From 892986136d9d3e3184068e96dac542c3b2542d7f Mon Sep 17 00:00:00 2001 From: Borewit Date: Thu, 26 Mar 2026 15:59:14 +0100 Subject: [PATCH] Harden ASF parser against infinite loop and malformed headers - Prevent parser rewind by disallowing negative skip lengths in tokenizer - Validate ASF object sizes to ensure minimum header length - Add sanity limit (10k) for numberOfHeaderObjects to avoid excessive iteration --- lib/ParseError.ts | 2 +- lib/asf/AsfObject.ts | 13 ++++--- lib/asf/AsfParser.ts | 10 +++--- test/samples/aiff/CWE-835-01.aiff | Bin 0 -> 99 bytes test/samples/asf/CWE-835-03.wma | Bin 0 -> 35742 bytes .../samples/asf/max-numberOfObjectHeaders.wma | Bin 0 -> 35742 bytes test/test-file-aiff.ts | 16 ++++++++- test/test-file-asf.ts | 34 +++++++++++++----- 8 files changed, 54 insertions(+), 21 deletions(-) create mode 100644 test/samples/aiff/CWE-835-01.aiff create mode 100644 test/samples/asf/CWE-835-03.wma create mode 100644 test/samples/asf/max-numberOfObjectHeaders.wma diff --git a/lib/ParseError.ts b/lib/ParseError.ts index 0a1430ee..30e39374 100644 --- a/lib/ParseError.ts +++ b/lib/ParseError.ts @@ -24,7 +24,7 @@ export class UnsupportedFileTypeError extends makeParseError('UnsupportedFileTyp } // Concrete error class representing unexpected file content. -class UnexpectedFileContentError extends makeParseError('UnexpectedFileContentError') { +export class UnexpectedFileContentError extends makeParseError('UnexpectedFileContentError') { public readonly fileType: string; constructor(fileType: string, message: string) { diff --git a/lib/asf/AsfObject.ts b/lib/asf/AsfObject.ts index 7651a540..180e3a07 100644 --- a/lib/asf/AsfObject.ts +++ b/lib/asf/AsfObject.ts @@ -77,11 +77,12 @@ export const TopLevelHeaderObjectToken: IGetToken { + const base = HeaderObjectToken.get(buf, off); + return { - objectId: AsfGuid.fromBin(buf, off), - objectSize: Number(Token.UINT64_LE.get(buf, off + 16)), + ...base, numberOfHeaderObjects: Token.UINT32_LE.get(buf, off + 24) - // Reserved: 2 bytes + // reserved: 2 bytes }; } }; @@ -95,10 +96,14 @@ export const HeaderObjectToken: IGetToken = { len: 24, get: (buf, off): IAsfObjectHeader => { - return { + const header = { objectId: AsfGuid.fromBin(buf, off), objectSize: Number(Token.UINT64_LE.get(buf, off + 16)) }; + if (header.objectSize < 24) { + throw new AsfContentParseError(`Invalid ASF header object size: ${header.objectSize}`); + } + return header; } }; diff --git a/lib/asf/AsfParser.ts b/lib/asf/AsfParser.ts index 0eb97c35..845429ab 100644 --- a/lib/asf/AsfParser.ts +++ b/lib/asf/AsfParser.ts @@ -6,7 +6,6 @@ import * as AsfObject from './AsfObject.js'; import { BasicParser } from '../common/BasicParser.js'; import { AsfContentParseError } from './AsfObject.js'; - const debug = initDebug('music-metadata:parser:ASF'); const headerType = 'asf'; @@ -24,8 +23,10 @@ export class AsfParser extends BasicParser { public async parse() { const header = await this.tokenizer.readToken(AsfObject.TopLevelHeaderObjectToken); - if (!header.objectId.equals(AsfGuid.HeaderObject)) { - throw new AsfContentParseError(`expected asf header; but was not found; got: ${header.objectId.str}`); + if (header.numberOfHeaderObjects > 10000) { + throw new AsfContentParseError( + `Unrealistic number of ASF header objects: ${header.numberOfHeaderObjects}` + ); } await this.parseObjectHeader(header.numberOfHeaderObjects); } @@ -110,9 +111,6 @@ export class AsfParser extends BasicParser { // Parse common header of the ASF Object (3.1) const header = await this.tokenizer.readToken(AsfObject.HeaderObjectToken); const remaining = header.objectSize - AsfObject.HeaderObjectToken.len; - if (remaining < 0) { - throw new AsfContentParseError(`Invalid ASF header object size: ${header.objectSize}`); - } // Parse data part of the ASF Object switch (header.objectId.str) { diff --git a/test/samples/aiff/CWE-835-01.aiff b/test/samples/aiff/CWE-835-01.aiff new file mode 100644 index 0000000000000000000000000000000000000000..b5573b068d7dbdb39c682c4b81cd20632ea3aee3 GIT binary patch literal 99 zcmZ?s5AtPTV2E+_baQt0_XV*T7#M+=lR?0N`xltYz!2)=7%t=)5~>@b;I3zGXsD1| os+*Ho&fpg28U$3rvZx`@AvoC21;`eJYGH8JSJN@Ix_^8h0D1!xSO5S3 literal 0 HcmV?d00001 diff --git a/test/samples/asf/CWE-835-03.wma b/test/samples/asf/CWE-835-03.wma new file mode 100644 index 0000000000000000000000000000000000000000..dd31a8c72b2e90b5a581fb96304e2357b753671b GIT binary patch literal 35742 zcmZsi3p`W*|HrqP%TSw{ONi01xmRwZ zUzfI$RPJKA-|zfa-`}s__xJyOkH_q@&pCD;$9bOj?elsoNL1XqccquB=riCcz@_K< zED-Q(V`lsYg7UsTyL;wIFW0>ZKocj@%Ju4BJOAf*cEZ1=h?*aV%CmqR|N7W;f}QEt zQ1yyu~ z;{^c50B68$z!iWp;5b0;UoQoK0%LD7>({EPzn%Byzs`WoCTyD6_i{bn0}wAd=t-M* zziCWz?&V6TVEp$g$B_Rz3?Rf9urXeL{WG0`AOKO5akY#W00aZD|2piieLw&R0AdWW zmhWSZ9`EBSC}dm{6K?(TuVVlJ?f*Cb^RGYvKE`$ayq3$1YxD#70FaEUcKvm=&Wy1( z;MT9PCu3|4Q2q5yAb>Ma`TyPPinxEB`|bgO5dZ+h@zBrRxqukp&vP>_i*fUQ z-AB+!lU5%9ATkXAK!E_ryb~K6Ge#U`fn~$Ooi4Ir6*xBN*G!KprcRPBmQvHLp%Hl4 zA$htnARH6AcgpRZ(OD$GG6fceJV#L=P%sJ#BuVVGQVbFBIWCUq;>4}I--7*!PIq%P?5wG=tp+DhN{l^PS(3mV=dZ$XiMSFw29-6LuqbMxKx#Qig_9;V>;(E*QE_L+ZF5a--b$4blQKH`L5VMUYAiD5j~Az~LG$ zSmH{<3%O}6Ns_r1PD>)XS9DM*@u|zz{=V19e1gajPW&@~mCnM0JOb!oGN?4)c3RZJ zDLnDJ$;v%LTrr8^D-H+D@Pm9Lmx-w2C^iorUy)7_N140J z=6+-YccK7r2=a$3(-k9QEVm+gi+w0$Yw>PE@l&9>JF z%_{R(^c^5OdEYcucePZODlPo&dqvrOPrH&ZC66laQtzdPvGJm>ucG=@ew3H)yRUf) z5z3%l)z-$X8er2fY0e7KWRIsRLmw)NU=B*KRLG_{F)VGr& zz5U8ey@A;_%A(||OkbDlmo;IuOYYG}XKhMXU7<-OdTX)!C!$*0+AVtIMB2yNrmXMB zj$nI~}m$H~X&lWfy zb3f_d^IEeyln!E|xoZ>?I^=Cx?{~6P%Ha^hYs9@%x8IjBzVFfJtZfT*))>Fa{oH@w z{eO4|{xbHzEQG^90r7bnG1__-OgM?;5(VTU1yH$<#IFGqxvj`je$u`La2h=UR8T#Lh3!HJ^LJq^5KGe)!d%ruTCf2 zosTdZ%4A^G-tkf_`fy zX<$&0>iI{(*o+I!*3qagp5}dKXbn<^PRNXd%lnHmXU3*nl`*DNZdMM14YBztsHjv+ zLvN+#dvX^8dZJ76y!Myma3@kd+eps1ED_;!tw4j@P?VrbzJ8jI+WbRxlF#SadcD!C z=-A=7LJ#$bv``k_<^_txt)dA)=w`a*;ebl|hz99qqIx2yv{AqDjIlzlzo(wc1e4r; zxg2#a&$p*it^h7q~*^A!k{V#QF!|e z4N4_n<-b6CvmApExvDuto8SX=`l$#BPdi}#9~40FZwnFp7Z8BITZrWjb4b)#B^YTB zL_Y46Vqy+S=Q2bB@fVYrlq_dY15n{6$ED9*{GfzEqRh2#U$v*Ke$;8X8it3FBWS4z zaxxR=@fdz9$nmqHrDEZD)oFVSG^<`w_H5poM05@Jc5cDy4n{svJ~g@3^3~0xcR(k} zvAczhIzvo*U!HKdpY1;$d{1(Kqx)l6d)mMu<$csvZJ_L09#n~3eW%JkOMW-Y=BuH^ zx9{JMNekc2^GpC9Yte*_7Y#q~@vz%{G2oP}CavAUl%ih?Nse{-RGvbi-_ zT@SVTp7Z{Ch^FVVqQ+#Lj%gV}sUzIYZc^-D+4ll+iWU%a31G%gN-YM}*6dtXrt(crFIEw%{A68b zS;|7~Q61$+AP?>)S(vKogLX%m8DV$bN1=!I2MLSs*@y3 z6ro~)t&z|!PaNx|P7Q(Yo1u;z#8nA&&w5Ut@6c?xZ+^y-WD2v&s=H6_3Sq}=?a^%Q zoVsRm^>XHAzLE|v0@It*tGU9xx3fjk49fK)mpOFjdd=n&1ExcATO#Ljs&wb{RQOxj z9j87SPb<7;Izw^#jRo*$T=`cFk@*i6VpIF7EUG<{>98&2+1YTzr$C$c=14L{8ioyJ zw-RN0Y>aF~0@BtLie4Dr)(#OP3Z!FQwDp{G%|VB4;ZBP8Imty#NO46iWA^ApptSSh z7Ll{~iw|CS+E5=n#e&G1_RqfGCyV_7=h_N*VK##aX}_mtp)XPvlC^&#h{qH8OjZJ$O)y^k!qH#Iu{=xfbE3(f>?vOG6m8 zxBpgTKE1uy54I_xE`GIH&ia$taL#wS3w;mM#XGlP)-H40Td}RjRaB9u*WQph^PPLL zh=0=fxK?^_e2w|`b}KKs24|=kQwv8~M)4x@v!kIurc?)~1V(I|6Jm=b@#n2zEiDnu zRD;^~L0)$D(>w&xsP2iS)(KNH$xPa)8DhyVcU5?)7y5%_WaDNySD z;Gx-C)=7qefp)xECTzDS2CyREuxIB~b-#rcx!q)yzTb-vL9;fHGe%b<=^b#3A{s^2 z>+206<|fV!++b%^H|vwDj-(*7!7vKT(#uB;@_5N7fZrJWX8`;a(*JT9b^l-?wq0Cf zb8~@FSJ+Yp#MlXs$+3CNyOu-)>MV+wB9%@q2i_3750OZ-)b{0W#k1rj8!gX*707W^ z3yZj? z@2(7Ye`19#MjVxS>Cq*9M3^gNrzETsdXK610rhL>wY%^d`<3P@mOu0OQ3jU#IaH3= z$Hl-&hhvEZ>aK?vjo6=T=jy(;{YrDF>I~nszb;TjrEP2E0d?0Ql*_(q5@PSoEmaXE z1g7t-zk<7s>$*4?>+0|cjNM2qL9vP-^xfQL%i{P;-b2BWP8Ykkd4u8DiQY3X6XR ztmM)Mm7cqYpl+klxG3jy`E2@%T2G1TBJ7q?I@kK*329e|mUrk6pKil_W0?UkiINn^ zQ<7l=Ku4!Y+{GOJ6h6(t4kJ9($K>7Ed#yY#mexP|c1zYt>TU1k{o!{zx5P61GJ^LA z@;TxjU+LUc}*tAnLSTZdEAwLDSeVN>WDfO9xGuHy@^1xL-{H7yq`n1v)n`*3bGS$I52m zK)tAZm-d6@9^lxXC<=ugSZV7hxbX^al%*3gYUXg(YTyaF&VijdS#R}z!Vo$$jxX6| zX`>u3*5IwY)l`mXb#c5jvGGTGh&vuVVBh*MT`-({%R42FyX6i`=#SZ@LMt9UYIdn4 z+<%9Q`Sdr1pdmBgd_7v4f6R)?1Rp0|kT%p7S4>f#ErtaR-1C23KvZNpGfx6mF9S(3 zhPO#UrfG!RYs6jR>hQ^Wj+pW7mN=yD#?=u%p!jfJH0u{{R{<8jZj{@V@eaUOrycB~ zFzet|%|X(s97mNgoFv>axp9K$IMZ5|YWhuf3EH37sTiaI(s_MV?#=|2q%b|g1z5d1 zWAM7Zn7jTzumFFi*na`B`@hbFos~HiF8Gw~w5brC42*h1|mICL(}5Q~Pk zF`^B58e8r|9I6p4jwTf7FX4?pknnDY3Sr@ApBulE*XH*vdhpcBL@_t|c{!rd1b-qk zw~M#BdO77$o@aLraQAJ7q7`|m!EVof8ok?Jk&WC_p4XJwu-mJSDHAGO`UE`+L|AKO z?5Wue{0RQWyTPSkWcEFoyj8>SUQiVwv`(EbnRZmUJ3SP~O`vtMh?r{Q zG>Qe2`k`Fa?c?-}=IB6ksAM_FC2>Vfh5zdfj*2<-hrxWT5GPup`bD=87|EMTb}a5i zah`y%@F28MwY_CsN;F1J+YwTI|3}1s;)(yj@N)!&{02hkXVn5U_Fv)V(%EKbA|Q?= zWgZouuYKY<#QB>J3{!~UQYhDHJq=(BhL}M6%5^XZOYax^#$e#6I{NA^yf^Q&345+g2IM^?FD9!XO`74FCW3>>!?M@^3%if8*>T0O zC*SYWsAJxIc(GO*?MML3g}eV=PR~@*&dysg=_~i~HrAri)t)gz#?oa-5tKLa7DYX~zFZRM7Vee+a&uUn<#A5W!!&)v^cox79!U zzT`jG>;QedTM^y(iKiAbo_A_C{X|Bn1$p1$>TdOB&g3bh*gD(g{pCA7$ck6wey!Os ztq3y}Vor_0R@D#)NaWavbmJjJeem7;UiWEiUS5%Yy;#}mU zbs2B?taX$qv_AIvafoQ~$5c^0-@}zEof8+H%%qhcZw+2hC9RTi}iQKLo@2t=On8y!SFA8TIVo>lYWm0ftT%tbefeV}!8= zwscX;tV>V-w|V$!A%4|1e*xj}7Z86h zS+N5iBfGIp#%!XZP9$9uJ#gf41l1i$!Xi+jY-kFy;Y9dbaO!1B*X!lCAUAYRss)wF?46f z{bWw@u7hvFP3r^scNiV%NKDDKk$sNhiKSwVXA$KIv1Ov0_le2bn;a}}VIPwm(7VH- z7kfDiT7<9G@tdI(zsz_-Ae=Vrt^65g2?d_@V{u%GhkW<;aykAm%X87y)mPVwdzE=X z%;vlyv~+D*RM#xlGt#jB>DA&xqhuLUsz7wC?1*hYZ)*bl*u+Kx*P)diUjNG1mE&RM zzKPQb{YUDcXP1NITCz{wR_UHQ=3Pq*#6FcT$>?!pV4$HQ(vK3d{Z5PIz^?YB(`Y1= zi6;Gq#tn6aDqd_0RC_u^!QYdRakn0wZFU*4swF|2VDk*@4Rmu}ufO70h%nJmc=%#{ zL3~i+kzVb)*YyR&%S_og%vxUn(s|%}&Z~MSg;ETlj|Emv()#0AcO;;(Bh$g zN;>|A1@LF!@K+2G{7)7lFYYO~#fOx5fM_M)hmzsb_^4zhYcvE~#Lnb`C#PDmBrSHP(OPZY+8GVC*|M4RmvMSd8OxAUWDD5}j_&(nY){dAYg^0zaCt@a)6};k11HF87s73Z+`Aj?UY%aAGKIvy zwJ%`#Skt~@!#33zCw;NXD81>RKgiXgIzDsjkeB50xLi+=TXX0${t@{J4W7HNUV7M- z32|TFN@CvWrf(Pk4%{;V zfGT=H0N4#eM^AoarztQxXW&JrK?V4IDbkT6bG0~TH~hAG_eSw2q2E$=+p=k+pGLt`(%DS(6X76j7&FF&8zX)0YA8g<{lp;hKaW5Bg@Z(sDbxc$HcixgD}o zyg}BaxTEvGCVkm0Sba%+&+r}1qPb$xe+*Asyv>pN1Q)U2{ghtfTImXy>KqkFsz_3N zxm6QJSr3jaxi08WUrZ#BU60I>?S(MA&%)P(YApTFbbpzfw)5uP@~HM1Iad^BJqxa+ zJ4fEQnJ_pAQ6^aZ1oM^G_bc48%twxG6|nw@56h7K8X zHps|Emsl96@Ri?eNoIx>{BchV6O0)XZ>8FCkWTdV6fNVKwiTT;-6U zw!!uzqgeBkJA5yORuWfb4E8geul=AVaQBO?Jn=ncW*M9<$Z+b|dJgMHS%TBU*$OSi z6<|*E&|oNeb(jRHUIvgXp%sZHPZeKfA&+9_Gq=kUZ^-F!%3*7~Q5yDPWd zEE8Sc)rGf44*I-rk^u@%&Cfbw=+#RB$jD_nQybFDvjd?e@i64|>^ipLdFZgp1e=H% zp*gzu5Z&)&X)$BrWnd~}bc<kts};XFVzzmtG73rH_h0fy6d=1Y$- zh37$X`^+~>fNb~y>;p>fL%aMT5&LO7ZL^HfE#8@+ncLRwTrH& zOllrBT})>S>%fE0dY~_BD7QMey+FG_s4d=VfLm{Qa9$+v(d>*1bIdI&jhVKRII32zIt)5jeG39UD{ z+iSLYH|pc4WL|OVJ;+A=jaw=ATbVH>UWP3^)Da&+%&h6-GE3E`K|RYTT-}6CB-NFf zQ-++Gc0<_;S=>0ca+|#`v zx=T|z+FQmS9@tA^99L`fiuQ(sd{xAFn3{G&pm{x#erHnUs6O^L1b-g@p}&Fn`oBPM zt%LFna-YK@_-~$iY8e%&7e$pQvDD@=v70qG+C%m(txjmHzlM z?=|&f&9{1PMRr7M7^PeNd1NTLE|Jax73(;5`eZ>+IU*uKVx&0$26$W zEyyezcQRNwV;Qg(TbC_TOITu>i|hmmCLu*^)*?f-nP_TM#v|^boM}>AMquHE{;YtZ zKu{3P{h0q(AMf?d8<(NF9MGy_WMyBdBeG@higp{c$di%Awz8(*To_13@rUM=+@THn zhKF3i#%!T7h?*FSX4sarwg%Ka%@^U|j z%4Z-`q!8u|JHc+kX48xgnfjh0Qd(kS3Acv!iJs!eV`M=TgVBhT6wat4B*WB7^e#`O z=n{fj$=mm#k#Yn2gyOQLJo(g$T#JzXLVek~nb#*R0`zXMTL~~r-)+3Tv^}=sj|w5n zy4BZikoW6kmp@+m(*L9+R1!AaR8?x9x-z`Hx2b((PG2PT&^Y+FyqUS~E9>Q}lHn!MdCdt}bxhz?=p z_R5(Q24$#pSFv_`_yRlJEb~$v%=OT%l+9t^;)rWV~Sku!%}%$PB}-CEz(SMP?ens3n-Qw)Lxws3YYw(7~xXc;!@eY$B`G^!RuI4@;4I! zIK-BBJv}fr=2k$ho3)ZSif4p?ECj z_O<+IVs2)|TPJ>qG?O99m`X|^YAaj;r|3ZHK1PSzfb-*}Y7u?uu$Ly#RMtdkoZT7v zvN^eNFF%L2K>gN;>AD)`AWg8>&CM@AFdJP5`PQF^jA-obJ!8N$CUmQr?AA!9DiJ)= z1|&pEKS49bDSOJxl`n02hPM{j_8af_SARR^C`&Hwf7lx;eQ73QV7r~7elE%8;19NA zn#QcxgDAaIHX_8Yx=U`&BU&mpJ!wt1T5@QVEUol(RRHNGSW%2rE_Tm1fP?)cH|IXP zl-3{7vZ5==2-8**xs6y^=gSsFV>zFL1d+ux!Eqh+7PhALLbw8&$y$EYrgHhG53TJ{ zJlxTWPp=nngkL>h9z@&xaDluWq%phlq6g7-Wqa0o2f3QBm%T2!Gr^lp)|YGFCf%He zYB=?Tf2S3vTXmnBs9g>~4997le9l-O1$FQSAh$(uJrhE2?OAt6wi&%duHz$DQ(<)>thtsEZ_B8K3^d;g$l7L;4__r<8LFMa-zN zMaT;ktIe}SlaYW4p3yAjhkrxhzlT8hZy?nF0^;u_E3QrC^SnZ&^T#)8U~TeoMDp3( zsCWwR~5v; zE}rsS=M4m7w9O01rC{_*sj5HT6A#W>nJ|lbL>G^8T#YqgZw$TRzP#Jr2>g;Idxm~} zswQ~&`~3)fdr`R2!8hKC^QMhqTS8sB?T%Kl|pyQNpm;a(< z;UGugCyR#SB%?C9%=1NQY7rfE=!x?kktUF}waUKqd7J$ilRjH)ZO@CHW}gBRbR14r zPEVzMP-Qj0)!@CFRS(_A>_r=IK;_~q30h_IM6K75N}&)gFIq1xH=r1qG^|1Gd;P|% zkSoitMrm>oJ0Wa_;!t;9pK5sSX4MJExCd2~yK$N@^xVzDqOe zSO(HaGU3{zSslEnWq&uFldor26$*ldaeUMq8`gBCLbk8roY+DDG&rJ0DUxHEeY-V0 zU-vf^KXLfI{gr=U89JMv`3LvU`M+ux|BDJ_wZ-|dq4uFCoLF?nrXlK3-_;PDIE=#_ zhQXcKoVZM!$-k>uC{eJ8$y5UY^f6`vu;+SI_%#;G_&BtJLKDQ<=?%#kgat&Q?pWkg zkomHU7iAmlL-Z9j zBP#t1U-o5K+jgon?YsP6Ozu6X2$LG^O>4p`0wX!o*vym?|OuIu&O&((2Um63JOB+g0 zI-Hun0C}(shefnxYD!pq*p~Qg=I@z*r;W!A6CIECN$808Pj{pnxeEC-qtYa^9A+={ z@`1j|(Fw>GIB#zKqj3X?D^L9L+1ut_$k7JJo3h37g>a?jrw0;Vyye5om=YpCk58aZGx84LwBUa2h1}Y9a7AK|Su~PorDg^4Rh_UceE2C_QT}go&52b}@pp$`& z+pbiM?50l?oPlY6B`Q{X3f^f7;0=1?eHS|+K-E5e6MVAZ^o0sHOXjpN8`k=@NbfO5 zouZQ=?7II(O=Unm-jk`Rh4L-nFsGbMc#K7E=%f0Ai{aZBbU%^IC7iP!hHrOid5XO1 zo|AL}B7OrA{J+iwvVNImluaD@XY$$P6A$755R5UZ5q2LhMNO{+lg*{_b9K;p5Vr9s z%k=z+v^AhuoHogV?Qs-YlmqY(!xja?KE4bV=e&$#L$#&nr*pR%O=#&u7trAwx zDy`rLPfsNEgPP7REoot@oCd2r#`db?rH@eO)5d)pqh#;(y8BHWtkd@(V_nh_-?qH_ zl|hWs#er6&=YmF~tu7@?Hp1R-YNzR9_PLI(FeS>%k`4Rb1W%Dw%&H66LNZbFS`9v&sy&Lno$Bb`XpqXxDsaEQ=IOB zy2FWml;s_AMaIz2=d&psNJ1^?)0|h|u&0H-2p*PW76i!i8;Hz*0Al~!@u%^q z58>wKDP$8C7fU=y+fdvIo{j}bK(t}xxK!CZ3|=IiO9zB8J(#P1_EAQsoKj&dH4f;Y4 z^DOaHd23R>I;n~JvRM&bIjN|Xx8^m;w%aJftvK>Psj2eff)W1&kHu2;?1&NlHF6~E51wTS%ShOLJx4huMQ=BlmGrzmwK=| zCVlYnlKtY1CzE#!Oa*LBRKm;iZYj2IaWht|%v4`+bHYRuekf47Zm%`Eb6BI zNH*C_x3ir0G&|Dx*_6wqovM;Am^g9W@nn!u2g51c^~41FtdG%tVXWf0VbX&`2I zDW^so$LkNhom08VP)qEXs!#?r2SOV0CX0dm<{`&|87rZEwaCah^!*<(12d4EPrLFkw2%JBR?uQlj0J!bS&ZCz`oXy`ToGv z0yVRkA-3}f-dT4)Do-Pioc7Duv$Se!Gn?`p-wUYqJ4%QjwcD$)rG8i%QOgW_Sy_~D z>6!8VZokDSPZgJf@%}U8_YR6`AdnZCgDRHRZPc#{i50syvbIb;}kFIOyLJdba_y*dOYtvOudFmar*Uq?Oxvj zXGezWAz3waWQU>Z4b^636<2Q8BKO?-O%Cv4H!rLfCl!tB#TC!Mp^Q5`nSj*w@7Z*- z1TZpF>?c$0$Tz2{D%Bz$j&%`5xAJ^jIl@o6&TF$yWN%w~;=rwk9SiwFE`N1u=`Ptq zMy}qS*8H%>)bHlB($7TKkE82_6D8zvUqc0Ldk<|?js(b!Zab}h4fxI|dAdaa`F;cO z^?!k22Rq?pIALJ2UV01=4U_=Bf^t@vO}y1m+odD89KFSCarv8F<|&tG zgk^aLQv!Vnu@P5R5Ej=Kl8tVtc+K+!JR#yb81R8ITya?bGNM+GQ%c4%&d(H^rS%k5 zyWJTpoKwO&$(nbC);xt0&Zb4uUx^r*IwsBud@+4rCSnw`PQF0sIOZKm*G~%o_%H%T zj=Y=NH`IH=Cn8k@>qx334uCu(LxjYLR(GXj_bqJ`4E>7V+Me zuT@Kt)%jYKR_Ojiw7n7<+TTy~WxdXg|HRK`U`6KZO-;7dwA<|(Ug$P|m6>0CR9<`K ztas?U;+;^d9Xm$CkQ30@3#?ACS^wcPSk1dDx+PH!Csn;AFZFB9QF~I2evDR4RZWq_ zd73?U8%@QmPsk2PXyxpdei*sGGVa@8wKG<*re6yV+NtV)*knf9NX3!+HYHA+h=+|G z*IY_;F5IF<<*4yG>vxSW;DyfSS3Hb9RAJ{KDYW{4uRMSkg^R|t5xikzYpnqeXhWZ8 zSt0IX%@9|8UVDKAMCL{&Yi8U)vSLl*oQAxpLtwDuO?El5Zdi7CH-?^7k73maC3j%H zlbo;iB)*|#D}56J<|4w~QfA$(-gtiqznz1eO2=ypHmwd>bqi1rV+C#kEP>Fj)yc0~ zXm#pZB105`z;1hsF_gLzx4v=IjfBVw0Rb|^L+z~D+UDDKf%c{(Zxj=ya_-(G70TCE zsIkHe@8aCmuRiW4)o3J^5pASEA_`Us=e*hS=?w|R` zk)QLw@(-b(h0g!3T|k!gp5sme^fDWWXdL()KrH-h9=OEvHVhZ_5iDTMW`cRcW6h?R z{v{e=WKf=?J;5R>T@UbDO(<9kL-E;F>Z7ey| z!FQ`<9q*vm6{acGzI$*kG19gEaOxtA9pEqCW$lv0xAJ*;-}#2ex9dS0Mxh477PJGt znU%0nM8jgDSKkYs2nV>;cbbQ9^=_kD``*ZB2c^4nRQ2b3qlL;R0+en`W9T~W$$_FW zqASLQ`+kO+Ud7e%yt&^q&v!f_-y&4ko7Hg$#G9Mv_~*9@##?r=Up<8hF7-y+d@;#G zRO(_l;FoALtvaio<8;A63pHN)vix~{1VtNcYF50KPE^ttIp~lEqnK+!c&&)mX zgQR=5K@u2su8ie*7goA<*1Ol$qg%#v^qc>#YW^D*pule+)c*qF@3jlaLErwYC?uD? z9LKL0L5hz_0qDD)gCDYk#e=CYISfsZ0%#qtKEfO3ldWXgM!S~0<&SUzApfz^D={f< z^C$K&XRUz2!PyD8u?42o|V2>#x33n$`Sojv)03+h;we_Mv*qPXV4M>-Ny#Mf|Rta;YbF-B0TFJTrC@ezn6BC6V(yo4tA)sNbXf<8} zzm0;?gY$%J=OWHMtlK&{RDE*78@js=NoTkq2bLY_OQU%I-H)#&Fl;3WiNz$0R zSD?|qGUEASBsJ@p7AmcHY%lGtdCCn)Wlg-5F~x@>G)BMqQLiz z1=}-bUx)c^2OjIt4N~IM&aNYEKfLX^EfqW_f{V;FJVc^uOPlIiaX4su1)f=xGkTwM z{1i+UFSA5fDe}C1EL&e?wertdVWy7Agg2+Zr;;?ND$QfrtP_I)jYCFttHMXV62-p? zd))*=UqKI*OaPI!y`r>U+qA0{vm&@*8hwv71;8n%jRRp5@=h|%`4C3kC<026%eS%F zFObzDY5l(Lf;*PvVy9z>c^n~d z4U|qW8aaCBgEm-n4Sw~61&$)|1o{L;5q-v~n1XGAfUeCcb{#&F%mVJ@vHBr#NJt;^ zpi&%m@qIgHd^~td`qJ{)82YyCS2KDD`dFM;wHN%o?tx;}PAKnY|J=c|z~L$Ke8V>A?zoQ)D%JwC@Yb?(mO0uz4}Wm+IjHjhRUB+l<|r=p!a<_G5dW zSlEBAm;eDytfPEe^G9VPOr^A>ROhygc6_ROFRR9!!hc#Bg4b>AKIf?^e}7iuoKA~L z`K3p11TSH3vW#5CC~u{~2uqTmnhJE;IbEgi%6bQ8c>9x0(Q*1e z^p9ESEyrw=QVluuF?gSj`UO5_VzJK0fpl*%ks6ux0J&{fHAcG+y;WsPL#1YlA(PbZ zJ+Ih23{5Z0Igbc2 z%)Jc3vXIF6UmsBx^PJD{;|gn~ebdhfTfSs;ciG(@&e-@V!*^p;f-Yt?Vniig*qKEs zaL;apn$6!+JCVi}rq;fj!}?hV&~&k8Wbey#iM!uIQa89?g^z!{Y9y^YfKp}TlzesM z(VnYPv;N^6jl($y_j4>W*Y{2K7=2=>{Q&AdVco(3RQ}A^oPH#GK5ah?T$bFJ5&KX% z)P^Go{Pw8m$Ro=g$dVVu8>Pz!`(WxMWjR(jglFzZstblsT|8AZrYWkwz!#{g!fo_8 zZw2GM#{BpiLtUP1Y#A=9sb}-U<&A)C7k3L9!rHz$hR}D2>s(;fh&A613*dFk*R$#i z>Xz$0dxjSk@jbbI<~S3(wp+=&^7`^gibl3Ky^K++l)T4CDzoo=VPvlFUM1I8E(RbI zS769(Jc)Hc@@B=KvU?C`(5n zA80%A@dM~l zf<%6)!)f+oI=rcK9lI~Sv@|NcE(!YtH<3#l-))q>R1sZv`W9MumUWvUpb2c}@I6r9 zb>*Ff?;pr_mCrD>T{?g0lD*Jus10g-Z@+Y2v{6nbzr6G_uDPOGI#Tl@^`ev7jRElj zmce#R8D!bP^XMNS_e5{R;`Kc7A@L$!v1B=NgWtU}FG|7o``rX?6TJ{ZRo@dVO$QUp zTM#IJs^8)*g7Wy$jN`0nQM}JXmTieBxr)qJsKK{qP2|>E7u@o-Jw;q{hI;+OBok_` z97twO=!R+=)kPTisZ&)FC!mMsR~23}W8UC2A2rgA!^N2T0zKQNL(nN~J%xw}l1weZ zOnl&H=_=eUe9PqyHG59Yu`+U*&^qX&BB(RZh!(F4|CC)*h7De4b?}9+-kt5~ru(Hi zZQlfQN=YPV8NJRrHA^&}?kPO1JGYLq3hueP(0`dN^xOL;YXD;<^i{UV)mCKGXC#Z2 zAvkYm(UM()3CpGf#}s}5%2itFr7E!@Vd4XNc)+{a%9rPecuOuN^XKx!q9|nF=H0u= zCcHnm&dhlxUiXH6f`6F_{0K38b{@E7eLC0MdtZNLyj`|`77p%L`&@Kqtx2_iv+i5X zH-n%hH3PMjj6%ep50TOJCNl!U@t;Lk#cJr zmuea247*F=+n&XOXHO*=-G7S7X1-%(dhzH)z4+A3b1}*>%6((X+lXLy!?t*NB+Dm; z;*M7u?O;|fsC!uyCGmxSQ?$}*s4TbGJ~%MY;_P|8WHA+9lvPk96}#BeJM=*}xMwW# zO|VS1U%$y*F}*|cT@{G2EZ!U~jx_Wet#1{4AJ9ZpK55jO8su z++T4xP~=(wa?I#;^~yJefNv+g8HyWQ=8wqw%Zw(#RXH4xerHf6v7~#Qnji?juoTo{zbeO}W&4Xu*vL4^la|F^aHiNo*hul%FwU-^f~ z&-q{Z$Jc*AW$9I`VT{s=4s;yb2C&HSdyEjF-45VDx;?h4AET z7bGs!!ZOW?h-ZsRMl|9r!@(D#j>Pd`8F>k)4W)yLdMW?hn)o1siV+Id=3Nv?7b$K@ zExPl8Z=un%I+3mGL=K#{BB^ub$7so=2s5_RYzaOGUFEyqIKom7HP+mq_g=f$SjJ79 z_H6+5rv4!U56fw?;aKymnre)?nF){l9yw)XpQY7*vbdYvSS9QBF7nd63fGOPrLZXf zU9qvFm@?=vPffbDOQQ{YwR<#m#zwqMFkswh$R?2#B08xUwXGpj^N(38_I+Jw;3p|*s}V;w0=pp!V|q0<|w za0>~%R1F(e_XpZOKi~a0hrUyq)0bh{Ne*1z_D%7kq)x(i-}ruD`S2uL-UbiCqV;AP zm!mwMma7)pb#=VU|H*js#f5JF`&<5J5_ih=FZDlMk|>{Bcy@$9TRG_7JA(hRz-B+! z@-6#=;H77R-I{g<%T1v$+sx+jz4KhWr5)b9)vDFYua^2%<~%Cjj?IKZ6t4H)%uynr zN$FIz=e|*{+Z-!|SPDZR8MV(poTOc#go8Wyj6lCVOm>HjjTfg?iqGqOv02Sc0$`DC;bSaVSt{`1c zo2n#DYYYb0ZnqKxnjYmYY9?n1Hm~j4z~4TR87<<0-=|5*0W8-4hu$P)6*FqRE$83m5u!n;0!gPOsOA-E_jL&L(TJhA-u z_BgaYhx2FAPcet&n$euNJQ;DcAsdPbgY1S|a3f=U*`>I(7gfe0(#^>dB%=vxI@-=? zwE;Re6MU9tHb;O?hr-FS)Evcw1fVN)*p)4KmfgfFwE7#_{)DvPz4D6q(I#ug^A0B$ zfE%ucGTMgJtP%Uer6c!Qy4stJ&Lt9OL|UNBQT9&^EId~NjAm|Iz5V_ynzqBpROYK? zd&J`XbIvpE=DD|M1`ZEFcpHt5U(BF9zfrvQz}se_dc4#BUH!&XsduY2WweosMuXevf_FVLrWNY% zc~amDjF2Mq$cKpRUM7w-?_NcBA4a8wnNco3j8vb9U^G4l#+U-degmQYzd*1{z<_8Z z2~6R)6f`l1+X9Z@b=aiYnU;VM$YTOR3kNY_6HrJoe`Oxe4vRNYq;5%w$~7Cgm>w}? zGvHT*pdgXpW*j$|U-29|g%DaP)tIMlMBwlh$|Jb!pdog_m9STpWb?fn|JUA|zeD}M z{r_gHgBm*_Gc=g7mo-^tY%!K$lw`@45VE9%v6C$s%qwLlV^kDUM3zKJFVv8t>>^3_ zefvJTUf0!iy+7}cG3+tN1k3pF~90(z=rgQTR z47o+T^91c@OlNrKzbBe|Ql`-tN?^VMs`k8D{V z;tsvfV@{WjcI#cuJh7Um9D(y%H}7#D#^xzM3+7bxqW_GY6WJj z0&?WHARPW(5U?HbD7}j@caE^J$E)z3=94IrhAkGUItExut_X`Gg<*y#-{4%^7w>Z= z^kGru`V}nM-N36?30Z1Qw-ncBF_jVEV;Z?mv?OMxza1yfy)&IW!t70GeSzsjMCGf` z-?P=#Uw4sQYNJ8iMJ*`JB~)3&;K)?mjrH+Pua*$P)Lya;s94;89n=Jibjl~{>Z+T& zP1k=EwvP3tW=7>H#C;XmXS3cuWNc4crQC%q%C$?jDO30Tt{-SloC)Av4oZ!9V%t}5 zkJjHBT|UQE3o>J|zc41-x+%*;z1#aen24wPy^G?oa&pXYfOuWXUG&V!cH$VU>T zUnK&JB8lUMM>Y8z^v#3wKy5Ms{lKhLD%x|5_dxpu$dTnvXqN@0q zL*=Rzk|n-RbA53C4BN^X}eaqdisvzG-Rf6#@OrwvTO4yyi~}k z+>p-QI4ewq_e&6hqUYU5s+oG#Z~P2HzT}`QH$9t-4o8zoWTpmVc^W}~4ur_%OpFrS z;Pj|aglT3MN4DzAIZ*X{5f6H)@HfEpe|^Fj!#aZ3UosYr1*ex0^4St!572g37&;35 zRnD?(M5Ey~AbJ}5cl6)UZ?;3juVSlH^;c@X3XAMiLQua2LHdIrmP|g$mFe>;A#oPm z5nZSCyxg${QVH{&l0NL*Rvhd&exc2+i|OWkmN7B$_oT=MrP(zl#T6-cPr+Fyh2v(N0!sCzqUtJ=WYtj*y(+o8kbQL2s@(vMIV5d%9vlj z+KQ{U*S@!WNrJW*Jna)|v+uQ#>Sn__sw2nrWD^)Nh4CNU`dLRaneLSz>@2shNZYwJ zHvzfJlvvce7PjcFAR*UnEoNIk*vhpKw{^_21Hyw}v&BiGKq1<8}Uv%nbd^F{iAmu9QCO4tN-!ZvNBj za;|!IvH)nd^Ti~3Tv&&Eo35VI&Nm!;E_7;jp_`Up>DR#}c2~1kxiD;q2EusNT^BnNK=C~;N8-8#fNlv*c+BC_6b6QM+p2=HS& zWI;qxX7qp7hd<`eqX5O^SN}uuw^VZfAeD95(lSn*k+9*ZcTv2mHZWBTgD{4Q%r0Ra zwKhLs5<#Y1*Oh_{S!O5d4HOcg?^T)#KSbJOW6e#>m9go^WRj5CQasLMl_jTNnoDvq z=)Dugi618x=Y%6G>|1%B-b9In*T&Gh}|-tuR3_$X3DaqG>((r&6SPy+c@TD3$ETt!Kwx<0k~l?t zUM|i7XBFhTntF7xhNy39A5P(baMS9B#M#7gTpW*t;0@2j2V7~)8uI#Ea8FJ2EyRw|Lvbbq<#zH`5y$a z%ITBAalx$PC>u)HP7}|?rdVcd$kfMlTGfSTbECxKkohr7JQoj|4ewMxa+}766z;x< z$LjG~TUisaENpr&*zVz0;r*&S);N-VU&Ufi>jR){l6`bMN8m$d^5JsIn0y@`Po7tJD>3ls{n3JM;ayeT1i(L@-4jaIP`7JnpAxM#NT@#T!yo#E6Fz^4erzAU%A|(UGou`W&_C-3MEbWNzWhNDYkhy4vOS2iGGTxk8ff;OI)yWF zAzMaeY{X@Iq1e4NjPKXP39b;i{<@E&!l;TF*$mkx5-}MjC4Cr)LN>O9SthbI+Lml3 zYq3r+zbeQ3Mkyk>%fe<1Rg-VnFO{iYfaYcE6e>Vlk9#v1jx_ZF6Sy; znH56=nOD2Glm{f?~8I+rl-;pCX@X{mY7o%#(bhR1nzu^ z^0?klJZN>VZjbWKVK5-CL-Z;(a|pS0VIpU0C0c)Jllj0L*j5f|gK*=El@h4XsVI++ znh4`BineAz6A<)oLG1iV5Ya5cIYV}hje>W|-+W5DvnoF)`;`Zq>a;{~?}c?~8d3MhkCEu44?=K=$D2z#PCHy_lG(iaW<}zqN>k+4k|b#^ zyttWd+H=1~EBoot4L-kI+{Jmq_;(Cu+O}95ga97hYf@*_O^X$|=2daDuF93~VLVgs zxOvI-Y@s-5daUm8*;%hAv{C_ug_4ocvx0e95tmJ#P1|bGNf)kY0cSVC$$SnOHXIm2 zQ3F#&q)q&!jKX=gPY2_nl~%85RNg*m=i2q(dlb27Sx+hPgt|M z*F*>Q+!Sh2(C#y&#Tu4jx&Oec{G1yIGf=+h;4NKC^>}lYjEu-_h<&$xj^cZ~2PN9T z`0jRLYwBy($KSJ6CmH;HTnFuw&M`YQ_ZuN4Y*MolQQ z)cuQkD43pcD@y7jl0Q-J;u|zol1}yX;!3XFjgkp?PWVMCRd!YSIR!1f2ln9Tag!r>U=F@Q@225 z_9`@Tvq?9feeUaeHk%4(5#J&(=mYoV@?GuaFA)w-O^ROLFH>IpZPp zAGSq3xf9d)YgWUQ;>?Y0e$4lS;otL{ew=Wy@$P{)H7a%<;Ozjo0&AZ_#Iv7hp*J=}!@Idujn zm$1SYR@Uj6*Tg#H(e;Av17BGu-&gP{mA?4SiSAB)l>%zqNIu^S<8xYVaJ{KpIlwES zmN#>Xxz76wkc zYv=ekHhMH1!(d3}jCudi*F&%zBJ*1iTK@>*Uw{Nq1)r)+q6)T1GEqs-To!^RMH^an zx|gFl^$W9Fm~Pz2CMK-76zVFU#-yWT^)R;Ll4vHBS&NB@rWx!Ozi}$-3Iu)d<#%+1 z6YCq(nO%Bqg8ph{Lf`xCaa-|Kt*c93wTn?t5xTXyJ7tGX@;Beuo13C6T8)Y6NYu=D ztlrq&pWX_p6`agnw;;}}FI;D={R)5nq0ze)-ds=~sSbz}+2gd7)%^XQlFfPmG~$Vf zd~lgsvFGc(+-dVbWNCsX^VKDPV9uJUxhDXGf$GmyRhsFTet#A8#4UnMsus$(?{w4i z^t$3tD=TyqIk`X@$Cy!@g7YRwKgm6_CX0r)KWwb2Jkm}QS5(x854c|2&_+=Vh}PZk zL|2DtrkLjw6I>mRyuz-87{SoZ7aXaN!yZb6UVgbfq~pam7I^NHR=!u-bF!5yi0r6O zijZC6jdglZT($@w5b-_KJS!E9T+8=k91iM^{@J_P4njcYEP_Z@B>yZAo7nMSVDW9E z_x_|b1k>|$ZCRgZ`O*mHo6tL-wBc`RW>}Gy*F115FD9c7yjG803Vrh&Za&(&1XgiCs2>xpg^Oqcczy9fe zV4459f5`s&{Ga^CzpovzZ9z&G@)U!Mgr4QQi^cv$eCelQszf%Vp`I0{B;gyxxt5D; zh!W03CbC|+Xb6tCo1~pPrDU1EOEaP8uYZ7XT2#--yvG|)6xv`VrCZC2;}+#Bm=*&n znyBLYV#Eyz3d%XFRe_QStqV-+2#B~>%gK}DUz;!UYPaIOPw@QeHn4IQC|KF9zO-E% z7d5nRIo*;I0n@>j#{MOhHYSv>Bl*C1dm=v-H})A z-$*u)?pDi~F|dg|PSyIEjhUFg+)I+@a1G8&Y8Q~0#mn}7(tngoaugB9%(JU(d=a-g z`Xoarhoo;Z^YHvBreX!JlFd?uf+3Aq`Y5gFJkEf%G?=EXKAjx$21*EuUGg8MUv3F2 z@gqoV{oRoB-Zc=%I563u6vFid+1lvQ?~$ioQ*w}V-b|-IzT2}u1qu5}F)Z>Q><&fv z5%OTkOYC>vx!^z~K>fvJEC6P`aMtEj1ab9!P_Pgg%0JZqI-e31_G^h*%SB`ww{dt) zEpA`Mu?_;lqSx){P^%e>Ten^83GbfOY_cL@W5)kyKY_^o76j?v*ACbkl0ldQlBC4R zOXR>cF~IPyQPwuumb(}|C)5cJCPo~dM>sylT%}2si}Mr{s*o=u6O)J(w!%Z1N+j;Y zkzwMM?QDPLTiPaLWeq=3inDEEP6~37vU)~rBD1)Q21@^`&fMV$R}l`3v+ti3t16Q{ z#~ry{+dAY=!;s|XQyW%lUjqZLZsrc_)Lb{E#`4CdZ_k4S?U#vuZO-yN8%uHT!H&}I z26E&P8~sDNo6Vq@0dqJ$AA|S3X*Xdj7x;7!SbBMr=p!jJyW(wUMjp8Bhv-u)O>7ad zZqywUld!i(pMJW&(Kf)P+BSftoRW%fOZIQ4Xw>;GKIFS{fUhbZ+L8M`pKs=I~wjj^Aqc1j0T*a{_hD6eg- zQQ-@nHCkB(M1_U(7dxPG(ZJHny)XcOxP4pW;)qTT?v|by?OQ0uv z1TvFx@d=apB0GbTAnc>)HRuffrOKT~z)@UcCp_Hx8=N>eKB{-87+OFTL-_vpzOkom6A*Whm6^5vw8|n85iO`^(>8DP3~J7 z@~9yBDj)+uO<0|}o(09Nzu{j^+V9*mf zdUxsJLEY}U$e_=MZTt4Fp(Z*t(x--W-5pDMZ3hU;n`h1v;t(HMziv9;IkaT|T%u-N zQZ+5AI(zhmqjR{MWx~%azgtHPQsJp75Q($l6J{nFsq1;Jj(W4Ed8Q@{@}Xwtcdwy% zQr=bi28!=Yo*7c5(!MPCRp_8okxvX}r;mRarmP>PW5WIJ)kwwM(_t6L7!5}2hm$TW zCkwQXCl|Nn`-8KALi_C4^KC%_{#xI1H3QvfFRMKC?{jTSYS`%bc6u*sy>DB72cMYf zbIWb#mG0cTXS7zq*E{}AaH0SUKec6>$d0A0H(2zp-ZYlhiU9RT1y;H`uw^L*DQvZ9 z!RcfT+}g{f(6?&UKccT$!Wr4gDxjJEa_*Z0aASrFGIA*2Vi-kw;fH*%HZN{9;LBxAi=1_BS~ZuFW>4H3{7^$`&@=#-xo?nT@mT}YVTmOjbA!r-L!lovx{|&puXIXOmY-~=aT~H`yIjbo|7cjk5lAHus)&} zobAo`*EMV793exV3puPfsDGxvYtTxn*@PzaCMnRF)J2S*FI!+UUr+LVnrizNads@v zS7T%vWC+x%$wW3?soW^sRI2~&!fm4o)25qHXHF@_lMG~LB;p9~Z)rdje+%NvA6AGJ zK_5eFRT(HZ9#tIkgUQk$8j9!aL&cUrJ>jXusJPR%{HYimORR>01X4Z*G|c($lqTb0 zJg!mf#6B!E>;U;Cn}KCEf={2Fnb`-5IDxUN{oJePsrO!%-DYkDMG2_bn|ryoo$7V5 z>KmWDt_6GNFj2mL{%tGj^UkpKrCRyVnNj50Hj;SMgIFDd#f_6G=m3FaSu^|RA3!67 zBted^mlez6y2d$*vfjzx1*-8Dt9p>YbZhH%j}L3q+|TqUEjM`K3qC=qcOjo= z&EZ}sih;vKfFQa+av}wCvNfIBU7XOrSyC_6mWeYWzQ-0QSp#6V>$lcC-^)~P>uJlg zpDNU3mYzh@Y0orp7XGhh(WU4f>L2vk-rWlW;GvhE1cDZ2LB$Wcq0Rl z&IJyirj0R^XBlP)oU^~!M!x3}WTj`pSs?)3uc_Mgnp4*3x#bS^7;`?@GhXC%s*Z*q zIq|y*_FE0$4Mgd;Aa?#;5bW&2Y+gqK#i1UYWJ=+ElTt<*s)`hu9iv}sE@Xt~*<>hG zRbj>9t<8BTaZMUNdd3)I&2$le?{d`^ z76d?W;catywLha@o36VnR{9uO?q$vQr`G2LoSdxPBFtU-vfX8)WA%D!=Tk}j+5H9I z{RhE^IvZ;DmLBem%=l^Fn%jRu+p#@3LZNk4>|MIGe2#l!Cr{Dmia#*x>)tZBtv21T z&*uF3wO_acqNmxgsqzG9rbak;2RYw)A?Y7cX6z#7RxDscB>io)`036>Vg}m%_&i=D z@l%#PY0T8L5j|-PK&r94B!plXZ+THsaFGSNSjbM{N%uRJ+jexb5Eoa6H?rEUuE{wk zf9j(X1qe<~jM+vTcH$b3q81U2>nV9DZPY=9{9Kbs<9e?d#xCW^M)hY}DFWDf=Oz6p zrOMXmZ!UrJv&TePf_MdIPY`~@_OfOUFipZrg=}4{P-5`|KbFv7K>-)Xt{Lc|k@5t3 zV(P0bPk?%EUyW+58P7S}qgJ3mPlf!-k}9}Ixe{HyHyvfuiKlkWY9^b4euY4-*pu z9;O&eEBWgxY!Y{oqB3L*mWr{Z-QYXYGRclue2*Vu!^=;aV<^^y84h9Jx1PH?Elv+5 z?<*k=tB8btrYa()@wyT>m~Jp{Jw$YV8JBPL^LibhLqJG7m5=n}l-h{Myk-61Xmz?NhUX0<2JJ9`9>en)yl)=(t`4f) zAB8>Tds7tNhkMYLO)bKP+oprMRy>GsycCEKWjn7OSxq~lmZv?H8>3u#`?2QI(Yv9j zg<(1!R5Ly1laO57f%5}Qe5=<%tUP~C*8*nZeAZ7lG5^)LAXEBKceO0mhdkDfGxxu5AW0`MA1}PT#_?TJ=h480fS4^D^MpYF4~C z|5YRZ{U^w=--6KkcR|4R*}OR^RdI2~M^DRgNgS}d=jzVP5*Lf39qHvKCNZ#HC}FQW zZyJ$aVlWfHX;W=Oek+|TAMb+@2C`=Soaa=RWTSc%ZBcn266G2yo?Fh)H58YS` z+K(Y_C2*ZJ)bUGcMUcl$_Z0hK7`yQu$5{8KI$hLWr2w?$?8#}$8P-Xo1I-Ur?<)_e z&0d}jcPnqVYNs>-bk;1QE89tj*2TjsuU1`oJu~|0XT*uV+6yy&_0Jkmv(=`)%iLz7QL2OGu4OWVE(4|X>eha%@O$vr7JRw?W&=l3S;`|0|`Wh9>x%nNu_26hZ{k%7yl}^u( z?PxM$0j$%@@4^HLgnq~@nFs;je2IjwWCoWD6LqCvQ32Spr9o1xa-%2|DO3Ulh3Sy1 z>Mv(NiJPp5f<}g8V95Z0GGkOgWeEl(M`K;-@=)uVb*;gxHyM?fMwFWljgZe6Rn@(^ z3OL;YB6Q}}sL=91is9FX5ar*3aQH_M{}Kq=Fumx0TgCQ}&Bc=9>y!q5UPIy!%RcEN zj7RajSVM7Ma`YzGT}aOa5NoYsPsfi{7jTjb7q9F&V! zw)vRed#OPY_>nt{|Wyw3cXOuPc3&z&Y-ySBzL^M zcLkM4&dQ+WqXBVwxQIeoXn)|6v`82gKYpaRT>qt2U);xs6_c zl<9PqjMgScR3m(bS<{1P>8`#f>IEeT=OH{Y;Vx_MBF@xIgrc|Ye9ai&bIiD@aNSDh)9E}t&9wbOFC+;>iVgNynp@ZidRTzNIO4$8GcGSnw`PG*+ z!XM$!b8q_$c8nw=N)VJUmo@2t<*Uq~zjS>1YTn(b4hA}F)8qbs35h{eehY&12SMys zx;kS^=xin;dbkJT99&S42`j^v%0Md*;1R7dxhR++##T~=-K#Xy9L-X8tktt5^E3-j zrNLN7tD!X+a-H9crF2qUr3r`BEzNVWeq{xXVyBZhCHYpu>^<>Os zA$EoMBf^4GlXFF}*&EzJ#^phFEF-P=yY5+2YJV@KujfkrSfriX@^}ER_VZ8UwbO5> zUN85|bn2>e!*g0rx7M~_3aS-=$q$&TSUw$>`8cjFJQ5davxWG``2AJqXG%!92x;IU zXK|e@Lc2d#pC&W0vg@MD&D3;7%KGErt7HC!Zph*z-+det>ub`+9p)WQSqY#{T`F^x$XGLSI#0PY@){iAk=-@g)cYFN38r`%^_8wU8X(hv6CtMzu7iJ06Rnj9 z0)or*TM={GG%(M{)8Qy|Fqmu4#yc*J469+*L>cV%%%lPfm3IUwT?oQ zF9Gy~f%~R+jzzd$;wfA~85!c=sK-PHQ;=r&Lerk`Y z{cSViPcaaP>Tf~h{$b15ayG=raYb7ej@`Z=BYxDX-#oq*`Qp-i|0w^Y;Z5RshU)r z>_vrYeI8Hf8EH7gBYA1~$<%CY5_}}2A#%pcmGpVhZ`p}Pm<_Tvl#R@DLv*R8ZcXgI z6WEANe7YD_F??xg>b(Qz(2}?Y>h4Nf&yBjo89#8YaH@~!JOKSNv%h#b@sd_)0o&)p zvEC&fIRU(z)87^na$3&LIUrK1pK4sMIJV6+)JA|Xd}H1+_sWU<>VQ!UxzGtOT^Qjt zS&;1$Uq_qpJ$cQqI;=nmy894mw~}Q?n)erozdMZxEe=?JbXWbOpoEu!1Gj+%C+Ua5 z_NTbpqBF9Ics61+upe+Jel{hDp^;MQgO#zdfQl&clQtfw(uB5x5Agmn{LnK%EYVdgh@*OK zSJrH0D-Z2H*I5pdkFZ(TiZ2&Athkx(SAIT1FRkCo&b8_mNQ4+qfTE=0T$)`ZD0^8u zz&fA3kb!5{j_SztvNGNJ0cbT2hwLN0bht@@Ibn&iSKM?Ku3K$3Ma&52Yl--q$@i20xaof(G3Wr?d+uET>E8P`rW@mQ9~K{JfpT&PUY0eaDC;=AN1=C3{Acy*yw+ z-f>p_b$5JjQp=MHbd^fqYEA-gywrwPer)#<%@oif0rl+5{Q~)!S$88)QK5eLfTY=@ z=NWk%`_@ef7LJo5>J6p7AVqL1KfTE>VURWB=jPog4Mz2~JcaijA60-Iq7c2k!C;#yWsjP9BsH$7CTA3Ss zD6_*`F)(qP#dSdAs7$9z7-0rTc8rRSF$PB0L+kNm6NRg&D#@5Kv^kq9I|vgQ-<+6k@v61OSJ(XS;ZJ1vJwEormy0}#oj}v)cweU zY07l-ECiG~H`JyZ-2}N0D^jMLU=6_4pZ!{)AXi`B-8bOizV^GDk`JW`eS5c>Prr1K z^}y)%1k|7PUK+0@CO6rRNy#)YyxYVu4{M7*t?xV&O0hU7YnreOmJ5+&fgYpC;~l&l zwz&@Np~mi_omQ>~yeKPYISj1(1Sn7Fai4mP?tm;q(%4TCZBozLox=p@06b(&U^0Pc2lWe9Ro z?9Owz#Imv6WK`I!qFHy1cMq_49!ourOa<(br5}FF*ROyrLw||zP!U;;3+?W0b!~kE z_54U?h%jMQ*wWy{!WatbvEpmfrTy4-3tR{@3W9VJ2P3FBM}7?)y6;iVj_t=5t-bgO z(jbi0KjEC;hJTqWEFk|i+VZ~yvGWH(ETpTtSH)wn50sVs-&^%rQtHXcvJ~DBmQZ?3DOpS|y)-O5_BsO;hU{zxSrJMXZ0yWvw`B$Xf5t z+g@S`m+s?UVBBrX; z6o>YhPbu2w^Lc?#DNRc~6LeI79}5$#eq*)}%(@&~Yjy2f*fQ$3Qc;L~7c#4*t)qFzO!PCYuyk$*jg0YShKlcWyz#E!{C(WFEitA~TStdaqhdkspzl>#4vDn9 z$wdv?8t_G2ko8#9XiT0S`J!yq^%##kl?rxz_1*J+t8dBctneSSUH+ccdA zcri7n9|2G1ohHA6IvPIY4JeeCUiC2ASpo>%^@Ks?rXK0io#lQMn;)g_!S$;i4uJ=8 zclvYY%ME&`C?>$i|9A)u95$dl^(>e^8AB$5d4pmd$5$P}B|~ZJTs6W|%vkt3KQj79 zED`ROM?=$bEP}JgeuB38xM>4x250vq6zngPFeK}1q;cs=ESZ%I`tIj)mWPDtY+|0H z!VFn|I%xj)=|c0jAhiAw#J^lfH~mo=8TREeCQJfjcT}^@h-Rlz+^UGCqKgR&NIt$q zEdHW3{#_yqGg|00Gan9BB(B8F5-X8-Iyf%E)a0E65AnEB#7R}-Pu@b| z9Z4X}Bj9v`OJ)!gfN(XivN;p@taR($c;QnS-P`(EPa}oHXLe>yRMgutCcOMji^JLZ z)YA3+YoxZ?#0`+t%T=!J^rY8cmNPpZ+{fropP+IT<4l_hNU3C!a#3h^e&!_MZ2r}d z$xF9-SGp!h-L%qRJ~5FrZBU$G1%t@EzyK(ZS>%cs;Qc=@aO}-;-YIecV}&5%eMxNRhWg)s>#BV`3{6P@Q z4MTbtE91y*6pA@Au7sFehUeB}NLQ6aHOLBEvYRfRMlw;~p-FKRFk}#aUdMipzj^JZ;zu!} zKFAyEn*Lx31f#w%FP`|_ta=dLro0_F+ckPW))vg1?Y|T56DS)~0P@HAKP7Cm{q38t zv5#!hR=kC?du83yQkZUbx$W&cTzPqE0&nB`tyANH*=CjPmk?mgA5wHsaaVmg#y%Rf zGp+zjiOdN&;2=sOxP z`>dq?qZ9j?Gv-sG4?^&zDm4&-x>KUK30s}JNEvpClHAB?&fRsxq!H~Wt3Imr`3t6A70LVABRw2>tM z-2?=*bOH+7o_t)lh~`6}w2R<>6F{-k%|Y>ItQ>Q2Q7&D0%UX*$)P#+%qo+g$pp zabV9W2mXK=_$P#|L#6>j0po62Nk^ex1k)fieyq4^9HWJPXI-j^kIs zHUQ`W$wD@OVFwO>VAcmV3{0V98=f=}vfB3b0@F$9?^}c+9r7F*^V;Ntsm@`&T)MWp zzBz*$%uyId&R9CQU0gsCIjT8z#kWCZv4kt4K&9b-t^EIp;n%OflMZ%~k_>A-PZ;{D1Vz3S zDv*(gyV`*+`!lMMl3t^$hC`$>Qy}u9s#3Hx1=E(`mM|`z(#ZTIr%+bwRZ1fouk6c z_Kn5fziMb``xk0E3qHRJVMB@qQZ^%;n3~un+}4XcP~Oh+VhFXK zRi3R*z1B4m0D5iL9)nET%cZRzsA~;qheQQ3(^EhXtqM2(6`VJ9ehcFH9|W;6e9tU8 zi<_;8#hO7YxGds&|6G)dBHren(>WLIC|k z>dyMt&Cy#!C#Sb|at&(VZPlT7Hf}vQOdpuv4%)T-DG}0ytaT9h!BcN!qed#|i8wN< zwRU$?F!rMSCSm!fM0tDj!cAz=8so0Jz-vo3mxD|(6K_S0GD(gut{h6%+`*0GCV>)O zi*3_RTqC0A_-b-3mK$CCLUVcnpTc*-v@xmgXpmQMy2gn0=xK4zyV|CC2()6X&ov)U zncKx>_d`kq6fVQADta_pzpBYK*oxRlKmICW=KEBEN}s-FBGIpdvETeYd@S$Rp!?4R z;Gtq*Z5#|%sVOk~ZXMkS%(rmdSl&IBOB!ajF4)yaw)q`UscfL5r}=O}vD^kdwzt!MZXi<6j2!4bQfl9xm`hS%l6mL7nF3hIkP5EQHK$eD7yS zV9RBo?eJv1SMgEc_z+KXzm&#)6;Z*sS@C(U5AnhD^7K3JLl*+6tjiDiX&-Jrp;%L- zyW}mmwU-C$yoKCVbu~vLDNSO2+K)j+QvFi7_vP=e%So&Nsa$?{bLYYR*A_5vCIRy% z^JgQU^DOGL06?d`-9uJxe|)X&CzzYV$JJc0i_f&c#}@c#j~3k;e7 literal 0 HcmV?d00001 diff --git a/test/samples/asf/max-numberOfObjectHeaders.wma b/test/samples/asf/max-numberOfObjectHeaders.wma new file mode 100644 index 0000000000000000000000000000000000000000..760da1dcb06deb3be5983e0ed7f3e6106b7218b5 GIT binary patch literal 35742 zcmZsi3p`W*|HrqP%TSw{ONi01z`6Uz zED-Q(J78=;Q10OKduN{ZaNVB(G;$)X0Q`UL{GZ=h@&B44YJM6j%LH=#>to|dcBWrL znG?UhSBUek9U#UVkum=H0;~c7ub3Jx$^Jag_^97e0}wCS>q(h+ zy=_Qz>fwqnXZ-gn#*qIy3?Rf9urXeL{WG0_AOKO5akY#W00aZD|2piieLw&R0AdWW zmLH;zp6KPuFJN2~6K?&=uVVlJ?f*Cb^RGYvKE`$ayp}7BYxD(p1CWfXcKLO+PK>cO z;P$Vv2V;C5pz`aRKmaG8(*L{H<+1-d$^U!%_uT^m!vO$@!=azMa{$r6pXX*=7USmq zx{sidMy*}|Kx7&KfC2%Kc}F%jW{fz>0?USlJ6>YL%5!YcubUoKNSP#EDxs#Ghlb-} zhvewSfG|wRo~rA6qq9hWWil)hd5$7apkUB^V;$OKdFB*^yi46Pph3gzgBr z^@zTwBT6gOXf@1eF|shyQC-k`umm~U)O5~MvoW+mVN7r>YyI6MDod{8x`+^~_3D0k zOC4wDuUh^hT`?Bu(UoX4d06 z3f~i%)KaEl8`kQpyAg4rS2!xR=E=Gt*qn8Vqz2jV8>9tfPKcScvLKb{Uqn+Qfx|SM zvBZ`7m$K7Zk|c92oR&mXkLZA6!ZYVRy9cWY_`5Z zXjYoPrtbjR$@``$x~nBJR4L(a-^)uMc-R()D!NyCm3S@HkBt`&zK-lu{!v!4@3!V4 zL@0%JR-I2GF7gKPh}5!X?ZfPP!j@cL@hd@94!8?kBZEXeI{ivMHEoTk3#tzVrM#OI z>FHBq>IulQRuUywX81VYxS|Q8U3QB)I%{3B>HX^YD4;G#d)*|Fq*%Z&? zk2Qqt?x+s1t5ejRdiMm(_-&A8s!RV+7LFGiy%}_qGMn#k z%SkaoCj1(v*AEc3n}-R_Uy7H%7*jrS8;oczdjv* zZ&E7gA_#~*#NlRhMkLac$8%C?7VdJyOkl{8z9$R<=0LX=6g|w+cfV=&EZ6>TcutcYTk09sm!tY_C?y3!ER+{hFb_7%^mhCV1?}wYzO98F%CJ7W7*x zNc{tXRF6OM$7Y;qHV#I$aWt3TEMn$Gr z8hR-<-Iu-O-yKz)>$$%qi#wU((Moc{Wr_%=X$2VEfuaPJ^Yl}_)#e|mlf1vo*6EFA zM#T)r7Pza2r-rcbHZ4#jZWm4fLN?PZ5BpcpM>I&c64VnorHuNFXN=`@{5J0&>3Rd`}&l_?QGwPp!<^j99^G6+fw@vDea@SY64`|a-oXks=JkTnR2_C)`Nx; z-@bo4CMA3?*CQTytXUH_UO4>F+ue5eWxr#Rf+Tnty%PGzr>Z{IND3w&{LPu}!RA_T zbtA;;d-jJL!I~b+3L2BKI;N!v#paZBXPwJ%u45MV7kJo-JG>a9;DOTH_2kl)n1L~^ zD77GW+4SqjAQn4RZ8z&FP~DAuQ`Aw~FK)k z@^K5b$F-Cn0X(!*b@G9{C>s{2_JUH@o0+3AQ2QEiS5`!CWu|fg%*ngE{a7d-sZNqC zR)C5Hv_wEVJ#eg-J2V8oZ-zK<5LYG8-Rs%8K0~u%K6&X&lF7`oJ>8@ShIOX^xo7uGF2=Q|51B zcbNKYJT3o*=?um3Hx@wV-#}#igN4}Cz9xfei(ooz19^Tn%!k!UIlnArn$uLCcsuY7r>qbhugM zEdJ8Nmmb#ChtIGevZmeh?+?ggf55r6{9l^QV1nE3t6Aual*%4+ucWyf#XQ!3Lp?}V z|E72nRkTtHReD&e&f2nFMc8w#Txf~NT4fI!&?3Fv*eUktB6zHYyK3}37u?bihVAXY z6PZtI>+ywcN~nupYmzL zaeQ1WEhw(qe0#fv7hR1rREVyDqbwtN5qVir&>vGO15*McHcjy{g_8ISR-!2oj+Y&fY(s}b~exJ4n2qT)Gt zQ;4~da|1Wf5!uE1^qK=H&}<--!m{-0alIT~@+sgq2LBlVe}(kFTt@9bScq+BmzbO! zVB}S{(SSOOA|@YCBbNbhiamfxq*`kGaJS%DvXhLKXTkF1SgM6Z z?6WeIc7(J94%uW#ra|!Lq!+oD!>i-5xjP${oDJy0;w$)yJ$19}ukB+&p~sRW%*%FH zhPytq!WP4iO22aNlsY2J6}(d%+5x@K)bo%!7;^m{yxMN1sgmW-Tz-^+<$gAmBj!mF zaMJ!*0)e{gE=D8vCE2>Tt!=;79I8CSH|?hj6j5&78hJ?FwGZL4tDJ<`d2t^vj}!va zch+CSUB`8u?TvMH_yopoCKMn9#!Qwa<@2tX-S^A3zgVX_Px79=C16%6DYijjGcuLF z&>tf+K4P(GYgBEo>ww`rjIzpI4VLPV+#%YY!?d->0H%-bd_HkvH&6G8Ps=}@HE&MX z<4EI^jP~KbKoMP?6nM%^q3hM?ldnwxVcm6CQ8h<~DO|3FD{&%tZ1UU;%cjPux}wL! zs>q|KPLrTa^zC-_4~2xw1d}e&@DWx^H^W9ziZ! z+B~vP z&8kHleh8vY+vQe)f*&@H9it?s2feb_gn98{nuPn*O7Y@`5 z%XVo$SndOk?TMmL*#4E)_WYZ#@kW_C!J}sOXRZ35qHFEhnUnNZAH)x#Gh+FYoR>Dr z@M85|N?VO(h!$su%M%-aqy@X-(fxKUkJ1Fg$hWTX;c;RA{f=SH!9^>Ptl;p;-VUL9`-3_9*$7ll~| zu4xXCRI?qF$8eHxhopuHo)b)KnJQ_w*d=IxVyB{!21uv%RoS}}RFeGk2p3@W-i*PU zx+3nn|G)zLnPUG1#P0t(6LwbS6u96swo_*#!?6tCalDg2LB$kkKgFSQXogrcw3QKU z$kEtx9^p_8U~x1dUw;X2{E>urJyZY-JNv@;y_`0`PvOI7RwfELQ7_664JP=L89AN2 zRaMK$k8?e`s)4)j(iN=8OZB#UcGKwHzVa;Op3=Og^oH$TRdlIP!O~~wQ6S>HR{EZr zZU2v;Z@e2^@9H^rcj7 zzWhe*7JUJy#k}6-MmI@VY`MrS;-#Wwvop0y`jjBm->{F3{qH|YwX-*rpO=ex`K_ic;V+gPv+#CEUg>2lb5Sz^ZdJDtYeVq+D=yuv*3 z!kUPB{RN*b?pUL*)CEiBl%zUp?DwqnIFA*>)@diJ{z4y*))95(H*~{#SIY&iIju7Q zB8#h~&&|5kkwMUpguqDN6tY864~p|7 zgoOv8g{tW(?Np>Oa@zLbss}&9{}WIA2Zo;`Amld?LO-h(pt1i7HA)}r2rl_DotD!8wjhWJw6{zLgRnIJ@#K*L1yOIE^T9k9BY7-&7v$Iu zPUedMMiyRa!UJ;=4Z&y6<%loc0YT8Ydzd}*z3qP6#WEAfn1Q7!sB)?JlB47d0Wqn< z9}Npz%Pf@6RLFhzBVD>Puhy zoU2NP2uJLKz7gVXelZ0Vhq7&zqFinSx6!v~Ta^bAUms-kZLE)uvKk#|Y$lMGMA%%= zxhTVz5awT+>8wFu7ay_LgQ6c*Yb{qi`^v1h~3vLg~nJ|VrB%!Fye(BS60z4uyKCjt?Cn|-X%W5 zcTl(oA7u4RC2eiJ6cPuyPqeZYj;?l(5z?2gKnkI}3AZWgS@~Z5VbdC?o-!l<{DImC zI~DAL z!Dr7$ibCsRUYvl47JW())$=)Aq1-WX@##!z*@>2*1r^dN8CPa9Cy_8G|FX}gYrb8! zg&Gg{bHy$@td1E~seh-1&1YPY9UE;ZaCKbP?qTj*&t!xKS?RmV_ZA2rO!fqp6e8GT zkxdJzBefA61D?j0C_>5!&-jBetlx@^YQuW2Fp^P^cD_Dw0UTiHRQ~!$8(&5kYjB%_ zgxYXoSZO3o)$}k)zC~H^a$2)0m<0R4l~0UXR-Z z2>8<++x!uggH5}4!~L?3lN_Tw;h2}YhNigRyGJ%pv*0<--cXSryV&R!`lyp*A7%Hn z@yzm`*NEi$!oV$ZiHw&d#;yoxku}8QG2Up9kxSim+Jgk!Lo;Rf``3!$AuosS&bXb* zF50#CiNAIJK<+(8M=AnSe0^k}qiABONaJ~US$s^X=;i}rQr0F1%RAVoM0@n^aLA<| z&irQKYqk7lD21;x9uNqpHG2zxx>eQ04h#%5ltubbLN?!N5ggdn?lc;Wgfh{j z-_*FNE?>!uZH8)32h00;5Yq3}p|i}cAXc>`XcKH60X+e(PV0479SRU88uE``t}loW zNIcf7dH<#^pLm5S3x`?j^+!7Of6snh=O|x-0ko_7_P&|m$v#W{@CQQJ9||oR`lqDh zZ&(0-1`dD45JCTBA#!7%aa(*$jsu8R0DdSMK8uS?Qaq1_0E&&p*+k_!awy0g6AXd~ zOI@Xz)A$vPxl90gWF!-tzQxJo1rOwLYQU2P(V`6dj4IY)Bc@!W~M zCc-hE>$Zls^qZsmyd2w8FyGqN@;h8s9`!8c-AMmQvf9Nk>mj$U2HV%C*DFmSaqsN% zSw2;_tyr^7HN;9?sx(S#Jm?E_v9F5D*gE7XxjZi09q8H=@|=G}ZbF0S-s@NHwxvSc zH#YhA>Wgo{)k2%f%f4y#jvZ-n%Wpm`me2Ce$mQl@JVh3Aved!@x7=2db%9-VNFja7 zN?%Je<3eO##I%ORDdiy5Y_bvF^QRrx=>`%CJbQRm;JCErb27m*1PXM3_ zo)7?bgV5fc7tvt~jLPnR*{fFUGc5m)`(l_N%-CTIeF|T!&ka>oBSda|jLh`**l7J~?rqtMAwg|} z?Z-wj=BIY}UJk7!tV$c~r#oH$L5=6`6I*%eqiSXulqJY;>exDt^N%wHr-!rTn~Tc9 zoamu}5c29U2~xETAX!4o6HJ~dyv{@(#mr}HmnPhl)#H@KR(qj1;F87L?M}8=@3>kf zIKQtAYl#@}{?I556r7r$b->W8mi&$l zRL>#0@2Qd^#==YgRQl)^)9M)VH!Q%zzk#UzUuObYK{Bbqm|%d%Sb1_m6Z0#sQx=Y7 z7>tB(BU>1<8R{JWX!I;cr$t*z5J@o4~JGE{nkR8=7xu}{{ zKWe;`$~Tj^vT|o%dHA7cNZ<2_6`up*qQE6+ht`7}FRSlQY<_g-slgyTn>l=k*F0Crv5vwO@pleHSVD*qy|<9iBi?=m$Dr%KOUN3Al7nT1f{ z4Bb$pJ{JKT6K*)ZsA5hNr%2a};FPr}4$J41?jB%GG@R2imah}oU3-)pwPD=dwII4n zQ$E^L${!ZcLtz|OWAvK#mVAh^~+ zc?LNzVB!3?RG(Q!M(9OSC5kPzc}y;>A{)>_uU@e0w4$FUHS+?W3yVi_z~GN`x+x$x zBpenQi9P%bE)d!2>TJl3%;7x#RCiU>v8(_&+Iv@9UqOwXwwxuZ{|59hCpkTE!mGr> zV=n>^KYt(<0$RD0qE~yV=-`j{%SGt%-I9Y+t@rV3*)qp~`;L=B=YOz98Wk-lZfR+y zSZwXvn3R24xZyk3eVrD)6m9!(Rv~BMZ`);D_v(iE>7$=n_+@zuBWHsy;|kIxHBI# z^<&Jpx^G9cM`;+PS^arrD5*Aq&H@!{KX&?5eqb3QJYHiWoMiP4^F71dKiAtdu)sCY zEDLukNH~2NuohFBB~n9JVw#KS00|}{MXc8%LbRD^YE;G}?yi(!QdCM{;f4OJfT2K8 z5Y6qF-=MeGddAHwP+bmaWf8KXH^c$iymwW*64k<7w~4{*6TA4TQT zk;%sq<_tT*Zo+2Wgbtqio-9&QY+?yN5A79I<;P=WKoo<~@Z@C9$Ri}flnV4NPlf0b zf?C1b`>}y?6Z(|myrnex%!*utkoih|)v}q}D(g7ig=Hm)9RACb_WRGp>$N(BxyCB14b*H}PRHC}HVy1kyd09W-6V5l&i;rFVdc)s znPdiKs5BR`HaqwNJKQYeaxBc{(Cy^SVV|P#>$2IlGqhM9f^6&jCwhsD zA5~&wV{geh(-R-xy#4A^VRUrb(@72{Nen54ywt*>umeBFTHp znu-1eTN-OoNOCx9ElqiBU0W68GZ^9{Y$iV7kF@e?nhj6&2YW<(VeV~yJI6FcXW`|y z)>thv9vbkfrwmv{hG(_Lxq2xyfAP&qPedMJ;YN4}E@>}NPHRb*y-lvl^vLku7iB)PDX?`^z@uDU>Xy;-9&b6pi>nI?y3C} zA|;=p>Eo0=rR9oO*4@Kf3vBxh5BjRU9dnQ&m-IdA36Z)y6W+hwMo~YPXnpVp+c8aJ z)*FG8o+)b);-K!5Ytx99vUPWAAcBbABW_wnaoKgG?t&wgC% zk0=?@l_Z2|i;3(;jEvJ2i^8$&FM)!{qUxa7_Bsn2Q#&DCKFwq;FLG0wBDn4eAsfKsekZFgq@Sy;_Lgh(#-X+a zF{Up0ZKE_>gVEK&%h$85m)UWuzSA13`3AKSq^sl8pE+EUfw4$$WYd&Vc7cc)HKq`G zv3#{@mS{5KKfyDasr2Y?2>kaD2>%U)`d>i&y=29;iF}b;fOPuwRt>C8K7mL&n-dvl zp~G%s`7jF4Wlr2fm7v18@!TeIKX}UL3dAqto7i+X;7R&CXb7r9Oa}sif$yn+IM~IL zU+BDrV2rkT0XYEF^=Kn36pr2|IY`7 zzEhEqI>#d+4bh*|Cs)g8ghN`_=jG$CCoc5i;be@`6 zj0UZ^C;gGE%U0OQpXVZ<=TVE+p)+%xE)Z>v?XG;sb=$>@Tqm2W*(&HT<WNodYH*MZ}f5xQO23ynpa;M2V-vk|tlabX^ zZW~Zu&1*6Epk~!g_cnXk%IjaT_*#Ni(KJ!xIiy@5gv*W6OU>~wLM9GtP3*;V=cAYmLIHQSmsO|gJ&FpLvh0DuOCS1U$vEVFO7gyre} zrs5|Kzqh~g4=h7x^E3b8{yG0w?c#q?fvh$=Ju%ci^pq2eZr?OS9qPRnj1z}(n8Pr* zlbaJ)h%u`OaS&mj|#ueVi^~UmX~jYI61y08H2EZNYq`6JPI;T zX7Q3tycwo(WtZU@>JH&`` z-@?~@Y1Y=AN=>^?zn7DH56eT3kM^WCVikasif>!rna#O@U%d@K!=(;pY7~JLtx(p= zhPaB>8FohAX!G9QO3cFqTi34ame5ZPj12YbfwI}i*BPeWA*M!mF|V%;{>vrxC8z9F z=PyDYF2iBr%^8{!79Y1IzL@!Wdx zZ?bd(@+HoTTmNWmf5OUB-#qr#d1rEz!HLE!u{X?W~$KW=3Lbymb!c&UX^w#2R^Lyd=0gEi1eK*nuX zEJAkCC-Tq0GzWAz#pfkRe;In$MbS@(76z{@kqo$u6679au9hLK}aWO6Zhku)wH5XO{ygm|637>fcWff({sBJMeW zD2fV)4f@nL6Vo8Lyfn%lCWxK+!VJ4Pacif18k(HuSCXiYv9nX!&9QsI!)6-zl^*I* z?4kV5q-=Fk6ZLhoJgQ<+K`VF7bCPYhL7H1(Owi$t_>3D zDA%)LFY@YD(R|9{-IXs3)|=u@GM_eQ)a^4uNN`PD((gD(pTeW@0;Q-36x zY^K>-&U=_0Y4~EwWzt4f&J#?SxZ!Xr(5Ri^6z+N8js^EH{6wm!AM^?c>de$1y}OiM zt&QXLgWk!m*kq_Bc1)Ei{hIy34S18q0Dkk}V?m6S(B2wk#2os;kLYp65=Js}syovc zgTjqNlU*EH z@&0a~#VAiDm%Q=*bK?*83TnYG3_Y5Zd=hkHvS2><7Vlfi-()PFp}?IpZD539a_14F zmf}aYcxJFE>f-Cj znxU$MwN_00$5yJCjsg26wIO(;jXH-aFX~LeM+bCSV3B$p?|n?2hH_EbjXdohpMEC? zhUy_nC1hlWq3R9MW@Hst@6;goT>DH8@M5V+SBJK{g;f1$zeOfrePPxo$vrc4fTYBKYEr%Tn_=2wtIyQF|Zy_UA z?@eodTx05UbzJFVqU*=f^}>h}a=5_|L7SdK8xQ?4=$f7QCZm^fRc(QQuOuW}RAWcBbmP#b#vre++UZpinp@g$&5%kw0My3u4a{^yYKa`3XMX!@D655Y>MbPzA{Q=&Lz>y>O zmiA5c?y!jnWx-mK3WSvQ!@J*OS6f8naN}d>=%+3zMs72%!qHQob`YhxlSi}b# zz7{P7R;TNcS|R(7&~}PwXkQ=EhxG7({{IWc%jSubw*y*Q913E zvtA+Zi*`b+c5E35L$-fI53nlUdi{s@Ko#$<=$1qkoK*Rayws;PN9|5A`Y~ELRXIf# z=V|iTZ7>x(e^RDjLMwZ>kVyNukw;d}aQ;C|ne#mEZ*%TWj&RM;m%S z&kS}GYl67w^V$i-BQiEJSTkb#lN72G<}~C)?E``wZn4Xfbwjhtx-j(2It;5u2)P~e zo#b?_JK-%YOYxf!Fb5Ilnmp@j_15cS*qvpgWhhZ)MzA@q*{>_Z5AHcrd9GK(dBul?SEnLpASFn!|&~{`~$#{b^pvi zj{Kbeg^JM6Lg#fLMpV}2<^bLL##jQz+Q+;ap|s}_G%MB zO&Br~hn0eAVC9Fb={>tmx-Mndyn>s!*`?U%c7&%n-gmzL;8T5KhkKHVy2s|Xniz73 zz0X$hI^JHdGgR|<+wQ@+gb0_q!zqg}c7UIF=XvKuzLhV_`%X9AzugGjFbXjkwxAvG z&8&ouBI*|tJbPdAgxkZdzSG=&s&*UH+V)1i*el+fqpH8y8!b>e>92T43Paa%O9~K` z7F{te*!MNm^en21(G4A6Hu2R~#Bivv?%aTuB)1<*R4y@a>Sr&`D|4Ytj>%b(x`K;9Fh*J8)H z%_G@g>Eh11#Jny@ZH~K6J4@P?CIE6uXymU6dRF>k>9=_&C`a^FXU`9dBK8^m92l(X znaQl?s`HBip=V#7Orplz z{d|qSl@X7ZBPp53v{0!3^a_H%N|4J-d#y`S`B;&helz5nM!u;UN-LTgp_|io;&pGvLgctkH+; z6RI#7yz~-XxzOXzu`GS%)rvo7g_+tT;@_VBo%9rr>mPGCa1iLJ}YG-!<{3R+hqin=Uu(TdRzno%tMBHYdV-R zg_v^y!E%gJ*z|}JfQf?y1v97s3jPMd{(mh5J8MuyvR+KAL?n{PdHyWT#8$@;^CVp0 zIw*}`G;;LrM{Tg^8vNQx3miq_DfB6dBKn+DAsO2Y0bQR{=sbKRi3QxjWA#JgkdQv+ zVTCyC(uX$8_;}Ek)aB)|G4vgoK{I+V`dF-3l_&gz?twz(P6+R2-`v6TfZ-|fl`~cb zOuNH1*FAA=M>Zl==t1&)Q)D$ew9iY*?(mPhuz4}W*Q()sjhP7WyY$_es3Rt9c4K>= zS=fKBm;eEdtfPEe^G9XEO^<6GSDD)~+VQUJxuO!SivPSa1h3uLeZf;*_Tj9=Ih|&c zvdfR(3SP$CZ1KOzTxM>i5wnfr)f;24SK3O25tbxBH|FcIbGk^~lko~j_wpl~qGR=c z=pVDtTaMl)r5JMPWANVXbqjpV#3G$f{b^oeBGuCC{<7OHYK(RtdW-UwhH~{3Lnf)+ zb3vhL%K7ofb;;sWo4gU9k$@c!QwK`_{>{@r>kvI+f-Bum?+p0Vv_gw!1hm%+c*!-3 z@^z=yztl6-5)GnlzDQvL4!K*Vq@JzdDF|TMFnJf_!5}Iq>`-yS%4w4JdZfowz~j%9 zQ?%2x4~?2Y9BVtKV%)1Xyqr1Jug-FzV*d2MZNWdk1AjI`{!3l)4?wV}9g>g_a{}jR z>r0SOAXH(DwsjJdAp$OiWQX8!#)W9CHGAxJb8{(4Z5%Et2FZ=m!Z#r!7@A&~Q!Wu= zm~#b!Wg(IC1|L%vbDhrc;|gk|eA3PcTfSm+ciG+Qe+L}em zbI)#sn9bi;JDJKAs@Arf&H6eShjcVco(WRQBB1oPH#0K6O77T$Wn`}JUnkX7Eczo8 zR$$0&Jc`bEb!=WATs_J z2*{dvtT|E?W!n3I8K9&C1aR3fArXdX1enY>-}p$MD+*N*PBsA%tRs72F90w?VWy6J z9?)ju(^KX!=6jh64>?gZeKa)IXq7^^{y?X(?<%=I_?)vtRCUMh2*b&a2L;I-h%j{8 z`3d~T52xCV>F}n^wePDy@CS=McafF_`g!{&=3Z08GGy*Jz4MfXj0 z+`a|oJT8%xY4j#jb(Uy6-Cb~4cWxbJ71Vuiq3;S?$hQxT=K+kB(AQZa*IL-MncjMJ z6;E(ApnC`XeU*j9{y!W*;om^i{zDA0OhYAuqY*6PFSsKQL7ah(r_KQ~HTBWCPDmCj zLvZfSq9wZo6P8T}jw$#El&!GROHpJ)!o>Ua@PPNT6|c?_@s?bQ<}c)kg^|eK&3pHf zOn85Aotg7UxZwr;4F5V4@Cjo0`~q<4{OKGouYLWM@iv*hSva^)?Mva^wMLb`&Dw9( z-wXnm)C|-@$AZ6S==szKs@!dowc1+R_h_&WI=?*Y_^5J3opQj-K3rdX*k>AhkGV>WL)r&(X=*6XEoQqb9R_Yy7+C~Jq8MemBAz3~% z6nDH*XnV6dLES5&D2cE9o1zs~L!~)Ic0mCF7H2Q;C5b8XqO1ZVsMy8so}rJrLEU2! zZ-b<>eEUr1isL8bUU12lE zR}o`vgRwj={DRRL@&=^0TBt3!c6eUPaJ-4f8`&I|H?l^ ze$M~OKL-B+m8I7$hS7>A+tIOXPog8$Viii@{CGZ#gsyad8*USJ2zOfSGh$|XRO6b1^vg3hO84v!J?B2k=qKQIr$cPo0jN+s>eb& z7Y;H@oU?u`@39F}g%k0neiWqj=fFY>4dt#S(KUU2A(-vSEWI1K%v`1{RQQds7&IbA zb0T9~_cZ;315eWWp;lI=1en?fsk*#Thc zFQ5A|L3A0?zJ-181!Sf=qkgJBeF5)44r9y_^t0Z7WrUmH`DBuX#%0_v37oGRsxwbs zHMmpJG@7|6>{}*Tuba@emTgVC_=2$(%jiSB>GC%84Dbbz8}Bfb;DHy5Y-RnLm7XB` zeKA;r5n{632ju{UNk|Qn$_b{p|LPO^=}eHnf!O^AAXb4cd(GyIauyd_Pudc10%QX{ zh`j!S{nEptMMI1N)pAx1D7vNq+Yjeuvqnhc;giBh7W|9M!yM0T%FtLNM-8;S?P&Pctmb<}&uxPoJ z%H<%3r{$=HbY2_p^m{tqbZMc>@4=SenS`A({mXrimL$sN7M>p=&{ht*_Kx7cF0k3n zHGj+cD0um~V3($C{&Hgo%qF9$Z0`aWZ%MlsZ;G}7Jsy|Slk%odbu_zTyCQwI zu0)(W{Cj{!|C5}eC=C4Ly^f7X$U_+5(w@-UjWPp&&CS#LW0KT>G>q7Bw?W1gHSVRfb5)y;G57dll(& z+Eh7lT4NxnX1j&x-}pFZQ8Ou1uxY(#igI$EA=ZEDo9g4i)WPD4(@bhWf7I*^R@7kV zjlT&rtxka4Rbzx{P2;mQIJiaesut!|2J!5=Lp4+>Tm7mJzkS$+;#qIqx$RD9QNi}# ztp`x_HxNQUl{f#d|6|!*Z}idILQBYV!x%QOWh6M93-9t24r&571mhyD3=In+bH(yL z*x}In98OYvpE8EIs{IZp=K)_!~A|z0VszY`C3upCv0}G4NECPBK#MY(F{RSN{rb1bF0xG7e?PH5NzF$EQ zUB2AZ^n)ry(0dLo2F`GIuy`=yjt{jWsX9}|IE?Qtz=RHK}b3z)FC z&cw#c4pv5ghgZ;D&q4Qgzz}Qhdc<5iLjG0Ju=Q$Acb#jEDWi>4Gz#2G7rf_@J}qB& z--7~QV1yJQM?QvU^)PXydi5x{c{3^{%#3pRVWj#*IHU17Aleit_8SQG{{@0w0tQ4Q zNni@UrJ#v9+y-z2ufrzA&a?!CK%Ni~S~!Ran}B?>`D^nyc37N=0(DD5RJO^;+4P7Z zn*qN91Oc0K| zW~_r6JK-`zgBg2SlV!#hV;M$CmTUalCuZYdO#7^KtI_u37onhwmUpzF4Pp3GUw;eZV>m zsfgH@Ibi2W_1=JWevFBZn(N=62Hsk`;yT|OooE0kSoev5$;N^%ICS$uoxjiXN1M~Q z@fLS_cfn_aof8^r8~RI~10a&9+jX%{;L!jqa%T_bn-*02CBH-H@L#N3LCw=s&xWvT zHyBVTPswpdq52GSl#bG5(zti-k6UNnrFwZ$`D=6%9UU>G^Xr<#4?&sV9S9*Wr*rcS z47o+T^91c@OlNrKzbBe|Ql`-tN?^VMs`4{cc= z;10dZV@{WjcI#cuJieNz9D(y%H}7#D#^xzM4dztzqW_4U6WJjue(Stwb3B%q860q5~?g>aAYd(`ucdMS4#+CYA@LaR4nej3TlEyI^`2}b=A$? zrt3clTgQ4+Go$hp;=Ty%vsrH+GPb9!Qtm(&<=Q3Nl&SlE*A6r%&IIr-2cNMQAdzuZN%bw*~|UBl#Ly|%ccQB{1* zp>kCU$r9hDxjs7{QQ=FTzB_j|cO5Uc5CPs;E zaC%fI!ZfpsBU|;w9H@Fej|aU}_-kPLzcyivVI9HiFByx*g44?g`Amtg2WY!13>|^~ zEN59ZqS5dg5Iqh3EBdeK*W01tSFqKo`YSbGghh5LA*f%1ApJ%VOC}%X%Jg}akT?tO zh^|w5UhY@}sf77XNgsA@D-L!XztHB^g>-X1%b1w>yHaF>((Ia&;tCar9vXe0>42)o zt-D8#-#vNK>@TU?1BNOAx+vmzVJ}fvgyq%!sG4L-uWiQ;xmJJWt>>;ZM3ea#VSXiz zP2L$*bWkFqQdoY^yA|_XULmXY1IwvbU)rOpb2kNM?DRfNjmszrgdNuYtPj9TWz4T$ zZpGExYu{bIC_!5cp7sf~+4ovVb+cg|)sbU*ya^1M!ua=Y{j8&zOn1u$r0v|C zn}FP5N-XMK3tMzokdW)P7PGA%Y~@;r+d695f#G!}>5tFgza{gdx$%a=R<31f>B_@= z0o9aF6^m#6N-h;Tr!1W`=&|n3GmjmrI{^2Rw*RH~-;v zDOWu^SpYQK`C<}1&aXqhPFK%q=Npba6FRxN&`ry)^y}afyQA5wTo^V)1K~d&PBCM^ zq$%Ojg1^>QKWJ65_YOa)8 z$3?%SM91Kad9ag8cR<^W^$Wanl7qJbl(?$lZXIGBO0APZ5m}tG^aAmziBO_P1o*KX zvLK=;Gy1Rf;kWtoC_pj!+5eFIC6(OYNM&8Nw2TvHBy4!{Z4|Gn4NMioAdI0RvrAY< zt<4XZM35=hbfq9emf4AV1BFEBJC&xw_mMW)SaTC|Wo-IUnIvSk6p!;*Wyz@*=8{|t zdT&K>;>U=^IpN3(`&OPOH&7zs^|2@B_P@&S-4hq%ny^z_rR`iSX!b~fG}kso>L+UP z)1Pb=j4np(i?{oPJUO;B=%^4+x1npFH9)$g&<5N)j!SCyH!z)?<@LG^~cDhYi_PO9a|I6FSmWifc>i3tR(c z$m50qngUC*n8eDrx3)2OBO~JI$JVnC3@~3$=ecVdvP-MHYkUdpo{4@v8Y}&`@pRUE zSN#CpBI~?>L2o`IXnC#Xi9%Y$a$~cCX~^hlVP%>&YqHE(-PD%)HkJB%R4aeol(q&s zq)LxSpF^NIX?%kvVg%_A=Md$$`xe0uC|c`!HMwq769Zs4D3}7B9oOcfe2&4xPJ^XI zA@)TC4zGFyI=OxV62(a4!C{z@)?p_g#tc8hY4WrVmheDq17Yye|MX8GQojW8>^Fi~ z<@CwmIB(W*gbgKZr-|ocQ!Fz!Wa?u&rRu`7xlv+q$o!}!o{I;~hIgtTxkY0`3U}Yd zWA%8gt*nVy7B;=-YstcQ=q>e{!Z)SfMVS@tIg5F z_{fu1gzTbK*^|2PeK~%4XX%b*i<_OIhR@|yCQaKCdU6eg*t0!Jj|BF$!QnG#=gG_k z|C5hx=eu;c#she&3Qluujn;B@}RaWE+=i+ zv?`C4u3Wig<^K7zbC?!cf#PJF_+rNE_Hb$l;8O%*Uld)z@-UN$3~w92hBb%0{tcM5 z!1^LAsL!ta@C+N4K#aCp2V5B zkS(J!HsZ3qQ0!hB#`kLC1XqY$f8N7UVN}J8Y=&$TiI@zNl0J+?Asbu5EECxpZA-Qi zHamF^SyGc}Zp+5J5mhWnoTOo2`(8A< z_xqXI#7GI#dOH0gZUzKD1r%=Qbznwa0uLZwPXgPPwI=JemF0ewNp?RS0_4Xnm$Q|w z%!;9b%&Td(&g&+|x@T51Bdkhq=0-8j8AA`N_eD7@(^F{)lgWM}OUx+>V?NOu0=GX$ zd0gu!9<;h!w@3NvFc^^6A$kRyIfUFgKan%F60N_q$$VfAY%2$~LAdexN(ofxWR%AT zO@#4hMO!nV2?+X^Aa;Hyh-j8_RNkL?FiY`hl(>|MiJm8~o*uL%jvi$VEZuU93(1Bj z3ndcCTgfsfjU#;?-YiY#F+oy!^~Z0?F<^OOPLatbDiCBevakct70=-G9LcZ=shCaF z;$m^abKQDf!p%~-V5u}G@|a0A0^RA?}gwHkJlG>oOZahbyt85xn=5c_ufEXDU&4@$Iw z@$Id`*3?(5kG^HAPBQp?zZ9l07|3!!`9fj_bLIb>EPlR&V15Zg^k)?0-zyaCjG9np zse2dnP%u5?R+Q8QB!8mbh1Y1RB%7)y4#!VKkjdH34Ht+lSX+t}HmNm;iS-Su3sb*y z6jq;@TvAH5Il$>{79+zY)2v9(V605G+sk%jOs+U-uatd2|6+OY*CH=kI_W|M9{``nlHY&I3nBECgn&Q4xU4bV&V5A0SA7=;Dw>jG3koR+vxaE`#d zYWqd7&(ypqaYsDkp|z?+N;N%KfSn6De;W_84o{{}g>GegQiHiq>rv(OF3O!n<&1~W zzuOk|0XZJ)Gy3xVY+@jo0zcTQmCtZ3X_hG)x+3|OQM-jW-TTrnr5(@{Kl!QD-iU-7vInk zPOPs@XLjke3Hqy*34QOj$8E(|wXQ6A)hRcWSU`t4=VW48!0sah!CzSB+5 z)9bQ7t*p>d3VR?Cdg;aXkd7DMSm4=@TKQgS&&XD;AhM%A zDMEIMH`eJvaoHk#K*aY@^Q=@baxLGFaX6?u`bY0(I|u=pvj`$tk^HkfY+}cPfyK9t z-ur{n5KPb0wPk&l)P}#VnPEj*UiHAOJfDm@@Jc;)DfIO-xcO-77BEwA z&iBJVg;@Y~VCuFB?^+}v9ik#P5SjfRAEcu}Oe}V#7+X5gqwOrlBKYq$%%5`j_4>R2 zfo1;t{vrGG^MCX|9R73dfNcv>x{xOsTqN`?-(D#8FXBr-1yd!mAr1AcFeM3JAJ$LOrjMJieM&=#fc%sk-D=FPtRvfn|U%|8( zP|-vc-xnipNKjDDS*;3`L}*=LT1P;{-C9nb9RJ#UnU}j2?|g#iSGR$cvp~VhcJ+nr z+PJ8peaoqqoCuiik?qLS82bPbM|lU`oE;IK+Kt9GGoI!LoU~LwNWI;LOCRTlbHwSPBIlMc$I9HDijQ9#L`D;Mdxq^tfj#;ZT0Eokk?Q`Q0$WbF#S?X zScxA&V(YJloOiB)IL3j=2Bi?L&&bwBkA9Cl^_r4{obzTn{qfzN{V7P;4~k)t|6q40 z!jF&#OI~8X{niBsA_3~pCu0FH>$$Twry_`}?}LJc$WZ>F{#W^wsIZ?)%vvrY)3}Yp zYie=(3XXLU5Ei{|MTc6=SlqnjVo!Mcv}ThP2^%y1U;7C}?w24)|G9R+){qRs9FQa> zPF^Ahu89GLca5^P$+q0Z=sBT|b1*UD@I1otG3F{ws$85WnNWp%8JU{;%}?b_BMe;S4)KcCvLQu_)Rcy%*(Sf}Q?DK(bYH+_5VCuqM&^lNjL@7Y+2dk1!u zb~lhCkJ#uR(%ozZ#SECkvH2Lh?+v>NTe-j|d%)7mn?xT;nb{R@J3VsWZ9hbxT4`d7 zh;^gxn3#mUIr8M=wT-p`F4eXHEajwBd|R@AJ4K_;ckuz=(5-nXK+Ro3qr{I53h~=RJBt&sKQn#!9#g% zV~q-*>8#PpDj+H>oWIxsm5TiA3WKr>GgeA61spPFv(4%$IB8sn_tdjAb~U+Y zX~-8f*j>#RV~~l*>f16(sNkZw_iUNOow;#vx=q4&imo|^z=ho@3u5=O8z%@@dKGzH zh|0p12gQ69ml}424)0#5DhqGliu4KQchg8|2YZT+B&~mkSB$Ih(?Q<>)5PX{n1ex2 z=;)oL2M2Y#>mq|b{bAd;cNI0!sgXW4r0ecj(rY_FSl&E+h7gDN!1`s=`SzhD`)3k0 z*01O@T<937;@C(MVm-b9L04HO(_MS&$DkGrw~c z#gp>3(l=0iXY%xrDwXzm!LLFGor-*HFgtzh{V-+y4>~5??{1A$%v~LJfsD~$w0=10 z{Bp8D`*?D3TfRRy8z{8Tjy>BJB;c?1Emt$pjrOw2L;pJ4wxouQj&G;;vex^y<#+Ij znLe}Jc3$buy>nV?6@0zpUk4`&u<%n`wu$Um+IoXU@9GU>X{`uQe^g+ls{>n>VvxdC zix!+t*1)a3SPFfkR{cHtswJF}ovZ?y=`ZHKIsi9js30SU@?A#q7Ll_J-Veegn?^

t^AjYVD; z|85*VIG|^#Bq;K|*mp%z`Gg?9o4kGhzRcUCPF=YYcMk8%Hy#~}y7}x~3(1{6U|jA_ zYhP_%Mr6h5dY|>y24F1TO+6*C14$3y>XeX%2pCBs8)2i(S0A~+#lhgFy?=%v20L2t zMrLeFt9P34aC~QN*Zr80^`B3ws;`TH#;A{os6nUvtZ*;l-snQY^tSW~1|H4~uM!=J zYskkeVRwDiOK*G&w5P|l{Rer(jA4fmwsqduSY zFAm+R%l^U3mF0gc)6t-eGu6z0%_qlskTg<5%C?iK*<^ayIsGw=J{Tta$8SZ zp7~gzR=r_)8+XDW3lY+%P*^23=ykn_8#lV);JaW5IU8_nS}>?)+<-K@#20BcpYBob zxSAA}>=!68k-stm%lTNk*jzKAnRPeV8t~Z_-rTQ-7sUq+PnsVl4d+*0rL6Z$gmz~W zbAyU|)U=-DHeyz9)t}#R351ufH1wQCSxO%pc8?UEp^kxJ{?q#eJ8n zwy+=of(vh(%d7nn{mOLRU9r-~$Z{`hzCX1-C*Z_n?G|C~;^*xy8y%}xQ#&6^>d)*i z`0n2iKGfMzySMaUXJp1t`{vyKW7>}G!4V3rt77ls&E>P)6FYf|K9~K0Szq_2!7a7v zhJ7~YPp|yK9S}XuhE0{nK{GYN!8^$L_H#-9h%#drF}Gp?8zSj1qs5Q6ClWKz?#Jfw zB8eZf>`7y$rj6)HV*pZ(eWI)k+b-);llh zM=4ddMt^k)oS!`^$`ZsYID4G%J+_xMbAV|QRw`ucVuccmANan61`7(fICjlI4~>*3 z&=XT%W_beCbNgykYt4AhnI5$Q1$rvvNA8MJBXDIt{fW1@LgtLpU+U04#*lLcuS&K8 z;5JTs#rJr~7_$D3jFT?jMg@wJLqk5|EzKp7tlv#c z40xDgEUo0Psjx}hL5j+dF<2_bmUf-*aLXh+V(}e*hz&14X^x>-6J|JsecyQQ>a;jL zki4ga_(Me`^b=JPF^$)ixXyH)dFuh9^YgfTqp$b+=BIt*2V%03Uke6@8dlO&DHYR? z8??Bs@FiMSEI zvr;u%E3{`RJW?lkWE=uQ+Npe`?aVYNK%soWUl%3F^#myX;C zMJ)`|>7bhFF`tCw+76r_VB%Z724dy;bGjBdLy#1SUMr66-g??EBhSjQ9O2a^(&7YS6w^p;_ z&H3*d`RAV?M}G-I>pukn+h_CUq*TSl86P<%%O!EZ?yjplGfP}7j&``0pP0nJdcK6c z@|=O_4Ixh{rkDdP6swaI6i>1h8-(Y82}I(&Cl*!1gQ74|P{nc0BySbLo{Wsjh)o1- zMF)@W`0+}RcY3AizF*0wjd!5T?W}J4?xmApU&Kf+1q1*CzM#i<#W8xMA-BUIpFVVb zEoeW6xRtOQH{Db0hhgl-cN}Bgo9c8?dzAvvmNO@&DW_Q{jSe(FP`#%- zpf-DHHr%be-Kw3^1khQth^}lW9a}uiRi%Vj59yIy6E)ZB$kF z@(SQ|3y9E}SEEA9e=CNcA3~IW3BuuTLHt`FXv6e^`z;mQLpB#mimy=`_<0S9-!1#3 z4>KOY^I{Ffd5y0yxEL83y{VRoPgTVh$1*Ti$CyZpFAdx`mat|*@nAWzxfm&2t8EYC*;HoBTJC*(3b^cbJ}@7LDN2 zi_BNt=pS)c`@W`ung9pTD7PfKI=Usod-2fuV94Tz(NO;9$Z}c>RtDMxdTxv2#n zUfJfOdhetLMU0D5OXOtOuO`uNZVt<9OKbTV7qK4(w*1HZM=A6|DL=K`B{_rQ&J*16 z_TCj#9yu$6mJbHR<>4XonqNTg~9V;0;*_tj-{{{zqrcvLbJ?VHO{Gt;T7&JE9LIn`R*ele(4046_Ru44IQT;{{Ly6{L`q|FxM1LL=sou4QnsS z7j8!9(!&Q~?OaAAH#7N^66;cHK?%Xo7X>GcK7=ZGj7MLW^r{wgkmRsHo$NdN^hdVP z=DRBr%5|yCRU%`}$mu-g(#WfDfJb)MXjAWNSSOg`Wz<)?=4gOS15SjTGPn-@IZd=y zA_xdB({D!1Y168_U5f+5TKLI5 zruH|@h~LFPAgaFvk^7r1W6RkPAIBAKSvYpoh`|jLTl5>Ui>+87#p8(8UDg!NoTB~?NNrfn`RgPFvRO{1tLeEIUAs)$#!;hzCW0T+`Aq|l;Uaq81i+;;aG{S6LsRb@Fo%}JHBfg}(t57fCC>PPbA?lVMCSqM=b8P*ONke?N(A88~noSa6cQ z8*G0}ypxvbyGW@)<=gg>cnUcxR^w0NQu4w%f<9PJf{2K*Jo?#Gy4mR$Tal3OCKKv4 zH_2oz>sM55b@mX2p%iM(=CtIn6j>YIfw+it0d*#IVeGZF{M;A^E0xd7)l6gt?UY&B zYIeDGy&t_#XIX+gd~{LKf31O>=n`_v8KAbvM*YqUZJas-dBDK4-hYnqV|^f#u3v1g z|MQvVnvF!A+-Sn53t2Fg85@P%JE&@^eC5UIgTOs0X zWsK31_64@0F?Wr=@x)s;StwwnBxzqB%F)cjOQy&7%!I5xo?h!Ci4PF zf>b(AmWO8}Rs;JUhvH{bf*2YpmEK<&8w;q2B0p~9aVkw{D|ip@FT)Q#1;i3v#ez7h z*LG#iR<`oc?lYa`Ao&QJg{}B3@h zHQ0%qpxqeX*o$EvosR@<|A;Y-oS}~v$SvOF^Sw^1n=vu9U~SE~arv@aE?3P$Yex#B zk4!s%aFW6I<*J}T_dinF1rwIjC3GlW!3oQz&m4Z-%3|ju>fgF;#1eB?O_h>8Bg$SL zupsX^tNyAxJ~yf5aRs_crEfJSfj3@iLn}YF`> zSor+5Uf0oC*fLV3^C^cuH!OoCLda6f2#Evv_3r0WH!0C(Kf>-r-GZ(ZD%~||s`N8H zHn~-_O&V6G4r4_uz-hH{@T!X)$;RTR9Dcq2ng96b{X_ld=YQuvej}AN4ii;%OI9m$ zgZE{2cq;}bZnL-!XdIR4R0$)@0LhL~(J{ur=z3^9o@}CU6;&k}Q-(HYQ)LHXB4a%M z0`g|ORki7PJa;?;>*y&ej30VIj%zRLtHG&G9-f_d?d@Yh$qa^173W^_X|l_=0~@|1Y$Nji`Dm#&-~+1|;{#R#K-lzE9KXj5vy${7v=>plU>V|v`jUgJB7H^x@n+}ymh)jLw^17Xa$7sXEm zjkgJbE5=E5w)MwHT{>43@^9G>%;bgswIF6d8GFrO%zXQkdLueXFk_vjl_Y?>6f_kj@+H`3@cHIIO!i<6-oy5TiD$bFg1BdQ;RI_9Iu|;do ze}FUyWAzU>=hxw%<_ZhQKSo>rLl8T^5yV2es(V#D276yw$^V^IpCzT9%#PNxyoKlC zHsC|DzgFopvBO(Z*r8r*)Kv~)L=)+cxN;m{IZvECJ5M^EnT;97z=EnS(l0xtXU2%Dgikn3*Vl_&)h1V^cDC%9%k6)WDDI)oTDEbR;(mY?5v^rh2L zeyWmNNCs3WKFvl21b}vYm(4Bva(KB1q5qY$77y5aw%2!VNA)icwVfX3dZIHD>qeXJ zNlEKU{}SUmE?{jGFuHK$32LLjf561-EXC`=VsLKK2mZ?sr0SjyFUqU&Ssm-HX(&mS z(7w;1S@%@YJFW3s4}94Ax&-B`B$S;Je^jgFlTV49ptWggUE{ajl(vZVkGZTBM+{l( z-Fe$fEa4Jf9SZ&<>eDw4lNAx=A}=>=JtC?jRi-lsrlkv)!fH0h@{nQ3+-SY?N?XKK zm73zv9`h+h+k8GR5GtihGEe9wyKTpEsao1!bZg)|fBQPZpV}877 zbKIVk6Bw!cVZMvGa&w?1G6NCv$U)SrNYtrEXF2lEM=&4=IAW6YUI3J=(^EL~`$w4K- zZzH2fK8APsJ0x4F37Pp7tjm!kSMI95BWk^~?tgq6_iamz>C@KH;nS#CkUQvmMV3P% zEpKvBgSG~I5$9z+7Bw1^t=m3kBz?Ragzhj1PKhy=$-(JGOT~3sW=meTBSfED&-FG< z=K)?!&FP20lX<(zub_^G4|xp=<)v3VjCPg)LU%o3P`Rl`x^!o`AI0WJsk?veiibns zLEP>BocVHt-YJR+@bNzyLIZ~lC{H~NrccI@iD2HKSjVwdM{vnd+B#c}@Dwu^zQ&J? z{vJz&yXDc)bR3J|?9m^ftv+trz?#9?JqZQ-%OniR`U+`Wx)MufC4;{E*_`DeVLF?b z=cq74*6$9Q|2$o2{t|@N--7tJ3+bjmDkHa5-*=(ff_S#F@0y?oViTC>N0KpeapBk6_myOI=vAfFOrfNWpk_i!b@}ideY|7 zUS``qWb@%r1LTX3y`2sevH;g^mW=>T-7vRG^GBm+mPQB1MVOkrli(p9*NZr*YW&Gt zD7+&Hgn0y|y&W%nBBOgtKkG@PaQMv5tci+xTgHT!ziDwe zJD*y*zJHC>R-3p1l6tAiwVj^y>hp4D$NhU4{psUWu40^NQvoTJOj0fi?at4fB%H~= z5;A%5X75VZ1gV==8q6mqlBNxc6RcnmnHLxUM19K- zQM-*i18o-Ht3t-IPe!ZwvqibA#Ii4m?Oa#?BZN7>YLZ{Mb^z*o%xflLCa%3lVyh#< zQIr|U0Wb0Ez_5PIm@fgTWfuOQ)2V)>dR8+l-!;0nUoJvtWu2Qplf?IP%Q*f^5Dvc) z#B#%s-i69IavOzWj*KfICYRy4^%&AsB~cBs!j|l&i>HuG)VF9-90d#+#GlhK;)nx3mY{TjUdB!Y`HU0;qE`*i9rPIy6;d)N+gwSdhwuq44?+tBa z2|zai!O^==5jqpu-U40%mjG?{!}=f?=3#W@2^i;~0bN4yD<5ag7G#{uNz+z-%9z+d z00VRb!ku>?15?jnH=rh{H=dXI=L(_qOAw^r2x6}zL;v14G8fL7xjL$?58hc8!^R+W zSLOIQp1i&oFY^S~c`@--GM z>C53&S}fm6&bG|9+~jbG%rI;k(f@Xo^64`!`Rc}-{Vv@HGO{rvn>z5jTBd|pYIWA0 z_tHYt9f2y}c=~TGQ{&rf9iq>YL(Y3fNtX_-5pF z+NN&f^$8Zzr>}0j+)^p@V$+kXK2Gmq45M`uL>p%mR(m8mqy;TdwrLh9Lv4C^AO|5m zbk}(#rAriw6`HPh1V#O@!0!k@)9Co1?qVGPv{V9EZq_doSs_ryp<}^G0GMatSln^! z3fKk!Js?@g1~BZv;SbFEz=nY-lx)M320~WbzFuHDDg9lGFr-7CBV%5hd@$8Htd~pI zR@XOYP=h%N!^jy+2e*s!NFqlyr>^)mh%A>U2vQvZ3F~3Og1F4Q?H z%xqs@?ESNbhPHpMwzJ^#vk*3KUQKYrPk;}(AM zU}|M$fbF{-VMp_2lLOLibtA41*kyaaC0Y#!1W6k2Ey#UyhnuA2V&+3iswt;Ro|a0f z5dmc_-iC#|r9!NW`%F!2=Z*0xl_h_?CzBsEjLE-(JE#c0{@hJ|v9D)Ll^=8sjU5>eQ=U69J&tcJ&d+l)YHm>Vdk}fObe!ATvD$^w6qs<6ppeQ|Ff;p8ZA;8^d?a zqO-W!idd`}B&En4oP8KZ!rM3|7cPp69I?jw+Mjt?SVSe8NDpr z-MvbY$+tTp<*ZY8Cu;X>*;B$BmO3M&{p=2@Zf7u+pIdo!rYbV#B_U%?3dS~P2{Xggf^V>nYwm&37nvk^)0^fP+jcn9N1w9dm zN43`OYzoF+kl!RM|BxteZ(g_oEm~vTbr*PL$>ws9DQ4o0s8J@#(Z!WR$(lR3aoi+O z!fUZ@+KFpK^ekUZuElbri(hC?FW^)7PM9_(^&JWF3QpG;u^v4o&Ur`MG!KDRjP<$d z<0*5ixa?j?iGac-*cC;OM(dX~xdvMi8|lYhM$CMhDp2Xu*Gwe(bujju--D0k{Ty`v zi2yuQ46KcV!74QcX5Xx%8-e*2jvLFn%W_e}%+>|F`p`DN11gmbbo3-2E-04U;HxDD zrV727i|sZ5mfh#m<%K&9gnZ8r@HgnUVw)lgW1H^6j4ih+XfwtP-Nm>2!ThRxM!@mC zOFp(FD&(;BHKIVDgARWZY4#1P&|(46{UwOc{}9Aj%m12p&CY`Q{ygq=`P*AKs1SvV zXVaNT4t&p*k^N^j$QN@|nH18w^w3P@T(xEw??U*JlaNK|>=M)|er|{dQO`oi+{X7_ zh6J`;2HFl!)_WNr1&$B#H1~^X>{k#KjGGmo=K2utO)pKq^*(eykjlFJfS>mM#$$># zMY>Dga$9?Ou+Ce^T~$|eG?LOJ=BND#R3z0emV00N_Ntu33Xsa>cQ$wK-+N^N17{L2 zZ!&*2@)^&fP745Z+S@%~<@U$d+J1z&Ih^=J-|smSd!AJGK+x23U)C3`gR-9qdIFp} zU_RmYm->sW;*T7EY$20OjA`4VPfVUoGPv3k(502C5u zbO+?jno|EDP3hL5Z8jM(ZQ7D5@cwv~r zPGXkW4TvQN{wh#I*RikR%8_n)3Zu)_EDSsM>9@aSxoIlXW)C`U(%QA? { @@ -159,4 +160,17 @@ describe('Parse AIFF (Audio Interchange File Format)', () => { ], 'common.comment'); }); + it('Protect against CWE-835 with 0 chunk length', async () => { + + const filePath = path.join(aiffSamplePath, 'CWE-835-01.aiff'); + + try { + await mm.parseFile(filePath); + expect.fail('Expected parseFile to throw UnexpectedFileContentError'); + } catch (err) { + expect(err).to.be.instanceOf(UnexpectedFileContentError); + expect((err as Error).message).to.match(/COMMON CHUNK size should always be at least 22/); + } + }); + }); diff --git a/test/test-file-asf.ts b/test/test-file-asf.ts index 05fd42ec..b9838371 100644 --- a/test/test-file-asf.ts +++ b/test/test-file-asf.ts @@ -154,16 +154,32 @@ describe('Parse ASF', () => { }); - it('Avoid infinite loop CWE-835', async () => { - const filePath = path.join(asfFilePath, 'CWE-835.wma'); + describe('security hardening', () => { + + it('Avoid infinite loop CWE-835', async () => { + const filePath = path.join(asfFilePath, 'CWE-835.wma'); + + try { + await mm.parseFile(filePath); + expect.fail('Expected parseFile to throw AsfContentParseError'); + } catch (err) { + expect(err).to.be.instanceOf(AsfContentParseError); + expect((err as Error).message).to.match(/Invalid ASF header object size/); + } + }); + + it('numberOfObjectHeaders=4294967295', async () => { + const filePath = path.join(asfFilePath, 'max-numberOfObjectHeaders.wma'); + + try { + await mm.parseFile(filePath); + expect.fail('Expected parseFile to throw AsfContentParseError'); + } catch (err) { + expect(err).to.be.instanceOf(AsfContentParseError); + expect((err as Error).message).to.match(/Unrealistic number of ASF header objects/); + } + }); - try { - await mm.parseFile(filePath); - expect.fail('Expected parseFile to throw AsfContentParseError'); - } catch (err) { - expect(err).to.be.instanceOf(AsfContentParseError); - expect((err as Error).message).to.match(/Invalid ASF header object size/); - } }); });