From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Jan Macku To: git-commits@fedoraproject.org Subject: [rpms/nghttp2] rawhide: Resolves: CVE-2026-58055 - HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests Date: Fri, 07 Aug 2026 10:41:25 GMT Message-ID: <178609928597.1.9407186031626264989.rpms-nghttp2-b664865eb764@fedoraproject.org> List-ID: X-Git-Repo: rpms/nghttp2 X-Git-Branch: rawhide X-Git-Rev: b664865eb764ccc93a98c31db2c6fdc3b7a3f75b QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvbmdodHRwMgpCcmFu Y2ggOiByYXdoaWRlCkNvbW1pdCA6IGI2NjQ4NjVlYjc2NGNjYzkzYTk4YzMxZGIyYzZmZGMzYjdh M2Y3NWIKQXV0aG9yIDogSmFuIE1hY2t1IDxqYW1hY2t1QHJlZGhhdC5jb20+CkRhdGUgICA6IDIw MjYtMDgtMDdUMTA6Mzg6NTcrMDI6MDAKU3RhdHMgIDogKzMyMi8tMSBpbiAyIGZpbGUocykKVVJM ICAgIDogaHR0cHM6Ly9zcmMuZmVkb3JhcHJvamVjdC5vcmcvcnBtcy9uZ2h0dHAyL2MvYjY2NDg2 NWViNzY0Y2NjOTNhOThjMzFkYjJjNmZkYzNiN2EzZjc1Yj9icmFuY2g9cmF3aGlkZQoKTG9nOgpS ZXNvbHZlczogQ1ZFLTIwMjYtNTgwNTUgLSBIVFRQIFJlcXVlc3QvUmVzcG9uc2UgU211Z2dsaW5n IGFuZCBSZXNwb25zZS1RdWV1ZSBQb2lzb25pbmcgdmlhIGFtYmlndW91cyBIVFRQLzEuMSBVcGdy YWRlIHJlcXVlc3RzCgotLS0KZGlmZiAtLWdpdCBhLzAwMDEtbmdodHRwMi0xLjY5LjAtQ1ZFLTIw MjYtNTgwNTUucGF0Y2ggYi8wMDAxLW5naHR0cDItMS42OS4wLUNWRS0yMDI2LTU4MDU1LnBhdGNo Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLjcwYjNmNGMKLS0tIC9kZXYvbnVs bAorKysgYi8wMDAxLW5naHR0cDItMS42OS4wLUNWRS0yMDI2LTU4MDU1LnBhdGNoCkBAIC0wLDAg KzEsMzE1IEBACitGcm9tIDE2MzJlYTRmYjc5MjllMzQ3NDk4MjFjNmIzYWVjMzhjYzk3ZDE0ZTIg TW9uIFNlcCAxNyAwMDowMDowMCAyMDAxCitGcm9tOiBUYXRzdWhpcm8gVHN1amlrYXdhIDx0YXRz dWhpcm8udEBnbWFpbC5jb20+CitEYXRlOiBGcmksIDIyIE1heSAyMDI2IDIxOjI2OjQ0ICswOTAw CitTdWJqZWN0OiBbUEFUQ0hdIG5naHR0cHg6IFRpZ2h0ZW4gdXAgQ09OTkVDVCBhbmQgSFRUUCBV cGdyYWRlIGhhbmRsaW5nCisKKyhjaGVycnkgcGlja2VkIGZyb20gY29tbWl0IGFiMjgxMDVjNGEw MTk3ZGEyNGY4YmZjNDE0YmMxMTYwNTUyNDllMWUpCistLS0KKyBzcmMvc2hycHhfZG93bnN0cmVh bS5jYyAgICAgICAgICAgICAgICAgfCAgMyArLQorIHNyYy9zaHJweF9kb3duc3RyZWFtLmggICAg ICAgICAgICAgICAgICB8ICA0ICsrCisgc3JjL3NocnB4X2h0dHAyX3Vwc3RyZWFtLmNjICAgICAg ICAgICAgIHwgIDggKysrCisgc3JjL3NocnB4X2h0dHAzX3Vwc3RyZWFtLmNjICAgICAgICAgICAg IHwgIDggKysrCisgc3JjL3NocnB4X2h0dHBfZG93bnN0cmVhbV9jb25uZWN0aW9uLmNjIHwgNzAg KysrKysrKysrKysrKysrKysrKysrLS0tLQorIHNyYy9zaHJweF9odHRwX2Rvd25zdHJlYW1fY29u bmVjdGlvbi5oICB8ICA1ICsrCisgc3JjL3NocnB4X2h0dHBzX3Vwc3RyZWFtLmNjICAgICAgICAg ICAgIHwgMzUgKysrKysrKysrKystLQorIDcgZmlsZXMgY2hhbmdlZCwgMTE3IGluc2VydGlvbnMo KyksIDE2IGRlbGV0aW9ucygtKQorCitkaWZmIC0tZ2l0IGEvc3JjL3NocnB4X2Rvd25zdHJlYW0u Y2MgYi9zcmMvc2hycHhfZG93bnN0cmVhbS5jYworaW5kZXggZjBjMzgwOWQuLjQ2NWY5YjRjIDEw MDY0NAorLS0tIGEvc3JjL3NocnB4X2Rvd25zdHJlYW0uY2MKKysrKyBiL3NyYy9zaHJweF9kb3du c3RyZWFtLmNjCitAQCAtMTE0Niw3ICsxMTQ2LDggQEAgYm9vbCBEb3duc3RyZWFtOjpjYW5fZGV0 YWNoX2Rvd25zdHJlYW1fY29ubmVjdGlvbigpIGNvbnN0IHsKKyAgIC8vIHN0YXRlLCBlc3BlY2lh bGx5IGZvciBIVFRQLzEuMQorICAgcmV0dXJuIGRjb25uXyAmJiByZXNwb25zZV9zdGF0ZV8gPT0g RG93bnN0cmVhbVN0YXRlOjpNU0dfQ09NUExFVEUgJiYKKyAgICAgICAgICByZXF1ZXN0X3N0YXRl XyA9PSBEb3duc3RyZWFtU3RhdGU6Ok1TR19DT01QTEVURSAmJiAhdXBncmFkZWRfICYmCistICAg ICAgICAgIXJlc3BfLmNvbm5lY3Rpb25fY2xvc2UgJiYgcmVxdWVzdF9idWZfLnJsZWZ0KCkgPT0g MDsKKysgICAgICAgICAhcmVzcF8uY29ubmVjdGlvbl9jbG9zZSAmJiBibG9ja2VkX3JlcXVlc3Rf YnVmXy5ybGVmdCgpID09IDAgJiYKKysgICAgICAgICByZXF1ZXN0X2J1Zl8ucmxlZnQoKSA9PSAw OworIH0KKyAKKyBEZWZhdWx0TWVtY2h1bmtzIERvd25zdHJlYW06OnBvcF9yZXNwb25zZV9idWYo KSB7CitkaWZmIC0tZ2l0IGEvc3JjL3NocnB4X2Rvd25zdHJlYW0uaCBiL3NyYy9zaHJweF9kb3du c3RyZWFtLmgKK2luZGV4IDk2ZGY5NmM5Li41ODI5ZGI1ZiAxMDA2NDQKKy0tLSBhL3NyYy9zaHJw eF9kb3duc3RyZWFtLmgKKysrKyBiL3NyYy9zaHJweF9kb3duc3RyZWFtLmgKK0BAIC0yMzEsNiAr MjMxLDEwIEBAIHN0cnVjdCBSZXF1ZXN0IHsKKyAgIC8vIG9yaWdfYXV0aG9yaXR5IGFuZCBvcmln X3BhdGggaGF2ZSB0aGUgYXV0aG9yaXR5IGFuZCBwYXRoIHdoaWNoCisgICAvLyBhcmUgdXNlZCBm b3IgdGhlIGZpcnN0IGJhY2tlbmQgc2VsZWN0aW9uLgorICAgYm9vbCBmb3J3YXJkZWRfb25jZTsK KysgIC8vIHRydWUgaWYgSFRUUC8xIHJlcXVlc3QgbWVzc2FnZSBoYXMgYmVlbiBjb21wbGV0ZWQu ICBUaGlzIGZpZWxkIGlzCisrICAvLyBhZGRlZCBiZWNhdXNlIERvd25zdHJlYW06OmdldF9yZXF1 ZXN0X3N0YXRlKCkgbWlnaHQgYmUgYWx0ZXJlZAorKyAgLy8gZnJvbSBEb3duc3RyZWFtU3RhdGU6 Ok1TR19DT01QTEVURS4KKysgIGJvb2wgaHR0cDFfbXNnX2NvbXBsZXRle307CisgfTsKKyAKKyBz dHJ1Y3QgUmVzcG9uc2UgeworZGlmZiAtLWdpdCBhL3NyYy9zaHJweF9odHRwMl91cHN0cmVhbS5j YyBiL3NyYy9zaHJweF9odHRwMl91cHN0cmVhbS5jYworaW5kZXggNTYzZjM4YWUuLjkwZmQzODg4 IDEwMDY0NAorLS0tIGEvc3JjL3NocnB4X2h0dHAyX3Vwc3RyZWFtLmNjCisrKysgYi9zcmMvc2hy cHhfaHR0cDJfdXBzdHJlYW0uY2MKK0BAIC0zMjgsNiArMzI4LDE0IEBAIGludCBIdHRwMlVwc3Ry ZWFtOjpvbl9yZXF1ZXN0X2hlYWRlcnMoRG93bnN0cmVhbSAqZG93bnN0cmVhbSwKKyAgICAgcmV0 dXJuIDA7CisgICB9CisgCisrICBpZiAobWV0aG9kX3Rva2VuID09IEhUVFBfQ09OTkVDVCAmJiBj b250ZW50X2xlbmd0aCkgeworKyAgICBpZiAobG9nX2VuYWJsZWQoSU5GTykpIHsKKysgICAgICBM b2d7SU5GTywgdGhpc30gPDwgImNvbnRlbnQtbGVuZ3RoIGFyZSBub3QgYWxsb3dlZCBpbiBDT05O RUNUIHJlcXVlc3QiOworKyAgICB9CisrCisrICAgIHJldHVybiBlcnJvcl9yZXBseShkb3duc3Ry ZWFtLCA0MDApOworKyAgfQorKworICAgYXV0byBmYWRkciA9IGhhbmRsZXJfLT5nZXRfdXBzdHJl YW1fYWRkcigpOworIAorICAgLy8gRm9yIEhUVFAvMiBwcm94eSwgd2UgcmVxdWlyZSA6YXV0aG9y aXR5LgorZGlmZiAtLWdpdCBhL3NyYy9zaHJweF9odHRwM191cHN0cmVhbS5jYyBiL3NyYy9zaHJw eF9odHRwM191cHN0cmVhbS5jYworaW5kZXggNDhmZGI1MWMuLjVmNGQxMzA2IDEwMDY0NAorLS0t IGEvc3JjL3NocnB4X2h0dHAzX3Vwc3RyZWFtLmNjCisrKysgYi9zcmMvc2hycHhfaHR0cDNfdXBz dHJlYW0uY2MKK0BAIC0yMjI0LDYgKzIyMjQsMTQgQEAgaW50IEh0dHAzVXBzdHJlYW06Omh0dHBf ZW5kX3JlcXVlc3RfaGVhZGVycyhEb3duc3RyZWFtICpkb3duc3RyZWFtLCBpbnQgZmluKSB7Cisg ICAgIHJldHVybiAwOworICAgfQorIAorKyAgaWYgKG1ldGhvZF90b2tlbiA9PSBIVFRQX0NPTk5F Q1QgJiYgY29udGVudF9sZW5ndGgpIHsKKysgICAgaWYgKGxvZ19lbmFibGVkKElORk8pKSB7Cisr ICAgICAgTG9ne0lORk8sIHRoaXN9IDw8ICJjb250ZW50LWxlbmd0aCBhcmUgbm90IGFsbG93ZWQg aW4gQ09OTkVDVCByZXF1ZXN0IjsKKysgICAgfQorKworKyAgICByZXR1cm4gZXJyb3JfcmVwbHko ZG93bnN0cmVhbSwgNDAwKTsKKysgIH0KKysKKyAgIGF1dG8gZmFkZHIgPSBoYW5kbGVyXy0+Z2V0 X3Vwc3RyZWFtX2FkZHIoKTsKKyAKKyAgIGF1dG8gY29uZmlnID0gZ2V0X2NvbmZpZygpOworZGlm ZiAtLWdpdCBhL3NyYy9zaHJweF9odHRwX2Rvd25zdHJlYW1fY29ubmVjdGlvbi5jYyBiL3NyYy9z aHJweF9odHRwX2Rvd25zdHJlYW1fY29ubmVjdGlvbi5jYworaW5kZXggMzQ2Mjg3YTkuLjE5N2Fh ZjNlIDEwMDY0NAorLS0tIGEvc3JjL3NocnB4X2h0dHBfZG93bnN0cmVhbV9jb25uZWN0aW9uLmNj CisrKysgYi9zcmMvc2hycHhfaHR0cF9kb3duc3RyZWFtX2Nvbm5lY3Rpb24uY2MKK0BAIC03MTIs NiArNzEyLDM0IEBAIGludCBIdHRwRG93bnN0cmVhbUNvbm5lY3Rpb246OnB1c2hfcmVxdWVzdF9o ZWFkZXJzKCkgeworICAgcmV0dXJuIDA7CisgfQorIAorK2Jvb2wgSHR0cERvd25zdHJlYW1Db25u ZWN0aW9uOjpzaG91bGRfYmxvY2tfcmVxdWVzdF9ib2R5KCkgY29uc3QgeworKyAgY29uc3QgYXV0 byAmcmVxID0gZG93bnN0cmVhbV8tPnJlcXVlc3QoKTsKKysKKysgIHJldHVybiAhZG93bnN0cmVh bV8tPmdldF9yZXF1ZXN0X2hlYWRlcl9zZW50KCkgfHwKKysgICAgICAgICAocmVxLnVwZ3JhZGVf cmVxdWVzdCAmJiAhZG93bnN0cmVhbV8tPmdldF91cGdyYWRlZCgpKTsKKyt9CisrCisrYm9vbCBI dHRwRG93bnN0cmVhbUNvbm5lY3Rpb246OnNob3VsZF91bmJsb2NrX3JlcXVlc3RfYm9keV9iZWZv cmVfcmVzcG9uc2UoKQorKyAgY29uc3QgeworKyAgY29uc3QgYXV0byAmcmVxID0gZG93bnN0cmVh bV8tPnJlcXVlc3QoKTsKKysKKysgIHJldHVybiAhcmVxLnVwZ3JhZGVfcmVxdWVzdDsKKyt9Cisr Cisrdm9pZCBIdHRwRG93bnN0cmVhbUNvbm5lY3Rpb246OnByb2Nlc3NfYmxvY2tlZF9yZXF1ZXN0 X2J1Zl9vbl9yZXNwb25zZSgpIHsKKysgIGlmIChibG9ja2VkX3JlcXVlc3RfYnVmX3Byb2Nlc3Nl ZF8pIHsKKysgICAgcmV0dXJuOworKyAgfQorKworKyAgcHJvY2Vzc19ibG9ja2VkX3JlcXVlc3Rf YnVmKCk7CisrCisrICBhdXRvIGJ1ZiA9IGRvd25zdHJlYW1fLT5nZXRfYmxvY2tlZF9yZXF1ZXN0 X2J1ZigpOworKyAgYnVmLT5yZXNldCgpOworKyAgYmxvY2tlZF9yZXF1ZXN0X2J1Zl9wcm9jZXNz ZWRfID0gdHJ1ZTsKKysKKysgIHNpZ25hbF93cml0ZSgpOworK30KKysKKyBpbnQgSHR0cERvd25z dHJlYW1Db25uZWN0aW9uOjpwcm9jZXNzX2Jsb2NrZWRfcmVxdWVzdF9idWYoKSB7CisgICBhdXRv IHNyYyA9IGRvd25zdHJlYW1fLT5nZXRfYmxvY2tlZF9yZXF1ZXN0X2J1ZigpOworIAorQEAgLTc0 MSw3ICs3NjksNyBAQCBpbnQgSHR0cERvd25zdHJlYW1Db25uZWN0aW9uOjpwcm9jZXNzX2Jsb2Nr ZWRfcmVxdWVzdF9idWYoKSB7CisgCisgaW50IEh0dHBEb3duc3RyZWFtQ29ubmVjdGlvbjo6cHVz aF91cGxvYWRfZGF0YV9jaHVuaygKKyAgIHN0ZDo6c3Bhbjxjb25zdCB1aW50OF90PiBkYXRhKSB7 CistICBpZiAoIWRvd25zdHJlYW1fLT5nZXRfcmVxdWVzdF9oZWFkZXJfc2VudCgpKSB7CisrICBp ZiAoc2hvdWxkX2Jsb2NrX3JlcXVlc3RfYm9keSgpKSB7CisgICAgIGF1dG8gb3V0cHV0ID0gZG93 bnN0cmVhbV8tPmdldF9ibG9ja2VkX3JlcXVlc3RfYnVmKCk7CisgICAgIGF1dG8gJnJlcSA9IGRv d25zdHJlYW1fLT5yZXF1ZXN0KCk7CisgICAgIG91dHB1dC0+YXBwZW5kKGRhdGEpOworQEAgLTc3 Myw3ICs4MDEsNyBAQCBpbnQgSHR0cERvd25zdHJlYW1Db25uZWN0aW9uOjpwdXNoX3VwbG9hZF9k YXRhX2NodW5rKAorIH0KKyAKKyBpbnQgSHR0cERvd25zdHJlYW1Db25uZWN0aW9uOjplbmRfdXBs b2FkX2RhdGEoKSB7CistICBpZiAoIWRvd25zdHJlYW1fLT5nZXRfcmVxdWVzdF9oZWFkZXJfc2Vu dCgpKSB7CisrICBpZiAoc2hvdWxkX2Jsb2NrX3JlcXVlc3RfYm9keSgpKSB7CisgICAgIGRvd25z dHJlYW1fLT5zZXRfYmxvY2tlZF9yZXF1ZXN0X2RhdGFfZW9mKHRydWUpOworICAgICBpZiAocmVx dWVzdF9oZWFkZXJfd3JpdHRlbl8pIHsKKyAgICAgICBzaWduYWxfd3JpdGUoKTsKK0BAIC05NzQs NiArMTAwMiwxMSBAQCBpbnQgaHRwX2hkcnNfY29tcGxldGVjYihsbGh0dHBfdCAqaHRwKSB7Cisg ICAvLyB1cGdyYWRlIHN1Y2NlZWRlZCwgMTAxIHJlc3BvbnNlIGlzIHRyZWF0ZWQgYXMgZmluYWwg aW4gbmdodHRweC4KKyAgIGRvd25zdHJlYW0tPmNoZWNrX3VwZ3JhZGVfZnVsZmlsbGVkX2h0dHAx KCk7CisgCisrICBpZiAocmVxLm1ldGhvZCA9PSBIVFRQX0NPTk5FQ1QgJiYgcmVzcC5odHRwX3N0 YXR1cyAvIDEwMCA9PSAyICYmCisrICAgICAgIWRvd25zdHJlYW0tPmdldF91cGdyYWRlZCgpKSB7 CisrICAgIHJlc3AuaHR0cF9zdGF0dXMgPSA1MDI7CisrICB9CisrCisgICBpZiAoZG93bnN0cmVh bS0+Z2V0X25vbl9maW5hbF9yZXNwb25zZSgpKSB7CisgICAgIC8vIFJlc2V0IGNvbnRlbnQtbGVu Z3RoIGJlY2F1c2Ugd2UgcmV1c2Ugc2FtZSBEb3duc3RyZWFtIGZvciB0aGUKKyAgICAgLy8gbmV4 dCByZXNwb25zZS4KK0BAIC05OTUsNyArMTAyOCw3IEBAIGludCBodHBfaGRyc19jb21wbGV0ZWNi KGxsaHR0cF90ICpodHApIHsKKyAgIGRvd25zdHJlYW0tPnNldF9yZXNwb25zZV9zdGF0ZShEb3du c3RyZWFtU3RhdGU6OkhFQURFUl9DT01QTEVURSk7CisgICBkb3duc3RyZWFtLT5pbnNwZWN0X2h0 dHAxX3Jlc3BvbnNlKCk7CisgCistICBpZiAoaHRwLT5mbGFncyAmIEZfQ0hVTktFRCkgeworKyAg aWYgKCFkb3duc3RyZWFtLT5nZXRfdXBncmFkZWQoKSAmJiAoaHRwLT5mbGFncyAmIEZfQ0hVTktF RCkpIHsKKyAgICAgZG93bnN0cmVhbS0+c2V0X2NodW5rZWRfcmVzcG9uc2UodHJ1ZSk7CisgICB9 CisgCitAQCAtMTAxMCwxMyArMTA0MywyMiBAQCBpbnQgaHRwX2hkcnNfY29tcGxldGVjYihsbGh0 dHBfdCAqaHRwKSB7CisgICAgIHJlc3AuY29ubmVjdGlvbl9jbG9zZSA9IHRydWU7CisgICAgIC8v IHRyYW5zZmVyLWVuY29kaW5nIG5vdCBhcHBsaWVkIHRvIHVwZ3JhZGVkIGNvbm5lY3Rpb24KKyAg ICAgZG93bnN0cmVhbS0+c2V0X2NodW5rZWRfcmVzcG9uc2UoZmFsc2UpOworLSAgfSBlbHNlIGlm IChodHRwMjo6bGVnYWN5X2h0dHAxKHJlcS5odHRwX21ham9yLCByZXEuaHR0cF9taW5vcikpIHsK Ky0gICAgaWYgKHJlc3AuZnMuY29udGVudF9sZW5ndGggPT0gLTEpIHsKKysKKysgICAgc3RhdGlj X2Nhc3Q8SHR0cERvd25zdHJlYW1Db25uZWN0aW9uICo+KGRjb25uKQorKyAgICAgIC0+cHJvY2Vz c19ibG9ja2VkX3JlcXVlc3RfYnVmX29uX3Jlc3BvbnNlKCk7CisrICB9IGVsc2UgeworKyAgICBp ZiAocmVxLnVwZ3JhZGVfcmVxdWVzdCkgeworICAgICAgIHJlc3AuY29ubmVjdGlvbl9jbG9zZSA9 IHRydWU7CisgICAgIH0KKy0gICAgZG93bnN0cmVhbS0+c2V0X2NodW5rZWRfcmVzcG9uc2UoZmFs c2UpOworLSAgfSBlbHNlIGlmICghZG93bnN0cmVhbS0+ZXhwZWN0X3Jlc3BvbnNlX2JvZHkoKSkg eworLSAgICBkb3duc3RyZWFtLT5zZXRfY2h1bmtlZF9yZXNwb25zZShmYWxzZSk7CisrCisrICAg IGlmIChodHRwMjo6bGVnYWN5X2h0dHAxKHJlcS5odHRwX21ham9yLCByZXEuaHR0cF9taW5vcikp IHsKKysgICAgICBpZiAocmVzcC5mcy5jb250ZW50X2xlbmd0aCA9PSAtMSkgeworKyAgICAgICAg cmVzcC5jb25uZWN0aW9uX2Nsb3NlID0gdHJ1ZTsKKysgICAgICB9CisrICAgICAgZG93bnN0cmVh bS0+c2V0X2NodW5rZWRfcmVzcG9uc2UoZmFsc2UpOworKyAgICB9IGVsc2UgaWYgKCFkb3duc3Ry ZWFtLT5leHBlY3RfcmVzcG9uc2VfYm9keSgpKSB7CisrICAgICAgZG93bnN0cmVhbS0+c2V0X2No dW5rZWRfcmVzcG9uc2UoZmFsc2UpOworKyAgICB9CisgICB9CisgCisgICBpZiAobG9nZ2luZ2Nv bmYuYWNjZXNzLndyaXRlX2Vhcmx5ICYmIGRvd25zdHJlYW0tPmFjY2Vzc2xvZ19yZWFkeSgpKSB7 CitAQCAtMTE5NCw3ICsxMjM2LDEwIEBAIGludCBodHBfbXNnX2NvbXBsZXRlY2IobGxodHRwX3Qg Kmh0cCkgeworIGludCBIdHRwRG93bnN0cmVhbUNvbm5lY3Rpb246OndyaXRlX2ZpcnN0KCkgewor ICAgaW50IHJ2OworIAorLSAgcHJvY2Vzc19ibG9ja2VkX3JlcXVlc3RfYnVmKCk7CisrICBhdXRv IHNob3VsZF91bmJsb2NrX3JlcV9ib2R5ID0gc2hvdWxkX3VuYmxvY2tfcmVxdWVzdF9ib2R5X2Jl Zm9yZV9yZXNwb25zZSgpOworKyAgaWYgKHNob3VsZF91bmJsb2NrX3JlcV9ib2R5KSB7CisrICAg IHByb2Nlc3NfYmxvY2tlZF9yZXF1ZXN0X2J1ZigpOworKyAgfQorIAorICAgaWYgKGNvbm5fLnRs cy5zc2wpIHsKKyAgICAgcnYgPSB3cml0ZV90bHMoKTsKK0BAIC0xMjE1LDggKzEyNjAsMTEgQEAg aW50IEh0dHBEb3duc3RyZWFtQ29ubmVjdGlvbjo6d3JpdGVfZmlyc3QoKSB7CisgICBmaXJzdF93 cml0ZV9kb25lXyA9IHRydWU7CisgICBkb3duc3RyZWFtXy0+c2V0X3JlcXVlc3RfaGVhZGVyX3Nl bnQodHJ1ZSk7CisgCistICBhdXRvIGJ1ZiA9IGRvd25zdHJlYW1fLT5nZXRfYmxvY2tlZF9yZXF1 ZXN0X2J1ZigpOworLSAgYnVmLT5yZXNldCgpOworKyAgaWYgKHNob3VsZF91bmJsb2NrX3JlcV9i b2R5KSB7CisrICAgIGF1dG8gYnVmID0gZG93bnN0cmVhbV8tPmdldF9ibG9ja2VkX3JlcXVlc3Rf YnVmKCk7CisrICAgIGJ1Zi0+cmVzZXQoKTsKKysgICAgYmxvY2tlZF9yZXF1ZXN0X2J1Zl9wcm9j ZXNzZWRfID0gdHJ1ZTsKKysgIH0KKyAKKyAgIC8vIHVwc3RyZWFtLT5yZXN1bWVfcmVhZCgpIG1p Z2h0IGJlIGNhbGxlZCBpbgorICAgLy8gd3JpdGVfdGxzKCkvd3JpdGVfY2xlYXIoKSwgYnV0IGJl Zm9yZSBibG9ja2VkX3JlcXVlc3RfYnVmXyBpcworZGlmZiAtLWdpdCBhL3NyYy9zaHJweF9odHRw X2Rvd25zdHJlYW1fY29ubmVjdGlvbi5oIGIvc3JjL3NocnB4X2h0dHBfZG93bnN0cmVhbV9jb25u ZWN0aW9uLmgKK2luZGV4IGQzZjI3NDMyLi5lYjZiYTE5ZSAxMDA2NDQKKy0tLSBhL3NyYy9zaHJw eF9odHRwX2Rvd25zdHJlYW1fY29ubmVjdGlvbi5oCisrKysgYi9zcmMvc2hycHhfaHR0cF9kb3du c3RyZWFtX2Nvbm5lY3Rpb24uaAorQEAgLTkxLDYgKzkxLDkgQEAgcHVibGljOgorICAgaW50IG5v b3AoKTsKKyAKKyAgIGludCBwcm9jZXNzX2Jsb2NrZWRfcmVxdWVzdF9idWYoKTsKKysgIHZvaWQg cHJvY2Vzc19ibG9ja2VkX3JlcXVlc3RfYnVmX29uX3Jlc3BvbnNlKCk7CisrICBib29sIHNob3Vs ZF91bmJsb2NrX3JlcXVlc3RfYm9keV9iZWZvcmVfcmVzcG9uc2UoKSBjb25zdDsKKysgIGJvb2wg c2hvdWxkX2Jsb2NrX3JlcXVlc3RfYm9keSgpIGNvbnN0OworIAorIHByaXZhdGU6CisgICBDb25u ZWN0aW9uIGNvbm5fOworQEAgLTExNyw2ICsxMjAsOCBAQCBwcml2YXRlOgorICAgYm9vbCByZXVz YWJsZV87CisgICAvLyB0cnVlIGlmIHJlcXVlc3QgaGVhZGVyIGlzIHdyaXR0ZW4gdG8gcmVxdWVz dCBidWZmZXIuCisgICBib29sIHJlcXVlc3RfaGVhZGVyX3dyaXR0ZW5fOworKyAgLy8gdHJ1ZSBp ZiBibG9ja2VkIHJlcXVlc3QgYnVmZmVyIGhhcyBiZWVuIHByb2Nlc3NlZC4KKysgIGJvb2wgYmxv Y2tlZF9yZXF1ZXN0X2J1Zl9wcm9jZXNzZWRfe307CisgfTsKKyAKKyB9IC8vIG5hbWVzcGFjZSBz aHJweAorZGlmZiAtLWdpdCBhL3NyYy9zaHJweF9odHRwc191cHN0cmVhbS5jYyBiL3NyYy9zaHJw eF9odHRwc191cHN0cmVhbS5jYworaW5kZXggN2IwNmVkYzEuLmQxODNmYzA5IDEwMDY0NAorLS0t IGEvc3JjL3NocnB4X2h0dHBzX3Vwc3RyZWFtLmNjCisrKysgYi9zcmMvc2hycHhfaHR0cHNfdXBz dHJlYW0uY2MKK0BAIC00MDIsNiArNDAyLDE3IEBAIGludCBodHBfaGRyc19jb21wbGV0ZWNiKGxs aHR0cF90ICpodHApIHsKKyAKKyAgIGRvd25zdHJlYW0tPmluc3BlY3RfaHR0cDFfcmVxdWVzdCgp OworIAorKyAgaWYgKChyZXEudXBncmFkZV9yZXF1ZXN0IHx8IGxsaHR0cF9nZXRfdXBncmFkZSho dHApKSAmJgorKyAgICAgIChyZXEuZnMuaGVhZGVyKGh0dHAyOjpIRF9UUkFOU0ZFUl9FTkNPRElO RykgfHwKKysgICAgICAgcmVxLmZzLmhlYWRlcihodHRwMjo6SERfQ09OVEVOVF9MRU5HVEgpKSkg eworKyAgICBpZiAobG9nX2VuYWJsZWQoSU5GTykpIHsKKysgICAgICBMb2d7SU5GTywgdXBzdHJl YW19IDw8ICJ0cmFuc2Zlci1lbmNvZGluZyBhbmQgY29udGVudC1sZW5ndGggYXJlIG5vdCAiCisr ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWxsb3dlZCBpbiBDT05ORUNUIG9yIHVwZ3Jh ZGUgcmVxdWVzdCI7CisrICAgIH0KKysKKysgICAgcmV0dXJuIC0xOworKyAgfQorKworICAgaWYg KGh0cC0+ZmxhZ3MgJiBGX0NIVU5LRUQpIHsKKyAgICAgZG93bnN0cmVhbS0+c2V0X2NodW5rZWRf cmVxdWVzdCh0cnVlKTsKKyAgIH0KK0BAIC01NTQsNiArNTY1LDE2IEBAIGludCBodHBfYm9keWNi KGxsaHR0cF90ICpodHAsIGNvbnN0IGNoYXIgKmRhdGEsIHNpemVfdCBsZW4pIHsKKyAgIGludCBy djsKKyAgIGF1dG8gdXBzdHJlYW0gPSBzdGF0aWNfY2FzdDxIdHRwc1Vwc3RyZWFtICo+KGh0cC0+ ZGF0YSk7CisgICBhdXRvIGRvd25zdHJlYW0gPSB1cHN0cmVhbS0+Z2V0X2Rvd25zdHJlYW0oKTsK KysgIGNvbnN0IGF1dG8gJnJlcSA9IGRvd25zdHJlYW0tPnJlcXVlc3QoKTsKKysKKysgIGlmIChy ZXEudXBncmFkZV9yZXF1ZXN0IHx8IGxsaHR0cF9nZXRfdXBncmFkZShodHApKSB7CisrICAgIGlm IChsb2dfZW5hYmxlZChJTkZPKSkgeworKyAgICAgIExvZ3tJTkZPLCB1cHN0cmVhbX0gPDwgIlJl cXVlc3QgYm9keSBmb3IgVXBncmFkZSByZXF1ZXN0IGlzIG5vdCBhbGxvd2VkIjsKKysgICAgfQor KworKyAgICByZXR1cm4gSFBFX1VTRVI7CisrICB9CisrCisgICBydiA9IGRvd25zdHJlYW0tPnB1 c2hfdXBsb2FkX2RhdGFfY2h1bmsoYXNfdWludDhfc3BhbihzdGQ6OnNwYW57ZGF0YSwgbGVufSkp OworICAgaWYgKHJ2ICE9IDApIHsKKyAgICAgLy8gSWdub3JlIGVycm9yIGlmIHJlc3BvbnNlIGhh cyBiZWVuIGNvbXBsZXRlZC4gIFdlIHdpbGwgZW5kIHVwIGluCitAQCAtNTg2LDYgKzYwNyw3IEBA IGludCBodHBfbXNnX2NvbXBsZXRlY2IobGxodHRwX3QgKmh0cCkgeworICAgfQorIAorICAgZG93 bnN0cmVhbS0+c2V0X3JlcXVlc3Rfc3RhdGUoRG93bnN0cmVhbVN0YXRlOjpNU0dfQ09NUExFVEUp OworKyAgcmVxLmh0dHAxX21zZ19jb21wbGV0ZSA9IHRydWU7CisgICBydiA9IGRvd25zdHJlYW0t PmVuZF91cGxvYWRfZGF0YSgpOworICAgaWYgKHJ2ICE9IDApIHsKKyAgICAgaWYgKGRvd25zdHJl YW0tPmdldF9yZXNwb25zZV9zdGF0ZSgpID09IERvd25zdHJlYW1TdGF0ZTo6TVNHX0NPTVBMRVRF KSB7CitAQCAtNjI2LDcgKzY0OCw4IEBAIGludCBIdHRwc1Vwc3RyZWFtOjpvbl9yZWFkKCkgewor IAorICAgLy8gZG93bnN0cmVhbSBjYW4gYmUgbnVsbHB0ciBoZXJlLCBiZWNhdXNlIGl0IGlzIGlu aXRpYWxpemVkIGluIHRoZQorICAgLy8gY2FsbGJhY2sgY2hhaW4gY2FsbGVkIGJ5IGxsaHR0cF9l eGVjdXRlKCkKKy0gIGlmIChkb3duc3RyZWFtICYmIGRvd25zdHJlYW0tPmdldF91cGdyYWRlZCgp KSB7CisrICBpZiAoZG93bnN0cmVhbSAmJiBkb3duc3RyZWFtLT5yZXF1ZXN0KCkuaHR0cDFfbXNn X2NvbXBsZXRlICYmCisrICAgICAgZG93bnN0cmVhbS0+Z2V0X3VwZ3JhZGVkKCkpIHsKKyAgICAg YXV0byBydiA9IGRvd25zdHJlYW0tPnB1c2hfdXBsb2FkX2RhdGFfY2h1bmsocmItPnBlZWsoKSk7 CisgCisgICAgIGlmIChydiAhPSAwKSB7CitAQCAtNjk5LDkgKzcyMiwxMyBAQCBpbnQgSHR0cHNV cHN0cmVhbTo6b25fcmVhZCgpIHsKKyAKKyAgIGlmIChodHBlcnIgIT0gSFBFX09LKSB7CisgICAg IGlmIChsb2dfZW5hYmxlZChJTkZPKSkgeworLSAgICAgIExvZ3tJTkZPLCB0aGlzfSA8PCAiSFRU UCBwYXJzZSBmYWlsdXJlOiAiCistICAgICAgICAgICAgICAgICAgICAgIDw8ICIoIiA8PCBsbGh0 dHBfZXJybm9fbmFtZShodHBlcnIpIDw8ICIpICIKKy0gICAgICAgICAgICAgICAgICAgICAgPDwg bGxodHRwX2dldF9lcnJvcl9yZWFzb24oJmh0cF8pOworKyAgICAgIGlmIChodHBlcnIgPT0gSFBF X1VTRVIpIHsKKysgICAgICAgIExvZ3tJTkZPLCB0aGlzfSA8PCAiSFRUUCBjYWxsYmFjayBlcnJv ciI7CisrICAgICAgfSBlbHNlIHsKKysgICAgICAgIExvZ3tJTkZPLCB0aGlzfSA8PCAiSFRUUCBw YXJzZSBmYWlsdXJlOiAiCisrICAgICAgICAgICAgICAgICAgICAgICAgPDwgIigiIDw8IGxsaHR0 cF9lcnJub19uYW1lKGh0cGVycikgPDwgIikgIgorKyAgICAgICAgICAgICAgICAgICAgICAgIDw8 IGxsaHR0cF9nZXRfZXJyb3JfcmVhc29uKCZodHBfKTsKKysgICAgICB9CisgICAgIH0KKyAKKyAg ICAgaWYgKGRvd25zdHJlYW0gJiYKKy0tIAorMi41NS4wCisKCmRpZmYgLS1naXQgYS9uZ2h0dHAy LnNwZWMgYi9uZ2h0dHAyLnNwZWMKaW5kZXggZTJjZThhOC4uNzIxN2M0YSAxMDA2NDQKLS0tIGEv bmdodHRwMi5zcGVjCisrKyBiL25naHR0cDIuc3BlYwpAQCAtMTMsNyArMTMsNyBAQAogU3VtbWFy eTogRXhwZXJpbWVudGFsIEhUVFAvMiBjbGllbnQsIHNlcnZlciBhbmQgcHJveHkKIE5hbWU6IG5n aHR0cDIKIFZlcnNpb246IDEuNjkuMAotUmVsZWFzZTogNCV7P2Rpc3R9CitSZWxlYXNlOiA1JXs/ ZGlzdH0KIAogIyBQYXJ0cyBvZiBydWJ5IGJpbmRpbmdzIGFyZSBhZGRpdGlvbmFsbHkgdW5kZXIg R1BMLTIuMC1vci1sYXRlciwgTUlUIGFuZAogIyBIUE5ELUtldmxpbi1IZW5uZXkgYnV0IHRoZXkg YXJlIE5PVCBzaGlwcGVkLgpAQCAtMjQsNiArMjQsOSBAQCBTb3VyY2UwOiBodHRwczovL2dpdGh1 Yi5jb20vdGF0c3VoaXJvLXQvbmdodHRwMi9yZWxlYXNlcy9kb3dubG9hZC92JXt2ZXJzaW9ufS9u ZwogU291cmNlMTogaHR0cHM6Ly9naXRodWIuY29tLyV7bmFtZX0vJXtuYW1lfS9yZWxlYXNlcy9k b3dubG9hZC92JXt2ZXJzaW9ufS8le25hbWV9LSV7dmVyc2lvbn0udGFyLnh6LmFzYwogU291cmNl MjogdGF0c3VoaXJvLXQucGdwCiAKKyMgZml4IEhUVFAgUmVxdWVzdC9SZXNwb25zZSBTbXVnZ2xp bmcgYW5kIFJlc3BvbnNlLVF1ZXVlIFBvaXNvbmluZyB2aWEgYW1iaWd1b3VzIEhUVFAvMS4xIFVw Z3JhZGUgcmVxdWVzdHMgKENWRS0yMDI2LTU4MDU1KQorUGF0Y2gwMDE6IDAwMDEtbmdodHRwMi0x LjY5LjAtQ1ZFLTIwMjYtNTgwNTUucGF0Y2gKKwogQnVpbGRSZXF1aXJlczogQ1VuaXQtZGV2ZWwK IEJ1aWxkUmVxdWlyZXM6IGMtYXJlcy1kZXZlbAogQnVpbGRSZXF1aXJlczogZ2NjLWMrKwpAQCAt MjI4LDYgKzIzMSw5IEBAIHBvcGQKIAogCiAlY2hhbmdlbG9nCisqIEZyaSBBdWcgMDcgMjAyNiBK YW4gTWFja3UgPGphbWFja3VAcmVkaGF0LmNvbT4gLSAxLjY5LjAtNQorLSBmaXggSFRUUCBSZXF1 ZXN0L1Jlc3BvbnNlIFNtdWdnbGluZyBhbmQgUmVzcG9uc2UtUXVldWUgUG9pc29uaW5nIHZpYSBh bWJpZ3VvdXMgSFRUUC8xLjEgVXBncmFkZSByZXF1ZXN0cyAoQ1ZFLTIwMjYtNTgwNTUpCisKICog VGh1IEp1bCAxNiAyMDI2IEZlZG9yYSBSZWxlYXNlIEVuZ2luZWVyaW5nIDxyZWxlbmdAZmVkb3Jh cHJvamVjdC5vcmc+IC0gMS42OS4wLTQKIC0gUmVidWlsdCBmb3IgaHR0cHM6Ly9mZWRvcmFwcm9q ZWN0Lm9yZy93aWtpL0ZlZG9yYV80NV9NYXNzX1JlYnVpbGQKIAo=