GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Out-of-bounds write in AST parser · Issue #104016 · python/cpython

Out-of-bounds write in AST parser #104016

New issue
Copy link
New issue
Copy link
Closed
Closed
Out-of-bounds write in AST parser#104016
Copy link
Labels
type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dumptype-securityA security issueA security issue

Description

@guidovranken
guidovranken
opened on Apr 30, 2023
Issue body actions

Crash report

Reported by OSS-Fuzz (issue 58510).

Reproducer:

import ast
ast.parse(bytes([
  0x46, 0x22, 0x76, 0x76, 0x3a, 0x6f, 0x72, 0x3a, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x77, 0x72, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x78, 0x3a, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46,
  0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46,
  0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46,
  0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46,
  0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46,
  0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46,
  0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46,
  0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46,
  0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46,
  0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x75, 0x74, 0x66, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x74, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x2d, 0x7b, 0xa7,
  0x61, 0x2d, 0xf3, 0xa0, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3,
  0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81,
  0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa1, 0x81, 0x81, 0xb5,
  0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0,
  0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81,
  0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3,
  0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81,
  0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5,
  0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0,
  0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81,
  0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3,
  0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81,
  0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x82, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5,
  0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0,
  0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81,
  0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3,
  0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81,
  0x81, 0xb5, 0xf3, 0xa1, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5,
  0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0,
  0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81,
  0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3,
  0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81,
  0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5,
  0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0,
  0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81,
  0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3,
  0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81,
  0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5,
  0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0,
  0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81,
  0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3,
  0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81,
  0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5,
  0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0,
  0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81,
  0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3,
  0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81,
  0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5,
  0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0,
  0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0xa7, 0x7b, 0x15, 0x7b, 0xc0, 0xad,
  0x7b, 0x7b, 0xc0, 0xad, 0x7b, 0x22]))

Regression range: ece20db...6be7aee

Error messages

AddressSanitizer stack trace:

==2936==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62a0000b91f4 at pc 0x000000c0a818 bp 0x7ffc21dc1e30 sp 0x7ffc21dc1e28
WRITE of size 1 at 0x62a0000b91f4 thread T0
SCARINESS: 31 (1-byte-write-heap-buffer-overflow)
    #0 0xc0a817 in tok_get_normal_mode cpython/Parser/tokenizer.c:2240:41
    #1 0xbf81d5 in tok_get cpython/Parser/tokenizer.c:2676:16
    #2 0xbf81d5 in _PyTokenizer_Get cpython/Parser/tokenizer.c:2685:18
    #3 0xb46ffa in _PyPegen_tokenize_full_source_to_check_for_errors cpython/Parser/pegen_errors.c:171:17
    #4 0xb46c26 in _Pypegen_set_syntax_error cpython/Parser/pegen_errors.c:0
    #5 0xb4313c in _PyPegen_run_parser cpython/Parser/pegen.c:858:9
    #6 0xb43a4d in _PyPegen_run_parser_from_string cpython/Parser/pegen.c:952:14
    #7 0xbf4ec7 in _PyParser_ASTFromString cpython/Parser/peg_api.c:14:21
    #8 0x95dab9 in Py_CompileStringObject cpython/Python/pythonrun.c:1771:11
    #9 0x7d8af6 in builtin_compile_impl cpython/Python/bltinmodule.c:831:14
    #10 0x7d8af6 in builtin_compile cpython/Python/clinic/bltinmodule.c.h:383:20
    #11 0xca3720 in cfunction_vectorcall_FASTCALL_KEYWORDS cpython/Objects/methodobject.c:438:24
    #12 0x5c1b88 in _PyObject_VectorcallTstate cpython/Include/internal/pycore_call.h:92:11
    #13 0x5c1b88 in PyObject_Vectorcall cpython/Objects/call.c:301:12
    #14 0x7f427f in _PyEval_EvalFrameDefault cpython/Python/bytecodes.c:2577:19
    #15 0x7e2a1f in _PyEval_EvalFrame cpython/Include/internal/pycore_ceval.h:88:16
    #16 0x7e2a1f in _PyEval_Vector cpython/Python/ceval.c:1529:12
    #17 0x5c261e in _PyFunction_Vectorcall cpython/Objects/call.c:0
    #18 0x5c193f in _PyVectorcall_Call cpython/Objects/call.c:247:16
    #19 0x5c1f22 in _PyObject_Call cpython/Objects/call.c:330:16
    #20 0x5c2a23 in PyObject_CallObject cpython/Objects/call.c:454:12
    #21 0x593bc4 in LLVMFuzzerTestOneInput python-library-fuzzers/fuzzer.cpp:134:14
    #22 0x461943 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15
    #23 0x44d0a2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6
    #24 0x45294c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9
    #25 0x47be82 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #26 0x7eafaded4082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/libc-start.c:308:16
    #27 0x44326d in _start
0x62a0000b91f4 is located 4 bytes to the right of 20464-byte region [0x62a0000b4200,0x62a0000b91f0)
allocated by thread T0 here:
    #0 0x552ad6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3
    #1 0x68ee29 in _PyMem_RawMalloc cpython/Objects/obmalloc.c:42:12
    #2 0x691e7a in PyMem_Malloc cpython/Objects/obmalloc.c:587:12
    #3 0xbf580a in tok_new cpython/Parser/tokenizer.c:74:49
    #4 0xbf580a in _PyTokenizer_FromString cpython/Parser/tokenizer.c:884:29
    #5 0xb43752 in _PyPegen_run_parser_from_string cpython/Parser/pegen.c:929:15
    #6 0xbf4ec7 in _PyParser_ASTFromString cpython/Parser/peg_api.c:14:21
    #7 0x95dab9 in Py_CompileStringObject cpython/Python/pythonrun.c:1771:11
    #8 0x7d8af6 in builtin_compile_impl cpython/Python/bltinmodule.c:831:14
    #9 0x7d8af6 in builtin_compile cpython/Python/clinic/bltinmodule.c.h:383:20
    #10 0xca3720 in cfunction_vectorcall_FASTCALL_KEYWORDS cpython/Objects/methodobject.c:438:24
    #11 0x5c1b88 in _PyObject_VectorcallTstate cpython/Include/internal/pycore_call.h:92:11
    #12 0x5c1b88 in PyObject_Vectorcall cpython/Objects/call.c:301:12
    #13 0x7f427f in _PyEval_EvalFrameDefault cpython/Python/bytecodes.c:2577:19
    #14 0x7e2a1f in _PyEval_EvalFrame cpython/Include/internal/pycore_ceval.h:88:16
    #15 0x7e2a1f in _PyEval_Vector cpython/Python/ceval.c:1529:12
    #16 0x5c261e in _PyFunction_Vectorcall cpython/Objects/call.c:0
    #17 0x5c193f in _PyVectorcall_Call cpython/Objects/call.c:247:16
    #18 0x5c1f22 in _PyObject_Call cpython/Objects/call.c:330:16
    #19 0x5c2a23 in PyObject_CallObject cpython/Objects/call.c:454:12
    #20 0x593bc4 in LLVMFuzzerTestOneInput python-library-fuzzers/fuzzer.cpp:134:14
    #21 0x461943 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15
    #22 0x44d0a2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6
    #23 0x45294c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9
    #24 0x47be82 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #25 0x7eafaded4082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/libc-start.c:308:16

Your environment

Linux x64, latest cpython main branch checkout.

Linked PRs

  • gh-104016: Fixed off by 1 error in f string tokenizer #104047
  • gh-104016: Skip test for deeply neste f-strings on wasi #104071

Activity

  1. guidovranken
    added
    type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
    on Apr 30, 2023
  2. alex
    added
    type-securityA security issueA security issue
    on Apr 30, 2023
  3. alex commented on Apr 30, 2023

    @alex
    alex
    on Apr 30, 2023
    Member
    More actions

    I'm guessing this is related to 1ef61cf and d4aa857

    cc: @pablogsal, @lysnikolaou, @isidentical, @mgmacias95, @sunmy2019

  4. sunmy2019 commented on Apr 30, 2023

    @sunmy2019
    sunmy2019
    on Apr 30, 2023
    Member
    More actions

    The overflow should be caught by an assert.

    cpython/Parser/tokenizer.c

    Lines 49 to 53 in 7d3931e

    static inline tokenizer_mode* TOK_NEXT_MODE(struct tok_state* tok) {
    assert(tok->tok_mode_stack_index >= 0);
    assert(tok->tok_mode_stack_index < MAXLEVEL);
    return &(tok->tok_mode_stack[++tok->tok_mode_stack_index]);
    }

    Should be

    -     assert(tok->tok_mode_stack_index < MAXLEVEL); 
    +     assert(tok->tok_mode_stack_index + 1 < MAXLEVEL); 

    Some code paths do not guard tok->tok_mode_stack_index.

  5. sunmy2019 commented on Apr 30, 2023

    @sunmy2019
    sunmy2019
    on Apr 30, 2023
    Member
    More actions

    The tok->level checks on reading ( or {, while f" increases on tok->tok_mode_stack_index. Adding one more check here should solve the problem.

    Simplified test case:

    import ast
    ast.parse('f"{1 1:' + ('{f"1:' * 199))

    By the way, OSS-Fuzz is amazing at finding bugs! It's just hard to solve them. 😢

    Reacted by Guido Vranken
  6. pablogsal
    added 2 commits that reference this issue on May 1, 2023

    gh-104016: Fixed off by 1 error in f string tokenizer (#104047)

    5078eed

    pythongh-104016: Skip test for deeply neste f-strings on wasi

    1796a64
  7. carljm
    added a commit that references this issue on May 1, 2023

    Merge branch 'main' into inlinecomp2

    1274e2b
  8. pablogsal
    added 2 commits that reference this issue on May 1, 2023

    pythongh-104016: Skip test for deeply neste f-strings on wasi

    52671f9

    gh-104016: Skip test for deeply neste f-strings on wasi (#104071)

    b1ca34d
  9. guidovranken commented on May 2, 2023

    @guidovranken
    guidovranken
    on May 2, 2023
    Author
    More actions

    OSS-Fuzz has detected this as being fixed, so closing this issue.

    Reacted by sunmy2019 and Oleg Iarygin
  10. guidovranken
    closed this as completedon May 2, 2023
  11. pablogsal commented on May 2, 2023

    @pablogsal
    pablogsal
    on May 2, 2023
    Member
    More actions

    Thanks a lot for opening the issue!

    Btw, @guidovranken there is any place where we can keep track of the OSS-Fuzz detections/tickets?

  12. guidovranken commented on May 2, 2023

    @guidovranken
    guidovranken
    on May 2, 2023
    Author
    More actions

    I can add people to the auto_ccs: https://github.com/google/oss-fuzz/blob/2647d8ae7c23f45d6078756d9de1ab0eec02dcc9/projects/python3-libraries/project.yaml#L5-L8

    Please give me the email addresses of all the recipients you would like to add. Note that:

    • These addressess will be public (they are stored in the project.yaml file in the oss-fuzz repository)
    • The addresses must be linked to a Google account in order to see detailed bug reports on https://oss-fuzz.com/
  13. pablogsal commented on May 2, 2023

    @pablogsal
    pablogsal
    on May 2, 2023
    Member
    More actions

    Please give me the email addresses of all the recipients you would like to add. Note that:

    Add this one for the time being: [email protected]

  14. guidovranken commented on May 2, 2023

    @guidovranken
    guidovranken
    on May 2, 2023
    Author
    More actions

    Done. You should be able to log in to https://oss-fuzz.com/ 24 hours (or so) after that PR is merged.

    The fuzzer harnesses are here: https://github.com/guidovranken/python-library-fuzzers , if you can think of an improvement feel free to submit a PR.

  15. carljm
    added 2 commits that reference this issue on May 2, 2023

    Merge branch 'main' into inlinecomp2

    0727d6f

    Merge branch 'main' into cached_property_docs

    b9c39e3
  16. jonathanmetzman
    added a commit that references this issue on May 3, 2023

    [python3-libraries] Add Python team member (#10214)

    76e0b59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dumptype-securityA security issueA security issue

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      You are visitor 01402503 — GeezerVison does not store the pages you look up.
      Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.