MIME-Version: 1.0
References: 
 <CAOYmi+=KTLd+XsEP=TDiZ48iVf-CEc7JrZd5uhWPYWKEfOgyyQ@mail.gmail.com>
In-Reply-To: 
 <CAOYmi+=KTLd+XsEP=TDiZ48iVf-CEc7JrZd5uhWPYWKEfOgyyQ@mail.gmail.com>
From: Jacob Champion <jacob.champion@enterprisedb.com>
Date: Thu, 25 Jun 2026 17:12:42 -0700
Message-ID: 
 <CAOYmi+n_hw=SC5V1i3BmqfZPfPBRaUSJc+BeOXEKDwRue+WYrg@mail.gmail.com>
Subject: Re: REVOKE's CASCADE protection doesn't work with INHERITed table
 owners
To: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Content-Type: multipart/mixed; boundary="0000000000004d4bc806551cf86f"
Archived-At: 
 <https://www.postgresql.org/message-id/CAOYmi%2Bn_hw%3DSC5V1i3BmqfZPfPBRaUSJc%2BBeOXEKDwRue%2BWYrg%40mail.gmail.com>
Precedence: bulk

--0000000000004d4bc806551cf86f
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

[moving to -hackers]

On Wed, Jun 24, 2026 at 2:57=E2=80=AFPM Jacob Champion
<jacob.champion@enterprisedb.com> wrote:
> TL;DR: The protection in recursive_revoke() against broken GRANT
> OPTION chains doesn't seem to work properly when the grantee also
> holds the privileges of the grantor.

More accurately: "when an intermediate grantor in the chain only
indirectly holds the ability to grant."

> I think the issue is in recursive_revoke()'s usage of aclmask(), which
> in turn uses has_privs_of_role(). It doesn't seem like that's what was
> wanted in this particular case... thoughts?

I propose changing that to aclmask_direct(), as in the attached, and
backpatching all the way down.

To try to prove to myself that this works, I added tests to pin each
of the three cases that are treated differently by aclmask_direct():
1. the grantor has indirect ownership privileges
2. the grantor has indirect grant options via INHERIT
3. the grantor has indirect grant options via PUBLIC (which is already
disallowed in practice)

I also tried to expand the existing comment, both to point out the
pitfall and to explain why the short-circuit works. But I've rewritten
it at least a dozen times, so if anyone can tell me whether I've made
sense and/or used the terminology appropriately, I'd appreciate it.

> I'm pretty sure the following is unintended behavior. It looks
> potentially related to [1] as well.

(To fix [1] I suspect we need to make a similar tweak to
check_circularity(), but I haven't looked into that yet.)

Thanks!
--Jacob

[1] https://postgr.es/m/CAM6Zo8wD7RtQNhbQHODc9DobiW+GpT=3DtnqOSMz4+mnzA9m0z=
Mg@mail.gmail.com

--0000000000004d4bc806551cf86f
Content-Type: application/octet-stream;
	name="v1-0001-Prevent-broken-grant-chains-when-indirect-grant-o.patch"
Content-Disposition: attachment;
	filename="v1-0001-Prevent-broken-grant-chains-when-indirect-grant-o.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mqu6crr30>
X-Attachment-Id: f_mqu6crr30

RnJvbSAxYTBjNDBlNDI1N2Q2YjFmZDE5ZDg1MDc2MWRiYmNjMjE4MDBhZWY3IE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBKYWNvYiBDaGFtcGlvbiA8amFjb2IuY2hhbXBpb25AZW50ZXJw
cmlzZWRiLmNvbT4KRGF0ZTogVGh1LCAyNSBKdW4gMjAyNiAxMToxODoyMCAtMDcwMApTdWJqZWN0
OiBbUEFUQ0ggdjFdIFByZXZlbnQgYnJva2VuIGdyYW50IGNoYWlucyB3aGVuIGluZGlyZWN0IGdy
YW50IG9wdGlvbnMKIGFyZSBoZWxkCgpyZWN1cnNpdmVfcmV2b2tlKCkgaXMgbWVhbnQgdG8gcHJv
dGVjdCBhZ2FpbnN0IGNhc2VzIHdoZXJlIGEgZ3JhbnRvcgpsb3NlcyB0aGVpciBncmFudCBvcHRp
b24gYWZ0ZXIgaXNzdWluZyBkZXBlbmRlbnQgZ3JhbnRzIHRvIG90aGVyIHJvbGVzLgpJbiB0aGF0
IGNhc2UsIHRoZSB1c2VyIG11c3Qgc3BlY2lmeSBDQVNDQURFIHRvIHBydW5lIHRoZSBkZXBlbmRl
bnQgQUNMcy4KCkhvd2V2ZXIsIGlmIGEgZ3JhbnRvciBoYXBwZW5zIHRvIGhvbGQgZ3JhbnQgb3B0
aW9ucyAob3IgdGFibGUgb3duZXJzaGlwKQppbmRpcmVjdGx5LCB3aGV0aGVyIHZpYSBJTkhFUklU
IG9yIFNVUEVSVVNFUiwgcmVjdXJzaXZlX3Jldm9rZSgpCnNob3J0LWNpcmN1aXRzIGFuZCBhbGxv
d3MgdGhlIFJFVk9LRSB0byBicmVhayB0aGUgZ3JhbnQgY2hhaW4uIFN5bXB0b21zCmluY2x1ZGUg
Z2VuZXJhbCB1c2VyIGNvbmZ1c2lvbiBhcyB3ZWxsIGFzIHByb2JsZW1zIGR1cmluZyBkdW1wL3Jl
c3RvcmUsCndoaWNoIGNhbm5vdCByZWNyZWF0ZSB0aGUgb3JpZ2luYWwgc3RhdGUuCgpUbyBmaXgs
IHN3aXRjaCBmcm9tIGFjbG1hc2soKSB0byBhY2xtYXNrX2RpcmVjdCgpLgoKRGlzY3Vzc2lvbjog
aHR0cHM6Ly9wb3N0Z3IuZXMvbS9DQU9ZbWklMkIlM0RLVExkJTJCWHNFUCUzRFREaVo0OGlWZi1D
RWM3SnJaZDV1aFdQWVdLRWZPZ3l5USU0MG1haWwuZ21haWwuY29tCkJhY2twYXRjaC10aHJvdWdo
OiAxNAotLS0KIHNyYy9iYWNrZW5kL3V0aWxzL2FkdC9hY2wuYyAgICAgICAgICAgICAgfCAxOSAr
KystLQogc3JjL3Rlc3QvcmVncmVzcy9leHBlY3RlZC9wcml2aWxlZ2VzLm91dCB8IDg4ICsrKysr
KysrKysrKysrKysrKysrKysrKwogc3JjL3Rlc3QvcmVncmVzcy9zcWwvcHJpdmlsZWdlcy5zcWwg
ICAgICB8IDQ0ICsrKysrKysrKysrKwogMyBmaWxlcyBjaGFuZ2VkLCAxNDcgaW5zZXJ0aW9ucygr
KSwgNCBkZWxldGlvbnMoLSkKCmRpZmYgLS1naXQgYS9zcmMvYmFja2VuZC91dGlscy9hZHQvYWNs
LmMgYi9zcmMvYmFja2VuZC91dGlscy9hZHQvYWNsLmMKaW5kZXggMDFjYWExMmVjYTcuLjIxYTg3
NDM5MmQ5IDEwMDY0NAotLS0gYS9zcmMvYmFja2VuZC91dGlscy9hZHQvYWNsLmMKKysrIGIvc3Jj
L2JhY2tlbmQvdXRpbHMvYWR0L2FjbC5jCkBAIC0xMDIsNiArMTAyLDggQEAgc3RhdGljIHZvaWQg
Y2hlY2tfY2lyY3VsYXJpdHkoY29uc3QgQWNsICpvbGRfYWNsLCBjb25zdCBBY2xJdGVtICptb2Rf
YWlwLAogCQkJCQkJCSAgT2lkIG93bmVySWQpOwogc3RhdGljIEFjbCAqcmVjdXJzaXZlX3Jldm9r
ZShBY2wgKmFjbCwgT2lkIGdyYW50ZWUsIEFjbE1vZGUgcmV2b2tlX3ByaXZzLAogCQkJCQkJCSBP
aWQgb3duZXJJZCwgRHJvcEJlaGF2aW9yIGJlaGF2aW9yKTsKK3N0YXRpYyBBY2xNb2RlIGFjbG1h
c2tfZGlyZWN0KGNvbnN0IEFjbCAqYWNsLCBPaWQgcm9sZWlkLCBPaWQgb3duZXJJZCwKKwkJCQkJ
CQkgIEFjbE1vZGUgbWFzaywgQWNsTWFza0hvdyBob3cpOwogCiBzdGF0aWMgQWNsTW9kZSBjb252
ZXJ0X2FueV9wcml2X3N0cmluZyh0ZXh0ICpwcml2X3R5cGVfdGV4dCwKIAkJCQkJCQkJCSAgIGNv
bnN0IHByaXZfbWFwICpwcml2aWxlZ2VzKTsKQEAgLTEzNDQsMTAgKzEzNDYsMTkgQEAgcmVjdXJz
aXZlX3Jldm9rZShBY2wgKmFjbCwKIAlpZiAoZ3JhbnRlZSA9PSBvd25lcklkKQogCQlyZXR1cm4g
YWNsOwogCi0JLyogVGhlIGdyYW50ZWUgbWlnaHQgc3RpbGwgaGF2ZSBzb21lIGdyYW50IG9wdGlv
bnMgdmlhIGFub3RoZXIgZ3JhbnRvciAqLwotCXN0aWxsX2hhcyA9IGFjbG1hc2soYWNsLCBncmFu
dGVlLCBvd25lcklkLAotCQkJCQkJQUNMX0dSQU5UX09QVElPTl9GT1IocmV2b2tlX3ByaXZzKSwK
LQkJCQkJCUFDTE1BU0tfQUxMKTsKKwkvKgorCSAqIFRoZSBncmFudGVlIG1pZ2h0IHN0aWxsIGhh
dmUgc29tZSBncmFudCBvcHRpb25zIHZpYSBhbm90aGVyIGdyYW50b3IsCisJICoga2VlcGluZyB0
aGUgY2hhaW4gaW50YWN0IGZvciB0aG9zZSBwcml2aWxlZ2VzLiBBbmQgaWYgX2FsbF8gb2YgdGhl
CisJICogcmVtYWluaW5nIHByaXZpbGVnZXMgY2FuIHN0aWxsIGJlIGdyYW50ZWQgYnkgYW55IHJv
bGUgb24gdGhlIGNoYWluLAorCSAqIHdlJ3JlIGRvbmUuCisJICoKKwkgKiBJbmRpcmVjdGx5IGhl
bGQgZ3JhbnQgb3B0aW9ucyBjYW5ub3Qga2VlcCB0aGUgY2hhaW4gYWxpdmUsIHNvIGNvbnN1bHQK
KwkgKiBhY2xtYXNrX2RpcmVjdCgpIHJhdGhlciB0aGFuIGFjbG1hc2soKS4gKE90aGVyd2lzZSwg
Zm9yIGV4YW1wbGUsIGEKKwkgKiBjaGFpbiBjb3VsZCBiZSBicm9rZW4gd2hlcmV2ZXIgdGhlIGdy
YW50ZWUgd2FzIGEgc3VwZXJ1c2VyKS4KKwkgKi8KKwlzdGlsbF9oYXMgPSBhY2xtYXNrX2RpcmVj
dChhY2wsIGdyYW50ZWUsIG93bmVySWQsCisJCQkJCQkJICAgQUNMX0dSQU5UX09QVElPTl9GT1Io
cmV2b2tlX3ByaXZzKSwKKwkJCQkJCQkgICBBQ0xNQVNLX0FMTCk7CiAJcmV2b2tlX3ByaXZzICY9
IH5BQ0xfT1BUSU9OX1RPX1BSSVZTKHN0aWxsX2hhcyk7CiAJaWYgKHJldm9rZV9wcml2cyA9PSBB
Q0xfTk9fUklHSFRTKQogCQlyZXR1cm4gYWNsOwpkaWZmIC0tZ2l0IGEvc3JjL3Rlc3QvcmVncmVz
cy9leHBlY3RlZC9wcml2aWxlZ2VzLm91dCBiL3NyYy90ZXN0L3JlZ3Jlc3MvZXhwZWN0ZWQvcHJp
dmlsZWdlcy5vdXQKaW5kZXggZjZjYzFhMTAyOWMuLjY4NDBmZjk1MGM2IDEwMDY0NAotLS0gYS9z
cmMvdGVzdC9yZWdyZXNzL2V4cGVjdGVkL3ByaXZpbGVnZXMub3V0CisrKyBiL3NyYy90ZXN0L3Jl
Z3Jlc3MvZXhwZWN0ZWQvcHJpdmlsZWdlcy5vdXQKQEAgLTE4NjIsNiArMTg2Miw4IEBAIENSRUFU
RSBUQUJMRSBhdGVzdDQgKGEgaW50KTsKIEdSQU5UIFNFTEVDVCBPTiBhdGVzdDQgVE8gcmVncmVz
c19wcml2X3VzZXIyIFdJVEggR1JBTlQgT1BUSU9OOwogR1JBTlQgVVBEQVRFIE9OIGF0ZXN0NCBU
TyByZWdyZXNzX3ByaXZfdXNlcjI7CiBHUkFOVCBTRUxFQ1QgT04gYXRlc3Q0IFRPIEdST1VQIHJl
Z3Jlc3NfcHJpdl9ncm91cDEgV0lUSCBHUkFOVCBPUFRJT047CitHUkFOVCBTRUxFQ1QgT04gYXRl
c3Q0IFRPIFBVQkxJQyBXSVRIIEdSQU5UIE9QVElPTjsgLS0gZmFpbAorRVJST1I6ICBncmFudCBv
cHRpb25zIGNhbiBvbmx5IGJlIGdyYW50ZWQgdG8gcm9sZXMKIFNFVCBTRVNTSU9OIEFVVEhPUkla
QVRJT04gcmVncmVzc19wcml2X3VzZXIyOwogR1JBTlQgU0VMRUNUIE9OIGF0ZXN0NCBUTyByZWdy
ZXNzX3ByaXZfdXNlcjM7CiBHUkFOVCBVUERBVEUgT04gYXRlc3Q0IFRPIHJlZ3Jlc3NfcHJpdl91
c2VyMzsgLS0gZmFpbApAQCAtMTg5Niw2ICsxODk4LDkxIEBAIFNFTEVDVCBoYXNfdGFibGVfcHJp
dmlsZWdlKCdyZWdyZXNzX3ByaXZfdXNlcjEnLCAnYXRlc3Q0JywgJ1NFTEVDVCBXSVRIIEdSQU5U
IE9QCiAgdAogKDEgcm93KQogCistLSBUZXN0IEdSQU5UIE9QVElPTiBjaGFpbnMgd2hlcmUgdGhl
IGludGVybWVkaWF0ZSBncmFudG9yIGhhcyB0aGUgcHJpdmlsZWdlcyBvZgorLS0gdGhlIG93bmVy
IChyZWdyZXNzX3ByaXZfZ3JvdXAxIC0+IHJlZ3Jlc3NfcHJpdl91c2VyNCAtPiByZWdyZXNzX3By
aXZfdXNlcjIpCistLSBvciBpbmhlcml0cyB0aGUgb3B0aW9uIChyZWdyZXNzX3ByaXZfZ3JvdXAy
IC0+IHJlZ3Jlc3NfcHJpdl91c2VyMSAtPgorLS0gcmVncmVzc19wcml2X3VzZXIzKS4KKy0tIHBp
biB0aGUgZ3JvdXAgbWVtYmVyc2hpcCB0aGF0IHdlIHJlbHkgb24gYmVsb3cKK1NFTEVDVCBwZ19o
YXNfcm9sZSgncmVncmVzc19wcml2X3VzZXI0JywgJ3JlZ3Jlc3NfcHJpdl9ncm91cDEnLCAnTUVN
QkVSJyksCisJICAgcGdfaGFzX3JvbGUoJ3JlZ3Jlc3NfcHJpdl91c2VyMScsICdyZWdyZXNzX3By
aXZfZ3JvdXAyJywgJ01FTUJFUicpOworIHBnX2hhc19yb2xlIHwgcGdfaGFzX3JvbGUgCistLS0t
LS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0KKyB0ICAgICAgICAgICB8IHQKKygxIHJvdykKKworU0VU
IFNFU1NJT04gQVVUSE9SSVpBVElPTiByZWdyZXNzX3ByaXZfZ3JvdXAxOworQ1JFQVRFIFRBQkxF
IGF0ZXN0NF9ncm91cG93bmVkIChhIGludCk7CitHUkFOVCBTRUxFQ1QgT04gYXRlc3Q0X2dyb3Vw
b3duZWQgVE8gcmVncmVzc19wcml2X3VzZXI0IFdJVEggR1JBTlQgT1BUSU9OOworR1JBTlQgVVBE
QVRFIE9OIGF0ZXN0NF9ncm91cG93bmVkIFRPIHJlZ3Jlc3NfcHJpdl9ncm91cDIgV0lUSCBHUkFO
VCBPUFRJT047CitHUkFOVCBVUERBVEUgT04gYXRlc3Q0X2dyb3Vwb3duZWQgVE8gcmVncmVzc19w
cml2X3VzZXIxIFdJVEggR1JBTlQgT1BUSU9OOworU0VUIFNFU1NJT04gQVVUSE9SSVpBVElPTiBy
ZWdyZXNzX3ByaXZfdXNlcjQ7CitHUkFOVCBTRUxFQ1QgT04gYXRlc3Q0X2dyb3Vwb3duZWQgVE8g
cmVncmVzc19wcml2X3VzZXIyOworU0VUIFNFU1NJT04gQVVUSE9SSVpBVElPTiByZWdyZXNzX3By
aXZfdXNlcjE7CitHUkFOVCBVUERBVEUgT04gYXRlc3Q0X2dyb3Vwb3duZWQgVE8gcmVncmVzc19w
cml2X3VzZXIzOworU0VUIFNFU1NJT04gQVVUSE9SSVpBVElPTiByZWdyZXNzX3ByaXZfZ3JvdXAx
OworUkVWT0tFIFNFTEVDVCBPTiBhdGVzdDRfZ3JvdXBvd25lZCBGUk9NIHJlZ3Jlc3NfcHJpdl91
c2VyNDsgLS0gZmFpbAorRVJST1I6ICBkZXBlbmRlbnQgcHJpdmlsZWdlcyBleGlzdAorSElOVDog
IFVzZSBDQVNDQURFIHRvIHJldm9rZSB0aGVtIHRvby4KK1NFTEVDVCBoYXNfdGFibGVfcHJpdmls
ZWdlKCdyZWdyZXNzX3ByaXZfdXNlcjInLCAnYXRlc3Q0X2dyb3Vwb3duZWQnLCAnU0VMRUNUJyk7
IC0tIHRydWUKKyBoYXNfdGFibGVfcHJpdmlsZWdlIAorLS0tLS0tLS0tLS0tLS0tLS0tLS0tCisg
dAorKDEgcm93KQorCitTRUxFQ1QgaGFzX3RhYmxlX3ByaXZpbGVnZSgncmVncmVzc19wcml2X3Vz
ZXI0JywgJ2F0ZXN0NF9ncm91cG93bmVkJywgJ1NFTEVDVCcpOyAtLSB0cnVlCisgaGFzX3RhYmxl
X3ByaXZpbGVnZSAKKy0tLS0tLS0tLS0tLS0tLS0tLS0tLQorIHQKKygxIHJvdykKKworUkVWT0tF
IFNFTEVDVCBPTiBhdGVzdDRfZ3JvdXBvd25lZCBGUk9NIHJlZ3Jlc3NfcHJpdl91c2VyNCBDQVND
QURFOyAtLSBvaworU0VMRUNUIGhhc190YWJsZV9wcml2aWxlZ2UoJ3JlZ3Jlc3NfcHJpdl91c2Vy
MicsICdhdGVzdDRfZ3JvdXBvd25lZCcsICdTRUxFQ1QnKTsgLS0gZmFsc2UKKyBoYXNfdGFibGVf
cHJpdmlsZWdlIAorLS0tLS0tLS0tLS0tLS0tLS0tLS0tCisgZgorKDEgcm93KQorCitTRUxFQ1Qg
aGFzX3RhYmxlX3ByaXZpbGVnZSgncmVncmVzc19wcml2X3VzZXI0JywgJ2F0ZXN0NF9ncm91cG93
bmVkJywgJ1NFTEVDVCcpOyAtLSBzdGlsbCB0cnVlIChpbmhlcml0ZWQpCisgaGFzX3RhYmxlX3By
aXZpbGVnZSAKKy0tLS0tLS0tLS0tLS0tLS0tLS0tLQorIHQKKygxIHJvdykKKworUkVWT0tFIFVQ
REFURSBPTiBhdGVzdDRfZ3JvdXBvd25lZCBGUk9NIHJlZ3Jlc3NfcHJpdl91c2VyMTsgLS0gZmFp
bAorRVJST1I6ICBkZXBlbmRlbnQgcHJpdmlsZWdlcyBleGlzdAorSElOVDogIFVzZSBDQVNDQURF
IHRvIHJldm9rZSB0aGVtIHRvby4KK1NFTEVDVCBoYXNfdGFibGVfcHJpdmlsZWdlKCdyZWdyZXNz
X3ByaXZfdXNlcjMnLCAnYXRlc3Q0X2dyb3Vwb3duZWQnLCAnVVBEQVRFJyk7IC0tIHRydWUKKyBo
YXNfdGFibGVfcHJpdmlsZWdlIAorLS0tLS0tLS0tLS0tLS0tLS0tLS0tCisgdAorKDEgcm93KQor
CitTRUxFQ1QgaGFzX3RhYmxlX3ByaXZpbGVnZSgncmVncmVzc19wcml2X3VzZXIxJywgJ2F0ZXN0
NF9ncm91cG93bmVkJywgJ1VQREFURScpOyAtLSB0cnVlCisgaGFzX3RhYmxlX3ByaXZpbGVnZSAK
Ky0tLS0tLS0tLS0tLS0tLS0tLS0tLQorIHQKKygxIHJvdykKKworUkVWT0tFIFVQREFURSBPTiBh
dGVzdDRfZ3JvdXBvd25lZCBGUk9NIHJlZ3Jlc3NfcHJpdl91c2VyMSBDQVNDQURFOyAtLSBvawor
U0VMRUNUIGhhc190YWJsZV9wcml2aWxlZ2UoJ3JlZ3Jlc3NfcHJpdl91c2VyMycsICdhdGVzdDRf
Z3JvdXBvd25lZCcsICdVUERBVEUnKTsgLS0gZmFsc2UKKyBoYXNfdGFibGVfcHJpdmlsZWdlIAor
LS0tLS0tLS0tLS0tLS0tLS0tLS0tCisgZgorKDEgcm93KQorCitTRUxFQ1QgaGFzX3RhYmxlX3By
aXZpbGVnZSgncmVncmVzc19wcml2X3VzZXIxJywgJ2F0ZXN0NF9ncm91cG93bmVkJywgJ1VQREFU
RScpOyAtLSBzdGlsbCB0cnVlIChpbmhlcml0ZWQpCisgaGFzX3RhYmxlX3ByaXZpbGVnZSAKKy0t
LS0tLS0tLS0tLS0tLS0tLS0tLQorIHQKKygxIHJvdykKKworUkVWT0tFIFVQREFURSBPTiBhdGVz
dDRfZ3JvdXBvd25lZCBGUk9NIHJlZ3Jlc3NfcHJpdl9ncm91cDIgUkVTVFJJQ1Q7IC0tIG9rCitT
RUxFQ1QgaGFzX3RhYmxlX3ByaXZpbGVnZSgncmVncmVzc19wcml2X3VzZXIxJywgJ2F0ZXN0NF9n
cm91cG93bmVkJywgJ1VQREFURScpOyAtLSBmYWxzZQorIGhhc190YWJsZV9wcml2aWxlZ2UgCist
LS0tLS0tLS0tLS0tLS0tLS0tLS0KKyBmCisoMSByb3cpCisKIC0tIHNlY3VyaXR5LXJlc3RyaWN0
ZWQgb3BlcmF0aW9ucwogXGMgLQogQ1JFQVRFIFJPTEUgcmVncmVzc19zcm9fdXNlcjsKQEAgLTMy
OTYsNiArMzM4Myw3IEBAIERST1AgVEFCTEUgYXRlc3QxOwogRFJPUCBUQUJMRSBhdGVzdDI7CiBE
Uk9QIFRBQkxFIGF0ZXN0MzsKIERST1AgVEFCTEUgYXRlc3Q0OworRFJPUCBUQUJMRSBhdGVzdDRf
Z3JvdXBvd25lZDsKIERST1AgVEFCTEUgYXRlc3Q1OwogRFJPUCBUQUJMRSBhdGVzdDY7CiBEUk9Q
IFRBQkxFIGF0ZXN0YzsKZGlmZiAtLWdpdCBhL3NyYy90ZXN0L3JlZ3Jlc3Mvc3FsL3ByaXZpbGVn
ZXMuc3FsIGIvc3JjL3Rlc3QvcmVncmVzcy9zcWwvcHJpdmlsZWdlcy5zcWwKaW5kZXggNmNkOWJi
ODQwZmYuLmM5ZjgwYmE4OThiIDEwMDY0NAotLS0gYS9zcmMvdGVzdC9yZWdyZXNzL3NxbC9wcml2
aWxlZ2VzLnNxbAorKysgYi9zcmMvdGVzdC9yZWdyZXNzL3NxbC9wcml2aWxlZ2VzLnNxbApAQCAt
MTIwNSw2ICsxMjA1LDcgQEAgQ1JFQVRFIFRBQkxFIGF0ZXN0NCAoYSBpbnQpOwogR1JBTlQgU0VM
RUNUIE9OIGF0ZXN0NCBUTyByZWdyZXNzX3ByaXZfdXNlcjIgV0lUSCBHUkFOVCBPUFRJT047CiBH
UkFOVCBVUERBVEUgT04gYXRlc3Q0IFRPIHJlZ3Jlc3NfcHJpdl91c2VyMjsKIEdSQU5UIFNFTEVD
VCBPTiBhdGVzdDQgVE8gR1JPVVAgcmVncmVzc19wcml2X2dyb3VwMSBXSVRIIEdSQU5UIE9QVElP
TjsKK0dSQU5UIFNFTEVDVCBPTiBhdGVzdDQgVE8gUFVCTElDIFdJVEggR1JBTlQgT1BUSU9OOyAt
LSBmYWlsCiAKIFNFVCBTRVNTSU9OIEFVVEhPUklaQVRJT04gcmVncmVzc19wcml2X3VzZXIyOwog
CkBAIC0xMjIyLDYgKzEyMjMsNDggQEAgU0VMRUNUIGhhc190YWJsZV9wcml2aWxlZ2UoJ3JlZ3Jl
c3NfcHJpdl91c2VyMycsICdhdGVzdDQnLCAnU0VMRUNUJyk7IC0tIGZhbHNlCiAKIFNFTEVDVCBo
YXNfdGFibGVfcHJpdmlsZWdlKCdyZWdyZXNzX3ByaXZfdXNlcjEnLCAnYXRlc3Q0JywgJ1NFTEVD
VCBXSVRIIEdSQU5UIE9QVElPTicpOyAtLSB0cnVlCiAKKy0tIFRlc3QgR1JBTlQgT1BUSU9OIGNo
YWlucyB3aGVyZSB0aGUgaW50ZXJtZWRpYXRlIGdyYW50b3IgaGFzIHRoZSBwcml2aWxlZ2VzIG9m
CistLSB0aGUgb3duZXIgKHJlZ3Jlc3NfcHJpdl9ncm91cDEgLT4gcmVncmVzc19wcml2X3VzZXI0
IC0+IHJlZ3Jlc3NfcHJpdl91c2VyMikKKy0tIG9yIGluaGVyaXRzIHRoZSBvcHRpb24gKHJlZ3Jl
c3NfcHJpdl9ncm91cDIgLT4gcmVncmVzc19wcml2X3VzZXIxIC0+CistLSByZWdyZXNzX3ByaXZf
dXNlcjMpLgorCistLSBwaW4gdGhlIGdyb3VwIG1lbWJlcnNoaXAgdGhhdCB3ZSByZWx5IG9uIGJl
bG93CitTRUxFQ1QgcGdfaGFzX3JvbGUoJ3JlZ3Jlc3NfcHJpdl91c2VyNCcsICdyZWdyZXNzX3By
aXZfZ3JvdXAxJywgJ01FTUJFUicpLAorCSAgIHBnX2hhc19yb2xlKCdyZWdyZXNzX3ByaXZfdXNl
cjEnLCAncmVncmVzc19wcml2X2dyb3VwMicsICdNRU1CRVInKTsKKworU0VUIFNFU1NJT04gQVVU
SE9SSVpBVElPTiByZWdyZXNzX3ByaXZfZ3JvdXAxOworCitDUkVBVEUgVEFCTEUgYXRlc3Q0X2dy
b3Vwb3duZWQgKGEgaW50KTsKKworR1JBTlQgU0VMRUNUIE9OIGF0ZXN0NF9ncm91cG93bmVkIFRP
IHJlZ3Jlc3NfcHJpdl91c2VyNCBXSVRIIEdSQU5UIE9QVElPTjsKK0dSQU5UIFVQREFURSBPTiBh
dGVzdDRfZ3JvdXBvd25lZCBUTyByZWdyZXNzX3ByaXZfZ3JvdXAyIFdJVEggR1JBTlQgT1BUSU9O
OworR1JBTlQgVVBEQVRFIE9OIGF0ZXN0NF9ncm91cG93bmVkIFRPIHJlZ3Jlc3NfcHJpdl91c2Vy
MSBXSVRIIEdSQU5UIE9QVElPTjsKKworU0VUIFNFU1NJT04gQVVUSE9SSVpBVElPTiByZWdyZXNz
X3ByaXZfdXNlcjQ7CisKK0dSQU5UIFNFTEVDVCBPTiBhdGVzdDRfZ3JvdXBvd25lZCBUTyByZWdy
ZXNzX3ByaXZfdXNlcjI7CisKK1NFVCBTRVNTSU9OIEFVVEhPUklaQVRJT04gcmVncmVzc19wcml2
X3VzZXIxOworCitHUkFOVCBVUERBVEUgT04gYXRlc3Q0X2dyb3Vwb3duZWQgVE8gcmVncmVzc19w
cml2X3VzZXIzOworCitTRVQgU0VTU0lPTiBBVVRIT1JJWkFUSU9OIHJlZ3Jlc3NfcHJpdl9ncm91
cDE7CisKK1JFVk9LRSBTRUxFQ1QgT04gYXRlc3Q0X2dyb3Vwb3duZWQgRlJPTSByZWdyZXNzX3By
aXZfdXNlcjQ7IC0tIGZhaWwKK1NFTEVDVCBoYXNfdGFibGVfcHJpdmlsZWdlKCdyZWdyZXNzX3By
aXZfdXNlcjInLCAnYXRlc3Q0X2dyb3Vwb3duZWQnLCAnU0VMRUNUJyk7IC0tIHRydWUKK1NFTEVD
VCBoYXNfdGFibGVfcHJpdmlsZWdlKCdyZWdyZXNzX3ByaXZfdXNlcjQnLCAnYXRlc3Q0X2dyb3Vw
b3duZWQnLCAnU0VMRUNUJyk7IC0tIHRydWUKK1JFVk9LRSBTRUxFQ1QgT04gYXRlc3Q0X2dyb3Vw
b3duZWQgRlJPTSByZWdyZXNzX3ByaXZfdXNlcjQgQ0FTQ0FERTsgLS0gb2sKK1NFTEVDVCBoYXNf
dGFibGVfcHJpdmlsZWdlKCdyZWdyZXNzX3ByaXZfdXNlcjInLCAnYXRlc3Q0X2dyb3Vwb3duZWQn
LCAnU0VMRUNUJyk7IC0tIGZhbHNlCitTRUxFQ1QgaGFzX3RhYmxlX3ByaXZpbGVnZSgncmVncmVz
c19wcml2X3VzZXI0JywgJ2F0ZXN0NF9ncm91cG93bmVkJywgJ1NFTEVDVCcpOyAtLSBzdGlsbCB0
cnVlIChpbmhlcml0ZWQpCisKK1JFVk9LRSBVUERBVEUgT04gYXRlc3Q0X2dyb3Vwb3duZWQgRlJP
TSByZWdyZXNzX3ByaXZfdXNlcjE7IC0tIGZhaWwKK1NFTEVDVCBoYXNfdGFibGVfcHJpdmlsZWdl
KCdyZWdyZXNzX3ByaXZfdXNlcjMnLCAnYXRlc3Q0X2dyb3Vwb3duZWQnLCAnVVBEQVRFJyk7IC0t
IHRydWUKK1NFTEVDVCBoYXNfdGFibGVfcHJpdmlsZWdlKCdyZWdyZXNzX3ByaXZfdXNlcjEnLCAn
YXRlc3Q0X2dyb3Vwb3duZWQnLCAnVVBEQVRFJyk7IC0tIHRydWUKK1JFVk9LRSBVUERBVEUgT04g
YXRlc3Q0X2dyb3Vwb3duZWQgRlJPTSByZWdyZXNzX3ByaXZfdXNlcjEgQ0FTQ0FERTsgLS0gb2sK
K1NFTEVDVCBoYXNfdGFibGVfcHJpdmlsZWdlKCdyZWdyZXNzX3ByaXZfdXNlcjMnLCAnYXRlc3Q0
X2dyb3Vwb3duZWQnLCAnVVBEQVRFJyk7IC0tIGZhbHNlCitTRUxFQ1QgaGFzX3RhYmxlX3ByaXZp
bGVnZSgncmVncmVzc19wcml2X3VzZXIxJywgJ2F0ZXN0NF9ncm91cG93bmVkJywgJ1VQREFURScp
OyAtLSBzdGlsbCB0cnVlIChpbmhlcml0ZWQpCitSRVZPS0UgVVBEQVRFIE9OIGF0ZXN0NF9ncm91
cG93bmVkIEZST00gcmVncmVzc19wcml2X2dyb3VwMiBSRVNUUklDVDsgLS0gb2sKK1NFTEVDVCBo
YXNfdGFibGVfcHJpdmlsZWdlKCdyZWdyZXNzX3ByaXZfdXNlcjEnLCAnYXRlc3Q0X2dyb3Vwb3du
ZWQnLCAnVVBEQVRFJyk7IC0tIGZhbHNlCiAKIC0tIHNlY3VyaXR5LXJlc3RyaWN0ZWQgb3BlcmF0
aW9ucwogXGMgLQpAQCAtMTk1NSw2ICsxOTk4LDcgQEAgRFJPUCBUQUJMRSBhdGVzdDE7CiBEUk9Q
IFRBQkxFIGF0ZXN0MjsKIERST1AgVEFCTEUgYXRlc3QzOwogRFJPUCBUQUJMRSBhdGVzdDQ7CitE
Uk9QIFRBQkxFIGF0ZXN0NF9ncm91cG93bmVkOwogRFJPUCBUQUJMRSBhdGVzdDU7CiBEUk9QIFRB
QkxFIGF0ZXN0NjsKIERST1AgVEFCTEUgYXRlc3RjOwotLSAKMi4zNC4xCgo=
--0000000000004d4bc806551cf86f--