From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Paul Eggert Newsgroups: gmane.emacs.bugs Subject: bug#9079: integer overflow etc. issues (e.g., image crashes Emacs) Date: Thu, 14 Jul 2011 00:55:39 -0700 Organization: UCLA Computer Science Department Message-ID: <4E1EA0FB.5070903@cs.ucla.edu> NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="------------070204040000030901000700" X-Trace: dough.gmane.org 1310630263 31708 80.91.229.12 (14 Jul 2011 07:57:43 GMT) X-Complaints-To: usenet@dough.gmane.org NNTP-Posting-Date: Thu, 14 Jul 2011 07:57:43 +0000 (UTC) To: 9079@debbugs.gnu.org Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Thu Jul 14 09:57:36 2011 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([140.186.70.17]) by lo.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1QhGnf-0004Kv-8s for geb-bug-gnu-emacs@m.gmane.org; Thu, 14 Jul 2011 09:57:36 +0200 Original-Received: from localhost ([::1]:36890 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QhGne-0006Tc-Jm for geb-bug-gnu-emacs@m.gmane.org; Thu, 14 Jul 2011 03:57:34 -0400 Original-Received: from eggs.gnu.org ([140.186.70.92]:53013) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QhGnG-0006TQ-Cm for bug-gnu-emacs@gnu.org; Thu, 14 Jul 2011 03:57:17 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QhGn9-00029g-Ol for bug-gnu-emacs@gnu.org; Thu, 14 Jul 2011 03:57:10 -0400 Original-Received: from debbugs.gnu.org ([140.186.70.43]:60371) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QhGn9-00029S-8g for bug-gnu-emacs@gnu.org; Thu, 14 Jul 2011 03:57:03 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.69) (envelope-from ) id 1QhGn8-00019X-KB; Thu, 14 Jul 2011 03:57:02 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Paul Eggert Original-Sender: debbugs-submit-bounces@debbugs.gnu.org Resent-To: owner@debbugs.gnu.org Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Thu, 14 Jul 2011 07:57:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 9079 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: patch X-Debbugs-Original-To: bug-gnu-emacs@gnu.org Original-Received: via spool by submit@debbugs.gnu.org id=B.13106301884386 (code B ref -1); Thu, 14 Jul 2011 07:57:02 +0000 Original-Received: (at submit) by debbugs.gnu.org; 14 Jul 2011 07:56:28 +0000 Original-Received: from localhost ([127.0.0.1] helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.69) (envelope-from ) id 1QhGmW-00018f-15 for submit@debbugs.gnu.org; Thu, 14 Jul 2011 03:56:28 -0400 Original-Received: from eggs.gnu.org ([140.186.70.92]) by debbugs.gnu.org with esmtp (Exim 4.69) (envelope-from ) id 1QhGmO-00018P-Ge for submit@debbugs.gnu.org; Thu, 14 Jul 2011 03:56:22 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QhGmC-0001ld-9b for submit@debbugs.gnu.org; Thu, 14 Jul 2011 03:56:11 -0400 Original-Received: from lists.gnu.org ([140.186.70.17]:36104) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QhGmB-0001lY-Tr for submit@debbugs.gnu.org; Thu, 14 Jul 2011 03:56:04 -0400 Original-Received: from eggs.gnu.org ([140.186.70.92]:49144) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QhGm4-0006Ln-TE for bug-gnu-emacs@gnu.org; Thu, 14 Jul 2011 03:56:03 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QhGlw-0001jV-9L for bug-gnu-emacs@gnu.org; Thu, 14 Jul 2011 03:55:56 -0400 Original-Received: from smtp.cs.ucla.edu ([131.179.128.62]:56460) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QhGlu-0001j8-U9 for bug-gnu-emacs@gnu.org; Thu, 14 Jul 2011 03:55:48 -0400 Original-Received: from localhost (localhost.localdomain [127.0.0.1]) by smtp.cs.ucla.edu (Postfix) with ESMTP id D2EB839E80F7 for ; Thu, 14 Jul 2011 00:55:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at smtp.cs.ucla.edu Original-Received: from smtp.cs.ucla.edu ([127.0.0.1]) by localhost (smtp.cs.ucla.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8k-Xe5dzjoIW for ; Thu, 14 Jul 2011 00:55:40 -0700 (PDT) Original-Received: from [192.168.1.10] (pool-71-189-109-235.lsanca.fios.verizon.net [71.189.109.235]) by smtp.cs.ucla.edu (Postfix) with ESMTPSA id F2B5539E80E0 for ; Thu, 14 Jul 2011 00:55:39 -0700 (PDT) User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.17) Gecko/20110516 Thunderbird/3.1.10 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 3) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 3) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.11 Precedence: list Resent-Date: Thu, 14 Jul 2011 03:57:02 -0400 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 3) X-Received-From: 140.186.70.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.bugs:48978 Archived-At: This is a multi-part message in MIME format. --------------070204040000030901000700 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Package: emacs Version: 24.0.50 Tags: patch I examined more of the Emacs C source code, looking for problems with integer overflow and signedness issues, and found several issues, all fixed in the patch below. This patch does not add any features to Emacs, and it focuses on fixing bugs, so I hope that it's suitable for the trunk now. Here's an example bug. Take the attached file 46341x46341.png.gz, uncompress it with 'gunzip', start up Emacs under X Windows, execute (setq max-image-size 50000), and then visit the file 46341x46341.png. If you're lucky Emacs will thrash around for quite some time and then dump core. If you're unlucky Emacs's internal data structures will be silently corrupted. To make things a bit easier on my hand examination (so that I didn't have so many false matches for 'size_t') this patch assumes the cleanups assuming C89 libraries that I circulated a week or two ago . This bug report to some extent follows up on Bug#8873, but takes a somewhat different tack, as it mostly focuses on unsigned integers. # Bazaar merge directive format 2 (Bazaar 0.90) # revision_id: eggert@cs.ucla.edu-20110714075051-k20k0pp3qx212hdt # target_branch: ../memcmp # testament_sha1: 9592d4b269a0873b3fbe5e662fc3f163f4678863 # timestamp: 2011-07-14 00:51:13 -0700 # base_revision_id: eggert@cs.ucla.edu-20110714073104-xn1qhv5x3zls9tpj # # Begin patch === modified file 'src/ChangeLog' --- src/ChangeLog 2011-07-14 07:31:04 +0000 +++ src/ChangeLog 2011-07-14 07:50:51 +0000 @@ -1,5 +1,176 @@ 2011-07-14 Paul Eggert + Integer signedness and overflow and related fixes. + + * image.c: Improve checking for integer overflow. + (check_image_size): Assume that f is nonnull, since + it is always nonnull in practice. This is one less thing to + worry about when checking for integer overflow later. + (x_check_image_size): New function, which checks for integer + overflow issues inside X. + (x_create_x_image_and_pixmap, xbm_read_bitmap_data): Use it. + This removes the need for a memory_full check. + (xbm_image_p): Rewrite to avoid integer multiplication overflow. + (Create_Pixmap_From_Bitmap_Data, xbm_load): Use x_check_image_size. + (xbm_read_bitmap_data): Change locals back to 'int', since + their values must fit in 'int'. + (xpm_load_image, png_load, tiff_load): + Invoke x_create_x_image_and_pixmap earlier, + to avoid much needless work if the image is too large. + (tiff_load): Treat overly large images as if + x_create_x_image_and_pixmap failed, not as malloc failures. + (gs_load): Use x_check_image_size. + + * gtkutil.c: Omit integer casts. + (xg_get_pixbuf_from_pixmap): Remove unnecessary cast. + (xg_set_toolkit_scroll_bar_thumb): Rewrite to avoid need for cast. + + * image.c (png_load): Don't assume height * row_bytes fits in 'int'. + + * bidi.c (bidi_dump_cached_states): Use pD to print ptrdiff_t. + + * xfaces.c (Fbitmap_spec_p): Fix integer overflow bug. + Without this fix, (bitmap-spec-p '(34359738368 1 "x")) + would wrongly return t on a 64-bit host. + + * dispnew.c (init_display): Use *_RANGE_OVERFLOW macros. + The plain *_OVERFLOW macros run afoul of GCC bug 49705 + + and therefore cause GCC to emit a bogus diagnostic in some cases. + + * image.c: Integer signedness and overflow and related fixes. + This is not an exhaustive set of fixes, but it's time to + record what I've got. + (lookup_pixel_color, check_image_size): Remove redundant decls. + (check_image_size): Don't assume that arbitrary EMACS_INT values + fit in 'int', or that arbitrary 'double' values fit in 'int'. + (x_alloc_image_color, x_create_x_image_and_pixmap, png_load) + (tiff_load, imagemagick_load_image): + Check for overflow in size calculations. + (x_create_x_image_and_pixmap): Remove unnecessary test for + xmalloc returning NULL; that can't happen. + (xbm_read_bitmap_data): Don't assume sizes fit into 'int'. + (xpm_color_bucket): Use better integer hashing function. + (xpm_cache_color): Don't possibly over-allocate memory. + (struct png_memory_storage, tiff_memory_source, tiff_seek_in_memory) + (gif_memory_source): + Use ptrdiff_t, not int or size_t, to record sizes. + (png_load): Don't assume values greater than 2**31 fit in 'int'. + (our_stdio_fill_input_buffer): Prefer ptrdiff_t to size_t when + either works, as we prefer signed integers. + (tiff_read_from_memory, tiff_write_from_memory): + Return tsize_t, not size_t, since that's what the TIFF API wants. + (tiff_read_from_memory): Don't fail simply because the read would + go past EOF; instead, return a short read. + (tiff_load): Omit no-longer-needed casts. + (Fimagemagick_types): Don't assume size fits into 'int'. + + Improve hashing quality when configured --with-wide-int. + * fns.c (hash_string): New function, taken from sxhash_string. + Do not discard information about ASCII character case; this + discarding is no longer needed. + (sxhash-string): Use it. Change sig to match it. Caller changed. + * lisp.h: Declare it. + * lread.c (hash_string): Remove, since we now use fns.c's version. + The fns.c version returns a wider integer if --with-wide-int is + specified, so this should help the quality of the hashing a bit. + + * emacs.c: Integer overflow minor fix. + (heap_bss_diff): Now uprintmax_t, not unsigned long. All used changed. + Define only if GNU_LINUX. + (main, Fdump_emacs): Set and use heap_bss_diff only if GNU_LINUX. + + * dispnew.c: Integer signedness and overflow fixes. + Remove unnecessary forward decls, that were a maintenance hassle. + (history_tick): Now uprintmax_t, so it's more likely to avoid overflow. + All uses changed. + (adjust_glyph_matrix, realloc_glyph_pool, adjust_frame_message_buffer) + (scrolling_window): Use ptrdiff_t, not int, for byte count. + (prepare_desired_row, line_draw_cost): + Use int, not unsigned, where either works. + (save_current_matrix, restore_current_matrix): + Use ptrdiff_t, not size_t, where either works. + (init_display): Check for overflow more accurately, and without + relying on undefined behavior. + + * editfns.c (pWIDE, pWIDElen, signed_wide, unsigned_wide): + Remove, replacing with the new symbols in lisp.h. All uses changed. + * fileio.c (make_temp_name): + * filelock.c (lock_file_1, lock_file): + * xdisp.c (message_dolog): + Don't assume PRIdMAX etc. works; this isn't portable to pre-C99 hosts. + Use pMd etc. instead. + * lisp.h (printmax_t, uprintmax_t, pMd, pMu): New types and macros, + replacing the pWIDE etc. symbols removed from editfns.c. + + * keyboard.h (num_input_events): Now uintmax_t. + This is (very slightly) less likely to mess up due to wraparound. + All uses changed. + + * buffer.c: Integer signedness fixes. + (alloc_buffer_text, enlarge_buffer_text): + Use ptrdiff_t rather than size_t when either will do, as we prefer + signed integers. + + * bidi.c: Integer signedness and overflow fixes. + (bidi_cache_idx, bidi_cache_last_idx, bidi_cache_fetch_state) + (bidi_cache_search, bidi_cache_find_level_change) + (bidi_cache_iterator_state, bidi_cache_find) + (bidi_find_other_level_edge, bidi_dump_cached_states): + Don't arbitrarily limit cache indexes to int; use ptrdiff_t instead. + (bidi_cache_size): Use ptrdiff_t rather than size_t, as we prefer + signed integers. + (elsz): Make it a (signed) constant. + (bidi_cache_iterator_state): Check for size-calculation overflow. + + * alloc.c: Integer signedness and overflow fixes. + Do not impose an arbitrary 32-bit limit on malloc sizes when debugging. + (__malloc_size_t): Default to size_t, not to int. + (pure_size, pure_bytes_used_before_overflow, stack_copy_size) + (Fgarbage_collect, mark_object_loop_halt, mark_object): + Prefer ptrdiff_t to size_t when either would do, as we prefer + signed integers. + (XMALLOC_OVERRUN_CHECK_OVERHEAD): New macro. + (xmalloc_overrun_check_header, xmalloc_overrun_check_trailer): + Now const. Initialize with values that are in range even if char + is signed. + (XMALLOC_PUT_SIZE, XMALLOC_GET_SIZE): Remove, replacing with ... + (xmalloc_put_size, xmalloc_get_size): New functions. All uses changed. + These functions do the right thing with sizes > 2**32. + (check_depth): Now ptrdiff_t, not int. + (overrun_check_malloc, overrun_check_realloc, overrun_check_free): + Adjust to new way of storing sizes. Check for size overflow bugs + in rest of code. + (STRING_BYTES_MAX): Adjust to new overheads. The old code was + slightly wrong anyway, as it missed one instance of + XMALLOC_OVERRUN_CHECK_OVERHEAD. + (refill_memory_reserve): Omit needless cast to size_t. + (mark_object_loop_halt): Mark as externally visible. + + * xselect.c: Integer signedness and overflow fixes. + (Fx_register_dnd_atom, x_handle_dnd_message): + Use ptrdiff_t, not size_t, since we prefer signed. + (Fx_register_dnd_atom): Check for ptrdiff_t (and size_t) overflow. + * xterm.h (struct x_display_info): Use ptrdiff_t, not size_t, for + x_dnd_atoms_size and x_dnd_atoms_length. + + * doprnt.c: Prefer signed to unsigned when either works. + * eval.c (verror): + * doprnt.c (doprnt): + * lisp.h (doprnt): + * xdisp.c (vmessage): + Use ptrdiff_t, not size_t, when using or implementing doprnt, + since the sizes cannot exceed ptrdiff_t bounds anyway, and we + prefer signed arithmetic to avoid comparison confusion. + * doprnt.c (doprnt): Avoid a "+ 1" that can't overflow, + but is a bit tricky. + + * lisp.h (struct vectorlike_header, struct Lisp_Subr): Signed sizes. + Use EMACS_INT, not EMACS_UINT, for sizes. The code works equally + well either way, and we prefer signed to unsigned. + +2011-07-14 Paul Eggert + Assume freestanding C89 headers, string.h, stdlib.h. * data.c, doprnt.c, floatfns.c, print.c: Include float.h unconditionally. === modified file 'src/alloc.c' --- src/alloc.c 2011-07-13 01:04:29 +0000 +++ src/alloc.c 2011-07-13 03:45:56 +0000 @@ -70,7 +70,7 @@ #include /* malloc.h #defines this as size_t, at least in glibc2. */ #ifndef __malloc_size_t -#define __malloc_size_t int +#define __malloc_size_t size_t #endif /* Specify maximum number of areas to mmap. It would be nice to use a @@ -214,12 +214,12 @@ /* Pointer to the pure area, and its size. */ static char *purebeg; -static size_t pure_size; +static ptrdiff_t pure_size; /* Number of bytes of pure storage used before pure storage overflowed. If this is non-zero, this implies that an overflow occurred. */ -static size_t pure_bytes_used_before_overflow; +static ptrdiff_t pure_bytes_used_before_overflow; /* Value is non-zero if P points into pure space. */ @@ -252,7 +252,7 @@ #if MAX_SAVE_STACK > 0 static char *stack_copy; -static size_t stack_copy_size; +static ptrdiff_t stack_copy_size; #endif /* Non-zero means ignore malloc warnings. Set during initialization. @@ -486,14 +486,15 @@ #ifndef XMALLOC_OVERRUN_CHECK -#define XMALLOC_OVERRUN_CHECK_SIZE 0 +#define XMALLOC_OVERRUN_CHECK_OVERHEAD 0 #else -/* Check for overrun in malloc'ed buffers by wrapping a 16 byte header - and a 16 byte trailer around each block. +/* Check for overrun in malloc'ed buffers by wrapping a header and trailer + around each block. - The header consists of 12 fixed bytes + a 4 byte integer contaning the - original block size, while the trailer consists of 16 fixed bytes. + The header consists of 16 fixed bytes followed by sizeof (size_t) bytes + containing the original block size in little-endian order, + while the trailer consists of 16 fixed bytes. The header is used to detect whether this block has been allocated through these functions -- as it seems that some low-level libc @@ -502,31 +503,47 @@ #define XMALLOC_OVERRUN_CHECK_SIZE 16 - -static char xmalloc_overrun_check_header[XMALLOC_OVERRUN_CHECK_SIZE-4] = - { 0x9a, 0x9b, 0xae, 0xaf, - 0xbf, 0xbe, 0xce, 0xcf, - 0xea, 0xeb, 0xec, 0xed }; - -static char xmalloc_overrun_check_trailer[XMALLOC_OVERRUN_CHECK_SIZE] = - { 0xaa, 0xab, 0xac, 0xad, - 0xba, 0xbb, 0xbc, 0xbd, - 0xca, 0xcb, 0xcc, 0xcd, - 0xda, 0xdb, 0xdc, 0xdd }; - -/* Macros to insert and extract the block size in the header. */ - -#define XMALLOC_PUT_SIZE(ptr, size) \ - (ptr[-1] = (size & 0xff), \ - ptr[-2] = ((size >> 8) & 0xff), \ - ptr[-3] = ((size >> 16) & 0xff), \ - ptr[-4] = ((size >> 24) & 0xff)) - -#define XMALLOC_GET_SIZE(ptr) \ - (size_t)((unsigned)(ptr[-1]) | \ - ((unsigned)(ptr[-2]) << 8) | \ - ((unsigned)(ptr[-3]) << 16) | \ - ((unsigned)(ptr[-4]) << 24)) +#define XMALLOC_OVERRUN_CHECK_OVERHEAD \ + (2 * XMALLOC_OVERRUN_CHECK_SIZE + sizeof (size_t)) + +static char const xmalloc_overrun_check_header[XMALLOC_OVERRUN_CHECK_SIZE] = + { '\x9a', '\x9b', '\xae', '\xaf', + '\xbf', '\xbe', '\xce', '\xcf', + '\xea', '\xeb', '\xec', '\xed', + '\xdf', '\xde', '\x9c', '\x9d' }; + +static char const xmalloc_overrun_check_trailer[XMALLOC_OVERRUN_CHECK_SIZE] = + { '\xaa', '\xab', '\xac', '\xad', + '\xba', '\xbb', '\xbc', '\xbd', + '\xca', '\xcb', '\xcc', '\xcd', + '\xda', '\xdb', '\xdc', '\xdd' }; + +/* Insert and extract the block size in the header. */ + +static void +xmalloc_put_size (unsigned char *ptr, size_t size) +{ + int i; + for (i = 0; i < sizeof (size_t); i++) + { + *--ptr = size & (1 << CHAR_BIT) - 1; + size >>= CHAR_BIT; + } +} + +static size_t +xmalloc_get_size (unsigned char *ptr) +{ + size_t size = 0; + int i; + ptr -= sizeof (size_t); + for (i = 0; i < sizeof (size_t); i++) + { + size <<= CHAR_BIT; + size += *ptr++; + } + return size; +} /* The call depth in overrun_check functions. For example, this might happen: @@ -545,10 +562,10 @@ xfree(10032) overrun_check_free(10032) - decrease overhed + decrease overhead free(10016) <- crash, because 10000 is the original pointer. */ -static int check_depth; +static ptrdiff_t check_depth; /* Like malloc, but wraps allocated block with header and trailer. */ @@ -556,15 +573,16 @@ overrun_check_malloc (size_t size) { register unsigned char *val; - size_t overhead = ++check_depth == 1 ? XMALLOC_OVERRUN_CHECK_SIZE*2 : 0; + int overhead = ++check_depth == 1 ? XMALLOC_OVERRUN_CHECK_OVERHEAD : 0; + if (SIZE_MAX - overhead < size) + abort (); val = (unsigned char *) malloc (size + overhead); if (val && check_depth == 1) { - memcpy (val, xmalloc_overrun_check_header, - XMALLOC_OVERRUN_CHECK_SIZE - 4); - val += XMALLOC_OVERRUN_CHECK_SIZE; - XMALLOC_PUT_SIZE(val, size); + memcpy (val, xmalloc_overrun_check_header, XMALLOC_OVERRUN_CHECK_SIZE); + val += XMALLOC_OVERRUN_CHECK_SIZE + sizeof (size_t); + xmalloc_put_size (val, size); memcpy (val + size, xmalloc_overrun_check_trailer, XMALLOC_OVERRUN_CHECK_SIZE); } @@ -580,31 +598,32 @@ overrun_check_realloc (POINTER_TYPE *block, size_t size) { register unsigned char *val = (unsigned char *) block; - size_t overhead = ++check_depth == 1 ? XMALLOC_OVERRUN_CHECK_SIZE*2 : 0; + int overhead = ++check_depth == 1 ? XMALLOC_OVERRUN_CHECK_OVERHEAD : 0; + if (SIZE_MAX - overhead < size) + abort (); if (val && check_depth == 1 && memcmp (xmalloc_overrun_check_header, - val - XMALLOC_OVERRUN_CHECK_SIZE, - XMALLOC_OVERRUN_CHECK_SIZE - 4) == 0) + val - XMALLOC_OVERRUN_CHECK_SIZE - sizeof (size_t), + XMALLOC_OVERRUN_CHECK_SIZE) == 0) { - size_t osize = XMALLOC_GET_SIZE (val); + size_t osize = xmalloc_get_size (val); if (memcmp (xmalloc_overrun_check_trailer, val + osize, XMALLOC_OVERRUN_CHECK_SIZE)) abort (); memset (val + osize, 0, XMALLOC_OVERRUN_CHECK_SIZE); - val -= XMALLOC_OVERRUN_CHECK_SIZE; - memset (val, 0, XMALLOC_OVERRUN_CHECK_SIZE); + val -= XMALLOC_OVERRUN_CHECK_SIZE + sizeof (size_t); + memset (val, 0, XMALLOC_OVERRUN_CHECK_SIZE + sizeof (size_t)); } val = (unsigned char *) realloc ((POINTER_TYPE *)val, size + overhead); if (val && check_depth == 1) { - memcpy (val, xmalloc_overrun_check_header, - XMALLOC_OVERRUN_CHECK_SIZE - 4); - val += XMALLOC_OVERRUN_CHECK_SIZE; - XMALLOC_PUT_SIZE(val, size); + memcpy (val, xmalloc_overrun_check_header, XMALLOC_OVERRUN_CHECK_SIZE); + val += XMALLOC_OVERRUN_CHECK_SIZE + sizeof (size_t); + xmalloc_put_size (val, size); memcpy (val + size, xmalloc_overrun_check_trailer, XMALLOC_OVERRUN_CHECK_SIZE); } @@ -623,20 +642,20 @@ if (val && check_depth == 1 && memcmp (xmalloc_overrun_check_header, - val - XMALLOC_OVERRUN_CHECK_SIZE, - XMALLOC_OVERRUN_CHECK_SIZE - 4) == 0) + val - XMALLOC_OVERRUN_CHECK_SIZE - sizeof (size_t), + XMALLOC_OVERRUN_CHECK_SIZE) == 0) { - size_t osize = XMALLOC_GET_SIZE (val); + size_t osize = xmalloc_get_size (val); if (memcmp (xmalloc_overrun_check_trailer, val + osize, XMALLOC_OVERRUN_CHECK_SIZE)) abort (); #ifdef XMALLOC_CLEAR_FREE_MEMORY - val -= XMALLOC_OVERRUN_CHECK_SIZE; - memset (val, 0xff, osize + XMALLOC_OVERRUN_CHECK_SIZE*2); + val -= XMALLOC_OVERRUN_CHECK_SIZE + sizeof (size_t); + memset (val, 0xff, osize + XMALLOC_OVERRUN_CHECK_OVERHEAD); #else memset (val + osize, 0, XMALLOC_OVERRUN_CHECK_SIZE); - val -= XMALLOC_OVERRUN_CHECK_SIZE; - memset (val, 0, XMALLOC_OVERRUN_CHECK_SIZE); + val -= XMALLOC_OVERRUN_CHECK_SIZE + sizeof (size_t); + memset (val, 0, XMALLOC_OVERRUN_CHECK_SIZE + sizeof (size_t)); #endif } @@ -1661,7 +1680,8 @@ calculating a value to be passed to malloc. */ #define STRING_BYTES_MAX \ min (STRING_BYTES_BOUND, \ - ((SIZE_MAX - XMALLOC_OVERRUN_CHECK_SIZE - GC_STRING_EXTRA \ + ((SIZE_MAX - XMALLOC_OVERRUN_CHECK_OVERHEAD \ + - GC_STRING_EXTRA \ - offsetof (struct sblock, first_data) \ - SDATA_DATA_OFFSET) \ & ~(sizeof (EMACS_INT) - 1))) @@ -3320,7 +3340,7 @@ { #ifndef SYSTEM_MALLOC if (spare_memory[0] == 0) - spare_memory[0] = (char *) malloc ((size_t) SPARE_MEMORY); + spare_memory[0] = (char *) malloc (SPARE_MEMORY); if (spare_memory[1] == 0) spare_memory[1] = (char *) lisp_align_malloc (sizeof (struct cons_block), MEM_TYPE_CONS); @@ -4922,7 +4942,7 @@ if (NILP (Vpurify_flag)) { char *stack; - size_t stack_size; + ptrdiff_t stack_size; if (&stack_top_variable < stack_bottom) { stack = &stack_top_variable; @@ -5233,7 +5253,7 @@ links of a list, in mark_object. In debugging, the call to abort will hit a breakpoint. Normally this is zero and the check never goes off. */ -static size_t mark_object_loop_halt; +ptrdiff_t mark_object_loop_halt EXTERNALLY_VISIBLE; static void mark_vectorlike (struct Lisp_Vector *ptr) @@ -5290,7 +5310,7 @@ void *po; struct mem_node *m; #endif - size_t cdr_count = 0; + ptrdiff_t cdr_count = 0; loop: === modified file 'src/bidi.c' --- src/bidi.c 2011-06-26 17:23:40 +0000 +++ src/bidi.c 2011-07-12 17:35:56 +0000 @@ -263,10 +263,10 @@ #define BIDI_CACHE_CHUNK 200 static struct bidi_it *bidi_cache; -static size_t bidi_cache_size = 0; -static size_t elsz = sizeof (struct bidi_it); -static int bidi_cache_idx; /* next unused cache slot */ -static int bidi_cache_last_idx; /* slot of last cache hit */ +static ptrdiff_t bidi_cache_size = 0; +enum { elsz = sizeof (struct bidi_it) }; +static ptrdiff_t bidi_cache_idx; /* next unused cache slot */ +static ptrdiff_t bidi_cache_last_idx; /* slot of last cache hit */ static inline void bidi_cache_reset (void) @@ -288,7 +288,7 @@ } static inline void -bidi_cache_fetch_state (int idx, struct bidi_it *bidi_it) +bidi_cache_fetch_state (ptrdiff_t idx, struct bidi_it *bidi_it) { int current_scan_dir = bidi_it->scan_dir; @@ -304,10 +304,10 @@ level less or equal to LEVEL. if LEVEL is -1, disregard the resolved levels in cached states. DIR, if non-zero, means search in that direction from the last cache hit. */ -static inline int +static inline ptrdiff_t bidi_cache_search (EMACS_INT charpos, int level, int dir) { - int i, i_start; + ptrdiff_t i, i_start; if (bidi_cache_idx) { @@ -366,12 +366,12 @@ C, searching backwards (DIR = -1) for LEVEL = 2 will return the index of slot B or A, depending whether BEFORE is, respectively, non-zero or zero. */ -static int +static ptrdiff_t bidi_cache_find_level_change (int level, int dir, int before) { if (bidi_cache_idx) { - int i = dir ? bidi_cache_last_idx : bidi_cache_idx - 1; + ptrdiff_t i = dir ? bidi_cache_last_idx : bidi_cache_idx - 1; int incr = before ? 1 : 0; if (!dir) @@ -407,7 +407,7 @@ static inline void bidi_cache_iterator_state (struct bidi_it *bidi_it, int resolved) { - int idx; + ptrdiff_t idx; /* We should never cache on backward scans. */ if (bidi_it->scan_dir == -1) @@ -420,6 +420,9 @@ /* Enlarge the cache as needed. */ if (idx >= bidi_cache_size) { + if (min (PTRDIFF_MAX, SIZE_MAX) / elsz - BIDI_CACHE_CHUNK + < bidi_cache_size) + memory_full (SIZE_MAX); bidi_cache_size += BIDI_CACHE_CHUNK; bidi_cache = (struct bidi_it *) xrealloc (bidi_cache, bidi_cache_size * elsz); @@ -468,7 +471,7 @@ static inline bidi_type_t bidi_cache_find (EMACS_INT charpos, int level, struct bidi_it *bidi_it) { - int i = bidi_cache_search (charpos, level, bidi_it->scan_dir); + ptrdiff_t i = bidi_cache_search (charpos, level, bidi_it->scan_dir); if (i >= 0) { @@ -1756,7 +1759,7 @@ bidi_find_other_level_edge (struct bidi_it *bidi_it, int level, int end_flag) { int dir = end_flag ? -bidi_it->scan_dir : bidi_it->scan_dir; - int idx; + ptrdiff_t idx; /* Try the cache first. */ if ((idx = bidi_cache_find_level_change (level, dir, end_flag)) >= 0) @@ -1912,7 +1915,7 @@ void bidi_dump_cached_states (void) { - int i; + ptrdiff_t i; int ndigits = 1; if (bidi_cache_idx == 0) @@ -1920,7 +1923,7 @@ fprintf (stderr, "The cache is empty.\n"); return; } - fprintf (stderr, "Total of %d state%s in cache:\n", + fprintf (stderr, "Total of %"pD"d state%s in cache:\n", bidi_cache_idx, bidi_cache_idx == 1 ? "" : "s"); for (i = bidi_cache[bidi_cache_idx - 1].charpos; i > 0; i /= 10) === modified file 'src/buffer.c' --- src/buffer.c 2011-07-13 04:09:28 +0000 +++ src/buffer.c 2011-07-14 06:41:47 +0000 @@ -152,7 +152,7 @@ Lisp_Object Qinsert_in_front_hooks; Lisp_Object Qinsert_behind_hooks; -static void alloc_buffer_text (struct buffer *, size_t); +static void alloc_buffer_text (struct buffer *, ptrdiff_t); static void free_buffer_text (struct buffer *b); static struct Lisp_Overlay * copy_overlays (struct buffer *, struct Lisp_Overlay *); static void modify_overlay (struct buffer *, EMACS_INT, EMACS_INT); @@ -4796,7 +4796,7 @@ /* Allocate NBYTES bytes for buffer B's text buffer. */ static void -alloc_buffer_text (struct buffer *b, size_t nbytes) +alloc_buffer_text (struct buffer *b, ptrdiff_t nbytes) { POINTER_TYPE *p; @@ -4826,8 +4826,8 @@ enlarge_buffer_text (struct buffer *b, EMACS_INT delta) { POINTER_TYPE *p; - size_t nbytes = (BUF_Z_BYTE (b) - BUF_BEG_BYTE (b) + BUF_GAP_SIZE (b) + 1 - + delta); + ptrdiff_t nbytes = (BUF_Z_BYTE (b) - BUF_BEG_BYTE (b) + BUF_GAP_SIZE (b) + 1 + + delta); BLOCK_INPUT; #if defined USE_MMAP_FOR_BUFFERS p = mmap_realloc ((POINTER_TYPE **) &b->text->beg, nbytes); === modified file 'src/callint.c' --- src/callint.c 2011-07-07 16:59:26 +0000 +++ src/callint.c 2011-07-09 07:06:04 +0000 @@ -339,7 +339,7 @@ { Lisp_Object input; Lisp_Object funval = Findirect_function (function, Qt); - size_t events = num_input_events; + uintmax_t events = num_input_events; input = specs; /* Compute the arg values using the user's expression. */ GCPRO2 (input, filter_specs); === modified file 'src/dispnew.c' --- src/dispnew.c 2011-07-10 08:20:10 +0000 +++ src/dispnew.c 2011-07-11 18:36:33 +0000 @@ -103,57 +103,24 @@ /* Function prototypes. */ -static struct glyph_matrix *save_current_matrix (struct frame *); -static void restore_current_matrix (struct frame *, struct glyph_matrix *); -static int showing_window_margins_p (struct window *); -static void fake_current_matrices (Lisp_Object); -static void redraw_overlapping_rows (struct window *, int); -static void redraw_overlapped_rows (struct window *, int); -static int count_blanks (struct glyph *, int); -static int count_match (struct glyph *, struct glyph *, - struct glyph *, struct glyph *); -static unsigned line_draw_cost (struct glyph_matrix *, int); static void update_frame_line (struct frame *, int); -static struct dim allocate_matrices_for_frame_redisplay - (Lisp_Object, int, int, int, int *); static int required_matrix_height (struct window *); static int required_matrix_width (struct window *); -static void allocate_matrices_for_window_redisplay (struct window *); -static int realloc_glyph_pool (struct glyph_pool *, struct dim); static void adjust_frame_glyphs (struct frame *); -static struct glyph_matrix *new_glyph_matrix (struct glyph_pool *); -static void free_glyph_matrix (struct glyph_matrix *); -static void adjust_glyph_matrix (struct window *, struct glyph_matrix *, - int, int, struct dim); static void change_frame_size_1 (struct frame *, int, int, int, int, int); static void increment_row_positions (struct glyph_row *, EMACS_INT, EMACS_INT); -static void swap_glyph_pointers (struct glyph_row *, struct glyph_row *); -#if GLYPH_DEBUG -static int glyph_row_slice_p (struct glyph_row *, struct glyph_row *); -#endif static void fill_up_frame_row_with_spaces (struct glyph_row *, int); static void build_frame_matrix_from_window_tree (struct glyph_matrix *, struct window *); static void build_frame_matrix_from_leaf_window (struct glyph_matrix *, struct window *); -static struct glyph_pool *new_glyph_pool (void); -static void free_glyph_pool (struct glyph_pool *); -static void adjust_frame_glyphs_initially (void); static void adjust_frame_message_buffer (struct frame *); static void adjust_decode_mode_spec_buffer (struct frame *); static void fill_up_glyph_row_with_spaces (struct glyph_row *); -static void build_frame_matrix (struct frame *); -void clear_current_matrices (struct frame *); -void scroll_glyph_matrix_range (struct glyph_matrix *, int, int, - int, int); static void clear_window_matrices (struct window *, int); static void fill_up_glyph_row_area_with_spaces (struct glyph_row *, int); static int scrolling_window (struct window *, int); static int update_window_line (struct window *, int, int *); -static void update_marginal_area (struct window *, int, int); -static int update_text_area (struct window *, int); -static void make_current (struct glyph_matrix *, struct glyph_matrix *, - int); static void mirror_make_current (struct window *, int); #if GLYPH_DEBUG static void check_matrix_pointers (struct glyph_matrix *, @@ -286,7 +253,7 @@ /* A tick that's incremented each time something is added to the history. */ -static unsigned history_tick; +static uprintmax_t history_tick; static void add_frame_display_history (struct frame *, int); @@ -305,7 +272,7 @@ buf = redisplay_history[history_idx].trace; ++history_idx; - sprintf (buf, "%d: window %p (`%s')%s\n", + sprintf (buf, "%"pMu": window %p (`%s')%s\n", history_tick++, w, ((BUFFERP (w->buffer) @@ -331,7 +298,7 @@ buf = redisplay_history[history_idx].trace; ++history_idx; - sprintf (buf, "%d: update frame %p%s", + sprintf (buf, "%"pMu": update frame %p%s", history_tick++, f, paused_p ? " ***paused***" : ""); } @@ -532,7 +499,7 @@ /* Enlarge MATRIX->rows if necessary. New rows are cleared. */ if (matrix->rows_allocated < dim.height) { - int size = dim.height * sizeof (struct glyph_row); + ptrdiff_t size = dim.height * sizeof (struct glyph_row); new_rows = dim.height - matrix->rows_allocated; matrix->rows = (struct glyph_row *) xrealloc (matrix->rows, size); memset (matrix->rows + matrix->rows_allocated, 0, @@ -1198,7 +1165,7 @@ { if (!row->enabled_p) { - unsigned rp = row->reversed_p; + int rp = row->reversed_p; clear_glyph_row (row); row->enabled_p = 1; @@ -1242,7 +1209,7 @@ the number of characters in the line. If must_write_spaces is zero, leading and trailing spaces are ignored. */ -static unsigned int +static int line_draw_cost (struct glyph_matrix *matrix, int vpos) { struct glyph_row *row = matrix->rows + vpos; @@ -1435,7 +1402,7 @@ needed = matrix_dim.width * matrix_dim.height; if (needed > pool->nglyphs) { - int size = needed * sizeof (struct glyph); + ptrdiff_t size = needed * sizeof (struct glyph); if (pool->glyphs) { @@ -2061,7 +2028,7 @@ { struct glyph_row *from = f->current_matrix->rows + i; struct glyph_row *to = saved->rows + i; - size_t nbytes = from->used[TEXT_AREA] * sizeof (struct glyph); + ptrdiff_t nbytes = from->used[TEXT_AREA] * sizeof (struct glyph); to->glyphs[TEXT_AREA] = (struct glyph *) xmalloc (nbytes); memcpy (to->glyphs[TEXT_AREA], from->glyphs[TEXT_AREA], nbytes); to->used[TEXT_AREA] = from->used[TEXT_AREA]; @@ -2083,7 +2050,7 @@ { struct glyph_row *from = saved->rows + i; struct glyph_row *to = f->current_matrix->rows + i; - size_t nbytes = from->used[TEXT_AREA] * sizeof (struct glyph); + ptrdiff_t nbytes = from->used[TEXT_AREA] * sizeof (struct glyph); memcpy (to->glyphs[TEXT_AREA], from->glyphs[TEXT_AREA], nbytes); to->used[TEXT_AREA] = from->used[TEXT_AREA]; xfree (from->glyphs[TEXT_AREA]); @@ -2271,7 +2238,7 @@ static void adjust_frame_message_buffer (struct frame *f) { - int size = FRAME_MESSAGE_BUF_SIZE (f) + 1; + ptrdiff_t size = FRAME_MESSAGE_BUF_SIZE (f) + 1; if (FRAME_MESSAGE_BUF (f)) { @@ -4301,7 +4268,8 @@ struct glyph_matrix *current_matrix = w->current_matrix; int yb = window_text_bottom_y (w); int i, j, first_old, first_new, last_old, last_new; - int nruns, nbytes, n, run_idx; + int nruns, n, run_idx; + ptrdiff_t nbytes; struct row_entry *entry; struct redisplay_interface *rif = FRAME_RIF (XFRAME (WINDOW_FRAME (w))); @@ -6326,11 +6294,14 @@ int width = FRAME_TOTAL_COLS (sf); int height = FRAME_LINES (sf); - unsigned int total_glyphs = height * (width + 2) * sizeof (struct glyph); - /* If these sizes are so big they cause overflow, just ignore the - change. It's not clear what better we could do. */ - if (total_glyphs / sizeof (struct glyph) / height != width + 2) + change. It's not clear what better we could do. The rest of + the code assumes that (width + 2) * height * sizeof (struct glyph) + does not overflow and does not exceed PTRDIFF_MAX or SIZE_MAX. */ + if (INT_ADD_RANGE_OVERFLOW (width, 2, INT_MIN, INT_MAX) + || INT_MULTIPLY_RANGE_OVERFLOW (width + 2, height, INT_MIN, INT_MAX) + || (min (PTRDIFF_MAX, SIZE_MAX) / sizeof (struct glyph) + < (width + 2) * height)) fatal ("screen size %dx%d too big", width, height); } === modified file 'src/doprnt.c' --- src/doprnt.c 2011-07-14 07:31:04 +0000 +++ src/doprnt.c 2011-07-14 07:50:51 +0000 @@ -129,8 +129,8 @@ String arguments are passed as C strings. Integers are passed as C integers. */ -size_t -doprnt (char *buffer, register size_t bufsize, const char *format, +ptrdiff_t +doprnt (char *buffer, ptrdiff_t bufsize, const char *format, const char *format_end, va_list ap) { const char *fmt = format; /* Pointer into format string */ @@ -140,7 +140,7 @@ char tembuf[DBL_MAX_10_EXP + 100]; /* Size of sprintf_buffer. */ - size_t size_allocated = sizeof (tembuf); + ptrdiff_t size_allocated = sizeof (tembuf); /* Buffer to use for sprintf. Either tembuf or same as BIG_BUFFER. */ char *sprintf_buffer = tembuf; @@ -159,7 +159,7 @@ if (format_end == 0) format_end = format + strlen (format); - if ((format_end - format + 1) < sizeof (fixed_buffer)) + if (format_end - format < sizeof (fixed_buffer) - 1) fmtcpy = fixed_buffer; else SAFE_ALLOCA (fmtcpy, char *, format_end - format + 1); @@ -171,7 +171,7 @@ { if (*fmt == '%') /* Check for a '%' character */ { - size_t size_bound = 0; + ptrdiff_t size_bound = 0; EMACS_INT width; /* Columns occupied by STRING on display. */ int long_flag = 0; int pIlen = sizeof pI - 1; @@ -189,16 +189,16 @@ This might be a field width or a precision; e.g. %1.1000f and %1000.1f both might need 1000+ bytes. Parse the width or precision, checking for overflow. */ - size_t n = *fmt - '0'; + ptrdiff_t n = *fmt - '0'; while (fmt + 1 < format_end && '0' <= fmt[1] && fmt[1] <= '9') { - /* Avoid size_t overflow. Avoid int overflow too, as + /* Avoid ptrdiff_t, size_t, and int overflow, as many sprintfs mishandle widths greater than INT_MAX. This test is simple but slightly conservative: e.g., (INT_MAX - INT_MAX % 10) is reported as an overflow even when it's not. */ - if (n >= min (INT_MAX, SIZE_MAX) / 10) + if (n >= min (INT_MAX, min (PTRDIFF_MAX, SIZE_MAX)) / 10) error ("Format width or precision too large"); n = n * 10 + fmt[1] - '0'; *string++ = *++fmt; @@ -230,7 +230,7 @@ /* Make the size bound large enough to handle floating point formats with large numbers. */ - if (size_bound > SIZE_MAX - DBL_MAX_10_EXP - 50) + if (size_bound > min (PTRDIFF_MAX, SIZE_MAX) - DBL_MAX_10_EXP - 50) error ("Format width or precision too large"); size_bound += DBL_MAX_10_EXP + 50; === modified file 'src/editfns.c' --- src/editfns.c 2011-07-13 23:48:35 +0000 +++ src/editfns.c 2011-07-14 06:41:47 +0000 @@ -3510,22 +3510,6 @@ RETURN_UNGCPRO (string); } -/* pWIDE is a conversion for printing large decimal integers (possibly with a - trailing "d" that is ignored). pWIDElen is its length. signed_wide and - unsigned_wide are signed and unsigned types for printing them. Use widest - integers if available so that more floating point values can be converted. */ -#ifdef PRIdMAX -# define pWIDE PRIdMAX -enum { pWIDElen = sizeof PRIdMAX - 2 }; /* Don't count trailing "d". */ -typedef intmax_t signed_wide; -typedef uintmax_t unsigned_wide; -#else -# define pWIDE pI -enum { pWIDElen = sizeof pI - 1 }; -typedef EMACS_INT signed_wide; -typedef EMACS_UINT unsigned_wide; -#endif - DEFUN ("format", Fformat, Sformat, 1, MANY, 0, doc: /* Format a string out of a format-string and arguments. The first argument is a format control string. @@ -3907,7 +3891,11 @@ precision is no more than DBL_USEFUL_PRECISION_MAX. On all practical hosts, %f is the worst case. */ SPRINTF_BUFSIZE = - sizeof "-." + (DBL_MAX_10_EXP + 1) + USEFUL_PRECISION_MAX + sizeof "-." + (DBL_MAX_10_EXP + 1) + USEFUL_PRECISION_MAX, + + /* Length of pM (that is, of pMd without the + trailing "d"). */ + pMlen = sizeof pMd - 2 }; verify (0 < USEFUL_PRECISION_MAX); @@ -3920,7 +3908,7 @@ /* Copy of conversion specification, modified somewhat. At most three flags F can be specified at once. */ - char convspec[sizeof "%FFF.*d" + pWIDElen]; + char convspec[sizeof "%FFF.*d" + pMlen]; /* Avoid undefined behavior in underlying sprintf. */ if (conversion == 'd' || conversion == 'i') @@ -3928,7 +3916,7 @@ /* Create the copy of the conversion specification, with any width and precision removed, with ".*" inserted, - and with pWIDE inserted for integer formats. */ + and with pM inserted for integer formats. */ { char *f = convspec; *f++ = '%'; @@ -3943,8 +3931,8 @@ || conversion == 'o' || conversion == 'x' || conversion == 'X') { - memcpy (f, pWIDE, pWIDElen); - f += pWIDElen; + memcpy (f, pMd, pMlen); + f += pMlen; zero_flag &= ~ precision_given; } *f++ = conversion; @@ -3984,7 +3972,7 @@ /* For float, maybe we should use "%1.0f" instead so it also works for values outside the integer range. */ - signed_wide x; + printmax_t x; if (INTEGERP (args[n])) x = XINT (args[n]); else @@ -3992,13 +3980,13 @@ double d = XFLOAT_DATA (args[n]); if (d < 0) { - x = TYPE_MINIMUM (signed_wide); + x = TYPE_MINIMUM (printmax_t); if (x < d) x = d; } else { - x = TYPE_MAXIMUM (signed_wide); + x = TYPE_MAXIMUM (printmax_t); if (d < x) x = d; } @@ -4008,7 +3996,7 @@ else { /* Don't sign-extend for octal or hex printing. */ - unsigned_wide x; + uprintmax_t x; if (INTEGERP (args[n])) x = XUINT (args[n]); else @@ -4018,7 +4006,7 @@ x = 0; else { - x = TYPE_MAXIMUM (unsigned_wide); + x = TYPE_MAXIMUM (uprintmax_t); if (d < x) x = d; } === modified file 'src/emacs.c' --- src/emacs.c 2011-07-10 08:20:10 +0000 +++ src/emacs.c 2011-07-11 06:05:57 +0000 @@ -170,8 +170,10 @@ /* The address where the heap starts (from the first sbrk (0) call). */ static void *my_heap_start; +#ifdef GNU_LINUX /* The gap between BSS end and heap start as far as we can tell. */ -static unsigned long heap_bss_diff; +static uprintmax_t heap_bss_diff; +#endif /* Nonzero means running Emacs without interactive terminal. */ int noninteractive; @@ -716,6 +718,7 @@ setenv ("G_SLICE", "always-malloc", 1); #endif +#ifdef GNU_LINUX if (!initialized) { extern char my_endbss[]; @@ -726,6 +729,7 @@ heap_bss_diff = (char *)my_heap_start - max (my_endbss, my_endbss_static); } +#endif #ifdef RUN_TIME_REMAP if (initialized) @@ -2134,7 +2138,7 @@ { fprintf (stderr, "**************************************************\n"); fprintf (stderr, "Warning: Your system has a gap between BSS and the\n"); - fprintf (stderr, "heap (%lu bytes). This usually means that exec-shield\n", + fprintf (stderr, "heap (%"pMu" bytes). This usually means that exec-shield\n", heap_bss_diff); fprintf (stderr, "or something similar is in effect. The dump may\n"); fprintf (stderr, "fail because of this. See the section about\n"); === modified file 'src/eval.c' --- src/eval.c 2011-07-05 09:51:56 +0000 +++ src/eval.c 2011-07-07 02:14:52 +0000 @@ -1968,18 +1968,18 @@ verror (const char *m, va_list ap) { char buf[4000]; - size_t size = sizeof buf; - size_t size_max = STRING_BYTES_BOUND + 1; - size_t mlen = strlen (m); + ptrdiff_t size = sizeof buf; + ptrdiff_t size_max = STRING_BYTES_BOUND + 1; + char const *m_end = m + strlen (m); char *buffer = buf; - size_t used; + ptrdiff_t used; Lisp_Object string; while (1) { va_list ap_copy; va_copy (ap_copy, ap); - used = doprnt (buffer, size, m, m + mlen, ap_copy); + used = doprnt (buffer, size, m, m_end, ap_copy); va_end (ap_copy); /* Note: the -1 below is because `doprnt' returns the number of bytes === modified file 'src/fileio.c' --- src/fileio.c 2011-07-04 17:50:12 +0000 +++ src/fileio.c 2011-07-07 21:52:44 +0000 @@ -587,9 +587,9 @@ { Lisp_Object val; int len, clen; - intmax_t pid; + printmax_t pid; char *p, *data; - char pidbuf[INT_BUFSIZE_BOUND (pid_t)]; + char pidbuf[INT_BUFSIZE_BOUND (printmax_t)]; int pidlen; CHECK_STRING (prefix); @@ -611,7 +611,7 @@ else { #ifdef HAVE_LONG_FILE_NAMES - pidlen = sprintf (pidbuf, "%"PRIdMAX, pid); + pidlen = sprintf (pidbuf, "%"pMd, pid); #else pidbuf[0] = make_temp_name_tbl[pid & 63], pid >>= 6; pidbuf[1] = make_temp_name_tbl[pid & 63], pid >>= 6; === modified file 'src/filelock.c' --- src/filelock.c 2011-06-20 03:11:40 +0000 +++ src/filelock.c 2011-07-07 21:52:44 +0000 @@ -337,7 +337,7 @@ lock_file_1 (char *lfname, int force) { register int err; - intmax_t boot, pid; + printmax_t boot, pid; const char *user_name; const char *host_name; char *lock_info_str; @@ -354,15 +354,15 @@ else host_name = ""; lock_info_str = (char *)alloca (strlen (user_name) + strlen (host_name) - + 2 * INT_STRLEN_BOUND (intmax_t) + + 2 * INT_STRLEN_BOUND (printmax_t) + sizeof "@.:"); pid = getpid (); if (boot) - sprintf (lock_info_str, "%s@%s.%"PRIdMAX":%"PRIdMAX, + sprintf (lock_info_str, "%s@%s.%"pMd":%"pMd, user_name, host_name, pid, boot); else - sprintf (lock_info_str, "%s@%s.%"PRIdMAX, + sprintf (lock_info_str, "%s@%s.%"pMd, user_name, host_name, pid); err = symlink (lock_info_str, lfname); @@ -542,7 +542,7 @@ register Lisp_Object attack, orig_fn, encoded_fn; register char *lfname, *locker; lock_info_type lock_info; - intmax_t pid; + printmax_t pid; struct gcpro gcpro1; /* Don't do locking while dumping Emacs. @@ -581,9 +581,10 @@ /* Else consider breaking the lock */ locker = (char *) alloca (strlen (lock_info.user) + strlen (lock_info.host) - + INT_STRLEN_BOUND (intmax_t) + sizeof "@ (pid )"); + + INT_STRLEN_BOUND (printmax_t) + + sizeof "@ (pid )"); pid = lock_info.pid; - sprintf (locker, "%s@%s (pid %"PRIdMAX")", + sprintf (locker, "%s@%s (pid %"pMd")", lock_info.user, lock_info.host, pid); FREE_LOCK_INFO (lock_info); === modified file 'src/fns.c' --- src/fns.c 2011-07-05 02:51:15 +0000 +++ src/fns.c 2011-07-08 00:51:25 +0000 @@ -4098,25 +4098,33 @@ #define SXHASH_REDUCE(X) \ ((((X) ^ (X) >> (BITS_PER_EMACS_INT - FIXNUM_BITS))) & INTMASK) -/* Return a hash for string PTR which has length LEN. The hash - code returned is guaranteed to fit in a Lisp integer. */ +/* Return a hash for string PTR which has length LEN. The hash value + can be any EMACS_UINT value. */ -static EMACS_UINT -sxhash_string (unsigned char *ptr, EMACS_INT len) +EMACS_UINT +hash_string (char const *ptr, ptrdiff_t len) { - unsigned char *p = ptr; - unsigned char *end = p + len; + char const *p = ptr; + char const *end = p + len; unsigned char c; EMACS_UINT hash = 0; while (p != end) { c = *p++; - if (c >= 0140) - c -= 40; hash = SXHASH_COMBINE (hash, c); } + return hash; +} + +/* Return a hash for string PTR which has length LEN. The hash + code returned is guaranteed to fit in a Lisp integer. */ + +static EMACS_UINT +sxhash_string (char const *ptr, ptrdiff_t len) +{ + EMACS_UINT hash = hash_string (ptr, len); return SXHASH_REDUCE (hash); } @@ -4231,7 +4239,7 @@ /* Fall through. */ case Lisp_String: - hash = sxhash_string (SDATA (obj), SCHARS (obj)); + hash = sxhash_string (SSDATA (obj), SBYTES (obj)); break; /* This can be everything from a vector to an overlay. */ === modified file 'src/gtkutil.c' --- src/gtkutil.c 2011-07-10 04:54:04 +0000 +++ src/gtkutil.c 2011-07-13 15:42:12 +0000 @@ -269,8 +269,8 @@ GDK_COLORSPACE_RGB, FALSE, xim->bitmap_unit, - (int) width, - (int) height, + width, + height, xim->bytes_per_line, NULL, NULL); @@ -3646,7 +3646,7 @@ gtk_adjustment_set_page_size (adj, size); gtk_adjustment_set_step_increment (adj, new_step); /* Assume a page increment is about 95% of the page size */ - gtk_adjustment_set_page_increment (adj,(int) (0.95*size)); + gtk_adjustment_set_page_increment (adj, size - size / 20); changed = 1; } } === modified file 'src/image.c' --- src/image.c 2011-07-10 08:20:10 +0000 +++ src/image.c 2011-07-14 06:20:53 +0000 @@ -136,7 +136,6 @@ #ifdef COLOR_TABLE_SUPPORT static void free_color_table (void); static unsigned long *colors_in_color_table (int *n); -static unsigned long lookup_pixel_color (struct frame *f, unsigned long p); #endif static Lisp_Object Finit_image_library (Lisp_Object, Lisp_Object); @@ -987,7 +986,6 @@ ***********************************************************************/ static void free_image (struct frame *f, struct image *img); -static int check_image_size (struct frame *f, int width, int height); #define MAX_IMAGE_SIZE 6.0 /* Allocate and return a new image structure for image specification @@ -1042,7 +1040,7 @@ /* Return 1 if the given widths and heights are valid for display; otherwise, return 0. */ -int +static int check_image_size (struct frame *f, int width, int height) { int w, h; @@ -1051,23 +1049,18 @@ return 0; if (INTEGERP (Vmax_image_size)) - w = h = XINT (Vmax_image_size); + return (width <= XINT (Vmax_image_size) + && height <= XINT (Vmax_image_size)); else if (FLOATP (Vmax_image_size)) { - if (f != NULL) - { - w = FRAME_PIXEL_WIDTH (f); - h = FRAME_PIXEL_HEIGHT (f); - } - else - w = h = 1024; /* Arbitrary size for unknown frame. */ - w = (int) (XFLOAT_DATA (Vmax_image_size) * w); - h = (int) (XFLOAT_DATA (Vmax_image_size) * h); + xassert (f); + w = FRAME_PIXEL_WIDTH (f); + h = FRAME_PIXEL_HEIGHT (f); + return (width <= XFLOAT_DATA (Vmax_image_size) * w + && height <= XFLOAT_DATA (Vmax_image_size) * h); } else return 1; - - return (width <= w && height <= h); } /* Prepare image IMG for display on frame F. Must be called before @@ -1368,7 +1361,9 @@ xassert (STRINGP (color_name)); - if (x_defined_color (f, SSDATA (color_name), &color, 1)) + if (x_defined_color (f, SSDATA (color_name), &color, 1) + && img->ncolors < min (min (PTRDIFF_MAX, SIZE_MAX) / sizeof *img->colors, + INT_MAX)) { /* This isn't called frequently so we get away with simply reallocating the color vector to the needed size, here. */ @@ -1911,6 +1906,38 @@ static void x_destroy_x_image (XImagePtr); static void x_put_x_image (struct frame *, XImagePtr, Pixmap, int, int); +/* Return nonzero if XIMG's size WIDTH x HEIGHT doesn't break X. + WIDTH and HEIGHT must both be positive. + If XIMG is null, assume it is a bitmap. */ +static int +x_check_image_size (XImagePtr ximg, int width, int height) +{ + /* Respect Xlib's limits: it cannot deal with images that have more + than INT_MAX (and/or UINT_MAX) bytes. And respect Emacs's limits + of PTRDIFF_MAX (and/or SIZE_MAX) bytes for any object. For now, + assume all windowing systems have the same limits that X does. */ + enum + { + XLIB_BYTES_MAX = min (INT_MAX, UINT_MAX), + X_IMAGE_BYTES_MAX = min (XLIB_BYTES_MAX, min (PTRDIFF_MAX, SIZE_MAX)) + }; + + int bitmap_pad, depth, bytes_per_line; + if (ximg) + { + bitmap_pad = ximg->bitmap_pad; + depth = ximg->depth; + bytes_per_line = ximg->bytes_per_line; + } + else + { + bitmap_pad = 8; + depth = 1; + bytes_per_line = (width >> 3) + ((width & 7) != 0); + } + return (width <= (INT_MAX - (bitmap_pad - 1)) / depth + && height <= X_IMAGE_BYTES_MAX / bytes_per_line); +} /* Create an XImage and a pixmap of size WIDTH x HEIGHT for use on frame F. Set *XIMG and *PIXMAP to the XImage and Pixmap created. @@ -1943,6 +1970,15 @@ return 0; } + if (! x_check_image_size (*ximg, width, height)) + { + x_destroy_x_image (*ximg); + *ximg = NULL; + image_error ("Image too large (%dx%d)", + make_number (width), make_number (height)); + return 0; + } + /* Allocate image raster. */ (*ximg)->data = (char *) xmalloc ((*ximg)->bytes_per_line * height); @@ -1989,11 +2025,6 @@ palette_colors = 1 << depth - 1; *ximg = xmalloc (sizeof (XImage) + palette_colors * sizeof (RGBQUAD)); - if (*ximg == NULL) - { - image_error ("Unable to allocate memory for XImage", Qnil, Qnil); - return 0; - } header = &(*ximg)->info.bmiHeader; memset (&(*ximg)->info, 0, sizeof (BITMAPINFO)); @@ -2365,7 +2396,7 @@ } else if (BOOL_VECTOR_P (data)) { - if (XBOOL_VECTOR (data)->size < width * height) + if (XBOOL_VECTOR (data)->size / height < width) return 0; } else @@ -2561,13 +2592,15 @@ img->pixmap = ns_image_from_XBM (data, img->width, img->height); #else - img->pixmap - = XCreatePixmapFromBitmapData (FRAME_X_DISPLAY (f), + img->pixmap = + (x_check_image_size (0, img->width, img->height) + ? XCreatePixmapFromBitmapData (FRAME_X_DISPLAY (f), FRAME_X_WINDOW (f), data, img->width, img->height, fg, bg, - DefaultDepthOfScreen (FRAME_X_SCREEN (f))); + DefaultDepthOfScreen (FRAME_X_SCREEN (f))) + : NO_PIXMAP); #endif /* !HAVE_NTGUI && !HAVE_NS */ } @@ -2674,6 +2707,13 @@ expect ('='); expect ('{'); + if (! x_check_image_size (0, *width, *height)) + { + if (!inhibit_image_error) + image_error ("Image too large (%dx%d)", + make_number (*width), make_number (*height)); + goto failure; + } bytes_per_line = (*width + 7) / 8 + padding_p; nbytes = bytes_per_line * *height; p = *data = (char *) xmalloc (nbytes); @@ -2864,6 +2904,12 @@ img->width = XFASTINT (fmt[XBM_WIDTH].value); img->height = XFASTINT (fmt[XBM_HEIGHT].value); xassert (img->width > 0 && img->height > 0); + if (!check_image_size (f, img->width, img->height)) + { + image_error ("Invalid image size (see `max-image-size')", + Qnil, Qnil); + return 0; + } } /* Get foreground and background colors, maybe allocate colors. */ @@ -2925,9 +2971,13 @@ #endif /* Create the pixmap. */ - Create_Pixmap_From_Bitmap_Data (f, img, bits, - foreground, background, - non_default_colors); + if (x_check_image_size (0, img->width, img->height)) + Create_Pixmap_From_Bitmap_Data (f, img, bits, + foreground, background, + non_default_colors); + else + img->pixmap = NO_PIXMAP; + if (img->pixmap) success_p = 1; else @@ -3125,12 +3175,8 @@ static int xpm_color_bucket (char *color_name) { - unsigned h = 0; - char *s; - - for (s = color_name; *s; ++s) - h = (h << 2) ^ *s; - return h %= XPM_COLOR_CACHE_BUCKETS; + EMACS_UINT hash = hash_string (color_name, strlen (color_name)); + return hash % XPM_COLOR_CACHE_BUCKETS; } @@ -3147,7 +3193,7 @@ if (bucket < 0) bucket = xpm_color_bucket (color_name); - nbytes = sizeof *p + strlen (color_name); + nbytes = offsetof (struct xpm_cached_color, name) + strlen (color_name) + 1; p = (struct xpm_cached_color *) xmalloc (nbytes); strcpy (p->name, color_name); p->color = *color; @@ -3849,6 +3895,18 @@ goto failure; } + if (!x_create_x_image_and_pixmap (f, width, height, 0, + &ximg, &img->pixmap) +#ifndef HAVE_NS + || !x_create_x_image_and_pixmap (f, width, height, 1, + &mask_img, &img->mask) +#endif + ) + { + image_error ("Image too large", Qnil, Qnil); + goto failure; + } + expect (','); XSETFRAME (frame, f); @@ -3942,18 +4000,6 @@ expect (','); } - if (!x_create_x_image_and_pixmap (f, width, height, 0, - &ximg, &img->pixmap) -#ifndef HAVE_NS - || !x_create_x_image_and_pixmap (f, width, height, 1, - &mask_img, &img->mask) -#endif - ) - { - image_error ("Out of memory (%s)", img->spec, Qnil); - goto error; - } - for (y = 0; y < height; y++) { expect (XPM_TK_STRING); @@ -5518,8 +5564,8 @@ struct png_memory_storage { unsigned char *bytes; /* The data */ - size_t len; /* How big is it? */ - int index; /* Where are we? */ + ptrdiff_t len; /* How big is it? */ + ptrdiff_t index; /* Where are we? */ }; @@ -5563,7 +5609,8 @@ { Lisp_Object file, specified_file; Lisp_Object specified_data; - int x, y, i; + int x, y; + ptrdiff_t i; XImagePtr ximg, mask_img = NULL; png_struct *png_ptr = NULL; png_info *info_ptr = NULL, *end_info = NULL; @@ -5683,11 +5730,19 @@ fn_png_get_IHDR (png_ptr, info_ptr, &width, &height, &bit_depth, &color_type, &interlace_type, NULL, NULL); - if (!check_image_size (f, width, height)) + if (! (width <= INT_MAX && height <= INT_MAX + && check_image_size (f, width, height))) { image_error ("Invalid image size (see `max-image-size')", Qnil, Qnil); goto error; } + + /* Create the X image and pixmap now, so that the work below can be + omitted if the image is too large for X. */ + if (!x_create_x_image_and_pixmap (f, width, height, 0, &ximg, + &img->pixmap)) + goto error; + /* If image contains simply transparency data, we prefer to construct a clipping mask. */ if (fn_png_get_valid (png_ptr, info_ptr, PNG_INFO_tRNS)) @@ -5776,7 +5831,10 @@ row_bytes = fn_png_get_rowbytes (png_ptr, info_ptr); /* Allocate memory for the image. */ - pixels = (png_byte *) xmalloc (row_bytes * height * sizeof *pixels); + if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof *rows < height + || min (PTRDIFF_MAX, SIZE_MAX) / sizeof *pixels / height < row_bytes) + memory_full (SIZE_MAX); + pixels = (png_byte *) xmalloc (sizeof *pixels * row_bytes * height); rows = (png_byte **) xmalloc (height * sizeof *rows); for (i = 0; i < height; ++i) rows[i] = pixels + i * row_bytes; @@ -5790,11 +5848,6 @@ fp = NULL; } - /* Create the X image and pixmap. */ - if (!x_create_x_image_and_pixmap (f, width, height, 0, &ximg, - &img->pixmap)) - goto error; - /* Create an image and pixmap serving as mask if the PNG image contains an alpha channel. */ if (channels == 4 @@ -6192,7 +6245,7 @@ src = (struct jpeg_stdio_mgr *) cinfo->src; if (!src->finished) { - size_t bytes; + ptrdiff_t bytes; bytes = fread (src->buffer, 1, JPEG_STDIO_BUFFER_SIZE, src->file); if (bytes > 0) @@ -6602,34 +6655,33 @@ typedef struct { unsigned char *bytes; - size_t len; - int index; + ptrdiff_t len; + ptrdiff_t index; } tiff_memory_source; -static size_t +static tsize_t tiff_read_from_memory (thandle_t data, tdata_t buf, tsize_t size) { tiff_memory_source *src = (tiff_memory_source *) data; - if (size > src->len - src->index) - return (size_t) -1; + size = min (size, src->len - src->index); memcpy (buf, src->bytes + src->index, size); src->index += size; return size; } -static size_t +static tsize_t tiff_write_from_memory (thandle_t data, tdata_t buf, tsize_t size) { - return (size_t) -1; + return -1; } static toff_t tiff_seek_in_memory (thandle_t data, toff_t off, int whence) { tiff_memory_source *src = (tiff_memory_source *) data; - int idx; + ptrdiff_t idx; switch (whence) { @@ -6765,8 +6817,8 @@ memsrc.index = 0; tiff = fn_TIFFClientOpen ("memory_source", "r", (thandle_t)&memsrc, - (TIFFReadWriteProc) tiff_read_from_memory, - (TIFFReadWriteProc) tiff_write_from_memory, + tiff_read_from_memory, + tiff_write_from_memory, tiff_seek_in_memory, tiff_close_memory, tiff_size_of_memory, @@ -6805,7 +6857,16 @@ return 0; } - buf = (uint32 *) xmalloc (width * height * sizeof *buf); + /* Create the X image and pixmap. */ + if (! (height <= min (PTRDIFF_MAX, SIZE_MAX) / sizeof *buf / width + && x_create_x_image_and_pixmap (f, width, height, 0, + &ximg, &img->pixmap))) + { + fn_TIFFClose (tiff); + return 0; + } + + buf = (uint32 *) xmalloc (sizeof *buf * width * height); rc = fn_TIFFReadRGBAImage (tiff, width, height, buf, 0); @@ -6826,13 +6887,6 @@ return 0; } - /* Create the X image and pixmap. */ - if (!x_create_x_image_and_pixmap (f, width, height, 0, &ximg, &img->pixmap)) - { - xfree (buf); - return 0; - } - /* Initialize the color table. */ init_color_table (); @@ -7034,8 +7088,8 @@ typedef struct { unsigned char *bytes; - size_t len; - int index; + ptrdiff_t len; + ptrdiff_t index; } gif_memory_source; @@ -7668,7 +7722,8 @@ height = MagickGetImageHeight (image_wand); width = MagickGetImageWidth (image_wand); - if (! check_image_size (f, width, height)) + if (! (width <= INT_MAX && height <= INT_MAX + && check_image_size (f, width, height))) { image_error ("Invalid image size (see `max-image-size')", Qnil, Qnil); goto imagemagick_error; @@ -7872,7 +7927,7 @@ size_t numf = 0; ExceptionInfo ex; char **imtypes = GetMagickList ("*", &numf, &ex); - int i; + size_t i; Lisp_Object Qimagemagicktype; for (i = 0; i < numf; i++) { @@ -8426,12 +8481,15 @@ /* Create the pixmap. */ xassert (img->pixmap == NO_PIXMAP); - /* Only W32 version did BLOCK_INPUT here. ++kfs */ - BLOCK_INPUT; - img->pixmap = XCreatePixmap (FRAME_X_DISPLAY (f), FRAME_X_WINDOW (f), - img->width, img->height, - DefaultDepthOfScreen (FRAME_X_SCREEN (f))); - UNBLOCK_INPUT; + if (x_check_image_size (0, img->width, img->height)) + { + /* Only W32 version did BLOCK_INPUT here. ++kfs */ + BLOCK_INPUT; + img->pixmap = XCreatePixmap (FRAME_X_DISPLAY (f), FRAME_X_WINDOW (f), + img->width, img->height, + DefaultDepthOfScreen (FRAME_X_SCREEN (f))); + UNBLOCK_INPUT; + } if (!img->pixmap) { === modified file 'src/keyboard.c' --- src/keyboard.c 2011-07-02 23:40:04 +0000 +++ src/keyboard.c 2011-07-07 17:55:38 +0000 @@ -210,8 +210,8 @@ /* Last size recorded for a current buffer which is not a minibuffer. */ static EMACS_INT last_non_minibuf_size; -/* Total number of times read_char has returned, modulo SIZE_MAX + 1. */ -size_t num_input_events; +/* Total number of times read_char has returned, modulo UINTMAX_MAX + 1. */ +uintmax_t num_input_events; /* Value of num_nonmacro_input_events as of last auto save. */ === modified file 'src/keyboard.h' --- src/keyboard.h 2011-06-23 06:31:41 +0000 +++ src/keyboard.h 2011-07-07 17:55:38 +0000 @@ -191,8 +191,8 @@ /* A list of all kboard objects, linked through next_kboard. */ extern KBOARD *all_kboards; -/* Total number of times read_char has returned, modulo SIZE_MAX + 1. */ -extern size_t num_input_events; +/* Total number of times read_char has returned, modulo UINTMAX_MAX + 1. */ +extern uintmax_t num_input_events; /* Nonzero means polling for input is temporarily suppressed. */ extern int poll_suppress_count; === modified file 'src/lisp.h' --- src/lisp.h 2011-07-14 07:27:40 +0000 +++ src/lisp.h 2011-07-14 07:50:51 +0000 @@ -61,6 +61,23 @@ # define EMACS_UINT unsigned EMACS_INT #endif +/* printmax_t and uprintmax_t are types for printing large integers. + These are the widest integers that are supported for printing. + pMd etc. are conversions for printing them. + On C99 hosts, there's no problem, as even the widest integers work. + Fall back on EMACS_INT on pre-C99 hosts. */ +#ifdef PRIdMAX +typedef intmax_t printmax_t; +typedef uintmax_t uprintmax_t; +# define pMd PRIdMAX +# define pMu PRIuMAX +#else +typedef EMACS_INT printmax_t; +typedef EMACS_UINT uprintmax_t; +# define pMd pI"d" +# define pMu pI"u" +#endif + /* Use pD to format ptrdiff_t values, which suffice for indexes into buffers and strings. Emacs never allocates objects larger than PTRDIFF_MAX bytes, as they cause problems with pointer subtraction. @@ -833,7 +850,7 @@ . */ struct vectorlike_header { - EMACS_UINT size; + EMACS_INT size; /* Pointer to the next vector-like object. It is generally a buffer or a Lisp_Vector alias, so for convenience it is a union instead of a @@ -1028,7 +1045,7 @@ struct Lisp_Subr { - EMACS_UINT size; + EMACS_INT size; union { Lisp_Object (*a0) (void); Lisp_Object (*a1) (Lisp_Object); @@ -2540,6 +2557,7 @@ extern Lisp_Object Qcursor_in_echo_area; extern Lisp_Object Qstring_lessp; extern Lisp_Object QCsize, QCtest, QCweakness, Qequal, Qeq, Qeql; +EMACS_UINT hash_string (char const *, ptrdiff_t); EMACS_UINT sxhash (Lisp_Object, int); Lisp_Object make_hash_table (Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, Lisp_Object, @@ -2868,7 +2886,8 @@ extern void syms_of_print (void); /* Defined in doprnt.c */ -extern size_t doprnt (char *, size_t, const char *, const char *, va_list); +extern ptrdiff_t doprnt (char *, ptrdiff_t, const char *, const char *, + va_list); /* Defined in lread.c. */ extern Lisp_Object Qvariable_documentation, Qstandard_input; === modified file 'src/lread.c' --- src/lread.c 2011-07-10 08:20:10 +0000 +++ src/lread.c 2011-07-11 06:05:57 +0000 @@ -3647,8 +3647,6 @@ static size_t oblookup_last_bucket_number; -static size_t hash_string (const char *ptr, size_t len); - /* Get an error if OBARRAY is not an obarray. If it is one, return it. */ @@ -3891,23 +3889,6 @@ XSETINT (tem, hash); return tem; } - -static size_t -hash_string (const char *ptr, size_t len) -{ - register const char *p = ptr; - register const char *end = p + len; - register unsigned char c; - register size_t hash = 0; - - while (p != end) - { - c = *p++; - if (c >= 0140) c -= 40; - hash = (hash << 3) + (hash >> (CHAR_BIT * sizeof hash - 4)) + c; - } - return hash; -} void map_obarray (Lisp_Object obarray, void (*fn) (Lisp_Object, Lisp_Object), Lisp_Object arg) === modified file 'src/xdisp.c' --- src/xdisp.c 2011-07-12 03:04:06 +0000 +++ src/xdisp.c 2011-07-12 17:38:05 +0000 @@ -8067,7 +8067,7 @@ if (nlflag) { EMACS_INT this_bol, this_bol_byte, prev_bol, prev_bol_byte; - intmax_t dups; + printmax_t dups; insert_1 ("\n", 1, 1, 0, 0); scan_newline (Z, Z_BYTE, BEG, BEG_BYTE, -2, 0); @@ -8091,12 +8091,12 @@ if (dups > 1) { char dupstr[sizeof " [ times]" - + INT_STRLEN_BOUND (intmax_t)]; + + INT_STRLEN_BOUND (printmax_t)]; int duplen; /* If you change this format, don't forget to also change message_log_check_duplicate. */ - sprintf (dupstr, " [%"PRIdMAX" times]", dups); + sprintf (dupstr, " [%"pMd" times]", dups); duplen = strlen (dupstr); TEMP_SET_PT_BOTH (Z - 1, Z_BYTE - 1); insert_1 (dupstr, duplen, 1, 0, 1); @@ -8489,7 +8489,7 @@ { if (m) { - size_t len; + ptrdiff_t len; len = doprnt (FRAME_MESSAGE_BUF (f), FRAME_MESSAGE_BUF_SIZE (f), m, (char *)0, ap); === modified file 'src/xfaces.c' --- src/xfaces.c 2011-07-10 08:20:10 +0000 +++ src/xfaces.c 2011-07-12 17:34:59 +0000 @@ -940,11 +940,13 @@ } } - if (NATNUMP (width) && NATNUMP (height) && STRINGP (data)) + if (STRINGP (data) + && INTEGERP (width) && 0 < XINT (width) + && INTEGERP (height) && 0 < XINT (height)) { - int bytes_per_row = ((XFASTINT (width) + BITS_PER_CHAR - 1) - / BITS_PER_CHAR); - if (SBYTES (data) >= bytes_per_row * XINT (height)) + EMACS_INT bytes_per_row = ((XINT (width) + BITS_PER_CHAR - 1) + / BITS_PER_CHAR); + if (XINT (height) <= SBYTES (data) / bytes_per_row) pixmap_p = 1; } } === modified file 'src/xselect.c' --- src/xselect.c 2011-07-13 01:48:43 +0000 +++ src/xselect.c 2011-07-13 03:45:56 +0000 @@ -2381,7 +2381,7 @@ { Atom x_atom; struct frame *f = check_x_frame (frame); - size_t i; + ptrdiff_t i; struct x_display_info *dpyinfo = FRAME_X_DISPLAY_INFO (f); @@ -2402,6 +2402,9 @@ if (dpyinfo->x_dnd_atoms_length == dpyinfo->x_dnd_atoms_size) { + if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof *dpyinfo->x_dnd_atoms / 2 + < dpyinfo->x_dnd_atoms_size) + memory_full (SIZE_MAX); dpyinfo->x_dnd_atoms_size *= 2; dpyinfo->x_dnd_atoms = xrealloc (dpyinfo->x_dnd_atoms, sizeof (*dpyinfo->x_dnd_atoms) @@ -2424,7 +2427,7 @@ int x, y; unsigned char *data = (unsigned char *) event->data.b; int idata[5]; - size_t i; + ptrdiff_t i; for (i = 0; i < dpyinfo->x_dnd_atoms_length; ++i) if (dpyinfo->x_dnd_atoms[i] == event->message_type) break; === modified file 'src/xterm.h' --- src/xterm.h 2011-06-22 06:16:16 +0000 +++ src/xterm.h 2011-07-07 02:24:56 +0000 @@ -326,8 +326,8 @@ /* Atoms that are drag and drop atoms */ Atom *x_dnd_atoms; - size_t x_dnd_atoms_size; - size_t x_dnd_atoms_length; + ptrdiff_t x_dnd_atoms_size; + ptrdiff_t x_dnd_atoms_length; /* Extended window manager hints, Atoms supported by the window manager and atoms for settig the window type. */ # Begin bundle IyBCYXphYXIgcmV2aXNpb24gYnVuZGxlIHY0CiMKQlpoOTFBWSZTWWciZ1wAiRTfgHgwf//////v //7////+YI5+9Q7vXHu1S7We41JSQHMpB9DAHWwDyHQAAceOxp7ZX3brkxHM1tkrr498Mdy88oMP RjsBfIVLPPsbz3e2fPsu4PPoAUrtipU+tvnxXz5fTX26He50IFA2xe23wduZ9ABpQADnhg50WGtB 6A6OeHu9ABXkqjVvD3vfHzumqAK0e74e8AABQO4bkCq6BoD3eDe8AAAD28LgAAUF4U9631AR7M0f RpUp7cu9tvHdPZoXm9V4Ai08cqB24AabXS0bcAbG2d6oLbbxXk87kLVXvdHp3c4hsN7yecVWs3Bc R22Kqd3eoBQjwL2a92I4yiSuuudjoDolyMIUBxZs0NGRsNC2ZVU02EW0qS67y87e7VSnbbOvffZU +PSJaylVUaVptpmzZCUICAAQAmIBMk09Ro0mVNjJlPTSnqaeUeyUAGEoEACERITBNNTaRNGRpoAA AAANAANMgCokJkyU9qI9TRtRoNDQAaNPUPUAA0ANAEmkkIJDQmBTMlPTKeaaaR6Keo0wEeoaaGJo 0wmhtIIkiECekwgI0MKegAhMDSE9U2AmhPUegmgzUCpJACZBAmmgIaaBommio9lR+mo9UPUPU0e1 Jp6gBkXQ6clI/uCkWxASBBRIimhH1RCiLBT1oWMU+FUoirEUYsQiSAQkSBBgJ/WCA02K/GKraCnm PI9U9BaDlMjxq4D/pT4HB0cenlOE5fx+rkfydbH6unxa+Pe5fkT6zj83yTogjA6b4YiCkiwUA+XW vDoHp7M0+vahp9x5WOZe9xkNME27ucas0fMi5kRtOrMYwFYP6fb5Tyfw/a/7+G/w2nHUR/N/3nCL Qk3/snXNBklrQgoh/+URlEPtdaNCaPaCAz2/upiqG3Zjs3O1tB7brPsiz4PZt8iiNEUoZZxEXLiz sLMndrA9PhyDi2ipiFIoPVVom5s5XOJKSjKZGiQ6ih7UOjDeIXiAX7VT4OTR3GGrW02QFg3b0+TR t7nkw5PVPdYWAPRNIUeick0zh+3sa1o344Ds32wkUIoBFjbAptldXJy37dY6SW06IV8D2D1Z6Hhn PizraslqKdckL3o27cMb5sDVLHV1dPV0vRx6J01sTVOViAw+znx2yPDrz5fz815lZWQ75Bm5WWf+ REmwU/CNXLu8+9+3DdrU6PU+y87/LfuXbPhL1/eWrz7O/B8/ic+vz+pHlKQdgL1/SF7AeOn/oHM9 8+v11ZxL8QNeCv3C/YvW9V7a9Ovzaf5VZxx3vc8PfN3K5TQ9P6OWUv7PIuC2xpmsuQ/Xls+VcygR hUzMOMw066qrcQmM0xBGPliN+n6PtflP9IaB4H6Tu0YgJRAp86TlA3+XRr4+e7ztEHlY3tMrmDYg dLHq4FHIrnse2cM5U02Q/H1SpTndtwfP3+7blWuSNfpo8coFe5PIlx7Pjak9VdKkGGcsSxLEtiDg F4VlV1Lna3OJKnnmanIqEVCR6/NAGZznqV2Oss9c3pskRorUrUJUFgVk9iVtGgx2wTknh9705o14 vFpdT026eSSEM7KEtoFGGBEsoImMH8RT1zFDG2ujalTUmpulLLCxaUOXRiLQy7FHC8vQW3UQHenV 09agqV6tczb0I2M2MhOErEYsTnFOrBMOIhGinOhVIlxBeibd5wxlLCdzQXdTWZ616vUPRB5RJgmq ojawvow0dvnrsEkDqzvJ297dztztiGl4Dt6YndS6MV7IFmSNclMGzPY8lohWQaZOGTkybjAN7eby TTpkN0XpvTZlTdMoUHa4wIosDm4mJJzceTbTmgkgJLiKIaiGFFhhgwTGvgpMbTcCwogaWGAgSQOd PCx8cNqqiIbTBHGC2FsNQ6aobMiy7uyZJwlHo8OJONXhA55QGqQRxnJfEBwlac5gb0Q15ETVMOdE jLC1jfLZroaBERGixgN712wv8dBmADfY+z9HyCB8Xl7PL3ex7/ebNmisrAqumCrDGadIC6ZieDUM mWkLMHEdjWGCTt2wUkHmv0/8992fLr+A7k5KrnLyKifD3jvCyoK+W0BVKVYUYxioI1Qpudy8mzO1 aq39zMhLYOkPzp9NMw0OSCSQXkAbXQKkMKw5B3TYydmXgPMEQQsRGY6h7TiBT4pMVqSw6KCDjb4B mfaJicUZrujCcvSHajE1aBEjFsQRsm4N7dSsJKekOa3GTKHIpB+u52X4rjgGxVw0UC74k5Bha/pV iyA20uIggObrpQCIznUt66a3E1BL6mrUeoOalI2laRTJc2k4HqWKy5XULPktHthxx4XjbHhNO36x EEQT4/IxEYVUj96yiLKwrCLDLVigipFIsFFkFIsiklZNDRmMltXCozdgf6qIQFekKkEHAERzxnKq C79nLbvTsOUOzbf3rqmjn9s6wrFB7nfvdUE/FNYQUERYiGJBRSopAWChFlqyh4vy/z98N6p9Yw3/ 1aC46v+aPL7YD60mWncM1SGHxPz9noqoIeBb6HiKKqqiqKyB4hO4+fuT81IH84CbsKpz20vP9DVW thOAAx8hI7nfN/EVi6VTEipNp/VHGo2UEfuvY+zFsNbWMzZMZJPAyd+v2/5xkqqX5fqf+P/Jt/xd jnlzU3hWWB3H9MqylIHlFiSa2EGTzUcpmatkT7v7R3vP0P8lNHj7fB5ONZJoqYqTJKaZa0tTCU8m TdS/x3lWwUp17F2RPC4Pf8Tcl2S3JD8BoSpSeTJBaWVEoVP+Co5byJF80ZWvd/DzhAUfBwzn1/yX KB6DjhZkDhls6tRPwAd53E5+Zdfb50bHfk52P5uPpjSRqcKXGuwgNFMOJhfoWG6uxwOcyJWZJogi Aa+YAifyE9yq1gpKkRgFQKkKwrFgpK1krIsiwWiVBkAVVUFFFFkWKsGpYKIwkoUo222oLFlZVZFB WQGEFERWIsWKsUFgsRIoioqhFgSCgKAoRURVUUEYMRQRFkWIwUBEFVRQVRVgKCgosFgoCwVSKCyM YIgsEVjbURiioxie07s92HhKJ/aUM+yH0oSST8P5B9X8Jfz6fg/NqL+oPZD/UDc1OXdTuUDYlbar eDNZ9rwEh1CTqkpKIKjIqhEIpEIgqAqqJcbbj7TBhlZvYcVJO6260wxxL/dLJ0aJQyQ/KuQNmBMD rACMKUUBBR0izeLfAkZGMxk0cPahxLG2ZBEwcLtTIIw3BxmHOrcJFGiq4PCTLF2BAi+oXSGi0daG IEuiE8vz9EIiJQyEQ9uLihMQQCeTuDKYOgE2MYtCTRFGjJiEYYsNYO5BL5auZHQmtKDOBGWEBxlF RJn4jtenN7MxpRAL6vHR4UChRQMkbWxfEU545mzC0p7rYAhQNiS5ElOmUY9apLSRCu40jMvBAffQ c8VtCcVHVEArexu+tUGZYyzM2qCbswhU0xNQuCoDKHcHyf5B3N66tWyssPk1yQ5Wa6369CvMQIKL lFzZC5OQSjXJsntga9F4vHktJi97pDkVWvbxHXzC+MpMmLaYmM2JbCgTUu927LAhhF0th6iCJg25 LOeLuiaSwOn26tma73Q70dGc9L1EP1B5h91gg11TlvTqm6bOBMo6lkMaQ1cJuAlISAmBREnCzYSR dhMbtEPB7VJotKCpws8c4w/eBsEOCDAd7PHDJAmAlAIWkObhI2XIIHMkPATWAQHQ19YhooEXUO62 oLiNTA1L4KDuUgILWWmZuMMlSyQdxIxTJd01B32JtCFRfTEBWbhUDpwsINFOVdoE6YxSdxXiEnJQ OS411pGFGCMwKSJNKkHa6CDbM5FAxKgiCxlDYRPhhei4wGpyHai1RozRuSLcbdVcsHOkTKFSiCJP PMQFKDniL6uhHI0zQucw5Zom0II0sSIV7A00d/WHhh4eN1ObPtM1CS7zPgOmGEEs8O8Rcb5qbmcJ mHsPTqiJOESd2nwq3fYpXc1LuIpWsovAycqCQKoKSzaSfDdowAXafRF4CVBq+q+zVGA4rqKJLI0Q 3vFTlvhrOQJsq01njRR44cdSWm5eiwovOgrwGzHGSDFxCdvjI8CKLVC8F58PRD1UQyOSnhCTzGY8 VWgCpJJYtBaSBRYmg71WVJaCkJ0V7+AiyO41xkZ5q78UEYLK/EkSiSJDQGN57t7heW/qrvAXAW3r Fwp1ZhUmggoIjw9/wP4VMvWHWxJuLCp7mop43g0orKomN4EB46J5eroWE3OZTAYmPg6GJP9S88jM QVE/69vj42OdohyjZx/H7HJyUpypZSzWxcpCsfP5tZ+GC+/on0glbT8ZjTVbJo2tJgeztxq+9sc8 j+bvyrkPOo4nOKYWSW811347mq5/VU3epZE0z6duR/PgzW8IcB0K0IcgQ54E8yL0zRurvoej0EcP KiUr3gRUE1tRO1k/itFXyUtFN5YbZRFtqgSQifEcf9H2fTdrXp9nD06Xm0pIJxN5AZ48e81m8eRF NxAYxFKHaDRHFJ/CXuc0EEgPTGuKRQ1Uxl+ThficlP8qcKzqt3fk9rVZioYli1DAOwEO6JGJdUTq KaR2ITQOx3Fw25eTkYXToiOdfTbAghjzYsLm/YqCoflrPJy9jNO/xaa/Y5kjsxP9Gu5obNkxj63V bKLBJSREMDMx4SRyifgL/Mvns9S33uzo3ebC002WOSz1GRzGkp1eLTR6p52pRXSVDH6FCiiiMoZU eeu55RxJlQPKq1VT4bpS7SYUqcPgOhQ4gnkVJYXiiimJf+eyZvLCOUuvm8/o71zkx6RuuXMrzo0e 5ikgzMPxztZmiwQFNx9RecXqlYrKjRwqGCDqVXAiQUhAYonQHqyZGDswMLDi5V5zAr4d4LohryHS TiKifafHQcIGFfgnSOGxhVc4aJX+4/Qd3yOQFCVAYzefYgpDsYr4p3IThGDkUVDEsfNSgPBZSsaF UcnfJHDwPX2cvU9reXc05LnhZO1bAtZaiWqi0MyTr5jGw5DduE0cUEPwpHkMxfVVxc3bG5potLGR NUjtKImJ9RQdly4YwPRbkkfoooiX9DgXP94ZOPrWxHiQufCFyZmJQbRR+4gnErZK6igyXzVKCwqI KOKSAzjFoGdghvFFiPMS0IHc8tPwIi817yBVO+wsSBcpYZYQldRgTqolOSuVXEzdX+yvyvW+2u9w 2/uxa4Ojt6eLN88GWuj9IkFp1q5V7N1camD0XsVN9vqqqxUeO0spWKqWS1Bhk09/3H5a503+bdQj 1dfEYehfZIKyig5SDPgVlZHmq+cCRWZxYcenW4dUlxIYBgHJNuj3OVzmhMicBSVIYRJ/Xdkr96o0 glc8cKKUcEEQDeOKx9FZIekAUVRuMKUFdBKOSZPtqh81/Ip6lu/6XFTRmb6ZBJkDIKsDgyDTBkhI D0KBTJAo58lhwuU9TBuvdJnMIwL11ZLmqlTyX4t2uTtCIwc9p8cc217GencwXOyLVWK0S0wXI0ws 20JcpKwibyksI0UKa1gayiIYVkcyApmOcRHqM1FmOm3faclR0vV+XfFrJT1ux0dE8nOZJW7Q88Ok z1JPDNsQzsJ9hCQjoniqpNUHRK/rNx5mOUjDLAcZG8QRALhNopaMnUeM4XbIcdZSr53u9tUucN59 TNqqMtMNdW7GamLdSmjLkoYLN8tar0WdVHRv+qm7VmwXGL+LkOAkg8JKozbnmtEqMSRrJZPweaCQ ogMIxkKKlg1B5u13WF1ZAUnwYiazsICoFpX8UvoT9jB3L2h/bo0eSzt/Fo6tZ5dqrsXeOLYYS03W YPHBWMMPFMwPxNXeUHdevfJEnWbt3EWxgpGRc2OIHcXKNxubHK/fsf2mkPshtLmRCh3jr8XzFHhB RSANUmyhuRP/KDlFUV9Xpi35fy/L8Tt9vycKj9+ybeUTUpUIdCf18Re4hynKq5GO8R9eRdisyBRo xc7Gn+0rIJfhUI2CQs4cpTrJt9iHmZjNRVyRRslQrFj1+qmDWCAzEc1CguSKokIyYRSg6OmMUhKT SUISgSZMsTFDlA4nEnBns98VVEV+VLQqtQq+ZfWFcqWlkWsbVRK1tsUVa1BGQURVRGKsWCl6h8yC iPdSqlSckUIGIKAskVQiJiUSkM5BIHAMyrP8ef6/u/kyIMV7fw39yiZR5fL+Ae/qrws3xvL7ue6/ zvQec8+SiOv4RT/J03lJd+xOs46q3q/e+R59VrykfwvJ4c80TH7idd76kzWfmB5J9Z9/lR8L976X ZQ6FO0xt3VCvrdL63dzajei6BKVfAoIjUFcHkzObXsX/BWlrf47zFHqVUzeF5q92yQ1jjyZ8yKYL zxtna8ykF6GVncsXzmhZm4tC7amxpSpH8H7ERuYvi4VOSfBqf0hMERETwJ7evPhwsvx7Zbl1deyf bx7u3s7u7R5e/w49fWonrCK1FRfv+61lVWEVX94kQALQbMBP6CBX5ffT/zPl98w1x2lGB/j6er+2 HE9X9nCLIMD931WoV/e16HrKX589rH5dei/JXMuazM0ZmazM94DdA5fQkOiCMFBGGEQNWWJqn8IY kPSi9hoAM4IfefnUk81LVVVoFSTzJCi5SYmYqrmEzFslqoKqtKyB+L8/6/3/x/Ft/hT9NvLqqTp1 VaSW2ELVpLbC2ltgW22lthC1aBatkLVVbJCsBtktstVVWyBiAZllqrbVVVtqqq/h7/ue301vB1gq cPx+LK6U/s/pF9XMrkcCC8Ox0Shk+mlidYyjS/R/8lO9zW2tagfv9Kgyyt+qd2Uo/uqhX+TOjqF+ 7z9HTdiOq5v2l3BWQLOorGRcCZmEBUXn4xPezxpzpeqi7GZR8FwcZRXH9zyajnsLJzSjmccdpXy1 01iqo6WEIQzCCb7xuVAJIe7mbBFNcD1hwIHgUPwCBAwcRHjj/BIoMj7igsJh9x95RiWGh1JFpYkv F5aHEsP6R+jEkSOZaVFZExMysiUHkfeTDf98fhz1a1WyrgvC9iA+H+Gb9fmZLX1Z55e1c265Thm7 m/rPVdshJdUUZuQ4d9ddmB+SHyMg/R+NVVn0pVarUVaiqqqXIWqquK1lVU0NdRGGUo4rpW5D7gMP pZA+cEh+NJ5GQW9NPQRX5xvAqCfYf6HZZtAjz9Hy38e/r7Maz3Qia+VsaW2tIkzFItX0CQo7qKnV UvOCKhK9LqQE7Cp007Emzybq+p7w/Y4zhKgxbPUqIYL1Li0mUU6ImrV4uPOCirsJy1FCGoYZw/ZE jWbaZz+nR4yh8U8dlKIs+yg1wQ0GVrrbtDYU6tpeHvBFNghAUUDcXFNV5kjyYiEORjnoDQIpvFa0 sIlae/ajzeKCkzsThaq1ERS34rAqHpsoJMbkTFBR0RK3FZBFkRDUUDF7IPVYG7MSo2noaFJeQLu0 QTRQ7Pq/gj9wHoRI/fZR/kH3qt2KAxgQIKTO+eKA8yk70iKTwKRcoRRKRHmUSyklySix6hYzmNUq VUPEUMlKjxLUCASI2gqNo2YAliERpoQaLNIPMXoAbpBWXKBos0oodqjAR+hEgG5oHk5S4u5GAfyU IPiYoxxR4g3EP3wGUFtOF0eIcnpg6qHw7r/Tswj7nfNJ0nVOUTNbmvXxJi7O7qdOFzDRuggXVmQ6 LYJY4YGVkcukFm4F9ms0PVoTfxCYc9kOOI5YHLJ1bxLZZEzidXmSW3IhPJyu4Qnb/TTpeRfjihZJ eqQNjvSkDuBdVuBwDx2lHaZ55ib/MwUCQYBhgAlj+Eu1XPZz97ONrXQemyTR818Vcp4Nv2VE3koN P7ocn08vZ9BhLqz1lZRY5zMqt9tD/OMMZrAzhWfBjwiC00+XwqIKsfRF+3KuwV7T5LX8qEvTs5Hk +4nftv04+Uk8LD8JajFn1lyPgvXgtxXrWek93+fl7Hy0sCqvQx1DQZVSg73bfp7U99dWTSypIg7m zdXLCJcVRValeCi9opFye8UycWTtROMT9tDwPDdb06d3a47SC9zpqK6b9dBJX0eJaHkawY5G06G0 7jibBSRvPQcOBXOUc5nK0IU+Ume+Dlkzq+lj6/Pb6Kj6QrUmfKqh49PGVPlXN96Rcx1w/Y4T44sl 6WTdoWbqTFcmZLkzTJMFxyTQ2G5Y0GJoi9yGBmvNyy7LWmFVeovhhqta1tRox1GR6DSWDwkjF86Z iCicrW1gfYZF5AUTwMa5edqutagJpOhkhETyHEQiMCTHCc6BIayDuPVR69CCZIRPhAsm0EYYgwht M3YwuIKJoXc+1Q9Af7QA+f6PtsfJlc5wjhV+wcgiAYFS12fRZu17Hv79Rv/ft8edr/6222UV8V7e tF52U49fGjn/XVr000ttqlKCyk6L2V73SlKL5Ngw6Oq9d+77fgLbAtoW2ELbC2y2ltLaW0LaS2lt LaFtLbJbZJbS2ltLUEkAkgkgEkEkEkwSQZhF553YkPMe775KD785Y46G2iyyypaK3Ku9m8BmVZtB 24e+iEJPc7VClX7X6b4r7vMPQVPS3o98GQesNXr0kukycpLBzkWMJyfExNFxCgzjuzODZAiYVWlG ZoZgzMZmIZAwgloplBkTRBvG0UqKuiCaIJuhjKkmJCTQybsJwySsgcxAKhJp2aJA9G+umgN0U5sO TCbMnDDhFhpkDSAaRQhuwmzCsmMA5IsnPayGyEMZWTGSbobpsgCmyLNJCpw1IaTdkx3ZMQu06G13 vLkTbAk9fk6+/aVPqp9MY/ko2zCh/aUVOzKZWjM7OISecoVig6CzH6JOd0mf1f0tYgojObLV/YRO +BAlAQlrEi+Wx9cuiYZTCEhOTkvbJodFjZ4M5Eu4KkQpeTiUsm3EFicxyBEEEQiaTVBM38eXw/xS nxXZfOTIiAYzcGGQvZGJCsr1YwPqBhRwcRyCZV+Q9CEXENCjxKJLJbZHUqghQUVQCdRSp/HScDKi FhMkOUJyfhpFrBB4YCWyxsoSMB0Ugg+7FV5Ya7K2VWqCXkYCp7SdS0ur8cbTFDxffuEdBNBRhAqQ luy5P2VmMKUIJEFZVE/LT9L49osp0iCZagCdyJlCWIVJpVR9SnB2C+BgtIuCCAj7J5LBYrHJVBmK /0uBaiKUTYOcDZRBMcCZ2gCmL2KClFld2MOjws1OjRCCMIFERBHNtOoTFeYr0LTDFlisyQWi90to TG1rOdrS/OBARhybPObyOdggmYGMANZenZLKqonEV3bp2q/Tp08kQSWpIgJBkZ5sy4owTBFWSpUh Q6Ka5rpqYdWLIi+2drc165oiYSLk/fuZVIXwpHBylKBMJHKnSZLaZVy9IZ5OSJha3JCGKNlFKYro CnAgC3YlEBtUBM6QRe0ykRMMNVhMbExR3UATsrQpUewQLd/30Acgc6K0EuQkkHtfU3xLTOPBTS5V CUkQFW4goxWCQURJvMauwUlUcM0HPCx+n582YBlFzwvqS4aVtbcYtFiqRFzCywkJ26oPBfy0Nlni CL4OiYMYmTT8rDjkiY5+rno1GSSkw2VPnprd5NWzTe5q84PKQ5wSaVCFSEFSKjtCT2SP87NnT79/ A7du8vN2emTp1YMrvJ0QQGjwtg7FJHtSxzmCAgFCp7OApo05OdLZYtDjNZoxZtEyPLwicyYuuSzF swpVOuoCgokihjo7CZcc68HKnQYbXkH7qUHKkjNVUINipK7mz2EN4jNUqVLFSD+jI9FBWKRwMrbn Ck8tDKy8rRA+hQMARNCK0ZPoivryWgiwVNnZI4NArhzARwI8CxVCR98BOkTR7LgnwPwPXfInrkjx ieMT3BNk15FGM0ROPgwIyCFApbLWl6mqJdrNqqzDldOeylAM0lmEEMAGHU/SrkZPAvNb8I4MBgM2 gzlhZD4mxxjEWUGRZgyuxNCiBFoDgqepwzp0vSIkDmlCc4gTblvxoIHFu4yYwXOTTLBsl5WbPRNI Ud7kON9sRHamcb7EhWFVDlsWGknNCXLOhhnHQ1tNDo9MxmoAbJ0y+raeTbjiwuNuPtkf1eAvIvXj pro67MG07hvMJ1DBgsURVjJIMGQRjCECG8t1dXL5LZqf2NKJqdEAG5WbRaaISJgsduOeFoZ3wvhh Yl55gXTe1CXb/zRJU9s6IyIK34Vj1EhhksQWf6pAwaTQqVTAx3IhEEdMOchObgNkkEYp4qUHSgze Gr+0upHJUaI7YOUkmN2SG6rqgiTdtKzaS1ShnU9Qk171+nvdXcc2yni38HtJO2UHadGBvsa5nvbb ZpKqYZGCgPIiWWPB3lLQgxUUTTcmIIg3Fdltljm1nJy5Tl5ueer6M9gggJgdCUKb2G/pfVURLCdY MJAYUlMJsi7bhk4GzmMR3ZYiObgbDvy2Y7805uIL0giaWxyHSJF95cEZGhIzEjcTzYIChWtS6khQ 4sSBPijnc7e2QYREMsHqjXCg1BaPe6CObM9WFZNzRhJMskMjuNWRmvXrcsyTwiOiNM6OjSkvB/Ot dvvbQsdetel34tPUthkf01aPXK53TK+bcnnWJyisbvyeeLXl7ZzfJQsrPbeZ7elIpWL8dWbird8E Nay1zSfIrDSpa+ny258bRzS4rSVFlKtaw7xhc8q09SmSxa8PQgsIiVKYJkGOBiIO7dyzOA6LY4OM d98i9Vd5dK74q6dXO2N8g5CYIT3MWGBEKd42mdAhAl1sMwSDVxkWqtY7sM5emG/eWmbXG5UYolrq 6KbFYQRnalZTqyLmY6HZu7zSdnAoY7GO8OrigzN6R6gqShfOnFWkuzpO5MAOqoQtziCaHjvN+UxO S+VvhEsvMKnVVqm6oN6dngsaklKJK3c2cuFaza5KiKR0XL13eRXeuw6s7GzTK1YRpL2DHjZ+hJ5E nvwO3Lq08HJRbB79/Dp3UmIzqTY3oi9WK0EmJ259QbKW+o9F7WUbooiITzBn38OnyALYRGBk2sys 3NXd7ioUKIwNdOx++7i/QR0QTtURdYqcBTaYdNGUko6zi1BqLicKKmEelliXBDVXqmA5epa9E4K3 sYlSpvKx6qNS4idWdLi2jJjayX0lIhVBlZVXXYvoO5mLp9byFD6hRezGDpWUwwj96Vci5oYWDnRo qWKc8c5ZpibYJhdlQlqQ62mBfEqcN67i+EnIZAJ1Fs55fLEl9sqHR9SCL2iWYwl4MeGA+PmoMHTB 5vpQXGQa6np9q71D66pJZ+rdEuhwsTsqXJWWgIyoJbFDp2lYgihFa2obKITWicKGQhCRIjJqDgv4 vEFSZip2Do7G5yujnU2S1R6MvwCCAmq1WYjoiA0Y9g4d2n+hCGmQZVOG3QlEiBfTnzIRGUWUqg7A qcEF3J5NYg9aXXiOeamzefiChwnNik2GMN7zvMmc5Zsn08Lr4kwUSazrU0iQbd+ZWYqexFrBYkY2 fYT4IqXJjeQXufOD5HD2KGyfoiam91Iiljo+LnMDjnYpoqfSUJg7GHMOY6NhYPNF4scJFuETUx4J QkQQYMIDEzaOim2bRybsHDS40L7N1mpu9Opg1RHVlMEU+awYuKy8veMUHKA4UL8MLaVdM76veCFQ +Ds2WLg/NwQWJh2OKZHmXHJVKVv6vVZ0NnvSDwnd1n47fm30r8ZJ3RMhMyfPWfn8gCKlIJSHMQ17 Nz9rlRVg9s3u5DCq52xG7I0URWgNBYM5ZENAvfi/dcxBtutDITXy1xtzgjQr5kFBg9ywoRQoQCKI VkEEgsxtOxOJrIFEURLH7j7sDw5dwIotvhlc3ASK2XbHftfxm12jVsTedeOrzceAg87mvmU+aIQe dd8L9pexjPma6glotdGRa24nmscMCkycz7Szxxp4ELoIZBMoJQfI6pAqMDDJGtuqqqyBgeRi+Y6h d7iQrqOMCNICICTqREzaVU3R+sRjASM8Oms+xxoaY4VnSsLcWw4XTIiE9Dd2uMCZ4dcrsHUusupU tSyFpIE8TwwWMH0BPkAS08MtlDIrRx5INW+4lNvtdwTq7BI9dK+bwzqsl6kx9ABLFyCv2D3Ia0dO tEtDmvWxU47m7HHmxzqrBqDlgiUMAuymYQbsk3nyWkOKFfkO6hid6OmUFk6hte2QSdA2xvu+C93m TugjgyiwEOKjrIRhYRurjbTJViyCTRE1Wl6oJg8HL1XQeMtEEfdPBjQ45wxQgl+Ej88B0u2ZgVSr KMnZnRDKaJB1UOlPPPkJHckpLzcLCKqQnRI0iBWJZc7Vw35OAgmF2RcR3yJCGpOvqBXeS2O7eyon YxUSwi7rUVH7KGTQ5I2YCxL0XHFUg8P1BnvrVYUUVmWaXQSSCLPgk7DCMdp0OkQrIo3NVtIuDJaj KQEyhEYREFzXhkmUBE9rtzCqKCpcr77qQZmQFxqmksFf4ATF71oyFLsWRDYiqgpKJfEVVm7VBHEB 7/p6Jqnq0unKkkzN2C527rEtxZlKUtTfnmkBxzA2Pnwz3hLCo3ZwsKKVLGixIoaM+4CYTLOr1WlO SbDoJKktVNB0FZeDboEwooS8I6M+HC5iaL3JieDVrdwoYubuPIvW6ki5Mg0dHC1PDNH151vSSRdO wiMpyGoqqCqVWecDCWBQtJmW61FsonsiC4gFz9yVp4dJhRRLmmS3ok4w+PVMimA2WwYogp0S7KVH 2uBtksPKFHDpzbTqJdkEmMgjoMMKqCTPTlE9o2D3qiQCl5d0K7zSo6QwOLA7RkYtyQ21H7yMU93E 0u8wdq2psZeT1XS4iQQCwFSZZy4vzTRgMVX9VyR4d1pI9SDBs6PgDLcCc5iycuQTXxIC2YJHmXr9 isCJMRAE5Q4CsshixsIsnsUUybgU2SvMb5UxMv6IkEGjNBcFwUpZ8m8GPn6uGujooXXwMH6Hiaow 3QryO+g5zyOyU9DBIFfZd1L5Cx2dnZwmYBDAVgOwuTLkiolDZUpgGrqwQ2ydgUsflmU+Kyr0xeth OioQUG9QKeWskRPwNHRoL55YUp1wY2bNHgcsXKmCRJi5o6IIl91IAnq3GAVIJTp4+F4ts239wnlk ORBOKCDwS3iYGSi7FwHIJjdDVezlUVy+Q4ZTU1KCOopm0QsjnurUcpeIyIaReID3kbrvKq9TONGr UMCG64ixmSXdysVpKaJcuZeCMMuduHfJGCZOGGeXaRNgUHrIdnOR20DgcZgl3AjL2aiIlTcTkBzi oqmbZDWPAHxu/xo9PSQAFohUEdcrMIac0mLUX7nTVlnEpApoY/CXCfGQcLHQ1yMDoic+1NK5OYiI /3XfZOTbovSQEycWwM4tsDqyCSNFE8FN1D5DQpYLPYk5qX4ocvuU3Q2ruKJYVBllIgfd/5Sk0qAV ARSqiGlzJlmEglImTIndUBC4sr8rPtt+5tWm9A1NDdhnvMZ0zWnRU5tl90Z4rMiYlF5cbY53DOyz BUaqMmhaJww7nC03FxUV5dmJaXmJsKL4IoLg3vZ6YKl1n7UEzon3pscXSXo3IhKHNTW6yWcnhVyL qF9TlJUl1JxRephSGhmsYMVoY08s7hC6YnkwXGtYmKyM1GVWVfR3Unn2ZfYRNe5HpuMKqyFoUmIb K5TbFWWpkFc5yLlTgzmkCQHnZRJAoyHoO6SgJ2d0Eb7IBXqLOBnRA+w+DAPBxZudjXeEMDMYUqKB xRF04McbWphJKjCYWgeEcNEdmAg9HRrXhQrjw3dYQNrsXxkWUmOWoTJsDux0gmDBHsgLTBvwci+R L8vM3ZQbk1yru33a2S92Ys9LkzwBz2OWMJi96dWiVs7hVk1JlIoi0T71H4aljsnoEuWslZYCUzKi kwcX5GlyvNevIHIW0krS6FRYTBaeyqcDOeEujQfnm8mVrsJqjBTDJ6ojCIoCjFWSvJoJNT6F/RKj p2XLXIBwTwxqL3GRPgVa43hJKaUyRskkZ0buYU1Zj3Tl0NvIVjLNTRQexLRaJj6+0HM0JFBRkVBl ShJki8eQk1x0NPZ+FqXJ17YPDz5c9WJ6OhN7RVUVBhEkSTfDcKu1gJNDbTM7N3A4GgDEERxWQDMl WggfPfkVuKUGNQw7KscgNXJTVVVDOWCRk9CqFUxIZK4PBQboK/LetCcGBi/bVHXClyKuyIG0ZPc2 gZlF7NayEwllBLensnTj07GPAduAvQihcazA6YHJlPYT2bMzr16NB4HoEXKBNBUE10QKyw5MKDkh xw8sUtIwc3u52NB0HoOFgmd7FwMD3OgktC2ypQoYKDHCxMtATOpFKhnvRV0dHXVfOGNNH4oau17l g43OsRtWKzq0bD9FSxQ0bC5UUPCxUfOseEYucMCnCuC311tn62KBYkOVkq+MsnRTs4cNFDYdHJHS nv37Ch7PWwnOZ4HnQx312jabMfmgnl70mQwdmDMoBRojRBiI6Y8IkcSOPGlDgCVB5p7Uvt95h4gC XAlvPYgje6/ttrFATzv5pq16qNZF1nJpYsEGpeEJcWdcvMGd2Q+++Z0dMuOvEBcMb14uGoMzgmC3 QGd0YpMkiYLWYbmUNlndzu7CRIVS4i62a6OyAhmdh7JhAhCpiHGYZQTvNYX4WHqCNqqEjtoWN1dP BAPf2JF9KOKjyMpGWNNslS4DfXVasFooqGqqwzyGExLEpGSB2cX6h5ySJexitTQWVSn2zm+ftwuQ XtyrQmFQT46Z3xnnkyiCcmiwKYLP8zYUW6y2wqodqSeRDOdGmSaYw1SyonCTfgKZWWazzDFCchEF meH6h9JgKjTBBAS9wkbK2ID8UA4VfoZj0xC1UbWFVj2KnwFvVS1iASYUXtmOsWREwgmUE4RJIGnc 4QRM9dmolIr4OaLET0C++/mIVMT5xQwG+g750XLl8I4WVwxBpcsUOIeSqfldlUQVPLBUpITQvyKa MDGUFJ6Y5kgngWZ9PfosaFBEqKIiT5gwEjk3RA0KHDr7ELdkgyj+l5sMB7K+ldNSiERCBuhQQQE9 c7JzPCQvPeU6ClIVqOnKQfWhExkMwNhfAtIyMIgFJ+yurv3aO6kLJ5s1GNBLU1qjJ2xIcnNEEogm QuMzXaeRvtBk6ao1km5p2vcjfQmbs3de8mJkNL2nbJGGlKJEyDGFUJ3DXZ09pSwD9JeVTOKZp6MN 25lpbkZhS8caQwsR7XjDgQiYho6MkL8FBM4ETIlM0LSL7EsR1F9o4mSQjoVHqbP2KejOu82IHNuK pw8LLQRfVBNRyijQOR6x08kIgF7ILXC10oYMkag9DoZY0VK9HUlvUUihEr0Qgb91hM1GRaMdUfkD y92dtFbDlxh2dYdeq0SogCzPhx+0shIl4TIeR8TjKn8Y9YaEjA1OrKzoldsiNJgYRKzigmlrpAiZ AqCJZAQQcgFrUkEC8OHnUULcCwwMSN4GPRchJ2KHWAzS4SHqaDAZN53QUYoZmKW5c+zBIK1LYKIJ s02CgsdBs2YDJzRo4dalPLljOTFczYq9WWGE+uJaJ5zF8kJTq0j8ueg+D0eHvwkWfyo5Q6kz+hzo f28EEMXwLZg4YNDmYT9OaQe73Tj5Er6ufrJyn59fNCkDUgGHr0B0oa79k3wfrrc6RJVVlirLnCLq aZUQZYFP3THa8doo9eKsBl+YRGxvTltbrbCZhQpg83F9T8wieuOgi5ueZoZkQBZNVm4aO5AU2lAi LfWDkFNeyH0azg5NXLWidGi70TLjajIhEVPTnT1vmSykbN1ZCMiqBGojQc2RfVNr3hY07B1FKsRr TQhfXrMe9Zs6MqbqgrPd8EtjmlcmjzcLQklyJ6+smfWREx0KoJZBitqx540tbFspZTdzWz8oSdEI 9lNgZMYHwsSDWsKwWCwWCwWRYLBQ6t2+25DGA/BZN1RBxBYPkChUFI4WFYKCg0jYCLMbkYmBgXOG NAbAnCOkiSPTEARdeSIlDxevXUTE6xDWKCDybmavZXW6JfNIj7HXZF7TtjKJQ1k/WH7AK4J1VZjd qeNNOaqwjvpkdBDbIibsWrh6YHR1YNm3reF3XaSMne22c4mtNjcB4IBrp3QeZToFP2rq1Dvg1Ql7 RAYMXPGE6xQ3afEoI4I9qHbzqeA5eZCcKQeSGOBF1fhZU+ABFAGqJptOCe/sTWXVNCPY5y3eTJmL sQ+Ne++ljs89EodVhnsF49/I1ART6gcZxUUUgGQ1C0iuaLm18NQcOEMNCdLNlbFzPFZ7hcMh7OyS XBwIQDqSXBGQCYQvQ5jKiAk5hOMjLWnSHu/Z8lqVsjKLYQfBDHx2giSREnAiALr3KOD+B8SvNru5 aOiOC6MG5x4vZdNH3ogkHRppsN8/LHAw0kOhzh9pZ07O5UPoStAvck3IQElgv26Vvr4CUWuVHOuv Q6ZFFznVRSSiheJkiTtEpHQmw0jH0ZuzDpjj1ssh4zmUk7DtSgjRCoJvNpl8nsdH2aLOKtEwNNeB QqSCZIyd+guXOGUQEt30txZvRbjkwSZQhlyKPLsky1oapQp5jAfF6LgPY5YyQCpXEChtlhUXGJiF ZnSYmhppIdMLsJEtAre0qxxgU+DopwNGga5mo+BxzYcKlB6lEEQUOrcL2TZZGpJgwWkuLcHMuc3J zLpJiotIVOBUkObv3vBFw74Zr2SbRo6Ow2TOgbs6OjuP0ps0fUXiS9qyslBiqinnKHhg2ZC9oJFx 8d0MN5gPRrOT0ZUzo2wUA9H2gggO7yHNzWMTQZ5lG3mR2eVHvB+COR4vf9B7PH0giCeQCd4hd5bu 0r7MuCwH8Xr06bBmczRCbTgtFDQo+Z4jXwpvnfJu6ArcYOytSolACCMZkhgNEVdNU1GPImYMGgOd giwNaph7gIxaNW4VDHtRMiJYM9NMQwuZOVEB9WblZIeTS1ZhIQ6K4jdvYDlkLEblRllrax4YD7Uz dbTGr8ImkTCJKoL5QhryrPOHywx3YKOy1VME5Te8g/WbK0kaBEkCogJn7jRynCc2BjSEnZDs/CRS Oo/DgmzZ+R3xBK9vhcNVyyc1suGfI0fvUxNjK5PHstl17zSRJC406+ypek5nEr1nlaVDDUOi32/T swVNmvljzsg78OdWV3hn7mcnAqCTLlgikkRlqKghQhRkFqHcQYHaGYUh5jFryuWwP8i3tIoMfrTR 10L69icJoJ0Ne93zh0bryo6bXBV7EwlHfZ2OfTWgShc2Xo6xoMEH0FQj7w9OUDh12aIHH3gPg4+r bBqNi74pG2eYM4tXiwYFOTkVBD3isz0TUMMVaRcw9HICw8tlS5QkXY0RhdZ0qWbWWk8nqKpkSI3T WvRoxRuhkTR2Q9FZBKtMtGDgzlTgopMLh8ETcxe28XxKor5sOWVhUZQyb9vO7VFsnC43bHe9lJHQ olHH5hjsm9uj0W8OmLjmUQSuU6m4LCsdC7KBkc2EtFes3XAUOpEvQKkG+zR2FNUmxMOwaxc3bBcY lgxssQaKFAsNeeC1tcHZSUh5SXBuNCj9Fx74VSUsk42TudlppWUktVJE2uKmhSvcplcQGzsNogTn YwWqdC3N90DShPpV6UwFTrsPxQRUI0onizdtYhZbWNVBa6K+d0XB13i5nbo7N8b13Dlu0YurSaWn xJNLCoRHMzKDXG2SKF8HdDKcDFiB97GwZIL/rQShgXQbOnIK4kTC0GiOQYJewYWVw1cgqpfpGMdf PzJzo6PKPU4cBZEUU6oxUdOGzWnB5GDp5UDISL3MmhyxsyYmUCRXaVmcMYoZqZJ1KOklQtcc6O8B QzlDAVOiCGLfZoJGDVs1z+7Z05W5qnRclssSc4NfthTRwmT+5DXx0Oggd2QgNQiCLyBJIJ3cgS/k mWOWc8mZc8nx8Q9No0yKtZ83sL3ZsKTeMFJSISBAy1cQ80NahleNGs6TThyGWLKkRU7KHThyVLBn saIityLZA9UkXUJ6Guad3vgrXRMiscahJCdw4h0KO2FwwSLe44qJmpHgV5Fb89/NTdkEMiIJoEGG g1SaEr5d8LXSw762UtJES+kg9vtwXSI2bLaM5quYFMV8sJMfWvc0+rFjETnzWiImK87NrL0OlTJU SPvFTJf0WwcPuKnCp0T11HGeyzlG+qHATSlFQQQmG6YgASxP1V7vZsXp1YRA7FAM3cHERBOg3mC1 5qqIkmmbhEEJmpqwaDhnhkT75dnOw8KlFjJcZVnHVYifENglXlKfERCSiCXKzpeuS/L1W+X/bfAW MEyty58lJmPxpOuTGLDNElhFUhHwcoXPQ1XATslgNeslgc1IaXkto1uJsq/HV392eKGDVqYzVi7+ TE+uE/I1TC9dx1JHdCDCmTcOTDARwdBGDR2TywnJyL+rL3E8D1dHTeyDU2cepepMHv4dkkqN0LOB gZ2SO8YE7AEd3QSBn8IewxkxlSUEEAVwpCA29N8aykKSQOvWZsDQ7teSh1l1xZ1SGV75J9mDBUPV mwphT7DaHh6hz16kQWG9Gw5smMZYN83qPJiqmIjpexZeYcw1mODuTF9hsqbJVPnlSt7HmQkKhg9s UzUn2nUyUbUnNBfQWadOjRQPwRO1RLyp0SCzCrc9MMfCCkaOwtvhHDNA+CWjSAdnMLSrdrC0qw6v Opge/YWGtTwPiQeqlitPBcGh0UVRQz0YN+GnVieOkRpJ90ie0k6RBOfg8Hj5X3HOXGhPg6DVDsqH hTQOaI8LfgJUMkzWl/B0uFjA5seh8MS2uw+QowOopkkSToUmQHRX5PXrCCV5k8Cp5cxLsNXFRS4M dbK8JlHMjdL2FSgZbJceiYI2acdBqBieThyuiZY2cHVIpUbvudwsKWOh0uZ7UncwQfbvhYKJxFOz WUYccUfGQvSW++QeDBQVFNg8YMko2VK7JhiYcBzoucNBY6MH4GBJ9Fq5LlgRBo38T1o+rq7xPIjf kVvtFOIPb68ESvDuQTYmiIE05vTzBOhu2a+KuqYKyDbbOM4yiEKdw6SdACyGghEMJF3VXQhq9T5q HTlyU/EHoEHbjD2G+vXxR2hgGoFmIID2tGGmwaLqcmRCIYByMEJZTzgdZgAcQRR0WNMTShxgmoUa +bkUVgUiGkwLzBdUEc5xdDcO7iujNpTMWuAErt6QuDnO2enBN6sLgXSAtzFyMQxTK4ROsl4LkQ0V jjeJYug0q10ltda1uyZoe/0wNnuUyr2q3c0CB942g0JGfRRSEwD2Zz2pY8CDwvM2dnht3DIxmimC Vj6xcco2MUiHwTc+sKIJts09+/y7DYSK+/gbfh0SIMjj+kVb3sLWZIuSaRBULnR52YOuuGIME66M H7+TQq/A0x2ow7u84PYJId8QYJUTApnJHEEvJW99j5NQGdopkmS8mUK2waanpKHZxEoLK286WLqM 0hXmiUIJ00QhptZJNMWj0W5gEwehPPDqQiYJHox4HfRkrtNLL01ZklVVeVOih2UNIdHeHuZr+sRA MFixnTFfNlx00no/bayVlKAcg2VUa9yRjOzsVdjLi2KTWUyQqqr9VpIoilTZTRpKOlvbmS95GwYz z96iPChmv1hY+fnCSNlwsaT6nhzzJwsHonYwtuyRXP0MXT0Cnv1z4NFXcm53vsmR4xQ9MRweDGyo ZPr/agmjRGUMWY+PGJrA3TOSDQ/Op1CJHPZcPRonog8pz5G6GNHR7+D4CJhI2VFN5BU52OCC7qGV 6OmRiJu0XSxM7HbZ6yUg+l+63DJYpM4etGaCwXDkaDKdg5fw9n0MEx3oexmCXoyHlbt37202Wf+N Ak6MlNlwiwlWBkFDQLwwax4JIPCnuejPTQZFwWFodD1Lmb2bIIm0M/oCJ77uWG7bijGlya5o9+90 wHAqGSAcFyKEgc+p/KYFFOXY9D+xkUz0HsHNFT8UElm4KNAV9Dm0EmOEujZQrwsdDicPRUodVLBE sllFUJEHr19dypI8D2x0bIJkKY6Kmip2TpNGSy7OI5QmHOakO+EmfsBDJwqZ0HGycG7u8qbVGPJB MDCBU5SeRC0iaiA8tfWSQsHjwbyCfdX4ZRO/1ehNoPgTqhNGvrPs6PvNPb4t3fvZ1Xzn5j7UkylS 7/MPyALz4KKd7hH3b3G3sC4mIbQmE9VPCIeNhIxTz0udaXvp3ipypY8jUvGBO0bYnXD0TmAGxFRB iyFdwzvaoGAuSMZFjtEzhjYnnNzLCACBR13G1xESZmYGuU9Xp5zJ23kMpUy2uQcYpLiIS9tty/Hb xOlKpNXaq2qyV+0tMmQULFMU2cHgBDISYzQGJYDkx8yrAZGZEQNgg2ltD3Vp2bDWFHBgQQEiQ9YB 8C80+4tgHPtKymE7tAgDcJHcyDJt3uQVIO+hjBw2Spe/SiuMj5bSi7XNCEspuZvYNMwagKSWlRQY vsnIuyCdH7EE/H8fN4NrYLoWpQnNOOMVzvoj2d183KGYa0uyBxrEzAe8LFKBUOzQL2EnqddyCWUE c9F6yLG0pjJYNrZSQpIKZ19l/itDzSIinGI6V4k8jTkVO1aTKFBX8YPYLccYiyTeQugl+XfpMGrm hTrYga+INddKyil25L2HhKU1m2ShOR8SGhkcyN6cawxWx9qCIZFAuXC0oQDsmcsfrQ0VPT2cMYTZ Coyhdfj3OHRmOH0+miJ7Po1+Gj4G2ZD2X1qYW8CofKhFfZ6CxY1o1kcy4+Rdxr1BRYcVjkl9OXHB TkNAeuiw5rOBaYBskycR2WGyHYrUXegkJkz6zImHA+ejh1pxnZoYfgcDljuxocu4TKGBkkNOTRaY xvHVMqSv7Wxs1nRBUsjXvDrH5BW0rSyVQ9FpJk7QldOuqej3UpQknteY8LumbsxvxZtLdFL2GvsJ OUok9ezCYvv5OI1JmpmRj0EfV29Qkeq6boHL+/DRoFL9UMFDIpcPZEyC4oz1CZAevaWpyZKREvNF wmOQQ+20UmQFtOmLd67EooV6S1IuZHR0kHVg0TGKnKIIx2UJCjHZguHZ927eEi9FHs1tHRgmdHQV NwdVKajedWkRUUYqWNTLkjRZtqxOjNzbOHsuOTo6OhUkcXxOJ7Dx47t4BSPevsGBo8FSsy4DuNXn NSjqU2hAOjuRsDwR538ROJEQ8xCoL7CI5EWwJA98UqAQgwgg4bfO9Ovn67HVx6b9ksdkv7jmALQs CxVSr46VsC35oI2XUC0QwJNoWRtKSENCpFiTQkrKRLgt0sBdLXBci6CJgC2RAYC2BcRDJtigiaRQ HRcFgLv9Duyj+zp/4LnpeqRl5/W80U3Kg0/PKUFexAU9e3+MuUKZM/++VrxVKTSR4/i9j73qdg54 thbj4SNRMd49vhyf4zP1uh4s12vT+cWQWLCa2udUVKzneVph5PjoOng4vhEgMfgWL7SjiZFB4eP9 aPzitQFf0ooH5xFpCzDzJr8B+zCUT929iCLBD55wXCGrSYy8U+fWpmCzNkRSBEGQBiQSLAZARgqR BiwSJGIgMEjIQ96SUlKMZYSlEEKEpSshCiMjJQsssssYywKUtKXzFYCgsILBYooooKRRRQUWRZIo ooooKKCiiwUkHIxjFwC1WMVjFQQVQgkSIiIiIkRERBkIRgwYxIkVEX7IZB8PmLz/IpIgw/YoWIip aINQL4HLJHNMgWAurk58H0GvpcBBRP0ulPua+0kkPDittK4I4m8X9viH8vl+k/zBP734CfuInyue koH/fcybEwwWeT/fyauVpe0/3H/6q8aCHQ7hwer5Wgo2iyh9dLMlh6QAoCxQWAQREIKyBEQBRCBF JAkEeS0YbP863+/M/yyXAnNDQRdAcnms84adCPe3OJzh/S1iGDAWxNbq/6hiwRteH/O7IEmFmLaW sSa6p8pEf3/B5eWEP2p4vv8nLnFH9ZTmEOBwPLlq7Q6MjrCJDtV0Z6m+Rlz5l21jPF1jv3+sqpJJ LCH9tZFNB5aAo39yu49EoF+NKHYcdR/ji8xyPURNsZE8NJyJY/p45iGztKEE7CBYLKif8pn0LLB7 TqSLccBLnq7RMHNotkpNSA7Ced85PKSf+ort6uc1lGYGl9AR+jDKjUrC+BCBHzYNgzKumRR2vaHI mA12FzGy9DzGhZtTWaWQ2iYJcFlijmZWwyOFy7f1nrT21N55STpKbTd4M3WzuaOotjO9gNUwL0UV TTtKOB32SoW/rLFl1ju5TbcwidfLVyDznB5SHOGpVMeUMnt+h4WLeuUSLJIvt8bsfJwC3aexxw8r ZsZu4YDwnsQaPDjYa2Ctw80A4ZaDMxseTQYaLbV7xUueaSXCPcwdQdH4fjVklKgntU3GS0pnZac9 E2D1ipGLBTx3FzQqFreOa+a0O61gHoipd40PlHW6hHjiD19NAaFQuGJprS88uck7vZf0ykmMcyRd fCvSfwbjrs83e73ls/1l7lS4wdWXjfe2HtqiW4l7PCI8yT2L0cbdrD1DSWs2jXO4gUhoOREgZwNw 9ER8xAoDBYFZKwAMOcR1ZMu61zzoKqgKqkGZgz1Iq9mTHfAqZRtEDelBxEOvSUERRFj8qQ6GpO9G HYZlGRHIuZEGE7ccQ/ulUSgcoeMWRzqkNCuqtFFDhUm0OQeowOmkPB7Ju39GTl5tKkn1STYYVO7g 1l7JXDytBi7Szeefz2FtLVWlq2dU9BO0hQ3npPtMvwtu6E6dojw04JoBozM6KqlqpKKqgqpJLHXf UkWFvQuhfXxS+5XqvuzzzdyoL6UISFqq2807PGUNCaRPU2RHlypJ5x5I1j1CZYOocORzGHFNaIb0 oREQlL7+vZ3HxMP+SyAjD6/zAD7kwMj74fu+89DxNQd2xOpSvJoL6eytwVhvkk+HFj0KhBJ+6pLT xTMsp+l6YVFxFMCLwlQOR4np5D0jyBrmRKu4tWLAwhLFDtuDe8u6SllUq76W++v9VOSN0TFc3aXv KaaaMpJu/HfkDyEIQ5sTXG7wDr5RNuc2ZJr7vWd8f3/tOKvgD/4KKQhtT1FFvvPWWIfxPVAs+B+o AJpTUWPlEyCKiUHUgZiZimkuauIlAkJd5oQN+6L8y5kUME5RymjHZhFoqalP/RUmU/TBgvcSqfm/ QdXaMlOUcNGhUwklkkOgWKlKEFgQCKgxQjGVfUEFyX8MoXlSTLVZzYRwYQROs1dSf8ObooozxqrL mq9vFnWLP8FNufVkLubU1cL2bidlXG8mEtOyKWwjHnIpZcNlJw55xenKNXM7Ns91atHJvNVuFRIL oUlaCGmpSFiDCJWu90UDJuGZv1uxdiQ2PCbbBO4dkVO6MWRBAqSFKMpKgsUlaSlE4whhkoCMqICJ EsUWsspUVarWsWXDKbN43mxw0mOaJpqwFKbFYeKgI8gf8/7f6/3/t+Sn8/9oYEyn+3KjfGy8EepH tQkRmpoyd/B/kszOHsQXNuH+3/pykKZH9yJoaGQMfIUvDUYQtxsfXTGElhJ1E9VsrR5xBN2jRlzx 2XsVGUSC5zvZmjkwWDf/MEmacuGSCCsFDo6MS2o/JA1Q6lioRz4sNTZQwaOgsQambLBL2QVK6NpL hU2hO2WNlRTRbqRgqQOQVFMoSK3NkZOkn799hbwLh4vgQQhw+3wcqnVSZwPSUDefAyYmUOx7f43N CkqmQ9uLYeG69lCQVFJHtHJBWZ792KpwySl1fq5dPPHLk5Clz1IGYgkz1F0LY0YkhmDMHo54MEFw 8FOsMoUGBdGvEE2f8fynnKMKNYmHbCh66DomZOBUsTmdl0uYLzkfmgH+rcF+8Bcu7sQa4GW+Pk+T 5IPUv3RPLdTVweDm01NHHhc5Oj3r0/s+J9n1vL/Vm0ZmryXHTuXcML3e7ll7qxc3Z63hDz9NokfW mGp5FfYJ84ywopU8fkF1LlKSdMp2aFNjg5678PQeMDkyZ821lBNBjB7PfyaKCBZIo2TFPOJlMbLR qywvLDE4bTTMgUoxqrJFY1w1BM9mAkGtyvY0SJmVBgb3RepGT6IgR96mRRQvwYJsbNJI8Jc8KH5v e3ljouPMXsMToOCliQhuIoUCxWGRRRE6bigNCh6zyg7FC2flKVhiMDsLF8aP59xCHh2frMBhFxOT A7GL7rsysL6uwK0WDc/DmN32GhMkaKTnKk6S0tlP0+S6MXyWQ/Fbg6Dz90FbvpHcTd68MoecVEgu WTxJPd8Gk1aSMOmwXbh700Nm631Gk1AulU4E/dzULZ2SYxo1jNaEh7tp4+9kx+jZMbsfVEKi+kbO knBpU55j2lHTxNIGCprNZ7QIXdpB7UBU5bKZksXO45V1GF8Dksu6jQPWPJlItyEOjosBqzDBF2HV 3WMR/wiO00bdIwIGOkgJci15uGqyL+RxQhBKOFaTSWEslKFtTYeBcsYJpEpyMAgLcUhleR5/IDiu C/NAfBMg2r0Ed4nboNAifV1HIEX9WGME/DWIByDcdwp7HqY+kVY9o93wjDjZV5JkfvcI1bOT7k15 bP3OdxxT8v3/q7Nn72Wq9+ajB8WDWs9jM8D2z8ryl2VaS6cuUGKBokLZDRdbj4MnWzRspmZEane2 CfycNimKWL00fRLmQ6QjiWFccY4E+DnQUMPiZsqcDKjOQnRxRSh4eEw+wEkdhcaVNLuTmXCwYDop oocGKX6MVCoU0tyB5e/A2bIGL1OHvNzatVih5yg4ejwydBjvpMnRom4dFRQkGRRgmZCweDGAmZou CoawYULYjoqUGo5VFtcsKSE6OhV7H6od8LHYoydlDGrBpHIkLQUqdhi52UrYe4LYudBSpkyZ0pPr qZxLIJv93yQHeiXl7sG9nM7Oy1Z3seVKBHRiZ6Pj8QuRIMC+yw0Ow7jWGeuuSaD6aaYGYpqNLy4f oFsw+IHCfyGj9HPYtToXZ4yDB4ZNGBTUGjoMVOqGSUvPLkH0L+zrUFj2YKGyZYO2GOHZdTHPFoWZ sGPV34NmzxmHGq3nucM5yYPAxfC0LCKgxQGQy2hhRUYEyZeYSQslppokkhS3FKm3h0eXVu8XZO52 YueTxYUweLDk7lNPkjm4nyIUe+CdpIsSEIyMJO2PuCD23K6yW/zXf6fwfWLvreahdE9h08X0bsZ7 mkwS9zJmioPVE1I+LxifgN9Xrk5FuSu9SxpBO5rSDyh46QXLSb1+FcDScFDkT1bu87hBuenBLKoc BzbRiSEYcg7AUIEBFEUwGHntzcdEcPU+8EQbmiM9gQoqqaZ4HhTIF3g7/UfYdcFYQM1VROrXC5BY SFUNyEUQwRPDR0StpeeT0+7Lhs1HSowoI+ChAYolIgpfLPfJfJGTRi2SPrfk5XcHs+rowFuaQb/c LkUnU9D1xLLIA8JFRYXvsCsxFDCpw6Op8XuWqzaCusrkyjTTegodhYocMA47np+BCihg2VDqMnh4 NggobPCoeftcPRssS1AxAXOyhMhFuTBTgeWPzQQ3B7CluOWNt+kFcExipz2SJGDhByODFoQTYx0U FThrDoWqR7PZkgJmyxg2cTgp7NpVBBRkEqFpMaLFERlKnAob31by8pb5Uahg0KidyI2+jeyxRKDC nRMMFThQ7MhtyYdnUdwJgpi8oNg9zSh2WOxyRc2X4hQwMMV7JdbMGiZHdJhsQOHfbpswYOdhqxM2 dkkFG22Dru426PtkjzJLvKIpSPHvczq5OTvZsr73E8MCLjR7zM5ocwEJaFcy8Hh6Ei08BTM8OsET 3Km9gYRIJ1GMzhabuLDnlw2o17wy2G4fILyJVEak3LFSz4lpGrYVk94+uRHdeXQOFpeMGXcqVCwo aJGRebNA/lDNzRruYfwgm+Bo1cmjhqyX9/yMFE6fWeTtu7OHHF9nDBiiNhkScaFoZGyITKzV1mYJ C0oBttSDxKrK5sycbrhxaO1jjC4iVqYzYLU1lBImUDdDmZ67NYdxcudQLe71ncf60D3gvOCwCAQh EiU/piIxYiercszskgUn6zC6hP2UwMKRSDgPsR3HFD57g9KPaZD4IFK09xDiZiwsJMmQwEJEwoYy yGeM1omjBBRKNniiUHQpmjimrEH5o8qf7Rd4aK+HBA8AXQeRHEa6jrIVFpYtCPYaQ5QzUovIbvqE N79UF9wOjIX8zk6DWEX/zspX/cQUT4q+bLV5AkBxi0IUFhKD0/WHpOjW7Q9PyNAJsOtDTsnocLfp zsWCpVEqry97FpZJsU+Es0bR2hMHZ2NYZIUob4ZIYbsOHMJBwLwd3ijwFQHjDJGRMcS+vEx+j5vZ /z6zRM/lyd+vb7NuEJY/qULwvqIFnALBRRCJIqmJCqrUKeFIlYYdw+LyHUeOA8JsM5BjIxMi/1D2 CA4iSNjGmmlU/jcdoImAVkcfGivb9eFzXgdH8l8lOxMF8oMZDFuCnAcKqLYWgp6NkkGKDXBTBANU mb0cKqvCcFRTo2fWezon49uH9gE68mFxbE1WzyDJ4V88JkCRbbAohWXBM6FVezKRuBEwIkRIFZkS LweNk7KeEhhyo5uR8BMehkqYMhImfFyp2kMGPmiI7mGytcjhs21at1mbm5ybGHTU9UQSxq5Y8TWL 2hc4vyVYxUT3zLk0EfT6SLmi7+zRowaJlByChIyHoET0XFHKgopUUUr2OVJl2KjJwK5FiLeyqTNl /dQvrwNp7Gc7rgCoeCHuT+YYHdzA05DIQiFLUFimw+3lCjmN22jbbfwscAsc50aMnmuaz9yIF5y9 k8ROCeXzoyfOCatZ1NhszA5mb3MZ06RHj4FG3qZXvNg32csG6/Rm95Ez54tWy/k9KauXJbBZi9Hr XrN2T0s0nc2a3OcLnPruZqlLDGkMYX34DFA8KWHlxBnlJtS3d6BgeKMKqCoasnjlEUz156SeXDCa i0a40gpgXm5RRPk9EmbJuNpmow2xHHCgRP/aQYFHMQnsdknmIDfYSBl+N5tPcyIUCoQHi1ib9hZt MzPVmROI42gu/p4e5tt7HsaqmbVk9OZU5RO5Ink7qzsd8eMUT0IIns6PJoyTEnUW0Q/DRoFLjc6H vY0bUaJ8kOM4n7v7l0c5i65nOHaJ9sTx6JMIOa+SeEPqcCjj6hoeLOZpo/ocoewHzh9eH63u2P0f ho82P7kecSWCVEPBCRH02Uax/iXOtwONgRByPsIp7Qf1a/P9nCSvf6fqwwkw+z8fy+ak0bFnxuJL SgecPPZFnENQyEo9w0kh08Y0E6Fypt5aCjl5lSZc/nEkR65RgwSnviQaNs2zGs9ouFzbBoopwsvY rGJbArlSZIP4B6FJKqOMPiYxgWeNXBRjI5cXJNHUVHDdEEeBAgKGRsqjmUwOKLCDCSUMGSpVzc3S ZYoEjsdL0lQShcsEplor0qC4rPnz6LHJy7j59McaS2jnHDCCTmrJoKzlZPQqpfUYsw0pSiSkEygo nsUUUC3oYvJCjyWYg4wwi0cqUIKgYRjF0JBVCtnk86ybV2u2i+LnroJywWhQpKApUsDYQCiIdz9n VZ+FizuQlO94P18HjM30Ww7FcVMe8prV0dkYPqjZHVu13b9N2x3w33w1/Rs47tss/Hly8ZVryOW4 0GrtGPpXsuGROB2DZMNmRPWdQRCwePKOZicwYxDG6jaOE6mxTRQ4TNnMEjo2bKHR0YKhBQcn+Jk+ gMbXA51osYJEsFLnAv1KhcTOXPJpgoUMNZj6IMeUGDhMgk5Uwp0oXBIflCi/nt4Pt325y5O4Sblh ZKD4P5MS436coSsz+mUsecyfR9hKrXLh0bspblQZ01dnftzrXfZez7HNV26RdfOjZx4beceNHKQt /K97jC2T6Gru3wuowe1fDvptW+7su3btKstVqcKqcYUZStM6b4UdJPjug701OjX0zuXaFV2hbMvH KaEOHM4zNWS++vjo9Vtm+dzFd8GDo2LjNg5vk+Tk3bmz97ijjKOXPJDXNFSZIevpP3i+DAd1qeEO dMtWmeFjCmQ0KcueEtgoZPzQSZMwTNfB4RseV/uEQyF/OwU6KnBSNG77aZTw7Tqxg4fjgyU7FJqU JaLqywHpTZ0oL2vCwxQdPnU6JMxKJlQx4VBPIKbzw4bUNxwRjuTmKDIIgHcigdnE8YDIIbpCQJCN QJFRiiAgCDFiigRZFBVi2QElvlJIUfgLOMJNilDrE7BKdBODDsGGDoIse8MEUCwXiwUBgaMthiFO BgxCSRSFFBMFRuZC9Bt8tB6A6+gPJz73wYHlcyex7n390c+ypVKqoixG74Lqo8L08fWR6TRjfUJ0 nh6Or5vF5Pi5vLr7l7yMtNVYJ2BtOhQIxYdDgfMKasDjnmLfxHhaKMcRxrNdpW0i8qSQxgSMzVqI C5lwxSxI6CVHBERE+8zDeCvPA4iqAqHcGgIQidnTKsPh2cCMxSBlM2ZZqrthIxYLFSpM6N3zWPt2 prS2d7lRXKCs3INu83uHHa3ZacBuA0CZWJfXudmMg4xcu5xpe3k8zj858XxfUpZicon8kJEc1wII CX4s4ZqTIbDt7zrzNxAc4MiMMzQG2lHshuIQiSBCQko2nHT08QhPPN5FIKIJTkd53ms0BEz9YdvS zt1U083+az9Ke3hw2aavc3kvpDZrBEvJPqk0+Ek8PM9yzg9jrY9v1MuTU0PRphoyZfgcsl7FouU+ s4iNvgxdPSGDVDZULNz5UekQbK7wH6DuYUMKEiFAkKRCgJSQYQsCJSMKAlBlIliUiWJSJYlIlghS JZElASxKRLEpEsEKQSxKRKAyUIlAGSWAJYlgliUgliWCWJYJYIWAliUiWCFIliWCWJYQoYlABClS Clf6oDdMnWC6EE7EFPBD6/FgPg8Q4psJIeHTb3b+kLefh304rZlR3HCn3eHWjPTny1gido7Hw2PH r35QV74q7uhZOCuHUAiUd+xYD6N2zulYUulWeBVddat13yBEoAROJqFTgnv8wLvAOjgr5E94onR5 TW+B+EPrNfcHnNZrdOXxPc+5jYzDgvr06taNhW2svkXUT/ARwS7aQE2HOZDQOg0lglih8S6FIZF8 z7Z9fANGR/GPB5XHMJFThEi0QS78/oQxQvhSP1c4o8070qZk3nC5hxToRJDlZBw4YSAoEERFRucw csagN3Ih59E6KLEHeaTQS1xZuuEls7Gk5SMUuk3Xw0RH9BUnwphDXV6jrWDtUk24YxULhURpRJVI SIrckpc/baqjZ+mLJcyGKzEw6L0/V3squZ982O41msdZCybr8lmia4NGGFX2XsnwT4o2DOJKTkSe A0dWlvjvI7KUZqUQ2k1mbJuC9qUWzX9ZE6yCaknFYdB3s8Gml6nDm3ZXV+funEnZRVSlDp4bOW9c kuPZGX2VAF5/8gN4QivDkDm3q/UjTrCEDoMoIqHgWes46gOhXbAXPikJEgBpaqmLJSSjAoe/QP88 MMHyFEwEv5cqJiPYNvFRHpAYhy+PD25/E9mguWv5hLRb1ZWRUZUSsJRVZy/Zc/nBhwxzwkP2XrmC xuussac+T2apimbFEU66V2na+v6YfyhQHTlxJwfxEFsC3GO5s/hiwcKiVzucW0M5WLdwzsqJyyWk 5rDSHFrwkZCIMl+ZHUNNokqbJ7K5KkFq0KFy4mC8koeFEsWKDqXLpwsUkWBy5O2jFS97nCjRQtMK SNEzQwTFVyH/TuRyR2XqpnouKQdhxKDhU0OYNjhkl2WIvOqhpHKkt2HgK1HHNGwm5cKChsvY5hsh a5c5c7NnDo5IEEBG7gO2ehRH7UFNlgt2YCCVi8gahgU4DBIqDl0cyaMVrBUuGkyWLliDDN11Y3YU uLk2SK6CoSIKGjh6p/sWlh5qkE55GLW05adI2K4N2h9IxXLz9SBNByx8TGPeTx7DU2fBwqcMi8oW PZHZYJDlChI4OQZuMGixooKaMlwsTo80gqRcoDscMGj5+ezovgkSLo65PYTKH0BO3oULWiXZg0dn R4dHVTwOjAcwXQEEGOGTJkwwZOfPuaEQmrJ3dOvJL1SSiT7p3x4397TWU6Lnc5GZInPnowN+zGER V7ySTk9ML/faPsgfyiQf2dzGH2xILPbJIOn5SiVLBgcaEpFw/HKlDuiu/ao521M1tP5e8ROZU9Qg UP4dh0p/216z2EIa40RdlqH3dIH1iBigvMnuo5IC8fMC5FtLDxOrnty7quepGFJzKwWhPfzdt63I 4AZgtxMsz1CgQDQdtCnTFCEHaoliFDQFCidSIUKWMCJCCWhgtH1IGGhbdB9F7+kTrNT5+jlvKxUi lO7j4/22jwTOf7Hwak7PSclCWUFGW+pcIsMMskD2JgwwkgoFERRaEBgaVKCIkID9KgKlnyL1l1f5 IDBBROY2m1HeqnZ6zUHc/qw3almt8ThvHBXOP7Cz5zwlS3/PE1ITMxQPzMzEsvv8lj2eo8Xp9vJ6 eCJoPDo6DcD1o7SEhLNNS0pBBNQgm8/0Pp2IJxS4cHqeJkNwPukwTCTt2lJg6mCVBDESZShN5vgp M6aDEguCgUC4lgsMIhDE/LwR5fvR8uRk6KSjUGqRuDUEETuS671o/kGKQVIIDmRR3FAcsfSSTtqj rCigNXOICwEYYZD3psX2QCbQP0RRERerEQoxEFhUPJ7HZ1IB8cODtAfu2ww9FOo7zwSDJCcmEwPG /Qybv1pSltzI5V2do4fyRpcu7g9Vkj/W4tfR3So+n4PTFIOj7bFoa2pMhmlKUpUrm1e9Ca6RNcn1 /v5bNEphH8FmkTA/CQ+ckj+TJ+8T3ogYo/N7wFU2G8i9yj6xJ80dSL8c9nH19Qh8Qd/DiZrYpcwU tqo2HhXIjxcgpQwRKUuMLPMkrQvhe/nHPm1tGlQu3JI+Ioof8nyEGymZvB7xRtki2RDId8IzX3o+ Y5cyneC+fRkEX3Q+shUWSRA5j9oYBlIgRUSMERPQan34b+ByL8/Or1qRMy2q2If2KkkmSJ5IThgP +z3PcU61SilDpnEg8ahELlEpPNY+1YNpq29fOMDyUe0PtCBQXAPv8jQLY+ZHcqv6EvC0D6ZSfwh6 NFmyZiQ60hwgn1/qN0DvXyOn0tGMmKmE8ywdHs2J9Uzf2w3j+ZQGJ9uCdgbi6BGLBIm3I+s30ZGO zsHihzGOZ14l4OIjlrJjyRdR4k4DCikBM1ezI5bD+PTb6g5d5vWldBB6yDR2UfmAQbkL9Rgg/gyS TqYAYiJlsARCk6P4JByyF+4FsC9QL7U6Tl+3iVAhAgLISBCUKo/pLv3XPXGOSujN7v4k9OtUO6y1 CkUfLnaXSpRoU2rnIJKm0zfnikdwBgZECGi7gXepHgFaYHmQHj+LiYKexmgOIW4cMCxgM9FigyYV CMSwV3G9cF3CcwvQrcp+ZoOrEd+p/wCInJyhKiAcYQMRDRnpen4GZqIEOt7Vz8S7Eiv86AYH1bHM NySCIAQFkDzG4xYsBe+dtmIKBxf0HPRdvFCEHkrt7Neo1q/3I+IP0Dmj/c9QhvfETk/FMN9tVVIS GiioWqiqNgEN33nvR6fXyEZ0CGP4GWa/Ucyp2vAOV3Ibg/IExROf5IHoere+Z7LuABCDZwoLQbL2 Iw4bwBvvENSA+joUcsFHbWZvv3wBM+BQ7VgHVr2k3G02H65B6QuNohKDyo2NINvw/GewlT+fK48/ 3o9vuFAbh0HkxEO4Pj0pYdT5Lqec0Uj44+yPU9keaHlM3wQn4ounrMn+KnAeTBcUBtUBjRPIWBrB DEjL2JGFi++FxuSEIAd7g4wkT2ZAC+pHS7uYDGMiUxVBylp2o7AXdpAXQDsoBbkko6oSIpiOlz3w +Dbr98l/sNZZpORSbRPu10MGqpM7E3SQbqUp5dLqq5IgvuhOErkjc5iIoG/jymwC5jolJwSrSya0 pNSfL9LIDzQev4isoLMY1o1ooZlBAFKxoodEE8tkj/b9aEDxRAxN+Aybgc4LA1qifUpcbThdZbnD iB+5GyGYw9g0NBjOQNgR8M1TzIkOk5xwh+8rM0Ny6l6fuBcTEdIOFiEIihMAWgfloV9vjdwIJmA+ VTgCBylT4TSLn8oyjkvSI+1DBPNpk1jJD/t9jAaUg5XXMNuInTk8nqUvymLI9R1T6CYT/KjHvUVL cElmUi8nkaOkkXKQfNlPb8FHtZr+H0blz4Flkpcj6nN4ac5rUMmGLY675WRKyTLE+j2K68uQHsR8 4PAdQW5xQPrDfvTSHFP2b9hxSFzASh+C4IcfbEbDzL+bFSRUbBti7AOg0P+cKJ5z0EMbfgQhH6DQ DYQpIDeA8CQkYxHB0EPj+zpAXPyWSTRKr/6/9zQh6hk/mVN/wqRH24B1kQqHPBYQoXw+wh6JZVA0 0Z8AsB9n7/3FgbkFwEhL/ogWLAQq2AWRz3Qzc5sHA0/lJsBaNhiC+w9atAvdEA3/q1GUjIyROSBp KMT+YwDm+wF5D4uj8vEHEF0i/HAPL1o0l0XURSAwQ+gt4lFn6UekF6lsaybUETlXCHrDVzZZd7s2 F1uCWLHx+Ifb7UeHwQNhia2hpM/y5EfF4p3I/LUju4lytLBGAMTsiW1mjs0en0dm3bTlyCmjyjDX INCKTBNhNtpsOTW2gzRdUKJdBSjqzRTIHQ2PsjdiT1JMClNzcROymGJBCAtRkYhqrETKgWcgJ4vx AdgL9oMsGHxifDR0qJu3S0SDOS3lgkvvokthOOS9Ps6UaKtEgtKHmyNChRJQekWP3epKyHCjtFCH 32QNTNNEwpEBzBhCNC2PXtoLjimCTkGiwXIKWJCKc3PhRK+6rp9o8CiCcIrCIVEDtJ3qGOmmBJ4b EmGGbpE9kaJUSsYF5IQEhAUhEbKQxUULAelE5RvZHYC/2DMuPOXxeo0x4LHmiXPV79Pn5A0DpY0H Ku35UHCaDmKA6IwigWXpBEH8NN+LTDZssHWi82n2QwRwVohF1sfz46rEMadQyGow2EA2AQ+UMDQS ba3ZWu8FSSLEIRuIIaMLK6iERipciKQETxqm5GkWIgPKqazOFumeJd7whivJoF1wETZR+Nb545jC u0vmUJCKG6J3ME6lx/dR/vOaxfSMfsUtFU0jVeUwarucX4H7GXyJd+PyIhKJkyIXifIIp4dR1HVE zaMEQxgIY3pXjt8gN/oDA6PRxta9GQfDY+ZhBTmiFB+NUMgF1Hh/FRNACkdDmjuPsXzZzxV4Jguk QsWNZ4sUYjSlWCJ+junuhNaUUV9BueQ7on2u1ch24MmJPAwgs+dJL3jekmAqJxM2CrKKpT4pFpAw cRLRIPOkGSYn1klpBq7xT1xMDI2zkyIuapn+sU71y0dNr5O6LEnaRNE7i4ysftxVhyb3LAGP76Vs RYQs5G2Dide1AwuNKoOxn1mil0i9cffJDC56oKL0CzKdnZPgowYkmqKJKUSVBU/5oORhUzsapTk0 dVGFkiqQ7/m/0nH2S++eTo6m2yzNxFL58niYr1SlL8HdKVJI6kfz/taHMgkgMTUUU4H3qOejgH/E T3kEIBzF8B1iUtK1iirF7pgU1YH5u2EO79J856n/CjrU/69P2XR28rcNZpdO9RTElj6LWP0ZntWW VSqVRKRYqrAzYEnSfmkHZ5fQAPaj5hDQHNcQnv/ETwN/SfZwKUpIzupKYHcQuPAInBIsOKQpOohv QMDHVHnX3eph/QkxiQVEE1aLncg+2f44bkpBE0dfH2FkKDp0nqnKpwBcEzgm/7OY3BJzh/X0Qm2x 9bGx/SUWtLC32yPaJW/T5P3wfIOScw+XqIROlZSWR4YECBgD+oHM879VMO5KU32XG4TxQ+CD1rVQ +3vPnFPPoU7/XS8CcSHKbiFWXoKDZCEZiEhBhCj0KMenwBeAYHh56wBxLec0kbdUNsA99BSbMhUx KMBGCyE+8entybj80nJNh6h3MBj8eo+t9q+3yKkVyB7rjkD7Oa1wjyAiDf1xHhpRwxVMpSpq6Om3 wR9eAN8xOehHzQlon8vUXvvlIfl5nEaEv6Anxz4wmQl2DzHIuIYRBUbBVDzHfnr2A2YiJNoFlohY IJIkUEQRGiShIwiRBwQxCa3l2caryKU8OHG220qnrMuFK2i7lDBOaGOKgZrIYxOl/n1tEnyyTH2x PT8+d8ibcbarnFgsUqTRhcnRano6SGIhL04mxJ4MvX+L0rIcmJyk3Zo1iURnEdyJJkXTpoNDuAgf VdSQhhegiloIUSXtjkhkg4RKMGNOwOIHaNETdCjt+s/atC8pe+n3avYXu9kqOqf5lFKj5u5i+h+Z RboOHCzqV27ffngnS86CJAiIDtMssAtDo4HIWX3fpqmK/V8gXSC2QROIifUPBEM4/O0vFJ9FM4uH LhozxXCyiOZEun1LCw8rRgEWI2DzliwetU7zWXiWC4h98zSX1FWQ8VlyNpEt5LG1jzSf4FI4OmJJ pDGTf4qXmEdY/f2k5Xfgy4conh6lHI3L+gxAeLGEFwmhcaX6NAUiYkFYBhQgom4sVICyxiqfD4A5 nFWXZ9Pr0fmT37OCeye3hOSmBJTNS0In6I8s4b4uXG6D1hB31KP8eWDY7rovUqUJpEUY+CIYDETK y9Qw9GT9ZxMEwYrL1YUX8jFs42YrmRwBuKcz9RRNzRfqKFwvAlOQ03PEWScTU3dhKFyY5RBxXIAU ggng9QBYYYj8obBwkNnMkNFP4Q6RqyUkzWVYerPCWVHGaSGappDWndzZdZvTWWuFJ4DuFPEaIxM5 JLUloBBsNBYhR+Bk8VsIKJ5Tm7NepHUjlmK6WxIcNpmFuKb3SWUysFNvAwIeDnZP0cIv7/xsffEr 3zZKas1xJ8Hgg34nhmx5v3Q8ZTMMN8KZJ7yFEARDDzgLyRNXh4tMvSgNBUTPF5HtAwl2FhQgUm4D aKDqa7ulA44qmtsRkCQJEQkCQJFWRYpFikUIpEZBSRisUWLCEkimKKBqtccg+R9puXSZmgxOXCix 7Sv3CuFgnhEoiMZJuEjIbbUOO+Px+fU6wXCpCkQGcTWeQ070JBr5WKnotV4mjLgge5QorJNqbMfH dHgSiCxVhIAlfAM5CaSaRhRAsNCSfnYExCRU9Kvj0nsfa6FQ4wJGQAkBkSQFBQUFBSKCgoKLIsIo sFixYLFgsWKBFPGeXy9A8fzeOwwnmUs5Z9S6RJZ+/jyfni335NIjZ4arLtD9/EQ+CgOBfo0qmCQR Mjl6iii1BQf3xiIIgkRGeX3SbZPQ5KZIhg4cHGqi+696Yl5uZkmCop3rqSdyRaf39q9cLsF9vxmY Zmx0HgKA7DUYueBsvSwgcSFCchHKAYCGRq2kqiqn8ENnYKF8l5OlHxDJMUzCXvsKNFKlQ7lTeh4o KgzL0mHomFhqQ7z7WfeuVE6GFixNxOyN8PYR6tIb9HVKTomGDIugES2SqTOZqKCrcJFdZP5CiI8h wS0QlTDQomAhAjRQBh2plYoOg7FqZxVAaGwNAm+TwMCiHIyBZzTCYcxNjqWcU3JgooihDEkoU8Jk yZFh0sQMlyAdxRMFHcQoIKPipVdDkzIUDQxUWA5JlsFhioodBNCcFw7ZIIBzPrTkcdmWgrLQrBRR SXS1tl4WIhyRomMSVKCiCyszKg4UEw4ORyNBDQncZJQOiEnN1qzpvXfTXVy6rtbM0bCauRJxTaSo sAQUTjeOSRbqX4/c+n2ff3bmTQk3vQkRzdyri+6NjGJBRfzi4yc5eu6xILsqUpS0SCzORpRMmheT LwdpeSHXCTJUtE+7uMAvEcPBtSZhVK579tQFslGDQuSw4fjzxvSxI8bPhk71YO9mxVSiS81k2hxE wiiPv72qUiQeBJtDNlVVQpI+Oa2INBPrOi9RbDcgSI0FjAlw0H5xE3RH/SIvw8a0BpV1tkGlzLgt 7FO8iPSQeYxegF2aSDCHCFBXQnjY1x9YC+EbJsmCUsp4t+GHgnnf8T8cCNSGX9Z/hy4TApSjy8rS eUqQfHfInvXp5sIL5OREHgGsESncfWA/q8z+UMGL3bDYziBgYKkO9dCEncJ2WLITJN8QwaNKwU04 FnzfFpFxCIgN8mIvSdKeKWPa6kMVTNye6JieovnN93/i/So2JEnzgEUIj73WQ39fKJ51VHsQnqLs snwNYJ7I835c3D2r0d/3dx+wPns2+BwPxEFE2qnqBxJuwj5ZYnCi8ZqhH2lNqMX5f4d3xqd7ScdE fOCdzWXk9pdDs9b6xUUSWZRovH2qTvEMF0vyiuY+TUJrXEuFGC0Nmt5ZS7H5q+Up/CWnWH8EN4YG dDWfU+ETZ3qLA15TlGxR3OxFwW5wXfzmwYdd7B+J62lMTzmxVGar+D2lRzJ73RXqjI+384nNJX8D uQr6Qw9nIjh7+4B8fd50eQEsO84TrOssR86N47Xk+v8CIT85DxQ1j+KnpR4LFkyQEtxaW5pCm2uR KWOsESDSI7CK1gnjhgYGGTiUgC7Hm9XRoPzRzB6tP4E1iVyHWKB7N/nVPL7QceCj869PgP09HuEN Hfw9qjwh2HvoQ5ESIgiIICZCwksJQ86Hb8Xyv0BQdXj6jFHga1wOtHM2kDrIw6iwNkHPzwkfSiem +sE2uzHKfoPlfI+BEHiKAw8RA9gYGQ+JQWRT8b7bTJPuwQ3Hn54eSwmkI9DwPVzb/Uj4cwIg9yBp QOfnoKrv0g9EGE5naWOUTsO09J+pEJ8vz6/qkB6jA7tYewuHmJgWNsKCBMMehG5gri2nu9vWD7QB yej5ANLjkdijvXeQdQoGxH+APbO0ar8Bgz3UofrUT0a0YM9lPhZttmT0STyO3+0sQ3TxmvzuT3G7 VRTR3xGEdZS44B5B+kYPrR6fjPlDLQ6dZUuRLEV1GnVPq5E3PkTZNH5X0/3TW1S99LPX61kyUW8F znEmInl+j8H3fl9jNtR8SflPtR5PUpi7QIfihJTNOQ+oPbx2fQd6dD6Yh25TmUoAIGnXgPgMD27h SYZTBN6uwlKNLDBMCWVbD7qkBezT7nN8dNk6+8Hm0oYENjEPp3ax9xKknsh9zLKDCJ0Qlzq4ifu7 HX77NEe3xhmj29ezKI8iH3fu9ZffMW65ZZVKpRaNYqK+729J0nQJsbJOZ4CF4hPV8ATyrp9aNIqb EzlmyqDRopENUUMRA+RzHlOfN6WBcB8qL0ViHM9QfPzRD1BT/0Pr+WZdpsIqhgf/i7kinChIM5Ez rgA= --------------070204040000030901000700 Content-Type: application/x-gzip; name="46341x46341.png.gz" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="46341x46341.png.gz" H4sIAIyNHE4CA+3cT2jXdRzH8e90gkyWG7IOeZlNDAMV8bCJChmrOcQxah5E2UwQJNxFDMyD zmS1LjOo6DATYXiwgesPv0MnCQZ1Ei+y1sWBBEpLIkayCKe/gR6Mr63tt+37+74fD/gdvl9+ 38vn+OHF8+P2tpbqqpeqkiSpbt3T/FaSFFYUfxWPXyRTvVf7k6Q+aW3e3XHq4sQPFcW3PZ88 HL6/svgBAAAAkGs9Y+eXz1wR1E+Pvtm+HwAAAMiFDRNT+55sAZ7zt3dWv1A5c0HwT9fa3U4N AAAAcq93V1PNzFrgz7PdlY4DAAAAykvhbOV3s9gCpKn7a/y1mXuBn6YLtR2OEwAAAHLvZyEB AAAAyLyv6rbtnMcWIJWQAAAAAMQiJAAAAADZseXE5O2F2AKkERIAAACAYIQEAAAAYNGNrVvf uphbgFRCAgAAABCLkAAAAAAsmB+P3PkiE1uANEICAAAAEIyQAAAAAMzXq6f3d2R6C5BKSAAA AABiERIAAACA2aofaDhWnluANEICAAAAEIyQAAAAADyjceOaM/naAqQSEgAAAIBYhAQAAAAI 6493xz4PsgVIIyQAAAAAwQgJAAAAkHd3a6d+Cb4FSCUkAAAAALEICQAAAJAXhYMNg7YA/4+Q AAAAAAQjJAAAAECZ+fVQS7ctQIkICQAAAEAsQgIAAABk1Nuf9j2wBVhgQgIAAAAQjJAAAAAA S+t84dJ9W4ClIiQAAAAAsQgJAAAAsDg2TXW+YguQNUICAAAAEIyQAAAAACX15csDt2wByoaQ AAAAAMQiJAAAAMCcjKzq3GwLUPaEBAAAACAYIQEAAACe51rbgSu2APklJAAAAACxCAkAAABQ dPLMjeW2APEICQAAAEAwQgIAAACh7L23tdYWgKeEBAAAACAWIQEAAIBcquoaGbYF4D8JCQAA AEAwQgIAAADlbHDj+E1bAOZOSAAAAABiERIAAAAoB4e2fTtiC0DpCQkAAABAMEICAAAAGfJi f2+/LQCLSEgAAAAAYhESAAAAWAIX9h24bgtABggJAAAAQDBCAgAAAAtn4OvP+mwByDIhAQAA AIhFSAAAAGD+vrnc9KEtAOVISAAAAACCERIAAACYtY+Ojv5uC0CuCAkAAABALEICAAAA/3Lr +6G/bQEIQUgAAAAAghESAAAA4po41zCUJGvftwUgLiEBAAAAiOXKrqb64kigZnL6vR3L6hIA gFLqGUp+255UNB4/vrP42PpGW/O11w9/8Ag3ZoxWJv0DAA== --------------070204040000030901000700--