Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wYHc7-000ARp-1O for pgsql-bugs@arkaria.postgresql.org; Sat, 13 Jun 2026 06:13:03 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1wYHc6-002olG-1H for pgsql-bugs@arkaria.postgresql.org; Sat, 13 Jun 2026 06:13:02 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wYHc4-002ol8-0t for pgsql-bugs@lists.postgresql.org; Sat, 13 Jun 2026 06:13:02 +0000 Received: from mail-yw1-x1134.google.com ([2607:f8b0:4864:20::1134]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.98.2) (envelope-from ) id 1wYHc1-000000007V3-1m2q for pgsql-bugs@postgresql.org; Sat, 13 Jun 2026 06:12:57 +0000 Received: by mail-yw1-x1134.google.com with SMTP id 00721157ae682-7e2fd65f968so17076417b3.3 for ; Fri, 12 Jun 2026 23:12:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1781331176; cv=none; d=google.com; s=arc-20240605; b=Pjog15t0zq5v6HHSjZCjIpK81VnAJOYRTwMmOx81gxACHqYgEogpUy2LsWzLv6eCEJ C+BSPL6FMVlFF524r1kLx667XyGx7GAXS/YlqIBzafVxP1hNhAzV9Do5IkQGKvUKLOSZ 0Aj7KwKcWzY+VxmI9JiYPKh84Bx/IYC0IWLzyC06yeRgvuESI9/f+kLVmq+I2ITc7cVm llBtO5e77gKTl48IqTFOmG5+xB/KOb/IzSrPspVB+9u6sd8bQ4jQd2A25K9cA+/3/cxT NaO6N81+/9JX/EvfRVHPql0vW1t4AwNB7LRuB+OV7v0ih+EJAtAchlmQZCKdwBfi8Gtc NKSQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=cysUFM2PqmHO6k9DVrsYnVFIizTq8GkFlLqlaZyJaDU=; fh=5PO0x7eVYsZTuspiZZMvw0ttSDUx1Actt89nuLX18m4=; b=Nn5brRaKzAkjuf0befkTrh5aGNrvKP0pRASsoxlVjNIjKBt+Aq6GUSfa7k+XEHfVVM tmZGL2j67dsalgDCPVaSuiJeHOFpduSoRGybWQiFE2AokzGC7S1vfckwVF3fuS7T6lLt 0NPzbb0i+vf+aCDWGEUSamzXxaYU0Z/25tsEXcsbBAmAi13NgQaP5H+GEr6WZLnNW0Mf oaYKTJbLYOkrHl9s8Pf8b8FqDK1md3IuIWwSZolUVC6U6Zz3BrSGR5JYBbbDwKOw2DL+ gXUXqbo+i5y7Zr1NgzFvGdTilT3uZTtHhuFLy//UKAZQ+6zCTIQUTcxKTyci/9Hl3GR9 UqBg==; darn=postgresql.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781331176; x=1781935976; darn=postgresql.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=cysUFM2PqmHO6k9DVrsYnVFIizTq8GkFlLqlaZyJaDU=; b=kkNPRuRnwumRbmIOXY7UejLsc/88mIoGwfk6T7cw6WktzH0us8jswT+0yPKla/Bp8d 1e/GXRfe5Eq89hAtrx8DeAdHBZzdD+sO5Q3tepNG5hAZBs/Mt1wrtWo73BFHRxjn+1od kCNw9cJHGIY4f9l+8rOeF18xL8ZHZGaDMLrnvHHqRparGwVLwXDSLO2kj3OyA/VnJ0nH vNNupY0orXtGCcmvrVBKJ3wcFGYJfyeITQt6M9XXzwBBr3MsG8lrtgxpyu0Hf1M5EWVy 1KRnCCnaVqpiqk9Svi8OuOyr8Klyjoaxubjmt9rHOeKV0eC9agG4T3aU9ZyOCmuMVg9z oHQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781331176; x=1781935976; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=cysUFM2PqmHO6k9DVrsYnVFIizTq8GkFlLqlaZyJaDU=; b=Xpkio95K/fzLOR6yIxTvtWrd777dryTejo/ZIlcH4Jc3y/vmfXn/IxtSbVqRHn0yFH wLLJmcDHDI+bQpPyf3jcDc3G1k/R4XQn+k4MdPzPBJ7+ZSFDSZmL9/9NQytG0WAZ44lH IEYUXmGkD1WfwxFr2tvxNqDCRXqzEYFkd3O/dcTPht30TaT3YBKv4lo7nq0kyZJ4ZkMD ++e5/6RkeR1/yXwyPOFRQ//U3dO7e/SzOyAaRbHki9c8iJWXhhjxtWWYWoVIGsHClg5J x7h6VNDRhjt55+wf22ZLDawPzIEZQbrxYIFOJyIcf8whfK45Pj67h82F4i2RhzxvTJE0 yfGw== X-Gm-Message-State: AOJu0YwrFgTb65nvbupf6xUj9l4X/PyNpqZ/hAZDUIZX27Z6WKQtlRYD ZQZRH6e9YdUEtaJ8hGjBBwD/zvPm+HJkFQEj572+NzB2WMXwocIBuox6m4jXgsKPFCuiA8iAU06 wROpxE73jIYRc/uW2mkYDwrVEurpCGlo= X-Gm-Gg: Acq92OHPj9OrasKU0U/AqJyxW4jT+jlxFL8pasAOvfjBtdA6m6dfqSWgxvb3hq5VflP hsOUAmr86laja4Cnnyr1TH0DJNhelcSMdbHADLbAEuYfmwHWO8Ync3zP4sho43yAKa90gLnQ73R 1MiBTxCBoPWexwiPf7a2jm8r02ScUwnh8+U9g5sAGgRtY6B2RVKR98RDwAjtKEJnpa7WSZBAVeZ GuMnz49AfyRll555IJRJfhigc/3eZTO2cW5cVpBfWZeUJvdw4+1HJKb+ov2iw/22jLRiXKHNNmT TURl8qKmYNXDBU5+T2WMt7JGYhE2i3uoPF6DXrMH4w== X-Received: by 2002:a05:690c:2502:b0:7bd:8cd8:de2e with SMTP id 00721157ae682-7f7b90160a1mr53963127b3.46.1781331176131; Fri, 12 Jun 2026 23:12:56 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Ayush Tiwari Date: Sat, 13 Jun 2026 11:42:44 +0530 X-Gm-Features: AVVi8Cd7OeEzfdgI6T7iTCOx8eR8QEePwcQ_GUxvefKSCMghFkX5eKOSxtomdFo Message-ID: Subject: Re: Fw:Re: Fw: ltree_compare in contrib/ltree/ltree_op.c overflows int32 on deep ltree comparisons, returning the wrong sign To: =?UTF-8?B?546L6LeD5p6X?= Cc: pgsql-bugs@postgresql.org Content-Type: multipart/mixed; boundary="000000000000fb446a06541c7b39" List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --000000000000fb446a06541c7b39 Content-Type: multipart/alternative; boundary="000000000000fb446706541c7b37" --000000000000fb446706541c7b37 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, On Sat, 13 Jun 2026 at 09:20, =E7=8E=8B=E8=B7=83=E6=9E=97 wrote: > =E4=B8=BB=E9=A2=98=EF=BC=9ARe: Fw: ltree_compare in contrib/ltree/ltree_o= p.c overflows int32 on deep ltree comparisons, returning the wrong sign > On Mon, May 25, 2026 at 10:58:05PM +0800, violin0613@tju.edu.cn wrote: > > PoC > > > > File vuln_001.sql > > > > CREATE EXTENSION IF NOT EXISTS ltree; > > =C3=A2 > > WITH s AS (SELECT 'a'::ltree AS v), > > l AS (SELECT (repeat('a.', 19999) || 'a')::ltree AS v) > > SELECT (l.v > s.v) AS long_gt_short_expected_true, > > (l.v < s.v) AS long_lt_short_expected_false > > FROM s, l; > > > > Process > > > > psql -h /tmp -p 36265 -U postgres -f vuln_001.sql > > > > Results > > > > long_gt_short_expected_true | long_lt_short_expected_false > > -----------------------------+------------------------------ > > f | t > > > > Both columns are inverted. long > short returned false, long < short > > returned true. > > This looks like a classic case of integer overflow that's happening in ltree_compare function in ltree_op.c. return (al->len - bl->len) * 10 * (an + 1); return res * 10 * (an + 1); return (a->numlevel - b->numlevel) * 10 * (an + 1); I think the calculation should be done as int64, something of this sort: int64 v =3D (int64) (al->len - bl->len) * 10 * (an + 1); if (v > PG_INT32_MAX) return PG_INT32_MAX; if (v < PG_INT32_MIN) return PG_INT32_MIN; return (int) v; And needed to adjust the ltree_penalty function too. Attached is a draft patch for this, I guess we can add a helper function too for the above conversion. Thoughts? Regards, Ayush --000000000000fb446706541c7b37 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi,

On Sat, 13 Jun 2= 026 at 09:20, =E7=8E=8B=E8=B7=83=E6=9E=97 <violin0613@tju.edu.cn> wrote:
=E4=B8=BB=E9=A2=98=EF=BC=9ARe: Fw: =
ltree_compare in contrib/ltree/ltree_op.c overflows int32 on deep ltree com=
parisons, returning the wrong sign
On Mon, May 25, 2026 at 10:58:05PM +0800, violin0613@tju.edu.cn wrote:
> PoC
>=20
> File vuln_001.sql
>=20
>  CREATE EXTENSION IF NOT EXISTS ltree;
>  =C3=A2
>  WITH s AS (SELECT 'a'::ltree AS v),
>       l AS (SELECT (repeat('a.', 19999) || 'a')::ltree=
 AS v)
>  SELECT (l.v > s.v) AS long_gt_short_expected_true,
>         (l.v < s.v) AS long_lt_short_expected_false
>  FROM s, l;
>=20
> Process
>=20
>  psql -h /tmp -p 36265 -U postgres -f vuln_001.sql
>=20
> Results
>=20
>   long_gt_short_expected_true | long_lt_short_expected_false
>  -----------------------------+------------------------------
>   f                           | t
>=20
>    Both columns are inverted. long > short returned false, long <=
; short
>    returned true.

This loo= ks like a classic case of integer overflow that's
happening i= n=C2=A0ltree_compare function in ltree_op.c.

return (al-&g= t;len - bl->len) * 10 * (an + 1);
return res * 10 * (an + 1);
retu= rn (a->numlevel - b->numlevel) * 10 * (an + 1);

I think the ca= lculation should be done as int64, something of this sort:

=C2=A0 = =C2=A0 int64 v =3D (int64) (al->len - bl->len) * 10 * (an + 1);
= =C2=A0 =C2=A0 if (v > PG_INT32_MAX) return PG_INT32_MAX;
=C2=A0 =C2= =A0 if (v < PG_INT32_MIN) return PG_INT32_MIN;
=C2=A0 =C2=A0 return (= int) v;

And needed to adjust the ltree_penalty function too.

= Attached is a draft patch for this, I guess we can add a helper
f= unction too for the above conversion.

Thoughts?

Regards,
A= yush
--000000000000fb446706541c7b37-- --000000000000fb446a06541c7b39 Content-Type: application/octet-stream; name="0001-Fix-int32-overflow-in-ltree_compare.patch" Content-Disposition: attachment; filename="0001-Fix-int32-overflow-in-ltree_compare.patch" Content-Transfer-Encoding: base64 Content-ID: X-Attachment-Id: f_mqbyh3fb0 RnJvbSA1YWY4NmVlMDljYzNhMjhiMjIwNjdhZDU0MzkxOWYwY2JjYzMxMTU3IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBBeXVzaCBUaXdhcmkgPGF5dXNodGl3YXJpLnNsZzAxQGdtYWls LmNvbT4KRGF0ZTogU2F0LCAxMyBKdW4gMjAyNiAxMTozNToyMCArMDUzMApTdWJqZWN0OiBbUEFU Q0ggdjFdIEZpeCBpbnQzMiBvdmVyZmxvdyBpbiBsdHJlZV9jb21wYXJlKCkKClRoZSBleHByZXNz aW9uIChsZW5fZGlmZiAqIDEwICogKGFuICsgMSkpIHVzZWQgYXMgdGhlIHJldHVybiB2YWx1ZSBv ZgpsdHJlZV9jb21wYXJlKCkgaXMgY29tcHV0ZWQgYXQgaW50MzIgd2lkdGguICBXaXRoIExUUkVF X01BWF9MRVZFTFMgPQo2NTUzNSwgdGhlIHByb2R1Y3QgY2FuIGV4Y2VlZCBJTlQzMl9NQVggb25j ZSBhbiBsdHJlZSBoYXMgbW9yZSB0aGFuCn4xNCw2NTMgbGV2ZWxzLCB3aGljaCBjYXVzZXMgdGhl IHJlc3VsdCB0byB3cmFwIGFuZCBpbnZlcnQgaXRzIHNpZ24uClRoYXQgY29ycnVwdHMgYnRyZWUg b3JkZXJpbmcgYXMgd2VsbCBhcyB0aGUgbWFnbml0dWRlIGNvbnN1bWVkIGJ5Cmx0cmVlX3BlbmFs dHkoKSBmb3IgR2lTVCBwYWdlIHNwbGl0cy4KCldpZGVuIHRoZSBtdWx0aXBsaWNhdGlvbiB0byBp bnQ2NCBhbmQgc2F0dXJhdGUgdGhlIHJlc3VsdCB0bwpQR19JTlQzMl9NSU4gLyBQR19JTlQzMl9N QVggYmVmb3JlIHJldHVybmluZy4gIFNhdHVyYXRpb24gcHJlc2VydmVzIGJvdGgKdGhlIHNpZ24g bmVlZGVkIGJ5IGJ0cmVlIGNvbXBhcmF0b3JzIGFuZCB0aGUgImRlZXBlciBtaXNtYXRjaCB5aWVs ZHMKbGFyZ2VyIG1hZ25pdHVkZSIgcHJvcGVydHkgdXNlZCBieSBsdHJlZV9wZW5hbHR5KCkuICBS ZXR1cm5pbmcgSU5UX01JTgpmcm9tIGEgY29tcGFyYXRvciBoYXMgYmVlbiBleHBsaWNpdGx5IGFs bG93ZWQgc2luY2UgY29tbWl0IDZlNjNlMDY5NzUxLgoKbHRyZWVfcGVuYWx0eSgpIHN1bXMgdGhl IHR3byBjb21wYXJhdG9yIHJlc3VsdHMsIHNvIGEgcGFpciBvZiBzYXR1cmF0ZWQKSU5UMzJfTUFY IHZhbHVlcyB3b3VsZCByZS1vdmVyZmxvdyBpbnQzMiBhbmQgeWllbGQgYSBuZWdhdGl2ZSBwZW5h bHR5Cm9uY2UgYXNzaWduZWQgdG8gaXRzIGZsb2F0IG91dHB1dC4gIFdpZGVuIHRoYXQgc3VtIHRv IGludDY0IGJlZm9yZQpjb252ZXJ0aW5nIHRvIGZsb2F0LgoKRXhpc3RpbmcgYnRyZWUgb3IgR2lT VCBpbmRleGVzIG9uIGx0cmVlIGNvbHVtbnMgY29udGFpbmluZyB2YWx1ZXMgd2l0aAptb3JlIHRo YW4gfjE0LDY1MyBsZXZlbHMgbWF5IGJlIGNvcnJ1cHQgYW5kIHNob3VsZCBiZSBSRUlOREVYZWQu CgpBZGQgYSByZWdyZXNzaW9uIHRlc3QgYmFzZWQgb24gdGhlIHJlcG9ydGVyJ3MgUG9DLgotLS0K IGNvbnRyaWIvbHRyZWUvZXhwZWN0ZWQvbHRyZWUub3V0IHwgMTMgKysrKysrKysrKysrKwogY29u dHJpYi9sdHJlZS9sdHJlZV9naXN0LmMgICAgICAgfCAgMiArLQogY29udHJpYi9sdHJlZS9sdHJl ZV9vcC5jICAgICAgICAgfCAyOSArKysrKysrKysrKysrKysrKysrKysrKysrKy0tLQogY29udHJp Yi9sdHJlZS9zcWwvbHRyZWUuc3FsICAgICAgfCAgOSArKysrKysrKysKIDQgZmlsZXMgY2hhbmdl ZCwgNDkgaW5zZXJ0aW9ucygrKSwgNCBkZWxldGlvbnMoLSkKCmRpZmYgLS1naXQgYS9jb250cmli L2x0cmVlL2V4cGVjdGVkL2x0cmVlLm91dCBiL2NvbnRyaWIvbHRyZWUvZXhwZWN0ZWQvbHRyZWUu b3V0CmluZGV4IDE1YjkxMzFhNzUwLi45ZDgzYWEyZmE4NCAxMDA2NDQKLS0tIGEvY29udHJpYi9s dHJlZS9leHBlY3RlZC9sdHJlZS5vdXQKKysrIGIvY29udHJpYi9sdHJlZS9leHBlY3RlZC9sdHJl ZS5vdXQKQEAgLTgyMjYsMyArODIyNiwxNiBAQCBERVRBSUw6ICBUb3RhbCBzaXplIG9mIGxldmVs IGV4Y2VlZHMgdGhlIG1heGltdW0gYWxsb3dlZCAoNjU1MzUgYnl0ZXMpLgogU0VMRUNUIChyZXBl YXQoJ2F8JywgNjU1MzUpIHx8ICdhJyk6OmxxdWVyeTsKIEVSUk9SOiAgbHF1ZXJ5IGxldmVsIGhh cyB0b28gbWFueSB2YXJpYW50cwogREVUQUlMOiAgTnVtYmVyIG9mIHZhcmlhbnRzIGV4Y2VlZHMg dGhlIG1heGltdW0gYWxsb3dlZCAoNjU1MzUpLgorLS0gVGVzdCB0aGF0IGx0cmVlX2NvbXBhcmUo KSBkb2VzIG5vdCBvdmVyZmxvdyBpbnQzMiB3aXRoIHZlcnkgZGVlcCBwYXRocy4KKy0tIFdpdGhv dXQgc2F0dXJhdGlvbiwgdGhlIHByb2R1Y3QgKGxlbl9kaWZmICogMTAgKiAoYW4gKyAxKSkgd3Jh cHMgcGFzdAorLS0gSU5UMzJfTUFYIGFib3ZlIH4xNDY1MyBsZXZlbHMgYW5kIHRoZSBzaWduIG9m IHRoZSByZXN1bHQgaXMgaW52ZXJ0ZWQsCistLSB3aGljaCBjb3JydXB0cyBidHJlZSBvcmRlcmlu ZyBhbmQgR2lTVCBwYWdlIHNwbGl0cy4KK1dJVEggcyBBUyAoU0VMRUNUICdhJzo6bHRyZWUgQVMg diksCisgICAgIGwgQVMgKFNFTEVDVCAocmVwZWF0KCdhLicsIDE0OTk5KSB8fCAnYScpOjpsdHJl ZSBBUyB2KQorU0VMRUNUIChsLnYgPiBzLnYpIEFTIGd0X29rLCAobC52IDwgcy52KSBBUyBsdF9v aywgKGwudiA9IHMudikgQVMgZXFfb2sKKyAgRlJPTSBzLCBsOworIGd0X29rIHwgbHRfb2sgfCBl cV9vayAKKy0tLS0tLS0rLS0tLS0tLSstLS0tLS0tCisgdCAgICAgfCBmICAgICB8IGYKKygxIHJv dykKKwpkaWZmIC0tZ2l0IGEvY29udHJpYi9sdHJlZS9sdHJlZV9naXN0LmMgYi9jb250cmliL2x0 cmVlL2x0cmVlX2dpc3QuYwppbmRleCA3OGM5NTA1Mjk5MC4uNDMzNTk3ZGUyZGEgMTAwNjQ0Ci0t LSBhL2NvbnRyaWIvbHRyZWUvbHRyZWVfZ2lzdC5jCisrKyBiL2NvbnRyaWIvbHRyZWUvbHRyZWVf Z2lzdC5jCkBAIC0yNzAsNyArMjcwLDcgQEAgbHRyZWVfcGVuYWx0eShQR19GVU5DVElPTl9BUkdT KQogCWNtcGwgPSBsdHJlZV9jb21wYXJlKExUR19HRVRMTk9ERShvcmlndmFsLCBzaWdsZW4pLCBM VEdfR0VUTE5PREUobmV3dmFsLCBzaWdsZW4pKTsKIAljbXByID0gbHRyZWVfY29tcGFyZShMVEdf R0VUUk5PREUobmV3dmFsLCBzaWdsZW4pLCBMVEdfR0VUUk5PREUob3JpZ3ZhbCwgc2lnbGVuKSk7 CiAKLQkqcGVuYWx0eSA9IE1heChjbXBsLCAwKSArIE1heChjbXByLCAwKTsKKwkqcGVuYWx0eSA9 IChmbG9hdCkgKChpbnQ2NCkgTWF4KGNtcGwsIDApICsgKGludDY0KSBNYXgoY21wciwgMCkpOwog CiAJUEdfUkVUVVJOX1BPSU5URVIocGVuYWx0eSk7CiB9CmRpZmYgLS1naXQgYS9jb250cmliL2x0 cmVlL2x0cmVlX29wLmMgYi9jb250cmliL2x0cmVlL2x0cmVlX29wLmMKaW5kZXggYzFmYzc3ZmM4 MDQuLmYyZjVhZDlmZDBmIDEwMDY0NAotLS0gYS9jb250cmliL2x0cmVlL2x0cmVlX29wLmMKKysr IGIvY29udHJpYi9sdHJlZS9sdHJlZV9vcC5jCkBAIC01NywxNSArNTcsMzAgQEAgbHRyZWVfY29t cGFyZShjb25zdCBsdHJlZSAqYSwgY29uc3QgbHRyZWUgKmIpCiAJCWlmICgocmVzID0gbWVtY21w KGFsLT5uYW1lLCBibC0+bmFtZSwgTWluKGFsLT5sZW4sIGJsLT5sZW4pKSkgPT0gMCkKIAkJewog CQkJaWYgKGFsLT5sZW4gIT0gYmwtPmxlbikKLQkJCQlyZXR1cm4gKGFsLT5sZW4gLSBibC0+bGVu KSAqIDEwICogKGFuICsgMSk7CisJCQl7CisJCQkJaW50NjQJCXYgPSAoaW50NjQpIChhbC0+bGVu IC0gYmwtPmxlbikgKiAxMCAqIChhbiArIDEpOworCisJCQkJaWYgKHYgPiBQR19JTlQzMl9NQVgp CisJCQkJCXJldHVybiBQR19JTlQzMl9NQVg7CisJCQkJaWYgKHYgPCBQR19JTlQzMl9NSU4pCisJ CQkJCXJldHVybiBQR19JTlQzMl9NSU47CisJCQkJcmV0dXJuIChpbnQzMikgdjsKKwkJCX0KIAkJ fQogCQllbHNlCiAJCXsKKwkJCWludDY0CQl2OworCiAJCQlpZiAocmVzIDwgMCkKIAkJCQlyZXMg PSAtMTsKIAkJCWVsc2UKIAkJCQlyZXMgPSAxOwotCQkJcmV0dXJuIHJlcyAqIDEwICogKGFuICsg MSk7CisJCQl2ID0gKGludDY0KSByZXMgKiAxMCAqIChhbiArIDEpOworCQkJaWYgKHYgPiBQR19J TlQzMl9NQVgpCisJCQkJcmV0dXJuIFBHX0lOVDMyX01BWDsKKwkJCWlmICh2IDwgUEdfSU5UMzJf TUlOKQorCQkJCXJldHVybiBQR19JTlQzMl9NSU47CisJCQlyZXR1cm4gKGludDMyKSB2OwogCQl9 CiAKIAkJYW4tLTsKQEAgLTc0LDcgKzg5LDE1IEBAIGx0cmVlX2NvbXBhcmUoY29uc3QgbHRyZWUg KmEsIGNvbnN0IGx0cmVlICpiKQogCQlibCA9IExFVkVMX05FWFQoYmwpOwogCX0KIAotCXJldHVy biAoYS0+bnVtbGV2ZWwgLSBiLT5udW1sZXZlbCkgKiAxMCAqIChhbiArIDEpOworCXsKKwkJaW50 NjQJCXYgPSAoaW50NjQpIChhLT5udW1sZXZlbCAtIGItPm51bWxldmVsKSAqIDEwICogKGFuICsg MSk7CisKKwkJaWYgKHYgPiBQR19JTlQzMl9NQVgpCisJCQlyZXR1cm4gUEdfSU5UMzJfTUFYOwor CQlpZiAodiA8IFBHX0lOVDMyX01JTikKKwkJCXJldHVybiBQR19JTlQzMl9NSU47CisJCXJldHVy biAoaW50MzIpIHY7CisJfQogfQogCiAjZGVmaW5lIFJVTkNNUAkJCQkJCVwKZGlmZiAtLWdpdCBh L2NvbnRyaWIvbHRyZWUvc3FsL2x0cmVlLnNxbCBiL2NvbnRyaWIvbHRyZWUvc3FsL2x0cmVlLnNx bAppbmRleCBkMGZhZGU5ZDE3ZC4uM2U5YzFmZjc5ZWUgMTAwNjQ0Ci0tLSBhL2NvbnRyaWIvbHRy ZWUvc3FsL2x0cmVlLnNxbAorKysgYi9jb250cmliL2x0cmVlL3NxbC9sdHJlZS5zcWwKQEAgLTQ3 NywzICs0NzcsMTIgQEAgU0VMRUNUIChyZXBlYXQoJ3gnLCAyNTUpIHx8IHJlcGVhdCgnfCcgfHwg cmVwZWF0KCd4JywgMjU1KSwgMjU2KSk6OmxxdWVyeTsKIC0tLSBUZXN0IGZvciBvdmVyZmxvdyBv ZiBscXVlcnlfbGV2ZWwubnVtdmFyLCB3aXRoIGEgc2V0IG9mIHNpbmdsZS1jaGFyCiAtLS0gdmFy aWFudHMgaW4gb25lIGxldmVsLgogU0VMRUNUIChyZXBlYXQoJ2F8JywgNjU1MzUpIHx8ICdhJyk6 OmxxdWVyeTsKKworLS0gVGVzdCB0aGF0IGx0cmVlX2NvbXBhcmUoKSBkb2VzIG5vdCBvdmVyZmxv dyBpbnQzMiB3aXRoIHZlcnkgZGVlcCBwYXRocy4KKy0tIFdpdGhvdXQgc2F0dXJhdGlvbiwgdGhl IHByb2R1Y3QgKGxlbl9kaWZmICogMTAgKiAoYW4gKyAxKSkgd3JhcHMgcGFzdAorLS0gSU5UMzJf TUFYIGFib3ZlIH4xNDY1MyBsZXZlbHMgYW5kIHRoZSBzaWduIG9mIHRoZSByZXN1bHQgaXMgaW52 ZXJ0ZWQsCistLSB3aGljaCBjb3JydXB0cyBidHJlZSBvcmRlcmluZyBhbmQgR2lTVCBwYWdlIHNw bGl0cy4KK1dJVEggcyBBUyAoU0VMRUNUICdhJzo6bHRyZWUgQVMgdiksCisgICAgIGwgQVMgKFNF TEVDVCAocmVwZWF0KCdhLicsIDE0OTk5KSB8fCAnYScpOjpsdHJlZSBBUyB2KQorU0VMRUNUIChs LnYgPiBzLnYpIEFTIGd0X29rLCAobC52IDwgcy52KSBBUyBsdF9vaywgKGwudiA9IHMudikgQVMg ZXFfb2sKKyAgRlJPTSBzLCBsOwotLSAKMi4zNC4xCgo= --000000000000fb446a06541c7b39--