR5cT8TnITniCA+yXxwCgkAGMBiSEUZjJQKxiSq= AQK UI/QOApjnkdempn9vb+vzMyMl7K1Gpch/xGL/neuVbTJ7z+P0gS1DmKPCxGSk6PvPo7oVz4aL= l1Y 6KfsDKJXdnIRO+FfuhpwikKZd26tQpHOoyaIUvHXFiNavv+A6I8C09gLKBvZ/kJsakYYiBirw= Vns EUMVgiSZXKoPFIBhqaYGHYvZk+1Jr+l4uBznNmFj3GJhE2MP0upRIFrRKlpkCjIhJTIklNOrY= bhy WnbFcexsUIqwfXhqQ9fAaTsaYmoUENWJERexudoKKzwcqt1TF4vFMJtNmhz0bOcKwKixePSEb= DLm rA9yrkPgoxgwMzK4QCT6YD5IwFpW04RQkIbIIPZcwRIN35l0HiL4hoWZw+IJbvatsrxo8CRwq= zxx wwxSltfQhwPy6Ej47btxJfiFSNcpVPx2wGGSOCLGAkBbzdVjus6lMVR+VU4UTKSd05nSaAsjS= bg1 hKJyUS+AgjKmhh8zOU46C/N6nRiI4YMclzmKZUVNOoERhYvCc08TuEybu6TMaSbmVZ1o1woMS= CjJ 8gvYNo8CkbkmPZN8yb16gyA63rUVbq7akpsoYRCaDcb2KqjjdjvaeJI5iCoHHzyaUcOGIZgdd= keC qfn5g+Yps6EMkefm4PJNmVcNnLa95YwvX1hUvrf1nNV2oBtIM/TX3+XifiOJ5RPuRQMEel0uI= akY hZ1DZw7DUYYOYZQlJcoIdNIGrVizdqls4VMQlFSqvY1UP4eT2zcgJAogffGiqoqqIWB2I+wCw= b+1 HUHcjs0cB/AH6Jbu0/Y/IhRsE+HwmUC5wlifSYgQIwsHSD813AruRoeA37vPGNTv/8kuWkbjZ= qLI DIgsM/EsdkLjb71IdHUwncGEN51Owoxx05VxWJ+m4yijKB7hAUPLGVVawfV9sFYIJswgiQQT7= KeJ gF93smYMQ52hPRuHEcDe7hOe3iGkPUISxFqTSU0ERIlOu35lmhps2GwJTfC1XCzp1ID7e/yiC= DAn nDGCyIwihFICiIRZFiMIosWKLBYIxYxiIpIKRQWIwFkRgpAVVFARWKIxYqwWRRQUWSLBESDkI= o/v gnyR0J8tgUeUB70dKO5NewkNrxIhkexRZzl0GmIxhJJB7Oig5s4GhRAdJadCOvoRQ4GayMPr0= Snh efja1ilGAjNIpty2RD3Uom3TDH7WfnQP1s3zfTm6BWLrnMUExovYUSFv4d7hyIACJNjAAt/oy= mm5 fBIa1MyFjIVRJYqs7DXpnSAcIL+urvA7P6GcMkwt8NneYbySS83vlWL+DvKiICLHd8bcYgggB= J+E rQ7oYwY5BvflN3Rx39mLocil/xiBaJGRhCAMIEkiRYH8Uqf5GV7sJRFJBZIVgLP2wfuQ9P3dh= 4Oe WsT0iD2xJEJEkCQJAkBSLBQWKSLIoCigoKCgoLFBYsigoKCgoLFigoKCgoKCxQWCgoKCgsUFB= QUF BQUFBQUFBRYSRJFCg+qPMdnuMvnodIHmh6XYQ7PyXPkh+XsB8y/dg658q77M9ogEgi1QwhGPf= SFD 44FWJAmCKbbF2Njy5ALHxMheVURsc8LAGgd3JSJmjVAAwCIDYKrZjrPLbQWvPZA3K5oLw0dGr= tmB gY81OIzIkLhTgM1xvbzQphmFmBfC/0TcKPIdfr3V6hNh0dGw4TMrSCuxS1ryVTTJCqehhYjic= UBd uT1BuYp+ChmnE4Img1jYyHIb/MARIuhDNfAqmwR0Xvrwo0hRiES33WoIO1jWVOGBQxIQC1I0N= 9+d 158igiGWOhtQwi+yBRESDAjFSQ5TlRwhC7/qHEFdWvMJauqk3jNxzUq+SsdSUqPAhyVcg9/6I= 2Oh N6niIeSPDVSOGdt7n4/CUnSJ/0MHpv8/JWq4tU27I9ctVtTUD5lGG7DlsXmOQeQEWYT6etKfl= 95d 1GFyqkEmxK6tYUmKhNhncLuu2Uw8LDg0V1BFcizuW9t9sB9R2y6ElncBM1WGZSGCTGbxxFBGY= O2d oKOR0SJqIOqQJhE/vDOxYIupj7pQFdMAhxRehXDhnkLENkMwYtAIgEfLpH+CtEYBTJnPdsMCi= Snf ngyG3ys3l8C1IKYdusJpO6BrC6hopMyDaA8GUl1MEwkKwI7oGyCTx3Jrep4zo7sABDZxCzgsU= pS+ M7HUdULe84NGCKPLbLNGSxIsZFeTkzDHyZyyaQXskzVJDhlYTvSOYgRYGGIGb3UhdJwTJWGKj= Pkf PNDQt4cwEydGEwDXew4NGutFO9JvJeGSsWdQpzMYOCBs31Jm+LxwYTxDVkoqV5kCJIcKFEZNL= Wi4 xIwQnYiMxAgiNQBNppTY2ZgZVXkzIN2qRUS7NQ8TZkIDBt0Pb32MbqvCKjai6CszoFIFs7IwY= Fd1 BWXWZG3ADEnqvEB4MREPDYmk4TwBXBSgyWBCEAUOISpnnkMa4Gbt9ym2rYsCAVwhQrrV3qsMh= hoL dgdDCKmHGdibXKwAiKCRHumAixIAPEzU1NDvibh6h3AnKcTYdpgdhCSaQolQ2kPLVDSSod8sx= iwW bZN5QXaFfEs4nXY2eNpaUstFo2lpElBBBE5pknAJO7IcYVNBpNH3XR/l9QPvBt60ZrE9/BJh9= hPv B+7LT+XN+iNA6EeOkceLXyzbMatg3lFucviCtxBYBs9w8SPvZpw+SEswMk1EhxRTdLo3NF+Bg= gYF 0JDQyBomUO8TkZiBZYyQhHZgGzZgb4DclkGMnFiUMHA0pcwYjmlLkqI5NwpURtiQVMAQex6Cf= hFp HSY2E9x7qcCF6U8YhTFEz1IaTuywNiVytQGCQSGIiH+UAeNGCB9EeMQx05zUCaEeNHPaXOYiw= IoP GwiAa6qEprsRvkCtnRrGhIETSdp47A7TRoYBZqWGKjEZBgdnwiAxahhdIkTUGuBLFgIj2sRag= NA6 9ep0tiBimlmnmC5RnJZVgK3LuhZ6Hh2n3Iv6ilAxWcwh7pM0bEo1yQhgoGQuxY8SLujtghTAV= r4m kzPbA4/pcUUdwKyixpQNK8g9C8aHKryIZPYj0H1RhFmJS8RALEQ0FNwgNpIVcLCzBGpAYhjJU= RC4 UMBRiR2A9nZSbDlKG96UqqQAqLKoR90R1xHUh/zhNa613mAXiPPqKHRB+/8NlsAOY02eIeJhJ= sFX bghSr3d1t4K/Xj0kI8KCg/NCF9pIvSwfqX9YCSdRUjIOKbRKVLTlLNIIZKhlCQP6RMI+h6sM2= WTh uFQcccMdzIB3mgDl2ahKSd5TRoIalsG0SECxVuMHTtezY6x0Bm6Kla6BPh/E5GuSlT9XgGK9s= rXD j13QCgrBHfj1xP7sRMI2In50dcxgq1F6CAUdVBjCRQuSEFvegsXKEwjzKENgUq/2J/qG0hA8T= FTA PsQpN8h0OIQ/DqVBStgIpj4xHJgSblNprt7T3EKcWe5NB4DrCBoUIFCQLhgdgXqdTEwRVHIua= m4W IADvQCKVGzhSgmA3FcSQnhRXe0KlFnxsOHAiJqgbYmTNlNFbW3kbk0zhIIDDfsK0o6m7mRkdJ= QK/ chkduI7UcF8AOUKTa7E36lsGk0NgXEcgfsjkXdiTN+pBVGKCxSKMYG58oj7golaMVIPvR4y5/= L/c s76MEVU9oqIBAVX0t0DA+KqbQXmn70d55hknQb1HrB0fkJ+KtWR/b8E6uMEDeBqQdSmRF+Ado= YB9 k2rYUc0CPmGQ8ogqBfsUE8DxN8BuQXhraodlbo2vyozcJd2kiNKbEV8ExpEMWIIYRTWjETJMw= KDe BD+CPiC6bakdhpOUHmR5eoOcECw8uoQXYLTYEDgxVdBhzg5WY4HBlwgFEQf9DBBdj0HOWMDVw= YJ+ +eA7Rdyh4hCEPLW4aA/I/KmM/KgbMQ+4D+Zh+L11TasZANIDAbxJG8FbMcj3BbLUGdrh1IxG7= ByA HAMmrh0HB+45MNzqyLocz+lnPxoF0ouTyE9nQns2J2kiRgYUHWmDT9Yr3g+j1kYBI5oXDPCQ9= IUS JCgKVNo1tbVdw5hsdCpDBcwh4qEMjiPBOfYBQDoR0JvBgF0ehOU6DdQUR0I+aPPjp0+oDz1AH= nv1 YAOCOGnW/E2nIHobA65zYC3hGKef7I7EFUOdHr2gvuRwR4FkcPcfwaN0gkyDIKJ2FpMPYFgk0= Qwy CgzxD0BtDcmBgZ75Yo4j/m0sIMKBFO6506yqgKv6hAQD27f3fGv64AOlmjj+op4HVvwOMyjbM= C5S iA9/iJ1KP8MEeHoRzNCm+cHpCzYD9GMkSIlRhDAo6z95b5A+xHf8UdnrTQPVmIe3k1I5q5nIj= 5I8 4YGoh6yy9AoqxBkEgyEGCQiCQGQSAKQNa0ILUFuSTSRSfkDJJJYokC+EwlQKIfAH6gdyOYD70= fij d+eavjoTTLHwRD2g2R2m0g9jAWMChIgQCMSDCMjJID8gY+96eUOXquEdDtPUDWpHucxdP6gZo= 8XF n0I2o7Y3JaVzZ2veqlZAdCO+lPw8qQaK4WTyCP4QfiQOZB+9opD+geMhgmKBfwM/GmuROU2Ij= ICw qUEvLRsC8ChKP0/dLAhyGSnR3H5ma8fHRWwrlV6vBX0iPut1fNHt2G8O1BVDuPYj5q+G5uweK= Jv8 6PdqTm1ijziFvPjRsjbUj7kFUOk0GKAdoMF6UfPiN50HA9pgdEXawYw8kWEBT42zSAqal55q8= nXZ FNbxut76Cv2gp7y4e6dyyI6PG0wL4xQHQDHRq11WvDG9jCi9/4tjd2PuR/FHd2e43MJJJJ6EZ= zI7 S9oQkk3/AUujiIDsAv0HQK9p0I9nia0e4QH44G0h1Ryhl0V1valv4tGbFukY5p7g87t4TJSNA= wv3 lFwjSMNuzoSFYgOwhZQYz3kAmdp4wnvxT5ZG7gHErmB37RzdMA9onuEglHp6d+/yvdN0a06y6= YTw mazW/CE39Gb3x8kD62HYQiQCQEhtX26zY7WNHURoLBAp5oRkm2B0cwyqapoIxj7p/EgZGZDuR= 1bE NKFI+niDwE/NHHjR9Z5vpR9CPo7XiVDIdiOQpYTl++jmPmFIWvRkfH4+G/DOfKSNFSmoBIdkD= Tpp cR0aizH2X9VzrOwhQmqCH3S7F0Bt70bZGBCjcRosQ0oCL2oxFfyMC4YBAoLgpzCnoR2ilaUbc= 8fj 9xVpzmX4aIXH5MHxDI+Bnsl+iYz1y5MjQ1QYaoBhZvL4TQambwmjZhgSTc8rKwFm7NMOCmiQl= OKO Wc02s1eMzykmnU45nGVwq/pmpQRe748V8yznt43Nh0S4Ek3ceHMZdQNZNQwFYh1I+Svej3pcH= 6e9 D4/hbnFPWjsA6UeebeK9FOii1kKcGAgWKCg5DgUrwHkEoxAPc+y4p7/p8A97yi6Pv+aOzcj1G= kNS POYI73EQHlXRB6zJX5o8zyHCCHsR73iDUHzFOlQ50YruFEh7Iek2CcaO4dhBgz1b0Hl2diMVD= +sF QrQcqPMbCMgSSSSKeCODsvdjJJz9j4HMKbxPLZqN8WQbo9SP2ur3vp1F0dvWJ96OnV5o94eKe= KOD ZGI7DzA7eMHVvEOpHeID28m1HQIIuru30lhEUhFQT1wA6ANGzH0I3AOfA9LrBXf6Abj64cy9K= MG4 niJ3AdgG+yMBdKPQji6BTtR6UfNH7+b7vkQtbDGgh+0CwP8I6d3dc3NWhhgzJMZ//i7kinChI= PIp 5Jo=3D