From b0ec76d623f737a32abc5ab8bb7198bf1d9939a4 Mon Sep 17 00:00:00 2001
From: Lukas Czerner <lczerner@redhat.com>
Date: Tue, 14 Aug 2018 16:37:53 +0200
Subject: [PATCH] libe2p: avoid segfault when s_nr_users is too high

Currently in e2fsprogs tools it's possible to access out of bounds
memory when reading list of ids sharing a journal log
(journal_superblock_t->s_users[]) in case where s_nr_users is too high.

This is because we never check whether the s_nr_users fits into the
restriction of JFS_USERS_MAX. Fix it by checking that nr_users is not
bigger than JFS_USERS_MAX and error out when possiblem.

Also add test for dumpe2fs. The rest would require involving external
journal which is not possible to test with e2fsprogs test suite at the
moment.

Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
---
 lib/e2p/ljs.c                             |   4 +-
 lib/ext2fs/mkjournal.c                    |   2 +
 misc/tune2fs.c                            |  11 +++
 tests/d_corrupt_journal_nr_users/expect   |  99 ++++++++++++++++++++++
 tests/d_corrupt_journal_nr_users/image.gz | Bin 0 -> 8788 bytes
 tests/d_corrupt_journal_nr_users/name     |   1 +
 tests/d_corrupt_journal_nr_users/script   |  25 ++++++
 tests/f_bad_local_jnl/image               | Bin 0 -> 8388608 bytes
 8 files changed, 140 insertions(+), 2 deletions(-)
 create mode 100644 tests/d_corrupt_journal_nr_users/expect
 create mode 100644 tests/d_corrupt_journal_nr_users/image.gz
 create mode 100644 tests/d_corrupt_journal_nr_users/name
 create mode 100644 tests/d_corrupt_journal_nr_users/script
 create mode 100644 tests/f_bad_local_jnl/image

diff --git a/lib/e2p/ljs.c b/lib/e2p/ljs.c
index 0b1beadb0..c99126b61 100644
--- a/lib/e2p/ljs.c
+++ b/lib/e2p/ljs.c
@@ -101,10 +101,10 @@ void e2p_list_journal_super(FILE *f, char *journal_sb_buf,
 			e2p_be32(jsb->s_checksum));
 	if ((nr_users > 1) ||
 	    !e2p_is_null_uuid(&jsb->s_users[0])) {
-		for (i=0; i < nr_users; i++) {
+		for (i=0; i < nr_users && i < JFS_USERS_MAX; i++) {
 			printf(i ? "                          %s\n"
 			       : "Journal users:            %s\n",
-			       e2p_uuid2str(&jsb->s_users[i*16]));
+			       e2p_uuid2str(&jsb->s_users[i * UUID_SIZE]));
 		}
 	}
 	if (jsb->s_errno != 0)
diff --git a/lib/ext2fs/mkjournal.c b/lib/ext2fs/mkjournal.c
index 7f78291da..a90e80e0b 100644
--- a/lib/ext2fs/mkjournal.c
+++ b/lib/ext2fs/mkjournal.c
@@ -401,6 +401,8 @@ errcode_t ext2fs_add_journal_device(ext2_filsys fs, ext2_filsys journal_dev)
 
 	/* Check and see if this filesystem has already been added */
 	nr_users = ntohl(jsb->s_nr_users);
+	if (nr_users > JFS_USERS_MAX)
+		return EXT2_ET_CORRUPT_JOURNAL_SB;
 	for (i=0; i < nr_users; i++) {
 		if (memcmp(fs->super->s_uuid,
 			   &jsb->s_users[i*16], 16) == 0)
diff --git a/misc/tune2fs.c b/misc/tune2fs.c
index b8cddfa13..ec977b8c3 100644
--- a/misc/tune2fs.c
+++ b/misc/tune2fs.c
@@ -292,6 +292,12 @@ static int remove_journal_device(ext2_filsys fs)
 	jsb = (journal_superblock_t *) buf;
 	/* Find the filesystem UUID */
 	nr_users = ntohl(jsb->s_nr_users);
+	if (nr_users > JFS_USERS_MAX) {
+		fprintf(stderr, _("Journal superblock is corrupted, nr_users\n"
+				 "is too high (%d).\n"), nr_users);
+		commit_remove_journal = 1;
+		goto no_valid_journal;
+	}
 
 	if (!journal_user(fs->super->s_uuid, jsb->s_users, nr_users)) {
 		fputs(_("Filesystem's UUID not found on journal device.\n"),
@@ -2850,6 +2856,11 @@ fs_update_journal_user(struct ext2_super_block *sb, __u8 old_uuid[UUID_SIZE])
 	jsb = (journal_superblock_t *) buf;
 	/* Find the filesystem UUID */
 	nr_users = ntohl(jsb->s_nr_users);
+	if (nr_users > JFS_USERS_MAX) {
+		fprintf(stderr, _("Journal superblock is corrupted, nr_users\n"
+				 "is too high (%d).\n"), nr_users);
+		return EXT2_ET_CORRUPT_JOURNAL_SB;
+	}
 
 	j_uuid = journal_user(old_uuid, jsb->s_users, nr_users);
 	if (j_uuid == NULL) {
diff --git a/tests/d_corrupt_journal_nr_users/expect b/tests/d_corrupt_journal_nr_users/expect
new file mode 100644
index 000000000..cdfb49a0d
--- /dev/null
+++ b/tests/d_corrupt_journal_nr_users/expect
@@ -0,0 +1,99 @@
+Filesystem volume name:   <none>
+Last mounted on:          <not available>
+Filesystem magic number:  0xEF53
+Filesystem revision #:    1 (dynamic)
+Filesystem features:      has_journal ext_attr resize_inode dir_index filetype extent 64bit flex_bg sparse_super large_file huge_file dir_nlink extra_isize metadata_csum
+Default mount options:    user_xattr acl
+Filesystem state:         clean
+Errors behavior:          Continue
+Filesystem OS type:       Linux
+Inode count:              512
+Block count:              2048
+Reserved block count:     102
+Free blocks:              982
+Free inodes:              501
+First block:              0
+Block size:               4096
+Fragment size:            4096
+Group descriptor size:    64
+Blocks per group:         32768
+Fragments per group:      32768
+Inodes per group:         512
+Inode blocks per group:   32
+Flex block group size:    16
+Mount count:              0
+Check interval:           0 (<none>)
+Reserved blocks uid:      0
+Reserved blocks gid:      0
+First inode:              11
+Inode size:	          256
+Required extra isize:     32
+Desired extra isize:      32
+Journal inode:            8
+Default directory hash:   half_md4
+Journal backup:           inode blocks
+Checksum type:            crc32c
+Journal features:         (none)
+Journal size:             4096k
+Journal length:           1024
+Journal sequence:         0x00000001
+Journal start:            0
+Journal number of users:  9999
+Journal users:            <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+                          <none>
+
+
+Group 0: (Blocks 0-2047)
+  Primary superblock at 0, Group descriptors at 1-1
+  Block bitmap at 2 (+2)
+  Inode bitmap at 18 (+18)
+  Inode table at 34-65 (+34)
+  982 free blocks, 501 free inodes, 2 directories, 501 unused inodes
+  Free blocks: 1066-2047
+  Free inodes: 12-512
diff --git a/tests/d_corrupt_journal_nr_users/image.gz b/tests/d_corrupt_journal_nr_users/image.gz
new file mode 100644
index 0000000000000000000000000000000000000000..1fc32eddd679fbea791aeba59faf0fcd93cbccd3
GIT binary patch
literal 8788
zc-rmIYfO@16bJCvT*KKGQCqf5%`9B%qSR??@ltJOwRQ25sO6;$ycDuED@^TmHj6Z(
z5-rLCvZkgpBT*Sau7+reOtUMJ*~M_+oy+PKp0Mw2t&i>beL6e)@BFvpSMK2<)t@|s
zxHGd)Fc7nW%8id+g-ii`N|!wKT|kMLw{poMdGNw+(!Pb>{>yVDJ64Oy{+}=TUER00
zat*IE{fHzn$CK9aoH$o3j=IH-AV>JGSTIsD8q00&Qxw$}NC_jTtscjHKqQ+vyfLgt
zAr~r3z1%E~d&*Q?>iYad-U?l+*LPBMd0op(3c95^?B4sK(5fg~&~R)#uQZCed0kta
zlAS}+5p+X_@aB4_gOZWvi|1?Dv$W<aRqO1q4pU5;2dp4PF{SBL+jZkQ=`|xIwMP?!
zCGe8<R_ncUcOzm$_B>vzuCSmi<GT-Cf}t5p#i{m(Ri3o!{;c$g>YpYxond!FjH<#U
z5L3nvNCW&#bttWg4bEygr;XEj)^i^m>ah)ZL<B)@x@+6E%QTw#c{T)K7<Q~ul2zm-
zrUg|>ByY}eFxFsjK{U}fS(#~>Ql)$w?{`CxV&NE{^VEE?!M?n6&;dleH%>p-0gn9}
z4jOKt-n}}&5*WN)t90}$4p@OG^}0w8+!3S$@BSVAh*jX=wy2RRl&Uix5y<<WaIf&2
zCZ<+R9z?0g-x23&iOi(m#U`z`)&u!>ma=mGVsrK7Tv`5CMXoGd`Rwh37u#y5={4*%
zEFY6jS|@wmLvFfxXGBZt`O-ISljf=bLt$+(`wEU*TcrgDnhZ4zyZA6YL0~w~t<emO
zjPAPlgA&YC2@iptXh8s$!9W4;PBz74n~U7!G;Vbc$~ja(uk8ia&y`zQ_Y(z2cb5f@
z@t<D+?`<W7{AD6y+YRf$9IajEDru0rs_v&b3LRks*^anugY#7*mJ`+6$$vY8gBjX5
zLzy@KUkHLA2!bF8f*=TjAP9mW2!bF8f*=U`-%<4E-IvY}+d-N=ApQ@jPvnq<E?2A=
F`2~>ucP9V<

literal 0
Hc-jL100001

diff --git a/tests/d_corrupt_journal_nr_users/name b/tests/d_corrupt_journal_nr_users/name
new file mode 100644
index 000000000..8b33a273e
--- /dev/null
+++ b/tests/d_corrupt_journal_nr_users/name
@@ -0,0 +1 @@
+Journal superblock corrupted, nr_users too high
diff --git a/tests/d_corrupt_journal_nr_users/script b/tests/d_corrupt_journal_nr_users/script
new file mode 100644
index 000000000..683cd4874
--- /dev/null
+++ b/tests/d_corrupt_journal_nr_users/script
@@ -0,0 +1,25 @@
+if ! test -x $DEBUGFS_EXE; then
+	echo "$test_name: $test_description: skipped (no debugfs)"
+	return 0
+fi
+
+IMAGE=$test_dir/image.gz
+EXP=$test_dir/expect
+OUT=$test_name.log
+gunzip < $IMAGE > $TMPFILE
+
+$DUMPE2FS $TMPFILE >> $OUT.new 2>&1
+sed -f $cmd_dir/filter.sed $OUT.new > $OUT
+rm -f $TMPFILE $OUT.new
+
+cmp -s $OUT $EXP
+status=$?
+
+if [ "$status" = 0 ] ; then
+	echo "$test_name: $test_description: ok"
+	touch $test_name.ok
+else
+	echo "$test_name: $test_description: failed"
+	diff $DIFF_OPTS $EXP $OUT > $test_name.failed
+	rm -f $test_name.tmp
+fi
diff --git a/tests/f_bad_local_jnl/image b/tests/f_bad_local_jnl/image
new file mode 100644
index 0000000000000000000000000000000000000000..6f2b550a3811cdffb3cdf8f3eb0eaae4e9a9421a
GIT binary patch
literal 8388608
zc-rjUb+Ghxy}<GF1k#-n64Kov-GX$7N|(~1fHX*VBPiXWG$=@SH;RN3q7o`4q1^YQ
z;8nSI?q51rdA;Vm_x$!Zd-lxv?tH#GyE8jyU;y~k8dQ@F44l;WJ0}_#c<ZB6e>K@h
zeROi1r>>uWU|{NjRbL<U=Tl=3yS~D!f4!?=My|bTXbt}8{7d&7yv%x+F1^u_HypD4
z)MuaY(!c7@8^I$C|EnP%&FOFh!{-03KhG=h>G0wI3wwGX;9qaA4~PGE*dKs@hL7ib
z*z5R@`&Vv2uP*xLpkXgS{_*#}IcUh=y%w3uUd?~v6Y$={F30%08T|N-xl#V+&8yjK
zj+(RPs<~^Pnz!bwFVwIfT%Z=Lg=*nJ*7yJ3f4Z3Uf7<^B4@~ekx0|}AscCDvn!aYJ
z8EdARxn}vxT@B1;Spfh50000000000000000000000000000000002~Z4Itb1_lkD
z`LD-=2hZG<kvo2Q$Vh{?+-8RzXV`R`ownZCTETysk^f=--yHIn`3F8FhFStJ|A6@i
z%s*iM0rL--f57|$<{vQsfcXdh9o#tod?)_*4lwlN!$BYQ2`}Aq@G|RNy7Wdz-f+nF
zQ=fgpOYhEo-3C?>00000000000002~xfZTPYSCJ(7Oy30$y%zGt}oUywQPN<maFA!
zg<7#zs+DV%TD4ZI)oYDfv(~D$Yn@uRzFc3auhx3CehvE&!G^U_4f|Iko7ASYS#4fh
z)Yt0kwPkHpTh}(VZEaWE*ABH~?Nr~WZ`RJWOYK_Us@-b$+N1WYy=w2;r}nM=>f5z{
z9Z(0>L3MB)Qis-Ib$A_7N7hkwbRAR2)^T-wolwI*U~y7?r%tX@>bv#5I<-!#)9Z{n
zv(Bos>zq2b&a3n5g1WFSs*CHA`hNYOF0ISz^17m~tgGtkx~8tJAJ&iRy1Kr8TsPE>
zbyMA3x74k5TisrF)SY!#-Cg(8y>(yRUk}uS^-w)rkJO{}SUp}()RXm-`e{8?KdYzf
znR>RKtDn~|>iK%1UaXhum-TY}s(xL+saNXNdaYis-`4Ny_w`1-S#Q<b^-lev-mUlQ
z{raH(SbwSyhYi7?zG`p{si8GoeWr%55o*L5sYb3*YSbF7Mz1ky%o?l4u5oJI8n4E$
z3F@;oVNFyM*Ch41nzSaX$!m)Gd`($X)zmdjO<U8|^fg1xSTohkHA~G}v(@Z1N6lGt
z)!a2t&0F);7i#`mpcbr!2HF1r0000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z000000000000000fKOUv(7?c=g9io{8)7Zs(`M1;f3aG;mZ&9bsam?eSj*J1^`%;_
zmai3R#agLWu2pK)TCG;EHEPXTtJbb{YTf#BeWkuy>(%<TL2XzY)yB0+ZCabv=CwtA
zt-fAc)>gH3ZByIUcC~%&P&?L6^^N*w?OeOmuJx_jt#+?HYR}rM_O5+u-`cOfUHjJo
zbzmJ-2iGBWXdPCE*AaDO9aTryF?DPmSI5^0bz+@V->H-9l=^OcuTHJg>hwCJ&aAWQ
z>^i5;t@G;qx}Ywsi|XRKq`qH2s7vdzy1cHaE9<Jdx~{2f>xcEDx~{ITAJ+|aW8G9Y
z*DZBx-B!2P9d&2jRd?4tb#L8Q_tyjUU_De1*CX|4Jyws`6ZK^Mq<&gY)z9kbdZwPO
z=j!M6i+a9Zs2A&{`enUbzp7u?Z|aqLwO*^&>$mm0`hC4oZ`ND&cD+-7sCVnVdcQuX
zKh~e>!y4#$Z%_@cAvLsytIyQ%HA0P8Bh|<?N{w2h)#x=wjag&W*fma#TjSOEH9>v0
zCaj5S;+mvBSCiIcHF-@@pRXxvs+zi{scCDvn!aYJ8EdARxn`+ZYqpxb=BPPqu9~~%
zsd;O@`a;cL3)F(OP%T`G47UFP0000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z0000000000000000H3tj;DLd~Yl&L2ma3)ei?vKGTVJZ>YWZ5BR;-n3<yxgyt<`Gv
zTBFviwQB8Jr`D}6*H`MRwO*}X8`OriQEgnC)TXsrZC+c{*XrxFWo=bk*EY3nZCBgZ
z4z*+LRNts?*3Pv{?ONZe-D>yRqxP)5YVX>o_O1Qu+qHikPzTmQb#NV0ht^?rcpXtk
z)=_nI9aG2Fadmv1P$$+&^_@DoPO0zK_v+L-txm5q>dZQ;&aQLn+&Zt$uM6tJx~ML$
zOX~aegSxaXtIO+(y0WgStLvJ&wtiSYs_W|d`f=S*H`YycbKO$6)@^lr-BEYeU3GWe
zQ}@<=b$>lj57tBVa6M9w)?@W}JyB2APwJ=jRQ;@;u4n4mdaiz6zo_Tyg?h1Gs$bU2
z^{e`I{ia^2SL?NUy?$H2tKZif^=7?QZ`V8ZhkCc(tM}`J`eXg6KCFQu0|SF<a1E)U
zHC%nBhOZH7#2Tqau2E{#8m&gJF>1^jtH!QzYTO#H#;*zLvo&E&R1?=E^|_j~CacM7
ziu!y_SyR>2HBC)h)7A7fL(Nz-)yy?Z&04e7>@`QtS##CgHBZf3^VJt>{#u|Gtc7af
zTBH^oV*djG0000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
zK56kG0|QIclC@MVU0<waYT5cyEmzCe3bkUbR4dmiwQ8+atJfN}X026g*E+RseYw6;
zU#<0O{o0^5tc_~p+N3tE&1&=7qP|vNuPtk<+Pb!>ZEL&QzILb`Yp41~eY1A1U250*
zR_#{1*B-TJ?Nxi%KDBS{SKqGv>wr424yuFekUF#utHbMvI<k(cqwAPDwvMag>x4S7
zPO9(J$#qJ7x4u`W)@gNmol$4jS#@@uQ|H!sb$(q?7uH2}aa~g1uOHN<by;0rSJaht
zRb5@z)V1})`cYk1*Vm8hhPttCs+;SUy0vbr+v|?Hv+k<9>z=x|?yLLjfqJkWs)y^5
zdbA#^$LooDvVKxOt*7c|^>jT`&(?GG^ZG?SUoX^)^-}$^Uanu&uj@DUO1)aI)$8@!
z`d$6L-l#Y0t$MrOsXx@a^<KSSAJiY~PxWC93>_F4RD)|s4XxqoGc|mTP$SkzHFAwo
zqt<9OdW}(I)>t)mjZ@>+cr|`aP@k;{YoeOCCaKTWq%~PhUQ^WPYs#9crmksf+M2GW
zuNi8_nyF^4S!&jrt!A$|YR;Og=B{~$+S334000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z0000000000000000000000000000000002^FZSR-000000LcHf5mZ%GRaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40RaI40
zRaI40RaI40RaI40RaI40RaI40RaI40RaI40Roa6?0ssI2073s>oBaR)0000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
z00000000000000000000000000000000000000000000000000000000000000000
a0000000000000000000000000000-J9<TfW

literal 0
Hc-jL100001

-- 
2.47.2