From 38ccd6af8abbafff98d458a1c62909acfc09a514 Mon Sep 17 00:00:00 2001 From: Denys Vlasenko Date: Sun, 8 Apr 2018 20:02:01 +0200 Subject: [PATCH] bzip2: fix two crashes on corrupted archives As it turns out, longjmp'ing into freed stack is not healthy... function old new delta unpack_usage_messages - 97 +97 unpack_bz2_stream 369 409 +40 get_next_block 1667 1677 +10 get_bits 156 155 -1 start_bunzip 212 183 -29 bb_show_usage 181 120 -61 ------------------------------------------------------------------------------ (add/remove: 1/0 grow/shrink: 2/3 up/down: 147/-91) Total: 56 bytes Signed-off-by: Denys Vlasenko --- archival/libarchive/decompress_bunzip2.c | 78 ++++++++++++++++------- archival/libarchive/decompress_gunzip.c | 1 - coreutils/test.c | 1 - include/bb_archive.h | 2 +- libbb/appletlib.c | 17 +++-- miscutils/bbconfig.c | 19 ++++-- shell/ash.c | 1 - testsuite/bunzip2.tests | 16 +++++ testsuite/bz2_issue_11.bz2 | Bin 0 -> 12000 bytes testsuite/bz2_issue_12.bz2 | Bin 0 -> 11000 bytes 10 files changed, 99 insertions(+), 36 deletions(-) create mode 100644 testsuite/bz2_issue_11.bz2 create mode 100644 testsuite/bz2_issue_12.bz2 diff --git a/archival/libarchive/decompress_bunzip2.c b/archival/libarchive/decompress_bunzip2.c index bec89edd3..7ef4e035f 100644 --- a/archival/libarchive/decompress_bunzip2.c +++ b/archival/libarchive/decompress_bunzip2.c @@ -100,7 +100,7 @@ struct bunzip_data { unsigned dbufSize; /* For I/O error handling */ - jmp_buf jmpbuf; + jmp_buf *jmpbuf; /* Big things go last (register-relative addressing can be larger for big offsets) */ uint32_t crc32Table[256]; @@ -127,7 +127,7 @@ static unsigned get_bits(bunzip_data *bd, int bits_wanted) /* if "no input fd" case: in_fd == -1, read fails, we jump */ bd->inbufCount = read(bd->in_fd, bd->inbuf, IOBUF_SIZE); if (bd->inbufCount <= 0) - longjmp(bd->jmpbuf, RETVAL_UNEXPECTED_INPUT_EOF); + longjmp(*bd->jmpbuf, RETVAL_UNEXPECTED_INPUT_EOF); bd->inbufPos = 0; } @@ -151,12 +151,12 @@ static unsigned get_bits(bunzip_data *bd, int bits_wanted) return bits; } +//#define get_bits(bd, n) (dbg("%d:get_bits()", __LINE__), get_bits(bd, n)) /* Unpacks the next block and sets up for the inverse Burrows-Wheeler step. */ static int get_next_block(bunzip_data *bd) { - struct group_data *hufGroup; - int groupCount, *base, *limit, selector, + int groupCount, selector, i, j, symCount, symTotal, nSelectors, byteCount[256]; uint8_t uc, symToByte[256], mtfSymbol[256], *selectors; uint32_t *dbuf; @@ -179,15 +179,19 @@ static int get_next_block(bunzip_data *bd) i = get_bits(bd, 24); j = get_bits(bd, 24); bd->headerCRC = get_bits(bd, 32); - if ((i == 0x177245) && (j == 0x385090)) return RETVAL_LAST_BLOCK; - if ((i != 0x314159) || (j != 0x265359)) return RETVAL_NOT_BZIP_DATA; + if ((i == 0x177245) && (j == 0x385090)) + return RETVAL_LAST_BLOCK; + if ((i != 0x314159) || (j != 0x265359)) + return RETVAL_NOT_BZIP_DATA; /* We can add support for blockRandomised if anybody complains. There was some code for this in busybox 1.0.0-pre3, but nobody ever noticed that it didn't actually work. */ - if (get_bits(bd, 1)) return RETVAL_OBSOLETE_INPUT; + if (get_bits(bd, 1)) + return RETVAL_OBSOLETE_INPUT; origPtr = get_bits(bd, 24); - if (origPtr > bd->dbufSize) return RETVAL_DATA_ERROR; + if (origPtr > bd->dbufSize) + return RETVAL_DATA_ERROR; /* mapping table: if some byte values are never used (encoding things like ascii text), the compression code removes the gaps to have fewer @@ -231,13 +235,21 @@ static int get_next_block(bunzip_data *bd) /* Get next value */ int n = 0; while (get_bits(bd, 1)) { - if (n >= groupCount) return RETVAL_DATA_ERROR; + if (n >= groupCount) + return RETVAL_DATA_ERROR; n++; } /* Decode MTF to get the next selector */ tmp_byte = mtfSymbol[n]; while (--n >= 0) mtfSymbol[n + 1] = mtfSymbol[n]; +//We catch it later, in the second loop where we use selectors[i]. +//Maybe this is a better place, though? +// if (tmp_byte >= groupCount) { +// dbg("%d: selectors[%d]:%d groupCount:%d", +// __LINE__, i, tmp_byte, groupCount); +// return RETVAL_DATA_ERROR; +// } mtfSymbol[0] = selectors[i] = tmp_byte; } @@ -248,6 +260,8 @@ static int get_next_block(bunzip_data *bd) uint8_t length[MAX_SYMBOLS]; /* 8 bits is ALMOST enough for temp[], see below */ unsigned temp[MAX_HUFCODE_BITS+1]; + struct group_data *hufGroup; + int *base, *limit; int minLen, maxLen, pp, len_m1; /* Read Huffman code lengths for each symbol. They're stored in @@ -283,8 +297,10 @@ static int get_next_block(bunzip_data *bd) /* Find largest and smallest lengths in this group */ minLen = maxLen = length[0]; for (i = 1; i < symCount; i++) { - if (length[i] > maxLen) maxLen = length[i]; - else if (length[i] < minLen) minLen = length[i]; + if (length[i] > maxLen) + maxLen = length[i]; + else if (length[i] < minLen) + minLen = length[i]; } /* Calculate permute[], base[], and limit[] tables from length[]. @@ -320,7 +336,8 @@ static int get_next_block(bunzip_data *bd) /* Count symbols coded for at each bit length */ /* NB: in pathological cases, temp[8] can end ip being 256. * That's why uint8_t is too small for temp[]. */ - for (i = 0; i < symCount; i++) temp[length[i]]++; + for (i = 0; i < symCount; i++) + temp[length[i]]++; /* Calculate limit[] (the largest symbol-coding value at each bit * length, which is (previous limit<<1)+symbols at this level), and @@ -363,12 +380,22 @@ static int get_next_block(bunzip_data *bd) runPos = dbufCount = selector = 0; for (;;) { + struct group_data *hufGroup; + int *base, *limit; int nextSym; + uint8_t ngrp; /* Fetch next Huffman coding group from list. */ symCount = GROUP_SIZE - 1; - if (selector >= nSelectors) return RETVAL_DATA_ERROR; - hufGroup = bd->groups + selectors[selector++]; + if (selector >= nSelectors) + return RETVAL_DATA_ERROR; + ngrp = selectors[selector++]; + if (ngrp >= groupCount) { + dbg("%d selectors[%d]:%d groupCount:%d", + __LINE__, selector-1, ngrp, groupCount); + return RETVAL_DATA_ERROR; + } + hufGroup = bd->groups + ngrp; base = hufGroup->base - 1; limit = hufGroup->limit - 1; @@ -403,7 +430,8 @@ static int get_next_block(bunzip_data *bd) } /* Figure how many bits are in next symbol and unget extras */ i = hufGroup->minLen; - while (nextSym > limit[i]) ++i; + while (nextSym > limit[i]) + ++i; j = hufGroup->maxLen - i; if (j < 0) return RETVAL_DATA_ERROR; @@ -671,7 +699,10 @@ int FAST_FUNC read_bunzip(bunzip_data *bd, char *outbuf, int len) /* Because bunzip2 is used for help text unpacking, and because bb_show_usage() should work for NOFORK applets too, we must be extremely careful to not leak any allocations! */ -int FAST_FUNC start_bunzip(bunzip_data **bdp, int in_fd, +int FAST_FUNC start_bunzip( + void *jmpbuf, + bunzip_data **bdp, + int in_fd, const void *inbuf, int len) { bunzip_data *bd; @@ -683,11 +714,14 @@ int FAST_FUNC start_bunzip(bunzip_data **bdp, int in_fd, /* Figure out how much data to allocate */ i = sizeof(bunzip_data); - if (in_fd != -1) i += IOBUF_SIZE; + if (in_fd != -1) + i += IOBUF_SIZE; /* Allocate bunzip_data. Most fields initialize to zero. */ bd = *bdp = xzalloc(i); + bd->jmpbuf = jmpbuf; + /* Setup input buffer */ bd->in_fd = in_fd; if (-1 == in_fd) { @@ -702,10 +736,6 @@ int FAST_FUNC start_bunzip(bunzip_data **bdp, int in_fd, /* Init the CRC32 table (big endian) */ crc32_filltable(bd->crc32Table, 1); - /* Setup for I/O error handling via longjmp */ - i = setjmp(bd->jmpbuf); - if (i) return i; - /* Ensure that file starts with "BZh['1'-'9']." */ /* Update: now caller verifies 1st two bytes, makes .gz/.bz2 * integration easier */ @@ -752,8 +782,12 @@ unpack_bz2_stream(transformer_state_t *xstate) outbuf = xmalloc(IOBUF_SIZE); len = 0; while (1) { /* "Process one BZ... stream" loop */ + jmp_buf jmpbuf; - i = start_bunzip(&bd, xstate->src_fd, outbuf + 2, len); + /* Setup for I/O error handling via longjmp */ + i = setjmp(jmpbuf); + if (i == 0) + i = start_bunzip(&jmpbuf, &bd, xstate->src_fd, outbuf + 2, len); if (i == 0) { while (1) { /* "Produce some output bytes" loop */ diff --git a/archival/libarchive/decompress_gunzip.c b/archival/libarchive/decompress_gunzip.c index 9a58d10d4..7f9046b82 100644 --- a/archival/libarchive/decompress_gunzip.c +++ b/archival/libarchive/decompress_gunzip.c @@ -32,7 +32,6 @@ * * Licensed under GPLv2 or later, see file LICENSE in this source tree. */ -#include #include "libbb.h" #include "bb_archive.h" diff --git a/coreutils/test.c b/coreutils/test.c index a8286525a..824ce3b5a 100644 --- a/coreutils/test.c +++ b/coreutils/test.c @@ -76,7 +76,6 @@ //usage: "1\n" #include "libbb.h" -#include /* This is a NOFORK applet. Be very careful! */ diff --git a/include/bb_archive.h b/include/bb_archive.h index a5c61e95b..b437f1920 100644 --- a/include/bb_archive.h +++ b/include/bb_archive.h @@ -210,7 +210,7 @@ const llist_t *find_list_entry2(const llist_t *list, const char *filename) FAST_ /* A bit of bunzip2 internals are exposed for compressed help support: */ typedef struct bunzip_data bunzip_data; -int start_bunzip(bunzip_data **bdp, int in_fd, const void *inbuf, int len) FAST_FUNC; +int start_bunzip(void *, bunzip_data **bdp, int in_fd, const void *inbuf, int len) FAST_FUNC; /* NB: read_bunzip returns < 0 on error, or the number of *unfilled* bytes * in outbuf. IOW: on EOF returns len ("all bytes are not filled"), not 0: */ int read_bunzip(bunzip_data *bd, char *outbuf, int len) FAST_FUNC; diff --git a/libbb/appletlib.c b/libbb/appletlib.c index 022455da4..769b7881c 100644 --- a/libbb/appletlib.c +++ b/libbb/appletlib.c @@ -102,14 +102,21 @@ static const char *unpack_usage_messages(void) char *outbuf = NULL; bunzip_data *bd; int i; + jmp_buf jmpbuf; - i = start_bunzip(&bd, + /* Setup for I/O error handling via longjmp */ + i = setjmp(jmpbuf); + if (i == 0) { + i = start_bunzip(&jmpbuf, + &bd, /* src_fd: */ -1, /* inbuf: */ packed_usage, - /* len: */ sizeof(packed_usage)); - /* read_bunzip can longjmp to start_bunzip, and ultimately - * end up here with i != 0 on read data errors! Not trivial */ - if (!i) { + /* len: */ sizeof(packed_usage) + ); + } + /* read_bunzip can longjmp and end up here with i != 0 + * on read data errors! Not trivial */ + if (i == 0) { /* Cannot use xmalloc: will leak bd in NOFORK case! */ outbuf = malloc_or_warn(sizeof(UNPACKED_USAGE)); if (outbuf) diff --git a/miscutils/bbconfig.c b/miscutils/bbconfig.c index 9ab57876e..501349548 100644 --- a/miscutils/bbconfig.c +++ b/miscutils/bbconfig.c @@ -44,13 +44,22 @@ int bbconfig_main(int argc UNUSED_PARAM, char **argv UNUSED_PARAM) { #if ENABLE_FEATURE_COMPRESS_BBCONFIG bunzip_data *bd; - int i = start_bunzip(&bd, + int i; + jmp_buf jmpbuf; + + /* Setup for I/O error handling via longjmp */ + i = setjmp(jmpbuf); + if (i == 0) { + i = start_bunzip(&jmpbuf, + &bd, /* src_fd: */ -1, /* inbuf: */ bbconfig_config_bz2, - /* len: */ sizeof(bbconfig_config_bz2)); - /* read_bunzip can longjmp to start_bunzip, and ultimately - * end up here with i != 0 on read data errors! Not trivial */ - if (!i) { + /* len: */ sizeof(bbconfig_config_bz2) + ); + } + /* read_bunzip can longjmp and end up here with i != 0 + * on read data errors! Not trivial */ + if (i == 0) { /* Cannot use xmalloc: will leak bd in NOFORK case! */ char *outbuf = malloc_or_warn(sizeof(bbconfig_config)); if (outbuf) { diff --git a/shell/ash.c b/shell/ash.c index 56fba4a57..24958c0fc 100644 --- a/shell/ash.c +++ b/shell/ash.c @@ -177,7 +177,6 @@ #define JOBS ENABLE_ASH_JOB_CONTROL -#include #include #include #include /* for setting $HOSTNAME */ diff --git a/testsuite/bunzip2.tests b/testsuite/bunzip2.tests index fcfce1a31..edb332748 100755 --- a/testsuite/bunzip2.tests +++ b/testsuite/bunzip2.tests @@ -552,6 +552,22 @@ if test "${0##*/}" = "bunzip2.tests"; then echo "FAIL: $unpack: pbzip_4m_zeros file" FAILCOUNT=$((FAILCOUNT + 1)) fi + + errout="`${bb}bunzip2 &1 >/dev/null`" + if test x"$errout:$?" = x"bunzip2: bunzip error -5:1"; then + echo "PASS: $unpack: bz2_issue_11.bz2 corrupted example" + else + echo "FAIL: $unpack: bz2_issue_11.bz2 corrupted example" + FAILCOUNT=$((FAILCOUNT + 1)) + fi + + errout="`${bb}bunzip2 &1 >/dev/null`" + if test x"$errout:$?" = x"bunzip2: bunzip error -3:1"; then + echo "PASS: $unpack: bz2_issue_12.bz2 corrupted example" + else + echo "FAIL: $unpack: bz2_issue_12.bz2 corrupted example" + FAILCOUNT=$((FAILCOUNT + 1)) + fi fi exit $((FAILCOUNT <= 255 ? FAILCOUNT : 255)) diff --git a/testsuite/bz2_issue_11.bz2 b/testsuite/bz2_issue_11.bz2 new file mode 100644 index 0000000000000000000000000000000000000000..62b252046e91a2f92c5848d2f4e2d8834ca2eb4b GIT binary patch literal 12000 zcmajFWmFqL^Di7cxVwiCf);luF2$_{iZ@7*;w}vk+=FXzr^U5UT#CE97fPX6ODTQ( z+~@t@d%xW|zq2!6cFvsL+1c5dRWNlB5Rf;47?^klcd7vZI4XckgaUvBfDU8<2w-c< z%?JmCm!V1u!Y%j?V%>^Zj(&S3EBx@tOAp<5-MmMfE zIjQI@b8uiU&L^35kDbeI-Vj8xT}84ygo57>ZKP;ZfC&@)t^of`kod3NhY)&t08sYt z|C4s)WPaex`&uM9^(3|L9lt)-MxfE}$i5owv?(Meks1+yCes(#sUxs#+S4t&WU8^P zT;ho!R@A>jE75-$Zb(-i7Wu+~MGZki1t83I?Jn^1m)`NLDDQ~f$|*T*+uC}y>}a-T zT3~(b=y$T7;VO zm}|H((kkT~DEPrV076c_0P7_OazxLj-OK|Qen2R;a@e%WIZtIsLuL3AGzGO%6$0Qb z1SErfBJ$v50EvSfM|pIv7TX}Y@R$xqnOOM?7y1{0DqMCIX@M^S3JQPZk~k;EKggIc`Avz8 zu)$4|!u!hi)giic4z!i@`d0BtbMQ*x02c!t-9Z;NauwCm0CeUu8I=TL1MGq{Jd`|c z;S9QiFuE0I^Os!Bii3rKYyrWFhsdgLdJj5WAra$7MJtM!<`RVI0tzZh zZ$iJqzY0G${I_-i;VR);#Ja*vg*a6wxX}Q#uS_K3a&~l3L?Kc+wwQ;+&_N#sHuIaF z$EVWMas1M!_qUs>iT`E)yJx??_XIy4oVASou=rS*t0GvAEG>f;buUlCKK%-@vFfp4 zVVV2z@eRA4{lqH#p~o^s)8tv z=ZVKM)CCsGk*Iw^k1e5KDf&`oL_!7HiAKcGC}Bo}txzwx8c5YNZdn+`_EuHYiC>I9 zd83t*DbpptOGA5?H%5@!=S~y(0VhhAs|1A9Whn&~52_U-ic?_mRz>lKUIbx-A*9ga z!I$+lMif^b8&X_biP7RCt4Z;J?xQteG2 z@!Z&_=+G+n6aV&9_Qg5ae9xcs!~W0T_C2r9#LgZn=T}U#H#js!`T3~mI~W$V-{98w zPHmj(oWuuTsq4YV)vIRn)(CcbvmlKnO!IEDfnb5hktV^~>MGcWx{u!lSSQPGYacV( zp^bh5-o~1;Y*wEG#=RG%KTl2`yNqW)F`owXgkA{;Dlf@=nh*clSO1zd+;^i4;2z%D zc{}+xj3X*9s5RaCc#m`HkgUtL@+F*x%B0B>m9lES_Zj}?U2e-1x4lq-a)INL9@%un zc=#xD+BXEgtaaj*HEOJdCTl|5Br z1bc*35X32OEX;Z;T+JX|7aM2;@W){noIjl5O^-;i<{j>`ze3X;IK8J&js1N!nRU8< z`Rj|cW$L#46V;{IbyWiSeQ#L%fxwkYbhB+g9$En?Tn)o7TkAu*uC_4hdO-eIXyp@WZvRffR`O zYkGn6jTzksMv0XQz2B0|VE?@%wUV;nx{qBwN#x^@Jj_oYdB4>Mea~ysv21hGmKiTE zv;#F^+tJ%)v+4+)ZN*6xb zmQO}hAkEg!kF&knO2SMw4?gmh0o(ke7(f{C?UIbO>gE77ok(VjC<(eQMkr4z6#q>Y z<^cFxMHEG8xa|@u{*-j`mX?pCOeh`=fF?`==#37Az7tNbInSiOr}8oVYaT*|`WP;F z@8r^V77X7bQiL%K)<_tj8SHF5&&fiH0_)>y`TO?Kj6i{GEUeS4aAqjY&@D^0G!HFcE7Vu2;Nj)w z+1ppmyj-S)1!1->>{#@wl2Lu{54guo492gIibVq-s;3g3N7+8DkF8mipZGWi7pxbc z0u1NOx_Yp-aWYrS(pua4!)X9NjZZ74VcxB}!4A)e6S0P7?7UiKrheAnw0Sh#>wVWS z-%P&_q$2M80=1LcsDi{QZ~THxsC*uaewDQLy|2D-TIb^IR0UT9@yGx~MW{GiqIs*@)^{TT!VUmciO+Z~xqzQ}MO2`yv^alJXj zE_FV_31LY3xbygNq-x^gC*X4tgozBJMI;8Z0 zN^|vNzBA5x+1Q^uMfQ1VV7|uqg^X(GsS6aa(i_cY>G|gAr|0&sjz-Ss>0qFK)c}&W zne$fgS7G7Y{?(p=Q-jO4&P0VN*Zk$P8QD#pfZTJLU#M3CwmW>tj%Sot_w~wky14~U z__7CN>tO^MST)Mo`l=^m$sNA^{Xpp(k6 zwz+l3o#^U7BJa~9KqeZRe}e-vR+Cd328F%9x1}W3O+KHP^rzkq{(TF%JZ4pa*m&k0^DC0gljj{jTNwPYgNLV|h7L1AWaS-8Of->x?6?&X0Ze{aC>U-7 zkl6L+eV^LL=pmrq?#kHOSdJ|aoUn=gKJe~c;5#7|;D^W@czKT3q)KcxHycC|q6rZ$ zMJgB$C5rDO{f$zvfM{4OrD!j`wU@-M;$8P+zjs~yE)m=G<6&xylNeR0tcz6jY0B06?a?U`1b-`=>!Qs3np$7 zIlH$F7q7sLJT3_hBG-e}d4P%4d=964j{b3y-F=#>A6}bUYQ=+;VtQH&d!RVdJmG)B zmNJDw@*t@)#ZhrIC>Gk}M`}+Q%QD3UZBUll<2i|brc4EGuvez?QsFr%&MP&@isdn= zQjVT#Bsi+z&8Jk(r!Xka-<3G27~r_$_;idVFRxa?U%{`Pr~O&5uoRZ8Oan@R!J?rl z6tOIzuo%*B4u)jtc*>x#d!&ICB7ulkpYl2LNRHo3%8=l zco2N`z(Sw}AiD4nNrG>gKdHC1Vs?1~GB$r`A^Ui(2eldmy;9|*Ql}7bc6VFfb5po8 zu?x#mh^ep;ALdn7jxN<379LA=siZB{w?j@sG_fG+RB~hBR4{U0QW@gVB#a@PWkjPX zM5Ok?#5P0Nb4X~KT=7F$oO8!X4m>aW*lgl@oYy3MpuiU|YiK?$8-tFe+&II;p9e4K z4=NZeP{M5gsJW_b`K#VQr-|JjoSPp&AQL$!a)xf`duC*7hz3EZ^K`)f!K&lPt znxU}f8JuvU53cxl+I=?Ngh8Oo-+~A1#h<{6C?z5#=50W0#i)o*Lx`uap%E&f%X8C` zfH9q@Qb+?J^2&J`!?dh71L&G7jU=(kVWXu6K%NLWsZLiZpO0UK)a*oum|%`g0~p z2!Dz&2aZOPjKEg}2=!vdbD@A@a4dy@F*vEDw_spU>h+PwSwYO}oE&wC45r5v@>8x( z{WMMyL%Xk*@I1To3xmh2$d+Ca+pv}rQ$Fl=J}6~tR=(zQm+9v0gjRvEyO)HRi#d45A5%&ZIjOXEPGNG$4#Cg@>%wx zr=S6N;aM*Wyryz|K|if={3{MO=48WM+`7x>?VTsWyEN|CnY;xj-_5Thd_$Or&fn{C z_?ji&!t3*nIj8hd>YN$TNR%=dr4B~DKno=$y7(uJaro-mP=J%w!5IqjqgaWbzPA3& zd^b7lzp2GYzqw^t_p$Tr<0zND+5`<6K~7P?Aq?iCF)$UdSM^YRVpaX+vhQEmZmDyz zPTt2v$?dI#N$k*^VBk=C-~^d?>}$|0ki%F7MR7RTMf-ZQ`Sbh!`}Y6Ee$_6) zbrDH&y5OLR#{$W-53MRG73$E3zv=5&g>BRGIsO}7F=Sx16p(Ur45g8C<2cX%1p%9( zI4U0FhW{|P=H_9!ULVB>H^2((C}=@hWp#t$SP_g8UUZ4okCbH)ciSC^B4QA?&G;9) z{(}#|Rfb{_PPA60$=9RhYvbp!NS<9sG{J+EV4~7w@w1#O8)n}`u6mC&PcdN*=IN>O*|_si)-(o zfw{2eH|6_<%uQPw&51euM9azlL;qup-CabH@lu?E6q})hEQyf!8w4^~x3t6Ka6A+A zZyfs{t6jt$doo0wW+!Oy@vGb4<9hWt7nq(5DUXn}%;v)#+Mb;|ewkz_r7OQJbPh+8 z6Wfvdjj^ev?sbbX#9YdKe(QB%*5L`xNp>>i6`|dmJF#pl*|gLsQRWjIR(BY#lMyNA zJF3uKil)_)DUrDIjc?IG&i#D!$Q*kK(fGA-t;-wkcTVT+iXK-BS&Rt{4ML}WFFqH3 zmSa!?7a#aG9DX^6y2s)qb_^-JU|KQD#~FTsA=lE{ZZ)XnA_qc4L&#&(753!{iMDPo zdFimaXZWQlX--h|rKDshgRH*Tiy|&|$k#Po`~ywh4;-ZJsU1zHolN_eT6pbS>a3ki z(?$QwQvrr1>BUPebs8q$oQzGE%1m48l$}fsO$u5n>ulSxzX|D&uzHH4g_9Y`V|(xc z2&}m|oeK$&RYIef)({(epigr44-;PH@>H%hK0ZEk=&DLxjD8u`9J@-E9Lg3*@|X}HAg{C#D+E*LB|Q?4^@S1vsDiCnfZu-4sGMzV#InVqD*P5u#x$Pu#i4l)&Ia_jP!qDGWPA06s#!fU!yt zPHl8+pbV|~3m*q~EW?W+P96P#urUH#!%KUDJFe<{iqw1wBO@<+5wqmn(=mP-J;{%x zwd#=R@BW=%Q z7x!DOQ+lSpZyuFk|JoMBUN5wV3DTNu8jN|8tGP`ozIEr2Fr6gj%5-AI@>TR8p~S~pqBwFdaWp$ z8T|c_d`Ueo7rqwfk=iC?Q5__4^5wmeq`gwS9dbn~!I$dOG3RgGiD!X>`NwZHDtIMO zkgpOL{;IOUhO6f;wskejA1ul)z~95U%kL7q^0M`{d85v$ zvt_vcSoHz!z*3Z21HtIl>!)3q?@mdJDDpx~do-7f!*E%`gQ9w|Mo$T<5cj2oF|OY2 zQ#M#(VX@5=+e^dqDy5V)QB2PU-Qi``QC@ww2T46Fn{pIYb7*84eEUkOY~lmPttCe6 z{upvjLV4=fGih4&MS9hD2t^OC-(Rc$H`UbA;_fS|_xPdv2>EzVV~LlMD~c;w3uRC2 z3uOpUjPF$$(9YwAri~VV;j?J)l(SjlpL+Bnvuwyq<-K1?32)5}Q->Io+`%dCN7>3UITCCUL(UqBT{8vvk~YGN zOy90z4KvuGc7KLmk{gd|o=V!N?2ef^5%ZX;aM-9C;Z%sCG=CV1?C!T)GwF$tDI}1C z;0ZtUq-l%kcjwyK(7i{mI9Fxt%&5~bW+hZRDxtgN&E@u`UGtSMEhYBenpR*F(i zJ-VUPX{jHRs}&+$%sQ<-#po7V{<=rI|9~>WI7|P^t5z!{b5wB|T`aw3^h) zy{vL|APShaqM1-QO303D#flG3W$Vm;&<}itxSHk+9I-ecpHi2+wg^-@Ep%g@MD7hB zV@W7XF`H86KY5zs^2|DhZ~^NFG)?uCx=uxZSI9^$f!f$PWn@Nb!Uw zzy6rMRrAc2g_pg$6n=S;0(>f^ir|~R@92dJ8;e1uI~{{R8haGf=n}GAj&uELCCArXg6%u1q^bOwM826GRWD zO~fUv7J&X<__qBn+?g9kJq)#lJ}4MGQWcq?Id~ zRS6&PAkRdL7^M5Fz&gMFHe`8(11BZImQ0=Scw0>sKg6n}p>(@h35kpuI4gInE33Qh zNF^?Xz@%WA`dw|!s@~q5RL*Ro$trD0HP_5eHjorK%Z`)iAsAI*2=UKa<^pf1kew`o z)28Xi@*HKzwZ&#q1^IKF2RCyRr4?z_VXhLV3(v?-uX5mLnm??;2iZ|JQj>;>OO>q%7^4-#Q_5)J;!-LtEjHAihc;Vi5H&(Ln>AxX zm089}s?-b(0Gz+~>7I|Z$vg$+=15vrx^2J!};8b-ozA|XO{#ATl@mNpl zw$S8BayJCoqZvJynRmmHOiLta8y`o&-vgifAZbo5cT+z-Q#d=#4H%`NN>dl7o_(SH zuQ*9FPE89-{`Mh?#f}^aNmH{GDm|%;m0nm=(7v3IXe6)R#&C$Oj~pV;Kqu26C9!&u zhKkkech}Ai^NxsH8SwL%JJ_}sOU@dNB}Apzm@b+_tx}b$1oLqx$tf&y#zr++$FX`OCyvfLH77@Bj|>lxB}pe6mi&8f)L1!wkSvUg%(J>OhL;{5LX?A0qK#| z@7-YIvGQ)5LMo!NveQ%81)D^G?XA%W-6DDgELu!{6w)1r9<2;aXblsTo5!3~e@_sa zu%N2^uQE}T2hBZ>WA0l5CZtV#1uB9)4MLMalrydi#Zj3EcFF@r|c(dY1BStW}9 zOSbw4_R@d(qkRlSq3AQn8%rI3>ip_(wuw+Jg~)3i!&sM1Mq+>zT=}M0aLIzD|c%l@Rk2!U} zrYg?}mHZZ(T z)8?Q0=kp120~A9I%7_M<@}AydbUYqC0Jb=DWvFDHpGj8|I6BICUOC6}!tfJsU-EI>vQN`?s}y%GQO(a15D z2pFvbjP+v{I5QVMWcohgbisbcZLI|vxM?F2i#Xo=_WNV*uVY^=TErp-T5G^VxbfSE z>g1kxoLBbn8T6_zjDM} zJ>X?!77H8Hd3X1cv7n`Bz3RdtpH+eNp-X%8k8Jru{9 z+Rm)_1`~S)eC_2ewZ_3q7)t0)-MKI$!uX9i1>f!x>!nw&lyE@`V74}zYIatq_U(9nv9krj zHk9P_9gUkWTM$X>>R{edyvQk<5RI3S1{x1E<_c6aES$!)#g%K!x;!+p@xx$NzgJ`= z`;TN~2-@0NK+^ii{7vx4TVLTGZ%D73^5>I4aUvYc_1oFc6&12ejO7@LB@e9wP7uOc z$n=|)+aC;4otDY&vIO+5p7IqvzOo+OVAQORl546@8h*MG20_=!XD}1xl3P|}R0KXt z;Lox2);WKLCuQDxBRwM{Wg{MS{T3rEBO^U!JuCFlMjk{X6z_#8v^CARkOvE4 z;?TPIFN*7_6}c3zLF0LvP5X<%m@s4*i_^^NE?h7w0fZ|)uCs6UNcnCM)=ZyE{2p_q zHh9YQl~7H=YYqh5>_RiLlV?XYF+}=`#BLYx&H-xUS=5JJ@%#=~jl(WE&{=ZdkwK+J zxh&z0wvQp}^o-ebG_uw@(lg8(dtNAT`7Hgz2(D5cW5Gg^6{}+S#!YZ5W1DCBbq){S zIpy?-Gx{8)&g#Vk{MT6T68vZD$YJQ9A`6l$O_*vu)@pqbH-CUC@Oy-WzJw-)l?RgW zGG#kx)I}Gw=MC3%!7PmcZC3DZBF2g8OXN?bi6?mm%Eh1Q2QZ%dp5X)<8mi{Iv=rj@ z$MdzH&2y8tPahaFU+=vcl;@*(rGu>Pm-t=Mn!|4(D^6nPy7&`qwxeEz4N;Y*;Hh_g zS-l=Uan4f(UoJdM;EMR6SN@Xvt%H@V2g$E^RM?F(cNYUSty*@x{WTK7PY}rp)b=E| zwA83yUt5WF4B!GXnt8gPvW797%Pkzu_9wd zP1Eov)z+ZV{79d-E!XB>^Y0sZ*6hxA_2Vzeg)l4GzV3AKeGT_<6BSl1WUV@f)}0i4 z)>AV9Pxlfp&~j*G^5oBouV>DzYglkh2&Z!^h;ZJJ=f~7f=*j31Ww+B7<->`396I-- z4Fl>D_dbloWLF&;EcqI){B+0N-&*dmOyB4+7hRRoJLNyK*p$3)&?$h+y!&*XNR7Q6 z##lH*FpLKWOwA~*9Qt@O+lIw0+dL)sQiuZ{t-y!0KMb|dfRJWW@*&Y+z7qIdv67|Y ze$)Jt8r&+JX<3#cj8ZnrvPZaM^40d4H%EZBXJA~@-Cc?M!r2rnx>;72z@q*)RU`)h z6Ocqho+Xi~J0$+2mSNFcaA$nO&d>yrP!?p{ONKgjXIQ|#c{brd3jwn)tgxf!O5_vh zhq2kV8%Fs$WNeB$hi@4Rx3QaLu46kyYR!qhlCv7aFWSE740sAfIH*B7dCBl-6H+Fw zwf^-h2|Fggiw&#PN2*JIrvDi%a8b(|qzEsZ23dI-5tY1dA|aKmkQJrhp}MYMBYD(k4NT4>Eaw3`zB!HEz#$4{(H{_&tRRVysZ;=CJ{B2U4x4f zM+aH7GWH~8Y253_`(^1?7J1%@zJC<+otv8m?E;MNkZRroL#RQxnQ! z3)2}qmTXvLS)%_7p^{7`Iio@xfRdcyl=zV}5iYw!jU{$>F5*!~b&K}s5auYRQ@Ow@ z_L1a)#^@DC+hY3(uWZT5T#*;kL)y;}*yrzfv{p~y2WGOwb^fOobm`1yQaLy&sWOE) z#VA8#JanLzd^Ri9H_bNM5}gUI`$cJ2dwH>EhSG1~3h(dt>|Q z_PYgg_w@VTL_Re|Npu~LI4F)tlZtsqq%`xV!2sGPc-9GlM!dj^x|S>60i&tm`jP%Q z-+InwtKwdp>L|dt#5FbKNZWpDw+AiGzYr(fRI0;=P#-El8eKU?$m;x&MC|^!hA=Xx z1uf6~N?sYtuHTGVBv*%LN{!VAdb|o2`N1N6WQ&0*&YD<*Qq@~1l@m!t_=Clz(GQRK zu23_@R8^gCME)hX#^T1t8yhq2kBnVDPv;KeIeyGq!OP<5gEgqqqDVcI=$#)Q(UG^z zJ)hLDa7FQ6Cf8yFMW)XwX(;DRNB5Z9&Yyb?K8@S=!7f3({Qnxv%#xQhawAE35KXj$ z;Ql3WQPH7W#b2eUr{aS;{is@r1OG(MLZoCdeJetav00Xc)&+lwv-mp)X={!_r&#g4bJOSh#^|9I`2Bzv)$= zqgszD1rMz~CcdD};AsNMjDIIcdorKi`iID;3jfvhyJjvsZ|Du(3dFdQD%`&GeJ#P} z5(KA@(A}puGpHu=m4!LJgR-5EtO+^EV({(S8r^=IWZi7=MbZ|@^|E&N=Js?ojgL4k zQoqIl3mS!aPTc&)IX2E#;AA!=weHfJC;zhoeKg5;NHHZLvjWhkJh+90{%H)kwqg_` zEGq8*L#V}spK)gqUK}L4`SnUohk%;zc+lNz`W1czD+*8I-{!_v7giTnw~I@6d>DRE~ZV@5+^yu&2X9Kc9hC(ILTlA7cG03YfK@sa(M^W^?>!&lX4VPBP^^EZ$B z4vaWvg6d6{#vEA=$3)^X%_oiuJ@H?bKYz(yg*eGx(G7@HYb&=%peoeiNKz1Ks-c$*?_#h{uIUkLd{oi`CS-ubOz^6MI(Kz~oq? zq|GnsEfI}Nq0eUVLQJ&y`P#O2aSB%@CXmR_d$&Ke!D0gp&df0^Sj%FkFO8F3+q#Z^ z+k4W#^nJ=TMcTJSkJn#!FG<9v<9?@oAMc%}305XYMv|uoMZNlyEVq^!wmw}Ct|zwX zlFzZ+%$-Umcvte5Vg&((p^f5xJ#jk-?>HkqIESTxQLrj-%Gr&OED`-Yd*-sS326On z`MPaQ?6>B&$xROj{TOdDF#&D9vZo&9Z?EdGZ@Z^8QU4n1ZdjRYK69*&D3D>@JY-v9 zV7KG%>>k`%XzoH}{J(!kG-e{__fNDeIEV>G<)WiTHDBf?Psxf0PBHCjNUyAq7z9MjhMdd=!Hkz#yhCSv+t&WeeJulTrRCICQoavY@**_v#9*uulw93^6<&zu;Z`KfT(l%@DR^Uce@$fmTdhm zgvDZ`LuFJ;q&X^trcu77s404MSw+4ux+$~bvz|sQKAK+xmsxKbM@3sV#11Q;4jh(= zqk=)%+2IFk0suo;`H@Nr)^yATg}xQPWHhxk_0~$!njAYQFrladNy$^)C~w%XFy&Q| zjIiESyu$nP_myvT=eoK0V|HOh8oeKQ3F%kIJ|zU$s;bGycI1()@V4jW@ruWS& zE4~UmLLUh~)&F;PzQHQNnq)e{%=rWr2ZRv-tRrTSxSS0=9FrfS9975z(zinkxe4dN)Z|SIvdJ=bBr*F}Cp2bxmGV^Fp)$o;~qN4O=bDmurzb@Lk5|7ux$yfzb z7{e2Tr>_IdmjkJN#f~bXVk!7qVgRCnY(!up!AiIhP>ZBzT=nE?>ennxVq1$U2(o8G z4<1;>6w34o?^3Yd$9?=3mJ zut?SzP_$Z`s>WTndkeiznaf8C6_3m5y z(V<09nH6{EC3V?%zj)qc+7imnVB)X-4cGLuNpFC_{a~YDb!7#rw&ueR0oJk7>+1Wo zHh6=#fQO-mEStp_-w}^F=`Ukr`%WX7504LhI|I*!{gl7Se3}V9>aKgq8tk=F0&ofL z=(ryH8^jTwn&o|L#~y7dM9>Rop8IJd1(o^qc3H(iQ} z(2?Mw#|@Jcd|b?wTP%-pP)>A@i<-^bgH2c8@JKOdmC(mD>3!q&Y7|t&e(L(sSt_ON z4VFWd&F_y(xBH)?Fnrwc)#uprWRrI|yT%oWaJiIxrBlTHP zAx~6moWmL?SPWIp@qqX$KcO#7RgOH}y!rsv3^icjj#J`T%KuRmYnN1k~|A9@Pf zYg^<>39f#DWIS|etnZ_SL!NfyI03}Zl*>`wBgh9+9_4t%sd$I|INyk$s^`h7l@ zakzc<>#MYR^1A#3&6(I`MJ(lQS5VuIz`069lXVXfRvsi+4aa_ff^Y6H$`nujmujET zwnR2zB`@O_>Ba+M-ao_oNsVQv%3EPw_+}HC&UwYsKXq16W2@O560!o@LY~yYyGud6 zi7?Zb3<4)BlR9@y5({Ozza<|-eYW=0ib?`%K78zqryPOh;C}kR`@PQpM^2-*d8@OQ z%t&dz4Wtp@hQTJ2Ra@wIEm{(jHtDAN-NLh9z#rj&KKUJcK?I4%P1;Cw-3|K zNP5r-jsS_OLJ&(rn;J+Gapu!r@gm~mnCl1nfQ0qVQ_Om9k1zjYC);4BlyZR6!ghIJ zHmlBdfpjV7N!yioo)9I&?dRg%$BfUuKD z7ByB@pd2d@-oOcsz^DyVfr&%-pXqF=bcS0RPvgI)Zz+;K z1Pk6eIJIjQY|fj$qcjbcnZ5Gx*=L(c{CQVi%P^OdE|pV+>631k68Kc{<@<%Gkms8z z$-i8o&-?XE7SH!?-mWV!Y;Nx3lvo`2!kPVyJ7$b;Cw?*Xx-+tjkTgU9AIaf1?2R(< zmHS%bR)xIb_SiF1mtQz^q;@lotmRn_w(ft$`@XWF%upEPL}-%w^@=|*2g`RY&`T=s z?)mER>laPDT*f4MLDo*}cnqqN;oa|dxJQiiMlSaXMg8t7$77#{TR$uhFIkixc-jZ# zE$1cq>Q9?|?8I9qNM9^TX=&{V1_OQ?9+pj@JX&-D?4FRt;q_12xVOlR|E#-eb*;bE z{h@BUntJI+L)P&XZX>l;ZBEY=ZEDt<>ET}yUfzk=ZQR7(NO-i|EQprlAX3Kk-0QN>QUreW-gd z&skU%>*_$8@GfQnL5PxE>f)(>Zx{xH5xU@Mr#y@@xzPn^#!{cc6^7DJE@rNA;i;j+f zCi@N6UDucHl`mhWyG-18WyIgU^L2lSa&W&!pZ>X)U5c)z{}H;XMZMp0i9<>BxB1=q z$@Q6w!&`#|!-a=OFB#3>XU)(uuuWWEdHWmDc-|NMDr)I|UwP`V)S0bm8U!R&e>FqK zrryL-Cr89ayFKw@|2>2~-@?Lb=xEM#r^W5OgC{2S2@HZ>>>XX&92`qHO|t_9=Cizg zbG3_K?6^npmNEXr#{GxEk^${u+Ws^2Hu@7E^7g2`+5691mVj(3vd4XM-j8AXJgZD% zU4=!qp*J0*x(&0sZ~+QpWeKgnr{1O7-8T@h^NZm%AGx~>0eZ{U2I3I!r7 zdP8`dIIjhN<>yatpKs|o)H|(fkCqv8&73`%lwH;K%|4O&mGnZudV?>d{R#E?ZJlzB zPIlhIBiS8_!JhK!V=iT2qthB%F+n`OvNhTwr?xoKN7K z&yf1W8hv}X`>ZN3E4Q3|enpBI%AEZtvwasEL`29GY?J{eBWGV?w2}Nn`?ZJ&V61jF zZ=e+bvgykCF}{t{Nld%`F>P&SJ}OUe)GF#n@4I(??}Surf-9W_C#ie_Xn-$3dIyo@1GPjj9O*k!TbV;-2oT+b?gIv@~FJYU8yVY;xN1l#!tc152 zGdD=i=5_t)3upt6Q*6D+WnX0uV01B;!y%WWX9Tpl4X(IwU)5AA?4uUb)tudeM3d(T z|4Y`Csq_;1$d#$~3L_v<@J4TPTk0s5aV~hhveXvOLBtbf8hE{}GL5?m&p}~Mv0g?L zk6wjx#CQYoUKwvLwQ??%USaO0#6ejv#|_7)eLQ)2wKD!Peytp>FM|2Ss03v&BoT#* zfG1K#u|R?%$-mp_Q(zM*LxOS@kSv6BP^AzGex=DWq`sX%NCceh45Tds05!mI!Ik-I z5fnTazB*t&&wyS89*b^tLny=$iUaH$Ko=!3ja<)lGS2{^hqFK;<3 z+!)yeWhg|JnTZeZDl116>kbGHCp(qX6(emz#$XzFFa(XA z{Qo2cKm}^{k2vQCls{#&CMwMqY7fPhzAV+`7UBNTUbv;EDu6{1u^3BWHW|5())h#9 z)q0m>q&mUd!^=7Kt%`@}#H%~RUVzgFW>uPlaId-I4 zL*Aq*EV%{59w4D*9}YhsPc-5X>+m-d0lOZJ;)NEIl9Tb)W3}LvMWkTF6WOpxl(6Nw z=|E6i2bx53UzogdPTBw+>s2qd#zF%qN;zn#SP#e(Drfk%6JAh}kR=yF5L*(0{WyO} zpPXc;qJn5njb4sXP?0>Oyv!zvI;h8rpIxmA7)+kzje-eS)LXK&EJAwwUV(`PIq8+~ zKqv(HY6zae(b(d^+wTz=_YDWEkK0W+Pno@OzJ3%E5);Kzuacumfu<9sVEEZV#YxFO zC*y@4jgw@du|Nr!M~VQUF5DQdB%l}?Pr-K>O)lvn=;xn&x#xPE7x^+P3jveCbsZ1+ zl&xJiK~TWh=A|h-!|wP@@BTcjxl6=4sJY0P55J8MPTi7`pp7F%SlvA+9{#E%Yi!WN zX-Oo_5_7WB7v=~OlE)0c0uKmD@w@_01X{<596BElz+7U6>myq=-hh&@mI+!p$KaAj zYD(G)NQ6{j;N~CgyI*Ec%hq1u@+%TY@hcF7A?N}#m|CLVDVrI7E&jcDIR2s)&00@P zkF!f3_|-}zqw~Qot#+8{WVpM?D9CC&OYZjG6}(%77>!93{65nlb&G(l9QhP%Z53;bgZbL2?%JKg8UF(+^3_K zzv=JB27FdEnHW~r^lLtJ9Df+%LaL2|v52z@e0NbOC-vTO->r(f$^(nauV>x=WV^Y> z$ueOZH%V@5AxL5ae1Jnh?MmQpGK|$sT{~Cc^uANObjt-i zd^jk%7CfQ-;w3vZC-EZ_!KumFuQMyBUXod&%{30j-9?sq zf=90KgUMi>U(aYC&ZGiv++A*%!aHtcqTq+#e;wji-o86M|NMU8%iBM{Z-1=+KjByP zH?$5WUQP${vQZf z^+(h27}oz+aBgZEkn8eP40Q%9uns|Hl~op3821&SNy2kZQOGb^MserO-f&VzaqF~y z+Vx+k1-3v6mAH(62lQYM#nP+qFJ9vHv>8SWI7fo$nZo zB`3Ba_Zw$b6XAZ1)Bm`b`{dgF)TG@Fnw8+7&nrT=HGN>-TC{4eUZl(?IDoJlsF4vV z(4V4y!X?R)X* z;NvX4BD8q#_krNE>7-jcPBQzq`KQbaCb z)o(w#_w` z4#ugX|B1-}eWTREZ_PF8M&BI_jlY!`H`gdT80#D5HJ8^|x8Z*mLJqRJiDLy*=*i=| z@&Sk~xj7y4i9;%chHx!mR<=OTgv<*gUggqct|dM`K2!LjN=+oP1aB*(;NSDE``<`R z_@7KSq#&>2TmUw0qADiD`$;DYsHY~RHb$5-ZDlRx{I$sf+|Qb&ASYr)mw=(?1o8(e z$~z~tXSM(wkA31}yRokF;Va*}^GR?nuiZ(o@RdhzoMehn=>FRpqM<~_4N?FfiLUQ( zIfS4(qQy^!&h(k59Xg8fnLnpC(l=$9w$%PN(%kOpb9eedGi!Sy_wlAw$k)d&WD*;MXAESEUs1yA#@cF8 z+5>Feq*6vmDt*$atW?R+HnbimI^*yu()X}Ng0p4S{h@!S6W47*%fohAW`u1+EGEqQ zSaxo^#WJyT{Kx8E5&o}rLHy->Ta+N3(W>6C8>O1_nBr>}4hiEia?UhwY6HIq?JmQI zS6lchyo$NJB4}h8r?95WLgpp?z*&X+A~WDfi|)6-_;=qDo~@A*t>d))vD_--j%&2* z2&ZdWuF8?2KIUX1HNA+BwTXNhZVN?FI|r3JlBvcw z4O1nAK6rJ$F2Ld>wR+;AwU-Z@D6fs8X3>ySF|DC&3J(2w30JDhxhh>HxI*;TBBtm% z=TDhXh1t1QV|;gYxAVke);KX;D{Q;x6?-{#pIt$9s7&giq^ey5^MLCYQYE9cIM?Pl zQQN~I(-O+#zn)0bA?6rV-(eJ8-G3id{vWHVrX$=|M09#%dkT4aOyG%^P%4TmSqf#2 zZVROeP>pO==+Vs(2Br)Ze&sW(cjInz)c8nk%*GM;#o^`2>k{GQEDtTC{kRx&<}G3E zPiMc-?uo}!WIuHoM5fq6&Xl))#mBxj)lcqcRC0kPy6j~t%VbHgh4wqD$9rKwcY6k(+* z=G3L{Po9vv7+Wk8F%im;W?jy{EcRq z3zw4e#olmW%7R90{tyW}p#|$BXfj(z?j6$a1?GH$({IphhjJVtd1>aSbeQkVIu^3k z8xjSgGRAF8ocZKt(p_mcuw%_nNExG)G1`*y1E3Mq2Tr2Hi?rKFh!Z2>9M%A*rP-^z z3S6S0QOanju5XsktaCI+mI{=xGfTMeY3ABs7?nSs&y{i@7`=Huf=JVEhh0cG!3sw; z_>sd%i>ApnGk05r)T7b@1@w4g1@U*J*U+g78;f4K3q7L`?9%`f?=e@6SlGGkXCuK- zVM-@n_GuCcU_}Me0Fp2EEE``jCGSqD!%w&iHYE(ZFIHjE0uwJ~mZ$7u#-?#?i6i<_ zvh)PRhStN7W+=@D=mMf?d-WwDszMcHZPmkqO@&a3=)w)hcj+x=XW!9wq2~Ceb+XIi zm#GKehv{=lBG4jWH3KH15l7{n@F;wN3^VU#G5I-A;@deTzFFHZ|s{~PK-+fU^sgg;B z@D5MNv1kFKbWa6T``6$44A)@bm_*PwV+SJM7GuTQD3z2XozJW!q=t-~<(rk|m7i_M zCC-GPv=3N1;sH|ZU05GhKQ4F}O(Xi}Lz%qL@>3%a60aWDr> znP3>sv6rFL5}QmGKTg_6GR-{9q-bftIKA|`~&q5z-Tv$SPGQ+K;#`LrIIxNsb zDI*X)MLNF9a(IswLcyI5B2*Mblc@+8rV}GlN^9ogQYtPk)YqDUH<_uEHo!QWG$I3) zS%yIsYWi`|P_=9UE~rW|A-@on$(uOTOcXSgHcDP&z+L0wtdo`p!9{3wQ@@9sfY-?< zPG@H>4B;!UOe?R&ds%~JrrW_HZ%A5F8E2#?D)&;p5RV<2jG*8vf#)L6V{!_IJCoOi z#tsrb!$LYWBBs-Gt~e6tNCmB9qKWxC(bKh(rnGWbbrX~MQxn{PAuvq}LY#K$nbyDN zBzT0D4wdk|Hk`$VG6a^QW-U~FP#z^cyQH9XHY(9TS-Fm57gZP5Pnm{Ip-v96c$ShB zrQ748l^Ns_8oki#?K-`)ZYh?KF%(6TlxSrt(pn$CiRh$I|Xr!2B- zg^kC;qhUNmF)1T6HIZGgQ3Tl55`obvU{JuL!{tv3aY126C<9|#f&}GeaK{kui34M2 zRh9pBCJHh<1VXw&QU5K#b^i&C8aEQjGz_CkVT7giF>}L=SwszKU{!n1-JN-raQ?5E zh+6jIfAynnBut^;3&aBt@o4F5#ArA45+OS$iPMnlQ;yQ482gzWQXHw4xvbVElVr}WXqT+O zgj#y5=p3J0Ax0(duHxpNCa9CnX+V)u8HhwyQY)n5!Bgpr_wxe#o@77=0tmSdhvA=J z^@Va7H7Ep_`1o=ufL$OpR)_%g{*%!f;f3ljj&{i^z~h`Z*Y5%uzNh%FVhx2 z5=HT7im0Q{<;W2!iYx_%>c=Q8<56(l{*ud75x^w}4+v0z0x58T?P6QSKf;ZW&&{0+bDocOZp&F{Y;@LTDzRYJ|++glE} zdW_=&&AxSVNzajI`YrCji?W=+`wxDXQV|~aPm5OW%s&qzKv%7fq0@MB!RPk4i#xom zkHv!ewBOx4XUc0XSgts=%Vm||2?`34lCcqhj4uQ{&F4eZ=T4pqb(bB*h(9C^$9gE% z1$cFSLCIwNzB+&1x@Wez?4S9=@lbEdKx1XD>uQI{=Z-pZAl!-ct+Xq15(AvTlGetg z@Cp}y0eb1~A+^N8OA<)pLfbJrDZ=!fEb)=e8RQKF9&Z%k+00#|5RtJ=H-!BuL#~-( z6#A?#!m$5GTYGfv@u=?)shmxBaa;im;6;)*0v;7$_U?Adt-lcm@W#%DNWVLk&Eb1~}0(V|Yu7VLlHY#>lQ^ z?w^Y5suegDF2Q4Xnv8o2p}44!AQp$o#Z9zecr1iad_;TOWounwLL)ws9P=OCL+z&ks*m0LkKe%aF-LNyMX1V2Z~ZF@$QX62ID zS6ZI>tP_(a6A>ZRmSJu|9{4jte)GqvwS$C8HB5Q41s1G|!7En*EljO$rI%SeL?_e} zgO1qKuo{bJqv&75UEk0@TLyOn`xIG1xKe~^mZL0|=LmCqY5abKN+2aPs4QGVNX`=1 z{fC@%a64adP2^311?VyYHsf#(RG)|ZR2qGdXQZC{nYx4Gx$PW?1%qjtZc-A-+U`%5 zel|^yT|d+^rN7*I)hEwK^+G$Ox<}%7QA-xTo~$^?=FQwstf}@o5jIRkih`T&(n53X9NA8b|v~+5jF}9Z>7=Gd~R-l#}rMbC! z-SW~xl)Wz(kjcc&<&ZUq@kEA^BxPlMi2tp?QgWbzZB{n1yZWS~5}3*0y?Fjr19>^Q zDkV8)7_3^AbK`XWNl22WlRocBk6!o9)y zpHy4?hjPO_UpHTx9_8LP@GRM!Y$9XMD1~s#*^V|o@*M?xI*SUc=Cf9uz-tZ)-RfwW zfrndhr&w8FnH>4!!pq5H%PJNEBa(^iGE#z9l(~_0qq;KMq?v7W1-WR_PP>ln2z}q0 zxUJg3$jpjey>DLn3qM^5x7X%7%~Mx8O+^=_bPxHD%~mCE>$UUHGVeZ}#L?of2QlSO z5)Tle0ppWO3%i~kkFA5E=dB)My{NbLFxZODO zO$}`k%sekk6+|r?Zr&-}KK5e$*n`7Y%gryk@#dz;W%hWS7271^qre>UyJ`pr02dGs zrp%B?*Xb9(sAilq72FtEvC%ie#FqG5cTptmyD-k;Up*PMqk}=&XBXJ9vn6tgkwI+M zZTjI}c4@1kj=^h&!maEk>C5hcKAL7V(ipl9lR7obg_w}mzw|P zl_c$BKg0%9>cSAxUl@J{2%J{4`YWRICmZr|1jk(8_D}*@bSo8DV?6cqh9&0ye9op%75!N>lUEhn6q}^!YrbuvZ;4kWN#;n zRl**xEKPXX7rG{Enl0ECfgfgMt)Se4zq-I*q5K-ET*dW5x&V$N&)gkBdT2ylXl6V~ z#FB{$D~a=YCRCKJBxjIM08o3Xan`u1BvswnVmXmyj1N>?8hdw-?>uR; zkfx&JmB_yW*HGNhaAjq(?VjnQ=fjDec$W8L&479F)V`{u;({>UB+(mhKGHo8nOi=o z0pYU3t#q!rP^xs#L-Ih*$@b5~&KrMj)%nz~-v>DP^YZ^2Fh7<&1IrD@=fE_ub^?07 zK?@3Yoy-0zg(u{8f^6>LjD}^2&U=|QIkU??neEJ4{!gg;es{hL_xXI8>$em|r;tnp zsRq8P|H-TBTV_P1?QL-?dXe68ZQSy(XG_VynS@V?L9d+I&B|REF|fEY!T_iJRUhMD zW8P+nGr{dQT_t|)CS!;}caq?lv5d?sw_+8=pvr2!;8@kb5psE4!h~qoS)4rcpHW56dj~fI&(>+ba$3G6^sw~IHeTsJu?GxMWQxN- zE`4V(3@=}*(^xQnC}t@tTGxruhKWbecoE|OHfQ)9jZEve>C+wiD{Q%y27JH+I?Mgb K7;b!&;r{|9z()=M literal 0 HcmV?d00001