From c372f2677d6f7cf88a8f26ef6bc175561e406ee2 Mon Sep 17 00:00:00 2001 From: Kevin Backhouse Date: Wed, 21 Apr 2021 12:15:50 +0100 Subject: [PATCH] Regression test for https://github.com/Exiv2/exiv2/security/advisories/GHSA-8949-hhfh-j7rj --- test/data/issue_ghsa_8949_hhfh_j7rj_poc.exv | Bin 0 -> 1959 bytes test/data/issue_ghsa_8949_hhfh_j7rj_poc.jp2 | Bin 0 -> 40609 bytes .../github/test_issue_ghsa_8949_hhfh_j7rj.py | 22 ++++++++++++++++++ 3 files changed, 22 insertions(+) create mode 100644 test/data/issue_ghsa_8949_hhfh_j7rj_poc.exv create mode 100644 test/data/issue_ghsa_8949_hhfh_j7rj_poc.jp2 create mode 100644 tests/bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py diff --git a/test/data/issue_ghsa_8949_hhfh_j7rj_poc.exv b/test/data/issue_ghsa_8949_hhfh_j7rj_poc.exv new file mode 100644 index 0000000000000000000000000000000000000000..380779b3e6e4cf8c8172a343c7eb4e3c3363c916 GIT binary patch literal 1959 zcmb7_&u<$=6vy9AoY-*^Kxw2xyA?x4C8v$8{b8?LgBna?q(I}CY!Xl}XuTQRgX~>v zckMQjxby%Or_|gkAw>{zK!QI33AjWYDP;BsyYK zii)AB`Fh?c>Bd$b2ia}Yq?@i|b$96|v)YzJZ>;RpY1vp@qHhiyMm2SbYKl^%c}mYa z=Y;c5#v=7C-t}qF@!UbXgFU0>70=>x7w`R#n`Sxh3THPM*}zXYFIXJahq<~ z%yJ5J3m4X{;okRO`P5*D!d$wn_0%}{H$C*dDPY2E}^F$OICkH*p8uGRkaHma8 zcMx=FwZ}YeTa-IA@GQsYf!I%MjX`P0?XkY=1tK*Qvs&e>?H1^E!7R|13iJBzf|<@;8X;jV`mxPR>8F>;%=JGH7=Tg=jb zZvgeRw>Ii@Wn;6kv02?(+o;EuRrOt1!a@4XK#FMwT8$K9Z=*Q8qlocW5W0DE<$^Kej(Xo{a6kAg4#sURb`6iCNs8>6j5A z8~gu;{s(v&CeWrB0FM$pN-!M8Ijf2y9Y*oTW6US!V_ZKG^8@6IpPl9apQpq8#U4`3 z;r%^|e9#OeW?`R5aOx;J?;qlfv3(hRrV?w@3C<*VI>Ffl&nB225qJsX{fY5K6Z?OF zkGSrF#l5X4MnzMpHdWEfm6CqOrpLDBZvno!4Dj~L08i4e>x76GiEaFpbi*19D_1WlaP#%G^;DQS zX~^hBfXHML=Fh8?Ot6MZGPwj&T_y`KTUPYEp%(ME)KXCxE}{bL4Y@zCx_H6;*Tk^U z<6SW~vt3`gQ#H*uKCG?Ef(8-q#ftg+`U1E@q6-e-`!+Si~ z&)Y%>gdyd3ct2cnB2F^Nfx6V3Qyt27)F;LIGSUy!uff zp?$j>BKVX)XbS|*{6hvo0zinq%!s=^;sK1Hi4k-Xg1(KQ=@4`gf+j-#L#JH?>NlNz z2tH%vcbXUtA&9uRdAa$)APzMSem)+49S+0;wyw4|P|FzxakK(zK_NB}7?4d`PYo!* z&%zE=a)&{IU=TYH%+1XU4lbcNVCx&qy7;m+&_#3Ur5ALE%?gED??FPB4gvoejjz4rT+?c6N8O1xh+W z;dYh~pdAe828Y00?cA>HU71EG1=>10L0z2TZda~pBfOHagW5QA0(CjHIe}XU<3JZ% zXN0(gH&Ek>uz^EdY@zTgmsBBcP#_Q73MlOeadibUOX{-#WgYE&AQn)B)rSbhE`833 zVK8gSs>n)e%d%ht|Mdj`s3|I|s{y6ewKUYVBy|+k)qZefKn4JIM37v?$V&MpYkP$wu1F)9$4lN;fjr5()8+0_;R<_7T#a|;QBcz_^~FrT0>h#&B8hXP;( zWCnka$7oalAm<02grMmn|A;R@0tNuV0&s)D+$ag(<1rJ#K>a~iAZVn-?=nbNahZhu zZ48|VK627`{R3C>KltMa8tn&v9zkOyeYb@OUjXJ0`fBfB{h$#f0Q-mhDndR1u^CVh zJZ^pfAn_ME=@%OC@Q2SJZf>N9-}PT!BK-M5_aXYD{GfvoG+F*1J^&tLeDnXx2GS4u z+x{*1E`wkLkblrue3V~k)PnEh-M$**5571;2K|@57{Ab%ztC8}(AdAwIKR-q0%QO! zLf;`m|J8M6-w*M-+U{5M)xH(x<`)KofM9fC9syxKo20DvX~05FaK zzN@}h<7F{}0x*F904svN;{E)Azyg*a9svOhZa!WJk2OD^g*8}!j~8lT0p^7YSc88` zUb%&QwUFN~l!`0#JcscEH)VYGZKTzin zMA5lI6xS<6p+Xh_U|y}~6@pVCivX^1f4kVO{-r_|`?XOVa1G4EBf!VQfe=SDY5-_{ z-Tk|N$1y5oUBDCq|Gr`GpHPnq*$_aaeKiS)Dfk7-sgR)n+&_UW6*3Hf`BMiKvMb=m zw^8YRTN|JnVsU`lP`HPkC6o%;3n}66YmNI)(#wA-7a@dymy3Q3VEMn3ixBhm?^Ds8 z|4}L$`CTgdb5ML=!NYH<=r=3)=S=iR-25XG;r{DHga|Mn0G5m$oD-;~r=|@6kW63g z);6D!S81hE@3QY^q$I9AD;E*>a)DSnK;3{AP#Zg#DBWIjI~~x@N|a8YPnBEMMH*^r zr{DvJYWt|^So%0v3R%&Ki(!j+341xYI6>VYKrbgpn5(dtC>`V~mkA^2D>fG$@SBL6 zgD9PWss>Qn84d;Va`JL=b0Eqr4=|k=Hc$j^Wi6~FBlklE;z^Xw*3HdDn2XEP)05Ma zhtnBu!vzu&65`?pbAiDe2nh~XZxh^WRn^~j z`f10>=})Fy-L#;84Ewj9x$1bkK)JM_uFmf8H7G)y{#RdJ-DEuwWBoC2|5kw|RMrDg zVEjpimE}MByST$0zs@CJo!KC88&W^FgN$Np?NvE3nTCpA^B69n-@{ra)3cP;2#<8 zPtpk8h>){_xIuo(|J1JYTkS62wL8OgoShv->HcXE#{X*#_RX_@EWNNI43S9OEw5tE zRg~_(jQ)SoCJp%(z4~xFHz-_`?jO7MFJiiI8>pG}5MIG85rOlY3`B61f&L<{0=0oydMj$^NXyvSAkG}3bSDA=AOQhM zerW+dAxW^5lnl234@f|kM}|)b3_{RX3hw-|ywc8&&TvG;B20d3`ku?LFhN*RT3Q3{ zY;EU=X!{;ITJlmrW&}$fGq{F`Tq1B zza8zweysvUxUN7P!Ti?YA0n_{>cW&i>cW2_{j*Y3l$H6j#P_G49*A)LM{bKCR`6<3 z5Qk6?sFfVt+3A~a-_Tpw4gm!}SNhvhxwe8p5Pl184ogH)%>e>g333QoB97_S5HJ`D z76c0kSo43IP~dk3R==$E_biIwAeQ_O*Fcs++)!>I5QinNAObb7G(xNdtT-%qEkPDw zJ|RI1ZXr6ZZxi;zRRud&H^fH&Wzw~wcmF)2-=`Ph10sV6LoD6OuePi!1Tnzx&H;Zk z{W`w?QY0gm`@3>aTPQ;HAE5s`SpJ8wtFyJ6Cj<_av_XXb&n>3$GbR7CBl4eJwzP%7 zY_0;7>&L7Bzc2gGIS}FczM#L(l1RLzu+<-x#4j@^>FD<7nY*f3gb}YlY!F+U!wPB* zad&j16Z?Ase2d;o^7j9I5&TOP|Nns(GQX>W|I-&Te<_1y5iexE&G8ko{EO>%2=H@J zMYs@v_t$k7LGaw{+#I3*^C;K>|6A*SSh})nc~$v1!+){-GiraJCjuG2ZHIsL8tZp9 zf2tAT0{q#^l~q@F3wx;Lk2ptE=Cr~;ArfJg?mHg;>9qZ43ka0<`i9xx&)*_kXupH- z?@XZod5N#|2L8EUS6I4|4Gx&_W^%y z{{HlHGQUOJFLV99^_K$-V%fj*5C|Pf1~L~PWYzk?(Y zB>wC7pGH*wY1f-ST8{sz#J_F$Y2@Du0$KkM8U2I&kEs9L$bX~`82UT0|7|0`vjO}+ zFtYeJL;nXx{$}IHUz@IfZ1UfE_21$BW+Y+%9X8Rpt=wmLaF3-&Rlmb2n-%Y4Ue_i!3z)<^W zl5}>%ru_n-^GJs;=8Gf3Kwrd1zpy(RnpltP=0$ER&a!P?2Ha|G2#0MLY%e^^4e^d8 z%`6}zqp@ioRDLSp_*VIeML@?%-_@TOiUfU(oc?gex~N~+-L4eTu1^9t-8*I^vxeG& zSIedrm`lv@Sx?O+&63>kB~Ive0B}x z)2Q6Er$@&4(4pw_+{5jgl1sN7H+$5gP-f0?H=5qv|?!{+BE9}64`do$YsJFT>b@$0>>Akx1alY@mt4I&<=p6ICJBn+59fe4CM6 ze!}z~zE|AErz_wQl(A@I#V^y?B+()Pnp@*_ZIAnMFSRZDD6dA_xLHgwQ*Tq*)io_Jeh!*voP<{@Y!QmYfxAcudCz@Br)F64sDRn z%(&M^sJ4Roe)fU6b>?v*@VN&rR=vUqkN@YR%YcqkVu_Q54qt~r{%$j%EbTUEj-BMr zleC19Q8D@byIB)2wUrBSr@l%uFn5y=i;8cqplF0V8g{yVZ7;B*%r)omLZ5$nLtSLj zK%Ge|^8oVIZivxa_tox=yM9DxXM*;%nom9rFz4{%n8?bax*I(}W2#u~DW1eilslQ1 zJ>V^DHD} z3j@ZUO12+w94@h!>(8*oh`xU0!g=R|bpI|xs+P$MhBdh-wB8zdpB>R13h0$Tf$8 z?{P+Kv(aQ}0zM+&K8`dY^m1f;b)b;Ao#0#VLMB>#$*VT5KGBP|sF);)!)j1yTV$nJsc3J(t?DKMgtvKfYJqe)gdgzTO$mr9zszv0xvhly zZbQ4qj9>CI%%#F%MpfFW8E*{KJRNpO6?ASM*sbCbTHfLsE7{`VTYbA;e2dF;xyr$> zz{mxQN4RE^(q>6qZtY`XQBl}Op05OuOQu$51uV7Kcz5jrUP4LbFQt|`nJv&{@ljhV zWX{Km{bc|nZ5K_Mz7nz-7niKQr3R@MD5<;e(S5+k784|&f%4N-wf#uWVg}{lak&}{ zDZ!#ggY;Ea!LleVL+f|xWz$tP4gHTJHnug+<@T-Oio(v5)<>1jdU@UO#y^~zqdfFVNiDfiw*2MfOT_*me_OomEB_gM?GeR+X zC-QqlIqfzkZ{qG7o0v|#?(Ayy17$29tS;9P8&cj}sWeoM92|Rb2S2%b*XuO{wNN{C z-*Rx0*>rq6+ho?`W!(?7S~q5jCvCrE;#78Jk(l8v85en_Ag5>rxmNhzPSQc8ddqnb zl!=+?cj}^aNTI<#_;~E@=UUZd0Z(oP?L>cK(oz3=0VIl3%!<|mLeVyF)bBUQSF$Ca zy0RVuw)<=0!xje5(Zsq!#ZmaXEA^jE&O`ABq&6yulE$FyZmei_c zA?NwDc};Ysju>56nzow@kGKKR(pQ=!rI$VT>M9o~SkJ7`C^MvIKebe})h^+NbudN5 z5A&;g-3saAv{MC|>Y(DzMqKJniH;2UU3m6A<7eA-hcjg9ToRz7Q?hP$j zZ#gKdcEl5wdUGb<-F0#NWqS5hwD8%oDh4baSC23Y;?oDdw>;s3Z?-XVy+7gHfyFWID?L4CyTsx@hoVLwA!ANO9MfxzSVp8kS2pA~W?I?$J zT@Za1{tDq1UgN2?46dxW9h4}mp{H#5RE$)S%40V}^Lmy)`8-N*{CGm3bmwO)8i~Ta zR_|e}2B?KxFhi#d@vMhDk>l+uLxRDD^hpBDIP64&2)SjqOoj$K-liL2lC8-#``Crs zwdE|75gppR7c^q6h^Wv=Wzwdl_V&zDagRPOz56lo;plM1Om;hI86kascPMOE`Vqez zx@D2#Mz$i$O4A+K_gJ|>@fG*7qWzZ)1|(+rGu`@m(T->~HKwz)!9uYahzc40dT z17|0g4|Th%(R7SKQSJ>>Vu}8Zc8lH(U${vJXBrEuA~_19oCPwD2tK{Th`&&2IqvA- zN1M_X_j6VJ$uM)KGGv^4To}p%6+??b_t=sY^F#1BF2i3>5{`{v>5>@kRC4=gCGPIMKy9XFE;(xm*?kEqt=7eC4e&gXzGGrv#Hm=+`b=!M>XNUmh!0*XM0A5W z4iGvgGRNqjLm1fTp)7k#yl&5q)YUpfJ2F=wSc0@2J6(sv4{c4_t|>D#yGrM6dB?h* zgT3;f%;WdtAHsvp}ByHm#;&~xm==M34mf4Qy%^6EnkDw z#)lcVSO-GR=SPX^=0$AK1GYd8I7imcxw3wa})I^g_jtQ=2c0%B+89FZuz>NrkDA3?33M2nKv3t z9&H!K5>M4V2bK9%HG%QUf~K;>LSqbHO{1Dq(4$!T_AKJGw~`mV34j(^HjxTP-0YKa zK&>La5q(ijhJju&`I(}D;6PEv& zEvlGlvapP*TCxsd32yb*tC6*(Jg8r+pK=m%9=UuCHMD#z!XZb&jBVOai!VE2JbVJG zmR2*qZ(rN*=aEE(rEBmq{uVRxHY+iC#m)uFx=8PeAHUz>vn{-M<%mbaBmw$4KKY-B z0!^Z{pArfJT9i*$FN*u#4~BK$xP~XAXGr*BhCPp6ghS(NZ?Q$TuQ^K~L&u{ho4bw6 ziU9}ML>B17ng_?pPp#hHrdg4}<&WXkc8S@CT8?T&7@foxXdX5@m>251&ukm9@ZC=4 zMSCsr`1S*LTiH8O&1AXa6i02qf?^~dysSYHpZlg}3gJe<&xAeiCvhxkk!|UoW(Zwc zOOs4c8Wc$4pc}u$GZn?e%@H@_AV8srmMBX1;pwyb?--iw+hcbF?BS(W4rD3bh1) z&NDLkwvbsh8jTsQ*iqZH41Jn1F=jpA79ue+sLGN&ikm5$-JX9VzVw8zYN$N=! zL_Wiwca9!=>% z_X$MBAMNUM@-BHqCZePGWwX04M?`Y&tG3Z#r_kK!t!at6YukLDBjJrujg;|fn zUWu~UJ=d8#;2KaiIq_25A)?uV&Dp?qniyhjI7YkF*T3EkXMjHzeZSwGz{qox`zxwt z%K#_)BO_ukj!<+D)4JRo{_RawHnfL^8FFp}?tm{0IOQ;Ui!(u`nfKQnt@#`wg@y{x zpM;|}W#5{Mqk;Eb>SQ~grW<-zvVBl}NK@IzusTBEify_|R^1`eY{Ezz$lEeYikfEr zz|%8aUT-^^u| z?LZ}r-VoPkN_A^$sm?ZB(!FkZACB+wSSi~~LyGMhewXMc*Pw^)t|vGk4~8;-$G4H-%I@E6_7; zkBN+I-!}}5ePoFpbQ}>Y7Xzk9x&0BD1zaxJIis(cue0$UrK08_%S*Sam+e);>VR03 z*t+&LOL`i^Mq#AZfE_)Lk1BCa>;z`lM%WzkHF;oiea$hWCzo7wxS5 zf`E3u7R}_%Q|(JaU%xvKY5nBr^qj`$5)bSA-^?YfPfMy;c?Tb>ZHl!E=T%qhgoU?- zt|L7*EreG>g5Ayr8WdA};;lz&<({aaQ(#A33XoMG;U2`!>8`wy8##1cKaCe5^(Rq! zHzZZ3YHMR%M8}!6n5Jwqhfa~!6h@^?uB}mi%?Qdm+Cg6LKDJw4A#R96={WX{>pY0vMfQ6FdG#oHx9k#9D z*|kL5!ZM2tfC@z7e#Oj7(Md)#V)_hj;^Ze81L3zyEHLD`!$O!6d*$?SSdjy~I@72U zr7{~6P3np_&+m&0$JU8BF{4Lo%DTf)}$<+zvk<;(+M9dnUP^iOP|85S>{=}4tZkZ-Q@hJ^ytt2qSiYC`9?Y6+o#sfpBnAh zpU9*hfD&z}&OPoOK5LScu-C-DFw<0McOW;cdua?3n_l=hviW>|e)ob!e;%iRGF4+p z=Ka^2&ogIV8$^$`UZ+VrUE*@u$Q(B>Sgqes6?t5`mus4&_}nqN{uI@1C3*BMTu$nm z#h_7@<9#8&b7tPqesrXKF)@N9&?M>y%nmP!Uc8W3Ot>#pb#((+y(o##7ke;SWcp(D zD>BwO1f|dV>r*KX&{OR|UpvePKaw1ml6D%nF#2s|PB+GzI%D4BrEx8fWDLW5CdZmx zEu4Pa=8})bcP>CinE$E9(Ug;!h29r|VT;}B@P^?Pv$^G3q*eXNu6j5H0R`bllzG%t z^n4n<-1tqp55pqpG#zxk{oyCq^{MTq^|iaA$0Kizc3J9YUG$0G!^K}pBOnCRoYA(v zWFvOWl+D?MESH-VzaXV5KgXjehZFq6p#_VuQsPXr zvg1^g?8VVpPteg>Y3J*>6;mmnb!L%%eVbN1_vUgzI~ZuKB>c_II>XrAtjI_$_~Y}c zyEXTnBSdV5dX;T0Q1OdcE3J>1tek-3&j<=I@}Zf=i9O|qk7wOqx5aTqa*LzVlE+RD z=V@`@d!fV=CgxPH4%6OxOpIZqaeVaNR2bWnkM~H5B(t1>{mnhmkFaaq*w7(@()vDp65X3YpBY4if*_sV6(7J zD$4Ch#_!=Tzg=sg{Zz=Lb^Svdp=-#)yVy()9?!%dFXuQE@>LG98_gs>RA_J+Pj$AE z#jZgW(k`A}lwAr`yAgXVk{7M|R$3%;ktJ})+n93SKUs=Tvv0ow2$Nv3un>?O*by%5 z)acEa#!+lL^?&AJ{o-ZVdUAVz$aWt&=`LlHc;^@So8rw3o~@20z2Xn|koSa!aOZn# zow6;O>2`TUr0>_Ad5Nj6o3;QhJ2W2;RH6C+eZ-YL2m zftGTVfC@Wu2-*$WvQF(|H<@XfaGi7cDv<@x_s44o$zFmGd)jM;G|E`li91^4pBaDV zPw9H68I|ykPuTNb`bDYY$K>dS)!Q+A?caYUp-JOkF??-ih}q33#A+-EMsni(JKf zB>YBh)z&4pt0MHqZSOB3G)}R^SQsIncNjTSPG#`j6Q17K#CWz{awwg9w3yA-TY4!K zfRQ2Z1gGQUxFC*irA(Dwj8y1jgTLebRFJrPQ9*T!s-W1-SUi~mnNIUV;a&Weao>fM z688#IV*2(#Ig?KlNI9y5na2lxkayl+-lU!}X4GL8jZDrAnCb@*J=-BcbGEDB#)`jZ zI(KB?9g1gji>h$>4$+PlypV9{NK#}m7U_#=(82XR5p~#YXO0o652bzdP&zxBX;VXB zLst!<{L{E=E=S6fHwbJU7mcGY?H@%HY|Ez?)v?ZQGI)%ID=M@l9bm|V{DWU6`5TuB zzvj`R^IC3m?BDv3)%=N~7Ox>1{eY(PrfpU~L>W!vQM&OB7RJ-JVXC-Wp0+Jvue@$?)S^C%%9Vt?)(6&|hQBQbuEZG=ZKGgj7xi+4DU; zauK-0aauhQjuE>(GWBry30Et4<&M1vVC9T?2uECxC}JpQWv!{OC_Vn}B6e@~XKe6? zQq55ef5W1ddvbflFF)Ngn`rdYn+jy@8;Q6!nCE(KR;e${uTn&@lh{GvgMI7qvvBm# z$cF>oVq!>db!^*A&IY2Wm(}n@#|`gBZj|s#@1>`+YAnp@k`NR|Iw3t;xTMn|>c*X^ zS`GZT&3*4?1>#+z_e2U?d%a3-d{l&FraYEue|yiv#EO2*PsNQ&1eusi#mMmb-tG;>Tx|M1M(i)h}h7mLW}J8~aLZT1eL+8Tx_&;!E8 ztzjvt%r|hnjtidZ;wfp-z)v_PsBxRvg>Uyh_2E(5AYE)YjolBJKV4y#_*kcWJGzK> zyovTWHKpP+M4xW`u7S5}Eni9KeLTyK@dF3)r_WuGJa^_``6Fk|7jjPuDFtltP&3}% zR%WRg$%nsrNvPS+L8ZsXcImTdx``bgDsLy3CTONsM8AIG9$>xN=*vnao%h|H3|^E}*pR%=tc|bpf?w;{!?3&AxDtC?&#^rirM}6& zE55?-LpJz1Q(aNa@O7OM=)M)2xytJSQh)H9paFH?ObfM5b%z6I!}3FW!bQ_CoM*6E z^LPByVTqEedG?*?2QH7tCFtx`MNiX+z3)v~8sX>PsbkKftXw-h8GVRlc7F?fayP!| zbBH#w2T20S%fmS%qOoRF!KEOWjYXG2QNdB<6ZdH#a9m>%D-aVrmU$Bwx}Q)VWrR=g zwQV6(p)0RjF0Dla^w5Z;SPck!tZrDn@mPC|u1skh7M_ol$>AExa$BM4 zg&%56Qa{F9pO4HqaJHKgGHFec1IN#9hu*KHuZlDku7RvM`>uF%Lmyh+j=G=^iVRq* zenho2Oj1W+vxb@vPPcs+)>eIPQ{}DN^JQ6rZY2IDx-6CSR~d0(7S-8MKO9nJRlDk5 z3BC`)$CMa|OnnoPsXGyw`o&md9)D<@1FrDsk;AHD?fI;UEGp`}4Z7%#&Yki|-@dOE zL|VSNiN)ac4b=pEWObj#FRPgq{qw2bJuJMHs`}G1#~-)itm()%&K|wm+EqNz#(g-A zhQ0=jPM_5}cvxQe_?8|Pyvo1sGtA&xuI)9x zV1{$`Wd*$JfGu!vb#Thg3~E_kKTZprZg?m8WxRIoG*z@j_Nva;JB%Z+B!W zyd|POLMpi5qHHV2N>bEu#<#2V3(vG z`^q4a1ct*DU8p;#wT`3zMw7XkHo2-yp9{+Y^}vp*R+QF!C8Uok0nfnNpy370i7Xzp zUy0W3Blj&feQfuhN+(xE!b#x{8vB5;zzU6iJbrm!y`rf;&Q@-%uyeJJyOOvr!r8ZK zu6qa>EAK)K%oE0jB2U%Jjg33pINVBlEhY8SVaA!IMe50Ot#6l4g4L~RJvppg$~)>hu&i|0|8G@ON(N1sW_wLqy3Im z(F)uc@2}68&@5?uDlgb!6u9m6VN^(jSCH@U4SKW>W+<5v8v$>UNv*o-n~`0#lKe4B zSjMORESt5M;hp%K^R?B5mGwKGL^RCWp#HHipwWP?UXN@~pvH?h7|k@+({5E!AJA7d z8j>yOgTuZhoyLwtW`137&v8TW&ReDg;bBj$lB zaV%qu;#>{cVXK9aU;!c5tQO>}GY-a671)^iNK|bxzm;nEVoQbSZ76)OfHJMeG7OC2 zI8dSBc`LTy(K}yJbY|=5ZXWX7XoZHG%N-W%-t^R>znO6D>=(z=UJ6o=kC}K3K9}|iYO#PcET)@TtLXjNJL2{&qgDtBw+R7g+7@8zel0VrfB%q zY*RPMn8=u;Vb7Q1`6LMzAug47Eh}la7#zlg*r9%}_}UGi>lrd<=6v&!y`d4ywHcJQ z+@lQve)4XZ*&Yxp|HS*Rw36Dvse9FMLH>>oZt>`AsOH8Zr*z7(Ty3VOm3K0}gW!A14YU)v+$9zHoEif-MSh!35fYn$5h6V5V9 z9lK;@J*be!tcOWvb>aaT1KpTKv()#-KRi7& zS2c5a%pN^P#~j0cJkmTCe)qviYkTC8%SHHgs)l}i-ZB>yc^qXKibPnNOa`HX_w6_n z&y#mkGqyd=VjDMOcI^8^bV?*ahp$=D{n_u~VHjUl=_>K|?%`@da z8GhGT5ofNHTwi=i3ST&HQvfp?XHp5ACXXW7tMxDz;k69ho_x~{&chj%N>{zB5DnFF z51rb>VI(C$1L4Kxu7}Lump93C5tDO5gxc%1#!^#pyiBg9HY0i4~rZCv*`hlo`X+m=) zD`dLNNa~L>-9@#07blZQZwVQZcw_Wfe7E{P&j)O1;14wp*hPWK3zaLQIJu@kyr}UC z%K7pULlG!wBR4m6$8!bN4wwoH8`&hYbqFVbqX$u*ddgdim7}!9BD&#EE;UOzK~}UR zl=z}{@85}bMKv~ur4^QpE3RnRO9w_y8|9s1RNi7(gC~>wKY8zv@WDZZkKbpUA(gB) z_<(k*KgM>(i8uS!zG8V&51mHR-diD0tiHZ58ce3Q92PQ`yEsCZvlp!znsgpp9CyL2 z{Mce!T;mCLr779W;UwOrRdRUzn#z0vhth)#Q_M@7@>%>XZ%-6zWV)gX(uH0*2)+tK z$JMC0TSN?CmiR(E%Ot|Opp5rsqcM+}$K5D)n#O5M2c+-?$;9SZM>hYi>Zid?cMwKM zZAI_$y)A{=Y7$BHr}FZL?=bn|sjMT$SIy@?(L(FYOCDl_!Y&D$Jatc8bB?<;AvEI0 zP67E9yJx=si%IFa(g_KX9EIq4AEK#yl=3Le0uAbh_^xI77+EUhHL$uBpzTCFyJlJ1 zku!R0F*|yPF-@UClxNoM_64Wi`+5plUo^_m#ATuPb4cb4(Q zr#bM6Vc=JdZbobOun^rG= zWbCj;?KUqW^ThJGGI2*4M!Y=U7W%M3a2$*WyDUg#{priMx6Ak5g*J44+<_LZ6+I3~ zJ-y=s%uC2w%0HrO(aTd`ycT!9IHxPiC=s0C;pUZY|D56dC3~3vMl;Ot+>}l=< zmODKT9@=Uy^#}_~X*c||KmVekCR{ahl0Rq3ZpE?A8BIe*Uc82iQl*UNzOKN8XkB)O z8Gqc|mqqVu&NvVa0D=6-SmOm&mwB6cewCWTgvfR2{PyW2#>D&RI)&PWo)0J6o<|Wj z=-%H7f?0}S9@d8fZ&HS|$YFmTjVA13-&LJ(SWq#^>F|xXX_`g6sHt}hUT*PmEjkvm zU(!;}^ErU=v`NySh&O75pNQhv&$sFpSYz+kxcSB{o_FM;Ol$;GG7pcpwA4y3PNK0| zp1Z!h&Vm6_4M`DfsGhiW?TMGeB)ya@OqEE?ourb9V^c?{uq^MXM|ZPTW6@{6y%RG{ zZdsC7_9I_kUVq4`2M@7K^HR>Fs5QW)BXeO3_tfkzt{=)SIggvUx2WvxL0vY-?PnB1 z!(m^s>$m1cUi@l^y#!tr+w#n9S3Q$p{ zT&QWpME0w$d{9s2d~mXJ`yMtbhU8#f+-pDQ>Mogmbt{b%*Mv#Tv?QMV%Gu9d6}Wmh z&%bU12@HS)nI<2VbhjsAgi4DTk+{Zr(WhTTKQK3qZYW%e_fC+h;;~dOV(|D+j|h?I zJ-Xyob>t`%XqRR%dFylx^B36cE<7{J5qFXr^Hy+>F((o>ptV(vhSLWNH81oX8s;X0 z`yJFy10gx?6D<~ln#}-?y3J9J>E{m$c(=#oC5B4q;mMj@6i-g@V3e-s?`LsNlLngA zvSw@g7nI|d8TF9^KYhJ*rdQ8~#}C_%zjbn+3lF(>z7*eUnVJSwOj^?f+fPr^9hC-x}QDBH{Ipnzzv#r5`)f2 z$ZQBHy$K(aUJo2AVSnjOVLU-1t6@m}a6~F9?2;-`M_0w?#OkFgQ?9}WDXTS<*L}2j zyX)4fh@Hw@IDgH|z1Q_*g!yM)T~r!K(}nF|w@NW9y~*s!l{b1CK892t!`C~EbiKyh z>&V=uaq)r2dG4R8gV9N>$)#66IjuRdOd?SdW52m^vhwj+nz^3Ia0_Mnn2PU%CP;e> znb*R>G_4^qUO$tK8Xg|=eN{{6rH}8zZs8+~C(AvK#0IO1iW^)iX2fA-T;hdT+m+Ax z8J-^8{ou*yt28gT?tBogCcZ*;fW~|8OH4%}ZPVN|kq-?QZ-m?0-NXQCEHAtZTPCxM zP=*+!#fw%f4nk47GCpE)`6l^m*zt^=Qzquf5Rcebatz9XI}CKYH!L!lAHA&DjU%QF zA-ys5g!xi@7D@ckIsX~#GqtC0`Ivz_qmf#SPFX7)jA~dY^F_9lNl;|fRKCbyhLEPw zo{`~P>}5CSpk7=L{)&!nEfDaD;7OFFxoZO5NnWAyxJz53N-TA|K+N6eVs&?#Mr~_j zYt)a#or;Gf_ktUS$C=;USw`I~!FWfIVp?^3#npNn|5;{1a;I(_(qWzI!pO!8BC7!UPxFqs}bfK{f5=aD|1v&6(5+jLd;f` z^*LZ3lO(UB#aS39XU^;Ix;jru}z(n{eDr7+OEsm=k8Y0nv#w%34TMsqvCOmf+>rhYS!_z)Yg z^4QZ+^L(lOy@Mz++IHC-s%eGVsh27-8svj4&qgHWmN1_ysCT!P z?31-WdKeUacdO!q{(5&83hzR=;^EAbzGzG!TY*5|M4ZI)@x208LElgB1wao*JkUd0 z(l}>SZHKjAkrnG^(mlbYcWRF!qIKl29H@f6UlG@~Mu#(DdS92iygp)ZTTMuP5&Q8c zw1MTtpn5?2kZ=?EAXYA_wjUt4Qf$(CpJ%=5QnQb4dvyF2t$OQP6qkl5~6!%zs!cqKz zLF?C7-qD@yBnixUEpyeK*@=~-=*9|s_-=uR+oZj5+m`007rp*Gb!)|i3GcYsR-v`8 zi%WcGx4#T{4@9)Lugu@AuhY%Y6u9Xr?n08sQl?hjA^Ej>eZs4U;ii?f%SI!ajGdF9 zzKlFgV@6ZBD-*mVtd8ie$`pp++|JYdapQnvm*aV%eO}KVD`uaR`!{aT`h@o8EaXRL z)ixDv_8r+E&izDfXCmcOUk#`ko2piF1Nu$thHp+UA_LGqYBMa6nD64A zh@2LQ|1jm`vDzN*(g=T6dqMZeGXwehht8yjRTz}A&xCUPRAT+@*|w4#Fa+H=hQD^th?&8mz@;-~9%V2NiLIY%(qa@WjlZczp&0FlR| zYW@R}_Z{cz($<`UPAF(wa&MP%MIYSIyJ`09WNNCq6Dzt~`>{;p!@!S|(b5eXGzD9m zTe7XrZT)h73hx8x>7vlLuB#1Nf8{{@M}YW?zdSN) zG0cf!vHYCXkMHECbpl#rpRCohG3(2{Ff}5=u_om#f9mn^5mP9ZX#L>Pxo1?vI1RmU zBW8QxL}8*ha#R_kvH<28k0Y|L;Rb2sPN`)?RXw(B%y^P-W|-Zph;#m4Dy8PlcSs?G z{cCZ@Vgx9%IY?~8Pi59w%i}0?x+QVaF?|eQGB{gtlzBKl;1%U$`;wh>jm+>t3421u z_NTJfB<5c~^PT2?e-vr#t3 z3Z3p7G9dN3#yz(&h`W)mvefX@Azp~|9SO+8&}o$U?eGynCGn9xWei4zgw3WKOJ_y6Irxk)r>d+E9>pg&_gQ(m&X6fVo$zJd%MYu~87J+&7tH*U~$_S~@ zw&y$cf(o(Uqu!5qq_=4anD7S2E{Q<9|&pq6I8~sDfjQPnO{4Zr+@*^9H_iWV>3?vRom%q_a zY&GqN$EAfw6!O-i2xpA*R{P*?k##rf;C3v1%&iwz&>mg#CT0BG(7;z4TQ;cjsCMM! zVWO0jj?!^?F(Y4;?o&p#0+7C~U4$VKiPz~NIG5{Ah44qBV^VLk)!gJDAshh=TYia% zG%CuT>B0G|(d_0+N#tG4QLKdK1AlE?>mx1|*tY)HAKp$!wg%4-ze>74(H%RkG^G78e8ikF_{=DNljLYWPEqCOhRpn4tOL(O81yFYu#J0@@!{jP^cyDNmgfgetvGr;*#Z&!JgXn zk>~)Iwt@c=g=~nhPj^vRH~P7T$SWM6Yg9KGo>*<8++xTs#&*HIZLK_aOa8q#1er>9 zUUb*0Xc*Xa^d5ZCyJc~Z<=i!gN1TAG(rP}n(X=csG@l+WdM!{iOW&=|$VG*E!;Arq zn@)g1?uAC~j1S82xy8YA=61#d0JjAyTah}0JRfWzOf}*~lN-0Y+6+dF$&1oA!u?9E zPl1o7IxKZ#V_+AK>|Zmp0gQKKt>Jpj>plGU6)a0WKcE;xGrCE4(3~!EHbeUuB&Mih zjnq_?y3zfa$|LhmlIRzu2y-&tjsVgby+PD44@}eat)r#0&S&=;aj|edyf$}BUxk;2 z(YKvu>G5f-e%{M3WvDxB*IfFlk;x$Q2w&6Afu=Bt=bwU30bgQ+|XPfX@k9&~G4*PSCW@LXE z@yelG+xL3Kx3r}1Cb%((b}JH)*5CFfA@dRP(2awh6}NG~)cI;cgiVj;jPu?pk?&@M z4=!)Ou!HFGk~)X3y`y;Yg{eEPzH+&HUN7MP0VP1%zaP+CK*027y#FZZsTrd9JZMwy|-izQC8mIN-VIzw;-xhLqEXNOZ zn_)FVOe02#`zLoSD>p2syeP`qQ{Ih?I8?+AN?=tOF(=`Vtj8sgp3lv~layksOn3m} zpS0)qXU4+j;V(5J6XfXF9aFfO#{)i!Y)sgHHq$s|A{7gxw2h)ymWYrXv}w!)eMQaY zM^~Q4M0+_6f=JTPzJLqnf>D-U7`C*lbfmGMe4qs9X_gT59_;0k&hA?QDOKEi=)s#W zjjfI!ox>>U1Vf23PHFWJ)T?<8!-ypEUXbMLgGZ(y%B72WO0d01DFU_h*roVkNU=3? zykON_K7WY+ff!(u6|}J!Ju@6I%GwGeb5Iu4 z67LTy_@@w(DV7r9B$;g`Vm6!Ez53%iX+qhAyFXT`+ucCJ8Nn9Bm&3y0Z%5^H_ilYD zunrwd)9H)M5U$5u0_fTj;I^jNO!^2!lc<3q_o)fzgBPLuDgL4YKcm0lG>QSV&Wq@1 zEyadj`BTm$thBgtQ(pQe1+@h}E~KpOL&<-??VK#w2jy~p&^8i64-Mpi|8>ON=nxgJ zH%zor)E7)BdD^wRxjMsX(Q)@6BnM)FQXUeJN_u8SjpO-h^h}9fddJ2Vm(E7WADPEbaV#$o+$0B> zhInLLzb5A8BodVy{MW9gV#rZd_!Ht~M2|LW0p~~kMLmC}Fwve;*m}vIrg?XL)v%N; zibJ{yKv}C5Phtq>>i5s&<&usn|&cheQs9>>saZV)Z&NNvou4XH9yc*WJM`hfDv@_>!VJ{ z@Z-x9|8XUTJZ!u2xrIRmcw^|Wu7h%ju}H;6_?-m~&p-ZM5V;ZlQXCeb-T-?hzLh-@ ztpqntE@GQ)x3NN;M5Onv6=9wNlHBj`voc;cu6t!5*x8?RZk~gRq0m)$5P$`tdV1&_ z>&2QOIJ{_!lyEyE)^yQ`w)FYJTlV?+jtERcK|syOfT<(`$SPE$N{&^R32%_ik4q(J01f%a$p1 zR*dO1WpWm8#p<_jzbX=t3dxy7iGtd%nc4XRhdD1s7ZaL>A}IcajnV@?6aQ0#fl88# z_EG2%?vAp{@DQBV8v%2c(-$8ErKWwU@8SWA#kDQB$gQ={Wg{=viWuQR+9dG^$ z2f}Z zfw17sc(Ng=e#g>{zz1p`iTh{y8Y0DY;=IBlo z&UC*F$SW~AYwfLtY~Br?%|@Uti$UTQ#nlwzYnffjN7T5vaIWX(KY zeAE+JT-qrxf;)grX&ypK3jwyzt0+4z_VO%aws&}1syDCH8Z#bWZ}n?#8ODc$ZN`A{ zm*+I(Xp<1SxwgR>Zb-f8%pBC_o6z&*JGqk@f2|6nH?5tXF69?u;;P>OFO zz!4nI8>dg9`RN1f+I0R6;J|Adnt0+cUejDVBp#ropsW`1h-0+jl(LQ7~z@ z`AbK!es7tx5yqOyF>lSn8u{rKN5M5nLk-5~fzBCRHCRy>8Qm|j#L+S$>gw;->lY`R z&eG4A*;z~Fe}=zmY13e!<##-3sQ6=I=9A+w)dK$so7cOzfjZojVwHtm?+GJO%J7Fp zSBg~rr?xRI?dPB)oEbIY2Gxx7@1aL+?y8dbFvM3fO$ohLldyM~hu_{!_-~pIQ^RuVZW5>6ELm+DdOYdz+Fp)O9l*?{tBhg8O)w$ zXY%Y1kqwCKghF4WY@wK1SDE1uhkrAVrjsRi_uaUlpl}=2&<3xQyDKF(?^9kwXL5(2 zhlr+LYZ!~@d4~98`v^R7QDt~VH4SyA2Q`qGv19^vl9^LT;etx37XK;$UA`1OEy%L< z?>y74!>YXv@?#x)!#8|mK+2Wyrvs~;nZ)lHvNP}mh79A)tQ^Tf|3 za+Go83BH-Fs@RDoceS5!lgU&yj%4tPSPM@Cp}l}7pq}}bQlEM-uoe71Di&{niAbRL z)D|Dj?1z>hq-ZT-}Soe{uw^pW-QR!ADIk5rsl#Of*ZPz@;mDR)_0ra-2giXt{ zdhs1yW34Fz_7$^Y3cp28^C_$12Q>2xS*b*2Yqi_Kxd0w#2Fjvkq8mFt*yjbQ0oY7u z-hXuGT!?jWQQ|I}&{Qj6*@hp)C96!9;=D_rqCb@GP%id6YK%Jop{;ACubA`M9RRVU z5w)@~An0wq2irbFoY|Hv+XKVH;6IMvqnHzTKgpjsv`t+F)UQ1Bz=PZR{^#(iWcFN2 zER{lb+5010k+7(sS|hhCJ7(@`CQAF-kAg>ykR|vOGxsMDQGaep33i);#Vwo#<{Rb9 zl3cf?SHilvtau-#gNXE{x*oi-+6n5IRszxb6jx8j?q75y@%oIG6Ch%ySL!bhB$vn) zLwzoqqZS*?m4b}?My~N{K5A00jez-Tn?*Tkg^5OxQLR=K>V!#;PIc-3M&mMhu&Z30 zkkyH3w4Xv;GHmSzdf9_N(4ji^2IlGlf@c8zb`W;qF2I6g-DY-VM*GP&SB(^1FJE|v zdDgiq0kg}Lv`ljIJnP!Ql>a#C8bxGA)i)*ntdZsGO5z;F5Ntd@{d7X0zUAA4uz=?# zWW3F6)iqfRS;vuKZY^K12~j7{a)NRQkT) zDMYzHp#d_l7~lb7L4M>W+JE>`eB2BczFfmUa$ouWol*sD`}(V6=T*d_k)01WmWbO$ zV7LP^uyvX31;DIw)8TXfS*WvGP{Yng(GUpJ3ZsNXT?aQ3oW2w%-+Gsi`cCJLCcV{k zFA9zvFF}KTy;$}{U6bB}dqTz&QrO;hLkR%6aS1^_RoU-Pg z*d)TL1)(9RJ;<2$d8ffAiH^2RF9`+j)*y{m21h?`BM*NbF0w@Jv%JQVrG9$0xydC$ zI5v(2-PcPG{d!9X=bk}+@3>!hDbxDAKsxpzh3RU7G?4wi`RelB-^I$#R}`u`324I#zuKI?GN^3=9V!Nkjdwj zq0usyIC4c(kcoQviuYevzjIRG1~WAP7LSjIT!|kfZvDtO82PY_#zr#)o*T7FmCiI=sdBBx7?qWS2r zx3S5w-oR1P7$reQiBg$O$CGLDp)xeR%Ek^I^l;9-zZDyu&&}4Hak&-}G?~~x*T&cA z?pf0T-BHiZ`d{V#3@J09=9!lks~-G_Ki*`%F@4~*-5pG?RMsnwM-iUo_r5H^NC)pG z)V?#e6ujAVTJj1{4{J~gleW}|8HK};iu3KGQq|gp=X;RL|RU-!4LeSa2F-#q6aqh@nN&K(l?B282Q!Jg%wV z6VQX(l`uB+2_FpiZc&_n5W)7{%;!~`m3&m9%~!hyHZNNrlBGnm7u-krK&oYc+v6C3 z6e<-$LD}D{dcf28hmkjxX{QtC_JyNGaANM#zi1F_)F+nqq{F5P}BPJzI6|X2F;#!LSB)xto(;g32wVPZ$pOTav0y5jbN2OMB5zz=*^o$j zH~&H>E*xXlFZQN-6H=eB+i!XI_1u}?HqhLUXRr@mI7iHAaNQK?RWNC}!9B&|Q$n*T zC5KQyk^G}TF5orS*P^a2EB3Y^e{o{-^0+m$LOKGCmM0;K24H9H+dCwg^s6nztg!T! z$Z_v>Xky6>;K54MUWjy_A#V#bV@$pffp~`~+#NX}er*CDz?|+K7>AmU5-E(vh%ckg zMfL61fz+6RAXtXt(oBmph*;Pijqzjd_NQTb4nG!da=C({qt!VFY@&@o8 z^>k3%8V3(y9L%&inzQmt^aB_++I1}1YV4p&XKnLoS1Z3b)|=|0ieX^-De#qo!c||1yW?_IrGYXTo*|=lZ(- ze_Pkcetai@@h~DIA#Ak5>AWqPA~Y<=Ib(3TZCSB{!~oJ@iqB?qHLB|xrp{+}-9GP( zAdQ`pXuJ??2zkHW#8;&x3pr=Sut)OsR7uG<8!=;~kHNe&{BHa;%FJ-DXHts<(UTv{ zRU)1QBd_2QsBN6ZNuVRfR#k02|4m$a$--$u&ip3isw2D506W*i-6G+$fNjenc#Dco z*B+XDaO=-&T=aPnBZS=hVSk$8` z&Z|ok-kOG%Hx@*@{y`d_W(dk_9ctkvYRfd>+lZ#TT%(?WS__ZR8*|~rq(dYjS5b>@ zTYASfTSIQk)q;e)HVm-ikh%6iRi|mYE`QkGhi3MmZj3CleASqIV5XLtu7y6c4uXuF zx4?P>8-0&Mo>u469A_&SqF0sJT}u=k+5~e)s8BH6rfMt}L{|hWl185-T)f4S^gUXq zp%S?)S{XU{D2U)eSq7~xI*KWmxm0QxZiXAe83GXE_a8fgkDgvc~( zl|1K47`(HL2k73>(+%JSq`qjCVR3kG{KMgTUB*!Kf1h9F9qr^ph~n0dL#$s6F;_S- z-D~E6xW6rZ5B$ea#0>PYi&JW@zS$e*G+pmIr$M_bXffkktQTw9qC$Q{fq?P4K{yo!2_wa&lP2vN{N zdW*p1Jif@-RLPd14gGyCA9hgxcJ-qJWp-51xJrH4^!6W;(wLJt-GtfHx2iBR%&JQS zM;?P7>(%G0QBph#W+<*hyoGk>QoHY(TU^BCM4K2*QD+B1sf5WIsi(htYdBtF6qaV4 zY3{K3X+V42fxZL@oz=sIyycR?E{A}p`C#{iApc?otI6^6dB5jA1C^Og5wuvG#h&O={L4p)H`$y z;OA5@=e;g=b;jV_ec}qezUZiGYs??<9(%SZvk{=v1wAgWp8=6FfctvYyo*DV7dZ!g zIiy+Z50WYl+^-6YZ@IwVXYFLd_pElJx~zKf_o`gNRPwZAvvEn*=F_;H4W*2!k1#=O z+6Fv-JQp6OCRE5r-szQdD)|EyVl>vlwzH~6=-=N4Z|2gKHPOJ@Kd-#5v89AZ=|9xO zapE@Nl;~+8Cgz(lWWRVyc&b3cO|IB6=YqYggOYv$Pg{w0!VgEe7(&|m-@6!nTn7gY z+)>B0oZyudTFR-rKxuxZ@%PSxfD#7FW#n9T|CPf)+ zm7&ax%Dtv%flEnIUjI@QN(L8y<814Mas9h4iHI=43zMDgAnJ6he5FkvAGC^_Vyt!` zDYu^*P%4cLYK1{HS?NVSf4~m9vmx|TQ)xwgqeZXqc_rwWC*QNcYFLK+l_`u6N#vbN z6ZEO*Z|I)SF)u!!?qcZb)Bx|DWz@6`q`h)+A zD8`*2yyD7-YW`!A_`}L;B)EE(DpyY9ip9OmCmsmfRA+tQ;{Q-D_E=lBV>P$^P@)SR z+QPFofsbws&3$ni=cgMdoxC3W_b6FIEh0s_rGqQ->Wa)Og{AV$r7a0WZcOYI0&ap| z8JCbgAy8Yof%0q@JGGr?FcA11$yX>JuJ_QyeU36abUwcAos;B{mlc5*{{x6X*My^> zY1~tG0pWT7Nd)kj`F!aa?Q|&O?EOqrG`^yts?C7arMr^IR7OVt{`8nPEm+u7T(-9dUdSQ zC8XC*)JBM;Y*awTCqBp~KH+1FP_11#5f$m|=R{(eD-aRW#G!z7q*`kJ0#gHi;j5c< znmD6%XO4k+AM;H7QxwE9V$!vo^Odti~M6P)HnYw$9(#?Y`$eh^h2(4ERGSS=9bs{p8h0e+%$5iCa*l zVi^jtS`z;!GTzCBI>hSQ?H60Gfw1NA#u}zJq1(-7itMJbpHXphH#KKBu!dLO^$0jl zbNrSRvtV71rrXR?L&o<<;h2e!95Wo0O_y{>?AFxiP@crGQVvKZWb`YePzMtpUiy}tVA|D3Je|Jgb&~&pXd*FcIdkJ3_C{F;h?SOwKM~n(epDr_Xd<@z8L?CPaM=#sOOXIj>92XAsch4e*&wav zKyQEJVc7QZq^V6H0e|hCDyFZC=eK+aD^PUK$_89Q=BK`qJFt;WMST#V`EjK`VtR%K zj$wt)&>UcS!s%+ih*v5nuPWBz`E~g29K)n}o)yeOc(*@$PW9_%kJLe!$i5ougK$ic zIOG<@Tqd<(YFQAQlt+M37AgFII}-3mVHC;d+*?r+nVhG2wS7IEocw`oDU@#mm6T*Xa-xciW9CcT!v zS(&x~<=^_tzy3VhZP@{wkxdJ7(0JdxrCo`{9v z3Wu22b)2HsxGdetmY%x!ta$7gGPtRUzozuRU3;RC=iA!X&ZuZj~ zuvuCi&COA&jI^6G^|XvEgX^j?4?U#nV!_ zi93LbS#9`&iP$-M+Z-7Dt&?`iKS z=S_<4vm_vR>6$#D(K5zf>G0xB%|`4s&JMAcXcB@jOv+PBLfOOR=$Bm6kiDF@90=oMm)y83uzIZ!nmfuUj<}84pJ13qz@J@{0ma+p;*L?X&J!x&28UxG_Hra+FK6LI1R-B8DVQ}*5T0|* z(w!byh5V)2fOdS?z%@q9MENTX{pIPUR(+*rHhTXH93_T3`G7LLj7U?99ed6*LL2U2 zA`WVax+eroUM(_xtPhN>+EEgi_jWZy|GxPMnAZqmk2ry2lL!e zl#I&fSeMDEArqr(l|nI*H^5Dff6nC>S43)iMuhY?#&XchXQrBYDKH9lXk+M{zRYt) zj%Y%m745?Jq6R=P%2dyT-a?@@vCpF9MQtpOGL}J#y4Tb=SN0Mmc|1FXZv{yCP!Uxh zL&fAhwSNV47gO&n2aRh}i~=(sEhUP=sHzDFEM^ui;n&M3%8w2$&j3LqIbtobv#9$$ zPUWdHH+?Stc&sIGnI~#-K_tm3&coJU*_=*j^`kW|oMf}`3UuX@26G&N3ywAE?{8=2 z40MZCb@Ud=6=Y!DmA^Q-_wVDhpVS{h9}08g-3|rVDqM;XKEySeUD|`H%ug77NI)8Z zS4Z^kkj^sFWr2xmJ72BJQVpDk4L6Wz{B!ebe2VO)x@A8ArO4$EM5$(qcy5D zRn$JrS0LHzGQ0~PYlyt!q!|v`EQBJ?6W41iI6qCHSg)S1F?)CJ6=?Sr#%6IVw0eg- z*xisS2f2#fT*LnkMc(!4h@55yRaS!h?KS>iZ49F)TH|0jO%wGO|8u_Bt?=_a{V{)% zX;AU-n|_inyjByx130r|mYXtNnT^U^_j+hoxL0C;qk3ayiO$7Dlnyx>1VNY&Ib2=& zUip_Y4gYVKwB5V5LspE9;qGalK2!tqCZ>5KHHc4xXxk7`p`X3j2tEgb~hXpiA?&UTZ|3UhP`@zXN#27I{9U()y-I?oluE zMg1EGE`@TxNqRm?84@LKy!hiwgA4Y78Z#8X#M5>JGq~G8D{=-9QlmgK$sz|5lbN?` zIYwszcR71}mcrr}8b7KfEur|hbGsuBN9;c2piM4srA-L$P^vOwYfnJ0~h1h8@1H;g!H? zZJjNi^11~b{|Nfd^J7DI8u&s|_MB!iS*&UWeIr6G&r~`i_#I;GdeF(Gy=A*GKt^Tz?W|xN*L0_-0OVCuG z&74IG&469>*X#h#5&lCwKW8e+KR|d3=Y4RR+UbCse7f7K@F(VAcz-HMl+fJdM`z&| zy?VJq7THB24{bh|SHC8=&lyF3L&smQOH{vT+VW0}5f?qbGo8Pi@kuGXsdM&7@5*SH zh0gZeuUq*d)Z%nhRiP&q2wNNK;gHrD)kc!+fT85$2VKuui#s8`j&fIjstSaW%wt$t zYi%DG(ZGRf;0|AVTZ>0pnq1jKj==v00}+)z^S#mcSs!K}- zU!w|pr*aX_P2^)@Dk5!po(DB5u=}>s%VEb|P~EW(-}cV}ch|B&ynam1zakGAgkr3W zy#o7Gv{Npq^L&vO*S=+MZW%^$B}c61qInRLlp_sEH8mU$0XI=EW$DqHA2m}t*Lu@= zz_6{WW#I~OZ75Z~7VzL24`1YRs_3lT8UUrNZbWJ7yvjk54TWp+2a*$*aI^g=kBnfo zDDhGyvGX)+SK}B#|kS2*Bx~( zXSq#DYcbMlAp;M#!!NHtP@F``{nT`d4TtefCl00Sk{!VI>Ivt{JGo7Ru*hjnM~Y3r z_gD->k)rs^?(9!idI^pi&3QEl@$-Jjrv(MWZA!knZOdW(b2x=&af%KbK(6SPs__n# zpeVc{FLTNVrfkk1EwtMWX1qc%^^yUfvC3gOk=d>xWF|;RaW3xpWpn4f~SocQ*-?c zs+GAY*X$V67uMT}6Kl4GWvWdSLMQWYZz2-O+j=NrmkbIuuA$dovXkY7*c~w-14@IW z;1&@Prm;>L20sk|PyQdIZ&YZdQ6F@RHjL)rw6xVGYy*dmXS-01;Ki{VuBP5fqp|+G zJ$X@H^}-z+P`SXQ2)r6Re#)WjCU=YR4Lzwawwm^eS2-(UAnS>vcLG13 zEUNB^=RRiW`*jN&zKI+{@2q28``HA4BL6h;`=iU$2afd( zZ6=q<_+!RX!-vWV+c;}f~&HruvqkYI4akVnaE|Fka_!DHgWzGmj z=gq;ptJQ&>szb3d=vuqZX#XBD6-?~U=%EXRB>@J2R_io-a*Ig-%((T>8o2A05uZE; zUEn{74$S6BruTR$xt><$d>^`QS15{IpujQt;zkC&`MzP~M3aCFdC6$T3UW;6cxE#F z^P#(YjsB}e_Hoks?SCIOSe;Qaq759jr# zJ{G6Keh<&~S^WOk?~xSvP{92EEZ67u1$>Do!us=dqQ02r#Zd}8f^dnUo80}kFp$9| z7lTJgit5&kavs=ZPG|d`%X=9*r4}M(C^!zjLooH-T%RSdm9&`7HK^BXeXahjmt3~% z_e&X(8VBN*Uf!*baeI>>T_wbEZJ^#Y5A%MxqfFxt@S0eRf1I2B*jTWX9A_qpuhV9cY*g8R0H#ap^b#^59DFoAV=vstSjTN&_PXpxX}HiFN+% zDnCDb2Yz5kV%HFlDAtScfYPO}+abZMtuPOXJOOJKj$>VR!A9;P-xtDkc8>mFgPsQx zO26)JGFt|W`nX7vs7$2$z+Z(C7UE=9Vu&v!hHsq?Xi%&@lhwhJF>>h=@?j}a+-De_ zs0t-ahN9B{xYZuyo4fikrU2G4)puG->{FWsK6T4b z@N=)b(`yNz0M%h*U!S30R6Ip}{>`$+XvZkc)_{Qs1G~B~RCmG77!`>6&2(g-^IPpQ zfBpXRpKwHbZa#KRRD3c6CJ2xU#Fgy3pL@%0ear)82h~h5B$q@e%l=Pm5Gj3-ydBXJ3%MXIqWw z(-czXMn0MxsGs4Wa}&NPl$`yKwta7LS*PK)KSOsM4tbGbk~rz(cQ_zTfk@d{5m~+y z$r+SP=YD)uC^$#8x&8rwQWx{-<4U{?r;t!Y9YKj_nAqyqd&+hXxD1}zJwrx&MvdF- zTFhceN4IL9@l>?oDvL!2i$@W4Yw#1x{U?P*SqL+ejD$6 zZygk)MCa$FTOZ6(!|*081N-r@Fji(+>!C}Z^GVF)!cu^0qHPwZ(U&hV8!JjXO>pVw zNCx}8TMyle$Ey}QM%4!A(A4!K1s3dcO&C<%i!DOSJ06?>+2)*T@v4F0yvF!0^oL+5 zDm1!bPey3+1oVKG68cgW=lBiFToyULy#bY?}@ZW;KU3 zE>z@(hue<%cvRtqVhas&N^HeN`Y)neMaymgMKH-)6X_k)&CW7uMS+4O3jV`etBlqf z#YiM5HruIK-hsZoBi^-#SG8qThlO*J$nHz8dcw5a;VPJh^y_ z^w;{F(;4}I**!Z0?fBpyuUlll`7{~Ms9op$XBDmT zI|Z=06oYE1EJCFyTR^nr+5%JUWMlq~PbZ_mOb6{)d#5`mve&3f`h9r;`(g!$G{3>e>d`v?9~HiZp#NBS1Y>EU1Jq0TIxz-n5#B9vO*`gfzx% z(UtA60b|%=iRiGqIe@SSe1OVtwc~jU8@#cZE-YPOB?;_UEM8Ixzwog1q(#^?}oKkFR^i8oL1<+~T5%3zVW>YOkn+TT;+8?1t&cEG); zX8;Tj{wX&EIknz@5SD0IaehsP+Ucjw=zI3_JId#kHO0}s<+EGEeeaTuho3|-5lF{d zipc8H%lUL;;TYjbxP=6mCaIfqXwCh_LRt*lQB`&>3~)r3x~RqpG)}TjEdL2*z^07B zEG>e|pXesq2w{p}`EsnAyYJK1N;GQ=S7#(}>0UQ?*30x(c+;7Qs%a*+6|@~7?)p8c zKJ9ZmEA%;=tnaD_>kJraOhzdEss>7q(Kaw}vJVwf`zowS=9rezOe|W_u?Qp~M(C%3 z(mFbr)~0y8RkUcE(5B^r)9`Oz|0ny%)3k*0s1G$gR8DFMaQPf0>>Y&vOaAEEG;6#U0N#kNrCf3IV7 zTyi?i{X;Iy>?x=08aPA#e6+vzr+yJ)UZ_hsl~p^a(LL#f^X-`0z+-o5Bp;tkzCYC9 zz#b?A$zqf(_HmcIodEYeV6U=HgL7U*{uNUbt+DJNvt|nIKo{#)7f-I5mfotZ^BM)@ zt#J`FlI+)`O+qTM0!-}+Fm^339@?he&E75&d*a4-iMnpxGl8Uryg)L5$Yj-^ZE{OI zM=~66dfXA@AzqKTy_hpco0*bXMs%RTGYZUJ|4{MQ&@;s@#wgiOi&D|@8$*V-o0eR{D ztgm7!RDyfaM0)tjP!t?yUZhaKX&Heo>GESuBk+!cI%|*WXUxP>S4WQBL5&Seco+eE z4SQ#dgWpiON9`e2Oy8~~Z!Q~D4O3;qZefTglBdsCOr`Z3vd|m*N^R2NW1as^WBJ6$ zJILnbqh2?}uz!icy}?_1l*mtskUe50xm8WKwNkBpO4`mDL|eU*(@es@C&g zM*OgRDHT`dBDO9(&BMgOw%mmp_Q9)qp*o5=+o49$2kHVcy~fsK%ywhs-+4zz=4ife z3abKvWir3r+hV-P^8YR@b#V+M!_}qvFcJD!*rzCwGMJxXI)mGfP|uWD*23kWQUTL_hM zoNKh*G9}ouQzHDoEckU;lK46R~gb|$HriIy41EJw3l z^++!smT@Dvx;)&rKkO=E~86x*GPN;}dty0XXL!-6Jul=$x zT5HEj%T2wfswm5jiZ0GO$uWgOHYE=#lB89>SKC*|uK!)=S$XPY?Y?AK&}4p)px&gB zy;jn^lOY#^gY$boFR_|x9^xq&y5@UhZZ&aikaWCulkT5kn(;`;zZ_N;VM?iP!*A)i z0kG;0i{Zh{b8-$DAcX05ZS=QzfA;C{>BT>;X8=Y@aqDBaBsQU5&*^4LA;rY|63c(d z5OOH*R13 zSR&^4z#BNQ98iF&$d0xC^n7hQx6%sV*U$S^5j)AdNW%or=tbC>;}<8J+GUZn<6>$K z@rhHi;DtLR=VS5^JtfpO*{+fMgUoHbI0n|A4E*MZEKLQ89gE}>K+X9EGnlXB1w5K| zo@utF7$>q4G#t!6eOoWhsAjccPW_0uUsQ6!3{RZP)(VQS=8MKd4i6EebRq0cWqcR<9 zelf(4P+A$oYB5$@LVJ{~5o0Mu3p`9_j?yEnGr8t^jqgd?_ylIHlvD~0@pE-$#uf;| z^4HW?*vS%OWIWCLMv5dgy3YA$(#rx=jb}Ethe7S70(UZcxqxpdZxI`_(EZ`jw0>e8)F-M$ReV9 z+Q}~cct?8^-Bl_M*;`SSs`^`-C`Ez-9jCpr1W%@`2XoC15zi}Q;To;GKjl(^|3lcV zcM|#`mx~|d0Bl^1n(yUWTBgiCRXc7qFn@!EbHqecK<^4h`D)qvabIJ$hd0xLTB{+O z$GuD~bLhJj0xZjw3^p;kEkeyrO$ih;h0XFRwJg z1I_6YNVo9&!4unUuV{oWVHQ`t`MI_x;l`jv!G2*usf7=JJL5-^q;eV*P@a2{m z$!@lSr=s6mT&Ti$R@AIW(3ECikToBgzFu~Zk6-SZcUsF|lsnKo z`gBn4K4=1yeKP-uDI!-x=*c{%p7aNF9t_wE5c*JTuJVA~SkEV2aVn{OyPa9S<>|P5 zMRJL`y|N=j_U((J#eDlWXn+b(d?KHZl0>NkD(Vv+z$zCS!oLFP8gMlDEGYD}m3=@m zRol~hi(Pcbe}&+N3|cSw_fIh57wY`tajb+tQZuR82FBFpH!y!h@+0OGv)IFsv2+f& zoYPL{+s1$MzofxL5@;ahDd_NI*bE#%2nVXex9`{LkBDh;bT8Ph{sD{1K1{Z<5oZ6(~N z33O>dh9>mKa`Dv`$o3K{P(hiw+b+2rZ*!7q^8XR6WvZG9FAG$Xt0jT|4jv&hO^Z$Y zwmnw9pfK9=gPax5=@1@m-uY9oyX5Iehg8RQaVB&0tQf>-7dFW#AV;Z#<9<+Wn1rix zPSwAwiHDo!oq3j-opY?yMNVr(sgO5=7`{ccGuP|3t6n62l0c*j{&|_I6IODSFE9OmDE+zZip^)NIRVvzlq#8 z*K_$-_XFe6Kzqtd%@Ay9ICe+@4ov-BFFud=Lg3G91piLvMpyo=L?<>cKLE{53-I{yjH59Mh>jicO9>jcrB<+lTj{WB ze?RIiOd%{+tv!3$w~}}6%99bo5C1XH#FzfXoKBPHHz`vNoiuLkV; z9)dn~>_v`h+`+SWF9en}=ZZZYIhMr4rJ-)p<0T^}+^Am?66w&+O|~Er+HZE3%X@d` zw#LY0DpBG|YQ=7dNLM*v?Fz!Ec;*t&Q%38=(=|0!s9;3il~Gj!triyjQYG5(yT92+ zO~mR4eOGKRnvWUyTxDjn3F|FghXo)cBvB=KYqK!FfV~+^ta`-+lL*s}ASvTwFaHV_ z^A;6VJgJyUVm!fd3ud5jRkNIQ9VZ6fUafTxll(HW~{~<(>co(}|0rzpFdj8re zsYumR^t3hP7`|WB$<@BGTAHdSI_bOs-WnsuH)foE_lcx3{~F8ewe{Upwwd+y zu`sP&+Q9&YDf)Bm>0-?}k5mt!#x?p-CI`*23%rM;gaqEQ^~zZ+>C0wFOJ=I|5K$O< z`;-F1yaH<{PydB>c2ff#!EK|tq?X753u~0+e`$7*15~dxy?wf!T#Bwx>r%pEUn;-@AO`Kl_);>}R(@JHD zxx59PH5)ccYa4i1IMY((Mt) zgiLwETEUe)P~A*c_;|Z)d=`u%k-<(Zbw~~*BUo;#6p3#BMOWY?;o^Zhzz#$f_qI*r z`sCk%DT!V650yi2hT8dj_CDdG73`fT-Ir!?wWC^uu~;Bh7S2>GP{j+K@=MYT-FA%A zdWqU(-3B0e!-CFWOBOwB>^fV&sY#;H6Tf7At)A?;chx2&*( zx`Vg)^q#=#EI+#MkvLh?N_~*FINl)N*I3GFt08f+=>2m%iJ@_m)9=Uy_YTWks~IY5 zWkh-@wjzSr)>rW^@%RGsAv6?rTzACZcTI!`#VdC|@rjzY literal 0 HcmV?d00001 diff --git a/tests/bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py b/tests/bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py new file mode 100644 index 00000000..c98b3815 --- /dev/null +++ b/tests/bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py @@ -0,0 +1,22 @@ +# -*- coding: utf-8 -*- + +from system_tests import CaseMeta, path + + +class Jp2ImageEncodeJp2HeaderOutOfBoundsRead(metaclass=CaseMeta): + """ + Regression test for the bug described in: + https://github.com/Exiv2/exiv2/security/advisories/GHSA-8949-hhfh-j7rj + """ + url = "https://github.com/Exiv2/exiv2/security/advisories/GHSA-8949-hhfh-j7rj" + + filename1 = path("$data_path/issue_ghsa_8949_hhfh_j7rj_poc.jp2") + filename2 = path("$data_path/issue_ghsa_8949_hhfh_j7rj_poc.exv") + commands = ["$exiv2 in $filename1"] + stdout = [""] + stderr = [ +"""Error: XMP Toolkit error 201: XML parsing failure +Warning: Failed to decode XMP metadata. +$filename1: Could not write metadata to file: $kerCorruptedMetadata +"""] + retval = [1]