Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1tauQS-006HUr-KN for pgsql-hackers@arkaria.postgresql.org; Thu, 23 Jan 2025 10:27:05 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1tauQR-00DZBP-9Y for pgsql-hackers@arkaria.postgresql.org; Thu, 23 Jan 2025 10:27:03 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1tauQQ-00DZ83-Lz for pgsql-hackers@lists.postgresql.org; Thu, 23 Jan 2025 10:27:02 +0000 Received: from mail-ed1-x52f.google.com ([2a00:1450:4864:20::52f]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.96) (envelope-from ) id 1tauQN-0014g4-2d for pgsql-hackers@lists.postgresql.org; Thu, 23 Jan 2025 10:27:01 +0000 Received: by mail-ed1-x52f.google.com with SMTP id 4fb4d7f45d1cf-5d3d0205bd5so1167776a12.3 for ; Thu, 23 Jan 2025 02:27:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cybertec.at; s=google; t=1737628019; x=1738232819; darn=lists.postgresql.org; h=mime-version:user-agent:references:in-reply-to:date:cc:to:from :subject:message-id:from:to:cc:subject:date:message-id:reply-to; bh=LK+DjOG0SGNtjHB8pgQHST6kwS/b5KqXMR2OjuQcOcg=; b=TZlfQjsQSJrsnA24i1JdLNNOVkItJYoXOGZgFG8iymz53JLml0MIsjlxDwwyx4zRQe xTF4FtU9+jGAQ7qeQ2xQ2hEebKNRTFAh1HLD4u4KcpQPvIVrsl2LZG6fbJSjy5yTNLaj faTS5pxngof8ic0Y3yy00cWz2HcxgxFmo4Omz0MaXnybLLzN9bCncRNbF6NKRn6uxNLP 5ZVR2zAI3w871HAkfT4rkGCpRXC8hNjalK14C+sguWs85NE5BhcXkea3HALjc6YHZYWP t+FX/N9Mpr0wvIysVsWA9nYFKDJgkAM8vZXVof9Cn8aIpaHn7wC/zQ9rZY89dQXetLCk GFlg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1737628019; x=1738232819; h=mime-version:user-agent:references:in-reply-to:date:cc:to:from :subject:message-id:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=LK+DjOG0SGNtjHB8pgQHST6kwS/b5KqXMR2OjuQcOcg=; b=hL2ECEWZFanUBdkOo/wsRGARLCji7geDSkCTcYQ0/Fpu6iHpZRw6U5K92sTnS8TK6R lD8Zj1Kq8iy1Ww8jrWDBH+VyFq3zY+fCAXt3qFTThB5Z3mn6qYcOe32EgK8x1dREv644 IipF3BrPnz4oRNV9kjCz0GLGOu3pn0NGo8zutZhCEtCBLA3r5i4y4AQaQx+TJUmzdoJW yhCb4TVXVU33mlu4oP35G41E1lZxn5hRnhXEUp+FOJmYUsdRz/xoqBA/CwQBYDBTATPE QBC1iKSEcxBN/au20e7vclmzO24ywZYcBIRAsHLdiX9MSMT0xT1pwJyyKHgTdkpHxCOa EIdw== X-Forwarded-Encrypted: i=1; AJvYcCWdPB8Z/0F8QuA6klug2JREXGmxitljb7qmSk4AQrG8QDDHMBXunhrg6UBhQG+u6C5A7bdkoS7MXH9PZEcV@lists.postgresql.org X-Gm-Message-State: AOJu0Yz3E/Gx5hv5GKmPIVFQrH4BIjru+AzSJqpf+R++Eyh5YeOwfpB2 cn/BZuDO4DyDe1+1lknIoH89q/xhZYIWSnCU794TWJIrFebwZwpJoxEDBkXhqow= X-Gm-Gg: ASbGncs4DJ3NJUzxze4lEL+7VvBcIr7CjlOHntZDeVeYKSgq1ChaPWXUy6JCBjcmMvJ rj4WXfgiBX2lvEpKIuAjleuMC0QZlwQtnHPXCWUCCA8MKhWfBpr/iNltB2cuefQKu90qn5WPTqB r5TonOP4J1TRe8Wi056K3CLQNyMI0ek0JpIgfJZ1PWeouUZXbc/xmtYktJSfJDQaM1EDq1ihbOj dTAxb1pxkTPLvw1aXAE93a2A/Lo8ywRiQDeEb0whG4Pq+KdBxwcmG+5qtkzLUniLMpquG2UpUu7 fm2f9Nn0sbMMvCmtOBFZ3Mus X-Google-Smtp-Source: AGHT+IF3ZVPwIOGFEHplTlEGkUM0b3DoWZdgXcOuAxJCGi9mCSxRZTjfamfEh/jQ69rhbXrELsex7w== X-Received: by 2002:a05:6402:4306:b0:5d9:f362:1682 with SMTP id 4fb4d7f45d1cf-5db7db13a5emr24460442a12.24.1737628018669; Thu, 23 Jan 2025 02:26:58 -0800 (PST) Received: from localhost.localdomain ([88.116.133.170]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-5db73683d79sm9805223a12.37.2025.01.23.02.26.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jan 2025 02:26:58 -0800 (PST) Message-ID: <3e4c8fe7adce2e3956e01bae8f1754830bd2d2bf.camel@cybertec.at> Subject: Re: Wrong security context for deferred triggers? From: Laurenz Albe To: Tom Lane Cc: Pavel Stehule , pgsql-hackers@lists.postgresql.org Date: Thu, 23 Jan 2025 11:26:57 +0100 In-Reply-To: <3944969.1737570355@sss.pgh.pa.us> References: <77ee784cf248e842f74588418f55c2931e47bd78.camel@cybertec.at> <6f27f51bc98354d7254bbde1c171fa13aca03f28.camel@cybertec.at> <77b89e609f21380785865542609fbc14010021c8.camel@cybertec.at> <3f0a08f3e3d445137ae287125bc8c1a007045db8.camel@cybertec.at> <66021ca9d81c4e1a22b6c417659b05424e130f27.camel@cybertec.at> <6bca669972ef0d4a665fa83c5b751ab116324f8f.camel@cybertec.at> <2653121.1730737337@sss.pgh.pa.us> <51386e72c47d922ef68eaa67451a52dc3f569843.camel@cybertec.at> <3944969.1737570355@sss.pgh.pa.us> Content-Type: multipart/mixed; boundary="=-2h3EWaR2JIDWTlu9mNnS" User-Agent: Evolution 3.54.3 (3.54.3-1.fc41) MIME-Version: 1.0 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --=-2h3EWaR2JIDWTlu9mNnS Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 2025-01-22 at 13:25 -0500, Tom Lane wrote: > Laurenz Albe writes: > > [ v4-0001-Make-AFTER-triggers-run-with-the-correct-user.patch ] >=20 > I started to look at this and got distracted by wondering why > afterTriggerAddEvent's scanning loop wasn't checking ats_modifiedcols. > That led to ea68ea632, which means this now needs a minor rebase. Thanks for your efforts! > I have a couple other thoughts: >=20 > * It's kind of sad that we have to add yet another field to > AfterTriggerSharedData, especially since this one will cost 8 bytes > thanks to alignment considerations. I'm not sure if there's another > way, but it seems like ats_relid, ats_rolid, and ats_modifiedcols > are all going to be extremely redundant in typical scenarios. > Maybe it's worth rethinking that data structure a bit? Or maybe > I'm worried over nothing; perhaps normal situations have only a few > AfterTriggerSharedDatas anyway. It might be worth trying to gather > some statistics about that. Thanks for investigating that as well. That matches my intuition that you typically don't run hundreds of different AFTER triggers in a single transaction. What about partitioned tables with hundreds of partitions? Could that be a problem? But then 100 times 8 bytes is still not a lot these days. > * I don't buy the bit about "We have to check if the role still > exists"; I think that's just a waste of cycles. There is no check > that prevents dropping the role a session is currently running as, > so why do we need one here? Moreover, the role could still get > dropped immediately after you look. Or for that matter, save_rolid > could be invalid by the time you restore it. None of this bothers me, > because if a session is running as a dropped role it will still > function pretty normally. It will find that it has no privileges > beyond those granted to PUBLIC, and if it tries to inspect > current_user or related functions those will fail, but there's > no compromise to system integrity. So I'd just remove that test. That makes sense to me. I was worried that it may lead to cryptic, hard-to-debug errors later on. Version 5 of the patch is attached. Yours, Laurenz Albe --=-2h3EWaR2JIDWTlu9mNnS Content-Disposition: attachment; filename="v5-0001-Make-AFTER-triggers-run-with-the-correct-user.patch" Content-Type: text/x-patch; name="v5-0001-Make-AFTER-triggers-run-with-the-correct-user.patch"; charset="UTF-8" Content-Transfer-Encoding: base64 RnJvbSAyM2RkODYzMGMwOTEyMGQ4MmExMWI1MzM0ZjhlZGExNDdmMTIyYmVhIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBMYXVyZW56IEFsYmUgPGxhdXJlbnouYWxiZUBjeWJlcnRlYy5h dD4KRGF0ZTogVGh1LCAyMyBKYW4gMjAyNSAxMToxOTozNiArMDEwMApTdWJqZWN0OiBbUEFUQ0gg djVdIE1ha2UgQUZURVIgdHJpZ2dlcnMgcnVuIHdpdGggdGhlIGNvcnJlY3QgdXNlcgoKV2l0aCBk ZWZlcnJlZCB0cmlnZ2VycywgaXQgaXMgcG9zc2libGUgdGhhdCB0aGUgY3VycmVudCByb2xlIGNo YW5nZXMKYmV0d2VlbiB0aGUgdGltZSB3aGVuIHRoZSB0cmlnZ2VyIGlzIHF1ZXVlZCBhbmQgdGhl IHRpbWUgaXQgaXMKZXhlY3V0ZWQgKGZvciBleGFtcGxlLCB0aGUgdHJpZ2dlcmluZyBkYXRhIG1v ZGlmaWNhdGlvbiBjb3VsZCBoYXZlIGJlZW4KZXhlY3V0ZWQgaW4gYSBTRUNVUklUWSBERUZJTkVS IGZ1bmN0aW9uKS4KClVwIHRvIG5vdywgZGVmZXJyZWQgdHJpZ2dlciBmdW5jdGlvbnMgd291bGQg cnVuIHdpdGggdGhlIGN1cnJlbnQgcm9sZQpzZXQgdG8gd2hhdGV2ZXIgd2FzIGFjdGl2ZSBhdCBj b21taXQgdGltZS4gIFRoYXQgZG9lcyBub3QgbWF0dGVyIGZvcgpyZWd1bGFyIGNvbnN0cmFpbnRz LCB3aG9zZSBjb3JyZWN0bmVzcyBkb2Vzbid0IGRlcGVuZCBvbiB0aGUgY3VycmVudApyb2xlLiAg QnV0IGZvciB1c2VyLXdyaXR0ZW4gY29udHJhaW50IHRyaWdnZXJzLCB0aGUgY3VycmVudCByb2xl CmNlcnRhaW5seSBtYXR0ZXJzLgoKU2VjdXJpdHkgY29uc2lkZXJhdGlvbnM6Ci0gVGhlIHRyaWdn ZXIgZnVuY3Rpb24gY291bGQgYmUgbW9kaWZpZWQgYmV0d2VlbiB0aGUgdGltZSB0aGUgdHJpZ2dl cgogIGlzIHF1ZXVlZCBhbmQgdGhlIHRpbWUgaXQgcnVucy4gIElmIHRoZSB0cmlnZ2VyIHdhcyBl eGVjdXRlZCBieSBhCiAgcHJpdmlsZWdlZCB1c2VyLCB0aGUgbmV3IGJlaGF2aW9yIGNvdWxkIGJl IHVzZWQgZm9yIHByaXZpbGVnZQogIGVzY2FsYXRpb24uICBCdXQgaWYgYSBwcml2aWxlZ2VkIHVz ZXIgZXhlY3V0ZXMgRE1MIG9uIGEgdGFibGUgb3duZWQKICBieSBhbiB1bnRydXN0ZWQgdXNlciwg YWxsIGJldHMgYXJlIG9mZiBhbnl3YXkgLS0tIHRoZSBtYWxpY2lvdXMgY29kZQogIGNvdWxkIGFz IHdlbGwgYmUgaW4gdGhlIHRyaWdnZXIgZnVuY3Rpb24gZnJvbSB0aGUgYmVnaW5uaW5nLgogIFNv IHdlIGRvbid0IGNvbnNpZGVyIHRoaXMgYSBzZWN1cml0eSBoYXphcmQuCi0gVGhlIHByZXZpb3Vz IGJlaGF2aW9yIGNvdWxkIGxlYWQgdG8gY29kZSBpbmFkdmVydGVudGx5IHJ1bm5pbmcgd2l0aAog IGVsZXZhdGVkIHByaXZpbGVnZXMgaWYgYSBwcml2aWxlZ2VkIHVzZXIgdGVtcG9yYXJpbHkgYXNz dW1lcyBsb3dlcgogIHByaXZpbGVnZXMgd2hpbGUgZXhlY3V0aW5nIERNTCBvbiBhbiB1bnRydXN0 ZWQgdGFibGUsIGJ1dCB0aGUgZGVmZXJyZWQKICB0cmlnZ2VyIHJ1bnMgd2l0aCB0aGUgdXNlcidz IG9yaWdpbmFsIHByaXZpbGVnZXMuICBBbHNvLCB0aGF0IG9ubHkKICBhcHBsaWVzIGlmIHRoZSBw cml2aWxlZ2VkIHVzZXIgY29tbWl0cyAqYWZ0ZXIqIHJlc3VtaW5nIHRoZSBvcmlnaW5hbAogIHJv bGUuICBUaGlzIHNob3VsZCBiZSBzZWVuIGFzIGRlbGliZXJhdGUgc2VsZi1kYW1hZ2UgcmF0aGVy IHRoYW4gYQogIHNlY3VyaXR5IHByb2JsZW0uCgpBdXRob3I6IExhdXJlbnogQWxiZQpSZXZpZXdl ZC1CeTogUGF2ZWwgU3RlaHVsZSwgSm9zZXBoIEtvc2hha293LCBJc2FhYyBNb3JsYW5kCkRpc2N1 c3Npb246IGh0dHBzOi8vcG9zdGdyLmVzL20vNzdlZTc4NGNmMjQ4ZTg0MmY3NDU4ODQxOGY1NWMy OTMxZTQ3YmQ3OC5jYW1lbCU0MGN5YmVydGVjLmF0Ci0tLQogZG9jL3NyYy9zZ21sL3RyaWdnZXIu c2dtbCAgICAgICAgICAgICAgfCAgNCArKwogc3JjL2JhY2tlbmQvY29tbWFuZHMvdHJpZ2dlci5j ICAgICAgICAgfCAyMCArKysrKysrCiBzcmMvdGVzdC9yZWdyZXNzL2V4cGVjdGVkL3RyaWdnZXJz Lm91dCB8IDgxICsrKysrKysrKysrKysrKysrKysrKysrKysrCiBzcmMvdGVzdC9yZWdyZXNzL3Nx bC90cmlnZ2Vycy5zcWwgICAgICB8IDc1ICsrKysrKysrKysrKysrKysrKysrKysrKwogNCBmaWxl cyBjaGFuZ2VkLCAxODAgaW5zZXJ0aW9ucygrKQoKZGlmZiAtLWdpdCBhL2RvYy9zcmMvc2dtbC90 cmlnZ2VyLnNnbWwgYi9kb2Mvc3JjL3NnbWwvdHJpZ2dlci5zZ21sCmluZGV4IGE5YWJhYWI5MDU2 Li5jM2MwZmFmN2ExYiAxMDA2NDQKLS0tIGEvZG9jL3NyYy9zZ21sL3RyaWdnZXIuc2dtbAorKysg Yi9kb2Mvc3JjL3NnbWwvdHJpZ2dlci5zZ21sCkBAIC0xMjksNiArMTI5LDEwIEBACiAgICAgSW4g YWxsIGNhc2VzLCBhIHRyaWdnZXIgaXMgZXhlY3V0ZWQgYXMgcGFydCBvZiB0aGUgc2FtZSB0cmFu c2FjdGlvbiBhcwogICAgIHRoZSBzdGF0ZW1lbnQgdGhhdCB0cmlnZ2VyZWQgaXQsIHNvIGlmIGVp dGhlciB0aGUgc3RhdGVtZW50IG9yIHRoZQogICAgIHRyaWdnZXIgY2F1c2VzIGFuIGVycm9yLCB0 aGUgZWZmZWN0cyBvZiBib3RoIHdpbGwgYmUgcm9sbGVkIGJhY2suCisgICAgQWxzbywgdGhlIHRy aWdnZXIgd2lsbCBhbHdheXMgcnVuIGluIHRoZSBzZWN1cml0eSBjb250ZXh0IG9mIHRoZSByb2xl CisgICAgdGhhdCBleGVjdXRlZCB0aGUgc3RhdGVtZW50IHRoYXQgY2F1c2VkIHRoZSB0cmlnZ2Vy IHRvIGZpcmUsIHVubGVzcworICAgIHRoZSB0cmlnZ2VyIGZ1bmN0aW9uIGlzIGRlZmluZWQgYXMg PGxpdGVyYWw+U0VDVVJJVFkgREVGSU5FUjwvbGl0ZXJhbD4sCisgICAgaW4gd2hpY2ggY2FzZSBp dCB3aWxsIHJ1biBhcyB0aGUgZnVuY3Rpb24gb3duZXIuCiAgICA8L3BhcmE+CiAKICAgIDxwYXJh PgpkaWZmIC0tZ2l0IGEvc3JjL2JhY2tlbmQvY29tbWFuZHMvdHJpZ2dlci5jIGIvc3JjL2JhY2tl bmQvY29tbWFuZHMvdHJpZ2dlci5jCmluZGV4IDFmYTYzYWI3ZDBmLi44ZjljZGYxNDA2NyAxMDA2 NDQKLS0tIGEvc3JjL2JhY2tlbmQvY29tbWFuZHMvdHJpZ2dlci5jCisrKyBiL3NyYy9iYWNrZW5k L2NvbW1hbmRzL3RyaWdnZXIuYwpAQCAtMzYzNSw2ICszNjM1LDcgQEAgdHlwZWRlZiBzdHJ1Y3Qg QWZ0ZXJUcmlnZ2VyU2hhcmVkRGF0YQogCVRyaWdnZXJFdmVudCBhdHNfZXZlbnQ7CQkvKiBldmVu dCB0eXBlIGluZGljYXRvciwgc2VlIHRyaWdnZXIuaCAqLwogCU9pZAkJCWF0c190Z29pZDsJCS8q IHRoZSB0cmlnZ2VyJ3MgSUQgKi8KIAlPaWQJCQlhdHNfcmVsaWQ7CQkvKiB0aGUgcmVsYXRpb24g aXQncyBvbiAqLworCU9pZAkJCWF0c19yb2xpZDsJCS8qIHJvbGUgdG8gZXhlY3V0ZSB0aGUgdHJp Z2dlciAqLwogCUNvbW1hbmRJZAlhdHNfZmlyaW5nX2lkOwkvKiBJRCBmb3IgZmlyaW5nIGN5Y2xl ICovCiAJc3RydWN0IEFmdGVyVHJpZ2dlcnNUYWJsZURhdGEgKmF0c190YWJsZTsJLyogdHJhbnNp dGlvbiB0YWJsZSBhY2Nlc3MgKi8KIAlCaXRtYXBzZXQgICphdHNfbW9kaWZpZWRjb2xzOwkvKiBt b2RpZmllZCBjb2x1bW5zICovCkBAIC00MTE2LDYgKzQxMTcsNyBAQCBhZnRlclRyaWdnZXJBZGRF dmVudChBZnRlclRyaWdnZXJFdmVudExpc3QgKmV2ZW50cywKIAkJCW5ld3NoYXJlZC0+YXRzX2Zp cmluZ19pZCA9PSAwICYmCiAJCQluZXdzaGFyZWQtPmF0c190YWJsZSA9PSBldnRzaGFyZWQtPmF0 c190YWJsZSAmJgogCQkJbmV3c2hhcmVkLT5hdHNfcmVsaWQgPT0gZXZ0c2hhcmVkLT5hdHNfcmVs aWQgJiYKKwkJCW5ld3NoYXJlZC0+YXRzX3JvbGlkID09IGV2dHNoYXJlZC0+YXRzX3JvbGlkICYm CiAJCQlibXNfZXF1YWwobmV3c2hhcmVkLT5hdHNfbW9kaWZpZWRjb2xzLAogCQkJCQkgIGV2dHNo YXJlZC0+YXRzX21vZGlmaWVkY29scykpCiAJCQlicmVhazsKQEAgLTQyOTEsNiArNDI5Myw4IEBA IEFmdGVyVHJpZ2dlckV4ZWN1dGUoRVN0YXRlICplc3RhdGUsCiAJaW50CQkJdGdpbmR4OwogCWJv b2wJCXNob3VsZF9mcmVlX3RyaWcgPSBmYWxzZTsKIAlib29sCQlzaG91bGRfZnJlZV9uZXcgPSBm YWxzZTsKKwlPaWQJCQlzYXZlX3JvbGlkOworCWludAkJCXNhdmVfc2VjX2NvbnRleHQ7CiAKIAkv KgogCSAqIExvY2F0ZSB0cmlnZ2VyIGluIHRyaWdkZXNjLiAgSXQgbWlnaHQgbm90IGJlIHByZXNl bnQsIGFuZCBpbiBmYWN0IHRoZQpAQCAtNDQ5MCw2ICs0NDk0LDE3IEBAIEFmdGVyVHJpZ2dlckV4 ZWN1dGUoRVN0YXRlICplc3RhdGUsCiAKIAlNZW1vcnlDb250ZXh0UmVzZXQocGVyX3R1cGxlX2Nv bnRleHQpOwogCisJLyoKKwkgKiBJZiB0aGUgY3VycmVudCByb2xlIHdhcyBkaWZmZXJlbnQgd2hl biB0aGUgdHJpZ2dlciBnb3QgcXVldWVkLAorCSAqIHRlbXBvcmFyaWx5IGNoYW5nZSB0aGUgY3Vy cmVudCByb2xlLiAgTm90ZSB0aGF0IHRoZSByb2xlIG1pZ2h0IGhhdmUgYmVlbgorCSAqIGRyb3Bw ZWQgc2luY2UgdGhlIHRyaWdnZXIgd2FzIHF1ZXVlZCwgYnV0IGlmIHRoYXQgaXMgYSBwcm9ibGVt LCB3ZSB3aWxsCisJICogZ2V0IGFuIGVycm9yIGxhdGVyLiAgQ2hlY2tpbmcgaGVyZSB3b3VsZCBz dGlsbCBsZWF2ZSBhIHJhY2UgY29uZGl0aW9uLgorCSAqLworCUdldFVzZXJJZEFuZFNlY0NvbnRl eHQoJnNhdmVfcm9saWQsICZzYXZlX3NlY19jb250ZXh0KTsKKwlpZiAoc2F2ZV9yb2xpZCAhPSBl dnRzaGFyZWQtPmF0c19yb2xpZCkKKwkJU2V0VXNlcklkQW5kU2VjQ29udGV4dChldnRzaGFyZWQt PmF0c19yb2xpZCwKKwkJCQkJCQkgICBzYXZlX3NlY19jb250ZXh0IHwgU0VDVVJJVFlfTE9DQUxf VVNFUklEX0NIQU5HRSk7CisKIAkvKgogCSAqIENhbGwgdGhlIHRyaWdnZXIgYW5kIHRocm93IGF3 YXkgYW55IHBvc3NpYmx5IHJldHVybmVkIHVwZGF0ZWQgdHVwbGUuCiAJICogKERvbid0IGxldCBF eGVjQ2FsbFRyaWdnZXJGdW5jIG1lYXN1cmUgRVhQTEFJTiB0aW1lLikKQEAgLTQ1MDQsNiArNDUx OSwxMCBAQCBBZnRlclRyaWdnZXJFeGVjdXRlKEVTdGF0ZSAqZXN0YXRlLAogCQlyZXR0dXBsZSAh PSBMb2NUcmlnZ2VyRGF0YS50Z19uZXd0dXBsZSkKIAkJaGVhcF9mcmVldHVwbGUocmV0dHVwbGUp OwogCisJLyogcmVzZXQgdGhlIGN1cnJlbnQgcm9sZSBpZiBuZWNlc3NhcnkgKi8KKwlpZiAoc2F2 ZV9yb2xpZCAhPSBldnRzaGFyZWQtPmF0c19yb2xpZCkKKwkJU2V0VXNlcklkQW5kU2VjQ29udGV4 dChzYXZlX3JvbGlkLCBzYXZlX3NlY19jb250ZXh0KTsKKwogCS8qCiAJICogUmVsZWFzZSByZXNv dXJjZXMKIAkgKi8KQEAgLTY0MjksNiArNjQ0OCw3IEBAIEFmdGVyVHJpZ2dlclNhdmVFdmVudChF U3RhdGUgKmVzdGF0ZSwgUmVzdWx0UmVsSW5mbyAqcmVsaW5mbywKIAkJCSh0cmlnZ2VyLT50Z2lu aXRkZWZlcnJlZCA/IEFGVEVSX1RSSUdHRVJfSU5JVERFRkVSUkVEIDogMCk7CiAJCW5ld19zaGFy ZWQuYXRzX3Rnb2lkID0gdHJpZ2dlci0+dGdvaWQ7CiAJCW5ld19zaGFyZWQuYXRzX3JlbGlkID0g UmVsYXRpb25HZXRSZWxpZChyZWwpOworCQluZXdfc2hhcmVkLmF0c19yb2xpZCA9IEdldFVzZXJJ ZCgpOwogCQluZXdfc2hhcmVkLmF0c19maXJpbmdfaWQgPSAwOwogCQlpZiAoKHRyaWdnZXItPnRn b2xkdGFibGUgfHwgdHJpZ2dlci0+dGduZXd0YWJsZSkgJiYKIAkJCXRyYW5zaXRpb25fY2FwdHVy ZSAhPSBOVUxMKQpkaWZmIC0tZ2l0IGEvc3JjL3Rlc3QvcmVncmVzcy9leHBlY3RlZC90cmlnZ2Vy cy5vdXQgYi9zcmMvdGVzdC9yZWdyZXNzL2V4cGVjdGVkL3RyaWdnZXJzLm91dAppbmRleCAwNjU3 ZGExNzU3Ny4uNmJjM2FkMWNhMTYgMTAwNjQ0Ci0tLSBhL3NyYy90ZXN0L3JlZ3Jlc3MvZXhwZWN0 ZWQvdHJpZ2dlcnMub3V0CisrKyBiL3NyYy90ZXN0L3JlZ3Jlc3MvZXhwZWN0ZWQvdHJpZ2dlcnMu b3V0CkBAIC0zNzQ4LDMgKzM3NDgsODQgQEAgSW5oZXJpdHM6IHBhcmVudAogCiBkcm9wIHRhYmxl IHBhcmVudCwgY2hpbGQ7CiBkcm9wIGZ1bmN0aW9uIGYoKTsKKy0tIHRlc3Qgd2hvIHJ1bnMgZGVm ZXJyZWQgdHJpZ2dlciBmdW5jdGlvbnMKKy0tIHNldHVwCitjcmVhdGUgcm9sZSByZWdyZXNzX2dy b290OworY3JlYXRlIHJvbGUgcmVncmVzc19vdXRpczsKK2NyZWF0ZSBmdW5jdGlvbiB3aG9hbWko KSByZXR1cm5zIHRyaWdnZXIgbGFuZ3VhZ2UgcGxwZ3NxbAorYXMgJCQKK2JlZ2luCisgIHJhaXNl IHdhcm5pbmcgJ0kgYW0gJScsIGN1cnJlbnRfdXNlcjsKKyAgcmV0dXJuIG51bGw7CitlbmQ7Cisk JDsKK2FsdGVyIGZ1bmN0aW9uIHdob2FtaSgpIG93bmVyIHRvIHJlZ3Jlc3Nfb3V0aXM7CitjcmVh dGUgdGFibGUgZGVmZXJfdHJpZyAoaWQgaW50ZWdlcik7CitncmFudCBpbnNlcnQgb24gZGVmZXJf dHJpZyB0byBwdWJsaWM7CitjcmVhdGUgY29uc3RyYWludCB0cmlnZ2VyIHdob2FtaSBhZnRlciBp bnNlcnQgb24gZGVmZXJfdHJpZworICBkZWZlcnJhYmxlIGluaXRpYWxseSBkZWZlcnJlZAorICBm b3IgZWFjaCByb3cKKyAgZXhlY3V0ZSBmdW5jdGlvbiB3aG9hbWkoKTsKKy0tIGRlZmVycmVkIHRy aWdnZXJzIG11c3QgcnVuIGFzIHRoZSB1c2VyIHRoYXQgcXVldWVkIHRoZSB0cmlnZ2VyCitiZWdp bjsKK3NldCByb2xlIHJlZ3Jlc3NfZ3Jvb3Q7CitpbnNlcnQgaW50byBkZWZlcl90cmlnIHZhbHVl cyAoMSk7CityZXNldCByb2xlOworc2V0IHJvbGUgcmVncmVzc19vdXRpczsKK2luc2VydCBpbnRv IGRlZmVyX3RyaWcgdmFsdWVzICgxKTsKK3Jlc2V0IHJvbGU7Citjb21taXQ7CitXQVJOSU5HOiAg SSBhbSByZWdyZXNzX2dyb290CitXQVJOSU5HOiAgSSBhbSByZWdyZXNzX291dGlzCistLSBtYWtl IHN1cmUgdGhhdCB0aGUgdXNlciBzdGlsbCBleGlzdHMgYXQgY29tbWl0IHRpbWUKK2JlZ2luOwor c2V0IHJvbGUgcmVncmVzc19ncm9vdDsKK2luc2VydCBpbnRvIGRlZmVyX3RyaWcgdmFsdWVzICgx KTsKK3Jlc2V0IHJvbGU7Citkcm9wIHJvbGUgcmVncmVzc19ncm9vdDsKK2RvICQkCitiZWdpbgor ICAtLSBjYXRjaCB0aGUgZXhlY3B0aW9uIGJlY2F1c2UgaXQgY29udGFpbnMgdGhlIHJvbGUgT0lE CisgIHNldCBjb25zdHJhaW50cyBhbGwgaW1tZWRpYXRlOworZXhjZXB0aW9uIHdoZW4gdW5kZWZp bmVkX29iamVjdCB0aGVuCisgIHJhaXNlIHdhcm5pbmcgJ3VzZXIgZG9lcyBub3QgZXhpc3QnOwor ZW5kOworJCQ7CitXQVJOSU5HOiAgdXNlciBkb2VzIG5vdCBleGlzdAorcm9sbGJhY2s7CistLSBz ZWN1cml0eSBkZWZpbmVyIGZ1bmN0aW9ucyBvdmVycmlkZSB0aGUgdXNlciB3aG8gcXVldWVkIHRo ZSB0cmlnZ2VyCithbHRlciBmdW5jdGlvbiB3aG9hbWkoKSBzZWN1cml0eSBkZWZpbmVyOworYmVn aW47CitzZXQgcm9sZSByZWdyZXNzX2dyb290OworaW5zZXJ0IGludG8gZGVmZXJfdHJpZyB2YWx1 ZXMgKDIpOworcmVzZXQgcm9sZTsKK2NvbW1pdDsKK1dBUk5JTkc6ICBJIGFtIHJlZ3Jlc3Nfb3V0 aXMKK2FsdGVyIGZ1bmN0aW9uIHdob2FtaSgpIHNlY3VyaXR5IGludm9rZXI7CistLSBtYWtlIHN1 cmUgdGhlIGN1cnJlbnQgdXNlciBpcyByZXNldCBvbiBlcnJvcgorY3JlYXRlIG9yIHJlcGxhY2Ug ZnVuY3Rpb24gd2hvYW1pKCkgcmV0dXJucyB0cmlnZ2VyIGxhbmd1YWdlIHBscGdzcWwKK2FzICQk CitiZWdpbgorICBwZXJmb3JtIDEgLyAwOworICByZXR1cm4gbnVsbDsKK2VuZDsKKyQkOworYmVn aW47CitzZXQgcm9sZSByZWdyZXNzX2dyb290OworaW5zZXJ0IGludG8gZGVmZXJfdHJpZyB2YWx1 ZXMgKDIpOworcmVzZXQgcm9sZTsKK2NvbW1pdDsgIC0tIGVycm9yIGV4cGVjdGVkCitFUlJPUjog IGRpdmlzaW9uIGJ5IHplcm8KK0NPTlRFWFQ6ICBTUUwgc3RhdGVtZW50ICJTRUxFQ1QgMSAvIDAi CitQTC9wZ1NRTCBmdW5jdGlvbiB3aG9hbWkoKSBsaW5lIDMgYXQgUEVSRk9STQorc2VsZWN0IGN1 cnJlbnRfdXNlciA9IHNlc3Npb25fdXNlcjsKKyA/Y29sdW1uPyAKKy0tLS0tLS0tLS0KKyB0Ciso MSByb3cpCisKKy0tIGNsZWFuIHVwCitkcm9wIHRhYmxlIGRlZmVyX3RyaWc7Citkcm9wIGZ1bmN0 aW9uIHdob2FtaSgpOworZHJvcCByb2xlIHJlZ3Jlc3Nfb3V0aXM7Citkcm9wIHJvbGUgcmVncmVz c19ncm9vdDsKZGlmZiAtLWdpdCBhL3NyYy90ZXN0L3JlZ3Jlc3Mvc3FsL3RyaWdnZXJzLnNxbCBi L3NyYy90ZXN0L3JlZ3Jlc3Mvc3FsL3RyaWdnZXJzLnNxbAppbmRleCA3ZTJmNzU5N2MxMC4uM2Y1 MjY3OThhNzcgMTAwNjQ0Ci0tLSBhL3NyYy90ZXN0L3JlZ3Jlc3Mvc3FsL3RyaWdnZXJzLnNxbAor KysgYi9zcmMvdGVzdC9yZWdyZXNzL3NxbC90cmlnZ2Vycy5zcWwKQEAgLTI4MzksMyArMjgzOSw3 OCBAQCBhbHRlciB0cmlnZ2VyIHBhcmVudHRyaWcgb24gcGFyZW50IHJlbmFtZSB0byBhbm90aGVy dHJpZzsKIAogZHJvcCB0YWJsZSBwYXJlbnQsIGNoaWxkOwogZHJvcCBmdW5jdGlvbiBmKCk7CisK Ky0tIHRlc3Qgd2hvIHJ1bnMgZGVmZXJyZWQgdHJpZ2dlciBmdW5jdGlvbnMKKy0tIHNldHVwCitj cmVhdGUgcm9sZSByZWdyZXNzX2dyb290OworY3JlYXRlIHJvbGUgcmVncmVzc19vdXRpczsKK2Ny ZWF0ZSBmdW5jdGlvbiB3aG9hbWkoKSByZXR1cm5zIHRyaWdnZXIgbGFuZ3VhZ2UgcGxwZ3NxbAor YXMgJCQKK2JlZ2luCisgIHJhaXNlIHdhcm5pbmcgJ0kgYW0gJScsIGN1cnJlbnRfdXNlcjsKKyAg cmV0dXJuIG51bGw7CitlbmQ7CiskJDsKK2FsdGVyIGZ1bmN0aW9uIHdob2FtaSgpIG93bmVyIHRv IHJlZ3Jlc3Nfb3V0aXM7CitjcmVhdGUgdGFibGUgZGVmZXJfdHJpZyAoaWQgaW50ZWdlcik7Citn cmFudCBpbnNlcnQgb24gZGVmZXJfdHJpZyB0byBwdWJsaWM7CitjcmVhdGUgY29uc3RyYWludCB0 cmlnZ2VyIHdob2FtaSBhZnRlciBpbnNlcnQgb24gZGVmZXJfdHJpZworICBkZWZlcnJhYmxlIGlu aXRpYWxseSBkZWZlcnJlZAorICBmb3IgZWFjaCByb3cKKyAgZXhlY3V0ZSBmdW5jdGlvbiB3aG9h bWkoKTsKKworLS0gZGVmZXJyZWQgdHJpZ2dlcnMgbXVzdCBydW4gYXMgdGhlIHVzZXIgdGhhdCBx dWV1ZWQgdGhlIHRyaWdnZXIKK2JlZ2luOworc2V0IHJvbGUgcmVncmVzc19ncm9vdDsKK2luc2Vy dCBpbnRvIGRlZmVyX3RyaWcgdmFsdWVzICgxKTsKK3Jlc2V0IHJvbGU7CitzZXQgcm9sZSByZWdy ZXNzX291dGlzOworaW5zZXJ0IGludG8gZGVmZXJfdHJpZyB2YWx1ZXMgKDEpOworcmVzZXQgcm9s ZTsKK2NvbW1pdDsKKworLS0gbWFrZSBzdXJlIHRoYXQgdGhlIHVzZXIgc3RpbGwgZXhpc3RzIGF0 IGNvbW1pdCB0aW1lCitiZWdpbjsKK3NldCByb2xlIHJlZ3Jlc3NfZ3Jvb3Q7CitpbnNlcnQgaW50 byBkZWZlcl90cmlnIHZhbHVlcyAoMSk7CityZXNldCByb2xlOworZHJvcCByb2xlIHJlZ3Jlc3Nf Z3Jvb3Q7CitkbyAkJAorYmVnaW4KKyAgLS0gY2F0Y2ggdGhlIGV4ZWNwdGlvbiBiZWNhdXNlIGl0 IGNvbnRhaW5zIHRoZSByb2xlIE9JRAorICBzZXQgY29uc3RyYWludHMgYWxsIGltbWVkaWF0ZTsK K2V4Y2VwdGlvbiB3aGVuIHVuZGVmaW5lZF9vYmplY3QgdGhlbgorICByYWlzZSB3YXJuaW5nICd1 c2VyIGRvZXMgbm90IGV4aXN0JzsKK2VuZDsKKyQkOworcm9sbGJhY2s7CisKKy0tIHNlY3VyaXR5 IGRlZmluZXIgZnVuY3Rpb25zIG92ZXJyaWRlIHRoZSB1c2VyIHdobyBxdWV1ZWQgdGhlIHRyaWdn ZXIKK2FsdGVyIGZ1bmN0aW9uIHdob2FtaSgpIHNlY3VyaXR5IGRlZmluZXI7CitiZWdpbjsKK3Nl dCByb2xlIHJlZ3Jlc3NfZ3Jvb3Q7CitpbnNlcnQgaW50byBkZWZlcl90cmlnIHZhbHVlcyAoMik7 CityZXNldCByb2xlOworY29tbWl0OworYWx0ZXIgZnVuY3Rpb24gd2hvYW1pKCkgc2VjdXJpdHkg aW52b2tlcjsKKworLS0gbWFrZSBzdXJlIHRoZSBjdXJyZW50IHVzZXIgaXMgcmVzZXQgb24gZXJy b3IKK2NyZWF0ZSBvciByZXBsYWNlIGZ1bmN0aW9uIHdob2FtaSgpIHJldHVybnMgdHJpZ2dlciBs YW5ndWFnZSBwbHBnc3FsCithcyAkJAorYmVnaW4KKyAgcGVyZm9ybSAxIC8gMDsKKyAgcmV0dXJu IG51bGw7CitlbmQ7CiskJDsKK2JlZ2luOworc2V0IHJvbGUgcmVncmVzc19ncm9vdDsKK2luc2Vy dCBpbnRvIGRlZmVyX3RyaWcgdmFsdWVzICgyKTsKK3Jlc2V0IHJvbGU7Citjb21taXQ7ICAtLSBl cnJvciBleHBlY3RlZAorc2VsZWN0IGN1cnJlbnRfdXNlciA9IHNlc3Npb25fdXNlcjsKKworLS0g Y2xlYW4gdXAKK2Ryb3AgdGFibGUgZGVmZXJfdHJpZzsKK2Ryb3AgZnVuY3Rpb24gd2hvYW1pKCk7 Citkcm9wIHJvbGUgcmVncmVzc19vdXRpczsKK2Ryb3Agcm9sZSByZWdyZXNzX2dyb290OwotLSAK Mi40OC4xCgo= --=-2h3EWaR2JIDWTlu9mNnS--