From 1268452c9023491fa7b4c1b1889e0295295ab62b Mon Sep 17 00:00:00 2001 From: Nikola Tesic Date: Wed, 5 Apr 2023 02:24:03 -0700 Subject: [PATCH 1/8] [Target] Helpers for param forwarding registers --- .../include/Target/CATargetInfo.h | 34 +++++++++++++++--- .../lib/Target/CATargetInfo.cpp | 36 +++++++++++++++++++ 2 files changed, 65 insertions(+), 5 deletions(-) diff --git a/llvm-15.0.3/llvm-crash-analyzer/include/Target/CATargetInfo.h b/llvm-15.0.3/llvm-crash-analyzer/include/Target/CATargetInfo.h index 66096124b3..f76e503024 100644 --- a/llvm-15.0.3/llvm-crash-analyzer/include/Target/CATargetInfo.h +++ b/llvm-15.0.3/llvm-crash-analyzer/include/Target/CATargetInfo.h @@ -18,6 +18,8 @@ #include "llvm/CodeGen/MachineBasicBlock.h" #include "llvm/CodeGen/MachineFunction.h" #include "llvm/CodeGen/MachineInstr.h" +#include "llvm/CodeGen/TargetInstrInfo.h" +#include "llvm/MC/MCRegisterInfo.h" #include "llvm/Support/Debug.h" #include "llvm/Support/Host.h" @@ -39,7 +41,8 @@ class CATargetInfo { std::unordered_map RegMap; // Save PC value for each instruction. - std::unordered_map> InstAddrs; + std::unordered_map> + InstAddrs; // Singleton class for the CATargetInfo instance. template class Singleton { @@ -53,11 +56,18 @@ class CATargetInfo { public: CATargetInfo() {} - virtual ~CATargetInfo() { RegMap.clear(); InstAddrs.clear(); } + virtual ~CATargetInfo() { + RegMap.clear(); + InstAddrs.clear(); + } // Get register index in the RegMap. virtual Optional getID(std::string RegName) const = 0; + // Get register unsigned (MCRegister) from the RegMap. + virtual Optional getRegister(std::string RegName, + const MachineInstr *MI) const = 0; + virtual unsigned getRegSize(std::string RegName) const = 0; // Get RegAliasTuple from the RegMap with selected Id. @@ -65,22 +75,28 @@ class CATargetInfo { return const_cast(RegMap.at(Id)); } + // Get RegAliasTuple from the RegMap with selected Id. + std::unordered_map getWholeRegMap() const { + return RegMap; + } + // Get InstAddr from the InstAddrs map for the MI. - Optional getInstAddr(const MachineInstr* MI) { + Optional getInstAddr(const MachineInstr *MI) { if (InstAddrs.count(MI) == 0) return None; return InstAddrs[MI].first; } // Get InstAddr from the InstAddrs map for the MI. - Optional getInstSize(const MachineInstr* MI) { + Optional getInstSize(const MachineInstr *MI) { if (InstAddrs.count(MI) == 0) return None; return InstAddrs[MI].second; } // Set InstAddr in the InstAddrs map for the MI. - void setInstAddr(const MachineInstr* MI, uint64_t InstAddr, uint64_t InstSize = 0) { + void setInstAddr(const MachineInstr *MI, uint64_t InstAddr, + uint64_t InstSize = 0) { InstAddrs[MI] = {InstAddr, InstSize}; } @@ -99,6 +115,9 @@ class CATargetInfo { // Return true if the register is Base Pointer Register. virtual bool isBPRegister(std::string RegName) const = 0; + // Return true if the register can be used to forward parameters. + virtual bool isParamFwdRegister(std::string RegName) const = 0; + // Set target Triple of the CATargetInfo instance. static void initializeCATargetInfo(Triple *Triple) { if (!TT) @@ -118,6 +137,9 @@ class X86CATargetInfo : public CATargetInfo { Optional getID(std::string RegName) const override; + Optional getRegister(std::string RegName, + const MachineInstr *MI) const override; + unsigned getRegSize(std::string RegName) const override; bool isRetValRegister(std::string RegName) const override; @@ -130,6 +152,8 @@ class X86CATargetInfo : public CATargetInfo { bool isBPRegister(std::string RegName) const override; + bool isParamFwdRegister(std::string RegName) const override; + // Define static instance getter for each target. static X86CATargetInfo *instance() { return CATargetInfo::Singleton::get(); diff --git a/llvm-15.0.3/llvm-crash-analyzer/lib/Target/CATargetInfo.cpp b/llvm-15.0.3/llvm-crash-analyzer/lib/Target/CATargetInfo.cpp index 0bd61f5dcd..f5c64f5e64 100644 --- a/llvm-15.0.3/llvm-crash-analyzer/lib/Target/CATargetInfo.cpp +++ b/llvm-15.0.3/llvm-crash-analyzer/lib/Target/CATargetInfo.cpp @@ -159,3 +159,39 @@ bool X86CATargetInfo::isBPRegister(std::string RegName) const { return true; return false; } + +bool X86CATargetInfo::isParamFwdRegister(std::string RegName) const { + if (RegName == "rdi" || RegName == "edi" || RegName == "di" || + RegName == "dil") + return true; + if (RegName == "rsi" || RegName == "esi" || RegName == "si" || + RegName == "sil") + return true; + if (RegName == "rdx" || RegName == "edx" || RegName == "dx" || + RegName == "dl") + return true; + if (RegName == "rcx" || RegName == "ecx" || RegName == "cx" || + RegName == "cl") + return true; + if (RegName == "r8" || RegName == "r8d" || RegName == "r8w" || + RegName == "r8b") + return true; + if (RegName == "r9" || RegName == "r9d" || RegName == "r9w" || + RegName == "r9b") + return true; + return false; +} + +Optional X86CATargetInfo::getRegister(std::string RegName, + const MachineInstr *MI) const { + auto TRI = MI->getMF()->getSubtarget().getRegisterInfo(); + if (!TRI) + return None; + unsigned N = 1000; + for (unsigned I = 0; I < N; ++I) { + std::string CurName = TRI->getRegAsmName(I).lower(); + if (CurName == RegName) + return I; + } + return None; +} From 7ea35b2a68c128d2e9bfe96e302a0f2dc950a69c Mon Sep 17 00:00:00 2001 From: Nikola Tesic Date: Wed, 5 Apr 2023 03:13:55 -0700 Subject: [PATCH 2/8] [TaintDFG] Upgrade TaintDFG infrastructure --- .../include/Analysis/TaintDataFlowGraph.h | 6 ++-- .../lib/Analysis/TaintAnalysis.cpp | 22 +++++++++----- .../lib/Analysis/TaintDataFlowGraph.cpp | 30 +++++++++++++++++-- 3 files changed, 47 insertions(+), 11 deletions(-) diff --git a/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/TaintDataFlowGraph.h b/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/TaintDataFlowGraph.h index 75ff72bc5f..66de6b1a63 100644 --- a/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/TaintDataFlowGraph.h +++ b/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/TaintDataFlowGraph.h @@ -19,6 +19,7 @@ #include #include +#include using namespace llvm; using namespace crash_analyzer; @@ -32,6 +33,7 @@ struct Node { static unsigned NextID; bool IsCrashNode; bool IsContant; + unsigned Depth = 0; // Call instruction that performed the call to function that is out // of bt. @@ -161,13 +163,13 @@ class TaintDataFlowGraph { public: // Map operand to the latest taint node. // FIXME: This should be private. - std::map> lastTaintedNode; + std::map> lastTaintedNode; void addEdge(std::shared_ptr src, std::shared_ptr dest, EdgeType e_type = EdgeType::Assigment); void addNode(std::shared_ptr n); - void updateLastTaintedNode(TaintInfo Op, std::shared_ptr N); + void updateLastTaintedNode(const MachineOperand* Op, std::shared_ptr N); unsigned getBlameNodesSize() { return Nodes.size(); } Node *getCrashNode() { return Nodes[0].get(); } diff --git a/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp b/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp index 892972ceae..72f431d1c6 100644 --- a/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp +++ b/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp @@ -609,8 +609,10 @@ void crash_analyzer::TaintAnalysis::insertTaint( StartCrashOrder = 0; Node *sNode = new Node(MF->getCrashOrder(), &MI, DestTi, false); std::shared_ptr startTaintNode(sNode); + // Set new node depth (crashNode has zero depth). + startTaintNode->Depth = crashNode->Depth + 1; TaintDFG.addEdge(crashNode, startTaintNode, EdgeType::Dereference); - TaintDFG.updateLastTaintedNode(DestTi, startTaintNode); + TaintDFG.updateLastTaintedNode(DestTi.Op, startTaintNode); } printTaintList(TL); @@ -708,8 +710,10 @@ void crash_analyzer::TaintAnalysis::addNewTaint( if (addToTaintList(Ti, TL)) { Node *sNode = new Node(MF->getCrashOrder(), &MI, Ti, false); std::shared_ptr startTaintNode(sNode); + // Set new node depth (crashNode has zero depth). + startTaintNode->Depth = crashNode->Depth + 1; TaintDFG.addEdge(crashNode, startTaintNode, EdgeType::Dereference); - TaintDFG.updateLastTaintedNode(Ti, startTaintNode); + TaintDFG.updateLastTaintedNode(Ti.Op, startTaintNode); } } @@ -941,10 +945,12 @@ bool llvm::crash_analyzer::TaintAnalysis::propagateTaint( if (CallMI) constantNode->CallMI = CallMI; std::shared_ptr constNode(constantNode); - auto &LastTaintedNodeForTheOp = TaintDFG.lastTaintedNode[Taint]; + auto &LastTaintedNodeForTheOp = TaintDFG.lastTaintedNode[Taint.Op]; TaintDFG.addEdge(LastTaintedNodeForTheOp, constNode, EdgeType::Dereference); // FIXME: The LastTaintedNode won't be used any more, no need for this line? - TaintDFG.updateLastTaintedNode(SrcTi, constNode); + TaintDFG.updateLastTaintedNode(SrcTi.Op, constNode); + // Set new node depth. + constNode->Depth = LastTaintedNodeForTheOp->Depth + 1; // We have reached a terminating condition where // dest is tainted and src is a constant operand. @@ -959,9 +965,9 @@ bool llvm::crash_analyzer::TaintAnalysis::propagateTaint( // TODO: Check if this should be a deref edge: // if we propagate taint from a mem addr (e.g. rbx + 10) // to its base reg (e.g. rbx). - assert(TaintDFG.lastTaintedNode.count(Taint) && + assert(TaintDFG.lastTaintedNode.count(Taint.Op) && "Taint Op must be reached already"); - auto &LastTaintedNodeForTheOp = TaintDFG.lastTaintedNode[Taint]; + auto &LastTaintedNodeForTheOp = TaintDFG.lastTaintedNode[Taint.Op]; if (LastTaintedNodeForTheOp->TaintOp.Op->isReg() && LastTaintedNodeForTheOp->TaintOp.Offset && @@ -972,7 +978,9 @@ bool llvm::crash_analyzer::TaintAnalysis::propagateTaint( EdgeType::Dereference); else TaintDFG.addEdge(LastTaintedNodeForTheOp, newTaintNode); - TaintDFG.updateLastTaintedNode(SrcTi, newTaintNode); + TaintDFG.updateLastTaintedNode(SrcTi.Op, newTaintNode); + // Set new node depth. + newTaintNode->Depth = LastTaintedNodeForTheOp->Depth + 1; if (!BaseTaintFlag) removeFromTaintList(Taint, TL); diff --git a/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintDataFlowGraph.cpp b/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintDataFlowGraph.cpp index a789ee75ae..266d8c90f0 100644 --- a/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintDataFlowGraph.cpp +++ b/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintDataFlowGraph.cpp @@ -31,7 +31,7 @@ void TaintDataFlowGraph::addEdge(std::shared_ptr src, adjacencies[src.get()].push_back({dest.get(), e_type}); } -void TaintDataFlowGraph::updateLastTaintedNode(TaintInfo Op, +void TaintDataFlowGraph::updateLastTaintedNode(const MachineOperand *Op, std::shared_ptr N) { lastTaintedNode[Op] = N; } @@ -134,6 +134,9 @@ void TaintDataFlowGraph::findBlameFunction(Node *v) { if (a->MI->getParent() == adjNode->MI->getParent() && !a->CallMI && !adjNode->CallMI) { if (MDT->dominates(adjNode->MI, a->MI)) { + // Do not erase potential blame nodes. + if (a->TaintOp.DerefLevel == 0 && a->IsContant) + break; BlameNodes.erase(BlameNodes.begin() + i); break; } @@ -141,6 +144,9 @@ void TaintDataFlowGraph::findBlameFunction(Node *v) { MDT = dominators[a->CallMI->getMF()]; if (a->CallMI->getParent() == adjNode->MI->getParent()) { if (MDT->dominates(adjNode->MI, a->CallMI)) { + // Do not erase potential blame nodes. + if (a->TaintOp.DerefLevel == 0 && a->IsContant) + break; BlameNodes.erase(BlameNodes.begin() + i); break; } @@ -149,6 +155,9 @@ void TaintDataFlowGraph::findBlameFunction(Node *v) { MDT = dominators[adjNode->CallMI->getMF()]; if (a->MI->getParent() == adjNode->CallMI->getParent()) { if (MDT->dominates(adjNode->CallMI, a->MI)) { + // Do not erase potential blame nodes. + if (a->TaintOp.DerefLevel == 0 && a->IsContant) + break; BlameNodes.erase(BlameNodes.begin() + i); break; } @@ -159,6 +168,9 @@ void TaintDataFlowGraph::findBlameFunction(Node *v) { a->CallMI->getParent() == adjNode->CallMI->getParent()) { MDT = dominators[adjNode->CallMI->getMF()]; if (MDT->dominates(adjNode->CallMI, a->CallMI)) { + // Do not erase potential blame nodes. + if (a->TaintOp.DerefLevel == 0 && a->IsContant) + break; BlameNodes.erase(BlameNodes.begin() + i); break; } @@ -196,12 +208,26 @@ bool TaintDataFlowGraph::printBlameFunction( StringRef BlameFn = ""; const MachineFunction *MF = nullptr; - auto &BlameNodes = blameNodes[MaxLevel]; + auto &SortBlameNodes = blameNodes[MaxLevel]; llvm::SmallVector BlameFns; llvm::SmallVector MFs; unsigned BlameLine = 0; unsigned BlameColumn = 0; + // Sort blame Nodes by depth - descending. + std::sort(SortBlameNodes.begin(), SortBlameNodes.end(), + [](Node *n1, Node *n2) { return n1->Depth > n2->Depth; }); + unsigned DepthLevel = 0; + llvm::SmallVector BlameNodes; + // Filter leaf nodes - consider zero DerefLevel and max depth. + for (auto &n : SortBlameNodes) { + if (n->TaintOp.DerefLevel != 0) + continue; + if (n->Depth < DepthLevel) + break; + DepthLevel = n->Depth; + BlameNodes.push_back(n); + } for (auto &a : BlameNodes) { // Only consider Node if it's DerefLevel is zero. From 987712b9d270707254cd63961c25680e116cb1da Mon Sep 17 00:00:00 2001 From: Nikola Tesic Date: Wed, 5 Apr 2023 03:33:00 -0700 Subject: [PATCH 3/8] [TA] Detect tainted parameters --- .../include/Analysis/RegisterEquivalence.h | 1 + .../include/Analysis/TaintAnalysis.h | 7 ++ .../lib/Analysis/RegisterEquivalence.cpp | 53 ++++++++ .../lib/Analysis/TaintAnalysis.cpp | 113 +++++++++++++++++- .../include/llvm/CodeGen/TargetInstrInfo.h | 1 + .../llvm/lib/Target/X86/X86InstrInfo.cpp | 11 ++ .../llvm/lib/Target/X86/X86InstrInfo.h | 1 + 7 files changed, 185 insertions(+), 2 deletions(-) diff --git a/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/RegisterEquivalence.h b/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/RegisterEquivalence.h index 47850b244d..83de981f22 100644 --- a/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/RegisterEquivalence.h +++ b/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/RegisterEquivalence.h @@ -90,6 +90,7 @@ class RegisterEquivalence { bool applyRegisterCopy(MachineInstr &MI); bool applyLoad(MachineInstr &MI); bool applyStore(MachineInstr &MI); + bool applyArithInstr(MachineInstr &MI); bool applyCall(MachineInstr &MI); bool applyRegDef(MachineInstr &MI); diff --git a/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/TaintAnalysis.h b/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/TaintAnalysis.h index 6ed5838f69..1ffe797f31 100644 --- a/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/TaintAnalysis.h +++ b/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/TaintAnalysis.h @@ -121,6 +121,13 @@ class TaintAnalysis { void printTaintList2(SmallVectorImpl &TL); void printDestSrcInfo(DestSourcePair &DS, const MachineInstr &MI); bool shouldAnalyzeCall(SmallVectorImpl &TL); + bool areParamsTainted(const MachineInstr *CallMI, + SmallVectorImpl &TL, + SmallVectorImpl *TL_Of_Caller, + TaintDataFlowGraph &TaintDFG, + RegisterEquivalence &REAnalysis); + const MachineInstr *findParamLoadingInstr(TaintInfo &Ti, + const MachineInstr *CallMI); TaintInfo isTainted(TaintInfo &Op, SmallVectorImpl &TL, RegisterEquivalence *REAnalysis = nullptr, const MachineInstr *MI = nullptr); diff --git a/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/RegisterEquivalence.cpp b/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/RegisterEquivalence.cpp index 14e261d661..b59a6ede62 100644 --- a/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/RegisterEquivalence.cpp +++ b/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/RegisterEquivalence.cpp @@ -277,6 +277,57 @@ bool RegisterEquivalence::applyStore(MachineInstr &MI) { return true; } +bool RegisterEquivalence::applyArithInstr(MachineInstr &MI) { + // Currently only LEA is concerned, but this should work for ADD, SUB... + if (!TII->isLEAInstr(MI)) + return false; + + auto srcDest = TII->getDestAndSrc(MI); + if (!srcDest) + return false; + + auto SrcReg = srcDest->Source->getReg(); + auto DestReg = srcDest->Destination->getReg(); + + int64_t SrcOffset = 0; + // Currently cannot handle if dest and src use the same reg. + if (SrcReg == DestReg) + return false; + + // Take the offset into account. + if (srcDest->SrcOffset) + SrcOffset = *srcDest->SrcOffset; + + // Transform deref->$rip+(off) to deref->$noreg+(rip+off). + auto CATI = getCATargetInfoInstance(); + std::string RegName = TRI->getRegAsmName(SrcReg).lower(); + if (CATI->isPCRegister(RegName) && CATI->getInstAddr(&MI)) { + SrcReg = 0; + SrcOffset += *CATI->getInstAddr(&MI) + *CATI->getInstSize(&MI); + } + + RegisterOffsetPair Src{SrcReg, SrcOffset}; + // Same as Load, but Src Memory address is not dereferenced. + Src.IsDeref = false; + RegisterOffsetPair Dest{DestReg}; + + // First invalidate dest reg, since it is being rewritten. + invalidateAllRegUses(MI, Dest); + + // If SrcReg is redefined (same as DestReg), set only identity equivalence. + if (Src.RegNum == Dest.RegNum) { + if (RegInfo[&MI][Dest].find(Src) == RegInfo[&MI][Dest].end()) + RegInfo[&MI][Src].insert(Src); + return true; + } + + // Set (transitive) equivalence. + setRegEq(MI, Src, Dest); + // dumpRegTableAfterMI(&MI); + + return true; +} + bool RegisterEquivalence::applyCall(MachineInstr &MI) { // TODO: Implement this by invalidating registers // that will be clobbered by the call. @@ -309,6 +360,8 @@ void RegisterEquivalence::processMI(MachineInstr &MI) { return; if (applyStore(MI)) return; + if (applyArithInstr(MI)) + return; if (applyCall(MI)) return; if (applyRegDef(MI)) diff --git a/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp b/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp index 72f431d1c6..27fe910376 100644 --- a/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp +++ b/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp @@ -404,6 +404,115 @@ void llvm::crash_analyzer::TaintAnalysis::removeFromTaintList( llvm_unreachable("Operand not in Taint List"); } +// Find the instruction, which loaded parameter value in the register location. +const MachineInstr *crash_analyzer::TaintAnalysis::findParamLoadingInstr( + TaintInfo &Ti, const MachineInstr *CallMI) { + MachineInstr *MI = nullptr; + if (!CallMI) + return nullptr; + auto *MBB = CallMI->getParent(); + auto *MF = CallMI->getMF(); + auto TII = MF->getSubtarget().getInstrInfo(); + // Skip the call instruction. + auto I = std::next(CallMI->getReverseIterator()); + // Search for an instruction, which loads parameter value in register(Ti) in + // the same MBB. + for (; I != MBB->rend(); ++I) { + // We stop the search at the new call site. + if (I->isCall()) + break; + auto DestSrc = TII->getDestAndSrc(*I); + if (!DestSrc) + continue; + + TaintInfo DestTi; + DestTi.Op = DestSrc->Destination; + DestTi.Offset = DestSrc->DestOffset; + if (DestTi.Offset) + calculateMemAddr(DestTi); + // Compare loded value (DestTi) to the register. + if (DestTi == Ti) + return &*I; + } + return MI; +} + +// Return true, if any parameter forwarding register location is tainted. +// Add tainted parameters to the TaintList (TL_Of_Caller), which will be used +// during forward TaintAnalysis of the called function. +bool crash_analyzer::TaintAnalysis::areParamsTainted( + const MachineInstr *CallMI, SmallVectorImpl &TL, + SmallVectorImpl *TL_Of_Caller, TaintDataFlowGraph &TaintDFG, + RegisterEquivalence &REAnalysis) { + auto CATI = getCATargetInfoInstance(); + const MachineFunction *MF = CallMI->getMF(); + + bool Tainted = false; + + // Search the parameter forwarding registers. + // TODO: Add support for parameters forwarded via stack. + auto RegMap = CATI->getWholeRegMap(); + for (auto regTuple : RegMap) { + std::string LargestRegName = std::get<0>(regTuple.second); + if (!CATI->isParamFwdRegister(LargestRegName)) + continue; + // Get unsigned identifier from Reg name. + auto OptReg = CATI->getRegister(LargestRegName, CallMI); + unsigned Reg = OptReg ? *OptReg : 0; + + // Create a TaintInfo for param forwarding register. + TaintInfo Ti; + MachineOperand MOp = MachineOperand::CreateReg(MCRegister(Reg), false); + MOp.setParent(const_cast(CallMI)); + Ti.Op = new MachineOperand(MOp); + + // Check if the register (parameter) is tainted. + auto Taint = isTainted(Ti, TL, &REAnalysis, CallMI); + if (Taint.Op == nullptr) + continue; + + // FIXME: Confirm that the param is a reference? + if (Taint.DerefLevel >= 0) + continue; + + Tainted = true; + + // FIXME: Should we update deref level for Ti? + Ti.DerefLevel = Taint.DerefLevel; + + // Add param forwarding reg to the Caller's TL. + if (addToTaintList(Ti, *TL_Of_Caller)) { + // For now use CallMI for param forwarding node. + auto LoadMI = findParamLoadingInstr(Ti, CallMI); + Node *newNode = new Node(MF->getCrashOrder(), LoadMI, Ti, false); + if (CallMI) + newNode->CallMI = CallMI; + std::shared_ptr newTaintNode(newNode); + // TODO: Check if this should be a deref edge: + // if we propagate taint from a mem addr (e.g. rbx + 10) + // to its base reg (e.g. rbx). + assert(TaintDFG.lastTaintedNode.count(Taint.Op) && + "Taint Op must be reached already"); + auto &LastTaintedNodeForTheOp = TaintDFG.lastTaintedNode[Taint.Op]; + // Set new node depth. + newTaintNode->Depth = LastTaintedNodeForTheOp->Depth + 1; + + if (LastTaintedNodeForTheOp->TaintOp.Op->isReg() && + LastTaintedNodeForTheOp->TaintOp.Offset && + newTaintNode->TaintOp.Op->isReg() && + (LastTaintedNodeForTheOp->TaintOp.Op->getReg() == + newTaintNode->TaintOp.Op->getReg())) + TaintDFG.addEdge(LastTaintedNodeForTheOp, newTaintNode, + EdgeType::Dereference); + else + TaintDFG.addEdge(LastTaintedNodeForTheOp, newTaintNode); + TaintDFG.updateLastTaintedNode(Ti.Op, newTaintNode); + } + } + + return Tainted; +} + // Return true if rax register, that stores the return value // of a function call is present in the taint list. // Also, if a global variable is tainted, we are interested @@ -435,7 +544,7 @@ TaintInfo crash_analyzer::TaintAnalysis::isTainted( Empty_op.Op = nullptr; Empty_op.Offset = 0; - unsigned OffsetOp = 0; + int64_t OffsetOp = 0; if (Op.Offset) OffsetOp = *Op.Offset; @@ -446,7 +555,7 @@ TaintInfo crash_analyzer::TaintAnalysis::isTainted( if (itr->Op->isReg() && Op.Op->isReg() && Op.Op->getReg() != itr->Op->getReg() && MI != &*MI->getParent()->begin()) { - unsigned OffsetCurrOp = 0; + int64_t OffsetCurrOp = 0; if (itr->Offset) OffsetCurrOp = *itr->Offset; if (REAnalysis->isEquivalent( diff --git a/llvm-15.0.3/llvm/include/llvm/CodeGen/TargetInstrInfo.h b/llvm-15.0.3/llvm/include/llvm/CodeGen/TargetInstrInfo.h index 8ce15b2e92..c945934bd8 100644 --- a/llvm-15.0.3/llvm/include/llvm/CodeGen/TargetInstrInfo.h +++ b/llvm-15.0.3/llvm/include/llvm/CodeGen/TargetInstrInfo.h @@ -350,6 +350,7 @@ class TargetInstrInfo : public MCInstrInfo { virtual bool isLoad(const MachineInstr &MI) const { return false; } virtual bool isStore(const MachineInstr &MI) const { return false; } + virtual bool isLEAInstr(const MachineInstr &MI) const { return false; } /// If the specified machine instruction has a load from a stack slot, /// return true along with the FrameIndices of the loaded stack slot and the diff --git a/llvm-15.0.3/llvm/lib/Target/X86/X86InstrInfo.cpp b/llvm-15.0.3/llvm/lib/Target/X86/X86InstrInfo.cpp index 20f0184998..db0c8414b6 100644 --- a/llvm-15.0.3/llvm/lib/Target/X86/X86InstrInfo.cpp +++ b/llvm-15.0.3/llvm/lib/Target/X86/X86InstrInfo.cpp @@ -732,6 +732,17 @@ bool X86InstrInfo::isStore(const MachineInstr &MI) const { } } +bool X86InstrInfo::isLEAInstr(const MachineInstr &MI) const { + switch (MI.getOpcode()) { + case X86::LEA32r: + case X86::LEA64r: + case X86::LEA64_32r: + return true; + default: + return false; + } +} + Optional X86InstrInfo::getDestAndSrc(const MachineInstr &MI) const { auto Res = isCopyInstr(MI); diff --git a/llvm-15.0.3/llvm/lib/Target/X86/X86InstrInfo.h b/llvm-15.0.3/llvm/lib/Target/X86/X86InstrInfo.h index d295530e7e..357caf9a01 100644 --- a/llvm-15.0.3/llvm/lib/Target/X86/X86InstrInfo.h +++ b/llvm-15.0.3/llvm/lib/Target/X86/X86InstrInfo.h @@ -219,6 +219,7 @@ class X86InstrInfo final : public X86GenInstrInfo { static bool isDataInvariantLoad(MachineInstr &MI); bool isLoad(const MachineInstr &MI) const override; bool isStore(const MachineInstr &MI) const override; + bool isLEAInstr(const MachineInstr &MI) const override; bool isNoopInstr(const MachineInstr &MI) const override; bool isXORSimplifiedSetToZero(const MachineInstr &MI) const override; bool isPush(const MachineInstr &MI) const override; From fe3565a36c5e0ecb60bb892e17666bed4bba2b72 Mon Sep 17 00:00:00 2001 From: Nikola Tesic Date: Wed, 5 Apr 2023 04:32:49 -0700 Subject: [PATCH 4/8] [TA] Introduce forward Taint Analysis --- .../include/Analysis/TaintAnalysis.h | 11 + .../lib/Analysis/TaintAnalysis.cpp | 229 +++++++++++++++++- 2 files changed, 232 insertions(+), 8 deletions(-) diff --git a/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/TaintAnalysis.h b/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/TaintAnalysis.h index 1ffe797f31..772b0e6f35 100644 --- a/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/TaintAnalysis.h +++ b/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/TaintAnalysis.h @@ -82,6 +82,8 @@ class TaintAnalysis { ConcreteReverseExec *CRE = nullptr; RegisterEquivalence *REA = nullptr; + // Used for functions out of the backtrace. + SmallVector TL_Of_Call; public: TaintAnalysis(StringRef TaintDotFileName, StringRef MirDotFileName, bool PrintPotentialCrashCauseLocation); @@ -105,6 +107,15 @@ class TaintAnalysis { void startTaint(DestSourcePair &DS, SmallVectorImpl &TL, const MachineInstr &MI, TaintDataFlowGraph &TaintDFG, RegisterEquivalence &REAnalysis); + bool forwardMFAnalysis(BlameModule &BM, const MachineFunction &MF, + TaintDataFlowGraph &TaintDFG, + unsigned levelOfCalledFn = 0, + SmallVector *TL_Of_Caller = nullptr, + const MachineInstr *CallMI = nullptr); + bool propagateTaintFwd(DestSourcePair &DS, SmallVectorImpl &TL, + const MachineInstr &MI, TaintDataFlowGraph &TaintDFG, + RegisterEquivalence &REAnalysis, + const MachineInstr *CallMI = nullptr); void addNewTaint(TaintInfo &Ti, SmallVectorImpl &TL, const MachineInstr &MI, TaintDataFlowGraph &TaintDFG, std::shared_ptr crashNode); diff --git a/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp b/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp index 27fe910376..51f08d69bb 100644 --- a/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp +++ b/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp @@ -595,7 +595,7 @@ bool crash_analyzer::TaintAnalysis::continueAnalysis( void crash_analyzer::TaintAnalysis::printTaintList( SmallVectorImpl &TL) { if (TL.empty()) { - LLVM_DEBUG(dbgs() << "Taint List is empty"); + LLVM_DEBUG(dbgs() << "Taint List is empty\n"); return; } LLVM_DEBUG(dbgs() << "\n-----Taint List Begin------\n"; @@ -957,7 +957,7 @@ bool llvm::crash_analyzer::TaintAnalysis::propagateTaint( // If empty taint list, we do nothing and we continue to // to propagate the taint along the other paths if (TL.empty() && !StartCrashOrder) { - LLVM_DEBUG(dbgs() << "\n No taint to propagate"); + LLVM_DEBUG(dbgs() << "\n No taint to propagate\n"); return true; } @@ -1103,6 +1103,193 @@ bool llvm::crash_analyzer::TaintAnalysis::propagateTaint( return true; } + +// Simplified version of propagateTaint, but in the oposite (forward) direction. +bool llvm::crash_analyzer::TaintAnalysis::propagateTaintFwd( + DestSourcePair &DS, SmallVectorImpl &TL, const MachineInstr &MI, + TaintDataFlowGraph &TaintDFG, RegisterEquivalence &REAnalysis, + const MachineInstr *CallMI) { + + TaintInfo SrcTi, DestTi; + SrcTi.Op = DS.Source; + SrcTi.Offset = DS.SrcOffset; + DestTi.Op = DS.Destination; + DestTi.Offset = DS.DestOffset; + + if (!SrcTi.Op) + return true; + + const auto &MF = MI.getParent()->getParent(); + auto TII = MF->getSubtarget().getInstrInfo(); + + // FIXME: Define better terminating criteria for forward analysis? + if (SrcTi.Op->isImm()) { + auto DestTaint = isTainted(DestTi, TL, &REAnalysis, &MI); + if (DestTaint.Op == nullptr) + return true; + // Propagate dereference level (from crash) from the Taint (DestTi) to the + // SrcTi. This propagation is in the backwards direction. + SrcTi.DerefLevel = DestTaint.DerefLevel; + SrcTi.propagateDerefLevel(MI); + + Node *constantNode = new Node(MF->getCrashOrder(), &MI, SrcTi, false, true); + // FIXME: Improve this code. + // This will be used to indentify call instruction when analyzing fns out of + // bt. + if (CallMI) + constantNode->CallMI = CallMI; + std::shared_ptr constNode(constantNode); + auto &LastTaintedNodeForTheOp = TaintDFG.lastTaintedNode[DestTaint.Op]; + TaintDFG.addEdge(LastTaintedNodeForTheOp, constNode, EdgeType::Dereference); + // FIXME: The LastTaintedNode won't be used any more, no need for this line? + TaintDFG.updateLastTaintedNode(SrcTi.Op, constNode); + constNode->Depth = LastTaintedNodeForTheOp->Depth + 1; + // We have reached a terminating condition where + // dest is tainted and src is a constant operand. + removeFromTaintList(DestTaint, TL); + return false; + } + + // Check if SrcTi is already tainted. + auto Taint = isTainted(SrcTi, TL, &REAnalysis, &MI); + // If SrcTi is not tainted, check if the base reg is tainted. + if (Taint.Op == nullptr && SrcTi.Offset) { + TaintInfo SrcBase; + SrcBase.Op = SrcTi.Op; + Taint = isTainted(SrcBase, TL, &REAnalysis, &MI); + } + + // If Destination is not tainted, nothing to do, just move on. + if (Taint.Op == nullptr) + return true; + + // Propagate dereference level (from crash) from the Taint to the DestTi. + // This propagation is in the forwards direction. + DestTi.DerefLevel = Taint.DerefLevel; + // Inverse DestTi.propagateDerefLevel(MI); + if (TII->isStore(MI)) + DestTi.DerefLevel -= 1; + else if (TII->isLoad(MI)) + DestTi.DerefLevel += 1; + + // Add new TaintDFG node for the DestTi. + if (addToTaintList(DestTi, TL)) { + Node *newNode = new Node(MF->getCrashOrder(), &MI, DestTi, false); + if (CallMI) + newNode->CallMI = CallMI; + std::shared_ptr newTaintNode(newNode); + assert(TaintDFG.lastTaintedNode.count(Taint.Op) && + "Taint Op must be reached already"); + auto &LastTaintedNodeForTheOp = TaintDFG.lastTaintedNode[Taint.Op]; + // Set new node depth. + newTaintNode->Depth = LastTaintedNodeForTheOp->Depth + 1; + + if (LastTaintedNodeForTheOp->TaintOp.Op->isReg() && + LastTaintedNodeForTheOp->TaintOp.Offset && + newTaintNode->TaintOp.Op->isReg() && + (LastTaintedNodeForTheOp->TaintOp.Op->getReg() == + newTaintNode->TaintOp.Op->getReg())) + TaintDFG.addEdge(LastTaintedNodeForTheOp, newTaintNode, + EdgeType::Dereference); + else + TaintDFG.addEdge(LastTaintedNodeForTheOp, newTaintNode); + TaintDFG.updateLastTaintedNode(DestTi.Op, newTaintNode); + + // TODO: Handle cases where we don't remove the Taint, like struct field + // access. + removeFromTaintList(Taint, TL); + } + printTaintList(TL); + return true; +} + +// Simplified version of runOnBlameMF, but in the oposite (forward) direction. +// Idea is to propagate the Taint from parameter (function entry point) to the +// program point, where the parameter's value is set. +bool crash_analyzer::TaintAnalysis::forwardMFAnalysis( + BlameModule &BM, const MachineFunction &MF, TaintDataFlowGraph &TaintDFG, + unsigned levelOfCalledFn, SmallVector *TL_Of_Caller, + const MachineInstr *CallMI) { + LLVM_DEBUG(llvm::dbgs() << "### MF - forward analysis: " << MF.getName() + << "\n";); + printTaintList(*TL_Of_Caller); + + // Run the forward analysis to compute register equivalance. + RegisterEquivalence REAnalysis; + REAnalysis.init(const_cast(MF)); + REAnalysis.run(const_cast(MF)); + + // Per function : Map MBB with its Taint List + DenseMap> MBB_TL_Map; + // Initialize all the MBB with emtpty taint list + for (const MachineBasicBlock &MBB : MF) { + SmallVector _tmp; + MBB_TL_Map[&MBB] = _tmp; + } + + auto TII = MF.getSubtarget().getInstrInfo(); + + // Perform forward analysis on the MF. + for (auto MBBIt = ipo_begin(&MF.front()), MBBIt_E = ipo_end(&MF.front()); + MBBIt != MBBIt_E; ++MBBIt) { + auto MBB = *MBBIt; + SmallVector &TL_Mbb = MBB_TL_Map.find(MBB)->second; + + // Initialize Taint list for a MBB + for (const MachineBasicBlock *Pred : MBB->predecessors()) { + mergeTaintList(TL_Mbb, MBB_TL_Map.find(Pred)->second); + } + if (MBB->pred_empty()) + mergeTaintList(TL_Mbb, *TL_Of_Caller); + TL_Of_Caller->clear(); + + // If Taint List for an MBB is empty, then no need to analyze this MBB + printTaintList(TL_Mbb); + if (TL_Mbb.empty()) + continue; + + for (auto MIIt = MBB->begin(); MIIt != MBB->end(); ++MIIt) { + auto &MI = *MIIt; + + // Stop analyzing this MBB. + if (MI.isBranch() || MI.isReturn()) + break; + + // Skip push. + if (TII->isPush(MI)) + continue; + + // Forward analysis doesn't step into nested calls, that is done in + // the backward analysis (runOnBlameMF). + if (MI.isCall()) + continue; + + auto DestSrc = TII->getDestAndSrc(MI); + if (!DestSrc) { + MI.dump(); + LLVM_DEBUG(llvm::dbgs() + << "haven't found dest && source for the MI\n";); + bool toContinue = continueAnalysis(MI, TL_Mbb, REAnalysis); + if (!toContinue) { + WithColor::error(errs()) + << "MIR not handled; Unable to propagate taint analysis\n"; + abortAnalysis = true; + return false; + } + continue; + } + + printDestSrcInfo(*DestSrc, MI); + propagateTaintFwd(*DestSrc, TL_Mbb, MI, TaintDFG, REAnalysis, CallMI); + } + // At the end, if we didn't find the blame in this function, the + // TL_Of_Caller should contain locations to continue backward analysis of + // this function (including nested calls). + mergeTaintList(*TL_Of_Caller, TL_Mbb); + } + return true; +} + void crash_analyzer::TaintAnalysis::setCRE(ConcreteReverseExec *cre) { CRE = cre; } @@ -1123,7 +1310,7 @@ bool crash_analyzer::TaintAnalysis::runOnBlameMF( BlameModule &BM, const MachineFunction &MF, TaintDataFlowGraph &TaintDFG, bool CalleeNotInBT, unsigned levelOfCalledFn, SmallVector *TL_Of_Caller, const MachineInstr *CallMI) { - LLVM_DEBUG(llvm::dbgs() << "### MF: " << MF.getName() << "\n";); + LLVM_DEBUG(llvm::dbgs() << "### - backward MF: " << MF.getName() << "\n";); // Run the forward analysis to compute register equivalance. RegisterEquivalence REAnalysis; @@ -1301,12 +1488,17 @@ bool crash_analyzer::TaintAnalysis::runOnBlameMF( if (MI.isCall() && levelOfCalledFn < FrameLevelDepthToGo) { // mergeTaintList(TL_Mbb, TaintList); Is this needed (as above) ? const MachineOperand &CalleeOp = MI.getOperand(0); + TL_Of_Call.clear(); // check this // TODO: handle indirect calls. if (!CalleeOp.isGlobal()) continue; + bool runFwAnalysis = + areParamsTainted(&MI, TL_Mbb, &TL_Of_Call, TaintDFG, *REA); + bool runBwAnalysis = shouldAnalyzeCall(TL_Mbb); + auto TargetName = CalleeOp.getGlobal()->getName(); - if (!shouldAnalyzeCall(TL_Mbb)) { + if (!runBwAnalysis && !runFwAnalysis) { LLVM_DEBUG(llvm::dbgs() << "Not Analyzing function " << TargetName << "\n"); continue; @@ -1314,8 +1506,9 @@ bool crash_analyzer::TaintAnalysis::runOnBlameMF( MachineFunction *CalledMF = getCalledMF(BM, TargetName.str()); if (CalledMF) { CalledMF->setCrashOrder(MF.getCrashOrder()); - runOnBlameMF(BM, *CalledMF, TaintDFG, true, ++levelOfCalledFn, - &TL_Mbb, &MI); + if (runBwAnalysis) + runOnBlameMF(BM, *CalledMF, TaintDFG, true, levelOfCalledFn + 1, + &TL_Mbb, &MI); CalledMF->setCrashOrder(0); continue; } else { @@ -1328,10 +1521,27 @@ bool crash_analyzer::TaintAnalysis::runOnBlameMF( } else { // Handle it. MFOnDemand->setCrashOrder(MF.getCrashOrder()); - runOnBlameMF(BM, *MFOnDemand, TaintDFG, true, ++levelOfCalledFn, - &TL_Mbb, &MI); + if (runBwAnalysis) + runOnBlameMF(BM, *MFOnDemand, TaintDFG, true, + levelOfCalledFn + 1, &TL_Mbb, &MI); + + MFOnDemand->setCrashOrder(MF.getCrashOrder() + 1); + if (runFwAnalysis) { + printTaintList(TL_Of_Call); + forwardMFAnalysis(BM, *MFOnDemand, TaintDFG, + levelOfCalledFn + 1, &TL_Of_Call, &MI); + if (!TL_Of_Call.empty()) { + printTaintList(TL_Of_Call); + runOnBlameMF(BM, *MFOnDemand, TaintDFG, true, + levelOfCalledFn + 1, &TL_Of_Call, &MI); + } + mergeTaintList(TL_Mbb, TL_Of_Call); + LLVM_DEBUG(llvm::dbgs() << "### Return to backward analysis: " + << MF.getName() << "\n";); + } MFOnDemand->setCrashOrder(0); } + continue; } else { LLVM_DEBUG(llvm::dbgs() << "#### Callee not found: " << TargetName << "\n";); @@ -1370,6 +1580,9 @@ bool crash_analyzer::TaintAnalysis::runOnBlameMF( if (!TaintResult) Result = true; } + // Consider updating TL_Of_Caller to be available in the parent call? + if (CalleeNotInBT) + mergeTaintList(*TL_Of_Caller, TL_Mbb); } resetTaintList(*CurTL); setREAnalysis(nullptr); From 2bd22b9461d43ecff4ed072b4fec83c9ce89370e Mon Sep 17 00:00:00 2001 From: Nikola Tesic Date: Wed, 5 Apr 2023 08:44:41 -0700 Subject: [PATCH 5/8] [TA] Analysis of already decompiled functions --- .../lib/Analysis/TaintAnalysis.cpp | 60 ++++++++++++++----- .../test/Analysis/alias1.mir | 3 +- .../test/Analysis/taint-dest-base-reg.test | 2 +- 3 files changed, 48 insertions(+), 17 deletions(-) diff --git a/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp b/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp index 51f08d69bb..a657602fcf 100644 --- a/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp +++ b/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp @@ -1310,7 +1310,7 @@ bool crash_analyzer::TaintAnalysis::runOnBlameMF( BlameModule &BM, const MachineFunction &MF, TaintDataFlowGraph &TaintDFG, bool CalleeNotInBT, unsigned levelOfCalledFn, SmallVector *TL_Of_Caller, const MachineInstr *CallMI) { - LLVM_DEBUG(llvm::dbgs() << "### - backward MF: " << MF.getName() << "\n";); + LLVM_DEBUG(llvm::dbgs() << "### MF - backward analysis: " << MF.getName() << "\n";); // Run the forward analysis to compute register equivalance. RegisterEquivalence REAnalysis; @@ -1365,16 +1365,10 @@ bool crash_analyzer::TaintAnalysis::runOnBlameMF( for (auto MIIt = MBB->rbegin(); MIIt != MBB->rend(); ++MIIt) { auto &MI = *MIIt; - if (MI.getFlag(MachineInstr::CrashStart)) { + // Consider crash-start instruction when analyzing functions from the + // backtrace. + if (!CalleeNotInBT && MI.getFlag(MachineInstr::CrashStart)) { CrashSequenceStarted = true; - // If this was a call to a function that isn't in the bt, - // the analysis will start from the last intr (return), so - // we need just to consider the taint operands from the MBB - // where it got called. - if (CalleeNotInBT) { - mergeTaintList(TL_Mbb, *TL_Of_Caller); - continue; - } // For frames > 0, skip to the first instruction after the call // instruction, traversing backwards. @@ -1473,8 +1467,22 @@ bool crash_analyzer::TaintAnalysis::runOnBlameMF( continue; } - if (!CrashSequenceStarted) - continue; + // Skip until crash-start instruction. + if (!CrashSequenceStarted) { + // If we analyze call out of the backtrace, even if the function + // is already decompiled (is in the backtrace as well), do not + // skip. + if (!CalleeNotInBT) + continue; + // For functions out of the BT, start TA from the last instruction. + CrashSequenceStarted = true; + // If this was a call to a function that isn't in the bt, + // the analysis will start from the last intr (return), so + // we need just to consider the taint operands from the MBB + // where it got called. + mergeTaintList(TL_Mbb, *TL_Of_Caller); + TL_Of_Caller->clear(); + } // Update the register values (including PC reg), so we have right // register values state. @@ -1488,7 +1496,7 @@ bool crash_analyzer::TaintAnalysis::runOnBlameMF( if (MI.isCall() && levelOfCalledFn < FrameLevelDepthToGo) { // mergeTaintList(TL_Mbb, TaintList); Is this needed (as above) ? const MachineOperand &CalleeOp = MI.getOperand(0); - TL_Of_Call.clear(); // check this + TL_Of_Call.clear(); // TODO: handle indirect calls. if (!CalleeOp.isGlobal()) continue; @@ -1509,6 +1517,25 @@ bool crash_analyzer::TaintAnalysis::runOnBlameMF( if (runBwAnalysis) runOnBlameMF(BM, *CalledMF, TaintDFG, true, levelOfCalledFn + 1, &TL_Mbb, &MI); + CalledMF->setCrashOrder(MF.getCrashOrder() + 1); + // If parameter is tainted, run analysis from the function entry point + // (forward), to the point where the parameter value is set. + if (runFwAnalysis) { + printTaintList(TL_Of_Call); + forwardMFAnalysis(BM, *CalledMF, TaintDFG, levelOfCalledFn + 1, + &TL_Of_Call, &MI); + // If there is a Taint left after the forward analysis, run backward + // analysis for the same TaintList. (ex. one parameter sets the + // value of another) + if (!TL_Of_Call.empty()) { + printTaintList(TL_Of_Call); + runOnBlameMF(BM, *CalledMF, TaintDFG, true, levelOfCalledFn + 1, + &TL_Of_Call, &MI); + } + mergeTaintList(TL_Mbb, TL_Of_Call); + LLVM_DEBUG(llvm::dbgs() << "### Return to backward analysis: " + << MF.getName() << "\n";); + } CalledMF->setCrashOrder(0); continue; } else { @@ -1526,10 +1553,15 @@ bool crash_analyzer::TaintAnalysis::runOnBlameMF( levelOfCalledFn + 1, &TL_Mbb, &MI); MFOnDemand->setCrashOrder(MF.getCrashOrder() + 1); + // If parameter is tainted, run analysis from the function entry + // point (forward), to the point where the parameter value is set. if (runFwAnalysis) { printTaintList(TL_Of_Call); forwardMFAnalysis(BM, *MFOnDemand, TaintDFG, levelOfCalledFn + 1, &TL_Of_Call, &MI); + // If there is a Taint left after the forward analysis, run + // backward analysis for the same TaintList. (ex. one parameter + // sets the value of another) if (!TL_Of_Call.empty()) { printTaintList(TL_Of_Call); runOnBlameMF(BM, *MFOnDemand, TaintDFG, true, @@ -1580,7 +1612,7 @@ bool crash_analyzer::TaintAnalysis::runOnBlameMF( if (!TaintResult) Result = true; } - // Consider updating TL_Of_Caller to be available in the parent call? + // Update TL_Of_Caller to be available in the parent call. if (CalleeNotInBT) mergeTaintList(*TL_Of_Caller, TL_Mbb); } diff --git a/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/alias1.mir b/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/alias1.mir index f7a4a48f00..8a839324c8 100644 --- a/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/alias1.mir +++ b/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/alias1.mir @@ -11,11 +11,10 @@ # return 0; #} -# XFAIL: * # RUN: %llvm-crash-analyzer-ta %s | FileCheck %s # CHECK: Blame Function is foo -# Currently, we do not analyze function calls with tainted parameters +# Analyze function calls with tainted parameters. --- | ; ModuleID = 'a.out' diff --git a/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/taint-dest-base-reg.test b/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/taint-dest-base-reg.test index e3faeea878..8caa533bf8 100755 --- a/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/taint-dest-base-reg.test +++ b/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/taint-dest-base-reg.test @@ -33,7 +33,7 @@ # RUN: %llvm-crash-analyzer --debug-only=taint-analysis --core-file=%S/Inputs/core.taint-dest-base-reg %S/Inputs/taint-dest-base-reg.out < %s 2>&1 | FileCheck --check-prefix=CHECK-DEBUG %s -# CHECK-DEBUG: MF: crash +# CHECK-DEBUG: MF - backward analysis: crash # CHECK-DEBUG-EMPTY: # CHECK-DEBUG-NEXT: crash-start MOV32mr $rcx, 1, $noreg, 4, $noreg, $eax ## Print Destination Source Pair for the MachineInstr above. From 10a9db91340e6f522899f919570573569f1c052a Mon Sep 17 00:00:00 2001 From: Nikola Tesic Date: Wed, 5 Apr 2023 08:51:27 -0700 Subject: [PATCH 6/8] New tests for tainted params analysis --- .../Inputs/core.taint-param-decompiled | Bin 0 -> 270336 bytes .../Inputs/core.tainted-param-inside-blame | Bin 0 -> 270336 bytes .../Inputs/core.tainted-params-outside-blame | Bin 0 -> 270336 bytes .../Inputs/taint-param-decompiled.out | Bin 0 -> 19488 bytes .../Inputs/tainted-param-inside-blame.out | Bin 0 -> 19520 bytes .../Inputs/tainted-params-outside-blame.out | Bin 0 -> 19592 bytes .../test/Analysis/taint-param-decompiled.test | 33 +++++++++++++++ .../Analysis/tainted-param-inside-blame.test | 35 ++++++++++++++++ .../tainted-params-outside-blame.test | 38 ++++++++++++++++++ 9 files changed, 106 insertions(+) create mode 100644 llvm-15.0.3/llvm-crash-analyzer/test/Analysis/Inputs/core.taint-param-decompiled create mode 100644 llvm-15.0.3/llvm-crash-analyzer/test/Analysis/Inputs/core.tainted-param-inside-blame create mode 100644 llvm-15.0.3/llvm-crash-analyzer/test/Analysis/Inputs/core.tainted-params-outside-blame create mode 100755 llvm-15.0.3/llvm-crash-analyzer/test/Analysis/Inputs/taint-param-decompiled.out create mode 100755 llvm-15.0.3/llvm-crash-analyzer/test/Analysis/Inputs/tainted-param-inside-blame.out create mode 100755 llvm-15.0.3/llvm-crash-analyzer/test/Analysis/Inputs/tainted-params-outside-blame.out create mode 100644 llvm-15.0.3/llvm-crash-analyzer/test/Analysis/taint-param-decompiled.test create mode 100644 llvm-15.0.3/llvm-crash-analyzer/test/Analysis/tainted-param-inside-blame.test create mode 100644 llvm-15.0.3/llvm-crash-analyzer/test/Analysis/tainted-params-outside-blame.test diff --git a/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/Inputs/core.taint-param-decompiled b/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/Inputs/core.taint-param-decompiled new file mode 100644 index 0000000000000000000000000000000000000000..61d8f627048e0e81c4ce7680fd0257955480d68a GIT binary patch literal 270336 zcmeEP3t$x0)xNt~!V&{nAZS!tMvNNNBpY6aN9-gdu+ac(5-hEc>?T=AAjvM-4Mfzk zylg^1gH@}2*wtcxwARK}E4CJwhl;I__^6_`HoigBMp48^&42FPb2ghH5v6GV_CFVH zzPaa~bMCp{y>n-FXLe>qQOQiJ#Ud!##Mz>^B!o^Caj1)2F#^jrL?>;;>B-Gck1+|b zDBBn$w>9}kCf)cO`{TeZ6G}UyDJN-qXhWe%Utn3zZqy9C z_wnKtF)Q$c+tCx%MqGP_z=QS9VW0G|L$T-{qqgGgjQ)|GmetozM?=CmJEMOQtoNAg zG?WvX?V?y8HreSYCycW*c%j)6HQAw_=(H*aadt+W4ml!_oOAp3&#AhDK$(Gv<~S zN&Wa;Jbqi&$u!L|MSL_YH-<`j=->MXA1eDIlFo;=8eF+;x}hF@P?gEnij?Ds2<>t; zR|%0hn#p1h`Xha+Hwc11rGr#E6R?3qtJ0))&p^3;mT7KNKm#DPCpm6`EZZfHMJXE1 z)Qydq?<9%iVav>IJ*p98W!G!8eKb(U7KU6rtGJ9}qcNxWiLay4-WTyfb5icF6w^s$ zi2DPLRkyKI_fGGgPkxyqRZ$$P7>@SUh}0(?cR<=}a9A~uzAU9_W|fb?k2 z5{GhJWlBaxDi6i79CMk5DKO@M+&m7;1f+NCpVYo^0#@LzAn>Ro-tSTM1__{ZFY1#Y zLfOA7z__TScqVbIB83WCBaj>6(8&zZqwtVpF3L59G=BsgW6j4*Dr;*0y^jpAEIdm7 z2a;o1gq8e$l1EipwCD6ahS0GA*ZNEqwGg!SN7XSP3+34j{z`Av;-)}$L&z7bt;%-i z&&Ytp!jSlQzUu6H@qgA= zQ?N0+uC{XWMESQWb9~nL+^nEqWPb(n>VCZ+PKw7rn45BL)7)G^J1mVMVi+cV+)>U{ z`|m5lIxR{HD@uwBO7lyFPu1sc?>z>Ti8H1BH79CjPDZBPDeY! z2-A<;wE1gbOPOXsHM%;wz5nUg2Nm4U4BM!%(hsXJ@VJR=Y} z-bh8PEXR@Nfg!{{)P~fT+mz#V4!1oH6tsSncO|~M2nt%f0JqBrkPCS=M0R(w zsHl+J6~U0VF;r0x7kV zz;a=|zX2^Plxn|0q3k=9sM8pYqL*U8~=+yV?fbd5k7pYoj4+Pp513PWukSRMzLbUEKP_#je(uU8`U1 zc9$1F6m=)+!u8O$F1T>+dg!5cfSyr{!2JDoslQ`ER?3()hIzYdLtd-&yJ65O2~!S+ zMnO}Pv8f?FT`6P2Qga6)=zqu1pHwPg+-I(BpC!0jyItG%e9L8d(DlS;p;T}%6dl-m zx)!92DeSeE?T7P*L$zocInUMl+MeZbh5x}pJxQ9dT(qNo$AaGAQpV^;|M#uyl}Qs< z>*WVqo8E7m{l2TM=wPe;qPPwj^{d}<$`~Ww{BIYx zKAV4jaqEHndHJpX%r7t5aLPoxCg!;|WJ)Y68TXnT(>-H81E1UenGhP2^8)f)()w{p z>w&`7f8_V1{?)a5hs8DJZ%uE?@xI`q{0s9h%D*_jBAz2-JRu^9#yr89A?I&=vYePO z4TizEPQLq}Jv|=SwnOtFz+HeXfO`Np1ExXeb^+D^N)mPhI&pHRLRluu@={@Gc34hK z9&B%iI=TMHV@Cjd8yB|<2Ro$933)xp=olh(WE{EB*0F#hf0*M6>x`j^=Yb(VY&IkocY5t3WjL~!_o?dISPi^jsCm^<`M8iu}gQHm;q*h8DIvO zfv z+el;&hi4<64%CNJ6{Af2bYuA!SdZraHsH_y9)o-S{I8}U?U#g|IB^MS9`oma{``-h zsrmCifBuhsfy1Bw@%sb*{Qqw|r{RW~0cL<1U|3~jszxDdB`TRfnK;Pf3 z z^f7v3kP!0z|77@kt~jTk`~Q^z*+uZSPeQtXLVB0?as-mq9U*3<`#uQey_+)0>(8He z|KnSCt2;^vh0vs#VJGheao?lr-SC|jiTtjN+H?F@THw+pR)7pQ+9;ictMhBZ=>R(5$YL5_y#o$EVBP{8ZzeT9NZQh1QpU-R? zda3QP{dq6^=DFQl?vk-dex%JnzgHj~IrpRv3~N-%aG1n?*f8#O0w=~#MVyYph-S64 zB)s1KK+$@!Q_L5G*NDLOux04F>RAVL^sS3_EgX2u%-*Vz)SNoo@W10fuI{ zLvPW;cZ-vD6>M7_d12FhtKH^w4|dqB?SnDK}!-g&)~!vD<|th%NMT*E#U%3c&GD~ zoneniUTIrr@#ql^D7055*u|=2tvL?6xHUba(%}f5P^k%vHA!>idpw)R+N|!esWz=; zMCIb7#J_GnUaz!SEz(lhthw%+3Ja61AFa}BG+S8LCOJ0Ux+`2VJXK58MC;0AG3YYK z=;ZAq3N2!##bQf#4B9oj%eFNmEF7aW5e7EwbrwBmrQNnPY(L#OR_k;nTJ(p93>OcJ zt6!KpSzDE!-*v^Db9ZWUgbn`PV(Hj9JTP;4Qbv2`57N7ZHOZ13F4Jwc?O{*AA;PJa z!JYQ7-5#-5Y6aJghhYOP+b7bMuzW`;%i&{S7?3rxP$ zH8zLcDmgtvDc4mk647=BkZ?C zhl=(g!kRifV{}-AGjw~{0$!k9A$0Mw$VkhDi5LCRe)nu)+1euXZ#$xalUI(e8`a@R ze`?q!`?_OW2A$rruJn4%QJj>VJ|(T7J>8;p>b6y*9J)i)I6UEXV!b9x-h?~h9TP4T zE3IMIqR3b=Ze^NYuqJnC;mPZ-4_hXRjIb^BIN?qb8A%RJlqcF9+9^YHkrYTMhDd~6 zAL_P6t);f)d|`>qcRcL!>so$VczQKFlf5KwXb*;cLOC*Ac}BVw3IEm8aTPYxV=-r&d|kIji+;Pe-28;0H4H^x93^ zMmpSuE5}<)E%tUX#Pdklp5)0Gy4sP@9<_$-!jcvSaw6dw37+BN)+rq}dqlr!RoGK- z%_-BJ&vb4|OT04e-jpe5OFk?YF#AQ~bz-F6v9Me#)P?1oN%=#BJ-?$} zj}E!nYTGz7*=E0Dls4Am5LQR@`qXps!=bA+Zg-NQdw-$P>BlJ@3>Vx4+2A`zq z+akZw!ov&1HPvogM)cvL840$CwY|U=St&Bs*m8GTY#tFE`oQk1yTY&*xolyFu-MX) zQ`T;bXZ@xj?avKfX>|?XIDbg{>8~Y~iFb4srY%OVl3z(Z)hof-_usayV?a*h|GcO(cyH&?}20LqykXgC9N(8R@o)mKmb6 z<(&LzVB$E(TQd@_7C8y&s~3qcX z5J95rm5dybIC`wUMPF0kvO2;u!|P{>IcFq|g{gaHqh_;2R@xm9Rl>%WGZQR@YZ8Xs zJj?TvKHTQG-BzjFZE2IijZLKLQ<7}O-__D?vN-JLY!>YmwHw@M)l|;oTty! zhUK`P3Troc3bvo5i@fx)kuF_KNF08Wu2tJDZae&5XLxw^kHiUD`5NZD)Wu(|H!adffb7l`4DXiPKT^RmNQ6>;Y`TIkk5f!0(lPPa>(aHo)7sukS~BN(}j>PhFl5R2YC_X zI><7~d!&~@4nl5%ybSWCkXJxn33)B#??Z+)MQniF4tXQwA3**gWSMS&{1eDOgM1U@ zpF@`E7m($ScPr%EAm0J`PRPH5d=KO;kne?jALOl&w?WsfQEaWuECqVutz1-SrnA>^5m&w*S5xfJqz$QMGcfb4}#$p_nuuv`b&0C@@I zAmk><%OPI|`FoI8Kn_EO`7BmLmZ=4>74mw>S3$l8@(&^Z81hdcM`R9;tfqX0E zUqZeEatGu)A>Rf0caZOeET7H#N67a>-VXUe$h#mv0$HX<0iT5YG~~ZPeh%{UkY9xS z669APzY6&^$ge}*3wa;pcObtDc|YV2ARmBCzd8Q|wm*Xm=S6VB3gZVk5wc9j0475o z3ONO`1M&#SBO#B1oCbL`-U^kY)Nd;CFFbmM?_u3dog^eUKMIu7SJ=@?yw! zko}MYke5IXL2iQF40$s7qn*;KHLZJLVin+Z;Ooz5`#9oHpgp-R%X0}zrC|F#&<%hf8QLv_?fsBtx?h2@u5Sj}XVBo? z;7cCA-@`UPjq8I4WE&y=9cbr`>+7FEes5g-KZ3ISQt9_#9|WIE!FG5Yk2N5F0qR$Q zuX?}^~zI#Adrjr$jhd}R2wEHRAB!bRQF{Ud)?{_Fi z6Naydfv%8xw!CMv!tR^iH}1QOUNFRX*1YpVg&xExqN75|g%|Y@!-(C8dZns&@B7s7 z+f{}7)e3dQD5CSEK}NfsSa$f7p2IuXkn33PLhL~FEKqvdckG5<7|R`qU5Ji_*e;@| z!SW-Y^n1Ud`ynNd+L~9-dH63%-j3)& zB)tHZk97DWXDI)kz(@VY-!)FvJ2Djp#w$Er{P2nbH43BuRQ(btKhpR+rYe8>$qL<*6*|vU*pBsw%%5qhp5iyp|1Ud#{?+(9Fz)}f z_-X#=rHapvIeq!3{Wo&Hl6T&yP|Q?F{CDI07xR=n@V=TK1I?cZ>HmxK#~gq6*A#zr zBl2*Rwn~VRW=`g z9e-7Fn*X%^M9|-tJ^mi)`V+x!SwJGz4^ekz;Md6;^${?}Ee^@q+M z0@ta2(EOqEH#&caV!e*%2{eCb{WPCHd|m4&#qYu6{ebb~dgr{U@BF9u19*Nw=RX6* zf3(+6ivMuuZ*=_nSI>Wr*71w>-=nqueBJvm#jj0GG(H#otLx`i9e>v(eAn3k3xp@A zKCguv6^ekuXh>lM<(+=4M?X<4M-V-TF}Ai_4mZ~y+735A+{qn3)a?ke^y3m!p&L$J- zR~=OS`~G_hn-QJ=Q02>?SNQk~3Ok=w_ym^k{XmtU!ZP`dAipIGR6Lup+<~|SF^aeg zu@iAOVi)4kj?<}VfD583$!nJ~O;B*ibxe8DSf;ZSz#WDvO+hTi@9o41ijT-YkpJfq zuTn_-Y(iepd_d4}o%D+9LSN(f9Zqh z_zTX97Z4BrRq;be^VQrgm5;RjEObEad|7-6<2_RR&H>fWFKcg(^UK=*tNKl+DdO(m z`hhWo=CU34M;af(fyVJj$B(|Qe*43|^M&}K@%^gWm-hq6^a{>{HxTzB{sVD8;)jTz zAod_8;(Q;9I0|tLVg_P1VlLuzL>;jZ(S=xo=te9@oR4@Rq6e`Wu?8`KcnRVPMDo8D z%j*!YLc9(!g18y+PQ>3M{t+>X_!q<%5#KRsp(~k8zmT$-MeTa`B{uS{p#7_~Eeag>h#4{16BbFduh**Q| zv>?`@d<`P`{|S~m5O-1;?RFy`MAT|j99`rG(S`B|;x5E)#7B^i!{L4$kE!=LjYHfA zSpE?4BU72i?-P`3wJJVZN51NL`c?Csi~ahl_T#U59@2hxr0X|a1~k$*JmHb|KFLJm zt4eUq@(9kar7c~C9Qn8Yj}J7z%y_igABr95I8M!5b2|f-sow+Do8{(s$)4~?`J?l* zv4`RBt7@Mv_tN?>P&-H3KL-+YCibrj$H{@8k6b7}AF&#-5s}6rY$}tSa1GYCAZBE% z`AGda()dTx0ROvjqUukVsb3V997nk?M5ZXcFe26CtpMWezoVa`zMuDLotT03VrJiZ znkVOCy=JPX&r|1Ny>6Z(#W|M90gjz0ru{5zj$9A2EQq0`V%u8xenv_$cCLZ0{v3cO&*79`}lB zHyv>*Vlm<_w4aCNAmRqZ2;y%MA3^L!JL0=C#A^^c z5FbN)1@V1E`(B(Eh^HgwA2QhB#WYuq)UuOJ0>Tg5*Gh!#=tB4;X zTHjRhB_p1KcqU>2;ygs!PZwi(8R9C$D-nN;cnjk15Vs;eiTDQMr--ThR6Lo8GY~I8 zT!gp`aV?^m2QK%|z_rNN4TwKQyc_Xm#Q#CO9kB!PF2s8gw<7L9+=V#!Ej5mhV);qL z=MY~+dbDLBabY;OR)WK4bbQ@7(c}~ z2FvgYrGDc*1?$P3j%9c+f}uYf%XHpZYSLebtuBU7@IJXqtc_Aetb z{D?;RsqqIxac;!H+myVvp*Cdr!pd%xH~5s89PR0qFY`Apj=AbWdB7VCE~_SO`0W(Q z8~q`FmA{S*I!WGCSyx-N*mnt<>_T~CpsLpiY(-HX^ffN6t?DIc3&~C0?Lc`SCs1(w zT-~SIb+bYZ%T7ecCM7r9#mbviefWPA1`sqKO$D${;pQjZnG z4=X+QE`?D<2g(Cj_8`U#aYKJb*+rgKs6VC9@fU^K6AIfA9i6HyupB`>C)%6+Yj$;i zub!x|dyqm0mfeUQh-UltkxE~TP`DlMcQ&IN>&^CEsmiVc(SdpaEIYA0kiF+bWgi%g zey|+*Cd#pFZkNjLla-zavGWx4ldiBG<)m*$ZGzGZ=P1+>J&5gy-H2xUj_Jy-YpTKs zVieJh_1#!D+ed4ZopYhW-N?Tg!&q;&@2XXH9f&&W1+eVF@<8^124&w_udoZTeTgay ztk)3D?YCd0^gM{7U6rF)4qvIt?TB570YoR+5tS<5jzmOf1v6k zSdOBdAT;?O`J6i66D570uWN%ORZqtHj=BBU=V5)Iy#M;SSnrwNfBh1&uQAtKj7xkg zvECU{^kb)L?l;PGo&Vsk zRecir(Y$Ko7%bCoa_KxhiJ?^C1qtsT5p*~9o7_QX5AZ_V`&#m7fj|3@Mc z+c{dWS)LF=iYVxbB6c8dLEMGdiMR(5;x*Di#ON|L4vya`)H~F3>F49`%mS#l1?#CF zEm)tiP}zxyvJ0cUuv*ElNBisVR%I9ZvEQilJ=E@G^?S2VQBV9z=?CcdZW~qkRrD9R zM%nMWQpv+8x1+yYjLS*!Eyeb+tfSr*wAZgw^)qScbq@!Y_uQcDH1dxF6|GhB zF07|^>Xg8?DMt&1tMhkz7?Ke>%>a_KTG~{5RDfy;7AuuPW?Zt5Bbz{Avx# zU-aY8j5rDtRejfIs_ec})qAEZd0?_a?G=TdKwoVCKI&n=BIjYbNnr=}qy1d$$4g3X z?zbpZ@pYqr_q!^d_75;FtFm)rJ24)bm7K;kfbF*bQ`tqHS3I{*ReD;!LMQgyIZu^o zT*$9n=T^X?tpkoFVI0c!{LU$(Zg}OsTaJBnQ)uBg&$FC;+dB6gc+Q*mxJ35{qn0dQ zb7t%Di+=sXMXi%Ra=lQ#rZqM3iJr55($jXgZOKdDDPFhn@zv|k8nR^5L#4N#J#K?# z$J{Ynm%OlJ^qjkIKzbRu&PWZ8u5zwDVrfJ0L3czj6B(G?8TzHCLtD`S-B5)!`wS<2+O z%UsAhWLc&ZzfCgfe?AyXl!@eYewKjei_#XVSHwP7k)jDnpX|wwK5v=SV@1-RU}}#( zhs6|48>CP6)E<34GpWalr0+GgN1xkbilzCP6 z)E<5QGpWal+XiTlJ{QImO&io6*;9M;dC{aEE51KKd-ORnrfAxr_Q;;vqtBNn^;nTU zXVHEBhm`Sm1@!rB3*P^tU5>}Om3aJ)dF;EXupz=C;Qryv53d5HJ#67_0hbUbiAjL0;^!Z`U*VI4y9-ro^xqqI4`d9P$<17U+v`+sVGIBsTu8DIvO0cL<1UEdKVm)<$jADNvGs3$%V3ZWTl@^g=To_N<&s=n)~ zv4)(`GukK$2fY9U?WDG}bH1qToG&Un!gl;XMM#fvm(T5xIaiq-g6U8v6QR_VNutah z*bg&mP$!dS{8i6%mz!m;g{qIl&W(0EH>g0(SdASbq&Uw5J9^g(hVr>UqgjgW4KxlK zzMzH>=`}c!?}CvNXV#o~V&QEmqinx?eCO6r&hY+x+|QG4Skv`_3}8594KmVhJUd=? zLCzWZ?0p&k36SZ%Ft91;oiy@YH6tKPAM~Ca*ff%ie-vbT|BRd_BOyx;Y7^FNMF+UZhP_FcA1<0Jb@{gE+9|FWMlF4-R$r)*osBK!6CxBXW=yXfPa zN~{kr@!WiM;&XX*2VULw%{{vTD}JI_K_3ruF>!2Tugv zF2D7bg1fHRG34ax`=+~IoZtLYn||CocmHwis%yXB`GUA``?R(DMlTLe|IP151q=T1 zT>rb0)BAi*0dj_mcVq7Zkh(GrA3(kU>ZG5DMa`&}4Q=3R0R1kEr(M0SOcbI1 z_dq@zW{KWC){xMCbOY*#SEx91Q2$xfkG`w)Gf+Mca5zLHa2=9!LZ*$74IVto&o2zA z5I3VdivCxlT+TnK-`=M5cc5HHxps$=e~j{JMm!@#_-PdnwRAS7U;14L* zey!vo?C_t^zxy#IZ$bZQs2};QlAnR{+fc6K9(@kV&p>%snbN0Yf-DV}duo@8GZz=0 zK@eAeYH6^K&-rQH2}<-Y{wg;11o?Q$hQAN%`VD9Uk(AU_e5{}t?{ z+>YZ#cI48sR;vMhM=Jx2_`4SlbX;vNtLWpOOY4=0+JCcraAF)zyuLD;a|nLgzxYRTZ@j3;c#W z=DT7+qfd3U+E>}M&`?xmZ{xzHhHiX(;Gq^cizBw8QF$~()wLDy*4S7p&}w6-wqaof zyf;^NtiHq^>bZ&vAY8#rGGlBff z$rH1J{;ct0R!MQejEeDD?pkbF>| zZCR3<^iR$}3;ug=+U0}gaX}u3y44hi8hK2yh^7;2hftl|pJbAC2~az-wsxqjONT7i zQn^0F>)1diHBLvapHfHa$|U{BxYj;iWwaq>r=X71rF8I_vBoB?Kb;q1kk9s&(|Tk# z$pfD$PY#pZvtId0Gs)Y3rR17P-n~l6GfZ;#`$`@$$v2g%PV6?xb1zkL$L_xI{}%Oi zll*a%yG-)eQQmBle}eL`N$$aRx0vL|l&N^SP4Y1)&v>qHoMH6iG07*Q{`Drg3+0_A zxew*y`M&;_qug$iZ^m|Yle`n<%_jLe^wVLI--z-qll-?R-(!+*LwVW@edBx<<(f%; z@KVL+e3LxmG9_;}$@ie2T_*X*C>MY2+pZh^%=Ciz&D2Tbw_D36%rb5Xw8 zBwv8?E|Yu>%G3VVH_jVT?lQ@LhjO<`-i-ZfG0AtKe$*uILV34Iz8~cW|E}VZ=frfr zFIR$GJRdtnEeoRiMYaF#Mt%92LE2F2ijyl%RkJ5f9{*XOJ5Ek(7WtCcGwC;-W5s(t zr~DQmWsKOL^39KHWW{@XUxH`)wi{*H(0hBIh?V8gzPEQ~S$c-6wJzQ1+AzZ@jdN4R6{hPc<4V%qDdWo1Jt^ZZgh)9t1Iz$3zzi@0 z|K}O#qW2AN?)%*QL*CDa?@RxxJEWgASH1UES4ibU+P&qajV}&Q@CPn^e$rXD9v6SA za)>Gmn1TNk1~h*D$A8LDah%KmGr$ZST?U-$yys{+jlb3^eVR{{Iwl|8_KsHE?1vd( z2ABb6fEi#0m;q*h8DIvO0cL<1U2r8a}1Cq<5h&m>swzRO4?z$efThIqR%!_+?}^1tI+fmznjYo-?M0ahl_IEK%{}&qxm& zyX>10|6$rw{R=Lt$_$2lfy}BpZ^Ocz?1j~p)xM?KmGH~KP;FgseAa~V7+`dO_&PAY zEbQyyxQ)eU@cYHv??2w^MInE+ztNvvz0BLV0DkZof?t#RQ1$Q3quakj z+V3;}7gkkeS53^Ck~JYS;LMgk51u?x?P4&ft7vyxMp?6eD&y#uiW{dFRC zA-b{NgBU>U#(II}FqN^PfT>LF4}?ziW3Jax-htR|@*6Rg$v!fGKdL9}M7=2aM+_rU zyQJTZaw;Dwb{!=@N80|;wu|C8=r~WsHxC%|HQ9Ko$f2!uo91Qroob%Cmn%F8O!mVM z_2dIC|c0}`UHc3u?s44e7(~QlITqTh|$&619Q~YFaUbxhHCd}fPD~g-eFRB&gEY#d!(3p(>vhAUCF9*$^JVpOsJDfBvViejjMM!%XQBc!OsSyrbp;#Yaw3QN9%8 zCb@=k`FsPCNjx3pjmN8gQr%>f2Tk$iplpkl3 zFGYEpNghV|@h15?l(%oZF8*iF;#!n%G|3|ko4o3WZFw6J8jq5VTPxF)H@wQ)P`;>>(I%wWMa!^j~kk4r-H_zW9l*{LNkgh~M zz7V%f>l3YuRE|^OO=f@@Uygd&09V=P}Er>O6%2|8qCi> z`$F%R9AOhlqjHSvnz75H_#AnPryZ~7(M73htdRHg(0ABUv;q_oAWOMS^B>-7T+fm^ z@`8`#<6Dqr{d8y`*+=837tVs4zvM$^Wg=9i&-sfNXoErDctcCwr2?DY zrOlIa##iKs+DWhvWxpY7g}f&(bwgm?kW$+;_m)=e{+v z?8N(EM5mhfbYBULd*^6n=a`@{ur=H8<0(<)_Iicg1q$7FDJ1`dkw5mm&Q9+mk?$^% zDSThwdJo=jr)rJA{fumH?WPfG-c#J9Ow*tC?_LYFl{-z@#mU1+AzZyx?<0w;i*5ea z)E-r!Z4Z?t%2*yp{nruW>*aPI1FV#GpP;@6+1_&0-+Z|KnQy#6aym_R#M$9^S%>ZR zvs{vke(^@Mi|0xzQhTQ5LHri=w;{$k?ZaoB+?dzTqW(ebUtE13yMf}*nBI54C3}jK z%4Xby?GEJEtWV{SkI>GIagravFVw$dQv3Fg#-qRf$-1$qKfz>2?G9u&7xfo>2|MyB zam^9h-Dt8qT>pND`pt(Mck@Dk!R|7(M}6pz7pjxkg?8~WxjoSQ*>BSCG(Eqw`|MAR z`^)sn3freE6om@qJ!~@3yGZExwi*ZTE=QHaJm_S+WQpGf3L@ie`1;X zL3-G{_yp@|e$e@IIo@ya5!Ppt!BIwf@7*D8hYwNbGY*9vh>j7e9KBQVN%y1CIGXPp z9O%9e>hB@#vVa+22ABb6fEi#0m;q+sa~T-uJZd1h+1bCUN9TQJzf~xp^Y7UAX;F0^ zoom$%4d;#OJQCFfoiCby4-x6;t4I1BXdgk;5j}_j#4f~cM1h|N!dPx6IXOmj4j?zF z#fs4Z^gB`R#CBr_U(tq!?Klv1Q@b8h`AEZXA0Qn>Tt+%Kaigtb^KiGL5v_mmGN$CiJzC~b74#e64wWn2kq;@!T;P)P+M}7$3^$c{xA&b69#~HWj_(8ub@2maQm3oqq zAW#4AA81G31lC9L`_~hiMpS%muzT=(IS*bxqVK)TM&yjvkFJrX>r}YDnC;u|QS(9{ z<}qB-^)d2K{;1rH`cx)6Did~~zfQz1L@mW*s5lXI#BQt?SaxICLvnKbCDDQY1~Lnv z|8~SMV&n+h^-%nWX?LJ_j#M7_n%g_lIKQY}6#3VMZkV`j3hDT5zRn*o%}Z*hBkq0x z+DBwvhgFv#wpeuuF_b#;9ov)!`riE)2|B4DsV670VsDMwqWDPOjqy_X z|0)KsKb`^lb+qDk9ERVc)y~)DN5lT;c%KcmYcoDI39$>;XPV#IK=TrxmmxoA$t?Bd zwYz4#@2mx}J?=gSUtohc z`2wn6yNWqBT7M`Ib3Mu7SyD~SnM%>$>_hO-Z@<(RPvMO&ND4)2L z2~S*FIw8AX@%ZdeT`(JOX2Zub86tHL96X)r%cm&D=h)i+yd?RD$%w?E(`Gc7uzaRLmt6N&1 zGtq#|oQd#Mxj;_rXVDP!>F8I^y~AZWU%zboO8@9R{|>`tU?tcIEZ=Vby-Djp&KS=3967MXHza8L4BM zLdSFi_Y793&r&Ellzn_`%HY52Z}**w?}2*tt#u}T2T~kBKExz{=N>hVok7)Z6w5T; zz9&?B*}-Mm0dLh}Ij3YAu0SLqb~pEpyRs@P=+ByrwL*};%Ey#H^Ss*pZqEuiw%=N% z>ZPsB`aN03{Db*xB$^L251d<6{8UCYIp2+xh*&=_Y;1Mkt@NiP=tkL%^E(>HyYxl# znd~fvwh(Wx#0?WfyT&L95_B*{6>mP{^lG{FzysIH-B0ZNFj6Uz(#G?5RLSiN+twXJ zvi`6g_dkl8=1KZVPJb^&< zWA1y@dPjJ@+fWnTS1E***4U8YOFPd#W#`$a>WYUbkLQs2yp)BnN>L2mfZn7(TEmVCZ?YYrzJ&vCluc=fG5z01XIuGn< zO;D20|4VU~VtWJiuOnCaA;e)ZI7x*nNvAvxSKl^o!=ukM(W5U^>OHoGU;^Oul65pr$VC={?L9;>nh2Q-LLk4DkpDO>qR^IA$iw(N{{@T z>#5w`r0gvaty*XFmdk&2uqWo{kA33`U!v9};zNkHR?BT#N5~Fl_@(iFNZyS0k_&0q zY4VTLR0L3u%4Yw>*Jc0gT@Pg&&fEGPw<Gtia|6#;- z)BYs&sZSE4s7HP`?@;!8E?0cczguB!9$*|B@9*8eq#x2ZpO+FJWKZQ-eAqsFWrwReu-yUFOQMbkNckP zJO6TDRps{SpQ`aHR7m}hzGdo0e%sMMp{j-YpDDhzhgAF2PqL%&nXyc*->?2m_2>3g z*BOVySBK{q=aE!i`*@WxBtx2&{xewLy$zWh-C%t-cIaQ_wEa>ROiC=NQGkC={=WeBJH8|(j!^<8m#(tz~jwoFvNfAj%k zzn1OE^@wm6jI;FLj(!Xy_>*nb{yA}RL#f-Q8zTC=MD>K()~@D|BW7Lu^I70r4)x z`w$;RO#DFE*CSqr_&3DD4^@2?;u6Gb5KlR%>d!~~@u#Y+^(g!y;vW&;K_tFUqK!_q ze@wt~H-5;W&o4cn{L=VF0>$bB2k6rGIMrxJ^H>+UA;Hr*_{6OeefFi}^YIgRRHX7yEUQoDLJTvNk0Zw>`K^Cae4T)DIvpB=<@b>{{8~ob zi~1&aLae*xrHwBRPw)pWeSXqew;pF{&YfH_dEy~zEMNwh0cL<1UGot zm%H+^y-gv1c4cjYKbRTv`|E<)b#+VYb0!*)nKLoVnHk8*uB)w_sx+H|ja9Y5Dt~5O zZ9`LYW@C-7?kv!O%j}txCmKI7@h=mXPu>-;O|i4lw_qdu7%*D zs?1=>7s#xt^ENEZ$zE7pS?yaYLu?Aw)&<9BO&I?<+SQ9f{%U`tKf8LFw{Zak8L9|0 z`WN}CLfMr~wRP1MF?n|JoU-!#l9FubQg)rc%3CMhW@A6iQN;XG9H<=MpM_Ob*;Ny> zresaX3^=pZod=31sSNaplCp{!b4%uymgO}D^PE$wYxA5r(*6Q4A9|Cilf{2jjLItVUGY}=Vz$fuy^K`_YI_TD?8OmMiYR}kS7`KgdNqK0Y znlN&^IZnShUMJ3fsCGebV}XX=_<~FOY^#BiUhCtO0##~XFy#KFv8e0gdR-siwfgaK zN{f59m-*si^~d$CKA`ptqlJmR1|aV(EcL4al1fX|)RdbIO}#41>U+1n!QL)6_R`o` zzqHrQf;zPaOF!PFYBiGEuyDqDxuCAs=fb*}xVm?J$ub-%9fvl*nRqf)o3g0L!j#COuhp?PDJLga#12OC96&6qsjaH1sP@5Ox6zk}sAVn?GiH3j zvjjLaW*Z0XSWjlmF3dBIufZB{nmyZJ-Bbr>2XHj>HT$Zv>y2_%eRWo-s!q%+D=N)v z2>F7wRidn@qXqC%W;c}5?~%fFMCEl;%q&;SHIuW&9*w7Ik0<#|QGYNJ+~Usyb^Op`n; z^EXy&88x9$U}|=@KNQdw_!~7i7YvM>DrV;wm*g3t1p{zKnO*O#ts|~x%%A^dC({{c zi1MP+*?G+nLcJ(+6_tQ@In^q?!I~JgFnKCw%quO0QK*0&XI2sP$yIWGNnVbzPt2Y> zr($kdUWq(ug#hQMb61>))%VE z4pu?$j5)jj=2LKLKU2L=wY2FYh>b_Q7{+Fnv9sd7paw~{S^>t!@Wt;`@eXqi7Xm1l zgUAtI;)4M2K9zn;e#kkz927i#hRxUqihA#2AJDhhH!*8`R*oDxRKoqRu_74qH-fk9 zMR4BVu&~aTU1iu9f8oQ!#Ha@(vQ0S6Oe?#3Ruql_xOv42g z7Bn?fg=+l`K@bFM{L3=ogIKkX3f2CQmaZpV9v6_Bld*{8yoH6oqS3od8=J0=)yAKF zYEB=6IE|Q9Q$x@f(kklff;H8Z3!yu;3$zQs{!%(lmKB%C-Q8FcDhi7V=FOU#>AZZb zmZzPTbDDP1G%Zx)Ye>?nyg?tBWscQq8?+?t^rfdapFS>0lg`gr+6;cFiM-R6HlLQH zO#=}q#Z>xgkV3DIzAj=Oz`oZpTKR(BDsZ=;7XHM#*XWaq#WTx5Xml~NLG}^^XEZ}^ zV*OA`dFe{i@By27r)j52m$3eV!cy7CUWWRfNleYW95k!_y-Z3AgD_}MZl8Se=@*=o zpZQ&H=5lA|l!}X>F4HT6IYjXSsF&5T=wgw3j9GV@ud2omk(`z;O;3ZKoaTws1|ghe zD94RH2n?H$^I%C6e7HHSUpL_7G;OTxu4GU;S(-PNrUP`gXwLZ+6f7$A*Gj+M8<(C2 zar9}R+TY*wS5r!AVVn-0#%f@O|+i zj_okL9#wEo@TQ0zI5bc(h*87P>p{gNkEh;HZDnm;ZRnCO8(gNc?%kn#z4yj9aAXFz z>g-e-Sc~E}I$=6U}TMf%8w2gwM1|^Ek2xBD~t5yU!qRMtu$gzDNPB_8b zs4+DgH|xLit)xSm(tC4ZQ^+^v%6`zh zbLBg8W!UoFyA-dqm%b#*I;k(~x21Os&zB{ey~vtw36q`l`Mr66TO$5+V#o82AKh4b zm9yrGbJxB;^vZ9pI_D94-8IcOUUvM?XEdxk{lQb^JHzYef4|TBxWT+n%7D^Xh_F+= z)>qsn1Arvk8v*h#26`gO^FS{3!}!8qpHzl48M2{ol1p<#-{fZ$>PN8MaZr|NK4j@f z!xsqu#E=Rx8c_N%>z{=B=J;2Fe7Jb`kiMUT`rR1k=}?yGJjl|&SuQFnmR1M-6$^c# zP;I@>zo6QC3CW~@wyWTweTzx!5MiS)NHTC#6=Wyys~UF z3;yQ_^*F@wS(0Fw5B>j>&Lt6G$I?*5j90gXP%1jr%FRr+OFG(T5h0~tT{Sv@om1S4#QOmZi~m^EjfxbpEwe=+@U;x=3bNaJH!UMeij4$Fzj zgYE4gcY%!@QysQ%fh=6Z99LK`9-3HuRl=3F4TIJvt{!Y%m$akck)lTn9-H-e{)1qc ze@to8j#-ZsfTVyVV0tFx8pxY~WMjY1m%h#!npn6YVZE(z^&smXrK5sJ(TSWB*F(Mr zh@t&dhw|-^J3wZv8HSG;Llb9SnXtjOeo*1+MC-lEOTlC4$73pMVBZaSG!SO2Bi8dV z5W@g!RG(9!zcrv^?5jpQuAzw@*+C)FL1!Y=H$(kTqyfc|zdFG>M{)t}j1RR@YUgk=E5txp!WK3tMg7!U z?oY)jzkb?f>CA6)jdrz_X+>>X(UiY7-R81<=6Y(6E8%?2l`u1-xV6)j*Yog?rY$`- z=Sf$l_|uQ3t=?`?qGkUmwsc;Qf8p#_YyL&~7ZJzSrB+)3f@ZHB`3x zU_!`o!4@d?DiEEQ6UJ6+Jz4_|Vn+}^1{Ain}>e%m~e zKjrDBAGx4vKIYW>8u`qggN>bD%O zwLK|oehO;&ZMm(Vt$rQGnVfwJ>c3fbpPuR-iA?c{jR5HW!~%XS6aJL3ZH0O*9E%yt;y+aSHEg(m8aYG zUF~XpIp=_DL*5@i)wSUq`yMMSt!txAx47C;(_L+a>Gr+nfs2w2qmF+@b}p%C?Zcs# zlD5ndPy}*D0^k%mp=io;O@E8ckk{l4k;BwB>cs~P56=P^GvtW_gWiB`OUjyQ;M*`S zOxgO4r$9!#No!|e>vJ$uehIPQ7TrzP}Z!x5%Znu=OP%ZWVZXs;hPT%9mHeI+L>IVW^p1wX=9z zm#x@xu&^zqu=O!x#zml_ZI)aWngXV&)?Dvun`N2KL{>2yVFlNnT5P+ODWreM8xLRM_B4%7s z)73h`)fRvzg7&tvro5Z7#tEwX{=PCV?Jn4W=u+0mqs;#HeSd~lSMQJ$>~i?K?|hm_ znd_h!KauvrM5+W???l>bOr*ElhF&0551B}LAkA+ZnLp*p(5c3Zee%GdNg%T{{dn(I zm{YMyZY+aSr9>`DIj~W@dZ!f@qs6bll!pnj?Iqi6sLF41>IWXQG|isfmQ>tUV3!Ar zDf^rDxGaym5@y*;5>i~P+h}QbweFIu`i2%U*|*cR@*}z6FMCri66e}WEW2E-2|3Zd zqoFO};1>&w`MtU)Wtkf$`TM_-p^SR_<({6_k5=Zr21QAkE2XH@n6poH-TDKVrcI+a zdqUb4y&y%n)*c9*>}s6}%a7|JJi{h??RS35vEFo0AA;ICxv?C#b;3d4r<6DGq z_T=2$32xjepKlAtqmA|TtI;yT$;(m4w|yM7;#M>mC&iGv~8@?;*;hXT5$3 zLrKo(+4J1_7eTbyT+L^l4FcnmO)OL4#Q4e@T6KxqK> z`k1(PNX#p~BUg~U@)L2!;-tEL+3OthQH~*dG;^%{={MS6T(vyZffi(e8N|5Ip) z>zqY+%U-edP1qs?pR9k{xeHXrq;VwQMuV8h|7qth(y!a!ui0;NGl9hK)c}|OrB;~_ zQAPQy&bP$Ba&Z;Xy45v6qw4>gkXVZ!NHOr5JMKlW*ZkMQxtRE+zt|rJ`?#j3bG4OP zzvi!UJ^QNatKbJi<|@gq+GlM;zz{G53;{#H5HJJ`0YktL_`eb89>3kh3Kr(yeK0Zv u41pO#0PjEl_^|hX#-6(^*AO5Ac>mit>$CUYwu2#H2p9r}fFUqL2>b%-6|Q^$ literal 0 HcmV?d00001 diff --git a/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/Inputs/core.tainted-param-inside-blame b/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/Inputs/core.tainted-param-inside-blame new file mode 100644 index 0000000000000000000000000000000000000000..5a7219dd8e82a0fd47364f43bfd54c428a67628d GIT binary patch literal 270336 zcmeEv3t$x0)&Jei5|$Xq0zso<9WhEklWcey!003-u+ac(5|q|Qc9Se5kjIkUKtwGI z1e*}iXw_=J+HdtkORb-cRa@FxUBp&weMD`2e>T3cXdA@`zR3UFx##R-NaP{ff7^56 z<~QfubI(2ZckkSp-I<+PQ&Kk9YOx4PHgSfCNkZsU5Qn?8>`77` z=`ByJrz>@A{wi6vVvIvS)^k)O*3+;aVO)DgJ%`aM7cx%5g-5 zcAT24gk(qMd(fX*Zx953%7^Jj(Nr|BT2)PI_Y~CY&zj~o>W2bqUvk_5S<*usi*l?r zS2s51{yjw;4O_%1VbELO6!g_*`@JpR#_W2LlWWp61?p>k+0_l+Mqf^IYfv-19rzy^ zTL^OLywVDajmDhfKX7k{$CBox++QiC6Ua604>VT&#!elZ-UFZgEKQoCI$AIq>(?UE zRMl|@q`f8|%Vi8QjZh$>QyJGqJL(C@j^-?JD92SMI&6|W5-Z9vmuZv&V-Cp8qfjOw zyI&Wmec>1^z+FM$QAa#mrOFKwz~&LOCqIO;fA>MX|^be4pj#W-);xUAd4Y<~4tEl0e z0oQ(y!W`7+HZ@m!YnHeAb77YY)Ys&?3+Lp*Rxpsb(*<&IZ*0nL@h#0=(%h2WP#;XR z$*wo;nBrgBduyO2x1qjz#x(i2CVNWGl>D4Pv&j7#^tFR}-=EglUtvDW{ekB58rsQe z+z~^tv&0=4O{M=lF@7BvWyMwTk;D$S6X)vofkENOt_MQ-VWips*WV3oh6d6};! zm|NXi-%wk%EZAJz+|ry&cCcAp-_#ncZwSa?&5e2f_t=uh03GIl6(&Vl>4HUzLFPH} z?=>f)$K?Z@vT}Xk#0)S4%m6dM3@`)C05iZ0Fayj0Gr$Zm1I)m`G6QQ&*Z-|}{hzK& z=-9c?oLDdA_5Tq<7bl7d#&r{UErjfJ+#=kA-?N@PbrZvM$viD=af4_YW4i zunLxZInX7Wa%^uXUV5>AgeVI7cE1)bWi++6Ww+(e$eu9`zT?lCV)R@3m$vg3EHVO- z6Fv%l?0V4w|RB(Jm4y({s>B_L?=3f!(7LNDZX4cXlp zqN+-6R|SIJmS9yQTz?hw%1VpoRKZ1$oav&fv~qq`tq(5z)CYpTmdg2a8k(DYmEP(G zAJkmh*xZCQtCZ=WhLQs-WcnAo;YI?(G{|B!vVQB{`by<6J(~%f7tq(4oyB>Zx3@|Wm8C3tETiS15l9P6PyHUN{wW**}`rR~aorIZt zg5#j68Q9c_fxfikL(+0PBG`Z1u%BKoVbWgLw!KNN&VJXnooBi%e{emyH<%6%Mxq1z zK;M$I$i| z3!#S)CzU^3^0}<*dbp(Dz)hF+?~F*(uGW6zy5`Onkn$p`YAin4zryoMJD)8)x3u%4 z!bOFhUldlBZ8~Y1T?5~nvL#lOO?pF)>CWT#g2QcJBn6MpdlC69>-@B=^P}RzRxpmIS#tDdvh9Z;yTQLtmd_pKxXM~GD&xwel2O_wTgj-b zD~7p7IWJFkjmlp?eBLO%X;gmUC}-iQtfEm`(Ws1~QI4WfcB8+k(C;?zLw%F(I57jv z05iZ0FauwO0VkZh83_>&ztMBeRCMmNDZ7y>Ba(pgo+T7&7tHkMeC;j@AEZz@Ps;2KW5=Urj;UF9~~b;u6w4 z=Fk89`5!-1^XGs5{2%=Shd=)h4Djdwf7Z+b%t-fr5XyTt zWs=vQzwExockWepln@G`$!bPDc`u0jSE}6otJ#L0@CLUbivFtUnml zdW8LWL7b5KC;KLIANJpj#ZV>_p|q7rqRd%1B4*T}OeW3v8@n$?eorOq4b?y5uiI3w z0`LDfw?ndq_Jq_w`klfRIDTflwpvvrr2c)?-zf~$zn*;69w82k!HK*#Skftfi%@&} zqD_yzkli)%65Hdu3ts%i^UrO)N5&@kk#&apy#m?DxhHL4SR+!0!z6aYhH;HLIl~>CNunms|n&_AVB~+lBwZkY(h?)Iyshv_qd_pR9LOo}R6Zn&LXSJ#vN3 z4v(H0b@Ls^Brn+^B2%CN_XusRz5NJH%gPk(ncs0Z7Ki>=T$Ck}Lyr78LeoQ{)Gf~0 zs2jg%fT0=f&^z?dz2bx&McdYgU);RdYPUJv!yPtjckvXV9pkVbZJT?tu!L`Sq~~92 zcPF`uexH&gM%%JZusVciE$mxY*gABZ#g-gOsY?lU6tCTRheM3iPEEHvs?!U#;%?Df zd*U^^)uDw&s8}Rf?V}cZZb=!I>b0*}VX>TQ@6$5IiVJluNlOtn&+z0qYiH;}D-^E@ zE$Mtm=ppB84~0A;b**iq#iNHcpwM2OWEbm>wB|YN;-{He)ecASm}*T}tSOqK(Bs)M z!De+&NVjPnW2%>@B)_!fXuaBIwaA*nX3clsTwI)L{bZe9r`bZfHr=uLr#nJrqtmr? zO?0kJ6~iudj8A=VOtD3*wODMaj$u3I_u1~x3JJ$JO@x3AdxJ&KTWhzi4B00;CuqH{ zWQ+dDh|%H^am|afW@zg&3;Ql#aP~vm0%3!Hw_1808ttFEIwh++`}>*w!kS`94OQqi z+k+vG-yuTjmf^kjklh}(S8GL?a+-*Zb>f7OC3M{_qw7Yvr|DsvK5m0vsTU>LGv1#nQvR-Su=%zW7EJxTYggzlt@80HEG2w=> z-C>KcdxZVg$VkyWLRiyBXN?buP?l~FS-=alD}*jy6B_D6Y^% z+27y}c*oQW#9C{}wJbbAOj?_v7q#b)EI#py8$y<8A}eG|KT5b$L{^GJ6P3w!hj!8k zU8MMvN+A+q*GIZ-5o@_EwNO~Xiye=+nsu!(BXoLJ--+T4O@Gp2(RHoJF;AqHU7ePk zlydStR_EH#_2LFwxfKGjYgu~7gzn3~eZo1TJH%$&$!kxxt=H@yg`Qq#+32j*xBWT% zv<5$rv1itA-Zs|ZE?zsuT5hp-ixHkjL-rI;*2wjar0$3{Xcv}@5RelN%}Mf%7C)WY zW3z|#o7aUrMc1Bmy7QUd%^As8X8gM2m8*Uv&f8>9vAVji%+SX>M2F=^E?akK%w7I; zUA*I3Fj92LrNyR)#@IWqa@bb*Z!Ymv|GvkYK1{Pf3&K(e%LUASk$k-vtM@Fe)QWXs zIcs|12w^Ym>DD77Zn4^~o||g3Up`Ko;Bg46BXUFfS%smX|HjD~-s@nJYFAi`z1A^$ zxpvK-(8a?~(DZHLUudDxMdI38w=FC3NXeWeTiDuNWDBnqS?#v`hb%Uah>ZOGbJz5R zU@dalLJncEWu&Hed&HFXj*SAs8S^Lo<`Lb`4_|9_jlO#Ei0;X6B#WYuO}ISbMEz-N zpGAzh2o|?zCfkm)e*kmvF5$?uZ~4B(l@;pt*e#_ZB&;GuoK&n?t#)}ta7-|MRW--* zpw%L#jE>yJvjDyTx8E7HJ}7oPb_g99bgLz72l( zG-9mVDmvzf-j1^hBmQZV9Pi9Yx<=$BWv*W)${ikyOAl!<2lNixx_S2VY{K3)V$3jM zztUMbJHP0tKb*1q2yF{=V6*6+GG+8zsW*=jrS0(hiO_?o#Shyo+t#gs-O`b1~DuoXH-hl}B`W7S4qb#r^jQ3PRxI&9VHNxp|7 z>qe};IX!ge_46#kCdP~kjTf7<#l$hgQ&!q0RHj^U!st}-3hWUlXNqm!lJ&PZw%aTx ziljneUH8B3We%q(Om#jc(TH4d$$2>P$F6n3ttrH{c+LRj{M~<=`=lyHV z_8FNTThUZ!(zeWwwc;Ah22=Tlv~H1MDKD}Mce*8HPySoF$QvKhBO`U2Bg-;YJSai~ z)<5UXA2n83uds^#YsMTcQu8ZB#I^IetBW*S{)i&oS()As>yf>~lA3MRZa#9IMNF{w zUF!^aM4p(IA+}hiyMP1Zd_bO8$Y+Vlg+e}~Q{E>m&v@m1&hp&$TaZtHd?MtNAZJ0I z4Ea>Z*^r%(DNTWmX(&uboC$b3WF4}cL2?Y|LN0}T7UVL>3m{iQJ{R(0$lr#1K4h6L zfP4|;YREpw%OE#EmPy_ty#jIoax3IjkS~F}2J%|S8z6rVGOQ_L6Xb5lS3~|jc#>d2{{AuF_6Cn`2@(B zkS9Tw=@h_IA?HBOg`5X@D&*53&xAZ1aslKsAs0a|hCCPYS&+*hmqV7ngS!B76=W}D zN(hv{4>aRLhgZl7vy^&{}S@AA-i?;m03t@P9SrAA|n^u=yS6-vyuX=_1gzLiw>^ zpM<{U`b232_?-koJG6hJ^aJ)Q(Z|bRUk@^+8$ccde&pv(neLEwpxX-|_oF)?hFRd} zbjZ75y8v)iTs;4c_5K3-kDy(-?yUs>4Iq19`x3x!f&U=#KNajh0lNjD{{k|lA42&Z zkgtl<$uhZ)$g~pby$AKK!}jF9BuLAVRas4_Ox96b0^@Ua={#HSHpE7uj7{u|no$F_%oKe->uV~tETpuZoo1KN5E zd|m|o^neYe67c&N=*L5UzAU9-9l0K^#(v2)`W?t0#`((te={&o5pByEN$MDPZ%ktPCjy z>QUMg*FOvBrFbW_eFVn-EE?7TUJt(hgms@l{1LP#*JXJwL8%<-eiv;0ph$&wD`0y! zWSJgNV65v~K(`kfycc}QL)-S$?VX8>k-u zpDUs6=r|thK>s3?uLEC=fK#FTX~3=E<2TqJ*~|@ChmI*ycPscF09%<(R3IJ(yDPEY zO;{%xY;MAst^~VZq8_U-d`%4WrK@Mndt3_p3wIm$-9l6QB9EYBR z9FIed-+7vfbAR#o7b!cf0PUwKjNGL9B~X8;@%Ox-{OH?}uV)lGA63|m<@?N^7gagM zZ=U}LJAb}v{5=@A`(G@6nm_vciqD?EC-P7GZ}=mn?>$3}zj!l||9+hR;zOnPU#oDa z`4cAluQ-3q@%Mj2@kjEIhr=9yJq% zS1IgUsgRDp;nhkuAAcQ}D!qCA38TM*J^mi*`V+zUdPg6g`02dhn~I;#JNn0}_(?XS zb3f%~`)^97^@q+M{4-QPX#UXo8=XHyuw2LU1e!mzewxo8zNz(-;`iY3e#rQ7y>k{O z&VP#EkLL$;{xekkhkN~``1g1IM#rzOdj4~`j$gF@9291m!TI2Qg}wlw$bPO!Z97i>q%O zq1rVU3?akwbOz+tGV)rMOrBF!T%HMu@p;CZQeQ0_t8iWouMf!K@q9AY2h;f~X(Xn+f%D#>e?GEG&m&vi_B(O9O_6u=#ZD$PVJ z#qaIJZxr9*tC0WIh`9=hpUub%Rv!{HoF|cE(GQ|P3?HNPI%40^N)91vh>;Aek0=ne zqfn3Y$Q;O_%zx>F==clHix(01T&m^^A-$b{Py*#p9fpt z9OuE-|El(_6BTg}-2b65gl5@}`y-7H;ZWmvsN+XpSHJs%#Q8$}(D;5`?aTWCWO@zf z!CQ#C5dVR=8}Vbr&kzR?lX1R}L>z~BJYp7NE@D37>4-XFF`^5x4AG5PiMSZ?0z?mD zEn*#_AMs+uHHhSY1Iil_uR^>YF^sqc@h-&QApQ<9g7_E2ml5AWr13mZRHFjd&awVZ zoR51D?KXA1$w16P%tv$~E=CL@_TqZnkC-uB`RT@T9pyVvz7O$H#Fr4?LHrysb(r!q z9`RJf(-F%MFF>rrb~+FnP~VP7{(ppW58^{4W4-4P_aJI^6-OWWL3E)$jJN}_AMsJ- zV}H0C$79xgPU8^wA<7>keqxeo{60gyHbTWm>&VwVPrq)S^RZuF*M9tU&qLbJ4t4#8 z%Ya6jgeN@m-Y1!8e3b;(EDz!QTGpk@kYg_!{P;lg%Z!Js{gK##o?jhY`_yl9Ttms` zc&R?&q4G!PXA}0r-`CYXUGAmzVW@TvwSNvI=v3@qAC8j)KOebJe=cGzVhbXTN5~|T zp0FLuI}o#;Q0LRspF@p*EDi8K8~?2O(`V`zg(b&P?hE1Pm0bvt%JEhJamE_8pY*+v z_<5h!i8)v<-b^f~d2%+EYo>DgJarD1>!xywgT{+w!tV3c_vIl(L5K$SwJL50VisZ% zVmab6#LEzWfOscj1o6*^p$C-Tw@}`T=vb%p;}NGIo`rZWq91V$;#G)0M*KPAV~AU@ zy;o4~M;t&rYQ1VV6LA(|DdG;SzX;_3;wHo};@yakBKBiF;=2#^pCOKFSM5$loP$`7 z=s~;~@p{C&5F?0BBEEz8DPqzF~zFCu>J#xe$+pX@-D<~ z)PIih*zYMnlM#y%FF@=;`_(A-p?o#UHzSG%m7grct*Czz(T(~x#4utn;x6*jq5OrsyaTZZ@gBrqBi@g= z9dQTZ@GI0fK8EsBh|eRwjQASjPQ-T+-$(oy@iRn$eup8ZB92Bp3UNH5hB!DItR)5_ zpQ`gAI?vHfvgaSF+`Uy@@1c4_;rH=8mCBQTs^$Y-uOL0)hg(#+yskmIgTj6lU;o{Q z7T?9#{+UBGdIZK#@g0vcygF&ncu&G|a;KvV??o`|=c7#Lo#iI`r6_-n_6;c0d2H63 ziZAm2RdM^B%HLlR-$5MqbEVh*_T}w)8|u9QpS+7)rHr%HeV@Kyov$UP77o-eZE0?m z_ajrXlRi-At!-XKYWPuz@>ACw2*$Y)d(Kk&`lkAz;R_4Itl_s)q;F{sHrF&aP=#L7w^ldQ*DUv4j8%4^zQtb?a{^lt)CYVmE9+}w z1Z^d~sk=R>PjCW)V~)E2w692^hO!gUQLOaldQsVh_pi=V=tt~93?p_UM(de2JXNYb ztrOvkluY}D$vi5C>Xn_lPGJPmfqFm69>i!x+|XC5df}i#J)qFhs!&^@up80gSF%7k zjCM|}Z}zWkQTF<63j1$W=s?+x*n?=U-+ec>_X~v&;{DEMbYr=>e&0Q+UJs%J?ffV^ zQ68$k=eMf9|337Ca`=AKqik-MWcPMu=RxfKJ^Fb_VK?f@-i+GQ$}aSzLLJeA*p1ka zXs+M$lB(DDg2FIj1ksJ<{V1F3N9=fC`EZ5LA^&C!VY#_}-w0K&2T?~mKgu4IhpO)% zrRw*NRM>~uJzB{E%QZxE``x+9&VwkNN{*l$%29GRVjrR((Mk0PO$|7wqyK3Noih~n zqrMlh2eE&uDi5O^!FqzwffU3zeeo~bA5}klv?oqhfr=}IklgG<<9Ae<Avtkrx%} zFQNRpLh*va(DNu`M4?xd+=u9SRms|G3d4v3{dltRJ_5Yogzi6~??1n8JWwLxc(_K| zZozT?#no#6aGJ*7>`(42GRsLp$5^w?fymT8wM%iB=cm~hwM%iB%ZHL9KDBOZOK|A-Z*9+Ysy>Xr zQJ;9H_pQ0EQt^C(<-a2$v7N&OTjU8Lq_Bbk`Ho(hdK3(7Mcjedi?|aJ;x*D9#K=)< z931B=)ZOa2^o#L#W`4BWisjUg4lK_auIdS0)eE7%*rxP1VEr2wDcOa7>}M!@54HP@ zy8rcav=j4{y`O&XmZ#*`(O-C)s=p&g=|iZuqrZHN%SrJaiS47Tquo}lug_5BeQ2kn zod@;#XkUkMgpW}6-Pmpq$`SOpvs{(;BRaAE4n*;uT8BHZKJgYzQuTJ=xOlMt8Cb6Y z%iY!Lx`zYhoikNEjr`+4MMfxnAC}X&b-$$ee#oNA1=j1uc3n7re)O*)A6u}WA>_Xe zQPI6uuIMj+VaPovD1HCS7~g$L?~LRa>qYoEC6hlL=S}xs zr4L=E`lDNwA5Xi&-jfvSuPMLUs9eKe{aCB?=6;LUReb&E-+i_6(|w&n_brIXUzCRo<&VbIkL`Bf zr0m1TD4x4tP_p)lLMQgy`Js|2e)22Vxizq8>wptT8HaK`ziZ~W8(+Kc)*~O=99;UX zb1Y}vzR|q^p7Z8CD%t(vxE0IWPwhN<+0TEltaHXEt`{rYJJXY&960Sq16}vpR=o1< z(v4R?vHptFMy%NUaQRQqn6$~Vec|!Ys<`4unx{{G#x{>O!su!+;txTiOvAS%!iC=mzuORIjg@;)0n zYV5fF)A5Q7qaLUMy3j3jEDEEkNe+=3(IodmLuW#fbRzQrWZ8u5zwDVrfPGTzc)U;1 zVO0#(zHCIsD`S-B5)zMtEOqkSWg%o8vXm*sZ<9{?UksHc%0zlPKTE>%MOhb$*F-;8 zk)a96p6XLQ`n+W_kBVeJ)zlt+4vQL^HprgpQ+xFJ%w!%F$=+*fk3P3W4NV(lPxYxi z`aEYckBV1gJLY=yIWKBx+8}$XPwmm?Ka+V>+%`me^tmu7b{rn(PQc@L)MMgCKOWy- zH=*3`kB3bAzsIWlL`?U0BzpVzmpqTF^Rj>co(|qabN@TE|CNs?`^J;8h{vtt{wy^= z&H8Z4m(Ty90uMj^pE=Iv@zwEjK>w@iyio*7^Um;q*h8DIvOfy2!}1ixP- zzw&d`U@7#zI#20NR?jITn^OG!GhtJy%lLk=0g>#?NbSh)A7t7(JMp}d&O1HtCEl;| zAAf!B$V8qLd$GTle?y-i=zDt_KN>HJ#6864hX`FCAj1Ph`ux!T4fT({$ESH}?w@C< z{@K5Le1_^S^-tjV62BA&)pI|Pc;5i&8JPiQfEi#04vYa>*XgzaThX;Io`2k{^thJ; zbHY~405iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0Gr$b|3ox)}mb!oA zUm#Qtkr`kHm;q*h8DIvO0cL<1UW`2 zR`kJL;gPwOwxW9;khl}C@6qp{{^JPwnmf$Ae$52`%e(LYm+t|0fEi#0m;q*h8DIvO z0cPO;9|qQxl+CqTEcBRRc;4_C#=g45a z>ixZX;uE0|nqekC_sHjo_dTu3`<|X)=m|aJ4N*Ag1t3^YTFZLQmsLII%c>q>H-4ZZ zq{q0+=XS`Pud3~XnNTJZp|q7rqRc(m4>M{|CX;6TRnK&nn-y;aYY(NK8|yu^Nd;=g zTI>)Z#d!|Yqj$YvC|?RRn&sHuP~)KC3u*|FUV{_)E*Lp+<}FwxmfoH=&i1n>9=iXt zQ@sB(>3>pgZ0~zf1~3}31{rBLo*gf{Am@yH_P&h&7|8Tq7}yl_P8#{HnlX^24|-1y zY#K?%KMpdze@0G|v5+MP^10bZLN+J)4jCCQy~9SnS6wFACweary>CbA<-2&~G)$8M zCK-#gmvPH}XtqKDe$zKi&>k8#JY-ueW@&b-mYJlr|HQFbn=EZ*-(|ZrKC-XW9~p!6 zFZ(IulKqi!%C==JvR{9FxB04PmwkG3ne~wso?EU-e!igLqt~~6Yv*%-RX<#_^p@XU z*q`#uZ!-%Vt(EnsoptY{vj_h4{U`nJR{r$XqI)jiKH|jM`%ZVgytwTqn|{>a@BQ6| zb=Q5b_eF8RgR?j68oxYr`Y(PnE>QH3r#4P>%X^Lo8G_6GPeVo zA2i(y+A+|JetdI-i>#o-Qt!M}_FVNtqI~_2)a!p$dU~JFNkGnM@m}9tI9@;;P_L29L zeHQ8$0gi@<1g=AJPRMjMWP=Bf@^hP^72+1uN6`Oz)XVuN?Yp~_{dUyrsMqdP`cF|m z+lXh32>n^bL+xG(dg;dzQ1))Cs_Ug(s!W$473m5t@Nj${&v*s zxJRFb`cqKfSE20bm>{Lma!>73apvQ~GYsMyY~0@idl`R7zGMPYp#pI-pwzp+r~H?p zz8FNQ*Dh1~bFshQ0a1=i82JgK{w1g<^>!RD8uw-BC-e{HI2r9lRZFm;wrXiZbG5fY zRMj?AEvav+t*Q+)S1oC7scNoX=Bo)B`bO_^UsWLJtyx~>YxC8#2EEk{KBL6fR^#&r z>zkXZYFd2WASkOE>Z@zWxT)5#s__PE>Yysxf>B%kjH;!+U{#I3wQ31eY;A$}s2U-7 zgWiTJe@lH+aEYO)^?4f_n!$swDhRJ^l{SI;rA=TI?=RTeBx5psu9Uq|Vfd6b05P}7 z*uaBf;;pT1FQGwJ)+DSehn z@BTpP!zTUaa@C3FO#1vwl-}`NV*Gcby>8M!fqIuo|0e3&O#07IA2R7Z*zQ)7{)h?{ zPrpfjJnFNaPmD8!emo}qG_=3Lq<5jd*QEEMUc8X#e>LjuCjAy{S2yWL5KSjNGDY0EQ z`pGxxkEm4s>rDCysP~)nQ&Ar_=@+7Yi%Gu(^?fFNJL)t3FEP#^quyoG{}T0XlfDi6 z)nU@_K>LVE--r5slYTeq_xx4GBhQKHd|$2v`FK8dl3Er-|I2FseGcvAX9ih^QeT{2 zS*ntqar*er0{wA%TC>QP#DVF*=$#6 z`^l&*hxYxqw?$=nvj6_ucaaR<8Vzs7!te*O&m>=Hk{89xuJ!L|uFmn9uFm32yQ}jx z*ZS8ZuC?!kpcz+ZO@^y8J+n*}m35Y7I$ZDvRKZNBa%pCktFs}~>Dn~MDJ$ovO)AdR z(lT>z1CVg{H2W`G%B2L8WippV`+>`HuY{yy*L!}q0s-5t`Oov+?| z+ozD^ecE00>}{iN&b(-H(fT9bUSvICpK?|(1OI{yIQjV>|AM2&Au|Ka05fnH80b~! zJ%_=Q;UfN8t5n2)rz7Q_XAWSU#{G+Hev)e-^~dc{diuSrybiy=EPn=( z>un7-=e7n~YU%?u&G=iomO5XI>xhFAml0%G_%BJ$txGDLhm7+((db${GO<1_d@@b(9fw{}^uxwg5bIk$F| zw`B?Z;4uilCT*5KWzDT_t%u*cM)kR+3o0rL%gW@C=E|R#Hbj{>BKKfF%=~wcQT(5G zSo(MP;@uA)G=kAi>evr+|NLWB|4u!;{oAMgg!#X;rY5&$TF%Uzso8#KuKaoMjA?2Y zlkv`&20M<1ahc=Q(p9_%GvDN#JJ|Ly5c&IN`PmkLR;fjdjO) zmWnTYo4J?(>_=A9f&>XuNSco(T(LEL_cCbmJ5_aBx6H z9~kpB)p)ANzOD6}=4JmmYM#1}QFsDW*$qF`lMlF%&v;loR?Yv#$13cftWbJBPKQ78 z2aaEoTvxqs#G@UJ`vbwU-@T~@_EaYBFJ_nY+=J(iQg%*6va{fiBO4cmNR@y( zwI8RI>xE1b>G>XpVvs-2ovQjlb!dMlz58L@ud!}7qWL$Qq$fYrl>1k+jm@5XrIA0$ zj86_z{8Zn(aH;i7nAK5N6gRD3R4|mD=EtFylm7$7MM=70DxVb~H)f)2C=cP!+OZYg zdtv?lsP#@WrH9}Ro;h%(nga zA4dH(CjHM)|9zAGm#Dwiq~C`6>rDDbQGdNj|19c%VA8*e`WsC8cTvC2q~C-3^(K81 zu6yk!{V3FLFzJs*{pBWoChEUu(&wVS!=#@@{^2eae#-aqnCPwkM;*{C7nnirD_crBte#Xnd(k=8P~I44DFVb6Q_JSF!0&WqK_s? zn)2Lt9cw#`P<}QM3}v#3`y^yh08+qof<(K6ZWR%REIpF}qFGKT9;EOTXM)9H7fyql zzvM$^Wg=A4m;A*Gw1I$cieaVhQh`nH%C_lwQ>yYr{q%fwTS)y3+^F*gR{0tlglO}@ zL-PG~_51pVXXzR#L=zTG?z=wmzBQ`Zi}%3@hnn|vUkQzS?|nJOb#lkk3jG%;^t_|6 zd!+K)|EiMRm4mkvzA*7RJH3xYzPm)G&;^O*9=zX9l^TBs8QECr=3l6GDQ+^R=}-H2 ztcKdke{r99Lr5W9y;bicG1rmu-KO@)2I~%xEK$bt1lqre7+)^86DnY#toIq(doWJw zADW24+M_awN8EjA{X2f&dWKu#HNK7b?T{%>vfp2v)3Ch*=^y!&?Yj1j^MJ!10?3nZu4RF62@A1@oR-9eU1axp0W80*DzB@L-P)AAthM*D4uaZVHXjME$Q z`dPH!gZ+yuPpCIk{8=w0?zdE*;w0IOJF(rN{F?1a{`3&*xiL=i19(9FJK~QTEx)mw=6OAewQ`IOjxi1mJKs<*%X{Sxil_BZb4g#d%yVQP>1Fc>dX zCb19e#p~quQ1fTE$-d9@{LcQDKQ-&ui( z%UB%-PB%kPd!OU^?+sY+1usoY89A>2V-tFV|uHnY{ zji*Op52E82N{--tigZ63jidR#!J+Q^p#JXDE-RP;W`G%B2ABb6fEi#0zLbHX&ZCCX zo1J}CJ38+(`>jC*oqtEaPxGkr=zObgSUAr}{C_hBF6!>`{gmO3O$uXjH2))THDn^E|??t^6+l^NEnl?0S$APGu+Vz;^Lk+`ynEV`S z`-i)p8^=k{Ar4*n{88 zdGPuXwH|LHx5*i;AANV5#tYXMbNz1oowYv7W4NU2V}<~K$REjVXiqZLBbl%V{q-XD zA!=zJ!^DZGBlcstK-rD5hxFw5Akl&ThN|XA|J{fo#PA`u>!JAf)9z659ID>`4Yzlw zaUN*B2=cEB-KgTWDWv1K`8vPfG%u;0p1At~XdjVfJyuU;Ow zl5{dbRI=vq81l~HN;ZFwY81x(q4Vy=i`4qOKYMdLe$(%lrR(^9#x*tQriT5XI0iNP z3Q8xAW3MSF^Sbh%CKIK!{*r8>iPVDbUvT4bpbziMq4O=`&%AzTneID?IZWK@o2uqt zKcbkXXFzqO&}B|a}he$J9v+RJNqZFt{V2V!^JeP{=ACQ0|Pfh(0T&I^xM z^O%sI_<)nvaNwv0RudIb<|G@t| zQT(pDPe2~OfZhM+ZUV!pgY=Gocl)YF^*NsW0@hZo1x_OUex(@8a za=K1TGP)N_<&!_M>sHlx{Q>#JrEGZO(#om1gQ}Gw`nkuY{F&#~miGqM$gw?hf-0AF zW!BHjHs&A9Un9|cpn0I5qT(kR&E$MHQZi!WqLA9c`8zX7H)J=???@c)(ihEVs%KHP z#k*^9!vvAOT|c($gK;yHXaeLH*be= z|D(8Ro@8#r`JgNQ-`@28QF8yM(4Kdzd z{5I9^o2AA}#{pYYQa0CWu|$V2Nt~hLyi=)ka`HIx3$iZqMJoI~Tbv~%sd8P@A-kfUHVn)-9{mu~yq6qB*DSP&hke&M%_x@jWUTIAsddc#E4AJc z-rzROME_L^h0u%*8NRIN*`?}vcBy)V{WxfZ)IZrbnftK+W-Nv>nFyt=OcG_z!Vxi} z24ym7#$O?*z2P9sdPDV(`0F;+t9T<=dnoO>vECIperCM3S~Wx{+mPuTsAuemO5E>X zin|=!8>)Xj`N|a`4vWD_IuuDd<#D+7_C=c>dm+1P*^z&9Im!Lw zRDBCXtJWD$Q@8fT0Qu>6CdL&yTCGdOhY;^Lv7XXPXw9|p6RI_fu-Q$3nzX5Pe99CzH&_9-Vv|73i$JaK;r zpQpyZcAAR64w1sV|6FAs-51AJ80W!MkL;;F)gz?#c8pf_h}S=3JI^7~{z2{i9vu+x zRFCYbKG`1;4Nw^S<(`G_sq=t(b^cWK!!=8#%f4DAli&KiHyKTbr>p*V6PorXX-|EU z*o$`Lck2vQf9G+E&&7)rM&|*>adlN}|B`;l-h5t4d{BLoDL#sq+L69wqWwkM%XuHc zI0qofaq~!=;+J@qU2v{Vt^^ zdBYPm#*mE2Q2J-EyniyzD{Pqfqw)F9M@3`hx=Hct&(1fFHzcn+TKOY=eo<6^|#{wEBfV#4Gd5mbUxo>I!+GdPs~>B)BZ|+Xg_bySLGduxes$2a4P5pJej86YFVsKAwNR znm^QEii7r7s!#SLo0001p5mi;sU0dG3guYFm-UWGTzBKk#$9~k>JwMV!E###Cao9f$&uD$B= z?5BR_wyAdM^AhrdsKS7Kj?ncZiSM{eMmLXn+_#on6 z5I;tARH%9z5pP7i1Mv++OQo_q4Y3HZ9I+9x74dS!2M|wQr0P#cydLq3bCrJlc?u^Z z&PRM1F>SFbue?Cv^A{;}S1DYHcn>1+eFAMb)c!FQ<$nB-L!Vy;KKq&RjRdOI2M(~M z?{R9e9-Uw6LN_#cItQP)Rie+nbi5vpdf`#)Hhmr>HQCYpqAxk-{#|{ukcx&Rk3?C0 zDi>muNlrKkfiklDb%EmP7__I;q2p107J0+3WyB+BkHs;Vz3AE7M%|ow(d44_N4~wt zdO}4J*N!m_el=u&P& zbB(t_y3NIYnxlyNr8v+yzCTNAYI19)<;={Pn(cSys!vObCut1yh_Z^RISb1cmRA(C z1PYw9YU>M}d9$ZZo7K={Y|NO|SXbb5&hpn6OmohjI(1f{+0aj)RZAPywW?^gGjCQ+ z+;($|q0f{0M#HUh`s}Hv&7PJwE6`ei8%qnOI%iLtI;+NOY~;-ft}-^J%xZ>>X|tzI znH2~c#?xl`+Ki^B%$l4N^tKq=d2)N{>gcw&r6z8BS#&$-joCERd87J<)zjj(p{LMy z>9b*VW6UVn5UU()i`!nUC@_LJEv8>x?~gi)X=`JfaRE29#ME)kG{m`%YjHJjK_Ld? zh3eH)q6O74kHN(4m`yNdQ|qgaR&DV&Mz@#6Q4A9|s`tfh2jaF{;e*T;l7_TmVs@y0@1RUZp2uqw7)8@KHX)JB_H=3i=TPlwT5=J&;f#`qEt;)<5m zFNxNvZd8LP>-(!!d&c(CxNW3M>Vr$wgpu2AarSNTHgW!g^-E%n`I}<#1y&|(tAUbU z8{>@pHELfl^vx@yQ8&i*x-q_MjZ@-`mdCbN`Ql=2j_X^aU+o!23)5m1KpzuUHmd=W zMl00Rl$%YhF_Tq|v2AZ4*5#HMjV+BUV{Vo-s6ANv@vc;>k=%xbGuq1~4Kbff8=~sk z*k)TztfjV9YF0=u7so|b6W3c`W6ZvJY0P``(iqQPuZnDjjI7mYRckgb92E-xutSXeB|3Kz^P@HJH}s>oSX zIX63BxJoN3q1DRrg=GcxOPiWoe6_9qfN(9Ws9aDuzobAO*1WZW?CE)V`67BSlIH+o zRb72eT~)0Q4!bSB0z@r)iI_9z0M8QO(3oo+w4*(lGrzdNIKBqzz-jLM=GxWHI217!I}oKsG_920M1b92;*h@uN7d(iJ)p6hG#H@86V4DGDkm0mbsfismMieslU zXfGAUrjT={q!_1JfzgM`%5N9s%JVBfGyp*_DqaY)YvFu%WkCth+oF{h7MCun&?FD5 znpfF6Rj{|rD}g?_%FZn-$TN0?`3o0R zEvzUglV_?B-~x5R+w2eKu4skn0x>qtnw2YMf2-f`3pRMGVa^zviZE$`b6M5(1#5Bx zHPAa_;x4I&$vkV2`JGTK>m(?m;}Nfhv6*M=p|}I6L6WUjL1kn3;`gL@hk5%80SwGR z zxy#^WziDZMFSo|1WBi3r4AXL^8UsFv@3)PZbaSFN=PdR?uoP#8q>6* z^gAW6h&Y`B7XONc?ve!smtJbjD%lm7VgY}>-=ezn(%YbAUXrk!U#3mcF4dwwjWR7eI~cq;ySb_1V%Ti)d26!` z7bGlcZK?^@H#Y@95vXfkl?|W1YJDWsHV3s#J>{~vfYh9fMkMDgtoBtc-c{O!Onrhj z<&2Z_5-P-5L~FG+1$;rRs<9zZS6jUlx>LVIJ0I#_LI=l+(lWWb8%sh}aY@mld9$*e zmrc+Lw265WwF_r!!8%`4idN$d_@G+$1g*YFOVK8;oZL2fQi>*>pR%$I{8AGI6IZrP zOwne83XGyAi56rK^O5Kx>H+G<9AhnCz*__Emej+aX!lxt(y(-H1t^U!W;e-Rg5s1m z=uNaA%BUbySsFfIvtXh&QM!cn7YtU)KE@bIJbjpzeHmERHpiHhH4MU_J-L12iIdMi zp)mV9-t5)R?3q;;LRq#~2D6Xh`A{y4qtQhp_ZYKoqOYc|86ugODXUI|o=o(_S%VVJ zER^FG9|VR?$a%1$6+Y2S9MlasnW#;W-IWYVCo2mk&~$*#mMl28ih@Oh!CD#Ad&|m+ z5Jy4-waraFa1-sC;o1l{t}8}&RkT=sS#0-$lNs1q2RSa#nTFak@VrNphcs=X+(jmO zpkZG_z=wOWC%VTTic9HHIwaZxL2nRFTrPMl$?nl;9W1Dxa(R#u%`QeFWk=z}gIF;`9S{aL|8IH_rp`<tRxfEiU3Dc*^UZ1y6?jYCsa2| zOwGp4dUVjJOd+_1WyOd7VM$aK?Dw1G{TlpJzX<2XnE_^i8DIvO0cL<1ULhOCLVS@0q45GiD3|ZOknim1!xwp&(Sa{+A*A

hQog5C^0fl8OmZx(@b{zEJCkIYOp+g&=)E*# z8@C%9*b;dk2~&)}b8Tw{btE_www(avWaKB`ZOqeIY}M;`0IJZwuD{0%e?T z@^xrNdskpNR{PpO#!r1#&mIKD7@MJ!+{rNJ!MjbbeB!a&PXE6t-!32f>sL=IvT9vF ze(dL#W0PjEfRY_OcHVwNXdHrzf#+2lBG43(2CAM4xeoGXAlcZj3#G5KMkW_;O1i>UyndMVchXVOW9UTA zi5nna3&hZVs)Kw7jKF^YI6LX zF55Khr*97oELy+U=BoLqbW=zMP}=!aY3CzlX~hxOwl{6A&Nm9rD?GPwQDJ38>8A0{ zlCF%xkG5OVHpn?#*rnUn?*U;02x)ijOv`g^dsTCdc+j=sskZNycDd}Xt~psHU7ifr z%qIgWu1S9^P5b$uU6$U$F4uThSA|y6rIpNlsr7c3Wv}b$ovx&FHCNKytkTY2SHZv| zKb*bt$h@aq+2W5soW1@*i&CxnN2#Uv{K5<7cUlWCEWD_+(~=h{th#Xf?(Vm}@OHWN zd#u5V^?Qx-%vy`>+&>9YLs?OgEFHBRgp7yuuiJPeJzy0@_N&mRpN0V+%I`h<>m_NLuG zt{;qCrwscGKxyY6I-mUb`O>HV-ua~K>Anq5m36+~HS$l=Ag#351wH-v6<69Fy&44a zzo0GbS|kc*{<-zPT$|GEZ{M?bU|`9ToV4THfnXsP!GP`g6;y>mfdMJ){Gh_s`I&3| z>;10v?>Jl=2GZJZ0<*%d{La1W--L0w8KkaZk3bb;m~I6zA=(X3rFHxml+gGV>9=dx zHh|);k+(}JHfB%4n01Z3(J&czJwQp9y?Evmt=Gv>Q$v-G1NDdKK)EdMyE@1I=IQy> zj*nm6_P1o{Yv&w$US$4;*IQ@1Hu-kKFcw~T;r6u!ncxx9n&5dbjAy_W3}agR?GTt8 z%KEJy8Di&O%R1jo8@B8Bu1zC%zX{=O8u!jG2L{#_ya|70ZC6_HlU*D8z_ze6HM8rQ z*Nv^pOxvz&T%E7xedO9y@LMo-Z92=o(+W%LhDhtJuCDYltgN}BS&fenA=V7M&40Inq@9KQe_4MDQ=IOqY4KH?$+$>G^nI@Nm zwyCk-I@x{Q=reV+DD|pYEtpEXE*WnQ=TEvh3+f z`)He`^%z%|)73fE)#ZmK0`{)cX1^X(eI`-?XbZc>7S4Psc(O5LpZaLn zbkJE^|Lg7hVNOLSxv>n+k{Y=v<-tbj`iHEr7%hJdraVlLZLiqoLs4OuQ~&4>me%?6 zyHZNKitO@WF>`n8PM75gSJFItSyGy-a~mz~uFf5DRo~PhX80a*t^GtU_^bXV7m2g& zWtJVT&ZNA^+vA}v;NZ3;#{6DCkhaPVll+5U$WX?;`|7|z=O=3m-T+Zj=1ME+HRkNo zeLwv^Ow-o!TRcH+t6r2QTpK*~7D@$ekG&9J>B zL$scd7diit?OXo_UEB4MEQQr`N#`Z0OF9FiT%8q;UC+6I`cC-!nrr=QX>#9nyFZ8h zJOif4K(A|4?RdxfJ>t8+d3!my@a`EH_%8Tv5lKl&qdyrK2$GYHZ68>L%SFGAb5JWdduGN_|hAU!_3oVj~K%@v56%nq2D_4;(=xh~{ zF!C9!%HYy{{w77hgJ{vvJ_%G<*|}S$tC%3>S6sG0tcAI2f^Tz8DQo z@S2%oFdD*8CFjfHvUEQGRpR|K<@6$)BmAluOp7xdZzU7AgEMaT{P0m)8Bt zH^lqVfzkks^#yV4keF9IBUg~U@)L2c#Yt8BpmmP-Uq7qOj>_L55EI3}YX3#`tM)%C_GcVSAn~IL z;EF%g3i%MLD1X)dmiQw(myr4`)dWHs|DTvxi(ji^NGd`fUE&a4-Z60YktLFa*{J Fffuj^4AuYu literal 0 HcmV?d00001 diff --git a/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/Inputs/core.tainted-params-outside-blame b/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/Inputs/core.tainted-params-outside-blame new file mode 100644 index 0000000000000000000000000000000000000000..269cac7116975a7134beb7a644e73155a5e984b4 GIT binary patch literal 270336 zcmeEv3t$x0_4nP)5|$Xq0zspqju0iFNjBkO0Hc$Tzy<@XNl@x5yGfQLkYv~F2I7+i zf+hqsTD5AcjTS9h>p!-&#Xjr;KCtx>UsY>s;~NES6l?KO@|`>PoXuuPL=pY^I2Uey zbIv{Y+;e~T&Yjtv*_l;^#dEC|i=bo^r-^<^2%QRIP!~C349Ye{CvC*o$<4ionG`6> zHipS7q0nS6P?q)LrG+m4Kyr8ti2nJ4dPbaXwAAMB z`Od0nE%1Zek)zc{OnZjHgXKNGf%Q-=dXH0EG4+i8QN8YU1MBHnkuav7(Z5bCcU&>B zo`!ltbG-*xVAox=b>XVK;Ani3dST19bX@mk1oyxc_+EGtH zb~I;+LpiQ8C88n8BT<%PF4HIl#vG8FN1#kVb`Q)_`@&IJfV+agqmKBfT$LLnfX!oQ zPksnx|JFj~!s4R2#IcGL3TTZ$ZiGXpYKR_%`yF#puPLPYBj^}wK4y}P$Hd=K1v*CJ zG4D5|M_D-4{{DN?m%8!NavbpfCgVnGOC5Z{_l)KxRY87p$$! zbmz^!?TxQY2(z3kbPukIz%wHCu5re!JHu>nH5 z!9doN-wQhN!ijT~2P7#g+>H(NQbR(M#X^Q>e4mK*bhIbzM0-N&pX{5=W!S$ms}7Qs zbqVObAEm8K?l(hKa{ETSAa!HBF4Z6_EH)(gUK5e(oeA}@3YL5^&?TD^Y;P!Dy0L$R zCmhBNb6ujw8(jLy3Q=4QVg8 zDaYCzXnQgkXoDEZ>uhxIN^Ef<2wJQHx66jm3wc3Ac6Wv-FPGcp!H~BxR9+7ke#E@u zqWn4KaJ3|3x+pIyTTou*g9|^k!H}=9Y{8s5e}k{gTT$nOn$`9G2CP}GOb0cT99SXK zzy3>ZO-I$jr9`VZ2IK8X@)%okE=b-e?TpdKjze#ZUXBH&y)k;4W3p^d(y^bq*6y~u z+K1hDm?m87A|Y#Ew`=V~_U%ShS)TP?QQOlOxY}NGt$m}{T~_pHBmlG5_2^b%z@uGo z{k(77GN}GhhqT|mG$ZM_7NdHHYh!Mk^t*A`8VNJ^hQ>itGq9-;KZ+AjOt)z;M8zTk6Ldtq;z{rs2? z$#PfQWqYN8t9=3FLf8fqjNd3+bV0`0X&3qO}MY>{K; zYAft@JzBU^Dr8;P#>;l@{E@8R-n7%W=(%$-NLdl^rK&Sw(Fh=Pk}_ z`&V9B@x~L9?HaVTF)zuei{0SubP!#ciJ!w|!jD_V>KLYR|PKu5+nIH0Y=0Y%;@#}(E&Bje8mMC^yF|neI!Y&s})ev~ir5rgWcL4t~y( z$5ol+F;*s<0?};Mjjey|>+{QvPOA=o`#&4z#3`9R6Gf~_P7o?JAkuwzDJYLaB%u2Y zy3rrS;Xwm9`8E>Ohr_B7PZ!$5DTpBxPrWGLiRD=R{~Pe`f7KY#wm&(!?+pFjWe=YLo}t042|e{~$;zsvwLzzi@0|6L6HuYCTGc-3#c{%bz} zKfYk#Z{2WO(sk_ru35^xVFs81W`G%B2ABb6fEi#0m;q*h8DIvOfmjCc`oFx5)JSpk z{J(pZN=LnTlAahOguMSh5&oVb<_~iJzp6m>I`OtnLb`uKdYAWd1QOL9A!eleJ_zMK znKH@i&tG)k;_my^9VLWtN2RQ0)RXsuxPPU}-M^Y`=m~Fh8=~mFS|Qbw;mdlSU8GWTHr%~$|sG7(B!nIy`bh9hD|4a#KFjKBT&#mMieWWAyKNBnh| z>XqXC|K@f`*3h1i`bWQ0*ns0_#_K9nMMCP|*ZrNsQ2p!5QSA}puo#@kdw(UJ^0x?8 zcQ4-f#GljKM_yuka!>BdKYQuLEx(YlNq%IVp?jX}W zpNcpg1)ZAJ(i-iZ2J_wwd~Y%ZB(}F#Foeg zn;jlmGwQZ`j*4HpLqxKn0rv=PwY}vqO-oA^Eve@?981D~D9BF}@nJ{K9HHr9QREh9 zuGfuUG{De|cId5o_%W-NPL=Yezx0(2jCgkF?D_QCK?fb|mLq zXLrZB@*hr!6QgZu$6Fo3vl{lT4YpR@X0gSG6KWE|tp%%h-s2D>wUd+Wj*8?wt)N46 zS53TDw>q>=5iSsMR{N+Wp4$_KC3@`_UTCqLZ12%h#)|WGElx`iHqY?*Ijd*rLdz4c z3oY(kNBAM<>koxJB5}2Cy~U$9B$2W*u`C`X%!Af=%@-!SgZ+}BhTa6 zJi%slPe`_Dtz#;dC&d3{^O1Um&1#V~h0U7dzOA4j(fY|6y+*Tzb#1z1(_K5l#iNt8 zWKFcKP87o~b&OBkHm1NLR$DB#M8~il3wmr1riF!LoF>A+hP}?BXRWr|R)pscUzOFt)byt<7G2l!9rHwD@ij^D zaS12>!s=WdzCqk*E3rZ#b}dbBozQW`caA@EbgS58J8|`iwzZo5Wtbi0g=0Lv~?F2?IHu;W=@h(c-R| zT{e5Ce%qR`C;z$=PIdmNds9mMRVfd&zIyc!#Mv9|307CfRVn&-hiJ9@z-8+QkGU_9 ztc%^Qg(F3)Tv}{;c#OUEYKQH@z-@(|iif+r$-^`Yv>+^buw20G7x6cUv3gf^nO2|+ z%lzqiBZNJ#t3!{BxZP^IW^SU*e#JO#g2y4Oj>wJ4^Yg-?z)e$9yw}4d)iziQyw)*# ziFWPY@I}Lq*YvHOKhwga^Tl;lZd+R9vBEiVwoYqDzO8e$NNcg>JY=zXL}cW{FJ9Xd zhPB9L3p<3xmXes<;St#_t?LDZGv<%_Z6i8f8ot`<8hy=@5gk+Bj2HP~n{au=MEzN7 zk422R02a4DO|czg{|M&beZrAy-~3&RD=pmNv0I8nSXf1ZIH5qZT8$stIVKpts+wcj zX0?dy(UJR~j0=wsy9*~TZShR1fk}7TnAKsS-JXA~1NaEHq~zs@E%sYrB=UBMyPfOB zFipSD-kInro7UsV6J6rS7E8n)zWJI0SDZ6kF)eT&|7V5=Go7-348O1F~fxY zDred3octpmIc?8j+GZH3O`;<^d-U6hw~Z1-E%5t@@V3N)M{Sm^Yu3mW-fBw38F^Lv? zd}=5BAj%>NA%b|<>uFgce*6S|i{6s&vO2-f zPmZ$`w8V|LeV*r4eYDMSkF7$t+frtL8=FYhXC~N+&e2kCvpDSYHw*njm@}R6ulB8W zjO)|KIH%0jMrFC44Qsb~^0ytYi`>)+ojtmk8bA7YU8}NN+;;dK&gk&ko5fLD*)VaN zWlUlCnde%Brlr6MVBCB$0p@l4BYBpVWcabpO_obq>%(ir2)mYjqvP;Vwqv}1tK2># z)nm(_>Wtf(+PYd?tJz>G-i=*W5qTR?z29Z zwP4g(VclRAz1NO8QY7Y-iim6Hi`V39www|9y0a{~7uF+tt0ghrs@-<@8jF}<@43zy z_J}MoEk$g$Om_hX#`%CeuaM6Yl?#P@MyI?_Sf269`<&&u?Xi%LhddGT36RquPl0?g z&xc$Lc_HL7$Y()b0{J_T&xI`0d5|xF zTmjh!c^Tw7$TG=$q%VXVgxmyqCFDyWuY$Z9@;b;@LWVU(Y=qna`5MUIh5S9pGTj9E z2ataV`8LQuf-KXWkmZhd7v#Gk-wXLZ$iIaAE67_QKLGi+kROD+74kO74?&jc5y(3r z{}J+&ke`P94CLn_zXyY1o{1)VQA-@M%ruP+yzXSF{{t)tB z$e%#|400c2x$@W`4}&bzaKI6e6Hu1Fs~QP83Gx`!jRia$ath?5ARi0)c*v=cCqtI$ zB*2p)XF$$`oCSF*xbvKKNXA8ao} zxel-a@`aFtkeeW14Ea*XmqT6!ISd)*vsepRrdGf<$QvME4f#6A--G;p$hSc5gnS$1 zA3?qY@?DUB0{LFZU6AjC{0qpxg!}+x`E1tTLH<4DZIB;PJuig@-dK)gDlfTz!M-(f;<^=I^+z^eIl2>#+SH=+|MH(gH`r zAim*BIuXmx0p0y3J2%+mQzgKQ!0%h&Q?5gWU|#{_kb>n;V4GyV31uHB?u9xsoo9!3 z;ao%}Ta5jmz}F_wy^p%NXd~@@4`siBY;1#{KSGRJOx;tVU>Zr=%Q$#heU zug7593%+K7%}3aOxwdTp-Rbb-4>$O~2J)@ozYlDF2m1HGXKcCvbWKoxG}yKmaiXF+}pWx38! zlIx{RBf&m4)q#&qP$xEx09(1P$n-;KOCH-E1^(oID33KVRf7IO$PQ@hZSZ*k^wR@2 zlnTM`6QCat{rRGlgmvV4cro@%uF<<8|0Bj<3iy+0GWdKL`zK|&p2?I9bC^NWzw-Rzb+Ai zfL@CCLfeO7>@T2UCEyL<>yKFXDa0Q@dvaZt=Mt1kpzh^h8vsQjv|9?>dmzj7dj-b2 zz8Q4;puzjWmpp!dh;4oz(+3aeu7UWsV?A$7U;haD2V&yC8D#mT(yyU@5PYtHx}#%w ztO5PYP`(Cy)dNn2@@E0JfRA5ee`GT^VjViBNZlRayANz-ny5fL3U*gvy<4zOJlNcV zFy22%;lN>BVTYLkuJKBI;vQ zx%>NNhQFS%XrHW5M~omkpFYp9>qglzPT4s|mm7K=BU;Zc*_O|6Ql6@~+bqc6X?9_Ybfih~0=ztWW%R;y84D#ql`U_?`1qoCk`( zw?x@#3(&qmVdST(Ujp?98-Lfk%8&jm^7WQN=U)_dVEKOYXO}9c_|5bGtInUV8-EwZ z?fwsopXQHlRpZ*VZy^7)|8~Z!^6rHS#m58r@5T8qhN<$vCRIMv{OKh7uQ`9r@%Mg9 z@kjEIheI5HfuT{~oIK=iATXHh1mE^TcnWie(?>eTuXe`qy3g8Yym1ZIq;rDjp4~p;3A0q$j5l>f0 z{A@yAu=;m)Ax6@$KB7R>CZQhZkvWiqng7xU(eXUa ziScO=F7(l!TaTOx@Ux)H~ z#H$f+K+>4lUg!0pY5l=-dMm!I(2HR;x ztV4YZBKiLT%3X*Lk&N|TMBIz0rKmW1$Pc0m^__@25PK0HM?MaOdvH8v{nlw5;{Jj1 zKM_AM$uxeSp_FF}U#)%Ww>hq%WOKY!pYUM$qw})~2jK6U zYM(Cm()ut|I|ti82NHBL_OA!W$$_7bT&O<_u?n#fk;Wrzl1We4g5|AuI;w6aJA$B1? ziTFC=M~L>Dl>ZdODTujVIdb|b!l_$i|G zX5}vt@dU(^5%UojBhr4l9OadWYY?wO{669xh`&U95b+trw-G-_O#Z%#CmnGP;<<>+ z5LY6uLp1Zi^56_yk9^&PcnjkFh_@sD81Wv&F2r9TK7jZj;&#Lxh{J!N#_fsLsB(E-gLGdF@jk=t2N&N(*#7B5G=&R+=ba@c`)ZUwNBcUI={z>=W5pNw|GK#SLFMmnh`SMo z{a)#{PrtZ5Z(Xf7=#zJmtCVuC8V_Hn#@E=d77o-`H~O38{m7K;qz~43tNbfT4L{IQ zero)|P>dU~_Z+3KZKw?yzOb+t^$k9yCPzE_^(+02%cHJ(P#^FHgDb1Z8h$%P`bK}q zU+J%-3f-h{s;H~2T<*IFtL#91W1zC%32a4BAM`b@sIBZLXbb60-R(mC04E?gO4WU; zJtYb?l%0rdH8IF0mLrEPQ(txXg$-0$FJ(sI?>snWZExG=20d)pLl!~31h=*Dt${ho(Zy)Hxt+67Q{qC8Z6&mUF&z~kr#<<2Kj zkFvR4lHJcLI}c*_^XTU}g&n9TdoyaUE4%Qk3Ux#eVh3U`qPc$8ZdI@6U4@;95kxnZ z_o8gBA4yU7XFHEj_#*Oe#xRzf>-QX~>UAONXcs`)gYr=I1IMcR-Nz{GLF_nQ$pXtY zM05Kcrz<-TqR^EbK{KnW~7s~^-g#+$`p!$oj++!cS{6eaqVlKBBm-tp= zxieLj_k5<}u*9qQZX^F$1M6F@s{B4I@0~HQ+-9>Hhwx{x+%eMR-=gZjPVGC)^)1Fy zYQg&-!lw@`r}k5@+*vrVoZ1g`4Ah&3=NlKpZ>jUc$S#HYZj?V#DBe{Veg|cYDExtv zdk{SzDp}j3uoF?BA5SjcM}YU6(ETU${pUB0UzSKX9PY5A(D(H(Kb|G#-+=1AQxDyfLHPT+h$Rsrmj-?89k9scs68xQ60PVJ5IrXCz z%hQff^@Lm13!}auS?O=Y`ZxNN>_R{Gh05MT?Y^b%fBhWo#QDlTfc`vrN`3?Vbrz`l zJ5E#jFzW5-F9+jtQhX<3`zY&Zw*~9#b5(f{+UaQLL46L|*I*o-M=SddY_|*L2>RPu zp~`y^omhVdqOhp)R;*9Fg~lrV4jdN`_CE#d)nU22QC;_NpuDq4)zip74pihwrSHLV z8n=$!itmR;t8#($y0Kjsj$Z)%YsklD>}MGHZ^rm(UYL=dV`tU}#-DAhAK@i0-?UGz z=CuwAPMf^ZvVGBU z4_^54_VEjUG4qp!oA%xpZZA&T{@#&)J>&ORzN!E0v7^s;|DCt*T{9cBWV|v)c`hOG7|2p5&s`Ql z)*(xoQtUSAr2i#QS)xp&r}MKoJYSS`p?FpFa}^nyknE{G)uYc_CiAFB_ESym(dV$J zp=pEcsXnzwpU+I@QIYJuruOJ_Th!3BLH1Oi+M~~NCiAFx4Yp&hN1yYehNca&r~1?$ zef~3{9OTkKHGx#zi8=roXf)Fchuv+jb1#yzhOeT-ya8=_J7Y9C&gSve@pC}$ zhw8jje@Ed^ys@4cUo{B?*%aaLp9z0n z^t|!?;(dr@XGUsAe*YlTmNN#PSJHW>$D)4cq^yMapT9nL;y|8=7s4yPrOyxay*-T| zjTgn?9^&&ugsu;e;g>}E{Lu0(^^d;Cr+I4bpJ%B4rF`-D4AougpTO}Yekl&B=YDG7 zeFvmxWCoZ4W`G&^atzSAPPYwQKjWOwx-u8t_~mM|6*IsLFayj0Gr$Zm1Iz$3zzi@0 z%m6dM3@`)C05iZ0Fayj0Gr$Zm1OGV;>^()@zww_FF-OV_Fayj0Gr$Zm1Iz$3zzi@0 z%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzqEFFmU~hSy>}Kv)pw3jEhf~xD&7M(eI!B zcbNEgddj?hJ3RmAw$l5b8#+hM3@`)C05iZ0Fayj0Gw^T6z^cOHxmJsX9y1Kj8$Qi= zmUmCN3RTC5oBtGj5IQ{XJ4cLwzo}xPVN35E8LV^N5346W5elIhX7Y27e4cpEv#Px3 z*$IZ8&@JfI}2P#5(jJtephs-&u+J2Y{Wik;;TbU%v z+=cxxqXuO%X~tjmOn13i`evx=VCuQC-a{Kzpk}PX4iQqEXF@%C*9(U7g+QZOg6$18 z4jR6oh7jpBIFavykrQX$!o{Nc?xbAf(pDd?Rv@?AA!AWI+go*dXTl8k>GWP1OMoF-!-OAh37vk!-C zPVyZxGG2OzjeM`VOtMe(ULJbij?~L{@yKbIBn3<|7HKczmi^Fdc>??{cx`PHXwGW0N*T+RDDmc4>TMU#UMb2I*h+Q^qCxBjc29%UEQ;{`Q{#>KB%M zdRwveu?s!7UmO2YZr#UkY&~}8i-6@fud2TNcjxye{OLETxsIl?+EeD=|M={_KYsV= zzv6&S zzdy77(z&zhulUOYFZ^)%oU|WqzAm|Umt}4%G(Tv%AGBkj7rprA1{YaDho#>ru4FpGMxbAj20h6-v^+ypc_KJ6bz)FPK%mRuVICwhp_L#cskVU%0waB zUk>`wFiZ5_35JIDqnpq^yh_EHh4wF?edGgWpN9IyfTJNIf$NZ*6Ea-`+2FyW{M>11 zg}5E{5%j+n^>Y46`;K;Hza8~D>a}~7{!`S?HsTp0!q2IAsNJhTFa0=z%HC~N6@G(y z?f;ZMgdP3^`gcF6^sVSW1?@Y3uJk9N{%+LkxJS=N{Yj|rDOL7#OpwxOxu^E1ICF5} z83u6;HtrvQy^KFBUortHPk}fQQ0m=RD*wf(F91>Mwab+LEbQ+&Aj)y+M1DF^{}-qy z^>!RD8uw-BC;WHiI3Ddqd1I)qs=T_+U*WA2U9a(~4#UuDS9 z*L#=y%7Yu)HpZ1j0Upe(Pet*9j9hAP9V(i^I* zfvRW=M$I`h%By{$^2$I{`BJFZ)CliUHA3))ymjS)#@dF^QbSSY^VZe*!Go_n1g~tB zHo@BJ1~7{C7iwydF&REr$ljXqm;K4BQR#i0`u4D{S37reoR+iT`EcF}u zsPFQnjXu@YDqlrYwPC1aZ)5ce!!|ZP@K6h!#SmNGs5}~~s@igRYizU?Xtgm^+fZE& z@6DARtFQDoH7Lqsof>7->BdIC3cWu>MZFxfdarD}+z8dEh0Gh3>Z;P~Y8#rG(}Dc- z8PhU?{)}ufued0GPI-1lcE!Owx~xYu!_oMjKLh0@_GhN_+n_!Punrr~5n%@`ZtVT951| zePEyRx0)CjD`!PkU)#oMH6iG3lqF{f#EQ3-#S5 zy$|)`&jbBmjC#9CzZu)rP5N%sH=Fe9(NC92e=F*HO!}Xrey2&l74<1E4~+8#)N3aF z-b)mpOHBH-OO?LEq~D2tc9`^^qF(%EV7qSglVj2!R;K*dnDi4+A28{sqQ29lUxfP2 zCjC;>_n7o8s89Lpz&LM3z00KkCFdSmpoW|1$6ebax|Jwbff zcf!vBl8zI5l8*hfMizYd&a3cD-ws2T4So2|(@|Lt?T7Ddjmq+5|HF6gBN@Ea8{P_p z;SXe=Nj~2sFOHR6Yj@(EEm$418|>e(&eQ_oaW+9n#;vQ@!`LS0Ty!wVT_$A?dHjJhWh2dDZ1VpC9`* z<9?>BU>(I6*eR5(3 zm;q*h8DIvO0cL<1U+lE4@@Ej4-lmX0vnkkESsSeM<8SF2YkYO5WH|9R zb(sP9jik5Q7t9P?6sqwzAf!*tn2~WxCj2rolY)@`f-BAT(#{#R!#K_HJC0ZJu?zimBlaM= zvD||gKY1>G>EP{>UFVenE2m@C+j!Z8Gi;7^hyX_5;!5Gs?TF2JSCr zm-O6&7bht@CnDKd@W+w$i^HTEfI77wqm}E0OcLq&9)@C&KQErD`ayMQe^;DVJe>$AU9^BY$y-n&+5{bZ`!v?h>x4@HB)*J-r$)7x2kzS@sX2c)UUv} zNw1+^KHq?J5~rZP@krHADw~1&ph=&P`jAP#5cTre2;@WJ64Z|~=_^owxJh4!`XfyG z6{t@!>BFc$(xhLH`i^UEi2d2KxE}S_nDm{fzt*Jx3F^OV(*F|m*O~NNQGdNj|2XPz zFzH`F{r61z*HC|>N&g<|*O>HsQNPxtkHdAZ#iSpF`gJD#k*L4Iq)$ctl_q^A>RV0v zS>zv{gAqF)%=&k3!F3tqr};_x*t%b3`-F?sx^CV-vQSU$kk8quH_zWf)XV32kgY^L zR*2cA^@-L+l4DGGlNn$Jm;q*h8DIvO0cL<1UcH!HbWy4b_41w``VL#FR)IkrWT}^_X6Ez8^(<*4 zFZf74PKPYZKa2-MyJh^u>`(jpKKn`Z(Ij!%FJA6g-D-sLlSyDGlTG|qLK+1i1x&|F zv^(fl5n;&EGZ`S7CdS)b3FA7NPypuTYPCN^CjE zdbgVD9jJf5MEm9gjk|dvz+iWn+M_-U#tW56?7@1mI=Ma6{Mlo&?=d~Uv-kZ{WCi10AdefFQUND17VaqNKcLtokQqNW>GORgnc*a zo!D-)!Z);`VLJ{)-PEqfBp+-T?nC6~VB0^`_1rj4I?hw_PoMKhJ`e`d)qItoS4TsZ z`+@xIsN?5a4`L@G6dCWfmiR@9J{Lx9Fi!d$HerbGv!nLk;Kr9-OJoQ=`1zgc(0(6i z?EgL6*9n#01Ft219WVcVb)DU6{nZhvhwgu>>lF0;3XO}%Q1h5%9WNYoU`3rA;1?^M z_#Pv&*IJZcGCL4D@OuxkBR_<*9vSM0Lp25>9cSF8;|Kk&e4zC=C-o&FL5?3A->aBg z>OkHEmUn(|=b&~%ylt*JsJs`ym-FEDBl_OUY)rh;`q8u9G+wyAnCo}o@2vGv9>XPF zA0z+dkK|^wCz_*u`dUE^~(SiPksun>19f)DX z&Vy{%L-8M=-J#++SbgAIZtq~@{Ic~T$iFUhql(+6kdEKx>-+)Jyrg!zV(tf^eMFXZ zS#=3wi&d8pMQJ17u}x{H@7?c=)5!!;$(qAs$acGu&EKOMg)x6<6+^x^&G7_G zzh9QFWBVD?)S#Oh_JiUW)aYv{oj8u&rl8F0%Kw^7l+yZ3vWX^A3%Y;7jmLo=yf25& zw}?OU`kiLF@1Wn|z^$G+YX0>iiUK7MwCb1iGIc+N8?nDcZBcxr@5OjY{&&Ry_Qx|s zzYbO0jsx&}sM`6q{Ak!89q+TDc5TL|CLwm<`b_g%8){zS^D^Y;ESaUfymr@&_noyO zcEsF=M%U!PY{*3Su|*9q&hyLFJSL>|*RyQ!`A_SleYq+h$}ZZ@m)IaqzJ%$wZeos& z)*lMQTuyp;mQ+)7`id%e_7D8e5(WQK_X)`3w>$@(6(dU@8s0xe*KJQR$qP{)iw%&R zh_V;U>AEq=G+rfGPB-t7OxJ;ZSWef8Nk;dgT0Z$By=G;lHxQIhTuO&0F0GiFIjA~2 zGgKGM#GBdh@l1wF-2(?tXZq?Xg7G;T2A`Lt|L1Q9-Vde!M9I{zuiCQNp9}pF&tKLb zJzq}XbI|B{X!P7LdcGDtw<`KQBQ~I(*9DKo@(0sHen0SASGS@*YnlP+S<~RDa)GSq z)4GHpzV>_mm0$5U1^vpocc3ii>sM`G*&n*+-(k26%m6dM3@`)C05iZ0Fayj0Gr$Zm z1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0 zGr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0 zFayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C z05iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM z3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0 z%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3 zzzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm z1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0 zGr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0 zFayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C z05iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM z3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0 z%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3 zzzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm z1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0 zGr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0%)kH!o}YN-p6{#@ z!UkFgDj7W)|FYWzQUM)Fn^6i^MU4po~Gg_8O`K;H&Q%e{o=6NI#Jor zjMEL-jq^Ja!@KlF^O@>dRBiFzYTPhEq~|!LL4x)sDRIInCsxU=eSf>h2<4%Fc2=ko z_4k^ywpYrn^V-)R7OOXJcjEp>ann3WeOmD)+=~BqZaKr?i|YFpt8y7X^?}Od{v4ak z<+6;%mw2LfX}@>i{-1;x>o0bj>i3+Y_}6j3RuvY{wOTCE;foWesW|UdDxI7>iTr}B ziyV;%f6ox}g(Ow3YdU0^bmMP7c3PE!5SJ-q9hCI~iANd+W*m=x2x;C+j-qQ8+Qh>C z>zrm3%X%_a_pj7C=Khsh?+9;n8)l;SYK1~*#)b@E*7NLA^*p;&J;GibG(zg1?3>Iz z*ncw?K$%R0(pDykGN<8)m{Ef=nKa|C5Y*mqkY&B0`bYeAnCg|j8LB#%_S{%+1CE~= zud7fE5z01XIuq&{JE9T~_?O}?!S;sgUssNDMTo;qr}!q&*IuA(KrcQ|&*_X$p-(_(S_Wt*fLz{71Mxpdzuc z)mR@o(GS`6+^+1%zqy>`-V;=P3q&i=Ghk-c+&%SQedMP%ePCSS$!c99K7`o)y46@{> z4ArmLa#^3+iD0?ZebprU)`RtXaa_nB`6r*$KZ=Kt$_K;Pbw2I1fyalz?4^$SP32UN z=9!r{;ly#r9c{mIa`gWhAFmj=KXg{B@vq8K@z)?ym=7*h_R)Q@^kw5bnCg)|)u(!d z)ZUIWRXyVMIc(=eMA|>7y@$~O@lN%~p6ZkRVbK7Ev0v^jpRdjXE>h=DA!stA}IIi*c?_bgn*_+Qx zi4UqzGQ~&nQajR@Otim9dpYkT7-t_OSx)wWM#T^DD$8OM+3&@16W0uGFOPdN(fZPR zx#E|2mgVvoN&Wb3%fR`UbDfeqc9*L0`bZ)5L;5xnuJ;}2pOA`s7b(8Am8yN}r@(qN zK656i_4|!Qsz3LvxxqLbzOhy5NnZCn6po zzkR3CFOt_xR{lsInW5yK8EXElA2yI5>Yo{@{ubPSMXwyOzCMbB&gZ*K$4RrFsGOtP zr~Q@u(0<-BU6r>YQoZQ@M+(#WK=xFh%*;sZ!`oL@7<`@BRpFC1y~v9|zmfIV8=<*T zuOse29w=_Jf0D`XPOPWl`FPH9HGinT6bJ3ERG;igHY3$1J;g`yQae;W6w0xTE$c2B zxbDW5$?Y!e&%;G(oL2ox%`3AV@k7T^;-MSs-!e=$s>GHXb&#iBST5oR+L3*KSSrjy+T1nTTr7kt12OY#rC*469^xuQ#}ZYZhj_(#Nm3-^bI2TkRiH zQSQYLIrRCZ@3Ws6-$(M;cg>Go@bPhgot3;oD>3A)VZ$=8J;|_fu zBsJO5{Gu;8=Dx4KSx7`fl1HMfK9vhG$|N5_j!pUpW+}doLOq=h9f$Hq$QynwBOXJ0 zlRF_k%hhn@Ke{<*M){0s`H12}-r_Y#X+&<#1_60Ko7lms4 z4G8H|GiGF*qMYD8CNV~`&>7Q0a9L$~FysrQSJrtOs@IV(_`JIy(J>eN|5zoDN#tBN)%s#MWzXV$FBm~DTf zq0f@~dc&=A`s}Hv%$}AtE7+8a8`Zf}owKJ+omJ^IHnL`gRvH`Gv;43zZT7V6S;3HD zJZ+Y**=Ra@)|8Bpx6#$6@cv{Rh^c4Coeb!xE z-)|JE>#rPYj@iCgQD6jdO27W%+CbD%zqYD>GbZ4=#(s57Gj%bpV_LizxS$Y2u|mbg z+0lZEevhGn+x<47ew!*^MYL*Tpgy|2EQVs3xKX_?W;+TF(ig3JvA>_O z%0O+u5W`*!A(h_#&{o#=hZbDfzg-ox?F&{#n_3pAHnyk3Xf6x*`i1(~5)fjFs%w`< z>r~XML6r3a6{5}?TwVE(;yE(?bIo2k|f2ek8e`A4${`i6`25hT=l3wd$ zi~^NvUoiCk715~cV|ra5+qL@a7^CI=+bexBvHD~BRv%D%hS9>b{tBS)7gqSy07;_@ z)zp-m4Nd(fE9?8Wy}|x2H}=!mSihp*&C)ux2TMQR6>2q-+pus(d%3i(-)D7QR9)4- z*<9J*Qu9hRE2Ni;Vj`=I>8-E6-`-!{@7-VB&$HL7BAX#2Ycg7un@j6r^!3x!ERY5D zwW?j*R^c1M@))DQ)TpQWKz{@NYBdX_ePh4*O0SAds{J_QjO{=ZtlqGANg)_eLCfvt zU_kY3#w<}<>Vma?;ljc>Wkrh?=4LrFvYj&_XJ=$NwdvEQXPu%+T~5Z-=^0s5v$gDO zv0zcb;^M;6@{+|1%gRlrJvLSX?$Y zJx92TO3R?tvXVu`xwX{|{zhL_Qy?f@i%QED<}E19m4`KNRWN;eR#uLP9*pEUfLK{m zTUk?H<%7d+qc0axOJ6GH%=waM32dGK?#ArnvB|!s6K8EGd{*UXWLoS6)yArvwAsW@e~U5=9(L`%u8UJk!@4 z@Hav~4ehMV6<#=VfpeB2iu+G&&|WHxO(ADbVF6CKT%!+VW#7rolxJE2XaIs=-m^88)MzC+fY+eL&xG z-?R)^`{dA}QKi2=0K7Gp2Sffw@Rqp@PWv0G>wKA&MjhiXe0G?YG1VCGL43zF8Sulp zRU1r~a}GbrsM1E*<$aB+T}ik%)L8577mZIdW)Vn|RLZ?P_QZcyzul6otdbf1V$kT8 z`YRhTM7a@lPirErAh;*enrKYZ(xP(;VG(gU1sn!S7r6@;=3aWKF{@-(V2T9;wEk!hV@HS-Vt= z`ZUV4^z=~ZqI7>l-9@n3=<`;k8!kwYi)Ej_3-vFd z!(?euvE1E_C84~aFn{s9S?SKpCTO|Zq^wEW`Lnf9jjtg=tMmqaP%V9eR@(j~0FV6Z~=v7e!VCla&L zF9XXee?OD5hCvv#C$}d~oO15*dFkhP(=T?W&n!P5%F?|unEedTg>qROjV>Cw$C!1K ze3dnRh-6Z#tU3vLGRYHT4N5r2P>vgY5EwQg=fQMYxRf5HL!vDh@`m6PHud!Vdbi)K zlT%ENp_+9nA~kiDX0W-uLJiHJ(;8eE`!jGIL!#Un(`7TXuMc!f+D2cfsSzf)G&H&} zU=azftPNGx)YnBKybcgBpsDg8XH%08wp@E4(j2ec14=N^kJoScZD{AX% zLl=G3;L=s?{vEpCdw+aGM`m!V&Q7(Vttft@69#puI5t|k??TPl-@37UOei%*w6>vI z3;DGL>cfKuRb+p)6>xNhgOXehg8rt)%0UOAwxJfj_=DXFtZ;Xd3)6%--i8J^ZmB8r z1>R5AfEPITtJ0*o!GvrOC!(BCOKS&C!pi>nXY_DFYL+}CO{nvGt6({Wwo%d4pj6Qr zVXPz*)QSK{RN0OSIlAw|2`5xHN=(hh%zAWCuS_AhMa2bQ<6{%7f$8wUNtEZxua9Ns z#0)S4%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm z1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0Gr$Zm1Iz$3zzi@0%m6dM3@`)C05iZ0Fayj0 zGr$Zm1OGk@;Co%80nvM1yYU4yI+mo-3u-`??{&4oUx!FC-t|cDnu$7z**G6x9eKoR<%)R)+8#Cfts0AUK33?Cd$r!8|3&5vLgj7$4 zC*O4=>5x_FJvp#xymMFfgWi=R-;pE3mhal3cx8R*OQI~3_Og6yYS-vIDcS6W)>KQF z>dCk5T)z0P7m7a|-Sub3&9|0Z?X0=tjCF5~yz1CB^B=d@UDtf;rAPi~PQ&^skDMsq z5mvwC$^q}+g6acO8b}i$!ft#)@ZB;1NV2^#pbul9N25L$^wK_zFZl6EV@UE1(T2TA zFRL5&CO_lQz7yM>46;m1AWJ_QzA)$qhE@pq{$AW~tQY0wE2@J2@@iiwR9o-!FRk)kL^`RU?Mir(-*U3rPub`Tk`5eI2AW6; zRyUXX)DI+1hYM#$FzF|?oRAm0PI3v|YsVfdIcGJft=aT{$Lh83)hw?3e} zT@#mw+3vCebs2kH8S2KJ19gd*i3`+W+?xG ztUz((t&OuTlpG|+$Ij{Ejl=GGr>}4E+I==x<;O)E!!m%Pwr7gk9xF~Nh`6@CWplN? znRj;HS$T`|%1Vnij&~Ner{sOS-IBCU&f&av-L`fw2DXy7M2NPVA|4@|lf6uur-FfY<@vin#t*~7yocWigyIq!ju4i|; z;?B}sadXp(+PYo2eUIHdd&S{d&$!aXA8ww#cAG`1R{p)n(tU2;c?;UCdFSU{P}FA0 zisY4_zkN@~J6?FZ;@Z8|Q0dyeaUsXKTjbjo^Ujl2(x7-_dhUyTeTD5lQMm4nP)~9D z^ywhG+DFa+FoG{^zf2U){JiO9)r;<;f4=3i{NbHU@Y6m{?C9$QAD=u5jl8xmukE>y zhm8Q0C3M4pj<UKd-|M{vb>7H&40{JOu^V%1SyqV86ec!b)+5XNi_Vx8GU7C?}Tni8^#9|n*y}yF0 zFeoq}MQtCIy4pT-t$m}{wRX3|wXQFz;*lY?{jIp|t)yYQ9(HXUx#ukiZ{xV#zwGN|8?Oy2nDT#qH^1Km>Be0^k%ms&M8@O@EEfkT>NFk;BwJ?v;lP z4=(^1Gvw)yhrJEkmZX;1;M=HPko4d&&w`G2leX@HwwGY0`~-CWe96_e&GqcNQuAz2 z;kuXGM{bg)`%RN8K%3V-CU54`P2V$S$#iHw>9_*mXydS#?w36r_spA;na4qZB$?Uf zYS%TGA)z=|+wkp4$Ay6$u~<$dW8W^Wd>f|H9yyir)_$IpbmfCkyhSdp1#PbaacjWS zvpsFwR=>6u)|sT1$Dm|Er~+nvQa{J6&y4UF`vAB4}?vW#$J-Elx1q^|#fzDZhXXh%Tu` z9%c4)?D`|Lx^}yqV3)z)U1!lmN?#9R>_mD8CQ=3H`X|ym#zcCredM{)biav|3);N) zv3WC}37u%n*k?W-HXU@9rtiP=Ak3-gBsZ49SyCexr7YMeTKkX{7Ng~_!<2^!vh`Kl z0w~IBcj_NMVrg2ipgp0eJ>M=57BlxW?Q~h5a>dQF7sn;J+P2ct?rPg1SM`mpVutS_ z*XmE?g1_=zxk#L0FShJ(wZ&yc-Wd;V0S9+3HRku)zND3InB*V*OolSEaIO0|G||;I7nUE_qsD33_VzV9f#6+l zF5dE{nj&p)p1(aSvc01}E#7ho6v0lC6c_1`J5Pe#1Nz`oTH6uQGn_+uNifB4MD{}5*+qb+6UEB4sEQQr`Y1<`Fj$BPf|cDw%g?OWHKi))nZBhS0VZ$i<;UrMvpYm=U#?z%^r z!_4`t-8@3+^sL!#!BLv?d3KdMpPuF??DDdx3jAYecC&L7=+DlOw>Zzri4^`yyapJ@ zqjSIV4e>?@pfmt$y+>R-B<2;L$Q9(T{6w5*aZ=g8usX+llzqrw`HOg+e;7cFM^W*o zXar5;Vc+ua2MPgsc8n=>*Eh{V!jkQeU-^!>z7JR9R~+$0_%nBsu6#-e}x+YB(Cp2 zF04f?$>jHV*k^@GM7md7h-?%UKjwP(anrjn4j!3fl3#2y*$^-U3;{#H5HJJ`0YktL zFa-WL0*&X#1I%Dz{OQ%m5HJLW3<2za{^P^;|B$_Ro30^11hD^Wxa+h1Z_B|DFa!(% LL%SC0jNn+i~L7S;Vx}W;@d(CCfII#4Tx=GUduYYRid@)p?>wO5#e9 z8u{qT1=4y^T9kF&+G|&|z4FHaEAcPmKAV^y3p1P^Oh`i zf5h77d+)yFdyns>M$x4U!m}U0cc1T%yZhd~_wMf9>0_yhF~83zIQYeT1*ML5BqU`1 z3NbY*lM0KAH6kJ2E#4(UKss46K>KTFl!Ep(mYdez8O41GRRD2W3T z$fi9h%sVQ$$8?8=H~UZk5%V)f+v1=ScFZqL4o&<#!z; zvi(l_%AG*Eek*-t<$Y=2bLsEiG46qZ^~ylk>W!J6zWq&o%KzNn4PcAfrW5J<&6SU= zuC6{8TwNOxzSCDPUY%(cuBR^{>;I!qH8E02*Ppyyuf2Ny(5vb5soV9g)0PTJ{?g06 zB$KY!Zl%wIo=@GXKeuuP8NqSAR`H8UK5{MfbE@VysZG-L)UEWj)CvLV^RRK@$(5C_ zkoNf}SN@t>d8LNb;4-X5tk!z^WO`)TS$acVP3%>j9&0@FnHniTY0`>aXpu|7UXbo_|R%UG=3$zE}HqYVY4Uo%~?( zbn=O$ZuOCDPn3wL>?f*cQ2(_C-`2n*Xa+%#>la^NU7Z5$LiPse^PryuT>9$CG1a;6L7IZ^BgceqvDdeCU1!%t@aX=acgF&3M@e9RXD?wfT%QKU?+}uq za>S9>y`Ul)?)`*+bbaUpFoY!WbGV4#58B{QHTh2iPJ=&c<$u)VlkGpowFrKm_+#PT z&-zp0EuRUb!jTIdsqnT>2h-u$Cqn6Pe5vz5I8h46li^r0ylr1NvM;=4U$}Q)xJ%aO zWvE|<9WFbWYlpT6+8$_opzVRS2i^=1#4vV~K~WxKGF_(%5$iDJ)~oc%kePl5^VK|R zt4h905mt#tz0`p)qus&YTvOLc!c??x#n*DQ2rJqrJrT%LpJdbrN zz=6@xha=lCgWDd7YrC{qWGFT?7~3^C9NBg(pNph3hKUah#t{+X=&N={KLiKnfZZS{!COx zBp#X0#dqzA?HP#;4##8Dd*U<0!#j8GjPJ>22M0%T!y_X@@%*0n@W^%{s2$~;2#!9G ze2;JE!eDG@M2L^6e#o?sD{9IGE45OofI`k@vyMs%;grpkO6BQ7$yJv7HBGvZe{i8# zn}uj8GoODrq7*4>?r)~tjsr&?7duiI8goBYxEw6^*vk44CYad|>F{ZFPKZr5-j3{y zzECL}`K$p?)6K&7ow7G}!VG=L?2DQ$elug>s>U32&>d5Y4|g;F7_#W!9~d&lC%@^49cfPhOW| z>TIKSd$!xt?Otx*pY&XMsC|F7pSS1-54NATw)fB5=lyxEJsv{;-|?0k57Bsz#<%pT z&RKqL(~qmRr7>Ak)_pwS)M<~m+T&-Mx3tI4?)OW3KBQil^7+%A-?rzs*8Z^LZNFYY ziy^l4r_5ku4-Kz9xydk(shbSH*O|J>@OtZ*8Uwh=@EYutT8nj)xv2DatMy&4aRGhG zr*J~qdaJC%&^p%t!Md94|Bkh=yINNx#W!O+-L5_ zzEj7mKk|AY({_LS<<@!M?Ectp&%2s;yk(v*?e=W9=l|z<6S+_c7C7R))u( z?|*|aD33k!YK-wkIsWlcmiQdGPM9$y{Ni)?CEPDRSo$6d2!FtTX|YrIF9Ai==o0=5 zhzh^2AHTlGIz-5n2z|knSXd)MBrH1ov^mfBSWtA6M$mr=taZdfbZ)I!FQr1EU`HqM zJ7vx6O zJM1#!n@A=&Y?BGSM+Exc+ue;vW@nEeEg{Q>O7B73=kxt6yq*ZA-1Mmykv@uwfUnQr z6MVpTkP@GNH_1EEKQod<)yP&6q1 zD%iF5mEgM2!C=P>kW)d?bq}DMmx61TAb2p?8M;I?^ksh+a{Tpv)t}e0B8qSB`0ia> zh~jH9A?GDVTeRm6ha=?QNL_T7~7A?;SC5W~eI^^YR{6t2I+bsg6W zxc&*(_i%k5*G*jihU-^Xcyh%r3IX(zxIfV%h8w4G?!d|nVE6r^t9(aeKaE{JD3)F2 zLxT6)*yTHg+dh{7yv+M!?DA_G`)us^TEX*MJKo)xW83j{g6Fz+e7%@c&mB7+#(9f` z6_W7)W{S(McyHtUh*c?oT@Ac%$&PQt`H?9rB;x_>;^6)IR%Sq8S97nM{ARJm6~9;9 z?~3DTDy;qPwj_hH^44?LrAo-eX|%>$<=Gud~_KjVR4^}t{9z<=z4ucHdP zdf?yiz+dvff98Sr(Tv8WUXOayycDc}0segU{!`Mv7(qO{W^{<1TnEH{apogYG; zR)(GLg&#{hF7E|7#Aq$&CW*Jcr+yQ-&*gpbDDaK&Kb^dyAk{%95Qz}r2%ndD>-%L6 zcrSLvvj16a4ERQW>wC6LIP&GuQ@>KEN}RQu^bdfOedl}a%fKT|u}19AfN$`x7YnLh z%=i}J*!9TocjnCDNLdx^`c)z9PiD4CVBLKe$F5%!xxnuehx$x{@=jK zj?+JPlsu0fN0odaMCISyl5Y?2h?23A7s!skb^Nm(@>H*cx?dV=&(T`7LWeV>*aa8G zsZ4$MFb2fAxr||+)QrZXn%4XeNgU(MR*XTdEHt%IRWFnZ1_qptw4N{JoR~IOHk=sA zx#3!^R4jZbUp(uo;KkJB!OGf#tC9y#%P$t(i)Cj(-6&-BO1@amTI*}a?e(_v?De$s zTK!<>yZFN{APuzo#V*w9A3I+f0aP)pKD5g?{AFiK19rdZxuWT`jFG3~tK`ImLf$M& zv!T4is2}BvGnlKPo0X3@6#%yMy(UHlag(*TfnDB<=i+;ZVyoYq0kRmqMAnKtS~o; z=W6rwXQ5(A$(q_kY3{4*W5<$*QhMs}ejO*J?Ls-B?>}`od1!pp&N1Dk>o~%or_#zo zdjBz@ADB3@FFBzf85=vEn$#zg`zBIkRUYIfcT#cR_~>>%moYMOJ)!0NcOqds0Irjy zdB_`C*iU@xxoTOT%an3-8hrc+q;iFlUaMlc!crQ#PlU(K1i9&IRhgGd8@i4|=Ikgs zeeQasoK{1GRy{j!WTrulib>} zj+&(x5Pr0UA|j?Sctp^tl6mwsvozDSLNTXh45Lz*u3`BIlKJV{Ec($5-g{;|Gd*3& zpWzh#u0fvTa0*8=IVzv209Y^2%)pfmd!&WNpkoiel0Y+T3{^0eHUqEk@ZZgF&a_F^ z8s3dWCoa~X^e2#N{#}ZQOf`Ra+{DN(L@)$t=<|BfqB6Km36cy2xsVIWb_NlD4QHM> z|I7Xa5P|h2Ng99O!>Mm_g?I!J`liJC%l-sX0_#wch((hK42PtjIR7mQr*W5@>ZmlY zQ^g5H;B#PR%Cy08qVLB=XSg_jUe9_)>GOFqE&S4CRd0LBVyI(@$XS3803N} z1-S=?l|i3$=<~YVNmZcr7Fmiq^IuZ>oDGlf=ajxPKdwKUJ@3%xbw2+4D*IVbQD^>N za_BFI5>j%R9qPE@ocVtR()6ceRC6`f4f*e_IORFb^v|J7`&C$<=aF$TiokMas+nf| zTVPO8S)bP-`S00WR^{jFupayM+t4Ku*5~!g8)_3x1UzeCeWu?5)2iQC*Hjtseabdi zkLf=+^m(4RMd>@+%h4R-Md*_)Ew2F z>+>rAZ#tGlo%Q)S6xkNrAbL(SQ-5Ry5qHXV0dQiZa=)6uI$u;y*?T?oKcn>JhcZhU zocixl`cD7#Dd0yIU5c_k(*dRL5EE Mro;!ipdR}F3u}2H&;S4c literal 0 HcmV?d00001 diff --git a/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/Inputs/tainted-param-inside-blame.out b/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/Inputs/tainted-param-inside-blame.out new file mode 100755 index 0000000000000000000000000000000000000000..4dfcaf91a605705a48c6c064872271c1d42867d2 GIT binary patch literal 19520 zcmeHPeQaCR6~BItoiu43ms02`5c83(h2_~v)6@Yv?4(H@meQ_GORG^{9otDf96Q+0 zT?!N`0%%!RD3ivtKgJ?$LYt;--5;B#ZPHqmt)OXAnI?wDHgyP4wlOW!HYg05opawg z_IuCol?t>Egl~I&?){x}?#H?Jz5DU*&HV$zgNnx^*eT*;0%O}6ViGcbg*enNql87p z5)l*Eh^vJkkOuHE$w6v_n4YDinKqG}7bxmQ6$6MWF&SWbxd98NTtcKi;u$1HF@w%G z8d0V~gd~7^Sk_2DMuF~=0j94~1`9-44~vI-G17~X9@9CJXUg@%x}hJT`i&?th+#a2 zM1L`ddP{8v)A-Mg@mt~irWv`&J zpK0AEL)aJ4ZtUhwxVaq`OgOd$yR#;o`xx^6-g@PmiJ4cM5{G@?Z3&6QL&tSx@pNM5 zsiu=s75SZi8Jd0ej>PPXiJ6xcwv7y(I=;;x6NytN&iIg=ngg=9@>8JxkE1Ama!hS) zdr+z$O&r-ci|HQmJ%FV5tiBSm>Y=QbES_m?JA{%aiGutdDZhR@lC|d&C(d~jvkQq6 z^EW3vKTAA&PQMruSVjpnEuI-`ZQE4U$NUd%Tn=neUa>PV`||wVi;Igt^DQ=qglF%` zqbJ9zg==k#$@>5KvsDaLW)HrVm@O|H-tt!B@W8@s(_T}Bke`@6cosNk6Q{7`!puG@ z`7^Hu4Vi;y=YI~_gE@nHp@vXS=ARmP3w0Bx1{Neea&Te(IEo%FFZ=`>dcFv;&f|t^ zwR~8=_-#Y8zmD%3ntd(4Gd}xvd}R1Ydv{X^(mv9GbjR@8m$6Of+s;9PC*JnzZJjTW zeTQe?9G-n`)9hd4ix>YkF>}(B=>1*!PuSj{+#A0=zBhhHTr=B9wkH$^sq81zGqC@f zooBW8#$f>Pefj*`i;EK&hV1VJ`ZUm^K<9xTLmX;$8t59JSo;Z}L8$ZdKzCCozZh_I zp1ZdT&vekUdTC?RQQ!pu!!cw6@(82Arp6#*5%3QJ#$yS}fVo8k^1KA7hzEiXEB(v- zpMZoQiu^QqC2=xV4^#y``fhJksrBLr_NQdi& z$<~V7zX+ zjQCOFA`2*Q=3GSEQ>mvc9uBv}SuI9ZDp11MldJtQGy)QmPQzaR3%MlckS_hVm&jl*%RZ z(mr#sj0%`4Y}O@$&Pepe^>@29vV$Y*Kdey z=#6xCM(;G{Zb+p%JA2dJy}e!0%!X)p?^+?S9dTZV9dUE~TF<(v&PZ3U z5cg9*WZK3RHROE7az3AhLXM|Wwn_?NmrdsLh0$!@QI`8PUgurxj_ z{M=D`gIl+c3=QrPi>M~&w-}H%xL&SSckkBXJ9Z3!)Ye;f0LxaMMqC?K=95zID)}hb z(ke`5b#1H&wbrHz**q+GYt!=M`g=Ke>5R0Dx)n3YTy|VOnr`jM`%+BpZB%d1dV4xO z%k}3I-;3ARpU?XH7W%UJNrv}e_t9Rglgv@l@1gx&w|N16%15`8(t5w_ z!{9#Fe_&rt_J7-6*ahvYq2hmYU(ID6Da+4oIzVlDA@fMP&iT^kbh*!5NcwgixBkfc zflTZD@!jq7{&OrK`0q65zlbaHgQaJeS14ZPv3r|@@(7?1oLVB3&qGis9{gc!P5nvT|Uu_aI&Q`5S!=jR-c%sAsvS zy?uqx+g`jhck^GD9m+ z#@B6;@n0*v?H_Atfp=zOt3WM*+4`W?8-RK|o___FA%Qg(eyfE*8wQ2f)26iguJqiD zk>7mgkI#H-;}cKZbH|$-BKN(qwLyp_N{puGD|}0uzvc7#Z}K(X;`8{!KJjCpw|U0b z=*MW;Cw}g0ZvK(4K}PrZ#J7D-%`f}BGrpydfz~bluP9BB?f>@M{-l}`VfgY6U%$&! zVfdz8%BI5G;{9O=>7}p^C$9BOx??H{pPfr#NjkFm4me019xD{#e7Y`DMf_+!nuG7s zVyv7O@{~5HiT%l(NT!QoN(V2l1#_bH*?RlPiie2K5$%?8XnY~=1OEW{6W~vQ{{{GG z!9NH7H{gE{{zdSwfPas*Ktr6*d7+c={Ry)iJUEqm2Ugr$IY(o~8!G2%thi4cS7K&J zhP`lFfX~~QnO@N-oX)v;!Nhz%#wx!=@HrbR-Yj^1YsFhCYiujNRPb8YiZ2rr^xm=J z0l04wGea`$g_Yvdj(D(gf5fchg;NcDZpn&Y1oubwnIReW!YK|uuWx301)OFMI?1mT zs~qu5#O01SysR9Y7fw5cf^#(-uc&+_xA44zPi0wPxVyopx9m8d+Op$(OTms`X$2_e zt)9TC@bUfEApW*k0VuE$snSw8@5B5pE_jk~UN5qI*#$r1f4f!Zm;iy zg!A4Q*Y_KMJN1+Ak^C8Ym9zXag!3GT@jno5xBnY1_)45$I@GJn1>fO<7hLd1UGT5F z;6EkYUf-7p=lvC~ucyH%za0+|Znw`yz@6-z09=97ZbxY@$m!og_;DM)mvCWgmlEI} zm;mzo4Z9P%2P9tmzWoNJQ#q$Pz@`P%pPuK;%{zgxYYm+7>Mml|V~a+Nrx^9so0 z&ai!4cwMIBFfPc=z}j-Ika+Dl^))bHT#Wx=O|xXqM&O9e7Ul+Cg0V7hopq{=Zq|m!+a@R zE*0_8W*AP#h2gfQ*3%7B)Di6%;X9w zbA7G2wcb{qwVqa9tsSg<2YXlrWCFEzu?p4N$I6$9094e?Hnhr|*DNvtt3kDN&M;b1 z&)~IIG~!e?V-%%ocQ-NYN15ChtlprT6?Rk=0IcbIRSXN_Bx`L0tGpY}!S*)ATDw;T zYHeQSIorF+x7oVNaI&*;rt^}U>&#mz- zL;Y5cVJ=OBs}0&ff>KCq+Ag%s!(02}!`jxt!5sr5+DN=_cmPwC7rfD&SX|moIPb;o zOggD2O&bn1cf?~c%O!CQ<&BHrke&5bxRx#zw25RsjW@=Jwt`eTo7c*v3{kr3F-_J zuw7G$85%~fFf=#}$t5SVFjkG@Km}VM_ zmOwHyS{{e~GzR0J5l)Vd7Bl-f27mV;!(lKA2a{M-Ru~&AW%NpVs09sCw2s>E zJ|=fKK^>PP=y?B!|E`98B@WXVi@OG5jo?{-M2SJH`gbcrGFJWJc@iV*A%Jrp)}K~l z5QF>21gw#<>ikn~^a94|bVB$wxD&z{hma zKIkG1F`|;x?C@~A8C)Sg4FR)0&v&A2dn|T&jx+rZ=;C=6*5`F*6cYusR(YDFg1OoCfPL{iRKx*M+M{-`-xf<`B<=KBmRx z=XKfT7pVU`%0B|s>{$PsW)Q-hKhswL!}l*c-j{uv^8bNt%hX<Lgb?blAgyo)}Uqr)ZtWjL^aTVs&Q zFY7VT>!QD&^rI|D)UH2F`u6fql77F7KBt3}-yLSrW1K$?AXfqNHt^i<`MJRR$J}?# f`tvw2f?LlIt`V(i>*atu>0i-jDBR8kb6kWR@eD?AC-sk({z4v|Z?%sR%o*qt*k1BzH;Gl>*1g7@2B_(A2 z3h}~-OcIt5t3*=VC~gp8K-%C+N)A#h#`GeYX4*k=L7=FYP%I#!BxQu@wH7RxatV=! zh-Z-`r7YS(888(>m3-90vc@Aa3G|SRFnyCUSSHGPSUl8Al3tSZn4Therd&U)8(x!C zzeyztDNHAk2vzl7<9;uMT(0k+NqPXnfU;FCVMfcodKy4!`WV_dJA*@~&pWeX*-dwgto zL?6%wv~5Bko7|)4jfyc-sG3G)a?ePyTrwuJQ$+(bXXeT!($p>p9tFLWQ0G3*QIHx5fS+};k$HXPf6!$lj;eGGZO?!N9fnPYEuWR8cv-=&Jo zV`ofd<$UJYa~)@;D)Re(F}C>91DVBt&m4PgdEeyNxij5_RB7+6CFI#w=BclYdS=wtpzcdiAtsI9*{v-tYbr&m^1 zo)4{bsv>ak?8&p!jly;JBxU`7{)GmHDvJ-jn^~+aAK&wC=6HH}vE!hvLdef7K6DWU zGROD8m4-NoQ28bQ*qhOY49Fg@EiavgVt`wtc4OT=g5=e6>37i$&tRKn7Sqd_bLk}n zP&aepp{1oKQU7>t>7TI|EZq&M{xe`tb=kxEr|unFd^vT`*y3BMyHktrr6$Ku^j_7W zLS85OkWP$mc^%t)Y2`hz`Rsc^v#0-6D*yQ6Z^jqj+O_!0)XG)=mN|AdkQw@E?LV+T z{K>)8{i%bg2U5D-hqAq)L`Y>nqMn2O+a3a&g13zWfX~xsAlq4>OF%yZ^gEYUR!#za z0qAMOfu0At5h}S1bQWk7s{IPk`{*XP3UCa8Pwy9jg=k>Y>h_M4z>5Ng@0bkOj-kM= z_9$X;xblGUy9Q;T+lVOSbv00tibNk*M%IKs1%@Dr{5)L9{|L}Jf3m^HE{^;g?feHC z{BHrS0)NEL|E$Hwyq|+>AMg$2k4BWQ{=Wb+q8nMnNca3+#C*1kKE zEJYHjNIVtUJRDJnBO8Y!(cwsktnX^5_X61Ax}mvNXnCOJftCka9%y;savq4o*i8na z^m?t2HCK~zyv>qZL+OREm6q>Dz(=w%>B0j1A!3fV|y$Y~yK{{BZX?NtWF$(NzPpLVJOwlt$2HY(LZxuo_FYH@A5x_PExCgGZ` zO>Nb3sHNq~bGH_Yhv)k8#^IQZNL-!DC${Z~?-+{r4<_PMI}+1_gIl+5P3*|!`um6S zgF{0D31dfMaA=DV*p4`E!;ZK+byHyLe1CjkNQj52A2RLXidu4^O085XKp|&xIaeix zaLZ;(rSepvGT)2}^wU5cr@jau#5YEQ3wxpjZybMcne{n>inLO-~^^}Kbwe?C0# z&!esJ5cL0>KXBtA9M9qS7C+Uw%g=547_}{q$r`fW;{mr$YrNGOKf}DKH6KcO-!HBC z5WO(v^XI14{I)f}wK|0LKKjtFSKwlZWBn=HU*AK+YfoM>%wy^$!|!#bUNXGiI!a>z zFBx8gJxXh_UNR?1e><)3`i%?lQ$B_o(GSWx46bASAFQj%{_k1~yP|b9RQ!FetNDy0 zW%;>H4QkUX8ArNxE@z+Za-X>p`)(b-{>bZrOk4f&w_E4^efP&!dtTAJ;{)@2X|-po zJ^w$?BR}l#f3GngzmJ*zwlX~S{N!cEpgi_`jK&y0kmH{KW(l7oR|_i!2}S%p{35Q% z50-&@fhKIlO zv%Ot^*Cxa&B}wD^^`TXre-jFZZx6NK8484BA@PrZ{1A{kEo5g%d?nP``Rh;wkT#S# z0Qtv59i6W~5$Zf91y_fkKpOsr(g9`o!|nu_({dsP-|697d2K!hU!bdnTx?%zBnC0F z8Z%*kwrS-1=CkmTx*C(DuTbiPZP&4ZzT)9xU%6)Xm8birYo(mXRq$i`R1v;s3jl=N z-3b;=%rBA^r$lKZ5HexL$_qRk$v| z^%`7DaJ>oFGF-p2`k-^(KLnvKC6r{7Al!iU^9y!n5O(n|c*?ic_vJX{L*k65d|2?l z9jAP|@Y*jE1efzZ8>jp#!TWWbc&FfbvJ>yB&()pyYQb}6C%#5}o}OP$JObx7l6FYO zgD~S<^2DR{eNc9#AncCd{ZCGO9h^fsWQSxt2)jXe-@lz16tL?#>LtHHZ1lvh7T0>> z@J#avLD)5=Mo%?yf};Ml-N6gicXv5p=smm(%#HKzFE`Go9o+bJPJmLu#!j9(A0Lx# z;#VtmfFe7QDqZz`L(JdfgJ%inc_+))eDD)K_)|XkSsxr96w6G3hbIYNn=X3e<$H*T=+r41-)`vz6y8%29o@I!|sIP z5s5cHZ@)`+>ibq71aPnN`_=0eX{TGXbtK7hgLv6_1LSdq+5KL4TiWq> zFUWC5b2-;by!k!#$AAYs-WRt6z7G74C%7<3b)e&fC&|ye_PHN$6$M@4l*F6gJ0-xQ zud_j~YrfU6C$dh7>) zuT|EFljH|xoI@OTTk?27HWM)a6>uyk-!BF!OhU(tLO)bp@7Xs{9-d?TT!N$w-y%Ew z+=vl=32?OI_FHGz%9n?nBP8Dq_*!K{Q@)!3S4qZBF39qDjF)1yY6TB}#$cCS3{HLO z+XrFroS)5_)=AJiZHp1$KQo)3ws4J}-rMw%{X3M4=&m{vwxg?X#}8(Y4@R1#^o<3QyOskP0trCr)5n8kH?}D=L?2altx4O ziD5r7iqkN!gKk!yXea>K)b|<~7Q{=|*#=H|Kc0v0U5d?qZwNH|yutJKcZ2Wpb%WvM zXY1&4u3EF)BAc<{0y^1TXFL33V@`vko7$#fTC!0W9s^ag1}AEBqH!WxH|JneJDiEG z!g=U?S)VDwu^LuPiM$N zX4ih9?;hVfoEq2nj*d>GC-uqH@OT=n%7fzQPAo31E?oA2xRKAAS=$0c(^>Om(s9^a zM|tZ&Ib`QNU9RV=WqmeV%HzrNvArObFO>9J)qv_XN{080@VT)-ZmL=(^Kvaj*Wo}r zI}J~|dmmrdsz>I`?392`QnBbP$K)Xac=(p!^n#We9_ur+GeVmw)wEe$d(rYoN}y~} zSZt9TI#J?C=)i;LY!(%SCTpRY#sWO0rLVP0S-Mg)W~npG!tzZ$WocNw!qVV4n9I%; z;9WI?FCzHS=8F)qjDa@pQQk>UY?$=8fM)dYC%Kb@rvI`z!^9UO<=5T1z!K*zt7>G ziKDDN;CQPYF4mt^l8|cr{R>s58b3TvVq_acaLmK{yq>f`z-AIe84Pm47%1E6hxl7? zwu<#nDM>&CtUpOo|2raXeTyr^Z4kk4SFC?VNkU4%I+Y}1!6E{NOVUrA|3<=boE3zN z^?4mDfgl7vZ)T+|8yrXaNx1N=80+(T*Hfg==hnFVEXVXd(8sf9oaS}0)1^h`jAVX*Xp;>(4fiyYzV-kpGSg{w)K0 zaOeMZVA}KN^};2}Uqz-ZxbuG!c=#u3sJZIviu`w7-13}eir+N4ZTdXVOrTK+EN7(} zX~usD3@j?=&+C-@cXLir`KdZ}d+gWeKo><=pVu=lV4)zW^0)EB`7(VGSa$vTx+i78 z_bFRoJ*Gc)>GQmBBk8-_i>kxs#48X(TU>sgmtA{>`ah-o<8_Nxg!RAY!a0AYZvY>k zzZ`g7_65rS8P}4jyFTxNBHLmcNRMh(>YwZ&#NDzT0Jt$!xq~LG?iZC?_G%yf)1?38 z`{aKE>AU?mLBN0d=yN&xeDY7@iv_}Fi`0KvkAWc{{W;Q4upm*l{y6Eo%l~cCm+Q|q z8?0}qu1BPlzR3C03*>r0?}dx|J>M6r0OP(Z73n8_yA|2SH!k6vFUzilh?l-GY)Rbj JQg9{3{{ow^L(u>L literal 0 HcmV?d00001 diff --git a/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/taint-param-decompiled.test b/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/taint-param-decompiled.test new file mode 100644 index 0000000000..449cd72f06 --- /dev/null +++ b/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/taint-param-decompiled.test @@ -0,0 +1,33 @@ +## This is reproducer (clang -g -O0 m.c -o m) +## // clang -g -O0 m.c -o m +## void set(int* ptr, int val) { +## *ptr = val; // crash, wrong blame - line 3 +## } +## +## void fun(int** ptr, int* adr) +## { +## set(ptr,adr); +## } +## +## int main(){ +## int *adr = 3; // correct blame - line 12 +## int *p = 0; // wrong blame - line 13 +## fun(&p,adr); +## set(p,1); +## return 0; +## } + +# RUN: %llvm-crash-analyzer --print-potential-crash-cause-loc \ +# RUN: --core-file=%S/Inputs/core.taint-param-decompiled %S/Inputs/taint-param-decompiled.out < %s 2>&1 | FileCheck %s + +# CHECK: Decompiling... +# CHECK-NEXT: Decompiling set +# CHECK-NEXT: Decompiling main +# CHECK-NEXT: Decompiled. + +# CHECK: Analyzing... +# CHECK-NEXT: Decompiling fun + + +# CHECK: Blame Function is main +# CHECK-NEXT: From File {{.*}}/m.c:12:8 diff --git a/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/tainted-param-inside-blame.test b/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/tainted-param-inside-blame.test new file mode 100644 index 0000000000..3a4026e383 --- /dev/null +++ b/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/tainted-param-inside-blame.test @@ -0,0 +1,35 @@ +## This is reproducer (clang -g -O0 m.c -o m) +## void crash(int val, int* adr){ +## *adr = val; // crash - line 3 +## } +## +## void blame(int** ptr){ +## *ptr = 0; // correct blame - line 7 +## } +## +## void fun(int** ptr) +## { +## blame(ptr); +## } +## +## int main(){ +## int *p = 0; // incorrect blame - line 16 +## fun(&p); +## crash(1, p); +## return 0; +## } + +## In this case, we test TaintAnalysis of functions out of the backtrace, where +## parameters are tainted (references to the tainted location) and are forwarded +## through registers. Blame instruction is in the call (outside of the backtrace). + + +# RUN: %llvm-crash-analyzer --print-potential-crash-cause-loc --debug-only=taint-dfg \ +# RUN: --core-file=%S/Inputs/core.tainted-param-inside-blame %S/Inputs/tainted-param-inside-blame.out < %s 2>&1 | FileCheck %s + +# CHECK: Blame Nodes: +# CHECK-NEXT: !11{4; MOV64mi32 $rax, 1, $noreg, 0, $noreg, 0; CONSTANT: 0; DEREF-LVL: 0} +# CHECK-NEXT: Blame line: 7 + +# CHECK: Blame Function is blame +# CHECK-NEXT: From File {{.*}}/m.c:7:7 diff --git a/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/tainted-params-outside-blame.test b/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/tainted-params-outside-blame.test new file mode 100644 index 0000000000..bfb61e4bb5 --- /dev/null +++ b/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/tainted-params-outside-blame.test @@ -0,0 +1,38 @@ +## This is reproducer (clang -g -O0 m.c -o m) +## void crash(int val, int* adr){ +## *adr = val; // crash - line 3 +## } +## +## void blame(int** ptr, int* adr){ +## *ptr = adr; // wrong blame - line 7 +## } +## +## void fun(int** ptr, int* adr) +## { +## blame(ptr,adr); +## } +## +## int main(){ +## int *adr = 3; // correct blame - line 16 +## int *p = 0; // wrong blame - line 17 +## fun(&p,adr); +## crash(1, p); +## return 0; +## } + +## In this case, we test TaintAnalysis of functions out of the backtrace, where +## parameters are tainted (references to the tainted location) and are forwarded +## through registers. + + +# RUN: %llvm-crash-analyzer --print-potential-crash-cause-loc --debug-only=taint-dfg \ +# RUN: --core-file=%S/Inputs/core.tainted-params-outside-blame %S/Inputs/tainted-params-outside-blame.out < %s 2>&1 | FileCheck %s + +# CHECK: Blame Nodes: +# CHECK-NEXT: !21{2; $eax = MOV32ri 3; CONSTANT: 3; DEREF-LVL: 0} +# CHECK-NEXT: Blame line: 16 +# CHECK-NEXT: !19{2; MOV64mi32 $rbp, 1, $noreg, -24, $noreg, 0; CONSTANT: 0; DEREF-LVL: 0} +# CHECK-NEXT: Blame line: 17 + +# CHECK: Blame Function is main +# CHECK-NEXT: From File {{.*}}/m.c:16:8 From 231fed58e2b3b6289cf2ec362ecc55e0270d7f9b Mon Sep 17 00:00:00 2001 From: Nikola Tesic Date: Tue, 18 Apr 2023 06:19:10 -0700 Subject: [PATCH 7/8] Addressing comments 1 --- .../include/Target/CATargetInfo.h | 4 ++-- .../lib/Analysis/TaintDataFlowGraph.cpp | 15 +++------------ 2 files changed, 5 insertions(+), 14 deletions(-) diff --git a/llvm-15.0.3/llvm-crash-analyzer/include/Target/CATargetInfo.h b/llvm-15.0.3/llvm-crash-analyzer/include/Target/CATargetInfo.h index f76e503024..ef47e71ab8 100644 --- a/llvm-15.0.3/llvm-crash-analyzer/include/Target/CATargetInfo.h +++ b/llvm-15.0.3/llvm-crash-analyzer/include/Target/CATargetInfo.h @@ -75,8 +75,8 @@ class CATargetInfo { return const_cast(RegMap.at(Id)); } - // Get RegAliasTuple from the RegMap with selected Id. - std::unordered_map getWholeRegMap() const { + // Get whole RegMap. + const std::unordered_map &getWholeRegMap() const { return RegMap; } diff --git a/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintDataFlowGraph.cpp b/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintDataFlowGraph.cpp index 266d8c90f0..46829d352a 100644 --- a/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintDataFlowGraph.cpp +++ b/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintDataFlowGraph.cpp @@ -131,12 +131,12 @@ void TaintDataFlowGraph::findBlameFunction(Node *v) { auto &BlameNodes = blameNodes[MaxLevel]; for (unsigned i = 0; i < BlameNodes.size(); i++) { auto &a = BlameNodes[i]; + // Do not erase potential blame nodes. + if (a->TaintOp.DerefLevel == 0 && a->IsContant) + break; if (a->MI->getParent() == adjNode->MI->getParent() && !a->CallMI && !adjNode->CallMI) { if (MDT->dominates(adjNode->MI, a->MI)) { - // Do not erase potential blame nodes. - if (a->TaintOp.DerefLevel == 0 && a->IsContant) - break; BlameNodes.erase(BlameNodes.begin() + i); break; } @@ -144,9 +144,6 @@ void TaintDataFlowGraph::findBlameFunction(Node *v) { MDT = dominators[a->CallMI->getMF()]; if (a->CallMI->getParent() == adjNode->MI->getParent()) { if (MDT->dominates(adjNode->MI, a->CallMI)) { - // Do not erase potential blame nodes. - if (a->TaintOp.DerefLevel == 0 && a->IsContant) - break; BlameNodes.erase(BlameNodes.begin() + i); break; } @@ -155,9 +152,6 @@ void TaintDataFlowGraph::findBlameFunction(Node *v) { MDT = dominators[adjNode->CallMI->getMF()]; if (a->MI->getParent() == adjNode->CallMI->getParent()) { if (MDT->dominates(adjNode->CallMI, a->MI)) { - // Do not erase potential blame nodes. - if (a->TaintOp.DerefLevel == 0 && a->IsContant) - break; BlameNodes.erase(BlameNodes.begin() + i); break; } @@ -168,9 +162,6 @@ void TaintDataFlowGraph::findBlameFunction(Node *v) { a->CallMI->getParent() == adjNode->CallMI->getParent()) { MDT = dominators[adjNode->CallMI->getMF()]; if (MDT->dominates(adjNode->CallMI, a->CallMI)) { - // Do not erase potential blame nodes. - if (a->TaintOp.DerefLevel == 0 && a->IsContant) - break; BlameNodes.erase(BlameNodes.begin() + i); break; } From 4eda5c0ad6b0d2d36f6f676cfa69dc2c3ee4dece Mon Sep 17 00:00:00 2001 From: Nikola Tesic Date: Mon, 24 Apr 2023 09:15:06 -0700 Subject: [PATCH 8/8] [TA] Support parameters on the stack --- .../include/Analysis/TaintAnalysis.h | 11 + .../include/Target/CATargetInfo.h | 16 ++ .../lib/Analysis/TaintAnalysis.cpp | 201 +++++++++++++++++- .../lib/Target/CATargetInfo.cpp | 33 +++ .../Analysis/Inputs/core.params-stack-stack | Bin 0 -> 270336 bytes .../Analysis/Inputs/params-stack-stack.out | Bin 0 -> 19800 bytes .../test/Analysis/params-stack-stack.test | 43 ++++ 7 files changed, 300 insertions(+), 4 deletions(-) create mode 100644 llvm-15.0.3/llvm-crash-analyzer/test/Analysis/Inputs/core.params-stack-stack create mode 100755 llvm-15.0.3/llvm-crash-analyzer/test/Analysis/Inputs/params-stack-stack.out create mode 100644 llvm-15.0.3/llvm-crash-analyzer/test/Analysis/params-stack-stack.test diff --git a/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/TaintAnalysis.h b/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/TaintAnalysis.h index 772b0e6f35..4d596b531b 100644 --- a/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/TaintAnalysis.h +++ b/llvm-15.0.3/llvm-crash-analyzer/include/Analysis/TaintAnalysis.h @@ -139,6 +139,17 @@ class TaintAnalysis { RegisterEquivalence &REAnalysis); const MachineInstr *findParamLoadingInstr(TaintInfo &Ti, const MachineInstr *CallMI); + void transformBPtoSPTaints(const MachineFunction &MF, + TaintDataFlowGraph &TaintDFG, + SmallVectorImpl &TL); + void transformSPtoBPTaints(const MachineFunction &MF, + TaintDataFlowGraph &TaintDFG, + SmallVectorImpl &TL); + bool isStackSlotTainted(const MachineInstr *CallMI, + SmallVectorImpl &TL, + SmallVectorImpl *TL_Of_Caller, + TaintDataFlowGraph &TaintDFG, + RegisterEquivalence *REAnalysis); TaintInfo isTainted(TaintInfo &Op, SmallVectorImpl &TL, RegisterEquivalence *REAnalysis = nullptr, const MachineInstr *MI = nullptr); diff --git a/llvm-15.0.3/llvm-crash-analyzer/include/Target/CATargetInfo.h b/llvm-15.0.3/llvm-crash-analyzer/include/Target/CATargetInfo.h index ef47e71ab8..00d31c9003 100644 --- a/llvm-15.0.3/llvm-crash-analyzer/include/Target/CATargetInfo.h +++ b/llvm-15.0.3/llvm-crash-analyzer/include/Target/CATargetInfo.h @@ -109,9 +109,18 @@ class CATargetInfo { // Return name of the Program Counter Register. virtual Optional getPC() const = 0; + // Return name of the Base Pointer Register. + virtual Optional getBP() const = 0; + + // Return name of the Stack Pointer Register. + virtual Optional getSP() const = 0; + // Return true if the register is Stack Pointer Register. virtual bool isSPRegister(std::string RegName) const = 0; + // Return SP adjustment to BP in the callee. + virtual int64_t getSPAdjust() const = 0; + // Return true if the register is Base Pointer Register. virtual bool isBPRegister(std::string RegName) const = 0; @@ -148,8 +157,15 @@ class X86CATargetInfo : public CATargetInfo { Optional getPC() const override; + Optional getBP() const override; + + Optional getSP() const override; + bool isSPRegister(std::string RegName) const override; + // Return SP adjustment to BP in the callee. + int64_t getSPAdjust() const override; + bool isBPRegister(std::string RegName) const override; bool isParamFwdRegister(std::string RegName) const override; diff --git a/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp b/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp index a657602fcf..6d00516fe1 100644 --- a/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp +++ b/llvm-15.0.3/llvm-crash-analyzer/lib/Analysis/TaintAnalysis.cpp @@ -537,6 +537,97 @@ bool crash_analyzer::TaintAnalysis::shouldAnalyzeCall( return false; } +// Check TaintList for non-dereferenced locations, equivalent to stack slots +// and add those stack locations to the TL_Of_Caller (to be tracked during +// TaintAnalysis of functions out of the backtrace). +bool crash_analyzer::TaintAnalysis::isStackSlotTainted( + const MachineInstr *CallMI, SmallVectorImpl &TL, + SmallVectorImpl *TL_Of_Caller, TaintDataFlowGraph &TaintDFG, + RegisterEquivalence *REAnalysis) { + auto *MF = CallMI->getMF(); + auto TRI = MF->getSubtarget().getRegisterInfo(); + auto CATI = getCATargetInfoInstance(); + + if (!REAnalysis) + return false; + bool Tainted = false; + + // Search for tainted stack slots. + for (auto itr = TL.begin(); itr != TL.end(); ++itr) { + auto Taint = *itr; + // Consider only memory Taint Infos. + if (!Taint.Op->isReg() || !Taint.Offset) + continue; + + int64_t OffsetOp = *Taint.Offset; + + if (!CallMI) + break; + // Try to see if there is an equal register that could be used here. + auto MII = MachineBasicBlock::iterator(const_cast(CallMI)); + if (MII == CallMI->getParent()->begin()) + break; + + // We try to see what was reg eq. status before the MI. + MII = std::prev(MII); + auto EqRegs = REAnalysis->getEqRegsAfterMI( + const_cast(&*MII), + {Taint.Op->getReg(), OffsetOp, /*IsDeref=*/false}); + + for (auto &eqR : EqRegs) { + // Read (base) register value, if it is not $noreg. + if (eqR.RegNum == 0) + continue; + std::string RegName = TRI->getRegAsmName(eqR.RegNum).lower(); + int64_t Offset = eqR.Offset; + // FIXME: Confirm that the param is a reference? + if (Taint.DerefLevel >= 0) + break; + + if (!CATI->isSPRegister(RegName) || !eqR.IsDeref) + continue; + // Create a TaintInfo for param forwarding stack slot. + TaintInfo Ti; + MachineOperand MOp = + MachineOperand::CreateReg(MCRegister(eqR.RegNum), false); + MOp.setParent(const_cast(CallMI)); + Ti.Op = new MachineOperand(MOp); + Ti.Offset = Offset; + // Based on the equivalance $rbp+(-40) : { deref->$rsp }, + // Ti ($rsp + 0) has one DerefLevel below ($rbp+(-40)). + Ti.DerefLevel = Taint.DerefLevel - 1; + + // Add param forwarding memory location to the Caller's TL. + if (addToTaintList(Ti, *TL_Of_Caller)) { + Tainted = true; + // For now, use CallMI for param forwarding node. + auto LoadMI = findParamLoadingInstr(Ti, CallMI); + Node *newNode = new Node(MF->getCrashOrder(), LoadMI, Ti, false); + if (CallMI) + newNode->CallMI = CallMI; + std::shared_ptr newTaintNode(newNode); + assert(TaintDFG.lastTaintedNode.count(Taint.Op) && + "Taint Op must be reached already"); + auto &LastTaintedNodeForTheOp = TaintDFG.lastTaintedNode[Taint.Op]; + // Set new node depth. + newTaintNode->Depth = LastTaintedNodeForTheOp->Depth + 1; + + if (LastTaintedNodeForTheOp->TaintOp.Op->isReg() && + LastTaintedNodeForTheOp->TaintOp.Offset && + newTaintNode->TaintOp.Op->isReg() && + (LastTaintedNodeForTheOp->TaintOp.Op->getReg() == + newTaintNode->TaintOp.Op->getReg())) + TaintDFG.addEdge(LastTaintedNodeForTheOp, newTaintNode, + EdgeType::Dereference); + else + TaintDFG.addEdge(LastTaintedNodeForTheOp, newTaintNode); + TaintDFG.updateLastTaintedNode(Ti.Op, newTaintNode); + } + } + } + return Tainted; +} + TaintInfo crash_analyzer::TaintAnalysis::isTainted( TaintInfo &Op, SmallVectorImpl &TL, RegisterEquivalence *REAnalysis, const MachineInstr *MI) { @@ -1105,6 +1196,9 @@ bool llvm::crash_analyzer::TaintAnalysis::propagateTaint( // Simplified version of propagateTaint, but in the oposite (forward) direction. +// Idea is to track tainted parameters of out-of-the-backtrace calls, from the +// function entry point, to the spot where the parameter value is set. +// (From that spot, we would go backwards to find the origin of the value.) bool llvm::crash_analyzer::TaintAnalysis::propagateTaintFwd( DestSourcePair &DS, SmallVectorImpl &TL, const MachineInstr &MI, TaintDataFlowGraph &TaintDFG, RegisterEquivalence &REAnalysis, @@ -1122,9 +1216,9 @@ bool llvm::crash_analyzer::TaintAnalysis::propagateTaintFwd( const auto &MF = MI.getParent()->getParent(); auto TII = MF->getSubtarget().getInstrInfo(); + auto DestTaint = isTainted(DestTi, TL, &REAnalysis, &MI); // FIXME: Define better terminating criteria for forward analysis? if (SrcTi.Op->isImm()) { - auto DestTaint = isTainted(DestTi, TL, &REAnalysis, &MI); if (DestTaint.Op == nullptr) return true; // Propagate dereference level (from crash) from the Taint (DestTi) to the @@ -1152,6 +1246,7 @@ bool llvm::crash_analyzer::TaintAnalysis::propagateTaintFwd( // Check if SrcTi is already tainted. auto Taint = isTainted(SrcTi, TL, &REAnalysis, &MI); + // If SrcTi is not tainted, check if the base reg is tainted. if (Taint.Op == nullptr && SrcTi.Offset) { TaintInfo SrcBase; @@ -1159,7 +1254,7 @@ bool llvm::crash_analyzer::TaintAnalysis::propagateTaintFwd( Taint = isTainted(SrcBase, TL, &REAnalysis, &MI); } - // If Destination is not tainted, nothing to do, just move on. + // If Source is not tainted, nothing to do, just move on. if (Taint.Op == nullptr) return true; @@ -1221,6 +1316,7 @@ bool crash_analyzer::TaintAnalysis::forwardMFAnalysis( // Per function : Map MBB with its Taint List DenseMap> MBB_TL_Map; + // Initialize all the MBB with emtpty taint list for (const MachineBasicBlock &MBB : MF) { SmallVector _tmp; @@ -1287,6 +1383,7 @@ bool crash_analyzer::TaintAnalysis::forwardMFAnalysis( // this function (including nested calls). mergeTaintList(*TL_Of_Caller, TL_Mbb); } + return true; } @@ -1304,13 +1401,94 @@ RegisterEquivalence *crash_analyzer::TaintAnalysis::getREAnalysis() { return REA; } +// Transform stack memory locations in the TaintList, to use Base Pointer as a +// base register (callee side), instead of the Stack Pointer (caller side). +void crash_analyzer::TaintAnalysis::transformSPtoBPTaints( + const MachineFunction &MF, TaintDataFlowGraph &TaintDFG, + SmallVectorImpl &TL) { + auto TRI = MF.getSubtarget().getRegisterInfo(); + auto CATI = getCATargetInfoInstance(); + + for (auto itr = TL.begin(); itr != TL.end(); ++itr) { + if (!itr->Op || !itr->Op->isReg()) + continue; + if (itr->IsConcreteMemory) + continue; + Register Reg = itr->Op->getReg(); + std::string RegName = TRI->getRegAsmName(Reg).lower(); + if (!CATI->isSPRegister(RegName)) + continue; + // Transform $rsp + off -> $rbp + ADJUSTMENT + off + // For X86, ADJUSTMENT is 16 (sizeof(rip) + sizeof(rbp)). + if (!CATI->getBP()) + break; + auto BpReg = CATI->getRegister(*CATI->getBP(), itr->Op->getParent()); + if (!BpReg) + break; + + assert(TaintDFG.lastTaintedNode.count(itr->Op) && + "Taint Op must be reached already"); + auto &LastTaintedNodeForTheOp = TaintDFG.lastTaintedNode[itr->Op]; + + LLVM_DEBUG(llvm::dbgs() << "Caller-side: " << *itr); + MachineOperand MOp = MachineOperand::CreateReg(MCRegister(*BpReg), false); + MOp.setParent(const_cast(itr->Op->getParent())); + itr->Op = new MachineOperand(MOp); + *itr->Offset = *itr->Offset + CATI->getSPAdjust(); + LLVM_DEBUG(llvm::dbgs() << " -> Callee-side:" << *itr << "\n"); + // Update LastTaintedNode with the transformed TaintInfo. + TaintDFG.updateLastTaintedNode(itr->Op, LastTaintedNodeForTheOp); + } +} + +// Transform stack memory locations in the TaintList, to use Stack Pointer as a +// base register (caller side), instead of the Base Pointer (callee side). +void crash_analyzer::TaintAnalysis::transformBPtoSPTaints( + const MachineFunction &MF, TaintDataFlowGraph &TaintDFG, + SmallVectorImpl &TL) { + auto TRI = MF.getSubtarget().getRegisterInfo(); + auto CATI = getCATargetInfoInstance(); + + for (auto itr = TL.begin(); itr != TL.end(); ++itr) { + if (!itr->Op || !itr->Op->isReg()) + continue; + if (itr->IsConcreteMemory) + continue; + Register Reg = itr->Op->getReg(); + std::string RegName = TRI->getRegAsmName(Reg).lower(); + if (!CATI->isBPRegister(RegName)) + continue; + // Transform $rbp + ADJUSTMENT + off -> $rsp + off + // For X86, ADJUSTMENT is 16 (sizeof(rip) + sizeof(rbp)). + if (!CATI->getSP()) + break; + auto SpReg = CATI->getRegister(*CATI->getSP(), itr->Op->getParent()); + if (!SpReg) + break; + + assert(TaintDFG.lastTaintedNode.count(itr->Op) && + "Taint Op must be reached already"); + auto &LastTaintedNodeForTheOp = TaintDFG.lastTaintedNode[itr->Op]; + + LLVM_DEBUG(llvm::dbgs() << "Callee-side: " << *itr); + MachineOperand MOp = MachineOperand::CreateReg(MCRegister(*SpReg), false); + MOp.setParent(const_cast(itr->Op->getParent())); + itr->Op = new MachineOperand(MOp); + *itr->Offset = *itr->Offset - CATI->getSPAdjust(); + LLVM_DEBUG(llvm::dbgs() << " -> Caller-side:" << *itr << "\n"); + // Update LastTaintedNode with the transformed TaintInfo. + TaintDFG.updateLastTaintedNode(itr->Op, LastTaintedNodeForTheOp); + } +} + // Return true if taint is terminated. // Return false otherwise. bool crash_analyzer::TaintAnalysis::runOnBlameMF( BlameModule &BM, const MachineFunction &MF, TaintDataFlowGraph &TaintDFG, bool CalleeNotInBT, unsigned levelOfCalledFn, SmallVector *TL_Of_Caller, const MachineInstr *CallMI) { - LLVM_DEBUG(llvm::dbgs() << "### MF - backward analysis: " << MF.getName() << "\n";); + LLVM_DEBUG(llvm::dbgs() << "### MF - backward analysis: " << MF.getName() + << "\n";); // Run the forward analysis to compute register equivalance. RegisterEquivalence REAnalysis; @@ -1502,7 +1680,8 @@ bool crash_analyzer::TaintAnalysis::runOnBlameMF( continue; bool runFwAnalysis = - areParamsTainted(&MI, TL_Mbb, &TL_Of_Call, TaintDFG, *REA); + areParamsTainted(&MI, TL_Mbb, &TL_Of_Call, TaintDFG, *REA) || + isStackSlotTainted(&MI, TL_Mbb, &TL_Of_Call, TaintDFG, REA); bool runBwAnalysis = shouldAnalyzeCall(TL_Mbb); auto TargetName = CalleeOp.getGlobal()->getName(); @@ -1521,6 +1700,9 @@ bool crash_analyzer::TaintAnalysis::runOnBlameMF( // If parameter is tainted, run analysis from the function entry point // (forward), to the point where the parameter value is set. if (runFwAnalysis) { + // Before call analysis, transform stack location TaintInfo to + // match the callee frame pointer. + transformSPtoBPTaints(MF, TaintDFG, TL_Of_Call); printTaintList(TL_Of_Call); forwardMFAnalysis(BM, *CalledMF, TaintDFG, levelOfCalledFn + 1, &TL_Of_Call, &MI); @@ -1532,7 +1714,11 @@ bool crash_analyzer::TaintAnalysis::runOnBlameMF( runOnBlameMF(BM, *CalledMF, TaintDFG, true, levelOfCalledFn + 1, &TL_Of_Call, &MI); } + // After call analysis, transform stack location TaintInfo to + // match the caller stack pointer. + transformBPtoSPTaints(MF, TaintDFG, TL_Of_Call); mergeTaintList(TL_Mbb, TL_Of_Call); + TL_Of_Call.clear(); LLVM_DEBUG(llvm::dbgs() << "### Return to backward analysis: " << MF.getName() << "\n";); } @@ -1556,6 +1742,9 @@ bool crash_analyzer::TaintAnalysis::runOnBlameMF( // If parameter is tainted, run analysis from the function entry // point (forward), to the point where the parameter value is set. if (runFwAnalysis) { + // Before call analysis, transform stack location TaintInfo to + // match the callee frame pointer. + transformSPtoBPTaints(MF, TaintDFG, TL_Of_Call); printTaintList(TL_Of_Call); forwardMFAnalysis(BM, *MFOnDemand, TaintDFG, levelOfCalledFn + 1, &TL_Of_Call, &MI); @@ -1567,7 +1756,11 @@ bool crash_analyzer::TaintAnalysis::runOnBlameMF( runOnBlameMF(BM, *MFOnDemand, TaintDFG, true, levelOfCalledFn + 1, &TL_Of_Call, &MI); } + // After call analysis, transform stack location TaintInfo to + // match the caller stack pointer. + transformBPtoSPTaints(MF, TaintDFG, TL_Of_Call); mergeTaintList(TL_Mbb, TL_Of_Call); + TL_Of_Call.clear(); LLVM_DEBUG(llvm::dbgs() << "### Return to backward analysis: " << MF.getName() << "\n";); } diff --git a/llvm-15.0.3/llvm-crash-analyzer/lib/Target/CATargetInfo.cpp b/llvm-15.0.3/llvm-crash-analyzer/lib/Target/CATargetInfo.cpp index f5c64f5e64..0a606758ef 100644 --- a/llvm-15.0.3/llvm-crash-analyzer/lib/Target/CATargetInfo.cpp +++ b/llvm-15.0.3/llvm-crash-analyzer/lib/Target/CATargetInfo.cpp @@ -146,6 +146,28 @@ Optional X86CATargetInfo::getPC() const { } } +Optional X86CATargetInfo::getBP() const { + switch (TT->getArch()) { + case Triple::x86_64: + return static_cast("rbp"); + case Triple::x86: + return static_cast("ebp"); + default: + return llvm::None; + } +} + +Optional X86CATargetInfo::getSP() const { + switch (TT->getArch()) { + case Triple::x86_64: + return static_cast("rsp"); + case Triple::x86: + return static_cast("esp"); + default: + return llvm::None; + } +} + bool X86CATargetInfo::isSPRegister(std::string RegName) const { if (RegName == "rsp" || RegName == "esp" || RegName == "sp" || RegName == "spl") @@ -153,6 +175,17 @@ bool X86CATargetInfo::isSPRegister(std::string RegName) const { return false; } +int64_t X86CATargetInfo::getSPAdjust() const { + switch (TT->getArch()) { + case Triple::x86_64: + return 16; + case Triple::x86: + return 8; + default: + return 0; + } +} + bool X86CATargetInfo::isBPRegister(std::string RegName) const { if (RegName == "rbp" || RegName == "ebp" || RegName == "bp" || RegName == "bpl") diff --git a/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/Inputs/core.params-stack-stack b/llvm-15.0.3/llvm-crash-analyzer/test/Analysis/Inputs/core.params-stack-stack new file mode 100644 index 0000000000000000000000000000000000000000..0e292e01581b34e2d0d8c1dea05754693e447ccf GIT binary patch literal 270336 zcmeEv3t$x0)&Jei5|$Xq0zspqjv;7JLpHn&VC>`t8x6Q7L8-6oCRs=z$u8LqMAWjp zG$EqVs?~n2-)gZRwbn+fEw(-uQNh+n)K;2+dygYfwiR$M)!e_XHU#Qybks>m2u&*)!-%AM)` z>uIECG}nt#x!Y7vCp}|aJ%bmXEghzMWGA|;(m`B3BTfg72&TgRaXO_|Fq-S>R8KGN zUr(cYjB)iOpH$Cdsz-LQag3{H#2KJ^0aHD0htXWGgX(n!x9p3bFB<@db(8i&0i^FE5rb zD@ObHT|9mp%P<|e{#22Xcxnu#cK^R^16AJNY(Gus)@Fk%w@o+7!cRz<4HJp-jifjF z4TaouVvc9BAah~X8wA0hvLUja$<%<=D#x1JJ(cwOP}AHd{a_%y$nk6iBW#~J7G+dx zmTqj!dOt}V4O?bz8_0}dVs?YZ+lK>@yD;RE*(K#18xI@D&%7Ou_727e&q>^0Ii?f2 zBJB@6Rz1c}-8a2^zxZVenvyzJFp}!m5OSY%+5vg)t&z=Rr8)&W1l2Hr6Yk!A4223P|hA&SeTSmzqCF}s*Jzc4dUO_RdcW@yS}b!+7$d-oi%CV zq}+)?zsUXu^fd!|Kaf@)`(R$;yykhif_GLPKf*9f`nV&Usr27RjNx(8V~BZrnG)dm(Jc_eU7_(r50B zd>;fqqQ!c-^ubK7ReE3?3uTxX`J;P8zSm+H#I=m_d}@GE2+c6Vdic4ZlWv?iM|cc9 z<8Er8hmh-Gc*f_6R8OaRj1jVDhuc7V+~yo_bD-@BV4w|Pg!kF_*_HU> zVi2@=1#MRhq8E5W1iL#;R9514CEUts3RO11jUO?)w4|W067H5voGL0yD&|zy_?mnR z>w+O)Q^lOZdViy@!dq4EgPIE){EbwzQko8Eh#XiU^S{1ZZq3Kk!L3BAIF91&PVpF9 zI2VvNPCMiD@#D}Fr^m72v^P%Aa}3M&q#XabYxQost9{5lM`*&eHX5?_cDYtRX5V5| z#qyl@O4^>g#MSn?YxNsF?uwGF(J0Jb*VfH$1GYxt{(0}1MNs|Y4z%C0U}DM%YmDk0 zuJw6s=y&~)RS47fhQ>fs)2OLoz1=A%gwb*fA=rQ4u%B9nFkzo-^S%UETaRn=&hNP_ zPq?1j7fJ;O!^wfYw|ha#2}OPNvHft~NGKM~qvyHW-rTtyZo51&q&G+exrQ# zZVmKlkR9Nwt$AX*1vr-0@sni?;)a_AB*musumfM@R8@Et*4h1PE3X$mXT{U<`KJ(8nX?rREyppz0 z^5^BZ{WHI!bp80phH7G-Ykd}CdFg~VaSrYL^*_Pu=6@!HPRMzM_$Y1rytM6;qP7q6 zdsF}BTD`^Mn*P7d@8bNr@Z$W7@-NQ6B)>9#OpN&h-9R+vCCxu4LmjAdLQaMD_}GOuFbzc%bVmY;{1J{Tt%buA&jm*yVtEZ@ zEI01ub9qHy`5G!e9WYkEsjqwksJo&5%J_2Y<%R*a{TO67^wEdqvqm_swHA*^yC$J{ zgtp#RJRUFgHQUcpi)?YSrPd5J|>gAsPw!xw|xy z#}G2`a|T`HkK^!=0YAsb_2DpR#M4RkaLQoF%u^4^Kc{kT=l>U~>wh_t>iS>KK;ADI zyJ+Gv@;p}8|LXdmuBp}azqEzUBYjkkdf+nF&!k6|+M^AqSD>jjeK6Cq~g z=RO$mz6vJ1|NK?Y8ScJcK2gFbgof3OdiX4e`**V3{kxflp7Cb4A&Q=BC2~CsAM1H` z$$Fk$vL0g(-4JKw{$bxRcT@k(SOjI57||9JBIZmQ5i@E~hDkI2_B|JapHpGI!TQJi zb(rdv)ARr4c39TPo{{^<-&44n#?Op5RLP2r+`oVIdkTZ~uQOM+$4J9saDvb3BAxhM zgql0&t$+HjS?$9wvpusX@0ELB-oEKRj1Bq0I)i;*fo*W^p$!ac6m>LAVh?N>&pLq< zUg~PYIxRmz8Jbj1Rf1rhObM`w>iSw^hx$p^wx?qva}JCTqmuG zUTw3(Pu7gM?XF`I7i<&JNzj0Mn6}cs<_Jy8%n)lbE^s*JhyPeqkSP+wj@&|_>0wdg z7U!3Xp+#5aafPG%{oa~B6m7c zb8oP_6I=z4CnboHw#*Z)4&hk|`_|RAR^4W?C5Dq~lftbC#C*@~Nkfvo_9aU!mecIrTH0uFv92X(Ny6qCnpn7Unl7|_ zu|sGH7dpa^Id?o3_K4(_wsjVd9?^h8dsTv6tUA(~XG-0tOX^wo4 zXJfj}>P}C!X|1EG7AGbCZR62;mCb6wn!;wyb>CK0lx+QMm0qja!n!uqvEdin!lffq zwNy>CtxOg}E_aMgesolkMXa<~Y{`xx+varJ9?lF4#~4k7fem}TMbBAjw=E6ZPjRMe zU9Lon{^YQc;z@D+D>J5Pt1|Mtubg}KW7=F{gMW8eIv*Pun6*49vm@(=89l<9WJwN} z>o(h?VNbvz!l{;_UG}iu9V%QSC@%E9m!`xH!h)o}}R9yCQgX)hw1SQdi`J#vR*iA!4pHmygx86y zHBtI5Jdy60e34jb4Z9Xa(#3?8X?nq$+~GyzuD&^JnIba7w$!79J4s|FIW$p`Xm@Di zhv_0IkWd1V2)jPqZHrpVY{~h;5}EIK(&g8+{Iu{Hncd^Wo0|Td#iHw4fn&BvF1;=# zF(K)s`>f8D;hV(GwlXUOV%IYD*7S}mzklMnBU{A=+es@=vaQzapM+mnWm)H}(Kr7& z@`46mkg;dfZP+~8;VxP^$y#QycZgx0r^5CmPv-E|j)ab=HDni-v@nnp2^S`KMv7ld z@3h$?`faPio`M_3pW%G5YeQP%HE9pDzIN?T#QE#(Nmf_KHEH@-hiJ9@#AWLUkGdz2 zs*ByOxx+;(E-f}aJj&jBt;4n?a9gpb>hVr*>JZHWEeK0KEEh2QMdD3jwBEU}LMzgR z<*cds!-PG*vqO&#yWMKLZdS6*e&rY~-Qy5eNA%{@v+~2Cz%8ewd2fVCs$Fd@@>)mf zW!m+7!PEUTg2K?V2i92nQLshk6COU5gq>c_UpUD zuok&&VTZ8T(vnjjl6FDu#QvSOcVuSn{au=IQ<1{ zw?&M)1Qxd!Pq7_m{}|@rJ;IS;-}pm|D>K~Tv0F++SXf1p7+<7Wt#&*jIMR)8RTWwu zwOYiak~6hIi^R$EnSg72~D zs$t7-OAX(B(`<{diBTiMW5tFnaq_64NlR_%6-ig0I5Jth27AOw8Dg`yc=hd$EjG(I zk&rK}tA4en)ZrBQi7u;cVur4}tfI}4ewKLj_S*Dq!ZK2*Fa<)e}< z_QZ?`d?CsriXnnT*N)5_kvKM8-=wc8a9JJUS>dZ^i@B#JrNh)ctx2<4A}j3Q6$>eG{KB^PLEw^r;(E;nQ~BnU4v}UlE3gZ9swHesd^c6(j1BA2;kwO{X&EgZ72#g% zpL6Dn7%i+Gtj$ zoMDg15mVB{M$1$eaA2Gd;CTi9mMAV1_#2)0oG_m8;&aY;ZhJiB6Csa-JRWi;9u^w^<8W4Z3s>}1Hc~0A3@#= z`7_90K<oC4Vac@*T)kjFqygFF`Uaga}djA zc{=1XAfE|Yhg<-;2y!vx*^o;hpAC5q3rt<+Wply^dg6&GkRgis<7ecOu zya@7Q$n}u@kOPpHKn_7}hTH;qIb=*%0Iq<%268Lu&Q63rCCG9ewm$;>S}K!T;AjZM zH&jX|QP~BcyWeEz2Acw|1b8XtkK_JQJVsDtSuJG2Yu zBA9G(_Ai334WN6UbhF3??H+-$KR`CN!Ox!{MlG)H8Bj2d;{FWcIi0qD4sBt&CC=BA zuOZb+SA*_*@Z}FT_`eSFt>C{GY#svrd*CxZT>`phC_fhL6UaBNPn?E< z-w7bBf%b1fKVZLRQ zp8uwLe*yg`&@QffOTm9V$R60f4DfjHA0qxIgZ*bsTlk| z4f?UrpRY6WCq@b(etc1+aZ8l&`10KS^zaTI>UxDUe?R-~R;pTxtW$c#YTzaTQ5Qzv*Y?SHO?=dU+e(86zJ!vV6zn~LrQ{roc6}`&jNZB?}oOI zpx9p`!)m~rz}KIs?z4nHf%b4+#&ZcyWl;AAU>g8MGPGL`+j}5mdPIV;u5Se0K4|cM z@P)_kkEqQr+7FD|3F;)KL!~;RQf&C4}#C7PJK(^Gu7c^3hM3v-@RaqX`BSH73{8|dOxK)iD2_nis>4#`z`6I zih^&5f$k#tTl1b4i9Jhp8qeKDPyMHX&eJ4%2&06KY^fJHWJee#>><=A$#VA}dJKQv zlgWOHM4d27==^Z6Vb?{nW2&@s$%H7g$hm<=A9UG+FLvrAHDR)sl&ka&`{!pS$`YzIk?~wWqLJuL^ z1xPl>b+B^ei}#JVJ^FhC#^3#!EO-1SE7`iUrM=y%J-W;M^HS2%>S=DfBx0@J1K7We^~rH zfAn<8XXo+#`RDyNa+1_{HA)mmO62*|L-SvZm-@hCa{LCHKM}V77w3;T{+@3s{-~FD zILz@!M@YXs{|}ab-haPs{(C0Mcn{b7?;wBQ*8bZwL&mTFkHqeuOXTBk<7;uK7Zr$hbWcnbe_QThu2T@`NOxhescUCI^GW&KdpDpCH?0=#~+~c13v#5EdIm2 zescT=I)CHi*S~uHbGVLQy#F4q_2=8(e>r|F>2u@!|6g4{zv=k9hsf*D!PW;)p}bxT z7f2Mk#AuPk2IZj`)rulzIvOq zzv@wmEriZTqorIeRqlDWCy9l=v zb`u`%IGvIPxFISN-n+y!S;BtzG4ZA`rqd|DA-D5}BV3 z#0ym)6f~MA(X+`9p&*Q$CG|RCcZrn4gc@PgMfC{^=I9LoGhA56zzXkNTR zxc4qOUl@75n%iahP}`qK4!E7Ki?30;+B@7T=O1OfM{jVi?9pSZv zHxWh%Hxk}M_K2&065A$*naZ9*Q;gGD(iaPOSz@1*&-m(V^%9&geJGYNAEU4-)q zLxf$l9`_KYoi6=!P`OU>T_it9_!Qya2zL{HNtirU`WZ`j8sQm)rGys|)>1pIg!QCf zL&*MrLUJeJV=Pm>?Sy*?wOkoTH~S%Ukv>AWjj)ICDdOWmxQE7L#)D4d5cdy~KPCLk zB=h)vL3(YvjE~omZ+f17(>&)=zrLyc_?w=Gyq_KF`VF@MjWmHyc<|XLOgz3)f_s*S zaDI(-`8MR}Uk!YG;Q3|7!`1$9>Okk)U$1@cw>hrCWOKY+pYc%nSE zd3_kHokQ)Pg9ti}`qxe4mC7eWf7U6k>0m2o8*Am`J_-n$a2{%%EuaVqC*h_fSZ)Cd}gfj?B2)9xF zc_ar3*Aqqve?#~bVGq?~zPm~P1>uPMWV@#j77~^bdI&EiyovB0!YJW$gu4kpCrr3s z`cEU|IL4DagK#dPhp>_GD#AMm|3LT@;p>DS5sKf^_z|8;cqZYwglRp}?qZT#2yZ0R zsl1l3gRqmZo6!ED^rI8rMfD#c43PdAl6Mhykp4@ONB>UxIfbx@@FK!avR_VeH_6wL zd>f(oNczbn+(i242;HP_A&d}q5$<9?o1~x7gc@NE;W>nLgqIQCK-fw64B-yKj|uG$ zNdIYsrx4~5&L^xTyn^r+!VQFbDQ<0#^vCndjK3%Q&4hm<>>_-F@N+`z@1?(F!tsQs z5f%{6Bjo*bG0DpaR}o%A_+Nx~5dN0%VZ!GL-zNN$F!c{Io-D#b!V3u(5iTQKOK9dn z$pbTRBk^?$;ZF(gC%m2Te+cg)>?FL8@BzYy3AYe#BOLmm9LJ|gexC4U!dD4*5bh*= zkMJYHPYJ&u6y$dZVKU)J!lMYs5^974v!S%iK=c%OKE&rax=Hq&Aj{o5KRc-V6hEZ% zRQ8|nvYZcmzk>CQ|JW|e@xBJ@z7}dSzMdV27T=}R{`UrH^azTd<2!+5c&*TY@s6i* zcBhjJ??o`|=a9_jonh`?#b>5&4pCXqj?J_wYzEG{NsZT8&q+i(NZ^q}5IoVksto7FTm$4ci#Fu_*{lQS2 z8?kq})YmoEg$!R**hBh8pH#D>oqhUc{-(t-SKXu!c!R-ZHEa#vonn2HKjg3W*K>s~ z);Cwx*Htg}T}oB9k-jNV-RA_hqNES{nwHj8_Yt&-^``E2lD?l45FA1IoN9NIM2%!8 zp(7;q=6W%?MV5z`NemEn5=IC+2xIk38=h-reO@Ob*GQT73zK%5;{m9 zAlXA0t4JIA&t<*H28sI5Bs%VpsNE*9gU}I?vLHD^c225q_OET1_WFwwd;TKPL9&~$ zlh9nhV+XbOy2MB6d1o`asoY$@`wdyIlh8qS0g|004_4o^OV$tUCO;%c-X}fD=5|?j z?~!&M!mfXipN}PWke=<$s3p+z(H4n1p@*=8u!qoGzcX3Z>rRpwA&e5bsl10|bNy(p ztmiyk;&$TSjA1G_*YBP#>va<9WEUXWL-Jtt182(mU3n6_2|MzoET~)~G`HVTDeXLj z!XxD<$>B?++(Fn)7$9_VJw{UlP9OQNk?33?v4`|sgq?&v)v`Q7a+K-`Mw9>1zmUfX zG4|bl=La@OXgZF{J5Lz6Jder)83UJ}L*<^#fy`giw$l z&&Bi{0X=WR&!6z;pWiedERk?LT!FS5Y25GKEcXwmY5dLpaA(1clY)=2W}AbNxqWVz z<1o)pvoCI!<1m*GCP#0S#|iBwi8>v}!;eUr`?9%GdKf{DUL-l0A4Vmxr?_D9wlgN+el^aKp%-_l7 z^K9Xi^N`QeyQyLP9Ro~!f9NPFidwh)o)hacUzF{0-1>59$X}V{_TW6UxI)?o`1@{NDZfGfA~mx9wo9ZwOnN){%cZ!S z9N#QzpJbivHc@?jfh_MPJDu!2q|YV$T8bkwQ`&b>yPYIQ$=}XZvb=}TN%gl8iW6md zE7fP-LX)L_8;y&H`kzMi>Z#m)y}a+?AbDq7iQ$&u`}xfXY4W7kMQ;tTlV3KK0?Z!=Su7uLGkVW z$gp$vj5F4wh+USmKb_`H$3*h?E7>1?l9WC7N$i>@Q6DY+YG-B`{-S@B{)=9e*!_$| z_a(C2lPv265+!QCk?7I;W5@YqNBxSNNOG~nPU=U;vC?nk9;r9?TcpbPddR73aSc$r9ZyU9$X_MT9ZAwo8!6FA{dSI*GLH-U#dU54EZRC?IxFK4 z*YkU(kGW;XgLfSH^oG#Fr`|rGc_o~AD#TS=du>aUIM1cKL?0CFi$>CKD);_j^@nVd4E`fL)WYpog%Q=vB$S8A)-)0^9pAVH0 zF|nS{&l2c-5$i(nir94(8=8>qxjxt9>n)RcOl14XruO(cEM{ohV0*65?eX=Q$vh^q zz1P$pU$?~!O&e^_^|?L1o->)p#OtUXb3MM!iy4|W*q-Zidwl(8GLMOy2WgM53uA_+ z4Q`L?b9;QfXflt99}m(VUq{9aO&i=E*XQ>5`qE?`6ZtxepYz{OrtcN-_1PwR{zaQZ z$GLOq_#N}uf1`(v?{An8_xlqd^ZxIdB>hB9&v*3q_T85}`%W~@3%>h39k_?){{xo;Lq)O{CK=L689k24^h59 zz=j8jeEqQITk0Qwj?eSd+&|A?{mcF8@fobU+&@9%%lvX2T+jW%!0-L#a)pWk#eiZ! zG4Rz4@Vd^A4cxn9^ruiSF<5_n*Ea-Tb%d zhT`?#W+?tm1L^rUjZ1~47*Gr-1{4E|0mXn~Kr!&2$iRx?(pgrEg@0xkesB0pQu{%u^&Q*-}}xL!{Bd*7-!h>J4XiUf7j#k7oQk~&c?^&VR<12tm}b%>GUJQwQmyIv@iuLK^=GHP$IanR@m zHH<{B!3n+#1}Dz!x%0%rJ5$Eke);TU4}Wp0_h%D+mUPRS?pH8?k&rdWM7#0Z@z@2N zGx*#482>Sl`Mof(Dfpc<_^z5!kkJRfCkHl-gz=Ao%=VD2hu^n@dVCiTPQw%wC}AvUk8xu^G+Vv^zp3lfwa11G4cq368JgXy zWh7{8{>QOFI|XgA@7OMn5B8P&gE63g>?g*B{lPe~ZHxu`_4oJu*S@sq^V>?TPcHG? zetqK0dG(*XvHAF&+W{+oykg<)4_(}o^x_{f@*K?-b*G0`FD);*Ns* zuG}(gT+M@LxL%##@>83B)cf~8w06~vS9QH2E_!t4+FfH8htIh8_hW(uA3VSA@>w$) zuKe2rFa7u8!p#5PctdK>F3YS|Xnw$SKWIlmFM8E10A=VWVv#fIb;BCC8pOVv;^~mDD-*?J{{zsEgju5Z zq#GLEk8UCR@Cq4c4%xp%_R$ZeeJ1JW0gi--1g%3jCoo+H+2Fw={rud}3UNE>qvU@z z>2dy{eMh^r-$Htw^xEB0|2gSr8u5%0;XliGxZP_&kA56MY45hm3V$HI_G_sRQHTFX z{@u?=eJlA-Bm2m2r2bUW-${C%_UN-ne=6y_%cVUZ6Hpq7duq3gGnW>gArRL<hA?0;(m@pEm@`%KEyhYBp}HF|4Y+q3T+wO15Csk~^(( zp)XWf9cZpx02P~?;618F2;PvlzB15M*BDx0C~AD(`g%Wj@KuK3m91zKtXtR!M)Cea z&5an7;d3eWMuy>&+91T-gt37K!^B%t(`2~97*GkF3)NLu)-^8h8~T{<$^}h6+0`0f zRr5l_P|Dt>g-Z?F`1rs>9dH&$Y-N-5XsBxHD&eiMu~wkfrchnu!b*5=E_SS;+TYwL zDUWw*lyRqAHx5e5t>l*CV@0AJ`{7IZS%b)zVLz zN#F4+sn<;Uo>fwxY0|qtmimZEzoATaV!KJ7dzsWbw)c-)z#mNZ)1B`$#YT+TZ_j(%Vh? zjnuAg(sz-*#iU=oS4t|aV5y5^Re-ASr9$1 z%Kdjc+2b_>*5TA0r{_^5aMZvawG5PMRN|GX9p zK6>Xh_)XsqL&k@&$1o8)=%vTOBj z&DAzG!_`)lVRyCdaIJnL>RP!w49&ROs?%I;sTrkMRN7XW;c&qpP=zv}%H^PC;Qa6(!0y|AXL#g9RdXGD-!-PsE}2_ikzZPhLz<0WF|Cg= zZ$$2)ewg|1D3JW0e^~l=_~JbPA3TDwPU_STbN>Q`vVW%?-u~^^e!uy@u(~?CddkG< z6DMZ{oZ0yG;AvCjE{5?=n*uwIMsbLX8i8#G@_>u^tS@( zD}-=UJf2hKbKK75GQP-F5(8Au75BQNo@K75ohIu$2s_DN7hyM{o60?e0m2?C7bJ&S zriKD0ncE)>o#e+{u9Lo#u*2jxVv@OjWDtK`&e%nEQT9(5CggV6zK8TIA1ZbqCO?PT z{^70{rE$<{o{IP1G3INs@v9>Hx7K5tmpv=xJawNX@kFSy2fnC>KX8G+@i4zo&j0ym zOYFHoB6>bfhd=lQ$FE4PN8UE#(Mo84pg8rb`1=r6<2c^ArvLt8cFDhcuzj|)a}u(h zg}xlwFfYuieyDT%aavq2Fd_2qdl-rV{%pTU_Jiy2{?2;$rzaZy;NPj~ARp%MY_gvH za8vHz%``SUbEO8qk{O>IruezOdEt`lnJ}wkt~hR9zqnv9J1f$cE}KUBph;gq`jAOKm-P7C2GAhG*cMTb7vi>ged2YI;04gW5? zp!+y{Q(+sG_w@GqG2E-E{2%+ITubF&w=3&D?b45{x>}PS6xGOXlNDzNEY+A=j~Qe}>)o0=;h z3#pq%8@1lxGGBeY5G_9Vk^Dey-TwaJw{(pZ<_SwC4?fZVxizlYMbE*AE;;Y{xe^}t zuHED0{pAE%KX8qdJ!7TZkteZdltlL$iR_;-vcCU)c77iTzPkid`0D=U9(vwRmKuKt z7}>tk4X?{~Ic_%Q>CgLjUk$mHd&KyD&+~ycOccW1Tlqc`Y1#kpZ%plRDb?*|84+W7 zmh9gmj4#LSeif(?>wQ7?9*UFuM=WB{?H}hs_0RV;+gncd8xPb!^Me;ePM4`3b9NwJ)=|3yESKzJK)jXe z#dC#*+@5K95WgY&&4h7I`|%m4H|F(AWWSgC7gye|-eB=(Cd>WrV8%Vpx7bPT4(2!B zHh%l_L#*efIOBXBRR4~6W8ig($05$2!Dl+zPd3$KyTR(6L-q^4Mm_e4xaJV+-D;}G z^KGy=e@pf)2O4+tgrH!zncCw%4AdT%A$C)}cpYvJHh=b*>^n`r-`O*w$9TR>Pn6h^ zEK#IN#Anzr@w-U)_~W@=KBvIvi_RZPna?-1A4!?_PwfUN^Ko)A@xt!{;OED3#J2_3IXIZDqd^7Cjsj^^hE2Yc>=`@3Je zN}(7~3@8Q^1BwB~fMP%~@RbYOwtu+mxoMnqny2iauk%}ru`^yjx_6kyi`Ex&{SNw`wLZdQxa9j| z?4SLy+(Py&b3K+BJIP-cVKK-JOJ+_Sk`IP z5yU2|ju1n%!FOzP8tilTpC{;SLMUa;;W6a-b}5@bM>PuL{_uJC{Izm@K9IdRo`C85 z%ji13pK(nMxT#S;IF130{spCz#<9y3lzCnGza}%Ky#BImqKValpI>m(aiE)?%i;4a z=Fhx-XPTZn=yTYAtGimxzaBzSBjx^9eUkoX`8d=J~A+HZSS-GVnSJGuq?5yB2!xtd+1M z?m4uBIg{k)*ua%c6z9c%m-CpB*I&=Nf#*N3llFF5KA0Uhb1=x99E|O^ZDWp&*B_3< zT+Vv~tfe*Z+duF>M-&}5-ndS|<2Rmz&WMxIhepp&@qOFVP4ZllM^ghVCzI@@ za=vfOGLKgomGi@UEc1O}AC>ccVwTChSct#;kyX2_+8YSsFD_-lFD@;eoIRj=Qg*05 zm`x9}(a$p(D)|f?{5sRuPf?1`am~Q${`mLh z1pN*g{~j9uZW#Z*7XNNl>~ltHK>l7A{4AC~m=*H-f#3T2r42b#49Lov0>3I3$cg=0 zmk`X?e!qWpt>o_%@{4otKpE%j*KJ?gAHLteqi_`{1{4E|0mXn~Krx^gPz)#r6a$I@ z#eiZ!F`yVw3@8Q^1BwB~fMP%~pcqgLCwEIZ(>UW{`J(?|&-iLl4jKklmPi9!Fw zX;dl%`>VQD`ZLd~jUV=|z_I;anJmY;nDwjDjrj-j*GN1ccpf-5$@p0&Go0^6N+fKU z7dE!K?w9t{6Ldp%)BKLc@s7TDK65>bVJ*aaD`~?7(e4wZh6vi5BE`zK&0QY}RzGhjD@pB)z z%-Ek<7@!=Bczl^BZkPA_Zi?&gygtPFi{Iq>om(aUIt|#0;?h}GizPOE3F1r{=iO4J zvy*3tUyyZ?E0W>w+2SmL4jGef{O!YtRVo;1nKITvtQSZ=+AuKVSn|Wj^By^j ztyyFf5Bslkno*4PFjn{P{@ zT}|U>#v7_+LyXu4rgNbluL)A~)qgqeGHP$I{&nU`Ka4ai1}CXdgmmI@xaQ7z>!1E> zR{QYFY|re;d*$Ajw{N-+W5af^4%%Qsdm1`JW}A*j#i&R*~{%kAL<`hxJ0f?%!d%W$Kf`w zBU}$=)MfF0Sl>eRkqfNXY4T6gR0PP5<^B8AZjt9tl|Npw5M6fP zAZ7Mjx9_J$(}722|2>2qru_-+xlf1@vSYukTV(y6b0nYh*Gi1d1B&CiYy0*u^uzY% z^HS!6>$A-9alG6P`ohHf3)`7@k*7*{gBRu=pueQ$Uh^O_xL5>+K*)W+)u8@ z<5M_WuHSF?Wqn6vq z4=pr~H!QCzk^Wd8Jx|J=PssVRZhU`!xPNBk`kQF~6+Jj&y}cXV@ zl=oNm!~1!~<1)Vagj_GS|FOcfKCnI4XEQVM`tbJu>@()UNu5z1 zoOkbzl!$Hl^YkG}oB?faqjq`!OQL?5EeC7w2NcIfzHST4dBXGTftTfe!Tug1dFCrp zf6{9bzfags_!Gk45I#vb^mS=JhHxUGm+&US+X;V9ICO`sH-m5vp`Wmo(E5h78%dZ! zcroFnguf>IJ>ee--z0pGa3A66Z%V(n68?&C#9LC|{Idk-Yd?G<=dBFj;{5ehy)#LfC3*FGzNKcnH zv1?yGUdN7q9rC!t*Mn3|upQ4Y{*YtV`|^{8WHMxVILY#=T!;}S`6za5(zpFl@^lR8 z`E=+6l0PQi=wlgi3)!3832}GBwhxYf`3Jv>Jh*Gl+1{5wY{{KgIc>^*W=f$LPz)#r z6a$I@#eiZ!F`yVw3@8Q^1B!wFQw&VZZV;tKm8B&GW%*^_uXN{Exbm{S%^`nwRb8V$ zm=*H->x0?#^-CLarWlZwGi9PPE0B|2Usp9lS~drps_TN){;c}C#^#o+rdnV9>0kqw z-dWS87>}KJ7y5$PflEWR{zihV$rGndJY71WXH(*gu+SOTLU2)aRxsoXWL4LD8yDte zFRZDm@h!y=n?rT=!ATP*Px=b$nnfXhjlapCU9-&Fv;cw(RR)^;i+t6g?5gIv`kKm^ zKD%UYc}0F{X*P5zyWU^ztw*=n)K7C1F~1xK8OQf$VRdzO^^}RzCr-`^IJ4!a5t1h~ z26{wkd1c`_rRS8D=QRcMoHJ_b@|-y{Cr_DC-)L-1o6%64=XA~p)a6Za&YV1XM$m8Q zr_QM1jj9@1G}DP~Tvj4zFP9V;L7d*FUtSl8IqK8a^liokT;J5E zj%%hq&UIXi%Yh3HF%&OUEuR!CsOs|=>c8D*6Y8_6@m0mDHU%1D+l%5ThKU=~`{K5P zaobIC+updYc&mM}y3752j8zBf`h+<4;s~ks_Jy{rt}nFUvcBz_xNTpsCf3xVz(Qkt zDvai$fUi$zh%W&lu4rN1f>@oZ204gWKTsvxGqxATZ4+In4=t1v2De+{>|5e(;{1o| z7W6e1XzYtGxU}E494PeK5N8yqmivOC_b-h_-4NI7hWM^EOo}sF+_$~V7Z$rb067P-$a%FAx_SHa_=&4KL3kS|zQo$byq%!aK{FgxUh1E{YiE8uPNHUzVS zA+RGs#13V61|gQ!)>YS5*7)F{-Q>$7)UpAK-1Q>sf0nRT!+nrxtE~DhQ`~hEMFj$)n^f&mjU@OZTTpaKQ zaTs6-phv!@AaO0HNoh&(+=>CG2+RuZOlk3X#ijARnO`)!vM9eIzp|(VPAK}h&7LSv zXe4p4(}V)v#o4}=fWHYw)zHq!Uh0MO9ysF}q`2?2i0oq{A#m;$7twUhGx|_b@%_AP zJWmTi0}%AQqH|!Do-@Z?kyi|((xjE;7nRH_*N}&0{-zo&vo;h8%*f96hXUFHf0G6$ zl7R^`#GL$+(mW%yU;s`>vm3m1^~_b_{P|yZE}eR+s3CFnaVdDmnO5Zu z*2buXxl>s?O^x zn?Q_>GiGF?9B2*%e4%=86`TPZn>2O7f@Za>>kCz92dklX#uQ#q2h)1S05iQ`G1lp) zh>b_Q8pdX}v8U6nAO{Ist%S{%Sp<@hO5DriFB@j` z+0D<%DVx?O290jXzu1T&;zrCpuZg^ZnASvNnwFPbPz;NR(<$H}QhtuRcy8Y1mm9MR zy8=@z7^n;QCI)M@@j+3L567oj^X3*-8Y}ns@p+jOw97OtQ}fo>d4n^PG~ZHhy_RuV zzlHq@ZGv{W7V~M8X<1pJ(4|@a#`;TPv&rYJ$ueB9u%NlII#lOx41yw9>tB`yS8+8y z7Ha$-Q8FcDvOE>=FOgw<-8(Y%hOKIIa#}SrWUI8H704*-k=Yv zWuPMMITq4QIhwt!!5BJbp-Ehi^wGeHGLF_ZolY|!VUzl)d$sNd(9 zYWafRYH+up4*tZt*W^RPl3C@TG`g78h`j{GsV&f(SU;puUWT+Ze86Vj$=b>264qZZ zSc-k@W2paW$c(Hjz_P~Q$0XJ;2!r-;d)&BFE<7jH1qa%a}`%8Q{a%ZtJ6XLuo$ zV{t6HSmYjK)}8FDuJuDCCud;Qlc6Ukd*ZA?3FjEnagz@Mqb6`3ENO--qmu`815QrX z(y_b9AUau^m(J4xI$J#Vyh;w13P3wss|i|y2d*A*bsIru%g`w7pC+= zZ(}1Ix8#)h3h$?BzzdxF)o5sLFo6xyM8pZTpsxQUtnQnCMi0|7a`2FpUhntTz;X(0 zlcKp%s$w(3SV_|5iU3DcY)6J1+xOvw6RH~}re@=2JvnHQrVw0Z9)4_$StZ4QVn8vV z7*Gr-1{4E|0mXn~Krx^gPz)#r6a$I@#eiZ!F`yVw3@8Q^1BwB~fMP%~pcqgLCX?_(M)T}&^2VKiR2 z3C8%I7<|V~H@*1Aj1GFy5hK6f2J2w%p%>(skzdHfNM?fHTY4G=YsMn*iHVWxVR-m% z9HaxQ@_Th)(|AWO_JiN8gYVSAu=(9{uxY&S3Vop;EJJ%N-<;7oG9M+Iz1W&z33EMs zJI@d1{qGX-$74JH>iF@kW!E}uuRMG0Tf?t8e$`n|+3Rm;x%Kj+e^%JI?vy7^!gq=_ z%)hGN`?{cdzmy45Iz-q-FBHBL1Av6>jRJj`h&`6{d7wx8Fuf4ShsKcbjnam_NsrYH zdy^l0=`z|!sND%5W10^c^%}ik=qH9&h_Qg^$83Kh*_-2E3Hp)Z!~Obx7TNbuoTq?{ z>0HR@->esvl}l@a{>p{EP^hlK=U-6cy_9vR;O%Po4Zg)}wV$%d7i1kcstz=>6kOO+ z>BFDQgTL^5h)aD!{?szIi7)ET5%R|kC&^cKTVX~F^bf~N{=4mw_lM(qZIQ1fkTKy{ zTH)^}&37kY87AZh6TioaZR2)hqnzithE5>;V_&Zyv6kf6zD@fnzsG7DmDBKwcB}-6 z_k}bmiZ6Smzl~J?pCr?C!`BBI?OjdfRP7rBjGy}~e*+K{qilvQ{(ZsMJp1&|&-mX- z-!B{e!0Y1+tXli6PygC-Y{E<(%yIwS0R6uRuma-V2p9sQwxb?!H|k-3aDvTafE9or z1BL*3d@Re$gr&t{IW~Eyy#w?vsDopw!}cAJg=>W4O6w)V6HBg5xW=}A$kmCfhg#Pq zZ7F!F`00XYWY=Pa2)xo z6RdNQgXF~cIbFJb$S>aM?VY!JpUqYMNy+*!22j%Wd`a7rr71;G*XFluuC_Px&(A+E ze_nn?dCB^*&f@m8{7<%6Qr6-e&TrRktM`Ji7KD_$cc$dHHova9hCS+9`+Um}O4?m^ zS9@V*al0qYHT}6@l54^rOHzLQXP2cbzuh&~)n2X@w`;}I|JHn`%d*e)!cJGhd73L> zR%S_Cmn*OL$sf;LdSuS?t}OA#AJ1IVied~y2~qImk3&9BH_bd`Mimdow{4ojT+%03~ftv_1Ff%Ox+o-}apAh3>V_m$rS>KKxH;kW$j+f}Vc* znk(h5E)4?t6=?I@=ZXC3e{TLS*ZNfZJNNDD?Om{7V#*0?fM6l!!GP`k9aM!ufdMIL z`?%cI_JwQp8$GVoyB)5zy(w#c3TFB3xo!JazXjuR8%XU#o`fpKFx>%Szi8J!pVE3O zD53F<=(l~yW`Lsh;di3cH)hYln6(eT#V{Fj6F_mhy=eNg%{Stx$)QT6fqEh~P%g_y zuC~#?e_>9QBNBWB$b#Z&{g_0UjZ(2%QhZcqVMY zFs7`z69U7btlQ+l5ZnG<+V)n;kX?_v)(_wF7KFEc%H0B8zlfbnDqj0!sI{~`YZQn;&S(IdBF7X@f4TX8V>9GUoFO<&?PFej-0<)cfH6a! z`(()5ux&|MGZTCp)r(RdKJEq3@ov)ARn+z}%#>e(?$eiDZI8NMco#J430Y~eHynH|QaLn^>A~R2c0126S)YYzQFhfEK zuC}3DQceg1Ibt48BxBz$t$rJ((jJ^j`K!N7NxAA_DBgriYf;;4K-?FrdmsbtNk2%NxPm|)P8>a zits$nu5-qgw7a#U_M?iSUw0pPUdg!x)2Q2+M){Xqyv3L`&p-e;Ys!n--gdRUx(R1N z%8-6`D_7W%mC&&;+wx&+qo?_TjgHVW(9d%oSUmQ^2FwhUX=a>SJpJ92HCv&*;`Y(SYoBj^`JEQgpyV?WLM9|)T`t%P|);Pg**WXv>rQHV`5M9a|Jj(3p*!3r9 zb@djUU{}E3UFY#c%323v{6u;OCQ=pX`X0K3kdhCWuIxE2X&0 zn6oc*|Kf)*O`FGV^n|ocdO?bCt^Fi4&eb*xmLJzvLHl@UA!KZF*Bqk+wH4 z-jWmD($SaZZMqDKU?)jQh<4!4lZ1OfFI=Uy9fcl;Y~GpNmY5U0m@47^R1V$RYi)AD z99&lDYMiJ5q4pb^pKi zuHQ9^APSFOQcARu6bf4yh((6I!-K=ZUnz2kNDve&FRQzHQFDaL222w{JHgU_Ml1x2 zSXlTcXernQ!imEAeYg9a0LjjB)NlG2fkhm?!t0e>B+jeHOL$>E2*x4<-A^^I`d$s@&mULN6WnNwzj0IFAB_ zne$n{_YjrdvtB=ip(N+?>{;%7@-*M%kh^6)-#?1pFxy69{%i|*i}S2`$i}}CuL0)q z=-jV-L%dr#P#S=>J|?am67z~9d!4PX!xl&I$^56?yP(UMG>+tTG>D1fpLYME{&o9%HT!KY zCXo2u8sLh*>{aGN?4tZt_gmuMIk|u|Z>a`ogz>+t5^M1n>R9nwIPQ66FaMXgAwc5# zzT{F{`cj+x4IYjeQwT`+YAb<`P5BSG-hJ5hRTT%1%pu7x)LGjQFa!(%L%8UjQB`@fC5KHLAc91Hb@Ng! zb*!Cp-#O%akB^=)bnCM4+V`D%f9IV0aqfNZe(+vB8yy{XyIg{uTYN-d>}W$+LdH{w zFAm8lVIk2Z!s0{XgTf0)1NgAyAT>fv*C=VGjU?v*ih3cp0fgLP8DRRL0Sl&FLZk}u z3=*c8K~GW!Ooa$aKI&mvd;BsA^o$HJy+s+U5@kIs9_ocjFHCw&FOxh|t{>J7{W#Tc z+#QA(#=}TNP(CXZWzijdQ%_=e1v8a2Y@wqvCInN~`#9*43Q63X1c-f%@~dT+Yg9j` zY@Y5+dSY*XcP81DNoR|5U2~zmU3>f0LQd_I^~Us3_Rte2WKP)LWQuYe+mZW$1nI$f zpge}zn`Qp1@GcMtItaA@w#fmH0v2?@$7|pM>Yu>s?iHGbVXdIY^SU+@PiMuU(UF6L zTA$jd?h)F^_?VVV%Lz!t^!6S2~pD^IVluYXTj zZw?CA>8qEnPF4!n+8LJh|H)@77^;-c-HDZos|#ayVhhpLQsZe;g^(XBom)eJ*uoh2 zD1I)uB@K)=+6|CAM%b5L+mAth@w815*bf12!1x zhnJ#v&@4;QHG|y7#$SrAVp}goZ(-9eMOPXmxq&ZUY$>`7L@b-5lcjGjb1#lJX+ekJysgp-neoCb6zMe{{<$y;)7W4B9tU-uBx;v+B5RhNa;tB zCr3(eMNULY??lE&FYb8N7ZfLA7rT%iAKmpP_Mw%R-houFyyMY3d*2{?jF#RWExk2V z`e|f+^WVlUTy@0;eq8(~>|eieI`WCg>BuJ|nz>D6|A8_gmHm=>BEBzX=i26Zd=vou zK2Jlo(?Gun^ckQh@2;<30y+ouWyFDA1G)@!73efnHvko126~cSs?C6-b3J`bxaI<` zZ5w=zmw*=l49BdsJL~J+C@|y;Al3tZGvvo(7s^046pMgu1u7!`z-Qcp8@(TggdmFi zBzWY%4``V`Ug5t${C#GAzQX@1;MYO_IWyn=j1<7UUj=^@>X<_Qus`rQchukU`<|#j zc(Ebs-}!q=%-{1FZ_FRM;5+0GXZ@jwzbE3~dC(s`=QZkSx% z)h$rBK-~g$3;h4GKo88_q$5hhVR^2(fvVfnV90Hx_-kGxF2^#!c-^&)_`Gg#X+i8{JFA|^Be`SQ%u}%dzG&uNJa3`$b zb_GM~9$4#GldTaN3sbun8?Jl zQ^B*Td?B6727CL}9(8YU=Tuq`gP$%=>{b(~r6zJSk7Y7vXS$N9v)wWv@!&) zzJZ?J{!q`vzR+ZU|L)zpL;Dhm-rj*^|G+?BD77!tKLCq8Y)71DVMja^+3wms+uPGO zAjGrO51DpyMGZM6U(9CHP{^r7!d6Kk?6UD}HaC&ZI?8gtru>!JOmPZCv+)K=-V1>5R0Dy5&>xOnOSbnzh=K_obNH+o;~2_4agn zm+S8*eit9Dzn}H*E%bwj>)%_;`19TwKhM|aL(u;pdDqQ{a6X6gTl}fcUVd)VPgC3C zoU9`2JRh*@)aP6E`7^AW>g%D1^ZQa?57B@rzdzgS>)ZPJ*60w%c=Vp%ufWX^%l=cm zw|s_%_nw?&n8(yfhR1cLPBOgTI!to_CmG&@y+(VnPBNEBe=qIt)|?km8s8=QZrO*y zeXRe1eKpztZF^z&wXcSX|C{@2HRh4B{CGSA-77@zXC7(SxmWs}F87)HN#Cwhvp-V5 zeYfokzSsL>y*=-1-SMvZzSP^Z-k$%L*OBk_@2%6EkH=%C|6LiLdw%R5b5Ndp{($Bf zyJ7vH2p47vKSyq$5Jcd(E3goE%O5OVPkMygn{g0t>xf!pd1XeiDt^9 zqfs==JQ_UD$vnKG6%$vWB%4Hlf_l4Xqu}gjv5A72X3bzv~v;o0$6%i}G-{=ScbVLXa( z6EFfl8#h>GM%qzE>9@#uw+qjXkF>PF*WA}CP)mFpyaMeZ?dWp-!oLw3NM0O(LP4Mt z2;}AJbhj!GxkfPZ!}XthVc=WMf3xfJKMP)Y`_xYxglKYyX<^Z>G&TQ`;_>cRe1{d6 zw_6c^2FP~+Icy*Y6!8a2bF+JUyV43+14^Az#7)K5{ALlI(pXe{7nEj5V&i@#uwQB4 zuWUW6eBiL+Ijn5(Ha?7LdB5y#gyQ{bPbbW%3DFH_2jKVn;%qnkDqct@x{pQ%yCI|( zx^*}+uBVb+vvK(0ywELwo8d@bSLSS{%YfulB=UFwU?Ky*v5U!KR>%|QkbpQF&xm+3 zFXCbXj*d=>Sv@c2#JqS~%!paB9U27NkL`bk+TlFWMWRV5hs`I%?}C3G{9l599sG~L zzXAR__#5C?z<(e7E%5&W{yg|q@IL_mui$TkUjzR(_&eZlg1-wM4<7u|?19F;xAQ=L zA$Pb+2tFv~`xs`X2W}S*-8?wqb2|j;h z#hV4M`>l9OdGEoBZxFl(V8u6zWpCIF$*@QG;U0<;-YP;qCp=I-*JV!31E)RsJeL*U z1ovvrm?0VV!08sg$6#i91f04KILU7j9gg@`@t`9PpGpVkfm2|?z~w5AN0d(wSa=@6 zr`0Sl^d3IdX2@lG z3Fmb*%NJ|l7i-`z*1)gU!11$!<+SJf^BVXDtgwUp4#N5OEmTK$fNG~t4VXD&|xa2HIB`TK_53ElG&um0YCozf|v-!;U= zD^kAtyZzUIJC(myy_RJ9!$EjZf z+~qJ{><4@k*niO*mIajR5E>;sOm^nI++%n~>P8RS0oFe9SVXa|I-(5Za z77>T?oS}Sqr1>4f&l8T*ZgkH|+z6YWUjiKSwU2|}06b_Gr0}-^Z*y-H*U1hnvV=IC z9_9IfY$jm-5O6Ff@AsxiVH`SM0QzCjHqPEed3fLXy980`zRKxPKkp{|F5sAs-EPfZ zBi}``!*e9x3V54)OI5zx01uLknOv9UahNZ47Ylj3%-Rj72D{-FtG2hlE1ybE$93ao zYj>zyRV)8N60W@_@_MhD6Dl3-)zaCt4%1LuTuWt>c1)el>2?g|oN%?6&7?n-%FH_| z)MBczOvvlSSx2QBJT*0!b}p8c0qS}>q2*JVT*6#mD{if~m1nJ|l~-*CE8oE$Rsoqn zwOy=2)%LOSWg-AsZD^IT*~`k530Uo>B{PQ6;(7|N`=SwN(P%hW#j&ne39? zEO)%30AN+$t6*3VCs}J7SmkT+9Bgk>thReapxWjYp0m9xe4DK+3@1AqSFsa?qG1-< zj1?2mP3k}`Ou;@*Ep4slbJCP*YMMI3G;IBpV}^#&D+~<|Lvrz%G>lbKI1s@@ zoy|bNNDQnY@HWm2^f{w66UB5Usm66ZpPnefb`?mbCW=$gpC)1aGs5wSiG1oT$KdZl zq&N&l;b1(8^=k$ zA9&UucZVTX`FkEg8LK>ap2Wx=2;iKD^?5&Oj)0vch%)Hp1~^borx(I+!Cf)dzw8bJ zB4GbXlJeh0vFjULAs&YS{uamji|#PQ1ng5u0vm&dgXxmA6X)MS_#jZZ6rwoqV}%d| z$M@%qn2`pDk$wz3-hJczdB5vL(&u}4Tz-~gdJ^>UE*-~tU+iVl4+0;Zz5E6$#1sV3 zmaNbFXV*yo3<+}n_WJ)8@Uc%|`sjF{t%n-OzQe=qW=IS1+Ym78^S;JW5-f7TNI{+* zVr8J`Z2G)!_Zk%l&smtAJ^u^9H1~g=&o7g{JwL8Lr@3I$=Y2r_yEOQ>6wJ<^{~rR= zoImduhVZ2V7euDX+4KJj@ciJZxyt*B{C8^X@*HRS66oSNAJ*q}W(X4n$8tuj5@-B7 zz(7;6KJQcV-vPQz<>&svdTiHMK^H|>pZ7Db)8V5a@XU_&nc}v(S--sRNg42a%4x73 z)4#Im^SZEu^zH3sYYwpt`j{4%pVws%-lzVLDgPdzX2<&9FoO{0{F&YajJk@H&1 | FileCheck %s + +# CHECK: Blame Nodes: +# CHECK-NEXT: !20{2; MOV32mi $rbp, 1, $noreg, -20, $noreg, 3; CONSTANT: 3; DEREF-LVL: 0} +# CHECK-NEXT: Blame line: 19 +# CHECK-NEXT: !19{2; MOV64mi32 $rbp, 1, $noreg, -40, $noreg, 0; CONSTANT: 0; DEREF-LVL: 0} +# CHECK-NEXT: Blame line: 22 + +# CHECK: Blame Function is main +# CHECK-NEXT: From File {{.*}}/m.c:19:7 \ No newline at end of file