From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Jan Macku To: git-commits@fedoraproject.org Subject: [rpms/nghttp2] f43: Resolves: CVE-2026-58055 - HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests Date: Fri, 07 Aug 2026 11:30:52 GMT Message-ID: <178610225227.1.11890197792701792815.rpms-nghttp2-4c4521b0e8e9@fedoraproject.org> List-ID: X-Git-Repo: rpms/nghttp2 X-Git-Branch: f43 X-Git-Rev: 4c4521b0e8e9e9b2bdb6f1c965fd0e5ad2a15f11 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvbmdodHRwMgpCcmFu Y2ggOiBmNDMKQ29tbWl0IDogNGM0NTIxYjBlOGU5ZTliMmJkYjZmMWM5NjVmZDBlNWFkMmExNWYx MQpBdXRob3IgOiBKYW4gTWFja3UgPGphbWFja3VAcmVkaGF0LmNvbT4KRGF0ZSAgIDogMjAyNi0w OC0wN1QxMzoxMzo0NSswMjowMApTdGF0cyAgOiArMzIyLy0xIGluIDIgZmlsZShzKQpVUkwgICAg OiBodHRwczovL3NyYy5mZWRvcmFwcm9qZWN0Lm9yZy9ycG1zL25naHR0cDIvYy80YzQ1MjFiMGU4 ZTllOWIyYmRiNmYxYzk2NWZkMGU1YWQyYTE1ZjExP2JyYW5jaD1mNDMKCkxvZzoKUmVzb2x2ZXM6 IENWRS0yMDI2LTU4MDU1IC0gSFRUUCBSZXF1ZXN0L1Jlc3BvbnNlIFNtdWdnbGluZyBhbmQgUmVz cG9uc2UtUXVldWUgUG9pc29uaW5nIHZpYSBhbWJpZ3VvdXMgSFRUUC8xLjEgVXBncmFkZSByZXF1 ZXN0cwoKLS0tCmRpZmYgLS1naXQgYS8wMDAxLW5naHR0cDItMS42Ni4wLUNWRS0yMDI2LTU4MDU1 LnBhdGNoIGIvMDAwMS1uZ2h0dHAyLTEuNjYuMC1DVkUtMjAyNi01ODA1NS5wYXRjaApuZXcgZmls ZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi4zNTMzY2QzCi0tLSAvZGV2L251bGwKKysrIGIv MDAwMS1uZ2h0dHAyLTEuNjYuMC1DVkUtMjAyNi01ODA1NS5wYXRjaApAQCAtMCwwICsxLDMxNSBA QAorRnJvbSA0NTU2MjRkYzlmMWM1ZjU5MzA1ZjQ2YzJmMDRiOTZmMGFjYjBlNGIxIE1vbiBTZXAg MTcgMDA6MDA6MDAgMjAwMQorRnJvbTogVGF0c3VoaXJvIFRzdWppa2F3YSA8dGF0c3VoaXJvLnRA Z21haWwuY29tPgorRGF0ZTogRnJpLCAyMiBNYXkgMjAyNiAyMToyNjo0NCArMDkwMAorU3ViamVj dDogW1BBVENIXSBuZ2h0dHB4OiBUaWdodGVuIHVwIENPTk5FQ1QgYW5kIEhUVFAgVXBncmFkZSBo YW5kbGluZworCisoY2hlcnJ5IHBpY2tlZCBmcm9tIGNvbW1pdCBhYjI4MTA1YzRhMDE5N2RhMjRm OGJmYzQxNGJjMTE2MDU1MjQ5ZTFlKQorLS0tCisgc3JjL3NocnB4X2Rvd25zdHJlYW0uY2MgICAg ICAgICAgICAgICAgIHwgIDMgKy0KKyBzcmMvc2hycHhfZG93bnN0cmVhbS5oICAgICAgICAgICAg ICAgICAgfCAgNCArKworIHNyYy9zaHJweF9odHRwMl91cHN0cmVhbS5jYyAgICAgICAgICAgICB8 ICA4ICsrKworIHNyYy9zaHJweF9odHRwM191cHN0cmVhbS5jYyAgICAgICAgICAgICB8ICA4ICsr KworIHNyYy9zaHJweF9odHRwX2Rvd25zdHJlYW1fY29ubmVjdGlvbi5jYyB8IDcwICsrKysrKysr KysrKysrKysrKysrKy0tLS0KKyBzcmMvc2hycHhfaHR0cF9kb3duc3RyZWFtX2Nvbm5lY3Rpb24u aCAgfCAgNSArKworIHNyYy9zaHJweF9odHRwc191cHN0cmVhbS5jYyAgICAgICAgICAgICB8IDM1 ICsrKysrKysrKysrLS0KKyA3IGZpbGVzIGNoYW5nZWQsIDExNyBpbnNlcnRpb25zKCspLCAxNiBk ZWxldGlvbnMoLSkKKworZGlmZiAtLWdpdCBhL3NyYy9zaHJweF9kb3duc3RyZWFtLmNjIGIvc3Jj L3NocnB4X2Rvd25zdHJlYW0uY2MKK2luZGV4IDljZmZjZDdjLi45ZjA4ZTgzMSAxMDA2NDQKKy0t LSBhL3NyYy9zaHJweF9kb3duc3RyZWFtLmNjCisrKysgYi9zcmMvc2hycHhfZG93bnN0cmVhbS5j YworQEAgLTExNDgsNyArMTE0OCw4IEBAIGJvb2wgRG93bnN0cmVhbTo6Y2FuX2RldGFjaF9kb3du c3RyZWFtX2Nvbm5lY3Rpb24oKSBjb25zdCB7CisgICAvLyBzdGF0ZSwgZXNwZWNpYWxseSBmb3Ig SFRUUC8xLjEKKyAgIHJldHVybiBkY29ubl8gJiYgcmVzcG9uc2Vfc3RhdGVfID09IERvd25zdHJl YW1TdGF0ZTo6TVNHX0NPTVBMRVRFICYmCisgICAgICAgICAgcmVxdWVzdF9zdGF0ZV8gPT0gRG93 bnN0cmVhbVN0YXRlOjpNU0dfQ09NUExFVEUgJiYgIXVwZ3JhZGVkXyAmJgorLSAgICAgICAgICFy ZXNwXy5jb25uZWN0aW9uX2Nsb3NlICYmIHJlcXVlc3RfYnVmXy5ybGVmdCgpID09IDA7CisrICAg ICAgICAgIXJlc3BfLmNvbm5lY3Rpb25fY2xvc2UgJiYgYmxvY2tlZF9yZXF1ZXN0X2J1Zl8ucmxl ZnQoKSA9PSAwICYmCisrICAgICAgICAgcmVxdWVzdF9idWZfLnJsZWZ0KCkgPT0gMDsKKyB9Cisg CisgRGVmYXVsdE1lbWNodW5rcyBEb3duc3RyZWFtOjpwb3BfcmVzcG9uc2VfYnVmKCkgeworZGlm ZiAtLWdpdCBhL3NyYy9zaHJweF9kb3duc3RyZWFtLmggYi9zcmMvc2hycHhfZG93bnN0cmVhbS5o CitpbmRleCBmODdjN2Y0OS4uNDJkZDQyYWYgMTAwNjQ0CistLS0gYS9zcmMvc2hycHhfZG93bnN0 cmVhbS5oCisrKysgYi9zcmMvc2hycHhfZG93bnN0cmVhbS5oCitAQCAtMjMzLDYgKzIzMywxMCBA QCBzdHJ1Y3QgUmVxdWVzdCB7CisgICAvLyBvcmlnX2F1dGhvcml0eSBhbmQgb3JpZ19wYXRoIGhh dmUgdGhlIGF1dGhvcml0eSBhbmQgcGF0aCB3aGljaAorICAgLy8gYXJlIHVzZWQgZm9yIHRoZSBm aXJzdCBiYWNrZW5kIHNlbGVjdGlvbi4KKyAgIGJvb2wgZm9yd2FyZGVkX29uY2U7CisrICAvLyB0 cnVlIGlmIEhUVFAvMSByZXF1ZXN0IG1lc3NhZ2UgaGFzIGJlZW4gY29tcGxldGVkLiAgVGhpcyBm aWVsZCBpcworKyAgLy8gYWRkZWQgYmVjYXVzZSBEb3duc3RyZWFtOjpnZXRfcmVxdWVzdF9zdGF0 ZSgpIG1pZ2h0IGJlIGFsdGVyZWQKKysgIC8vIGZyb20gRG93bnN0cmVhbVN0YXRlOjpNU0dfQ09N UExFVEUuCisrICBib29sIGh0dHAxX21zZ19jb21wbGV0ZXt9OworIH07CisgCisgc3RydWN0IFJl c3BvbnNlIHsKK2RpZmYgLS1naXQgYS9zcmMvc2hycHhfaHR0cDJfdXBzdHJlYW0uY2MgYi9zcmMv c2hycHhfaHR0cDJfdXBzdHJlYW0uY2MKK2luZGV4IDNjM2NhMGY1Li4xMGZkZjEwYiAxMDA2NDQK Ky0tLSBhL3NyYy9zaHJweF9odHRwMl91cHN0cmVhbS5jYworKysrIGIvc3JjL3NocnB4X2h0dHAy X3Vwc3RyZWFtLmNjCitAQCAtMzMwLDYgKzMzMCwxNCBAQCBpbnQgSHR0cDJVcHN0cmVhbTo6b25f cmVxdWVzdF9oZWFkZXJzKERvd25zdHJlYW0gKmRvd25zdHJlYW0sCisgICAgIHJldHVybiAwOwor ICAgfQorIAorKyAgaWYgKG1ldGhvZF90b2tlbiA9PSBIVFRQX0NPTk5FQ1QgJiYgY29udGVudF9s ZW5ndGgpIHsKKysgICAgaWYgKExPR19FTkFCTEVEKElORk8pKSB7CisrICAgICAgVUxPRyhJTkZP LCB0aGlzKSA8PCAiY29udGVudC1sZW5ndGggYXJlIG5vdCBhbGxvd2VkIGluIENPTk5FQ1QgcmVx dWVzdCI7CisrICAgIH0KKysKKysgICAgcmV0dXJuIGVycm9yX3JlcGx5KGRvd25zdHJlYW0sIDQw MCk7CisrICB9CisrCisgICBhdXRvIGZhZGRyID0gaGFuZGxlcl8tPmdldF91cHN0cmVhbV9hZGRy KCk7CisgCisgICAvLyBGb3IgSFRUUC8yIHByb3h5LCB3ZSByZXF1aXJlIDphdXRob3JpdHkuCitk aWZmIC0tZ2l0IGEvc3JjL3NocnB4X2h0dHAzX3Vwc3RyZWFtLmNjIGIvc3JjL3NocnB4X2h0dHAz X3Vwc3RyZWFtLmNjCitpbmRleCBlNzlmYjNmYS4uYzVjN2NiOWYgMTAwNjQ0CistLS0gYS9zcmMv c2hycHhfaHR0cDNfdXBzdHJlYW0uY2MKKysrKyBiL3NyYy9zaHJweF9odHRwM191cHN0cmVhbS5j YworQEAgLTIyNTYsNiArMjI1NiwxNCBAQCBpbnQgSHR0cDNVcHN0cmVhbTo6aHR0cF9lbmRfcmVx dWVzdF9oZWFkZXJzKERvd25zdHJlYW0gKmRvd25zdHJlYW0sIGludCBmaW4pIHsKKyAgICAgcmV0 dXJuIDA7CisgICB9CisgCisrICBpZiAobWV0aG9kX3Rva2VuID09IEhUVFBfQ09OTkVDVCAmJiBj b250ZW50X2xlbmd0aCkgeworKyAgICBpZiAoTE9HX0VOQUJMRUQoSU5GTykpIHsKKysgICAgICBV TE9HKElORk8sIHRoaXMpIDw8ICJjb250ZW50LWxlbmd0aCBhcmUgbm90IGFsbG93ZWQgaW4gQ09O TkVDVCByZXF1ZXN0IjsKKysgICAgfQorKworKyAgICByZXR1cm4gZXJyb3JfcmVwbHkoZG93bnN0 cmVhbSwgNDAwKTsKKysgIH0KKysKKyAgIGF1dG8gZmFkZHIgPSBoYW5kbGVyXy0+Z2V0X3Vwc3Ry ZWFtX2FkZHIoKTsKKyAKKyAgIGF1dG8gY29uZmlnID0gZ2V0X2NvbmZpZygpOworZGlmZiAtLWdp dCBhL3NyYy9zaHJweF9odHRwX2Rvd25zdHJlYW1fY29ubmVjdGlvbi5jYyBiL3NyYy9zaHJweF9o dHRwX2Rvd25zdHJlYW1fY29ubmVjdGlvbi5jYworaW5kZXggZmI5ZjIwMWMuLjQzMDhkOTI2IDEw MDY0NAorLS0tIGEvc3JjL3NocnB4X2h0dHBfZG93bnN0cmVhbV9jb25uZWN0aW9uLmNjCisrKysg Yi9zcmMvc2hycHhfaHR0cF9kb3duc3RyZWFtX2Nvbm5lY3Rpb24uY2MKK0BAIC03MTUsNiArNzE1 LDM0IEBAIGludCBIdHRwRG93bnN0cmVhbUNvbm5lY3Rpb246OnB1c2hfcmVxdWVzdF9oZWFkZXJz KCkgeworICAgcmV0dXJuIDA7CisgfQorIAorK2Jvb2wgSHR0cERvd25zdHJlYW1Db25uZWN0aW9u OjpzaG91bGRfYmxvY2tfcmVxdWVzdF9ib2R5KCkgY29uc3QgeworKyAgY29uc3QgYXV0byAmcmVx ID0gZG93bnN0cmVhbV8tPnJlcXVlc3QoKTsKKysKKysgIHJldHVybiAhZG93bnN0cmVhbV8tPmdl dF9yZXF1ZXN0X2hlYWRlcl9zZW50KCkgfHwKKysgICAgICAgICAocmVxLnVwZ3JhZGVfcmVxdWVz dCAmJiAhZG93bnN0cmVhbV8tPmdldF91cGdyYWRlZCgpKTsKKyt9CisrCisrYm9vbCBIdHRwRG93 bnN0cmVhbUNvbm5lY3Rpb246OnNob3VsZF91bmJsb2NrX3JlcXVlc3RfYm9keV9iZWZvcmVfcmVz cG9uc2UoKQorKyAgY29uc3QgeworKyAgY29uc3QgYXV0byAmcmVxID0gZG93bnN0cmVhbV8tPnJl cXVlc3QoKTsKKysKKysgIHJldHVybiAhcmVxLnVwZ3JhZGVfcmVxdWVzdDsKKyt9CisrCisrdm9p ZCBIdHRwRG93bnN0cmVhbUNvbm5lY3Rpb246OnByb2Nlc3NfYmxvY2tlZF9yZXF1ZXN0X2J1Zl9v bl9yZXNwb25zZSgpIHsKKysgIGlmIChibG9ja2VkX3JlcXVlc3RfYnVmX3Byb2Nlc3NlZF8pIHsK KysgICAgcmV0dXJuOworKyAgfQorKworKyAgcHJvY2Vzc19ibG9ja2VkX3JlcXVlc3RfYnVmKCk7 CisrCisrICBhdXRvIGJ1ZiA9IGRvd25zdHJlYW1fLT5nZXRfYmxvY2tlZF9yZXF1ZXN0X2J1Zigp OworKyAgYnVmLT5yZXNldCgpOworKyAgYmxvY2tlZF9yZXF1ZXN0X2J1Zl9wcm9jZXNzZWRfID0g dHJ1ZTsKKysKKysgIHNpZ25hbF93cml0ZSgpOworK30KKysKKyBpbnQgSHR0cERvd25zdHJlYW1D b25uZWN0aW9uOjpwcm9jZXNzX2Jsb2NrZWRfcmVxdWVzdF9idWYoKSB7CisgICBhdXRvIHNyYyA9 IGRvd25zdHJlYW1fLT5nZXRfYmxvY2tlZF9yZXF1ZXN0X2J1ZigpOworIAorQEAgLTc0NCw3ICs3 NzIsNyBAQCBpbnQgSHR0cERvd25zdHJlYW1Db25uZWN0aW9uOjpwcm9jZXNzX2Jsb2NrZWRfcmVx dWVzdF9idWYoKSB7CisgCisgaW50IEh0dHBEb3duc3RyZWFtQ29ubmVjdGlvbjo6cHVzaF91cGxv YWRfZGF0YV9jaHVuayhjb25zdCB1aW50OF90ICpkYXRhLAorICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc2l6ZV90IGRhdGFsZW4pIHsKKy0gIGlm ICghZG93bnN0cmVhbV8tPmdldF9yZXF1ZXN0X2hlYWRlcl9zZW50KCkpIHsKKysgIGlmIChzaG91 bGRfYmxvY2tfcmVxdWVzdF9ib2R5KCkpIHsKKyAgICAgYXV0byBvdXRwdXQgPSBkb3duc3RyZWFt Xy0+Z2V0X2Jsb2NrZWRfcmVxdWVzdF9idWYoKTsKKyAgICAgYXV0byAmcmVxID0gZG93bnN0cmVh bV8tPnJlcXVlc3QoKTsKKyAgICAgb3V0cHV0LT5hcHBlbmQoZGF0YSwgZGF0YWxlbik7CitAQCAt Nzc2LDcgKzgwNCw3IEBAIGludCBIdHRwRG93bnN0cmVhbUNvbm5lY3Rpb246OnB1c2hfdXBsb2Fk X2RhdGFfY2h1bmsoY29uc3QgdWludDhfdCAqZGF0YSwKKyB9CisgCisgaW50IEh0dHBEb3duc3Ry ZWFtQ29ubmVjdGlvbjo6ZW5kX3VwbG9hZF9kYXRhKCkgeworLSAgaWYgKCFkb3duc3RyZWFtXy0+ Z2V0X3JlcXVlc3RfaGVhZGVyX3NlbnQoKSkgeworKyAgaWYgKHNob3VsZF9ibG9ja19yZXF1ZXN0 X2JvZHkoKSkgeworICAgICBkb3duc3RyZWFtXy0+c2V0X2Jsb2NrZWRfcmVxdWVzdF9kYXRhX2Vv Zih0cnVlKTsKKyAgICAgaWYgKHJlcXVlc3RfaGVhZGVyX3dyaXR0ZW5fKSB7CisgICAgICAgc2ln bmFsX3dyaXRlKCk7CitAQCAtOTc3LDYgKzEwMDUsMTEgQEAgaW50IGh0cF9oZHJzX2NvbXBsZXRl Y2IobGxodHRwX3QgKmh0cCkgeworICAgLy8gdXBncmFkZSBzdWNjZWVkZWQsIDEwMSByZXNwb25z ZSBpcyB0cmVhdGVkIGFzIGZpbmFsIGluIG5naHR0cHguCisgICBkb3duc3RyZWFtLT5jaGVja191 cGdyYWRlX2Z1bGZpbGxlZF9odHRwMSgpOworIAorKyAgaWYgKHJlcS5tZXRob2QgPT0gSFRUUF9D T05ORUNUICYmIHJlc3AuaHR0cF9zdGF0dXMgLyAxMDAgPT0gMiAmJgorKyAgICAgICFkb3duc3Ry ZWFtLT5nZXRfdXBncmFkZWQoKSkgeworKyAgICByZXNwLmh0dHBfc3RhdHVzID0gNTAyOworKyAg fQorKworICAgaWYgKGRvd25zdHJlYW0tPmdldF9ub25fZmluYWxfcmVzcG9uc2UoKSkgeworICAg ICAvLyBSZXNldCBjb250ZW50LWxlbmd0aCBiZWNhdXNlIHdlIHJldXNlIHNhbWUgRG93bnN0cmVh bSBmb3IgdGhlCisgICAgIC8vIG5leHQgcmVzcG9uc2UuCitAQCAtOTk4LDcgKzEwMzEsNyBAQCBp bnQgaHRwX2hkcnNfY29tcGxldGVjYihsbGh0dHBfdCAqaHRwKSB7CisgICBkb3duc3RyZWFtLT5z ZXRfcmVzcG9uc2Vfc3RhdGUoRG93bnN0cmVhbVN0YXRlOjpIRUFERVJfQ09NUExFVEUpOworICAg ZG93bnN0cmVhbS0+aW5zcGVjdF9odHRwMV9yZXNwb25zZSgpOworIAorLSAgaWYgKGh0cC0+Zmxh Z3MgJiBGX0NIVU5LRUQpIHsKKysgIGlmICghZG93bnN0cmVhbS0+Z2V0X3VwZ3JhZGVkKCkgJiYg KGh0cC0+ZmxhZ3MgJiBGX0NIVU5LRUQpKSB7CisgICAgIGRvd25zdHJlYW0tPnNldF9jaHVua2Vk X3Jlc3BvbnNlKHRydWUpOworICAgfQorIAorQEAgLTEwMTMsMTMgKzEwNDYsMjIgQEAgaW50IGh0 cF9oZHJzX2NvbXBsZXRlY2IobGxodHRwX3QgKmh0cCkgeworICAgICByZXNwLmNvbm5lY3Rpb25f Y2xvc2UgPSB0cnVlOworICAgICAvLyB0cmFuc2Zlci1lbmNvZGluZyBub3QgYXBwbGllZCB0byB1 cGdyYWRlZCBjb25uZWN0aW9uCisgICAgIGRvd25zdHJlYW0tPnNldF9jaHVua2VkX3Jlc3BvbnNl KGZhbHNlKTsKKy0gIH0gZWxzZSBpZiAoaHR0cDI6OmxlZ2FjeV9odHRwMShyZXEuaHR0cF9tYWpv ciwgcmVxLmh0dHBfbWlub3IpKSB7CistICAgIGlmIChyZXNwLmZzLmNvbnRlbnRfbGVuZ3RoID09 IC0xKSB7CisrCisrICAgIHN0YXRpY19jYXN0PEh0dHBEb3duc3RyZWFtQ29ubmVjdGlvbiAqPihk Y29ubikKKysgICAgICAtPnByb2Nlc3NfYmxvY2tlZF9yZXF1ZXN0X2J1Zl9vbl9yZXNwb25zZSgp OworKyAgfSBlbHNlIHsKKysgICAgaWYgKHJlcS51cGdyYWRlX3JlcXVlc3QpIHsKKyAgICAgICBy ZXNwLmNvbm5lY3Rpb25fY2xvc2UgPSB0cnVlOworICAgICB9CistICAgIGRvd25zdHJlYW0tPnNl dF9jaHVua2VkX3Jlc3BvbnNlKGZhbHNlKTsKKy0gIH0gZWxzZSBpZiAoIWRvd25zdHJlYW0tPmV4 cGVjdF9yZXNwb25zZV9ib2R5KCkpIHsKKy0gICAgZG93bnN0cmVhbS0+c2V0X2NodW5rZWRfcmVz cG9uc2UoZmFsc2UpOworKworKyAgICBpZiAoaHR0cDI6OmxlZ2FjeV9odHRwMShyZXEuaHR0cF9t YWpvciwgcmVxLmh0dHBfbWlub3IpKSB7CisrICAgICAgaWYgKHJlc3AuZnMuY29udGVudF9sZW5n dGggPT0gLTEpIHsKKysgICAgICAgIHJlc3AuY29ubmVjdGlvbl9jbG9zZSA9IHRydWU7CisrICAg ICAgfQorKyAgICAgIGRvd25zdHJlYW0tPnNldF9jaHVua2VkX3Jlc3BvbnNlKGZhbHNlKTsKKysg ICAgfSBlbHNlIGlmICghZG93bnN0cmVhbS0+ZXhwZWN0X3Jlc3BvbnNlX2JvZHkoKSkgeworKyAg ICAgIGRvd25zdHJlYW0tPnNldF9jaHVua2VkX3Jlc3BvbnNlKGZhbHNlKTsKKysgICAgfQorICAg fQorIAorICAgaWYgKGxvZ2dpbmdjb25mLmFjY2Vzcy53cml0ZV9lYXJseSAmJiBkb3duc3RyZWFt LT5hY2Nlc3Nsb2dfcmVhZHkoKSkgeworQEAgLTExOTcsNyArMTIzOSwxMCBAQCBpbnQgaHRwX21z Z19jb21wbGV0ZWNiKGxsaHR0cF90ICpodHApIHsKKyBpbnQgSHR0cERvd25zdHJlYW1Db25uZWN0 aW9uOjp3cml0ZV9maXJzdCgpIHsKKyAgIGludCBydjsKKyAKKy0gIHByb2Nlc3NfYmxvY2tlZF9y ZXF1ZXN0X2J1ZigpOworKyAgYXV0byBzaG91bGRfdW5ibG9ja19yZXFfYm9keSA9IHNob3VsZF91 bmJsb2NrX3JlcXVlc3RfYm9keV9iZWZvcmVfcmVzcG9uc2UoKTsKKysgIGlmIChzaG91bGRfdW5i bG9ja19yZXFfYm9keSkgeworKyAgICBwcm9jZXNzX2Jsb2NrZWRfcmVxdWVzdF9idWYoKTsKKysg IH0KKyAKKyAgIGlmIChjb25uXy50bHMuc3NsKSB7CisgICAgIHJ2ID0gd3JpdGVfdGxzKCk7CitA QCAtMTIxOCw4ICsxMjYzLDExIEBAIGludCBIdHRwRG93bnN0cmVhbUNvbm5lY3Rpb246OndyaXRl X2ZpcnN0KCkgeworICAgZmlyc3Rfd3JpdGVfZG9uZV8gPSB0cnVlOworICAgZG93bnN0cmVhbV8t PnNldF9yZXF1ZXN0X2hlYWRlcl9zZW50KHRydWUpOworIAorLSAgYXV0byBidWYgPSBkb3duc3Ry ZWFtXy0+Z2V0X2Jsb2NrZWRfcmVxdWVzdF9idWYoKTsKKy0gIGJ1Zi0+cmVzZXQoKTsKKysgIGlm IChzaG91bGRfdW5ibG9ja19yZXFfYm9keSkgeworKyAgICBhdXRvIGJ1ZiA9IGRvd25zdHJlYW1f LT5nZXRfYmxvY2tlZF9yZXF1ZXN0X2J1ZigpOworKyAgICBidWYtPnJlc2V0KCk7CisrICAgIGJs b2NrZWRfcmVxdWVzdF9idWZfcHJvY2Vzc2VkXyA9IHRydWU7CisrICB9CisgCisgICAvLyB1cHN0 cmVhbS0+cmVzdW1lX3JlYWQoKSBtaWdodCBiZSBjYWxsZWQgaW4KKyAgIC8vIHdyaXRlX3Rscygp L3dyaXRlX2NsZWFyKCksIGJ1dCBiZWZvcmUgYmxvY2tlZF9yZXF1ZXN0X2J1Zl8gaXMKK2RpZmYg LS1naXQgYS9zcmMvc2hycHhfaHR0cF9kb3duc3RyZWFtX2Nvbm5lY3Rpb24uaCBiL3NyYy9zaHJw eF9odHRwX2Rvd25zdHJlYW1fY29ubmVjdGlvbi5oCitpbmRleCBiOWY3MGM3NC4uMmYxYTFhMWMg MTAwNjQ0CistLS0gYS9zcmMvc2hycHhfaHR0cF9kb3duc3RyZWFtX2Nvbm5lY3Rpb24uaAorKysr IGIvc3JjL3NocnB4X2h0dHBfZG93bnN0cmVhbV9jb25uZWN0aW9uLmgKK0BAIC05MSw2ICs5MSw5 IEBAIHB1YmxpYzoKKyAgIGludCBub29wKCk7CisgCisgICBpbnQgcHJvY2Vzc19ibG9ja2VkX3Jl cXVlc3RfYnVmKCk7CisrICB2b2lkIHByb2Nlc3NfYmxvY2tlZF9yZXF1ZXN0X2J1Zl9vbl9yZXNw b25zZSgpOworKyAgYm9vbCBzaG91bGRfdW5ibG9ja19yZXF1ZXN0X2JvZHlfYmVmb3JlX3Jlc3Bv bnNlKCkgY29uc3Q7CisrICBib29sIHNob3VsZF9ibG9ja19yZXF1ZXN0X2JvZHkoKSBjb25zdDsK KyAKKyBwcml2YXRlOgorICAgQ29ubmVjdGlvbiBjb25uXzsKK0BAIC0xMTcsNiArMTIwLDggQEAg cHJpdmF0ZToKKyAgIGJvb2wgcmV1c2FibGVfOworICAgLy8gdHJ1ZSBpZiByZXF1ZXN0IGhlYWRl ciBpcyB3cml0dGVuIHRvIHJlcXVlc3QgYnVmZmVyLgorICAgYm9vbCByZXF1ZXN0X2hlYWRlcl93 cml0dGVuXzsKKysgIC8vIHRydWUgaWYgYmxvY2tlZCByZXF1ZXN0IGJ1ZmZlciBoYXMgYmVlbiBw cm9jZXNzZWQuCisrICBib29sIGJsb2NrZWRfcmVxdWVzdF9idWZfcHJvY2Vzc2VkX3t9OworIH07 CisgCisgfSAvLyBuYW1lc3BhY2Ugc2hycHgKK2RpZmYgLS1naXQgYS9zcmMvc2hycHhfaHR0cHNf dXBzdHJlYW0uY2MgYi9zcmMvc2hycHhfaHR0cHNfdXBzdHJlYW0uY2MKK2luZGV4IDVkZTE0MGZi Li40ODQ3YzhlMiAxMDA2NDQKKy0tLSBhL3NyYy9zaHJweF9odHRwc191cHN0cmVhbS5jYworKysr IGIvc3JjL3NocnB4X2h0dHBzX3Vwc3RyZWFtLmNjCitAQCAtNDA4LDYgKzQwOCwxNyBAQCBpbnQg aHRwX2hkcnNfY29tcGxldGVjYihsbGh0dHBfdCAqaHRwKSB7CisgCisgICBkb3duc3RyZWFtLT5p bnNwZWN0X2h0dHAxX3JlcXVlc3QoKTsKKyAKKysgIGlmICgocmVxLnVwZ3JhZGVfcmVxdWVzdCB8 fCBsbGh0dHBfZ2V0X3VwZ3JhZGUoaHRwKSkgJiYKKysgICAgICAocmVxLmZzLmhlYWRlcihodHRw Mjo6SERfVFJBTlNGRVJfRU5DT0RJTkcpIHx8CisrICAgICAgIHJlcS5mcy5oZWFkZXIoaHR0cDI6 OkhEX0NPTlRFTlRfTEVOR1RIKSkpIHsKKysgICAgaWYgKExPR19FTkFCTEVEKElORk8pKSB7Cisr ICAgICAgVUxPRyhJTkZPLCB1cHN0cmVhbSkgPDwgInRyYW5zZmVyLWVuY29kaW5nIGFuZCBjb250 ZW50LWxlbmd0aCBhcmUgbm90ICIKKysgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJhbGxv d2VkIGluIENPTk5FQ1Qgb3IgdXBncmFkZSByZXF1ZXN0IjsKKysgICAgfQorKworKyAgICByZXR1 cm4gLTE7CisrICB9CisrCisgICBpZiAoaHRwLT5mbGFncyAmIEZfQ0hVTktFRCkgeworICAgICBk b3duc3RyZWFtLT5zZXRfY2h1bmtlZF9yZXF1ZXN0KHRydWUpOworICAgfQorQEAgLTU1Miw2ICs1 NjMsMTYgQEAgaW50IGh0cF9ib2R5Y2IobGxodHRwX3QgKmh0cCwgY29uc3QgY2hhciAqZGF0YSwg c2l6ZV90IGxlbikgeworICAgaW50IHJ2OworICAgYXV0byB1cHN0cmVhbSA9IHN0YXRpY19jYXN0 PEh0dHBzVXBzdHJlYW0gKj4oaHRwLT5kYXRhKTsKKyAgIGF1dG8gZG93bnN0cmVhbSA9IHVwc3Ry ZWFtLT5nZXRfZG93bnN0cmVhbSgpOworKyAgY29uc3QgYXV0byAmcmVxID0gZG93bnN0cmVhbS0+ cmVxdWVzdCgpOworKworKyAgaWYgKHJlcS51cGdyYWRlX3JlcXVlc3QgfHwgbGxodHRwX2dldF91 cGdyYWRlKGh0cCkpIHsKKysgICAgaWYgKExPR19FTkFCTEVEKElORk8pKSB7CisrICAgICAgVUxP RyhJTkZPLCB1cHN0cmVhbSkgPDwgIlJlcXVlc3QgYm9keSBmb3IgVXBncmFkZSByZXF1ZXN0IGlz IG5vdCBhbGxvd2VkIjsKKysgICAgfQorKworKyAgICByZXR1cm4gSFBFX1VTRVI7CisrICB9Cisr CisgICBydiA9IGRvd25zdHJlYW0tPnB1c2hfdXBsb2FkX2RhdGFfY2h1bmsoCisgICAgIHJlaW50 ZXJwcmV0X2Nhc3Q8Y29uc3QgdWludDhfdCAqPihkYXRhKSwgbGVuKTsKKyAgIGlmIChydiAhPSAw KSB7CitAQCAtNTg1LDYgKzYwNiw3IEBAIGludCBodHBfbXNnX2NvbXBsZXRlY2IobGxodHRwX3Qg Kmh0cCkgeworICAgfQorIAorICAgZG93bnN0cmVhbS0+c2V0X3JlcXVlc3Rfc3RhdGUoRG93bnN0 cmVhbVN0YXRlOjpNU0dfQ09NUExFVEUpOworKyAgcmVxLmh0dHAxX21zZ19jb21wbGV0ZSA9IHRy dWU7CisgICBydiA9IGRvd25zdHJlYW0tPmVuZF91cGxvYWRfZGF0YSgpOworICAgaWYgKHJ2ICE9 IDApIHsKKyAgICAgaWYgKGRvd25zdHJlYW0tPmdldF9yZXNwb25zZV9zdGF0ZSgpID09IERvd25z dHJlYW1TdGF0ZTo6TVNHX0NPTVBMRVRFKSB7CitAQCAtNjI1LDcgKzY0Nyw4IEBAIGludCBIdHRw c1Vwc3RyZWFtOjpvbl9yZWFkKCkgeworIAorICAgLy8gZG93bnN0cmVhbSBjYW4gYmUgbnVsbHB0 ciBoZXJlLCBiZWNhdXNlIGl0IGlzIGluaXRpYWxpemVkIGluIHRoZQorICAgLy8gY2FsbGJhY2sg Y2hhaW4gY2FsbGVkIGJ5IGxsaHR0cF9leGVjdXRlKCkKKy0gIGlmIChkb3duc3RyZWFtICYmIGRv d25zdHJlYW0tPmdldF91cGdyYWRlZCgpKSB7CisrICBpZiAoZG93bnN0cmVhbSAmJiBkb3duc3Ry ZWFtLT5yZXF1ZXN0KCkuaHR0cDFfbXNnX2NvbXBsZXRlICYmCisrICAgICAgZG93bnN0cmVhbS0+ Z2V0X3VwZ3JhZGVkKCkpIHsKKyAgICAgYXV0byBydiA9IGRvd25zdHJlYW0tPnB1c2hfdXBsb2Fk X2RhdGFfY2h1bmsocmItPnBvcygpLCByYi0+cmxlZnQoKSk7CisgCisgICAgIGlmIChydiAhPSAw KSB7CitAQCAtNjk4LDkgKzcyMSwxMyBAQCBpbnQgSHR0cHNVcHN0cmVhbTo6b25fcmVhZCgpIHsK KyAKKyAgIGlmIChodHBlcnIgIT0gSFBFX09LKSB7CisgICAgIGlmIChMT0dfRU5BQkxFRChJTkZP KSkgeworLSAgICAgIFVMT0coSU5GTywgdGhpcykgPDwgIkhUVFAgcGFyc2UgZmFpbHVyZTogIgor LSAgICAgICAgICAgICAgICAgICAgICAgPDwgIigiIDw8IGxsaHR0cF9lcnJub19uYW1lKGh0cGVy cikgPDwgIikgIgorLSAgICAgICAgICAgICAgICAgICAgICAgPDwgbGxodHRwX2dldF9lcnJvcl9y ZWFzb24oJmh0cF8pOworKyAgICAgIGlmIChodHBlcnIgPT0gSFBFX1VTRVIpIHsKKysgICAgICAg IFVMT0coSU5GTywgdGhpcykgPDwgIkhUVFAgY2FsbGJhY2sgZXJyb3IiOworKyAgICAgIH0gZWxz ZSB7CisrICAgICAgICBVTE9HKElORk8sIHRoaXMpIDw8ICJIVFRQIHBhcnNlIGZhaWx1cmU6ICIK KysgICAgICAgICAgICAgICAgICAgICAgICAgPDwgIigiIDw8IGxsaHR0cF9lcnJub19uYW1lKGh0 cGVycikgPDwgIikgIgorKyAgICAgICAgICAgICAgICAgICAgICAgICA8PCBsbGh0dHBfZ2V0X2Vy cm9yX3JlYXNvbigmaHRwXyk7CisrICAgICAgfQorICAgICB9CisgCisgICAgIGlmIChkb3duc3Ry ZWFtICYmCistLSAKKzIuNTUuMAorCgpkaWZmIC0tZ2l0IGEvbmdodHRwMi5zcGVjIGIvbmdodHRw Mi5zcGVjCmluZGV4IDIzNzZlMzIuLmMzOTk1MDkgMTAwNjQ0Ci0tLSBhL25naHR0cDIuc3BlYwor KysgYi9uZ2h0dHAyLnNwZWMKQEAgLTcsNyArNyw3IEBACiBTdW1tYXJ5OiBFeHBlcmltZW50YWwg SFRUUC8yIGNsaWVudCwgc2VydmVyIGFuZCBwcm94eQogTmFtZTogbmdodHRwMgogVmVyc2lvbjog MS42Ni4wCi1SZWxlYXNlOiAyJXs/ZGlzdH0KK1JlbGVhc2U6IDMlez9kaXN0fQogCiAjIFBhcnRz IG9mIHJ1YnkgYmluZGluZ3MgYXJlIGFkZGl0aW9uYWxseSB1bmRlciBHUEwtMi4wLW9yLWxhdGVy LCBNSVQgYW5kCiAjIEhQTkQtS2V2bGluLUhlbm5leSBidXQgdGhleSBhcmUgTk9UIHNoaXBwZWQu CkBAIC0xOCw2ICsxOCw5IEBAIFNvdXJjZTA6IGh0dHBzOi8vZ2l0aHViLmNvbS90YXRzdWhpcm8t dC9uZ2h0dHAyL3JlbGVhc2VzL2Rvd25sb2FkL3Yle3ZlcnNpb259L25nCiBTb3VyY2UxOiBodHRw czovL2dpdGh1Yi5jb20vJXtuYW1lfS8le25hbWV9L3JlbGVhc2VzL2Rvd25sb2FkL3Yle3ZlcnNp b259LyV7bmFtZX0tJXt2ZXJzaW9ufS50YXIueHouYXNjCiBTb3VyY2UyOiB0YXRzdWhpcm8tdC5w Z3AKIAorIyBmaXggSFRUUCBSZXF1ZXN0L1Jlc3BvbnNlIFNtdWdnbGluZyBhbmQgUmVzcG9uc2Ut UXVldWUgUG9pc29uaW5nIHZpYSBhbWJpZ3VvdXMgSFRUUC8xLjEgVXBncmFkZSByZXF1ZXN0cyAo Q1ZFLTIwMjYtNTgwNTUpCitQYXRjaDAwMTogMDAwMS1uZ2h0dHAyLTEuNjYuMC1DVkUtMjAyNi01 ODA1NS5wYXRjaAorCiBCdWlsZFJlcXVpcmVzOiBDVW5pdC1kZXZlbAogQnVpbGRSZXF1aXJlczog Yy1hcmVzLWRldmVsCiBCdWlsZFJlcXVpcmVzOiBnY2MtYysrCkBAIC0yMDksNiArMjEyLDkgQEAg cG9wZAogCiAKICVjaGFuZ2Vsb2cKKyogRnJpIEF1ZyAwNyAyMDI2IEphbiBNYWNrdSA8amFtYWNr dUByZWRoYXQuY29tPiAtIDEuNjYuMC0zCistIGZpeCBIVFRQIFJlcXVlc3QvUmVzcG9uc2UgU211 Z2dsaW5nIGFuZCBSZXNwb25zZS1RdWV1ZSBQb2lzb25pbmcgdmlhIGFtYmlndW91cyBIVFRQLzEu MSBVcGdyYWRlIHJlcXVlc3RzIChDVkUtMjAyNi01ODA1NSkKKwogKiBUaHUgSnVsIDI0IDIwMjUg RmVkb3JhIFJlbGVhc2UgRW5naW5lZXJpbmcgPHJlbGVuZ0BmZWRvcmFwcm9qZWN0Lm9yZz4gLSAx LjY2LjAtMgogLSBSZWJ1aWx0IGZvciBodHRwczovL2ZlZG9yYXByb2plY3Qub3JnL3dpa2kvRmVk b3JhXzQzX01hc3NfUmVidWlsZAogCg==